yeka-skills 0.1.0 → 0.2.0

package/README.md

@@ -1,12 +1,15 @@
 # yeka-skills
 
-Install and update private Gemography agent skills from Yeka Skills.
+Install, update, and remove private Gemography agent skills from Yeka Skills.
 
 ```bash
 npx yeka-skills add ste100-session
 ```
 
-The CLI opens Cloudflare Access in your browser when it needs a session. It stores the short session in macOS Keychain.
+The CLI tries to open Cloudflare Access in your browser when it needs a session. It always prints
+the same one-time address in the terminal, so you can open it yourself if the browser does not
+continue. The address expires after five minutes. Run the same command again to get a new address.
+The CLI stores the short session in macOS Keychain.
 
 It detects the shared local skill folders used by ChatGPT desktop, Codex, Claude Desktop, Cowork, and Claude Code. A shared skill installs into each active compatible folder.
 
@@ -17,13 +20,38 @@ Commands:
 ```text
 yeka-skills add <skill>
 yeka-skills list
+yeka-skills share <skill>
 yeka-skills status
 yeka-skills update [skill]
+yeka-skills remove <skill>
 yeka-skills login
 yeka-skills logout
 ```
 
-Use `--dry-run` with `add` or `update` to verify and report changes without installation.
+## Share a local skill with the team
+
+`yeka-skills share <skill>` packages one of your local skill folders and sends it to the private
+submission inbox, where a review bot turns it into a team-repo pull request. Nothing is published
+by a share — a person reviews every submission first.
+
+- The CLI looks for the folder in the same local roots the installer knows. If a skill exists in
+  several of them, it picks the one it would install into first (the current Codex folder, then
+  the Claude folder, then the legacy Codex folder) and tells you which it chose.
+- `yeka-skills share <skill> --check` looks the folder over without network access or a session:
+  SKILL.md present with a matching `name`, folder under the 5 MB share limit, and plain-language
+  warnings about anything reviewers will look at (web addresses, credentials paths, `curl | sh`,
+  long base64 tokens). Warnings never block a share — the team's server-side checks decide.
+- `--notes-file <path>` attaches a small UTF-8 text file (up to 8 KB) with your interview answers.
+  The file rides inside the archive as `_yeka/notes.txt`, always the first entry, namespaced so
+  the review bot can find it, read it, and strip it before the skill content is unpacked. Do not
+  create a `_yeka` folder inside your skill yourself.
+- A successful share answers with one sentence: you'll hear back in #yeka-skills, and updates
+  usually go live within the hour.
+
+Use `--dry-run` with `add`, `update`, or `remove` to verify and report changes without mutating the
+managed installation. Removal is fully offline and uses local receipts. It refuses locally edited
+copies unless `--force` is present; forced removal moves edited content into a private backup and
+prints its path.
 
 Managed installation receipts and backups stay in `~/Library/Application Support/Yeka Skills/`.
 

package/dist/cli.js

@@ -4,9 +4,9 @@
 import { Command } from "commander";
 
 // src/commands.ts
-import { chmod as chmod2, lstat as lstat6, mkdir as mkdir4, mkdtemp as mkdtemp2, rm as rm3 } from "fs/promises";
-import os6 from "os";
-import path7 from "path";
+import { chmod as chmod3, lstat as lstat9, mkdir as mkdir6, mkdtemp as mkdtemp3, readFile as readFile4, rm as rm5 } from "fs/promises";
+import os7 from "os";
+import path9 from "path";
 
 // ../contracts/dist/index.js
 import { z } from "zod";
@@ -41,6 +41,10 @@ var ShareIdMapSchema = z.object({
   schemaVersion: z.literal(1),
   skills: z.record(SkillNameSchema, OpaqueShareIdSchema)
 });
+var PublishedSkillsSchema = z.object({
+  schemaVersion: z.literal(1),
+  published: z.array(SkillNameSchema).min(1)
+});
 var RegistryManifestSchema = z.object({
   schemaVersion: z.literal(1),
   generatedAt: z.iso.datetime({ offset: true }),
@@ -112,7 +116,7 @@ import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
 import {
   chmod,
   cp,
-  lstat as lstat3,
+  lstat as lstat4,
   mkdir as mkdir3,
   mkdtemp,
   rename as rename2,
@@ -408,11 +412,45 @@ var extractVerifiedArchive = async (archivePath, destination, expectedContentHas
 
 // src/receipts.ts
 import { createHash as createHash2, randomUUID } from "crypto";
-import { mkdir as mkdir2, readFile, readdir as readdir2, rename, unlink, writeFile } from "fs/promises";
+import { lstat as lstat3, mkdir as mkdir2, readFile, readdir as readdir2, rename, unlink, writeFile } from "fs/promises";
 import os2 from "os";
 import path4 from "path";
 var rootIdentifier = (targetRoot) => createHash2("sha256").update(targetRoot).digest("hex").slice(0, 16);
 var receiptPath = (targetRoot, skillName, home = os2.homedir()) => path4.join(localPaths(home).receipts, rootIdentifier(targetRoot), `${skillName}.json`);
+var receiptStoreExists = async (home, root) => {
+  const resolvedHome = path4.resolve(home);
+  const relativeRoot = path4.relative(resolvedHome, root);
+  if (relativeRoot.startsWith("..") || path4.isAbsolute(relativeRoot)) {
+    throw new CliError("unsafe_receipts", "The Yeka Skills receipt location is unsafe.");
+  }
+  let current = resolvedHome;
+  const homeEntry = await lstat3(current);
+  if (!homeEntry.isDirectory() || homeEntry.isSymbolicLink()) {
+    throw new CliError(
+      "unsafe_receipts",
+      `The Yeka Skills receipt location is not a real directory: ${current}.`
+    );
+  }
+  for (const segment of relativeRoot.split(path4.sep)) {
+    current = path4.join(current, segment);
+    let entry;
+    try {
+      entry = await lstat3(current);
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+        return false;
+      }
+      throw error;
+    }
+    if (!entry.isDirectory() || entry.isSymbolicLink()) {
+      throw new CliError(
+        "unsafe_receipts",
+        `The Yeka Skills receipt location is not a real directory: ${current}.`
+      );
+    }
+  }
+  return true;
+};
 var writeReceipt = async (receipt, home = os2.homedir()) => {
   const validated = InstallReceiptSchema.parse(receipt);
   const destination = receiptPath(receipt.targetRoot, receipt.skillName, home);
@@ -453,50 +491,76 @@ var readReceipt = async (targetRoot, skillName, home = os2.homedir()) => {
     });
   }
 };
-var listReceipts = async (home = os2.homedir()) => {
+var scanReceiptRecords = async (home = os2.homedir()) => {
   const root = localPaths(home).receipts;
+  if (!await receiptStoreExists(home, root)) {
+    return { records: [], invalidFiles: [] };
+  }
   let rootEntries;
   try {
     rootEntries = await readdir2(root, { withFileTypes: true });
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      return [];
+      return { records: [], invalidFiles: [] };
     }
     throw error;
   }
-  const receipts = [];
+  const records = [];
+  const invalidFiles = [];
   for (const rootEntry of rootEntries) {
     if (!rootEntry.isDirectory()) {
+      if (/^[0-9a-f]{16}$/.test(rootEntry.name)) {
+        invalidFiles.push(path4.join(root, rootEntry.name));
+      }
       continue;
     }
     const files = await readdir2(path4.join(root, rootEntry.name), { withFileTypes: true });
     for (const file of files) {
-      if (!file.isFile() || !file.name.endsWith(".json")) {
+      if (!file.name.endsWith(".json")) {
+        continue;
+      }
+      const filePath = path4.join(root, rootEntry.name, file.name);
+      if (!file.isFile()) {
+        invalidFiles.push(filePath);
         continue;
       }
       try {
-        receipts.push(
-          InstallReceiptSchema.parse(
-            JSON.parse(await readFile(path4.join(root, rootEntry.name, file.name), "utf8"))
-          )
-        );
-      } catch (error) {
-        throw new CliError("invalid_receipt", `The local receipt ${file.name} is invalid.`, {
-          cause: error
+        const serialized = await readFile(filePath, "utf8");
+        records.push({
+          filePath,
+          contentHash: createHash2("sha256").update(serialized).digest("hex"),
+          receipt: InstallReceiptSchema.parse(JSON.parse(serialized))
         });
+      } catch {
+        invalidFiles.push(filePath);
       }
     }
   }
-  return receipts.sort(
-    (left, right) => `${left.skillName}:${left.runtime}`.localeCompare(`${right.skillName}:${right.runtime}`, "en")
+  records.sort(
+    (left, right) => `${left.receipt.skillName}:${left.receipt.runtime}:${left.filePath}`.localeCompare(
+      `${right.receipt.skillName}:${right.receipt.runtime}:${right.filePath}`,
+      "en"
+    )
   );
+  invalidFiles.sort((left, right) => left.localeCompare(right, "en"));
+  return { records, invalidFiles };
+};
+var listReceipts = async (home = os2.homedir()) => {
+  const scan = await scanReceiptRecords(home);
+  if (scan.invalidFiles.length > 0) {
+    throw new CliError(
+      "invalid_receipt",
+      `The local receipt file is invalid: ${scan.invalidFiles[0]}.`
+    );
+  }
+  return scan.records.map((record) => record.receipt);
 };
 
