@nearform/fling 0.1.1 → 0.2.0

package/dist/cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 
 // src/cli.ts
+import chalk9 from "chalk";
 import { Command } from "commander";
 
 // src/commands/auth.ts
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 
 // src/auth.ts
 import { randomBytes } from "node:crypto";
@@ -23,14 +24,198 @@ var MAX_FILE_BYTES = 25 * 1024 * 1024;
 var MAX_FILES = 5e3;
 var MAX_PATH_LENGTH = 1024;
 
+// ../../packages/shared/src/secrets.ts
+var SECRET_SCAN_MAX_FILE_BYTES = MAX_FILE_BYTES;
+var BINARY_SNIFF_BYTES = 8192;
+var SECRET_EXTENSIONS = [
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".jks",
+  ".keystore",
+  ".tfstate",
+  ".tfstate.backup",
+  ".tfvars",
+  ".tfvars.json",
+  ".kdbx"
+];
+var SECRET_NAMES = /* @__PURE__ */ new Set([
+  "credentials",
+  "credentials.json",
+  "secrets.json",
+  "secrets.yml",
+  "secrets.yaml",
+  "wp-config.php",
+  ".htpasswd"
+]);
+var SSH_KEY_RE = /^id_(?:rsa|dsa|ecdsa|ed25519)(?:[._-]|$)/;
+function isSecretPath(path) {
+  const name = (path.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+  if (!name) return false;
+  if (SECRET_NAMES.has(name)) return true;
+  if (SECRET_EXTENSIONS.some((ext) => name.endsWith(ext) && name.length > ext.length)) return true;
+  if (/service[-_]account.*\.json$/.test(name)) return true;
+  if (SSH_KEY_RE.test(name) && !name.endsWith(".pub")) return true;
+  return false;
+}
+var PLACEHOLDER_RE = /example|xxxx/i;
+var isPlaceholder = (m) => PLACEHOLDER_RE.test(m[0]);
+var DB_PASSWORD_PLACEHOLDER = /^(?:password|passw(?:or)?d|pass|pwd|secret|changeme|example|test|admin|root|postgres|mysql|redis|guest|user|\*+|x+|\.+)$/i;
+var LOCAL_HOST = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|db|host|hostname)(?::\d+)?$/i;
+var RULES = [
+  {
+    id: "private-key",
+    label: "private key",
+    // The header, optional RFC 1421 headers (Proc-Type, DEK-Info, Version), then key material.
+    re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY(?: BLOCK)?-----[ \t]*\r?\n(?:[A-Za-z-]+:[^\n]*\r?\n)*(?:[ \t]*\r?\n)?[ \t]*[A-Za-z0-9+/=]{40,}/g
+  },
+  {
+    id: "aws-access-key-id",
+    label: "AWS access key ID",
+    re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+    allow: isPlaceholder
+  },
+  {
+    id: "aws-secret-access-key",
+    label: "AWS secret access key",
+    re: /\b(?:aws_?)?secret_?access_?key["']?\s*[:=]\s*["']?[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])/gi,
+    allow: isPlaceholder
+  },
+  {
+    id: "github-token",
+    label: "GitHub token",
+    re: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{80,})/g,
+    allow: isPlaceholder
+  },
+  { id: "npm-token", label: "npm token", re: /\bnpm_[A-Za-z0-9]{36}\b/g, allow: isPlaceholder },
+  {
+    id: "slack-token",
+    label: "Slack token",
+    re: /\bxox[abposr]-[0-9]{6,}-[A-Za-z0-9-]{10,}/g,
+    allow: isPlaceholder
+  },
+  {
+    id: "slack-webhook",
+    label: "Slack webhook URL",
+    re: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]{6,}\/B[A-Z0-9]{6,}\/[A-Za-z0-9]{20,}/g,
+    allow: isPlaceholder
+  },
+  {
+    id: "stripe-live-key",
+    label: "Stripe live key",
+    re: /\b[sr]k_live_[0-9a-zA-Z]{24,}\b/g,
+    allow: isPlaceholder
+  },
+  {
+    id: "google-oauth-client-secret",
+    label: "Google OAuth client secret",
+    re: /\bGOCSPX-[A-Za-z0-9_-]{28}(?![A-Za-z0-9_-])/g,
+    allow: isPlaceholder
+  },
+  {
+    id: "openai-api-key",
+    label: "OpenAI API key",
+    re: /\bsk-(?:(?:proj|svcacct|admin)-[A-Za-z0-9_-]{40,}|[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20})/g,
+    allow: isPlaceholder
+  },
+  {
+    id: "anthropic-api-key",
+    label: "Anthropic API key",
+    re: /\bsk-ant-[A-Za-z0-9_-]{80,}/g,
+    allow: isPlaceholder
+  },
+  {
+    id: "sendgrid-api-key",
+    label: "SendGrid API key",
+    re: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])/g,
+    allow: isPlaceholder
+  },
+  {
+    id: "azure-storage-key",
+    label: "Azure storage account key",
+    re: /\bAccountKey=[A-Za-z0-9+/]{80,}={0,2}/g,
+    allow: isPlaceholder
+  },
+  {
+    id: "database-url-password",
+    label: "database URL with a password",
+    re: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^:\s/@"'`<>]+:([^@\s/"'`<>]{3,})@([^\s/?#"'`<>]+)/g,
+    allow: (m) => {
+      const password = m[1] ?? "";
+      const host = m[2] ?? "";
+      return DB_PASSWORD_PLACEHOLDER.test(password) || /[${}%]/.test(password) || PLACEHOLDER_RE.test(password) || LOCAL_HOST.test(host) || /(?:^|\.)example(?:\.[a-z]+)?(?::\d+)?$/i.test(host);
+    }
+  }
+];
+var SECRET_RULE_LABELS = Object.fromEntries(
+  RULES.map((r) => [r.id, r.label])
+);
+function lineAt(starts, index) {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (starts[mid] <= index) lo = mid;
+    else hi = mid - 1;
+  }
+  return lo + 1;
+}
+function scanForSecrets(text2, path) {
+  let starts;
+  const findings = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rule of RULES) {
+    rule.re.lastIndex = 0;
+    for (let m = rule.re.exec(text2); m !== null; m = rule.re.exec(text2)) {
+      if (m[0].length === 0) rule.re.lastIndex++;
+      if (rule.allow?.(m)) continue;
+      if (!starts) {
+        starts = [0];
+        for (let i = text2.indexOf("\n"); i !== -1; i = text2.indexOf("\n", i + 1)) starts.push(i + 1);
+      }
+      const line = lineAt(starts, m.index);
+      const key = `${rule.id}:${line}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push({ path, line, rule: rule.id });
+    }
+  }
+  return findings.sort((a, b) => a.line - b.line || a.rule.localeCompare(b.rule));
+}
+var BINARY_EXTENSIONS = new Set(
+  "png jpg jpeg gif webp avif ico bmp tif tiff heic psd woff woff2 ttf otf eot mp3 mp4 m4a m4v mov webm ogg oga ogv wav flac aac avi mkv zip gz tgz br zst bz2 xz 7z rar wasm pdf glb gltf-binary bin dat".split(/\s+/).filter(Boolean)
+);
+function isScannablePath(path) {
+  const name = path.split("/").at(-1) ?? "";
+  const dot = name.lastIndexOf(".");
+  return dot <= 0 || !BINARY_EXTENSIONS.has(name.slice(dot + 1).toLowerCase());
+}
+function looksBinary(bytes) {
+  const end = Math.min(bytes.length, BINARY_SNIFF_BYTES);
+  for (let i = 0; i < end; i++) if (bytes[i] === 0) return true;
+  return false;
+}
+function scanBytesForSecrets(bytes, path) {
+  if (!isScannablePath(path) || bytes.length > SECRET_SCAN_MAX_FILE_BYTES || looksBinary(bytes))
+    return [];
+  return scanForSecrets(new TextDecoder("utf-8").decode(bytes), path);
+}
+function describeSecretFindings(findings, max = 20) {
+  const lines = findings.slice(0, max).map((f) => `${f.path} line ${f.line}: ${SECRET_RULE_LABELS[f.rule] ?? f.rule}`);
+  if (findings.length > max) lines.push(`\u2026 and ${findings.length - max} more`);
+  return lines;
+}
+var NEVER_PUBLISHED_NOTE = "Fling never publishes dotfiles, gitignored files, secret files (keys, certificates, credentials) or files that contain secrets.";
+
 // ../../packages/shared/src/manifest.ts
 function isValidSitePath(path) {
   if (!path || path.length > MAX_PATH_LENGTH) return false;
   if (path.startsWith("/") || path.includes("\\") || path.includes("\0")) return false;
-  return path.split("/").every((seg) => seg !== "" && seg !== "." && seg !== "..");
+  return path.split("/").every((seg) => seg !== "" && !seg.startsWith("."));
 }
 var ManifestFileSchema = z.object({
-  path: z.string().refine(isValidSitePath, "invalid path"),
+  path: z.string().refine(isValidSitePath, "invalid path (dotfiles are never published)").refine((p) => !isSecretPath(p), "secret file (keys, certificates, credentials) never published"),
   sha256: z.string().regex(/^[a-f0-9]{64}$/),
   size: z.number().int().min(0).max(MAX_FILE_BYTES),
   contentType: z.string().min(1).max(255)
@@ -279,6 +464,7 @@ var NAME_RULES = `Site names are 1-${SITE_NAME_MAX} chars of lowercase letters,
 var NAME_REQUIRED = 'Publishing needs a name: if the user did not give one, propose a short descriptive one (e.g. "q3-report") and confirm it with them first (fling_check_name tells you whether it is free). If the name is taken by someone else the call fails with free suggestions \u2014 offer those to the user and retry with the one they pick.';
 var VISIBILITY = "Sites are private by default (only signed-in Nearformers can open them); pass `public: true` only if the user asks for a public site. Share links (fling_share) are public to anyone who has them.";
 var INLINE_ONLY = "If you created the content in this conversation, pass it directly \u2014 never pass file paths from your sandbox (this server cannot read them) and never try to curl/upload from your sandbox.";
+var NEVER_PUBLISHED = "Fling never publishes dotfiles, gitignored files, secret files (keys, certs, credentials) or files that contain secrets (API keys, tokens, private keys, passwords in database URLs); it stops and tells you which file and line. Remove the secret (or leave the file out) and retry \u2014 there is no way to override this.";
 var ENCODING = '`encoding` is "utf8" (default, for text: HTML, CSS, JS, SVG, JSON, Markdown\u2026) or "base64" (binary: images, fonts, PDFs).';
 var LIST_HTML = "If the files have no root index.html but do include HTML pages, the call does not publish: it reports how many HTML pages there are and asks you to check with the user. Ask them whether to generate an index.html listing those pages (retry with `listHtml: true`) or to publish without one (`listHtml: false` \u2014 the site root will 404, the pages still work at their own paths), then retry.";
 var listHtml = z4.boolean().optional().describe(
@@ -286,7 +472,7 @@ var listHtml = z4.boolean().optional().describe(
 );
 var siteName = z4.string().min(1).max(200).describe('Site name, e.g. "q3-report"');
 var sitePath = z4.string().min(1).max(1024).describe(
-  'Site-relative path with forward slashes, e.g. "index.html", "css/app.css", "img/logo.png". The root page must be "index.html".'
+  'Site-relative path with forward slashes, e.g. "index.html", "css/app.css", "img/logo.png". The root page must be "index.html". No dotfiles (".env", ".well-known/\u2026")'
 );
 var encoding = z4.enum(["utf8", "base64"]).optional().describe('How `content` is encoded: "utf8" (default) for text, "base64" for binary files');
 var spa = z4.boolean().optional().describe(
@@ -339,7 +525,7 @@ var mcpTools = {
   publish: tool({
     name: "fling_publish",
     title: "Publish a site",
-    description: `Publish a static site to Fling in one call and get back its URL. Pass every file of the site inline in \`files\` (whole site, up to ${MCP_PUBLISH_MAX_BYTES / 1024 / 1024} MB decoded in total; bigger sites: fling_upload_begin / fling_upload_file / fling_upload_finish). ${INLINE_ONLY} ${ENCODING} Publishing replaces the whole site with exactly these files (it is not a patch: include unchanged files too); publishing identical content again is a no-op. ${NAME_REQUIRED} ${NAME_RULES} ${VISIBILITY} ${LIST_HTML} The result includes \`warnings\`. Share the returned URL with the user; fling_files shows exactly which files the site has.`,
+    description: `Publish a static site to Fling in one call and get back its URL. Pass every file of the site inline in \`files\` (whole site, up to ${MCP_PUBLISH_MAX_BYTES / 1024 / 1024} MB decoded in total; bigger sites: fling_upload_begin / fling_upload_file / fling_upload_finish). ${INLINE_ONLY} ${ENCODING} Publishing replaces the whole site with exactly these files (it is not a patch: include unchanged files too); publishing identical content again is a no-op. ${NAME_REQUIRED} ${NAME_RULES} ${VISIBILITY} ${LIST_HTML} ${NEVER_PUBLISHED} The result includes \`warnings\`. Share the returned URL with the user; fling_files shows exactly which files the site has.`,
     inputSchema: {
       name: siteName,
       files: z4.array(
@@ -365,7 +551,7 @@ var mcpTools = {
   uploadFile: tool({
     name: "fling_upload_file",
     title: "Upload a file (chunked)",
-    description: `Add one file to a chunked upload started with fling_upload_begin. Sending the same path again replaces it. A file larger than ${MCP_UPLOAD_CHUNK_MAX_CHARS / 1024 / 1024} MB of content can span calls: send the first part normally, then the following parts in order with \`append: true\` (same path and encoding; send appends one at a time, not in parallel). ${ENCODING}`,
+    description: `Add one file to a chunked upload started with fling_upload_begin. Sending the same path again replaces it. A file larger than ${MCP_UPLOAD_CHUNK_MAX_CHARS / 1024 / 1024} MB of content can span calls: send the first part normally, then the following parts in order with \`append: true\` (same path and encoding; send appends one at a time, not in parallel). ${ENCODING} ${NEVER_PUBLISHED}`,
     inputSchema: {
       uploadId: z4.string().min(1).max(100).describe("From fling_upload_begin"),
       path: sitePath,
@@ -440,6 +626,7 @@ var MCP_REMOTE_INSTRUCTIONS = [
   "Every site needs a name. If the user did not give one, propose a short descriptive name and confirm it before publishing (fling_check_name shows whether it is free). Names are global and first come, first served; when a name is taken, offer the returned suggestions.",
   "Sites are private (Nearformers only) by default. Only make one public if asked; to show a private site to someone outside Nearform, create a share link with fling_share.",
   "If a site has HTML pages but no root index.html, fling_publish / fling_upload_finish stop and ask: check with the user whether to generate an index.html listing the pages (`listHtml: true`) or publish without one (`listHtml: false`, the root URL will 404), then retry.",
+  NEVER_PUBLISHED,
   `For sites over ${MCP_PUBLISH_MAX_BYTES / 1024 / 1024} MB use fling_upload_begin, fling_upload_file (repeat, \`append\` for big files) and fling_upload_finish.`,
   "Always give the user the URL that comes back. Use fling_list / fling_info to find existing sites, fling_rollback to restore a version, fling_archive rather than fling_delete unless the user insists. Use fling_files to see exactly which files a site has (e.g. when the user reports a 404)."
 ].join("\n\n");
@@ -469,7 +656,7 @@ function describeVersionFiles(name, files, opts) {
 var READY_TIMEOUT_MS = 15e3;
 var NOT_READY_NOTE = "it can take a few more seconds to appear everywhere; reload if you see a 404";
 var isReachableStatus = (status) => status >= 200 && status < 400 || status === 401 || status === 403;
-var defaultSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
+var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function waitUntilReachable(url, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? READY_TIMEOUT_MS;
   const doFetch = opts.fetch ?? ((u, init) => fetch(u, init));
@@ -543,7 +730,7 @@ function exitCodeFor(error) {
 // package.json
 var package_default = {
   name: "@nearform/fling",
-  version: "0.1.1",
+  version: "0.2.0",
   license: "MIT",
   description: "Fling a folder of static files at fling.labs.nearform.com and get a link back. CLI + MCP server.",
   type: "module",
@@ -574,6 +761,7 @@ var package_default = {
     test: "vitest run"
   },
   dependencies: {
+    "@clack/prompts": "^1.8.1",
     "@modelcontextprotocol/sdk": "^1.20.0",
     chalk: "^5.6.2",
     commander: "^15.0.0",
@@ -707,26 +895,37 @@ async function putUpload(fetchImpl, url, headers, body, timeoutMs = 5 * 6e4) {
 }
 async function readBody(response) {
   if (response.status === 204) return void 0;
-  const text = await response.text();
-  if (text === "") return void 0;
+  const text2 = await response.text();
+  if (text2 === "") return void 0;
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return text;
+    return text2;
   }
 }
 function errorFromResponse(status, body, method, path) {
   const envelope = ErrorEnvelopeSchema.safeParse(body);
   if (envelope.success) {
-    return new CliApiError({
+    const { code } = envelope.data.error;
+    const error = new CliApiError({
       status,
-      code: envelope.data.error.code,
+      code,
       body,
-      message: envelope.data.error.message
+      message: envelope.data.error.message,
+      hint: code ? NEVER_PUBLISHED_HINTS[code] : void 0
     });
+    const extra = body.error;
+    if (Array.isArray(extra?.findings)) Object.assign(error, { findings: extra.findings });
+    if (Array.isArray(extra?.paths)) Object.assign(error, { paths: extra.paths });
+    return error;
   }
   return new CliApiError({ status, body, message: `${method} ${path} failed with HTTP ${status}` });
 }
+var NEVER_PUBLISHED_HINTS = {
+  secret_detected: "Remove the secret from the file (and rotate it if it was ever shared), or add the file to .flingignore if the site does not need it.",
+  secret_file: "Move the secret files out of the folder, or add them to .flingignore if the site does not need them.",
+  dotfile: `Dotfiles are never flung. Update the CLI (\`npm i -g @nearform/fling@latest\`), which skips them.`
+};
 function describeCause(cause) {
   if (cause instanceof Error) {
     const inner = cause.cause;
@@ -904,8 +1103,8 @@ async function startCallbackServer(options = {}) {
   const timeoutMs = options.timeoutMs ?? LOGIN_TIMEOUT_MS;
   let settle;
   let timer;
-  const result = new Promise((resolve3, reject) => {
-    settle = { resolve: resolve3, reject };
+  const result = new Promise((resolve5, reject) => {
+    settle = { resolve: resolve5, reject };
   }).finally(() => clearTimeout(timer));
   result.catch(() => {
   });
@@ -966,7 +1165,7 @@ ${close ? "<script>setTimeout(function(){window.close()},800)</script>" : ""}
   res.end(html);
 }
 function listenOnFreePort(server) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve5, reject) => {
     let port = CALLBACK_PORT_START;
     const tryNext = () => {
       if (port > CALLBACK_PORT_END) {
@@ -988,18 +1187,18 @@ function listenOnFreePort(server) {
       });
       server.listen(port, "127.0.0.1", () => {
         server.removeAllListeners("error");
-        resolve3(port);
+        resolve5(port);
       });
     };
     tryNext();
   });
 }
-function escapeHtml2(text) {
-  return text.replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
+function escapeHtml2(text2) {
+  return text2.replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
 }
 
