hngr 0.2.0 → 0.4.0

package/dist/{commands-BchmocR_.mjs → commands-CLqLwQHY.mjs}

@@ -1,4 +1,4 @@
-import { t as commandCatalog } from "./catalog-jU0-wzh3.mjs";
+import { t as commandCatalog } from "./catalog-Bv304SXJ.mjs";
 // src/commands/commands.ts
 function run(ctx) {
 	const catalog = commandCatalog();

package/dist/{http-2HWxLIOq.mjs → http-DgHX7Fux.mjs}

@@ -86,18 +86,16 @@ async function writeFileAtomically(path, content, options = {}) {
 }
 /**
 * Writes a directory through "temp → rename": the destination is either
-* absent or complete, never half-written. With `force`, the old directory is
-* moved aside before the rename so a failed swap puts it back.
+* absent or complete, never half-written. An existing directory is moved
+* aside before the rename so a failed swap puts it back.
 */
-async function writeDirectoryAtomically(dest, writeTemp, options) {
+async function writeDirectoryAtomically(dest, writeTemp, options = {}) {
 	const parent = dirname(dest);
 	await mkdir(parent, { recursive: true });
 	const temp = resolve(parent, `.hngr-${basename(dest)}-${randomUUID()}.tmp`);
 	try {
 		await writeTemp(temp);
-		const exists = await lstat(dest).then(() => true, () => false);
-		if (exists && !options.force) throw options.existsError();
-		if (!exists) {
+		if (!await lstat(dest).then(() => true, () => false)) {
 			await rename(temp, dest);
 			return;
 		}
@@ -127,6 +125,14 @@ async function writeDirectoryAtomically(dest, writeTemp, options) {
 	}
 }
 // src/config.ts
+/**
+* The stored token's audience. Config files written before audiences existed
+* hold a management token by definition, so a missing field reads as
+* `management` instead of failing to load.
+*/
+function storedAudience(config) {
+	return config?.audience === "mcp" ? "mcp" : "management";
+}
 /** `$XDG_CONFIG_HOME/hngr/config.json`, falling back to `~/.config/hngr/config.json`. */
 function configFilePath(env) {
 	const xdg = env.XDG_CONFIG_HOME;
@@ -456,4 +462,4 @@ async function apiFetch(connection, options) {
 		signal: options.signal
 	});
 }
-export { renderError as C, HngrError as S, scrubCredentials as _, toHngrError as a, writeFileAtomically as b, redactUrlForDisplay as c, configFilePath as d, deleteStoredConfig as f, resolveConnection as g, redactUrl as h, buildRequestUrl as i, apiErrorFromResponse as l, readStoredConfig as m, apiGet as n, redactQuery as o, normalizeServerUrl as p, apiRequest as r, redactSensitive as s, apiFetch as t, DEFAULT_SERVER_URL as u, writeStoredConfig as v, CancelledError as x, writeDirectoryAtomically as y };
+export { HngrError as C, CancelledError as S, scrubCredentials as _, toHngrError as a, writeDirectoryAtomically as b, redactUrlForDisplay as c, configFilePath as d, deleteStoredConfig as f, resolveConnection as g, redactUrl as h, buildRequestUrl as i, apiErrorFromResponse as l, readStoredConfig as m, apiGet as n, redactQuery as o, normalizeServerUrl as p, apiRequest as r, redactSensitive as s, apiFetch as t, DEFAULT_SERVER_URL as u, storedAudience as v, renderError as w, writeFileAtomically as x, writeStoredConfig as y };

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-jU0-wzh3.mjs";
-import { C as renderError, S as HngrError, c as redactUrlForDisplay, g as resolveConnection, i as buildRequestUrl, o as redactQuery, r as apiRequest, s as redactSensitive, u as DEFAULT_SERVER_URL, x as CancelledError } from "./http-2HWxLIOq.mjs";
-import { t as collectPages } from "./pagination-BbKLKSw3.mjs";
+import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-Bv304SXJ.mjs";
+import { C as HngrError, S as CancelledError, c as redactUrlForDisplay, g as resolveConnection, i as buildRequestUrl, o as redactQuery, r as apiRequest, s as redactSensitive, u as DEFAULT_SERVER_URL, w as renderError } from "./http-DgHX7Fux.mjs";
+import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
