skillpass 0.2.0 → 0.4.0

package/dist/{cli.mjs → cli.js}

@@ -492,16 +492,7 @@ function unzipSync(data, opts) {
 }
 
 // src/add.ts
-import {
-  existsSync,
-  mkdirSync as mkdirSync2,
-  readdirSync as readdirSync2,
-  renameSync,
-  rmdirSync,
-  rmSync,
-  statSync as statSync2,
-  writeFileSync as writeFileSync2
-} from "node:fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync3, renameSync, rmdirSync, rmSync, statSync as statSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname, isAbsolute, join as join4, resolve as resolve2 } from "node:path";
 
 // ../validator/src/load.ts
@@ -15281,10 +15272,10 @@ function parseManifest(input) {
 }
 
 // ../skill-schema/src/report.ts
-var reportFindingSchema = external_exports.strictObject({
+var reportFindingSchema = external_exports.object({
   code: external_exports.string().min(1),
   message: external_exports.string().min(1),
-  location: external_exports.strictObject({
+  location: external_exports.object({
     path: external_exports.string().min(1),
     line: external_exports.number().int().positive().optional(),
     snippet: external_exports.string().optional()
@@ -15313,11 +15304,11 @@ var validationReportSchema = external_exports.strictObject({
 });
 
 // ../skill-schema/src/passport.ts
-var skillPassportSchema = external_exports.strictObject({
+var skillPassportSchema = external_exports.object({
   schemaVersion: external_exports.literal("0.1"),
   validationStatus: validationStatusSchema,
   riskLevel: riskLevelSchema,
-  permissionsSummary: external_exports.strictObject({
+  permissionsSummary: external_exports.object({
     declared: external_exports.array(permissionKeySchema),
     detected: external_exports.array(permissionKeySchema)
   }),
@@ -15338,7 +15329,7 @@ var skillPassportSchema = external_exports.strictObject({
 
 // ../skill-schema/src/ai-review.ts
 var aiReviewVerdictSchema = external_exports.enum(["clear", "caution", "concern"]);
-var aiReviewSchema = external_exports.strictObject({
+var aiReviewSchema = external_exports.object({
   summary: external_exports.string().min(1).max(600),
   verdict: aiReviewVerdictSchema,
   reasoning: external_exports.string().min(1).max(800),
@@ -15348,14 +15339,7 @@ var aiReviewSchema = external_exports.strictObject({
 
 // ../skill-schema/src/submission.ts
 var SUBMISSION_SOURCE_TYPES = ["github_url", "zip"];
-var SUBMISSION_STATUSES = [
-  "draft",
-  "validating",
-  "passed",
-  "warning",
-  "failed",
-  "published"
-];
+var SUBMISSION_STATUSES = ["draft", "validating", "passed", "warning", "failed", "published"];
 var submissionSourceTypeSchema = external_exports.enum(SUBMISSION_SOURCE_TYPES);
 var submissionStatusSchema = external_exports.enum(SUBMISSION_STATUSES);
 var MAX_ZIP_BYTES = 10 * 1024 * 1024;
@@ -15390,9 +15374,14 @@ var publishResultSchema = external_exports.object({
   slug: external_exports.string().min(1),
   version: external_exports.string().min(1)
 });
+var MAX_SLUG_LENGTH = 60;
+function slugForSkill(name) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, MAX_SLUG_LENGTH).replace(/-+$/, "");
+  return slug || "skill";
+}
 
 // ../skill-schema/src/public.ts
-var publicSkillSummarySchema = external_exports.strictObject({
+var publicSkillSummarySchema = external_exports.object({
   slug: external_exports.string().min(1),
   name: external_exports.string().min(1),
   summary: external_exports.string().min(1),
@@ -15422,7 +15411,7 @@ var publicSkillSummarySchema = external_exports.strictObject({
   publishedAt: external_exports.iso.datetime()
 });
 var publicSkillListSchema = external_exports.array(publicSkillSummarySchema);
-var publicSkillVersionSchema = external_exports.strictObject({
+var publicSkillVersionSchema = external_exports.object({
   version: external_exports.string().min(1),
   validationStatus: validationStatusSchema,
   riskLevel: riskLevelSchema,
@@ -15431,10 +15420,10 @@ var publicSkillVersionSchema = external_exports.strictObject({
 var publicSkillDetailSchema = publicSkillSummarySchema.extend({
   // Full member entries (incl. per-target variants) for a pack; the CLI's
   // per-target install resolution reads exactly this. Null for single skills.
-  packMembers: external_exports.array(skillEntrySchema).nullable().optional(),
+  packMembers: external_exports.array(external_exports.object(skillEntrySchema.shape)).nullable().optional(),
   githubRepoUrl: external_exports.string().min(1).nullable(),
   passport: skillPassportSchema,
-  maintainerInfo: external_exports.strictObject({
+  maintainerInfo: external_exports.object({
     username: external_exports.string().min(1),
     displayName: external_exports.string().min(1),
     avatarUrl: external_exports.string().min(1)
@@ -15443,18 +15432,18 @@ var publicSkillDetailSchema = publicSkillSummarySchema.extend({
   // The cached AI review for this version's source hash; null until generated.
   aiReview: aiReviewSchema.nullable()
 });
-var publicSkillSourceSchema = external_exports.strictObject({
+var publicSkillSourceSchema = external_exports.object({
   version: external_exports.string().min(1),
   sourceHash: external_exports.string().min(1),
-  files: external_exports.array(external_exports.strictObject({ path: external_exports.string().min(1), content: external_exports.string() }))
+  files: external_exports.array(external_exports.object({ path: external_exports.string().min(1), content: external_exports.string() }))
 });
 
 // ../skill-schema/src/preflight.ts
-var permissionSetDiffSchema = external_exports.strictObject({
+var permissionSetDiffSchema = external_exports.object({
   added: external_exports.array(permissionKeySchema),
   removed: external_exports.array(permissionKeySchema)
 });
-var publicPreflightSchema = external_exports.strictObject({
+var publicPreflightSchema = external_exports.object({
   version: external_exports.string().min(1),
   validationStatus: validationStatusSchema,
   riskLevel: riskLevelSchema,
@@ -15462,11 +15451,11 @@ var publicPreflightSchema = external_exports.strictObject({
   sourceVerified: external_exports.boolean(),
   resolvedCommitSha: external_exports.string().min(1).nullable(),
   generatedAt: external_exports.iso.datetime(),
-  permissions: external_exports.strictObject({
+  permissions: external_exports.object({
     declared: external_exports.array(permissionKeySchema),
     detected: external_exports.array(permissionKeySchema)
   }),
-  diff: external_exports.strictObject({
+  diff: external_exports.object({
     previousVersion: external_exports.string().min(1),
     declared: permissionSetDiffSchema,
     detected: permissionSetDiffSchema
@@ -15546,6 +15535,39 @@ var resolveReportInputSchema = external_exports.strictObject({
   status: external_exports.enum(["reviewed", "actioned"])
 });
 
+// ../skill-schema/src/maintainer.ts
+var SKILL_STATUSES = ["published", "draft", "private", "flagged"];
+var skillStatusSchema = external_exports.enum(SKILL_STATUSES);
+var maintainerSkillSchema = external_exports.strictObject({
+  slug: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  status: skillStatusSchema,
+  version: external_exports.string().nullable(),
+  validationStatus: validationStatusSchema.nullable(),
+  riskLevel: riskLevelSchema.nullable(),
+  updatedAt: external_exports.iso.datetime()
+});
+var maintainerReportSchema = external_exports.strictObject({
+  id: external_exports.number().int().positive(),
+  skill: external_exports.strictObject({ slug: external_exports.string(), name: external_exports.string() }),
+  reason: external_exports.string(),
+  status: abuseReportStatusSchema,
+  createdAt: external_exports.iso.datetime()
+});
+
+// ../skill-schema/src/user.ts
+var USER_ROLES = ["user", "maintainer", "admin"];
+var userRoleSchema = external_exports.enum(USER_ROLES);
+var publicUserSchema = external_exports.object({
+  id: external_exports.number().int().positive(),
+  username: external_exports.string().min(1),
+  displayName: external_exports.string().min(1),
+  avatarUrl: external_exports.string().min(1),
+  role: userRoleSchema,
+  reputation: external_exports.number().int(),
+  createdAt: external_exports.iso.datetime()
+});
+
 // ../validator/src/rules/permissions.ts
 var PERMISSION_SIGNALS = [
   {
@@ -15600,24 +15622,30 @@ var PERMISSION_SIGNALS = [
   }
 ];
 function detectPermissions(files) {
-  const detected = /* @__PURE__ */ new Map();
+  const detected = /* @__PURE__ */ new Set();
   for (const file2 of files) {
-    file2.content.split("\n").forEach((line, i2) => {
+    for (const line of file2.content.split("\n")) {
       for (const signal of PERMISSION_SIGNALS) {
         if (!detected.has(signal.permission) && signal.pattern.test(line)) {
-          detected.set(signal.permission, {
-            permission: signal.permission,
-            description: signal.description,
-            location: { path: file2.path, line: i2 + 1, snippet: line.trim() }
-          });
+          detected.add(signal.permission);
         }
       }
-    });
+    }
   }
-  return [...detected.values()];
+  return [...detected];
 }
 