 // src/context.ts
-import { createInterface } from "node:readline/promises";
+import { confirm, isCancel, text } from "@clack/prompts";
 
 // src/ready.ts
 import chalk from "chalk";
@@ -1035,20 +1234,83 @@ async function waitWithSpinner(waiter, url, paths, io) {
 }
 
 // src/utils/logger.ts
+import chalk3 from "chalk";
+
+// src/ui/theme.ts
 import chalk2 from "chalk";
-var PREFIX = chalk2.cyan("fling");
+var STOPS = [
+  [0, 229, 255],
+  [124, 77, 255],
+  [255, 78, 205]
+];
+var WORDMARK = [
+  "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557     \u2588\u2588\u2557\u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 ",
+  "\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D ",
+  "\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2588\u2557",
+  "\u2588\u2588\u2554\u2550\u2550\u255D  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551",
+  "\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D",
+  "\u255A\u2550\u255D     \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D "
+];
+var TRAILS = ["      ", "  \u2501\u2501\u2501 ", " \u2501\u2501\u2501\u2501 ", "   \u2501\u2501 ", "      ", "      "];
+var LOGO_WIDTH = TRAILS[0].length + WORDMARK[0].length;
+var brand = {
+  primary: chalk2.hex("#7C4DFF"),
+  accent: chalk2.hex("#00E5FF"),
+  url: (url) => chalk2.bold.hex("#00E5FF")(url)
+};
+var symbols = {
+  info: chalk2.hex("#7C4DFF")("\u25C6"),
+  success: chalk2.green("\u2714"),
+  warn: chalk2.yellow("\u25B2"),
+  error: chalk2.red("\u2716"),
+  step: chalk2.dim("\u2502")
+};
+function colourAt(t) {
+  const scaled = Math.min(Math.max(t, 0), 1) * (STOPS.length - 1);
+  const i = Math.min(Math.floor(scaled), STOPS.length - 2);
+  const f = scaled - i;
+  const a = STOPS[i];
+  const b = STOPS[i + 1];
+  return [0, 1, 2].map((k) => Math.round(a[k] + (b[k] - a[k]) * f));
+}
+function gradient(text2, width = text2.length, offset = 0) {
+  if (chalk2.level === 0) return text2;
+  return [...text2].map((ch, i) => ch === " " ? ch : chalk2.rgb(...colourAt((offset + i) / (width - 1)))(ch)).join("");
+}
+function logo(options = {}) {
+  const columns = options.columns || process.stderr.columns || 80;
+  const tagline = options.tagline ?? "throw static files at the web, get a link back";
+  if (columns < LOGO_WIDTH + 2) return `${gradient("\u25B6\u25B6 fling")}  ${chalk2.dim(tagline)}`;
+  const lines = WORDMARK.map(
+    (row, i) => chalk2.dim(TRAILS[i] ?? "") + gradient(row, WORDMARK[0].length)
+  );
+  return ["", ...lines, `${" ".repeat(TRAILS[0].length)}${chalk2.dim(tagline)}`, ""].join("\n");
+}
+var ANSI = /\x1b\[[0-9;]*m/g;
+var visibleLength = (s) => s.replace(ANSI, "").length;
+function box(lines, title) {
+  const width = Math.max(...lines.map(visibleLength), title ? visibleLength(title) + 2 : 0);
+  const border = chalk2.dim;
+  const top = title ? `${border("\u256D\u2500")} ${title} ${border(`${"\u2500".repeat(width - visibleLength(title) - 1)}\u256E`)}` : border(`\u256D${"\u2500".repeat(width + 2)}\u256E`);
+  const body = lines.map(
+    (line) => `${border("\u2502")} ${line}${" ".repeat(width - visibleLength(line))} ${border("\u2502")}`
+  );
+  return [top, ...body, border(`\u2570${"\u2500".repeat(width + 2)}\u256F`)].join("\n");
+}
+
+// src/utils/logger.ts
 function createLogger(options = {}) {
   const write = options.write ?? ((line) => process.stderr.write(`${line}
 `));
   const debugEnabled = options.debug ?? false;
   return {
-    info: (message) => write(`${PREFIX} ${message}`),
-    success: (message) => write(`${PREFIX} ${chalk2.green("\u2713")} ${message}`),
-    warn: (message) => write(`${PREFIX} ${chalk2.yellow("!")} ${message}`),
-    error: (message) => write(`${PREFIX} ${chalk2.red("\u2717")} ${message}`),
-    hint: (message) => write(chalk2.dim(`  ${message}`)),
+    info: (message) => write(`${symbols.info} ${message}`),
+    success: (message) => write(`${symbols.success} ${message}`),
+    warn: (message) => write(`${symbols.warn} ${chalk3.yellow(message)}`),
+    error: (message) => write(`${symbols.error} ${chalk3.red(message)}`),
+    hint: (message) => write(chalk3.dim(`  ${message}`)),
     debug: (message) => {
-      if (debugEnabled) write(chalk2.dim(`[debug] ${message}`));
+      if (debugEnabled) write(chalk3.dim(`[debug] ${message}`));
     }
   };
 }
@@ -1068,12 +1330,13 @@ var silentLogger = {
 };
 
 // src/utils/output.ts
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 function createOutput(options = {}) {
   const json = options.json ?? false;
   const write = options.write ?? ((chunk) => process.stdout.write(chunk));
   return {
     json,
+    tty: options.tty ?? (options.write ? false : Boolean(process.stdout.isTTY)),
     data: (raw, human) => write(`${json ? formatJson(raw) : human()}
 `),
     text: (line) => {
@@ -1086,15 +1349,15 @@ function formatJson(value) {
   return JSON.stringify(value, null, 2);
 }
 function renderTable(rows, columns) {
-  if (rows.length === 0) return chalk3.dim("(no results)");
+  if (rows.length === 0) return chalk4.dim("(no results)");
   const cells = rows.map((row) => columns.map((column) => formatCell(column.value(row))));
   const widths = columns.map(
     (column, i) => Math.max(column.header.length, ...cells.map((line) => line[i]?.length ?? 0))
   );
-  const pad = (text, i) => i === columns.length - 1 ? text : text.padEnd(widths[i] ?? 0);
+  const pad = (text2, i) => i === columns.length - 1 ? text2 : text2.padEnd(widths[i] ?? 0);
   const header = columns.map((column, i) => pad(column.header, i)).join("  ");
   const body = cells.map((line) => line.map(pad).join("  "));
-  return [chalk3.bold(header), ...body].join("\n");
+  return [chalk4.bold(header), ...body].join("\n");
 }
 function formatCell(value) {
   if (value === null || value === void 0 || value === "") return "-";
@@ -1144,16 +1407,14 @@ async function createContext(options = {}) {
   };
 }
 async function ttyConfirm(question) {
-  const answer = await ttyPrompt(`${question} [y/N] `);
-  return /^y(es)?$/i.test(answer.trim());
+  const answer = await confirm({ message: question, initialValue: false, output: process.stderr });
+  if (isCancel(answer)) throw new CliError("Cancelled");
+  return answer;
 }
 async function ttyPrompt(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    return await rl.question(question);
-  } finally {
-    rl.close();
-  }
+  const answer = await text({ message: question.trim(), output: process.stderr });
+  if (isCancel(answer)) throw new CliError("Cancelled");
+  return answer ?? "";
 }
 function ttyProgress(line) {
   process.stderr.write(`\r\x1B[2K${line ?? ""}`);
@@ -1308,30 +1569,135 @@ async function runWhoami(ctx) {
       apiKeySource: ctx.config.apiKeySource
     },
     () => [
-      `${chalk4.bold("User:")}    ${me.name} <${me.email}>`,
-      `${chalk4.bold("Sites:")}   ${sitesPattern(base)} ${chalk4.dim("(names are first come, first served)")}`,
-      `${chalk4.bold("Server:")}  ${ctx.config.serverUrl}`,
-      `${chalk4.bold("API key:")} ${redactKey(ctx.config.apiKey)} ${chalk4.dim(`(from ${ctx.config.apiKeySource})`)}`
+      `${chalk5.bold("User:")}    ${me.name} <${me.email}>`,
+      `${chalk5.bold("Sites:")}   ${sitesPattern(base)} ${chalk5.dim("(names are first come, first served)")}`,
+      `${chalk5.bold("Server:")}  ${ctx.config.serverUrl}`,
+      `${chalk5.bold("API key:")} ${redactKey(ctx.config.apiKey)} ${chalk5.dim(`(from ${ctx.config.apiKeySource})`)}`
     ].join("\n")
   );
 }
 
 // src/commands/deploy.ts
-import chalk5 from "chalk";
+import { stat as stat4 } from "node:fs/promises";
+import { resolve as resolve3 } from "node:path";
+import chalk6 from "chalk";
 