 import { createRequire } from "node:module";
 import { notStrictEqual, strictEqual } from "assert";
 import { basename, dirname, extname, join, normalize, relative, resolve } from "path";
@@ -5279,7 +5279,7 @@ function isYargsInstance(y) {
 // ../../node_modules/.pnpm/yargs@18.2.0/node_modules/yargs/index.mjs
 const Yargs = YargsFactory(esm_default);
 // package.json
-var version = "0.2.0";
+var version = "0.4.0";
 // src/generated/completion.ts
 function isCompletionShell(value) {
 	return value === "bash" || value === "zsh" || value === "fish";
@@ -6499,6 +6499,32 @@ let u$1 = class u extends y {
 		});
 	}
 };
+let n$1 = class n extends y {
+	options;
+	cursor = 0;
+	get _selectedValue() {
+		return this.options[this.cursor];
+	}
+	changeValue() {
+		const e = this._selectedValue;
+		this.value = e === void 0 ? void 0 : e.value;
+	}
+	constructor(e) {
+		super(e, false), this.options = e.options;
+		const o = this.options.findIndex(({ value: s }) => s === e.initialValue), t = o === -1 ? 0 : o;
+		this.cursor = this.options[t]?.disabled ? findCursor(t, 1, this.options) : t, this.changeValue(), this.on("cursor", (s) => {
+			switch (s) {
+				case "left":
+				case "up":
+					this.cursor = findCursor(this.cursor, -1, this.options);
+					break;
+				case "down":
+				case "right": this.cursor = findCursor(this.cursor, 1, this.options);
+			}
+			this.changeValue();
+		});
+	}
+};
 var n = class extends y {
 	get userInputWithCursor() {
 		if (this.state === "submit") return this.userInput;
@@ -6534,6 +6560,8 @@ const S_STEP_ERROR = unicodeOr("▲", "x");
 const S_STEP_SUBMIT = unicodeOr("◇", "o");
 const S_BAR = unicodeOr("│", "|");
 const S_BAR_END = unicodeOr("└", "—");
+const S_RADIO_ACTIVE = unicodeOr("●", ">");
+const S_RADIO_INACTIVE = unicodeOr("○", " ");
 const S_CHECKBOX_ACTIVE = unicodeOr("◻", "[•]");
 const S_CHECKBOX_SELECTED = unicodeOr("◼", "[+]");
 const S_CHECKBOX_INACTIVE = unicodeOr("◻", "[ ]");
@@ -6720,7 +6748,64 @@ ${r ? styleText("cyan", S_BAR_END) : ""}
 		}
 	}
 }).prompt();
-`${styleText("dim", "↑/↓")}`, `${styleText("dim", "Enter:")}`;
+const SELECT_INSTRUCTIONS = [`${styleText("dim", "↑/↓")} to navigate`, `${styleText("dim", "Enter:")} confirm`];
+const c = (t, o) => t.includes(`
+`) ? t.split(`
+`).map((d) => o(d)).join(`
+`) : o(t);
+const select = (t) => {
+	const o = (n, m) => {
+		if (n === void 0) return "";
+		const s = n.label ?? String(n.value);
+		switch (m) {
+			case "disabled": return `${styleText("gray", S_RADIO_INACTIVE)} ${c(s, (i) => styleText("gray", i))}${n.hint ? ` ${styleText("dim", `(${n.hint ?? "disabled"})`)}` : ""}`;
+			case "selected": return `${c(s, (i) => styleText("dim", i))}`;
+			case "active": return `${styleText("green", S_RADIO_ACTIVE)} ${s}${n.hint ? ` ${styleText("dim", `(${n.hint})`)}` : ""}`;
+			case "cancelled": return `${c(s, (i) => styleText(["strikethrough", "dim"], i))}`;
+			default: return `${styleText("dim", S_RADIO_INACTIVE)} ${c(s, (i) => styleText("dim", i))}`;
+		}
+	}, d = t.showInstructions ?? true;
+	return new n$1({
+		options: t.options,
+		signal: t.signal,
+		input: t.input,
+		output: t.output,
+		initialValue: t.initialValue,
+		render() {
+			const n = t.withGuide ?? settings.withGuide, m = `${symbol(this.state)}  `, s = `${symbolBar(this.state)}  `, i = wrapTextWithPrefix(t.output, t.message, s, m), u = `${n ? `${styleText("gray", S_BAR)}
+` : ""}${i}
+`;
+			switch (this.state) {
+				case "submit": {
+					const r = n ? `${styleText("gray", S_BAR)}  ` : "";
+					return `${u}${wrapTextWithPrefix(t.output, o(this.options[this.cursor], "selected"), r)}`;
+				}
+				case "cancel": {
+					const r = n ? `${styleText("gray", S_BAR)}  ` : "";
+					return `${u}${wrapTextWithPrefix(t.output, o(this.options[this.cursor], "cancelled"), r)}${n ? `
+${styleText("gray", S_BAR)}` : ""}`;
+				}
