@qodalis/cli 2.4.2 → 2.5.0

package/public-api.js

@@ -519,7 +519,7 @@ var CliKeyValueStore_TOKEN = cliCore.createCliToken("cli-key-value-store");
 var SyntaxHighlighterRegistry_TOKEN = cliCore.createCliToken("syntax-highlighter-registry");
 
 // src/lib/version.ts
-var LIBRARY_VERSION = "2.4.2";
+var LIBRARY_VERSION = "2.5.0";
 var API_VERSION = 2;
 var ANONYMOUS = "\0anonymous";
 function aliasOwner(context2) {
@@ -5887,6 +5887,72 @@ var CliServerConnection = class _CliServerConnection {
     return httpUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
   }
 };
+function plainText(value, keepLineBreaks = false) {
+  const text = String(value ?? "");
+  return keepLineBreaks ? text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, "") : text.replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+}
+function optionalText(value) {
+  return value === void 0 || value === null ? void 0 : plainText(value);
+}
+function serverCommandAliases(descriptor) {
+  return (descriptor.aliases ?? []).map((a) => plainText(a).trim()).filter((a) => a && !/\s/.test(a));
+}
+var DEFAULT_SERVER_COMMAND_ICON = "\u{1F5A5}";
+function serverCommandMetadata(descriptor, fallbackModule, server) {
+  return {
+    module: plainText(descriptor.module) || fallbackModule,
+    icon: plainText(descriptor.icon) || DEFAULT_SERVER_COMMAND_ICON,
+    requireServer: true,
+    ...server ? { server } : {}
+  };
+}
+function serverCommandParameters(descriptor) {
+  return descriptor.parameters?.map((p) => {
+    const allowed = p.allowedValues?.length ? p.allowedValues.map((v) => plainText(v)) : void 0;
+    const examples = p.examples?.map((v) => plainText(v)).filter(Boolean);
+    return {
+      name: p.name,
+      aliases: p.aliases?.map((a) => plainText(a).replace(/^-+/, "")).filter(Boolean),
+      description: optionalText(p.description),
+      required: p.required,
+      type: p.type,
+      defaultValue: p.defaultValue,
+      ...examples?.length ? { examples } : {},
+      ...allowed ? {
+        allowedValues: allowed,
+        validator: (value) => {
+          const values = Array.isArray(value) ? value : [value];
+          const valid = values.every(
+            (v) => allowed.some((a) => a.toLowerCase() === String(v).toLowerCase())
+          );
+          return valid ? { valid: true } : { valid: false, message: `--${p.name} must be one of: ${allowed.join(", ")}` };
+        }
+      } : {}
+    };
+  });
+}
+function serverCommandWriteDescription(descriptor) {
+  const paragraphs = plainText(descriptor.documentation, true).split(/\r?\n\s*\r?\n/).map((p) => p.trim()).filter(Boolean);
+  const examples = (descriptor.examples ?? []).filter((e) => e?.command).map((e) => ({ command: plainText(e.command), description: optionalText(e.description) }));
+  if (paragraphs.length === 0 && examples.length === 0) {
+    return void 0;
+  }
+  return (context2) => {
+    paragraphs.forEach((paragraph, i) => {
+      if (i > 0) context2.writer.writeln();
+      cliCore.writeWrapped(context2, paragraph);
+    });
+    if (examples.length > 0) {
+      if (paragraphs.length > 0) context2.writer.writeln();
+      cliCore.writeExamples(
+        context2,
+        examples.map((e) => [e.command, e.description ?? ""])
+      );
+    }
+  };
+}
+
+// src/lib/server/cli-server-proxy-processor.ts
 function renderSingleOutput(output2, context2, rawCommand) {
   switch (output2.type) {
     case "text": {
@@ -6018,21 +6084,15 @@ var CliServerProxyProcessor = class _CliServerProxyProcessor {
     this.serverName = serverName;
     this.commandPath = [...parentPath, descriptor.command];
     this.command = isNested ? descriptor.command : `${serverName}:${descriptor.command}`;
-    this.description = descriptor.description;
+    this.description = descriptor.description === void 0 ? void 0 : plainText(descriptor.description);
     this.version = descriptor.version;
-    this.metadata = {
-      module: `server:${serverName}`,
-      icon: "\u{1F5A5}",
-      requireServer: true
-    };
-    this.parameters = descriptor.parameters?.map((p) => ({
-      name: p.name,
-      aliases: p.aliases,
-      description: p.description,
-      required: p.required,
-      type: p.type,
-      defaultValue: p.defaultValue
-    }));
+    const aliases = serverCommandAliases(descriptor);
+    if (aliases.length) {
+      this.aliases = isNested ? [...aliases] : aliases.map((a) => `${serverName}:${a}`);
+    }
+    this.metadata = serverCommandMetadata(descriptor, `server:${serverName}`, serverName);
+    this.parameters = serverCommandParameters(descriptor);
+    this.writeDescription = serverCommandWriteDescription(descriptor);
     this.processors = descriptor.processors?.map(
       (sub) => new _CliServerProxyProcessor(connection, sub, serverName, true, this.commandPath)
     );
@@ -6058,20 +6118,14 @@ var CliServerMultiProxyProcessor = class _CliServerMultiProxyProcessor {
     const first = entries[0].descriptor;
     this.commandPath = [...parentPath, first.command];
     this.command = first.command;
-    this.description = first.description;
-    this.metadata = {
-      module: "server:multi",
-      icon: "\u{1F5A5}",
-      requireServer: true
-    };
-    this.parameters = first.parameters?.map((p) => ({
-      name: p.name,
-      aliases: p.aliases,
-      description: p.description,
-      required: p.required,
-      type: p.type,
-      defaultValue: p.defaultValue
-    }));
+    this.description = first.description === void 0 ? void 0 : plainText(first.description);
+    const aliases = serverCommandAliases(first);
+    if (parentPath.length > 0 && aliases.length) {
+      this.aliases = aliases;
+    }
+    this.metadata = serverCommandMetadata(first, "server:multi");
+    this.parameters = serverCommandParameters(first);
+    this.writeDescription = serverCommandWriteDescription(first);
     this.processors = first.processors?.map((sub) => {
       const subEntries = entries.map((e) => {
         const subDesc = e.descriptor.processors?.find(
@@ -6180,9 +6234,15 @@ var CliServerManager = class {
     /** Bare-name aliases this manager registered (only these are ever removed) */
     this._bareAliases = /* @__PURE__ */ new Set();
     this._hidden = [];
+    /** Servers the user linked (`server add`), as opposed to the host's */
+    this._linked = /* @__PURE__ */ new Set();
     /** `server:command` pairs already warned about, so each warns once */
     this._warnedHidden = /* @__PURE__ */ new Set();
   }
+  /** Whether the user linked this server (`server add`): only those can be removed or edited. */
+  isLinked(name) {
+    return this._linked.has(name);
+  }
   get defaultServer() {
     return this._defaultServer;
   }
@@ -6203,53 +6263,97 @@ var CliServerManager = class {
     this.unregisterBareAliases();
     this.registerBareAliases();
   }
-  async connectAll(servers, logger, backgroundServices, cliLogger) {
+  /** Where connections report and run (set once at boot, before any server connects). */
+  configure(logger, backgroundServices, cliLogger) {
     this._logger = logger;
     this._cliLogger = cliLogger;
     this._backgroundServices = backgroundServices;
+  }
+  async connectAll(servers, logger, backgroundServices, cliLogger) {
+    this.configure(logger, backgroundServices, cliLogger);
     for (const config of servers) {
       if (config.enabled === false) continue;
-      const connection = new CliServerConnection(
-        config,
-        backgroundServices,
-        cliLogger,
-        this.authService
+      await this.connectServer(config);
+    }
+    this.registerBareAliases();
+  }
+  /**
+   * Connects one server and registers its commands (without the bare
+   * aliases: callers refresh them once every server is connected).
