skilllib 1.13.0 → 1.14.0

package/README.md

@@ -193,10 +193,10 @@ These are the issues `skilllib doctor` reports, with the same fixes and choices.
 
 A skill's pin goes in one of two places:
 
-- **`skilllib.json` in the repo (shared).** Commit it with the skill folders, and teammates get the same skills. This is where pins go when the repo already has a `skilllib.json`.
-- **Your personal pins (`~/.skilllib/pins/`).** One file per repo, matched by its `origin` remote, so every clone and worktree of the repo shares it. skilllib keeps the copies and links out of git through the repo's `.git/info/exclude` (only your clone; the repo's `.gitignore` doesn't change). Nothing shows up in `git status`. This is where pins go when the repo has no `skilllib.json`.
+- **Your personal pins (`~/.skilllib/pins/`).** The default. One file per repo, matched by its `origin` remote, so every clone and worktree of the repo shares it. skilllib keeps the copies and links out of git through the repo's `.git/info/exclude` (only your clone; the repo's `.gitignore` doesn't change). Nothing shows up in `git status`. A repo that already has `skilllib.json` still gets new skills here.
+- **`skilllib.json` in the repo (shared).** Only when you share a skill with the team: `skilllib add <name> --shared`, or *Pin it for the team* in the app. Commit it with the skill folders, and teammates get that skill.
 
-`skilllib add <name> --personal` or `--shared` picks the place, and moves an existing pin without changing its version. In the app, a library skill's actions offer *Make it personal* or *Pin it for the team*, and its tag says `personal v2`. A copy git already has can't become personal. A skill pinned in both places uses the repo's pin; doctor offers to drop yours (a choice: yours would keep the skill if the team unpinned it).
+`--personal` moves a shared pin back to yours, without changing its version. A copy git already has can't become personal. A skill pinned in both places uses the repo's pin; doctor offers to drop yours (a choice: yours would keep the skill if the team unpinned it). The app tags a personal skill `personal v2`.
 
 **On another machine:** keep `~/.skilllib/pins/` and `~/.skilllib/library/` in git (a dotfiles repo, say). Clone a repo there and run `skilllib sync`: your personal skills come back, out of git again. A repo without a remote keeps its pins by folder, so they stay on that machine until it gets one: adding a remote (or renaming it) keeps them. Only a repo's top folder can have personal pins, not a monorepo package's.
 
@@ -249,7 +249,7 @@ Every plugin issue is *your call*: turning plugins on or off, or updating them,
 
 The details list its skills with their uses, what else it brings, where it's installed and its version. Its actions:
 
-- **Turn it on / off**: `claude plugin enable|disable --scope <scope>`, run in its repo for a project or local install. A plugin synced from claude.ai is switched by its `"<name>@synced"` line in `~/.claude/settings.json`; so is any plugin when the `claude` command isn't available.
+- **Turn it on / off**: `skilllib plugin off <id>` and `skilllib plugin on <id>` (`name@marketplace`). That switches the copy that loads in every repo and leaves a per-repo install on. The same switch is `claude plugin enable|disable --scope <scope>`, run in its repo for a project or local install. A plugin synced from claude.ai is switched by its `"<name>@synced"` line in `~/.claude/settings.json`; so is any plugin when the `claude` command isn't available.
 - **Update to vN**, when its marketplace (as Claude Code last fetched it) declares a newer version or commit: `claude plugin update`. If the marketplace asks to run a command, skilllib doesn't confirm it for you: it tells you to run the update yourself.
 - **Uninstall**: `claude plugin uninstall --keep-data`, where it's installed. Settings › Backups reinstalls it, in the same repo for a project install.
 - **Replace *plugin* with library skills…** copies all its skills into your library (grouped under the plugin), adds them to the repos you tick, and uninstalls the plugin. A plugin can't be half removed, so it's all its skills at once; the confirmation says what else it brings that goes too. If the `claude` command isn't available, skilllib turns the plugin off instead and tells you to finish with `/plugin uninstall`. Plugins synced from claude.ai can't be removed from here: skilllib copies their skills, turns the plugin off, and tells you to remove it on claude.ai.
@@ -409,6 +409,8 @@ skilllib new <name> [desc]      create a skill
 
 skilllib projects               your projects and their skills
 skilllib usage [--days N]       which skills Claude Code used (a plugin's copy counts for the skill's name)
+skilllib check [--days N]        what loaded skills cost on every prompt, and which had no use
+skilllib plugin off|on <id>      turn a Claude Code plugin off or on (it stays installed)
 skilllib doctor [--fix]         find (and fix) problems
 skilllib apply <id> [choice]    apply one problem's fix, or the choice you pick (ids from status or doctor --json)
 skilllib restore [name]         put back something skilllib moved out (copies moved together come back together)
@@ -424,7 +426,7 @@ Flags: `--personal` / `--shared` (for `add`: pin in your personal pins or in the
 
 A command exits 1 when it couldn't do all you asked: a skill skipped (not in the library, or local edits in the way), links git-tracked folders blocked, a link something else is in the way of (a file or another copy), an unknown `tidy` name or `--keep` folder, or (with `--all`, and `projects`) a repo left out because its `skilllib.json` can't be read. What it did do is still done, and listed. An unknown or misspelled flag is an error too, so a typo never runs silently. With `--json`, an error that stops a command prints `{"error": "…"}` on stdout as well as the message on stderr. The commands SKILL.md lists as messages-only print nothing on stdout otherwise: read their exit code.
 
-**`--json`** prints one line of JSON on stdout, for scripts and agents. Messages and warnings go to stderr. It works with `status`, `list`, `show`, `projects`, `outdated`, `usage`, `doctor`, `apply`, `add`, `remove`, `sync`, `update`, `import`, `global move` and `agent-skill`. The output is shaped to keep agents fast and cheap:
+**`--json`** prints one line of JSON on stdout, for scripts and agents. Messages and warnings go to stderr. It works with `status`, `list`, `show`, `projects`, `outdated`, `usage`, `doctor`, `apply`, `add`, `remove`, `sync`, `update`, `import`, `global move`, `agent-skill`, `check` and `plugin`. The output is shaped to keep agents fast and cheap:
 
 - **`status --json`** answers everything about the repo in one call:
   - the repo's skills, with their source, version, state and git state
@@ -455,11 +457,13 @@ A field is only removed or changed in a major version.
 
 | Path | What |
 |---|---|
-| `<repo>/skilllib.json` | The repo's shared skills and pinned versions. **Commit it.** |
+| `<repo>/skilllib.json` | Skills you shared with the team (`--shared`). **Commit it** with the skill folders. Absent until then |
 | `~/.skilllib/pins/` | Your personal pins, one file per repo (by its remote). Keep it in git with your library to use them on other machines. |
 | `~/.skilllib/library/` | Your skills (master copies). Worth putting under git. |
 | `~/.skilllib/store/` | Every version of every skill, immutable |
 | `~/.skilllib/config.json` | Your agents, project folders, hidden projects, skills you keep global |
+| `~/.skilllib/projects.json` | Repos skilllib has seen. Rewritten only when that list changes |
+| `~/.skilllib/usage-cache.json` | Parsed Claude Code transcripts, so the next `status` doesn't read them again. Safe to delete |
 | `~/.skilllib/trash/`, `global-backup/`, `tidy-backup/`, `edit-backup/` | Everything skilllib removed, restorable from Settings › Backups |
 | `~/.skilllib/plugin-backup.json` | Plugins skilllib uninstalled (with their scope and repo), so Settings › Backups can reinstall them |
 | `~/.skilllib/review-prompt.md` | The last review prompt you copied |
@@ -469,11 +473,11 @@ Environment variables: `SKILLLIB_HOME` moves `~/.skilllib`, `$VISUAL` / `$EDITOR
 
 ## FAQ
 
-**Does it change my repos?** Only when you tell it to: adding, removing, linking or tidying a skill, which updates `skilllib.json` (or, for personal pins, your `~/.skilllib/pins/` and the repo's `.git/info/exclude`). It asks before linking into a folder git tracks, and before tidy changes a committed file. It never deletes the only copy of a repo's own skill.
+**Does it change my repos?** Only when you tell it to: adding, removing, linking or tidying a skill. That updates your `~/.skilllib/pins/` and the repo's `.git/info/exclude`, or `skilllib.json` when you share a skill with the team. It asks before linking a shared skill into a folder git tracks, and before tidy changes a committed file. It never deletes the only copy of a repo's own skill.
 