 // src/deploy.ts
-import { readFile as readFile3 } from "node:fs/promises";
+import { readFile as readFile4 } from "node:fs/promises";
 
 // src/manifest.ts
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { readdir, readFile as readFile2, realpath, stat as stat2 } from "node:fs/promises";
-import { join as join2, sep } from "node:path";
-import ignore from "ignore";
+import { readdir, readFile as readFile3, realpath as realpath2, stat as stat2 } from "node:fs/promises";
+import { join as join3, relative as relative2, sep as sep2 } from "node:path";
+import ignore2 from "ignore";
 import mime from "mime";
+
+// src/gitignore.ts
+import { execFile } from "node:child_process";
+import { readFile as readFile2, realpath } from "node:fs/promises";
+import { join as join2, relative, sep } from "node:path";
+import ignore from "ignore";
+var GIT_TIMEOUT_MS = 2e4;
+function git(cwd, args, input) {
+  return new Promise((resolve5) => {
+    try {
+      const child = execFile(
+        "git",
+        ["-C", cwd, ...args],
+        { timeout: GIT_TIMEOUT_MS, maxBuffer: 256 * 1024 * 1024, encoding: "utf8" },
+        (error, stdout) => {
+          const code = error?.code;
+          if (error && !(args[0] === "check-ignore" && code === 1)) resolve5(null);
+          else resolve5(stdout);
+        }
+      );
+      child.on("error", () => resolve5(null));
+      if (input !== void 0) child.stdin?.end(input);
+    } catch {
+      resolve5(null);
+    }
+  });
+}
+async function rootIsIgnored(top, root) {
+  const rel = relative(top, root);
+  if (!rel || rel.startsWith("..")) return false;
+  const segments = rel.split(sep);
+  const candidates = segments.map((_, i) => `${segments.slice(0, i + 1).join("/")}/`);
+  const out = await git(top, ["check-ignore", "--stdin", "-z"], `${candidates.join("\0")}\0`);
+  return out !== null && out.split("\0").some(Boolean);
+}
+function gitMode(entries) {
+  const files = /* @__PURE__ */ new Set();
+  const dirs = [];
+  for (const e of entries) {
+    if (!e) continue;
+    if (e.endsWith("/")) dirs.push(e);
+    else files.add(e);
+  }
+  const dirSet = new Set(dirs);
+  return {
+    mode: "git",
+    ignores(rel, isDir) {
+      if (isDir ? dirSet.has(`${rel}/`) : files.has(rel)) return true;
+      let i = rel.indexOf("/");
+      while (i !== -1) {
+        if (dirSet.has(rel.slice(0, i + 1))) return true;
+        i = rel.indexOf("/", i + 1);
+      }
+      return false;
+    },
+    async enterDir() {
+    }
+  };
+}
+function nestedMode() {
+  const levels = [];
+  return {
+    mode: "nested",
+    ignores(rel, isDir) {
+      for (const { base, ig } of levels) {
+        if (base && !rel.startsWith(`${base}/`)) continue;
+        const sub = base ? rel.slice(base.length + 1) : rel;
+        if (sub && ig.ignores(isDir ? `${sub}/` : sub)) return true;
+      }
+      return false;
+    },
+    async enterDir(absDir, relDir) {
+      let text2;
+      try {
+        text2 = await readFile2(join2(absDir, ".gitignore"), "utf8");
+      } catch {
+        return;
+      }
+      levels.push({ base: relDir, ig: ignore().add(text2) });
+    }
+  };
+}
+async function loadGitIgnore(root) {
+  const topOut = await git(root, ["rev-parse", "--show-toplevel"]);
+  const topRaw = topOut?.trim();
+  if (!topRaw) return nestedMode();
+  const top = await realpath(topRaw).catch(() => topRaw);
+  if (await rootIsIgnored(top, root)) return nestedMode();
+  const listed = await git(root, [
+    "ls-files",
+    "--others",
+    "--ignored",
+    "--exclude-standard",
+    "--directory",
+    "-z"
+  ]);
+  if (listed === null) return nestedMode();
+  return gitMode(listed.split("\0"));
+}
+
+// src/manifest.ts
 var IGNORE_FILE = ".flingignore";
 var NO_INDEX_WARNING = "No index.html at the top of the folder \u2014 the site root will 404.";
 var ALWAYS_SKIP = /* @__PURE__ */ new Set(["node_modules"]);
+var QUIET_DOT_ENTRIES = /* @__PURE__ */ new Set([".git", ".DS_Store"]);
+var SKIPPED_SHOWN = 5;
 var CHARSET_TYPES = /* @__PURE__ */ new Set([
   "application/javascript",
   "application/json",
@@ -1339,6 +1705,45 @@ var CHARSET_TYPES = /* @__PURE__ */ new Set([
   "application/xml",
   "image/svg+xml"
 ]);
+var SecretFilesError = class extends CliError {
+  constructor(paths) {
+    const shown = paths.slice(0, 20);
+    super(
+      `Not flung: ${paths.length === 1 ? "this is a secret file" : `these are ${paths.length} secret files`} (keys, certificates, credentials): ${shown.join(", ")}${paths.length > shown.length ? ` (+${paths.length - shown.length} more)` : ""}. ${NEVER_PUBLISHED_NOTE}`,
+      {
+        hint: `Move ${paths.length === 1 ? "it" : "them"} out of the folder, or add ${paths.length === 1 ? "it" : "them"} to ${IGNORE_FILE} if the site does not need ${paths.length === 1 ? "it" : "them"}.`
+      }
+    );
+    this.paths = paths;
+    this.name = "SecretFilesError";
+  }
+  code = "secret_file";
+};
+var SecretsFoundError = class extends CliError {
+  constructor(findings) {
+    const files = new Set(findings.map((f) => f.path)).size;
+    super(
+      `Not flung: found secrets in ${files} file${files === 1 ? "" : "s"}:
+  ${describeSecretFindings(findings).join("\n  ")}
+${NEVER_PUBLISHED_NOTE}`,
+      {
+        hint: `Remove the secret (and rotate it if it was ever shared), or add the file to ${IGNORE_FILE} if the site does not need it.`
+      }
+    );
+    this.findings = findings;
+    this.name = "SecretsFoundError";
+  }
+  code = "secret_detected";
+};
+function describeSkipped(skipped) {
+  const line = (n, what, names) => `Skipped ${n} ${what}${n === 1 ? "" : "s"} (${names.slice(0, SKIPPED_SHOWN).join(", ")}${n > SKIPPED_SHOWN ? ", \u2026" : ""}) \u2014 ${what}s are never flung`;
+  const lines = [];
+  if (skipped.dotfiles.length)
+    lines.push(line(skipped.dotfiles.length, "dotfile", skipped.dotfiles));
+  if (skipped.gitignored.length)
+    lines.push(line(skipped.gitignored.length, "gitignored file", skipped.gitignored));
+  return lines;
+}
 function contentTypeFor(path) {
   const type = mime.getType(path) ?? "application/octet-stream";
   return type.startsWith("text/") || CHARSET_TYPES.has(type) ? `${type}; charset=utf-8` : type;
@@ -1361,29 +1766,38 @@ function toManifest(local) {
 async function buildManifest(dir) {
   let root;
   try {
-    root = await realpath(dir);
+    root = await realpath2(dir);
   } catch {
     throw new CliError(`Folder not found: ${dir}`);
   }
   if (!(await stat2(root)).isDirectory()) throw new CliError(`Not a folder: ${dir}`);
   const ig = await loadIgnore(root);
+  const gitIgnore = await loadGitIgnore(root);
   const warnings = [];
+  const skipped = { dotfiles: [], gitignored: [] };
+  const secretFiles = [];
   const found = [];
   const visitedDirs = /* @__PURE__ */ new Set([root]);
-  const inside = (real) => real === root || real.startsWith(root + sep);
+  const inside = (real) => real === root || real.startsWith(root + sep2);
   async function walk2(realDir, relDir) {
+    await gitIgnore.enterDir(realDir, relDir);
     const entries = await readdir(realDir, { withFileTypes: true });
     entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const entry of entries) {
-      if (entry.name.startsWith(".") || ALWAYS_SKIP.has(entry.name)) continue;
       const rel = relDir ? `${relDir}/${entry.name}` : entry.name;
-      let abs = join2(realDir, entry.name);
+      if (entry.name.startsWith(".")) {
+        if (!QUIET_DOT_ENTRIES.has(entry.name))
+          skipped.dotfiles.push(entry.isDirectory() ? `${rel}/` : rel);
+        continue;
+      }
+      if (ALWAYS_SKIP.has(entry.name)) continue;
+      let abs = join3(realDir, entry.name);
       let isDir = entry.isDirectory();
       let isFile = entry.isFile();
       if (entry.isSymbolicLink()) {
         let target;
         try {
-          target = await realpath(abs);
+          target = await realpath2(abs);
         } catch {
           warnings.push(`Skipped broken symlink: ${rel}`);
           continue;
@@ -1393,17 +1807,38 @@ async function buildManifest(dir) {
           continue;
         }
         const info = await stat2(target);
+        const targetRel = relative2(root, target).split(sep2).join("/");
+        if (targetRel.split("/").some((seg) => seg.startsWith("."))) {
+          skipped.dotfiles.push(rel);
+          continue;
+        }
+        if (targetRel && gitIgnore.ignores(targetRel, info.isDirectory())) {
+          skipped.gitignored.push(rel);
+          continue;
+        }
         abs = target;
         isDir = info.isDirectory();
         isFile = info.isFile();
       }
       if (isDir) {
+        if (gitIgnore.ignores(rel, true)) {
+          skipped.gitignored.push(`${rel}/`);
+          continue;
+        }
         if (ig.ignores(`${rel}/`)) continue;
         if (visitedDirs.has(abs)) continue;
         visitedDirs.add(abs);
         await walk2(abs, rel);
       } else if (isFile) {
+        if (gitIgnore.ignores(rel, false)) {
+          skipped.gitignored.push(rel);
+          continue;
+        }
         if (ig.ignores(rel)) continue;
+        if (isSecretPath(rel)) {
+          secretFiles.push(rel);
+          continue;
+        }
         const { size } = await stat2(abs);
         found.push({ path: rel, absPath: abs, size });
         if (found.length > MAX_FILES) {
@@ -1415,21 +1850,34 @@ async function buildManifest(dir) {
     }
   }
   await walk2(root, "");
+  if (secretFiles.length > 0) throw new SecretFilesError(secretFiles);
   if (found.length === 0) {
     throw new CliError(
-      `Nothing to deploy: ${dir} has no files (dotfiles and node_modules are skipped)`
+      `Nothing to deploy: ${dir} has no files (dotfiles, gitignored files and node_modules are skipped)`
     );
   }
   checkLimits(found, dir);
   if (!found.some((f) => f.path === "index.html")) {
     warnings.push(NO_INDEX_WARNING);
   }
-  const files = await mapLimit(found, 16, async (f) => ({
-    ...f,
-    sha256: await sha256File(f.absPath),
-    contentType: contentTypeFor(f.path)
-  }));
-  return { root, files, totalBytes: files.reduce((n, f) => n + f.size, 0), warnings };
+  const findings = [];
+  const files = await mapLimit(found, 16, async (f) => {
+    let sha256;
+    if (f.size <= SECRET_SCAN_MAX_FILE_BYTES && isScannablePath(f.path)) {
+      const bytes = await readFile3(f.absPath);
+      sha256 = createHash("sha256").update(bytes).digest("hex");
+      findings.push(...scanBytesForSecrets(bytes, f.path));
+    } else sha256 = await sha256File(f.absPath);
+    return { ...f, sha256, contentType: contentTypeFor(f.path) };
+  });
+  if (findings.length > 0) {
+    throw new SecretsFoundError(
+      findings.sort(
+        (a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : a.line - b.line || a.rule.localeCompare(b.rule)
+      )
+    );
+  }
+  return { root, files, totalBytes: files.reduce((n, f) => n + f.size, 0), warnings, skipped };
 }
 function checkLimits(files, dir) {
   for (const f of files) {
@@ -1493,9 +1941,9 @@ async function withHtmlListing(local, siteName2) {
   };
 }
 async function loadIgnore(root) {
-  const ig = ignore();
+  const ig = ignore2();
   try {
-    ig.add(await readFile2(join2(root, IGNORE_FILE), "utf8"));
+    ig.add(await readFile3(join3(root, IGNORE_FILE), "utf8"));
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -1517,7 +1965,7 @@ async function mapLimit(items, limit, fn) {
 // src/naming.ts
 import { existsSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { basename, dirname, isAbsolute, relative, resolve, sep as sep2 } from "node:path";
+import { basename, dirname, isAbsolute, relative as relative3, resolve, sep as sep3 } from "node:path";
 var PROJECT_MARKERS = ["package.json", "pyproject.toml", "Cargo.toml", "go.mod"];
 var BUILD_OUTPUT_DIRS = /* @__PURE__ */ new Set([
   "dist",
@@ -1549,23 +1997,23 @@ function findProjectRoot(dir, env = {}) {
   const home = resolve(env.home ?? homedir2());
   const candidates = [];
   for (let d = resolve(dir); d !== home && dirname(d) !== d; d = dirname(d)) candidates.push(d);
-  return candidates.find((d) => exists(`${d}${sep2}.git`)) ?? candidates.find((d) => PROJECT_MARKERS.some((m) => exists(`${d}${sep2}${m}`))) ?? null;
+  return candidates.find((d) => exists(`${d}${sep3}.git`)) ?? candidates.find((d) => PROJECT_MARKERS.some((m) => exists(`${d}${sep3}${m}`))) ?? null;
 }
 var isGeneric = (segment) => segment.startsWith(".") || BUILD_OUTPUT_DIRS.has(segment.toLowerCase());
 function nameParts(dir, env = {}) {
   const abs = resolve(dir);
   const root = findProjectRoot(abs, env);
   if (!root) {
-    const fromHome = relative(resolve(env.home ?? homedir2()), abs);
+    const fromHome = relative3(resolve(env.home ?? homedir2()), abs);
     if (fromHome === "") return [];
     const underHome = fromHome && !fromHome.startsWith("..") && !isAbsolute(fromHome);
-    const segments = (underHome ? fromHome : abs).split(sep2).filter(Boolean);
+    const segments = (underHome ? fromHome : abs).split(sep3).filter(Boolean);
     const pick = [...segments].reverse().find((s) => !isGeneric(s)) ?? segments.at(-1);
     return pick ? [pick] : [];
   }
   const parts = [basename(root)];
-  const rel = relative(root, abs);
-  for (const raw of rel ? rel.split(sep2) : []) {
+  const rel = relative3(root, abs);
+  for (const raw of rel ? rel.split(sep3) : []) {
     if (isGeneric(raw) || CONTAINER_DIRS.has(raw.toLowerCase())) continue;
     const segment = raw.replace(BUILD_SUFFIX_RE, "");
     const slug = slugify(segment, 200);
@@ -1696,7 +2144,7 @@ async function deploy(deps, opts) {
 }
 async function uploadWithRetry(deps, file, url, headers) {
   const sleep = deps.sleep ?? defaultSleep2;
-  const body = file.content ?? await readFile3(file.absPath);
+  const body = file.content ?? await readFile4(file.absPath);
   for (let attempt = 0; ; attempt++) {
     try {
       await putUpload(deps.fetch, url, headers, body);
@@ -1714,9 +2162,9 @@ async function uploadWithRetry(deps, file, url, headers) {
 }
 