+   */
+  async connectServer(config) {
+    const logger = this._logger;
+    const connection = new CliServerConnection(
+      config,
+      this._backgroundServices,
+      this._cliLogger,
+      this.authService
+    );
+    this.connections.set(config.name, connection);
+    connection.onDisconnect = () => {
+      this.handleDisconnect(config.name);
+    };
+    connection.onReconnected = () => {
+      logger?.info(
+        `Server '${config.name}' reconnected (${connection.commands.length} commands, API v${connection.apiVersion}).`
       );
-      this.connections.set(config.name, connection);
-      connection.onDisconnect = () => {
-        this.handleDisconnect(config.name);
-      };
-      connection.onReconnected = () => {
-        logger?.info(
-          `Server '${config.name}' reconnected (${connection.commands.length} commands, API v${connection.apiVersion}).`
-        );
-        this.emitConnected(connection, true);
-        this.registerProxyProcessors(connection, config.name);
-        this.unregisterBareAliases();
-        this.registerBareAliases();
-      };
-      await connection.connect();
-      if (connection.connected) {
-        logger?.info(
-          `Connected to server '${config.name}' (${connection.commands.length} commands)`
-        );
-        this.registerProxyProcessors(connection, config.name);
-        this.emitConnected(connection, false);
-      } else if (connection.needsSignIn) {
-        logger?.info(
-          `Server '${config.name}' needs a sign-in; its commands load once you are signed in.`
-        );
-      } else {
-        logger?.warn(
-          `Could not connect to server '${config.name}' at ${config.url}. Commands from this server will not be available.`
-        );
-        this.events?.emit("server:unavailable", {
-          name: config.name,
-          url: config.url
-        });
-      }
+      this.emitConnected(connection, true);
+      this.registerProxyProcessors(connection, config.name);
+      this.unregisterBareAliases();
+      this.registerBareAliases();
+    };
+    await connection.connect();
+    if (connection.connected) {
+      logger?.info(
+        `Connected to server '${config.name}' (${connection.commands.length} commands)`
+      );
+      this.registerProxyProcessors(connection, config.name);
+      this.emitConnected(connection, false);
+    } else if (connection.needsSignIn) {
+      logger?.info(
+        `Server '${config.name}' needs a sign-in; its commands load once you are signed in.`
+      );
+    } else {
+      logger?.warn(
+        `Could not connect to server '${config.name}' at ${config.url}. Commands from this server will not be available.`
+      );
+      this.events?.emit("server:unavailable", {
+        name: config.name,
+        url: config.url
+      });
+    }
+    return connection;
+  }
+  /**
+   * Connects a server added while the terminal runs (`server add`): its
+   * commands are available at once. Throws when the name is taken.
+   */
+  async addServer(config, options = {}) {
+    if (this.connections.has(config.name)) {
+      throw new Error(`Server '${config.name}' already exists`);
     }
+    if (options.linked) this._linked.add(config.name);
+    const connection = await this.connectServer(config);
+    this.unregisterBareAliases();
     this.registerBareAliases();
+    return connection;
+  }
+  /**
+   * Disconnects a server and forgets it (`server remove`): its commands go
+   * away. False when there is no such server.
+   */
+  removeServer(name) {
+    const connection = this.connections.get(name);
+    if (!connection) return false;
+    connection.onDisconnect = void 0;
+    connection.onReconnected = void 0;
+    connection.disconnect();
+    this.connections.delete(name);
+    this._linked.delete(name);
+    if (this._defaultServer === name) this._defaultServer = null;
+    this.unregisterServerProcessors(name);
+    this.events?.emit("server:disconnected", { name });
+    return true;
   }
   async reconnect(name) {
     const connection = this.connections.get(name);
@@ -6379,7 +6483,7 @@ var CliServerManager = class {
           serverName
         );
         alias.command = command2;
-        alias.aliases = [namespacedCommand];
+        alias.aliases = [namespacedCommand, ...this.freeAliases(descriptor)];
         this.registry.registerProcessor(alias);
         this._bareAliases.add(alias);
       } else {
@@ -6391,11 +6495,20 @@ var CliServerManager = class {
           return { serverName, connection, descriptor };
         });
         const multi = new CliServerMultiProxyProcessor(entries, this);
+        const aliases = this.freeAliases(entries[0].descriptor);
+        if (aliases.length) multi.aliases = aliases;
         this.registry.registerProcessor(multi);
         this._bareAliases.add(multi);
       }
     }
   }
+  /**
+   * The server's aliases of a command that no registered command answers
+   * to yet: a local command (or an earlier server alias) keeps its name.
+   */
+  freeAliases(descriptor) {
+    return serverCommandAliases(descriptor).filter((a) => !this.registry.findProcessor(a, []));
+  }
   recordHidden(server, command2, localCommand) {
     this._hidden.push({ server, command: command2, localCommand });
     const key = `${server}:${command2}`;
@@ -6655,9 +6768,13 @@ var CliHelpCommandProcessor = class {
       }
     }
     if (processor.metadata?.requireServer) {
+      const server = processor.metadata.server;
       writer.writeln();
       writer.writeln(
-        `  ${writer.wrapInColor(t.t("cli.help.requires_server", "Requires a connected server"), cliCore.CliForegroundColor.Red)}`
+        `  ${writer.wrapInColor(
+          server ? t.t("cli.help.runs_on_server", "Runs on server {server}", { server }) : t.t("cli.help.requires_server", "Requires a connected server"),
+          cliCore.CliForegroundColor.Red
+        )}`
       );
     }
     writer.writeln();
@@ -6683,14 +6800,24 @@ var CliHelpCommandProcessor = class {
     const typeStr = `${DIM}<${param.type}>${RESET}`;
     const required = param.required ? writer.wrapInColor(` ${translator.t("cli.help.required", "(required)")}`, cliCore.CliForegroundColor.Red) : "";
     const defaultVal = param.defaultValue !== void 0 && !param.required ? `${DIM} [${param.defaultValue}]${RESET}` : "";
+    const allowed = param.allowedValues?.length ? `${DIM}${translator.t("cli.help.one_of", "one of:")}${RESET} ${param.allowedValues.map((v) => writer.wrapInColor(v, cliCore.CliForegroundColor.Magenta)).join(", ")}` : "";
+    const examples = param.examples?.length ? `${DIM}${translator.t("cli.help.for_example", "e.g.")}${RESET} ${param.examples.map((v) => writer.wrapInColor(v, cliCore.CliForegroundColor.Magenta)).join(", ")}` : "";
     if (narrow) {
       writer.writeln(`    ${nameStr} ${typeStr}${required}${defaultVal}`);
       cliCore.writeWrapped(context2, param.description, 6);
+      if (allowed) writer.writeln(`      ${allowed}`);
+      if (examples) writer.writeln(`      ${examples}`);
       return;
     }
     writer.writeln(
       `    ${nameStr} ${typeStr}  ${param.description}${required}${defaultVal}`
     );
+    if (allowed) {
+      writer.writeln(`      ${allowed}`);
+    }
+    if (examples) {
+      writer.writeln(`      ${examples}`);
+    }
   }
 };
 function isNarrow(context2) {
@@ -15157,6 +15284,129 @@ var CliClipboard = class {
     }
   }
 };
+
+// src/lib/server/linked/cli-linked-servers.ts
+var SERVERS_KEY = "qcli-linked-servers";
+var tokenKey = (name) => `server-token:${name.toLowerCase()}`;
+var SERVER_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/;
+function normalizeServerUrl(input) {
+  const value = input.trim();
+  if (!value) return null;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value : `https://${value}`;
+  try {
+    const url = new URL(withScheme);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    if (!url.hostname || url.username || url.password) return null;
+    return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return null;
+  }
+}
