@sealant/mend 0.1.1 → 0.3.0

package/dist/main.js

@@ -2,10 +2,22 @@
 import { spawn, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import { createRequire } from "node:module";
+import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
+import { readSyncFiles, scanDotfileCandidates } from "./dotfiles.js";
+import { formatLoadReport } from "./env.js";
+import { isComposeFile, proposeFromCompose, proposeFromPackageJson, proposeFromWorkspacePackage, renderMendToml, workspaceGlobs, } from "./service-init.js";
 import { CONTINUE_COMMANDS, gitTopLevel, HARNESS_COMMANDS, LIVE_STATUSES, matchProjectByCwd, normalizeProjectName, } from "./shared.js";
-const CONFIG_PATH = path.join(os.homedir(), ".mend", "cli.json");
+// `$XDG_CONFIG_HOME/mend`, default `~/.config/mend`; a pre-XDG `~/.mend` stays authoritative
+// when it is the only one present (mirrors @mend/store's resolver — the CLI stays dependency-light).
+const mendCliHome = () => {
+    const xdg = process.env["XDG_CONFIG_HOME"];
+    const preferred = path.join(xdg === undefined || xdg === "" ? path.join(os.homedir(), ".config") : xdg, "mend");
+    const legacy = path.join(os.homedir(), ".mend");
+    return !fs.existsSync(preferred) && fs.existsSync(legacy) ? legacy : preferred;
+};
+const CONFIG_PATH = path.join(mendCliHome(), "cli.json");
 const loadConfig = () => {
     let fileConfig = {};
     if (fs.existsSync(CONFIG_PATH)) {
@@ -82,7 +94,9 @@ const request = async (config, method, route, body) => {
         throw new Error(`cannot reach the Mend server at ${config.url} — is it running?`);
     }
     if (response.status === 401) {
-        throw new Error(`unauthorized — set MEND_TOKEN (or "token" in ${CONFIG_PATH}) to a bearer token for ${config.url}`);
+        throw new Error(config.token === null
+            ? `not signed in to ${config.url} — run: mend login`
+            : `unauthorized at ${config.url} — the saved token was rejected; run: mend login`);
     }
     const text = await response.text();
     if (!response.ok) {
@@ -132,18 +146,35 @@ const withSpinner = async (label, work) => {
 const adopt = async (config, args) => {
     const nameFlag = args.indexOf("--name");
     const name = nameFlag !== -1 && args[nameFlag + 1] !== undefined ? String(args[nameFlag + 1]) : null;
-    const positional = args.filter((a, i) => !a.startsWith("--") && (nameFlag === -1 || i !== nameFlag + 1));
+    const authFlagIndex = args.indexOf("--auth");
+    const positional = args.filter((a, i) => !a.startsWith("--") &&
+        (nameFlag === -1 || i !== nameFlag + 1) &&
+        (authFlagIndex === -1 || i !== authFlagIndex + 1));
     // Bare `mend adopt` adopts the repo the cwd is inside, not the subdirectory.
     const rawSource = positional[0] ?? gitTopLevel(process.cwd()) ?? ".";
     const source = /^(https?|git|ssh):|^git@/.test(rawSource) ? rawSource : path.resolve(rawSource);
     // Derived defaults are normalized ("Mend" → "mend"); explicit --name is sent as typed.
     const projectName = name ?? normalizeProjectName(path.basename(source, ".git"));
+    const auth = authFlagIndex !== -1 && args[authFlagIndex + 1] !== undefined
+        ? String(args[authFlagIndex + 1])
+        : null;
+    if (auth !== null && auth !== "ambient" && auth !== "mend-key" && auth !== "bridge") {
+        return fail(`--auth takes "ambient", "mend-key", or "bridge", not "${auth}"`);
+    }
     const project = await api(config, "POST", "/projects", {
         name: projectName,
         source,
+        ...(auth === null ? {} : { gitAuthMode: auth }),
     });
     say(`${green("✓")} adopted · ${project.name} · ${dim(project.storePath)}`);
     say(`${dim("  default branch")} ${project.defaultBranch}`);
+    // Say which signer did the work — the clone already proved it answers.
+    if (project.gitAuthMode === "mend-key") {
+        say(`${dim("  git auth")} mend key ${dim("(the machine's deploy key signed this clone)")}`);
+    }
+    else if (project.gitAuthMode === "bridge") {
+        say(`${dim("  git auth")} bridge ${dim("(signed through the connected `mend keys share`)")}`);
+    }
     say(`${dim("  sessions start with:")} mend codex ${dim("(from anywhere —")} --project ${project.name}${dim(")")}`);
 };
 // ─── session launch ─────────────────────────────────────────────────────────
@@ -218,10 +249,15 @@ const launch = async (config, harness, args) => {
  * caller decides what each outcome means (commands exit, the dashboard
  * resumes).
  */
-const attachTty = async (config, sessionId, harness, from) => {
+const attachTty = async (config, sessionId, harness, from, processId, options) => {
     const url = new URL(`${config.url}/api/tty`);
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-    url.searchParams.set("session", sessionId);
+    // Process addressing reaches any PTY in the workspace (a shell); the
+    // session form remains the agent's PTY.
+    if (processId !== undefined)
+        url.searchParams.set("process", processId);
+    else
+        url.searchParams.set("session", sessionId);
     url.searchParams.set("from", from.toString());
     if (config.token !== null)
         url.searchParams.set("token", config.token);
@@ -294,12 +330,16 @@ const attachTty = async (config, sessionId, harness, from) => {
     try {
         sendResize();
         process.stdout.on("resize", onWinch);
-        if (rawTty) {
-            process.stdin.setRawMode(true);
-            rawModeEnabled = true;
+        // Read-only (logs): never forward stdin — Ctrl+C exits the CLI, the
+        // socket drops, and the process inside keeps running untouched.
