ocx 1.3.0 → 1.3.2

package/dist/index.js

@@ -10501,7 +10501,8 @@ var ghostConfigSchema = exports_external.object({
     "opencode.json"
   ]).describe("Glob patterns to exclude from the symlink farm"),
   include: exports_external.array(globPatternSchema).default([]).describe("Glob patterns to re-include from excluded set (for power users)"),
-  renameWindow: exports_external.boolean().default(true).describe("Set terminal/tmux window name when launching OpenCode")
+  renameWindow: exports_external.boolean().default(true).describe("Set terminal/tmux window name when launching OpenCode"),
+  maxFiles: exports_external.number().int().min(0, "maxFiles must be non-negative").default(1e4).describe("Maximum files to process (0 = unlimited)")
 });
 
 // src/utils/errors.ts
@@ -10511,7 +10512,8 @@ var EXIT_CODES = {
   NOT_FOUND: 66,
   NETWORK: 69,
   CONFIG: 78,
-  INTEGRITY: 1
+  INTEGRITY: 1,
+  FILE_LIMIT: 74
 };
 
 class OCXError extends Error {
@@ -10586,6 +10588,17 @@ class GhostConfigError extends OCXError {
   }
 }
 
+class FileLimitExceededError extends OCXError {
+  count;
+  limit;
+  constructor(count, limit) {
+    super(`File limit exceeded: found ${count} entries (limit: ${limit}). ` + `To fix: add exclude patterns to ghost.jsonc, or set "maxFiles" to a higher value (0 = unlimited).`, "FILE_LIMIT", EXIT_CODES.FILE_LIMIT);
+    this.count = count;
+    this.limit = limit;
+    this.name = "FileLimitExceededError";
+  }
+}
+
 class ProfileNotFoundError extends OCXError {
   constructor(name) {
     super(`Profile "${name}" not found`, "NOT_FOUND", EXIT_CODES.NOT_FOUND);
@@ -10686,7 +10699,8 @@ var DEFAULT_GHOST_CONFIG = {
     "opencode.json"
   ],
   include: [],
-  renameWindow: true
+  renameWindow: true,
+  maxFiles: 1e4
 };
 
 class ProfileManager {
@@ -10880,7 +10894,7 @@ class GhostConfigProvider {
 // package.json
 var package_default = {
   name: "ocx",
-  version: "1.3.0",
+  version: "1.3.2",
   description: "OCX CLI - ShadCN-style registry for OpenCode extensions. Install agents, plugins, skills, and MCP servers.",
   author: "kdcokenny",
   license: "MIT",
@@ -11020,13 +11034,13 @@ async function fetchFileContent(baseUrl, componentName, filePath) {
   return response.text();
 }
 
-// ../../node_modules/.bun/remeda@2.33.0/node_modules/remeda/dist/lazyDataLastImpl-DtF3cihj.js
+// ../../node_modules/.bun/remeda@2.33.1/node_modules/remeda/dist/lazyDataLastImpl-DtF3cihj.js
 function e(e2, t, n) {
   let r = (n2) => e2(n2, ...t);
   return n === undefined ? r : Object.assign(r, { lazy: n, lazyArgs: t });
 }
 
-// ../../node_modules/.bun/remeda@2.33.0/node_modules/remeda/dist/purry-GjwKKIlp.js
+// ../../node_modules/.bun/remeda@2.33.1/node_modules/remeda/dist/purry-GjwKKIlp.js
 function t(t2, n, r) {
   let i = t2.length - n.length;
   if (i === 0)
@@ -11036,7 +11050,7 @@ function t(t2, n, r) {
   throw Error(`Wrong number of arguments`);
 }
 
-// ../../node_modules/.bun/remeda@2.33.0/node_modules/remeda/dist/isPlainObject.js
+// ../../node_modules/.bun/remeda@2.33.1/node_modules/remeda/dist/isPlainObject.js
 function e2(e3) {
   if (typeof e3 != `object` || !e3)
     return false;
@@ -11044,7 +11058,7 @@ function e2(e3) {
   return t2 === null || t2 === Object.prototype;
 }
 
-// ../../node_modules/.bun/remeda@2.33.0/node_modules/remeda/dist/mergeDeep.js
+// ../../node_modules/.bun/remeda@2.33.1/node_modules/remeda/dist/mergeDeep.js
 function n(...t2) {
   return t(r, t2);
 }
@@ -13770,7 +13784,7 @@ function registerBuildCommand(program2) {
   });
 }
 
-// ../../node_modules/.bun/diff@8.0.2/node_modules/diff/libesm/diff/base.js
+// ../../node_modules/.bun/diff@8.0.3/node_modules/diff/libesm/diff/base.js
 class Diff {
   diff(oldStr, newStr, options2 = {}) {
     let callback;
@@ -13970,12 +13984,12 @@ class Diff {
   }
 }
 
-// ../../node_modules/.bun/diff@8.0.2/node_modules/diff/libesm/diff/character.js
+// ../../node_modules/.bun/diff@8.0.3/node_modules/diff/libesm/diff/character.js
 class CharacterDiff extends Diff {
 }
 var characterDiff = new CharacterDiff;
 
-// ../../node_modules/.bun/diff@8.0.2/node_modules/diff/libesm/util/string.js
+// ../../node_modules/.bun/diff@8.0.3/node_modules/diff/libesm/util/string.js
 function longestCommonPrefix(str1, str2) {
   let i;
   for (i = 0;i < str1.length && i < str2.length; i++) {
@@ -14071,8 +14085,8 @@ function leadingWs(string) {
   return match ? match[0] : "";
 }
 
-// ../../node_modules/.bun/diff@8.0.2/node_modules/diff/libesm/diff/word.js
-var extendedWordChars = "a-zA-Z0-9_\\u{C0}-\\u{FF}\\u{D8}-\\u{F6}\\u{F8}-\\u{2C6}\\u{2C8}-\\u{2D7}\\u{2DE}-\\u{2FF}\\u{1E00}-\\u{1EFF}";
+// ../../node_modules/.bun/diff@8.0.3/node_modules/diff/libesm/diff/word.js
+var extendedWordChars = "a-zA-Z0-9_\\u{AD}\\u{C0}-\\u{D6}\\u{D8}-\\u{F6}\\u{F8}-\\u{2C6}\\u{2C8}-\\u{2D7}\\u{2DE}-\\u{2FF}\\u{1E00}-\\u{1EFF}";
 var tokenizeIncludingWhitespace = new RegExp(`[${extendedWordChars}]+|\\s+|[^${extendedWordChars}]`, "ug");
 
 class WordDiff extends Diff {
@@ -14090,7 +14104,15 @@ class WordDiff extends Diff {
       if (segmenter2.resolvedOptions().granularity != "word") {
         throw new Error('The segmenter passed must have a granularity of "word"');
       }
-      parts = Array.from(segmenter2.segment(value), (segment) => segment.segment);
+      parts = [];
+      for (const segmentObj of Array.from(segmenter2.segment(value))) {
+        const segment = segmentObj.segment;
+        if (parts.length && /\s/.test(parts[parts.length - 1]) && /\s/.test(segment)) {
+          parts[parts.length - 1] += segment;
+        } else {
+          parts.push(segment);
+        }
+      }
     } else {
       parts = value.match(tokenizeIncludingWhitespace) || [];
     }
@@ -14209,7 +14231,7 @@ class WordsWithSpaceDiff extends Diff {
 }
 var wordsWithSpaceDiff = new WordsWithSpaceDiff;
 
-// ../../node_modules/.bun/diff@8.0.2/node_modules/diff/libesm/diff/line.js
+// ../../node_modules/.bun/diff@8.0.3/node_modules/diff/libesm/diff/line.js
 class LineDiff extends Diff {
   constructor() {
     super(...arguments);
@@ -14262,7 +14284,7 @@ function tokenize(value, options2) {
   return retLines;
 }
 
-// ../../node_modules/.bun/diff@8.0.2/node_modules/diff/libesm/diff/sentence.js
+// ../../node_modules/.bun/diff@8.0.3/node_modules/diff/libesm/diff/sentence.js
 function isSentenceEndPunct(char) {
   return char == "." || char == "!" || char == "?";
 }
@@ -14292,7 +14314,7 @@ class SentenceDiff extends Diff {
 }
 var sentenceDiff = new SentenceDiff;
 
-// ../../node_modules/.bun/diff@8.0.2/node_modules/diff/libesm/diff/css.js
+// ../../node_modules/.bun/diff@8.0.3/node_modules/diff/libesm/diff/css.js
 class CssDiff extends Diff {
   tokenize(value) {
     return value.split(/([{}:;,]|\s+)/);
@@ -14300,7 +14322,7 @@ class CssDiff extends Diff {
 }
 var cssDiff = new CssDiff;
 
-// ../../node_modules/.bun/diff@8.0.2/node_modules/diff/libesm/diff/json.js
+// ../../node_modules/.bun/diff@8.0.3/node_modules/diff/libesm/diff/json.js
 class JsonDiff extends Diff {
   constructor() {
     super(...arguments);
@@ -14369,7 +14391,7 @@ function canonicalize(obj, stack, replacementStack, replacer, key) {
   return canonicalizedObj;
 }
 
-// ../../node_modules/.bun/diff@8.0.2/node_modules/diff/libesm/diff/array.js
+// ../../node_modules/.bun/diff@8.0.3/node_modules/diff/libesm/diff/array.js
 class ArrayDiff extends Diff {
   tokenize(value) {
     return value.slice();
@@ -14383,7 +14405,12 @@ class ArrayDiff extends Diff {
 }
 var arrayDiff = new ArrayDiff;
 
-// ../../node_modules/.bun/diff@8.0.2/node_modules/diff/libesm/patch/create.js
+// ../../node_modules/.bun/diff@8.0.3/node_modules/diff/libesm/patch/create.js
+var INCLUDE_HEADERS = {
+  includeIndex: true,
+  includeUnderline: true,
+  includeFileHeaders: true
+};
 function structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, options2) {
   let optionsObj;
   if (!options2) {
@@ -14491,18 +14518,28 @@ function structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, ne
     };
   }
 }
-function formatPatch(patch) {
+function formatPatch(patch, headerOptions) {
+  if (!headerOptions) {
+    headerOptions = INCLUDE_HEADERS;
+  }
   if (Array.isArray(patch)) {
-    return patch.map(formatPatch).join(`
+    if (patch.length > 1 && !headerOptions.includeFileHeaders) {
+      throw new Error("Cannot omit file headers on a multi-file patch. " + "(The result would be unparseable; how would a tool trying to apply " + "the patch know which changes are to which file?)");
+    }
+    return patch.map((p) => formatPatch(p, headerOptions)).join(`
 `);
   }
   const ret = [];
-  if (patch.oldFileName == patch.newFileName) {
+  if (headerOptions.includeIndex && patch.oldFileName == patch.newFileName) {
     ret.push("Index: " + patch.oldFileName);
   }
-  ret.push("===================================================================");
-  ret.push("--- " + patch.oldFileName + (typeof patch.oldHeader === "undefined" ? "" : "\t" + patch.oldHeader));
-  ret.push("+++ " + patch.newFileName + (typeof patch.newHeader === "undefined" ? "" : "\t" + patch.newHeader));
+  if (headerOptions.includeUnderline) {
+    ret.push("===================================================================");
+  }
+  if (headerOptions.includeFileHeaders) {
+    ret.push("--- " + patch.oldFileName + (typeof patch.oldHeader === "undefined" ? "" : "\t" + patch.oldHeader));
+    ret.push("+++ " + patch.newFileName + (typeof patch.newHeader === "undefined" ? "" : "\t" + patch.newHeader));
+  }
   for (let i = 0;i < patch.hunks.length; i++) {
     const hunk = patch.hunks[i];
     if (hunk.oldLines === 0) {
@@ -14529,14 +14566,14 @@ function createTwoFilesPatch(oldFileName, newFileName, oldStr, newStr, oldHeader
     if (!patchObj) {
       return;
     }
-    return formatPatch(patchObj);
+    return formatPatch(patchObj, options2 === null || options2 === undefined ? undefined : options2.headerOptions);
   } else {
     const { callback } = options2;
     structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, Object.assign(Object.assign({}, options2), { callback: (patchObj) => {
       if (!patchObj) {
         callback(undefined);
       } else {
-        callback(formatPatch(patchObj));
+        callback(formatPatch(patchObj, options2.headerOptions));
       }
     } }));
   }
@@ -14762,7 +14799,7 @@ async function runGhostInit(options2) {
 }
 
