guideline-manage 0.16.0 → 0.17.0

package/cli/src/catalog.js

@@ -7,6 +7,7 @@ import { readCategories } from './categories.js';
 import { asTree, readText } from './tree.js';
 import { t } from './i18n.js';
 import { marker } from './markers.js';
+import { stackNameProblem } from './stack-name.js';
 
 // export 함수의 src 는 문서 저장소 루트의 디스크 경로나 트리(tree.js)다. 서버는 DB 트리를 넘긴다.
 
@@ -265,6 +266,7 @@ export function fileCategories(categories, rel) {
 export function warnings(src) {
   const tree = asTree(src);
   const rules = stacks(tree).flatMap(s => [
+    ...(stackNameProblem(s) ? [{ path: `rules/${s}/`, message: stackNameProblem(s) }] : []),
     ...stackTiers(s, tree).filter(f => f.warning).map(f => ({ path: f.path, message: f.warning })),
     ...stackOverrides(s, tree).warnings,
   ]);

package/cli/src/cli.js

@@ -20,7 +20,7 @@ const ALLOWED_OPTIONS = {
   status: ['project', 'server', 'source', 'json'],
   login: ['server', 'token-stdin'],
   logout: ['server'],
-  propose: ['project', 'server', 'source', 'title', 'message', 'only', 'from', 'dry-run', 'json'],
+  propose: ['project', 'server', 'source', 'title', 'message', 'only', 'from', 'dry-run', 'apply', 'json'],
   source: ['server', 'source'],
   locale: ['json'],
   help: [],
@@ -107,7 +107,7 @@ export async function main(argv) {
     return propose({
       project: values.project, server: values.server, source: values.source, title: values.title, message: values.message,
       only: values.only?.split(',').map(s => s.trim()).filter(Boolean), from: values.from,
-      dryRun: values['dry-run'], json: values.json, cwd,
+      dryRun: values['dry-run'], apply: values.apply, json: values.json, cwd,
     });
   }
 

package/cli/src/commands/login.js

@@ -14,6 +14,36 @@ async function readAll(stream) {
   return s;
 }
 
+/**
+ * 터미널에서 토큰 한 줄을 읽는다. 입력한 글자는 화면에 보이지 않는다.
+ * 파이프가 아닌 터미널은 EOF 가 오지 않아서, readAll 로는 아무 안내 없이 멈춘 것처럼 보인다.
+ * @returns {Promise<string | null>} Ctrl-C 면 null
+ */
+function readHiddenLine(stdin, write) {
+  return new Promise(resolve => {
+    let s = '';
+    const done = value => {
+      stdin.removeListener('data', onData);
+      stdin.setRawMode?.(false);
+      stdin.pause();
+      write('\n');
+      resolve(value);
+    };
+    const onData = chunk => {
+      for (const ch of String(chunk)) {
+        if (ch === '\r' || ch === '\n' || ch === '\u0004') return done(s);
+        if (ch === '\u0003') return done(null);
+        if (ch === '\u007f' || ch === '\b') s = s.slice(0, -1);
+        else s += ch;
+      }
+    };
+    stdin.setRawMode?.(true);
+    stdin.setEncoding?.('utf8');
+    stdin.on('data', onData);
+    stdin.resume();
+  });
+}
+
 /** 127.0.0.1 의 임시 포트에서 /cb 한 번을 기다린다. */
 async function callbackServer() {
   let resolve;
@@ -45,6 +75,7 @@ async function callbackServer() {
 export async function login({
   server, tokenStdin = false, env = process.env, out = console.log, err = console.error, open = openBrowser, fetchImpl = fetch,
   home, stdin = process.stdin, hostname = os.hostname(), timeoutMs = LOGIN_TIMEOUT_MS,
+  prompt = s => process.stderr.write(s),
 }) {
   const url = serverOf({ flag: server, env });
   if (!url) {
@@ -52,7 +83,15 @@ export async function login({
     return 2;
   }
   if (tokenStdin) {
-    const token = (await readAll(stdin)).trim();
+    let token;
+    if (stdin.isTTY) {
+      prompt(t('login.pasteToken'));
+      token = await readHiddenLine(stdin, prompt);
+      if (token === null) return 130;
+    } else {
+      token = await readAll(stdin);
+    }
+    token = token.trim();
     if (!token) {
       err(t('login.noStdinToken'));
       return 2;

