hngr 0.7.0 → 0.9.0

package/README.md

@@ -13,13 +13,13 @@ hngr --version
 ## Authenticate
 
 ```sh
-# Interactive: username and password against http://10.199.100.24:26434 (the
+# Interactive: username and password against https://hangar.paykka.com (the
 # built-in default), then an access token is written to
 # ~/.config/hngr/config.json (0600).
 hngr auth login
 
-# A different deployment. The built-in default is plain http on a private
-# network; any other host needs https:// (or an explicit --insecure).
+# A different deployment. Any non-local host needs https:// (or an explicit
+# --insecure).
 hngr auth login --server https://hangar.example.com
 
 # CI or containers: read an existing access token from stdin.
@@ -43,10 +43,25 @@ hngr mcp add pdf-tools --agent claude-code
 # another namespace
 hngr skills add team-a/pdf-tools --agent claude-code
 
+# choose several skills from a namespace in an interactive terminal
+hngr skills add team-a
+
+# expand a namespace without prompting; the trailing slash or /* is explicit
+hngr skills add team-a/ --all-skills --agent claude-code
+hngr skills add 'team-a/*' --all-skills --agent claude-code
+
 # pin a version
 hngr skills add pdf-tools@2026.10.25.1 --agent claude-code
 ```
 
+A bare name such as `team-a` first looks for `system/team-a`; only when that skill
+does not exist is the argument treated as a namespace to choose from. Write `team-a/`
+or `team-a/*` to mean the namespace unconditionally. In an interactive terminal a
+namespace opens a searchable multi-select, including when it holds only one skill;
+without a terminal, pass `--all-skills` to install every skill in it, or name each
+skill as `<namespace>/<name>`. A namespace cannot be version-pinned, and every
+selected skill still installs into its own `<name>` directory.
+
 The shared `.agents/skills` store is always installed, so every universal agent reads it
 without extra work. In an interactive terminal, omitting `--global` first asks whether to
 install for the current project or the user, then shows a multi-select of the agents that

package/dist/{auth-ByGgd_Yn.mjs → auth-CQkOtVxv.mjs}

@@ -1,4 +1,4 @@
-import { C as HngrError, d as configFilePath, f as deleteStoredConfig, g as resolveConnection, h as redactUrl, m as readStoredConfig, n as apiGet, p as normalizeServerUrl, t as apiFetch, v as storedAudience, y as writeStoredConfig } from "./http-DgHX7Fux.mjs";
+import { C as HngrError, d as configFilePath, f as deleteStoredConfig, g as resolveConnection, h as redactUrl, m as readStoredConfig, n as apiGet, p as normalizeServerUrl, t as apiFetch, v as storedAudience, y as writeStoredConfig } from "./http-CLG2jrIE.mjs";
 import { hostname } from "node:os";
 import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
@@ -60,8 +60,8 @@ function canPrompt(ctx) {
 	return ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && ctx.io.prompts !== void 0;
 }
 /**
-* Enforces https everywhere; http only for localhost, 127.0.0.1, [::1], the
-* built-in default, or with an explicit --insecure.
+* Enforces https everywhere; http only for localhost, 127.0.0.1, [::1], or
+* with an explicit --insecure.
 */
 function assertServerUrlAllowed(raw, insecure) {
 	const server = normalizeServerUrl(raw);
@@ -72,7 +72,7 @@ function assertServerUrlAllowed(raw, insecure) {
 			"localhost",
 			"127.0.0.1",
 			"[::1]"
-		].includes(url.hostname) || insecure || server === "http://10.199.100.24:26434") return server;
+		].includes(url.hostname) || insecure) return server;
 		throw new HngrError({
 			type: "config",
 			title: `Refusing insecure server URL ${redactUrl(server)}`,
@@ -114,7 +114,7 @@ async function revokePreviousToken(ctx, stored) {
 async function login(ctx, argv) {
 	if (ctx.env.HANGAR_TOKEN) throw envTokenRefusal();
 	const stored = await readStoredConfig(ctx.env);
-	const server = assertServerUrlAllowed(ctx.flags.server ?? ctx.env.HANGAR_URL ?? stored?.server ?? "http://10.199.100.24:26434", ctx.flags.insecure);
+	const server = assertServerUrlAllowed(ctx.flags.server ?? ctx.env.HANGAR_URL ?? stored?.server ?? "https://hangar.paykka.com", ctx.flags.insecure);
 	if (stored?.token && !ctx.flags.force) try {
 		const me = asStoredPrincipal(await apiGet({
 			server,

package/dist/{catalog-yVsOzNKU.mjs → catalog-CmtREMFr.mjs}

@@ -1242,7 +1242,7 @@ const COMMANDS = deriveCommands({
 			"get": {
 				"operationId": "listCapabilities",
 				"summary": "List the Capabilities the caller can read, newest first.",
-				"description": "Reads follow the rules of `lookupCapability`. Filters combine with\nAND. The list is ordered by `created_at` then `id`, both descending,\nand paged by cursor without a total.\n",
+				"description": "Reads follow the rules of `lookupCapability`. Filters combine with\nAND. The list is ordered by `created_at` then `id`, both descending,\nand paged by cursor. `total` counts every Capability matching the\nfilters, independent of the cursor.\n",
 				"security": [
 					{},
 					{ "sessionCookie": [] },
@@ -3660,13 +3660,23 @@ const COMMANDS = deriveCommands({
 			},
 			"CapabilityList": {
 				"type": "object",
-				"required": ["items", "next_cursor"],
+				"required": [
+					"items",
+					"next_cursor",
+					"total"
+				],
 				"properties": {
 					"items": {
 						"type": "array",
 						"items": { "$ref": "#/components/schemas/Capability" }
 					},
-					"next_cursor": { "$ref": "#/components/schemas/NextCursor" }
+					"next_cursor": { "$ref": "#/components/schemas/NextCursor" },
+					"total": {
+						"type": "integer",
+						"format": "int64",
+						"minimum": 0,
+						"description": "The number of Capabilities matching the filters, independent of the cursor."
+					}
 				}
 			},
 			"VersionSummary": {
@@ -4329,7 +4339,7 @@ function workflowCatalog() {
 				name: "path",
 				required: true,
 				variadic: true,
-				description: "<name> or <namespace>/<name>, optionally @<version>"
+				description: "<name>, <namespace>/<name>, or <namespace>/ and <namespace>/* to choose from a namespace; optionally @<version>"
 			}],
 			flags: [
 				{
@@ -4343,6 +4353,11 @@ function workflowCatalog() {
 					type: "boolean",
 					description: "Install to all known agents"
 				},
+				{
+					name: "all-skills",
+					type: "boolean",
+					description: "Install every skill in a namespace argument instead of prompting"
+				},
 				{
 					name: "global",
 					type: "boolean",

