shoplazza-ai-dev-cli 0.1.1 → 0.1.2

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as __toESM, n as __exportAll } from "./_chunks/rolldown-runtime.mjs";
+import { r as __toESM } from "./_chunks/rolldown-runtime.mjs";
 import { l as pD, u as require_picocolors } from "./_chunks/libs/@clack/core.mjs";
 import { a as Y, c as ve, i as Se, l as xe, n as M, o as be, r as Me, s as fe, t as Ie, u as ye } from "./_chunks/libs/@clack/prompts.mjs";
 import "./_chunks/libs/@kwsites/file-exists.mjs";
@@ -11,12 +11,13 @@ import "./_chunks/libs/core-util-is.mjs";
 import "./_chunks/libs/inherits.mjs";
 import "./_chunks/libs/immediate.mjs";
 import { exec, execSync, spawnSync } from "child_process";
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "fs";
 import { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
-import { homedir, platform, tmpdir } from "os";
 import { URL as URL$1, fileURLToPath } from "url";
 import { stripVTControlCharacters } from "node:util";
+import { homedir, hostname, platform, tmpdir } from "os";
 import { access, chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
+import { createServer } from "http";
 import { gunzipSync } from "node:zlib";
 import { mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1 } from "node:fs";
 import { dirname as dirname$1, normalize as normalize$1, resolve as resolve$1, sep as sep$1 } from "node:path";
@@ -24,7 +25,6 @@ import { parse } from "yaml";
 import * as readline from "readline";
 import { Writable } from "stream";
 import { createHash } from "crypto";
-import { createServer } from "http";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 function getOwnerRepo(parsed) {
 	if (parsed.type === "local") return null;
@@ -318,7 +318,7 @@ const agents = {
 	cursor: {
 		name: "cursor",
 		displayName: "Cursor",
-		skillsDir: ".agents/skills",
+		skillsDir: ".cursor/skills",
 		globalSkillsDir: join(home, ".cursor/skills"),
 		detectInstalled: async () => {
 			return existsSync(join(home, ".cursor"));
@@ -340,8 +340,8 @@ function isUniversalAgent(type) {
 function getStoreRoot(_scope, _cwd) {
 	return join(home, FORGE_STORE_DIRNAME, "store");
 }
-function getAgentEntryRoot(agent, scope, cwd) {
-	if (scope === "global") return getAgentHome(agent);
+function getAgentEntryRoot(_agent, scope, cwd) {
+	if (scope === "global") return home;
 	return cwd ?? process.cwd();
 }
 function getInstallTargets(agent, component, scope, cwd) {
@@ -628,35 +628,93 @@ function getForgeHookScript(portalUrl) {
 	return `#!/usr/bin/env node
 // ${FORGE_HOOK_TAG}
 // Auto-generated by ai-dev-cli. Do not edit; run \`ai-dev-cli add\` to refresh.
-// Reports {type:'skill_invoked', asset_ref, install_mode} when the agent reads
-// SKILL.md from a forge-installed skill (identified by .forge-source.json).
+// Reports {type:'skill_invoked', asset_ref, install_mode} when Claude Code
+// loads a forge-installed skill — via slash command (UserPromptExpansion)
+// or via the Skill tool (PreToolUse). PostToolUse(Skill) is unreliable on
+// Claude Code 2.1.x; see anthropics/claude-code#43630.
 // Anonymous: /events accepts unauthenticated posts.
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 
 const PORTAL = ${JSON.stringify(portal)};
 
-setTimeout(() => process.exit(0), 5000);
+// Safety net: never let a stuck fetch block the IDE for more than 5 seconds.
+// The fetch itself uses AbortSignal.timeout(2000); this catches edge cases
+// like a stalled DNS lookup before the abort fires.
+const exitTimer = setTimeout(() => process.exit(0), 5000);
+exitTimer.unref?.();
+
+function readManifest(dir) {
+  try {
+    const raw = fs.readFileSync(path.join(dir, '.forge-source.json'), 'utf8');
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+function manifestFromSkillName(skillId, cwd) {
+  if (!skillId || typeof skillId !== 'string') return null;
+  // \`plugin:skill-name\` → drop the plugin prefix; forge installs flatten into
+  // .claude/skills/<name>/ regardless of plugin namespace (see agents.ts).
+  const name = skillId.includes(':') ? skillId.split(':').pop() : skillId;
+  if (!name) return null;
+  const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || path.join(os.homedir(), '.claude');
+  // 1) IDE entry under cwd (project-scope install).
+  // 2) IDE entry under CLAUDE_CONFIG_DIR (global-scope install).
+  const ideCandidates = [];
+  if (cwd) ideCandidates.push(path.join(cwd, '.claude', 'skills', name));
+  ideCandidates.push(path.join(claudeHome, 'skills', name));
+  for (const dir of ideCandidates) {
+    const m = readManifest(dir);
+    if (m) return m;
+  }
+  // 3) Forge canonical store. Truth source — regardless of where the IDE
+  // entry symlink lives or what the agent's cwd is, the manifest always
+  // exists under ~/.ai-dev-cli/store. Skill dirs are named \`<scope>__<name>\`;
+  // plugin-internal skills live one level deeper.
+  const storeRoot = path.join(os.homedir(), '.ai-dev-cli', 'store');
+  for (const sub of ['skills', 'plugins']) {
+    try {
+      const root = path.join(storeRoot, sub);
+      for (const entry of fs.readdirSync(root)) {
+        if (sub === 'skills') {
+          if (!entry.endsWith('__' + name)) continue;
+          const m = readManifest(path.join(root, entry));
+          if (m && m.name === name) return m;
+        } else {
+          const m = readManifest(path.join(root, entry, 'skills', name));
+          if (m && m.name === name) return m;
+        }
+      }
+    } catch {
+      /* store dir missing — fall through */
+    }
+  }
+  return null;
+}
 
 let buf = '';
 process.stdin.on('data', (c) => (buf += c));
 process.stdin.on('end', () => {
+  let skillId = null;
   try {
     const ev = JSON.parse(buf);
-    const filePath = ev.tool_input?.file_path || '';
-    if (!filePath.endsWith(path.sep + 'SKILL.md') && !filePath.endsWith('/SKILL.md')) return;
-
-    let dir = path.dirname(filePath);
-    let manifest = null;
-    for (let i = 0; i < 8 && dir && dir !== path.dirname(dir); i++) {
-      const p = path.join(dir, '.forge-source.json');
-      if (fs.existsSync(p)) {
-        manifest = JSON.parse(fs.readFileSync(p, 'utf8'));
-        break;
-      }
-      dir = path.dirname(dir);
+    if (ev.hook_event_name === 'UserPromptExpansion') {
+      // Slash command path. \`command_name\` is the skill identifier as the
+      // user typed it (without the leading slash), e.g. "ai-coding-llm-wiki".
+      if (ev.expansion_type !== 'slash_command') process.exit(0);
+      skillId = ev.command_name;
+    } else if (ev.hook_event_name === 'PreToolUse' && ev.tool_name === 'Skill') {
+      skillId = ev.tool_input?.skill ?? ev.tool_input?.name;
+    } else {
+      process.exit(0);
+    }
+    const manifest = manifestFromSkillName(skillId, ev.cwd || process.cwd());
+    if (!manifest?.ref) {
+      process.exit(0);
     }
-    if (!manifest?.ref) return;
 
