quiver-cli 0.8.0 → 1.0.0

package/dist/cli.js

@@ -9,7 +9,7 @@ var __export = (target, all) => {
 };
 
 // src/ui/prompts.ts
-var clackPromise, warnedClackUnavailable, loadClack, QUIVER_ART, TAGLINE, colorEnabled, palette, block, banner, outro, step, info, success, warn, error, password, selectGrouped, selectGroupedText;
+var clackPromise, warnedClackUnavailable, loadClack, QUIVER_ART, TAGLINE, colorEnabled, palette, block, banner, outro, step, info, success, warn, error, selectGrouped, selectGroupedText;
 var init_prompts = __esm({
   "src/ui/prompts.ts"() {
     "use strict";
@@ -96,23 +96,6 @@ ${message}
       if (clack) clack.log.error(message);
       else console.error(message);
     };
-    password = async (message) => {
-      const clack = await loadClack();
-      if (clack) {
-        const value = await clack.password({ message });
-        if (clack.isCancel(value)) return null;
-        return value;
-      }
-      const { createInterface } = await import("readline");
-      const rl = createInterface({ input: process.stdin, output: process.stdout });
-      const answer = await new Promise((res) => {
-        rl.question(`${message}: `, (a) => {
-          rl.close();
-          res(a);
-        });
-      });
-      return answer.trim() || null;
-    };
     selectGrouped = async ({
       message,
       groups,
@@ -326,7 +309,7 @@ var init_frontmatter = __esm({
 // src/catalog/discover.ts
 import { existsSync, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
 import { relative as relative2, resolve as resolve2 } from "path";
-var readConfig, discoverSkills, discoverCommands, discoverMcp, loadCatalog;
+var readConfig, discoverSkills, discoverCommands, discoverMcp, discoverPlugins, loadCatalog;
 var init_discover = __esm({
   "src/catalog/discover.ts"() {
     "use strict";
@@ -400,6 +383,20 @@ var init_discover = __esm({
         configDigest: jsonDigest(servers[name])
       }));
     };
+    discoverPlugins = (root, config) => Object.entries(config.plugins ?? {}).sort(([a], [b]) => a.localeCompare(b)).map(([name, plugin]) => {
+      const absPath = resolve2(root, plugin.sourcePath);
+      if (!existsSync(absPath)) {
+        throw new Error(`Plugin "${name}" source not found: ${absPath}`);
+      }
+      return {
+        name,
+        provider: plugin.provider,
+        sourcePath: plugin.sourcePath,
+        absPath,
+        digest: jsonDigest({ config: plugin, content: fileDigest(absPath) }),
+        requires: plugin.requires ?? []
+      };
+    });
     loadCatalog = (catalog) => {
       const { config, path } = readConfig(catalog.root);
       return {
@@ -407,14 +404,15 @@ var init_discover = __esm({
         configPath: path,
         skills: discoverSkills(catalog.root),
         commands: discoverCommands(catalog.root),
-        mcp: discoverMcp(config)
+        mcp: discoverMcp(config),
+        plugins: discoverPlugins(catalog.root, config)
       };
     };
   }
 });
 
 // src/catalog/entries.ts
-var skillToEntry, commandToEntry, mcpToEntry;
+var skillToEntry, commandToEntry, mcpToEntry, pluginToEntry;
 var init_entries = __esm({
   "src/catalog/entries.ts"() {
     "use strict";
@@ -437,6 +435,13 @@ var init_entries = __esm({
       tools: null,
       toolsFetchedAt: null
     });
+    pluginToEntry = (plugin) => ({
+      type: "plugin",
+      provider: plugin.provider,
+      sourcePath: plugin.sourcePath,
+      digest: plugin.digest,
+      requires: plugin.requires
+    });
   }
 });
 
@@ -526,6 +531,12 @@ var init_materialize = __esm({
         mkdirSync(dirname(dest), { recursive: true });
         cpSync(command.absPath, dest, { force: true });
       }
+      for (const plugin of catalog.plugins) {
+        if (!selection.plugins.includes(plugin.name)) continue;
+        const dest = resolve4(destRoot, plugin.sourcePath);
+        mkdirSync(dirname(dest), { recursive: true });
+        cpSync(plugin.absPath, dest, { force: true });
+      }
       const filteredConfig = {};
       if (catalog.config.shared) filteredConfig["shared"] = catalog.config.shared;
       const mcpServers = {};
@@ -533,6 +544,14 @@ var init_materialize = __esm({
         if (selection.mcp.includes(mcp.name)) mcpServers[mcp.name] = mcp.server;
       }
       if (Object.keys(mcpServers).length) filteredConfig["mcpServers"] = mcpServers;
+      const plugins = {};
+      for (const plugin of catalog.plugins) {
+        if (!selection.plugins.includes(plugin.name)) continue;
+        plugins[plugin.name] = catalog.config.plugins?.[plugin.name];
+      }
+      if (Object.keys(plugins).length) filteredConfig["plugins"] = plugins;
+      if (catalog.config.opencode) filteredConfig["opencode"] = catalog.config.opencode;
+      if (catalog.config.tui) filteredConfig["tui"] = catalog.config.tui;
       if (catalog.config.claude) filteredConfig["claude"] = catalog.config.claude;
       writeFileSync(
         resolve4(destRoot, "config.json"),
@@ -568,53 +587,10 @@ var init_materialize = __esm({
 
 // src/github/auth.ts
 import { execFileSync } from "child_process";
-import {
-  chmodSync,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { homedir } from "os";
-import { resolve as resolve5 } from "path";
-var configDir, authFilePath, readAuthFile, readStoredToken, writeStoredToken, deleteStoredToken, cachedToken, ghToken, resolveGithubToken, resetTokenCache, validateToken;
+var cachedToken, ghToken, resolveGithubToken;
 var init_auth = __esm({
   "src/github/auth.ts"() {
     "use strict";
-    configDir = () => {
-      const base = process.env["XDG_CONFIG_HOME"] || resolve5(homedir(), ".config");
-      return resolve5(base, "quiver");
-    };
-    authFilePath = () => resolve5(configDir(), "auth.json");
-    readAuthFile = () => {
-      const path = authFilePath();
-      if (!existsSync4(path)) return null;
-      try {
-        return JSON.parse(readFileSync4(path, "utf8"));
-      } catch {
-        return null;
-      }
-    };
-    readStoredToken = () => readAuthFile()?.github?.token ?? null;
-    writeStoredToken = (token, login2) => {
-      mkdirSync2(configDir(), { recursive: true });
-      const file = {
-        github: { token, login: login2, createdAt: (/* @__PURE__ */ new Date()).toISOString() }
-      };
-      writeFileSync2(authFilePath(), JSON.stringify(file, null, 2) + "\n", {
-        mode: 384
-      });
-      chmodSync(authFilePath(), 384);
-      resetTokenCache();
-    };
-    deleteStoredToken = () => {
-      const path = authFilePath();
-      if (!existsSync4(path)) return false;
-      rmSync2(path);
-      resetTokenCache();
-      return true;
-    };
     ghToken = () => {
       try {
         const out = execFileSync("gh", ["auth", "token"], {
@@ -629,38 +605,14 @@ var init_auth = __esm({
     };
     resolveGithubToken = () => {
       if (cachedToken !== void 0) return cachedToken;
-      cachedToken = process.env["GITHUB_TOKEN"] ?? process.env["GH_TOKEN"] ?? readStoredToken() ?? ghToken();
+      cachedToken = process.env["GITHUB_TOKEN"] ?? process.env["GH_TOKEN"] ?? ghToken();
       return cachedToken;
     };
-    resetTokenCache = () => {
-      cachedToken = void 0;
-    };
-    validateToken = async (token) => {
-      let res;
-      try {
-        res = await fetch("https://api.github.com/user", {
-          headers: {
-            Accept: "application/vnd.github+json",
-            "User-Agent": "quiver-cli",
-            Authorization: `Bearer ${token}`
-          }
-        });
-      } catch (err) {
-        return {
-          ok: false,
-          reason: err instanceof Error ? err.message : "fetch failed"
-        };
-      }
-      if (res.status === 401) return { ok: false, reason: "token is invalid or expired" };
-      if (!res.ok) return { ok: false, reason: `HTTP ${res.status}` };
-      const body = await res.json();
-      return { ok: true, login: body.login ?? "unknown" };
-    };
   }
 });
 
