@viraatdas/rudder 3.9.2 → 3.9.5

package/assets/skills/google-cloud/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rudder-google-cloud
-description: Use for any Google Cloud or Google API setup — creating or naming a GCP project, enabling APIs (Gmail, Calendar, Drive, Gemini, …), "Sign in with Google" / Google OAuth clients, the consent screen (app name, logo, domains, scopes, verification, test users), redirect_uri_mismatch and other OAuth errors, gcloud auth, service accounts and keys, and storing the resulting secrets. Makes sure users see the product's own name on Google's screens, never a stray project like "My First Project".
+description: Use for any Google Cloud or Google API setup — creating or naming a GCP project, enabling APIs (Gmail, Calendar, Drive, Gemini, …), "Sign in with Google" / Google OAuth clients, the consent screen (app name, logo, domains, scopes, brand verification, test users), moving sign-in to another domain, redirect_uri_mismatch and other OAuth errors, gcloud auth, service accounts and keys, and storing the resulting secrets. Makes sure users see the product's own name on Google's screens, never a stray project like "My First Project".
 ---
 
 # Google Cloud, done properly
@@ -14,6 +14,15 @@ Helper: `node <this skill dir>/scripts/gcp.mjs <command>` (Node 18+, no deps).
 It finds credentials from `gcloud`, gcloud's stored login, or ADC; run
 `whoami` first.
 
+**Google's official skills cover the rest.** This skill is the product layer
+(project naming, consent screen, OAuth client, what a user sees). For general
+`gcloud` work use Google's `gcloud` skill (check leaf syntax with `gcloud help
+<command>` before running it, `--limit`/`--filter`/`--format` on every list,
+`--quiet`, dry-run where supported) and `google-cloud-recipe-auth` for IAM,
+service accounts and ADC. Both are in the `google-cloud-developer` plugin; if
+they are not loaded: `claude plugin marketplace add google/skills && claude
+plugin install google-cloud-developer@google-plugins`.
+
 ## The rules
 
 1. **One project per product, named after the product.** Display name = the
@@ -25,7 +34,11 @@ It finds credentials from `gcloud`, gcloud's stored login, or ADC; run
 2. **The consent screen's App name is what users read**, not the project name
    and not the client name. Set it on the Branding page to the product name,
    with the product's own support email, home page, privacy and terms URLs, and
-   the product's domain as an authorized domain.
+   the product's domain as an authorized domain. **It only shows once the
+   branding is verified.** Until then Google shows the redirect URI's domain:
+   the registrable domain for your own (`app.rudder.exla.ai` → "exla.ai"), the
+   whole host for a platform one ("rudder-cloud-control.fly.dev"). See "Brand
+   verification" below.
 3. **Ask for the narrowest scopes that work.** Basic (openid/email/profile) can go
    straight to production. Sensitive (Calendar, gmail.send) need verification.
    Restricted (Gmail read/modify/compose, Drive full) need verification **and**
@@ -94,8 +107,8 @@ real sign-in in a browser and say in your report what the screen showed.
 - **Testing vs production**: in Testing only listed test users can sign in and
   refresh tokens expire after 7 days — fine for a demo, wrong for real users.
   Publish as soon as the scopes allow it.
-- **Logo**: uploading one triggers brand verification; leave it off until the
-  user is ready to verify. The name, links and domain still show.
+- **Logo**: uploading one adds a logo review to verification; leave it off
+  unless the user wants it, since basic scopes verify faster without one.
 - **Internal user type** restricts sign-in to the org's Workspace accounts — only
   right for internal tools.
 - **Verification** (sensitive/restricted scopes): needs the home page on the
@@ -113,9 +126,60 @@ real sign-in in a browser and say in your report what the screen showed.
   again) and the consent App name (Branding page). The project ID can never
   change — choose it once, deliberately.
 
+## Brand verification (getting the App name on screen)
+
+Branding page → **Verify branding**. Google checks that every **authorized
+domain** is verified in Search Console by an owner of the project, that the
+home page and privacy policy live on those domains and name the app, and that
+the support email belongs to the owner. Basic scopes: usually a few days.
+
+- **Redirect URIs must be on a domain the user owns.** Platform hosts
+  (`*.fly.dev`, `*.vercel.app`, `*.run.app`, `*.awsapprunner.com`,
+  `*.netlify.app`) can never be verified, and while they are authorized
+  domains verification fails. Serve the auth callback from the product's own
+  domain (e.g. `app.<domain>`), then remove the platform redirect URIs and
+  their authorized domains.
+- **Search Console**: add a Domain property for the apex and verify it with
+  the DNS TXT record it gives (through the DNS host's API if you have it,
+  otherwise ask the user), signed in as the same account that owns the project.
+
+## Moving sign-in to another domain
+
+Order matters. Switching the app first breaks sign-in for everyone.
+
+1. Point the new host at the app (DNS + TLS) and check it serves.
+2. Add the new redirect URI (and JS origin if used) to the Google client **and**
+   to every other provider on the same auth base URL (GitHub OAuth/App callback
+   URLs, Slack, Linear …). `check-client` must show it accepted.
+3. Make every page that STARTS a sign-in redirect to the new host before
+   starting it: the OAuth state cookie is set on the host that starts the flow
+   and must be there when the callback lands. Native shells and old CLIs keep
+   using the old address, so bounce their login pages; don't strand them.
+4. Flip the auth base URL (`BETTER_AUTH_URL`, `NEXTAUTH_URL`, …) and deploy.
+5. Real sign-in on the new host for each provider; then remove the old redirect
+   URIs and authorized domains, and verify the branding.
+
+## Keeping an existing client
+
+A client already shipped in apps (an iOS bundle, a published CLI, stored in a
+host's secrets) can stay in a misnamed project when moving it would change the
+client ID. Its consent screen can still say the product's name: set the
+Branding and verify it. Note the exception in the report; never silently.
+
+## In the browser
+
+- Google may ask for a passkey, security key or password re-auth (the URL
+  carries `rapt=`). Stop and ask the user to complete it; never type it.
+- The client page's "Last used date" lags by days. Confirm which client is live
+  from the app's own sign-in redirect (`curl -sI <login url>` → `client_id=`),
+  not from that date.
+- Settings "may take 5 minutes to a few hours"; `check-client` usually sees a
+  new redirect URI within a minute.
+
 ## Report
 
 Say which project (ID and display name), which APIs, which client (ID, never
 the secret), where the secrets live, the `check-client` result per redirect
-URI, what the real sign-in screen showed, the publishing status, and any
-verification still owed (with the user cap it implies).
+URI (including the name Google shows today), what the real sign-in screen
+showed, the publishing and brand-verification status, and any verification
+still owed (with the user cap it implies).

package/assets/skills/google-cloud/scripts/gcp.mjs

@@ -329,9 +329,15 @@ async function probe(clientId, redirect, scopes) {
   const url = new URL("https://accounts.google.com/o/oauth2/v2/auth");
   url.search = new URLSearchParams({ client_id: clientId, redirect_uri: redirect, response_type: "code", scope: scopes.join(" "), prompt: "select_account" }).toString();
   const response = await fetch(url, { redirect: "follow", headers: { "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0 Safari/537.36", "accept-language": "en-US" } });
-  const text = pageText(await response.text());
+  const html = await response.text();
+  const text = pageText(html);
   const error = text.match(/Error 400: (\w+)/)?.[1] ?? text.match(/Error 401: (\w+)/)?.[1] ?? text.match(/Error 403: (\w+)/)?.[1] ?? (response.url.includes("/signin/oauth/error") ? "unknown_error" : null);
-  const appName = text.match(/to continue to ([^.]+?)(?:\s+(?:Email|Forgot|Not your|Create account|Next)\b|$)/)?.[1]?.trim() ?? null;
+  // The name sits in a data-app-name attribute (seen 2026-10); the text
+  // match is the fallback for older page shapes. Unverified branding shows
+  // the redirect URI's domain here, not the App name.
+  const appName = pageText(html.match(/data-app-name="([^"]+)"/)?.[1] ?? "").trim()
+    || text.match(/to continue to ([^.]+?)(?:\s+(?:Email|Forgot|Not your|Create account|Next)\b|$)/)?.[1]?.trim()
+    || null;
   return { error, appName, finalUrl: response.url };
 }
 
