hngr 0.4.0 → 0.5.1

package/README.md

@@ -47,12 +47,24 @@ hngr skills add team-a/pdf-tools --agent claude-code
 hngr skills add pdf-tools@2026.10.25.1 --agent claude-code
 ```
 
-Non-interactive runs must pass `--agent` (repeatable) or `--all`. In an interactive
-terminal, omitting `--global` first asks whether to install for the current project or
-the user; without a terminal it defaults to the project. Use `--global` to skip the
-question, `--copy` to skip the canonical `.agents/skills` directory, and `--dry-run` to
-preview without writing. Re-running an install replaces the existing target; `--force`
-is not needed.
+The shared `.agents/skills` store is always installed, so every universal agent reads it
+without extra work. In an interactive terminal, omitting `--global` first asks whether to
+install for the current project or the user, then shows a multi-select of the agents that
+need their own directory (`claude-code`, `cline`, `junie` or `kiro-cli`), with an
+`All agents` entry; detected agents are preselected, and pressing Enter with none selected
+installs only `.agents/skills`. Without a terminal, pass `--agent` (repeatable) or `--all`,
+and the scope defaults to the project. Use `--copy` to write copies instead of the
+canonical store plus links, and `--dry-run` to preview without writing. Re-running an
+install replaces the existing target; `--force` is not needed.
+
+Interactive runs end with a borderless summary on stderr (canonical path, universal
+agents, symlinked/copied agents); stdout carries the JSON payload only when piped or when
+`--json` is passed.
+
+MCP installs ask for the same scope and then for the MCP targets to write, with an
+`All targets` entry; targets whose config already exists are preselected, and Claude
+Code's `.mcp.json` is preselected for project installs. Without a terminal, pass
+`--agent` (repeatable) or `--all`.
 
 ## Publish capabilities
 

package/dist/{catalog-Bv304SXJ.mjs → catalog-r53AMymQ.mjs}

@@ -50,6 +50,8 @@ const EXCLUDED_PATHS = [
 	"/api/v1/auth/device/lookup",
 	"/api/v1/auth/device/approve",
 	"/api/v1/auth/device/deny",
+	"/api/v1/teams/{team_id}/invitations",
+	"/api/v1/team-invitations",
 	"/api/v1/oauth"
 ];
 /**
@@ -1816,7 +1818,10 @@ const COMMANDS = deriveCommands({
 							"team.deleted",
 							"team.member_added",
 							"team.member_role_changed",
-							"team.member_removed"
+							"team.member_removed",
+							"team.invitation_created",
+							"team.invitation_revoked",
+							"team.invitation_accepted"
 						]
 					}
 				},
@@ -2094,6 +2099,125 @@ const COMMANDS = deriveCommands({
 				}
 			}
 		},
+		"/api/v1/teams/{team_id}/invitations": {
+			"parameters": [{ "$ref": "#/components/parameters/TeamID" }],
+			"post": {
+				"operationId": "createTeamInvitation",
+				"summary": "Create an invitation link for a Team.",
+				"description": "Allowed for an effective Team Admin and for a Platform Admin of an\nenabled Team. The Team must be enabled; a disabled Team answers 409 for\nevery caller, Platform Admins included. The invitation always adds\nmembers as `member`: the request carries no role and no use limit. The\nresponse is the only time the plaintext `token` and the absolute `url`\nare returned; the platform stores only the token's keyed digest and\nlater lists expose only `token_prefix`. `expires_in_days` defaults to 7\nand must be between 1 and 30.\n",
+				"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateTeamInvitationRequest" } } }
+				},
+				"responses": {
+					"201": {
+						"description": "The invitation and the one-time token and link.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/IssuedTeamInvitation" } } }
+					},
+					"400": { "$ref": "#/components/responses/Problem" },
+					"401": { "$ref": "#/components/responses/Problem" },
+					"403": { "$ref": "#/components/responses/Problem" },
+					"404": { "$ref": "#/components/responses/Problem" },
+					"409": { "$ref": "#/components/responses/Problem" },
+					"default": { "$ref": "#/components/responses/Problem" }
+				}
+			},
+			"get": {
+				"operationId": "listTeamInvitations",
+				"summary": "List a Team's invitation links, newest first.",
+				"description": "Allowed for an effective Team Admin and for a Platform Admin. A\ndisabled Team stays readable and its invitations stay revocable.\nUnknown and deleted Teams answer 404; a caller who does not govern the\nTeam answers 403. The list\nnever contains the token or its digest, only `token_prefix`; `uses` is\nthe number of Users the link has actually added. `state` is derived by\nthe server with priority revoked, then expired, then active. The list\nis ordered by `created_at` then `id`, both descending, and paged by\ncursor without a total.\n",
+				"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
+				"parameters": [{ "$ref": "#/components/parameters/Cursor" }, { "$ref": "#/components/parameters/Limit" }],
+				"responses": {
+					"200": {
+						"description": "One page of invitations.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamInvitationList" } } }
+					},
+					"400": { "$ref": "#/components/responses/Problem" },
+					"401": { "$ref": "#/components/responses/Problem" },
+					"403": { "$ref": "#/components/responses/Problem" },
+					"404": { "$ref": "#/components/responses/Problem" },
+					"default": { "$ref": "#/components/responses/Problem" }
+				}
+			}
+		},
+		"/api/v1/teams/{team_id}/invitations/{invitation_id}": {