 // ../validator/src/load.ts
+var NUL_SCAN_BYTES = 8e3;
+function isBinary(bytes) {
+  if (bytes.subarray(0, NUL_SCAN_BYTES).includes(0)) return true;
+  try {
+    new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return false;
+  } catch {
+    return true;
+  }
+}
 var PackageReadError = class extends Error {
   constructor(dir, cause) {
     super(`cannot read skill package at "${dir}"`, { cause });
@@ -15626,19 +15654,23 @@ var PackageReadError = class extends Error {
 };
 var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
 function walk(root, rel = "") {
-  const files = [];
+  const tree = { files: [], binaries: [] };
   for (const name of readdirSync(join(root, rel)).sort()) {
     const relPath = rel === "" ? name : `${rel}/${name}`;
     const stats = statSync(join(root, relPath));
     if (stats.isDirectory()) {
       if (!SKIP_DIRS.has(name)) {
-        files.push(...walk(root, relPath));
+        const sub = walk(root, relPath);
+        tree.files.push(...sub.files);
+        tree.binaries.push(...sub.binaries);
       }
     } else {
-      files.push({ path: relPath, content: readFileSync(join(root, relPath), "utf8") });
+      const bytes = readFileSync(join(root, relPath));
+      if (isBinary(bytes)) tree.binaries.push(relPath);
+      else tree.files.push({ path: relPath, content: bytes.toString("utf8") });
     }
   }
-  return files;
+  return tree;
 }
 function hashFiles(files) {
   const hash2 = createHash("sha256");
@@ -15665,9 +15697,16 @@ function readManifest(files) {
   if (!result.success) {
     return { state: "invalid", error: result.error };
   }
-  return { state: "ok", data: result.data, raw: file2.content };
+  return { state: "ok", data: result.data };
 }
 var FRONTMATTER_RE = /^---\n([\s\S]*?)\n---/;
+function readDeclaredVersion(frontmatter) {
+  const top = /^version:\s*["']?([^"'\s]+)["']?\s*$/m.exec(frontmatter);
+  if (top) return top[1];
+  const block = /^metadata:\s*\n((?:[ \t]+\S.*(?:\n|$))*)/m.exec(frontmatter);
+  const nested = block && /^[ \t]+version:\s*["']?([^"'\s]+)["']?\s*$/m.exec(block[1]);
+  return nested ? nested[1] : void 0;
+}
 function readSkillMeta(content) {
   const out = {};
   const fm = FRONTMATTER_RE.exec(content);
@@ -15690,19 +15729,45 @@ function readSkillMeta(content) {
         const text = block[1] === ">" ? gathered.join(" ").replace(/\s+/g, " ").trim() : gathered.join("\n").trim();
         if (text) out[key] = text;
       } else {
-        out[key] = kv[2].replace(/^["']|["']$/g, "");
+        const parts = [kv[2]];
+        for (let j = i2 + 1; j < lines.length && /^\s+\S/.test(lines[j]); j++) parts.push(lines[j].trim());
+        out[key] = parts.join(" ").replace(/^["']|["']$/g, "");
       }
     }
+    const version2 = readDeclaredVersion(fm[1]);
+    if (version2) out.version = version2;
   }
   if (!out.description) {
-    const prose = body.split("\n").map((line) => line.trim()).find((line) => line && !line.startsWith("#"));
-    if (prose) out.description = prose.slice(0, 200);
+    const prose = firstParagraph(body);
+    if (prose) out.description = prose;
   }
   return out;
 }
-function slugify2(value) {
-  const slug = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return slug || "skill";
+var HTML_TAG_RE = /<\/?[a-zA-Z][^>]*>/g;
+var MD_LINK_RE = /\[([^\]]*)\]\([^)]*\)/g;
+var STRUCTURAL_LINE_RE = /^(#|!\[|\[!\[|---$|\*\*\*$|___$)|^<h[1-6][\s>]/i;
+var DESCRIPTION_MAX = 200;
+var cleanInline = (line) => line.replace(HTML_TAG_RE, " ").replace(MD_LINK_RE, "$1").replace(/^>\s?/, "").replace(/\s+/g, " ").trim();
+function clip(text, max2) {
+  if (text.length <= max2) return text;
+  const head = text.slice(0, max2);
+  const sentenceEnd = Math.max(head.lastIndexOf(". "), head.lastIndexOf("! "), head.lastIndexOf("? "));
+  if (sentenceEnd >= 60) return head.slice(0, sentenceEnd + 1);
+  const wordEnd = head.lastIndexOf(" ");
+  return (wordEnd > 0 ? head.slice(0, wordEnd) : head).replace(/[,;:]+$/, "").trim();
+}
+function firstParagraph(text) {
+  const kept = [];
+  for (const raw of text.split("\n")) {
+    const source = raw.trim();
+    const line = STRUCTURAL_LINE_RE.test(source) ? "" : cleanInline(source);
+    if (!line) {
+      if (kept.length > 0) break;
+      continue;
+    }
+    kept.push(line);
+  }
+  return kept.length > 0 ? clip(kept.join(" "), DESCRIPTION_MAX) : void 0;
 }
 function inferTargets(files) {
   const targets = /* @__PURE__ */ new Set();
@@ -15715,11 +15780,12 @@ function inferTargets(files) {
 function inferManifest(files, fallbackName) {
   const skillFile = files.find((f) => f.path === "SKILL.md");
   const meta3 = skillFile ? readSkillMeta(skillFile.content) : {};
-  const name = slugify2(meta3.name ?? fallbackName);
-  const permissions = [...new Set(detectPermissions(files).map((d) => d.permission))];
+  const name = slugForSkill(meta3.name ?? fallbackName);
+  const permissions = detectPermissions(files);
   return {
     schemaVersion: "0.1",
     name,
+    ...meta3.version && SEMVER_RE.test(meta3.version) ? { version: meta3.version } : {},
     description: meta3.description ?? name,
     targets: inferTargets(files),
     permissions,
@@ -15751,16 +15817,10 @@ function collectMemberFiles(files) {
 }
 function readmeProse(files) {
   const readme = files.find((f) => f.path === "README.md");
-  if (!readme) return void 0;
-  const prose = readme.content.split("\n").map((line) => line.trim()).find(
-    (line) => line && !line.startsWith("#") && !line.startsWith("![") && !line.startsWith("[![") && !line.startsWith("<")
-  );
-  return prose?.slice(0, 200);
+  return readme ? firstParagraph(readme.content) : void 0;
 }
 function inferNestedManifest(files, fallbackName) {
-  const members = collectMemberFiles(files).sort(
-    (a, b) => a.folder < b.folder ? -1 : a.folder > b.folder ? 1 : 0
-  );
+  const members = collectMemberFiles(files).sort((a, b) => a.folder < b.folder ? -1 : a.folder > b.folder ? 1 : 0);
   if (members.length === 0) {
     return null;
   }
@@ -15770,13 +15830,10 @@ function inferNestedManifest(files, fallbackName) {
     const entryPath = member.claudePath ?? member.agentsPath ?? member.plainPath;
     const file2 = files.find((f) => f.path === entryPath);
     const meta3 = readSkillMeta(file2.content);
-    let entryName = slugify2(meta3.name ?? member.folder);
-    if (used.has(entryName)) entryName = slugify2(member.folder);
+    let entryName = slugForSkill(meta3.name ?? member.folder);
+    if (used.has(entryName)) entryName = slugForSkill(member.folder);
     used.add(entryName);
-    const targets = member.plainPath ? inferTargets(files) : [
-      ...member.claudePath ? ["claude-code"] : [],
-      ...member.agentsPath ? ["codex"] : []
-    ];
+    const targets = member.plainPath ? inferTargets(files) : [...member.claudePath ? ["claude-code"] : [], ...member.agentsPath ? ["codex"] : []];
     for (const target of targets) packTargets.add(target);
     return {
       name: entryName,
@@ -15787,10 +15844,10 @@ function inferNestedManifest(files, fallbackName) {
     };
   });
   const single = entries.length === 1 ? entries[0] : null;
-  const permissions = [...new Set(detectPermissions(files).map((d) => d.permission))];
+  const permissions = detectPermissions(files);
   return {
     schemaVersion: "0.1",
-    name: single ? single.name : slugify2(fallbackName),
+    name: single ? single.name : slugForSkill(fallbackName),
     description: single ? single.description ?? single.name : readmeProse(files) ?? `A pack of ${entries.length} skills`,
     targets: [...packTargets],
     permissions,
@@ -15820,82 +15877,33 @@ function resolveEntries(dir, manifest, files) {
   ]);
 }
 var byPath = (a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0;
-function loadPackageFromFiles(files, name = "package") {
+function loadPackageFromFiles(files, name = "package", binaries = []) {
   const sorted = [...files].sort(byPath);
   let manifest = readManifest(sorted);
   if (manifest.state === "missing") {
     const data = sorted.some((f) => f.path === "SKILL.md") ? inferManifest(sorted, name) : inferNestedManifest(sorted, name);
     if (data) {
-      manifest = { state: "ok", inferred: true, data, raw: JSON.stringify(data, null, 2) };
+      manifest = { state: "ok", inferred: true, data };
     }
   }
   return {
-    dir: name,
     files: sorted,
     manifest,
     entries: resolveEntries(name, manifest, sorted),
-    sourceHash: hashFiles(sorted)
+    sourceHash: hashFiles(sorted),
+    binaries
   };
 }
 function loadPackage(dir) {
-  let files;
+  let tree;
   try {
-    files = walk(dir);
+    tree = walk(dir);
   } catch (err2) {
     throw new PackageReadError(dir, err2);
   }
-  return loadPackageFromFiles(files, dir);
+  return loadPackageFromFiles(tree.files, dir, tree.binaries);
 }
 
