@akms/mcp-ssh 0.1.2 → 0.1.3

package/lib/cli.js

@@ -26,7 +26,7 @@ var CWD_MARKER = "__AKMS_SSH_CWD__";
 var MAX_DIRECTORY_ENTRIES = 1e3;
 var SERVER_NAME = "akms-mcp-ssh";
 var PACKAGE_NAME = "@akms/mcp-ssh";
-var SERVER_VERSION = "0.1.2";
+var SERVER_VERSION = "0.1.3";
 
 // src/_defs/command-rules.ts
 var CRITICAL_PATH_PATTERN = new RegExp(
@@ -2634,1208 +2634,1306 @@ function summarizeEntry(entry) {
     notes: notes.join(", ")
   };
 }
-var PREFERRED_KEY_NAMES = ["id_ed25519", "id_ecdsa", "id_rsa"];
-var NON_KEY_FILE_NAMES = ["config", "known_hosts", "known_hosts.old", "authorized_keys", "environment"];
-var MAX_KEY_FILE_BYTES = 64 * 1024;
-var CLEAR_ANSWER = "-";
-var OTHER_KEY_PATH = "\0other";
-var FIELD_NAME_WIDTH = 17;
-var SUB_FIELDS = ["key", "passphrase", "password", "jump-host", "jump-port", "jump-user", "proxy"];
-var FIELD_NAMES = {
-  "host": "Host",
-  "port": "Port",
-  "user": "User",
-  "name": "Server name",
-  "auth": "Authentication",
-  "key": "Private key",
-  "passphrase": "Passphrase",
-  "password": "Password",
-  "route": "Route",
-  "jump-host": "Jump host",
-  "jump-port": "Jump port",
-  "jump-user": "Jump user",
-  "proxy": "Proxy command",
-  "description": "Description",
-  "readonly": "Read-only",
-  "paths": "File paths",
-  "host-key": "Host key",
-  "jump-host-key": "Jump host key"
-};
-var AUTH_LABELS = {
-  key: "Private key file",
-  password: "Password",
-  agent: "SSH agent"
-};
-var ROUTE_LABELS = {
-  "direct": "Directly",
-  "jump": "Through a jump host",
-  "proxy": "Through a proxy command",
-  "jump-proxy": "Proxy command, then a jump host"
+
+// src/modules/manage/prompter.ts
+var PromptClosedError = class extends Error {
+  constructor() {
+    super("input closed before the prompt was answered");
+    this.name = "PromptClosedError";
+  }
 };
-var REQUIRED_MARK = "(required)";
-function findPrivateKeys() {
-  const sshDirectory = path.join(os5.homedir(), ".ssh");
-  let names = [];
-  try {
-    names = fs6.readdirSync(sshDirectory);
-  } catch {
-    return [];
+var PromptBackError = class extends Error {
+  constructor() {
+    super("prompt left with esc");
+    this.name = "PromptBackError";
   }
+};
+var ESC = "\x1B";
+var KEY_UP = [`${ESC}[A`, `${ESC}OA`];
+var KEY_DOWN = [`${ESC}[B`, `${ESC}OB`];
+var KEY_RIGHT = [`${ESC}[C`, `${ESC}OC`];
+var KEY_LEFT = [`${ESC}[D`, `${ESC}OD`];
+var KEY_HOME = [`${ESC}[H`, `${ESC}OH`, `${ESC}[1~`, "
"];
+var KEY_END = [`${ESC}[F`, `${ESC}OF`, `${ESC}[4~`, ""];
+var KEY_DELETE = [`${ESC}[3~`];
+var KEY_ENTER = ["\r", "\n"];
+var KEY_BACKSPACE = ["\x7F", "\b"];
+var KEY_CTRL_C = "";
+var KEY_CTRL_D = "";
+var KEY_CLEAR_LINE = "";
+function splitKeys(chunk) {
   const keys = [];
-  for (const name of names) {
-    if (name.endsWith(".pub") == true || NON_KEY_FILE_NAMES.includes(name) == true) {
-      continue;
-    }
-    const fullPath = path.join(sshDirectory, name);
-    let head = "";
-    try {
-      const stat = fs6.statSync(fullPath);
-      if (stat.isFile() == false || stat.size > MAX_KEY_FILE_BYTES) {
-        continue;
+  let index = 0;
+  while (index < chunk.length) {
+    const isSequence = chunk[index] === ESC && (chunk[index + 1] === "[" || chunk[index + 1] === "O");
+    if (isSequence == true) {
+      let end = index + 2;
+      while (end < chunk.length && /[0-9;]/.test(chunk[end]) == true) {
+        end += 1;
       }
-      const descriptor = fs6.openSync(fullPath, "r");
-      const buffer = Buffer.alloc(64);
-      const bytesRead = fs6.readSync(descriptor, buffer, 0, buffer.length, 0);
-      fs6.closeSync(descriptor);
-      head = buffer.subarray(0, bytesRead).toString("utf8");
-    } catch {
-      continue;
-    }
-    const isPemKey = head.startsWith("-----BEGIN") == true && head.includes("PRIVATE KEY") == true;
-    const isPuttyKey = head.startsWith("PuTTY-User-Key-File") == true;
-    if (isPemKey == false && isPuttyKey == false) {
+      keys.push(chunk.slice(index, end + 1));
+      index = end + 1;
       continue;
     }
-    let hint = "";
-    try {
-      const publicKey = fs6.readFileSync(`${fullPath}.pub`, "utf8").trim().split(/\s+/);
-      hint = publicKey[0].replace(/^ssh-/, "");
-      if (publicKey.length > 2) {
-        hint += ` \xB7 ${publicKey.slice(2).join(" ")}`;
-      }
-    } catch {
-    }
-    keys.push({ path: `~/.ssh/${name}`, hint });
+    const codePoint = chunk.codePointAt(index) ?? 0;
+    const character = String.fromCodePoint(codePoint);
+    keys.push(character);
+    index += character.length;
   }
-  const rank = (key) => {
-    const index = PREFERRED_KEY_NAMES.indexOf(path.basename(key.path));
-    if (index < 0) {
-      return PREFERRED_KEY_NAMES.length;
-    }
-    return index;
-  };
-  return keys.sort((left, right) => rank(left) - rank(right) || left.path.localeCompare(right.path));
+  return keys;
 }
-async function askPort(prompter, question, current) {
-  for (; ; ) {
-    const answer = await prompter.ask(question, String(current));
-    const parsed = Number(answer);
-    if (Number.isInteger(parsed) == true && parsed > 0 && parsed <= 65535) {
-      return parsed;
-    }
-    prompter.write("  Enter a port number between 1 and 65535.\n");
+function isPrintableKey(key) {
+  if (key.startsWith(ESC) == true) {
+    return false;
   }
+  const codePoint = key.codePointAt(0) ?? 0;
+  return codePoint >= 32 && codePoint !== 127;
 }
-async function askOptional(prompter, question, current) {
-  const answer = await prompter.ask(question, current);
-  if (answer === "" || answer === CLEAR_ANSWER) {
-    return void 0;
+function charWidth(codePoint) {
+  if (codePoint < 4352) {
+    return 1;
   }
-  return answer;
-}
-async function askOptionalSecret(prompter, question, current) {
-  let suffix = "(empty for none)";
-  if (current != null) {
-    suffix = `(enter keeps current, ${CLEAR_ANSWER} clears)`;
+  const isWide = codePoint <= 4447 || codePoint === 9001 || codePoint === 9002 || codePoint >= 11904 && codePoint <= 42191 && codePoint !== 12351 || codePoint >= 44032 && codePoint <= 55203 || codePoint >= 63744 && codePoint <= 64255 || codePoint >= 65072 && codePoint <= 65103 || codePoint >= 65280 && codePoint <= 65376 || codePoint >= 65504 && codePoint <= 65510 || codePoint >= 127744 && codePoint <= 128591 || codePoint >= 129280 && codePoint <= 129535 || codePoint >= 131072 && codePoint <= 262141;
+  if (isWide == true) {
+    return 2;
   }
-  const answer = await prompter.askSecret(`${question} ${prompter.paint.dim(suffix)}`);
-  if (answer === CLEAR_ANSWER) {
-    return void 0;
+  return 1;
+}
+function displayWidth(text) {
+  let width = 0;
+  for (const character of text) {
+    width += charWidth(character.codePointAt(0) ?? 0);
   }
-  if (answer === "") {
-    return current;
+  return width;
+}
+function padToWidth(text, width) {
+  const missing = width - displayWidth(text);
+  if (missing <= 0) {
+    return text;
   }
-  return answer;
+  return `${text}${" ".repeat(missing)}`;
 }
-async function askKeyPath(prompter, current) {
-  const found = findPrivateKeys();
-  let picked = OTHER_KEY_PATH;
-  if (found.length > 0 || current != null) {
-    const items = [];
-    if (current != null && found.some((key) => key.path === current) == false) {
-      items.push({ value: current, label: current, hint: "current" });
-    }
-    for (const key of found) {
-      items.push({ value: key.path, label: key.path, hint: key.hint });
+function groupLabelWidths(items) {
+  const widths = items.map(() => 0);
+  let groupStart = 0;
+  for (let index = 0; index <= items.length; index += 1) {
+    const atBoundary = index === items.length || "value" in items[index] == false;
+    if (atBoundary == false) {
+      continue;
     }
-    items.push({ separator: true });
-    items.push({ value: OTHER_KEY_PATH, key: "other", label: "Another path\u2026" });
-    picked = await prompter.select("Private key", items, { defaultValue: current ?? found[0]?.path });
-  }
-  if (picked !== OTHER_KEY_PATH) {
-    return picked;
-  }
-  for (; ; ) {
-    const typed = await prompter.askRequired("Private key path");
-    if (fs6.existsSync(expandHomePath(typed)) == true) {
-      return typed;
+    let groupWidth = 0;
+    for (let member = groupStart; member < index; member += 1) {
+      const item = items[member];
+      groupWidth = Math.max(groupWidth, displayWidth(item.label));
     }
-    prompter.write(`  ${expandHomePath(typed)} does not exist.
-`);
-    const useAnyway = await prompter.askYesNo("Use this path anyway?", false);
-    if (useAnyway == true) {
-      return typed;
+    for (let member = groupStart; member < index; member += 1) {
+      widths[member] = groupWidth;
     }
+    groupStart = index + 1;
   }
+  return widths;
 }
-function routeUsesJump(route) {
-  return route === "jump" || route === "jump-proxy";
-}
-function routeUsesProxy(route) {
-  return route === "proxy" || route === "jump-proxy";
-}
-function deriveServerName(host) {
-  return `ssh-${host}`.replace(/[^A-Za-z0-9_-]+/g, "-").slice(0, 48);
-}
-function finalizeAnswers(state) {
-  const answers = { ...state.answers };
-  if (routeUsesJump(state.route) == false) {
-    answers.jumpHost = void 0;
-    answers.jumpPort = void 0;
-    answers.jumpUser = void 0;
-    answers.jumpHostKeyFingerprint = void 0;
-  }
-  if (routeUsesProxy(state.route) == false) {
-    answers.proxyCommand = void 0;
-  }
-  if (answers.auth !== "key") {
-    answers.keyPath = void 0;
-    answers.passphrase = void 0;
-  }
-  if (answers.auth !== "password") {
-    answers.password = void 0;
+function supportsUnicode() {
+  if (process.platform !== "win32") {
+    return true;
   }
-  return answers;
+  return process.env.WT_SESSION != null || process.env.TERM_PROGRAM === "vscode" || process.env.TERMINAL_EMULATOR === "JetBrains-JediTerm" || process.env.ConEmuTask != null;
 }
-function snapshotOf(state) {
-  return JSON.stringify(finalizeAnswers(state));
+function createStyle(enabled) {
+  const paint = (open, close) => {
+    return (text) => {
+      if (enabled == false || text === "") {
+        return text;
+      }
+      return `${ESC}[${open}m${text}${ESC}[${close}m`;
+    };
+  };
+  return {
+    accent: paint(36, 39),
+    success: paint(32, 39),
+    dim: paint(2, 22),
+    bold: paint(1, 22)
+  };
 }
-function missingFields(state) {
-  const { answers } = state;
-  const missing = [];
-  if (answers.host === "") {
-    missing.push("host");
-  }
-  if (answers.username === "") {
-    missing.push("user");
-  }
-  if (answers.auth === "key" && answers.keyPath == null) {
-    missing.push("key");
+var Prompter = class {
+  constructor(input, output) {
+    this.input = input;
+    this.output = output;
+    this.lineBuffer = "";
+    this.pendingLines = [];
+    this.lineWaiter = null;
+    this.inputEnded = false;
+    /** Set while a key-driven prompt owns the input. */
+    this.keyHandler = null;
+    /**
+     * When true, an answered prompt leaves nothing behind on a TTY instead of its
+     * `✔ question · answer` line. The settings form sets it: the form itself shows every
+     * value, so it can redraw in place rather than scroll a trail of edits.
