@akms/mcp-ssh 0.1.1 → 0.1.2

package/lib/cli.js

@@ -26,7 +26,7 @@ var CWD_MARKER = "__AKMS_SSH_CWD__";
 var MAX_DIRECTORY_ENTRIES = 1e3;
 var SERVER_NAME = "akms-mcp-ssh";
 var PACKAGE_NAME = "@akms/mcp-ssh";
-var SERVER_VERSION = "0.1.1";
+var SERVER_VERSION = "0.1.2";
 
 // src/_defs/command-rules.ts
 var CRITICAL_PATH_PATTERN = new RegExp(
@@ -2359,6 +2359,23 @@ async function downloadFile(connection, remotePath, localPath) {
 }
 
 // src/modules/manage/connection-check.ts
+function profileFromEnv(output, env) {
+  try {
+    const profile = loadHostProfile(env);
+    if (profile == null) {
+      output.write("  The entry has no host.\n");
+    }
+    return profile;
+  } catch (ex) {
+    let detail = String(ex);
+    if (ex instanceof Error) {
+      detail = ex.message;
+    }
+    output.write(`  The server would refuse to start with this entry: ${detail}
+`);
+    return null;
+  }
+}
 function describeAuth(profile) {
   if (profile.privateKeyPath != null) {
     return `key ${profile.privateKeyPath}`;
@@ -2617,6 +2634,654 @@ function summarizeEntry(entry) {
     notes: notes.join(", ")
   };
 }
+var PREFERRED_KEY_NAMES = ["id_ed25519", "id_ecdsa", "id_rsa"];
+var NON_KEY_FILE_NAMES = ["config", "known_hosts", "known_hosts.old", "authorized_keys", "environment"];
+var MAX_KEY_FILE_BYTES = 64 * 1024;
+var CLEAR_ANSWER = "-";
+var OTHER_KEY_PATH = "\0other";
+var FIELD_NAME_WIDTH = 17;
+var SUB_FIELDS = ["key", "passphrase", "password", "jump-host", "jump-port", "jump-user", "proxy"];
+var FIELD_NAMES = {
+  "host": "Host",
+  "port": "Port",
+  "user": "User",
+  "name": "Server name",
+  "auth": "Authentication",
+  "key": "Private key",
+  "passphrase": "Passphrase",
+  "password": "Password",
+  "route": "Route",
+  "jump-host": "Jump host",
+  "jump-port": "Jump port",
+  "jump-user": "Jump user",
+  "proxy": "Proxy command",
+  "description": "Description",
+  "readonly": "Read-only",
+  "paths": "File paths",
+  "host-key": "Host key",
+  "jump-host-key": "Jump host key"
+};
+var AUTH_LABELS = {
+  key: "Private key file",
+  password: "Password",
+  agent: "SSH agent"
+};
+var ROUTE_LABELS = {
+  "direct": "Directly",
+  "jump": "Through a jump host",
+  "proxy": "Through a proxy command",
+  "jump-proxy": "Proxy command, then a jump host"
+};
+var REQUIRED_MARK = "(required)";
+function findPrivateKeys() {
+  const sshDirectory = path.join(os5.homedir(), ".ssh");
+  let names = [];
+  try {
+    names = fs6.readdirSync(sshDirectory);
+  } catch {
+    return [];
+  }
+  const keys = [];
+  for (const name of names) {
+    if (name.endsWith(".pub") == true || NON_KEY_FILE_NAMES.includes(name) == true) {
+      continue;
+    }
+    const fullPath = path.join(sshDirectory, name);
+    let head = "";
+    try {
+      const stat = fs6.statSync(fullPath);
+      if (stat.isFile() == false || stat.size > MAX_KEY_FILE_BYTES) {
+        continue;
+      }
+      const descriptor = fs6.openSync(fullPath, "r");
+      const buffer = Buffer.alloc(64);
+      const bytesRead = fs6.readSync(descriptor, buffer, 0, buffer.length, 0);
+      fs6.closeSync(descriptor);
+      head = buffer.subarray(0, bytesRead).toString("utf8");
+    } catch {
+      continue;
+    }
+    const isPemKey = head.startsWith("-----BEGIN") == true && head.includes("PRIVATE KEY") == true;
+    const isPuttyKey = head.startsWith("PuTTY-User-Key-File") == true;
+    if (isPemKey == false && isPuttyKey == false) {
+      continue;
+    }
+    let hint = "";
+    try {
+      const publicKey = fs6.readFileSync(`${fullPath}.pub`, "utf8").trim().split(/\s+/);
+      hint = publicKey[0].replace(/^ssh-/, "");
+      if (publicKey.length > 2) {
+        hint += ` \xB7 ${publicKey.slice(2).join(" ")}`;
+      }
+    } catch {
+    }
+    keys.push({ path: `~/.ssh/${name}`, hint });
+  }
+  const rank = (key) => {
+    const index = PREFERRED_KEY_NAMES.indexOf(path.basename(key.path));
+    if (index < 0) {
+      return PREFERRED_KEY_NAMES.length;
+    }
+    return index;
+  };
+  return keys.sort((left, right) => rank(left) - rank(right) || left.path.localeCompare(right.path));
+}
+async function askPort(prompter, question, current) {
+  for (; ; ) {
+    const answer = await prompter.ask(question, String(current));
+    const parsed = Number(answer);
+    if (Number.isInteger(parsed) == true && parsed > 0 && parsed <= 65535) {
+      return parsed;
+    }
+    prompter.write("  Enter a port number between 1 and 65535.\n");
+  }
+}
+async function askOptional(prompter, question, current) {
+  const answer = await prompter.ask(question, current);
+  if (answer === "" || answer === CLEAR_ANSWER) {
+    return void 0;
+  }
+  return answer;
+}
+async function askOptionalSecret(prompter, question, current) {
+  let suffix = "(empty for none)";
+  if (current != null) {
+    suffix = `(enter keeps current, ${CLEAR_ANSWER} clears)`;
+  }
+  const answer = await prompter.askSecret(`${question} ${prompter.paint.dim(suffix)}`);