+        if (options?.readOnly !== true) {
+            if (rawTty) {
+                process.stdin.setRawMode(true);
+                rawModeEnabled = true;
+            }
+            process.stdin.resume();
+            process.stdin.on("data", onKeys);
         }
-        process.stdin.resume();
-        process.stdin.on("data", onKeys);
         ws.addEventListener("message", onTtyFrame);
         await finished;
         return detached ? "detached" : "ended";
@@ -350,6 +390,887 @@ const attach = async (config, args) => {
     await attachOrExit(config, match.id, match.harness);
     exitAfterSessionEnd(config, match.id);
 };
+/** Compact picker: numbered live sessions, one keystroke of typing. */
+const pickSessionInteractively = async (rows) => {
+    say(dim("more than one live session — pick one:"));
+    rows.forEach((row, index) => {
+        say(`  ${index + 1}. ${row.session.harness.padEnd(8)} ${dim(row.session.id.slice(0, 8))}  ${row.projectName}  ${dim(row.session.branch)}`);
+    });
+    const readline = await import("node:readline/promises");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await rl.question("  session #: ");
+    rl.close();
+    const chosen = rows[Number(answer.trim()) - 1];
+    if (chosen === undefined)
+        return fail(`"${answer.trim()}" is not one of the choices`);
+    return chosen.session;
+};
+/**
+ * The resolution order (docs/SESSION-SERVICES.md): an explicit id wins, then
+ * the cwd's project narrows, one candidate is taken, several go to the
+ * picker, and a non-interactive caller never gets a silent guess.
+ */
+const resolveLiveSession = async (config, prefix) => {
+    const sessions = await api(config, "GET", "/sessions");
+    if (prefix !== undefined) {
+        const matches = sessions.filter((s) => s.id.startsWith(prefix));
+        if (matches.length === 0)
+            return fail(`no live session matches "${prefix}"`);
+        const exact = matches[0];
+        if (matches.length > 1 || exact === undefined) {
+            return fail(`session prefix "${prefix}" is ambiguous — use more of the id`);
+        }
+        return exact;
+    }
+    const projects = await api(config, "GET", "/projects");
+    const project = matchProjectByCwd(projects, process.cwd());
+    const candidates = project === undefined ? sessions : sessions.filter((s) => s.projectId === project.id);
+    const only = candidates[0];
+    if (only === undefined) {
+        return fail("no live session — start one with mend codex|claude|opencode");
+    }
+    if (candidates.length === 1)
+        return only;
+    if (process.stdin.isTTY !== true) {
+        return fail("several live sessions — name one: mend shell <session-id-prefix>");
+    }
+    const nameById = new Map(projects.map((p) => [p.id, p.name]));
+    return pickSessionInteractively(candidates.map((session) => ({
+        session,
+        projectName: nameById.get(session.projectId) ?? session.projectId.slice(0, 8),
+    })));
+};
+/**
+ * A real interactive shell in the session's CURRENT workspace — same
+ * /workspace/repo the agent is editing, same dependencies, same network. Not
+ * a shell in the host checkout. The shell holds a workspace lease, so the
+ * container survives the agent settling while the shell lives.
+ */
+const shellCommand = async (config, args) => {
+    const prefix = args.find((a) => !a.startsWith("--"));
+    const session = await resolveLiveSession(config, prefix);
+    say(`${green("✓")} shell in ${session.harness} session ${dim(session.id.slice(0, 8))} · ${dim(session.branch)}${detachHint()}`);
+    const shellProcess = await withSpinner("opening a shell in the session workspace…", api(config, "POST", `/sessions/${session.id}/shell`));
+    say("");
+    const outcome = await attachTty(config, session.id, "shell", 0n, shellProcess.id);
+    if (outcome === "unavailable") {
+        return fail(`tty attach unavailable: could not connect to ${config.url}`);
+    }
+    say("");
+    if (outcome === "detached") {
+        say(`${amber("detached")} — the shell keeps running and holds the workspace open`);
+        process.exit(0);
+    }
+    say(`${green("✓")} shell ended`);
+    process.exit(0);
+};
+const serviceUrl = (config, service) => {
+    const host = new URL(config.url).hostname || "localhost";
+    // A UDP Service has no page to open — the endpoint is the whole fact.
+    return service.protocol === "udp"
+        ? `${host}:${service.hostPort ?? "?"} (udp)`
+        : `http://${host}:${service.hostPort ?? "?"}`;
+};
+const printService = (config, service) => {
+    const status = service.status === "reachable" ? green(service.status) : amber(service.status);
+    say(`${(service.label ?? service.id.slice(0, 8)).padEnd(12)}  ${dim(`:${service.workspacePort ?? "?"}${service.protocol === "udp" ? "/udp" : ""} →`)} ${serviceUrl(config, service)}  ${status}  ${dim(service.id.slice(0, 8))}`);
+};
+/**
+ * Adopt an already-listening workspace port as a Service: Mend binds a host
+ * port on its private interfaces and pumps every connection into the
+ * session's workspace. No supervision — reachability is the observation.
+ */
+const serviceAdd = async (config, args) => {
+    const nameFlag = args.indexOf("--name");
+    const name = nameFlag !== -1 && args[nameFlag + 1] !== undefined ? String(args[nameFlag + 1]) : null;
+    const protocol = args.includes("--udp") ? "udp" : "tcp";
+    const positional = args.filter((a, i) => !a.startsWith("--") && (nameFlag === -1 || i !== nameFlag + 1));
+    const portRaw = positional.find((a) => /^\d+$/.test(a));
+    if (portRaw === undefined) {
+        return fail("usage: mend service add [session] <port> [--name <n>] [--udp]");
+    }
+    const port = Number(portRaw);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        return fail(`"${portRaw}" is not a port`);
+    }
+    const prefix = positional.find((a) => a !== portRaw);
+    const session = await resolveLiveSession(config, prefix);
+    const service = await api(config, "POST", `/sessions/${session.id}/services`, {
+        port,
+        name,
+        protocol,
+    });
+    say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
+    say(`  ${cobalt(serviceUrl(config, service))}`);
+    if (protocol === "udp") {
+        say(dim(`  udp — a reply is the only reachability signal; silence just relays`));
+    }
+    else if (service.status !== "reachable") {
+        say(dim(`  nothing answered on :${port} yet — the URL goes live when something listens`));
+    }
+};
+const serviceList = async (config) => {
+    const services = await api(config, "GET", "/services");
+    if (services.length === 0) {
+        say(dim("no live services — mend service add <port> adopts a listening one"));
+        return;
+    }
+    for (const service of services)
+        printService(config, service);
+};
+const serviceStop = async (config, args) => {
+    const needle = args.find((a) => !a.startsWith("--"));
+    if (needle === undefined)
+        return fail("usage: mend service stop <name-or-id-prefix>");
+    const services = await api(config, "GET", "/services");
+    const matches = services.filter((service) => service.label === needle || service.id.startsWith(needle));
+    if (matches.length === 0)
+        return fail(`no live service matches "${needle}"`);
+    const match = matches[0];
+    if (matches.length > 1 || match === undefined) {
+        return fail(`"${needle}" is ambiguous — use more of the id`);
+    }
+    const stoppedService = await api(config, "POST", `/services/${match.id}/stop`);
+    say(`${green("✓")} stopped · ${stoppedService.label ?? stoppedService.id.slice(0, 8)}`);
+};
+const findLiveService = async (config, needle) => {
+    const services = await api(config, "GET", "/services");
+    const matches = services.filter((service) => service.label === needle || service.id.startsWith(needle));
+    if (matches.length === 0)
+        return fail(`no live service matches "${needle}"`);
+    const match = matches[0];
+    if (matches.length > 1 || match === undefined) {
+        return fail(`"${needle}" is ambiguous — use more of the id`);
+    }
+    return match;
+};
+/**
+ * Start and supervise a Service: the command runs as its own PTY process in
+ * the session's workspace (own record = its logs), Mend waits for the
+ * declared port to answer, then exposes it like any Service. The command
+ * never occupies the agent's terminal or a tool call.