+     */
+    this.transient = false;
+    const ttyInput = input;
+    const ttyOutput = output;
+    this.interactive = ttyInput.isTTY == true && ttyInput.setRawMode != null && ttyOutput.isTTY == true;
+    this.style = createStyle(this.interactive == true && process.env.NO_COLOR == null);
+    if (supportsUnicode() == true) {
+      this.symbols = { question: "?", pointer: "\u276F", tick: "\u2714", rule: "\u2500" };
+    } else {
+      this.symbols = { question: "?", pointer: ">", tick: "\u221A", rule: "-" };
+    }
+    input.setEncoding("utf8");
+    input.on("data", (chunk) => {
+      this.onData(chunk);
+    });
+    input.on("end", () => {
+      this.inputEnded = true;
+      if (this.lineWaiter != null) {
+        const waiter = this.lineWaiter;
+        this.lineWaiter = null;
+        waiter(null);
+      }
+      if (this.keyHandler != null) {
+        this.keyHandler(KEY_CTRL_D);
+      }
+    });
   }
-  if (answers.auth === "password" && answers.password == null) {
-    missing.push("password");
+  /** Stops reading so the process can exit once the command is done. */
+  close() {
+    if (this.interactive == true) {
+      this.input.setRawMode?.(false);
+      this.output.write(`${ESC}[?25h`);
+    }
+    this.input.pause();
   }
-  if (routeUsesJump(state.route) == true && answers.jumpHost == null) {
-    missing.push("jump-host");
+  write(text) {
+    this.output.write(text);
   }
-  if (routeUsesProxy(state.route) == true && answers.proxyCommand == null) {
-    missing.push("proxy");
+  /** Styling for callers that print around the prompts; plain text off a TTY. */
+  get paint() {
+    return this.style;
   }
-  return missing;
-}
-function describePin(fingerprint) {
-  if (fingerprint == null) {
-    return "not pinned";
+  /**
+   * Free-text prompt. Enter accepts `defaultValue` when one is shown.
+   *
+   * @throws {PromptBackError} On Esc.
+   * @throws {PromptClosedError} If the input closes before a line arrives.
+   */
+  async ask(question, defaultValue) {
+    let suffix = "";
+    if (defaultValue != null && defaultValue !== "") {
+      suffix = ` ${this.style.dim(`(${defaultValue})`)}`;
+    }
+    const prompt = `${this.style.accent(this.symbols.question)} ${this.style.bold(question)}${suffix} `;
+    const typed = await this.readText(prompt, false);
+    let answer = typed.trim();
+    if (answer === "" && defaultValue != null) {
+      answer = defaultValue;
+    }
+    let shown = answer;
+    if (shown === "") {
+      shown = this.style.dim("(empty)");
+    }
+    this.writeAnswered(question, shown);
+    return answer;
   }
-  return `pinned \xB7 ${fingerprint.slice(0, 19)}\u2026`;
-}
-function valueOrRequired(value) {
-  if (value == null || value === "") {
-    return REQUIRED_MARK;
+  /** Like `ask`, re-asking until something non-empty is entered. */
+  async askRequired(question, defaultValue) {
+    for (; ; ) {
+      const answer = await this.ask(question, defaultValue);
+      if (answer !== "") {
+        return answer;
+      }
+      this.output.write(`  ${this.style.dim("A value is required.")}
+`);
+    }
   }
-  return value;
-}
-function fieldRow(id, value, hint) {
-  let name = FIELD_NAMES[id];
-  if (SUB_FIELDS.includes(id) == true) {
-    name = `  ${name}`;
+  /**
+   * @throws {PromptBackError} On Esc — the caller decides what "neither" means.
+   * @throws {PromptClosedError} If the input closes before a line arrives.
+   */
+  async askYesNo(question, defaultValue) {
+    let hint = "y/N";
+    if (defaultValue == true) {
+      hint = "Y/n";
+    }
+    for (; ; ) {
+      const prompt = `${this.style.accent(this.symbols.question)} ${this.style.bold(question)} ${this.style.dim(`(${hint})`)} `;
+      const typed = await this.readText(prompt, false);
+      const normalized = typed.trim().toLowerCase();
+      let answer = null;
+      if (normalized === "") {
+        answer = defaultValue;
+      } else if (normalized === "y" || normalized === "yes") {
+        answer = true;
+      } else if (normalized === "n" || normalized === "no") {
+        answer = false;
+      }
+      if (answer != null) {
+        let shown = "no";
+        if (answer == true) {
+          shown = "yes";
+        }
+        this.writeAnswered(question, shown);
+        return answer;
+      }
+      this.output.write(`  ${this.style.dim("Answer y or n.")}
+`);
+    }
   }
-  return {
-    value: id,
-    key: id,
-    label: `${name.padEnd(FIELD_NAME_WIDTH)}${value}`,
-    hint
-  };
-}
-function buildRows(state, destination) {
-  const { answers } = state;
-  const rows = [];
-  rows.push(fieldRow("host", valueOrRequired(answers.host)));
-  rows.push(fieldRow("port", String(answers.port)));
-  rows.push(fieldRow("user", valueOrRequired(answers.username)));
-  let nameValue = answers.name;
-  let nameHint = "what the agent sees";
-  if (state.nameTouched == false) {
-    nameHint = "follows the host until you change it";
+  /**
+   * Picks one of `items`. On a TTY: ↑/↓ move, 1–9 jump, Enter picks, Esc goes back. Off a
+   * TTY: a numbered list, answered by number, key or label.
+   *
+   * @throws {PromptBackError} On Esc without a `cancelValue`.
+   * @throws {PromptClosedError} On Ctrl+C or when the input closes.
+   */
+  async select(question, items, options) {
+    const choices = items.filter((item) => "value" in item);
+    if (choices.length === 0) {
+      throw new Error("select needs at least one choice");
+    }
+    let startIndex = items.findIndex((item) => "value" in item && item.value === options?.defaultValue);
+    if (startIndex < 0) {
+      startIndex = items.findIndex((item) => "value" in item);
+    }
+    let picked;
+    if (this.interactive == true) {
+      picked = await this.selectWithKeys(question, items, startIndex);
+    } else {
+      picked = await this.selectWithLines(question, items, startIndex);
+    }
+    if (picked != null) {
+      return picked;
+    }
+    if (options?.cancelValue != null) {
+      return options.cancelValue;
+    }
+    throw new PromptBackError();
   }
-  if (nameValue === "") {
-    nameValue = "ssh-<host>";
+  /**
+   * Reads a value without echoing it on a TTY. Empty means "none", or "keep" when the
+   * caller says a value already exists.
+   *
+   * @throws {PromptBackError} On Esc.
+   * @throws {PromptClosedError} On Ctrl+C or when the input closes.
+   */
+  async askSecret(question) {
+    const prompt = `${this.style.accent(this.symbols.question)} ${this.style.bold(question)} `;
+    const secret = await this.readText(prompt, true);
+    let shown = this.style.dim("(empty)");
+    if (secret !== "") {
+      shown = "\u2022".repeat(Math.min(secret.length, 8));
+    }
+    this.writeAnswered(question, shown);
+    return secret;
   }
-  rows.push(fieldRow("name", nameValue, nameHint));
-  rows.push(fieldRow("auth", AUTH_LABELS[answers.auth]));
-  if (answers.auth === "key") {
-    rows.push(fieldRow("key", valueOrRequired(answers.keyPath)));
-    let passphrase = "none";
-    if (answers.passphrase != null) {
-      passphrase = "set";
+  // ── input ──────────────────────────────────────────────────────────────
+  /**
+   * One text answer, through the line editor on a TTY and a line read off one. The prompt
+   * is erased once answered; the caller writes the summary line.
+   *
+   * @throws {PromptBackError} On Esc, or a line of just `ESC` off a TTY.
+   */
+  async readText(prompt, secret) {
+    if (this.interactive == false) {
+      this.output.write(prompt);
+      const line = await this.readLine();
+      if (line == null) {
+        throw new PromptClosedError();
+      }
+      if (line === ESC) {
+        throw new PromptBackError();
+      }
+      return line;
     }
-    rows.push(fieldRow("passphrase", passphrase));
+    const result = await this.editLine(prompt, secret);
+    if (result.kind === "back") {
+      throw new PromptBackError();
+    }
+    return result.text;
   }
-  if (answers.auth === "password") {
-    let password = REQUIRED_MARK;
-    if (answers.password != null) {
-      password = "set";
+  readLine() {
+    const queued = this.pendingLines.shift();
+    if (queued != null) {
+      return Promise.resolve(queued);
     }
-    rows.push(fieldRow("password", password, "stored in the config file as plain text"));
+    if (this.inputEnded == true) {
+      return Promise.resolve(null);
+    }
+    return new Promise((resolve) => {
+      this.lineWaiter = resolve;
+    });
   }
-  rows.push(fieldRow("route", ROUTE_LABELS[state.route]));
-  if (routeUsesJump(state.route) == true) {
-    rows.push(fieldRow("jump-host", valueOrRequired(answers.jumpHost)));
-    rows.push(fieldRow("jump-port", String(answers.jumpPort ?? DEFAULT_SSH_PORT)));
-    let jumpUser = answers.jumpUser;
-    if (jumpUser == null || jumpUser === answers.username) {
-      let loginUser = answers.username;
-      if (loginUser === "") {
-        loginUser = "\u2026";
+  onData(chunk) {
+    if (this.keyHandler != null) {
+      for (const key of splitKeys(chunk)) {
+        if (this.keyHandler == null) {
+          break;
+        }
+        this.keyHandler(key);
       }
-      jumpUser = `same as login (${loginUser})`;
+      return;
+    }
+    this.lineBuffer += chunk;
+    let newlineIndex = this.lineBuffer.indexOf("\n");
+    while (newlineIndex >= 0) {
+      const line = this.lineBuffer.slice(0, newlineIndex).replace(/\r$/, "");
+      this.lineBuffer = this.lineBuffer.slice(newlineIndex + 1);
+      if (this.lineWaiter != null) {
+        const waiter = this.lineWaiter;
+        this.lineWaiter = null;
+        waiter(line);
+      } else {
+        this.pendingLines.push(line);
+      }
+      newlineIndex = this.lineBuffer.indexOf("\n");
     }
-    rows.push(fieldRow("jump-user", jumpUser));
   }
-  if (routeUsesProxy(state.route) == true) {
-    rows.push(fieldRow("proxy", valueOrRequired(answers.proxyCommand), "%h %p %r \u2192 first hop"));
+  /**
+   * A one-line editor in raw mode: insert at the cursor, Backspace / Delete, ←/→, Home /
+   * End, Ctrl+U clears, Enter answers, Esc goes back. Secrets draw nothing after the
+   * prompt. Cooked mode is not used for text on a TTY because it never reports Esc: the
+   * terminal swallows it or stuffs the `ESC` byte into the value.