+  if (answer === CLEAR_ANSWER) {
+    return void 0;
+  }
+  if (answer === "") {
+    return current;
+  }
+  return answer;
+}
+async function askKeyPath(prompter, current) {
+  const found = findPrivateKeys();
+  let picked = OTHER_KEY_PATH;
+  if (found.length > 0 || current != null) {
+    const items = [];
+    if (current != null && found.some((key) => key.path === current) == false) {
+      items.push({ value: current, label: current, hint: "current" });
+    }
+    for (const key of found) {
+      items.push({ value: key.path, label: key.path, hint: key.hint });
+    }
+    items.push({ separator: true });
+    items.push({ value: OTHER_KEY_PATH, key: "other", label: "Another path\u2026" });
+    picked = await prompter.select("Private key", items, { defaultValue: current ?? found[0]?.path });
+  }
+  if (picked !== OTHER_KEY_PATH) {
+    return picked;
+  }
+  for (; ; ) {
+    const typed = await prompter.askRequired("Private key path");
+    if (fs6.existsSync(expandHomePath(typed)) == true) {
+      return typed;
+    }
+    prompter.write(`  ${expandHomePath(typed)} does not exist.
+`);
+    const useAnyway = await prompter.askYesNo("Use this path anyway?", false);
+    if (useAnyway == true) {
+      return typed;
+    }
+  }
+}
+function routeUsesJump(route) {
+  return route === "jump" || route === "jump-proxy";
+}
+function routeUsesProxy(route) {
+  return route === "proxy" || route === "jump-proxy";
+}
+function deriveServerName(host) {
+  return `ssh-${host}`.replace(/[^A-Za-z0-9_-]+/g, "-").slice(0, 48);
+}
+function finalizeAnswers(state) {
+  const answers = { ...state.answers };
+  if (routeUsesJump(state.route) == false) {
+    answers.jumpHost = void 0;
+    answers.jumpPort = void 0;
+    answers.jumpUser = void 0;
+    answers.jumpHostKeyFingerprint = void 0;
+  }
+  if (routeUsesProxy(state.route) == false) {
+    answers.proxyCommand = void 0;
+  }
+  if (answers.auth !== "key") {
+    answers.keyPath = void 0;
+    answers.passphrase = void 0;
+  }
+  if (answers.auth !== "password") {
+    answers.password = void 0;
+  }
+  return answers;
+}
+function snapshotOf(state) {
+  return JSON.stringify(finalizeAnswers(state));
+}
+function missingFields(state) {
+  const { answers } = state;
+  const missing = [];
+  if (answers.host === "") {
+    missing.push("host");
+  }
+  if (answers.username === "") {
+    missing.push("user");
+  }
+  if (answers.auth === "key" && answers.keyPath == null) {
+    missing.push("key");
+  }
+  if (answers.auth === "password" && answers.password == null) {
+    missing.push("password");
+  }
+  if (routeUsesJump(state.route) == true && answers.jumpHost == null) {
+    missing.push("jump-host");
+  }
+  if (routeUsesProxy(state.route) == true && answers.proxyCommand == null) {
+    missing.push("proxy");
+  }
+  return missing;
+}
+function describePin(fingerprint) {
+  if (fingerprint == null) {
+    return "not pinned";
+  }
+  return `pinned \xB7 ${fingerprint.slice(0, 19)}\u2026`;
+}
+function valueOrRequired(value) {
+  if (value == null || value === "") {
+    return REQUIRED_MARK;
+  }
+  return value;
+}
+function fieldRow(id, value, hint) {
+  let name = FIELD_NAMES[id];
+  if (SUB_FIELDS.includes(id) == true) {
+    name = `  ${name}`;
+  }
+  return {
+    value: id,
+    key: id,
+    label: `${name.padEnd(FIELD_NAME_WIDTH)}${value}`,
+    hint
+  };
+}
+function buildRows(state, destination) {
+  const { answers } = state;
+  const rows = [];
+  rows.push(fieldRow("host", valueOrRequired(answers.host)));
+  rows.push(fieldRow("port", String(answers.port)));
+  rows.push(fieldRow("user", valueOrRequired(answers.username)));
+  let nameValue = answers.name;
+  let nameHint = "what the agent sees";
+  if (state.nameTouched == false) {
+    nameHint = "follows the host until you change it";
+  }
+  if (nameValue === "") {
+    nameValue = "ssh-<host>";
+  }
+  rows.push(fieldRow("name", nameValue, nameHint));
+  rows.push(fieldRow("auth", AUTH_LABELS[answers.auth]));
+  if (answers.auth === "key") {
+    rows.push(fieldRow("key", valueOrRequired(answers.keyPath)));
+    let passphrase = "none";
+    if (answers.passphrase != null) {
+      passphrase = "set";
+    }
+    rows.push(fieldRow("passphrase", passphrase));
+  }
+  if (answers.auth === "password") {
+    let password = REQUIRED_MARK;
+    if (answers.password != null) {
+      password = "set";
+    }
+    rows.push(fieldRow("password", password, "stored in the config file as plain text"));
+  }
+  rows.push(fieldRow("route", ROUTE_LABELS[state.route]));
+  if (routeUsesJump(state.route) == true) {
+    rows.push(fieldRow("jump-host", valueOrRequired(answers.jumpHost)));
+    rows.push(fieldRow("jump-port", String(answers.jumpPort ?? DEFAULT_SSH_PORT)));
+    let jumpUser = answers.jumpUser;
+    if (jumpUser == null || jumpUser === answers.username) {
+      let loginUser = answers.username;
