skillmds 1.1.1 → 1.2.0

package/dist/cli.js

@@ -1,136 +1,54 @@
+import {
+  IntegrityError,
+  RegistryError,
+  agentDir,
+  agentSupportsGlobal,
+  canonicalDir,
+  collectFiles,
+  configPath,
+  createClient,
+  detectAgents,
+  digestOf,
+  fetchBundle,
+  gigetInput,
+  hostOf,
+  installSkill,
+  isSkillDirOrLink,
+  listInstalled,
+  looksLikeProject,
+  parseSource,
+  readConfig,
+  readLock,
+  resolveApi,
+  resolvePackFiles,
+  resolveSource,
+  resolveTree,
+  safeText,
+  skillMdFor,
+  sourceId,
+  telemetryDisabled,
+  uninstallSkill,
+  upsertEntry,
+  writeConfig
+} from "./chunk-A7BKAUUO.js";
+
 // src/index.ts
 import { Command as Command13 } from "commander";
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
+import pc15 from "picocolors";
 
 // src/commands/lint.ts
 import { Command } from "commander";
 import { writeFileSync } from "fs";
-import { homedir } from "os";
-import { resolve } from "path";
+import { homedir as homedir2 } from "os";
+import { resolve as resolve2 } from "path";
 import pc2 from "picocolors";
 import * as p from "@clack/prompts";
 import { lint, toJson, toSarif, toGithub } from "@skillmds/core";
 
-// src/source.ts
-import { existsSync, statSync, lstatSync, readFileSync, readdirSync, mkdtempSync, rmSync } from "fs";
-import { tmpdir } from "os";
-import { join, basename, dirname, relative, sep } from "path";
-var IGNORE_DIRS = /* @__PURE__ */ new Set([
-  // build/dependency dirs
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  "out",
-  ".next",
-  ".wrangler",
-  ".cache",
-  ".npm",
-  ".pnpm-store",
-  ".venv",
-  "venv",
-  "__pycache__",
-  "target",
-  "vendor",
-  // large OS / user dirs (mostly relevant when run from a home directory)
-  "AppData",
-  "Library",
-  "$Recycle.Bin",
-  "System Volume Information",
-  "Windows",
-  "Program Files"
-]);
-var MAX_DEPTH = 12;
-function findSkillFiles(dir, depth = 0) {
-  const out = [];
-  if (depth > MAX_DEPTH) return out;
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return out;
-  }
-  for (const entry of entries) {
-    if (entry.isDirectory()) {
-      if (IGNORE_DIRS.has(entry.name)) continue;
-      out.push(...findSkillFiles(join(dir, entry.name), depth + 1));
-    } else if (entry.name === "SKILL.md") {
-      out.push(join(dir, entry.name));
-    }
-  }
-  return out;
-}
-function loadLocal(file) {
-  return { path: file, raw: readFileSync(file, "utf8"), slug: basename(dirname(file)), file };
-}
-function isLikelyLocal(arg) {
-  return arg === "." || arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(arg) || existsSync(arg);
-}
-async function resolveSource(arg) {
-  if (isLikelyLocal(arg)) {
-    if (!existsSync(arg)) throw new Error(`Path not found: ${arg}`);
-    const st = statSync(arg);
-    if (st.isFile()) return [loadLocal(arg)];
-    const files2 = findSkillFiles(arg);
-    if (files2.length === 0) {
-      throw new Error(`No SKILL.md found under ${arg}. Point at a skill directory, e.g. "skillmd lint ./my-skill", or run "skillmd init" to create one.`);
-    }
-    return files2.map(loadLocal);
-  }
-  const { downloadTemplate } = await import("giget");
-  const input = normalizeGiget(arg);
-  const dir = mkdtempSync(join(tmpdir(), "skillmd-src-"));
-  const { dir: out } = await downloadTemplate(input, { dir, forceClean: true });
-  const files = findSkillFiles(out);
-  if (files.length === 0) throw new Error(`No SKILL.md found in ${arg}`);
-  return files.map(loadLocal);
-}
-var MAX_PACK_FILES = 200;
-var MAX_PACK_BYTES = 20 * 1024 * 1024;
-function collectFiles(root, dir, limits = {}) {
-  const maxFiles = limits.maxFiles ?? MAX_PACK_FILES;
-  const maxBytes = limits.maxBytes ?? MAX_PACK_BYTES;
-  const out = [];
-  let bytes = 0;
-  const walk = (d, depth) => {
-    if (depth > MAX_DEPTH) return;
-    for (const entry of readdirSync(d, { withFileTypes: true })) {
-      const fp = join(d, entry.name);
-      const st = lstatSync(fp);
-      if (st.isSymbolicLink()) continue;
-      if (st.isDirectory()) {
-        if (entry.name === ".git" || entry.name === "node_modules") continue;
-        walk(fp, depth + 1);
-      } else if (st.isFile()) {
-        if (out.length >= maxFiles) throw new Error(`pack too large: > ${maxFiles} files`);
-        bytes += st.size;
-        if (bytes > maxBytes) throw new Error(`pack too large: > ${Math.round(maxBytes / (1024 * 1024))}MB`);
-        out.push({ path: relative(root, fp).split(sep).join("/"), contents: readFileSync(fp) });
-      }
-    }
-  };
-  walk(dir, 0);
-  return out;
-}
-async function resolveTree(sourceUrl, ref) {
-  const { downloadTemplate } = await import("giget");
-  const input = normalizeGiget(sourceUrl) + (ref ? `#${ref}` : "");
-  const dir = mkdtempSync(join(tmpdir(), "skillmd-pack-"));
-  try {
-    const { dir: out } = await downloadTemplate(input, { dir, forceClean: true });
-    return collectFiles(out, out);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-function normalizeGiget(arg) {
-  const m = arg.match(/github\.com\/([^/]+)\/([^/]+)(?:\/tree\/[^/]+\/(.+))?/);
-  if (m) return `github:${m[1]}/${m[2]}${m[3] ? "/" + m[3] : ""}`;
-  if (arg.startsWith("github:") || arg.startsWith("gh:")) return arg;
-  return `github:${arg}`;
-}
-
 // src/ui.ts
+import { homedir } from "os";
+import { relative, resolve, sep } from "path";
 import pc from "picocolors";
 var decorate = (text3, kind) => {
   switch (kind) {
@@ -154,7 +72,11 @@ var SEV_COLOR = {
 var GLYPH = {
   error: "\u2716",
   warn: "\u26A0",
-  info: "\u2139"
+  info: "\u2139",
+  ok: "\u2713",
+  skip: "\u21B7",
+  blocked: "\u2717",
+  replaced: "\u26A0"
 };
 var SEC_GLYPH = "\u2691";
 var SEV_ORDER = ["error", "warn", "info"];
@@ -188,7 +110,7 @@ function statusDot(result) {
   return attention ? pc.yellow("\u25CF") : pc.green("\u25CF");
 }
 function failureBlock(file, result) {
-  const lines = [`${pc.red("\u2716")} ${pc.bold(label(file))}`];
+  const lines = [`${pc.red(GLYPH.error)} ${pc.bold(label(file))}`];
   for (const d of result.diagnostics.filter((x) => x.severity === "error")) {
     const loc = d.line !== void 0 ? pc.dim(`:${d.line}`) : "";
     lines.push(`    ${SEV_COLOR.error(d.id)}${loc}  ${d.message}`);
@@ -242,7 +164,7 @@ function renderMany(results) {
 }
 function renderFailuresView(results) {
   const fails = results.filter((r) => !r.result.ok);
-  if (!fails.length) return pc.green(`\u2713 No failures across ${results.length} skill${results.length === 1 ? "" : "s"}.`);
+  if (!fails.length) return pc.green(`${GLYPH.ok} No failures across ${results.length} skill${results.length === 1 ? "" : "s"}.`);
   const out = fails.map((f) => failureBlock(f.file, f.result));
   out.push("");
   out.push(`${pc.red(`${fails.length} failed`)} ${pc.dim(`of ${results.length}`)}`);
@@ -263,6 +185,88 @@ function exitCodeFor(results, policy = {}) {
   }
   return 0;
 }
+function shortPath(p7, ctx = {}) {
+  const home = resolve(ctx.home ?? homedir());
+  const cwd = resolve(ctx.cwd ?? process.cwd());
+  const abs = resolve(p7);
+  const norm = (s) => s.split(sep).join("/");
+  if (abs === cwd) return ".";
+  if (abs.startsWith(cwd + sep)) return `./${norm(relative(cwd, abs))}`;
+  if (abs === home) return "~";
+  if (abs.startsWith(home + sep)) return `~/${norm(relative(home, abs))}`;
+  return norm(abs);
+}
+var SGR = /\x1b\[[0-9;]*m/g;
+var SGR_AT = /\x1b\[[0-9;]*m/y;
+var RESET = "\x1B[0m";
+function stripAnsi(s) {
+  return s.replace(SGR, "");
+}
+var visible = (s) => stripAnsi(s).length;
+function truncateVisible(s, max) {
+  if (max <= 0) return "";
+  if (visible(s) <= max) return s;
+  let out = "";
+  let shown = 0;
+  let open = false;
+  for (let i = 0; i < s.length && shown < max - 1; ) {
+    if (s[i] === "\x1B") {
+      SGR_AT.lastIndex = i;
+      const m = SGR_AT.exec(s);
+      if (m) {
+        out += m[0];
+        open = m[0] !== RESET && m[0] !== "\x1B[m";
+        i += m[0].length;
+        continue;
+      }
+    }
+    out += s[i];
+    shown++;
+    i++;
+  }
+  return out + "\u2026" + (open ? RESET : "");
+}
+var termWidth = (w) => w ?? Math.min(process.stdout.columns ?? 100, 120);
+function table(rows, opts = {}) {
+  if (rows.length === 0) return "";
+  const width = termWidth(opts.width);
+  const indent = opts.indent ?? "";
+  const cols = Math.max(...rows.map((r) => r.length));
+  const widths = Array.from({ length: cols }, (_, i) => Math.max(...rows.map((r) => visible(r[i] ?? ""))));
+  return rows.map((r) => {
+    let line = indent;
+    for (let i = 0; i < cols; i++) {
+      const cell = r[i] ?? "";
+      if (i < cols - 1) {
+        line += cell + " ".repeat(widths[i] - visible(cell) + 2);
+        continue;
+      }
+      line += truncateVisible(cell, Math.max(4, width - visible(line)));
+    }
+    line = line.trimEnd();
+    return visible(line) > width ? truncateVisible(line, width) : line;
+  }).join("\n");
+}
+function renderInstallSummary(i, ctx = {}) {
+  const width = termWidth(ctx.width);
+  const src = i.source.startsWith("local:") ? `local:${shortPath(i.source.slice(6), ctx)}` : i.source;
+  const head = truncateVisible(
+    pc.green(`${GLYPH.ok} ${i.name}`) + pc.dim(`  score ${i.score}${i.flags.length ? `  ${i.flags.join(", ")}` : ""}  from ${src}`),
+    width
+  );
+  const byPath = /* @__PURE__ */ new Map();
+  for (const t of i.targets) {
+    const e = byPath.get(t.path);
+    if (e) e.agents.push(t.agent);
+    else byPath.set(t.path, { agents: [t.agent], mode: t.mode });
+  }
+  const rows = [...byPath.entries()].map(([path, e]) => [pc.cyan(e.agents.join(", ")), pc.dim(e.mode), shortPath(path, ctx)]);
+  const body = rows.length ? table(rows, { width, indent: "  " }) : truncateVisible(pc.dim(`  ${shortPath(i.canonical, ctx)}  canonical only`), width);
+  const skipped = i.skipped.map((s) => truncateVisible(pc.dim(`  ${GLYPH.skip} ${s.agent}: ${s.reason}`), width));
+  const replaced = i.replaced ? [truncateVisible(pc.yellow(`  ${GLYPH.replaced} replaced previous install (${i.replaced === "untracked" ? "untracked directory" : i.replaced})`), width)] : [];
+  return [head, body, ...skipped, ...replaced].join("\n");
+}
+var banner = () => pc.bgCyan(pc.black(" skillmd "));
 
 // src/commands/lint.ts
 function applyLicenseFix(raw) {
@@ -304,9 +308,9 @@ async function runLint(target, flags) {
   return { results, output, exitCode };
 }
 function lintCommand() {
-  return new Command("lint").alias("check").description("Validate SKILL.md file(s) against the spec and report a quality score").argument("[target]", "local path or GitHub source", ".").option("--format <fmt>", "text | json | sarif | github", "text").option("--strict", "treat warnings as errors").option("--fail-on-warning", "exit non-zero when warnings exist").option("--fix", "apply safe automatic fixes (e.g. add missing license)").option("--errors-only", "show only skills that failed").action(async (target, opts) => {
+  return new Command("lint").description("Validate SKILL.md file(s) against the spec and report a quality score").argument("[target]", "local path or GitHub source", ".").option("--format <fmt>", "text | json | sarif | github", "text").option("--strict", "treat warnings as errors").option("--fail-on-warning", "exit non-zero when warnings exist").option("--fix", "apply safe automatic fixes (e.g. add missing license)").option("--errors-only", "show only skills that failed").action(async (target, opts) => {
     const ui = Boolean(process.stdout.isTTY) && opts.format === "text";
-    if (resolve(target) === homedir()) {
+    if (resolve2(target) === homedir2()) {
       process.stderr.write(pc2.yellow(`Warning: scanning your entire home directory. Pass a narrower path, e.g. skillmd lint ./my-skill
 `));
     }
@@ -402,10 +406,43 @@ function rulesCommand() {
 
