hngr 0.5.1 → 0.7.0

package/README.md

@@ -59,7 +59,10 @@ install replaces the existing target; `--force` is not needed.
 
 Interactive runs end with a borderless summary on stderr (canonical path, universal
 agents, symlinked/copied agents); stdout carries the JSON payload only when piped or when
-`--json` is passed.
+`--json` is passed. After a successful interactive install the CLI asks once whether to
+also install `system/find-capabilities` (the catalog's discovery skill, which finds both
+Skills and MCP servers) for the same scope and agents; it is skipped silently when a copy
+already exists in either scope, and a failed follow-up install only prints a warning.
 
 MCP installs ask for the same scope and then for the MCP targets to write, with an
 `All targets` entry; targets whose config already exists are preselected, and Claude

package/dist/{catalog-r53AMymQ.mjs → catalog-yVsOzNKU.mjs}

@@ -42,6 +42,7 @@ const EXCLUDED_PATHS = [
 	"/api/v1/capabilities/{capability_id}/versions/{version}/content",
 	"/api/v1/capabilities/{capability_id}/versions/{version}/files",
 	"/api/v1/capabilities/{capability_id}/versions/{version}/file",
+	"/api/v1/capabilities/{capability_id}/versions/{version}/derive",
 	"/api/v1/auth/methods",
 	"/api/v1/auth/oidc/login",
 	"/api/v1/auth/oidc/callback",
@@ -1479,6 +1480,42 @@ const COMMANDS = deriveCommands({
 				}
 			}
 		},
+		"/api/v1/capabilities/{capability_id}/versions/{version}/derive": { "post": {
+			"operationId": "deriveCapabilityVersion",
+			"summary": "Publish a new Version by editing the files of the current Skill Version.",
+			"description": "Derives a new Version from the package of `{version}` by replacing the\nlisted entries and publishes it through the same pipeline as\n`publishCapabilityVersion`: CalVer allocation, the current-version\nswitch and the `capability.version_published` Audit Event all follow\nthe existing publishing rules. Only a Skill Capability accepts this\noperation; an MCP Capability answers 400.\n\n`{version}` must be the Capability's Current Version; any other CalVer\nanswers 409 `/problems/version-conflict`. The check runs again after\nthe Capability row is locked, so a concurrent publish is reported\nrather than silently replaced. Each `edits` path is matched exactly\nagainst a non-directory entry of the baseline package (case\nsensitive); an unknown path, a directory, a non-text entry, an entry\nlarger than 256 KiB, or more than 1 MiB of edits in total answers 400.\n\nThe new Version inherits the baseline Version's `readme` unchanged,\nincluding a null value, for which the existing display rule falls back\nto the package's `SKILL.md`. The request has no README field. This\noperation does not increment `download_count`.\n\nThe caller must manage the Capability's Namespace, under the same\nrules as `publishCapabilityVersion`: a deleted or unavailable\nCapability, one in an unusable Namespace, and a private one the caller\ndoes not manage answer 404. A replayed `Idempotency-Key` returns the\nfirst response without deriving again.\n",
+			"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
+			"parameters": [
+				{ "$ref": "#/components/parameters/CapabilityID" },
+				{
+					"name": "version",
+					"in": "path",
+					"required": true,
+					"schema": { "$ref": "#/components/schemas/CalVer" }
+				},
+				{ "$ref": "#/components/parameters/IdempotencyKey" }
+			],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeriveCapabilityVersionRequest" } } }
+			},
+			"responses": {
+				"201": {
+					"description": "The Capability with its new current version.",
+					"headers": { "Location": {
+						"description": "`/api/v1/capabilities/{capability_id}/versions/{version}`",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/Capability" } } }
+				},
+				"400": { "$ref": "#/components/responses/Problem" },
+				"401": { "$ref": "#/components/responses/Problem" },
+				"403": { "$ref": "#/components/responses/Problem" },
+				"404": { "$ref": "#/components/responses/Problem" },
+				"409": { "$ref": "#/components/responses/Problem" },
+				"default": { "$ref": "#/components/responses/Problem" }
+			}
+		} },
 		"/api/v1/capabilities/{capability_id}/versions/{version}/content": { "get": {
 			"operationId": "lookupCapabilityContent",
 			"summary": "Return the Content of one Version of a Capability.",
@@ -3412,6 +3449,34 @@ const COMMANDS = deriveCommands({
 				},
 				"additionalProperties": false
 			},
+			"DeriveCapabilityVersionRequest": {
+				"type": "object",
+				"required": ["edits"],
+				"properties": { "edits": {
+					"type": "array",
+					"description": "Entries to replace in the baseline package. Paths must be unique\nand must exist as non-directory entries of the baseline package.\n",
+					"minItems": 1,
+					"maxItems": 200,
+					"items": { "$ref": "#/components/schemas/DeriveCapabilityVersionEdit" }
+				} },
+				"additionalProperties": false
+			},
+			"DeriveCapabilityVersionEdit": {
+				"type": "object",
+				"required": ["path", "content"],
+				"properties": {
+					"path": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 4096
+					},
+					"content": {
+						"type": "string",
+						"description": "UTF-8 text. The server enforces 256 KiB per entry and 1 MiB for\nthe whole request by UTF-8 byte length.\n"
+					}
+				},
+				"additionalProperties": false
+			},
 			"Capability": {
 				"type": "object",
 				"required": [

