@qodalis/cli 2.4.2 → 2.5.1

package/public-api.mjs

@@ -1,4 +1,4 @@
-import { createCliToken, CliLogLevel, DefaultThemes, DefaultThemeInfos, CliForegroundColor, DefaultLibraryAuthor, CliIcon, writeWrapped, LIBRARY_VERSION as LIBRARY_VERSION$1, writeUsage, writeExamples, writeHint, joinShellWords, CliKeyData, unquoteRawArgument, resolveConfigurationCategories, ICliTranslationService_TOKEN, splitShellWords, cliAuthorize, CliUsersPermissions, ICliAuthorizationService_TOKEN, quoteShellWord, resolveHeaders, appendQueryParams, buildServerWebSocketUrl, ServerVersionNegotiator, CliHttpError, formatJson, visibleLength, ICliEventBus_TOKEN, stripAnsi, CancellablePromise, isCliAccessDeniedError, getParameterValue, ICliCommandGuard_TOKEN, getRightOfWord, CLI_CONFIGURE_STORE_NAME, CliModuleRegistry, initializeBrowserEnvironment, ICliPermissionRegistry_TOKEN, satisfiesVersionRange, CliServerPermissions, ICliDragDropService_TOKEN, cliAccessMetadataGuards, resolvePanelTheme, prefersDarkScheme, ICliServerAuthService_TOKEN, loadPanelPosition, savePanelPosition, derivePanelThemeStyles, delay, colorFirstWord, clearTerminalLine, ICliCompletionProvider_TOKEN, ICliServerAuthTokenProvider_TOKEN, truncateToWidth } from '@qodalis/cli-core';
+import { createCliToken, CliLogLevel, DefaultThemes, DefaultThemeInfos, CliForegroundColor, DefaultLibraryAuthor, CliIcon, writeWrapped, LIBRARY_VERSION as LIBRARY_VERSION$1, writeUsage, writeExamples, writeHint, joinShellWords, CliKeyData, unquoteRawArgument, resolveConfigurationCategories, ICliTranslationService_TOKEN, splitShellWords, cliAuthorize, CliUsersPermissions, ICliAuthorizationService_TOKEN, quoteShellWord, resolveHeaders, appendQueryParams, buildServerWebSocketUrl, ServerVersionNegotiator, CliHttpError, formatJson, visibleLength, ICliEventBus_TOKEN, stripAnsi, CancellablePromise, isCliAccessDeniedError, getParameterValue, ICliCommandGuard_TOKEN, getRightOfWord, CLI_CONFIGURE_STORE_NAME, CliModuleRegistry, initializeBrowserEnvironment, ICliPermissionRegistry_TOKEN, satisfiesVersionRange, ICliSecretStore_TOKEN, ICliKeyValueStore_TOKEN, CliServerPermissions, ICliDragDropService_TOKEN, cliAccessMetadataGuards, resolvePanelTheme, prefersDarkScheme, ICliServerAuthService_TOKEN, loadPanelPosition, savePanelPosition, derivePanelThemeStyles, delay, colorFirstWord, clearTerminalLine, ICliCompletionProvider_TOKEN, ICliServerAuthTokenProvider_TOKEN, truncateToWidth } from '@qodalis/cli-core';
 export { ICliUserSessionService_TOKEN, ICliUsersStoreService_TOKEN } from '@qodalis/cli-core';
 import { Terminal } from '@xterm/xterm';
 import { FitAddon } from '@xterm/addon-fit';
@@ -518,7 +518,7 @@ var CliKeyValueStore_TOKEN = createCliToken("cli-key-value-store");
 var SyntaxHighlighterRegistry_TOKEN = createCliToken("syntax-highlighter-registry");
 
 // src/lib/version.ts
-var LIBRARY_VERSION = "2.4.2";
+var LIBRARY_VERSION = "2.5.1";
 var API_VERSION = 2;
 var ANONYMOUS = "\0anonymous";
 function aliasOwner(context2) {
@@ -5886,6 +5886,72 @@ var CliServerConnection = class _CliServerConnection {
     return httpUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
   }
 };
+function plainText(value, keepLineBreaks = false) {
+  const text = String(value ?? "");
+  return keepLineBreaks ? text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, "") : text.replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+}
+function optionalText(value) {
+  return value === void 0 || value === null ? void 0 : plainText(value);
+}
+function serverCommandAliases(descriptor) {
+  return (descriptor.aliases ?? []).map((a) => plainText(a).trim()).filter((a) => a && !/\s/.test(a));
+}
+var DEFAULT_SERVER_COMMAND_ICON = "\u{1F5A5}";
+function serverCommandMetadata(descriptor, fallbackModule, server) {
+  return {
+    module: plainText(descriptor.module) || fallbackModule,
+    icon: plainText(descriptor.icon) || DEFAULT_SERVER_COMMAND_ICON,
+    requireServer: true,
+    ...server ? { server } : {}
+  };
+}
+function serverCommandParameters(descriptor) {
+  return descriptor.parameters?.map((p) => {
+    const allowed = p.allowedValues?.length ? p.allowedValues.map((v) => plainText(v)) : void 0;
+    const examples = p.examples?.map((v) => plainText(v)).filter(Boolean);
+    return {
+      name: p.name,
+      aliases: p.aliases?.map((a) => plainText(a).replace(/^-+/, "")).filter(Boolean),
+      description: optionalText(p.description),
+      required: p.required,
+      type: p.type,
+      defaultValue: p.defaultValue,
+      ...examples?.length ? { examples } : {},
+      ...allowed ? {
+        allowedValues: allowed,
+        validator: (value) => {
+          const values = Array.isArray(value) ? value : [value];
+          const valid = values.every(
+            (v) => allowed.some((a) => a.toLowerCase() === String(v).toLowerCase())
+          );
+          return valid ? { valid: true } : { valid: false, message: `--${p.name} must be one of: ${allowed.join(", ")}` };
+        }
+      } : {}
+    };
+  });
+}
+function serverCommandWriteDescription(descriptor) {
+  const paragraphs = plainText(descriptor.documentation, true).split(/\r?\n\s*\r?\n/).map((p) => p.trim()).filter(Boolean);
+  const examples = (descriptor.examples ?? []).filter((e) => e?.command).map((e) => ({ command: plainText(e.command), description: optionalText(e.description) }));
+  if (paragraphs.length === 0 && examples.length === 0) {
+    return void 0;
+  }
+  return (context2) => {
+    paragraphs.forEach((paragraph, i) => {
+      if (i > 0) context2.writer.writeln();
+      writeWrapped(context2, paragraph);
+    });
+    if (examples.length > 0) {
+      if (paragraphs.length > 0) context2.writer.writeln();
+      writeExamples(
+        context2,
+        examples.map((e) => [e.command, e.description ?? ""])
+      );
+    }
+  };
+}
+
+// src/lib/server/cli-server-proxy-processor.ts
 function renderSingleOutput(output2, context2, rawCommand) {
   switch (output2.type) {
     case "text": {
@@ -6017,21 +6083,15 @@ var CliServerProxyProcessor = class _CliServerProxyProcessor {
     this.serverName = serverName;
     this.commandPath = [...parentPath, descriptor.command];
     this.command = isNested ? descriptor.command : `${serverName}:${descriptor.command}`;
-    this.description = descriptor.description;
+    this.description = descriptor.description === void 0 ? void 0 : plainText(descriptor.description);
     this.version = descriptor.version;
-    this.metadata = {
-      module: `server:${serverName}`,
-      icon: "\u{1F5A5}",
-      requireServer: true
-    };
-    this.parameters = descriptor.parameters?.map((p) => ({
-      name: p.name,
-      aliases: p.aliases,
-      description: p.description,
-      required: p.required,
-      type: p.type,
-      defaultValue: p.defaultValue
-    }));
+    const aliases = serverCommandAliases(descriptor);
+    if (aliases.length) {
+      this.aliases = isNested ? [...aliases] : aliases.map((a) => `${serverName}:${a}`);
+    }
+    this.metadata = serverCommandMetadata(descriptor, `server:${serverName}`, serverName);
+    this.parameters = serverCommandParameters(descriptor);
+    this.writeDescription = serverCommandWriteDescription(descriptor);
     this.processors = descriptor.processors?.map(
       (sub) => new _CliServerProxyProcessor(connection, sub, serverName, true, this.commandPath)
     );
@@ -6057,20 +6117,14 @@ var CliServerMultiProxyProcessor = class _CliServerMultiProxyProcessor {
     const first = entries[0].descriptor;
     this.commandPath = [...parentPath, first.command];
     this.command = first.command;
-    this.description = first.description;
-    this.metadata = {
-      module: "server:multi",
-      icon: "\u{1F5A5}",
-      requireServer: true
-    };
-    this.parameters = first.parameters?.map((p) => ({
-      name: p.name,
-      aliases: p.aliases,
-      description: p.description,
-      required: p.required,
-      type: p.type,
-      defaultValue: p.defaultValue
-    }));
+    this.description = first.description === void 0 ? void 0 : plainText(first.description);
+    const aliases = serverCommandAliases(first);
+    if (parentPath.length > 0 && aliases.length) {
+      this.aliases = aliases;
+    }
+    this.metadata = serverCommandMetadata(first, "server:multi");
+    this.parameters = serverCommandParameters(first);
+    this.writeDescription = serverCommandWriteDescription(first);
     this.processors = first.processors?.map((sub) => {
       const subEntries = entries.map((e) => {
         const subDesc = e.descriptor.processors?.find(
@@ -6179,9 +6233,15 @@ var CliServerManager = class {
     /** Bare-name aliases this manager registered (only these are ever removed) */
     this._bareAliases = /* @__PURE__ */ new Set();
     this._hidden = [];
+    /** Servers the user linked (`server add`), as opposed to the host's */
+    this._linked = /* @__PURE__ */ new Set();
     /** `server:command` pairs already warned about, so each warns once */
     this._warnedHidden = /* @__PURE__ */ new Set();
   }
+  /** Whether the user linked this server (`server add`): only those can be removed or edited. */
+  isLinked(name) {
+    return this._linked.has(name);
+  }
   get defaultServer() {
     return this._defaultServer;
   }
@@ -6202,53 +6262,97 @@ var CliServerManager = class {
     this.unregisterBareAliases();
     this.registerBareAliases();
   }
-  async connectAll(servers, logger, backgroundServices, cliLogger) {
+  /** Where connections report and run (set once at boot, before any server connects). */
+  configure(logger, backgroundServices, cliLogger) {
     this._logger = logger;
     this._cliLogger = cliLogger;
     this._backgroundServices = backgroundServices;
+  }
+  async connectAll(servers, logger, backgroundServices, cliLogger) {
+    this.configure(logger, backgroundServices, cliLogger);
     for (const config of servers) {
       if (config.enabled === false) continue;
-      const connection = new CliServerConnection(
-        config,
-        backgroundServices,
-        cliLogger,
-        this.authService
+      await this.connectServer(config);
+    }
+    this.registerBareAliases();
+  }
+  /**
+   * Connects one server and registers its commands (without the bare
+   * aliases: callers refresh them once every server is connected).