@@ -364,7 +370,7 @@ async function checkClient(o) {
     }
     const nameOk = !expect || r.appName.toLowerCase() === expect.toLowerCase();
     if (!nameOk) ok = false;
-    console.log(`${nameOk ? "✓" : "✗"} ${redirect}: accepted; Google shows "continue to ${r.appName}"${nameOk ? "" : `, expected "${expect}". Fix the App name on the Branding page (it is not the project name).`}`);
+    console.log(`${nameOk ? "✓" : "✗"} ${redirect}: accepted; Google shows "continue to ${r.appName}"${nameOk ? "" : `, expected "${expect}". ${/\./.test(r.appName) ? "Google shows a domain until the branding is verified (Branding page, Verify branding)." : "Fix the App name on the Branding page (it is not the project name)."}`}`);
   }
   if (!ok) process.exit(1);
 }

package/assets/skills/namecheap/SKILL.md

@@ -0,0 +1,130 @@
+---
+name: rudder-namecheap
+description: Use WHENEVER Namecheap comes up, and for any domain registered there (nameservers dns1/dns2.registrar-servers.com). Covers the whole account through the Namecheap API and CLI — DNS records (A/AAAA/CNAME/TXT/MX, verification records, pointing a domain or subdomain at Vercel, Netlify or a server, removing the parking page), free email forwarding (hello@ to an inbox), URL redirects, nameservers, registrar lock, domain privacy (WhoisGuard), domain list, expiry and auto-renew, contacts, availability and pricing, registering and renewing domains, transfers, account balance, and API access setup. Does the change itself and never hands the user records to type into the Namecheap dashboard.
+---
+
+# Namecheap
+
+**The rule: do it through the API, never hand the user steps for the
+dashboard.** If access is missing, the only acceptable ask is the one-time API
+setup in section 6, stated once, after everything else is done.
+
+Tool: `<this skill dir>/scripts/namecheap` (Python 3 stdlib, no installs).
+`$NC --help` and `$NC <command> --help` list every option.
+
+```bash
+NC="<this skill dir>/scripts/namecheap"
+$NC check            # credentials work + every domain in the account
+```
+
+## 1. Look before changing
+
+| Question | Command |
+|---|---|
+| Which domains, when do they expire, auto-renew, privacy, lock | `$NC domains` (`--expiring`, `--expired`, `--search TEXT`) |
+| One domain in full: status, expiry, privacy, nameservers, lock | `$NC info example.com` |
+| Where its DNS is served from (public view) | `$NC lookup example.com NS` |
+| Records Namecheap serves + email mode | `$NC list example.com` |
+| Email forwards | `$NC forward example.com` |
+| WHOIS contacts | `$NC contacts example.com` |
+| Balance | `$NC balance` |
+| Incoming transfers | `$NC transfers` |
+
+If the nameservers are not `dns1/dns2.registrar-servers.com`, records live at
+that DNS host, not at Namecheap: `*.vercel-dns.com` → `vercel dns add`;
+Netlify (`dns*.p0*.nsone.net`) → the Netlify CLI/API; Cloudflare, Route 53 →
+their CLI/API. Registrar settings (nameservers, lock, privacy, renewals) still
+belong here.
+
+## 2. DNS records: list, dry-run, then apply
+
+```bash
+$NC list example.com
+$NC set example.com --add 'CNAME app site.netlify.app.' --dry-run
+$NC set example.com --add 'CNAME app site.netlify.app.'      # backs up, writes, re-reads, verifies
+```
+
+Namecheap's `setHosts` **replaces every record on the domain**. Never call it
+with curl or any other client: one call missing the MX or TXT records silently
+breaks mail and verification. The tool merges with the live set, refuses record
+types it cannot round-trip (CAA, SRV: tell the user those need the dashboard),
+and backs up every write to `~/.config/namecheap/backups/`. Undo with
+`$NC restore <backup.json>`.
+
+| Goal | Command |
+|---|---|
+| Apex + www to Vercel (removes the parking page) | `$NC vercel example.com`, then `vercel domains add example.com <project>` and `vercel domains add www.example.com <project>` |
+| Subdomain to Vercel | `$NC vercel example.com --sub app` |
+| Verification TXT (Vercel, Google, …) | `$NC set example.com --add 'TXT _vercel "vc-domain-verify=..."'` |
+| Subdomain to Netlify / any host | `$NC set example.com --add 'CNAME app site-name.netlify.app.'` |
+| A record to a server | `$NC set example.com --add 'A api 203.0.113.7'` |
+| Redirect a name (301) | `$NC set example.com --add 'URL301 old https://new.example.com'` |
+| Third-party mail (MX) | `$NC set example.com --add 'MX @ mx1.provider.com. 1800 10'` |
+| Replace a conflicting record | add `--replace` (without it the tool refuses and shows the clash) |
+| Remove a record | `$NC set example.com --remove 'CNAME old'` (value optional) |
+| Free email forwarding | `$NC forward example.com --add hello=you@example.com` (refuses to cut off live MX mail unless `--force`) |
+
+Verify with `$NC list` (Namecheap's view, already re-read after the write) and
+`$NC lookup example.com A` (public DNS, after the TTL).
+
+## 3. Registrar settings
+
+| Goal | Command |
+|---|---|
+| Move DNS to another host (Vercel, Cloudflare, …) | `$NC nameservers example.com --set ns1.host.com ns2.host.com --yes` |
+| Back to Namecheap BasicDNS | `$NC nameservers example.com --default --yes` |
+| Transfer lock | `$NC lock example.com --on` / `--off` (off only to transfer it out) |
+| Domain privacy | `$NC privacy example.com --on` / `--off`; `$NC privacy` lists all |
+
+Switching nameservers moves the whole domain: copy the records to the new host
+first, or mail and verification break. The tool asks for `--yes` for that reason.
+
+## 4. Buying and renewing (spends money)
+
+```bash
+$NC available idea.dev other.com      # free? premium?
+$NC price dev                         # your register price; --action renew|transfer, --years N
+$NC renew example.com --years 1       # prints price + balance, charges nothing
+$NC register idea.dev --contacts-from example.com   # same: prints, charges nothing
+```
+
+Anything that charges the account does nothing without `--yes`. **Before
+adding `--yes`, tell the user the item and total and get a clear yes in chat**,
+every time; a yes for one purchase does not cover the next. Registration copies
+WHOIS contacts from a domain the user already owns and turns free privacy on.
+Premium names are refused (they need the dashboard). Payment comes from the
+account balance; if it is short, say so and stop.
+
+## 5. Report
+
+Say what changed (before → after), the backup path for record writes, what
+`lookup` shows publicly, anything still propagating, and for purchases the
+amount charged and the order id.
+
+## 6. When access is missing
+
+The tool reads `NAMECHEAP_API_USER` / `NAMECHEAP_API_KEY` (optionally
+`NAMECHEAP_USERNAME`, `NAMECHEAP_CLIENT_IP`) from the environment or
+`~/.config/namecheap/credentials.env`. On a Rudder cloud machine the environment
+comes from the Rudder secrets vault; `env | grep -c NAMECHEAP` shows whether it
+has them.
+
+If the tool prints `NO_NAMECHEAP_CREDENTIALS`, or an API error naming an IP that
+isn't whitelisted, first do everything that doesn't need Namecheap. Then send
+the user one short message with only this:
+
+1. Namecheap → Profile → Tools → **Namecheap API Access** → ON. Namecheap
+   requires a $50 balance, $50 spent in the last two years, or 20 domains.
+2. **Whitelisted IPs** → add the IP the tool printed (this machine's public
+   IPv4; only IPv4 works).
+3. Store the key once, from their computer, so every Rudder cloud machine has
+   it: `rudder cloud secrets set NAMECHEAP_API_USER <namecheap-username>` and
+   `rudder cloud secrets set NAMECHEAP_API_KEY` (prompts for the value). For
+   this machine only: `! <this skill dir>/scripts/namecheap setup <namecheap-username>`
+   (prompts for the key).
+
+Never print the key, commit it, put it in a URL or pass it as a command-line
+argument. Never sign in to the Namecheap dashboard yourself: the account
+password is the user's. A cloud machine's outbound IP can change on restart;
+when Namecheap rejects a call, the error names the new IP. Whitelist it too, or
+pin a static egress IP, which costs money and needs the user's go-ahead.