 // src/commands/ghost/opencode.ts
-import { renameSync, rmSync } from "fs";
+import { existsSync as existsSync4, renameSync, rmSync, statSync as statSync2 } from "fs";
 import { copyFile, mkdir as mkdir5, readdir as readdir5 } from "fs/promises";
 import path7 from "path";
 var {Glob: Glob3 } = globalThis.Bun;
@@ -16448,7 +16485,12 @@ function createFileSync(tempDir, projectDir, options2) {
       stabilityThreshold: 200,
       pollInterval: 50
     },
-    ignored: (filePath) => isExcluded(relative4(tempDir, filePath), gitignore)
+    ignored: (filePath) => {
+      const relativePath = normalizePath2(relative4(tempDir, filePath));
+      if (options2?.overlayFiles?.has(relativePath))
+        return true;
+      return isExcluded(relativePath, gitignore);
+    }
   });
   watcher.on("error", (err) => {
     failures.push({ path: "<watcher>", error: err });
@@ -16534,10 +16576,12 @@ function createFileSync(tempDir, projectDir, options2) {
 }
 
 // src/utils/symlink-farm.ts
+var import_ignore2 = __toESM(require_ignore(), 1);
 import { randomBytes } from "crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync2, realpathSync, statSync } from "fs";
 import { mkdir as mkdir4, readdir as readdir4, rename as rename2, rm as rm2, stat as stat5, symlink as symlink2 } from "fs/promises";
-import { tmpdir } from "os";
-import { dirname as dirname6, isAbsolute as isAbsolute2, join as join7, relative as relative5 } from "path";
+import { homedir as homedir2, tmpdir } from "os";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join7, normalize as normalize2, posix, relative as relative5, sep } from "path";
 
 // src/utils/pattern-filter.ts
 import path5 from "path";
@@ -16647,10 +16691,25 @@ async function createSymlinkFarm(sourceDir, options2) {
   const tempDir = join7(tmpdir(), `${GHOST_DIR_PREFIX}${suffix}`);
   await Bun.write(join7(tempDir, GHOST_MARKER_FILE), "");
   try {
+    const projectDir = options2?.projectDir ?? sourceDir;
+    const gitIgnore = await loadGitIgnoreStack(projectDir);
     const matcher = createPathMatcher(options2?.includePatterns ?? [], options2?.excludePatterns ?? []);
-    const plan = await computeSymlinkPlan(sourceDir, sourceDir, matcher);
-    await executeSymlinkPlan(plan, sourceDir, tempDir);
-    return tempDir;
+    const maxFiles = options2?.maxFiles ?? 1e4;
+    const state = { count: 0, plan: [] };
+    const plan = await computeSymlinkPlan(sourceDir, sourceDir, matcher, state, maxFiles, gitIgnore, projectDir);
+    const symlinkRoots = new Set;
+    await executeSymlinkPlan(plan, sourceDir, tempDir, "", symlinkRoots);
+    for (const op of state.plan) {
+      const relPath = normalizePath3(relative5(sourceDir, op.source));
+      const targetPath = join7(tempDir, relPath);
+      const parentDir = dirname6(targetPath);
+      if (parentDir !== tempDir) {
+        await mkdir4(parentDir, { recursive: true });
+      }
+      await symlink2(op.source, targetPath);
+      symlinkRoots.add(relPath);
+    }
+    return { tempDir, symlinkRoots };
   } catch (error) {
     await rm2(tempDir, { recursive: true, force: true }).catch(() => {});
     throw error;
@@ -16707,7 +16766,7 @@ async function cleanupOrphanedGhostDirs(tempBase = tmpdir()) {
   }
   return cleanedCount;
 }
-async function computeSymlinkPlan(sourceDir, projectRoot, matcher) {
+async function computeSymlinkPlan(sourceDir, projectRoot, matcher, state, maxFiles, gitIgnore, projectDir) {
   if (!isAbsolute2(sourceDir)) {
     throw new Error(`sourceDir must be an absolute path, got: ${sourceDir}`);
   }
@@ -16716,32 +16775,79 @@ async function computeSymlinkPlan(sourceDir, projectRoot, matcher) {
     files: [],
     partialDirs: new Map
   };
+  let resolvedSource;
+  let resolvedProject;
+  try {
+    resolvedSource = realpathSync(sourceDir);
+    resolvedProject = realpathSync(projectDir);
+  } catch {
+    resolvedSource = sourceDir;
+    resolvedProject = projectDir;
+  }
+  const rel = normalize2(relative5(resolvedProject, resolvedSource));
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute2(rel)) {
+    return plan;
+  }
+  const relativeDirPath = normalizePath3(relative5(resolvedProject, resolvedSource));
+  const nestedGitignorePath = join7(sourceDir, ".gitignore");
+  if (gitIgnore && existsSync3(nestedGitignorePath)) {
+    try {
+      addScopedRules(gitIgnore, readFileSync2(nestedGitignorePath, "utf-8"), relativeDirPath);
+    } catch {}
+  }
   const entries = await readdir4(sourceDir, { withFileTypes: true });
   for (const entry of entries) {
+    if (entry.name === ".git")
+      continue;
     const sourcePath = join7(sourceDir, entry.name);
-    const relativePath = normalizeForMatching(sourcePath, projectRoot);
-    const disposition = matcher.getDisposition(relativePath);
+    const relativePath = normalizePath3(relative5(projectDir, sourcePath));
+    const checkPath = entry.isDirectory() ? `${relativePath}/` : relativePath;
+    const isGitignored = gitIgnore?.ignores(checkPath) ?? false;
+    const matcherRelativePath = normalizeForMatching(sourcePath, projectRoot);
+    const disposition = matcher.getDisposition(matcherRelativePath);
     if (disposition.type === "excluded") {
       continue;
     }
-    if (disposition.type === "included") {
-      if (entry.isDirectory()) {
+    if (entry.isDirectory()) {
+      if (isGitignored) {
+        state.plan.push({ type: "directory", source: sourcePath });
+        state.count += 1;
+        if (maxFiles > 0 && state.count > maxFiles) {
+          throw new FileLimitExceededError(state.count, maxFiles);
+        }
+        continue;
+      }
+      if (disposition.type === "included") {
         plan.wholeDirs.push(entry.name);
-      } else {
-        plan.files.push(entry.name);
+        state.count += 1;
+        if (maxFiles > 0 && state.count > maxFiles) {
+          throw new FileLimitExceededError(state.count, maxFiles);
+        }
+        continue;
       }
-      continue;
-    }
-    if (entry.isDirectory()) {
-      const nestedPlan = await computeSymlinkPlan(sourcePath, projectRoot, matcher);
+      const nestedPlan = await computeSymlinkPlan(sourcePath, projectRoot, matcher, state, maxFiles, gitIgnore, projectDir);
       plan.partialDirs.set(entry.name, nestedPlan);
     } else {
+      if (isGitignored)
+        continue;
+      if (disposition.type === "included") {
+        plan.files.push(entry.name);
+        state.count += 1;
+        if (maxFiles > 0 && state.count > maxFiles) {
+          throw new FileLimitExceededError(state.count, maxFiles);
+        }
+        continue;
+      }
       plan.files.push(entry.name);
+      state.count += 1;
+      if (maxFiles > 0 && state.count > maxFiles) {
+        throw new FileLimitExceededError(state.count, maxFiles);
+      }
     }
   }
   return plan;
 }
-async function executeSymlinkPlan(plan, sourceRoot, targetRoot) {
+async function executeSymlinkPlan(plan, sourceRoot, targetRoot, relativePath = "", symlinkRoots) {
   if (!isAbsolute2(sourceRoot)) {
     throw new Error(`sourceRoot must be an absolute path, got: ${sourceRoot}`);
   }
@@ -16752,18 +16858,99 @@ async function executeSymlinkPlan(plan, sourceRoot, targetRoot) {
     const sourcePath = join7(sourceRoot, dirName);
     const targetPath = join7(targetRoot, dirName);
     await symlink2(sourcePath, targetPath);
+    symlinkRoots?.add(relativePath ? `${relativePath}/${dirName}` : dirName);
   }
   for (const fileName of plan.files) {
     const sourcePath = join7(sourceRoot, fileName);
     const targetPath = join7(targetRoot, fileName);
     await symlink2(sourcePath, targetPath);
+    symlinkRoots?.add(relativePath ? `${relativePath}/${fileName}` : fileName);
   }
   for (const [dirName, nestedPlan] of plan.partialDirs) {
     const sourcePath = join7(sourceRoot, dirName);
     const targetPath = join7(targetRoot, dirName);
     await mkdir4(targetPath, { recursive: true });
-    await executeSymlinkPlan(nestedPlan, sourcePath, targetPath);
+    const nestedRelativePath = relativePath ? `${relativePath}/${dirName}` : dirName;
+    await executeSymlinkPlan(nestedPlan, sourcePath, targetPath, nestedRelativePath, symlinkRoots);
+  }
+}
+function normalizePath3(p) {
+  return p.replace(/\\/g, "/").replace(/\/$/, "");
+}
+function getGitDir(projectDir) {
+  const gitPath = join7(projectDir, ".git");
+  try {
+    const stats = statSync(gitPath);
+    if (stats.isDirectory())
+      return gitPath;
+    if (stats.isFile()) {
+      const content2 = readFileSync2(gitPath, "utf-8").trim();
+      const match = content2.match(/^gitdir:\s*(.+)$/);
+      if (match?.[1]) {
+        const gitdir = match[1];
+        return isAbsolute2(gitdir) ? gitdir : join7(projectDir, gitdir);
+      }
+    }
+  } catch {}
+  return null;
+}
+function getGlobalGitignore() {
+  const gitconfigPath = join7(homedir2(), ".gitconfig");
+  try {
+    const content2 = readFileSync2(gitconfigPath, "utf-8");
+    const match = content2.match(/excludesfile\s*=\s*(.+)/i);
+    if (match?.[1]) {
+      const p = match[1].trim().replace(/^~/, homedir2());
+      if (existsSync3(p))
+        return p;
+    }
+  } catch {}
+  const xdgConfig = process.env.XDG_CONFIG_HOME || join7(homedir2(), ".config");
+  const xdgIgnore = join7(xdgConfig, "git", "ignore");
+  return existsSync3(xdgIgnore) ? xdgIgnore : null;
+}
+function addScopedRules(ig, content2, subdir) {
+  for (const line of content2.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    let pattern = trimmed;
+    let isNegation = false;
+    if (pattern.startsWith("!")) {
+      isNegation = true;
+      pattern = pattern.slice(1);
+    }
+    if (pattern.startsWith("/")) {
+      pattern = pattern.slice(1);
+    }
+    const scoped = subdir ? posix.join(subdir, pattern) : pattern;
+    ig.add(isNegation ? `!${scoped}` : scoped);
+  }
+}
+async function loadGitIgnoreStack(projectDir) {
+  const gitDir = getGitDir(projectDir);
+  if (!gitDir)
+    return null;
+  const ig = import_ignore2.default();
+  const globalPath = getGlobalGitignore();
+  if (globalPath) {
+    try {
+      addScopedRules(ig, readFileSync2(globalPath, "utf-8"), "");
+    } catch {}
   }
+  const excludePath = join7(gitDir, "info", "exclude");
+  try {
+    if (existsSync3(excludePath)) {
+      addScopedRules(ig, readFileSync2(excludePath, "utf-8"), "");
+    }
+  } catch {}
+  const rootGitignore = join7(projectDir, ".gitignore");
+  try {
+    if (existsSync3(rootGitignore)) {
+      addScopedRules(ig, readFileSync2(rootGitignore, "utf-8"), "");
+    }
+  } catch {}
+  return ig;
 }
 
 // src/utils/terminal-title.ts
@@ -16819,11 +17006,77 @@ function formatTerminalName(cwd, profileName, gitInfo) {
 }
 