+   */
+  async connectServer(config) {
+    const logger = this._logger;
+    const connection = new CliServerConnection(
+      config,
+      this._backgroundServices,
+      this._cliLogger,
+      this.authService
+    );
+    this.connections.set(config.name, connection);
+    connection.onDisconnect = () => {
+      this.handleDisconnect(config.name);
+    };
+    connection.onReconnected = () => {
+      logger?.info(
+        `Server '${config.name}' reconnected (${connection.commands.length} commands, API v${connection.apiVersion}).`
       );
-      this.connections.set(config.name, connection);
-      connection.onDisconnect = () => {
-        this.handleDisconnect(config.name);
-      };
-      connection.onReconnected = () => {
-        logger?.info(
-          `Server '${config.name}' reconnected (${connection.commands.length} commands, API v${connection.apiVersion}).`
-        );
-        this.emitConnected(connection, true);
-        this.registerProxyProcessors(connection, config.name);
-        this.unregisterBareAliases();
-        this.registerBareAliases();
-      };
-      await connection.connect();
-      if (connection.connected) {
-        logger?.info(
-          `Connected to server '${config.name}' (${connection.commands.length} commands)`
-        );
-        this.registerProxyProcessors(connection, config.name);
-        this.emitConnected(connection, false);
-      } else if (connection.needsSignIn) {
-        logger?.info(
-          `Server '${config.name}' needs a sign-in; its commands load once you are signed in.`
-        );
-      } else {
-        logger?.warn(
-          `Could not connect to server '${config.name}' at ${config.url}. Commands from this server will not be available.`
-        );
-        this.events?.emit("server:unavailable", {
-          name: config.name,
-          url: config.url
-        });
-      }
+      this.emitConnected(connection, true);
+      this.registerProxyProcessors(connection, config.name);
+      this.unregisterBareAliases();
+      this.registerBareAliases();
+    };
+    await connection.connect();
+    if (connection.connected) {
+      logger?.info(
+        `Connected to server '${config.name}' (${connection.commands.length} commands)`
+      );
+      this.registerProxyProcessors(connection, config.name);
+      this.emitConnected(connection, false);
+    } else if (connection.needsSignIn) {
+      logger?.info(
+        `Server '${config.name}' needs a sign-in; its commands load once you are signed in.`
+      );
+    } else {
+      logger?.warn(
+        `Could not connect to server '${config.name}' at ${config.url}. Commands from this server will not be available.`
+      );
+      this.events?.emit("server:unavailable", {
+        name: config.name,
+        url: config.url
+      });
     }
+    return connection;
+  }
+  /**
+   * Connects a server added while the terminal runs (`server add`): its
+   * commands are available at once. Throws when the name is taken.
+   */
+  async addServer(config, options = {}) {
+    if (this.connections.has(config.name)) {
+      throw new Error(`Server '${config.name}' already exists`);
+    }
+    if (options.linked) this._linked.add(config.name);
+    const connection = await this.connectServer(config);
+    this.unregisterBareAliases();
     this.registerBareAliases();
+    return connection;
+  }
+  /**
+   * Disconnects a server and forgets it (`server remove`): its commands go
+   * away. False when there is no such server.
+   */
+  removeServer(name) {
+    const connection = this.connections.get(name);
+    if (!connection) return false;
+    connection.onDisconnect = void 0;
+    connection.onReconnected = void 0;
+    connection.disconnect();
+    this.connections.delete(name);
+    this._linked.delete(name);
+    if (this._defaultServer === name) this._defaultServer = null;
+    this.unregisterServerProcessors(name);
+    this.events?.emit("server:disconnected", { name });
+    return true;
   }
   async reconnect(name) {
     const connection = this.connections.get(name);
@@ -6378,7 +6482,7 @@ var CliServerManager = class {
           serverName
         );
         alias.command = command2;
-        alias.aliases = [namespacedCommand];
+        alias.aliases = [namespacedCommand, ...this.freeAliases(descriptor)];
         this.registry.registerProcessor(alias);
         this._bareAliases.add(alias);
       } else {
@@ -6390,11 +6494,20 @@ var CliServerManager = class {
           return { serverName, connection, descriptor };
         });
         const multi = new CliServerMultiProxyProcessor(entries, this);
+        const aliases = this.freeAliases(entries[0].descriptor);
+        if (aliases.length) multi.aliases = aliases;
         this.registry.registerProcessor(multi);
         this._bareAliases.add(multi);
       }
     }
   }
+  /**
+   * The server's aliases of a command that no registered command answers
+   * to yet: a local command (or an earlier server alias) keeps its name.
+   */
+  freeAliases(descriptor) {
+    return serverCommandAliases(descriptor).filter((a) => !this.registry.findProcessor(a, []));
+  }
   recordHidden(server, command2, localCommand) {
     this._hidden.push({ server, command: command2, localCommand });
     const key = `${server}:${command2}`;
@@ -6654,9 +6767,13 @@ var CliHelpCommandProcessor = class {
       }
     }
     if (processor.metadata?.requireServer) {
+      const server = processor.metadata.server;
       writer.writeln();
       writer.writeln(
-        `  ${writer.wrapInColor(t.t("cli.help.requires_server", "Requires a connected server"), CliForegroundColor.Red)}`
+        `  ${writer.wrapInColor(
+          server ? t.t("cli.help.runs_on_server", "Runs on server {server}", { server }) : t.t("cli.help.requires_server", "Requires a connected server"),
+          CliForegroundColor.Red
+        )}`
       );
     }
     writer.writeln();
@@ -6682,14 +6799,24 @@ var CliHelpCommandProcessor = class {
     const typeStr = `${DIM}<${param.type}>${RESET}`;
     const required = param.required ? writer.wrapInColor(` ${translator.t("cli.help.required", "(required)")}`, CliForegroundColor.Red) : "";
     const defaultVal = param.defaultValue !== void 0 && !param.required ? `${DIM} [${param.defaultValue}]${RESET}` : "";
+    const allowed = param.allowedValues?.length ? `${DIM}${translator.t("cli.help.one_of", "one of:")}${RESET} ${param.allowedValues.map((v) => writer.wrapInColor(v, CliForegroundColor.Magenta)).join(", ")}` : "";
+    const examples = param.examples?.length ? `${DIM}${translator.t("cli.help.for_example", "e.g.")}${RESET} ${param.examples.map((v) => writer.wrapInColor(v, CliForegroundColor.Magenta)).join(", ")}` : "";
     if (narrow) {
       writer.writeln(`    ${nameStr} ${typeStr}${required}${defaultVal}`);
       writeWrapped(context2, param.description, 6);
+      if (allowed) writer.writeln(`      ${allowed}`);
+      if (examples) writer.writeln(`      ${examples}`);
       return;
     }
     writer.writeln(
       `    ${nameStr} ${typeStr}  ${param.description}${required}${defaultVal}`
     );
+    if (allowed) {
+      writer.writeln(`      ${allowed}`);
+    }
+    if (examples) {
+      writer.writeln(`      ${examples}`);
+    }
   }
 };
 function isNarrow(context2) {
@@ -15156,6 +15283,129 @@ var CliClipboard = class {
     }
   }
 };
+
+// src/lib/server/linked/cli-linked-servers.ts
+var SERVERS_KEY = "qcli-linked-servers";
+var tokenKey = (name) => `server-token:${name.toLowerCase()}`;
+var SERVER_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/;
+function normalizeServerUrl(input) {
+  const value = input.trim();
+  if (!value) return null;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value : `https://${value}`;
+  try {
+    const url = new URL(withScheme);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    if (!url.hostname || url.username || url.password) return null;
+    return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return null;
+  }
+}
+function isPrivateHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) return true;
+  if (host.includes(":")) {
+    return host === "::1" || /^f[cd][0-9a-f]{0,2}:/.test(host) || /^fe[89ab][0-9a-f]?:/.test(host);
+  }
+  const ip = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!ip) return false;
+  const [a, b] = [Number(ip[1]), Number(ip[2])];
+  return a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
+}
+function checkServerUrl(input, pageProtocol) {
+  const url = normalizeServerUrl(input);
+  if (!url) return "Not a valid http(s) URL";
+  const { protocol, hostname } = new URL(url);
+  if (protocol === "http:" && !isPrivateHost(hostname)) {
+    return "Only https servers can be linked (http is accepted for localhost and private addresses)";
+  }
+  return {
+    url,
+    insecure: protocol === "http:",
+    mixedContent: protocol === "http:" && pageProtocol === "https:"
+  };
+}
+function userServersAllow(options, url) {
+  const policy = options?.userServers;
+  if (policy === false) return false;
+  if (policy === void 0 || policy === true) return true;
+  const origin = new URL(url).origin.toLowerCase();
+  return (policy.allowedOrigins ?? []).some((pattern) => {
+    const escaped = pattern.toLowerCase().replace(/\/+$/, "").replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+    return new RegExp(`^${escaped}$`).test(origin);
+  });
+}
+function userServersEnabled(options) {
+  return options?.userServers !== false;
+}
+function suggestServerName(url, taken) {
+  const { hostname, port } = new URL(url);
+  const host = hostname.replace(/^\[|\]$/g, "");
+  const isIp = /^[\d.]+$/.test(host) || host.includes(":");
+  const base = (isIp ? host.replace(/[.:]/g, "-") : host.split(".")[0]) + (port && (isIp || host === "localhost") ? `-${port}` : "");
+  let name = base.replace(/[^A-Za-z0-9_-]/g, "-").replace(/^[-_]+/, "").slice(0, 28) || "server";