package/dist/{commands-KKAq0m6z.mjs → commands-Bjui8-Nt.mjs}

@@ -1,4 +1,4 @@
-import { t as commandCatalog } from "./catalog-yVsOzNKU.mjs";
+import { t as commandCatalog } from "./catalog-CmtREMFr.mjs";
 // src/commands/commands.ts
 function run(ctx) {
 	const catalog = commandCatalog();

package/dist/{http-DgHX7Fux.mjs → http-CLG2jrIE.mjs}

@@ -171,7 +171,7 @@ async function readStoredConfig(env) {
 * The instance the CLI talks to when `--server`, `HANGAR_URL` and the config
 * file are all absent. Point a deployment elsewhere with any of those.
 */
-const DEFAULT_SERVER_URL = "http://10.199.100.24:26434";
+const DEFAULT_SERVER_URL = "https://hangar.paykka.com";
 const INVALID_SERVER_DETAIL = "Pass --server <url>, set HANGAR_URL, or run `hngr auth login` to store one in the config file.";
 /** Parses and normalizes a server URL (no trailing slash); invalid input is a config error. */
 function normalizeServerUrl(server) {
@@ -225,7 +225,7 @@ async function deleteStoredConfig(env) {
 */
 async function resolveConnection(flags, env) {
 	const config = await readStoredConfig(env);
-	const server = flags.server ?? env.HANGAR_URL ?? config?.server ?? "http://10.199.100.24:26434";
+	const server = flags.server ?? env.HANGAR_URL ?? config?.server ?? "https://hangar.paykka.com";
 	const token = env.HANGAR_TOKEN ?? config?.token;
 	return {
 		server: normalizeServerUrl(server),