+      if (loginUser === "") {
+        loginUser = "\u2026";
+      }
+      jumpUser = `same as login (${loginUser})`;
+    }
+    rows.push(fieldRow("jump-user", jumpUser));
+  }
+  if (routeUsesProxy(state.route) == true) {
+    rows.push(fieldRow("proxy", valueOrRequired(answers.proxyCommand), "%h %p %r \u2192 first hop"));
+  }
+  rows.push(fieldRow("description", answers.description ?? "none", "shown to the agent"));
+  let readonly = "no";
+  if (answers.readonly == true) {
+    readonly = "yes";
+  }
+  rows.push(fieldRow("readonly", readonly, "enter toggles"));
+  let paths = "anywhere";
+  if (answers.allowedPaths.length > 0) {
+    paths = answers.allowedPaths.join(", ");
+  }
+  rows.push(fieldRow("paths", paths, "where the file tools may read and write"));
+  rows.push(fieldRow("host-key", describePin(answers.hostKeyFingerprint)));
+  if (routeUsesJump(state.route) == true) {
+    rows.push(fieldRow("jump-host-key", describePin(answers.jumpHostKeyFingerprint)));
+  }
+  rows.push({ separator: true });
+  let testHint = "not run yet";
+  if (state.lastTest === "ok") {
+    testHint = "last run: OK";
+  } else if (state.lastTest === "failed") {
+    testHint = "last run: failed";
+  }
+  rows.push({ value: "test", key: "test", label: "Test the connection", hint: testHint });
+  rows.push({ value: "save", key: "save", label: "Save", hint: `to ${destination}` });
+  rows.push({ value: "cancel", key: "cancel", label: "Cancel" });
+  return rows;
+}
+function nextCursor(state, destination, edited) {
+  if (edited === "readonly") {
+    return edited;
+  }
+  const values = buildRows(state, destination).flatMap((row) => {
+    if ("value" in row) {
+      return [row.value];
+    }
+    return [];
+  });
+  let index = values.indexOf(edited) + 1;
+  if (SUB_FIELDS.includes(edited) == false) {
+    while (index < values.length && SUB_FIELDS.includes(values[index]) == true) {
+      index += 1;
+    }
+  }
+  const next = values[index];
+  if (next == null || next === "test") {
+    return "save";
+  }
+  return next;
+}
+async function testConnection(prompter, output, state) {
+  const answers = finalizeAnswers(state);
+  output.write("\n");
+  const profile = profileFromEnv(output, answersToEntry(answers).env);
+  if (profile == null) {
+    output.write("\n");
+    state.lastTest = "failed";
+    return false;
+  }
+  const result = await runConnectionCheck(profile, output);
+  output.write("\n");
+  if (result.connected == true) {
+    if (result.hostKeyFingerprint != null && state.answers.hostKeyFingerprint == null) {
+      const pin = await prompter.askYesNo("Pin this host key? (a changed key then aborts the connection)", true);
+      if (pin == true) {
+        state.answers.hostKeyFingerprint = result.hostKeyFingerprint;
+      }
+    }
+    if (result.jumpHostKeyFingerprint != null && routeUsesJump(state.route) == true && state.answers.jumpHostKeyFingerprint == null) {
+      const pin = await prompter.askYesNo("Pin the jump host key too?", true);
+      if (pin == true) {
+        state.answers.jumpHostKeyFingerprint = result.jumpHostKeyFingerprint;
+      }
+    }
+    state.lastTest = "ok";
+    state.testedSnapshot = snapshotOf(state);
+    return true;
+  }
+  const hostKeyChanged = result.hostKeyFingerprint != null && state.answers.hostKeyFingerprint != null && result.hostKeyFingerprint !== state.answers.hostKeyFingerprint;
+  if (hostKeyChanged == true) {
+    output.write("  The host presented a different key than the pinned one. Re-pin only if you know it was rebuilt.\n");
+    const repin = await prompter.askYesNo(`Pin ${result.hostKeyFingerprint} instead?`, false);
+    if (repin == true) {
+      state.answers.hostKeyFingerprint = result.hostKeyFingerprint ?? void 0;
+      output.write("  Pinned the new key \u2014 test again to confirm.\n");
+    }
+  }
+  const jumpKeyChanged = result.jumpHostKeyFingerprint != null && state.answers.jumpHostKeyFingerprint != null && result.jumpHostKeyFingerprint !== state.answers.jumpHostKeyFingerprint;
+  if (jumpKeyChanged == true) {
+    output.write("  The jump host presented a different key than the pinned one. Re-pin only if you know it was rebuilt.\n");
+    const repin = await prompter.askYesNo(`Pin ${result.jumpHostKeyFingerprint} instead?`, false);
+    if (repin == true) {
+      state.answers.jumpHostKeyFingerprint = result.jumpHostKeyFingerprint ?? void 0;
+      output.write("  Pinned the new key \u2014 test again to confirm.\n");
+    }
+  }
+  state.lastTest = "failed";
+  return false;
+}
+async function editField(prompter, output, state, id) {
+  const { answers } = state;
+  if (id === "host") {
+    let current;
+    if (answers.host !== "") {
+      current = answers.host;
+    }
+    answers.host = await prompter.askRequired("Host (hostname or IP)", current);
+    if (state.nameTouched == false) {
+      answers.name = deriveServerName(answers.host);
+    }
+    return;
+  }