     fetch(PORTAL + '/events', {
       method: 'POST',
@@ -670,9 +728,11 @@ process.stdin.on('end', () => {
         },
       }),
       signal: AbortSignal.timeout(2000),
-    }).catch(() => {});
+    })
+      .catch(() => {})
+      .finally(() => process.exit(0));
   } catch {
-    /* swallow */
+    process.exit(0);
   }
 });
 `;
@@ -710,6 +770,27 @@ async function writeHookScript(scriptPath, portalUrl) {
 		await chmod(scriptPath, 493);
 	} catch {}
 }
+const FORGE_LEGACY_LOCATIONS = [
+	{
+		event: "PostToolUse",
+		matcher: "Read"
+	},
+	{
+		event: "PostToolUse",
+		matcher: "Read|Skill"
+	},
+	{
+		event: "PostToolUse",
+		matcher: "Skill"
+	}
+];
+const FORGE_CANONICAL_LOCATIONS = [{
+	event: "UserPromptExpansion",
+	matcher: void 0
+}, {
+	event: "PreToolUse",
+	matcher: "Skill"
+}];
 async function upsertClaudeCodeSettings(settingsPath, scriptPath) {
 	const command = `node ${shellEscape(scriptPath)}`;
 	let raw = "";
@@ -725,26 +806,38 @@ async function upsertClaudeCodeSettings(settingsPath, scriptPath) {
 		throw new Error(`Refusing to overwrite invalid JSON at ${settingsPath}: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	if (!settings.hooks || typeof settings.hooks !== "object") settings.hooks = {};
-	if (!Array.isArray(settings.hooks.PostToolUse)) settings.hooks.PostToolUse = [];
-	const matcherList = settings.hooks.PostToolUse;
-	let readMatcher = matcherList.find((m) => m && m.matcher === "Read");
-	if (!readMatcher) {
-		readMatcher = {
-			matcher: "Read",
-			hooks: []
-		};
-		matcherList.push(readMatcher);
+	const hooks = settings.hooks;
+	const isOurEntry = (h) => !!(h && typeof h.command === "string" && h.command.includes(HOOK_SCRIPT_BASENAME));
+	const owned = new Set([...FORGE_LEGACY_LOCATIONS, ...FORGE_CANONICAL_LOCATIONS].map((l) => `${l.event}::${l.matcher ?? ""}`));
+	for (const eventName of Object.keys(hooks)) {
+		const matcherList = hooks[eventName];
+		if (!Array.isArray(matcherList)) continue;
+		for (let i = matcherList.length - 1; i >= 0; i--) {
+			const m = matcherList[i];
+			if (!m || !Array.isArray(m.hooks)) continue;
+			m.hooks = m.hooks.filter((h) => !isOurEntry(h));
+			const key = `${eventName}::${m.matcher ?? ""}`;
+			if (m.hooks.length === 0 && owned.has(key)) matcherList.splice(i, 1);
+		}
+		if (matcherList.length === 0) delete hooks[eventName];
+	}
+	for (const loc of FORGE_CANONICAL_LOCATIONS) {
+		if (!Array.isArray(hooks[loc.event])) hooks[loc.event] = [];
+		const matcherList = hooks[loc.event];
+		let target = matcherList.find((m) => m && (m.matcher ?? void 0) === loc.matcher);
+		if (!target) {
+			target = loc.matcher === void 0 ? { hooks: [] } : {
+				matcher: loc.matcher,
+				hooks: []
+			};
+			matcherList.push(target);
+		}
+		if (!Array.isArray(target.hooks)) target.hooks = [];
+		target.hooks.push({
+			type: "command",
+			command
+		});
 	}
-	if (!Array.isArray(readMatcher.hooks)) readMatcher.hooks = [];
-	const ourEntry = readMatcher.hooks.find((h) => typeof h?.command === "string" && h.command.includes(HOOK_SCRIPT_BASENAME));
-	if (ourEntry) {
-		if (ourEntry.command === command && ourEntry.type === "command") return;
-		ourEntry.type = "command";
-		ourEntry.command = command;
-	} else readMatcher.hooks.push({
-		type: "command",
-		command
-	});
 	await mkdir(dirname(settingsPath), { recursive: true });
 	await writeFile(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
 }
@@ -752,18 +845,273 @@ function shellEscape(p) {
 	if (!/[\s"'$`\\]/.test(p)) return p;
 	return `'${p.replace(/'/g, `'\\''`)}'`;
 }
-async function fetchSkillArchive(ref, portalUrl, bearerToken) {
-	const url = `${portalUrl.replace(/\/$/, "")}/api/cli/skills/archive?ref=${encodeURIComponent(ref)}`;
-	const headers = { Accept: "application/gzip" };
-	if (bearerToken) headers.Authorization = `Bearer ${bearerToken}`;
-	let resp;
+function getRandomPort() {
+	return new Promise((resolve, reject) => {
+		const server = createServer();
+		server.listen(0, "127.0.0.1", () => {
+			const address = server.address();
+			if (address && typeof address !== "string" && "port" in address) {
+				const port = address.port;
+				server.close(() => resolve(port));
+			} else server.close(() => reject(/* @__PURE__ */ new Error("Failed to get port")));
+		});
+		server.on("error", reject);
+	});
+}
+const PORTAL_THEME_CSS = `
+  :root {
+    --bg: #FDFCF8;
+    --ink: #201F1D;
+    --text: #37352F;
+    --muted: #827E7A;
+    --line: #EDECE8;
+    --success: #0F6E37;
+    --success-soft: #EDF7F1;
+    --danger: #E5484D;
+    --danger-soft: #FDF1EF;
+    --serif: "Newsreader", "Source Serif Pro", Georgia, serif;
+    --sans: -apple-system, BlinkMacSystemFont, "PingFang SC", "Segoe UI", sans-serif;
+    --shadow-sm: 0 1px 2px rgba(32, 31, 29, 0.06);
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --bg: #27251F;
+      --ink: #EDEAE5;
+      --text: #D4CFC8;
+      --muted: #918D89;
+      --line: #35332F;
+      --success: #3FC67A;
+      --success-soft: #062A14;
+      --danger: #E5484D;
+      --danger-soft: #2B1212;
+    }
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    background: var(--bg);
+    color: var(--text);
+    font-family: var(--sans);
+    font-size: 15px;
+    line-height: 1.65;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+  }
+  .card {
+    max-width: 480px;
+    margin: 0 24px;
+    padding: 40px 32px;
+    text-align: center;
+  }
+  .icon {
+    width: 56px;
+    height: 56px;
+    margin: 0 auto 24px;
+    border-radius: 50%;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+  }
+  .icon.success { background: var(--success-soft); }
+  .icon.error { background: var(--danger-soft); }
+  .icon svg { display: block; }
+  h1 {
+    font-family: var(--serif);
+    font-size: 28px;
+    font-weight: 500;
+    letter-spacing: -0.01em;
+    color: var(--ink);
+    margin: 0 0 12px;
+  }
+  p { color: var(--muted); margin: 0 0 8px; }
+  p.detail { color: var(--text); }
+`;
+function renderCallbackPage(opts) {
+	return `<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>${opts.title}</title>
+  <style>${PORTAL_THEME_CSS}</style>
+</head>
+<body>
+  <div class="card">
+    <div class="icon ${opts.variant}">${opts.iconSvg}</div>
+    <h1>${opts.heading}</h1>
+    ${opts.body}
+  </div>
+</body>
+</html>`;
+}
+function getSuccessHtml() {
+	return renderCallbackPage({
+		title: "Login successful",
+		heading: "Login successful",
+		body: "<p>You can close this window and return to the CLI.</p>",
+		variant: "success",
+		iconSvg: `
+    <svg width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="currentColor"
+         stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"
+         style="color: var(--success);">
+      <polyline points="4 12 10 18 20 6"></polyline>
+    </svg>`
+	});
+}
+function escapeHtml(input) {
+	return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function getErrorHtml(error) {
+	return renderCallbackPage({
+		title: "Login failed",
+		heading: "Login failed",
+		body: `<p class="detail">${escapeHtml(error)}</p><p>Please try again.</p>`,
+		variant: "error",
+		iconSvg: `
+    <svg width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="currentColor"
+         stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"
+         style="color: var(--danger);">
+      <line x1="6" y1="6" x2="18" y2="18"></line>
+      <line x1="18" y1="6" x2="6" y2="18"></line>
+    </svg>`
+	});
+}
+let callbackResolve = null;
+async function runLogin(options = {}) {
+	const cfg = loadConfig();
+	if (options.logout) {
+		if (cfg.token) {
+			saveConfig({
+				token: void 0,
+				token_name: void 0
+			});
+			M.success("Logged out successfully.");
+			M.message(import_picocolors.default.dim("Your token has been removed from the config."));
+		} else M.message("You are not logged in.");
+		return;
+	}
+	if (cfg.token && !options.force) {
+		M.message("You are already logged in.");
+		M.info(import_picocolors.default.dim(`Token: ${cfg.token_name || "default"}`));
+		const shouldReauth = await ye({
+			message: "Re-authenticate?",
+			initialValue: false
+		});
+		if (isCancelled$1(shouldReauth)) {
+			Se(import_picocolors.default.dim("Cancelled"));
+			return;
+		}
+		if (!shouldReauth) return;
+	}
+	console.log();
+	Ie(import_picocolors.default.bgCyan(import_picocolors.default.black(" login ")));
+	const portalUrl = cfg.portal;
+	const port = await getRandomPort();
+	const redirectUrl = `http://127.0.0.1:${port}/callback`;
+	const machine = hostname().slice(0, 64);
+	const authUrl = `${portalUrl}/cli-auth?redirect=${encodeURIComponent(redirectUrl)}&hostname=${encodeURIComponent(machine)}`;
+	M.message(`Opening browser for authentication...`);
+	M.info(import_picocolors.default.dim(authUrl));
+	await new Promise((resolve, reject) => {
+		exec(`open "${authUrl}"`, (err) => {
+			if (err) reject(err);
+			else resolve();
+		});
+	});
+	const result = await new Promise((resolve) => {
+		callbackResolve = resolve;
+		const server = createServer((req, res) => {
+			const url = new URL$1(req.url || "", `http://127.0.0.1:${port}`);
+			if (url.pathname === "/callback") {
+				const token = url.searchParams.get("token");
+				const tokenName = url.searchParams.get("token_name");
+				const error = url.searchParams.get("error");
+				if (error) {
+					res.writeHead(400, { "Content-Type": "text/html" });
+					res.end(getErrorHtml(error));
+					resolve({
+						success: false,
+						error
+					});
+				} else if (token) {
+					res.writeHead(200, { "Content-Type": "text/html" });
+					res.end(getSuccessHtml());
+					resolve({
+						success: true,
+						token,
+						tokenName: tokenName || "default"
+					});
+				} else {
+					res.writeHead(400, { "Content-Type": "text/html" });
+					res.end(getErrorHtml("No token received"));
+					resolve({
+						success: false,
+						error: "No token received"
+					});
+				}
+			} else {
+				res.writeHead(404);
+				res.end("Not found");
+			}
+		});
+		server.listen(port, "127.0.0.1", () => {});
+		setTimeout(() => {
+			server.close();
+			if (callbackResolve) callbackResolve({
+				success: false,
+				error: "Login timed out"
+			});
+		}, 12e4);
+	});
+	if (!result.success) {
+		Se(import_picocolors.default.red("Login failed: " + result.error));
+		process.exit(1);
+	}
+	saveConfig({
+		token: result.token,
+		token_name: result.tokenName
+	});
+	M.success("Login successful!");
+	M.message(import_picocolors.default.dim(`Token saved as: ${result.tokenName}`));
+	Se(import_picocolors.default.green("You can now publish skills."));
+}
+function isCancelled$1(value) {
+	return typeof value === "symbol";
+}
+function parseLoginOptions(args) {
+	const options = {};
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "--logout" || arg === "-l") options.logout = true;
+	}
+	return options;
+}
+async function rawFetch(url, headers, portalUrl) {
 	try {
-		resp = await fetch(url, { headers });
+		return await fetch(url, { headers });
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
 		throw new Error(`Failed to reach portal at ${portalUrl}: ${msg}`);
 	}
-	if (resp.status === 401) throw new Error("Login required: run `ai-dev-cli login` first");
+}
+async function fetchWithAutoAuth(url, accept, bearerToken, portalUrl) {
+	const buildHeaders = (token) => {
+		const h = { Accept: accept };
+		if (token) h.Authorization = `Bearer ${token}`;
+		return h;
+	};
+	let resp = await rawFetch(url, buildHeaders(bearerToken), portalUrl);
+	if (resp.status !== 401) return resp;
+	await resp.arrayBuffer().catch(() => void 0);
+	await runLogin({ force: true });
+	const refreshed = loadConfig().token;
+	if (!refreshed) return resp;
+	return rawFetch(url, buildHeaders(refreshed), portalUrl);
+}
+async function fetchSkillArchive(ref, portalUrl, bearerToken) {
+	const resp = await fetchWithAutoAuth(`${portalUrl.replace(/\/$/, "")}/api/cli/skills/archive?ref=${encodeURIComponent(ref)}`, "application/gzip", bearerToken, portalUrl);
+	if (resp.status === 401) throw new Error("Authentication failed after login. Please try again.");
 	if (resp.status === 403) throw new Error(`Permission denied for ${ref}`);
 	if (resp.status === 404) throw new Error(`Skill not found: ${ref}`);
 	if (!resp.ok) {
@@ -773,19 +1121,8 @@ async function fetchSkillArchive(ref, portalUrl, bearerToken) {
 	return Buffer.from(await resp.arrayBuffer());
 }
 async function fetchTeamAssets(teamScope, portalUrl, bearerToken) {
-	const url = `${portalUrl.replace(/\/$/, "")}/api/cli/teams/${encodeURIComponent(teamScope)}/assets`;
-	const headers = {
-		Accept: "application/json",
-		Authorization: `Bearer ${bearerToken}`
-	};
-	let resp;
-	try {
-		resp = await fetch(url, { headers });
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		throw new Error(`Failed to reach portal at ${portalUrl}: ${msg}`);
-	}
-	if (resp.status === 401) throw new Error("Login required: run `shoplazza-ai-dev-cli login` first");
+	const resp = await fetchWithAutoAuth(`${portalUrl.replace(/\/$/, "")}/api/cli/teams/${encodeURIComponent(teamScope)}/assets`, "application/json", bearerToken, portalUrl);
+	if (resp.status === 401) throw new Error("Authentication failed after login. Please try again.");
 	if (resp.status === 403) throw new Error(`Not a member of team "${teamScope}"`);
 	if (resp.status === 404) throw new Error(`Team not found: ${teamScope}`);
 	if (!resp.ok) {
@@ -795,17 +1132,8 @@ async function fetchTeamAssets(teamScope, portalUrl, bearerToken) {
 	return (await resp.json()).items ?? [];
 }
 async function fetchPluginArchive(ref, portalUrl, bearerToken) {
-	const url = `${portalUrl.replace(/\/$/, "")}/api/cli/plugins/archive?ref=${encodeURIComponent(ref)}`;
-	const headers = { Accept: "application/gzip" };
-	if (bearerToken) headers.Authorization = `Bearer ${bearerToken}`;
-	let resp;
-	try {
-		resp = await fetch(url, { headers });
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		throw new Error(`Failed to reach portal at ${portalUrl}: ${msg}`);
-	}
-	if (resp.status === 401) throw new Error("Login required: run `ai-dev-cli login` first");
+	const resp = await fetchWithAutoAuth(`${portalUrl.replace(/\/$/, "")}/api/cli/plugins/archive?ref=${encodeURIComponent(ref)}`, "application/gzip", bearerToken, portalUrl);
+	if (resp.status === 401) throw new Error("Authentication failed after login. Please try again.");
 	if (resp.status === 403) throw new Error(`Permission denied for ${ref}`);
 	if (resp.status === 404) throw new Error(`Plugin not found: ${ref}`);
 	if (!resp.ok) {
@@ -947,7 +1275,7 @@ async function promptForeignOverwrite(conflicts, opts = {}) {
 	}
 	return choice === "yes";
 }
-const AGENTS_DIR$2 = ".agents";
+const AGENTS_DIR$1 = ".agents";
 const SKILLS_SUBDIR = "skills";
 function parseFrontmatter(raw) {
 	const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
@@ -1187,17 +1515,8 @@ function isPathSafe(basePath, targetPath) {
 	const normalizedTarget = normalize(resolve(targetPath));
 	return normalizedTarget.startsWith(normalizedBase + sep) || normalizedTarget === normalizedBase;
 }
-async function isDirEntryOrSymlinkToDir(entry, entryPath) {
-	if (entry.isDirectory()) return true;
-	if (!entry.isSymbolicLink()) return false;
-	try {
-		return (await stat(entryPath)).isDirectory();
-	} catch {
-		return false;
-	}
-}
 function getCanonicalSkillsDir(global, cwd) {
-	return join(global ? homedir() : cwd || process.cwd(), AGENTS_DIR$2, SKILLS_SUBDIR);
+	return join(global ? homedir() : cwd || process.cwd(), AGENTS_DIR$1, SKILLS_SUBDIR);
 }
 function getAgentBaseDir(agentType, global, cwd) {
 	if (isUniversalAgent(agentType)) return getCanonicalSkillsDir(global, cwd);
@@ -1283,8 +1602,7 @@ async function installSkillForAgent(skill, agentType, opts) {
 		error: "Invalid skill name: path traversal detected",
 		forgeOtherReplacements: []
 	};
-	const entryAgentRoot = scope === "global" ? getAgentHome(agentType) : cwd;
-	const entry = agentType === "claude-code" ? join(entryAgentRoot, ".claude", "skills", skillName) : agentType === "cursor" ? join(entryAgentRoot, ".cursor", "skills", skillName) : join(entryAgentRoot, ".agents", "skills", skillName);
+	const entry = join(getAgentBaseDir(agentType, scope === "global", cwd), skillName);
 	try {
 		const status = await assertEntryReplaceable(entry, {
 			intendedRef: newOpts.ref,
@@ -1487,15 +1805,6 @@ async function isSkillInstalled(skillName, agentType, options = {}) {
 		return false;
 	}
 }
-function getInstallPath(skillName, agentType, options = {}) {
-	agents[agentType];
-	options.cwd || process.cwd();
-	const sanitized = sanitizeName(skillName);
-	const targetBase = getAgentBaseDir(agentType, options.global ?? false, options.cwd);
-	const installPath = join(targetBase, sanitized);
-	if (!isPathSafe(targetBase, installPath)) throw new Error("Invalid skill name: potential path traversal detected");
-	return installPath;
-}
 function getCanonicalPath(skillName, options = {}) {
 	const sanitized = sanitizeName(skillName);
 	const canonicalBase = getCanonicalSkillsDir(options.global ?? false, options.cwd);
@@ -1665,166 +1974,6 @@ async function installBlobSkillForAgent(skill, agentType, options = {}) {
 		};
 	}
 }
-async function listInstalledSkills(options = {}) {
-	const cwd = options.cwd || process.cwd();
-	const skillsMap = /* @__PURE__ */ new Map();
-	const scopes = [];
-	const detectedAgents = await detectInstalledAgents();
-	const agentFilter = options.agentFilter;
-	const agentsToCheck = agentFilter ? detectedAgents.filter((a) => agentFilter.includes(a)) : detectedAgents;
-	const scopeTypes = [];
-	if (options.global === void 0) scopeTypes.push({ global: false }, { global: true });
-	else scopeTypes.push({ global: options.global });
-	for (const { global: isGlobal } of scopeTypes) {
-		scopes.push({
-			global: isGlobal,
-			path: getCanonicalSkillsDir(isGlobal, cwd)
-		});
-		for (const agentType of agentsToCheck) {
-			const agent = agents[agentType];
-			if (isGlobal && agent.globalSkillsDir === void 0) continue;
-			const agentDir = isGlobal ? agent.globalSkillsDir : join(cwd, agent.skillsDir);
-			if (!scopes.some((s) => s.path === agentDir && s.global === isGlobal)) scopes.push({
-				global: isGlobal,
-				path: agentDir,
-				agentType
-			});
-		}
-		const allAgentTypes = Object.keys(agents);
-		for (const agentType of allAgentTypes) {
-			if (agentsToCheck.includes(agentType)) continue;
-			const agent = agents[agentType];
-			if (isGlobal && agent.globalSkillsDir === void 0) continue;
-			const agentDir = isGlobal ? agent.globalSkillsDir : join(cwd, agent.skillsDir);
-			if (scopes.some((s) => s.path === agentDir && s.global === isGlobal)) continue;
-			if (existsSync(agentDir)) scopes.push({
-				global: isGlobal,
-				path: agentDir,
-				agentType
-			});
-		}
-	}
-	for (const scope of scopes) try {
-		const entries = await readdir(scope.path, { withFileTypes: true });
-		for (const entry of entries) {
-			const skillDir = join(scope.path, entry.name);
-			if (!await isDirEntryOrSymlinkToDir(entry, skillDir)) continue;
-			const skillMdPath = join(skillDir, "SKILL.md");
-			try {
-				await stat(skillMdPath);
-			} catch {
-				continue;
-			}
-			const skill = await parseSkillMd(skillMdPath);
-			if (!skill) continue;
-			const scopeKey = scope.global ? "global" : "project";
-			const skillKey = `${scopeKey}:${skill.name}`;
-			if (scope.agentType) {
-				if (skillsMap.has(skillKey)) {
-					const existing = skillsMap.get(skillKey);
-					if (!existing.agents.includes(scope.agentType)) existing.agents.push(scope.agentType);
-				} else skillsMap.set(skillKey, {
-					name: skill.name,
-					description: skill.description,
-					path: skillDir,
-					canonicalPath: skillDir,
-					scope: scopeKey,
-					agents: [scope.agentType]
-				});
-				continue;
-			}
-			const sanitizedSkillName = sanitizeName(skill.name);
-			const installedAgents = [];
-			for (const agentType of agentsToCheck) {
-				const agent = agents[agentType];
-				if (scope.global && agent.globalSkillsDir === void 0) continue;
-				const agentBase = scope.global ? agent.globalSkillsDir : join(cwd, agent.skillsDir);
-				let found = false;
-				const possibleNames = Array.from(new Set([
-					entry.name,
-					sanitizedSkillName,
-					skill.name.toLowerCase().replace(/\s+/g, "-").replace(/[\/\\:\0]/g, "")
-				]));
-				for (const possibleName of possibleNames) {
-					const agentSkillDir = join(agentBase, possibleName);
-					if (!isPathSafe(agentBase, agentSkillDir)) continue;
-					try {
-						await access(agentSkillDir);
-						found = true;
-						break;
-					} catch {}
-				}
-				if (!found) try {
-					const agentEntries = await readdir(agentBase, { withFileTypes: true });
-					for (const agentEntry of agentEntries) {
-						const candidateDir = join(agentBase, agentEntry.name);
-						if (!await isDirEntryOrSymlinkToDir(agentEntry, candidateDir)) continue;
-						if (!isPathSafe(agentBase, candidateDir)) continue;
-						try {
-							const candidateSkillMd = join(candidateDir, "SKILL.md");
-							await stat(candidateSkillMd);
-							const candidateSkill = await parseSkillMd(candidateSkillMd);
-							if (candidateSkill && candidateSkill.name === skill.name) {
-								found = true;
-								break;
-							}
-						} catch {}
-					}
-				} catch {}
-				if (found) installedAgents.push(agentType);
-			}
-			if (skillsMap.has(skillKey)) {
-				const existing = skillsMap.get(skillKey);
-				for (const agent of installedAgents) if (!existing.agents.includes(agent)) existing.agents.push(agent);
-			} else skillsMap.set(skillKey, {
-				name: skill.name,
-				description: skill.description,
-				path: skillDir,
-				canonicalPath: skillDir,
-				scope: scopeKey,
-				agents: installedAgents
-			});
-		}
-	} catch {}
-	return Array.from(skillsMap.values());
-}
-const USER_START = "<!-- forge:user-content:start -->";
-const USER_END = "<!-- forge:user-content:end -->";
-function takeoverWithUserContent(existing) {
-	if (existing.includes(USER_START)) return existing;
-	return `${USER_START}\n${existing.trim()}\n${USER_END}\n`;
-}
-function injectPluginRules(agentsMd, plugin, rules) {
-	const start = `<!-- forge-plugin:${plugin.key}:start ref=${plugin.ref} install_mode=codex -->`;
-	const end = `<!-- forge-plugin:${plugin.key}:end -->`;
-	const block = `${start}\n${rules.map((r) => {
-		const rs = `<!-- forge-rule:${r.relativePath}:start -->`;
-		const re = `<!-- forge-rule:${r.relativePath}:end -->`;
-		return `  ${rs}\n${r.content.trimEnd()}\n  ${re}`;
-	}).join("\n")}\n${end}\n`;
-	const existing = findPluginBlock(agentsMd, plugin.key);
-	if (existing) return agentsMd.slice(0, existing.start) + block + agentsMd.slice(existing.end);
-	return agentsMd + (agentsMd.endsWith("\n") ? "" : "\n") + "\n" + block;
-}
-function removePluginRules(agentsMd, pluginKey) {
-	const existing = findPluginBlock(agentsMd, pluginKey);
-	if (!existing) return agentsMd;
-	return agentsMd.slice(0, existing.start) + agentsMd.slice(existing.end);
-}
-function findPluginBlock(agentsMd, pluginKey) {
-	const startMarker = `<!-- forge-plugin:${pluginKey}:start`;
-	const endMarker = `<!-- forge-plugin:${pluginKey}:end -->`;
-	const startIdx = agentsMd.indexOf(startMarker);
-	if (startIdx < 0) return null;
-	const endIdx = agentsMd.indexOf(endMarker, startIdx);
-	if (endIdx < 0) return null;
-	let blockEnd = endIdx + endMarker.length;
-	if (agentsMd[blockEnd] === "\n") blockEnd++;
-	return {
-		start: startIdx,
-		end: blockEnd
-	};
-}
 async function installPlugin(ref, opts) {
 	const cfg = loadConfig();
 	const tarball = await fetchPluginArchive(ref, cfg.portal, cfg.token);
@@ -1866,7 +2015,7 @@ async function installFromExtracted(ref, extractedDir, opts) {