 // src/github/api.ts
-import { mkdirSync as mkdirSync3 } from "fs";
+import { mkdirSync as mkdirSync2 } from "fs";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
 import * as tar from "tar";
@@ -678,13 +630,14 @@ var init_api = __esm({
       if (token) h["Authorization"] = `Bearer ${token}`;
       return h;
     };
-    failureReason = (status2) => {
-      if (status2 === 401) return "authentication failed - run `quiver-cli login` with a valid token";
-      if (status2 === 403 || status2 === 429)
-        return "rate-limited or access denied (run `quiver-cli login` or set GITHUB_TOKEN)";
-      if (status2 === 404)
-        return "repo or ref not found (private repo? run `quiver-cli login`)";
-      return `HTTP ${status2}`;
+    failureReason = (status) => {
+      if (status === 401)
+        return "authentication failed - set GITHUB_TOKEN or log in with the gh CLI";
+      if (status === 403 || status === 429)
+        return "rate-limited or access denied (set GITHUB_TOKEN or log in with the gh CLI)";
+      if (status === 404)
+        return "repo or ref not found (private repo? set GITHUB_TOKEN or log in with the gh CLI)";
+      return `HTTP ${status}`;
     };
     apiFetch = async (url) => {
       let res;
@@ -721,7 +674,7 @@ var init_api = __esm({
       );
       if (!res.ok) return res;
       if (!res.value.body) return { ok: false, reason: "empty tarball response" };
-      mkdirSync3(destDir, { recursive: true });
+      mkdirSync2(destDir, { recursive: true });
       try {
         await pipeline(
           Readable.fromWeb(res.value.body),
@@ -746,9 +699,9 @@ __export(remote_exports, {
   fetchRemoteCatalog: () => fetchRemoteCatalog,
   parseGithubSource: () => parseGithubSource
 });
-import { existsSync as existsSync5, mkdtempSync, renameSync, rmSync as rmSync3, mkdirSync as mkdirSync4 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, resolve as resolve6 } from "path";
+import { existsSync as existsSync4, mkdtempSync, renameSync, rmSync as rmSync2, mkdirSync as mkdirSync3 } from "fs";
+import { homedir } from "os";
+import { dirname as dirname2, resolve as resolve5 } from "path";
 var parseGithubSource, catalogCacheRoot, catalogCacheDir, fetchRemoteCatalog;
 var init_remote = __esm({
   "src/catalog/remote.ts"() {
@@ -771,10 +724,10 @@ var init_remote = __esm({
       return { repo: `${owner}/${repo}`, path: pathParts.join("/"), ref };
     };
     catalogCacheRoot = () => {
-      const base = process.env["XDG_CACHE_HOME"] || resolve6(homedir2(), ".cache");
-      return resolve6(base, "quiver", "catalogs");
+      const base = process.env["XDG_CACHE_HOME"] || resolve5(homedir(), ".cache");
+      return resolve5(base, "quiver", "catalogs");
     };
-    catalogCacheDir = (repo, sha) => resolve6(catalogCacheRoot(), `${repo.replace("/", "-")}-${sha.slice(0, 12)}`);
+    catalogCacheDir = (repo, sha) => resolve5(catalogCacheRoot(), `${repo.replace("/", "-")}-${sha.slice(0, 12)}`);
     fetchRemoteCatalog = async (source, options = {}) => {
       const spec = parseGithubSource(source);
       let ref = spec.ref;
@@ -794,22 +747,22 @@ var init_remote = __esm({
         sha = commit.value;
       }
       const cacheDir = catalogCacheDir(spec.repo, sha);
-      if (!existsSync5(cacheDir)) {
-        mkdirSync4(dirname2(cacheDir), { recursive: true });
+      if (!existsSync4(cacheDir)) {
+        mkdirSync3(dirname2(cacheDir), { recursive: true });
         const tmp = mkdtempSync(`${cacheDir}.tmp-`);
         const result = await downloadTarball(spec.repo, sha, tmp);
         if (!result.ok) {
-          rmSync3(tmp, { recursive: true, force: true });
+          rmSync2(tmp, { recursive: true, force: true });
           throw new Error(`Cannot download ${spec.repo}@${sha.slice(0, 12)}: ${result.reason}`);
         }
         try {
           renameSync(tmp, cacheDir);
         } catch {
-          rmSync3(tmp, { recursive: true, force: true });
+          rmSync2(tmp, { recursive: true, force: true });
         }
       }
-      const root = spec.path ? resolve6(cacheDir, spec.path) : cacheDir;
-      if (!existsSync5(root)) {
+      const root = spec.path ? resolve5(cacheDir, spec.path) : cacheDir;
+      if (!existsSync4(root)) {
         throw new Error(
           `Catalog path "${spec.path}" not found in ${spec.repo}@${sha.slice(0, 12)}.`
         );
@@ -820,21 +773,21 @@ var init_remote = __esm({
 });
 
 // src/catalog/resolve.ts
-import { accessSync, constants, existsSync as existsSync6 } from "fs";
-import { dirname as dirname3, relative as relative3, resolve as resolve7, sep } from "path";
+import { accessSync, constants, existsSync as existsSync5 } from "fs";
+import { dirname as dirname3, relative as relative3, resolve as resolve6, sep } from "path";
 import { fileURLToPath } from "url";
 var packageRoot, DEFAULT_CATALOG_SOURCE, resolveCatalog, isInstalledPackage, isBundledCatalog, isCatalogWritable;
 var init_resolve = __esm({
   "src/catalog/resolve.ts"() {
     "use strict";
-    packageRoot = resolve7(dirname3(fileURLToPath(import.meta.url)), "..");
+    packageRoot = resolve6(dirname3(fileURLToPath(import.meta.url)), "..");
     DEFAULT_CATALOG_SOURCE = "local:template/.agents";
     resolveCatalog = async (source = DEFAULT_CATALOG_SOURCE, options = {}) => {
       const [scheme, ...rest] = source.split(":");
       const spec = rest.join(":");
       if (scheme === "local") {
-        const root = resolve7(packageRoot, spec);
-        if (!existsSync6(root)) {
+        const root = resolve6(packageRoot, spec);
+        if (!existsSync5(root)) {
           throw new Error(`Catalog not found at ${root} (source: ${source}).`);
         }
         return { source, root };
@@ -879,7 +832,9 @@ var init_schema = __esm({
       if (idx === -1) return null;
       const type = id.slice(0, idx);
       const name = id.slice(idx + 1);
-      if (type !== "skill" && type !== "command" && type !== "mcp") return null;
+      if (type !== "skill" && type !== "command" && type !== "mcp" && type !== "plugin") {
+        return null;
+      }
       if (!name) return null;
       return { type, name };
     };
@@ -887,19 +842,19 @@ var init_schema = __esm({
 });
 
 // src/lockfile/io.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve8 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve7 } from "path";
 var lockfilePath, lockfileExists, readLockfile, writeLockfile, emptyLockfile;
 var init_io = __esm({
   "src/lockfile/io.ts"() {
     "use strict";
     init_schema();
-    lockfilePath = (targetRoot) => resolve8(targetRoot, LOCKFILE_NAME);
-    lockfileExists = (targetRoot) => existsSync7(lockfilePath(targetRoot));
+    lockfilePath = (targetRoot) => resolve7(targetRoot, LOCKFILE_NAME);
+    lockfileExists = (targetRoot) => existsSync6(lockfilePath(targetRoot));
     readLockfile = (targetRoot) => {
       const path = lockfilePath(targetRoot);
-      if (!existsSync7(path)) return null;
-      const parsed = JSON.parse(readFileSync5(path, "utf8"));
+      if (!existsSync6(path)) return null;
+      const parsed = JSON.parse(readFileSync4(path, "utf8"));
       if (parsed.version !== LOCKFILE_VERSION) {
         throw new Error(
           `Unsupported ${LOCKFILE_NAME} version ${parsed.version}; expected ${LOCKFILE_VERSION}.`
@@ -918,7 +873,7 @@ var init_io = __esm({
         ...lock.providers !== void 0 ? { providers: lock.providers } : {},
         entries: sortedEntries
       };
-      writeFileSync3(lockfilePath(targetRoot), JSON.stringify(ordered, null, 2) + "\n");
+      writeFileSync2(lockfilePath(targetRoot), JSON.stringify(ordered, null, 2) + "\n");
     };
     emptyLockfile = (catalogSource, remote = {}) => ({
       version: LOCKFILE_VERSION,
@@ -990,7 +945,7 @@ var init_resolve2 = __esm({
 });
 
 // src/providers/claude.ts
-import { resolve as resolve9 } from "path";
+import { resolve as resolve8 } from "path";
 var formatMcpJson, planClaude;
 var init_claude = __esm({
   "src/providers/claude.ts"() {
@@ -1005,33 +960,33 @@ var init_claude = __esm({
       const removeFiles = [];
       if (claudeSettings) {
         files.push({
-          path: resolve9(targetRoot, ".claude/settings.json"),
+          path: resolve8(targetRoot, ".claude/settings.json"),
           content: JSON.stringify(claudeSettings, null, 2) + "\n"
         });
       }
       const mcp = formatMcpJson(mcpServers);
-      const mcpPath = resolve9(targetRoot, ".mcp.json");
+      const mcpPath = resolve8(targetRoot, ".mcp.json");
       if (mcp) files.push({ path: mcpPath, content: mcp });
       else removeFiles.push(mcpPath);
       const skillNames = selected.skills.map((s) => s.name);
       const commandFiles = selected.commands.map((c) => `${c.name}.md`);
       const symlinks = [
         ...selected.skills.map((s) => ({
-          path: resolve9(targetRoot, ".claude/skills", s.name),
+          path: resolve8(targetRoot, ".claude/skills", s.name),
           target: s.absDir
         })),
         ...selected.commands.map((c) => ({
-          path: resolve9(targetRoot, ".claude/commands", `${c.name}.md`),
+          path: resolve8(targetRoot, ".claude/commands", `${c.name}.md`),
           target: c.absPath
         }))
       ];
       const managedDirs = [
         {
-          path: resolve9(targetRoot, ".claude/skills"),
+          path: resolve8(targetRoot, ".claude/skills"),
           expected: new Set(skillNames)
         },
         {
-          path: resolve9(targetRoot, ".claude/commands"),
+          path: resolve8(targetRoot, ".claude/commands"),
           expected: new Set(commandFiles)
         }
       ];
@@ -1041,7 +996,7 @@ var init_claude = __esm({
 });
 
 // src/providers/codex.ts
-import { resolve as resolve10 } from "path";
+import { resolve as resolve9 } from "path";
 import TOML from "@iarna/toml";
 var buildConfig, planCodex;
 var init_codex = __esm({
@@ -1085,7 +1040,7 @@ var init_codex = __esm({
       const files = [];
       const removeFiles = [];
       const config = buildConfig(rawMcpServers);
-      const path = resolve10(targetRoot, ".codex/config.toml");
+      const path = resolve9(targetRoot, ".codex/config.toml");
       if (config) {
         files.push({
           path,
@@ -1101,19 +1056,19 @@ var init_codex = __esm({
 