+  if (id === "port") {
+    answers.port = await askPort(prompter, "Port", answers.port);
+    return;
+  }
+  if (id === "user") {
+    let current;
+    if (answers.username !== "") {
+      current = answers.username;
+    }
+    answers.username = await prompter.askRequired("Login user", current);
+    return;
+  }
+  if (id === "name") {
+    let current;
+    if (answers.name !== "") {
+      current = answers.name;
+    }
+    for (; ; ) {
+      const name = await prompter.askRequired("Server name the agent sees", current);
+      if (SERVER_NAME_PATTERN.test(name) == true) {
+        answers.name = name;
+        state.nameTouched = true;
+        return;
+      }
+      prompter.write("  Use letters, digits, '-' and '_' only (max 48) \u2014 the name becomes part of every tool name.\n");
+    }
+  }
+  if (id === "auth") {
+    answers.auth = await prompter.select(
+      "Authentication",
+      [
+        { value: "key", label: AUTH_LABELS.key, hint: "only the path is stored \u2014 recommended" },
+        { value: "password", label: AUTH_LABELS.password, hint: "stored in the config file as plain text" },
+        { value: "agent", label: AUTH_LABELS.agent, hint: "keys already loaded in ssh-agent" }
+      ],
+      { defaultValue: answers.auth }
+    );
+    if (answers.auth === "key" && answers.keyPath == null) {
+      answers.keyPath = await askKeyPath(prompter, void 0);
+    }
+    if (answers.auth === "password" && answers.password == null) {
+      answers.password = await askOptionalSecret(prompter, "Password", void 0);
+    }
+    return;
+  }
+  if (id === "key") {
+    answers.keyPath = await askKeyPath(prompter, answers.keyPath);
+    return;
+  }
+  if (id === "passphrase") {
+    answers.passphrase = await askOptionalSecret(prompter, "Key passphrase", answers.passphrase);
+    return;
+  }
+  if (id === "password") {
+    answers.password = await askOptionalSecret(prompter, "Password", answers.password);
+    return;
+  }
+  if (id === "route") {
+    state.route = await prompter.select(
+      "Route",
+      [
+        { value: "direct", label: ROUTE_LABELS.direct },
+        { value: "jump", label: ROUTE_LABELS.jump, hint: "ssh -J" },
+        { value: "proxy", label: ROUTE_LABELS.proxy, hint: "e.g. cloudflared access ssh" },
+        { value: "jump-proxy", label: ROUTE_LABELS["jump-proxy"], hint: "cloudflared to the bastion, then on to the host" }
+      ],
+      { defaultValue: state.route }
+    );
+    if (routeUsesJump(state.route) == true && answers.jumpHost == null) {
+      answers.jumpHost = await prompter.askRequired("Jump host");
+    }
+    if (routeUsesProxy(state.route) == true && answers.proxyCommand == null) {
+      answers.proxyCommand = await prompter.askRequired("Proxy command", "cloudflared access ssh --hostname %h");
+    }
+    return;
+  }
+  if (id === "jump-host") {
+    answers.jumpHost = await prompter.askRequired("Jump host", answers.jumpHost);
+    return;
+  }
+  if (id === "jump-port") {
+    answers.jumpPort = await askPort(prompter, "Jump host port", answers.jumpPort ?? DEFAULT_SSH_PORT);
+    return;
+  }
+  if (id === "jump-user") {
+    answers.jumpUser = await askOptional(prompter, "Jump host user (empty = same as the login user)", answers.jumpUser);
+    return;
+  }
+  if (id === "proxy") {
+    output.write(prompter.paint.dim("  %h / %p / %r expand to the first hop's host, port and user.\n"));
+    answers.proxyCommand = await prompter.askRequired("Proxy command", answers.proxyCommand ?? "cloudflared access ssh --hostname %h");
+    return;
+  }
+  if (id === "description") {
+    answers.description = await askOptional(prompter, "Description shown to the agent", answers.description);
+    return;
+  }
+  if (id === "readonly") {
+    answers.readonly = answers.readonly == false;
+    return;
+  }
+  if (id === "paths") {
+    let current;
+    if (answers.allowedPaths.length > 0) {
+      current = answers.allowedPaths.join(",");
+    }
+    const typed = await askOptional(prompter, "Limit file tools to path prefixes (comma-separated, empty = anywhere)", current);
+    answers.allowedPaths = [];
+    if (typed != null) {
+      answers.allowedPaths = typed.split(",").map((item) => item.trim()).filter((item) => item !== "");
+    }
+    return;
+  }
+  const isJump = id === "jump-host-key";
+  let pinned = answers.hostKeyFingerprint;
+  if (isJump == true) {
+    pinned = answers.jumpHostKeyFingerprint;
+  }
+  if (pinned != null) {
+    const unpin = await prompter.askYesNo(`Unpin ${pinned}?`, false);
+    if (unpin == true && isJump == true) {
+      answers.jumpHostKeyFingerprint = void 0;
+    } else if (unpin == true) {
+      answers.hostKeyFingerprint = void 0;
+    }
+    return;
+  }
+  const missing = missingFields(state);
+  if (missing.length > 0) {
+    output.write(`  Fill in ${missing.map((field) => FIELD_NAMES[field]).join(", ")} first \u2014 the key is pinned by testing the connection.
