@akms/mcp-ssh 0.1.6 → 0.1.8

package/lib/cli.js

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import fs6 from 'fs';
+import fs7 from 'fs';
 import os5 from 'os';
 import path from 'path';
 import { spawnSync, spawn } from 'child_process';
-import { createHash } from 'crypto';
+import { randomUUID, createHash } from 'crypto';
 import { Duplex } from 'stream';
 import { StringDecoder } from 'string_decoder';
 import ssh2 from 'ssh2';
-import { setInterval, clearInterval } from 'timers';
+import { setInterval as setInterval$1, clearInterval as clearInterval$1 } from 'timers';
+import { isDeepStrictEqual } from 'util';
+import { parse, TomlError } from 'smol-toml';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { z } from 'zod';
 
@@ -27,7 +29,7 @@ var CWD_MARKER = "__AKMS_SSH_CWD__";
 var MAX_DIRECTORY_ENTRIES = 1e3;
 var SERVER_NAME = "akms-mcp-ssh";
 var PACKAGE_NAME = "@akms/mcp-ssh";
-var SERVER_VERSION = "0.1.6";
+var SERVER_VERSION = "0.1.8";
 
 // src/_defs/command-rules.ts
 var CRITICAL_PATH_PATTERN = new RegExp(
@@ -613,7 +615,7 @@ function findExecutable(name) {
   for (const directory of directories) {
     for (const suffix of suffixes) {
       const candidate = path.join(directory, `${name}${suffix}`);
-      if (fs6.existsSync(candidate) == true && fs6.statSync(candidate).isFile() == true) {
+      if (fs7.existsSync(candidate) == true && fs7.statSync(candidate).isFile() == true) {
         return candidate;
       }
     }
@@ -754,7 +756,7 @@ function loadHostProfile(env = process.env) {
   if (keyPath != null) {
     const expandedKeyPath = expandHomePath(keyPath);
     profile.privateKeyPath = expandedKeyPath;
-    if (fs6.existsSync(expandedKeyPath) == false) {
+    if (fs7.existsSync(expandedKeyPath) == false) {
       _logger.warn(`${SINGLE_HOST_ENV.KEY} does not exist; connections will fail`, {
         private_key_path: expandedKeyPath
       });
@@ -786,7 +788,7 @@ function loadHostProfile(env = process.env) {
     if (jumpKeyPath != null) {
       profile.jump.privateKeyPath = expandHomePath(jumpKeyPath);
       profile.jump.passphrase = readEnv(env, SINGLE_HOST_ENV.JUMP_PASSPHRASE);
-      if (fs6.existsSync(profile.jump.privateKeyPath) == false) {
+      if (fs7.existsSync(profile.jump.privateKeyPath) == false) {
         _logger.warn(`${SINGLE_HOST_ENV.JUMP_KEY} does not exist; connections will fail`, {
           private_key_path: profile.jump.privateKeyPath
         });
@@ -1272,14 +1274,14 @@ function inspectRemotePath(remotePath, policy, access) {
 function toRealPath(inputPath) {
   const _logger = $logger.child({ context: "toRealPath" });
   try {
-    return fs6.realpathSync.native(inputPath);
+    return fs7.realpathSync.native(inputPath);
   } catch (ex) {
     _logger.debug("path does not resolve, falling back to its parent directory", {
       reason: ex instanceof Error ? ex.name : "unknown"
     });
   }
   try {
-    const parentRealPath = fs6.realpathSync.native(path.dirname(inputPath));
+    const parentRealPath = fs7.realpathSync.native(path.dirname(inputPath));
     return path.join(parentRealPath, path.basename(inputPath));
   } catch (ex) {
     _logger.debug("parent directory does not resolve either, comparing lexically", {
@@ -1371,7 +1373,7 @@ function readPrivateKey(label, keyPath) {
     return cached;
   }
   try {
-    const contents = fs6.readFileSync(keyPath);
+    const contents = fs7.readFileSync(keyPath);
     PRIVATE_KEY_CACHE.set(keyPath, contents);
     return contents;
   } catch (ex) {
@@ -1640,7 +1642,7 @@ var SshConnection = class {
    * @throws {Error} If the connection was closed, authentication fails, the host is
    *                 unreachable, the handshake times out, or the carrier cannot be opened.
    */
-  async connect() {
+  async connect(onProgress) {
     if (this.disposed == true) {
       throw new Error(`ssh connection for '${this.profile.name}' has been closed; open a new session`);
     }
@@ -1662,6 +1664,9 @@ var SshConnection = class {
       this.observedFingerprint = fingerprint;
     });
     this.connecting = (async () => {
+      if (this.profile.jump != null || this.profile.proxyCommand != null) {
+        onProgress?.("transport");
+      }
       const transport = await openTransport(this.profile, (fingerprint) => {
         this.observedJumpFingerprint = fingerprint;
       });
@@ -1672,6 +1677,7 @@ var SshConnection = class {
       if (transport != null) {
         connectConfig.sock = transport.sock;
       }
+      onProgress?.("host");
       await new Promise((resolve, reject) => {
         const client = new Client();
         this.pendingClient = client;
@@ -2127,7 +2133,7 @@ var SshSessionManager = class {
     if (this.sweepTimer != null) {
       return;
     }
-    this.sweepTimer = setInterval(() => {
+    this.sweepTimer = setInterval$1(() => {
       const expiredAt = Date.now() - SESSION_IDLE_TIMEOUT_MS;
       for (const session of Array.from(this.sessions.values())) {
         if (session.isBusy == true) {
@@ -2151,7 +2157,7 @@ var SshSessionManager = class {
     if (this.sweepTimer == null) {
       return;
     }
-    clearInterval(this.sweepTimer);
+    clearInterval$1(this.sweepTimer);
     this.sweepTimer = null;
   }
 };
@@ -2322,7 +2328,7 @@ async function writeRemoteFile(connection, args) {
 }
 async function uploadFile(connection, localPath, remotePath) {
   requirePermittedPath(connection, remotePath, "write");
-  const localStats = fs6.statSync(localPath);
+  const localStats = fs7.statSync(localPath);
   if (localStats.isFile() == false) {
     throw new Error(`local path is not a file: ${localPath}`);
   }
@@ -2359,7 +2365,7 @@ async function downloadFile(connection, remotePath, localPath) {
       });
     });
   });
-  const localStats = fs6.statSync(localPath);
+  const localStats = fs7.statSync(localPath);
   const _logger = $logger.child({
     context: "downloadFile",
     profile: connection.profile.name,
@@ -2370,283 +2376,6 @@ async function downloadFile(connection, remotePath, localPath) {
   return localStats.size;
 }
 
-// src/modules/manage/connection-check.ts
-function profileFromEnv(output, env) {
-  try {
-    const profile = loadHostProfile(env);
-    if (profile == null) {
-      output.write("  The entry has no host.\n");
-    }
-    return profile;
-  } catch (ex) {
-    let detail = String(ex);
-    if (ex instanceof Error) {
-      detail = ex.message;
-    }
-    output.write(`  The server would refuse to start with this entry: ${detail}
-`);
-    return null;
-  }
-}
-function describeAuth(profile) {
-  if (profile.privateKeyPath != null) {
-    return `key ${profile.privateKeyPath}`;
-  }
-  if (profile.password != null) {
-    return "password";
-  }
-  return "ssh agent";
-}
-async function runConnectionCheck(profile, output) {
-  const endpoint = `${profile.username}@${profile.host}:${profile.port}`;
-  const auth = describeAuth(profile);
-  output.write(`Checking ${profile.name}  \u2192  ${endpoint}
-`);
-  if (profile.proxyCommand != null) {
-    output.write(`  via proxy command: ${profile.proxyCommand}
-`);
-  }
-  if (profile.jump != null) {
-    output.write(`  via jump host: ${profile.jump.username}@${profile.jump.host}:${profile.jump.port}
-`);
-  }
-  output.write("\n");
-  const connection = new SshConnection(profile);
-  const startedAt = Date.now();
-  let connected = false;
-  let detail = "";
-  try {
-    await connection.connect();
-    connected = true;
-  } catch (ex) {
-    detail = String(ex);
-    if (ex instanceof Error) {
-      detail = ex.message;
-    }
-  } finally {
-    connection.disconnect();
-  }
-  const durationMs = Date.now() - startedAt;
-  if (connected == true) {
-    output.write(`  OK      ${endpoint}  (${auth}, ${durationMs}ms)
-`);
-  } else {
-    output.write(`  FAILED  ${endpoint}  (${auth})