package/cli/src/commands/propose.js

@@ -20,7 +20,7 @@ const textOr = buf => (buf === null ? '' : buf.includes(0) ? null : buf.toString
  * 변경 묶음을 보이거나(dry-run) 제안으로 보낸다. propose 와 propose --from 이 같이 쓴다.
  * @returns {Promise<number>}
  */
-export async function sendProposal({ client, server, title, message, project, changes, todos, dryRun, json, out, err, baseTree }) {
+export async function sendProposal({ client, server, title, message, project, changes, todos, dryRun, apply = false, json, out, err, baseTree }) {
   if (changes.length === 0) {
     if (json) out(JSON.stringify({ changes: [], todos }, null, 2));
     else {
@@ -47,18 +47,20 @@ export async function sendProposal({ client, server, title, message, project, ch
   }
   let r;
   try {
-    r = await client.createProposal({ title, description: message ?? '', project, changes: changes.map(toApiChange) });
+    r = await client.createProposal({ title, description: message ?? '', project, changes: changes.map(toApiChange), ...(apply ? { apply: true } : {}) });
   } catch (e) {
     if (e instanceof ServerError && e.status === 403) {
-      err(PROPOSE_DENIED(server));
+      err(apply ? t('propose.applyDenied', { server }) : PROPOSE_DENIED(server));
       return 1;
     }
     err(explain(e, server));
     return 1;
   }
-  if (json) out(JSON.stringify({ id: r.id, url: r.url, changes: listed, todos }, null, 2));
+  if (json) out(JSON.stringify({ id: r.id, url: r.url, status: r.status, revision: r.revision ?? null, changes: listed, todos }, null, 2));
   else {
-    out(t('propose.sent', { id: r.id, url: r.url }));
+    if (r.status !== 'accepted') out(t('propose.sent', { id: r.id, url: r.url }));
+    else if (r.revision) out(t('propose.applied', { rev: r.revision, url: r.url }));
+    else out(t('propose.appliedNothing'));
     for (const c of changes) out(`  ${KIND(c)}  ${c.path}`);
     printTodos(todos, out);
   }
@@ -70,7 +72,7 @@ export async function sendProposal({ client, server, title, message, project, ch
  * @returns {Promise<number>}
  */
 export async function propose({
-  project, server, source, from, title, message, only, dryRun = false, json = false,
+  project, server, source, from, title, message, only, dryRun = false, apply = false, json = false,
   env = process.env, out = console.log, err = console.error, fetchImpl = fetch, home, cwd = process.cwd(),
 }) {
   if (from !== undefined) {
@@ -101,7 +103,7 @@ export async function propose({
       return 1;
     }
     return sendProposal({
-      client, server: url, title, message, project: null, changes: folderChanges({ base, folder }), todos: [], dryRun, json, out, err, baseTree: base,
+      client, server: url, title, message, project: null, changes: folderChanges({ base, folder }), todos: [], dryRun, apply, json, out, err, baseTree: base,
     });
   }
   const dir = project !== undefined ? expandPath(project) : cwd;
@@ -139,7 +141,7 @@ export async function propose({
     const prefix = many ? line => out(`${name}: ${line}`) : out;
     const c = await sendProposal({
       client, server: url, title: title ?? t('propose.defaultTitle', { project: projectName }), message, project: projectName,
-      changes: list, todos: many ? [] : shown, dryRun, json, out: prefix, err, baseTree: base,
+      changes: list, todos: many ? [] : shown, dryRun, apply, json, out: prefix, err, baseTree: base,
     });
     if (c !== 0) code = c;
   }