+`);
+    return;
+  }
+  await testConnection(prompter, output, state);
+}
+async function runHostForm(prompter, output, options) {
+  const { existing, takenNames, destination } = options;
+  let state;
+  if (existing != null) {
+    let route = "direct";
+    if (existing.jumpHost != null && existing.proxyCommand != null) {
+      route = "jump-proxy";
+    } else if (existing.jumpHost != null) {
+      route = "jump";
+    } else if (existing.proxyCommand != null) {
+      route = "proxy";
+    }
+    state = { answers: { ...existing }, route, nameTouched: true, lastTest: "never", testedSnapshot: null };
+  } else {
+    const foundKeys = findPrivateKeys();
+    state = {
+      answers: {
+        name: "",
+        host: "",
+        port: DEFAULT_SSH_PORT,
+        username: "",
+        auth: "key",
+        keyPath: foundKeys[0]?.path,
+        readonly: false,
+        allowedPaths: [],
+        extraEnv: {}
+      },
+      route: "direct",
+      nameTouched: false,
+      lastTest: "never",
+      testedSnapshot: null
+    };
+  }
+  const initialSnapshot = snapshotOf(state);
+  const originalName = existing?.name;
+  let title = "New host";
+  if (existing != null) {
+    title = `Editing ${existing.name}`;
+  }
+  output.write(prompter.paint.dim(`
+  Pick a setting to change it. In a text field, Enter keeps the value shown and ${CLEAR_ANSWER} clears it.
+
+`));
+  const previousTransient = prompter.transient;
+  prompter.transient = true;
+  try {
+    let cursor = "host";
+    for (; ; ) {
+      const picked = await prompter.select(title, buildRows(state, destination), { defaultValue: cursor, cancelValue: "cancel" });
+      if (picked === "cancel") {
+        if (snapshotOf(state) !== initialSnapshot) {
+          const discard = await prompter.askYesNo("Discard the changes?", false);
+          if (discard == false) {
+            continue;
+          }
+        }
+        return null;
+      }
+      const missing = missingFields(state);
+      if (picked === "test") {
+        if (missing.length > 0) {
+          output.write(`  Fill in ${missing.map((field) => FIELD_NAMES[field]).join(", ")} first.
+`);
+          cursor = missing[0];
+          continue;
+        }
+        const connected = await testConnection(prompter, output, state);
+        cursor = "test";
+        if (connected == true) {
+          cursor = "save";
+        }
+        continue;
+      }
+      if (picked === "save") {
+        if (missing.length > 0) {
+          output.write(`  Fill in ${missing.map((field) => FIELD_NAMES[field]).join(", ")} first.
+`);
+          cursor = missing[0];
+          continue;
+        }
+        const name = state.answers.name;
+        if (name !== originalName && takenNames.includes(name) == true) {
+          const replace = await prompter.askYesNo(`"${name}" already exists in this file. Replace it?`, false);
+          if (replace == false) {
+            cursor = "name";
+            continue;
+          }
+        }
+        if (snapshotOf(state) !== state.testedSnapshot) {
+          const testFirst = await prompter.askYesNo("Test the connection before saving?", true);
+          if (testFirst == true) {
+            const connected = await testConnection(prompter, output, state);
+            if (connected == false) {
+              const next = await prompter.select(
+                "The check failed. What now?",
+                [
+                  { value: "back", key: "back", label: "Back to the settings" },
+                  { value: "save", key: "save", label: "Save anyway", hint: "the host may be unreachable from here" },
+                  { value: "discard", key: "discard", label: "Discard", hint: "nothing is written" }
+                ],
+                { defaultValue: "back", cancelValue: "back" }
+              );
+              if (next === "discard") {
+                return null;
+              }
+              if (next === "back") {
+                cursor = "test";
+                continue;
+              }
+            }
+          }
+        }
+        return finalizeAnswers(state);
+      }
+      await editField(prompter, output, state, picked);
+      cursor = nextCursor(state, destination, picked);
+    }
+  } finally {
+    prompter.transient = previousTransient;
+  }
+}
 
 // src/modules/manage/prompter.ts
 var PromptClosedError = class extends Error {
@@ -2731,6 +3396,12 @@ var Prompter = class {
     this.inputEnded = false;
     /** Set while a key-driven prompt (select, secret) owns the input. */
     this.keyHandler = null;
+    /**
+     * When true, an answered prompt leaves nothing behind on a TTY instead of its
+     * `✔ question · answer` line. The settings form sets it: the form itself shows every
+     * value, so it can redraw in place rather than scroll a trail of edits.
