pinsay-cli 0.7.3 → 0.8.1

package/dist/cli.js

@@ -15,13 +15,13 @@ var init_build_constants = __esm({
   "src/build-constants.ts"() {
     "use strict";
     BUILD_DEFAULT_SERVER = true ? "https://app.pinsay.dev" : "https://app.pinsay.dev";
-    BUILD_CLI_VERSION = true ? "0.7.3" : "0.0.0-dev";
+    BUILD_CLI_VERSION = true ? "0.8.1" : "0.0.0-dev";
   }
 });
 
 // src/config.ts
 import { promises as fs } from "node:fs";
-import { join, dirname, isAbsolute, sep } from "node:path";
+import { join, dirname, resolve, sep } from "node:path";
 function isMultiProject(config) {
   return !!config.projects && Object.keys(config.projects).length > 0;
 }
@@ -70,7 +70,7 @@ function resolveProject(config, cwd2, root, flag) {
   return { ok: false, reason: "ambiguous", keys: projects.map((p) => p.key) };
 }
 function resolveAbs(p) {
-  return isAbsolute(p) ? normalizeTrailingSlash(p) : normalizeTrailingSlash(join(process.cwd(), p));
+  return normalizeTrailingSlash(resolve(p));
 }
 function normalizeTrailingSlash(p) {
   return p.endsWith(sep) && p.length > 1 ? p.slice(0, -1) : p;
@@ -124,8 +124,6 @@ async function writeCredentials(cwd2, token, extra = {}) {
   const file = join(cwd2, CREDENTIALS_FILE);
   await fs.mkdir(dirname(file), { recursive: true });
   const lines = [`PINSAY_API_KEY=${token}`];
-  if (extra.server)
-    lines.push(`PINSAY_SERVER=${extra.server}`);
   if (extra.project)
     lines.push(`PINSAY_PROJECT=${extra.project}`);
   await fs.writeFile(file, lines.join("\n") + "\n", { encoding: "utf8", mode: 384 });
@@ -147,48 +145,7 @@ async function removeLegacyRepoFiles(cwd2) {
   }
   return removed;
 }
-async function upsertGitignore(cwd2, productName = "Feedback tool", skillsDir) {
-  const file = join(cwd2, ".gitignore");
-  let content = await fs.readFile(file, "utf8").catch(() => "");
-  const before = content;
-  const skillsDirPaths = skillsDir ? [`${skillsDir.replace(/\/+$/, "")}/pinsay-init/`, `${skillsDir.replace(/\/+$/, "")}/pinsay-feedback/`] : [];
-  const allSkillPaths = [...IGNORED_SKILL_DIRS, ...skillsDirPaths];
-  const entry = [
-    "",
-    `# ${productName}`,
-    // `.pinsay/*`, not `.pinsay/`. Git does not descend into an excluded DIRECTORY, so the
-    // directory form makes every `!` line below inert and the files this block exists to keep
-    // committable are silently ignored instead.
-    ".pinsay/*",
-    "!.pinsay/stack.json",
-    "!.pinsay/config.json",
-    // Re-includes the directory itself (not a wildcard for its contents) — with nothing further
-    // ignoring paths inside it, git descends and every `projects/<key>.stack.json` stays
-    // committable, exactly like stack.json/config.json above.
-    "!.pinsay/projects/",
-    ...allSkillPaths,
-    ""
-  ].join("\n");
-  content = content.replace(/^\.pinsay\/$/m, ".pinsay/*");
-  content = content.replace(/\n?# [^\n]*\n\.pinsay\/credentials\.env\n/, "");
-  content = content.replace(/^!\.pinsay\/pinsay\.sh\n/m, "");
-  content = content.replace(/^!\.pinsay\/credentials\.env\.example\n/m, "");
-  if (!/^!\.pinsay\/stack\.json$/m.test(content)) {
-    content += entry;
-  }
-  const missingSkillDirs = allSkillPaths.filter((d) => !content.includes(d));
-  if (missingSkillDirs.length > 0) {
-    content += missingSkillDirs.map((d) => `${d}
-`).join("");
-  }
-  if (!content.includes("!.pinsay/projects/")) {
-    content += "!.pinsay/projects/\n";
-  }
-  if (content !== before) {
-    await fs.writeFile(file, content, "utf8");
-  }
-}
-var CONFIG_FILE, CREDENTIALS_FILE, LEGACY_SERVER, CANONICAL_SERVER, IGNORED_SKILL_DIRS, LEGACY_REPO_FILES;
+var CONFIG_FILE, CREDENTIALS_FILE, LEGACY_SERVER, CANONICAL_SERVER, LEGACY_REPO_FILES;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
@@ -196,22 +153,6 @@ var init_config = __esm({
     CREDENTIALS_FILE = ".pinsay/credentials.env";
     LEGACY_SERVER = "https://api.pinsay.dev";
     CANONICAL_SERVER = "https://app.pinsay.dev";
-    IGNORED_SKILL_DIRS = [
-      ".claude/skills/pinsay-init/",
-      ".claude/skills/pinsay-feedback/",
-      // Current Agent Skills layout (2026-09-16+) — used by `other`/`antigravity`, and symlinked into
-      // from claude-code/cursor/windsurf (see `writeOrLink` in skills.ts).
-      ".agents/skills/pinsay-init/",
-      ".agents/skills/pinsay-feedback/",
-      // Legacy pre-2026-09-16 layout. `installSkills` removes these on every install, but a repo that
-      // has not run init/update since still has them on disk until it does — keep ignoring them too.
-      ".agents/pinsay-init/",
-      ".agents/pinsay-feedback/",
-      ".cursor/rules/pinsay-init.md",
-      ".cursor/rules/pinsay-feedback.md",
-      ".windsurf/rules/pinsay-init.md",
-      ".windsurf/rules/pinsay-feedback.md"
-    ];
     LEGACY_REPO_FILES = [".pinsay/credentials.env.example", ".pinsay/.token_cache"];
   }
 });
@@ -258,10 +199,10 @@ var init_api = __esm({
 });
 
 // src/credentials.ts
-import { promises as fs10 } from "node:fs";
+import { promises as fs12 } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
-import { join as join10, dirname as dirname4 } from "node:path";
+import { join as join11, dirname as dirname5 } from "node:path";
 function sourceLabel(source) {
   if (source === "env")
     return "env var";
@@ -278,43 +219,88 @@ function normalizeServerOrigin(server) {
     return server.replace(/\/+$/, "");
   }
 }
+function configBase() {
+  if (process.platform === "win32") {
+    return process.env.APPDATA || join11(homedir(), "AppData", "Roaming");
+  }
+  return process.env.XDG_CONFIG_HOME || join11(homedir(), ".config");
+}
 function globalConfigDir() {
   if (process.env.PINSAY_CONFIG_DIR)
     return process.env.PINSAY_CONFIG_DIR;
-  if (process.platform === "win32") {
-    return join10(process.env.APPDATA || join10(homedir(), "AppData", "Roaming"), "pointer");
-  }
-  return join10(process.env.XDG_CONFIG_HOME || join10(homedir(), ".config"), "pointer");
+  return join11(configBase(), DIR_NAME);
 }
 function globalCredentialsPath() {
-  return join10(globalConfigDir(), "credentials.json");
+  return join11(globalConfigDir(), "credentials.json");
+}
+function legacyGlobalCredentialsPath() {
+  if (process.env.PINSAY_CONFIG_DIR)
+    return void 0;
+  return join11(configBase(), LEGACY_DIR_NAME, "credentials.json");
 }
 function globalCacheDir() {
   if (process.env.PINSAY_CONFIG_DIR)
-    return join10(process.env.PINSAY_CONFIG_DIR, "cache");
+    return join11(process.env.PINSAY_CONFIG_DIR, "cache");
   if (process.platform === "win32") {
-    return join10(process.env.LOCALAPPDATA || join10(homedir(), "AppData", "Local"), "pointer", "cache");
+    return join11(process.env.LOCALAPPDATA || join11(homedir(), "AppData", "Local"), DIR_NAME, "cache");
   }
-  return join10(process.env.XDG_CACHE_HOME || join10(homedir(), ".cache"), "pointer");
+  return join11(process.env.XDG_CACHE_HOME || join11(homedir(), ".cache"), DIR_NAME);
 }
 function tokenCacheFile(server, apiKey) {
   const hash = createHash("sha256").update(`${normalizeServerOrigin(server)}:${apiKey}`).digest("hex").slice(0, 32);
-  return join10(globalCacheDir(), `${hash}.json`);
+  return join11(globalCacheDir(), `${hash}.json`);
+}
+function isCredentialStore(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  return Object.values(value).every(
+    (entry) => !!entry && typeof entry === "object" && typeof entry.apiKey === "string"
+  );
 }
 async function readGlobalStore() {
+  let raw;
+  try {
+    raw = await fs12.readFile(globalCredentialsPath(), "utf8");
+  } catch (err) {
+    if (err?.code === "ENOENT")
+      return migrateLegacyStore();
+    return {};
+  }
   try {
-    const raw = await fs10.readFile(globalCredentialsPath(), "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
   }
 }
+async function migrateLegacyStore() {
+  const legacyFile = legacyGlobalCredentialsPath();
+  if (!legacyFile)
+    return {};
+  let legacy;
+  try {
+    legacy = JSON.parse(await fs12.readFile(legacyFile, "utf8"));
+  } catch {
+    return {};
+  }
+  if (!isCredentialStore(legacy))
+    return {};
+  try {
+    await writeGlobalStore(legacy);
+  } catch {
+    return legacy;
+  }
+  await fs12.rm(legacyFile, { force: true }).catch(() => {
+  });
+  await fs12.rmdir(dirname5(legacyFile)).catch(() => {
+  });
+  return legacy;
+}
 async function writeGlobalStore(store) {
   const file = globalCredentialsPath();
-  await fs10.mkdir(dirname4(file), { recursive: true });
-  await fs10.writeFile(file, JSON.stringify(store, null, 2) + "\n", { encoding: "utf8", mode: 384 });
-  await fs10.chmod(file, 384).catch(() => {
+  await fs12.mkdir(dirname5(file), { recursive: true });
+  await fs12.writeFile(file, JSON.stringify(store, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  await fs12.chmod(file, 384).catch(() => {
   });
 }
 async function getGlobalCredential(server) {
@@ -332,15 +318,18 @@ async function saveGlobalCredential(server, entry) {
 async function removeGlobalCredential(server) {
   const store = await readGlobalStore();
   const origin = normalizeServerOrigin(server);
-  if (!(origin in store))
+  const origins = origin === "https://app.pinsay.dev" ? [origin, "https://api.pinsay.dev"] : [origin];
+  const present = origins.filter((o) => o in store);
+  if (present.length === 0)
     return false;
-  delete store[origin];
+  for (const o of present)
+    delete store[o];
   await writeGlobalStore(store);
   return true;
 }
 async function readRepoApiKey(root) {
   try {
-    const raw = await fs10.readFile(join10(root, ".pinsay", "credentials.env"), "utf8");
+    const raw = await fs12.readFile(join11(root, ".pinsay", "credentials.env"), "utf8");
     return raw.match(/^PINSAY_API_KEY=(.*)$/m)?.[1]?.trim() || void 0;
   } catch {
     return void 0;
@@ -361,12 +350,42 @@ async function resolveApiKey(root, server) {
   return { key: void 0, source: null };
 }
 async function removeStaleRepoTokenCache(root) {
-  await fs10.rm(join10(root, ".pinsay", ".token_cache"), { force: true }).catch(() => {
+  await fs12.rm(join11(root, ".pinsay", ".token_cache"), { force: true }).catch(() => {
   });
 }
+var DIR_NAME, LEGACY_DIR_NAME;
 var init_credentials = __esm({
   "src/credentials.ts"() {
     "use strict";
+    DIR_NAME = "pinsay";
+    LEGACY_DIR_NAME = "pointer";
+  }
+});
+
+// src/server.ts
+function resolveServer() {
+  const override = process.env.PINSAY_SERVER?.trim();
+  return canonicalServer(override || BUILD_DEFAULT_SERVER).replace(/\/+$/, "");
+}
+async function serverSettingError(cwd2, parsed) {
+  const server = resolveServer();
+  if (parsed["server"] !== void 0) {
+    return `--server was removed: this CLI talks only to ${server}.`;
+  }
+  const root = await findRepoRoot(cwd2);
+  const config = await readConfig(root).catch(() => ({}));
+  if (config.server && normalizeServerOrigin(config.server) !== normalizeServerOrigin(server)) {
+    return `.pinsay/config.json sets "server": "${config.server}", but this CLI talks only to ${server}.
+Remove the "server" line from .pinsay/config.json, then run the command again.`;
+  }
+  return null;
+}
+var init_server = __esm({
+  "src/server.ts"() {
+    "use strict";
+    init_build_constants();
+    init_config();
+    init_credentials();
   }
 });
 