 	const forgeOtherReplacements = [];
 	const statuses = /* @__PURE__ */ new Map();
 	for (const pe of preflight) {
-		const intendedRef = ref + "/" + componentSubRef(pe.component);
+		const intendedRef = ref + "/" + componentSubRef$1(pe.component);
 		const status = await assertEntryReplaceable(pe.entryPath, {
 			intendedRef,
 			intendedCanonical: pe.intendedCanonical,
@@ -2053,7 +2202,7 @@ function parsePluginRef$1(ref) {
 	};
 	throw new Error(`invalid plugin ref: ${ref}`);
 }
-function componentSubRef(c) {
+function componentSubRef$1(c) {
 	switch (c.kind) {
 		case "plugin-skill": return `skills/${c.skillName}`;
 		case "plugin-agent-manifest": return `agents/${c.filename}`;
@@ -2140,14 +2289,6 @@ async function commitPluginInstall(params) {
 			else await copyFileShallow(pe.intendedCanonical, pe.entryPath);
 		}
 	}
-	if (opts.agents.includes("codex") && components.ruleManifests.length > 0) await injectCodexAgentsMdForPlugin({
-		pluginCanonical,
-		pluginRef: ref,
-		pluginKey: `${scopeNamespace}:${pluginName}`,
-		ruleManifests: components.ruleManifests,
-		scope: opts.scope,
-		cwd: opts.cwd
-	});
 	if (opts.agents.includes("codex") && components.agentManifests.length > 0) await registerCodexAgents({
 		pluginCanonical,
 		agentFilenames: components.agentManifests,
@@ -2172,38 +2313,6 @@ async function copyFileShallow(src, dest) {
 	await mkdir(dirname(dest), { recursive: true });
 	await writeFile(dest, buf);
 }
-async function injectCodexAgentsMdForPlugin(params) {
-	const codexAgentsMd = join(params.scope === "global" ? getAgentHome("codex") : join(params.cwd ?? process.cwd(), ".codex"), "AGENTS.md");
-	const canonicalAgentsMd = join(getStoreRoot(params.scope, params.cwd), "codex-agents.md");
-	let userContent = "";
-	try {
-		if ((await stat(codexAgentsMd)).isFile()) userContent = await readFile(codexAgentsMd, "utf-8");
-	} catch {}
-	let canonicalContent = "";
-	try {
-		canonicalContent = await readFile(canonicalAgentsMd, "utf-8");
-	} catch {}
-	if (!canonicalContent) canonicalContent = takeoverWithUserContent(userContent);
-	const rules = [];
-	for (const fname of params.ruleManifests) {
-		const content = await readFile(join(params.pluginCanonical, "rules", fname), "utf-8");
-		rules.push({
-			relativePath: `rules/${fname}`,
-			content
-		});
-	}
-	const updated = injectPluginRules(canonicalContent, {
-		ref: params.pluginRef,
-		key: params.pluginKey
-	}, rules);
-	await mkdir(dirname(canonicalAgentsMd), { recursive: true });
-	await writeFile(canonicalAgentsMd, updated, "utf-8");
-	try {
-		await rm(codexAgentsMd, { force: true });
-	} catch {}
-	await mkdir(dirname(codexAgentsMd), { recursive: true });
-	await symlink(canonicalAgentsMd, codexAgentsMd);
-}
 async function registerCodexAgents(params) {
 	const configToml = join(params.scope === "global" ? getAgentHome("codex") : join(params.cwd ?? process.cwd(), ".codex"), "config.toml");
 	let raw = "";
@@ -2497,8 +2606,6 @@ function track(data) {
 	if (!portalUrl) portalUrl = loadConfig().portal;
 	try {
 		const bodyPayload = {};
-		if ("event" in data) bodyPayload.event = data.event;
-		else if (data.event_type) bodyPayload.event_type = data.event_type;
 		for (const [key, value] of Object.entries(data)) if (value !== void 0 && value !== null) bodyPayload[key] = value;
 		const p = fetch(`${portalUrl}${TELEMETRY_URL_SUFFIX}`, {
 			method: "POST",
@@ -2705,16 +2812,16 @@ var WellKnownProvider = class {
 	}
 };
 const wellKnownProvider = new WellKnownProvider();
-const AGENTS_DIR$1 = ".agents";
-const LOCK_FILE$1 = ".skill-lock.json";
+const AGENTS_DIR = ".agents";
+const LOCK_FILE = ".skill-lock.json";
 const CURRENT_VERSION$1 = 3;
-function getSkillLockPath$1() {
+function getSkillLockPath() {
 	const xdgStateHome = process.env.XDG_STATE_HOME;
-	if (xdgStateHome) return join(xdgStateHome, "skills", LOCK_FILE$1);
-	return join(homedir(), AGENTS_DIR$1, LOCK_FILE$1);
+	if (xdgStateHome) return join(xdgStateHome, "skills", LOCK_FILE);
+	return join(homedir(), AGENTS_DIR, LOCK_FILE);
 }
-async function readSkillLock$1() {
-	const lockPath = getSkillLockPath$1();
+async function readSkillLock() {
+	const lockPath = getSkillLockPath();
 	try {
 		const content = await readFile(lockPath, "utf-8");
 		const parsed = JSON.parse(content);
@@ -2726,7 +2833,7 @@ async function readSkillLock$1() {
 	}
 }
 async function writeSkillLock(lock) {
-	const lockPath = getSkillLockPath$1();
+	const lockPath = getSkillLockPath();
 	await mkdir(dirname(lockPath), { recursive: true });
 	await writeFile(lockPath, JSON.stringify(lock, null, 2), "utf-8");
 }
@@ -2746,14 +2853,8 @@ function getGitHubToken() {
 	} catch {}
 	return null;
 }
-async function fetchSkillFolderHash(ownerRepo, skillPath, token, ref) {
-	const { fetchRepoTree, getSkillFolderHashFromTree } = await Promise.resolve().then(() => blob_exports);
-	const tree = await fetchRepoTree(ownerRepo, ref, token);
-	if (!tree) return null;
-	return getSkillFolderHashFromTree(tree, skillPath);
-}
 async function addSkillToLock(skillName, entry) {
-	const lock = await readSkillLock$1();
+	const lock = await readSkillLock();
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	const existingEntry = lock.skills[skillName];
 	lock.skills[skillName] = {
@@ -2764,20 +2865,14 @@ async function addSkillToLock(skillName, entry) {
 	await writeSkillLock(lock);
 }
 async function removeSkillFromLock(skillName) {
-	const lock = await readSkillLock$1();
+	const lock = await readSkillLock();
 	if (!(skillName in lock.skills)) return false;
 	delete lock.skills[skillName];
 	await writeSkillLock(lock);
 	return true;
 }
-async function getSkillFromLock(skillName) {
-	return (await readSkillLock$1()).skills[skillName] ?? null;
-}
-async function getAllLockedSkills() {
-	return (await readSkillLock$1()).skills;
-}
 async function addPluginToLock(pluginName, entry) {
-	const lock = await readSkillLock$1();
+	const lock = await readSkillLock();
 	if (!lock.plugins) lock.plugins = {};
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	const existing = lock.plugins[pluginName];
@@ -2789,7 +2884,7 @@ async function addPluginToLock(pluginName, entry) {
 	await writeSkillLock(lock);
 }
 async function removePluginFromLock(pluginName) {
-	const lock = await readSkillLock$1();
+	const lock = await readSkillLock();
 	if (!lock.plugins || !(pluginName in lock.plugins)) return false;
 	delete lock.plugins[pluginName];
 	await writeSkillLock(lock);
@@ -2804,10 +2899,10 @@ function createEmptyLockFile() {
 	};
 }
 async function isPromptDismissed(promptKey) {
-	return (await readSkillLock$1()).dismissed?.[promptKey] === true;
+	return (await readSkillLock()).dismissed?.[promptKey] === true;
 }
 async function dismissPrompt(promptKey) {
-	const lock = await readSkillLock$1();
+	const lock = await readSkillLock();
 	if (!lock.dismissed) lock.dismissed = {};
 	lock.dismissed[promptKey] = true;
 	await writeSkillLock(lock);
@@ -2877,6 +2972,13 @@ async function addSkillToLocalLock(skillName, entry, cwd) {
 	lock.skills[skillName] = entry;
 	await writeLocalLock(lock, cwd);
 }
+async function removeSkillFromLocalLock(skillName, cwd) {
+	const lock = await readLocalLock(cwd);
+	if (!(skillName in lock.skills)) return false;
+	delete lock.skills[skillName];
+	await writeLocalLock(lock, cwd);
+	return true;
+}
 async function addPluginToLocalLock(pluginName, entry, cwd) {
 	const lock = await readLocalLock(cwd);
 	if (!lock.plugins) lock.plugins = {};
@@ -2896,13 +2998,6 @@ function createEmptyLocalLock() {
 		skills: {}
 	};
 }
-var blob_exports = /* @__PURE__ */ __exportAll({
-	fetchRepoTree: () => fetchRepoTree,
-	findSkillMdPaths: () => findSkillMdPaths,
-	getSkillFolderHashFromTree: () => getSkillFolderHashFromTree,
-	toSkillSlug: () => toSkillSlug,
-	tryBlobInstall: () => tryBlobInstall
-});
 const DOWNLOAD_BASE_URL = process.env.SKILLS_DOWNLOAD_URL || "https://skills.sh";
 const FETCH_TIMEOUT = 1e4;
 function toSkillSlug(name) {
@@ -3159,7 +3254,7 @@ function shortenPath$2(fullPath, cwd) {
 	if (fullPath === cwd || fullPath.startsWith(cwd + sep)) return "." + fullPath.slice(cwd.length);
 	return fullPath;
 }
-function formatList$1(items, maxShow = 5) {
+function formatList(items, maxShow = 5) {
 	if (items.length <= maxShow) return items.join(", ");
 	const shown = items.slice(0, maxShow);
 	const remaining = items.length - maxShow;
@@ -3175,15 +3270,22 @@ function splitAgentsByType(agentTypes) {
 		symlinked
 	};
 }
-function buildAgentSummaryLines(targetAgents, installMode) {
+function buildAgentSummaryLines(targetAgents, installMode, entry) {
 	const lines = [];
 	const { universal, symlinked } = splitAgentsByType(targetAgents);
 	if (installMode === "symlink") {
-		if (universal.length > 0) lines.push(`  ${import_picocolors.default.green("universal:")} ${formatList$1(universal)}`);
-		if (symlinked.length > 0) lines.push(`  ${import_picocolors.default.dim("symlink →")} ${formatList$1(symlinked)}`);
+		if (universal.length > 0) lines.push(`  ${import_picocolors.default.green("universal:")} ${formatList(universal)}`);
+		if (symlinked.length > 0) if (entry) {
+			const sanitized = sanitizeName(entry.skillName);
+			for (const a of targetAgents) {
+				if (isUniversalAgent(a)) continue;
+				const entryPath = join(getAgentBaseDir(a, entry.scope === "global", entry.cwd), sanitized);
+				lines.push(`  ${import_picocolors.default.dim("symlink →")} ${import_picocolors.default.cyan(shortenPath$2(entryPath, entry.cwd))}  ${import_picocolors.default.dim(`(${agents[a].displayName})`)}`);
+			}
+		} else lines.push(`  ${import_picocolors.default.dim("symlink →")} ${formatList(symlinked)}`);
 	} else {
 		const allNames = targetAgents.map((a) => agents[a].displayName);
-		lines.push(`  ${import_picocolors.default.dim("copy →")} ${formatList$1(allNames)}`);
+		lines.push(`  ${import_picocolors.default.dim("copy →")} ${formatList(allNames)}`);
 	}
 	return lines;
 }
@@ -3198,9 +3300,9 @@ function buildResultLines(results, targetAgents) {
 	const { universal, symlinked: symlinkAgents } = splitAgentsByType(targetAgents);
 	const successfulSymlinks = results.filter((r) => !r.symlinkFailed && !universal.includes(r.agent)).map((r) => r.agent);
 	const failedSymlinks = results.filter((r) => r.symlinkFailed).map((r) => r.agent);
-	if (universal.length > 0) lines.push(`  ${import_picocolors.default.green("universal:")} ${formatList$1(universal)}`);
-	if (successfulSymlinks.length > 0) lines.push(`  ${import_picocolors.default.dim("symlinked:")} ${formatList$1(successfulSymlinks)}`);
-	if (failedSymlinks.length > 0) lines.push(`  ${import_picocolors.default.yellow("copied:")} ${formatList$1(failedSymlinks)}`);
+	if (universal.length > 0) lines.push(`  ${import_picocolors.default.green("universal:")} ${formatList(universal)}`);
+	if (successfulSymlinks.length > 0) lines.push(`  ${import_picocolors.default.dim("symlinked:")} ${formatList(successfulSymlinks)}`);
+	if (failedSymlinks.length > 0) lines.push(`  ${import_picocolors.default.yellow("copied:")} ${formatList(failedSymlinks)}`);
 	return lines;
 }
 function multiselect(opts) {
@@ -3218,15 +3320,26 @@ async function promptForAgents(message, choices) {
 		required: true
 	});
 }
+const PLUGIN_ENTRY_ROOTS = {
+	"claude-code": [".claude"],
+	cursor: [".cursor"],
+	codex: [".codex", ".agents/skills"]
+};
 function buildAgentChoices(agentList, options = {}) {
 	return agentList.map((a) => {
 		const cfg = agents[a];
-		const baseHint = options.global && cfg.globalSkillsDir ? cfg.globalSkillsDir : cfg.skillsDir;
-		const isShared = !options.global && isUniversalAgent(a);
+		let hint;
+		if (options.forPlugin) {
+			const roots = PLUGIN_ENTRY_ROOTS[a];
+			hint = options.global ? roots.map((r) => `~/${r}`).join(", ") : roots.join(", ");
+		} else {
+			const baseHint = options.global && cfg.globalSkillsDir ? cfg.globalSkillsDir : cfg.skillsDir;
+			hint = !options.global && isUniversalAgent(a) ? `${baseHint}, shared` : baseHint;
+		}
 		return {
 			value: a,
 			label: cfg.displayName,
-			hint: isShared ? `${baseHint}, shared` : baseHint
+			hint
 		};
 	});
 }
@@ -3404,11 +3517,15 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 		if (summaryLines.length > 0) summaryLines.push("");
 		const shortCanonical = shortenPath$2(getCanonicalPath(skill.installName, { global: installGlobally }), cwd);
 		summaryLines.push(`${import_picocolors.default.cyan(shortCanonical)}`);
-		summaryLines.push(...buildAgentSummaryLines(targetAgents, installMode));
+		summaryLines.push(...buildAgentSummaryLines(targetAgents, installMode, {
+			skillName: skill.installName,
+			scope: installGlobally ? "global" : "project",
+			cwd
+		}));
 		if (skill.files.size > 1) summaryLines.push(`  ${import_picocolors.default.dim("files:")} ${skill.files.size}`);
 		const skillOverwrites = overwriteStatus.get(skill.installName);
 		const overwriteAgents = targetAgents.filter((a) => skillOverwrites?.get(a)).map((a) => agents[a].displayName);
-		if (overwriteAgents.length > 0) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList$1(overwriteAgents)}`);
+		if (overwriteAgents.length > 0) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList(overwriteAgents)}`);
 	}
 	console.log();
 	Me(summaryLines.join("\n"), "Installation Summary");
@@ -3501,7 +3618,7 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 		const title = import_picocolors.default.green(`Installed ${skillCount} skill${skillCount !== 1 ? "s" : ""}`);
 		Me(resultLines.join("\n"), title);
 		if (symlinkFailures.length > 0) {
-			M.warn(import_picocolors.default.yellow(`Symlinks failed for: ${formatList$1(copiedAgents)}`));
+			M.warn(import_picocolors.default.yellow(`Symlinks failed for: ${formatList(copiedAgents)}`));
 			M.message(import_picocolors.default.dim("  Files were copied instead. On Windows, enable Developer Mode for symlink support."));
 		}
 	}
@@ -3515,14 +3632,16 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 	await promptForFindSkills(options, targetAgents);
 }
 async function runTeamBatchAdd(teamScope, options) {
-	const cfg = loadConfig();
+	let cfg = loadConfig();
 	if (!cfg.token) {
-		console.log();
-		console.log(import_picocolors.default.bgRed(import_picocolors.default.white(import_picocolors.default.bold(" ERROR "))) + " " + import_picocolors.default.red("Login required for team installs"));
-		console.log();
-		console.log(`  Run ${import_picocolors.default.cyan("shoplazza-ai-dev-cli login")} first.`);
-		console.log();
-		process.exit(1);
+		await runLogin({ force: true });
+		cfg = loadConfig();
+		if (!cfg.token) {
+			console.log();
+			console.log(import_picocolors.default.bgRed(import_picocolors.default.white(import_picocolors.default.bold(" ERROR "))) + " " + import_picocolors.default.red("Login required for team installs"));
+			console.log();
+			process.exit(1);
+		}
 	}
 	console.log();
 	Ie(import_picocolors.default.bgCyan(import_picocolors.default.black(" skills ")));
@@ -3537,10 +3656,9 @@ async function runTeamBatchAdd(teamScope, options) {
 		Se(import_picocolors.default.red(msg));
 		process.exit(1);
 	}
-	const skills = items.filter((i) => i.kind === "skill");
-	spinner.stop(`Found ${skills.length} skill${skills.length === 1 ? "" : "s"}`);
-	if (skills.length === 0) {
-		Se(import_picocolors.default.dim(`Team "${teamScope}" has no skills.`));
+	spinner.stop(`Found ${items.length} asset${items.length === 1 ? "" : "s"}`);
+	if (items.length === 0) {
+		Se(import_picocolors.default.dim(`Team "${teamScope}" has no assets.`));
 		return;
 	}
 	const validAgents = Object.keys(agents);
@@ -3616,8 +3734,8 @@ async function runTeamBatchAdd(teamScope, options) {
 		global: installGlobally
 	};
 	let failures = 0;
-	for (const item of skills) {
-		M.step(`Installing ${import_picocolors.default.cyan(item.name)}`);
+	for (const item of items) {
+		M.step(`Installing ${import_picocolors.default.cyan(item.name)} (${item.kind})`);
 		try {
 			await runAdd([item.ref], childOptions);
 		} catch (err) {
@@ -3627,9 +3745,9 @@ async function runTeamBatchAdd(teamScope, options) {
 		}
 	}
 	console.log();
-	if (failures === 0) Se(import_picocolors.default.green(`Installed ${skills.length} skill${skills.length === 1 ? "" : "s"} from team "${teamScope}"`));
+	if (failures === 0) Se(import_picocolors.default.green(`Installed ${items.length} asset${items.length === 1 ? "" : "s"} from team "${teamScope}"`));
 	else {
-		Se(import_picocolors.default.yellow(`Installed ${skills.length - failures}/${skills.length} skills (${failures} failed) from team "${teamScope}"`));
+		Se(import_picocolors.default.yellow(`Installed ${items.length - failures}/${items.length} assets (${failures} failed) from team "${teamScope}"`));
 		process.exit(1);
 	}
 	await promptForFindSkills(options, targetAgents);
@@ -3730,7 +3848,10 @@ async function runAdd(args, options = {}) {
 					spinner.stop(`${Object.keys(agents).length} agents`);
 					if (options.yes) targetAgents = installedAgents.length > 0 ? ensureUniversalAgents(installedAgents) : validAgents;
 					else if (installedAgents.length === 0) {
-						const selected = await promptForAgents("Which IDEs do you want to install this plugin to?", buildAgentChoices(Object.keys(agents), { global: options.global }));
+						const selected = await promptForAgents("Which IDEs do you want to install this plugin to?", buildAgentChoices(Object.keys(agents), {
+							global: options.global,
+							forPlugin: true
+						}));
 						if (pD(selected)) {
 							xe("Installation cancelled");
 							await cleanup(tempDir);
@@ -3741,7 +3862,10 @@ async function runAdd(args, options = {}) {
 						targetAgents = ensureUniversalAgents(installedAgents);
 						M.info(`Installing to: ${import_picocolors.default.cyan(agents[installedAgents[0]].displayName)}`);
 					} else {
-						const selected = await selectAgentsInteractive({ global: options.global });
+						const selected = await selectAgentsInteractive({
+							global: options.global,
+							forPlugin: true
+						});
 						if (pD(selected)) {
 							xe("Installation cancelled");
 							await cleanup(tempDir);
@@ -3776,8 +3900,8 @@ async function runAdd(args, options = {}) {
 					const summaryLines = [];
 					summaryLines.push(import_picocolors.default.cyan(shortenPath$2(previewCanonical, process.cwd())));
 					const agentNames = targetAgents.map((a) => agents[a].displayName);
-					if (agentNames.length > 0) summaryLines.push(`  ${import_picocolors.default.dim("symlink →")} ${formatList$1(agentNames)}`);
-					if (existsSync(previewCanonical)) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList$1(agentNames)}`);
+					if (agentNames.length > 0) summaryLines.push(`  ${import_picocolors.default.dim("symlink →")} ${formatList(agentNames)}`);
+					if (existsSync(previewCanonical)) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList(agentNames)}`);
 					console.log();
 					Me(summaryLines.join("\n"), "Installation Summary");
 				}
@@ -3848,7 +3972,7 @@ async function runAdd(args, options = {}) {
 							pluginPath: lockPluginPath,
 							computedHash: lockHash
 						});
-						M.info(`Recorded in lock file: ${import_picocolors.default.dim(getSkillLockPath$1())}`);
+						M.info(`Recorded in lock file: ${import_picocolors.default.dim(getSkillLockPath())}`);
 					} else {
 						await addPluginToLocalLock(lockPluginName, {
 							source: lockSource,
@@ -4225,16 +4349,21 @@ async function runAdd(args, options = {}) {
 			if (!groupedSummary[group]) groupedSummary[group] = [];
 			groupedSummary[group].push(skill);
 		} else ungroupedSummary.push(skill);
-		const _summaryStoreRoot = getStoreRoot(installGlobally ? "global" : "project", cwd);
+		const _summaryScope = installGlobally ? "global" : "project";
+		const _summaryStoreRoot = getStoreRoot(_summaryScope, cwd);
 		const printSkillSummary = (skills) => {
 			for (const skill of skills) {
 				if (summaryLines.length > 0) summaryLines.push("");
 				const shortCanonical = shortenPath$2(join(_summaryStoreRoot, "skills", `${_summaryScopeNs}__${sanitizeName(skill.name)}`), cwd);
 				summaryLines.push(`${import_picocolors.default.cyan(shortCanonical)}`);
-				summaryLines.push(...buildAgentSummaryLines(targetAgents, installMode));
+				summaryLines.push(...buildAgentSummaryLines(targetAgents, installMode, {
+					skillName: skill.name,
+					scope: _summaryScope,
+					cwd
+				}));
 				const skillOverwrites = overwriteStatus.get(skill.name);
 				const overwriteAgents = targetAgents.filter((a) => skillOverwrites?.get(a)).map((a) => agents[a].displayName);
-				if (overwriteAgents.length > 0) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList$1(overwriteAgents)}`);
+				if (overwriteAgents.length > 0) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList(overwriteAgents)}`);
 			}
 		};
 		const sortedGroups = Object.keys(groupedSummary).sort();
@@ -4493,7 +4622,7 @@ async function runAdd(args, options = {}) {
 			const title = import_picocolors.default.green(`Installed ${skillCount} skill${skillCount !== 1 ? "s" : ""}`);
 			Me(resultLines.join("\n"), title);
 			if (symlinkFailures.length > 0) {
-				M.warn(import_picocolors.default.yellow(`Symlinks failed for: ${formatList$1(copiedAgents)}`));
+				M.warn(import_picocolors.default.yellow(`Symlinks failed for: ${formatList(copiedAgents)}`));
 				M.message(import_picocolors.default.dim("  Files were copied instead. On Windows, enable Developer Mode for symlink support."));
 			}
 		}
@@ -4627,7 +4756,7 @@ function parseAddOptions(args) {
 const RESET$2 = "\x1B[0m";
 const BOLD$2 = "\x1B[1m";
 const DIM$2 = "\x1B[38;5;102m";
-const TEXT$1 = "\x1B[38;5;145m";
+const TEXT$2 = "\x1B[38;5;145m";
 const CYAN$1 = "\x1B[36m";
 const SEARCH_API_BASE = process.env.SKILLS_API_URL || "https://skills.sh";
 function formatInstalls(count) {
@@ -4672,7 +4801,7 @@ async function runSearchPrompt(initialQuery = "") {
 		process.stdout.write(CLEAR_DOWN);
 		const lines = [];
 		const cursor = `${BOLD$2}_${RESET$2}`;
-		lines.push(`${TEXT$1}Search skills:${RESET$2} ${query}${cursor}`);
+		lines.push(`${TEXT$2}Search skills:${RESET$2} ${query}${cursor}`);
 		lines.push("");
 		if (!query || query.length < 2) lines.push(`${DIM$2}Start typing to search (min 2 chars)${RESET$2}`);
 		else if (results.length === 0 && loading) lines.push(`${DIM$2}Searching...${RESET$2}`);
@@ -4683,7 +4812,7 @@ async function runSearchPrompt(initialQuery = "") {
 				const skill = visible[i];
 				const isSelected = i === selectedIndex;
 				const arrow = isSelected ? `${BOLD$2}>${RESET$2}` : " ";
-				const name = isSelected ? `${BOLD$2}${skill.name}${RESET$2}` : `${TEXT$1}${skill.name}${RESET$2}`;
+				const name = isSelected ? `${BOLD$2}${skill.name}${RESET$2}` : `${TEXT$2}${skill.name}${RESET$2}`;
 				const source = skill.source ? ` ${DIM$2}${skill.source}${RESET$2}` : "";
 				const installs = formatInstalls(skill.installs);
 				const installsBadge = installs ? ` ${CYAN$1}${installs}${RESET$2}` : "";
@@ -4793,11 +4922,6 @@ ${DIM$2}  1) npx skills find [query]${RESET$2}
 ${DIM$2}  2) npx skills add <owner/repo@skill>${RESET$2}`;
 	if (query) {
 		const results = await searchSkillsAPI(query);
-		track({
-			event: "find",
-			query,
-			resultCount: String(results.length)
-		});
 		if (results.length === 0) {
 			console.log(`${DIM$2}No skills found for "${query}"${RESET$2}`);
 			return;
@@ -4807,7 +4931,7 @@ ${DIM$2}  2) npx skills add <owner/repo@skill>${RESET$2}`;
 		for (const skill of results.slice(0, 6)) {
 			const pkg = skill.source || skill.slug;
 			const installs = formatInstalls(skill.installs);
-			console.log(`${TEXT$1}${pkg}@${skill.name}${RESET$2}${installs ? ` ${CYAN$1}${installs}${RESET$2}` : ""}`);