+   */
+  editLine(prompt, secret) {
+    const ttyInput = this.input;
+    const plainPrompt = prompt.replace(/\u001b\[[0-9;]*m/g, "");
+    let characters = [];
+    let cursor = 0;
+    const draw = () => {
+      let text = `\r${ESC}[2K${prompt}`;
+      if (secret == false) {
+        text += characters.join("");
+        const column = displayWidth(plainPrompt) + displayWidth(characters.slice(0, cursor).join(""));
+        text += `\r${ESC}[${column}C`;
+      }
+      this.output.write(text);
+    };
+    return new Promise((resolve, reject) => {
+      const finish = () => {
+        this.keyHandler = null;
+        ttyInput.setRawMode?.(false);
+        this.output.write(`\r${ESC}[2K`);
+      };
+      this.keyHandler = (key) => {
+        if (key === KEY_CTRL_C || key === KEY_CTRL_D) {
+          finish();
+          reject(new PromptClosedError());
+          return;
+        }
+        if (KEY_ENTER.includes(key) == true) {
+          finish();
+          resolve({ kind: "entered", text: characters.join("") });
+          return;
+        }
+        if (key === ESC) {
+          finish();
+          resolve({ kind: "back" });
+          return;
+        }
+        if (KEY_BACKSPACE.includes(key) == true) {
+          if (cursor > 0) {
+            characters.splice(cursor - 1, 1);
+            cursor -= 1;
+          }
+        } else if (KEY_DELETE.includes(key) == true) {
+          characters.splice(cursor, 1);
+        } else if (KEY_LEFT.includes(key) == true) {
+          cursor = Math.max(0, cursor - 1);
+        } else if (KEY_RIGHT.includes(key) == true) {
+          cursor = Math.min(characters.length, cursor + 1);
+        } else if (KEY_HOME.includes(key) == true) {
+          cursor = 0;
+        } else if (KEY_END.includes(key) == true) {
+          cursor = characters.length;
+        } else if (key === KEY_CLEAR_LINE) {
+          characters = [];
+          cursor = 0;
+        } else if (isPrintableKey(key) == true) {
+          characters.splice(cursor, 0, key);
+          cursor += 1;
+        } else {
+          return;
+        }
+        draw();
+      };
+      ttyInput.setRawMode?.(true);
+      draw();
+    });
   }
-  rows.push(fieldRow("description", answers.description ?? "none", "shown to the agent"));
-  let readonly = "no";
-  if (answers.readonly == true) {
-    readonly = "yes";
+  async selectWithLines(question, items, startIndex) {
+    const choices = items.filter((item) => "value" in item);
+    const labelWidths = groupLabelWidths(items);
+    this.output.write(`${this.symbols.question} ${question}
+`);
+    let number = 0;
+    for (let index = 0; index < items.length; index += 1) {
+      const item = items[index];
+      if ("value" in item == false) {
+        this.output.write("\n");
+        continue;
+      }
+      number += 1;
+      let line = `  ${String(number).padStart(2)}) ${padToWidth(item.label, labelWidths[index])}`;
+      if (item.hint != null && item.hint !== "") {
+        line += `  ${item.hint}`;
+      }
+      this.output.write(`${line.trimEnd()}
+`);
+    }
+    const defaultChoice = items[startIndex];
+    const defaultNumber = choices.indexOf(defaultChoice) + 1;
+    for (; ; ) {
+      this.output.write(`Choice (${defaultNumber}): `);
+      const line = await this.readLine();
+      if (line == null) {
+        throw new PromptClosedError();
+      }
+      if (line === ESC) {
+        return null;
+      }
+      const answer = line.trim();
+      if (answer === "") {
+        return defaultChoice.value;
+      }
+      const index = Number(answer);
+      if (Number.isInteger(index) == true && index >= 1 && index <= choices.length) {
+        return choices[index - 1].value;
+      }
+      const lowered = answer.toLowerCase();
+      const matched = choices.find((choice) => {
+        const key = choice.key ?? choice.value;
+        return key.toLowerCase() === lowered || choice.label.toLowerCase() === lowered;
+      });
+      if (matched != null) {
+        return matched.value;
+      }
+      this.output.write(`  Pick a number from 1 to ${choices.length}.
+`);
+    }
   }
-  rows.push(fieldRow("readonly", readonly, "enter toggles"));
-  let paths = "anywhere";
-  if (answers.allowedPaths.length > 0) {
-    paths = answers.allowedPaths.join(", ");
+  // ── TTY rendering ──────────────────────────────────────────────────────
+  columns() {
+    const columns = this.output.columns;
+    if (columns == null || columns < 20) {
+      return 80;
+    }
+    return columns;
   }
-  rows.push(fieldRow("paths", paths, "where the file tools may read and write"));
-  rows.push(fieldRow("host-key", describePin(answers.hostKeyFingerprint)));
-  if (routeUsesJump(state.route) == true) {
-    rows.push(fieldRow("jump-host-key", describePin(answers.jumpHostKeyFingerprint)));
+  /** Joins styled parts, cutting the text (not the styles) once `width` columns are used. */
+  fitLine(parts, width) {
+    let used = 0;
+    let line = "";
+    for (const part of parts) {
+      let text = "";
+      for (const character of part.text) {
+        const characterWidth = charWidth(character.codePointAt(0) ?? 0);
+        if (used + characterWidth > width) {
+          break;
+        }
+        used += characterWidth;
+        text += character;
+      }
+      if (part.paint != null) {
+        line += part.paint(text);
+      } else {
+        line += text;
+      }
+      if (used >= width) {
+        break;
+      }
+    }
+    return line;
   }
-  rows.push({ separator: true });
-  let testHint = "not run yet";
-  if (state.lastTest === "ok") {
-    testHint = "last run: OK";
-  } else if (state.lastTest === "failed") {
-    testHint = "last run: failed";
+  /** The one-line record an answered prompt leaves behind on a TTY. */
+  writeAnswered(question, answer) {
+    if (this.interactive == false || this.transient == true) {
+      return;
+    }
+    this.output.write(`${this.style.success(this.symbols.tick)} ${question} ${this.style.dim("\xB7")} ${this.style.accent(answer)}
+`);
   }
-  rows.push({ value: "test", key: "test", label: "Test the connection", hint: testHint });
-  rows.push({ value: "save", key: "save", label: "Save", hint: `to ${destination}` });
-  rows.push({ value: "cancel", key: "cancel", label: "Cancel" });
-  return rows;
-}
-function nextCursor(state, destination, edited) {
-  if (edited === "readonly") {
-    return edited;
+  /** @returns The picked value, or null on Esc. */
+  selectWithKeys(question, items, startIndex) {
+    const ttyInput = this.input;
+    const selectableIndexes = items.flatMap((item, index) => {
+      if ("value" in item) {
+        return [index];
+      }
+      return [];
+    });
+    const labelWidths = groupLabelWidths(items);
+    const ruleWidth = Math.min(Math.max(...labelWidths), 24);
+    let active = startIndex;
+    let renderedLines = 0;
+    const draw = (lines) => {
+      let text = "";
+      if (renderedLines > 1) {
+        text += `${ESC}[${renderedLines - 1}A`;
+      }
+      text += `\r${ESC}[J${lines.join("\n")}`;
+      this.output.write(text);
+      renderedLines = lines.length;
+    };
+    const buildLines = () => {
+      const width = this.columns() - 1;
+      const lines = [
+        this.fitLine([
+          { text: this.symbols.question, paint: this.style.accent },
+          { text: " " },
+          { text: question, paint: this.style.bold }
+        ], width)
+      ];
+      for (let index = 0; index < items.length; index += 1) {
+        const item = items[index];
+        if ("value" in item == false) {
+          lines.push(this.fitLine([{ text: `  ${this.symbols.rule.repeat(ruleWidth)}`, paint: this.style.dim }], width));
+          continue;
+        }
+        const isActive = index === active;
+        const parts = [];
+        if (isActive == true) {
+          parts.push({ text: `${this.symbols.pointer} `, paint: this.style.accent });
+          parts.push({ text: padToWidth(item.label, labelWidths[index]), paint: this.style.accent });
+        } else {
+          parts.push({ text: "  " });
+          parts.push({ text: padToWidth(item.label, labelWidths[index]) });
+        }
+        if (item.hint != null && item.hint !== "") {
+          parts.push({ text: `  ${item.hint}`, paint: this.style.dim });
+        }
+        lines.push(this.fitLine(parts, width));
+      }
+      lines.push(this.fitLine([{ text: "\u2191\u2193 move \xB7 enter select \xB7 esc back", paint: this.style.dim }], width));
+      return lines;
+    };
+    const move = (step) => {
+      const position = selectableIndexes.indexOf(active);
+      const next = (position + step + selectableIndexes.length) % selectableIndexes.length;
+      active = selectableIndexes[next];
+    };
+    return new Promise((resolve, reject) => {
+      const finish = () => {
+        this.keyHandler = null;
+        ttyInput.setRawMode?.(false);
+        draw([]);
+        this.output.write(`${ESC}[?25h`);
+      };
+      this.keyHandler = (key) => {
+        if (key === KEY_CTRL_C || key === KEY_CTRL_D) {
+          finish();
+          reject(new PromptClosedError());
+          return;
+        }
+        if (KEY_ENTER.includes(key) == true) {
+          const picked = items[active];
+          finish();
+          this.writeAnswered(question, picked.label);
+          resolve(picked.value);
+          return;
+        }
+        if (key === ESC) {
+          finish();
+          resolve(null);
+          return;
+        }
+        if (KEY_UP.includes(key) == true) {
+          move(-1);
+        } else if (KEY_DOWN.includes(key) == true) {
+          move(1);
+        } else if (KEY_HOME.includes(key) == true) {
+          active = selectableIndexes[0];
+        } else if (KEY_END.includes(key) == true) {
+          active = selectableIndexes[selectableIndexes.length - 1];
+        } else if (/^[1-9]$/.test(key) == true && Number(key) <= selectableIndexes.length) {
+          active = selectableIndexes[Number(key) - 1];
+        } else {
+          return;
+        }
+        draw(buildLines());
+      };
+      ttyInput.setRawMode?.(true);
+      this.output.write(`${ESC}[?25l`);
+      draw(buildLines());
+    });
   }
-  const values = buildRows(state, destination).flatMap((row) => {
-    if ("value" in row) {
-      return [row.value];
-    }
+};
+
+// src/modules/manage/host-form.ts
+var PREFERRED_KEY_NAMES = ["id_ed25519", "id_ecdsa", "id_rsa"];
+var NON_KEY_FILE_NAMES = ["config", "known_hosts", "known_hosts.old", "authorized_keys", "environment"];
+var MAX_KEY_FILE_BYTES = 64 * 1024;
+var CLEAR_ANSWER = "-";