 // src/commands/init.ts
 import { Command as Command4 } from "commander";
-import { mkdirSync, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
+import { mkdirSync, writeFileSync as writeFileSync2, existsSync } from "fs";
+import { join } from "path";
 import { slugify } from "@skillmds/core";
 import * as p2 from "@clack/prompts";
+import pc5 from "picocolors";
+
+// src/env.ts
+function detectHostAgent(env = process.env) {
+  if (env.CLAUDECODE) return "claude-code";
+  if (env.CURSOR_AGENT || env.CURSOR_EXTENSION_HOST_ROLE === "agent-exec") return "cursor";
+  if (env.CODEX_SANDBOX || env.CODEX_THREAD_ID) return "codex";
+  if (env.GEMINI_CLI) return "gemini-cli";
+  if (env.CI && env.CI !== "false" && env.CI !== "0") return "ci";
+  return null;
+}
+var realTerminal = () => ({
+  stdinTTY: Boolean(process.stdin.isTTY),
+  stdoutTTY: Boolean(process.stdout.isTTY),
+  env: process.env
+});
+function isInteractive(flags, term = realTerminal()) {
+  if (flags.yes || flags.json) return false;
+  if (!term.stdinTTY || !term.stdoutTTY) return false;
+  return detectHostAgent(term.env) === null;
+}
+function scopesFor(flags) {
+  return flags.global && !flags.project ? [true] : flags.project && !flags.global ? [false] : [false, true];
+}
+function nonInteractiveHint(flags) {
+  return `Interactive prompt required but stdin is not a terminal. Nothing was changed. Re-run with ${flags} to run non-interactively.`;
+}
+function promptIf(flags, prompt) {
+  const term = { stdinTTY: Boolean(process.stdin.isTTY), stdoutTTY: Boolean(process.stdout.isTTY), env: flags.env ?? process.env };
+  return isInteractive(flags, term) ? { prompt } : {};
+}
+
+// src/commands/init.ts
 function skillTemplate(name, description, license) {
   const desc = description.trim() || `A skill that helps agents with ${name}.`;
   return `---
@@ -434,134 +471,54 @@ Add any constraints, edge cases, or references the agent should keep in mind.
 }
 function initSkill(name, opts = {}) {
   const slug = slugify(name);
-  const root = join2(opts.dir ?? process.cwd(), slug);
-  if (existsSync2(join2(root, "SKILL.md"))) throw new Error(`SKILL.md already exists at ${root}`);
+  const root = join(opts.dir ?? process.cwd(), slug);
+  if (existsSync(join(root, "SKILL.md"))) throw new Error(`SKILL.md already exists at ${root}`);
   mkdirSync(root, { recursive: true });
-  const file = join2(root, "SKILL.md");
+  const file = join(root, "SKILL.md");
   writeFileSync2(file, skillTemplate(name, opts.description ?? "", opts.license ?? "MIT"), "utf8");
   return file;
 }
-function initCommand() {
-  return new Command4("init").description("Scaffold a new SKILL.md from a template").argument("[name]", "skill name").option("--name <name>", "skill name (non-interactive)").option("--description <text>", "skill description").option("--license <license>", "license identifier", "MIT").option("-y, --yes", "skip prompts").action(async (nameArg, opts) => {
-    let name = nameArg ?? opts.name;
-    if (!name && !opts.yes) {
-      const answer = await p2.text({ message: "Skill name?", placeholder: "my-skill" });
-      if (p2.isCancel(answer)) {
-        p2.cancel("Cancelled.");
-        return;
-      }
-      name = answer;
-    }
-    if (!name) {
-      console.error("A skill name is required (pass a name or --name).");
-      process.exitCode = 1;
-      return;
+var defaultInitDeps = (flags) => promptIf(flags, async () => {
+  const answer = await p2.text({ message: "Skill name?", placeholder: "my-skill" });
+  return p2.isCancel(answer) ? null : answer;
+});
+function finish(flags, result, doc) {
+  return flags.json ? { ...result, output: JSON.stringify(doc, null, 2) } : result;
+}
+async function runInit(nameArg, flags, deps = defaultInitDeps(flags)) {
+  let name = nameArg ?? flags.name;
+  if (!name) {
+    if (!deps.prompt) {
+      const error = nonInteractiveHint("a name argument or --name <name>");
+      return finish(flags, { exitCode: 1, output: pc5.red(error) }, { ok: false, error });
     }
-    const file = initSkill(name, { description: opts.description, license: opts.license });
-    console.log(`Created ${file}`);
-  });
-}
-
-// src/commands/search.ts
-import { Command as Command5 } from "commander";
-import pc5 from "picocolors";
-
-// src/api.ts
-import { createHash } from "crypto";
-import { isAllowedSourceUrl } from "@skillmds/core";
-
-// src/config.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-var DEFAULT_API = "https://api.skillmd.com";
-function configPath() {
-  return join3(homedir2(), ".skillmd", "config.json");
-}
-function readConfig() {
-  try {
-    return JSON.parse(readFileSync2(configPath(), "utf8"));
-  } catch {
-    return {};
-  }
-}
-function writeConfig(cfg) {
-  const dir = join3(homedir2(), ".skillmd");
-  mkdirSync2(dir, { recursive: true });
-  writeFileSync3(configPath(), JSON.stringify(cfg, null, 2), { encoding: "utf8", mode: 384 });
-}
-function resolveToken(flags = {}) {
-  return flags.token || process.env.SKILLMD_TOKEN || readConfig().token || void 0;
-}
-function resolveApi(flags = {}) {
-  return flags.api || process.env.SKILLMD_API || readConfig().api || DEFAULT_API;
-}
-
-// src/api.ts
-import { isAllowedSourceUrl as isAllowedSourceUrl2, reconstructSkillMd, skillMdFor } from "@skillmds/core";
-var IntegrityError = class extends Error {
-  integrity = true;
-  constructor(message) {
-    super(message);
-    this.name = "IntegrityError";
+    const answer = await deps.prompt();
+    if (answer === null) return finish(flags, { exitCode: 0, output: pc5.dim("Cancelled.") }, { ok: false, cancelled: true });
+    name = answer;
   }
-};
-var RegistryError = class extends Error {
-  constructor(message, status) {
-    super(message);
-    this.status = status;
-    this.name = "RegistryError";
-  }
-  status;
-};
-function createClient(flags = {}) {
-  const base = resolveApi(flags);
-  const token = resolveToken(flags);
-  async function api(path, init = {}) {
-    const headers = { accept: "application/json", ...init.headers };
-    if (token) headers.authorization = `Bearer ${token}`;
-    let res;
-    try {
-      res = await fetch(base + path, { ...init, headers });
-    } catch (e) {
-      const cause = e instanceof Error ? e.cause?.message ?? e.message : String(e);
-      throw new RegistryError(`could not reach ${base}: ${cause}`);
-    }
-    if (!res.ok) {
-      const detail = await res.text().catch(() => "");
-      throw new RegistryError(`SkillMD API ${res.status} on ${path}: ${detail}`, res.status);
-    }
-    return await res.json();
+  if (!name) {
+    const error = "A skill name is required (pass a name or --name).";
+    return finish(flags, { exitCode: 1, output: pc5.red(error) }, { ok: false, error });
   }
-  return { api, base, token, hasToken: Boolean(token) };
-}
-async function fetchBundle(base, slug, token) {
-  const headers = { accept: "application/json" };
-  if (token) headers.authorization = `Bearer ${token}`;
-  const res = await fetch(`${base}/api/skills/${slug}/bundle?format=json`, { headers }).catch(() => null);
-  if (!res || !res.ok) return null;
-  const data = await res.json().catch(() => null);
-  if (!data?.files) return null;
-  const out = [];
-  for (const f of data.files) {
-    if (f.content_base64 != null) {
-      const contents = Buffer.from(f.content_base64, "base64");
-      if (f.sha256) {
-        const got = createHash("sha256").update(contents).digest("hex");
-        if (got !== f.sha256) {
-          throw new IntegrityError(`integrity check failed for "${f.path}" (expected ${f.sha256.slice(0, 12)}\u2026, got ${got.slice(0, 12)}\u2026)`);
-        }
-      }
-      out.push({ path: f.path, contents });
-    } else if (f.source_url && isAllowedSourceUrl(f.source_url)) {
-      const r = await fetch(f.source_url).catch(() => null);
-      if (r && r.ok) out.push({ path: f.path, contents: Buffer.from(await r.arrayBuffer()) });
-    }
+  try {
+    const file = initSkill(name, { dir: flags.dir, description: flags.description, license: flags.license });
+    return { exitCode: 0, file, output: flags.json ? JSON.stringify({ ok: true, file }, null, 2) : `Created ${file}` };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { exitCode: 1, output: flags.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : pc5.red(msg) };
   }
-  return out;
+}
+function initCommand() {
+  return new Command4("init").description("Scaffold a new SKILL.md from a template").argument("[name]", "skill name").option("--name <name>", "skill name (non-interactive)").option("--description <text>", "skill description").option("--license <license>", "license identifier", "MIT").option("--json", "machine-readable output").option("-y, --yes", "skip prompts").action(async (nameArg, opts, cmd) => {
+    const r = await runInit(nameArg, { ...cmd.parent?.opts(), ...opts });
+    console.log(r.output);
+    process.exitCode = r.exitCode;
+  });
 }
 
 // src/commands/search.ts
+import { Command as Command5 } from "commander";
+import pc6 from "picocolors";
 var MAX_LINE_WIDTH = 100;
 function formatStars(n) {
   if (n >= 1e6) {
@@ -580,13 +537,13 @@ function truncate(text3, width) {
   return `${text3.slice(0, width - 1).trimEnd()}\u2026`;
 }
 function formatSearchResult(item, width = process.stdout.columns ?? 80) {
-  const stars = item.repo_stars != null ? pc5.dim(`\u2605 ${formatStars(item.repo_stars)}`) : "";
-  const check = item.verified ? pc5.green("\u2713") : "";
-  const pack = item.type === "pack" ? pc5.dim("[pack]") : "";
-  const head = [pc5.bold(item.slug), stars, check, pack].filter(Boolean).join(" ");
+  const stars = item.repo_stars != null ? pc6.dim(`\u2605 ${formatStars(item.repo_stars)}`) : "";
+  const check = item.verified ? pc6.green("\u2713") : "";
+  const pack = item.type === "pack" ? pc6.dim("[pack]") : "";
+  const head = [pc6.bold(safeText(item.slug, 200)), stars, check, pack].filter(Boolean).join(" ");
   const indent = "  ";
   const lineWidth = Math.max(10, Math.min(width, MAX_LINE_WIDTH) - indent.length);
-  const desc = `${indent}${pc5.dim(truncate(item.description ?? "", lineWidth))}`;
+  const desc = `${indent}${pc6.dim(truncate(safeText(item.description ?? ""), lineWidth))}`;
   return `${head}
 ${desc}`;
 }
@@ -613,42 +570,44 @@ function searchCommand() {
 