+function isPrivateHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) return true;
+  if (host.includes(":")) {
+    return host === "::1" || /^f[cd][0-9a-f]{0,2}:/.test(host) || /^fe[89ab][0-9a-f]?:/.test(host);
+  }
+  const ip = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!ip) return false;
+  const [a, b] = [Number(ip[1]), Number(ip[2])];
+  return a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
+}
+function checkServerUrl(input, pageProtocol) {
+  const url = normalizeServerUrl(input);
+  if (!url) return "Not a valid http(s) URL";
+  const { protocol, hostname } = new URL(url);
+  if (protocol === "http:" && !isPrivateHost(hostname)) {
+    return "Only https servers can be linked (http is accepted for localhost and private addresses)";
+  }
+  return {
+    url,
+    insecure: protocol === "http:",
+    mixedContent: protocol === "http:" && pageProtocol === "https:"
+  };
+}
+function userServersAllow(options, url) {
+  const policy = options?.userServers;
+  if (policy === false) return false;
+  if (policy === void 0 || policy === true) return true;
+  const origin = new URL(url).origin.toLowerCase();
+  return (policy.allowedOrigins ?? []).some((pattern) => {
+    const escaped = pattern.toLowerCase().replace(/\/+$/, "").replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+    return new RegExp(`^${escaped}$`).test(origin);
+  });
+}
+function userServersEnabled(options) {
+  return options?.userServers !== false;
+}
+function suggestServerName(url, taken) {
+  const { hostname, port } = new URL(url);
+  const host = hostname.replace(/^\[|\]$/g, "");
+  const isIp = /^[\d.]+$/.test(host) || host.includes(":");
+  const base = (isIp ? host.replace(/[.:]/g, "-") : host.split(".")[0]) + (port && (isIp || host === "localhost") ? `-${port}` : "");
+  let name = base.replace(/[^A-Za-z0-9_-]/g, "-").replace(/^[-_]+/, "").slice(0, 28) || "server";
+  if (!SERVER_NAME_PATTERN.test(name)) name = "server";
+  let candidate = name;
+  for (let i = 2; taken(candidate); i++) candidate = `${name}-${i}`;
+  return candidate;
+}
+function maskToken(token) {
+  if (!token) return "-";
+  return `\u2022\u2022\u2022\u2022${token.slice(-4)}`;
+}
+function redactSecrets(command2) {
+  return command2.replace(
+    // A following flag (`--token --default`) is not a value
+    /(--(?:token|password)(?:=|\s+))("[^"]*"|'[^']*'|(?!--)\S+)/gi,
+    (_match, flag) => `${flag}***`
+  );
+}
+var CliLinkedServers = class {
+  constructor(kv, secrets) {
+    this.kv = kv;
+    this.secrets = secrets;
+  }
+  async list() {
+    const saved = await this.kv.get(SERVERS_KEY);
+    return Array.isArray(saved) ? saved.filter((s) => s && typeof s.name === "string" && typeof s.url === "string") : [];
+  }
+  async get(name) {
+    return (await this.list()).find((s) => s.name.toLowerCase() === name.toLowerCase());
+  }
+  /** Saves a server (replacing one with the same name) and its token (none: deleted). */
+  async save(server, token) {
+    if (token) await this.secrets.set(tokenKey(server.name), token);
+    else await this.secrets.delete(tokenKey(server.name));
+    const others = (await this.list()).filter((s) => s.name.toLowerCase() !== server.name.toLowerCase());
+    await this.kv.set(SERVERS_KEY, [...others, server]);
+  }
+  async setToken(name, token) {
+    await this.secrets.set(tokenKey(name), token);
+  }
+  async token(name) {
+    return this.secrets.get(tokenKey(name));
+  }
+  async remove(name) {
+    const all = await this.list();
+    const rest = all.filter((s) => s.name.toLowerCase() !== name.toLowerCase());
+    await this.secrets.delete(tokenKey(name));
+    if (rest.length === all.length) return false;
+    await this.kv.set(SERVERS_KEY, rest);
+    return true;
+  }
+  /** Removes every linked server and every secret. */
+  async clear() {
+    await this.kv.remove(SERVERS_KEY);
+    await this.secrets.clear();
+  }
+};
+function linkedServerConfig(server, token) {
+  return {
+    name: server.name,
+    url: server.url,
+    ...token ? { headers: () => ({ Authorization: `Bearer ${token}` }) } : {}
+  };
+}
 var InputModeBase = class {
   constructor(host, resolve) {
     this.host = host;
@@ -17908,7 +18158,8 @@ var CliExecutionContext = class {
       const startedAt = Date.now();
       await this.executor.executeCommand(command2, this);
       this.events?.emit("command:executed", {
-        command: command2,
+        // As in the history: `--token`/`--password` values never leave
+        command: redactSecrets(command2),
         exitCode: this.executor.exitStatus ?? 0,
         durationMs: Date.now() - startedAt
       });
@@ -19388,7 +19639,7 @@ var CliCommandHistory = class {
     return this.loading;
   }
   async addCommand(command2) {
-    const normalizedCommand = command2.trim();
+    const normalizedCommand = redactSecrets(command2.trim());
     if (!normalizedCommand) return;
     await this.loading;
     const existingIndex = this.commandHistory.indexOf(normalizedCommand);
@@ -20977,6 +21228,129 @@ var CliStateStoreManager = class {
     };
   }
 };
+
+// src/lib/server/linked/cli-web-crypto-secret-store.ts
+var KEY_KEY = "qcli-secret-key";
+var NAMES_KEY = "qcli-secret-names";
+var SECRET_PREFIX = "qcli-secret:";
+var CliWebCryptoSecretStore = class {
+  constructor(kv, crypto2 = globalThis.crypto ?? null) {
+    this.kv = kv;
+    this.crypto = crypto2;
+    this.keyPromise = null;
+  }
+  isAvailable() {
+    return !!this.crypto?.subtle && typeof this.crypto.getRandomValues === "function";
+  }
+  async get(key) {
+    if (!this.isAvailable()) return void 0;
+    const record = await this.kv.get(SECRET_PREFIX + key);
+    if (!record?.iv || !record?.data) return void 0;
+    const cryptoKey = await this.kv.get(KEY_KEY);
+    if (!cryptoKey) return void 0;
+    try {
+      const plain = await this.crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: record.iv },
+        cryptoKey,
+        record.data
+      );
+      return new TextDecoder().decode(plain);
+    } catch {
+      return void 0;
+    }
+  }
+  async set(key, value) {
+    if (!this.isAvailable()) {
+      throw new Error("Secrets cannot be saved: this page has no Web Crypto (it must be served over https)");
+    }
+    const cryptoKey = await this.key();
+    const iv = this.crypto.getRandomValues(new Uint8Array(12));
+    const data = await this.crypto.subtle.encrypt(
+      { name: "AES-GCM", iv },
+      cryptoKey,
+      new TextEncoder().encode(value)
+    );
+    await this.kv.set(SECRET_PREFIX + key, { iv, data: new Uint8Array(data) });
+    const names = await this.kv.get(NAMES_KEY) ?? [];
+    if (!names.includes(key)) await this.kv.set(NAMES_KEY, [...names, key]);
+  }
+  async delete(key) {
+    await this.kv.remove(SECRET_PREFIX + key);
+    const names = await this.kv.get(NAMES_KEY) ?? [];
+    if (names.includes(key)) await this.kv.set(NAMES_KEY, names.filter((n) => n !== key));
+  }
+  async clear() {
+    for (const name of await this.kv.get(NAMES_KEY) ?? []) {
+      await this.kv.remove(SECRET_PREFIX + name);
+    }
+    await this.kv.remove(NAMES_KEY);
+    await this.kv.remove(KEY_KEY);
+    this.keyPromise = null;
+  }
+  /** The saved key, or a new one (created once, even for parallel calls). */
+  key() {
+    this.keyPromise ??= (async () => {
+      const saved = await this.kv.get(KEY_KEY);
+      if (saved) return saved;
+      const created = await this.crypto.subtle.generateKey(
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["encrypt", "decrypt"]
+      );
+      await this.kv.set(KEY_KEY, created);
+      return created;
+    })();
+    const pending = this.keyPromise;
+    pending.catch(() => {
+      if (this.keyPromise === pending) this.keyPromise = null;
+    });
+    return pending;
+  }
+};
+
+// src/lib/server/linked/cli-linked-servers-runtime.ts
+var webCryptoStores = /* @__PURE__ */ new WeakMap();
+function secretStoreOf(context2) {
+  const provided = context2.services.get(cliCore.ICliSecretStore_TOKEN);
+  if (provided) return provided;
+  const kv = context2.services.getRequired(cliCore.ICliKeyValueStore_TOKEN);
+  let store = webCryptoStores.get(kv);
+  if (!store) {
