skilllib 1.11.2 → 1.11.3

package/dist/{chunk-OFWHWIER.js → chunk-3XDWEHI4.js}

@@ -2,9 +2,9 @@
 import { resolve as resolve2, sep } from "path";
 
 // src/paths.ts
-import { realpathSync } from "fs";
+import { mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join, resolve } from "path";
+import { dirname, join, resolve } from "path";
 function userHome() {
   return process.env.HOME || homedir();
 }
@@ -41,6 +41,46 @@ function isRepoSkillLocation(location) {
   return location === AGENTS_SKILLS_DIR || location === GROK_SKILLS_DIR;
 }
 var OWN_SKILL_MARKER = ".managed-by-skilllib";
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function realpathOrNull(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+}
+function readState(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`${path} isn't valid JSON: fix it, or move it away to start that file over`);
+  }
+}
+function writeState(path, data) {
+  const target = realpathOrNull(path) ?? path;
+  mkdirSync(dirname(target), { recursive: true });
+  const temp = `${target}.${process.pid}.tmp`;
+  try {
+    writeFileSync(temp, JSON.stringify(data, null, 2) + "\n", { mode: statSync(target, { throwIfNoEntry: false })?.mode ?? 420 });
+    renameSync(temp, target);
+  } catch (err) {
+    rmSync(temp, { force: true });
+    throw err;
+  }
+}
 
 // src/output.ts
 var jsonMode = false;
@@ -71,21 +111,25 @@ function truncate(s, max) {
   return line.length > max ? line.slice(0, max - 1) + "\u2026" : line;
 }
 var visible = (s) => s.replace(/\x1b\[\d+m/g, "");
-function table(rows) {
-  if (rows.length === 0) return;
-  const keys = Object.keys(rows[0]);
-  const widths = keys.map((k) => Math.max(k.length, ...rows.map((r) => visible(r[k] ?? "").length)));
+function table(rows2) {
+  if (rows2.length === 0) return;
+  const keys = Object.keys(rows2[0]);
+  const widths = keys.map((k) => Math.max(k.length, ...rows2.map((r) => visible(r[k] ?? "").length)));
   const pad = (s, w) => s + " ".repeat(Math.max(0, w - visible(s).length));
   info(dim(keys.map((k, i) => pad(k, widths[i])).join("  ")));
-  for (const row of rows) info(keys.map((k, i) => pad(row[k] ?? "", widths[i])).join("  ").trimEnd());
+  for (const row of rows2) info(keys.map((k, i) => pad(row[k] ?? "", widths[i])).join("  ").trimEnd());
+}
+function localStamp(ms) {
+  const at = new Date(ms);
+  return new Date(ms - at.getTimezoneOffset() * 6e4).toISOString().slice(0, 16).replace("T", " ");
 }
 
 // src/agentSkill.ts
-import { existsSync as existsSync8, lstatSync as lstatSync3, mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync as rmSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync8, lstatSync as lstatSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync4, rmSync as rmSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
 import { join as join9 } from "path";
 
 // src/config.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync5, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join6, resolve as resolve4 } from "path";
 
@@ -185,16 +229,16 @@ function installDirs(enabled, keep) {
 }
 
 // src/project.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname, join as join5, resolve as resolve3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join5, resolve as resolve3 } from "path";
 
 // src/versions.ts
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
 import { join as join4 } from "path";
 
 // src/skills.ts
 import { createHash } from "crypto";
-import { cpSync, existsSync as existsSync2, readdirSync, readFileSync, realpathSync as realpathSync2, rmSync, statSync } from "fs";
+import { cpSync, existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, realpathSync as realpathSync2, rmSync as rmSync2, statSync as statSync2 } from "fs";
 import { basename, join as join3, relative, sep as sep2 } from "path";
 import { parse as parseYaml } from "yaml";
 var IGNORED = /* @__PURE__ */ new Set([".DS_Store", ".git", "node_modules"]);
@@ -202,7 +246,7 @@ function readSkillInfo(dir) {
   const skillMd = join3(dir, "SKILL.md");
   const fallback = { name: basename(dir), description: "" };
   if (!existsSync2(skillMd)) return fallback;
-  const match = readFileSync(skillMd, "utf-8").match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  const match = readFileSync2(skillMd, "utf-8").match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match) return fallback;
   try {
     const fm = parseYaml(match[1]);
@@ -220,22 +264,22 @@ function isSkillDir(dir) {
 function listFiles(dir) {
   return readdirSync(dir).filter((entry) => !IGNORED.has(entry)).flatMap((entry) => {
     const full = join3(dir, entry);
-    const st = statSync(full, { throwIfNoEntry: false });
+    const st = statSync2(full, { throwIfNoEntry: false });
     return !st ? [] : st.isDirectory() ? listFiles(full) : [full];
   });
 }
 function treeHash(dir) {
   if (!existsSync2(dir)) return null;
   const hash = createHash("sha256");
-  const files = listFiles(dir).map((f) => ({ path: relative(dir, f).split(sep2).join("/"), full: f })).sort((a, b) => a.path.localeCompare(b.path));
+  const files = listFiles(dir).map((f) => ({ path: relative(dir, f).split(sep2).join("/"), full: f })).sort((a, b) => a.path.localeCompare(b.path, "en"));
   for (const file of files) {
-    hash.update(file.path).update("\0").update(createHash("sha256").update(readFileSync(file.full)).digest("hex")).update("\n");
+    hash.update(file.path).update("\0").update(createHash("sha256").update(readFileSync2(file.full)).digest("hex")).update("\n");
   }
   return hash.digest("hex").slice(0, 16);
 }
 function copySkill(from, to) {
   const source = realpathSync2(from);
-  rmSync(to, { recursive: true, force: true });
+  rmSync2(to, { recursive: true, force: true });
   cpSync(source, to, { recursive: true, dereference: true, filter: (src) => !IGNORED.has(basename(src)) && existsSync2(src) });
 }
 function skillDirsIn(dir) {
@@ -251,11 +295,7 @@ function indexFile(name) {
   return join4(storeDir(name), "versions.json");
 }
 function versionHistory(name) {
-  try {
-    return JSON.parse(readFileSync2(indexFile(name), "utf-8"));
-  } catch {
-    return [];
-  }
+  return readState(indexFile(name)) ?? [];
 }
 function versionDir(name, version) {
   return join4(storeDir(name), String(version));
@@ -277,9 +317,10 @@ function latestVersion(name) {
       result = last;
     } else {
       const next = { version: (last?.version ?? 0) + 1, hash, date: (/* @__PURE__ */ new Date()).toISOString() };
-      mkdirSync(storeDir(name), { recursive: true });
+      if (existsSync3(versionDir(name, next.version))) throw new Error(`${versionDir(name, next.version)} exists but ${indexFile(name)} doesn't list it: fix the index before adding versions`);
+      mkdirSync2(storeDir(name), { recursive: true });
       copySkill(source, versionDir(name, next.version));
-      writeFileSync(indexFile(name), JSON.stringify([...history, next], null, 2) + "\n");
+      writeState(indexFile(name), [...history, next]);
       result = next;
     }
   }
@@ -298,7 +339,7 @@ function findProjectRoot(from = process.cwd()) {
   let dir = resolve3(from);
   while (true) {
     if (existsSync4(join5(dir, MANIFEST_FILE)) || existsSync4(join5(dir, ".git"))) return dir;
-    const parent = dirname(dir);
+    const parent = dirname2(dir);
     if (parent === dir) return resolve3(from);
     dir = parent;
   }
@@ -310,7 +351,12 @@ function projectHere(from = process.cwd()) {
 function readManifest(root) {
   const path = join5(root, MANIFEST_FILE);
   if (!existsSync4(path)) return { skills: {} };
-  const data = JSON.parse(readFileSync3(path, "utf-8"));
+  let data;
+  try {
+    data = JSON.parse(readFileSync3(path, "utf-8"));
+  } catch {
+    throw new Error(`${path} isn't valid JSON (a merge conflict?): fix it, then run skilllib again`);
+  }
   const skills = Object.fromEntries(
     Object.entries(data.skills ?? {}).flatMap(([name, value]) => {
       if (name.startsWith("@")) return [];
@@ -335,8 +381,8 @@ function readManifest(root) {
   return { ...data, skills };
 }
 function writeManifest(root, manifest) {
-  const skills = Object.fromEntries(Object.entries(manifest.skills).sort(([a], [b]) => a.localeCompare(b)));
-  writeFileSync2(join5(root, MANIFEST_FILE), JSON.stringify({ ...manifest, skills }, null, 2) + "\n");
+  const skills = Object.fromEntries(Object.entries(manifest.skills).sort(([a], [b]) => a.localeCompare(b, "en")));
+  writeState(join5(root, MANIFEST_FILE), { ...manifest, skills });
 }
 function projectsFile() {
   return join5(skilllibHome(), "projects.json");
@@ -344,7 +390,7 @@ function projectsFile() {
 function knownProjects() {
   const path = projectsFile();
   if (!existsSync4(path)) return [];
-  const list2 = JSON.parse(readFileSync3(path, "utf-8"));
+  const list2 = readState(path) ?? [];
   return onePerFolder(list2.filter((p) => existsSync4(p) && isProjectCandidate(p) && !isAgentWorktree(p)));
 }
 function isAgentWorktree(path) {
@@ -365,8 +411,27 @@ function isProjectCandidate(root) {
 function rememberProjects(roots) {
   const incoming = roots.map((r) => resolve3(r)).filter((r) => isProjectCandidate(r) && !isAgentWorktree(r));
   const all = onePerFolder([...knownProjects(), ...incoming]).sort();
-  mkdirSync2(skilllibHome(), { recursive: true });
-  writeFileSync2(projectsFile(), JSON.stringify(all, null, 2) + "\n");
+  writeState(projectsFile(), all);
+}
+function readableRoots(roots) {
+  const unreadable = [];
+  const readable = roots.filter((root) => {
+    try {
+      readManifest(root);
+      return true;
+    } catch (err) {
+      unreadable.push({ root, reason: err.message });
+      return false;
+    }
+  });
+  return { readable, unreadable };
+}
+function pinsIn(root) {
+  try {
+    return readManifest(root).skills;
+  } catch {
+    return {};
+  }
 }
 
 // src/config.ts
@@ -374,16 +439,11 @@ function configFile() {
   return join6(skilllibHome(), "config.json");
 }
 function readConfig() {
-  try {
-    const data = JSON.parse(readFileSync4(configFile(), "utf-8"));
-    return { ...data, roots: data.roots ?? [], hidden: data.hidden ?? [] };
-  } catch {
-    return { roots: [], hidden: [] };
-  }
+  const data = readState(configFile()) ?? {};
+  return { ...data, roots: data.roots ?? [], hidden: data.hidden ?? [] };
 }
 function writeConfig(config) {
-  mkdirSync3(skilllibHome(), { recursive: true });
-  writeFileSync3(configFile(), JSON.stringify(config, null, 2) + "\n");
+  writeState(configFile(), config);
 }
 function expandHome(path) {
   return resolve4(path.replace(/^~(?=$|\/)/, homedir2()));
@@ -391,7 +451,7 @@ function expandHome(path) {
 function addRoot(path) {
   const root = expandHome(path);
   if (!existsSync5(root)) throw new Error(`${tildify(root)} doesn't exist`);
-  if (!statSync2(root).isDirectory()) throw new Error(`${tildify(root)} isn't a folder`);
+  if (!statSync3(root).isDirectory()) throw new Error(`${tildify(root)} isn't a folder`);
   const config = readConfig();
   if (!config.roots.includes(root)) writeConfig({ ...config, roots: [...config.roots, root].sort() });
   return root;
@@ -464,35 +524,25 @@ function setKeepGlobal(names, keep) {
 
 // src/library.ts
 import { execFileSync } from "child_process";
-import { cpSync as cpSync2, existsSync as existsSync7, lstatSync as lstatSync2, mkdirSync as mkdirSync5, readdirSync as readdirSync4, readFileSync as readFileSync6, realpathSync as realpathSync4, renameSync, rmSync as rmSync2, symlinkSync, unlinkSync, writeFileSync as writeFileSync5 } from "fs";
-import { basename as basename3, dirname as dirname2, join as join8, relative as relative2, sep as sep3 } from "path";
+import { cpSync as cpSync2, existsSync as existsSync7, lstatSync as lstatSync2, mkdirSync as mkdirSync4, readdirSync as readdirSync4, renameSync as renameSync2, rmSync as rmSync3, symlinkSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename as basename3, dirname as dirname3, join as join8, relative as relative2, sep as sep4 } from "path";
 
