ocx 1.4.0 → 1.4.2

package/dist/index.js

@@ -9814,6 +9814,142 @@ var coerce = {
   date: (arg) => ZodDate.create({ ...arg, coerce: true })
 };
 var NEVER = INVALID;
+// src/schemas/registry.ts
+import { isAbsolute, normalize } from "path";
+
+// src/utils/errors.ts
+var EXIT_CODES = {
+  SUCCESS: 0,
+  GENERAL: 1,
+  NOT_FOUND: 66,
+  NETWORK: 69,
+  CONFIG: 78,
+  INTEGRITY: 1,
+  CONFLICT: 6
+};
+
+class OCXError extends Error {
+  code;
+  exitCode;
+  constructor(message, code, exitCode = EXIT_CODES.GENERAL) {
+    super(message);
+    this.code = code;
+    this.exitCode = exitCode;
+    this.name = "OCXError";
+  }
+}
+
+class NotFoundError extends OCXError {
+  constructor(message) {
+    super(message, "NOT_FOUND", EXIT_CODES.NOT_FOUND);
+    this.name = "NotFoundError";
+  }
+}
+
+class NetworkError extends OCXError {
+  constructor(message) {
+    super(message, "NETWORK_ERROR", EXIT_CODES.NETWORK);
+    this.name = "NetworkError";
+  }
+}
+
+class ConfigError extends OCXError {
+  constructor(message) {
+    super(message, "CONFIG_ERROR", EXIT_CODES.CONFIG);
+    this.name = "ConfigError";
+  }
+}
+
+class ValidationError extends OCXError {
+  constructor(message) {
+    super(message, "VALIDATION_ERROR", EXIT_CODES.GENERAL);
+    this.name = "ValidationError";
+  }
+}
+
+class ConflictError extends OCXError {
+  constructor(message) {
+    super(message, "CONFLICT", EXIT_CODES.CONFLICT);
+    this.name = "ConflictError";
+  }
+}
+
+class IntegrityError extends OCXError {
+  constructor(component, expected, found) {
+    const message = `Integrity verification failed for "${component}"
+` + `  Expected: ${expected}
+` + `  Found:    ${found}
+
+` + `The registry content has changed since this component was locked.
+` + `Use 'ocx update ${component}' to intentionally update this component.`;
+    super(message, "INTEGRITY_ERROR", EXIT_CODES.INTEGRITY);
+    this.name = "IntegrityError";
+  }
+}
+
+class SelfUpdateError extends OCXError {
+  constructor(message) {
+    super(message, "UPDATE_ERROR", EXIT_CODES.GENERAL);
+    this.name = "SelfUpdateError";
+  }
+}
+
+class OcxConfigError extends OCXError {
+  constructor(message) {
+    super(message, "CONFIG_ERROR", EXIT_CODES.CONFIG);
+    this.name = "OcxConfigError";
+  }
+}
+
+class ProfileNotFoundError extends OCXError {
+  constructor(name) {
+    super(`Profile "${name}" not found`, "NOT_FOUND", EXIT_CODES.NOT_FOUND);
+    this.name = "ProfileNotFoundError";
+  }
+}
+
+class ProfileExistsError extends OCXError {
+  constructor(name) {
+    super(`Profile "${name}" already exists. Use --force to overwrite.`, "CONFLICT", EXIT_CODES.CONFLICT);
+    this.name = "ProfileExistsError";
+  }
+}
+
+class RegistryExistsError extends OCXError {
+  registryName;
+  existingUrl;
+  newUrl;
+  targetLabel;
+  constructor(registryName, existingUrl, newUrl, targetLabel) {
+    const target = targetLabel ? ` in ${targetLabel}` : "";
+    const message = `Registry "${registryName}" already exists${target}.
+` + `  Current: ${existingUrl}
+` + `  New:     ${newUrl}
+
+` + `Use --force to overwrite.`;
+    super(message, "CONFLICT", EXIT_CODES.CONFLICT);
+    this.registryName = registryName;
+    this.existingUrl = existingUrl;
+    this.newUrl = newUrl;
+    this.targetLabel = targetLabel;
+    this.name = "RegistryExistsError";
+  }
+}
+
+class InvalidProfileNameError extends OCXError {
+  constructor(name, reason) {
+    super(`Invalid profile name "${name}": ${reason}`, "VALIDATION_ERROR", EXIT_CODES.GENERAL);
+    this.name = "InvalidProfileNameError";
+  }
+}
+
+class ProfilesNotInitializedError extends OCXError {
+  constructor() {
+    super("Profiles not initialized. Run 'ocx init --global' first.", "NOT_FOUND", EXIT_CODES.NOT_FOUND);
+    this.name = "ProfilesNotInitializedError";
+  }
+}
+
 // src/schemas/registry.ts
 var npmSpecifierSchema = exports_external.string().refine((val) => val.startsWith("npm:"), {
   message: 'npm specifier must start with "npm:" prefix'
@@ -9860,8 +9996,10 @@ var componentTypeSchema = exports_external.enum([
   "ocx:plugin",
   "ocx:command",
   "ocx:tool",
-  "ocx:bundle"
+  "ocx:bundle",
+  "ocx:profile"
 ]);
+var profileTargetPathSchema = exports_external.enum(["ocx.jsonc", "opencode.jsonc", "AGENTS.md"]);
 var targetPathSchema = exports_external.string().refine((path) => path.startsWith(".opencode/"), {
   message: 'Target path must start with ".opencode/"'
 }).refine((path) => {
@@ -9901,7 +10039,7 @@ var mcpServerObjectSchema = exports_external.object({
 var mcpServerRefSchema = exports_external.union([exports_external.string(), mcpServerObjectSchema]);
 var componentFileObjectSchema = exports_external.object({
   path: exports_external.string().min(1, "File path cannot be empty"),
-  target: targetPathSchema
+  target: exports_external.string().min(1, "Target path cannot be empty")
 });
 var componentFileSchema = exports_external.union([
   exports_external.string().min(1, "File path cannot be empty"),
@@ -9993,16 +10131,56 @@ var componentManifestSchema = exports_external.object({
   npmDevDependencies: exports_external.array(exports_external.string()).optional(),
   opencode: opencodeConfigSchema.optional()
 });
+function validateSafePath(filePath) {
+  if (isAbsolute(filePath)) {
+    throw new ValidationError(`Invalid path: "${filePath}" - absolute paths not allowed`);
+  }
+  if (filePath.startsWith("~")) {
+    throw new ValidationError(`Invalid path: "${filePath}" - home directory paths not allowed`);
+  }
+  const normalized = normalize(filePath);
+  if (normalized.startsWith("..")) {
+    throw new ValidationError(`Invalid path: "${filePath}" - path traversal not allowed`);
+  }
+}
 function inferTargetPath(sourcePath) {
   return `.opencode/${sourcePath}`;
 }
-function normalizeFile(file) {
+function validateFileTarget(target, componentType) {
+  const isProfile = componentType === "ocx:profile";
+  if (isProfile) {
+    const isProfileFile = profileTargetPathSchema.safeParse(target).success;
+    const isOpencodeTarget = target.startsWith(".opencode/");
+    if (!isProfileFile && !isOpencodeTarget) {
+      throw new ValidationError(`Invalid profile target: "${target}". ` + `Must be a profile file (ocx.jsonc, opencode.jsonc, AGENTS.md) or start with ".opencode/"`);
+    }
+    if (isOpencodeTarget) {
+      const parseResult = targetPathSchema.safeParse(target);
+      if (!parseResult.success) {
+        throw new ValidationError(`Invalid embedded target: "${target}". ${parseResult.error.errors[0]?.message}`);
+      }
+    }
+  } else {
+    const parseResult = targetPathSchema.safeParse(target);
+    if (!parseResult.success) {
+      throw new ValidationError(`Invalid target: "${target}". ${parseResult.error.errors[0]?.message}`);
+    }
+  }
+}
+function normalizeFile(file, componentType) {
+  const isProfile = componentType === "ocx:profile";
   if (typeof file === "string") {
+    validateSafePath(file);
+    const target = isProfile ? file : inferTargetPath(file);
+    validateFileTarget(target, componentType);
     return {
       path: file,
-      target: inferTargetPath(file)
+      target
     };
   }
+  validateSafePath(file.path);
+  validateSafePath(file.target);
+  validateFileTarget(file.target, componentType);
   return file;
 }
 function normalizeMcpServer(server) {
@@ -10028,7 +10206,7 @@ function normalizeComponentManifest(manifest) {
   }
   return {
     ...manifest,
-    files: manifest.files.map(normalizeFile),
+    files: manifest.files.map((file) => normalizeFile(file, manifest.type)),
     opencode: normalizedOpencode
   };
 }
@@ -10128,9 +10306,15 @@ function findOcxConfig(cwd) {
   }
   return { path: dotOpencodePath, exists: false };
 }
-function findOcxLock(cwd) {
+function findOcxLock(cwd, options) {
   const dotOpencodePath = path.join(cwd, LOCAL_CONFIG_DIR, LOCK_FILE);
   const rootPath = path.join(cwd, LOCK_FILE);
+  if (options?.isFlattened) {
+    if (existsSync(rootPath)) {
+      return { path: rootPath, exists: true };
+    }
+    return { path: rootPath, exists: false };
+  }
   if (existsSync(dotOpencodePath)) {
     return { path: dotOpencodePath, exists: true };
   }
@@ -10160,8 +10344,8 @@ async function writeOcxConfig(cwd, config, existingPath) {
   const content = JSON.stringify(config, null, 2);
   await Bun.write(configPath, content);
 }
-async function readOcxLock(cwd) {
-  const { path: lockPath, exists } = findOcxLock(cwd);
+async function readOcxLock(cwd, options) {
+  const { path: lockPath, exists } = findOcxLock(cwd, options);
   if (!exists) {
     return null;
   }
@@ -10177,124 +10361,13 @@ async function writeOcxLock(cwd, lock, existingPath) {
   await Bun.write(lockPath, content);
 }
 
