skillpass 0.2.0 → 0.3.0

package/bin/skillpass.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import '../dist/cli.js';

package/dist/{cli.mjs → cli.js}

@@ -493,13 +493,13 @@ function unzipSync(data, opts) {
 
 // src/add.ts
 import {
-  existsSync,
+  existsSync as existsSync2,
   mkdirSync as mkdirSync2,
-  readdirSync as readdirSync2,
+  readdirSync as readdirSync3,
   renameSync,
   rmdirSync,
   rmSync,
-  statSync as statSync2,
+  statSync as statSync3,
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { dirname, isAbsolute, join as join4, resolve as resolve2 } from "node:path";
@@ -15281,10 +15281,10 @@ function parseManifest(input) {
 }
 
 // ../skill-schema/src/report.ts
-var reportFindingSchema = external_exports.strictObject({
+var reportFindingSchema = external_exports.object({
   code: external_exports.string().min(1),
   message: external_exports.string().min(1),
-  location: external_exports.strictObject({
+  location: external_exports.object({
     path: external_exports.string().min(1),
     line: external_exports.number().int().positive().optional(),
     snippet: external_exports.string().optional()
@@ -15313,11 +15313,11 @@ var validationReportSchema = external_exports.strictObject({
 });
 
 // ../skill-schema/src/passport.ts
-var skillPassportSchema = external_exports.strictObject({
+var skillPassportSchema = external_exports.object({
   schemaVersion: external_exports.literal("0.1"),
   validationStatus: validationStatusSchema,
   riskLevel: riskLevelSchema,
-  permissionsSummary: external_exports.strictObject({
+  permissionsSummary: external_exports.object({
     declared: external_exports.array(permissionKeySchema),
     detected: external_exports.array(permissionKeySchema)
   }),
@@ -15338,7 +15338,7 @@ var skillPassportSchema = external_exports.strictObject({
 
 // ../skill-schema/src/ai-review.ts
 var aiReviewVerdictSchema = external_exports.enum(["clear", "caution", "concern"]);
-var aiReviewSchema = external_exports.strictObject({
+var aiReviewSchema = external_exports.object({
   summary: external_exports.string().min(1).max(600),
   verdict: aiReviewVerdictSchema,
   reasoning: external_exports.string().min(1).max(800),
@@ -15390,9 +15390,14 @@ var publishResultSchema = external_exports.object({
   slug: external_exports.string().min(1),
   version: external_exports.string().min(1)
 });
+var MAX_SLUG_LENGTH = 60;
+function slugForSkill(name) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, MAX_SLUG_LENGTH).replace(/-+$/, "");
+  return slug || "skill";
+}
 
 // ../skill-schema/src/public.ts
-var publicSkillSummarySchema = external_exports.strictObject({
+var publicSkillSummarySchema = external_exports.object({
   slug: external_exports.string().min(1),
   name: external_exports.string().min(1),
   summary: external_exports.string().min(1),
@@ -15422,7 +15427,7 @@ var publicSkillSummarySchema = external_exports.strictObject({
   publishedAt: external_exports.iso.datetime()
 });
 var publicSkillListSchema = external_exports.array(publicSkillSummarySchema);
-var publicSkillVersionSchema = external_exports.strictObject({
+var publicSkillVersionSchema = external_exports.object({
   version: external_exports.string().min(1),
   validationStatus: validationStatusSchema,
   riskLevel: riskLevelSchema,
@@ -15431,10 +15436,10 @@ var publicSkillVersionSchema = external_exports.strictObject({
 var publicSkillDetailSchema = publicSkillSummarySchema.extend({
   // Full member entries (incl. per-target variants) for a pack; the CLI's
   // per-target install resolution reads exactly this. Null for single skills.
-  packMembers: external_exports.array(skillEntrySchema).nullable().optional(),
+  packMembers: external_exports.array(external_exports.object(skillEntrySchema.shape)).nullable().optional(),
   githubRepoUrl: external_exports.string().min(1).nullable(),
   passport: skillPassportSchema,
-  maintainerInfo: external_exports.strictObject({
+  maintainerInfo: external_exports.object({
     username: external_exports.string().min(1),
     displayName: external_exports.string().min(1),
     avatarUrl: external_exports.string().min(1)
@@ -15443,18 +15448,18 @@ var publicSkillDetailSchema = publicSkillSummarySchema.extend({
   // The cached AI review for this version's source hash; null until generated.
   aiReview: aiReviewSchema.nullable()
 });
-var publicSkillSourceSchema = external_exports.strictObject({
+var publicSkillSourceSchema = external_exports.object({
   version: external_exports.string().min(1),
   sourceHash: external_exports.string().min(1),
-  files: external_exports.array(external_exports.strictObject({ path: external_exports.string().min(1), content: external_exports.string() }))
+  files: external_exports.array(external_exports.object({ path: external_exports.string().min(1), content: external_exports.string() }))
 });
 
 // ../skill-schema/src/preflight.ts
-var permissionSetDiffSchema = external_exports.strictObject({
+var permissionSetDiffSchema = external_exports.object({
   added: external_exports.array(permissionKeySchema),
   removed: external_exports.array(permissionKeySchema)
 });
-var publicPreflightSchema = external_exports.strictObject({
+var publicPreflightSchema = external_exports.object({
   version: external_exports.string().min(1),
   validationStatus: validationStatusSchema,
   riskLevel: riskLevelSchema,
@@ -15462,11 +15467,11 @@ var publicPreflightSchema = external_exports.strictObject({
   sourceVerified: external_exports.boolean(),
   resolvedCommitSha: external_exports.string().min(1).nullable(),
   generatedAt: external_exports.iso.datetime(),
-  permissions: external_exports.strictObject({
+  permissions: external_exports.object({
     declared: external_exports.array(permissionKeySchema),
     detected: external_exports.array(permissionKeySchema)
   }),
-  diff: external_exports.strictObject({
+  diff: external_exports.object({
     previousVersion: external_exports.string().min(1),
     declared: permissionSetDiffSchema,
     detected: permissionSetDiffSchema
@@ -15546,6 +15551,39 @@ var resolveReportInputSchema = external_exports.strictObject({
   status: external_exports.enum(["reviewed", "actioned"])
 });
 