 // src/commands/ghost/opencode.ts
+var PROFILE_OVERLAY_ALLOWED = [
+  "opencode.jsonc",
+  "opencode.json",
+  "opencode.yaml",
+  "AGENTS.md",
+  "CLAUDE.md",
+  "CONTEXT.md",
+  /^\.opencode(\/|$)/
+];
+var defaultFs = {
+  existsSync: existsSync4,
+  statSync: statSync2
+};
+function resolveProjectPath(args, cwd, fs = defaultFs) {
+  if (args.length === 0) {
+    return { projectDir: cwd, remainingArgs: [], explicitPath: null };
+  }
+  const firstArg = args[0];
+  if (firstArg === undefined) {
+    return { projectDir: cwd, remainingArgs: [], explicitPath: null };
+  }
+  let pathArg;
+  let remainingArgs;
+  if (firstArg === "--") {
+    const secondArg = args[1];
+    if (secondArg === undefined) {
+      return { projectDir: cwd, remainingArgs: [], explicitPath: null };
+    }
+    pathArg = secondArg;
+    remainingArgs = args.slice(2);
+  } else {
+    const potentialPath = isAbsolutePath(firstArg) ? firstArg : path7.resolve(cwd, firstArg);
+    if (!fs.existsSync(potentialPath)) {
+      return { projectDir: cwd, remainingArgs: args, explicitPath: null };
+    }
+    const stat7 = fs.statSync(potentialPath);
+    if (!stat7.isDirectory()) {
+      return { projectDir: cwd, remainingArgs: args, explicitPath: null };
+    }
+    pathArg = firstArg;
+    remainingArgs = args.slice(1);
+  }
+  const projectDir = isAbsolutePath(pathArg) ? pathArg : path7.resolve(cwd, pathArg);
+  if (!fs.existsSync(projectDir)) {
+    throw new NotFoundError(`Project path does not exist: ${pathArg}`);
+  }
+  const stat6 = fs.statSync(projectDir);
+  if (!stat6.isDirectory()) {
+    throw new ValidationError(`Project path is not a directory: ${pathArg}`);
+  }
+  return {
+    projectDir,
+    remainingArgs,
+    explicitPath: pathArg
+  };
+}
+function isAllowedOverlayFile(relativePath) {
+  return PROFILE_OVERLAY_ALLOWED.some((pattern) => typeof pattern === "string" ? relativePath === pattern : pattern.test(relativePath));
+}
+function isWithinSymlinkRoot(relativePath, symlinkRoots) {
+  for (const root of symlinkRoots) {
+    if (relativePath === root || relativePath.startsWith(`${root}/`)) {
+      return true;
+    }
+  }
+  return false;
+}
 function registerGhostOpenCodeCommand(parent) {
-  parent.command("opencode").description("Launch OpenCode with ghost mode configuration").option("-p, --profile <name>", "Use specific profile").option("--no-rename", "Disable terminal/tmux window renaming").addOption(sharedOptions.json()).addOption(sharedOptions.quiet()).allowUnknownOption().allowExcessArguments(true).action(async (options2, command) => {
+  parent.command("opencode").description("Launch OpenCode with ghost mode configuration (first arg can be project path)").option("-p, --profile <name>", "Use specific profile").option("--no-rename", "Disable terminal/tmux window renaming").addOption(sharedOptions.json()).addOption(sharedOptions.quiet()).allowUnknownOption().allowExcessArguments(true).action(async (options2, command) => {
     try {
-      const args = command.args;
-      await runGhostOpenCode(args, options2);
+      await runGhostOpenCode(command.args, options2);
     } catch (error) {
       handleError(error, { json: options2.json });
     }
@@ -16844,17 +17097,21 @@ async function runGhostOpenCode(args, options2) {
   if (!hasOpencodeConfig && !options2.quiet) {
     logger.warn(`No opencode.jsonc found at ${profileOpencodePath}. Create one to customize OpenCode settings.`);
   }
-  const cwd = process.cwd();
-  const gitContext = await detectGitRepo(cwd);
+  const { projectDir, remainingArgs, explicitPath } = resolveProjectPath(args, process.cwd());
+  if (explicitPath && !options2.quiet) {
+    logger.info(`Using project directory: ${projectDir}`);
+  }
+  const gitContext = await detectGitRepo(projectDir);
   const ghostConfig = profile.ghost;
-  const tempDir = await createSymlinkFarm(cwd, {
+  const { tempDir, symlinkRoots } = await createSymlinkFarm(projectDir, {
     includePatterns: ghostConfig.include,
-    excludePatterns: ghostConfig.exclude
+    excludePatterns: ghostConfig.exclude,
+    maxFiles: ghostConfig.maxFiles
   });
-  const overlayFiles = await injectProfileOverlay(tempDir, profileDir, ghostConfig.include);
+  const overlayFiles = await injectProfileOverlay(tempDir, profileDir, ghostConfig.include, symlinkRoots);
   let cleanupDone = false;
   let fileSync;
-  fileSync = createFileSync(tempDir, cwd, { overlayFiles });
+  fileSync = createFileSync(tempDir, projectDir, { overlayFiles });
   const performCleanup = async () => {
     if (cleanupDone)
       return;
@@ -16885,11 +17142,11 @@ async function runGhostOpenCode(args, options2) {
   process.on("SIGTERM", sigtermHandler);
   if (shouldRename) {
     saveTerminalTitle();
-    const gitInfo = await getGitInfo(cwd);
-    setTerminalName(formatTerminalName(cwd, profileName, gitInfo));
+    const gitInfo = await getGitInfo(projectDir);
+    setTerminalName(formatTerminalName(projectDir, profileName, gitInfo));
   }
   proc = Bun.spawn({
-    cmd: ["opencode", ...args],
+    cmd: ["opencode", ...remainingArgs],
     cwd: tempDir,
     env: {
       ...process.env,
@@ -16942,7 +17199,7 @@ function userExplicitlyIncluded(relativePath, compiledPatterns) {
     return false;
   return compiledPatterns.some((glob) => glob.match(relativePath));
 }
-async function injectProfileOverlay(tempDir, profileDir, includePatterns) {
+async function injectProfileOverlay(tempDir, profileDir, includePatterns, symlinkRoots) {
   const entries = await readdir5(profileDir, { withFileTypes: true, recursive: true });
   const injectedFiles = new Set;
   const compiledIncludePatterns = includePatterns.map((p) => new Glob3(p));
@@ -16952,11 +17209,17 @@ async function injectProfileOverlay(tempDir, profileDir, includePatterns) {
       continue;
     if (relativePath === ".gitignore")
       continue;
+    if (!isAllowedOverlayFile(relativePath))
+      continue;
+    if (isWithinSymlinkRoot(relativePath, symlinkRoots))
+      continue;
     if (userExplicitlyIncluded(relativePath, compiledIncludePatterns))
       continue;
     if (entry.isDirectory())
       continue;
     const destPath = path7.join(tempDir, relativePath);
+    if (existsSync4(destPath))
+      continue;
     await mkdir5(path7.dirname(destPath), { recursive: true });
     await copyFile(path7.join(entry.parentPath, entry.name), destPath);
     injectedFiles.add(normalizePath2(relativePath));
@@ -17488,850 +17751,864 @@ function registerGhostSearchCommand(parent) {
   });
 }
 
-// src/commands/ghost/index.ts
-function registerGhostCommand(program2) {
-  const ghost = program2.command("ghost").alias("g").description("Ghost mode - work without local config files");
-  registerGhostInitCommand(ghost);
-  registerGhostConfigCommand(ghost);
-  registerGhostRegistryCommand(ghost);
-  registerGhostAddCommand(ghost);
-  registerGhostSearchCommand(ghost);
-  registerGhostOpenCodeCommand(ghost);
-  registerGhostProfileCommand(ghost);
-}
-
-// src/commands/init.ts
-import { existsSync as existsSync3 } from "fs";
-import { cp, mkdir as mkdir6, readdir as readdir6, readFile, rm as rm3, writeFile as writeFile2 } from "fs/promises";
-import { join as join8 } from "path";
-var TEMPLATE_REPO = "kdcokenny/ocx";
-var TEMPLATE_PATH = "examples/registry-starter";
-function registerInitCommand(program2) {
-  program2.command("init [directory]").description("Initialize OCX configuration in your project").option("--cwd <path>", "Working directory", process.cwd()).option("-q, --quiet", "Suppress output").option("-v, --verbose", "Verbose output").option("--json", "Output as JSON").option("--registry", "Scaffold a new OCX registry project").option("--namespace <name>", "Registry namespace (e.g., my-org)").option("--author <name>", "Author name for the registry").option("--canary", "Use canary (main branch) instead of latest release").option("--local <path>", "Use local template directory instead of fetching").option("-f, --force", "Overwrite existing files (registry mode only)").action(async (directory, options2) => {
+// src/commands/update.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync5 } from "fs";
+import { mkdir as mkdir6, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname7, join as join8 } from "path";
+function registerUpdateCommand(program2) {
+  program2.command("update [components...]").description("Update installed components (use @version suffix to pin, e.g., kdco/agents@1.2.0)").option("--all", "Update all installed components").option("--registry <name>", "Update all components from a specific registry").option("--dry-run", "Preview changes without applying").option("--cwd <path>", "Working directory", process.cwd()).option("-q, --quiet", "Suppress output").option("-v, --verbose", "Verbose output").option("--json", "Output as JSON").action(async (components, options2) => {
     try {
-      if (options2.registry) {
-        await runInitRegistry(directory, options2);
-      } else {
-        await runInit(options2);
-      }
+      await runUpdate(components, options2);
     } catch (error) {
       handleError(error, { json: options2.json });
     }
   });
 }
-async function runInit(options2) {
+async function runUpdate(componentNames, options2) {
   const cwd = options2.cwd ?? process.cwd();
-  const configPath = join8(cwd, "ocx.jsonc");
-  if (existsSync3(configPath)) {
-    throw new ConflictError(`ocx.jsonc already exists at ${configPath}
+  const provider = await LocalConfigProvider.create(cwd);
+  await runUpdateCore(componentNames, options2, provider);
+}
+async function runUpdateCore(componentNames, options2, provider) {
+  const lockPath = join8(provider.cwd, "ocx.lock");
+  const registries = provider.getRegistries();
+  const lock = await readOcxLock(provider.cwd);
+  if (!lock || Object.keys(lock.installed).length === 0) {
+    throw new ValidationError("Nothing installed yet. Run 'ocx add <component>' first.");
+  }
+  const hasComponents = componentNames.length > 0;
+  const hasAll = options2.all === true;
+  const hasRegistry = options2.registry !== undefined;
+  if (!hasComponents && !hasAll && !hasRegistry) {
+    throw new ValidationError(`Specify components, use --all, or use --registry <name>.
 
