hngr 0.3.0 → 0.5.0

package/README.md

@@ -47,9 +47,19 @@ hngr skills add team-a/pdf-tools --agent claude-code
 hngr skills add pdf-tools@2026.10.25.1 --agent claude-code
 ```
 
-Non-interactive runs must pass `--agent` (repeatable) or `--all`. Use `--global` for
-user-level directories, `--copy` to skip the canonical `.agents/skills` directory, and
-`--dry-run` to preview without writing.
+The shared `.agents/skills` store is always installed, so every universal agent reads it
+without extra work. In an interactive terminal, omitting `--global` first asks whether to
+install for the current project or the user, then shows a multi-select of the agents that
+need their own directory (`claude-code`, `cline`, `junie` or `kiro-cli`), with an
+`All agents` entry; detected agents are preselected, and pressing Enter with none selected
+installs only `.agents/skills`. Without a terminal, pass `--agent` (repeatable) or `--all`,
+and the scope defaults to the project. Use `--copy` to write copies instead of the
+canonical store plus links, and `--dry-run` to preview without writing. Re-running an
+install replaces the existing target; `--force` is not needed.
+
+Interactive runs end with a borderless summary on stderr (canonical path, universal
+agents, symlinked/copied agents); stdout carries the JSON payload only when piped or when
+`--json` is passed.
 
 ## Publish capabilities
 

package/dist/{auth-CgBUQUQn.mjs → auth-ByGgd_Yn.mjs}

@@ -1,4 +1,4 @@
-import { S as HngrError, d as configFilePath, f as deleteStoredConfig, g as resolveConnection, h as redactUrl, m as readStoredConfig, n as apiGet, p as normalizeServerUrl, t as apiFetch, v as writeStoredConfig } from "./http-2HWxLIOq.mjs";
+import { C as HngrError, d as configFilePath, f as deleteStoredConfig, g as resolveConnection, h as redactUrl, m as readStoredConfig, n as apiGet, p as normalizeServerUrl, t as apiFetch, v as storedAudience, y as writeStoredConfig } from "./http-DgHX7Fux.mjs";
 import { hostname } from "node:os";
 import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
@@ -28,12 +28,33 @@ async function activeToken(ctx) {
 		source: "config"
 	} : void 0;
 }
-async function token(ctx) {
+async function token(ctx, argv) {
+	if (argv.audience === "mcp") return mintMCPToken(ctx);
 	const active = await activeToken(ctx);
 	if (!active) throw notLoggedInError();
 	ctx.io.stdout.write(`${active.token}\n`);
 	return 0;
 }
+/**
+* Mints a static MCP token with the active credential and prints it once.
+* The stored config is never rewritten, so the same machine keeps its
+* management login while handing out MCP tokens.
+*
+* The caller's kind is deliberately not checked here: the server owns the
+* owner rule (a Principal can manage its own tokens), so the request must go
+* out and its Problem, if any, reaches the user through the usual mapping.