+				default: {
+					const r = n ? `${styleText("cyan", S_BAR)}  ` : "", a = u.split(`
+`).length, p = d ? formatInstructionFooter(SELECT_INSTRUCTIONS, n) : n ? [styleText("cyan", S_BAR_END)] : [], f = p.join(`
+`), b = p.length + 1;
+					return `${u}${r}${limitOptions({
+						output: t.output,
+						cursor: this.cursor,
+						options: this.options,
+						maxItems: t.maxItems,
+						columnPadding: r.length,
+						rowPadding: a + b,
+						style: (g, x) => o(g, g.disabled ? "disabled" : x ? "active" : "inactive")
+					}).join(`
+${r}`)}
+${f}
+`;
+				}
+			}
+		}
+	}).prompt();
+};
 `${styleText("gray", S_BAR)}`;
 const text = (t) => new n({
 	validate: t.validate,
@@ -6804,6 +6889,15 @@ function clackPrompter(streams = {}) {
 				}
 			}));
 		},
+		async select(message, options, initialValue) {
+			return unwrapPrompt(await select({
+				message,
+				input,
+				output,
+				options,
+				initialValue
+			}));
+		},
 		async multiselect(message, options, initialValues = []) {
 			return unwrapPrompt(await multiselect({
 				message,
@@ -6846,7 +6940,7 @@ const GLOBAL_OPTIONS = {
 	force: {
 		type: "boolean",
 		default: false,
-		describe: "Overwrite existing targets; the only way to skip destructive confirmations",
+		describe: "Skip destructive confirmations",
 		global: true
 	},
 	"dry-run": {
@@ -6911,46 +7005,53 @@ function buildParser(onMatched) {
 	parser.command("commands", "Print the command catalog", () => {}, (argv) => {
 		onMatched({
 			argv,
-			run: async (ctx) => (await import("./commands-BchmocR_.mjs")).run(ctx)
+			run: async (ctx) => (await import("./commands-CLqLwQHY.mjs")).run(ctx)
 		});
 	});
 	parser.command("auth", "Manage credentials", (auth) => {
-		auth.command("login", "Log in with username and password and mint an access token", (login) => login.option("token", {
+		auth.command("login", "Log in through the browser device flow, or with --password / --token", (login) => login.option("password", {
+			type: "boolean",
+			describe: "Prompt for a username and password instead of the device flow"
+		}).option("token", {
 			type: "boolean",
-			default: false,
 			describe: "Read an access token from stdin instead of prompting"
-		}), (argv) => {
+		}).conflicts("password", "token"), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./auth-BT8HuCif.mjs")).login(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./auth-ByGgd_Yn.mjs")).login(ctx, matchedArgv)
 			});
 		});
 		auth.command("logout", "Revoke the stored token and delete the local config", () => {}, (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx) => (await import("./auth-BT8HuCif.mjs")).logout(ctx)
+				run: async (ctx) => (await import("./auth-ByGgd_Yn.mjs")).logout(ctx)
 			});
 		});
-		auth.command("status", "Show credential source, server, principal and token prefix", (status) => status.option("offline", {
+		auth.command("status", "Show credential source, server, principal, token prefix and audience", (status) => status.option("offline", {
 			type: "boolean",
 			default: false,
 			describe: "Skip the live GET /me check"
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./auth-BT8HuCif.mjs")).status(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./auth-ByGgd_Yn.mjs")).status(ctx, matchedArgv)
 			});
 		});
-		auth.command("token", "Print the access token to stdout and nothing else", () => {}, (argv) => {
+		auth.command("token", "Print the access token to stdout and nothing else", (token) => token.option("audience", {
+			type: "string",
+			choices: ["management", "mcp"],
+			default: "management",
+			describe: "management prints the stored token; mcp mints a new MCP token that can read and write the catalog content you have access to, without changing the stored credential"
+		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx) => (await import("./auth-BT8HuCif.mjs")).token(ctx)