 // src/sources.ts
-import { existsSync as existsSync6, lstatSync, mkdirSync as mkdirSync4, readdirSync as readdirSync3, readFileSync as readFileSync5, readlinkSync, realpathSync as realpathSync3, writeFileSync as writeFileSync4 } from "fs";
-import { basename as basename2, join as join7, resolve as resolve5 } from "path";
-function readJson(path) {
-  try {
-    return JSON.parse(readFileSync5(path, "utf-8"));
-  } catch {
-    return null;
-  }
-}
+import { existsSync as existsSync6, lstatSync, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readlinkSync } from "fs";
+import { basename as basename2, join as join7, resolve as resolve5, sep as sep3 } from "path";
+import { tmpdir } from "os";
 function skillsShLock() {
   return readJson(join7(userHome(), ".agents", ".skill-lock.json"))?.skills ?? {};
 }
 function projectSkillsLock(root) {
   return readJson(join7(root, "skills-lock.json"))?.skills ?? {};
 }
-function realpathOrNull(path) {
-  try {
-    return realpathSync3(path);
-  } catch {
-    return null;
-  }
+function vendorSkill(path, kind, origin, harnesses) {
+  return { name: basename2(path), kind, origin, path, description: readSkillInfo(path).description, movable: false, broken: false, harnesses, links: [] };
 }
 function harnessesReading(dir, enabled) {
   const real = realPath(dir);
-  return enabled.filter((id) => HARNESSES.find((h) => h.id === id)?.globalDirs().some((d) => realPath(d) === real));
+  return enabled.filter((id) => harness(id).globalDirs().some((d) => realPath(d) === real));
 }
 var systemDirs = () => [codexSystemDir()];
 function globalSkillDirs() {
@@ -511,17 +561,7 @@ function globalDirAs(dir) {
 }
 function systemSkills(enabled) {
   return systemDirs().flatMap(
-    (dir) => skillDirsIn(dir).map((path) => ({
-      name: basename2(path),
-      kind: "system",
-      origin: dir.replace(/\\/g, "/"),
-      path,
-      description: readSkillInfo(path).description,
-      movable: false,
-      broken: false,
-      harnesses: harnessesReading(dir, enabled),
-      links: []
-    }))
+    (dir) => skillDirsIn(dir).map((path) => vendorSkill(path, "system", dir.replace(/\\/g, "/"), harnessesReading(dir, enabled)))
   ).filter((s) => s.harnesses.length > 0);
 }
 function globalFolderSkills(enabled) {
@@ -550,7 +590,7 @@ function globalFolderSkills(enabled) {
     const inAgents = e.dir === agentsDir || target_.includes(".agents/skills");
     const locked = lock[e.name]?.source;
     if (existsSync6(join7(e.path, OWN_SKILL_MARKER))) {
-      skills.push({ name: e.name, kind: "skilllib", origin: "skilllib", path: e.path, description: readSkillInfo(e.path).description, movable: false, broken: false, harnesses: harnessesReading(e.dir, enabled), links: [] });
+      skills.push(vendorSkill(e.path, "skilllib", "skilllib", harnessesReading(e.dir, enabled)));
       continue;
     }
     skills.push({
@@ -578,31 +618,11 @@ function tildify2(p) {
 }
 function grokBuiltInSkills(enabled) {
   if (!enabled.includes("grok")) return [];
-  return skillDirsIn(join7(grokDir(), "bundled", "skills")).map((path) => ({
-    name: basename2(path),
-    kind: "built-in",
-    origin: "Grok",
-    path,
-    description: readSkillInfo(path).description,
-    movable: false,
-    broken: false,
-    harnesses: ["grok"],
-    links: []
-  }));
+  return skillDirsIn(join7(grokDir(), "bundled", "skills")).map((path) => vendorSkill(path, "built-in", "Grok", ["grok"]));
 }
 function cursorBuiltInSkills(enabled) {
   if (!enabled.includes("cursor")) return [];
-  return skillDirsIn(join7(userHome(), ".cursor", "skills-cursor")).map((path) => ({
-    name: basename2(path),
-    kind: "built-in",
-    origin: "Cursor",
-    path,
-    description: readSkillInfo(path).description,
-    movable: false,
-    broken: false,
-    harnesses: ["cursor"],
-    links: []
-  }));
+  return skillDirsIn(join7(userHome(), ".cursor", "skills-cursor")).map((path) => vendorSkill(path, "built-in", "Cursor", ["cursor"]));
 }
 function claudeAiSkills(enabled) {
   const byReal = /* @__PURE__ */ new Map();
@@ -617,20 +637,13 @@ function claudeAiSkills(enabled) {
   }
   return [...byReal.values()].flatMap(
     ({ dir, readers }) => readdirSync3(dir).filter((d) => !d.startsWith(".")).flatMap(
-      (bucket) => skillDirsIn(join7(dir, bucket)).map((path) => ({
-        name: basename2(path),
-        kind: "claude.ai",
-        origin: "claude.ai account",
-        path,
-        description: readSkillInfo(path).description,
-        movable: false,
-        broken: false,
-        harnesses: enabled.filter((id) => readers.includes(id)),
-        links: []
-      }))
+      (bucket) => skillDirsIn(join7(dir, bucket)).map((path) => vendorSkill(path, "claude.ai", "claude.ai account", enabled.filter((id) => readers.includes(id))))
     )
   );
 }
+function installedPluginsJson() {
+  return readJson(join7(claudeDir(), "plugins", "installed_plugins.json"))?.plugins ?? {};
+}
 function pluginDirCandidates(id, installPaths) {
   const [name = "", marketplace = ""] = id.split("@");
   const plugins = join7(claudeDir(), "plugins");
@@ -653,7 +666,7 @@ function pluginSkills(harnesses, root) {
   const cursor = harnesses.includes("cursor");
   if (!claude2 && !cursor) return [];
   const plugins = join7(claudeDir(), "plugins");
-  const installed = readJson(join7(plugins, "installed_plugins.json"))?.plugins ?? {};
+  const installed = installedPluginsJson();
   const user = enabledPlugins();
   const enabled = root ? enabledPlugins(root) : user;
   const fromMarketplaces = [.../* @__PURE__ */ new Set([...Object.keys(enabled), ...Object.keys(user)])].filter((id) => claude2 && enabled[id] || cursor && user[id]).flatMap((id) => {
@@ -673,17 +686,7 @@ function pluginSkills(harnesses, root) {
       return skillDirsIn(join7(root2, "skills")).map((path) => ({ path, origin: `${name}@synced`, loadedBy: ["claude-code"] }));
     })
   ) : [];
-  return [...fromMarketplaces, ...fromSynced].map(({ path, origin, loadedBy }) => ({
-    name: basename2(path),
-    kind: "plugin",
-    origin,
-    path,
-    description: readSkillInfo(path).description,
-    movable: false,
-    broken: false,
-    harnesses: loadedBy,
-    links: []
-  }));
+  return [...fromMarketplaces, ...fromSynced].map(({ path, origin, loadedBy }) => vendorSkill(path, "plugin", origin, loadedBy));
 }
 var byKindAndName = (a, b) => a.kind.localeCompare(b.kind) || a.name.localeCompare(b.name);
 function machineSkills(enabled = enabledHarnesses()) {
@@ -705,15 +708,18 @@ function originsFile() {
   return join7(skilllibHome(), "origins.json");
 }
 function libraryOrigins() {
-  return readJson(originsFile()) ?? {};
+  return readState(originsFile()) ?? {};
 }
 function recordOrigin(name, origin) {
   const origins = libraryOrigins();
   if (origins[name] === origin) return;
-  mkdirSync4(skilllibHome(), { recursive: true });
-  writeFileSync4(originsFile(), JSON.stringify({ ...origins, [name]: origin }, null, 2) + "\n");
+  mkdirSync3(skilllibHome(), { recursive: true });
+  writeState(originsFile(), { ...origins, [name]: origin });
 }
 function originFor(dir) {
+  const under = (path, folder) => path.startsWith((realpathOrNull(folder) ?? folder) + sep3);
+  const real = realpathOrNull(dir) ?? dir;
+  if ([tmpdir(), "/tmp", "/var/tmp"].some((t) => under(real, t)) && !under(real, userHome())) return "";
   const match = machineSkills().find((s) => resolve5(s.path) === resolve5(dir));
   if (match) return match.kind === "global" ? "global folder" : `${match.kind}: ${match.origin}`;
   const project = dir.split(/[\\/]\.(?:claude|agents|grok|cursor|codex)[\\/]skills[\\/]/)[0];
@@ -733,13 +739,6 @@ function librarySkills() {
 function librarySkillDir(name) {
   return join8(libraryDir(), name);
 }
-function realpathOrNull2(path) {
-  try {
-    return realpathSync4(path);
-  } catch {
-    return null;
-  }
-}
 function isLink(path) {
   try {
     return lstatSync2(path).isSymbolicLink();
@@ -749,7 +748,7 @@ function isLink(path) {
 }
 function linkDir(target, link2) {
   if (process.platform === "win32") symlinkSync(target, link2, "junction");
-  else symlinkSync(relative2(dirname2(link2), target), link2);
+  else symlinkSync(relative2(dirname3(link2), target), link2);
 }
 function entryExists(path) {
   return isLink(path) || existsSync7(path);
@@ -761,9 +760,9 @@ function visibilityOf(root, name, enabled = enabledHarnesses()) {
   }));
 }
 function dependencyDirs(root, name, dep) {
-  const wanted = installDirs(enabledHarnesses());
   const untracked = ALL_PROJECT_DIRS.find((d) => d !== GROK_SKILLS_DIR && existsSync7(join8(root, d, name, "SKILL.md")) && !isLink(join8(root, d, name)));
-  const primary = dep ? dep.dir ?? PROJECT_SKILLS_DIR : untracked ?? wanted[0];
+  const primary = dep ? dep.dir ?? PROJECT_SKILLS_DIR : untracked ?? installDirs(enabledHarnesses())[0];
+  const wanted = installDirs(enabledHarnesses(), primary);
   return [primary, .../* @__PURE__ */ new Set([...dep?.links ?? [], ...wanted.filter((d) => d !== primary)])];
 }
 function isGitTracked(root, dir) {
@@ -809,7 +808,7 @@ function projectStatus(root) {
   }
   for (const [name, paths] of byName) {
     const real = paths.find((p) => !isLink(p)) ?? paths[0];
-    const location = relative2(root, join8(real, "..")).split(sep3).join("/");
+    const location = relative2(root, join8(real, "..")).split(sep4).join("/");
     const source = lock[name]?.source;
     unmanaged.push({
       name,
@@ -854,9 +853,9 @@ function nestedSkills(root, { depth = 3, enabled = enabledHarnesses() } = {}) {
     for (const sub of subs) {
       if (existsSync7(join8(sub, ".git"))) continue;
       for (const [skillsDir, readers] of NESTED_READERS) {
-        const location = relative2(root, join8(sub, skillsDir)).split(sep3).join("/");
+        const location = relative2(root, join8(sub, skillsDir)).split(sep4).join("/");
         for (const path of skillDirsIn(join8(sub, skillsDir))) {
-          if (isLink(path) && (realpathOrNull2(path) ?? "").startsWith((realpathOrNull2(root) ?? root) + sep3)) continue;
+          if (isLink(path) && (realpathOrNull(path) ?? "").startsWith((realpathOrNull(root) ?? root) + sep4)) continue;
           const name = basename3(path);
           found.push({
             name,
@@ -907,7 +906,7 @@ function linkEverywhere(root, name, location, { allowTracked = false, dryRun = f
       }
     }
     if (!dryRun) {
-      mkdirSync5(join8(root, dir), { recursive: true });
+      mkdirSync4(join8(root, dir), { recursive: true });
       linkDir(join8(root, location, name), link2);
     }
     result.created.push(dir);
@@ -915,12 +914,12 @@ function linkEverywhere(root, name, location, { allowTracked = false, dryRun = f
   return result;
 }
 function unlinkEverywhere(root, name, removing) {
-  const gone = removing ? realpathOrNull2(removing) : null;
+  const gone = removing ? realpathOrNull(removing) : null;
   return ALL_PROJECT_DIRS.filter((dir) => {
     const link2 = join8(root, dir, name);
     if (!isLink(link2)) return false;
     if (dir === GROK_SKILLS_DIR) {
-      const target = realpathOrNull2(link2);
+      const target = realpathOrNull(link2);
       if (target !== null && target !== gone) return false;
     }
     unlinkSync(link2);
@@ -960,6 +959,8 @@ function addSkill(root, name, { force = false, version, allowTracked = false } =
   const to = join8(root, primary, name);
   const local = isLink(to) && !recorded ? null : treeHash(to);
   const knownContent = local !== null && (local === recorded?.hash || versionForHash(name, local) !== null);
+  if (local !== null && !recorded && local !== target.hash && isGitTracked(root, `${primary}/${name}`))
+    return { name, action: "skipped", reason: `${primary}/${name} is the repo's own (committed): skilllib doesn't replace it; remove it in the repo first if the library's should win` };
   if (local !== null && local !== target.hash && !knownContent && !force) {
     return {
       name,
@@ -969,9 +970,9 @@ function addSkill(root, name, { force = false, version, allowTracked = false } =
   }
   let backedUp;
   if (local !== target.hash || isLink(to)) {
-    mkdirSync5(join8(root, primary), { recursive: true });
+    mkdirSync4(join8(root, primary), { recursive: true });
     if (isLink(to)) unlinkSync(to);
-    else if (local !== null && !knownContent) backedUp = stash(to, "edit-backup");
+    else if (local !== null && versionForHash(name, local) === null) backedUp = stash(to, "edit-backup");
     copySkill(versionDir(name, target.version), to);
   }
   const links = [];
@@ -980,7 +981,7 @@ function addSkill(root, name, { force = false, version, allowTracked = false } =
   let shared;
   for (const dir of linkDirs) {
     const link2 = join8(root, dir, name);
-    if (isLink(link2) && realpathOrNull2(link2) === realpathOrNull2(to)) {
+    if (isLink(link2) && realpathOrNull(link2) === realpathOrNull(to)) {
       links.push(dir);
       continue;
     }
@@ -995,7 +996,7 @@ function addSkill(root, name, { force = false, version, allowTracked = false } =
         continue;
       }
     }
-    mkdirSync5(join8(root, dir), { recursive: true });
+    mkdirSync4(join8(root, dir), { recursive: true });
     linkDir(to, link2);
     links.push(dir);
   }
@@ -1022,14 +1023,15 @@ function removeSkill(root, name, { force = false } = {}) {
   if (!recorded) return { name, action: "skipped", reason: "not managed by skilllib in this project" };
   const dir = join8(root, recorded.dir ?? PROJECT_SKILLS_DIR, name);
   const local = treeHash(dir);
-  const edited = local !== null && local !== recorded.hash && !versionForHash(name, local);
+  const inLibrary = local !== null && versionForHash(name, local) !== null;
+  const edited = local !== null && local !== recorded.hash && !inLibrary;
   if (edited && !force) return { name, action: "skipped", reason: "has local edits (use --force to delete anyway)" };
   for (const linkDir2 of recorded.links ?? []) {
     const link2 = join8(root, linkDir2, name);
     if (isLink(link2)) unlinkSync(link2);
   }
-  const backedUp = edited ? stash(dir, "edit-backup") : void 0;
-  if (!backedUp) rmSync2(dir, { recursive: true, force: true });
+  const backedUp = local !== null && !inLibrary ? stash(dir, "edit-backup") : void 0;
+  if (!backedUp) rmSync3(dir, { recursive: true, force: true });
   delete manifest.skills[name];
   writeManifest(root, manifest);
   return { name, action: "removed", ...backedUp ? { backedUp } : {} };
@@ -1040,23 +1042,41 @@ function syncProject(root, { force = false } = {}) {
 function syncSkill(root, name, { force = false } = {}) {
   const dep = readManifest(root).skills[name];
   if (!dep) return [];
-  const local = treeHash(join8(root, dep.dir ?? PROJECT_SKILLS_DIR, name));
-  const linksOk = (dep.links ?? []).every((d) => existsSync7(join8(root, d, name, "SKILL.md")));
+  const copy = join8(root, dep.dir ?? PROJECT_SKILLS_DIR, name);
+  const local = treeHash(copy);
+  const linksOk = (dep.links ?? []).every((d) => realpathOrNull(join8(root, d, name)) === realpathOrNull(copy));
   if (local === dep.hash && linksOk) return [];
+  if (local === dep.hash) return [relinkPinned(root, name, dep)];
   if (local !== null && local !== dep.hash && !force) return [{ name, action: "skipped", reason: "has local edits (use --force to reset them)" }];
-  const change = addSkill(root, name, { force: true, version: pinnedVersion(name, dep) });
-  if (change.action === "skipped") return [{ ...change, reason: `not in your library (${tildify(libraryDir())}); import it, or set SKILLLIB_HOME to the library that has it` }];
+  const version = pinnedVersion(name, dep);
+  if (typeof version === "string") return [{ name, action: "skipped", reason: version }];
+  const change = addSkill(root, name, { force: true, version });
   return [{ ...change, action: local === null ? "installed" : change.action }];
 }
+function relinkPinned(root, name, dep) {
+  const to = join8(root, dep.dir ?? PROJECT_SKILLS_DIR, name);
+  for (const dir of dep.links ?? []) {
+    const link2 = join8(root, dir, name);
+    if (realpathOrNull(link2) === realpathOrNull(to)) continue;
+    if (isLink(link2)) unlinkSync(link2);
+    else if (entryExists(link2)) return { name, action: "skipped", reason: `${dir}/${name} is in the way of its link: move it, then sync` };
+    mkdirSync4(join8(root, dir), { recursive: true });
+    linkDir(to, link2);
+  }
+  return { name, action: "relinked", to: dep.version };
+}
 function pinnedVersion(name, dep) {
-  return versionForHash(name, dep.hash)?.version ?? (dep.version > 0 && getVersion(name, dep.version) ? dep.version : void 0);
+  if (!latestVersion(name)) return `not in your library (${tildify(libraryDir())}); import it, or set SKILLLIB_HOME to the library that has it`;
+  return versionForHash(name, dep.hash)?.version ?? `your library has no copy of the version skilllib.json pins (pinned from another library?); skilllib update ${name} installs your newest`;
 }
 function discardEdits(root, name) {
   const dep = readManifest(root).skills[name];
   if (!dep) return { name, action: "skipped", reason: "not managed by skilllib in this project" };
+  const version = pinnedVersion(name, dep);
+  if (typeof version === "string") return { name, action: "skipped", reason: version };
   const dir = join8(root, dep.dir ?? PROJECT_SKILLS_DIR, name);
   if (existsSync7(dir) && !isLink(dir)) stash(dir, "edit-backup");
-  return addSkill(root, name, { force: true, version: pinnedVersion(name, dep) });
+  return addSkill(root, name, { force: true, version });
 }
 function updateProject(root, names, { force = false } = {}) {
   const { skills } = readManifest(root);
@@ -1078,7 +1098,7 @@ function importSkill(dir, { force = false } = {}) {
   const incoming = treeHash(dir);
   if (existing === incoming) return { name, status: "unchanged" };
   if (existing !== null && !force) return { name, status: "exists" };
-  mkdirSync5(libraryDir(), { recursive: true });
+  mkdirSync4(libraryDir(), { recursive: true });
   const origin = existing !== null && libraryOrigins()[name] ? null : originFor(dir);
   copySkill(dir, to);
   if (origin) recordOrigin(name, origin);
@@ -1090,19 +1110,15 @@ function backupIndexFile(bucket) {
   return join8(skilllibHome(), bucket, "index.json");
 }
 function readBackupIndex(bucket) {
-  try {
-    return JSON.parse(readFileSync6(backupIndexFile(bucket), "utf-8"));
-  } catch {
-    return {};
-  }
+  return readState(backupIndexFile(bucket)) ?? {};
 }
 function move(from, to) {
   try {
-    renameSync(from, to);
+    renameSync2(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
     cpSync2(from, to, { recursive: true, verbatimSymlinks: true });
-    rmSync2(from, { recursive: true, force: true });
+    rmSync3(from, { recursive: true, force: true });
   }
 }
 function stash(dir, bucket) {
@@ -1111,9 +1127,10 @@ function stash(dir, bucket) {
   while (entryExists(join8(skilllibHome(), bucket, entryAt(at)))) at++;
   const entry = entryAt(at);
   const target = join8(skilllibHome(), bucket, entry);
-  mkdirSync5(join8(skilllibHome(), bucket), { recursive: true });
+  const index = readBackupIndex(bucket);
+  mkdirSync4(join8(skilllibHome(), bucket), { recursive: true });
   move(dir, target);
-  writeFileSync5(backupIndexFile(bucket), JSON.stringify({ ...readBackupIndex(bucket), [entry]: dir }, null, 2) + "\n");
+  writeState(backupIndexFile(bucket), { ...index, [entry]: dir });
   return target;
 }
 function removeUntracked(root, name, path) {
@@ -1121,7 +1138,7 @@ function removeUntracked(root, name, path) {
   return stash(path, "trash");
 }
 function projectsUsing(name) {
-  return knownProjects().filter((p) => name in readManifest(p).skills);
+  return knownProjects().filter((p) => name in pinsIn(p));
 }
 function deleteLibrarySkill(name) {
   const using = projectsUsing(name);
@@ -1150,12 +1167,12 @@ function linkGlobal(path, agents) {
   const skipped = [];
   for (const dir of new Set(agents.map((id) => harness(id).globalDirs()[0]))) {
     const link2 = join8(dir, name);
-    if (isLink(link2) && realpathOrNull2(link2) === null) unlinkSync(link2);
+    if (isLink(link2) && realpathOrNull(link2) === null) unlinkSync(link2);
     else if (entryExists(link2)) {
-      if (realpathOrNull2(link2) !== realpathOrNull2(path)) skipped.push(link2);
+      if (realpathOrNull(link2) !== realpathOrNull(path)) skipped.push(link2);
       continue;
     }
-    mkdirSync5(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true });
     linkDir(path, link2);
     linked.push(link2);
   }
@@ -1165,8 +1182,8 @@ function createSkill(name, description) {
   if (!/^[a-z0-9][a-z0-9-]*$/.test(name)) return { ok: false, reason: "use lowercase letters, digits and dashes" };
   const dir = librarySkillDir(name);
   if (existsSync7(dir)) return { ok: false, reason: `${name} already exists` };
-  mkdirSync5(dir, { recursive: true });
-  writeFileSync5(
+  mkdirSync4(dir, { recursive: true });
+  writeFileSync2(
     join8(dir, "SKILL.md"),
     `---
 name: ${name}
@@ -1190,26 +1207,28 @@ function listBackups() {
       const match = entry.match(/^(.*)-(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-\d{3}Z$/);
       if (!match) return [];
       const name = match[1];
-      const from = index[entry] ?? (kind === "trash" ? librarySkillDir(name) : join8(claudeDir(), "skills", name));
-      return [{ name, kind, path: join8(dir, entry), movedAt: `${match[2]} ${match[3]}:${match[4]}`, from }];
+      const from = index[entry] ?? (kind === "trash" ? librarySkillDir(name) : kind === "global-backup" ? join8(claudeDir(), "skills", name) : "");
+      return [{ name, kind, path: join8(dir, entry), movedAt: localStamp(Date.parse(`${match[2]}T${match[3]}:${match[4]}:${match[5]}Z`)), from }];
     });
   }).sort((a, b) => b.path.slice(-24).localeCompare(a.path.slice(-24)));
 }
 function backupFrom(backup) {
   if (backup.kind === "plugin") return "Claude Code plugin";
-  return backup.from === librarySkillDir(backup.name) ? "library (deleted)" : tildify(dirname2(backup.from));
+  if (!backup.from) return "unknown";
+  return backup.from === librarySkillDir(backup.name) ? "library (deleted)" : tildify(dirname3(backup.from));
 }
 function restoreBackup(backup) {
   const to = backup.from;
+  if (!to) return { ok: false, reason: `skilllib doesn't know where it came from; its files are in ${tildify(backup.path)}` };
   if (backup.kind === "tidy-backup" && isLink(to)) unlinkSync(to);
-  if (backup.kind === "edit-backup" && !isLink(to) && versionForHash(backup.name, treeHash(to) ?? "") !== null) rmSync2(to, { recursive: true, force: true });
+  if (backup.kind === "edit-backup" && !isLink(to) && versionForHash(backup.name, treeHash(to) ?? "") !== null) rmSync3(to, { recursive: true, force: true });
   let taken = existsSync7(to);
   try {
     taken = taken || lstatSync2(to) !== null;
   } catch {
   }
   if (taken) return { ok: false, reason: `${backup.name} already exists there` };
-  mkdirSync5(join8(to, ".."), { recursive: true });
+  mkdirSync4(join8(to, ".."), { recursive: true });
   move(backup.path, to);
   forgetLatest(backup.name);
   return { ok: true, to };
@@ -1218,7 +1237,7 @@ function restoreBackup(backup) {
 // src/agentSkill.ts
 var AGENT_SKILL_NAME = "skilllib";
 function shippedSkill() {
-  return readFileSync7(new URL("../skills/skilllib/SKILL.md", import.meta.url), "utf-8");
+  return readFileSync4(new URL("../skills/skilllib/SKILL.md", import.meta.url), "utf-8");
 }
 function agentSkillDirs(enabled = enabledHarnesses()) {
   const claudeSkills = join9(claudeDir(), "skills");
@@ -1244,7 +1263,7 @@ function entryExists2(path) {
 function agentSkillState(enabled = enabledHarnesses()) {
   const [primary, ...links] = agentSkillDirs(enabled);
   if (!primary || !isOurs(primary) || links.some((l) => !existsSync8(join9(l, "SKILL.md")))) return "missing";
-  return readFileSync7(join9(primary, "SKILL.md"), "utf-8") === shippedSkill() ? "installed" : "outdated";
+  return readFileSync4(join9(primary, "SKILL.md"), "utf-8") === shippedSkill() ? "installed" : "outdated";
 }
 function installAgentSkill(enabled = enabledHarnesses()) {
   const [primary, ...links] = agentSkillDirs(enabled);
@@ -1252,12 +1271,12 @@ function installAgentSkill(enabled = enabledHarnesses()) {
   const foreign = [primary, ...links].find((d) => entryExists2(d) && !isOurs(d) && !isDangling(d));
   if (foreign) return { ok: false, reason: `${tildify(foreign)} already exists and isn't skilllib's` };
   for (const d of [primary, ...links]) if (isDangling(d)) unlinkSync2(d);
-  mkdirSync6(primary, { recursive: true });
-  writeFileSync6(join9(primary, "SKILL.md"), shippedSkill());
-  writeFileSync6(join9(primary, OWN_SKILL_MARKER), "Installed by skilllib. `skilllib agent-skill remove` removes it.\n");
+  mkdirSync5(primary, { recursive: true });
+  writeFileSync3(join9(primary, "SKILL.md"), shippedSkill());
+  writeFileSync3(join9(primary, OWN_SKILL_MARKER), "Installed by skilllib. `skilllib agent-skill remove` removes it.\n");
   for (const link2 of links) {
     if (entryExists2(link2)) continue;
-    mkdirSync6(join9(link2, ".."), { recursive: true });
+    mkdirSync5(join9(link2, ".."), { recursive: true });
     linkDir(primary, link2);
   }
   return { ok: true, dirs: [primary, ...links] };
@@ -1266,8 +1285,9 @@ function removeAgentSkill() {
   const all = agentSkillDirs(["claude-code", "codex"]);
   const removed = all.filter((d) => entryExists2(d) && (isOurs(d) || isDangling(d)));
   for (const d of removed) {
+    if (!entryExists2(d)) continue;
     if (lstatSync3(d).isSymbolicLink()) unlinkSync2(d);
-    else rmSync3(d, { recursive: true, force: true });
+    else rmSync4(d, { recursive: true, force: true });
   }
   return removed;
 }
@@ -1279,9 +1299,9 @@ function refreshAgentSkill() {
 }
 