+// ../skill-schema/src/maintainer.ts
+var SKILL_STATUSES = ["published", "draft", "private", "flagged"];
+var skillStatusSchema = external_exports.enum(SKILL_STATUSES);
+var maintainerSkillSchema = external_exports.strictObject({
+  slug: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  status: skillStatusSchema,
+  version: external_exports.string().nullable(),
+  validationStatus: validationStatusSchema.nullable(),
+  riskLevel: riskLevelSchema.nullable(),
+  updatedAt: external_exports.iso.datetime()
+});
+var maintainerReportSchema = external_exports.strictObject({
+  id: external_exports.number().int().positive(),
+  skill: external_exports.strictObject({ slug: external_exports.string(), name: external_exports.string() }),
+  reason: external_exports.string(),
+  status: abuseReportStatusSchema,
+  createdAt: external_exports.iso.datetime()
+});
+
+// ../skill-schema/src/user.ts
+var USER_ROLES = ["user", "maintainer", "admin"];
+var userRoleSchema = external_exports.enum(USER_ROLES);
+var publicUserSchema = external_exports.object({
+  id: external_exports.number().int().positive(),
+  username: external_exports.string().min(1),
+  displayName: external_exports.string().min(1),
+  avatarUrl: external_exports.string().min(1),
+  role: userRoleSchema,
+  reputation: external_exports.number().int(),
+  createdAt: external_exports.iso.datetime()
+});
+
 // ../validator/src/rules/permissions.ts
 var PERMISSION_SIGNALS = [
   {
@@ -15600,24 +15638,30 @@ var PERMISSION_SIGNALS = [
   }
 ];
 function detectPermissions(files) {
-  const detected = /* @__PURE__ */ new Map();
+  const detected = /* @__PURE__ */ new Set();
   for (const file2 of files) {
-    file2.content.split("\n").forEach((line, i2) => {
+    for (const line of file2.content.split("\n")) {
       for (const signal of PERMISSION_SIGNALS) {
         if (!detected.has(signal.permission) && signal.pattern.test(line)) {
-          detected.set(signal.permission, {
-            permission: signal.permission,
-            description: signal.description,
-            location: { path: file2.path, line: i2 + 1, snippet: line.trim() }
-          });
+          detected.add(signal.permission);
         }
       }
-    });
+    }
   }
-  return [...detected.values()];
+  return [...detected];
 }
 
 // ../validator/src/load.ts
+var NUL_SCAN_BYTES = 8e3;
+function isBinary(bytes) {
+  if (bytes.subarray(0, NUL_SCAN_BYTES).includes(0)) return true;
+  try {
+    new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return false;
+  } catch {
+    return true;
+  }
+}
 var PackageReadError = class extends Error {
   constructor(dir, cause) {
     super(`cannot read skill package at "${dir}"`, { cause });
@@ -15626,19 +15670,23 @@ var PackageReadError = class extends Error {
 };
 var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
 function walk(root, rel = "") {
-  const files = [];
+  const tree = { files: [], binaries: [] };
   for (const name of readdirSync(join(root, rel)).sort()) {
     const relPath = rel === "" ? name : `${rel}/${name}`;
     const stats = statSync(join(root, relPath));
     if (stats.isDirectory()) {
       if (!SKIP_DIRS.has(name)) {
-        files.push(...walk(root, relPath));
+        const sub = walk(root, relPath);
+        tree.files.push(...sub.files);
+        tree.binaries.push(...sub.binaries);
       }
     } else {
-      files.push({ path: relPath, content: readFileSync(join(root, relPath), "utf8") });
+      const bytes = readFileSync(join(root, relPath));
+      if (isBinary(bytes)) tree.binaries.push(relPath);
+      else tree.files.push({ path: relPath, content: bytes.toString("utf8") });
     }
   }
-  return files;
+  return tree;
 }
 function hashFiles(files) {
   const hash2 = createHash("sha256");
@@ -15665,7 +15713,7 @@ function readManifest(files) {
   if (!result.success) {
     return { state: "invalid", error: result.error };
   }
-  return { state: "ok", data: result.data, raw: file2.content };
+  return { state: "ok", data: result.data };
 }
 var FRONTMATTER_RE = /^---\n([\s\S]*?)\n---/;
 function readSkillMeta(content) {
@@ -15690,19 +15738,43 @@ function readSkillMeta(content) {
         const text = block[1] === ">" ? gathered.join(" ").replace(/\s+/g, " ").trim() : gathered.join("\n").trim();
         if (text) out[key] = text;
       } else {
-        out[key] = kv[2].replace(/^["']|["']$/g, "");
+        const parts = [kv[2]];
+        for (let j = i2 + 1; j < lines.length && /^\s+\S/.test(lines[j]); j++) parts.push(lines[j].trim());
+        out[key] = parts.join(" ").replace(/^["']|["']$/g, "");
       }
     }
   }
   if (!out.description) {
-    const prose = body.split("\n").map((line) => line.trim()).find((line) => line && !line.startsWith("#"));
-    if (prose) out.description = prose.slice(0, 200);
+    const prose = firstParagraph(body);
+    if (prose) out.description = prose;
   }
   return out;
 }
-function slugify2(value) {
-  const slug = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return slug || "skill";
+var HTML_TAG_RE = /<\/?[a-zA-Z][^>]*>/g;
+var MD_LINK_RE = /\[([^\]]*)\]\([^)]*\)/g;
+var STRUCTURAL_LINE_RE = /^(#|!\[|\[!\[|---$|\*\*\*$|___$)|^<h[1-6][\s>]/i;
+var DESCRIPTION_MAX = 200;
+var cleanInline = (line) => line.replace(HTML_TAG_RE, " ").replace(MD_LINK_RE, "$1").replace(/^>\s?/, "").replace(/\s+/g, " ").trim();
+function clip(text, max2) {
+  if (text.length <= max2) return text;
+  const head = text.slice(0, max2);
+  const sentenceEnd = Math.max(head.lastIndexOf(". "), head.lastIndexOf("! "), head.lastIndexOf("? "));
+  if (sentenceEnd >= 60) return head.slice(0, sentenceEnd + 1);
+  const wordEnd = head.lastIndexOf(" ");
+  return (wordEnd > 0 ? head.slice(0, wordEnd) : head).replace(/[,;:]+$/, "").trim();
+}
+function firstParagraph(text) {
+  const kept = [];
+  for (const raw of text.split("\n")) {
+    const source = raw.trim();
+    const line = STRUCTURAL_LINE_RE.test(source) ? "" : cleanInline(source);
+    if (!line) {
+      if (kept.length > 0) break;
+      continue;
+    }
+    kept.push(line);
+  }
+  return kept.length > 0 ? clip(kept.join(" "), DESCRIPTION_MAX) : void 0;
 }
 function inferTargets(files) {
   const targets = /* @__PURE__ */ new Set();
@@ -15715,8 +15787,8 @@ function inferTargets(files) {
 function inferManifest(files, fallbackName) {
   const skillFile = files.find((f) => f.path === "SKILL.md");
   const meta3 = skillFile ? readSkillMeta(skillFile.content) : {};
-  const name = slugify2(meta3.name ?? fallbackName);
-  const permissions = [...new Set(detectPermissions(files).map((d) => d.permission))];
+  const name = slugForSkill(meta3.name ?? fallbackName);
+  const permissions = detectPermissions(files);
   return {
     schemaVersion: "0.1",
     name,
@@ -15751,11 +15823,7 @@ function collectMemberFiles(files) {
 }
 function readmeProse(files) {
   const readme = files.find((f) => f.path === "README.md");
-  if (!readme) return void 0;
-  const prose = readme.content.split("\n").map((line) => line.trim()).find(
-    (line) => line && !line.startsWith("#") && !line.startsWith("![") && !line.startsWith("[![") && !line.startsWith("<")
-  );
-  return prose?.slice(0, 200);
+  return readme ? firstParagraph(readme.content) : void 0;
 }
 function inferNestedManifest(files, fallbackName) {
   const members = collectMemberFiles(files).sort(
@@ -15770,8 +15838,8 @@ function inferNestedManifest(files, fallbackName) {
     const entryPath = member.claudePath ?? member.agentsPath ?? member.plainPath;
     const file2 = files.find((f) => f.path === entryPath);
     const meta3 = readSkillMeta(file2.content);
-    let entryName = slugify2(meta3.name ?? member.folder);
-    if (used.has(entryName)) entryName = slugify2(member.folder);
+    let entryName = slugForSkill(meta3.name ?? member.folder);
+    if (used.has(entryName)) entryName = slugForSkill(member.folder);
     used.add(entryName);
     const targets = member.plainPath ? inferTargets(files) : [
       ...member.claudePath ? ["claude-code"] : [],
@@ -15787,10 +15855,10 @@ function inferNestedManifest(files, fallbackName) {
     };
   });
   const single = entries.length === 1 ? entries[0] : null;
-  const permissions = [...new Set(detectPermissions(files).map((d) => d.permission))];
+  const permissions = detectPermissions(files);
   return {
     schemaVersion: "0.1",
-    name: single ? single.name : slugify2(fallbackName),
+    name: single ? single.name : slugForSkill(fallbackName),
     description: single ? single.description ?? single.name : readmeProse(files) ?? `A pack of ${entries.length} skills`,
     targets: [...packTargets],
     permissions,
@@ -15820,82 +15888,33 @@ function resolveEntries(dir, manifest, files) {
   ]);
 }
 var byPath = (a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0;
-function loadPackageFromFiles(files, name = "package") {
+function loadPackageFromFiles(files, name = "package", binaries = []) {
   const sorted = [...files].sort(byPath);
   let manifest = readManifest(sorted);
   if (manifest.state === "missing") {
     const data = sorted.some((f) => f.path === "SKILL.md") ? inferManifest(sorted, name) : inferNestedManifest(sorted, name);
     if (data) {
-      manifest = { state: "ok", inferred: true, data, raw: JSON.stringify(data, null, 2) };
+      manifest = { state: "ok", inferred: true, data };
     }
   }
   return {
-    dir: name,
     files: sorted,
     manifest,
     entries: resolveEntries(name, manifest, sorted),
-    sourceHash: hashFiles(sorted)
+    sourceHash: hashFiles(sorted),
+    binaries
   };
 }
 function loadPackage(dir) {
-  let files;
+  let tree;
   try {
-    files = walk(dir);
+    tree = walk(dir);
   } catch (err2) {
     throw new PackageReadError(dir, err2);
   }
-  return loadPackageFromFiles(files, dir);
+  return loadPackageFromFiles(tree.files, dir, tree.binaries);
 }
 