-// src/utils/errors.ts
-var EXIT_CODES = {
-  SUCCESS: 0,
-  GENERAL: 1,
-  NOT_FOUND: 66,
-  NETWORK: 69,
-  CONFIG: 78,
-  INTEGRITY: 1
-};
-
-class OCXError extends Error {
-  code;
-  exitCode;
-  constructor(message, code, exitCode = EXIT_CODES.GENERAL) {
-    super(message);
-    this.code = code;
-    this.exitCode = exitCode;
-    this.name = "OCXError";
-  }
-}
-
-class NotFoundError extends OCXError {
-  constructor(message) {
-    super(message, "NOT_FOUND", EXIT_CODES.NOT_FOUND);
-    this.name = "NotFoundError";
-  }
-}
-
-class NetworkError extends OCXError {
-  constructor(message) {
-    super(message, "NETWORK_ERROR", EXIT_CODES.NETWORK);
-    this.name = "NetworkError";
-  }
-}
-
-class ConfigError extends OCXError {
-  constructor(message) {
-    super(message, "CONFIG_ERROR", EXIT_CODES.CONFIG);
-    this.name = "ConfigError";
-  }
-}
-
-class ValidationError extends OCXError {
-  constructor(message) {
-    super(message, "VALIDATION_ERROR", EXIT_CODES.GENERAL);
-    this.name = "ValidationError";
-  }
-}
-
-class ConflictError extends OCXError {
-  constructor(message) {
-    super(message, "CONFLICT", EXIT_CODES.GENERAL);
-    this.name = "ConflictError";
-  }
-}
-
-class IntegrityError extends OCXError {
-  constructor(component, expected, found) {
-    const message = `Integrity verification failed for "${component}"
-` + `  Expected: ${expected}
-` + `  Found:    ${found}
-
-` + `The registry content has changed since this component was locked.
-` + `Use 'ocx update ${component}' to intentionally update this component.`;
-    super(message, "INTEGRITY_ERROR", EXIT_CODES.INTEGRITY);
-    this.name = "IntegrityError";
-  }
-}
-
-class SelfUpdateError extends OCXError {
-  constructor(message) {
-    super(message, "UPDATE_ERROR", EXIT_CODES.GENERAL);
-    this.name = "SelfUpdateError";
-  }
-}
-
-class OcxConfigError extends OCXError {
-  constructor(message) {
-    super(message, "CONFIG_ERROR", EXIT_CODES.CONFIG);
-    this.name = "OcxConfigError";
-  }
-}
-
-class ProfileNotFoundError extends OCXError {
-  constructor(name) {
-    super(`Profile "${name}" not found`, "NOT_FOUND", EXIT_CODES.NOT_FOUND);
-    this.name = "ProfileNotFoundError";
-  }
-}
-
-class ProfileExistsError extends OCXError {
-  constructor(name) {
-    super(`Profile "${name}" already exists`, "CONFLICT", EXIT_CODES.GENERAL);
-    this.name = "ProfileExistsError";
-  }
-}
-
-class InvalidProfileNameError extends OCXError {
-  constructor(name, reason) {
-    super(`Invalid profile name "${name}": ${reason}`, "VALIDATION_ERROR", EXIT_CODES.GENERAL);
-    this.name = "InvalidProfileNameError";
-  }
-}
-
-class ProfilesNotInitializedError extends OCXError {
-  constructor() {
-    super("Profiles not initialized. Run 'ocx profile add default' first.", "NOT_FOUND", EXIT_CODES.NOT_FOUND);
-    this.name = "ProfilesNotInitializedError";
-  }
-}
-
 // src/utils/paths.ts
 import { stat } from "fs/promises";
 import { homedir } from "os";
-import { isAbsolute, join } from "path";
+import { isAbsolute as isAbsolute2, join } from "path";
 function getGlobalConfigPath() {
   const xdg = process.env.XDG_CONFIG_HOME;
-  const base = xdg && isAbsolute(xdg) ? xdg : join(homedir(), ".config");
+  const base = xdg && isAbsolute2(xdg) ? xdg : join(homedir(), ".config");
   return join(base, "opencode");
 }
 async function globalDirectoryExists() {
@@ -10305,8 +10378,8 @@ async function globalDirectoryExists() {
     return false;
   }
 }
-function resolveTargetPath(target, isGlobal) {
-  if (isGlobal && target.startsWith(".opencode/")) {
+function resolveTargetPath(target, isFlattened) {
+  if (isFlattened && target.startsWith(".opencode/")) {
     return target.slice(".opencode/".length);
   }
   return target;
@@ -10348,7 +10421,7 @@ class GlobalConfigProvider {
   static async requireInitialized() {
     const basePath = getGlobalConfigPath();
     if (!await globalDirectoryExists()) {
-      throw new ConfigError("Global config not found. Run 'opencode' once to initialize, then retry.");
+      throw new ConfigError("Global config not found. Run 'ocx init --global' first.");
     }
     const config = await readOcxConfig(basePath);
     return new GlobalConfigProvider(basePath, config);
@@ -10575,7 +10648,25 @@ class ProfileManager {
     const dir = getProfileDir(name);
     await mkdir2(dir, { recursive: true, mode: 448 });
     const ocxPath = getProfileOcxConfig(name);
-    await atomicWrite(ocxPath, DEFAULT_OCX_CONFIG);
+    const ocxFile = Bun.file(ocxPath);
+    if (!await ocxFile.exists()) {
+      await atomicWrite(ocxPath, DEFAULT_OCX_CONFIG);
+    }
+    const opencodePath = getProfileOpencodeConfig(name);
+    const opencodeFile = Bun.file(opencodePath);
+    if (!await opencodeFile.exists()) {
+      await atomicWrite(opencodePath, {});
+    }
+    const agentsPath = getProfileAgents(name);
+    const agentsFile = Bun.file(agentsPath);
+    if (!await agentsFile.exists()) {
+      const agentsContent = `# Profile Instructions
+
+<!-- Add your custom instructions for this profile here -->
+<!-- These will be included when running \`ocx opencode -p ${name}\` -->
+`;
+      await Bun.write(agentsPath, agentsContent, { mode: 384 });
+    }
   }
   async remove(name) {
     if (!await this.exists(name)) {
@@ -10714,11 +10805,13 @@ class ConfigResolver {
       }
     }
     const shouldLoadLocal = this.shouldLoadLocalConfig();
-    if (shouldLoadLocal && this.localConfigDir) {
+    if (!this.profile && shouldLoadLocal && this.localConfigDir) {
       const localOcxConfig = this.loadLocalOcxConfig();
       if (localOcxConfig) {
-        registries = { ...registries, ...localOcxConfig.registries };
+        registries = localOcxConfig.registries;
       }
+    }
+    if (shouldLoadLocal && this.localConfigDir) {
       const localOpencodeConfig = this.loadLocalOpencodeConfig();
       if (localOpencodeConfig) {
         opencode = this.deepMerge(opencode, localOpencodeConfig);
@@ -10759,7 +10852,7 @@ class ConfigResolver {
       }
     }
     const shouldLoadLocal = this.shouldLoadLocalConfig();
-    if (shouldLoadLocal && this.localConfigDir) {
+    if (!this.profile && shouldLoadLocal && this.localConfigDir) {
       const localOcxConfig = this.loadLocalOcxConfig();
       if (localOcxConfig) {
         const localOcxPath = join2(this.localConfigDir, OCX_CONFIG_FILE);
@@ -10768,6 +10861,8 @@ class ConfigResolver {
           origins.set(`registries.${key}`, { path: localOcxPath, source: "local-config" });
         }
       }
+    }
+    if (shouldLoadLocal && this.localConfigDir) {
       const localOpencodeConfig = this.loadLocalOpencodeConfig();
       if (localOpencodeConfig) {
         opencode = this.deepMerge(opencode, localOpencodeConfig);
@@ -10887,7 +10982,7 @@ class ConfigResolver {
 // package.json
 var package_default = {
   name: "ocx",
-  version: "1.4.0",
+  version: "1.4.2",
   description: "OCX CLI - ShadCN-style registry for OpenCode extensions. Install agents, plugins, skills, and MCP servers.",
   author: "kdcokenny",
   license: "MIT",
@@ -11162,8 +11257,19 @@ async function resolveDependencies(registries, componentNames) {
 // src/updaters/update-opencode-config.ts
 import { existsSync as existsSync4 } from "fs";
 import { mkdir as mkdir3 } from "fs/promises";
+import { homedir as homedir3 } from "os";
 import path4 from "path";
 var LOCAL_CONFIG_DIR3 = ".opencode";
+function isGlobalConfigPath(cwd) {
+  const base = process.env.XDG_CONFIG_HOME || path4.join(homedir3(), ".config");
+  const globalConfigDir = path4.resolve(base, "opencode");
+  const resolvedCwd = path4.resolve(cwd);
+  if (resolvedCwd === globalConfigDir) {
+    return true;
+  }
+  const relative2 = path4.relative(globalConfigDir, resolvedCwd);
+  return relative2 !== "" && !relative2.startsWith("..") && !path4.isAbsolute(relative2);
+}
 var JSONC_OPTIONS = {
   formattingOptions: {
     tabSize: 2,
@@ -11178,6 +11284,17 @@ var OPENCODE_CONFIG_TEMPLATE = `{
 }
 `;
 function findOpencodeConfig(cwd) {
+  if (isGlobalConfigPath(cwd)) {
+    const rootJsonc2 = path4.join(cwd, "opencode.jsonc");
+    const rootJson2 = path4.join(cwd, "opencode.json");
+    if (existsSync4(rootJsonc2)) {
+      return { path: rootJsonc2, exists: true };
+    }
+    if (existsSync4(rootJson2)) {
+      return { path: rootJson2, exists: true };
+    }
+    return { path: rootJsonc2, exists: false };
+  }
   const dotOpencodeJsonc = path4.join(cwd, LOCAL_CONFIG_DIR3, "opencode.jsonc");
   const dotOpencodeJson = path4.join(cwd, LOCAL_CONFIG_DIR3, "opencode.json");
   if (existsSync4(dotOpencodeJsonc)) {
@@ -11267,7 +11384,7 @@ async function updateOpencodeJsonConfig(cwd, opencode) {
   } else {
     const config = { $schema: "https://opencode.ai/config.json" };
     content = JSON.stringify(config, null, "\t");
-    configPath = path4.join(cwd, LOCAL_CONFIG_DIR3, "opencode.jsonc");
+    configPath = isGlobalConfigPath(cwd) ? path4.join(cwd, "opencode.jsonc") : path4.join(cwd, LOCAL_CONFIG_DIR3, "opencode.jsonc");
     await mkdir3(path4.dirname(configPath), { recursive: true });
     created = true;
   }
@@ -11559,6 +11676,25 @@ function wrapAction(action) {
   };
 }
 function formatErrorAsJson(error) {
+  if (error instanceof RegistryExistsError) {
+    return {
+      success: false,
+      error: {
+        code: error.code,
+        message: error.message,
+        details: {
+          registryName: error.registryName,
+          existingUrl: error.existingUrl,
+          newUrl: error.newUrl,
+          ...error.targetLabel && { targetLabel: error.targetLabel }
+        }
+      },
+      exitCode: error.exitCode,
+      meta: {
+        timestamp: new Date().toISOString()
+      }
+    };
+  }
   if (error instanceof OCXError) {
     return {
       success: false,
@@ -11622,6 +11758,7 @@ var sharedOptions = {
   cwd: () => new Option("--cwd <path>", "Working directory").default(process.cwd()),
   quiet: () => new Option("-q, --quiet", "Suppress output"),
   json: () => new Option("--json", "Output as JSON"),
+  profile: () => new Option("-p, --profile <name>", "Target a specific profile's config"),
   force: () => new Option("-f, --force", "Skip confirmation prompts"),
   verbose: () => new Option("-v, --verbose", "Verbose output"),
   global: new Option("-g, --global", "Install to global OpenCode config (~/.config/opencode)")
@@ -11638,6 +11775,20 @@ function addVerboseOption(cmd) {
 function addGlobalOption(cmd) {
   return cmd.addOption(sharedOptions.global);
 }
+function addProfileOption(cmd) {
+  return cmd.addOption(sharedOptions.profile());
+}
+function validateProfileName(name) {
+  if (!name || name.length === 0) {
+    throw new InvalidProfileNameError(name, "cannot be empty");
+  }
+  if (name.length > 32) {
+    throw new InvalidProfileNameError(name, "must be 32 characters or less");
+  }
+  if (!/^[a-zA-Z][a-zA-Z0-9._-]*$/.test(name)) {
+    throw new InvalidProfileNameError(name, "must start with a letter and contain only alphanumeric characters, dots, underscores, or hyphens");
+  }
+}
 // ../../node_modules/.bun/ora@8.2.0/node_modules/ora/index.js
 import process9 from "process";
 