 // src/installer.ts
 var isNotFound = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
 var fingerprint = async (entryPath) => {
   try {
-    const entry = await lstat3(entryPath, { bigint: true });
+    const entry = await lstat4(entryPath, { bigint: true });
     return {
       dev: entry.dev,
       ino: entry.ino,
@@ -521,7 +585,7 @@ var assertSafeTarget = async (target, skillName, home) => {
   const parent = path5.dirname(resolvedRoot);
   let parentStat;
   try {
-    parentStat = await lstat3(parent);
+    parentStat = await lstat4(parent);
   } catch (error) {
     if (isNotFound(error)) {
       throw new CliError("runtime_not_found", `The ${target.runtime} configuration directory is missing.`);
@@ -533,7 +597,7 @@ var assertSafeTarget = async (target, skillName, home) => {
   }
   const rootFingerprint = await fingerprint(resolvedRoot);
   if (rootFingerprint !== null) {
-    const rootStat = await lstat3(resolvedRoot);
+    const rootStat = await lstat4(resolvedRoot);
     if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
       throw new CliError("unsafe_target", `The ${target.runtime} skills directory is not a real directory.`);
     }
@@ -576,8 +640,8 @@ var preflightTarget = async (target, skill, home) => {
   if (oldReceipt !== null && (oldReceipt.runtime !== target.runtime || path5.resolve(oldReceipt.targetRoot) !== targetRoot || path5.resolve(oldReceipt.installedPath) !== installedPath)) {
     throw new CliError("invalid_receipt_target", `The local receipt for ${skill.name} has an invalid target.`);
   }
-  const entryFingerprint = await fingerprint(installedPath);
-  if (entryFingerprint === null) {
+  const entryFingerprint2 = await fingerprint(installedPath);
+  if (entryFingerprint2 === null) {
     return {
       action: "install",
       runtime: target.runtime,
@@ -594,11 +658,11 @@ var preflightTarget = async (target, skill, home) => {
       targetRoot,
       installedPath,
       existed: true,
-      fingerprint: entryFingerprint,
+      fingerprint: entryFingerprint2,
       oldReceipt
     };
   }
-  const installedStat = await lstat3(installedPath);
+  const installedStat = await lstat4(installedPath);
   if (!installedStat.isDirectory() || installedStat.isSymbolicLink()) {
     throw new CliError(
       "local_changes",
@@ -628,7 +692,7 @@ var preflightTarget = async (target, skill, home) => {
     targetRoot,
     installedPath,
     existed: true,
-    fingerprint: entryFingerprint,
+    fingerprint: entryFingerprint2,
     oldReceipt
   };
 };
@@ -640,7 +704,7 @@ var ensureTargetRoot = async (targetRoot) => {
       throw error;
     }
   }
-  const rootStat = await lstat3(targetRoot);
+  const rootStat = await lstat4(targetRoot);
   if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
     throw new CliError("unsafe_target", `The skills target is not a real directory: ${targetRoot}`);
   }
@@ -733,7 +797,7 @@ var installSkillFromArchive = async (options) => {
   }
   const operationCache = localPaths(home).cache;
   await mkdir3(operationCache, { recursive: true, mode: 448 });
-  const cacheStat = await lstat3(operationCache);
+  const cacheStat = await lstat4(operationCache);
   if (!cacheStat.isDirectory() || cacheStat.isSymbolicLink()) {
     throw new CliError("unsafe_cache", "The Yeka Skills cache is not a real directory.");
   }
@@ -1034,14 +1098,14 @@ var deleteSession = async () => {
 };
 
