hngr 0.5.0 → 0.6.0

package/README.md

@@ -59,7 +59,15 @@ install replaces the existing target; `--force` is not needed.
 
 Interactive runs end with a borderless summary on stderr (canonical path, universal
 agents, symlinked/copied agents); stdout carries the JSON payload only when piped or when
-`--json` is passed.
+`--json` is passed. After a successful interactive install the CLI asks once whether to
+also install `system/find-capabilities` (the catalog's discovery skill, which finds both
+Skills and MCP servers) for the same scope and agents; it is skipped silently when a copy
+already exists in either scope, and a failed follow-up install only prints a warning.
+
+MCP installs ask for the same scope and then for the MCP targets to write, with an
+`All targets` entry; targets whose config already exists are preselected, and Claude
+Code's `.mcp.json` is preselected for project installs. Without a terminal, pass
+`--agent` (repeatable) or `--all`.
 
 ## Publish capabilities
 

package/dist/{catalog-Bv304SXJ.mjs → catalog-r53AMymQ.mjs}

@@ -50,6 +50,8 @@ const EXCLUDED_PATHS = [
 	"/api/v1/auth/device/lookup",
 	"/api/v1/auth/device/approve",
 	"/api/v1/auth/device/deny",
+	"/api/v1/teams/{team_id}/invitations",
+	"/api/v1/team-invitations",
 	"/api/v1/oauth"
 ];
 /**
@@ -1816,7 +1818,10 @@ const COMMANDS = deriveCommands({
 							"team.deleted",
 							"team.member_added",
 							"team.member_role_changed",
-							"team.member_removed"
+							"team.member_removed",
+							"team.invitation_created",
+							"team.invitation_revoked",
+							"team.invitation_accepted"
 						]
 					}
 				},
@@ -2094,6 +2099,125 @@ const COMMANDS = deriveCommands({
 				}
 			}
 		},
+		"/api/v1/teams/{team_id}/invitations": {
+			"parameters": [{ "$ref": "#/components/parameters/TeamID" }],
+			"post": {
+				"operationId": "createTeamInvitation",
+				"summary": "Create an invitation link for a Team.",
+				"description": "Allowed for an effective Team Admin and for a Platform Admin of an\nenabled Team. The Team must be enabled; a disabled Team answers 409 for\nevery caller, Platform Admins included. The invitation always adds\nmembers as `member`: the request carries no role and no use limit. The\nresponse is the only time the plaintext `token` and the absolute `url`\nare returned; the platform stores only the token's keyed digest and\nlater lists expose only `token_prefix`. `expires_in_days` defaults to 7\nand must be between 1 and 30.\n",
+				"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateTeamInvitationRequest" } } }
+				},
+				"responses": {
+					"201": {
+						"description": "The invitation and the one-time token and link.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/IssuedTeamInvitation" } } }
+					},
+					"400": { "$ref": "#/components/responses/Problem" },
+					"401": { "$ref": "#/components/responses/Problem" },
+					"403": { "$ref": "#/components/responses/Problem" },
+					"404": { "$ref": "#/components/responses/Problem" },
+					"409": { "$ref": "#/components/responses/Problem" },
+					"default": { "$ref": "#/components/responses/Problem" }
+				}
+			},
+			"get": {
+				"operationId": "listTeamInvitations",
+				"summary": "List a Team's invitation links, newest first.",
+				"description": "Allowed for an effective Team Admin and for a Platform Admin. A\ndisabled Team stays readable and its invitations stay revocable.\nUnknown and deleted Teams answer 404; a caller who does not govern the\nTeam answers 403. The list\nnever contains the token or its digest, only `token_prefix`; `uses` is\nthe number of Users the link has actually added. `state` is derived by\nthe server with priority revoked, then expired, then active. The list\nis ordered by `created_at` then `id`, both descending, and paged by\ncursor without a total.\n",
+				"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
+				"parameters": [{ "$ref": "#/components/parameters/Cursor" }, { "$ref": "#/components/parameters/Limit" }],
+				"responses": {
+					"200": {
+						"description": "One page of invitations.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamInvitationList" } } }
+					},
+					"400": { "$ref": "#/components/responses/Problem" },
+					"401": { "$ref": "#/components/responses/Problem" },