 **Can I share skills with my team?** Commit `skilllib.json` along with the skill folders (`.agents/skills`, and `.claude/skills` if you use Claude Code). Or keep `~/.skilllib/library` in a git repo of its own (the rest of `~/.skilllib` is personal: config, backups, the version store), and run `skilllib import` on teammates' machines from a clone of it.
 
-**Do I have to commit `skilllib.json`?** No. In a repo without one, skilllib pins in your personal pins and keeps its copies out of git, so the repo doesn't change for anyone else. See [Personal or shared pins](#personal-or-shared-pins).
+**Do I have to commit `skilllib.json`?** Only for a skill you shared with the team (`skilllib add <name> --shared`). Everything else stays in your personal pins, out of git. See [Personal or shared pins](#personal-or-shared-pins).
 
 **Why does usage only count Claude Code?** It's the only agent whose transcripts skilllib reads. Grok keeps sessions under `~/.grok/sessions`, and Cursor doesn't keep them locally. Codex's format hasn't been tested yet. That's why "unused" is a strong hint, not proof.
 

package/dist/{chunk-C6TSR7NT.js → chunk-XMXC2XM2.js}

@@ -434,15 +434,25 @@ function indexFile(name) {
   return join4(storeDir(name), "versions.json");
 }
 function versionHistory(name) {
-  return readState(indexFile(name)) ?? [];
+  const hit = historyCache.get(name);
+  if (hit) return hit;
+  const history = readState(indexFile(name)) ?? [];
+  historyCache.set(name, history);
+  return history;
 }
 function versionDir(name, version) {
   return join4(storeDir(name), String(version));
 }
 var latestCache = /* @__PURE__ */ new Map();
+var historyCache = /* @__PURE__ */ new Map();
 function forgetLatest(name) {
-  if (name) latestCache.delete(name);
-  else latestCache.clear();
+  if (name) {
+    latestCache.delete(name);
+    historyCache.delete(name);
+  } else {
+    latestCache.clear();
+    historyCache.clear();
+  }
 }
 function latestVersion(name) {
   if (latestCache.has(name)) return latestCache.get(name) ?? null;
@@ -459,7 +469,9 @@ function latestVersion(name) {
       if (existsSync3(versionDir(name, next.version))) throw new Error(`${versionDir(name, next.version)} exists but ${indexFile(name)} doesn't list it: fix the index before adding versions`);
       mkdirSync2(storeDir(name), { recursive: true });
       copySkill(source, versionDir(name, next.version));
-      writeState(indexFile(name), [...history, next]);
+      const recorded = [...history, next];
+      writeState(indexFile(name), recorded);
+      historyCache.set(name, recorded);
       result = next;
     }
   }
@@ -585,26 +597,63 @@ function normalizeRemote(url) {
 }
 var repos = /* @__PURE__ */ new Map();
 var changedAt = (path) => statSync3(path, { throwIfNoEntry: false })?.mtimeMs ?? -1;
+function gitCommon(root) {
+  const gitPath = join5(root, ".git");
+  const st = statSync3(gitPath, { throwIfNoEntry: false });
+  if (!st) return null;
+  if (st.isDirectory()) return existsSync4(join5(gitPath, "HEAD")) ? gitPath : null;
+  if (!st.isFile()) return null;
+  const gitdir = readFileSync3(gitPath, "utf-8").match(/^gitdir:\s*(.+?)\s*$/m)?.[1];
+  if (!gitdir) return null;
+  const dir = resolve3(root, gitdir);
+  if (!existsSync4(dir)) return null;
+  let common = dir;
+  try {
+    const resolved = resolve3(dir, readFileSync3(join5(dir, "commondir"), "utf-8").trim());
+    if (existsSync4(resolved)) common = resolved;
+  } catch {
+  }
+  return existsSync4(join5(common, "HEAD")) ? common : null;
+}
+function remoteUrls(configPath) {
+  let text;
+  try {
+    text = readFileSync3(configPath, "utf-8");
+  } catch {
+    return [];
+  }
+  if (/^\s*\[include/m.test(text)) return null;
+  const urls = [];
+  let section = "";
+  for (const line of text.split(/\r?\n/)) {
+    const header = line.match(/^\s*\[([^\]]+)\]\s*$/);
+    if (header) {
+      const remote = header[1].match(/^remote\s+"(.+)"$/) ?? header[1].match(/^remote\s+(\S+)$/);
+      section = remote?.[1] ?? "";
+      continue;
+    }
+    const url = section ? line.match(/^\s*url\s*=\s*(.*?)\s*$/) : null;
+    if (url) urls.push([`remote.${section}.url`, url[1]]);
+  }
+  return urls;
+}
 function repoOf(root) {
   const real = realPath(root);
   const hit = repos.get(real);
   if (hit && (hit.config ? changedAt(hit.config) === hit.seen : !existsSync4(join5(root, ".git")))) return hit.repo;
-  const out2 = gitIn(root, ["rev-parse", "--show-prefix", "--git-common-dir"])?.split("\n");
-  if (!out2) {
+  const commonPath = gitCommon(root);
+  if (!commonPath) {
     repos.set(real, { repo: null, config: null, seen: 0 });
     return null;
   }
-  const common = realNative(resolve3(root, out2[1].trim())) ?? resolve3(root, out2[1].trim());
+  const common = realNative(commonPath) ?? commonPath;
   const folder = basename2(common) === ".git" ? dirname2(common) : common;
   const config = join5(common, "config");
   const seen = changedAt(config);
-  let repo = null;
-  if (out2[0] === "") {
-    const urls = (gitIn(root, ["config", "--get-regexp", "^remote\\..*\\.url$"]) ?? "").split("\n").filter(Boolean).map((l) => [l.slice(0, l.indexOf(" ")), l.slice(l.indexOf(" ") + 1)]);
-    const url = (urls.find(([k]) => k === "remote.origin.url") ?? urls[0])?.[1];
-    const remote = url ? normalizeRemote(url) : void 0;
-    repo = { file: pinsFileFor(root, remote, folder), folder, common, ...remote ? { remote } : {}, root };
-  }
+  const urls = remoteUrls(config) ?? (gitIn(root, ["config", "--get-regexp", "^remote\\..*\\.url$"]) ?? "").split("\n").filter(Boolean).map((l) => [l.slice(0, l.indexOf(" ")), l.slice(l.indexOf(" ") + 1)]);
+  const url = (urls.find(([k]) => k === "remote.origin.url") ?? urls[0])?.[1];
+  const remote = url ? normalizeRemote(url) : void 0;
+  const repo = { file: pinsFileFor(root, remote, folder), folder, common, ...remote ? { remote } : {}, root };
   repos.set(real, { repo, config, seen });
   return repo;
 }
@@ -696,7 +745,10 @@ function isProjectCandidate(root) {
 function rememberProjects(roots) {
   const incoming = roots.map((r) => resolve3(r)).filter((r) => isProjectCandidate(r) && !isAgentWorktree(r));
   const all = onePerFolder([...knownProjects(), ...incoming]).sort();
-  writeState(projectsFile(), all);
+  const path = projectsFile();
+  const prev = readState(path);
+  if (Array.isArray(prev) && prev.length === all.length && prev.every((p, i) => p === all[i])) return;
+  writeState(path, all);
 }
 function readableRoots(roots) {
   const unreadable = [];
@@ -1249,7 +1301,9 @@ function trackBlocker(root, name) {
     return `${MANIFEST_FILE} can't be read`;
   }
   const stuck = firstStuck(root, dependencyDirs(root, name, recorded));
-  return stuck ? blockerSaid(root, stuck) : null;
+  if (stuck) return blockerSaid(root, stuck);
+  if (!recorded && !personalPinsFile(root) && gitRepoAbove(root)) return "only the top folder of a git repo can have personal pins";
+  return null;
 }
 function pinsSkill(root, name) {
   try {
@@ -1598,10 +1652,20 @@ function addSkill(root, name, { force = false, version, allowTracked = false, pe
     ...moved ? { moved } : {}
   };
 }
+function gitRepoAbove(dir) {
+  let at = resolve6(dir);
+  while (true) {
+    if (existsSync7(join8(at, ".git", "HEAD"))) return true;
+    const parent = dirname3(at);
+    if (parent === at) return false;
+    at = parent;
+  }
+}
 function pinsWhere(root, recorded, personal) {
-  const want = personal ?? (recorded ? !!recorded.personal : !existsSync7(join8(root, MANIFEST_FILE)));
-  if (!want || personalPinsFile(root)) return want;
-  return personal ? "only the top folder of a git repo can have personal pins" : false;
+  const want = personal ?? (recorded ? !!recorded.personal : !!personalPinsFile(root));
+  if (want && !personalPinsFile(root)) return "only the top folder of a git repo can have personal pins";
+  if (personal === void 0 && !recorded && !personalPinsFile(root) && gitRepoAbove(root)) return "only the top folder of a git repo can have personal pins";
+  return want;
 }
 var personalOf = (manifest) => Object.fromEntries(Object.entries(manifest.skills).filter(([, d]) => d.personal));
 function removeSkill(root, name, { force = false } = {}) {
@@ -1924,9 +1988,9 @@ function refreshAgentSkill() {
 }
 