 // src/commands/info.ts
 import { Command as Command6 } from "commander";
-import pc6 from "picocolors";
-async function runInfo(slug, flags) {
+import pc7 from "picocolors";
+async function runInfo(slug, flags, deps = {}) {
   const [owner, name] = slug.split("/");
   if (!owner || !name || slug.split("/").length !== 2) {
-    return { ok: false, exitCode: 1, output: pc6.red("Expected owner/name, e.g. anthropic/pdf") };
+    return { ok: false, exitCode: 1, output: pc7.red("Expected owner/name, e.g. anthropic/pdf") };
   }
-  const { api } = createClient(flags);
+  const api = deps.api ?? createClient(flags).api;
   let s;
   try {
     s = await api(`/api/skills/${owner}/${name}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     if (/^SkillMD API 404 /.test(message)) {
-      return { ok: false, exitCode: 1, output: pc6.red(`Skill not found on the registry: ${slug}`) };
+      return { ok: false, exitCode: 1, output: pc7.red(`Skill not found on the registry: ${slug}`) };
     }
-    return { ok: false, exitCode: 1, output: pc6.red(`Could not reach the SkillMD registry: ${message}`) };
+    return { ok: false, exitCode: 1, output: pc7.red(`Could not reach the SkillMD registry: ${message}`) };
   }
   if (flags.json) return { ok: true, exitCode: 0, output: JSON.stringify(s, null, 2), skill: s };
+  const slugTxt = safeText(s.slug, 200);
   const lines = [];
   lines.push(
-    `${pc6.bold(s.slug)} ${pc6.dim(`[${s.type ?? "single"}]`)} ${s.verified ? pc6.green("\u2713 verified") : pc6.yellow("unverified")}`
+    `${pc7.bold(slugTxt)} ${pc7.dim(`[${safeText(s.type ?? "single", 40)}]`)} ${s.verified ? pc7.green("\u2713 verified") : pc7.yellow("unverified")}`
   );
-  lines.push(`  ${s.description}`);
+  lines.push(`  ${safeText(s.description)}`);
   lines.push(
-    pc6.dim(
-      `  category: ${s.category ?? "-"} \xB7 rating: ${s.avg_rating != null ? s.avg_rating.toFixed(1) : "-"} (${s.rating_count ?? 0}) \xB7 installs: ${s.install_count ?? 0}`
+    pc7.dim(
+      `  category: ${safeText(s.category ?? "-", 100) || "-"} \xB7 rating: ${s.avg_rating != null ? s.avg_rating.toFixed(1) : "-"} (${s.rating_count ?? 0}) \xB7 installs: ${s.install_count ?? 0}`
     )
   );
+  const securityFlags2 = (s.security_flags ?? []).map((f) => safeText(f, 60)).filter(Boolean);
   lines.push(
-    pc6.dim(`  security: ${(s.security_flags ?? []).join(", ") || "unscanned"} \xB7 license: ${s.provenance?.license ?? s.license ?? "unknown"}`)
+    pc7.dim(`  security: ${securityFlags2.join(", ") || "unscanned"} \xB7 license: ${safeText(s.provenance?.license ?? s.license ?? "unknown", 100) || "unknown"}`)
   );
-  const sourceRepo = s.provenance?.source_repo ?? s.source_repo;
-  const commitSha = s.provenance?.commit_sha ?? s.commit_sha;
-  if (sourceRepo) lines.push(pc6.dim(`  source: ${sourceRepo}${commitSha ? ` @ ${commitSha.slice(0, 8)}` : ""}`));
-  lines.push(pc6.dim(`  page: https://skillmd.com/skills/${s.slug}`));
-  lines.push(pc6.dim(`  install: ${s.install?.cli ?? `npx skillmds add ${s.slug}`}`));
+  const sourceRepo = safeText(s.provenance?.source_repo ?? s.source_repo, 300);
+  const commitSha = safeText(s.provenance?.commit_sha ?? s.commit_sha, 100);
+  if (sourceRepo) lines.push(pc7.dim(`  source: ${sourceRepo}${commitSha ? ` @ ${commitSha.slice(0, 8)}` : ""}`));
+  lines.push(pc7.dim(`  page: https://skillmd.com/skills/${slugTxt}`));
+  lines.push(pc7.dim(`  install: ${safeText(s.install?.cli, 300) || `npx skillmds add ${slugTxt}`}`));
   return { ok: true, exitCode: 0, output: lines.join("\n"), skill: s };
 }
 function infoCommand() {
@@ -662,154 +621,46 @@ function infoCommand() {
 
