hngr 0.6.0 → 0.8.0

package/README.md

@@ -43,10 +43,25 @@ hngr mcp add pdf-tools --agent claude-code
 # another namespace
 hngr skills add team-a/pdf-tools --agent claude-code
 
+# choose several skills from a namespace in an interactive terminal
+hngr skills add team-a
+
+# expand a namespace without prompting; the trailing slash or /* is explicit
+hngr skills add team-a/ --all-skills --agent claude-code
+hngr skills add 'team-a/*' --all-skills --agent claude-code
+
 # pin a version
 hngr skills add pdf-tools@2026.10.25.1 --agent claude-code
 ```
 
+A bare name such as `team-a` first looks for `system/team-a`; only when that skill
+does not exist is the argument treated as a namespace to choose from. Write `team-a/`
+or `team-a/*` to mean the namespace unconditionally. In an interactive terminal a
+namespace opens a searchable multi-select, including when it holds only one skill;
+without a terminal, pass `--all-skills` to install every skill in it, or name each
+skill as `<namespace>/<name>`. A namespace cannot be version-pinned, and every
+selected skill still installs into its own `<name>` directory.
+
 The shared `.agents/skills` store is always installed, so every universal agent reads it
 without extra work. In an interactive terminal, omitting `--global` first asks whether to
 install for the current project or the user, then shows a multi-select of the agents that

package/dist/{catalog-r53AMymQ.mjs → catalog-qfvmyg4e.mjs}

@@ -42,6 +42,7 @@ const EXCLUDED_PATHS = [
 	"/api/v1/capabilities/{capability_id}/versions/{version}/content",
 	"/api/v1/capabilities/{capability_id}/versions/{version}/files",
 	"/api/v1/capabilities/{capability_id}/versions/{version}/file",
+	"/api/v1/capabilities/{capability_id}/versions/{version}/derive",
 	"/api/v1/auth/methods",
 	"/api/v1/auth/oidc/login",
 	"/api/v1/auth/oidc/callback",
@@ -1479,6 +1480,42 @@ const COMMANDS = deriveCommands({
 				}
 			}
 		},
+		"/api/v1/capabilities/{capability_id}/versions/{version}/derive": { "post": {
+			"operationId": "deriveCapabilityVersion",
+			"summary": "Publish a new Version by editing the files of the current Skill Version.",
+			"description": "Derives a new Version from the package of `{version}` by replacing the\nlisted entries and publishes it through the same pipeline as\n`publishCapabilityVersion`: CalVer allocation, the current-version\nswitch and the `capability.version_published` Audit Event all follow\nthe existing publishing rules. Only a Skill Capability accepts this\noperation; an MCP Capability answers 400.\n\n`{version}` must be the Capability's Current Version; any other CalVer\nanswers 409 `/problems/version-conflict`. The check runs again after\nthe Capability row is locked, so a concurrent publish is reported\nrather than silently replaced. Each `edits` path is matched exactly\nagainst a non-directory entry of the baseline package (case\nsensitive); an unknown path, a directory, a non-text entry, an entry\nlarger than 256 KiB, or more than 1 MiB of edits in total answers 400.\n\nThe new Version inherits the baseline Version's `readme` unchanged,\nincluding a null value, for which the existing display rule falls back\nto the package's `SKILL.md`. The request has no README field. This\noperation does not increment `download_count`.\n\nThe caller must manage the Capability's Namespace, under the same\nrules as `publishCapabilityVersion`: a deleted or unavailable\nCapability, one in an unusable Namespace, and a private one the caller\ndoes not manage answer 404. A replayed `Idempotency-Key` returns the\nfirst response without deriving again.\n",
+			"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
+			"parameters": [
+				{ "$ref": "#/components/parameters/CapabilityID" },
+				{
+					"name": "version",
+					"in": "path",
+					"required": true,
+					"schema": { "$ref": "#/components/schemas/CalVer" }
+				},
+				{ "$ref": "#/components/parameters/IdempotencyKey" }
+			],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeriveCapabilityVersionRequest" } } }
+			},
+			"responses": {
+				"201": {
+					"description": "The Capability with its new current version.",
+					"headers": { "Location": {
+						"description": "`/api/v1/capabilities/{capability_id}/versions/{version}`",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/Capability" } } }
+				},
+				"400": { "$ref": "#/components/responses/Problem" },
+				"401": { "$ref": "#/components/responses/Problem" },
+				"403": { "$ref": "#/components/responses/Problem" },
+				"404": { "$ref": "#/components/responses/Problem" },
+				"409": { "$ref": "#/components/responses/Problem" },
+				"default": { "$ref": "#/components/responses/Problem" }
+			}
+		} },
 		"/api/v1/capabilities/{capability_id}/versions/{version}/content": { "get": {
 			"operationId": "lookupCapabilityContent",
 			"summary": "Return the Content of one Version of a Capability.",
@@ -3412,6 +3449,34 @@ const COMMANDS = deriveCommands({
 				},
 				"additionalProperties": false
 			},
+			"DeriveCapabilityVersionRequest": {
+				"type": "object",
+				"required": ["edits"],
+				"properties": { "edits": {
