@vancityayush/xpssh 0.1.0

package/dist/index.js

@@ -0,0 +1,2929 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/version.ts
+import { createRequire as createRequire2 } from "node:module";
+var require2, VERSION;
+var init_version = __esm(() => {
+  require2 = createRequire2(import.meta.url);
+  VERSION = require2("../package.json").version;
+});
+
+// src/tui/store.tsx
+import { createContext, useContext, useReducer } from "react";
+import { jsxDEV } from "react/jsx-dev-runtime";
+function reducer(state, action) {
+  switch (action.type) {
+    case "navigate":
+      return { ...state, screen: action.screen };
+    case "set-profiles":
+      return { ...state, profiles: action.profiles };
+    case "append-event":
+      return { ...state, transcript: [...state.transcript, action.event].slice(-MAX_TRANSCRIPT) };
+    case "clear-transcript":
+      return { ...state, transcript: [] };
+    case "set-busy":
+      return { ...state, busy: action.busy };
+    case "set-focus":
+      return { ...state, focusZone: action.zone };
+    case "push-history":
+      return { ...state, history: [...state.history, action.line].slice(-100) };
+    case "set-prompt":
+      return { ...state, prompt: action.prompt };
+    case "set-setup-prefill":
+      return { ...state, setupPrefill: action.args };
+  }
+}
+function StoreProvider({ children }) {
+  const [state, dispatch] = useReducer(reducer, initialState);
+  return /* @__PURE__ */ jsxDEV(StoreContext.Provider, {
+    value: { state, dispatch },
+    children
+  }, undefined, false, undefined, this);
+}
+function useStore() {
+  const store = useContext(StoreContext);
+  if (!store)
+    throw new Error("useStore outside StoreProvider");
+  return store;
+}
+var MAX_TRANSCRIPT = 200, initialState, StoreContext;
+var init_store = __esm(() => {
+  initialState = {
+    screen: "dashboard",
+    profiles: [],
+    transcript: [],
+    busy: false,
+    focusZone: "screen",
+    history: [],
+    prompt: null,
+    setupPrefill: null
+  };
+  StoreContext = createContext(null);
+});
+
+// src/services/exec.ts
+import { spawn } from "node:child_process";
+var realExec = (cmd, args, opts = {}) => new Promise((resolve) => {
+  const child = spawn(cmd, args, { stdio: ["pipe", "pipe", "pipe"] });
+  let stdout = "";
+  let stderr = "";
+  let settled = false;
+  const settle = (result) => {
+    if (!settled) {
+      settled = true;
+      resolve(result);
+    }
+  };
+  const timer = opts.timeoutMs ? setTimeout(() => {
+    child.kill("SIGKILL");
+    settle({ code: null, stdout, stderr: stderr + `
+[xpssh] timed out after ${opts.timeoutMs}ms` });
+  }, opts.timeoutMs) : null;
+  child.stdout.on("data", (chunk) => stdout += chunk.toString());
+  child.stderr.on("data", (chunk) => stderr += chunk.toString());
+  child.on("error", (err) => {
+    if (timer)
+      clearTimeout(timer);
+    settle({ code: null, stdout, stderr: `${err.message}` });
+  });
+  child.on("close", (code) => {
+    if (timer)
+      clearTimeout(timer);
+    settle({ code, stdout, stderr });
+  });
+  if (opts.stdin !== undefined) {
+    child.stdin.write(opts.stdin);
+  }
+  child.stdin.end();
+});
+var init_exec = () => {};
+
+// src/platform/paths.ts
+import { homedir } from "node:os";
+import { join } from "node:path";
+function resolvePaths(env = process.env) {
+  const home = env["HOME"] ?? env["USERPROFILE"] ?? homedir();
+  const configDir = env["XPSSH_CONFIG_DIR"] ?? (env["XDG_CONFIG_HOME"] ? join(env["XDG_CONFIG_HOME"], "xpssh") : join(home, ".config", "xpssh"));
+  const sshDir = join(home, ".ssh");
+  return {
+    home,
+    sshDir,
+    sshConfig: join(sshDir, "config"),
+    configDir,
+    manifest: join(configDir, "profiles.json")
+  };
+}
+function expandTilde(path, home) {
+  if (path === "~")
+    return home;
+  if (path.startsWith("~/"))
+    return join(home, path.slice(2));
+  return path;
+}
+function contractTilde(path, home) {
+  if (path === home)
+    return "~";
+  if (path.startsWith(home + "/"))
+    return "~/" + path.slice(home.length + 1);
+  return path;
+}
+var init_paths = () => {};
+
+// src/platform/os.ts
+function resolveOs(platform = process.platform) {
+  switch (platform) {
+    case "darwin":
+      return {
+        platform: "darwin",
+        hasKeychain: true,
+        clipboardCommands: [["pbcopy"]],
+        openCommand: ["open"]
+      };
+    case "win32":
+      return {
+        platform: "win32",
+        hasKeychain: false,
+        clipboardCommands: [["clip.exe"]],
+        openCommand: ["cmd", "/c", "start", ""]
+      };
+    default:
+      return {
+        platform: "linux",
+        hasKeychain: false,
+        clipboardCommands: [["xclip", "-selection", "clipboard"], ["xsel", "--clipboard", "--input"], ["wl-copy"]],
+        openCommand: ["xdg-open"]
+      };
+  }
+}
+
+// src/cli/tokenize.ts
+function tokenize(line) {
+  const tokens = [];
+  let current = "";
+  let hasToken = false;
+  let quote = null;
+  let escaped = false;
+  for (const ch of line) {
+    if (escaped) {
+      current += ch;
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\" && quote !== "'") {
+      escaped = true;
+      hasToken = true;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) {
+        quote = null;
+      } else {
+        current += ch;
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      hasToken = true;
+      continue;
+    }
+    if (ch === " " || ch === "\t") {
+      if (hasToken) {
+        tokens.push(current);
+        current = "";
+        hasToken = false;
+      }
+      continue;
+    }
+    current += ch;
+    hasToken = true;
+  }
+  if (escaped)
+    current += "\\";
+  if (hasToken)
+    tokens.push(current);
+  return tokens;
+}
+
+// src/commands/types.ts
+function defineCommand(def) {
+  return def;
+}
+var UsageError;
+var init_types = __esm(() => {
+  UsageError = class UsageError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "UsageError";
+    }
+  };
+});
+
+// src/core/providers/index.ts
+function getProvider(idOrAlias) {
+  const needle = idOrAlias.toLowerCase();
+  return PROVIDERS.find((p) => p.id === needle || p.aliases.includes(needle));
+}
+var PROVIDERS;
+var init_providers = __esm(() => {
+  PROVIDERS = [
+    {
+      id: "github",
+      label: "GitHub",
+      aliases: ["gh", "github.com"],
+      host: "github.com",
+      sshUser: "git",
+      keyType: "ed25519",
+      settingsUrl: "https://github.com/settings/keys",
+      api: {
+        tokenEnvVar: "XPSSH_TOKEN_GITHUB",
+        tokenHint: "Create a PAT with the admin:public_key scope at https://github.com/settings/tokens",
+        buildUploadRequest: (token, title, publicKey) => ({
+          url: "https://api.github.com/user/keys",
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: "application/vnd.github+json",
+            "Content-Type": "application/json",
+            "User-Agent": "xpssh"
+          },
+          body: JSON.stringify({ title, key: publicKey })
+        })
+      }
+    },
+    {
+      id: "gitlab",
+      label: "GitLab",
+      aliases: ["gl", "gitlab.com"],
+      host: "gitlab.com",
+      sshUser: "git",
+      keyType: "ed25519",
+      settingsUrl: "https://gitlab.com/-/profile/keys",
+      api: {
+        tokenEnvVar: "XPSSH_TOKEN_GITLAB",
+        tokenHint: "Create a personal access token with the api scope at https://gitlab.com/-/user_settings/personal_access_tokens",
+        buildUploadRequest: (token, title, publicKey) => ({
+          url: "https://gitlab.com/api/v4/user/keys",
+          method: "POST",
+          headers: {
+            "PRIVATE-TOKEN": token,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({ title, key: publicKey })
+        })
+      }
+    },
+    {
+      id: "bitbucket",
+      label: "Bitbucket",
+      aliases: ["bb", "bitbucket.org"],
+      host: "bitbucket.org",
+      sshUser: "git",
+      keyType: "ed25519",
+      settingsUrl: "https://bitbucket.org/account/settings/ssh-keys/",
+      api: {
+        tokenEnvVar: "XPSSH_TOKEN_BITBUCKET",
+        tokenHint: "Create an API token with account:write at https://id.atlassian.com/manage-profile/security/api-tokens (used as Bearer)",
+        buildUploadRequest: (token, title, publicKey) => ({
+          url: "https://api.bitbucket.org/2.0/users/{uuid}/ssh-keys",
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({ label: title, key: publicKey })
+        })
+      }
+    },
+    {
+      id: "azure",
+      label: "Azure DevOps",
+      aliases: ["ado", "azuredevops", "dev.azure.com", "ssh.dev.azure.com"],
+      host: "ssh.dev.azure.com",
+      sshUser: "git",
+      keyType: "rsa",
+      settingsUrl: "https://dev.azure.com/_usersSettings/keys",
+      api: null
+    }
+  ];
+});
+
+// src/core/profile.ts
+function sanitizeName(raw) {
+  return raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-");
+}
+function deriveProfileId(providerId, name) {
+  return `${providerId}-${sanitizeName(name)}`;
+}
+function deriveAlias(host, name, isDefault) {
+  return isDefault ? host : `${host}-${sanitizeName(name)}`;
+}
+function deriveKeyPath(providerId, name) {
+  return `~/.ssh/xpssh_${providerId}_${sanitizeName(name).replace(/-/g, "_")}`;
+}
+function clonePrefix(profile, sshUser = "git") {
+  return `${sshUser}@${profile.alias}:`;
+}
+
+// src/core/manifest.ts
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join as join2 } from "node:path";
+import { z } from "zod";
+async function loadManifest(manifestPath) {
+  let raw;
+  try {
+    raw = await readFile(manifestPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: 1, profiles: [] };
+    }
+    throw err;
+  }
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    throw new ManifestError(`${manifestPath} is not valid JSON — fix or delete it`);
+  }
+  const parsed = manifestSchema.safeParse(json);
+  if (!parsed.success) {
+    throw new ManifestError(`${manifestPath} failed validation: ${parsed.error.issues[0]?.message}`);
+  }
+  return parsed.data;
+}
+async function saveManifest(manifestPath, manifest) {
+  manifestSchema.parse(manifest);
+  await mkdir(dirname(manifestPath), { recursive: true });
+  const tmp = join2(dirname(manifestPath), `.profiles.json.tmp-${process.pid}`);
+  await writeFile(tmp, JSON.stringify(manifest, null, 2) + `
+`, { mode: 384 });
+  await rename(tmp, manifestPath);
+}
+function findProfile(manifest, idOrAlias) {
+  return manifest.profiles.find((p) => p.id === idOrAlias || p.alias === idOrAlias);
+}
+function upsertProfile(manifest, profile) {
+  if (profile.isDefault) {
+    const clash = manifest.profiles.find((p) => p.provider === profile.provider && p.isDefault && p.id !== profile.id);
+    if (clash) {
+      throw new ManifestError(`${clash.id} is already the default for ${profile.provider} — remove it or set up without --default`);
+    }
+  }
+  const rest = manifest.profiles.filter((p) => p.id !== profile.id);
+  return { ...manifest, profiles: [...rest, profile] };
+}
+function removeProfile(manifest, id) {
+  return { ...manifest, profiles: manifest.profiles.filter((p) => p.id !== id) };
+}
+var profileSchema, manifestSchema, ManifestError;
+var init_manifest = __esm(() => {
+  profileSchema = z.object({
+    id: z.string().min(1),
+    provider: z.enum(["github", "gitlab", "bitbucket", "azure"]),
+    name: z.string().min(1),
+    email: z.string(),
+    alias: z.string().min(1),
+    keyPath: z.string().min(1),
+    keyType: z.enum(["ed25519", "rsa"]),
+    isDefault: z.boolean(),
+    createdAt: z.string(),
+    lastTest: z.object({ ok: z.boolean(), at: z.string(), message: z.string() }).optional(),
+    gitDirs: z.array(z.string()).default([]),
+    uploaded: z.object({ via: z.enum(["api", "manual"]), at: z.string() }).optional()
+  });
+  manifestSchema = z.object({
+    version: z.literal(1),
+    profiles: z.array(profileSchema)
+  });
+  ManifestError = class ManifestError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ManifestError";
+    }
+  };
+});
+