 // src/commands/add.ts
 import { Command as Command7, Option } from "commander";
-import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { resolve as resolve3 } from "path";
-import pc7 from "picocolors";
-import { lint as lint2 } from "@skillmds/core";
-
-// src/agents.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync as rmSync2, symlinkSync, existsSync as existsSync3, readdirSync as readdirSync2, statSync as statSync2, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join4, resolve as resolve2, dirname as dirname2, sep as sep2 } from "path";
-var AGENTS = [
-  { id: "claude-code", project: [".claude", "skills"], global: [".claude", "skills"], detect: [[".claude"]] },
-  { id: "cursor", project: [".cursor", "skills"], global: [".cursor", "skills"], detect: [[".cursor"]] },
-  { id: "codex", project: [".codex", "skills"], global: [".codex", "skills"], detect: [[".codex"]] },
-  { id: "windsurf", project: [".windsurf", "skills"], global: [".codeium", "windsurf", "skills"], detect: [[".codeium", "windsurf"], [".windsurf"]] },
-  { id: "opencode", project: [".opencode", "skills"], global: [".config", "opencode", "skills"], detect: [[".config", "opencode"], [".opencode"]] },
-  { id: "gemini-cli", project: [".agents", "skills"], global: [".gemini", "skills"], detect: [[".gemini"]] },
-  { id: "antigravity", project: [".agents", "skills"], global: [".gemini", "antigravity", "skills"], detect: [[".gemini", "antigravity"], [".antigravity"]] },
-  { id: "kiro", project: [".kiro", "skills"], global: [".kiro", "skills"], detect: [[".kiro"]] },
-  { id: "warp", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".warp"]] },
-  { id: "github-copilot", project: [".agents", "skills"], global: [".copilot", "skills"], detect: [[".copilot"]] },
-  { id: "cline", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".cline"]] },
-  { id: "roo", project: [".roo", "skills"], global: [".roo", "skills"], detect: [[".roo"]] },
-  { id: "goose", project: [".goose", "skills"], global: [".config", "goose", "skills"], detect: [[".config", "goose"]] },
-  { id: "trae", project: [".trae", "skills"], global: [".trae", "skills"], detect: [[".trae"]] },
-  { id: "qwen-code", project: [".qwen", "skills"], global: [".qwen", "skills"], detect: [[".qwen"]] },
-  { id: "amp", project: [".agents", "skills"], global: [".config", "agents", "skills"], detect: [[".config", "amp"]] },
-  // — extended registry —
-  { id: "openclaw", project: ["skills"], global: [".openclaw", "skills"], detect: [[".openclaw"], [".clawdbot"], [".moltbot"]] },
-  { id: "kilo", project: [".kilocode", "skills"], global: [".kilocode", "skills"], detect: [[".kilocode"]] },
-  { id: "hermes-agent", project: [".hermes", "skills"], global: [".hermes", "skills"], detect: [[".hermes"]] },
-  { id: "continue", project: [".continue", "skills"], global: [".continue", "skills"], detect: [[".continue"]] },
-  { id: "devin", project: [".devin", "skills"], global: [".config", "devin", "skills"], detect: [[".config", "devin"]] },
-  { id: "openhands", project: [".openhands", "skills"], global: [".openhands", "skills"], detect: [[".openhands"]] },
-  { id: "replit", project: [".agents", "skills"], global: [".config", "agents", "skills"], detect: [[".replit"]] },
-  { id: "mistral-vibe", project: [".vibe", "skills"], global: [".vibe", "skills"], detect: [[".vibe"]] },
-  { id: "zed", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".config", "zed"]] },
-  { id: "adal", project: [".adal", "skills"], global: [".adal", "skills"], detect: [[".adal"]] },
-  { id: "aider-desk", project: [".aider-desk", "skills"], global: [".aider-desk", "skills"], detect: [[".aider-desk"]] },
-  { id: "antigravity-cli", project: [".agents", "skills"], global: [".gemini", "antigravity-cli", "skills"], detect: [[".gemini", "antigravity-cli"]] },
-  { id: "augment", project: [".augment", "skills"], global: [".augment", "skills"], detect: [[".augment"]] },
-  { id: "autohand-code", project: [".autohand", "skills"], global: [".autohand", "skills"], detect: [[".autohand"]] },
-  { id: "bob", project: [".bob", "skills"], global: [".bob", "skills"], detect: [[".bob"]] },
-  { id: "codearts-agent", project: [".codeartsdoer", "skills"], global: [".codeartsdoer", "skills"], detect: [[".codeartsdoer"]] },
-  { id: "codebuddy", project: [".codebuddy", "skills"], global: [".codebuddy", "skills"], detect: [[".codebuddy"]] },
-  { id: "codemaker", project: [".codemaker", "skills"], global: [".codemaker", "skills"], detect: [[".codemaker"]] },
-  { id: "codestudio", project: [".codestudio", "skills"], global: [".codestudio", "skills"], detect: [[".codestudio"]] },
-  { id: "command-code", project: [".commandcode", "skills"], global: [".commandcode", "skills"], detect: [[".commandcode"]] },
-  { id: "cortex", project: [".cortex", "skills"], global: [".snowflake", "cortex", "skills"], detect: [[".snowflake", "cortex"]] },
-  { id: "crush", project: [".crush", "skills"], global: [".config", "crush", "skills"], detect: [[".config", "crush"]] },
-  { id: "deepagents", project: [".agents", "skills"], global: [".deepagents", "agent", "skills"], detect: [[".deepagents"]] },
-  { id: "dexto", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".dexto"]] },
-  { id: "droid", project: [".factory", "skills"], global: [".factory", "skills"], detect: [[".factory"]] },
-  { id: "firebender", project: [".agents", "skills"], global: [".firebender", "skills"], detect: [[".firebender"]] },
-  { id: "forgecode", project: [".forge", "skills"], global: [".forge", "skills"], detect: [[".forge"]] },
-  { id: "iflow-cli", project: [".iflow", "skills"], global: [".iflow", "skills"], detect: [[".iflow"]] },
-  { id: "inference-sh", project: [".inferencesh", "skills"], global: [".inferencesh", "skills"], detect: [[".inferencesh"]] },
-  { id: "jazz", project: [".jazz", "skills"], global: [".jazz", "skills"], detect: [[".jazz"]] },
-  { id: "junie", project: [".junie", "skills"], global: [".junie", "skills"], detect: [[".junie"]] },
-  { id: "kimi-code-cli", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".kimi-code"], [".kimi"]] },
-  { id: "kode", project: [".kode", "skills"], global: [".kode", "skills"], detect: [[".kode"]] },
-  { id: "lingma", project: [".lingma", "skills"], global: [".lingma", "skills"], detect: [[".lingma"]] },
-  { id: "loaf", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".loaf"]] },
-  { id: "mcpjam", project: [".mcpjam", "skills"], global: [".mcpjam", "skills"], detect: [[".mcpjam"]] },
-  { id: "moxby", project: [".moxby", "skills"], global: [".moxby", "skills"], detect: [[".moxby"]] },
-  { id: "mux", project: [".mux", "skills"], global: [".mux", "skills"], detect: [[".mux"]] },
-  { id: "neovate", project: [".neovate", "skills"], global: [".neovate", "skills"], detect: [[".neovate"]] },
-  { id: "ona", project: [".ona", "skills"], global: [".ona", "skills"], detect: [[".ona"]] },
-  { id: "pi", project: [".pi", "skills"], global: [".pi", "agent", "skills"], detect: [[".pi", "agent"]] },
-  { id: "pochi", project: [".pochi", "skills"], global: [".pochi", "skills"], detect: [[".pochi"]] },
-  { id: "qoder", project: [".qoder", "skills"], global: [".qoder", "skills"], detect: [[".qoder"]] },
-  { id: "qoder-cn", project: [".qoder", "skills"], global: [".qoder-cn", "skills"], detect: [[".qoder-cn"]] },
-  { id: "reasonix", project: [".reasonix", "skills"], global: [".reasonix", "skills"], detect: [[".reasonix"]] },
-  { id: "rovodev", project: [".rovodev", "skills"], global: [".rovodev", "skills"], detect: [[".rovodev"]] },
-  { id: "tabnine-cli", project: [".tabnine", "agent", "skills"], global: [".tabnine", "agent", "skills"], detect: [[".tabnine"]] },
-  { id: "terramind", project: [".terramind", "skills"], global: [".terramind", "skills"], detect: [[".terramind"]] },
-  { id: "tinycloud", project: [".tinycloud", "skills"], global: [".tinycloud", "skills"], detect: [[".tinycloud"]] },
-  { id: "trae-cn", project: [".trae", "skills"], global: [".trae-cn", "skills"], detect: [[".trae-cn"]] },
-  { id: "zcode", project: [".zcode", "skills"], global: [".zcode", "skills"], detect: [[".zcode"]] },
-  { id: "zencoder", project: [".zencoder", "skills"], global: [".zencoder", "skills"], detect: [[".zencoder"]] }
-];
-function agentDir(agentId, opts = {}) {
-  const agent = AGENTS.find((a) => a.id === agentId);
-  if (!agent) throw new Error(`Unknown agent: ${agentId}. Known: ${AGENTS.map((a) => a.id).join(", ")}`);
-  return opts.global ? join4(opts.home ?? homedir3(), ...agent.global) : join4(opts.cwd ?? process.cwd(), ...agent.project);
-}
-function detectAgents(opts = {}) {
-  const home = opts.home ?? homedir3();
-  return AGENTS.filter((a) => a.detect.some((d) => existsSync3(join4(home, ...d)))).map((a) => a.id);
-}
-function writeSkill(skillName, files, targetDir, opts = {}) {
-  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(skillName) || skillName.includes("..")) {
-    throw new Error(`refused unsafe skill name: "${skillName}"`);
-  }
-  const dest = join4(targetDir, skillName);
-  if (opts.mode === "symlink" && opts.canonicalDir) {
-    mkdirSync3(dirname2(dest), { recursive: true });
-    rmSync2(dest, { recursive: true, force: true });
-    symlinkSync(resolve2(opts.canonicalDir), dest, "dir");
-    return dest;
-  }
-  mkdirSync3(dest, { recursive: true });
-  const root = resolve2(dest);
-  for (const f of files) {
-    const fp = resolve2(dest, f.path);
-    if (fp !== root && !fp.startsWith(root + sep2)) {
-      throw new Error(`refused unsafe path in skill "${skillName}": ${f.path}`);
-    }
-    mkdirSync3(dirname2(fp), { recursive: true });
-    writeFileSync4(fp, f.contents);
-  }
-  return dest;
-}
-function installedSkills(opts = {}) {
-  const scope = opts.global ? "global" : "project";
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const agent of AGENTS) {
-    const dir = agentDir(agent.id, opts);
-    if (seen.has(dir)) continue;
-    seen.add(dir);
-    if (!existsSync3(dir)) continue;
-    for (const entry of readdirSync2(dir)) {
-      const skillMd = join4(dir, entry, "SKILL.md");
-      if (!existsSync3(skillMd) || !statSync2(skillMd).isFile()) continue;
-      out.push({ name: entry, agent: agent.id, scope, path: join4(dir, entry), raw: readFileSync3(skillMd, "utf8") });
-    }
+import * as p3 from "@clack/prompts";
+import { dirname, resolve as resolve3 } from "path";
+import pc8 from "picocolors";
+import { lint as lint2, parseSkillMd as parseSkillMd2 } from "@skillmds/core";
+var infoNotice = (text3) => ({ text: text3, style: "info" });
+var warnNotice = (text3) => ({ text: text3, style: "warn" });
+var skipNotice = (text3) => ({ text: text3, style: "skip" });
+var replacedNotice = (text3) => ({ text: text3, style: "warn", suppressInSummary: true });
+function noticeLine(n) {
+  switch (n.style) {
+    case "info":
+      return pc8.dim(`${GLYPH.info} ${n.text}`);
+    case "skip":
+      return pc8.dim(`${GLYPH.skip} ${n.text}`);
+    case "warn":
+      return pc8.yellow(`${GLYPH.warn} ${n.text}`);
   }
-  return out;
 }
-
-// src/commands/add.ts
-function isLocalish(arg) {
-  return arg === "." || arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(arg) || existsSync4(arg);
-}
-async function resolvePackFiles(skill, fetchTree = resolveTree) {
-  if (!skill.source_repo) return null;
-  const attempts = [{ ref: skill.commit_sha ?? void 0, pinMiss: false }];
-  if (skill.commit_sha) attempts.push({ ref: void 0, pinMiss: true });
-  for (const attempt of attempts) {
-    try {
-      const files = await fetchTree(skill.source_repo, attempt.ref);
-      const sk = files.find((f) => f.path === "SKILL.md");
-      if (sk) return { raw: sk.contents.toString("utf8"), files, pinMiss: attempt.pinMiss };
-    } catch {
-    }
-  }
-  return null;
+async function promptScopeInteractive(ctx) {
+  const choice = await p3.select({
+    message: "Installation scope",
+    initialValue: ctx.suggestGlobal,
+    options: [
+      { value: false, label: "Project", hint: `install in ${ctx.cwd} (committed with your project)` },
+      { value: true, label: "Global", hint: "install in your home directory (available across all projects)" }
+    ]
+  });
+  return p3.isCancel(choice) ? null : choice;
+}
+async function promptAgentsInteractive(ctx) {
+  if (ctx.detected.length < 2) return ctx.detected;
+  const remembered = (readConfig().lastAgents ?? []).filter((id) => ctx.detected.includes(id));
+  const picked = await p3.multiselect({
+    message: "Which agents do you want to install to?",
+    options: ctx.detected.map((id) => ({ value: id, label: id, hint: ctx.dirFor(id) })),
+    initialValues: remembered.length ? remembered : ctx.detected,
+    required: true
+  });
+  return p3.isCancel(picked) ? null : picked;
 }
 function registryFallbackNote(host) {
   return `installed from GitHub because the SkillMD registry (${host}) was unreachable \u2014 this copy is not the registry-reviewed version`;
@@ -822,38 +673,69 @@ If this environment restricts network access (sandbox, proxy, CI), ask an admini
 Registry error: ${e.message}`
   );
 }
-var defaultDeps = {
-  async resolve(arg, flags) {
-    if (isLocalish(arg)) {
-      const rs = await resolveSource(arg);
-      return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug }));
-    }
-    let registryDown = null;
-    const registryHost = (() => {
-      try {
-        return new URL(createClient(flags).base).host;
-      } catch {
-        return "api.skillmd.com";
+function argWithRef(arg, ref) {
+  if (!ref) return arg;
+  try {
+    const spec = parseSource(arg, { ref });
+    return spec.kind === "github" ? sourceId(spec) : arg;
+  } catch {
+    return arg;
+  }
+}
+function provenanceFor(arg) {
+  try {
+    return sourceId(parseSource(arg));
+  } catch {
+    return `unknown:${arg}`;
+  }
+}
+function makeDefaultDeps(flags) {
+  const canPrompt = () => isInteractive(flags, {
+    stdinTTY: Boolean(process.stdin.isTTY),
+    stdoutTTY: Boolean(process.stdout.isTTY),
+    env: flags.env ?? process.env
+  });
+  return {
+    async resolve(arg, f) {
+      const spec = parseSource(arg, { ref: f.ref });
+      const source = sourceId(spec);
+      if (spec.kind !== "slug") {
+        const rs = await resolveSource(argWithRef(arg, f.ref));
+        return rs.map((r) => ({
+          name: r.slug,
+          raw: r.raw,
+          slug: r.slug,
+          source,
+          ...spec.kind === "local" && r.file ? { files: collectFiles(dirname(r.file), dirname(r.file)) } : {}
+        }));
       }
-    })();
-    if (/^[^/\s:]+\/[^/\s:]+$/.test(arg)) {
-      const { api, base: apiBase, token } = createClient(flags);
-      const [owner, name] = arg.split("/");
+      let registryDown = null;
+      const { api, base: apiBase, token } = createClient(f);
+      const registryHost = (() => {
+        try {
+          return new URL(apiBase).host;
+        } catch {
+          return "api.skillmd.com";
+        }
+      })();
+      const registrySlug = `${spec.owner}/${spec.name}`;
       try {
-        const skill = await api(`/api/skills/${owner}/${name}`);
-        const skillName = skill.slug.split("/")[1] || name;
+        const skill = await api(`/api/skills/${spec.owner}/${spec.name}`);
+        const skillName = skill.slug.split("/")[1] || spec.name;
         const meta = {
           name: skillName,
           slug: skillName,
-          registrySlug: arg,
+          registrySlug,
+          source,
+          commit_sha: skill.commit_sha ?? void 0,
           verified: skill.verified,
           type: skill.type,
           securityFlags: skill.security_flags
         };
         if (skill.type === "pack") {
-          const bundle = await fetchBundle(apiBase, arg, token);
+          const bundle = await fetchBundle(apiBase, registrySlug, token);
           if (bundle && bundle.length) {
-            const sk = bundle.find((f) => f.path === "SKILL.md");
+            const sk = bundle.find((file) => file.path === "SKILL.md");
             return [{ ...meta, raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill), files: bundle }];
           }
           const pack = await resolvePackFiles(skill);
@@ -864,206 +746,644 @@ var defaultDeps = {
         if (e instanceof IntegrityError) throw e;
         if (e instanceof RegistryError && e.status !== 404) registryDown = e;
       }
+      const ghSource = sourceId({ kind: "github", owner: spec.owner, repo: spec.name, display: arg });
+      try {
+        const rs = await resolveSource(arg);
+        const note2 = registryDown ? registryFallbackNote(registryHost) : void 0;
+        return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug, source: ghSource, note: note2 }));
+      } catch (e) {
+        if (registryDown) throw registryUnreachableError(arg, registryHost, registryDown);
+        throw e;
+      }
+    },
+    get promptScope() {
+      return canPrompt() ? promptScopeInteractive : void 0;
+    },
+    get promptAgents() {
+      return canPrompt() ? promptAgentsInteractive : void 0;
+    },
+    fireInstall(registrySlug, f) {
+      const { api } = createClient(f);
+      const [owner, name] = registrySlug.split("/");
+      void api(`/api/skills/${owner}/${name}/install`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ via: "cli" })
+      }).catch(() => {
+      });
     }
-    try {
-      const rs = await resolveSource(arg);
-      const note2 = registryDown ? registryFallbackNote(registryHost) : void 0;
-      return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug, note: note2 }));
-    } catch (e) {
-      if (registryDown) throw registryUnreachableError(arg, registryHost, registryDown);
-      throw e;
-    }
-  },
-  fireInstall(registrySlug, flags) {
-    const { api } = createClient(flags);
-    const [owner, name] = registrySlug.split("/");
-    void api(`/api/skills/${owner}/${name}/install`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ via: "cli" })
-    }).catch(() => {
-    });
+  };
+}
+async function resolveScope(flags, deps) {
+  const home = resolve3(flags.home ?? homedir3());
+  const cwd = resolve3(flags.cwd ?? process.cwd());
+  const base = { cwd: flags.cwd, home: flags.home, env: flags.env };
+  if (flags.global) return { scope: { global: true, ...base } };
+  if (flags.project) return { scope: { global: false, ...base } };
+  if (cwd === home) return { scope: { global: true, ...base } };
+  const isProject = looksLikeProject(cwd);
+  const hosted = detectHostAgent(flags.env ?? process.env) !== null;
+  if (deps.promptScope && !flags.yes && !flags.json && !hosted) {
+    const global = await deps.promptScope({ cwd, suggestGlobal: !isProject });
+    if (global === null) return null;
+    return { scope: { global, ...base } };
   }
-};
-async function runAdd(arg, flags, deps = defaultDeps) {
-  let candidates;
-  try {
-    candidates = await deps.resolve(arg, flags);
-  } catch (e) {
-    if (e instanceof IntegrityError) {
+  if (isProject) return { scope: { global: false, ...base } };
+  return {
+    scope: { global: true, ...base },
+    note: `no project detected in ${cwd} \u2014 installing to your user-level agent folders (pass --project to install here)`
+  };
+}
+function defaultNeedsPrompt(flags) {
+  const env = flags.env ?? process.env;
+  if (flags.yes || flags.json || flags.global || flags.project || flags.list) return false;
+  if (detectHostAgent(env)) return false;
+  if (resolve3(flags.cwd ?? process.cwd()) === resolve3(flags.home ?? homedir3())) return false;
+  return !isInteractive(flags, { stdinTTY: Boolean(process.stdin.isTTY), stdoutTTY: Boolean(process.stdout.isTTY), env });
+}
+var CANCELLED_TEXT = "installation cancelled \u2014 nothing was installed";
+function finish2(flags, outcome) {
+  const json = Boolean(flags.json);
+  switch (outcome.kind) {
+    case "install": {
+      const installed = outcome.records.flatMap((r) => r.kind === "installed" ? [r.doc] : []);
+      const blocked = outcome.records.flatMap((r) => r.kind === "blocked" ? [{ name: r.name, reason: r.reason }] : []);
+      const written = installed.flatMap((d) => d.targets.map((t) => ({ name: d.name, dir: t.path })));
+      const warnings = [
+        ...outcome.notices,
+        ...outcome.records.flatMap((r) => r.kind === "installed" ? r.notices : [])
+      ].map((n) => n.text);
+      const exitCode = blocked.length > 0 || installed.length === 0 ? 1 : 0;
+      const doc = { ok: exitCode === 0, scope: outcome.scope, installed, blocked, warnings };
+      return {
+        written,
+        blocked,
+        exitCode,
+        output: json ? JSON.stringify(doc, null, 2) : renderHuman(outcome.notices, outcome.records, outcome.paths)
+      };
+    }
+    case "list": {
+      const human = outcome.skills.length ? outcome.skills.map((s) => `${pc8.bold(s.name)}  ${pc8.dim(s.description)}`).join("\n") : "No skills found.";
+      return { written: [], blocked: [], exitCode: 0, output: json ? JSON.stringify({ ok: true, skills: outcome.skills }, null, 2) : human };
+    }
+    case "cancel": {
+      const doc = { ok: false, error: CANCELLED_TEXT };
       return {
         written: [],
-        blocked: [{ name: arg, reason: e.message }],
-        exitCode: 1,
-        output: pc7.red(`\u2717 ${arg} blocked \u2014 ${e.message}`)
+        blocked: [],
+        exitCode: 0,
+        cancelled: true,
+        output: json ? JSON.stringify(doc, null, 2) : pc8.dim("Installation cancelled \u2014 nothing was installed.")
       };
     }
-    throw e;
-  }
-  if (flags.skill?.length) candidates = candidates.filter((c) => flags.skill.includes(c.name) || flags.skill.includes("*"));
-  const deny = new Set(flags.deny ?? []);
-  const written = [];
-  const blocked = [];
-  const lines = [];
-  const home = flags.home ?? homedir4();
-  const isGlobal = flags.global || resolve3(flags.cwd ?? process.cwd()) === resolve3(home);
-  const scope = { global: isGlobal, cwd: flags.cwd, home: flags.home };
-  const detected = detectAgents(scope);
-  const targets = flags.agent?.length ? flags.agent : detected.length ? detected : ["claude-code"];
-  const dirAgents = /* @__PURE__ */ new Map();
-  for (const agentId of targets) {
-    const dir = agentDir(agentId, scope);
-    dirAgents.set(dir, [...dirAgents.get(dir) ?? [], agentId]);
-  }
-  for (const c of candidates) {
-    const result = lint2(c.raw, { slug: c.slug });
-    const allFlags = [.../* @__PURE__ */ new Set([...result.security.flags, ...c.securityFlags ?? []])];
-    const deniedFlags = allFlags.filter((f) => deny.has(f));
-    if (!flags.skipLint && !result.ok) {
-      blocked.push({ name: c.name, reason: `lint errors: ${result.diagnostics.filter((d) => d.severity === "error").map((d) => d.id).join(", ")}` });
-      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 failed lint (use --skip-lint to override)`));
-      continue;
+    case "fail": {
+      const warnings = (outcome.notices ?? []).map((n) => n.text);
+      const doc = { ok: false, error: outcome.error };
+      if (outcome.blocked?.length) doc.blocked = outcome.blocked;
+      if (warnings.length) doc.warnings = warnings;
+      const human = [
+        ...(outcome.notices ?? []).map(noticeLine),
+        ...outcome.blocked?.length ? outcome.blocked.map((b) => pc8.red(`${GLYPH.blocked} ${b.name} blocked \u2014 ${b.reason}`)) : [pc8.red(outcome.error)]
+      ].join("\n");
+      return { written: [], blocked: outcome.blocked ?? [], exitCode: 1, output: json ? JSON.stringify(doc, null, 2) : human };
     }
-    if (deniedFlags.length) {
-      blocked.push({ name: c.name, reason: `denied security flags: ${deniedFlags.join(", ")}` });
-      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 you passed --deny ${deniedFlags.join(", ")}`));
+  }
+}
+function renderHuman(notices, records, paths) {
+  const lines = notices.map(noticeLine);
+  for (const r of records) {
+    if (r.kind === "blocked") {
+      lines.push(pc8.red(r.message));
       continue;
     }
-    const files = c.files ?? [{ path: "SKILL.md", contents: c.raw }];
-    for (const [dir, agentIds] of dirAgents) {
-      const out = writeSkill(c.name, files, dir, { mode: "copy" });
-      written.push({ name: c.name, dir: out });
-      lines.push(pc7.green(`\u2713 ${c.name} \u2192 ${out}`) + pc7.dim(` (${agentIds.join(", ")}; score ${result.score}${allFlags.length ? `; ${allFlags.join(", ")}` : ""})`));
-    }
-    if (c.pinMiss) {
-      lines.push(pc7.yellow(`\u26A0 ${c.name}: pinned commit unavailable upstream \u2014 fetched the source repo's default branch instead`));
+    const { doc } = r;
+    lines.push(renderInstallSummary({
+      name: doc.name,
+      score: r.score,
+      flags: r.securityFlags,
+      source: r.source,
+      canonical: doc.canonical,
+      targets: doc.targets,
+      skipped: doc.skipped,
+      ...r.replaced ? { replaced: r.replaced } : {}
+    }, paths));
+    for (const n of r.notices) if (!n.suppressInSummary) lines.push(noticeLine(n));
+  }
+  return lines.join("\n");
+}
+async function resolveCandidates(arg, flags, deps) {
+  const candidates = await deps.resolve(arg, flags);
+  if (!flags.skill?.length) return candidates;
+  return candidates.filter((c) => flags.skill.includes(c.name) || flags.skill.includes("*"));
+}
+function gate(flags, deps, candidates) {
+  if (flags.list) {
+    return finish2(flags, {
+      kind: "list",
+      skills: candidates.map((c) => {
+        const parsed = parseSkillMd2(c.raw);
+        const description = "error" in parsed ? `(invalid SKILL.md \u2014 ${parsed.error})` : parsed.description;
+        return { name: c.name, description: safeText(description, 80) };
+      })
+    });
+  }
+  if (flags.json && !flags.yes) {
+    return finish2(flags, { kind: "fail", error: "--json requires -y (no prompts can be shown in JSON mode)" });
+  }
+  if (deps.needsPrompt ?? (!deps.promptScope && defaultNeedsPrompt(flags))) {
+    return finish2(flags, { kind: "fail", error: nonInteractiveHint("-y (auto-detects the scope) or -g / -p") });
+  }
+  return null;
+}
+async function chooseTargets(flags, deps, scope, detected) {
+  const notices = [];
+  let targets = flags.agent?.length ? flags.agent : detected.length ? detected : ["claude-code"];
+  if (scope.global) {
+    const kept = [];
+    for (const id of targets) {
+      if (agentSupportsGlobal(id)) kept.push(id);
+      else notices.push(skipNotice(`${id}: project-only agent`));
     }
-    if (c.note) {
-      lines.push(pc7.yellow(`\u26A0 ${c.name}: ${c.note}`));
+    targets = kept;
+  }
+  if (!flags.agent?.length && deps.promptAgents && !flags.yes && !flags.json && !detectHostAgent(flags.env ?? process.env)) {
+    const picked = await deps.promptAgents({ detected: targets, dirFor: (id) => agentDir(id, scope) });
+    if (picked === null) return null;
+    targets = picked;
+    if (flags.home === void 0 && picked.length) {
+      try {
+        writeConfig({ ...readConfig(), lastAgents: picked });
+      } catch {
+      }
     }
-    if (c.type === "pack" && !c.files) {
-      lines.push(pc7.yellow(`\u26A0 ${c.name} is a pack but its asset files could not be fetched \u2014 only SKILL.md was installed. It may reference missing files.`));
+  }
+  return { targets, notices };
+}
+async function installOne(c, ctx) {
+  const result = lint2(c.raw, { slug: c.slug });
+  const securityFlags2 = [.../* @__PURE__ */ new Set([...result.security.flags, ...c.securityFlags ?? []])];
+  const deniedFlags = securityFlags2.filter((f) => ctx.deny.has(f));
+  if (!ctx.flags.skipLint && !result.ok) {
+    return {
+      kind: "blocked",
+      name: c.name,
+      reason: `lint errors: ${result.diagnostics.filter((d) => d.severity === "error").map((d) => d.id).join(", ")}`,
+      message: `${GLYPH.blocked} ${c.name} blocked \u2014 failed lint (use --skip-lint to override)`
+    };
+  }
+  if (deniedFlags.length) {
+    return {
+      kind: "blocked",
+      name: c.name,
+      reason: `denied security flags: ${deniedFlags.join(", ")}`,
+      message: `${GLYPH.blocked} ${c.name} blocked \u2014 you passed --deny ${deniedFlags.join(", ")}`
+    };
+  }
+  const source = c.source ?? (c.registrySlug ? `registry:${c.registrySlug}` : provenanceFor(ctx.arg));
+  let out;
+  try {
+    out = await installSkill({
+      name: c.name,
+      files: c.files ?? [{ path: "SKILL.md", contents: c.raw }],
+      source,
+      commit_sha: c.commit_sha,
+      scope: ctx.scope,
+      agents: ctx.targets,
+      explicitAgents: Boolean(ctx.flags.agent?.length),
+      mode: ctx.flags.mode,
+      force: ctx.flags.force
+    });
+  } catch (e) {
+    const reason = e instanceof Error ? e.message : String(e);
+    return { kind: "blocked", name: c.name, reason, message: `${GLYPH.blocked} ${c.name} \u2014 ${reason}` };
+  }
+  const notices = [];
+  if (out.replaced) notices.push(replacedNotice(`${c.name}: replaced previous install (${out.replaced})`));
+  if (c.pinMiss) notices.push(warnNotice(`${c.name}: pinned commit unavailable upstream \u2014 fetched the source repo's default branch instead`));
+  if (c.note) notices.push(warnNotice(`${c.name}: ${c.note}`));
+  if (c.type === "pack" && !c.files) {
+    notices.push(warnNotice(`${c.name} is a pack but its asset files could not be fetched \u2014 only SKILL.md was installed. It may reference missing files.`));
+  }
+  if (c.registrySlug && !telemetryDisabled(ctx.env)) ctx.deps.fireInstall(c.registrySlug, ctx.flags);
+  return {
+    kind: "installed",
+    doc: { name: c.name, canonical: out.canonical, targets: out.targets, skipped: out.skipped, digest: out.digest },
+    score: result.score,
+    securityFlags: securityFlags2,
+    notices,
+    source,
+    ...out.replaced ? { replaced: out.replaced } : {}
+  };
+}
+async function runAdd(arg, flags, deps) {
+  const d = deps ?? makeDefaultDeps(flags);
+  const env = flags.env ?? process.env;
+  let candidates;
+  try {
+    candidates = await resolveCandidates(arg, flags, d);
+  } catch (e) {
+    if (e instanceof IntegrityError) {
+      return finish2(flags, { kind: "fail", error: e.message, blocked: [{ name: arg, reason: e.message }] });
     }
-    if (c.registrySlug) deps.fireInstall(c.registrySlug, flags);
+    if (flags.json) return finish2(flags, { kind: "fail", error: e instanceof Error ? e.message : String(e) });
+    throw e;
   }
-  const exitCode = written.length === 0 ? 1 : 0;
-  return { written, blocked, exitCode, output: lines.join("\n") };
+  const early = gate(flags, d, candidates);
+  if (early) return early;
+  const resolved = await resolveScope(flags, d);
+  if (!resolved) return finish2(flags, { kind: "cancel" });
+  const scope = resolved.scope;
+  const notices = resolved.note ? [infoNotice(resolved.note)] : [];
+  const chosen = await chooseTargets(flags, d, scope, detectAgents(scope));
+  if (!chosen) return finish2(flags, { kind: "cancel" });
+  notices.push(...chosen.notices);
+  const ctx = { arg, flags, deny: new Set(flags.deny ?? []), scope, targets: chosen.targets, env, deps: d };
+  const records = [];
+  for (const c of candidates) records.push(await installOne(c, ctx));
+  const paths = { home: flags.home ?? homedir3(), cwd: flags.cwd ?? process.cwd() };
+  return finish2(flags, { kind: "install", scope: scope.global ? "global" : "project", records, notices, paths });
+}
+function addFlags(opts, parent) {
+  const merged = { ...parent, ...opts };
+  if (opts.copy) merged.mode = "copy";
+  return merged;
 }
 function addCommand() {
-  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents (default: every agent detected on this machine)").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").addOption(new Option("--allow-unverified").hideHelp()).option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills carrying any of these security flags (opt-in)").action(async (source, opts, cmd) => {
-    const merged = { ...cmd.parent?.opts(), ...opts };
-    const run = await runAdd(source, merged);
-    console.log(run.output);
+  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to your user-level agent folders (available in every project)").option("-p, --project", "install into the current directory's agent folders (committed with the project)").option("-a, --agent <agents...>", "target specific agents (default: every agent detected on this machine)").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--ref <ref>", "git ref (branch, tag or commit) for GitHub sources").option("-l, --list", "list the skills a source contains without installing").addOption(new Option("--mode <mode>", "link (junction/symlink into each agent dir, default) or copy").choices(["link", "copy"]).default("link")).option("--force", "replace a skill installed from a different source, or an untracked directory").addOption(new Option("--copy", "alias of --mode copy").hideHelp()).option("-y, --yes", "skip prompts; scope is auto-detected (project if this folder looks like a project, else global)").addOption(new Option("--allow-unverified").hideHelp()).option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills carrying any of these security flags (opt-in)").action(async (source, opts, cmd) => {
+    const merged = addFlags(opts, cmd.parent?.opts());
+    const { run, printed } = await runAddWithUI(source, merged);
+    if (!printed) {
+      if (run.exitCode === 1 && !merged.json) console.error(run.output);
+      else console.log(run.output);
+    }
     process.exitCode = run.exitCode;
   });
 }
+var clackUI = {
+  intro: (m) => p3.intro(m),
+  spinner: () => p3.spinner(),
+  message: (m) => p3.log.message(m),
+  outro: (m) => p3.outro(m),
+  cancel: (m) => p3.cancel(m)
+};
+async function runAddWithUI(source, flags, opts = {}) {
+  const term = opts.term ?? { ...realTerminal(), env: flags.env ?? process.env };
+  const base = opts.deps ?? makeDefaultDeps(flags);
+  if (!isInteractive(flags, term)) return { run: await runAdd(source, flags, base), printed: false };
+  const ui = opts.ui ?? clackUI;
+  ui.intro(banner());
+  try {
+    const run = await runAdd(source, flags, {
+      // NOTE: spreading `base` reads makeDefaultDeps()'s promptScope/promptAgents
+      // getters right here, freezing their values for this run. That is exactly
+      // what we want (interactivity is decided once, up front), but it does mean
+      // a getter added to AddDeps later stops being lazy the moment it crosses
+      // this spread.
+      ...base,
+      resolve: async (arg, f) => {
+        const s = ui.spinner();
+        s.start(`Resolving ${arg}`);
+        try {
+          const c = await base.resolve(arg, f);
+          s.stop(`${c.length} skill${c.length === 1 ? "" : "s"} found`);
+          return c;
+        } catch (e) {
+          s.stop(pc8.red("Could not resolve the source"));
+          throw e;
+        }
+      }
+    });
+    if (run.cancelled) {
+      ui.cancel("Installation cancelled \u2014 nothing was installed.");
+      return { run, printed: true };
+    }
+    ui.message(run.output);
+    ui.outro(run.exitCode === 0 ? `Done. Run ${pc8.cyan("skillmd list")} to see everything installed.` : pc8.red("Some skills were not installed."));
+    return { run, printed: true };
+  } catch (e) {
+    ui.outro(pc8.red("Nothing was installed."));
+    throw e;
+  }
+}
 