+ */
+const serviceRun = async (config, args) => {
+    const dashdash = args.indexOf("--");
+    const usage = "usage: mend service run [session] --port <port> [--name <n>] [--udp] -- <command...>\n" +
+        "       mend service run [session] <name>          (a declared recipe)";
+    // No explicit command = a DECLARED Service: resolve the name against the
+    // session worktree's mend.toml and start (or adopt) its recipe.
+    if (dashdash === -1) {
+        const positionals = args.filter((a) => !a.startsWith("--"));
+        const name = positionals.at(-1);
+        if (name === undefined)
+            return fail(usage);
+        const prefix = positionals.length > 1 ? positionals[0] : undefined;
+        const session = await resolveLiveSession(config, prefix);
+        const recipes = await api(config, "GET", `/sessions/${session.id}/recipes`);
+        const recipe = recipes.find((entry) => entry.name === name);
+        if (recipe === undefined) {
+            const known = recipes.map((entry) => entry.name).join(", ");
+            return fail(recipes.length === 0
+                ? `no mend.toml recipes in this worktree — declare [service.${name}] first`
+                : `no recipe named "${name}" — declared: ${known}`);
+        }
+        if (recipe.command === null) {
+            // A port-only recipe is an adopt: something else starts the listener.
+            const service = await api(config, "POST", `/sessions/${session.id}/services`, {
+                port: recipe.port,
+                name: recipe.name,
+                protocol: recipe.protocol,
+            });
+            say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
+            say(`  ${cobalt(serviceUrl(config, service))}`);
+            return;
+        }
+        const service = await withSpinner(recipe.protocol === "udp"
+            ? `starting ${recipe.name} (udp :${recipe.port})…`
+            : `starting ${recipe.name} — waiting for :${recipe.port} to answer…`, api(config, "POST", `/sessions/${session.id}/services/run`, {
+            argv: ["sh", "-c", recipe.command],
+            port: recipe.port,
+            name: recipe.name,
+            protocol: recipe.protocol,
+        }));
+        say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
+        say(`  ${cobalt(serviceUrl(config, service))}`);
+        say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
+        return;
+    }
+    const argv = args.slice(dashdash + 1);
+    if (argv.length === 0)
+        return fail(usage);
+    const head = args.slice(0, dashdash);
+    const portFlag = head.indexOf("--port");
+    const port = portFlag !== -1 ? Number(head[portFlag + 1]) : Number.NaN;
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        return fail(usage);
+    const nameFlag = head.indexOf("--name");
+    const name = nameFlag !== -1 && head[nameFlag + 1] !== undefined ? String(head[nameFlag + 1]) : null;
+    const protocol = head.includes("--udp") ? "udp" : "tcp";
+    const prefix = head.find((a, i) => !a.startsWith("--") && i !== portFlag + 1 && i !== nameFlag + 1);
+    const session = await resolveLiveSession(config, prefix);
+    const service = await withSpinner(protocol === "udp"
+        ? `starting ${name ?? argv[0]} (udp :${port})…`
+        : `starting ${name ?? argv[0]} — waiting for :${port} to answer…`, api(config, "POST", `/sessions/${session.id}/services/run`, {
+        argv,
+        port,
+        name,
+        protocol,
+    }));
+    say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
+    say(`  ${cobalt(serviceUrl(config, service))}`);
+    say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
+};
+/**
+ * Watch a supervised Service's output: record replay, then live tail. A DEAD
+ * Service still answers — its record outlives the process — printed once
+ * instead of followed.
+ */
+const serviceLogs = async (config, args) => {
+    const needle = args.find((a) => !a.startsWith("--"));
+    if (needle === undefined)
+        return fail("usage: mend service logs <name-or-id-prefix>");
+    const everything = await api(config, "GET", "/services?all=1");
+    const matches = everything.filter((service) => service.label === needle || service.id.startsWith(needle));
+    if (matches.length === 0)
+        return fail(`no service matches "${needle}"`);
+    // Prefer the live one; otherwise the newest ended one (list is newest-first).
+    const service = matches.find((m) => m.status !== "exited" && m.status !== "stopped") ?? matches[0];
+    if (service === undefined)
+        return fail(`no service matches "${needle}"`);
+    if (service.sealantSessionId === null) {
+        return fail(`"${needle}" is an adopted port — no process of Mend's, no logs. mend service run supervises.`);
+    }
+    if (service.status === "exited" || service.status === "stopped") {
+        // Post-mortem: print the record, don't attach.