+// src/core/sshconfig.ts
+function splitKeepEnds(text) {
+  if (text === "")
+    return [];
+  const lines = text.split(/(?<=\n)/);
+  return lines;
+}
+function parseSegments(text) {
+  const segments = [];
+  let userBuf = "";
+  let managed = null;
+  for (const line of splitKeepEnds(text)) {
+    const stripped = line.replace(/\r?\n$/, "");
+    const begin = stripped.match(BEGIN_RE);
+    const end = stripped.match(END_RE);
+    if (begin) {
+      if (managed) {
+        throw new SshConfigParseError(`Nested xpssh fence: "${begin[1]}" begins inside unclosed "${managed.id}"`);
+      }
+      if (userBuf) {
+        segments.push({ kind: "user", text: userBuf });
+        userBuf = "";
+      }
+      managed = { id: begin[1], buf: line };
+    } else if (end) {
+      if (!managed) {
+        throw new SshConfigParseError(`Orphaned xpssh end fence for "${end[1]}"`);
+      }
+      if (end[1] !== managed.id) {
+        throw new SshConfigParseError(`Mismatched xpssh fences: begin "${managed.id}" closed by "${end[1]}"`);
+      }
+      segments.push({ kind: "managed", id: managed.id, text: managed.buf + line });
+      managed = null;
+    } else if (managed) {
+      managed.buf += line;
+    } else {
+      userBuf += line;
+    }
+  }
+  if (managed) {
+    throw new SshConfigParseError(`Unclosed xpssh fence for "${managed.id}"`);
+  }
+  if (userBuf) {
+    segments.push({ kind: "user", text: userBuf });
+  }
+  return segments;
+}
+function renderSegments(segments) {
+  return segments.map((s) => s.text).join("");
+}
+function buildHostBlock(spec) {
+  const lines = [
+    `# >>> xpssh:${spec.id} >>>`,
+    `Host ${spec.alias}`,
+    `    HostName ${spec.hostName}`,
+    `    User ${spec.user}`,
+    `    IdentityFile ${spec.identityFile}`,
+    `    IdentitiesOnly yes`,
+    `    AddKeysToAgent yes`,
+    ...spec.useKeychain ? ["    UseKeychain yes"] : [],
+    `# <<< xpssh:${spec.id} <<<`
+  ];
+  return lines.join(`
+`) + `
+`;
+}
+function upsertBlock(segments, spec) {
+  const block = buildHostBlock(spec);
+  const index = segments.findIndex((s) => s.kind === "managed" && s.id === spec.id);
+  if (index !== -1) {
+    const next2 = [...segments];
+    next2[index] = { kind: "managed", id: spec.id, text: block };
+    return { segments: next2, action: "replaced" };
+  }
+  const next = [...segments];
+  const last = next[next.length - 1];
+  if (last && !last.text.endsWith(`
+`)) {
+    next[next.length - 1] = { ...last, text: last.text + `
+` };
+  }
+  if (last) {
+    next.push({ kind: "user", text: `
+` });
+  }
+  next.push({ kind: "managed", id: spec.id, text: block });
+  return { segments: next, action: "added" };
+}
+function removeBlock(segments, id) {
+  const index = segments.findIndex((s) => s.kind === "managed" && s.id === id);
+  if (index === -1)
+    return { segments, removed: false };
+  const next = [...segments];
+  next.splice(index, 1);
+  const before = next[index - 1];
+  if (before && before.kind === "user" && /(^|\n)\n$/.test(before.text)) {
+    next[index - 1] = { ...before, text: before.text.replace(/\n$/, "") };
+    if (next[index - 1].text === "")
+      next.splice(index - 1, 1);
+  }
+  return { segments: next, removed: true };
+}
+function listManagedIds(segments) {
+  return segments.filter((s) => s.kind === "managed").map((s) => s.id);
+}
+function parseBlockFields(blockText) {
+  const fields = {};
+  for (const raw of blockText.split(`
+`)) {
+    const line = raw.trim();
+    if (line.startsWith("#") || line === "")
+      continue;
+    const match = line.match(/^(\S+)\s+(.+)$/);
+    if (match)
+      fields[match[1]] = match[2];
+  }
+  return fields;
+}
+var BEGIN_RE, END_RE, SshConfigParseError;
+var init_sshconfig = __esm(() => {
+  BEGIN_RE = /^# >>> xpssh:([A-Za-z0-9._-]+) >>>\s*$/;
+  END_RE = /^# <<< xpssh:([A-Za-z0-9._-]+) <<<\s*$/;
+  SshConfigParseError = class SshConfigParseError extends Error {
+    constructor(message) {
+      super(`${message} — fix ~/.ssh/config by hand or run \`xpssh doctor\``);
+      this.name = "SshConfigParseError";
+    }
+  };
+});
+
+// src/services/sshconfigFile.ts
+import { copyFile, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod } from "node:fs/promises";
+import { dirname as dirname2 } from "node:path";
+async function loadSshConfig(paths) {
+  let text;
+  try {
+    text = await readFile2(paths.sshConfig, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return [];
+    throw err;
+  }
+  return parseSegments(text);
+}
+async function saveSshConfig(paths, segments) {
+  await mkdir2(dirname2(paths.sshConfig), { recursive: true, mode: 448 });
+  try {
+    await copyFile(paths.sshConfig, `${paths.sshConfig}.xpssh.bak`);
+  } catch (err) {
+    if (err.code !== "ENOENT")
+      throw err;
+  }
+  await writeFile2(paths.sshConfig, renderSegments(segments), { mode: 384 });
+  await chmod(paths.sshConfig, 384);
+}
+var init_sshconfigFile = __esm(() => {
+  init_sshconfig();
+});
+
+// src/services/keygen.ts
+var exports_keygen = {};
+__export(exports_keygen, {
+  readPublicKey: () => readPublicKey,
+  generateKeyPair: () => generateKeyPair,
+  deleteKeyPair: () => deleteKeyPair
+});
+import { mkdir as mkdir3, readFile as readFile3, unlink } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
+async function generateKeyPair(exec, spec) {
+  await mkdir3(dirname3(spec.keyPath), { recursive: true, mode: 448 });
+  const args = [
+    "-t",
+    spec.keyType,
+    ...spec.keyType === "rsa" ? ["-b", "4096"] : [],
+    "-f",
+    spec.keyPath,
+    "-C",
+    spec.email,
+    "-N",
+    "",
+    "-q"
+  ];
+  const result = await exec("ssh-keygen", args);
+  if (result.code !== 0) {
+    throw new Error(`ssh-keygen failed: ${result.stderr.trim() || `exit ${result.code}`}`);
+  }
+}
+async function readPublicKey(keyPath) {
+  return (await readFile3(`${keyPath}.pub`, "utf8")).trim();
+}
+async function deleteKeyPair(keyPath) {
+  for (const file of [keyPath, `${keyPath}.pub`]) {
+    try {
+      await unlink(file);
+    } catch (err) {
+      if (err.code !== "ENOENT")
+        throw err;
+    }
+  }
+}
+var init_keygen = () => {};
+
+// src/services/clipboard.ts
+async function copyToClipboard(exec, os, text) {
+  for (const [cmd, ...args] of os.clipboardCommands) {
+    const result = await exec(cmd, args, { stdin: text });
+    if (result.code === 0)
+      return true;
+  }
+  return false;
+}
+
+// src/services/browser.ts
+async function openInBrowser(exec, os, url) {
+  const [cmd, ...args] = os.openCommand;
+  const result = await exec(cmd, [...args, url]);
+  return result.code === 0;
+}
+
+// src/core/sshOutput.ts
+function classifyTestOutput(code, stdout, stderr) {
+  const combined = `${stdout}
+${stderr}`.trim();
+  const firstLine = combined.split(`
+`).map((l) => l.trim()).find((l) => l.length > 0 && !l.startsWith("Warning:")) ?? "";
+  if (DENIED_RE.test(combined)) {
+    return { ok: false, message: "Permission denied — the key is not registered with the provider yet" };
+  }
+  if (SUCCESS_RE.test(combined)) {
+    return { ok: true, message: firstLine };
+  }
+  if (code === 0 || code === 1) {
+    return { ok: true, message: firstLine || "Authenticated" };
+  }
+  return { ok: false, message: firstLine || `ssh exited with code ${code}` };
+}
+function parseAgentList(stdout) {
+  const keys = [];
+  for (const line of stdout.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed || /has no identities/i.test(trimmed))
+      continue;
+    const match = trimmed.match(/^(\d+)\s+(\S+)\s+(.*?)\s+\((\S+)\)$/);
+    if (match) {
+      keys.push({
+        bits: Number(match[1]),
+        fingerprint: match[2],
+        comment: match[3],
+        type: match[4]
+      });
+    }
+  }
+  return keys;
+}
+var SUCCESS_RE, DENIED_RE;
+var init_sshOutput = __esm(() => {
+  SUCCESS_RE = /successfully authenticated|shell access is not supported|authenticated/i;
+  DENIED_RE = /permission denied/i;
+});
+
+// src/services/sshTest.ts
+async function testConnection(exec, alias, sshUser = "git") {
+  const result = await exec("ssh", ["-T", "-o", "StrictHostKeyChecking=accept-new", "-o", "BatchMode=yes", `${sshUser}@${alias}`], { timeoutMs: 20000 });
+  return classifyTestOutput(result.code, result.stdout, result.stderr);
+}
+var init_sshTest = __esm(() => {
+  init_sshOutput();
+});
+
+// src/services/agent.ts
+async function getAgentStatus(exec) {
+  const result = await exec("ssh-add", ["-l"]);
+  if (result.code === 2 || result.code === null)
+    return { running: false, keys: [] };
+  return { running: true, keys: parseAgentList(result.stdout) };
+}
+async function ensureAgentRunning(exec, env) {
+  const status = await getAgentStatus(exec);
+  if (status.running)
+    return true;
+  const result = await exec("ssh-agent", ["-s"]);
+  if (result.code !== 0)
+    return false;
+  for (const [, name, value] of result.stdout.matchAll(/(SSH_AUTH_SOCK|SSH_AGENT_PID)=([^;]+);/g)) {
+    env[name] = value;
+    process.env[name] = value;
+  }
+  return (await getAgentStatus(exec)).running;
+}
+async function addKeyToAgent(exec, os, absKeyPath) {
+  const args = os.hasKeychain ? ["--apple-use-keychain", absKeyPath] : [absKeyPath];
+  const result = await exec("ssh-add", args);
+  if (result.code !== 0) {
+    throw new Error(`ssh-add failed: ${result.stderr.trim() || `exit ${result.code}`}`);
+  }
+}
+async function removeKeyFromAgent(exec, absKeyPath) {
+  const result = await exec("ssh-add", ["-d", absKeyPath]);
+  return result.code === 0;
+}
+var init_agent = __esm(() => {
+  init_sshOutput();
+});
+
+// src/core/gitconfig.ts
+function buildProfileGitconfig(email, keyPath) {
+  return [
+    "[user]",
+    `    email = ${email}`,
+    "[core]",
+    `    sshCommand = ssh -i ${keyPath} -o IdentitiesOnly=yes`,
+    ""
+  ].join(`
+`);
+}
+function deriveGitconfigPath(keyPath) {
+  return `${keyPath}.gitconfig`;
+}
+function includeIfKey(dir) {
+  const normalized = dir.endsWith("/") ? dir : `${dir}/`;
+  return `includeIf.gitdir:${normalized}.path`;
+}
+
+// src/services/gitconfig.ts
+import { unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
+async function linkGitIdentity(exec, home, profile, dir) {
+  const gitconfigPath = deriveGitconfigPath(profile.keyPath);
+  await writeFile3(expandTilde(gitconfigPath, home), buildProfileGitconfig(profile.email, profile.keyPath));
+  const result = await exec("git", ["config", "--global", includeIfKey(dir), gitconfigPath]);
+  if (result.code !== 0) {
+    throw new Error(`git config failed: ${result.stderr.trim() || `exit ${result.code}`}`);
+  }
+}
+var init_gitconfig = __esm(() => {
+  init_paths();
+});
+
+// src/services/api.ts
+async function uploadKey(provider, token, title, publicKey, fetchFn = fetch) {
+  if (!provider.api) {
+    return { ok: false, message: `${provider.label} has no key-upload API — add it manually at ${provider.settingsUrl}` };
+  }
+  const request = provider.api.buildUploadRequest(token, title, publicKey);
+  let url = request.url;
+  if (url.includes("{uuid}")) {
+    const who = await fetchFn("https://api.bitbucket.org/2.0/user", {
+      headers: { Authorization: request.headers["Authorization"] }
+    });
+    if (!who.ok) {
+      return { ok: false, message: `Token rejected while looking up your Bitbucket account (HTTP ${who.status})` };
+    }
+    const { uuid } = await who.json();
+    url = url.replace("{uuid}", encodeURIComponent(uuid));
+  }
+  const response = await fetchFn(url, { method: request.method, headers: request.headers, body: request.body });
+  if (response.ok) {
+    return { ok: true, message: `Public key uploaded to ${provider.label}` };
+  }
+  let detail = "";
+  try {
+    const body = await response.json();
+    detail = body.message ?? body.error?.message ?? "";
+  } catch {}
+  if (response.status === 401 || response.status === 403) {
+    return { ok: false, message: `Token rejected by ${provider.label} (HTTP ${response.status}) — ${provider.api.tokenHint}` };
+  }