+					"type": "array",
+					"description": "Entries to replace in the baseline package. Paths must be unique\nand must exist as non-directory entries of the baseline package.\n",
+					"minItems": 1,
+					"maxItems": 200,
+					"items": { "$ref": "#/components/schemas/DeriveCapabilityVersionEdit" }
+				} },
+				"additionalProperties": false
+			},
+			"DeriveCapabilityVersionEdit": {
+				"type": "object",
+				"required": ["path", "content"],
+				"properties": {
+					"path": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 4096
+					},
+					"content": {
+						"type": "string",
+						"description": "UTF-8 text. The server enforces 256 KiB per entry and 1 MiB for\nthe whole request by UTF-8 byte length.\n"
+					}
+				},
+				"additionalProperties": false
+			},
 			"Capability": {
 				"type": "object",
 				"required": [
@@ -4264,7 +4329,7 @@ function workflowCatalog() {
 				name: "path",
 				required: true,
 				variadic: true,
-				description: "<name> or <namespace>/<name>, optionally @<version>"
+				description: "<name>, <namespace>/<name>, or <namespace>/ and <namespace>/* to choose from a namespace; optionally @<version>"
 			}],
 			flags: [
 				{
@@ -4278,6 +4343,11 @@ function workflowCatalog() {
 					type: "boolean",
 					description: "Install to all known agents"
 				},
+				{
+					name: "all-skills",
+					type: "boolean",
+					description: "Install every skill in a namespace argument instead of prompting"
+				},
 				{
 					name: "global",
 					type: "boolean",

package/dist/{commands-_R93Y2z-.mjs → commands-39DynBwu.mjs}

@@ -1,4 +1,4 @@
-import { t as commandCatalog } from "./catalog-r53AMymQ.mjs";
+import { t as commandCatalog } from "./catalog-qfvmyg4e.mjs";
 // src/commands/commands.ts
 function run(ctx) {
 	const catalog = commandCatalog();

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-r53AMymQ.mjs";
+import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-qfvmyg4e.mjs";
 import { C as HngrError, S as CancelledError, c as redactUrlForDisplay, g as resolveConnection, i as buildRequestUrl, o as redactQuery, r as apiRequest, s as redactSensitive, u as DEFAULT_SERVER_URL, w as renderError } from "./http-DgHX7Fux.mjs";
 import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
 import { createRequire } from "node:module";
@@ -5279,7 +5279,7 @@ function isYargsInstance(y) {
 // ../../node_modules/.pnpm/yargs@18.2.0/node_modules/yargs/index.mjs
 const Yargs = YargsFactory(esm_default);
 // package.json
-var version = "0.6.0";
+var version = "0.8.0";
 // src/generated/completion.ts
 function isCompletionShell(value) {
 	return value === "bash" || value === "zsh" || value === "fish";
@@ -6429,6 +6429,86 @@ var y = class {
 		}
 	}
 };
+function p$1(l, e) {
+	if (l === void 0 || e.length === 0) return 0;
+	const i = e.findIndex((s) => s.value === l);
+	return i !== -1 ? i : 0;
+}
+function m$1(l, e) {
+	return (e.label ?? String(e.value)).toLowerCase().includes(l.toLowerCase());
+}
+function g(l, e) {
+	if (e) return l ? e : e[0];
+}
+let T$1 = class T extends y {
+	filteredOptions;
+	multiple;
+	isNavigating = false;
+	selectedValues = [];
+	focusedValue;
+	#e = 0;
+	#s = "";
+	#t;
+	#i;
+	#n;
+	#l;
+	get cursor() {
+		return this.#e;
+	}
+	get userInputWithCursor() {
+		if (!this.userInput) return styleText(["inverse", "hidden"], "_");
+		if (this._cursor >= this.userInput.length) return `${this.userInput}\u2588`;
+		const e = this.userInput.slice(0, this.cursor), t = this.userInput.slice(this.cursor, this.cursor + 1), i = this.userInput.slice(this.cursor + 1);
+		return `${e}${styleText("inverse", t)}${i}`;
+	}
+	get options() {
+		return typeof this.#i == "function" ? this.#i() : this.#i;
+	}
+	constructor(e) {
+		super(e), this.#i = e.options, this.#n = e.placeholder, this.#l = e.completeOnTab === true;
+		const t = this.options;
+		this.filteredOptions = [...t], this.multiple = e.multiple === true, this.#t = typeof e.options == "function" ? e.filter : e.filter ?? m$1;
+		let i;
+		if (e.initialValue && Array.isArray(e.initialValue) ? this.multiple ? i = e.initialValue : i = e.initialValue.slice(0, 1) : !this.multiple && this.options.length > 0 && (i = [this.options[0]?.value]), i) for (const s of i) {
+			const n = t.findIndex((r) => r.value === s);
+			n !== -1 && (this.toggleSelected(s), this.#e = n);
+		}
+		this.focusedValue = this.options[this.#e]?.value, this.on("key", (s, n) => this.#u(s, n)), this.on("userInput", (s) => this.#o(s));
+	}
+	_isActionKey(e, t) {
+		return e === "	" || this.multiple && this.isNavigating && t.name === "space" && e !== void 0 && e !== "";
+	}
+	#u(e, t) {
+		const i = t.name === "up", s = t.name === "down", n = t.name === "return", r = this.userInput === "" || this.userInput === "	", u = this.#n, d = this.options, c = u !== void 0 && u !== "" && d.some((o) => !o.disabled && (this.#t ? this.#t(u, o) : true));
+		if (t.name === "tab" && r && c) {
+			this.userInput === "	" && this._clearUserInput(), this._setUserInput(u, true), this.isNavigating = false;
+			return;
+		}
+		if (t.name === "tab" && this.#l && !this.multiple && this.focusedValue !== void 0) {