 // src/local-status.ts
-import { lstat as lstat4 } from "fs/promises";
+import { lstat as lstat5 } from "fs/promises";
 import os4 from "os";
 var isNotFound2 = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
 var inspectLocalStatus = async (receipt, remote, home = os4.homedir()) => {
   targetsFromReceipts([receipt], receipt.skillName, home);
   let installedStat;
   try {
-    installedStat = await lstat4(receipt.installedPath);
+    installedStat = await lstat5(receipt.installedPath);
   } catch (error) {
     if (isNotFound2(error)) {
       return { kind: "missing", receipt, ...remote === void 0 ? {} : { remote } };
@@ -1076,6 +1140,7 @@ import http from "http";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+var LOGIN_RETRY = "run the same Yeka Skills command again to get a new address.";
 var MAX_TOKEN_RESPONSE_BYTES = 16 * 1024;
 var AUTHORIZATION_CODE_PATTERN = /^[A-Za-z0-9._-]{32,4096}$/;
 var readBoundedJson = async (response) => {
@@ -1163,7 +1228,10 @@ var waitForCallback = async (expectedState) => {
     throw new CliError("login_listener_failed", "The CLI could not start its private login listener.");
   }
   const timeout = setTimeout(() => {
-    rejectCallback?.(new CliError("login_timeout", "The browser login did not finish within five minutes."));
+    rejectCallback?.(new CliError(
+      "login_timeout",
+      "The one-time browser address expired after five minutes. Run the same Yeka Skills command again to get a new address."
+    ));
   }, LOGIN_TIMEOUT_MS);
   timeout.unref();
   return {
@@ -1183,12 +1251,23 @@ var waitForCallback = async (expectedState) => {
 var openBrowser = async (url) => {
   try {
     await execFileAsync("/usr/bin/open", [url]);
-    return true;
   } catch (error) {
     void error;
-    return false;
   }
 };
+var launchAuthorization = async (url, dependencies = {
+  openBrowser,
+  write: (message) => process.stdout.write(message)
+}) => {
+  dependencies.write([
+    "Your browser will try to open for Gemography email verification.",
+    "If it does not continue, open this one-time address:",
+    url,
+    `This address expires in five minutes. If it expires, ${LOGIN_RETRY}`,
+    ""
+  ].join("\n"));
+  await dependencies.openBrowser(url);
+};
 var login = async () => {
   const verifier = randomBytes(32).toString("base64url");
   const challenge = createHash5("sha256").update(verifier).digest("base64url");
@@ -1199,13 +1278,8 @@ var login = async () => {
   authorizationUrl.searchParams.set("code_challenge_method", "S256");
   authorizationUrl.searchParams.set("redirect_uri", listener.authorizationUrl);
   authorizationUrl.searchParams.set("state", state);
-  process.stdout.write("Your browser will open for Gemography email verification.\n");
   try {
-    if (!await openBrowser(authorizationUrl.toString())) {
-      process.stdout.write(`Open this address in your browser:
-${authorizationUrl.toString()}
-`);
-    }
+    await launchAuthorization(authorizationUrl.toString());
     const callback = await listener.callback;
     const response = await fetch(new URL("/v1/auth/token", REGISTRY_ORIGIN), {
       method: "POST",
@@ -1235,8 +1309,346 @@ ${authorizationUrl.toString()}
   }
 };
 