+  if (!SERVER_NAME_PATTERN.test(name)) name = "server";
+  let candidate = name;
+  for (let i = 2; taken(candidate); i++) candidate = `${name}-${i}`;
+  return candidate;
+}
+function maskToken(token) {
+  if (!token) return "-";
+  return `\u2022\u2022\u2022\u2022${token.slice(-4)}`;
+}
+function redactSecrets(command2) {
+  return command2.replace(
+    // A following flag (`--token --default`) is not a value
+    /(--(?:token|password)(?:=|\s+))("[^"]*"|'[^']*'|(?!--)\S+)/gi,
+    (_match, flag) => `${flag}***`
+  );
+}
+var CliLinkedServers = class {
+  constructor(kv, secrets) {
+    this.kv = kv;
+    this.secrets = secrets;
+  }
+  async list() {
+    const saved = await this.kv.get(SERVERS_KEY);
+    return Array.isArray(saved) ? saved.filter((s) => s && typeof s.name === "string" && typeof s.url === "string") : [];
+  }
+  async get(name) {
+    return (await this.list()).find((s) => s.name.toLowerCase() === name.toLowerCase());
+  }
+  /** Saves a server (replacing one with the same name) and its token (none: deleted). */
+  async save(server, token) {
+    if (token) await this.secrets.set(tokenKey(server.name), token);
+    else await this.secrets.delete(tokenKey(server.name));
+    const others = (await this.list()).filter((s) => s.name.toLowerCase() !== server.name.toLowerCase());
+    await this.kv.set(SERVERS_KEY, [...others, server]);
+  }
+  async setToken(name, token) {
+    await this.secrets.set(tokenKey(name), token);
+  }
+  async token(name) {
+    return this.secrets.get(tokenKey(name));
+  }
+  async remove(name) {
+    const all = await this.list();
+    const rest = all.filter((s) => s.name.toLowerCase() !== name.toLowerCase());
+    await this.secrets.delete(tokenKey(name));
+    if (rest.length === all.length) return false;
+    await this.kv.set(SERVERS_KEY, rest);
+    return true;
+  }
+  /** Removes every linked server and every secret. */
+  async clear() {
+    await this.kv.remove(SERVERS_KEY);
+    await this.secrets.clear();
+  }
+};
+function linkedServerConfig(server, token) {
+  return {
+    name: server.name,
+    url: server.url,
+    ...token ? { headers: () => ({ Authorization: `Bearer ${token}` }) } : {}
+  };
+}
 var InputModeBase = class {
   constructor(host, resolve) {
     this.host = host;
@@ -17907,7 +18157,8 @@ var CliExecutionContext = class {
       const startedAt = Date.now();
       await this.executor.executeCommand(command2, this);
       this.events?.emit("command:executed", {
-        command: command2,
+        // As in the history: `--token`/`--password` values never leave
+        command: redactSecrets(command2),
         exitCode: this.executor.exitStatus ?? 0,
         durationMs: Date.now() - startedAt
       });
@@ -19387,7 +19638,7 @@ var CliCommandHistory = class {
     return this.loading;
   }
   async addCommand(command2) {
-    const normalizedCommand = command2.trim();
+    const normalizedCommand = redactSecrets(command2.trim());
     if (!normalizedCommand) return;
     await this.loading;
     const existingIndex = this.commandHistory.indexOf(normalizedCommand);
@@ -20976,6 +21227,129 @@ var CliStateStoreManager = class {
     };
   }
 };
+
+// src/lib/server/linked/cli-web-crypto-secret-store.ts
+var KEY_KEY = "qcli-secret-key";
+var NAMES_KEY = "qcli-secret-names";
+var SECRET_PREFIX = "qcli-secret:";
+var CliWebCryptoSecretStore = class {
+  constructor(kv, crypto2 = globalThis.crypto ?? null) {
+    this.kv = kv;
+    this.crypto = crypto2;
+    this.keyPromise = null;
+  }
+  isAvailable() {
+    return !!this.crypto?.subtle && typeof this.crypto.getRandomValues === "function";
+  }
+  async get(key) {
+    if (!this.isAvailable()) return void 0;
+    const record = await this.kv.get(SECRET_PREFIX + key);
+    if (!record?.iv || !record?.data) return void 0;
+    const cryptoKey = await this.kv.get(KEY_KEY);
+    if (!cryptoKey) return void 0;
+    try {
+      const plain = await this.crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: record.iv },
+        cryptoKey,
+        record.data
+      );
+      return new TextDecoder().decode(plain);
+    } catch {
+      return void 0;
+    }
+  }
+  async set(key, value) {
+    if (!this.isAvailable()) {
+      throw new Error("Secrets cannot be saved: this page has no Web Crypto (it must be served over https)");
+    }
+    const cryptoKey = await this.key();
+    const iv = this.crypto.getRandomValues(new Uint8Array(12));
+    const data = await this.crypto.subtle.encrypt(
+      { name: "AES-GCM", iv },
+      cryptoKey,
+      new TextEncoder().encode(value)
+    );
+    await this.kv.set(SECRET_PREFIX + key, { iv, data: new Uint8Array(data) });
+    const names = await this.kv.get(NAMES_KEY) ?? [];
+    if (!names.includes(key)) await this.kv.set(NAMES_KEY, [...names, key]);
+  }
+  async delete(key) {
+    await this.kv.remove(SECRET_PREFIX + key);
+    const names = await this.kv.get(NAMES_KEY) ?? [];
+    if (names.includes(key)) await this.kv.set(NAMES_KEY, names.filter((n) => n !== key));
+  }
+  async clear() {
+    for (const name of await this.kv.get(NAMES_KEY) ?? []) {
+      await this.kv.remove(SECRET_PREFIX + name);
+    }
+    await this.kv.remove(NAMES_KEY);
+    await this.kv.remove(KEY_KEY);
+    this.keyPromise = null;
+  }
+  /** The saved key, or a new one (created once, even for parallel calls). */
+  key() {
+    this.keyPromise ??= (async () => {
+      const saved = await this.kv.get(KEY_KEY);
+      if (saved) return saved;
+      const created = await this.crypto.subtle.generateKey(
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["encrypt", "decrypt"]
+      );
+      await this.kv.set(KEY_KEY, created);
+      return created;
+    })();
+    const pending = this.keyPromise;
+    pending.catch(() => {
+      if (this.keyPromise === pending) this.keyPromise = null;
+    });
+    return pending;
+  }
+};
+
+// src/lib/server/linked/cli-linked-servers-runtime.ts
+var webCryptoStores = /* @__PURE__ */ new WeakMap();
+function secretStoreOf(context2) {
+  const provided = context2.services.get(ICliSecretStore_TOKEN);
+  if (provided) return provided;
+  const kv = context2.services.getRequired(ICliKeyValueStore_TOKEN);
+  let store = webCryptoStores.get(kv);
+  if (!store) {
+    store = new CliWebCryptoSecretStore(kv);
+    webCryptoStores.set(kv, store);
+  }
+  return store;
+}
+function linkedServersOf(context2) {
+  const kv = context2.services.getRequired(ICliKeyValueStore_TOKEN);
+  return new CliLinkedServers(kv, secretStoreOf(context2));
+}
+function rejectedTokenMessage(name) {
+  return `Server '${name}' rejected its token. Link it again with server add ${name}, or set a new token with server edit ${name} --token.`;
+}
+async function restoreLinkedServers(context2, manager, warn) {
+  if (!userServersEnabled(context2.options)) return;
+  const linked = linkedServersOf(context2);
+  let servers;
+  try {
+    servers = await linked.list();
+  } catch {
+    return;
+  }
+  for (const server of servers) {
+    if (manager.connections.has(server.name)) {
+      warn(`Linked server '${server.name}' is not connected: the app has a server with the same name.`);
+      continue;
+    }
+    if (!userServersAllow(context2.options, server.url)) {
+      warn(`Linked server '${server.name}' (${server.url}) is not allowed by this app.`);
+      continue;
+    }
+    const token = await linked.token(server.name).catch(() => void 0);
+    const connection = await manager.addServer(linkedServerConfig(server, token), { linked: true });
+    if (token && connection.needsSignIn) warn(rejectedTokenMessage(server.name));
+  }
+}
 var CliServerAuthService = class {
   constructor(services) {
     this.services = services;
@@ -21047,14 +21421,17 @@ function writeUnknownServer(context2, manager, name) {
 function writeConfigureHint(context2) {
   const { writer } = context2;
   writer.writeln(
-    `  Servers are configured by the app: ${writer.wrapInColor("servers: [{ name: 'node', url: 'http://localhost:8047' }]", CliForegroundColor.Yellow)}`
+    `  Link one: ${writer.wrapInColor("server add", CliForegroundColor.Cyan)}, or configure it in the app: ${writer.wrapInColor("servers: [{ name: 'node', url: 'http://localhost:8047' }]", CliForegroundColor.Yellow)}`
   );
   writer.writeln(
     `  See ${writer.wrapInColor("https://cli.qodalis.com/docs/server-integration", CliForegroundColor.Blue)}`
   );
 }
 function statusLabel(context2, connection) {
-  return connection.connected ? context2.writer.wrapInColor("\u25CF connected", CliForegroundColor.Green) : context2.writer.wrapInColor("\u25CB unreachable", CliForegroundColor.Red);
+  if (connection.connected) {
+    return context2.writer.wrapInColor("\u25CF connected", CliForegroundColor.Green);
+  }
+  return connection.needsSignIn ? context2.writer.wrapInColor("\u25D0 sign-in needed", CliForegroundColor.Yellow) : context2.writer.wrapInColor("\u25CB unreachable", CliForegroundColor.Red);
 }
 async function pingServer(connection) {
   const started = performance.now();
@@ -21096,6 +21473,546 @@ function editDistance(a, b) {
   return row[b.length];
 }
 
+// src/lib/server/linked/cli-server-link-client.ts
+var V1 = "/api/v1/qcli";
+function plainText2(value) {
+  return String(value ?? "").replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+}
+async function readJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+async function probeServer(fetchFn, url) {
+  let versions;
+  try {
+    versions = await fetchFn(`${url}/api/qcli/versions`, { headers: { Accept: "application/json" } });
+  } catch (e) {
+    throw new Error(`Cannot reach ${url}: ${e.message || "network error"}`, { cause: e });
+  }
+  const body = versions.ok ? await readJson(versions) : null;
+  if (!body || !Array.isArray(body.supportedVersions)) {
+    throw new Error(`${url} is not a Qodalis CLI server (no version discovery at /api/qcli/versions)`);