+			const o = String(this.focusedValue);
+			this._clearUserInput(), this._setUserInput(o, true), this.isNavigating = false;
+			return;
+		}
+		i || s ? (this.#e = findCursor(this.#e, i ? -1 : 1, this.filteredOptions), this.focusedValue = this.filteredOptions[this.#e]?.value, this.multiple || (this.selectedValues = [this.focusedValue]), this.isNavigating = true) : n ? this.value = g(this.multiple, this.selectedValues) : this.multiple ? this.focusedValue !== void 0 && (t.name === "tab" || this.isNavigating && t.name === "space") ? this.toggleSelected(this.focusedValue) : this.isNavigating = false : (this.focusedValue && (this.selectedValues = [this.focusedValue]), this.isNavigating = false);
+	}
+	deselectAll() {
+		this.selectedValues = [];
+	}
+	toggleSelected(e) {
+		this.filteredOptions.length !== 0 && (this.multiple ? this.selectedValues.includes(e) ? this.selectedValues = this.selectedValues.filter((t) => t !== e) : this.selectedValues = [...this.selectedValues, e] : this.selectedValues = [e]);
+	}
+	#o(e) {
+		if (e !== this.#s) {
+			this.#s = e;
+			const t = this.options;
+			e && this.#t ? this.filteredOptions = t.filter((n) => this.#t?.(e, n)) : this.filteredOptions = [...t];
+			const i = p$1(this.focusedValue, this.filteredOptions);
+			this.#e = findCursor(i, 0, this.filteredOptions);
+			const s = this.filteredOptions[this.#e];
+			s && !s.disabled ? this.focusedValue = s.value : this.focusedValue = void 0, this.multiple || (this.focusedValue !== void 0 ? this.toggleSelected(this.focusedValue) : this.deselectAll());
+		}
+	}
+};
 var r = class extends y {
 	get cursor() {
 		return this.value ? 0 : 1;
@@ -6650,6 +6730,66 @@ const limitOptions = ({ cursor: l, options: e, style: w, output: p = process.std
 	for (const t of s) for (const n of t) x.push(n);
 	return c && x.push(M), x;
 };
+function P(t, c) {
+	if (!t) return true;
+	const n = (c.label ?? String(c.value ?? "")).toLowerCase(), i = (c.hint ?? "").toLowerCase(), r = String(c.value).toLowerCase(), o = t.toLowerCase();
+	return n.includes(o) || i.includes(o) || r.includes(o);
+}
+const autocompleteMultiselect = (t) => {
+	const c = (i, r, o, m) => {
+		const p = o.includes(i.value), $ = i.label ?? String(i.value ?? ""), l = i.hint && m !== void 0 && i.value === m ? styleText("dim", ` (${i.hint})`) : "", s = p ? styleText("green", S_CHECKBOX_SELECTED) : styleText("dim", S_CHECKBOX_INACTIVE);
+		return i.disabled ? `${styleText("gray", S_CHECKBOX_INACTIVE)} ${styleText(["strikethrough", "gray"], $)}` : r ? `${s} ${$}${l}` : `${s} ${styleText("dim", $)}`;
+	}, n = new T$1({
+		options: t.options,
+		multiple: true,
+		placeholder: t.placeholder,
+		filter: t.filter ?? ((i, r) => P(i, r)),
+		validate: () => {
+			if (t.required && n.selectedValues.length === 0) return "Please select at least one item";
+		},
+		initialValue: t.initialValues,
+		signal: t.signal,
+		input: t.input,
+		output: t.output,
+		render() {
+			const i = t.withGuide ?? settings.withGuide, r = `${i ? `${styleText("gray", S_BAR)}
+` : ""}${symbol(this.state)}  ${t.message}
+`, o = this.userInput, m = t.placeholder, p = o === "" && m !== void 0, $ = this.isNavigating || p ? styleText("dim", p ? m : o) : this.userInputWithCursor, l = this.options, s = this.filteredOptions.length !== l.length ? styleText("dim", ` (${this.filteredOptions.length} match${this.filteredOptions.length === 1 ? "" : "es"})`) : "";
+			switch (this.state) {
+				case "submit": return `${r}${i ? `${styleText("gray", S_BAR)}  ` : ""}${styleText("dim", `${this.selectedValues.length} items selected`)}`;
+				case "cancel": return `${r}${i ? `${styleText("gray", S_BAR)}  ` : ""}${styleText(["strikethrough", "dim"], o)}`;
+				default: {
+					const a = this.state === "error" ? "yellow" : "cyan", u = i ? `${styleText(a, S_BAR)}  ` : "", V = i ? styleText(a, S_BAR_END) : "", b = [
+						`${styleText("dim", "↑/↓")} to navigate`,
+						`${styleText("dim", this.isNavigating ? "Space/Tab:" : "Tab:")} select`,
+						`${styleText("dim", "Enter:")} confirm`,
+						`${styleText("dim", "Type:")} to search`
+					], y = this.filteredOptions.length === 0 && o ? [`${u}${styleText("yellow", "No matches found")}`] : [], S = this.state === "error" ? [`${u}${styleText("yellow", this.error)}`] : [], g = [
+						...`${r}${i ? styleText(a, S_BAR) : ""}`.split(`
+`),
+						`${u}${styleText("dim", "Search:")} ${$}${s}`,
+						...y,
+						...S
+					], O = [`${u}${b.join(" • ")}`, V], d = limitOptions({
+						cursor: this.cursor,
+						options: this.filteredOptions,
+						style: (f, L) => c(f, L, this.selectedValues, this.focusedValue),
+						maxItems: t.maxItems,
+						output: t.output,
+						rowPadding: g.length + O.length
+					});
+					return [
+						...g,
+						...d.map((f) => `${u}${f}`),
+						...O
+					].join(`
+`);
+				}
+			}
+		}
+	});
+	return n.prompt();
+};
 const confirm = (e) => {
 	const a = e.active ?? "Yes", o = e.inactive ?? "No";
 	return new r({
@@ -6970,6 +7110,19 @@ function clackPrompter(streams = {}) {
 				required: false
 			}));
 		},
+		async searchableMultiselect(message, options, initialValues = [], hint) {