package/assets/skills/namecheap/scripts/namecheap

@@ -0,0 +1,785 @@
+#!/usr/bin/env python3
+"""namecheap: the Namecheap account from the command line, safely, for agents.
+
+Namecheap's setHosts REPLACES every host record on a domain, so record changes
+never write blind: read the live records, merge, back the old set up, write,
+re-read and check. Anything that costs money (register, renew) shows the price
+and the balance and does nothing without --yes.
+
+Account
+  namecheap setup <api-user> [<api-key>] [--username U] [--client-ip IP]
+  namecheap check                         credentials + IP whitelist + domain list
+  namecheap balance                       account balance
+  namecheap domains [--expiring|--expired] [--search TEXT]
+  namecheap info <domain>                 status, expiry, auto-renew, privacy, nameservers
+  namecheap contacts <domain>             registrant/admin/tech/billing contacts
+
+Buying (prices first; --yes to spend)
+  namecheap available <domain> [...]      availability + premium price
+  namecheap price <tld> [--action register|renew|transfer]
+  namecheap register <domain> --contacts-from <owned domain> [--years N] [--yes]
+  namecheap renew <domain> [--years N] [--yes]
+  namecheap transfers                     incoming transfers and their status
+
+Registrar settings
+  namecheap nameservers <domain> [--set NS1 NS2 ...|--default]
+  namecheap lock <domain> [--on|--off]    registrar (transfer) lock
+  namecheap privacy [<domain>] [--on [--email E]|--off]   free domain privacy
+
+DNS (Namecheap BasicDNS)
+  namecheap list <domain>                 host records and email mode
+  namecheap set <domain> --add "A @ 76.76.21.21" --remove "CNAME www" [--replace] [--dry-run]
+  namecheap vercel <domain> [--sub NAME ...] [--dry-run]
+                                          apex + www (or subdomains) to Vercel, parking removed
+  namecheap forward <domain> [--add hello=you@example.com] [--remove hello] [--dry-run]
+  namecheap lookup <name> [TYPE]          DNS-over-HTTPS lookup (no dig needed)
+  namecheap restore <backup.json> [--dry-run]
+
+Credentials come from the environment or ~/.config/namecheap/credentials.env:
+  NAMECHEAP_API_USER, NAMECHEAP_API_KEY, NAMECHEAP_USERNAME (defaults to the
+  API user), NAMECHEAP_CLIENT_IP (defaults to this machine's public IPv4),
+  NAMECHEAP_SANDBOX=1 for the sandbox API.
+"""
+import argparse
+import json
+import os
+import shlex
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+import xml.etree.ElementTree as ET
+from datetime import datetime
+from pathlib import Path
+
+API = 'https://api.namecheap.com/xml.response'
+SANDBOX_API = 'https://api.sandbox.namecheap.com/xml.response'
+CONFIG_DIR = Path(os.environ.get('NAMECHEAP_CONFIG_DIR', Path.home() / '.config' / 'namecheap'))
+CRED_FILE = CONFIG_DIR / 'credentials.env'
+BACKUP_DIR = CONFIG_DIR / 'backups'
+NS = '{http://api.namecheap.com/xml.response}'
+TWO_LEVEL_TLDS = {
+    'co.uk', 'org.uk', 'me.uk', 'ltd.uk', 'plc.uk', 'net.uk', 'com.au', 'net.au', 'org.au',
+    'co.nz', 'net.nz', 'org.nz', 'co.jp', 'com.br', 'com.mx', 'co.in', 'co.za', 'com.sg', 'com.tr',
+}
+# Types this tool can read back and write again without losing fields.
+ROUND_TRIP_TYPES = {'A', 'AAAA', 'ALIAS', 'CNAME', 'MX', 'MXE', 'NS', 'TXT', 'URL', 'URL301', 'FRAME'}
+REDIRECT_TYPES = {'URL', 'URL301', 'FRAME'}
+PARKING_TARGETS = ('parkingpage.namecheap.com',)
+VERCEL_A = '76.76.21.21'
+VERCEL_CNAME = 'cname.vercel-dns.com.'
+DEFAULT_TTL = '1800'
+
+
+class ApiError(Exception):
+    def __init__(self, errors, client_ip):
+        self.errors = errors
+        hints = []
+        numbers = {number for number, _ in errors}
+        text = ' '.join(message for _, message in errors).lower()
+        if '1011150' in numbers or ('ip' in text and ('whitelist' in text or 'invalid request ip' in text)):
+            hints.append(
+                f'This machine\'s IP {client_ip} is not whitelisted. Namecheap dashboard: Profile > Tools > '
+                'Namecheap API Access > Whitelisted IPs > add it.')
+        if numbers & {'1011102', '1011104', '1010102', '1010104'} or 'api key' in text or 'apiuser' in text:
+            hints.append('API user or key rejected. Re-run `namecheap setup` with the key from Profile > Tools > Namecheap API Access.')
+        if 'not associated' in text or 'domain not found' in text or numbers & {'2019166', '2016166'}:
+            hints.append('That domain is not in this Namecheap account.')
+        detail = '; '.join(f'{number}: {message}' for number, message in errors)
+        super().__init__(detail + ''.join(f'\n  -> {hint}' for hint in hints))
+
+
+# ---------- credentials and transport ----------
+
+def read_cred_file():
+    values = {}
+    if CRED_FILE.exists():
+        for line in CRED_FILE.read_text().splitlines():
+            line = line.strip()
+            if line and not line.startswith('#') and '=' in line:
+                key, value = line.split('=', 1)
+                values[key.strip()] = value.strip().strip('"').strip("'")
+    return values
+
+
+def public_ip():
+    for url in ('https://api.ipify.org', 'https://ifconfig.me/ip', 'https://ipv4.icanhazip.com'):
+        try:
+            with urllib.request.urlopen(url, timeout=8) as response:
+                ip = response.read().decode().strip()
+                if ip.count('.') == 3:
+                    return ip
+        except (urllib.error.URLError, OSError):
+            continue
+    sys.exit('Could not find this machine\'s public IPv4. Set NAMECHEAP_CLIENT_IP.')
+
+
+def load_creds():
+    stored = read_cred_file()
+    get = lambda key: os.environ.get(key) or stored.get(key)
+    user, key = get('NAMECHEAP_API_USER'), get('NAMECHEAP_API_KEY')
+    if not user or not key:
+        sys.exit(
+            'NO_NAMECHEAP_CREDENTIALS: no API user/key in the environment or ' + str(CRED_FILE) + '.\n'
+            'One-time setup (the user does this once, then never again):\n'
+            '  1. Namecheap dashboard > Profile > Tools > Namecheap API Access > turn ON\n'
+            '     (Namecheap requires $50 balance, $50 spent in 2 years, or 20 domains).\n'
+            f'  2. Whitelisted IPs > add {public_ip()} (this machine).\n'
+            '  3. namecheap setup <namecheap-username>   (prompts for the key)')
+    return {
+        'ApiUser': user,
+        'ApiKey': key,
+        'UserName': get('NAMECHEAP_USERNAME') or user,
+        'ClientIp': get('NAMECHEAP_CLIENT_IP') or public_ip(),
+        'sandbox': get('NAMECHEAP_SANDBOX') == '1',
+    }
+
+
+def call(creds, command, **params):
+    data = {name: creds[name] for name in ('ApiUser', 'ApiKey', 'UserName', 'ClientIp')}
+    data['Command'] = command
+    data.update({name: str(value) for name, value in params.items()})
+    request = urllib.request.Request(
+        SANDBOX_API if creds['sandbox'] else API,
+        data=urllib.parse.urlencode(data).encode(),
+        method='POST',
+    )
+    with urllib.request.urlopen(request, timeout=30) as response:
+        root = ET.fromstring(response.read())
+    if root.get('Status') != 'OK':
+        errors = [(error.get('Number', '?'), (error.text or '').strip()) for error in root.iter(NS + 'Error')]
+        raise ApiError(errors or [('?', 'unknown error')], creds['ClientIp'])
+    return root.find(NS + 'CommandResponse')
+
+
+# ---------- domain records ----------
+
+def split_domain(domain):
+    labels = domain.lower().strip().strip('.').split('.')
+    if len(labels) >= 3 and '.'.join(labels[-2:]) in TWO_LEVEL_TLDS:
+        sld, tld, extra = labels[-3], '.'.join(labels[-2:]), labels[:-3]
+    elif len(labels) >= 2:
+        sld, tld, extra = labels[-2], labels[-1], labels[:-2]
+    else:
+        sys.exit(f'Not a domain: {domain}')
+    if extra:
+        sys.exit(f'Pass the registered domain ({sld}.{tld}), not a subdomain; use the host field for "{".".join(extra)}".')