package/cli/src/stack-name.js

@@ -0,0 +1,21 @@
+import { t } from './i18n.js';
+
+// 도메인 스택: `<도구>__<도메인>`. 같은 도구라도 돌아가는 서버(회사·인스턴스)가 다르면 규칙이 달라 스택을 나눈다.
+const SEP = '__';
+const DOMAIN = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/;
+
+/**
+ * @param {string} name 스택 이름
+ * @returns {{ tool: string, domain: string | null }}
+ */
+export function splitStackName(name) {
+  const i = name.indexOf(SEP);
+  return i === -1 ? { tool: name, domain: null } : { tool: name.slice(0, i), domain: name.slice(i + SEP.length) };
+}
+
+/** `__` 가 있는데 도메인 모양이 아니면 경고 문구. 없거나 맞으면 null. */
+export function stackNameProblem(name) {
+  const { domain } = splitStackName(name);
+  if (domain === null || DOMAIN.test(domain)) return null;
+  return t('catalog.badDomain');
+}

package/locales/en/messages.json

@@ -49,7 +49,7 @@
   "diff.proposal": "proposal",
   "diff.source": "source",
   "diff.tooBig": "omitted (too large)",
-  "help.usage": "Usage: guideline <command> [options]\n\nIn a project (guideline server)\n  common --source <name>   a source (sources in guideline.json). For pick, an unknown name together with --server adds a new source\n  pick     choose guidelines to export in a web form; submitting applies them to this project\n             --project <path>    target project (default: current directory)\n             --new <name|path>   create a new project (a bare name goes under GUIDELINE_PROJECTS_DIR)\n             --server <URL>      guideline server (default: guideline.json → GUIDELINE_SERVER)\n             --no-browser        print the address instead of opening a browser\n             --json              print the result (written files, to-dos) as JSON\n  update   re-apply the chosen items from the latest server revision\n             --project <path>  --server <URL>\n             --force             also overwrite files changed in the project\n             --json              print the result as JSON\n  status   show whether the applied guidelines are current and what the project changed\n             --project <path>  --server <URL>  --json\n  login    log in to a guideline server and store a read token\n             --server <URL>\n             --token-stdin       store a token from standard input instead of using a browser\n  logout   delete the stored token and revoke it on the server\n             --server <URL>\n  propose  turn edited copies back into source form and propose them to the server (they become source when an admin accepts)\n             --project <path>  --server <URL>\n             --title <title>     proposal title (default: guidelines edited in <directory>)\n             --message <text>    proposal description\n             --only <item,…>     only these items (e.g. rules/base/01-git.md,skills/s)\n             --from <folder>     compare a folder from guideline source against the revision it came from (--title required)\n             --dry-run           show the changes and diffs without sending\n             --json              print the result as JSON\n  source   unpack the latest server source into an empty folder; edit it in source layout, then propose --from\n             guideline source <folder>  --server <URL>\n  list     list the source and its checks. With a folder, read that folder (a source from guideline source); otherwise the server\n             guideline list [folder]  --server <URL>  --json\n  locale   language packs: check <folder> compares a pack with English; list shows available languages. The language is GUIDELINE_LANG\n             guideline locale check <folder>  guideline locale list  --json\n  help     this help\n",
+  "help.usage": "Usage: guideline <command> [options]\n\nIn a project (guideline server)\n  common --source <name>   a source (sources in guideline.json). For pick, an unknown name together with --server adds a new source\n  pick     choose guidelines to export in a web form; submitting applies them to this project\n             --project <path>    target project (default: current directory)\n             --new <name|path>   create a new project (a bare name goes under GUIDELINE_PROJECTS_DIR)\n             --server <URL>      guideline server (default: guideline.json → GUIDELINE_SERVER)\n             --no-browser        print the address instead of opening a browser\n             --json              print the result (written files, to-dos) as JSON\n  update   re-apply the chosen items from the latest server revision\n             --project <path>  --server <URL>\n             --force             also overwrite files changed in the project\n             --json              