+			if (hint) output.write(`${import_picocolors.default.dim(hint)}\n`);
+			return unwrapPrompt(await autocompleteMultiselect({
+				message,
+				input,
+				output,
+				options,
+				initialValues,
+				required: false,
+				placeholder: "Type to search",
+				maxItems: 12
+			}));
+		},
 		note(message, title) {
 			output.write(`${import_picocolors.default.green("◇")}  ${title}\n`);
 			output.write(`${import_picocolors.default.dim("│")}\n`);
@@ -7075,7 +7228,7 @@ function buildParser(onMatched) {
 	parser.command("commands", "Print the command catalog", () => {}, (argv) => {
 		onMatched({
 			argv,
-			run: async (ctx) => (await import("./commands-_R93Y2z-.mjs")).run(ctx)
+			run: async (ctx) => (await import("./commands-39DynBwu.mjs")).run(ctx)
 		});
 	});
 	parser.command("auth", "Manage credentials", (auth) => {
@@ -7138,6 +7291,10 @@ function buildParser(onMatched) {
 			type: "boolean",
 			default: false,
 			describe: "Install to every known agent target"
+		}).option("all-skills", {
+			type: "boolean",
+			default: false,
+			describe: "Install every skill in a namespace argument instead of prompting"
 		}).option("global", {
 			type: "boolean",
 			default: false,
@@ -7155,7 +7312,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-B92ip3mJ.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-oCdToBxi.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		skills.command("publish <paths..>", "Publish a local skill directory as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7183,7 +7340,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-B92ip3mJ.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-oCdToBxi.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return skills.demandCommand(1);
@@ -7205,7 +7362,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-DjSU9C8z.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-CctR-PSK.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		mcp.command("publish <paths..>", "Publish an MCP snapshot as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7233,7 +7390,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-DjSU9C8z.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-CctR-PSK.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return mcp.demandCommand(1);

package/dist/{mcp-DjSU9C8z.mjs → mcp-CctR-PSK.mjs}

@@ -1,5 +1,5 @@
 import { C as HngrError, g as resolveConnection, s as redactSensitive, t as apiFetch, x as writeFileAtomically } from "./http-DgHX7Fux.mjs";
-import { S as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as parseCapabilityPath, c as runBatch, h as findAgentDefinition, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, v as MCP_KIND, x as resolveCapability } from "./scope-D8k2oa_W.mjs";
+import { S as parseCapabilityPath, T as resolveCapabilityVersion, _ as downloadContent, a as errorBody, c as runBatch, h as findAgentDefinition, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, v as MCP_KIND, w as resolveCapability } from "./scope-D5BF1Dv_.mjs";
 import { constants } from "node:fs";
 import { access, readFile, stat } from "node:fs/promises";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";

package/dist/{scope-D8k2oa_W.mjs → scope-D5BF1Dv_.mjs}

@@ -76,6 +76,37 @@ function parseCapabilityPath(raw, kind) {
 		version
 	};
 }
+/**
+* Parses a position argument into a concrete path, a bare name to probe, or an
+* explicit Namespace. `<namespace>/` and `<namespace>/*` always mean the
+* Namespace; a bare name is resolved by the caller because today it means
+* `system/<name>` while a miss may be a Namespace.
+*/
+function parseCapabilityTarget(raw, kind) {
+	const value = raw.trim();
+	if (value === "") throw usage$1(`A ${kind.noun} path is required`, "Pass `<name>`, `<namespace>/<name>`, `<namespace>/` or `<namespace>/*`.");
+	const at = value.lastIndexOf("@");
+	const base = at === -1 ? value : value.slice(0, at);
+	if (base.endsWith("/") || base.endsWith("/*")) {
+		if (at !== -1) throw usage$1(`Invalid ${kind.noun} path ${JSON.stringify(raw)}`, "A version cannot be pinned on a namespace; name each one as `<namespace>/<name>@<version>`.");
+		const namespace = base.endsWith("/*") ? base.slice(0, -2) : base.slice(0, -1);
+		if (namespace === "" || namespace.includes("/")) throw usage$1(`Invalid ${kind.noun} path ${JSON.stringify(raw)}`, "Use `<namespace>/` or `<namespace>/*`.");
+		checkNamePart(namespace, raw, kind.noun);
+		return {
+			kind: "namespace",
+			namespace
+		};
+	}
+	const parsed = parseCapabilityPath(value, kind);
+	if (!value.includes("/") && parsed.version === void 0) return {
+		kind: "probe",
+		parsed
+	};
+	return {
+		kind: "capability",
+		parsed
+	};
+}
 function candidateLabel(capability) {
 	return `${capability.id} (${capability.namespace}/${capability.name}, ${capability.kind})`;
 }
@@ -99,6 +130,19 @@ async function findCapability(connection, parsed, kind, signal) {
 	});
 	return matches[0] ?? null;
 }
+/**
+* Lists every readable Capability of one kind in one Namespace, newest-first
+* pages included, then sorted by name so a picker is stable across requests.