+			console.log(`${TEXT$2}${pkg}@${skill.name}${RESET$2}${installs ? ` ${CYAN$1}${installs}${RESET$2}` : ""}`);
 			console.log(`${DIM$2}└ https://skills.sh/${skill.slug}${RESET$2}`);
 			console.log();
 		}
@@ -4818,12 +4942,6 @@ ${DIM$2}  2) npx skills add <owner/repo@skill>${RESET$2}`;
 		console.log();
 	}
 	const selected = await runSearchPrompt();
-	track({
-		event: "find",
-		query: "",
-		resultCount: selected ? "1" : "0",
-		interactive: "1"
-	});
 	if (!selected) {
 		console.log(`${DIM$2}Search cancelled${RESET$2}`);
 		console.log();
@@ -4832,7 +4950,7 @@ ${DIM$2}  2) npx skills add <owner/repo@skill>${RESET$2}`;
 	const pkg = selected.source || selected.slug;
 	const skillName = selected.name;
 	console.log();
-	console.log(`${TEXT$1}Installing ${BOLD$2}${skillName}${RESET$2} from ${DIM$2}${pkg}${RESET$2}...`);
+	console.log(`${TEXT$2}Installing ${BOLD$2}${skillName}${RESET$2} from ${DIM$2}${pkg}${RESET$2}...`);
 	console.log();
 	const { source, options } = parseAddOptions([
 		pkg,
@@ -4842,11 +4960,11 @@ ${DIM$2}  2) npx skills add <owner/repo@skill>${RESET$2}`;
 	await runAdd(source, options);
 	console.log();
 	const info = getOwnerRepoFromString(pkg);
-	if (info && await isRepoPublic(info.owner, info.repo)) console.log(`${DIM$2}View the skill at${RESET$2} ${TEXT$1}https://skills.sh/${selected.slug}${RESET$2}`);
-	else console.log(`${DIM$2}Discover more skills at${RESET$2} ${TEXT$1}https://skills.sh${RESET$2}`);
+	if (info && await isRepoPublic(info.owner, info.repo)) console.log(`${DIM$2}View the skill at${RESET$2} ${TEXT$2}https://skills.sh/${selected.slug}${RESET$2}`);
+	else console.log(`${DIM$2}Discover more skills at${RESET$2} ${TEXT$2}https://skills.sh${RESET$2}`);
 	console.log();
 }
-const isCancelled$1 = (value) => typeof value === "symbol";
+const isCancelled = (value) => typeof value === "symbol";
 function shortenPath$1(fullPath, cwd) {
 	const home = homedir();
 	if (fullPath === home || fullPath.startsWith(home + sep)) return "~" + fullPath.slice(home.length);
@@ -4997,7 +5115,7 @@ async function runSync(args, options = {}) {
 				initialSelected: [],
 				required: true
 			});
-			if (isCancelled$1(selected)) {
+			if (isCancelled(selected)) {
 				xe("Sync cancelled");
 				process.exit(0);
 			}
@@ -5023,7 +5141,7 @@ async function runSync(args, options = {}) {
 				initialSelected: installedAgents.filter((a) => allAgents.includes(a)),
 				required: true
 			});
-			if (isCancelled$1(selected)) {
+			if (isCancelled(selected)) {
 				xe("Sync cancelled");
 				process.exit(0);
 			}
@@ -5102,12 +5220,6 @@ async function runSync(args, options = {}) {
 		M.error(import_picocolors.default.red(`Failed to install ${failed.length}`));
 		for (const r of failed) M.message(`  ${import_picocolors.default.red("✗")} ${r.skill} → ${r.agent}: ${import_picocolors.default.dim(r.error)}`);
 	}
-	track({
-		event: "experimental_sync",
-		skillCount: String(toInstall.length),
-		successCount: String(successfulSkillNames.size),
-		agents: targetAgents.join(",")
-	});
 	console.log();
 	Se(import_picocolors.default.green("Done!") + import_picocolors.default.dim("  Review skills before use; they run with full agent permissions."));
 }
@@ -5183,26 +5295,14 @@ async function runInstallFromLock(args) {
 const RESET$1 = "\x1B[0m";
 const BOLD$1 = "\x1B[1m";
 const DIM$1 = "\x1B[38;5;102m";
+const TEXT$1 = "\x1B[38;5;145m";
 const CYAN = "\x1B[36m";
 const YELLOW = "\x1B[33m";
-function shortenPath(fullPath, cwd) {
-	const home = homedir();
-	if (fullPath.startsWith(home)) return fullPath.replace(home, "~");
-	if (fullPath.startsWith(cwd)) return "." + fullPath.slice(cwd.length);
-	return fullPath;
-}
-function formatList(items, maxShow = 5) {
-	if (items.length <= maxShow) return items.join(", ");
-	const shown = items.slice(0, maxShow);
-	const remaining = items.length - maxShow;
-	return `${shown.join(", ")} +${remaining} more`;
-}
 function parseListOptions(args) {
 	const options = {};
 	for (let i = 0; i < args.length; i++) {
 		const arg = args[i];
-		if (arg === "-g" || arg === "--global") options.global = true;
-		else if (arg === "--json") options.json = true;
+		if (arg === "--json") options.json = true;
 		else if (arg === "-a" || arg === "--agent") {
 			options.agent = options.agent || [];
 			while (i + 1 < args.length && !args[i + 1].startsWith("-")) options.agent.push(args[++i]);
@@ -5210,152 +5310,393 @@ function parseListOptions(args) {
 	}
 	return options;
 }
+function shortenPath(fullPath, cwd) {
+	const home = homedir();
+	if (fullPath.startsWith(home)) return fullPath.replace(home, "~");
+	if (fullPath.startsWith(cwd)) return "." + fullPath.slice(cwd.length);
+	return fullPath;
+}
+function ledgerToComponent$1(c, pluginCanonical) {
+	switch (c.type) {
+		case "skill": return {
+			kind: "plugin-skill",
+			pluginCanonical,
+			skillName: c.name
+		};
+		case "agent-manifest": return {
+			kind: "plugin-agent-manifest",
+			pluginCanonical,
+			filename: c.name
+		};
+		case "agent-deps-dir": return {
+			kind: "plugin-agent-deps-dir",
+			pluginCanonical,
+			dirname: c.name
+		};
+		case "rule-manifest": return {
+			kind: "plugin-rule-manifest",
+			pluginCanonical,
+			filename: c.name
+		};
+		case "rule-deps-dir": return {
+			kind: "plugin-rule-deps-dir",
+			pluginCanonical,
+			dirname: c.name
+		};
+		default: return null;
+	}
+}
+async function entryHits(entryPath, canonicalRoot) {
+	if (!entryPath) return false;
+	try {
+		const realEntry = await realpath(entryPath);
+		let realCanon = canonicalRoot;
+		try {
+			realCanon = await realpath(canonicalRoot);
+		} catch {}
+		return realEntry === realCanon || realEntry.startsWith(realCanon + sep) || realEntry === canonicalRoot || realEntry.startsWith(canonicalRoot + sep);
+	} catch {
+		return false;
+	}
+}
+function standaloneSkillEntryPaths(skillName, agent, cwd) {
+	const paths = [];
+	if (agent === "claude-code") {
+		paths.push(join(cwd, ".claude", "skills", skillName));
+		paths.push(join(homedir(), ".claude", "skills", skillName));
+	} else if (agent === "cursor") {
+		paths.push(join(cwd, ".cursor", "skills", skillName));
+		paths.push(join(homedir(), ".cursor", "skills", skillName));
+	} else if (agent === "codex") {
+		paths.push(join(cwd, ".agents", "skills", skillName));
+		paths.push(join(homedir(), ".agents", "skills", skillName));
+	}
+	return paths;
+}
+async function collectPluginLinks(pluginCanonical, installedComponents, agentFilter, cwd) {
+	const out = [];
+	for (const ag of agentFilter) for (const c of installedComponents) {
+		const comp = ledgerToComponent$1(c, pluginCanonical);
+		if (!comp) continue;
+		for (const scope of ["project", "global"]) {
+			const t = getInstallTargets(ag, comp, scope, cwd);
+			if (!t.entry) continue;
+			if (await entryHits(t.entry, pluginCanonical)) out.push({
+				agent: ag,
+				entryPath: t.entry,
+				componentType: c.type,
+				componentName: c.name
+			});
+		}
+	}
+	return out;
+}
+async function collectSkillLinks(canonical, skillName, agentFilter, cwd) {
+	const out = [];
+	for (const ag of agentFilter) for (const p of standaloneSkillEntryPaths(skillName, ag, cwd)) if (await entryHits(p, canonical)) out.push({
+		agent: ag,
+		entryPath: p
+	});
+	return out;
+}
+function uniqueAgents(links) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const l of links) seen.add(l.agent);
+	return Array.from(seen);
+}
+async function scanStore(cwd, agentFilter) {
+	const storeRoot = getStoreRoot();
+	const pluginsDir = join(storeRoot, "plugins");
+	const skillsDir = join(storeRoot, "skills");
+	const agentList = agentFilter ?? Object.keys(agents);
+	const plugins = [];
+	const skills = [];
+	let pluginDirs = [];
+	try {
+		pluginDirs = (await readdir(pluginsDir, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
+	} catch {}
+	for (const dirName of pluginDirs) {
+		const canonical = join(pluginsDir, dirName);
+		const ledgerPath = join(canonical, ".forge-plugin.json");
+		let ledger;
+		try {
+			ledger = JSON.parse(await readFile(ledgerPath, "utf-8"));
+		} catch {
+			continue;
+		}
+		if (!ledger.ref || !ledger.name) continue;
+		const installedComponents = ledger.installed_components ?? [];
+		const components = {
+			skills: [],
+			agents: [],
+			rules: []
+		};
+		for (const c of installedComponents) if (c.type === "skill") components.skills.push(c.name);
+		else if (c.type === "agent-manifest" || c.type === "agent-deps-dir") components.agents.push(c.name);
+		else if (c.type === "rule-manifest" || c.type === "rule-deps-dir") components.rules.push(c.name);
+		const links = await collectPluginLinks(canonical, installedComponents, agentList, cwd);
+		plugins.push({
+			name: ledger.name,
+			ref: ledger.ref,
+			canonical,
+			components,
+			agents: uniqueAgents(links),
+			links
+		});
+	}
+	let skillDirs = [];
+	try {
+		skillDirs = (await readdir(skillsDir, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
+	} catch {}
+	for (const dirName of skillDirs) {
+		const canonical = join(skillsDir, dirName);
+		const sidecarPath = join(canonical, ".forge-source.json");
+		let sidecar;
+		try {
+			sidecar = JSON.parse(await readFile(sidecarPath, "utf-8"));
+		} catch {
+			continue;
+		}
+		if (sidecar.type && sidecar.type !== "skill") continue;
+		if (sidecar.parent_plugin_ref) continue;
+		if (!sidecar.name) continue;
+		const links = await collectSkillLinks(canonical, sidecar.name, agentList, cwd);
+		skills.push({
+			name: sidecar.name,
+			ref: sidecar.ref,
+			canonical,
+			agents: uniqueAgents(links),
+			links
+		});
+	}
+	plugins.sort((a, b) => a.name.localeCompare(b.name));
+	skills.sort((a, b) => a.name.localeCompare(b.name));
+	return {
+		plugins,
+		skills
+	};
+}
+function pluralize(count, singular, plural) {
+	return count === 1 ? `${count} ${singular}` : `${count} ${plural ?? singular + "s"}`;
+}
+function pluginComponentSummary(plugin) {
+	const parts = [];
+	parts.push(pluralize(plugin.components.skills.length, "skill"));
+	parts.push(pluralize(plugin.components.agents.length, "agent"));
+	parts.push(pluralize(plugin.components.rules.length, "rule"));
+	return parts.join(" · ");
+}
 async function runList(args) {
 	const options = parseListOptions(args);
-	const scope = options.global === true ? true : false;
+	const cwd = process.cwd();
 	let agentFilter;
 	if (options.agent && options.agent.length > 0) {
 		const validAgents = Object.keys(agents);
-		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
-		if (invalidAgents.length > 0) {
-			console.log(`${YELLOW}Invalid agents: ${invalidAgents.join(", ")}${RESET$1}`);
+		const invalid = options.agent.filter((a) => !validAgents.includes(a));
+		if (invalid.length > 0) {
+			console.log(`${YELLOW}Invalid agents: ${invalid.join(", ")}${RESET$1}`);
 			console.log(`${DIM$1}Valid agents: ${validAgents.join(", ")}${RESET$1}`);
 			process.exit(1);
 		}
 		agentFilter = options.agent;
 	}
-	const installedSkills = await listInstalledSkills({
-		global: scope,
-		agentFilter
-	});
+	const inventory = await scanStore(cwd, agentFilter);
 	if (options.json) {
-		const jsonOutput = installedSkills.map((skill) => ({
-			name: skill.name,
-			path: skill.canonicalPath,
-			scope: skill.scope,
-			agents: skill.agents.map((a) => agents[a].displayName)
-		}));
-		console.log(JSON.stringify(jsonOutput, null, 2));
+		const out = {
+			plugins: inventory.plugins.map((p) => ({
+				name: p.name,
+				ref: p.ref,
+				canonical: p.canonical,
+				agents: p.agents,
+				components: p.components,
+				links: p.links
+			})),
+			skills: inventory.skills.map((s) => ({
+				name: s.name,
+				ref: s.ref ?? null,
+				canonical: s.canonical,
+				agents: s.agents,
+				links: s.links
+			}))
+		};
+		console.log(JSON.stringify(out, null, 2));
 		return;
 	}
-	const lockedSkills = await getAllLockedSkills();
-	const cwd = process.cwd();
-	const scopeLabel = scope ? "Global" : "Project";
-	if (installedSkills.length === 0) {
-		if (options.json) {
-			console.log("[]");
-			return;
-		}
-		console.log(`${DIM$1}No ${scopeLabel.toLowerCase()} skills found.${RESET$1}`);
-		if (scope) console.log(`${DIM$1}Try listing project skills without -g${RESET$1}`);
-		else console.log(`${DIM$1}Try listing global skills with -g${RESET$1}`);
+	if (inventory.plugins.length === 0 && inventory.skills.length === 0) {
+		console.log(`${DIM$1}No forge-managed skills or plugins installed.${RESET$1}`);
+		console.log(`${DIM$1}Run${RESET$1} ${TEXT$1}add <ref>${RESET$1} ${DIM$1}to install one.${RESET$1}`);
 		return;
 	}
-	function printSkill(skill, indent = false) {
-		const prefix = indent ? "  " : "";
-		const shortPath = shortenPath(skill.canonicalPath, cwd);
-		const agentNames = skill.agents.map((a) => agents[a].displayName);
-		const agentInfo = skill.agents.length > 0 ? formatList(agentNames) : `${YELLOW}not linked${RESET$1}`;
-		console.log(`${prefix}${CYAN}${sanitizeMetadata(skill.name)}${RESET$1} ${DIM$1}${shortPath}${RESET$1}`);
-		console.log(`${prefix}  ${DIM$1}Agents:${RESET$1} ${agentInfo}`);
-	}
-	console.log(`${BOLD$1}${scopeLabel} Skills${RESET$1}`);
-	console.log();
-	const groupedSkills = {};
-	const ungroupedSkills = [];
-	for (const skill of installedSkills) {
-		const lockEntry = lockedSkills[skill.name];
-		if (lockEntry?.pluginName) {
-			const group = lockEntry.pluginName;
-			if (!groupedSkills[group]) groupedSkills[group] = [];
-			groupedSkills[group].push(skill);
-		} else ungroupedSkills.push(skill);
-	}
-	if (Object.keys(groupedSkills).length > 0) {
-		const sortedGroups = Object.keys(groupedSkills).sort();
-		for (const group of sortedGroups) {
-			const title = group.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
-			console.log(`${BOLD$1}${title}${RESET$1}`);
-			const skills = groupedSkills[group];
-			if (skills) for (const skill of skills) printSkill(skill, true);
+	if (inventory.plugins.length > 0) {
+		console.log(`${BOLD$1}Plugins${RESET$1}`);
+		for (const plugin of inventory.plugins) {
+			const safeName = sanitizeMetadata(plugin.name);
+			console.log(`  ${CYAN}${safeName}${RESET$1}  ${DIM$1}${plugin.ref}${RESET$1}`);
+			console.log(`    ${DIM$1}${shortenPath(plugin.canonical, cwd)}${RESET$1}`);
+			console.log(`    ${DIM$1}Components:${RESET$1} ${pluginComponentSummary(plugin)}`);
+			printLinkedFrom(plugin.links, cwd);
 			console.log();
 		}
-		if (ungroupedSkills.length > 0) {
-			console.log(`${BOLD$1}General${RESET$1}`);
-			for (const skill of ungroupedSkills) printSkill(skill, true);
+	}
+	if (inventory.skills.length > 0) {
+		console.log(`${BOLD$1}Skills${RESET$1}`);
+		for (const skill of inventory.skills) {
+			const safeName = sanitizeMetadata(skill.name);
+			const refTail = skill.ref ? `  ${DIM$1}${skill.ref}${RESET$1}` : "";
+			console.log(`  ${CYAN}${safeName}${RESET$1}${refTail}`);
+			console.log(`    ${DIM$1}${shortenPath(skill.canonical, cwd)}${RESET$1}`);
+			printLinkedFrom(skill.links, cwd);
 			console.log();
 		}
-	} else {
-		for (const skill of installedSkills) printSkill(skill);
-		console.log();
 	}
 }
-async function removeCommand(skillNames, options) {
-	const isGlobal = options.global ?? false;
-	const cwd = process.cwd();
-	const pluginRefRe = /^@[^/]+\/plugins\/[^/]+/;
-	const pluginRefs = skillNames.filter((n) => pluginRefRe.test(n));
-	if (pluginRefs.length > 0) {
-		const scope = isGlobal ? "global" : "project";
-		for (const ref of pluginRefs) try {
-			M.info(`Uninstalling plugin ${import_picocolors.default.cyan(ref)}...`);
-			await uninstallPlugin(ref, scope, cwd);
-			M.success(import_picocolors.default.green(`Plugin ${ref} uninstalled`));
-		} catch (err) {
-			M.error(import_picocolors.default.red(`Failed to uninstall plugin ${ref}: ${err instanceof Error ? err.message : String(err)}`));
+function printLinkedFrom(links, cwd) {
+	if (links.length === 0) {
+		console.log(`    ${DIM$1}Linked from:${RESET$1} ${YELLOW}(none)${RESET$1}`);
+		return;
+	}
+	const grouped = /* @__PURE__ */ new Map();
+	for (const l of links) {
+		const list = grouped.get(l.agent) ?? [];
+		list.push(shortenPath(l.entryPath, cwd));
+		grouped.set(l.agent, list);
+	}
+	if (grouped.size === 1) {
+		const [agent, paths] = grouped.entries().next().value;
+		if (paths.length === 1) {
+			console.log(`    ${DIM$1}Linked from:${RESET$1} ${agents[agent].displayName}  ${DIM$1}${paths[0]}${RESET$1}`);
+			return;
 		}
-		const nonPluginNames = skillNames.filter((n) => !pluginRefRe.test(n));
-		if (nonPluginNames.length === 0) return;
-		skillNames = nonPluginNames;
 	}
-	const spinner = Y();
-	spinner.start("Scanning for installed skills...");
-	const skillNamesSet = /* @__PURE__ */ new Set();
-	const scanDir = async (dir) => {
-		try {
-			const entries = await readdir(dir, { withFileTypes: true });
-			for (const entry of entries) if (entry.isDirectory()) skillNamesSet.add(entry.name);
-		} catch (err) {
-			if (err instanceof Error && err.code !== "ENOENT") M.warn(`Could not scan directory ${dir}: ${err.message}`);
+	console.log(`    ${DIM$1}Linked from:${RESET$1}`);
+	const labelWidth = Math.max(...Array.from(grouped.keys()).map((a) => agents[a].displayName.length));
+	for (const [agent, paths] of grouped) {
+		const label = agents[agent].displayName.padEnd(labelWidth);
+		if (paths.length === 1) console.log(`      ${label}  ${DIM$1}${paths[0]}${RESET$1}`);
+		else {
+			console.log(`      ${label}`);
+			for (const p of paths) console.log(`        ${DIM$1}${p}${RESET$1}`);
 		}
-	};
-	if (isGlobal) {
-		await scanDir(getCanonicalSkillsDir(true, cwd));
-		for (const agent of Object.values(agents)) if (agent.globalSkillsDir !== void 0) await scanDir(agent.globalSkillsDir);
-	} else {
-		await scanDir(getCanonicalSkillsDir(false, cwd));
-		for (const agent of Object.values(agents)) await scanDir(join(cwd, agent.skillsDir));
 	}
-	const installedSkills = Array.from(skillNamesSet).sort();
-	spinner.stop(`Found ${installedSkills.length} unique installed skill(s)`);
-	if (installedSkills.length === 0) {
-		Se(import_picocolors.default.yellow("No skills found to remove."));
-		return;
+}
+const PLUGIN_REF_RE = /^@(?:public|teams\/[^/]+)\/plugins\/[^/]+/;
+function isPluginRef(s) {
+	return PLUGIN_REF_RE.test(s);
+}
+function parseRemoveOptions(args) {
+	const options = {};
+	const skills = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "-y" || arg === "--yes") options.yes = true;
+		else if (arg === "--all") options.all = true;
+		else if (arg === "-a" || arg === "--agent") {
+			options.agent = options.agent || [];
+			i++;
+			let nextArg = args[i];
+			while (i < args.length && nextArg && !nextArg.startsWith("-")) {
+				options.agent.push(nextArg);
+				i++;
+				nextArg = args[i];
+			}
+			i--;
+		} else if (arg && !arg.startsWith("-")) skills.push(arg);
 	}
+	return {
+		skills,
+		options
+	};
+}
+function findOwningPlugin(name, inventory) {
+	const lower = name.toLowerCase();
+	for (const plugin of inventory.plugins) if (plugin.components.skills.some((s) => s.toLowerCase() === lower) || plugin.components.agents.some((a) => a.toLowerCase() === lower) || plugin.components.rules.some((r) => r.toLowerCase() === lower)) return plugin;
+	return null;
+}
+async function removeCommand(skillNames, options) {
+	const cwd = process.cwd();
 	if (options.agent && options.agent.length > 0) {
 		const validAgents = Object.keys(agents);
-		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
-		if (invalidAgents.length > 0) {
-			M.error(`Invalid agents: ${invalidAgents.join(", ")}`);
+		const invalid = options.agent.filter((a) => !validAgents.includes(a));
+		if (invalid.length > 0) {
+			M.error(`Invalid agents: ${invalid.join(", ")}`);
 			M.info(`Valid agents: ${validAgents.join(", ")}`);
 			process.exit(1);
 		}
 	}
-	let selectedSkills = [];
-	if (options.all) selectedSkills = installedSkills;
-	else if (skillNames.length > 0) {
-		selectedSkills = installedSkills.filter((s) => skillNames.some((name) => name.toLowerCase() === s.toLowerCase()));
-		if (selectedSkills.length === 0) {
-			M.error(`No matching skills found for: ${skillNames.join(", ")}`);
+	const inventory = await scanStore(cwd);
+	const targets = [];
+	const errors = [];
+	const explicitPluginRefs = skillNames.filter(isPluginRef);
+	const bareNames = skillNames.filter((n) => !isPluginRef(n));
+	for (const ref of explicitPluginRefs) {
+		const plugin = inventory.plugins.find((pl) => pl.ref === ref);
+		if (plugin) targets.push({
+			kind: "plugin",
+			plugin
+		});
+		else errors.push(`No installed plugin matching ref ${ref}`);
+	}
+	if (options.all) {
+		if (bareNames.length > 0) errors.push("--all cannot be combined with positional names");
+		for (const plugin of inventory.plugins) targets.push({
+			kind: "plugin",
+			plugin
+		});
+		for (const skill of inventory.skills) targets.push({
+			kind: "skill",
+			skill
+		});
+	} else if (bareNames.length > 0) for (const name of bareNames) {
+		const lower = name.toLowerCase();
+		const plugin = inventory.plugins.find((pl) => pl.name.toLowerCase() === lower);
+		if (plugin) {
+			targets.push({
+				kind: "plugin",
+				plugin
+			});
+			continue;
+		}
+		const skill = inventory.skills.find((s) => s.name.toLowerCase() === lower);
+		if (skill) {
+			targets.push({
+				kind: "skill",
+				skill
+			});
+			continue;
+		}
+		const owner = findOwningPlugin(name, inventory);
+		if (owner) {
+			errors.push(`${name} belongs to plugin ${owner.ref}\n  Cannot remove individual plugin components.\n  Run: remove ${owner.ref}`);
+			continue;
+		}
+		errors.push(`No forge-managed skill or plugin matching '${name}'.`);
+	}
+	else if (explicitPluginRefs.length === 0) {
+		if (inventory.plugins.length === 0 && inventory.skills.length === 0) {
+			Se(import_picocolors.default.yellow("No skills or plugins installed."));
 			return;
 		}
-	} else {
-		const choices = installedSkills.map((s) => ({
-			value: s,
-			label: s
-		}));
+		const choices = [];
+		for (const plugin of inventory.plugins) {
+			const summary = `${plugin.components.skills.length} skill(s), ${plugin.components.agents.length} agent(s), ${plugin.components.rules.length} rule(s)`;
+			choices.push({
+				value: {
+					kind: "plugin",
+					plugin
+				},
+				label: `[plugin] ${plugin.name}`,
+				hint: summary
+			});
+		}
+		for (const skill of inventory.skills) choices.push({
+			value: {
+				kind: "skill",
+				skill
+			},
+			label: `[skill]  ${skill.name}`
+		});
 		const selected = await fe({
-			message: `Select skills to remove ${import_picocolors.default.dim("(space to toggle)")}`,
+			message: `Select what to remove ${import_picocolors.default.dim("(space to toggle)")}`,
 			options: choices,
 			required: true
 		});
@@ -5363,172 +5704,157 @@ async function removeCommand(skillNames, options) {
 			xe("Removal cancelled");
 			process.exit(0);
 		}
-		selectedSkills = selected;
+		targets.push(...selected);
 	}
-	let targetAgents;
-	if (options.agent && options.agent.length > 0) targetAgents = options.agent;
-	else {
-		targetAgents = Object.keys(agents);
-		spinner.stop(`Targeting ${targetAgents.length} potential agent(s)`);
+	for (const err of errors) M.error(err);
+	if (targets.length === 0) {
+		if (errors.length === 0) Se(import_picocolors.default.yellow("Nothing to remove."));
+		return;
 	}
 	if (!options.yes) {
 		console.log();
-		M.info("Skills to remove:");
-		for (const skill of selectedSkills) M.message(`  ${import_picocolors.default.red("•")} ${skill}`);
+		M.info("Planned removals:");
+		for (const t of targets) {
+			const tag = t.kind === "plugin" ? "[plugin]" : "[skill] ";
+			const name = t.kind === "plugin" ? t.plugin?.name : t.skill?.name;
+			const ref = t.kind === "plugin" ? t.plugin?.ref : t.skill?.ref;
+			const refTail = ref ? `  ${import_picocolors.default.dim(ref)}` : "";