@@ -13182,8 +13333,9 @@ function registerAddCommand(program2) {
         const resolver = await ConfigResolver.create(options2.cwd ?? process.cwd(), {
           profile: options2.profile
         });
+        const profileDir = getProfileDir(options2.profile);
         provider = {
-          cwd: resolver.getCwd(),
+          cwd: profileDir,
           getRegistries: () => resolver.getRegistries(),
           getComponentPath: () => resolver.getComponentPath()
         };
@@ -13298,10 +13450,11 @@ async function handleNpmPlugins(inputs, options2, cwd) {
 }
 async function runRegistryAddCore(componentNames, options2, provider) {
   const cwd = provider.cwd;
-  const { path: lockPath } = findOcxLock(cwd);
+  const isFlattened = !!options2.global || !!options2.profile;
+  const { path: lockPath } = findOcxLock(cwd, { isFlattened });
   const registries = provider.getRegistries();
   let lock = { lockVersion: 1, installed: {} };
-  const existingLock = await readOcxLock(cwd);
+  const existingLock = await readOcxLock(cwd, { isFlattened });
   if (existingLock) {
     lock = existingLock;
   }
@@ -13354,7 +13507,7 @@ async function runRegistryAddCore(componentNames, options2, provider) {
       }
       const computedHash = await hashBundle(files);
       for (const file of component.files) {
-        const targetPath = join3(cwd, resolveTargetPath(file.target, !!options2.global));
+        const targetPath = join3(cwd, resolveTargetPath(file.target, isFlattened));
         assertPathInside(targetPath, cwd);
       }
       const existingEntry = lock.installed[component.qualifiedName];
@@ -13363,7 +13516,7 @@ async function runRegistryAddCore(componentNames, options2, provider) {
         throw new IntegrityError(component.qualifiedName, existingEntry.hash, computedHash);
       }
       for (const file of component.files) {
-        const resolvedTarget = resolveTargetPath(file.target, !!options2.global);
+        const resolvedTarget = resolveTargetPath(file.target, isFlattened);
         const targetPath = join3(cwd, resolvedTarget);
         if (existsSync5(targetPath)) {
           const conflictingComponent = findComponentByFile(lock, resolvedTarget);
@@ -13387,7 +13540,7 @@ async function runRegistryAddCore(componentNames, options2, provider) {
         const componentFile = component.files.find((f) => f.path === file.path);
         if (!componentFile)
           continue;
-        const resolvedTarget = resolveTargetPath(componentFile.target, !!options2.global);
+        const resolvedTarget = resolveTargetPath(componentFile.target, isFlattened);
         const targetPath = join3(cwd, resolvedTarget);
         if (existsSync5(targetPath)) {
           const existingContent = await Bun.file(targetPath).text();
@@ -13415,7 +13568,7 @@ async function runRegistryAddCore(componentNames, options2, provider) {
       const installResult = await installComponent(component, files, cwd, {
         force: options2.force,
         verbose: options2.verbose,
-        isGlobal: options2.global
+        isFlattened
       });
       if (options2.verbose) {
         for (const f of installResult.skipped) {
@@ -13436,7 +13589,7 @@ async function runRegistryAddCore(componentNames, options2, provider) {
         registry: component.registryName,
         version: index.version,
         hash: computedHash,
-        files: component.files.map((f) => resolveTargetPath(f.target, !!options2.global)),
+        files: component.files.map((f) => resolveTargetPath(f.target, isFlattened)),
         installedAt: new Date().toISOString()
       };
     }
@@ -13453,12 +13606,12 @@ async function runRegistryAddCore(componentNames, options2, provider) {
     }
     const hasNpmDeps = resolved.npmDependencies.length > 0;
     const hasNpmDevDeps = resolved.npmDevDependencies.length > 0;
-    const packageJsonPath = options2.global ? join3(cwd, "package.json") : join3(cwd, ".opencode/package.json");
+    const packageJsonPath = options2.global || options2.profile ? join3(cwd, "package.json") : join3(cwd, ".opencode/package.json");
     if (hasNpmDeps || hasNpmDevDeps) {
       const npmSpin = options2.quiet ? null : createSpinner({ text: `Updating ${packageJsonPath}...` });
       npmSpin?.start();
       try {
-        await updateOpencodeDevDependencies(cwd, resolved.npmDependencies, resolved.npmDevDependencies, { isGlobal: options2.global });
+        await updateOpencodeDevDependencies(cwd, resolved.npmDependencies, resolved.npmDevDependencies, { isFlattened });
         const totalDeps = resolved.npmDependencies.length + resolved.npmDevDependencies.length;
         npmSpin?.succeed(`Added ${totalDeps} dependencies to ${packageJsonPath}`);
       } catch (error) {
@@ -13494,7 +13647,7 @@ async function installComponent(component, files, cwd, options2) {
     const componentFile = component.files.find((f) => f.path === file.path);
     if (!componentFile)
       continue;
-    const resolvedTarget = resolveTargetPath(componentFile.target, !!options2.isGlobal);
+    const resolvedTarget = resolveTargetPath(componentFile.target, !!options2.isFlattened);
     const targetPath = join3(cwd, resolvedTarget);
     const targetDir = dirname(targetPath);
     if (existsSync5(targetPath)) {
@@ -13594,7 +13747,7 @@ async function readOpencodePackageJson(opencodeDir) {
     return JSON.parse(content2);
   } catch (e3) {
     const message = e3 instanceof Error ? e3.message : String(e3);
-    throw new ConfigError(`Invalid .opencode/package.json: ${message}`);
+    throw new ConfigError(`Invalid ${pkgPath}: ${message}`);
   }
 }
 async function ensureManifestFilesAreTracked(opencodeDir) {
@@ -13621,14 +13774,14 @@ async function updateOpencodeDevDependencies(cwd, npmDeps, npmDevDeps, options2
   const allDepSpecs = [...npmDeps, ...npmDevDeps];
   if (allDepSpecs.length === 0)
     return;
-  const packageDir = options2.isGlobal ? cwd : join3(cwd, ".opencode");
+  const packageDir = options2.isFlattened ? cwd : join3(cwd, ".opencode");
   await mkdir4(packageDir, { recursive: true });
   const parsedDeps = allDepSpecs.map(parseNpmDependency);
   const existing = await readOpencodePackageJson(packageDir);
   const updated = mergeDevDependencies(existing, parsedDeps);
   await Bun.write(join3(packageDir, "package.json"), `${JSON.stringify(updated, null, 2)}
 `);
-  if (!options2.isGlobal) {
+  if (!options2.isFlattened) {
     await ensureManifestFilesAreTracked(packageDir);
   }
 }
@@ -13689,7 +13842,7 @@ async function buildRegistry(options2) {
     const packumentPath = join4(componentsDir, `${component.name}.json`);
     await Bun.write(packumentPath, JSON.stringify(packument, null, 2));
     for (const rawFile of component.files) {
-      const file = normalizeFile(rawFile);
+      const file = normalizeFile(rawFile, component.type);
       const sourceFilePath = join4(sourcePath, "files", file.path);
       const destFilePath = join4(componentsDir, component.name, file.path);
       const destFileDir = dirname2(destFilePath);
@@ -13786,7 +13939,7 @@ import { existsSync as existsSync6 } from "fs";
 import { mkdir as mkdir6 } from "fs/promises";
 import { join as join6 } from "path";
 function registerConfigEditCommand(parent) {
-  parent.command("edit").description("Open configuration file in editor").option("-g, --global", "Edit global ocx.jsonc").action(async (options2) => {
+  parent.command("edit").description("Open configuration file in editor").option("-g, --global", "Edit global ocx.jsonc").option("-p, --profile <name>", "Edit specific profile's config").action(async (options2) => {
     try {
       await runConfigEdit(options2);
     } catch (error) {
@@ -13795,12 +13948,26 @@ function registerConfigEditCommand(parent) {
   });
 }
 async function runConfigEdit(options2) {
+  if (options2.global && options2.profile) {
+    throw new ValidationError("Cannot use both --global and --profile flags");
+  }
   let configPath;
-  if (options2.global) {
+  if (options2.profile) {
+    const parseResult = profileNameSchema.safeParse(options2.profile);
+    if (!parseResult.success) {
+      throw new ValidationError(`Invalid profile name "${options2.profile}": ${parseResult.error.errors[0]?.message ?? "Invalid name"}`);
+    }
+    await ProfileManager.requireInitialized();
+    const manager = ProfileManager.create();
+    if (!await manager.exists(options2.profile)) {
+      throw new ProfileNotFoundError(options2.profile);
+    }
+    configPath = getProfileOcxConfig(options2.profile);
+  } else if (options2.global) {
     configPath = getGlobalConfig();
     if (!existsSync6(configPath)) {
       throw new ConfigError(`Global config not found at ${configPath}.
-` + "Run 'opencode' once to initialize, then retry.");
+Run 'ocx init --global' first.`);
     }
   } else {
     const localConfigDir = findLocalConfigDir(process.cwd());
@@ -14851,11 +15018,40 @@ Diff for ${res.name}:`));
 }
 