+			"parameters": [{ "$ref": "#/components/parameters/TeamID" }, { "$ref": "#/components/parameters/InvitationID" }],
+			"delete": {
+				"operationId": "revokeTeamInvitation",
+				"summary": "Revoke an invitation link.",
+				"description": "Allowed for an effective Team Admin and for a Platform Admin, also\nwhile the Team is disabled: revoking changes no membership. Revoking an\nalready-revoked invitation answers 204 without changing `revoked_at`. An\ninvitation of another Team, or an unknown one, answers 404.\n",
+				"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
+				"responses": {
+					"204": { "description": "The invitation is revoked." },
+					"400": { "$ref": "#/components/responses/Problem" },
+					"401": { "$ref": "#/components/responses/Problem" },
+					"403": { "$ref": "#/components/responses/Problem" },
+					"404": { "$ref": "#/components/responses/Problem" },
+					"default": { "$ref": "#/components/responses/Problem" }
+				}
+			}
+		},
+		"/api/v1/team-invitations/preview": { "post": {
+			"operationId": "previewTeamInvitation",
+			"summary": "Preview an invitation link without joining.",
+			"description": "Anonymous. Resolves the token to the Team it invites to, without\nrevealing the roster or anything else about the Team. A live Team\nanswers 200 even when the invitation is expired or revoked, with\n`state` carrying the reason; the Web page explains it. An unknown\ntoken answers 404, and a Team that has been deleted makes its links\nunknown too. `already_member` is resolved from the Session cookie when\nthe caller is signed in and is always false for an anonymous caller.\nThe endpoint is rate-limited per client address and every response is\n`no-store`.\n",
+			"security": [],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamInvitationToken" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "The Team and the invitation's derived state.",
+					"headers": { "Cache-Control": {
+						"description": "Always `no-store`.",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamInvitationPreview" } } }
+				},
+				"400": { "$ref": "#/components/responses/Problem" },
+				"404": { "$ref": "#/components/responses/Problem" },
+				"429": { "$ref": "#/components/responses/Problem" },
+				"default": { "$ref": "#/components/responses/Problem" }
+			}
+		} },
+		"/api/v1/team-invitations/accept": { "post": {
+			"operationId": "acceptTeamInvitation",
+			"summary": "Join a Team through an invitation link.",
+			"description": "Session-only: a Bearer Access Token is never accepted, so an Agent\ncannot join through a link. Membership is always created with the\n`member` role; the request carries no role. A new membership answers\n201 and an existing one answers 200 without changing any role, which\nmakes replay safe. Both answer with the same `TeamMember` shape as\n`putTeamMember`. An unknown token or a deleted Team answers 404; an\nexpired or revoked invitation, or a disabled Team, answers 409.\n`uses` increments only when a membership is actually inserted, and the\nendpoint is rate-limited per client address. Every response is\n`no-store`.\n",
+			"security": [{ "sessionCookie": [] }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamInvitationToken" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "The caller was already a member; nothing changed.",
+					"headers": { "Cache-Control": {
+						"description": "Always `no-store`.",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamMember" } } }
+				},
+				"201": {
+					"description": "The caller was added to the Team as a member.",
+					"headers": { "Cache-Control": {
+						"description": "Always `no-store`.",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamMember" } } }
+				},
+				"400": { "$ref": "#/components/responses/Problem" },
+				"401": { "$ref": "#/components/responses/Problem" },
+				"403": { "$ref": "#/components/responses/Problem" },
+				"404": { "$ref": "#/components/responses/Problem" },
+				"409": { "$ref": "#/components/responses/Problem" },
+				"429": { "$ref": "#/components/responses/Problem" },
+				"default": { "$ref": "#/components/responses/Problem" }
+			}
+		} },
 		"/api/v1/teams/{team_id}/members/{principal_id}": {
 			"parameters": [{ "$ref": "#/components/parameters/TeamID" }, { "$ref": "#/components/parameters/PrincipalID" }],
 			"put": {
@@ -2208,6 +2332,15 @@ const COMMANDS = deriveCommands({
 					"format": "uuid"
 				}
 			},
+			"InvitationID": {
+				"name": "invitation_id",
+				"in": "path",
+				"required": true,
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			},
 			"TokenID": {
 				"name": "token_id",
 				"in": "path",
@@ -3854,6 +3987,141 @@ const COMMANDS = deriveCommands({
 					"next_cursor": { "$ref": "#/components/schemas/NextCursor" }
 				}
 			},
+			"TeamInvitationState": {
+				"type": "string",
+				"enum": [
+					"active",
+					"expired",
+					"revoked"
+				],
+				"description": "Derived by the server; revoked wins over expired, which wins over active."
+			},
+			"TeamInvitation": {
+				"type": "object",
+				"required": [
+					"id",
+					"token_prefix",
+					"uses",
+					"expires_at",
+					"revoked_at",
+					"state",
+					"created_at",
+					"created_by"
+				],
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"token_prefix": {
+						"type": "string",
+						"description": "The `hngi_` scheme plus the first 8 random characters, for recognising the link in a list."
+					},
+					"uses": {
+						"type": "integer",
+						"description": "How many Users the link has actually added to the Team."