 // src/commands.ts
-import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync6 } from "fs";
 import { parseArgs as parseFlags } from "util";
-import { basename as basename9, join as join14, resolve as resolve7, sep as sep5 } from "path";
+import { basename as basename9, join as join15, resolve as resolve7, sep as sep6 } from "path";
 
 // src/git.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -1323,24 +1343,17 @@ function relativeTo(root, path) {
 }
 
 // src/here.ts
-import { readdirSync as readdirSync7 } from "fs";
+import { readdirSync as readdirSync8 } from "fs";
 import { basename as basename7 } from "path";
 
 // src/health.ts
-import { lstatSync as lstatSync4 } from "fs";
-import { basename as basename6, dirname as dirname5 } from "path";
+import { existsSync as existsSync12, lstatSync as lstatSync4, readdirSync as readdirSync7, unlinkSync as unlinkSync4 } from "fs";
+import { basename as basename6, dirname as dirname6, join as join13 } from "path";
 
 // src/plugins.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readdirSync as readdirSync5, readFileSync as readFileSync8, statSync as statSync3, writeFileSync as writeFileSync7 } from "fs";
-import { basename as basename4, dirname as dirname3, join as join11, resolve as resolve6 } from "path";
-function readJson2(path) {
-  try {
-    return JSON.parse(readFileSync8(path, "utf-8"));
-  } catch {
-    return null;
-  }
-}
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readdirSync as readdirSync5, readFileSync as readFileSync5, statSync as statSync4, writeFileSync as writeFileSync4 } from "fs";
+import { basename as basename4, dirname as dirname4, join as join11, resolve as resolve6 } from "path";
 function nonEmptyDir(path) {
   try {
     return readdirSync5(path).some((f) => !f.startsWith("."));
@@ -1349,7 +1362,7 @@ function nonEmptyDir(path) {
   }
 }
 function extrasOf(root) {
-  const manifest = readJson2(join11(root, ".claude-plugin", "plugin.json")) ?? {};
+  const manifest = readJson(join11(root, ".claude-plugin", "plugin.json")) ?? {};
   return [
     ...existsSync10(join11(root, ".mcp.json")) || manifest.mcpServers ? ["MCP servers"] : [],
     ...existsSync10(join11(root, "hooks", "hooks.json")) || manifest.hooks ? ["hooks"] : [],
@@ -1358,21 +1371,20 @@ function extrasOf(root) {
   ];
 }
 function claudePlugins(machine, root) {
-  const installed = readJson2(join11(claudeDir(), "plugins", "installed_plugins.json"))?.plugins ?? {};
+  const installed = installedPluginsJson();
   const byOrigin = /* @__PURE__ */ new Map();
   for (const m of machine) if (m.kind === "plugin") byOrigin.set(m.origin, [...byOrigin.get(m.origin) ?? [], m.path]);
   return [...byOrigin].map(([origin, skills]) => {
     const synced = origin.endsWith("@synced");
-    const id = origin;
     const entries = installed[origin] ?? [];
     const entry = entries.find((e) => root && e.projectPath === root) ?? entries.find((e) => (e.scope ?? "user") === "user") ?? entries[0];
     return {
-      id,
+      id: origin,
       scope: synced ? null : entry?.scope ?? "user",
       ...entry?.projectPath ? { projectPath: entry.projectPath } : {},
       synced,
       skills,
-      extras: extrasOf(dirname3(dirname3(skills[0])))
+      extras: extrasOf(dirname4(dirname4(skills[0])))
     };
   });
 }
@@ -1385,10 +1397,10 @@ function newer(a, b) {
 }
 function updateOf(name, marketplace, entry, catalogs) {
   const dir = join11(claudeDir(), "plugins", "marketplaces", marketplace);
-  if (!catalogs.has(marketplace)) catalogs.set(marketplace, readJson2(join11(dir, ".claude-plugin", "marketplace.json"))?.plugins ?? []);
+  if (!catalogs.has(marketplace)) catalogs.set(marketplace, readJson(join11(dir, ".claude-plugin", "marketplace.json"))?.plugins ?? []);
   const listed = catalogs.get(marketplace).find((p) => p.name === name);
   if (!listed) return void 0;
-  const version = listed.version ?? (typeof listed.source === "string" ? readJson2(join11(dir, listed.source, ".claude-plugin", "plugin.json"))?.version : void 0);
+  const version = listed.version ?? (typeof listed.source === "string" ? readJson(join11(dir, listed.source, ".claude-plugin", "plugin.json"))?.version : void 0);
   if (version && entry.version) return newer(version, entry.version) ? version : void 0;
   const sha = typeof listed.source === "object" ? listed.source?.sha : void 0;
   return sha && entry.gitCommitSha && sha !== entry.gitCommitSha ? "newer" : void 0;
@@ -1398,12 +1410,12 @@ function pluginRoot(id, entry) {
   return candidates.find((c) => existsSync10(join11(c, "skills"))) ?? candidates.find((c) => existsSync10(c)) ?? candidates[0];
 }
 function describe(root) {
-  const manifest = readJson2(join11(root, ".claude-plugin", "plugin.json")) ?? {};
+  const manifest = readJson(join11(root, ".claude-plugin", "plugin.json")) ?? {};
   return { description: manifest.description ?? "", version: manifest.version, skills: skillDirsIn(join11(root, "skills")), extras: extrasOf(root) };
 }
 function installedPlugins() {
   const plugins = join11(claudeDir(), "plugins");
-  const installed = readJson2(join11(plugins, "installed_plugins.json"))?.plugins ?? {};
+  const installed = installedPluginsJson();
   const catalogs = /* @__PURE__ */ new Map();
   const fromMarketplaces = Object.entries(installed).flatMap(
     ([id, entries]) => entries.map((entry) => {
@@ -1435,18 +1447,18 @@ function installedPlugins() {
   const syncedDir = join11(plugins, "synced");
   const dirs = (p) => existsSync10(p) ? readdirSync5(p, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).map((d) => join11(p, d.name)) : [];
   const fromSynced = dirs(syncedDir).flatMap(dirs).map((root) => {
-    const id = `${readJson2(join11(root, ".claude-plugin", "plugin.json"))?.name ?? basename4(root)}@synced`;
+    const id = `${readJson(join11(root, ".claude-plugin", "plugin.json"))?.name ?? basename4(root)}@synced`;
     return { id, scope: null, synced: true, agent: "claude-code", on: user[id] !== false, root, ...describe(root) };
   });
   return [...fromMarketplaces, ...fromSettings, ...fromSynced];
 }
 function cursorPlugins() {
   const cache = join11(userHome(), ".cursor", "plugins", "cache");
-  const dirs = (p) => existsSync10(p) ? readdirSync5(p).filter((d) => !d.startsWith(".") && statSync3(join11(p, d)).isDirectory()) : [];
+  const dirs = (p) => existsSync10(p) ? readdirSync5(p).filter((d) => !d.startsWith(".") && statSync4(join11(p, d)).isDirectory()) : [];
   return dirs(cache).flatMap(
     (marketplace) => dirs(join11(cache, marketplace)).flatMap((plugin) => {
       const versions = dirs(join11(cache, marketplace, plugin)).map((v) => join11(cache, marketplace, plugin, v));
-      const root = versions.sort((a, b) => statSync3(b).mtimeMs - statSync3(a).mtimeMs)[0];
+      const root = versions.sort((a, b) => statSync4(b).mtimeMs - statSync4(a).mtimeMs)[0];
       if (!root) return [];
       const about = describe(root);
       return [{ id: `${plugin}@${marketplace}`, scope: null, synced: false, agent: "cursor", on: null, root, ...about, version: about.version ?? basename4(root) }];
@@ -1485,11 +1497,10 @@ function claude(args, cwd, bin = claudeBinary()) {
   }
 }
 function setPluginIn(file, id, on) {
-  const settings = existsSync10(file) ? readJson2(file) : {};
+  const settings = existsSync10(file) ? readJson(file) : {};
   if (!settings) return { ok: false, reason: `can't read ${file}` };
   const enabled = settings.enabledPlugins ?? {};
-  mkdirSync7(dirname3(file), { recursive: true });
-  writeFileSync7(file, JSON.stringify({ ...settings, enabledPlugins: { ...enabled, [id]: on } }, null, 2) + "\n");
+  writeState(file, { ...settings, enabledPlugins: { ...enabled, [id]: on } });
   return { ok: true };
 }
 function ignoreLocalSettings(root) {
@@ -1512,9 +1523,9 @@ function ignoreLocalSettings(root) {
   }
   try {
     const exclude = resolve6(root, git2("rev-parse", "--git-path", "info/exclude"));
-    const before = existsSync10(exclude) ? readFileSync8(exclude, "utf-8") : "";
-    mkdirSync7(dirname3(exclude), { recursive: true });
-    writeFileSync7(exclude, `${before}${before && !before.endsWith("\n") ? "\n" : ""}/${git2("rev-parse", "--show-prefix")}${file}
+    const before = existsSync10(exclude) ? readFileSync5(exclude, "utf-8") : "";
+    mkdirSync6(dirname4(exclude), { recursive: true });
+    writeFileSync4(exclude, `${before}${before && !before.endsWith("\n") ? "\n" : ""}/${git2("rev-parse", "--show-prefix")}${file}
 `);
     return ", which git now ignores via .git/info/exclude";
   } catch {
@@ -1582,32 +1593,38 @@ function removePlugin(plugin, how) {
   if (plugin.scope && plugin.scope !== "user" && !plugin.projectPath) {
     return { ok: false, message: `${plugin.id}: installed for one project; run \`claude plugin ${how === "delete" ? "uninstall" : "disable"} ${plugin.id} --scope ${plugin.scope}\` there` };
   }
-  if (!plugin.synced && !claudeBinary()) {
+  const viaSettings = plugin.synced || !claudeBinary() && how === "off" && !plugin.projectPath;
+  if (!viaSettings && !claudeBinary()) {
     return { ok: false, message: `${plugin.id}: nothing changed; Claude Code's CLI didn't run (tried \`claude\` on your PATH and ~/.local/bin/claude)` };
   }
-  const imported = plugin.skills.filter((dir) => latestVersion(basename4(dir)) === null).map((dir) => importSkill(dir).name);
+  const wasOn = enabledPlugins(plugin.projectPath)[plugin.id] === true;
+  const yours = new Set(machineSkills().filter((m) => m.movable).map((m) => m.name));
+  const imported = plugin.skills.filter((dir) => !yours.has(basename4(dir)) && latestVersion(basename4(dir)) === null).map((dir) => importSkill(dir).name);
   const scope = plugin.scope ? ["--scope", plugin.scope] : [];
-  const r = plugin.synced ? (
+  const r = viaSettings ? (
     // Synced plugins aren't installed, so `claude plugin` can't touch them: their switch is enabledPlugins.
     setPluginIn(join11(claudeDir(), "settings.json"), plugin.id, false)
-  ) : claude(["plugin", how === "delete" ? "uninstall" : "disable", plugin.id, ...scope], plugin.projectPath);
+  ) : (
+    // --keep-data, as uninstallPlugin: its saved data stays, so a restore brings it back as it was.
+    claude(["plugin", how === "delete" ? "uninstall" : "disable", plugin.id, ...how === "delete" ? ["--keep-data"] : [], ...scope], plugin.projectPath)
+  );
   const saved = imported.length ? `; ${imported.join(", ")} copied into Your skills` : "";
   if (!r.ok) return { ok: false, message: `${plugin.id}: ${r.reason}${saved}` };
-  if (how === "delete" && !plugin.synced) recordRemovedPlugin(plugin.id, plugin.scope ?? "user", plugin.projectPath, true);
+  if (how === "delete" && !plugin.synced) recordRemovedPlugin(plugin.id, plugin.scope ?? "user", plugin.projectPath, wasOn);
   return { ok: true, message: `${plugin.id} ${how === "delete" && !plugin.synced ? "removed" : "turned off"}${saved}` };
 }
 function recordRemovedPlugin(id, scope, projectPath, on = true) {
-  const list2 = readJson2(removedFile()) ?? [];
-  mkdirSync7(skilllibHome(), { recursive: true });
-  writeFileSync7(removedFile(), JSON.stringify([...list2, { id, scope, ...projectPath ? { projectPath } : {}, on, at: (/* @__PURE__ */ new Date()).toISOString() }], null, 2) + "\n");
+  const list2 = readState(removedFile()) ?? [];
+  mkdirSync6(skilllibHome(), { recursive: true });
+  writeState(removedFile(), [...list2, { id, scope, ...projectPath ? { projectPath } : {}, on, at: (/* @__PURE__ */ new Date()).toISOString() }]);
 }
 function pluginBackups() {
-  return (readJson2(removedFile()) ?? []).map((r) => ({
+  return (readState(removedFile()) ?? []).map((r) => ({
     name: r.id,
     kind: "plugin",
     // Project and local installs go back into their project.
     path: r.projectPath ? `${r.scope}:${r.projectPath}` : r.scope,
-    movedAt: r.at.slice(0, 16).replace("T", " "),
+    movedAt: localStamp(Date.parse(r.at)),
     from: r.id
   }));
 }
@@ -1616,11 +1633,11 @@ function restorePlugin(backup) {
   const projectPath = rest.join(":") || void 0;
   const r = claude(["plugin", "install", backup.from, "--scope", scope], projectPath);
   if (!r.ok) return r;
-  const records = readJson2(removedFile()) ?? [];
+  const records = readState(removedFile()) ?? [];
   const same = (x) => x.id === backup.from && (x.projectPath ?? void 0) === projectPath && x.scope === scope;
   const wasOff = records.filter(same).pop()?.on === false;
   const off = wasOff ? claude(["plugin", "disable", backup.from, "--scope", scope], projectPath) : null;
-  writeFileSync7(removedFile(), JSON.stringify(records.filter((x) => !same(x)), null, 2) + "\n");
+  writeState(removedFile(), records.filter((x) => !same(x)));
   const where = `Claude Code plugins (${scope}${projectPath ? ` in ${basename4(projectPath)}` : ""}${wasOff ? off?.ok ? ", off as it was" : ", but it's on: turn it off from Plugins" : ""})`;
   return { ok: true, to: where };
 }
@@ -1629,14 +1646,14 @@ function cursorPluginSkills(plugins = cursorPlugins()) {
 }
 