+    return sld, tld
+
+
+def norm(record_type, value):
+    value = (value or '').strip()
+    return value if record_type == 'TXT' else value.rstrip('.').lower()
+
+
+def same(a, b):
+    return (a['type'] == b['type'] and a['host'].lower() == b['host'].lower()
+            and norm(a['type'], a['address']) == norm(b['type'], b['address']))
+
+
+def fmt(record):
+    extra = f" pref={record['mxpref']}" if record['type'] in ('MX', 'MXE') else ''
+    return f"{record['type']:<6} {record['host']:<14} {record['address']}  ttl={record['ttl']}{extra}"
+
+
+def get_hosts(creds, domain):
+    sld, tld = split_domain(domain)
+    result = call(creds, 'namecheap.domains.dns.getHosts', SLD=sld, TLD=tld).find(NS + 'DomainDNSGetHostsResult')
+    records = [{
+        'type': host.get('Type', '').upper(),
+        'host': host.get('Name', ''),
+        'address': host.get('Address', ''),
+        'ttl': host.get('TTL') or DEFAULT_TTL,
+        'mxpref': host.get('MXPref') or '10',
+    } for host in result.iter(NS + 'host')]
+    return {
+        'domain': domain,
+        'records': records,
+        'email_type': (result.get('EmailType') or '').upper(),
+        'using_namecheap_dns': (result.get('IsUsingOurDNS') or '').lower() == 'true',
+    }
+
+
+def set_hosts(creds, domain, records, email_type):
+    sld, tld = split_domain(domain)
+    params = {'SLD': sld, 'TLD': tld}
+    for index, record in enumerate(records, 1):
+        params[f'HostName{index}'] = record['host']
+        params[f'RecordType{index}'] = record['type']
+        params[f'Address{index}'] = record['address']
+        params[f'TTL{index}'] = record['ttl'] or DEFAULT_TTL
+        if record['type'] in ('MX', 'MXE'):
+            params[f'MXPref{index}'] = record['mxpref'] or '10'
+    if email_type and email_type != 'NONE':
+        params['EmailType'] = email_type
+    result = call(creds, 'namecheap.domains.dns.setHosts', **params).find(NS + 'DomainDNSSetHostsResult')
+    if result is None or (result.get('IsSuccess') or '').lower() != 'true':
+        sys.exit('setHosts did not report success; nothing verified. Check the domain in the dashboard.')
+
+
+def parse_spec(spec, need_value):
+    parts = shlex.split(spec)
+    if len(parts) < (3 if need_value else 2):
+        sys.exit(f'Bad record "{spec}". Use "TYPE HOST VALUE [TTL] [MXPREF]", e.g. "A @ 76.76.21.21".')
+    record = {'type': parts[0].upper(), 'host': parts[1], 'address': parts[2] if len(parts) > 2 else None,
+              'ttl': parts[3] if len(parts) > 3 else DEFAULT_TTL, 'mxpref': parts[4] if len(parts) > 4 else '10'}
+    if need_value and record['type'] not in ROUND_TRIP_TYPES:
+        sys.exit(f'Record type {record["type"]} is not supported by this tool.')
+    return record
+
+
+def conflicts(existing, new):
+    """Records that cannot coexist with `new` at the same host."""
+    host = new['host'].lower()
+    out = []
+    for record in existing:
+        if record['host'].lower() != host or same(record, new):
+            continue
+        if new['type'] == 'CNAME' or record['type'] == 'CNAME':
+            out.append(record)  # a CNAME owns its name outright
+        elif new['type'] in ('A', 'AAAA', 'ALIAS') and record['type'] in REDIRECT_TYPES | {'ALIAS'}:
+            out.append(record)  # a redirect or ALIAS answers for the same name
+        elif new['type'] in REDIRECT_TYPES and record['type'] in {'A', 'AAAA', 'ALIAS'} | REDIRECT_TYPES:
+            out.append(record)
+        elif new['type'] == record['type'] and new['type'] in ('A', 'AAAA'):
+            out.append(record)  # a second A would round-robin traffic to the old target
+    return out
+
+
+def plan_change(current, adds, removes, replace):
+    records = [dict(record) for record in current]
+    removed, added = [], []
+    for spec in removes:
+        for record in list(records):
+            if (record['type'] == spec['type'] and record['host'].lower() == spec['host'].lower()
+                    and (spec['address'] is None or norm(record['type'], record['address']) == norm(spec['type'], spec['address']))):
+                records.remove(record)
+                removed.append(record)
+    for new in adds:
+        if any(same(record, new) for record in records):
+            continue
+        clash = conflicts(records, new)
+        if clash and not replace:
+            sys.exit('Refusing: ' + fmt(new) + ' conflicts with existing record(s):\n  '
+                     + '\n  '.join(fmt(record) for record in clash)
+                     + '\nRe-run with --replace to swap them, or --remove them explicitly.')
+        for record in clash:
+            records.remove(record)
+            removed.append(record)
+        records.append(new)
+        added.append(new)
+    return records, removed, added
+
+
+def backup(state):
+    BACKUP_DIR.mkdir(parents=True, exist_ok=True)
+    os.chmod(CONFIG_DIR, 0o700)
+    # Microseconds keep two writes in the same second from overwriting each other's backup.
+    path = BACKUP_DIR / f"{state['domain']}-{datetime.now().strftime('%Y%m%dT%H%M%S.%f')}.json"
+    path.write_text(json.dumps(state, indent=2))
+    return path
+
+
+def apply(creds, domain, state, records, removed, added, dry_run, email_type=None):
+    unknown = [record for record in state['records'] if record['type'] not in ROUND_TRIP_TYPES]
+    if unknown:
+        sys.exit('Refusing to rewrite: the domain has record types this tool cannot round-trip:\n  '
+                 + '\n  '.join(fmt(record) for record in unknown) + '\nChange them in the dashboard instead.')
+    if not state['using_namecheap_dns']:
+        sys.exit(f'{domain} is not on Namecheap DNS (custom nameservers). Change records at that DNS host instead.')
+    for record in removed:
+        print('- ' + fmt(record))
+    for record in added:
+        print('+ ' + fmt(record))
+    target_email = email_type or state['email_type']
+    if target_email != state['email_type']:
+        print(f"~ email mode {state['email_type'] or 'NONE'} -> {target_email}")
+    if not removed and not added and target_email == state['email_type']:
+        print('No change needed; the records are already in place.')
+        return
+    if dry_run:
+        print('(dry run: nothing written)')
+        return
+    saved = backup(state)
+    print(f'Backed up previous records to {saved}')
+    set_hosts(creds, domain, records, target_email)
+    after = get_hosts(creds, domain)
+    missing = [record for record in added if not any(same(record, live) for live in after['records'])]
+    lingering = [record for record in removed if any(same(record, live) for live in after['records'])]
+    if missing or lingering:
+        sys.exit('Verification failed after write. Missing: ' + ', '.join(map(fmt, missing))
+                 + ' Still present: ' + ', '.join(map(fmt, lingering)) + f'\nRestore with: namecheap restore {saved}')
+    print(f'Verified: {len(after["records"])} records live on Namecheap. Public DNS catches up within the TTL:')
+    print(f'  namecheap lookup {domain} A')
+
+
+# ---------- commands ----------
+
+def cmd_setup(args):
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    os.chmod(CONFIG_DIR, 0o700)
+    api_key = args.api_key
+    if not api_key:
+        import getpass
+        # Prompted, not an argument: a key on the command line lands in shell
+        # history and the process list.
+        api_key = getpass.getpass('Namecheap API key: ').strip()
+    if not api_key:
+        sys.exit('No API key given.')
+    lines = [f'NAMECHEAP_API_USER={args.api_user}', f'NAMECHEAP_API_KEY={api_key}']
+    if args.username:
+        lines.append(f'NAMECHEAP_USERNAME={args.username}')
+    if args.client_ip:
+        lines.append(f'NAMECHEAP_CLIENT_IP={args.client_ip}')