+var OTHER_KEY_PATH = "\0other";
+var FIELD_NAME_WIDTH = 17;
+var SUB_FIELDS = ["key", "passphrase", "password", "jump-host", "jump-port", "jump-user", "proxy"];
+var FIELD_NAMES = {
+  "host": "Host",
+  "port": "Port",
+  "user": "User",
+  "name": "Server name",
+  "auth": "Authentication",
+  "key": "Private key",
+  "passphrase": "Passphrase",
+  "password": "Password",
+  "route": "Route",
+  "jump-host": "Jump host",
+  "jump-port": "Jump port",
+  "jump-user": "Jump user",
+  "proxy": "Proxy command",
+  "description": "Description",
+  "readonly": "Read-only",
+  "paths": "File paths",
+  "host-key": "Host key",
+  "jump-host-key": "Jump host key"
+};
+var AUTH_LABELS = {
+  key: "Private key file",
+  password: "Password",
+  agent: "SSH agent"
+};
+var ROUTE_LABELS = {
+  "direct": "Directly",
+  "jump": "Through a jump host",
+  "proxy": "Through a proxy command",
+  "jump-proxy": "Proxy command, then a jump host"
+};
+var REQUIRED_MARK = "(required)";
+function findPrivateKeys() {
+  const sshDirectory = path.join(os5.homedir(), ".ssh");
+  let names = [];
+  try {
+    names = fs6.readdirSync(sshDirectory);
+  } catch {
     return [];
-  });
-  let index = values.indexOf(edited) + 1;
-  if (SUB_FIELDS.includes(edited) == false) {
-    while (index < values.length && SUB_FIELDS.includes(values[index]) == true) {
-      index += 1;
-    }
-  }
-  const next = values[index];
-  if (next == null || next === "test") {
-    return "save";
   }
-  return next;
-}
-async function testConnection(prompter, output, state) {
-  const answers = finalizeAnswers(state);
-  output.write("\n");
-  const profile = profileFromEnv(output, answersToEntry(answers).env);
-  if (profile == null) {
-    output.write("\n");
-    state.lastTest = "failed";
-    return false;
-  }
-  const result = await runConnectionCheck(profile, output);
-  output.write("\n");
-  if (result.connected == true) {
-    if (result.hostKeyFingerprint != null && state.answers.hostKeyFingerprint == null) {
-      const pin = await prompter.askYesNo("Pin this host key? (a changed key then aborts the connection)", true);
-      if (pin == true) {
-        state.answers.hostKeyFingerprint = result.hostKeyFingerprint;
+  const keys = [];
+  for (const name of names) {
+    if (name.endsWith(".pub") == true || NON_KEY_FILE_NAMES.includes(name) == true) {
+      continue;
+    }
+    const fullPath = path.join(sshDirectory, name);
+    let head = "";
+    try {
+      const stat = fs6.statSync(fullPath);
+      if (stat.isFile() == false || stat.size > MAX_KEY_FILE_BYTES) {
+        continue;
       }
+      const descriptor = fs6.openSync(fullPath, "r");
+      const buffer = Buffer.alloc(64);
+      const bytesRead = fs6.readSync(descriptor, buffer, 0, buffer.length, 0);
+      fs6.closeSync(descriptor);
+      head = buffer.subarray(0, bytesRead).toString("utf8");
+    } catch {
+      continue;
     }
-    if (result.jumpHostKeyFingerprint != null && routeUsesJump(state.route) == true && state.answers.jumpHostKeyFingerprint == null) {
-      const pin = await prompter.askYesNo("Pin the jump host key too?", true);
-      if (pin == true) {
-        state.answers.jumpHostKeyFingerprint = result.jumpHostKeyFingerprint;
+    const isPemKey = head.startsWith("-----BEGIN") == true && head.includes("PRIVATE KEY") == true;
+    const isPuttyKey = head.startsWith("PuTTY-User-Key-File") == true;
+    if (isPemKey == false && isPuttyKey == false) {
+      continue;
+    }
+    let hint = "";
+    try {
+      const publicKey = fs6.readFileSync(`${fullPath}.pub`, "utf8").trim().split(/\s+/);
+      hint = publicKey[0].replace(/^ssh-/, "");
+      if (publicKey.length > 2) {
+        hint += ` \xB7 ${publicKey.slice(2).join(" ")}`;
       }
+    } catch {
     }
-    state.lastTest = "ok";
-    state.testedSnapshot = snapshotOf(state);
-    return true;
+    keys.push({ path: `~/.ssh/${name}`, hint });
   }
-  const hostKeyChanged = result.hostKeyFingerprint != null && state.answers.hostKeyFingerprint != null && result.hostKeyFingerprint !== state.answers.hostKeyFingerprint;
-  if (hostKeyChanged == true) {
-    output.write("  The host presented a different key than the pinned one. Re-pin only if you know it was rebuilt.\n");
-    const repin = await prompter.askYesNo(`Pin ${result.hostKeyFingerprint} instead?`, false);
-    if (repin == true) {
-      state.answers.hostKeyFingerprint = result.hostKeyFingerprint ?? void 0;
-      output.write("  Pinned the new key \u2014 test again to confirm.\n");
+  const rank = (key) => {
+    const index = PREFERRED_KEY_NAMES.indexOf(path.basename(key.path));
+    if (index < 0) {
+      return PREFERRED_KEY_NAMES.length;
     }
-  }
-  const jumpKeyChanged = result.jumpHostKeyFingerprint != null && state.answers.jumpHostKeyFingerprint != null && result.jumpHostKeyFingerprint !== state.answers.jumpHostKeyFingerprint;
-  if (jumpKeyChanged == true) {
-    output.write("  The jump host presented a different key than the pinned one. Re-pin only if you know it was rebuilt.\n");
-    const repin = await prompter.askYesNo(`Pin ${result.jumpHostKeyFingerprint} instead?`, false);
-    if (repin == true) {
-      state.answers.jumpHostKeyFingerprint = result.jumpHostKeyFingerprint ?? void 0;
-      output.write("  Pinned the new key \u2014 test again to confirm.\n");
+    return index;
+  };
+  return keys.sort((left, right) => rank(left) - rank(right) || left.path.localeCompare(right.path));
+}
+async function askPort(prompter, question, current) {
+  for (; ; ) {
+    const answer = await prompter.ask(question, String(current));
+    const parsed = Number(answer);
+    if (Number.isInteger(parsed) == true && parsed > 0 && parsed <= 65535) {
+      return parsed;
     }
+    prompter.write("  Enter a port number between 1 and 65535.\n");
   }
-  state.lastTest = "failed";
-  return false;
 }
-async function editField(prompter, output, state, id) {
-  const { answers } = state;
-  if (id === "host") {
-    let current;
-    if (answers.host !== "") {
-      current = answers.host;
-    }
-    answers.host = await prompter.askRequired("Host (hostname or IP)", current);
-    if (state.nameTouched == false) {
-      answers.name = deriveServerName(answers.host);
-    }
-    return;
+async function askOptional(prompter, question, current) {
+  const answer = await prompter.ask(question, current);
+  if (answer === "" || answer === CLEAR_ANSWER) {
+    return void 0;
   }
-  if (id === "port") {
-    answers.port = await askPort(prompter, "Port", answers.port);
-    return;
+  return answer;
+}
+async function askOptionalSecret(prompter, question, current) {
+  let suffix = "(empty for none)";
+  if (current != null) {
+    suffix = `(enter keeps current, ${CLEAR_ANSWER} clears)`;
   }
-  if (id === "user") {
-    let current;
-    if (answers.username !== "") {
-      current = answers.username;
-    }
-    answers.username = await prompter.askRequired("Login user", current);
-    return;
+  const answer = await prompter.askSecret(`${question} ${prompter.paint.dim(suffix)}`);
+  if (answer === CLEAR_ANSWER) {
+    return void 0;
   }
-  if (id === "name") {
-    let current;
-    if (answers.name !== "") {
-      current = answers.name;
-    }
-    for (; ; ) {
-      const name = await prompter.askRequired("Server name the agent sees", current);
-      if (SERVER_NAME_PATTERN.test(name) == true) {
-        answers.name = name;
-        state.nameTouched = true;
-        return;
-      }
-      prompter.write("  Use letters, digits, '-' and '_' only (max 48) \u2014 the name becomes part of every tool name.\n");
-    }
+  if (answer === "") {
+    return current;
   }
-  if (id === "auth") {
-    answers.auth = await prompter.select(
-      "Authentication",
-      [
-        { value: "key", label: AUTH_LABELS.key, hint: "only the path is stored \u2014 recommended" },
-        { value: "password", label: AUTH_LABELS.password, hint: "stored in the config file as plain text" },
-        { value: "agent", label: AUTH_LABELS.agent, hint: "keys already loaded in ssh-agent" }
-      ],
-      { defaultValue: answers.auth }
-    );
-    if (answers.auth === "key" && answers.keyPath == null) {
-      answers.keyPath = await askKeyPath(prompter, void 0);
+  return answer;
+}
+async function askKeyPath(prompter, current) {
+  const found = findPrivateKeys();
+  let picked = OTHER_KEY_PATH;
+  if (found.length > 0 || current != null) {
+    const items = [];
+    if (current != null && found.some((key) => key.path === current) == false) {
+      items.push({ value: current, label: current, hint: "current" });
     }
-    if (answers.auth === "password" && answers.password == null) {
-      answers.password = await askOptionalSecret(prompter, "Password", void 0);
+    for (const key of found) {
+      items.push({ value: key.path, label: key.path, hint: key.hint });
     }
-    return;
-  }
-  if (id === "key") {
-    answers.keyPath = await askKeyPath(prompter, answers.keyPath);
-    return;
-  }
-  if (id === "passphrase") {
-    answers.passphrase = await askOptionalSecret(prompter, "Key passphrase", answers.passphrase);
-    return;
+    items.push({ separator: true });
+    items.push({ value: OTHER_KEY_PATH, key: "other", label: "Another path\u2026" });
+    picked = await prompter.select("Private key", items, { defaultValue: current ?? found[0]?.path });
   }
-  if (id === "password") {
-    answers.password = await askOptionalSecret(prompter, "Password", answers.password);
-    return;
+  if (picked !== OTHER_KEY_PATH) {
+    return picked;
   }
-  if (id === "route") {
-    state.route = await prompter.select(
-      "Route",
-      [
-        { value: "direct", label: ROUTE_LABELS.direct },
-        { value: "jump", label: ROUTE_LABELS.jump, hint: "ssh -J" },
-        { value: "proxy", label: ROUTE_LABELS.proxy, hint: "e.g. cloudflared access ssh" },
-        { value: "jump-proxy", label: ROUTE_LABELS["jump-proxy"], hint: "cloudflared to the bastion, then on to the host" }
-      ],
-      { defaultValue: state.route }
-    );
-    if (routeUsesJump(state.route) == true && answers.jumpHost == null) {
-      answers.jumpHost = await prompter.askRequired("Jump host");
+  for (; ; ) {
+    const typed = await prompter.askRequired("Private key path");
+    if (fs6.existsSync(expandHomePath(typed)) == true) {
+      return typed;
     }
-    if (routeUsesProxy(state.route) == true && answers.proxyCommand == null) {
-      answers.proxyCommand = await prompter.askRequired("Proxy command", "cloudflared access ssh --hostname %h");
+    prompter.write(`  ${expandHomePath(typed)} does not exist.