print the result as JSON\n  status   show whether the applied guidelines are current and what the project changed\n             --project <path>  --server <URL>  --json\n  login    log in to a guideline server and store a read token\n             --server <URL>\n             --token-stdin       store a token from standard input instead of using a browser\n  logout   delete the stored token and revoke it on the server\n             --server <URL>\n  propose  turn edited copies back into source form and propose them to the server (they become source when an admin accepts)\n             --project <path>  --server <URL>\n             --title <title>     proposal title (default: guidelines edited in <directory>)\n             --message <text>    proposal description\n             --only <item,…>     only these items (e.g. rules/base/01-git.md,skills/s)\n             --from <folder>     compare a folder from guideline source against the revision it came from (--title required)\n             --dry-run           show the changes and diffs without sending\n             --apply             with an admin token, apply directly instead of proposing\n             --json              print the result as JSON\n  source   unpack the latest server source into an empty folder; edit it in source layout, then propose --from\n             guideline source <folder>  --server <URL>\n  list     list the source and its checks. With a folder, read that folder (a source from guideline source); otherwise the server\n             guideline list [folder]  --server <URL>  --json\n  locale   language packs: check <folder> compares a pack with English; list shows available languages. The language is GUIDELINE_LANG\n             guideline locale check <folder>  guideline locale list  --json\n  help     this help\n",
   "http.badJson": "The body is not JSON",
   "http.badUrl": "The address is badly encoded",
   "http.needJson": "Content-Type must be application/json",
@@ -91,6 +91,7 @@
   "login.callbackPage": "Login received. You can close this tab.",
   "login.done": "Logged in: {url} ({name})",
   "login.loggedOut": "Logged out: {url}",
+  "login.pasteToken": "Paste the token and press Enter (it is not shown): ",
   "login.noStdinToken": "No token on standard input",
   "login.notLoggedIn": "Not logged in",
   "login.openUrl": "Log in: {url}",
@@ -274,7 +275,7 @@
   "todo.skippedAdopted": "{what}: already differed from the source before it was received (it may be an old version) — use --force to match the source, or guideline propose --only {id} if the project edited it",
   "todo.unsynced": "{item}: could not be applied because an existing copy differs — check the diff in guideline pick and turn on update",
   "tokens.badName": "Names are 1–64 characters of letters, digits and . _ -",
-  "tokens.badScope": "The scope is read or propose",
+  "tokens.badScope": "The scope must be read, propose or admin",
   "tokens.nameTaken": "Name already exists: {name}",
   "toml.badValue": "value cannot be written as TOML: {value}",
   "toml.duplicate": "[{table}] appears more than once",
@@ -286,7 +287,6 @@
   "update.unknownSource": "Source {name} is not in guideline.json — sources: {names}",
   "web.adminToken": "Admin token",
   "web.all": "All",
-  "web.allFiles": "All files",
   "web.backHistory": "Back to history",
   "web.backHome": "Back to the list",
   "web.badOrigin": "This request came from another address. Open {origin} and try again",
@@ -294,7 +294,6 @@
   "web.badToken": "The token is wrong",
   "web.binary": "Binary file · {n} bytes. To replace it, upload a file with the same name on the directory page.",
   "web.binaryChange": "binary · {from} → {to}",
-  "web.brand": "Guideline server",
   "web.bytes": "{n} bytes",
   "web.cancel": "Cancel",
   "web.categories": "Categories",
@@ -364,7 +363,6 @@
   "web.confirmDeleteDir": "Delete every file under {path}",
   "web.count": "{n}",
   "web.delete": "Delete",
-  "web.directory": "Directory",
   "web.download": "Download",
   "web.edit": "Edit",
   "web.edit.conflict": "Someone saved while you had this open. Below is the difference between the current content (-) and yours (+). Check it and save again.",
@@ -375,17 +373,15 @@
   "web.edit.textOnly": "Only text files can be edited. Upload binaries on the directory page",
   "web.edit.title": "Edit: {path}",
   "web.edit.warnings": "Saving leaves these warnings in the list (saving still works).",
-  "web.editReadme": "Edit README",
   "web.empty": "No guidelines yet. Create one with \"New file\", or upload many at once with an admin token through the proposals API (POST /api/v1/proposals, apply: true).",