+					"403": { "$ref": "#/components/responses/Problem" },
+					"404": { "$ref": "#/components/responses/Problem" },
+					"default": { "$ref": "#/components/responses/Problem" }
+				}
+			}
+		},
+		"/api/v1/teams/{team_id}/invitations/{invitation_id}": {
+			"parameters": [{ "$ref": "#/components/parameters/TeamID" }, { "$ref": "#/components/parameters/InvitationID" }],
+			"delete": {
+				"operationId": "revokeTeamInvitation",
+				"summary": "Revoke an invitation link.",
+				"description": "Allowed for an effective Team Admin and for a Platform Admin, also\nwhile the Team is disabled: revoking changes no membership. Revoking an\nalready-revoked invitation answers 204 without changing `revoked_at`. An\ninvitation of another Team, or an unknown one, answers 404.\n",
+				"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
+				"responses": {
+					"204": { "description": "The invitation is revoked." },
+					"400": { "$ref": "#/components/responses/Problem" },
+					"401": { "$ref": "#/components/responses/Problem" },
+					"403": { "$ref": "#/components/responses/Problem" },
+					"404": { "$ref": "#/components/responses/Problem" },
+					"default": { "$ref": "#/components/responses/Problem" }
+				}
+			}
+		},
+		"/api/v1/team-invitations/preview": { "post": {
+			"operationId": "previewTeamInvitation",
+			"summary": "Preview an invitation link without joining.",
+			"description": "Anonymous. Resolves the token to the Team it invites to, without\nrevealing the roster or anything else about the Team. A live Team\nanswers 200 even when the invitation is expired or revoked, with\n`state` carrying the reason; the Web page explains it. An unknown\ntoken answers 404, and a Team that has been deleted makes its links\nunknown too. `already_member` is resolved from the Session cookie when\nthe caller is signed in and is always false for an anonymous caller.\nThe endpoint is rate-limited per client address and every response is\n`no-store`.\n",
+			"security": [],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamInvitationToken" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "The Team and the invitation's derived state.",
+					"headers": { "Cache-Control": {
+						"description": "Always `no-store`.",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamInvitationPreview" } } }
+				},
+				"400": { "$ref": "#/components/responses/Problem" },
+				"404": { "$ref": "#/components/responses/Problem" },
+				"429": { "$ref": "#/components/responses/Problem" },
+				"default": { "$ref": "#/components/responses/Problem" }
+			}
+		} },
+		"/api/v1/team-invitations/accept": { "post": {
+			"operationId": "acceptTeamInvitation",
+			"summary": "Join a Team through an invitation link.",
+			"description": "Session-only: a Bearer Access Token is never accepted, so an Agent\ncannot join through a link. Membership is always created with the\n`member` role; the request carries no role. A new membership answers\n201 and an existing one answers 200 without changing any role, which\nmakes replay safe. Both answer with the same `TeamMember` shape as\n`putTeamMember`. An unknown token or a deleted Team answers 404; an\nexpired or revoked invitation, or a disabled Team, answers 409.\n`uses` increments only when a membership is actually inserted, and the\nendpoint is rate-limited per client address. Every response is\n`no-store`.\n",
+			"security": [{ "sessionCookie": [] }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamInvitationToken" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "The caller was already a member; nothing changed.",
+					"headers": { "Cache-Control": {
+						"description": "Always `no-store`.",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamMember" } } }
+				},
+				"201": {
+					"description": "The caller was added to the Team as a member.",
+					"headers": { "Cache-Control": {
+						"description": "Always `no-store`.",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamMember" } } }
+				},
+				"400": { "$ref": "#/components/responses/Problem" },
+				"401": { "$ref": "#/components/responses/Problem" },
+				"403": { "$ref": "#/components/responses/Problem" },
+				"404": { "$ref": "#/components/responses/Problem" },
+				"409": { "$ref": "#/components/responses/Problem" },