+				run: async (ctx, matchedArgv) => (await import("./auth-ByGgd_Yn.mjs")).token(ctx, matchedArgv)
 			});
 		});
 		auth.command("whoami", "Print the GET /me payload", () => {}, (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx) => (await import("./auth-BT8HuCif.mjs")).whoami(ctx)
+				run: async (ctx) => (await import("./auth-ByGgd_Yn.mjs")).whoami(ctx)
 			});
 		});
 		registerGeneratedAuth(auth, onMatched);
@@ -6984,7 +7085,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-DwoDzsXd.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-CxMeJ5PF.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		skills.command("publish <paths..>", "Publish a local skill directory as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7002,11 +7103,9 @@ function buildParser(onMatched) {
 		}).option("readme", {
 			type: "string",
 			describe: "Markdown file to attach as the README"
-		}).option("tag", {
+		}).option("category", {
 			type: "string",
-			array: true,
-			nargs: 1,
-			describe: "Capability tag (repeatable, at most eight)"
+			describe: "Category slug in the target namespace (create only; resolved even with --dry-run)"
 		}).option("new", {
 			type: "boolean",
 			default: false,
@@ -7014,7 +7113,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-DwoDzsXd.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-CxMeJ5PF.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return skills.demandCommand(1);
@@ -7036,7 +7135,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-DeWHHgQK.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-DWF_ELDU.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		mcp.command("publish <paths..>", "Publish an MCP snapshot as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7054,11 +7153,9 @@ function buildParser(onMatched) {
 		}).option("readme", {
 			type: "string",
 			describe: "Markdown file to attach as the README"
-		}).option("tag", {
+		}).option("category", {
 			type: "string",
-			array: true,
-			nargs: 1,
-			describe: "Capability tag (repeatable, at most eight)"
+			describe: "Category slug in the target namespace (create only; resolved even with --dry-run)"
 		}).option("new", {
 			type: "boolean",
 			default: false,
@@ -7066,7 +7163,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-DeWHHgQK.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-DWF_ELDU.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return mcp.demandCommand(1);

package/dist/{mcp-DeWHHgQK.mjs → mcp-DWF_ELDU.mjs}

@@ -1,5 +1,5 @@
-import { S as HngrError, b as writeFileAtomically, g as resolveConnection, s as redactSensitive, t as apiFetch } from "./http-2HWxLIOq.mjs";
-import { _ as resolveCapabilityVersion, a as failedResult, c as stringValues, f as downloadContent, g as resolveCapability, h as parseCapabilityPath, i as errorBody, l as AGENTS, n as readPublishFlags, o as positionalPaths, p as MCP_KIND, r as runPublish, s as runBatch, t as explicitName, u as findAgentDefinition } from "./publish-D7zaQl9x.mjs";
+import { C as HngrError, g as resolveConnection, s as redactSensitive, t as apiFetch, x as writeFileAtomically } from "./http-DgHX7Fux.mjs";
+import { _ as resolveCapability, a as errorBody, c as runBatch, d as findAgentDefinition, g as parseCapabilityPath, i as runPublish, l as stringValues, m as MCP_KIND, n as explicitName, o as failedResult, p as downloadContent, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as AGENTS, v as resolveCapabilityVersion } from "./scope-Ch6wZCgE.mjs";
 import { constants } from "node:fs";
 import { access, readFile, stat } from "node:fs/promises";
 import { basename, delimiter, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -98,31 +98,24 @@ async function userServerState(executable, name, env) {
 /**
 * Installs one user-scope server through Claude Code itself.
