@akms/mcp-ssh 0.1.0 → 0.1.1

package/lib/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import fs7 from 'fs';
-import os4 from 'os';
+import fs6 from 'fs';
+import os5 from 'os';
 import path from 'path';
 import { spawnSync, spawn } from 'child_process';
 import { createHash } from 'crypto';
@@ -26,7 +26,7 @@ var CWD_MARKER = "__AKMS_SSH_CWD__";
 var MAX_DIRECTORY_ENTRIES = 1e3;
 var SERVER_NAME = "akms-mcp-ssh";
 var PACKAGE_NAME = "@akms/mcp-ssh";
-var SERVER_VERSION = "0.1.0";
+var SERVER_VERSION = "0.1.1";
 
 // src/_defs/command-rules.ts
 var CRITICAL_PATH_PATTERN = new RegExp(
@@ -601,7 +601,7 @@ function findExecutable(name) {
   for (const directory of directories) {
     for (const suffix of suffixes) {
       const candidate = path.join(directory, `${name}${suffix}`);
-      if (fs7.existsSync(candidate) == true && fs7.statSync(candidate).isFile() == true) {
+      if (fs6.existsSync(candidate) == true && fs6.statSync(candidate).isFile() == true) {
         return candidate;
       }
     }
@@ -611,9 +611,9 @@ function findExecutable(name) {
 function expandHomePath(inputPath) {
   let expanded = inputPath;
   if (inputPath === "~") {
-    expanded = os4.homedir();
+    expanded = os5.homedir();
   } else if (inputPath.startsWith("~/") == true || inputPath.startsWith("~\\") == true) {
-    expanded = path.join(os4.homedir(), inputPath.slice(2));
+    expanded = path.join(os5.homedir(), inputPath.slice(2));
   }
   return path.resolve(expanded);
 }
@@ -742,7 +742,7 @@ function loadHostProfile(env = process.env) {
   if (keyPath != null) {
     const expandedKeyPath = expandHomePath(keyPath);
     profile.privateKeyPath = expandedKeyPath;
-    if (fs7.existsSync(expandedKeyPath) == false) {
+    if (fs6.existsSync(expandedKeyPath) == false) {
       _logger.warn(`${SINGLE_HOST_ENV.KEY} does not exist; connections will fail`, {
         private_key_path: expandedKeyPath
       });
@@ -774,7 +774,7 @@ function loadHostProfile(env = process.env) {
     if (jumpKeyPath != null) {
       profile.jump.privateKeyPath = expandHomePath(jumpKeyPath);
       profile.jump.passphrase = readEnv(env, SINGLE_HOST_ENV.JUMP_PASSPHRASE);
-      if (fs7.existsSync(profile.jump.privateKeyPath) == false) {
+      if (fs6.existsSync(profile.jump.privateKeyPath) == false) {
         _logger.warn(`${SINGLE_HOST_ENV.JUMP_KEY} does not exist; connections will fail`, {
           private_key_path: profile.jump.privateKeyPath
         });
@@ -1260,14 +1260,14 @@ function inspectRemotePath(remotePath, policy, access) {
 function toRealPath(inputPath) {
   const _logger = $logger.child({ context: "toRealPath" });
   try {
-    return fs7.realpathSync.native(inputPath);
+    return fs6.realpathSync.native(inputPath);
   } catch (ex) {
     _logger.debug("path does not resolve, falling back to its parent directory", {
       reason: ex instanceof Error ? ex.name : "unknown"
     });
   }
   try {
-    const parentRealPath = fs7.realpathSync.native(path.dirname(inputPath));
+    const parentRealPath = fs6.realpathSync.native(path.dirname(inputPath));
     return path.join(parentRealPath, path.basename(inputPath));
   } catch (ex) {
     _logger.debug("parent directory does not resolve either, comparing lexically", {
@@ -1359,7 +1359,7 @@ function readPrivateKey(label, keyPath) {
     return cached;
   }
   try {
-    const contents = fs7.readFileSync(keyPath);
+    const contents = fs6.readFileSync(keyPath);
     PRIVATE_KEY_CACHE.set(keyPath, contents);
     return contents;
   } catch (ex) {
@@ -2310,7 +2310,7 @@ async function writeRemoteFile(connection, args) {
 }
 async function uploadFile(connection, localPath, remotePath) {
   requirePermittedPath(connection, remotePath, "write");
-  const localStats = fs7.statSync(localPath);
+  const localStats = fs6.statSync(localPath);
   if (localStats.isFile() == false) {
     throw new Error(`local path is not a file: ${localPath}`);
   }
@@ -2347,7 +2347,7 @@ async function downloadFile(connection, remotePath, localPath) {
       });
     });
   });
-  const localStats = fs7.statSync(localPath);
+  const localStats = fs6.statSync(localPath);
   const _logger = $logger.child({
     context: "downloadFile",
     profile: connection.profile.name,
@@ -2625,36 +2625,152 @@ var PromptClosedError = class extends Error {
     this.name = "PromptClosedError";
   }
 };
+var ESC = "\x1B";
+var KEY_UP = [`${ESC}[A`, `${ESC}OA`, "k"];
+var KEY_DOWN = [`${ESC}[B`, `${ESC}OB`, "j"];
+var KEY_HOME = [`${ESC}[H`, `${ESC}OH`, `${ESC}[1~`];
+var KEY_END = [`${ESC}[F`, `${ESC}OF`, `${ESC}[4~`];
+var KEY_ENTER = ["\r", "\n"];
+var KEY_BACKSPACE = ["\x7F", "\b"];
+var KEY_CTRL_C = "";
+var KEY_CTRL_D = "";
+function splitKeys(chunk) {
+  const keys = [];
+  let index = 0;
+  while (index < chunk.length) {
+    const isSequence = chunk[index] === ESC && (chunk[index + 1] === "[" || chunk[index + 1] === "O");
+    if (isSequence == true) {
+      let end = index + 2;
+      while (end < chunk.length && /[0-9;]/.test(chunk[end]) == true) {
+        end += 1;
+      }
+      keys.push(chunk.slice(index, end + 1));
+      index = end + 1;
+      continue;
+    }
+    const codePoint = chunk.codePointAt(index) ?? 0;
+    const character = String.fromCodePoint(codePoint);
+    keys.push(character);
+    index += character.length;
+  }
+  return keys;
+}
+function charWidth(codePoint) {
+  if (codePoint < 4352) {
+    return 1;
+  }
+  const isWide = codePoint <= 4447 || codePoint === 9001 || codePoint === 9002 || codePoint >= 11904 && codePoint <= 42191 && codePoint !== 12351 || codePoint >= 44032 && codePoint <= 55203 || codePoint >= 63744 && codePoint <= 64255 || codePoint >= 65072 && codePoint <= 65103 || codePoint >= 65280 && codePoint <= 65376 || codePoint >= 65504 && codePoint <= 65510 || codePoint >= 127744 && codePoint <= 128591 || codePoint >= 129280 && codePoint <= 129535 || codePoint >= 131072 && codePoint <= 262141;
+  if (isWide == true) {
+    return 2;
+  }
+  return 1;
+}
+function displayWidth(text) {
+  let width = 0;
+  for (const character of text) {
+    width += charWidth(character.codePointAt(0) ?? 0);
+  }
+  return width;
+}
+function padToWidth(text, width) {
+  const missing = width - displayWidth(text);
+  if (missing <= 0) {
+    return text;
+  }
+  return `${text}${" ".repeat(missing)}`;
+}
+function groupLabelWidths(items) {
+  const widths = items.map(() => 0);
+  let groupStart = 0;
+  for (let index = 0; index <= items.length; index += 1) {
+    const atBoundary = index === items.length || "value" in items[index] == false;
+    if (atBoundary == false) {
+      continue;
+    }
+    let groupWidth = 0;
+    for (let member = groupStart; member < index; member += 1) {
+      const item = items[member];
+      groupWidth = Math.max(groupWidth, displayWidth(item.label));
+    }
+    for (let member = groupStart; member < index; member += 1) {
+      widths[member] = groupWidth;
+    }