@@ -562,8 +581,8 @@ __export(map_exports, {
   isSameManifest: () => isSameManifest,
   mapCommand: () => mapCommand
 });
-import { promises as fs14 } from "node:fs";
-import { join as join14, relative as relative4, resolve as resolve3 } from "node:path";
+import { promises as fs16 } from "node:fs";
+import { join as join15, relative as relative6, resolve as resolve7 } from "node:path";
 import { execFileSync } from "node:child_process";
 function gitRoot(cwd2) {
   try {
@@ -575,7 +594,7 @@ function gitRoot(cwd2) {
 async function walk(dir, out = []) {
   let entries;
   try {
-    entries = await fs14.readdir(dir, { withFileTypes: true });
+    entries = await fs16.readdir(dir, { withFileTypes: true });
   } catch {
     return out;
   }
@@ -584,7 +603,7 @@ async function walk(dir, out = []) {
       if (SKIP_DIRS.has(entry.name))
         continue;
     }
-    const full = join14(dir, entry.name);
+    const full = join15(dir, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRS.has(entry.name))
         continue;
@@ -636,10 +655,10 @@ async function buildManifest(cwd2, opts = {}) {
   let scanned = 0;
   let failed = 0;
   for (const file of files) {
-    const relPath = toPosix(relative4(root, file));
+    const relPath = toPosix(relative6(root, file));
     let code;
     try {
-      code = await fs14.readFile(file, "utf8");
+      code = await fs16.readFile(file, "utf8");
     } catch {
       continue;
     }
@@ -655,25 +674,25 @@ async function buildManifest(cwd2, opts = {}) {
         console.error(`  skipped ${relPath}: ${err?.message ?? err}`);
     }
   }
-  const target = resolve3(root, ".pinsay/manifest.json");
-  await fs14.mkdir(join14(root, ".pinsay"), { recursive: true });
+  const target = resolve7(root, ".pinsay/manifest.json");
+  await fs16.mkdir(join15(root, ".pinsay"), { recursive: true });
   const entries = Object.fromEntries(
     Object.entries(manifest).sort(([a], [b]) => a.localeCompare(b)).map(([hash, entry]) => [hash, { path: entry.path, component: entry.export }])
   );
   const nextContent = JSON.stringify({ version: 1, entries }, null, 2) + "\n";
   let currentContent = null;
   try {
-    currentContent = await fs14.readFile(target, "utf8");
+    currentContent = await fs16.readFile(target, "utf8");
   } catch {
     currentContent = null;
   }
   const prev = target.replace(/\.json$/, ".prev.json");
   if (currentContent !== null && !isSameManifest(currentContent, nextContent)) {
-    await fs14.copyFile(target, prev);
+    await fs16.copyFile(target, prev);
   }
   const tmp = `${target}.tmp`;
-  await fs14.writeFile(tmp, nextContent, "utf8");
-  await fs14.rename(tmp, target);
+  await fs16.writeFile(tmp, nextContent, "utf8");
+  await fs16.rename(tmp, target);
   const count = Object.keys(entries).length;
   if (!opts.quiet) {
     console.log(
@@ -705,7 +724,7 @@ var init_map = __esm({
 });
 
 // src/auth.ts
-import { promises as fs18 } from "node:fs";
+import { promises as fs20 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
 async function readApiKey(cwd2, server) {
   const { key } = await resolveApiKey(cwd2, server);
@@ -730,7 +749,7 @@ async function resolveToken(server, cwd2, explicitApiKey) {
     return void 0;
   const cacheFile = tokenCacheFile(server, apiKey);
   try {
-    const cached = JSON.parse(await fs18.readFile(cacheFile, "utf8"));
+    const cached = JSON.parse(await fs20.readFile(cacheFile, "utf8"));
     const token = typeof cached?.token === "string" ? cached.token.trim() : "";
     if (token && !isJwtExpired(token))
       return token;
@@ -747,8 +766,8 @@ async function resolveToken(server, cwd2, explicitApiKey) {
     );
     if (login?.token) {
       try {
-        await fs18.mkdir(dirname8(cacheFile), { recursive: true });
-        await fs18.writeFile(cacheFile, JSON.stringify({ token: login.token }), "utf8");
+        await fs20.mkdir(dirname8(cacheFile), { recursive: true });
+        await fs20.writeFile(cacheFile, JSON.stringify({ token: login.token }), "utf8");
       } catch {
       }
       return login.token;
@@ -931,11 +950,7 @@ function mapEnvironmentToString(env) {
 async function getClient(cwd2, parsed, opts = {}) {
   const root = await findRepoRoot(cwd2);
   const config = await readConfig(root);
-  const server = ((typeof parsed["server"] === "string" ? parsed["server"] : config.server) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
-  if (!server) {
-    console.error("No server configured.");
-    process.exit(2);
-  }
+  const server = resolveServer();
   const explicitKey = typeof parsed["key"] === "string" ? parsed["key"] : void 0;
   const token = await resolveToken(server, root, explicitKey);
   const apiKey = explicitKey || await readApiKey(root, server);
@@ -1145,8 +1160,8 @@ var init_comments = __esm({
     init_resolve();
     init_api();
     init_auth();
-    init_build_constants();
     init_projection();
+    init_server();
   }
 });
 
@@ -1261,7 +1276,7 @@ function assertInteractive() {
   if (process.stdin.isTTY)
     return;
   console.error(
-    "\x1B[31mThis command is interactive, but stdin is not a terminal.\x1B[0m\nPiped input, CI, and some editor-embedded shells have no TTY, so there is no way to ask you anything.\n\nEither run it in a real terminal, or pass every answer as a flag:\n  npx -y pinsay-cli init --server <url> --key ptr_... --project <key> --environment local --yes\n\nRun 'npx -y pinsay-cli init --help' for the full list of flags."
+    "\x1B[31mThis command is interactive, but stdin is not a terminal.\x1B[0m\nPiped input, CI, and some editor-embedded shells have no TTY, so there is no way to ask you anything.\n\nEither run it in a real terminal, or pass every answer as a flag:\n  npx -y pinsay-cli init --key ptr_... --project <key> --yes\n\nRun 'npx -y pinsay-cli init --help' for the full list of flags."
   );
   process.exit(2);
 }
@@ -1354,7 +1369,7 @@ async function menu(question, items, cursorStart, opts) {
   process.stdin.resume();
   render(true);
   try {
-    return await new Promise((resolve5) => {
+    return await new Promise((resolve9) => {
       const onKey = (_str, key) => {
         if (key.ctrl && key.name === "c") {
           cleanup();
@@ -1381,7 +1396,7 @@ async function menu(question, items, cursorStart, opts) {
             selected.add(cursor);
           }
           cleanup();
-          resolve5(opts.multi ? [...selected].sort((a, b) => a - b) : [cursor]);
+          resolve9(opts.multi ? [...selected].sort((a, b) => a - b) : [cursor]);
         }
       };
       const cleanup = () => {
@@ -1863,10 +1878,10 @@ ${indent}${call},` + rest.replace(/^\s*\n/, "\n") : next.slice(0, at) + `${call}
   const envPath = join6(cwd2, envName);
   const envBefore = await fs6.readFile(envPath, "utf8").catch(() => "");
   if (!/^VITE_PINSAY_SOURCE=/m.test(envBefore)) {
-    const sep3 = envBefore && !envBefore.endsWith("\n") ? "\n" : "";
+    const sep6 = envBefore && !envBefore.endsWith("\n") ? "\n" : "";
     await fs6.writeFile(
       envPath,
-      `${envBefore}${sep3}# Stamps component source hashes for PinSay. Development only.
+      `${envBefore}${sep6}# Stamps component source hashes for PinSay. Development only.
 VITE_PINSAY_SOURCE=true
 `,
       "utf8"
@@ -1887,34 +1902,317 @@ async function firstExisting2(cwd2, names) {
 }
 