 // src/inputs.ts
-import { copyFile, mkdir as mkdir2, mkdtemp, readFile as readFile4, rm, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
+import { copyFile, mkdir as mkdir2, mkdtemp, readFile as readFile5, rm, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { basename as basename2, extname, join as join3, resolve as resolve2, sep as sep3 } from "node:path";
+import { basename as basename2, extname, join as join4, resolve as resolve2, sep as sep4 } from "node:path";
 import { unzipSync } from "fflate";
 function inputKind(path, isDirectory) {
   if (isDirectory) return "folder";
@@ -1734,7 +2182,7 @@ function defaultNameFor(path, isDirectory) {
   return isDirectory ? defaultSiteName(path) : fileSiteName(path);
 }
 async function tempFolder() {
-  const dir = await mkdtemp(join3(tmpdir(), "fling-"));
+  const dir = await mkdtemp(join4(tmpdir(), "fling-"));
   return { dir, cleanup: () => rm(dir, { recursive: true, force: true }) };
 }
 async function prepareInput(path) {
@@ -1747,32 +2195,44 @@ async function prepareInput(path) {
   const kind = inputKind(path, info.isDirectory());
   const defaultName = defaultNameFor(path, info.isDirectory());
   if (kind === "folder")
-    return { kind, source: path, dir: path, defaultName, cleanup: async () => {
-    } };
+    return {
+      kind,
+      source: path,
+      dir: path,
+      defaultName,
+      skippedDotfiles: [],
+      cleanup: async () => {
+      }
+    };
+  const file = basename2(path);
+  if (file.startsWith("."))
+    throw new CliError(`Not flung: ${file} is a dotfile. ${NEVER_PUBLISHED_NOTE}`);
+  if (kind === "file" && isSecretPath(file)) throw new SecretFilesError([file]);
   if (info.size > MAX_DEPLOY_BYTES)
     throw new CliError(
       `${basename2(path)} is ${formatBytes(info.size)}; the limit is ${formatBytes(MAX_DEPLOY_BYTES)}`
     );
   const tmp = await tempFolder();
+  const skippedDotfiles = [];
   try {
     if (kind === "html") {
       if (info.size > MAX_FILE_BYTES)
         throw new CliError(
           `${basename2(path)} is ${formatBytes(info.size)}; the limit is ${formatBytes(MAX_FILE_BYTES)} per file`
         );
-      await copyFile(path, join3(tmp.dir, "index.html"));
+      await copyFile(path, join4(tmp.dir, "index.html"));
     } else if (kind === "zip") {
-      await extractZip(await readFile4(path), tmp.dir);
+      await extractZip(await readFile5(path), tmp.dir, skippedDotfiles);
     } else {
       const name = basename2(path);
-      await copyFile(path, join3(tmp.dir, name));
-      await writeFile2(join3(tmp.dir, "index.html"), wrapperPage(name));
+      await copyFile(path, join4(tmp.dir, name));
+      await writeFile2(join4(tmp.dir, "index.html"), wrapperPage(name));
     }
   } catch (error) {
     await tmp.cleanup();
     throw error;
   }
-  return { kind, source: path, dir: tmp.dir, defaultName, cleanup: tmp.cleanup };
+  return { kind, source: path, dir: tmp.dir, defaultName, skippedDotfiles, cleanup: tmp.cleanup };
 }
 var JUNK_FILES = /* @__PURE__ */ new Set(["thumbs.db", "desktop.ini"]);
 function zipEntryPath(name) {
@@ -1795,7 +2255,16 @@ function unwrapSingleFolder(paths) {
     current = current.map((p) => p.slice(first.length + 1));
   }
 }
-async function extractZip(data, dest) {
+function zipDotEntry(name) {
+  const segments = name.replace(/\\/g, "/").split("/").filter((s) => s !== "" && s !== ".");
+  if (segments[0] === "__MACOSX") return null;
+  const i = segments.findIndex((s) => s.startsWith("."));
+  if (i === -1) return null;
+  const seg = segments[i];
+  if (seg === ".DS_Store" || seg === ".git" || seg.startsWith("._")) return null;
+  return i < segments.length - 1 ? `${segments.slice(0, i + 1).join("/")}/` : segments.join("/");
+}
+async function extractZip(data, dest, skippedDotfiles = []) {
   const unsafe = [];
   let declared = 0;
   let count = 0;
@@ -1808,7 +2277,11 @@ async function extractZip(data, dest) {
           unsafe.push(file.name);
           return false;
         }
-        if (path === null) return false;
+        if (path === null) {
+          const dot = zipDotEntry(file.name);
+          if (dot && !skippedDotfiles.includes(dot)) skippedDotfiles.push(dot);
+          return false;
+        }
         count++;
         declared += file.originalSize;
         if (file.originalSize > MAX_FILE_BYTES)
@@ -1849,8 +2322,8 @@ async function extractZip(data, dest) {
       throw new CliError(`The zip expands to more than the limits allow`);
     const rel = paths.get(name);
     const target = resolve2(root, ...rel.split("/"));
-    if (!target.startsWith(root + sep3)) throw new CliError(`Unsafe path in the zip: ${name}`);
-    await mkdir2(join3(target, ".."), { recursive: true });
+    if (!target.startsWith(root + sep4)) throw new CliError(`Unsafe path in the zip: ${name}`);
+    await mkdir2(join4(target, ".."), { recursive: true });
     await writeFile2(target, content);
     written.push(rel);
   }
@@ -1890,63 +2363,548 @@ function wrapperPage(file) {
 `;
 }
 