-`);
-    output.write(`          ${detail}
-`);
-  }
-  if (connection.hostKeyFingerprint != null) {
-    let pinNote = `not pinned \u2014 set ${SINGLE_HOST_ENV.HOST_KEY} to it to detect a changed key`;
-    if (profile.hostKeyFingerprint != null) {
-      pinNote = "pinned";
-    }
-    output.write(`          host key ${connection.hostKeyFingerprint}  (${pinNote})
-`);
-  }
-  if (connection.jumpHostKeyFingerprint != null) {
-    let pinNote = `not pinned \u2014 set ${SINGLE_HOST_ENV.JUMP_HOST_KEY} to it to detect a changed key`;
-    if (profile.jump?.hostKeyFingerprint != null) {
-      pinNote = "pinned";
-    }
-    output.write(`          jump host key ${connection.jumpHostKeyFingerprint}  (${pinNote})
-`);
-  }
-  return {
-    connected,
-    hostKeyFingerprint: connection.hostKeyFingerprint,
-    jumpHostKeyFingerprint: connection.jumpHostKeyFingerprint
-  };
-}
-
-// src/modules/manage/entry.ts
-var MANAGED_ENV_NAMES = [
-  SINGLE_HOST_ENV.HOST,
-  SINGLE_HOST_ENV.PORT,
-  SINGLE_HOST_ENV.USER,
-  SINGLE_HOST_ENV.KEY,
-  SINGLE_HOST_ENV.PASSPHRASE,
-  SINGLE_HOST_ENV.PASSWORD,
-  SINGLE_HOST_ENV.DESCRIPTION,
-  SINGLE_HOST_ENV.JUMP_HOST,
-  SINGLE_HOST_ENV.JUMP_PORT,
-  SINGLE_HOST_ENV.JUMP_USER,
-  SINGLE_HOST_ENV.PROXY_COMMAND,
-  SINGLE_HOST_ENV.READONLY,
-  SINGLE_HOST_ENV.ALLOWED_PATHS,
-  SINGLE_HOST_ENV.HOST_KEY,
-  SINGLE_HOST_ENV.JUMP_HOST_KEY
-];
-var JUMP_ENV_PREFIX = "SSH_JUMP_";
-var SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]{1,48}$/;
-function isOurEntry(entry) {
-  if (entry.args.includes(PACKAGE_NAME) == true) {
-    return true;
-  }
-  const commandBase = entry.command.replace(/\\/g, "/").split("/").pop() ?? "";
-  return commandBase === SERVER_NAME || commandBase.startsWith(`${SERVER_NAME}.`) == true;
-}
-function launchCommand() {
-  if (process.platform === "win32") {
-    return { command: "cmd", args: ["/c", "npx", "-y", PACKAGE_NAME] };
-  }
-  return { command: "npx", args: ["-y", PACKAGE_NAME] };
-}
-function answersToEntry(answers) {
-  const env = {};
-  env[SINGLE_HOST_ENV.HOST] = answers.host;
-  if (answers.port !== DEFAULT_SSH_PORT) {
-    env[SINGLE_HOST_ENV.PORT] = String(answers.port);
-  }
-  env[SINGLE_HOST_ENV.USER] = answers.username;
-  if (answers.auth === "key" && answers.keyPath != null) {
-    env[SINGLE_HOST_ENV.KEY] = answers.keyPath;
-    if (answers.passphrase != null && answers.passphrase !== "") {
-      env[SINGLE_HOST_ENV.PASSPHRASE] = answers.passphrase;
-    }
-  }
-  if (answers.auth === "password" && answers.password != null) {
-    env[SINGLE_HOST_ENV.PASSWORD] = answers.password;
-  }
-  if (answers.hostKeyFingerprint != null) {
-    env[SINGLE_HOST_ENV.HOST_KEY] = answers.hostKeyFingerprint;
-  }
-  if (answers.description != null && answers.description !== "") {
-    env[SINGLE_HOST_ENV.DESCRIPTION] = answers.description;
-  }
-  if (answers.jumpHost != null) {
-    env[SINGLE_HOST_ENV.JUMP_HOST] = answers.jumpHost;
-    if (answers.jumpPort != null && answers.jumpPort !== DEFAULT_SSH_PORT) {
-      env[SINGLE_HOST_ENV.JUMP_PORT] = String(answers.jumpPort);
-    }
-    if (answers.jumpUser != null && answers.jumpUser !== answers.username) {
-      env[SINGLE_HOST_ENV.JUMP_USER] = answers.jumpUser;
-    }
-    if (answers.jumpHostKeyFingerprint != null) {
-      env[SINGLE_HOST_ENV.JUMP_HOST_KEY] = answers.jumpHostKeyFingerprint;
-    }
-  }
-  if (answers.proxyCommand != null && answers.proxyCommand !== "") {
-    env[SINGLE_HOST_ENV.PROXY_COMMAND] = answers.proxyCommand;
-  }
-  if (answers.readonly == true) {
-    env[SINGLE_HOST_ENV.READONLY] = "true";
-  }
-  if (answers.allowedPaths.length > 0) {
-    env[SINGLE_HOST_ENV.ALLOWED_PATHS] = answers.allowedPaths.join(",");
-  }
-  for (const [name, value] of Object.entries(answers.extraEnv)) {
-    if (MANAGED_ENV_NAMES.includes(name) == true) {
-      continue;
-    }
-    if (answers.jumpHost == null && name.startsWith(JUMP_ENV_PREFIX) == true) {
-      continue;
-    }
-    env[name] = value;
-  }
-  const launch = launchCommand();
-  return {
-    command: launch.command,
-    args: launch.args,
-    env
-  };
-}
-function readPort(value) {
-  if (value == null) {
-    return DEFAULT_SSH_PORT;
-  }
-  const parsed = Number(value);
-  if (Number.isInteger(parsed) == false || parsed <= 0) {
-    return DEFAULT_SSH_PORT;
-  }
-  return parsed;
-}
-function isTruthy(value) {
-  if (value == null) {
-    return false;
-  }
-  return TRUTHY_ENV_VALUES.includes(value.trim().toLowerCase());
-}
-function entryToAnswers(name, entry) {
-  const env = entry.env;
-  const host = env[SINGLE_HOST_ENV.HOST] ?? "";
-  const username = env[SINGLE_HOST_ENV.USER] ?? "";
-  let auth = "agent";
-  if (env[SINGLE_HOST_ENV.KEY] != null) {
-    auth = "key";
-  } else if (env[SINGLE_HOST_ENV.PASSWORD] != null) {
-    auth = "password";
-  }
-  let allowedPaths = [];
-  const allowedPathsValue = env[SINGLE_HOST_ENV.ALLOWED_PATHS];
-  if (allowedPathsValue != null) {
-    allowedPaths = allowedPathsValue.split(",").map((item) => item.trim()).filter((item) => item !== "");
-  }
-  const extraEnv = {};
-  for (const [variable, value] of Object.entries(env)) {
-    if (MANAGED_ENV_NAMES.includes(variable) == false) {
-      extraEnv[variable] = value;
-    }
-  }
-  const answers = {
-    name,
-    host,
-    port: readPort(env[SINGLE_HOST_ENV.PORT]),
-    username,
-    auth,
-    keyPath: env[SINGLE_HOST_ENV.KEY],
-    passphrase: env[SINGLE_HOST_ENV.PASSPHRASE],
-    password: env[SINGLE_HOST_ENV.PASSWORD],
-    description: env[SINGLE_HOST_ENV.DESCRIPTION],
-    proxyCommand: env[SINGLE_HOST_ENV.PROXY_COMMAND],
-    readonly: isTruthy(env[SINGLE_HOST_ENV.READONLY]),
-    allowedPaths,
-    hostKeyFingerprint: env[SINGLE_HOST_ENV.HOST_KEY],
-    extraEnv
-  };
-  const jumpHost = env[SINGLE_HOST_ENV.JUMP_HOST];
-  if (jumpHost != null) {
-    answers.jumpHost = jumpHost;
-    answers.jumpPort = readPort(env[SINGLE_HOST_ENV.JUMP_PORT]);
-    answers.jumpUser = env[SINGLE_HOST_ENV.JUMP_USER] ?? username;
-    answers.jumpHostKeyFingerprint = env[SINGLE_HOST_ENV.JUMP_HOST_KEY];
-  }
-  return answers;
-}
-function summarizeEntry(entry) {
-  const env = entry.env;
-  const host = env[SINGLE_HOST_ENV.HOST] ?? "?";
-  const port = env[SINGLE_HOST_ENV.PORT] ?? String(DEFAULT_SSH_PORT);
-  const username = env[SINGLE_HOST_ENV.USER] ?? "?";
-  let auth = "agent";
-  if (env[SINGLE_HOST_ENV.KEY] != null) {
-    auth = "key";
-  } else if (env[SINGLE_HOST_ENV.PASSWORD] != null) {
-    auth = "password";
-  }
-  const notes = [];
-  if (env[SINGLE_HOST_ENV.JUMP_HOST] != null) {
-    notes.push(`jump ${env[SINGLE_HOST_ENV.JUMP_HOST]}`);
-  }
-  if (env[SINGLE_HOST_ENV.PROXY_COMMAND] != null) {
-    notes.push("proxy");
-  }
-  if (isTruthy(env[SINGLE_HOST_ENV.READONLY]) == true) {
-    notes.push("readonly");
-  }
-  if (env[SINGLE_HOST_ENV.ALLOWED_PATHS] != null) {
-    notes.push(`paths ${env[SINGLE_HOST_ENV.ALLOWED_PATHS]}`);
-  }
-  if (env[SINGLE_HOST_ENV.HOST_KEY] != null) {
-    notes.push("pinned");
-  }
-  return {
-    endpoint: `${username}@${host}:${port}`,
-    auth,
-    notes: notes.join(", ")
-  };
-}
-
 // src/modules/manage/prompter.ts
 var PromptClosedError = class extends Error {
   constructor() {
@@ -2823,6 +2552,17 @@ var Prompter = class {
   get paint() {
     return this.style;
   }
+  /** Keeps a report visible until Enter on a TTY; Esc goes back. Pipes need no extra answer. */
+  async pause() {
+    if (this.interactive == false) {
+      return;
+    }
+    if (this.inputEnded == true) {
+      throw new PromptClosedError();
+    }
+    const prompt = this.fitLine([{ text: "Press Enter to continue", paint: this.style.dim }], this.columns() - 1);
+    await this.readText(prompt, false);
+  }
   /**
    * Free-text prompt. Enter accepts `defaultValue` when one is shown.