 // src/providers/fsops.ts
 import {
-  existsSync as existsSync8,
+  existsSync as existsSync7,
   lstatSync,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync4,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync5,
   readlinkSync,
   rmdirSync,
-  rmSync as rmSync4,
+  rmSync as rmSync3,
   symlinkSync,
   unlinkSync,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname4, relative as relative4, resolve as resolve11 } from "path";
+import { dirname as dirname4, relative as relative4, resolve as resolve10 } from "path";
 var isENOENT, isMatchingSymlink, removePath, applyOutputs, checkOutputs;
 var init_fsops = __esm({
   "src/providers/fsops.ts"() {
@@ -1122,7 +1077,7 @@ var init_fsops = __esm({
     isMatchingSymlink = (path, target) => {
       const stats = lstatSync(path);
       if (!stats.isSymbolicLink()) return false;
-      return resolve11(dirname4(path), readlinkSync(path)) === target;
+      return resolve10(dirname4(path), readlinkSync(path)) === target;
     };
     removePath = (path) => {
       let stats;
@@ -1133,7 +1088,7 @@ var init_fsops = __esm({
         throw e;
       }
       if (stats.isSymbolicLink()) unlinkSync(path);
-      else rmSync4(path, { force: true, recursive: true });
+      else rmSync3(path, { force: true, recursive: true });
     };
     applyOutputs = ({
       files,
@@ -1146,22 +1101,22 @@ var init_fsops = __esm({
       for (const out of files) {
         let current = null;
         try {
-          current = readFileSync6(out.path, "utf8");
+          current = readFileSync5(out.path, "utf8");
         } catch (e) {
           if (!isENOENT(e)) throw e;
         }
         if (current === out.content) continue;
-        mkdirSync5(dirname4(out.path), { recursive: true });
-        writeFileSync4(out.path, out.content);
+        mkdirSync4(dirname4(out.path), { recursive: true });
+        writeFileSync3(out.path, out.content);
         result.generated.push(out.path);
       }
       for (const path of removeFiles) {
-        if (!existsSync8(path)) continue;
-        rmSync4(path, { force: true });
+        if (!existsSync7(path)) continue;
+        rmSync3(path, { force: true });
         result.removed.push(path);
       }
       for (const path of removeDirs) {
-        if (!existsSync8(path)) continue;
+        if (!existsSync7(path)) continue;
         removePath(path);
         result.removed.push(path);
       }
@@ -1172,7 +1127,7 @@ var init_fsops = __esm({
         }
       }
       for (const link of symlinks) {
-        mkdirSync5(dirname4(link.path), { recursive: true });
+        mkdirSync4(dirname4(link.path), { recursive: true });
         try {
           if (isMatchingSymlink(link.path, link.target)) continue;
         } catch (e) {
@@ -1187,10 +1142,10 @@ var init_fsops = __esm({
         result.linked.push(link.path);
       }
       for (const dir of managedDirs) {
-        if (!existsSync8(dir.path)) continue;
+        if (!existsSync7(dir.path)) continue;
         for (const child of readdirSync3(dir.path)) {
           if (dir.expected.has(child)) continue;
-          const childPath = resolve11(dir.path, child);
+          const childPath = resolve10(dir.path, child);
           removePath(childPath);
           result.removed.push(childPath);
         }
@@ -1207,7 +1162,7 @@ var init_fsops = __esm({
       const problems = [];
       for (const out of files) {
         try {
-          if (readFileSync6(out.path, "utf8") !== out.content) {
+          if (readFileSync5(out.path, "utf8") !== out.content) {
             problems.push(`out of sync: ${out.path}`);
           }
         } catch (e) {
@@ -1216,10 +1171,10 @@ var init_fsops = __esm({
         }
       }
       for (const path of removeFiles) {
-        if (existsSync8(path)) problems.push(`stale (should be removed): ${path}`);
+        if (existsSync7(path)) problems.push(`stale (should be removed): ${path}`);
       }
       for (const path of removeDirs) {
-        if (existsSync8(path)) problems.push(`stale (should be removed): ${path}`);
+        if (existsSync7(path)) problems.push(`stale (should be removed): ${path}`);
       }
       for (const link of symlinks) {
         try {
@@ -1232,10 +1187,10 @@ var init_fsops = __esm({
         }
       }
       for (const dir of managedDirs) {
-        if (!existsSync8(dir.path)) continue;
+        if (!existsSync7(dir.path)) continue;
         for (const child of readdirSync3(dir.path)) {
           if (!dir.expected.has(child)) {
-            problems.push(`unexpected shim: ${resolve11(dir.path, child)}`);
+            problems.push(`unexpected shim: ${resolve10(dir.path, child)}`);
           }
         }
       }
@@ -1245,61 +1200,111 @@ var init_fsops = __esm({
 });
 
 // src/providers/opencode.ts
-import { resolve as resolve12 } from "path";
-var formatOpenCodeJson, planOpenCode;
+import { existsSync as existsSync8 } from "fs";
+import { resolve as resolve11 } from "path";
+var formatOpenCodeJson, preserveEnvReference, preserveEnvReferences, planOpenCode;
 var init_opencode = __esm({
   "src/providers/opencode.ts"() {
     "use strict";
-    formatOpenCodeJson = (servers) => {
-      if (Object.keys(servers).length === 0) return null;
+    formatOpenCodeJson = (servers, overlay) => {
+      if (Object.keys(servers).length === 0 && !overlay) return null;
       const mcp = {};
       for (const [name, server] of Object.entries(servers)) {
         if (server.transport === "http") {
           mcp[name] = {
             type: "remote",
-            url: server.url,
-            ...server.headers ? { headers: server.headers } : {}
+            url: preserveEnvReference(server.url),
+            ...server.headers ? { headers: preserveEnvReferences(server.headers) } : {}
           };
         } else {
           mcp[name] = {
             type: "local",
-            command: [server.command, ...server.args ?? []],
-            ...server.env ? { environment: server.env } : {}
+            command: [server.command, ...server.args ?? []].map(
+              preserveEnvReference
+            ),
+            ...server.env ? { environment: preserveEnvReferences(server.env) } : {}
           };
         }
       }
-      return JSON.stringify(
-        { $schema: "https://opencode.ai/config.json", mcp },
-        null,
-        2
-      ) + "\n";
-    };
+      const overlayMcp = overlay?.["mcp"] && typeof overlay["mcp"] === "object" ? overlay["mcp"] : {};
+      const mergedMcp = { ...overlayMcp, ...mcp };
+      const config = {
+        ...overlay,
+        $schema: "https://opencode.ai/config.json",
+        ...Object.keys(mergedMcp).length ? { mcp: mergedMcp } : {}
+      };
+      return JSON.stringify(config, null, 2) + "\n";
+    };
+    preserveEnvReference = (value) => value.replace(/\$\{([^}]+)\}/g, "{env:$1}");
+    preserveEnvReferences = (values) => Object.fromEntries(
+      Object.entries(values).map(([key, value]) => [
+        key,
+        preserveEnvReference(value)
+      ])
+    );
     planOpenCode = (inputs) => {
-      const { targetRoot, selected, mcpServers } = inputs;
+      const {
+        targetRoot,
+        selected,
+        rawMcpServers,
+        opencodeConfig,
+        tuiConfig
+      } = inputs;
       const files = [];
       const removeFiles = [];
-      const json = formatOpenCodeJson(mcpServers);
-      const jsonPath = resolve12(targetRoot, "opencode.json");
+      const json = formatOpenCodeJson(rawMcpServers, opencodeConfig);
+      const jsonPath = resolve11(targetRoot, "opencode.json");
       if (json) files.push({ path: jsonPath, content: json });
       else removeFiles.push(jsonPath);
+      const tuiPath = resolve11(targetRoot, ".opencode/tui.json");
+      const tuiMarkerPath = resolve11(targetRoot, ".opencode/.quiver-tui");
+      if (tuiConfig) {
+        files.push({
+          path: tuiPath,
+          content: JSON.stringify(
+            { ...tuiConfig, $schema: "https://opencode.ai/tui.json" },
+            null,
+            2
+          ) + "\n"
+        });
+        files.push({ path: tuiMarkerPath, content: "managed by quiver\n" });
+      } else if (existsSync8(tuiMarkerPath)) {
+        removeFiles.push(tuiPath, tuiMarkerPath);
+      }
       const symlinks = [
         ...selected.skills.map((s) => ({
-          path: resolve12(targetRoot, ".opencode/skills", s.name),
+          path: resolve11(targetRoot, ".opencode/skills", s.name),
           target: s.absDir
         })),
         ...selected.commands.map((c) => ({
-          path: resolve12(targetRoot, ".opencode/commands", `${c.name}.md`),
+          path: resolve11(targetRoot, ".opencode/commands", `${c.name}.md`),
           target: c.absPath
+        })),
+        ...selected.plugins.map((plugin) => ({
+          path: resolve11(
+            targetRoot,
+            ".opencode/plugins",
+            `${plugin.name}${plugin.absPath.endsWith(".js") ? ".js" : ".ts"}`
+          ),
+          target: plugin.absPath
         }))
       ];
       const managedDirs = [
         {
-          path: resolve12(targetRoot, ".opencode/skills"),
+          path: resolve11(targetRoot, ".opencode/skills"),
           expected: new Set(selected.skills.map((s) => s.name))
         },
         {
-          path: resolve12(targetRoot, ".opencode/commands"),
+          path: resolve11(targetRoot, ".opencode/commands"),
           expected: new Set(selected.commands.map((c) => `${c.name}.md`))
+        },
+        {
+          path: resolve11(targetRoot, ".opencode/plugins"),
+          expected: new Set(
+            selected.plugins.map(
+              (plugin) => `${plugin.name}${plugin.absPath.endsWith(".js") ? ".js" : ".ts"}`
+            )
+          )
         }
       ];
       return { files, removeFiles, symlinks, managedDirs };
@@ -1317,17 +1322,20 @@ var init_selection = __esm({
       const skillNames = /* @__PURE__ */ new Set();
       const commandNames = /* @__PURE__ */ new Set();
       const mcpNames = /* @__PURE__ */ new Set();
+      const pluginNames = /* @__PURE__ */ new Set();
       for (const id of Object.keys(lock.entries)) {
         const parsed = parseEntryId(id);
         if (!parsed) continue;
         if (parsed.type === "skill") skillNames.add(parsed.name);
         else if (parsed.type === "command") commandNames.add(parsed.name);
         else if (parsed.type === "mcp") mcpNames.add(parsed.name);
+        else if (parsed.type === "plugin") pluginNames.add(parsed.name);
       }
       return {
         skills: catalog.skills.filter((s) => skillNames.has(s.name)),
         commands: catalog.commands.filter((c) => commandNames.has(c.name)),
-        mcp: catalog.mcp.filter((m) => mcpNames.has(m.name))
+        mcp: catalog.mcp.filter((m) => mcpNames.has(m.name)),
+        plugins: catalog.plugins.filter((p) => pluginNames.has(p.name))
       };
     };
   }
@@ -1335,7 +1343,7 @@ var init_selection = __esm({
 
 // src/providers/write.ts
 import { existsSync as existsSync9, lstatSync as lstatSync2 } from "fs";
-import { basename, relative as relative5, resolve as resolve13 } from "path";
+import { basename, relative as relative5, resolve as resolve12 } from "path";
 var isLinkable, buildPlan, writeProviders, formatWriteResult, checkProviders;
 var init_write = __esm({
   "src/providers/write.ts"() {
@@ -1360,14 +1368,16 @@ var init_write = __esm({
       const rawMcpServers = {};
       for (const mcp of selected.mcp) rawMcpServers[mcp.name] = mcp.server;
       const mcpServers = interpolateEnvVars(rawMcpServers, onMissingEnv);
-      const agentsRoot = resolve13(targetRoot, ".agents");
+      const agentsRoot = resolve12(targetRoot, ".agents");
       const inputs = {
         targetRoot,
         agentsRoot,
         selected,
         mcpServers,
         rawMcpServers,
-        claudeSettings: catalog.config.claude?.settings ?? null
+        claudeSettings: catalog.config.claude?.settings ?? null,
+        opencodeConfig: catalog.config.opencode ?? null,
+        tuiConfig: catalog.config.tui ?? null
       };
       const active = lock.providers?.length ? lock.providers : [...PROVIDERS];
       const planByProvider = {
@@ -1391,12 +1401,12 @@ var init_write = __esm({
         }
       }
       const rootSymlinks = [];
-      const agentsMd = resolve13(agentsRoot, "AGENTS.md");
+      const agentsMd = resolve12(agentsRoot, "AGENTS.md");
       if (existsSync9(agentsMd)) {
-        const rootAgents = resolve13(targetRoot, "AGENTS.md");
+        const rootAgents = resolve12(targetRoot, "AGENTS.md");
         for (const link of [
           { path: rootAgents, target: agentsMd },
-          { path: resolve13(targetRoot, "CLAUDE.md"), target: rootAgents }
+          { path: resolve12(targetRoot, "CLAUDE.md"), target: rootAgents }
         ]) {
           if (isLinkable(link.path)) rootSymlinks.push(link);
           else onSkippedRootFile?.(basename(link.path));
@@ -1458,8 +1468,8 @@ var init_write = __esm({
 