 // src/commands/list.ts
 import { Command as Command8 } from "commander";
-import pc8 from "picocolors";
-import { parseSkillMd as parseSkillMd2 } from "@skillmds/core";
-function listCommand() {
-  return new Command8("list").alias("ls").description("List installed skills across detected agents").option("-g, --global", "only global skills").option("--json", "machine-readable output").action((opts) => {
-    const scope = { global: opts.global };
-    const skills = installedSkills(scope);
-    if (opts.json) {
-      console.log(JSON.stringify(skills.map((s) => ({ name: s.name, agent: s.agent, scope: s.scope, path: s.path })), null, 2));
-      return;
-    }
-    if (skills.length === 0) {
-      console.log("No installed skills found.");
-      return;
-    }
-    for (const s of skills) {
-      const parsed = parseSkillMd2(s.raw);
-      const desc = "error" in parsed ? pc8.red(`(invalid SKILL.md \u2014 ${parsed.error})`) : pc8.dim(parsed.description.slice(0, 80));
-      console.log(`${pc8.bold(s.name)} ${pc8.dim(`[${s.agent}/${s.scope}]`)}
-    ${desc}`);
+import { existsSync as existsSync2, readFileSync } from "fs";
+import { join as join3 } from "path";
+import pc9 from "picocolors";
+import { parseSkillMd as parseSkillMd3 } from "@skillmds/core";
+function runList(flags = {}) {
+  const scopes = scopesFor(flags);
+  let items = [];
+  for (const global of scopes) {
+    for (const s of listInstalled({ global, cwd: flags.cwd, home: flags.home })) {
+      const md = join3(s.path, "SKILL.md");
+      let description = "";
+      if (existsSync2(md)) {
+        const parsed = parseSkillMd3(readFileSync(md, "utf8"));
+        description = "error" in parsed ? `(invalid SKILL.md \u2014 ${parsed.error})` : parsed.description;
+      }
+      items.push({ ...s, description: safeText(description, 80) });
     }
+  }
+  if (flags.agent?.length) items = items.filter((i) => i.agents.some((a) => flags.agent.includes(a)));
+  items.sort((a, b) => a.name.localeCompare(b.name) || a.scope.localeCompare(b.scope));
+  if (flags.json) {
+    return { items, output: JSON.stringify(items.map(({ name, scope, path, agents, source, mode, tracked, description }) => ({ name, scope, path, agents, source: source ?? null, mode, tracked, description })), null, 2) };
+  }
+  if (items.length === 0) return { items, output: pc9.dim("No installed skills found. Install one with `skillmd add owner/name`.") };
+  const w = Math.max(...items.map((i) => i.name.length), 4);
+  const lines = items.map((i) => {
+    const tag = i.tracked ? pc9.dim(i.source ?? "") : pc9.yellow("untracked");
+    const modes = [...new Set(Object.values(i.mode))].join("/");
+    return `${pc9.bold(i.name.padEnd(w))}  ${pc9.cyan(i.scope.padEnd(7))}  ${i.agents.join(", ").padEnd(24)}  ${pc9.dim(modes.padEnd(9))}  ${tag}
+${" ".repeat(w + 2)}${pc9.dim(i.description)}`;
+  });
+  return { items, output: lines.join("\n") };
+}
+function listCommand() {
+  return new Command8("list").alias("ls").description("List installed skills (project and global) with their source and link mode").option("-g, --global", "only user-level skills").option("-p, --project", "only this project's skills").option("-a, --agent <agents...>", "only skills linked into these agents").option("--json", "machine-readable output").action((opts, cmd) => {
+    console.log(runList({ ...cmd.parent?.opts(), ...opts }).output);
   });
 }
 