    *
@@ -3268,9 +3008,435 @@ var Prompter = class {
       draw(buildLines());
     });
   }
-};
-
-// src/modules/manage/host-form.ts
+};
+
+// src/modules/manage/check-progress.ts
+var ESC2 = "\x1B";
+var CheckProgress = class {
+  constructor(output) {
+    this.output = output;
+    this.unicode = supportsUnicode();
+    this.frames = this.unicode ? ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"] : ["-", "\\", "|", "/"];
+    this.timer = null;
+    this.label = null;
+    this.startedAt = 0;
+    this.frame = 0;
+    this.enabled = output.isTTY === true && process.env.TERM !== "dumb";
+    this.color = process.env.NO_COLOR == null;
+  }
+  /** Advancing means the preceding phase actually completed successfully. */
+  start(label) {
+    if (this.enabled == false) {
+      return;
+    }
+    this.finish(true);
+    this.label = label;
+    this.startedAt = Date.now();
+    this.frame = 0;
+    this.draw(this.frames[0], 36);
+    this.timer = setInterval(() => {
+      this.frame = (this.frame + 1) % this.frames.length;
+      this.draw(this.frames[this.frame], 36);
+    }, 80);
+    this.timer.unref();
+  }
+  /** Leaves the completed phase and its duration visible. */
+  finish(ok) {
+    if (this.label == null) {
+      return;
+    }
+    this.clearTimer();
+    const symbol = ok ? this.unicode ? "\u2714" : "OK" : this.unicode ? "\u2716" : "X";
+    this.draw(symbol, ok ? 32 : 31);
+    this.output.write("\n");
+    this.label = null;
+  }
+  /** Clears an unfinished phase without recording a result. */
+  stop() {
+    this.clearTimer();
+    if (this.label != null) {
+      this.output.write(`\r${ESC2}[2K`);
+      this.label = null;
+    }
+  }
+  clearTimer() {
+    if (this.timer != null) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
+  draw(symbol, color) {
+    const columns = this.output.columns;
+    const width = Math.max(0, (columns != null && columns > 0 ? columns : 80) - 1);
+    const elapsed = `  ${((Date.now() - this.startedAt) / 1e3).toFixed(1)}s`;
+    const prefix = `  ${symbol} `;
+    const labelWidth = Math.min(48, Math.max(0, width - displayWidth(prefix) - displayWidth(elapsed)));
+    const label = this.fit(this.label ?? "", labelWidth);
+    const line = this.fit(`${prefix}${label}${" ".repeat(labelWidth - displayWidth(label))}${elapsed}`, width);
+    const painted = this.color ? `${ESC2}[${color}m${line}${ESC2}[39m` : line;
+    this.output.write(`\r${ESC2}[2K${painted}`);
+  }
+  fit(text, width) {
+    if (displayWidth(text) <= width) {
+      return text;
+    }
+    if (width < 1) {
+      return "";
+    }
+    let result = "";
+    let used = 0;
+    for (const character of text) {
+      const size = displayWidth(character);
+      if (used + size > width - 1) {
+        break;
+      }
+      result += character;
+      used += size;
+    }
+    return `${result}${this.unicode ? "\u2026" : "~"}`;
+  }
+};
+
+// src/modules/manage/connection-check.ts
+function profileFromEnv(output, env) {
+  try {
+    const profile = loadHostProfile(env);
+    if (profile == null) {
+      output.write("  The entry has no host.\n");
+    }
+    return profile;
+  } catch (ex) {
+    let detail = String(ex);
+    if (ex instanceof Error) {
+      detail = ex.message;
+    }
+    output.write(`  The server would refuse to start with this entry: ${detail}
+`);
+    return null;
+  }
+}
+function describeAuth(profile) {
+  if (profile.privateKeyPath != null) {
+    return `key ${profile.privateKeyPath}`;
+  }
+  if (profile.password != null) {
+    return "password";
+  }
+  return "ssh agent";
+}
+async function runConnectionCheck(profile, output) {
+  const endpoint = `${profile.username}@${profile.host}:${profile.port}`;
+  const auth = describeAuth(profile);
+  output.write(`Checking ${profile.name}  \u2192  ${endpoint}
+`);
+  if (profile.proxyCommand != null) {
+    output.write(`  via proxy command: ${profile.proxyCommand}
+`);
+  }
+  if (profile.jump != null) {
+    output.write(`  via jump host: ${profile.jump.username}@${profile.jump.host}:${profile.jump.port}
+`);
+  }
+  output.write("\n");
+  const connection = new SshConnection(profile);
+  const progress = new CheckProgress(output);
+  const startedAt = Date.now();
+  let connected = false;
+  let detail = "";
+  try {
+    progress.start("Preparing SSH connection");
+    await connection.connect((stage) => {
+      if (stage === "transport") {
+        progress.start(profile.jump != null ? "Jump host connection and forwarding" : "Starting proxy connection");
+      } else {
+        progress.start("SSH handshake and authentication");
+      }
+    });
+    connected = true;
+  } catch (ex) {
+    detail = String(ex);
+    if (ex instanceof Error) {
+      detail = ex.message;
+    }
+  } finally {
+    progress.finish(connected);
+    connection.disconnect();
+  }
+  const durationMs = Date.now() - startedAt;
+  if (connected == true) {
+    output.write(`  OK      ${endpoint}  (${auth}, ${durationMs}ms)
+`);
+  } else {
+    output.write(`  FAILED  ${endpoint}  (${auth})
+`);
+    output.write(`          ${detail}
+`);
+  }
+  if (connection.hostKeyFingerprint != null) {
+    let pinNote = `not pinned \u2014 set ${SINGLE_HOST_ENV.HOST_KEY} to it to detect a changed key`;
+    if (profile.hostKeyFingerprint != null) {
+      pinNote = "pinned";
+    }
+    output.write(`          host key ${connection.hostKeyFingerprint}  (${pinNote})
+`);
+  }
+  if (connection.jumpHostKeyFingerprint != null) {
+    let pinNote = `not pinned \u2014 set ${SINGLE_HOST_ENV.JUMP_HOST_KEY} to it to detect a changed key`;
+    if (profile.jump?.hostKeyFingerprint != null) {
+      pinNote = "pinned";
+    }
+    output.write(`          jump host key ${connection.jumpHostKeyFingerprint}  (${pinNote})
+`);
+  }
+  return {
+    connected,
+    hostKeyFingerprint: connection.hostKeyFingerprint,
+    jumpHostKeyFingerprint: connection.jumpHostKeyFingerprint
+  };
+}
+
+// src/modules/manage/copy-entry.ts
+async function copyEntryToClient(prompter, source, targets, name, entry) {
+  const destinations = targets.filter((target) => target.id !== source.id);
+  if (destinations.length === 0) {
+    return;
+  }
+  for (; ; ) {
+    const items = destinations.map((target) => ({
+      value: target.id,
+      key: target.id,
+      label: target.label,
+      hint: target.detected ? target.location : `${target.location} \xB7 not found on this machine`
+    }));
+    items.push({ separator: true }, { value: "back", key: "b", label: "Back" });
+    const picked = await prompter.select(`Copy ${name} to which client?`, items, { cancelValue: "back" });
+    const destination = destinations.find((target) => target.id === picked);
+    if (destination == null) {
+      return;
+    }
+    const exists = destination.hasEntry?.(name) ?? Object.hasOwn(destination.readEntries(), name);
+    if (exists) {
+      try {
+        const overwrite = await prompter.askYesNo(
+          `${name} already exists in ${destination.label} (${destination.location}). Overwrite it?`,
+          false
+        );
+        if (overwrite == false) {
+          prompter.write("  Not copied; the destination entry was kept.\n\n");
+          return;
+        }
+      } catch (ex) {
+        if (ex instanceof PromptBackError == false) {
+          throw ex;
+        }
+        continue;
+      }
+    }
+    const result = destination.writeEntry(name, {
+      command: entry.command,
+      args: [...entry.args],
+      env: { ...entry.env }
+    }, { replace: true });