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-yVsOzNKU.mjs";
-import { C as HngrError, S as CancelledError, c as redactUrlForDisplay, g as resolveConnection, i as buildRequestUrl, o as redactQuery, r as apiRequest, s as redactSensitive, u as DEFAULT_SERVER_URL, w as renderError } from "./http-DgHX7Fux.mjs";
-import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
+import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-CmtREMFr.mjs";
+import { C as HngrError, S as CancelledError, c as redactUrlForDisplay, g as resolveConnection, i as buildRequestUrl, o as redactQuery, r as apiRequest, s as redactSensitive, u as DEFAULT_SERVER_URL, w as renderError } from "./http-CLG2jrIE.mjs";
+import { t as collectPages } from "./pagination-DtoXmj2F.mjs";
 import { createRequire } from "node:module";
 import { notStrictEqual, strictEqual } from "assert";
 import { basename, dirname, extname, join, normalize, relative, resolve } from "path";
@@ -5279,7 +5279,7 @@ function isYargsInstance(y) {
 // ../../node_modules/.pnpm/yargs@18.2.0/node_modules/yargs/index.mjs
 const Yargs = YargsFactory(esm_default);
 // package.json
-var version = "0.7.0";
+var version = "0.9.0";
 // src/generated/completion.ts
 function isCompletionShell(value) {
 	return value === "bash" || value === "zsh" || value === "fish";
@@ -6429,6 +6429,86 @@ var y = class {
 		}
 	}
 };
+function p$1(l, e) {
+	if (l === void 0 || e.length === 0) return 0;
+	const i = e.findIndex((s) => s.value === l);
+	return i !== -1 ? i : 0;
+}
+function m$1(l, e) {
+	return (e.label ?? String(e.value)).toLowerCase().includes(l.toLowerCase());
+}
+function g(l, e) {
+	if (e) return l ? e : e[0];
+}
+let T$1 = class T extends y {
+	filteredOptions;
+	multiple;
+	isNavigating = false;
+	selectedValues = [];
+	focusedValue;
+	#e = 0;
+	#s = "";
+	#t;
+	#i;
+	#n;
+	#l;
+	get cursor() {
+		return this.#e;
+	}
+	get userInputWithCursor() {
+		if (!this.userInput) return styleText(["inverse", "hidden"], "_");
+		if (this._cursor >= this.userInput.length) return `${this.userInput}\u2588`;
+		const e = this.userInput.slice(0, this.cursor), t = this.userInput.slice(this.cursor, this.cursor + 1), i = this.userInput.slice(this.cursor + 1);
+		return `${e}${styleText("inverse", t)}${i}`;
+	}
+	get options() {
+		return typeof this.#i == "function" ? this.#i() : this.#i;
+	}
+	constructor(e) {
+		super(e), this.#i = e.options, this.#n = e.placeholder, this.#l = e.completeOnTab === true;
+		const t = this.options;
+		this.filteredOptions = [...t], this.multiple = e.multiple === true, this.#t = typeof e.options == "function" ? e.filter : e.filter ?? m$1;
+		let i;
+		if (e.initialValue && Array.isArray(e.initialValue) ? this.multiple ? i = e.initialValue : i = e.initialValue.slice(0, 1) : !this.multiple && this.options.length > 0 && (i = [this.options[0]?.value]), i) for (const s of i) {
+			const n = t.findIndex((r) => r.value === s);
+			n !== -1 && (this.toggleSelected(s), this.#e = n);
+		}
+		this.focusedValue = this.options[this.#e]?.value, this.on("key", (s, n) => this.#u(s, n)), this.on("userInput", (s) => this.#o(s));
+	}
+	_isActionKey(e, t) {
+		return e === "	" || this.multiple && this.isNavigating && t.name === "space" && e !== void 0 && e !== "";
+	}
+	#u(e, t) {
+		const i = t.name === "up", s = t.name === "down", n = t.name === "return", r = this.userInput === "" || this.userInput === "	", u = this.#n, d = this.options, c = u !== void 0 && u !== "" && d.some((o) => !o.disabled && (this.#t ? this.#t(u, o) : true));
+		if (t.name === "tab" && r && c) {
+			this.userInput === "	" && this._clearUserInput(), this._setUserInput(u, true), this.isNavigating = false;
+			return;
+		}
+		if (t.name === "tab" && this.#l && !this.multiple && this.focusedValue !== void 0) {
+			const o = String(this.focusedValue);
+			this._clearUserInput(), this._setUserInput(o, true), this.isNavigating = false;
+			return;
+		}
+		i || s ? (this.#e = findCursor(this.#e, i ? -1 : 1, this.filteredOptions), this.focusedValue = this.filteredOptions[this.#e]?.value, this.multiple || (this.selectedValues = [this.focusedValue]), this.isNavigating = true) : n ? this.value = g(this.multiple, this.selectedValues) : this.multiple ? this.focusedValue !== void 0 && (t.name === "tab" || this.isNavigating && t.name === "space") ? this.toggleSelected(this.focusedValue) : this.isNavigating = false : (this.focusedValue && (this.selectedValues = [this.focusedValue]), this.isNavigating = false);
+	}
+	deselectAll() {
+		this.selectedValues = [];
+	}
+	toggleSelected(e) {
+		this.filteredOptions.length !== 0 && (this.multiple ? this.selectedValues.includes(e) ? this.selectedValues = this.selectedValues.filter((t) => t !== e) : this.selectedValues = [...this.selectedValues, e] : this.selectedValues = [e]);
+	}
+	#o(e) {
+		if (e !== this.#s) {
+			this.#s = e;
+			const t = this.options;
+			e && this.#t ? this.filteredOptions = t.filter((n) => this.#t?.(e, n)) : this.filteredOptions = [...t];
+			const i = p$1(this.focusedValue, this.filteredOptions);
+			this.#e = findCursor(i, 0, this.filteredOptions);
+			const s = this.filteredOptions[this.#e];
+			s && !s.disabled ? this.focusedValue = s.value : this.focusedValue = void 0, this.multiple || (this.focusedValue !== void 0 ? this.toggleSelected(this.focusedValue) : this.deselectAll());
+		}
+	}
+};
 var r = class extends y {
 	get cursor() {
 		return this.value ? 0 : 1;
@@ -6650,6 +6730,66 @@ const limitOptions = ({ cursor: l, options: e, style: w, output: p = process.std
 	for (const t of s) for (const n of t) x.push(n);
 	return c && x.push(M), x;
 };
+function P(t, c) {
+	if (!t) return true;
+	const n = (c.label ?? String(c.value ?? "")).toLowerCase(), i = (c.hint ?? "").toLowerCase(), r = String(c.value).toLowerCase(), o = t.toLowerCase();
+	return n.includes(o) || i.includes(o) || r.includes(o);
+}
+const autocompleteMultiselect = (t) => {
+	const c = (i, r, o, m) => {
+		const p = o.includes(i.value), $ = i.label ?? String(i.value ?? ""), l = i.hint && m !== void 0 && i.value === m ? styleText("dim", ` (${i.hint})`) : "", s = p ? styleText("green", S_CHECKBOX_SELECTED) : styleText("dim", S_CHECKBOX_INACTIVE);
+		return i.disabled ? `${styleText("gray", S_CHECKBOX_INACTIVE)} ${styleText(["strikethrough", "gray"], $)}` : r ? `${s} ${$}${l}` : `${s} ${styleText("dim", $)}`;
+	}, n = new T$1({
+		options: t.options,