-// ../validator/src/rules/structure.ts
-var structureRule = (pkg) => {
-  if (pkg.files.length === 0) {
-    return [
-      {
-        severity: "failure",
-        code: "empty-package",
-        message: "the package contains no files"
-      }
-    ];
-  }
-  const findings = [];
-  if (pkg.manifest.state === "missing") {
-    findings.push({
-      severity: "warning",
-      code: "missing-manifest",
-      message: "no skill.json manifest; permissions and targets are undeclared"
-    });
-  } else if (pkg.manifest.state === "invalid") {
-    findings.push({
-      severity: "failure",
-      code: "invalid-manifest",
-      message: `skill.json is invalid: ${pkg.manifest.error}`,
-      location: { path: "skill.json" }
-    });
-  }
-  for (const entry of pkg.entries) {
-    if (!entry.exists) {
-      findings.push({
-        severity: "failure",
-        code: "missing-skill-file",
-        message: `skill "${entry.skillName}" references "${entry.path}", which does not exist`,
-        location: { path: entry.path }
-      });
-    } else {
-      const file2 = pkg.files.find((f) => f.path === entry.path);
-      if (file2 !== void 0 && file2.content.trim() === "") {
-        findings.push({
-          severity: "failure",
-          code: "missing-skill-file",
-          message: `skill "${entry.skillName}" entry "${entry.path}" is empty`,
-          location: { path: entry.path }
-        });
-      }
-    }
-  }
-  return findings;
-};
-
 // ../validator/src/rules/content.ts
 var SECRET_PATTERNS = [
   {
@@ -16012,10 +16020,12 @@ var CREDENTIAL_PATTERNS = [
   },
   {
     code: "credential-harvesting",
-    // The ::/. lookbehinds skip code identifiers (`Box::leak(secret)`,
-    // `.leak(`) so security docs naming anti-patterns don't flag.
+    // The verb has to sit where an instruction puts it (line or sentence
+    // start, or after then/and/to/should/must): narrative like "timing leaks
+    // secret bits" has a noun subject and does not fire. The ::/. lookbehinds
+    // skip code identifiers (`Box::leak(secret)`, `.leak(`).
     pattern: new RegExp(
-      String.raw`(?<!\b(?:never|not|don'?t|avoids?|prevents?|stops?)\s)(?<!::)(?<!\.)\b(?:exfiltrates?|steals?|harvests?|dumps?|leaks?)\b[^.\n]{0,60}?${SECRET_NOUN}`,
+      String.raw`(?:^[-*\d.)\s]*|[.:;!?]\s+|\b(?:then|and|or|to|should|must|now|please)\s+)(?<!\b(?:never|not|don'?t|avoids?|prevents?|stops?)\s)(?<!::)(?<!\.)(?:exfiltrate|steal|harvest|dump|leak)s?\b[^.\n]{0,60}?${SECRET_NOUN}`,
       "i"
     ),
     message: "matches a credential-exfiltration phrase"
@@ -16029,36 +16039,143 @@ var CREDENTIAL_PATTERNS = [
     message: "matches a credential-file network-transmission phrase"
   }
 ];
-var advisory = (rows) => rows.map((row2) => ({ ...row2, severity: "warning" }));
+var advisory = (rows, mentionAware = false) => rows.map((row2) => ({ ...row2, severity: "warning", mentionAware }));
 var ALL_ROWS = [
   ...SECRET_PATTERNS,
-  ...advisory(INJECTION_PATTERNS),
+  ...advisory(INJECTION_PATTERNS, true),
   ...advisory(DANGEROUS_PATTERNS),
   ...advisory(MALWARE_PATTERNS),
-  ...advisory(CREDENTIAL_PATTERNS)
+  ...advisory(CREDENTIAL_PATTERNS, true)
 ];
+var MENTION_LEAD_RE = /\b(?:flags?|flagged|detects?|detecting|look(?:ing)?\s+for|watch\s+for|check(?:ing)?\s+for|signs?\s+of|indicators?\s+of|evidence\s+of|red\s+flags?|examples?|e\.g\.|such\s+as|attempts?\s+to|designed\s+to|(?:code|scripts?|files?|comments?|text|instructions?)\s+that)\b/i;
+var TRANSMIT_VERB_RE = /\b(?:post|send|curl|transmit|exfiltrate)s?\b/i;
+function matchAnchor(line, match) {
+  if (match[0]) return match.index;
+  const verb = line.search(TRANSMIT_VERB_RE);
+  return verb < 0 ? line.length : verb;
+}
+function isMention(line, anchor, inFence) {
+  if (inFence || line.trimStart().startsWith("|")) return true;
+  const before = line.slice(0, anchor);
+  const inside = (mark) => (before.split(mark).length - 1) % 2 === 1;
+  return inside('"') || inside("`") || MENTION_LEAD_RE.test(before);
+}
+var FENCE_RE = /^\s*(?:```|~~~)/;
+var DOCUMENTED_PLACEHOLDERS = ["AKIAIOSFODNN7EXAMPLE", "AKIAI44QH8DHBEXAMPLE"];
+var withoutPlaceholders = (line) => DOCUMENTED_PLACEHOLDERS.reduce((l, p) => l.replaceAll(p, " "), line);
+var REDACTIONS = ALL_ROWS.filter((row2) => row2.redact).map(
+  (row2) => new RegExp(row2.pattern.source, `${row2.pattern.flags}g`)
+);
+var redactLine = (line) => REDACTIONS.reduce((l, re) => l.replace(re, "[redacted]"), line);
 var contentRule = (pkg) => {
   const findings = [];
   for (const file2 of pkg.files) {
-    file2.content.split("\n").forEach((line, i2) => {
-      for (const row2 of ALL_ROWS) {
-        if (row2.pattern.test(line)) {
-          const snippet = row2.redact ? line.trim().replace(row2.pattern, "[redacted]") : line.trim();
-          findings.push({
-            severity: row2.severity ?? "failure",
-            code: row2.code,
-            message: row2.message,
-            location: { path: file2.path, line: i2 + 1, snippet }
-          });
-        }
+    let inFence = false;
+    file2.content.split("\n").forEach((rawLine, i2) => {
+      if (FENCE_RE.test(rawLine)) {
+        inFence = !inFence;
+        return;
       }
+      const line = withoutPlaceholders(rawLine);
+      const hits = ALL_ROWS.filter((row2) => {
+        const match = row2.pattern.exec(line);
+        return match !== null && !(row2.mentionAware && isMention(line, matchAnchor(line, match), inFence));
+      });
+      if (hits.length === 0) return;
+      const snippet = redactLine(line).trim();
+      for (const row2 of hits) {
+        findings.push({
+          severity: row2.severity ?? "failure",
+          code: row2.code,
+          message: row2.message,
+          location: { path: file2.path, line: i2 + 1, snippet }
+        });
+      }
+    });
+  }
+  return findings;
+};
+
+// ../validator/src/rules/structure.ts
+var structureRule = (pkg) => {
+  if (pkg.files.length === 0) {
+    return [
+      {
+        severity: "failure",
+        code: "empty-package",
+        message: "the package contains no files"
+      }
+    ];
+  }
+  const findings = [];
+  if (pkg.manifest.state === "missing") {
+    findings.push({
+      severity: "warning",
+      code: "missing-manifest",
+      message: "no skill.json manifest; permissions and targets are undeclared"
+    });
+  } else if (pkg.manifest.state === "invalid") {
+    findings.push({
+      severity: "failure",
+      code: "invalid-manifest",
+      message: `skill.json is invalid: ${pkg.manifest.error}`,
+      location: { path: "skill.json" }
     });
   }
+  for (const path of pkg.binaries) {
+    findings.push({
+      severity: "warning",
+      code: "binary-dropped",
+      message: `"${path}" is not a text file and was left out of the snapshot; installs will not include it`,
+      location: { path }
+    });
+  }
+  for (const entry of pkg.entries) {
+    if (!entry.exists) {
+      findings.push({
+        severity: "failure",
+        code: "missing-skill-file",
+        message: `skill "${entry.skillName}" references "${entry.path}", which does not exist`,
+        location: { path: entry.path }
+      });
+    } else {
+      const file2 = pkg.files.find((f) => f.path === entry.path);
+      if (file2 !== void 0 && file2.content.trim() === "") {
+        findings.push({
+          severity: "failure",
+          code: "missing-skill-file",
+          message: `skill "${entry.skillName}" entry "${entry.path}" is empty`,
+          location: { path: entry.path }
+        });
+      }
+    }
+  }
   return findings;
 };
 
+// ../validator/package.json
+var package_default = {
+  name: "validator",
+  version: "0.3.0",
+  private: true,
+  type: "module",
+  exports: {
+    ".": "./src/index.ts"
+  },
+  scripts: {
+    typecheck: "tsc --noEmit"
+  },
+  dependencies: {
+    "skill-schema": "workspace:*"
+  },
+  devDependencies: {
+    "@types/node": "^22.0.0",
+    typescript: "^6.0.3"
+  }
+};
+
 // ../validator/src/validate.ts
-var ENGINE_VERSION = "0.3.0";
+var ENGINE_VERSION = package_default.version;
 var RULES = [
   { key: "structure", label: "Check package structure", run: structureRule },
   { key: "content", label: "Scan content for risky patterns", run: contentRule }
@@ -16070,7 +16187,7 @@ function toReportFindings(findings) {
 }
 function buildReport(pkg, findings, opts = {}) {
   const declared = pkg.manifest.state === "ok" ? pkg.manifest.data.permissions : [];
-  const detected = detectPermissions(pkg.files).map((d) => d.permission).sort();
+  const detected = [...detectPermissions(pkg.files)].sort();
   const status = findings.some((f) => f.severity === "failure") ? "failed" : findings.some((f) => f.severity === "warning") ? "warning" : "passed";
   const report = {
     schemaVersion: "0.1",
@@ -16121,10 +16238,23 @@ async function getParsed(fetchImpl, url2, schema) {
   try {
     body = await res.json();
   } catch {
-    return { ok: false, notFound: false, message: `unexpected response from the API (${res.status})` };
+    return {
+      ok: false,
+      notFound: false,
+      message: `unexpected response from the API (${res.status})`,
+      status: res.status
+    };
   }
   if (typeof body !== "object" || body === null || !("success" in body) || body.success !== true) {
-    return res.status === 404 ? { ok: false, notFound: true, message: "not found" } : { ok: false, notFound: false, message: `the API returned an error (${res.status})` };
+    const error51 = body?.error;
+    const apiError = typeof error51 === "string" ? { apiError: error51 } : {};
+    return res.status === 404 ? { ok: false, notFound: true, message: "not found", status: 404, ...apiError } : {
+      ok: false,
+      notFound: false,
+      message: `the API returned an error (${res.status})`,
+      status: res.status,
+      ...apiError
+    };
   }
   const parsed = schema.safeParse(body.data);
   if (!parsed.success) {
@@ -16160,6 +16290,52 @@ async function fetchPreflight(fetchImpl, apiUrl, ref) {
   return { ok: true, slug, detail: detail.data, preflight: preflight.data };
 }
 