+        const output = await api(config, "GET", `/processes/${service.id}/output`);
+        say(dim(`${service.label ?? service.id.slice(0, 8)} · ${service.status} — recorded output:`));
+        say("");
+        process.stdout.write(output.text.endsWith("\n") ? output.text : `${output.text}\n`);
+        process.exit(0);
+    }
+    say(dim(`following ${service.label ?? service.id.slice(0, 8)} — Ctrl+C detaches, the service keeps running`));
+    say("");
+    const outcome = await attachTty(config, service.sessionId, "service", 0n, service.id, {
+        readOnly: true,
+    });
+    if (outcome === "unavailable") {
+        return fail(`tty attach unavailable: could not connect to ${config.url}`);
+    }
+    say("");
+    say(dim("stream ended"));
+    process.exit(0);
+};
+const serviceRestart = async (config, args) => {
+    const needle = args.find((a) => !a.startsWith("--"));
+    if (needle === undefined)
+        return fail("usage: mend service restart <name-or-id-prefix>");
+    const service = await findLiveService(config, needle);
+    const restarted = await withSpinner(`restarting ${service.label ?? service.id.slice(0, 8)}…`, api(config, "POST", `/services/${service.id}/restart`));
+    say(`${green("✓")} restarted · ${restarted.status}`);
+    say(`  ${cobalt(serviceUrl(config, restarted))}`);
+};
+/**
+ * Scaffold mend.toml from the project's own manifests. Static suggestion,
+ * not detection: package.json scripts and compose port mappings become
+ * recipe proposals the user confirms and commits. Nothing runs.
+ */
+const serviceInit = async (args) => {
+    const root = gitTopLevel(process.cwd()) ?? process.cwd();
+    const target = path.join(root, "mend.toml");
+    if (fs.existsSync(target)) {
+        return fail(`${target} already exists — edit it directly (init never merges)`);
+    }
+    const rootFiles = fs.readdirSync(root);
+    const proposals = [];
+    const readRoot = (name) => fs.readFileSync(path.join(root, name), "utf8");
+    if (rootFiles.includes("package.json")) {
+        proposals.push(...proposeFromPackageJson(readRoot("package.json"), rootFiles));
+    }
+    // Monorepo sweep: every workspace package, named after its folder.
+    const globs = workspaceGlobs(rootFiles.includes("pnpm-workspace.yaml") ? readRoot("pnpm-workspace.yaml") : null, rootFiles.includes("package.json") ? readRoot("package.json") : null);
+    for (const glob of globs) {
+        const parent = glob.replace(/\/?\*+$/, "");
+        const dirs = glob.endsWith("*")
+            ? fs.existsSync(path.join(root, parent))
+                ? fs.readdirSync(path.join(root, parent)).map((dir) => path.join(parent, dir))
+                : []
+            : [glob];
+        for (const dir of dirs) {
+            const manifest = path.join(root, dir, "package.json");
+            if (!fs.existsSync(manifest))
+                continue;
+            for (const proposal of proposeFromWorkspacePackage(path.basename(dir), fs.readFileSync(manifest, "utf8"), rootFiles)) {
+                if (!proposals.some((existing) => existing.name === proposal.name)) {
+                    proposals.push(proposal);
+                }
+            }
+        }
+    }
+    // Every compose flavor in the root, aggregated; non-default files need -f.
+    for (const composeName of rootFiles.filter(isComposeFile).toSorted()) {
+        const isDefault = composeName === "compose.yaml" || composeName === "docker-compose.yml";
+        for (const proposal of proposeFromCompose(readRoot(composeName))) {
+            if (!proposals.some((existing) => existing.name === proposal.name)) {
+                proposals.push({
+                    ...proposal,
+                    command: isDefault
+                        ? proposal.command
+                        : proposal.command.replace("docker compose ", `docker compose -f ${composeName} `),
+                    source: `${composeName}: ${proposal.source}`,
+                });
+            }
+        }
+    }
+    if (proposals.length === 0) {
+        return fail("nothing to propose — no server-ish package.json script with a nameable port, no compose ports");
+    }
+    const toml = renderMendToml(proposals);
+    say(dim(`proposed ${target}:`));
+    say("");
+    process.stdout.write(toml);
+    say("");
+    if (!args.includes("--yes")) {
+        if (process.stdin.isTTY !== true) {
+            return fail("non-interactive — pass --yes to write the file");
+        }
+        const readline = await import("node:readline/promises");
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        const answer = await rl.question("write it? [y/N] ");
+        rl.close();
+        if (answer.trim().toLowerCase() !== "y") {
+            say(dim("nothing written"));
+            return;
+        }
+    }
+    fs.writeFileSync(target, toml);
+    say(`${green("✓")} wrote ${target} — commit it, then: mend service run ${proposals[0]?.name}`);
+};
+const serviceCommand = async (config, args) => {
+    const [verb, ...rest] = args;
+    switch (verb) {
+        case "run":
+            return serviceRun(config, rest);
+        case "add":
+            return serviceAdd(config, rest);
+        case "init":
+            return serviceInit(rest);
+        case "list":
+        case undefined:
+            return serviceList(config);
+        case "logs":
+            return serviceLogs(config, rest);
+        case "restart":
+            return serviceRestart(config, rest);
+        case "stop":
+            return serviceStop(config, rest);
+        default:
+            // Sugar: `mend service mysql` reads as `mend service run mysql` — a
+            // bare word that isn't a verb is a recipe name. A miss still explains
+            // itself (declared recipes are listed in the failure).
+            return serviceRun(config, [verb, ...rest]);
+    }
+};
+// ─── login: obtain and save the bearer token ────────────────────────────────
+const takeFlagValue = (args, flag) => {
+    const at = args.indexOf(flag);
+    return at !== -1 && args[at + 1] !== undefined ? String(args[at + 1]) : null;
+};
+/**
+ * Read a password: raw-mode without echo on a TTY; on a pipe, one line through the SAME readline
+ * that read the email (a second reader would find the buffered pipe already drained).