+		multiple: true,
+		placeholder: t.placeholder,
+		filter: t.filter ?? ((i, r) => P(i, r)),
+		validate: () => {
+			if (t.required && n.selectedValues.length === 0) return "Please select at least one item";
+		},
+		initialValue: t.initialValues,
+		signal: t.signal,
+		input: t.input,
+		output: t.output,
+		render() {
+			const i = t.withGuide ?? settings.withGuide, r = `${i ? `${styleText("gray", S_BAR)}
+` : ""}${symbol(this.state)}  ${t.message}
+`, o = this.userInput, m = t.placeholder, p = o === "" && m !== void 0, $ = this.isNavigating || p ? styleText("dim", p ? m : o) : this.userInputWithCursor, l = this.options, s = this.filteredOptions.length !== l.length ? styleText("dim", ` (${this.filteredOptions.length} match${this.filteredOptions.length === 1 ? "" : "es"})`) : "";
+			switch (this.state) {
+				case "submit": return `${r}${i ? `${styleText("gray", S_BAR)}  ` : ""}${styleText("dim", `${this.selectedValues.length} items selected`)}`;
+				case "cancel": return `${r}${i ? `${styleText("gray", S_BAR)}  ` : ""}${styleText(["strikethrough", "dim"], o)}`;
+				default: {
+					const a = this.state === "error" ? "yellow" : "cyan", u = i ? `${styleText(a, S_BAR)}  ` : "", V = i ? styleText(a, S_BAR_END) : "", b = [
+						`${styleText("dim", "↑/↓")} to navigate`,
+						`${styleText("dim", this.isNavigating ? "Space/Tab:" : "Tab:")} select`,
+						`${styleText("dim", "Enter:")} confirm`,
+						`${styleText("dim", "Type:")} to search`
+					], y = this.filteredOptions.length === 0 && o ? [`${u}${styleText("yellow", "No matches found")}`] : [], S = this.state === "error" ? [`${u}${styleText("yellow", this.error)}`] : [], g = [
+						...`${r}${i ? styleText(a, S_BAR) : ""}`.split(`
+`),
+						`${u}${styleText("dim", "Search:")} ${$}${s}`,
+						...y,
+						...S
+					], O = [`${u}${b.join(" • ")}`, V], d = limitOptions({
+						cursor: this.cursor,
+						options: this.filteredOptions,
+						style: (f, L) => c(f, L, this.selectedValues, this.focusedValue),
+						maxItems: t.maxItems,
+						output: t.output,
+						rowPadding: g.length + O.length
+					});
+					return [
+						...g,
+						...d.map((f) => `${u}${f}`),
+						...O
+					].join(`
+`);
+				}
+			}
+		}
+	});
+	return n.prompt();
+};
 const confirm = (e) => {
 	const a = e.active ?? "Yes", o = e.inactive ?? "No";
 	return new r({
@@ -6970,6 +7110,19 @@ function clackPrompter(streams = {}) {
 				required: false
 			}));
 		},
+		async searchableMultiselect(message, options, initialValues = [], hint) {
+			if (hint) output.write(`${import_picocolors.default.dim(hint)}\n`);
+			return unwrapPrompt(await autocompleteMultiselect({
+				message,
+				input,
+				output,
+				options,
+				initialValues,
+				required: false,
+				placeholder: "Type to search",
+				maxItems: 12
+			}));
+		},
 		note(message, title) {
 			output.write(`${import_picocolors.default.green("◇")}  ${title}\n`);
 			output.write(`${import_picocolors.default.dim("│")}\n`);
@@ -7075,7 +7228,7 @@ function buildParser(onMatched) {
 	parser.command("commands", "Print the command catalog", () => {}, (argv) => {
 		onMatched({
 			argv,
-			run: async (ctx) => (await import("./commands-KKAq0m6z.mjs")).run(ctx)
+			run: async (ctx) => (await import("./commands-Bjui8-Nt.mjs")).run(ctx)
 		});
 	});
 	parser.command("auth", "Manage credentials", (auth) => {
@@ -7088,13 +7241,13 @@ function buildParser(onMatched) {
 		}).conflicts("password", "token"), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./auth-ByGgd_Yn.mjs")).login(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./auth-CQkOtVxv.mjs")).login(ctx, matchedArgv)
 			});
 		});
 		auth.command("logout", "Revoke the stored token and delete the local config", () => {}, (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx) => (await import("./auth-ByGgd_Yn.mjs")).logout(ctx)
+				run: async (ctx) => (await import("./auth-CQkOtVxv.mjs")).logout(ctx)
 			});
 		});
 		auth.command("status", "Show credential source, server, principal, token prefix and audience", (status) => status.option("offline", {
@@ -7104,7 +7257,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./auth-ByGgd_Yn.mjs")).status(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./auth-CQkOtVxv.mjs")).status(ctx, matchedArgv)
 			});
 		});
 		auth.command("token", "Print the access token to stdout and nothing else", (token) => token.option("audience", {
@@ -7115,13 +7268,13 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./auth-ByGgd_Yn.mjs")).token(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./auth-CQkOtVxv.mjs")).token(ctx, matchedArgv)
 			});
 		});
 		auth.command("whoami", "Print the GET /me payload", () => {}, (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx) => (await import("./auth-ByGgd_Yn.mjs")).whoami(ctx)
+				run: async (ctx) => (await import("./auth-CQkOtVxv.mjs")).whoami(ctx)
 			});
 		});
 		registerGeneratedAuth(auth, onMatched);
@@ -7138,6 +7291,10 @@ function buildParser(onMatched) {
 			type: "boolean",
 			default: false,
 			describe: "Install to every known agent target"
+		}).option("all-skills", {
+			type: "boolean",
+			default: false,
+			describe: "Install every skill in a namespace argument instead of prompting"
 		}).option("global", {
 			type: "boolean",
 			default: false,
@@ -7155,7 +7312,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-BH59pgRw.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-CqHGxo_M.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		skills.command("publish <paths..>", "Publish a local skill directory as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7183,7 +7340,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-BH59pgRw.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-CqHGxo_M.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return skills.demandCommand(1);
@@ -7205,7 +7362,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-DjSU9C8z.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-C-oJ6J5B.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		mcp.command("publish <paths..>", "Publish an MCP snapshot as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7233,7 +7390,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-DjSU9C8z.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-C-oJ6J5B.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return mcp.demandCommand(1);