package/dist/{commands-_R93Y2z-.mjs → commands-KKAq0m6z.mjs}

@@ -1,4 +1,4 @@
-import { t as commandCatalog } from "./catalog-r53AMymQ.mjs";
+import { t as commandCatalog } from "./catalog-yVsOzNKU.mjs";
 // src/commands/commands.ts
 function run(ctx) {
 	const catalog = commandCatalog();

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-r53AMymQ.mjs";
+import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-yVsOzNKU.mjs";
 import { C as HngrError, S as CancelledError, c as redactUrlForDisplay, g as resolveConnection, i as buildRequestUrl, o as redactQuery, r as apiRequest, s as redactSensitive, u as DEFAULT_SERVER_URL, w as renderError } from "./http-DgHX7Fux.mjs";
 import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
 import { createRequire } from "node:module";
@@ -5279,7 +5279,7 @@ function isYargsInstance(y) {
 // ../../node_modules/.pnpm/yargs@18.2.0/node_modules/yargs/index.mjs
 const Yargs = YargsFactory(esm_default);
 // package.json
-var version = "0.5.1";
+var version = "0.7.0";
 // src/generated/completion.ts
 function isCompletionShell(value) {
 	return value === "bash" || value === "zsh" || value === "fish";
@@ -6429,6 +6429,23 @@ var y = class {
 		}
 	}
 };
+var r = class extends y {
+	get cursor() {
+		return this.value ? 0 : 1;
+	}
+	get _value() {
+		return this.cursor === 0;
+	}
+	constructor(t) {
+		super(t, false), this.value = !!t.initialValue, this.on("userInput", () => {
+			this.value = this._value;
+		}), this.on("confirm", (i) => {
+			this.output.write(import_src.cursor.move(0, -1)), this.value = i, this.state = "submit", this.close();
+		}), this.on("cursor", () => {
+			this.value = !this.value;
+		});
+	}
+};
 var a = class extends y {
 	options;
 	cursor = 0;
@@ -6633,6 +6650,35 @@ const limitOptions = ({ cursor: l, options: e, style: w, output: p = process.std
 	for (const t of s) for (const n of t) x.push(n);
 	return c && x.push(M), x;
 };
+const confirm = (e) => {
+	const a = e.active ?? "Yes", o = e.inactive ?? "No";
+	return new r({
+		active: a,
+		inactive: o,
+		signal: e.signal,
+		input: e.input,
+		output: e.output,
+		initialValue: e.initialValue ?? true,
+		render() {
+			const i = e.withGuide ?? settings.withGuide, u = `${symbol(this.state)}  `, l = i ? `${styleText("gray", S_BAR)}  ` : "", f = wrapTextWithPrefix(e.output, e.message, l, u), s = `${i ? `${styleText("gray", S_BAR)}
+` : ""}${f}
+`, c = this.value ? a : o;
+			switch (this.state) {
+				case "submit": return `${s}${i ? `${styleText("gray", S_BAR)}  ` : ""}${styleText("dim", c)}`;
+				case "cancel": return `${s}${i ? `${styleText("gray", S_BAR)}  ` : ""}${styleText(["strikethrough", "dim"], c)}${i ? `
+${styleText("gray", S_BAR)}` : ""}`;
+				default: {
+					const r = i ? `${styleText("cyan", S_BAR)}  ` : "", g = i ? styleText("cyan", S_BAR_END) : "";
+					return `${s}${r}${this.value ? `${styleText("green", S_RADIO_ACTIVE)} ${a}` : `${styleText("dim", S_RADIO_INACTIVE)} ${styleText("dim", a)}`}${e.vertical ? i ? `
+${styleText("cyan", S_BAR)}  ` : `
+` : ` ${styleText("dim", "/")} `}${this.value ? `${styleText("dim", S_RADIO_INACTIVE)} ${styleText("dim", o)}` : `${styleText("green", S_RADIO_ACTIVE)} ${o}`}
+${g}
+`;
+				}
+			}
+		}
+	}).prompt();
+};
 const MULTISELECT_INSTRUCTIONS = [
 	`${styleText("dim", "↑/↓")} to navigate`,
 	`${styleText("dim", "Space:")} select`,
@@ -6905,6 +6951,14 @@ function clackPrompter(streams = {}) {
 				initialValue
 			}));
 		},
+		async confirm(message, initialValue = true) {
+			return unwrapPrompt(await confirm({
+				message,
+				input,
+				output,
+				initialValue
+			}));
+		},
 		async multiselect(message, options, initialValues = [], hint) {
 			if (hint) output.write(`${import_picocolors.default.dim(hint)}\n`);
 			return unwrapPrompt(await multiselect({
@@ -7021,7 +7075,7 @@ function buildParser(onMatched) {
 	parser.command("commands", "Print the command catalog", () => {}, (argv) => {
 		onMatched({
 			argv,
-			run: async (ctx) => (await import("./commands-_R93Y2z-.mjs")).run(ctx)
+			run: async (ctx) => (await import("./commands-KKAq0m6z.mjs")).run(ctx)
 		});
 	});
 	parser.command("auth", "Manage credentials", (auth) => {
@@ -7101,7 +7155,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-C3cphIAl.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-BH59pgRw.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		skills.command("publish <paths..>", "Publish a local skill directory as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7129,7 +7183,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-C3cphIAl.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-BH59pgRw.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return skills.demandCommand(1);