+    if (result.status === "written") {
+      prompter.write(`  ${prompter.paint.success(`Copied ${name} to ${destination.label}`)} ${prompter.paint.dim(result.detail)}
+`);
+      prompter.write(prompter.paint.dim("  Restart the destination client (or reconnect it from its MCP menu) to pick up the change.\n\n"));
+    } else {
+      prompter.write(`  Not copied: ${result.detail}
+
+`);
+    }
+    return;
+  }
+}
+
+// src/modules/manage/entry.ts
+var MANAGED_ENV_NAMES = [
+  SINGLE_HOST_ENV.HOST,
+  SINGLE_HOST_ENV.PORT,
+  SINGLE_HOST_ENV.USER,
+  SINGLE_HOST_ENV.KEY,
+  SINGLE_HOST_ENV.PASSPHRASE,
+  SINGLE_HOST_ENV.PASSWORD,
+  SINGLE_HOST_ENV.DESCRIPTION,
+  SINGLE_HOST_ENV.JUMP_HOST,
+  SINGLE_HOST_ENV.JUMP_PORT,
+  SINGLE_HOST_ENV.JUMP_USER,
+  SINGLE_HOST_ENV.PROXY_COMMAND,
+  SINGLE_HOST_ENV.READONLY,
+  SINGLE_HOST_ENV.ALLOWED_PATHS,
+  SINGLE_HOST_ENV.HOST_KEY,
+  SINGLE_HOST_ENV.JUMP_HOST_KEY
+];
+var JUMP_ENV_PREFIX = "SSH_JUMP_";
+var SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]{1,48}$/;
+function isOurEntry(entry) {
+  if (entry.args.includes(PACKAGE_NAME) == true) {
+    return true;
+  }
+  const commandBase = entry.command.replace(/\\/g, "/").split("/").pop() ?? "";
+  return commandBase === SERVER_NAME || commandBase.startsWith(`${SERVER_NAME}.`) == true;
+}
+function launchCommand() {
+  if (process.platform === "win32") {
+    return { command: "cmd", args: ["/c", "npx", "-y", PACKAGE_NAME] };
+  }
+  return { command: "npx", args: ["-y", PACKAGE_NAME] };
+}
+function answersToEntry(answers) {
+  const env = {};
+  env[SINGLE_HOST_ENV.HOST] = answers.host;
+  if (answers.port !== DEFAULT_SSH_PORT) {
+    env[SINGLE_HOST_ENV.PORT] = String(answers.port);
+  }
+  env[SINGLE_HOST_ENV.USER] = answers.username;
+  if (answers.auth === "key" && answers.keyPath != null) {
+    env[SINGLE_HOST_ENV.KEY] = answers.keyPath;
+    if (answers.passphrase != null && answers.passphrase !== "") {
+      env[SINGLE_HOST_ENV.PASSPHRASE] = answers.passphrase;
+    }
+  }
+  if (answers.auth === "password" && answers.password != null) {
+    env[SINGLE_HOST_ENV.PASSWORD] = answers.password;
+  }
+  if (answers.hostKeyFingerprint != null) {
+    env[SINGLE_HOST_ENV.HOST_KEY] = answers.hostKeyFingerprint;
+  }
+  if (answers.description != null && answers.description !== "") {
+    env[SINGLE_HOST_ENV.DESCRIPTION] = answers.description;
+  }
+  if (answers.jumpHost != null) {
+    env[SINGLE_HOST_ENV.JUMP_HOST] = answers.jumpHost;
+    if (answers.jumpPort != null && answers.jumpPort !== DEFAULT_SSH_PORT) {
+      env[SINGLE_HOST_ENV.JUMP_PORT] = String(answers.jumpPort);
+    }
+    if (answers.jumpUser != null && answers.jumpUser !== answers.username) {
+      env[SINGLE_HOST_ENV.JUMP_USER] = answers.jumpUser;
+    }
+    if (answers.jumpHostKeyFingerprint != null) {
+      env[SINGLE_HOST_ENV.JUMP_HOST_KEY] = answers.jumpHostKeyFingerprint;
+    }
+  }
+  if (answers.proxyCommand != null && answers.proxyCommand !== "") {
+    env[SINGLE_HOST_ENV.PROXY_COMMAND] = answers.proxyCommand;
+  }
+  if (answers.readonly == true) {
+    env[SINGLE_HOST_ENV.READONLY] = "true";
+  }
+  if (answers.allowedPaths.length > 0) {
+    env[SINGLE_HOST_ENV.ALLOWED_PATHS] = answers.allowedPaths.join(",");
+  }
+  for (const [name, value] of Object.entries(answers.extraEnv)) {
+    if (MANAGED_ENV_NAMES.includes(name) == true) {
+      continue;
+    }
+    if (answers.jumpHost == null && name.startsWith(JUMP_ENV_PREFIX) == true) {
+      continue;
+    }
+    env[name] = value;
+  }
+  const launch = launchCommand();
+  return {
+    command: launch.command,
+    args: launch.args,
+    env
+  };
+}
+function readPort(value) {
+  if (value == null) {
+    return DEFAULT_SSH_PORT;
+  }
+  const parsed = Number(value);
+  if (Number.isInteger(parsed) == false || parsed <= 0) {
+    return DEFAULT_SSH_PORT;
+  }
+  return parsed;
+}
+function isTruthy(value) {
+  if (value == null) {
+    return false;
+  }
+  return TRUTHY_ENV_VALUES.includes(value.trim().toLowerCase());
+}
+function entryToAnswers(name, entry) {
+  const env = entry.env;
+  const host = env[SINGLE_HOST_ENV.HOST] ?? "";
+  const username = env[SINGLE_HOST_ENV.USER] ?? "";
+  let auth = "agent";
+  if (env[SINGLE_HOST_ENV.KEY] != null) {
+    auth = "key";
+  } else if (env[SINGLE_HOST_ENV.PASSWORD] != null) {
+    auth = "password";
+  }
+  let allowedPaths = [];
+  const allowedPathsValue = env[SINGLE_HOST_ENV.ALLOWED_PATHS];
+  if (allowedPathsValue != null) {
+    allowedPaths = allowedPathsValue.split(",").map((item) => item.trim()).filter((item) => item !== "");
+  }
+  const extraEnv = {};
+  for (const [variable, value] of Object.entries(env)) {
+    if (MANAGED_ENV_NAMES.includes(variable) == false) {
+      extraEnv[variable] = value;
+    }
+  }
+  const answers = {
+    name,
+    host,
+    port: readPort(env[SINGLE_HOST_ENV.PORT]),
+    username,
+    auth,
+    keyPath: env[SINGLE_HOST_ENV.KEY],
+    passphrase: env[SINGLE_HOST_ENV.PASSPHRASE],
+    password: env[SINGLE_HOST_ENV.PASSWORD],
+    description: env[SINGLE_HOST_ENV.DESCRIPTION],
+    proxyCommand: env[SINGLE_HOST_ENV.PROXY_COMMAND],
+    readonly: isTruthy(env[SINGLE_HOST_ENV.READONLY]),
+    allowedPaths,
+    hostKeyFingerprint: env[SINGLE_HOST_ENV.HOST_KEY],
+    extraEnv
+  };
+  const jumpHost = env[SINGLE_HOST_ENV.JUMP_HOST];
+  if (jumpHost != null) {
+    answers.jumpHost = jumpHost;
+    answers.jumpPort = readPort(env[SINGLE_HOST_ENV.JUMP_PORT]);
+    answers.jumpUser = env[SINGLE_HOST_ENV.JUMP_USER] ?? username;
+    answers.jumpHostKeyFingerprint = env[SINGLE_HOST_ENV.JUMP_HOST_KEY];
+  }
+  return answers;
+}
+function summarizeEntry(entry) {
+  const env = entry.env;
+  const host = env[SINGLE_HOST_ENV.HOST] ?? "?";
+  const port = env[SINGLE_HOST_ENV.PORT] ?? String(DEFAULT_SSH_PORT);
+  const username = env[SINGLE_HOST_ENV.USER] ?? "?";
+  let auth = "agent";
+  if (env[SINGLE_HOST_ENV.KEY] != null) {
+    auth = "key";
+  } else if (env[SINGLE_HOST_ENV.PASSWORD] != null) {
+    auth = "password";
+  }
+  const notes = [];
+  if (env[SINGLE_HOST_ENV.JUMP_HOST] != null) {
+    notes.push(`jump ${env[SINGLE_HOST_ENV.JUMP_HOST]}`);
+  }
+  if (env[SINGLE_HOST_ENV.PROXY_COMMAND] != null) {
+    notes.push("proxy");
+  }
+  if (isTruthy(env[SINGLE_HOST_ENV.READONLY]) == true) {
+    notes.push("readonly");
+  }
+  if (env[SINGLE_HOST_ENV.ALLOWED_PATHS] != null) {
+    notes.push(`paths ${env[SINGLE_HOST_ENV.ALLOWED_PATHS]}`);
+  }
+  if (env[SINGLE_HOST_ENV.HOST_KEY] != null) {
+    notes.push("pinned");
+  }
+  return {
+    endpoint: `${username}@${host}:${port}`,
+    auth,
+    notes: notes.join(", ")
+  };
+}
 var PREFERRED_KEY_NAMES = ["id_ed25519", "id_ecdsa", "id_rsa"];
 var NON_KEY_FILE_NAMES = ["config", "known_hosts", "known_hosts.old", "authorized_keys", "environment"];
 var MAX_KEY_FILE_BYTES = 64 * 1024;
@@ -3314,7 +3480,7 @@ function findPrivateKeys() {
   const sshDirectory = path.join(os5.homedir(), ".ssh");
   let names = [];
   try {
-    names = fs6.readdirSync(sshDirectory);
+    names = fs7.readdirSync(sshDirectory);
   } catch {
     return [];
   }
@@ -3326,14 +3492,14 @@ function findPrivateKeys() {
     const fullPath = path.join(sshDirectory, name);
     let head = "";
     try {
-      const stat = fs6.statSync(fullPath);
+      const stat = fs7.statSync(fullPath);
       if (stat.isFile() == false || stat.size > MAX_KEY_FILE_BYTES) {
         continue;
       }
-      const descriptor = fs6.openSync(fullPath, "r");