+			M.message(`  ${import_picocolors.default.red("•")} ${tag} ${name}${refTail}`);
+		}
 		console.log();
-		const confirmed = await ye({ message: `Are you sure you want to uninstall ${selectedSkills.length} skill(s)?` });
+		const confirmed = await ye({ message: `Uninstall ${targets.length} item(s)?` });
 		if (pD(confirmed) || !confirmed) {
 			xe("Removal cancelled");
 			process.exit(0);
 		}
 	}
-	spinner.start("Removing skills...");
+	const spinner = Y();
+	spinner.start("Removing...");
 	const results = [];
-	for (const skillName of selectedSkills) try {
-		const canonicalPath = getCanonicalPath(skillName, {
-			global: isGlobal,
-			cwd
+	const agentFilter = options.agent ?? null;
+	for (const t of targets) if (t.kind === "plugin" && t.plugin) try {
+		await uninstallPlugin(t.plugin, cwd, agentFilter);
+		results.push({
+			name: t.plugin.name,
+			kind: "plugin",
+			success: true
 		});
-		for (const agentKey of targetAgents) {
-			const agent = agents[agentKey];
-			const skillPath = getInstallPath(skillName, agentKey, {
-				global: isGlobal,
-				cwd
-			});
-			const pathsToCleanup = new Set([skillPath]);
-			const sanitizedName = sanitizeName(skillName);
-			if (isGlobal && agent.globalSkillsDir) pathsToCleanup.add(join(agent.globalSkillsDir, sanitizedName));
-			else pathsToCleanup.add(join(cwd, agent.skillsDir, sanitizedName));
-			for (const pathToCleanup of pathsToCleanup) {
-				if (pathToCleanup === canonicalPath) continue;
-				try {
-					if (await lstat(pathToCleanup).catch(() => null)) await rm(pathToCleanup, {
-						recursive: true,
-						force: true
-					});
-				} catch (err) {
-					M.warn(`Could not remove skill from ${agent.displayName}: ${err instanceof Error ? err.message : String(err)}`);
-				}
-			}
-		}
-		const remainingAgents = (await detectInstalledAgents()).filter((a) => !targetAgents.includes(a));
-		let isStillUsed = false;
-		for (const agentKey of remainingAgents) if (await lstat(getInstallPath(skillName, agentKey, {
-			global: isGlobal,
-			cwd
-		})).catch(() => null)) {
-			isStillUsed = true;
-			break;
-		}
-		if (!isStillUsed) await rm(canonicalPath, {
-			recursive: true,
-			force: true
+	} catch (err) {
+		results.push({
+			name: t.plugin.name,
+			kind: "plugin",
+			success: false,
+			error: err instanceof Error ? err.message : String(err)
 		});
-		const lockEntry = isGlobal ? await getSkillFromLock(skillName) : null;
-		const effectiveSource = lockEntry?.source || "local";
-		const effectiveSourceType = lockEntry?.sourceType || "local";
-		if (isGlobal) await removeSkillFromLock(skillName);
+	}
+	else if (t.kind === "skill" && t.skill) try {
+		await uninstallStandaloneSkill(t.skill, cwd, agentFilter);
 		results.push({
-			skill: skillName,
-			success: true,
-			source: effectiveSource,
-			sourceType: effectiveSourceType
+			name: t.skill.name,
+			kind: "skill",
+			success: true
 		});
 	} catch (err) {
 		results.push({
-			skill: skillName,
+			name: t.skill.name,
+			kind: "skill",
 			success: false,
 			error: err instanceof Error ? err.message : String(err)
 		});
 	}
-	spinner.stop("Removal process complete");
+	spinner.stop("Done");
 	const successful = results.filter((r) => r.success);
 	const failed = results.filter((r) => !r.success);
-	if (successful.length > 0) {
-		const bySource = /* @__PURE__ */ new Map();
-		for (const r of successful) {
-			const source = r.source || "local";
-			const existing = bySource.get(source) || { skills: [] };
-			existing.skills.push(r.skill);
-			existing.sourceType = r.sourceType;
-			bySource.set(source, existing);
-		}
-		for (const [source, data] of bySource) track({
-			event: "remove",
-			source,
-			skills: data.skills.join(","),
-			agents: targetAgents.join(","),
-			...isGlobal && { global: "1" },
-			sourceType: data.sourceType
-		});
-	}
-	if (successful.length > 0) M.success(import_picocolors.default.green(`Successfully removed ${successful.length} skill(s)`));
+	if (successful.length > 0) M.success(import_picocolors.default.green(`Successfully removed ${successful.length} item(s)`));
 	if (failed.length > 0) {
-		M.error(import_picocolors.default.red(`Failed to remove ${failed.length} skill(s)`));
-		for (const r of failed) M.message(`  ${import_picocolors.default.red("✗")} ${r.skill}: ${r.error}`);
+		M.error(import_picocolors.default.red(`Failed to remove ${failed.length} item(s)`));
+		for (const r of failed) M.message(`  ${import_picocolors.default.red("✗")} ${r.name}: ${r.error}`);
 	}
 	console.log();
 	Se(import_picocolors.default.green("Done!"));
 }
-function parseRemoveOptions(args) {
-	const options = {};
-	const skills = [];
-	for (let i = 0; i < args.length; i++) {
-		const arg = args[i];
-		if (arg === "-g" || arg === "--global") options.global = true;
-		else if (arg === "-y" || arg === "--yes") options.yes = true;
-		else if (arg === "--all") options.all = true;
-		else if (arg === "-a" || arg === "--agent") {
-			options.agent = options.agent || [];
-			i++;
-			let nextArg = args[i];
-			while (i < args.length && nextArg && !nextArg.startsWith("-")) {
-				options.agent.push(nextArg);
-				i++;
-				nextArg = args[i];
-			}
-			i--;
-		} else if (arg && !arg.startsWith("-")) skills.push(arg);
-	}
-	return {
-		skills,
-		options
-	};
-}
-async function uninstallPlugin(ref, scope, cwd) {
-	const { scopeNamespace, pluginName } = parsePluginRef(ref);
-	const storeRoot = getStoreRoot(scope, cwd);
-	const pluginCanonical = join(storeRoot, "plugins", `${scopeNamespace}__${pluginName}`);
-	const ledgerPath = join(pluginCanonical, ".forge-plugin.json");
-	let ledger;
-	try {
-		ledger = JSON.parse(await readFile(ledgerPath, "utf-8"));
-	} catch {
-		throw new Error(`plugin not installed (no ledger at ${ledgerPath})`);
-	}
-	for (const agent of ledger.install_modes) for (const c of ledger.installed_components) {
-		const entryPath = resolveEntryPath(agent, c, pluginCanonical, scope, cwd);
-		if (!entryPath) continue;
-		const status = await assertEntryReplaceable(entryPath, {
-			intendedRef: ref,
-			intendedCanonical: pluginCanonical,
+async function uninstallStandaloneSkill(skill, cwd, agentFilter) {
+	const storeRoot = getStoreRoot();
+	const intendedRef = skill.ref ?? `<store>/${skill.name}`;
+	const candidates = standaloneSkillEntryCandidates(skill.name, cwd, agentFilter);
+	for (const entry of candidates) try {
+		const status = await assertEntryReplaceable(entry, {
+			intendedRef,
+			intendedCanonical: skill.canonical,
 			storeRoot
 		});
-		if (status.kind === "forge-self") try {
-			await rm(entryPath, {
-				recursive: true,
-				force: true
-			});
-		} catch {}
-		else if (status.kind !== "absent") M.warn(`skipping ${entryPath} (${status.kind}) — not deleted (preserved by forge)`);
-	}
-	if (ledger.install_modes.includes("codex")) await cleanupCodexConfig(ledger, scope, cwd, scopeNamespace, pluginName);
-	try {
-		await rm(pluginCanonical, {
+		if (status.kind === "absent") continue;
+		if (status.kind === "forge-self" || status.kind === "forge-other") await rm(entry, {
 			recursive: true,
 			force: true
 		});
+		else M.warn(`skipping ${entry} (${status.kind}) — not deleted (preserved by forge)`);
 	} catch {}
+	await rm(skill.canonical, {
+		recursive: true,
+		force: true
+	});
+	try {
+		await removeSkillFromLock(skill.name);
+	} catch {}
+	try {
+		await removeSkillFromLocalLock(skill.name, cwd);
+	} catch {}
+}
+function standaloneSkillEntryCandidates(skillName, cwd, agentFilter) {
+	const home = homedir();
+	const list = agentFilter ?? Object.keys(agents);
+	const out = [];
+	for (const ag of list) if (ag === "claude-code") {
+		out.push(join(cwd, ".claude", "skills", skillName));
+		out.push(join(home, ".claude", "skills", skillName));
+	} else if (ag === "cursor") {
+		out.push(join(cwd, ".cursor", "skills", skillName));
+		out.push(join(home, ".cursor", "skills", skillName));
+	} else if (ag === "codex") {
+		out.push(join(cwd, ".agents", "skills", skillName));
+		out.push(join(home, ".agents", "skills", skillName));
+	}
+	return out;
+}
+async function uninstallPlugin(plugin, cwd, agentFilter) {
+	const storeRoot = getStoreRoot();
+	const ledgerPath = join(plugin.canonical, ".forge-plugin.json");
+	let ledger;
+	try {
+		ledger = JSON.parse(await readFile(ledgerPath, "utf-8"));
+	} catch {
+		throw new Error(`plugin ledger missing or unreadable: ${ledgerPath}`);
+	}
+	const installModes = agentFilter ? ledger.install_modes.filter((a) => agentFilter.includes(a)) : ledger.install_modes;
+	for (const agent of installModes) for (const c of ledger.installed_components) {
+		const comp = ledgerToComponent(c, plugin.canonical);
+		if (!comp) continue;
+		for (const scope of ["project", "global"]) {
+			const t = getInstallTargets(agent, comp, scope, cwd);
+			if (!t.entry) continue;
+			const intendedRef = `${plugin.ref}/${componentSubRef(comp)}`;
+			const status = await assertEntryReplaceable(t.entry, {
+				intendedRef,
+				intendedCanonical: t.canonical,
+				storeRoot
+			});
+			if (status.kind === "absent") continue;
+			if (status.kind === "forge-self") try {
+				await rm(t.entry, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+			else M.warn(`skipping ${t.entry} (${status.kind}) — not deleted (preserved by forge)`);
+		}
+	}
+	if (installModes.includes("codex")) for (const scope of ["project", "global"]) await cleanupCodexConfigToml(ledger, scope, cwd);
+	await rm(plugin.canonical, {
+		recursive: true,
+		force: true
+	});
+	const { pluginName } = parsePluginRef(plugin.ref);
 	try {
 		await removePluginFromLock(pluginName);
 	} catch {}
@@ -5536,75 +5862,63 @@ async function uninstallPlugin(ref, scope, cwd) {
 		await removePluginFromLocalLock(pluginName, cwd);
 	} catch {}
 }
-function resolveEntryPath(agent, c, pluginCanonical, scope, cwd) {
-	let component;
+function componentSubRef(c) {
+	switch (c.kind) {
+		case "plugin-skill": return `skills/${c.skillName}`;
+		case "plugin-agent-manifest": return `agents/${c.filename}`;
+		case "plugin-agent-deps-dir": return `agents/${c.dirname}`;
+		case "plugin-rule-manifest": return `rules/${c.filename}`;
+		case "plugin-rule-deps-dir": return `rules/${c.dirname}`;
+	}
+}
+function ledgerToComponent(c, pluginCanonical) {
 	switch (c.type) {
-		case "skill":
-			component = {
-				kind: "plugin-skill",
-				pluginCanonical,
-				skillName: c.name
-			};
-			break;
-		case "agent-manifest":
-			component = {
-				kind: "plugin-agent-manifest",
-				pluginCanonical,
-				filename: c.name
-			};
-			break;
-		case "agent-deps-dir":
-			component = {
-				kind: "plugin-agent-deps-dir",
-				pluginCanonical,
-				dirname: c.name
-			};
-			break;
-		case "rule-manifest":
-			component = {
-				kind: "plugin-rule-manifest",
-				pluginCanonical,
-				filename: c.name
-			};
-			break;
-		case "rule-deps-dir":
-			component = {
-				kind: "plugin-rule-deps-dir",
-				pluginCanonical,
-				dirname: c.name
-			};
-			break;
-		default: return "";
+		case "skill": return {
+			kind: "plugin-skill",
+			pluginCanonical,
+			skillName: c.name
+		};
+		case "agent-manifest": return {
+			kind: "plugin-agent-manifest",
+			pluginCanonical,
+			filename: c.name
+		};
+		case "agent-deps-dir": return {
+			kind: "plugin-agent-deps-dir",
+			pluginCanonical,
+			dirname: c.name
+		};
+		case "rule-manifest": return {
+			kind: "plugin-rule-manifest",
+			pluginCanonical,
+			filename: c.name
+		};
+		case "rule-deps-dir": return {
+			kind: "plugin-rule-deps-dir",
+			pluginCanonical,
+			dirname: c.name
+		};
+		default: return null;
 	}
-	return getInstallTargets(agent, component, scope, cwd).entry;
 }
-async function cleanupCodexConfig(ledger, scope, cwd, scopeNs, pluginName) {
-	const configToml = join(scope === "global" ? getAgentHome("codex") : join(cwd ?? process.cwd(), ".codex"), "config.toml");
+async function cleanupCodexConfigToml(ledger, scope, cwd) {
+	const configToml = join(scope === "global" ? getAgentHome("codex") : join(cwd, ".codex"), "config.toml");
 	let tomlRaw = "";
 	try {
 		tomlRaw = await readFile(configToml, "utf-8");
-	} catch {}
-	if (tomlRaw) {
-		let changed = false;
-		for (const c of ledger.installed_components) if (c.type === "agent-manifest") {
-			const id = c.name.replace(/\.md$/, "");
-			const updated = removeCodexAgent(tomlRaw, id);
-			if (updated !== tomlRaw) {
-				tomlRaw = updated;
-				changed = true;
-			}
-		}
-		if (changed) await writeFile(configToml, tomlRaw, "utf-8");
-	}
-	const canonicalAgentsMd = join(getStoreRoot(scope, cwd), "codex-agents.md");
-	let agentsRaw = "";
-	try {
-		agentsRaw = await readFile(canonicalAgentsMd, "utf-8");
 	} catch {
 		return;
 	}
-	const updatedAgentsMd = removePluginRules(agentsRaw, `${scopeNs}:${pluginName}`);
-	if (updatedAgentsMd !== agentsRaw) await writeFile(canonicalAgentsMd, updatedAgentsMd, "utf-8");
+	let changed = false;
+	for (const c of ledger.installed_components) if (c.type === "agent-manifest") {
+		const id = c.name.replace(/\.md$/, "");
+		const updated = removeCodexAgent(tomlRaw, id);
+		if (updated !== tomlRaw) {
+			tomlRaw = updated;
+			changed = true;
+		}
+	}
+	if (changed) await writeFile(configToml, tomlRaw, "utf-8");
 }
 function parsePluginRef(ref) {
 	let m = /^@public\/plugins\/(.+)$/.exec(ref);
@@ -5619,202 +5933,6 @@ function parsePluginRef(ref) {
 	};
 	throw new Error(`invalid plugin ref: ${ref}`);
 }
-function formatSourceInput(sourceUrl, ref) {
-	if (!ref) return sourceUrl;
-	return `${sourceUrl}#${ref}`;
-}
-function deriveSkillFolder(skillPath) {
-	let folder = skillPath;
-	if (folder.endsWith("/SKILL.md")) folder = folder.slice(0, -9);
-	else if (folder.endsWith("SKILL.md")) folder = folder.slice(0, -8);
-	if (folder.endsWith("/")) folder = folder.slice(0, -1);
-	return folder;
-}
-function appendFolderAndRef(source, skillPath, ref) {
-	const folder = deriveSkillFolder(skillPath);
-	const withFolder = folder ? `${source}/${folder}` : source;
-	return ref ? `${withFolder}#${ref}` : withFolder;
-}
-function buildUpdateInstallSource(entry) {
-	if (!entry.skillPath) return formatSourceInput(entry.sourceUrl, entry.ref);
-	return appendFolderAndRef(entry.source, entry.skillPath, entry.ref);
-}
-function buildLocalUpdateSource(entry) {
-	if (!entry.skillPath) return formatSourceInput(entry.source, entry.ref);
-	return appendFolderAndRef(entry.source, entry.skillPath, entry.ref);
-}
-function getRandomPort() {
-	return new Promise((resolve, reject) => {
-		const server = createServer();
-		server.listen(0, "127.0.0.1", () => {
-			const address = server.address();
-			if (address && typeof address !== "string" && "port" in address) {
-				const port = address.port;
-				server.close(() => resolve(port));
-			} else server.close(() => reject(/* @__PURE__ */ new Error("Failed to get port")));
-		});
-		server.on("error", reject);
-	});
-}
-function getSuccessHtml() {
-	return `
-<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Login Successful</title>
-  <style>
-    body { font-family: system-ui, -apple-system, sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; background: #10b981; color: white; }
-    .container { text-align: center; padding: 2rem; }
-    h1 { font-size: 1.5rem; margin-bottom: 0.5rem; }
-    p { opacity: 0.9; }
-    .spinner { width: 24px; height: 24px; border: 2px solid rgba(255,255,255,0.3); border-top-color: white; border-radius: 50%; animation: spin 1s linear infinite; margin: 1rem auto; }
-    @keyframes spin { to { transform: rotate(360deg); } }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <h1>Login Successful!</h1>
-    <p>You can close this window and return to the CLI.</p>
-    <div class="spinner"></div>
-  </div>
-</body>
-</html>
-  `.trim();
-}
-function getErrorHtml(error) {
-	return `
-<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Login Failed</title>
-  <style>
-    body { font-family: system-ui, -apple-system, sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; background: #ef4444; color: white; }
-    .container { text-align: center; padding: 2rem; }
-    h1 { font-size: 1.5rem; margin-bottom: 0.5rem; }
-    p { opacity: 0.9; }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <h1>Login Failed</h1>
-    <p>${import_picocolors.default.red(error)}</p>
-    <p>Please try again.</p>
-  </div>
-</body>
-</html>
-  `.trim();
-}
-let callbackResolve = null;
-async function runLogin(options = {}) {
-	const cfg = loadConfig();
-	if (options.logout) {
-		if (cfg.token) {
-			saveConfig({
-				token: void 0,
-				token_name: void 0
-			});
-			M.success("Logged out successfully.");
-			M.message(import_picocolors.default.dim("Your token has been removed from the config."));
-		} else M.message("You are not logged in.");
-		return;
-	}
-	if (cfg.token) {
-		M.message("You are already logged in.");
-		M.info(import_picocolors.default.dim(`Token: ${cfg.token_name || "default"}`));
-		const shouldReauth = await ye({
-			message: "Re-authenticate?",
-			initialValue: false
-		});
-		if (isCancelled(shouldReauth)) {
-			Se(import_picocolors.default.dim("Cancelled"));
-			return;
-		}
-		if (!shouldReauth) return;
-	}
-	console.log();
-	Ie(import_picocolors.default.bgCyan(import_picocolors.default.black(" login ")));
-	const portalUrl = cfg.portal;
-	const port = await getRandomPort();
-	const redirectUrl = `http://127.0.0.1:${port}/callback`;
-	const authUrl = `${portalUrl}/cli-auth?redirect=${encodeURIComponent(redirectUrl)}`;
-	M.message(`Opening browser for authentication...`);
-	M.info(import_picocolors.default.dim(authUrl));
-	await new Promise((resolve, reject) => {
-		exec(`open "${authUrl}"`, (err) => {
-			if (err) reject(err);
-			else resolve();
-		});
-	});
-	const result = await new Promise((resolve) => {
-		callbackResolve = resolve;
-		const server = createServer((req, res) => {
-			const url = new URL$1(req.url || "", `http://127.0.0.1:${port}`);
-			if (url.pathname === "/callback") {
-				const token = url.searchParams.get("token");
-				const tokenName = url.searchParams.get("token_name");
-				const error = url.searchParams.get("error");
-				if (error) {
-					res.writeHead(400, { "Content-Type": "text/html" });
-					res.end(getErrorHtml(error));
-					resolve({
-						success: false,
-						error
-					});
-				} else if (token) {
-					res.writeHead(200, { "Content-Type": "text/html" });
-					res.end(getSuccessHtml());
-					resolve({
-						success: true,
-						token,
-						tokenName: tokenName || "default"
-					});
-				} else {
-					res.writeHead(400, { "Content-Type": "text/html" });
-					res.end(getErrorHtml("No token received"));
-					resolve({
-						success: false,
-						error: "No token received"
-					});
-				}
-			} else {
-				res.writeHead(404);
-				res.end("Not found");
-			}
-		});
-		server.listen(port, "127.0.0.1", () => {});
-		setTimeout(() => {
-			server.close();
-			if (callbackResolve) callbackResolve({
-				success: false,
-				error: "Login timed out"
-			});
-		}, 12e4);
-	});
-	if (!result.success) {
-		Se(import_picocolors.default.red("Login failed: " + result.error));
-		process.exit(1);
-	}
-	saveConfig({
-		token: result.token,
-		token_name: result.tokenName
-	});
-	M.success("Login successful!");
-	M.message(import_picocolors.default.dim(`Token saved as: ${result.tokenName}`));
-	Se(import_picocolors.default.green("You can now publish skills."));
-}
-function isCancelled(value) {
-	return typeof value === "symbol";
-}
-function parseLoginOptions(args) {
-	const options = {};
-	for (let i = 0; i < args.length; i++) {
-		const arg = args[i];
-		if (arg === "--logout" || arg === "-l") options.logout = true;
-	}
-	return options;
-}
 var import_lib = /* @__PURE__ */ __toESM(require_lib(), 1);
 async function getBootstrap(opts = {}) {
 	const cfg = loadConfig();
@@ -5979,11 +6097,14 @@ function validatePath(path) {
 	return { valid: true };
 }
 async function runPublish(paths, options = {}) {
-	const cfg = loadConfig();
+	let cfg = loadConfig();
 	if (!cfg.token) {
-		M.error("You must be logged in to publish.");
-		M.message(import_picocolors.default.dim("Run: npx shoplazza-ai-dev-cli login"));
-		process.exit(1);
+		await runLogin({ force: true });
+		cfg = loadConfig();
+		if (!cfg.token) {
+			M.error("Login required to publish.");
+			process.exit(1);
+		}
 	}
 	console.log();
 	Ie(import_picocolors.default.bgCyan(import_picocolors.default.black(" publish ")));
@@ -6032,14 +6153,25 @@ async function runPublish(paths, options = {}) {
 			form.set("asset_type", assetType);
 			form.set("file", blob, filename);
 			try {
-				const resp = await fetch(contributionsUrl, {
+				const sendRequest = (token) => fetch(contributionsUrl, {
 					method: "POST",
 					headers: {
-						Authorization: `Bearer ${cfg.token}`,
+						Authorization: `Bearer ${token}`,
 						"User-Agent": "shoplazza-ai-dev-cli"
 					},
 					body: form
 				});
+				let resp = await sendRequest(cfg.token);
+				if (resp.status === 401) {
+					await resp.arrayBuffer().catch(() => void 0);
+					await runLogin({ force: true });
+					cfg = loadConfig();
+					if (!cfg.token) {
+						M.error(`Failed to publish ${name}: login required`);
+						continue;
+					}
+					resp = await sendRequest(cfg.token);
+				}
 				if (!resp.ok) {
 					const errorText = await resp.text();
 					M.error(`Failed to publish ${name}: ${resp.status} ${errorText}`);
@@ -6049,12 +6181,6 @@ async function runPublish(paths, options = {}) {
 				M.success(`Published: ${import_picocolors.default.green(name)}`);
 				if (result?.asset_ref) M.message(import_picocolors.default.dim(`Asset:  ${result.asset_ref}`));
 				if (result?.mr_iid) M.message(import_picocolors.default.dim(`MR !${result.mr_iid}`));
-				track({
-					event_type: "publish",
-					asset_ref: result?.asset_ref ?? name,
-					visibility,
-					team_id: scope.startsWith("team:") ? scope.slice(5) : void 0
-				});
 			} catch (err) {
 				const message = err instanceof Error ? err.message : String(err);
 				M.error(`Failed to publish ${name}: ${message}`);
@@ -6136,12 +6262,12 @@ function showBanner() {
 	console.log();
 	console.log(`${DIM}Shoplazza Forge skill CLI${RESET}`);
 	console.log();
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx shoplazza-ai-dev-cli add ${DIM}<source>${RESET}     ${DIM}Add a skill${RESET}`);
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx shoplazza-ai-dev-cli remove${RESET}             ${DIM}Remove installed skills${RESET}`);
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx shoplazza-ai-dev-cli list${RESET}               ${DIM}List installed skills${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx shoplazza-ai-dev-cli add ${DIM}<source>${RESET}     ${DIM}Add a skill or plugin${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx shoplazza-ai-dev-cli remove${RESET}             ${DIM}Remove installed skills or plugins${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx shoplazza-ai-dev-cli list${RESET}               ${DIM}List installed skills and plugins${RESET}`);
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx shoplazza-ai-dev-cli find ${DIM}[query]${RESET}       ${DIM}Search for skills${RESET}`);
 	console.log();
-	console.log(`  ${DIM}$${RESET} ${TEXT}npx shoplazza-ai-dev-cli update${RESET}             ${DIM}Update installed skills${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx shoplazza-ai-dev-cli update${RESET}             ${DIM}Refresh installed skills and plugins${RESET}`);
 	console.log();
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx shoplazza-ai-dev-cli init ${DIM}[name]${RESET}        ${DIM}Initialize a skill${RESET}`);
 	console.log();
@@ -6153,29 +6279,24 @@ function showHelp() {
 ${BOLD}Usage:${RESET} shoplazza-ai-dev-cli <command> [options]
 
