ocx 1.4.0 → 1.4.1

package/dist/index.js

@@ -9814,6 +9814,120 @@ var coerce = {
   date: (arg) => ZodDate.create({ ...arg, coerce: true })
 };
 var NEVER = INVALID;
+// src/schemas/registry.ts
+import { isAbsolute, normalize } from "path";
+
+// src/utils/errors.ts
+var EXIT_CODES = {
+  SUCCESS: 0,
+  GENERAL: 1,
+  NOT_FOUND: 66,
+  NETWORK: 69,
+  CONFIG: 78,
+  INTEGRITY: 1
+};
+
+class OCXError extends Error {
+  code;
+  exitCode;
+  constructor(message, code, exitCode = EXIT_CODES.GENERAL) {
+    super(message);
+    this.code = code;
+    this.exitCode = exitCode;
+    this.name = "OCXError";
+  }
+}
+
+class NotFoundError extends OCXError {
+  constructor(message) {
+    super(message, "NOT_FOUND", EXIT_CODES.NOT_FOUND);
+    this.name = "NotFoundError";
+  }
+}
+
+class NetworkError extends OCXError {
+  constructor(message) {
+    super(message, "NETWORK_ERROR", EXIT_CODES.NETWORK);
+    this.name = "NetworkError";
+  }
+}
+
+class ConfigError extends OCXError {
+  constructor(message) {
+    super(message, "CONFIG_ERROR", EXIT_CODES.CONFIG);
+    this.name = "ConfigError";
+  }
+}
+
+class ValidationError extends OCXError {
+  constructor(message) {
+    super(message, "VALIDATION_ERROR", EXIT_CODES.GENERAL);
+    this.name = "ValidationError";
+  }
+}
+
+class ConflictError extends OCXError {
+  constructor(message) {
+    super(message, "CONFLICT", EXIT_CODES.GENERAL);
+    this.name = "ConflictError";
+  }
+}
+
+class IntegrityError extends OCXError {
+  constructor(component, expected, found) {
+    const message = `Integrity verification failed for "${component}"
+` + `  Expected: ${expected}
+` + `  Found:    ${found}
+
+` + `The registry content has changed since this component was locked.
+` + `Use 'ocx update ${component}' to intentionally update this component.`;
+    super(message, "INTEGRITY_ERROR", EXIT_CODES.INTEGRITY);
+    this.name = "IntegrityError";
+  }
+}
+
+class SelfUpdateError extends OCXError {
+  constructor(message) {
+    super(message, "UPDATE_ERROR", EXIT_CODES.GENERAL);
+    this.name = "SelfUpdateError";
+  }
+}
+
+class OcxConfigError extends OCXError {
+  constructor(message) {
+    super(message, "CONFIG_ERROR", EXIT_CODES.CONFIG);
+    this.name = "OcxConfigError";
+  }
+}
+
+class ProfileNotFoundError extends OCXError {
+  constructor(name) {
+    super(`Profile "${name}" not found`, "NOT_FOUND", EXIT_CODES.NOT_FOUND);
+    this.name = "ProfileNotFoundError";
+  }
+}
+
+class ProfileExistsError extends OCXError {
+  constructor(name) {
+    super(`Profile "${name}" already exists`, "CONFLICT", EXIT_CODES.GENERAL);
+    this.name = "ProfileExistsError";
+  }
+}
+
+class InvalidProfileNameError extends OCXError {
+  constructor(name, reason) {
+    super(`Invalid profile name "${name}": ${reason}`, "VALIDATION_ERROR", EXIT_CODES.GENERAL);
+    this.name = "InvalidProfileNameError";
+  }
+}
+
+class ProfilesNotInitializedError extends OCXError {
+  constructor() {
+    super("Profiles not initialized. Run 'ocx profile add default' first.", "NOT_FOUND", EXIT_CODES.NOT_FOUND);
+    this.name = "ProfilesNotInitializedError";
+  }
+}
+
 // src/schemas/registry.ts
 var npmSpecifierSchema = exports_external.string().refine((val) => val.startsWith("npm:"), {
   message: 'npm specifier must start with "npm:" prefix'
@@ -9860,8 +9974,10 @@ var componentTypeSchema = exports_external.enum([
   "ocx:plugin",
   "ocx:command",
   "ocx:tool",
-  "ocx:bundle"
+  "ocx:bundle",
+  "ocx:profile"
 ]);
+var profileTargetPathSchema = exports_external.enum(["ocx.jsonc", "opencode.jsonc", "AGENTS.md"]);
 var targetPathSchema = exports_external.string().refine((path) => path.startsWith(".opencode/"), {
   message: 'Target path must start with ".opencode/"'
 }).refine((path) => {
@@ -9901,7 +10017,7 @@ var mcpServerObjectSchema = exports_external.object({
 var mcpServerRefSchema = exports_external.union([exports_external.string(), mcpServerObjectSchema]);
 var componentFileObjectSchema = exports_external.object({
   path: exports_external.string().min(1, "File path cannot be empty"),
-  target: targetPathSchema
+  target: exports_external.string().min(1, "Target path cannot be empty")
 });
 var componentFileSchema = exports_external.union([
   exports_external.string().min(1, "File path cannot be empty"),
@@ -9993,16 +10109,56 @@ var componentManifestSchema = exports_external.object({
   npmDevDependencies: exports_external.array(exports_external.string()).optional(),
   opencode: opencodeConfigSchema.optional()
 });
+function validateSafePath(filePath) {
+  if (isAbsolute(filePath)) {
+    throw new ValidationError(`Invalid path: "${filePath}" - absolute paths not allowed`);
+  }
+  if (filePath.startsWith("~")) {
+    throw new ValidationError(`Invalid path: "${filePath}" - home directory paths not allowed`);
+  }
+  const normalized = normalize(filePath);
+  if (normalized.startsWith("..")) {
+    throw new ValidationError(`Invalid path: "${filePath}" - path traversal not allowed`);
+  }
+}
 function inferTargetPath(sourcePath) {
   return `.opencode/${sourcePath}`;
 }
-function normalizeFile(file) {
+function validateFileTarget(target, componentType) {
+  const isProfile = componentType === "ocx:profile";
+  if (isProfile) {
+    const isProfileFile = profileTargetPathSchema.safeParse(target).success;
+    const isOpencodeTarget = target.startsWith(".opencode/");
+    if (!isProfileFile && !isOpencodeTarget) {
+      throw new ValidationError(`Invalid profile target: "${target}". ` + `Must be a profile file (ocx.jsonc, opencode.jsonc, AGENTS.md) or start with ".opencode/"`);
+    }
+    if (isOpencodeTarget) {
+      const parseResult = targetPathSchema.safeParse(target);
+      if (!parseResult.success) {
+        throw new ValidationError(`Invalid embedded target: "${target}". ${parseResult.error.errors[0]?.message}`);
+      }
+    }
+  } else {
+    const parseResult = targetPathSchema.safeParse(target);
+    if (!parseResult.success) {
+      throw new ValidationError(`Invalid target: "${target}". ${parseResult.error.errors[0]?.message}`);
+    }
+  }
+}
+function normalizeFile(file, componentType) {
+  const isProfile = componentType === "ocx:profile";
   if (typeof file === "string") {
+    validateSafePath(file);
+    const target = isProfile ? file : inferTargetPath(file);
+    validateFileTarget(target, componentType);
     return {
       path: file,
-      target: inferTargetPath(file)
+      target
     };
   }
+  validateSafePath(file.path);
+  validateSafePath(file.target);
+  validateFileTarget(file.target, componentType);
   return file;
 }
 function normalizeMcpServer(server) {
@@ -10028,7 +10184,7 @@ function normalizeComponentManifest(manifest) {
   }
   return {
     ...manifest,
-    files: manifest.files.map(normalizeFile),
+    files: manifest.files.map((file) => normalizeFile(file, manifest.type)),
     opencode: normalizedOpencode
   };
 }
@@ -10128,9 +10284,15 @@ function findOcxConfig(cwd) {
   }
   return { path: dotOpencodePath, exists: false };
 }
-function findOcxLock(cwd) {
+function findOcxLock(cwd, options) {