+    store = new CliWebCryptoSecretStore(kv);
+    webCryptoStores.set(kv, store);
+  }
+  return store;
+}
+function linkedServersOf(context2) {
+  const kv = context2.services.getRequired(cliCore.ICliKeyValueStore_TOKEN);
+  return new CliLinkedServers(kv, secretStoreOf(context2));
+}
+function rejectedTokenMessage(name) {
+  return `Server '${name}' rejected its token. Link it again with server add ${name}, or set a new token with server edit ${name} --token.`;
+}
+async function restoreLinkedServers(context2, manager, warn) {
+  if (!userServersEnabled(context2.options)) return;
+  const linked = linkedServersOf(context2);
+  let servers;
+  try {
+    servers = await linked.list();
+  } catch {
+    return;
+  }
+  for (const server of servers) {
+    if (manager.connections.has(server.name)) {
+      warn(`Linked server '${server.name}' is not connected: the app has a server with the same name.`);
+      continue;
+    }
+    if (!userServersAllow(context2.options, server.url)) {
+      warn(`Linked server '${server.name}' (${server.url}) is not allowed by this app.`);
+      continue;
+    }
+    const token = await linked.token(server.name).catch(() => void 0);
+    const connection = await manager.addServer(linkedServerConfig(server, token), { linked: true });
+    if (token && connection.needsSignIn) warn(rejectedTokenMessage(server.name));
+  }
+}
 var CliServerAuthService = class {
   constructor(services) {
     this.services = services;
@@ -21048,14 +21422,17 @@ function writeUnknownServer(context2, manager, name) {
 function writeConfigureHint(context2) {
   const { writer } = context2;
   writer.writeln(
-    `  Servers are configured by the app: ${writer.wrapInColor("servers: [{ name: 'node', url: 'http://localhost:8047' }]", cliCore.CliForegroundColor.Yellow)}`
+    `  Link one: ${writer.wrapInColor("server add", cliCore.CliForegroundColor.Cyan)}, or configure it in the app: ${writer.wrapInColor("servers: [{ name: 'node', url: 'http://localhost:8047' }]", cliCore.CliForegroundColor.Yellow)}`
   );
   writer.writeln(
     `  See ${writer.wrapInColor("https://cli.qodalis.com/docs/server-integration", cliCore.CliForegroundColor.Blue)}`
   );
 }
 function statusLabel(context2, connection) {
-  return connection.connected ? context2.writer.wrapInColor("\u25CF connected", cliCore.CliForegroundColor.Green) : context2.writer.wrapInColor("\u25CB unreachable", cliCore.CliForegroundColor.Red);
+  if (connection.connected) {
+    return context2.writer.wrapInColor("\u25CF connected", cliCore.CliForegroundColor.Green);
+  }
+  return connection.needsSignIn ? context2.writer.wrapInColor("\u25D0 sign-in needed", cliCore.CliForegroundColor.Yellow) : context2.writer.wrapInColor("\u25CB unreachable", cliCore.CliForegroundColor.Red);
 }
 async function pingServer(connection) {
   const started = performance.now();
@@ -21097,6 +21474,546 @@ function editDistance(a, b) {
   return row[b.length];
 }
 
+// src/lib/server/linked/cli-server-link-client.ts
+var V1 = "/api/v1/qcli";
+function plainText2(value) {
+  return String(value ?? "").replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+}
+async function readJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+async function probeServer(fetchFn, url) {
+  let versions;
+  try {
+    versions = await fetchFn(`${url}/api/qcli/versions`, { headers: { Accept: "application/json" } });
+  } catch (e) {
+    throw new Error(`Cannot reach ${url}: ${e.message || "network error"}`, { cause: e });
+  }
+  const body = versions.ok ? await readJson(versions) : null;
+  if (!body || !Array.isArray(body.supportedVersions)) {
+    throw new Error(`${url} is not a Qodalis CLI server (no version discovery at /api/qcli/versions)`);
+  }
+  let capabilities = null;
+  try {
+    const res = await fetchFn(`${url}${V1}/capabilities`, { headers: { Accept: "application/json" } });
+    if (res.ok) capabilities = await readJson(res);
+  } catch {
+  }
+  let needsSignIn = false;
+  try {
+    const res = await fetchFn(`${url}${V1}/commands`, { headers: { Accept: "application/json" } });
+    needsSignIn = res.status === 401 || res.status === 403;
+  } catch {
+  }
+  return { version: capabilities?.version, capabilities, needsSignIn };
+}
+async function requestLink(fetchFn, url, client) {
+  const res = await fetchFn(`${url}${V1}/link`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ client })
+  });
+  if (res.status === 404 || res.status === 405) return null;
+  const body = await readJson(res);
+  if (!res.ok || !body?.linkId) {
+    throw new Error(body?.error ? plainText2(body.error) : `The server refused the link request (${res.status})`);
+  }
+  let verificationUrl;
+  try {
+    verificationUrl = new URL(String(body.verificationUrl), `${url}/`);
+  } catch {
+    throw new Error("The server sent an invalid approval page address");
+  }
+  if (verificationUrl.protocol !== "https:" && verificationUrl.protocol !== "http:") {
+    throw new Error("The server sent an invalid approval page address");
+  }
+  return {
+    linkId: String(body.linkId),
+    userCode: plainText2(body.userCode),
+    verificationUrl: verificationUrl.toString(),
+    interval: Math.max(1, Number(body.interval) || 2),
+    expiresIn: Number(body.expiresIn) || 600
+  };
+}
+async function pollLink(fetchFn, url, linkId) {
+  const res = await fetchFn(`${url}${V1}/link/${encodeURIComponent(linkId)}`, { headers: { Accept: "application/json" } });
+  if (res.status === 404) return { status: "expired" };
+  const body = await readJson(res);
+  if (!res.ok || !body) throw new Error(`Link status unavailable (${res.status})`);
+  if (body.status === "approved" && body.token) return { status: "approved", token: body.token, userName: body.userName };
+  if (body.status === "denied") return { status: "denied" };
+  if (body.status === "expired") return { status: "expired" };
+  return { status: "pending" };
+}
+async function createTokenWithPassword(fetchFn, url, username, password, tokenName) {
+  const login = await fetchFn(`${url}${V1}/sessions`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ username, password })
+  });
+  const session = await readJson(login);
+  if (!login.ok || !session?.token) {
+    throw new Error(login.status === 404 ? "This server has no user sign-in" : plainText2(session?.error ?? "Sign-in failed"));
+  }
+  const auth = { Authorization: `Bearer ${session.token}` };
+  try {
+    for (let suffix = 1; ; suffix++) {
+      const name = suffix === 1 ? tokenName : `${tokenName.slice(0, 60)} ${suffix}`;
+      const created = await fetchFn(`${url}${V1}/tokens`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...auth },
+        body: JSON.stringify({ name })
+      });
+      const body = await readJson(created);
+      if (created.status === 409 && suffix < 20) continue;
+      if (!created.ok || !body?.token) throw new Error(body?.error ? plainText2(body.error) : `Could not create a token (${created.status})`);
+      return body.token;
+    }
+  } finally {
+    await fetchFn(`${url}${V1}/sessions/current`, { method: "DELETE", headers: auth }).catch(() => void 0);
+  }
+}
+function deviceName(appName = "Qodalis CLI") {
+  const nav = globalThis.navigator;
+  const ua = nav?.userAgent ?? "";
+  const platform = nav?.userAgentData?.platform || (/Android/i.test(ua) ? "Android" : /iPhone|iPad/i.test(ua) ? "iOS" : /Mac/i.test(ua) ? "macOS" : /Windows/i.test(ua) ? "Windows" : /Linux/i.test(ua) ? "Linux" : "");
+  const name = platform ? `${appName} on ${platform}` : appName;
+  return name.replace(/[^A-Za-z0-9._ -]/g, "-").slice(0, 64);
+}
+
+// src/lib/server/linked/cli-server-link-processors.ts
+var fetchOf = (context2) => (url, init) => context2.http.fetch(url, init);
+function sleep(ms, signal) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      resolve();
+    }, { once: true });
+  });
+}
+function linkingDisabled(context2) {
+  if (userServersEnabled(context2.options)) return false;
+  context2.writer.writeError(
+    context2.translator.t("cli.server.link.disabled", "This app does not allow linking servers from the terminal.")