 // src/commands/ghost/migrate.ts
-import { copyFileSync, existsSync as existsSync7, lstatSync, readdirSync, renameSync, unlinkSync } from "fs";
+import {
+  copyFileSync,
+  cpSync,
+  existsSync as existsSync7,
+  lstatSync,
+  mkdirSync,
+  readdirSync,
+  renameSync,
+  rmdirSync,
+  rmSync,
+  unlinkSync
+} from "fs";
 import path6 from "path";
 var GHOST_CONFIG_FILE = "ghost.jsonc";
 var BACKUP_EXT = ".bak";
 var CURRENT_SYMLINK = "current";
+var FLATTEN_DIRS = ["plugin", "agent", "skill", "command"];
+function moveAtomically(source, destination, isDir) {
+  try {
+    renameSync(source, destination);
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "EXDEV") {
+      if (isDir) {
+        cpSync(source, destination, { recursive: true });
+        rmSync(source, { recursive: true, force: true });
+      } else {
+        copyFileSync(source, destination);
+        unlinkSync(source);
+      }
+    } else {
+      throw err;
+    }
+  }
+}
 function planMigration() {
   const profilesDir = getProfilesDir();
   const plan = {
@@ -14899,6 +15095,55 @@ function planMigration() {
       backup: backupPath
     });
   }
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.name === CURRENT_SYMLINK)
+      continue;
+    const profileName = entry.name;
+    const profileDir = path6.join(profilesDir, profileName);
+    const dotOpencode = path6.join(profileDir, ".opencode");
+    if (!existsSync7(dotOpencode))
+      continue;
+    for (const dir of FLATTEN_DIRS) {
+      const source = path6.join(dotOpencode, dir);
+      const destination = path6.join(profileDir, dir);
+      if (!existsSync7(source))
+        continue;
+      try {
+        const stat3 = lstatSync(source);
+        if (!stat3.isDirectory()) {
+          plan.skipped.push({
+            profileName,
+            reason: `.opencode/${dir} is not a directory`
+          });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (existsSync7(destination)) {
+        plan.skipped.push({
+          profileName,
+          reason: `${dir}/ exists in both .opencode/ and profile root`
+        });
+        continue;
+      }
+      const backupPath = source + BACKUP_EXT;
+      if (existsSync7(backupPath)) {
+        plan.skipped.push({
+          profileName,
+          reason: `backup already exists: .opencode/${dir}${BACKUP_EXT}`
+        });
+        continue;
+      }
+      plan.profiles.push({
+        type: "move-dir",
+        profileName,
+        source,
+        destination,
+        backup: backupPath
+      });
+    }
+  }
   const currentPath = path6.join(profilesDir, CURRENT_SYMLINK);
   if (existsSync7(currentPath)) {
     try {
@@ -14924,15 +15169,20 @@ function executeMigration(plan) {
   const completedRenames = [];
   try {
     for (const action of plan.profiles) {
-      copyFileSync(action.source, action.backup);
-      completedBackups.push(action.backup);
+      if (action.type === "rename") {
+        copyFileSync(action.source, action.backup);
+      } else {
+        cpSync(action.source, action.backup, { recursive: true });
+      }
+      completedBackups.push({ path: action.backup, isDir: action.type === "move-dir" });
     }
     for (const action of plan.profiles) {
-      renameSync(action.source, action.destination);
+      moveAtomically(action.source, action.destination, action.type === "move-dir");
       completedRenames.push({
         source: action.source,
         destination: action.destination,
-        backup: action.backup
+        backup: action.backup,
+        isDir: action.type === "move-dir"
       });
     }
     if (plan.symlink) {
@@ -14945,32 +15195,61 @@ function executeMigration(plan) {
     }
     for (const backup of completedBackups) {
       try {
-        unlinkSync(backup);
+        if (backup.isDir) {
+          rmSync(backup.path, { recursive: true, force: true });
+        } else {
+          unlinkSync(backup.path);
+        }
       } catch {}
     }
   } catch (error) {
     for (const rename2 of completedRenames) {
       try {
         if (existsSync7(rename2.destination)) {
-          renameSync(rename2.destination, rename2.source);
+          if (rename2.isDir) {
+            rmSync(rename2.destination, { recursive: true, force: true });
+          } else {
+            unlinkSync(rename2.destination);
+          }
         }
-      } catch {
-        try {
-          if (existsSync7(rename2.backup)) {
+        mkdirSync(path6.dirname(rename2.source), { recursive: true });
+        if (existsSync7(rename2.backup)) {
+          if (rename2.isDir) {
+            cpSync(rename2.backup, rename2.source, { recursive: true });
+          } else {
             copyFileSync(rename2.backup, rename2.source);
           }
-        } catch {}
-      }
+        }
+      } catch {}
     }
     for (const backup of completedBackups) {
       try {
-        if (existsSync7(backup)) {
-          unlinkSync(backup);
+        if (existsSync7(backup.path)) {
+          if (backup.isDir) {
+            rmSync(backup.path, { recursive: true, force: true });
+          } else {
+            unlinkSync(backup.path);
+          }
         }
       } catch {}
     }
     throw error;
   }
+  try {
+    const processedProfiles = new Set(plan.profiles.filter((a) => a.type === "move-dir").map((a) => a.profileName));
+    for (const profileName of processedProfiles) {
+      const profileDir = path6.join(getProfilesDir(), profileName);
+      const dotOpencode = path6.join(profileDir, ".opencode");
+      if (existsSync7(dotOpencode)) {
+        const remaining = readdirSync(dotOpencode);
+        if (remaining.length === 0) {
+          try {
+            rmdirSync(dotOpencode);
+          } catch {}
+        }
+      }
+    }
+  } catch {}
 }
 function printPlan(plan, dryRun) {
   const prefix = dryRun ? "[DRY-RUN] " : "";
@@ -14983,7 +15262,12 @@ function printPlan(plan, dryRun) {
   if (plan.profiles.length > 0 || plan.skipped.length > 0) {
     console.log("Profiles:");
     for (const action of plan.profiles) {
-      console.log(`  \u2713 ${action.profileName}: ${GHOST_CONFIG_FILE} \u2192 ${OCX_CONFIG_FILE}`);
+      if (action.type === "rename") {
+        console.log(`  \u2713 ${action.profileName}: ${GHOST_CONFIG_FILE} \u2192 ${OCX_CONFIG_FILE}`);
+      } else {
+        const dirName = path6.basename(action.source);
+        console.log(`  \u2713 ${action.profileName}: .opencode/${dirName}/ \u2192 ${dirName}/`);
+      }
     }
     for (const skipped of plan.skipped) {
       console.log(`  \u26A0 ${skipped.profileName}: skipped (${skipped.reason})`);
@@ -15099,34 +15383,90 @@ async function runInit(options2) {
   }
 }
 async function runInitGlobal(options2) {
-  const manager = ProfileManager.create();
-  if (await manager.isInitialized()) {
-    const profilesDir = getProfilesDir();
-    throw new ProfileExistsError(`Global profiles already initialized at ${profilesDir}`);
-  }
   const spin = options2.quiet ? null : createSpinner({ text: "Initializing global profiles..." });
   spin?.start();
   try {
-    await manager.initialize();
+    const created = [];
+    const existed = [];
+    const globalConfigPath = getGlobalConfig();
+    if (existsSync8(globalConfigPath)) {
+      existed.push("globalConfig");
+    } else {
+      await mkdir7(dirname3(globalConfigPath), { recursive: true, mode: 448 });
+      await atomicWrite(globalConfigPath, {
+        $schema: OCX_SCHEMA_URL,
+        registries: {}
+      });
+      created.push("globalConfig");
+    }
     const profilesDir = getProfilesDir();
-    const ocxConfigPath = getProfileOcxConfig("default");
+    if (!existsSync8(profilesDir)) {
+      await mkdir7(profilesDir, { recursive: true, mode: 448 });
+    }
+    const profileDir = getProfileDir("default");
+    if (!existsSync8(profileDir)) {
+      await mkdir7(profileDir, { recursive: true, mode: 448 });
+    }
+    const ocxPath = getProfileOcxConfig("default");
+    if (existsSync8(ocxPath)) {
+      existed.push("profileOcx");
+    } else {
+      await atomicWrite(ocxPath, DEFAULT_OCX_CONFIG);
+      created.push("profileOcx");
+    }
+    const opencodePath = getProfileOpencodeConfig("default");
+    if (existsSync8(opencodePath)) {
+      existed.push("profileOpencode");
+    } else {
+      await atomicWrite(opencodePath, {});
+      created.push("profileOpencode");
+    }
+    const agentsPath = getProfileAgents("default");
+    if (existsSync8(agentsPath)) {
+      existed.push("profileAgents");
+    } else {
+      const agentsContent = `# Profile Instructions
+
+<!-- Add your custom instructions for this profile here -->
+<!-- These will be included when running \`ocx opencode -p default\` -->
+`;
+      await Bun.write(agentsPath, agentsContent, { mode: 384 });
+      created.push("profileAgents");
+    }
     spin?.succeed("Initialized global profiles");
     if (options2.json) {
       console.log(JSON.stringify({
         success: true,
-        profilesDir,
-        defaultProfile: "default",
-        ocxConfigPath
+        files: {
+          globalConfig: globalConfigPath,
+          profileOcx: ocxPath,
+          profileOpencode: opencodePath,
+          profileAgents: agentsPath
+        },
+        created,
+        existed
       }));
     } else if (!options2.quiet) {
-      logger.info(`Created ${profilesDir}`);
-      logger.info(`Created profile "default"`);
-      logger.info("");
-      logger.info("Next steps:");
-      logger.info("  1. Edit your profile config: ocx profile config");
-      logger.info("  2. Add registries: ocx registry add <url> --profile default");
-      logger.info("  3. Launch OpenCode: ocx opencode");
-      logger.info("  4. Create more profiles: ocx profile add <name>");
+      if (created.length > 0) {
+        for (const key of created) {
+          if (key === "globalConfig")
+            logger.info(`Created global config: ${globalConfigPath}`);
+          if (key === "profileOcx")
+            logger.info(`Created profile config: ${ocxPath}`);
+          if (key === "profileOpencode")
+            logger.info(`Created profile opencode config: ${opencodePath}`);
+          if (key === "profileAgents")
+            logger.info(`Created profile instructions: ${agentsPath}`);
+        }
+        logger.info("");
+        logger.info("Next steps:");
+        logger.info("  1. Edit your profile config: ocx config edit -p default");
+        logger.info("  2. Add registries: ocx registry add <url> --name <name> --global");
+        logger.info("  3. Launch OpenCode: ocx opencode");
+        logger.info("  4. Create more profiles: ocx profile add <name>");
+      } else {
+        logger.info("Global profiles already initialized (all files exist)");
+      }
     }
   } catch (error) {
     spin?.fail("Failed to initialize");
@@ -15154,7 +15494,7 @@ async function runInitRegistry(directory, options2) {
       await mkdir7(cwd, { recursive: true });
       await copyDir(options2.local, cwd);
     } else {
-      const version = options2.canary ? "main" : await getLatestVersion();
+      const version = options2.canary ? "main" : getReleaseTag();
       await fetchAndExtractTemplate(cwd, version, options2.verbose);
     }
     if (spin)
@@ -15183,15 +15523,16 @@ async function runInitRegistry(directory, options2) {
 async function copyDir(src, dest) {
   await cp(src, dest, { recursive: true });
 }
-async function getLatestVersion() {
-  const pkgPath = new URL("../../package.json", import.meta.url);
-  const pkgContent = await readFile(pkgPath);
-  const pkg = JSON.parse(pkgContent.toString());
-  return `v${pkg.version}`;
+function getReleaseTag() {
+  if (false) {}
+  return `v${"1.4.2"}`;
 }
-async function fetchAndExtractTemplate(destDir, version, verbose) {
+function getTemplateUrl(version) {
   const ref = version === "main" ? "heads/main" : `tags/${version}`;
-  const tarballUrl = `https://github.com/${TEMPLATE_REPO}/archive/refs/${ref}.tar.gz`;
+  return `https://github.com/${TEMPLATE_REPO}/archive/refs/${ref}.tar.gz`;
+}
+async function fetchAndExtractTemplate(destDir, version, verbose) {
+  const tarballUrl = getTemplateUrl(version);
   if (verbose) {
     logger.info(`Fetching ${tarballUrl}`);
   }
@@ -15300,6 +15641,18 @@ function formatTerminalName(cwd, profileName, gitInfo) {
 }
 