 // src/commands.ts
-import { existsSync as existsSync15, readFileSync as readFileSync7, rmSync as rmSync7 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync7, rmSync as rmSync8 } from "fs";
 import { parseArgs as parseFlags } from "util";
-import { basename as basename11, join as join16, resolve as resolve9, sep as sep10 } from "path";
+import { basename as basename11, join as join17, resolve as resolve9, sep as sep10 } from "path";
 
 // src/git.ts
 import { execFileSync as execFileSync3 } from "child_process";
@@ -1945,11 +2009,13 @@ function git(root, args, input) {
 }
 function gitInfo(root, extraDirs = []) {
   let inRepo;
-  try {
-    inRepo = execFileSync3("git", ["rev-parse", "--show-prefix"], { cwd: root, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-  } catch {
-    if (!existsSync9(join10(root, ".git"))) return null;
-    inRepo = "";
+  if (existsSync9(join10(root, ".git"))) inRepo = "";
+  else {
+    try {
+      inRepo = execFileSync3("git", ["rev-parse", "--show-prefix"], { cwd: root, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    } catch {
+      return null;
+    }
   }
   const real = (p) => {
     try {
@@ -2535,7 +2601,7 @@ function intoLibrary(path, force = false) {
   return r.name;
 }
 var pinsOf = (where, personal) => personal ? "your personal pins" : `${where}'s skilllib.json`;
-var newPinsOf = (root, where) => pinsOf(where, !existsSync12(join13(root, MANIFEST_FILE)) && personalPinsFile(root) !== null);
+var newPinsOf = (root, where) => pinsOf(where, personalPinsFile(root) !== null);
 function track(root, name) {
   const c = addSkill(root, name);
   if (c.action === "skipped") throw new Error(`${name}: ${c.reason}`);
@@ -3278,13 +3344,13 @@ function repoIssues(root, ctx) {
         id: `local:${root}:${s.name}`,
         severity: "suggestion",
         title: `${s.name} in ${where} isn't in your library`,
-        detail: "Import it into the library to reuse it in other projects and keep it backed up. The repo then tracks it (in skilllib.json, or your personal pins when it has none).",
+        detail: `Import it into the library to reuse it in other projects and keep it backed up. The repo then tracks it in ${newPinsOf(root, where)}.`,
         at: rows(root, [s.name]),
         choices: [
           {
             label: "Import into the library",
             // Tracking it writes skilllib.json.
-            hint: `copies it into Your skills${gitNote(root, [join13(root, MANIFEST_FILE)])}`,
+            hint: `copies it into Your skills${personalPinsFile(root) ? "" : gitNote(root, [join13(root, MANIFEST_FILE)])}`,
             run: () => {
               intoLibrary(s.path);
               track(root, s.name);
@@ -3341,7 +3407,7 @@ function repoIssues(root, ctx) {
         id: `npx:${root}:${s.name}`,
         severity: "suggestion",
         title: `${s.name} in ${where} came from npx skills, not your library`,
-        detail: `Installed with \`npx skills add\`${s.source ? ` (${s.source})` : ""}. Import it into your library to reuse it in other projects and keep it backed up${teams ? `; ${where}'s copy stays as it is (${committed(s) ? "committed" : `${untrackable(s)}, so skilllib can't track it here`})` : `; ${where} then tracks it (in skilllib.json, or your personal pins when it has none)`}.`,
+        detail: `Installed with \`npx skills add\`${s.source ? ` (${s.source})` : ""}. Import it into your library to reuse it in other projects and keep it backed up${teams ? `; ${where}'s copy stays as it is (${committed(s) ? "committed" : `${untrackable(s)}, so skilllib can't track it here`})` : `; ${where} then tracks it in ${newPinsOf(root, where)}`}.`,
         at: rows(root, [s.name]),
         choices: [
           {
@@ -3612,8 +3678,8 @@ function libraryFor(currentProject) {
 }
 
 // src/usage.ts
-import { createReadStream, existsSync as existsSync13, readdirSync as readdirSync10, statSync as statSync6 } from "fs";
-import { join as join14 } from "path";
+import { createReadStream, existsSync as existsSync13, mkdirSync as mkdirSync9, readdirSync as readdirSync10, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname7, join as join14 } from "path";
 import { createInterface } from "readline";
 var BUILTIN_COMMANDS = /* @__PURE__ */ new Set([
   "add-dir",
@@ -3715,21 +3781,58 @@ function transcriptFiles(sinceMs) {
     });
   });
 }
+function usageCacheFile() {
+  return join14(skilllibHome(), "usage-cache.json");
+}
+function readUsageCache() {
+  const data = readJson(usageCacheFile());
+  return data?.files && typeof data.files === "object" ? data : { files: {} };
+}
+function writeUsageCache(cache) {
+  const path = usageCacheFile();
+  const temp = `${path}.${process.pid}.tmp`;
+  try {
+    mkdirSync9(dirname7(path), { recursive: true });
+    writeFileSync6(temp, JSON.stringify(cache));
+    renameSync4(temp, path);
+  } catch {
+    rmSync6(temp, { force: true });
+  }
+}
+async function usesIn(file) {
+  const uses = [];
+  const lines = createInterface({ input: createReadStream(file), crlfDelay: Infinity });
+  for await (const line of lines) uses.push(...usesFromTranscriptLine(line));
+  return uses;
+}
 async function scanUsage(days) {
   const sinceMs = Date.now() - days * 24 * 60 * 60 * 1e3;
+  const files = transcriptFiles(sinceMs);
+  const cache = readUsageCache();
+  let dirty = false;
+  for (const file of Object.keys(cache.files)) {
+    if (!files.includes(file) && !existsSync13(file)) {
+      delete cache.files[file];
+      dirty = true;
+    }
+  }
   const seen = /* @__PURE__ */ new Map();
-  for (const file of transcriptFiles(sinceMs)) {
+  for (const file of files) {
     try {
-      const lines = createInterface({ input: createReadStream(file), crlfDelay: Infinity });
-      for await (const line of lines) {
-        for (const use of usesFromTranscriptLine(line)) {
-          if (Date.parse(use.at) >= sinceMs) seen.set(use.key, use);
-        }
+      const st = statSync6(file);
+      const mtimeMs = Math.round(st.mtimeMs);
+      const hit = cache.files[file];
+      const uses = hit && hit.size === st.size && hit.mtimeMs === mtimeMs && Array.isArray(hit.uses) ? hit.uses : await usesIn(file);
+      if (uses !== hit?.uses) {
+        cache.files[file] = { size: st.size, mtimeMs, uses };
+        dirty = true;
       }
+      for (const use of uses) if (Date.parse(use.at) >= sinceMs) seen.set(use.key, use);
     } catch {
       continue;
     }
   }
+  if (dirty) writeUsageCache(cache);
   return [...seen.values()];
 }
 var skillOf = (key) => key.split(":").pop();
@@ -3761,7 +3864,7 @@ function usesByProject(uses, projectOf) {
 