-// src/locate.ts
-import { lstat, readdir as readdir2, readFile as readFile5, realpath as realpath2, stat as stat4 } from "node:fs/promises";
-import { posix, win32 } from "node:path";
-import { fileURLToPath } from "node:url";
-var DOWNLOADS_DIR_ENV = "FLING_DOWNLOADS_DIR";
-var FOUND_AS_GIVEN = "path";
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "__MACOSX", "Library", "AppData", "$RECYCLE.BIN"]);
-var SESSION_SKIP_DIRS = /* @__PURE__ */ new Set(["skills-plugin", "rpm", "uploads", "memory"]);
-var SESSIONS_DEPTH = 4;
-var OUTPUTS_DEPTH = 4;
-var SANDBOX_PATH_RE = /^\/(mnt\/user-data|mnt\/data|sessions|home\/claude|tmp\/outputs)(\/|$)/;
-var nodeFs = {
-  async stat(path) {
-    try {
-      const s = await stat4(path);
-      return { isFile: s.isFile(), isDirectory: s.isDirectory(), mtimeMs: s.mtimeMs, size: s.size };
-    } catch {
-      return null;
-    }
-  },
-  async readdir(path) {
-    try {
-      const entries = await readdir2(path, { withFileTypes: true });
-      const out = [];
-      for (const e of entries) {
-        if (e.isSymbolicLink()) {
-          const s = await stat4(`${path}/${e.name}`).catch(() => null);
-          out.push({ name: e.name, isFile: Boolean(s?.isFile()), isDirectory: false });
-        } else out.push({ name: e.name, isFile: e.isFile(), isDirectory: e.isDirectory() });
+// src/commands/deploy.ts
+async function runDeploy(ctx, input, opts) {
+  const client = requireClient(ctx);
+  const ask = ctx.interactive && !opts.yes;
+  const base = ask ? await discoverSitesBase(client) : sitesBaseFor(client.serverUrl);
+  const path = resolve3(input ?? ".");
+  if (!await stat4(path).catch(() => null))
+    throw new CliError(`No such file or folder: ${input ?? "."}`, {
+      hint: `Give the path to a folder, .html, .zip or other file, e.g. \`${ctx.binName} deploy ./dist\`.`
+    });
+  const prepared = await prepareInput(path);
+  try {
+    await deployPrepared(ctx, client, base, prepared, opts, ask);
+  } finally {
+    await prepared.cleanup();
+  }
+}
+async function deployPrepared(ctx, client, base, prepared, opts, ask) {
+  let local = await buildManifest(prepared.dir);
+  local.skipped.dotfiles.unshift(...prepared.skippedDotfiles);
+  for (const line of describeSkipped(local.skipped)) ctx.log.info(line);
+  let name = opts.name !== void 0 ? resolveSiteName(prepared.dir, opts.name) : prepared.defaultName;
+  if (opts.name === void 0 && ask) name = await confirmSiteName(ctx, client, name, base);
+  if (!hasRootIndex(local)) {
+    const pages = htmlPages(local).length;
+    const root = base ? siteUrlFor(name, base) : "the site root";
+    const warning = `No index.html at the root \u2014 ${root} will show a 404.`;
+    const choice = opts.listHtml === true ? "list" : opts.listHtml === false ? "fling" : ask ? await askNoIndex(ctx, pages) : pages > 0 ? "list" : "fling";
+    if (choice === "list") {
+      local = await withHtmlListing(local, name);
+      ctx.log.info(`Generated index.html listing ${pages} HTML page${pages === 1 ? "" : "s"}`);
+    } else ctx.log.warn(warning);
+  }
+  let progressShown = false;
+  const result = await deploy(
+    { client, fetch: ctx.fetch },
+    {
+      dir: prepared.dir,
+      name,
+      manifest: local,
+      spa: opts.spa ? true : void 0,
+      public: opts.public,
+      onProgress: (p) => {
+        if (p.total === 0) return;
+        progressShown = true;
+        ctx.progress(
+          `${progressBar(p.totalBytes ? p.bytes / p.totalBytes : p.uploaded / p.total)} uploading ${p.uploaded}/${p.total} files \xB7 ${formatBytes(p.bytes)}/${formatBytes(p.totalBytes)}`
+        );
       }
-      return out;
-    } catch {
-      return [];
     }
-  },
-  async realpath(path) {
-    return realpath2(path).catch(() => null);
-  },
-  async readText(path) {
-    try {
-      if (!(await lstat(path)).isFile()) return null;
-      return await readFile5(path, "utf8");
-    } catch {
-      return null;
+  ).finally(() => {
+    if (progressShown) ctx.progress(null);
+  });
+  for (const warning of result.warnings) if (warning !== NO_INDEX_WARNING) ctx.log.warn(warning);
+  const summary = `${result.fileCount} files, ${formatBytes(result.totalBytes)}`;
+  if (result.status === "unchanged") ctx.log.info(`Unchanged ${chalk6.dim(`(${summary})`)}`);
+  else if (result.status === "repointed")
+    ctx.log.success(`Restored version ${result.versionId} ${chalk6.dim(`(${summary})`)}`);
+  else
+    ctx.log.success(
+      `Deployed ${result.name} ${chalk6.dim(`(${summary}; uploaded ${result.uploaded}, version ${result.versionId})`)}`
+    );
+  const ready = result.status === "unchanged" ? true : (await waitWithSpinner(
+    ctx.waitReady,
+    result.url,
+    local.files.map((f) => f.path),
+    { progress: ctx.progress, warn: (m) => ctx.log.warn(m) }
+  )).ready;
+  const privateNote = `Private: Nearform sign-in required. Share publicly with \`${ctx.binName} share ${result.name}\`.`;
+  ctx.out.data({ status: result.status, site: result.site, ready, skipped: local.skipped }, () => {
+    const isPrivate = result.site.visibility === "private";
+    if (ctx.out.tty)
+      return box(
+        [brand.url(result.url), ...isPrivate ? [chalk6.dim(privateNote)] : []],
+        isPrivate ? chalk6.bold("flung \xB7 private") : chalk6.bold("flung \xB7 public")
+      );
+    const lines = [chalk6.bold(result.url)];
+    if (isPrivate) lines.push(chalk6.dim(privateNote));
+    return lines.join("\n");
+  });
+}
+var BAR_WIDTH = 20;
+function progressBar(fraction) {
+  const done = Math.round(Math.min(Math.max(fraction, 0), 1) * BAR_WIDTH);
+  return brand.primary("\u2501".repeat(done)) + chalk6.dim("\u2500".repeat(BAR_WIDTH - done));
+}
+async function askNoIndex(ctx, pages) {
+  const question = pages > 0 ? "No index.html at the root. [L]ist the HTML pages on a generated index page / [f]ling anyway (the root will 404) / [a]bort " : "No index.html at the root (and no HTML pages to list). [f]ling anyway (the root will 404) / [A]bort ";
+  for (; ; ) {
+    const answer = (await ctx.prompt(question)).trim().toLowerCase();
+    if (pages > 0 && (answer === "" || answer === "l" || answer === "list")) return "list";
+    if (answer === "f" || answer === "fling") return "fling";
+    if (answer === "a" || answer === "abort" || answer === "n" || answer === "no" || answer === "")
+      throw new CliError("Not flung: no index.html at the root", {
+        hint: "Fling the folder that contains index.html (your build output, e.g. ./dist), or pass --list-html / --no-list-html."
+      });
+  }
+}
+async function confirmSiteName(ctx, client, generated, base) {
+  const where = (n) => base ? ` \u2192 ${siteUrlFor(n, base)}` : "";
+  const describe = (n, note) => ctx.log.info(`Site name: ${chalk6.bold(n)}${where(n)}  ${chalk6.dim(`(${note})`)}`);
+  let candidate = generated;
+  for (; ; ) {
+    const check2 = await checkName(client, candidate);
+    let proposal;
+    if (check2.status === "available" || check2.status === "yours") {
+      proposal = candidate;
+      describe(candidate, check2.status === "yours" ? "updates your existing site" : "new");
+    } else {
+      const why = check2.status === "taken" ? "is taken" : "is not a valid site name";
+      const alternatives = check2.suggestions.length ? ` Suggestions: ${check2.suggestions.join(", ")}` : "";
+      ctx.log.warn(`${candidate} ${why}.${alternatives}`);
+      proposal = check2.suggestions[0];
+      if (proposal) describe(proposal, "new");
+    }
+    for (; ; ) {
+      const question = proposal ? `Use "${proposal}"? [Y/n or type another name] ` : "Type a site name (or n to abort): ";
+      const answer = (await ctx.prompt(question)).trim();
+      if (proposal && (answer === "" || /^y(es)?$/i.test(answer))) return proposal;
+      if (/^no?$/i.test(answer))
+        throw new CliError("Aborted \u2014 nothing was flung", {
+          hint: "Pass --name <name> to choose the site name up front."
+        });
+      if (answer === "") continue;
+      if (!isValidSiteName(answer)) {
+        ctx.log.warn(
+          `"${answer}" is not a valid site name: use lowercase letters, digits and single hyphens (max ${SITE_NAME_MAX}); some names are reserved.`
+        );
+        continue;
+      }
+      candidate = answer;
+      break;
     }
   }
-};
-var pathFor = (platform) => platform === "win32" ? win32 : posix;
-var usable = (value) => Boolean(value?.trim()) && !value?.trim().startsWith("${");
-async function xdgUserDir(key, opts, fs) {
-  const fromEnv2 = opts.env[`XDG_${key}_DIR`];
-  if (usable(fromEnv2)) return fromEnv2;
-  const configHome = opts.env.XDG_CONFIG_HOME || posix.join(opts.home, ".config");
-  const text = await fs.readText(posix.join(configHome, "user-dirs.dirs"));
-  const match = text?.match(new RegExp(`^XDG_${key}_DIR="([^"]*)"`, "m"));
-  if (!match?.[1]) return void 0;
-  return match[1].replace(/^\$HOME(?=\/|$)/, opts.home);
+}
+
+// src/commands/setup.ts
+import { intro, outro, spinner } from "@clack/prompts";
+import chalk7 from "chalk";
+
+// src/claude.ts
+import { execFile as execFile2 } from "node:child_process";
+import { access, mkdtemp as mkdtemp2, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir3, tmpdir as tmpdir2 } from "node:os";
+import { join as join5 } from "node:path";
+var MARKETPLACE_SOURCE = "nearform/fling";
+var MARKETPLACE_NAME = "fling";
+var PLUGIN_NAME = "fling";
+var PLUGIN_ID = `${PLUGIN_NAME}@${MARKETPLACE_NAME}`;
+var MCPB_PATH = "/downloads/fling.mcpb";
+var runClaude = (args) => new Promise((resolve5) => {
+  execFile2(
+    "claude",
+    [...args],
+    { timeout: 12e4, maxBuffer: 16 * 1024 * 1024, shell: process.platform === "win32" },
+    (error, stdout, stderr) => {
+      const missing = error?.code === "ENOENT";
+      const code = !error ? 0 : missing ? -1 : typeof error.code === "number" ? error.code : 1;
+      resolve5({ code, stdout: String(stdout), stderr: String(stderr) });
+    }
+  );
+});
+async function claudeCodeStatus(run) {
+  const version = await run(["--version"]);
+  if (version.code !== 0) return { claude: "missing" };
+  const claude = version.stdout.trim().split(/\s+/)[0] ?? "unknown";
+  const list = await run(["plugin", "list", "--json"]);
+  let plugins = [];
+  try {
+    plugins = JSON.parse(list.stdout);
+  } catch {
+  }
+  const fling = Array.isArray(plugins) ? plugins.find((p) => p.id === PLUGIN_ID) : void 0;
+  if (!fling) return { claude, installed: false };
+  return {
+    claude,
+    installed: true,
+    version: fling.version,
+    scope: fling.scope,
+    enabled: fling.enabled
+  };
+}
+async function installPlugin(run, scope) {
+  check(
+    await run(["plugin", "install", PLUGIN_NAME, "--marketplace", MARKETPLACE_SOURCE, "-s", scope]),
+    "install the Fling plugin"
+  );
+}
+async function updatePlugin(run, scope) {
+  check(await run(["plugin", "marketplace", "update", MARKETPLACE_NAME]), "update the marketplace");
+  check(
+    await run(["plugin", "update", PLUGIN_ID, ...scope ? ["-s", scope] : []]),
+    "update the Fling plugin"
+  );
+}
+function check(result, what) {
+  if (result.code === 0) return;
+  const detail = (result.stderr || result.stdout).trim().split("\n").at(-1);
+  throw new Error(`Could not ${what}${detail ? `: ${detail}` : ""}`);
+}
+async function findClaudeDesktop(platform = process.platform, env = process.env, exists = (path) => access(path).then(
+  () => true,
+  () => false
+)) {
+  const candidates = platform === "darwin" ? ["/Applications/Claude.app", join5(homedir3(), "Applications", "Claude.app")] : platform === "win32" && env.LOCALAPPDATA ? [join5(env.LOCALAPPDATA, "AnthropicClaude"), join5(env.LOCALAPPDATA, "Programs", "Claude")] : [];
+  for (const path of candidates) if (await exists(path)) return path;
+  return null;
+}
+async function downloadExtension(serverUrl, fetch2) {
+  const url = new URL(MCPB_PATH, serverUrl).toString();
+  const response = await fetch2(url);
+  if (!response.ok) throw new Error(`Could not download ${url} (HTTP ${response.status})`);
+  const dir = await mkdtemp2(join5(tmpdir2(), "fling-mcpb-"));
+  const file = join5(dir, "fling.mcpb");
+  await writeFile3(file, Buffer.from(await response.arrayBuffer()));
+  return file;
+}
+
+// src/commands/setup.ts
+var SCOPES = ["user", "project", "local"];
+async function runSetup(baseCtx, opts, deps = {}) {
+  const scope = opts.scope ?? "user";
+  if (!SCOPES.includes(scope))
+    throw new CliError(`--scope must be one of ${SCOPES.join(", ")}, not "${opts.scope}"`);
+  const run = deps.runClaude ?? runClaude;
+  const ask = baseCtx.interactive && !opts.yes;
+  const fancy = baseCtx.interactive && !baseCtx.json;
+  const ctx = fancy ? {
+    ...baseCtx,
+    log: createLogger({
+      debug: baseCtx.config.debug,
+      write: (line) => process.stderr.write(`${chalk7.gray("\u2502")}  ${line}
+`)
+    })
+  } : baseCtx;
+  if (fancy) {
+    process.stderr.write(`${logo()}
+`);
+    intro(chalk7.bold(" fling setup "), { output: process.stderr });
+  }
+  const results = {
+    login: await stepLogin(ctx),
+    claudeCode: "skipped",
+    claudeDesktop: "skipped"
+  };
+  results.claudeCode = await stepClaudeCode(ctx, run, scope, ask, fancy);
+  results.claudeDesktop = await stepClaudeDesktop(ctx, deps, ask, fancy);
+  const failed = Object.values(results).includes("failed");
+  if (fancy)
+    outro(
+      failed ? chalk7.yellow("Setup finished with problems \u2014 see above, then run `fling setup` again.") : `You're set. Try ${chalk7.bold(`${ctx.binName} deploy ./dist`)}, or ask Claude to \u201Cfling this\u201D.`,
+      { output: process.stderr }
+    );
+  ctx.out.data(results, () => "");
+  if (failed) process.exitCode = 1;
+}
+async function stepLogin(ctx) {
+  if (ctx.config.apiKey) {
+    try {
+      const me = await whoami(requireClient(ctx));
+      ctx.log.success(`Signed in as ${chalk7.bold(me.name)} ${chalk7.dim(`<${me.email}>`)}`);
+      return "already";
+    } catch (error) {
+      if (exitCodeFor(error) !== 2) {
+        ctx.log.error(error instanceof Error ? error.message : String(error));
+        return "failed";
+      }
+      ctx.log.warn("The stored API key no longer works \u2014 signing in again");
+    }
+  }
+  try {
+    await runLogin({ ...ctx, json: false });
+    return "done";
+  } catch (error) {
+    ctx.log.error(error instanceof Error ? error.message : String(error));
+    return "failed";
+  }
+}
+async function stepClaudeCode(ctx, run, scope, ask, fancy) {
+  const status = await claudeCodeStatus(run);
+  if (status.claude === "missing") {
+    ctx.log.info(`Claude Code not found ${chalk7.dim("(no `claude` on your PATH) \u2014 skipped")}`);
+    ctx.log.hint(
+      `Once it is installed, run \`${ctx.binName} setup\` again, or in Claude Code: /plugin marketplace add ${MARKETPLACE_SOURCE} then /plugin install ${PLUGIN_ID}`
+    );
+    return "missing";
+  }
+  const installed = "installed" in status && status.installed;
+  const question = installed ? `The Fling plugin is installed in Claude Code${status.version ? ` (${status.version})` : ""}. Update it to the latest?` : "Install the Fling plugin (skill + MCP server) into Claude Code?";
+  if (ask && !await ctx.confirm(question)) {
+    ctx.log.info(chalk7.dim("Claude Code plugin: skipped"));
+    return installed ? "already" : "skipped";
+  }
+  const s = fancy ? spinner({ output: process.stderr }) : null;
+  s?.start(installed ? "Updating the Claude Code plugin" : "Installing the Claude Code plugin");
+  try {
+    if (installed) await updatePlugin(run, status.scope);
+    else await installPlugin(run, scope);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (s) s.error(message);
+    else ctx.log.error(message);
+    return "failed";
+  }
+  const done = installed ? `Claude Code plugin ${PLUGIN_NAME} is up to date` : `Claude Code plugin ${PLUGIN_NAME} installed ${chalk7.dim(`(${scope} scope)`)}`;
+  if (s) s.stop(done);
+  else ctx.log.success(done);
+  ctx.log.hint("Restart Claude Code (or run /reload-plugins) to pick it up.");
+  return installed ? "updated" : "done";
+}
+async function stepClaudeDesktop(ctx, deps, ask, fancy) {
+  const app = await (deps.findClaudeDesktop ?? findClaudeDesktop)();
+  if (!app) return "missing";
+  if (ask && !await ctx.confirm("Add the Fling extension to Claude Desktop too?")) {
+    ctx.log.info(chalk7.dim("Claude Desktop extension: skipped"));
+    return "skipped";
+  }
+  const s = fancy ? spinner({ output: process.stderr }) : null;
+  s?.start("Downloading the Claude Desktop extension");
+  try {
+    const file = await (deps.downloadExtension ?? ((serverUrl) => downloadExtension(serverUrl, ctx.fetch)))(ctx.config.serverUrl);
+    await ctx.open(file);
+    const done = "Opened fling.mcpb in Claude Desktop \u2014 click Install there to finish";
+    if (s) s.stop(done);
+    else ctx.log.success(done);
+    return "done";
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (s) s.error(message);
+    else ctx.log.error(message);
+    return "failed";
+  }
+}
+
+// src/commands/sites.ts
+import chalk8 from "chalk";
+async function runList(ctx, opts) {
+  const sites = await listSites(requireClient(ctx), opts);
+  ctx.out.data(
+    { sites },
+    () => renderTable(sites, [
+      { header: "NAME", value: (s) => s.name },
+      { header: "URL", value: (s) => s.url },
+      {
+        header: "VISIBILITY",
+        value: (s) => s.archived ? `${s.visibility} (archived)` : s.visibility
+      },
+      { header: "SHARE", value: (s) => s.shareUrl },
+      { header: "UPDATED", value: (s) => formatDate(s.updatedAt) }
+    ])
+  );
+}
+function describeSite(site) {
+  const row = (label, value) => `${chalk8.bold(`${label}:`.padEnd(12))}${value}`;
+  return [
+    row("Name", site.name),
+    row("URL", site.url),
+    row("Visibility", site.visibility + (site.archived ? chalk8.yellow(" (archived)") : "")),
+    row("SPA", site.spa ? "yes" : "no"),
+    row("Share link", site.shareUrl ?? "-"),
+    row("Version", site.currentVersionId ?? "-"),
+    ...filesRow(site, row),
+    row("Created", formatDate(site.createdAt)),
+    row("Updated", formatDate(site.updatedAt))
+  ];
+}
+function filesRow(site, row) {
+  const current = site.versions?.find((v) => v.id === site.currentVersionId);
+  if (!current) return [];
+  const n = current.fileCount;
+  return [row("Files", `${n} file${n === 1 ? "" : "s"}, ${formatBytes(current.totalBytes)}`)];
+}
+async function runInfo(ctx, name) {
+  const site = await getSite(requireClient(ctx), name);
+  ctx.out.data(
+    site,
+    () => [
+      ...describeSite(site),
+      "",
+      chalk8.dim(
+        `${site.versions.length} version(s) \u2014 \`fling versions ${name}\`; files \u2014 \`fling files ${name}\``
+      )
+    ].join("\n")
+  );
+}
+async function runVersions(ctx, name) {
+  const site = await getSite(requireClient(ctx), name);
+  ctx.out.data(
+    { name: site.name, currentVersionId: site.currentVersionId, versions: site.versions },
+    () => renderTable(site.versions, [
+      { header: "", value: (v) => v.id === site.currentVersionId ? "*" : " " },
+      { header: "VERSION", value: (v) => v.id },
+      { header: "FILES", value: (v) => v.fileCount },
+      { header: "SIZE", value: (v) => formatBytes(v.totalBytes) },
+      { header: "CREATED", value: (v) => formatDate(v.createdAt) }
+    ])
+  );
+}
+async function runFiles(ctx, name, versionId) {
+  const result = await versionFiles(requireClient(ctx), name, versionId);
+  if (!result.files.some((f) => f.path === "index.html")) {
+    ctx.log.warn("No index.html at the root \u2014 the site root URL will 404");
+  }
+  ctx.out.data(result, () => {
+    const n = result.files.length;
+    const header = chalk8.dim(
+      `${result.versionId}${result.current ? " (current)" : " (not served)"} \u2014 ${n} file${n === 1 ? "" : "s"}, ${formatBytes(result.totalBytes)}${result.generatedIndex ? ", generated index.html" : ""}`
+    );
+    const table = renderTable(result.files, [
+      { header: "PATH", value: (f) => f.path },
+      { header: "SIZE", value: (f) => formatBytes(f.size) },
+      { header: "TYPE", value: (f) => f.contentType }
+    ]);
+    return `${header}
+${table}`;
+  });
+}
+async function runRollback(ctx, name, versionId) {
+  const site = await rollback(requireClient(ctx), name, versionId);
+  ctx.log.success(`${name} now serves version ${site.currentVersionId ?? versionId}`);
+  ctx.out.data(site, () => site.url);
+}
+async function runShare(ctx, name, opts) {
+  if (opts.refresh && opts.revoke) throw new CliError("Use either --refresh or --revoke, not both");
+  const client = requireClient(ctx);
+  const result = await share(client, name, opts);
+  let ready;
+  if (result.action === "created" || result.action === "refreshed") {
+    const files = ctx.waitReady ? await versionFiles(client, name).catch(() => null) : null;
+    ready = (await waitWithSpinner(ctx.waitReady, result.shareUrl, files?.files.map((f) => f.path) ?? [], {
+      progress: ctx.progress,
+      warn: (m) => ctx.log.warn(m)
+    })).ready;
+  }
+  if (result.action === "revoked") ctx.log.success(`Share link for ${name} revoked`);
+  else if (result.action === "refreshed")
+    ctx.log.success("New share link \u2014 the old one no longer works");
+  else if (result.action === "created")
+    ctx.log.success("Share link created \u2014 anyone with it can view the site");
+  ctx.out.data(
+    ready === void 0 ? result : { ...result, ready },
+    () => result.shareUrl ? result.shareUrl : chalk8.dim("(no share link)")
+  );
+}
+async function runVisibility(ctx, name, visibility) {
+  if (visibility !== "private" && visibility !== "public") {
+    throw new CliError(`Visibility must be "private" or "public", not "${visibility}"`);
+  }
+  const site = await setVisibility(requireClient(ctx), name, visibility);
+  ctx.log.success(
+    site.visibility === "public" ? `${name} is public \u2014 no sign-in needed` : `${name} is private \u2014 Nearform sign-in required`
+  );
+  ctx.out.data(site, () => site.url);
+}
+async function runArchive(ctx, name, unarchive = false) {
+  const site = await archiveSite(requireClient(ctx), name, { unarchive });
+  ctx.log.success(
+    unarchive ? `${name} restored` : `${name} archived \u2014 it 404s until \`fling unarchive ${name}\``
+  );
+  if (ctx.json) ctx.out.data(site, () => "");
+  else if (unarchive) ctx.out.text(site.url);
+}
+async function runRemove(ctx, name, opts) {
+  if (!opts.yes) {
+    if (!ctx.interactive) {
+      throw new CliError(`Refusing to delete ${name} without confirmation`, {
+        hint: "Pass --yes to delete."
+      });
+    }
+    const ok = await ctx.confirm(`Delete ${name} and every version of it? This cannot be undone.`);
+    if (!ok) throw new CliError("Cancelled");
+  }
+  const result = await deleteSite(requireClient(ctx), name);
+  ctx.log.success(`${name} deleted`);
+  if (ctx.json) ctx.out.data(result, () => "");
+}
+
+// src/mcp.ts
+import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm2, writeFile as writeFile4 } from "node:fs/promises";
+import { tmpdir as tmpdir3 } from "node:os";
+import { basename as basename3, dirname as dirname2, join as join6 } from "node:path";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z as z7 } from "zod";
+
+// src/locate.ts
+import { lstat, readdir as readdir2, readFile as readFile6, realpath as realpath3, stat as stat5 } from "node:fs/promises";
+import { posix, win32 } from "node:path";
+import { fileURLToPath } from "node:url";
+var DOWNLOADS_DIR_ENV = "FLING_DOWNLOADS_DIR";
+var FOUND_AS_GIVEN = "path";
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "__MACOSX", "Library", "AppData", "$RECYCLE.BIN"]);
+var SESSION_SKIP_DIRS = /* @__PURE__ */ new Set(["skills-plugin", "rpm", "uploads", "memory"]);
+var SESSIONS_DEPTH = 4;
+var OUTPUTS_DEPTH = 4;
+var SANDBOX_PATH_RE = /^\/(mnt\/user-data|mnt\/data|sessions|home\/claude|tmp\/outputs)(\/|$)/;
+var nodeFs = {
+  async stat(path) {
+    try {
+      const s = await stat5(path);
+      return { isFile: s.isFile(), isDirectory: s.isDirectory(), mtimeMs: s.mtimeMs, size: s.size };
+    } catch {
+      return null;
+    }
+  },
+  async readdir(path) {
+    try {
+      const entries = await readdir2(path, { withFileTypes: true });
+      const out = [];
+      for (const e of entries) {
+        if (e.isSymbolicLink()) {
+          const s = await stat5(`${path}/${e.name}`).catch(() => null);
+          out.push({ name: e.name, isFile: Boolean(s?.isFile()), isDirectory: false });
+        } else out.push({ name: e.name, isFile: e.isFile(), isDirectory: e.isDirectory() });
+      }
+      return out;
+    } catch {
+      return [];
+    }
+  },
+  async realpath(path) {
+    return realpath3(path).catch(() => null);
+  },
+  async readText(path) {
+    try {
+      if (!(await lstat(path)).isFile()) return null;
+      return await readFile6(path, "utf8");
+    } catch {
+      return null;
+    }
+  }
+};
+var pathFor = (platform) => platform === "win32" ? win32 : posix;
+var usable = (value) => Boolean(value?.trim()) && !value?.trim().startsWith("${");
+async function xdgUserDir(key, opts, fs) {
+  const fromEnv2 = opts.env[`XDG_${key}_DIR`];
+  if (usable(fromEnv2)) return fromEnv2;
+  const configHome = opts.env.XDG_CONFIG_HOME || posix.join(opts.home, ".config");
+  const text2 = await fs.readText(posix.join(configHome, "user-dirs.dirs"));
+  const match = text2?.match(new RegExp(`^XDG_${key}_DIR="([^"]*)"`, "m"));
+  if (!match?.[1]) return void 0;
+  return match[1].replace(/^\$HOME(?=\/|$)/, opts.home);
 }
 async function searchRoots(opts) {
   const fs = opts.fs ?? nodeFs;
@@ -2178,286 +3136,7 @@ async function findFiles(opts, find = {}) {
   return { files, searched: roots, complete };
 }
 