+				"429": { "$ref": "#/components/responses/Problem" },
+				"default": { "$ref": "#/components/responses/Problem" }
+			}
+		} },
 		"/api/v1/teams/{team_id}/members/{principal_id}": {
 			"parameters": [{ "$ref": "#/components/parameters/TeamID" }, { "$ref": "#/components/parameters/PrincipalID" }],
 			"put": {
@@ -2208,6 +2332,15 @@ const COMMANDS = deriveCommands({
 					"format": "uuid"
 				}
 			},
+			"InvitationID": {
+				"name": "invitation_id",
+				"in": "path",
+				"required": true,
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			},
 			"TokenID": {
 				"name": "token_id",
 				"in": "path",
@@ -3854,6 +3987,141 @@ const COMMANDS = deriveCommands({
 					"next_cursor": { "$ref": "#/components/schemas/NextCursor" }
 				}
 			},
+			"TeamInvitationState": {
+				"type": "string",
+				"enum": [
+					"active",
+					"expired",
+					"revoked"
+				],
+				"description": "Derived by the server; revoked wins over expired, which wins over active."
+			},
+			"TeamInvitation": {
+				"type": "object",
+				"required": [
+					"id",
+					"token_prefix",
+					"uses",
+					"expires_at",
+					"revoked_at",
+					"state",
+					"created_at",
+					"created_by"
+				],
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"token_prefix": {
+						"type": "string",
+						"description": "The `hngi_` scheme plus the first 8 random characters, for recognising the link in a list."
+					},
+					"uses": {
+						"type": "integer",
+						"description": "How many Users the link has actually added to the Team."
+					},
+					"expires_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"revoked_at": {
+						"type": ["string", "null"],
+						"format": "date-time"
+					},
+					"state": { "$ref": "#/components/schemas/TeamInvitationState" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"created_by": {
+						"type": ["string", "null"],
+						"format": "uuid"
+					}
+				}
+			},
+			"TeamInvitationList": {
+				"type": "object",
+				"required": ["items", "next_cursor"],
+				"properties": {
+					"items": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/TeamInvitation" }
+					},
+					"next_cursor": { "$ref": "#/components/schemas/NextCursor" }
+				}
+			},
+			"IssuedTeamInvitation": {
+				"description": "The TeamInvitation plus the plaintext token and link, returned only once.",
+				"allOf": [{ "$ref": "#/components/schemas/TeamInvitation" }, {
+					"type": "object",
+					"required": ["token", "url"],
+					"properties": {
+						"token": { "type": "string" },
+						"url": { "type": "string" }
+					}
+				}]
+			},
+			"CreateTeamInvitationRequest": {
+				"type": "object",
+				"properties": { "expires_in_days": {
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 30,
+					"default": 7
+				} },
+				"additionalProperties": false
+			},
+			"TeamInvitationToken": {
+				"type": "object",
+				"description": "The opaque token a join link carries. It travels in the body, never in a path or query.",
+				"required": ["token"],
+				"properties": { "token": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 128
+				} },
+				"additionalProperties": false
+			},
+			"TeamInvitationPreview": {
+				"type": "object",
+				"description": "What a join page may show before the visitor acts. It never carries\nthe roster or the token. `already_member` is false for anonymous\ncallers. `state` is derived on the server with priority revoked, then\nexpired, then active.\n",
+				"required": [
+					"team",
+					"state",
+					"expires_at",
+					"team_disabled",
+					"already_member"
+				],
+				"properties": {
+					"team": {
+						"type": "object",
+						"required": [
+							"id",
+							"name",
+							"display_name"
+						],
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"name": {
+								"type": "string",
+								"description": "The Team's Namespace name."
+							},
+							"display_name": { "type": ["string", "null"] }
+						}
+					},
+					"state": { "$ref": "#/components/schemas/TeamInvitationState" },
+					"expires_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"team_disabled": { "type": "boolean" },
+					"already_member": { "type": "boolean" }
+				}
+			},
 			"CalVer": {
 				"type": "string",
 				"description": "`YYYY.MM.DD.N` in UTC; N counts from 0 per Capability per day.",