+ */
+const readSecretLine = async (prompt, rl) => {
+    if (process.stdin.isTTY !== true) {
+        return (await rl.question(prompt)).trim();
+    }
+    process.stdout.write(prompt);
+    return new Promise((resolve) => {
+        const stdin = process.stdin;
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        let buffer = "";
+        const onData = (chunk) => {
+            for (const char of chunk) {
+                if (char === "\r" || char === "\n") {
+                    stdin.setRawMode(false);
+                    stdin.pause();
+                    stdin.off("data", onData);
+                    process.stdout.write("\n");
+                    resolve(buffer);
+                    return;
+                }
+                if (char === "\u0003") {
+                    stdin.setRawMode(false);
+                    process.stdout.write("\n");
+                    process.exit(130);
+                }
+                if (char === "\u007f" || char === "\b") {
+                    buffer = buffer.slice(0, -1);
+                    continue;
+                }
+                buffer += char;
+            }
+        };
+        stdin.on("data", onData);
+    });
+};
+const saveCliConfig = (next) => {
+    fs.mkdirSync(path.dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(CONFIG_PATH, `${JSON.stringify({ url: next.url, token: next.token }, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(CONFIG_PATH, 0o600);
+};
+/**
+ * `mend login [--url <server>] [--email <address>]`: sign in with email + password against the
+ * server's auth endpoint (the bearer plugin answers with a `set-auth-token` header) and save the
+ * token 0600 in the CLI config. Nothing else asks for a password again.
+ */
+const login = async (config, args) => {
+    const url = takeFlagValue(args, "--url") ?? process.env["MEND_URL"] ?? config.url;
+    const emailFlag = takeFlagValue(args, "--email");
+    const readline = await import("node:readline/promises");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const email = emailFlag ?? (await rl.question(`email for ${url}: `)).trim();
+    if (email === "") {
+        rl.close();
+        return fail("an email is required");
+    }
+    const password = await readSecretLine("password: ", rl);
+    rl.close();
+    if (password === "")
+        return fail("a password is required");
+    let response;
+    try {
+        response = await fetch(`${url}/api/auth/sign-in/email`, {
+            method: "POST",
+            // better-auth's CSRF check rejects the `Origin: null` a non-browser fetch sends; the
+            // server's own URL is always a trusted origin, so present that.
+            headers: { "content-type": "application/json", origin: url },
+            body: JSON.stringify({ email, password }),
+        });
+    }
+    catch {
+        return fail(`cannot reach the Mend server at ${url} — is it running?`);
+    }
+    if (response.status === 401 || response.status === 403 || response.status === 400) {
+        return fail(`sign-in refused for ${email} at ${url}`);
+    }
+    if (!response.ok)
+        return fail(`sign-in failed: ${url} responded ${response.status}`);
+    const token = response.headers.get("set-auth-token");
+    if (token === null || token === "") {
+        return fail("the server signed you in but returned no bearer token (bearer plugin missing?)");
+    }
+    saveCliConfig({ ...config, url, token });
+    say(`${green("✓")} signed in as ${email} · ${dim(`token saved to ${CONFIG_PATH}`)}`);
+};
+const logout = (config) => {
+    if (!fs.existsSync(CONFIG_PATH)) {
+        say(dim("nothing saved — already signed out"));
+        return;
+    }
+    saveCliConfig({ ...config, token: null });
+    say(`${green("✓")} signed out · ${dim(`token removed from ${CONFIG_PATH}`)}`);
+};
+// ─── keys: the machine's Mend deploy key (docs/GIT-ACCESS.md) ───────────────
+/** Print the public key with the one instruction that makes it useful. */
+const printGitKey = (key) => {
+    if (key.publicKey === null)
+        return;
+    say(key.publicKey);
+    if (key.fingerprint !== null)
+        say(dim(`  ${key.fingerprint}`));
+    say(dim("  add this as a deploy key on your git host (GitHub/GitLab/Gitea: repo"));
+    say(dim("  settings → deploy keys; grant write access if sessions should push),"));
+    say(dim("  then adopt with: mend adopt <ssh-url> --auth mend-key"));
+};
+const keysShow = async (config) => {
+    const key = await api(config, "GET", "/keys/git");
+    if (!key.exists) {
+        say(`no Mend key yet ${dim("— mend keys init generates one (ed25519, stays on the server host)")}`);
+        return;
+    }
+    printGitKey(key);
+};
+const keysInit = async (config) => {
+    const key = await api(config, "POST", "/keys/git");
+    say(`${green("✓")} Mend key ready ${dim("(private half stays on the server host)")}`);
+    printGitKey(key);
+};
+/**
+ * The ssh-agent bridge, client half (docs/GIT-ACCESS.md decision 2): relay
+ * the LOCAL ssh-agent to the Mend server over one standing WebSocket, so
+ * bridge-mode git ops sign with a key that never leaves this machine — a
+ * hardware key blinks here, not on the server. Agent-protocol messages are
+ * relayed verbatim (length-prefixed frames, base64 over JSON); the only
+ * inspection is each message's type byte, to say what is being asked.
+ */
+const keysShare = async (config) => {
+    const agentSock = process.env["SSH_AUTH_SOCK"];
+    if (agentSock === undefined || agentSock === "") {
+        return fail("SSH_AUTH_SOCK is not set — start (or plug in) your ssh-agent first");
+    }
+    const url = new URL(`${config.url}/api/keys/bridge/ws`);
+    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+    url.searchParams.set("host", os.hostname());
+    if (config.token !== null)
+        url.searchParams.set("token", config.token);
+    /**
+     * One complete agent exchange against the local agent: fresh connection,
+     * write the framed request verbatim, read one framed response. A hardware
+     * key blocks here until the touch — hence the generous timeout.
+     */
+    const askLocalAgent = (payload) => new Promise((resolve, reject) => {
+        const connection = net.connect(agentSock, () => {
+            connection.write(payload);
+        });
+        const timer = setTimeout(() => {
+            connection.destroy();
+            reject(new Error("the agent did not answer within 60s — touch missed?"));
+        }, 60_000);
+        let pending = Buffer.alloc(0);
+        connection.on("data", (chunk) => {
+            pending = Buffer.concat([pending, chunk]);
+            if (pending.length >= 4 && pending.length >= 4 + pending.readUInt32BE(0)) {
+                clearTimeout(timer);
+                connection.end();
+                resolve(pending.subarray(0, 4 + pending.readUInt32BE(0)));
+            }
+        });
+        connection.on("error", (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+    // Strictly one request at a time, in arrival order — the agent protocol is
+    // request/response and a hardware key cannot answer two touches at once.