 // src/commands/opencode.ts
+function resolveOpenCodeBinary(opts) {
+  return opts.configBin ?? opts.envBin ?? "opencode";
+}
+function buildOpenCodeEnv(opts) {
+  return {
+    ...opts.baseEnv,
+    ...opts.disableProjectConfig && { OPENCODE_DISABLE_PROJECT_CONFIG: "true" },
+    ...opts.profileDir && { OPENCODE_CONFIG_DIR: opts.profileDir },
+    ...opts.mergedConfig && { OPENCODE_CONFIG_CONTENT: JSON.stringify(opts.mergedConfig) },
+    ...opts.profileName && { OCX_PROFILE: opts.profileName }
+  };
+}
 function registerOpencodeCommand(program2) {
   program2.command("opencode [path]").alias("oc").description("Launch OpenCode with resolved configuration").option("-p, --profile <name>", "Use specific profile").option("--no-rename", "Disable terminal/tmux window renaming").addOption(sharedOptions.quiet()).addOption(sharedOptions.json()).allowUnknownOption().allowExcessArguments(true).action(async (path8, options2, command) => {
     try {
@@ -15354,17 +15707,20 @@ async function runOpencode(pathArg, args, options2) {
     const gitInfo = await getGitInfo(projectDir);
     setTerminalName(formatTerminalName(projectDir, config.profileName ?? "default", gitInfo));
   }
-  const bin = ocxConfig?.bin ?? process.env.OPENCODE_BIN ?? "opencode";
+  const bin = resolveOpenCodeBinary({
+    configBin: ocxConfig?.bin,
+    envBin: process.env.OPENCODE_BIN
+  });
   proc = Bun.spawn({
     cmd: [bin, ...args],
     cwd: projectDir,
-    env: {
-      ...process.env,
-      OPENCODE_DISABLE_PROJECT_CONFIG: "true",
-      ...profileDir && { OPENCODE_CONFIG_DIR: profileDir },
-      ...configToPass && { OPENCODE_CONFIG_CONTENT: JSON.stringify(configToPass) },
-      ...config.profileName && { OCX_PROFILE: config.profileName }
-    },
+    env: buildOpenCodeEnv({
+      baseEnv: process.env,
+      profileDir,
+      profileName: config.profileName ?? undefined,
+      mergedConfig: configToPass,
+      disableProjectConfig: true
+    }),
     stdin: "inherit",
     stdout: "inherit",
     stderr: "inherit"
@@ -15389,9 +15745,290 @@ async function runOpencode(pathArg, args, options2) {
   }
 }
 