+*/
+async function mintMCPToken(ctx) {
+	const connection = await resolveConnection(ctx.flags, ctx.env);
+	if (!connection.token) throw notLoggedInError();
+	const minted = await mintAccessToken(connection.server, {
+		name: cliMCPTokenName(),
+		audience: "mcp",
+		headers: { Authorization: `Bearer ${connection.token}` }
+	});
+	ctx.io.stdout.write(`${minted.token}\n`);
+	return 0;
+}
 /** Prompts only happen with both stdin and stdout on a TTY and a prompter available. */
 function canPrompt(ctx) {
 	return ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && ctx.io.prompts !== void 0;
@@ -130,6 +151,7 @@ async function loginWithToken(ctx, server, stored) {
 			token_name: matched.name
 		} : {},
 		token_prefix: prefix,
+		audience: "management",
 		principal,
 		created_at: (/* @__PURE__ */ new Date()).toISOString()
 	});
@@ -158,7 +180,11 @@ async function loginWithPassword(ctx, server, stored) {
 		}
 	}));
 	if (ctx.flags.force && stored) await revokePreviousToken(ctx, stored);
-	const minted = await mintAccessToken(server, cookie, cliTokenName());
+	const minted = await mintAccessToken(server, {
+		name: cliTokenName(),
+		audience: "management",
+		headers: { Cookie: cookie }
+	});
 	const principal = asStoredPrincipal(await apiGet({
 		server,
 		token: minted.token
@@ -171,6 +197,7 @@ async function loginWithPassword(ctx, server, stored) {
 			token_id: minted.id,
 			token_name: minted.name,
 			token_prefix: minted.token_prefix,
+			audience: "management",
 			principal,
 			created_at: (/* @__PURE__ */ new Date()).toISOString()
 		});
@@ -308,6 +335,7 @@ async function loginDevice(ctx, server, stored) {
 			token_id: minted.token_id,
 			token_name: minted.name,
 			token_prefix: minted.token_prefix,
+			audience: "management",
 			principal,
 			created_at: (/* @__PURE__ */ new Date()).toISOString()
 		});
@@ -332,6 +360,10 @@ function sessionCookieOf(response) {
 function cliTokenName() {
 	return `hngr-cli@${hostname()}`.slice(0, 64);
 }
+/** `hngr-mcp@<hostname>`, so MCP tokens are recognisable in the token list. */
+function cliMCPTokenName() {
+	return `hngr-mcp@${hostname()}`.slice(0, 64);
+}
 /**
 * Finds the stored token's id so logout can revoke it. A token list that is
 * unavailable, malformed, or ambiguous leaves the id unknown; login itself
@@ -360,20 +392,24 @@ async function lookupTokenMetadata(server, token, prefix) {
 	} : { id: match.id };
 }
 /**
-* Mints an access token with the session cookie and a random Idempotency-Key.
-* A replay response carries no token value: delete the replayed id and mint
-* again under a fresh key.
+* Mints an access token with the caller's credentials and a random
+* Idempotency-Key. The caller passes either a session cookie (login) or a
+* Bearer token (minting for an audience). A replay response carries no token
+* value: delete the replayed id and mint again under a fresh key.
 */
-async function mintAccessToken(server, cookie, name) {
+async function mintAccessToken(server, options) {
 	for (let attempt = 0; attempt < 2; attempt++) {
 		const response = await apiFetch({ server }, {
 			method: "POST",
 			path: "/api/v1/me/tokens",
 			headers: {
-				Cookie: cookie,
+				...options.headers,
 				"Idempotency-Key": randomUUID()
 			},
-			body: { name }
+			body: {
+				name: options.name,
+				audience: options.audience
+			}
 		});
 		const body = await response.json();
 		if (response.status === 201) {
@@ -397,7 +433,7 @@ async function mintAccessToken(server, cookie, name) {
 		await apiFetch({ server }, {
 			method: "DELETE",
 			path: `/api/v1/me/tokens/${encodeURIComponent(body.id)}`,
-			headers: { Cookie: cookie }
+			headers: options.headers
 		});
 	}
 	throw new HngrError({
@@ -447,6 +483,7 @@ async function status(ctx, argv) {
 	const config = await readStoredConfig(ctx.env);
 	const source = active.source === "env" ? "env:HANGAR_TOKEN" : configFilePath(ctx.env);
 	const tokenPrefix = active.source === "config" && config?.token_prefix ? config.token_prefix : tokenPrefixOf(active.token);
+	const audience = active.source === "config" ? storedAudience(config) : "management";
 	let principal = config?.principal ?? null;
 	if (argv.offline !== true) try {
 		principal = await apiGet(connection, "/api/v1/me", void 0, { signal: AbortSignal.timeout(5e3) });
@@ -458,7 +495,8 @@ async function status(ctx, argv) {
 		source,
 		server: connection.server,
 		principal,
-		token_prefix: tokenPrefix
+		token_prefix: tokenPrefix,
+		audience
 	});
 	return 0;
 }