+  if (response.status === 422 || /already in use|has already been taken/i.test(detail)) {
+    return { ok: true, message: `${provider.label} reports this key is already registered` };
+  }
+  return { ok: false, message: `${provider.label} upload failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}` };
+}
+
+// src/commands/setup.ts
+import { access } from "node:fs/promises";
+import { hostname } from "node:os";
+async function resolveSetupPlan(args, ctx) {
+  let provider = args.provider ? getProvider(args.provider) : undefined;
+  if (args.provider && !provider) {
+    throw new UsageError(`Unknown provider "${args.provider}" — expected one of: ${PROVIDERS.map((p) => p.id).join(", ")}`);
+  }
+  if (!provider) {
+    if (ctx.yes)
+      throw new UsageError("Missing <provider> (required with -y)");
+    provider = await ctx.promptSelect("Which git provider?", PROVIDERS.map((p) => ({ label: p.label, value: p })));
+  }
+  const manifest = await loadManifest(ctx.paths.manifest);
+  const existingForProvider = manifest.profiles.filter((p) => p.provider === provider.id);
+  let name = args.name;
+  if (!name) {
+    if (ctx.yes) {
+      name = "personal";
+    } else {
+      name = await ctx.promptText("Profile name for this account (e.g. personal, work)", {
+        defaultValue: existingForProvider.length === 0 ? "personal" : ""
+      });
+    }
+  }
+  name = sanitizeName(name);
+  if (!name)
+    throw new UsageError("Profile name must contain at least one letter or digit");
+  let email = args.email;
+  if (!email) {
+    if (ctx.yes)
+      throw new UsageError("Missing --email (required with -y)");
+    email = await ctx.promptText(`Email for the ${provider.label} key comment`);
+  }
+  if (!email.includes("@"))
+    throw new UsageError(`"${email}" does not look like an email address`);
+  const hasDefault = existingForProvider.some((p) => p.isDefault);
+  const isDefault = args.default ?? !hasDefault;
+  const keyType = args.keyType ?? provider.keyType;
+  const profileId = deriveProfileId(provider.id, name);
+  const token = args.token ?? (provider.api ? ctx.env[provider.api.tokenEnvVar] : undefined);
+  return {
+    provider,
+    name,
+    email,
+    keyType,
+    isDefault,
+    profileId,
+    alias: deriveAlias(provider.host, name, isDefault),
+    keyPath: deriveKeyPath(provider.id, name),
+    noBrowser: args.noBrowser,
+    noClipboard: args.noClipboard,
+    noAgent: args.noAgent,
+    force: args.force,
+    token,
+    dir: args.dir
+  };
+}
+async function fileExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function executeSetupPipeline(plan, ctx) {
+  for (const step of setupSteps) {
+    ctx.emit({ type: "step", id: step.id, label: step.label, status: "start" });
+    try {
+      await step.run(plan, ctx);
+      ctx.emit({ type: "step", id: step.id, label: step.label, status: "done" });
+    } catch (err) {
+      ctx.emit({ type: "step", id: step.id, label: step.label, status: "fail" });
+      throw err;
+    }
+  }
+}
+var setupSteps, setupCommand;
+var init_setup = __esm(() => {
+  init_types();
+  init_providers();
+  init_manifest();
+  init_sshconfig();
+  init_sshconfigFile();
+  init_keygen();
+  init_sshTest();
+  init_agent();
+  init_gitconfig();
+  init_paths();
+  setupSteps = [
+    {
+      id: "generate-key",
+      label: "Generate SSH key",
+      async run(plan, ctx) {
+        const absKeyPath = expandTilde(plan.keyPath, ctx.paths.home);
+        if (await fileExists(absKeyPath)) {
+          if (!plan.force) {
+            const overwrite = await ctx.confirm(`${plan.keyPath} already exists — overwrite it?`);
+            if (!overwrite)
+              throw new Error(`Key ${plan.keyPath} already exists (use --force to overwrite)`);
+          }
+          const { deleteKeyPair: deleteKeyPair2 } = await Promise.resolve().then(() => (init_keygen(), exports_keygen));
+          await deleteKeyPair2(absKeyPath);
+        }
+        await generateKeyPair(ctx.exec, { keyType: plan.keyType, keyPath: absKeyPath, email: plan.email });
+        ctx.emit({ type: "info", text: `${plan.keyType} key written to ${plan.keyPath}` });
+      }
+    },
+    {
+      id: "write-ssh-config",
+      label: "Add host entry to ~/.ssh/config",
+      async run(plan, ctx) {
+        const segments = await loadSshConfig(ctx.paths);
+        const { segments: next, action } = upsertBlock(segments, {
+          id: plan.profileId,
+          alias: plan.alias,
+          hostName: plan.provider.host,
+          user: plan.provider.sshUser,
+          identityFile: plan.keyPath,
+          useKeychain: ctx.os.hasKeychain
+        });
+        await saveSshConfig(ctx.paths, next);
+        ctx.emit({ type: "info", text: `Host ${plan.alias} ${action} in ~/.ssh/config` });
+      }
+    },
+    {
+      id: "add-to-agent",
+      label: "Load key into ssh-agent",
+      async run(plan, ctx) {
+        if (plan.noAgent) {
+          ctx.emit({ type: "info", text: "Skipped (--no-agent)" });
+          return;
+        }
+        const running = await ensureAgentRunning(ctx.exec, ctx.env);
+        if (!running) {
+          ctx.emit({ type: "warn", text: "ssh-agent unavailable — key will load on first use via AddKeysToAgent" });
+          return;
+        }
+        try {
+          await addKeyToAgent(ctx.exec, ctx.os, expandTilde(plan.keyPath, ctx.paths.home));
+          ctx.emit({ type: "info", text: ctx.os.hasKeychain ? "Key in agent (persisted to Keychain)" : "Key in agent" });
+        } catch (err) {
+          ctx.emit({ type: "warn", text: err.message });
+        }
+      }
+    },
+    {
+      id: "save-profile",
+      label: "Record profile",
+      async run(plan, ctx) {
+        const manifest = await loadManifest(ctx.paths.manifest);
+        const profile = {
+          id: plan.profileId,
+          provider: plan.provider.id,
+          name: plan.name,
+          email: plan.email,
+          alias: plan.alias,
+          keyPath: plan.keyPath,
+          keyType: plan.keyType,
+          isDefault: plan.isDefault,
+          createdAt: new Date().toISOString(),
+          gitDirs: plan.dir ? [plan.dir] : []
+        };
+        await saveManifest(ctx.paths.manifest, upsertProfile(manifest, profile));
+      }
+    },
+    {
+      id: "link-gitconfig",
+      label: "Bind directory to this git identity",
+      async run(plan, ctx) {
+        if (!plan.dir)
+          return;
+        await linkGitIdentity(ctx.exec, ctx.paths.home, { email: plan.email, keyPath: plan.keyPath }, plan.dir);
+        ctx.emit({ type: "info", text: `Repos under ${plan.dir} now commit as ${plan.email} using this key` });
+      }
+    },
+    {
+      id: "deliver-pubkey",
+      label: "Deliver public key to provider",
+      async run(plan, ctx) {
+        const absKeyPath = expandTilde(plan.keyPath, ctx.paths.home);
+        const publicKey = await readPublicKey(absKeyPath);
+        if (plan.token && plan.provider.api) {
+          const title = `xpssh:${plan.profileId}@${hostname()}`;
+          const outcome = await uploadKey(plan.provider, plan.token, title, publicKey, ctx.fetch);
+          ctx.emit({ type: outcome.ok ? "success" : "warn", text: outcome.message });
+          if (outcome.ok) {
+            const manifest = await loadManifest(ctx.paths.manifest);
+            const profile = manifest.profiles.find((p) => p.id === plan.profileId);
+            if (profile) {
+              profile.uploaded = { via: "api", at: new Date().toISOString() };
+              await saveManifest(ctx.paths.manifest, manifest);
+            }
+            return;
+          }
+        }
+        if (!plan.noClipboard) {
+          const copied = await copyToClipboard(ctx.exec, ctx.os, publicKey);
+          ctx.emit(copied ? { type: "success", text: "Public key copied to clipboard" } : { type: "warn", text: `Clipboard unavailable — copy it yourself: cat ${plan.keyPath}.pub` });
+        }
+        if (!plan.noBrowser) {
+          const opened = await openInBrowser(ctx.exec, ctx.os, plan.provider.settingsUrl);
+          ctx.emit(opened ? { type: "info", text: `Opened ${plan.provider.settingsUrl} — paste the key there` } : { type: "warn", text: `Add the key manually at ${plan.provider.settingsUrl}` });
+        } else {
+          ctx.emit({ type: "info", text: `Add the key at ${plan.provider.settingsUrl}` });
+        }
+      }
+    },
+    {
+      id: "test-connection",
+      label: "Test SSH connection",
+      async run(plan, ctx) {
+        const ready = await ctx.confirm(`Key added on ${plan.provider.label}? Test the connection now?`);
+        if (!ready) {
+          ctx.emit({ type: "info", text: `Skipped — run \`xpssh test ${plan.profileId}\` when ready` });
+          return;
+        }
+        const result = await testConnection(ctx.exec, plan.alias, plan.provider.sshUser);
+        const manifest = await loadManifest(ctx.paths.manifest);
+        const profile = manifest.profiles.find((p) => p.id === plan.profileId);
+        if (profile) {
+          profile.lastTest = { ok: result.ok, at: new Date().toISOString(), message: result.message };
+          await saveManifest(ctx.paths.manifest, manifest);
+        }
+        ctx.emit(result.ok ? { type: "success", text: result.message } : { type: "warn", text: `${result.message} — run \`xpssh test ${plan.profileId}\` after adding the key` });
+      }
+    }
+  ];
+  setupCommand = defineCommand({
+    name: "setup",
+    summary: "Generate a key and wire up SSH for a git provider",
+    usage: "xpssh setup <provider> [-n <name>] [-e <email>] [-t ed25519|rsa] [--default] [--token <tok>] [--dir <path>] [--force] [--no-browser] [--no-clipboard] [--no-agent] [-y]",
+    flags: [
+      { name: "name", short: "n", type: "string", description: "profile name (work, personal, ...)", valueHint: "<name>" },
+      { name: "email", short: "e", type: "string", description: "email for the key comment", valueHint: "<email>" },
+      { name: "type", short: "t", type: "string", description: "key algorithm (default: provider preference)", valueHint: "ed25519|rsa" },
+      { name: "default", type: "boolean", description: "make this the bare-host default profile" },
+      { name: "token", type: "string", description: "API token — upload the key directly, skip browser", valueHint: "<token>" },
+      { name: "dir", type: "string", description: "bind a directory to this identity (git includeIf)", valueHint: "<path>" },
+      { name: "force", type: "boolean", description: "overwrite an existing key file" },
+      { name: "no-browser", type: "boolean", description: "don't open the provider settings page" },
+      { name: "no-clipboard", type: "boolean", description: "don't copy the public key" },
+      { name: "no-agent", type: "boolean", description: "don't load the key into ssh-agent" },
+      { name: "yes", short: "y", type: "boolean", description: "never prompt (missing inputs become errors)" }
+    ],
+    parse(positionals, values) {
+      if (values["type"] && values["type"] !== "ed25519" && values["type"] !== "rsa") {
+        throw new UsageError(`--type must be ed25519 or rsa, got "${values["type"]}"`);
+      }
+      return {
+        provider: positionals[0],
+        name: values["name"],
+        email: values["email"],
+        keyType: values["type"],
+        default: values["default"] === true ? true : undefined,
+        token: values["token"],
+        dir: values["dir"],
+        force: values["force"] === true,
+        noBrowser: values["no-browser"] === true,
+        noClipboard: values["no-clipboard"] === true,
+        noAgent: values["no-agent"] === true
+      };
+    },
+    async run(args, ctx) {
+      const plan = await resolveSetupPlan(args, ctx);
+      await executeSetupPipeline(plan, ctx);
+      return {
+        ok: true,
+        message: `Profile ${plan.profileId} ready — clone with ${clonePrefix(plan, plan.provider.sshUser)}<owner>/<repo>.git`
+      };
+    }
+  });
+});
+
+// src/commands/list.ts