+  );
+  return true;
+}
+function parseAddArgs(value) {
+  const words = cliCore.splitShellWords(value ?? "");
+  if (words.length >= 2) return { name: words[0], url: words[1] };
+  if (words.length === 1) {
+    return /[.:/]/.test(words[0]) ? { url: words[0] } : { name: words[0] };
+  }
+  return {};
+}
+async function replaceConnection(manager, config) {
+  const current = [...manager.connections.keys()].find((n) => n.toLowerCase() === config.name.toLowerCase());
+  const wasDefault = !!current && manager.defaultServer === current;
+  if (current) manager.removeServer(current);
+  const connection = await manager.addServer(config, { linked: true });
+  if (wasDefault) manager.setDefaultServer(config.name);
+  return connection;
+}
+var ServerAddProcessor = class {
+  constructor() {
+    this.command = "add";
+    this.aliases = ["link"];
+    this.description = "Link a server to this terminal (kept across reloads)";
+    this.acceptsRawInput = true;
+    this.valueRequired = false;
+    this.parameters = [
+      { name: "token", description: "API token (qcli_pat_\u2026) to link with (asked for, hidden, when given without a value)", required: false, type: "string" },
+      { name: "default", description: "Make it the default server", required: false, type: "boolean" },
+      { name: "no-browser", description: "Link with a token or a password, without the browser", required: false, type: "boolean" }
+    ];
+  }
+  async processCommand(command2, context2) {
+    const t = context2.translator;
+    const { writer, reader } = context2;
+    const manager = serverManagerOf(context2);
+    if (!manager || linkingDisabled(context2)) return;
+    const linked = linkedServersOf(context2);
+    const args = parseAddArgs(command2.value);
+    const rawUrl = args.url ?? await reader.readLine(t.t("cli.server.link.url_prompt", "Server URL: "), { placeholder: "https://my-server.example.com" });
+    if (!rawUrl) return;
+    const pageProtocol = globalThis.location?.protocol;
+    const checked = checkServerUrl(rawUrl, pageProtocol);
+    if (typeof checked === "string") {
+      writer.writeError(checked);
+      return;
+    }
+    const url = checked.url;
+    if (!userServersAllow(context2.options, url)) {
+      writer.writeError(t.t("cli.server.link.origin_not_allowed", "This app does not allow linking {url}.", { url }));
+      return;
+    }
+    if (checked.mixedContent) {
+      writer.writeWarning(t.t("cli.server.link.mixed_content", "This page is served over https: the browser may block requests to an http server."));
+    }
+    let probe;
+    context2.spinner?.show(t.t("cli.server.link.checking", "Checking {url}\u2026", { url }));
+    try {
+      probe = await probeServer(fetchOf(context2), url);
+    } catch (e) {
+      writer.writeError(e.message);
+      return;
+    } finally {
+      context2.spinner?.hide();
+    }
+    writeProbe(context2, url, probe);
+    if (checked.insecure) {
+      writer.writeWarning(t.t("cli.server.link.http_warning", "{url} is not encrypted (http): its token travels in clear text on the network.", { url }));
+      const go = await reader.readConfirm(t.t("cli.server.link.http_confirm", "Link it anyway?"), false);
+      if (!go) return;
+    }
+    let name = args.name;
+    if (name) {
+      if (!await this.nameAvailable(context2, manager, linked, name)) return;
+    }
+    const tokenFlag = command2.args?.["token"];
+    const tokenArg = typeof tokenFlag === "string" && tokenFlag.trim() ? tokenFlag.trim() : void 0;
+    const method = tokenFlag !== void 0 && tokenFlag !== false ? "token" : await this.chooseMethod(context2, probe, !!command2.args?.["no-browser"]);
+    if (!method) return;
+    if (method !== "none" && !await secretStoreOf(context2).isAvailable()) {
+      writer.writeError(t.t("cli.server.link.no_secret_store", "Tokens cannot be kept safely on this page (no Web Crypto: serve it over https). The server was not linked."));
+      return;
+    }
+    let token;
+    let userName;
+    if (method === "browser") {
+      const result = await this.linkInBrowser(context2, url);
+      if (!result) return;
+      token = result.token;
+      userName = result.userName;
+    } else if (method === "token") {
+      token = tokenArg ?? (await reader.readPassword(t.t("cli.server.link.token_prompt", "API token: ")))?.trim();
+      if (!token) return;
+    } else if (method === "password") {
+      const username = await reader.readLine(t.t("cli.server.link.username_prompt", "Username: "));
+      if (!username) return;
+      const password = await reader.readPassword(t.t("cli.server.link.password_prompt", "Password: "));
+      if (!password) return;
+      try {
+        token = await createTokenWithPassword(fetchOf(context2), url, username.trim(), password, deviceName());
+        userName = username.trim();
+      } catch (e) {
+        writer.writeError(e.message);
+        return;
+      }
+    }
+    if (!name) {
+      const suggested = suggestServerName(url, (n) => manager.connections.has(n));
+      const answer = await reader.readLine(t.t("cli.server.link.name_prompt", "Name for this server: "), {
+        default: suggested,
+        placeholder: suggested,
+        validate: (value) => !value || SERVER_NAME_PATTERN.test(value.trim()) ? null : t.t("cli.server.link.invalid_name", "Letters, digits, - and _ (at most 32), starting with a letter or digit")
+      });
+      if (answer === null) return;
+      name = answer.trim() || suggested;
+      if (!await this.nameAvailable(context2, manager, linked, name)) return;
+    }
+    const server = { name, url, addedAt: Date.now() };
+    const previous = (await linked.get(name))?.name;
+    if (previous && previous !== name) await linked.remove(previous);
+    await linked.save(server, token);
+    const connection = await replaceConnection(manager, linkedServerConfig(server, token));
+    if (connection.connected) {
+      writer.writeSuccess(
+        t.t("cli.server.link.linked", "Linked {name}: {count} commands{user}.", {
+          name,
+          count: connection.commands.length,
+          user: userName ? t.t("cli.server.link.as_user", " as {user}", { user: userName }) : ""
+        })
+      );
+    } else if (token && connection.needsSignIn) {
+      writer.writeWarning(rejectedTokenMessage(name));
+    } else if (connection.needsSignIn) {
+      writer.writeWarning(t.t("cli.server.link.needs_sign_in", "Linked {name}, but its commands need a sign-in: link it with a token or through the browser.", { name }));
+    } else {
+      writer.writeWarning(t.t("cli.server.link.unreachable", "Linked {name}, but it is unreachable now: its commands load when it is back.", { name }));
+    }
+    if (command2.args?.["default"]) {
+      manager.setDefaultServer(name);
+      context2.state.updateState({ defaultServer: name });
+      writer.writeln(t.t("cli.server.link.now_default", "  {name} is the default server.", { name }));
+    }
+  }
+  async nameAvailable(context2, manager, linked, name) {
+    const t = context2.translator;
+    if (!SERVER_NAME_PATTERN.test(name)) {
+      context2.writer.writeError(t.t("cli.server.link.invalid_name", "Letters, digits, - and _ (at most 32), starting with a letter or digit"));
+      return false;
+    }
+    const existing = [...manager.connections.keys()].find((n) => n.toLowerCase() === name.toLowerCase());
+    if (existing && !manager.isLinked(existing)) {
+      context2.writer.writeError(t.t("cli.server.link.host_server", "'{name}' is configured by the app and cannot be replaced.", { name: existing }));
+      return false;
+    }
+    if (existing || await linked.get(name)) {
+      const replace = await context2.reader.readConfirm(
+        t.t("cli.server.link.replace_confirm", "A linked server '{name}' exists. Replace it?", { name }),
+        false
+      );
+      return !!replace;
+    }
+    return true;
+  }
+  async chooseMethod(context2, probe, noBrowser) {
+    const t = context2.translator;
+    const options = [
+      ...noBrowser ? [] : [{ label: t.t("cli.server.link.method_browser", "Open the server in the browser and approve (recommended)"), value: "browser" }],
+      { label: t.t("cli.server.link.method_token", "Paste an API token"), value: "token" },
+      { label: t.t("cli.server.link.method_password", "Sign in with user and password"), value: "password" },
+      ...probe.needsSignIn ? [] : [{ label: t.t("cli.server.link.method_none", "No sign-in (open server)"), value: "none" }]
+    ];
+    const choice = await context2.reader.readSelect(t.t("cli.server.link.method_prompt", "How do you want to link it?"), options);
+    return choice ?? null;
+  }
+  /** The device flow: a link request, the page to approve it, then polling until a decision. */
+  async linkInBrowser(context2, url) {
+    const t = context2.translator;
+    const { writer } = context2;
+    const fetchFn = fetchOf(context2);
+    let request;
+    try {
+      request = await requestLink(fetchFn, url, deviceName());
+    } catch (e) {
+      writer.writeError(e.message);
+      return null;
+    }
+    if (!request) {
+      writer.writeError(t.t("cli.server.link.no_browser_link", "This server cannot link through the browser (it needs the users plugin, 1.0.0-beta.25 or later). Use server add --no-browser."));
+      return null;
+    }
+    writer.writeln();
+    writer.writeln(t.t("cli.server.link.open_page", "  Open this page, sign in and approve:"));
+    writer.write("  ");
+    writer.writeLink(request.verificationUrl, request.verificationUrl);
+    writer.writeln();
+    writer.writeln(
+      t.t("cli.server.link.compare_code", "  Check that it shows the code {code}", {
+        code: writer.wrapInColor(request.userCode, cliCore.CliForegroundColor.Yellow)
+      })
+    );
+    writer.writeln();
+    try {
+      globalThis.open?.(request.verificationUrl, "_blank");
+    } catch {
+    }
+    const deadline = Date.now() + request.expiresIn * 1e3;
+    const cancelled = () => {
+      context2.spinner?.hide();
+      const minutes = Math.max(1, Math.ceil((deadline - Date.now()) / 6e4));
+      writer.writeInfo(
+        t.t("cli.server.link.cancelled", "Cancelled. The request expires on the server in {minutes} min.", { minutes })
+      );
+      return null;
+    };
+    context2.spinner?.show(t.t("cli.server.link.waiting", "Waiting for the approval\u2026 (Ctrl+C to cancel)"));
+    try {
+      while (Date.now() < deadline) {
+        if (context2.signal?.aborted) return cancelled();
+        await sleep(request.interval * 1e3, context2.signal);
+        if (context2.signal?.aborted) return cancelled();
+        let poll;
+        try {
+          poll = await pollLink(fetchFn, url, request.linkId);
+        } catch {
+          continue;
+        }
+        if (poll.status === "approved") return { token: poll.token, userName: poll.userName };
+        if (poll.status === "denied") {
+          context2.spinner?.hide();
+          writer.writeError(t.t("cli.server.link.denied", "The link request was denied."));
+          return null;
+        }
+        if (poll.status === "expired") break;
+      }
+    } finally {
+      context2.spinner?.hide();
+    }
+    writer.writeError(t.t("cli.server.link.expired", "The link request expired. Run server add again."));
+    return null;
+  }
+  writeDescription(context2) {
+    const t = context2.translator;
+    cliCore.writeWrapped(
+      context2,
+      t.t("cli.server.add.help.description", "Links a Node, .NET or Python server to this terminal: its commands are available at once and after every reload. Asks for what is missing: the URL, how to sign in (approve in the browser, paste an API token, or a user and password) and a name. Tokens are kept encrypted and never shown again; only https servers can be linked (http for localhost and private addresses).")