+// src/remover.ts
+import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
+import { chmod as chmod2, lstat as lstat6, mkdir as mkdir4, readFile as readFile2, rename as rename3, rm as rm3 } from "fs/promises";
+import os5 from "os";
+import path6 from "path";
+var isNotFound3 = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
+var entryFingerprint = async (entryPath) => {
+  try {
+    const entry = await lstat6(entryPath, { bigint: true });
+    return {
+      dev: entry.dev,
+      ino: entry.ino,
+      mode: Number(entry.mode),
+      mtimeNs: entry.mtimeNs,
+      size: entry.size
+    };
+  } catch (error) {
+    if (isNotFound3(error)) {
+      return null;
+    }
+    throw error;
+  }
+};
+var fingerprintsMatch2 = (left, right) => left !== null && right !== void 0 && left.dev === right.dev && left.ino === right.ino && left.mode === right.mode && left.mtimeNs === right.mtimeNs && left.size === right.size;
+var agentLabel = (runtime) => runtime === "codex" ? "Codex" : "Claude";
+var targetIdentifier = (targetRoot) => createHash6("sha256").update(targetRoot).digest("hex").slice(0, 16);
+var receiptIssue = (record, message) => `${record.filePath}: ${message}`;
+var assertRealDirectory = async (directory) => {
+  const fingerprint2 = await entryFingerprint(directory);
+  if (fingerprint2 === null) {
+    return false;
+  }
+  const entry = await lstat6(directory);
+  return entry.isDirectory() && !entry.isSymbolicLink();
+};
+var validateReceiptTarget = (record, skillName, home) => {
+  const { receipt } = record;
+  try {
+    targetsFromReceipts([receipt], skillName, home);
+  } catch {
+    return receiptIssue(record, "the target is outside the supported local skill folders");
+  }
+  const canonicalRoot = path6.resolve(receipt.targetRoot);
+  const canonicalInstalledPath = path6.join(canonicalRoot, skillName);
+  if (receipt.targetRoot !== canonicalRoot || receipt.installedPath !== canonicalInstalledPath || path6.dirname(receipt.installedPath) !== canonicalRoot) {
+    return receiptIssue(record, "the installed path is not the canonical path inside its target root");
+  }
+  if (receiptPath(receipt.targetRoot, receipt.skillName, home) !== record.filePath) {
+    return receiptIssue(record, "the file is stored under the wrong target identifier");
+  }
+  return null;
+};
+var preflightRecord = async (record, skillName, home, force, batchRoot) => {
+  const issues = [];
+  const targetIssue = validateReceiptTarget(record, skillName, home);
+  if (targetIssue !== null) {
+    return { issues: [targetIssue] };
+  }
+  const receiptFingerprint = await entryFingerprint(record.filePath);
+  if (receiptFingerprint === null) {
+    return { issues: [receiptIssue(record, "the receipt disappeared during preflight")] };
+  }
+  const receiptStat = await lstat6(record.filePath);
+  if (!receiptStat.isFile() || receiptStat.isSymbolicLink()) {
+    return { issues: [receiptIssue(record, "the receipt is not a real file")] };
+  }
+  const { receipt } = record;
+  const installedFingerprint = await entryFingerprint(receipt.installedPath);
+  if (installedFingerprint === null) {
+    return {
+      target: {
+        action: "clean-receipt",
+        runtime: receipt.runtime,
+        targetRoot: receipt.targetRoot,
+        installedPath: receipt.installedPath,
+        record,
+        receiptFingerprint
+      },
+      issues
+    };
+  }
+  if (!await assertRealDirectory(path6.dirname(receipt.targetRoot))) {
+    issues.push(receiptIssue(record, "the agent configuration directory is not a real directory"));
+  }
+  if (!await assertRealDirectory(receipt.targetRoot)) {
+    issues.push(receiptIssue(record, "the target root is not a real directory"));
+  }
+  const installedStat = await lstat6(receipt.installedPath);
+  if (!installedStat.isDirectory() || installedStat.isSymbolicLink()) {
+    issues.push(
+      `${agentLabel(receipt.runtime)} copy at ${receipt.installedPath} is not a real directory.`
+    );
+    return { issues };
+  }
+  let installedHash;
+  try {
+    installedHash = (await hashDirectory(receipt.installedPath)).contentHash;
+  } catch {
+    issues.push(
+      `${agentLabel(receipt.runtime)} copy at ${receipt.installedPath} contains unsupported local changes.`
+    );
+    return { issues };
+  }
+  const modified = installedHash !== receipt.installedHash;
+  if (modified && !force) {
+    issues.push(
+      `${agentLabel(receipt.runtime)} copy at ${receipt.installedPath} was edited after installation; re-run with --force to preserve it in a private backup.`
+    );
+  }
+  const backupPath = path6.join(
+    batchRoot,
+    "content",
+    receipt.runtime,
+    targetIdentifier(receipt.targetRoot),
+    skillName
+  );
+  return {
+    target: {
+      action: modified ? "backup-modified" : "remove",
+      runtime: receipt.runtime,
+      targetRoot: receipt.targetRoot,
+      installedPath: receipt.installedPath,
+      backupPath,
+      record,
+      receiptFingerprint,
+      installedFingerprint,
+      installedHash
+    },
+    issues
+  };
+};
+var assertInstalledUnchanged = async (target) => {
+  const currentFingerprint = await entryFingerprint(target.installedPath);
+  if (target.action === "clean-receipt") {
+    if (currentFingerprint !== null) {
+      throw new CliError(
+        "target_changed",
+        `The ${target.runtime} installation appeared during removal preflight.`
+      );
+    }
+    return;
+  }
+  if (!fingerprintsMatch2(currentFingerprint, target.installedFingerprint)) {
+    throw new CliError(
+      "target_changed",
+      `The ${target.runtime} installation changed during removal preflight.`
+    );
+  }
+  const currentHash = (await hashDirectory(target.installedPath)).contentHash;
+  if (currentHash !== target.installedHash) {
+    throw new CliError(
+      "target_changed",
+      `The ${target.runtime} installation changed during removal preflight.`
+    );
+  }
+};
+var assertReceiptUnchanged = async (target) => {
+  const currentFingerprint = await entryFingerprint(target.record.filePath);
+  if (!fingerprintsMatch2(currentFingerprint, target.receiptFingerprint)) {
+    throw new CliError(
+      "receipt_changed",
+      `The receipt changed during removal: ${target.record.filePath}.`
+    );
+  }
+  const serialized = await readFile2(target.record.filePath, "utf8");
+  const contentHash = createHash6("sha256").update(serialized).digest("hex");
+  if (contentHash !== target.record.contentHash) {
+    throw new CliError(
+      "receipt_changed",
+      `The receipt changed during removal: ${target.record.filePath}.`
+    );
+  }
+};
+var createPrivateBatchRoot = async (batchRoot, home) => {
+  const backups = localPaths(home).backups;
+  await mkdir4(backups, { recursive: true, mode: 448 });
+  const backupsStat = await lstat6(backups);
+  if (!backupsStat.isDirectory() || backupsStat.isSymbolicLink()) {
+    throw new CliError("unsafe_backup", "The Yeka Skills backup location is not a real directory.");
+  }
+  await mkdir4(batchRoot, { mode: 448 });
+  await chmod2(batchRoot, 448);
+};
+var moveToBatch = async (source, destination) => {
+  await mkdir4(path6.dirname(destination), { recursive: true, mode: 448 });
+  await rename3(source, destination);
+  return { source, destination };
+};
+var rollbackMoves = async (moves) => {
+  const failures = [];
+  for (const move of [...moves].reverse()) {
+    try {
+      await rename3(move.destination, move.source);
+    } catch (error) {
+      failures.push(error instanceof Error ? error : new Error(String(error)));
+    }
+  }
+  return failures;
+};
+var restoreReceipts2 = async (targets, home) => {
+  const failures = [];
+  for (const target of [...targets].reverse()) {
+    try {
+      await writeReceipt(target.record.receipt, home);
+    } catch (error) {
+      failures.push(error instanceof Error ? error : new Error(String(error)));
+    }
+  }
+  return failures;
+};
+var publicActions = (targets) => targets.map(({ action, runtime, targetRoot, installedPath, backupPath }) => ({
+  action,
+  runtime,
+  targetRoot,
+  installedPath,
+  ...backupPath === void 0 ? {} : { backupPath }
+}));
+var removableSkillNames = async (home = os5.homedir()) => {
+  const scan = await scanReceiptRecords(home);
+  return [...new Set(scan.records.map((record) => record.receipt.skillName))].sort(
+    (left, right) => left.localeCompare(right, "en")
+  );
+};
+var removeSkill = async (skillName, options = {}) => {
+  const home = path6.resolve(options.home ?? os5.homedir());
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const timestamp = now.toISOString().replace(/[:.]/g, "-");
+  const batchRoot = path6.join(
+    localPaths(home).backups,
+    `${timestamp}-remove-${randomUUID3()}`
+  );
+  const scan = await scanReceiptRecords(home);
+  const matchingRecords = scan.records.filter((record) => record.receipt.skillName === skillName);
+  if (matchingRecords.length === 0 && scan.invalidFiles.length === 0) {
+    throw new CliError("not_installed", `${skillName} is not a managed installation.`);
+  }
+  const issues = scan.invalidFiles.map((filePath) => `${filePath}: the receipt is invalid or corrupt`);
+  const targets = [];
+  for (const record of matchingRecords) {
+    try {
+      const result = await preflightRecord(
+        record,
+        skillName,
+        home,
+        options.force === true,
+        batchRoot
+      );
+      issues.push(...result.issues);
+      if (result.target !== void 0) {
+        targets.push(result.target);
+      }
+    } catch (error) {
+      issues.push(
+        receiptIssue(
+          record,
+          error instanceof Error ? error.message : "preflight could not inspect this target"
+        )
+      );
+    }
+  }
+  const liveInstallsByRuntime = /* @__PURE__ */ new Map();
+  for (const target of targets) {
+    if (target.backupPath !== void 0) {
+      const live = liveInstallsByRuntime.get(target.runtime) ?? [];
+      live.push(target);
+      liveInstallsByRuntime.set(target.runtime, live);
+    }
+  }
+  for (const [runtime, liveTargets] of liveInstallsByRuntime) {
+    if (liveTargets.length > 1) {
+      for (const target of liveTargets) {
+        issues.push(
+          receiptIssue(
+            target.record,
+            `there is more than one ${runtime} receipt with an existing installation`
+          )
+        );
+      }
+    }
+  }
+  if (issues.length > 0) {
+    throw new CliError(
+      "remove_preflight_failed",
+      `Nothing was removed because preflight found a problem:
+${issues.map((issue) => `- ${issue}`).join("\n")}`
+    );
+  }
+  if (targets.length === 0) {
+    throw new CliError("not_installed", `${skillName} is not a managed installation.`);
+  }
+  const actions = publicActions(targets);
+  if (options.dryRun === true) {
+    return actions;
+  }
+  const hasDirectoryMoves = targets.some((target) => target.backupPath !== void 0);
+  if (hasDirectoryMoves) {
+    await createPrivateBatchRoot(batchRoot, home);
+  }
+  const directoryMoves = [];
+  const deletedReceipts = [];
+  try {
+    for (const target of targets) {
+      await assertInstalledUnchanged(target);
+      if (target.backupPath !== void 0) {
+        directoryMoves.push(await moveToBatch(target.installedPath, target.backupPath));
+      }
+    }
+    for (const target of targets) {
+      await assertReceiptUnchanged(target);
+      await deleteReceipt(target.targetRoot, skillName, home);
+      deletedReceipts.push(target);
+    }
+  } catch (error) {
+    const receiptFailures = await restoreReceipts2(deletedReceipts, home);
+    const directoryFailures = await rollbackMoves(directoryMoves);
+    if (receiptFailures.length > 0 || directoryFailures.length > 0) {
+      throw new CliError(
+        "rollback_failed",
+        hasDirectoryMoves ? `Removal failed and automatic rollback was incomplete. Recovery data remains at ${batchRoot}.` : "Removal failed and automatic rollback was incomplete.",
+        { cause: error }
+      );
+    }
+    if (hasDirectoryMoves) {
+      await rm3(batchRoot, { recursive: true, force: true });
+    }
+    throw new CliError(
+      "remove_failed",
+      `Nothing was removed. ${error instanceof Error ? error.message : "The removal batch failed."}`,
+      { cause: error }
+    );
+  }
+  const retainsModifiedCopy = targets.some((target) => target.action === "backup-modified");
+  if (hasDirectoryMoves && !retainsModifiedCopy) {
+    await rm3(batchRoot, { recursive: true, force: true });
+  }
+  return actions;
+};
+
 // src/registry-client.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { open, unlink as unlink2 } from "fs/promises";
 var MAX_MANIFEST_BYTES = 1024 * 1024;
 var parseContentLength = (value) => {
@@ -1341,7 +1753,7 @@ var RegistryClient = class {
       throw new CliError("artifact_size_mismatch", "The skill artifact size does not match its manifest.");
     }
     const file = await open(destination, "wx", 384);
-    const hash = createHash6("sha256");
+    const hash = createHash7("sha256");
     const reader = response.body.getReader();
     let bytesWritten = 0;
     try {
@@ -1389,6 +1801,60 @@ var RegistryClient = class {
       );
     }
   }
+  async uploadSubmission(skillName, archiveSha256, body, token) {
+    const response = await fetch(new URL("/v1/submissions", this.origin), {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "X-Yeka-Skill-Name": skillName,
+        "X-Yeka-Archive-Sha256": archiveSha256,
+        "Content-Type": "application/gzip"
+      },
+      body,
+      redirect: "error",
+      signal: AbortSignal.timeout(2 * 60 * 1e3)
+    });
+    if (response.status === 201) {
+      const payload = await response.json();
+      if (typeof payload.submissionId !== "string" || payload.submissionId.length === 0) {
+        throw new CliError("invalid_submission_response", "The registry response was incomplete.");
+      }
+      return payload.submissionId;
+    }
+    if (response.status === 401 || response.status === 403) {
+      await response.body?.cancel("authentication failed");
+      throw new AuthenticationError();
+    }
+    await response.body?.cancel("submission rejected");
+    if (response.status === 415) {
+      throw new CliError(
+        "submission_not_gzip",
+        "The registry did not accept the archive as gzip. Run `yeka-skills share " + skillName + " --check` and share the error with the team channel if it looks fine."
+      );
+    }
+    if (response.status === 413) {
+      throw new CliError(
+        "submission_too_large",
+        "The skill is over the 5 MB share limit. Move anything heavy out of the folder, then run `yeka-skills share " + skillName + "` again."
+      );
+    }
+    if (response.status === 429) {
+      throw new CliError(
+        "submission_rate_limited",
+        "You have shared the daily maximum of 20 skills. Try again tomorrow."
+      );
+    }
+    if (response.status === 400) {
+      throw new CliError(
+        "submission_rejected",
+        "The registry could not accept this share. Run `yeka-skills share " + skillName + " --check` to look the folder over, then try again."
+      );
+    }
+    throw new CliError(
+      "registry_request_failed",
+      `The registry could not accept the share right now (status ${response.status}). Try again in a moment.`
+    );
+  }
 };
 