+import { access as access2 } from "node:fs/promises";
+async function gatherProfileRows(paths) {
+  const manifest = await loadManifest(paths.manifest);
+  return Promise.all(manifest.profiles.map(async (p) => {
+    let keyExists = false;
+    try {
+      await access2(expandTilde(p.keyPath, paths.home));
+      keyExists = true;
+    } catch {}
+    return { ...p, keyExists, clonePrefix: clonePrefix(p) };
+  }));
+}
+var listCommand;
+var init_list = __esm(() => {
+  init_types();
+  init_manifest();
+  init_paths();
+  listCommand = defineCommand({
+    name: "list",
+    aliases: ["ls"],
+    summary: "Show all managed profiles and their status",
+    usage: "xpssh list [--json]",
+    flags: [{ name: "json", type: "boolean", description: "machine-readable output" }],
+    parse(_positionals, values) {
+      return { json: values["json"] === true };
+    },
+    async run(args, ctx) {
+      const rows = await gatherProfileRows(ctx.paths);
+      if (rows.length === 0) {
+        if (args.json) {
+          ctx.emit({ type: "info", text: JSON.stringify({ profiles: [] }) });
+          return { ok: true };
+        }
+        return { ok: true, message: "No profiles yet — run `xpssh setup <provider>` to create one" };
+      }
+      if (args.json) {
+        ctx.emit({ type: "info", text: JSON.stringify({ profiles: rows }, null, 2) });
+        return { ok: true };
+      }
+      for (const row of rows) {
+        const status = !row.keyExists ? "key missing" : row.lastTest ? row.lastTest.ok ? "tested ok" : "test failed" : "untested";
+        const type = status === "tested ok" ? "success" : status === "untested" ? "info" : "warn";
+        ctx.emit({
+          type,
+          text: `${row.id}  ${row.keyType}  ${row.email}  [${status}]${row.isDefault ? " (default)" : ""}  clone: ${row.clonePrefix}owner/repo.git`
+        });
+      }
+      return { ok: true };
+    }
+  });
+});
+
+// src/commands/test.ts
+var testCommand;
+var init_test = __esm(() => {
+  init_types();
+  init_manifest();
+  init_sshTest();
+  testCommand = defineCommand({
+    name: "test",
+    summary: "Test SSH authentication for a profile",
+    usage: "xpssh test [<profile>] [--all]",
+    flags: [{ name: "all", type: "boolean", description: "test every profile" }],
+    parse(positionals, values) {
+      return { profile: positionals[0], all: values["all"] === true };
+    },
+    async run(args, ctx) {
+      const manifest = await loadManifest(ctx.paths.manifest);
+      if (manifest.profiles.length === 0) {
+        return { ok: false, message: "No profiles to test — run `xpssh setup <provider>` first" };
+      }
+      let targets = manifest.profiles;
+      if (!args.all) {
+        if (!args.profile) {
+          if (manifest.profiles.length === 1) {
+            targets = manifest.profiles;
+          } else if (ctx.yes) {
+            throw new UsageError("Multiple profiles exist — pass <profile> or --all");
+          } else {
+            const chosen = await ctx.promptSelect("Which profile?", manifest.profiles.map((p) => ({ label: `${p.id} (${p.email})`, value: p })));
+            targets = [chosen];
+          }
+        } else {
+          const profile = findProfile(manifest, args.profile);
+          if (!profile) {
+            throw new UsageError(`No profile "${args.profile}" — run \`xpssh list\` to see what exists`);
+          }
+          targets = [profile];
+        }
+      }
+      let allOk = true;
+      for (const profile of targets) {
+        ctx.emit({ type: "step", id: profile.id, label: `ssh -T git@${profile.alias}`, status: "start" });
+        const result = await testConnection(ctx.exec, profile.alias);
+        profile.lastTest = { ok: result.ok, at: new Date().toISOString(), message: result.message };
+        ctx.emit({ type: "step", id: profile.id, label: `ssh -T git@${profile.alias}`, status: result.ok ? "done" : "fail" });
+        ctx.emit({ type: result.ok ? "success" : "error", text: `${profile.id}: ${result.message}` });
+        if (!result.ok)
+          allOk = false;
+      }
+      await saveManifest(ctx.paths.manifest, manifest);
+      return allOk ? { ok: true, message: targets.length > 1 ? "All connections authenticated" : undefined } : { ok: false, message: "Some connections failed — make sure the public key is added to the provider" };
+    }
+  });
+});
+
+// src/commands/copy.ts
+var copyCommand;
+var init_copy = __esm(() => {
+  init_types();
+  init_manifest();
+  init_providers();
+  init_keygen();
+  init_paths();
+  copyCommand = defineCommand({
+    name: "copy",
+    summary: "Copy a profile's public key to the clipboard",
+    usage: "xpssh copy <profile> [--open]",
+    flags: [{ name: "open", type: "boolean", description: "also open the provider's SSH settings page" }],
+    parse(positionals, values) {
+      return { profile: positionals[0], open: values["open"] === true };
+    },
+    async run(args, ctx) {
+      if (!args.profile)
+        throw new UsageError("Missing <profile> — run `xpssh list` to see what exists");
+      const manifest = await loadManifest(ctx.paths.manifest);
+      const profile = findProfile(manifest, args.profile);
+      if (!profile)
+        throw new UsageError(`No profile "${args.profile}" — run \`xpssh list\` to see what exists`);
+      const publicKey = await readPublicKey(expandTilde(profile.keyPath, ctx.paths.home));
+      const copied = await copyToClipboard(ctx.exec, ctx.os, publicKey);
+      if (!copied) {
+        ctx.emit({ type: "info", text: publicKey });
+        return { ok: false, message: "Clipboard unavailable — public key printed above" };
+      }
+      if (args.open) {
+        const provider = getProvider(profile.provider);
+        await openInBrowser(ctx.exec, ctx.os, provider.settingsUrl);
+        ctx.emit({ type: "info", text: `Opened ${provider.settingsUrl}` });
+      }
+      return { ok: true, message: `Public key for ${profile.id} copied to clipboard` };
+    }
+  });
+});
+
+// src/commands/remove.ts
+var removeCommand;
+var init_remove = __esm(() => {
+  init_types();
+  init_manifest();
+  init_sshconfig();
+  init_sshconfigFile();
+  init_keygen();
+  init_paths();
+  removeCommand = defineCommand({
+    name: "remove",
+    aliases: ["rm"],
+    summary: "Remove a profile: ssh config block, key files, manifest entry",
+    usage: "xpssh remove <profile> [--keep-key] [-y]",
+    flags: [
+      { name: "keep-key", type: "boolean", description: "keep the key files on disk" },
+      { name: "yes", short: "y", type: "boolean", description: "skip confirmation" }
+    ],
+    parse(positionals, values) {
+      return { profile: positionals[0], keepKey: values["keep-key"] === true };
+    },
+    async run(args, ctx) {
+      if (!args.profile)
+        throw new UsageError("Missing <profile> — run `xpssh list` to see what exists");
+      const manifest = await loadManifest(ctx.paths.manifest);
+      const profile = findProfile(manifest, args.profile);
+      if (!profile)
+        throw new UsageError(`No profile "${args.profile}" — run \`xpssh list\` to see what exists`);
+      const what = args.keepKey ? "ssh config entry" : `ssh config entry and key files (${profile.keyPath})`;
+      const confirmed = await ctx.confirm(`Remove ${profile.id} — ${what}?`);
+      if (!confirmed)
+        return { ok: false, message: "Aborted" };
+      const segments = await loadSshConfig(ctx.paths);
+      const { segments: next, removed } = removeBlock(segments, profile.id);
+      if (removed) {
+        await saveSshConfig(ctx.paths, next);
+        ctx.emit({ type: "info", text: `Removed Host ${profile.alias} from ~/.ssh/config` });
+      } else {
+        ctx.emit({ type: "warn", text: "No managed ssh config block found (already removed?)" });
+      }
+      if (!args.keepKey) {
+        await deleteKeyPair(expandTilde(profile.keyPath, ctx.paths.home));
+        ctx.emit({ type: "info", text: `Deleted ${profile.keyPath}(.pub)` });
+      }
+      await saveManifest(ctx.paths.manifest, removeProfile(manifest, profile.id));
+      return { ok: true, message: `Profile ${profile.id} removed` };
+    }
+  });
+});
+
+// src/commands/agent.ts
+function isAgentSubcommand(value) {
+  return AGENT_SUBCOMMANDS.includes(value);
+}
+async function requireProfile(ctx, idOrAlias, subcommand) {
+  if (!idOrAlias)
+    throw new UsageError(`Missing <profile> — usage: xpssh agent ${subcommand} <profile>`);
+  const manifest = await loadManifest(ctx.paths.manifest);
+  const profile = findProfile(manifest, idOrAlias);
+  if (!profile)
+    throw new UsageError(`No profile "${idOrAlias}" — run \`xpssh list\` to see what exists`);
+  return profile;
+}
+var AGENT_SUBCOMMANDS, agentCommand;
+var init_agent2 = __esm(() => {
+  init_types();
+  init_manifest();
+  init_agent();
+  init_paths();
+  AGENT_SUBCOMMANDS = ["list", "add", "remove", "start"];
+  agentCommand = defineCommand({
+    name: "agent",
+    summary: "Inspect and manage keys in ssh-agent",
+    usage: "xpssh agent [list|add <profile>|remove <profile>|start]",
+    flags: [],
+    parse(positionals) {
+      const subcommand = positionals[0] ?? "list";
+      if (!isAgentSubcommand(subcommand)) {
+        throw new UsageError(`Unknown agent subcommand "${subcommand}" — expected one of: ${AGENT_SUBCOMMANDS.join(", ")}`);
+      }
+      return { subcommand, profile: positionals[1] };
+    },
+    async run(args, ctx) {
+      switch (args.subcommand) {
+        case "list": {
+          const status = await getAgentStatus(ctx.exec);
+          if (!status.running) {
+            return { ok: true, message: "ssh-agent is not running — start it with `xpssh agent start`" };
+          }
+          if (status.keys.length === 0) {
+            return { ok: true, message: "Agent running, no keys loaded" };
+          }
+          const manifest = await loadManifest(ctx.paths.manifest);
+          for (const key of status.keys) {
+            const owner = manifest.profiles.find((p) => p.email === key.comment);
+            const line = `${key.bits} ${key.type} ${key.fingerprint} ${key.comment}`;
+            ctx.emit({ type: "info", text: owner ? `${line} ← ${owner.id}` : line });
+          }
+          return { ok: true };
+        }
+        case "add": {
+          const profile = await requireProfile(ctx, args.profile, "add");
+          const running = await ensureAgentRunning(ctx.exec, ctx.env);
+          if (!running)
+            return { ok: false, message: "Could not start ssh-agent" };
+          await addKeyToAgent(ctx.exec, ctx.os, expandTilde(profile.keyPath, ctx.paths.home));
+          return {
+            ok: true,
+            message: ctx.os.hasKeychain ? `Key for ${profile.id} added to ssh-agent (persisted to Keychain)` : `Key for ${profile.id} added to ssh-agent`
+          };
+        }
+        case "remove": {
+          const profile = await requireProfile(ctx, args.profile, "remove");
+          const removed = await removeKeyFromAgent(ctx.exec, expandTilde(profile.keyPath, ctx.paths.home));
+          if (!removed) {
+            return {
+              ok: false,
+              message: `Could not remove ${profile.id} from ssh-agent — the key is probably not loaded`
+            };
+          }
+          return { ok: true, message: `Key for ${profile.id} removed from ssh-agent` };
+        }
+        case "start": {
+          const running = await ensureAgentRunning(ctx.exec, ctx.env);
+          return running ? { ok: true, message: "ssh-agent is running" } : { ok: false, message: "Failed to start ssh-agent" };
+        }
+      }
+    }
+  });
+});
+
+// src/commands/upload.ts
+import { hostname as hostname2 } from "node:os";
+var uploadCommand;
+var init_upload = __esm(() => {
+  init_types();
+  init_manifest();
+  init_providers();
+  init_keygen();
+  init_paths();
+  uploadCommand = defineCommand({
+    name: "upload",
+    summary: "Upload a profile's public key via the provider API",
+    usage: "xpssh upload <profile> [--token <token>]",