-  "web.fileCount": "{n} instruction files",
   "web.files": "Files",
-  "web.find.agents": "Find subagents",
-  "web.find.mcp": "Find MCP servers",
-  "web.find.skills": "Find skills and files",
-  "web.find.stacks": "Find stacks and files",
+  "web.find.agents": "Find a subagent",
+  "web.find.mcp": "Find an MCP server",
+  "web.find.skills": "Find a skill",
+  "web.find.stacks": "Find a stack",
   "web.firstTime.after": "",
   "web.firstTime.before": "New here? Read the",
-  "web.firstTime.link": "usage guide (llms.txt)",
+  "web.firstTime.link": "usage guide",
   "web.form.agents": "Agents",
   "web.form.badLink": "The form link is wrong or the form is gone",
   "web.form.byCategory": "Pick by category",
@@ -409,10 +405,9 @@
   "web.login": "Log in",
   "web.loginNeeded": "Login required",
   "web.logout": "Log out",
-  "web.manage": "Rename · Delete",
+  "web.manage": "Rename · delete this file",
   "web.message": "Message",
   "web.methodNotAllowed": "Method not allowed",
-  "web.nav.export": "Export",
   "web.nav.history": "History",
   "web.nav.kinds": "Kinds",
   "web.nav.proposals": "Proposals",
@@ -421,11 +416,9 @@
   "web.newFile": "New file",
   "web.newPath": "New path",
   "web.noDiff": "No differences",
-  "web.noDir": "No such directory",
   "web.noHistory": "This path has no history",
   "web.noPath": "No such path",
   "web.noPathGiven": "No path given",
-  "web.noReadme": "There is no README.md.",
   "web.noStack": "No such stack",
   "web.noStacksInCategory": "No stacks in this category.",
   "web.none": "none",
@@ -515,7 +508,7 @@
   "web.tokens.confirmRevoke": "Revoke the token {name}",
   "web.tokens.copyNow": "You cannot see this value again. Copy it now into the agent's environment.",
   "web.tokens.created": "Created",
-  "web.tokens.intro": "Tokens that agents use for the API. read can read; propose can read and propose.",
+  "web.tokens.intro": "Tokens agents use for the API. read can read, propose can also propose, and admin can also accept proposals and apply changes directly.",
   "web.tokens.issueHeading": "Issue",
   "web.tokens.issued": "Token issued",
   "web.tokens.lastUsed": "Last used",
@@ -526,7 +519,6 @@
   "web.tokens.revokedOn": "revoked {day}",
   "web.tokens.scope": "Scope",
   "web.tokens.status": "Status",
-  "web.up": "Up",
   "web.upload.button": "Upload",
   "web.upload.conflict": "A file with the same name changed in the meantime. Reload and upload again",
   "web.upload.file": "File",
@@ -536,5 +528,41 @@
   "web.warnings": "warnings {n}",
   "web.warningsHeading": "Warnings",
   "workspace.unknownSource": "Source {name} is not in guideline.json in {dir}",
-  "web.source.seed": "Seed"
+  "web.source.seed": "Seed",
+  "web.tokens.delete": "Delete",
+  "web.tokens.confirmDelete": "Delete the token {name}?",
+  "web.tokens.adminWarning": "An admin token can change the source directly, without proposal review. Issue it only to agents you trust.",
+  "propose.applied": "Applied: r{rev} — {url}",
+  "propose.appliedNothing": "Nothing changed — same as the source",
+  "propose.applyDenied": "An admin token is needed — get a token with scope admin from an admin and store it with guideline login --server {server} --token-stdin",
+  "catalog.badDomain": "the part after __ is not a domain — use <tool>__<domain>",
+  "web.nav.settings": "Settings",
+  "web.archive": "Download (.tar.gz)",
+  "web.noBlock": "No such block",
+  "web.add.stack": "+ Add stack",
+  "web.add.skill": "+ Add skill",
+  "web.add.agent": "+ Add subagent",
+  "web.add.mcp": "+ Add MCP server",
+  "web.add.kind.stack": "Stack",
+  "web.add.kind.skill": "Skill",
+  "web.add.kind.agent": "Subagent",
+  "web.add.kind.mcp": "MCP server",
+  "web.add.title": "Add {kind}",
+  "web.add.name": "Name",
+  "web.add.domain": "Domain (optional)",
+  "web.add.categories": "Categories (comma-separated)",
+  "web.add.submit": "Add",
+  "web.add.badName": "The name starts with a lowercase letter and uses only lowercase letters, digits and -",
+  "web.add.badDomain": "Not a domain",
+  "web.add.exists": "That name already exists",
+  "web.add.message": "Add: {name}",
+  "web.settings.title": "Settings",
+  "web.settings.files": "Files outside blocks",
+  "web.settings.intro": "Files that belong to no block, items left out of the lists, and warnings.",
+  "web.settings.problems": "Warnings {warnings} · ignored {ignored} — see Settings",
+  "web.usage.title": "Usage",
+  "web.usage.copy": "Copy link",
+  "web.usage.raw": "Raw",
+  "web.client.copied": "Copied",
+  "web.manageBlock": "Rename · delete this block"
 }