-// ../validator/src/rules/structure.ts
-var structureRule = (pkg) => {
-  if (pkg.files.length === 0) {
-    return [
-      {
-        severity: "failure",
-        code: "empty-package",
-        message: "the package contains no files"
-      }
-    ];
-  }
-  const findings = [];
-  if (pkg.manifest.state === "missing") {
-    findings.push({
-      severity: "warning",
-      code: "missing-manifest",
-      message: "no skill.json manifest; permissions and targets are undeclared"
-    });
-  } else if (pkg.manifest.state === "invalid") {
-    findings.push({
-      severity: "failure",
-      code: "invalid-manifest",
-      message: `skill.json is invalid: ${pkg.manifest.error}`,
-      location: { path: "skill.json" }
-    });
-  }
-  for (const entry of pkg.entries) {
-    if (!entry.exists) {
-      findings.push({
-        severity: "failure",
-        code: "missing-skill-file",
-        message: `skill "${entry.skillName}" references "${entry.path}", which does not exist`,
-        location: { path: entry.path }
-      });
-    } else {
-      const file2 = pkg.files.find((f) => f.path === entry.path);
-      if (file2 !== void 0 && file2.content.trim() === "") {
-        findings.push({
-          severity: "failure",
-          code: "missing-skill-file",
-          message: `skill "${entry.skillName}" entry "${entry.path}" is empty`,
-          location: { path: entry.path }
-        });
-      }
-    }
-  }
-  return findings;
-};
-
 // ../validator/src/rules/content.ts
 var SECRET_PATTERNS = [
   {
@@ -16037,28 +16056,113 @@ var ALL_ROWS = [
   ...advisory(MALWARE_PATTERNS),
   ...advisory(CREDENTIAL_PATTERNS)
 ];
+var DOCUMENTED_PLACEHOLDERS = ["AKIAIOSFODNN7EXAMPLE", "AKIAI44QH8DHBEXAMPLE"];
+var withoutPlaceholders = (line) => DOCUMENTED_PLACEHOLDERS.reduce((l, p) => l.replaceAll(p, " "), line);
+var REDACTIONS = ALL_ROWS.filter((row2) => row2.redact).map(
+  (row2) => new RegExp(row2.pattern.source, `${row2.pattern.flags}g`)
+);
+var redactLine = (line) => REDACTIONS.reduce((l, re) => l.replace(re, "[redacted]"), line);
 var contentRule = (pkg) => {
   const findings = [];
   for (const file2 of pkg.files) {
-    file2.content.split("\n").forEach((line, i2) => {
-      for (const row2 of ALL_ROWS) {
-        if (row2.pattern.test(line)) {
-          const snippet = row2.redact ? line.trim().replace(row2.pattern, "[redacted]") : line.trim();
-          findings.push({
-            severity: row2.severity ?? "failure",
-            code: row2.code,
-            message: row2.message,
-            location: { path: file2.path, line: i2 + 1, snippet }
-          });
-        }
+    file2.content.split("\n").forEach((rawLine, i2) => {
+      const line = withoutPlaceholders(rawLine);
+      const hits = ALL_ROWS.filter((row2) => row2.pattern.test(line));
+      if (hits.length === 0) return;
+      const snippet = redactLine(line).trim();
+      for (const row2 of hits) {
+        findings.push({
+          severity: row2.severity ?? "failure",
+          code: row2.code,
+          message: row2.message,
+          location: { path: file2.path, line: i2 + 1, snippet }
+        });
       }
     });
   }
   return findings;
 };
 