+    flags: [{ name: "token", type: "string", description: "provider API token", valueHint: "<token>" }],
+    parse(positionals, values) {
+      return { profile: positionals[0], token: values["token"] };
+    },
+    async run(args, ctx) {
+      if (!args.profile)
+        throw new UsageError("Missing <profile> — run `xpssh list` to see what exists");
+      const manifest = await loadManifest(ctx.paths.manifest);
+      const profile = findProfile(manifest, args.profile);
+      if (!profile)
+        throw new UsageError(`No profile "${args.profile}" — run \`xpssh list\` to see what exists`);
+      const provider = getProvider(profile.provider);
+      if (!provider.api) {
+        return {
+          ok: false,
+          message: `${provider.label} has no key-upload API — add the key manually at ${provider.settingsUrl}`
+        };
+      }
+      let token = args.token ?? ctx.env[provider.api.tokenEnvVar];
+      if (!token && !ctx.yes) {
+        token = await ctx.promptSecret(`${provider.label} API token (${provider.api.tokenHint})`);
+      }
+      if (!token) {
+        throw new UsageError(`No API token — pass --token <token> or set ${provider.api.tokenEnvVar}`);
+      }
+      const publicKey = await readPublicKey(expandTilde(profile.keyPath, ctx.paths.home));
+      const title = `xpssh:${profile.id}@${hostname2()}`;
+      const outcome = await uploadKey(provider, token, title, publicKey, ctx.fetch);
+      if (!outcome.ok) {
+        return { ok: false, message: outcome.message };
+      }
+      profile.uploaded = { via: "api", at: new Date().toISOString() };
+      await saveManifest(ctx.paths.manifest, manifest);
+      return { ok: true, message: outcome.message };
+    }
+  });
+});
+
+// src/commands/doctor.ts
+import { access as access3, chmod as chmod2, stat } from "node:fs/promises";
+async function fileExists2(path) {
+  try {
+    await access3(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function looseMode(path) {
+  try {
+    const { mode } = await stat(path);
+    return (mode & 63) !== 0 ? mode & 511 : null;
+  } catch {
+    return null;
+  }
+}
+function shadowedByEarlierHost(segments, blockIndex, alias) {
+  return segments.slice(0, blockIndex).some((segment) => segment.kind === "user" && [...segment.text.matchAll(HOST_LINE_RE)].some((match) => match[1].trim().split(/\s+/).some((pattern) => pattern === alias || pattern === "*")));
+}
+var HOST_LINE_RE, doctorCommand;
+var init_doctor = __esm(() => {
+  init_types();
+  init_manifest();
+  init_sshconfig();
+  init_sshconfigFile();
+  init_providers();
+  init_paths();
+  HOST_LINE_RE = /^\s*Host\s+(.+)$/gm;
+  doctorCommand = defineCommand({
+    name: "doctor",
+    summary: "Reconcile manifest, ssh config, and key files; report drift",
+    usage: "xpssh doctor [--fix]",
+    flags: [{ name: "fix", type: "boolean", description: "repair what can be repaired" }],
+    parse(_positionals, values) {
+      return { fix: values["fix"] === true };
+    },
+    async run(args, ctx) {
+      let segments;
+      try {
+        segments = await loadSshConfig(ctx.paths);
+      } catch (err) {
+        if (err instanceof SshConfigParseError) {
+          ctx.emit({ type: "error", text: err.message });
+          return { ok: false, message: "~/.ssh/config has broken xpssh fences — fix manually" };
+        }
+        throw err;
+      }
+      const manifest = await loadManifest(ctx.paths.manifest);
+      let found = 0;
+      let fixed = 0;
+      let configDirty = false;
+      const report = async (text, fix) => {
+        found += 1;
+        ctx.emit({ type: "warn", text });
+        if (args.fix && fix) {
+          ctx.emit({ type: "info", text: await fix() });
+          fixed += 1;
+        }
+      };
+      const blockSpecFor = (profile) => {
+        const provider = getProvider(profile.provider);
+        return {
+          id: profile.id,
+          alias: profile.alias,
+          hostName: provider.host,
+          user: provider.sshUser,
+          identityFile: profile.keyPath,
+          useKeychain: ctx.os.hasKeychain
+        };
+      };
+      const managedIds = new Set(listManagedIds(segments));
+      for (const profile of manifest.profiles) {
+        if (managedIds.has(profile.id))
+          continue;
+        await report(`${profile.id}: missing ssh config block`, () => {
+          segments = upsertBlock(segments, blockSpecFor(profile)).segments;
+          configDirty = true;
+          return `${profile.id}: re-added Host ${profile.alias} to ~/.ssh/config`;
+        });
+      }
+      const profileIds = new Set(manifest.profiles.map((p) => p.id));
+      for (const id of listManagedIds(segments)) {
+        if (profileIds.has(id))
+          continue;
+        await report(`orphan ssh config block "${id}"`, () => {
+          segments = removeBlock(segments, id).segments;
+          configDirty = true;
+          return `removed orphan block "${id}" from ~/.ssh/config`;
+        });
+      }
+      for (const profile of manifest.profiles) {
+        const block = segments.find((s) => s.kind === "managed" && s.id === profile.id);
+        if (!block)
+          continue;
+        const fields = parseBlockFields(block.text);
+        if (fields["Host"] === profile.alias && fields["IdentityFile"] === profile.keyPath)
+          continue;
+        await report(`${profile.id}: ssh config block is stale (expected Host ${profile.alias}, IdentityFile ${profile.keyPath})`, () => {
+          segments = upsertBlock(segments, blockSpecFor(profile)).segments;
+          configDirty = true;
+          return `${profile.id}: regenerated ssh config block`;
+        });
+      }
+      for (const profile of manifest.profiles) {
+        const absKeyPath = expandTilde(profile.keyPath, ctx.paths.home);
+        if (await fileExists2(absKeyPath) && await fileExists2(`${absKeyPath}.pub`))
+          continue;
+        await report(`${profile.id}: key file missing (${profile.keyPath}) — regenerate with ` + `\`xpssh setup ${profile.provider} -n ${profile.name} --force\` or detach with ` + `\`xpssh remove ${profile.id} --keep-key\``);
+      }
+      if (ctx.os.platform !== "win32") {
+        const sensitive = [ctx.paths.sshConfig, ...manifest.profiles.map((p) => expandTilde(p.keyPath, ctx.paths.home))];
+        for (const path of sensitive) {
+          const mode = await looseMode(path);
+          if (mode === null)
+            continue;
+          const display = contractTilde(path, ctx.paths.home);
+          await report(`${display}: permissions too open (${mode.toString(8)}) — should be 600`, async () => {
+            await chmod2(path, 384);
+            return `restored 600 permissions on ${display}`;
+          });
+        }
+      }
+      for (const profile of manifest.profiles) {
+        const blockIndex = segments.findIndex((s) => s.kind === "managed" && s.id === profile.id);
+        if (blockIndex === -1)
+          continue;
+        if (shadowedByEarlierHost(segments, blockIndex, profile.alias)) {
+          await report(`${profile.id}: alias ${profile.alias} may be shadowed by an earlier Host entry`);
+        }
+      }
+      if (configDirty)
+        await saveSshConfig(ctx.paths, segments);
+      if (found === 0)
+        return { ok: true, message: "No issues found" };
+      return {
+        ok: found === fixed,
+        message: `${found} issue${found === 1 ? "" : "s"} found, ${fixed} fixed`
+      };
+    }
+  });
+});
+
+// src/commands/registry.ts
+function lookupCommand(name) {
+  const needle = name.toLowerCase();
+  return COMMANDS.find((c) => c.name === needle || c.aliases?.includes(needle));
+}
+var COMMANDS;
+var init_registry = __esm(() => {
+  init_setup();
+  init_list();
+  init_test();
+  init_copy();
+  init_remove();
+  init_agent2();
+  init_upload();
+  init_doctor();
+  COMMANDS = [
+    setupCommand,
+    listCommand,
+    testCommand,
+    copyCommand,
+    removeCommand,
+    agentCommand,
+    uploadCommand,
+    doctorCommand
+  ];
+});
+
+// src/cli/parse.ts
+import { parseArgs } from "node:util";
+function resolveCommand(tokens) {
+  const [name, ...rest] = tokens;
+  if (!name)
+    throw new UsageError("No command given — try `xpssh help`");
+  const def = lookupCommand(name);
+  if (!def)
+    throw new UsageError(`Unknown command "${name}" — try \`xpssh help\``);
+  const options = {};
+  for (const flag of def.flags) {
+    options[flag.name] = flag.short ? { type: flag.type, short: flag.short } : { type: flag.type };
+  }
+  let parsed;
+  try {
+    parsed = parseArgs({ args: rest, options, allowPositionals: true, strict: true });
+  } catch (err) {
+    throw new UsageError(`${err.message.split(`
+`)[0]}
+Usage: ${def.usage}`);
+  }
+  const args = def.parse(parsed.positionals, parsed.values);
+  return { def, args };
+}
+function hasYesFlag(tokens) {
+  return tokens.includes("-y") || tokens.includes("--yes");
+}
+var init_parse = __esm(() => {
+  init_types();
+  init_registry();
+});
+
+// src/tui/dispatch.ts
+var exports_dispatch = {};
+__export(exports_dispatch, {
+  useCommandDispatch: () => useCommandDispatch,
+  sessionLog: () => sessionLog
+});
+import { useCallback } from "react";
+function useCommandDispatch() {
+  const { state, dispatch } = useStore();
+  const refreshProfiles = useCallback(async () => {
+    const rows = await gatherProfileRows(resolvePaths(process.env));
+    dispatch({ type: "set-profiles", profiles: rows });
+  }, [dispatch]);
+  const makeContext = useCallback((yes, onEvent) => {
+    const ask = (build) => new Promise((resolve) => {
+      dispatch({
+        type: "set-prompt",
+        prompt: build((value) => {
+          dispatch({ type: "set-prompt", prompt: null });
+          resolve(value);
+        })
+      });
+    });
+    return {
+      exec: realExec,
+      fetch: globalThis.fetch,
+      env: process.env,
+      paths: resolvePaths(process.env),
+      os: resolveOs(),
+      yes,
+      emit: (event) => {
+        dispatch({ type: "append-event", event });
+        onEvent?.(event);
+      },
+      confirm: (message) => yes ? Promise.resolve(true) : ask((resolve) => ({ kind: "confirm", message, resolve })),
+      promptText: (message, options) => ask((resolve) => ({ kind: "text", message, defaultValue: options?.defaultValue, resolve })),
+      promptSecret: (message) => ask((resolve) => ({ kind: "secret", message, resolve })),
+      promptSelect: (message, choices) => ask((resolve) => ({
+        kind: "select",
+        message,
+        choices,
+        resolve
+      }))
+    };
+  }, [dispatch]);
+  const runLine = useCallback(async (line) => {
+    const tokens = tokenize(line);
+    if (tokens.length === 0)
+      return;
+    dispatch({ type: "push-history", line });
+    dispatch({ type: "append-event", event: { type: "info", text: `❯ ${line}` } });
+    let resolved;
+    try {
+      resolved = resolveCommand(tokens);
+    } catch (err) {
+      dispatch({ type: "append-event", event: { type: "error", text: err.message } });
+      return;
+    }
+    if (resolved.def.name === "setup" && !hasYesFlag(tokens)) {
+      dispatch({ type: "set-setup-prefill", args: resolved.args });
+      dispatch({ type: "navigate", screen: "setup" });
+      return;
+    }
+    const ctx = makeContext(hasYesFlag(tokens));
+    dispatch({ type: "set-busy", busy: true });
+    try {
+      const result = await resolved.def.run(resolved.args, ctx);
+      if (result.message) {
+        dispatch({
+          type: "append-event",
+          event: { type: result.ok ? "success" : "error", text: result.message }
+        });
+        sessionLog.push(`${result.ok ? "✓" : "✗"} ${result.message}`);
+      }
+    } catch (err) {
+      const text = err instanceof UsageError ? err.message : `✗ ${err.message}`;
+      dispatch({ type: "append-event", event: { type: "error", text } });
+    } finally {
+      dispatch({ type: "set-busy", busy: false });