-// src/commands/deploy.ts
-async function runDeploy(ctx, input, opts) {
-  const client = requireClient(ctx);
-  const ask = ctx.interactive && !opts.yes;
-  const base = ask ? await discoverSitesBase(client) : sitesBaseFor(client.serverUrl);
-  const located = await resolveInput(input ?? ".", ctx.locate ?? systemLocateOptions());
-  if (located.foundIn !== FOUND_AS_GIVEN) {
-    ctx.log.info(`Found in ${located.foundIn}: ${located.path}`);
-    if (located.alternatives.length)
-      ctx.log.hint(
-        `Also found (older): ${located.alternatives.map((a) => a.path).join(", ")} \u2014 pass the full path to fling another.`
-      );
-  }
-  const prepared = await prepareInput(located.path);
-  try {
-    await deployPrepared(ctx, client, base, prepared, opts, ask);
-  } finally {
-    await prepared.cleanup();
-  }
-}
-async function deployPrepared(ctx, client, base, prepared, opts, ask) {
-  let local = await buildManifest(prepared.dir);
-  let name = opts.name !== void 0 ? resolveSiteName(prepared.dir, opts.name) : prepared.defaultName;
-  if (opts.name === void 0 && ask) name = await confirmSiteName(ctx, client, name, base);
-  if (!hasRootIndex(local)) {
-    const pages = htmlPages(local).length;
-    const root = base ? siteUrlFor(name, base) : "the site root";
-    const warning = `No index.html at the root \u2014 ${root} will show a 404.`;
-    const choice = opts.listHtml === true ? "list" : opts.listHtml === false ? "fling" : ask ? await askNoIndex(ctx, pages) : pages > 0 ? "list" : "fling";
-    if (choice === "list") {
-      local = await withHtmlListing(local, name);
-      ctx.log.info(`Generated index.html listing ${pages} HTML page${pages === 1 ? "" : "s"}`);
-    } else ctx.log.warn(warning);
-  }
-  let progressShown = false;
-  const result = await deploy(
-    { client, fetch: ctx.fetch },
-    {
-      dir: prepared.dir,
-      name,
-      manifest: local,
-      spa: opts.spa ? true : void 0,
-      public: opts.public,
-      onProgress: (p) => {
-        if (p.total === 0) return;
-        progressShown = true;
-        ctx.progress(
-          `${chalk5.cyan("fling")} uploading ${p.uploaded}/${p.total} files \xB7 ${formatBytes(p.bytes)}/${formatBytes(p.totalBytes)}`
-        );
-      }
-    }
-  ).finally(() => {
-    if (progressShown) ctx.progress(null);
-  });
-  for (const warning of result.warnings) if (warning !== NO_INDEX_WARNING) ctx.log.warn(warning);
-  const summary = `${result.fileCount} files, ${formatBytes(result.totalBytes)}`;
-  if (result.status === "unchanged") ctx.log.info(`Unchanged ${chalk5.dim(`(${summary})`)}`);
-  else if (result.status === "repointed")
-    ctx.log.success(`Restored version ${result.versionId} ${chalk5.dim(`(${summary})`)}`);
-  else
-    ctx.log.success(
-      `Deployed ${result.name} ${chalk5.dim(`(${summary}; uploaded ${result.uploaded}, version ${result.versionId})`)}`
-    );
-  const ready = result.status === "unchanged" ? true : (await waitWithSpinner(
-    ctx.waitReady,
-    result.url,
-    local.files.map((f) => f.path),
-    { progress: ctx.progress, warn: (m) => ctx.log.warn(m) }
-  )).ready;
-  ctx.out.data({ status: result.status, site: result.site, ready }, () => {
-    const lines = [chalk5.bold(result.url)];
-    if (result.site.visibility === "private")
-      lines.push(
-        chalk5.dim(
-          `Private: Nearform sign-in required. Share publicly with \`${ctx.binName} share ${result.name}\`.`
-        )
-      );
-    return lines.join("\n");
-  });
-}
-async function askNoIndex(ctx, pages) {
-  const question = pages > 0 ? "No index.html at the root. [L]ist the HTML pages on a generated index page / [f]ling anyway (the root will 404) / [a]bort " : "No index.html at the root (and no HTML pages to list). [f]ling anyway (the root will 404) / [A]bort ";
-  for (; ; ) {
-    const answer = (await ctx.prompt(question)).trim().toLowerCase();
-    if (pages > 0 && (answer === "" || answer === "l" || answer === "list")) return "list";
-    if (answer === "f" || answer === "fling") return "fling";
-    if (answer === "a" || answer === "abort" || answer === "n" || answer === "no" || answer === "")
-      throw new CliError("Not flung: no index.html at the root", {
-        hint: "Fling the folder that contains index.html (your build output, e.g. ./dist), or pass --list-html / --no-list-html."
-      });
-  }
-}
-async function confirmSiteName(ctx, client, generated, base) {
-  const where = (n) => base ? ` \u2192 ${siteUrlFor(n, base)}` : "";
-  const describe = (n, note) => ctx.log.info(`Site name: ${chalk5.bold(n)}${where(n)}  ${chalk5.dim(`(${note})`)}`);
-  let candidate = generated;
-  for (; ; ) {
-    const check = await checkName(client, candidate);
-    let proposal;
-    if (check.status === "available" || check.status === "yours") {
-      proposal = candidate;
-      describe(candidate, check.status === "yours" ? "updates your existing site" : "new");
-    } else {
-      const why = check.status === "taken" ? "is taken" : "is not a valid site name";
-      const alternatives = check.suggestions.length ? ` Suggestions: ${check.suggestions.join(", ")}` : "";
-      ctx.log.warn(`${candidate} ${why}.${alternatives}`);
-      proposal = check.suggestions[0];
-      if (proposal) describe(proposal, "new");
-    }
-    for (; ; ) {
-      const question = proposal ? `Use "${proposal}"? [Y/n or type another name] ` : "Type a site name (or n to abort): ";
-      const answer = (await ctx.prompt(question)).trim();
-      if (proposal && (answer === "" || /^y(es)?$/i.test(answer))) return proposal;
-      if (/^no?$/i.test(answer))
-        throw new CliError("Aborted \u2014 nothing was flung", {
-          hint: "Pass --name <name> to choose the site name up front."
-        });
-      if (answer === "") continue;
-      if (!isValidSiteName(answer)) {
-        ctx.log.warn(
-          `"${answer}" is not a valid site name: use lowercase letters, digits and single hyphens (max ${SITE_NAME_MAX}); some names are reserved.`
-        );
-        continue;
-      }
-      candidate = answer;
-      break;
-    }
-  }
-}
-
-// src/commands/sites.ts
-import chalk6 from "chalk";
-async function runList(ctx, opts) {
-  const sites = await listSites(requireClient(ctx), opts);
-  ctx.out.data(
-    { sites },
-    () => renderTable(sites, [
-      { header: "NAME", value: (s) => s.name },
-      { header: "URL", value: (s) => s.url },
-      {
-        header: "VISIBILITY",
-        value: (s) => s.archived ? `${s.visibility} (archived)` : s.visibility
-      },
-      { header: "SHARE", value: (s) => s.shareUrl },
-      { header: "UPDATED", value: (s) => formatDate(s.updatedAt) }
-    ])
-  );
-}
-function describeSite(site) {
-  const row = (label, value) => `${chalk6.bold(`${label}:`.padEnd(12))}${value}`;
-  return [
-    row("Name", site.name),
-    row("URL", site.url),
-    row("Visibility", site.visibility + (site.archived ? chalk6.yellow(" (archived)") : "")),
-    row("SPA", site.spa ? "yes" : "no"),
-    row("Share link", site.shareUrl ?? "-"),
-    row("Version", site.currentVersionId ?? "-"),
-    ...filesRow(site, row),
-    row("Created", formatDate(site.createdAt)),
-    row("Updated", formatDate(site.updatedAt))
-  ];
-}
-function filesRow(site, row) {
-  const current = site.versions?.find((v) => v.id === site.currentVersionId);
-  if (!current) return [];
-  const n = current.fileCount;
-  return [row("Files", `${n} file${n === 1 ? "" : "s"}, ${formatBytes(current.totalBytes)}`)];
-}
-async function runInfo(ctx, name) {
-  const site = await getSite(requireClient(ctx), name);
-  ctx.out.data(
-    site,
-    () => [
-      ...describeSite(site),
-      "",
-      chalk6.dim(
-        `${site.versions.length} version(s) \u2014 \`fling versions ${name}\`; files \u2014 \`fling files ${name}\``
-      )
-    ].join("\n")
-  );
-}
-async function runVersions(ctx, name) {
-  const site = await getSite(requireClient(ctx), name);
-  ctx.out.data(
-    { name: site.name, currentVersionId: site.currentVersionId, versions: site.versions },
-    () => renderTable(site.versions, [
-      { header: "", value: (v) => v.id === site.currentVersionId ? "*" : " " },
-      { header: "VERSION", value: (v) => v.id },
-      { header: "FILES", value: (v) => v.fileCount },
-      { header: "SIZE", value: (v) => formatBytes(v.totalBytes) },
-      { header: "CREATED", value: (v) => formatDate(v.createdAt) }
-    ])
-  );
-}
-async function runFiles(ctx, name, versionId) {
-  const result = await versionFiles(requireClient(ctx), name, versionId);
-  if (!result.files.some((f) => f.path === "index.html")) {
-    ctx.log.warn("No index.html at the root \u2014 the site root URL will 404");
-  }
-  ctx.out.data(result, () => {
-    const n = result.files.length;
-    const header = chalk6.dim(
-      `${result.versionId}${result.current ? " (current)" : " (not served)"} \u2014 ${n} file${n === 1 ? "" : "s"}, ${formatBytes(result.totalBytes)}${result.generatedIndex ? ", generated index.html" : ""}`
-    );
-    const table = renderTable(result.files, [
-      { header: "PATH", value: (f) => f.path },
-      { header: "SIZE", value: (f) => formatBytes(f.size) },
-      { header: "TYPE", value: (f) => f.contentType }
-    ]);
-    return `${header}
-${table}`;
-  });
-}
-async function runRollback(ctx, name, versionId) {
-  const site = await rollback(requireClient(ctx), name, versionId);
-  ctx.log.success(`${name} now serves version ${site.currentVersionId ?? versionId}`);
-  ctx.out.data(site, () => site.url);
-}
-async function runShare(ctx, name, opts) {
-  if (opts.refresh && opts.revoke) throw new CliError("Use either --refresh or --revoke, not both");
-  const client = requireClient(ctx);
-  const result = await share(client, name, opts);
-  let ready;
-  if (result.action === "created" || result.action === "refreshed") {
-    const files = ctx.waitReady ? await versionFiles(client, name).catch(() => null) : null;
-    ready = (await waitWithSpinner(ctx.waitReady, result.shareUrl, files?.files.map((f) => f.path) ?? [], {
-      progress: ctx.progress,
-      warn: (m) => ctx.log.warn(m)
-    })).ready;
-  }
-  if (result.action === "revoked") ctx.log.success(`Share link for ${name} revoked`);
-  else if (result.action === "refreshed")
-    ctx.log.success("New share link \u2014 the old one no longer works");
-  else if (result.action === "created")
-    ctx.log.success("Share link created \u2014 anyone with it can view the site");
-  ctx.out.data(
-    ready === void 0 ? result : { ...result, ready },
-    () => result.shareUrl ? result.shareUrl : chalk6.dim("(no share link)")
-  );
-}
-async function runVisibility(ctx, name, visibility) {
-  if (visibility !== "private" && visibility !== "public") {
-    throw new CliError(`Visibility must be "private" or "public", not "${visibility}"`);
-  }
-  const site = await setVisibility(requireClient(ctx), name, visibility);
-  ctx.log.success(
-    site.visibility === "public" ? `${name} is public \u2014 no sign-in needed` : `${name} is private \u2014 Nearform sign-in required`
-  );
-  ctx.out.data(site, () => site.url);
-}
-async function runArchive(ctx, name, unarchive = false) {
-  const site = await archiveSite(requireClient(ctx), name, { unarchive });
-  ctx.log.success(
-    unarchive ? `${name} restored` : `${name} archived \u2014 it 404s until \`fling unarchive ${name}\``
-  );
-  if (ctx.json) ctx.out.data(site, () => "");
-  else if (unarchive) ctx.out.text(site.url);
-}
-async function runRemove(ctx, name, opts) {
-  if (!opts.yes) {
-    if (!ctx.interactive) {
-      throw new CliError(`Refusing to delete ${name} without confirmation`, {
-        hint: "Pass --yes to delete."
-      });
-    }
-    const ok = await ctx.confirm(`Delete ${name} and every version of it? This cannot be undone.`);
-    if (!ok) throw new CliError("Cancelled");
-  }
-  const result = await deleteSite(requireClient(ctx), name);
-  ctx.log.success(`${name} deleted`);
-  if (ctx.json) ctx.out.data(result, () => "");
-}
-
 // src/mcp.ts
-import { mkdir as mkdir3, mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename3, dirname as dirname2, join as join4 } from "node:path";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z as z7 } from "zod";
 var LOGIN_HINT = `Not logged in to Fling. Call fling_login (it opens the browser to sign in with Nearform Google), or ask the user to run \`${NPX_COMMAND} login\` in a terminal (in Claude Code: \`! ${NPX_COMMAND} login\`), then try again.`;
 var MCP_LOCAL_INSTRUCTIONS = [
   "Fling publishes static sites (HTML/CSS/JS, images, documents) for Nearform staff at https://<name>.fling.labs.nearform.com. This server runs on the user's computer.",
@@ -2465,6 +3144,7 @@ var MCP_LOCAL_INSTRUCTIONS = [
   'A file or folder the user has on this computer (a downloaded .html, a .zip, a build folder): call fling_deploy with its path, or just its file name (e.g. "Pitch Deck.html") \u2014 it is looked up in Downloads, Desktop, Documents/Claude and Claude Desktop output folders. Use fling_find_files to see recent candidates when unsure which file the user means.',
   "Confirm the site name with the user before publishing (fling_check_name shows whether it is free and, for a path, the generated name). Names are global, first come first served; when one is taken, offer the suggestions.",
   "When there is no index.html but there are HTML pages, fling_deploy and fling_publish do not publish: ask the user whether to generate an index page listing the pages (`listHtml: true`) or publish without one (`listHtml: false`, the root URL 404s), then retry.",
+  NEVER_PUBLISHED,
   "Not logged in? Call fling_login, let the user finish signing in in the browser, then retry.",
   "Sites are private (Nearformers only) by default; only make one public if asked. Use fling_share for a link people outside Nearform can open. Always give the user the URL that comes back."
 ].join("\n\n");
@@ -2505,6 +3185,9 @@ ${JSON.stringify(data, null, 2)}` }] };
   }
   async function deployFolder(c, dir, opts) {
     let local = await buildManifest(dir);
+    local.skipped.dotfiles.unshift(...opts.skippedDotfiles ?? []);
+    const skippedNote = describeSkipped(local.skipped).map((l) => `
+${l}.`).join("");
     let generatedIndex = false;
     if (!hasRootIndex(local)) {
       const pages = htmlPages(local).map((f) => f.path);
@@ -2547,7 +3230,7 @@ Warnings:
     );
     return {
       kind: "deployed",
-      summary: `${what}: ${result.url} (${result.site.visibility})${generatedIndex ? " \u2014 with a generated index.html listing the HTML pages" : ""}${warnings}${edge.note}
+      summary: `${what}: ${result.url} (${result.site.visibility})${generatedIndex ? " \u2014 with a generated index.html listing the HTML pages" : ""}${warnings}${skippedNote}${edge.note}
 To check exactly which files the site has, call fling_files with name "${result.name}".`,
       data: {
         status: result.status,
@@ -2557,7 +3240,8 @@ To check exactly which files the site has, call fling_files with name "${result.
         versionId: result.versionId,
         site: result.site,
         generatedIndex,
-        warnings: result.warnings
+        warnings: result.warnings,
+        skipped: local.skipped
       }
     };
   }
@@ -2570,7 +3254,7 @@ To check exactly which files the site has, call fling_files with name "${result.
     "fling_deploy",
     {
       title: "Deploy a file or folder from this computer",
-      description: 'Fling something that is on the user\'s computer and return its stable URL (https://<name>.fling.labs.nearform.com): a folder of static files (e.g. a build output like dist/), a single .html file (served as the site\'s index.html), a .zip of a site (extracted; a single top-level folder is unwrapped), or any other single file (.pdf, .svg, .png\u2026, served next to a generated page that shows it). `path` can be absolute, relative to the working directory, or just a file name ("Pitch Deck.html"): names are looked up, newest first, in Downloads, Desktop, Documents/Claude and Claude Desktop output folders, and the result says where the file was found. Never pass paths from your own sandbox (/mnt/user-data/\u2026, /sessions/\u2026): for content you created, use fling_publish. Without `name`, a name is generated: from the file name for files ("Pitch Deck (1).html" \u2192 pitch-deck), from the project and folder for folders (~/work/rocketpod/docs \u2192 rocketpod-docs). Site names are one global namespace, first come first served \u2014 confirm the name with the user first (fling_check_name with `path` shows the generated one). If the name is taken it fails with free suggestions \u2014 ask the user to pick one, then retry with `name`. If there is no index.html but there are HTML pages, it does not deploy: ask the user whether to generate an index page listing them (`listHtml: true`) or deploy without one (`listHtml: false`), then retry. Re-deploying identical content is a no-op. Sites are private to signed-in Nearformers unless `public` is set.',
+      description: 'Fling something that is on the user\'s computer and return its stable URL (https://<name>.fling.labs.nearform.com): a folder of static files (e.g. a build output like dist/), a single .html file (served as the site\'s index.html), a .zip of a site (extracted; a single top-level folder is unwrapped), or any other single file (.pdf, .svg, .png\u2026, served next to a generated page that shows it). `path` can be absolute, relative to the working directory, or just a file name ("Pitch Deck.html"): names are looked up, newest first, in Downloads, Desktop, Documents/Claude and Claude Desktop output folders, and the result says where the file was found. Never pass paths from your own sandbox (/mnt/user-data/\u2026, /sessions/\u2026): for content you created, use fling_publish. Without `name`, a name is generated: from the file name for files ("Pitch Deck (1).html" \u2192 pitch-deck), from the project and folder for folders (~/work/rocketpod/docs \u2192 rocketpod-docs). Site names are one global namespace, first come first served \u2014 confirm the name with the user first (fling_check_name with `path` shows the generated one). If the name is taken it fails with free suggestions \u2014 ask the user to pick one, then retry with `name`. If there is no index.html but there are HTML pages, it does not deploy: ask the user whether to generate an index page listing them (`listHtml: true`) or deploy without one (`listHtml: false`), then retry. Re-deploying identical content is a no-op. Sites are private to signed-in Nearformers unless `public` is set. ' + NEVER_PUBLISHED,
       inputSchema: {
         path: z7.string().min(1).describe(
           "File or folder on this computer: absolute, relative to the working directory, or just its name (looked up in Downloads, Desktop and Claude output folders)"
@@ -2596,7 +3280,8 @@ To check exactly which files the site has, call fling_files with name "${result.
           spa: args.spa,
           public: args.public,
           listHtml: args.listHtml,
-          retryWith: "fling_deploy"
+          retryWith: "fling_deploy",
+          skippedDotfiles: prepared.skippedDotfiles
         });
         const where = located.foundIn === FOUND_AS_GIVEN ? "" : `Found "${basename3(located.path)}" in ${located.foundIn}: ${located.path}
 `;
@@ -2665,10 +3350,11 @@ ${JSON.stringify(data, null, 2)}` }]
     },
     (args) => run(async (c) => {
       const name = resolveSiteName(".", args.name);
-      const tmp = await mkdtemp2(join4(tmpdir2(), "fling-publish-"));
+      const tmp = await mkdtemp3(join6(tmpdir3(), "fling-publish-"));
       try {
-        await writeInlineFiles(tmp, args.files);
+        const { skippedDotfiles } = await writeInlineFiles(tmp, args.files);
         const outcome = await deployFolder(c, tmp, {
+          skippedDotfiles,
           name,
           nameGiven: true,
           spa: args.spa,
@@ -2701,20 +3387,20 @@ ${JSON.stringify(data, null, 2)}` }]
         source = await resolveInput(args.path, locate);
         name = defaultNameFor(source.path, source.isDirectory);
       }
-      const check = await checkName(c, name);
-      const base = check.status === "invalid" ? null : await discoverSitesBase(c);
+      const check2 = await checkName(c, name);
+      const base = check2.status === "invalid" ? null : await discoverSitesBase(c);
       const url = base ? siteUrlFor(name, base) : null;
-      const suggestions = check.suggestions.length ? ` Suggestions: ${check.suggestions.join(", ")}.` : "";
+      const suggestions = check2.suggestions.length ? ` Suggestions: ${check2.suggestions.join(", ")}.` : "";
       const summary = {
         available: `"${name}" is available${url ? ` \u2192 ${url}` : ""}.`,
         yours: `"${name}" is the user's existing site${url ? ` (${url})` : ""} \u2014 deploying updates it.`,
         taken: `"${name}" is taken by someone else.${suggestions}`,
         invalid: `"${name}" is not a valid site name.${suggestions}`
-      }[check.status];
+      }[check2.status];
       return {
         summary,
         data: {
-          ...check,
+          ...check2,
           url,
           ...source ? { generated: true, source: { path: source.path, foundIn: source.foundIn } } : {}
         }
@@ -2882,23 +3568,36 @@ ${JSON.stringify(data, null, 2)}` }]
   );
   return server;
 }
-var textResult = (text) => ({ content: [{ type: "text", text }] });
+var textResult = (text2) => ({ content: [{ type: "text", text: text2 }] });
 async function writeInlineFiles(dir, files) {
   const seen = /* @__PURE__ */ new Set();
+  const skippedDotfiles = [];
+  const secretFiles = [];
   let total = 0;
   for (const f of files) {
     const path = f.path.replace(/^(\.\/)+/, "").replace(/^\/+/, "");
+    const segments = path.split("/");
+    if (path && !path.includes("\\") && segments.every((s) => s !== "" && s !== "." && s !== "..") && segments.some((s) => s.startsWith("."))) {
+      skippedDotfiles.push(path);
+      continue;
+    }
     if (!isValidSitePath(path)) throw new CliError(`Invalid file path: "${f.path}"`);
+    if (isSecretPath(path)) {
+      secretFiles.push(path);
+      continue;
+    }
     if (seen.has(path)) throw new CliError(`"${path}" is listed twice`);
     seen.add(path);
     const bytes = Buffer.from(f.content, f.encoding === "base64" ? "base64" : "utf8");
     total += bytes.length;
     if (total > MAX_DEPLOY_BYTES)
       throw new CliError(`The site is larger than ${formatBytes(MAX_DEPLOY_BYTES)}`);
-    const target = join4(dir, ...path.split("/"));
+    const target = join6(dir, ...path.split("/"));
     await mkdir3(dirname2(target), { recursive: true });
-    await writeFile3(target, bytes);
+    await writeFile4(target, bytes);
   }
+  if (secretFiles.length > 0) throw new SecretFilesError(secretFiles);
+  return { skippedDotfiles };
 }
 function describeError(error) {
   if (error instanceof CliError && error.exitCode === EXIT_NOT_LOGGED_IN) return LOGIN_HINT;
@@ -2913,24 +3612,83 @@ async function runMcpServer(deps = {}) {
   await server.connect(new StdioServerTransport());
 }
 