+// ../validator/src/rules/structure.ts
+var structureRule = (pkg) => {
+  if (pkg.files.length === 0) {
+    return [
+      {
+        severity: "failure",
+        code: "empty-package",
+        message: "the package contains no files"
+      }
+    ];
+  }
+  const findings = [];
+  if (pkg.manifest.state === "missing") {
+    findings.push({
+      severity: "warning",
+      code: "missing-manifest",
+      message: "no skill.json manifest; permissions and targets are undeclared"
+    });
+  } else if (pkg.manifest.state === "invalid") {
+    findings.push({
+      severity: "failure",
+      code: "invalid-manifest",
+      message: `skill.json is invalid: ${pkg.manifest.error}`,
+      location: { path: "skill.json" }
+    });
+  }
+  for (const path of pkg.binaries) {
+    findings.push({
+      severity: "warning",
+      code: "binary-dropped",
+      message: `"${path}" is not a text file and was left out of the snapshot; installs will not include it`,
+      location: { path }
+    });
+  }
+  for (const entry of pkg.entries) {
+    if (!entry.exists) {
+      findings.push({
+        severity: "failure",
+        code: "missing-skill-file",
+        message: `skill "${entry.skillName}" references "${entry.path}", which does not exist`,
+        location: { path: entry.path }
+      });
+    } else {
+      const file2 = pkg.files.find((f) => f.path === entry.path);
+      if (file2 !== void 0 && file2.content.trim() === "") {
+        findings.push({
+          severity: "failure",
+          code: "missing-skill-file",
+          message: `skill "${entry.skillName}" entry "${entry.path}" is empty`,
+          location: { path: entry.path }
+        });
+      }
+    }
+  }
+  return findings;
+};
+
+// ../validator/package.json
+var package_default = {
+  name: "validator",
+  version: "0.3.0",
+  private: true,
+  type: "module",
+  exports: {
+    ".": "./src/index.ts"
+  },
+  scripts: {
+    typecheck: "tsc --noEmit"
+  },
+  dependencies: {
+    "skill-schema": "workspace:*"
+  },
+  devDependencies: {
+    "@types/node": "^22.0.0",
+    typescript: "^6.0.3"
+  }
+};
+
 // ../validator/src/validate.ts
-var ENGINE_VERSION = "0.3.0";
+var ENGINE_VERSION = package_default.version;
 var RULES = [
   { key: "structure", label: "Check package structure", run: structureRule },
   { key: "content", label: "Scan content for risky patterns", run: contentRule }
@@ -16070,7 +16174,7 @@ function toReportFindings(findings) {
 }
 function buildReport(pkg, findings, opts = {}) {
   const declared = pkg.manifest.state === "ok" ? pkg.manifest.data.permissions : [];
-  const detected = detectPermissions(pkg.files).map((d) => d.permission).sort();
+  const detected = [...detectPermissions(pkg.files)].sort();
   const status = findings.some((f) => f.severity === "failure") ? "failed" : findings.some((f) => f.severity === "warning") ? "warning" : "passed";
   const report = {
     schemaVersion: "0.1",
@@ -16160,6 +16264,52 @@ async function fetchPreflight(fetchImpl, apiUrl, ref) {
   return { ok: true, slug, detail: detail.data, preflight: preflight.data };
 }
 