+					},
+					"expires_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"revoked_at": {
+						"type": ["string", "null"],
+						"format": "date-time"
+					},
+					"state": { "$ref": "#/components/schemas/TeamInvitationState" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"created_by": {
+						"type": ["string", "null"],
+						"format": "uuid"
+					}
+				}
+			},
+			"TeamInvitationList": {
+				"type": "object",
+				"required": ["items", "next_cursor"],
+				"properties": {
+					"items": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/TeamInvitation" }
+					},
+					"next_cursor": { "$ref": "#/components/schemas/NextCursor" }
+				}
+			},
+			"IssuedTeamInvitation": {
+				"description": "The TeamInvitation plus the plaintext token and link, returned only once.",
+				"allOf": [{ "$ref": "#/components/schemas/TeamInvitation" }, {
+					"type": "object",
+					"required": ["token", "url"],
+					"properties": {
+						"token": { "type": "string" },
+						"url": { "type": "string" }
+					}
+				}]
+			},
+			"CreateTeamInvitationRequest": {
+				"type": "object",
+				"properties": { "expires_in_days": {
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 30,
+					"default": 7
+				} },
+				"additionalProperties": false
+			},
+			"TeamInvitationToken": {
+				"type": "object",
+				"description": "The opaque token a join link carries. It travels in the body, never in a path or query.",
+				"required": ["token"],
+				"properties": { "token": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 128
+				} },
+				"additionalProperties": false
+			},
+			"TeamInvitationPreview": {
+				"type": "object",
+				"description": "What a join page may show before the visitor acts. It never carries\nthe roster or the token. `already_member` is false for anonymous\ncallers. `state` is derived on the server with priority revoked, then\nexpired, then active.\n",
+				"required": [
+					"team",
+					"state",
+					"expires_at",
+					"team_disabled",
+					"already_member"
+				],
+				"properties": {
+					"team": {
+						"type": "object",
+						"required": [
+							"id",
+							"name",
+							"display_name"
+						],
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"name": {
+								"type": "string",
+								"description": "The Team's Namespace name."
+							},
+							"display_name": { "type": ["string", "null"] }
+						}
+					},
+					"state": { "$ref": "#/components/schemas/TeamInvitationState" },
+					"expires_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"team_disabled": { "type": "boolean" },
+					"already_member": { "type": "boolean" }
+				}
+			},
 			"CalVer": {
 				"type": "string",
 				"description": "`YYYY.MM.DD.N` in UTC; N counts from 0 per Capability per day.",

package/dist/{commands-CLqLwQHY.mjs → commands-_R93Y2z-.mjs}

@@ -1,4 +1,4 @@
-import { t as commandCatalog } from "./catalog-Bv304SXJ.mjs";
+import { t as commandCatalog } from "./catalog-r53AMymQ.mjs";
 // src/commands/commands.ts
 function run(ctx) {
 	const catalog = commandCatalog();

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-Bv304SXJ.mjs";
+import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-r53AMymQ.mjs";
 import { C as HngrError, S as CancelledError, c as redactUrlForDisplay, g as resolveConnection, i as buildRequestUrl, o as redactQuery, r as apiRequest, s as redactSensitive, u as DEFAULT_SERVER_URL, w as renderError } from "./http-DgHX7Fux.mjs";
 import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
 import { createRequire } from "node:module";
@@ -5279,7 +5279,7 @@ function isYargsInstance(y) {
 // ../../node_modules/.pnpm/yargs@18.2.0/node_modules/yargs/index.mjs
 const Yargs = YargsFactory(esm_default);
 // package.json
-var version = "0.4.0";
+var version = "0.5.1";
 // src/generated/completion.ts
 function isCompletionShell(value) {
 	return value === "bash" || value === "zsh" || value === "fish";
@@ -6721,6 +6721,13 @@ ${h}
 		}
 	}).prompt();
 };
+const outro = (o = "", t) => {
+	const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText("gray", S_BAR)}
+${styleText("gray", S_BAR_END)}  ` : "";
+	i.write(`${e}${o}
+
+`);
+};
 const password = (e) => new u$1({
 	validate: e.validate,
 	mask: e.mask ?? S_PASSWORD_MASK,
@@ -6898,15 +6905,24 @@ function clackPrompter(streams = {}) {
 				initialValue
 			}));
 		},
-		async multiselect(message, options, initialValues = []) {
+		async multiselect(message, options, initialValues = [], hint) {
+			if (hint) output.write(`${import_picocolors.default.dim(hint)}\n`);
 			return unwrapPrompt(await multiselect({
 				message,
 				input,
 				output,
 				options,
 				initialValues,
-				required: true
+				required: false
 			}));
+		},
+		note(message, title) {
+			output.write(`${import_picocolors.default.green("◇")}  ${title}\n`);
+			output.write(`${import_picocolors.default.dim("│")}\n`);
+			for (const line of message.split("\n")) output.write(`${import_picocolors.default.dim("│")}  ${line}\n`);
+		},
+		outro(message) {
+			outro(message, { output });
 		}
 	};
 }
@@ -6922,7 +6938,7 @@ const GLOBAL_OPTIONS = {
 	json: {
 		type: "boolean",
 		default: false,