 // src/install.ts
 import { execFileSync as execFileSync5 } from "child_process";
-import { createWriteStream, existsSync as existsSync14, lstatSync as lstatSync5, mkdirSync as mkdirSync9, mkdtempSync, readdirSync as readdirSync11, rmSync as rmSync6, statSync as statSync7 } from "fs";
+import { createWriteStream, existsSync as existsSync14, lstatSync as lstatSync5, mkdirSync as mkdirSync10, mkdtempSync, readdirSync as readdirSync11, rmSync as rmSync7, statSync as statSync7 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { basename as basename9, join as join15, resolve as resolve8, sep as sep9 } from "path";
 import { Readable } from "stream";
@@ -3851,16 +3954,16 @@ async function downloadGitHub(owner, repo) {
   try {
     res = await fetch(url, { redirect: "follow" });
   } catch (err) {
-    rmSync6(dest, { recursive: true, force: true });
+    rmSync7(dest, { recursive: true, force: true });
     throw new Error(`couldn't download ${owner}/${repo} (${err instanceof Error ? err.message : err})`);
   }
   if (!res.ok || !res.body) {
-    rmSync6(dest, { recursive: true, force: true });
+    rmSync7(dest, { recursive: true, force: true });
     throw new Error(res.status === 404 ? `${owner}/${repo} not found on GitHub` : `couldn't download ${owner}/${repo} (${res.status})`);
   }
   const host = new URL(res.url).hostname;
   if (host !== "codeload.github.com" && host !== "github.com") {
-    rmSync6(dest, { recursive: true, force: true });
+    rmSync7(dest, { recursive: true, force: true });
     throw new Error(`refusing to download ${owner}/${repo} from ${host}`);
   }
   let bytes = 0;
@@ -3882,11 +3985,11 @@ async function downloadGitHub(owner, repo) {
     );
     execFileSync5("tar", ["-xzf", archive, "-C", dest], { stdio: "ignore" });
   } catch (err) {
-    rmSync6(dest, { recursive: true, force: true });
+    rmSync7(dest, { recursive: true, force: true });
     if (err instanceof Error && /larger than|couldn't download/.test(err.message)) throw err;
     throw new Error(`couldn't extract ${owner}/${repo}`);
   }
-  rmSync6(archive, { force: true });
+  rmSync7(archive, { force: true });
   const top = readdirSync11(dest);
   const root = top.length === 1 && statSync7(join15(dest, top[0])).isDirectory() ? join15(dest, top[0]) : dest;
   return { tmp: dest, root };
@@ -3904,19 +4007,19 @@ function installGlobal(name, { force = false } = {}) {
     return { ok: false, reason: `${name} is already global, with edits that aren't in your library (pass --force to replace them)` };
   }
   if (there !== latest.hash) {
-    if (isLink(dest)) rmSync6(dest, { force: true });
-    mkdirSync9(primary, { recursive: true });
+    if (isLink(dest)) rmSync7(dest, { force: true });
+    mkdirSync10(primary, { recursive: true });
     copySkill(versionDir(name, latest.version), dest);
   }
   const wrote = [dest];
   for (const dir of links) {
     const link2 = join15(dir, name);
-    if (isLink(link2) && realpathOrNull(link2) === null) rmSync6(link2, { force: true });
+    if (isLink(link2) && realpathOrNull(link2) === null) rmSync7(link2, { force: true });
     else if (entryExists(link2)) {
       if (realpathOrNull(link2) === realpathOrNull(dest)) wrote.push(link2);
       continue;
     }
-    mkdirSync9(dir, { recursive: true });
+    mkdirSync10(dir, { recursive: true });
     linkDir(realpathOrNull(dest) ?? dest, join15(realpathOrNull(dir) ?? dir, name));
     wrote.push(link2);
   }
@@ -3964,6 +4067,87 @@ async function resolveInstallDir(spec) {
   return { tmp: got.tmp, dirs, source, many: !spec.skill && dirs.length > 1 };
 }
 