 // src/commands/remove.ts
 import { Command as Command9 } from "commander";
-import { rmSync as rmSync3 } from "fs";
-import pc9 from "picocolors";
-function runRemove(names, scope = {}) {
-  const installed = installedSkills(scope);
-  const targets = installed.filter((s) => names.includes(s.name));
-  const removed = [];
+import { rmSync } from "fs";
+import { join as join4, resolve as resolve4 } from "path";
+import * as p4 from "@clack/prompts";
+import pc10 from "picocolors";
+var defaultDeps = (flags) => isInteractive(flags) ? {
+  confirm: async (msg) => {
+    const a = await p4.confirm({ message: msg, initialValue: false });
+    return !p4.isCancel(a) && a;
+  },
+  pick: async ({ names }) => {
+    const a = await p4.multiselect({ message: "Which skills do you want to remove?", options: names.map((n) => ({ value: n, label: n })), required: true });
+    return p4.isCancel(a) ? null : a;
+  }
+} : {};
+function finish3(flags, result, doc) {
+  return flags.json ? { ...result, output: JSON.stringify(doc, null, 2) } : result;
+}
+var scopeLabel = (scope) => scope.global ? "global" : "project";
+async function runRemove(names, flags, deps = defaultDeps(flags)) {
+  const scopes = scopesFor(flags).map((global) => ({ global, cwd: flags.cwd, home: flags.home }));
+  const where = scopes.map(scopeLabel).join(" and ");
   const lines = [];
-  for (const t of targets) {
-    rmSync3(t.path, { recursive: true, force: true });
-    removed.push(t.path);
-    lines.push(pc9.green(`\u2713 removed ${t.name} (${t.agent})`));
+  if (flags.all && names.length) {
+    const error = "--all cannot be combined with skill names";
+    return finish3(flags, { removed: [], exitCode: 1, output: pc10.red(error) }, { ok: false, error });
   }
-  for (const n of names) {
-    if (!targets.some((t) => t.name === n)) lines.push(pc9.yellow(`- ${n} not installed`));
+  const perScope = scopes.map((scope) => ({ scope, installed: listInstalled(scope) }));
+  const allNames = [...new Set(perScope.flatMap((s) => s.installed.map((i) => i.name)))];
+  const nothingInstalled = `No installed skills found in ${where} scope.`;
+  let targets = names;
+  if (flags.all) {
+    if (allNames.length === 0) {
+      return finish3(flags, { removed: [], exitCode: 1, output: pc10.dim(nothingInstalled) }, { ok: false, error: nothingInstalled });
+    }
+    targets = allNames;
+  } else if (targets.length === 0) {
+    if (!deps.pick) {
+      const error = "Give one or more skill names, or --all.";
+      return finish3(flags, { removed: [], exitCode: 1, output: pc10.red(`${error} `) + pc10.dim(nonInteractiveHint("skill names and -y")) }, { ok: false, error });
+    }
+    if (allNames.length === 0) {
+      return finish3(flags, { removed: [], exitCode: 1, output: pc10.dim(nothingInstalled) }, { ok: false, error: nothingInstalled });
+    }
+    const picked = await deps.pick({ names: allNames });
+    if (!picked) return finish3(flags, { removed: [], exitCode: 0, cancelled: true, output: pc10.dim("Nothing removed.") }, { ok: true, removed: [], cancelled: true });
+    targets = picked;
   }
-  return { removed, output: lines.join("\n") };
+  const known = targets.filter((n) => allNames.includes(n));
+  const missing = targets.filter((n) => !known.includes(n));
+  for (const n of missing) lines.push(pc10.yellow(`- ${n} not installed (${where} scope)`));
+  if (known.length === 0) {
+    const output = lines.join("\n");
+    return finish3(flags, { removed: [], exitCode: 1, output }, { ok: false, error: `not installed: ${missing.join(", ")}`, missing });
+  }
+  if (!flags.yes) {
+    const what = flags.agent?.length ? `from ${flags.agent.join(", ")}` : "from every agent";
+    const ok = deps.confirm ? await deps.confirm(`Remove ${known.length} skill${known.length === 1 ? "" : "s"} (${known.join(", ")}) ${what} in ${where} scope?`) : null;
+    if (ok === null) {
+      const error = nonInteractiveHint("-y");
+      return finish3(flags, { removed: [], exitCode: 1, output: pc10.red(error) }, { ok: false, error });
+    }
+    if (!ok) return finish3(flags, { removed: [], exitCode: 0, cancelled: true, output: pc10.dim("Nothing removed.") }, { ok: true, removed: [], cancelled: true });
+  }
+  const removed = [];
+  const skipped = [];
+  let changed = 0;
+  for (const name of known) {
+    for (const { scope, installed } of perScope) {
+      if (!installed.some((s) => s.name === name)) continue;
+      const tag = scopes.length > 1 ? pc10.dim(` [${scopeLabel(scope)}]`) : "";
+      if (flags.agent?.length) {
+        const lock = readLock({ global: Boolean(scope.global), cwd: scope.cwd, home: scope.home });
+        const entry = lock.skills[name];
+        const canonRoot = resolve4(canonicalDir(scope));
+        let acted = false;
+        for (const a of flags.agent) {
+          let dir;
+          try {
+            dir = agentDir(a, scope);
+          } catch (e) {
+            lines.push(pc10.yellow(`- ${a}: ${e instanceof Error ? e.message : String(e)}`));
+            continue;
+          }
+          if (resolve4(dir) === canonRoot || entry?.mode[a] === "canonical") {
+            lines.push(pc10.dim(`${GLYPH.skip} ${name}: ${a} reads the canonical copy directly \u2014 unlinking is a no-op (use remove without -a to delete the skill)`));
+            skipped.push({ skill: name, agent: a, scope: scopeLabel(scope), reason: "reads the canonical copy directly" });
+            acted = true;
+            continue;
+          }
+          const pth = join4(dir, name);
+          if (isSkillDirOrLink(pth)) {
+            rmSync(pth, { recursive: true, force: true });
+            removed.push(pth);
+            acted = true;
+            lines.push(pc10.green(`${GLYPH.ok} removed ${name} from ${a}`) + tag);
+          }
+        }
+        if (!acted) lines.push(pc10.yellow(`- ${name} is not linked into ${flags.agent.join(", ")}`) + tag);
+        if (entry) {
+          const left = entry.agents.filter((a) => !flags.agent.includes(a));
+          if (left.length) upsertEntry({ global: Boolean(scope.global), cwd: scope.cwd, home: scope.home }, name, { ...entry, agents: left, mode: Object.fromEntries(Object.entries(entry.mode).filter(([a]) => left.includes(a))) });
+          else {
+            const r2 = uninstallSkill(name, scope);
+            removed.push(...r2.removed);
+            lines.push(pc10.dim(`  (no agents left \u2014 removed the canonical copy too)`));
+          }
+        }
+        if (acted) changed++;
+        continue;
+      }
+      const r = uninstallSkill(name, scope);
+      removed.push(...r.removed);
+      changed++;
+      lines.push(pc10.green(`${GLYPH.ok} removed ${name}`) + tag + pc10.dim(` (${r.removed.length} path${r.removed.length === 1 ? "" : "s"}${r.untracked ? ", untracked" : ""})`));
+    }
+  }
+  const exitCode = changed ? 0 : 1;
+  const doc = { ok: exitCode === 0, removed, missing };
+  if (skipped.length) doc.skipped = skipped;
+  return finish3(flags, { removed, exitCode, output: lines.join("\n") }, doc);
 }
 function removeCommand() {
-  return new Command9("remove").alias("rm").description("Remove installed skills").argument("<names...>", "skill names to remove").option("-g, --global", "only global skills").action((names, opts) => {
-    const run = runRemove(names, { global: opts.global });
+  return new Command9("remove").alias("rm").description("Remove installed skills (links, canonical copy and lock entry)").argument("[names...]", "skill names (omit to pick interactively)").option("-g, --global", "only user-level skills").option("-p, --project", "only this project's skills").option("-a, --agent <agents...>", "remove only from these agents").option("--all", "remove every skill in the scope").option("-y, --yes", "skip the confirmation").option("--json", "machine-readable output").action(async (names, opts, cmd) => {
+    const run = await runRemove(names, { ...cmd.parent?.opts(), ...opts });
     console.log(run.output);
+    process.exitCode = run.exitCode;
   });
 }
 