+    groupStart = index + 1;
+  }
+  return widths;
+}
+function supportsUnicode() {
+  if (process.platform !== "win32") {
+    return true;
+  }
+  return process.env.WT_SESSION != null || process.env.TERM_PROGRAM === "vscode" || process.env.TERMINAL_EMULATOR === "JetBrains-JediTerm" || process.env.ConEmuTask != null;
+}
+function createStyle(enabled) {
+  const paint = (open, close) => {
+    return (text) => {
+      if (enabled == false || text === "") {
+        return text;
+      }
+      return `${ESC}[${open}m${text}${ESC}[${close}m`;
+    };
+  };
+  return {
+    accent: paint(36, 39),
+    success: paint(32, 39),
+    dim: paint(2, 22),
+    bold: paint(1, 22)
+  };
+}
 var Prompter = class {
   constructor(input, output) {
     this.input = input;
     this.output = output;
     this.lineBuffer = "";
     this.pendingLines = [];
-    this.waiter = null;
+    this.lineWaiter = null;
     this.inputEnded = false;
-    this.secretMode = false;
-    this.secretBuffer = "";
+    /** Set while a key-driven prompt (select, secret) owns the input. */
+    this.keyHandler = null;
+    const ttyInput = input;
+    const ttyOutput = output;
+    this.interactive = ttyInput.isTTY == true && ttyInput.setRawMode != null && ttyOutput.isTTY == true;
+    this.style = createStyle(this.interactive == true && process.env.NO_COLOR == null);
+    if (supportsUnicode() == true) {
+      this.symbols = { question: "?", pointer: "\u276F", tick: "\u2714", rule: "\u2500" };
+    } else {
+      this.symbols = { question: "?", pointer: ">", tick: "\u221A", rule: "-" };
+    }
     input.setEncoding("utf8");
     input.on("data", (chunk) => {
       this.onData(chunk);
     });
     input.on("end", () => {
       this.inputEnded = true;
-      if (this.waiter != null) {
-        const waiter = this.waiter;
-        this.waiter = null;
+      if (this.lineWaiter != null) {
+        const waiter = this.lineWaiter;
+        this.lineWaiter = null;
         waiter(null);
       }
+      if (this.keyHandler != null) {
+        this.keyHandler(KEY_CTRL_D);
+      }
     });
   }
   /** Stops reading so the process can exit once the command is done. */
   close() {
+    if (this.interactive == true) {
+      this.input.setRawMode?.(false);
+      this.output.write(`${ESC}[?25h`);
+    }
     this.input.pause();
   }
   write(text) {
     this.output.write(text);
   }
+  /** Styling for callers that print around the prompts; plain text off a TTY. */
+  get paint() {
+    return this.style;
+  }
   /**
    * Free-text prompt. Enter accepts `defaultValue` when one is shown.
    *
@@ -2663,18 +2779,20 @@ var Prompter = class {
   async ask(question, defaultValue) {
     let suffix = "";
     if (defaultValue != null && defaultValue !== "") {
-      suffix = ` [${defaultValue}]`;
+      suffix = ` ${this.style.dim(`(${defaultValue})`)}`;
     }
-    this.output.write(`${question}${suffix}: `);
+    const prompt = `${this.style.accent(this.symbols.question)} ${this.style.bold(question)}${suffix} `;
+    this.output.write(prompt);
     const line = await this.readLine();
     if (line == null) {
       throw new PromptClosedError();
     }
-    const trimmed = line.trim();
-    if (trimmed === "" && defaultValue != null) {
-      return defaultValue;
+    let answer = line.trim();
+    if (answer === "" && defaultValue != null) {
+      answer = defaultValue;
     }
-    return trimmed;
+    this.collapseAnswered(prompt, line, question, answer);
+    return answer;
   }
   /** Like `ask`, re-asking until something non-empty is entered. */
   async askRequired(question, defaultValue) {
@@ -2683,77 +2801,115 @@ var Prompter = class {
       if (answer !== "") {
         return answer;
       }
-      this.output.write("  A value is required.\n");
+      this.output.write(`  ${this.style.dim("A value is required.")}
+`);
     }
   }
   async askYesNo(question, defaultValue) {
-    let hint = "[y/N]";
+    let hint = "y/N";
     if (defaultValue == true) {
-      hint = "[Y/n]";
+      hint = "Y/n";
     }
     for (; ; ) {
-      this.output.write(`${question} ${hint}: `);
+      const prompt = `${this.style.accent(this.symbols.question)} ${this.style.bold(question)} ${this.style.dim(`(${hint})`)} `;
+      this.output.write(prompt);
       const line = await this.readLine();
       if (line == null) {
         throw new PromptClosedError();
       }
       const normalized = line.trim().toLowerCase();
+      let answer = null;
       if (normalized === "") {
-        return defaultValue;
-      }
-      if (normalized === "y" || normalized === "yes") {
-        return true;
+        answer = defaultValue;
+      } else if (normalized === "y" || normalized === "yes") {
+        answer = true;
+      } else if (normalized === "n" || normalized === "no") {
+        answer = false;
       }
-      if (normalized === "n" || normalized === "no") {
-        return false;
+      if (answer != null) {
+        let shown = "no";
+        if (answer == true) {
+          shown = "yes";
+        }
+        this.collapseAnswered(prompt, line, question, shown);
+        return answer;
       }
-      this.output.write("  Answer y or n.\n");
+      this.output.write(`  ${this.style.dim("Answer y or n.")}
+`);
     }
   }
-  /** Lists the choices one per line and accepts a key, case-insensitively. */
-  async askChoice(question, choices, defaultKey) {
-    this.output.write(`${question}
-`);
-    for (const choice of choices) {
-      this.output.write(`  ${choice.key}) ${choice.label}
-`);
+  /**
+   * Picks one of `items`. On a TTY: ↑/↓ (or k/j) move, 1–9 jump, Enter picks, Esc returns
+   * `cancelValue`. Off a TTY: a numbered list, answered by number, key or label.
+   *
+   * @throws {PromptClosedError} On Ctrl+C or when the input closes.
+   */
+  async select(question, items, options) {
+    const choices = items.filter((item) => "value" in item);
+    if (choices.length === 0) {
+      throw new Error("select needs at least one choice");
     }
-    for (; ; ) {
-      const answer = await this.ask("Choice", defaultKey);
-      const matched = choices.find((choice) => choice.key.toLowerCase() === answer.toLowerCase());
-      if (matched != null) {
-        return matched.key;
-      }
-      this.output.write(`  Pick one of ${choices.map((choice) => choice.key).join(", ")}.
-`);
+    let startIndex = items.findIndex((item) => "value" in item && item.value === options?.defaultValue);
+    if (startIndex < 0) {
+      startIndex = items.findIndex((item) => "value" in item);
+    }
+    if (this.interactive == true) {
+      const picked2 = await this.selectWithKeys(question, items, startIndex, options?.cancelValue);
+      return picked2;
     }
+    const picked = await this.selectWithLines(question, items, startIndex);
+    return picked;
   }
   /**
    * Reads a value without echoing it on a TTY. Empty means "none", or "keep" when the
    * caller says a value already exists.