-		describe: "Machine mode: errors are single-line JSON on stderr",
+		describe: "Machine mode: print the JSON payload even on a TTY, and errors as JSON",
 		global: true
 	},
 	quiet: {
@@ -7005,7 +7021,7 @@ function buildParser(onMatched) {
 	parser.command("commands", "Print the command catalog", () => {}, (argv) => {
 		onMatched({
 			argv,
-			run: async (ctx) => (await import("./commands-CLqLwQHY.mjs")).run(ctx)
+			run: async (ctx) => (await import("./commands-_R93Y2z-.mjs")).run(ctx)
 		});
 	});
 	parser.command("auth", "Manage credentials", (auth) => {
@@ -7085,7 +7101,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-CxMeJ5PF.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-C3cphIAl.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		skills.command("publish <paths..>", "Publish a local skill directory as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7113,7 +7129,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-CxMeJ5PF.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-C3cphIAl.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return skills.demandCommand(1);
@@ -7135,7 +7151,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-DWF_ELDU.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-DjSU9C8z.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		mcp.command("publish <paths..>", "Publish an MCP snapshot as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7163,7 +7179,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-DWF_ELDU.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-DjSU9C8z.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return mcp.demandCommand(1);

package/dist/{mcp-DWF_ELDU.mjs → mcp-DjSU9C8z.mjs}

@@ -1,8 +1,8 @@
 import { C as HngrError, g as resolveConnection, s as redactSensitive, t as apiFetch, x as writeFileAtomically } from "./http-DgHX7Fux.mjs";
-import { _ as resolveCapability, a as errorBody, c as runBatch, d as findAgentDefinition, g as parseCapabilityPath, i as runPublish, l as stringValues, m as MCP_KIND, n as explicitName, o as failedResult, p as downloadContent, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as AGENTS, v as resolveCapabilityVersion } from "./scope-Ch6wZCgE.mjs";
+import { S as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as parseCapabilityPath, c as runBatch, h as findAgentDefinition, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, v as MCP_KIND, x as resolveCapability } from "./scope-D8k2oa_W.mjs";
 import { constants } from "node:fs";
 import { access, readFile, stat } from "node:fs/promises";
-import { basename, delimiter, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { spawn } from "node:child_process";
 // src/mcp/claude-cli.ts
 const EXECUTABLE = "claude";
@@ -128,6 +128,12 @@ async function addJsonWithClaude(env, name, config) {
 // src/mcp/content.ts
 /** Server names Claude Code accepts as `mcpServers` keys. */
 const SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]+$/;
+/**
+* `__proto__` matches the pattern but is an accessor on `Object.prototype`:
+* assigning it would silently change the merged object's prototype instead of
+* recording a server.
+*/
+const RESERVED_SERVER_NAMES = /* @__PURE__ */ new Set(["__proto__"]);
 const EXPECTED_SHAPE = "Expected an object shaped {\"mcpServers\": {\"<server-name>\": {\"command\": \"...\", \"args\": [...]}}}.";
 function invalid(title, detail = EXPECTED_SHAPE) {
 	return new HngrError({
@@ -148,7 +154,7 @@ function validateSnapshot(body) {
 	if (!("mcpServers" in body)) throw invalid("The MCP snapshot is missing \"mcpServers\"");
 	const servers = body.mcpServers;
 	if (!isPlainObject$1(servers)) throw invalid("The MCP snapshot's \"mcpServers\" is not an object");
-	for (const name of Object.keys(servers)) if (!SERVER_NAME_PATTERN.test(name)) throw invalid(`Invalid MCP server name ${JSON.stringify(name)}`, "Server names must match [A-Za-z0-9_-]+.");
+	for (const name of Object.keys(servers)) if (!SERVER_NAME_PATTERN.test(name) || RESERVED_SERVER_NAMES.has(name)) throw invalid(`Invalid MCP server name ${JSON.stringify(name)}`, "Server names must match [A-Za-z0-9_-]+ and must not be __proto__.");
 	return {
 		servers,
 		ignoredKeys: Object.keys(body).filter((key) => key !== "mcpServers")
@@ -343,6 +349,48 @@ function usage(title, detail) {
 		detail
 	});
 }
+const ALL_TARGETS = "__all__";
+/** Target prompts need a TTY on both ends, a multi-select prompter, and human output mode. */
+function canPrompt(ctx) {
+	return !ctx.flags.json && ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && ctx.io.prompts?.multiselect !== void 0;
+}
+function noTargetSelectionError(global) {
+	return usage("No agent target selected", `Pass --agent <id> (repeatable) or --all. For example: hngr mcp add pdf --agent claude-code${global ? " --global" : ""}`);
+}
+/**
+* One multi-select for the MCP targets supported at the chosen scope. Detection
+* only preselects: an existing agent config (or its directory) is highlighted,
+* and Claude Code is preselected at project scope because the current directory
+* always exists. A non-TTY invocation never prompts and must pass --agent or --all.