 // src/tidy.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, readdirSync as readdirSync6, unlinkSync as unlinkSync3 } from "fs";
-import { basename as basename5, dirname as dirname4, join as join12, sep as sep4 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync6, unlinkSync as unlinkSync3 } from "fs";
+import { basename as basename5, dirname as dirname5, join as join12, sep as sep5 } from "path";
 function entriesOf(dirs, name) {
   return dirs.flatMap((dir) => {
     const path = join12(dir, name);
     if (!entryExists(path)) return [];
     const link2 = isLink(path);
-    const real = realpathOrNull2(path);
+    const real = realpathOrNull(path);
     const skill = existsSync11(join12(path, "SKILL.md"));
     if (!link2 && !skill) return [];
     return [{ dir, path, link: link2, real, hash: null }];
@@ -1661,7 +1678,7 @@ function globalTidyDirs() {
 function runsFrom(id, dirsWithCopy, readsOf) {
   const reads = readsOf(id).filter((d) => dirsWithCopy.includes(d));
   if (id === "codex") return reads;
-  const pick = (d) => CURSOR_PICKS.indexOf(basename5(dirname4(d)));
+  const pick = (d) => CURSOR_PICKS.indexOf(basename5(dirname5(d)));
   return id === "cursor" ? [...reads].sort((a, b) => pick(a) - pick(b)).slice(0, 1) : reads.slice(0, 1);
 }
 function conflictOf(name, root, reals, enabled, readsOf) {
@@ -1677,17 +1694,17 @@ function planProjectTidy(root, { keep = {}, enabled = enabledHarnesses() } = {})
   const { skills } = readManifest(root);
   const abs = (dir) => join12(root, dir);
   const rel = (dir) => relativeTo(root, dir);
-  const readsOf = (id) => HARNESSES.find((h) => h.id === id).projectDirs.map(abs);
+  const readsOf = (id) => harness(id).projectDirs.map(abs);
   let git2;
   const skillsLock = projectSkillsLock(root);
   for (const name of namesIn(PROJECT_TIDY_DIRS.map(abs))) {
     const entries = entriesOf(PROJECT_TIDY_DIRS.map(abs), name);
-    const external = entries.find((e) => e.link && e.real && !(e.real + sep4).startsWith(realpathOrNull2(root) + sep4));
+    const external = entries.find((e) => e.link && e.real && !(e.real + sep5).startsWith(realpathOrNull(root) + sep5));
     if (external) {
       report.skipped.push({ name, reason: `${rel(external.path)} links outside the repo` });
       continue;
     }
-    const reals = entries.filter((e) => !e.link);
+    const reals = entries.filter((e, i, all) => !e.link && all.findIndex((o) => !o.link && realpathOrNull(o.path) === realpathOrNull(e.path)) === i);
     if (reals.length === 0) continue;
     hashReals(reals);
     const dep = skills[name];
@@ -1713,10 +1730,11 @@ function planProjectTidy(root, { keep = {}, enabled = enabledHarnesses() } = {})
     const wanted = new Set([...installDirs(enabled, rel(primary.dir)), ...dep?.links ?? []].map(abs));
     const steps = [];
     for (const e of entries) {
-      if (e === primary) continue;
+      if (e === primary || !e.link && e.real === primary.real) continue;
       const needed = wanted.has(e.dir);
       if (e.link) {
         if (e.real === primary.real) {
+          if (!needed && !dep && ["committed", "changed"].includes((git2 ??= gitInfo(root))?.of(rel(e.path)) ?? "")) continue;
           if (!needed) steps.push({ kind: "unlink", path: e.path });
         } else steps.push(needed ? { kind: "link", path: e.path, target: primary.path } : { kind: "unlink", path: e.path });
       } else {
@@ -1729,7 +1747,7 @@ function planProjectTidy(root, { keep = {}, enabled = enabledHarnesses() } = {})
   return report;
 }
 function globalReadsOf(id) {
-  return HARNESSES.find((h) => h.id === id).globalDirs().map(globalDirAs);
+  return harness(id).globalDirs().map(globalDirAs);
 }
 function isSkillsDirPlugin(path) {
   return existsSync11(join12(path, ".claude-plugin", "plugin.json"));
@@ -1744,7 +1762,7 @@ function planGlobalTidy({ keep = {}, enabled = enabledHarnesses() } = {}) {
       report.skipped.push({ name, reason: "a Claude Code plugin kept in a skills folder" });
       continue;
     }
-    const reals = entries.filter((e, i, all) => !e.link && all.findIndex((o) => !o.link && realpathOrNull2(o.path) === realpathOrNull2(e.path)) === i);
+    const reals = entries.filter((e, i, all) => !e.link && all.findIndex((o) => !o.link && realpathOrNull(o.path) === realpathOrNull(e.path)) === i);
     if (reals.length < 2) continue;
     hashReals(reals);
     const kept = reals.find((r) => r.dir === keep[name]);
@@ -1770,11 +1788,12 @@ function applyTidy(plan, { git: git2 = "keep", info: info2 } = {}) {
   const applied = [];
   for (const step of plan.steps) {
     if (held.includes(step) || !entryExists(step.path) || "target" in step && !entryExists(step.target)) continue;
+    if ("target" in step && realpathOrNull(step.path) === realpathOrNull(step.target)) continue;
     if (step.kind === "link" || step.kind === "unlink") {
       if (isLink(step.path)) unlinkSync3(step.path);
     } else stash(step.path, "tidy-backup");
     if (step.kind === "link" || step.kind === "replace") {
-      mkdirSync8(dirname4(step.path), { recursive: true });
+      mkdirSync7(dirname5(step.path), { recursive: true });
       linkDir(step.target, step.path);
     }
     applied.push(step);
@@ -1782,7 +1801,7 @@ function applyTidy(plan, { git: git2 = "keep", info: info2 } = {}) {
   if (plan.root) {
     const manifest = readManifest(plan.root);
     const dep = manifest.skills[plan.name];
-    const added = applied.filter((s) => s.kind === "link" || s.kind === "replace").map((s) => relativeTo(plan.root, dirname4(s.path)));
+    const added = applied.filter((s) => s.kind === "link" || s.kind === "replace").map((s) => relativeTo(plan.root, dirname5(s.path)));
     if (dep && added.length) {
       manifest.skills[plan.name] = { ...dep, links: [.../* @__PURE__ */ new Set([...dep.links ?? [], ...added])] };
       writeManifest(plan.root, manifest);
@@ -1826,42 +1845,135 @@ function orThrow(r) {
   if (!r.ok) throw new Error(r.message);
   return r.message;
 }
+function intoLibrary(path, force = false) {
+  const r = importSkill(path, { force });
+  if (r.status === "exists") throw new Error(`${r.name}: your library has a different ${r.name}; update or delete it first`);
+  return r.name;
+}
+function track(root, name) {
+  const c = addSkill(root, name);
+  if (c.action === "skipped") throw new Error(`${name}: ${c.reason}`);
+  return c;
+}
+var installedIn = (p) => p.projectPath ? ` in ${basename6(p.projectPath)}` : "";
+var installId = (p) => `${p.projectPath ? `${p.projectPath}:` : ""}${p.id}`;
+function summarize(where, verb, changes) {
+  const done = changes.filter((c) => c.action !== "skipped");
+  const skipped = changes.filter((c) => c.action === "skipped").map((c) => `${c.name}: ${c.reason}`);
+  if (!done.length) throw new Error(`${where}: nothing ${verb}${skipped.length ? `; ${skipped.join("; ")}` : ""}`);
+  return `${where}: ${verb} ${plural(done.length, "skill")}${skipped.length ? `; skipped ${skipped.join("; ")}` : ""}`;
+}
 var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
-var agentNames = (ids) => ids.map((id) => HARNESSES.find((h) => h.id === id).name).join(", ");
+var rows = (root, skills) => skills.map((skill) => ({ root, skill }));
+var agentNames = (ids) => ids.map((id) => harness(id).name).join(", ");
 function conflictIssue(c) {
   const where = c.root ? basename6(c.root) : "your global folders";
   const winners = c.managed ? c.copies.filter((x) => x.dir === c.managed) : c.copies;
+  const planFor = (dir) => (c.root ? planProjectTidy(c.root, { keep: { [c.name]: dir } }) : planGlobalTidy({ keep: { [c.name]: dir } })).plans.find((p) => p.name === c.name);
+  const keep = (dir, git2) => () => {
+    const plan = planFor(dir);
+    const r = plan ? applyTidy(plan, { git: git2 }) : null;
+    if (!r?.applied.length) throw new Error(`${c.name}: nothing changed${r?.held.length ? " (git would see every change)" : ""}`);
+    return `${c.name}: kept the ${copyLabel(c, dir)} copy${r.held.length ? `; held back ${plural(r.held.length, "change")} git would see` : ""}`;
+  };
   return {
     id: `conflict:${c.root ?? "global"}:${c.name}`,
     severity: "problem",
     title: `${c.name} in ${where}: the copies differ`,
-    detail: `Your agents run different versions: ${c.copies.map((x) => `${copyLabel(c, x.dir)}${x.runs.length ? ` (${agentNames(x.runs)})` : ""}`).join(" vs ")}. Keep one; the others become links to it and are restorable from Health.`,
-    choices: winners.map((x) => ({
-      label: `Keep the ${copyLabel(c, x.dir)} copy`,
-      hint: x.dir === c.managed ? "skilllib's version" : "the others become links to it",
-      run: () => {
-        const keep = { [c.name]: x.dir };
-        const plan = (c.root ? planProjectTidy(c.root, { keep }) : planGlobalTidy({ keep })).plans.find((p) => p.name === c.name);
-        if (plan) applyTidy(plan, { git: "go" });
-        return `${c.name}: kept the ${copyLabel(c, x.dir)} copy`;
-      }
-    }))
+    detail: `Your agents run different versions: ${c.copies.map((x) => `${copyLabel(c, x.dir)}${x.runs.length ? ` (${agentNames(x.runs)})` : ""}`).join(" vs ")}. Keep one; the others become links to it and are restorable with skilllib restore (Settings \u203A Backups in the app).`,
+    at: rows(c.root, [c.name]),
+    choices: winners.flatMap((x) => {
+      const plan = planFor(x.dir);
+      const visible2 = plan ? gitVisibleSteps(plan).map((s) => describeStep(s, c.root)) : [];
+      const label = `Keep the ${copyLabel(c, x.dir)} copy`;
+      if (!visible2.length) return [{ label, hint: x.dir === c.managed ? "skilllib's version" : "the others become links to it", run: keep(x.dir, "go") }];
+      return [
+        { label: `${label}, but keep git as it is`, hint: `skips what git would see: ${visible2.join(", ")}`, run: keep(x.dir, "keep") },
+        { label: `${label}, and change what git tracks`, hint: `git will see: ${visible2.join(", ")}`, run: keep(x.dir, "go") }
+      ];
+    })
   };
 }
 function applyAll(plans, git2) {
   const results = plans.map((p) => applyTidy(p, { git: git2 }));
   return { skills: results.filter((r) => r.applied.length).length, held: results.reduce((n, r) => n + r.held.length, 0) };
 }
-function findIssues(projects2, machine, libraryNames, statusOf = projectStatus, loadedIn = (root) => skillsLoadedIn(root, machine), nestedOf = nestedSkills) {
-  const issues = [];
+function brokenLinksIn(root) {
+  const where = basename6(root);
+  const tidied = ALL_PROJECT_DIRS.filter((d) => d !== GROK_SKILLS_DIR);
+  const hasCopy = (name) => tidied.some((d) => !isLink(join13(root, d, name)) && existsSync12(join13(root, d, name, "SKILL.md")));
+  let git2;
+  return ALL_PROJECT_DIRS.flatMap((dir) => {
+    const folder = join13(root, dir);
+    if (!existsSync12(folder)) return [];
+    return readdirSync7(folder).flatMap((name) => {
+      const path = join13(folder, name);
+      if (!isLink(path) || existsSync12(path) || dir !== GROK_SKILLS_DIR && hasCopy(name)) return [];
+      const remove2 = {
+        label: "Remove the link",
+        run: () => {
+          unlinkSync4(path);
+          return `Removed the broken link ${dir}/${name} in ${where}`;
+        }
+      };
+      git2 ??= gitInfo(root);
+      const tracked = ["committed", "changed"].includes(git2?.of(relativeTo(root, path)) ?? "");
+      return [
+        {
+          id: `broken:${root}:${dir}/${name}`,
+          severity: "problem",
+          title: `${name}: broken link in ${where}/${dir}`,
+          detail: `It points at a folder that no longer exists, so it loads nothing.${tracked ? " Git tracks the link, so removing it shows in git status." : ""}`,
+          at: rows(root, [name]),
+          ...tracked ? { choices: [remove2] } : { fix: remove2 }
+        }
+      ];
+    });
+  });
+}
+function grokDiffers(projects2, machine, statusOf) {
+  if (!enabledHarnesses().includes("grok")) return [];
+  const issue = (root, name, grokCopy, other) => ({
+    id: `grok-differs:${root ?? "global"}:${name}`,
+    severity: "suggestion",
+    title: `${name}${root ? ` in ${basename6(root)}` : ""}: Grok runs a different copy`,
+    detail: `Grok reads ${grokCopy} first; your other agents run ${other}, and the two differ. skilllib doesn't change Grok's folder: update or remove that copy there to make them match.`,
+    at: rows(root, [name])
+  });
+  const grokGlobal = join13(grokDir(), "skills");
+  const global = skillDirsIn(grokGlobal).filter((path) => !isLink(path)).flatMap((path) => {
+    const name = basename6(path);
+    const other = machine.find((m) => m.name === name && m.movable && !m.broken && m.harnesses.some((id) => id !== "grok") && realPath(dirname6(m.path)) !== realPath(grokGlobal));
+    return other && treeHash(other.path) !== treeHash(path) ? [issue(null, name, tildify(path), tildify(other.path))] : [];
+  });
+  const repos = projects2.flatMap(
+    (root) => skillDirsIn(join13(root, GROK_SKILLS_DIR)).filter((path) => !isLink(path)).flatMap((path) => {
+      const name = basename6(path);
+      const other = statusOf(root).find((s) => s.name === name && !s.path.startsWith(join13(root, GROK_SKILLS_DIR)));
+      return other && treeHash(other.path) !== treeHash(path) ? [issue(root, name, `${GROK_SKILLS_DIR}/${name}`, relativeTo(root, other.path))] : [];
+    })
+  );
+  return [...global, ...repos];
+}
+function findIssues(roots, machine, libraryNames, statusOf = projectStatus, loadedIn = (root) => skillsLoadedIn(root, machine), nestedOf = nestedSkills) {
+  const { readable: projects2, unreadable } = readableRoots(roots);
+  const issues = unreadable.map(({ root, reason }) => ({
+    id: `manifest:${root}`,
+    severity: "problem",
+    title: `${basename6(root)}: skilllib.json can't be read`,
+    detail: `${reason}. Until it's fixed, skilllib leaves ${basename6(root)} out.`,
+    at: []
+  }));
   const statuses = new Map(projects2.map((root) => [root, statusOf(root)]));
+  issues.push(...grokDiffers(projects2, machine, (root) => statuses.get(root)));
   const nested = new Map(projects2.map((root) => [root, nestedOf(root)]));
   for (const skill of machine.filter((m) => m.broken)) {
     issues.push({
-      id: `broken:${skill.name}`,
+      id: `broken:${skill.path}`,
       severity: "problem",
-      title: `${skill.name}: broken link in ${tildify(dirname5(skill.path))}`,
+      title: `${skill.name}: broken link in ${tildify(dirname6(skill.path))}`,
       detail: "It points at a folder that no longer exists, so it loads nothing.",
+      at: rows(null, [skill.name]),
       fix: {
         label: "Remove the link",
         run: () => {
@@ -1884,7 +1996,8 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
       id: `dup:${name}`,
       severity: "problem",
       title: `${name}: loaded twice in ${harnesses.join(" and ")}`,
-      detail: `${copies.map((c) => `${c.kind} (${c.origin})`).join(" and ")}. Your skill wins: turn the ${vendor.map((c) => c.kind).join(" and ")} copy off at its source${vendor.some((c) => c.kind === "claude.ai") ? " (claude.ai \u2192 Settings \u2192 Skills)" : ""}${vendor.some((c) => c.kind === "system") ? ` (whoever manages ${vendor.find((c) => c.kind === "system").origin})` : ""}.`
+      detail: `${copies.map((c) => `${c.kind} (${c.origin})`).join(" and ")}. Your skill wins: turn the ${vendor.map((c) => c.kind).join(" and ")} copy off at its source${vendor.some((c) => c.kind === "claude.ai") ? " (claude.ai \u2192 Settings \u2192 Skills)" : ""}${vendor.some((c) => c.kind === "system") ? ` (whoever manages ${vendor.find((c) => c.kind === "system").origin})` : ""}.`,
+      at: rows(null, [name])
     });
   }
   const loadedHere = new Map(projects2.map((root) => [root, loadedIn(root)]));
@@ -1929,7 +2042,7 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
     const pluginName = plugin.id.split("@")[0];
     const remove2 = {
       label: `Remove the plugin ${plugin.id}`,
-      hint: plugin.extras.length ? `also removes its ${plugin.extras.join(", ")}` : "restorable from Health",
+      hint: plugin.extras.length ? `also removes its ${plugin.extras.join(", ")}` : "restorable with skilllib restore",
       run: () => orThrow(removePlugin(plugin, "delete"))
     };
     const off = { label: `Turn the plugin ${plugin.id} off`, hint: "stays installed", run: () => orThrow(removePlugin(plugin, "off")) };
@@ -1950,9 +2063,25 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
         plugin.synced ? "It's synced from claude.ai, so it can only be turned off here." : "",
         inRepos.length ? `Or keep it and turn it off only in ${inRepos.map(([root]) => basename6(root)).join(", ")}.` : ""
       ].filter(Boolean).join(" "),
-      choices: [...plugin.synced ? [off] : plugin.extras.length ? [off, remove2] : [remove2, off], ...inRepos.flatMap(([root, d]) => repoChoices(plugin, root, d))]
+      choices: [...plugin.synced ? [off] : plugin.extras.length ? [off, remove2] : [remove2, off], ...inRepos.flatMap(([root, d]) => repoChoices(plugin, root, d))],
+      // Global's rows (yours and the plugin's), and the repos where both load.
+      at: [...rows(null, dupes), ...[...inRepos, ...cursorRepos].flatMap(([root, d]) => rows(root, d))],
+      plugin: plugin.id
     });
   }
+  if (enabledHarnesses().includes("claude-code"))
+    for (const p of installedPlugins().filter((x) => x.update && !x.synced && !x.settingsOnly)) {
+      const update2 = { label: p.update === "newer" ? "Update it" : `Update to ${p.update}`, hint: `runs claude plugin update ${p.id}`, run: () => orThrow(updatePlugin(p)) };
+      issues.push({
+        id: `plugin-update:${installId(p)}`,
+        severity: "suggestion",
+        title: `${p.id}${installedIn(p)}: ${p.update === "newer" ? "its marketplace has a newer commit" : `update available (${p.version ?? "?"} \u2192 ${p.update})`}`,
+        detail: "Updates can bring new commands, hooks or MCP servers. If the marketplace asks to run a command, skilllib stops and you update it yourself. Claude Code uses the new version after a restart.",
+        choices: [update2],
+        plugin: p.id,
+        pluginAt: p.projectPath ?? null
+      });
+    }
   const machinePluginSkills = new Set(machinePlugins.flatMap((p) => p.skills));
   for (const root of projects2) {
     const where = basename6(root);
@@ -1967,7 +2096,9 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
         severity: "problem",
         title: `${dupes.join(", ")}: also in the Claude Code plugin ${plugin.id}, on in ${where}`,
         detail: `${where}'s Claude Code settings turn the plugin on, so Claude Code loads both there (the plugin's as /${plugin.id.split("@")[0]}:${dupes[0]}). Your skill wins.`,
-        choices: repoChoices(plugin, root, inRepo)
+        choices: repoChoices(plugin, root, inRepo),
+        at: rows(root, dupes),
+        plugin: plugin.id
       });
     }
   }
@@ -1979,7 +2110,9 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
         id: `cursor-plugin:${plugin}`,
         severity: "suggestion",
         title: `${names.join(", ")}: also in the Cursor plugin ${plugin}`,
-        detail: `Cursor lists both copies when that plugin is on. Your skill wins: turn the plugin off in Cursor (Settings \u2192 Plugins).`
+        detail: `Cursor lists both copies when that plugin is on. Your skill wins: turn the plugin off in Cursor (Settings \u2192 Plugins).`,
+        at: [...rows(null, names.filter((n) => globalYours.has(n))), ...projects2.flatMap((root) => rows(root, names.filter((n) => statuses.get(root).some((s) => s.name === n))))],
+        plugin
       });
     }
   }
@@ -1989,7 +2122,8 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
       id: "tidy:global",
       severity: "suggestion",
       title: `${plural(global.plans.length, "global skill")} with duplicate copies`,
-      detail: `${global.plans.map((p) => p.name).join(", ")}: each keeps one copy (in ~/.agents/skills when there's one) and the others become links. Restorable from Health.`,
+      detail: `${global.plans.map((p) => p.name).join(", ")}: each keeps one copy (in ~/.agents/skills when there's one) and the others become links. Restorable with skilllib restore.`,
+      at: rows(null, global.plans.map((p) => p.name)),
       fix: {
         label: "Keep one copy of each",
         run: () => {
@@ -2002,13 +2136,14 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
   }
   issues.push(...global.conflicts.map(conflictIssue));
   const kept = keptGlobal();
-  const unreviewed = [...new Set(loaded.filter((m) => m.movable && !kept.has(m.name)).map((m) => m.name))];
+  const unreviewed = [...new Set(loaded.filter((m) => m.movable && m.harnesses.length && !kept.has(m.name)).map((m) => m.name))];
   if (unreviewed.length) {
     issues.push({
       id: "review:global",
       severity: "suggestion",
       title: `${plural(unreviewed.length, "global skill")} of yours ${unreviewed.length === 1 ? "loads" : "load"} in every repo`,
-      detail: `${unreviewed.join(", ")}. Move each to the repos that need it (skilllib global move <name> --to <repo>...), or mark the ones you want everywhere as global on purpose (skilllib global keep <name>).`
+      detail: `${unreviewed.join(", ")}. Move each to the repos that need it (skilllib global move <name> --to <repo>...), or mark the ones you want everywhere as global on purpose (skilllib global keep <name>).`,
+      at: rows(null, unreviewed)
     });
   }
   const enabled = enabledHarnesses();
@@ -2035,6 +2170,7 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
       severity: "suggestion",
       title: `${plural(skills.length, "global skill")}${onPurpose ? " you keep global" : ""} not usable by ${agentNames(missing)}`,
       detail: `${skills.map((m) => `${m.name} (only ${agentNames(m.harnesses)})`).join(", ")}. ${onPurpose ? "A link in each agent's global folder makes the one real copy reach every agent you use." : `Link ${skills.length === 1 ? "it" : "them"} for every agent, or move ${skills.length === 1 ? "it" : "them"} to the repos that need ${skills.length === 1 ? "it" : "them"} (skilllib global move), which works for every agent too.`}`,
+      at: rows(null, [...new Set(skills.map((m) => m.name))]),
       ...onPurpose ? { fix: link2 } : { choices: [link2] }
     });
   }
@@ -2044,22 +2180,30 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
   for (const root of projects2) {
     const where = basename6(root);
     const status2 = statuses.get(root);
-    const restorable = status2.filter((s) => s.state === "folder missing" && s.latest !== null);
+    issues.push(...brokenLinksIn(root));
+    const pins = readManifest(root).skills;
+    const missing = status2.filter((s) => s.state === "folder missing" && s.latest !== null);
+    const restorable = missing.filter((s) => versionForHash(s.name, pins[s.name]?.hash ?? "") !== null);
+    for (const s of missing.filter((m) => !restorable.includes(m)))
+      issues.push({
+        id: `pin:${root}:${s.name}`,
+        severity: "problem",
+        title: `${s.name}: the version ${where}'s skilllib.json pins isn't in your library`,
+        detail: `The folder is missing, and no version in Your skills has the content it pins (pinned from another library?). Install your newest v${s.latest}; ${where}'s skilllib.json then pins it.`,
+        at: rows(root, [s.name]),
+        // It changes what the shared skilllib.json pins: a choice, never run by `doctor --fix`.
+        choices: [{ label: `Install your newest (v${s.latest})`, hint: `${where}'s skilllib.json pins it`, run: () => `${s.name}: installed v${track(root, s.name).to}` }]
+      });
     if (restorable.length > 0) {
       issues.push({
         id: `sync:${root}`,
         severity: "problem",
         title: `${where}: ${plural(restorable.length, "skill")} in skilllib.json not installed`,
         detail: `${restorable.map((s) => s.name).join(", ")}: the folder is missing`,
+        at: rows(root, restorable.map((s) => s.name)),
         fix: {
           label: "Sync the project",
-          run: () => {
-            const changes = syncProject(root);
-            const done = changes.filter((c) => c.action !== "skipped");
-            const skipped = changes.filter((c) => c.action === "skipped").map((c) => `${c.name}: ${c.reason}`);
-            if (!done.length) throw new Error(`${where}: nothing restored${skipped.length ? `; ${skipped.join("; ")}` : ""}`);
-            return `${where}: restored ${plural(done.length, "skill")}${skipped.length ? `; skipped ${skipped.join("; ")}` : ""}`;
-          }
+          run: () => summarize(where, "restored", syncProject(root))
         }
       });
     }
@@ -2069,6 +2213,7 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
         severity: "problem",
         title: `${s.name}: pinned in ${where}'s skilllib.json, but not in your library`,
         detail: `Its folder is missing, and your library (${tildify(libraryDir())}) has no copy to restore: import it, or set SKILLLIB_HOME to the library that has it.`,
+        at: rows(root, [s.name]),
         // Editing skilllib.json is the team's call: a choice, never run by `doctor --fix`.