+`);
+    const useAnyway = await prompter.askYesNo("Use this path anyway?", false);
+    if (useAnyway == true) {
+      return typed;
     }
-    return;
   }
-  if (id === "jump-host") {
-    answers.jumpHost = await prompter.askRequired("Jump host", answers.jumpHost);
-    return;
+}
+function routeUsesJump(route) {
+  return route === "jump" || route === "jump-proxy";
+}
+function routeUsesProxy(route) {
+  return route === "proxy" || route === "jump-proxy";
+}
+function deriveServerName(host) {
+  return `ssh-${host}`.replace(/[^A-Za-z0-9_-]+/g, "-").slice(0, 48);
+}
+function finalizeAnswers(state) {
+  const answers = { ...state.answers };
+  if (routeUsesJump(state.route) == false) {
+    answers.jumpHost = void 0;
+    answers.jumpPort = void 0;
+    answers.jumpUser = void 0;
+    answers.jumpHostKeyFingerprint = void 0;
   }
-  if (id === "jump-port") {
-    answers.jumpPort = await askPort(prompter, "Jump host port", answers.jumpPort ?? DEFAULT_SSH_PORT);
-    return;
+  if (routeUsesProxy(state.route) == false) {
+    answers.proxyCommand = void 0;
   }
-  if (id === "jump-user") {
-    answers.jumpUser = await askOptional(prompter, "Jump host user (empty = same as the login user)", answers.jumpUser);
-    return;
+  if (answers.auth !== "key") {
+    answers.keyPath = void 0;
+    answers.passphrase = void 0;
   }
-  if (id === "proxy") {
-    output.write(prompter.paint.dim("  %h / %p / %r expand to the first hop's host, port and user.\n"));
-    answers.proxyCommand = await prompter.askRequired("Proxy command", answers.proxyCommand ?? "cloudflared access ssh --hostname %h");
-    return;
+  if (answers.auth !== "password") {
+    answers.password = void 0;
   }
-  if (id === "description") {
-    answers.description = await askOptional(prompter, "Description shown to the agent", answers.description);
-    return;
+  return answers;
+}
+function snapshotOf(state) {
+  return JSON.stringify(finalizeAnswers(state));
+}
+function cloneState(state) {
+  return {
+    ...state,
+    answers: {
+      ...state.answers,
+      allowedPaths: [...state.answers.allowedPaths],
+      extraEnv: { ...state.answers.extraEnv }
+    }
+  };
+}
+function restoreState(state, snapshot) {
+  const restored = cloneState(snapshot);
+  state.answers = restored.answers;
+  state.route = restored.route;
+  state.nameTouched = restored.nameTouched;
+  state.lastTest = restored.lastTest;
+  state.testedSnapshot = restored.testedSnapshot;
+}
+function missingFields(state) {
+  const { answers } = state;
+  const missing = [];
+  if (answers.host === "") {
+    missing.push("host");
   }
-  if (id === "readonly") {
-    answers.readonly = answers.readonly == false;
-    return;
+  if (answers.username === "") {
+    missing.push("user");
   }
-  if (id === "paths") {
-    let current;
-    if (answers.allowedPaths.length > 0) {
-      current = answers.allowedPaths.join(",");
-    }
-    const typed = await askOptional(prompter, "Limit file tools to path prefixes (comma-separated, empty = anywhere)", current);
-    answers.allowedPaths = [];
-    if (typed != null) {
-      answers.allowedPaths = typed.split(",").map((item) => item.trim()).filter((item) => item !== "");
-    }
-    return;
+  if (answers.auth === "key" && answers.keyPath == null) {
+    missing.push("key");
   }
-  const isJump = id === "jump-host-key";
-  let pinned = answers.hostKeyFingerprint;
-  if (isJump == true) {
-    pinned = answers.jumpHostKeyFingerprint;
+  if (answers.auth === "password" && answers.password == null) {
+    missing.push("password");
   }
-  if (pinned != null) {
-    const unpin = await prompter.askYesNo(`Unpin ${pinned}?`, false);
-    if (unpin == true && isJump == true) {
-      answers.jumpHostKeyFingerprint = void 0;
-    } else if (unpin == true) {
-      answers.hostKeyFingerprint = void 0;
-    }
-    return;
+  if (routeUsesJump(state.route) == true && answers.jumpHost == null) {
+    missing.push("jump-host");
   }
-  const missing = missingFields(state);
-  if (missing.length > 0) {
-    output.write(`  Fill in ${missing.map((field) => FIELD_NAMES[field]).join(", ")} first \u2014 the key is pinned by testing the connection.
-`);
-    return;
+  if (routeUsesProxy(state.route) == true && answers.proxyCommand == null) {
+    missing.push("proxy");
   }
-  await testConnection(prompter, output, state);
+  return missing;
 }
-async function runHostForm(prompter, output, options) {
-  const { existing, takenNames, destination } = options;
-  let state;
-  if (existing != null) {
-    let route = "direct";
-    if (existing.jumpHost != null && existing.proxyCommand != null) {
-      route = "jump-proxy";
-    } else if (existing.jumpHost != null) {
-      route = "jump";
-    } else if (existing.proxyCommand != null) {
-      route = "proxy";
-    }
-    state = { answers: { ...existing }, route, nameTouched: true, lastTest: "never", testedSnapshot: null };
-  } else {
-    const foundKeys = findPrivateKeys();
-    state = {
-      answers: {
-        name: "",
-        host: "",
-        port: DEFAULT_SSH_PORT,
-        username: "",
-        auth: "key",
-        keyPath: foundKeys[0]?.path,
-        readonly: false,
-        allowedPaths: [],
-        extraEnv: {}
-      },
-      route: "direct",
-      nameTouched: false,
-      lastTest: "never",
-      testedSnapshot: null
-    };
+function describePin(fingerprint) {
+  if (fingerprint == null) {
+    return "not pinned";
   }
-  const initialSnapshot = snapshotOf(state);
-  const originalName = existing?.name;
-  let title = "New host";
-  if (existing != null) {
-    title = `Editing ${existing.name}`;
+  return `pinned \xB7 ${fingerprint.slice(0, 19)}\u2026`;
+}
+function valueOrRequired(value) {
+  if (value == null || value === "") {
+    return REQUIRED_MARK;
   }
-  output.write(prompter.paint.dim(`
-  Pick a setting to change it. In a text field, Enter keeps the value shown and ${CLEAR_ANSWER} clears it.
-
-`));
-  const previousTransient = prompter.transient;
-  prompter.transient = true;
-  try {
-    let cursor = "host";
-    for (; ; ) {
-      const picked = await prompter.select(title, buildRows(state, destination), { defaultValue: cursor, cancelValue: "cancel" });
-      if (picked === "cancel") {
-        if (snapshotOf(state) !== initialSnapshot) {
-          const discard = await prompter.askYesNo("Discard the changes?", false);
-          if (discard == false) {
-            continue;
-          }
-        }
-        return null;
-      }
-      const missing = missingFields(state);
-      if (picked === "test") {
-        if (missing.length > 0) {
-          output.write(`  Fill in ${missing.map((field) => FIELD_NAMES[field]).join(", ")} first.
-`);
-          cursor = missing[0];
-          continue;
-        }
-        const connected = await testConnection(prompter, output, state);
-        cursor = "test";
-        if (connected == true) {
-          cursor = "save";
-        }
-        continue;
-      }
-      if (picked === "save") {
-        if (missing.length > 0) {
-          output.write(`  Fill in ${missing.map((field) => FIELD_NAMES[field]).join(", ")} first.
-`);
-          cursor = missing[0];
-          continue;
-        }
-        const name = state.answers.name;
-        if (name !== originalName && takenNames.includes(name) == true) {
-          const replace = await prompter.askYesNo(`"${name}" already exists in this file. Replace it?`, false);
-          if (replace == false) {
-            cursor = "name";
-            continue;
-          }
-        }
-        if (snapshotOf(state) !== state.testedSnapshot) {
-          const testFirst = await prompter.askYesNo("Test the connection before saving?", true);
-          if (testFirst == true) {
-            const connected = await testConnection(prompter, output, state);
-            if (connected == false) {
-              const next = await prompter.select(
-                "The check failed. What now?",
-                [
-                  { value: "back", key: "back", label: "Back to the settings" },
-                  { value: "save", key: "save", label: "Save anyway", hint: "the host may be unreachable from here" },
-                  { value: "discard", key: "discard", label: "Discard", hint: "nothing is written" }
-                ],
-                { defaultValue: "back", cancelValue: "back" }
-              );
-              if (next === "discard") {
-                return null;
-              }
-              if (next === "back") {
-                cursor = "test";
-                continue;
-              }
-            }
-          }
-        }
-        return finalizeAnswers(state);
-      }
-      await editField(prompter, output, state, picked);
-      cursor = nextCursor(state, destination, picked);
+  return value;
+}
+function fieldRow(id, value, hint) {
+  let name = FIELD_NAMES[id];
+  if (SUB_FIELDS.includes(id) == true) {
+    name = `  ${name}`;
+  }
+  return {
+    value: id,
+    key: id,
+    label: `${name.padEnd(FIELD_NAME_WIDTH)}${value}`,
+    hint
+  };
+}
+function buildRows(state, destination) {
+  const { answers } = state;
+  const rows = [];
+  rows.push(fieldRow("host", valueOrRequired(answers.host)));
+  rows.push(fieldRow("port", String(answers.port)));
+  rows.push(fieldRow("user", valueOrRequired(answers.username)));
+  let nameValue = answers.name;
+  let nameHint = "what the agent sees";
+  if (state.nameTouched == false) {
+    nameHint = "follows the host until you change it";
+  }
+  if (nameValue === "") {
+    nameValue = "ssh-<host>";
+  }
+  rows.push(fieldRow("name", nameValue, nameHint));
+  rows.push(fieldRow("auth", AUTH_LABELS[answers.auth]));
+  if (answers.auth === "key") {
+    rows.push(fieldRow("key", valueOrRequired(answers.keyPath)));
+    let passphrase = "none";
+    if (answers.passphrase != null) {
+      passphrase = "set";
     }
-  } finally {
-    prompter.transient = previousTransient;
+    rows.push(fieldRow("passphrase", passphrase));
   }
-}
-
-// src/modules/manage/prompter.ts
-var PromptClosedError = class extends Error {
-  constructor() {
-    super("input closed before the prompt was answered");
-    this.name = "PromptClosedError";
+  if (answers.auth === "password") {
+    let password = REQUIRED_MARK;
+    if (answers.password != null) {
+      password = "set";
+    }
+    rows.push(fieldRow("password", password, "stored in the config file as plain text"));
   }
-};
-var ESC = "\x1B";
-var KEY_UP = [`${ESC}[A`, `${ESC}OA`, "k"];
-var KEY_DOWN = [`${ESC}[B`, `${ESC}OB`, "j"];
-var KEY_HOME = [`${ESC}[H`, `${ESC}OH`, `${ESC}[1~`];
-var KEY_END = [`${ESC}[F`, `${ESC}OF`, `${ESC}[4~`];
-var KEY_ENTER = ["\r", "\n"];
-var KEY_BACKSPACE = ["\x7F", "\b"];
-var KEY_CTRL_C = "";
-var KEY_CTRL_D = "";
-function splitKeys(chunk) {
-  const keys = [];
-  let index = 0;
-  while (index < chunk.length) {
-    const isSequence = chunk[index] === ESC && (chunk[index + 1] === "[" || chunk[index + 1] === "O");
-    if (isSequence == true) {
-      let end = index + 2;
-      while (end < chunk.length && /[0-9;]/.test(chunk[end]) == true) {
-        end += 1;
+  rows.push(fieldRow("route", ROUTE_LABELS[state.route]));
+  if (routeUsesJump(state.route) == true) {
+    rows.push(fieldRow("jump-host", valueOrRequired(answers.jumpHost)));
+    rows.push(fieldRow("jump-port", String(answers.jumpPort ?? DEFAULT_SSH_PORT)));
+    let jumpUser = answers.jumpUser;
+    if (jumpUser == null || jumpUser === answers.username) {
+      let loginUser = answers.username;
+      if (loginUser === "") {
+        loginUser = "\u2026";
       }
-      keys.push(chunk.slice(index, end + 1));
-      index = end + 1;
-      continue;
+      jumpUser = `same as login (${loginUser})`;
     }
-    const codePoint = chunk.codePointAt(index) ?? 0;
-    const character = String.fromCodePoint(codePoint);
-    keys.push(character);
-    index += character.length;
+    rows.push(fieldRow("jump-user", jumpUser));
   }
-  return keys;
-}
-function charWidth(codePoint) {
-  if (codePoint < 4352) {
-    return 1;
+  if (routeUsesProxy(state.route) == true) {
+    rows.push(fieldRow("proxy", valueOrRequired(answers.proxyCommand), "%h %p %r \u2192 first hop"));
   }
-  const isWide = codePoint <= 4447 || codePoint === 9001 || codePoint === 9002 || codePoint >= 11904 && codePoint <= 42191 && codePoint !== 12351 || codePoint >= 44032 && codePoint <= 55203 || codePoint >= 63744 && codePoint <= 64255 || codePoint >= 65072 && codePoint <= 65103 || codePoint >= 65280 && codePoint <= 65376 || codePoint >= 65504 && codePoint <= 65510 || codePoint >= 127744 && codePoint <= 128591 || codePoint >= 129280 && codePoint <= 129535 || codePoint >= 131072 && codePoint <= 262141;
-  if (isWide == true) {
-    return 2;
+  rows.push(fieldRow("description", answers.description ?? "none", "shown to the agent"));