+   *
+   * @throws {PromptClosedError} On Ctrl+C or when the input closes.
    */
   async askSecret(question) {
-    const rawModeStream = this.input;
-    if (rawModeStream.isTTY != true || rawModeStream.setRawMode == null) {
+    if (this.interactive == false) {
       const answer = await this.ask(question);
       return answer;
     }
-    this.output.write(`${question}: `);
-    this.secretBuffer = "";
-    this.secretMode = true;
-    rawModeStream.setRawMode(true);
-    try {
-      const line = await this.readLine();
-      if (line == null) {
-        throw new PromptClosedError();
-      }
-      return line;
-    } finally {
-      rawModeStream.setRawMode(false);
-      this.secretMode = false;
-      this.output.write("\n");
-    }
+    const prompt = `${this.style.accent(this.symbols.question)} ${this.style.bold(question)} `;
+    this.output.write(prompt);
+    const ttyInput = this.input;
+    return new Promise((resolve, reject) => {
+      let buffer = "";
+      const finish = () => {
+        this.keyHandler = null;
+        ttyInput.setRawMode?.(false);
+        this.output.write(`\r${ESC}[2K`);
+      };
+      this.keyHandler = (key) => {
+        if (key === KEY_CTRL_C || key === KEY_CTRL_D) {
+          finish();
+          reject(new PromptClosedError());
+          return;
+        }
+        if (KEY_ENTER.includes(key) == true) {
+          finish();
+          let shown = this.style.dim("(empty)");
+          if (buffer !== "") {
+            shown = "\u2022".repeat(Math.min(buffer.length, 8));
+          }
+          this.writeAnswered(question, shown);
+          resolve(buffer);
+          return;
+        }
+        if (KEY_BACKSPACE.includes(key) == true) {
+          buffer = Array.from(buffer).slice(0, -1).join("");
+          return;
+        }
+        if (key.startsWith(ESC) == true) {
+          return;
+        }
+        buffer += key;
+      };
+      ttyInput.setRawMode?.(true);
+    });
   }
+  // ── line mode ──────────────────────────────────────────────────────────
   readLine() {
     const queued = this.pendingLines.shift();
     if (queued != null) {
@@ -2763,36 +2919,16 @@ var Prompter = class {
       return Promise.resolve(null);
     }
     return new Promise((resolve) => {
-      this.waiter = resolve;
+      this.lineWaiter = resolve;
     });
   }
-  deliver(line) {
-    if (this.waiter != null) {
-      const waiter = this.waiter;
-      this.waiter = null;
-      waiter(line);
-      return;
-    }
-    this.pendingLines.push(line);
-  }
   onData(chunk) {
-    if (this.secretMode == true) {
-      for (const character of chunk) {
-        if (character === "\r" || character === "\n") {
-          const secret = this.secretBuffer;
-          this.secretBuffer = "";
-          this.deliver(secret);
-          continue;
-        }
-        if (character === "") {
-          this.output.write("\n");
-          process.exit(130);
-        }
-        if (character === "\x7F" || character === "\b") {
-          this.secretBuffer = this.secretBuffer.slice(0, -1);
-          continue;
+    if (this.keyHandler != null) {
+      for (const key of splitKeys(chunk)) {
+        if (this.keyHandler == null) {
+          break;
         }
-        this.secretBuffer += character;
+        this.keyHandler(key);
       }
       return;
     }
@@ -2801,13 +2937,289 @@ var Prompter = class {
     while (newlineIndex >= 0) {
       const line = this.lineBuffer.slice(0, newlineIndex).replace(/\r$/, "");
       this.lineBuffer = this.lineBuffer.slice(newlineIndex + 1);
-      this.deliver(line);
+      if (this.lineWaiter != null) {
+        const waiter = this.lineWaiter;
+        this.lineWaiter = null;
+        waiter(line);
+      } else {
+        this.pendingLines.push(line);
+      }
       newlineIndex = this.lineBuffer.indexOf("\n");
     }
   }
+  async selectWithLines(question, items, startIndex) {
+    const choices = items.filter((item) => "value" in item);
+    const labelWidths = groupLabelWidths(items);
+    this.output.write(`${this.symbols.question} ${question}
+`);
+    let number = 0;
+    for (let index = 0; index < items.length; index += 1) {
+      const item = items[index];
+      if ("value" in item == false) {
+        this.output.write("\n");
+        continue;
+      }
+      number += 1;
+      let line = `  ${String(number).padStart(2)}) ${padToWidth(item.label, labelWidths[index])}`;
+      if (item.hint != null && item.hint !== "") {
+        line += `  ${item.hint}`;
+      }
+      this.output.write(`${line.trimEnd()}
+`);
+    }
+    const defaultChoice = items[startIndex];
+    const defaultNumber = choices.indexOf(defaultChoice) + 1;
+    for (; ; ) {
+      this.output.write(`Choice (${defaultNumber}): `);
+      const line = await this.readLine();
+      if (line == null) {
+        throw new PromptClosedError();
+      }
+      const answer = line.trim();
+      if (answer === "") {
+        return defaultChoice.value;
+      }
+      const index = Number(answer);
+      if (Number.isInteger(index) == true && index >= 1 && index <= choices.length) {
+        return choices[index - 1].value;
+      }
+      const lowered = answer.toLowerCase();
+      const matched = choices.find((choice) => {
+        const key = choice.key ?? choice.value;
+        return key.toLowerCase() === lowered || choice.label.toLowerCase() === lowered;
+      });
+      if (matched != null) {
+        return matched.value;
+      }
+      this.output.write(`  Pick a number from 1 to ${choices.length}.
+`);
+    }
+  }
+  // ── TTY rendering ──────────────────────────────────────────────────────
+  columns() {
+    const columns = this.output.columns;
+    if (columns == null || columns < 20) {
+      return 80;
+    }
+    return columns;
+  }
+  /** Joins styled parts, cutting the text (not the styles) once `width` columns are used. */
+  fitLine(parts, width) {
+    let used = 0;
+    let line = "";
+    for (const part of parts) {
+      let text = "";
+      for (const character of part.text) {
+        const characterWidth = charWidth(character.codePointAt(0) ?? 0);
+        if (used + characterWidth > width) {
+          break;
+        }
+        used += characterWidth;
+        text += character;
+      }
+      if (part.paint != null) {
+        line += part.paint(text);
+      } else {
+        line += text;
+      }
+      if (used >= width) {
+        break;
+      }
+    }
+    return line;
+  }
+  /** The one-line record an answered prompt leaves behind on a TTY. */
+  writeAnswered(question, answer) {
+    this.output.write(`${this.style.success(this.symbols.tick)} ${question} ${this.style.dim("\xB7")} ${this.style.accent(answer)}
+`);
+  }
+  /**
+   * Replaces a cooked-mode prompt and its echoed answer with the one-line record. The
+   * rows are worked out from the widths, since a long answer wraps.