-` + `To reset, delete the config and run init again:
-` + `  rm ${configPath} && ocx init`);
+` + `Examples:
+` + `  ocx update kdco/agents           # Update specific component
+` + `  ocx update --all                 # Update all installed components
+` + "  ocx update --registry kdco       # Update all from a registry");
   }
-  const spin = options2.quiet ? null : createSpinner({ text: "Initializing OCX..." });
-  spin?.start();
-  try {
-    const rawConfig = {
-      $schema: OCX_SCHEMA_URL,
-      registries: {}
-    };
-    const config = ocxConfigSchema.parse(rawConfig);
-    const content2 = JSON.stringify(config, null, 2);
-    await writeFile2(configPath, content2, "utf-8");
-    const opencodeResult = await ensureOpencodeConfig(cwd);
-    spin?.succeed("Initialized OCX configuration");
-    if (options2.json) {
-      console.log(JSON.stringify({
-        success: true,
-        path: configPath,
-        opencodePath: opencodeResult.path,
-        opencodeCreated: opencodeResult.created
-      }));
-    } else if (!options2.quiet) {
-      logger.info(`Created ${configPath}`);
-      if (opencodeResult.created) {
-        logger.info(`Created ${opencodeResult.path}`);
-      }
-      logger.info("");
-      logger.info("Next steps:");
-      logger.info("  1. Add a registry: ocx registry add <url>");
-      logger.info("  2. Install components: ocx add <component>");
-    }
-  } catch (error) {
-    spin?.fail("Failed to initialize");
-    throw error;
+  if (hasAll && hasComponents) {
+    throw new ValidationError(`Cannot specify components with --all.
+` + "Use either 'ocx update --all' or 'ocx update <components>'.");
   }
-}
-async function runInitRegistry(directory, options2) {
-  const cwd = directory ?? options2.cwd ?? process.cwd();
-  const namespace = options2.namespace ?? "my-registry";
-  const author = options2.author ?? "Your Name";
-  if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(namespace)) {
-    throw new ValidationError("Invalid namespace format: must start with letter/number, use hyphens only between segments (e.g., 'my-registry')");
+  if (hasRegistry && hasComponents) {
+    throw new ValidationError(`Cannot specify components with --registry.
+` + "Use either 'ocx update --registry <name>' or 'ocx update <components>'.");
   }
-  const existingFiles = await readdir6(cwd).catch(() => []);
-  const hasVisibleFiles = existingFiles.some((f) => !f.startsWith("."));
-  if (hasVisibleFiles && !options2.force) {
-    throw new ConflictError("Directory is not empty. Use --force to overwrite existing files.");
+  if (hasAll && hasRegistry) {
+    throw new ValidationError(`Cannot use --all with --registry.
+` + "Use either 'ocx update --all' or 'ocx update --registry <name>'.");
   }
-  const spin = options2.quiet ? null : createSpinner({ text: "Scaffolding registry..." });
-  spin?.start();
-  try {
-    if (spin)
-      spin.text = options2.local ? "Copying template..." : "Fetching template...";
-    if (options2.local) {
-      await mkdir6(cwd, { recursive: true });
-      await copyDir(options2.local, cwd);
-    } else {
-      const version = options2.canary ? "main" : await getLatestVersion();
-      await fetchAndExtractTemplate(cwd, version, options2.verbose);
-    }
-    if (spin)
-      spin.text = "Configuring project...";
-    await replacePlaceholders(cwd, { namespace, author });
-    spin?.succeed(`Created registry: ${namespace}`);
-    if (options2.json) {
-      console.log(JSON.stringify({ success: true, namespace, path: cwd }));
-    } else if (!options2.quiet) {
-      logger.info("");
-      logger.info("Next steps:");
-      logger.info("  1. bun install");
-      logger.info("  2. Edit registry.jsonc with your components");
-      logger.info("  3. bun run build");
-      logger.info("");
-      logger.info("Deploy to:");
-      logger.info("  Cloudflare: bunx wrangler deploy");
-      logger.info("  Vercel:     vercel");
-      logger.info("  Netlify:    netlify deploy");
+  const parsedComponents = componentNames.map(parseComponentSpec);
+  for (const spec of parsedComponents) {
+    if (spec.version !== undefined && spec.version === "") {
+      throw new ValidationError(`Invalid version specifier in '${spec.component}@'.` + `
+Version cannot be empty. Use 'kdco/agents@1.2.0' or omit the version for latest.`);
     }
-  } catch (error) {
-    spin?.fail("Failed to scaffold registry");
-    throw error;
-  }
-}
-async function copyDir(src, dest) {
-  await cp(src, dest, { recursive: true });
-}
-async function getLatestVersion() {
-  const pkgPath = new URL("../../package.json", import.meta.url);
-  const pkgContent = await readFile(pkgPath);
-  const pkg = JSON.parse(pkgContent.toString());
-  return `v${pkg.version}`;
-}
-async function fetchAndExtractTemplate(destDir, version, verbose) {
-  const ref = version === "main" ? "heads/main" : `tags/${version}`;
-  const tarballUrl = `https://github.com/${TEMPLATE_REPO}/archive/refs/${ref}.tar.gz`;
-  if (verbose) {
-    logger.info(`Fetching ${tarballUrl}`);
   }
-  const response = await fetch(tarballUrl);
-  if (!response.ok || !response.body) {
-    throw new NetworkError(`Failed to fetch template from ${tarballUrl}: ${response.statusText}`);
+  const componentsToUpdate = resolveComponentsToUpdate(lock, parsedComponents, options2);
+  if (componentsToUpdate.length === 0) {
+    if (hasRegistry) {
+      throw new NotFoundError(`No installed components from registry '${options2.registry}'.`);
+    }
+    throw new NotFoundError("No matching components found to update.");
   }
-  const tempDir = join8(destDir, ".ocx-temp");
-  await mkdir6(tempDir, { recursive: true });
+  const spin = options2.quiet ? null : createSpinner({ text: "Checking for updates..." });
+  spin?.start();
+  const results = [];
+  const updates = [];
   try {
-    const tarPath = join8(tempDir, "template.tar.gz");
-    const arrayBuffer = await response.arrayBuffer();
-    await writeFile2(tarPath, Buffer.from(arrayBuffer));
-    const proc = Bun.spawn(["tar", "-xzf", tarPath, "-C", tempDir], {
-      stdout: "ignore",
-      stderr: "pipe"
-    });
-    const exitCode = await proc.exited;
-    if (exitCode !== 0) {
-      const stderr = await new Response(proc.stderr).text();
-      throw new Error(`Failed to extract template: ${stderr}`);
-    }
-    const extractedDirs = await readdir6(tempDir);
-    const extractedDir = extractedDirs.find((d) => d.startsWith("ocx-"));
-    if (!extractedDir) {
-      throw new Error("Failed to find extracted template directory");
+    for (const spec of componentsToUpdate) {
+      const qualifiedName = spec.component;
+      const lockEntry = lock.installed[qualifiedName];
+      if (!lockEntry) {
+        throw new NotFoundError(`Component '${qualifiedName}' not found in lock file.`);
+      }
+      const { namespace, component: componentName } = parseQualifiedComponent(qualifiedName);
+      const regConfig = registries[namespace];
+      if (!regConfig) {
+        throw new ConfigError(`Registry '${namespace}' not configured. Component '${qualifiedName}' cannot be updated.`);
+      }
+      const fetchResult = await fetchComponentVersion(regConfig.url, componentName, spec.version);
+      const manifest = fetchResult.manifest;
+      const version = fetchResult.version;
+      const normalizedManifest = normalizeComponentManifest(manifest);
+      const files = [];
+      for (const file of normalizedManifest.files) {
+        const content2 = await fetchFileContent(regConfig.url, componentName, file.path);
+        files.push({ path: file.path, content: Buffer.from(content2) });
+      }
+      const newHash = await hashBundle2(files);
+      if (newHash === lockEntry.hash) {
+        results.push({
+          qualifiedName,
+          oldVersion: lockEntry.version,
+          newVersion: version,
+          status: "up-to-date"
+        });
+      } else if (options2.dryRun) {
+        results.push({
+          qualifiedName,
+          oldVersion: lockEntry.version,
+          newVersion: version,
+          status: "would-update"
+        });
+      } else {
+        results.push({
+          qualifiedName,
+          oldVersion: lockEntry.version,
+          newVersion: version,
+          status: "updated"
+        });
+        updates.push({
+          qualifiedName,
+          component: normalizedManifest,
+          files,
+          newHash,
+          newVersion: version,
+          baseUrl: regConfig.url
+        });
+      }
     }
-    const templateDir = join8(tempDir, extractedDir, TEMPLATE_PATH);
-    await copyDir(templateDir, destDir);
-  } finally {
-    await rm3(tempDir, { recursive: true, force: true });
-  }
-}
-async function replacePlaceholders(dir, values) {
-  const filesToProcess = [
-    "registry.jsonc",
-    "package.json",
-    "wrangler.jsonc",
-    "README.md",
-    "AGENTS.md"
-  ];
-  for (const file of filesToProcess) {
-    const filePath = join8(dir, file);
-    if (!existsSync3(filePath))
-      continue;
-    let content2 = await readFile(filePath).then((b) => b.toString());
-    content2 = content2.replace(/my-registry/g, values.namespace);
-    content2 = content2.replace(/Your Name/g, values.author);
-    await writeFile2(filePath, content2);
-  }
-}
-
-// src/self-update/version-provider.ts
-class BuildTimeVersionProvider {
-  version = "1.3.0";
-}
-var defaultVersionProvider = new BuildTimeVersionProvider;
-
-// src/self-update/check.ts
-var VERSION_CHECK_TIMEOUT_MS = 200;
-var PACKAGE_NAME = "ocx";
-function parseVersion2(v) {
-  const [main2 = ""] = v.split("-");
-  const parts = main2.split(".");
-  const major = parseInt(parts[0] ?? "", 10);
-  const minor = parseInt(parts[1] ?? "", 10);
-  const patch = parseInt(parts[2] ?? "", 10);
-  if (Number.isNaN(major) || Number.isNaN(minor) || Number.isNaN(patch)) {
-    return null;
-  }
-  return { major, minor, patch };
-}
-function compareSemver2(a, b) {
-  const vA = parseVersion2(a);
-  const vB = parseVersion2(b);
-  if (!vA || !vB) {
-    return null;
-  }
-  if (vA.major !== vB.major)
-    return vA.major - vB.major;
-  if (vA.minor !== vB.minor)
-    return vA.minor - vB.minor;
-  return vA.patch - vB.patch;
-}
-async function checkForUpdate(versionProvider) {
-  const provider = versionProvider ?? defaultVersionProvider;
-  const current = provider.version || "0.0.0-dev";
-  if (current === "0.0.0-dev") {
-    return null;
-  }
-  try {
-    const result = await fetchPackageVersion(PACKAGE_NAME, undefined, AbortSignal.timeout(VERSION_CHECK_TIMEOUT_MS));
-    const latest = result.version;
-    const comparison = compareSemver2(latest, current);
-    if (comparison === null) {
-      return null;
+    spin?.succeed(`Checked ${componentsToUpdate.length} component(s)`);
+    if (options2.dryRun) {
+      outputDryRun(results, options2);
+      return;
     }
-    return {
-      current,
-      latest,
-      updateAvailable: comparison > 0
-    };
-  } catch {
-    return null;
+    if (updates.length === 0) {
+      if (!options2.quiet && !options2.json) {
+        logger.info("");
+        logger.success("All components are up to date.");
+      }
+      if (options2.json) {
+        console.log(JSON.stringify({ success: true, updated: [], upToDate: results }, null, 2));
+      }
+      return;
+    }
+    const installSpin = options2.quiet ? null : createSpinner({ text: "Updating components..." });
+    installSpin?.start();
+    for (const update of updates) {
+      for (const file of update.files) {
+        const fileObj = update.component.files.find((f) => f.path === file.path);
+        if (!fileObj)
+          continue;
+        const targetPath = join8(provider.cwd, fileObj.target);
+        const targetDir = dirname7(targetPath);
+        if (!existsSync5(targetDir)) {
+          await mkdir6(targetDir, { recursive: true });
+        }
+        await writeFile2(targetPath, file.content);
+        if (options2.verbose) {
+          logger.info(`  \u2713 Updated ${fileObj.target}`);
+        }
+      }
+      const existingEntry = lock.installed[update.qualifiedName];
+      if (!existingEntry) {
+        throw new NotFoundError(`Component '${update.qualifiedName}' not found in lock file.`);
+      }
+      lock.installed[update.qualifiedName] = {
+        registry: existingEntry.registry,
+        version: update.newVersion,
+        hash: update.newHash,
+        files: existingEntry.files,
+        installedAt: existingEntry.installedAt,
+        updatedAt: new Date().toISOString()
+      };
+    }
+    installSpin?.succeed(`Updated ${updates.length} component(s)`);
+    await writeFile2(lockPath, JSON.stringify(lock, null, 2), "utf-8");
+    if (options2.json) {
+      console.log(JSON.stringify({
+        success: true,
+        updated: results.filter((r2) => r2.status === "updated"),
+        upToDate: results.filter((r2) => r2.status === "up-to-date")
+      }, null, 2));
+    } else if (!options2.quiet) {
+      logger.info("");
+      for (const result of results) {
+        if (result.status === "updated") {
+          logger.info(`  \u2713 ${result.qualifiedName} (${result.oldVersion} \u2192 ${result.newVersion})`);
+        } else if (result.status === "up-to-date" && options2.verbose) {
+          logger.info(`  \u25CB ${result.qualifiedName} (already up to date)`);
+        }
+      }
+      logger.info("");
+      logger.success(`Done! Updated ${updates.length} component(s).`);
+    }
+  } catch (error) {
+    spin?.fail("Failed to check for updates");
+    throw error;
   }
 }
-
-// src/self-update/detect-method.ts
-function parseInstallMethod(input) {
-  const VALID_METHODS = ["curl", "npm", "yarn", "pnpm", "bun"];
-  const method = VALID_METHODS.find((m) => m === input);
-  if (!method) {
-    throw new SelfUpdateError(`Invalid install method: "${input}"
-Valid methods: ${VALID_METHODS.join(", ")}`);
+function parseComponentSpec(spec) {
+  const atIndex = spec.lastIndexOf("@");
+  if (atIndex <= 0) {
+    return { component: spec };
   }
-  return method;
+  return {
+    component: spec.slice(0, atIndex),
+    version: spec.slice(atIndex + 1)
+  };
 }
-var isCompiledBinary = () => Bun.main.startsWith("/$bunfs/");
-var isTempExecution = (path8) => path8.includes("/_npx/") || path8.includes("/.cache/bunx/") || path8.includes("/.pnpm/_temp/");
-var isYarnGlobalInstall = (path8) => path8.includes("/.yarn/global") || path8.includes("/.config/yarn/global");
-var isPnpmGlobalInstall = (path8) => path8.includes("/.pnpm/") || path8.includes("/pnpm/global");
-var isBunGlobalInstall = (path8) => path8.includes("/.bun/bin") || path8.includes("/.bun/install/global");
-var isNpmGlobalInstall = (path8) => path8.includes("/.npm/") || path8.includes("/node_modules/");
-function detectInstallMethod() {
-  if (isCompiledBinary()) {
-    return "curl";
+function resolveComponentsToUpdate(lock, parsedComponents, options2) {
+  const installedComponents = Object.keys(lock.installed);
+  if (options2.all) {
+    return installedComponents.map((c) => ({ component: c }));
   }
-  const scriptPath = process.argv[1] ?? "";
-  if (isTempExecution(scriptPath))
-    return "unknown";
-  if (isYarnGlobalInstall(scriptPath))
-    return "yarn";
-  if (isPnpmGlobalInstall(scriptPath))
-    return "pnpm";
-  if (isBunGlobalInstall(scriptPath))
-    return "bun";
-  if (isNpmGlobalInstall(scriptPath))
-    return "npm";
-  const userAgent = process.env.npm_config_user_agent ?? "";
-  if (userAgent.includes("yarn"))
-    return "yarn";
-  if (userAgent.includes("pnpm"))
-    return "pnpm";
-  if (userAgent.includes("bun"))
-    return "bun";
-  if (userAgent.includes("npm"))
-    return "npm";
-  return "unknown";
-}
-function getExecutablePath() {
-  if (typeof Bun !== "undefined" && Bun.main.startsWith("/$bunfs/")) {
-    return process.execPath;
+  if (options2.registry) {
+    return installedComponents.filter((name) => {
+      const entry = lock.installed[name];
+      return entry?.registry === options2.registry;
+    }).map((c) => ({ component: c }));
   }
-  return process.argv[1] ?? process.execPath;
-}
+  const result = [];
+  for (const spec of parsedComponents) {
+    const name = spec.component;
+    if (!name.includes("/")) {
+      const suggestions = installedComponents.filter((installed) => installed.endsWith(`/${name}`));
+      if (suggestions.length === 1) {
+        throw new ValidationError(`Ambiguous component '${name}'. Did you mean '${suggestions[0]}'?`);
+      }
+      if (suggestions.length > 1) {
+        throw new ValidationError(`Ambiguous component '${name}'. Found in multiple registries:
+` + suggestions.map((s) => `  - ${s}`).join(`
+`) + `
 