package/dist/{skills-C3cphIAl.mjs → skills-BH59pgRw.mjs}

@@ -241,12 +241,12 @@ function readSkillPackage(buffer) {
 		if (seen.has(folded)) throw invalid$1(`entry ${JSON.stringify(name)} appears more than once`);
 		seen.add(folded);
 	}
-	const manifests = files.filter((entry) => lastSegment$1(entry.name).toLowerCase() === "skill.md");
-	if (manifests.length === 0) throw invalid$1("the package has no SKILL.md");
-	if (manifests.length > 1) throw invalid$1(`the package has more than one SKILL.md: ${manifests.map((entry) => entry.name).join(", ")}`);
 	const root = packageRoot$1(names);
 	const expectedManifest = `${root}SKILL.md`;
-	if (manifests[0]?.name !== expectedManifest) throw invalid$1(`found ${manifests[0]?.name}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	if (!files.find((entry) => entry.name === expectedManifest)) {
+		const manifests = files.filter((entry) => lastSegment$1(entry.name).toLowerCase() === "skill.md");
+		throw invalid$1(manifests.length === 0 ? "the package has no SKILL.md" : `found ${manifests.map((entry) => entry.name).join(", ")}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	}
 	let actualBytes = 0;
 	const entries = [];
 	let manifest;
@@ -455,11 +455,11 @@ async function packageSkillDirectory(dir) {
 		if (seen.has(folded)) throw invalid(`entry ${JSON.stringify(entry.path)} appears more than once`);
 		seen.add(folded);
 	}
-	const manifests = entries.filter((entry) => lastSegment(entry.path).toLowerCase() === "skill.md");
-	if (manifests.length === 0) throw invalid("the directory has no SKILL.md");
-	if (manifests.length > 1) throw invalid(`the directory has more than one SKILL.md: ${manifests.map((entry) => entry.path).join(", ")}`);
 	const expected = `${packageRoot(entries.map((entry) => entry.path))}SKILL.md`;
-	if (manifests[0]?.path !== expected) throw invalid(`found ${manifests[0]?.path}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	if (!entries.some((entry) => entry.path === expected)) {
+		const manifests = entries.filter((entry) => lastSegment(entry.path).toLowerCase() === "skill.md");
+		throw invalid(manifests.length === 0 ? "the directory has no SKILL.md" : `found ${manifests.map((entry) => entry.path).join(", ")}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	}
 	return {
 		zip: buildZip(entries),
 		fileCount: entries.length,
@@ -787,6 +787,47 @@ async function publish(ctx, argv) {
 		items
 	});
 }
+const FIND_CAPABILITIES = "find-capabilities";
+/** The follow-up question needs a yes/no prompter on both ends of a terminal. */
+function canConfirm(ctx) {
+	return ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && ctx.io.prompts?.confirm !== void 0;
+}
+/**
+* Whether any scope the caller would install into already holds find-capabilities.