+    );
+    context2.writer.writeln();
+    cliCore.writeUsage(context2, [
+      ["server add", t.t("cli.server.add.help.interactive", "Asks for everything")],
+      ["server add <url>", t.t("cli.server.add.help.url", "Link this server")],
+      ["server add <name> <url> --token [token]", t.t("cli.server.add.help.token", "Link with an API token (scripts)")]
+    ]);
+    context2.writer.writeln();
+    cliCore.writeExamples(context2, [
+      ["server add https://cli.example.com", t.t("cli.server.add.help.example_browser", "Approve in the browser")],
+      ["server add home http://192.168.1.20:8047 --no-browser", t.t("cli.server.add.help.example_lan", "A server on the local network")]
+    ]);
+  }
+};
+function writeProbe(context2, url, probe) {
+  const { writer } = context2;
+  const caps = probe.capabilities;
+  const details = [caps?.os, caps?.shell ? "shell" : null, caps?.streaming ? "streaming" : null, probe.needsSignIn ? "sign-in required" : null].filter(Boolean).join(" \xB7 ");
+  writer.writeSuccess(
+    `${context2.translator.t("cli.server.link.found", "Qodalis CLI server")} ${probe.version ?? ""} ${writer.wrapInColor(url, cliCore.CliForegroundColor.Cyan)}${details ? ` (${details})` : ""}`.replace(/\s+/g, " ")
+  );
+}
+var ServerRemoveProcessor = class {
+  constructor() {
+    this.command = "remove";
+    this.aliases = ["rm", "unlink"];
+    this.description = "Unlink a server linked with server add (its token is deleted)";
+    this.acceptsRawInput = true;
+    this.valueRequired = true;
+  }
+  async processCommand(command2, context2) {
+    const t = context2.translator;
+    const manager = serverManagerOf(context2);
+    if (!manager) return;
+    const name = cliCore.splitShellWords(command2.value ?? "")[0] ?? "";
+    const linked = linkedServersOf(context2);
+    const connected = [...manager.connections.keys()].find((n) => n.toLowerCase() === name.toLowerCase());
+    const saved = await linked.get(name);
+    if (connected && !manager.isLinked(connected) && !saved) {
+      context2.writer.writeError(t.t("cli.server.link.cannot_remove_host", "'{name}' is configured by the app and cannot be removed.", { name: connected }));
+      return;
+    }
+    if (!saved && !connected) {
+      context2.writer.writeError(t.t("cli.server.link.unknown_linked", "No linked server '{name}'. See server list.", { name }));
+      return;
+    }
+    await linked.remove(saved?.name ?? name);
+    const linkedConnection = connected && manager.isLinked(connected) ? connected : void 0;
+    if (linkedConnection) manager.removeServer(linkedConnection);
+    const removedName = saved?.name ?? linkedConnection ?? name;
+    if (linkedConnection && context2.state.getState().defaultServer === linkedConnection) {
+      context2.state.updateState({ defaultServer: null });
+    }
+    context2.writer.writeSuccess(t.t("cli.server.link.removed", "Unlinked {name}; its token is deleted from this device.", { name: removedName }));
+    context2.writer.writeln(t.t("cli.server.link.revoke_hint", "  The token stays valid on the server until it expires: revoke it there with token revoke."));
+  }
+};
+var ServerEditProcessor = class {
+  constructor() {
+    this.command = "edit";
+    this.description = "Change the URL or the token of a linked server";
+    this.acceptsRawInput = true;
+    this.valueRequired = true;
+    this.parameters = [
+      { name: "url", description: "New URL", required: false, type: "string" },
+      { name: "token", description: "New API token (asked for, hidden, when given without a value)", required: false, type: "string" }
+    ];
+  }
+  async processCommand(command2, context2) {
+    const t = context2.translator;
+    const { writer } = context2;
+    const manager = serverManagerOf(context2);
+    if (!manager || linkingDisabled(context2)) return;
+    const name = cliCore.splitShellWords(command2.value ?? "")[0] ?? "";
+    const connected = [...manager.connections.keys()].find((n) => n.toLowerCase() === name.toLowerCase());
+    if (connected && !manager.isLinked(connected)) {
+      writer.writeError(t.t("cli.server.link.cannot_edit_host", "'{name}' is configured by the app and cannot be edited.", { name: connected }));
+      return;
+    }
+    const linked = linkedServersOf(context2);
+    const saved = await linked.get(name);
+    if (!saved) {
+      writer.writeError(t.t("cli.server.link.unknown_linked", "No linked server '{name}'. See server list.", { name }));
+      return;
+    }
+    const urlArg = command2.args?.["url"];
+    const tokenArg = command2.args?.["token"];
+    if (urlArg === void 0 && tokenArg === void 0) {
+      writer.writeError(t.t("cli.server.link.edit_nothing", "Give --url <url> and/or --token."));
+      return;
+    }
+    let url = saved.url;
+    if (typeof urlArg === "string") {
+      const checked = checkServerUrl(urlArg, globalThis.location?.protocol);
+      if (typeof checked === "string") {
+        writer.writeError(checked);
+        return;
+      }
+      if (!userServersAllow(context2.options, checked.url)) {
+        writer.writeError(t.t("cli.server.link.origin_not_allowed", "This app does not allow linking {url}.", { url: checked.url }));
+        return;
+      }
+      if (checked.insecure) {
+        writer.writeWarning(t.t("cli.server.link.http_warning", "{url} is not encrypted (http): its token travels in clear text on the network.", { url: checked.url }));
+        if (!await context2.reader.readConfirm(t.t("cli.server.link.http_confirm", "Link it anyway?"), false)) return;
+      }
+      if (checked.mixedContent) {
+        writer.writeWarning(t.t("cli.server.link.mixed_content", "This page is served over https: the browser may block requests to an http server."));
+      }
+      url = checked.url;
+    }
+    let token = await linked.token(saved.name);
+    if (tokenArg !== void 0) {
+      token = typeof tokenArg === "string" && tokenArg.trim() ? tokenArg.trim() : (await context2.reader.readPassword(t.t("cli.server.link.token_prompt", "API token: ")))?.trim();
+      if (!token) return;
+    }
+    const updated = { ...saved, url };
+    await linked.save(updated, token);
+    const connection = await replaceConnection(manager, linkedServerConfig(updated, token));
+    if (connection.connected) {
+      writer.writeSuccess(t.t("cli.server.link.updated", "Updated {name}: {count} commands.", { name: saved.name, count: connection.commands.length }));
+    } else if (token && connection.needsSignIn) {
+      writer.writeWarning(rejectedTokenMessage(saved.name));
+    } else {
+      writer.writeWarning(t.t("cli.server.link.updated_unreachable", "Updated {name}, but it is unreachable now.", { name: saved.name }));
+    }
+  }
+};
+var ServerForgetAllProcessor = class {
+  constructor() {
+    this.command = "forget-all";
+    this.description = "Unlink every linked server and delete every saved token";
+  }
+  async processCommand(_command, context2) {
+    const t = context2.translator;
+    const manager = serverManagerOf(context2);
+    if (!manager) return;
+    const linked = linkedServersOf(context2);
+    const servers = await linked.list();
+    if (servers.length === 0) {
+      context2.writer.writeInfo(t.t("cli.server.link.none_linked", "No linked servers. Link one with server add."));
+      return;
+    }
+    const ok = await context2.reader.readConfirm(
+      t.t("cli.server.link.forget_all_confirm", "Unlink every linked server ({count}) and delete their saved tokens?", { count: servers.length }),
+      false
+    );
+    if (!ok) return;
+    await linked.clear();
+    for (const name of [...manager.connections.keys()]) {
+      if (manager.isLinked(name)) manager.removeServer(name);
+    }
+    const saved = context2.state.getState().defaultServer;