+  let readonly = "no";
+  if (answers.readonly == true) {
+    readonly = "yes";
   }
-  return 1;
-}
-function displayWidth(text) {
-  let width = 0;
-  for (const character of text) {
-    width += charWidth(character.codePointAt(0) ?? 0);
+  rows.push(fieldRow("readonly", readonly, "enter toggles"));
+  let paths = "anywhere";
+  if (answers.allowedPaths.length > 0) {
+    paths = answers.allowedPaths.join(", ");
   }
-  return width;
-}
-function padToWidth(text, width) {
-  const missing = width - displayWidth(text);
-  if (missing <= 0) {
-    return text;
+  rows.push(fieldRow("paths", paths, "where the file tools may read and write"));
+  rows.push(fieldRow("host-key", describePin(answers.hostKeyFingerprint)));
+  if (routeUsesJump(state.route) == true) {
+    rows.push(fieldRow("jump-host-key", describePin(answers.jumpHostKeyFingerprint)));
   }
-  return `${text}${" ".repeat(missing)}`;
+  rows.push({ separator: true });
+  let testHint = "not run yet";
+  if (state.lastTest === "ok") {
+    testHint = "last run: OK";
+  } else if (state.lastTest === "failed") {
+    testHint = "last run: failed";
+  }
+  rows.push({ value: "test", key: "test", label: "Test the connection", hint: testHint });
+  rows.push({ value: "save", key: "save", label: "Save", hint: `to ${destination}` });
+  rows.push({ value: "cancel", key: "cancel", label: "Cancel" });
+  return rows;
 }
-function groupLabelWidths(items) {
-  const widths = items.map(() => 0);
-  let groupStart = 0;
-  for (let index = 0; index <= items.length; index += 1) {
-    const atBoundary = index === items.length || "value" in items[index] == false;
-    if (atBoundary == false) {
-      continue;
-    }
-    let groupWidth = 0;
-    for (let member = groupStart; member < index; member += 1) {
-      const item = items[member];
-      groupWidth = Math.max(groupWidth, displayWidth(item.label));
+function nextCursor(state, destination, edited) {
+  if (edited === "readonly") {
+    return edited;
+  }
+  const values = buildRows(state, destination).flatMap((row) => {
+    if ("value" in row) {
+      return [row.value];
     }
-    for (let member = groupStart; member < index; member += 1) {
-      widths[member] = groupWidth;
+    return [];
+  });
+  let index = values.indexOf(edited) + 1;
+  if (SUB_FIELDS.includes(edited) == false) {
+    while (index < values.length && SUB_FIELDS.includes(values[index]) == true) {
+      index += 1;
     }
-    groupStart = index + 1;
   }
-  return widths;
-}
-function supportsUnicode() {
-  if (process.platform !== "win32") {
-    return true;
+  const next = values[index];
+  if (next == null || next === "test") {
+    return "save";
   }
-  return process.env.WT_SESSION != null || process.env.TERM_PROGRAM === "vscode" || process.env.TERMINAL_EMULATOR === "JetBrains-JediTerm" || process.env.ConEmuTask != null;
+  return next;
 }
-function createStyle(enabled) {
-  const paint = (open, close) => {
-    return (text) => {
-      if (enabled == false || text === "") {
-        return text;
+async function testConnection(prompter, output, state) {
+  const answers = finalizeAnswers(state);
+  output.write("\n");
+  const profile = profileFromEnv(output, answersToEntry(answers).env);
+  if (profile == null) {
+    output.write("\n");
+    state.lastTest = "failed";
+    return false;
+  }
+  const result = await runConnectionCheck(profile, output);
+  output.write("\n");
+  if (result.connected == true) {
+    if (result.hostKeyFingerprint != null && state.answers.hostKeyFingerprint == null) {
+      const pin = await prompter.askYesNo("Pin this host key? (a changed key then aborts the connection)", true);
+      if (pin == true) {
+        state.answers.hostKeyFingerprint = result.hostKeyFingerprint;
       }
-      return `${ESC}[${open}m${text}${ESC}[${close}m`;
-    };
-  };
-  return {
-    accent: paint(36, 39),
-    success: paint(32, 39),
-    dim: paint(2, 22),
-    bold: paint(1, 22)
-  };
-}
-var Prompter = class {
-  constructor(input, output) {
-    this.input = input;
-    this.output = output;
-    this.lineBuffer = "";
-    this.pendingLines = [];
-    this.lineWaiter = null;
-    this.inputEnded = false;
-    /** Set while a key-driven prompt (select, secret) owns the input. */
-    this.keyHandler = null;
-    /**
-     * When true, an answered prompt leaves nothing behind on a TTY instead of its
-     * `✔ question · answer` line. The settings form sets it: the form itself shows every
-     * value, so it can redraw in place rather than scroll a trail of edits.
-     */
-    this.transient = false;
-    const ttyInput = input;
-    const ttyOutput = output;
-    this.interactive = ttyInput.isTTY == true && ttyInput.setRawMode != null && ttyOutput.isTTY == true;
-    this.style = createStyle(this.interactive == true && process.env.NO_COLOR == null);
-    if (supportsUnicode() == true) {
-      this.symbols = { question: "?", pointer: "\u276F", tick: "\u2714", rule: "\u2500" };
-    } else {
-      this.symbols = { question: "?", pointer: ">", tick: "\u221A", rule: "-" };
     }
-    input.setEncoding("utf8");
-    input.on("data", (chunk) => {
-      this.onData(chunk);
-    });
-    input.on("end", () => {
-      this.inputEnded = true;
-      if (this.lineWaiter != null) {
-        const waiter = this.lineWaiter;
-        this.lineWaiter = null;
-        waiter(null);
-      }
-      if (this.keyHandler != null) {
-        this.keyHandler(KEY_CTRL_D);
+    if (result.jumpHostKeyFingerprint != null && routeUsesJump(state.route) == true && state.answers.jumpHostKeyFingerprint == null) {
+      const pin = await prompter.askYesNo("Pin the jump host key too?", true);
+      if (pin == true) {
+        state.answers.jumpHostKeyFingerprint = result.jumpHostKeyFingerprint;
       }
-    });
-  }
-  /** Stops reading so the process can exit once the command is done. */
-  close() {
-    if (this.interactive == true) {
-      this.input.setRawMode?.(false);
-      this.output.write(`${ESC}[?25h`);
     }
-    this.input.pause();
-  }
-  write(text) {
-    this.output.write(text);
+    state.lastTest = "ok";
+    state.testedSnapshot = snapshotOf(state);
+    return true;
   }
-  /** Styling for callers that print around the prompts; plain text off a TTY. */
-  get paint() {
-    return this.style;
+  const hostKeyChanged = result.hostKeyFingerprint != null && state.answers.hostKeyFingerprint != null && result.hostKeyFingerprint !== state.answers.hostKeyFingerprint;
+  if (hostKeyChanged == true) {
+    output.write("  The host presented a different key than the pinned one. Re-pin only if you know it was rebuilt.\n");
+    const repin = await prompter.askYesNo(`Pin ${result.hostKeyFingerprint} instead?`, false);
+    if (repin == true) {
+      state.answers.hostKeyFingerprint = result.hostKeyFingerprint ?? void 0;
+      output.write("  Pinned the new key \u2014 test again to confirm.\n");
+    }
   }
-  /**
-   * Free-text prompt. Enter accepts `defaultValue` when one is shown.
-   *
-   * @throws {PromptClosedError} If the input closes before a line arrives.
-   */
-  async ask(question, defaultValue) {
-    let suffix = "";
-    if (defaultValue != null && defaultValue !== "") {
-      suffix = ` ${this.style.dim(`(${defaultValue})`)}`;
+  const jumpKeyChanged = result.jumpHostKeyFingerprint != null && state.answers.jumpHostKeyFingerprint != null && result.jumpHostKeyFingerprint !== state.answers.jumpHostKeyFingerprint;
+  if (jumpKeyChanged == true) {
+    output.write("  The jump host presented a different key than the pinned one. Re-pin only if you know it was rebuilt.\n");
+    const repin = await prompter.askYesNo(`Pin ${result.jumpHostKeyFingerprint} instead?`, false);
+    if (repin == true) {
+      state.answers.jumpHostKeyFingerprint = result.jumpHostKeyFingerprint ?? void 0;
+      output.write("  Pinned the new key \u2014 test again to confirm.\n");
     }
-    const prompt = `${this.style.accent(this.symbols.question)} ${this.style.bold(question)}${suffix} `;
-    this.output.write(prompt);
-    const line = await this.readLine();
-    if (line == null) {
-      throw new PromptClosedError();
+  }
+  state.lastTest = "failed";
+  return false;
+}
+async function editField(prompter, output, state, id) {
+  const { answers } = state;
+  if (id === "host") {
+    let current;
+    if (answers.host !== "") {
+      current = answers.host;
     }
-    let answer = line.trim();
-    if (answer === "" && defaultValue != null) {
-      answer = defaultValue;
+    answers.host = await prompter.askRequired("Host (hostname or IP)", current);
+    if (state.nameTouched == false) {
+      answers.name = deriveServerName(answers.host);
     }
-    this.collapseAnswered(prompt, line, question, answer);
-    return answer;
+    return;
   }
-  /** Like `ask`, re-asking until something non-empty is entered. */
-  async askRequired(question, defaultValue) {
-    for (; ; ) {
-      const answer = await this.ask(question, defaultValue);
-      if (answer !== "") {
-        return answer;
-      }
-      this.output.write(`  ${this.style.dim("A value is required.")}
-`);
+  if (id === "port") {
+    answers.port = await askPort(prompter, "Port", answers.port);
+    return;
+  }
+  if (id === "user") {
+    let current;
+    if (answers.username !== "") {
+      current = answers.username;
     }
+    answers.username = await prompter.askRequired("Login user", current);
+    return;
   }
-  async askYesNo(question, defaultValue) {
-    let hint = "y/N";
-    if (defaultValue == true) {
-      hint = "Y/n";
+  if (id === "name") {
+    let current;
+    if (answers.name !== "") {
+      current = answers.name;
     }
     for (; ; ) {
-      const prompt = `${this.style.accent(this.symbols.question)} ${this.style.bold(question)} ${this.style.dim(`(${hint})`)} `;
-      this.output.write(prompt);
-      const line = await this.readLine();
-      if (line == null) {
-        throw new PromptClosedError();
-      }
-      const normalized = line.trim().toLowerCase();
-      let answer = null;
-      if (normalized === "") {
-        answer = defaultValue;
-      } else if (normalized === "y" || normalized === "yes") {
-        answer = true;
-      } else if (normalized === "n" || normalized === "no") {
-        answer = false;
-      }
-      if (answer != null) {
-        let shown = "no";
-        if (answer == true) {
-          shown = "yes";
-        }
-        this.collapseAnswered(prompt, line, question, shown);
-        return answer;
+      const name = await prompter.askRequired("Server name the agent sees", current);
+      if (SERVER_NAME_PATTERN.test(name) == true) {
+        answers.name = name;
+        state.nameTouched = true;
+        return;
       }
-      this.output.write(`  ${this.style.dim("Answer y or n.")}
-`);
+      prompter.write("  Use letters, digits, '-' and '_' only (max 48) \u2014 the name becomes part of every tool name.\n");
     }
   }
-  /**
-   * Picks one of `items`. On a TTY: ↑/↓ (or k/j) move, 1–9 jump, Enter picks, Esc returns
-   * `cancelValue`. Off a TTY: a numbered list, answered by number, key or label.
-   *
-   * @throws {PromptClosedError} On Ctrl+C or when the input closes.
-   */
-  async select(question, items, options) {
-    const choices = items.filter((item) => "value" in item);
-    if (choices.length === 0) {
-      throw new Error("select needs at least one choice");
-    }
-    let startIndex = items.findIndex((item) => "value" in item && item.value === options?.defaultValue);
-    if (startIndex < 0) {
-      startIndex = items.findIndex((item) => "value" in item);
+  if (id === "auth") {
+    answers.auth = await prompter.select(
+      "Authentication",
+      [
+        { value: "key", label: AUTH_LABELS.key, hint: "only the path is stored \u2014 recommended" },
+        { value: "password", label: AUTH_LABELS.password, hint: "stored in the config file as plain text" },
+        { value: "agent", label: AUTH_LABELS.agent, hint: "keys already loaded in ssh-agent" }
+      ],
+      { defaultValue: answers.auth }
+    );
+    if (answers.auth === "key" && answers.keyPath == null) {
+      answers.keyPath = await askKeyPath(prompter, void 0);
     }
-    if (this.interactive == true) {
-      const picked2 = await this.selectWithKeys(question, items, startIndex, options?.cancelValue);
-      return picked2;
+    if (answers.auth === "password" && answers.password == null) {
+      answers.password = await askOptionalSecret(prompter, "Password", void 0);
     }
-    const picked = await this.selectWithLines(question, items, startIndex);
-    return picked;
+    return;
   }
-  /**
-   * Reads a value without echoing it on a TTY. Empty means "none", or "keep" when the
-   * caller says a value already exists.