 // src/commands/gitignore.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
-import { resolve as resolve14 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve13 } from "path";
 var HEADER, SECRETS_COMMENT, PROVIDER_ENTRIES, SHARED_ENTRIES, SECRET_ENTRIES, patchGitignore, ignoredSourcePaths;
 var init_gitignore = __esm({
   "src/commands/gitignore.ts"() {
@@ -1475,8 +1485,8 @@ var init_gitignore = __esm({
     SHARED_ENTRIES = ["AGENTS.md", "CLAUDE.md"];
     SECRET_ENTRIES = [".env.local"];
     patchGitignore = (targetRoot, providers2) => {
-      const path = resolve14(targetRoot, ".gitignore");
-      const current = existsSync10(path) ? readFileSync7(path, "utf8") : "";
+      const path = resolve13(targetRoot, ".gitignore");
+      const current = existsSync10(path) ? readFileSync6(path, "utf8") : "";
       const lines = new Set(current.split("\n").map((l) => l.trim()));
       const active = providers2?.length ? providers2 : [...PROVIDERS];
       const shimEntries = [
@@ -1490,7 +1500,7 @@ var init_gitignore = __esm({
       if (missingShims.length) block2.push(HEADER, ...missingShims);
       if (missingSecrets.length) block2.push(SECRETS_COMMENT, ...missingSecrets);
       const prefix = current && !current.endsWith("\n") ? "\n" : "";
-      writeFileSync5(
+      writeFileSync4(
         path,
         current + prefix + (current ? "\n" : "") + block2.join("\n") + "\n"
       );
@@ -1535,12 +1545,24 @@ var init_select = __esm({
       const s = entry.server;
       return s.transport === "http" ? s.url : [s.command, ...s.args ?? []].filter(Boolean).join(" ");
     };
-    selectFromCatalog = async (catalog, { interactive }) => {
+    selectFromCatalog = async (catalog, {
+      interactive,
+      providers: providers2
+    }) => {
       const allSkills = catalog.skills.map((s) => s.name);
       const allCommands = catalog.commands.map((c) => c.name);
       const allMcp = catalog.mcp.map((m) => m.name);
+      const availablePlugins = catalog.plugins.filter(
+        (plugin) => providers2.includes(plugin.provider)
+      );
+      const allPlugins = availablePlugins.map((p) => p.name);
       if (!interactive || !process.stdin.isTTY) {
-        return { skills: allSkills, commands: allCommands, mcp: allMcp };
+        return {
+          skills: allSkills,
+          commands: allCommands,
+          mcp: allMcp,
+          plugins: allPlugins
+        };
       }
       const groupNames = [...new Set(catalog.skills.map((s) => s.group))].sort(
         (a, b) => a === "general" ? -1 : b === "general" ? 1 : a.localeCompare(b)
@@ -1595,7 +1617,21 @@ var init_select = __esm({
         groups: mcpGroups,
         initialValues: []
       }) : [];
-      return { skills, commands, mcp };
+      const plugins = availablePlugins.length ? await selectGrouped({
+        message: "Select plugins (space toggles, a all, enter confirms)",
+        groups: [
+          {
+            name: "opencode",
+            items: availablePlugins.map((plugin) => ({
+              value: plugin.name,
+              label: plugin.name,
+              hint: plugin.requires.length ? `requires: ${plugin.requires.join(", ")}` : void 0
+            }))
+          }
+        ],
+        initialValues: []
+      }) : [];
+      return { skills, commands, mcp, plugins };
     };
   }
 });
@@ -1637,11 +1673,12 @@ var init_init = __esm({
         );
       }
       const sourceCatalog = loadCatalog(source);
-      const selection = await selectFromCatalog(sourceCatalog, {
-        interactive: !options.all
-      });
       const providers2 = await resolveProviders(options);
       if (providers2 === null) return;
+      const selection = await selectFromCatalog(sourceCatalog, {
+        interactive: !options.all,
+        providers: providers2
+      });
       const resolved = materializeCatalog(
         options.targetRoot,
         source,
@@ -1669,9 +1706,14 @@ var init_init = __esm({
           lock.entries[entryId("mcp", mcp.name)] = mcpToEntry(mcp);
         }
       }
+      for (const plugin of catalog.plugins) {
+        if (selection.plugins.includes(plugin.name)) {
+          lock.entries[entryId("plugin", plugin.name)] = pluginToEntry(plugin);
+        }
+      }
       writeLockfile(options.targetRoot, lock);
       await step(
-        `Wrote quiver.lock (${selection.skills.length} skills, ${selection.commands.length} commands, ${selection.mcp.length} MCP servers)`
+        `Wrote quiver.lock (${selection.skills.length} skills, ${selection.commands.length} commands, ${selection.mcp.length} MCP servers, ${selection.plugins.length} plugins)`
       );
       const result = writeProviders(options.targetRoot, catalog, lock);
       if (result.generated.length || result.linked.length) {
@@ -1706,13 +1748,13 @@ var init_init = __esm({
 