+// src/commands/profile/install-from-registry.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync9 } from "fs";
+import { mkdir as mkdir8, mkdtemp, rename as rename2, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname4, join as join8 } from "path";
+var PROFILE_FILE_TARGETS = new Set(["ocx.jsonc", "opencode.jsonc", "AGENTS.md"]);
+function isProfileFile(target) {
+  return PROFILE_FILE_TARGETS.has(target);
+}
+function hashContent2(content2) {
+  return createHash2("sha256").update(content2).digest("hex");
+}
+function hashBundle2(files) {
+  const sorted = [...files].sort((a, b) => a.path.localeCompare(b.path));
+  const manifestParts = [];
+  for (const file of sorted) {
+    const hash = hashContent2(file.content);
+    manifestParts.push(`${file.path}:${hash}`);
+  }
+  return hashContent2(manifestParts.join(`
+`));
+}
+async function installProfileFromRegistry(options2) {
+  const { namespace, component, profileName, force, registryUrl, registries, quiet } = options2;
+  const parseResult = profileNameSchema.safeParse(profileName);
+  if (!parseResult.success) {
+    throw new ValidationError(`Invalid profile name: "${profileName}". ` + `Profile names must start with a letter and contain only alphanumeric characters, dots, underscores, or hyphens.`);
+  }
+  const profileDir = getProfileDir(profileName);
+  const qualifiedName = `${namespace}/${component}`;
+  const profileExists = existsSync9(profileDir);
+  if (profileExists && !force) {
+    throw new ConflictError(`Profile "${profileName}" already exists.
+Use --force to overwrite.`);
+  }
+  const fetchSpin = quiet ? null : createSpinner({ text: `Fetching ${qualifiedName}...` });
+  fetchSpin?.start();
+  let manifest;
+  try {
+    manifest = await fetchComponent(registryUrl, component);
+  } catch (error) {
+    fetchSpin?.fail(`Failed to fetch ${qualifiedName}`);
+    if (error instanceof NotFoundError) {
+      throw new NotFoundError(`Profile component "${qualifiedName}" not found in registry.
+
+` + `Check the component name and ensure the registry is configured.`);
+    }
+    throw error;
+  }
+  if (manifest.type !== "ocx:profile") {
+    fetchSpin?.fail(`Invalid component type`);
+    throw new ValidationError(`Component "${qualifiedName}" is type "${manifest.type}", not "ocx:profile".
+
+` + `Only profile components can be installed with 'ocx profile add --from'.`);
+  }
+  const normalized = normalizeComponentManifest(manifest);
+  fetchSpin?.succeed(`Fetched ${qualifiedName}`);
+  const filesSpin = quiet ? null : createSpinner({ text: "Downloading profile files..." });
+  filesSpin?.start();
+  const profileFiles = [];
+  const dependencyFiles = [];
+  for (const file of normalized.files) {
+    const content2 = await fetchFileContent(registryUrl, component, file.path);
+    const fileEntry = {
+      path: file.path,
+      target: file.target,
+      content: Buffer.from(content2)
+    };
+    if (isProfileFile(file.target)) {
+      profileFiles.push(fileEntry);
+    } else {
+      dependencyFiles.push(fileEntry);
+    }
+  }
+  filesSpin?.succeed(`Downloaded ${normalized.files.length} files`);
+  let resolvedDeps = null;
+  const dependencyBundles = [];
+  if (manifest.dependencies.length > 0) {
+    const depsSpin = quiet ? null : createSpinner({ text: "Resolving dependencies..." });
+    depsSpin?.start();
+    try {
+      const depRefs = manifest.dependencies.map((dep) => dep.includes("/") ? dep : `${namespace}/${dep}`);
+      resolvedDeps = await resolveDependencies(registries, depRefs);
+      for (const depComponent of resolvedDeps.components) {
+        const files = [];
+        for (const file of depComponent.files) {
+          const content2 = await fetchFileContent(depComponent.baseUrl, depComponent.name, file.path);
+          const resolvedTarget = resolveTargetPath(file.target, true);
+          files.push({
+            path: file.path,
+            target: resolvedTarget,
+            content: Buffer.from(content2)
+          });
+        }
+        const registryIndex = await fetchRegistryIndex(depComponent.baseUrl);
+        dependencyBundles.push({
+          qualifiedName: depComponent.qualifiedName,
+          registryName: depComponent.registryName,
+          files,
+          hash: hashBundle2(files),
+          version: registryIndex.version
+        });
+      }
+      depsSpin?.succeed(`Resolved ${resolvedDeps.components.length} dependencies`);
+    } catch (error) {
+      depsSpin?.fail("Failed to resolve dependencies");
+      throw error;
+    }
+  }
+  const profilesDir = getProfilesDir();
+  await mkdir8(profilesDir, { recursive: true, mode: 448 });
+  const stagingDir = await mkdtemp(join8(profilesDir, ".staging-"));
+  const stagingOpencodeDir = join8(stagingDir, ".opencode");
+  try {
+    await mkdir8(stagingOpencodeDir, { recursive: true, mode: 448 });
+    const writeSpin = quiet ? null : createSpinner({ text: "Writing profile files..." });
+    writeSpin?.start();
+    for (const file of profileFiles) {
+      const targetPath = join8(stagingDir, file.target);
+      const targetDir = dirname4(targetPath);
+      if (!existsSync9(targetDir)) {
+        await mkdir8(targetDir, { recursive: true });
+      }
+      await writeFile3(targetPath, file.content);
+    }
+    for (const file of dependencyFiles) {
+      const target = file.target.startsWith(".opencode/") ? file.target.slice(".opencode/".length) : file.target;
+      const targetPath = join8(stagingOpencodeDir, target);
+      const targetDir = dirname4(targetPath);
+      if (!existsSync9(targetDir)) {
+        await mkdir8(targetDir, { recursive: true });
+      }
+      await writeFile3(targetPath, file.content);
+    }
+    writeSpin?.succeed(`Wrote ${profileFiles.length + dependencyFiles.length} profile files`);
+    if (dependencyBundles.length > 0) {
+      const depWriteSpin = quiet ? null : createSpinner({ text: "Writing dependency files..." });
+      depWriteSpin?.start();
+      let depFileCount = 0;
+      for (const bundle of dependencyBundles) {
+        for (const file of bundle.files) {
+          const targetPath = join8(stagingOpencodeDir, file.target);
+          const targetDir = dirname4(targetPath);
+          if (!existsSync9(targetDir)) {
+            await mkdir8(targetDir, { recursive: true });
+          }
+          await writeFile3(targetPath, file.content);
+          depFileCount++;
+        }
+      }
+      depWriteSpin?.succeed(`Wrote ${depFileCount} dependency files`);
+    }
+    const profileHash = hashBundle2(profileFiles.map((f) => ({ path: f.path, content: f.content })));
+    const registryIndex = await fetchRegistryIndex(registryUrl);
+    const lock = {
+      version: 1,
+      installedFrom: {
+        registry: namespace,
+        component,
+        version: registryIndex.version,
+        hash: profileHash,
+        installedAt: new Date().toISOString()
+      },
+      installed: {}
+    };
+    for (const bundle of dependencyBundles) {
+      lock.installed[bundle.qualifiedName] = {
+        registry: bundle.registryName,
+        version: bundle.version,
+        hash: bundle.hash,
+        files: bundle.files.map((f) => f.target),
+        installedAt: new Date().toISOString()
+      };
+    }
+    await writeFile3(join8(stagingDir, "ocx.lock"), JSON.stringify(lock, null, "\t"));
+    const moveSpin = quiet ? null : createSpinner({ text: "Finalizing installation..." });
+    moveSpin?.start();
+    const profilesDir2 = dirname4(profileDir);
+    if (!existsSync9(profilesDir2)) {
+      await mkdir8(profilesDir2, { recursive: true, mode: 448 });
+    }
+    if (profileExists && force) {
+      const backupDir = `${profileDir}.backup-${Date.now()}`;
+      await rename2(profileDir, backupDir);
+      try {
+        await rename2(stagingDir, profileDir);
+      } catch (err) {
+        await rename2(backupDir, profileDir);
+        throw err;
+      }
+      await rm3(backupDir, { recursive: true, force: true });
+    } else {
+      await rename2(stagingDir, profileDir);
+    }
+    moveSpin?.succeed("Installation complete");
+    if (!quiet) {
+      logger.info("");
+      logger.success(`Installed profile "${profileName}" from ${qualifiedName}`);
+      logger.info("");
+      logger.info("Profile contents:");
+      for (const file of profileFiles) {
+        logger.info(`  ${file.target}`);
+      }
+      if (dependencyBundles.length > 0) {
+        logger.info("");
+        logger.info("Dependencies:");
+        for (const bundle of dependencyBundles) {
+          logger.info(`  ${bundle.qualifiedName}`);
+        }
+      }
+    }
+  } catch (error) {
+    try {
+      if (existsSync9(stagingDir)) {
+        await rm3(stagingDir, { recursive: true });
+      }
+    } catch {}
+    throw error;
+  }
+}
+
 // src/commands/profile/add.ts
+function parseFromOption(from) {
+  if (!from?.trim()) {
+    throw new ValidationError("--from value cannot be empty");
+  }
+  const trimmed = from.trim();
+  if (trimmed.startsWith("./") || trimmed.startsWith("~/") || trimmed.startsWith("/")) {
+    return { type: "local-path", path: trimmed };
+  }
+  const slashCount = (trimmed.match(/\//g) || []).length;
+  if (slashCount === 1) {
+    const [namespace, component] = trimmed.split("/").map((s) => s.trim());
+    if (!namespace || !component) {
+      throw new ValidationError(`Invalid registry reference: "${from}". Expected format: namespace/component`);
+    }
+    return { type: "registry", namespace, component };
+  }
+  return { type: "local-profile", name: trimmed };
+}
+async function readGlobalOcxConfig() {
+  const configPath = getGlobalConfig();
+  const file = Bun.file(configPath);
+  if (!await file.exists()) {
+    return null;
+  }
+  try {
+    const content2 = await file.text();
+    const json = parse2(content2, [], { allowTrailingComma: true });
+    return profileOcxConfigSchema.parse(json);
+  } catch (error) {
+    if (error instanceof Error) {
+      throw new ConfigError(`Failed to parse global config at "${configPath}": ${error.message}
+
+` + `Check the file for syntax errors or run: ocx config edit --global`);
+    }
+    throw error;
+  }
+}
+async function requireGlobalRegistry(namespace) {
+  const globalConfig = await readGlobalOcxConfig();
+  if (!globalConfig) {
+    throw new ConfigError(`Registry "${namespace}" is not configured globally.
+
+` + `Profile installation requires global registry configuration.
+` + `Run: ocx registry add <url> --name ${namespace} --global`);
+  }
+  const registry = globalConfig.registries[namespace];
+  if (!registry) {
+    throw new ConfigError(`Registry "${namespace}" is not configured globally.
+
+` + `Profile installation requires global registry configuration.
+` + `Run: ocx registry add <url> --name ${namespace} --global`);
+  }
+  return { config: globalConfig, registryUrl: registry.url };
+}
 function registerProfileAddCommand(parent) {
-  parent.command("add <name>").description("Create a new global profile").option("--from <profile>", "Clone settings from existing profile").action(async (name, options2) => {
+  parent.command("add <name>").description("Create a new profile, clone from existing, or install from registry").option("--from <source>", "Clone from existing profile or install from registry (e.g., kdco/minimal)").option("-f, --force", "Overwrite existing profile").addHelpText("after", `
+Examples:
+  $ ocx profile add work                      # Create empty profile
+  $ ocx profile add work --from dev           # Clone from existing profile
+  $ ocx profile add work --from kdco/minimal  # Install from registry
+  $ ocx profile add work --from kdco/minimal --force  # Overwrite existing
+`).action(async (name, options2) => {
     try {
       await runProfileAdd(name, options2);
     } catch (error) {
@@ -15401,42 +16038,61 @@ function registerProfileAddCommand(parent) {
 }
 async function runProfileAdd(name, options2) {
   const manager = await ProfileManager.requireInitialized();
-  if (options2.from) {
-    const source = await manager.get(options2.from);
-    await manager.add(name);
-    await atomicWrite(getProfileOcxConfig(name), source.ocx);
-    logger.success(`Created profile "${name}" (cloned from "${options2.from}")`);
-  } else {
-    await manager.add(name);
-    logger.success(`Created profile "${name}"`);
+  const profileExists = await manager.exists(name);
+  if (profileExists && !options2.force) {
+    logger.error(`\u2717 Profile "${name}" already exists`);
+    logger.error("");
+    logger.error("Use --force to overwrite the existing profile.");
+    throw new ProfileExistsError(name);
+  }
+  if (!options2.from) {
+    await createEmptyProfile(manager, name, profileExists);
+    return;
   }
-}
+  const fromInput = parseFromOption(options2.from);
+  switch (fromInput.type) {
+    case "local-profile":
+      await cloneFromLocalProfile(manager, name, fromInput.name, profileExists);
+      break;
+    case "local-path":
+      throw new ValidationError(`Local path installation is not yet implemented: "${fromInput.path}"
 