 // src/session.ts
@@ -1410,13 +1876,253 @@ var withRegistrySession = async (operation, dependencies = defaultDependencies)
   }
 };
 
+// src/share.ts
+import { createHash as createHash8 } from "crypto";
+import { lstat as lstat7, mkdir as mkdir5, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile3, realpath, rm as rm4, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import { tmpdir } from "os";
+import path7 from "path";
+import * as tar2 from "tar";
+import { gzipSync } from "zlib";
+var MAX_PACKAGED_BYTES = 5 * 1024 * 1024;
+var MAX_NOTES_BYTES = 8 * 1024;
+var RESERVED_ENTRY = "_yeka";
+var NOTES_ARCHIVE_PATH = "_yeka/notes.txt";
+var SKILL_MANIFEST_PATH = "SKILL.md";
+var isSkillFolder = async (candidate) => {
+  try {
+    const entry = await lstat7(candidate);
+    if (entry.isSymbolicLink()) {
+      const resolved = await stat2(await realpath(candidate));
+      return resolved.isDirectory();
+    }
+    return entry.isDirectory();
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+};
+var candidateRoots = (home) => [
+  { runtime: "codex", targetRoot: path7.join(home, ".agents", "skills") },
+  { runtime: "claude", targetRoot: path7.join(home, ".claude", "skills") },
+  { runtime: "codex", targetRoot: path7.join(home, ".codex", "skills") }
+];
+var resolveSkillFolder = async (skillName, home) => {
+  const parsedName = SkillNameSchema.safeParse(skillName);
+  if (!parsedName.success) {
+    throw new CliError("invalid_skill_name", "Use the exact lowercase skill name from the catalog.");
+  }
+  const found = [];
+  for (const candidate of candidateRoots(home)) {
+    const requestedPath = path7.join(candidate.targetRoot, skillName);
+    if (await isSkillFolder(requestedPath)) {
+      found.push({
+        ...candidate,
+        requestedPath,
+        folderPath: await realpath(requestedPath)
+      });
+    }
+  }
+  if (found.length === 0) {
+    throw new CliError(
+      "skill_folder_not_found",
+      `No local skill folder named ${skillName} was found in your Codex or Claude skills folders.`
+    );
+  }
+  return found[0];
+};
+var enumerateSkillFiles = async (folderPath) => {
+  const entries = [];
+  const walk = async (relativePrefix) => {
+    const absoluteDir = relativePrefix === "" ? folderPath : path7.join(folderPath, relativePrefix);
+    for (const entry of await readdir3(absoluteDir, { withFileTypes: true })) {
+      const relativePath = relativePrefix === "" ? entry.name : `${relativePrefix}/${entry.name}`;
+      if (relativePrefix === "" && entry.name === RESERVED_ENTRY) {
+        throw new CliError(
+          "reserved_folder_name",
+          "This skill contains a reserved `_yeka` folder. Rename it \u2014 Yeka Skills uses `_yeka` inside the archive for its own metadata."
+        );
+      }
+      if (entry.isSymbolicLink()) {
+        throw new CliError(
+          "unsafe_skill_folder",
+          `${relativePath} is a symlink. Replace it with a real file or folder before sharing.`
+        );
+      }
+      if (entry.isDirectory()) {
+        await walk(relativePath);
+      } else if (entry.isFile()) {
+        entries.push({ relativePath, sizeBytes: (await lstat7(path7.join(absoluteDir, entry.name))).size });
+      } else {
+        throw new CliError(
+          "unsafe_skill_folder",
+          `${relativePath} is not a regular file. Remove it before sharing.`
+        );
+      }
+    }
+  };
+  await walk("");
+  entries.sort((left, right) => left.relativePath.localeCompare(right.relativePath, "en"));
+  if (!entries.some((entry) => entry.relativePath === SKILL_MANIFEST_PATH)) {
+    throw new CliError(
+      "skill_md_missing",
+      `The folder has no SKILL.md file. Add one at ${path7.join(folderPath, SKILL_MANIFEST_PATH)} so reviewers know what the skill does.`
+    );
+  }
+  return {
+    entries,
+    totalBytes: entries.reduce((total, entry) => total + entry.sizeBytes, 0)
+  };
+};
+var CREDENTIAL_PATH_PATTERN = /(\.ssh[/\\]|\.aws[/\\]|\.netrc|\.git-credentials|id_rsa|\.env\b|credentials\.json)/i;
+var CURL_PIPE_SHELL_PATTERN = /(?:curl|wget)\s[^|]*\|\s*(?:ba|z)?sh\b/i;
+var LONG_BASE64_PATTERN = /[A-Za-z0-9+/]{80,}={0,2}/;
+var URL_PATTERN = /https?:\/\/[^\s"'`>)\]]+/g;
+var lintWarningsFor = async (folderPath, entries) => {
+  const warnings = [];
+  const urls = /* @__PURE__ */ new Set();
+  for (const { relativePath } of entries) {
+    const text = (await readFile3(path7.join(folderPath, relativePath))).toString("utf8");
+    for (const match of text.matchAll(URL_PATTERN)) {
+      urls.add(match[0]);
+    }
+    if (CREDENTIAL_PATH_PATTERN.test(text)) {
+      warnings.push(
+        `${relativePath} mentions a credentials path (like .ssh, .aws, or a .env file). Check that it only points at them and never contains the secrets themselves.`
+      );
+    }
+    if (CURL_PIPE_SHELL_PATTERN.test(text)) {
+      warnings.push(
+        `${relativePath} pipes curl or wget straight into a shell. Reviewers will look at this closely, so make sure the command is safe.`
+      );
+    }
+    if (LONG_BASE64_PATTERN.test(text)) {
+      warnings.push(
+        `${relativePath} contains a long base64 token. Make sure it is not a real secret before you share.`
+      );
+    }
+  }
+  if (urls.size > 0) {
+    warnings.push(
+      `The skill mentions these web addresses, just so you know: ${[...urls].slice(0, 5).join(", ")}.`
+    );
+  }
+  return warnings;
+};
+var packageSkillFolder = async (folderPath, notes, maxBytes = MAX_PACKAGED_BYTES) => {
+  if (notes !== void 0 && Buffer.byteLength(notes.text, "utf8") > MAX_NOTES_BYTES) {
+    throw new CliError(
+      "notes_too_large",
+      "The notes file is over 8 KB. Trim it down and try again."
+    );
+  }
+  const skillFiles = await enumerateSkillFiles(folderPath);
+  const staging = await mkdtemp2(path7.join(tmpdir(), "yeka-share-"));
+  let archiveBytes;
+  try {
+    const tarPath = path7.join(staging, "skill.tar");
+    if (notes === void 0) {
+      await tar2.c(
+        { cwd: folderPath, file: tarPath, portable: true, noMtime: true, strict: true },
+        skillFiles.entries.map((entry) => entry.relativePath)
+      );
+    } else {
+      const notesStagingPath = path7.join(staging, NOTES_ARCHIVE_PATH);
+      await mkdir5(path7.dirname(notesStagingPath), { recursive: true });
+      await writeFile2(notesStagingPath, notes.text, { encoding: "utf8", mode: 384 });
+      await tar2.c(
+        { cwd: staging, file: tarPath, portable: true, noMtime: true, strict: true },
+        [NOTES_ARCHIVE_PATH]
+      );
+      await tar2.r(
+        { cwd: folderPath, file: tarPath, portable: true, noMtime: true, strict: true },
+        skillFiles.entries.map((entry) => entry.relativePath)
+      );
+    }
+    const archivePaths = [];
+    await tar2.t({
+      file: tarPath,
+      strict: true,
+      onReadEntry: (entry) => {
+        const entryPath = entry.path.replace(/\/+$/, "");
+        if (archivePaths.includes(entryPath)) {
+          throw new CliError(
+            "reserved_folder_name",
+            `The archive repeats ${entryPath}. Remove the duplicate before sharing.`
+          );
+        }
+        archivePaths.push(entryPath);
+      }
+    });
+    const expectedPaths = new Set(skillFiles.entries.map((entry) => entry.relativePath));
+    if (notes !== void 0) {
+      expectedPaths.add(NOTES_ARCHIVE_PATH);
+    }
+    if (archivePaths.length !== expectedPaths.size || archivePaths.some((p) => !expectedPaths.has(p))) {
+      throw new CliError(
+        "unsafe_skill_folder",
+        "The folder changed while the archive was being built. Nothing was shared; run the share again."