+      dispatch({ type: "set-prompt", prompt: null });
+      await refreshProfiles();
+    }
+  }, [dispatch, makeContext, refreshProfiles]);
+  return { runLine, refreshProfiles, makeContext, busy: state.busy };
+}
+var sessionLog;
+var init_dispatch = __esm(() => {
+  init_exec();
+  init_paths();
+  init_parse();
+  init_list();
+  init_types();
+  init_store();
+  sessionLog = [];
+});
+
+// src/tui/components/Header.tsx
+import { Box, Text } from "ink";
+import { jsxDEV as jsxDEV2 } from "react/jsx-dev-runtime";
+function Header() {
+  const { state } = useStore();
+  const tested = state.profiles.filter((p) => p.lastTest?.ok).length;
+  return /* @__PURE__ */ jsxDEV2(Box, {
+    paddingX: 1,
+    justifyContent: "space-between",
+    children: [
+      /* @__PURE__ */ jsxDEV2(Text, {
+        children: [
+          /* @__PURE__ */ jsxDEV2(Text, {
+            bold: true,
+            color: "cyan",
+            children: "xpssh"
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV2(Text, {
+            dimColor: true,
+            children: [
+              " v",
+              VERSION
+            ]
+          }, undefined, true, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      /* @__PURE__ */ jsxDEV2(Text, {
+        dimColor: true,
+        children: [
+          state.profiles.length,
+          " profile",
+          state.profiles.length === 1 ? "" : "s",
+          " · ",
+          tested,
+          " tested"
+        ]
+      }, undefined, true, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var init_Header = __esm(() => {
+  init_version();
+  init_store();
+});
+
+// src/tui/components/Transcript.tsx
+import { Box as Box2, Text as Text2 } from "ink";
+import { Spinner } from "@inkjs/ui";
+import { jsxDEV as jsxDEV3 } from "react/jsx-dev-runtime";
+function EventLine({ event }) {
+  if (event.type === "step") {
+    const icon = event.status === "done" ? "✓" : event.status === "fail" ? "✗" : "·";
+    const color2 = event.status === "done" ? "green" : event.status === "fail" ? "red" : undefined;
+    return /* @__PURE__ */ jsxDEV3(Text2, {
+      color: color2,
+      dimColor: event.status === "start",
+      children: [
+        icon,
+        " ",
+        event.label
+      ]
+    }, undefined, true, undefined, this);
+  }
+  const prefix = { success: "✓", error: "✗", warn: "!", info: " " }[event.type];
+  const color = { success: "green", error: "red", warn: "yellow", info: undefined }[event.type];
+  return /* @__PURE__ */ jsxDEV3(Text2, {
+    color,
+    children: [
+      prefix,
+      " ",
+      event.text
+    ]
+  }, undefined, true, undefined, this);
+}
+function Transcript() {
+  const { state } = useStore();
+  const events = state.transcript.slice(-VISIBLE);
+  if (events.length === 0 && !state.busy)
+    return null;
+  return /* @__PURE__ */ jsxDEV3(Box2, {
+    flexDirection: "column",
+    paddingX: 1,
+    borderStyle: "round",
+    borderDimColor: true,
+    children: [
+      events.map((event, i) => /* @__PURE__ */ jsxDEV3(EventLine, {
+        event
+      }, state.transcript.length - events.length + i, false, undefined, this)),
+      state.busy && /* @__PURE__ */ jsxDEV3(Spinner, {
+        label: "working…"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var VISIBLE = 6;
+var init_Transcript = __esm(() => {
+  init_store();
+});
+
+// src/tui/components/CommandBar.tsx
+import { useState } from "react";
+import { Box as Box3, Text as Text3, useInput } from "ink";
+import TextInput from "ink-text-input";
+import { jsxDEV as jsxDEV4 } from "react/jsx-dev-runtime";
+function CommandBar() {
+  const { state, dispatch } = useStore();
+  const { runLine } = useCommandDispatch();
+  const [value, setValue] = useState("");
+  const [historyIndex, setHistoryIndex] = useState(null);
+  const focused = state.focusZone === "bar" && !state.prompt;
+  useInput((_input, key) => {
+    if (key.escape) {
+      setValue("");
+      setHistoryIndex(null);
+      dispatch({ type: "set-focus", zone: "screen" });
+      return;
+    }
+    if (key.upArrow && state.history.length > 0) {
+      const next = historyIndex === null ? state.history.length - 1 : Math.max(0, historyIndex - 1);
+      setHistoryIndex(next);
+      setValue(state.history[next] ?? "");
+    }
+    if (key.downArrow && historyIndex !== null) {
+      const next = historyIndex + 1;
+      if (next >= state.history.length) {
+        setHistoryIndex(null);
+        setValue("");
+      } else {
+        setHistoryIndex(next);
+        setValue(state.history[next] ?? "");
+      }
+    }
+  }, { isActive: focused });
+  return /* @__PURE__ */ jsxDEV4(Box3, {
+    borderStyle: "round",
+    paddingX: 1,
+    borderColor: focused ? "cyan" : undefined,
+    borderDimColor: !focused,
+    children: [
+      /* @__PURE__ */ jsxDEV4(Text3, {
+        color: focused ? "cyan" : "gray",
+        children: "❯ "
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV4(TextInput, {
+        value,
+        onChange: (next) => {
+          setValue(next);
+          setHistoryIndex(null);
+        },
+        onSubmit: (line) => {
+          setValue("");
+          setHistoryIndex(null);
+          dispatch({ type: "set-focus", zone: "screen" });
+          runLine(line);
+        },
+        focus: focused,
+        placeholder: focused ? "setup github -e you@example.com" : "press / to type a command",
+        showCursor: focused
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var init_CommandBar = __esm(() => {
+  init_store();
+  init_dispatch();
+});
+
+// src/tui/components/PromptOverlay.tsx
+import { useState as useState2 } from "react";
+import { Box as Box4, Text as Text4 } from "ink";
+import { ConfirmInput, Select } from "@inkjs/ui";
+import TextInput2 from "ink-text-input";
+import { jsxDEV as jsxDEV5 } from "react/jsx-dev-runtime";
+function PromptOverlay() {
+  const { state } = useStore();
+  const prompt = state.prompt;
+  const [text, setText] = useState2("");
+  if (!prompt)
+    return null;
+  return /* @__PURE__ */ jsxDEV5(Box4, {
+    flexDirection: "column",
+    borderStyle: "round",
+    borderColor: "yellow",
+    paddingX: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV5(Text4, {
+        bold: true,
+        children: prompt.message
+      }, undefined, false, undefined, this),
+      prompt.kind === "confirm" && /* @__PURE__ */ jsxDEV5(ConfirmInput, {
+        onConfirm: () => prompt.resolve(true),
+        onCancel: () => prompt.resolve(false)
+      }, undefined, false, undefined, this),
+      (prompt.kind === "text" || prompt.kind === "secret") && /* @__PURE__ */ jsxDEV5(Box4, {
+        children: [
+          /* @__PURE__ */ jsxDEV5(Text4, {
+            color: "yellow",
+            children: "→ "
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV5(TextInput2, {
+            value: text,
+            onChange: setText,
+            onSubmit: (answer) => {
+              setText("");
+              prompt.resolve(answer || ("defaultValue" in prompt ? prompt.defaultValue ?? "" : ""));
+            },
+            mask: prompt.kind === "secret" ? "*" : undefined,
+            placeholder: "defaultValue" in prompt ? prompt.defaultValue : undefined,
+            focus: true
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      prompt.kind === "select" && /* @__PURE__ */ jsxDEV5(Select, {
+        options: prompt.choices.map((choice, i) => ({ label: choice.label, value: String(i) })),
+        onChange: (index) => prompt.resolve(prompt.choices[Number(index)].value)
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var init_PromptOverlay = __esm(() => {
+  init_store();
+});
+
+// src/tui/components/ProfileRow.tsx
+import { Box as Box5, Text as Text5 } from "ink";
+import { Badge } from "@inkjs/ui";
+import { jsxDEV as jsxDEV6 } from "react/jsx-dev-runtime";
+function ProfileRow({ profile }) {
+  const status = !profile.keyExists ? { color: "red", label: "key missing" } : profile.lastTest ? profile.lastTest.ok ? { color: "green", label: "tested" } : { color: "red", label: "failed" } : { color: "yellow", label: "untested" };
+  return /* @__PURE__ */ jsxDEV6(Box5, {
+    gap: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV6(Box5, {
+        width: 22,
+        children: [
+          /* @__PURE__ */ jsxDEV6(Text5, {
+            bold: true,
+            children: profile.id
+          }, undefined, false, undefined, this),
+          profile.isDefault && /* @__PURE__ */ jsxDEV6(Text5, {
+            dimColor: true,
+            children: " ★"
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      /* @__PURE__ */ jsxDEV6(Box5, {
+        width: 10,
+        children: /* @__PURE__ */ jsxDEV6(Badge, {
+          color: status.color,
+          children: status.label
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV6(Box5, {
+        width: 26,
+        children: /* @__PURE__ */ jsxDEV6(Text5, {
+          dimColor: true,
+          children: profile.email
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV6(Text5, {
+        dimColor: true,
+        children: [
+          profile.clonePrefix,
+          "owner/repo.git"
+        ]
+      }, undefined, true, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var init_ProfileRow = () => {};
+
+// src/tui/screens/Dashboard.tsx
+import { Box as Box6, Text as Text6 } from "ink";
+import { Select as Select2 } from "@inkjs/ui";
+import { jsxDEV as jsxDEV7 } from "react/jsx-dev-runtime";
+function Dashboard() {
+  const { state, dispatch } = useStore();
+  const { runLine } = useCommandDispatch();
+  const active = state.focusZone === "screen" && !state.prompt && !state.busy;
+  return /* @__PURE__ */ jsxDEV7(Box6, {
+    flexDirection: "column",
+    gap: 1,
+    paddingX: 1,
+    children: [
+      state.profiles.length > 0 ? /* @__PURE__ */ jsxDEV7(Box6, {
+        flexDirection: "column",
+        children: state.profiles.map((profile) => /* @__PURE__ */ jsxDEV7(ProfileRow, {
+          profile
+        }, profile.id, false, undefined, this))
+      }, undefined, false, undefined, this) : /* @__PURE__ */ jsxDEV7(Text6, {
+        dimColor: true,
+        children: "No SSH profiles yet — set one up below."
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV7(Select2, {
+        isDisabled: !active,
+        options: [
+          { label: "➕ Setup a new SSH key", value: "screen:setup" },
+          { label: "\uD83D\uDDC2  Manage keys", value: "screen:keys" },
+          { label: "\uD83D\uDD0C Test connections", value: "screen:test" },
+          { label: "\uD83D\uDD11 SSH agent", value: "screen:agent" },
+          { label: "❓ Help", value: "screen:help" }
+        ],
+        onChange: (value) => {
+          if (value.startsWith("screen:")) {
+            dispatch({ type: "navigate", screen: value.slice("screen:".length) });
+          } else {
+            runLine(value);
+          }
+        }
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var init_Dashboard = __esm(() => {
+  init_store();
+  init_dispatch();
+  init_ProfileRow();
+});
+
+// src/tui/screens/KeyManager.tsx
+import { useState as useState3 } from "react";
+import { Box as Box7, Text as Text7, useInput as useInput2 } from "ink";
+import { Select as Select3 } from "@inkjs/ui";
+import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
+function KeyManager() {
+  const { state, dispatch } = useStore();
+  const { runLine } = useCommandDispatch();
+  const [selected, setSelected] = useState3(null);
+  const active = state.focusZone === "screen" && !state.prompt && !state.busy;
+  useInput2((_input, key) => {
+    if (key.escape) {
+      if (selected)
+        setSelected(null);
+      else
+        dispatch({ type: "navigate", screen: "dashboard" });
+    }
+  }, { isActive: active });
+  if (state.profiles.length === 0) {
+    return /* @__PURE__ */ jsxDEV8(Box7, {
+      paddingX: 1,
+      children: /* @__PURE__ */ jsxDEV8(Text7, {
+        dimColor: true,
+        children: "No profiles to manage — run setup first (esc to go back)."