   const dotOpencodePath = path.join(cwd, LOCAL_CONFIG_DIR, LOCK_FILE);
   const rootPath = path.join(cwd, LOCK_FILE);
+  if (options?.isFlattened) {
+    if (existsSync(rootPath)) {
+      return { path: rootPath, exists: true };
+    }
+    return { path: rootPath, exists: false };
+  }
   if (existsSync(dotOpencodePath)) {
     return { path: dotOpencodePath, exists: true };
   }
@@ -10160,8 +10322,8 @@ async function writeOcxConfig(cwd, config, existingPath) {
   const content = JSON.stringify(config, null, 2);
   await Bun.write(configPath, content);
 }
-async function readOcxLock(cwd) {
-  const { path: lockPath, exists } = findOcxLock(cwd);
+async function readOcxLock(cwd, options) {
+  const { path: lockPath, exists } = findOcxLock(cwd, options);
   if (!exists) {
     return null;
   }
@@ -10177,124 +10339,13 @@ async function writeOcxLock(cwd, lock, existingPath) {
   await Bun.write(lockPath, content);
 }
 
-// src/utils/errors.ts
-var EXIT_CODES = {
-  SUCCESS: 0,
-  GENERAL: 1,
-  NOT_FOUND: 66,
-  NETWORK: 69,
-  CONFIG: 78,
-  INTEGRITY: 1
-};
-
-class OCXError extends Error {
-  code;
-  exitCode;
-  constructor(message, code, exitCode = EXIT_CODES.GENERAL) {
-    super(message);
-    this.code = code;
-    this.exitCode = exitCode;
-    this.name = "OCXError";
-  }
-}
-
-class NotFoundError extends OCXError {
-  constructor(message) {
-    super(message, "NOT_FOUND", EXIT_CODES.NOT_FOUND);
-    this.name = "NotFoundError";
-  }
-}
-
-class NetworkError extends OCXError {
-  constructor(message) {
-    super(message, "NETWORK_ERROR", EXIT_CODES.NETWORK);
-    this.name = "NetworkError";
-  }
-}
-
-class ConfigError extends OCXError {
-  constructor(message) {
-    super(message, "CONFIG_ERROR", EXIT_CODES.CONFIG);
-    this.name = "ConfigError";
-  }
-}
-
-class ValidationError extends OCXError {
-  constructor(message) {
-    super(message, "VALIDATION_ERROR", EXIT_CODES.GENERAL);
-    this.name = "ValidationError";
-  }
-}
-
-class ConflictError extends OCXError {
-  constructor(message) {
-    super(message, "CONFLICT", EXIT_CODES.GENERAL);
-    this.name = "ConflictError";
-  }
-}
-
-class IntegrityError extends OCXError {
-  constructor(component, expected, found) {
-    const message = `Integrity verification failed for "${component}"
-` + `  Expected: ${expected}
-` + `  Found:    ${found}
-
-` + `The registry content has changed since this component was locked.
-` + `Use 'ocx update ${component}' to intentionally update this component.`;
-    super(message, "INTEGRITY_ERROR", EXIT_CODES.INTEGRITY);
-    this.name = "IntegrityError";
-  }
-}
-
-class SelfUpdateError extends OCXError {
-  constructor(message) {
-    super(message, "UPDATE_ERROR", EXIT_CODES.GENERAL);
-    this.name = "SelfUpdateError";
-  }
-}
-
-class OcxConfigError extends OCXError {
-  constructor(message) {
-    super(message, "CONFIG_ERROR", EXIT_CODES.CONFIG);
-    this.name = "OcxConfigError";
-  }
-}
-
-class ProfileNotFoundError extends OCXError {
-  constructor(name) {
-    super(`Profile "${name}" not found`, "NOT_FOUND", EXIT_CODES.NOT_FOUND);
-    this.name = "ProfileNotFoundError";
-  }
-}
-
-class ProfileExistsError extends OCXError {
-  constructor(name) {
-    super(`Profile "${name}" already exists`, "CONFLICT", EXIT_CODES.GENERAL);
-    this.name = "ProfileExistsError";
-  }
-}
-
-class InvalidProfileNameError extends OCXError {
-  constructor(name, reason) {
-    super(`Invalid profile name "${name}": ${reason}`, "VALIDATION_ERROR", EXIT_CODES.GENERAL);
-    this.name = "InvalidProfileNameError";
-  }
-}
-
-class ProfilesNotInitializedError extends OCXError {
-  constructor() {
-    super("Profiles not initialized. Run 'ocx profile add default' first.", "NOT_FOUND", EXIT_CODES.NOT_FOUND);
-    this.name = "ProfilesNotInitializedError";
-  }
-}
-
 // src/utils/paths.ts
 import { stat } from "fs/promises";
 import { homedir } from "os";
-import { isAbsolute, join } from "path";
+import { isAbsolute as isAbsolute2, join } from "path";
 function getGlobalConfigPath() {
   const xdg = process.env.XDG_CONFIG_HOME;
-  const base = xdg && isAbsolute(xdg) ? xdg : join(homedir(), ".config");
+  const base = xdg && isAbsolute2(xdg) ? xdg : join(homedir(), ".config");
   return join(base, "opencode");
 }
 async function globalDirectoryExists() {
@@ -10305,8 +10356,8 @@ async function globalDirectoryExists() {
     return false;
   }
 }
-function resolveTargetPath(target, isGlobal) {
-  if (isGlobal && target.startsWith(".opencode/")) {
+function resolveTargetPath(target, isFlattened) {
+  if (isFlattened && target.startsWith(".opencode/")) {
     return target.slice(".opencode/".length);
   }
   return target;
@@ -10887,7 +10938,7 @@ class ConfigResolver {
 // package.json
 var package_default = {
   name: "ocx",
-  version: "1.4.0",
+  version: "1.4.1",
   description: "OCX CLI - ShadCN-style registry for OpenCode extensions. Install agents, plugins, skills, and MCP servers.",
   author: "kdcokenny",
   license: "MIT",
@@ -11162,8 +11213,19 @@ async function resolveDependencies(registries, componentNames) {
 // src/updaters/update-opencode-config.ts
 import { existsSync as existsSync4 } from "fs";
 import { mkdir as mkdir3 } from "fs/promises";
+import { homedir as homedir3 } from "os";
 import path4 from "path";
 var LOCAL_CONFIG_DIR3 = ".opencode";
+function isGlobalConfigPath(cwd) {
+  const base = process.env.XDG_CONFIG_HOME || path4.join(homedir3(), ".config");
+  const globalConfigDir = path4.resolve(base, "opencode");
+  const resolvedCwd = path4.resolve(cwd);
+  if (resolvedCwd === globalConfigDir) {
+    return true;
+  }
+  const relative2 = path4.relative(globalConfigDir, resolvedCwd);
+  return relative2 !== "" && !relative2.startsWith("..") && !path4.isAbsolute(relative2);
+}
 var JSONC_OPTIONS = {
   formattingOptions: {
     tabSize: 2,
@@ -11178,6 +11240,17 @@ var OPENCODE_CONFIG_TEMPLATE = `{
 }
 `;
 function findOpencodeConfig(cwd) {
+  if (isGlobalConfigPath(cwd)) {
+    const rootJsonc2 = path4.join(cwd, "opencode.jsonc");
+    const rootJson2 = path4.join(cwd, "opencode.json");
+    if (existsSync4(rootJsonc2)) {
+      return { path: rootJsonc2, exists: true };
+    }
+    if (existsSync4(rootJson2)) {
+      return { path: rootJson2, exists: true };
+    }
+    return { path: rootJsonc2, exists: false };
+  }
   const dotOpencodeJsonc = path4.join(cwd, LOCAL_CONFIG_DIR3, "opencode.jsonc");
   const dotOpencodeJson = path4.join(cwd, LOCAL_CONFIG_DIR3, "opencode.json");
   if (existsSync4(dotOpencodeJsonc)) {
@@ -11267,7 +11340,7 @@ async function updateOpencodeJsonConfig(cwd, opencode) {
   } else {
     const config = { $schema: "https://opencode.ai/config.json" };
     content = JSON.stringify(config, null, "\t");
-    configPath = path4.join(cwd, LOCAL_CONFIG_DIR3, "opencode.jsonc");
+    configPath = isGlobalConfigPath(cwd) ? path4.join(cwd, "opencode.jsonc") : path4.join(cwd, LOCAL_CONFIG_DIR3, "opencode.jsonc");
     await mkdir3(path4.dirname(configPath), { recursive: true });
     created = true;
   }
@@ -13182,8 +13255,9 @@ function registerAddCommand(program2) {