+    let chain = Promise.resolve();
+    const SSH_AGENTC_SIGN_REQUEST = 13;
+    const SSH_AGENTC_REQUEST_IDENTITIES = 11;
+    let attempt = 0;
+    for (;;) {
+        const ws = new WebSocket(url);
+        const closed = new Promise((resolve) => {
+            ws.addEventListener("close", () => resolve(), { once: true });
+        });
+        const opened = await new Promise((resolve) => {
+            ws.addEventListener("open", () => resolve(true), { once: true });
+            ws.addEventListener("error", () => resolve(false), { once: true });
+        });
+        if (opened) {
+            attempt = 0;
+            say(`${green("●")} sharing this machine's ssh-agent with ${config.url}`);
+            say(dim(`  agent: ${agentSock} · signature requests print here · Ctrl-C stops sharing`));
+            ws.addEventListener("message", (event) => {
+                const text = typeof event.data === "string"
+                    ? event.data
+                    : Buffer.from(event.data).toString("utf8");
+                let frame;
+                try {
+                    frame = JSON.parse(text);
+                }
+                catch {
+                    return;
+                }
+                if (frame.t !== "req" ||
+                    typeof frame.id !== "number" ||
+                    typeof frame.payload !== "string") {
+                    return;
+                }
+                const id = frame.id;
+                const payload = Buffer.from(frame.payload, "base64");
+                const type = payload[4];
+                const context = typeof frame.context === "string" ? frame.context : "mend";
+                chain = chain.then(async () => {
+                    const started = Date.now();
+                    if (type === SSH_AGENTC_SIGN_REQUEST) {
+                        say(`${amber("✎")} signature requested by mend ${dim(`(${context})`)}`);
+                        say(dim("  waiting — touch your key if it blinks (up to 60s)…"));
+                    }
+                    else if (type === SSH_AGENTC_REQUEST_IDENTITIES) {
+                        say(dim(`  identities requested (${context})`));
+                    }
+                    try {
+                        const response = await askLocalAgent(payload);
+                        if (ws.readyState !== WebSocket.OPEN)
+                            return null;
+                        ws.send(JSON.stringify({ t: "res", id, payload: response.toString("base64") }));
+                        if (type === SSH_AGENTC_SIGN_REQUEST) {
+                            say(`${green("✓")} signed ${dim(`(${((Date.now() - started) / 1000).toFixed(1)}s)`)}`);
+                        }
+                    }
+                    catch (error) {
+                        const message = error instanceof Error ? error.message : String(error);
+                        if (ws.readyState === WebSocket.OPEN) {
+                            ws.send(JSON.stringify({ t: "err", id, message }));
+                        }
+                        if (type === SSH_AGENTC_SIGN_REQUEST)
+                            say(`${amber("✗")} not signed — ${message}`);
+                    }
+                    return null;
+                });
+            });
+        }
+        await closed;
+        attempt += 1;
+        const delay = Math.min(30_000, 1000 * 2 ** Math.min(attempt - 1, 5));
+        say(dim(`not connected — retrying in ${Math.round(delay / 1000)}s (Ctrl-C stops)`));
+        await new Promise((resolve) => setTimeout(resolve, delay));
+    }
+};
+const keysCommand = async (config, args) => {
+    const [verb] = args;
+    switch (verb) {
+        case "init":
+            return keysInit(config);
+        case "share":
+            return keysShare(config);
+        case "show":
+        case undefined:
+            return keysShow(config);
+        default:
+            return fail(`unknown keys command "${verb}" — try: mend keys init | show | share`);
+    }
+};
+const formatDotfileBytes = (bytes) => bytes < 1024 ? `${bytes} B` : `${(bytes / 1024).toFixed(1)} KB`;
+const dotfilesShow = async (config) => {
+    const dotfiles = await api(config, "GET", "/dotfiles");
+    if (dotfiles.repository === null) {
+        say(`repo      ${dim("none")}`);
+    }
+    else {
+        const branch = dotfiles.repository.ref ?? "default branch";
+        const bootstrap = dotfiles.repository.bootstrap ? "install.sh on" : "install.sh off";
+        say(`repo      ${dotfiles.repository.url} ${dim(`(${branch} · ${bootstrap})`)}`);
+    }
+    if (dotfiles.snapshot === null) {
+        say(`snapshot  ${dim("none — sync from this machine: mend dotfiles sync --all")}`);
+        return;
+    }
+    const snapshot = dotfiles.snapshot;
+    say(`snapshot  ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} · from ${snapshot.source} · ${dim(snapshot.sha.slice(0, 7))}`);
+    for (const file of snapshot.files) {
+        say(`  ${file.path.padEnd(36)} ${dim(formatDotfileBytes(file.bytes))}`);
+    }
+};
+/**
+ * `mend dotfiles sync` — capture home files ON THIS MACHINE and stream them into the server's
+ * per-user dotfiles store. This is the whole point of the store: the server may be a VPS whose
+ * home directory belongs to a service account, so contents are read here, where they live.
+ */
+const dotfilesSync = async (config, args) => {
+    const all = args.includes("--all");
+    const requestedPaths = args.filter((arg) => !arg.startsWith("--"));
+    const home = os.homedir();
+    if (!all && requestedPaths.length === 0) {
+        const found = scanDotfileCandidates(home);
+        if (found.length === 0) {
+            say(dim("no known config files found under ~"));
+            return;
+        }
+        let group = "";
+        for (const entry of found) {
+            if (entry.group !== group) {
+                group = entry.group;
+                say(dim(group));
+            }
+            say(`  ${entry.path.padEnd(36)} ${dim(formatDotfileBytes(entry.bytes))}`);
+        }
+        say("");
+        say(`sync everything with ${cobalt("mend dotfiles sync --all")}, or pick: ${cobalt("mend dotfiles sync .zshrc .gitconfig")}`);
+        return;
+    }
+    const selected = all ? scanDotfileCandidates(home).map((entry) => entry.path) : requestedPaths;
+    if (selected.length === 0)
+        return fail("nothing to sync — no known config files found under ~");
+    const read = readSyncFiles(home, selected);
+    if ("error" in read)
+        return fail(read.error);
+    const result = await api(config, "POST", "/dotfiles/snapshot", {
+        files: read.files,
+        source: os.hostname(),
+        merge: false,
+    });
+    const snapshot = result.snapshot;
+    if (snapshot === null)
+        return fail("the server accepted the sync but reports no snapshot");
+    say(`${green("synced")} ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} from ${os.hostname()} · ${dim(snapshot.sha.slice(0, 7))} ${dim("— applies from the next session launch")}`);
+};
+const envLoad = async (config, args) => {
+    const explicitProject = takeFlagValue(args, "--project");
+    // `--secret` alone sends everything to Secrets; `--secret A,B` only those names (for the
+    // ordinary-looking ones that embed credentials, like DATABASE_URL). Routing is by NAME.