+   */
+  collapseAnswered(prompt, typed, question, answer) {
+    if (this.interactive == false) {
+      return;
+    }
+    const plainPrompt = prompt.replace(/\u001b\[[0-9;]*m/g, "");
+    const used = displayWidth(plainPrompt) + displayWidth(typed);
+    const rows = Math.max(1, Math.ceil(used / this.columns()));
+    this.output.write(`${ESC}[${rows}A\r${ESC}[J`);
+    let shown = answer;
+    if (shown === "") {
+      shown = this.style.dim("(empty)");
+    }
+    this.writeAnswered(question, shown);
+  }
+  selectWithKeys(question, items, startIndex, cancelValue) {
+    const ttyInput = this.input;
+    const selectableIndexes = items.flatMap((item, index) => {
+      if ("value" in item) {
+        return [index];
+      }
+      return [];
+    });
+    const labelWidths = groupLabelWidths(items);
+    const ruleWidth = Math.min(Math.max(...labelWidths), 24);
+    let active = startIndex;
+    let renderedLines = 0;
+    const draw = (lines) => {
+      let text = "";
+      if (renderedLines > 1) {
+        text += `${ESC}[${renderedLines - 1}A`;
+      }
+      text += `\r${ESC}[J${lines.join("\n")}`;
+      this.output.write(text);
+      renderedLines = lines.length;
+    };
+    const buildLines = () => {
+      const width = this.columns() - 1;
+      const lines = [
+        this.fitLine([
+          { text: this.symbols.question, paint: this.style.accent },
+          { text: " " },
+          { text: question, paint: this.style.bold }
+        ], width)
+      ];
+      for (let index = 0; index < items.length; index += 1) {
+        const item = items[index];
+        if ("value" in item == false) {
+          lines.push(this.fitLine([{ text: `  ${this.symbols.rule.repeat(ruleWidth)}`, paint: this.style.dim }], width));
+          continue;
+        }
+        const isActive = index === active;
+        const parts = [];
+        if (isActive == true) {
+          parts.push({ text: `${this.symbols.pointer} `, paint: this.style.accent });
+          parts.push({ text: padToWidth(item.label, labelWidths[index]), paint: this.style.accent });
+        } else {
+          parts.push({ text: "  " });
+          parts.push({ text: padToWidth(item.label, labelWidths[index]) });
+        }
+        if (item.hint != null && item.hint !== "") {
+          parts.push({ text: `  ${item.hint}`, paint: this.style.dim });
+        }
+        lines.push(this.fitLine(parts, width));
+      }
+      let footer = "\u2191\u2193 move \xB7 enter select";
+      if (cancelValue != null) {
+        footer += " \xB7 esc back";
+      }
+      lines.push(this.fitLine([{ text: footer, paint: this.style.dim }], width));
+      return lines;
+    };
+    const move = (step) => {
+      const position = selectableIndexes.indexOf(active);
+      const next = (position + step + selectableIndexes.length) % selectableIndexes.length;
+      active = selectableIndexes[next];
+    };
+    return new Promise((resolve, reject) => {
+      const finish = () => {
+        this.keyHandler = null;
+        ttyInput.setRawMode?.(false);
+        draw([]);
+        this.output.write(`${ESC}[?25h`);
+      };
+      this.keyHandler = (key) => {
+        if (key === KEY_CTRL_C || key === KEY_CTRL_D) {
+          finish();
+          reject(new PromptClosedError());
+          return;
+        }
+        if (KEY_ENTER.includes(key) == true) {
+          const picked = items[active];
+          finish();
+          this.writeAnswered(question, picked.label);
+          resolve(picked.value);
+          return;
+        }
+        if (key === ESC) {
+          if (cancelValue == null) {
+            return;
+          }
+          finish();
+          resolve(cancelValue);
+          return;
+        }
+        if (KEY_UP.includes(key) == true) {
+          move(-1);
+        } else if (KEY_DOWN.includes(key) == true) {
+          move(1);
+        } else if (KEY_HOME.includes(key) == true) {
+          active = selectableIndexes[0];
+        } else if (KEY_END.includes(key) == true) {
+          active = selectableIndexes[selectableIndexes.length - 1];
+        } else if (/^[1-9]$/.test(key) == true && Number(key) <= selectableIndexes.length) {
+          active = selectableIndexes[Number(key) - 1];
+        } else {
+          return;
+        }
+        draw(buildLines());
+      };
+      ttyInput.setRawMode?.(true);
+      this.output.write(`${ESC}[?25l`);
+      draw(buildLines());
+    });
+  }
 };
-var DEFAULT_KEY_CANDIDATES = ["~/.ssh/id_ed25519", "~/.ssh/id_ecdsa", "~/.ssh/id_rsa"];
+var PREFERRED_KEY_NAMES = ["id_ed25519", "id_ecdsa", "id_rsa"];
+var NON_KEY_FILE_NAMES = ["config", "known_hosts", "known_hosts.old", "authorized_keys", "environment"];
+var MAX_KEY_FILE_BYTES = 64 * 1024;
 var CLEAR_ANSWER = "-";
+var OTHER_KEY_PATH = "\0other";
+function findPrivateKeys() {
+  const sshDirectory = path.join(os5.homedir(), ".ssh");
+  let names = [];
+  try {
+    names = fs6.readdirSync(sshDirectory);
+  } catch {
+    return [];
+  }
+  const keys = [];
+  for (const name of names) {
+    if (name.endsWith(".pub") == true || NON_KEY_FILE_NAMES.includes(name) == true) {
+      continue;
+    }
+    const fullPath = path.join(sshDirectory, name);
+    let head = "";
+    try {
+      const stat = fs6.statSync(fullPath);
+      if (stat.isFile() == false || stat.size > MAX_KEY_FILE_BYTES) {
+        continue;
+      }
+      const descriptor = fs6.openSync(fullPath, "r");
+      const buffer = Buffer.alloc(64);
+      const bytesRead = fs6.readSync(descriptor, buffer, 0, buffer.length, 0);
+      fs6.closeSync(descriptor);
+      head = buffer.subarray(0, bytesRead).toString("utf8");
+    } catch {
+      continue;
+    }
+    const isPemKey = head.startsWith("-----BEGIN") == true && head.includes("PRIVATE KEY") == true;
+    const isPuttyKey = head.startsWith("PuTTY-User-Key-File") == true;
+    if (isPemKey == false && isPuttyKey == false) {
+      continue;
+    }
+    let hint = "";
+    try {
+      const publicKey = fs6.readFileSync(`${fullPath}.pub`, "utf8").trim().split(/\s+/);
+      hint = publicKey[0].replace(/^ssh-/, "");
+      if (publicKey.length > 2) {
+        hint += ` \xB7 ${publicKey.slice(2).join(" ")}`;
+      }
+    } catch {
+    }
+    keys.push({ path: `~/.ssh/${name}`, hint });
+  }
+  const rank = (key) => {
+    const index = PREFERRED_KEY_NAMES.indexOf(path.basename(key.path));
+    if (index < 0) {
+      return PREFERRED_KEY_NAMES.length;
+    }
+    return index;
+  };
+  return keys.sort((left, right) => rank(left) - rank(right) || left.path.localeCompare(right.path));
+}
 async function askPort(prompter, question, current) {
   for (; ; ) {
     const answer = await prompter.ask(question, String(current));
@@ -2826,11 +3238,11 @@ async function askOptional(prompter, question, current) {
   return answer;
 }
 async function askOptionalSecret(prompter, question, current) {
-  let suffix = " (empty for none)";
+  let suffix = "(empty for none)";
   if (current != null) {
-    suffix = ` [keep current, ${CLEAR_ANSWER} to clear]`;
+    suffix = `(enter keeps current, ${CLEAR_ANSWER} clears)`;
   }
-  const answer = await prompter.askSecret(`${question}${suffix}`);
+  const answer = await prompter.askSecret(`${question} ${prompter.paint.dim(suffix)}`);
   if (answer === CLEAR_ANSWER) {
     return void 0;
   }
@@ -2839,11 +3251,42 @@ async function askOptionalSecret(prompter, question, current) {
   }
   return answer;
 }
+async function askKeyPath(prompter, current) {
+  const found = findPrivateKeys();
+  let picked = OTHER_KEY_PATH;
+  if (found.length > 0 || current != null) {
+    const items = [];
+    if (current != null && found.some((key) => key.path === current) == false) {
+      items.push({ value: current, label: current, hint: "current" });
+    }
+    for (const key of found) {
+      items.push({ value: key.path, label: key.path, hint: key.hint });
+    }
+    items.push({ separator: true });
+    items.push({ value: OTHER_KEY_PATH, key: "other", label: "Another path\u2026" });
+    picked = await prompter.select("Private key", items, { defaultValue: current ?? found[0]?.path });
+  }
+  if (picked !== OTHER_KEY_PATH) {
+    return picked;
+  }
+  for (; ; ) {
+    const typed = await prompter.askRequired("Private key path");
+    if (fs6.existsSync(expandHomePath(typed)) == true) {
+      return typed;
+    }
+    prompter.write(`  ${expandHomePath(typed)} does not exist.