         const resolver = await ConfigResolver.create(options2.cwd ?? process.cwd(), {
           profile: options2.profile
         });
+        const profileDir = getProfileDir(options2.profile);
         provider = {
-          cwd: resolver.getCwd(),
+          cwd: profileDir,
           getRegistries: () => resolver.getRegistries(),
           getComponentPath: () => resolver.getComponentPath()
         };
@@ -13298,10 +13372,11 @@ async function handleNpmPlugins(inputs, options2, cwd) {
 }
 async function runRegistryAddCore(componentNames, options2, provider) {
   const cwd = provider.cwd;
-  const { path: lockPath } = findOcxLock(cwd);
+  const isFlattened = !!options2.global || !!options2.profile;
+  const { path: lockPath } = findOcxLock(cwd, { isFlattened });
   const registries = provider.getRegistries();
   let lock = { lockVersion: 1, installed: {} };
-  const existingLock = await readOcxLock(cwd);
+  const existingLock = await readOcxLock(cwd, { isFlattened });
   if (existingLock) {
     lock = existingLock;
   }
@@ -13354,7 +13429,7 @@ async function runRegistryAddCore(componentNames, options2, provider) {
       }
       const computedHash = await hashBundle(files);
       for (const file of component.files) {
-        const targetPath = join3(cwd, resolveTargetPath(file.target, !!options2.global));
+        const targetPath = join3(cwd, resolveTargetPath(file.target, isFlattened));
         assertPathInside(targetPath, cwd);
       }
       const existingEntry = lock.installed[component.qualifiedName];
@@ -13363,7 +13438,7 @@ async function runRegistryAddCore(componentNames, options2, provider) {
         throw new IntegrityError(component.qualifiedName, existingEntry.hash, computedHash);
       }
       for (const file of component.files) {
-        const resolvedTarget = resolveTargetPath(file.target, !!options2.global);
+        const resolvedTarget = resolveTargetPath(file.target, isFlattened);
         const targetPath = join3(cwd, resolvedTarget);
         if (existsSync5(targetPath)) {
           const conflictingComponent = findComponentByFile(lock, resolvedTarget);
@@ -13387,7 +13462,7 @@ async function runRegistryAddCore(componentNames, options2, provider) {
         const componentFile = component.files.find((f) => f.path === file.path);
         if (!componentFile)
           continue;
-        const resolvedTarget = resolveTargetPath(componentFile.target, !!options2.global);
+        const resolvedTarget = resolveTargetPath(componentFile.target, isFlattened);
         const targetPath = join3(cwd, resolvedTarget);
         if (existsSync5(targetPath)) {
           const existingContent = await Bun.file(targetPath).text();
@@ -13415,7 +13490,7 @@ async function runRegistryAddCore(componentNames, options2, provider) {
       const installResult = await installComponent(component, files, cwd, {
         force: options2.force,
         verbose: options2.verbose,
-        isGlobal: options2.global
+        isFlattened
       });
       if (options2.verbose) {
         for (const f of installResult.skipped) {
@@ -13436,7 +13511,7 @@ async function runRegistryAddCore(componentNames, options2, provider) {
         registry: component.registryName,
         version: index.version,
         hash: computedHash,
-        files: component.files.map((f) => resolveTargetPath(f.target, !!options2.global)),
+        files: component.files.map((f) => resolveTargetPath(f.target, isFlattened)),
         installedAt: new Date().toISOString()
       };
     }
@@ -13453,12 +13528,12 @@ async function runRegistryAddCore(componentNames, options2, provider) {
     }
     const hasNpmDeps = resolved.npmDependencies.length > 0;
     const hasNpmDevDeps = resolved.npmDevDependencies.length > 0;
-    const packageJsonPath = options2.global ? join3(cwd, "package.json") : join3(cwd, ".opencode/package.json");
+    const packageJsonPath = options2.global || options2.profile ? join3(cwd, "package.json") : join3(cwd, ".opencode/package.json");
     if (hasNpmDeps || hasNpmDevDeps) {
       const npmSpin = options2.quiet ? null : createSpinner({ text: `Updating ${packageJsonPath}...` });
       npmSpin?.start();
       try {
-        await updateOpencodeDevDependencies(cwd, resolved.npmDependencies, resolved.npmDevDependencies, { isGlobal: options2.global });
+        await updateOpencodeDevDependencies(cwd, resolved.npmDependencies, resolved.npmDevDependencies, { isFlattened });
         const totalDeps = resolved.npmDependencies.length + resolved.npmDevDependencies.length;
         npmSpin?.succeed(`Added ${totalDeps} dependencies to ${packageJsonPath}`);
       } catch (error) {
@@ -13494,7 +13569,7 @@ async function installComponent(component, files, cwd, options2) {
     const componentFile = component.files.find((f) => f.path === file.path);
     if (!componentFile)
       continue;
-    const resolvedTarget = resolveTargetPath(componentFile.target, !!options2.isGlobal);
+    const resolvedTarget = resolveTargetPath(componentFile.target, !!options2.isFlattened);
     const targetPath = join3(cwd, resolvedTarget);
     const targetDir = dirname(targetPath);
     if (existsSync5(targetPath)) {
@@ -13594,7 +13669,7 @@ async function readOpencodePackageJson(opencodeDir) {
     return JSON.parse(content2);
   } catch (e3) {
     const message = e3 instanceof Error ? e3.message : String(e3);
-    throw new ConfigError(`Invalid .opencode/package.json: ${message}`);
+    throw new ConfigError(`Invalid ${pkgPath}: ${message}`);
   }
 }
 async function ensureManifestFilesAreTracked(opencodeDir) {
@@ -13621,14 +13696,14 @@ async function updateOpencodeDevDependencies(cwd, npmDeps, npmDevDeps, options2
   const allDepSpecs = [...npmDeps, ...npmDevDeps];
   if (allDepSpecs.length === 0)
     return;
-  const packageDir = options2.isGlobal ? cwd : join3(cwd, ".opencode");
+  const packageDir = options2.isFlattened ? cwd : join3(cwd, ".opencode");
   await mkdir4(packageDir, { recursive: true });
   const parsedDeps = allDepSpecs.map(parseNpmDependency);
   const existing = await readOpencodePackageJson(packageDir);
   const updated = mergeDevDependencies(existing, parsedDeps);
   await Bun.write(join3(packageDir, "package.json"), `${JSON.stringify(updated, null, 2)}
 `);
-  if (!options2.isGlobal) {
+  if (!options2.isFlattened) {
     await ensureManifestFilesAreTracked(packageDir);
   }
 }
@@ -13689,7 +13764,7 @@ async function buildRegistry(options2) {
     const packumentPath = join4(componentsDir, `${component.name}.json`);
     await Bun.write(packumentPath, JSON.stringify(packument, null, 2));
     for (const rawFile of component.files) {
-      const file = normalizeFile(rawFile);
+      const file = normalizeFile(rawFile, component.type);
       const sourceFilePath = join4(sourcePath, "files", file.path);
       const destFilePath = join4(componentsDir, component.name, file.path);
       const destFileDir = dirname2(destFilePath);
@@ -14851,11 +14926,40 @@ Diff for ${res.name}:`));
 }
 
 // src/commands/ghost/migrate.ts
-import { copyFileSync, existsSync as existsSync7, lstatSync, readdirSync, renameSync, unlinkSync } from "fs";