+* The server has no total; an empty array means nothing is readable there.
+*/
+async function listCapabilityNamespace(connection, namespace, kind, signal) {
+	return (await collectPages(CAPABILITIES_PATH, (cursor) => apiGet(connection, CAPABILITIES_PATH, {
+		kind: kind.kind,
+		namespace,
+		limit: 100,
+		cursor
+	}, { signal }))).filter((item) => item !== null && typeof item === "object" && item.kind === kind.kind && item.namespace === namespace && typeof item.name === "string").sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+}
 /** Resolves a path to exactly one Capability, or reports that it does not exist. */
 async function resolveCapability(connection, parsed, kind, signal) {
 	const capability = await findCapability(connection, parsed, kind, signal);
@@ -637,4 +681,4 @@ async function resolveInstallScope(ctx, global) {
 	if (!select || ctx.flags.json || !ctx.io.stdin.isTTY || !ctx.io.stdout.isTTY) return "project";
 	return await select("Install scope", SCOPE_OPTIONS, "project") === "global" ? "global" : "project";
 }
-export { resolveCapabilityVersion as S, downloadContent as _, errorBody as a, parseCapabilityPath as b, runBatch as c, installAtomically as d, linkAtomically as f, homeDir as g, findAgentDefinition as h, runPublish as i, stringValues as l, AGENTS as m, explicitName as n, failedResult as o, pathExists as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, copyAtomically as u, MCP_KIND as v, resolveCapability as x, SKILL_KIND as y };
+export { parseCapabilityTarget as C, parseCapabilityPath as S, resolveCapabilityVersion as T, downloadContent as _, errorBody as a, findCapability as b, runBatch as c, installAtomically as d, linkAtomically as f, homeDir as g, findAgentDefinition as h, runPublish as i, stringValues as l, AGENTS as m, explicitName as n, failedResult as o, pathExists as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, copyAtomically as u, MCP_KIND as v, resolveCapability as w, listCapabilityNamespace as x, SKILL_KIND as y };

package/dist/{skills-B92ip3mJ.mjs → skills-oCdToBxi.mjs}

@@ -1,5 +1,5 @@
 import { C as HngrError, g as resolveConnection, r as apiRequest } from "./http-DgHX7Fux.mjs";
-import { S as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as parseCapabilityPath, c as runBatch, d as installAtomically, f as linkAtomically, g as homeDir, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as copyAtomically, x as resolveCapability, y as SKILL_KIND } from "./scope-D8k2oa_W.mjs";
+import { C as parseCapabilityTarget, S as parseCapabilityPath, T as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as findCapability, c as runBatch, d as installAtomically, f as linkAtomically, g as homeDir, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as copyAtomically, w as resolveCapability, x as listCapabilityNamespace, y as SKILL_KIND } from "./scope-D5BF1Dv_.mjs";
 import { lstat, readFile, readdir } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -241,12 +241,12 @@ function readSkillPackage(buffer) {
 		if (seen.has(folded)) throw invalid$1(`entry ${JSON.stringify(name)} appears more than once`);
 		seen.add(folded);
 	}
-	const manifests = files.filter((entry) => lastSegment$1(entry.name).toLowerCase() === "skill.md");
-	if (manifests.length === 0) throw invalid$1("the package has no SKILL.md");
-	if (manifests.length > 1) throw invalid$1(`the package has more than one SKILL.md: ${manifests.map((entry) => entry.name).join(", ")}`);
 	const root = packageRoot$1(names);
 	const expectedManifest = `${root}SKILL.md`;
-	if (manifests[0]?.name !== expectedManifest) throw invalid$1(`found ${manifests[0]?.name}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	if (!files.find((entry) => entry.name === expectedManifest)) {
+		const manifests = files.filter((entry) => lastSegment$1(entry.name).toLowerCase() === "skill.md");
+		throw invalid$1(manifests.length === 0 ? "the package has no SKILL.md" : `found ${manifests.map((entry) => entry.name).join(", ")}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	}
 	let actualBytes = 0;
 	const entries = [];
 	let manifest;
@@ -455,17 +455,30 @@ async function packageSkillDirectory(dir) {
 		if (seen.has(folded)) throw invalid(`entry ${JSON.stringify(entry.path)} appears more than once`);
 		seen.add(folded);
 	}
-	const manifests = entries.filter((entry) => lastSegment(entry.path).toLowerCase() === "skill.md");
-	if (manifests.length === 0) throw invalid("the directory has no SKILL.md");
-	if (manifests.length > 1) throw invalid(`the directory has more than one SKILL.md: ${manifests.map((entry) => entry.path).join(", ")}`);
 	const expected = `${packageRoot(entries.map((entry) => entry.path))}SKILL.md`;
-	if (manifests[0]?.path !== expected) throw invalid(`found ${manifests[0]?.path}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	if (!entries.some((entry) => entry.path === expected)) {
+		const manifests = entries.filter((entry) => lastSegment(entry.path).toLowerCase() === "skill.md");
+		throw invalid(manifests.length === 0 ? "the directory has no SKILL.md" : `found ${manifests.map((entry) => entry.path).join(", ")}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	}
 	return {
 		zip: buildZip(entries),
 		fileCount: entries.length,
 		byteCount: totals.bytes
 	};
 }
+// src/terminal-text.ts
+/**
+* Catalog text is publisher-controlled. Keep a single line safe to draw in a
+* terminal: drop ANSI escape sequences and remaining control characters,
+* collapse whitespace, and cap the length. Skill names are already validated,
+* but descriptions are not.