 // src/commands/update.ts
 import { Command as Command10 } from "commander";
-import { writeFileSync as writeFileSync5 } from "fs";
-import { join as join5 } from "path";
-import pc10 from "picocolors";
+import pc11 from "picocolors";
 import { lint as lint3 } from "@skillmds/core";
-async function runUpdate(names, flags, scope = {}) {
-  const { api } = createClient(flags);
-  const installed = installedSkills(scope).filter((s) => names.length === 0 || names.includes(s.name));
+function pickSkillTree(files, want) {
+  const norm = files.map((f) => ({ path: f.path.replace(/\\/g, "/"), contents: f.contents }));
+  const match = norm.find((f) => f.path.endsWith("/SKILL.md") && f.path.split("/").at(-2) === want);
+  if (match) {
+    const prefix = match.path.slice(0, -"SKILL.md".length);
+    return norm.filter((f) => f.path.startsWith(prefix)).map((f) => ({ path: f.path.slice(prefix.length), contents: f.contents }));
+  }
+  if (norm.some((f) => f.path === "SKILL.md")) return norm;
+  return null;
+}
+function makeDefaultUpdateDeps(opts = {}) {
+  const tree = opts.resolveTree ?? ((input) => resolveTree(input));
+  const one = opts.resolveSource ?? ((url) => resolveSource(url));
+  const client = opts.client ?? createClient;
+  return {
+    async fetchLatest(source, flags, name) {
+      if (source.startsWith("registry:")) {
+        const slug = source.slice("registry:".length);
+        const { api, base, token } = client(flags);
+        let skill;
+        try {
+          skill = await api(`/api/skills/${slug}`);
+        } catch (e) {
+          if (e.status === 404) return null;
+          throw e;
+        }
+        if (skill.type === "pack") {
+          const bundle = await fetchBundle(base, slug, token);
+          if (bundle?.length) return { files: bundle, commit_sha: skill.commit_sha ?? void 0 };
+          const pack = await resolvePackFiles(skill);
+          if (pack) return { files: pack.files, commit_sha: skill.commit_sha ?? void 0 };
+        }
+        return { files: [{ path: "SKILL.md", contents: skillMdFor(skill) }], commit_sha: skill.commit_sha ?? void 0 };
+      }
+      if (source.startsWith("github:")) {
+        const spec = parseSource(source);
+        if (spec.kind !== "github") return null;
+        const files = await tree(gigetInput(spec));
+        const picked = pickSkillTree(files, spec.skill ?? name);
+        return picked ? { files: picked } : null;
+      }
+      if (source.startsWith("gist:")) {
+        const [user, id] = source.slice("gist:".length).split("/");
+        const rs = await one(`https://gist.github.com/${user}/${id}`);
+        return rs[0] ? { files: [{ path: "SKILL.md", contents: rs[0].raw }] } : null;
+      }
+      return null;
+    }
+  };
+}
+var defaultUpdateDeps = makeDefaultUpdateDeps();
+async function runUpdate(names, flags, deps = defaultUpdateDeps) {
+  const scopes = scopesFor(flags);
   const updated = [];
+  const available = [];
+  const failed = [];
   const lines = [];
-  for (const s of installed) {
-    const slug = await findRegistrySlug(api, s);
-    if (!slug) {
-      lines.push(pc10.dim(`- ${s.name} skipped (no registry match)`));
-      continue;
-    }
-    try {
-      const [owner, name] = slug.split("/");
-      const skill = await api(`/api/skills/${owner}/${name}`);
-      const next = skillMdFor(skill);
-      if (next.trim() === s.raw.trim()) {
-        lines.push(pc10.dim(`- ${s.name} already up to date`));
+  const seen = /* @__PURE__ */ new Set();
+  for (const global of scopes) {
+    const scope = { global, cwd: flags.cwd, home: flags.home };
+    const lock = readLock(scope);
+    const installed = listInstalled(scope).filter((s) => names.length === 0 || names.includes(s.name));
+    for (const s of installed) {
+      seen.add(s.name);
+      const label2 = `${s.name}${scopes.length > 1 ? pc11.dim(` [${s.scope}]`) : ""}`;
+      const entry = lock.skills[s.name];
+      if (!entry) {
+        lines.push(pc11.dim(`- ${label2} untracked \u2014 reinstall with \`skillmd add\` to track updates`));
         continue;
       }
-      const result = lint3(next, { slug: s.name });
-      if (!result.ok) {
-        lines.push(pc10.red(`\u2717 ${s.name} update failed lint \u2014 skipped`));
+      if (entry.source.startsWith("local:")) {
+        lines.push(pc11.dim(`- ${label2} local source \u2014 not auto-updated`));
         continue;
       }
-      writeFileSync5(join5(s.path, "SKILL.md"), next, "utf8");
-      updated.push(s.name);
-      lines.push(pc10.green(`\u2713 updated ${s.name}`));
-    } catch {
-      lines.push(pc10.red(`\u2717 ${s.name} update error`));
+      try {
+        const latest = await deps.fetchLatest(entry.source, flags, s.name);
+        if (!latest) {
+          failed.push(s.name);
+          lines.push(pc11.red(`${GLYPH.blocked} ${label2} no longer available upstream (${entry.source})`));
+          continue;
+        }
+        if (entry.source.startsWith("registry:") && latest.commit_sha && entry.commit_sha && latest.commit_sha === entry.commit_sha) {
+          lines.push(pc11.dim(`- ${label2} up to date`));
+          continue;
+        }
+        if (digestOf(latest.files) === entry.digest) {
+          lines.push(pc11.dim(`- ${label2} up to date`));
+          continue;
+        }
+        if (flags.check) {
+          available.push(s.name);
+          lines.push(pc11.yellow(`\u2191 ${label2} update available`));
+          continue;
+        }
+        const md = latest.files.find((f) => f.path === "SKILL.md");
+        const raw = md ? typeof md.contents === "string" ? md.contents : md.contents.toString("utf8") : "";
+        const result = lint3(raw, { slug: s.name });
+        if (!result.ok) {
+          failed.push(s.name);
+          lines.push(pc11.red(`${GLYPH.blocked} ${label2} update failed lint (${result.diagnostics.filter((d) => d.severity === "error").map((d) => d.id).join(", ")}) \u2014 kept the installed version`));
+          continue;
+        }
+        await installSkill({ name: s.name, files: latest.files, source: entry.source, commit_sha: latest.commit_sha, scope, agents: entry.agents, explicitAgents: true, mode: Object.values(entry.mode).includes("copy") ? "copy" : "link" });
+        updated.push(s.name);
+        lines.push(pc11.green(`${GLYPH.ok} ${label2} updated`));
+      } catch (e) {
+        failed.push(s.name);
+        lines.push(pc11.red(`${GLYPH.blocked} ${label2} ${e instanceof Error ? e.message : String(e)}`));
+      }
     }
   }
-  return { updated, output: lines.join("\n") || "Nothing to update." };
+  for (const n of names) {
+    if (seen.has(n)) continue;
+    failed.push(n);
+    lines.push(pc11.yellow(`- ${n} not installed`));
+  }
+  const exitCode = failed.length ? 1 : 0;
+  if (flags.json) return { updated, available, failed, exitCode, output: JSON.stringify({ ok: exitCode === 0, updated: [...new Set(updated)], available: [...new Set(available)], failed: [...new Set(failed)] }, null, 2) };
+  if (lines.length === 0) lines.push(pc11.dim("No installed skills found."));
+  return { updated, available, failed, exitCode, output: lines.join("\n") };
 }
-async function findRegistrySlug(api, s) {
-  const r = await api(`/api/search?q=${encodeURIComponent(s.name)}&limit=5`).catch(() => null);
-  const hit = r?.items?.find((it) => it.slug.split("/")[1] === s.name);
-  return hit?.slug ?? null;
+function scopeOptions(cmd) {
+  return cmd.option("-g, --global", "only user-level skills").option("-p, --project", "only this project's skills").option("--json", "machine-readable output");
 }
 function updateCommand() {
-  return new Command10("update").description("Update installed skills from the registry (re-lints before writing)").argument("[names...]", "specific skills to update (default: all)").option("-g, --global", "only global skills").action(async (names, opts, cmd) => {
-    const merged = { ...cmd.parent?.opts(), ...opts };
-    const run = await runUpdate(names, merged, { global: opts.global });
+  return scopeOptions(new Command10("update").description("Update installed skills from the source recorded in the lock file (re-lints before writing)").argument("[names...]", "specific skills (default: all tracked)").option("--check", "only report which skills have updates")).action(async (names, opts, cmd) => {
+    const run = await runUpdate(names, { ...cmd.parent?.opts(), ...opts });
+    console.log(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+function checkCommand() {
+  return scopeOptions(new Command10("check").description("Report installed skills that have updates (alias of `update --check`)").argument("[names...]", "specific skills (default: all tracked)")).action(async (names, opts, cmd) => {
+    const run = await runUpdate(names, { ...cmd.parent?.opts(), ...opts, check: true });
     console.log(run.output);
+    process.exitCode = run.exitCode;
   });
 }
 
 // src/commands/publish.ts
 import { Command as Command11 } from "commander";
-import pc11 from "picocolors";
+import pc12 from "picocolors";
 import { lint as lint4, toText } from "@skillmds/core";
 var defaultDeps2 = {
   resolve: resolveSource,
@@ -1087,20 +1407,20 @@ async function runPublish(target, flags, deps = defaultDeps2) {
   const report = toText([{ file: src.path, result }], { decorate });
   if (!result.ok) {
     return { result, published: false, exitCode: 1, output: `${report}
-${pc11.red("\u2717 Refusing to publish: fix the errors above.")}` };
+${pc12.red("\u2717 Refusing to publish: fix the errors above.")}` };
   }
   const hasWarn = result.diagnostics.some((d) => d.severity === "warn");
   if (hasWarn && !flags.force) {
     return { result, published: false, exitCode: 1, output: `${report}
-${pc11.yellow("\u2717 Warnings present. Re-run with --force to publish anyway.")}` };
+${pc12.yellow("\u2717 Warnings present. Re-run with --force to publish anyway.")}` };
   }
   if (flags.dryRun) {
     return { result, published: false, exitCode: 0, output: `${report}
-${pc11.green("\u2713 Dry run: would publish.")}` };
+${pc12.green("\u2713 Dry run: would publish.")}` };
   }
   const res = await deps.submit({ content: src.raw, type: flags.type ?? "single" }, flags);
   return { result, published: true, slug: res.slug, exitCode: 0, output: `${report}
-${pc11.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ?? "pending"})`)}` };
+${pc12.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ?? "pending"})`)}` };
 }
 function publishCommand() {
   return new Command11("publish").alias("submit").description("Publish a skill to the registry (refuses to publish on lint errors)").argument("[target]", "local path to the skill", ".").option("--type <type>", "single | pack", "single").option("--force", "publish despite warnings (never bypasses errors)").option("--dry-run", "lint only; do not publish").action(async (target, opts, cmd) => {
@@ -1113,46 +1433,81 @@ function publishCommand() {
 
 // src/commands/login.ts
 import { Command as Command12 } from "commander";
-import * as p3 from "@clack/prompts";
-function loginCommand() {
-  return new Command12("login").description("Store a SkillMD personal access token for publishing").option("--token <token>", "token to store (otherwise prompt)").option("--api <url>", "registry API base to store").action(async (opts) => {
-    let token = opts.token;
-    if (!token) {
-      const answer = await p3.password({ message: "Paste your SkillMD token (from your account page)" });
-      if (p3.isCancel(answer)) {
-        p3.cancel("Cancelled.");
-        return;
-      }
-      token = answer;
-    }
-    if (!token) {
-      console.error("A token is required.");
-      process.exitCode = 1;
-      return;
+import * as p5 from "@clack/prompts";
+import pc13 from "picocolors";
+var defaultLoginDeps = (flags) => promptIf(flags, async () => {
+  const answer = await p5.password({ message: "Paste your SkillMD token (from your account page)" });
+  return p5.isCancel(answer) ? null : answer;
+});
+function finish4(flags, result, doc) {
+  return flags.json ? { ...result, output: JSON.stringify(doc, null, 2) } : result;
+}
+async function runLogin(flags, deps = defaultLoginDeps(flags)) {
+  const env = flags.env ?? process.env;
+  let token = flags.token;
+  if (!token) {
+    if (!deps.prompt) {
+      const error = nonInteractiveHint("--token <token> (or set SKILLMD_TOKEN)");
+      return finish4(flags, { exitCode: 1, output: pc13.red(error) }, { ok: false, error });
     }
-    const cfg = readConfig();
-    cfg.token = token;
-    if (opts.api) cfg.api = opts.api;
-    writeConfig(cfg);
-    console.log(`Saved token to ${configPath()}`);
+    const answer = await deps.prompt();
+    if (answer === null) return finish4(flags, { exitCode: 0, output: pc13.dim("Cancelled.") }, { ok: false, cancelled: true });
+    token = answer;
+  }
+  if (!token) {
+    const error = "A token is required.";
+    return finish4(flags, { exitCode: 1, output: pc13.red(error) }, { ok: false, error });
+  }
+  const cfg = readConfig(flags.home);
+  let host;
+  try {
+    host = hostOf(resolveApi({ api: flags.api, insecureHttp: flags.insecureHttp }, { env, config: { ...cfg, api: flags.api ?? cfg.api } }));
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { exitCode: 1, output: flags.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : pc13.red(msg) };
+  }
+  cfg.token = token;
+  if (flags.api) cfg.api = flags.api;
+  cfg.tokenHost = host;
+  writeConfig(cfg, flags.home);
+  const file = configPath(flags.home);
+  return {
+    exitCode: 0,
+    output: flags.json ? JSON.stringify({ ok: true, file, host }, null, 2) : `Saved token for ${host} to ${file}`
+  };
+}
+function runLogout(flags) {
+  const cfg = readConfig(flags.home);
+  const had = Boolean(cfg.token);
+  delete cfg.token;
+  delete cfg.tokenHost;
+  writeConfig(cfg, flags.home);
+  return {
+    exitCode: 0,
+    output: flags.json ? JSON.stringify({ ok: true, removed: had }, null, 2) : had ? "Removed stored token." : "No stored token."
+  };
+}
+function loginCommand() {
+  return new Command12("login").description("Store a SkillMD personal access token for publishing (prefer this or SKILLMD_TOKEN over --token)").option("--token <token>", "token to store (otherwise prompt)").option("--api <url>", "registry API base to store").option("--json", "machine-readable output").action(async (opts, cmd) => {
+    const r = await runLogin({ ...cmd.parent?.opts(), ...opts });
+    console.log(r.output);
+    process.exitCode = r.exitCode;
   });
 }
 function logoutCommand() {
-  return new Command12("logout").description("Remove the stored SkillMD token").action(() => {
-    const cfg = readConfig();
-    delete cfg.token;
-    writeConfig(cfg);
-    console.log("Removed stored token.");
+  return new Command12("logout").description("Remove the stored SkillMD token").option("--json", "machine-readable output").action((opts, cmd) => {
+    const r = runLogout({ ...cmd.parent?.opts(), ...opts });
+    console.log(r.output);
+    process.exitCode = r.exitCode;
   });
 }
 