+*/
+async function selectTargets(ctx, argv, scope) {
+	const requested = stringValues(argv.agent);
+	const all = argv.all === true;
+	if (requested.length > 0 || all) return selectMcpTargets(requested, all, scope, process.cwd(), ctx.env);
+	const multiselect = ctx.io.prompts?.multiselect;
+	if (!canPrompt(ctx) || !multiselect) throw noTargetSelectionError(scope === "global");
+	const plans = selectMcpTargets([], true, scope, process.cwd(), ctx.env);
+	const options = [{
+		value: ALL_TARGETS,
+		label: "All targets",
+		hint: "install for every target below"
+	}];
+	const initialValues = [];
+	for (const plan of plans) {
+		options.push({
+			value: plan.agent,
+			label: plan.agent,
+			hint: plan.path
+		});
+		const configPath = plan.filePath ?? plan.path;
+		if (plan.kind === "claude-cli" ? await pathExists(configPath) : await pathExists(dirname(configPath))) initialValues.push(plan.agent);
+	}
+	const selected = await multiselect("Install targets", options, initialValues, "Existing agent configs are preselected");
+	const chosen = selected.includes(ALL_TARGETS) ? new Set(plans.map((plan) => plan.agent)) : new Set(selected);
+	const targets = plans.filter((plan) => chosen.has(plan.agent));
+	if (targets.length === 0) throw noTargetSelectionError(scope === "global");
+	return targets;
+}
 function failureResult(parsed, err, version) {
 	return {
 		servers: [],
@@ -391,8 +439,6 @@ async function addOne(ctx, connection, parsed, targets, state) {
 	const snapshot = await downloadMcpSnapshot(connection, capability.id, version);
 	if (snapshot.ignoredKeys.length > 0) ctx.summary(`warning: ignoring unsupported top-level keys in the MCP snapshot: ${snapshot.ignoredKeys.join(", ")}`);
 	const serverNames = Object.keys(snapshot.servers);
-	const etag = snapshot.etag ? ` (ETag ${snapshot.etag})` : "";
-	ctx.summary(`resolved ${parsed.namespace}/${parsed.name} to version ${version}${etag}`);
 	if (ctx.flags.dryRun) {
 		const dryTargets = [];
 		let failure = null;
@@ -567,7 +613,7 @@ async function add(ctx, argv) {
 	if (rawPaths.length === 0) throw usage("No capability path given", "Pass one or more `<name>` or `<namespace>/<name>` arguments.");
 	const parsedPaths = rawPaths.map(parseMcpPath);
 	const scope = await resolveInstallScope(ctx, argv.global === true);
-	const targets = selectMcpTargets(stringValues(argv.agent), argv.all === true, scope, process.cwd(), ctx.env);
+	const targets = await selectTargets(ctx, argv, scope);
 	const connection = await resolveConnection(ctx.flags, ctx.env);
 	let approvalHintShown = false;
 	const { results, failed } = await runBatch({
@@ -583,7 +629,7 @@ async function add(ctx, argv) {
 			}
 		}
 	});
-	ctx.writePayload({ results });
+	if (ctx.flags.json || !ctx.io.stdout.isTTY) ctx.writePayload({ results });
 	return failed ? 1 : 0;
 }
 export { add, publish };

package/dist/{scope-Ch6wZCgE.mjs → scope-D8k2oa_W.mjs}

@@ -1,8 +1,9 @@
-import { C as HngrError, _ as scrubCredentials, a as toHngrError, g as resolveConnection, h as redactUrl, i as buildRequestUrl, l as apiErrorFromResponse, n as apiGet } from "./http-DgHX7Fux.mjs";
+import { C as HngrError, _ as scrubCredentials, a as toHngrError, b as writeDirectoryAtomically, g as resolveConnection, h as redactUrl, i as buildRequestUrl, l as apiErrorFromResponse, n as apiGet } from "./http-DgHX7Fux.mjs";
 import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
-import { readFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, rename, rm, symlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { randomUUID } from "node:crypto";
 // ../client/src/capability-path.ts
 /** The Namespace every bare capability reference means. */
 const SYSTEM_NAMESPACE = "system";
@@ -172,6 +173,10 @@ function claudeConfigDir(env) {
 function xdgConfigDir(env) {
 	return env.XDG_CONFIG_HOME && env.XDG_CONFIG_HOME !== "" ? env.XDG_CONFIG_HOME : join(homeDir(env), ".config");
 }
+/** Pi's agent directory: `PI_CODING_AGENT_DIR` or `~/.pi/agent`. */
+function piAgentDir(env) {
+	return env.PI_CODING_AGENT_DIR && env.PI_CODING_AGENT_DIR !== "" ? env.PI_CODING_AGENT_DIR : join(homeDir(env), ".pi", "agent");
+}
 const universalSkills = {
 	projectDir: null,
 	globalDir: null,
@@ -220,6 +225,15 @@ const AGENTS = [
 			reason: "OpenCode uses a top-level `mcp` object with local/remote entries."
 		}
 	},
+	{
+		id: "pi",
+		skills: universalSkills,
+		mcp: {
+			kind: "json",
+			project: ".pi/mcp.json",
+			global: (env) => join(piAgentDir(env), "mcp.json")
+		}
+	},
 	{
 		id: "amp",
 		skills: universalSkills,
@@ -310,6 +324,69 @@ const AGENTS = [
 function findAgentDefinition(id) {
 	return AGENTS.find((agent) => agent.id === id);
 }
+// src/skills/install.ts
+async function pathExists(path) {
+	return lstat(path).then(() => true, () => false);
+}
+async function writeEntries(dest, entries) {
+	await mkdir(dest, { recursive: true });
+	for (const entry of entries) {
+		const path = resolve(dest, entry.path);
+		if (path !== dest && !path.startsWith(`${dest}${sep}`)) throw new HngrError({
+			type: "io",
+			title: `Refusing to write outside ${dest}`,
+			detail: `entry ${JSON.stringify(entry.path)} escapes the target directory`
+		});
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, entry.data, { mode: entry.mode & 73 ? 493 : 420 });
+	}
+}
+/**
+* Writes a skill through "temp directory → validate → rename": the target is
+* either absent or complete, never half-written. Re-installing replaces the
+* previous directory, with the old one moved aside so a failed swap puts it
+* back.