+      );
+    }
+    const recheck = await enumerateSkillFiles(folderPath);
+    if (recheck.entries.length !== skillFiles.entries.length || recheck.entries.some(
+      (entry, index) => entry.relativePath !== skillFiles.entries[index].relativePath || entry.sizeBytes !== skillFiles.entries[index].sizeBytes
+    )) {
+      throw new CliError(
+        "skill_folder_changed",
+        "The folder changed while it was being packaged. Nothing was shared; run the share again."
+      );
+    }
+    const tarBytes = new Uint8Array(await readFile3(tarPath));
+    const bytes = new Uint8Array(gzipSync(tarBytes));
+    archiveBytes = bytes.byteLength;
+    if (archiveBytes > maxBytes) {
+      throw new CliError(
+        "skill_too_large",
+        `The packaged skill is ${(archiveBytes / (1024 * 1024)).toFixed(1)} MB, over the 5 MB share limit. Move anything heavy out of the folder and try again.`
+      );
+    }
+    const sha256 = createHash8("sha256").update(bytes).digest("hex");
+    return {
+      bytes,
+      sha256,
+      fileCount: skillFiles.entries.length,
+      packagedBytes: skillFiles.totalBytes,
+      archiveBytes
+    };
+  } finally {
+    await rm4(staging, { recursive: true, force: true });
+  }
+};
+var checkSkillFolder = async (folderPath, skillName, maxBytes = MAX_PACKAGED_BYTES, notes) => {
+  const skillFiles = await enumerateSkillFiles(folderPath);
+  const skillMd = await readFile3(path7.join(folderPath, SKILL_MANIFEST_PATH), "utf8");
+  const frontmatterMatch = skillMd.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  const frontmatter = frontmatterMatch?.[1] ?? "";
+  const declaredName = frontmatter.match(/^name:\s*(.+)\s*$/m)?.[1]?.trim() ?? "";
+  if (declaredName !== skillName || !SkillNameSchema.safeParse(declaredName).success) {
+    throw new CliError(
+      "skill_name_mismatch",
+      declaredName.length === 0 ? `The SKILL.md frontmatter has no name line. Add \`name: ${skillName}\` at the top.` : `The SKILL.md frontmatter says name: ${declaredName}, but the folder is ${skillName}. Make them match, using only lowercase letters, numbers, and dashes.`
+    );
+  }
+  const packaged = await packageSkillFolder(folderPath, notes, maxBytes);
+  return {
+    fileCount: packaged.fileCount,
+    rawBytes: skillFiles.totalBytes,
+    archiveBytes: packaged.archiveBytes,
+    warnings: await lintWarningsFor(folderPath, skillFiles.entries)
+  };
+};
+
 // src/targets.ts
-import { lstat as lstat5 } from "fs/promises";
-import os5 from "os";
-import path6 from "path";
+import { lstat as lstat8 } from "fs/promises";
+import os6 from "os";
+import path8 from "path";
 var isRealDirectory = async (candidate) => {
   try {
-    const entry = await lstat5(candidate);
+    const entry = await lstat8(candidate);
     return entry.isDirectory() && !entry.isSymbolicLink();
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -1427,7 +2133,7 @@ var isRealDirectory = async (candidate) => {
 };
 var pathExists = async (candidate) => {
   try {
-    await lstat5(candidate);
+    await lstat8(candidate);
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -1437,17 +2143,17 @@ var pathExists = async (candidate) => {
   }
 };
 var resolveCodexTarget = async (home, skillName) => {
-  const currentRoot = path6.join(home, ".agents", "skills");
-  const currentParent = path6.join(home, ".agents");
-  const codexConfig = path6.join(home, ".codex");
-  const legacyRoot = path6.join(codexConfig, "skills");
+  const currentRoot = path8.join(home, ".agents", "skills");
+  const currentParent = path8.join(home, ".agents");
+  const codexConfig = path8.join(home, ".codex");
+  const legacyRoot = path8.join(codexConfig, "skills");
   const legacyActive = await isRealDirectory(legacyRoot);
   const currentActive = await isRealDirectory(currentRoot) || await isRealDirectory(currentParent) || await isRealDirectory(codexConfig) && !legacyActive;
   if (currentActive) {
-    if (legacyActive && await pathExists(path6.join(legacyRoot, skillName))) {
+    if (legacyActive && await pathExists(path8.join(legacyRoot, skillName))) {
       throw new CliError(
         "legacy_codex_conflict",
-        `Codex can see a legacy copy at ${path6.join(legacyRoot, skillName)}. Remove or archive that copy before installation.`
+        `Codex can see a legacy copy at ${path8.join(legacyRoot, skillName)}. Remove or archive that copy before installation.`
       );
     }
     return { runtime: "codex", targetRoot: currentRoot, legacy: false };
@@ -1458,17 +2164,17 @@ var resolveCodexTarget = async (home, skillName) => {
   return null;
 };
 var resolveClaudeTarget = async (home) => {
-  const claudeConfig = path6.join(home, ".claude");
+  const claudeConfig = path8.join(home, ".claude");
   if (!await isRealDirectory(claudeConfig)) {
     return null;
   }
   return {
     runtime: "claude",
-    targetRoot: path6.join(claudeConfig, "skills"),
+    targetRoot: path8.join(claudeConfig, "skills"),
     legacy: false
   };
 };
-var resolveInstallTargets = async (skill, home = os5.homedir()) => {
+var resolveInstallTargets = async (skill, home = os6.homedir()) => {
   const targets = [];
   if (skill.runtimes.includes("codex")) {
     const codex = await resolveCodexTarget(home, skill.name);
@@ -1512,8 +2218,8 @@ var findSkill = (manifest, name) => {
 };
 var ensurePrivateCache = async (home) => {
   const cache = localPaths(home).cache;
-  await mkdir4(cache, { recursive: true, mode: 448 });
-  const cacheStat = await lstat6(cache);
+  await mkdir6(cache, { recursive: true, mode: 448 });
+  const cacheStat = await lstat9(cache);
   if (!cacheStat.isDirectory() || cacheStat.isSymbolicLink()) {
     throw new CliError("unsafe_cache", "The Yeka Skills cache is not a real directory.");
   }
@@ -1521,9 +2227,9 @@ var ensurePrivateCache = async (home) => {
 };
 var downloadAndInstall = async (client, token, skill, targets, options, home) => {
   const cache = await ensurePrivateCache(home);
-  const downloadRoot = await mkdtemp2(path7.join(cache, "download-"));
-  await chmod2(downloadRoot, 448);
-  const archivePath = path7.join(downloadRoot, `${skill.name}.tgz`);
+  const downloadRoot = await mkdtemp3(path9.join(cache, "download-"));
+  await chmod3(downloadRoot, 448);
+  const archivePath = path9.join(downloadRoot, `${skill.name}.tgz`);
   try {
     await client.downloadArtifact(skill, token, archivePath);
     return await installSkillFromArchive({
@@ -1534,7 +2240,7 @@ var downloadAndInstall = async (client, token, skill, targets, options, home) =>
       home
     });
   } finally {
-    await rm3(downloadRoot, { recursive: true, force: true });
+    await rm5(downloadRoot, { recursive: true, force: true });
   }
 };
 var actionMessage = (skillName, action, dryRun) => {
@@ -1557,17 +2263,52 @@ var printActions = (context, skillName, actions, dryRun) => {
     }
   }
 };
+var COMPANION_SKILL_NAME = "yeka-skills";
 var addCommand = async (skillNameInput, options, context = {}) => {
   const skillName = validatedSkillName(skillNameInput);
-  const home = path7.resolve(context.home ?? os6.homedir());
+  const home = path9.resolve(context.home ?? os7.homedir());
   const client = context.client ?? new RegistryClient();
-  const actions = await withRegistrySession(async (token) => {
+  const { actions, companionInstalled } = await withRegistrySession(async (token) => {
     const manifest = await client.getManifest(token);
     const skill = findSkill(manifest, skillName);
     const targets = await resolveInstallTargets(skill, home);
-    return downloadAndInstall(client, token, skill, targets, options, home);