package/dist/{mcp-DjSU9C8z.mjs → mcp-C-oJ6J5B.mjs}

@@ -1,5 +1,5 @@
-import { C as HngrError, g as resolveConnection, s as redactSensitive, t as apiFetch, x as writeFileAtomically } from "./http-DgHX7Fux.mjs";
-import { S as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as parseCapabilityPath, c as runBatch, h as findAgentDefinition, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, v as MCP_KIND, x as resolveCapability } from "./scope-D8k2oa_W.mjs";
+import { C as HngrError, g as resolveConnection, s as redactSensitive, t as apiFetch, x as writeFileAtomically } from "./http-CLG2jrIE.mjs";
+import { S as parseCapabilityPath, T as resolveCapabilityVersion, _ as downloadContent, a as errorBody, c as runBatch, h as findAgentDefinition, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, v as MCP_KIND, w as resolveCapability } from "./scope-8BZjgIXy.mjs";
 import { constants } from "node:fs";
 import { access, readFile, stat } from "node:fs/promises";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";

package/dist/{pagination-BXyFxGYA.mjs → pagination-DtoXmj2F.mjs}

@@ -1,4 +1,4 @@
-import { C as HngrError } from "./http-DgHX7Fux.mjs";
+import { C as HngrError } from "./http-CLG2jrIE.mjs";
 // src/pagination.ts
 function asCursorPage(body, path) {
 	if (body === null || typeof body !== "object" || !Array.isArray(body.items) || !("next_cursor" in body)) throw new HngrError({

package/dist/{scope-D8k2oa_W.mjs → scope-8BZjgIXy.mjs}

@@ -1,5 +1,5 @@
-import { C as HngrError, _ as scrubCredentials, a as toHngrError, b as writeDirectoryAtomically, g as resolveConnection, h as redactUrl, i as buildRequestUrl, l as apiErrorFromResponse, n as apiGet } from "./http-DgHX7Fux.mjs";
-import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
+import { C as HngrError, _ as scrubCredentials, a as toHngrError, b as writeDirectoryAtomically, g as resolveConnection, h as redactUrl, i as buildRequestUrl, l as apiErrorFromResponse, n as apiGet } from "./http-CLG2jrIE.mjs";
+import { t as collectPages } from "./pagination-DtoXmj2F.mjs";
 import { lstat, mkdir, readFile, rename, rm, symlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
@@ -76,6 +76,37 @@ function parseCapabilityPath(raw, kind) {
 		version
 	};
 }
+/**
+* Parses a position argument into a concrete path, a bare name to probe, or an
+* explicit Namespace. `<namespace>/` and `<namespace>/*` always mean the
+* Namespace; a bare name is resolved by the caller because today it means
+* `system/<name>` while a miss may be a Namespace.
+*/
+function parseCapabilityTarget(raw, kind) {
+	const value = raw.trim();
+	if (value === "") throw usage$1(`A ${kind.noun} path is required`, "Pass `<name>`, `<namespace>/<name>`, `<namespace>/` or `<namespace>/*`.");
+	const at = value.lastIndexOf("@");
+	const base = at === -1 ? value : value.slice(0, at);
+	if (base.endsWith("/") || base.endsWith("/*")) {
+		if (at !== -1) throw usage$1(`Invalid ${kind.noun} path ${JSON.stringify(raw)}`, "A version cannot be pinned on a namespace; name each one as `<namespace>/<name>@<version>`.");
+		const namespace = base.endsWith("/*") ? base.slice(0, -2) : base.slice(0, -1);
+		if (namespace === "" || namespace.includes("/")) throw usage$1(`Invalid ${kind.noun} path ${JSON.stringify(raw)}`, "Use `<namespace>/` or `<namespace>/*`.");
+		checkNamePart(namespace, raw, kind.noun);
+		return {
+			kind: "namespace",
+			namespace
+		};
+	}
+	const parsed = parseCapabilityPath(value, kind);
+	if (!value.includes("/") && parsed.version === void 0) return {
+		kind: "probe",
+		parsed
+	};
+	return {
+		kind: "capability",
+		parsed
+	};
+}
 function candidateLabel(capability) {
 	return `${capability.id} (${capability.namespace}/${capability.name}, ${capability.kind})`;
 }
@@ -99,6 +130,19 @@ async function findCapability(connection, parsed, kind, signal) {
 	});
 	return matches[0] ?? null;
 }
+/**
+* Lists every readable Capability of one kind in one Namespace, newest-first
+* pages included, then sorted by name so a picker is stable across requests.
+* The server has no total; an empty array means nothing is readable there.
+*/
+async function listCapabilityNamespace(connection, namespace, kind, signal) {
+	return (await collectPages(CAPABILITIES_PATH, (cursor) => apiGet(connection, CAPABILITIES_PATH, {
+		kind: kind.kind,
+		namespace,
+		limit: 100,
+		cursor
+	}, { signal }))).filter((item) => item !== null && typeof item === "object" && item.kind === kind.kind && item.namespace === namespace && typeof item.name === "string").sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+}
 /** Resolves a path to exactly one Capability, or reports that it does not exist. */
 async function resolveCapability(connection, parsed, kind, signal) {
 	const capability = await findCapability(connection, parsed, kind, signal);
@@ -637,4 +681,4 @@ async function resolveInstallScope(ctx, global) {
 	if (!select || ctx.flags.json || !ctx.io.stdin.isTTY || !ctx.io.stdout.isTTY) return "project";
 	return await select("Install scope", SCOPE_OPTIONS, "project") === "global" ? "global" : "project";
 }
-export { resolveCapabilityVersion as S, downloadContent as _, errorBody as a, parseCapabilityPath as b, runBatch as c, installAtomically as d, linkAtomically as f, homeDir as g, findAgentDefinition as h, runPublish as i, stringValues as l, AGENTS as m, explicitName as n, failedResult as o, pathExists as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, copyAtomically as u, MCP_KIND as v, resolveCapability as x, SKILL_KIND as y };
+export { parseCapabilityTarget as C, parseCapabilityPath as S, resolveCapabilityVersion as T, downloadContent as _, errorBody as a, findCapability as b, runBatch as c, installAtomically as d, linkAtomically as f, homeDir as g, findAgentDefinition as h, runPublish as i, stringValues as l, AGENTS as m, explicitName as n, failedResult as o, pathExists as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, copyAtomically as u, MCP_KIND as v, resolveCapability as w, listCapabilityNamespace as x, SKILL_KIND as y };