+    if (saved && !manager.connections.has(saved)) context2.state.updateState({ defaultServer: null });
+    context2.writer.writeSuccess(t.t("cli.server.link.forgot_all", "Every linked server and saved token is gone."));
+  }
+};
+async function linkedTokenLabels(context2, manager) {
+  const labels = /* @__PURE__ */ new Map();
+  const names = [...manager.connections.keys()].filter((n) => manager.isLinked(n));
+  if (names.length === 0) return labels;
+  const linked = linkedServersOf(context2);
+  for (const name of names) {
+    const token = await linked.token(name).catch(() => void 0);
+    if (token) labels.set(name, maskToken(token));
+  }
+  return labels;
+}
+
 // src/lib/server/cli-server-command-processor.ts
 var CliServerCommandProcessor = class {
   constructor() {
@@ -21118,7 +22035,11 @@ var CliServerCommandProcessor = class {
       new ServerStatusProcessor(),
       new ServerCommandsProcessor(),
       new ServerReconnectProcessor(),
-      new ServerDefaultProcessor()
+      new ServerDefaultProcessor(),
+      new ServerAddProcessor(),
+      new ServerRemoveProcessor(),
+      new ServerEditProcessor(),
+      new ServerForgetAllProcessor()
     ];
   }
   /** Restore the default server saved by `server default <name>`. */
@@ -21134,7 +22055,7 @@ var CliServerCommandProcessor = class {
     const t = context2.translator;
     const manager = serverManagerOf(context2);
     if (!manager) return;
-    writeServerTable(context2, manager);
+    writeServerTable(context2, manager, await linkedTokenLabels(context2, manager));
     context2.writer.writeln();
     cliCore.writeHint(context2, "help server", t.t("cli.server.help.see_everything_you_can", "to see everything you can do"));
   }
@@ -21165,6 +22086,10 @@ var CliServerCommandProcessor = class {
       ["server commands|cmds [name]", t.t("cli.server.help.commands_each_server_provides", "Commands each server provides")],
       ["server reconnect|rc [name]", t.t("cli.server.help.connect_again_unreachable_servers", "Connect again (unreachable servers, or one)")],
       ["server default|use [name]", t.t("cli.server.help.show_set_server_shared", "Show or set the server for shared commands")],
+      ["server add [name] [url]", t.t("cli.server.help.add", "Link a server to this terminal (kept across reloads)")],
+      ["server edit <name> --url|--token", t.t("cli.server.help.edit", "Change a linked server")],
+      ["server remove <name>", t.t("cli.server.help.remove", "Unlink a server and delete its token")],
+      ["server forget-all", t.t("cli.server.help.forget_all", "Unlink every linked server")],
       ["ssh [name] [command]", t.t("cli.server.help.open_shell_server_run", "Open a shell on a server, or run one command")]
     ]);
     writer.writeln();
@@ -21187,7 +22112,7 @@ var ServerListProcessor = class {
   }
   async processCommand(_command, context2) {
     const manager = serverManagerOf(context2);
-    if (manager) writeServerTable(context2, manager);
+    if (manager) writeServerTable(context2, manager, await linkedTokenLabels(context2, manager));
   }
   writeDescription(context2) {
     const t = context2.translator;
@@ -21199,7 +22124,7 @@ var ServerListProcessor = class {
     cliCore.writeUsage(context2, [["server list", ""], ["server ls", ""]]);
   }
 };
-function writeServerTable(context2, manager) {
+function writeServerTable(context2, manager, tokenLabels = /* @__PURE__ */ new Map()) {
   const t = context2.translator;
   const { writer } = context2;
   if (manager.connections.size === 0) {
@@ -21219,12 +22144,13 @@ function writeServerTable(context2, manager) {
       connected ? connection.capabilities?.version ?? "-" : "-",
       connected ? `v${connection.apiVersion}` : "-",
       connected ? String(connection.commands.length) : "-",
-      connected ? connection.capabilities?.shell ? "yes" : "no" : "-"
+      connected ? connection.capabilities?.shell ? "yes" : "no" : "-",
+      manager.isLinked(name) ? `linked ${tokenLabels.get(name) ?? ""}`.trim() : "app"
     ]);
   }
   writer.writeln(`\u{1F5A5}  Servers (${manager.connections.size}):`);
   writer.writeTable(
-    ["Name", "Status", "URL", "Version", "API", "Commands", "Shell"],
+    ["Name", "Status", "URL", "Version", "API", "Commands", "Shell", "Source"],
     rows
   );
   if (manager.defaultServer) {
@@ -22487,6 +23413,7 @@ function resolveCompletionPath(tokens, tokenIndex, processors, currentToken = ""
   let descriptors = [];
   let candidates = processors;
   let isFlagValue = false;
+  let flag;
   for (let i = 0; i < parsed.length; i++) {
     const token = parsed[i];
     if (token.kind === "flag") {
@@ -22495,6 +23422,7 @@ function resolveCompletionPath(tokens, tokenIndex, processors, currentToken = ""
         if (parsed[i + 1].kind === "word") i++;
       } else if (!currentToken.startsWith("-")) {
         isFlagValue = true;
+        flag = findParameter(token.name, descriptors);
       }
       continue;
     }
@@ -22508,7 +23436,11 @@ function resolveCompletionPath(tokens, tokenIndex, processors, currentToken = ""
     }
     candidates = match?.processors?.length ? match.processors : void 0;
   }
-  return { processor, descriptors, subCommands: candidates, isFlagValue };
+  return { processor, descriptors, subCommands: candidates, isFlagValue, flag };
+}
+function findParameter(name, descriptors) {
+  const bare = (a) => a.replace(/^-+/, "");
+  return descriptors.find((d) => d.name === name) ?? descriptors.find((d) => d.aliases?.some((a) => bare(a) === name));
 }
 function toParsedToken(text) {
   const flag = /^(--?)([a-zA-Z0-9_][^\s=]*)(=.*)?$/.exec(text);
@@ -22607,6 +23539,36 @@ var CliParameterCompletionProvider = class {
   }
 };
 
+// src/lib/completion/cli-parameter-value-completion-provider.ts
+var CliParameterValueCompletionProvider = class {
+  constructor(registry) {
+    this.registry = registry;
+    this.priority = 190;
+  }
+  getCompletions(context2) {
+    const { tokens, tokenIndex, token } = context2;
+    if (tokens.length === 0) return [];
+    const inline = /^(--?)([^\s=]+)=(.*)$/.exec(token);
+    if (inline) {
+      const path2 = resolveCompletionPath(tokens, tokenIndex, this.registry.processors, token);
+      const values2 = findParameter(inline[2], path2.descriptors)?.allowedValues;
+      if (!values2?.length) return [];
+      const prefix = `${inline[1]}${inline[2]}=`;
+      return matchIgnoringCase(values2, inline[3]).map((v) => `${prefix}${v}`);
+    }
+    if (token.startsWith("-")) return [];
+    const path = resolveCompletionPath(tokens, tokenIndex, this.registry.processors, token);
+    const values = path.isFlagValue ? path.flag?.allowedValues : void 0;
+    return values?.length ? matchIgnoringCase(values, token) : [];
+  }
+};
+function matchIgnoringCase(values, prefix) {
+  const exact = getAccelerator().prefixMatch(values, prefix);
+  if (exact.length) return exact;
+  const lower = prefix.toLowerCase();
+  return values.filter((v) => v.toLowerCase().startsWith(lower));
+}
+
 // src/lib/completion/cli-service-name-completion-provider.ts
 var SERVICE_NAME_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "start",
@@ -22894,6 +23856,7 @@ function createCompletionProviders(deps) {
     new CliServerNameCompletionProvider(serverManager),
     new CliConfigKeyCompletionProvider(registry),
     new CliCommandCompletionProvider(registry),
+    new CliParameterValueCompletionProvider(registry),
     new CliParameterCompletionProvider(registry, executor)
   ];
   const fromPlugins = services.getAll(
@@ -23114,29 +24077,31 @@ var CliEngine = class {
     ]);
     return services.getRequired(CliServerManager_TOKEN);
   }
-  /** 4. Connect to the configured servers, one boot step each. */
+  /**
+   * 4. Connect to the configured servers, one boot step each, then to the
+   * servers the user linked (`server add`).