package/locales/en/templates/authoring.md

@@ -128,6 +128,13 @@ Setup that must be done when adopting a stack or on every clone (config files, h
 
 Do not invent a Why. If you do not know the reason, hold off on adding the rule.
 
+## Domain stacks
+
+The same tool can need different rules on different servers (companies, instances). Then name the stack `<tool>__<domain>`. Examples: `deploy-package__gitlab.develma.com`, `deploy-agent__deploy.kbrainc.dev`.
+
+- Use `__` once. The part after it must look like a domain (lowercase letters, digits, `-`, and at least one dot). Otherwise `guideline list` shows a warning (the stack still works).
+- The web shows the tool name with the domain as a tag. Project paths (`.ruler/<stack>/`) and CLI output keep the full name.
+
 ## Skeleton stacks
 
 A `rules/<stack>/` with only `README.md` is a skeleton and does not appear in `guideline list`. It becomes a stack the moment its first guideline file (`NN-*.md`) is added.

package/locales/en/templates/llms.txt

@@ -40,6 +40,7 @@ guideline update --force       # also overwrite files edited in the project
 
 - `pick` sends only the result of comparing the project with the source to the server and prints the form address (`Form: <address>` on stderr). It waits until items are checked in the form and submitted. MCP values (secrets) are not sent.
 - Form states: "same" is already applied, "different" means the project copy differs from the source (turn on "update" to overwrite it), "missing" is not there yet (check it to add). Unchecking an existing item means "remove". Category buttons check every item in that category.
+- A domain stack `<tool>__<domain>` (e.g. `deploy-package__gitlab.develma.com`) holds the rules for using that tool on that server. Pick only stacks whose domain matches the server the project uses.
 - Where copies go: always-on guidelines in `.ruler/<stack>/NN-*.md`, reference guidelines in `docs/guideline/<stack>/` with the index `.ruler/<stack>/99-reference.md`, skills in `.ruler/skills/`, MCP in `.ruler/ruler.toml`. After applying, `ruler apply` runs at the git root (when ruler is installed).
 - Applying creates `guideline.json` (chosen items) and `guideline-lock.json` (applied revision and hashes). Commit them with the applied files. The CLI does not commit.
 - **Monorepos**: run in a subdirectory with its own `.ruler/` and that directory becomes a separate unit, with its own manifest, lock and copies. Skills, subagents and MCP servers are received only at the git root. ruler builds that directory's guidelines only when `.ruler/ruler.toml` at the git root has `nested = true`.
@@ -122,8 +123,9 @@ guideline propose --from <that folder> --title "<title>"   # send what was added
 - `GET {{SERVER}}/api/v1/catalog`: stacks, skills, subagents, MCP servers and their categories
 - `GET {{SERVER}}/api/v1/archive?rev=<revision>`: the whole source (tar.gz)
 - `GET {{SERVER}}/api/v1/files/<path>?rev=<revision>`: one source file
-- `POST {{SERVER}}/api/v1/proposals`: a proposal (`propose` scope token). Body `{ title, description?, project?, changes: [{ path, text | base64 | delete: true, base: <sha256> | null }] }`. An admin token can use `apply: true` to apply it right away without review