+    fd = os.open(CRED_FILE, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, 'w') as handle:
+        handle.write('\n'.join(lines) + '\n')
+    os.chmod(CRED_FILE, 0o600)
+    print(f'Saved credentials to {CRED_FILE} (mode 600).')
+    cmd_check(args)
+
+
+def cmd_check(_args):
+    creds = load_creds()
+    result = call(creds, 'namecheap.domains.getList', PageSize=100).find(NS + 'DomainGetListResult')
+    domains = [(domain.get('Name'), domain.get('IsOurDNS'), domain.get('Expires')) for domain in result.iter(NS + 'Domain')]
+    print(f"OK: API user {creds['ApiUser']} from IP {creds['ClientIp']}. {len(domains)} domain(s):")
+    for name, ours, expires in domains:
+        print(f"  {name:<32} {'Namecheap DNS' if (ours or '').lower() == 'true' else 'custom nameservers':<20} expires {expires}")
+
+
+def cmd_list(args):
+    state = get_hosts(load_creds(), args.domain)
+    print(f"{args.domain}: {'Namecheap DNS' if state['using_namecheap_dns'] else 'custom nameservers'}, "
+          f"email mode {state['email_type'] or 'NONE'}")
+    for record in state['records']:
+        print('  ' + fmt(record))
+
+
+def cmd_set(args):
+    creds = load_creds()
+    state = get_hosts(creds, args.domain)
+    adds = [parse_spec(spec, True) for spec in args.add]
+    removes = [parse_spec(spec, False) for spec in args.remove]
+    records, removed, added = plan_change(state['records'], adds, removes, args.replace)
+    apply(creds, args.domain, state, records, removed, added, args.dry_run)
+
+
+def cmd_vercel(args):
+    creds = load_creds()
+    state = get_hosts(creds, args.domain)
+    removes = []
+    for record in state['records']:
+        if norm('CNAME', record['address']).endswith(PARKING_TARGETS) or (
+                record['type'] in REDIRECT_TYPES and record['host'] in ('@', 'www')):
+            removes.append(dict(record))  # Namecheap's default parking page and redirects
+    names = args.sub or ['@', 'www']
+    adds = []
+    for name in names:
+        if name == '@':
+            adds.append({'type': 'A', 'host': '@', 'address': VERCEL_A, 'ttl': DEFAULT_TTL, 'mxpref': '10'})
+        else:
+            adds.append({'type': 'CNAME', 'host': name, 'address': VERCEL_CNAME, 'ttl': DEFAULT_TTL, 'mxpref': '10'})
+    records, removed, added = plan_change(state['records'], adds, removes, replace=True)
+    apply(creds, args.domain, state, records, removed, added, args.dry_run)
+    if not args.dry_run:
+        print('Next: `vercel domains add ' + (args.domain if names == ['@', 'www'] else f'{names[0]}.{args.domain}')
+              + ' <project>` if not attached yet, then `vercel domains inspect` to confirm.')
+
+
+def cmd_forward(args):
+    creds = load_creds()
+    domain = args.domain.lower()
+    result = call(creds, 'namecheap.domains.dns.getEmailForwarding', DomainName=domain).find(
+        NS + 'DomainDNSGetEmailForwardingResult')
+    forwards = [(forward.get('mailbox'), (forward.text or '').strip()) for forward in result.iter(NS + 'Forward')]
+    if not args.add and not args.remove:
+        print(f'{domain} email forwards:' if forwards else f'{domain}: no email forwards')
+        for mailbox, target in forwards:
+            print(f'  {mailbox}@{domain} -> {target}')
+        return
+    wanted = [(mailbox, target) for mailbox, target in forwards if mailbox not in set(args.remove)]
+    for spec in args.add:
+        if '=' not in spec:
+            sys.exit(f'Bad forward "{spec}". Use mailbox=destination, e.g. hello=you@example.com')
+        mailbox, target = (part.strip() for part in spec.split('=', 1))
+        wanted = [(m, t) for m, t in wanted if m != mailbox] + [(mailbox, target)]
+    state = get_hosts(creds, domain)
+    if state['email_type'] != 'FWD':
+        has_mx = any(record['type'] in ('MX', 'MXE') for record in state['records'])
+        if has_mx and not args.force:
+            sys.exit(f"{domain} receives mail through MX records (mode {state['email_type']}). Switching to "
+                     'forwarding would cut that mail off. Re-run with --force only if that mail setup is unused.')
+        print(f"Switching {domain} email mode {state['email_type'] or 'NONE'} -> FWD")
+        records = [record for record in state['records'] if record['type'] not in ('MX', 'MXE')]
+        removed = [record for record in state['records'] if record['type'] in ('MX', 'MXE')]
+        apply(creds, domain, state, records, removed, [], args.dry_run, email_type='FWD')
+    for mailbox, target in wanted:
+        print(f'  {mailbox}@{domain} -> {target}')
+    if args.dry_run:
+        print('(dry run: forwards not written)')
+        return
+    params = {'DomainName': domain}
+    for index, (mailbox, target) in enumerate(wanted, 1):
+        params[f'MailBox{index}'] = mailbox
+        params[f'ForwardTo{index}'] = target
+    call(creds, 'namecheap.domains.dns.setEmailForwarding', **params)
+    print('Forwards saved.')
+
+
+def text(node, tag):
+    found = node.find(NS + tag) if node is not None else None
+    return (found.text or '').strip() if found is not None else ''
+
+
+def cmd_balance(_args):
+    result = call(load_creds(), 'namecheap.users.getBalances').find(NS + 'UserGetBalancesResult')
+    print(f"Available {result.get('AvailableBalance')} {result.get('Currency')} "
+          f"(account {result.get('AccountBalance')}, earned {result.get('EarnedAmount')}, "
+          f"funds needed for auto-renew {result.get('FundsRequiredForAutoRenew')})")
+
+
+def all_domains(creds, list_type='ALL', search=None):
+    page, out = 1, []
+    while True:
+        params = {'PageSize': 100, 'Page': page, 'ListType': list_type}
+        if search:
+            params['SearchTerm'] = search
+        response = call(creds, 'namecheap.domains.getList', **params)
+        batch = list(response.find(NS + 'DomainGetListResult').iter(NS + 'Domain'))
+        out.extend(batch)
+        paging = response.find(NS + 'Paging')
+        total = int(text(paging, 'TotalItems') or len(out))
+        if not batch or len(out) >= total:
+            return out
+        page += 1
+
+
+def cmd_domains(args):
+    list_type = 'EXPIRING' if args.expiring else 'EXPIRED' if args.expired else 'ALL'
+    domains = all_domains(load_creds(), list_type, args.search)
+    print(f'{len(domains)} domain(s):')
+    for domain in domains:
+        flags = [label for label, attr in (('auto-renew', 'AutoRenew'), ('locked', 'IsLocked'), ('privacy', 'WhoisGuard'))
+                 if (domain.get(attr) or '').lower() in ('true', 'enabled')]
+        dns = 'Namecheap DNS' if (domain.get('IsOurDNS') or '').lower() == 'true' else 'custom NS'
+        print(f"  {domain.get('Name'):<32} expires {domain.get('Expires'):<11} {dns:<14} {' '.join(flags)}")
+
+
+def cmd_info(args):
+    creds = load_creds()
+    result = call(creds, 'namecheap.domains.getInfo', DomainName=args.domain).find(NS + 'DomainGetInfoResult')
+    details = result.find(NS + 'DomainDetails')
+    privacy = result.find(NS + 'Whoisguard')
+    dns = result.find(NS + 'DnsDetails')
+    print(f"{result.get('DomainName')}: status {result.get('Status')}, owner {result.get('OwnerName')}, "
+          f"premium {result.get('IsPremium')}")
+    print(f"  created {text(details, 'CreatedDate')}, expires {text(details, 'ExpiredDate')}")
+    print(f"  privacy {privacy.get('Enabled') if privacy is not None else '?'}"
+          f"{' until ' + text(privacy, 'ExpiredDate') if privacy is not None and text(privacy, 'ExpiredDate') else ''}")
+    if dns is not None:
+        servers = [(server.text or '').strip() for server in dns.iter(NS + 'Nameserver')]
+        print(f"  DNS {dns.get('ProviderType')}: {', '.join(servers) or '(none listed)'}")
+    lock = call(creds, 'namecheap.domains.getRegistrarLock', DomainName=args.domain).find(NS + 'DomainGetRegistrarLockResult')
+    print(f"  registrar lock {lock.get('RegistrarLockStatus') if lock is not None else '?'}")