         choices: [
           {
@@ -2089,15 +2234,10 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
         severity: "suggestion",
         title: `${where}: ${plural(behind.length, "skill")} out of date`,
         detail: behind.map((s) => `${s.name} (v${s.version} \u2192 v${s.latest})`).join(", "),
+        at: rows(root, behind.map((s) => s.name)),
         fix: {
           label: "Update to the newest versions",
-          run: () => {
-            const changes = updateProject(root, behind.map((s) => s.name));
-            const done = changes.filter((c) => c.action !== "skipped");
-            const skipped = changes.filter((c) => c.action === "skipped").map((c) => `${c.name}: ${c.reason}`);
-            if (!done.length) throw new Error(`${where}: nothing updated${skipped.length ? `; ${skipped.join("; ")}` : ""}`);
-            return `${where}: updated ${plural(done.length, "skill")}${skipped.length ? `; skipped ${skipped.join("; ")}` : ""}`;
-          }
+          run: () => summarize(where, "updated", updateProject(root, behind.map((s) => s.name)))
         }
       });
     const tidy2 = planProjectTidy(root);
@@ -2113,40 +2253,45 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
         id: `tidy:${root}`,
         severity: "suggestion",
         title: `${where}: ${plural(tidy2.plans.length, "skill")} with extra copies or links`,
-        detail: tidy2.plans.map((p) => `${p.name}: ${p.steps.map((s) => describeStep(s, root)).join(", ")}`).join(" \xB7 ") + (visible2.length ? `. Git would see ${plural(visible2.length, "of these change")}: ${visible2.join(", ")}.` : ". Replaced copies are restorable from Health."),
+        detail: tidy2.plans.map((p) => `${p.name}: ${p.steps.map((s) => describeStep(s, root)).join(", ")}`).join(" \xB7 ") + (visible2.length ? `. Git would see ${plural(visible2.length, "of these change")}: ${visible2.join(", ")}.` : ". Replaced copies are restorable with skilllib restore."),
+        at: rows(root, tidy2.plans.map((p) => p.name)),
         ...visible2.length ? {
           choices: [
-            { label: "Tidy, but keep git as it is", hint: `skips the ${plural(visible2.length, "change")} git would see`, run: run("keep") },
+            // "Keep git as it is" only when it leaves something to do.
+            ...visible2.length < tidy2.plans.reduce((n, p) => n + p.steps.length, 0) ? [{ label: "Tidy, but keep git as it is", hint: `skips the ${plural(visible2.length, "change")} git would see`, run: run("keep") }] : [],
             { label: "Tidy everything", hint: `${plural(visible2.length, "change")} will show in git status`, run: run("go") }
           ]
         } : { fix: { label: "Tidy", run: run("go") } }
       });
     }
     issues.push(...tidy2.conflicts.map(conflictIssue));
-    const blindHere = status2.filter((s) => s.state !== "folder missing" && s.visibility.some((v) => v.paths === 0)).map((s) => ({ s, would: linkEverywhere(root, s.name, s.location, { dryRun: true }) }));
+    const loadsGlobally = (name, id) => globalCopies.some((m) => m.name === name && m.harnesses.includes(id));
+    const blindHere = status2.filter((s) => s.state !== "folder missing" && s.visibility.some((v) => v.paths === 0 && !loadsGlobally(s.name, v.id))).map((s) => ({ s, would: linkEverywhere(root, s.name, s.location, { dryRun: true }) }));
     for (const { s, would } of blindHere.filter(({ would: w }) => !w.created.length && !w.blocked.length && w.uncommitted.length))
       issues.push({
         id: `uncommitted:${root}:${s.name}`,
         severity: "suggestion",
         title: `${s.name} in ${where}: ${agentNames(s.visibility.filter((v) => v.paths === 0).map((v) => v.id))} can't use it until it's committed`,
-        detail: `Git tracks ${would.uncommitted.join(", ")}, but not ${s.location}/${s.name}: a link there would be broken for teammates. Commit it, then link it (\`skilllib link --allow-tracked\`, or from Health).`
+        detail: `Git tracks ${would.uncommitted.join(", ")}, but not ${s.location}/${s.name}: a link there would be broken for teammates. Commit it, then link it (\`skilllib link --allow-tracked\`).`,
+        at: rows(root, [s.name])
       });
     const partial = blindHere.filter(({ would }) => would.created.length || would.blocked.length).map(({ s }) => s);
     if (partial.length) {
-      const missing = [...new Set(partial.flatMap((s) => s.visibility.filter((v) => v.paths === 0).map((v) => v.id)))];
+      const missing2 = [...new Set(partial.flatMap((s) => s.visibility.filter((v) => v.paths === 0).map((v) => v.id)))];
       const tracked = [...new Set(blindHere.flatMap(({ would }) => would.blocked))];
       const run = (allowTracked) => () => {
         if (allowTracked) allowTrackedLinks(root);
         const r = linkAll(root, { allowTracked });
         const notes = `${r.blocked.length ? `; skipped ${r.blocked.join(", ")} (git tracks ${r.blocked.length === 1 ? "it" : "them"})` : ""}${r.uncommitted.length ? `; ${r.uncommitted.join(", ")} not linked into folders git tracks (not committed, so teammates would get broken links)` : ""}`;
         if (!r.linked.length) throw new Error(`${where}: nothing linked${notes}`);
-        return `${where}: linked ${plural(r.linked.length, "skill")} for ${agentNames(missing)}${notes}`;
+        return `${where}: linked ${plural(r.linked.length, "skill")} for ${agentNames(missing2)}${notes}`;
       };
       issues.push({
         id: `usable:${root}`,
         severity: "suggestion",
-        title: `${where}: ${plural(partial.length, "skill")} not usable by ${agentNames(missing)}`,
+        title: `${where}: ${plural(partial.length, "skill")} not usable by ${agentNames(missing2)}`,
         detail: `${partial.map((s) => `${s.name} (not ${agentNames(s.visibility.filter((v) => v.paths === 0).map((v) => v.id))})`).join(", ")}. Adding links makes the one real copy reach every agent you use; nothing is copied or moved.${tracked.length ? ` Git tracks ${tracked.join(", ")}, so links there show in git status.` : ""}`,
+        at: rows(root, partial.map((s) => s.name)),
         ...tracked.length ? {
           choices: [
             // Only when some link goes where git doesn't track: otherwise this one would link nothing.
@@ -2167,12 +2312,13 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
           severity: "suggestion",
           title: `${s.name} in ${where} isn't in your library`,
           detail: "Copy it into the library to reuse it in other projects. The repo's copy stays as it is: it's the team's (committed).",
+          at: rows(root, [s.name]),
           choices: [
             {
               label: "Copy into the library",
               hint: `${where}'s copy stays as it is`,
               run: () => {
-                importSkill(s.path);
+                intoLibrary(s.path);
                 return `${s.name} copied into your library; ${where}'s copy stays as it is`;
               }
             }
@@ -2184,13 +2330,14 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
           severity: "suggestion",
           title: `${s.name} in ${where} isn't in your library`,
           detail: "Import it into the library to reuse it in other projects and keep it backed up. The repo then tracks it in skilllib.json.",
+          at: rows(root, [s.name]),
           choices: [
             {
               label: "Import into the library",
-              hint: `${where} then tracks it`,
+              hint: "copies it into Your skills",
               run: () => {
-                importSkill(s.path);
-                addSkill(root, s.name);
+                intoLibrary(s.path);
+                track(root, s.name);
                 return `${s.name} imported and tracked in ${where}`;
               }
             }
@@ -2202,9 +2349,81 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
           severity: "suggestion",
           title: `${s.name} in ${where} isn't tracked`,
           detail: "It's identical to the library copy; track it (in skilllib.json) so future library changes reach it.",
-          choices: [{ label: "Track it", hint: `adds it to ${where}'s skilllib.json`, run: () => `${addSkill(root, s.name).name} tracked in ${where}` }]
+          at: rows(root, [s.name]),
+          choices: [{ label: "Track it", hint: `adds it to ${where}'s skilllib.json`, run: () => `${track(root, s.name).name} tracked in ${where}` }]
+        });
+      } else if (s.state === "untracked, differs from library" || s.state === "repo skill, differs from library") {
+        const teams = s.state.startsWith("repo skill") || committed(s);
+        issues.push({
+          id: `differs:${root}:${s.name}`,
+          severity: "suggestion",
+          title: `${s.name} in ${where} differs from your library`,
+          detail: teams ? `It's the team's copy (committed, or in the repo's own .agents/skills), and no version in Your skills matches it. Update your library from it if it's the one to keep; ${where}'s copy stays as it is.` : `No version in Your skills matches it. Update your library from it (${where} then tracks it), or replace it with your library's.`,
+          at: rows(root, [s.name]),
+          choices: [
+            {
+              label: "Update your library from it",
+              hint: teams ? `a new version in Your skills; ${where}'s copy stays as it is` : `a new version in Your skills; ${where} then tracks it`,
+              run: () => {
+                intoLibrary(s.path, true);
+                if (teams) return `${s.name}: your library has ${where}'s copy; ${where}'s copy stays as it is`;
+                const c = track(root, s.name);
+                return `${s.name}: your library has ${where}'s copy as v${c.to}; ${where} tracks it`;
+              }
+            },
+            ...teams ? [] : [
+              {
+                label: "Replace it with your library's",
+                hint: "this copy is restorable with skilllib restore",
+                run: () => {
+                  const c = addSkill(root, s.name, { force: true });
+                  if (c.action === "skipped") throw new Error(`${s.name}: ${c.reason}`);
+                  return `${s.name} in ${where} is your library's v${c.to} now; the old copy is restorable with skilllib restore`;
+                }
+              }
+            ]
+          ]
+        });
+      } else if (s.state === "from npx skills") {
+        const teams = committed(s);
+        issues.push({
+          id: `npx:${root}:${s.name}`,
+          severity: "suggestion",
+          title: `${s.name} in ${where} came from npx skills, not your library`,
+          detail: `Installed with \`npx skills add\`${s.source ? ` (${s.source})` : ""}. Import it into your library to reuse it in other projects and keep it backed up${teams ? `; ${where}'s copy stays as it is (committed)` : `; ${where} then tracks it in skilllib.json`}.`,
+          at: rows(root, [s.name]),
+          choices: [
+            {
+              label: "Import it into your library",
+              hint: teams ? `${where}'s copy stays as it is` : `${where} then tracks it`,
+              run: () => {
+                intoLibrary(s.path);
+                if (teams) return `${s.name} copied into your library; ${where}'s copy stays as it is`;
+                track(root, s.name);
+                return `${s.name} imported and tracked in ${where}`;
+              }
+            }
+          ]
         });
       }
+      if (s.state === "not in library")
+        issues.push({
+          id: `not-in-lib:${root}:${s.name}`,
+          severity: "suggestion",
+          title: `${s.name} in ${where} is tracked, but no longer in your library`,
+          detail: `${where}'s skilllib.json pins it, but your library has no copy: if the folder goes, sync can't restore it, and your other repos can't add it. Copy ${where}'s copy back into the library.`,
+          at: rows(root, [s.name]),
+          choices: [
+            {
+              label: "Copy it back into your library",
+              hint: `${where}'s copy stays as it is`,
+              run: () => {
+                intoLibrary(s.path);
+                return `${s.name} copied back into your library`;
+              }
+            }
+          ]
+        });
       if (s.state === "edited locally" || s.state === "edited locally, update available") {
         const newer2 = s.state !== "edited locally";
         const pinned = s.version ? `v${s.version}` : "the library version";
@@ -2213,6 +2432,7 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
           severity: "suggestion",
           title: `${s.name} in ${where} has local edits`,
           detail: `It no longer matches ${pinned} from Your skills${newer2 ? `, and v${s.latest} is out` : ""}. Save the edits as a new version so your other repos can get them, or discard them. Keeping them is fine too: skilllib never overwrites edits.`,
+          at: rows(root, [s.name]),
           choices: [
             {
               label: "Save as a new version in Your skills",
@@ -2226,7 +2446,7 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
             },
             {
               label: "Discard the edits",
-              hint: `back to ${pinned}; the edited copy is restorable from Health`,
+              hint: `back to ${pinned}; the edited copy is restorable with skilllib restore`,
               run: () => {
                 const c = discardEdits(root, s.name);
                 if (c.action === "skipped") throw new Error(`${s.name}: ${c.reason}`);
@@ -2242,13 +2462,14 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
   for (const root of projects2) {
     for (const n of nested.get(root)) {
       const copies = alsoGlobal.get(n.name) ?? [];
-      if (alsoLoadedGlobally(n) && !copies.some((c) => c.root === root)) alsoGlobal.set(n.name, [...copies, { root, managed: false }]);
+      if (alsoLoadedGlobally(n) && !copies.some((c) => c.root === root)) alsoGlobal.set(n.name, [...copies, { root, managed: false, nested: true }]);
     }
   }
   for (const [name, copies] of alsoGlobal) {
     const wheres = copies.map((c) => basename6(c.root)).join(", ");
     const removable = copies.filter((c) => c.managed).map((c) => c.root);
     const repoOwn = copies.filter((c) => !c.managed).map((c) => basename6(c.root));
+    const at = [...copies.flatMap((c) => rows(c.root, [name])), ...rows(null, [name])];
     if (kept.has(name)) {
       const removeWheres = removable.map((r) => basename6(r)).join(", ");
       issues.push({
@@ -2256,13 +2477,15 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
         severity: "suggestion",
         title: `${name}: in ${wheres}, and you keep it global`,
         detail: `The global copy already loads there, so the project copies are extra. Claude Code runs the global one anyway.${repoOwn.length ? ` ${repoOwn.join(", ")} ${repoOwn.length === 1 ? "has its own copy" : "have their own copies"}: remove ${repoOwn.length === 1 ? "it" : "them"} in the repo, or stop keeping ${name} global.` : ""}`,
+        at,
         choices: removable.length ? [
           {
             label: `Remove the copies in ${removeWheres}`,
             hint: "the global copy stays",
             run: () => {
               const removed = removable.filter((root) => removeSkill(root, name).action === "removed").map((r) => basename6(r));
-              return `${name}: removed from ${removed.join(", ") || "no project"}; the global copy stays`;
+              if (!removed.length) throw new Error(`${name}: removed from no project (local edits?)`);
+              return `${name}: removed from ${removed.join(", ")}; the global copy stays`;
             }
           }
         ] : void 0
@@ -2271,18 +2494,23 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
     }
     const movable = machine.find((m) => m.name === name && m.movable);
     issues.push({
+      at,
       id: `twice:${name}`,
       severity: "suggestion",
       title: `${name}: in ${wheres} and also loaded globally`,
-      detail: `${repoOwn.length === copies.length ? `Agents there load both the repo's copy and the global one.` : "The project copies are enough; the global one loads it in every other project too."} ${movable ? "Stop loading it globally, or keep it global on purpose (Global \u2192 Enter)." : `The global copy comes from ${machine.find((m) => m.name === name && !m.movable)?.origin ?? "a vendor"}: turn it off there.`}`,
+      detail: `${repoOwn.length === copies.length ? `Agents there load both the repo's copy and the global one.` : "The project copies are enough; the global one loads it in every other project too."} ${movable ? "Stop loading it globally, or keep it global on purpose (skilllib global keep)." : `The global copy comes from ${machine.find((m) => m.name === name && !m.movable)?.origin ?? "a vendor"}: turn it off there.`}`,
       choices: movable ? [
         {
           label: "Stop loading it globally",
-          hint: "restorable from Health",
+          hint: "restorable with skilllib restore",
           run: () => {
+            const blind = copies.filter((c) => !c.nested).flatMap((c) => visibilityOf(c.root, name).flatMap((v) => v.paths === 0 ? [`${harness(v.id).name} in ${basename6(c.root)}`] : []));
+            if (blind.length) throw new Error(`${name}: ${blind.join(", ")} only see the global copy; link the repo copies first (skilllib link)`);
             if (!libraryNames.has(name)) importSkill(movable.path);
-            const r = unloadGlobal(movable.path, movable.links);
-            if (!r.ok) throw new Error(`${name}: ${r.reason}`);
+            for (const m of machine.filter((x) => x.name === name && x.movable)) {
+              const r = unloadGlobal(m.path, m.links);
+              if (!r.ok) throw new Error(`${name}: ${r.reason}`);
+            }
             return `${name} no longer loads globally`;
           }
         }
@@ -2305,6 +2533,7 @@ function findIssues(projects2, machine, libraryNames, statusOf = projectStatus,
       severity: "suggestion",
       title: agentSkill2 === "missing" ? "Your agents don't know about skilllib" : "The skilllib skill for your agents is out of date",
       detail: "The skilllib skill lets you ask your agents which skills they can use here, where each comes from, and which of your skills a repo should add.",
+      at: rows(null, ["skilllib"]),
       ...agentSkill2 === "missing" ? { choices: [install] } : { fix: install }
     });
   }
@@ -2332,6 +2561,7 @@ function usageIssues(projects2, machine, libraryNames, uses, statusOf = projectS
       severity: "suggestion",
       title: `${where}: ${plural(unused.length, "skill")} unused in ${uses.days} days`,
       detail: `${unused.map((s) => s.name).join(", ")}: no Claude Code session in ${where} used ${unused.length === 1 ? "it" : "them"}. Each one's name and description still takes context in every session there.${unused.length > removable.length ? " The repo's own skills are the team's: remove those in the repo if nobody needs them." : ""}`,
+      at: rows(root, unused.map((s) => s.name)),
       choices: removable.length ? [
         {
           label: `Remove ${removable.length === unused.length ? "them" : `the ${plural(removable.length, "skill")} skilllib installed`} from ${where}`,
@@ -2340,12 +2570,30 @@ function usageIssues(projects2, machine, libraryNames, uses, statusOf = projectS
             const changes = removable.map((s) => removeSkill(root, s.name));
             const removed = changes.filter((c) => c.action === "removed").map((c) => c.name);
             const kept = changes.filter((c) => c.action !== "removed").map((c) => c.name);
-            return `${where}: removed ${removed.join(", ") || "nothing"}${kept.length ? `; kept ${kept.join(", ")} (local edits)` : ""}`;
+            if (!removed.length) throw new Error(`${where}: removed nothing; kept ${kept.join(", ")} (local edits)`);
+            return `${where}: removed ${removed.join(", ")}${kept.length ? `; kept ${kept.join(", ")} (local edits)` : ""}`;
           }
         }
       ] : void 0
     });
   }
+  if (uses.asUsed)
+    for (const p of installedPlugins().filter((x) => x.agent === "claude-code" && x.on && x.skills.length)) {
+      const name = p.id.split("@")[0];
+      if (p.skills.some((path) => uses.asUsed(`${name}:${basename6(path)}`) > 0)) continue;
+      issues.push({
+        id: `plugin-unused:${installId(p)}`,
+        severity: "suggestion",
+        title: `${p.id}${installedIn(p)}: its skills weren't used in ${uses.days} days`,
+        detail: `No Claude Code session used ${p.skills.map((path) => `/${name}:${basename6(path)}`).join(", ")}. Each one's name and description still takes context in every session.${p.extras.length ? ` It also brings ${p.extras.join(", ")}: turning it off pauses those too.` : ""}`,
+        choices: [
+          { label: `Turn the plugin ${p.id} off`, hint: "stays installed", run: () => orThrow(setPluginOn(p, false)) },
+          ...p.synced || p.settingsOnly ? [] : [{ label: `Uninstall the plugin ${p.id}`, hint: "its data stays; restorable with skilllib restore", run: () => orThrow(uninstallPlugin(p)) }]
+        ],
+        plugin: p.id,
+        pluginAt: p.projectPath ?? null
+      });
+    }
   const installed = /* @__PURE__ */ new Set([...projects2.flatMap((root) => statusOf(root).map((s) => s.name)), ...machine.filter((m) => !m.broken).map((m) => m.name)]);
   const idle = [...libraryNames].filter((name) => {
     const first = versionHistory(name)[0];
@@ -2357,13 +2605,16 @@ function usageIssues(projects2, machine, libraryNames, uses, statusOf = projectS
       severity: "suggestion",
       title: `${plural(idle.length, "skill")} in Your skills: in no repo, unused in ${uses.days} days`,
       detail: `${idle.sort().join(", ")}. They load nowhere, so they take no context: add the ones you want to a repo, or delete the ones you've outgrown.`,
+      // Your skills' rows (none loads globally, so none is in Global).
+      at: rows(null, idle),
       choices: [
         {
           label: `Delete ${idle.length === 1 ? "it" : `all ${idle.length}`} from Your skills`,
-          hint: "restorable from Health",
+          hint: "restorable with skilllib restore",
           run: () => {
             const done = idle.map((name) => [name, deleteLibrarySkill(name)]);
             const failed = done.filter(([, r]) => !r.ok).map(([name]) => name);
+            if (failed.length === done.length) throw new Error(`Deleted nothing; kept ${failed.join(", ")}`);
             return `Deleted ${plural(done.length - failed.length, "skill")} from Your skills${failed.length ? `; kept ${failed.join(", ")}` : ""}`;
           }
         }
@@ -2391,7 +2642,7 @@ function globalFrom(kind, origin, path) {
 var SKIP = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "target", "vendor", "coverage"]);
 function topLevel(root) {
   try {
-    return readdirSync7(root, { withFileTypes: true }).filter((d) => !d.name.startsWith(".") && !SKIP.has(d.name)).map((d) => d.isDirectory() ? `${d.name}/` : d.name).sort().slice(0, 60);
+    return readdirSync8(root, { withFileTypes: true }).filter((d) => !d.name.startsWith(".") && !SKIP.has(d.name)).map((d) => d.isDirectory() ? `${d.name}/` : d.name).sort().slice(0, 60);
   } catch {
     return [];
   }
@@ -2407,7 +2658,7 @@ function usableHere(root, uses = /* @__PURE__ */ new Map()) {
   const group = (list2) => groupBy(
     list2.map((s) => {
       const loadedBy = s.visibility.filter((v) => v.paths > 0).map((v) => v.id);
-      const behind = s.managed && s.latest !== null && s.version !== null && s.latest > s.version;
+      const behind = s.state.endsWith("update available");
       const gitState = git2?.of(relativeTo(root, s.path));
       const repo = !s.managed && (s.state.startsWith("repo skill") || gitState === "committed" || gitState === "changed");
       const usual = s.state === "ok" || s.state === "local only" || repo && s.state !== "from npx skills";
@@ -2445,7 +2696,8 @@ function usableHere(root, uses = /* @__PURE__ */ new Map()) {
   const usesHere = Object.fromEntries([...uses].filter(([, n]) => n > 0));
   return {
     project: tildify(root),
-    files: topLevel(root),
+    // Outside a repo there are no project files to read (and the folder may be your home).
+    files: inRepo ? topLevel(root) : [],
     agents,
     skills,
     nested: nested.length > 0 ? nested : void 0,
@@ -2460,7 +2712,7 @@ function firstSentence(description) {
   return sentence.length > 200 ? sentence.slice(0, 199).trimEnd() + "\u2026" : sentence;
 }
 function libraryFor(currentProject) {
-  const manifests = visibleProjects().map((p) => ({ name: basename7(p), skills: readManifest(p).skills }));
+  const manifests = visibleProjects().map((p) => ({ name: basename7(p), skills: pinsIn(p) }));
   const here = currentProject ? new Set(projectStatus(currentProject).map((s) => s.name)) : null;
   const all = librarySkills();
   const describe2 = (s) => {
@@ -2472,8 +2724,8 @@ function libraryFor(currentProject) {
 }
 