-   *
-   * @throws {PromptClosedError} On Ctrl+C or when the input closes.
-   */
-  async askSecret(question) {
-    if (this.interactive == false) {
-      const answer = await this.ask(question);
-      return answer;
-    }
-    const prompt = `${this.style.accent(this.symbols.question)} ${this.style.bold(question)} `;
-    this.output.write(prompt);
-    const ttyInput = this.input;
-    return new Promise((resolve, reject) => {
-      let buffer = "";
-      const finish = () => {
-        this.keyHandler = null;
-        ttyInput.setRawMode?.(false);
-        this.output.write(`\r${ESC}[2K`);
-      };
-      this.keyHandler = (key) => {
-        if (key === KEY_CTRL_C || key === KEY_CTRL_D) {
-          finish();
-          reject(new PromptClosedError());
-          return;
-        }
-        if (KEY_ENTER.includes(key) == true) {
-          finish();
-          let shown = this.style.dim("(empty)");
-          if (buffer !== "") {
-            shown = "\u2022".repeat(Math.min(buffer.length, 8));
-          }
-          this.writeAnswered(question, shown);
-          resolve(buffer);
-          return;
-        }
-        if (KEY_BACKSPACE.includes(key) == true) {
-          buffer = Array.from(buffer).slice(0, -1).join("");
-          return;
-        }
-        if (key.startsWith(ESC) == true) {
-          return;
-        }
-        buffer += key;
-      };
-      ttyInput.setRawMode?.(true);
-    });
+  if (id === "key") {
+    answers.keyPath = await askKeyPath(prompter, answers.keyPath);
+    return;
   }
-  // ── line mode ──────────────────────────────────────────────────────────
-  readLine() {
-    const queued = this.pendingLines.shift();
-    if (queued != null) {
-      return Promise.resolve(queued);
-    }
-    if (this.inputEnded == true) {
-      return Promise.resolve(null);
-    }
-    return new Promise((resolve) => {
-      this.lineWaiter = resolve;
-    });
+  if (id === "passphrase") {
+    answers.passphrase = await askOptionalSecret(prompter, "Key passphrase", answers.passphrase);
+    return;
   }
-  onData(chunk) {
-    if (this.keyHandler != null) {
-      for (const key of splitKeys(chunk)) {
-        if (this.keyHandler == null) {
-          break;
-        }
-        this.keyHandler(key);
-      }
-      return;
-    }
-    this.lineBuffer += chunk;
-    let newlineIndex = this.lineBuffer.indexOf("\n");
-    while (newlineIndex >= 0) {
-      const line = this.lineBuffer.slice(0, newlineIndex).replace(/\r$/, "");
-      this.lineBuffer = this.lineBuffer.slice(newlineIndex + 1);
-      if (this.lineWaiter != null) {
-        const waiter = this.lineWaiter;
-        this.lineWaiter = null;
-        waiter(line);
-      } else {
-        this.pendingLines.push(line);
-      }
-      newlineIndex = this.lineBuffer.indexOf("\n");
-    }
+  if (id === "password") {
+    answers.password = await askOptionalSecret(prompter, "Password", answers.password);
+    return;
   }
-  async selectWithLines(question, items, startIndex) {
-    const choices = items.filter((item) => "value" in item);
-    const labelWidths = groupLabelWidths(items);
-    this.output.write(`${this.symbols.question} ${question}
-`);
-    let number = 0;
-    for (let index = 0; index < items.length; index += 1) {
-      const item = items[index];
-      if ("value" in item == false) {
-        this.output.write("\n");
-        continue;
-      }
-      number += 1;
-      let line = `  ${String(number).padStart(2)}) ${padToWidth(item.label, labelWidths[index])}`;
-      if (item.hint != null && item.hint !== "") {
-        line += `  ${item.hint}`;
-      }
-      this.output.write(`${line.trimEnd()}
-`);
+  if (id === "route") {
+    state.route = await prompter.select(
+      "Route",
+      [
+        { value: "direct", label: ROUTE_LABELS.direct },
+        { value: "jump", label: ROUTE_LABELS.jump, hint: "ssh -J" },
+        { value: "proxy", label: ROUTE_LABELS.proxy, hint: "e.g. cloudflared access ssh" },
+        { value: "jump-proxy", label: ROUTE_LABELS["jump-proxy"], hint: "cloudflared to the bastion, then on to the host" }
+      ],
+      { defaultValue: state.route }
+    );
+    if (routeUsesJump(state.route) == true && answers.jumpHost == null) {
+      answers.jumpHost = await prompter.askRequired("Jump host");
     }
-    const defaultChoice = items[startIndex];
-    const defaultNumber = choices.indexOf(defaultChoice) + 1;
-    for (; ; ) {
-      this.output.write(`Choice (${defaultNumber}): `);
-      const line = await this.readLine();
-      if (line == null) {
-        throw new PromptClosedError();
-      }
-      const answer = line.trim();
-      if (answer === "") {
-        return defaultChoice.value;
-      }
-      const index = Number(answer);
-      if (Number.isInteger(index) == true && index >= 1 && index <= choices.length) {
-        return choices[index - 1].value;
-      }
-      const lowered = answer.toLowerCase();
-      const matched = choices.find((choice) => {
-        const key = choice.key ?? choice.value;
-        return key.toLowerCase() === lowered || choice.label.toLowerCase() === lowered;
-      });
-      if (matched != null) {
-        return matched.value;
-      }
-      this.output.write(`  Pick a number from 1 to ${choices.length}.
-`);
+    if (routeUsesProxy(state.route) == true && answers.proxyCommand == null) {
+      answers.proxyCommand = await prompter.askRequired("Proxy command", "cloudflared access ssh --hostname %h");
     }
+    return;
+  }
+  if (id === "jump-host") {
+    answers.jumpHost = await prompter.askRequired("Jump host", answers.jumpHost);
+    return;
+  }
+  if (id === "jump-port") {
+    answers.jumpPort = await askPort(prompter, "Jump host port", answers.jumpPort ?? DEFAULT_SSH_PORT);
+    return;
+  }
+  if (id === "jump-user") {
+    answers.jumpUser = await askOptional(prompter, "Jump host user (empty = same as the login user)", answers.jumpUser);
+    return;
+  }
+  if (id === "proxy") {
+    output.write(prompter.paint.dim("  %h / %p / %r expand to the first hop's host, port and user.\n"));
+    answers.proxyCommand = await prompter.askRequired("Proxy command", answers.proxyCommand ?? "cloudflared access ssh --hostname %h");
+    return;
+  }
+  if (id === "description") {
+    answers.description = await askOptional(prompter, "Description shown to the agent", answers.description);
+    return;
+  }
+  if (id === "readonly") {
+    answers.readonly = answers.readonly == false;
+    return;
   }
-  // ── TTY rendering ──────────────────────────────────────────────────────
-  columns() {
-    const columns = this.output.columns;
-    if (columns == null || columns < 20) {
-      return 80;
+  if (id === "paths") {
+    let current;
+    if (answers.allowedPaths.length > 0) {
+      current = answers.allowedPaths.join(",");
     }
-    return columns;
-  }
-  /** Joins styled parts, cutting the text (not the styles) once `width` columns are used. */
-  fitLine(parts, width) {
-    let used = 0;
-    let line = "";
-    for (const part of parts) {
-      let text = "";
-      for (const character of part.text) {
-        const characterWidth = charWidth(character.codePointAt(0) ?? 0);
-        if (used + characterWidth > width) {
-          break;
-        }
-        used += characterWidth;
-        text += character;
-      }
-      if (part.paint != null) {
-        line += part.paint(text);
-      } else {
-        line += text;
-      }
-      if (used >= width) {
-        break;
-      }
+    const typed = await askOptional(prompter, "Limit file tools to path prefixes (comma-separated, empty = anywhere)", current);
+    answers.allowedPaths = [];
+    if (typed != null) {
+      answers.allowedPaths = typed.split(",").map((item) => item.trim()).filter((item) => item !== "");
     }
-    return line;
+    return;
   }
-  /** The one-line record an answered prompt leaves behind on a TTY. */
-  writeAnswered(question, answer) {
-    if (this.transient == true) {
-      return;
+  const isJump = id === "jump-host-key";
+  let pinned = answers.hostKeyFingerprint;
+  if (isJump == true) {
+    pinned = answers.jumpHostKeyFingerprint;
+  }
+  if (pinned != null) {
+    const unpin = await prompter.askYesNo(`Unpin ${pinned}?`, false);
+    if (unpin == true && isJump == true) {
+      answers.jumpHostKeyFingerprint = void 0;
+    } else if (unpin == true) {
+      answers.hostKeyFingerprint = void 0;
     }
-    this.output.write(`${this.style.success(this.symbols.tick)} ${question} ${this.style.dim("\xB7")} ${this.style.accent(answer)}
+    return;
+  }
+  const missing = missingFields(state);
+  if (missing.length > 0) {
+    output.write(`  Fill in ${missing.map((field) => FIELD_NAMES[field]).join(", ")} first \u2014 the key is pinned by testing the connection.
 `);
+    return;
   }
-  /**
-   * Replaces a cooked-mode prompt and its echoed answer with the one-line record. The
-   * rows are worked out from the widths, since a long answer wraps.