+*/
+const ESCAPE_SEQUENCE = /\u001b(?:\[[0-?]*[ -/]*[@-~]|\][^\u0007]*(?:\u0007|\u001b\\)|[P^_][\s\S]*?\u001b\\|[@-_])/g;
+const CONTROL_CHARACTER = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g;
+function terminalText(value, maxLength = 80) {
+	const cleaned = value.replace(ESCAPE_SEQUENCE, "").replace(CONTROL_CHARACTER, " ").replace(/\s+/g, " ").trim();
+	return Array.from(cleaned).slice(0, maxLength).join("");
+}
 // src/commands/skills.ts
 function usage(title, detail) {
 	return new HngrError({
@@ -498,12 +511,11 @@ function noAgentSelectionError(examplePath, global) {
 }
 const ALL_AGENTS = "__all__";
 /**
-* One multi-select for the agents that keep their own skills directory.
-* `.agents` is always installed, so universal agents never appear here.
-* Detection only preselects; a non-TTY invocation never consults the
-* filesystem and must pass --agent or --all.
+* The agents named by flags, or null when a terminal must choose. Resolving
+* this without prompting lets a non-TTY invocation fail before any network
+* call, even when the arguments also include a namespace to expand.
 */
-async function selectAgents(ctx, argv, examplePath, global) {
+function requestedAgents(argv) {
 	const requested = stringValues(argv.agent);
 	if (requested.length > 0) {
 		const unknown = requested.filter((id) => findAgent(id) === void 0);
@@ -511,6 +523,16 @@ async function selectAgents(ctx, argv, examplePath, global) {
 		return AGENT_TARGETS.filter((agent) => requested.includes(agent.id));
 	}
 	if (argv.all === true) return [...AGENT_TARGETS];
+	return null;
+}
+/**
+* One multi-select for the agents that keep their own skills directory.
+* `.agents` is always installed, so universal agents never appear here.
+* Detection only preselects; a non-TTY invocation never consults the
+* filesystem and must pass --agent or --all.
+*/
+async function selectAgents(ctx, requested, examplePath, global) {
+	if (requested !== null) return requested;
 	const multiselect = ctx.io.prompts?.multiselect;
 	if (!canPrompt(ctx) || !multiselect) throw noAgentSelectionError(examplePath, global);
 	const cwd = process.cwd();
@@ -546,6 +568,217 @@ function frontmatterName(manifest) {
 function assertNotReserved(name) {
 	if (isReservedDirName(name)) throw usage(`Reserved directory name: ${name}`, "The names `synced` and `anthropic-skills` are reserved for agent-owned skill stores.");
 }
+function capabilityRef(namespace, name) {
+	return `${namespace}/${name}`;
+}
+function skillHint(capability) {
+	const description = typeof capability.description === "string" ? terminalText(capability.description) : "";
+	if (description !== "") return description;
+	return capability.current_version ? `v${capability.current_version}` : "";
+}
+/** A namespace picker needs a TTY and either multi-select implementation. */
+function canSelectSkills(ctx) {
+	return !ctx.flags.json && ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && (ctx.io.prompts?.searchableMultiselect !== void 0 || ctx.io.prompts?.multiselect !== void 0);
+}
+async function promptForSkills(ctx, candidates) {
+	const namespaces = new Set(candidates.map((capability) => capability.namespace));
+	const options = candidates.map((capability) => ({
+		value: capability.id,
+		label: namespaces.size === 1 ? capability.name : capabilityRef(capability.namespace, capability.name),
+		hint: skillHint(capability)
+	}));
+	const prompt = ctx.io.prompts;
+	const message = "Select skills to install";
+	const hint = "space to select · enter to install · nothing selected installs nothing";
+	let selected = [];
+	if (prompt?.searchableMultiselect) selected = await prompt.searchableMultiselect(message, options, [], hint);
+	else if (prompt?.multiselect) selected = await prompt.multiselect(message, options, [], hint);
+	const byId = new Map(candidates.map((capability) => [capability.id, capability]));
+	const chosen = selected.flatMap((id) => {
+		const capability = byId.get(id);
+		return capability ? [capability] : [];
+	});
+	if (chosen.length === 0) ctx.summary("No skills selected.");
+	return chosen;
+}
+function emptyExpansionError(expansion) {
+	if (expansion.origin !== void 0) return new HngrError({
+		type: "api",
+		title: `No skill named ${expansion.origin.namespace}/${expansion.origin.name}`,
+		detail: `There are also no readable skills in the ${JSON.stringify(expansion.namespace)} namespace.`
+	});
+	return new HngrError({
+		type: "api",
+		title: `No readable skills in namespace ${expansion.namespace}`,
+		detail: "Check the Namespace name, or list the catalog with `hngr capabilities list`."