 // src/skills.ts
+import { promises as fs8 } from "node:fs";
+import { join as join8, posix, relative as relative3, resolve as resolve3, sep as sep3, isAbsolute as isAbsolute2 } from "node:path";
+
+// src/lib/repo-paths.ts
 import { promises as fs7 } from "node:fs";
-import { join as join7, dirname as dirname2 } from "node:path";
-async function fetchText(url) {
-  const res = await fetch(url);
-  if (!res.ok)
-    throw new Error(`Failed to fetch ${url}: ${res.status}`);
-  return res.text();
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { dirname as dirname2, isAbsolute, join as join7, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+var execFileAsync = promisify(execFile);
+var RepoPathError = class extends Error {
+  kind;
+  /** Repo-relative path of what is in the way, always with `/`. */
+  blocker;
+  /** What the user should do, as commands that work in PowerShell, cmd and POSIX shells. */
+  hint;
+  constructor(kind, blocker, message, hint) {
+    super(message);
+    this.name = "RepoPathError";
+    this.kind = kind;
+    this.blocker = blocker;
+    this.hint = hint;
+  }
+};
+var MAX_HOPS = 8;
+var STUB_MAX_BYTES = 1024;
+var THEN_UPDATE = 'Then run "npx pinsay-cli update".';
+function toSlash(p) {
+  return p.split(sep2).join("/");
+}
+function segmentsBelow(base, p) {
+  const rel = relative2(base, p);
+  if (rel === "")
+    return [];
+  if (rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute(rel))
+    return null;
+  return rel.split(sep2).filter(Boolean);
+}
+async function rootForms(root) {
+  const abs = resolve2(root);
+  const real = await fs7.realpath(abs).catch(() => abs);
+  return real === abs ? [abs] : [abs, real];
 }
-async function download(url, dest, chmod = false) {
-  const txt = await fetchText(url);
-  await fs7.mkdir(dirname2(dest), { recursive: true });
-  await fs7.writeFile(dest, txt, "utf8");
-  if (chmod) {
-    await fs7.chmod(dest, 493).catch(() => {
+function segmentsInRepo(roots, target) {
+  for (const r of roots) {
+    const s = segmentsBelow(r, target);
+    if (s !== null)
+      return s;
+  }
+  return null;
+}
+function samePath(a, b) {
+  const x = resolve2(a);
+  const y = resolve2(b);
+  return process.platform === "win32" ? x.toLowerCase() === y.toLowerCase() : x === y;
+}
+async function realOr(p) {
+  return fs7.realpath(p).catch(() => resolve2(p));
+}
+async function isGitSymlink(rootAbs, abs) {
+  try {
+    const { stdout } = await execFileAsync("git", ["ls-files", "-s", "--", toSlash(relative2(rootAbs, abs))], {
+      cwd: rootAbs,
+      windowsHide: true
     });
+    return stdout.startsWith("120000 ");
+  } catch {
+    return false;
+  }
+}
+async function linkStubTarget(rootAbs, abs) {
+  let st;
+  try {
+    st = await fs7.lstat(abs);
+  } catch {
+    return null;
+  }
+  if (!st.isFile() || st.size === 0 || st.size > STUB_MAX_BYTES)
+    return null;
+  const text = (await fs7.readFile(abs, "utf8")).replace(/\r?\n$/, "");
+  if (text === "" || /[\r\n\0]/.test(text))
+    return null;
+  const target = resolve2(dirname2(abs), text.replace(/\\/g, "/"));
+  if (await isGitSymlink(rootAbs, abs))
+    return target;
+  try {
+    if ((await fs7.stat(target)).isDirectory())
+      return target;
+  } catch {
+  }
+  return null;
+}
+function fileInTheWay(blocker, what) {
+  return new RepoPathError(
+    "file-in-the-way",
+    blocker,
+    `${blocker} ${what}, not a folder, so the skills can't go inside it. PinSay left it unchanged.`,
+    `If ${blocker} is a Git symlink checked out as a plain file (Windows without symlink support): turn on Developer Mode, then run "git config core.symlinks true" and "git checkout -- ${blocker}". Otherwise move it away. ${THEN_UPDATE}`
+  );
+}
+function outsideRepo(blocker, target) {
+  return new RepoPathError(
+    "link-outside-repo",
+    blocker,
+    `${blocker} points to ${target}, outside this repository. PinSay only writes inside the repository and left it unchanged.`,
+    `Fix or remove the link, or choose another folder with "npx pinsay-cli init --skills-dir <folder>". ${THEN_UPDATE}`
+  );
+}
+function linkLoop(blocker) {
+  return new RepoPathError(
+    "link-loop",
+    blocker,
+    `${blocker} starts a chain of links PinSay could not follow (more than ${MAX_HOPS} links, or a loop). PinSay left it unchanged.`,
+    `Fix the links. ${THEN_UPDATE}`
+  );
+}
+function dirInTheWay(blocker) {
+  return new RepoPathError(
+    "directory-in-the-way",
+    blocker,
+    `${blocker} is a folder where PinSay writes a file. PinSay left it unchanged.`,
+    `Move the folder away. ${THEN_UPDATE}`
+  );
+}
+function ioError(blocker, err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return new RepoPathError(
+    "io-error",
+    blocker,
+    `could not write ${blocker} (${msg}).`,
+    `Check the folder's permissions, or close programs that lock it. ${THEN_UPDATE}`
+  );
+}
+async function resolveRepoPath(root, rel, opts) {
+  const roots = await rootForms(root);
+  const rootAbs = roots[0];
+  const naive = resolve2(rootAbs, rel.replace(/\\/g, "/"));
+  const below = segmentsBelow(rootAbs, naive);
+  if (below === null || below.length === 0) {
+    if (opts.create)
+      await fs7.mkdir(dirname2(naive), { recursive: true });
+    return { abs: naive };
+  }
+  let segments = below;
+  const fileName = segments.pop();
+  const shown = (p) => toSlash(relative2(rootAbs, p)) || ".";
+  let cur = rootAbs;
+  let i = 0;
+  let hops = 0;
+  let redirectedVia;
+  while (i < segments.length) {
+    const next = join7(cur, segments[i]);
+    let st;
+    try {
+      st = await fs7.lstat(next);
+    } catch (err) {
+      if (err?.code !== "ENOENT")
+        throw ioError(shown(next), err);
+      if (!opts.create)
+        return { abs: join7(next, ...segments.slice(i + 1), fileName), redirectedVia };
+      try {
+        await fs7.mkdir(next);
+      } catch (e) {
+        if (e?.code !== "EEXIST")
+          throw ioError(shown(next), e);
+      }
+      continue;
+    }
+    if (st.isDirectory()) {
+      cur = next;
+      i++;
+      continue;
+    }
+    let target;
+    if (st.isSymbolicLink()) {
+      const live = await fs7.stat(next).catch(() => null);
+      if (live?.isDirectory()) {
+        cur = next;
+        i++;
+        continue;
+      }
+      if (live)
+        throw fileInTheWay(shown(next), "points to a file");
+      let raw;
+      try {
+        raw = await fs7.readlink(next);
+      } catch (e) {
+        throw ioError(shown(next), e);
+      }
+      target = resolve2(dirname2(next), raw);
+    } else if (st.isFile()) {
+      const stub = await linkStubTarget(rootAbs, next);
+      if (stub === null)
+        throw fileInTheWay(shown(next), "is a file");
+      target = stub;
+    } else {
+      throw fileInTheWay(shown(next), "is not a folder");
+    }
+    const targetSegments = segmentsInRepo(roots, target);
+    if (targetSegments === null)
+      throw outsideRepo(shown(next), target);
+    hops++;
+    if (hops > MAX_HOPS)
+      throw linkLoop(redirectedVia ?? shown(next));
+    redirectedVia ??= shown(next);
+    segments = [...targetSegments, ...segments.slice(i + 1)];
+    cur = rootAbs;
+    i = 0;
+  }
+  return { abs: join7(cur, fileName), redirectedVia };
+}
+async function writeRepoFile(root, rel, content) {
+  const r = await resolveRepoPath(root, rel, { create: true });
+  const shown = toSlash(relative2(resolve2(root), r.abs));
+  const st = await fs7.lstat(r.abs).catch(() => null);
+  if (st?.isDirectory())
+    throw dirInTheWay(shown);
+  try {
+    if (st?.isSymbolicLink() && !await fs7.stat(r.abs).catch(() => null))
+      await fs7.unlink(r.abs);
+    await fs7.writeFile(r.abs, content, "utf8");
+  } catch (err) {
+    throw ioError(shown, err);
   }
+  return r;
 }
-async function makeSymlink(target, path) {
-  await fs7.mkdir(dirname2(path), { recursive: true });
+async function linkOrCopy(root, sourceAbs, destRel) {
+  const dest = await resolveRepoPath(root, destRel, { create: true });
+  const shown = toSlash(relative2(resolve2(root), dest.abs));
+  const sourceReal = await realOr(sourceAbs);
+  const st = await fs7.lstat(dest.abs).catch(() => null);
+  if (st && samePath(await realOr(dest.abs), sourceReal) && !st.isSymbolicLink()) {
+    return { abs: dest.abs, mode: "same" };
+  }
+  if (st?.isDirectory())
+    throw dirInTheWay(shown);
   try {
-    await fs7.symlink(target, path);
+    if (st?.isSymbolicLink()) {
+      const real = await fs7.realpath(dest.abs).catch(() => null);
+      if (real !== null && samePath(real, sourceReal))
+        return { abs: dest.abs, mode: "link" };
+      await fs7.unlink(dest.abs);
+    } else if (st) {
+      await fs7.unlink(dest.abs);
+    }
   } catch (err) {
-    if (err.code === "EPERM" && process.platform === "win32") {
-      await fs7.copyFile(target, path);
-    } else if (err.code !== "EEXIST") {
-      throw err;
+    throw ioError(shown, err);
+  }
+  try {
+    await fs7.symlink(relative2(dirname2(dest.abs), sourceAbs), dest.abs, "file");
+    return { abs: dest.abs, mode: "link" };
+  } catch {
+    try {
+      await fs7.copyFile(sourceAbs, dest.abs);
+    } catch (err) {
+      throw ioError(shown, err);
     }
+    return { abs: dest.abs, mode: "copy" };
+  }
+}
+
+// src/skills.ts
+var DownloadError = class extends Error {
+  reason;
+  constructor(url, reason) {
+    super(`Failed to fetch ${url}: ${reason}`);
+    this.name = "DownloadError";
+    this.reason = reason;
+  }
+};
+async function fetchText(url) {
+  let res;
+  try {
+    res = await fetch(url);
+  } catch (err) {
+    throw new DownloadError(url, err?.message ?? String(err));
+  }
+  if (!res.ok)
+    throw new DownloadError(url, `HTTP ${res.status}`);
+  return res.text();
+}
+function toWarning(tool, path, server, err) {
+  if (err instanceof RepoPathError)
+    return { tool, path, message: err.message, hint: err.hint };
+  if (err instanceof DownloadError) {
+    return {
+      tool,
+      path,
+      message: `could not download the skill files from ${server} (${err.reason}).`,
+      hint: 'Check your connection. Then run "npx pinsay-cli update".'
+    };
   }
+  const msg = err instanceof Error ? err.message : String(err);
+  return { tool, path, message: `could not install it (${msg}).`, hint: 'Run "npx pinsay-cli update" to try again.' };
+}
+function formatSkillWarnings(warnings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const w of warnings) {
+    const key = `${w.tool}\0${w.message}\0${w.hint}`;
+    const g = groups.get(key);
+    if (g)
+      g.paths.push(w.path);
+    else
+      groups.set(key, { w, paths: [w.path] });
+  }
+  const lines = [];
+  for (const { w, paths } of groups.values()) {
+    lines.push(`\u26A0 Skills for ${w.tool}: ${w.message}`);
+    lines.push(`  Not installed: ${paths.join(", ")}`);
+    lines.push(`  Fix: ${w.hint}`);
+  }
+  return lines;
 }
 var SUB_SKILLS = ["apply", "translate", "advanced"];
 var SUB_SKILL_TITLES = {
@@ -1963,57 +2261,231 @@ ${text.trim()}`
 }
 async function removeLegacyAgentsLayout(cwd2) {
   for (const name of ["pinsay-init", "pinsay-feedback"]) {
-    const filePath = join7(cwd2, ".agents", name, "SKILL.md");
-    const dirPath = join7(cwd2, ".agents", name);
+    const filePath = join8(cwd2, ".agents", name, "SKILL.md");
+    const dirPath = join8(cwd2, ".agents", name);
     try {
-      await fs7.rm(filePath, { force: true });
+      await fs8.rm(filePath, { force: true });
     } catch {
     }
     try {
-      const remaining = await fs7.readdir(dirPath);
+      const remaining = await fs8.readdir(dirPath);
       if (remaining.length === 0)
-        await fs7.rmdir(dirPath);
+        await fs8.rmdir(dirPath);
     } catch {
     }
   }
 }
 async function installSkills(server, aiTool, cwd2, overrideDir) {
   const files = [];
+  const warnings = [];
+  const hide = [];
   server = server.replace(/\/$/, "");
-  await removeLegacyAgentsLayout(cwd2);
-  const pinsayShPath = join7(cwd2, ".pinsay", "pinsay.sh");
-  await download(`${server}/pinsay.sh`, pinsayShPath, true);
-  files.push(".pinsay/pinsay.sh");
+  const landed = (abs, folder) => {
+    const rel = relative3(resolve3(cwd2), abs).split(sep3).join("/");
+    if (rel === "" || rel.startsWith("../") || isAbsolute2(rel))
+      return;
+    hide.push(folder ? `${posix.dirname(rel)}/` : rel);
+  };
+  const step = async (rel, work) => {
+    try {
+      await work();
+    } catch (err) {
+      warnings.push(toWarning(aiTool, rel, server, err));
+    }
+  };
+  await removeLegacyAgentsLayout(cwd2).catch(() => {
+  });
+  await step(".pinsay/pinsay.sh", async () => {
+    const { abs } = await writeRepoFile(cwd2, ".pinsay/pinsay.sh", await fetchText(`${server}/pinsay.sh`));
+    await fs8.chmod(abs, 493).catch(() => {
+    });
+    files.push(".pinsay/pinsay.sh");
+  });
   const isFlatFileTool = !overrideDir && (aiTool === "cursor" || aiTool === "windsurf");
+  const overrideSlash = overrideDir ? overrideDir.replace(/\\/g, "/") : void 0;
   async function writeOrLink(primaryPath, skillName) {
     const url = skillName === "pinsay-init" ? `${server}/pinsay-init.md` : `${server}/skill.md`;
-    const finalPath = overrideDir ? join7(cwd2, overrideDir, skillName, "SKILL.md") : join7(cwd2, primaryPath);
-    if (skillName === "pinsay-feedback" && isFlatFileTool) {
-      const combined = await buildFlatPinSayFeedback(server);
-      await fs7.mkdir(dirname2(finalPath), { recursive: true });
-      await fs7.writeFile(finalPath, combined, "utf8");
-    } else {
-      await download(url, finalPath);
-    }
-    files.push(overrideDir ? join7(overrideDir, skillName, "SKILL.md") : primaryPath);
+    const rel = overrideSlash ? posix.join(overrideSlash, skillName, "SKILL.md") : primaryPath;
+    let primaryAbs = null;
+    await step(rel, async () => {
+      const body = skillName === "pinsay-feedback" && isFlatFileTool ? await buildFlatPinSayFeedback(server) : await fetchText(url);
+      primaryAbs = (await writeRepoFile(cwd2, rel, body)).abs;
+      landed(primaryAbs, !isFlatFileTool);
+      files.push(rel);
+    });
+    if (primaryAbs === null)
+      return;
+    const source = primaryAbs;
     if (!overrideDir && (aiTool === "claude-code" || aiTool === "cursor" || aiTool === "windsurf")) {
-      const symDest = join7(cwd2, ".agents", "skills", skillName, "SKILL.md");
-      await makeSymlink(join7("..", "..", "..", primaryPath), symDest);
-      files.push(`.agents/skills/${skillName}/SKILL.md`);
+      const mirrorRel = `.agents/skills/${skillName}/SKILL.md`;
+      await step(mirrorRel, async () => {
+        const m = await linkOrCopy(cwd2, source, mirrorRel);
+        landed(m.abs, true);
+        files.push(mirrorRel);
+      });
     }
     if (skillName === "pinsay-feedback" && !isFlatFileTool) {
-      const siblingDir = dirname2(finalPath);
-      const relDir = overrideDir ? join7(overrideDir, skillName) : dirname2(primaryPath);
+      const relDir = posix.dirname(rel);
       for (const name of SUB_SKILLS) {
-        await download(`${server}/skills/${name}.md`, join7(siblingDir, `${name}.md`));
-        files.push(join7(relDir, `${name}.md`));
+        const subRel = posix.join(relDir, `${name}.md`);
+        await step(subRel, async () => {
+          await writeRepoFile(cwd2, subRel, await fetchText(`${server}/skills/${name}.md`));
+          files.push(subRel);
+        });
       }
     }
   }
   const layout = SKILL_FILES[aiTool] ?? SKILL_FILES.other;
   await writeOrLink(layout[0], "pinsay-init");
   await writeOrLink(layout[1], "pinsay-feedback");
-  return files;
+  return { files, warnings, hide: [...new Set(hide)] };
+}
+
+// src/lib/git-exclude.ts
+import { promises as fs9 } from "node:fs";
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+import { dirname as dirname3, join as join9, resolve as resolve4 } from "node:path";
+var execFileAsync2 = promisify2(execFile2);
+var EXCLUDE_BEGIN = "# pinsay-cli: begin (managed by pinsay-cli; rewritten by init/update)";
+var EXCLUDE_END = "# pinsay-cli: end";
+var TEAM_FILES = [];
+var TEAM_FILE_PATHS = [".pinsay/config.json", ".pinsay/stack.json", ".pinsay/projects/"];
+var PINSAY_SKILL_PATHS = [
+  ".claude/skills/pinsay-init/",
+  ".claude/skills/pinsay-feedback/",
+  ".agents/skills/pinsay-init/",
+  ".agents/skills/pinsay-feedback/",
+  // Legacy pre-2026-09-16 layout; installSkills removes it, older clones may still have it.
+  ".agents/pinsay-init/",
+  ".agents/pinsay-feedback/",
+  ".cursor/rules/pinsay-init.md",
+  ".cursor/rules/pinsay-feedback.md",
+  ".windsurf/rules/pinsay-init.md",
+  ".windsurf/rules/pinsay-feedback.md"
+];
+function literal(p) {
+  return p.replace(/([\\*?[\]!#])/g, "\\$1");
+}
+async function gitInfo(cwd2) {
+  try {
+    const { stdout } = await execFileAsync2("git", ["rev-parse", "--git-path", "info/exclude", "--show-prefix"], {
+      cwd: cwd2,
+      windowsHide: true
+    });
+    const [path, prefix = ""] = stdout.split(/\r?\n/);
+    if (!path)
+      return null;
+    return { excludeFile: resolve4(cwd2, path.trim()), prefix: prefix.trim() };
+  } catch {
+    return null;
+  }
+}
+function cleanExtra(extra) {
+  return extra.map((e) => e.replace(/\\/g, "/").replace(/^\.\/+/, "")).filter((e) => e !== "" && !e.startsWith("../") && e !== ".." && !/^[A-Za-z]:\//.test(e) && !e.startsWith("/"));
+}
+function skillsDirExtra(dir) {
+  if (!dir)
+    return [];
+  const d = dir.replace(/\\/g, "/").replace(/\/+$/, "");
+  return [`${d}/pinsay-init/`, `${d}/pinsay-feedback/`];
+}
+function excludeLines(prefix, extra = []) {
+  const p = `/${literal(prefix)}`;
+  const pinsay = TEAM_FILES.length === 0 ? [`${p}.pinsay/`] : [`${p}.pinsay/*`, ...TEAM_FILES.map((f) => `!${p}.pinsay/${f}`)];
+  const lines = [
+    ...pinsay,
+    ...PINSAY_SKILL_PATHS.map((s) => `${p}${s}`),
+    ...cleanExtra(extra).map((e) => `${p}${literal(e)}`)
+  ];
+  return [...new Set(lines)];
+}
+function pinsayDirGitignore() {
+  const body = TEAM_FILES.length === 0 ? ["*"] : ["/*", ...TEAM_FILES.map((f) => `!/${f}`)];
+  return [
+    "# Written by pinsay-cli. Keeps PinSay's per-machine files (credentials, scripts, caches) out of git,",
+    "# even before this folder is in a git repository. It ignores itself too.",
+    ...body,
+    ""
+  ].join("\n");
+}
+async function writePinsayDirGitignore(cwd2) {
+  const file = join9(cwd2, ".pinsay", ".gitignore");
+  const want = pinsayDirGitignore();
+  const have = await fs9.readFile(file, "utf8").catch(() => null);
+  if (have === want)
+    return;
+  await fs9.mkdir(dirname3(file), { recursive: true });
+  await fs9.writeFile(file, want, "utf8");
+}
+async function trackedPinsayFiles(cwd2, extra = []) {
+  const specs = [".pinsay", ...PINSAY_SKILL_PATHS, ...cleanExtra(extra)].map((s) => s.replace(/\/$/, ""));
+  try {
+    const { stdout } = await execFileAsync2("git", ["ls-files", "-z", "--", ...specs], { cwd: cwd2, windowsHide: true });
+    return stdout.split("\0").filter(Boolean).filter((f) => !TEAM_FILE_PATHS.some((t) => t.endsWith("/") ? f.startsWith(t) : f === t)).sort();
+  } catch {
+    return [];
+  }
+}
+async function hidePinsayFiles(cwd2, extra = []) {
+  try {
+    await writePinsayDirGitignore(cwd2);
+  } catch {
+  }
+  const info = await gitInfo(cwd2);
+  if (!info)
+    return { status: "not-a-repo", tracked: [] };
+  let status = "unchanged";
+  let error;
+  try {
+    const content = await fs9.readFile(info.excludeFile, "utf8").catch(() => "");
+    const eol = content.includes("\r\n") ? "\r\n" : "\n";
+    const lines = content === "" ? [] : content.split(/\r?\n/);
+    const b = lines.findIndex((l) => l.startsWith("# pinsay-cli: begin"));
+    const e = b >= 0 ? lines.indexOf(EXCLUDE_END, b + 1) : -1;
+    const kept = b >= 0 && e > b ? lines.slice(b + 1, e).filter((l) => /\/pinsay-(init|feedback)(\/|\.md)$/.test(l) && !l.startsWith("!")) : [];
+    const block = [EXCLUDE_BEGIN, .../* @__PURE__ */ new Set([...excludeLines(info.prefix, extra), ...kept]), EXCLUDE_END];
+    let next;
+    if (b >= 0 && e > b) {
+      next = [...lines.slice(0, b), ...block, ...lines.slice(e + 1)];
+    } else {
+      const base = [...lines];
+      while (base.length > 0 && base[base.length - 1] === "")
+        base.pop();
+      next = [...base, ...base.length > 0 ? [""] : [], ...block];
+    }
+    while (next.length > 0 && next[next.length - 1] === "")
+      next.pop();
+    const out = next.join(eol) + eol;
+    if (out !== content) {
+      await fs9.mkdir(dirname3(info.excludeFile), { recursive: true });
+      await fs9.writeFile(info.excludeFile, out, "utf8");
+      status = "written";
+    }
+  } catch (err) {
+    status = "failed";
+    error = err instanceof Error ? err.message : String(err);
+  }
+  return { status, file: info.excludeFile, tracked: await trackedPinsayFiles(cwd2, extra), error };
+}
+function formatHideWarnings(r) {
+  const lines = [];
+  if (r.status === "failed") {
+    lines.push(`\u26A0 Could not update ${r.file ?? ".git/info/exclude"} (${r.error}), so PinSay's files may show in git status.`);
+    lines.push(`  Fix: check that file's permissions. Then run "npx pinsay-cli update".`);
+  }
+  if (r.tracked.length > 0) {
+    lines.push(`\u26A0 Git already tracks these PinSay files, so they can't be hidden: ${r.tracked.join(", ")}`);
+    lines.push(`  To stop tracking them (the files stay on disk), run: git rm -r --cached -- ${r.tracked.join(" ")}`);
+  }
+  return lines;
+}
+async function excludeBlockStatus(cwd2) {
+  const info = await gitInfo(cwd2);
+  if (!info)
+    return "not-a-repo";
+  const content = await fs9.readFile(info.excludeFile, "utf8").catch(() => "");
+  return content.includes(EXCLUDE_END) && /^# pinsay-cli: begin/m.test(content) ? "ok" : "missing";
 }
 