+      const descriptor = fs7.openSync(fullPath, "r");
       const buffer = Buffer.alloc(64);
-      const bytesRead = fs6.readSync(descriptor, buffer, 0, buffer.length, 0);
-      fs6.closeSync(descriptor);
+      const bytesRead = fs7.readSync(descriptor, buffer, 0, buffer.length, 0);
+      fs7.closeSync(descriptor);
       head = buffer.subarray(0, bytesRead).toString("utf8");
     } catch {
       continue;
@@ -3345,7 +3511,7 @@ function findPrivateKeys() {
     }
     let hint = "";
     try {
-      const publicKey = fs6.readFileSync(`${fullPath}.pub`, "utf8").trim().split(/\s+/);
+      const publicKey = fs7.readFileSync(`${fullPath}.pub`, "utf8").trim().split(/\s+/);
       hint = publicKey[0].replace(/^ssh-/, "");
       if (publicKey.length > 2) {
         hint += ` \xB7 ${publicKey.slice(2).join(" ")}`;
@@ -3414,7 +3580,7 @@ async function askKeyPath(prompter, current) {
   }
   for (; ; ) {
     const typed = await prompter.askRequired("Private key path");
-    if (fs6.existsSync(expandHomePath(typed)) == true) {
+    if (fs7.existsSync(expandHomePath(typed)) == true) {
       return typed;
     }
     prompter.write(`  ${expandHomePath(typed)} does not exist.
@@ -3626,10 +3792,12 @@ async function testConnection(prompter, output, state) {
   if (profile == null) {
     output.write("\n");
     state.lastTest = "failed";
+    await prompter.pause();
     return false;
   }
   const result = await runConnectionCheck(profile, output);
   output.write("\n");
+  await prompter.pause();
   if (result.connected == true) {
     if (result.hostKeyFingerprint != null && state.answers.hostKeyFingerprint == null) {
       const pin = await prompter.askYesNo("Pin this host key? (a changed key then aborts the connection)", true);
@@ -3946,6 +4114,65 @@ async function runHostForm(prompter, output, options) {
     prompter.transient = previousTransient;
   }
 }
+function readExisting(filePath) {
+  try {
+    return fs7.readFileSync(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+function updateConfigFile(filePath, update) {
+  let destination = filePath;
+  let symbolicLink = false;
+  try {
+    symbolicLink = fs7.lstatSync(filePath).isSymbolicLink();
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  if (symbolicLink) {
+    destination = fs7.realpathSync(filePath);
+  }
+  const before = readExisting(destination);
+  const updated = update(before ?? "");
+  if (before != null) {
+    fs7.accessSync(destination, fs7.constants.W_OK);
+  }
+  fs7.mkdirSync(path.dirname(destination), { recursive: true });
+  const temporary = path.join(path.dirname(destination), `.${path.basename(destination)}.${randomUUID()}.tmp`);
+  const mode = before == null ? 384 : fs7.statSync(destination).mode & 511;
+  let descriptor;
+  let ownsTemporary = false;
+  try {
+    descriptor = fs7.openSync(temporary, "wx", mode);
+    ownsTemporary = true;
+    fs7.writeFileSync(descriptor, updated, "utf8");
+    fs7.fsyncSync(descriptor);
+    fs7.closeSync(descriptor);
+    descriptor = void 0;
+    if (readExisting(destination) !== before) {
+      throw new Error("The config changed while saving; reload it and try again.");
+    }
+    fs7.renameSync(temporary, destination);
+    ownsTemporary = false;
+  } finally {
+    try {
+      if (descriptor != null) {
+        fs7.closeSync(descriptor);
+      }
+    } finally {
+      if (ownsTemporary) {
+        fs7.unlinkSync(temporary);
+      }
+    }
+  }
+}
+
+// src/modules/manage/targets/json-file.ts
 function toMcpServerEntry(value) {
   if (typeof value !== "object" || value == null) {
     return null;
@@ -3958,7 +4185,7 @@ function toMcpServerEntry(value) {
   if (Array.isArray(record.args) == true) {
     args = record.args.filter((item) => typeof item === "string");
   }
-  const env = {};
+  const env = /* @__PURE__ */ Object.create(null);
   if (typeof record.env === "object" && record.env != null) {
     for (const [key, item] of Object.entries(record.env)) {
       if (typeof item === "string") {
@@ -3968,16 +4195,22 @@ function toMcpServerEntry(value) {
   }
   return { command: record.command, args, env };
 }
-function readMcpServersJson(document) {
-  if (typeof document !== "object" || document == null || Array.isArray(document) == true) {
+function readRawMcpServersJson(document) {
+  if (typeof document !== "object" || document == null || Array.isArray(document)) {
     throw new Error("the config file is not a JSON object");
   }
-  const entries = {};
   const servers = document.mcpServers;
-  if (typeof servers !== "object" || servers == null) {
-    return entries;
+  if (servers === void 0) {
+    return {};
+  }
+  if (typeof servers !== "object" || servers == null || Array.isArray(servers)) {
+    throw new Error("mcpServers is not a JSON object");
   }
-  for (const [name, value] of Object.entries(servers)) {
+  return servers;
+}
+function readMcpServersJson(document) {
+  const entries = /* @__PURE__ */ Object.create(null);
+  for (const [name, value] of Object.entries(readRawMcpServersJson(document))) {
     const entry = toMcpServerEntry(value);
     if (entry != null) {
       entries[name] = entry;
@@ -3985,11 +4218,11 @@ function readMcpServersJson(document) {
   }
   return entries;
 }
-function readDocument(filePath) {
-  if (fs6.existsSync(filePath) == false) {
+function readDocument(filePath, contents) {
+  if (contents == null && fs7.existsSync(filePath) == false) {
     return {};
   }
-  const text = fs6.readFileSync(filePath, "utf8");
+  const text = contents ?? fs7.readFileSync(filePath, "utf8");
   if (text.trim() === "") {
     return {};
   }
@@ -4010,39 +4243,35 @@ function readDocument(filePath) {
 }
 function createJsonFileTarget(options) {
   const { id, label, filePath } = options;
-  function writeDocument(document) {
-    fs6.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs6.writeFileSync(filePath, `${JSON.stringify(document, null, 4)}
-`, "utf8");
-  }
   return {
     id,
     label,
     location: filePath,
-    detected: fs6.existsSync(filePath),
+    detected: fs7.existsSync(filePath),
     readEntries() {
       const document = readDocument(filePath);
       return readMcpServersJson(document);
     },
+    hasEntry(name) {
+      return Object.hasOwn(readRawMcpServersJson(readDocument(filePath)), name);
+    },
     writeEntry(name, entry) {
-      const document = readDocument(filePath);
-      let servers = document.mcpServers;
-      if (typeof servers !== "object" || servers == null || Array.isArray(servers) == true) {
-        servers = {};
-      }
-      servers[name] = entry;
-      document.mcpServers = servers;
-      writeDocument(document);
+      updateConfigFile(filePath, (contents) => {
+        const document = readDocument(filePath, contents);
+        const servers = Object.assign(/* @__PURE__ */ Object.create(null), readRawMcpServersJson(document));
+        servers[name] = entry;
+        document.mcpServers = servers;
+        return JSON.stringify(document, null, 4) + "\n";
+      });
       return { status: "written", detail: filePath };
     },
     removeEntry(name) {
-      const document = readDocument(filePath);
-      const servers = document.mcpServers;
-      if (typeof servers !== "object" || servers == null || Array.isArray(servers) == true) {
-        return { status: "written", detail: filePath };
-      }
-      delete servers[name];
-      writeDocument(document);
+      updateConfigFile(filePath, (contents) => {
+        const document = readDocument(filePath, contents);