package/dist/{commands-CLqLwQHY.mjs → commands-_R93Y2z-.mjs}

@@ -1,4 +1,4 @@
-import { t as commandCatalog } from "./catalog-Bv304SXJ.mjs";
+import { t as commandCatalog } from "./catalog-r53AMymQ.mjs";
 // src/commands/commands.ts
 function run(ctx) {
 	const catalog = commandCatalog();

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-Bv304SXJ.mjs";
+import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-r53AMymQ.mjs";
 import { C as HngrError, S as CancelledError, c as redactUrlForDisplay, g as resolveConnection, i as buildRequestUrl, o as redactQuery, r as apiRequest, s as redactSensitive, u as DEFAULT_SERVER_URL, w as renderError } from "./http-DgHX7Fux.mjs";
 import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
 import { createRequire } from "node:module";
@@ -5279,7 +5279,7 @@ function isYargsInstance(y) {
 // ../../node_modules/.pnpm/yargs@18.2.0/node_modules/yargs/index.mjs
 const Yargs = YargsFactory(esm_default);
 // package.json
-var version = "0.5.0";
+var version = "0.6.0";
 // src/generated/completion.ts
 function isCompletionShell(value) {
 	return value === "bash" || value === "zsh" || value === "fish";
@@ -6429,6 +6429,23 @@ var y = class {
 		}
 	}
 };
+var r = class extends y {
+	get cursor() {
+		return this.value ? 0 : 1;
+	}
+	get _value() {
+		return this.cursor === 0;
+	}
+	constructor(t) {
+		super(t, false), this.value = !!t.initialValue, this.on("userInput", () => {
+			this.value = this._value;
+		}), this.on("confirm", (i) => {
+			this.output.write(import_src.cursor.move(0, -1)), this.value = i, this.state = "submit", this.close();
+		}), this.on("cursor", () => {
+			this.value = !this.value;
+		});
+	}
+};
 var a = class extends y {
 	options;
 	cursor = 0;
@@ -6633,6 +6650,35 @@ const limitOptions = ({ cursor: l, options: e, style: w, output: p = process.std
 	for (const t of s) for (const n of t) x.push(n);
 	return c && x.push(M), x;
 };
+const confirm = (e) => {
+	const a = e.active ?? "Yes", o = e.inactive ?? "No";
+	return new r({
+		active: a,
+		inactive: o,
+		signal: e.signal,
+		input: e.input,
+		output: e.output,
+		initialValue: e.initialValue ?? true,
+		render() {
+			const i = e.withGuide ?? settings.withGuide, u = `${symbol(this.state)}  `, l = i ? `${styleText("gray", S_BAR)}  ` : "", f = wrapTextWithPrefix(e.output, e.message, l, u), s = `${i ? `${styleText("gray", S_BAR)}
+` : ""}${f}
+`, c = this.value ? a : o;
+			switch (this.state) {
+				case "submit": return `${s}${i ? `${styleText("gray", S_BAR)}  ` : ""}${styleText("dim", c)}`;
+				case "cancel": return `${s}${i ? `${styleText("gray", S_BAR)}  ` : ""}${styleText(["strikethrough", "dim"], c)}${i ? `
+${styleText("gray", S_BAR)}` : ""}`;
+				default: {
+					const r = i ? `${styleText("cyan", S_BAR)}  ` : "", g = i ? styleText("cyan", S_BAR_END) : "";
+					return `${s}${r}${this.value ? `${styleText("green", S_RADIO_ACTIVE)} ${a}` : `${styleText("dim", S_RADIO_INACTIVE)} ${styleText("dim", a)}`}${e.vertical ? i ? `
+${styleText("cyan", S_BAR)}  ` : `
+` : ` ${styleText("dim", "/")} `}${this.value ? `${styleText("dim", S_RADIO_INACTIVE)} ${styleText("dim", o)}` : `${styleText("green", S_RADIO_ACTIVE)} ${o}`}
+${g}
+`;
+				}
+			}
+		}
+	}).prompt();
+};
 const MULTISELECT_INSTRUCTIONS = [
 	`${styleText("dim", "↑/↓")} to navigate`,
 	`${styleText("dim", "Space:")} select`,
@@ -6905,6 +6951,14 @@ function clackPrompter(streams = {}) {
 				initialValue
 			}));
 		},
+		async confirm(message, initialValue = true) {
+			return unwrapPrompt(await confirm({
+				message,
+				input,
+				output,
+				initialValue
+			}));
+		},
 		async multiselect(message, options, initialValues = [], hint) {
 			if (hint) output.write(`${import_picocolors.default.dim(hint)}\n`);
 			return unwrapPrompt(await multiselect({
@@ -7021,7 +7075,7 @@ function buildParser(onMatched) {
 	parser.command("commands", "Print the command catalog", () => {}, (argv) => {
 		onMatched({
 			argv,
-			run: async (ctx) => (await import("./commands-CLqLwQHY.mjs")).run(ctx)
+			run: async (ctx) => (await import("./commands-_R93Y2z-.mjs")).run(ctx)
 		});
 	});
 	parser.command("auth", "Manage credentials", (auth) => {
@@ -7101,7 +7155,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-ZFmFyZtw.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-B92ip3mJ.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		skills.command("publish <paths..>", "Publish a local skill directory as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7129,7 +7183,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-ZFmFyZtw.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-B92ip3mJ.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return skills.demandCommand(1);
@@ -7151,7 +7205,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-B0sbQABp.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-DjSU9C8z.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		mcp.command("publish <paths..>", "Publish an MCP snapshot as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7179,7 +7233,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-B0sbQABp.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-DjSU9C8z.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return mcp.demandCommand(1);