 * `~/.claude.json` is never edited directly: Claude Code owns that file and may
-* hold live session state. A conflicting user-scope server fails without
-* `force`; with `force` it is removed through the CLI before the new entry is
-* added, so every write still goes through Claude Code.
+* hold live session state. Re-installing replaces an existing user-scope
+* server through the CLI before the new entry is added, so every write still
+* goes through Claude Code.
 */
-async function addJsonWithClaude(env, name, config, force) {
+async function addJsonWithClaude(env, name, config) {
 	const executable = await findExecutable(EXECUTABLE, env);
 	if (!executable) throw new HngrError({
 		type: "config",
 		title: "Claude Code CLI not found",
 		detail: "`claude` must be on PATH to install user-level MCP servers; install Claude Code or use project-level (no --global) installation."
 	});
-	if (await userServerState(executable, name, env) === "present") {
-		if (!force) throw new HngrError({
-			type: "io",
-			title: `MCP server ${JSON.stringify(name)} already exists in Claude Code's user config`,
-			detail: "Pass --force to replace it."
-		});
-		await runChecked(executable, [
-			"mcp",
-			"remove",
-			"--scope",
-			"user",
-			name
-		], env, name);
-	}
+	if (await userServerState(executable, name, env) === "present") await runChecked(executable, [
+		"mcp",
+		"remove",
+		"--scope",
+		"user",
+		name
+	], env, name);
 	await runChecked(executable, [
 		"mcp",
 		"add-json",
@@ -202,8 +195,8 @@ function readTargetDocument(raw, label) {
 }
 /**
 * Merges the incoming servers into the document's `mcpServers`. Existing
-* servers and other top-level keys survive. A name collision fails unless
-* `force`, which replaces only the colliding entries.
+* servers and other top-level keys survive; a name collision is replaced, so
+* re-installing a capability is idempotent.
 */
 function mergeSnapshot(document, incoming, options) {
 	const existing = document.mcpServers;
@@ -211,21 +204,13 @@ function mergeSnapshot(document, incoming, options) {
 		if (existing === null || typeof existing !== "object" || Array.isArray(existing)) throw ioError(`"mcpServers" in ${options.label} is not an object`, "Fix the target file before installing MCP servers.");
 	}
 	const servers = { ...existing ?? {} };
-	const conflicts = [];
 	const added = [];
 	const replaced = [];
-	for (const [name, entry] of Object.entries(incoming)) if (Object.hasOwn(servers, name)) {
-		if (!options.force) {
-			conflicts.push(name);
-			continue;
-		}
+	for (const [name, entry] of Object.entries(incoming)) {
+		if (Object.hasOwn(servers, name)) replaced.push(name);
+		else added.push(name);
 		servers[name] = entry;
-		replaced.push(name);
-	} else {
-		servers[name] = entry;
-		added.push(name);
 	}
-	if (conflicts.length > 0) throw ioError(`MCP ${conflicts.length === 1 ? "server" : "servers"} already configured in ${options.label}: ${conflicts.join(", ")}`, "Pass --force to replace only the conflicting entries.");
 	return {
 		document: {
 			...document,
@@ -381,11 +366,8 @@ async function readExisting(path, label) {
 * redacted. The file is never written by dry-run, so this only affects the
 * preview.