+	});
+}
+/** Keeps the first occurrence, but an explicitly pinned version outranks a bare one. */
+function dedupeUnits(units) {
+	const index = /* @__PURE__ */ new Map();
+	const result = [];
+	for (const unit of units) {
+		const key = capabilityRef(unit.parsed.namespace, unit.parsed.name);
+		const existing = index.get(key);
+		if (existing === void 0) {
+			index.set(key, result.length);
+			result.push(unit);
+			continue;
+		}
+		const current = result[existing];
+		if (current === void 0) continue;
+		if (unit.kind === "skill" && unit.parsed.version !== void 0 && current.kind === "skill" && current.parsed.version === void 0) result[existing] = unit;
+	}
+	return result;
+}
+/**
+* Resolves position arguments into install units. Explicit paths stay in input
+* order; each namespace's selection is inserted at its first position. A bare
+* name probes `system/<name>` first, so today's meaning always wins.
+*/
+async function resolveAddUnits(ctx, connection, targets, allSkills) {
+	const pending = [];
+	const expansions = /* @__PURE__ */ new Map();
+	const expand = (namespace, origin) => {
+		const existing = expansions.get(namespace);
+		if (existing === void 0) expansions.set(namespace, {
+			namespace,
+			origin,
+			candidates: []
+		});
+		else if (existing.origin === void 0) existing.origin = origin;
+		pending.push({
+			kind: "namespace",
+			namespace
+		});
+	};
+	for (const target of targets) {
+		if (target.kind === "capability") {
+			pending.push({
+				kind: "unit",
+				unit: {
+					kind: "skill",
+					parsed: target.parsed
+				}
+			});
+			continue;
+		}
+		if (target.kind === "probe") {
+			try {
+				const found = await findCapability(connection, target.parsed, SKILL_KIND);
+				if (found !== null) {
+					pending.push({
+						kind: "unit",
+						unit: {
+							kind: "skill",
+							parsed: target.parsed,
+							capability: found
+						}
+					});
+					continue;
+				}
+			} catch (err) {
+				if (err instanceof HngrError && err.exitCode !== 1) throw err;
+				pending.push({
+					kind: "unit",
+					unit: {
+						kind: "failure",
+						parsed: target.parsed,
+						error: err
+					}
+				});
+				continue;
+			}
+			expand(target.parsed.name, target.parsed);
+			continue;
+		}
+		expand(target.namespace);
+	}
+	const candidates = [];
+	for (const expansion of expansions.values()) {
+		try {
+			expansion.candidates = await listCapabilityNamespace(connection, expansion.namespace, SKILL_KIND);
+		} catch (err) {
+			if (err instanceof HngrError && err.exitCode !== 1) throw err;
+			expansion.error = err;
+			continue;
+		}
+		if (expansion.candidates.length > 0) candidates.push(...expansion.candidates);
+	}
+	const unique = /* @__PURE__ */ new Map();
+	for (const capability of candidates) unique.set(capabilityRef(capability.namespace, capability.name), capability);
+	const allCandidates = [...unique.values()].sort((a, b) => {
+		const left = capabilityRef(a.namespace, a.name);
+		const right = capabilityRef(b.namespace, b.name);
+		return left < right ? -1 : left > right ? 1 : 0;
+	});
+	let chosen;
+	if (allCandidates.length === 0) chosen = [];
+	else if (allSkills) chosen = allCandidates;
+	else if (!canSelectSkills(ctx)) throw usage("Cannot choose skills from a namespace without a terminal", "Pass --all-skills to install every skill in the namespace, or name each skill as `<namespace>/<name>`.");
+	else chosen = await promptForSkills(ctx, allCandidates);
+	const chosenRefs = new Set(chosen.map((capability) => capabilityRef(capability.namespace, capability.name)));
+	const units = [];
+	for (const entry of pending) {
+		if (entry.kind === "unit") {
+			units.push(entry.unit);
+			continue;
+		}
+		const expansion = expansions.get(entry.namespace);
+		if (expansion === void 0) continue;
+		if (expansion.error !== void 0) {
+			units.push({
+				kind: "failure",
+				parsed: expansion.origin ?? {
+					namespace: expansion.namespace,
+					name: "*"
+				},
+				error: expansion.error
+			});
+			continue;
+		}
+		if (expansion.candidates.length === 0) {
+			units.push({
+				kind: "failure",
+				parsed: expansion.origin ?? {
+					namespace: expansion.namespace,
+					name: "*"
+				},
+				error: emptyExpansionError(expansion)
+			});
+			continue;
+		}
+		for (const capability of expansion.candidates) {
+			if (!chosenRefs.has(capabilityRef(capability.namespace, capability.name))) continue;
+			units.push({
+				kind: "skill",
+				parsed: {
+					namespace: capability.namespace,
+					name: capability.name
+				},
+				capability
+			});
+		}
+	}
+	return {
+		units: dedupeUnits(units),
+		expanded: expansions.size > 0
+	};
+}
+function assertAddPlan(units, as, expanded) {
+	if (as !== void 0 && expanded) throw usage("--as cannot be used with a namespace", "Pass one explicit `<namespace>/<name>` instead.");
+	const skills = units.filter((unit) => unit.kind === "skill");
+	if (as !== void 0 && skills.length !== 1) throw usage("--as requires exactly one skill", `This command resolves to ${skills.length} skills; install them without --as.`);
+	const destinations = /* @__PURE__ */ new Map();
+	for (const unit of skills) {
+		const destName = as ?? unit.parsed.name;
+		assertNotReserved(destName);