 // src/catalog/repo.ts
 import { existsSync as existsSync11 } from "fs";
-import { resolve as resolve15 } from "path";
+import { resolve as resolve14 } from "path";
 var repoCatalogRoot, repoCatalogExists, loadRepoCatalog;
 var init_repo = __esm({
   "src/catalog/repo.ts"() {
     "use strict";
     init_discover();
-    repoCatalogRoot = (targetRoot) => resolve15(targetRoot, ".agents");
+    repoCatalogRoot = (targetRoot) => resolve14(targetRoot, ".agents");
     repoCatalogExists = (targetRoot) => existsSync11(repoCatalogRoot(targetRoot));
     loadRepoCatalog = (targetRoot, source) => {
       const resolved = {
@@ -1745,13 +1787,17 @@ var init_add = __esm({
     add = async (options) => {
       const id = options.positionals[0];
       if (!id) {
-        await error("Usage: quiver-cli add <skill:name|command:name|mcp:name>");
+        await error(
+          "Usage: quiver-cli add <skill:name|command:name|mcp:name|plugin:name>"
+        );
         process.exitCode = 1;
         return;
       }
       const parsed = parseEntryId(id);
       if (!parsed) {
-        await error(`Invalid id "${id}". Expected skill:<name>, command:<name> or mcp:<name>.`);
+        await error(
+          `Invalid id "${id}". Expected skill:<name>, command:<name>, mcp:<name> or plugin:<name>.`
+        );
         process.exitCode = 1;
         return;
       }
@@ -1772,16 +1818,25 @@ var init_add = __esm({
       const skill = sourceCatalog.skills.find((s) => s.name === parsed.name);
       const command = sourceCatalog.commands.find((c) => c.name === parsed.name);
       const mcp = sourceCatalog.mcp.find((m) => m.name === parsed.name);
-      const entry = parsed.type === "skill" && skill ? skillToEntry(skill) : parsed.type === "command" && command ? commandToEntry(command) : parsed.type === "mcp" && mcp ? mcpToEntry(mcp) : null;
+      const plugin = sourceCatalog.plugins.find((p) => p.name === parsed.name);
+      const entry = parsed.type === "skill" && skill ? skillToEntry(skill) : parsed.type === "command" && command ? commandToEntry(command) : parsed.type === "mcp" && mcp ? mcpToEntry(mcp) : parsed.type === "plugin" && plugin ? pluginToEntry(plugin) : null;
       if (!entry) {
         await error(`${id} not found in catalog.`);
         process.exitCode = 1;
         return;
       }
+      if (entry.type === "plugin" && lock.providers?.length && !lock.providers.includes(entry.provider)) {
+        await error(
+          `${id} requires the ${entry.provider} provider. Enable it with \`quiver-cli providers ${entry.provider}\` first.`
+        );
+        process.exitCode = 1;
+        return;
+      }
       const selection = selectionFromLock(lock);
       if (parsed.type === "skill") selection.skills.push(parsed.name);
       if (parsed.type === "command") selection.commands.push(parsed.name);
       if (parsed.type === "mcp") selection.mcp.push(parsed.name);
+      if (parsed.type === "plugin") selection.plugins.push(parsed.name);
       materializeCatalog(options.targetRoot, source, sourceCatalog, selection);
       lock.entries[id] = entry;
       writeLockfile(options.targetRoot, lock);
@@ -1790,13 +1845,19 @@ var init_add = __esm({
       await success(`Added ${id}.`);
     };
     selectionFromLock = (lock) => {
-      const selection = { skills: [], commands: [], mcp: [] };
+      const selection = {
+        skills: [],
+        commands: [],
+        mcp: [],
+        plugins: []
+      };
       for (const lid of Object.keys(lock.entries)) {
         const p = parseEntryId(lid);
         if (!p) continue;
         if (p.type === "skill") selection.skills.push(p.name);
         else if (p.type === "command") selection.commands.push(p.name);
         else if (p.type === "mcp") selection.mcp.push(p.name);
+        else if (p.type === "plugin") selection.plugins.push(p.name);
       }
       return selection;
     };
@@ -1808,9 +1869,9 @@ var remove_exports = {};
 __export(remove_exports, {
   remove: () => remove
 });
-import { existsSync as existsSync12, readdirSync as readdirSync4, readFileSync as readFileSync8, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
-import { resolve as resolve16 } from "path";
-var remove, cleanupEmptyGroups, rewriteRepoMcp;
+import { existsSync as existsSync12, readdirSync as readdirSync4, readFileSync as readFileSync7, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
+import { resolve as resolve15 } from "path";
+var remove, rewriteRepoPlugins, cleanupEmptyGroups, rewriteRepoMcp;
 var init_remove = __esm({
   "src/commands/remove.ts"() {
     "use strict";
@@ -1823,7 +1884,9 @@ var init_remove = __esm({
     remove = async (options) => {
       const id = options.positionals[0];
       if (!id) {
-        await error("Usage: quiver remove <skill:name|command:name|mcp:name>");
+        await error(
+          "Usage: quiver remove <skill:name|command:name|mcp:name|plugin:name>"
+        );
         process.exitCode = 1;
         return;
       }
@@ -1844,31 +1907,46 @@ var init_remove = __esm({
         await info(`${id} is not installed.`);
         return;
       }
-      if (entry.type === "skill" || entry.type === "command") {
+      if (entry.type === "skill" || entry.type === "command" || entry.type === "plugin") {
         removeArtifact(options.targetRoot, entry.sourcePath);
         cleanupEmptyGroups(options.targetRoot);
       }
       delete lock.entries[id];
       writeLockfile(options.targetRoot, lock);
       rewriteRepoMcp(options.targetRoot, lock);
+      rewriteRepoPlugins(options.targetRoot, lock);
       const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
       writeProviders(options.targetRoot, catalog, lock);
       await success(`Removed ${id}.`);
     };
+    rewriteRepoPlugins = (targetRoot, lock) => {
+      const configPath = resolve15(targetRoot, ".agents/config.json");
+      if (!existsSync12(configPath)) return;
+      const config = JSON.parse(readFileSync7(configPath, "utf8"));
+      if (!config.plugins) return;
+      const keep = new Set(
+        Object.keys(lock.entries).map(parseEntryId).filter((p) => p?.type === "plugin").map((p) => p.name)
+      );
+      config.plugins = Object.fromEntries(
+        Object.entries(config.plugins).filter(([name]) => keep.has(name))
+      );
+      if (!Object.keys(config.plugins).length) delete config.plugins;
+      writeFileSync5(configPath, JSON.stringify(config, null, 2) + "\n");
+    };
     cleanupEmptyGroups = (targetRoot) => {
-      const skillsRoot = resolve16(targetRoot, ".agents/skills");
+      const skillsRoot = resolve15(targetRoot, ".agents/skills");
       if (!existsSync12(skillsRoot)) return;
       for (const entry of readdirSync4(skillsRoot, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
-        const dir = resolve16(skillsRoot, entry.name);
-        if (existsSync12(resolve16(dir, "SKILL.md"))) continue;
-        if (readdirSync4(dir).length === 0) rmSync5(dir, { recursive: true, force: true });
+        const dir = resolve15(skillsRoot, entry.name);
+        if (existsSync12(resolve15(dir, "SKILL.md"))) continue;
+        if (readdirSync4(dir).length === 0) rmSync4(dir, { recursive: true, force: true });
       }
     };
     rewriteRepoMcp = (targetRoot, lock) => {
-      const configPath = resolve16(targetRoot, ".agents/config.json");
+      const configPath = resolve15(targetRoot, ".agents/config.json");
       if (!existsSync12(configPath)) return;
-      const config = JSON.parse(readFileSync8(configPath, "utf8"));
+      const config = JSON.parse(readFileSync7(configPath, "utf8"));
       if (!config.mcpServers) return;
       const keep = new Set(
         Object.keys(lock.entries).map(parseEntryId).filter((p) => p?.type === "mcp").map((p) => p.name)
@@ -1879,7 +1957,7 @@ var init_remove = __esm({
       }
       if (Object.keys(kept).length) config.mcpServers = kept;
       else delete config.mcpServers;
-      writeFileSync6(configPath, JSON.stringify(config, null, 2) + "\n");
+      writeFileSync5(configPath, JSON.stringify(config, null, 2) + "\n");
     };
   }
 });
@@ -1894,6 +1972,7 @@ var init_locksync = __esm({
       const skillByName = new Map(catalog.skills.map((s) => [s.name, s]));
       const commandByName = new Map(catalog.commands.map((c) => [c.name, c]));
       const mcpByName = new Map(catalog.mcp.map((m) => [m.name, m]));
+      const pluginByName = new Map(catalog.plugins.map((p) => [p.name, p]));
       for (const [id, entry] of Object.entries(lock.entries)) {
         if (entry.type === "skill") {
           const cat = skillByName.get(id.slice("skill:".length));
@@ -1918,6 +1997,15 @@ var init_locksync = __esm({
             entry.configDigest = cat.configDigest;
             entry.transport = cat.server.transport;
           }
+        } else if (entry.type === "plugin") {
+          const cat = pluginByName.get(id.slice("plugin:".length));
+          if (!cat) continue;
+          if (cat.digest !== entry.digest) {
+            drift.push(`${id}: plugin content changed`);
+            entry.digest = cat.digest;
+            entry.sourcePath = cat.sourcePath;
+            entry.requires = cat.requires;
+          }
         }
       }
       return drift;
@@ -1975,11 +2063,12 @@ var init_sync = __esm({
       const haveSkills = new Set(catalog.skills.map((s) => s.name));
       const haveCommands = new Set(catalog.commands.map((c) => c.name));
       const haveMcp = new Set(catalog.mcp.map((m) => m.name));
+      const havePlugins = new Set(catalog.plugins.map((p) => p.name));
       const orphans = [];
       for (const id of Object.keys(lock.entries)) {
         const p = parseEntryId(id);
         if (!p) continue;
-        const present = p.type === "skill" && haveSkills.has(p.name) || p.type === "command" && haveCommands.has(p.name) || p.type === "mcp" && haveMcp.has(p.name);
+        const present = p.type === "skill" && haveSkills.has(p.name) || p.type === "command" && haveCommands.has(p.name) || p.type === "mcp" && haveMcp.has(p.name) || p.type === "plugin" && havePlugins.has(p.name);
         if (!present) orphans.push(id);
       }
       if (orphans.length) {
@@ -2085,8 +2174,8 @@ var update_exports = {};
 __export(update_exports, {
   update: () => update
 });
-import { cpSync as cpSync2, mkdirSync as mkdirSync6, readFileSync as readFileSync9, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname5, resolve as resolve17 } from "path";
+import { cpSync as cpSync2, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, resolve as resolve16 } from "path";
 var update, applyUpdate, report;
 var init_update = __esm({
   "src/commands/update.ts"() {
@@ -2142,21 +2231,27 @@ var init_update = __esm({
           sourceCatalog,
           repoCatalog,
           lock,
-          options.force
+          options.force,
+          options.dryRun
         );
         if (report4.status === "updated") changed = true;
         reports.push(report4);
       }
-      if (changed || catalogMoved) {
-        writeLockfile(options.targetRoot, lock);
-      }
-      if (changed) {
-        const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
-        writeProviders(options.targetRoot, catalog, lock);
+      if (!options.dryRun) {
+        if (changed || catalogMoved) {
+          writeLockfile(options.targetRoot, lock);
+        }
+        if (changed) {
+          const { catalog } = loadRepoCatalog(
+            options.targetRoot,
+            lock.catalog.source
+          );
+          writeProviders(options.targetRoot, catalog, lock);
+        }
       }
       report(reports, options);
     };
-    applyUpdate = (targetRoot, parsed, entry, sourceCatalog, repoCatalog, lock, force) => {
+    applyUpdate = (targetRoot, parsed, entry, sourceCatalog, repoCatalog, lock, force, dryRun) => {
       const id = `${parsed.type}:${parsed.name}`;
       if (entry.type === "skill") {
         const src2 = sourceCatalog.skills.find((s) => s.name === parsed.name);
@@ -2166,9 +2261,10 @@ var init_update = __esm({
         if (repo2 && repo2.digest !== entry.digest && !force) {
           return { id, status: "local-changes" };
         }
-        const dest = resolve17(targetRoot, ".agents", src2.sourcePath);
-        rmSync6(dest, { recursive: true, force: true });
-        mkdirSync6(dirname5(dest), { recursive: true });
+        if (dryRun) return { id, status: "updated" };
+        const dest = resolve16(targetRoot, ".agents", src2.sourcePath);
+        rmSync5(dest, { recursive: true, force: true });
+        mkdirSync5(dirname5(dest), { recursive: true });
         cpSync2(src2.absDir, dest, { recursive: true });
         entry.digest = src2.digest;
         entry.frontmatter = src2.frontmatter;
@@ -2183,13 +2279,38 @@ var init_update = __esm({
         if (repo2 && repo2.digest !== entry.digest && !force) {
           return { id, status: "local-changes" };
         }
-        const dest = resolve17(targetRoot, ".agents", src2.sourcePath);
-        mkdirSync6(dirname5(dest), { recursive: true });
+        if (dryRun) return { id, status: "updated" };
+        const dest = resolve16(targetRoot, ".agents", src2.sourcePath);
+        mkdirSync5(dirname5(dest), { recursive: true });
         cpSync2(src2.absPath, dest, { force: true });
         entry.digest = src2.digest;
         entry.sourcePath = src2.sourcePath;
         return { id, status: "updated" };
       }
+      if (entry.type === "plugin") {
+        const src2 = sourceCatalog.plugins.find((p) => p.name === parsed.name);
+        if (!src2) return { id, status: "not-in-catalog" };
+        if (src2.digest === entry.digest) return { id, status: "up-to-date" };
+        const repo2 = repoCatalog.plugins.find((p) => p.name === parsed.name);
+        if (repo2 && repo2.digest !== entry.digest && !force) {
+          return { id, status: "local-changes" };
+        }
+        if (dryRun) return { id, status: "updated" };
+        const dest = resolve16(targetRoot, ".agents", src2.sourcePath);
+        mkdirSync5(dirname5(dest), { recursive: true });
+        cpSync2(src2.absPath, dest, { force: true });
+        const configPath2 = resolve16(targetRoot, ".agents/config.json");
+        const config2 = JSON.parse(readFileSync8(configPath2, "utf8"));
+        config2.plugins = {
+          ...config2.plugins,
+          [parsed.name]: sourceCatalog.config.plugins?.[parsed.name]
+        };
+        writeFileSync6(configPath2, JSON.stringify(config2, null, 2) + "\n");
+        entry.digest = src2.digest;
+        entry.sourcePath = src2.sourcePath;
+        entry.requires = src2.requires;
+        return { id, status: "updated" };
+      }
       const src = sourceCatalog.mcp.find((m) => m.name === parsed.name);
       if (!src) return { id, status: "not-in-catalog" };
       if (src.configDigest === entry.configDigest) return { id, status: "up-to-date" };
@@ -2197,10 +2318,11 @@ var init_update = __esm({
       if (repo && repo.configDigest !== entry.configDigest && !force) {
         return { id, status: "local-changes" };
       }
-      const configPath = resolve17(targetRoot, ".agents", "config.json");
-      const config = JSON.parse(readFileSync9(configPath, "utf8"));
+      if (dryRun) return { id, status: "updated" };
+      const configPath = resolve16(targetRoot, ".agents", "config.json");
+      const config = JSON.parse(readFileSync8(configPath, "utf8"));
       config.mcpServers = { ...config.mcpServers, [parsed.name]: src.server };
-      writeFileSync7(configPath, JSON.stringify(config, null, 2) + "\n");
+      writeFileSync6(configPath, JSON.stringify(config, null, 2) + "\n");
       entry.configDigest = src.configDigest;
       entry.transport = src.server.transport;
       entry.tools = null;
@@ -2214,6 +2336,7 @@ var init_update = __esm({
           JSON.stringify(
             {
               ok: true,
+              dryRun: options.dryRun,
               updated: by("updated").map((r) => r.id),
               upToDate: by("up-to-date").map((r) => r.id),
               localChanges: by("local-changes").map((r) => r.id),
@@ -2227,7 +2350,8 @@ var init_update = __esm({
       }
       const c = palette();
       const lines = [""];
-      for (const r of by("updated")) lines.push(`  ${c.cyan("\u2191")} ${r.id}  updated`);
+      const verb = options.dryRun ? "would update" : "updated";
+      for (const r of by("updated")) lines.push(`  ${c.cyan("\u2191")} ${r.id}  ${verb}`);
       for (const r of by("local-changes"))
         lines.push(
           `  ${c.yellow("\u25B2")} ${r.id}  ${c.yellow("local changes - skipped (use --force)")}`
@@ -2239,7 +2363,11 @@ var init_update = __esm({
       const updated = by("updated").length;
       lines.push(
         "",
-        `  ${updated ? c.cyan(`\u2191 ${updated} updated - review and commit .agents/ + quiver.lock`) : c.green("\u2713 everything up to date with the catalog")}`,
+        `  ${updated ? options.dryRun ? c.cyan(
+          `\u2191 ${updated} would be updated - run without --dry-run to apply`
+        ) : c.cyan(
+          `\u2191 ${updated} updated - review and commit .agents/ + quiver.lock`
+        ) : c.green("\u2713 everything up to date with the catalog")}`,
         ""
       );
       block(lines);
@@ -2287,14 +2415,16 @@ var init_list = __esm({
       const skills = [];
       const commands = [];
       const mcp = [];
+      const plugins = [];
       for (const [id, entry] of Object.entries(lock.entries)) {
         const p = parseEntryId(id);
         if (!p) continue;
         if (entry.type === "skill") skills.push({ name: p.name, entry });
         else if (entry.type === "command") commands.push({ name: p.name, entry });
         else if (entry.type === "mcp") mcp.push({ name: p.name, entry });
+        else if (entry.type === "plugin") plugins.push({ name: p.name, entry });
       }
-      for (const group of [skills, commands, mcp]) {
+      for (const group of [skills, commands, mcp, plugins]) {
         group.sort((a, b) => a.name.localeCompare(b.name));
       }
       if (options.json) {
@@ -2313,6 +2443,11 @@ var init_list = __esm({
                 transport: entry.transport,
                 detail: serverDetail2.get(name) ?? null,
                 toolCount: entry.tools ? Object.keys(entry.tools).length : null
+              })),
+              plugins: plugins.map(({ name, entry }) => ({
+                name,
+                provider: entry.provider,
+                requires: entry.requires
               }))
             },
             null,
@@ -2370,11 +2505,18 @@ var init_list = __esm({
           );
         }
       }
+      if (plugins.length) {
+        lines.push("", `  ${c.bold("plugins")}`);
+        for (const { name, entry } of plugins) {
+          const requires = entry.requires.length ? `  ${c.dim(`requires: ${entry.requires.join(", ")}`)}` : "";
+          lines.push(`    ${name} ${c.dim(entry.provider)}${requires}`);
+        }
+      }
       const providers2 = lock.providers?.length ? lock.providers.join(", ") : "claude, opencode, codex";
       lines.push(
         "",
         `  ${c.bold(
-          `${skills.length} skills \xB7 ${commands.length} commands \xB7 ${mcp.length} MCP servers`
+          `${skills.length} skills \xB7 ${commands.length} commands \xB7 ${mcp.length} MCP servers \xB7 ${plugins.length} plugins`
         )}  ${c.dim(`providers: ${providers2}`)}`
       );
       if (missingTools) {
@@ -2386,84 +2528,6 @@ var init_list = __esm({
   }
 });
 