+// src/check.ts
+import { join as join16 } from "path";
+function promptTokens(name, description) {
+  return Math.max(1, Math.ceil((name.length + 1 + description.length) / 4));
+}
+function freshLabel(state, version, latest) {
+  if (state === "update available") return `v${version} \u2192 v${latest}`;
+  if (state === "edited locally, update available") return `edited here, library has v${latest}`;
+  if (state === "edited locally") return "edited here";
+  if (state === "out of sync") return "not the pinned version";
+  if (state === "folder missing") return "folder missing";
+  if (state === "ok" || state === "repo skill, in library" || state === "untracked copy of library skill") return "current";
+  if (state === "untracked, differs from library" || state === "repo skill, differs from library") return "differs from your library";
+  return "not in your library";
+}
+function libraryFresh(path, name) {
+  const lib = join16(libraryDir(), name);
+  if (!isSkillDir(lib)) return "not in your library";
+  const here = treeHash(path);
+  return here && here === treeHash(lib) ? "matches your library" : "differs from your library";
+}
+var settled = /* @__PURE__ */ new Set(["current", "matches your library", "vendor", "skilllib"]);
+function byWeight(rows2) {
+  const rank = (r) => (r.uses === 0 ? 0 : 1) * 2 + (settled.has(r.fresh) ? 1 : 0);
+  return [...rows2].sort((a, b) => rank(a) - rank(b) || b.everyPrompt - a.everyPrompt || a.name.localeCompare(b.name));
+}
+function tokenSum(rows2, where) {
+  return rows2.filter((r) => !where || r.where === where).reduce((n, r) => n + r.everyPrompt, 0);
+}
+function rough(n) {
+  const rounded = n >= 100 ? Math.round(n / 100) * 100 : n;
+  return String(rounded).replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+}
+function checkBrief(rows2, ctx) {
+  const global = rows2.filter((r) => r.where === "global");
+  const repo = rows2.filter((r) => r.where === "repo");
+  const globalTokens = tokenSum(global);
+  const unused = rows2.filter((r) => r.uses === 0);
+  const unusedGlobal = global.filter((r) => r.uses === 0 && r.lever !== "skilllib");
+  const unusedTokens = tokenSum(unusedGlobal);
+  const n = (count) => `${count} skill${count === 1 ? "" : "s"}`;
+  const lines = [
+    `${n(rows2.length)}. ~${rough(globalTokens)} tokens of names and descriptions in every prompt${ctx.repo ? `, plus ~${rough(tokenSum(repo))} from this repo` : ""}.`,
+    `${unused.length} had no Claude Code use in ${ctx.days} days. A zero is a hint: Cursor and Codex aren't in these transcripts.`
+  ];
+  if (!globalTokens) return [...lines, "Nothing global is loading."];
+  lines.push(
+    unusedTokens * 2 >= globalTokens ? "Heavy. More than half of every prompt's skill list had no use." : unusedTokens * 4 >= globalTokens ? "Mixed. A good share of every prompt is skills with no use." : "Fine. Most of what loads has been used."
+  );
+  const plugins = Object.entries(Object.groupBy(global.filter((r) => r.lever === "plugin"), (r) => r.via ?? r.name)).map(([id, skills = []]) => ({
+    id,
+    tokens: tokenSum(skills),
+    idle: tokenSum(skills.filter((s) => s.uses === 0)),
+    skills: skills.length,
+    used: skills.filter((s) => s.uses > 0).length
+  })).filter((p) => p.idle > 0 && p.idle * 2 >= p.tokens).sort((a, b) => b.tokens - a.tokens);
+  const yours = unusedGlobal.filter((r) => r.lever === "yours");
+  const synced = unusedGlobal.filter((r) => r.lever === "claude.ai");
+  const drop = plugins.reduce((n2, p) => n2 + p.tokens, 0) + tokenSum(yours) + tokenSum(synced);
+  if (drop > 0) lines.push(`You can drop ~${rough(drop)} tokens.`);
+  for (const p of plugins.slice(0, 3)) {
+    lines.push(
+      p.used ? `~${rough(p.tokens)} is ${p.id} (${p.skills} skills, ${p.used} used). Turning the plugin off drops all of it, including ${p.used === 1 ? "that one" : "those"}.` : `~${rough(p.tokens)} is ${p.id} (${p.skills} skills, no use). Turn the plugin off.`
+    );
+  }
+  if (plugins.length > 3) lines.push(`${plugins.length - 3} more plugins are in the same spot.`);
+  if (plugins.length) lines.push("Turn a Claude Code plugin off with skilllib plugin off <id>. Cursor plugins turn off in Cursor.");
+  if (yours.length) {
+    const names = yours.sort((a, b) => b.everyPrompt - a.everyPrompt).slice(0, 5).map((r) => r.name);
+    const more = yours.length > 5 ? `, and ${yours.length - 5} more` : "";
+    lines.push(`~${rough(tokenSum(yours))} are your own global skills with no use (${names.join(", ")}${more}). Move them into the repos that need them, or delete them.`);
+  }
+  if (synced.length) lines.push(`~${rough(tokenSum(synced))} are claude.ai skills with no use. Turn them off on claude.ai.`);
+  const builtins = unusedGlobal.filter((r) => r.lever === "built-in");
+  if (builtins.length) {
+    const who = [...new Set(builtins.map((r) => r.via ?? "the agent"))].join(", ");
+    lines.push(`~${rough(tokenSum(builtins))} are ${who} built-ins with no use. They ship with the agent. skilllib can't unload them.`);
+  }
+  return lines;
+}
+
 // src/move.ts
 import { basename as basename10 } from "path";
 function moveGlobalSkills(skills, roots, {
@@ -4116,7 +4300,7 @@ function requireProject() {
   if (!isProjectCandidate(findProjectRoot())) {
     const top = findProjectRoot();
     if (realPath(top) !== realPath(userHome())) throw new Error(`${tildify(top)} is skilllib's or an agent's own folder, not a project. Run this inside a project.`);
-    const stray = existsSync15(join16(userHome(), MANIFEST_FILE)) ? `, though ${tildify(join16(userHome(), MANIFEST_FILE))} makes it look like one` : "";
+    const stray = existsSync15(join17(userHome(), MANIFEST_FILE)) ? `, though ${tildify(join17(userHome(), MANIFEST_FILE))} makes it look like one` : "";
     throw new Error(`Your home folder isn't a project${stray}: skills added here would load in every repo. Run this inside a project.`);
   }
   throw new Error("Not in a git repo. Run this inside a project (or `git init` first).");
@@ -4300,7 +4484,7 @@ function add(args) {
   const pins = readManifest(root).skills;
   const done = changes.filter((c) => c.action !== "skipped" && pins[c.name]);
   if (!args.json && args.personal === void 0 && done.some((c) => c.action === "installed" && !c.moved && pins[c.name].personal))
-    info(dim(`Pinned in your personal pins (${tildify(personalPinsDir())}) and kept out of git. --shared pins in skilllib.json for the team.`));
+    info(dim(`Pinned for you (${tildify(personalPinsDir())}), kept out of git. To share it with the team: skilllib add <name> --shared, then commit skilllib.json and the skill folders.`));
   rememberProjects([root]);
 }
 function remove(args) {
@@ -4384,7 +4568,7 @@ function importSkills(args) {
     success(`${name} ${dim(result === "unchanged" ? "already in library" : result === "added" ? "added to library" : "library updated")}`);
     const root = resolve9(dir, "..", "..", "..");
     const dep = projectHere(root) === root ? readManifest(root).skills[name] : void 0;
-    if (dep && realpathOrNull(join16(root, dep.dir ?? PROJECT_SKILLS_DIR, name)) === realpathOrNull(dir) && dep.hash !== treeHash(dir)) {
+    if (dep && realpathOrNull(join17(root, dep.dir ?? PROJECT_SKILLS_DIR, name)) === realpathOrNull(dir) && dep.hash !== treeHash(dir)) {
       const change = addSkill(root, name);
       if (change.action !== "skipped") info(dim(`  ${basename11(root)} now depends on ${name} v${change.to}`));
     }
@@ -4402,7 +4586,7 @@ function scan(args) {
   const library = new Set(librarySkills().map((s) => s.name));
   const skillNames = (root) => [
     // Not a folder that links out of the repo: what's in it isn't the repo's (as in status).
-    .../* @__PURE__ */ new Set([...projectDirsInUse(enabledHarnesses()).filter((d) => !notWritable(root, d)).flatMap((d) => skillDirsIn(join16(root, d))).map((d) => basename11(d)), ...nestedSkills(root).map((s) => s.name)])
+    .../* @__PURE__ */ new Set([...projectDirsInUse(enabledHarnesses()).filter((d) => !notWritable(root, d)).flatMap((d) => skillDirsIn(join17(root, d))).map((d) => basename11(d)), ...nestedSkills(root).map((s) => s.name)])
   ];
   const withSkills = found.filter((root) => skillNames(root).length > 0);
   info(`Scanned ${roots.map((r) => tildify(r)).join(", ")}: ${found.length} project${found.length === 1 ? "" : "s"}, ${withSkills.length} with skills
@@ -4466,7 +4650,7 @@ function newSkill(args) {
   if (!r.ok) {
     throw new Error(`Can't create ${name}: ${r.reason}`);
   }
-  success(`Created ${tildify(join16(r.dir, "SKILL.md"))}`);
+  success(`Created ${tildify(join17(r.dir, "SKILL.md"))}`);
 }
 function restore(args) {
   const backups = [...listBackups(), ...pluginBackups()];
@@ -4587,7 +4771,7 @@ async function usage(args) {
     info(`No skill usage in Claude Code transcripts from the last ${args.days} days.`);
     return;
   }
-  info(`Skill usage, last ${args.days} days ${dim(`(from ${tildify(join16(claudeDir(), "projects"))})`)}
+  info(`Skill usage, last ${args.days} days ${dim(`(from ${tildify(join17(claudeDir(), "projects"))})`)}
 `);
   table(
     summaries.map((s) => ({
@@ -4603,9 +4787,117 @@ async function usage(args) {
     warn(`Library skills unused in the last ${args.days} days: ${unused.join(", ")}`);
   }
 }
+var LEVER = { plugin: "plugin", "built-in": "built-in", "claude.ai": "claude.ai", system: "system", skilllib: "skilllib" };
+async function check(args) {
+  const root = projectHere();
+  const usage2 = await usageBySkill(args.days);
+  const kept = keptGlobal();
+  const machine = machineSkills().filter((m) => !m.broken);
+  const loaded = root ? skillsLoadedIn(root, machine) : machine;
+  const local = root ? projectStatus(root) : [];
+  const localByName = new Map(local.map((s) => [s.name, s]));
+  const seen = /* @__PURE__ */ new Set();
+  const rows2 = [];
+  for (const g of loaded) {
+    seen.add(g.name);
+    const here = localByName.get(g.name);
+    const u = usage2.get(g.name);
+    const repoFresh = here && here.state !== "folder missing" ? freshLabel(here.state, here.version, here.latest) : null;
+    const lever = LEVER[g.kind] ?? "yours";
+    rows2.push({
+      name: g.name,
+      where: "global",
+      description: g.description,
+      everyPrompt: promptTokens(g.name, g.description),
+      uses: u?.uses ?? 0,
+      lastUsed: u ? u.lastUsed.slice(0, 10) : null,
+      projects: [...u?.projects ?? []].map((p) => basename11(p)),
+      fresh: lever === "yours" ? repoFresh ?? libraryFresh(g.path, g.name) : lever,
+      path: g.path,
+      lever,
+      ...lever !== "yours" && lever !== "skilllib" ? { via: g.origin } : {},
+      ...here ? { alsoInRepo: true } : {},
+      ...kept.has(g.name) ? { keptGlobal: true } : {}
+    });
+  }
+  for (const s of local) {
+    if (seen.has(s.name) || s.state === "folder missing") continue;
+    const u = usage2.get(s.name);
+    const { description } = readSkillInfo(s.path);
+    rows2.push({
+      name: s.name,
+      where: "repo",
+      description,
+      everyPrompt: promptTokens(s.name, description),
+      uses: u?.uses ?? 0,
+      lastUsed: u ? u.lastUsed.slice(0, 10) : null,
+      projects: [...u?.projects ?? []].map((p) => basename11(p)),
+      fresh: freshLabel(s.state, s.version, s.latest),
+      path: s.path,
+      lever: "repo"
+    });
+  }
+  const skills = byWeight(rows2);
+  const repoName = root ? basename11(root) : null;
+  const brief = checkBrief(skills, { days: args.days, repo: repoName });
+  const report = {
+    days: args.days,
+    repo: repoName,
+    everyPrompt: { global: tokenSum(skills, "global"), repo: tokenSum(skills, "repo") },
+    note: "Uses are Claude Code transcripts only, so 0 means it wasn't seen. everyPrompt is a rough token count (chars/4) of the name and description, which sit in every prompt. The rest of SKILL.md loads only when the skill is used. brief is the report.",
+    brief,
+    skills: skills.map(({ lastUsed: lastUsed2, projects: projects2, via, alsoInRepo, keptGlobal: keptGlobal2, ...rest }) => ({
+      ...rest,
+      ...lastUsed2 ? { lastUsed: lastUsed2 } : {},
+      ...projects2.length ? { projects: projects2 } : {},
+      ...via ? { via } : {},
+      ...alsoInRepo ? { alsoInRepo } : {},
+      ...keptGlobal2 ? { keptGlobal: keptGlobal2 } : {}
+    }))
+  };
+  if (args.json) return json("check", report);
+  if (!skills.length) return info("No skills loaded.");
+  info(brief.join("\n"));
+}
+function pluginCommand(args) {
+  const [action, id, extra] = args.positional;
+  if (action !== "off" && action !== "on" || !id || extra) throw new Error("Usage: skilllib plugin off|on <id>");
+  const on = action === "on";
+  const targets = pluginTargets(id);
+  const results = targets.map((p) => setPluginOn(p, on));
+  const ok = results.every((r) => r.ok);
+  const message = [...results.map((r) => r.message), stillOnElsewhere(targets)].filter(Boolean).join(" ");
+  if (!ok) process.exitCode = 1;
+  const body = { id: targets[0].id, on, ok, message };
+  if (args.json) return json("plugin", body);
+  if (ok) success(message);
+  else error(message);
+}
+function pluginTargets(id) {
+  const claude2 = installedPlugins().filter((p) => p.agent === "claude-code");
+  const exact = claude2.filter((p) => p.id === id);
+  const matches = exact.length ? exact : claude2.filter((p) => pluginNameOf(p.id) === id);
+  if (!matches.length) {
+    const cursor = cursorPlugins().some((p) => p.id === id || pluginNameOf(p.id) === id);
+    throw new Error(cursor ? `${id} is a Cursor plugin. Turn it off in Cursor (Settings \u2192 Plugins).` : `No Claude Code plugin ${id}.`);
+  }
+  const ids = [...new Set(matches.map((p) => p.id))];
+  if (ids.length > 1) throw new Error(`Several plugins match ${id}: ${ids.join(", ")}. Pass the id.`);
+  const everywhere = matches.filter((p) => !p.projectPath);
+  if (everywhere.length) return everywhere;
+  if (matches.length === 1) return matches;
+  const where = matches.map((p) => `${basename11(p.projectPath)} (${p.scope})`).join(", ");
+  throw new Error(`${matches[0].id} is installed in more than one repo (${where}). This command switches the copy that loads in every repo, and these are per-repo installs.`);
+}
+function stillOnElsewhere(targets) {
+  const id = targets[0].id;
+  const switched = new Set(targets.map((p) => p.projectPath).filter((p) => !!p));
+  const left = installedPlugins().filter((p) => p.agent === "claude-code" && p.id === id && p.projectPath && !switched.has(p.projectPath) && p.on !== false);
+  return left.length ? `Still on in ${left.map((p) => `${basename11(p.projectPath)} (${p.scope})`).join(", ")}.` : "";
+}
 function show(args) {
   const name = args.positional[0];
-  const dir = name ? join16(libraryDir(), name) : "";
+  const dir = name ? join17(libraryDir(), name) : "";
   if (!name || !isSkillDir(dir)) {
     throw new Error(name ? `${name} is not in the library` : "Usage: skilllib show <skill-name>");
   }
@@ -4618,7 +4910,7 @@ function show(args) {
       latest: latestVersion(name)?.version ?? null,
       origin: libraryOrigins()[name] ?? "",
       projects: projectsUsing(name).map((p) => basename11(p)),
-      skillMd: readFileSync7(join16(dir, "SKILL.md"), "utf-8")
+      skillMd: readFileSync7(join17(dir, "SKILL.md"), "utf-8")
     });
   }
   info(`${name} ${dim(tildify(dir))}`);
@@ -4793,7 +5085,7 @@ function tidy(args) {
   }
   if (args.dryRun) info(dim("\nNothing changed (--dry-run)."));
   else if (changed) info(dim(`
-Replaced copies are in ${tildify(join16(skilllibHome(), "tidy-backup"))}; \`skilllib restore\` puts them back.`));
+Replaced copies are in ${tildify(join17(skilllibHome(), "tidy-backup"))}; \`skilllib restore\` puts them back.`));
   if (held) {
     process.exitCode = 1;
     info(dim(`${held} change${held === 1 ? "" : "s"} held back because git would see them. Re-run with --allow-git to make them.`));
@@ -4914,7 +5206,7 @@ async function install(args) {
         }
       }
     } finally {
-      if (resolved.tmp) rmSync7(resolved.tmp, { recursive: true, force: true });
+      if (resolved.tmp) rmSync8(resolved.tmp, { recursive: true, force: true });
     }
   }
   if (args.json) json("install", results);
@@ -5036,6 +5328,8 @@ export {
   doctor,
   apply,
   usage,
+  check,
+  pluginCommand,
   show,
   harnessesCommand,
   link,