-  });
+    const primaryActions = await downloadAndInstall(client, token, skill, targets, options, home);
+    let companion = "skipped";
+    if (options.dryRun !== true && skillName !== COMPANION_SKILL_NAME) {
+      let hasCompanionReceipt = false;
+      try {
+        const receipts = await listReceipts(home);
+        hasCompanionReceipt = receipts.some((r2) => r2.skillName === COMPANION_SKILL_NAME);
+      } catch {
+        hasCompanionReceipt = false;
+      }
+      if (hasCompanionReceipt) {
+        companion = "present";
+      } else {
+        try {
+          const companionSkill = findSkill(manifest, COMPANION_SKILL_NAME);
+          const companionTargets = await resolveInstallTargets(companionSkill, home);
+          await downloadAndInstall(client, token, companionSkill, companionTargets, options, home);
+          companion = "installed";
+        } catch {
+          companion = "failed";
+        }
+      }
+    }
+    return { actions: primaryActions, companionInstalled: companion };
+  }, context.session);
   printActions(context, skillName, actions, options.dryRun === true);
+  if (companionInstalled === "installed") {
+    output(
+      context,
+      "Also installed the yeka-skills assistant so your agent knows how to update and share skills."
+    );
+  } else if (companionInstalled === "failed") {
+    output(
+      context,
+      "(could not auto-install the assistant; run `npx yeka-skills add yeka-skills` yourself)"
+    );
+  }
 };
 var receiptGroups = (receipts) => {
   const groups = /* @__PURE__ */ new Map();
@@ -1593,7 +2334,7 @@ var statusLabel = (status) => {
   }
 };
 var listCommand = async (context = {}) => {
-  const home = path7.resolve(context.home ?? os6.homedir());
+  const home = path9.resolve(context.home ?? os7.homedir());
   const receipts = await listReceipts(home);
   if (receipts.length === 0) {
     output(context, "No managed Yeka skills are installed.");
@@ -1604,7 +2345,7 @@ var listCommand = async (context = {}) => {
   }
 };
 var statusCommand = async (context = {}) => {
-  const home = path7.resolve(context.home ?? os6.homedir());
+  const home = path9.resolve(context.home ?? os7.homedir());
   const receipts = await listReceipts(home);
   if (receipts.length === 0) {
     output(context, "No managed Yeka skills are installed.");
@@ -1639,7 +2380,7 @@ var assertUpdatableStatuses = (skillName, statuses) => {
 };
 var updateCommand = async (skillNameInput, options, context = {}) => {
   const selectedName = skillNameInput === void 0 ? void 0 : validatedSkillName(skillNameInput);
-  const home = path7.resolve(context.home ?? os6.homedir());
+  const home = path9.resolve(context.home ?? os7.homedir());
   const allReceipts = await listReceipts(home);
   const groups = receiptGroups(allReceipts);
   if (selectedName !== void 0 && !groups.has(selectedName)) {
@@ -1692,6 +2433,100 @@ var updateCommand = async (skillNameInput, options, context = {}) => {
     printActions(context, result.name, result.actions, options.dryRun === true);
   }
 };
+var removeActionMessage = (skillName, action, dryRun) => {
+  const agent = action.runtime === "codex" ? "Codex" : "Claude";
+  switch (action.action) {
+    case "remove":
+      return dryRun ? `Would remove the ${agent} copy of ${skillName} at ${action.installedPath}.` : `Removed the ${agent} copy of ${skillName} at ${action.installedPath}.`;
+    case "clean-receipt":
+      return dryRun ? `The ${agent} copy of ${skillName} is already gone; would clean its receipt.` : `The ${agent} copy of ${skillName} was already gone; receipt cleaned.`;
+    case "backup-modified":
+      return dryRun ? `Would remove the edited ${agent} copy of ${skillName} and preserve it in a private backup folder.` : `Removed the edited ${agent} copy of ${skillName}; backup: ${action.backupPath}.`;
+  }
+};
+var removeCommand = async (skillNameInput, options, context = {}) => {
+  const home = path9.resolve(context.home ?? os7.homedir());
+  if (skillNameInput === void 0) {
+    const names = await removableSkillNames(home);
+    throw new CliError(
+      "missing_skill_name",
+      names.length === 0 ? "Usage: yeka-skills remove <skill>. No managed Yeka skills are removable." : `Usage: yeka-skills remove <skill>. Removable skills: ${names.join(", ")}.`
+    );
+  }
+  const skillName = validatedSkillName(skillNameInput);
+  const actions = await removeSkill(skillName, {
+    home,
+    ...options.dryRun === void 0 ? {} : { dryRun: options.dryRun },
+    ...options.force === void 0 ? {} : { force: options.force }
+  });
+  for (const action of actions) {
+    output(context, removeActionMessage(skillName, action, options.dryRun === true));
+  }
+};
+var readNotesFile = async (notesPath) => {
+  let text;
+  try {
+    text = await readFile4(notesPath, "utf8");
+  } catch {
+    throw new CliError(
+      "notes_file_unreadable",
+      `The notes file could not be read: ${notesPath}. Check the path and try again.`
+    );
+  }
+  if (Buffer.byteLength(text, "utf8") > 8 * 1024) {
+    throw new CliError(
+      "notes_too_large",
+      "The notes file is over 8 KB. Trim it down and try again."
+    );
+  }
+  return { text };
+};
+var agentLabel2 = (runtime) => runtime === "codex" ? "Codex" : "Claude";
+var shareCommand = async (skillNameInput, options, context = {}) => {
+  const home = path9.resolve(context.home ?? os7.homedir());
+  if (skillNameInput === void 0) {
+    throw new CliError("missing_skill_name", "Usage: yeka-skills share <skill-name>.");
+  }
+  const skillName = validatedSkillName(skillNameInput);
+  const folder = await resolveSkillFolder(skillName, home);
+  output(
+    context,
+    folder.requestedPath === folder.folderPath ? `Found ${skillName} in your ${agentLabel2(folder.runtime)} skills folder: ${folder.folderPath}` : `Found ${skillName} in your ${agentLabel2(folder.runtime)} skills folder: ${folder.requestedPath} (packaging the folder it points at: ${folder.folderPath})`
+  );
+  const notes = options.notesFile === void 0 ? void 0 : await readNotesFile(options.notesFile);
+  const check = await checkSkillFolder(folder.folderPath, skillName, void 0, notes);
+  if (options.check === true) {
+    if (check.warnings.length === 0) {
+      output(context, "Nothing looked risky.");
+    } else {
+      for (const warning of check.warnings) {
+        output(context, `Heads up: ${warning}`);
+      }
+      output(context, "These are warnings only \u2014 they never block a share. The team's checks decide.");
+    }
+    output(
+      context,
+      `${skillName} is ready to share (${check.fileCount} files, ${(check.archiveBytes / (1024 * 1024)).toFixed(1)} MB packaged). Run \`yeka-skills share ${skillName}\` when you're happy with it.`
+    );
+    return;
+  }
+  const packaged = await packageSkillFolder(folder.folderPath, notes);
+  const client = context.client ?? new RegistryClient();
+  try {
+    await withRegistrySession(
+      (token) => client.uploadSubmission(skillName, packaged.sha256, packaged.bytes, token)
+    );
+  } catch (error) {
+    if (error instanceof CliError && error.code.startsWith("login_")) {
+      throw new CliError(
+        error.code,
+        `${error.message} You can also run \`yeka-skills login\` first, then try the share again.`
+      );
+    }
+    throw error;
+  }
+  output(context, "Shared. You'll hear back in #yeka-skills \u2014 updates usually go live within the hour.");
+};
 var loginCommand = async (context = {}) => {
   await deleteSession();
   await login();
@@ -1704,13 +2539,19 @@ var logoutCommand = async (context = {}) => {
 