 // src/usage.ts
-import { createReadStream, existsSync as existsSync12, readdirSync as readdirSync8, statSync as statSync4 } from "fs";
-import { join as join13 } from "path";
+import { createReadStream, existsSync as existsSync13, readdirSync as readdirSync9, statSync as statSync5 } from "fs";
+import { join as join14 } from "path";
 import { createInterface } from "readline";
 var BUILTIN_COMMANDS = /* @__PURE__ */ new Set([
   "add-dir",
@@ -2553,12 +2805,12 @@ function usesFromTranscriptLine(line) {
   return [];
 }
 function transcriptFiles(sinceMs) {
-  const base = join13(claudeDir(), "projects");
-  if (!existsSync12(base)) return [];
-  return readdirSync8(base).flatMap((project) => {
-    const dir = join13(base, project);
-    if (!statSync4(dir).isDirectory()) return [];
-    return readdirSync8(dir).filter((f) => f.endsWith(".jsonl")).map((f) => join13(dir, f)).filter((f) => statSync4(f).mtimeMs >= sinceMs);
+  const base = join14(claudeDir(), "projects");
+  if (!existsSync13(base)) return [];
+  return readdirSync9(base).flatMap((project) => {
+    const dir = join14(base, project);
+    if (!statSync5(dir).isDirectory()) return [];
+    return readdirSync9(dir).filter((f) => f.endsWith(".jsonl")).map((f) => join14(dir, f)).filter((f) => statSync5(f).mtimeMs >= sinceMs);
   });
 }
 async function scanUsage(days) {
@@ -2574,7 +2826,7 @@ async function scanUsage(days) {
   }
   return [...seen.values()];
 }
-function summarize(uses, projectOf = () => null) {
+function summarize2(uses, projectOf = () => null) {
   const bySkill = /* @__PURE__ */ new Map();
   for (const use of uses) {
     const skill = use.skill.split(":").pop();
@@ -2601,7 +2853,12 @@ function usesByProject(uses, projectOf) {
 