package/dist/index.js

@@ -4,6 +4,7 @@ import {
   add,
   agentSkill,
   apply,
+  check,
   doctor,
   error,
   folders,
@@ -19,6 +20,7 @@ import {
   outdated,
   overview,
   parseArgs,
+  pluginCommand,
   projects,
   refreshAgentSkill,
   remove,
@@ -33,7 +35,7 @@ import {
   unhide,
   update,
   usage
-} from "./chunk-C6TSR7NT.js";
+} from "./chunk-XMXC2XM2.js";
 
 // src/index.ts
 import { readFileSync } from "fs";
@@ -59,8 +61,8 @@ Set up:
 In a project (a git repo or a folder with skilllib.json; never your home folder):
   skilllib status                This project's skills, which agents load them, and issues
   skilllib add <name>...         Install library skills where your harnesses look
-                                 (pinned in skilllib.json when the repo has one, else in your
-                                 personal pins, kept out of git; --personal / --shared to choose)
+                                 (your personal pins, kept out of git; --shared writes
+                                 skilllib.json to commit with the team)
   skilllib remove <name>...      Remove skills from this project
   skilllib link [--all]          Make every skill here usable by all your agents (adds links)
   skilllib tidy [--all|--global] One real copy per skill, plus only the links your agents need
@@ -76,6 +78,8 @@ Library:
   skilllib new <name> [desc]     Create a skill in the library
   skilllib projects              Your projects and their skills
   skilllib usage [--days N]      Which skills agents used (from Claude Code transcripts)
+  skilllib check [--days N]      What global skills and this repo's cost, and whether each was used or is current
+  skilllib plugin off|on <id>    Turn a Claude Code plugin off or on (it stays installed)
 
 Health:
   skilllib doctor [--fix]        Broken links, duplicates, out-of-date projects
@@ -88,7 +92,7 @@ Agents:
                                  Teach your agents to use skilllib, so you can ask them
                                  "which skills can you use here?" in any repo
   --json                         Machine-readable output (status list show projects outdated
-                                 usage doctor apply add remove sync update import global move agent-skill install search)
+                                 usage doctor apply add remove sync update import global move agent-skill install search check plugin)
 