+
+
+CONTACT_ROLES = ('Registrant', 'Tech', 'Admin', 'AuxBilling')
+CONTACT_FIELDS = ('OrganizationName', 'JobTitle', 'FirstName', 'LastName', 'Address1', 'Address2', 'City',
+                  'StateProvince', 'StateProvinceChoice', 'PostalCode', 'Country', 'Phone', 'PhoneExt', 'Fax',
+                  'EmailAddress')
+
+
+def get_contacts(creds, domain):
+    result = call(creds, 'namecheap.domains.getContacts', DomainName=domain).find(NS + 'DomainContactsResult')
+    return {role: {field: text(result.find(NS + role), field) for field in CONTACT_FIELDS} for role in CONTACT_ROLES}
+
+
+def cmd_contacts(args):
+    for role, fields in get_contacts(load_creds(), args.domain).items():
+        name = ' '.join(filter(None, (fields['FirstName'], fields['LastName'])))
+        place = ', '.join(filter(None, (fields['City'], fields['StateProvince'], fields['Country'])))
+        print(f"  {role:<10} {name} <{fields['EmailAddress']}> {fields['OrganizationName']} {place}".rstrip())
+
+
+def cmd_available(args):
+    result = call(load_creds(), 'namecheap.domains.check', DomainList=','.join(args.domains))
+    for domain in result.iter(NS + 'DomainCheckResult'):
+        available = (domain.get('Available') or '').lower() == 'true'
+        premium = (domain.get('IsPremiumName') or '').lower() == 'true'
+        price = f" premium {domain.get('PremiumRegistrationPrice')}" if premium else ''
+        print(f"  {domain.get('Domain'):<32} {'AVAILABLE' if available else 'taken'}{price}")
+
+
+def tld_price(creds, tld, action, years=1):
+    response = call(creds, 'namecheap.users.getPricing', ProductType='DOMAIN',
+                    ProductCategory=action.upper(), ProductName=tld)
+    for product in response.iter(NS + 'Product'):
+        for price in product.iter(NS + 'Price'):
+            if price.get('Duration') == str(years):
+                return price
+    return None
+
+
+def cmd_price(args):
+    tld = args.tld.lstrip('.').lower()
+    price = tld_price(load_creds(), tld, args.action, args.years)
+    if price is None:
+        sys.exit(f'No {args.action} price for .{tld} ({args.years} year).')
+    print(f".{tld} {args.action} {args.years} year(s): {price.get('YourPrice') or price.get('Price')} {price.get('Currency')}"
+          f" (list {price.get('RegularPrice') or price.get('Price')}{', +ICANN fee ' + price.get('YourAdditonalCost') if price.get('YourAdditonalCost') else ''})")
+
+
+def money_gate(creds, what, price_node, years, yes):
+    balance = call(creds, 'namecheap.users.getBalances').find(NS + 'UserGetBalancesResult')
+    cost = price_node.get('YourPrice') or price_node.get('Price') if price_node is not None else '?'
+    currency = price_node.get('Currency') if price_node is not None else ''
+    print(f"{what}: {cost} {currency} per year x {years}; account balance {balance.get('AvailableBalance')} {balance.get('Currency')}")
+    if not yes:
+        sys.exit('Not charged. This spends money: confirm the item and total with the user, then re-run with --yes.')
+
+
+def cmd_renew(args):
+    creds = load_creds()
+    _, tld = split_domain(args.domain)
+    money_gate(creds, f'Renew {args.domain}', tld_price(creds, tld, 'renew', 1), args.years, args.yes)
+    result = call(creds, 'namecheap.domains.renew', DomainName=args.domain, Years=args.years).find(NS + 'DomainRenewResult')
+    print(f"Renewed {args.domain}: charged {result.get('ChargedAmount')}, order {result.get('OrderID')}")
+
+
+def cmd_register(args):
+    creds = load_creds()
+    _, tld = split_domain(args.domain)
+    check = call(creds, 'namecheap.domains.check', DomainList=args.domain).find(NS + 'DomainCheckResult')
+    if (check.get('Available') or '').lower() != 'true':
+        sys.exit(f'{args.domain} is not available.')
+    if (check.get('IsPremiumName') or '').lower() == 'true':
+        sys.exit(f"{args.domain} is a premium name ({check.get('PremiumRegistrationPrice')}); register it in the dashboard.")
+    contacts = get_contacts(creds, args.contacts_from)
+    money_gate(creds, f'Register {args.domain}', tld_price(creds, tld, 'register', 1), args.years, args.yes)
+    params = {'DomainName': args.domain, 'Years': args.years, 'AddFreeWhoisguard': 'yes', 'WGEnabled': 'yes'}
+    for role, fields in contacts.items():
+        for field, value in fields.items():
+            if value:
+                params[role + field] = value
+    if args.nameservers:
+        params['Nameservers'] = ','.join(args.nameservers)
+    result = call(creds, 'namecheap.domains.create', **params).find(NS + 'DomainCreateResult')
+    print(f"Registered {result.get('Domain')}: {result.get('Registered')}, charged {result.get('ChargedAmount')}, "
+          f"order {result.get('OrderID')}, privacy on")
+
+
+def cmd_transfers(_args):
+    result = call(load_creds(), 'namecheap.domains.transfer.getList', PageSize=100).find(NS + 'TransferGetListResult')
+    transfers = list(result.iter(NS + 'Transfer')) if result is not None else []
+    print(f'{len(transfers)} transfer(s):')
+    for transfer in transfers:
+        print(f"  {transfer.get('DomainName'):<32} {transfer.get('Status')} ({transfer.get('StatusDescription')}) "
+              f"id {transfer.get('ID')} {transfer.get('TransferDate')}")
+
+
+def cmd_nameservers(args):
+    creds = load_creds()
+    sld, tld = split_domain(args.domain)
+    if args.set and args.default:
+        sys.exit('Use --set or --default, not both.')
+    if args.set:
+        if len(args.set) < 2:
+            sys.exit('Give at least two nameservers.')
+        print(f"{args.domain}: nameservers -> {', '.join(args.set)}. Namecheap's own records stop being served.")
+        if not args.yes:
+            sys.exit('Not changed: re-run with --yes (it moves the whole domain to another DNS host).')
+        call(creds, 'namecheap.domains.dns.setCustom', SLD=sld, TLD=tld, Nameservers=','.join(args.set))
+    elif args.default:
+        print(f'{args.domain}: nameservers -> Namecheap BasicDNS.')
+        if not args.yes:
+            sys.exit('Not changed: re-run with --yes (records at the current DNS host stop being served).')
+        call(creds, 'namecheap.domains.dns.setDefault', SLD=sld, TLD=tld)
+    result = call(creds, 'namecheap.domains.dns.getList', SLD=sld, TLD=tld).find(NS + 'DomainDNSGetListResult')
+    servers = [(server.text or '').strip() for server in result.iter(NS + 'Nameserver')]
+    kind = 'Namecheap DNS' if (result.get('IsUsingOurDNS') or '').lower() == 'true' else 'custom'
+    print(f"{args.domain}: {kind}: {', '.join(servers)}")
+
+
+def cmd_lock(args):
+    creds = load_creds()
+    if args.on or args.off:
+        call(creds, 'namecheap.domains.setRegistrarLock', DomainName=args.domain, LockAction='LOCK' if args.on else 'UNLOCK')
+    result = call(creds, 'namecheap.domains.getRegistrarLock', DomainName=args.domain).find(NS + 'DomainGetRegistrarLockResult')
+    print(f"{args.domain}: registrar lock {result.get('RegistrarLockStatus')}")
+
+
+def cmd_privacy(args):
+    creds = load_creds()
+    result = call(creds, 'namecheap.whoisguard.getList', PageSize=100, ListType='ALL').find(NS + 'WhoisguardGetListResult')
+    entries = list(result.iter(NS + 'Whoisguard')) if result is not None else []
+    if args.domain:
+        entries = [entry for entry in entries if (entry.get('DomainName') or '').lower() == args.domain.lower()]
+        if not entries:
+            sys.exit(f'No domain privacy subscription found for {args.domain}.')
+    if args.on or args.off:
+        if not args.domain:
+            sys.exit('Name the domain to change.')
+        entry = entries[0]
+        if args.on:
+            email = args.email or get_contacts(creds, args.domain)['Registrant']['EmailAddress']
+            call(creds, 'namecheap.whoisguard.enable', WhoisguardID=entry.get('ID'), ForwardedToEmail=email)