+import {
+  copyFileSync,
+  cpSync,
+  existsSync as existsSync7,
+  lstatSync,
+  mkdirSync,
+  readdirSync,
+  renameSync,
+  rmdirSync,
+  rmSync,
+  unlinkSync
+} from "fs";
 import path6 from "path";
 var GHOST_CONFIG_FILE = "ghost.jsonc";
 var BACKUP_EXT = ".bak";
 var CURRENT_SYMLINK = "current";
+var FLATTEN_DIRS = ["plugin", "agent", "skill", "command"];
+function moveAtomically(source, destination, isDir) {
+  try {
+    renameSync(source, destination);
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "EXDEV") {
+      if (isDir) {
+        cpSync(source, destination, { recursive: true });
+        rmSync(source, { recursive: true, force: true });
+      } else {
+        copyFileSync(source, destination);
+        unlinkSync(source);
+      }
+    } else {
+      throw err;
+    }
+  }
+}
 function planMigration() {
   const profilesDir = getProfilesDir();
   const plan = {
@@ -14899,6 +15003,55 @@ function planMigration() {
       backup: backupPath
     });
   }
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.name === CURRENT_SYMLINK)
+      continue;
+    const profileName = entry.name;
+    const profileDir = path6.join(profilesDir, profileName);
+    const dotOpencode = path6.join(profileDir, ".opencode");
+    if (!existsSync7(dotOpencode))
+      continue;
+    for (const dir of FLATTEN_DIRS) {
+      const source = path6.join(dotOpencode, dir);
+      const destination = path6.join(profileDir, dir);
+      if (!existsSync7(source))
+        continue;
+      try {
+        const stat3 = lstatSync(source);
+        if (!stat3.isDirectory()) {
+          plan.skipped.push({
+            profileName,
+            reason: `.opencode/${dir} is not a directory`
+          });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (existsSync7(destination)) {
+        plan.skipped.push({
+          profileName,
+          reason: `${dir}/ exists in both .opencode/ and profile root`
+        });
+        continue;
+      }
+      const backupPath = source + BACKUP_EXT;
+      if (existsSync7(backupPath)) {
+        plan.skipped.push({
+          profileName,
+          reason: `backup already exists: .opencode/${dir}${BACKUP_EXT}`
+        });
+        continue;
+      }
+      plan.profiles.push({
+        type: "move-dir",
+        profileName,
+        source,
+        destination,
+        backup: backupPath
+      });
+    }
+  }
   const currentPath = path6.join(profilesDir, CURRENT_SYMLINK);
   if (existsSync7(currentPath)) {
     try {
@@ -14924,15 +15077,20 @@ function executeMigration(plan) {
   const completedRenames = [];
   try {
     for (const action of plan.profiles) {
-      copyFileSync(action.source, action.backup);
-      completedBackups.push(action.backup);
+      if (action.type === "rename") {
+        copyFileSync(action.source, action.backup);
+      } else {
+        cpSync(action.source, action.backup, { recursive: true });
+      }
+      completedBackups.push({ path: action.backup, isDir: action.type === "move-dir" });
     }
     for (const action of plan.profiles) {
-      renameSync(action.source, action.destination);
+      moveAtomically(action.source, action.destination, action.type === "move-dir");
       completedRenames.push({
         source: action.source,
         destination: action.destination,
-        backup: action.backup
+        backup: action.backup,
+        isDir: action.type === "move-dir"
       });
     }
     if (plan.symlink) {
@@ -14945,32 +15103,61 @@ function executeMigration(plan) {
     }
     for (const backup of completedBackups) {
       try {
-        unlinkSync(backup);
+        if (backup.isDir) {
+          rmSync(backup.path, { recursive: true, force: true });
+        } else {
+          unlinkSync(backup.path);
+        }
       } catch {}
     }
   } catch (error) {
     for (const rename2 of completedRenames) {
       try {
         if (existsSync7(rename2.destination)) {
-          renameSync(rename2.destination, rename2.source);
+          if (rename2.isDir) {
+            rmSync(rename2.destination, { recursive: true, force: true });
+          } else {
+            unlinkSync(rename2.destination);
+          }
         }
-      } catch {
-        try {
-          if (existsSync7(rename2.backup)) {
+        mkdirSync(path6.dirname(rename2.source), { recursive: true });
+        if (existsSync7(rename2.backup)) {
+          if (rename2.isDir) {
+            cpSync(rename2.backup, rename2.source, { recursive: true });
+          } else {
             copyFileSync(rename2.backup, rename2.source);
           }
-        } catch {}
-      }
+        }
+      } catch {}
     }
     for (const backup of completedBackups) {
       try {
-        if (existsSync7(backup)) {
-          unlinkSync(backup);
+        if (existsSync7(backup.path)) {
+          if (backup.isDir) {
+            rmSync(backup.path, { recursive: true, force: true });
+          } else {
+            unlinkSync(backup.path);
+          }
         }
       } catch {}
     }
     throw error;
   }
+  try {
+    const processedProfiles = new Set(plan.profiles.filter((a) => a.type === "move-dir").map((a) => a.profileName));
+    for (const profileName of processedProfiles) {
+      const profileDir = path6.join(getProfilesDir(), profileName);
+      const dotOpencode = path6.join(profileDir, ".opencode");
+      if (existsSync7(dotOpencode)) {
+        const remaining = readdirSync(dotOpencode);
+        if (remaining.length === 0) {
+          try {
+            rmdirSync(dotOpencode);
+          } catch {}
+        }
+      }
+    }
+  } catch {}
 }
 function printPlan(plan, dryRun) {
   const prefix = dryRun ? "[DRY-RUN] " : "";
@@ -14983,7 +15170,12 @@ function printPlan(plan, dryRun) {
   if (plan.profiles.length > 0 || plan.skipped.length > 0) {
     console.log("Profiles:");
     for (const action of plan.profiles) {
-      console.log(`  \u2713 ${action.profileName}: ${GHOST_CONFIG_FILE} \u2192 ${OCX_CONFIG_FILE}`);
+      if (action.type === "rename") {
+        console.log(`  \u2713 ${action.profileName}: ${GHOST_CONFIG_FILE} \u2192 ${OCX_CONFIG_FILE}`);
+      } else {
+        const dirName = path6.basename(action.source);
+        console.log(`  \u2713 ${action.profileName}: .opencode/${dirName}/ \u2192 ${dirName}/`);
+      }
     }
     for (const skipped of plan.skipped) {
       console.log(`  \u26A0 ${skipped.profileName}: skipped (${skipped.reason})`);
@@ -15389,9 +15581,290 @@ async function runOpencode(pathArg, args, options2) {
   }
 }
 
+// src/commands/profile/install-from-registry.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync9 } from "fs";
+import { mkdir as mkdir8, mkdtemp, rename as rename2, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname4, join as join8 } from "path";
+var PROFILE_FILE_TARGETS = new Set(["ocx.jsonc", "opencode.jsonc", "AGENTS.md"]);
+function isProfileFile(target) {
+  return PROFILE_FILE_TARGETS.has(target);
+}
+function hashContent2(content2) {
+  return createHash2("sha256").update(content2).digest("hex");
+}
+function hashBundle2(files) {