+* A project install does not ask again when the global store has it, and the
+* reverse, so the offer appears only when nothing is installed yet.
+*/
+async function findCapabilitiesInstalled(ctx, agents, options) {
+	const scopes = options.dir ? [options.global] : [false, true];
+	for (const global of scopes) {
+		const plan = planInstall(process.cwd(), ctx.env, FIND_CAPABILITIES, agents, {
+			...options,
+			global
+		});
+		const paths = [...plan.canonical ? [plan.canonical] : [], ...plan.targets.map((target) => target.path)];
+		for (const path of paths) if (await pathExists(path)) return true;
+	}
+	return false;
+}
+/**
+* Offers the catalog's capability-discovery skill after a successful install so
+* an agent that just gained one capability can find the rest, Skills and MCP
+* servers alike. It is a convenience, not part of the request: an
+* already-installed copy or a failed download never makes the add itself fail
+* (a cancelled prompt still exits 130).
+*/
+async function offerFindCapabilities(ctx, connection, destNames, agents, options) {
+	const confirm = ctx.io.prompts?.confirm;
+	if (!confirm || destNames.includes(FIND_CAPABILITIES)) return;
+	if (await findCapabilitiesInstalled(ctx, agents, options)) return;
+	if (!await confirm(`Also install ${FIND_CAPABILITIES} (discover more capabilities)?`, true)) return;
+	try {
+		await addOne(ctx, connection, parseSkillPath(FIND_CAPABILITIES), FIND_CAPABILITIES, agents, options.dir, options.global, options.copy, { version: null });
+	} catch (err) {
+		if (err instanceof HngrError && err.exitCode !== 1) throw err;
+		ctx.summary(`warning: could not install ${FIND_CAPABILITIES}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
 async function add(ctx, argv) {
 	const rawPaths = positionalPaths(argv.paths);
 	if (rawPaths.length === 0) throw usage("No skill path given", "Pass one or more `<name>` or `<namespace>/<name>` arguments.");
@@ -812,6 +853,11 @@ async function add(ctx, argv) {
 		failure: failureResult
 	});
 	if (ctx.flags.json || !ctx.io.stdout.isTTY) ctx.writePayload({ results });
+	if (!ctx.flags.json && !ctx.flags.dryRun && !ctx.flags.quiet && !failed && canConfirm(ctx)) await offerFindCapabilities(ctx, connection, parsedPaths.map((parsed) => as ?? parsed.name), agents, {
+		dir,
+		global,
+		copy
+	});
 	if (!ctx.flags.json && !ctx.flags.dryRun && !ctx.flags.quiet && !failed && ctx.io.stderr.isTTY) ctx.io.prompts?.outro?.("Done! Review skills before use; they run with full agent permissions.");
 	return failed ? 1 : 0;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hngr",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "description": "The Hangar CLI: install skills and MCP servers into coding agents, and drive the Management API.",
   "keywords": [
     "hangar",