+`);
+    const useAnyway = await prompter.askYesNo("Use this path anyway?", false);
+    if (useAnyway == true) {
+      return typed;
+    }
+  }
+}
 async function askHostQuestions(prompter, existing) {
   if (existing != null) {
-    prompter.write(`  Enter keeps the value in brackets; ${CLEAR_ANSWER} clears an optional one.
+    prompter.write(prompter.paint.dim(`  Enter keeps the value in brackets; ${CLEAR_ANSWER} clears an optional one.
 
-`);
+`));
   }
   const host = await prompter.askRequired("Host (hostname or IP)", existing?.host);
   const port = await askPort(prompter, "Port", existing?.port ?? DEFAULT_SSH_PORT);
@@ -2857,60 +3300,60 @@ async function askHostQuestions(prompter, existing) {
     }
     prompter.write("  Use letters, digits, '-' and '_' only (max 48) \u2014 the name becomes part of every tool name.\n");
   }
-  const auth = await prompter.askChoice(
+  const auth = await prompter.select(
     "Authentication",
     [
-      { key: "key", label: "private key file  (recommended \u2014 only the path is stored)" },
-      { key: "password", label: "password  (stored in the config file in plain text)" },
-      { key: "agent", label: "ssh agent  (SSH_AUTH_SOCK / OpenSSH agent pipe)" }
+      { value: "key", label: "Private key file", hint: "only the path is stored \u2014 recommended" },
+      { value: "password", label: "Password", hint: "stored in the config file as plain text" },
+      { value: "agent", label: "SSH agent", hint: "keys already loaded in ssh-agent" }
     ],
-    existing?.auth ?? "key"
+    { defaultValue: existing?.auth ?? "key" }
   );
   let keyPath;
   let passphrase;
   let password;
   if (auth === "key") {
-    let defaultKeyPath = existing?.keyPath;
-    if (defaultKeyPath == null) {
-      defaultKeyPath = DEFAULT_KEY_CANDIDATES.find((candidate) => fs7.existsSync(expandHomePath(candidate)) == true);
-    }
-    for (; ; ) {
-      keyPath = await prompter.askRequired("Private key path", defaultKeyPath);
-      if (fs7.existsSync(expandHomePath(keyPath)) == true) {
-        break;
-      }
-      prompter.write(`  ${expandHomePath(keyPath)} does not exist.
-`);
-      const useAnyway = await prompter.askYesNo("Use this path anyway?", false);
-      if (useAnyway == true) {
-        break;
-      }
-    }
+    keyPath = await askKeyPath(prompter, existing?.keyPath);
     passphrase = await askOptionalSecret(prompter, "Key passphrase", existing?.passphrase);
   }
   if (auth === "password") {
-    prompter.write("  The password is written into the config file as plain text. A key file is safer.\n");
     password = await askOptionalSecret(prompter, "Password", existing?.password);
     if (password == null) {
       prompter.write("  No password given \u2014 falling back to the ssh agent.\n");
     }
   }
+  let currentRoute = "direct";
+  if (existing?.jumpHost != null && existing.proxyCommand != null) {
+    currentRoute = "jump-proxy";
+  } else if (existing?.jumpHost != null) {
+    currentRoute = "jump";
+  } else if (existing?.proxyCommand != null) {
+    currentRoute = "proxy";
+  }
+  const route = await prompter.select(
+    "How is it reached?",
+    [
+      { value: "direct", label: "Directly" },
+      { value: "jump", label: "Through a jump host", hint: "ssh -J" },
+      { value: "proxy", label: "Through a proxy command", hint: "e.g. cloudflared access ssh" },
+      { value: "jump-proxy", label: "Proxy command, then a jump host", hint: "cloudflared to the bastion, then on to the host" }
+    ],
+    { defaultValue: currentRoute }
+  );
   let jumpHost;
   let jumpPort;
   let jumpUser;
-  const viaJump = await prompter.askYesNo("Reach it through a jump host (ssh -J)?", existing?.jumpHost != null);
-  if (viaJump == true) {
+  let proxyCommand;
+  if (route === "jump" || route === "jump-proxy") {
     jumpHost = await prompter.askRequired("Jump host", existing?.jumpHost);
     jumpPort = await askPort(prompter, "Jump host port", existing?.jumpPort ?? DEFAULT_SSH_PORT);
     jumpUser = await prompter.askRequired("Jump host user", existing?.jumpUser ?? username);
   }
-  let proxyCommand;
-  const viaProxy = await prompter.askYesNo("Start a proxy command for the first hop (e.g. cloudflared)?", existing?.proxyCommand != null);
-  if (viaProxy == true) {
-    prompter.write("  %h / %p / %r expand to the first hop's host, port and user.\n");
+  if (route === "proxy" || route === "jump-proxy") {
+    prompter.write(prompter.paint.dim("  %h / %p / %r expand to the first hop's host, port and user.\n"));
     proxyCommand = await prompter.askRequired("Proxy command", existing?.proxyCommand ?? "cloudflared access ssh --hostname %h");
   }
-  const description = await askOptional(prompter, "Description shown to the agent (what the host is for)", existing?.description);
+  const description = await askOptional(prompter, "Description shown to the agent", existing?.description);
   const readonly = await prompter.askYesNo("Read-only? (rejects writes, redirections, uploads)", existing?.readonly ?? false);
   let currentAllowedPaths;
   if (existing != null && existing.allowedPaths.length > 0) {
@@ -2919,7 +3362,7 @@ async function askHostQuestions(prompter, existing) {
   let allowedPaths = [];
   const allowedPathsAnswer = await askOptional(
     prompter,
-    "Restrict file tools to these path prefixes (comma-separated, empty = unrestricted)",
+    "Limit file tools to path prefixes (comma-separated, empty = anywhere)",
     currentAllowedPaths
   );
   if (allowedPathsAnswer != null) {
@@ -2995,10 +3438,10 @@ function readMcpServersJson(document) {
   return entries;
 }
 function readDocument(filePath) {
-  if (fs7.existsSync(filePath) == false) {
+  if (fs6.existsSync(filePath) == false) {
     return {};
   }
-  const text = fs7.readFileSync(filePath, "utf8");
+  const text = fs6.readFileSync(filePath, "utf8");
   if (text.trim() === "") {
     return {};
   }
@@ -3020,15 +3463,15 @@ function readDocument(filePath) {
 function createJsonFileTarget(options) {
   const { id, label, filePath } = options;
   function writeDocument(document) {
-    fs7.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs7.writeFileSync(filePath, `${JSON.stringify(document, null, 4)}
+    fs6.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs6.writeFileSync(filePath, `${JSON.stringify(document, null, 4)}
 `, "utf8");
   }
   return {
     id,
     label,
     location: filePath,
-    detected: fs7.existsSync(filePath),
+    detected: fs6.existsSync(filePath),
     readEntries() {
       const document = readDocument(filePath);
       return readMcpServersJson(document);
@@ -3058,7 +3501,7 @@ function createJsonFileTarget(options) {
 }
 
 // src/modules/manage/targets/claude-code.ts
-var CLAUDE_CODE_CONFIG_PATH = path.join(os4.homedir(), ".claude.json");
+var CLAUDE_CODE_CONFIG_PATH = path.join(os5.homedir(), ".claude.json");
 var CMD_META_CHARACTER_PATTERN = /([()\][%!^"`<>&|;, *?])/g;
 function toClaudeAddJsonPayload(entry) {
   return JSON.stringify({ type: "stdio", command: entry.command, args: entry.args, env: entry.env });