+*/
+async function installAtomically(dest, entries) {
+	await writeDirectoryAtomically(dest, (temp) => writeEntries(temp, entries));
+}
+/**
+* Creates a relative symlink to the canonical directory, falling back to a
+* copy when the platform refuses the link (Windows without Developer Mode).
+* Windows prefers a junction, which does not need elevated privileges; its
+* target must be absolute. A temp link plus rename replaces an existing link
+* atomically; re-installing replaces an existing directory or link.
+*/
+async function linkAtomically(canonical, target, entries, options = {}) {
+	const exists = await pathExists(target);
+	await mkdir(dirname(target), { recursive: true });
+	const temp = resolve(dirname(target), `.hngr-${basename(target)}-${randomUUID()}.link`);
+	const windows = (options.platform ?? process.platform) === "win32";
+	const createLink = options.symlink ?? symlink;
+	try {
+		await createLink(windows ? canonical : relative(dirname(target), canonical), temp, windows ? "junction" : "dir");
+		if (exists) {
+			const stat = await lstat(target);
+			if (stat.isDirectory() && !stat.isSymbolicLink()) await rm(target, {
+				recursive: true,
+				force: true
+			});
+		}
+		await rename(temp, target);
+		return { mode: "symlink" };
+	} catch {
+		await rm(temp, { force: true }).catch(() => {});
+		await installAtomically(target, entries);
+		return {
+			mode: "copy",
+			warning: `warning: could not create a link at ${target}; copied instead`
+		};
+	}
+}
+/** Copies one target directory atomically, without a canonical store. */
+async function copyAtomically(target, entries) {
+	await installAtomically(target, entries);
+}
 // src/commands/batch.ts
 /** A repeatable string flag can arrive as one value or an array of values. */
 function stringValues(value) {
@@ -557,7 +634,7 @@ const SCOPE_OPTIONS = [{
 async function resolveInstallScope(ctx, global) {
 	if (global) return "global";
 	const select = ctx.io.prompts?.select;
-	if (!select || !ctx.io.stdin.isTTY || !ctx.io.stdout.isTTY) return "project";
+	if (!select || ctx.flags.json || !ctx.io.stdin.isTTY || !ctx.io.stdout.isTTY) return "project";
 	return await select("Install scope", SCOPE_OPTIONS, "project") === "global" ? "global" : "project";
 }
-export { resolveCapability as _, errorBody as a, runBatch as c, findAgentDefinition as d, homeDir as f, parseCapabilityPath as g, SKILL_KIND as h, runPublish as i, stringValues as l, MCP_KIND as m, explicitName as n, failedResult as o, downloadContent as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, AGENTS as u, resolveCapabilityVersion as v };
+export { resolveCapabilityVersion as S, downloadContent as _, errorBody as a, parseCapabilityPath as b, runBatch as c, installAtomically as d, linkAtomically as f, homeDir as g, findAgentDefinition as h, runPublish as i, stringValues as l, AGENTS as m, explicitName as n, failedResult as o, pathExists as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, copyAtomically as u, MCP_KIND as v, resolveCapability as x, SKILL_KIND as y };

package/dist/{skills-CxMeJ5PF.mjs → skills-C3cphIAl.mjs}

@@ -1,6 +1,6 @@
-import { C as HngrError, b as writeDirectoryAtomically, g as resolveConnection, r as apiRequest } from "./http-DgHX7Fux.mjs";
-import { _ as resolveCapability, a as errorBody, c as runBatch, f as homeDir, g as parseCapabilityPath, h as SKILL_KIND, i as runPublish, l as stringValues, n as explicitName, o as failedResult, p as downloadContent, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as AGENTS, v as resolveCapabilityVersion } from "./scope-Ch6wZCgE.mjs";
-import { lstat, mkdir, readFile, readdir, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { C as HngrError, g as resolveConnection, r as apiRequest } from "./http-DgHX7Fux.mjs";
+import { S as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as parseCapabilityPath, c as runBatch, d as installAtomically, f as linkAtomically, g as homeDir, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as copyAtomically, x as resolveCapability, y as SKILL_KIND } from "./scope-D8k2oa_W.mjs";
+import { lstat, readFile, readdir } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { randomUUID } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
@@ -88,69 +88,6 @@ function isReservedDirName(name) {
 function downloadSkillPackage(connection, capabilityId, version, signal) {
 	return downloadContent(connection, capabilityId, version, "application/zip", signal);
 }
-// src/skills/install.ts
-async function pathExists(path) {
-	return lstat(path).then(() => true, () => false);
-}
-async function writeEntries(dest, entries) {
-	await mkdir(dest, { recursive: true });
-	for (const entry of entries) {
-		const path = resolve(dest, entry.path);
-		if (path !== dest && !path.startsWith(`${dest}${sep}`)) throw new HngrError({
-			type: "io",
-			title: `Refusing to write outside ${dest}`,
-			detail: `entry ${JSON.stringify(entry.path)} escapes the target directory`
-		});
-		await mkdir(dirname(path), { recursive: true });
-		await writeFile(path, entry.data, { mode: entry.mode & 73 ? 493 : 420 });
-	}
-}
-/**
-* Writes a skill through "temp directory → validate → rename": the target is
-* either absent or complete, never half-written. Re-installing replaces the
-* previous directory, with the old one moved aside so a failed swap puts it
-* back.