+  }
+  let capabilities = null;
+  try {
+    const res = await fetchFn(`${url}${V1}/capabilities`, { headers: { Accept: "application/json" } });
+    if (res.ok) capabilities = await readJson(res);
+  } catch {
+  }
+  let needsSignIn = false;
+  try {
+    const res = await fetchFn(`${url}${V1}/commands`, { headers: { Accept: "application/json" } });
+    needsSignIn = res.status === 401 || res.status === 403;
+  } catch {
+  }
+  return { version: capabilities?.version, capabilities, needsSignIn };
+}
+async function requestLink(fetchFn, url, client) {
+  const res = await fetchFn(`${url}${V1}/link`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ client })
+  });
+  if (res.status === 404 || res.status === 405) return null;
+  const body = await readJson(res);
+  if (!res.ok || !body?.linkId) {
+    throw new Error(body?.error ? plainText2(body.error) : `The server refused the link request (${res.status})`);
+  }
+  let verificationUrl;
+  try {
+    verificationUrl = new URL(String(body.verificationUrl), `${url}/`);
+  } catch {
+    throw new Error("The server sent an invalid approval page address");
+  }
+  if (verificationUrl.protocol !== "https:" && verificationUrl.protocol !== "http:") {
+    throw new Error("The server sent an invalid approval page address");
+  }
+  return {
+    linkId: String(body.linkId),
+    userCode: plainText2(body.userCode),
+    verificationUrl: verificationUrl.toString(),
+    interval: Math.max(1, Number(body.interval) || 2),
+    expiresIn: Number(body.expiresIn) || 600
+  };
+}
+async function pollLink(fetchFn, url, linkId) {
+  const res = await fetchFn(`${url}${V1}/link/${encodeURIComponent(linkId)}`, { headers: { Accept: "application/json" } });
+  if (res.status === 404) return { status: "expired" };
+  const body = await readJson(res);
+  if (!res.ok || !body) throw new Error(`Link status unavailable (${res.status})`);
+  if (body.status === "approved" && body.token) return { status: "approved", token: body.token, userName: body.userName };
+  if (body.status === "denied") return { status: "denied" };
+  if (body.status === "expired") return { status: "expired" };
+  return { status: "pending" };
+}
+async function createTokenWithPassword(fetchFn, url, username, password, tokenName) {
+  const login = await fetchFn(`${url}${V1}/sessions`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ username, password })
+  });
+  const session = await readJson(login);
+  if (!login.ok || !session?.token) {
+    throw new Error(login.status === 404 ? "This server has no user sign-in" : plainText2(session?.error ?? "Sign-in failed"));
+  }
+  const auth = { Authorization: `Bearer ${session.token}` };
+  try {
+    for (let suffix = 1; ; suffix++) {
+      const name = suffix === 1 ? tokenName : `${tokenName.slice(0, 60)} ${suffix}`;
+      const created = await fetchFn(`${url}${V1}/tokens`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...auth },
+        body: JSON.stringify({ name })
+      });
+      const body = await readJson(created);
+      if (created.status === 409 && suffix < 20) continue;
+      if (!created.ok || !body?.token) throw new Error(body?.error ? plainText2(body.error) : `Could not create a token (${created.status})`);
+      return body.token;
+    }
+  } finally {
+    await fetchFn(`${url}${V1}/sessions/current`, { method: "DELETE", headers: auth }).catch(() => void 0);
+  }
+}
+function deviceName(appName = "Qodalis CLI") {
+  const nav = globalThis.navigator;
+  const ua = nav?.userAgent ?? "";
+  const platform = nav?.userAgentData?.platform || (/Android/i.test(ua) ? "Android" : /iPhone|iPad/i.test(ua) ? "iOS" : /Mac/i.test(ua) ? "macOS" : /Windows/i.test(ua) ? "Windows" : /Linux/i.test(ua) ? "Linux" : "");
+  const name = platform ? `${appName} on ${platform}` : appName;
+  return name.replace(/[^A-Za-z0-9._ -]/g, "-").slice(0, 64);
+}
+
+// src/lib/server/linked/cli-server-link-processors.ts
+var fetchOf = (context2) => (url, init) => context2.http.fetch(url, init);
+function sleep(ms, signal) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      resolve();
+    }, { once: true });
+  });
+}
+function linkingDisabled(context2) {
+  if (userServersEnabled(context2.options)) return false;
+  context2.writer.writeError(
+    context2.translator.t("cli.server.link.disabled", "This app does not allow linking servers from the terminal.")
+  );
+  return true;
+}
+function parseAddArgs(value) {
+  const words = splitShellWords(value ?? "");
+  if (words.length >= 2) return { name: words[0], url: words[1] };
+  if (words.length === 1) {
+    return /[.:/]/.test(words[0]) ? { url: words[0] } : { name: words[0] };
+  }
+  return {};
+}
+async function replaceConnection(manager, config) {
+  const current = [...manager.connections.keys()].find((n) => n.toLowerCase() === config.name.toLowerCase());
+  const wasDefault = !!current && manager.defaultServer === current;
+  if (current) manager.removeServer(current);
+  const connection = await manager.addServer(config, { linked: true });
+  if (wasDefault) manager.setDefaultServer(config.name);
+  return connection;
+}
+var ServerAddProcessor = class {
+  constructor() {
+    this.command = "add";
+    this.aliases = ["link"];
+    this.description = "Link a server to this terminal (kept across reloads)";
+    this.acceptsRawInput = true;
+    this.valueRequired = false;
+    this.parameters = [
+      { name: "token", description: "API token (qcli_pat_\u2026) to link with (asked for, hidden, when given without a value)", required: false, type: "string" },
+      { name: "default", description: "Make it the default server", required: false, type: "boolean" },
+      { name: "no-browser", description: "Link with a token or a password, without the browser", required: false, type: "boolean" }
+    ];
+  }
+  async processCommand(command2, context2) {
+    const t = context2.translator;
+    const { writer, reader } = context2;
+    const manager = serverManagerOf(context2);
+    if (!manager || linkingDisabled(context2)) return;
+    const linked = linkedServersOf(context2);
+    const args = parseAddArgs(command2.value);
+    const rawUrl = args.url ?? await reader.readLine(t.t("cli.server.link.url_prompt", "Server URL: "), { placeholder: "https://my-server.example.com" });
+    if (!rawUrl) return;
+    const pageProtocol = globalThis.location?.protocol;
+    const checked = checkServerUrl(rawUrl, pageProtocol);
+    if (typeof checked === "string") {
+      writer.writeError(checked);
+      return;
+    }
+    const url = checked.url;
+    if (!userServersAllow(context2.options, url)) {
+      writer.writeError(t.t("cli.server.link.origin_not_allowed", "This app does not allow linking {url}.", { url }));
+      return;
+    }
+    if (checked.mixedContent) {
+      writer.writeWarning(t.t("cli.server.link.mixed_content", "This page is served over https: the browser may block requests to an http server."));
+    }
+    let probe;
+    context2.spinner?.show(t.t("cli.server.link.checking", "Checking {url}\u2026", { url }));
+    try {
+      probe = await probeServer(fetchOf(context2), url);
+    } catch (e) {
+      writer.writeError(e.message);
+      return;
+    } finally {
+      context2.spinner?.hide();
+    }
+    writeProbe(context2, url, probe);
+    if (checked.insecure) {
+      writer.writeWarning(t.t("cli.server.link.http_warning", "{url} is not encrypted (http): its token travels in clear text on the network.", { url }));
+      const go = await reader.readConfirm(t.t("cli.server.link.http_confirm", "Link it anyway?"), false);
+      if (!go) return;
+    }
+    let name = args.name;
+    if (name) {
+      if (!await this.nameAvailable(context2, manager, linked, name)) return;
+    }
+    const tokenFlag = command2.args?.["token"];
+    const tokenArg = typeof tokenFlag === "string" && tokenFlag.trim() ? tokenFlag.trim() : void 0;
+    const method = tokenFlag !== void 0 && tokenFlag !== false ? "token" : await this.chooseMethod(context2, probe, !!command2.args?.["no-browser"]);
+    if (!method) return;
+    if (method !== "none" && !await secretStoreOf(context2).isAvailable()) {
+      writer.writeError(t.t("cli.server.link.no_secret_store", "Tokens cannot be kept safely on this page (no Web Crypto: serve it over https). The server was not linked."));
+      return;
+    }
+    let token;
+    let userName;
+    if (method === "browser") {
+      const result = await this.linkInBrowser(context2, url);
+      if (!result) return;
+      token = result.token;
+      userName = result.userName;
+    } else if (method === "token") {
+      token = tokenArg ?? (await reader.readPassword(t.t("cli.server.link.token_prompt", "API token: ")))?.trim();
+      if (!token) return;
+    } else if (method === "password") {
+      const username = await reader.readLine(t.t("cli.server.link.username_prompt", "Username: "));
+      if (!username) return;
+      const password = await reader.readPassword(t.t("cli.server.link.password_prompt", "Password: "));
+      if (!password) return;
+      try {
+        token = await createTokenWithPassword(fetchOf(context2), url, username.trim(), password, deviceName());
+        userName = username.trim();
+      } catch (e) {
+        writer.writeError(e.message);
+        return;
+      }
+    }
+    if (!name) {
+      const suggested = suggestServerName(url, (n) => manager.connections.has(n));
+      const answer = await reader.readLine(t.t("cli.server.link.name_prompt", "Name for this server: "), {
+        default: suggested,
+        placeholder: suggested,
+        validate: (value) => !value || SERVER_NAME_PATTERN.test(value.trim()) ? null : t.t("cli.server.link.invalid_name", "Letters, digits, - and _ (at most 32), starting with a letter or digit")
+      });
+      if (answer === null) return;
+      name = answer.trim() || suggested;
+      if (!await this.nameAvailable(context2, manager, linked, name)) return;