 // src/branding.ts
@@ -2054,17 +2526,17 @@ async function postEvent(server, token, payload) {
 // src/checks.ts
 init_config();
 init_api();
-import { promises as fs11 } from "node:fs";
-import { join as join11 } from "node:path";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import { promises as fs13 } from "node:fs";
+import { join as join12 } from "node:path";
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify3 } from "node:util";
 
 // src/lib/skill-stamp.ts
-import { promises as fs8 } from "node:fs";
+import { promises as fs10 } from "node:fs";
 async function readStamp(path) {
   let content;
   try {
-    content = await fs8.readFile(path, "utf8");
+    content = await fs10.readFile(path, "utf8");
   } catch {
     return null;
   }
@@ -2124,20 +2596,20 @@ async function readStamp(path) {
 }
 
 // src/lib/skill-paths.ts
-import { join as join8 } from "node:path";
 function skillFilesFor(config) {
   const layout = SKILL_FILES[config.aiTool ?? ""] ?? SKILL_FILES.other;
-  const skillPaths = config.skillsDir ? [
-    join8(config.skillsDir, "pinsay-init", "SKILL.md"),
-    join8(config.skillsDir, "pinsay-feedback", "SKILL.md"),
-    ...SUB_SKILLS.map((name) => join8(config.skillsDir, "pinsay-feedback", `${name}.md`))
+  const dir = config.skillsDir?.replace(/\\/g, "/").replace(/\/+$/, "");
+  const skillPaths = dir ? [
+    `${dir}/pinsay-init/SKILL.md`,
+    `${dir}/pinsay-feedback/SKILL.md`,
+    ...SUB_SKILLS.map((name) => `${dir}/pinsay-feedback/${name}.md`)
   ] : [...layout];
   return [...skillPaths, ".pinsay/pinsay.sh"];
 }
 
 // src/stack/stackfile.ts
-import { promises as fs9 } from "node:fs";
-import { join as join9, dirname as dirname3 } from "node:path";
+import { promises as fs11 } from "node:fs";
+import { join as join10, dirname as dirname4 } from "node:path";
 function buildRequestBody(stack) {
   const body = {};
   if (stack.frontend !== void 0)
@@ -2151,11 +2623,11 @@ function buildRequestBody(stack) {
   return body;
 }
 function stackFileRelPath(projectKey) {
-  return projectKey ? join9(".pinsay", "projects", `${projectKey}.stack.json`) : join9(".pinsay", "stack.json");
+  return projectKey ? join10(".pinsay", "projects", `${projectKey}.stack.json`) : join10(".pinsay", "stack.json");
 }
 async function readStackFile(cwd2, projectKey) {
   try {
-    const raw = await fs9.readFile(join9(cwd2, stackFileRelPath(projectKey)), "utf8");
+    const raw = await fs11.readFile(join10(cwd2, stackFileRelPath(projectKey)), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -2260,18 +2732,19 @@ function formatStackJson(stack) {
 }
 async function writeStackFile(cwd2, stack, projectKey) {
   const relPath = stackFileRelPath(projectKey);
-  const dir = join9(cwd2, dirname3(relPath));
-  await fs9.mkdir(dir, { recursive: true });
-  const targetPath = join9(cwd2, relPath);
-  const tempPath = join9(dir, `${projectKey ?? "stack"}.json.tmp.${Date.now()}.${Math.random().toString(36).slice(2)}`);
+  const dir = join10(cwd2, dirname4(relPath));
+  await fs11.mkdir(dir, { recursive: true });
+  const targetPath = join10(cwd2, relPath);
+  const tempPath = join10(dir, `${projectKey ?? "stack"}.json.tmp.${Date.now()}.${Math.random().toString(36).slice(2)}`);
   const content = formatStackJson(stack);
-  await fs9.writeFile(tempPath, content, "utf8");
-  await fs9.rename(tempPath, targetPath);
+  await fs11.writeFile(tempPath, content, "utf8");
+  await fs11.rename(tempPath, targetPath);
 }
 
 // src/checks.ts
 init_credentials();
-var execFileAsync = promisify(execFile);
+init_server();
+var execFileAsync3 = promisify3(execFile3);
 function tooOldMessage(cliVersion, min) {
   return `CLI ${cliVersion} is older than the server requires (${min}). Upgrade with: npx -y pinsay@latest`;
 }
@@ -2308,7 +2781,7 @@ async function fetchWithTimeout(url, ms, init) {
 async function runInitChecks(cwd2, overrides = {}, cliVersion = "0.0.0") {
   const checks = [];
   const config = await readConfig(cwd2);
-  const server = (overrides.server || config.server || "").replace(/\/$/, "");
+  const server = (overrides.server || resolveServer()).replace(/\/$/, "");
   const multiProject = isMultiProject(config);
   const allProjects = listProjects(config);
   const projectTargets = multiProject && overrides.project ? allProjects.filter((p) => p.key === overrides.project) : allProjects;
@@ -2416,7 +2889,7 @@ async function runInitChecks(cwd2, overrides = {}, cliVersion = "0.0.0") {
   }
   for (const target of multiProject ? projectTargets : [{ key: project, path: ".", environment, delivery: config.delivery }]) {
     const prefix = multiProject ? `[${target.key}] ` : "";
-    const appCwd = multiProject ? join11(cwd2, target.path) : cwd2;
+    const appCwd = multiProject ? join12(cwd2, target.path) : cwd2;
     if (token) {
       try {
         const projects = await api(server, "/api/admin/projects", { token });
@@ -2456,7 +2929,7 @@ async function runInitChecks(cwd2, overrides = {}, cliVersion = "0.0.0") {
       }
     }
     try {
-      await fs11.access(join11(cwd2, stackFileRelPath(multiProject ? target.key : void 0)));
+      await fs13.access(join12(cwd2, stackFileRelPath(multiProject ? target.key : void 0)));
       checks.push({ id: "stack", status: "ok", message: `${prefix}Stack registered` });
     } catch {
       checks.push({ id: "stack", status: "warn", message: `${prefix}Stack not registered`, fixable: true });
@@ -2478,9 +2951,9 @@ async function runInitChecks(cwd2, overrides = {}, cliVersion = "0.0.0") {
   if (meta?.skillVersion) {
     const stale = [];
     for (const rel of skillFilesFor(config)) {
-      const abs = join11(cwd2, rel);
+      const abs = join12(cwd2, rel);
       try {
-        await fs11.access(abs);
+        await fs13.access(abs);
       } catch {
         continue;
       }
@@ -2502,7 +2975,7 @@ async function runInitChecks(cwd2, overrides = {}, cliVersion = "0.0.0") {
 async function sourceMapCheck(cwd2, prefix = "") {
   const configured = await (async () => {
     for (const name of ["vite.config.ts", "vite.config.js", "vite.config.mjs", "vite.config.mts"]) {
-      const body = await fs11.readFile(join11(cwd2, name), "utf8").catch(() => "");
+      const body = await fs13.readFile(join12(cwd2, name), "utf8").catch(() => "");
       if (body.includes("pinsay/vite"))
         return true;
     }
@@ -2516,7 +2989,7 @@ async function sourceMapCheck(cwd2, prefix = "") {
     };
   }
   try {
-    const raw = await fs11.readFile(join11(cwd2, ".pinsay/manifest.json"), "utf8");
+    const raw = await fs13.readFile(join12(cwd2, ".pinsay/manifest.json"), "utf8");
     const count = Object.keys(JSON.parse(raw)?.entries ?? {}).length;
     return count > 0 ? { id: "source-map", status: "ok", message: `${prefix}Source manifest present (${count} components)` } : { id: "source-map", status: "warn", message: `${prefix}Source manifest is empty`, fixable: true };
   } catch {
@@ -2539,16 +3012,16 @@ async function widgetCheck(cwd2, config = {}, prefix = "") {
   const detection = await detectStack(cwd2).catch(() => null);
   const candidates = [config.htmlPath, detection?.htmlPath, "index.html", "public/index.html", "src/index.html"].filter(Boolean);
   try {
-    for (const entry of await fs11.readdir(cwd2, { withFileTypes: true })) {
+    for (const entry of await fs13.readdir(cwd2, { withFileTypes: true })) {
       if (entry.isDirectory() && !entry.name.startsWith(".")) {
-        candidates.push(join11(entry.name, "index.html"));
+        candidates.push(join12(entry.name, "index.html"));
       }
     }
   } catch {
   }
   for (const rel of candidates) {
     try {
-      const html = await fs11.readFile(join11(cwd2, rel), "utf8");
+      const html = await fs13.readFile(join12(cwd2, rel), "utf8");
       if (html.includes("<!-- pinsay-feedback:start -->") || html.includes("<pinsay-feedback")) {
         return { id: "widget", status: "ok", message: `${prefix}Widget found in ${rel}` };
       }
@@ -2557,7 +3030,7 @@ async function widgetCheck(cwd2, config = {}, prefix = "") {
   }
   for (const envFile of [".env", ".env.local", ".env.development"]) {
     try {
-      const env = await fs11.readFile(join11(cwd2, envFile), "utf8");
+      const env = await fs13.readFile(join12(cwd2, envFile), "utf8");
       if (/^VITE_PINSAY_PROJECT=/m.test(env)) {
         return { id: "widget", status: "ok", message: `${prefix}Widget env configured in ${envFile}` };
       }
@@ -2575,20 +3048,14 @@ async function skillsCheck(cwd2, config) {
   const tool = config.aiTool;
   if (!tool)
     return { id: "skills", status: "warn", message: "No AI tool configured" };
-  const expected = SKILL_FILES[tool] ?? SKILL_FILES.other;
   const missing = [];
-  for (const rel of expected) {
+  for (const rel of skillFilesFor(config)) {
     try {
-      await fs11.access(join11(cwd2, config.skillsDir ?? "", rel));
+      await fs13.access((await resolveRepoPath(cwd2, rel, { create: false })).abs);
     } catch {
       missing.push(rel);
     }
   }
-  try {
-    await fs11.access(join11(cwd2, ".pinsay/pinsay.sh"));
-  } catch {
-    missing.push(".pinsay/pinsay.sh");
-  }
   return missing.length === 0 ? { id: "skills", status: "ok", message: `Skills installed for ${tool}` } : {
     id: "skills",
     status: "warn",
@@ -2601,7 +3068,7 @@ async function gitignoreChecks(cwd2) {
   const results = [];
   let tracked = false;
   try {
-    await execFileAsync("git", ["ls-files", "--error-unmatch", ".pinsay/credentials.env"], { cwd: cwd2 });
+    await execFileAsync3("git", ["ls-files", "--error-unmatch", ".pinsay/credentials.env"], { cwd: cwd2 });
     tracked = true;
   } catch {
     tracked = false;
@@ -2615,24 +3082,33 @@ async function gitignoreChecks(cwd2) {
     });
     return results;
   }
-  try {
-    const ignore = await fs11.readFile(join11(cwd2, ".gitignore"), "utf8");
-    results.push(
-      ignore.includes(".pinsay/") ? { id: "gitignore", status: "ok", message: "Credentials ignored by git" } : { id: "gitignore", status: "warn", message: ".gitignore is missing the .pinsay/ entries", fixable: true }
-    );
-  } catch {
-    results.push({ id: "gitignore", status: "warn", message: "No .gitignore found", fixable: true });
+  const block = await excludeBlockStatus(cwd2);
+  if (block === "not-a-repo") {
+    results.push({ id: "gitignore", status: "ok", message: "Not a git repository \u2014 nothing to hide" });
+    return results;
+  }
+  const others = (await trackedPinsayFiles(cwd2)).filter((f) => f !== ".pinsay/credentials.env");
+  if (others.length > 0) {
+    results.push({
+      id: "gitignore",
+      status: "warn",
+      message: `Git tracks PinSay files that should be per-machine: ${others.join(", ")}`,
+      hint: `Run: git rm -r --cached -- ${others.join(" ")}`
+    });
   }
+  results.push(
+    block === "ok" ? { id: "gitignore", status: "ok", message: "PinSay files hidden from git (.git/info/exclude)" } : { id: "gitignore", status: "warn", message: "PinSay's files are not hidden from git yet", hint: "Run `npx pinsay-cli doctor --fix`", fixable: true }
+  );
   return results;
 }
 