+     */
+    this.transient = false;
     const ttyInput = input;
     const ttyOutput = output;
     this.interactive = ttyInput.isTTY == true && ttyInput.setRawMode != null && ttyOutput.isTTY == true;
@@ -3030,6 +3701,9 @@ var Prompter = class {
   }
   /** The one-line record an answered prompt leaves behind on a TTY. */
   writeAnswered(question, answer) {
+    if (this.transient == true) {
+      return;
+    }
     this.output.write(`${this.style.success(this.symbols.tick)} ${question} ${this.style.dim("\xB7")} ${this.style.accent(answer)}
 `);
   }
@@ -3162,242 +3836,6 @@ var Prompter = class {
     });
   }
 };
-var PREFERRED_KEY_NAMES = ["id_ed25519", "id_ecdsa", "id_rsa"];
-var NON_KEY_FILE_NAMES = ["config", "known_hosts", "known_hosts.old", "authorized_keys", "environment"];
-var MAX_KEY_FILE_BYTES = 64 * 1024;
-var CLEAR_ANSWER = "-";
-var OTHER_KEY_PATH = "\0other";
-function findPrivateKeys() {
-  const sshDirectory = path.join(os5.homedir(), ".ssh");
-  let names = [];
-  try {
-    names = fs6.readdirSync(sshDirectory);
-  } catch {
-    return [];
-  }
-  const keys = [];
-  for (const name of names) {
-    if (name.endsWith(".pub") == true || NON_KEY_FILE_NAMES.includes(name) == true) {
-      continue;
-    }
-    const fullPath = path.join(sshDirectory, name);
-    let head = "";
-    try {
-      const stat = fs6.statSync(fullPath);
-      if (stat.isFile() == false || stat.size > MAX_KEY_FILE_BYTES) {
-        continue;
-      }
-      const descriptor = fs6.openSync(fullPath, "r");
-      const buffer = Buffer.alloc(64);
-      const bytesRead = fs6.readSync(descriptor, buffer, 0, buffer.length, 0);
-      fs6.closeSync(descriptor);
-      head = buffer.subarray(0, bytesRead).toString("utf8");
-    } catch {
-      continue;
-    }
-    const isPemKey = head.startsWith("-----BEGIN") == true && head.includes("PRIVATE KEY") == true;
-    const isPuttyKey = head.startsWith("PuTTY-User-Key-File") == true;
-    if (isPemKey == false && isPuttyKey == false) {
-      continue;
-    }
-    let hint = "";
-    try {
-      const publicKey = fs6.readFileSync(`${fullPath}.pub`, "utf8").trim().split(/\s+/);
-      hint = publicKey[0].replace(/^ssh-/, "");
-      if (publicKey.length > 2) {
-        hint += ` \xB7 ${publicKey.slice(2).join(" ")}`;
-      }
-    } catch {
-    }
-    keys.push({ path: `~/.ssh/${name}`, hint });
-  }
-  const rank = (key) => {
-    const index = PREFERRED_KEY_NAMES.indexOf(path.basename(key.path));
-    if (index < 0) {
-      return PREFERRED_KEY_NAMES.length;
-    }
-    return index;
-  };
-  return keys.sort((left, right) => rank(left) - rank(right) || left.path.localeCompare(right.path));
-}
-async function askPort(prompter, question, current) {
-  for (; ; ) {
-    const answer = await prompter.ask(question, String(current));
-    const parsed = Number(answer);
-    if (Number.isInteger(parsed) == true && parsed > 0 && parsed <= 65535) {
-      return parsed;
-    }
-    prompter.write("  Enter a port number between 1 and 65535.\n");
-  }
-}
-async function askOptional(prompter, question, current) {
-  const answer = await prompter.ask(question, current);
-  if (answer === "" || answer === CLEAR_ANSWER) {
-    return void 0;
-  }
-  return answer;
-}
-async function askOptionalSecret(prompter, question, current) {
-  let suffix = "(empty for none)";
-  if (current != null) {
-    suffix = `(enter keeps current, ${CLEAR_ANSWER} clears)`;
-  }
-  const answer = await prompter.askSecret(`${question} ${prompter.paint.dim(suffix)}`);
-  if (answer === CLEAR_ANSWER) {
-    return void 0;
-  }
-  if (answer === "") {
-    return current;
-  }
-  return answer;
-}
-async function askKeyPath(prompter, current) {
-  const found = findPrivateKeys();
-  let picked = OTHER_KEY_PATH;
-  if (found.length > 0 || current != null) {
-    const items = [];
-    if (current != null && found.some((key) => key.path === current) == false) {
-      items.push({ value: current, label: current, hint: "current" });
-    }
-    for (const key of found) {
-      items.push({ value: key.path, label: key.path, hint: key.hint });
-    }
-    items.push({ separator: true });
-    items.push({ value: OTHER_KEY_PATH, key: "other", label: "Another path\u2026" });
-    picked = await prompter.select("Private key", items, { defaultValue: current ?? found[0]?.path });
-  }
-  if (picked !== OTHER_KEY_PATH) {
-    return picked;
-  }
-  for (; ; ) {
-    const typed = await prompter.askRequired("Private key path");
-    if (fs6.existsSync(expandHomePath(typed)) == true) {
-      return typed;
-    }
-    prompter.write(`  ${expandHomePath(typed)} does not exist.
-`);
-    const useAnyway = await prompter.askYesNo("Use this path anyway?", false);
-    if (useAnyway == true) {
-      return typed;
-    }
-  }
-}
-async function askHostQuestions(prompter, existing) {
-  if (existing != null) {
-    prompter.write(prompter.paint.dim(`  Enter keeps the value in brackets; ${CLEAR_ANSWER} clears an optional one.