+    }
+    const server = { name, url, addedAt: Date.now() };
+    const previous = (await linked.get(name))?.name;
+    if (previous && previous !== name) await linked.remove(previous);
+    await linked.save(server, token);
+    const connection = await replaceConnection(manager, linkedServerConfig(server, token));
+    if (connection.connected) {
+      writer.writeSuccess(
+        t.t("cli.server.link.linked", "Linked {name}: {count} commands{user}.", {
+          name,
+          count: connection.commands.length,
+          user: userName ? t.t("cli.server.link.as_user", " as {user}", { user: userName }) : ""
+        })
+      );
+    } else if (token && connection.needsSignIn) {
+      writer.writeWarning(rejectedTokenMessage(name));
+    } else if (connection.needsSignIn) {
+      writer.writeWarning(t.t("cli.server.link.needs_sign_in", "Linked {name}, but its commands need a sign-in: link it with a token or through the browser.", { name }));
+    } else {
+      writer.writeWarning(t.t("cli.server.link.unreachable", "Linked {name}, but it is unreachable now: its commands load when it is back.", { name }));
+    }
+    if (command2.args?.["default"]) {
+      manager.setDefaultServer(name);
+      context2.state.updateState({ defaultServer: name });
+      writer.writeln(t.t("cli.server.link.now_default", "  {name} is the default server.", { name }));
+    }
+  }
+  async nameAvailable(context2, manager, linked, name) {
+    const t = context2.translator;
+    if (!SERVER_NAME_PATTERN.test(name)) {
+      context2.writer.writeError(t.t("cli.server.link.invalid_name", "Letters, digits, - and _ (at most 32), starting with a letter or digit"));
+      return false;
+    }
+    const existing = [...manager.connections.keys()].find((n) => n.toLowerCase() === name.toLowerCase());
+    if (existing && !manager.isLinked(existing)) {
+      context2.writer.writeError(t.t("cli.server.link.host_server", "'{name}' is configured by the app and cannot be replaced.", { name: existing }));
+      return false;
+    }
+    if (existing || await linked.get(name)) {
+      const replace = await context2.reader.readConfirm(
+        t.t("cli.server.link.replace_confirm", "A linked server '{name}' exists. Replace it?", { name }),
+        false
+      );
+      return !!replace;
+    }
+    return true;
+  }
+  async chooseMethod(context2, probe, noBrowser) {
+    const t = context2.translator;
+    const options = [
+      ...noBrowser ? [] : [{ label: t.t("cli.server.link.method_browser", "Open the server in the browser and approve (recommended)"), value: "browser" }],
+      { label: t.t("cli.server.link.method_token", "Paste an API token"), value: "token" },
+      { label: t.t("cli.server.link.method_password", "Sign in with user and password"), value: "password" },
+      ...probe.needsSignIn ? [] : [{ label: t.t("cli.server.link.method_none", "No sign-in (open server)"), value: "none" }]
+    ];
+    const choice = await context2.reader.readSelect(t.t("cli.server.link.method_prompt", "How do you want to link it?"), options);
+    return choice ?? null;
+  }
+  /** The device flow: a link request, the page to approve it, then polling until a decision. */
+  async linkInBrowser(context2, url) {
+    const t = context2.translator;
+    const { writer } = context2;
+    const fetchFn = fetchOf(context2);
+    let request;
+    try {
+      request = await requestLink(fetchFn, url, deviceName());
+    } catch (e) {
+      writer.writeError(e.message);
+      return null;
+    }
+    if (!request) {
+      writer.writeError(t.t("cli.server.link.no_browser_link", "This server cannot link through the browser (it needs the users plugin, 1.0.0-beta.25 or later). Use server add --no-browser."));
+      return null;
+    }
+    writer.writeln();
+    writer.writeln(t.t("cli.server.link.open_page", "  Open this page, sign in and approve:"));
+    writer.write("  ");
+    writer.writeLink(request.verificationUrl, request.verificationUrl);
+    writer.writeln();
+    writer.writeln(
+      t.t("cli.server.link.compare_code", "  Check that it shows the code {code}", {
+        code: writer.wrapInColor(request.userCode, CliForegroundColor.Yellow)
+      })
+    );
+    writer.writeln();
+    try {
+      globalThis.open?.(request.verificationUrl, "_blank");
+    } catch {
+    }
+    const deadline = Date.now() + request.expiresIn * 1e3;
+    const cancelled = () => {
+      context2.spinner?.hide();
+      const minutes = Math.max(1, Math.ceil((deadline - Date.now()) / 6e4));
+      writer.writeInfo(
+        t.t("cli.server.link.cancelled", "Cancelled. The request expires on the server in {minutes} min.", { minutes })
+      );
+      return null;
+    };
+    context2.spinner?.show(t.t("cli.server.link.waiting", "Waiting for the approval\u2026 (Ctrl+C to cancel)"));
+    try {
+      while (Date.now() < deadline) {
+        if (context2.signal?.aborted) return cancelled();
+        await sleep(request.interval * 1e3, context2.signal);
+        if (context2.signal?.aborted) return cancelled();
+        let poll;
+        try {
+          poll = await pollLink(fetchFn, url, request.linkId);
+        } catch {
+          continue;
+        }
+        if (poll.status === "approved") return { token: poll.token, userName: poll.userName };
+        if (poll.status === "denied") {
+          context2.spinner?.hide();
+          writer.writeError(t.t("cli.server.link.denied", "The link request was denied."));
+          return null;
+        }
+        if (poll.status === "expired") break;
+      }
+    } finally {
+      context2.spinner?.hide();
+    }
+    writer.writeError(t.t("cli.server.link.expired", "The link request expired. Run server add again."));
+    return null;
+  }
+  writeDescription(context2) {
+    const t = context2.translator;
+    writeWrapped(
+      context2,
+      t.t("cli.server.add.help.description", "Links a Node, .NET or Python server to this terminal: its commands are available at once and after every reload. Asks for what is missing: the URL, how to sign in (approve in the browser, paste an API token, or a user and password) and a name. Tokens are kept encrypted and never shown again; only https servers can be linked (http for localhost and private addresses).")
+    );
+    context2.writer.writeln();
+    writeUsage(context2, [
+      ["server add", t.t("cli.server.add.help.interactive", "Asks for everything")],
+      ["server add <url>", t.t("cli.server.add.help.url", "Link this server")],
+      ["server add <name> <url> --token [token]", t.t("cli.server.add.help.token", "Link with an API token (scripts)")]
+    ]);
+    context2.writer.writeln();
+    writeExamples(context2, [
+      ["server add https://cli.example.com", t.t("cli.server.add.help.example_browser", "Approve in the browser")],
+      ["server add home http://192.168.1.20:8047 --no-browser", t.t("cli.server.add.help.example_lan", "A server on the local network")]
+    ]);
+  }
+};
+function writeProbe(context2, url, probe) {
+  const { writer } = context2;
+  const caps = probe.capabilities;
+  const details = [caps?.os, caps?.shell ? "shell" : null, caps?.streaming ? "streaming" : null, probe.needsSignIn ? "sign-in required" : null].filter(Boolean).join(" \xB7 ");
+  writer.writeSuccess(
+    `${context2.translator.t("cli.server.link.found", "Qodalis CLI server")} ${probe.version ?? ""} ${writer.wrapInColor(url, CliForegroundColor.Cyan)}${details ? ` (${details})` : ""}`.replace(/\s+/g, " ")
+  );
+}
+var ServerRemoveProcessor = class {
+  constructor() {
+    this.command = "remove";
+    this.aliases = ["rm", "unlink"];
+    this.description = "Unlink a server linked with server add (its token is deleted)";
+    this.acceptsRawInput = true;
+    this.valueRequired = true;
+  }
+  async processCommand(command2, context2) {
+    const t = context2.translator;
+    const manager = serverManagerOf(context2);
+    if (!manager) return;
+    const name = splitShellWords(command2.value ?? "")[0] ?? "";
+    const linked = linkedServersOf(context2);
+    const connected = [...manager.connections.keys()].find((n) => n.toLowerCase() === name.toLowerCase());
+    const saved = await linked.get(name);
+    if (connected && !manager.isLinked(connected) && !saved) {
+      context2.writer.writeError(t.t("cli.server.link.cannot_remove_host", "'{name}' is configured by the app and cannot be removed.", { name: connected }));
+      return;
+    }
+    if (!saved && !connected) {
+      context2.writer.writeError(t.t("cli.server.link.unknown_linked", "No linked server '{name}'. See server list.", { name }));
+      return;
+    }
+    await linked.remove(saved?.name ?? name);
+    const linkedConnection = connected && manager.isLinked(connected) ? connected : void 0;
+    if (linkedConnection) manager.removeServer(linkedConnection);
+    const removedName = saved?.name ?? linkedConnection ?? name;
+    if (linkedConnection && context2.state.getState().defaultServer === linkedConnection) {
+      context2.state.updateState({ defaultServer: null });
+    }
+    context2.writer.writeSuccess(t.t("cli.server.link.removed", "Unlinked {name}; its token is deleted from this device.", { name: removedName }));
+    context2.writer.writeln(t.t("cli.server.link.revoke_hint", "  The token stays valid on the server until it expires: revoke it there with token revoke."));
+  }
+};
+var ServerEditProcessor = class {
+  constructor() {
+    this.command = "edit";
+    this.description = "Change the URL or the token of a linked server";
+    this.acceptsRawInput = true;
+    this.valueRequired = true;
+    this.parameters = [
+      { name: "url", description: "New URL", required: false, type: "string" },
+      { name: "token", description: "New API token (asked for, hidden, when given without a value)", required: false, type: "string" }
+    ];
+  }