+// src/install.ts
+import { existsSync, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
+var GLOBAL_NEEDS_TARGET = "error: --global needs --target (e.g. --target claude-code)";
+var TARGET_OR_DIR = "error: pass --target or --dir, not both";
+function createOutput(emit) {
+  const lines = [];
+  const streamed = emit !== void 0;
+  const push = (...next) => {
+    lines.push(...next);
+    if (next.length > 0) emit?.(next.join("\n"));
+  };
+  const done = (exitCode) => ({ lines, exitCode, streamed });
+  return { push, done };
+}
+function isOccupied(path) {
+  return existsSync(path) && (!statSync2(path).isDirectory() || readdirSync2(path).length > 0);
+}
+function receiptFor(preflight, packSlug) {
+  return {
+    version: preflight.version,
+    sourceHash: preflight.sourceHash,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...packSlug ? { pack: { slug: packSlug, version: preflight.version } } : {}
+  };
+}
+function memberFiles(files, sourceDir) {
+  if (sourceDir === ".") {
+    return files;
+  }
+  const prefix = `${sourceDir}/`;
+  return files.filter((f) => f.path.startsWith(prefix)).map((f) => ({ path: f.path.slice(prefix.length), content: f.content }));
+}
+function planMembers(installs, files) {
+  return installs.map((m) => ({ ...m, files: memberFiles(files, m.sourceDir) }));
+}
+async function confirmRisk(preflight, opts, question, abortLine, push) {
+  if (preflight.riskLevel === "low" || opts.yes) return true;
+  if (!opts.confirmImpl) {
+    push("", `error: a ${preflight.riskLevel}-risk skill needs confirmation; rerun with --yes`);
+    return false;
+  }
+  if (await opts.confirmImpl(question)) return true;
+  push("", abortLine);
+  return false;
+}
+
 // src/pack.ts
 import { posix } from "node:path";
 function resolvePackMembers(members, target) {
@@ -16464,7 +16614,7 @@ function writeTree(files, target) {
       writeFileSync2(filePath, file2.content);
     }
     mkdirSync2(dirname(target), { recursive: true });
-    if (existsSync(target)) {
+    if (existsSync2(target)) {
       rmdirSync(target);
     }
     renameSync(tempDir, target);
@@ -16473,13 +16623,6 @@ function writeTree(files, target) {
     throw err2;
   }
 }
-function memberFiles(files, sourceDir) {
-  if (sourceDir === ".") {
-    return files;
-  }
-  const prefix = `${sourceDir}/`;
-  return files.filter((f) => f.path.startsWith(prefix)).map((f) => ({ path: f.path.slice(prefix.length), content: f.content }));
-}
 function installChoices(declared, slug) {
   const choices = [];
   const ordered = [
@@ -16531,22 +16674,146 @@ function packChoices(declared, slug, count) {
   choices.push({ label: `current directory (./${slug}, raw pack source)` });
   return choices;
 }
-async function runAdd(ref, opts = {}) {
-  const lines = [];
-  const streamed = opts.emit !== void 0;
-  const push = (...next) => {
-    lines.push(...next);
-    if (next.length > 0) {
-      opts.emit?.(next.join("\n"));
+async function promptIndex(ask, count, push) {
+  while (true) {
+    const answer = (await ask(`Where should it go? [1-${count}, default 1] `)).trim();
+    if (answer === "") return 0;
+    const index = /^\d+$/.test(answer) ? Number.parseInt(answer, 10) - 1 : -1;
+    if (index >= 0 && index < count) return index;
+    push(`  answer 1-${count}, or press enter for the default`);
+  }
+}
+async function choosePackLocation(ctx, detail, memberCount, prompt) {
+  if (prompt) {
+    const choices = packChoices(detail.targets, ctx.slug, memberCount);
+    ctx.push("", "Install location:");
+    choices.forEach((choice, i2) => ctx.push(`  ${i2 + 1}) ${choice.label}`));
+    const chosen = choices[await promptIndex(prompt, choices.length, ctx.push)];
+    return chosen.tool ? { tool: chosen.tool, global: chosen.global ?? false } : { dir: ctx.slug };
+  }
+  const mappable = mappableDeclaredTargets(detail.targets);
+  if (mappable.length > 0) {
+    ctx.push(
+      "",
+      `tip: --target ${mappable[0]} installs the ${memberCount} skills into the tool's skills folder`
+    );
+  }
+  return { dir: ctx.slug };
+}
+async function chooseSingleLocation(ctx, detail, prompt) {
+  const choices = installChoices(detail.targets, ctx.slug);
+  if (prompt && choices.length > 1) {
+    ctx.push("", "Install location:");
+    choices.forEach((choice, i2) => ctx.push(`  ${i2 + 1}) ${choice.label}`));
+    return choices[await promptIndex(prompt, choices.length, ctx.push)].dir;
+  }
+  const mappable = mappableDeclaredTargets(detail.targets);
+  if (mappable.length > 0) {
+    ctx.push("", `tip: --target ${mappable[0]} installs into the tool's skills folder`);
+  }
+  return ctx.slug;
+}
+async function installPack(ctx, members, tool, global) {
+  const { push, done, slug, preflight } = ctx;
+  const area = resolveTargetArea(tool, global);
+  if (!area.ok) {
+    push("", `error: ${area.message}`);
+    return done(2);
+  }
+  const { installs, skipped } = resolvePackMembers(members, tool);
+  if (installs.length === 0) {
+    push("", `error: none of this pack's skills support ${tool}`);
+    return done(2);
+  }
+  const areaAbs = resolve2(ctx.cwd, area.dir);
+  const conflicts = installs.map((m) => join4(areaAbs, m.name)).filter(isOccupied);
+  if (conflicts.length > 0) {
+    push(
+      "",
+      "error: these destinations already exist and are not empty; nothing was installed:",
+      ...conflicts.map((c) => `  ${c}`)
+    );
+    return done(2);
+  }
+  const download = await downloadVerified(ctx.fetchImpl, ctx.apiUrl, slug, preflight.version, preflight.sourceHash);
+  if (!download.ok) {
+    push("", `error: ${download.message}`);
+    return done(2);
+  }
+  const plans = planMembers(installs, download.files);
+  const missing = plans.find((p) => p.files.length === 0);
+  if (missing) {
+    push("", `error: the snapshot has no files for "${missing.name}"; nothing was installed`);
+    return done(2);
+  }
+  for (const name of skipped) {
+    push("", `note: ${name} does not support ${tool}; skipped`);
+  }
+  const written = [];
+  try {
+    for (const plan of plans) {
+      writeTree(plan.files, join4(areaAbs, plan.name));
+      written.push(plan.name);
+      recordReceipt(areaAbs, plan.name, receiptFor(preflight, slug));
     }
-  };
-  const done = (exitCode) => ({ lines, exitCode, streamed });
+  } catch {
+    push(
+      "",
+      `error: could not write ${plans[written.length].name}; installed before the failure: ${written.join(", ") || "none"}`
+    );
+    return done(2);
+  }
+  push(
+    "",
+    `Installed ${written.length} skills to ${areaAbs}`,
+    `  ${written.join(", ")}`,
+    "Source hash verified against the Skill Passport."
+  );
+  return done(0);
+}
+async function installSingle(ctx, targetDir) {
+  const { push, done, slug, preflight } = ctx;
+  const target = resolve2(ctx.cwd, targetDir);
+  if (existsSync2(target)) {
+    if (!statSync3(target).isDirectory()) {
+      push("", `error: target ${target} already exists and is not a directory`);
+      return done(2);
+    }
+    if (readdirSync3(target).length > 0) {
+      push("", `error: target directory ${target} already exists and is not empty`);
+      return done(2);
+    }
+  }
+  const download = await downloadVerified(ctx.fetchImpl, ctx.apiUrl, slug, preflight.version, preflight.sourceHash);
+  if (!download.ok) {
+    push("", `error: ${download.message}`);
+    return done(2);
+  }
+  try {
+    writeTree(download.files, target);
+  } catch {
+    push("", "error: could not write the install; nothing was installed");
+    return done(2);
+  }
+  const area = knownAreas(ctx.cwd).find((a) => a.dir === dirname(target));
+  if (area) {
+    recordReceipt(area.dir, slug, receiptFor(preflight));
+  }
+  push(
+    "",
+    `Installed ${download.files.length} file(s) to ${target}`,
+    "Source hash verified against the Skill Passport."
+  );
+  return done(0);
+}
+async function runAdd(ref, opts = {}) {
+  const { push, done } = createOutput(opts.emit);
   if (opts.target && opts.dir) {
-    push("error: pass --target or --dir, not both");
+    push(TARGET_OR_DIR);
     return done(2);
   }
   if (opts.global && !opts.target) {