+  const sorted = [...files].sort((a, b) => a.path.localeCompare(b.path));
+  const manifestParts = [];
+  for (const file of sorted) {
+    const hash = hashContent2(file.content);
+    manifestParts.push(`${file.path}:${hash}`);
+  }
+  return hashContent2(manifestParts.join(`
+`));
+}
+async function installProfileFromRegistry(options2) {
+  const { namespace, component, profileName, force, registryUrl, registries, quiet } = options2;
+  const parseResult = profileNameSchema.safeParse(profileName);
+  if (!parseResult.success) {
+    throw new ValidationError(`Invalid profile name: "${profileName}". ` + `Profile names must start with a letter and contain only alphanumeric characters, dots, underscores, or hyphens.`);
+  }
+  const profileDir = getProfileDir(profileName);
+  const qualifiedName = `${namespace}/${component}`;
+  const profileExists = existsSync9(profileDir);
+  if (profileExists && !force) {
+    throw new ConflictError(`Profile "${profileName}" already exists.
+Use --force to overwrite.`);
+  }
+  const fetchSpin = quiet ? null : createSpinner({ text: `Fetching ${qualifiedName}...` });
+  fetchSpin?.start();
+  let manifest;
+  try {
+    manifest = await fetchComponent(registryUrl, component);
+  } catch (error) {
+    fetchSpin?.fail(`Failed to fetch ${qualifiedName}`);
+    if (error instanceof NotFoundError) {
+      throw new NotFoundError(`Profile component "${qualifiedName}" not found in registry.
+
+` + `Check the component name and ensure the registry is configured.`);
+    }
+    throw error;
+  }
+  if (manifest.type !== "ocx:profile") {
+    fetchSpin?.fail(`Invalid component type`);
+    throw new ValidationError(`Component "${qualifiedName}" is type "${manifest.type}", not "ocx:profile".
+
+` + `Only profile components can be installed with 'ocx profile add --from'.`);
+  }
+  const normalized = normalizeComponentManifest(manifest);
+  fetchSpin?.succeed(`Fetched ${qualifiedName}`);
+  const filesSpin = quiet ? null : createSpinner({ text: "Downloading profile files..." });
+  filesSpin?.start();
+  const profileFiles = [];
+  const dependencyFiles = [];
+  for (const file of normalized.files) {
+    const content2 = await fetchFileContent(registryUrl, component, file.path);
+    const fileEntry = {
+      path: file.path,
+      target: file.target,
+      content: Buffer.from(content2)
+    };
+    if (isProfileFile(file.target)) {
+      profileFiles.push(fileEntry);
+    } else {
+      dependencyFiles.push(fileEntry);
+    }
+  }
+  filesSpin?.succeed(`Downloaded ${normalized.files.length} files`);
+  let resolvedDeps = null;
+  const dependencyBundles = [];
+  if (manifest.dependencies.length > 0) {
+    const depsSpin = quiet ? null : createSpinner({ text: "Resolving dependencies..." });
+    depsSpin?.start();
+    try {
+      const depRefs = manifest.dependencies.map((dep) => dep.includes("/") ? dep : `${namespace}/${dep}`);
+      resolvedDeps = await resolveDependencies(registries, depRefs);
+      for (const depComponent of resolvedDeps.components) {
+        const files = [];
+        for (const file of depComponent.files) {
+          const content2 = await fetchFileContent(depComponent.baseUrl, depComponent.name, file.path);
+          const resolvedTarget = resolveTargetPath(file.target, true);
+          files.push({
+            path: file.path,
+            target: resolvedTarget,
+            content: Buffer.from(content2)
+          });
+        }
+        const registryIndex = await fetchRegistryIndex(depComponent.baseUrl);
+        dependencyBundles.push({
+          qualifiedName: depComponent.qualifiedName,
+          registryName: depComponent.registryName,
+          files,
+          hash: hashBundle2(files),
+          version: registryIndex.version
+        });
+      }
+      depsSpin?.succeed(`Resolved ${resolvedDeps.components.length} dependencies`);
+    } catch (error) {
+      depsSpin?.fail("Failed to resolve dependencies");
+      throw error;
+    }
+  }
+  const profilesDir = getProfilesDir();
+  await mkdir8(profilesDir, { recursive: true, mode: 448 });
+  const stagingDir = await mkdtemp(join8(profilesDir, ".staging-"));
+  const stagingOpencodeDir = join8(stagingDir, ".opencode");
+  try {
+    await mkdir8(stagingOpencodeDir, { recursive: true, mode: 448 });
+    const writeSpin = quiet ? null : createSpinner({ text: "Writing profile files..." });
+    writeSpin?.start();
+    for (const file of profileFiles) {
+      const targetPath = join8(stagingDir, file.target);
+      const targetDir = dirname4(targetPath);
+      if (!existsSync9(targetDir)) {
+        await mkdir8(targetDir, { recursive: true });
+      }
+      await writeFile3(targetPath, file.content);
+    }
+    for (const file of dependencyFiles) {
+      const target = file.target.startsWith(".opencode/") ? file.target.slice(".opencode/".length) : file.target;
+      const targetPath = join8(stagingOpencodeDir, target);
+      const targetDir = dirname4(targetPath);
+      if (!existsSync9(targetDir)) {
+        await mkdir8(targetDir, { recursive: true });
+      }
+      await writeFile3(targetPath, file.content);
+    }
+    writeSpin?.succeed(`Wrote ${profileFiles.length + dependencyFiles.length} profile files`);
+    if (dependencyBundles.length > 0) {
+      const depWriteSpin = quiet ? null : createSpinner({ text: "Writing dependency files..." });
+      depWriteSpin?.start();
+      let depFileCount = 0;
+      for (const bundle of dependencyBundles) {
+        for (const file of bundle.files) {
+          const targetPath = join8(stagingOpencodeDir, file.target);
+          const targetDir = dirname4(targetPath);
+          if (!existsSync9(targetDir)) {
+            await mkdir8(targetDir, { recursive: true });
+          }
+          await writeFile3(targetPath, file.content);
+          depFileCount++;
+        }
+      }
+      depWriteSpin?.succeed(`Wrote ${depFileCount} dependency files`);
+    }
+    const profileHash = hashBundle2(profileFiles.map((f) => ({ path: f.path, content: f.content })));
+    const registryIndex = await fetchRegistryIndex(registryUrl);
+    const lock = {
+      version: 1,
+      installedFrom: {
+        registry: namespace,
+        component,
+        version: registryIndex.version,
+        hash: profileHash,
+        installedAt: new Date().toISOString()
+      },
+      installed: {}
+    };
+    for (const bundle of dependencyBundles) {
+      lock.installed[bundle.qualifiedName] = {
+        registry: bundle.registryName,
+        version: bundle.version,
+        hash: bundle.hash,
+        files: bundle.files.map((f) => f.target),
+        installedAt: new Date().toISOString()
+      };
+    }
+    await writeFile3(join8(stagingDir, "ocx.lock"), JSON.stringify(lock, null, "\t"));
+    const moveSpin = quiet ? null : createSpinner({ text: "Finalizing installation..." });
+    moveSpin?.start();
+    const profilesDir2 = dirname4(profileDir);
+    if (!existsSync9(profilesDir2)) {
+      await mkdir8(profilesDir2, { recursive: true, mode: 448 });
+    }
+    if (profileExists && force) {
+      const backupDir = `${profileDir}.backup-${Date.now()}`;