+  async processCommand(command2, context2) {
+    const t = context2.translator;
+    const { writer } = context2;
+    const manager = serverManagerOf(context2);
+    if (!manager || linkingDisabled(context2)) return;
+    const name = splitShellWords(command2.value ?? "")[0] ?? "";
+    const connected = [...manager.connections.keys()].find((n) => n.toLowerCase() === name.toLowerCase());
+    if (connected && !manager.isLinked(connected)) {
+      writer.writeError(t.t("cli.server.link.cannot_edit_host", "'{name}' is configured by the app and cannot be edited.", { name: connected }));
+      return;
+    }
+    const linked = linkedServersOf(context2);
+    const saved = await linked.get(name);
+    if (!saved) {
+      writer.writeError(t.t("cli.server.link.unknown_linked", "No linked server '{name}'. See server list.", { name }));
+      return;
+    }
+    const urlArg = command2.args?.["url"];
+    const tokenArg = command2.args?.["token"];
+    if (urlArg === void 0 && tokenArg === void 0) {
+      writer.writeError(t.t("cli.server.link.edit_nothing", "Give --url <url> and/or --token."));
+      return;
+    }
+    let url = saved.url;
+    if (typeof urlArg === "string") {
+      const checked = checkServerUrl(urlArg, globalThis.location?.protocol);
+      if (typeof checked === "string") {
+        writer.writeError(checked);
+        return;
+      }
+      if (!userServersAllow(context2.options, checked.url)) {
+        writer.writeError(t.t("cli.server.link.origin_not_allowed", "This app does not allow linking {url}.", { url: checked.url }));
+        return;
+      }
+      if (checked.insecure) {
+        writer.writeWarning(t.t("cli.server.link.http_warning", "{url} is not encrypted (http): its token travels in clear text on the network.", { url: checked.url }));
+        if (!await context2.reader.readConfirm(t.t("cli.server.link.http_confirm", "Link it anyway?"), false)) return;
+      }
+      if (checked.mixedContent) {
+        writer.writeWarning(t.t("cli.server.link.mixed_content", "This page is served over https: the browser may block requests to an http server."));
+      }
+      url = checked.url;
+    }
+    let token = await linked.token(saved.name);
+    if (tokenArg !== void 0) {
+      token = typeof tokenArg === "string" && tokenArg.trim() ? tokenArg.trim() : (await context2.reader.readPassword(t.t("cli.server.link.token_prompt", "API token: ")))?.trim();
+      if (!token) return;
+    }
+    const updated = { ...saved, url };
+    await linked.save(updated, token);
+    const connection = await replaceConnection(manager, linkedServerConfig(updated, token));
+    if (connection.connected) {
+      writer.writeSuccess(t.t("cli.server.link.updated", "Updated {name}: {count} commands.", { name: saved.name, count: connection.commands.length }));
+    } else if (token && connection.needsSignIn) {
+      writer.writeWarning(rejectedTokenMessage(saved.name));
+    } else {
+      writer.writeWarning(t.t("cli.server.link.updated_unreachable", "Updated {name}, but it is unreachable now.", { name: saved.name }));
+    }
+  }
+};
+var ServerForgetAllProcessor = class {
+  constructor() {
+    this.command = "forget-all";
+    this.description = "Unlink every linked server and delete every saved token";
+  }
+  async processCommand(_command, context2) {
+    const t = context2.translator;
+    const manager = serverManagerOf(context2);
+    if (!manager) return;
+    const linked = linkedServersOf(context2);
+    const servers = await linked.list();
+    if (servers.length === 0) {
+      context2.writer.writeInfo(t.t("cli.server.link.none_linked", "No linked servers. Link one with server add."));
+      return;
+    }
+    const ok = await context2.reader.readConfirm(
+      t.t("cli.server.link.forget_all_confirm", "Unlink every linked server ({count}) and delete their saved tokens?", { count: servers.length }),
+      false
+    );
+    if (!ok) return;
+    await linked.clear();
+    for (const name of [...manager.connections.keys()]) {
+      if (manager.isLinked(name)) manager.removeServer(name);
+    }
+    const saved = context2.state.getState().defaultServer;
+    if (saved && !manager.connections.has(saved)) context2.state.updateState({ defaultServer: null });
+    context2.writer.writeSuccess(t.t("cli.server.link.forgot_all", "Every linked server and saved token is gone."));
+  }
+};
+async function linkedTokenLabels(context2, manager) {
+  const labels = /* @__PURE__ */ new Map();
+  const names = [...manager.connections.keys()].filter((n) => manager.isLinked(n));
+  if (names.length === 0) return labels;
+  const linked = linkedServersOf(context2);
+  for (const name of names) {
+    const token = await linked.token(name).catch(() => void 0);
+    if (token) labels.set(name, maskToken(token));
+  }
+  return labels;
+}
+
 // src/lib/server/cli-server-command-processor.ts
 var CliServerCommandProcessor = class {
   constructor() {
@@ -21117,7 +22034,11 @@ var CliServerCommandProcessor = class {
       new ServerStatusProcessor(),
       new ServerCommandsProcessor(),
       new ServerReconnectProcessor(),
-      new ServerDefaultProcessor()
+      new ServerDefaultProcessor(),
+      new ServerAddProcessor(),
+      new ServerRemoveProcessor(),
+      new ServerEditProcessor(),
+      new ServerForgetAllProcessor()
     ];
   }
   /** Restore the default server saved by `server default <name>`. */
@@ -21133,7 +22054,7 @@ var CliServerCommandProcessor = class {
     const t = context2.translator;
     const manager = serverManagerOf(context2);
     if (!manager) return;
-    writeServerTable(context2, manager);
+    writeServerTable(context2, manager, await linkedTokenLabels(context2, manager));
     context2.writer.writeln();
     writeHint(context2, "help server", t.t("cli.server.help.see_everything_you_can", "to see everything you can do"));
   }
@@ -21164,6 +22085,10 @@ var CliServerCommandProcessor = class {
       ["server commands|cmds [name]", t.t("cli.server.help.commands_each_server_provides", "Commands each server provides")],
       ["server reconnect|rc [name]", t.t("cli.server.help.connect_again_unreachable_servers", "Connect again (unreachable servers, or one)")],
       ["server default|use [name]", t.t("cli.server.help.show_set_server_shared", "Show or set the server for shared commands")],
+      ["server add [name] [url]", t.t("cli.server.help.add", "Link a server to this terminal (kept across reloads)")],
+      ["server edit <name> --url|--token", t.t("cli.server.help.edit", "Change a linked server")],
+      ["server remove <name>", t.t("cli.server.help.remove", "Unlink a server and delete its token")],
+      ["server forget-all", t.t("cli.server.help.forget_all", "Unlink every linked server")],
       ["ssh [name] [command]", t.t("cli.server.help.open_shell_server_run", "Open a shell on a server, or run one command")]
     ]);
     writer.writeln();
@@ -21186,7 +22111,7 @@ var ServerListProcessor = class {
   }
   async processCommand(_command, context2) {
     const manager = serverManagerOf(context2);
-    if (manager) writeServerTable(context2, manager);
+    if (manager) writeServerTable(context2, manager, await linkedTokenLabels(context2, manager));
   }
   writeDescription(context2) {
     const t = context2.translator;
@@ -21198,7 +22123,7 @@ var ServerListProcessor = class {
     writeUsage(context2, [["server list", ""], ["server ls", ""]]);
   }
 };
-function writeServerTable(context2, manager) {
+function writeServerTable(context2, manager, tokenLabels = /* @__PURE__ */ new Map()) {
   const t = context2.translator;
   const { writer } = context2;
   if (manager.connections.size === 0) {
@@ -21218,12 +22143,13 @@ function writeServerTable(context2, manager) {
       connected ? connection.capabilities?.version ?? "-" : "-",
       connected ? `v${connection.apiVersion}` : "-",
       connected ? String(connection.commands.length) : "-",
-      connected ? connection.capabilities?.shell ? "yes" : "no" : "-"
+      connected ? connection.capabilities?.shell ? "yes" : "no" : "-",
+      manager.isLinked(name) ? `linked ${tokenLabels.get(name) ?? ""}`.trim() : "app"
     ]);
   }
   writer.writeln(`\u{1F5A5}  Servers (${manager.connections.size}):`);
   writer.writeTable(
-    ["Name", "Status", "URL", "Version", "API", "Commands", "Shell"],
+    ["Name", "Status", "URL", "Version", "API", "Commands", "Shell", "Source"],
     rows
   );
   if (manager.defaultServer) {
@@ -22486,6 +23412,7 @@ function resolveCompletionPath(tokens, tokenIndex, processors, currentToken = ""
   let descriptors = [];
   let candidates = processors;
   let isFlagValue = false;
+  let flag;
   for (let i = 0; i < parsed.length; i++) {
     const token = parsed[i];
     if (token.kind === "flag") {
@@ -22494,6 +23421,7 @@ function resolveCompletionPath(tokens, tokenIndex, processors, currentToken = ""
         if (parsed[i + 1].kind === "word") i++;
       } else if (!currentToken.startsWith("-")) {
         isFlagValue = true;
+        flag = findParameter(token.name, descriptors);
       }
       continue;
     }
@@ -22507,7 +23435,11 @@ function resolveCompletionPath(tokens, tokenIndex, processors, currentToken = ""
     }
     candidates = match?.processors?.length ? match.processors : void 0;
   }
-  return { processor, descriptors, subCommands: candidates, isFlagValue };
+  return { processor, descriptors, subCommands: candidates, isFlagValue, flag };
+}
+function findParameter(name, descriptors) {
+  const bare = (a) => a.replace(/^-+/, "");
+  return descriptors.find((d) => d.name === name) ?? descriptors.find((d) => d.aliases?.some((a) => bare(a) === name));
 }
 function toParsedToken(text) {
   const flag = /^(--?)([a-zA-Z0-9_][^\s=]*)(=.*)?$/.exec(text);
@@ -22606,6 +23538,36 @@ var CliParameterCompletionProvider = class {
   }
 };
 
+// src/lib/completion/cli-parameter-value-completion-provider.ts