+// src/route.ts
+import { stat as stat6 } from "node:fs/promises";
+import { resolve as resolve4 } from "node:path";
+var PASS_THROUGH = /* @__PURE__ */ new Set(["-h", "--help", "-V", "--version"]);
+var pathExists = (path) => stat6(resolve4(path)).then(
+  () => true,
+  () => false
+);
+async function routeArgs(args, opts) {
+  const exists = opts.exists ?? pathExists;
+  let first;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--") {
+      first = args[i + 1];
+      break;
+    }
+    if (arg.startsWith("-")) {
+      if (PASS_THROUGH.has(arg)) return { kind: "run", args: [...args] };
+      if (opts.valueFlags.has(arg)) i++;
+      continue;
+    }
+    first = arg;
+    break;
+  }
+  if (first === void 0) return { kind: "help" };
+  if (await exists(first)) return { kind: "run", args: ["deploy", ...args] };
+  if (opts.commands.has(first)) return { kind: "run", args: [...args] };
+  return { kind: "unknown", arg: first };
+}
+function routeOptionsFor(program2) {
+  const commands = /* @__PURE__ */ new Set(["help"]);
+  const valueFlags = /* @__PURE__ */ new Set();
+  const addFlags = (command) => {
+    for (const option of command.options)
+      if (option.required || option.optional) {
+        for (const flag of [option.short, option.long]) if (flag) valueFlags.add(flag);
+      }
+  };
+  addFlags(program2);
+  for (const command of program2.commands) {
+    commands.add(command.name());
+    for (const alias of command.aliases()) commands.add(alias);
+    addFlags(command);
+  }
+  return { commands, valueFlags };
+}
+
 // src/cli.ts
 var program = new Command();
 program.name(BIN_NAME).description("Fling a folder of static files at Fling and get a link back").version(VERSION).option(
   "--server <url>",
   `server URL (default: $${ENV.url} or config, else ${DEFAULT_SERVER_URL})`
-).option("--json", "print JSON instead of human output", false).showHelpAfterError().addHelpText(
+).option("--json", "print JSON instead of human output", false).showHelpAfterError().configureHelp({
+  sortSubcommands: false,
+  styleTitle: (title) => chalk9.bold(brand.primary(title)),
+  styleCommandText: (text2) => chalk9.bold(text2),
+  styleSubcommandText: (text2) => brand.accent(text2),
+  styleOptionText: (text2) => brand.accent(text2),
+  styleArgumentText: (text2) => chalk9.dim(text2)
+}).addHelpText(
+  "before",
+  () => process.stdout.isTTY ? logo({ columns: process.stdout.columns }) : ""
+).addHelpText(
   "after",
-  `
-Examples:
-  $ ${BIN_NAME} login
-  $ ${BIN_NAME} ./dist --name my-app     deploy \u2192 https://my-app.fling.labs.nearform.com
-  $ ${BIN_NAME} ./dist --yes             no prompts (CI): use the generated name, fail if it is taken
-  $ ${BIN_NAME} "Pitch Deck.html"        a single page; found in Downloads if it is not here
-  $ ${BIN_NAME} site.zip                 a zip of a site
-  $ ${BIN_NAME} share my-app             public link for people outside Nearform
+  () => `
+${chalk9.bold(brand.primary("Examples:"))}
+  $ ${BIN_NAME} setup                      sign in and add Fling to Claude Code / Claude Desktop
+  $ ${BIN_NAME} deploy ./dist --name my-app \u2192 https://my-app.fling.labs.nearform.com
+  $ ${BIN_NAME} ./dist                     the same: an existing path deploys
+  $ ${BIN_NAME} ./dist --yes               no prompts (CI): use the generated name, fail if it is taken
+  $ ${BIN_NAME} "Pitch Deck.html"          a single page
+  $ ${BIN_NAME} site.zip                   a zip of a site
+  $ ${BIN_NAME} share my-app               public link for people outside Nearform
 