+// src/install.ts
+import { existsSync, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
+var GLOBAL_NEEDS_TARGET = "error: --global needs --target (e.g. --target claude-code)";
+var TARGET_OR_DIR = "error: pass --target or --dir, not both";
+function createOutput(emit) {
+  const lines = [];
+  const streamed = emit !== void 0;
+  const push = (...next) => {
+    lines.push(...next);
+    if (next.length > 0) emit?.(next.join("\n"));
+  };
+  const done = (exitCode) => ({ lines, exitCode, streamed });
+  return { push, done };
+}
+function isOccupied(path) {
+  return existsSync(path) && (!statSync2(path).isDirectory() || readdirSync2(path).length > 0);
+}
+function receiptFor(preflight, packSlug) {
+  return {
+    version: preflight.version,
+    sourceHash: preflight.sourceHash,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...packSlug ? { pack: { slug: packSlug, version: preflight.version } } : {}
+  };
+}
+function memberFiles(files, sourceDir) {
+  if (sourceDir === ".") {
+    return files;
+  }
+  const prefix = `${sourceDir}/`;
+  return files.filter((f) => f.path.startsWith(prefix)).map((f) => ({ path: f.path.slice(prefix.length), content: f.content }));
+}
+function planMembers(installs, files) {
+  return installs.map((m) => ({ ...m, files: memberFiles(files, m.sourceDir) }));
+}
+async function confirmRisk(preflight, opts, question, abortLine, push) {
+  if (preflight.riskLevel === "low" || opts.yes) return true;
+  if (!opts.confirmImpl) {
+    push("", `error: a ${preflight.riskLevel}-risk skill needs confirmation; rerun with --yes`);
+    return false;
+  }
+  if (await opts.confirmImpl(question)) return true;
+  push("", abortLine);
+  return false;
+}
+
 // src/pack.ts
 import { posix } from "node:path";
 function resolvePackMembers(members, target) {
@@ -16308,10 +16484,7 @@ function renderPreflightReport(detail, preflight, st = PLAIN) {
     ...renderDiff(preflight.diff)
   ];
   if (preflight.blocked) {
-    lines.push(
-      "",
-      st.red(`BLOCKED: ${preflight.blockedReason ?? "this version cannot be downloaded"}`)
-    );
+    lines.push("", st.red(`BLOCKED: ${preflight.blockedReason ?? "this version cannot be downloaded"}`));
   }
   return lines;
 }
@@ -16334,37 +16507,39 @@ function renderDiff(diff) {
 // src/targets.ts
 import { homedir } from "node:os";
 import { join as join3, resolve } from "node:path";
-function installAreas(home = homedir()) {
-  return {
-    "claude-code": { project: join3(".claude", "skills"), global: join3(home, ".claude", "skills") },
-    codex: { project: join3(".agents", "skills") }
-  };
+var SHARED = { project: join3(".agents", "skills"), global: join3(".agents", "skills"), layout: "codex" };
+var INSTALL_TOOLS = {
+  "claude-code": { project: join3(".claude", "skills"), global: join3(".claude", "skills"), layout: "claude-code" },
+  agents: SHARED,
+  codex: SHARED,
+  cursor: SHARED,
+  windsurf: SHARED,
+  "github-copilot": SHARED,
+  "gemini-cli": SHARED,
+  opencode: SHARED,
+  cline: { project: join3(".cline", "skills"), global: join3(".cline", "skills"), layout: "codex" }
+};
+var INSTALL_TOOL_NAMES = Object.keys(INSTALL_TOOLS);
+function lookupTool(name) {
+  return Object.hasOwn(INSTALL_TOOLS, name) ? INSTALL_TOOLS[name] : void 0;
+}
+var MAPPED_TARGETS = TARGETS.filter((t) => lookupTool(t) !== void 0);
+function layoutTarget(tool) {
+  return lookupTool(tool)?.layout;
+}
+function declaresTool(declared, tool) {
+  const layout = layoutTarget(tool);
+  return declared.includes(tool) || layout !== void 0 && declared.includes(layout);
 }
-var MAPPED_TARGETS = Object.keys(installAreas());
 function resolveTargetArea(target, global = false, home) {
-  if (!TARGETS.includes(target)) {
-    return {
-      ok: false,
-      message: `unknown target "${target}" (known tools: ${TARGETS.join(", ")})`
-    };
-  }
-  const area = installAreas(home)[target];
-  if (!area) {
-    return {
-      ok: false,
-      message: `${target} has no standard skills folder yet; use --dir to pick a location`
-    };
-  }
-  if (global) {
-    if (!area.global) {
-      return {
-        ok: false,
-        message: `${target} has no user-level skills folder; install per project instead`
-      };
+  const tool = lookupTool(target);
+  if (!tool) {
+    if (TARGETS.includes(target)) {
+      return { ok: false, message: `${target} has no standard skills folder yet; use --dir to pick a location` };
     }
-    return { ok: true, dir: area.global };
+    return { ok: false, message: `unknown target "${target}" (known tools: ${INSTALL_TOOL_NAMES.join(", ")})` };
   }
-  return { ok: true, dir: area.project };
+  return { ok: true, dir: global ? join3(home ?? homedir(), tool.global) : tool.project };
 }
 function resolveTargetDir(target, slug, global = false, home) {
   const area = resolveTargetArea(target, global, home);
@@ -16374,24 +16549,48 @@ function mappableDeclaredTargets(declared) {
   return declared.filter((t) => MAPPED_TARGETS.includes(t));
 }
 function knownAreas(cwd, home) {
-  const areas = [];
-  const byTarget = installAreas(home);
-  for (const tool of MAPPED_TARGETS) {
-    const area = byTarget[tool];
-    if (!area) {
-      continue;
-    }
-    areas.push({
-      tool,
-      global: false,
-      label: `${tool} project (${area.project})`,
-      dir: resolve(cwd, area.project)
-    });
-    if (area.global) {
-      areas.push({ tool, global: true, label: `${tool} user (${area.global})`, dir: area.global });
+  const areas = /* @__PURE__ */ new Map();
+  for (const [name, tool] of Object.entries(INSTALL_TOOLS)) {
+    const scopes = [
+      { global: false, display: tool.project, dir: resolve(cwd, tool.project) },
+      { global: true, display: join3(home ?? homedir(), tool.global), dir: join3(home ?? homedir(), tool.global) }
+    ];
+    for (const scope of scopes) {
+      const existing = areas.get(scope.dir);
+      if (existing) {
+        if (!existing.tools.includes(name)) existing.tools.push(name);
+        existing.project ||= !scope.global;
+        existing.global ||= scope.global;
+        existing.label = areaLabel(existing);
+        continue;
+      }
+      const area = {
+        tools: [name],
+        layout: tool.layout,
+        project: !scope.global,
+        global: scope.global,
+        label: "",
+        dir: scope.dir
+      };
+      area.label = areaLabel(area, scope.display);
+      areas.set(scope.dir, area);
     }
   }
-  return areas;
+  return [...areas.values()];
+}
+function areaLabel(area, display) {
+  const shown = display ?? area.label.slice(0, area.label.indexOf(" ("));
+  const scopes = [...area.project ? ["project"] : [], ...area.global ? ["user"] : []].join(", ");
+  return `${shown} (${scopes}) - ${area.tools.join(", ")}`;
+}
+function resolveArea(target, global, cwd, home) {
+  const resolved = resolveTargetArea(target, global, home);
+  if (!resolved.ok) {
+    return resolved;
+  }
+  const dir = resolve(cwd, resolved.dir);
+  const area = knownAreas(cwd, home).find((a) => a.dir === dir);
+  return area ? { ok: true, area } : { ok: false, message: `no known skills area for ${target}` };
 }
 
