@buildinternet/uploads 0.31.0 → 0.33.0

package/dist/client.d.ts

@@ -437,6 +437,7 @@ export interface MintWorkspaceSummary {
 /** GET /v1/tokens — workspaces the signed-in user can mint tokens for. */
 export declare function listMintWorkspaces(apiUrl: string, accessToken: string): Promise<{
     workspaces: MintWorkspaceSummary[];
+    suggestedWorkspace?: string;
 }>;
 export interface CreateWorkspaceResult {
     name: string;

package/dist/commands/admin-enrollment.js

@@ -11,7 +11,7 @@ non-secret page URL plus a code you share separately). The legacy
 
 Options:
   --admin-token <token>  Or ADMIN_TOKEN (UPLOADS_ADMIN_TOKEN is a legacy alias)
-  --workspace <name>     Default: default
+  --workspace <name>     Required — the workspace the invite grants access to
   --label <label>
   --expires-in <seconds> Default: server policy
   --token-expires-in <seconds>  Upload token lifetime (default: server policy)
@@ -79,7 +79,15 @@ export async function runAdmin(args, opts, help = false) {
         throw new UsageError("ADMIN_TOKEN is required for admin enrollment creation");
     const apiUrl = flagString(parsed.flags, "--api-url") ?? opts.apiUrl ?? "https://api.uploads.sh";
     const webUrl = flagString(parsed.flags, "--web-url");
-    const workspace = flagString(parsed.flags, "--workspace") ?? "default";
+    // No default. An invite grants files:read/files:write on the workspace it
+    // names, so omitting the flag used to silently target the shared `default`
+    // workspace — and enrollment redemption mints a token without an org
+    // membership, so the recipient would not appear in any member list while
+    // still reading and writing its files.
+    const workspace = flagString(parsed.flags, "--workspace");
+    if (!workspace) {
+        throw new UsageError("--workspace is required (the workspace the invite grants access to)");
+    }
     const label = flagString(parsed.flags, "--label");
     const email = flagString(parsed.flags, "--email");
     const result = await createEnrollment(apiUrl, adminToken, {

package/dist/commands/config.js

@@ -149,9 +149,13 @@ Examples:
         keys.UPLOADS_WORKSPACE = workspace;
     if (token)
         keys.UPLOADS_TOKEN = token;
+    // Seed only the API URL. A `UPLOADS_WORKSPACE` written here outranks the
+    // workspace encoded in the token itself (see `resolveConfig`'s precedence),
+    // so seeding one would pin every later `uploads login` to whatever this
+    // wrote — historically `default` — no matter which workspace the user's
+    // token was actually minted for.
     if (Object.keys(keys).length === 0) {
         keys.UPLOADS_API_URL = DEFAULT_API_URL;
-        keys.UPLOADS_WORKSPACE = DEFAULT_WORKSPACE;
     }
     try {
         const result = writeConfigKeys(path, keys, { force });

package/dist/commands/install.d.ts

@@ -4,7 +4,7 @@ export declare const DEFAULT_MCP_URL = "https://agents.uploads.sh/mcp";
 export interface StepResult {
     command: string[];
     ok: boolean;
-    skipped?: "dry-run" | "sign-in";
+    skipped?: "dry-run" | "sign-in" | "already-configured";
     error?: string;
     output?: string;
 }

package/dist/commands/install.js

@@ -17,6 +17,10 @@ infers your workspace from the bearer token, so only the token is needed.
 Claude Code and Codex ship the same reminder via their plugins (same command:
 \`${HOOK_COMMAND}\`) — install those plugins instead of relying on this step.
 
+Safe to re-run. An MCP server already registered under this name is reported
+as \`already configured\` and left as-is — including the token it was created
+with. To point it at a new token: \`claude mcp remove <name>\` first.
+
 Usage:
   uploads install [skill|mcp|hooks|all]     (default: all)
 