-
-`));
-  }
-  const host = await prompter.askRequired("Host (hostname or IP)", existing?.host);
-  const port = await askPort(prompter, "Port", existing?.port ?? DEFAULT_SSH_PORT);
-  const username = await prompter.askRequired("Login user", existing?.username);
-  let name = "";
-  const defaultName = existing?.name ?? `ssh-${host}`.replace(/[^A-Za-z0-9_-]+/g, "-").slice(0, 48);
-  for (; ; ) {
-    name = await prompter.askRequired("Server name the agent sees", defaultName);
-    if (SERVER_NAME_PATTERN.test(name) == true) {
-      break;
-    }
-    prompter.write("  Use letters, digits, '-' and '_' only (max 48) \u2014 the name becomes part of every tool name.\n");
-  }
-  const auth = await prompter.select(
-    "Authentication",
-    [
-      { value: "key", label: "Private key file", hint: "only the path is stored \u2014 recommended" },
-      { value: "password", label: "Password", hint: "stored in the config file as plain text" },
-      { value: "agent", label: "SSH agent", hint: "keys already loaded in ssh-agent" }
-    ],
-    { defaultValue: existing?.auth ?? "key" }
-  );
-  let keyPath;
-  let passphrase;
-  let password;
-  if (auth === "key") {
-    keyPath = await askKeyPath(prompter, existing?.keyPath);
-    passphrase = await askOptionalSecret(prompter, "Key passphrase", existing?.passphrase);
-  }
-  if (auth === "password") {
-    password = await askOptionalSecret(prompter, "Password", existing?.password);
-    if (password == null) {
-      prompter.write("  No password given \u2014 falling back to the ssh agent.\n");
-    }
-  }
-  let currentRoute = "direct";
-  if (existing?.jumpHost != null && existing.proxyCommand != null) {
-    currentRoute = "jump-proxy";
-  } else if (existing?.jumpHost != null) {
-    currentRoute = "jump";
-  } else if (existing?.proxyCommand != null) {
-    currentRoute = "proxy";
-  }
-  const route = await prompter.select(
-    "How is it reached?",
-    [
-      { value: "direct", label: "Directly" },
-      { value: "jump", label: "Through a jump host", hint: "ssh -J" },
-      { value: "proxy", label: "Through a proxy command", hint: "e.g. cloudflared access ssh" },
-      { value: "jump-proxy", label: "Proxy command, then a jump host", hint: "cloudflared to the bastion, then on to the host" }
-    ],
-    { defaultValue: currentRoute }
-  );
-  let jumpHost;
-  let jumpPort;
-  let jumpUser;
-  let proxyCommand;
-  if (route === "jump" || route === "jump-proxy") {
-    jumpHost = await prompter.askRequired("Jump host", existing?.jumpHost);
-    jumpPort = await askPort(prompter, "Jump host port", existing?.jumpPort ?? DEFAULT_SSH_PORT);
-    jumpUser = await prompter.askRequired("Jump host user", existing?.jumpUser ?? username);
-  }
-  if (route === "proxy" || route === "jump-proxy") {
-    prompter.write(prompter.paint.dim("  %h / %p / %r expand to the first hop's host, port and user.\n"));
-    proxyCommand = await prompter.askRequired("Proxy command", existing?.proxyCommand ?? "cloudflared access ssh --hostname %h");
-  }
-  const description = await askOptional(prompter, "Description shown to the agent", existing?.description);
-  const readonly = await prompter.askYesNo("Read-only? (rejects writes, redirections, uploads)", existing?.readonly ?? false);
-  let currentAllowedPaths;
-  if (existing != null && existing.allowedPaths.length > 0) {
-    currentAllowedPaths = existing.allowedPaths.join(",");
-  }
-  let allowedPaths = [];
-  const allowedPathsAnswer = await askOptional(
-    prompter,
-    "Limit file tools to path prefixes (comma-separated, empty = anywhere)",
-    currentAllowedPaths
-  );
-  if (allowedPathsAnswer != null) {
-    allowedPaths = allowedPathsAnswer.split(",").map((item) => item.trim()).filter((item) => item !== "");
-  }
-  let resolvedAuth = auth;
-  if (auth === "password" && password == null) {
-    resolvedAuth = "agent";
-  }
-  const answers = {
-    name,
-    host,
-    port,
-    username,
-    auth: resolvedAuth,
-    keyPath,
-    passphrase,
-    password,
-    description,
-    jumpHost,
-    jumpPort,
-    jumpUser,
-    proxyCommand,
-    readonly,
-    allowedPaths,
-    extraEnv: existing?.extraEnv ?? {}
-  };
-  if (existing != null && existing.host === host && existing.port === port) {
-    answers.hostKeyFingerprint = existing.hostKeyFingerprint;
-  }
-  if (existing != null && existing.jumpHost === jumpHost && existing.jumpPort === jumpPort) {
-    answers.jumpHostKeyFingerprint = existing.jumpHostKeyFingerprint;
-  }
-  return answers;
-}
 function toMcpServerEntry(value) {
   if (typeof value !== "object" || value == null) {
     return null;
@@ -4125,113 +4563,20 @@ function reportWrite(prompter, result, action) {
 
 `);
 }
-function profileFromEntry(output, entry) {
-  try {
-    const profile = loadHostProfile(entry.env);
-    if (profile == null) {
-      output.write("  The entry has no host.\n");
-    }
-    return profile;
-  } catch (ex) {
-    output.write(`  The server would refuse to start with this entry: ${errorMessage(ex)}
-`);
-    return null;
-  }
-}
-async function verifyAnswers(prompter, output, initial) {
-  let answers = initial;
-  for (; ; ) {
-    const testNow = await prompter.askYesNo("Test the connection now?", true);