 // src/add.ts
@@ -16464,7 +16663,7 @@ function writeTree(files, target) {
       writeFileSync2(filePath, file2.content);
     }
     mkdirSync2(dirname(target), { recursive: true });
-    if (existsSync(target)) {
+    if (existsSync2(target)) {
       rmdirSync(target);
     }
     renameSync(tempDir, target);
@@ -16473,309 +16672,247 @@ function writeTree(files, target) {
     throw err2;
   }
 }
-function memberFiles(files, sourceDir) {
-  if (sourceDir === ".") {
-    return files;
-  }
-  const prefix = `${sourceDir}/`;
-  return files.filter((f) => f.path.startsWith(prefix)).map((f) => ({ path: f.path.slice(prefix.length), content: f.content }));
+function orderedAreas(declared, cwd, home) {
+  const areas = knownAreas(cwd, home).map((area) => ({
+    ...area,
+    declared: area.tools.some((tool) => declaresTool(declared, tool))
+  }));
+  return [...areas.filter((a) => a.declared), ...areas.filter((a) => !a.declared)];
 }
-function installChoices(declared, slug) {
-  const choices = [];
-  const ordered = [
-    ...MAPPED_TARGETS.filter((t) => declared.includes(t)),
-    ...MAPPED_TARGETS.filter((t) => !declared.includes(t))
-  ];
-  for (const tool of ordered) {
-    const note = declared.includes(tool) ? "" : " - not declared by this skill";
-    const resolved = resolveTargetDir(tool, slug);
-    if (resolved.ok) {
-      choices.push({ label: `${tool} skills folder (${resolved.dir})${note}`, dir: resolved.dir });
-    }
-    const global = resolveTargetDir(tool, slug, true);
-    if (global.ok) {
-      choices.push({
-        label: `${tool} user-level skills folder (${global.dir})${note}`,
-        dir: global.dir
-      });
-    }
-  }
+function installChoices(declared, slug, cwd, home) {
+  const choices = orderedAreas(declared, cwd, home).map((area) => ({
+    label: `${area.label}${area.declared ? "" : " - not declared by this skill"}`,
+    dir: join4(area.dir, slug)
+  }));
   choices.push({ label: `current directory (./${slug})`, dir: slug });
   return choices;
 }
-function packChoices(declared, slug, count) {
-  const choices = [];
-  const ordered = [
-    ...MAPPED_TARGETS.filter((t) => declared.includes(t)),
-    ...MAPPED_TARGETS.filter((t) => !declared.includes(t))
-  ];
-  for (const tool of ordered) {
-    const note = declared.includes(tool) ? "" : " - not declared by this pack";
-    const project = resolveTargetArea(tool);
-    if (project.ok) {
-      choices.push({
-        label: `${tool} skills folder (${project.dir}) - ${count} skills${note}`,
-        tool,
-        global: false
-      });
-    }
-    const global = resolveTargetArea(tool, true);
-    if (global.ok) {
-      choices.push({
-        label: `${tool} user-level skills folder (${global.dir}) - ${count} skills${note}`,
-        tool,
-        global: true
-      });
-    }
-  }
+function packChoices(declared, slug, count, cwd, home) {
+  const choices = orderedAreas(declared, cwd, home).map((area) => ({
+    label: `${area.label} - ${count} skills${area.declared ? "" : " - not declared by this pack"}`,
+    area
+  }));
   choices.push({ label: `current directory (./${slug}, raw pack source)` });
   return choices;
 }
-async function runAdd(ref, opts = {}) {
-  const lines = [];
-  const streamed = opts.emit !== void 0;
-  const push = (...next) => {
-    lines.push(...next);
-    if (next.length > 0) {
-      opts.emit?.(next.join("\n"));
-    }
-  };
-  const done = (exitCode) => ({ lines, exitCode, streamed });
-  if (opts.target && opts.dir) {
-    push("error: pass --target or --dir, not both");
+async function promptIndex(ask, count, push) {
+  while (true) {
+    const answer = (await ask(`Where should it go? [1-${count}, default 1] `)).trim();
+    if (answer === "") return 0;
+    const index = /^\d+$/.test(answer) ? Number.parseInt(answer, 10) - 1 : -1;
+    if (index >= 0 && index < count) return index;
+    push(`  answer 1-${count}, or press enter for the default`);
+  }
+}
+async function choosePackLocation(ctx, detail, memberCount, prompt) {
+  if (prompt) {
+    const choices = packChoices(detail.targets, ctx.slug, memberCount, ctx.cwd, ctx.home);
+    ctx.push("", "Install location:");
+    choices.forEach((choice, i2) => ctx.push(`  ${i2 + 1}) ${choice.label}`));
+    const chosen = choices[await promptIndex(prompt, choices.length, ctx.push)];
+    return chosen.area ? { area: chosen.area } : { dir: ctx.slug };
+  }
+  const mappable = mappableDeclaredTargets(detail.targets);
+  if (mappable.length > 0) {
+    ctx.push("", `tip: --target ${mappable[0]} installs the ${memberCount} skills into the tool's skills folder`);
+  }
+  return { dir: ctx.slug };
+}
+async function chooseSingleLocation(ctx, detail, prompt) {
+  const choices = installChoices(detail.targets, ctx.slug, ctx.cwd, ctx.home);
+  if (prompt && choices.length > 1) {
+    ctx.push("", "Install location:");
+    choices.forEach((choice, i2) => ctx.push(`  ${i2 + 1}) ${choice.label}`));
+    return choices[await promptIndex(prompt, choices.length, ctx.push)].dir;
+  }
+  const mappable = mappableDeclaredTargets(detail.targets);
+  if (mappable.length > 0) {
+    ctx.push("", `tip: --target ${mappable[0]} installs into the tool's skills folder`);
+  }
+  return ctx.slug;
+}
+async function installPack(ctx, members, targets) {
+  const { push, done, slug, preflight } = ctx;
+  const resolved = targets.map(({ area, tool }) => ({ area, tool, ...resolvePackMembers(members, area.layout) }));
+  const unsupported = resolved.find((r) => r.installs.length === 0);
+  if (unsupported) {
+    push("", `error: none of this pack's skills support ${unsupported.tool}`);
     return done(2);
   }
-  if (opts.global && !opts.target) {
-    push("error: --global needs --target (e.g. --target claude-code)");
+  const conflicts = resolved.flatMap((r) => r.installs.map((m) => join4(r.area.dir, m.name))).filter(isOccupied);
+  if (conflicts.length > 0) {
+    push(
+      "",
+      "error: these destinations already exist and are not empty; nothing was installed:",
+      ...conflicts.map((c) => `  ${c}`)
+    );
     return done(2);
   }
-  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
-  const apiUrl = resolveApiUrl(opts.apiUrl);
-  const fetched = await fetchPreflight(fetchImpl, apiUrl, ref);
-  if (!fetched.ok) {
-    push(...fetched.result.lines);
-    return done(fetched.result.exitCode);
-  }
-  const { slug, detail, preflight } = fetched;
-  push(...renderPreflightReport(detail, preflight, opts.style));
-  if (preflight.blocked) {
-    return done(1);
+  const download = await downloadVerified(ctx.fetchImpl, ctx.apiUrl, slug, preflight.version, preflight.sourceHash);
+  if (!download.ok) {
+    push("", `error: ${download.message}`);
+    return done(2);
   }
-  const members = detail.packMembers ?? [];
-  const isPack = members.length > 0;
-  let targetDir = opts.dir;
-  let packTool;
-  let packGlobal = false;
-  if (opts.target) {
-    const resolved = isPack ? resolveTargetArea(opts.target, opts.global) : resolveTargetDir(opts.target, slug, opts.global);
-    if (!resolved.ok) {
-      push("", `error: ${resolved.message}`);
-      return done(2);
-    }
-    if (isPack) {
-      packTool = opts.target;
-      packGlobal = opts.global ?? false;
-    } else {
-      targetDir = resolved.dir;
-    }
-    if (!detail.targets.includes(opts.target)) {
-      push("", `warning: this skill does not declare ${opts.target} as a target`);
-    }
+  const planned = resolved.map((r) => ({ ...r, plans: planMembers(r.installs, download.files) }));
+  const missing = planned.flatMap((r) => r.plans).find((p) => p.files.length === 0);
+  if (missing) {
+    push("", `error: the snapshot has no files for "${missing.name}"; nothing was installed`);
+    return done(2);
   }
-  if (preflight.riskLevel !== "low" && !opts.yes) {
-    if (!opts.confirmImpl) {
-      push("", `error: a ${preflight.riskLevel}-risk skill needs confirmation; rerun with --yes`);
-      return done(2);
-    }
-    const confirmed = await opts.confirmImpl(
-      `Install ${slug}@${preflight.version} (${preflight.riskLevel} risk)? [y/N] `
-    );
-    if (!confirmed) {
-      push("", "Install aborted.");
-      return done(2);
+  for (const r of planned) {
+    for (const name of r.skipped) {
+      push("", `note: ${name} does not support ${r.tool}; skipped`);
     }
   }
-  const prompt = opts.promptImpl;
-  const promptIndex = async (ask, count) => {
-    while (true) {
-      const answer = (await ask(`Where should it go? [1-${count}, default 1] `)).trim();
-      if (answer === "") {
-        return 0;
-      }
-      const index = /^\d+$/.test(answer) ? Number.parseInt(answer, 10) - 1 : -1;
-      if (index >= 0 && index < count) {
-        return index;
-      }
-      push(`  answer 1-${count}, or press enter for the default`);
-    }
-  };
-  if (isPack && packTool === void 0 && targetDir === void 0) {
-    if (prompt) {
-      const choices = packChoices(detail.targets, slug, members.length);
-      push("", "Install location:");
-      choices.forEach((choice, i2) => push(`  ${i2 + 1}) ${choice.label}`));
-      const chosen = choices[await promptIndex(prompt, choices.length)];
-      if (chosen.tool) {
-        packTool = chosen.tool;
-        packGlobal = chosen.global ?? false;
-      } else {
-        targetDir = slug;
-      }
-    } else {
-      targetDir = slug;
-      const mappable = mappableDeclaredTargets(detail.targets);
-      if (mappable.length > 0) {
-        push(
-          "",
-          `tip: --target ${mappable[0]} installs the ${members.length} skills into the tool's skills folder`
-        );
+  const landed = [];
+  const describe3 = (dir, names) => planned.length > 1 ? `${dir}: ${names.join(", ")}` : names.join(", ");
+  for (const r of planned) {
+    const written = [];
+    try {
+      for (const plan of r.plans) {
+        writeTree(plan.files, join4(r.area.dir, plan.name));
+        written.push(plan.name);
+        recordReceipt(r.area.dir, plan.name, receiptFor(preflight, slug));
       }
-    }
-  }
-  if (packTool !== void 0) {
-    const area2 = resolveTargetArea(packTool, packGlobal);
-    if (!area2.ok) {
-      push("", `error: ${area2.message}`);
-      return done(2);
-    }
-    const { installs, skipped } = resolvePackMembers(members, packTool);
-    if (installs.length === 0) {
-      push("", `error: none of this pack's skills support ${packTool}`);
-      return done(2);
-    }
-    const areaAbs = resolve2(opts.cwd ?? process.cwd(), area2.dir);
-    const conflicts = installs.map((m) => join4(areaAbs, m.name)).filter(
-      (dest) => existsSync(dest) && (!statSync2(dest).isDirectory() || readdirSync2(dest).length > 0)
-    );
-    if (conflicts.length > 0) {
+    } catch {
+      const before = [...landed, ...written.length > 0 ? [describe3(r.area.dir, written)] : []];
+      const where = planned.length > 1 ? ` in ${r.area.dir}` : "";
       push(
         "",
-        "error: these destinations already exist and are not empty; nothing was installed:",
-        ...conflicts.map((c) => `  ${c}`)
+        `error: could not write ${r.plans[written.length].name}${where}; installed before the failure: ${before.join("; ") || "none"}`
       );
       return done(2);
     }
-    const download2 = await downloadVerified(
-      fetchImpl,
-      apiUrl,
-      slug,
-      preflight.version,
-      preflight.sourceHash
-    );
-    if (!download2.ok) {
-      push("", `error: ${download2.message}`);
+    landed.push(describe3(r.area.dir, written));
+    push("", `Installed ${written.length} skills to ${r.area.dir}`, `  ${written.join(", ")}`);
+  }
+  push("Source hash verified against the Skill Passport.");
+  return done(0);
+}
+async function installSingle(ctx, targetDirs) {
+  const { push, done, slug, preflight } = ctx;
+  const targets = targetDirs.map((dir) => resolve2(ctx.cwd, dir));
+  for (const target of targets) {
+    if (!existsSync2(target)) continue;
+    if (!statSync3(target).isDirectory()) {
+      push("", `error: target ${target} already exists and is not a directory`);
       return done(2);
     }
-    const plans = installs.map((m) => ({ ...m, files: memberFiles(download2.files, m.sourceDir) }));
-    const missing = plans.find((p) => p.files.length === 0);
-    if (missing) {
-      push("", `error: the snapshot has no files for "${missing.name}"; nothing was installed`);
+    if (readdirSync3(target).length > 0) {
+      push("", `error: target directory ${target} already exists and is not empty`);
       return done(2);
     }
-    for (const name of skipped) {
-      push("", `note: ${name} does not support ${packTool}; skipped`);
-    }
-    const written = [];
+  }
+  const download = await downloadVerified(ctx.fetchImpl, ctx.apiUrl, slug, preflight.version, preflight.sourceHash);
+  if (!download.ok) {
+    push("", `error: ${download.message}`);
+    return done(2);
+  }
+  const areas = knownAreas(ctx.cwd, ctx.home);
+  const landed = [];
+  for (const target of targets) {
     try {
-      for (const plan of plans) {
-        writeTree(plan.files, join4(areaAbs, plan.name));
-        written.push(plan.name);
-      }
+      writeTree(download.files, target);
     } catch {
       push(
         "",
-        `error: could not write ${plans[written.length].name}; installed before the failure: ${written.join(", ") || "none"}`
+        landed.length === 0 ? "error: could not write the install; nothing was installed" : `error: could not write ${target}; installed before the failure: ${landed.join(", ")}`
       );
       return done(2);
     }
-    for (const name of written) {
-      recordReceipt(areaAbs, name, {
-        version: preflight.version,
-        sourceHash: preflight.sourceHash,
-        installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        pack: { slug, version: preflight.version }
-      });
+    landed.push(target);
+    const area = areas.find((a) => a.dir === dirname(target));
+    if (area) {
+      recordReceipt(area.dir, slug, receiptFor(preflight));
     }
-    push(
-      "",
-      `Installed ${written.length} skills to ${areaAbs}`,
-      `  ${written.join(", ")}`,
-      "Source hash verified against the Skill Passport."
-    );
-    return done(0);
+    push("", `Installed ${download.files.length} file(s) to ${target}`);
   }
-  if (isPack && opts.dir) {
-    push(
-      "",
-      `note: --dir installs the raw pack source; --target <tool> installs the ${members.length} skills individually`
-    );
+  push("Source hash verified against the Skill Passport.");
+  return done(0);
+}
+async function runAdd(ref, opts = {}) {
+  const { push, done } = createOutput(opts.emit);
+  const tools = [...new Set([opts.target ?? []].flat())];
+  if (tools.length > 0 && opts.dir) {
+    push(TARGET_OR_DIR);
+    return done(2);
   }
-  if (!targetDir) {
-    const choices = installChoices(detail.targets, slug);
-    if (prompt && choices.length > 1) {
-      push("", "Install location:");
-      choices.forEach((choice, i2) => push(`  ${i2 + 1}) ${choice.label}`));
-      targetDir = choices[await promptIndex(prompt, choices.length)].dir;
-    } else {
-      targetDir = slug;
-      const mappable = mappableDeclaredTargets(detail.targets);
-      if (mappable.length > 0) {
-        push("", `tip: --target ${mappable[0]} installs into the tool's skills folder`);
-      }
-    }
+  if (opts.global && tools.length === 0) {
+    push(GLOBAL_NEEDS_TARGET);
+    return done(2);
   }
-  const target = resolve2(opts.cwd ?? process.cwd(), targetDir);
-  if (existsSync(target)) {
-    if (!statSync2(target).isDirectory()) {
-      push("", `error: target ${target} already exists and is not a directory`);
+  const cwd = opts.cwd ?? process.cwd();
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const fetched = await fetchPreflight(fetchImpl, apiUrl, ref);
+  if (!fetched.ok) {
+    push(...fetched.result.lines);
+    return done(fetched.result.exitCode);
+  }
+  const { slug, detail, preflight } = fetched;
+  push(...renderPreflightReport(detail, preflight, opts.style));
+  if (preflight.blocked) {
+    return done(1);
+  }
+  const members = detail.packMembers ?? [];
+  const isPack = members.length > 0;
+  const targets = [];
+  for (const tool of tools) {
+    const resolved = resolveArea(tool, opts.global ?? false, cwd, opts.home);
+    if (!resolved.ok) {
+      push("", `error: ${resolved.message}`);
       return done(2);
     }
-    if (readdirSync2(target).length > 0) {
-      push("", `error: target directory ${target} already exists and is not empty`);
-      return done(2);
+    const shared = targets.find((t) => t.area.dir === resolved.area.dir);
+    if (shared) {
+      push("", `note: ${tool} and ${shared.tool} share ${resolved.area.dir}; installing once`);
+      continue;
+    }
+    targets.push({ area: resolved.area, tool });
+    if (!declaresTool(detail.targets, tool)) {
+      push("", `warning: this skill does not declare ${tool} as a target`);
     }
   }
-  const download = await downloadVerified(
-    fetchImpl,
-    apiUrl,
-    slug,
-    preflight.version,
-    preflight.sourceHash
+  const confirmed = await confirmRisk(
+    preflight,
+    opts,
+    `Install ${slug}@${preflight.version} (${preflight.riskLevel} risk)? [y/N] `,
+    "Install aborted.",
+    push
   );
-  if (!download.ok) {
-    push("", `error: ${download.message}`);
-    return done(2);
-  }
-  try {
-    writeTree(download.files, target);
-  } catch {
-    push("", "error: could not write the install; nothing was installed");
-    return done(2);
+  if (!confirmed) return done(2);
+  const ctx = { push, done, fetchImpl, apiUrl, cwd, home: opts.home, slug, preflight };
+  if (isPack) {
+    if (targets.length > 0) {
+      return installPack(ctx, members, targets);
+    }
+    if (opts.dir === void 0) {
+      const location = await choosePackLocation(ctx, detail, members.length, opts.promptImpl);
+      return "area" in location ? installPack(ctx, members, [{ area: location.area, tool: location.area.tools[0] }]) : installSingle(ctx, [location.dir]);
+    }
+    push(
+      "",
+      `note: --dir installs the raw pack source; --target <tool> installs the ${members.length} skills individually`
+    );
+    return installSingle(ctx, [opts.dir]);
   }
-  const area = knownAreas(opts.cwd ?? process.cwd()).find((a) => a.dir === dirname(target));
-  if (area) {
-    recordReceipt(area.dir, slug, {
-      version: preflight.version,
-      sourceHash: preflight.sourceHash,
-      installedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
+  if (targets.length > 0) {
+    return installSingle(
+      ctx,
+      targets.map((t) => join4(t.area.dir, slug))
+    );
   }
-  push(
-    "",
-    `Installed ${download.files.length} file(s) to ${target}`,
-    "Source hash verified against the Skill Passport."
-  );
-  return done(0);
+  return installSingle(ctx, [opts.dir ?? await chooseSingleLocation(ctx, detail, opts.promptImpl)]);
 }
 