+      await rename2(profileDir, backupDir);
+      try {
+        await rename2(stagingDir, profileDir);
+      } catch (err) {
+        await rename2(backupDir, profileDir);
+        throw err;
+      }
+      await rm3(backupDir, { recursive: true, force: true });
+    } else {
+      await rename2(stagingDir, profileDir);
+    }
+    moveSpin?.succeed("Installation complete");
+    if (!quiet) {
+      logger.info("");
+      logger.success(`Installed profile "${profileName}" from ${qualifiedName}`);
+      logger.info("");
+      logger.info("Profile contents:");
+      for (const file of profileFiles) {
+        logger.info(`  ${file.target}`);
+      }
+      if (dependencyBundles.length > 0) {
+        logger.info("");
+        logger.info("Dependencies:");
+        for (const bundle of dependencyBundles) {
+          logger.info(`  ${bundle.qualifiedName}`);
+        }
+      }
+    }
+  } catch (error) {
+    try {
+      if (existsSync9(stagingDir)) {
+        await rm3(stagingDir, { recursive: true });
+      }
+    } catch {}
+    throw error;
+  }
+}
+
 // src/commands/profile/add.ts
+function parseFromOption(from) {
+  if (!from?.trim()) {
+    throw new ValidationError("--from value cannot be empty");
+  }
+  const trimmed = from.trim();
+  if (trimmed.startsWith("./") || trimmed.startsWith("~/") || trimmed.startsWith("/")) {
+    return { type: "local-path", path: trimmed };
+  }
+  const slashCount = (trimmed.match(/\//g) || []).length;
+  if (slashCount === 1) {
+    const [namespace, component] = trimmed.split("/").map((s) => s.trim());
+    if (!namespace || !component) {
+      throw new ValidationError(`Invalid registry reference: "${from}". Expected format: namespace/component`);
+    }
+    return { type: "registry", namespace, component };
+  }
+  return { type: "local-profile", name: trimmed };
+}
+async function readGlobalOcxConfig() {
+  const configPath = getGlobalConfig();
+  const file = Bun.file(configPath);
+  if (!await file.exists()) {
+    return null;
+  }
+  try {
+    const content2 = await file.text();
+    const json = parse2(content2, [], { allowTrailingComma: true });
+    return profileOcxConfigSchema.parse(json);
+  } catch (error) {
+    if (error instanceof Error) {
+      throw new ConfigError(`Failed to parse global config at "${configPath}": ${error.message}
+
+` + `Check the file for syntax errors or run: ocx config edit --global`);
+    }
+    throw error;
+  }
+}
+async function requireGlobalRegistry(namespace) {
+  const globalConfig = await readGlobalOcxConfig();
+  if (!globalConfig) {
+    throw new ConfigError(`Registry "${namespace}" is not configured globally.
+
+` + `Profile installation requires global registry configuration.
+` + `Run: ocx registry add ${namespace} <url> --global`);
+  }
+  const registry = globalConfig.registries[namespace];
+  if (!registry) {
+    throw new ConfigError(`Registry "${namespace}" is not configured globally.
+
+` + `Profile installation requires global registry configuration.
+` + `Run: ocx registry add ${namespace} <url> --global`);
+  }
+  return { config: globalConfig, registryUrl: registry.url };
+}
 function registerProfileAddCommand(parent) {
-  parent.command("add <name>").description("Create a new global profile").option("--from <profile>", "Clone settings from existing profile").action(async (name, options2) => {
+  parent.command("add <name>").description("Create a new profile, clone from existing, or install from registry").option("--from <source>", "Clone from existing profile or install from registry (e.g., kdco/minimal)").option("-f, --force", "Overwrite existing profile").addHelpText("after", `
+Examples:
+  $ ocx profile add work                      # Create empty profile
+  $ ocx profile add work --from dev           # Clone from existing profile
+  $ ocx profile add work --from kdco/minimal  # Install from registry
+  $ ocx profile add work --from kdco/minimal --force  # Overwrite existing
+`).action(async (name, options2) => {
     try {
       await runProfileAdd(name, options2);
     } catch (error) {
@@ -15401,15 +15874,61 @@ function registerProfileAddCommand(parent) {
 }
 async function runProfileAdd(name, options2) {
   const manager = await ProfileManager.requireInitialized();
-  if (options2.from) {
-    const source = await manager.get(options2.from);
-    await manager.add(name);
-    await atomicWrite(getProfileOcxConfig(name), source.ocx);
-    logger.success(`Created profile "${name}" (cloned from "${options2.from}")`);
-  } else {
-    await manager.add(name);
-    logger.success(`Created profile "${name}"`);
+  const profileExists = await manager.exists(name);
+  if (profileExists && !options2.force) {
+    logger.error(`\u2717 Profile "${name}" already exists`);
+    logger.error("");
+    logger.error("Use --force to overwrite the existing profile.");
+    throw new ProfileExistsError(name);
+  }
+  if (!options2.from) {
+    await createEmptyProfile(manager, name, profileExists);
+    return;
   }
+  const fromInput = parseFromOption(options2.from);
+  switch (fromInput.type) {
+    case "local-profile":
+      await cloneFromLocalProfile(manager, name, fromInput.name, profileExists);
+      break;
+    case "local-path":
+      throw new ValidationError(`Local path installation is not yet implemented: "${fromInput.path}"
+
+` + `Currently supported sources:
+` + `  - Existing profile: --from <profile-name>
+` + `  - Registry: --from <namespace>/<component>`);
+    case "registry": {
+      const { config: globalConfig, registryUrl } = await requireGlobalRegistry(fromInput.namespace);
+      const registries = {};
+      for (const [ns, reg] of Object.entries(globalConfig.registries)) {
+        registries[ns] = { url: reg.url };
+      }
+      await installProfileFromRegistry({
+        namespace: fromInput.namespace,
+        component: fromInput.component,
+        profileName: name,
+        force: options2.force,
+        registryUrl,
+        registries
+      });
+      break;
+    }
+  }
+}
+async function createEmptyProfile(manager, name, exists) {
+  if (exists) {
+    await manager.remove(name);
+  }
+  await manager.add(name);
+  logger.success(`Created profile "${name}"`);
+}
+async function cloneFromLocalProfile(manager, name, sourceName, exists) {
+  const source = await manager.get(sourceName);
+  if (exists) {
+    await manager.remove(name);
+  }
+  await manager.add(name);
+  await atomicWrite(getProfileOcxConfig(name), source.ocx);
+  logger.success(`Created profile "${name}" (cloned from "${sourceName}")`);
 }
 
 // src/commands/profile/config.ts
@@ -15566,31 +16085,56 @@ function runRegistryListCore(callbacks) {
 function registerRegistryCommand(program2) {
   const registry = program2.command("registry").description("Manage registries");
   const addCmd = registry.command("add").description("Add a registry").argument("<url>", "Registry URL").option("--name <name>", "Registry alias (defaults to hostname)").option("--version <version>", "Pin to specific version");
+  addGlobalOption(addCmd);
   addCommonOptions(addCmd);