-// src/self-update/download.ts
-import { chmodSync, existsSync as existsSync4, renameSync as renameSync2, unlinkSync as unlinkSync2 } from "fs";
-var GITHUB_REPO2 = "kdcokenny/ocx";
-var DEFAULT_DOWNLOAD_BASE_URL = `https://github.com/${GITHUB_REPO2}/releases/download`;
-var PLATFORM_MAP = {
-  "arm64-darwin": "ocx-darwin-arm64",
-  "x64-darwin": "ocx-darwin-x64",
-  "arm64-linux": "ocx-linux-arm64",
-  "x64-linux": "ocx-linux-x64",
-  "x64-win32": "ocx-windows-x64.exe"
-};
-function getDownloadBaseUrl() {
-  const envUrl = process.env.OCX_DOWNLOAD_URL;
-  if (envUrl) {
-    return envUrl.replace(/\/+$/, "");
-  }
-  return DEFAULT_DOWNLOAD_BASE_URL;
-}
-function getDownloadUrl(version) {
-  const platform = `${process.arch}-${process.platform}`;
-  const target = PLATFORM_MAP[platform];
-  if (!target) {
-    const supported = Object.keys(PLATFORM_MAP).join(", ");
-    throw new SelfUpdateError(`Unsupported platform: ${platform}
-` + `Supported platforms: ${supported}`);
-  }
-  const baseUrl = getDownloadBaseUrl();
-  return `${baseUrl}/v${version}/${target}`;
-}
-async function downloadWithProgress(url, dest) {
-  const spin = createSpinner({ text: "Downloading update..." });
-  spin.start();
-  let response;
-  try {
-    response = await fetch(url, { redirect: "follow" });
-  } catch (error) {
-    spin.fail("Download failed");
-    throw new SelfUpdateError(`Network error: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  if (!response.ok) {
-    spin.fail("Download failed");
-    throw new SelfUpdateError(`Failed to download: HTTP ${response.status} ${response.statusText}`);
-  }
-  if (!response.body) {
-    spin.fail("Download failed");
-    throw new SelfUpdateError("Download failed: Empty response body");
-  }
-  const reader = response.body.getReader();
-  const writer = Bun.file(dest).writer();
-  const total = Number(response.headers.get("content-length") || 0);
-  let received = 0;
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done)
-        break;
-      await writer.write(value);
-      received += value.length;
-      if (total > 0) {
-        const pct = Math.round(received / total * 100);
-        spin.text = `Downloading... ${pct}%`;
+Please use a fully qualified name (registry/component).`);
       }
+      throw new ValidationError(`Component '${name}' must include a registry prefix (e.g., 'kdco/${name}').`);
     }
-    await writer.end();
-    spin.succeed("Download complete");
-  } catch (error) {
-    spin.fail("Download failed");
-    await writer.end();
-    throw new SelfUpdateError(`Download interrupted: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-async function downloadToTemp(version) {
-  const execPath = getExecutablePath();
-  const tempPath = `${execPath}.new.${Date.now()}`;
-  const url = getDownloadUrl(version);
-  await downloadWithProgress(url, tempPath);
-  try {
-    chmodSync(tempPath, 493);
-  } catch (error) {
-    if (existsSync4(tempPath)) {
-      unlinkSync2(tempPath);
+    if (!lock.installed[name]) {
+      throw new NotFoundError(`Component '${name}' is not installed.
+Run 'ocx add ${name}' to install it first.`);
     }
-    throw new SelfUpdateError(`Failed to set permissions: ${error instanceof Error ? error.message : String(error)}`);
+    result.push(spec);
   }
-  return { tempPath, execPath };
+  return result;
 }
-function atomicReplace(tempPath, execPath) {
-  const backupPath = `${execPath}.backup`;
-  try {
-    if (existsSync4(execPath)) {
-      renameSync2(execPath, backupPath);
-    }
-    renameSync2(tempPath, execPath);
-    if (existsSync4(backupPath)) {
-      unlinkSync2(backupPath);
+function outputDryRun(results, options2) {
+  const wouldUpdate = results.filter((r2) => r2.status === "would-update");
+  const upToDate = results.filter((r2) => r2.status === "up-to-date");
+  if (options2.json) {
+    console.log(JSON.stringify({ dryRun: true, wouldUpdate, upToDate }, null, 2));
+    return;
+  }
+  if (!options2.quiet) {
+    logger.info("");
+    if (wouldUpdate.length > 0) {
+      logger.info("Would update:");
+      for (const result of wouldUpdate) {
+        logger.info(`  ${result.qualifiedName} (${result.oldVersion} \u2192 ${result.newVersion})`);
+      }
     }
-  } catch (error) {
-    if (existsSync4(backupPath) && !existsSync4(execPath)) {
-      try {
-        renameSync2(backupPath, execPath);
-      } catch {}
+    if (upToDate.length > 0 && options2.verbose) {
+      logger.info("");
+      logger.info("Already up to date:");
+      for (const result of upToDate) {
+        logger.info(`  ${result.qualifiedName}`);
+      }
     }
-    if (existsSync4(tempPath)) {
-      try {
-        unlinkSync2(tempPath);
-      } catch {}
+    if (wouldUpdate.length > 0) {
+      logger.info("");
+      logger.info("Run without --dry-run to apply changes.");
+    } else {
+      logger.info("All components are up to date.");
     }
-    throw new SelfUpdateError(`Update failed: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-function cleanupTempFile(tempPath) {
-  if (existsSync4(tempPath)) {
-    try {
-      unlinkSync2(tempPath);
-    } catch {}
+async function hashContent2(content2) {
+  return createHash2("sha256").update(content2).digest("hex");
+}
+async function hashBundle2(files) {
+  const sorted = [...files].sort((a, b) => a.path.localeCompare(b.path));
+  const manifestParts = [];
+  for (const file of sorted) {
+    const hash = await hashContent2(file.content);
+    manifestParts.push(`${file.path}:${hash}`);
   }
+  return hashContent2(manifestParts.join(`
+`));
 }
 
-// src/self-update/notify.ts
-function notifyUpdate(current, latest) {
-  if (!process.stdout.isTTY)
-    return;
-  console.error(`${kleur_default.cyan("info")}: update available - ${kleur_default.green(latest)} (current: ${kleur_default.dim(current)})`);
-  console.error(`  run ${kleur_default.cyan("`ocx self update`")} to upgrade`);
-}
-function notifyUpToDate(version) {
-  console.error(`${kleur_default.cyan("info")}: ocx unchanged - ${kleur_default.dim(version)}`);
+// src/commands/ghost/update.ts
+function registerGhostUpdateCommand(parent) {
+  parent.command("update [components...]").description("Update installed components (use @version suffix to pin)").option("--all", "Update all installed components").option("--registry <name>", "Update all components from a specific registry").option("--dry-run", "Preview changes without applying").option("--cwd <path>", "Working directory", process.cwd()).option("-q, --quiet", "Suppress output").option("-v, --verbose", "Verbose output").option("--json", "Output as JSON").action(async (components, options2) => {
+    try {
+      const provider = await GhostConfigProvider.create(options2.cwd ?? process.cwd());
+      await runUpdateCore(components, options2, provider);
+    } catch (error) {
+      handleError(error, { json: options2.json });
+    }
+  });
 }
-function notifyUpdated(from, to) {
-  console.error(`  ${kleur_default.green("ocx updated")} - ${to} (from ${from})`);
+
+// src/commands/ghost/index.ts
+function registerGhostCommand(program2) {
+  const ghost = program2.command("ghost").alias("g").description("Ghost mode - work without local config files");
+  registerGhostInitCommand(ghost);
+  registerGhostConfigCommand(ghost);
+  registerGhostRegistryCommand(ghost);
+  registerGhostAddCommand(ghost);
+  registerGhostSearchCommand(ghost);
+  registerGhostOpenCodeCommand(ghost);
+  registerGhostProfileCommand(ghost);
+  registerGhostUpdateCommand(ghost);
 }
 