 // src/commands/init.ts
-import { promises as fs13, existsSync as existsSync2 } from "node:fs";
-import { join as join13, dirname as dirname6, relative as relative3, resolve as resolve2, isAbsolute as isAbsolute2, sep as sep2 } from "node:path";
+import { promises as fs15, existsSync as existsSync2 } from "node:fs";
+import { join as join14, dirname as dirname7, relative as relative5, resolve as resolve6, isAbsolute as isAbsolute3, sep as sep5 } from "node:path";
 
 // src/stack/design.ts
-import { promises as fs12, statSync } from "node:fs";
-import { dirname as dirname5, join as join12, relative as relative2, resolve } from "node:path";
+import { promises as fs14, statSync } from "node:fs";
+import { dirname as dirname6, join as join13, relative as relative4, resolve as resolve5, sep as sep4 } from "node:path";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -2658,7 +3134,7 @@ async function collectFiles(cwd2, options) {
       return;
     let entries;
     try {
-      entries = await fs12.readdir(dir);
+      entries = await fs14.readdir(dir);
     } catch {
       return;
     }
@@ -2668,17 +3144,17 @@ async function collectFiles(cwd2, options) {
         return;
       if (IGNORED_DIRS.has(entry))
         continue;
-      const fullPath = join12(dir, entry);
+      const fullPath = join13(dir, entry);
       let stat;
       try {
-        stat = await fs12.stat(fullPath);
+        stat = await fs14.stat(fullPath);
       } catch {
         continue;
       }
       if (stat.isDirectory()) {
         subdirs.push(fullPath);
       } else if (stat.isFile()) {
-        collected.push(relative2(cwd2, fullPath));
+        collected.push(relative4(cwd2, fullPath).split(sep4).join("/"));
       }
     }
     for (const sub of subdirs) {
@@ -2777,15 +3253,15 @@ function parseArrayOrObjectKeys(content, matchIndex) {
   return [];
 }
 async function collectDependencyChain(cwd2, root, readFile) {
-  const cwdAbs = resolve(cwd2);
-  const rootAbs = resolve(root);
+  const cwdAbs = resolve5(cwd2);
+  const rootAbs = resolve5(root);
   const dirs = [];
   let dir = cwdAbs;
   while (true) {
     dirs.push(dir);
     if (dir === rootAbs)
       break;
-    const parent = dirname5(dir);
+    const parent = dirname6(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -2794,7 +3270,7 @@ async function collectDependencyChain(cwd2, root, readFile) {
   const merged = {};
   for (const d of dirs) {
     try {
-      const pkg = JSON.parse(await readFile(join12(d, "package.json")));
+      const pkg = JSON.parse(await readFile(join13(d, "package.json")));
       Object.assign(merged, pkg.dependencies, pkg.devDependencies);
     } catch {
     }
@@ -2821,7 +3297,7 @@ async function detectTailwind(cwd2, files, readFile, root = cwd2) {
     let exists = files.includes(name);
     if (!exists) {
       try {
-        await readFile(join12(cwd2, name));
+        await readFile(join13(cwd2, name));
         exists = true;
       } catch {
         exists = false;
@@ -2829,16 +3305,16 @@ async function detectTailwind(cwd2, files, readFile, root = cwd2) {
     }
     if (exists) {
       foundConfigFile = name;
-      configAbsPath = join12(cwd2, name);
+      configAbsPath = join13(cwd2, name);
       break;
     }
   }
-  if (!foundConfigFile && resolve(root) !== resolve(cwd2)) {
+  if (!foundConfigFile && resolve5(root) !== resolve5(cwd2)) {
     for (const name of configNames) {
-      const candidate = join12(root, name);
+      const candidate = join13(root, name);
       try {
         await readFile(candidate);
-        foundConfigFile = relative2(cwd2, candidate);
+        foundConfigFile = relative4(cwd2, candidate);
         configAbsPath = candidate;
         break;
       } catch {
@@ -2909,7 +3385,7 @@ async function detectTailwind(cwd2, files, readFile, root = cwd2) {
   for (const file of cssFiles) {
     let content = "";
     try {
-      content = await readFile(join12(cwd2, file));
+      content = await readFile(join13(cwd2, file));
     } catch {
       continue;
     }
@@ -2955,7 +3431,7 @@ async function scanCssVars(baseDir, candidatePaths, readFile) {
   const candidateFiles = [];
   for (const f of candidatePaths) {
     try {
-      const fullPath = join12(baseDir, f);
+      const fullPath = join13(baseDir, f);
       const stat = statSync(fullPath);
       if (stat.size <= 204800) {
         candidateFiles.push({ path: f, size: stat.size });
@@ -2975,7 +3451,7 @@ async function scanCssVars(baseDir, candidatePaths, readFile) {
   for (const item of selectedFiles) {
     let content = "";
     try {
-      content = await readFile(join12(baseDir, item.path));
+      content = await readFile(join13(baseDir, item.path));
     } catch {
       continue;
     }
@@ -3018,7 +3494,7 @@ async function scanScss(baseDir, candidatePaths, readFile) {
   for (const f of candidatePaths) {
     let content = "";
     try {
-      content = await readFile(join12(baseDir, f));
+      content = await readFile(join13(baseDir, f));
     } catch {
       continue;
     }
@@ -3084,7 +3560,7 @@ async function detectTheme(cwd2, files, readFile) {
   for (const f of themeFiles) {
     let content = "";
     try {
-      content = await readFile(join12(cwd2, f));
+      content = await readFile(join13(cwd2, f));
     } catch {
       continue;
     }
@@ -3114,7 +3590,7 @@ async function detectAngularMaterial(cwd2, files, readFile) {
   for (const f of scssFiles) {
     let content = "";
     try {
-      content = await readFile(join12(cwd2, f));
+      content = await readFile(join13(cwd2, f));
     } catch {
       continue;
     }
@@ -3147,7 +3623,7 @@ async function detectLibraries(cwd2, files, readFile, root = cwd2) {
     "primeng",
     "primevue"
   ];
-  if (resolve(root) !== resolve(cwd2)) {
+  if (resolve5(root) !== resolve5(cwd2)) {
     tracked.push("tailwindcss");
   }
   for (const [depName, depVer] of Object.entries(deps)) {
@@ -3205,7 +3681,7 @@ function buildDesignBlock(libraries, tokens) {
   };
 }
 async function detectDesignTokens(cwd2, options) {
-  const readFile = options?.readFile ?? ((p) => fs12.readFile(p, "utf8"));
+  const readFile = options?.readFile ?? ((p) => fs14.readFile(p, "utf8"));
   const root = options?.root ?? cwd2;
   const files = await collectFiles(cwd2, options);
   const libraries = await detectLibraries(cwd2, files, readFile, root);
@@ -3214,7 +3690,7 @@ async function detectDesignTokens(cwd2, options) {
   let scss = await detectScss(cwd2, files, readFile);
   const theme = await detectTheme(cwd2, files, readFile);
   const angularMaterial = await detectAngularMaterial(cwd2, files, readFile);
-  if ((!cssVars || !scss) && resolve(root) !== resolve(cwd2)) {
+  if ((!cssVars || !scss) && resolve5(root) !== resolve5(cwd2)) {
     const rootFiles = await collectFiles(root, options);
     const sharedStyleFiles = rootFiles.filter(isRootSharedStylePath);
     if (!cssVars) {
@@ -3294,7 +3770,7 @@ function openBrowser(url) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 async function runDeviceLogin(server, options = {}) {
   const clientName = options.clientName ?? `pinsay CLI on ${hostname()}`;
@@ -3355,7 +3831,35 @@ async function runDeviceLogin(server, options = {}) {
   return { ok: false, reason: "expired" };
 }
 
+// src/key-scope.ts
+var KEY_SCOPE_QUESTION = "Where should this API key be stored?";
+var KEY_SCOPE_GLOBAL = "Global \u2014 this machine, every repo (~/.config/pinsay/credentials.json)";
+var KEY_SCOPE_REPO = "Repo \u2014 .pinsay/credentials.env in this repo only (hidden from git)";
+function scopeFromFlags(options) {
+  const raw = options["scope"];
+  if (typeof raw === "string") {
+    const value = raw.toLowerCase();
+    if (value !== "global" && value !== "repo") {
+      return { error: `Invalid --scope "${raw}". Valid values: global, repo.` };
+    }
+    return { scope: value };
+  }
+  if (options["local-credentials"] === true)
+    return { scope: "repo" };
+  return {};
+}
+function decideKeyScope(flagScope, interactive) {
+  if (flagScope)
+    return flagScope;
+  return interactive ? "ask" : "global";
+}
+async function askKeyScope() {
+  const choice = await select(KEY_SCOPE_QUESTION, [KEY_SCOPE_GLOBAL, KEY_SCOPE_REPO]);
+  return choice === KEY_SCOPE_REPO ? "repo" : "global";
+}
+
 // src/commands/init.ts
+init_server();
 async function initCommand(cwd2, options = {}) {
   const isYes = options["yes"] || options["json"];
   const isJson = options["json"];
@@ -3373,12 +3877,9 @@ async function initCommand(cwd2, options = {}) {
   const pathFlag = typeof options["path"] === "string" ? String(options["path"]).replace(/^\.\/+/, "").replace(/\/+$/, "") : void 0;
   const isAddProject = Boolean(pathFlag);
   const configIsMulti = isMultiProject(config);
-  const isJoin = !isAddProject && Boolean(config.server) && (Boolean(config.project) || configIsMulti);
+  const isJoin = !isAddProject && (Boolean(config.project) || configIsMulti);
   const mode = isJoin ? "join" : "install";
-  let server = options["server"] || config.server || canonicalServer(process.env.PINSAY_SERVER) || BUILD_DEFAULT_SERVER;
-  if (!isYes && !options["server"] && !config.server) {
-    server = await ask("Server URL", { default: server });
-  }
+  const server = resolveServer();
   const scopeFlag = typeof options["scope"] === "string" ? String(options["scope"]).toLowerCase() : void 0;
   if (scopeFlag !== void 0 && scopeFlag !== "global" && scopeFlag !== "repo") {
     console.error(`Invalid --scope "${options["scope"]}". Valid values: global, repo.`);
@@ -3521,11 +4022,7 @@ async function initCommand(cwd2, options = {}) {
   if (freshlyAuthenticated) {
     let saveGlobally = !localCredentialsFlag;
     if (saveGlobally && !isYes && scopeFlag === void 0) {
-      const choice = await select("Where should this API key be stored?", [
-        "Global \u2014 this machine, every repo (~/.config/pointer/credentials.json)",
-        "Repo \u2014 .pinsay/credentials.env in this repo only (gitignored)"
-      ]);
-      saveGlobally = choice.startsWith("Global");
+      saveGlobally = await askKeyScope() === "global";
     }
     if (saveGlobally) {
       await saveGlobalCredential(server, { apiKey: key, email: me?.email, displayName: me?.displayName });
@@ -3534,9 +4031,9 @@ async function initCommand(cwd2, options = {}) {
     }
   }
   if (writeLocalCreds) {
-    await writeCredentials(cwd2, key, { server });
+    await writeCredentials(cwd2, key);
   }
-  await upsertGitignore(cwd2, product, options["skills-dir"] || config.skillsDir);
+  await hidePinsayFiles(cwd2, skillsDirExtra(options["skills-dir"] || config.skillsDir));
   if (isJoin && configIsMulti) {
     await handleMultiJoin(cwd2, config, server, product, Boolean(isJson), options, token, me);
     return;
@@ -3734,6 +4231,7 @@ and the pinsay-init skill uses them to mount the widget for you afterwards.
   let routedToSkill = false;
   let filesMod = [];
   let skillFiles = [];
+  let skillWarnings = [];
   let pin = null;
   if (!isJoin && options["pin"] === true) {
     try {
@@ -3812,23 +4310,43 @@ and the pinsay-init skill uses them to mount the widget for you afterwards.
         console.error(`\u26A0 ${sourceMapNote}`);
     }
   }
+  const skillHide = [];
   if (!options["no-skills"]) {
     if (!isJson)
       console.log(`Installing AI skills for ${tools.join(", ")}`);
     const skillsDir = options["skills-dir"];
     const installed = [];
     for (const t of tools) {
-      installed.push(...await installSkills(server, t, cwd2, t === tool ? skillsDir : void 0));
+      try {
+        const r = await installSkills(server, t, cwd2, t === tool ? skillsDir : void 0);
+        installed.push(...r.files);
+        skillWarnings.push(...r.warnings);
+        skillHide.push(...r.hide);
+      } catch (err) {
+        skillWarnings.push({
+          tool: t,
+          path: "(all skill files)",
+          message: `could not install the skills (${err?.message ?? err}).`,
+          hint: 'Run "npx pinsay-cli update" to try again.'
+        });
+      }
     }
+    if (!isJson)
+      for (const line of formatSkillWarnings(skillWarnings))
+        console.error(line);
     filesMod.push(...installed);
     skillFiles = [...new Set(installed.filter((f) => f.includes("SKILL.md") || f.endsWith(".md")))];
   }
-  const pkgStr = await fs13.readFile(join13(cwd2, "package.json"), "utf8").catch(() => "{}");
+  const hidden = await hidePinsayFiles(cwd2, [...skillsDirExtra(options["skills-dir"]), ...skillHide]);
+  if (!isJson)
+    for (const line of formatHideWarnings(hidden))
+      console.error(line);
+  const pkgStr = await fs15.readFile(join14(cwd2, "package.json"), "utf8").catch(() => "{}");
   const tokens = extractTokens(JSON.parse(pkgStr));
   const stackMeta = { frontend: tokens.frontend, backend: tokens.backend, aiTool: tool };
   let stackFileExists = false;
   try {
-    await fs13.access(join13(cwd2, ".pinsay/stack.json"));
+    await fs15.access(join14(cwd2, ".pinsay/stack.json"));
     stackFileExists = true;
   } catch {
     stackFileExists = false;
@@ -3856,7 +4374,6 @@ and the pinsay-init skill uses them to mount the widget for you afterwards.
   }
   const injectedHtml = injected ? filesMod.find((f) => f.toLowerCase().endsWith(".html"))?.replace(`${cwd2}/`, "") : void 0;
   const configPatch = {
-    server,
     project: finalProjectKey,
     aiTool: tool,
     skillsDir: options["skills-dir"],
@@ -3868,10 +4385,9 @@ and the pinsay-init skill uses them to mount the widget for you afterwards.
   await writeConfig(cwd2, configPatch);
   filesMod.push(".pinsay/config.json");
   if (writeLocalCreds) {
-    await writeCredentials(cwd2, key, { server, project: finalProjectKey });
+    await writeCredentials(cwd2, key, { project: finalProjectKey });
     filesMod.push(".pinsay/credentials.env");
   }
-  filesMod.push(".gitignore");
   if (!isJson)
     console.log("Verifying...");
   const checks = await runInitChecks(cwd2, { server, project: finalProjectKey }, BUILD_CLI_VERSION);
@@ -3901,6 +4417,9 @@ and the pinsay-init skill uses them to mount the widget for you afterwards.
       injected,
       routedToSkill,
       files: filesMod,
+      skillWarnings,
+      hiddenFromGit: hidden.status,
+      trackedPinsayFiles: hidden.tracked,
       checks,
       cliVersion: BUILD_CLI_VERSION
     }));
@@ -3912,7 +4431,7 @@ and the pinsay-init skill uses them to mount the widget for you afterwards.
   const cyan = (s) => `\x1B[36m${s}\x1B[0m`;
   const rule = dim("\u2500".repeat(60));
   const envLabel = environmentPinned ? envs.length > 1 ? envs.join(", ") : env : null;
-  const keyLine = keyLivesGlobally ? `this machine's global store ${dim("(~/.config/pointer/credentials.json)")}` : `.pinsay/credentials.env ${dim("(gitignored)")}`;
+  const keyLine = keyLivesGlobally ? `this machine's global store ${dim("(~/.config/pinsay/credentials.json)")}` : `.pinsay/credentials.env ${dim("(gitignored)")}`;
   if (isJoin) {
     console.log(`
 ${rule}
@@ -3921,7 +4440,7 @@ ${envLabel !== null ? `
   ${dim("Environment(s)")}  ${envLabel}` : ""}
   ${dim("Server")}          ${server}
   ${dim("Key")}             ${keyLine}
-  ${dim("Skills")}          ${skillFiles.length ? skillFiles.join("\n                    ") : "installed"}
+  ${dim("Skills")}          ${skillFiles.length ? skillFiles.join("\n                    ") : skillWarnings.length ? "not installed \u2014 see the warning above" : "installed"}
 ${rule}`);
   } else {
     console.log(`
@@ -3932,7 +4451,7 @@ ${green("\u2714")} ${bold(`${product} is set up`)}
 ${envLabel !== null ? `  ${dim("Environments")}  ${envLabel}
 ` : ""}  ${dim("Server")}        ${server}
   ${dim("Key")}           ${keyLine}
-  ${dim("Skills")}        ${skillFiles.length ? skillFiles.join("\n                ") : "installed"}
+  ${dim("Skills")}        ${skillFiles.length ? skillFiles.join("\n                ") : skillWarnings.length ? "not installed \u2014 see the warning above" : "installed"}
 ${rule}`);
   }
   if (delivery === "extension") {
@@ -3944,7 +4463,7 @@ ${rule}`);
 ${bold("Next")}  Reviewers open the widget through the ${product} Chrome extension \u2014 nothing was injected.
 