-  addCmd.action(async (url, options2) => {
+  addCmd.action(async (url, options2, command) => {
     try {
-      const cwd = options2.cwd ?? process.cwd();
-      const { path: configPath } = findOcxConfig(cwd);
-      const config = await readOcxConfig(cwd);
-      if (!config) {
-        logger.error("No ocx.jsonc found. Run 'ocx init' first.");
+      const cwdExplicitlyProvided = command.getOptionValueSource("cwd") === "cli";
+      if (options2.global && cwdExplicitlyProvided) {
+        logger.error("Cannot use --global with --cwd. They are mutually exclusive.");
         process.exit(1);
       }
+      let configDir;
+      let configPath;
+      const config = await (async () => {
+        if (options2.global) {
+          configDir = getGlobalConfigPath();
+          const found = findOcxConfig(configDir);
+          configPath = found.path;
+          const cfg = await readOcxConfig(configDir);
+          if (!cfg) {
+            logger.error("Global config not found. Run 'opencode' once to initialize.");
+            process.exit(1);
+          }
+          return cfg;
+        } else {
+          configDir = options2.cwd ?? process.cwd();
+          const found = findOcxConfig(configDir);
+          configPath = found.path;
+          const cfg = await readOcxConfig(configDir);
+          if (!cfg) {
+            logger.error("No ocx.jsonc found. Run 'ocx init' first.");
+            process.exit(1);
+          }
+          return cfg;
+        }
+      })();
       const result = await runRegistryAddCore2(url, options2, {
         getRegistries: () => config.registries,
         isLocked: () => config.lockRegistries ?? false,
         setRegistry: async (name, regConfig) => {
           config.registries[name] = regConfig;
-          await writeOcxConfig(cwd, config, configPath);
+          await writeOcxConfig(configDir, config, configPath);
         }
       });
       if (options2.json) {
         outputJson({ success: true, data: result });
       } else if (!options2.quiet) {
+        const location = options2.global ? "global config" : "local config";
         if (result.updated) {
-          logger.success(`Updated registry: ${result.name} -> ${result.url}`);
+          logger.success(`Updated registry in ${location}: ${result.name} -> ${result.url}`);
         } else {
-          logger.success(`Added registry: ${result.name} -> ${result.url}`);
+          logger.success(`Added registry to ${location}: ${result.name} -> ${result.url}`);
         }
       }
     } catch (error) {
@@ -15598,43 +16142,90 @@ function registerRegistryCommand(program2) {
     }
   });
   const removeCmd = registry.command("remove").description("Remove a registry").argument("<name>", "Registry name");
+  addGlobalOption(removeCmd);
   addCommonOptions(removeCmd);
-  removeCmd.action(async (name, options2) => {
+  removeCmd.action(async (name, options2, command) => {
     try {
-      const cwd = options2.cwd ?? process.cwd();
-      const { path: configPath } = findOcxConfig(cwd);
-      const config = await readOcxConfig(cwd);
-      if (!config) {
-        logger.error("No ocx.jsonc found. Run 'ocx init' first.");
+      const cwdExplicitlyProvided = command.getOptionValueSource("cwd") === "cli";
+      if (options2.global && cwdExplicitlyProvided) {
+        logger.error("Cannot use --global with --cwd. They are mutually exclusive.");
         process.exit(1);
       }
+      let configDir;
+      let configPath;
+      const config = await (async () => {
+        if (options2.global) {
+          configDir = getGlobalConfigPath();
+          const found = findOcxConfig(configDir);
+          configPath = found.path;
+          const cfg = await readOcxConfig(configDir);
+          if (!cfg) {
+            logger.error("Global config not found. Run 'opencode' once to initialize.");
+            process.exit(1);
+          }
+          return cfg;
+        } else {
+          configDir = options2.cwd ?? process.cwd();
+          const found = findOcxConfig(configDir);
+          configPath = found.path;
+          const cfg = await readOcxConfig(configDir);
+          if (!cfg) {
+            logger.error("No ocx.jsonc found. Run 'ocx init' first.");
+            process.exit(1);
+          }
+          return cfg;
+        }
+      })();
       const result = await runRegistryRemoveCore(name, {
         getRegistries: () => config.registries,
         isLocked: () => config.lockRegistries ?? false,
         removeRegistry: async (regName) => {
           delete config.registries[regName];
-          await writeOcxConfig(cwd, config, configPath);
+          await writeOcxConfig(configDir, config, configPath);
         }
       });
       if (options2.json) {
         outputJson({ success: true, data: result });
       } else if (!options2.quiet) {
-        logger.success(`Removed registry: ${result.removed}`);
+        const location = options2.global ? "global config" : "local config";
+        logger.success(`Removed registry from ${location}: ${result.removed}`);
       }
     } catch (error) {
       handleError(error, { json: options2.json });
     }
   });
   const listCmd = registry.command("list").description("List configured registries");
+  addGlobalOption(listCmd);
   addCommonOptions(listCmd);
-  listCmd.action(async (options2) => {
+  listCmd.action(async (options2, command) => {
     try {
-      const cwd = options2.cwd ?? process.cwd();
-      const config = await readOcxConfig(cwd);
-      if (!config) {
-        logger.warn("No ocx.jsonc found. Run 'ocx init' first.");
-        return;
+      const cwdExplicitlyProvided = command.getOptionValueSource("cwd") === "cli";
+      if (options2.global && cwdExplicitlyProvided) {
+        logger.error("Cannot use --global with --cwd. They are mutually exclusive.");
+        process.exit(1);
       }
+      let configDir;
+      const config = await (async () => {
+        if (options2.global) {
+          configDir = getGlobalConfigPath();
+          const cfg = await readOcxConfig(configDir);
+          if (!cfg) {
+            logger.warn("Global config not found. Run 'opencode' once to initialize.");
+            return null;
+          }
+          return cfg;
+        } else {
+          configDir = options2.cwd ?? process.cwd();
+          const cfg = await readOcxConfig(configDir);
+          if (!cfg) {
+            logger.warn("No ocx.jsonc found. Run 'ocx init' first.");
+            return null;
+          }
+          return cfg;
+        }
+      })();
+      if (!config)
+        return;
       const result = runRegistryListCore({
         getRegistries: () => config.registries,
         isLocked: () => config.lockRegistries ?? false
@@ -15645,7 +16236,7 @@ function registerRegistryCommand(program2) {
         if (result.registries.length === 0) {
           logger.info("No registries configured.");
         } else {
-          logger.info(`Configured registries${result.locked ? kleur_default.yellow(" (locked)") : ""}:`);
+          logger.info(`Configured registries${options2.global ? " (global)" : ""}${result.locked ? kleur_default.yellow(" (locked)") : ""}:`);