+var CliParameterValueCompletionProvider = class {
+  constructor(registry) {
+    this.registry = registry;
+    this.priority = 190;
+  }
+  getCompletions(context2) {
+    const { tokens, tokenIndex, token } = context2;
+    if (tokens.length === 0) return [];
+    const inline = /^(--?)([^\s=]+)=(.*)$/.exec(token);
+    if (inline) {
+      const path2 = resolveCompletionPath(tokens, tokenIndex, this.registry.processors, token);
+      const values2 = findParameter(inline[2], path2.descriptors)?.allowedValues;
+      if (!values2?.length) return [];
+      const prefix = `${inline[1]}${inline[2]}=`;
+      return matchIgnoringCase(values2, inline[3]).map((v) => `${prefix}${v}`);
+    }
+    if (token.startsWith("-")) return [];
+    const path = resolveCompletionPath(tokens, tokenIndex, this.registry.processors, token);
+    const values = path.isFlagValue ? path.flag?.allowedValues : void 0;
+    return values?.length ? matchIgnoringCase(values, token) : [];
+  }
+};
+function matchIgnoringCase(values, prefix) {
+  const exact = getAccelerator().prefixMatch(values, prefix);
+  if (exact.length) return exact;
+  const lower = prefix.toLowerCase();
+  return values.filter((v) => v.toLowerCase().startsWith(lower));
+}
+
 // src/lib/completion/cli-service-name-completion-provider.ts
 var SERVICE_NAME_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "start",
@@ -22893,6 +23855,7 @@ function createCompletionProviders(deps) {
     new CliServerNameCompletionProvider(serverManager),
     new CliConfigKeyCompletionProvider(registry),
     new CliCommandCompletionProvider(registry),
+    new CliParameterValueCompletionProvider(registry),
     new CliParameterCompletionProvider(registry, executor)
   ];
   const fromPlugins = services.getAll(
@@ -22901,6 +23864,143 @@ function createCompletionProviders(deps) {
   return [...fromPlugins, ...builtIn];
 }
 
+// src/lib/engine/cli-touch-scroll.ts
+var SLOP_PX = 8;
+var MIN_FLING = 0.15;
+var FRICTION = 0.997;
+var VELOCITY_WINDOW_MS = 100;
+var KEYBOARD_HOLD_MS = 400;
+function enableTouchScroll(terminal, paused = () => false) {
+  const element = terminal.element;
+  if (!element) {
+    return () => {
+    };
+  }
+  let startY = 0;
+  let lastY = 0;
+  let scrolling = false;
+  let carry = 0;
+  let moves = [];
+  let frame = 0;
+  let holdTimer = 0;
+  let holding = false;
+  const textarea = terminal.textarea;
+  const keyboardOpen = () => window.innerHeight < screen.height * 0.75;
+  const holdKeyboard = () => {
+    clearTimeout(holdTimer);
+    if (holding || !textarea || textarea.hasAttribute("inputmode") || keyboardOpen()) {
+      return;
+    }
+    holding = true;
+    textarea.setAttribute("inputmode", "none");
+  };
+  const releaseKeyboard = () => {
+    clearTimeout(holdTimer);
+    if (holding) {
+      holding = false;
+      textarea?.removeAttribute("inputmode");
+    }
+  };
+  const rowHeight = () => {
+    const screen2 = element.querySelector(".xterm-screen");
+    return (screen2?.clientHeight || element.clientHeight) / terminal.rows || 16;
+  };
+  const scrollBy = (pixels) => {
+    carry += pixels;
+    const height = rowHeight();
+    const rows = Math.trunc(carry / height);
+    if (rows === 0) {
+      return true;
+    }
+    carry -= rows * height;
+    const buffer = terminal.buffer.active;
+    const before = buffer.viewportY;
+    terminal.scrollLines(-rows);
+    const moved = buffer.viewportY !== before;
+    if (!moved) {
+      carry = 0;
+    }
+    return moved;
+  };
+  const stopGlide = () => {
+    cancelAnimationFrame(frame);
+    frame = 0;
+  };
+  const glide = (velocity) => {
+    let previous = performance.now();
+    const step = (now) => {
+      const elapsed = Math.min(now - previous, 50);
+      previous = now;
+      velocity *= Math.pow(FRICTION, elapsed);
+      if (Math.abs(velocity) < 0.02 || !scrollBy(velocity * elapsed)) {
+        frame = 0;
+        return;
+      }
+      frame = requestAnimationFrame(step);
+    };
+    frame = requestAnimationFrame(step);
+  };
+  const onStart = (e) => {
+    stopGlide();
+    scrolling = false;
+    if (e.touches.length !== 1 || paused()) {
+      return;
+    }
+    holdKeyboard();
+    startY = lastY = e.touches[0].clientY;
+    carry = 0;
+    moves = [{ y: startY, time: e.timeStamp }];
+  };
+  const onMove = (e) => {
+    if (e.touches.length !== 1 || paused() || moves.length === 0) {
+      return;
+    }
+    const y = e.touches[0].clientY;
+    if (!scrolling && Math.abs(y - startY) < SLOP_PX) {
+      return;
+    }
+    scrolling = true;
+    e.preventDefault();
+    scrollBy(y - lastY);
+    lastY = y;
+    moves.push({ y, time: e.timeStamp });
+    while (moves.length > 2 && e.timeStamp - moves[0].time > VELOCITY_WINDOW_MS) {
+      moves.shift();
+    }
+  };
+  const onEnd = (e) => {
+    if (!scrolling) {
+      releaseKeyboard();
+      moves = [];
+      return;
+    }
+    e.preventDefault();
+    scrolling = false;
+    holdTimer = window.setTimeout(releaseKeyboard, KEYBOARD_HOLD_MS);
+    const first = moves[0];
+    const last = moves[moves.length - 1];
+    moves = [];
+    const elapsed = last.time - first.time;
+    const velocity = elapsed > 0 && e.timeStamp - last.time < VELOCITY_WINDOW_MS ? (last.y - first.y) / elapsed : 0;
+    if (Math.abs(velocity) >= MIN_FLING) {
+      glide(velocity);
+    }
+  };
+  const options = { passive: false, capture: true };
+  element.addEventListener("touchstart", onStart, options);
+  element.addEventListener("touchmove", onMove, options);
+  element.addEventListener("touchend", onEnd, options);
+  element.addEventListener("touchcancel", onEnd, options);
+  return () => {
+    stopGlide();
+    releaseKeyboard();
+    element.removeEventListener("touchstart", onStart, options);
+    element.removeEventListener("touchmove", onMove, options);
+    element.removeEventListener("touchend", onEnd, options);
+    element.removeEventListener("touchcancel", onEnd, options);
+  };
+}
+
 // src/lib/engine/cli-engine.ts
 var CliEngine = class {
   constructor(container, options) {
@@ -23012,6 +24112,12 @@ var CliEngine = class {
     this.serializeAddon = setup.serializeAddon;
     this.dragDropService = setup.dragDropService;
     this.wheelListener = setup.wheelListener;
+    if (this.options?.touchScroll !== false) {
+      this.disposeTouchScroll = enableTouchScroll(
+        this.terminal,
+        () => !!this.executionContext?.contextProcessor
+      );
+    }
     this.handleResize();
   }
   /** 2. Service container, boot service, executor and execution context. */
@@ -23113,29 +24219,31 @@ var CliEngine = class {
     ]);
     return services.getRequired(CliServerManager_TOKEN);
   }
-  /** 4. Connect to the configured servers, one boot step each. */
+  /**
+   * 4. Connect to the configured servers, one boot step each, then to the
+   * servers the user linked (`server add`).
+   */
   async connectServers(serverManager, bootLog) {
-    const servers = this.options?.servers;
-    if (!servers || servers.length === 0) return;
     const ctx = this.executionContext;
-    bootLog.setCurrent("Connecting to servers");
-    await serverManager.connectAll(
-      servers,
-      {
-        warn: (msg) => {
-          ctx.logger.warn(msg);
-          bootLog.warn(msg);
-          bootLog.completeStep();
-        },
-        info: (msg) => {
-          ctx.logger.info(msg);
-          bootLog.ok(msg);
-          bootLog.completeStep();
-        }
+    const logger = {
+      warn: (msg) => {
+        ctx.logger.warn(msg);
+        bootLog.warn(msg);
+        bootLog.completeStep();
       },
-      ctx.backgroundServices,
-      ctx.logger
-    );
+      info: (msg) => {
+        ctx.logger.info(msg);
+        bootLog.ok(msg);
+        bootLog.completeStep();
+      }
+    };
+    serverManager.configure(logger, ctx.backgroundServices, ctx.logger);
+    const servers = this.options?.servers;
+    if (servers && servers.length > 0) {
+      bootLog.setCurrent("Connecting to servers");
+      await serverManager.connectAll(servers, logger, ctx.backgroundServices, ctx.logger);
+    }
+    await restoreLinkedServers(ctx, serverManager, logger.warn);
   }
   /**
    * 5. Built-in welcome and server modules, the app's modules, and the
@@ -23239,6 +24347,7 @@ var CliEngine = class {
     if (this.wheelListener) {
       this.container.removeEventListener("wheel", this.wheelListener);
     }
+    this.disposeTouchScroll?.();
     this.resizeVersion = -1;
     this.resizeScheduled = false;
     this.resizeObserver?.disconnect();
@@ -24147,6 +25256,21 @@ var DARK_SCHEME_QUERY = "(prefers-color-scheme: dark)";
 function asEventTarget(node) {
   return node && typeof node.addEventListener === "function" ? node : null;
 }
+function canScrollWithin(target, root, dx, dy) {
+  for (let el = target; el && el !== root; el = el.parentElement) {
+    if (!(el instanceof HTMLElement)) continue;
+    const style = getComputedStyle(el);
+    const scrollsY = /auto|scroll/.test(style.overflowY) && el.scrollHeight > el.clientHeight;
+    const scrollsX = /auto|scroll/.test(style.overflowX) && el.scrollWidth > el.clientWidth;
+    if (dy !== 0 && scrollsY) {
+      if (dy < 0 ? el.scrollTop > 0 : el.scrollTop + el.clientHeight < el.scrollHeight) return true;
+    }
+    if (dx !== 0 && scrollsX) {
+      if (dx < 0 ? el.scrollLeft > 0 : el.scrollLeft + el.clientWidth < el.scrollWidth) return true;
+    }
+  }
+  return false;
+}
 function followsSystem(input) {
   return input === "auto" || typeof input === "object" && input !== null && input.base === "auto";
 }
@@ -24228,6 +25352,16 @@ var CliPanelController = class {
       if (event.target !== first) return;
       this.syncThemeFromEngine(event.detail);
     };
+    /**
+     * A wheel over the panel chrome (header, icon strip, empty pane) would
+     * scroll the page behind it; the terminals already keep their own wheel.