package/dist/{mcp-B0sbQABp.mjs → mcp-DjSU9C8z.mjs}

@@ -1,8 +1,8 @@
 import { C as HngrError, g as resolveConnection, s as redactSensitive, t as apiFetch, x as writeFileAtomically } from "./http-DgHX7Fux.mjs";
-import { _ as resolveCapability, a as errorBody, c as runBatch, d as findAgentDefinition, g as parseCapabilityPath, i as runPublish, l as stringValues, m as MCP_KIND, n as explicitName, o as failedResult, p as downloadContent, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as AGENTS, v as resolveCapabilityVersion } from "./scope-DVfDeQi2.mjs";
+import { S as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as parseCapabilityPath, c as runBatch, h as findAgentDefinition, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, v as MCP_KIND, x as resolveCapability } from "./scope-D8k2oa_W.mjs";
 import { constants } from "node:fs";
 import { access, readFile, stat } from "node:fs/promises";
-import { basename, delimiter, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { spawn } from "node:child_process";
 // src/mcp/claude-cli.ts
 const EXECUTABLE = "claude";
@@ -128,6 +128,12 @@ async function addJsonWithClaude(env, name, config) {
 // src/mcp/content.ts
 /** Server names Claude Code accepts as `mcpServers` keys. */
 const SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]+$/;
+/**
+* `__proto__` matches the pattern but is an accessor on `Object.prototype`:
+* assigning it would silently change the merged object's prototype instead of
+* recording a server.
+*/
+const RESERVED_SERVER_NAMES = /* @__PURE__ */ new Set(["__proto__"]);
 const EXPECTED_SHAPE = "Expected an object shaped {\"mcpServers\": {\"<server-name>\": {\"command\": \"...\", \"args\": [...]}}}.";
 function invalid(title, detail = EXPECTED_SHAPE) {
 	return new HngrError({
@@ -148,7 +154,7 @@ function validateSnapshot(body) {
 	if (!("mcpServers" in body)) throw invalid("The MCP snapshot is missing \"mcpServers\"");
 	const servers = body.mcpServers;
 	if (!isPlainObject$1(servers)) throw invalid("The MCP snapshot's \"mcpServers\" is not an object");
-	for (const name of Object.keys(servers)) if (!SERVER_NAME_PATTERN.test(name)) throw invalid(`Invalid MCP server name ${JSON.stringify(name)}`, "Server names must match [A-Za-z0-9_-]+.");
+	for (const name of Object.keys(servers)) if (!SERVER_NAME_PATTERN.test(name) || RESERVED_SERVER_NAMES.has(name)) throw invalid(`Invalid MCP server name ${JSON.stringify(name)}`, "Server names must match [A-Za-z0-9_-]+ and must not be __proto__.");
 	return {
 		servers,
 		ignoredKeys: Object.keys(body).filter((key) => key !== "mcpServers")
@@ -343,6 +349,48 @@ function usage(title, detail) {
 		detail
 	});
 }
+const ALL_TARGETS = "__all__";
+/** Target prompts need a TTY on both ends, a multi-select prompter, and human output mode. */
+function canPrompt(ctx) {
+	return !ctx.flags.json && ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && ctx.io.prompts?.multiselect !== void 0;
+}
+function noTargetSelectionError(global) {
+	return usage("No agent target selected", `Pass --agent <id> (repeatable) or --all. For example: hngr mcp add pdf --agent claude-code${global ? " --global" : ""}`);
+}
+/**
+* One multi-select for the MCP targets supported at the chosen scope. Detection
+* only preselects: an existing agent config (or its directory) is highlighted,
+* and Claude Code is preselected at project scope because the current directory
+* always exists. A non-TTY invocation never prompts and must pass --agent or --all.
+*/
+async function selectTargets(ctx, argv, scope) {
+	const requested = stringValues(argv.agent);
+	const all = argv.all === true;
+	if (requested.length > 0 || all) return selectMcpTargets(requested, all, scope, process.cwd(), ctx.env);
+	const multiselect = ctx.io.prompts?.multiselect;
+	if (!canPrompt(ctx) || !multiselect) throw noTargetSelectionError(scope === "global");
+	const plans = selectMcpTargets([], true, scope, process.cwd(), ctx.env);
+	const options = [{
+		value: ALL_TARGETS,
+		label: "All targets",
+		hint: "install for every target below"
+	}];
+	const initialValues = [];
+	for (const plan of plans) {
+		options.push({
+			value: plan.agent,
+			label: plan.agent,
+			hint: plan.path
+		});
+		const configPath = plan.filePath ?? plan.path;
+		if (plan.kind === "claude-cli" ? await pathExists(configPath) : await pathExists(dirname(configPath))) initialValues.push(plan.agent);
+	}
+	const selected = await multiselect("Install targets", options, initialValues, "Existing agent configs are preselected");
+	const chosen = selected.includes(ALL_TARGETS) ? new Set(plans.map((plan) => plan.agent)) : new Set(selected);
+	const targets = plans.filter((plan) => chosen.has(plan.agent));
+	if (targets.length === 0) throw noTargetSelectionError(scope === "global");
+	return targets;
+}
 function failureResult(parsed, err, version) {
 	return {
 		servers: [],
@@ -565,7 +613,7 @@ async function add(ctx, argv) {
 	if (rawPaths.length === 0) throw usage("No capability path given", "Pass one or more `<name>` or `<namespace>/<name>` arguments.");
 	const parsedPaths = rawPaths.map(parseMcpPath);
 	const scope = await resolveInstallScope(ctx, argv.global === true);
-	const targets = selectMcpTargets(stringValues(argv.agent), argv.all === true, scope, process.cwd(), ctx.env);
+	const targets = await selectTargets(ctx, argv, scope);
 	const connection = await resolveConnection(ctx.flags, ctx.env);
 	let approvalHintShown = false;
 	const { results, failed } = await runBatch({