-- `GET {{SERVER}}/api/v1/proposals`, `GET {{SERVER}}/api/v1/proposals/<number>`: the status of your proposals
+- `POST {{SERVER}}/api/v1/proposals`: a proposal (`propose` scope token). Body `{ title, description?, project?, changes: [{ path, text | base64 | delete: true, base: <sha256> | null }] }`. An admin token or an `admin` scope token can use `apply: true` to apply it right away without review. From the CLI: `guideline propose --apply`
+- `GET {{SERVER}}/api/v1/proposals`, `GET {{SERVER}}/api/v1/proposals/<number>`: the status of your proposals (an `admin` scope token sees all)
+- `POST {{SERVER}}/api/v1/proposals/<number>/accept`, `POST {{SERVER}}/api/v1/proposals/<number>/reject` (body `{ note? }`): accept or reject a proposal (admin token or `admin` scope token). A conflict is 409 with `conflicts`
 
 ## More
 

package/locales/en/templates/new-file/server.json

@@ -0,0 +1,5 @@
+{
+  "type": "stdio",
+  "command": "npx",
+  "args": ["-y", "<package>"]
+}

package/locales/en/templates/skills/guideline-export/SKILL.md

@@ -13,6 +13,7 @@ description: Proposes sections of this project's guidelines that other projects
 
 1. **Get the source.** Pick an empty temporary folder (for example `src` under `mktemp -d`) and run `guideline source <folder>`. If this project's `guideline.json` has more than one source, ask the user which source (guideline server) to upload to and run `guideline source <folder> --source <name>`. Below, this is the "source folder". If you see "Login required", point the user to `! guideline login --server <URL>` and stop.
 2. **Permission to propose.** If uploading says "This token cannot propose", tell the user to get a token with the `propose` scope from an admin and store it with `guideline login --server <URL> --token-stdin`, then stop.
+   - Only when the stored token has the `admin` scope and the user asked to apply without review, upload with `guideline propose --from <source folder> --title <title> --apply`. If it says "An admin token is needed", upload as a proposal without `--apply`.
 3. If `<source folder>/docs/authoring.md` has no `## Subagents` or `## MCP servers` section, stop before uploading subagents or MCP servers and ask the guideline admin to add that section to the source. When uploading an MCP server built from its README, also read the `### Servers built when applied` section.
 4. If `<source folder>/docs/authoring.md` has no `## Load — always and reference` section, stop the same way before uploading guideline files. The rule for choosing the load is in that section. When uploading an override of another stack, also read the `## Overriding another stack` section.
 5. **Edits to received copies are not this skill's job.** Copies that `guideline status` shows as "edited in project" are sent with `guideline propose` (it turns the copy back into source form). This skill uploads guidelines that are new to the source. `propose` leaves out copies that already differed from the source when first received (to-do `adopted`), because proposing an old version would undo source changes.