 ${BOLD}Manage Skills:${RESET}
-  add <source>         Add a skill (alias: a)
+  add <source>         Add a skill or plugin (alias: a)
                        e.g. @public/skills --skill <name>
                             @teams/<scope>/skills --skill <name>
-                            @public/skills/<name>           # legacy, still supported
+                            @public/plugins/<name>
                             https://gitlab.shoplazza.site/.../<repo>.git
   add --team <scope>   Install every skill owned by a team
-  remove [skills]      Remove installed skills
-  list, ls             List installed skills
+  remove [names...]    Remove installed skills or plugins
+  list, ls             List installed skills and plugins
   find [query]         Search for skills interactively
 
 ${BOLD}Updates:${RESET}
-  update [skills...]   Update skills to latest versions (alias: upgrade)
-
-${BOLD}Update Options:${RESET}
-  -g, --global           Update global skills only
-  -p, --project          Update project skills only
-  -y, --yes              Skip scope prompt (auto-detect: project if in a project, else global)
+  update [names...]    Refresh installed skills/plugins from source (alias: upgrade)
 
 ${BOLD}Project:${RESET}
   init [name]            Initialize a skill (creates <name>/SKILL.md or ./SKILL.md)
 
 ${BOLD}Add Options:${RESET}
-  -g, --global           Install skill globally (user-level) instead of project-level
+  -g, --global           Install at global scope (entry symlinks under ~/)
   -a, --agent <agents>   Specify agents to install to (use '*' for all agents)
   -s, --skill <skills>   Specify skill names to install (use '*' for all skills)
   -l, --list             List available skills in the source without installing
@@ -6187,62 +6308,62 @@ ${BOLD}Add Options:${RESET}
   --full-depth           Search all subdirectories even when a root SKILL.md exists
 