package/dist/{skills-BH59pgRw.mjs → skills-CqHGxo_M.mjs}

@@ -1,5 +1,5 @@
-import { C as HngrError, g as resolveConnection, r as apiRequest } from "./http-DgHX7Fux.mjs";
-import { S as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as parseCapabilityPath, c as runBatch, d as installAtomically, f as linkAtomically, g as homeDir, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as copyAtomically, x as resolveCapability, y as SKILL_KIND } from "./scope-D8k2oa_W.mjs";
+import { C as HngrError, g as resolveConnection, r as apiRequest } from "./http-CLG2jrIE.mjs";
+import { C as parseCapabilityTarget, S as parseCapabilityPath, T as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as findCapability, c as runBatch, d as installAtomically, f as linkAtomically, g as homeDir, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as copyAtomically, w as resolveCapability, x as listCapabilityNamespace, y as SKILL_KIND } from "./scope-8BZjgIXy.mjs";
 import { lstat, readFile, readdir } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -466,6 +466,19 @@ async function packageSkillDirectory(dir) {
 		byteCount: totals.bytes
 	};
 }
+// src/terminal-text.ts
+/**
+* Catalog text is publisher-controlled. Keep a single line safe to draw in a
+* terminal: drop ANSI escape sequences and remaining control characters,
+* collapse whitespace, and cap the length. Skill names are already validated,
+* but descriptions are not.
+*/
+const ESCAPE_SEQUENCE = /\u001b(?:\[[0-?]*[ -/]*[@-~]|\][^\u0007]*(?:\u0007|\u001b\\)|[P^_][\s\S]*?\u001b\\|[@-_])/g;
+const CONTROL_CHARACTER = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g;
+function terminalText(value, maxLength = 80) {
+	const cleaned = value.replace(ESCAPE_SEQUENCE, "").replace(CONTROL_CHARACTER, " ").replace(/\s+/g, " ").trim();
+	return Array.from(cleaned).slice(0, maxLength).join("");
+}
 // src/commands/skills.ts
 function usage(title, detail) {
 	return new HngrError({
@@ -498,12 +511,11 @@ function noAgentSelectionError(examplePath, global) {
 }
 const ALL_AGENTS = "__all__";
 /**
-* One multi-select for the agents that keep their own skills directory.
-* `.agents` is always installed, so universal agents never appear here.
-* Detection only preselects; a non-TTY invocation never consults the
-* filesystem and must pass --agent or --all.
+* The agents named by flags, or null when a terminal must choose. Resolving
+* this without prompting lets a non-TTY invocation fail before any network
+* call, even when the arguments also include a namespace to expand.
 */
-async function selectAgents(ctx, argv, examplePath, global) {
+function requestedAgents(argv) {
 	const requested = stringValues(argv.agent);
 	if (requested.length > 0) {
 		const unknown = requested.filter((id) => findAgent(id) === void 0);
@@ -511,6 +523,16 @@ async function selectAgents(ctx, argv, examplePath, global) {
 		return AGENT_TARGETS.filter((agent) => requested.includes(agent.id));
 	}
 	if (argv.all === true) return [...AGENT_TARGETS];
+	return null;
+}
+/**
+* One multi-select for the agents that keep their own skills directory.
+* `.agents` is always installed, so universal agents never appear here.
+* Detection only preselects; a non-TTY invocation never consults the
+* filesystem and must pass --agent or --all.
+*/
+async function selectAgents(ctx, requested, examplePath, global) {
+	if (requested !== null) return requested;
 	const multiselect = ctx.io.prompts?.multiselect;
 	if (!canPrompt(ctx) || !multiselect) throw noAgentSelectionError(examplePath, global);
 	const cwd = process.cwd();
@@ -546,6 +568,217 @@ function frontmatterName(manifest) {
 function assertNotReserved(name) {
 	if (isReservedDirName(name)) throw usage(`Reserved directory name: ${name}`, "The names `synced` and `anthropic-skills` are reserved for agent-owned skill stores.");
 }
+function capabilityRef(namespace, name) {
+	return `${namespace}/${name}`;
+}
+function skillHint(capability) {
+	const description = typeof capability.description === "string" ? terminalText(capability.description) : "";
+	if (description !== "") return description;
+	return capability.current_version ? `v${capability.current_version}` : "";
+}
+/** A namespace picker needs a TTY and either multi-select implementation. */
+function canSelectSkills(ctx) {
+	return !ctx.flags.json && ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && (ctx.io.prompts?.searchableMultiselect !== void 0 || ctx.io.prompts?.multiselect !== void 0);
+}
+async function promptForSkills(ctx, candidates) {
+	const namespaces = new Set(candidates.map((capability) => capability.namespace));
+	const options = candidates.map((capability) => ({
+		value: capability.id,
+		label: namespaces.size === 1 ? capability.name : capabilityRef(capability.namespace, capability.name),
+		hint: skillHint(capability)
+	}));
+	const prompt = ctx.io.prompts;
+	const message = "Select skills to install";
+	const hint = "space to select · enter to install · nothing selected installs nothing";
+	let selected = [];
+	if (prompt?.searchableMultiselect) selected = await prompt.searchableMultiselect(message, options, [], hint);
+	else if (prompt?.multiselect) selected = await prompt.multiselect(message, options, [], hint);
+	const byId = new Map(candidates.map((capability) => [capability.id, capability]));
+	const chosen = selected.flatMap((id) => {
+		const capability = byId.get(id);
+		return capability ? [capability] : [];
+	});
+	if (chosen.length === 0) ctx.summary("No skills selected.");