+      }, undefined, false, undefined, this)
+    }, undefined, false, undefined, this);
+  }
+  if (!selected) {
+    return /* @__PURE__ */ jsxDEV8(Box7, {
+      flexDirection: "column",
+      paddingX: 1,
+      gap: 1,
+      children: [
+        /* @__PURE__ */ jsxDEV8(Text7, {
+          bold: true,
+          children: "Pick a profile"
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV8(Select3, {
+          isDisabled: !active,
+          options: state.profiles.map((p) => ({ label: `${p.id}  (${p.email})`, value: p.id })),
+          onChange: (id) => setSelected(id)
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  return /* @__PURE__ */ jsxDEV8(Box7, {
+    flexDirection: "column",
+    paddingX: 1,
+    gap: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV8(Text7, {
+        bold: true,
+        children: selected
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV8(Select3, {
+        isDisabled: !active,
+        options: [
+          { label: "\uD83D\uDCCB Copy public key", value: `copy ${selected}` },
+          { label: "\uD83C\uDF10 Copy + open provider settings", value: `copy ${selected} --open` },
+          { label: "\uD83D\uDD0C Test connection", value: `test ${selected}` },
+          { label: "\uD83D\uDDD1  Remove profile", value: `remove ${selected}` }
+        ],
+        onChange: (line) => {
+          setSelected(null);
+          runLine(line);
+        }
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV8(Text7, {
+        dimColor: true,
+        children: "esc to go back"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var init_KeyManager = __esm(() => {
+  init_store();
+  init_dispatch();
+});
+
+// src/tui/components/StepList.tsx
+import { Box as Box8, Text as Text8 } from "ink";
+import { Spinner as Spinner2 } from "@inkjs/ui";
+import { jsxDEV as jsxDEV9 } from "react/jsx-dev-runtime";
+function StepList({ steps }) {
+  return /* @__PURE__ */ jsxDEV9(Box8, {
+    flexDirection: "column",
+    children: steps.map((step) => /* @__PURE__ */ jsxDEV9(Box8, {
+      gap: 1,
+      children: step.status === "running" ? /* @__PURE__ */ jsxDEV9(Spinner2, {
+        label: step.label
+      }, undefined, false, undefined, this) : /* @__PURE__ */ jsxDEV9(Text8, {
+        color: step.status === "done" ? "green" : step.status === "failed" ? "red" : undefined,
+        dimColor: step.status === "pending",
+        children: [
+          step.status === "done" ? "✓" : step.status === "failed" ? "✗" : "○",
+          " ",
+          step.label
+        ]
+      }, undefined, true, undefined, this)
+    }, step.id, false, undefined, this))
+  }, undefined, false, undefined, this);
+}
+var init_StepList = () => {};
+
+// src/tui/screens/SetupWizard.tsx
+import { useMemo, useState as useState4 } from "react";
+import { Box as Box9, Text as Text9, useInput as useInput3 } from "ink";
+import { Select as Select4 } from "@inkjs/ui";
+import TextInput3 from "ink-text-input";
+import { jsxDEV as jsxDEV10 } from "react/jsx-dev-runtime";
+function firstStage(args) {
+  if (!args.provider || !getProvider(args.provider))
+    return "provider";
+  if (!args.name)
+    return "name";
+  if (!args.email)
+    return "email";
+  return "review";
+}
+function SetupWizard() {
+  const { state, dispatch } = useStore();
+  const { makeContext, refreshProfiles } = useCommandDispatch();
+  const initialArgs = state.setupPrefill ?? EMPTY_ARGS;
+  const [args, setArgs] = useState4(initialArgs);
+  const [stage, setStage] = useState4(() => firstStage(initialArgs));
+  const [text, setText] = useState4("");
+  const [steps, setSteps] = useState4([]);
+  const [plan, setPlan] = useState4(null);
+  const [error, setError] = useState4(null);
+  const interactive = state.focusZone === "screen" && !state.prompt && !state.busy;
+  const provider = args.provider ? getProvider(args.provider) : undefined;
+  useInput3((_input, key) => {
+    if (!key.escape)
+      return;
+    if (stage === "running")
+      return;
+    dispatch({ type: "set-setup-prefill", args: null });
+    dispatch({ type: "navigate", screen: "dashboard" });
+  }, { isActive: interactive });
+  const stepRows = useMemo(() => setupSteps.map((s) => ({ id: s.id, label: s.label, status: "pending" })), []);
+  async function start() {
+    setStage("running");
+    setSteps(stepRows);
+    setError(null);
+    const ctx = makeContext(false, (event) => {
+      if (event.type !== "step")
+        return;
+      setSteps((current) => current.map((row) => row.id === event.id ? { ...row, status: event.status === "start" ? "running" : event.status === "done" ? "done" : "failed" } : row));
+    });
+    dispatch({ type: "set-busy", busy: true });
+    try {
+      const resolved = await resolveSetupPlan(args, ctx);
+      setPlan(resolved);
+      await executeSetupPipeline(resolved, ctx);
+    } catch (err) {
+      setError(err.message);
+    } finally {
+      dispatch({ type: "set-busy", busy: false });
+      dispatch({ type: "set-prompt", prompt: null });
+      await refreshProfiles();
+      setStage("finished");
+    }
+  }
+  return /* @__PURE__ */ jsxDEV10(Box9, {
+    flexDirection: "column",
+    paddingX: 1,
+    gap: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV10(Text9, {
+        bold: true,
+        children: [
+          "Set up a new SSH key",
+          provider ? ` — ${provider.label}` : ""
+        ]
+      }, undefined, true, undefined, this),
+      stage === "provider" && /* @__PURE__ */ jsxDEV10(Select4, {
+        isDisabled: !interactive,
+        options: PROVIDERS.map((p) => ({ label: p.label, value: p.id })),
+        onChange: (id) => {
+          setArgs((a) => ({ ...a, provider: id }));
+          setStage(firstStage({ ...args, provider: id }));
+        }
+      }, undefined, false, undefined, this),
+      stage === "name" && /* @__PURE__ */ jsxDEV10(Box9, {
+        flexDirection: "column",
+        children: [
+          /* @__PURE__ */ jsxDEV10(Text9, {
+            children: "Profile name for this account (e.g. personal, work)"
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV10(Box9, {
+            children: [
+              /* @__PURE__ */ jsxDEV10(Text9, {
+                color: "cyan",
+                children: "→ "
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV10(TextInput3, {
+                value: text,
+                onChange: setText,
+                focus: interactive,
+                placeholder: "personal",
+                onSubmit: (value) => {
+                  const name = value.trim() || "personal";
+                  setText("");
+                  setArgs((a) => ({ ...a, name }));
+                  setStage(firstStage({ ...args, name }));
+                }
+              }, undefined, false, undefined, this)
+            ]
+          }, undefined, true, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      stage === "email" && /* @__PURE__ */ jsxDEV10(Box9, {
+        flexDirection: "column",
+        children: [
+          /* @__PURE__ */ jsxDEV10(Text9, {
+            children: "Email for the key comment"
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV10(Box9, {
+            children: [
+              /* @__PURE__ */ jsxDEV10(Text9, {
+                color: "cyan",
+                children: "→ "
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV10(TextInput3, {
+                value: text,
+                onChange: setText,
+                focus: interactive,
+                placeholder: "you@example.com",
+                onSubmit: (value) => {
+                  if (!value.includes("@"))
+                    return;
+                  setText("");
+                  setArgs((a) => ({ ...a, email: value.trim() }));
+                  setStage("delivery");
+                }
+              }, undefined, false, undefined, this)
+            ]
+          }, undefined, true, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      stage === "delivery" && /* @__PURE__ */ jsxDEV10(Box9, {
+        flexDirection: "column",
+        children: [
+          /* @__PURE__ */ jsxDEV10(Text9, {
+            children: [
+              "How should the public key reach ",
+              provider?.label,
+              "?"
+            ]
+          }, undefined, true, undefined, this),
+          /* @__PURE__ */ jsxDEV10(Select4, {
+            isDisabled: !interactive,
+            options: [
+              { label: "Clipboard + open settings page (manual paste)", value: "manual" },
+              ...provider?.api ? [{ label: `Upload via API token (${provider.api.tokenEnvVar})`, value: "token" }] : []
+            ],
+            onChange: (choice) => {
+              if (choice === "token") {
+                setStage("review");
+                setArgs((a) => ({ ...a, token: a.token ?? process.env[provider.api.tokenEnvVar] }));
+              } else {
+                setStage("review");
+              }
+            }
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      stage === "review" && /* @__PURE__ */ jsxDEV10(Box9, {
+        flexDirection: "column",
+        gap: 1,
+        children: [
+          /* @__PURE__ */ jsxDEV10(Box9, {
+            flexDirection: "column",
+            children: [
+              /* @__PURE__ */ jsxDEV10(Text9, {
+                children: [
+                  "provider ",
+                  /* @__PURE__ */ jsxDEV10(Text9, {
+                    bold: true,
+                    children: provider?.label
+                  }, undefined, false, undefined, this),
+                  " · profile ",
+                  /* @__PURE__ */ jsxDEV10(Text9, {
+                    bold: true,
+                    children: args.name
+                  }, undefined, false, undefined, this),
+                  " · email",
+                  " ",
+                  /* @__PURE__ */ jsxDEV10(Text9, {
+                    bold: true,
+                    children: args.email
+                  }, undefined, false, undefined, this)
+                ]
+              }, undefined, true, undefined, this),
+              /* @__PURE__ */ jsxDEV10(Text9, {
+                dimColor: true,
+                children: [
+                  "key ",
+                  args.keyType ?? provider?.keyType,
+                  " · delivery ",
+                  args.token ? "API upload" : "clipboard + browser"
+                ]
+              }, undefined, true, undefined, this)
+            ]
+          }, undefined, true, undefined, this),
+          /* @__PURE__ */ jsxDEV10(Select4, {
+            isDisabled: !interactive,
+            options: [
+              { label: "▶ Create the key", value: "go" },
+              { label: "Cancel", value: "cancel" }
+            ],
+            onChange: (choice) => {
+              if (choice === "go")
+                start();
+              else {
+                dispatch({ type: "set-setup-prefill", args: null });
+                dispatch({ type: "navigate", screen: "dashboard" });
+              }
+            }
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      (stage === "running" || stage === "finished") && /* @__PURE__ */ jsxDEV10(Box9, {
+        flexDirection: "column",
+        gap: 1,
+        children: [
+          /* @__PURE__ */ jsxDEV10(StepList, {
+            steps
+          }, undefined, false, undefined, this),
+          error && /* @__PURE__ */ jsxDEV10(Text9, {
+            color: "red",
+            children: [
+              "✗ ",
+              error
+            ]
+          }, undefined, true, undefined, this),
+          stage === "finished" && !error && plan && /* @__PURE__ */ jsxDEV10(Text9, {
+            color: "green",
+            children: [
+              "✓ Clone with ",
+              clonePrefix(plan, plan.provider.sshUser),
+              "<owner>/<repo>.git"
+            ]
+          }, undefined, true, undefined, this),
+          stage === "finished" && /* @__PURE__ */ jsxDEV10(Select4, {
+            isDisabled: !interactive,
+            options: [
+              { label: "Back to dashboard", value: "dashboard" },
+              ...plan && error ? [{ label: "Retry", value: "retry" }] : []
+            ],
+            onChange: (choice) => {
+              if (choice === "retry")
+                start();
+              else {
+                dispatch({ type: "set-setup-prefill", args: null });
+                dispatch({ type: "navigate", screen: "dashboard" });
+              }
+            }
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      stage !== "running" && stage !== "finished" && /* @__PURE__ */ jsxDEV10(Text9, {
+        dimColor: true,
+        children: "esc to cancel"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var EMPTY_ARGS;
+var init_SetupWizard = __esm(() => {
+  init_providers();
+  init_setup();
+  init_store();
+  init_dispatch();
+  init_StepList();
+  EMPTY_ARGS = { noBrowser: false, noClipboard: false, noAgent: false, force: false };
+});
+
+// src/tui/screens/Tester.tsx
+import { useState as useState5 } from "react";
+import { Box as Box10, Text as Text10, useInput as useInput4 } from "ink";
+import { MultiSelect, Badge as Badge2 } from "@inkjs/ui";
+import { jsxDEV as jsxDEV11 } from "react/jsx-dev-runtime";
+function Tester() {
+  const { state, dispatch } = useStore();
+  const { runLine } = useCommandDispatch();
+  const [running, setRunning] = useState5(false);
+  const active = state.focusZone === "screen" && !state.prompt && !state.busy && !running;
+  useInput4((_input, key) => {
+    if (key.escape)
+      dispatch({ type: "navigate", screen: "dashboard" });
+  }, { isActive: active });
+  if (state.profiles.length === 0) {
+    return /* @__PURE__ */ jsxDEV11(Box10, {
+      paddingX: 1,
+      children: /* @__PURE__ */ jsxDEV11(Text10, {
+        dimColor: true,
+        children: "No profiles to test — run setup first (esc to go back)."
+      }, undefined, false, undefined, this)
+    }, undefined, false, undefined, this);
+  }
+  return /* @__PURE__ */ jsxDEV11(Box10, {
+    flexDirection: "column",
+    paddingX: 1,
+    gap: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV11(Text10, {
+        bold: true,
+        children: "Select profiles to test (space toggles, enter runs)"
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV11(MultiSelect, {
+        isDisabled: !active,
+        options: state.profiles.map((p) => ({ label: `${p.id} (${p.alias})`, value: p.id })),
+        defaultValue: state.profiles.map((p) => p.id),
+        onSubmit: async (ids) => {
+          setRunning(true);
+          for (const id of ids) {
+            await runLine(`test ${id}`);
+          }
+          setRunning(false);
+        }
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV11(Box10, {
+        flexDirection: "column",
+        children: state.profiles.filter((p) => p.lastTest).map((p) => /* @__PURE__ */ jsxDEV11(Box10, {
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV11(Badge2, {
+              color: p.lastTest.ok ? "green" : "red",
+              children: p.lastTest.ok ? "ok" : "fail"
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsxDEV11(Text10, {
+              children: p.id
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsxDEV11(Text10, {
+              dimColor: true,
+              children: p.lastTest.message
+            }, undefined, false, undefined, this)
+          ]
+        }, p.id, true, undefined, this))
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV11(Text10, {
+        dimColor: true,
+        children: "esc to go back"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var init_Tester = __esm(() => {
+  init_store();
+  init_dispatch();
+});
+
+// src/tui/screens/AgentScreen.tsx
+import { useEffect, useState as useState6 } from "react";
+import { Box as Box11, Text as Text11, useInput as useInput5 } from "ink";
+import { Select as Select5 } from "@inkjs/ui";
+import { jsxDEV as jsxDEV12 } from "react/jsx-dev-runtime";
+function AgentScreen() {
+  const { state, dispatch } = useStore();
+  const { runLine } = useCommandDispatch();
+  const [status, setStatus] = useState6(null);
+  const active = state.focusZone === "screen" && !state.prompt && !state.busy;
+  useEffect(() => {
+    getAgentStatus(realExec).then(setStatus);
+  }, [state.busy]);
+  useInput5((_input, key) => {
+    if (key.escape)
+      dispatch({ type: "navigate", screen: "dashboard" });
+  }, { isActive: active });
+  return /* @__PURE__ */ jsxDEV12(Box11, {
+    flexDirection: "column",
+    paddingX: 1,
+    gap: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV12(Text11, {
+        bold: true,
+        children: [
+          "ssh-agent:",
+          " ",
+          status === null ? /* @__PURE__ */ jsxDEV12(Text11, {
+            dimColor: true,
+            children: "checking…"
+          }, undefined, false, undefined, this) : status.running ? /* @__PURE__ */ jsxDEV12(Text11, {
+            color: "green",
+            children: [
+              "running · ",
+              status.keys.length,
+              " key(s)"
+            ]
+          }, undefined, true, undefined, this) : /* @__PURE__ */ jsxDEV12(Text11, {
+            color: "red",
+            children: "not running"
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      status?.running && status.keys.length > 0 && /* @__PURE__ */ jsxDEV12(Box11, {
+        flexDirection: "column",
+        children: status.keys.map((key) => /* @__PURE__ */ jsxDEV12(Text11, {
+          dimColor: true,
+          children: [
+            key.bits,
+            " ",
+            key.type,
+            " ",
+            key.fingerprint,
+            " ",
+            key.comment
+          ]
+        }, key.fingerprint, true, undefined, this))
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV12(Select5, {
+        isDisabled: !active,
+        options: [
+          ...status?.running === false ? [{ label: "▶ Start ssh-agent", value: "agent start" }] : [],
+          ...state.profiles.map((p) => ({ label: `➕ Load ${p.id}`, value: `agent add ${p.id}` })),
+          ...state.profiles.map((p) => ({ label: `➖ Unload ${p.id}`, value: `agent remove ${p.id}` }))
+        ],
+        onChange: (line) => void runLine(line)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV12(Text11, {
+        dimColor: true,
+        children: "esc to go back"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var init_AgentScreen = __esm(() => {
+  init_exec();
+  init_agent();
+  init_store();
+  init_dispatch();
+});
+
+// src/tui/screens/HelpScreen.tsx
+import { Box as Box12, Text as Text12, useInput as useInput6 } from "ink";
+import { jsxDEV as jsxDEV13 } from "react/jsx-dev-runtime";
+function HelpScreen() {
+  const { state, dispatch } = useStore();
+  useInput6((_input, key) => {
+    if (key.escape)
+      dispatch({ type: "navigate", screen: "dashboard" });
+  }, { isActive: state.focusZone === "screen" && !state.prompt });
+  return /* @__PURE__ */ jsxDEV13(Box12, {
+    flexDirection: "column",
+    paddingX: 1,
+    gap: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV13(Text12, {
+        bold: true,
+        children: "Commands (type them in the bar below, same as the CLI)"
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV13(Box12, {
+        flexDirection: "column",
+        children: COMMANDS.map((c) => /* @__PURE__ */ jsxDEV13(Box12, {
+          children: [
+            /* @__PURE__ */ jsxDEV13(Box12, {
+              width: 12,
+              children: /* @__PURE__ */ jsxDEV13(Text12, {
+                color: "cyan",
+                children: c.name
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsxDEV13(Text12, {
+              dimColor: true,
+              children: c.summary
+            }, undefined, false, undefined, this)
+          ]
+        }, c.name, true, undefined, this))
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV13(Box12, {
+        flexDirection: "column",
+        children: [
+          /* @__PURE__ */ jsxDEV13(Text12, {
+            bold: true,
+            children: "Keys"
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV13(Text12, {
+            dimColor: true,
+            children: "/ or : focus command bar · ↑↓ history · 1/2 screens · esc back · q quit"
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+var init_HelpScreen = __esm(() => {
+  init_store();
+  init_registry();
+});
+
+// src/tui/App.tsx
+var exports_App = {};
+__export(exports_App, {
+  App: () => App
+});
+import { useEffect as useEffect2 } from "react";
+import { Box as Box13, Text as Text13, useApp, useInput as useInput7, useWindowSize } from "ink";
+import { ThemeProvider, defaultTheme } from "@inkjs/ui";
+import { jsxDEV as jsxDEV14 } from "react/jsx-dev-runtime";
+function Shell() {
+  const { state, dispatch } = useStore();
+  const { refreshProfiles } = useCommandDispatch();
+  const { exit } = useApp();
+  const { rows, columns } = useWindowSize();
+  useEffect2(() => {
+    refreshProfiles();
+  }, []);
+  useInput7((input, key) => {
+    if (input === "/" || input === ":" || key.ctrl && input === "k") {
+      dispatch({ type: "set-focus", zone: "bar" });
+      return;
+    }
+    if (input === "q")
+      exit();
+    if (input === "?")