+    const secretFlag = args.indexOf("--secret");
+    const secretArg = secretFlag !== -1 ? args[secretFlag + 1] : undefined;
+    const secretNames = secretArg !== undefined &&
+        !secretArg.startsWith("--") &&
+        !secretArg.includes("/") &&
+        !secretArg.includes(".")
+        ? secretArg
+            .split(",")
+            .map((s) => s.trim())
+            .filter((s) => s !== "")
+        : [];
+    const allSecret = secretFlag !== -1 && secretNames.length === 0;
+    const consumed = new Set();
+    if (secretFlag !== -1 && secretNames.length > 0)
+        consumed.add(secretFlag + 1);
+    const positional = args.filter((arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project" && !consumed.has(i));
+    const file = path.resolve(positional[0] ?? ".env");
+    let contents;
+    try {
+        contents = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return fail(`cannot read ${file} — pass a path: mend env load path/to/.env`);
+    }
+    if (contents.trim() === "") {
+        say(dim(`${file} is empty`));
+        return;
+    }
+    const project = await findProject(config, explicitProject);
+    const report = await api(config, "POST", `/projects/${project.id}/environment/load`, { contents, allSecret, secretNames });
+    if (report.loaded.length === 0 &&
+        report.rejected.length === 0 &&
+        report.malformedLines.length === 0) {
+        say(dim(`${path.basename(file)} has no variables`));
+        return;
+    }
+    say(`${green("✓")} loaded ${path.basename(file)} into ${project.name}`);
+    for (const line of formatLoadReport(report, { dim, warn: amber }))
+        say(line);
+    const plaintextUrls = report.loaded.filter((entry) => entry.lane === "configuration" && /_(URL|URI|DSN)$/.test(entry.name));
+    if (plaintextUrls.length > 0) {
+        say(amber(`  ${plaintextUrls.map((entry) => entry.name).join(", ")} stored as plaintext configuration — if a value embeds a password, store it as a secret: mend env load --secret ${plaintextUrls.map((entry) => entry.name).join(",")}`));
+    }
+    if (report.malformedLines.length > 0) {
+        say(amber(`  skipped ${report.malformedLines.length} malformed line${report.malformedLines.length === 1 ? "" : "s"}: ${report.malformedLines.join(", ")}`));
+    }
+    say(dim(`  configuration r${report.environmentRevision} · secrets r${report.secretRevision} — applies from the next workspace launch, including resume; running workspaces keep what they started with`));
+};
+const envShow = async (config, args) => {
+    const project = await findProject(config, takeFlagValue(args, "--project"));
+    const [environment, secrets] = await Promise.all([
+        api(config, "GET", `/projects/${project.id}/environment`),
+        api(config, "GET", `/projects/${project.id}/secrets`),
+    ]);
+    say(`${project.name} ${dim(`· configuration r${environment.revision} · secrets r${secrets.revision}`)}`);
+    if (environment.variables.length === 0 && secrets.secrets.length === 0) {
+        say(dim(`  nothing stored — load a file: ${cobalt("mend env load")}`));
+        return;
+    }
+    const width = Math.max(...environment.variables.map((v) => v.name.length), ...secrets.secrets.map((s) => s.name.length));
+    for (const variable of environment.variables) {
+        say(`  ${variable.name.padEnd(width)}  configuration ${dim("· plaintext")}`);
+    }
+    for (const secret of secrets.secrets) {
+        say(`  ${secret.name.padEnd(width)}  secret ${dim("· value set, never shown")}`);
+    }
+};
+const envCommand = async (config, args) => {
+    const [verb, ...rest] = args;
+    switch (verb) {
+        case "load":
+            return envLoad(config, rest);
+        case "show":
+        case undefined:
+            return envShow(config, rest);
+        default:
+            return fail(`unknown env command "${verb}" — try: mend env load | show`);
+    }
+};
+const dotfilesCommand = async (config, args) => {
+    const [verb, ...rest] = args;
+    switch (verb) {
+        case "sync":
+            return dotfilesSync(config, rest);
+        case "show":
+        case undefined:
+            return dotfilesShow(config);
+        default:
+            return fail(`unknown dotfiles command "${verb}" — try: mend dotfiles sync | show`);
+    }
+};
+// ─── completions: live sessions under TAB ───────────────────────────────────
+/**
+ * The data half of shell completion: one live session per line as
+ * `id<TAB>description`. Scripts adapt the shape (zsh wants `id:desc`, bash
+ * wants bare ids). Never fails — a dead server just completes nothing.
+ */
+const completeCommand = async (config, args) => {
+    if (args[0] !== "session")
+        return;
+    try {
+        const [sessions, projects] = await Promise.all([
+            request(config, "GET", "/sessions"),
+            request(config, "GET", "/projects"),
+        ]);
+        const nameById = new Map(projects.map((p) => [p.id, p.name]));
+        for (const session of sessions) {
+            const project = nameById.get(session.projectId) ?? "";
+            process.stdout.write(`${session.id}\t${session.harness} · ${project} · ${session.branch}\n`);
+        }
+    }
+    catch {
+        // Completion must never surface an error into the user's TAB press.