 // src/list.ts
-import { existsSync as existsSync2, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync3, readdirSync as readdirSync4, statSync as statSync4 } from "node:fs";
 import { join as join5 } from "node:path";
 function installedIn(dir) {
-  if (!existsSync2(dir)) {
+  if (!existsSync3(dir)) {
     return [];
   }
-  return readdirSync3(dir).sort().filter((name) => statSync3(join5(dir, name)).isDirectory());
+  return readdirSync4(dir).sort().filter((name) => statSync4(join5(dir, name), { throwIfNoEntry: false })?.isDirectory() ?? false);
 }
 function runList(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
@@ -16810,11 +16947,7 @@ async function identifyByHash(fetchImpl, apiUrl, slug, dir) {
   } catch {
     return void 0;
   }
-  const detail = await getParsed(
-    fetchImpl,
-    `${apiUrl}/skills/${encodeURIComponent(slug)}`,
-    publicSkillDetailSchema
-  );
+  const detail = await getParsed(fetchImpl, `${apiUrl}/skills/${encodeURIComponent(slug)}`, publicSkillDetailSchema);
   if (!detail.ok) {
     return void 0;
   }
@@ -16859,9 +16992,7 @@ async function runOutdated(opts = {}) {
         }
         seenPacks.add(receipt.pack.slug);
         tracked += 1;
-        const members = Object.values(receipts).filter(
-          (r) => r.pack?.slug === receipt.pack?.slug
-        ).length;
+        const members = Object.values(receipts).filter((r) => r.pack?.slug === receipt.pack?.slug).length;
         const latest = latestBySlug.get(receipt.pack.slug)?.version;
         if (latest === void 0) {
           rows.push(`  ${receipt.pack.slug}  ${receipt.pack.version}  not in the directory`);
@@ -16869,9 +17000,7 @@ async function runOutdated(opts = {}) {
           rows.push(`  ${receipt.pack.slug}  ${receipt.pack.version}  current (pack, ${members} skills)`);
         } else {
           outdatedCount += 1;
-          rows.push(
-            `  ${receipt.pack.slug}  ${receipt.pack.version} -> ${latest}  (pack, ${members} skills)`
-          );
+          rows.push(`  ${receipt.pack.slug}  ${receipt.pack.version} -> ${latest}  (pack, ${members} skills)`);
         }
         continue;
       }
@@ -16927,39 +17056,27 @@ async function runOutdated(opts = {}) {
 }
 