-// src/commands/status.ts
-var status_exports = {};
-__export(status_exports, {
-  status: () => status
-});
-var status;
-var init_status = __esm({
-  "src/commands/status.ts"() {
-    "use strict";
-    init_repo();
-    init_io();
-    init_schema();
-    init_write();
-    init_prompts();
-    status = async (options) => {
-      const lock = readLockfile(options.targetRoot);
-      if (!lock) {
-        if (options.json) console.log(JSON.stringify({ ok: false, error: "no-lockfile" }));
-        else await error("No quiver.lock found. Run `quiver-cli init` first.");
-        process.exitCode = 1;
-        return;
-      }
-      if (!repoCatalogExists(options.targetRoot)) {
-        if (options.json) console.log(JSON.stringify({ ok: false, error: "no-agents" }));
-        else await error("No .agents/ directory found. Run `quiver-cli init` first.");
-        process.exitCode = 1;
-        return;
-      }
-      const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
-      const haveSkills = new Set(catalog.skills.map((s) => s.name));
-      const haveCommands = new Set(catalog.commands.map((c) => c.name));
-      const haveMcp = new Set(catalog.mcp.map((m) => m.name));
-      const missing = [];
-      const changed = [];
-      const skillByName = new Map(catalog.skills.map((s) => [s.name, s]));
-      const commandByName = new Map(catalog.commands.map((c) => [c.name, c]));
-      const mcpByName = new Map(catalog.mcp.map((m) => [m.name, m]));
-      for (const [id, entry] of Object.entries(lock.entries)) {
-        const p = parseEntryId(id);
-        if (!p) continue;
-        if (p.type === "skill") {
-          if (!haveSkills.has(p.name)) missing.push(id);
-          else if (entry.type === "skill" && skillByName.get(p.name).digest !== entry.digest)
-            changed.push(id);
-        } else if (p.type === "command") {
-          if (!haveCommands.has(p.name)) missing.push(id);
-          else if (entry.type === "command" && commandByName.get(p.name).digest !== entry.digest)
-            changed.push(id);
-        } else if (p.type === "mcp") {
-          if (!haveMcp.has(p.name)) missing.push(id);
-          else if (entry.type === "mcp" && mcpByName.get(p.name).configDigest !== entry.configDigest)
-            changed.push(id);
-        }
-      }
-      const shimProblems = checkProviders(options.targetRoot, catalog, lock);
-      const ok = missing.length === 0 && changed.length === 0 && shimProblems.length === 0;
-      if (options.json) {
-        console.log(JSON.stringify({ ok, missing, changed, shims: shimProblems }, null, 2));
-        if (!ok) process.exitCode = 1;
-        return;
-      }
-      if (ok) {
-        await success("In sync: lockfile, .agents/ and provider shims agree.");
-        return;
-      }
-      if (missing.length)
-        await warn(`Missing in .agents/: ${missing.join(", ")}`);
-      if (changed.length)
-        await warn(`Content changed since lockfile: ${changed.join(", ")}`);
-      if (shimProblems.length)
-        await warn(`Provider shims out of date:
-  - ${shimProblems.join("\n  - ")}`);
-      await info("Run `quiver-cli sync` to regenerate provider shims and refresh digests.");
-      process.exitCode = 1;
-    };
-  }
-});
-
 // src/mcp/diff.ts
 var diffSnapshots, isEmptyDiff;
 var init_diff = __esm({
@@ -2598,9 +2662,12 @@ var init_snapshot = __esm({
 var check_exports = {};
 __export(check_exports, {
   check: () => check,
+  hasCommand: () => hasCommand,
   summarize: () => summarize
 });
-var check, report2, driftLines, list2, recommend, summarize, truncate2, fail;
+import { accessSync as accessSync2, constants as constants2 } from "fs";
+import { delimiter, resolve as resolve17 } from "path";
+var check, report2, driftLines, list2, recommend, summarize, hasCommand, truncate2, fail;
 var init_check = __esm({
   "src/commands/check.ts"() {
     "use strict";
@@ -2610,6 +2677,7 @@ var init_check = __esm({
     init_diff();
     init_introspect();
     init_snapshot();
+    init_write();
     init_interpolate();
     init_prompts();
     check = async (options) => {
@@ -2624,8 +2692,10 @@ var init_check = __esm({
       const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
       const skillByName = new Map(catalog.skills.map((s) => [s.name, s]));
       const commandByName = new Map(catalog.commands.map((c) => [c.name, c]));
+      const pluginByName = new Map(catalog.plugins.map((p) => [p.name, p]));
       const skillDrift = [];
-      const checked = { skills: 0, commands: 0, mcp: 0 };
+      const pluginRequirements = [];
+      const checked = { skills: 0, commands: 0, mcp: 0, plugins: 0 };
       for (const [id, entry] of Object.entries(lock.entries)) {
         const p = parseEntryId(id);
         if (!p) continue;
@@ -2639,11 +2709,24 @@ var init_check = __esm({
           if (!cat) continue;
           checked.commands += 1;
           if (cat.digest !== entry.digest) skillDrift.push({ id, kind: "content" });
+        } else if (entry.type === "plugin") {
+          const cat = pluginByName.get(p.name);
+          if (!cat) continue;
+          checked.plugins += 1;
+          if (cat.digest !== entry.digest) skillDrift.push({ id, kind: "content" });
+          if (lock.providers?.length && !lock.providers.includes(entry.provider)) {
+            continue;
+          }
+          for (const command of entry.requires) {
+            if (!hasCommand(command)) pluginRequirements.push({ id, command });
+          }
         }
       }
+      const shimProblems = checkProviders(options.targetRoot, catalog, lock);
       const mcpReports = [];
       let lockChanged = false;
       for (const [id, entry] of Object.entries(lock.entries)) {
+        if (options.offline) break;
         if (entry.type !== "mcp") continue;
         const p = parseEntryId(id);
         const catMcp = catalog.mcp.find((m) => m.name === p.name);
@@ -2677,11 +2760,18 @@ var init_check = __esm({
         }
       }
       if (lockChanged) writeLockfile(options.targetRoot, lock);
-      const hasDrift = skillDrift.length > 0 || mcpReports.some((r) => r.status === "drift");
+      const hasDrift = skillDrift.length > 0 || pluginRequirements.length > 0 || shimProblems.length > 0 || mcpReports.some((r) => r.status === "drift");
       if (options.json) {
         console.log(
           JSON.stringify(
-            { ok: !hasDrift, checked, skillDrift, mcp: mcpReports },
+            {
+              ok: !hasDrift,
+              checked,
+              skillDrift,
+              pluginRequirements,
+              shims: shimProblems,
+              mcp: mcpReports
+            },
             null,
             2
           )
@@ -2689,16 +2779,35 @@ var init_check = __esm({
         if (hasDrift) process.exitCode = 1;
         return;
       }
-      await report2(skillDrift, mcpReports, checked, options);
+      await report2(
+        skillDrift,
+        pluginRequirements,
+        shimProblems,
+        mcpReports,
+        checked,
+        options
+      );
       if (hasDrift) process.exitCode = 1;
     };
-    report2 = async (skillDrift, mcpReports, checked, options) => {
+    report2 = async (skillDrift, pluginRequirements, shimProblems, mcpReports, checked, options) => {
       if (skillDrift.length) {
         await warn(
-          `Skill/command content changed since lockfile:
+          `Managed content changed since lockfile:
   - ${skillDrift.map((s) => s.id).join("\n  - ")}`
         );
       }
+      if (pluginRequirements.length) {
+        await warn(
+          `Plugin requirements missing:
+  - ${pluginRequirements.map((issue) => `${issue.id}: ${issue.command}`).join("\n  - ")}`
+        );
+      }
+      if (shimProblems.length) {
+        await warn(
+          `Provider shims out of date:
+  - ${shimProblems.join("\n  - ")}`
+        );
+      }
       const skipped = mcpReports.filter((r) => r.status === "skipped");
       if (skipped.length) {
         const names = skipped.map((r) => parseEntryId(r.id)?.name ?? r.id);
@@ -2723,12 +2832,13 @@ var init_check = __esm({
   - ${driftLines(r.diff, options.verbose).join("\n  - ")}`);
       }
       const summary = summarize(checked);
-      const hasDrift = skillDrift.length > 0 || drifted.length > 0;
-      if (!hasDrift) {
+      const hasDrift = skillDrift.length > 0 || shimProblems.length > 0 || drifted.length > 0;
+      const hasProblems = hasDrift || pluginRequirements.length > 0;
+      if (!hasProblems) {
         await success(`check passed: ${summary}, no drift detected.`);
       } else {
         await info(`checked ${summary}, drift detected.`);
-        await recommend(skillDrift, drifted);
+        await recommend(skillDrift, shimProblems, drifted);
       }
     };
     driftLines = (diff, verbose) => {
@@ -2762,9 +2872,12 @@ var init_check = __esm({
       const rest = names.length - sample;
       return `${names.length} tools (${names.slice(0, sample).join(", ")}, \u2026 +${rest} more)`;
     };
-    recommend = async (skillDrift, drifted) => {
+    recommend = async (skillDrift, shimProblems, drifted) => {
       const c = palette();
       const lines = ["to update the lockfile baseline:"];
+      if (shimProblems.length) {
+        lines.push(`  ${c.cyan("quiver-cli sync")}   regenerate provider shims`);
+      }
       if (drifted.length) {
         lines.push(`  ${c.cyan("quiver-cli check --accept")}   accept the new MCP tool snapshots`);
       }
@@ -2786,8 +2899,23 @@ var init_check = __esm({
       if (c.skills) parts.push(plural(c.skills, "skill"));
       if (c.commands) parts.push(plural(c.commands, "command"));
       if (c.mcp) parts.push(plural(c.mcp, "MCP server"));
+      if (c.plugins) parts.push(plural(c.plugins, "plugin"));
       return parts.length ? parts.join(", ") : "nothing";
     };
+    hasCommand = (command) => {
+      if (!/^[A-Za-z0-9._-]+$/.test(command)) return false;
+      const extensions = process.platform === "win32" ? (process.env["PATHEXT"] ?? ".EXE;.CMD;.BAT;.COM").split(";") : [""];
+      for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
+        for (const extension of extensions) {
+          try {
+            accessSync2(resolve17(dir, command + extension), constants2.X_OK);
+            return true;
+          } catch {
+          }
+        }
+      }
+      return false;
+    };
     truncate2 = (s, max = 120) => s.length > max ? s.slice(0, max) + "\u2026" : s;
     fail = async (options, code, message) => {
       if (options.json) console.log(JSON.stringify({ ok: false, error: code }));
@@ -2802,9 +2930,9 @@ import { execFileSync as execFileSync3 } from "child_process";
 import {
   existsSync as existsSync13,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync10,
-  rmSync as rmSync7,
-  writeFileSync as writeFileSync8
+  readFileSync as readFileSync9,
+  rmSync as rmSync6,
+  writeFileSync as writeFileSync7
 } from "fs";
 import { tmpdir } from "os";
 import { join, resolve as resolve18 } from "path";
@@ -2819,10 +2947,10 @@ var init_upstreams = __esm({
     loadUpstreams = (catalog) => {
       const path = upstreamsPath(catalog);
       if (!existsSync13(path)) return {};
-      return JSON.parse(readFileSync10(path, "utf8"));
+      return JSON.parse(readFileSync9(path, "utf8"));
     };
     writeUpstreams = (catalog, map) => {
-      writeFileSync8(upstreamsPath(catalog), JSON.stringify(map, null, 2) + "\n");
+      writeFileSync7(upstreamsPath(catalog), JSON.stringify(map, null, 2) + "\n");
     };
     fetchLatestCommit = async (origin) => {
       const url = `https://api.github.com/repos/${origin.repo}/commits?path=${encodeURIComponent(origin.path)}&sha=${encodeURIComponent(origin.ref)}&per_page=1`;
@@ -2861,7 +2989,7 @@ var init_upstreams = __esm({
     };
     fetchUpstreamDir = (origin) => {
       const tmp = mkdtempSync2(join(tmpdir(), "quiver-pull-"));
-      const cleanup = () => rmSync7(tmp, { recursive: true, force: true });
+      const cleanup = () => rmSync6(tmp, { recursive: true, force: true });
       const git = (args, cwd) => {
         execFileSync3("git", args, {
           cwd,
@@ -2936,7 +3064,7 @@ var upstream_exports = {};
 __export(upstream_exports, {
   upstream: () => upstream
 });
-import { cpSync as cpSync3, rmSync as rmSync8 } from "fs";
+import { cpSync as cpSync3, rmSync as rmSync7 } from "fs";
 var upstream, guardWritableCatalog, STATUS_ORDER, pull, report3, countByStatus;
 var init_upstream = __esm({
   "src/commands/upstream.ts"() {
@@ -2988,7 +3116,7 @@ var init_upstream = __esm({
     guardWritableCatalog = async (catalog) => {
       if (isCatalogWritable(catalog)) return false;
       await error(
-        "upstream is a catalog-maintenance command and the catalog here is not writable (the installed package or a remote cache).\nRun it inside the quiver-cli repo, or point at a writable local catalog with --catalog <path>.\nTo update a consuming repo's installed entries, use quiver-cli check / quiver-cli update instead."
+        "upstream is a catalog-maintenance command and the catalog here is not writable (the installed package or a remote cache).\nRun it inside the quiver-cli repo, or point at a writable local catalog with --catalog=local:/absolute/path/.agents.\nTo update a consuming repo's installed entries, use quiver-cli check / quiver-cli update instead."
       );
       process.exitCode = 1;
       return true;
@@ -3046,7 +3174,7 @@ var init_upstream = __esm({
           continue;
         }
         try {
-          rmSync8(skill.absDir, { recursive: true, force: true });
+          rmSync7(skill.absDir, { recursive: true, force: true });
           cpSync3(fetched.dir, skill.absDir, { recursive: true, dereference: true });
         } finally {
           fetched.cleanup();
@@ -3120,14 +3248,23 @@ var init_upstream = __esm({
         lines.push(`  ${mark[r.status]} ${c.bold(name)}  ${detail}  ${where}`);
       }
       block(lines);
-      const drifted = sorted.filter(
-        (r) => r.status === "drift" || r.status === "drift-curated"
-      );
-      if (drifted.length) {
+      const drifted = sorted.filter((r) => r.status === "drift");
+      const curated = sorted.filter((r) => r.status === "drift-curated");
+      if (drifted.length || curated.length) {
         const hint = [""];
-        for (const r of drifted) {
-          const note = r.status === "drift-curated" ? "curated \u2014 reconcile changes by hand" : "re-fetch with the skills CLI, then copy into the catalog";
-          hint.push(`  ${c.yellow(r.name)}: ${c.dim(note)}`);
+        if (drifted.length) {
+          hint.push(
+            `  ${c.cyan("quiver-cli upstream pull")}  ${c.dim(
+              `update the catalog copy (${drifted.map((r) => r.name).join(", ")})`
+            )}`
+          );
+        }
+        for (const r of curated) {
+          hint.push(
+            `  ${c.yellow(r.name)}: ${c.dim(
+              "curated \u2014 reconcile by hand, or upstream pull --force"
+            )}`
+          );
         }
         block(hint);
       }
@@ -3163,83 +3300,6 @@ var init_upstream = __esm({
   }
 });
 