-// src/commands/profile/config.ts
-function registerProfileConfigCommand(parent) {
-  parent.command("config [name]").description("Open profile ocx.jsonc in editor").action(async (name) => {
-    try {
-      await runProfileConfig(name);
-    } catch (error) {
-      handleError(error);
+` + `Currently supported sources:
+` + `  - Existing profile: --from <profile-name>
+` + `  - Registry: --from <namespace>/<component>`);
+    case "registry": {
+      const { config: globalConfig, registryUrl } = await requireGlobalRegistry(fromInput.namespace);
+      const registries = {};
+      for (const [ns, reg] of Object.entries(globalConfig.registries)) {
+        registries[ns] = { url: reg.url };
+      }
+      await installProfileFromRegistry({
+        namespace: fromInput.namespace,
+        component: fromInput.component,
+        profileName: name,
+        force: options2.force,
+        registryUrl,
+        registries
+      });
+      break;
     }
-  });
+  }
 }
-async function runProfileConfig(name) {
-  const manager = await ProfileManager.requireInitialized();
-  const profileName = name ?? await manager.resolveProfile();
-  await manager.get(profileName);
-  const configPath = getProfileOcxConfig(profileName);
-  const editor = process.env.EDITOR || process.env.VISUAL || "vi";
-  const proc = Bun.spawn([editor, configPath], {
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit"
-  });
-  const exitCode = await proc.exited;
-  if (exitCode !== 0) {
-    throw new Error(`Editor exited with code ${exitCode}`);
+async function createEmptyProfile(manager, name, exists) {
+  if (exists) {
+    await manager.remove(name);
+  }
+  await manager.add(name);
+  logger.success(`Created profile "${name}"`);
+}
+async function cloneFromLocalProfile(manager, name, sourceName, exists) {
+  const source = await manager.get(sourceName);
+  if (exists) {
+    await manager.remove(name);
   }
+  await manager.add(name);
+  await atomicWrite(getProfileOcxConfig(name), source.ocx);
+  logger.success(`Created profile "${name}" (cloned from "${sourceName}")`);
 }
 
 // src/commands/profile/list.ts
@@ -15525,22 +16181,43 @@ function registerProfileCommand(program2) {
   registerProfileAddCommand(profile);
   registerProfileRemoveCommand(profile);
   registerProfileShowCommand(profile);
-  registerProfileConfigCommand(profile);
 }
 
 // src/commands/registry.ts
+import { existsSync as existsSync10 } from "fs";
+import { dirname as dirname5, join as join9 } from "path";
 async function runRegistryAddCore2(url, options2, callbacks) {
   if (callbacks.isLocked?.()) {
     throw new Error("Registries are locked. Cannot add.");
   }
-  const name = options2.name || new URL(url).hostname.replace(/\./g, "-");
+  const trimmedUrl = url.trim();
+  if (!trimmedUrl) {
+    throw new ValidationError("Registry URL is required");
+  }
+  let derivedName;
+  try {
+    const parsed = new URL(trimmedUrl);
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      throw new ValidationError(`Invalid registry URL: ${trimmedUrl} (must use http or https)`);
+    }
+    derivedName = options2.name || parsed.hostname.replace(/\./g, "-");
+  } catch (error) {
+    if (error instanceof ValidationError)
+      throw error;
+    throw new ValidationError(`Invalid registry URL: ${trimmedUrl}`);
+  }
+  const name = derivedName;
   const registries = callbacks.getRegistries();
+  const existingRegistry = registries[name];
+  if (existingRegistry && !options2.force) {
+    throw new RegistryExistsError(name, existingRegistry.url, trimmedUrl);
+  }
   const isUpdate = name in registries;
   await callbacks.setRegistry(name, {
-    url,
+    url: trimmedUrl,
     version: options2.version
   });
-  return { name, url, updated: isUpdate };
+  return { name, url: trimmedUrl, updated: isUpdate };
 }
 async function runRegistryRemoveCore(name, callbacks) {
   if (callbacks.isLocked?.()) {
@@ -15563,17 +16240,67 @@ function runRegistryListCore(callbacks) {
   }));
   return { registries: list, locked };
 }
+async function resolveRegistryTarget(options2, command, cwd) {
+  const cwdExplicitlyProvided = command.getOptionValueSource("cwd") === "cli";
+  if (options2.global && options2.profile) {
+    throw new ValidationError("Cannot use both --global and --profile flags");
+  }
+  if (cwdExplicitlyProvided && options2.profile) {
+    throw new ValidationError("Cannot use both --cwd and --profile flags");
+  }
+  if (options2.global && cwdExplicitlyProvided) {
+    throw new ValidationError("Cannot use both --global and --cwd flags");
+  }
+  if (options2.profile) {
+    validateProfileName(options2.profile);
+    const manager = await ProfileManager.requireInitialized();
+    if (!await manager.exists(options2.profile)) {
+      throw new ProfileNotFoundError(options2.profile);
+    }
+    const configPath = getProfileOcxConfig(options2.profile);
+    if (!existsSync10(configPath)) {
+      throw new OcxConfigError(`Profile '${options2.profile}' has no ocx.jsonc. Run 'ocx profile config ${options2.profile}' to create it.`);
+    }
+    return {
+      scope: "profile",
+      configPath,
+      configDir: dirname5(configPath),
+      targetLabel: `profile '${options2.profile}' config`
+    };
+  }
+  if (options2.global) {
+    const configDir = getGlobalConfigPath();
+    return {
+      scope: "global",
+      configPath: join9(configDir, "ocx.jsonc"),
+      configDir,
+      targetLabel: "global config"
+    };
+  }
+  const found = findOcxConfig(cwd);
+  return {
+    scope: "local",
+    configPath: found.path,
+    configDir: found.exists ? dirname5(found.path) : join9(cwd, ".opencode"),
+    targetLabel: "local config"
+  };
+}
 function registerRegistryCommand(program2) {
   const registry = program2.command("registry").description("Manage registries");
-  const addCmd = registry.command("add").description("Add a registry").argument("<url>", "Registry URL").option("--name <name>", "Registry alias (defaults to hostname)").option("--version <version>", "Pin to specific version");
+  const addCmd = registry.command("add").description("Add a registry").argument("<url>", "Registry URL").option("--name <name>", "Registry alias (defaults to hostname)").option("--version <version>", "Pin to specific version").option("-f, --force", "Overwrite existing registry");
+  addGlobalOption(addCmd);
+  addProfileOption(addCmd);
   addCommonOptions(addCmd);
-  addCmd.action(async (url, options2) => {
+  addCmd.action(async (url, options2, command) => {
+    let target;
     try {
       const cwd = options2.cwd ?? process.cwd();
-      const { path: configPath } = findOcxConfig(cwd);
-      const config = await readOcxConfig(cwd);
+      target = await resolveRegistryTarget(options2, command, cwd);
+      const { configDir, configPath } = target;
+      const config = await readOcxConfig(configDir);
       if (!config) {
-        logger.error("No ocx.jsonc found. Run 'ocx init' first.");
+        const initHint = target.scope === "global" ? "Run 'ocx init --global' first." : target.scope === "profile" ? `Run 'ocx profile config ${options2.profile}' to create it.` : "Run 'ocx init' first.";
+        logger.error(`${target.targetLabel} not found. ${initHint}`);
         process.exit(1);
       }
       const result = await runRegistryAddCore2(url, options2, {
@@ -15581,31 +16308,38 @@ function registerRegistryCommand(program2) {
         isLocked: () => config.lockRegistries ?? false,
         setRegistry: async (name, regConfig) => {
           config.registries[name] = regConfig;
-          await writeOcxConfig(cwd, config, configPath);
+          await writeOcxConfig(configDir, config, configPath);
         }
       });
       if (options2.json) {
         outputJson({ success: true, data: result });
       } else if (!options2.quiet) {
         if (result.updated) {
-          logger.success(`Updated registry: ${result.name} -> ${result.url}`);
+          logger.success(`Updated registry in ${target.targetLabel}: ${result.name} -> ${result.url}`);
         } else {
-          logger.success(`Added registry: ${result.name} -> ${result.url}`);
+          logger.success(`Added registry to ${target.targetLabel}: ${result.name} -> ${result.url}`);
         }
       }
     } catch (error) {
+      if (error instanceof RegistryExistsError && !error.targetLabel) {
+        const enrichedError = new RegistryExistsError(error.registryName, error.existingUrl, error.newUrl, target?.targetLabel ?? "config");
+        handleError(enrichedError, { json: options2.json });
+      }
       handleError(error, { json: options2.json });
     }
   });
   const removeCmd = registry.command("remove").description("Remove a registry").argument("<name>", "Registry name");
+  addGlobalOption(removeCmd);
+  addProfileOption(removeCmd);
   addCommonOptions(removeCmd);
-  removeCmd.action(async (name, options2) => {
+  removeCmd.action(async (name, options2, command) => {
     try {
       const cwd = options2.cwd ?? process.cwd();
-      const { path: configPath } = findOcxConfig(cwd);
-      const config = await readOcxConfig(cwd);
+      const target = await resolveRegistryTarget(options2, command, cwd);
+      const config = await readOcxConfig(target.configDir);
       if (!config) {
-        logger.error("No ocx.jsonc found. Run 'ocx init' first.");
+        const initHint = target.scope === "global" ? "Run 'ocx init --global' first." : target.scope === "profile" ? `Run 'ocx profile config ${options2.profile}' to create it.` : "Run 'ocx init' first.";
+        logger.error(`${target.targetLabel} not found. ${initHint}`);
         process.exit(1);
       }
       const result = await runRegistryRemoveCore(name, {
@@ -15613,26 +16347,30 @@ function registerRegistryCommand(program2) {
         isLocked: () => config.lockRegistries ?? false,
         removeRegistry: async (regName) => {
           delete config.registries[regName];
-          await writeOcxConfig(cwd, config, configPath);
+          await writeOcxConfig(target.configDir, config, target.configPath);
         }
       });
       if (options2.json) {
         outputJson({ success: true, data: result });
       } else if (!options2.quiet) {
-        logger.success(`Removed registry: ${result.removed}`);
+        logger.success(`Removed registry from ${target.targetLabel}: ${result.removed}`);
       }
     } catch (error) {
       handleError(error, { json: options2.json });
     }
   });
   const listCmd = registry.command("list").description("List configured registries");
+  addGlobalOption(listCmd);
+  addProfileOption(listCmd);
   addCommonOptions(listCmd);
-  listCmd.action(async (options2) => {
+  listCmd.action(async (options2, command) => {
     try {
       const cwd = options2.cwd ?? process.cwd();
-      const config = await readOcxConfig(cwd);
+      const target = await resolveRegistryTarget(options2, command, cwd);
+      const config = await readOcxConfig(target.configDir);
       if (!config) {
-        logger.warn("No ocx.jsonc found. Run 'ocx init' first.");
+        const initHint = target.scope === "global" ? "Run 'ocx init --global' first." : target.scope === "profile" ? `Run 'ocx profile config ${options2.profile}' to create it.` : "Run 'ocx init' first.";
+        logger.warn(`${target.targetLabel} not found. ${initHint}`);
         return;
       }
       const result = runRegistryListCore({
@@ -15645,7 +16383,8 @@ function registerRegistryCommand(program2) {
         if (result.registries.length === 0) {
           logger.info("No registries configured.");
         } else {
-          logger.info(`Configured registries${result.locked ? kleur_default.yellow(" (locked)") : ""}:`);
+          const scopeLabel = target.scope === "global" ? " (global)" : target.scope === "profile" ? ` (profile '${options2.profile}')` : "";
+          logger.info(`Configured registries${scopeLabel}${result.locked ? kleur_default.yellow(" (locked)") : ""}:`);
           for (const reg of result.registries) {
             console.log(`  ${kleur_default.cyan(reg.name)}: ${reg.url} ${kleur_default.dim(`(${reg.version})`)}`);
           }
@@ -15780,7 +16519,7 @@ async function runSearchCore(query, options2, provider) {
 