@@ -3104,10 +3547,10 @@ function runClaude(executable, args) {
   return { status: "written", detail: CLAUDE_CODE_CONFIG_PATH };
 }
 function readClaudeEntries() {
-  if (fs7.existsSync(CLAUDE_CODE_CONFIG_PATH) == false) {
+  if (fs6.existsSync(CLAUDE_CODE_CONFIG_PATH) == false) {
     return {};
   }
-  const text = fs7.readFileSync(CLAUDE_CODE_CONFIG_PATH, "utf8");
+  const text = fs6.readFileSync(CLAUDE_CODE_CONFIG_PATH, "utf8");
   let document;
   try {
     document = JSON.parse(text);
@@ -3126,7 +3569,7 @@ function createClaudeCodeTarget() {
     id: "claude-code",
     label: "Claude Code (user scope)",
     location: CLAUDE_CODE_CONFIG_PATH,
-    detected: executable != null || fs7.existsSync(CLAUDE_CODE_CONFIG_PATH) == true,
+    detected: executable != null || fs6.existsSync(CLAUDE_CODE_CONFIG_PATH) == true,
     readEntries: readClaudeEntries,
     writeEntry(name, entry) {
       if (executable == null) {
@@ -3578,24 +4021,24 @@ function writeMcpServerToml(text, name, entry) {
 }
 
 // src/modules/manage/targets/codex.ts
-var CODEX_CONFIG_PATH = path.join(os4.homedir(), ".codex", "config.toml");
+var CODEX_CONFIG_PATH = path.join(os5.homedir(), ".codex", "config.toml");
 function createCodexTarget() {
   function readText() {
-    if (fs7.existsSync(CODEX_CONFIG_PATH) == false) {
+    if (fs6.existsSync(CODEX_CONFIG_PATH) == false) {
       return "";
     }
-    return fs7.readFileSync(CODEX_CONFIG_PATH, "utf8");
+    return fs6.readFileSync(CODEX_CONFIG_PATH, "utf8");
   }
   function writeText(text) {
-    fs7.mkdirSync(path.dirname(CODEX_CONFIG_PATH), { recursive: true });
-    fs7.writeFileSync(CODEX_CONFIG_PATH, text, "utf8");
+    fs6.mkdirSync(path.dirname(CODEX_CONFIG_PATH), { recursive: true });
+    fs6.writeFileSync(CODEX_CONFIG_PATH, text, "utf8");
     return { status: "written", detail: CODEX_CONFIG_PATH };
   }
   return {
     id: "codex",
     label: "Codex CLI",
     location: CODEX_CONFIG_PATH,
-    detected: findExecutable("codex") != null || fs7.existsSync(CODEX_CONFIG_PATH) == true,
+    detected: findExecutable("codex") != null || fs6.existsSync(CODEX_CONFIG_PATH) == true,
     readEntries() {
       const text = readText();
       return parseMcpServersToml(text);
@@ -3616,20 +4059,20 @@ function createCodexTarget() {
 // src/modules/manage/targets/index.ts
 function claudeDesktopConfigPath() {
   if (process.platform === "win32") {
-    const appData = process.env.APPDATA ?? path.join(os4.homedir(), "AppData", "Roaming");
+    const appData = process.env.APPDATA ?? path.join(os5.homedir(), "AppData", "Roaming");
     return path.join(appData, "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "darwin") {
-    return path.join(os4.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return path.join(os5.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
-  return path.join(os4.homedir(), ".config", "Claude", "claude_desktop_config.json");
+  return path.join(os5.homedir(), ".config", "Claude", "claude_desktop_config.json");
 }
 function listConfigTargets() {
   const targets = [
     createClaudeCodeTarget(),
     createCodexTarget(),
     createJsonFileTarget({ id: "claude-desktop", label: "Claude Desktop", filePath: claudeDesktopConfigPath() }),
-    createJsonFileTarget({ id: "cursor", label: "Cursor", filePath: path.join(os4.homedir(), ".cursor", "mcp.json") })
+    createJsonFileTarget({ id: "cursor", label: "Cursor", filePath: path.join(os5.homedir(), ".cursor", "mcp.json") })
   ];
   const detected = targets.filter((target) => target.detected == true);
   const others = targets.filter((target) => target.detected == false);
@@ -3643,6 +4086,7 @@ var SECRET_ENV_NAMES = [
   SINGLE_HOST_ENV.JUMP_PASSWORD,
   SINGLE_HOST_ENV.JUMP_PASSPHRASE
 ];
+var HOST_VALUE_PREFIX = "host:";
 function errorMessage(error) {
   if (error instanceof Error) {
     return error.message;
@@ -3670,14 +4114,14 @@ function formatForTarget(target, name, entry) {
 function indent(text) {
   return text.replace(/\n$/, "").split("\n").map((line) => `    ${line}`).join("\n");
 }
-function reportWrite(output, result, action) {
+function reportWrite(prompter, result, action) {
   if (result.status === "written") {
-    output.write(`  ${action} \u2014 ${result.detail}
+    prompter.write(`  ${prompter.paint.success(action)} ${prompter.paint.dim(result.detail)}
 `);
-    output.write("  Restart the client (or reconnect it from its MCP menu) to pick up the change.\n\n");
+    prompter.write(prompter.paint.dim("  Restart the client (or reconnect it from its MCP menu) to pick up the change.\n\n"));
     return;
   }
-  output.write(`  Not ${action.toLowerCase()}: ${result.detail}
+  prompter.write(`  Not ${action.toLowerCase()}: ${result.detail}
 
 `);
 }
@@ -3708,13 +4152,13 @@ async function verifyAnswers(prompter, output, initial) {
       output.write("\n");
       if (result.connected == true) {
         if (result.hostKeyFingerprint != null && answers.hostKeyFingerprint == null) {
-          const pin = await prompter.askYesNo(`Pin the host key ${result.hostKeyFingerprint}? (a changed key then aborts the connection)`, true);
+          const pin = await prompter.askYesNo("Pin this host key? (a changed key then aborts the connection)", true);
           if (pin == true) {
             answers = { ...answers, hostKeyFingerprint: result.hostKeyFingerprint };
           }
         }
         if (result.jumpHostKeyFingerprint != null && answers.jumpHost != null && answers.jumpHostKeyFingerprint == null) {
-          const pin = await prompter.askYesNo(`Pin the jump host key ${result.jumpHostKeyFingerprint}?`, true);
+          const pin = await prompter.askYesNo("Pin the jump host key too?", true);
           if (pin == true) {
             answers = { ...answers, jumpHostKeyFingerprint: result.jumpHostKeyFingerprint };
           }
@@ -3740,23 +4184,23 @@ async function verifyAnswers(prompter, output, initial) {
         }
       }
     }
-    const next = await prompter.askChoice(
-      "What now?",
+    const next = await prompter.select(
+      "The check failed. What now?",
       [
-        { key: "r", label: "retry the check" },
-        { key: "e", label: "edit the answers" },
-        { key: "w", label: "write it anyway" },
-        { key: "c", label: "cancel" }
+        { value: "edit", key: "e", label: "Change the answers" },
+        { value: "retry", key: "r", label: "Try again", hint: "e.g. after starting a tunnel" },
+        { value: "write", key: "w", label: "Write it anyway", hint: "the host may be unreachable from here" },
+        { value: "cancel", key: "c", label: "Cancel", hint: "nothing is written" }
       ],
-      "e"
+      { defaultValue: "edit", cancelValue: "cancel" }
     );
-    if (next === "c") {
+    if (next === "cancel") {
       return null;
     }
-    if (next === "w") {
+    if (next === "write") {
       return answers;
     }
-    if (next === "e") {
+    if (next === "edit") {
       output.write("\n");
       answers = await askHostQuestions(prompter, answers);