           for (const reg of result.registries) {
             console.log(`  ${kleur_default.cyan(reg.name)}: ${reg.url} ${kleur_default.dim(`(${reg.version})`)}`);
           }
@@ -15780,7 +16371,7 @@ async function runSearchCore(query, options2, provider) {
 
 // src/self-update/version-provider.ts
 class BuildTimeVersionProvider {
-  version = "1.4.0";
+  version = "1.4.1";
 }
 var defaultVersionProvider = new BuildTimeVersionProvider;
 
@@ -15893,7 +16484,7 @@ function getExecutablePath() {
 }
 
 // src/self-update/download.ts
-import { chmodSync, existsSync as existsSync9, renameSync as renameSync2, unlinkSync as unlinkSync2 } from "fs";
+import { chmodSync, existsSync as existsSync10, renameSync as renameSync2, unlinkSync as unlinkSync2 } from "fs";
 var GITHUB_REPO2 = "kdcokenny/ocx";
 var DEFAULT_DOWNLOAD_BASE_URL = `https://github.com/${GITHUB_REPO2}/releases/download`;
 var PLATFORM_MAP = {
@@ -15971,7 +16562,7 @@ async function downloadToTemp(version) {
   try {
     chmodSync(tempPath, 493);
   } catch (error) {
-    if (existsSync9(tempPath)) {
+    if (existsSync10(tempPath)) {
       unlinkSync2(tempPath);
     }
     throw new SelfUpdateError(`Failed to set permissions: ${error instanceof Error ? error.message : String(error)}`);
@@ -15981,20 +16572,20 @@ async function downloadToTemp(version) {
 function atomicReplace(tempPath, execPath) {
   const backupPath = `${execPath}.backup`;
   try {
-    if (existsSync9(execPath)) {
+    if (existsSync10(execPath)) {
       renameSync2(execPath, backupPath);
     }
     renameSync2(tempPath, execPath);
-    if (existsSync9(backupPath)) {
+    if (existsSync10(backupPath)) {
       unlinkSync2(backupPath);
     }
   } catch (error) {
-    if (existsSync9(backupPath) && !existsSync9(execPath)) {
+    if (existsSync10(backupPath) && !existsSync10(execPath)) {
       try {
         renameSync2(backupPath, execPath);
       } catch {}
     }
-    if (existsSync9(tempPath)) {
+    if (existsSync10(tempPath)) {
       try {
         unlinkSync2(tempPath);
       } catch {}
@@ -16003,7 +16594,7 @@ function atomicReplace(tempPath, execPath) {
   }
 }
 function cleanupTempFile(tempPath) {
-  if (existsSync9(tempPath)) {
+  if (existsSync10(tempPath)) {
     try {
       unlinkSync2(tempPath);
     } catch {}
@@ -16025,7 +16616,7 @@ function notifyUpdated(from, to) {
 }
 
 // src/self-update/verify.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var GITHUB_REPO3 = "kdcokenny/ocx";
 function parseSha256Sums(content2) {
   const checksums = new Map;
@@ -16038,8 +16629,8 @@ function parseSha256Sums(content2) {
   }
   return checksums;
 }
-function hashContent2(content2) {
-  return createHash2("sha256").update(content2).digest("hex");
+function hashContent3(content2) {
+  return createHash3("sha256").update(content2).digest("hex");
 }
 async function fetchChecksums(version) {
   const url = `https://github.com/${GITHUB_REPO3}/releases/download/v${version}/SHA256SUMS.txt`;
@@ -16053,7 +16644,7 @@ async function fetchChecksums(version) {
 async function verifyChecksum(filePath, expectedHash, filename) {
   const file = Bun.file(filePath);
   const content2 = await file.arrayBuffer();
-  const actualHash = hashContent2(Buffer.from(content2));
+  const actualHash = hashContent3(Buffer.from(content2));
   if (actualHash !== expectedHash) {
     throw new IntegrityError(filename, expectedHash, actualHash);
   }
@@ -16178,10 +16769,10 @@ function registerSelfCommand(program2) {
 }
 
 // src/commands/update.ts
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync10 } from "fs";
-import { mkdir as mkdir8, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname4, join as join8 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync11 } from "fs";
+import { mkdir as mkdir9, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname5, join as join9 } from "path";
 function registerUpdateCommand(program2) {
   program2.command("update [components...]").description("Update installed components (use @version suffix to pin, e.g., kdco/agents@1.2.0)").option("--all", "Update all installed components").option("--registry <name>", "Update all components from a specific registry").option("--dry-run", "Preview changes without applying").option("--cwd <path>", "Working directory", process.cwd()).option("-q, --quiet", "Suppress output").option("-v, --verbose", "Verbose output").option("--json", "Output as JSON").action(async (components, options2) => {
     try {
@@ -16265,7 +16856,7 @@ Version cannot be empty. Use 'kdco/agents@1.2.0' or omit the version for latest.
         const content2 = await fetchFileContent(regConfig.url, componentName, file.path);
         files.push({ path: file.path, content: Buffer.from(content2) });
       }
-      const newHash = await hashBundle2(files);
+      const newHash = await hashBundle3(files);
       if (newHash === lockEntry.hash) {
         results.push({
           qualifiedName,
@@ -16319,12 +16910,12 @@ Version cannot be empty. Use 'kdco/agents@1.2.0' or omit the version for latest.
         const fileObj = update.component.files.find((f) => f.path === file.path);
         if (!fileObj)
           continue;
-        const targetPath = join8(provider.cwd, fileObj.target);
-        const targetDir = dirname4(targetPath);
-        if (!existsSync10(targetDir)) {
-          await mkdir8(targetDir, { recursive: true });
+        const targetPath = join9(provider.cwd, fileObj.target);
+        const targetDir = dirname5(targetPath);
+        if (!existsSync11(targetDir)) {
+          await mkdir9(targetDir, { recursive: true });
         }
-        await writeFile3(targetPath, file.content);
+        await writeFile4(targetPath, file.content);
         if (options2.verbose) {
           logger.info(`  \u2713 Updated ${fileObj.target}`);
         }
@@ -16443,17 +17034,17 @@ function outputDryRun(results, options2) {
     }
   }
 }
-async function hashContent3(content2) {
-  return createHash3("sha256").update(content2).digest("hex");
+async function hashContent4(content2) {
+  return createHash4("sha256").update(content2).digest("hex");
 }
-async function hashBundle2(files) {
+async function hashBundle3(files) {
   const sorted = [...files].sort((a, b) => a.path.localeCompare(b.path));
   const manifestParts = [];
   for (const file of sorted) {
-    const hash = await hashContent3(file.content);
+    const hash = await hashContent4(file.content);
     manifestParts.push(`${file.path}:${hash}`);
   }
-  return hashContent3(manifestParts.join(`
+  return hashContent4(manifestParts.join(`
 `));
 }
 
@@ -16485,7 +17076,7 @@ function registerUpdateCheckHook(program2) {
   });
 }
 // src/index.ts
-var version = "1.4.0";
+var version = "1.4.1";
 async function main2() {
   const program2 = new Command().name("ocx").description("OpenCode Extensions - Install agents, skills, plugins, and commands").version(version);
   registerInitCommand(program2);
@@ -16517,4 +17108,4 @@ export {
   buildRegistry
 };
 
-//# debugId=5FADDAC480C59C7864756E2164756E21
+//# debugId=4E10E39074E11B3A64756E2164756E21