package/dist/{scope-DVfDeQi2.mjs → scope-D8k2oa_W.mjs}

@@ -1,8 +1,9 @@
-import { C as HngrError, _ as scrubCredentials, a as toHngrError, g as resolveConnection, h as redactUrl, i as buildRequestUrl, l as apiErrorFromResponse, n as apiGet } from "./http-DgHX7Fux.mjs";
+import { C as HngrError, _ as scrubCredentials, a as toHngrError, b as writeDirectoryAtomically, g as resolveConnection, h as redactUrl, i as buildRequestUrl, l as apiErrorFromResponse, n as apiGet } from "./http-DgHX7Fux.mjs";
 import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
-import { readFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, rename, rm, symlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { randomUUID } from "node:crypto";
 // ../client/src/capability-path.ts
 /** The Namespace every bare capability reference means. */
 const SYSTEM_NAMESPACE = "system";
@@ -323,6 +324,69 @@ const AGENTS = [
 function findAgentDefinition(id) {
 	return AGENTS.find((agent) => agent.id === id);
 }
+// src/skills/install.ts
+async function pathExists(path) {
+	return lstat(path).then(() => true, () => false);
+}
+async function writeEntries(dest, entries) {
+	await mkdir(dest, { recursive: true });
+	for (const entry of entries) {
+		const path = resolve(dest, entry.path);
+		if (path !== dest && !path.startsWith(`${dest}${sep}`)) throw new HngrError({
+			type: "io",
+			title: `Refusing to write outside ${dest}`,
+			detail: `entry ${JSON.stringify(entry.path)} escapes the target directory`
+		});
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, entry.data, { mode: entry.mode & 73 ? 493 : 420 });
+	}
+}
+/**
+* Writes a skill through "temp directory → validate → rename": the target is
+* either absent or complete, never half-written. Re-installing replaces the
+* previous directory, with the old one moved aside so a failed swap puts it
+* back.
+*/
+async function installAtomically(dest, entries) {
+	await writeDirectoryAtomically(dest, (temp) => writeEntries(temp, entries));
+}
+/**
+* Creates a relative symlink to the canonical directory, falling back to a
+* copy when the platform refuses the link (Windows without Developer Mode).
+* Windows prefers a junction, which does not need elevated privileges; its
+* target must be absolute. A temp link plus rename replaces an existing link
+* atomically; re-installing replaces an existing directory or link.
+*/
+async function linkAtomically(canonical, target, entries, options = {}) {
+	const exists = await pathExists(target);
+	await mkdir(dirname(target), { recursive: true });
+	const temp = resolve(dirname(target), `.hngr-${basename(target)}-${randomUUID()}.link`);
+	const windows = (options.platform ?? process.platform) === "win32";
+	const createLink = options.symlink ?? symlink;
+	try {
+		await createLink(windows ? canonical : relative(dirname(target), canonical), temp, windows ? "junction" : "dir");
+		if (exists) {
+			const stat = await lstat(target);
+			if (stat.isDirectory() && !stat.isSymbolicLink()) await rm(target, {
+				recursive: true,
+				force: true
+			});
+		}
+		await rename(temp, target);
+		return { mode: "symlink" };
+	} catch {
+		await rm(temp, { force: true }).catch(() => {});
+		await installAtomically(target, entries);
+		return {
+			mode: "copy",
+			warning: `warning: could not create a link at ${target}; copied instead`
+		};
+	}
+}
+/** Copies one target directory atomically, without a canonical store. */
+async function copyAtomically(target, entries) {
+	await installAtomically(target, entries);
+}
 // src/commands/batch.ts
 /** A repeatable string flag can arrive as one value or an array of values. */
 function stringValues(value) {
@@ -573,4 +637,4 @@ async function resolveInstallScope(ctx, global) {
 	if (!select || ctx.flags.json || !ctx.io.stdin.isTTY || !ctx.io.stdout.isTTY) return "project";
 	return await select("Install scope", SCOPE_OPTIONS, "project") === "global" ? "global" : "project";
 }
-export { resolveCapability as _, errorBody as a, runBatch as c, findAgentDefinition as d, homeDir as f, parseCapabilityPath as g, SKILL_KIND as h, runPublish as i, stringValues as l, MCP_KIND as m, explicitName as n, failedResult as o, downloadContent as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, AGENTS as u, resolveCapabilityVersion as v };
+export { resolveCapabilityVersion as S, downloadContent as _, errorBody as a, parseCapabilityPath as b, runBatch as c, installAtomically as d, linkAtomically as f, homeDir as g, findAgentDefinition as h, runPublish as i, stringValues as l, AGENTS as m, explicitName as n, failedResult as o, pathExists as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, copyAtomically as u, MCP_KIND as v, resolveCapability as x, SKILL_KIND as y };