-    push("error: --global needs --target (e.g. --target claude-code)");
+    push(GLOBAL_NEEDS_TARGET);
     return done(2);
   }
   const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
@@ -16564,8 +16831,7 @@ async function runAdd(ref, opts = {}) {
   const members = detail.packMembers ?? [];
   const isPack = members.length > 0;
   let targetDir = opts.dir;
-  let packTool;
-  let packGlobal = false;
+  let pack;
   if (opts.target) {
     const resolved = isPack ? resolveTargetArea(opts.target, opts.global) : resolveTargetDir(opts.target, slug, opts.global);
     if (!resolved.ok) {
@@ -16573,8 +16839,7 @@ async function runAdd(ref, opts = {}) {
       return done(2);
     }
     if (isPack) {
-      packTool = opts.target;
-      packGlobal = opts.global ?? false;
+      pack = { tool: opts.target, global: opts.global ?? false };
     } else {
       targetDir = resolved.dir;
     }
@@ -16582,127 +16847,30 @@ async function runAdd(ref, opts = {}) {
       push("", `warning: this skill does not declare ${opts.target} as a target`);
     }
   }
-  if (preflight.riskLevel !== "low" && !opts.yes) {
-    if (!opts.confirmImpl) {
-      push("", `error: a ${preflight.riskLevel}-risk skill needs confirmation; rerun with --yes`);
-      return done(2);
-    }
-    const confirmed = await opts.confirmImpl(
-      `Install ${slug}@${preflight.version} (${preflight.riskLevel} risk)? [y/N] `
-    );
-    if (!confirmed) {
-      push("", "Install aborted.");
-      return done(2);
-    }
-  }
-  const prompt = opts.promptImpl;
-  const promptIndex = async (ask, count) => {
-    while (true) {
-      const answer = (await ask(`Where should it go? [1-${count}, default 1] `)).trim();
-      if (answer === "") {
-        return 0;
-      }
-      const index = /^\d+$/.test(answer) ? Number.parseInt(answer, 10) - 1 : -1;
-      if (index >= 0 && index < count) {
-        return index;
-      }
-      push(`  answer 1-${count}, or press enter for the default`);
-    }
+  const confirmed = await confirmRisk(
+    preflight,
+    opts,
+    `Install ${slug}@${preflight.version} (${preflight.riskLevel} risk)? [y/N] `,
+    "Install aborted.",
+    push
+  );
+  if (!confirmed) return done(2);
+  const ctx = {
+    push,
+    done,
+    fetchImpl,
+    apiUrl,
+    cwd: opts.cwd ?? process.cwd(),
+    slug,
+    preflight
   };
-  if (isPack && packTool === void 0 && targetDir === void 0) {
-    if (prompt) {
-      const choices = packChoices(detail.targets, slug, members.length);
-      push("", "Install location:");
-      choices.forEach((choice, i2) => push(`  ${i2 + 1}) ${choice.label}`));
-      const chosen = choices[await promptIndex(prompt, choices.length)];
-      if (chosen.tool) {
-        packTool = chosen.tool;
-        packGlobal = chosen.global ?? false;
-      } else {
-        targetDir = slug;
-      }
-    } else {
-      targetDir = slug;
-      const mappable = mappableDeclaredTargets(detail.targets);
-      if (mappable.length > 0) {
-        push(
-          "",
-          `tip: --target ${mappable[0]} installs the ${members.length} skills into the tool's skills folder`
-        );
-      }
-    }
+  if (isPack && pack === void 0 && targetDir === void 0) {
+    const location = await choosePackLocation(ctx, detail, members.length, opts.promptImpl);
+    if ("tool" in location) pack = location;
+    else targetDir = location.dir;
   }
-  if (packTool !== void 0) {
-    const area2 = resolveTargetArea(packTool, packGlobal);
-    if (!area2.ok) {
-      push("", `error: ${area2.message}`);
-      return done(2);
-    }
-    const { installs, skipped } = resolvePackMembers(members, packTool);
-    if (installs.length === 0) {
-      push("", `error: none of this pack's skills support ${packTool}`);
-      return done(2);
-    }
-    const areaAbs = resolve2(opts.cwd ?? process.cwd(), area2.dir);
-    const conflicts = installs.map((m) => join4(areaAbs, m.name)).filter(
-      (dest) => existsSync(dest) && (!statSync2(dest).isDirectory() || readdirSync2(dest).length > 0)
-    );
-    if (conflicts.length > 0) {
-      push(
-        "",
-        "error: these destinations already exist and are not empty; nothing was installed:",
-        ...conflicts.map((c) => `  ${c}`)
-      );
-      return done(2);
-    }
-    const download2 = await downloadVerified(
-      fetchImpl,
-      apiUrl,
-      slug,
-      preflight.version,
-      preflight.sourceHash
-    );
-    if (!download2.ok) {
-      push("", `error: ${download2.message}`);
-      return done(2);
-    }
-    const plans = installs.map((m) => ({ ...m, files: memberFiles(download2.files, m.sourceDir) }));
-    const missing = plans.find((p) => p.files.length === 0);
-    if (missing) {
-      push("", `error: the snapshot has no files for "${missing.name}"; nothing was installed`);
-      return done(2);
-    }
-    for (const name of skipped) {
-      push("", `note: ${name} does not support ${packTool}; skipped`);
-    }
-    const written = [];
-    try {
-      for (const plan of plans) {
-        writeTree(plan.files, join4(areaAbs, plan.name));
-        written.push(plan.name);
-      }
-    } catch {
-      push(
-        "",
-        `error: could not write ${plans[written.length].name}; installed before the failure: ${written.join(", ") || "none"}`
-      );
-      return done(2);
-    }
-    for (const name of written) {
-      recordReceipt(areaAbs, name, {
-        version: preflight.version,
-        sourceHash: preflight.sourceHash,
-        installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        pack: { slug, version: preflight.version }
-      });
-    }
-    push(
-      "",
-      `Installed ${written.length} skills to ${areaAbs}`,
-      `  ${written.join(", ")}`,
-      "Source hash verified against the Skill Passport."
-    );
-    return done(0);
+  if (pack !== void 0) {
+    return installPack(ctx, members, pack.tool, pack.global);
   }
   if (isPack && opts.dir) {
     push(
@@ -16710,72 +16878,17 @@ async function runAdd(ref, opts = {}) {
       `note: --dir installs the raw pack source; --target <tool> installs the ${members.length} skills individually`
     );
   }
-  if (!targetDir) {
-    const choices = installChoices(detail.targets, slug);
-    if (prompt && choices.length > 1) {
-      push("", "Install location:");
-      choices.forEach((choice, i2) => push(`  ${i2 + 1}) ${choice.label}`));
-      targetDir = choices[await promptIndex(prompt, choices.length)].dir;
-    } else {
-      targetDir = slug;
-      const mappable = mappableDeclaredTargets(detail.targets);
-      if (mappable.length > 0) {
-        push("", `tip: --target ${mappable[0]} installs into the tool's skills folder`);
-      }
-    }
-  }
-  const target = resolve2(opts.cwd ?? process.cwd(), targetDir);
-  if (existsSync(target)) {
-    if (!statSync2(target).isDirectory()) {
-      push("", `error: target ${target} already exists and is not a directory`);
-      return done(2);
-    }
-    if (readdirSync2(target).length > 0) {
-      push("", `error: target directory ${target} already exists and is not empty`);
-      return done(2);
-    }
-  }
-  const download = await downloadVerified(
-    fetchImpl,
-    apiUrl,
-    slug,
-    preflight.version,
-    preflight.sourceHash
-  );
-  if (!download.ok) {
-    push("", `error: ${download.message}`);
-    return done(2);
-  }
-  try {
-    writeTree(download.files, target);
-  } catch {
-    push("", "error: could not write the install; nothing was installed");
-    return done(2);
-  }
-  const area = knownAreas(opts.cwd ?? process.cwd()).find((a) => a.dir === dirname(target));
-  if (area) {
-    recordReceipt(area.dir, slug, {
-      version: preflight.version,
-      sourceHash: preflight.sourceHash,
-      installedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-  }
-  push(
-    "",
-    `Installed ${download.files.length} file(s) to ${target}`,
-    "Source hash verified against the Skill Passport."
-  );
-  return done(0);
+  return installSingle(ctx, targetDir ?? await chooseSingleLocation(ctx, detail, opts.promptImpl));
 }
 