 // src/remove.ts
-import { existsSync as existsSync3, rmSync as rmSync2, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync4, rmSync as rmSync2, statSync as statSync5 } from "node:fs";
 import { dirname as dirname2, join as join7, resolve as resolve3 } from "node:path";
 function looksLikeInstalledSkill(dir) {
-  return existsSync3(join7(dir, "SKILL.md")) || existsSync3(join7(dir, "skill.json"));
+  return existsSync4(join7(dir, "SKILL.md")) || existsSync4(join7(dir, "skill.json"));
 }
 function candidateDirs(slug, cwd, home) {
-  const dirs = [];
-  const byTarget = installAreas(home);
-  for (const tool of MAPPED_TARGETS) {
-    const area = byTarget[tool];
-    if (!area) {
-      continue;
-    }
-    dirs.push(resolve3(cwd, join7(area.project, slug)));
-    if (area.global) {
-      dirs.push(join7(area.global, slug));
-    }
-  }
-  dirs.push(resolve3(cwd, slug));
-  return [...new Set(dirs)];
+  const inAreas = knownAreas(cwd, home).map((area) => join7(area.dir, slug));
+  return [.../* @__PURE__ */ new Set([...inAreas, resolve3(cwd, slug)])];
 }
 function runRemove(slug, opts = {}) {
   if (opts.target && opts.dir) {
-    return { lines: ["error: pass --target or --dir, not both"], exitCode: 2 };
+    return { lines: [TARGET_OR_DIR], exitCode: 2 };
   }
   if (opts.global && !opts.target) {
-    return { lines: ["error: --global needs --target (e.g. --target claude-code)"], exitCode: 2 };
+    return { lines: [GLOBAL_NEEDS_TARGET], exitCode: 2 };
   }
   const cwd = opts.cwd ?? process.cwd();
   if (!opts.dir) {
     let areas = knownAreas(cwd, opts.home);
     if (opts.target) {
-      areas = areas.filter((a) => a.tool === opts.target && a.global === (opts.global ?? false));
+      areas = areas.filter((a) => a.tools.includes(opts.target) && (opts.global ? a.global : a.project));
     }
     const packHits = areas.map((area) => ({
       area,
@@ -16981,10 +17098,7 @@ function runRemove(slug, opts = {}) {
         removeReceipt(area.dir, name);
       }
       return {
-        lines: [
-          `Removed pack ${slug} (${members.length} skills) from ${area.dir}`,
-          `  ${members.sort().join(", ")}`
-        ],
+        lines: [`Removed pack ${slug} (${members.length} skills) from ${area.dir}`, `  ${members.sort().join(", ")}`],
         exitCode: 0
       };
     }
@@ -16999,9 +17113,7 @@ function runRemove(slug, opts = {}) {
   } else if (opts.dir) {
     dir = resolve3(cwd, opts.dir);
   } else {
-    const found = candidateDirs(slug, cwd, opts.home).filter(
-      (candidate) => existsSync3(candidate)
-    );
+    const found = candidateDirs(slug, cwd, opts.home).filter((candidate) => existsSync4(candidate));
     if (found.length === 0) {
       return { lines: [`error: ${slug} is not installed in any known location`], exitCode: 2 };
     }
@@ -17016,10 +17128,10 @@ function runRemove(slug, opts = {}) {
     }
     dir = found[0];
   }
-  if (!existsSync3(dir)) {
+  if (!existsSync4(dir)) {
     return { lines: [`error: nothing installed at ${dir}`], exitCode: 2 };
   }
-  if (!statSync4(dir).isDirectory()) {
+  if (!statSync5(dir).isDirectory()) {
     return { lines: [`error: ${dir} is not a directory`], exitCode: 2 };
   }
   if (!looksLikeInstalledSkill(dir)) {
@@ -17120,25 +17232,23 @@ async function runSearch(opts = {}) {
   }
   if (opts.category && !CATEGORY_SLUGS.includes(opts.category)) {
     return {
-      lines: [
-        `error: unknown category "${opts.category}" (known categories: ${CATEGORY_SLUGS.join(", ")})`
-      ],
+      lines: [`error: unknown category "${opts.category}" (known categories: ${CATEGORY_SLUGS.join(", ")})`],
       exitCode: 2
     };
   }
   const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
   const apiUrl = resolveApiUrl(opts.apiUrl);
+  if (opts.ai) {
+    return runAiSearch(opts, fetchImpl, apiUrl);
+  }
   const fetched = await getParsed(fetchImpl, `${apiUrl}/skills`, publicSkillListSchema);
   if (!fetched.ok) {
     return { lines: [`error: ${fetched.message}`], exitCode: 2 };
   }
   const query = (opts.query ?? "").trim().toLowerCase();
-  const matches = fetched.data.filter((skill) => {
-    if (opts.target && !skill.targets.includes(opts.target)) return false;
-    if (opts.category && (skill.category ?? null) !== opts.category) return false;
-    if (opts.packs && (skill.packSkills?.length ?? 0) === 0) return false;
-    return query === "" || matchesQuery(skill, query);
-  });
+  const matches = fetched.data.filter(
+    (skill) => matchesFilters(skill, opts) && (query === "" || matchesQuery(skill, query))
+  );
   if (opts.json) {
     return { lines: [JSON.stringify(matches, null, 2)], exitCode: 0 };
   }
@@ -17150,22 +17260,66 @@ async function runSearch(opts = {}) {
     lines: [
       ...renderRows(matches, opts.width, st),
       "",
-      st.dim(
-        `${matches.length} of ${fetched.data.length} skills - skillpass report <slug> shows the passport`
-      )
+      st.dim(`${matches.length} of ${fetched.data.length} skills - skillpass report <slug> shows the passport`)
+    ],
+    exitCode: 0
+  };
+}
+function matchesFilters(skill, opts) {
+  if (opts.target && !skill.targets.includes(opts.target)) return false;
+  if (opts.category && (skill.category ?? null) !== opts.category) return false;
+  if (opts.packs && (skill.packSkills?.length ?? 0) === 0) return false;
+  return true;
+}
+var AI_ERRORS = {
+  429: "AI search is rate limited (20 requests a minute per address); try again in a moment",
+  503: "AI search is not configured on this API",
+  502: "AI search is temporarily unavailable; try again shortly"
+};
+function aiErrorMessage(outcome) {
+  if (outcome.status !== void 0 && AI_ERRORS[outcome.status]) return AI_ERRORS[outcome.status];
+  if (outcome.status === 400 && outcome.apiError) return outcome.apiError;
+  return outcome.message;
+}
+async function runAiSearch(opts, fetchImpl, apiUrl) {
+  const query = (opts.query ?? "").trim();
+  if (query === "") {
+    return { lines: ["error: search --ai needs a query (describe what you need)"], exitCode: 2 };
+  }
+  const fetched = await getParsed(
+    fetchImpl,
+    `${apiUrl}/skills/search?q=${encodeURIComponent(query)}`,
+    publicSkillListSchema
+  );
+  if (!fetched.ok) {
+    return { lines: [`error: ${aiErrorMessage(fetched)}`], exitCode: 2 };
+  }
+  const matches = fetched.data.filter((skill) => matchesFilters(skill, opts));
+  if (opts.json) {
+    return { lines: [JSON.stringify(matches, null, 2)], exitCode: 0 };
+  }
+  if (matches.length === 0) {
+    return { lines: ["No skills match by meaning - try other words"], exitCode: 0 };
+  }
+  const st = opts.style ?? PLAIN;
+  return {
+    lines: [
+      ...renderRows(matches, opts.width, st),
+      "",
+      st.dim(`${matches.length} skills by meaning - skillpass report <slug> shows the passport`)
     ],
     exitCode: 0
   };
 }
 