 // src/commands/interactive.ts
-import * as p4 from "@clack/prompts";
-import pc12 from "picocolors";
-import { parseSkillMd as parseSkillMd3 } from "@skillmds/core";
+import * as p6 from "@clack/prompts";
+import pc14 from "picocolors";
 function bail(v) {
-  if (p4.isCancel(v)) {
-    p4.cancel("Cancelled.");
+  if (p6.isCancel(v)) {
+    p6.cancel("Cancelled.");
     return true;
   }
   return false;
@@ -1160,25 +1515,26 @@ function bail(v) {
 async function browseSearchResults(items) {
   const cols = process.stdout.columns ?? 80;
   for (; ; ) {
-    const picked = await p4.select({
+    const picked = await p6.select({
       message: "Search results",
       options: [
         ...items.map((item2) => {
           const starsTxt = item2.repo_stars != null ? ` \u2605${formatStars(item2.repo_stars)}` : "";
           const checkTxt = item2.verified ? " \u2713" : "";
-          const plainLabel = `${item2.slug}${starsTxt}${checkTxt}`;
-          const label2 = `${pc12.bold(item2.slug)}${starsTxt ? pc12.dim(starsTxt) : ""}${checkTxt ? pc12.green(checkTxt) : ""}`;
+          const slugTxt = safeText(item2.slug, 200);
+          const plainLabel = `${slugTxt}${starsTxt}${checkTxt}`;
+          const label2 = `${pc14.bold(slugTxt)}${starsTxt ? pc14.dim(starsTxt) : ""}${checkTxt ? pc14.green(checkTxt) : ""}`;
           const hintWidth = Math.max(10, cols - plainLabel.length - 6);
           return {
             value: item2.slug,
             label: label2,
-            hint: truncate(item2.description ?? "", hintWidth)
+            hint: truncate(safeText(item2.description ?? ""), hintWidth)
           };
         }),
         { value: "__back", label: "\u2190 Back to menu" }
       ]
     });
-    if (p4.isCancel(picked) || picked === "__back") return;
+    if (p6.isCancel(picked) || picked === "__back") return;
     const item = items.find((i) => i.slug === picked);
     if (!item) continue;
     await browseOneResult(item);
@@ -1186,14 +1542,15 @@ async function browseSearchResults(items) {
 }
 async function browseOneResult(item) {
   const starsTxt = item.repo_stars != null ? `\u2605 ${formatStars(item.repo_stars)} stars` : "";
+  const slugTxt = safeText(item.slug, 200);
   const meta = [
     starsTxt,
-    item.verified ? pc12.green("\u2713 verified") : "unverified",
+    item.verified ? pc14.green("\u2713 verified") : "unverified",
     item.type === "pack" ? "pack" : ""
   ].filter(Boolean).join(" \xB7 ");
-  p4.note([item.description ?? "", pc12.dim(meta)].join("\n"), item.slug);
+  p6.note([safeText(item.description ?? ""), pc14.dim(meta)].join("\n"), slugTxt);
   for (; ; ) {
-    const action = await p4.select({
+    const action = await p6.select({
       message: "What next?",
       options: [
         { value: "project", label: "Install to this project" },
@@ -1202,33 +1559,36 @@ async function browseOneResult(item) {
         { value: "back", label: "\u2190 Back to results" }
       ]
     });
-    if (p4.isCancel(action) || action === "back") return;
+    if (p6.isCancel(action) || action === "back") return;
     if (action === "url") {
-      p4.log.message(pc12.dim(`https://skillmd.com/skills/${item.slug}`));
+      p6.log.message(pc14.dim(`https://skillmd.com/skills/${slugTxt}`));
       continue;
     }
-    p4.log.step(`Installing ${item.slug}\u2026`);
+    p6.log.step(`Installing ${slugTxt}\u2026`);
     try {
-      const run = await runAdd(item.slug, action === "global" ? { global: true } : {});
+      const run = await runAdd(item.slug, action === "global" ? { global: true } : { project: true });
       console.log(run.output);
-      if (run.exitCode === 0) p4.log.success("Installed.");
-      else p4.log.warn("Not installed.");
+      if (run.exitCode === 0) p6.log.success("Installed.");
+      else p6.log.warn("Not installed.");
     } catch (err) {
-      p4.log.error(err instanceof Error ? err.message : String(err));
+      p6.log.error(err instanceof Error ? err.message : String(err));
     }
   }
 }
 async function runInteractive() {
-  p4.intro(pc12.bgCyan(pc12.black(" skillmd ")));
+  p6.intro(banner());
   for (; ; ) {
-    const action = await p4.select({
+    const action = await p6.select({
       message: "What would you like to do?",
       options: [
         { value: "lint", label: "Lint a skill", hint: "validate a SKILL.md" },
         { value: "scan", label: "Security scan", hint: "scripts, network, secrets" },
         { value: "search", label: "Search the registry" },
+        { value: "install", label: "Install a skill", hint: "registry slug, GitHub URL or local path" },
         { value: "init", label: "Create a new skill" },
         { value: "list", label: "List installed skills" },
+        { value: "update", label: "Update installed skills" },
+        { value: "remove", label: "Remove skills" },
         { value: "help", label: "Show all commands" },
         { value: "quit", label: "Quit" }
       ]
@@ -1237,10 +1597,10 @@ async function runInteractive() {
     switch (action) {
       case "lint":
       case "scan": {
-        const path = await p4.text({ message: "Path to a skill or folder", placeholder: ".", defaultValue: "." });
+        const path = await p6.text({ message: "Path to a skill or folder", placeholder: ".", defaultValue: "." });
         if (bail(path)) break;
         const target = String(path || ".");
-        const s = p4.spinner();
+        const s = p6.spinner();
         s.start(action === "lint" ? "Linting" : "Scanning");
         try {
           const run = action === "lint" ? await runLint(target, { format: "text" }) : await runScan(target, { format: "text" });
@@ -1248,74 +1608,97 @@ async function runInteractive() {
           console.log(run.output);
           process.exitCode = run.exitCode;
         } catch (err) {
-          s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
+          s.stop(pc14.red(err instanceof Error ? err.message : String(err)));
           process.exitCode = 1;
         }
         break;
       }
       case "search": {
-        const query = await p4.text({ message: "Search the registry for" });
+        const query = await p6.text({ message: "Search the registry for" });
         if (bail(query)) break;
-        const verified = await p4.confirm({ message: "Verified skills only?", initialValue: false });
+        const verified = await p6.confirm({ message: "Verified skills only?", initialValue: false });
         if (bail(verified)) break;
-        const s = p4.spinner();
+        const s = p6.spinner();
         s.start("Searching");
         try {
           const run = await runSearch(String(query), { verified: Boolean(verified), limit: "20" });
           s.stop(`${run.items.length} result${run.items.length === 1 ? "" : "s"}`);
           if (run.items.length === 0) {
-            p4.log.info("No results.");
+            p6.log.info("No results.");
             break;
           }
           await browseSearchResults(run.items);
         } catch (err) {
-          s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
+          s.stop(pc14.red(err instanceof Error ? err.message : String(err)));
           process.exitCode = 1;
         }
         break;
       }
       case "init": {
-        const name = await p4.text({ message: "Skill name", placeholder: "my-skill" });
+        const name = await p6.text({ message: "Skill name", placeholder: "my-skill" });
         if (bail(name)) break;
-        const description = await p4.text({ message: "One-line description", placeholder: "What this skill helps an agent do" });
+        const description = await p6.text({ message: "One-line description", placeholder: "What this skill helps an agent do" });
         if (bail(description)) break;
         try {
           const file = initSkill(String(name), { description: String(description || "") });
-          p4.log.success(`Created ${pc12.bold(file)}`);
+          p6.log.success(`Created ${pc14.bold(file)}`);
+        } catch (err) {
+          p6.log.error(err instanceof Error ? err.message : String(err));
+          process.exitCode = 1;
+        }
+        break;
+      }
+      case "install": {
+        const src = await p6.text({ message: "Skill source", placeholder: "owner/name, https://github.com/\u2026, or ./path" });
+        if (bail(src)) break;
+        try {
+          const run = await runAdd(String(src), {});
+          console.log(run.output);
+          process.exitCode = run.exitCode;
         } catch (err) {
-          p4.log.error(err instanceof Error ? err.message : String(err));
+          p6.log.error(err instanceof Error ? err.message : String(err));
           process.exitCode = 1;
         }
         break;
       }
       case "list": {
-        const skills = [...installedSkills({}), ...installedSkills({ global: true })];
-        if (skills.length === 0) {
-          p4.log.info("No installed skills found (checked this folder and your user directory).");
-        } else {
-          p4.log.message(
-            skills.map((sk) => {
-              const parsed = parseSkillMd3(sk.raw);
-              const desc = "error" in parsed ? pc12.red(`(invalid SKILL.md \u2014 ${parsed.error})`) : pc12.dim(parsed.description.slice(0, 70));
-              return `${pc12.bold(sk.name)} ${pc12.dim(`[${sk.agent}/${sk.scope}]`)}
-  ${desc}`;
-            }).join("\n")
-          );
+        console.log(runList({}).output);
+        break;
+      }
+      case "update": {
+        try {
+          const run = await runUpdate([], {});
+          console.log(run.output);
+          process.exitCode = run.exitCode;
+        } catch (err) {
+          p6.log.error(err instanceof Error ? err.message : String(err));
+          process.exitCode = 1;
+        }
+        break;
+      }
+      case "remove": {
+        try {
+          const run = await runRemove([], {});
+          console.log(run.output);
+          process.exitCode = run.exitCode;
+        } catch (err) {
+          p6.log.error(err instanceof Error ? err.message : String(err));
+          process.exitCode = 1;
         }
         break;
       }
       case "help": {
-        p4.note(
+        p6.note(
           [
-            `${pc12.bold("lint")} [path]      validate SKILL.md + quality score`,
-            `${pc12.bold("scan")} [path]      security scan`,
-            `${pc12.bold("search")} <query>   search the registry`,
-            `${pc12.bold("add")} <source>     install a skill (lints first)`,
-            `${pc12.bold("info")} <slug>      registry details for a skill`,
-            `${pc12.bold("init")} [name]      scaffold a new skill`,
-            `${pc12.bold("list / remove / update")}   manage installed skills`,
-            `${pc12.bold("publish")} [path]   publish (fails on lint errors)`,
-            `${pc12.bold("rules / login")}`
+            `${pc14.bold("lint")} [path]      validate SKILL.md + quality score`,
+            `${pc14.bold("scan")} [path]      security scan`,
+            `${pc14.bold("search")} <query>   search the registry`,
+            `${pc14.bold("add")} <source>     install a skill (lints first)`,
+            `${pc14.bold("info")} <slug>      registry details for a skill`,
+            `${pc14.bold("init")} [name]      scaffold a new skill`,
+            `${pc14.bold("list / remove / update")}   manage installed skills`,
+            `${pc14.bold("publish")} [path]   publish (fails on lint errors)`,
+            `${pc14.bold("rules / login")}`
           ].join("\n"),
           "Commands (run: skillmd <command>)"
         );
@@ -1323,16 +1706,39 @@ async function runInteractive() {
       }
     }
   }
-  p4.outro(pc12.dim("skillmd.com"));
+  p6.outro(pc14.dim("skillmd.com"));
 }
 
 // src/index.ts
 var version = "0.0.0";
 try {
-  version = JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8")).version;
+  version = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8")).version;
 } catch {
 }
-var program = new Command13("skillmd").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "SkillMD personal access token").option("--api <url>", "override the registry API base URL");
+var program = new Command13("skillmd").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "personal access token (prefer `skillmd login` or SKILLMD_TOKEN \u2014 command-line tokens show up in process lists)").option("--api <url>", "override the registry API base URL").option("--insecure-http", "allow an http:// --api base (local development only)");
+program.configureHelp({ sortSubcommands: false });
+program.addHelpText("after", `
+Examples:
+  $ skillmd add anthropic/pdf                  install from the registry (asks project vs global)
+  $ skillmd add owner/repo/skills/x#main -g    a GitHub subfolder at a ref, into your user dirs
+  $ skillmd add ./my-skill -a claude-code -p   a local skill into this project for one agent
+  $ skillmd add anthropic/pdf -y --json        non-interactive, machine-readable
+  $ skillmd list                               everything installed, project and global
+  $ skillmd check                              which installed skills have updates
+  $ skillmd update -g                          update your user-level skills
+  $ skillmd remove pdf                         remove a skill from every agent
+
+Quality:   lint  scan  rules  init
+Registry:  search  info  add  list  remove  update  check
+Publish:   publish  login  logout
+
+Docs: https://skillmd.com/docs/cli`);
+program.hook("preAction", (thisCmd) => {
+  const opts = thisCmd.opts();
+  if (opts.token && process.stderr.isTTY) {
+    console.error(pc15.yellow("\u26A0 --token is visible in your shell history and process list; prefer `skillmd login` or SKILLMD_TOKEN."));
+  }
+});
 program.addCommand(lintCommand());
 program.addCommand(scanCommand());
 program.addCommand(rulesCommand());
@@ -1343,6 +1749,7 @@ program.addCommand(addCommand());
 program.addCommand(listCommand());
 program.addCommand(removeCommand());
 program.addCommand(updateCommand());
+program.addCommand(checkCommand());
 program.addCommand(publishCommand());
 program.addCommand(loginCommand());
 program.addCommand(logoutCommand());