@@ -73,6 +77,16 @@ function skillCommand(skill) {
     // -g global, -y non-interactive, -a '*' every agent (skips the multi-select TUI)
     return ["npx", "-y", "skills", "add", SKILL_SOURCE, "--skill", skill, "-g", "-y", "-a", "*"];
 }
+/**
+ * `claude mcp add` refuses to overwrite an existing entry and exits non-zero
+ * ("MCP server uploads already exists in local config"). That is the steady
+ * state for anyone re-running `uploads install`, not a failure — recognize it
+ * so the run stays green and the footer tells them how to re-add if they want
+ * a fresh token in the header.
+ */
+function alreadyConfigured(result) {
+    return !result.ok && /already exists/i.test(result.error ?? "");
+}
 function mcpCommand(name, url, bearer) {
     return [
         "claude",
@@ -101,7 +115,7 @@ function peekToken(globals) {
         return undefined;
     }
 }
-function printHumanSteps(results, redact, verbose) {
+function printHumanSteps(results, redact, verbose, mcpName) {
     for (const [step, r] of Object.entries(results)) {
         const cmd = redact(r.command.join(" "));
         if (r.skipped === "dry-run") {
@@ -110,6 +124,10 @@ function printHumanSteps(results, redact, verbose) {
         else if (r.skipped === "sign-in") {
             process.stdout.write(`${step}: skipped — ${redact(r.error ?? "needs sign-in")}\n`);
         }
+        else if (r.skipped === "already-configured") {
+            process.stdout.write(`${step}: already configured — "${mcpName}" is registered in Claude Code (nothing to do)\n` +
+                `  To re-register (e.g. with a new token): claude mcp remove ${mcpName} && uploads install mcp\n`);
+        }
         else if (r.ok) {
             process.stdout.write(`${step}: ok\n`);
             if (verbose && r.output) {
@@ -189,7 +207,12 @@ export async function runInstall(args, opts, help = false) {
             const command = mcpCommand(name, url, token || "<token>");
             if (human)
                 process.stdout.write("Installing MCP server…\n");
-            results.mcp = dryRun ? { command, ok: true, skipped: "dry-run" } : runStep(run, command);
+            const step = dryRun
+                ? { command, ok: true, skipped: "dry-run" }
+                : runStep(run, command);
+            results.mcp = alreadyConfigured(step)
+                ? { command, ok: true, skipped: "already-configured", output: step.error }
+                : step;
         }
     }
     if (target === "hooks" || target === "all") {
@@ -223,7 +246,7 @@ export async function runInstall(args, opts, help = false) {
         process.stdout.write(JSON.stringify({ ok: !failed, steps }, null, 2) + "\n");
         return failed ? 1 : 0;
     }
-    printHumanSteps(results, redact, verbose);
+    printHumanSteps(results, redact, verbose, name);
     // Path-level detail for hooks (printHumanSteps only shows the synthetic step).
     if ((target === "hooks" || target === "all") &&
         (dryRun || (human && (verbose || hookWrites.some((w) => w.action !== "skipped"))))) {

package/dist/commands/login.d.ts

@@ -30,8 +30,13 @@ export interface DeviceLoginIo {
     write: (text: string) => void;
     /** Whether the CLI can prompt the user (a real TTY, not a script/CI pipe). */
     isTTY: boolean;
-    /** Prompt for a new workspace name when the account has zero. */
-    promptWorkspaceName: () => Promise<string>;
+    /**
+     * Prompt for a new workspace name when the account has zero. `suggestion`
+     * is a server-derived default (the user's GitHub login, when it makes a
+     * valid and available slug) offered as a bracketed default that Enter
+     * accepts; it is always overridable and never auto-submitted.
+     */
+    promptWorkspaceName: (suggestion?: string) => Promise<string>;
 }
 export declare const defaultDeviceIo: DeviceLoginIo;
 /** A completed device authorization: the session bearer plus the (possibly rewritten) scope. */

package/dist/commands/login.js

@@ -185,10 +185,14 @@ function openUrl(url) {
         // ignore — the URL is printed for manual navigation.
     }
 }
-async function promptWorkspaceName() {
+async function promptWorkspaceName(suggestion) {
     const rl = createInterface({ input: stdin, output: process.stderr });
+    const hint = suggestion ? ` [${suggestion}]` : "";
     try {
-        return (await rl.question("no workspaces yet — enter a name to create one (lowercase, hyphens): ")).trim();
+        const answer = (await rl.question(`no workspaces yet — enter a name to create one (lowercase, hyphens)${hint}: `)).trim();
+        // Empty input accepts the offered default; with no suggestion it stays
+        // empty and the caller's "cancelled" guard fires as before.
+        return answer || (suggestion ?? "");
     }
     finally {
         rl.close();
@@ -347,14 +351,14 @@ async function resolveMintWorkspace(apiUrl, accessToken, requested, io, create =
         io.write(`created workspace "${created.name}" — files will get public URLs under ${created.publicBaseUrl}/\n`);
         return created.name;
     }
-    const { workspaces } = await listMintWorkspaces(apiUrl, accessToken);
+    const { workspaces, suggestedWorkspace } = await listMintWorkspaces(apiUrl, accessToken);
     if (workspaces.length === 1)
         return workspaces[0].workspace;
     if (workspaces.length === 0) {
         if (!io.isTTY) {
             throw new UsageError("your account has no workspace access yet — pass `--workspace <name> --create` to provision one, run `uploads login` interactively, or ask an administrator for an invitation");
         }
-        const name = (await io.promptWorkspaceName()).trim();
+        const name = (await io.promptWorkspaceName(suggestedWorkspace)).trim();
         if (!name)
             throw new UsageError("workspace creation cancelled");
         const created = await createWorkspaceRequest(apiUrl, accessToken, name);

package/dist/commands/update.js

@@ -9,9 +9,10 @@ import { runInstall, runStep } from "./install.js";
 const UPDATE_HELP = `uploads update — update the CLI and refresh agent integrations
 
 Upgrades the globally installed npm package, then re-runs \`uploads install\` so
-the agent skills and the MCP registration match the new version. Skills and the
-MCP registration drift on their own, so this refreshes them even when the CLI is
-already current.
+the agent skills match the new version. Skills drift on their own, so this
+refreshes them even when the CLI is already current. An MCP server already
+registered is left as-is (\`already configured\`) — \`claude mcp add\` never
+overwrites an existing entry.
 
 Usage:
   uploads update [options]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
   "sideEffects": false,