+    }
+};
+const ZSH_COMPLETIONS = `#compdef mend
+_mend() {
+  local -a commands
+  commands=(
+    'adopt:adopt a repository into the store'
+    'codex:new session + codex' 'claude:new session + claude' 'opencode:new session + opencode'
+    'run:new session + arbitrary command'
+    'attach:reattach to a running session' 'shell:open a shell in a live session workspace'
+    'service:reachable ports — add, list, stop'
+    'keys:the machine Mend deploy key — init, show, share'
+    'continue:resume with the pending follow-up' 'resume:rejoin a settled session'
+    'rejoin:attach if live, otherwise resume'
+    'projects:adopted projects' 'sessions:sessions with review facts' 'status:active sessions'
+    'ui:the dashboard' 'help:help'
+  )
+  if (( CURRENT == 2 )); then
+    _describe 'command' commands
+    return
+  fi
+  case $words[2] in
+    shell|attach|continue|resume|rejoin)
+      local -a sessions
+      sessions=(\${(f)"$(command mend __complete session 2>/dev/null | tr '\\t' ':')"})
+      (( \${#sessions} )) && _describe 'session' sessions
+      ;;
+  esac
+}
+_mend "$@"
+`;
+const BASH_COMPLETIONS = `_mend() {
+  local cur=\${COMP_WORDS[COMP_CWORD]}
+  if [ "$COMP_CWORD" -eq 1 ]; then
+    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach shell service keys continue resume rejoin projects sessions status ui help" -- "$cur") )
+    return
+  fi
+  case \${COMP_WORDS[1]} in
+    shell|attach|continue|resume|rejoin)
+      COMPREPLY=( $(compgen -W "$(command mend __complete session 2>/dev/null | cut -f1)" -- "$cur") )
+      ;;
+  esac
+}
+complete -F _mend mend
+`;
+/** Print the hook for the named shell; the user wires it into their rc file. */
+const completionsCommand = (args) => {
+    switch (args[0]) {
+        case "zsh":
+            process.stdout.write(ZSH_COMPLETIONS);
+            return;
+        case "bash":
+            process.stdout.write(BASH_COMPLETIONS);
+            return;
+        default:
+            return fail('usage: mend completions zsh|bash — e.g. mend completions zsh > "$fpath[1]/_mend"');
+    }
+};
 // ─── supervised run: platform workspace + PTY + record ──────────────────────
 const supervisedRun = async (config, session, argv) => {
     const launched = await withSpinner("provisioning workspace — a first launch builds the harness image (can take minutes)…", api(config, "POST", `/sessions/${session.id}/launch`, { argv }));
@@ -731,10 +1652,36 @@ const dashboard = async (config) => {
 const HELP = `mend — the agent workbench
 
   mend                                  the dashboard: every project and session, live
-  mend adopt [source] [--name <name>]   adopt a repository into the store (default: cwd)
+  mend adopt [source] [--name <name>] [--auth ambient|mend-key|bridge]
+                                        adopt a repository into the store (default: cwd; any git
+                                        URL — GitHub, GitLab, self-hosted, ssh://, a local path)
+  mend login [--url <server>]           sign in with email + password; saves the token (0600)
+  mend logout                           forget the saved token
+  mend keys init                        generate the machine's Mend deploy key (ed25519)
+  mend keys show                        print the public key — add it as a deploy key on your git host
+  mend env load [file] [--secret [A,B]] load a .env into the project: ordinary names → configuration,
+                                        secret-shaped names → secrets; --secret sends all (or the
+                                        named ones, e.g. DATABASE_URL) to secrets
+  mend env show                         what the project store holds — names only, never values
+  mend dotfiles                         your dotfiles on the server: repo + synced home files
+  mend dotfiles sync [--all | paths…]   capture config files from THIS machine into your store
+  mend keys share                       relay THIS machine's ssh-agent to the server (bridge mode:
+                                        hardware keys sign here; Ctrl-C stops sharing)
   mend codex|claude|opencode            new session worktree + launch the harness in it
   mend run -- <command...>              same, with an arbitrary command
   mend attach <session-id-prefix>       reattach this terminal to a running session
+  mend shell [session-id-prefix]        open a shell in a live session's workspace
+  mend service run [session] --port <p> [--name <n>] [--udp] -- <command...>
+                                        start + supervise a server in the session workspace
+  mend service run [session] <name>     start a declared Service (mend.toml recipe)
+  mend service <name>                   shorthand for the above
+  mend service init [--yes]             scaffold mend.toml from package.json + compose ports
+  mend service add [session] <port> [--name <n>] [--udp]
+                                        adopt a listening workspace port — reachable on this machine
+  mend service list                     every live service and its observed state
+  mend service logs <name-or-id>        follow a supervised service's output (replay, then live)
+  mend service restart <name-or-id>     re-run its recorded command — same URL
+  mend service stop <name-or-id>        stop a service (closes its host port)
   mend continue [session-id]            resume a session with its pending review follow-up
   mend resume [session-id] [--with h]   rejoin a settled session (state restored; --with switches harness)
   mend rejoin [session-id] [--harness h] attach if live, otherwise resume; newest live wins
@@ -742,10 +1689,11 @@ const HELP = `mend — the agent workbench
   mend sessions [--all] [--project p] [--json]
                                         sessions with review facts; JSON is stable for integrations
   mend status                           active sessions (alias of mend sessions)
+  mend completions zsh|bash             print the TAB-completion hook (live session ids under TAB)
 
   server: MEND_URL (default http://localhost:3105) · auth: MEND_TOKEN
   detach key: Ctrl+] (set MEND_DETACH_KEY=none when an outer multiplexer owns detaching)
-  config file: ~/.mend/cli.json { "url": ..., "token": ... }
+  config file: ~/.config/mend/cli.json { "url": ..., "token": ... }
 `;
 const main = async () => {
     const [command, ...rest] = process.argv.slice(2);
@@ -760,6 +1708,24 @@ const main = async () => {
             return launch(config, command, rest);
         case "attach":
             return attach(config, rest);
+        case "shell":
+            return shellCommand(config, rest);
+        case "service":
+            return serviceCommand(config, rest);
+        case "login":
+            return login(config, rest);
+        case "logout":
+            return logout(config);
+        case "keys":
+            return keysCommand(config, rest);
+        case "dotfiles":
+            return dotfilesCommand(config, rest);
+        case "env":
+            return envCommand(config, rest);
+        case "completions":
+            return completionsCommand(rest);
+        case "__complete":
+            return completeCommand(config, rest);
         case "continue":
             return continueSession(config, rest);
         case "resume":