+        const servers = readRawMcpServersJson(document);
+        delete servers[name];
+        return JSON.stringify(document, null, 4) + "\n";
+      });
       return { status: "written", detail: filePath };
     }
   };
@@ -4094,11 +4323,11 @@ function runClaude(executable, args) {
   }
   return { status: "written", detail: CLAUDE_CODE_CONFIG_PATH };
 }
-function readClaudeEntries() {
-  if (fs6.existsSync(CLAUDE_CODE_CONFIG_PATH) == false) {
+function readRawClaudeEntries() {
+  if (fs7.existsSync(CLAUDE_CODE_CONFIG_PATH) == false) {
     return {};
   }
-  const text = fs6.readFileSync(CLAUDE_CODE_CONFIG_PATH, "utf8");
+  const text = fs7.readFileSync(CLAUDE_CODE_CONFIG_PATH, "utf8");
   let document;
   try {
     document = JSON.parse(text);
@@ -4109,7 +4338,7 @@ function readClaudeEntries() {
     }
     throw new Error(`${CLAUDE_CODE_CONFIG_PATH} is not valid JSON: ${detail}`);
   }
-  return readMcpServersJson(document);
+  return readRawMcpServersJson(document);
 }
 function createClaudeCodeTarget() {
   const executable = findExecutable("claude");
@@ -4117,28 +4346,35 @@ function createClaudeCodeTarget() {
     id: "claude-code",
     label: "Claude Code (user scope)",
     location: CLAUDE_CODE_CONFIG_PATH,
-    detected: executable != null || fs6.existsSync(CLAUDE_CODE_CONFIG_PATH) == true,
-    readEntries: readClaudeEntries,
+    detected: executable != null || fs7.existsSync(CLAUDE_CODE_CONFIG_PATH) == true,
+    readEntries() {
+      return readMcpServersJson({ mcpServers: readRawClaudeEntries() });
+    },
+    hasEntry(name) {
+      return Object.hasOwn(readRawClaudeEntries(), name);
+    },
     writeEntry(name, entry) {
       if (executable == null) {
         return {
           status: "unavailable",
-          detail: `the claude CLI is not on PATH \u2014 run this yourself:
-  ${formatClaudeAddCommand(name, entry)}`
+          detail: "the claude CLI is not on PATH \u2014 install it, or use Print to get a command to run yourself"
         };
       }
-      const previous = readClaudeEntries()[name];
-      if (previous != null) {
+      const previousEntries = readRawClaudeEntries();
+      const hadPrevious = Object.hasOwn(previousEntries, name);
+      const previous = previousEntries[name];
+      if (hadPrevious) {
         const removed = runClaude(executable, ["mcp", "remove", name, "-s", "user"]);
         if (removed.status === "unavailable") {
           return removed;
         }
       }
       const added = runClaude(executable, ["mcp", "add-json", name, toClaudeAddJsonPayload(entry), "-s", "user"]);
-      if (added.status === "unavailable" && previous != null) {
-        runClaude(executable, ["mcp", "add-json", name, toClaudeAddJsonPayload(previous), "-s", "user"]);
+      if (added.status === "unavailable" && hadPrevious) {
+        const restored = runClaude(executable, ["mcp", "add-json", name, JSON.stringify(previous), "-s", "user"]);
+        const recovery = restored.status === "written" ? "the previous entry was restored" : `could not restore the previous entry: ${restored.detail}`;
         return { status: "unavailable", detail: `${added.detail}
-  the previous entry was restored` };
+  ${recovery}` };
       }
       return added;
     },
@@ -4155,194 +4391,121 @@ function createClaudeCodeTarget() {
   };
 }
 
-// src/modules/manage/targets/toml-subset.ts
-var BARE_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
-var ANY_HEADER_PATTERN = /^\s*\[/;
-var SERVER_HEADER_PATTERN = /^\s*\[\s*mcp_servers\s*\.\s*([A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*")\s*((?:\.[^\]]*)?)\]\s*(?:#.*)?$/;
-var KEY_VALUE_PATTERN = /^\s*([A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*")\s*=\s*(.*)$/;
-var OWNED_TABLE_KEYS = ["command", "args", "env"];
-var TomlValueParser = class {
-  constructor(text) {
-    this.text = text;
-    this.position = 0;
-  }
-  parse() {
-    const value = this.parseValue();
-    return value;
-  }
-  skipWhitespace() {
-    while (this.position < this.text.length && /\s/.test(this.text[this.position]) == true) {
-      this.position += 1;
-    }
-  }
-  parseValue() {
-    this.skipWhitespace();
-    const current = this.text[this.position];
-    if (current === '"') {
-      return this.parseBasicString();
-    }
-    if (current === "'") {
-      return this.parseLiteralString();
-    }
-    if (current === "[") {
-      return this.parseArray();
-    }
-    if (current === "{") {
-      return this.parseInlineTable();
-    }
-    throw new Error(`unsupported toml value at offset ${this.position}`);
-  }
-  parseBasicString() {
-    this.position += 1;
-    let result = "";
-    while (this.position < this.text.length) {
-      const current = this.text[this.position];
-      if (current === '"') {
-        this.position += 1;
-        return result;
-      }
-      if (current !== "\\") {
-        result += current;
-        this.position += 1;
-        continue;
-      }
-      const escaped = this.text[this.position + 1];
-      this.position += 2;
-      if (escaped === "n") {
-        result += "\n";
-      } else if (escaped === "t") {
-        result += "	";
-      } else if (escaped === "r") {
-        result += "\r";
-      } else if (escaped === "u" || escaped === "U") {
-        let length = 4;
-        if (escaped === "U") {
-          length = 8;
+// src/modules/manage/targets/toml-lines.ts
+function lineState() {
+  return { quote: null, multiline: false, depth: 0 };
+}
+function scanTomlLine(line, state) {
+  for (let index = 0; index < line.length; index += 1) {
+    const character = line[index];
+    if (state.quote != null) {
+      if (character === "\\" && state.quote === '"') {
+        index += 1;
+      } else if (character === state.quote) {
+        if (!state.multiline) {
+          state.quote = null;
+        } else if (line.slice(index, index + 3) === state.quote.repeat(3)) {
+          while (line[index + 1] === character) {
+            index += 1;
+          }
+          state.quote = null;
+          state.multiline = false;
         }
-        const hex = this.text.slice(this.position, this.position + length);
-        result += String.fromCodePoint(Number.parseInt(hex, 16));
-        this.position += length;
-      } else {
-        result += escaped;
       }
+      continue;
     }
-    throw new Error("unterminated toml string");
-  }
-  parseLiteralString() {
-    const end = this.text.indexOf("'", this.position + 1);
-    if (end < 0) {
-      throw new Error("unterminated toml literal string");
+    if (character === "#") {
+      break;
     }
-    const result = this.text.slice(this.position + 1, end);
-    this.position = end + 1;
-    return result;
-  }
-  parseArray() {
-    this.position += 1;
-    const items = [];
-    for (; ; ) {
-      this.skipWhitespace();
-      if (this.position >= this.text.length) {
-        throw new Error("unterminated toml array");
-      }
-      if (this.text[this.position] === "]") {
-        this.position += 1;
-        return items;
-      }
-      items.push(this.parseValue());
-      this.skipWhitespace();
-      if (this.text[this.position] === ",") {
-        this.position += 1;
+    if (character === '"' || character === "'") {
+      state.quote = character;
+      state.multiline = line.slice(index, index + 3) === character.repeat(3);
+      if (state.multiline) {
+        index += 2;
       }
+    } else if (character === "[" || character === "{") {
+      state.depth += 1;
+    } else if (character === "]" || character === "}") {