-// src/self-update/verify.ts
-import { createHash as createHash2 } from "crypto";
-var GITHUB_REPO3 = "kdcokenny/ocx";
-function parseSha256Sums(content2) {
-  const checksums = new Map;
-  for (const line of content2.split(`
-`)) {
-    const match = line.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
-    if (match?.[1] && match[2]) {
-      checksums.set(match[2].trim(), match[1].toLowerCase());
+// src/commands/init.ts
+import { existsSync as existsSync6 } from "fs";
+import { cp, mkdir as mkdir7, readdir as readdir6, readFile, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { join as join9 } from "path";
+var TEMPLATE_REPO = "kdcokenny/ocx";
+var TEMPLATE_PATH = "examples/registry-starter";
+function registerInitCommand(program2) {
+  program2.command("init [directory]").description("Initialize OCX configuration in your project").option("--cwd <path>", "Working directory", process.cwd()).option("-q, --quiet", "Suppress output").option("-v, --verbose", "Verbose output").option("--json", "Output as JSON").option("--registry", "Scaffold a new OCX registry project").option("--namespace <name>", "Registry namespace (e.g., my-org)").option("--author <name>", "Author name for the registry").option("--canary", "Use canary (main branch) instead of latest release").option("--local <path>", "Use local template directory instead of fetching").option("-f, --force", "Overwrite existing files (registry mode only)").action(async (directory, options2) => {
+    try {
+      if (options2.registry) {
+        await runInitRegistry(directory, options2);
+      } else {
+        await runInit(options2);
+      }
+    } catch (error) {
+      handleError(error, { json: options2.json });
     }
-  }
-  return checksums;
-}
-function hashContent2(content2) {
-  return createHash2("sha256").update(content2).digest("hex");
-}
-async function fetchChecksums(version) {
-  const url = `https://github.com/${GITHUB_REPO3}/releases/download/v${version}/SHA256SUMS.txt`;
-  const response = await fetch(url);
-  if (!response.ok) {
-    throw new SelfUpdateError(`Failed to fetch checksums: ${response.status}`);
-  }
-  const content2 = await response.text();
-  return parseSha256Sums(content2);
-}
-async function verifyChecksum(filePath, expectedHash, filename) {
-  const file = Bun.file(filePath);
-  const content2 = await file.arrayBuffer();
-  const actualHash = hashContent2(Buffer.from(content2));
-  if (actualHash !== expectedHash) {
-    throw new IntegrityError(filename, expectedHash, actualHash);
-  }
+  });
 }
+async function runInit(options2) {
+  const cwd = options2.cwd ?? process.cwd();
+  const configPath = join9(cwd, "ocx.jsonc");
+  if (existsSync6(configPath)) {
+    throw new ConflictError(`ocx.jsonc already exists at ${configPath}
 
-// src/commands/self/update.ts
-var SEMVER_PATTERN = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
-async function updateCommand(options2) {
-  const method = options2.method ? parseInstallMethod(options2.method) : detectInstallMethod();
-  const result = await checkForUpdate();
-  if (!result) {
-    throw new SelfUpdateError("Failed to check for updates");
-  }
-  const { current, latest, updateAvailable } = result;
-  if (!updateAvailable && !options2.force) {
-    notifyUpToDate(current);
-    return;
+` + `To reset, delete the config and run init again:
+` + `  rm ${configPath} && ocx init`);
   }
-  const targetVersion = latest;
-  switch (method) {
-    case "curl": {
-      await updateViaCurl(current, targetVersion);
-      break;
-    }
-    case "npm":
-    case "pnpm":
-    case "bun":
-    case "unknown": {
-      await updateViaPackageManager(method, current, targetVersion);
-      break;
+  const spin = options2.quiet ? null : createSpinner({ text: "Initializing OCX..." });
+  spin?.start();
+  try {
+    const rawConfig = {
+      $schema: OCX_SCHEMA_URL,
+      registries: {}
+    };
+    const config = ocxConfigSchema.parse(rawConfig);
+    const content2 = JSON.stringify(config, null, 2);
+    await writeFile3(configPath, content2, "utf-8");
+    const opencodeResult = await ensureOpencodeConfig(cwd);
+    spin?.succeed("Initialized OCX configuration");
+    if (options2.json) {
+      console.log(JSON.stringify({
+        success: true,
+        path: configPath,
+        opencodePath: opencodeResult.path,
+        opencodeCreated: opencodeResult.created
+      }));
+    } else if (!options2.quiet) {
+      logger.info(`Created ${configPath}`);
+      if (opencodeResult.created) {
+        logger.info(`Created ${opencodeResult.path}`);
+      }
+      logger.info("");
+      logger.info("Next steps:");
+      logger.info("  1. Add a registry: ocx registry add <url>");
+      logger.info("  2. Install components: ocx add <component>");
     }
+  } catch (error) {
+    spin?.fail("Failed to initialize");
+    throw error;
   }
 }
-async function updateViaCurl(current, targetVersion) {
-  const url = getDownloadUrl(targetVersion);
-  const filename = url.split("/").pop();
-  if (!filename) {
-    throw new SelfUpdateError("Failed to determine binary filename from download URL");
+async function runInitRegistry(directory, options2) {
+  const cwd = directory ?? options2.cwd ?? process.cwd();
+  const namespace = options2.namespace ?? "my-registry";
+  const author = options2.author ?? "Your Name";
+  if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(namespace)) {
+    throw new ValidationError("Invalid namespace format: must start with letter/number, use hyphens only between segments (e.g., 'my-registry')");
   }
-  const checksums = await fetchChecksums(targetVersion);
-  const expectedHash = checksums.get(filename);
-  if (!expectedHash) {
-    throw new SelfUpdateError(`Security error: No checksum found for ${filename}. Update aborted.`);
+  const existingFiles = await readdir6(cwd).catch(() => []);
+  const hasVisibleFiles = existingFiles.some((f) => !f.startsWith("."));
+  if (hasVisibleFiles && !options2.force) {
+    throw new ConflictError("Directory is not empty. Use --force to overwrite existing files.");
   }
-  const { tempPath, execPath } = await downloadToTemp(targetVersion);
+  const spin = options2.quiet ? null : createSpinner({ text: "Scaffolding registry..." });
+  spin?.start();
   try {
-    await verifyChecksum(tempPath, expectedHash, filename);
+    if (spin)
+      spin.text = options2.local ? "Copying template..." : "Fetching template...";
+    if (options2.local) {
+      await mkdir7(cwd, { recursive: true });
+      await copyDir(options2.local, cwd);
+    } else {
+      const version = options2.canary ? "main" : await getLatestVersion();
+      await fetchAndExtractTemplate(cwd, version, options2.verbose);
+    }
+    if (spin)
+      spin.text = "Configuring project...";
+    await replacePlaceholders(cwd, { namespace, author });
+    spin?.succeed(`Created registry: ${namespace}`);
+    if (options2.json) {
+      console.log(JSON.stringify({ success: true, namespace, path: cwd }));
+    } else if (!options2.quiet) {
+      logger.info("");
+      logger.info("Next steps:");
+      logger.info("  1. bun install");
+      logger.info("  2. Edit registry.jsonc with your components");
+      logger.info("  3. bun run build");
+      logger.info("");
+      logger.info("Deploy to:");
+      logger.info("  Cloudflare: bunx wrangler deploy");
+      logger.info("  Vercel:     vercel");
+      logger.info("  Netlify:    netlify deploy");
+    }
   } catch (error) {
-    cleanupTempFile(tempPath);
+    spin?.fail("Failed to scaffold registry");
     throw error;
   }
-  atomicReplace(tempPath, execPath);
-  notifyUpdated(current, targetVersion);
 }
-async function runPackageManager(cmd) {
-  const proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe" });
-  const exitCode = await proc.exited;
-  if (exitCode !== 0) {
-    const stderr = await new Response(proc.stderr).text();
-    throw new SelfUpdateError(`Package manager command failed: ${stderr.trim()}`);
-  }
+async function copyDir(src, dest) {
+  await cp(src, dest, { recursive: true });
 }
-async function updateViaPackageManager(method, current, targetVersion) {
-  if (!SEMVER_PATTERN.test(targetVersion)) {
-    throw new SelfUpdateError(`Invalid version format: ${targetVersion}`);
+async function getLatestVersion() {
+  const pkgPath = new URL("../../package.json", import.meta.url);
+  const pkgContent = await readFile(pkgPath);
+  const pkg = JSON.parse(pkgContent.toString());
+  return `v${pkg.version}`;
+}
+async function fetchAndExtractTemplate(destDir, version, verbose) {
+  const ref = version === "main" ? "heads/main" : `tags/${version}`;
+  const tarballUrl = `https://github.com/${TEMPLATE_REPO}/archive/refs/${ref}.tar.gz`;
+  if (verbose) {
+    logger.info(`Fetching ${tarballUrl}`);
   }
-  const spin = createSpinner({ text: `Updating via ${method}...` });
-  spin.start();
+  const response = await fetch(tarballUrl);
+  if (!response.ok || !response.body) {
+    throw new NetworkError(`Failed to fetch template from ${tarballUrl}: ${response.statusText}`);
+  }
+  const tempDir = join9(destDir, ".ocx-temp");
+  await mkdir7(tempDir, { recursive: true });
   try {
-    switch (method) {
-      case "npm": {
-        await runPackageManager(["npm", "install", "-g", `ocx@${targetVersion}`]);
-        break;
-      }
-      case "yarn": {
-        await runPackageManager(["yarn", "global", "add", `ocx@${targetVersion}`]);
-        break;
-      }
-      case "pnpm": {
-        await runPackageManager(["pnpm", "install", "-g", `ocx@${targetVersion}`]);
-        break;
-      }
-      case "bun": {
-        await runPackageManager(["bun", "install", "-g", `ocx@${targetVersion}`]);
-        break;
-      }
-      case "unknown": {
-        throw new SelfUpdateError(`Could not detect install method. Update manually with one of:
-` + `  npm install -g ocx@latest
-` + `  pnpm install -g ocx@latest
-` + "  bun install -g ocx@latest");
-      }
+    const tarPath = join9(tempDir, "template.tar.gz");
+    const arrayBuffer = await response.arrayBuffer();
+    await writeFile3(tarPath, Buffer.from(arrayBuffer));
+    const proc = Bun.spawn(["tar", "-xzf", tarPath, "-C", tempDir], {
+      stdout: "ignore",
+      stderr: "pipe"
+    });
+    const exitCode = await proc.exited;
+    if (exitCode !== 0) {
+      const stderr = await new Response(proc.stderr).text();
+      throw new Error(`Failed to extract template: ${stderr}`);
     }
-    spin.succeed(`Updated via ${method}`);
-    notifyUpdated(current, targetVersion);
-  } catch (error) {
-    if (error instanceof SelfUpdateError) {
-      spin.fail(`Update failed`);
-      throw error;
+    const extractedDirs = await readdir6(tempDir);
+    const extractedDir = extractedDirs.find((d) => d.startsWith("ocx-"));
+    if (!extractedDir) {
+      throw new Error("Failed to find extracted template directory");
     }
-    spin.fail(`Update failed`);
-    throw new SelfUpdateError(`Failed to run ${method}: ${error instanceof Error ? error.message : String(error)}`);
+    const templateDir = join9(tempDir, extractedDir, TEMPLATE_PATH);
+    await copyDir(templateDir, destDir);
+  } finally {
+    await rm3(tempDir, { recursive: true, force: true });
   }
 }
-function registerSelfUpdateCommand(parent) {
-  parent.command("update").description("Update OCX to the latest version").option("-f, --force", "Reinstall even if already up to date").option("-m, --method <method>", "Override install method detection (curl|npm|pnpm|bun)").action(wrapAction(async (options2) => {
-    await updateCommand(options2);
-  }));
+async function replacePlaceholders(dir, values) {
+  const filesToProcess = [
+    "registry.jsonc",
+    "package.json",
+    "wrangler.jsonc",
+    "README.md",
+    "AGENTS.md"
+  ];
+  for (const file of filesToProcess) {
+    const filePath = join9(dir, file);
+    if (!existsSync6(filePath))
+      continue;
+    let content2 = await readFile(filePath).then((b) => b.toString());
+    content2 = content2.replace(/my-registry/g, values.namespace);
+    content2 = content2.replace(/Your Name/g, values.author);
+    await writeFile3(filePath, content2);
+  }
 }
 