 // src/list.ts
-import { existsSync as existsSync2, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync3, readdirSync as readdirSync4, statSync as statSync4 } from "node:fs";
 import { join as join5 } from "node:path";
 function installedIn(dir) {
-  if (!existsSync2(dir)) {
+  if (!existsSync3(dir)) {
     return [];
   }
-  return readdirSync3(dir).sort().filter((name) => statSync3(join5(dir, name)).isDirectory());
+  return readdirSync4(dir).sort().filter((name) => statSync4(join5(dir, name), { throwIfNoEntry: false })?.isDirectory() ?? false);
 }
 function runList(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
@@ -16927,33 +17040,21 @@ async function runOutdated(opts = {}) {
 }
 
 // src/remove.ts
-import { existsSync as existsSync3, rmSync as rmSync2, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync4, rmSync as rmSync2, statSync as statSync5 } from "node:fs";
 import { dirname as dirname2, join as join7, resolve as resolve3 } from "node:path";
 function looksLikeInstalledSkill(dir) {
-  return existsSync3(join7(dir, "SKILL.md")) || existsSync3(join7(dir, "skill.json"));
+  return existsSync4(join7(dir, "SKILL.md")) || existsSync4(join7(dir, "skill.json"));
 }
 function candidateDirs(slug, cwd, home) {
-  const dirs = [];
-  const byTarget = installAreas(home);
-  for (const tool of MAPPED_TARGETS) {
-    const area = byTarget[tool];
-    if (!area) {
-      continue;
-    }
-    dirs.push(resolve3(cwd, join7(area.project, slug)));
-    if (area.global) {
-      dirs.push(join7(area.global, slug));
-    }
-  }
-  dirs.push(resolve3(cwd, slug));
-  return [...new Set(dirs)];
+  const inAreas = knownAreas(cwd, home).map((area) => join7(area.dir, slug));
+  return [.../* @__PURE__ */ new Set([...inAreas, resolve3(cwd, slug)])];
 }
 function runRemove(slug, opts = {}) {
   if (opts.target && opts.dir) {
-    return { lines: ["error: pass --target or --dir, not both"], exitCode: 2 };
+    return { lines: [TARGET_OR_DIR], exitCode: 2 };
   }
   if (opts.global && !opts.target) {
-    return { lines: ["error: --global needs --target (e.g. --target claude-code)"], exitCode: 2 };
+    return { lines: [GLOBAL_NEEDS_TARGET], exitCode: 2 };
   }
   const cwd = opts.cwd ?? process.cwd();
   if (!opts.dir) {
@@ -17000,7 +17101,7 @@ function runRemove(slug, opts = {}) {
     dir = resolve3(cwd, opts.dir);
   } else {
     const found = candidateDirs(slug, cwd, opts.home).filter(
-      (candidate) => existsSync3(candidate)
+      (candidate) => existsSync4(candidate)
     );
     if (found.length === 0) {
       return { lines: [`error: ${slug} is not installed in any known location`], exitCode: 2 };
@@ -17016,10 +17117,10 @@ function runRemove(slug, opts = {}) {
     }
     dir = found[0];
   }
-  if (!existsSync3(dir)) {
+  if (!existsSync4(dir)) {
     return { lines: [`error: nothing installed at ${dir}`], exitCode: 2 };
   }
-  if (!statSync4(dir).isDirectory()) {
+  if (!statSync5(dir).isDirectory()) {
     return { lines: [`error: ${dir} is not a directory`], exitCode: 2 };
   }
   if (!looksLikeInstalledSkill(dir)) {
@@ -17159,7 +17260,7 @@ async function runSearch(opts = {}) {
 }
 