+      state.depth -= 1;
     }
   }
-  parseInlineTable() {
-    this.position += 1;
-    const table = {};
-    for (; ; ) {
-      this.skipWhitespace();
-      if (this.position >= this.text.length) {
-        throw new Error("unterminated toml inline table");
-      }
-      if (this.text[this.position] === "}") {
-        this.position += 1;
-        return table;
-      }
-      let key;
-      if (this.text[this.position] === '"') {
-        key = this.parseBasicString();
-      } else {
-        const match = /^[A-Za-z0-9_-]+/.exec(this.text.slice(this.position));
-        if (match == null) {
-          throw new Error(`invalid inline table key at offset ${this.position}`);
-        }
-        key = match[0];
-        this.position += key.length;
-      }
-      this.skipWhitespace();
-      if (this.text[this.position] !== "=") {
-        throw new Error(`expected '=' at offset ${this.position}`);
-      }
-      this.position += 1;
-      table[key] = this.parseValue();
-      this.skipWhitespace();
-      if (this.text[this.position] === ",") {
-        this.position += 1;
-      }
-    }
+}
+function isTable(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function parseConfigToml(text) {
+  let document;
+  try {
+    document = parse(text, { integersAsBigInt: true });
+  } catch (error) {
+    const location = error instanceof TomlError ? ` at line ${error.line}, column ${error.column}` : "";
+    throw new Error(`Invalid TOML${location}; fix the config before changing it.`);
   }
-};
-function unquoteKey(rawKey) {
-  if (rawKey.startsWith('"') == false) {
-    return rawKey;
+  if (Object.hasOwn(document, "mcp_servers") && !isTable(document.mcp_servers)) {
+    throw new Error("mcp_servers must be a TOML table.");
   }
-  const parsed = new TomlValueParser(rawKey).parse();
-  return parsed;
+  return document;
 }
-function bracketBalance(text) {
-  let balance = 0;
-  let quote = null;
-  for (let index = 0; index < text.length; index += 1) {
-    const current = text[index];
-    if (quote != null) {
-      if (current === "\\" && quote === '"') {
-        index += 1;
-      } else if (current === quote) {
-        quote = null;
-      }
-      continue;
-    }
-    if (current === '"' || current === "'") {
-      quote = current;
-    } else if (current === "#") {
-      break;
-    } else if (current === "[" || current === "{") {
-      balance += 1;
-    } else if (current === "]" || current === "}") {
-      balance -= 1;
+function readTomlEntries(text) {
+  return readMcpServersJson({ mcpServers: parseConfigToml(text).mcp_servers ?? {} });
+}
+function hasTomlEntry(text, name) {
+  return Object.hasOwn(parseConfigToml(text).mcp_servers ?? {}, name);
+}
+function normalize(document) {
+  const servers = document.mcp_servers;
+  if (servers == null) {
+    return;
+  }
+  for (const server of Object.values(servers)) {
+    if (isTable(server) && isTable(server.env) && Object.keys(server.env).length === 0) {
+      delete server.env;
     }
   }
-  return balance;
+  if (Object.keys(servers).length === 0) {
+    delete document.mcp_servers;
+  }
 }
-function stripComment(text) {
-  let quote = null;
-  for (let index = 0; index < text.length; index += 1) {
-    const current = text[index];
-    if (quote != null) {
-      if (current === "\\" && quote === '"') {
-        index += 1;
-      } else if (current === quote) {
-        quote = null;
-      }
-      continue;
-    }
-    if (current === '"' || current === "'") {
-      quote = current;
-    } else if (current === "#") {
-      return text.slice(0, index);
-    }
+function verifyTomlEdit(before, after, name, entry) {
+  const expected = parseConfigToml(before);
+  const servers = expected.mcp_servers ?? /* @__PURE__ */ Object.create(null);
+  if (entry == null) {
+    delete servers[name];
+  } else {
+    const previous = Object.hasOwn(servers, name) && isTable(servers[name]) ? servers[name] : {};
+    Object.defineProperty(servers, name, {
+      value: Object.assign(/* @__PURE__ */ Object.create(null), previous, { command: entry.command, args: [...entry.args], env: Object.assign(/* @__PURE__ */ Object.create(null), entry.env) }),
+      configurable: true,
+      enumerable: true,
+      writable: true
+    });
+  }
+  expected.mcp_servers = servers;
+  let actual;
+  try {
+    actual = parseConfigToml(after);
+  } catch {
+    throw new Error("Cannot safely edit this TOML layout. Use [mcp_servers.<name>] tables; nothing was written.");
+  }
+  normalize(expected);
+  normalize(actual);
+  if (!isDeepStrictEqual(expected, actual)) {
+    throw new Error("Cannot safely edit this TOML layout without changing other settings; nothing was written.");
+  }
+  return after;
+}
+
+// src/modules/manage/targets/toml-subset.ts
+var BARE_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
+var ANY_HEADER_PATTERN = /^\s*\[/;
+var SERVER_HEADER_PATTERN = /^\s*\[\s*(?:mcp_servers|"mcp_servers"|'mcp_servers')\s*\.\s*([A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*"|'[^']*')\s*((?:\.[^\]]*)?)\]\s*(?:#.*)?$/;
+var KEY_VALUE_PATTERN = /^\s*([A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*"|'[^']*')\s*=\s*(.*)$/;
+var OWNED_TABLE_KEYS = ["command", "args", "env"];
+function unquoteKey(rawKey) {
+  if (rawKey.startsWith('"') || rawKey.startsWith("'")) {
+    return parseConfigToml(`value = ${rawKey}`).value;
   }
-  return text;
+  return rawKey;
 }
 function readStatements(body) {
   const statements = [];
@@ -4354,28 +4517,25 @@ function readStatements(body) {
       continue;
     }
     const start = index;
-    let rawValue = stripComment(match[2]);
-    let balance = bracketBalance(rawValue);
+    const state = lineState();
+    scanTomlLine(match[2], state);
     index += 1;
-    while (balance > 0 && index < body.length) {
-      const continuation = stripComment(body[index]);
-      rawValue += `
-${continuation}`;
-      balance += bracketBalance(continuation);
+    while ((state.quote != null || state.depth > 0) && index < body.length) {
+      scanTomlLine(body[index], state);
       index += 1;
     }
-    statements.push({ key: unquoteKey(match[1]), rawValue, start, end: index });
+    statements.push({ key: unquoteKey(match[1]), start, end: index });
   }
   return statements;
 }
 function splitSections(lines) {
   const sections = [{ header: null, serverName: null, subPath: "", body: [] }];
-  let balance = 0;
+  const state = lineState();
   for (const line of lines) {
     const current = sections[sections.length - 1];
-    if (balance > 0) {
+    if (state.quote != null || state.depth > 0) {
       current.body.push(line);
-      balance += bracketBalance(stripComment(line));
+      scanTomlLine(line, state);
       continue;
     }
     if (ANY_HEADER_PATTERN.test(line) == true) {
@@ -4390,73 +4550,18 @@ function splitSections(lines) {
       continue;
     }
     current.body.push(line);
-    const keyValueMatch = KEY_VALUE_PATTERN.exec(line);
-    if (keyValueMatch != null) {
-      balance = bracketBalance(stripComment(keyValueMatch[2]));
-    }
+    scanTomlLine(line, state);
   }
   return sections;
 }
-function parseStatementValue(statement) {
-  try {
-    const value = new TomlValueParser(statement.rawValue).parse();
-    return value;
-  } catch {
-    return null;
-  }
+function hasMcpServerToml(text, name) {
+  return hasTomlEntry(text, name);
 }
 function parseMcpServersToml(text) {
-  const sections = splitSections(text.split(/\r?\n/));
-  const entries = {};
-  const envTables = {};