-// src/commands/self/index.ts
-function registerSelfCommand(program2) {
-  const self = program2.command("self").description("Manage the OCX CLI");
-  registerSelfUpdateCommand(self);
+// src/self-update/version-provider.ts
+class BuildTimeVersionProvider {
+  version = "1.3.2";
+}
+var defaultVersionProvider = new BuildTimeVersionProvider;
+
+// src/self-update/check.ts
+var VERSION_CHECK_TIMEOUT_MS = 200;
+var PACKAGE_NAME = "ocx";
+function parseVersion2(v) {
+  const [main2 = ""] = v.split("-");
+  const parts = main2.split(".");
+  const major = parseInt(parts[0] ?? "", 10);
+  const minor = parseInt(parts[1] ?? "", 10);
+  const patch = parseInt(parts[2] ?? "", 10);
+  if (Number.isNaN(major) || Number.isNaN(minor) || Number.isNaN(patch)) {
+    return null;
+  }
+  return { major, minor, patch };
+}
+function compareSemver2(a, b) {
+  const vA = parseVersion2(a);
+  const vB = parseVersion2(b);
+  if (!vA || !vB) {
+    return null;
+  }
+  if (vA.major !== vB.major)
+    return vA.major - vB.major;
+  if (vA.minor !== vB.minor)
+    return vA.minor - vB.minor;
+  return vA.patch - vB.patch;
+}
+async function checkForUpdate(versionProvider) {
+  const provider = versionProvider ?? defaultVersionProvider;
+  const current = provider.version || "0.0.0-dev";
+  if (current === "0.0.0-dev") {
+    return null;
+  }
+  try {
+    const result = await fetchPackageVersion(PACKAGE_NAME, undefined, AbortSignal.timeout(VERSION_CHECK_TIMEOUT_MS));
+    const latest = result.version;
+    const comparison = compareSemver2(latest, current);
+    if (comparison === null) {
+      return null;
+    }
+    return {
+      current,
+      latest,
+      updateAvailable: comparison > 0
+    };
+  } catch {
+    return null;
+  }
 }
 
-// src/commands/update.ts
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync5 } from "fs";
-import { mkdir as mkdir7, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname7, join as join9 } from "path";
-function registerUpdateCommand(program2) {
-  program2.command("update [components...]").description("Update installed components (use @version suffix to pin, e.g., kdco/agents@1.2.0)").option("--all", "Update all installed components").option("--registry <name>", "Update all components from a specific registry").option("--dry-run", "Preview changes without applying").option("--cwd <path>", "Working directory", process.cwd()).option("-q, --quiet", "Suppress output").option("-v, --verbose", "Verbose output").option("--json", "Output as JSON").action(async (components, options2) => {
-    try {
-      await runUpdate(components, options2);
-    } catch (error) {
-      handleError(error, { json: options2.json });
-    }
-  });
+// src/self-update/detect-method.ts
+function parseInstallMethod(input) {
+  const VALID_METHODS = ["curl", "npm", "yarn", "pnpm", "bun"];
+  const method = VALID_METHODS.find((m) => m === input);
+  if (!method) {
+    throw new SelfUpdateError(`Invalid install method: "${input}"
+Valid methods: ${VALID_METHODS.join(", ")}`);
+  }
+  return method;
 }
-async function runUpdate(componentNames, options2) {
-  const cwd = options2.cwd ?? process.cwd();
-  const lockPath = join9(cwd, "ocx.lock");
-  const config = await readOcxConfig(cwd);
-  if (!config) {
-    throw new ConfigError("No ocx.jsonc found. Run 'ocx init' first.");
+var isCompiledBinary = () => Bun.main.startsWith("/$bunfs/");
+var isTempExecution = (path8) => path8.includes("/_npx/") || path8.includes("/.cache/bunx/") || path8.includes("/.pnpm/_temp/");
+var isYarnGlobalInstall = (path8) => path8.includes("/.yarn/global") || path8.includes("/.config/yarn/global");
+var isPnpmGlobalInstall = (path8) => path8.includes("/.pnpm/") || path8.includes("/pnpm/global");
+var isBunGlobalInstall = (path8) => path8.includes("/.bun/bin") || path8.includes("/.bun/install/global");
+var isNpmGlobalInstall = (path8) => path8.includes("/.npm/") || path8.includes("/node_modules/");
+function detectInstallMethod() {
+  if (isCompiledBinary()) {
+    return "curl";
   }
-  const lock = await readOcxLock(cwd);
-  if (!lock || Object.keys(lock.installed).length === 0) {
-    throw new ConfigError("Nothing installed yet. Run 'ocx add <component>' first.");
+  const scriptPath = process.argv[1] ?? "";
+  if (isTempExecution(scriptPath))
+    return "unknown";
+  if (isYarnGlobalInstall(scriptPath))
+    return "yarn";
+  if (isPnpmGlobalInstall(scriptPath))
+    return "pnpm";
+  if (isBunGlobalInstall(scriptPath))
+    return "bun";
+  if (isNpmGlobalInstall(scriptPath))
+    return "npm";
+  const userAgent = process.env.npm_config_user_agent ?? "";
+  if (userAgent.includes("yarn"))
+    return "yarn";
+  if (userAgent.includes("pnpm"))
+    return "pnpm";
+  if (userAgent.includes("bun"))
+    return "bun";
+  if (userAgent.includes("npm"))
+    return "npm";
+  return "unknown";
+}
+function getExecutablePath() {
+  if (typeof Bun !== "undefined" && Bun.main.startsWith("/$bunfs/")) {
+    return process.execPath;
   }
-  const hasComponents = componentNames.length > 0;
-  const hasAll = options2.all === true;
-  const hasRegistry = options2.registry !== undefined;
-  if (!hasComponents && !hasAll && !hasRegistry) {
-    throw new ValidationError(`Specify components, use --all, or use --registry <name>.
+  return process.argv[1] ?? process.execPath;
+}
 
-` + `Examples:
-` + `  ocx update kdco/agents           # Update specific component
-` + `  ocx update --all                 # Update all installed components
-` + "  ocx update --registry kdco       # Update all from a registry");
-  }
-  if (hasAll && hasComponents) {
-    throw new ValidationError(`Cannot specify components with --all.
-` + "Use either 'ocx update --all' or 'ocx update <components>'.");
+// src/self-update/download.ts
+import { chmodSync, existsSync as existsSync7, renameSync as renameSync2, unlinkSync as unlinkSync2 } from "fs";
+var GITHUB_REPO2 = "kdcokenny/ocx";
+var DEFAULT_DOWNLOAD_BASE_URL = `https://github.com/${GITHUB_REPO2}/releases/download`;
+var PLATFORM_MAP = {
+  "arm64-darwin": "ocx-darwin-arm64",
+  "x64-darwin": "ocx-darwin-x64",
+  "arm64-linux": "ocx-linux-arm64",
+  "x64-linux": "ocx-linux-x64",
+  "x64-win32": "ocx-windows-x64.exe"
+};
+function getDownloadBaseUrl() {
+  const envUrl = process.env.OCX_DOWNLOAD_URL;
+  if (envUrl) {
+    return envUrl.replace(/\/+$/, "");
   }
-  if (hasRegistry && hasComponents) {
-    throw new ValidationError(`Cannot specify components with --registry.
-` + "Use either 'ocx update --registry <name>' or 'ocx update <components>'.");
+  return DEFAULT_DOWNLOAD_BASE_URL;
+}
+function getDownloadUrl(version) {
+  const platform = `${process.arch}-${process.platform}`;
+  const target = PLATFORM_MAP[platform];
+  if (!target) {
+    const supported = Object.keys(PLATFORM_MAP).join(", ");
+    throw new SelfUpdateError(`Unsupported platform: ${platform}
+` + `Supported platforms: ${supported}`);
   }
-  if (hasAll && hasRegistry) {
-    throw new ValidationError(`Cannot use --all with --registry.
-` + "Use either 'ocx update --all' or 'ocx update --registry <name>'.");
+  const baseUrl = getDownloadBaseUrl();
+  return `${baseUrl}/v${version}/${target}`;
+}
+async function downloadWithProgress(url, dest) {
+  const spin = createSpinner({ text: "Downloading update..." });
+  spin.start();
+  let response;
+  try {
+    response = await fetch(url, { redirect: "follow" });
+  } catch (error) {
+    spin.fail("Download failed");
+    throw new SelfUpdateError(`Network error: ${error instanceof Error ? error.message : String(error)}`);
   }
-  const parsedComponents = componentNames.map(parseComponentSpec);
-  for (const spec of parsedComponents) {
-    if (spec.version !== undefined && spec.version === "") {
-      throw new ValidationError(`Invalid version specifier in '${spec.component}@'.` + `
-Version cannot be empty. Use 'kdco/agents@1.2.0' or omit the version for latest.`);
-    }
+  if (!response.ok) {
+    spin.fail("Download failed");
+    throw new SelfUpdateError(`Failed to download: HTTP ${response.status} ${response.statusText}`);
   }
-  const componentsToUpdate = resolveComponentsToUpdate(lock, parsedComponents, options2);
-  if (componentsToUpdate.length === 0) {
-    if (hasRegistry) {
-      throw new NotFoundError(`No installed components from registry '${options2.registry}'.`);
-    }
-    throw new NotFoundError("No matching components found to update.");
+  if (!response.body) {
+    spin.fail("Download failed");
+    throw new SelfUpdateError("Download failed: Empty response body");
   }
-  const spin = options2.quiet ? null : createSpinner({ text: "Checking for updates..." });
-  spin?.start();
-  const results = [];
-  const updates = [];
+  const reader = response.body.getReader();
+  const writer = Bun.file(dest).writer();
+  const total = Number(response.headers.get("content-length") || 0);
+  let received = 0;
   try {
-    for (const spec of componentsToUpdate) {
-      const qualifiedName = spec.component;
-      const lockEntry = lock.installed[qualifiedName];
-      if (!lockEntry) {
-        throw new NotFoundError(`Component '${qualifiedName}' not found in lock file.`);
-      }
-      const { namespace, component: componentName } = parseQualifiedComponent(qualifiedName);
-      const regConfig = config.registries[namespace];
-      if (!regConfig) {
-        throw new ConfigError(`Registry '${namespace}' not configured. Component '${qualifiedName}' cannot be updated.`);
-      }
-      const fetchResult = await fetchComponentVersion(regConfig.url, componentName, spec.version);
-      const manifest = fetchResult.manifest;
-      const version = fetchResult.version;
-      const normalizedManifest = normalizeComponentManifest(manifest);
-      const files = [];
-      for (const file of normalizedManifest.files) {
-        const content2 = await fetchFileContent(regConfig.url, componentName, file.path);
-        files.push({ path: file.path, content: Buffer.from(content2) });
-      }
-      const newHash = await hashBundle2(files);
-      if (newHash === lockEntry.hash) {
-        results.push({
-          qualifiedName,
-          oldVersion: lockEntry.version,
-          newVersion: version,
-          status: "up-to-date"
-        });
-      } else if (options2.dryRun) {
-        results.push({
-          qualifiedName,
-          oldVersion: lockEntry.version,
-          newVersion: version,
-          status: "would-update"
-        });
-      } else {
-        results.push({
-          qualifiedName,
-          oldVersion: lockEntry.version,
-          newVersion: version,
-          status: "updated"
-        });
-        updates.push({
-          qualifiedName,
-          component: normalizedManifest,
-          files,
-          newHash,
-          newVersion: version,
-          baseUrl: regConfig.url
-        });
-      }
-    }
-    spin?.succeed(`Checked ${componentsToUpdate.length} component(s)`);
-    if (options2.dryRun) {
-      outputDryRun(results, options2);
-      return;
-    }
-    if (updates.length === 0) {
-      if (!options2.quiet && !options2.json) {
-        logger.info("");
-        logger.success("All components are up to date.");
-      }
-      if (options2.json) {
-        console.log(JSON.stringify({ success: true, updated: [], upToDate: results }, null, 2));
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      await writer.write(value);
+      received += value.length;
+      if (total > 0) {
+        const pct = Math.round(received / total * 100);
+        spin.text = `Downloading... ${pct}%`;
       }
-      return;
     }
-    const installSpin = options2.quiet ? null : createSpinner({ text: "Updating components..." });
-    installSpin?.start();
-    for (const update of updates) {
-      for (const file of update.files) {
-        const fileObj = update.component.files.find((f) => f.path === file.path);
-        if (!fileObj)
-          continue;
-        const targetPath = join9(cwd, fileObj.target);
-        const targetDir = dirname7(targetPath);
-        if (!existsSync5(targetDir)) {
-          await mkdir7(targetDir, { recursive: true });
-        }
-        await writeFile3(targetPath, file.content);
-        if (options2.verbose) {
-          logger.info(`  \u2713 Updated ${fileObj.target}`);
-        }
-      }
-      const existingEntry = lock.installed[update.qualifiedName];
-      if (!existingEntry) {
-        throw new NotFoundError(`Component '${update.qualifiedName}' not found in lock file.`);
-      }
-      lock.installed[update.qualifiedName] = {
-        registry: existingEntry.registry,
-        version: update.newVersion,
-        hash: update.newHash,
-        files: existingEntry.files,
-        installedAt: existingEntry.installedAt,
-        updatedAt: new Date().toISOString()
-      };
+    await writer.end();
+    spin.succeed("Download complete");
+  } catch (error) {
+    spin.fail("Download failed");
+    await writer.end();
+    throw new SelfUpdateError(`Download interrupted: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function downloadToTemp(version) {
+  const execPath = getExecutablePath();
+  const tempPath = `${execPath}.new.${Date.now()}`;
+  const url = getDownloadUrl(version);
+  await downloadWithProgress(url, tempPath);
+  try {
+    chmodSync(tempPath, 493);
+  } catch (error) {
+    if (existsSync7(tempPath)) {
+      unlinkSync2(tempPath);
     }
-    installSpin?.succeed(`Updated ${updates.length} component(s)`);
-    await writeFile3(lockPath, JSON.stringify(lock, null, 2), "utf-8");
-    if (options2.json) {
-      console.log(JSON.stringify({
-        success: true,
-        updated: results.filter((r2) => r2.status === "updated"),
-        upToDate: results.filter((r2) => r2.status === "up-to-date")
-      }, null, 2));
-    } else if (!options2.quiet) {
-      logger.info("");
-      for (const result of results) {
-        if (result.status === "updated") {
-          logger.info(`  \u2713 ${result.qualifiedName} (${result.oldVersion} \u2192 ${result.newVersion})`);
-        } else if (result.status === "up-to-date" && options2.verbose) {
-          logger.info(`  \u25CB ${result.qualifiedName} (already up to date)`);
-        }
-      }
-      logger.info("");
-      logger.success(`Done! Updated ${updates.length} component(s).`);
+    throw new SelfUpdateError(`Failed to set permissions: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return { tempPath, execPath };
+}
+function atomicReplace(tempPath, execPath) {
+  const backupPath = `${execPath}.backup`;
+  try {
+    if (existsSync7(execPath)) {
+      renameSync2(execPath, backupPath);
+    }
+    renameSync2(tempPath, execPath);
+    if (existsSync7(backupPath)) {
+      unlinkSync2(backupPath);
     }
   } catch (error) {
-    spin?.fail("Failed to check for updates");
-    throw error;
+    if (existsSync7(backupPath) && !existsSync7(execPath)) {
+      try {
+        renameSync2(backupPath, execPath);
+      } catch {}
+    }
+    if (existsSync7(tempPath)) {
+      try {
+        unlinkSync2(tempPath);
+      } catch {}
+    }
+    throw new SelfUpdateError(`Update failed: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-function parseComponentSpec(spec) {
-  const atIndex = spec.lastIndexOf("@");
-  if (atIndex <= 0) {
-    return { component: spec };
+function cleanupTempFile(tempPath) {
+  if (existsSync7(tempPath)) {
+    try {
+      unlinkSync2(tempPath);
+    } catch {}
   }
-  return {
-    component: spec.slice(0, atIndex),
-    version: spec.slice(atIndex + 1)
-  };
 }
-function resolveComponentsToUpdate(lock, parsedComponents, options2) {
-  const installedComponents = Object.keys(lock.installed);
-  if (options2.all) {
-    return installedComponents.map((c) => ({ component: c }));
+
+// src/self-update/notify.ts
+function notifyUpdate(current, latest) {
+  if (!process.stdout.isTTY)
+    return;
+  console.error(`${kleur_default.cyan("info")}: update available - ${kleur_default.green(latest)} (current: ${kleur_default.dim(current)})`);
+  console.error(`  run ${kleur_default.cyan("`ocx self update`")} to upgrade`);
+}
+function notifyUpToDate(version) {
+  console.error(`${kleur_default.cyan("info")}: ocx unchanged - ${kleur_default.dim(version)}`);
+}
+function notifyUpdated(from, to) {
+  console.error(`  ${kleur_default.green("ocx updated")} - ${to} (from ${from})`);
+}
+
+// src/self-update/verify.ts
+import { createHash as createHash3 } from "crypto";
+var GITHUB_REPO3 = "kdcokenny/ocx";
+function parseSha256Sums(content2) {
+  const checksums = new Map;
+  for (const line of content2.split(`
+`)) {
+    const match = line.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+    if (match?.[1] && match[2]) {
+      checksums.set(match[2].trim(), match[1].toLowerCase());
+    }
   }
-  if (options2.registry) {
-    return installedComponents.filter((name) => {
-      const entry = lock.installed[name];
-      return entry?.registry === options2.registry;
-    }).map((c) => ({ component: c }));
+  return checksums;
+}
+function hashContent3(content2) {
+  return createHash3("sha256").update(content2).digest("hex");
+}
+async function fetchChecksums(version) {
+  const url = `https://github.com/${GITHUB_REPO3}/releases/download/v${version}/SHA256SUMS.txt`;
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new SelfUpdateError(`Failed to fetch checksums: ${response.status}`);
   }
-  const result = [];
-  for (const spec of parsedComponents) {
-    const name = spec.component;
-    if (!name.includes("/")) {
-      const suggestions = installedComponents.filter((installed) => installed.endsWith(`/${name}`));
-      if (suggestions.length === 1) {
-        throw new ValidationError(`Ambiguous component '${name}'. Did you mean '${suggestions[0]}'?`);
-      }
-      if (suggestions.length > 1) {
-        throw new ValidationError(`Ambiguous component '${name}'. Found in multiple registries:
-` + suggestions.map((s) => `  - ${s}`).join(`
-`) + `
+  const content2 = await response.text();
+  return parseSha256Sums(content2);
+}
+async function verifyChecksum(filePath, expectedHash, filename) {
+  const file = Bun.file(filePath);
+  const content2 = await file.arrayBuffer();
+  const actualHash = hashContent3(Buffer.from(content2));
+  if (actualHash !== expectedHash) {
+    throw new IntegrityError(filename, expectedHash, actualHash);
+  }
+}
 