 // src/cli.ts
 var program = new Command();
-program.name("yeka-skills").description("Install and update private Gemography agent skills").version("0.1.0").showHelpAfterError();
+program.name("yeka-skills").description("Install, update, and remove private Gemography agent skills").version("0.1.0").showHelpAfterError();
 program.command("add").description("Install one private skill").argument("<skill>", "exact skill name").option("--dry-run", "verify and show changes without installation").action(async (skill, options) => addCommand(skill, options));
 program.command("list").description("List managed local skills without network access").action(async () => listCommand());
 program.command("status").description("Check local skills and available updates").action(async () => statusCommand());
 program.command("update").description("Update one managed skill or all managed skills").argument("[skill]", "exact skill name").option("--dry-run", "verify and show changes without installation").action(
   async (skill, options) => updateCommand(skill, options)
 );
+program.command("remove").description("Remove one managed skill without registry access").argument("[skill]", "exact skill name").option("--force", "preserve and remove a locally edited copy").option("--dry-run", "verify and show changes without removal").action(
+  async (skill, options) => removeCommand(skill, options)
+);
+program.command("share").description("Share one local skill with the team for review").argument("<skill>", "exact skill name").option("--check", "look the skill over without sharing").option("--notes-file <path>", "text file with your interview answers, shared with the reviewers").action(
+  async (skill, options) => shareCommand(skill, options)
+);
 program.command("login").description("Start a new private registry session").action(async () => loginCommand());
 program.command("logout").description("Remove the saved private registry session").action(async () => logoutCommand());
 var main = async () => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "yeka-skills",
-  "version": "0.1.0",
-  "description": "Install and update private Gemography agent skills",
+  "version": "0.2.0",
+  "description": "Install, update, and remove private Gemography agent skills",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -13,9 +13,6 @@
   "engines": {
     "node": ">=22.15.0"
   },
-  "os": [
-    "darwin"
-  ],
   "bin": {
     "yeka-skills": "./dist/cli.js"
   },