 // src/move.ts
 import { basename as basename8 } from "path";
-function moveGlobalSkills(skills, roots, { group, allowTracked = false, label = basename8 } = {}) {
+function moveGlobalSkills(skills, roots, {
+  group,
+  allowTracked = false,
+  label = basename8,
+  allowBlind = false
+} = {}) {
   const byName = /* @__PURE__ */ new Map();
   for (const m of skills) byName.set(m.name, [...byName.get(m.name) ?? [], m]);
   return [...byName].map(([name, copies]) => {
@@ -2612,7 +2869,14 @@ function moveGlobalSkills(skills, roots, { group, allowTracked = false, label =
     if (group) recordOrigin(name, `group: ${group}`);
     const changes = roots.map((root) => [root, addSkill(root, name, { allowTracked })]);
     const skipped = changes.filter(([, c]) => c.action === "skipped");
-    if (skipped.length) return { name, moved: false, reason: `not added to ${skipped.map(([r, c]) => `${label(r)} (${c.reason})`).join(", ")}, so it still loads globally`, changes };
+    const why = (reason = "") => reason.replace(/ \(use --force to replace it\)$/, ": move or remove it there first");
+    if (skipped.length) return { name, moved: false, reason: `not added to ${skipped.map(([r, c]) => `${label(r)} (${why(c.reason)})`).join(", ")}, so it still loads globally`, changes };
+    const held = changes.filter(([, c]) => c.blocked?.length || c.uncommitted?.length);
+    const blind = held.flatMap(([root]) => visibilityOf(root, name).flatMap((v) => v.paths === 0 ? [`${harness(v.id).name} in ${label(root)}`] : []));
+    if (blind.length && !allowBlind) {
+      const next = held.some(([, c]) => c.uncommitted?.length) ? "commit the skill's copy in the repo, then run skilllib link --allow-tracked there" : "re-run with --allow-tracked";
+      return { name, moved: false, reason: `added, but ${blind.join(", ")} couldn't see it (git tracks the folder its link goes in), so it still loads globally; ${next}`, changes };
+    }
     const failed = copies.map((m) => unloadGlobal(m.path, m.links)).find((r) => !r.ok);
     return failed && !failed.ok ? { name, moved: false, reason: failed.reason, changes } : { name, moved: true, changes };
   });
@@ -2636,6 +2900,7 @@ var FLAGS = {
 function parseArgs(argv) {
   const { values: v, positionals } = parseFlags({ args: argv, options: FLAGS, allowPositionals: true, strict: true });
   const days = Number(v.days ?? USAGE_DAYS);
+  if (!Number.isInteger(days) || days <= 0) throw new Error(`--days takes a whole number of days, like --days 30 (got ${v.days})`);
   return {
     positional: positionals,
     force: !!v.force,
@@ -2644,7 +2909,7 @@ function parseArgs(argv) {
     fix: !!v.fix,
     allowTracked: !!v["allow-tracked"],
     json: !!v.json,
-    days: Number.isFinite(days) && days > 0 ? days : USAGE_DAYS,
+    days,
     dryRun: !!v["dry-run"],
     allowGit: !!v["allow-git"],
     ...v.keep ? { keep: v.keep } : {},
@@ -2660,25 +2925,24 @@ function colorState(state) {
 function withDirs(root, changes) {
   const { skills } = readManifest(root);
   return changes.map((c) => {
-    const dep = c.action === "installed" || c.action === "updated" || c.action === "reset" ? skills[c.name] : void 0;
+    const dep = c.action === "installed" || c.action === "updated" || c.action === "reset" || c.action === "relinked" ? skills[c.name] : void 0;
     return dep ? { ...c, dirs: [dep.dir ?? ".claude/skills", ...dep.links ?? []] } : c;
   });
 }
+var incomplete = (c) => c.action === "skipped" || !!c.blocked?.length || !!c.uncommitted?.length;
+function warnHeldLinks(c, where = "here") {
+  if (c.blocked?.length) warn(`${c.name}: git tracks ${c.blocked.join(", ")} ${where}, so no link was added there. Re-run with --allow-tracked to add it.`);
+  if (c.uncommitted?.length)
+    warn(`${c.name}: git tracks ${c.uncommitted.join(", ")} ${where} but not ${c.name}'s real copy, so no link was added there (teammates would get a broken link). Commit ${c.name} first, then run skilllib link --allow-tracked.`);
+}
 function printChanges(root, changes, args) {
-  if (changes.some((c) => c.action === "skipped")) process.exitCode = 1;
+  if (changes.some(incomplete)) process.exitCode = 1;
   if (args.json) return json("changes", withDirs(root, changes));
   for (const c of changes) {
-    if (c.blocked?.length) {
-      warn(`${c.name}: git tracks ${c.blocked.join(", ")} here, so no link was added there. Re-run with --allow-tracked to add it.`);
-    }
-    if (c.uncommitted?.length) {
-      warn(
-        `${c.name}: git tracks ${c.uncommitted.join(", ")} here but not ${c.name}'s real copy, so no link was added there (teammates would get a broken link). Commit ${c.name} first, then run skilllib link --allow-tracked.`
-      );
-    }
+    warnHeldLinks(c);
     if (c.action === "skipped") error(`${c.name}: ${c.reason}`);
     else {
-      const icon = c.action === "removed" ? red("-") : c.action === "reset" ? yellow("\u21BA") : green(c.action === "installed" ? "+" : "\u2191");
+      const icon = c.action === "removed" ? red("-") : c.action === "reset" ? yellow("\u21BA") : green(c.action === "installed" ? "+" : c.action === "relinked" ? "\u21E2" : "\u2191");
       const versions = c.action === "removed" ? "" : c.from && c.from !== c.to ? ` v${c.from} \u2192 v${c.to}` : c.to ? ` v${c.to}` : "";
       info(`  ${icon} ${c.name}${versions} ${dim(c.action)}`);
     }
@@ -2693,9 +2957,9 @@ function projectOfFactory(projects2) {
   const sorted = [...projects2].sort((a, b) => b.length - a.length);
   return (cwd) => {
     if (!cwd) return null;
-    const known = sorted.find((p) => cwd === p || cwd.startsWith(p + sep5));
+    const known = sorted.find((p) => cwd === p || cwd.startsWith(p + sep6));
     if (known) return known;
-    const repo = cwd.split(`${sep5}.claude${sep5}worktrees${sep5}`)[0];
+    const repo = cwd.split(`${sep6}.claude${sep6}worktrees${sep6}`)[0];
     return isProjectCandidate(repo) ? repo : null;
   };
 }
@@ -2703,13 +2967,23 @@ async function usageBySkill(days, onlyProject) {
   const projectOf = projectOfFactory(onlyProject ? [onlyProject, ...knownProjects()] : knownProjects());
   const uses = await scanUsage(days);
   const scoped = onlyProject ? uses.filter((u) => projectOf(u.cwd) === onlyProject) : uses;
-  return new Map(summarize(scoped, projectOf).map((s) => [s.skill, s]));
+  return new Map(summarize2(scoped, projectOf).map((s) => [s.skill, s]));
 }
+var projectsFor = (args) => {
+  if (!args.all) return [requireProject()];
+  const { readable, unreadable } = readableRoots(visibleProjects());
+  for (const u of unreadable) {
+    error(`${basename9(u.root)}: ${u.reason}`);
+    process.exitCode = 1;
+  }
+  return readable;
+};
+var yourGlobals = () => machineSkills().filter((m) => m.movable && !m.broken);
 function requireProject() {
   const root = projectHere();
   if (root) return root;
   if (!isProjectCandidate(findProjectRoot())) {
-    const stray = existsSync13(join14(userHome(), MANIFEST_FILE)) ? `, though ${tildify(join14(userHome(), MANIFEST_FILE))} makes it look like one` : "";
+    const stray = existsSync14(join15(userHome(), MANIFEST_FILE)) ? `, though ${tildify(join15(userHome(), MANIFEST_FILE))} makes it look like one` : "";
     throw new Error(`Your home folder isn't a project${stray}: skills added here would load in every repo. Run this inside a project.`);
   }
   throw new Error("Not in a git repo. Run this inside a project (or `git init` first).");
@@ -2732,14 +3006,8 @@ async function status(args) {
 `);
   if (skills.length === 0 && nested.length === 0) info("No skills in this project yet. Add one from your library with: skilllib add <name>");
   const usage2 = await usageBySkill(args.days, root);
-  const git2 = gitInfo(root, [...new Set(nested.map((s) => s.location))]);
-  const committed = (path) => ["committed", "changed"].includes(git2?.of(relativeTo(root, path)) ?? "");
-  const asRepo = {
-    "local only": "repo skill",
-    "untracked copy of library skill": "repo skill, in library",
-    "untracked, differs from library": "repo skill, differs from library"
-  };
-  const stateOf = (s) => colorState(committed(s.path) && asRepo[s.state] || s.state);
+  const teamState = teamStateIn(root, nested.map((s) => s.location));
+  const stateOf = (s) => colorState(teamState(s));
   const agentsOf = (s) => {
     const ids = s.visibility.filter((v) => v.paths > 0).map((v) => v.id);
     return ids.length === s.visibility.length ? dim("all") : ids.length ? ids.map((id) => harness(id).name).join(", ") : red("none");
@@ -2804,7 +3072,7 @@ async function list(args) {
   } else {
     const installs = /* @__PURE__ */ new Map();
     for (const project of visibleProjects()) {
-      for (const name of Object.keys(readManifest(project).skills)) {
+      for (const name of Object.keys(pinsIn(project))) {
         installs.set(name, [...installs.get(name) ?? [], basename9(project)]);
       }
     }
@@ -2823,7 +3091,7 @@ async function list(args) {
     );
   }
   const libraryNames = new Set(skills.map((s) => s.name));
-  const globals = [...new Set(machineSkills().filter((m) => m.movable && !m.broken).map((m) => m.name))];
+  const globals = [...new Set(yourGlobals().map((m) => m.name))];
   if (globals.length > 0) {
     info("");
     warn(`${globals.length} of your global ${globals.length === 1 ? "skill still loads" : "skills still load"} in every project`);
@@ -2835,20 +3103,33 @@ async function list(args) {
     );
   }
 }
+function teamStateIn(root, extraDirs = []) {
+  const git2 = gitInfo(root, [...new Set(extraDirs)]);
+  const committed = (path) => ["committed", "changed"].includes(git2?.of(relativeTo(root, path)) ?? "");
+  const asRepo = {
+    "local only": "repo skill",
+    "untracked copy of library skill": "repo skill, in library",
+    "untracked, differs from library": "repo skill, differs from library"
+  };
+  return (s) => committed(s.path) && asRepo[s.state] || s.state;
+}
 function projects(args) {
-  const roots = visibleProjects();
+  const { readable: roots, unreadable } = readableRoots(visibleProjects());
+  for (const u of unreadable) {
+    error(`${basename9(u.root)}: ${u.reason}`);
+    process.exitCode = 1;
+  }
   if (args.json) {
     return json(
       "projects",
-      roots.map(
-        (root) => ({
+      roots.map((root) => {
+        const teamState = teamStateIn(root);
+        return {
           name: basename9(root),
           path: root,
-          skills: projectStatus(root).map(
-            (s) => ({ name: s.name, managed: s.managed, state: s.state, version: s.version, latest: s.latest })
-          )
-        })
-      )
+          skills: projectStatus(root).map((s) => ({ name: s.name, managed: s.managed, state: teamState(s), version: s.version, latest: s.latest }))
+        };
+      })
     );
   }
   if (roots.length === 0) {
@@ -2886,59 +3167,60 @@ function remove(args) {
   const root = requireProject();
   printChanges(root, args.positional.map((name) => removeSkill(root, name, { force: args.force })), args);
 }
-function sync(args) {
-  if (args.positional.length) throw new Error(`sync takes no skill names: it installs exactly what skilllib.json pins. To add a skill: skilllib add ${args.positional.join(" ")}`);
-  const roots = args.all ? visibleProjects() : [requireProject()];
+function changeEach(args, change, nothing) {
+  const roots = projectsFor(args);
   const results = roots.map((root) => {
     if (args.allowTracked) allowTrackedLinks(root);
-    const changes = syncProject(root, { force: args.force });
-    if (changes.some((c) => c.action === "skipped")) process.exitCode = 1;
+    const changes = change(root);
+    if (changes.some(incomplete)) process.exitCode = 1;
     if (!args.json) {
       if (args.all) info(`${basename9(root)} ${dim(tildify(root))}`);
-      if (changes.length === 0) {
-        if (existsSync13(join14(root, MANIFEST_FILE))) success("Installed versions match skilllib.json");
-        else info(dim("No skilllib.json: nothing to sync"));
-      } else printChanges(root, changes, args);
+      if (changes.length === 0) nothing(root);
+      else printChanges(root, changes, args);
     }
     return { project: basename9(root), path: root, changes: withDirs(root, changes) };
   });
   if (args.json) args.all ? json("changes --all", results) : json("changes", results[0].changes);
+  return roots;
+}
+function sync(args) {
+  if (args.positional.length) throw new Error(`sync takes no skill names: it installs exactly what skilllib.json pins. To add a skill: skilllib add ${args.positional.join(" ")}`);
+  const roots = changeEach(
+    args,
+    (root) => syncProject(root, { force: args.force }),
+    (root) => existsSync14(join15(root, MANIFEST_FILE)) ? success("Installed versions match skilllib.json") : info(dim("No skilllib.json: nothing to sync"))
+  );
   if (!args.all) rememberProjects(roots);
 }
 function update(args) {
-  const roots = args.all ? visibleProjects() : [requireProject()];
-  const results = roots.map((root) => {
-    if (args.allowTracked) allowTrackedLinks(root);
-    const names = args.positional.length ? args.positional : void 0;
-    const changes = updateProject(root, names, { force: args.force });
-    if (!args.all) {
-      const { skills } = readManifest(root);
-      for (const name of names ?? []) if (!(name in skills)) changes.push({ name, action: "skipped", reason: "not managed by skilllib in this project" });
-    }
-    if (changes.some((c) => c.action === "skipped")) process.exitCode = 1;
-    if (!args.json) {
-      if (args.all) info(`${basename9(root)} ${dim(tildify(root))}`);
-      if (changes.length === 0) success("Everything is on the latest version");
-      else printChanges(root, changes, args);
-    }
-    return { project: basename9(root), path: root, changes: withDirs(root, changes) };
-  });
-  if (args.json) args.all ? json("changes --all", results) : json("changes", results[0].changes);
+  const names = args.positional.length ? args.positional : void 0;
+  changeEach(
+    args,
+    (root) => {
+      const changes = updateProject(root, names, { force: args.force });
+      if (!args.all) {
+        for (const name of names ?? []) if (!(name in readManifest(root).skills)) changes.push({ name, action: "skipped", reason: "not managed by skilllib in this project" });
+      }
+      return changes;
+    },
+    () => success("Everything is on the latest version")
+  );
 }
 function outdated(args) {
-  const roots = args.all ? visibleProjects() : [requireProject()];
+  const roots = projectsFor(args);
   const behind = roots.flatMap(
-    (root) => projectStatus(root).filter((s) => s.managed && s.latest !== null && s.version !== null && s.latest > s.version).map((s) => ({ project: basename9(root), path: root, skill: s.name, installed: s.version, latest: s.latest, state: s.state }))
+    (root) => projectStatus(root).filter((s) => s.state.endsWith("update available") && s.latest !== null && s.version !== null).map((s) => ({ project: basename9(root), path: root, skill: s.name, installed: s.version, latest: s.latest, state: s.state }))
   );
   if (args.json) return json("outdated", behind);
-  const rows = behind.map((b) => ({ Project: b.project, Skill: b.skill, Installed: `v${b.installed}`, Latest: `v${b.latest}`, Status: colorState(b.state) }));
-  if (rows.length === 0) return success("Everything is on the latest version");
-  table(rows);
+  const rows2 = behind.map((b) => ({ Project: b.project, Skill: b.skill, Installed: `v${b.installed}`, Latest: `v${b.latest}`, Status: colorState(b.state) }));
+  if (rows2.length === 0) return success("Everything is on the latest version");
+  table(rows2);
   info(dim(`
 \u2192 skilllib update${args.all ? " --all" : ""}`));
 }
 function importSkills(args) {
-  const dirs = args.global ? machineSkills().filter((m) => m.movable && !m.broken).map((m) => m.path) : args.positional.map((p) => resolve7(p));
+  if (args.global && args.positional.length) throw new Error("skilllib import --global takes no folders: it imports all your global skills");
+  const dirs = args.global ? yourGlobals().map((m) => m.path) : args.positional.map((p) => resolve7(p));
   if (dirs.length === 0) {
     throw new Error("Usage: skilllib import <skill-dir>... [--force] | skilllib import --global");
   }
@@ -2958,14 +3240,11 @@ function importSkills(args) {
       continue;
     }
     success(`${name} ${dim(result === "unchanged" ? "already in library" : result === "added" ? "added to library" : "library updated")}`);
-    const skillsDir = resolve7(dir, "..");
-    const root = resolve7(skillsDir, "..", "..");
-    if (skillsDir === join14(root, ".claude", "skills") && isProjectCandidate(root)) {
-      if (readManifest(root).skills[name]?.hash !== treeHash(dir)) {
-        const change = addSkill(root, name);
-        if (change.action !== "skipped") info(dim(`  ${basename9(root)} now depends on ${name} v${change.to}`));
-      }