 ${installLine}
-  2. Extension \u2192 Options \u2192 set server ${server}; sign in with your ${product} account.
+  2. Open the extension and sign in with your ${product} account.
   3. Open your app, click the extension icon, choose project ${dim(finalProjectKey)}, Activate.
   4. Then ${bold("npx pinsay-cli list")} / ${bold("apply")} as usual.
       ${dim(`Dashboard: ${branding.urls?.app || server}`)}`);
@@ -3999,19 +4518,19 @@ function projectQuestion(label) {
   return label ? `Which PinSay project is ${label}?` : "Which project is this app?";
 }
 function toRootRelative(root, p) {
-  const abs = isAbsolute2(p) ? p : resolve2(p);
-  return relative3(root, abs).split(sep2).join("/");
+  const abs = isAbsolute3(p) ? p : resolve6(p);
+  return relative5(root, abs).split(sep5).join("/");
 }
 async function hasViteConfig(appDir) {
   for (const ext of ["ts", "js", "mjs", "mts"]) {
-    if (existsSync2(join13(appDir, `vite.config.${ext}`)))
+    if (existsSync2(join14(appDir, `vite.config.${ext}`)))
       return true;
   }
   return false;
 }
 async function readJsonSafe(p) {
   try {
-    return JSON.parse(await fs13.readFile(p, "utf8"));
+    return JSON.parse(await fs15.readFile(p, "utf8"));
   } catch {
     return null;
   }
@@ -4019,13 +4538,13 @@ async function readJsonSafe(p) {
 async function resolveHtmlCandidate(root, appDir, explicitHtml) {
   if (explicitHtml)
     return explicitHtml;
-  const targetCwd = join13(root, appDir);
-  const candidates = [join13(targetCwd, "index.html"), join13(targetCwd, "src", "index.html")];
-  const projectJson = await readJsonSafe(join13(targetCwd, "project.json"));
+  const targetCwd = join14(root, appDir);
+  const candidates = [join14(targetCwd, "index.html"), join14(targetCwd, "src", "index.html")];
+  const projectJson = await readJsonSafe(join14(targetCwd, "project.json"));
   if (projectJson?.sourceRoot) {
-    candidates.push(join13(root, projectJson.sourceRoot, "index.html"));
+    candidates.push(join14(root, projectJson.sourceRoot, "index.html"));
   }
-  candidates.push(join13(targetCwd, "public", "index.html"));
+  candidates.push(join14(targetCwd, "public", "index.html"));
   for (const c of candidates) {
     if (existsSync2(c))
       return c;
@@ -4035,7 +4554,7 @@ async function resolveHtmlCandidate(root, appDir, explicitHtml) {
 function deriveAppDirFromHtmlPath(htmlPath) {
   if (!htmlPath)
     return ".";
-  let dir = dirname6(htmlPath).replace(/\/src$/, "");
+  let dir = dirname7(htmlPath).replace(/\/src$/, "");
   return dir === "" || dir === "." ? "." : dir;
 }
 async function selectOrCreateProject(server, token, isYes, presetKey, presetCreate, label) {
@@ -4160,7 +4679,7 @@ async function resolvePin(server, options) {
 }
 async function setupOneProject(ctx) {
   const { cwd: cwd2, appDir, server, token } = ctx;
-  const targetCwd = join13(cwd2, appDir);
+  const targetCwd = join14(cwd2, appDir);
   const label = appLabel(appDir);
   const { key, name, created } = await selectOrCreateProject(server, token, ctx.isYes, ctx.presetKey, ctx.presetCreate, label);
   const ALL_ENVS = ["local", "staging", "production"];
@@ -4236,9 +4755,9 @@ async function setupOneProject(ctx) {
       noHtmlFound = true;
     }
   }
-  let pkgStr = await fs13.readFile(join13(targetCwd, "package.json"), "utf8").catch(() => "");
+  let pkgStr = await fs15.readFile(join14(targetCwd, "package.json"), "utf8").catch(() => "");
   if (!pkgStr)
-    pkgStr = await fs13.readFile(join13(cwd2, "package.json"), "utf8").catch(() => "{}");
+    pkgStr = await fs15.readFile(join14(cwd2, "package.json"), "utf8").catch(() => "{}");
   const tokens = extractTokens(JSON.parse(pkgStr || "{}"));
   const stackMeta = { frontend: tokens.frontend, backend: tokens.backend, aiTool: ctx.aiTool };
   let serverStackResponse = null;
@@ -4260,25 +4779,39 @@ async function setupOneProject(ctx) {
 async function handleMultiJoin(cwd2, config, server, product, isJson, options, token, me) {
   closePrompts();
   const tool = options["tool"] || config.aiTool || "other";
+  const skillWarnings = [];
+  const hide = [];
   if (!options["no-skills"]) {
-    await installSkills(server, tool, cwd2, options["skills-dir"]).catch(() => {
-    });
+    try {
+      const r = await installSkills(server, tool, cwd2, options["skills-dir"]);
+      skillWarnings.push(...r.warnings);
+      hide.push(...r.hide);
+    } catch (err) {
+      skillWarnings.push({ tool, path: "(all skill files)", message: `could not install the skills (${err?.message ?? err}).`, hint: 'Run "npx pinsay-cli update" to try again.' });
+    }
+    if (!isJson)
+      for (const line of formatSkillWarnings(skillWarnings))
+        console.error(line);
   }
+  const hidden = await hidePinsayFiles(cwd2, [...skillsDirExtra(options["skills-dir"]), ...hide]);
+  if (!isJson)
+    for (const line of formatHideWarnings(hidden))
+      console.error(line);
   const projects = listProjects(config);
   for (const p of projects) {
     const relStack = stackFileRelPath(p.key);
     let exists = true;
     try {
-      await fs13.access(join13(cwd2, relStack));
+      await fs15.access(join14(cwd2, relStack));
     } catch {
       exists = false;
     }
     if (exists)
       continue;
-    const appCwd = join13(cwd2, p.path);
-    let pkgStr = await fs13.readFile(join13(appCwd, "package.json"), "utf8").catch(() => "");
+    const appCwd = join14(cwd2, p.path);
+    let pkgStr = await fs15.readFile(join14(appCwd, "package.json"), "utf8").catch(() => "");
     if (!pkgStr)
-      pkgStr = await fs13.readFile(join13(cwd2, "package.json"), "utf8").catch(() => "{}");
+      pkgStr = await fs15.readFile(join14(cwd2, "package.json"), "utf8").catch(() => "{}");
     const tokens = extractTokens(JSON.parse(pkgStr || "{}"));
     const stackMeta = { frontend: tokens.frontend, backend: tokens.backend, aiTool: config.aiTool };
     let serverStackResponse = null;
@@ -4310,6 +4843,9 @@ async function handleMultiJoin(cwd2, config, server, product, isJson, options, t
         htmlPath: p.htmlPath,
         delivery: p.delivery ?? config.delivery ?? "embed"
       })),
+      skillWarnings,
+      hiddenFromGit: hidden.status,
+      trackedPinsayFiles: hidden.tracked,
       cliVersion: BUILD_CLI_VERSION
     }));
   } else {
@@ -4397,12 +4933,26 @@ async function handleMultiProjectSetup(args) {
     }
   }
   closePrompts();
+  const skillWarnings = [];
+  const hide = [];
   if (!options["no-skills"]) {
     for (const t of tools) {
-      await installSkills(server, t, cwd2, t === tool ? options["skills-dir"] : void 0).catch(() => {
-      });
+      try {
+        const r = await installSkills(server, t, cwd2, t === tool ? options["skills-dir"] : void 0);
+        skillWarnings.push(...r.warnings);
+        hide.push(...r.hide);
+      } catch (err) {
+        skillWarnings.push({ tool: t, path: "(all skill files)", message: `could not install the skills (${err?.message ?? err}).`, hint: 'Run "npx pinsay-cli update" to try again.' });
+      }
     }
+    if (!isJson)
+      for (const line of formatSkillWarnings(skillWarnings))
+        console.error(line);
   }
+  const hidden = await hidePinsayFiles(cwd2, [...skillsDirExtra(options["skills-dir"]), ...hide]);
+  if (!isJson)
+    for (const line of formatHideWarnings(hidden))
+      console.error(line);
   const projectsMap = { ...config.projects ?? {} };
   let migrationNote = null;
   let migrationOk = null;
@@ -4426,7 +4976,6 @@ async function handleMultiProjectSetup(args) {
   for (const r of results)
     projectsMap[r.key] = r.entry;
   await writeConfigFull(cwd2, {
-    server,
     aiTool: tool,
     skillsDir: (options["skills-dir"] || config.skillsDir) ?? void 0,
     cliVersion: BUILD_CLI_VERSION,
@@ -4434,7 +4983,7 @@ async function handleMultiProjectSetup(args) {
     projects: projectsMap
   });
   if (writeLocalCreds) {
-    await writeCredentials(cwd2, key, { server });
+    await writeCredentials(cwd2, key);
   }
   await postEvent(server, token, {
     type: "installed",
@@ -4451,6 +5000,9 @@ async function handleMultiProjectSetup(args) {
         const r = results.find((res) => res.key === k);
         return { key: k, path: p.path, injected: r ? r.injected : false, htmlPath: p.htmlPath, delivery: p.delivery ?? repoDefaultDelivery };
       }),
+      skillWarnings,
+      hiddenFromGit: hidden.status,
+      trackedPinsayFiles: hidden.tracked,
       cliVersion: BUILD_CLI_VERSION
     }));
   } else {
@@ -4467,10 +5019,11 @@ ${migrationLine}  Config: .pinsay/config.json (projects map)
 