package/dist/{skills-ZFmFyZtw.mjs → skills-B92ip3mJ.mjs}

@@ -1,6 +1,6 @@
-import { C as HngrError, b as writeDirectoryAtomically, g as resolveConnection, r as apiRequest } from "./http-DgHX7Fux.mjs";
-import { _ as resolveCapability, a as errorBody, c as runBatch, f as homeDir, g as parseCapabilityPath, h as SKILL_KIND, i as runPublish, l as stringValues, n as explicitName, o as failedResult, p as downloadContent, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as AGENTS, v as resolveCapabilityVersion } from "./scope-DVfDeQi2.mjs";
-import { lstat, mkdir, readFile, readdir, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { C as HngrError, g as resolveConnection, r as apiRequest } from "./http-DgHX7Fux.mjs";
+import { S as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as parseCapabilityPath, c as runBatch, d as installAtomically, f as linkAtomically, g as homeDir, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as copyAtomically, x as resolveCapability, y as SKILL_KIND } from "./scope-D8k2oa_W.mjs";
+import { lstat, readFile, readdir } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { randomUUID } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
@@ -88,69 +88,6 @@ function isReservedDirName(name) {
 function downloadSkillPackage(connection, capabilityId, version, signal) {
 	return downloadContent(connection, capabilityId, version, "application/zip", signal);
 }
-// src/skills/install.ts
-async function pathExists(path) {
-	return lstat(path).then(() => true, () => false);
-}
-async function writeEntries(dest, entries) {
-	await mkdir(dest, { recursive: true });
-	for (const entry of entries) {
-		const path = resolve(dest, entry.path);
-		if (path !== dest && !path.startsWith(`${dest}${sep}`)) throw new HngrError({
-			type: "io",
-			title: `Refusing to write outside ${dest}`,
-			detail: `entry ${JSON.stringify(entry.path)} escapes the target directory`
-		});
-		await mkdir(dirname(path), { recursive: true });
-		await writeFile(path, entry.data, { mode: entry.mode & 73 ? 493 : 420 });
-	}
-}
-/**
-* Writes a skill through "temp directory → validate → rename": the target is
-* either absent or complete, never half-written. Re-installing replaces the
-* previous directory, with the old one moved aside so a failed swap puts it
-* back.
-*/
-async function installAtomically(dest, entries) {
-	await writeDirectoryAtomically(dest, (temp) => writeEntries(temp, entries));
-}
-/**
-* Creates a relative symlink to the canonical directory, falling back to a
-* copy when the platform refuses the link (Windows without Developer Mode).
-* Windows prefers a junction, which does not need elevated privileges; its
-* target must be absolute. A temp link plus rename replaces an existing link
-* atomically; re-installing replaces an existing directory or link.
-*/
-async function linkAtomically(canonical, target, entries, options = {}) {
-	const exists = await pathExists(target);
-	await mkdir(dirname(target), { recursive: true });
-	const temp = resolve(dirname(target), `.hngr-${basename(target)}-${randomUUID()}.link`);
-	const windows = (options.platform ?? process.platform) === "win32";
-	const createLink = options.symlink ?? symlink;
-	try {
-		await createLink(windows ? canonical : relative(dirname(target), canonical), temp, windows ? "junction" : "dir");
-		if (exists) {
-			const stat = await lstat(target);
-			if (stat.isDirectory() && !stat.isSymbolicLink()) await rm(target, {
-				recursive: true,
-				force: true
-			});
-		}
-		await rename(temp, target);
-		return { mode: "symlink" };
-	} catch {
-		await rm(temp, { force: true }).catch(() => {});
-		await installAtomically(target, entries);