-Exit codes: 0 ok \xB7 1 error \xB7 2 not logged in \xB7 3 forbidden
-Env:        ${ENV.apiKey} \xB7 ${ENV.url} \xB7 ${ENV.configDir} \xB7 ${ENV.debug}`
+${chalk9.dim(`Exit codes: 0 ok \xB7 1 error \xB7 2 not logged in \xB7 3 forbidden
+Env:        ${ENV.apiKey} \xB7 ${ENV.url} \xB7 ${ENV.configDir} \xB7 ${ENV.debug}`)}`
 );
 function action(handler) {
   return async (...args) => {
@@ -2953,15 +3711,23 @@ function report(error, ctx) {
   if (error instanceof CliError && error.hint) log.hint(error.hint);
   if (ctx?.config.debug && error instanceof Error && error.stack) log.hint(error.stack);
   if (ctx?.json) {
-    const code = error.code;
+    const { code, findings, paths } = error;
     process.stdout.write(
-      `${formatJson({ error: { message, exitCode: exitCodeFor(error), ...typeof code === "string" ? { code } : {} } })}
+      `${formatJson({
+        error: {
+          message,
+          exitCode: exitCodeFor(error),
+          ...typeof code === "string" ? { code } : {},
+          ...Array.isArray(findings) ? { findings } : {},
+          ...Array.isArray(paths) ? { paths } : {}
+        }
+      })}
 `
     );
   }
 }
-program.command("deploy [path]", { isDefault: true }).description(
-  "deploy a folder (default: .), a single .html file, a .zip or any file \u2014 the default command, so `fling ./dist` works. A path that does not exist is looked up by name in Downloads, Desktop and Claude output folders"
+program.command("deploy [path]").helpGroup("Deploy:").description(
+  "deploy a folder (default: .), a single .html file, a .zip or any file. `fling <path>` is short for it"
 ).option(
   "-n, --name <name>",
   "site name \u2014 names are global, first come first served (default: generated from the project and folder, e.g. rocketpod-docs; you confirm it on a terminal)"
@@ -2973,28 +3739,54 @@ program.command("deploy [path]", { isDefault: true }).description(
     (ctx, path, opts) => runDeploy(ctx, path, opts)
   )
 );
-program.command("login").description("sign in through the browser and store an API key").action(action((ctx) => runLogin(ctx)));
-program.command("logout").description("remove the stored API key").action(action((ctx) => runLogout(ctx)));
-program.command("whoami").description("show the signed-in user").action(action((ctx) => runWhoami(ctx)));
-program.command("ls").alias("list").description("list your sites").option("--archived", "list archived sites").action(action((ctx, opts) => runList(ctx, opts)));
-program.command("info <name>").description("show a site").action(action((ctx, name) => runInfo(ctx, name)));
-program.command("versions <name>").description("list a site's versions (* = live)").action(action((ctx, name) => runVersions(ctx, name)));
-program.command("files <name> [versionId]").description("list the files in a site's live version (or in versionId)").action(
+program.command("setup").helpGroup("Setup:").description(
+  "sign in, then add the Fling plugin to Claude Code and the extension to Claude Desktop"
+).option("-y, --yes", "do every step without asking").option("-s, --scope <scope>", "Claude Code plugin scope: user, project or local", "user").action(action((ctx, opts) => runSetup(ctx, opts)));
+program.command("login").helpGroup("Setup:").description("sign in through the browser and store an API key").action(
+  action(async (ctx) => {
+    await runLogin(ctx);
+    ctx.log.hint(`Next: \`${BIN_NAME} setup\` adds Fling to Claude Code and Claude Desktop.`);
+  })
+);
+program.command("logout").helpGroup("Setup:").description("remove the stored API key").action(action((ctx) => runLogout(ctx)));
+program.command("whoami").helpGroup("Setup:").description("show the signed-in user").action(action((ctx) => runWhoami(ctx)));
+program.commandsGroup("Setup:").helpCommand("help [command]", "show help for a command");
+program.command("ls").helpGroup("Sites:").alias("list").description("list your sites").option("--archived", "list archived sites").action(action((ctx, opts) => runList(ctx, opts)));
+program.command("info <name>").helpGroup("Sites:").description("show a site").action(action((ctx, name) => runInfo(ctx, name)));
+program.command("versions <name>").helpGroup("Sites:").description("list a site's versions (* = live)").action(action((ctx, name) => runVersions(ctx, name)));
+program.command("files <name> [versionId]").helpGroup("Sites:").description("list the files in a site's live version (or in versionId)").action(
   action((ctx, name, versionId) => runFiles(ctx, name, versionId))
 );
-program.command("rollback <name> <versionId>").description("serve an earlier version again").action(action((ctx, name, versionId) => runRollback(ctx, name, versionId)));
-program.command("share <name>").description("print (or create) a public share link \u2014 anyone with it can view the site").option("--refresh", "replace the link; the old one stops working").option("--revoke", "remove the link").action(
+program.command("rollback <name> <versionId>").helpGroup("Sites:").description("serve an earlier version again").action(action((ctx, name, versionId) => runRollback(ctx, name, versionId)));
+program.command("share <name>").helpGroup("Sites:").description("print (or create) a public share link \u2014 anyone with it can view the site").option("--refresh", "replace the link; the old one stops working").option("--revoke", "remove the link").action(
   action(
     (ctx, name, opts) => runShare(ctx, name, opts)
   )
 );
-program.command("visibility <name> <visibility>").description("private (Nearform sign-in) or public (anyone)").action(action((ctx, name, visibility) => runVisibility(ctx, name, visibility)));
-program.command("archive <name>").description("take a site offline (404) but keep its files; undo with unarchive").action(action((ctx, name) => runArchive(ctx, name)));
-program.command("unarchive <name>").description("bring an archived site back").action(action((ctx, name) => runArchive(ctx, name, true)));
-program.command("rm <name>").alias("delete").description("delete a site and all its versions (asks first unless --yes)").option("-y, --yes", "do not ask for confirmation").action(action((ctx, name, opts) => runRemove(ctx, name, opts)));
-program.command("mcp").description("run the MCP server on stdio (used by the Claude Code plugin)").action(async (_opts, command) => {
+program.command("visibility <name> <visibility>").helpGroup("Sites:").description("private (Nearform sign-in) or public (anyone)").action(action((ctx, name, visibility) => runVisibility(ctx, name, visibility)));
+program.command("archive <name>").helpGroup("Sites:").description("take a site offline (404) but keep its files; undo with unarchive").action(action((ctx, name) => runArchive(ctx, name)));
+program.command("unarchive <name>").helpGroup("Sites:").description("bring an archived site back").action(action((ctx, name) => runArchive(ctx, name, true)));
+program.command("rm <name>").helpGroup("Sites:").alias("delete").description("delete a site and all its versions (asks first unless --yes)").option("-y, --yes", "do not ask for confirmation").action(action((ctx, name, opts) => runRemove(ctx, name, opts)));
+program.command("mcp").helpGroup("Agents:").description("run the MCP server on stdio (used by the Claude Code plugin)").action(async (_opts, command) => {
   const globals = command.optsWithGlobals();
   await runMcpServer({ server: globals.server });
 });
-program.parseAsync(process.argv);
+async function main() {
+  const route = await routeArgs(process.argv.slice(2), routeOptionsFor(program));
+  if (route.kind === "help") {
+    program.outputHelp();
+    return;
+  }
+  if (route.kind === "unknown") {
+    const log = createLogger();
+    log.error(`"${route.arg}" is not a command, file or folder`);
+    log.hint(
+      `Run \`${BIN_NAME} --help\` for the commands, or \`${BIN_NAME} deploy <path>\` to deploy.`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  await program.parseAsync(route.args, { from: "user" });
+}
+await main();
 //# sourceMappingURL=cli.js.map