-      rememberProjects([root]);
+    const root = resolve7(dir, "..", "..", "..");
+    const dep = projectHere(root) === root ? readManifest(root).skills[name] : void 0;
+    if (dep && realpathOrNull(join15(root, dep.dir ?? PROJECT_SKILLS_DIR, name)) === realpathOrNull(dir) && dep.hash !== treeHash(dir)) {
+      const change = addSkill(root, name);
+      if (change.action !== "skipped") info(dim(`  ${basename9(root)} now depends on ${name} v${change.to}`));
     }
   }
   if (args.json) json("import", results);
@@ -2980,7 +3259,7 @@ function scan(args) {
   const found = discoverProjects();
   const library = new Set(librarySkills().map((s) => s.name));
   const skillNames = (root) => [
-    .../* @__PURE__ */ new Set([...ALL_PROJECT_DIRS.flatMap((d) => skillDirsIn(join14(root, d))).map((d) => basename9(d)), ...nestedSkills(root).map((s) => s.name)])
+    .../* @__PURE__ */ new Set([...ALL_PROJECT_DIRS.flatMap((d) => skillDirsIn(join15(root, d))).map((d) => basename9(d)), ...nestedSkills(root).map((s) => s.name)])
   ];
   const withSkills = found.filter((root) => skillNames(root).length > 0);
   info(`Scanned ${roots.map((r) => tildify(r)).join(", ")}: ${found.length} project${found.length === 1 ? "" : "s"}, ${withSkills.length} with skills
@@ -2997,6 +3276,7 @@ ${yellow("Yellow")} skills aren't in your library yet (\`skilllib import <skill-
 }
 function folders(args) {
   const [action, ...paths] = args.positional;
+  if (action && !["add", "remove", "rm"].includes(action)) throw new Error("Usage: skilllib folders [add|remove <folder>...]");
   let failed = false;
   if (action === "add") {
     for (const p of paths) {
@@ -3011,7 +3291,10 @@ function folders(args) {
   } else if (action === "remove" || action === "rm") {
     for (const p of paths) {
       if (removeRoot(p)) success(`Removed ${tildify(expandHome(p))}`);
-      else warn(`${tildify(expandHome(p))} wasn't a project folder`);
+      else {
+        warn(`${tildify(expandHome(p))} wasn't a project folder`);
+        failed = true;
+      }
     }
   }
   const { roots, hidden } = readConfig();
@@ -3045,7 +3328,7 @@ function newSkill(args) {
   if (!r.ok) {
     throw new Error(`Can't create ${name}: ${r.reason}`);
   }
-  success(`Created ${tildify(join14(r.dir, "SKILL.md"))}`);
+  success(`Created ${tildify(join15(r.dir, "SKILL.md"))}`);
 }
 function restore(args) {
   const backups = [...listBackups(), ...pluginBackups()];
@@ -3056,15 +3339,17 @@ function restore(args) {
     info(dim("\n\u2192 skilllib restore <name>"));
     return;
   }
-  const backup = backups.find((b) => b.name === name);
-  if (!backup) {
-    throw new Error(`No backup named ${name}`);
-  }
-  const r = backup.kind === "plugin" ? restorePlugin(backup) : restoreBackup(backup);
-  if (r.ok) success(`Restored ${name} to ${tildify(r.to)}`);
-  else {
-    error(`Can't restore ${name}: ${r.reason}`);
-    process.exitCode = 1;
+  const newest = backups.find((b) => b.name === name);
+  if (!newest) throw new Error(`No backup named ${name} (skilllib restore lists them; a skill removed from a repo that your library has comes back with skilllib add ${name})`);
+  const at = (b) => Date.parse(b.path.slice(-24).replace(/^(.{13})-(\d\d)-(\d\d)-(\d{3})Z$/, "$1:$2:$3.$4Z"));
+  const together = newest.kind === "plugin" ? [newest] : backups.filter((b) => b.name === name && b.kind === newest.kind && Math.abs(at(b) - at(newest)) <= 2e3);
+  for (const backup of together) {
+    const r = backup.kind === "plugin" ? restorePlugin(backup) : restoreBackup(backup);
+    if (r.ok) success(`Restored ${name} to ${tildify(r.to)}`);
+    else {
+      error(`Can't restore ${name}: ${r.reason}`);
+      process.exitCode = 1;
+    }
   }
 }
 async function allIssues(args, withUsage = true) {
@@ -3076,11 +3361,14 @@ async function allIssues(args, withUsage = true) {
     const projectOf = projectOfFactory(projects2);
     const uses = await scanUsage(args.days);
     const inProject = usesByProject(uses, projectOf);
-    const total = new Map(summarize(uses, projectOf).map((s) => [s.skill, s.uses]));
+    const total = new Map(summarize2(uses, projectOf).map((s) => [s.skill, s.uses]));
+    const asUsed = /* @__PURE__ */ new Map();
+    for (const u of uses) asUsed.set(u.skill, (asUsed.get(u.skill) ?? 0) + 1);
     issues.push(
-      ...usageIssues(projects2, machine, libraryNames, {
+      ...usageIssues(readableRoots(projects2).readable, machine, libraryNames, {
         inProject: (root, skill) => inProject.get(root)?.get(skill) ?? 0,
         total: (skill) => total.get(skill) ?? 0,
+        asUsed: (key) => asUsed.get(key) ?? 0,
         days: args.days
       })
     );
@@ -3125,7 +3413,7 @@ async function doctor(args) {
 async function apply(args) {
   const [id, pick] = args.positional;
   if (!id) throw new Error("Usage: skilllib apply <issue-id> [choice]   (ids and choices: skilllib status --json or doctor --json)");
-  const found = [...statusIssues(findProjectRoot()), ...await allIssues(args, id.startsWith("unused:"))].filter((i) => i.id === id);
+  const found = [...statusIssues(findProjectRoot()), ...await allIssues(args, /^(plugin-)?unused:/.test(id))].filter((i) => i.id === id);
   if (!found.length) throw new Error(`No issue ${id} right now (it may be fixed already; for an unused:\u2026 issue, pass doctor's --days). See skilllib status --json or doctor --json`);
   const optionsOf = (i) => i.choices ?? (i.fix ? [i.fix] : []);
   const labels = (i) => optionsOf(i).map((c) => c.label).join("\0");
@@ -3148,22 +3436,22 @@ async function apply(args) {
   else error(r.message);
 }
 async function usage(args) {
-  const summaries = summarize(await scanUsage(args.days), projectOfFactory(knownProjects()));
+  const summaries = summarize2(await scanUsage(args.days), projectOfFactory(knownProjects()));
+  const library = new Set(librarySkills().map((s) => s.name));
+  const unused = [...library].filter((name) => !summaries.some((u) => u.skill === name));
   if (args.json) {
-    const library2 = new Set(librarySkills().map((s) => s.name));
     return json("usage", {
       usageDays: args.days,
       source: "Claude Code transcripts",
-      skills: summaries.map((s) => ({ skill: s.skill, uses: s.uses, lastUsed: s.lastUsed, projects: [...s.projects].map((p) => basename9(p)), inLibrary: library2.has(s.skill) })),
-      unusedLibrarySkills: librarySkills().filter((l) => !summaries.some((u) => u.skill === l.name)).map((l) => l.name)
+      skills: summaries.map((s) => ({ skill: s.skill, uses: s.uses, lastUsed: s.lastUsed, projects: [...s.projects].map((p) => basename9(p)), inLibrary: library.has(s.skill) })),
+      unusedLibrarySkills: unused
     });
   }
   if (summaries.length === 0) {
     info(`No skill usage in Claude Code transcripts from the last ${args.days} days.`);
     return;
   }
-  const library = new Set(librarySkills().map((s) => s.name));
-  info(`Skill usage, last ${args.days} days ${dim(`(from ${tildify(join14(claudeDir(), "projects"))})`)}
+  info(`Skill usage, last ${args.days} days ${dim(`(from ${tildify(join15(claudeDir(), "projects"))})`)}
 `);
   table(
     summaries.map((s) => ({
@@ -3174,15 +3462,14 @@ async function usage(args) {
       Library: library.has(s.skill) ? green("yes") : dim("no")
     }))
   );
-  const unused = librarySkills().filter((s) => !summaries.some((u) => u.skill === s.name));
   if (unused.length > 0) {
     info("");
-    warn(`Library skills unused in the last ${args.days} days: ${unused.map((s) => s.name).join(", ")}`);
+    warn(`Library skills unused in the last ${args.days} days: ${unused.join(", ")}`);
   }
 }
 function show(args) {
   const name = args.positional[0];
-  const dir = name ? join14(libraryDir(), name) : "";
+  const dir = name ? join15(libraryDir(), name) : "";
   if (!name || !isSkillDir(dir)) {
     throw new Error(name ? `${name} is not in the library` : "Usage: skilllib show <skill-name>");
   }
@@ -3194,14 +3481,14 @@ function show(args) {
       path: dir,
       latest: latestVersion(name)?.version ?? null,
       origin: libraryOrigins()[name] ?? "",
-      projects: knownProjects().filter((p) => name in readManifest(p).skills).map((p) => basename9(p)),
-      skillMd: readFileSync9(join14(dir, "SKILL.md"), "utf-8")
+      projects: knownProjects().filter((p) => name in pinsIn(p)).map((p) => basename9(p)),
+      skillMd: readFileSync6(join15(dir, "SKILL.md"), "utf-8")
     });
   }
   info(`${name} ${dim(tildify(dir))}`);
   if (description) info(`
 ${description}`);
-  const using = knownProjects().filter((p) => name in readManifest(p).skills);
+  const using = knownProjects().filter((p) => name in pinsIn(p));
   info(`
 Installed in: ${using.map((p) => tildify(p)).join(", ") || "no projects"}`);
 }
@@ -3223,7 +3510,7 @@ function harnessesCommand(args) {
 New installs go to ${installDirs(enabled).join(" (real copy) + ")}${installDirs(enabled).length > 1 ? " (link)" : ""}.`));
 }
 function link(args) {
-  const roots = args.all ? visibleProjects() : [requireProject()];
+  const roots = projectsFor(args);
   for (const root of roots) {
     if (args.allowTracked) allowTrackedLinks(root);
     const res = linkAll(root);
@@ -3234,6 +3521,7 @@ function link(args) {
       process.exitCode = 1;
       error(`${label}git tracks ${res.blocked.join(", ")}, so ${res.linked.length ? "some skills weren't" : "nothing was"} linked there; re-run with --allow-tracked to link there too`);
     }
+    if (res.uncommitted.length) process.exitCode = 1;
     if (res.uncommitted.length)
       warn(
         `${label}${res.uncommitted.join(", ")} ${res.uncommitted.length === 1 ? "isn't" : "aren't"} committed, so not linked into folders git tracks (teammates would get broken links); commit ${res.uncommitted.length === 1 ? "it" : "them"} first`
@@ -3242,7 +3530,7 @@ function link(args) {
 }
 function globalCommand(args) {
   const [action, ...names] = args.positional;
-  const yours = machineSkills().filter((m) => m.movable && !m.broken);
+  const yours = yourGlobals();
   if (action === "move") return moveGlobal(args, names, yours);
   if (action === "keep" || action === "unkeep") {
     const unknown = names.filter((n) => !yours.some((m) => m.name === n));
@@ -3267,7 +3555,7 @@ function repoRoot(repo) {
   if (named.length === 1) return named[0];
   if (named.length > 1) throw new Error(`Several projects are named ${repo}: ${named.map(tildify).join(", ")}. Pass its path.`);
   const path = expandHome(repo);
-  if (!existsSync13(path)) throw new Error(`No project ${repo} (pass its path, or see skilllib projects)`);
+  if (!existsSync14(path)) throw new Error(`No project ${repo} (pass its path, or see skilllib projects)`);
   const root = projectHere(path);
   if (root !== path) throw new Error(root ? `${tildify(path)} is inside ${tildify(root)}: pass the repo's top folder` : `${tildify(path)} isn't in a git repo`);
   return root;
@@ -3279,6 +3567,7 @@ function moveGlobal(args, names, yours) {
   const roots = [...new Set(args.to.map(repoRoot))];
   const skills = yours.filter((m) => names.includes(m.name));
   const moves = moveGlobalSkills(skills, roots, { allowTracked: args.allowTracked });
+  rememberProjects(roots);
   if (moves.some((m) => !m.moved)) process.exitCode = 1;
   if (args.json) {
     return json(
@@ -3294,10 +3583,7 @@ function moveGlobal(args, names, yours) {
   for (const m of moves) {
     if (m.moved) success(`${m.name} now loads only in ${m.changes.map(([r]) => basename9(r)).join(", ")} (the global copy is in skilllib restore)`);
     else error(`${m.name}: ${m.reason}`);
-    for (const [root, c] of m.changes) {
-      if (c.blocked?.length) warn(`  ${basename9(root)}: git tracks ${c.blocked.join(", ")}, so no link there. Re-run with --allow-tracked to add it.`);
-      if (c.uncommitted?.length) warn(`  ${basename9(root)}: no link in ${c.uncommitted.join(", ")}: git tracks it but not the skill's copy, so the link would break for teammates. Commit the copy, then run skilllib link --allow-tracked.`);
-    }
+    for (const [root, c] of m.changes) warnHeldLinks(c, `in ${basename9(root)}`);
   }
   if (moves.some((m) => m.moved)) info(dim("Commit skilllib.json and the skill folders in each repo."));
 }
@@ -3307,7 +3593,7 @@ function tidy(args) {
   if (args.keep && !names.length) {
     throw new Error("Usage: skilllib tidy <name>... --keep <folder>");
   }
-  const targets = args.global ? [null] : args.all ? visibleProjects() : [requireProject()];
+  const targets = args.global ? [null] : projectsFor(args);
   const problems = [];
   for (const name of names) {
     const where = targets.map((root) => ({ root, ...foldersOf(root, name) })).filter((w) => w.all.length);
@@ -3335,20 +3621,20 @@ function tidy(args) {
   for (const { label, report } of reports) {
     const plans = report.plans.filter((p) => !names.length || names.includes(p.name));
     const conflicts = report.conflicts.filter((c) => !names.length || names.includes(c.name));
-    if (!plans.length && !conflicts.length && !args.all) success(`${label}: every skill has one copy and the links your agents need`);
+    if (!plans.length && !conflicts.length && !args.all) success(`${label}: nothing to tidy (no extra copies or links)`);
     for (const plan of plans) {
-      const result = args.dryRun ? { applied: [], held: gitVisibleSteps(plan) } : applyTidy(plan, { git: args.allowGit ? "go" : "keep" });
-      const show2 = args.dryRun ? plan.steps : result.applied;
-      if (show2.length) info(`${args.dryRun ? dim("would") : green("\u2713")} ${label} \xB7 ${plan.name}: ${show2.map((s) => describeStep(s, plan.root)).join(", ")}`);
-      if (!args.dryRun) for (const step of result.held) info(`${yellow("!")} ${label} \xB7 ${plan.name}: held back, git would see it: ${describeStep(step, plan.root)}`);
-      held += args.dryRun ? 0 : result.held.length;
+      const wouldHold = args.allowGit ? [] : gitVisibleSteps(plan);
+      const result = args.dryRun ? { applied: plan.steps.filter((s) => !wouldHold.includes(s)), held: wouldHold } : applyTidy(plan, { git: args.allowGit ? "go" : "keep" });
+      if (result.applied.length) info(`${args.dryRun ? dim("would") : green("\u2713")} ${label} \xB7 ${plan.name}: ${result.applied.map((s) => describeStep(s, plan.root)).join(", ")}`);
+      for (const step of result.held) info(`${yellow("!")} ${label} \xB7 ${plan.name}: ${args.dryRun ? "would be held" : "held"} back, git would see it: ${describeStep(step, plan.root)}`);
+      held += result.held.length;
       changed += result.applied.length;
     }
     if (args.keep && conflicts.length) process.exitCode = 1;
     for (const c of conflicts) {
       warn(`${label} \xB7 ${c.name}: the copies differ`);
       for (const copy of c.copies) {
-        const runs = copy.runs.map((id) => HARNESSES.find((h) => h.id === id).name);
+        const runs = copy.runs.map((id) => harness(id).name);
         info(`    ${copyLabel(c, copy.dir)}${runs.length ? dim(`  run by ${runs.join(", ")}`) : ""}${c.managed === copy.dir ? dim("  (skilllib's copy)") : ""}`);
       }
       const pick = copyLabel(c, c.managed ?? c.copies[0].dir);
@@ -3378,6 +3664,7 @@ function agentSkill(args) {
     if (args.json) return json("agent-skill", { state: agentSkillState(), removed });
     return removed.length ? success(`Removed from ${removed.map((d) => tildify(d)).join(" and ")}`) : info("The skilllib skill isn't installed.");
   }
+  if (action) throw new Error("Usage: skilllib agent-skill [install|remove]");
   const state = agentSkillState();
   if (args.json) return json("agent-skill", { state, dirs: agentSkillDirs() });
   if (state === "installed") success(`Your agents can use skilllib ${dim(`(${agentSkillDirs().map((d) => tildify(d)).join(", ")})`)}`);
@@ -3391,16 +3678,19 @@ export {
   HARNESSES,
   harness,
   readSkillInfo,
+  treeHash,
   versionHistory,
   forgetLatest,
   latestVersion,
   projectHere,
   readManifest,
+  readableRoots,
   setJsonMode,
   isJsonMode,
   json,
   error,
   tildify,
+  localStamp,
   readConfig,
   addRoot,
   removeRoot,
@@ -3425,43 +3715,34 @@ export {
   relinkDependency,
   addSkill,
   removeSkill,
-  syncSkill,
   updateProject,
   importSkill,
   removeUntracked,
   projectsUsing,
   deleteLibrarySkill,
   deleteGlobal,
-  unloadGlobal,
-  linkGlobal,
   createSkill,
   listBackups,
   restoreBackup,
   gitInfo,
   relativeTo,
-  claudePlugins,
   installedPlugins,
   cursorPlugins,
   forgetClaudeBinary,
   claudeBinary,
-  turnOffIn,
   setPluginOn,
   uninstallPlugin,
   updatePlugin,
   pluginBackups,
   restorePlugin,
-  cursorPluginSkills,
   agentSkillState,
   installAgentSkill,
   removeAgentSkill,
   refreshAgentSkill,
-  planProjectTidy,
-  planGlobalTidy,
-  gitVisibleSteps,
-  applyTidy,
-  describeStep,
-  copyLabel,
-  addedAt,
+  foldersOf,
+  runFix,
+  findIssues,
+  usageIssues,
   scanUsage,
   moveGlobalSkills,
   parseArgs,