 */
-function previewJsonTarget(plan, existing, servers, force) {
-	const merged = mergeSnapshot(readTargetDocument(existing, plan.path), servers, {
-		force,
-		label: plan.path
-	});
+function previewJsonTarget(plan, existing, servers) {
+	const merged = mergeSnapshot(readTargetDocument(existing, plan.path), servers, { label: plan.path });
 	return serializeTargetDocument(redactSensitive(merged.document));
 }
 /** Reports one target's failure without aborting the remaining targets. */
@@ -393,16 +375,13 @@ function reportTargetFailure(ctx, plan, err) {
 	const body = errorBody(err);
 	ctx.summary(`error: ${plan.agent} ${plan.path}: ${body.title}`);
 }
-async function installJsonTarget(plan, servers, force) {
+async function installJsonTarget(plan, servers) {
 	const filePath = plan.filePath;
 	if (!filePath) throw new HngrError({
 		type: "io",
 		title: `No file path configured for ${plan.agent}`
 	});
-	const merged = mergeSnapshot(readTargetDocument(await readExisting(filePath, plan.path), plan.path), servers, {
-		force,
-		label: plan.path
-	});
+	const merged = mergeSnapshot(readTargetDocument(await readExisting(filePath, plan.path), plan.path), servers, { label: plan.path });
 	await writeFileAtomically(filePath, serializeTargetDocument(merged.document), { label: plan.path });
 }
 async function addOne(ctx, connection, parsed, targets, state) {
@@ -419,7 +398,7 @@ async function addOne(ctx, connection, parsed, targets, state) {
 		let failure = null;
 		for (const plan of targets) try {
 			if (plan.kind === "json") {
-				const preview = previewJsonTarget(plan, plan.filePath ? await readExisting(plan.filePath, plan.path) : void 0, snapshot.servers, ctx.flags.force);
+				const preview = previewJsonTarget(plan, plan.filePath ? await readExisting(plan.filePath, plan.path) : void 0, snapshot.servers);
 				ctx.detail(`dry-run: would write ${plan.path}\n${preview}`);
 			} else for (const [name, entry] of Object.entries(snapshot.servers)) ctx.detail(`dry-run: claude mcp add-json --scope user ${name} ${JSON.stringify(redactSensitive(entry))}`);
 			dryTargets.push({
@@ -449,8 +428,8 @@ async function addOne(ctx, connection, parsed, targets, state) {
 	const installedTargets = [];
 	let failure = null;
 	for (const plan of targets) try {
-		if (plan.kind === "json") await installJsonTarget(plan, snapshot.servers, ctx.flags.force);
-		else for (const [name, entry] of Object.entries(snapshot.servers)) await addJsonWithClaude(ctx.env, name, entry, ctx.flags.force);
+		if (plan.kind === "json") await installJsonTarget(plan, snapshot.servers);
+		else for (const [name, entry] of Object.entries(snapshot.servers)) await addJsonWithClaude(ctx.env, name, entry);
 		installedTargets.push({
 			agent: plan.agent,
 			path: plan.path,
@@ -517,7 +496,7 @@ function mcpPrepared(config, metadata) {
 			visibility: metadata.visibility
 		};
 		if (metadata.readme !== void 0) body.readme = metadata.readme;
-		if (metadata.tags.length > 0) body.tags = metadata.tags;
+		if (metadata.category !== void 0) body.category = metadata.category;
 		body.config = config;
 		return body;
 	};
@@ -536,7 +515,7 @@ function mcpPrepared(config, metadata) {
 			if (metadata.description !== void 0) preview.description = metadata.description;
 			preview.visibility = metadata.visibility;
 			if (metadata.readme !== void 0) preview.readme = metadata.readme;
-			if (metadata.tags.length > 0) preview.tags = metadata.tags;
+			if (metadata.category !== void 0) preview.category = metadata.category;
 			preview.config = `<${serverCount} server${serverCount === 1 ? "" : "s"}>`;
 			return preview;
 		},
@@ -569,7 +548,7 @@ function defaultMcpName(file) {
 async function publish(ctx, argv) {
 	const rawPaths = positionalPaths(argv.paths);
 	if (rawPaths.length === 0) throw usage("No MCP snapshot given", "Pass one or more JSON snapshot files.");
-	const flags = await readPublishFlags(argv, "mcp");
+	const flags = await readPublishFlags(argv);
 	const forcedName = explicitName(argv, rawPaths.length);
 	const items = rawPaths.map((file) => ({
 		name: forcedName ?? defaultMcpName(file),