 // src/update.ts
-import { existsSync as existsSync4, readdirSync as readdirSync4, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync5, renameSync as renameSync2, rmSync as rmSync3 } from "node:fs";
 import { join as join8 } from "node:path";
 async function locate(slug, opts, fetchImpl, apiUrl) {
   const cwd = opts.cwd ?? process.cwd();
   let areas = knownAreas(cwd, opts.home);
   if (opts.target) {
-    areas = areas.filter((a) => a.tool === opts.target && a.global === (opts.global ?? false));
+    areas = areas.filter((a) => a.tools.includes(opts.target) && (opts.global ? a.global : a.project));
   }
   const hits = [];
   for (const area of areas) {
@@ -17186,7 +17340,7 @@ async function locate(slug, opts, fetchImpl, apiUrl) {
       hits.push({ area, dir: area.dir, installedVersion: packMember.pack.version, packSlug: slug });
       continue;
     }
-    if (existsSync4(dir)) {
+    if (existsSync5(dir)) {
       const identified = await identifyByHash(fetchImpl, apiUrl, slug, dir);
       if (identified !== void 0) {
         hits.push({ area, dir, installedVersion: identified });
@@ -17207,30 +17361,23 @@ function permissionChanges(installed, target) {
 function swapTree(files, dir) {
   const fresh = `${dir}.new-${process.pid}`;
   const aside = `${dir}.old-${process.pid}`;
+  rmSync3(fresh, { recursive: true, force: true });
   writeTree(files, fresh);
-  renameSync2(dir, aside);
   try {
+    if (existsSync5(dir)) renameSync2(dir, aside);
     renameSync2(fresh, dir);
   } catch (err2) {
-    renameSync2(aside, dir);
+    if (existsSync5(aside) && !existsSync5(dir)) renameSync2(aside, dir);
     rmSync3(fresh, { recursive: true, force: true });
     throw err2;
   }
   rmSync3(aside, { recursive: true, force: true });
 }
 async function runUpdate(ref, opts = {}) {
-  const lines = [];
-  const streamed = opts.emit !== void 0;
-  const push = (...next) => {
-    lines.push(...next);
-    if (next.length > 0) {
-      opts.emit?.(next.join("\n"));
-    }
-  };
-  const done = (exitCode) => ({ lines, exitCode, streamed });
+  const { push, done } = createOutput(opts.emit);
   const st = opts.style ?? PLAIN;
   if (opts.global && !opts.target) {
-    push("error: --global needs --target (e.g. --target claude-code)");
+    push(GLOBAL_NEEDS_TARGET);
     return done(2);
   }
   const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
@@ -17243,9 +17390,7 @@ async function runUpdate(ref, opts = {}) {
   const hits = await locate(slug, opts, fetchImpl, apiUrl);
   const memberHit = hits.find((h) => h.packSlug !== void 0 && h.packSlug !== slug);
   if (memberHit?.packSlug !== void 0) {
-    push(
-      `error: ${slug} is part of the ${memberHit.packSlug} pack; run skillpass update ${memberHit.packSlug}`
-    );
+    push(`error: ${slug} is part of the ${memberHit.packSlug} pack; run skillpass update ${memberHit.packSlug}`);
     return done(2);
   }
   if (hits.length === 0) {
@@ -17280,19 +17425,14 @@ async function runUpdate(ref, opts = {}) {
   if (preflight.blocked) {
     return done(1);
   }
-  if (preflight.riskLevel !== "low" && !opts.yes) {
-    if (!opts.confirmImpl) {
-      push("", `error: a ${preflight.riskLevel}-risk skill needs confirmation; rerun with --yes`);
-      return done(2);
-    }
-    const confirmed = await opts.confirmImpl(
-      `Update ${slug} to ${preflight.version} (${preflight.riskLevel} risk)? [y/N] `
-    );
-    if (!confirmed) {
-      push("", "Update aborted; the installed version was left in place.");
-      return done(2);
-    }
-  }
+  const confirmed = await confirmRisk(
+    preflight,
+    opts,
+    `Update ${slug} to ${preflight.version} (${preflight.riskLevel} risk)? [y/N] `,
+    "Update aborted; the installed version was left in place.",
+    push
+  );
+  if (!confirmed) return done(2);
   const download = await downloadVerified(fetchImpl, apiUrl, slug, preflight.version, preflight.sourceHash);
   if (!download.ok) {
     push("", `error: ${download.message}`);
@@ -17304,11 +17444,7 @@ async function runUpdate(ref, opts = {}) {
     push("", "error: could not replace the install; the installed version was left in place");
     return done(2);
   }
-  recordReceipt(installed.area.dir, slug, {
-    version: preflight.version,
-    sourceHash: preflight.sourceHash,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString()
-  });
+  recordReceipt(installed.area.dir, slug, receiptFor(preflight));
   push(
     "",
     `Updated ${slug} ${installed.installedVersion ?? "?"} -> ${preflight.version} in ${installed.dir}`,
@@ -17326,9 +17462,7 @@ async function changesVsInstalled(fetchImpl, apiUrl, slug, installed, target, st
     publicPreflightSchema
   );
   if (!before.ok) {
-    return [
-      `Changes vs installed v${installed.installedVersion}: unavailable (that version is no longer published)`
-    ];
+    return [`Changes vs installed v${installed.installedVersion}: unavailable (that version is no longer published)`];
   }
   const { added, removed } = permissionChanges(before.data.permissions, target.permissions);
   if (added.length === 0 && removed.length === 0) {
@@ -17354,23 +17488,19 @@ async function runPackUpdate(slug, installed, detail, preflight, opts, fetchImpl
   if (preflight.blocked) {
     return done(1);
   }
-  if (preflight.riskLevel !== "low" && !opts.yes) {
-    if (!opts.confirmImpl) {
-      push("", `error: a ${preflight.riskLevel}-risk skill needs confirmation; rerun with --yes`);
-      return done(2);
-    }
-    const confirmed = await opts.confirmImpl(
-      `Update ${slug} to ${preflight.version} (${preflight.riskLevel} risk)? [y/N] `
-    );
-    if (!confirmed) {
-      push("", "Update aborted; the installed version was left in place.");
-      return done(2);
-    }
-  }
+  const confirmed = await confirmRisk(
+    preflight,
+    opts,
+    `Update ${slug} to ${preflight.version} (${preflight.riskLevel} risk)? [y/N] `,
+    "Update aborted; the installed version was left in place.",
+    push
+  );
+  if (!confirmed) return done(2);
   const areaDir = installed.area.dir;
-  const { installs, skipped } = resolvePackMembers(detail.packMembers ?? [], installed.area.tool);
+  const tool = opts.target ?? installed.area.tools[0];
+  const { installs, skipped } = resolvePackMembers(detail.packMembers ?? [], installed.area.layout);
   if (installs.length === 0) {
-    push("", `error: none of the new version's skills support ${installed.area.tool}`);
+    push("", `error: none of the new version's skills support ${tool}`);
     return done(2);
   }
   const receipts = readReceipts(areaDir);
@@ -17378,9 +17508,7 @@ async function runPackUpdate(slug, installed, detail, preflight, opts, fetchImpl
   const newNames = new Set(installs.map((m) => m.name));
   const toRemove = currentMembers.filter((name) => !newNames.has(name));
   const additions = installs.filter((m) => !currentMembers.includes(m.name));
-  const conflicts = additions.map((m) => join8(areaDir, m.name)).filter(
-    (dest) => existsSync4(dest) && (!statSync5(dest).isDirectory() || readdirSync4(dest).length > 0)
-  );
+  const conflicts = additions.map((m) => join8(areaDir, m.name)).filter(isOccupied);
   if (conflicts.length > 0) {
     push(
       "",
@@ -17394,31 +17522,26 @@ async function runPackUpdate(slug, installed, detail, preflight, opts, fetchImpl
     push("", `error: ${download.message}`);
     return done(2);
   }
-  const plans = installs.map((m) => ({ ...m, files: memberFiles(download.files, m.sourceDir) }));
+  const plans = planMembers(installs, download.files);
   const missing = plans.find((p) => p.files.length === 0);
   if (missing) {
     push("", `error: the snapshot has no files for "${missing.name}"; nothing was changed`);
     return done(2);
   }
   for (const name of skipped) {
-    push("", `note: ${name} does not support ${installed.area.tool}; skipped`);
+    push("", `note: ${name} does not support ${tool}; skipped`);
   }
   const done1 = [];
   try {
     for (const plan of plans) {
       const dest = join8(areaDir, plan.name);
-      if (existsSync4(dest)) {
+      if (existsSync5(dest)) {
         swapTree(plan.files, dest);
       } else {
         writeTree(plan.files, dest);
       }
       done1.push(plan.name);
-      recordReceipt(areaDir, plan.name, {
-        version: preflight.version,
-        sourceHash: preflight.sourceHash,
-        installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        pack: { slug, version: preflight.version }
-      });
+      recordReceipt(areaDir, plan.name, receiptFor(preflight, slug));
     }
   } catch {
     push(
@@ -17487,11 +17610,11 @@ var USAGE = [
   "skillpass - validate AI agent skills locally and inspect hosted passports",
   "",
   "Usage:",
-  "  skillpass search [query] [--target <tool>] [--category <slug>] [--packs] [--json]",
+  "  skillpass search [query] [--ai] [--target <tool>] [--category <slug>] [--packs] [--json]",
   "                                             find skills in the directory",
   "  skillpass scan <path> [--json]              run the validator on a local skill package",
   "  skillpass report <slug>[@version] [--json]  fetch the hosted passport pre-flight",
-  "  skillpass add <slug>[@version] [--target <tool> [--global] | --dir <path>] [--yes]",
+  "  skillpass add <slug>[@version] [--target <tool>... [--global] | --dir <path>] [--yes]",
   "                                             install a skill through the pre-flight gate",
   "  skillpass remove <slug> [--target <tool> [--global] | --dir <path>]",
   "                                             remove an installed skill",
@@ -17502,11 +17625,15 @@ var USAGE = [
   "",
   "Flags:",
   "  --json    print machine-readable JSON instead of the readable report",
-  "  --target  install into a tool's skills folder: claude-code (.claude/skills),",
-  "            codex (.agents/skills)",
-  "  --global  with --target claude-code, install to ~/.claude/skills instead",
+  "  --target  a tool's skills folder: claude-code, cline, or agents (the shared",
+  "            .agents/skills read by codex, cursor, windsurf, github-copilot,",
+  "            gemini-cli, and opencode; those names work too). add takes it more",
+  "            than once to install into several tools",
+  "  --global  with --target, use the tool's user-level folder (~/.claude/skills,",
+  "            ~/.agents/skills, ~/.cline/skills)",
   "  --dir     install target directory (default ./<slug>)",
   "  --yes     skip the confirmation prompt for medium+ risk skills",
+  "  --ai      search by meaning: describe what you need (needs a query)",
   "  --category  search filter: a directory category slug",
   "  --packs   search filter: multi-skill packs only",
   "  --version print the CLI version",
@@ -17524,7 +17651,7 @@ var COMMAND_FLAGS = {
   list: [],
   outdated: [],
   update: ["--yes", "--target", "--global"],
-  search: ["--target", "--category", "--packs", "--json"]
+  search: ["--ai", "--target", "--category", "--packs", "--json"]
 };
 function parseCliArgs(argv) {
   const parsed = {
@@ -17535,6 +17662,7 @@ function parseCliArgs(argv) {
     yes: false,
     global: false,
     packs: false,
+    ai: false,
     seen: []
   };
   for (let i2 = 0; i2 < argv.length; i2++) {
@@ -17551,6 +17679,9 @@ function parseCliArgs(argv) {
     } else if (arg === "--packs") {
       parsed.packs = true;
       parsed.seen.push(arg);
+    } else if (arg === "--ai") {
+      parsed.ai = true;
+      parsed.seen.push(arg);
     } else if (arg === "--dir" || arg === "--target" || arg === "--category") {
       parsed.seen.push(arg);
       const value = argv[i2 + 1];
@@ -17561,7 +17692,7 @@ function parseCliArgs(argv) {
         if (arg === "--dir") {
           parsed.dir = value;
         } else if (arg === "--target") {
-          parsed.target = value;
+          parsed.targets = [.../* @__PURE__ */ new Set([...parsed.targets ?? [], value])];
         } else {
           parsed.category = value;
         }
@@ -17611,12 +17742,17 @@ async function run(argv) {
   if (disallowed) {
     return { lines: [`error: ${args.command} does not take ${disallowed}`, "", USAGE], exitCode: 2 };
   }
+  const target = args.targets?.[0];
+  if (args.command !== "add" && (args.targets?.length ?? 0) > 1) {
+    return { lines: [`error: ${args.command} takes one --target`, "", USAGE], exitCode: 2 };
+  }
   if (args.command === "search") {
     return runSearch({
       query: args.positional.join(" "),
-      target: args.target,
+      target,
       category: args.category,
       packs: args.packs,
+      ai: args.ai,
       json: args.json,
       width: process.stdout.isTTY ? process.stdout.columns : void 0,
       style: styler(Boolean(process.stdout.isTTY))
@@ -17634,7 +17770,7 @@ async function run(argv) {
     if (!slug) {
       return { lines: ["error: remove needs a skill slug", "", USAGE], exitCode: 2 };
     }
-    return runRemove(slug, { target: args.target, dir: args.dir, global: args.global });
+    return runRemove(slug, { target, dir: args.dir, global: args.global });
   }
   if (args.command === "list") {
     if (args.positional.length > 0) {
@@ -17650,7 +17786,7 @@ async function run(argv) {
     const tty = Boolean(process.stdin.isTTY);
     return runUpdate(ref, {
       yes: args.yes,
-      target: args.target,
+      target,
       global: args.global,
       style: styler(Boolean(process.stdout.isTTY)),
       confirmImpl: tty ? confirmViaTty : void 0,
@@ -17679,7 +17815,7 @@ async function run(argv) {
     return runAdd(ref, {
       yes: args.yes,
       dir: args.dir,
-      target: args.target,
+      target: args.targets,
       global: args.global,
       style: styler(Boolean(process.stdout.isTTY)),
       confirmImpl: tty ? confirmViaTty : void 0,
@@ -17689,10 +17825,17 @@ async function run(argv) {
   }
   return { lines: [`error: unknown command "${args.command}"`, "", USAGE], exitCode: 2 };
 }
-async function main(argv) {
-  const result = await run(argv);
+async function main(argv, runImpl = run) {
+  let result;
+  try {
+    result = await runImpl(argv);
+  } catch (err2) {
+    console.error(`error: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    process.exitCode = 2;
+    return;
+  }
   if (!result.streamed) {
-    console.log(result.lines.join("\n"));
+    (result.exitCode === 2 ? console.error : console.log)(result.lines.join("\n"));
   }
   process.exitCode = result.exitCode;
 }