+        else:
+            call(creds, 'namecheap.whoisguard.disable', WhoisguardID=entry.get('ID'))
+        return cmd_privacy(argparse.Namespace(domain=args.domain, on=False, off=False, email=None))
+    for entry in entries:
+        print(f"  {entry.get('DomainName') or '(unassigned)':<32} {entry.get('Status'):<10} id {entry.get('ID')} expires {entry.get('Expires')}")
+
+
+def cmd_lookup(args):
+    """Resolve through Google and Cloudflare DNS-over-HTTPS; works where dig is not installed."""
+    for resolver in ('https://dns.google/resolve', 'https://cloudflare-dns.com/dns-query'):
+        url = f'{resolver}?' + urllib.parse.urlencode({'name': args.name, 'type': args.type.upper()})
+        request = urllib.request.Request(url, headers={'Accept': 'application/dns-json'})
+        try:
+            with urllib.request.urlopen(request, timeout=10) as response:
+                answers = json.load(response).get('Answer', [])
+        except (urllib.error.URLError, OSError, ValueError):
+            continue
+        records = [answer['data'] for answer in answers]
+        print(f"{args.name} {args.type.upper()} via {resolver.split('/')[2]}: " + (', '.join(records) or '(no answer)'))
+        if args.type.upper() == 'NS' and any('registrar-servers.com' in record for record in records):
+            print('-> Namecheap BasicDNS: use this tool.')
+        return
+    sys.exit('Both DNS-over-HTTPS resolvers were unreachable.')
+
+
+def cmd_restore(args):
+    saved = json.loads(Path(args.backup).read_text())
+    creds = load_creds()
+    state = get_hosts(creds, saved['domain'])
+    removed = [record for record in state['records'] if not any(same(record, old) for old in saved['records'])]
+    added = [record for record in saved['records'] if not any(same(record, live) for live in state['records'])]
+    apply(creds, saved['domain'], state, saved['records'], removed, added, args.dry_run, email_type=saved['email_type'])
+
+
+def main():
+    parser = argparse.ArgumentParser(prog='namecheap', description=__doc__,
+                                     formatter_class=argparse.RawDescriptionHelpFormatter)
+    sub = parser.add_subparsers(dest='command', required=True)
+
+    p = sub.add_parser('setup', help='store API credentials, then check them')
+    p.add_argument('api_user')
+    p.add_argument('api_key', nargs='?', help='omit to be prompted (keeps it out of shell history)')
+    p.add_argument('--username')
+    p.add_argument('--client-ip')
+    p.set_defaults(func=cmd_setup)
+
+    sub.add_parser('check', help='verify credentials and list domains').set_defaults(func=cmd_check)
+
+    sub.add_parser('balance', help='account balance').set_defaults(func=cmd_balance)
+
+    p = sub.add_parser('domains', help='list domains in the account')
+    p.add_argument('--expiring', action='store_true')
+    p.add_argument('--expired', action='store_true')
+    p.add_argument('--search')
+    p.set_defaults(func=cmd_domains)
+
+    p = sub.add_parser('info', help='status, expiry, privacy, nameservers, lock')
+    p.add_argument('domain')
+    p.set_defaults(func=cmd_info)
+
+    p = sub.add_parser('contacts', help='WHOIS contacts on a domain')
+    p.add_argument('domain')
+    p.set_defaults(func=cmd_contacts)
+
+    p = sub.add_parser('available', help='is a domain free to register')
+    p.add_argument('domains', nargs='+')
+    p.set_defaults(func=cmd_available)
+
+    p = sub.add_parser('price', help='your price for a TLD')
+    p.add_argument('tld')
+    p.add_argument('--action', choices=('register', 'renew', 'transfer'), default='register')
+    p.add_argument('--years', type=int, default=1)
+    p.set_defaults(func=cmd_price)
+
+    p = sub.add_parser('register', help='buy a domain (price first; --yes to charge)')
+    p.add_argument('domain')
+    p.add_argument('--contacts-from', required=True, metavar='OWNED_DOMAIN', help='copy WHOIS contacts from a domain you own')
+    p.add_argument('--years', type=int, default=1)
+    p.add_argument('--nameservers', nargs='+', help='custom nameservers (default: Namecheap BasicDNS)')
+    p.add_argument('--yes', action='store_true', help='actually charge the account')
+    p.set_defaults(func=cmd_register)
+
+    p = sub.add_parser('renew', help='renew a domain (price first; --yes to charge)')
+    p.add_argument('domain')
+    p.add_argument('--years', type=int, default=1)
+    p.add_argument('--yes', action='store_true', help='actually charge the account')
+    p.set_defaults(func=cmd_renew)
+
+    sub.add_parser('transfers', help='incoming domain transfers').set_defaults(func=cmd_transfers)
+
+    p = sub.add_parser('nameservers', help='show or change nameservers')
+    p.add_argument('domain')
+    p.add_argument('--set', nargs='+', metavar='NS')
+    p.add_argument('--default', action='store_true', help='back to Namecheap BasicDNS')
+    p.add_argument('--yes', action='store_true', help='confirm the switch')
+    p.set_defaults(func=cmd_nameservers)
+
+    p = sub.add_parser('lock', help='show or change the registrar lock')
+    p.add_argument('domain')
+    group = p.add_mutually_exclusive_group()
+    group.add_argument('--on', action='store_true')
+    group.add_argument('--off', action='store_true')
+    p.set_defaults(func=cmd_lock)
+
+    p = sub.add_parser('privacy', help='show or change free domain privacy')
+    p.add_argument('domain', nargs='?')
+    group = p.add_mutually_exclusive_group()
+    group.add_argument('--on', action='store_true')
+    group.add_argument('--off', action='store_true')
+    p.add_argument('--email', help='where privacy forwards mail (default: the registrant email)')
+    p.set_defaults(func=cmd_privacy)
+
+    p = sub.add_parser('list', help='show host records')
+    p.add_argument('domain')
+    p.set_defaults(func=cmd_list)
+
+    p = sub.add_parser('set', help='add/remove host records (merged, backed up, verified)')
+    p.add_argument('domain')
+    p.add_argument('--add', action='append', default=[], metavar='"TYPE HOST VALUE [TTL] [MXPREF]"')
+    p.add_argument('--remove', action='append', default=[], metavar='"TYPE HOST [VALUE]"')
+    p.add_argument('--replace', action='store_true', help='swap out records that conflict with an added one')
+    p.add_argument('--dry-run', action='store_true')
+    p.set_defaults(func=cmd_set)
+
+    p = sub.add_parser('vercel', help='point the apex + www (or --sub names) at Vercel')
+    p.add_argument('domain')
+    p.add_argument('--sub', action='append', metavar='NAME', help='subdomain(s) to CNAME to Vercel instead of @ + www')
+    p.add_argument('--dry-run', action='store_true')
+    p.set_defaults(func=cmd_vercel)
+
+    p = sub.add_parser('forward', help='list or change free email forwarding')
+    p.add_argument('domain')
+    p.add_argument('--add', action='append', default=[], metavar='mailbox=destination')
+    p.add_argument('--remove', action='append', default=[], metavar='mailbox')
+    p.add_argument('--force', action='store_true', help='allow switching a domain off MX mail to forwarding')
+    p.add_argument('--dry-run', action='store_true')
+    p.set_defaults(func=cmd_forward)
+
+    p = sub.add_parser('lookup', help='resolve a name over DNS-over-HTTPS (no dig needed)')
+    p.add_argument('name')
+    p.add_argument('type', nargs='?', default='A')
+    p.set_defaults(func=cmd_lookup)
+
+    p = sub.add_parser('restore', help='put a backup back')
+    p.add_argument('backup')
+    p.add_argument('--dry-run', action='store_true')
+    p.set_defaults(func=cmd_restore)
+
+    args = parser.parse_args()
+    try:
+        args.func(args)
+    except ApiError as error:
+        sys.exit(f'Namecheap API error: {error}')
+    except urllib.error.URLError as error:
+        sys.exit(f'Could not reach the Namecheap API: {error}')
+
+
+if __name__ == '__main__':
+    main()