 ${BOLD}Remove Options:${RESET}
-  -g, --global           Remove from global scope
-  -a, --agent <agents>   Remove from specific agents (use '*' for all agents)
-  -s, --skill <skills>   Specify skills to remove (use '*' for all skills)
+  -a, --agent <agents>   Restrict cleanup to specific agents
   -y, --yes              Skip confirmation prompts
-  --all                  Shorthand for --skill '*' --agent '*' -y
+  --all                  Remove every installed skill and plugin
 
 ${BOLD}List Options:${RESET}
-  -g, --global           List global skills (default: project)
-  -a, --agent <agents>   Filter by specific agents
+  -a, --agent <agents>   Filter the "Linked from" column by agent
   --json                 Output as JSON (machine-readable, no ANSI codes)
 
+${BOLD}Update Options:${RESET}
+  -y, --yes              Skip confirmation prompts
+  --json                 Machine-readable summary
+
 ${BOLD}Options:${RESET}
   --help, -h        Show this help message
   --version, -v     Show version number
 
 ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} shoplazza-ai-dev-cli add @public/skills --skill systematic-debugging
-  ${DIM}$${RESET} shoplazza-ai-dev-cli add @public/skills --skill systematic-debugging -g
-  ${DIM}$${RESET} shoplazza-ai-dev-cli add @public/skills --skill <name> --agent claude-code cursor
+  ${DIM}$${RESET} shoplazza-ai-dev-cli add @public/plugins/forge-demo-plugin
   ${DIM}$${RESET} shoplazza-ai-dev-cli add @teams/infra/skills --skill <name>
   ${DIM}$${RESET} shoplazza-ai-dev-cli remove                        ${DIM}# interactive${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli remove my-skill               ${DIM}# remove by name${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli list                          ${DIM}# list project skills${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli ls -g                         ${DIM}# list global skills${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli find                          ${DIM}# interactive search${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli find typescript               ${DIM}# search by keyword${RESET}
+  ${DIM}$${RESET} shoplazza-ai-dev-cli remove my-skill               ${DIM}# bare-name → resolved against store${RESET}
+  ${DIM}$${RESET} shoplazza-ai-dev-cli remove @public/plugins/foo    ${DIM}# explicit plugin ref${RESET}
+  ${DIM}$${RESET} shoplazza-ai-dev-cli list                          ${DIM}# list everything in store${RESET}
+  ${DIM}$${RESET} shoplazza-ai-dev-cli list --json
   ${DIM}$${RESET} shoplazza-ai-dev-cli update
+  ${DIM}$${RESET} shoplazza-ai-dev-cli update some-skill
   ${DIM}$${RESET} shoplazza-ai-dev-cli init my-skill
 `);
 }
 function showRemoveHelp() {
 	console.log(`
-${BOLD}Usage:${RESET} shoplazza-ai-dev-cli remove [skills...] [options]
+${BOLD}Usage:${RESET} shoplazza-ai-dev-cli remove [names...] [options]
 
 ${BOLD}Description:${RESET}
-  Remove installed skills from agents. If no skill names are provided,
-  an interactive selection menu will be shown.
+  Resolves each name against the forge store (~/.ai-dev-cli/store):
+  - explicit plugin ref or bare plugin name → cascades full plugin uninstall
+  - bare standalone-skill name              → uninstalls just that skill
+  - bare component name owned by a plugin   → refused (uninstall the plugin instead)
 
 ${BOLD}Arguments:${RESET}
-  skills            Optional skill names to remove (space-separated)
+  names             Optional skill / plugin names (space-separated). Empty triggers an
+                    interactive multiselect over everything currently in the store.
 
 ${BOLD}Options:${RESET}
-  -g, --global       Remove from global scope (~/) instead of project scope
-  -a, --agent        Remove from specific agents (use '*' for all agents)
-  -s, --skill        Specify skills to remove (use '*' for all skills)
-  -y, --yes          Skip confirmation prompts
-  --all              Shorthand for --skill '*' --agent '*' -y
+  -a, --agent       Restrict entry cleanup to specific IDE agents
+  -y, --yes         Skip confirmation prompts
+  --all             Remove every installed skill and plugin
 