 Options: --force (overwrite local edits)  --allow-tracked (link into git-tracked skill folders)  --days N
 `.trim();
@@ -125,13 +129,15 @@ var FLAGS_OF = {
   doctor: ["fix", "days"],
   apply: ["days"],
   usage: ["days"],
+  check: ["days"],
+  plugin: [],
   install: ["force", "global", "all", "allow-tracked"],
   search: [],
   "agent-skill": [],
   version: [],
   help: []
 };
-var NO_ARGS = /* @__PURE__ */ new Set(["", "ui", "status", "outdated", "list", "projects", "link", "doctor", "usage", "version"]);
+var NO_ARGS = /* @__PURE__ */ new Set(["", "ui", "status", "outdated", "list", "projects", "link", "doctor", "usage", "check", "version"]);
 async function main() {
   const argv = process.argv.slice(2);
   setJsonMode(argv.includes("--json"));
@@ -148,10 +154,10 @@ async function main() {
   if (!["--version", "-v", "version", "help", "--help", "-h"].includes(command ?? "")) refreshAgentSkill();
   switch (command) {
     case void 0:
-      return process.stdin.isTTY && process.stdout.isTTY ? (await import("./tui-3MBVYSVM.js")).tui() : overview(args);
+      return process.stdin.isTTY && process.stdout.isTTY ? (await import("./tui-N6NRJYLZ.js")).tui() : overview(args);
     case "ui":
       if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("`skilllib ui` needs an interactive terminal. Agents and scripts: use `skilllib status --json`.");
-      return (await import("./tui-3MBVYSVM.js")).tui();
+      return (await import("./tui-N6NRJYLZ.js")).tui();
     case "status":
       return status(args);
     case "add":
@@ -196,6 +202,10 @@ async function main() {
       return apply(args);
     case "usage":
       return usage(args);
+    case "check":
+      return check(args);
+    case "plugin":
+      return pluginCommand(args);
     case "agent-skill":
       return agentSkill(args);
     case "install":

package/dist/json.d.cts

@@ -896,6 +896,43 @@ type InstallJson = {
     /** Global folders written, when `--global`. */
     global?: string[];
 }[];
+/** `skilllib check --json`. Computed while the command runs. Nothing is stored. */
+type CheckJson = {
+    days: number;
+    repo: string | null;
+    /** Rough tokens of names and descriptions. Global skills load in every repo; repo skills add to that here. */
+    everyPrompt: {
+        global: number;
+        repo: number;
+    };
+    /** How to read uses and everyPrompt. */
+    note: string;
+    /** The short report. The skill list is there if you need a name. */
+    brief: string[];
+    skills: {
+        name: string;
+        where: "global" | "repo";
+        description: string;
+        everyPrompt: number;
+        uses: number;
+        lastUsed?: string;
+        projects?: string[];
+        fresh: string;
+        lever: "yours" | "plugin" | "built-in" | "claude.ai" | "system" | "skilllib" | "repo";
+        via?: string;
+        path: string;
+        alsoInRepo?: boolean;
+        keptGlobal?: boolean;
+    }[];
+};
+/** `skilllib plugin off|on <id> --json`. One Claude Code install: the copy that loads in every repo, or the only per-repo install. */
+type PluginJson = {
+    id: string;
+    /** The state just set. */
+    on: boolean;
+    ok: boolean;
+    message: string;
+};
 /** `skilllib agent-skill [install|remove] --json` */
 type AgentSkillJson = {
     state: AgentSkillState;
@@ -905,4 +942,4 @@ type AgentSkillJson = {
     removed?: string[];
 };
 
-export type { AgentSkillJson, AgentSkillState, AllChangesJson, ApplyJson, ChangeJson, ChangesJson, DoctorJson, ErrorJson, GitState, GlobalMoveJson, HarnessId, ImportJson, InstallJson, ListJson, OutdatedJson, ProjectSource, ProjectsJson, SearchJson, ShowJson, SkillState, SourceKind, StatusGlobalGroup, StatusIssue, StatusJson, StatusSkillGroup, UsageJson };
+export type { AgentSkillJson, AgentSkillState, AllChangesJson, ApplyJson, ChangeJson, ChangesJson, CheckJson, DoctorJson, ErrorJson, GitState, GlobalMoveJson, HarnessId, ImportJson, InstallJson, ListJson, OutdatedJson, PluginJson, ProjectSource, ProjectsJson, SearchJson, ShowJson, SkillState, SourceKind, StatusGlobalGroup, StatusIssue, StatusJson, StatusSkillGroup, UsageJson };

package/dist/json.d.ts

@@ -896,6 +896,43 @@ type InstallJson = {
     /** Global folders written, when `--global`. */
     global?: string[];
 }[];
+/** `skilllib check --json`. Computed while the command runs. Nothing is stored. */
+type CheckJson = {
+    days: number;
+    repo: string | null;
+    /** Rough tokens of names and descriptions. Global skills load in every repo; repo skills add to that here. */
+    everyPrompt: {
+        global: number;
+        repo: number;
+    };
+    /** How to read uses and everyPrompt. */
+    note: string;
+    /** The short report. The skill list is there if you need a name. */
+    brief: string[];
+    skills: {
+        name: string;
+        where: "global" | "repo";
+        description: string;
+        everyPrompt: number;
+        uses: number;
+        lastUsed?: string;
+        projects?: string[];
+        fresh: string;
+        lever: "yours" | "plugin" | "built-in" | "claude.ai" | "system" | "skilllib" | "repo";
+        via?: string;
+        path: string;
+        alsoInRepo?: boolean;
+        keptGlobal?: boolean;
+    }[];
+};
+/** `skilllib plugin off|on <id> --json`. One Claude Code install: the copy that loads in every repo, or the only per-repo install. */
+type PluginJson = {
+    id: string;
+    /** The state just set. */
+    on: boolean;
+    ok: boolean;
+    message: string;
+};
 /** `skilllib agent-skill [install|remove] --json` */
 type AgentSkillJson = {
     state: AgentSkillState;
@@ -905,4 +942,4 @@ type AgentSkillJson = {
     removed?: string[];
 };
 
-export type { AgentSkillJson, AgentSkillState, AllChangesJson, ApplyJson, ChangeJson, ChangesJson, DoctorJson, ErrorJson, GitState, GlobalMoveJson, HarnessId, ImportJson, InstallJson, ListJson, OutdatedJson, ProjectSource, ProjectsJson, SearchJson, ShowJson, SkillState, SourceKind, StatusGlobalGroup, StatusIssue, StatusJson, StatusSkillGroup, UsageJson };
+export type { AgentSkillJson, AgentSkillState, AllChangesJson, ApplyJson, ChangeJson, ChangesJson, CheckJson, DoctorJson, ErrorJson, GitState, GlobalMoveJson, HarnessId, ImportJson, InstallJson, ListJson, OutdatedJson, PluginJson, ProjectSource, ProjectsJson, SearchJson, ShowJson, SkillState, SourceKind, StatusGlobalGroup, StatusIssue, StatusJson, StatusSkillGroup, UsageJson };

package/dist/{tui-3MBVYSVM.js → tui-N6NRJYLZ.js}

@@ -88,7 +88,7 @@ import {
   versionHistory,
   visibleProjects,
   withoutForceHint
-} from "./chunk-C6TSR7NT.js";
+} from "./chunk-XMXC2XM2.js";
 
 // src/tui/index.tsx
 import { render } from "ink";
@@ -303,17 +303,6 @@ function copyText(text) {
   return { copied: false, savedTo };
 }
 