+	return chosen;
+}
+function emptyExpansionError(expansion) {
+	if (expansion.origin !== void 0) return new HngrError({
+		type: "api",
+		title: `No skill named ${expansion.origin.namespace}/${expansion.origin.name}`,
+		detail: `There are also no readable skills in the ${JSON.stringify(expansion.namespace)} namespace.`
+	});
+	return new HngrError({
+		type: "api",
+		title: `No readable skills in namespace ${expansion.namespace}`,
+		detail: "Check the Namespace name, or list the catalog with `hngr capabilities list`."
+	});
+}
+/** Keeps the first occurrence, but an explicitly pinned version outranks a bare one. */
+function dedupeUnits(units) {
+	const index = /* @__PURE__ */ new Map();
+	const result = [];
+	for (const unit of units) {
+		const key = capabilityRef(unit.parsed.namespace, unit.parsed.name);
+		const existing = index.get(key);
+		if (existing === void 0) {
+			index.set(key, result.length);
+			result.push(unit);
+			continue;
+		}
+		const current = result[existing];
+		if (current === void 0) continue;
+		if (unit.kind === "skill" && unit.parsed.version !== void 0 && current.kind === "skill" && current.parsed.version === void 0) result[existing] = unit;
+	}
+	return result;
+}
+/**
+* Resolves position arguments into install units. Explicit paths stay in input
+* order; each namespace's selection is inserted at its first position. A bare
+* name probes `system/<name>` first, so today's meaning always wins.
+*/
+async function resolveAddUnits(ctx, connection, targets, allSkills) {
+	const pending = [];
+	const expansions = /* @__PURE__ */ new Map();
+	const expand = (namespace, origin) => {
+		const existing = expansions.get(namespace);
+		if (existing === void 0) expansions.set(namespace, {
+			namespace,
+			origin,
+			candidates: []
+		});
+		else if (existing.origin === void 0) existing.origin = origin;
+		pending.push({
+			kind: "namespace",
+			namespace
+		});
+	};
+	for (const target of targets) {
+		if (target.kind === "capability") {
+			pending.push({
+				kind: "unit",
+				unit: {
+					kind: "skill",
+					parsed: target.parsed
+				}
+			});
+			continue;
+		}
+		if (target.kind === "probe") {
+			try {
+				const found = await findCapability(connection, target.parsed, SKILL_KIND);
+				if (found !== null) {
+					pending.push({
+						kind: "unit",
+						unit: {
+							kind: "skill",
+							parsed: target.parsed,
+							capability: found
+						}
+					});
+					continue;
+				}
+			} catch (err) {
+				if (err instanceof HngrError && err.exitCode !== 1) throw err;
+				pending.push({
+					kind: "unit",
+					unit: {
+						kind: "failure",
+						parsed: target.parsed,
+						error: err
+					}
+				});
+				continue;
+			}
+			expand(target.parsed.name, target.parsed);
+			continue;
+		}
+		expand(target.namespace);
+	}
+	const candidates = [];
+	for (const expansion of expansions.values()) {
+		try {
+			expansion.candidates = await listCapabilityNamespace(connection, expansion.namespace, SKILL_KIND);
+		} catch (err) {
+			if (err instanceof HngrError && err.exitCode !== 1) throw err;
+			expansion.error = err;
+			continue;
+		}
+		if (expansion.candidates.length > 0) candidates.push(...expansion.candidates);
+	}
+	const unique = /* @__PURE__ */ new Map();
+	for (const capability of candidates) unique.set(capabilityRef(capability.namespace, capability.name), capability);
+	const allCandidates = [...unique.values()].sort((a, b) => {
+		const left = capabilityRef(a.namespace, a.name);
+		const right = capabilityRef(b.namespace, b.name);
+		return left < right ? -1 : left > right ? 1 : 0;
+	});
+	let chosen;
+	if (allCandidates.length === 0) chosen = [];
+	else if (allSkills) chosen = allCandidates;
+	else if (!canSelectSkills(ctx)) throw usage("Cannot choose skills from a namespace without a terminal", "Pass --all-skills to install every skill in the namespace, or name each skill as `<namespace>/<name>`.");
+	else chosen = await promptForSkills(ctx, allCandidates);
+	const chosenRefs = new Set(chosen.map((capability) => capabilityRef(capability.namespace, capability.name)));
+	const units = [];
+	for (const entry of pending) {
+		if (entry.kind === "unit") {
+			units.push(entry.unit);
+			continue;
+		}
+		const expansion = expansions.get(entry.namespace);
+		if (expansion === void 0) continue;
+		if (expansion.error !== void 0) {
+			units.push({
+				kind: "failure",
+				parsed: expansion.origin ?? {
+					namespace: expansion.namespace,
+					name: "*"
+				},
+				error: expansion.error
+			});
+			continue;
+		}
+		if (expansion.candidates.length === 0) {
+			units.push({
+				kind: "failure",
+				parsed: expansion.origin ?? {
+					namespace: expansion.namespace,
+					name: "*"
+				},
+				error: emptyExpansionError(expansion)
+			});
+			continue;
+		}
+		for (const capability of expansion.candidates) {
+			if (!chosenRefs.has(capabilityRef(capability.namespace, capability.name))) continue;
+			units.push({
+				kind: "skill",
+				parsed: {
+					namespace: capability.namespace,
+					name: capability.name
+				},
+				capability
+			});
+		}
+	}
+	return {
+		units: dedupeUnits(units),
+		expanded: expansions.size > 0
+	};
+}
+function assertAddPlan(units, as, expanded) {
+	if (as !== void 0 && expanded) throw usage("--as cannot be used with a namespace", "Pass one explicit `<namespace>/<name>` instead.");
+	const skills = units.filter((unit) => unit.kind === "skill");