-// src/commands/login.ts
-var login_exports = {};
-__export(login_exports, {
-  login: () => login
-});
-import process3 from "process";
-var login, promptToken, readStdin;
-var init_login = __esm({
-  "src/commands/login.ts"() {
-    "use strict";
-    init_auth();
-    init_prompts();
-    login = async (options) => {
-      const token = process3.stdin.isTTY ? await promptToken() : await readStdin();
-      if (!token) {
-        await error(
-          "No token provided. Create a GitHub personal access token with `repo` read access and try again."
-        );
-        process3.exitCode = 1;
-        return;
-      }
-      const validation = await validateToken(token);
-      if (!validation.ok) {
-        await error(`Token validation failed: ${validation.reason}`);
-        process3.exitCode = 1;
-        return;
-      }
-      writeStoredToken(token, validation.login);
-      if (options.json) {
-        console.log(JSON.stringify({ ok: true, login: validation.login }, null, 2));
-        return;
-      }
-      await success(
-        `Logged in as ${validation.login}. Token stored in ${authFilePath()}.`
-      );
-    };
-    promptToken = async () => {
-      await info(
-        "Paste a GitHub personal access token (used for github: catalogs; needs read access to the catalog repo)."
-      );
-      const value = await password("GitHub token");
-      return value?.trim() || null;
-    };
-    readStdin = async () => {
-      let data = "";
-      for await (const chunk of process3.stdin) data += chunk;
-      return data.trim() || null;
-    };
-  }
-});
-
-// src/commands/logout.ts
-var logout_exports = {};
-__export(logout_exports, {
-  logout: () => logout
-});
-var logout;
-var init_logout = __esm({
-  "src/commands/logout.ts"() {
-    "use strict";
-    init_auth();
-    init_prompts();
-    logout = async (options) => {
-      const removed = deleteStoredToken();
-      if (options.json) {
-        console.log(JSON.stringify({ ok: true, removed }, null, 2));
-        return;
-      }
-      if (removed) {
-        await success(`Logged out. Removed ${authFilePath()}.`);
-      } else {
-        await info("Not logged in - nothing to remove.");
-      }
-    };
-  }
-});
-
 // src/version/notifier.ts
 var notifier_exports = {};
 __export(notifier_exports, {
@@ -3249,8 +3309,8 @@ __export(notifier_exports, {
   installHint: () => installHint,
   notifierSuppressed: () => notifierSuppressed
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
-import { homedir as homedir3 } from "os";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { homedir as homedir2 } from "os";
 import { dirname as dirname6, resolve as resolve19 } from "path";
 var REGISTRY_URL, CHECK_TTL_MS, FETCH_TIMEOUT_MS, INSTALL_HINT, cacheFilePath, installHint, getCurrentVersion, compareSemver, readCache, writeCache, fetchLatestVersion, checkForUpdate, notifierSuppressed;
 var init_notifier = __esm({
@@ -3262,14 +3322,14 @@ var init_notifier = __esm({
     FETCH_TIMEOUT_MS = 2e3;
     INSTALL_HINT = "pnpm add -g quiver-cli";
     cacheFilePath = () => {
-      const base = process.env["XDG_CACHE_HOME"] || resolve19(homedir3(), ".cache");
+      const base = process.env["XDG_CACHE_HOME"] || resolve19(homedir2(), ".cache");
       return resolve19(base, "quiver", "update-check.json");
     };
     installHint = () => INSTALL_HINT;
     getCurrentVersion = () => {
       try {
         const pkg = JSON.parse(
-          readFileSync11(resolve19(packageRoot, "package.json"), "utf8")
+          readFileSync10(resolve19(packageRoot, "package.json"), "utf8")
         );
         return pkg.version;
       } catch {
@@ -3297,7 +3357,7 @@ var init_notifier = __esm({
       const path = cacheFilePath();
       if (!existsSync14(path)) return null;
       try {
-        return JSON.parse(readFileSync11(path, "utf8"));
+        return JSON.parse(readFileSync10(path, "utf8"));
       } catch {
         return null;
       }
@@ -3305,8 +3365,8 @@ var init_notifier = __esm({
     writeCache = (cache) => {
       try {
         const path = cacheFilePath();
-        mkdirSync7(dirname6(path), { recursive: true });
-        writeFileSync9(path, JSON.stringify(cache, null, 2) + "\n");
+        mkdirSync6(dirname6(path), { recursive: true });
+        writeFileSync8(path, JSON.stringify(cache, null, 2) + "\n");
       } catch {
       }
     };
@@ -3350,58 +3410,85 @@ var init_notifier = __esm({
 