 // src/commands/doctor.ts
 init_config();
-import { promises as fs15 } from "node:fs";
-import { join as join15 } from "node:path";
+import { promises as fs17 } from "node:fs";
+import { join as join16 } from "node:path";
 init_api();
 init_credentials();
+init_server();
 var ICON = { ok: "\u2714", warn: "\u26A0", error: "\u2718" };
 function exitCodeFor(checks) {
   const failed = checks.filter((c) => c.status === "error");
@@ -4485,7 +5038,7 @@ async function doctorCommand(cwd2, options, cliVersion) {
     const config = await readConfig(cwd2);
     const multi = isMultiProject(config);
     const projectKey = multi ? options.project || listProjects(config)[0]?.key : void 0;
-    const appCwd = multi && projectKey ? join15(cwd2, config.projects?.[projectKey]?.path ?? ".") : cwd2;
+    const appCwd = multi && projectKey ? join16(cwd2, config.projects?.[projectKey]?.path ?? ".") : cwd2;
     const start = Date.now();
     const designBlock = await detectDesignTokens(appCwd, { root: cwd2 });
     const detectMs = Date.now() - start;
@@ -4500,11 +5053,12 @@ async function doctorCommand(cwd2, options, cliVersion) {
     }
     return 0;
   }
-  let checks = await runInitChecks(cwd2, { server: options.server, project: options.project }, cliVersion);
+  const server = (options.server || resolveServer()).replace(/\/$/, "");
+  let checks = await runInitChecks(cwd2, { server, project: options.project }, cliVersion);
   if (options.fix) {
-    const repaired = await applyFixes(cwd2, checks);
+    const repaired = await applyFixes(cwd2, checks, server);
     if (repaired.length > 0) {
-      checks = await runInitChecks(cwd2, { server: options.server, project: options.project }, cliVersion);
+      checks = await runInitChecks(cwd2, { server, project: options.project }, cliVersion);
     }
   }
   const code = exitCodeFor(checks);
@@ -4534,7 +5088,7 @@ async function reportRun(cwd2, options, checks, ok) {
     return;
   try {
     const config = await readConfig(cwd2);
-    const server = (options.server || config.server || "").replace(/\/$/, "");
+    const server = (options.server || resolveServer()).replace(/\/$/, "");
     if (!server)
       return;
     const { key: apiKey } = await resolveApiKey(cwd2, server);
@@ -4551,10 +5105,9 @@ async function reportRun(cwd2, options, checks, ok) {
   } catch {
   }
 }
-async function applyFixes(cwd2, checks) {
+async function applyFixes(cwd2, checks, server) {
   const repaired = [];
   const config = await readConfig(cwd2);
-  const server = (config.server || "").replace(/\/$/, "");
   let token;
   const tokenFor = async () => {
     if (token)
@@ -4576,11 +5129,10 @@ async function applyFixes(cwd2, checks) {
       continue;
     try {
       if (check.id === "gitignore") {
-        const path = join15(cwd2, ".gitignore");
-        const before = await fs15.readFile(path, "utf8").catch(() => "");
-        await upsertGitignore(cwd2, "Feedback tool", config.skillsDir);
-        const after = await fs15.readFile(path, "utf8").catch(() => "");
-        if (after !== before)
+        const r = await hidePinsayFiles(cwd2, skillsDirExtra(config.skillsDir));
+        for (const line of formatHideWarnings(r))
+          console.error(line);
+        if (r.status === "written" || r.status === "unchanged")
           repaired.push(check.id);
       } else if (check.id === "source-map") {
         const { buildManifest: buildManifest2 } = await Promise.resolve().then(() => (init_map(), map_exports));
@@ -4588,8 +5140,12 @@ async function applyFixes(cwd2, checks) {
         if (built.ok)
           repaired.push(check.id);
       } else if (check.id === "skills" && server && config.aiTool) {
-        await installSkills(server, config.aiTool, cwd2, config.skillsDir);
-        repaired.push(check.id);
+        const r = await installSkills(server, config.aiTool, cwd2, config.skillsDir);
+        for (const line of formatSkillWarnings(r.warnings))
+          console.error(line);
+        await hidePinsayFiles(cwd2, [...skillsDirExtra(config.skillsDir), ...r.hide]);
+        if (r.warnings.length === 0)
+          repaired.push(check.id);
       }
     } catch {
     }
@@ -4600,7 +5156,7 @@ async function applyFixes(cwd2, checks) {
     let any = false;
     for (const t of targets) {
       try {
-        const appCwd = multi ? join15(cwd2, t.path) : cwd2;
+        const appCwd = multi ? join16(cwd2, t.path) : cwd2;
         const detection = await detectStack(appCwd);
         const stackToken = await tokenFor();
         const stack = stackToken ? await api(server, `/api/projects/${t.key}/stack`, {
@@ -4609,7 +5165,7 @@ async function applyFixes(cwd2, checks) {
           body: { kind: detection.kind, evidence: detection.evidence }
         }).catch(() => null) : null;
         if (stack) {
-          await fs15.writeFile(join15(cwd2, stackFileRelPath(multi ? t.key : void 0)), JSON.stringify(stack, null, 2) + "\n", "utf8");
+          await fs17.writeFile(join16(cwd2, stackFileRelPath(multi ? t.key : void 0)), JSON.stringify(stack, null, 2) + "\n", "utf8");
           any = true;
         }
       } catch {
@@ -4624,8 +5180,8 @@ async function applyFixes(cwd2, checks) {
 // src/commands/update.ts
 init_config();
 init_api();
-import { promises as fs16 } from "node:fs";
-import { dirname as dirname7, join as join16 } from "node:path";
+import { promises as fs18 } from "node:fs";
+init_server();
 function sourceFor(path) {
   if (path.endsWith("pinsay.sh"))
     return "/pinsay.sh";
@@ -4649,9 +5205,9 @@ async function updateCommand(cwd2, options) {
   for (const f of removedLegacyFiles)
     console.log(`\x1B[2mremoved legacy ${f}\x1B[0m`);
   const config = await readConfig(cwd2);
-  const server = (options.server || config.server || "").replace(/\/$/, "");
-  if (!server) {
-    console.error("No server configured \u2014 run `npx -y pinsay-cli init` first.");
+  const server = (options.server || resolveServer()).replace(/\/$/, "");
+  if (!config.project && !isMultiProject(config)) {
+    console.error("No .pinsay/config.json here \u2014 run `npx -y pinsay-cli init` first.");
     return 1;
   }
   let served = null;
@@ -4659,16 +5215,17 @@ async function updateCommand(cwd2, options) {
     const meta = await api(server, "/api/meta");
     served = meta?.skillVersion ?? null;
   } catch {
-    console.error(`Could not reach ${server} \u2014 check the URL.`);
+    console.error(`Could not reach ${server}.`);
     return 1;
   }
   const files = skillFilesFor(config);
   const missing = [];
   const stale = [];
   for (const rel of files) {
-    const abs = join16(cwd2, rel);
+    let abs;
     try {
-      await fs16.access(abs);
+      abs = (await resolveRepoPath(cwd2, rel, { create: false })).abs;
+      await fs18.access(abs);
     } catch {
       missing.push(rel);
       continue;
@@ -4679,6 +5236,10 @@ async function updateCommand(cwd2, options) {
   }
   if (missing.length === 0 && stale.length === 0) {
     console.log(`Up to date (skill version ${served ?? "unknown"}).`);
+    if (!options.check) {
+      for (const line of formatHideWarnings(await hidePinsayFiles(cwd2, skillsDirExtra(config.skillsDir))))
+        console.error(line);
+    }
     return 0;
   }
   if (options.check) {
@@ -4695,17 +5256,31 @@ async function updateCommand(cwd2, options) {
     return 0;
   }
   let installedCount = 0;
+  let installHide = [];
   if (missing.length > 0) {
     if (!config.aiTool) {
       console.error("No AI tool configured \u2014 run `npx -y pinsay-cli init` to record one, then `update` again.");
     } else {
       try {
-        await installSkills(server, config.aiTool, cwd2, config.skillsDir);
-        installedCount = missing.length;
-        console.log(`installed ${installedCount} file${installedCount === 1 ? "" : "s"}: ${missing.join(", ")}`);
+        const r = await installSkills(server, config.aiTool, cwd2, config.skillsDir);
+        for (const line of formatSkillWarnings(r.warnings))
+          console.error(line);
+        installHide = r.hide;
       } catch (err) {
         console.error(`  failed to install missing skills: ${err?.message ?? err}`);
       }
+      const nowPresent = [];
+      for (const rel of missing) {
+        try {
+          await fs18.access((await resolveRepoPath(cwd2, rel, { create: false })).abs);
+          nowPresent.push(rel);
+        } catch {
+        }
+      }
+      installedCount = nowPresent.length;
+      if (installedCount > 0) {
+        console.log(`installed ${installedCount} file${installedCount === 1 ? "" : "s"}: ${nowPresent.join(", ")}`);
+      }
     }
   }
   let updated = 0;
@@ -4725,11 +5300,10 @@ async function updateCommand(cwd2, options) {
           throw new Error(`HTTP ${res.status}`);
         body = await res.text();
       }
-      const abs = join16(cwd2, f.path);
-      await fs16.mkdir(dirname7(abs), { recursive: true });
-      await fs16.writeFile(abs, body, "utf8");
+      const abs = (await resolveRepoPath(cwd2, f.path, { create: true })).abs;
+      await fs18.writeFile(abs, body, "utf8");
       if (abs.endsWith(".sh"))
-        await fs16.chmod(abs, 493).catch(() => {
+        await fs18.chmod(abs, 493).catch(() => {
         });
       updated++;
     } catch (err) {
@@ -4739,6 +5313,9 @@ async function updateCommand(cwd2, options) {
   if (stale.length > 0) {
     console.log(`updated ${updated} file${updated === 1 ? "" : "s"} (skill version ${from} \u2192 ${served ?? "unknown"})`);
   }
+  const hidden = await hidePinsayFiles(cwd2, [...skillsDirExtra(config.skillsDir), ...installHide]);
+  for (const line of formatHideWarnings(hidden))
+    console.error(line);
   const installedOk = missing.length === 0 || installedCount === missing.length;
   const updatedOk = updated === stale.length;
   return installedOk && updatedOk ? 0 : 1;
@@ -4749,7 +5326,7 @@ init_config();
 init_api();
 
 // src/lib/notify-update.ts
-import { promises as fs17 } from "node:fs";
+import { promises as fs19 } from "node:fs";
 import { join as join17 } from "node:path";
 init_build_constants();
 async function checkAndNotifyUpdates(options) {
@@ -4775,7 +5352,7 @@ async function checkAndNotifyUpdates(options) {
       for (const rel of files) {
         const abs = join17(options.cwd, rel);
         try {
-          await fs17.access(abs);
+          await fs19.access(abs);
           const installed = await readStamp(abs);
           if (installed && installed !== meta.skillVersion) {
             hasStale = true;
@@ -4805,7 +5382,7 @@ init_build_constants();
 // src/apply/run.ts
 init_resolve();
 init_api();
-import { promises as fs20 } from "node:fs";
+import { promises as fs22 } from "node:fs";
 import { join as join20, dirname as dirname9 } from "node:path";
 import { spawnSync } from "node:child_process";
 
@@ -4964,7 +5541,7 @@ async function fetchQueue(ctx, filter) {
 
 // src/apply/context.ts
 init_api();
-import { promises as fs19 } from "node:fs";
+import { promises as fs21 } from "node:fs";
 import { join as join19 } from "node:path";
 init_config();
 async function loadProjectContext(ctx) {
@@ -4976,7 +5553,7 @@ async function loadProjectContext(ctx) {
     if (config.delegation === "off")
       delegation = "off";
     const relPath = isMultiProject(config) ? stackFileRelPath(ctx.project) : stackFileRelPath();
-    const stackRaw = await fs19.readFile(join19(ctx.cwd, relPath), "utf8");
+    const stackRaw = await fs21.readFile(join19(ctx.cwd, relPath), "utf8");
     stack = JSON.parse(stackRaw);
   } catch {
   }
@@ -5351,7 +5928,7 @@ async function ensureToolRegistered(ctx, tool) {
   const stackPath = join20(ctx.cwd, relStackPath);
   let stackData = {};
   try {
-    const raw = await fs20.readFile(stackPath, "utf8");
+    const raw = await fs22.readFile(stackPath, "utf8");
     stackData = JSON.parse(raw);
   } catch {
   }
@@ -5370,8 +5947,8 @@ async function ensureToolRegistered(ctx, tool) {
         }
       );
       if (res) {
-        await fs20.mkdir(dirname9(stackPath), { recursive: true });
-        await fs20.writeFile(stackPath, JSON.stringify(res, null, 2) + "\n", "utf8");
+        await fs22.mkdir(dirname9(stackPath), { recursive: true });
+        await fs22.writeFile(stackPath, JSON.stringify(res, null, 2) + "\n", "utf8");
         return;
       }
     } catch {
@@ -5380,8 +5957,8 @@ async function ensureToolRegistered(ctx, tool) {
   aiTools.push(tool);
   stackData.aiTools = aiTools;
   try {
-    await fs20.mkdir(dirname9(stackPath), { recursive: true });
-    await fs20.writeFile(stackPath, JSON.stringify(stackData, null, 2) + "\n", "utf8");
+    await fs22.mkdir(dirname9(stackPath), { recursive: true });
+    await fs22.writeFile(stackPath, JSON.stringify(stackData, null, 2) + "\n", "utf8");
   } catch {
   }
 }
@@ -5456,8 +6033,8 @@ async function runApply(options, ctx) {
       }
     } else if (tool === "cursor") {
       const promptFile = join20(ctx.cwd, ".pinsay/apply-prompt.md");
-      await fs20.mkdir(join20(ctx.cwd, ".pinsay"), { recursive: true });
-      await fs20.writeFile(promptFile, prompt, "utf8");
+      await fs22.mkdir(join20(ctx.cwd, ".pinsay"), { recursive: true });
+      await fs22.writeFile(promptFile, prompt, "utf8");
       console.log(`Saved apply prompt to ${promptFile}`);
     } else if (tool === "clipboard") {
       const copied = copyToClipboard(prompt);
@@ -5823,6 +6400,7 @@ function describeFilter(filter) {
 