+	if (as !== void 0 && skills.length !== 1) throw usage("--as requires exactly one skill", `This command resolves to ${skills.length} skills; install them without --as.`);
+	const destinations = /* @__PURE__ */ new Map();
+	for (const unit of skills) {
+		const destName = as ?? unit.parsed.name;
+		assertNotReserved(destName);
+		const ref = capabilityRef(unit.parsed.namespace, unit.parsed.name);
+		const existing = destinations.get(destName);
+		if (existing !== void 0 && existing !== ref) throw usage(`Two skills would install as ${JSON.stringify(destName)}`, `${existing} and ${ref} both use that directory name; install them separately.`);
+		destinations.set(destName, ref);
+	}
+}
 function planInstall(cwd, env, destName, agents, options) {
 	if (options.dir) {
 		const base = resolve(cwd, options.dir);
@@ -644,8 +877,8 @@ function installSummary(outcome, canonicalPath) {
 	if (failed.length > 0) lines.push(`  failed: ${failed.map((target) => target.path).join(", ")}`);
 	return lines.join("\n");
 }
-async function addOne(ctx, connection, parsed, destName, agents, dir, global, copy, state) {
-	const capability = await resolveSkill(connection, parsed);
+async function addOne(ctx, connection, parsed, destName, agents, dir, global, copy, state, resolved) {
+	const capability = resolved ?? await resolveSkill(connection, parsed);
 	const version = resolveVersion(capability, parsed);
 	state.version = version;
 	const plan = planInstall(process.cwd(), ctx.env, destName, agents, {
@@ -830,30 +1063,45 @@ async function offerFindCapabilities(ctx, connection, destNames, agents, options
 }
 async function add(ctx, argv) {
 	const rawPaths = positionalPaths(argv.paths);
-	if (rawPaths.length === 0) throw usage("No skill path given", "Pass one or more `<name>` or `<namespace>/<name>` arguments.");
-	const parsedPaths = rawPaths.map(parseSkillPath);
+	if (rawPaths.length === 0) throw usage("No skill path given", "Pass one or more `<name>`, `<namespace>/<name>`, `<namespace>/` or `<namespace>/*` arguments.");
+	const targets = rawPaths.map((raw) => parseCapabilityTarget(raw, SKILL_KIND));
 	const dir = stringFlag(argv, "dir");
 	const as = stringFlag(argv, "as");
 	if (as !== void 0 && (as.includes("/") || as.includes("\\") || as === "." || as === "..")) throw usage(`Invalid --as name ${JSON.stringify(as)}`, "Pass a single directory name.");
 	const requestedGlobal = argv.global === true;
 	const copy = argv.copy === true;
+	const allSkills = argv.allSkills === true;
 	if (dir !== void 0 && requestedGlobal) throw usage("--dir cannot be combined with --global");
 	if (dir !== void 0 && (stringValues(argv.agent).length > 0 || argv.all === true)) throw usage("--dir cannot be combined with --agent or --all");
 	if (as !== void 0) assertNotReserved(as);
-	for (const parsed of parsedPaths) assertNotReserved(as ?? parsed.name);
-	const global = dir === void 0 ? await resolveInstallScope(ctx, requestedGlobal) === "global" : false;
-	const agents = dir === void 0 ? await selectAgents(ctx, argv, rawPaths[0] ?? "", global) : [];
+	if (as !== void 0 && targets.some((target) => target.kind === "namespace")) throw usage("--as cannot be used with a namespace", "Pass one explicit `<namespace>/<name>` instead.");
+	for (const target of targets) {
+		if (target.kind === "namespace") continue;
+		assertNotReserved(as ?? target.parsed.name);
+	}
+	const requested = dir === void 0 ? requestedAgents(argv) : [];
+	if (dir === void 0 && requested === null && !canPrompt(ctx)) throw noAgentSelectionError(rawPaths[0] ?? "", requestedGlobal);
 	const connection = await resolveConnection(ctx.flags, ctx.env);
+	const { units, expanded } = await resolveAddUnits(ctx, connection, targets, allSkills);
+	if (units.length === 0) return 0;
+	assertAddPlan(units, as, expanded);
+	const installable = units.some((unit) => unit.kind === "skill");
+	const global = dir === void 0 && installable ? await resolveInstallScope(ctx, requestedGlobal) === "global" : false;
+	const agents = dir === void 0 && installable ? await selectAgents(ctx, requested, rawPaths[0] ?? "", global) : [];
+	const unitByRef = new Map(units.map((unit) => [capabilityRef(unit.parsed.namespace, unit.parsed.name), unit]));
 	const { results, failed } = await runBatch({
 		ctx,
-		paths: parsedPaths,
+		paths: units.map((unit) => unit.parsed),
 		run: async (parsed, state) => {
-			return (await addOne(ctx, connection, parsed, as ?? parsed.name, agents, dir, global, copy, state)).result;
+			const unit = unitByRef.get(capabilityRef(parsed.namespace, parsed.name));
+			if (unit?.kind === "failure") throw unit.error;
+			return (await addOne(ctx, connection, parsed, as ?? parsed.name, agents, dir, global, copy, state, unit?.capability)).result;
 		},
 		failure: failureResult
 	});
 	if (ctx.flags.json || !ctx.io.stdout.isTTY) ctx.writePayload({ results });
-	if (!ctx.flags.json && !ctx.flags.dryRun && !ctx.flags.quiet && !failed && canConfirm(ctx)) await offerFindCapabilities(ctx, connection, parsedPaths.map((parsed) => as ?? parsed.name), agents, {
+	const destNames = units.filter((unit) => unit.kind === "skill").map((unit) => as ?? unit.parsed.name);
+	if (!ctx.flags.json && !ctx.flags.dryRun && !ctx.flags.quiet && !failed && canConfirm(ctx)) await offerFindCapabilities(ctx, connection, destNames, agents, {
 		dir,
 		global,
 		copy

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hngr",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "The Hangar CLI: install skills and MCP servers into coding agents, and drive the Management API.",
   "keywords": [
     "hangar",