+		const ref = capabilityRef(unit.parsed.namespace, unit.parsed.name);
+		const existing = destinations.get(destName);
+		if (existing !== void 0 && existing !== ref) throw usage(`Two skills would install as ${JSON.stringify(destName)}`, `${existing} and ${ref} both use that directory name; install them separately.`);
+		destinations.set(destName, ref);
+	}
+}
 function planInstall(cwd, env, destName, agents, options) {
 	if (options.dir) {
 		const base = resolve(cwd, options.dir);
@@ -644,8 +877,8 @@ function installSummary(outcome, canonicalPath) {
 	if (failed.length > 0) lines.push(`  failed: ${failed.map((target) => target.path).join(", ")}`);
 	return lines.join("\n");
 }
-async function addOne(ctx, connection, parsed, destName, agents, dir, global, copy, state) {
-	const capability = await resolveSkill(connection, parsed);
+async function addOne(ctx, connection, parsed, destName, agents, dir, global, copy, state, resolved) {
+	const capability = resolved ?? await resolveSkill(connection, parsed);
 	const version = resolveVersion(capability, parsed);
 	state.version = version;
 	const plan = planInstall(process.cwd(), ctx.env, destName, agents, {
@@ -830,30 +1063,45 @@ async function offerFindCapabilities(ctx, connection, destNames, agents, options
 }
 async function add(ctx, argv) {
 	const rawPaths = positionalPaths(argv.paths);
-	if (rawPaths.length === 0) throw usage("No skill path given", "Pass one or more `<name>` or `<namespace>/<name>` arguments.");
-	const parsedPaths = rawPaths.map(parseSkillPath);
+	if (rawPaths.length === 0) throw usage("No skill path given", "Pass one or more `<name>`, `<namespace>/<name>`, `<namespace>/` or `<namespace>/*` arguments.");
+	const targets = rawPaths.map((raw) => parseCapabilityTarget(raw, SKILL_KIND));
 	const dir = stringFlag(argv, "dir");
 	const as = stringFlag(argv, "as");
 	if (as !== void 0 && (as.includes("/") || as.includes("\\") || as === "." || as === "..")) throw usage(`Invalid --as name ${JSON.stringify(as)}`, "Pass a single directory name.");
 	const requestedGlobal = argv.global === true;
 	const copy = argv.copy === true;
+	const allSkills = argv.allSkills === true;
 	if (dir !== void 0 && requestedGlobal) throw usage("--dir cannot be combined with --global");
 	if (dir !== void 0 && (stringValues(argv.agent).length > 0 || argv.all === true)) throw usage("--dir cannot be combined with --agent or --all");
 	if (as !== void 0) assertNotReserved(as);
-	for (const parsed of parsedPaths) assertNotReserved(as ?? parsed.name);
-	const global = dir === void 0 ? await resolveInstallScope(ctx, requestedGlobal) === "global" : false;
-	const agents = dir === void 0 ? await selectAgents(ctx, argv, rawPaths[0] ?? "", global) : [];
+	if (as !== void 0 && targets.some((target) => target.kind === "namespace")) throw usage("--as cannot be used with a namespace", "Pass one explicit `<namespace>/<name>` instead.");
+	for (const target of targets) {
+		if (target.kind === "namespace") continue;
+		assertNotReserved(as ?? target.parsed.name);
+	}
+	const requested = dir === void 0 ? requestedAgents(argv) : [];
+	if (dir === void 0 && requested === null && !canPrompt(ctx)) throw noAgentSelectionError(rawPaths[0] ?? "", requestedGlobal);
 	const connection = await resolveConnection(ctx.flags, ctx.env);
+	const { units, expanded } = await resolveAddUnits(ctx, connection, targets, allSkills);
+	if (units.length === 0) return 0;
+	assertAddPlan(units, as, expanded);
+	const installable = units.some((unit) => unit.kind === "skill");
+	const global = dir === void 0 && installable ? await resolveInstallScope(ctx, requestedGlobal) === "global" : false;
+	const agents = dir === void 0 && installable ? await selectAgents(ctx, requested, rawPaths[0] ?? "", global) : [];
+	const unitByRef = new Map(units.map((unit) => [capabilityRef(unit.parsed.namespace, unit.parsed.name), unit]));
 	const { results, failed } = await runBatch({
 		ctx,
-		paths: parsedPaths,
+		paths: units.map((unit) => unit.parsed),
 		run: async (parsed, state) => {
-			return (await addOne(ctx, connection, parsed, as ?? parsed.name, agents, dir, global, copy, state)).result;
+			const unit = unitByRef.get(capabilityRef(parsed.namespace, parsed.name));
+			if (unit?.kind === "failure") throw unit.error;
+			return (await addOne(ctx, connection, parsed, as ?? parsed.name, agents, dir, global, copy, state, unit?.capability)).result;
 		},
 		failure: failureResult
 	});
 	if (ctx.flags.json || !ctx.io.stdout.isTTY) ctx.writePayload({ results });
-	if (!ctx.flags.json && !ctx.flags.dryRun && !ctx.flags.quiet && !failed && canConfirm(ctx)) await offerFindCapabilities(ctx, connection, parsedPaths.map((parsed) => as ?? parsed.name), agents, {
+	const destNames = units.filter((unit) => unit.kind === "skill").map((unit) => as ?? unit.parsed.name);
+	if (!ctx.flags.json && !ctx.flags.dryRun && !ctx.flags.quiet && !failed && canConfirm(ctx)) await offerFindCapabilities(ctx, connection, destNames, agents, {
 		dir,
 		global,
 		copy

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hngr",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "The Hangar CLI: install skills and MCP servers into coding agents, and drive the Management API.",
   "keywords": [
     "hangar",