     }
@@ -3767,10 +4211,12 @@ async function addOrEditHost(prompter, output, target, entries, existingName) {
   if (existingName != null) {
     existing = entryToAnswers(existingName, entries[existingName]);
     output.write(`
-Editing ${existingName}
+${prompter.paint.bold(`Editing ${existingName}`)}
 `);
   } else {
-    output.write("\nAdding a host\n");
+    output.write(`
+${prompter.paint.bold("Adding a host")}
+`);
   }
   const asked = await askHostQuestions(prompter, existing);
   output.write("\n");
@@ -3788,7 +4234,7 @@ Editing ${existingName}
   }
   const entry = answersToEntry(answers);
   output.write(`
-  This goes into ${target.location}:
+  ${prompter.paint.dim(`This goes into ${target.location}:`)}
 
 `);
   output.write(`${indent(formatForTarget(target, answers.name, maskSecrets(entry)))}
@@ -3796,11 +4242,11 @@ Editing ${existingName}
 `);
   const confirmed = await prompter.askYesNo("Write it?", true);
   if (confirmed == false) {
-    output.write("  Not written. The print view (p) gives the same entry ready to paste.\n\n");
+    output.write("  Not written. Pick the host and choose Print to get the entry ready to paste.\n\n");
     return;
   }
   const written = target.writeEntry(answers.name, entry);
-  reportWrite(output, written, "Written");
+  reportWrite(prompter, written, "Written");
   if (written.status === "written" && existingName != null && existingName !== answers.name) {
     const removed = target.removeEntry(existingName);
     if (removed.status === "unavailable") {
@@ -3825,14 +4271,14 @@ async function checkHost(prompter, output, target, name, entry) {
   const env = { ...entry.env };
   let changed = false;
   if (result.hostKeyFingerprint != null && env[SINGLE_HOST_ENV.HOST_KEY] == null) {
-    const pin = await prompter.askYesNo(`Pin the host key ${result.hostKeyFingerprint}?`, true);
+    const pin = await prompter.askYesNo("Pin this host key?", true);
     if (pin == true) {
       env[SINGLE_HOST_ENV.HOST_KEY] = result.hostKeyFingerprint;
       changed = true;
     }
   }
   if (result.jumpHostKeyFingerprint != null && env[SINGLE_HOST_ENV.JUMP_HOST_KEY] == null) {
-    const pin = await prompter.askYesNo(`Pin the jump host key ${result.jumpHostKeyFingerprint}?`, true);
+    const pin = await prompter.askYesNo("Pin the jump host key too?", true);
     if (pin == true) {
       env[SINGLE_HOST_ENV.JUMP_HOST_KEY] = result.jumpHostKeyFingerprint;
       changed = true;
@@ -3840,76 +4286,79 @@ async function checkHost(prompter, output, target, name, entry) {
   }
   if (changed == true) {
     const written = target.writeEntry(name, { ...entry, env });
-    reportWrite(output, written, "Pinned");
+    reportWrite(prompter, written, "Pinned");
   }
 }
-function printHost(output, name, entry) {
-  output.write('\n  JSON \u2014 Claude Desktop, Cursor, .mcp.json (inside "mcpServers"):\n\n');
-  output.write(`${indent(`"${name}": ${JSON.stringify(entry, null, 4)}`)}
+function printHost(prompter, name, entry) {
+  prompter.write(`
+  ${prompter.paint.dim('JSON \u2014 Claude Desktop, Cursor, .mcp.json (inside "mcpServers"):')}
 
 `);
-  output.write("  TOML \u2014 Codex (~/.codex/config.toml):\n\n");
-  output.write(`${indent(renderMcpServerTable(name, entry))}
+  prompter.write(`${indent(`"${name}": ${JSON.stringify(entry, null, 4)}`)}
 
 `);
-  output.write("  Claude Code CLI (bash / zsh / Git Bash):\n\n");
-  output.write(`${indent(formatClaudeAddCommand(name, entry))}
+  prompter.write(`  ${prompter.paint.dim("TOML \u2014 Codex (~/.codex/config.toml):")}
 
 `);
-}
-async function pickHost(prompter, output, names) {
-  if (names.length === 0) {
-    output.write("  No hosts yet \u2014 add one with a.\n\n");
-    return null;
-  }
-  if (names.length === 1) {
-    return names[0];
-  }
-  for (; ; ) {
-    const answer = await prompter.ask("Which host (number or name, empty to go back)");
-    if (answer === "") {
-      return null;
-    }
-    const index = Number(answer);
-    if (Number.isInteger(index) == true && index >= 1 && index <= names.length) {
-      return names[index - 1];
-    }
-    if (names.includes(answer) == true) {
-      return answer;
-    }
-    output.write(`  No host "${answer}".
+  prompter.write(`${indent(renderMcpServerTable(name, entry))}
+
 `);
-  }
-}
-function renderHostList(output, target, entries) {
-  const names = Object.keys(entries).filter((name) => isOurEntry(entries[name]) == true);
-  const otherCount = Object.keys(entries).length - names.length;
-  output.write(`
-${target.label} \u2014 ${target.location}
+  prompter.write(`  ${prompter.paint.dim("Claude Code CLI (bash / zsh / Git Bash):")}
 
 `);
-  if (names.length === 0) {
-    output.write("  No SSH hosts registered here yet.\n");
-  } else {
-    const rows = names.map((name, index) => {
-      const summary = summarizeEntry(entries[name]);
-      return [String(index + 1), name, summary.endpoint, summary.auth, summary.notes];
-    });
-    const header = ["#", "Server", "Endpoint", "Auth", "Notes"];
-    const widths = header.map((title, column) => Math.max(title.length, ...rows.map((row) => row[column].length)));
-    for (const row of [header, ...rows]) {
-      const line = row.map((cell, column) => cell.padEnd(widths[column])).join("  ").trimEnd();
-      output.write(`  ${line}
+  prompter.write(`${indent(formatClaudeAddCommand(name, entry))}
+
 `);
+}
+function buildHostItems(names, entries) {
+  const nameWidth = Math.max(...names.map((name) => displayWidth(name)));
+  const summaries = names.map((name) => summarizeEntry(entries[name]));
+  const endpointWidth = Math.max(...summaries.map((summary) => displayWidth(summary.endpoint)));
+  return names.map((name, index) => {
+    const summary = summaries[index];
+    const hintParts = [summary.auth];
+    if (summary.notes !== "") {
+      hintParts.push(summary.notes);
     }
+    return {
+      value: `${HOST_VALUE_PREFIX}${name}`,
+      key: name,
+      label: `${name.padEnd(nameWidth)}  ${summary.endpoint.padEnd(endpointWidth)}`,
+      hint: hintParts.join(" \xB7 ")
+    };
+  });
+}
+async function manageHost(prompter, output, target, entries, name) {
+  const action = await prompter.select(
+    name,
+    [
+      { value: "edit", key: "e", label: "Edit", hint: "change the answers, re-check, re-write" },
+      { value: "check", key: "c", label: "Check the connection", hint: "connect now and offer to pin the host key" },
+      { value: "print", key: "p", label: "Print the entry", hint: "JSON, Codex TOML and a claude command, ready to paste" },
+      { value: "remove", key: "r", label: "Remove", hint: `from ${target.label}` },
+      { separator: true },
+      { value: "back", key: "b", label: "Back" }
+    ],
+    { defaultValue: "edit", cancelValue: "back" }
+  );
+  if (action === "edit") {
+    await addOrEditHost(prompter, output, target, entries, name);
+    return;
   }
-  if (otherCount > 0) {
-    output.write(`
-  ${otherCount} other MCP server(s) in this file are not managed here.