 ${BOLD}Examples:${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli remove                           ${DIM}# interactive selection${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli remove my-skill                   ${DIM}# remove specific skill${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli remove skill1 skill2 -y           ${DIM}# remove multiple skills${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli remove --global my-skill          ${DIM}# remove from global scope${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli rm --agent claude-code my-skill   ${DIM}# remove from specific agent${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli remove --all                      ${DIM}# remove all skills${RESET}
-  ${DIM}$${RESET} shoplazza-ai-dev-cli remove --skill '*' -a cursor      ${DIM}# remove all skills from cursor${RESET}
+  ${DIM}$${RESET} shoplazza-ai-dev-cli remove                           ${DIM}# interactive${RESET}
+  ${DIM}$${RESET} shoplazza-ai-dev-cli remove my-skill                  ${DIM}# resolve and remove${RESET}
+  ${DIM}$${RESET} shoplazza-ai-dev-cli remove skill1 skill2 -y          ${DIM}# remove several${RESET}
+  ${DIM}$${RESET} shoplazza-ai-dev-cli remove @public/plugins/foo       ${DIM}# explicit plugin ref${RESET}
+  ${DIM}$${RESET} shoplazza-ai-dev-cli rm --agent claude-code my-skill  ${DIM}# clean only Claude Code entry${RESET}
+  ${DIM}$${RESET} shoplazza-ai-dev-cli remove --all                     ${DIM}# remove everything${RESET}
 `);
 }
 function runInit(args) {
@@ -6289,383 +6410,155 @@ Describe when this skill should be used.
 	console.log(`  ${DIM}Forge:${RESET}  ${TEXT}shoplazza-ai-dev-cli publish ${displayPath.replace("/SKILL.md", "")}${RESET}`);
 	console.log();
 }
-const AGENTS_DIR = ".agents";
-const LOCK_FILE = ".skill-lock.json";
-const CURRENT_LOCK_VERSION = 3;
-function getSkillLockPath() {
-	const xdgStateHome = process.env.XDG_STATE_HOME;
-	if (xdgStateHome) return join(xdgStateHome, "skills", LOCK_FILE);
-	return join(homedir(), AGENTS_DIR, LOCK_FILE);
-}
-function readSkillLock() {
-	const lockPath = getSkillLockPath();
-	try {
-		const content = readFileSync(lockPath, "utf-8");
-		const parsed = JSON.parse(content);
-		if (typeof parsed.version !== "number" || !parsed.skills) return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
-		};
-		if (parsed.version < CURRENT_LOCK_VERSION) return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
-		};
-		return parsed;
-	} catch {
-		return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
-		};
-	}
-}
 function parseUpdateOptions(args) {
 	const options = {};
-	const positional = [];
-	for (const arg of args) if (arg === "-g" || arg === "--global") options.global = true;
-	else if (arg === "-p" || arg === "--project") options.project = true;
-	else if (arg === "-y" || arg === "--yes") options.yes = true;
-	else if (!arg.startsWith("-")) positional.push(arg);
-	if (positional.length > 0) options.skills = positional;
+	const names = [];
+	for (const arg of args) if (arg === "-y" || arg === "--yes") options.yes = true;
+	else if (arg === "--json") options.json = true;
+	else if (!arg.startsWith("-")) names.push(arg);
+	if (names.length > 0) options.names = names;
 	return options;
 }
-function hasProjectSkills(cwd) {
-	const dir = cwd || process.cwd();
-	if (existsSync(join(dir, "skills-lock.json"))) return true;
-	const skillsDir = join(dir, ".agents", "skills");
-	try {
-		const entries = readdirSync(skillsDir, { withFileTypes: true });
-		for (const entry of entries) if (entry.isDirectory()) {
-			if (existsSync(join(skillsDir, entry.name, "SKILL.md"))) return true;
+function hasProjectEntryFor(canonical, cwd) {
+	const candidates = [
+		join(cwd, ".claude", "skills"),
+		join(cwd, ".cursor", "skills"),
+		join(cwd, ".agents", "skills"),
+		join(cwd, ".claude", "agents"),
+		join(cwd, ".cursor", "agents"),
+		join(cwd, ".codex", "agents"),
+		join(cwd, ".claude", "rules"),
+		join(cwd, ".cursor", "rules")
+	];
+	for (const dir of candidates) {
+		if (!existsSync(dir)) continue;
+		let entries;
+		try {
+			entries = readdirSyncSafe(dir);
+		} catch {
+			continue;
 		}
-	} catch {}
-	return false;
-}
-async function resolveUpdateScope(options) {
-	if (options.skills && options.skills.length > 0) {
-		if (options.global) return "global";
-		if (options.project) return "project";
-		return "both";
-	}
-	if (options.global && options.project) return "both";
-	if (options.global) return "global";
-	if (options.project) return "project";
-	if (options.yes || !process.stdin.isTTY) return hasProjectSkills() ? "project" : "global";
-	const scope = await ve({
-		message: "Update scope",
-		options: [
-			{
-				value: "project",
-				label: "Project",
-				hint: "Update skills in current directory"
-			},
-			{
-				value: "global",
-				label: "Global",
-				hint: "Update skills in home directory"
-			},
-			{
-				value: "both",
-				label: "Both",
-				hint: "Update all skills"
-			}
-		]
-	});
-	if (pD(scope)) {
-		xe("Cancelled");
-		process.exit(0);
-	}
-	return scope;
-}
-function matchesSkillFilter(name, filter) {
-	if (!filter || filter.length === 0) return true;
-	const lower = name.toLowerCase();
-	return filter.some((f) => f.toLowerCase() === lower);
-}
-function getSkipReason(entry) {
-	if (entry.sourceType === "local") return "Local path";
-	if (entry.sourceType === "git") return "Git URL";
-	if (entry.sourceType === "well-known") return "Well-known skill";
-	if (!entry.skillFolderHash) return "Private or deleted repo";
-	if (!entry.skillPath) return "No skill path recorded";
-	return "No version tracking";
-}
-function getInstallSource(skill) {
-	let url = skill.sourceUrl;
-	if (skill.sourceType === "well-known") {
-		const idx = url.indexOf("/.well-known/");
-		if (idx !== -1) url = url.slice(0, idx);
-	}
-	return formatSourceInput(url, skill.ref);
-}
-function printSkippedSkills(skipped) {
-	if (skipped.length === 0) return;
-	console.log();
-	console.log(`${DIM}${skipped.length} skill(s) cannot be checked automatically:${RESET}`);
-	const grouped = /* @__PURE__ */ new Map();
-	for (const skill of skipped) {
-		const source = getInstallSource(skill);
-		const existing = grouped.get(source) || [];
-		existing.push(skill);
-		grouped.set(source, existing);
-	}
-	for (const [source, skills] of grouped) {
-		if (skills.length === 1) {
-			const skill = skills[0];
-			console.log(`  ${TEXT}•${RESET} ${sanitizeMetadata(skill.name)} ${DIM}(${skill.reason})${RESET}`);
-		} else {
-			const reason = skills[0].reason;
-			const names = skills.map((s) => sanitizeMetadata(s.name)).join(", ");
-			console.log(`  ${TEXT}•${RESET} ${names} ${DIM}(${reason})${RESET}`);
+		for (const name of entries) {
+			const entryPath = join(dir, name);
+			try {
+				const real = realpathSync(entryPath);
+				if (real === canonical || real.startsWith(canonical + sep)) return true;
+			} catch {}
 		}
-		console.log(`    ${DIM}To update: ${TEXT}npx skills add ${source} -g -y${RESET}`);
 	}
+	return false;
 }
-async function getProjectSkillsForUpdate(skillFilter) {
-	const localLock = await readLocalLock();
-	const skills = [];
-	for (const [name, entry] of Object.entries(localLock.skills)) {
-		if (!matchesSkillFilter(name, skillFilter)) continue;
-		if (entry.sourceType === "node_modules" || entry.sourceType === "local") continue;
-		skills.push({
-			name,
-			source: entry.source,
-			entry
-		});
+function readdirSyncSafe(dir) {
+	try {
+		return readdirSync(dir);
+	} catch {
+		return [];
 	}
-	return skills;
 }
-async function updateGlobalSkills(skillFilter) {
-	const lock = readSkillLock();
-	const skillNames = Object.keys(lock.skills);
-	let successCount = 0;
-	let failCount = 0;
-	if (skillNames.length === 0) {
-		if (!skillFilter) {
-			console.log(`${DIM}No global skills tracked in lock file.${RESET}`);
-			console.log(`${DIM}Install skills with${RESET} ${TEXT}npx skills add <package> -g${RESET}`);
-		}
-		return {
-			successCount,
-			failCount,
-			checkedCount: 0
-		};
+async function runUpdate(args = []) {
+	const options = parseUpdateOptions(args);
+	const cwd = process.cwd();
+	const inventory = await scanStore(cwd);
+	let targets = [...inventory.plugins.map((pl) => ({
+		kind: "plugin",
+		name: pl.name,
+		ref: pl.ref,
+		canonical: pl.canonical,
+		hasProjectEntry: hasProjectEntryFor(pl.canonical, cwd)
+	})), ...inventory.skills.filter((s) => Boolean(s.ref)).map((s) => ({
+		kind: "skill",
+		name: s.name,
+		ref: s.ref,
+		canonical: s.canonical,
+		hasProjectEntry: hasProjectEntryFor(s.canonical, cwd)
+	}))];
+	if (options.names && options.names.length > 0) {
+		const wanted = new Set(options.names.map((n) => n.toLowerCase()));
+		targets = targets.filter((t) => wanted.has(t.name.toLowerCase()));
 	}
-	const token = getGitHubToken();
-	const updates = [];
-	const skipped = [];
-	const checkable = [];
-	for (const skillName of skillNames) {
-		if (!matchesSkillFilter(skillName, skillFilter)) continue;
-		const entry = lock.skills[skillName];
-		if (!entry) continue;
-		if (!entry.skillFolderHash || !entry.skillPath) {
-			skipped.push({
-				name: skillName,
-				reason: getSkipReason(entry),
-				sourceUrl: entry.sourceUrl,
-				sourceType: entry.sourceType,
-				ref: entry.ref
-			});
-			continue;
+	if (options.json) {
+		const out = { targets: targets.map((t) => ({
+			kind: t.kind,
+			name: t.name,
+			ref: t.ref
+		})) };
+		if (targets.length === 0) {
+			console.log(JSON.stringify(out, null, 2));
+			return;
 		}
-		checkable.push({
-			name: skillName,
-			entry
-		});
 	}
-	for (let i = 0; i < checkable.length; i++) {
-		const { name: skillName, entry } = checkable[i];
-		process.stdout.write(`\r${DIM}Checking global skill ${i + 1}/${checkable.length}: ${sanitizeMetadata(skillName)}${RESET}\x1b[K`);
-		try {
-			const latestHash = await fetchSkillFolderHash(entry.source, entry.skillPath, token, entry.ref);
-			if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
-				name: skillName,
-				source: entry.source,
-				entry
-			});
-		} catch {}
-	}
-	if (checkable.length > 0) process.stdout.write("\r\x1B[K");
-	const checkedCount = checkable.length + skipped.length;
-	if (checkable.length === 0 && skipped.length === 0) {
-		if (!skillFilter) console.log(`${DIM}No global skills to check.${RESET}`);
-		return {
-			successCount,
-			failCount,
-			checkedCount: 0
-		};
+	if (targets.length === 0) {
+		if (options.names && options.names.length > 0) console.log(`${DIM}No installed skills/plugins matching: ${options.names.join(", ")}${RESET}`);
+		else {
+			console.log(`${DIM}Nothing to update — store is empty.${RESET}`);
+			console.log(`${DIM}Install something with${RESET} ${TEXT}npx skills add <ref>${RESET}`);
+		}
+		return;
 	}
-	if (checkable.length === 0 && skipped.length > 0) {
-		printSkippedSkills(skipped);
-		return {
-			successCount,
-			failCount,
-			checkedCount
-		};
+	if (!options.yes && !options.json) {
+		console.log(`${TEXT}Updating ${targets.length} entr${targets.length === 1 ? "y" : "ies"}...${RESET}`);
+		console.log();
 	}
-	if (updates.length === 0) {
-		console.log(`${TEXT}✓ All global skills are up to date${RESET}`);
-		return {
-			successCount,
-			failCount,
-			checkedCount
-		};
+	const cliEntry = join(__dirname, "..", "bin", "cli.mjs");
+	if (!existsSync(cliEntry)) {
+		console.error(`${BOLD}✗${RESET} CLI entrypoint not found at ${cliEntry}`);
+		process.exitCode = 1;
+		return;
 	}
-	console.log(`${TEXT}Found ${updates.length} global update(s)${RESET}`);
-	console.log();
-	for (const update of updates) {
-		const safeName = sanitizeMetadata(update.name);
-		console.log(`${TEXT}Updating ${safeName}...${RESET}`);
-		const installUrl = buildUpdateInstallSource(update.entry);
-		const cliEntry = join(__dirname, "..", "bin", "cli.mjs");
-		if (!existsSync(cliEntry)) {
-			failCount++;
-			console.log(`  ${DIM}✗ Failed to update ${safeName}: CLI entrypoint not found at ${cliEntry}${RESET}`);
-			continue;
-		}
-		if (spawnSync(process.execPath, [
-			cliEntry,
+	let success = 0;
+	let fail = 0;
+	const results = [];
+	for (const t of targets) {
+		const safeName = sanitizeMetadata(t.name);
+		if (!options.json) console.log(`${TEXT}Updating ${safeName}...${RESET} ${DIM}(${t.ref})${RESET}`);
+		const passthrough = [
 			"add",
-			installUrl,
-			"-g",
+			t.ref,
 			"-y"
-		], {
-			stdio: [
-				"inherit",
+		];
+		if (!t.hasProjectEntry) passthrough.push("-g");
+		const ok = spawnSync(process.execPath, [cliEntry, ...passthrough], {
+			stdio: options.json ? [
+				"ignore",
 				"pipe",
 				"pipe"
-			],
-			encoding: "utf-8",
-			shell: process.platform === "win32"
-		}).status === 0) {
-			successCount++;
-			console.log(`  ${TEXT}✓${RESET} Updated ${safeName}`);
-		} else {
-			failCount++;
-			console.log(`  ${DIM}✗ Failed to update ${safeName}${RESET}`);
-		}
-	}
-	printSkippedSkills(skipped);
-	return {
-		successCount,
-		failCount,
-		checkedCount
-	};
-}
-async function updateProjectSkills(skillFilter) {
-	const projectSkills = await getProjectSkillsForUpdate(skillFilter);
-	let successCount = 0;
-	let failCount = 0;
-	if (projectSkills.length === 0) {
-		if (!skillFilter) {
-			console.log(`${DIM}No project skills to update.${RESET}`);
-			console.log(`${DIM}Install project skills with${RESET} ${TEXT}npx skills add <package>${RESET}`);
-		}
-		return {
-			successCount,
-			failCount,
-			foundCount: 0
-		};
-	}
-	const updatable = projectSkills.filter((s) => s.entry.skillPath);
-	const legacy = projectSkills.filter((s) => !s.entry.skillPath);
-	if (updatable.length === 0) {
-		console.log(`${DIM}No project skills can be updated in place.${RESET}`);
-		printLegacyProjectSkills(legacy);
-		return {
-			successCount,
-			failCount,
-			foundCount: projectSkills.length
-		};
-	}
-	console.log(`${TEXT}Refreshing ${updatable.length} project skill(s)...${RESET}`);
-	console.log();
-	for (const skill of updatable) {
-		const safeName = sanitizeMetadata(skill.name);
-		console.log(`${TEXT}Updating ${safeName}...${RESET}`);
-		const installUrl = buildLocalUpdateSource(skill.entry);
-		const cliEntry = join(__dirname, "..", "bin", "cli.mjs");
-		if (!existsSync(cliEntry)) {
-			failCount++;
-			console.log(`  ${DIM}✗ Failed to update ${safeName}: CLI entrypoint not found at ${cliEntry}${RESET}`);
-			continue;
-		}
-		if (spawnSync(process.execPath, [
-			cliEntry,
-			"add",
-			installUrl,
-			"--skill",
-			skill.name,
-			"-y"
-		], {
-			stdio: [
+			] : [
 				"inherit",
 				"pipe",
 				"pipe"
 			],
 			encoding: "utf-8",
 			shell: process.platform === "win32"
-		}).status === 0) {
-			successCount++;
-			console.log(`  ${TEXT}✓${RESET} Updated ${safeName}`);
+		}).status === 0;
+		if (ok) {
+			success++;
+			if (!options.json) console.log(`  ${TEXT}✓${RESET} updated ${safeName}`);
 		} else {
-			failCount++;
-			console.log(`  ${DIM}✗ Failed to update ${safeName}${RESET}`);
+			fail++;
+			if (!options.json) console.log(`  ${DIM}✗ failed ${safeName}${RESET}`);
 		}
+		results.push({
+			name: t.name,
+			kind: t.kind,
+			ok
+		});
 	}
-	printLegacyProjectSkills(legacy);
-	return {
-		successCount,
-		failCount,
-		foundCount: projectSkills.length
-	};
-}
-function printLegacyProjectSkills(legacy) {
-	if (legacy.length === 0) return;
-	console.log();
-	console.log(`${DIM}${legacy.length} project skill(s) cannot be updated automatically (installed before skillPath tracking):${RESET}`);
-	for (const skill of legacy) {
-		const reinstall = formatSourceInput(skill.entry.source, skill.entry.ref);
-		console.log(`  ${TEXT}•${RESET} ${sanitizeMetadata(skill.name)}`);
-		console.log(`    ${DIM}To refresh: ${TEXT}npx skills add ${reinstall} -y${RESET}`);
+	if (options.json) {
+		console.log(JSON.stringify({
+			targets: targets.map((t) => ({
+				kind: t.kind,
+				name: t.name,
+				ref: t.ref
+			})),
+			results,
+			success,
+			fail
+		}, null, 2));
+		return;
 	}
-}
-async function runUpdate(args = []) {
-	const options = parseUpdateOptions(args);
-	const scope = await resolveUpdateScope(options);
-	if (options.skills) console.log(`${TEXT}Updating ${options.skills.join(", ")}...${RESET}`);
-	else console.log(`${TEXT}Checking for skill updates...${RESET}`);
 	console.log();
-	let totalSuccess = 0;
-	let totalFail = 0;
-	let totalFound = 0;
-	if (scope === "global" || scope === "both") {
-		if (scope === "both" && !options.skills) console.log(`${BOLD}Global Skills${RESET}`);
-		const { successCount, failCount, checkedCount } = await updateGlobalSkills(options.skills);
-		totalSuccess += successCount;
-		totalFail += failCount;
-		totalFound += checkedCount;
-		if (scope === "both" && !options.skills) console.log();
-	}
-	if (scope === "project" || scope === "both") {
-		if (scope === "both" && !options.skills) console.log(`${BOLD}Project Skills${RESET}`);
-		const { successCount, failCount, foundCount } = await updateProjectSkills(options.skills);
-		totalSuccess += successCount;
-		totalFail += failCount;
-		totalFound += foundCount;
-	}
-	if (options.skills && totalFound === 0) console.log(`${DIM}No installed skills found matching: ${options.skills.join(", ")}${RESET}`);
-	console.log();
-	if (totalSuccess > 0) console.log(`${TEXT}✓ Updated ${totalSuccess} skill(s)${RESET}`);
-	if (totalFail > 0) console.log(`${DIM}Failed to update ${totalFail} skill(s)${RESET}`);
-	if (totalSuccess === 0 && totalFail === 0) {}
-	track({
-		event: "update",
-		scope,
-		skillCount: String(totalSuccess + totalFail),
-		successCount: String(totalSuccess),
-		failCount: String(totalFail)
-	});
+	if (success > 0) console.log(`${TEXT}✓ Updated ${success} entr${success === 1 ? "y" : "ies"}${RESET}`);
+	if (fail > 0) console.log(`${DIM}Failed to update ${fail} entr${fail === 1 ? "y" : "ies"}${RESET}`);
 	console.log();
 }
 async function main() {