 // src/commands/apply.ts
 init_projection();
+init_server();
 async function exitIfWorkspaceFrozen(server, token) {
   if (!token)
     return;
@@ -5871,11 +6449,7 @@ function parseModelFlags(parsed) {
 async function applyCommand(cwd2, parsed, positionals = []) {
   const root = await findRepoRoot(cwd2);
   const config = await readConfig(root);
-  const server = ((typeof parsed["server"] === "string" ? parsed["server"] : config.server) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
-  if (!server) {
-    console.error("No server configured. Run `npx pinsay-cli init` or pass --server.");
-    process.exit(2);
-  }
+  const server = resolveServer();
   const projectFlag = typeof parsed["project"] === "string" ? parsed["project"] : void 0;
   const resolved = resolveProject(config, cwd2, root, projectFlag);
   const markVal = parsed["mark"];
@@ -11002,7 +11576,7 @@ var Protocol = class {
    * Do not use this method to emit notifications! Use notification() instead.
    */
   request(request, resultSchema, options) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve9, reject) => {
       var _a, _b, _c, _d;
       if (!this._transport) {
         reject(new Error("Not connected"));
@@ -11039,7 +11613,7 @@ var Protocol = class {
         }
         try {
           const result = resultSchema.parse(response.result);
-          resolve5(result);
+          resolve9(result);
         } catch (error) {
           reject(error);
         }
@@ -11392,12 +11966,12 @@ var StdioServerTransport = class {
     (_a = this.onclose) === null || _a === void 0 ? void 0 : _a.call(this);
   }
   send(message) {
-    return new Promise((resolve5) => {
+    return new Promise((resolve9) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve5();
+        resolve9();
       } else {
-        this._stdout.once("drain", resolve5);
+        this._stdout.once("drain", resolve9);
       }
     });
   }
@@ -11662,7 +12236,7 @@ var ALL_TOOLS = [
 // src/mcp/tools.ts
 init_api();
 import { existsSync as existsSync4, readFileSync as readFileSync2 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join21, relative as relative5, resolve as resolve4 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join21, relative as relative7, resolve as resolve8 } from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 init_build_constants();
 init_projection();
@@ -11976,12 +12550,12 @@ async function handleCommitAndMark(args, ctx) {
   if (Array.isArray(files) && files.length > 0) {
     for (const entry of files) {
       const cleanPath = entry.includes(":") ? entry.split(":").slice(1).join(":") : entry;
-      if (isAbsolute3(cleanPath)) {
+      if (isAbsolute4(cleanPath)) {
         throw mcpError("git", `Path must be relative to repo root: ${cleanPath}`);
       }
-      const resolved = resolve4(ctx.cwd, cleanPath);
-      const rel = relative5(ctx.cwd, resolved);
-      if (rel.startsWith("..") || isAbsolute3(rel)) {
+      const resolved = resolve8(ctx.cwd, cleanPath);
+      const rel = relative7(ctx.cwd, resolved);
+      if (rel.startsWith("..") || isAbsolute4(rel)) {
         throw mcpError("git", `Path escapes repository root: ${cleanPath}`);
       }
       if (!existsSync4(resolved)) {
@@ -12452,8 +13026,8 @@ function createMcpServer(ctx) {
 async function runMcpServer(ctx, logFile) {
   if (logFile) {
     try {
-      const fs21 = await import("node:fs");
-      const logStream = fs21.createWriteStream(logFile, { flags: "a" });
+      const fs23 = await import("node:fs");
+      const logStream = fs23.createWriteStream(logFile, { flags: "a" });
       const origWrite = process.stderr.write;
       process.stderr.write = function(chunk, encoding, cb) {
         logStream.write(chunk);
@@ -12468,10 +13042,11 @@ async function runMcpServer(ctx, logFile) {
 }
 
 // src/commands/mcp.ts
+init_server();
 async function mcpCommand(cwd2, parsed = {}) {
   const root = await findRepoRoot(cwd2);
   const config = await readConfig(root).catch(() => ({}));
-  const server = ((typeof parsed["server"] === "string" ? parsed["server"] : config.server) || canonicalServer(process.env.PINSAY_SERVER) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
+  const server = resolveServer();
   const projectFlag = typeof parsed["project"] === "string" ? parsed["project"] : void 0;
   const project = projectFlag || config.project || process.env.PINSAY_PROJECT || "";
   const explicitKey = typeof parsed["key"] === "string" ? parsed["key"] : void 0;
@@ -12508,11 +13083,15 @@ async function mcpCommand(cwd2, parsed = {}) {
 init_config();
 init_api();
 init_credentials();
-init_build_constants();
+init_server();
 async function loginCommand(cwd2, options = {}) {
+  const flags = scopeFromFlags(options);
+  if (flags.error) {
+    console.error(flags.error);
+    process.exit(2);
+  }
   const root = await findRepoRoot(cwd2);
-  const config = await readConfig(root).catch(() => ({}));
-  const server = ((typeof options["server"] === "string" ? options["server"] : void 0) || config.server || canonicalServer(process.env.PINSAY_SERVER) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
+  const server = resolveServer();
   const branding = await getBranding(server);
   const product = branding.productName;
   const flagKey = typeof options["key"] === "string" ? options["key"] : void 0;
@@ -12547,14 +13126,15 @@ async function loginCommand(cwd2, options = {}) {
     console.error("No key provided and no terminal to sign in from \u2014 run `npx pinsay-cli login --key <key>` or set PINSAY_API_KEY.");
     process.exit(2);
   }
-  const scope = typeof options["scope"] === "string" ? String(options["scope"]).toLowerCase() : "global";
-  if (scope !== "global" && scope !== "repo") {
-    console.error(`Invalid --scope "${options["scope"]}". Valid values: global, repo.`);
-    process.exit(2);
-  }
+  const interactive = Boolean(process.stdin.isTTY) && options["yes"] !== true;
+  const decided = decideKeyScope(flags.scope, interactive);
+  const scope = decided === "ask" ? await askKeyScope() : decided;
+  closePrompts();
   const who = me?.displayName ? `${me.displayName}${me?.email ? ` (${me.email})` : ""}` : me?.email ?? "you";
   if (scope === "repo") {
-    await writeCredentials(root, key, { server });
+    await writeCredentials(root, key);
+    for (const line of formatHideWarnings(await hidePinsayFiles(root)))
+      console.error(line);
     console.log(`\u2714 Signed in to ${server} as ${who} \u2014 saved to .pinsay/credentials.env (this repo only; overrides the global store here)`);
     process.exit(0);
   }
@@ -12564,13 +13144,10 @@ async function loginCommand(cwd2, options = {}) {
 }
 
 // src/commands/logout.ts
-init_config();
 init_credentials();
-init_build_constants();
-async function logoutCommand(cwd2, options = {}) {
-  const root = await findRepoRoot(cwd2);
-  const config = await readConfig(root).catch(() => ({}));
-  const server = ((typeof options["server"] === "string" ? options["server"] : void 0) || config.server || canonicalServer(process.env.PINSAY_SERVER) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
+init_server();
+async function logoutCommand(_cwd, options = {}) {
+  const server = resolveServer();
   const origin = normalizeServerOrigin(server);
   const removed = await removeGlobalCredential(server);
   if (options["json"] === true) {
@@ -12587,11 +13164,10 @@ async function logoutCommand(cwd2, options = {}) {
 init_config();
 init_api();
 init_credentials();
-init_build_constants();
+init_server();
 async function whoamiCommand(cwd2, options = {}) {
   const root = await findRepoRoot(cwd2);
-  const config = await readConfig(root).catch(() => ({}));
-  const server = ((typeof options["server"] === "string" ? options["server"] : void 0) || config.server || canonicalServer(process.env.PINSAY_SERVER) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
+  const server = resolveServer();
   const isJson = options["json"] === true;
   const { key, source } = await resolveApiKey(root, server);
   if (!key) {
@@ -12631,6 +13207,7 @@ async function whoamiCommand(cwd2, options = {}) {
 // src/cli.ts
 init_build_constants();
 init_api();
+init_server();
 import { argv, cwd } from "node:process";
 function parseArgs(args) {
   const parsed = {};
@@ -12687,8 +13264,8 @@ Usage: npx pinsay-cli <command> [options]
 
 Commands:
   init      Set up the feedback widget in your project
-  login     Authenticate once per machine (saves a key for every repo)
-  logout    Remove this machine's saved key for a server
+  login     Sign in and save your API key (this machine, or this repo only)
+  logout    Remove this machine's saved key
   whoami    Show the signed-in account and where the API key came from
   doctor    Diagnose an install and report what is wrong
   update    Refresh the served skills to the server's current version
@@ -12719,13 +13296,19 @@ async function main() {
       process.exit(0);
     }
   }
+  if (command !== "map" && !parsed["help"]) {
+    const serverError = await serverSettingError(cwd(), parsed);
+    if (serverError) {
+      console.error(serverError);
+      process.exit(2);
+    }
+  }
   if (command === "init") {
     if (parsed["help"]) {
       console.log(`
 Usage: npx pinsay-cli init [options]
 
 Options:
-  --server <url>           Feedback server URL
   --key <key>              API key
   --project <key>          Project key
   --create <name>          Create project with name
@@ -12744,9 +13327,10 @@ Options:
   --no-skills              Skip skills installation
   --no-design              Skip design token detection
   --source-map             Wire in the Vite plugin that stamps component source hashes
-  --scope <global|repo>    Where the API key is stored: global (default \u2014 this machine, all repos,
-                           ~/.config/pointer/credentials.json) or repo (.pinsay/credentials.env,
-                           gitignored, this repo only). --local-credentials is an alias for --scope repo
+  --scope <global|repo>    Where the API key is stored, without asking: global (this machine, all
+                           repos, ~/.config/pinsay/credentials.json; the default with --yes) or
+                           repo (.pinsay/credentials.env, hidden from git, this repo only).
+                           --local-credentials is an alias for --scope repo
   --no-browser             When signing in in the browser (first run, no key resolved yet), print
                            the link/code but don't try to open a browser
   -y, --yes                Non-interactive
@@ -12761,21 +13345,21 @@ Options:
       console.log(`
 Usage: npx pinsay-cli login [options]
 
-Authenticate once per machine and save the result to
-~/.config/pointer/credentials.json (honours $XDG_CONFIG_HOME / $PINSAY_CONFIG_DIR), keyed by
-server. Every repo on this machine then resolves a key for that server without being asked again.
+Sign in and save your API key. On a terminal it asks where to save it:
+  Global  this machine, every repo (~/.config/pinsay/credentials.json, honours $XDG_CONFIG_HOME)
+  Repo    .pinsay/credentials.env in this repo only (hidden from git)
+With no terminal (CI, a pipe) or with --yes it saves globally, unless --scope repo is given.
 
 With no --key on a real terminal, opens your browser to sign in (mirrors \`gh auth login\`): prints
 a link and a short code, waits for you to approve it in the dashboard, then saves the personal API
-key it hands back. Pass --key to skip the browser and validate a pasted key instead, unchanged from
-before.
+key it hands back. Pass --key to skip the browser and validate a pasted key instead.
 
 Options:
-  --server <url>          Server URL (default: this repo's .pinsay/config.json, then $PINSAY_SERVER)
   --key <key>             API key \u2014 skips the browser flow entirely
   --no-browser            Print the sign-in link/code but don't try to open a browser
-  --scope <global|repo>   global (default): save for every repo on this machine;
-                          repo: write .pinsay/credentials.env in the current repo only
+  --scope <global|repo>   Where to save the key, without asking
+  --local-credentials     Alias for --scope repo
+  -y, --yes               Don't ask; save globally unless --scope repo is given
   -h, --help              Show this help
 `);
       process.exit(0);
@@ -12786,10 +13370,9 @@ Options:
       console.log(`
 Usage: npx pinsay-cli logout [options]
 
-Removes this machine's saved global key for a server.
+Removes this machine's saved global key.
 
 Options:
-  --server <url>     Server URL (default: this repo's .pinsay/config.json, then $PINSAY_SERVER)
   --json             Emit { ok, server, removed } as JSON
   -h, --help         Show this help
 `);
@@ -12805,7 +13388,6 @@ Prints the server, the signed-in account, and which of env/repo/global answered
 never the key itself.
 
 Options:
-  --server <url>     Server URL (default: this repo's .pinsay/config.json, then $PINSAY_SERVER)
   --json             Emit { ok, server, displayName, email, source } as JSON
   -h, --help         Show this help
 `);
@@ -12820,7 +13402,6 @@ Usage: npx pinsay-cli doctor [options]
 Checks an existing install and prints one line per check.
 
 Options:
-  --server <url>     Override the server from .pinsay/config.json
   --project <key>    Override the project key
   --json             Emit { ok, checks } as JSON
   --fix              Apply the idempotent repairs (gitignore, skills, stack)
@@ -12836,7 +13417,6 @@ Exit codes:
       process.exit(0);
     }
     const code = await doctorCommand(cwd(), {
-      server: typeof parsed["server"] === "string" ? parsed["server"] : void 0,
       project: typeof parsed["project"] === "string" ? parsed["project"] : void 0,
       json: parsed["json"] === true,
       fix: parsed["fix"] === true,
@@ -12848,17 +13428,15 @@ Exit codes:
       console.log(`
 Usage: npx pinsay-cli update [options]
 
-Refreshes the AI skills and pinsay.sh from the configured server.
+Refreshes the AI skills and pinsay.sh from the server.
 
 Options:
-  --server <url>     Override the server from .pinsay/config.json
   --check            Report what is out of date without writing anything
   -h, --help         Show this help
 `);
       process.exit(0);
     }
     const code = await updateCommand(cwd(), {
-      server: typeof parsed["server"] === "string" ? parsed["server"] : void 0,
       check: parsed["check"] === true
     });
     process.exit(code);
@@ -12979,7 +13557,6 @@ Start the PinSay stdio MCP server for AI tools.
 
 Options:
   --log <file>       Log MCP server traffic to file
-  --server <url>     Feedback server URL
   --project <key>    Project key
   --key <key>        API key
   -h, --help         Show this help