-    if (testNow == false) {
-      return answers;
-    }
-    output.write("\n");
-    const profile = profileFromEntry(output, answersToEntry(answers));
-    if (profile != null) {
-      const result = await runConnectionCheck(profile, output);
-      output.write("\n");
-      if (result.connected == true) {
-        if (result.hostKeyFingerprint != null && answers.hostKeyFingerprint == null) {
-          const pin = await prompter.askYesNo("Pin this host key? (a changed key then aborts the connection)", true);
-          if (pin == true) {
-            answers = { ...answers, hostKeyFingerprint: result.hostKeyFingerprint };
-          }
-        }
-        if (result.jumpHostKeyFingerprint != null && answers.jumpHost != null && answers.jumpHostKeyFingerprint == null) {
-          const pin = await prompter.askYesNo("Pin the jump host key too?", true);
-          if (pin == true) {
-            answers = { ...answers, jumpHostKeyFingerprint: result.jumpHostKeyFingerprint };
-          }
-        }
-        return answers;
-      }
-      const hostKeyChanged = result.hostKeyFingerprint != null && answers.hostKeyFingerprint != null && result.hostKeyFingerprint !== answers.hostKeyFingerprint;
-      if (hostKeyChanged == true) {
-        output.write("  The host presented a different key than the pinned one. Re-pin only if you know it was rebuilt.\n");
-        const repin = await prompter.askYesNo(`Pin ${result.hostKeyFingerprint} instead?`, false);
-        if (repin == true) {
-          answers = { ...answers, hostKeyFingerprint: result.hostKeyFingerprint ?? void 0 };
-          continue;
-        }
-      }
-      const jumpKeyChanged = result.jumpHostKeyFingerprint != null && answers.jumpHostKeyFingerprint != null && result.jumpHostKeyFingerprint !== answers.jumpHostKeyFingerprint;
-      if (jumpKeyChanged == true) {
-        output.write("  The jump host presented a different key than the pinned one. Re-pin only if you know it was rebuilt.\n");
-        const repin = await prompter.askYesNo(`Pin ${result.jumpHostKeyFingerprint} instead?`, false);
-        if (repin == true) {
-          answers = { ...answers, jumpHostKeyFingerprint: result.jumpHostKeyFingerprint ?? void 0 };
-          continue;
-        }
-      }
-    }
-    const next = await prompter.select(
-      "The check failed. What now?",
-      [
-        { value: "edit", key: "e", label: "Change the answers" },
-        { value: "retry", key: "r", label: "Try again", hint: "e.g. after starting a tunnel" },
-        { value: "write", key: "w", label: "Write it anyway", hint: "the host may be unreachable from here" },
-        { value: "cancel", key: "c", label: "Cancel", hint: "nothing is written" }
-      ],
-      { defaultValue: "edit", cancelValue: "cancel" }
-    );
-    if (next === "cancel") {
-      return null;
-    }
-    if (next === "write") {
-      return answers;
-    }
-    if (next === "edit") {
-      output.write("\n");
-      answers = await askHostQuestions(prompter, answers);
-    }
-  }
-}
 async function addOrEditHost(prompter, output, target, entries, existingName) {
   let existing;
   if (existingName != null) {
     existing = entryToAnswers(existingName, entries[existingName]);
-    output.write(`
-${prompter.paint.bold(`Editing ${existingName}`)}
-`);
-  } else {
-    output.write(`
-${prompter.paint.bold("Adding a host")}
-`);
   }
-  const asked = await askHostQuestions(prompter, existing);
-  output.write("\n");
-  const answers = await verifyAnswers(prompter, output, asked);
+  const answers = await runHostForm(prompter, output, {
+    existing,
+    takenNames: Object.keys(entries),
+    destination: target.label
+  });
   if (answers == null) {
     output.write("  Cancelled \u2014 nothing was written.\n\n");
     return;
   }
-  if (answers.name !== existingName && entries[answers.name] != null) {
-    const replace = await prompter.askYesNo(`"${answers.name}" already exists in this file. Replace it?`, false);
-    if (replace == false) {
-      output.write("  Cancelled \u2014 nothing was written.\n\n");
-      return;
-    }
-  }
   const entry = answersToEntry(answers);
   output.write(`
   ${prompter.paint.dim(`This goes into ${target.location}:`)}
@@ -4258,7 +4603,7 @@ ${prompter.paint.bold("Adding a host")}
 }
 async function checkHost(prompter, output, target, name, entry) {
   output.write("\n");
-  const profile = profileFromEntry(output, entry);
+  const profile = profileFromEnv(output, entry.env);
   if (profile == null) {
     output.write("\n");
     return;
@@ -4332,7 +4677,7 @@ async function manageHost(prompter, output, target, entries, name) {
   const action = await prompter.select(
     name,
     [
-      { value: "edit", key: "e", label: "Edit", hint: "change the answers, re-check, re-write" },
+      { value: "edit", key: "e", label: "Edit", hint: "open its settings" },
       { value: "check", key: "c", label: "Check the connection", hint: "connect now and offer to pin the host key" },
       { value: "print", key: "p", label: "Print the entry", hint: "JSON, Codex TOML and a claude command, ready to paste" },
       { value: "remove", key: "r", label: "Remove", hint: `from ${target.label}` },