@buildinternet/uploads 0.31.0 → 0.32.0

package/dist/commands/admin-enrollment.js

@@ -11,7 +11,7 @@ non-secret page URL plus a code you share separately). The legacy
 
 Options:
   --admin-token <token>  Or ADMIN_TOKEN (UPLOADS_ADMIN_TOKEN is a legacy alias)
-  --workspace <name>     Default: default
+  --workspace <name>     Required — the workspace the invite grants access to
   --label <label>
   --expires-in <seconds> Default: server policy
   --token-expires-in <seconds>  Upload token lifetime (default: server policy)
@@ -79,7 +79,15 @@ export async function runAdmin(args, opts, help = false) {
         throw new UsageError("ADMIN_TOKEN is required for admin enrollment creation");
     const apiUrl = flagString(parsed.flags, "--api-url") ?? opts.apiUrl ?? "https://api.uploads.sh";
     const webUrl = flagString(parsed.flags, "--web-url");
-    const workspace = flagString(parsed.flags, "--workspace") ?? "default";
+    // No default. An invite grants files:read/files:write on the workspace it
+    // names, so omitting the flag used to silently target the shared `default`
+    // workspace — and enrollment redemption mints a token without an org
+    // membership, so the recipient would not appear in any member list while
+    // still reading and writing its files.
+    const workspace = flagString(parsed.flags, "--workspace");
+    if (!workspace) {
+        throw new UsageError("--workspace is required (the workspace the invite grants access to)");
+    }
     const label = flagString(parsed.flags, "--label");
     const email = flagString(parsed.flags, "--email");
     const result = await createEnrollment(apiUrl, adminToken, {

package/dist/commands/install.d.ts

@@ -4,7 +4,7 @@ export declare const DEFAULT_MCP_URL = "https://agents.uploads.sh/mcp";
 export interface StepResult {
     command: string[];
     ok: boolean;
-    skipped?: "dry-run" | "sign-in";
+    skipped?: "dry-run" | "sign-in" | "already-configured";
     error?: string;
     output?: string;
 }

package/dist/commands/install.js

@@ -17,6 +17,10 @@ infers your workspace from the bearer token, so only the token is needed.
 Claude Code and Codex ship the same reminder via their plugins (same command:
 \`${HOOK_COMMAND}\`) — install those plugins instead of relying on this step.
 
+Safe to re-run. An MCP server already registered under this name is reported
+as \`already configured\` and left as-is — including the token it was created
+with. To point it at a new token: \`claude mcp remove <name>\` first.
+
 Usage:
   uploads install [skill|mcp|hooks|all]     (default: all)
 
@@ -73,6 +77,16 @@ function skillCommand(skill) {
     // -g global, -y non-interactive, -a '*' every agent (skips the multi-select TUI)
     return ["npx", "-y", "skills", "add", SKILL_SOURCE, "--skill", skill, "-g", "-y", "-a", "*"];
 }
+/**
+ * `claude mcp add` refuses to overwrite an existing entry and exits non-zero
+ * ("MCP server uploads already exists in local config"). That is the steady
+ * state for anyone re-running `uploads install`, not a failure — recognize it
+ * so the run stays green and the footer tells them how to re-add if they want
+ * a fresh token in the header.
+ */
+function alreadyConfigured(result) {
+    return !result.ok && /already exists/i.test(result.error ?? "");
+}
 function mcpCommand(name, url, bearer) {
     return [
         "claude",
@@ -101,7 +115,7 @@ function peekToken(globals) {
         return undefined;
     }
 }
-function printHumanSteps(results, redact, verbose) {
+function printHumanSteps(results, redact, verbose, mcpName) {
     for (const [step, r] of Object.entries(results)) {
         const cmd = redact(r.command.join(" "));
         if (r.skipped === "dry-run") {
@@ -110,6 +124,10 @@ function printHumanSteps(results, redact, verbose) {
         else if (r.skipped === "sign-in") {
             process.stdout.write(`${step}: skipped — ${redact(r.error ?? "needs sign-in")}\n`);
         }
+        else if (r.skipped === "already-configured") {
+            process.stdout.write(`${step}: already configured — "${mcpName}" is registered in Claude Code (nothing to do)\n` +
+                `  To re-register (e.g. with a new token): claude mcp remove ${mcpName} && uploads install mcp\n`);
+        }
         else if (r.ok) {
             process.stdout.write(`${step}: ok\n`);
             if (verbose && r.output) {
@@ -189,7 +207,12 @@ export async function runInstall(args, opts, help = false) {
             const command = mcpCommand(name, url, token || "<token>");
             if (human)
                 process.stdout.write("Installing MCP server…\n");
-            results.mcp = dryRun ? { command, ok: true, skipped: "dry-run" } : runStep(run, command);
+            const step = dryRun
+                ? { command, ok: true, skipped: "dry-run" }
+                : runStep(run, command);
+            results.mcp = alreadyConfigured(step)
+                ? { command, ok: true, skipped: "already-configured", output: step.error }
+                : step;
         }
     }
     if (target === "hooks" || target === "all") {
@@ -223,7 +246,7 @@ export async function runInstall(args, opts, help = false) {
         process.stdout.write(JSON.stringify({ ok: !failed, steps }, null, 2) + "\n");
         return failed ? 1 : 0;
     }
-    printHumanSteps(results, redact, verbose);
+    printHumanSteps(results, redact, verbose, name);
     // Path-level detail for hooks (printHumanSteps only shows the synthetic step).
     if ((target === "hooks" || target === "all") &&
         (dryRun || (human && (verbose || hookWrites.some((w) => w.action !== "skipped"))))) {

package/dist/commands/update.js

@@ -9,9 +9,10 @@ import { runInstall, runStep } from "./install.js";
 const UPDATE_HELP = `uploads update — update the CLI and refresh agent integrations
 
 Upgrades the globally installed npm package, then re-runs \`uploads install\` so
-the agent skills and the MCP registration match the new version. Skills and the
-MCP registration drift on their own, so this refreshes them even when the CLI is
-already current.
+the agent skills match the new version. Skills drift on their own, so this
+refreshes them even when the CLI is already current. An MCP server already
+registered is left as-is (\`already configured\`) — \`claude mcp add\` never
+overwrites an existing entry.
 
 Usage:
   uploads update [options]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
   "sideEffects": false,