-  for (const section of sections) {
-    if (section.serverName == null) {
-      continue;
-    }
-    if (section.subPath === "env") {
-      const envTable = {};
-      for (const statement of readStatements(section.body)) {
-        const value = parseStatementValue(statement);
-        if (typeof value === "string") {
-          envTable[statement.key] = value;
-        }
-      }
-      envTables[section.serverName] = envTable;
-      continue;
-    }
-    if (section.subPath !== "") {
-      continue;
-    }
-    let command = null;
-    let args = [];
-    const env = {};
-    for (const statement of readStatements(section.body)) {
-      const value = parseStatementValue(statement);
-      if (statement.key === "command" && typeof value === "string") {
-        command = value;
-      } else if (statement.key === "args" && Array.isArray(value) == true) {
-        args = value.filter((item) => typeof item === "string");
-      } else if (statement.key === "env" && value != null && typeof value === "object" && Array.isArray(value) == false) {
-        for (const [key, item] of Object.entries(value)) {
-          if (typeof item === "string") {
-            env[key] = item;
-          }
-        }
-      }
-    }
-    if (command != null) {
-      entries[section.serverName] = { command, args, env };
-    }
-  }
-  for (const [name, envTable] of Object.entries(envTables)) {
-    if (entries[name] != null) {
-      Object.assign(entries[name].env, envTable);
-    }
-  }
-  return entries;
+  return readTomlEntries(text);
 }
 function quoteTomlString(value) {
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
   return `"${escaped}"`;
 }
 function formatTomlKey(key) {
@@ -4500,6 +4605,11 @@ function joinSections(sections, eol) {
   return lines.join(eol);
 }
 function writeMcpServerToml(text, name, entry) {
+  parseConfigToml(text);
+  const updated = editMcpServerToml(text, name, entry);
+  return verifyTomlEdit(text, updated, name, entry);
+}
+function editMcpServerToml(text, name, entry) {
   let eol = "\n";
   if (text.includes("\r\n") == true) {
     eol = "\r\n";
@@ -4572,34 +4682,36 @@ function writeMcpServerToml(text, name, entry) {
 var CODEX_CONFIG_PATH = path.join(os5.homedir(), ".codex", "config.toml");
 function createCodexTarget() {
   function readText() {
-    if (fs6.existsSync(CODEX_CONFIG_PATH) == false) {
+    if (fs7.existsSync(CODEX_CONFIG_PATH) == false) {
       return "";
     }
-    return fs6.readFileSync(CODEX_CONFIG_PATH, "utf8");
-  }
-  function writeText(text) {
-    fs6.mkdirSync(path.dirname(CODEX_CONFIG_PATH), { recursive: true });
-    fs6.writeFileSync(CODEX_CONFIG_PATH, text, "utf8");
-    return { status: "written", detail: CODEX_CONFIG_PATH };
+    return fs7.readFileSync(CODEX_CONFIG_PATH, "utf8");
   }
   return {
     id: "codex",
     label: "Codex CLI",
     location: CODEX_CONFIG_PATH,
-    detected: findExecutable("codex") != null || fs6.existsSync(CODEX_CONFIG_PATH) == true,
+    detected: findExecutable("codex") != null || fs7.existsSync(CODEX_CONFIG_PATH) == true,
     readEntries() {
       const text = readText();
       return parseMcpServersToml(text);
     },
-    writeEntry(name, entry) {
-      const text = readText();
-      const updated = writeMcpServerToml(text, name, entry);
-      return writeText(updated);
+    hasEntry(name) {
+      return hasMcpServerToml(readText(), name);
+    },
+    writeEntry(name, entry, options) {
+      updateConfigFile(CODEX_CONFIG_PATH, (original) => {
+        let text = original;
+        if (options?.replace) {
+          text = writeMcpServerToml(text, name, null);
+        }
+        return writeMcpServerToml(text, name, entry);
+      });
+      return { status: "written", detail: CODEX_CONFIG_PATH };
     },
     removeEntry(name) {
-      const text = readText();
-      const updated = writeMcpServerToml(text, name, null);
-      return writeText(updated);
+      updateConfigFile(CODEX_CONFIG_PATH, (text) => writeMcpServerToml(text, name, null));
+      return { status: "written", detail: CODEX_CONFIG_PATH };
     }
   };
 }
@@ -4738,10 +4850,12 @@ async function checkHost(prompter, output, target, name, entry) {
   const profile = profileFromEnv(output, entry.env);
   if (profile == null) {
     output.write("\n");
+    await prompter.pause();
     return;
   }
   const result = await runConnectionCheck(profile, output);
   output.write("\n");
+  await prompter.pause();
   if (result.connected == false) {
     return;
   }
@@ -4805,13 +4919,14 @@ function buildHostItems(names, entries) {
     };
   });
 }
-async function manageHost(prompter, output, target, entries, name) {
+async function manageHost(prompter, output, target, targets, entries, name) {
   const action = await prompter.select(
     name,
     [
       { value: "edit", key: "e", label: "Edit", hint: "open its settings" },
       { value: "check", key: "c", label: "Check the connection", hint: "connect now and offer to pin the host key" },
       { value: "print", key: "p", label: "Print the entry", hint: "JSON, Codex TOML and a claude command, ready to paste" },
+      ...targets.some((candidate) => candidate.id !== target.id) ? [{ value: "copy", key: "o", label: "Copy to another client", hint: "keep this entry and copy its settings" }] : [],
       { value: "remove", key: "r", label: "Remove", hint: `from ${target.label}` },
       { separator: true },
       { value: "back", key: "b", label: "Back" }
@@ -4830,6 +4945,10 @@ async function manageHost(prompter, output, target, entries, name) {
     printHost(prompter, name, entries[name]);
     return;
   }
+  if (action === "copy") {
+    await copyEntryToClient(prompter, target, targets, name, entries[name]);
+    return;
+  }
   if (action === "remove") {
     const remove = await prompter.askYesNo(`Remove ${name} from ${target.location}?`, false);
     if (remove == true) {
@@ -4931,7 +5050,7 @@ ${paint.bold(target.label)}  ${paint.dim(target.location)}
           continue;
         }
         if (picked.startsWith(HOST_VALUE_PREFIX) == true) {
-          await manageHost(prompter, output, target, entries, picked.slice(HOST_VALUE_PREFIX.length));
+          await manageHost(prompter, output, target, targets, entries, picked.slice(HOST_VALUE_PREFIX.length));
         }
       } catch (ex) {
         if (ex instanceof PromptClosedError) {
@@ -5384,7 +5503,7 @@ ${file.content}`);
         const { profile, session: openSession } = resolveProfile(context, { session });
         const resolvedLocalPath = expandHomePath(localPath);
         requirePermittedLocalPath(resolvedLocalPath, "read");
-        if (fs6.existsSync(resolvedLocalPath) == false) {
+        if (fs7.existsSync(resolvedLocalPath) == false) {
           return textResult(`local file not found: ${resolvedLocalPath}`);
         }
         const transferredBytes = await withHostConnection(profile, openSession, async (connection) => {
@@ -5424,7 +5543,7 @@ ${file.content}`);
         const { profile, session: openSession } = resolveProfile(context, { session });
         const resolvedLocalPath = expandHomePath(localPath);
         requirePermittedLocalPath(resolvedLocalPath, "write");
-        fs6.mkdirSync(path.dirname(resolvedLocalPath), { recursive: true });
+        fs7.mkdirSync(path.dirname(resolvedLocalPath), { recursive: true });
         const transferredBytes = await withHostConnection(profile, openSession, async (connection) => {
           return await downloadFile(connection, remotePath, resolvedLocalPath);
         });