package/dist/agent-skills.d.ts

@@ -4,9 +4,11 @@ export type AgentSkillTarget = {
 };
 export declare function agentSkillsSourceDir(): string;
 export declare function agentSkillTargets(home?: string, env?: NodeJS.ProcessEnv): AgentSkillTarget[];
+export declare const RETIRED_AGENT_SKILLS: string[];
 export type InstallResult = {
     installed: string[];
     updatedFiles: number;
+    removed: string[];
 };
 export declare function installAgentSkills(options?: {
     sourceDir?: string;

package/dist/agent-skills.js

@@ -23,6 +23,10 @@ async function listFiles(root, rel = "") {
     }
     return files;
 }
+// Skills Rudder once shipped under another name. Their rudder-<name> copies are
+// Rudder's own (never the user's), so an upgrade removes them rather than leave
+// agents two skills for the same job.
+export const RETIRED_AGENT_SKILLS = ["namecheap-dns"];
 export async function installAgentSkills(options = {}) {
     const sourceDir = options.sourceDir ?? agentSkillsSourceDir();
     const targets = options.targets ?? agentSkillTargets();
@@ -31,7 +35,7 @@ export async function installAgentSkills(options = {}) {
         skills = (await fsp.readdir(sourceDir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
     }
     catch {
-        return { installed: [], updatedFiles: 0 };
+        return { installed: [], updatedFiles: 0, removed: [] };
     }
     const installed = [];
     let updatedFiles = 0;
@@ -57,7 +61,19 @@ export async function installAgentSkills(options = {}) {
             installed.push(`${target.agent}:rudder-${skill}`);
         }
     }
-    return { installed, updatedFiles };
+    const removed = [];
+    for (const retired of RETIRED_AGENT_SKILLS) {
+        if (skills.includes(retired))
+            continue;
+        for (const target of targets) {
+            const dir = path.join(target.dir, `rudder-${retired}`);
+            if (!(await fsp.stat(dir).catch(() => null)))
+                continue;
+            await fsp.rm(dir, { recursive: true, force: true });
+            removed.push(`${target.agent}:rudder-${retired}`);
+        }
+    }
+    return { installed, updatedFiles, removed };
 }
 /** Best effort: a read-only home or odd permissions must never block a run. */
 export async function ensureAgentSkills(env = process.env) {

package/dist/agent-skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-skills.js","sourceRoot":"","sources":["../src/agent-skills.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAWzC,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,MAAyB,OAAO,CAAC,GAAG;IACzF,OAAO;QACL,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,EAAE;QAClG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,EAAE;KAC1F,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,GAAG,GAAG,EAAE;IAC7C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;aAClE,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAgE,EAAE;IACzG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,iBAAiB,EAAE,CAAC;IACvD,IAAI,MAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACjD,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACjC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC;oBAAE,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBACtE,YAAY,EAAE,CAAC;YACjB,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,WAAW,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,IAAI,GAAG,CAAC,2BAA2B,KAAK,GAAG;QAAE,OAAO;IACpD,MAAM,kBAAkB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"agent-skills.js","sourceRoot":"","sources":["../src/agent-skills.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAWzC,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,MAAyB,OAAO,CAAC,GAAG;IACzF,OAAO;QACL,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,EAAE;QAClG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,EAAE;KAC1F,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,GAAG,GAAG,EAAE;IAC7C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;aAClE,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,sCAAsC;AACtC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,eAAe,CAAC,CAAC;AAItD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAgE,EAAE;IACzG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,iBAAiB,EAAE,CAAC;IACvD,IAAI,MAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACjD,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACjC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC;oBAAE,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBACtE,YAAY,EAAE,CAAC;YACjB,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,WAAW,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACvD,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,WAAW,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,IAAI,GAAG,CAAC,2BAA2B,KAAK,GAAG;QAAE,OAAO;IACpD,MAAM,kBAAkB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACpD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viraatdas/rudder",
-  "version": "3.9.2",
+  "version": "3.9.5",
   "description": "A TUI for managing coding agents: run Claude Code, Codex and opencode side by side, each in its own isolated jj workspace.",
   "keywords": [
     "tui",