-`);
+  if (action === "check") {
+    await checkHost(prompter, output, target, name, entries[name]);
+    return;
+  }
+  if (action === "print") {
+    printHost(prompter, name, entries[name]);
+    return;
+  }
+  if (action === "remove") {
+    const remove = await prompter.askYesNo(`Remove ${name} from ${target.location}?`, false);
+    if (remove == true) {
+      reportWrite(prompter, target.removeEntry(name), "Removed");
+    }
   }
-  output.write("\n");
-  return names;
 }
 async function runConfigCommand(options) {
   const { input, output } = options;
@@ -3925,81 +4374,88 @@ async function runConfigCommand(options) {
     target = requested;
   }
   const prompter = new Prompter(input, output);
+  const paint = prompter.paint;
   try {
     for (; ; ) {
       let entries = {};
       let names = [];
-      let readable = true;
+      let readError = null;
       try {
         entries = target.readEntries();
-        names = renderHostList(output, target, entries);
+        names = Object.keys(entries).filter((name) => isOurEntry(entries[name]) == true);
       } catch (ex) {
-        readable = false;
-        output.write(`
-${target.label} \u2014 ${target.location}
-
-  Cannot read it: ${errorMessage(ex)}
+        readError = errorMessage(ex);
+      }
+      output.write(`
+${paint.bold(target.label)}  ${paint.dim(target.location)}
+`);
+      if (readError != null) {
+        output.write(`  Cannot read it: ${readError}
   Fix the file by hand, or switch to another client.
-
 `);
+      } else {
+        const otherCount = Object.keys(entries).length - names.length;
+        if (otherCount > 0) {
+          output.write(paint.dim(`  ${otherCount} other MCP server(s) in this file are not managed here.
+`));
+        }
+      }
+      output.write("\n");
+      const items = [];
+      if (names.length > 0) {
+        items.push(...buildHostItems(names, entries));
+        items.push({ separator: true });
       }
-      let menu = "  t) switch client   q) quit";
-      if (readable == true && names.length > 0) {
-        menu = "  a) add   e) edit   r) remove   c) check   p) print   t) switch client   q) quit";
-      } else if (readable == true) {
-        menu = "  a) add   t) switch client   q) quit";
+      if (readError == null) {
+        items.push({ value: "add", key: "a", label: "Add a host" });
       }
-      output.write(`${menu}
-`);
-      const action = (await prompter.ask("Choice")).toLowerCase();
-      if (action === "q" || action === "quit") {
+      const otherTargets = targets.filter((candidate) => candidate.id !== target.id);
+      if (otherTargets.length > 0) {
+        const detectedOthers = otherTargets.filter((candidate) => candidate.detected == true).map((candidate) => candidate.label);
+        let switchHint = "";
+        if (detectedOthers.length > 0) {
+          switchHint = `also found: ${detectedOthers.join(", ")}`;
+        }
+        items.push({ value: "switch", key: "t", label: "Switch client", hint: switchHint });
+      }
+      items.push({ value: "quit", key: "q", label: "Quit" });
+      let question = "No SSH hosts here yet";
+      if (names.length === 1) {
+        question = "1 SSH host \u2014 pick it to manage it";
+      } else if (names.length > 1) {
+        question = `${names.length} SSH hosts \u2014 pick one to manage it`;
+      }
+      let defaultValue = "add";
+      if (names.length > 0) {
+        defaultValue = `${HOST_VALUE_PREFIX}${names[0]}`;
+      }
+      const picked = await prompter.select(question, items, { defaultValue, cancelValue: "quit" });
+      if (picked === "quit") {
         return 0;
       }
-      if (action === "t") {
-        const picked = await prompter.askChoice(
+      if (picked === "switch") {
+        const switched = await prompter.select(
           "Which client?",
           targets.map((candidate) => {
-            let mark = "";
-            if (candidate.detected == true) {
-              mark = "  (detected)";
+            let hint = candidate.location;
+            if (candidate.detected == false) {
+              hint += " \xB7 not found on this machine";
             }
-            return { key: candidate.id, label: `${candidate.label} \u2014 ${candidate.location}${mark}` };
+            return { value: candidate.id, label: candidate.label, hint };
           }),
-          target.id
+          { defaultValue: target.id, cancelValue: target.id }
         );
-        target = targets.find((candidate) => candidate.id === picked) ?? target;
-        continue;
-      }
-      if (readable == false) {
-        output.write("  Not available while the file cannot be read.\n");
+        target = targets.find((candidate) => candidate.id === switched) ?? target;
         continue;
       }
       try {
-        if (action === "a") {
+        if (picked === "add") {
           await addOrEditHost(prompter, output, target, entries);
           continue;
         }
-        if (action === "e" || action === "r" || action === "c" || action === "p") {
-          const name = await pickHost(prompter, output, names);
-          if (name == null) {
-            continue;
-          }
-          if (action === "e") {
-            await addOrEditHost(prompter, output, target, entries, name);
-          } else if (action === "r") {
-            const remove = await prompter.askYesNo(`Remove ${name} from ${target.location}?`, false);
-            if (remove == true) {
-              reportWrite(output, target.removeEntry(name), "Removed");
-            }
-          } else if (action === "c") {
-            await checkHost(prompter, output, target, name, entries[name]);
-          } else {
-            printHost(output, name, entries[name]);
-          }
-          continue;
+        if (picked.startsWith(HOST_VALUE_PREFIX) == true) {
+          await manageHost(prompter, output, target, entries, picked.slice(HOST_VALUE_PREFIX.length));
         }
-        output.write(`  Unknown choice "${action}".
-`);
       } catch (ex) {
         if (ex instanceof PromptClosedError) {
           throw ex;
@@ -4448,7 +4904,7 @@ ${file.content}`);
         const { profile, session: openSession } = resolveProfile(context, { session });
         const resolvedLocalPath = expandHomePath(localPath);
         requirePermittedLocalPath(resolvedLocalPath, "read");
-        if (fs7.existsSync(resolvedLocalPath) == false) {
+        if (fs6.existsSync(resolvedLocalPath) == false) {
           return textResult(`local file not found: ${resolvedLocalPath}`);
         }
         const transferredBytes = await withHostConnection(profile, openSession, async (connection) => {
@@ -4488,7 +4944,7 @@ ${file.content}`);
         const { profile, session: openSession } = resolveProfile(context, { session });
         const resolvedLocalPath = expandHomePath(localPath);
         requirePermittedLocalPath(resolvedLocalPath, "write");
-        fs7.mkdirSync(path.dirname(resolvedLocalPath), { recursive: true });
+        fs6.mkdirSync(path.dirname(resolvedLocalPath), { recursive: true });
         const transferredBytes = await withHostConnection(profile, openSession, async (connection) => {
           return await downloadFile(connection, remotePath, resolvedLocalPath);
         });