+     */
+    this.onPanelWheel = (event) => {
+      const wheel = event;
+      const root = this.rootElement;
+      if (!root || canScrollWithin(wheel.target, root, wheel.deltaX, wheel.deltaY)) return;
+      wheel.preventDefault();
+    };
     this.onVisualViewportChange = () => {
       const fields = visualViewportFields();
       const s = this.snapshot;
@@ -24336,9 +25470,13 @@ var CliPanelController = class {
   /** Element containing the terminals, used for theme sync. */
   setRootElement(element) {
     if (element === this.rootElement) return;
-    asEventTarget(this.rootElement)?.removeEventListener(CLI_TERMINAL_THEME_EVENT, this.onTerminalTheme);
+    const previous = asEventTarget(this.rootElement);
+    previous?.removeEventListener(CLI_TERMINAL_THEME_EVENT, this.onTerminalTheme);
+    previous?.removeEventListener("wheel", this.onPanelWheel);
     this.rootElement = element;
-    asEventTarget(element)?.addEventListener(CLI_TERMINAL_THEME_EVENT, this.onTerminalTheme);
+    const next = asEventTarget(element);
+    next?.addEventListener(CLI_TERMINAL_THEME_EVENT, this.onTerminalTheme);
+    next?.addEventListener("wheel", this.onPanelWheel, { passive: false });
     if (element && this.followsTerminalTheme) this.startThemeSync();
   }
   /**
@@ -25270,6 +26408,6 @@ function openStatusDropdown(s) {
   return null;
 }
 
-export { API_VERSION, CLI_ENV_GLOBAL_PERMISSION, CLI_FRAMEWORK_SERVICE, CLOSE_GLYPH, CLOSE_ICON, CapturingTerminalWriter, CliAliasCommandProcessor, CliArgsParser, CliBackgroundServiceRegistry_TOKEN, CliBoot, CliBootLog, CliBootLog_TOKEN, CliCalCommandProcessor, CliCaptureCommandProcessor, CliClearCommandProcessor, CliClipboard, CliClipboardCommandProcessor, CliColorCommandProcessor, CliCommandExecutionContext, CliCommandExecutor, CliCommandHistory, CliCommandHistory_TOKEN, CliCommandProcessorRegistry, CliConfigureCommandProcessor, CliConvertCommandProcessor, CliDebugCommandProcessor, CliDefaultPingServerService, CliDiffCommandProcessor, CliDragDropService, CliEchoCommandProcessor, CliEngine, CliEnvCommandProcessor, CliEnvironment, CliEvalCommandProcessor, CliEventsCommandProcessor, CliExecutionContext, CliExecutionProcess, CliExportCommandProcessor, CliFalseCommandProcessor, CliFeedbackCommandProcessor, CliFontSizeCommandProcessor, CliFullScreenManager, CliHelpCommandProcessor, CliHistoryCommandProcessor, CliHotKeysCommandProcessor, CliHtopCommandProcessor, CliHttpClient, CliInputReader, CliJsonCommandProcessor, CliKeyValueStore, CliKeyValueStore_TOKEN, CliKillCommandProcessor, CliLogger, CliLoremCommandProcessor, CliModuleRegistry_TOKEN, CliNanoCommandProcessor, CliNotifier, CliOpenCommandProcessor, CliPackageManagerService, CliPackageManagerService_TOKEN, CliPackagesCommandProcessor, CliPanelController, CliPanelStatusTracker, CliPermissionRegistry, CliPingCommandProcessor, CliProcessRegistry, CliProcessRegistry_TOKEN, CliProcessorsRegistry_TOKEN, CliPsCommandProcessor, CliRandomCommandProcessor, CliScreenCommandProcessor, CliScriptSyntaxError, CliSeqCommandProcessor, CliServerCommandProcessor, CliServerConnection, CliServerManager, CliServerManager_TOKEN, CliServerMultiProxyProcessor, CliServerProxyProcessor, CliServiceContainer, CliServicesCommandProcessor, CliSleepCommandProcessor, CliSnippetCommandProcessor, CliSshCommandProcessor, CliStateStore, CliStateStoreManager, CliStateStoreManager_TOKEN, CliTerminalProgressBar, CliTerminalSpinner, CliTerminalTextAnimator, CliTerminalWriter, CliTestCommandProcessor, CliTestHarness, CliThemeCommandProcessor, CliTimeCommandProcessor, CliTimerManager, CliTimestampCommandProcessor, CliTrueCommandProcessor, CliUnAliasCommandProcessor, CliUnameCommandProcessor, CliUnsetCommandProcessor, CliUptimeCommandProcessor, CliVersionCommandProcessor, CliYesCommandProcessor, CommandParser, DEFAULT_CLI_NAME, DEFAULT_GLOBAL_STATUS, DEFAULT_PANEL_HEIGHT, DEFAULT_PANEL_WIDTH, DEFAULT_TAB_STATUS, ERROR_ICON, EXEC_POLL_MS, GLOBAL_POLL_MS, HIDE_ICON, HIDE_TAB_TERMINAL_ICON, ICliEnvironment_TOKEN, ICliPingServerService_TOKEN, ICliScriptRunner_TOKEN, JsFallbackAccelerator, LIBRARY_VERSION, MAXIMIZE_ICON, MIN_PANEL_SIZE, MIN_PANE_WIDTH_PERCENT, OverlayAddon, PANEL_LABELS, PANEL_POSITIONS, ProcessExitedError, RESTORE_ICON, SERVICES_ICON, SUCCESS_ICON, SVG_COMMON_ATTRS, SVG_VIEW_BOX, ScriptLoaderService, SyntaxHighlighterRegistry_TOKEN, TERMINAL_ICON, UPTIME_ICON, appendOutputToFile, appendStderrToFile, applyEnvironmentChange, builtinProcessors, capitalize, clampPanelSize, cliScriptRunner, collapseChevronIcon, computeDiff, computeGlobalStatus, computeTabStatus, contextGlobalParameter, contextMenuItems, contextMenuStyle, createCliEngine, createServerModule, defaultFontSize, describeShellClose, distributePaneWidths, dropdownAnchorStyle, executeOnServer, expandBraces, expandEnvironmentVars, expandGlobs, formatDiff, formatUptime2 as formatUptime, getAccelerator, getCliNameArt, getGreetingBasedOnTime, getTerminalOptions, glowLineClass, greetingModule, groupBy, handleRenameKey, helpGlobalParameter, hideTabChevronIcon, hotkeysInfo, initWasmAccelerator, initializeServices, initializeTerminal, interruptCommand, isHorizontalPosition, isWasmAccelerated, joinClasses, killProcess, matchGlob, mergeCliOptions, miscProcessors, nextRowsCommand, normalizePaneWidths, openLink, openStatusDropdown, paneClass, paneStyle, panelBranding, panelTabClass, panelTabDotClass, panelWrapperClass, panelWrapperStyle, panesContainerClass, panesContainerWidth, parseAssignments, parseScript, positionDropdownItemClass, positionIcon, positionOptions, reconcileArgs, renderServerResponse, renderSingleOutput, resizePaneWidths, resizedPanelSize, resolveCliBranding, resolveCliHostConfig, runContextMenuAction, runScript, splitWords, statusIndicators, substituteCommands, substituteVars, svgAttrs, systemProcessors, tabDotClass, themeInfos, themes, tryExecuteScript, versionGlobalParameter, waitForLayout, welcomeModule, writeOutputToFile, writeStderrToFile };
+export { API_VERSION, CLI_ENV_GLOBAL_PERMISSION, CLI_FRAMEWORK_SERVICE, CLOSE_GLYPH, CLOSE_ICON, CapturingTerminalWriter, CliAliasCommandProcessor, CliArgsParser, CliBackgroundServiceRegistry_TOKEN, CliBoot, CliBootLog, CliBootLog_TOKEN, CliCalCommandProcessor, CliCaptureCommandProcessor, CliClearCommandProcessor, CliClipboard, CliClipboardCommandProcessor, CliColorCommandProcessor, CliCommandExecutionContext, CliCommandExecutor, CliCommandHistory, CliCommandHistory_TOKEN, CliCommandProcessorRegistry, CliConfigureCommandProcessor, CliConvertCommandProcessor, CliDebugCommandProcessor, CliDefaultPingServerService, CliDiffCommandProcessor, CliDragDropService, CliEchoCommandProcessor, CliEngine, CliEnvCommandProcessor, CliEnvironment, CliEvalCommandProcessor, CliEventsCommandProcessor, CliExecutionContext, CliExecutionProcess, CliExportCommandProcessor, CliFalseCommandProcessor, CliFeedbackCommandProcessor, CliFontSizeCommandProcessor, CliFullScreenManager, CliHelpCommandProcessor, CliHistoryCommandProcessor, CliHotKeysCommandProcessor, CliHtopCommandProcessor, CliHttpClient, CliInputReader, CliJsonCommandProcessor, CliKeyValueStore, CliKeyValueStore_TOKEN, CliKillCommandProcessor, CliLinkedServers, CliLogger, CliLoremCommandProcessor, CliModuleRegistry_TOKEN, CliNanoCommandProcessor, CliNotifier, CliOpenCommandProcessor, CliPackageManagerService, CliPackageManagerService_TOKEN, CliPackagesCommandProcessor, CliPanelController, CliPanelStatusTracker, CliPermissionRegistry, CliPingCommandProcessor, CliProcessRegistry, CliProcessRegistry_TOKEN, CliProcessorsRegistry_TOKEN, CliPsCommandProcessor, CliRandomCommandProcessor, CliScreenCommandProcessor, CliScriptSyntaxError, CliSeqCommandProcessor, CliServerCommandProcessor, CliServerConnection, CliServerManager, CliServerManager_TOKEN, CliServerMultiProxyProcessor, CliServerProxyProcessor, CliServiceContainer, CliServicesCommandProcessor, CliSleepCommandProcessor, CliSnippetCommandProcessor, CliSshCommandProcessor, CliStateStore, CliStateStoreManager, CliStateStoreManager_TOKEN, CliTerminalProgressBar, CliTerminalSpinner, CliTerminalTextAnimator, CliTerminalWriter, CliTestCommandProcessor, CliTestHarness, CliThemeCommandProcessor, CliTimeCommandProcessor, CliTimerManager, CliTimestampCommandProcessor, CliTrueCommandProcessor, CliUnAliasCommandProcessor, CliUnameCommandProcessor, CliUnsetCommandProcessor, CliUptimeCommandProcessor, CliVersionCommandProcessor, CliWebCryptoSecretStore, CliYesCommandProcessor, CommandParser, DEFAULT_CLI_NAME, DEFAULT_GLOBAL_STATUS, DEFAULT_PANEL_HEIGHT, DEFAULT_PANEL_WIDTH, DEFAULT_TAB_STATUS, ERROR_ICON, EXEC_POLL_MS, GLOBAL_POLL_MS, HIDE_ICON, HIDE_TAB_TERMINAL_ICON, ICliEnvironment_TOKEN, ICliPingServerService_TOKEN, ICliScriptRunner_TOKEN, JsFallbackAccelerator, LIBRARY_VERSION, MAXIMIZE_ICON, MIN_PANEL_SIZE, MIN_PANE_WIDTH_PERCENT, OverlayAddon, PANEL_LABELS, PANEL_POSITIONS, ProcessExitedError, RESTORE_ICON, SERVER_NAME_PATTERN, SERVICES_ICON, SUCCESS_ICON, SVG_COMMON_ATTRS, SVG_VIEW_BOX, ScriptLoaderService, SyntaxHighlighterRegistry_TOKEN, TERMINAL_ICON, UPTIME_ICON, appendOutputToFile, appendStderrToFile, applyEnvironmentChange, builtinProcessors, capitalize, checkServerUrl, clampPanelSize, cliScriptRunner, collapseChevronIcon, computeDiff, computeGlobalStatus, computeTabStatus, contextGlobalParameter, contextMenuItems, contextMenuStyle, createCliEngine, createServerModule, createTokenWithPassword, defaultFontSize, describeShellClose, deviceName, distributePaneWidths, dropdownAnchorStyle, executeOnServer, expandBraces, expandEnvironmentVars, expandGlobs, formatDiff, formatUptime2 as formatUptime, getAccelerator, getCliNameArt, getGreetingBasedOnTime, getTerminalOptions, glowLineClass, greetingModule, groupBy, handleRenameKey, helpGlobalParameter, hideTabChevronIcon, hotkeysInfo, initWasmAccelerator, initializeServices, initializeTerminal, interruptCommand, isHorizontalPosition, isPrivateHost, isWasmAccelerated, joinClasses, killProcess, linkedServerConfig, linkedServersOf, maskToken, matchGlob, mergeCliOptions, miscProcessors, nextRowsCommand, normalizePaneWidths, normalizeServerUrl, openLink, openStatusDropdown, paneClass, paneStyle, panelBranding, panelTabClass, panelTabDotClass, panelWrapperClass, panelWrapperStyle, panesContainerClass, panesContainerWidth, parseAssignments, parseScript, plainText2 as plainText, pollLink, positionDropdownItemClass, positionIcon, positionOptions, probeServer, reconcileArgs, redactSecrets, renderServerResponse, renderSingleOutput, requestLink, resizePaneWidths, resizedPanelSize, resolveCliBranding, resolveCliHostConfig, restoreLinkedServers, runContextMenuAction, runScript, secretStoreOf, splitWords, statusIndicators, substituteCommands, substituteVars, suggestServerName, svgAttrs, systemProcessors, tabDotClass, themeInfos, themes, tryExecuteScript, userServersAllow, userServersEnabled, versionGlobalParameter, waitForLayout, welcomeModule, writeOutputToFile, writeStderrToFile };
 //# sourceMappingURL=public-api.mjs.map
 //# sourceMappingURL=public-api.mjs.map