 // src/update.ts
-import { existsSync as existsSync4, readdirSync as readdirSync4, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync5, renameSync as renameSync2, rmSync as rmSync3 } from "node:fs";
 import { join as join8 } from "node:path";
 async function locate(slug, opts, fetchImpl, apiUrl) {
   const cwd = opts.cwd ?? process.cwd();
@@ -17186,7 +17287,7 @@ async function locate(slug, opts, fetchImpl, apiUrl) {
       hits.push({ area, dir: area.dir, installedVersion: packMember.pack.version, packSlug: slug });
       continue;
     }
-    if (existsSync4(dir)) {
+    if (existsSync5(dir)) {
       const identified = await identifyByHash(fetchImpl, apiUrl, slug, dir);
       if (identified !== void 0) {
         hits.push({ area, dir, installedVersion: identified });
@@ -17207,30 +17308,23 @@ function permissionChanges(installed, target) {
 function swapTree(files, dir) {
   const fresh = `${dir}.new-${process.pid}`;
   const aside = `${dir}.old-${process.pid}`;
+  rmSync3(fresh, { recursive: true, force: true });
   writeTree(files, fresh);
-  renameSync2(dir, aside);
   try {
+    if (existsSync5(dir)) renameSync2(dir, aside);
     renameSync2(fresh, dir);
   } catch (err2) {
-    renameSync2(aside, dir);
+    if (existsSync5(aside) && !existsSync5(dir)) renameSync2(aside, dir);
     rmSync3(fresh, { recursive: true, force: true });
     throw err2;
   }
   rmSync3(aside, { recursive: true, force: true });
 }
 async function runUpdate(ref, opts = {}) {
-  const lines = [];
-  const streamed = opts.emit !== void 0;
-  const push = (...next) => {
-    lines.push(...next);
-    if (next.length > 0) {
-      opts.emit?.(next.join("\n"));
-    }
-  };
-  const done = (exitCode) => ({ lines, exitCode, streamed });
+  const { push, done } = createOutput(opts.emit);
   const st = opts.style ?? PLAIN;
   if (opts.global && !opts.target) {
-    push("error: --global needs --target (e.g. --target claude-code)");
+    push(GLOBAL_NEEDS_TARGET);
     return done(2);
   }
   const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
@@ -17280,19 +17374,14 @@ async function runUpdate(ref, opts = {}) {
   if (preflight.blocked) {
     return done(1);
   }
-  if (preflight.riskLevel !== "low" && !opts.yes) {
-    if (!opts.confirmImpl) {
-      push("", `error: a ${preflight.riskLevel}-risk skill needs confirmation; rerun with --yes`);
-      return done(2);
-    }
-    const confirmed = await opts.confirmImpl(
-      `Update ${slug} to ${preflight.version} (${preflight.riskLevel} risk)? [y/N] `
-    );
-    if (!confirmed) {
-      push("", "Update aborted; the installed version was left in place.");
-      return done(2);
-    }
-  }
+  const confirmed = await confirmRisk(
+    preflight,
+    opts,
+    `Update ${slug} to ${preflight.version} (${preflight.riskLevel} risk)? [y/N] `,
+    "Update aborted; the installed version was left in place.",
+    push
+  );
+  if (!confirmed) return done(2);
   const download = await downloadVerified(fetchImpl, apiUrl, slug, preflight.version, preflight.sourceHash);
   if (!download.ok) {
     push("", `error: ${download.message}`);
@@ -17304,11 +17393,7 @@ async function runUpdate(ref, opts = {}) {
     push("", "error: could not replace the install; the installed version was left in place");
     return done(2);
   }
-  recordReceipt(installed.area.dir, slug, {
-    version: preflight.version,
-    sourceHash: preflight.sourceHash,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString()
-  });
+  recordReceipt(installed.area.dir, slug, receiptFor(preflight));
   push(
     "",
     `Updated ${slug} ${installed.installedVersion ?? "?"} -> ${preflight.version} in ${installed.dir}`,
@@ -17354,19 +17439,14 @@ async function runPackUpdate(slug, installed, detail, preflight, opts, fetchImpl
   if (preflight.blocked) {
     return done(1);
   }
-  if (preflight.riskLevel !== "low" && !opts.yes) {
-    if (!opts.confirmImpl) {
-      push("", `error: a ${preflight.riskLevel}-risk skill needs confirmation; rerun with --yes`);
-      return done(2);
-    }
-    const confirmed = await opts.confirmImpl(
-      `Update ${slug} to ${preflight.version} (${preflight.riskLevel} risk)? [y/N] `
-    );
-    if (!confirmed) {
-      push("", "Update aborted; the installed version was left in place.");
-      return done(2);
-    }
-  }
+  const confirmed = await confirmRisk(
+    preflight,
+    opts,
+    `Update ${slug} to ${preflight.version} (${preflight.riskLevel} risk)? [y/N] `,
+    "Update aborted; the installed version was left in place.",
+    push
+  );
+  if (!confirmed) return done(2);
   const areaDir = installed.area.dir;
   const { installs, skipped } = resolvePackMembers(detail.packMembers ?? [], installed.area.tool);
   if (installs.length === 0) {
@@ -17378,9 +17458,7 @@ async function runPackUpdate(slug, installed, detail, preflight, opts, fetchImpl
   const newNames = new Set(installs.map((m) => m.name));
   const toRemove = currentMembers.filter((name) => !newNames.has(name));
   const additions = installs.filter((m) => !currentMembers.includes(m.name));
-  const conflicts = additions.map((m) => join8(areaDir, m.name)).filter(
-    (dest) => existsSync4(dest) && (!statSync5(dest).isDirectory() || readdirSync4(dest).length > 0)
-  );
+  const conflicts = additions.map((m) => join8(areaDir, m.name)).filter(isOccupied);
   if (conflicts.length > 0) {
     push(
       "",
@@ -17394,7 +17472,7 @@ async function runPackUpdate(slug, installed, detail, preflight, opts, fetchImpl
     push("", `error: ${download.message}`);
     return done(2);
   }
-  const plans = installs.map((m) => ({ ...m, files: memberFiles(download.files, m.sourceDir) }));
+  const plans = planMembers(installs, download.files);
   const missing = plans.find((p) => p.files.length === 0);
   if (missing) {
     push("", `error: the snapshot has no files for "${missing.name}"; nothing was changed`);
@@ -17407,18 +17485,13 @@ async function runPackUpdate(slug, installed, detail, preflight, opts, fetchImpl
   try {
     for (const plan of plans) {
       const dest = join8(areaDir, plan.name);
-      if (existsSync4(dest)) {
+      if (existsSync5(dest)) {
         swapTree(plan.files, dest);
       } else {
         writeTree(plan.files, dest);
       }
       done1.push(plan.name);
-      recordReceipt(areaDir, plan.name, {
-        version: preflight.version,
-        sourceHash: preflight.sourceHash,
-        installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        pack: { slug, version: preflight.version }
-      });
+      recordReceipt(areaDir, plan.name, receiptFor(preflight, slug));
     }
   } catch {
     push(
@@ -17689,10 +17762,17 @@ async function run(argv) {
   }
   return { lines: [`error: unknown command "${args.command}"`, "", USAGE], exitCode: 2 };
 }
-async function main(argv) {
-  const result = await run(argv);
+async function main(argv, runImpl = run) {
+  let result;
+  try {
+    result = await runImpl(argv);
+  } catch (err2) {
+    console.error(`error: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    process.exitCode = 2;
+    return;
+  }
   if (!result.streamed) {
-    console.log(result.lines.join("\n"));
+    (result.exitCode === 2 ? console.error : console.log)(result.lines.join("\n"));
   }
   process.exitCode = result.exitCode;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillpass",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Validation-first installer for AI agent skills: search the SkillPass directory, inspect a skill's passport, and install hash-verified skills and packs for Claude Code, Codex, and more.",
   "keywords": [
     "ai",
@@ -21,7 +21,7 @@
   "author": "Brad Traversy",
   "type": "module",
   "bin": {
-    "skillpass": "./bin/skillpass.mjs"
+    "skillpass": "./bin/skillpass.js"
   },
   "files": [
     "bin",
@@ -36,11 +36,11 @@
     "esbuild": "^0.28.1",
     "fflate": "^0.8.3",
     "typescript": "^6.0.3",
-    "validator": "0.3.0",
-    "skill-schema": "0.1.0"
+    "skill-schema": "0.1.0",
+    "validator": "0.3.0"
   },
   "scripts": {
-    "build": "esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist/cli.mjs --log-level=warning",
+    "build": "esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist/cli.js --log-level=warning",
     "typecheck": "tsc --noEmit"
   }
 }

package/bin/skillpass.mjs

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-import '../dist/cli.mjs';