@@ -587,7 +566,7 @@ async function add(ctx, argv) {
 	const rawPaths = positionalPaths(argv.paths);
 	if (rawPaths.length === 0) throw usage("No capability path given", "Pass one or more `<name>` or `<namespace>/<name>` arguments.");
 	const parsedPaths = rawPaths.map(parseMcpPath);
-	const scope = argv.global === true ? "global" : "project";
+	const scope = await resolveInstallScope(ctx, argv.global === true);
 	const targets = selectMcpTargets(stringValues(argv.agent), argv.all === true, scope, process.cwd(), ctx.env);
 	const connection = await resolveConnection(ctx.flags, ctx.env);
 	let approvalHintShown = false;

package/dist/{pagination-BbKLKSw3.mjs → pagination-BXyFxGYA.mjs}

@@ -1,4 +1,4 @@
-import { S as HngrError } from "./http-2HWxLIOq.mjs";
+import { C as HngrError } from "./http-DgHX7Fux.mjs";
 // src/pagination.ts
 function asCursorPage(body, path) {
 	if (body === null || typeof body !== "object" || !Array.isArray(body.items) || !("next_cursor" in body)) throw new HngrError({

package/dist/{publish-D7zaQl9x.mjs → scope-Ch6wZCgE.mjs}

@@ -1,5 +1,5 @@
-import { S as HngrError, _ as scrubCredentials, a as toHngrError, g as resolveConnection, h as redactUrl, i as buildRequestUrl, l as apiErrorFromResponse, n as apiGet } from "./http-2HWxLIOq.mjs";
-import { t as collectPages } from "./pagination-BbKLKSw3.mjs";
+import { C as HngrError, _ as scrubCredentials, a as toHngrError, g as resolveConnection, h as redactUrl, i as buildRequestUrl, l as apiErrorFromResponse, n as apiGet } from "./http-DgHX7Fux.mjs";
+import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
@@ -368,6 +368,7 @@ async function runBatch(options) {
 	};
 }
 // src/commands/publish.ts
+const CATEGORIES_PATH = "/api/v1/categories";
 const VISIBILITIES = [
 	"public",
 	"internal",
@@ -397,21 +398,15 @@ async function readOptionalFile(path) {
 	}
 }
 /** Reads the shared publish flags; a bad value fails before any request. */
-async function readPublishFlags(argv, kind) {
+async function readPublishFlags(argv) {
 	const visibility = stringFlag(argv, "visibility") ?? "private";
 	if (!VISIBILITIES.includes(visibility)) throw usage(`Invalid --visibility ${JSON.stringify(visibility)}`, `Use one of: ${VISIBILITIES.join(", ")}.`);
-	const tags = stringValues(argv.tag);
-	if (tags.length > 8) throw usage("Too many --tag values", "At most eight tags are allowed.");
-	for (const tag of tags) {
-		if (tag.trim() === "") throw usage("Empty --tag value", "Pass a non-empty tag.");
-		if (kind === "skill" && tag.includes(",")) throw usage(`Invalid --tag ${JSON.stringify(tag)}`, "A Skill tag cannot contain a comma; the multipart form joins tags with commas.");
-	}
 	return {
 		namespace: stringFlag(argv, "namespace") ?? "system",
 		description: stringFlag(argv, "description"),
 		visibility,
 		readme: await readOptionalFile(stringFlag(argv, "readme")),
-		tags,
+		category: stringFlag(argv, "category"),
 		forceNew: argv.new === true
 	};
 }
@@ -424,6 +419,39 @@ function explicitName(argv, targetCount) {
 function asRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
+/** Reads one taxonomy page and narrows the fields resolution needs. */
+async function categoryPage(connection, namespace, query) {
+	const body = await apiGet(connection, CATEGORIES_PATH, {
+		namespace,
+		limit: 200,
+		...query === void 0 ? {} : { q: query }
+	});
+	const items = asRecord(body)?.items;
+	if (!Array.isArray(items)) throw new HngrError({
+		type: "api",
+		title: "The server returned an unexpected response shape",
+		detail: `Expected {items: [...], truncated: ...} from GET ${CATEGORIES_PATH}.`
+	});
+	return {
+		slugs: items.map((item) => asRecord(item)?.slug).filter((value) => typeof value === "string"),
+		truncated: asRecord(body)?.truncated === true
+	};
+}
+/**
+* Resolves a Category slug against the target Namespace's taxonomy. A slug the
+* Namespace does not own is a usage error; any transport or HTTP failure
+* propagates, so the caller never uploads after a failed lookup. A truncated
+* first page is re-queried by slug, and only an exact match counts, so a large
+* taxonomy does not turn a valid Category into an unknown one.