-Please use a fully qualified name (registry/component).`);
-      }
-      throw new ValidationError(`Component '${name}' must include a registry prefix (e.g., 'kdco/${name}').`);
+// src/commands/self/update.ts
+var SEMVER_PATTERN = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
+async function updateCommand(options2) {
+  const method = options2.method ? parseInstallMethod(options2.method) : detectInstallMethod();
+  const result = await checkForUpdate();
+  if (!result) {
+    throw new SelfUpdateError("Failed to check for updates");
+  }
+  const { current, latest, updateAvailable } = result;
+  if (!updateAvailable && !options2.force) {
+    notifyUpToDate(current);
+    return;
+  }
+  const targetVersion = latest;
+  switch (method) {
+    case "curl": {
+      await updateViaCurl(current, targetVersion);
+      break;
     }
-    if (!lock.installed[name]) {
-      throw new NotFoundError(`Component '${name}' is not installed.
-Run 'ocx add ${name}' to install it first.`);
+    case "npm":
+    case "pnpm":
+    case "bun":
+    case "unknown": {
+      await updateViaPackageManager(method, current, targetVersion);
+      break;
     }
-    result.push(spec);
   }
-  return result;
 }
-function outputDryRun(results, options2) {
-  const wouldUpdate = results.filter((r2) => r2.status === "would-update");
-  const upToDate = results.filter((r2) => r2.status === "up-to-date");
-  if (options2.json) {
-    console.log(JSON.stringify({ dryRun: true, wouldUpdate, upToDate }, null, 2));
-    return;
+async function updateViaCurl(current, targetVersion) {
+  const url = getDownloadUrl(targetVersion);
+  const filename = url.split("/").pop();
+  if (!filename) {
+    throw new SelfUpdateError("Failed to determine binary filename from download URL");
   }
-  if (!options2.quiet) {
-    logger.info("");
-    if (wouldUpdate.length > 0) {
-      logger.info("Would update:");
-      for (const result of wouldUpdate) {
-        logger.info(`  ${result.qualifiedName} (${result.oldVersion} \u2192 ${result.newVersion})`);
+  const checksums = await fetchChecksums(targetVersion);
+  const expectedHash = checksums.get(filename);
+  if (!expectedHash) {
+    throw new SelfUpdateError(`Security error: No checksum found for ${filename}. Update aborted.`);
+  }
+  const { tempPath, execPath } = await downloadToTemp(targetVersion);
+  try {
+    await verifyChecksum(tempPath, expectedHash, filename);
+  } catch (error) {
+    cleanupTempFile(tempPath);
+    throw error;
+  }
+  atomicReplace(tempPath, execPath);
+  notifyUpdated(current, targetVersion);
+}
+async function runPackageManager(cmd) {
+  const proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe" });
+  const exitCode = await proc.exited;
+  if (exitCode !== 0) {
+    const stderr = await new Response(proc.stderr).text();
+    throw new SelfUpdateError(`Package manager command failed: ${stderr.trim()}`);
+  }
+}
+async function updateViaPackageManager(method, current, targetVersion) {
+  if (!SEMVER_PATTERN.test(targetVersion)) {
+    throw new SelfUpdateError(`Invalid version format: ${targetVersion}`);
+  }
+  const spin = createSpinner({ text: `Updating via ${method}...` });
+  spin.start();
+  try {
+    switch (method) {
+      case "npm": {
+        await runPackageManager(["npm", "install", "-g", `ocx@${targetVersion}`]);
+        break;
       }
-    }
-    if (upToDate.length > 0 && options2.verbose) {
-      logger.info("");
-      logger.info("Already up to date:");
-      for (const result of upToDate) {
-        logger.info(`  ${result.qualifiedName}`);
+      case "yarn": {
+        await runPackageManager(["yarn", "global", "add", `ocx@${targetVersion}`]);
+        break;
+      }
+      case "pnpm": {
+        await runPackageManager(["pnpm", "install", "-g", `ocx@${targetVersion}`]);
+        break;
+      }
+      case "bun": {
+        await runPackageManager(["bun", "install", "-g", `ocx@${targetVersion}`]);
+        break;
+      }
+      case "unknown": {
+        throw new SelfUpdateError(`Could not detect install method. Update manually with one of:
+` + `  npm install -g ocx@latest
+` + `  pnpm install -g ocx@latest
+` + "  bun install -g ocx@latest");
       }
     }
-    if (wouldUpdate.length > 0) {
-      logger.info("");
-      logger.info("Run without --dry-run to apply changes.");
-    } else {
-      logger.info("All components are up to date.");
+    spin.succeed(`Updated via ${method}`);
+    notifyUpdated(current, targetVersion);
+  } catch (error) {
+    if (error instanceof SelfUpdateError) {
+      spin.fail(`Update failed`);
+      throw error;
     }
+    spin.fail(`Update failed`);
+    throw new SelfUpdateError(`Failed to run ${method}: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-async function hashContent3(content2) {
-  return createHash3("sha256").update(content2).digest("hex");
+function registerSelfUpdateCommand(parent) {
+  parent.command("update").description("Update OCX to the latest version").option("-f, --force", "Reinstall even if already up to date").option("-m, --method <method>", "Override install method detection (curl|npm|pnpm|bun)").action(wrapAction(async (options2) => {
+    await updateCommand(options2);
+  }));
 }
-async function hashBundle2(files) {
-  const sorted = [...files].sort((a, b) => a.path.localeCompare(b.path));
-  const manifestParts = [];
-  for (const file of sorted) {
-    const hash = await hashContent3(file.content);
-    manifestParts.push(`${file.path}:${hash}`);
-  }
-  return hashContent3(manifestParts.join(`
-`));
+
+// src/commands/self/index.ts
+function registerSelfCommand(program2) {
+  const self = program2.command("self").description("Manage the OCX CLI");
+  registerSelfUpdateCommand(self);
 }
 
 // src/self-update/index.ts
@@ -18362,7 +18639,7 @@ function registerUpdateCheckHook(program2) {
   });
 }
 // src/index.ts
-var version = "1.3.0";
+var version = "1.3.2";
 async function main2() {
   const program2 = new Command().name("ocx").description("OpenCode Extensions - Install agents, skills, plugins, and commands").version(version);
   registerInitCommand(program2);
@@ -18391,4 +18668,4 @@ export {
   buildRegistry
 };
 
-//# debugId=FE5CBBF0E272CBE164756E2164756E21
+//# debugId=B7C7102D18EED5CE64756E2164756E21