 // src/self-update/version-provider.ts
 class BuildTimeVersionProvider {
-  version = "1.4.0";
+  version = "1.4.2";
 }
 var defaultVersionProvider = new BuildTimeVersionProvider;
 
@@ -15893,7 +16632,7 @@ function getExecutablePath() {
 }
 
 // src/self-update/download.ts
-import { chmodSync, existsSync as existsSync9, renameSync as renameSync2, unlinkSync as unlinkSync2 } from "fs";
+import { chmodSync, existsSync as existsSync11, renameSync as renameSync2, unlinkSync as unlinkSync2 } from "fs";
 var GITHUB_REPO2 = "kdcokenny/ocx";
 var DEFAULT_DOWNLOAD_BASE_URL = `https://github.com/${GITHUB_REPO2}/releases/download`;
 var PLATFORM_MAP = {
@@ -15971,7 +16710,7 @@ async function downloadToTemp(version) {
   try {
     chmodSync(tempPath, 493);
   } catch (error) {
-    if (existsSync9(tempPath)) {
+    if (existsSync11(tempPath)) {
       unlinkSync2(tempPath);
     }
     throw new SelfUpdateError(`Failed to set permissions: ${error instanceof Error ? error.message : String(error)}`);
@@ -15981,20 +16720,20 @@ async function downloadToTemp(version) {
 function atomicReplace(tempPath, execPath) {
   const backupPath = `${execPath}.backup`;
   try {
-    if (existsSync9(execPath)) {
+    if (existsSync11(execPath)) {
       renameSync2(execPath, backupPath);
     }
     renameSync2(tempPath, execPath);
-    if (existsSync9(backupPath)) {
+    if (existsSync11(backupPath)) {
       unlinkSync2(backupPath);
     }
   } catch (error) {
-    if (existsSync9(backupPath) && !existsSync9(execPath)) {
+    if (existsSync11(backupPath) && !existsSync11(execPath)) {
       try {
         renameSync2(backupPath, execPath);
       } catch {}
     }
-    if (existsSync9(tempPath)) {
+    if (existsSync11(tempPath)) {
       try {
         unlinkSync2(tempPath);
       } catch {}
@@ -16003,7 +16742,7 @@ function atomicReplace(tempPath, execPath) {
   }
 }
 function cleanupTempFile(tempPath) {
-  if (existsSync9(tempPath)) {
+  if (existsSync11(tempPath)) {
     try {
       unlinkSync2(tempPath);
     } catch {}
@@ -16025,7 +16764,7 @@ function notifyUpdated(from, to) {
 }
 
 // src/self-update/verify.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var GITHUB_REPO3 = "kdcokenny/ocx";
 function parseSha256Sums(content2) {
   const checksums = new Map;
@@ -16038,8 +16777,8 @@ function parseSha256Sums(content2) {
   }
   return checksums;
 }
-function hashContent2(content2) {
-  return createHash2("sha256").update(content2).digest("hex");
+function hashContent3(content2) {
+  return createHash3("sha256").update(content2).digest("hex");
 }
 async function fetchChecksums(version) {
   const url = `https://github.com/${GITHUB_REPO3}/releases/download/v${version}/SHA256SUMS.txt`;
@@ -16053,7 +16792,7 @@ async function fetchChecksums(version) {
 async function verifyChecksum(filePath, expectedHash, filename) {
   const file = Bun.file(filePath);
   const content2 = await file.arrayBuffer();
-  const actualHash = hashContent2(Buffer.from(content2));
+  const actualHash = hashContent3(Buffer.from(content2));
   if (actualHash !== expectedHash) {
     throw new IntegrityError(filename, expectedHash, actualHash);
   }
@@ -16178,10 +16917,10 @@ function registerSelfCommand(program2) {
 }
 
 // src/commands/update.ts
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync10 } from "fs";
-import { mkdir as mkdir8, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname4, join as join8 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync12 } from "fs";
+import { mkdir as mkdir9, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname6, join as join10 } from "path";
 function registerUpdateCommand(program2) {
   program2.command("update [components...]").description("Update installed components (use @version suffix to pin, e.g., kdco/agents@1.2.0)").option("--all", "Update all installed components").option("--registry <name>", "Update all components from a specific registry").option("--dry-run", "Preview changes without applying").option("--cwd <path>", "Working directory", process.cwd()).option("-q, --quiet", "Suppress output").option("-v, --verbose", "Verbose output").option("--json", "Output as JSON").action(async (components, options2) => {
     try {
@@ -16265,7 +17004,7 @@ Version cannot be empty. Use 'kdco/agents@1.2.0' or omit the version for latest.
         const content2 = await fetchFileContent(regConfig.url, componentName, file.path);
         files.push({ path: file.path, content: Buffer.from(content2) });
       }
-      const newHash = await hashBundle2(files);
+      const newHash = await hashBundle3(files);
       if (newHash === lockEntry.hash) {
         results.push({
           qualifiedName,
@@ -16319,12 +17058,12 @@ Version cannot be empty. Use 'kdco/agents@1.2.0' or omit the version for latest.
         const fileObj = update.component.files.find((f) => f.path === file.path);
         if (!fileObj)
           continue;
-        const targetPath = join8(provider.cwd, fileObj.target);
-        const targetDir = dirname4(targetPath);
-        if (!existsSync10(targetDir)) {
-          await mkdir8(targetDir, { recursive: true });
+        const targetPath = join10(provider.cwd, fileObj.target);
+        const targetDir = dirname6(targetPath);
+        if (!existsSync12(targetDir)) {
+          await mkdir9(targetDir, { recursive: true });
         }
-        await writeFile3(targetPath, file.content);
+        await writeFile4(targetPath, file.content);
         if (options2.verbose) {
           logger.info(`  \u2713 Updated ${fileObj.target}`);
         }
@@ -16443,17 +17182,17 @@ function outputDryRun(results, options2) {
     }
   }
 }
-async function hashContent3(content2) {
-  return createHash3("sha256").update(content2).digest("hex");
+async function hashContent4(content2) {
+  return createHash4("sha256").update(content2).digest("hex");
 }
-async function hashBundle2(files) {
+async function hashBundle3(files) {
   const sorted = [...files].sort((a, b) => a.path.localeCompare(b.path));
   const manifestParts = [];
   for (const file of sorted) {
-    const hash = await hashContent3(file.content);
+    const hash = await hashContent4(file.content);
     manifestParts.push(`${file.path}:${hash}`);
   }
-  return hashContent3(manifestParts.join(`
+  return hashContent4(manifestParts.join(`
 `));
 }
 
@@ -16485,7 +17224,7 @@ function registerUpdateCheckHook(program2) {
   });
 }
 // src/index.ts
-var version = "1.4.0";
+var version = "1.4.2";
 async function main2() {
   const program2 = new Command().name("ocx").description("OpenCode Extensions - Install agents, skills, plugins, and commands").version(version);
   registerInitCommand(program2);
@@ -16517,4 +17256,4 @@ export {
   buildRegistry
 };
 
-//# debugId=5FADDAC480C59C7864756E2164756E21
+//# debugId=52AD8D268EBA9E8864756E2164756E21