+      dispatch({ type: "navigate", screen: "help" });
+    if (key.ctrl && input === "l")
+      dispatch({ type: "clear-transcript" });
+    const screen = SCREEN_KEYS[input];
+    if (screen)
+      dispatch({ type: "navigate", screen });
+  }, { isActive: state.focusZone === "screen" && !state.prompt && !state.busy && state.screen !== "setup" });
+  return /* @__PURE__ */ jsxDEV14(Box13, {
+    flexDirection: "column",
+    width: columns,
+    height: rows,
+    children: [
+      /* @__PURE__ */ jsxDEV14(Header, {}, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV14(Box13, {
+        flexDirection: "column",
+        flexGrow: 1,
+        overflow: "hidden",
+        children: [
+          state.screen === "dashboard" && /* @__PURE__ */ jsxDEV14(Dashboard, {}, undefined, false, undefined, this),
+          state.screen === "keys" && /* @__PURE__ */ jsxDEV14(KeyManager, {}, undefined, false, undefined, this),
+          state.screen === "setup" && /* @__PURE__ */ jsxDEV14(SetupWizard, {}, JSON.stringify(state.setupPrefill), false, undefined, this),
+          state.screen === "test" && /* @__PURE__ */ jsxDEV14(Tester, {}, undefined, false, undefined, this),
+          state.screen === "agent" && /* @__PURE__ */ jsxDEV14(AgentScreen, {}, undefined, false, undefined, this),
+          state.screen === "help" && /* @__PURE__ */ jsxDEV14(HelpScreen, {}, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      /* @__PURE__ */ jsxDEV14(Transcript, {}, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV14(PromptOverlay, {}, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV14(CommandBar, {}, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV14(Box13, {
+        paddingX: 1,
+        children: /* @__PURE__ */ jsxDEV14(Text13, {
+          dimColor: true,
+          children: "/ command · 1 dash · 2 keys · 3 setup · 4 test · 5 agent · ? help · ctrl+l clear · q quit"
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+function App() {
+  return /* @__PURE__ */ jsxDEV14(ThemeProvider, {
+    theme: defaultTheme,
+    children: /* @__PURE__ */ jsxDEV14(StoreProvider, {
+      children: /* @__PURE__ */ jsxDEV14(Shell, {}, undefined, false, undefined, this)
+    }, undefined, false, undefined, this)
+  }, undefined, false, undefined, this);
+}
+var SCREEN_KEYS;
+var init_App = __esm(() => {
+  init_store();
+  init_dispatch();
+  init_Header();
+  init_Transcript();
+  init_CommandBar();
+  init_PromptOverlay();
+  init_Dashboard();
+  init_KeyManager();
+  init_SetupWizard();
+  init_Tester();
+  init_AgentScreen();
+  init_HelpScreen();
+  SCREEN_KEYS = {
+    "1": "dashboard",
+    "2": "keys",
+    "3": "setup",
+    "4": "test",
+    "5": "agent"
+  };
+});
+
+// src/cli/help.ts
+var exports_help = {};
+__export(exports_help, {
+  renderHelp: () => renderHelp
+});
+function renderHelp(commandName) {
+  if (commandName) {
+    const def = lookupCommand(commandName);
+    if (def)
+      return renderCommandHelp(def);
+  }
+  const lines = [
+    `xpssh v${VERSION} — SSH keys for git providers, done right`,
+    "",
+    "Usage: xpssh <command> [options]",
+    "       xpssh            launch the interactive TUI",
+    "",
+    "Commands:",
+    ...COMMANDS.map((c) => `  ${c.name.padEnd(10)} ${c.summary}`),
+    `  ${"help".padEnd(10)} Show help for a command`,
+    "",
+    "Run `xpssh help <command>` for flags."
+  ];
+  return lines.join(`
+`);
+}
+function renderCommandHelp(def) {
+  const lines = [def.summary, "", `Usage: ${def.usage}`];
+  if (def.flags.length > 0) {
+    lines.push("", "Options:");
+    for (const flag of def.flags) {
+      const left = [flag.short ? `-${flag.short},` : "   ", `--${flag.name}`, flag.valueHint ?? ""].join(" ").trimEnd();
+      lines.push(`  ${left.padEnd(28)} ${flag.description}`);
+    }
+  }
+  return lines.join(`
+`);
+}
+var init_help = __esm(() => {
+  init_registry();
+  init_version();
+});
+
+// src/cli/run.ts
+var exports_run = {};
+__export(exports_run, {
+  runCli: () => runCli
+});
+import * as readline from "node:readline/promises";
+import { styleText } from "node:util";
+function renderEvent(event) {
+  switch (event.type) {
+    case "step":
+      if (event.status === "start")
+        process.stdout.write(styleText("dim", `· ${event.label}
+`));
+      else if (event.status === "fail")
+        process.stdout.write(styleText("red", `✗ ${event.label}
+`));
+      else
+        process.stdout.write(styleText("green", `✓ ${event.label}
+`));
+      break;
+    case "success":
+      process.stdout.write(styleText("green", `✓ ${event.text}
+`));
+      break;
+    case "error":
+      process.stdout.write(styleText("red", `✗ ${event.text}
+`));
+      break;
+    case "warn":
+      process.stdout.write(styleText("yellow", `! ${event.text}
+`));
+      break;
+    default:
+      process.stdout.write(`  ${event.text}
+`);
+  }
+}
+function buildTerminalContext(yes) {
+  const rl = () => readline.createInterface({ input: process.stdin, output: process.stdout });
+  return {
+    exec: realExec,
+    fetch: globalThis.fetch,
+    env: process.env,
+    paths: resolvePaths(process.env),
+    os: resolveOs(),
+    yes,
+    emit: renderEvent,
+    async confirm(message) {
+      if (yes)
+        return true;
+      const iface = rl();
+      try {
+        const answer = await iface.question(`${message} ${styleText("dim", "[y/N] ")}`);
+        return /^y(es)?$/i.test(answer.trim());
+      } finally {
+        iface.close();
+      }
+    },
+    async promptText(message, options) {
+      if (yes)
+        throw new UsageError(`Missing input: ${message}`);
+      const iface = rl();
+      try {
+        const hint = options?.defaultValue ? styleText("dim", ` (${options.defaultValue})`) : "";
+        const answer = (await iface.question(`${message}${hint}: `)).trim();
+        return answer || options?.defaultValue || "";
+      } finally {
+        iface.close();
+      }
+    },
+    async promptSecret(message) {
+      if (yes)
+        throw new UsageError(`Missing input: ${message}`);
+      const muted = { active: false };
+      const iface = readline.createInterface({
+        input: process.stdin,
+        output: new Proxy(process.stdout, {
+          get(target, prop) {
+            if (prop === "write" && muted.active) {
+              return () => true;
+            }
+            const value = Reflect.get(target, prop);
+            return typeof value === "function" ? value.bind(target) : value;
+          }
+        }),
+        terminal: true
+      });
+      try {
+        process.stdout.write(`${message}: `);
+        muted.active = true;
+        const answer = await iface.question("");
+        process.stdout.write(`
+`);
+        return answer.trim();
+      } finally {
+        iface.close();
+      }
+    },
+    async promptSelect(message, choices) {
+      if (yes)
+        throw new UsageError(`Missing input: ${message}`);
+      process.stdout.write(`${message}
+`);
+      choices.forEach((choice, i) => process.stdout.write(`  ${i + 1}) ${choice.label}
+`));
+      const iface = rl();
+      try {
+        for (;; ) {
+          const answer = await iface.question(`Choose [1-${choices.length}]: `);
+          const index = Number(answer.trim()) - 1;
+          const choice = choices[index];
+          if (choice)
+            return choice.value;
+          process.stdout.write(styleText("yellow", `Not a valid choice
+`));
+        }
+      } finally {
+        iface.close();
+      }
+    }
+  };
+}
+async function runCli(tokens) {
+  if (tokens[0] === "help" || tokens.includes("--help") || tokens.includes("-h")) {
+    const target = tokens[0] === "help" ? tokens[1] : tokens[0];
+    process.stdout.write(renderHelp(target === "-h" || target === "--help" ? undefined : target) + `
+`);
+    return 0;
+  }
+  try {
+    const { def, args } = resolveCommand(tokens);
+    const ctx = buildTerminalContext(hasYesFlag(tokens));
+    const result = await def.run(args, ctx);
+    if (result.message) {
+      renderEvent({ type: result.ok ? "success" : "error", text: result.message });
+    }
+    return result.ok ? 0 : 1;
+  } catch (err) {
+    if (err instanceof UsageError) {
+      process.stderr.write(styleText("red", `${err.message}
+`));
+      return 2;
+    }
+    process.stderr.write(styleText("red", `✗ ${err.message}
+`));
+    return 1;
+  }
+}
+var init_run = __esm(() => {
+  init_exec();
+  init_paths();
+  init_types();
+  init_parse();
+  init_help();
+});
+
+// src/index.tsx
+init_version();
+import { jsxDEV as jsxDEV15 } from "react/jsx-dev-runtime";
+var args = process.argv.slice(2);
+if (args.includes("--version") || args.includes("-v")) {
+  console.log(VERSION);
+  process.exit(0);
+}
+if (args[0] === "ui" || args.length === 0 && process.stdout.isTTY) {
+  const { render } = await import("ink");
+  const { App: App2 } = await Promise.resolve().then(() => (init_App(), exports_App));
+  const { sessionLog: sessionLog2 } = await Promise.resolve().then(() => (init_dispatch(), exports_dispatch));
+  const app = render(/* @__PURE__ */ jsxDEV15(App2, {}, undefined, false, undefined, this), { alternateScreen: true });
+  await app.waitUntilExit();
+  if (sessionLog2.length > 0) {
+    console.log("xpssh session:");
+    for (const line of sessionLog2)
+      console.log(`  ${line}`);
+  }
+  process.exit(0);
+}
+if (args.length === 0) {
+  const { renderHelp: renderHelp2 } = await Promise.resolve().then(() => (init_help(), exports_help));
+  console.log(renderHelp2());
+  process.exit(0);
+}
+var { runCli: runCli2 } = await Promise.resolve().then(() => (init_run(), exports_run));
+process.exit(await runCli2(args));