 // src/cli.ts
 init_prompts();
-import process4 from "process";
-var HELP = `quiver-cli - compose agent skills, commands & MCP servers into any repo
+import process3 from "process";
+var HELP = `quiver-cli - compose agent skills, commands, plugins & MCP servers into any repo
 
 Usage:
   quiver-cli <command> [options]
 
 Commands:
   init             Interactive picker over the catalog; write native configs + quiver.lock
-  add <id>         Add a single catalog entry (skill:<name>, command:<name>, mcp:<name>)
+  add <id>         Add an entry (skill:<name>, command:<name>, mcp:<name>, plugin:<name>)
   remove <id>      Remove a single entry; keep lockfile + configs consistent
   sync             Regenerate provider configs from .agents/ (warns on drift)
   providers [a,b]  Change which tools get configs (claude, opencode, codex)
   update [id]      Pull newer catalog content into .agents/ (all or one entry)
-  list             Show installed entries (skills, commands, MCP tool counts)
-  status           Diff the lockfile against what is actually in the repo
-  check            Detect upstream drift (skill digests, MCP tool snapshots)
+  list             Show installed entries (skills, commands, plugins, MCP tool counts)
+  check            Detect drift: skill digests, provider shims, MCP tool
+                   snapshots (--offline skips MCP re-introspection)
   upstream         Catalog maintenance: check source repos for skill updates
                    (run in the quiver-cli repo or with a writable --catalog)
   upstream pull    Pull latest upstream content into the catalog [skill]
-  login            Store a GitHub token for remote (github:) catalogs
-  logout           Remove the stored GitHub token
   help             Show this help
   version          Show the quiver-cli version
 
 Options:
   -f, --force          Overwrite existing files
   --all, -y            Keep everything without prompting (non-interactive)
-  --json               Machine-readable output (status/check/upstream/list)
+  --json               Machine-readable output (check/upstream/list)
   -V, --verbose        Show full tool lists and description diffs (check)
   --accept             Record the current MCP tool snapshots as the new baseline (check)
+  --offline            Skip MCP re-introspection; check digests + shims only (check)
+  --dry-run            Report what would change without writing (update)
   --providers=a,b      Generate configs only for these tools (init, sync, providers)
   --catalog=<source>   Catalog source for init (e.g. github:owner/repo[/path][#ref])
   --introspect-stdio   Allow introspecting stdio MCP servers (runs foreign code)
   -v, --version        Show the quiver-cli version
 `;
+var KNOWN_FLAGS = /* @__PURE__ */ new Set([
+  "--force",
+  "-f",
+  "--all",
+  "--yes",
+  "-y",
+  "--json",
+  "--verbose",
+  "-V",
+  "--accept",
+  "--offline",
+  "--dry-run",
+  "--introspect-stdio",
+  "--help",
+  "-h",
+  "--version",
+  "-v"
+]);
+var KNOWN_VALUE_FLAGS = ["--providers", "--catalog"];
+var isKnownFlag = (arg) => {
+  if (KNOWN_FLAGS.has(arg)) return true;
+  return KNOWN_VALUE_FLAGS.some((f) => arg.startsWith(`${f}=`));
+};
 var parse2 = (argv) => {
   const [command = "init", ...rest] = argv;
   const flags = new Set(rest.filter((a) => a.startsWith("-")));
   const positionals = rest.filter((a) => !a.startsWith("-"));
+  const unknownFlags = [...flags].filter((a) => !isKnownFlag(a));
   const providersFlag = rest.find((a) => a.startsWith("--providers="));
   const providers2 = providersFlag ? providersFlag.slice("--providers=".length).split(",").map((p) => p.trim()).filter(Boolean) : null;
   const catalogFlag = rest.find((a) => a.startsWith("--catalog="));
   const catalog = catalogFlag ? catalogFlag.slice("--catalog=".length).trim() || null : null;
   return {
     command,
+    unknownFlags,
     options: {
-      targetRoot: process4.cwd(),
+      targetRoot: process3.cwd(),
       force: flags.has("--force") || flags.has("-f"),
       all: flags.has("--all") || flags.has("--yes") || flags.has("-y"),
       json: flags.has("--json"),
       verbose: flags.has("--verbose") || flags.has("-V"),
       accept: flags.has("--accept"),
+      offline: flags.has("--offline"),
+      dryRun: flags.has("--dry-run"),
       introspectStdio: flags.has("--introspect-stdio"),
       providers: providers2,
       catalog,
@@ -3410,13 +3497,22 @@ var parse2 = (argv) => {
   };
 };
 var run = async () => {
-  const { command, options } = parse2(process4.argv.slice(2));
-  if (process4.stdin.isTTY && !options.all) {
+  const { command, options, unknownFlags } = parse2(process3.argv.slice(2));
+  if (unknownFlags.length) {
+    await error(
+      `Unknown option${unknownFlags.length === 1 ? "" : "s"}: ${unknownFlags.join(", ")}
+`
+    );
+    console.log(HELP);
+    process3.exitCode = 1;
+    return;
+  }
+  if (process3.stdin.isTTY && !options.all) {
     const { checkNodeForCommand: checkNodeForCommand2 } = await Promise.resolve().then(() => (init_node_guard(), node_guard_exports));
     const guard = checkNodeForCommand2(command);
     if (!guard.ok) {
       await error(guard.message);
-      process4.exitCode = 1;
+      process3.exitCode = 1;
       return;
     }
   }
@@ -3458,11 +3554,6 @@ var run = async () => {
       await list3(options);
       break;
     }
-    case "status": {
-      const { status: status2 } = await Promise.resolve().then(() => (init_status(), status_exports));
-      await status2(options);
-      break;
-    }
     case "check": {
       const { check: check2 } = await Promise.resolve().then(() => (init_check(), check_exports));
       await check2(options);
@@ -3473,16 +3564,6 @@ var run = async () => {
       await upstream2(options);
       break;
     }
-    case "login": {
-      const { login: login2 } = await Promise.resolve().then(() => (init_login(), login_exports));
-      await login2(options);
-      break;
-    }
-    case "logout": {
-      const { logout: logout2 } = await Promise.resolve().then(() => (init_logout(), logout_exports));
-      await logout2(options);
-      break;
-    }
     case "help":
     case "--help":
     case "-h":
@@ -3505,7 +3586,7 @@ var run = async () => {
       console.error(`Unknown command: ${command}
 `);
       console.log(HELP);
-      process4.exitCode = 1;
+      process3.exitCode = 1;
   }
   if (!["version", "--version", "-v", "help", "--help", "-h"].includes(command)) {
     await maybeNotifyUpdate(options.json);
@@ -3527,7 +3608,14 @@ ${c.yellow("\u25B2")} ${c.bold("update available")} ${c.dim(
   } catch {
   }
 };
-run().catch(async (err) => {
-  await error(err instanceof Error ? err.message : String(err));
-  process4.exitCode = 1;
-});
+var main = () => {
+  run().catch(async (err) => {
+    await error(err instanceof Error ? err.message : String(err));
+    process3.exitCode = 1;
+  });
+};
+export {
+  main,
+  parse2 as parse,
+  run
+};