-*/
-async function installAtomically(dest, entries) {
-	await writeDirectoryAtomically(dest, (temp) => writeEntries(temp, entries));
-}
-/**
-* Creates a relative symlink to the canonical directory, falling back to a
-* copy when the platform refuses the link (Windows without Developer Mode).
-* Windows prefers a junction, which does not need elevated privileges; its
-* target must be absolute. A temp link plus rename replaces an existing link
-* atomically; re-installing replaces an existing directory or link.
-*/
-async function linkAtomically(canonical, target, entries, options = {}) {
-	const exists = await pathExists(target);
-	await mkdir(dirname(target), { recursive: true });
-	const temp = resolve(dirname(target), `.hngr-${basename(target)}-${randomUUID()}.link`);
-	const windows = (options.platform ?? process.platform) === "win32";
-	const createLink = options.symlink ?? symlink;
-	try {
-		await createLink(windows ? canonical : relative(dirname(target), canonical), temp, windows ? "junction" : "dir");
-		if (exists) {
-			const stat = await lstat(target);
-			if (stat.isDirectory() && !stat.isSymbolicLink()) await rm(target, {
-				recursive: true,
-				force: true
-			});
-		}
-		await rename(temp, target);
-		return { mode: "symlink" };
-	} catch {
-		await rm(temp, { force: true }).catch(() => {});
-		await installAtomically(target, entries);
-		return {
-			mode: "copy",
-			warning: `warning: could not create a link at ${target}; copied instead`
-		};
-	}
-}
-/** Copies one target directory atomically, without a canonical store. */
-async function copyAtomically(target, entries) {
-	await installAtomically(target, entries);
-}
 // src/skills/resolve.ts
 /** Parses `<name>` or `<namespace>/<name>`, with an optional `@YYYY.MM.DD.N`. */
 function parseSkillPath(raw) {
@@ -552,17 +489,19 @@ function failureResult(parsed, err, version) {
 		canonicalPath: null
 	};
 }
-/** Prompts need both stdin and stdout on a TTY plus a prompter that can multi-select. */
+/** Agent prompts need a TTY on both ends, a multi-select prompter, and human output mode. */
 function canPrompt(ctx) {
-	return ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && ctx.io.prompts?.multiselect !== void 0;
+	return !ctx.flags.json && ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && ctx.io.prompts?.multiselect !== void 0;
 }
 function noAgentSelectionError(examplePath, global) {
 	return usage("No agent target selected", `Pass --agent <id> (repeatable) or --all. For example: hngr skills add ${examplePath} --agent claude-code${global ? " --global" : ""}`);
 }
+const ALL_AGENTS = "__all__";
 /**
-* One multi-select for every Agent Target, pre-selecting those whose skills
-* directory is detected. Detection is only a pre-selection hint; a non-TTY
-* invocation never consults the filesystem and must pass --agent or --all.
+* One multi-select for the agents that keep their own skills directory.
+* `.agents` is always installed, so universal agents never appear here.
+* Detection only preselects; a non-TTY invocation never consults the
+* filesystem and must pass --agent or --all.
 */
 async function selectAgents(ctx, argv, examplePath, global) {
 	const requested = stringValues(argv.agent);
@@ -572,26 +511,28 @@ async function selectAgents(ctx, argv, examplePath, global) {
 		return AGENT_TARGETS.filter((agent) => requested.includes(agent.id));
 	}
 	if (argv.all === true) return [...AGENT_TARGETS];
-	if (canPrompt(ctx)) {
-		const multiselect = ctx.io.prompts?.multiselect;
-		if (!multiselect) throw noAgentSelectionError(examplePath, global);
-		const cwd = process.cwd();
-		const choices = [];
-		for (const agent of AGENT_TARGETS) {
-			const dir = targetSkillsDir(agent, cwd, ctx.env, global);
-			choices.push({
-				option: {
-					value: agent.id,
-					label: `${agent.id}  ${displayPath(dir, cwd)}`
-				},
-				detected: await pathExists(dirname(dir))
-			});
-		}
-		const selected = await multiselect("Select agent targets", choices.map((choice) => choice.option), choices.filter((choice) => choice.detected).map((choice) => choice.option.value));
-		if (selected.length === 0) throw noAgentSelectionError(examplePath, global);
-		return AGENT_TARGETS.filter((agent) => selected.includes(agent.id));
+	const multiselect = ctx.io.prompts?.multiselect;
+	if (!canPrompt(ctx) || !multiselect) throw noAgentSelectionError(examplePath, global);
+	const cwd = process.cwd();
+	const linkAgents = AGENT_TARGETS.filter((agent) => agent.link);
+	const options = [{
+		value: ALL_AGENTS,
+		label: "All agents",
+		hint: "select every agent below"
+	}];
+	const initialValues = [];
+	for (const agent of linkAgents) {
+		const dir = targetSkillsDir(agent, cwd, ctx.env, global);
+		options.push({
+			value: agent.id,
+			label: agent.id,
+			hint: displayPath(dir, cwd)
+		});
+		if (await pathExists(dirname(dir))) initialValues.push(agent.id);
 	}
-	throw noAgentSelectionError(examplePath, global);
+	const selected = await multiselect("Install for another agent", options, initialValues, ".agents/skills is always installed; press Enter to skip");