-// src/search.ts
-function matchScore(text, query) {
-  if (!query) return 0;
-  const t = text.toLowerCase();
-  const q = query.toLowerCase();
-  if (t.startsWith(q)) return 0;
-  if (t.includes(q)) return 1;
-  const initials = t.split(/[-_\s./]+/).filter(Boolean).map((w) => w[0]).join("");
-  return q.length >= 2 && initials.startsWith(q) ? 2 : null;
-}
-
 // src/tui/world.ts
 var failed = (message) => ({ message, failed: true });
 var isFailure = (r) => typeof r !== "string" && "failed" in r;
@@ -624,7 +613,12 @@ function groupLabel(g, names) {
   return `${top} + ${names.length - 1} more \xB7 ${g.label}`;
 }
 function matches(name, query) {
-  return matchScore(name, query) !== null;
+  if (!query) return true;
+  const text = name.toLowerCase();
+  const q = query.toLowerCase();
+  if (text.includes(q)) return true;
+  const initials = text.split(/[-_\s./]+/).filter(Boolean).map((w) => w[0]).join("");
+  return q.length >= 2 && initials.startsWith(q);
 }
 function addRows(w, target, q) {
   const taken = new Set(target ? project(w, target).skills.map((s) => s.name) : []);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skilllib",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Manage your agent skills like dependencies. One library, install from skills.sh, and every agent you use can see them.",
   "keywords": [
     "agent-skills",

package/skills/skilllib/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Bash(skilllib:*)
 
 # skilllib
 
-The user manages agent skills with the `skilllib` CLI. Their **library** (`~/.skilllib/library`, "my skills", "the registry") holds versioned skills that load nowhere until added to a repo. A repo pins its skills in `skilllib.json` (shared, committed), or in the user's personal pins (`~/.skilllib/pins`, kept out of git: `personal: true` in the output).
+The user manages agent skills with the `skilllib` CLI. Their **library** (`~/.skilllib/library`, "my skills", "the registry") holds versioned skills that load nowhere until added to a repo. Adding a skill pins it in the user's personal pins (`~/.skilllib/pins`, kept out of git: `personal: true`). `skilllib.json` is only for sharing a skill with the team, and only when they ask: `--shared` writes it, and they commit it.
 
 Always pass `--json` (one line of JSON on stdout; messages go to stderr). A failure exits 1 with `{"error": "..."}` as that line. `link`, `tidy`, `global` (its listing, `keep` and `unkeep`), `restore`, `new`, `folders`, `harnesses`, `scan`, `search` (without `--json`) and `unhide` print messages only (read the exit code). Unknown flags are errors. Never run bare `skilllib` or `skilllib ui`: that's an interactive app.
 
@@ -23,9 +23,11 @@ The **Now** section at the end has this repo's `status` and `list` output. Answe
 
 Also: `usage --json` (Claude Code usage only, so "unused" is a hint; each skill lists the `projects` that used it), `projects --json` (every repo), `outdated --all --json`, `doctor --json` (every issue in every repo and globally, each with an `id`).
 
+`check --json` reads the global skills and, in a repo, that repo's. It stores nothing. `brief` is the report: how many tokens the names and descriptions cost on every prompt, whether that is heavy, and the cuts that can actually be made. A Claude Code plugin it names turns off with `plugin off <id> --json`, and `plugin on <id>` puts it back. Run that only after the user agrees: the switch is global, and a skill in the plugin that was used goes too. Cursor plugins turn off in Cursor. claude.ai skills turn off on claude.ai. Built-ins ship with Cursor, Codex, and Grok, and skilllib can't unload them. Your own unused globals can move into the repos that need them. `uses` is Claude Code only, so 0 means it wasn't seen. Read `brief` to the user. The `skills` list is there if they ask about one.
+
 ## Changing (ask first unless the user asked for this exact change)
 
-`add <name>...` (pins in `skilllib.json` when the repo has one, else in personal pins; `--personal` / `--shared` choose, and move an existing pin without changing its version) · `remove <name>...` (skills skilllib manages, `source: library`) · `update [name...]` · `sync` (installs what's pinned, in `skilllib.json` and your personal pins; takes no names). Pass several names in one call. Their result is `[{name, action, from, to, dirs, personal, moved, reason, blocked, uncommitted, inTheWay, backedUp}]` (`personal: true` when the pin is in your personal pins; `moved` when `--personal`/`--shared` moved it), which is the whole result: there's no need to check files afterwards. `import <dir>...` (into the library) prints `[{path, name, status}]` and exits 1 if a folder was skipped (`exists`, `no SKILL.md`). `doctor --fix` prints doctor's issues, each fix with `fixed: {ok, message}`.
+`plugin off|on <id>` (a Claude Code plugin, `name@marketplace` from `check`; a name alone works when only one plugin has it; it stays installed. The copy that loads in every repo. A per-repo install is left on, and the message says where) · `add <name>...` (personal pins; `--shared` writes `skilllib.json` for the team, and only when they asked to share it; `--personal` moves a shared pin back. Either flag moves an existing pin without changing its version. A pin stays where it already is) · `remove <name>...` (skills skilllib manages, `source: library`) · `update [name...]` · `sync` (installs what's pinned, personal pins and `skilllib.json`; takes no names). Pass several names in one call. Their result is `[{name, action, from, to, dirs, personal, moved, reason, blocked, uncommitted, inTheWay, backedUp}]` (`personal: true` when the pin is in your personal pins; `moved` when `--personal`/`--shared` moved it), which is the whole result: there's no need to check files afterwards. `import <dir>...` (into the library) prints `[{path, name, status}]` and exits 1 if a folder was skipped (`exists`, `no SKILL.md`). `doctor --fix` prints doctor's issues, each fix with `fixed: {ok, message}`.
 
 - `skipped` + `reason`: nothing changed for that skill, and the command exits 1; tell the user. `--force` overwrites local edits (`backedUp` says where they went; `skilllib restore <name>` brings them back), but only use it with their OK.
 - `removed` + `reason`: removed from skilllib.json, but something was left as it is (its copy behind a folder that links out of the repo, a file of the user's, or a link in such a folder). Tell the user what the reason says is still there.
@@ -33,11 +35,11 @@ Also: `usage --json` (Claude Code usage only, so "unused" is a hint; each skill
 - `inTheWay`: something else is where a link goes (a file, or another copy), so that agent may not run this copy there, and the command exits 1. Tell the user what's there; once they move it, `skilllib link` adds the link. (A skills folder that's a file or links out of the repo makes the skill `skipped` instead, with the reason.)
 - `blocked`: git tracks that folder. Re-run with `--allow-tracked` (for that command only) only with their OK.
 - `uncommitted`: git tracks that folder but not the skill's real copy, so a link there would break for teammates; `--allow-tracked` doesn't change that. Once the copy is committed, `link --allow-tracked` adds it.
-- Changes apply from the agent's next session. For a change without `personal`, remind the user to commit `skilllib.json` and the folders in `dirs`; a `personal` one has nothing to commit.
+- Changes apply from the agent's next session. A `personal` change has nothing to commit. Without `personal` (`--shared`, or a pin that was already in `skilllib.json`), remind the user to commit `skilllib.json` and the folders in `dirs`.
 
 **Prefer per-repo skills to global ones.** A global skill loads in every repo, for every agent. When `usage --json` shows one used in only a few repos, propose moving it there:
 
-- `global move <name>... --to <repo>[,<repo>...]` (a project name from `projects`, or the path of a repo's top folder): imports it into the library, adds it to each repo, and only then stops loading it globally (restorable with `skilllib restore`). Prints `[{skill, moved, reason, left, projects: [{project, path, change}]}]` (`left`: links in a repo or its packages that now point at nothing, though a copy in the repo still serves them; tell the user to remove them); `moved: false` means it still loads globally, and `reason` says why (for example, git tracks the folder a link goes in, so an agent couldn't see it there: re-run with `--allow-tracked` only with the user's OK).
+- `global move <name>... --to <repo>[,<repo>...]` (a project name from `projects`, or the path of a repo's top folder): imports it into the library, adds it to each repo, and only then stops loading it globally (restorable with `skilllib restore`). Prints `[{skill, moved, reason, left, projects: [{project, path, change}]}]` (`left`: links in a repo or its packages that now point at nothing, though a copy in the repo still serves them; tell the user to remove them); `moved: false` means it still loads globally, and `reason` says why.
 - `global keep <name>...`: the user wants it everywhere; skilllib stops flagging it.
 
 **Fixes and decisions.** `apply <id> [choice]` runs one problem's `fix`, or the choice you name: its label (safest), or its number from 1. With several choices it needs one. Prints `{id, applied, ok, message}`. Ids come from `issues` in `status --json` (Now, below) or from `doctor --json` (every repo; pass `apply` the same `--days` you gave `doctor`). A few issues span repos and offer different choices in each; then `apply` takes only the label.