+   */
   async connectServers(serverManager, bootLog) {
-    const servers = this.options?.servers;
-    if (!servers || servers.length === 0) return;
     const ctx = this.executionContext;
-    bootLog.setCurrent("Connecting to servers");
-    await serverManager.connectAll(
-      servers,
-      {
-        warn: (msg) => {
-          ctx.logger.warn(msg);
-          bootLog.warn(msg);
-          bootLog.completeStep();
-        },
-        info: (msg) => {
-          ctx.logger.info(msg);
-          bootLog.ok(msg);
-          bootLog.completeStep();
-        }
+    const logger = {
+      warn: (msg) => {
+        ctx.logger.warn(msg);
+        bootLog.warn(msg);
+        bootLog.completeStep();
       },
-      ctx.backgroundServices,
-      ctx.logger
-    );
+      info: (msg) => {
+        ctx.logger.info(msg);
+        bootLog.ok(msg);
+        bootLog.completeStep();
+      }
+    };
+    serverManager.configure(logger, ctx.backgroundServices, ctx.logger);
+    const servers = this.options?.servers;
+    if (servers && servers.length > 0) {
+      bootLog.setCurrent("Connecting to servers");
+      await serverManager.connectAll(servers, logger, ctx.backgroundServices, ctx.logger);
+    }
+    await restoreLinkedServers(ctx, serverManager, logger.warn);
   }
   /**
    * 5. Built-in welcome and server modules, the app's modules, and the
@@ -25331,6 +26296,7 @@ exports.CliJsonCommandProcessor = CliJsonCommandProcessor;
 exports.CliKeyValueStore = CliKeyValueStore;
 exports.CliKeyValueStore_TOKEN = CliKeyValueStore_TOKEN;
 exports.CliKillCommandProcessor = CliKillCommandProcessor;
+exports.CliLinkedServers = CliLinkedServers;
 exports.CliLogger = CliLogger;
 exports.CliLoremCommandProcessor = CliLoremCommandProcessor;
 exports.CliModuleRegistry_TOKEN = CliModuleRegistry_TOKEN;
@@ -25382,6 +26348,7 @@ exports.CliUnameCommandProcessor = CliUnameCommandProcessor;
 exports.CliUnsetCommandProcessor = CliUnsetCommandProcessor;
 exports.CliUptimeCommandProcessor = CliUptimeCommandProcessor;
 exports.CliVersionCommandProcessor = CliVersionCommandProcessor;
+exports.CliWebCryptoSecretStore = CliWebCryptoSecretStore;
 exports.CliYesCommandProcessor = CliYesCommandProcessor;
 exports.CommandParser = CommandParser;
 exports.DEFAULT_CLI_NAME = DEFAULT_CLI_NAME;
@@ -25407,6 +26374,7 @@ exports.PANEL_LABELS = PANEL_LABELS;
 exports.PANEL_POSITIONS = PANEL_POSITIONS;
 exports.ProcessExitedError = ProcessExitedError;
 exports.RESTORE_ICON = RESTORE_ICON;
+exports.SERVER_NAME_PATTERN = SERVER_NAME_PATTERN;
 exports.SERVICES_ICON = SERVICES_ICON;
 exports.SUCCESS_ICON = SUCCESS_ICON;
 exports.SVG_COMMON_ATTRS = SVG_COMMON_ATTRS;
@@ -25420,6 +26388,7 @@ exports.appendStderrToFile = appendStderrToFile;
 exports.applyEnvironmentChange = applyEnvironmentChange;
 exports.builtinProcessors = builtinProcessors;
 exports.capitalize = capitalize;
+exports.checkServerUrl = checkServerUrl;
 exports.clampPanelSize = clampPanelSize;
 exports.cliScriptRunner = cliScriptRunner;
 exports.collapseChevronIcon = collapseChevronIcon;
@@ -25431,8 +26400,10 @@ exports.contextMenuItems = contextMenuItems;
 exports.contextMenuStyle = contextMenuStyle;
 exports.createCliEngine = createCliEngine;
 exports.createServerModule = createServerModule;
+exports.createTokenWithPassword = createTokenWithPassword;
 exports.defaultFontSize = defaultFontSize;
 exports.describeShellClose = describeShellClose;
+exports.deviceName = deviceName;
 exports.distributePaneWidths = distributePaneWidths;
 exports.dropdownAnchorStyle = dropdownAnchorStyle;
 exports.executeOnServer = executeOnServer;
@@ -25457,14 +26428,19 @@ exports.initializeServices = initializeServices;
 exports.initializeTerminal = initializeTerminal;
 exports.interruptCommand = interruptCommand;
 exports.isHorizontalPosition = isHorizontalPosition;
+exports.isPrivateHost = isPrivateHost;
 exports.isWasmAccelerated = isWasmAccelerated;
 exports.joinClasses = joinClasses;
 exports.killProcess = killProcess;
+exports.linkedServerConfig = linkedServerConfig;
+exports.linkedServersOf = linkedServersOf;
+exports.maskToken = maskToken;
 exports.matchGlob = matchGlob;
 exports.mergeCliOptions = mergeCliOptions;
 exports.miscProcessors = miscProcessors;
 exports.nextRowsCommand = nextRowsCommand;
 exports.normalizePaneWidths = normalizePaneWidths;
+exports.normalizeServerUrl = normalizeServerUrl;
 exports.openLink = openLink;
 exports.openStatusDropdown = openStatusDropdown;
 exports.paneClass = paneClass;
@@ -25478,28 +26454,38 @@ exports.panesContainerClass = panesContainerClass;
 exports.panesContainerWidth = panesContainerWidth;
 exports.parseAssignments = parseAssignments;
 exports.parseScript = parseScript;
+exports.plainText = plainText2;
+exports.pollLink = pollLink;
 exports.positionDropdownItemClass = positionDropdownItemClass;
 exports.positionIcon = positionIcon;
 exports.positionOptions = positionOptions;
+exports.probeServer = probeServer;
 exports.reconcileArgs = reconcileArgs;
+exports.redactSecrets = redactSecrets;
 exports.renderServerResponse = renderServerResponse;
 exports.renderSingleOutput = renderSingleOutput;
+exports.requestLink = requestLink;
 exports.resizePaneWidths = resizePaneWidths;
 exports.resizedPanelSize = resizedPanelSize;
 exports.resolveCliBranding = resolveCliBranding;
 exports.resolveCliHostConfig = resolveCliHostConfig;
+exports.restoreLinkedServers = restoreLinkedServers;
 exports.runContextMenuAction = runContextMenuAction;
 exports.runScript = runScript;
+exports.secretStoreOf = secretStoreOf;
 exports.splitWords = splitWords;
 exports.statusIndicators = statusIndicators;
 exports.substituteCommands = substituteCommands;
 exports.substituteVars = substituteVars;
+exports.suggestServerName = suggestServerName;
 exports.svgAttrs = svgAttrs;
 exports.systemProcessors = systemProcessors;
 exports.tabDotClass = tabDotClass;
 exports.themeInfos = themeInfos;
 exports.themes = themes;
 exports.tryExecuteScript = tryExecuteScript;
+exports.userServersAllow = userServersAllow;
+exports.userServersEnabled = userServersEnabled;
 exports.versionGlobalParameter = versionGlobalParameter;
 exports.waitForLayout = waitForLayout;
 exports.welcomeModule = welcomeModule;