+	const chosen = selected.includes(ALL_AGENTS) ? new Set(linkAgents.map((agent) => agent.id)) : new Set(selected);
+	return linkAgents.filter((agent) => chosen.has(agent.id));
 }
 function frontmatterName(manifest) {
 	const text = manifest.toString("utf8");
@@ -683,6 +624,26 @@ async function install(ctx, plan, entries) {
 		failure
 	};
 }
+function withDot(path) {
+	return path.startsWith("/") ? path : `./${path}`;
+}
+/** The boxed result shown after an interactive install. */
+function installSummary(outcome, canonicalPath) {
+	const lines = [];
+	const installed = outcome.targets.filter((target) => target.status === "installed");
+	if (canonicalPath) {
+		lines.push(`✓ ${withDot(canonicalPath)}`);
+		const universal = AGENT_TARGETS.filter((agent) => !agent.link).map((agent) => agent.id);
+		if (universal.length > 0) lines.push(`  universal: ${universal.join(", ")}`);
+	} else for (const target of installed) lines.push(`✓ ${withDot(target.path)}`);
+	const symlinked = installed.filter((target) => target.mode === "symlink" && target.agent).map((target) => target.agent);
+	const copied = installed.filter((target) => target.mode === "copy" && target.agent).map((target) => target.agent);
+	if (symlinked.length > 0) lines.push(`  symlinked: ${symlinked.join(", ")}`);
+	if (copied.length > 0) lines.push(`  copied: ${copied.join(", ")}`);
+	const failed = outcome.targets.filter((target) => target.status === "failed");
+	if (failed.length > 0) lines.push(`  failed: ${failed.map((target) => target.path).join(", ")}`);
+	return lines.join("\n");
+}
 async function addOne(ctx, connection, parsed, destName, agents, dir, global, copy, state) {
 	const capability = await resolveSkill(connection, parsed);
 	const version = resolveVersion(capability, parsed);
@@ -694,7 +655,9 @@ async function addOne(ctx, connection, parsed, destName, agents, dir, global, co
 	});
 	const canonicalPath = plan.canonical ? displayPath(plan.canonical, process.cwd()) : null;
 	if (ctx.flags.dryRun) {
-		ctx.summary(`resolved ${parsed.namespace}/${parsed.name} to version ${version}`);
+		ctx.detail(`dry-run: would install ${parsed.namespace}/${parsed.name}@${version}`);
+		if (canonicalPath) ctx.detail(`  ${canonicalPath}`);
+		for (const target of plan.targets) ctx.detail(`  ${displayPath(target.path, process.cwd())} (${target.mode})`);
 		return { result: {
 			name: capability.name,
 			namespace: capability.namespace,
@@ -710,19 +673,18 @@ async function addOne(ctx, connection, parsed, destName, agents, dir, global, co
 			error: null
 		} };
 	}
-	const download = await downloadSkillPackage(connection, capability.id, version);
-	const pkg = readSkillPackage(download.bytes);
-	ctx.summary(`resolved ${parsed.namespace}/${parsed.name} to version ${version}`);
+	const pkg = readSkillPackage((await downloadSkillPackage(connection, capability.id, version)).bytes);
 	const declaredName = frontmatterName(pkg.manifest);
 	if (declaredName !== void 0 && declaredName !== destName) ctx.summary(`warning: SKILL.md declares name ${JSON.stringify(declaredName)} but the directory is ${JSON.stringify(destName)}`);
 	const outcome = await install(ctx, plan, pkg.entries);
-	const universal = agents.filter((agent) => !agent.link).map((agent) => agent.id);
-	const etag = download.etag ? ` (ETag ${download.etag})` : "";
-	const verb = outcome.failure ? "partially installed" : "installed";
-	ctx.progress(`${verb} ${capability.namespace}/${capability.name}@${version}${etag}`);
-	if (canonicalPath) ctx.progress(`  canonical ${canonicalPath}`);
-	if (universal.length > 0) ctx.progress(`  universal: ${universal.join(", ")}`);
-	for (const target of outcome.targets) ctx.progress(target.status === "failed" ? `  failed ${target.path}` : `  ${target.mode} ${target.path}`);
+	const verb = outcome.failure ? "Partially installed" : "Installed";
+	const note = ctx.io.prompts?.note;
+	if (!ctx.flags.json && !ctx.flags.quiet && ctx.io.stderr.isTTY && note) note(installSummary(outcome, canonicalPath), `${verb} ${capability.namespace}/${capability.name}@${version}`);
+	else {
+		ctx.progress(`${verb.toLowerCase()} ${capability.namespace}/${capability.name}@${version}`);
+		if (canonicalPath) ctx.progress(`  ${canonicalPath}`);
+		for (const target of outcome.targets) ctx.progress(target.status === "failed" ? `  failed ${target.path}` : `  ${target.path} (${target.mode})`);
+	}
 	return { result: {
 		name: capability.name,
 		namespace: capability.namespace,
@@ -849,7 +811,8 @@ async function add(ctx, argv) {
 		},
 		failure: failureResult
 	});
-	ctx.writePayload({ results });
+	if (ctx.flags.json || !ctx.io.stdout.isTTY) ctx.writePayload({ results });
+	if (!ctx.flags.json && !ctx.flags.dryRun && !ctx.flags.quiet && !failed && ctx.io.stderr.isTTY) ctx.io.prompts?.outro?.("Done! Review skills before use; they run with full agent permissions.");
 	return failed ? 1 : 0;
 }
 export { add, publish };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hngr",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "The Hangar CLI: install skills and MCP servers into coding agents, and drive the Management API.",
   "keywords": [
     "hangar",