-		return {
-			mode: "copy",
-			warning: `warning: could not create a link at ${target}; copied instead`
-		};
-	}
-}
-/** Copies one target directory atomically, without a canonical store. */
-async function copyAtomically(target, entries) {
-	await installAtomically(target, entries);
-}
 // src/skills/resolve.ts
 /** Parses `<name>` or `<namespace>/<name>`, with an optional `@YYYY.MM.DD.N`. */
 function parseSkillPath(raw) {
@@ -850,6 +787,47 @@ async function publish(ctx, argv) {
 		items
 	});
 }
+const FIND_CAPABILITIES = "find-capabilities";
+/** The follow-up question needs a yes/no prompter on both ends of a terminal. */
+function canConfirm(ctx) {
+	return ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && ctx.io.prompts?.confirm !== void 0;
+}
+/**
+* Whether any scope the caller would install into already holds find-capabilities.
+* A project install does not ask again when the global store has it, and the
+* reverse, so the offer appears only when nothing is installed yet.
+*/
+async function findCapabilitiesInstalled(ctx, agents, options) {
+	const scopes = options.dir ? [options.global] : [false, true];
+	for (const global of scopes) {
+		const plan = planInstall(process.cwd(), ctx.env, FIND_CAPABILITIES, agents, {
+			...options,
+			global
+		});
+		const paths = [...plan.canonical ? [plan.canonical] : [], ...plan.targets.map((target) => target.path)];
+		for (const path of paths) if (await pathExists(path)) return true;
+	}
+	return false;
+}
+/**
+* Offers the catalog's capability-discovery skill after a successful install so
+* an agent that just gained one capability can find the rest, Skills and MCP
+* servers alike. It is a convenience, not part of the request: an
+* already-installed copy or a failed download never makes the add itself fail
+* (a cancelled prompt still exits 130).
+*/
+async function offerFindCapabilities(ctx, connection, destNames, agents, options) {
+	const confirm = ctx.io.prompts?.confirm;
+	if (!confirm || destNames.includes(FIND_CAPABILITIES)) return;
+	if (await findCapabilitiesInstalled(ctx, agents, options)) return;
+	if (!await confirm(`Also install ${FIND_CAPABILITIES} (discover more capabilities)?`, true)) return;
+	try {
+		await addOne(ctx, connection, parseSkillPath(FIND_CAPABILITIES), FIND_CAPABILITIES, agents, options.dir, options.global, options.copy, { version: null });
+	} catch (err) {
+		if (err instanceof HngrError && err.exitCode !== 1) throw err;
+		ctx.summary(`warning: could not install ${FIND_CAPABILITIES}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
 async function add(ctx, argv) {
 	const rawPaths = positionalPaths(argv.paths);
 	if (rawPaths.length === 0) throw usage("No skill path given", "Pass one or more `<name>` or `<namespace>/<name>` arguments.");
@@ -875,6 +853,11 @@ async function add(ctx, argv) {
 		failure: failureResult
 	});
 	if (ctx.flags.json || !ctx.io.stdout.isTTY) ctx.writePayload({ results });
+	if (!ctx.flags.json && !ctx.flags.dryRun && !ctx.flags.quiet && !failed && canConfirm(ctx)) await offerFindCapabilities(ctx, connection, parsedPaths.map((parsed) => as ?? parsed.name), agents, {
+		dir,
+		global,
+		copy
+	});
 	if (!ctx.flags.json && !ctx.flags.dryRun && !ctx.flags.quiet && !failed && ctx.io.stderr.isTTY) ctx.io.prompts?.outro?.("Done! Review skills before use; they run with full agent permissions.");
 	return failed ? 1 : 0;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hngr",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "The Hangar CLI: install skills and MCP servers into coding agents, and drive the Management API.",
   "keywords": [
     "hangar",