-   */
-  collapseAnswered(prompt, typed, question, answer) {
-    if (this.interactive == false) {
-      return;
-    }
-    const plainPrompt = prompt.replace(/\u001b\[[0-9;]*m/g, "");
-    const used = displayWidth(plainPrompt) + displayWidth(typed);
-    const rows = Math.max(1, Math.ceil(used / this.columns()));
-    this.output.write(`${ESC}[${rows}A\r${ESC}[J`);
-    let shown = answer;
-    if (shown === "") {
-      shown = this.style.dim("(empty)");
+  await testConnection(prompter, output, state);
+}
+async function runHostForm(prompter, output, options) {
+  const { existing, takenNames, destination } = options;
+  let state;
+  if (existing != null) {
+    let route = "direct";
+    if (existing.jumpHost != null && existing.proxyCommand != null) {
+      route = "jump-proxy";
+    } else if (existing.jumpHost != null) {
+      route = "jump";
+    } else if (existing.proxyCommand != null) {
+      route = "proxy";
     }
-    this.writeAnswered(question, shown);
-  }
-  selectWithKeys(question, items, startIndex, cancelValue) {
-    const ttyInput = this.input;
-    const selectableIndexes = items.flatMap((item, index) => {
-      if ("value" in item) {
-        return [index];
-      }
-      return [];
-    });
-    const labelWidths = groupLabelWidths(items);
-    const ruleWidth = Math.min(Math.max(...labelWidths), 24);
-    let active = startIndex;
-    let renderedLines = 0;
-    const draw = (lines) => {
-      let text = "";
-      if (renderedLines > 1) {
-        text += `${ESC}[${renderedLines - 1}A`;
-      }
-      text += `\r${ESC}[J${lines.join("\n")}`;
-      this.output.write(text);
-      renderedLines = lines.length;
-    };
-    const buildLines = () => {
-      const width = this.columns() - 1;
-      const lines = [
-        this.fitLine([
-          { text: this.symbols.question, paint: this.style.accent },
-          { text: " " },
-          { text: question, paint: this.style.bold }
-        ], width)
-      ];
-      for (let index = 0; index < items.length; index += 1) {
-        const item = items[index];
-        if ("value" in item == false) {
-          lines.push(this.fitLine([{ text: `  ${this.symbols.rule.repeat(ruleWidth)}`, paint: this.style.dim }], width));
-          continue;
-        }
-        const isActive = index === active;
-        const parts = [];
-        if (isActive == true) {
-          parts.push({ text: `${this.symbols.pointer} `, paint: this.style.accent });
-          parts.push({ text: padToWidth(item.label, labelWidths[index]), paint: this.style.accent });
-        } else {
-          parts.push({ text: "  " });
-          parts.push({ text: padToWidth(item.label, labelWidths[index]) });
-        }
-        if (item.hint != null && item.hint !== "") {
-          parts.push({ text: `  ${item.hint}`, paint: this.style.dim });
-        }
-        lines.push(this.fitLine(parts, width));
-      }
-      let footer = "\u2191\u2193 move \xB7 enter select";
-      if (cancelValue != null) {
-        footer += " \xB7 esc back";
-      }
-      lines.push(this.fitLine([{ text: footer, paint: this.style.dim }], width));
-      return lines;
-    };
-    const move = (step) => {
-      const position = selectableIndexes.indexOf(active);
-      const next = (position + step + selectableIndexes.length) % selectableIndexes.length;
-      active = selectableIndexes[next];
+    state = { answers: { ...existing }, route, nameTouched: true, lastTest: "never", testedSnapshot: null };
+  } else {
+    const foundKeys = findPrivateKeys();
+    state = {
+      answers: {
+        name: "",
+        host: "",
+        port: DEFAULT_SSH_PORT,
+        username: "",
+        auth: "key",
+        keyPath: foundKeys[0]?.path,
+        readonly: false,
+        allowedPaths: [],
+        extraEnv: {}
+      },
+      route: "direct",
+      nameTouched: false,
+      lastTest: "never",
+      testedSnapshot: null
     };
-    return new Promise((resolve, reject) => {
-      const finish = () => {
-        this.keyHandler = null;
-        ttyInput.setRawMode?.(false);
-        draw([]);
-        this.output.write(`${ESC}[?25h`);
-      };
-      this.keyHandler = (key) => {
-        if (key === KEY_CTRL_C || key === KEY_CTRL_D) {
-          finish();
-          reject(new PromptClosedError());
-          return;
+  }
+  const initialSnapshot = snapshotOf(state);
+  const originalName = existing?.name;
+  let title = "New host";
+  if (existing != null) {
+    title = `Editing ${existing.name}`;
+  }
+  output.write(prompter.paint.dim(`
+  Pick a setting to change it. In a text field, Enter keeps the value shown and ${CLEAR_ANSWER} clears it.
+
+`));
+  const previousTransient = prompter.transient;
+  prompter.transient = true;
+  try {
+    let cursor = "host";
+    for (; ; ) {
+      const picked = await prompter.select(title, buildRows(state, destination), { defaultValue: cursor, cancelValue: "cancel" });
+      const before = cloneState(state);
+      try {
+        if (picked === "cancel") {
+          if (snapshotOf(state) !== initialSnapshot) {
+            const discard = await prompter.askYesNo("Discard the changes?", false);
+            if (discard == false) {
+              continue;
+            }
+          }
+          return null;
         }
-        if (KEY_ENTER.includes(key) == true) {
-          const picked = items[active];
-          finish();
-          this.writeAnswered(question, picked.label);
-          resolve(picked.value);
-          return;
+        const missing = missingFields(state);
+        if (picked === "test") {
+          if (missing.length > 0) {
+            output.write(`  Fill in ${missing.map((field) => FIELD_NAMES[field]).join(", ")} first.
+`);
+            cursor = missing[0];
+            continue;
+          }
+          const connected = await testConnection(prompter, output, state);
+          cursor = "test";
+          if (connected == true) {
+            cursor = "save";
+          }
+          continue;
         }
-        if (key === ESC) {
-          if (cancelValue == null) {
-            return;
+        if (picked === "save") {
+          if (missing.length > 0) {
+            output.write(`  Fill in ${missing.map((field) => FIELD_NAMES[field]).join(", ")} first.
+`);
+            cursor = missing[0];
+            continue;
           }
-          finish();
-          resolve(cancelValue);
-          return;
+          const name = state.answers.name;
+          if (name !== originalName && takenNames.includes(name) == true) {
+            const replace = await prompter.askYesNo(`"${name}" already exists in this file. Replace it?`, false);
+            if (replace == false) {
+              cursor = "name";
+              continue;
+            }
+          }
+          if (snapshotOf(state) !== state.testedSnapshot) {
+            const testFirst = await prompter.askYesNo("Test the connection before saving?", true);
+            if (testFirst == true) {
+              const connected = await testConnection(prompter, output, state);
+              if (connected == false) {
+                const next = await prompter.select(
+                  "The check failed. What now?",
+                  [
+                    { value: "back", key: "back", label: "Back to the settings" },
+                    { value: "save", key: "save", label: "Save anyway", hint: "the host may be unreachable from here" },
+                    { value: "discard", key: "discard", label: "Discard", hint: "nothing is written" }
+                  ],
+                  { defaultValue: "back", cancelValue: "back" }
+                );
+                if (next === "discard") {
+                  return null;
+                }
+                if (next === "back") {
+                  cursor = "test";
+                  continue;
+                }
+              }
+            }
+          }
+          return finalizeAnswers(state);
         }
-        if (KEY_UP.includes(key) == true) {
-          move(-1);
-        } else if (KEY_DOWN.includes(key) == true) {
-          move(1);
-        } else if (KEY_HOME.includes(key) == true) {
-          active = selectableIndexes[0];
-        } else if (KEY_END.includes(key) == true) {
-          active = selectableIndexes[selectableIndexes.length - 1];
-        } else if (/^[1-9]$/.test(key) == true && Number(key) <= selectableIndexes.length) {
-          active = selectableIndexes[Number(key) - 1];
-        } else {
-          return;
+        await editField(prompter, output, state, picked);
+        cursor = nextCursor(state, destination, picked);
+      } catch (ex) {
+        if (ex instanceof PromptBackError == false) {
+          throw ex;
         }
-        draw(buildLines());
-      };
-      ttyInput.setRawMode?.(true);
-      this.output.write(`${ESC}[?25l`);
-      draw(buildLines());
-    });
+        restoreState(state, before);
+        cursor = picked;
+      }
+    }
+  } finally {
+    prompter.transient = previousTransient;
   }
-};
+}
 function toMcpServerEntry(value) {
   if (typeof value !== "object" || value == null) {
     return null;
@@ -4568,7 +4666,7 @@ async function addOrEditHost(prompter, output, target, entries, existingName) {
   if (existingName != null) {
     existing = entryToAnswers(existingName, entries[existingName]);
   }
-  const answers = await runHostForm(prompter, output, {
+  let answers = await runHostForm(prompter, output, {
     existing,
     takenNames: Object.keys(entries),
     destination: target.label
@@ -4577,18 +4675,40 @@ async function addOrEditHost(prompter, output, target, entries, existingName) {
     output.write("  Cancelled \u2014 nothing was written.\n\n");
     return;
   }
-  const entry = answersToEntry(answers);
-  output.write(`
+  let entry = answersToEntry(answers);
+  for (; ; ) {
+    output.write(`
   ${prompter.paint.dim(`This goes into ${target.location}:`)}
 
 `);
-  output.write(`${indent(formatForTarget(target, answers.name, maskSecrets(entry)))}
+    output.write(`${indent(formatForTarget(target, answers.name, maskSecrets(entry)))}
 
 `);
-  const confirmed = await prompter.askYesNo("Write it?", true);
-  if (confirmed == false) {
-    output.write("  Not written. Pick the host and choose Print to get the entry ready to paste.\n\n");
-    return;
+    let confirmed;
+    try {
+      confirmed = await prompter.askYesNo("Write it?", true);
+    } catch (ex) {
+      if (ex instanceof PromptBackError == false) {
+        throw ex;
+      }
+      const revised = await runHostForm(prompter, output, {
+        existing: answers,
+        takenNames: Object.keys(entries),
+        destination: target.label
+      });
+      if (revised == null) {
+        output.write("  Cancelled \u2014 nothing was written.\n\n");
+        return;
+      }
+      answers = revised;
+      entry = answersToEntry(answers);
+      continue;
+    }
+    if (confirmed == false) {
+      output.write("  Not written. Pick the host and choose Print to get the entry ready to paste.\n\n");
+      return;
+    }
+    break;
   }
   const written = target.writeEntry(answers.name, entry);
   reportWrite(prompter, written, "Written");
@@ -4705,7 +4825,7 @@ async function manageHost(prompter, output, target, entries, name) {
     }
   }
 }
-async function runConfigCommand(options) {
+async function runSetupCommand(options) {
   const { input, output } = options;
   const targets = options.targets ?? listConfigTargets();
   let target = targets[0];
@@ -4805,6 +4925,9 @@ ${paint.bold(target.label)}  ${paint.dim(target.location)}
         if (ex instanceof PromptClosedError) {
           throw ex;
         }
+        if (ex instanceof PromptBackError) {
+          continue;
+        }
         output.write(`  Failed: ${errorMessage(ex)}
 
 `);
@@ -5512,11 +5635,12 @@ function createSshMcpServer() {
 }
 
 // src/cli.ts
+var SETUP_COMMAND_NAMES = ["setup", "config"];
 function parseArguments(argv) {
-  const parsed = { showHelp: false, showVersion: false, checkOnly: false, configMode: false };
+  const parsed = { showHelp: false, showVersion: false, checkOnly: false, setupMode: false };
   let rest = argv;
-  if (argv[0] === "config") {
-    parsed.configMode = true;
+  if (argv[0] != null && SETUP_COMMAND_NAMES.includes(argv[0]) == true) {
+    parsed.setupMode = true;
     rest = argv.slice(1);
   }
   for (let index = 0; index < rest.length; index += 1) {
@@ -5550,17 +5674,17 @@ var HELP_TEXT = [
   "",
   "Usage:",
   "  akms-mcp-ssh [--check]",
-  "  akms-mcp-ssh config [--target <client>]",
+  "  akms-mcp-ssh setup [--target <client>]",
   "",
   "Commands:",
-  "  config               Manage the SSH hosts registered in an MCP client's config \u2014",
+  "  setup                Manage the SSH hosts registered in an MCP client's config \u2014",
   "                       list, add, edit, remove, check, print. Asks plain questions,",
   "                       so the SSH_* names below never have to be typed.",
   "",
   "Options:",
   "      --check          Connect to the configured host, report the result, and exit.",
   "                       Prints the host key fingerprint so it can be pinned.",
-  "      --target <id>    config: claude-code | codex | claude-desktop | cursor",
+  "      --target <id>    setup: claude-code | codex | claude-desktop | cursor",
   "                       (default: the first one installed)",
   "  -v, --version        Print the version and exit",
   "  -h, --help           Print this help and exit",
@@ -5594,7 +5718,7 @@ var HELP_TEXT = [
 ].join("\n");
 async function runCheckCommand(profile) {
   if (profile == null) {
-    process.stdout.write(`No SSH host is registered \u2014 set ${SINGLE_HOST_ENV.HOST} and ${SINGLE_HOST_ENV.USER}, or run: akms-mcp-ssh config
+    process.stdout.write(`No SSH host is registered \u2014 set ${SINGLE_HOST_ENV.HOST} and ${SINGLE_HOST_ENV.USER}, or run: akms-mcp-ssh setup
 `);
     return 1;
   }
@@ -5617,11 +5741,11 @@ async function main() {
 `);
     return;
   }
-  if (cliArguments.configMode == true) {
+  if (cliArguments.setupMode == true) {
     if (process.env[LOG_LEVEL_ENV] == null) {
       process.env[LOG_LEVEL_ENV] = "warn";
     }
-    const exitCode = await runConfigCommand({
+    const exitCode = await runSetupCommand({
       input: process.stdin,
       output: process.stdout,
       targetId: cliArguments.targetId