+*/
+async function resolveCategorySlug(connection, namespace, slug) {
+	const first = await categoryPage(connection, namespace);
+	if (first.slugs.includes(slug)) return slug;
+	if (first.truncated) {
+		if ((await categoryPage(connection, namespace, slug)).slugs.includes(slug)) return slug;
+	}
+	throw usage(`Unknown --category ${JSON.stringify(slug)}`, first.slugs.length > 0 ? `Available in ${namespace}: ${first.slugs.join(", ")}.` : `No Categories exist in the ${namespace} namespace.`);
+}
 function printPreview(ctx, kind, namespace, name, preview) {
 	ctx.detail(`dry-run: would publish ${kind} ${namespace}/${name}`);
 	for (const [key, value] of Object.entries(preview)) {
@@ -439,6 +467,7 @@ function printPreview(ctx, kind, namespace, name, preview) {
 async function runPublish(options) {
 	const { ctx } = options;
 	const connection = await resolveConnection(ctx.flags, ctx.env);
+	if (options.category !== void 0) await resolveCategorySlug(connection, options.namespace, options.category);
 	const results = [];
 	for (const item of options.items) {
 		const base = {
@@ -459,7 +488,7 @@ async function runPublish(options) {
 				description: options.description,
 				visibility: options.visibility,
 				readme: options.readme,
-				tags: options.tags
+				category: options.category
 			};
 			const prepared = await item.prepare(metadata);
 			if (ctx.flags.dryRun) {
@@ -475,6 +504,7 @@ async function runPublish(options) {
 				name: item.name
 			}, options.info);
 			if (existing !== null && options.forceNew) throw usage(`The ${options.info.noun} ${options.namespace}/${item.name} already exists`, "Drop --new to publish a new version of it.");
+			if (existing !== null && options.category !== void 0) throw usage(`Cannot change the category of the existing ${options.info.noun} ${options.namespace}/${item.name}`, "Drop --category to publish a new version; change the category in the Web console.");
 			let response;
 			let mode;
 			if (existing !== null) {
@@ -509,4 +539,25 @@ async function runPublish(options) {
 	ctx.writePayload({ results });
 	return results.some((result) => result.status === "failed") ? 1 : 0;
 }
-export { resolveCapabilityVersion as _, failedResult as a, stringValues as c, homeDir as d, downloadContent as f, resolveCapability as g, parseCapabilityPath as h, errorBody as i, AGENTS as l, SKILL_KIND as m, readPublishFlags as n, positionalPaths as o, MCP_KIND as p, runPublish as r, runBatch as s, explicitName as t, findAgentDefinition as u };
+// src/commands/scope.ts
+const SCOPE_OPTIONS = [{
+	value: "project",
+	label: "Project",
+	hint: "install into the current directory"
+}, {
+	value: "global",
+	label: "Global",
+	hint: "install for the current user"
+}];
+/**
+* Resolves project vs global install scope. `--global` wins without asking.
+* Without an interactive prompter the current-directory default is kept, so
+* scripts, pipes and `--json` runs never block on a prompt.
+*/
+async function resolveInstallScope(ctx, global) {
+	if (global) return "global";
+	const select = ctx.io.prompts?.select;
+	if (!select || !ctx.io.stdin.isTTY || !ctx.io.stdout.isTTY) return "project";
+	return await select("Install scope", SCOPE_OPTIONS, "project") === "global" ? "global" : "project";
+}
+export { resolveCapability as _, errorBody as a, runBatch as c, findAgentDefinition as d, homeDir as f, parseCapabilityPath as g, SKILL_KIND as h, runPublish as i, stringValues as l, MCP_KIND as m, explicitName as n, failedResult as o, downloadContent as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, AGENTS as u, resolveCapabilityVersion as v };