cloudhop 1.0.0 → 1.1.0

package/dist/cli.js

@@ -41,62 +41,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// ../../node_modules/.pnpm/sisteransi@1.0.5/node_modules/sisteransi/src/index.js
-var require_src = __commonJS({
-  "../../node_modules/.pnpm/sisteransi@1.0.5/node_modules/sisteransi/src/index.js"(exports, module) {
-    "use strict";
-    var ESC2 = "\x1B";
-    var CSI2 = `${ESC2}[`;
-    var beep = "\x07";
-    var cursor3 = {
-      to(x2, y2) {
-        if (!y2) return `${CSI2}${x2 + 1}G`;
-        return `${CSI2}${y2 + 1};${x2 + 1}H`;
-      },
-      move(x2, y2) {
-        let ret = "";
-        if (x2 < 0) ret += `${CSI2}${-x2}D`;
-        else if (x2 > 0) ret += `${CSI2}${x2}C`;
-        if (y2 < 0) ret += `${CSI2}${-y2}A`;
-        else if (y2 > 0) ret += `${CSI2}${y2}B`;
-        return ret;
-      },
-      up: (count = 1) => `${CSI2}${count}A`,
-      down: (count = 1) => `${CSI2}${count}B`,
-      forward: (count = 1) => `${CSI2}${count}C`,
-      backward: (count = 1) => `${CSI2}${count}D`,
-      nextLine: (count = 1) => `${CSI2}E`.repeat(count),
-      prevLine: (count = 1) => `${CSI2}F`.repeat(count),
-      left: `${CSI2}G`,
-      hide: `${CSI2}?25l`,
-      show: `${CSI2}?25h`,
-      save: `${ESC2}7`,
-      restore: `${ESC2}8`
-    };
-    var scroll = {
-      up: (count = 1) => `${CSI2}S`.repeat(count),
-      down: (count = 1) => `${CSI2}T`.repeat(count)
-    };
-    var erase3 = {
-      screen: `${CSI2}2J`,
-      up: (count = 1) => `${CSI2}1J`.repeat(count),
-      down: (count = 1) => `${CSI2}J`.repeat(count),
-      line: `${CSI2}2K`,
-      lineEnd: `${CSI2}K`,
-      lineStart: `${CSI2}1K`,
-      lines(count) {
-        let clear = "";
-        for (let i2 = 0; i2 < count; i2++)
-          clear += this.line + (i2 < count - 1 ? cursor3.up() : "");
-        if (count)
-          clear += cursor3.left;
-        return clear;
-      }
-    };
-    module.exports = { cursor: cursor3, scroll, erase: erase3, beep };
-  }
-});
-
 // ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/nodes/identity.js"(exports) {
@@ -1064,14 +1008,14 @@ var require_foldFlowLines = __commonJS({
     var FOLD_FLOW = "flow";
     var FOLD_BLOCK = "block";
     var FOLD_QUOTED = "quoted";
-    function foldFlowLines(text3, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
+    function foldFlowLines(text4, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
       if (!lineWidth || lineWidth < 0)
-        return text3;
+        return text4;
       if (lineWidth < minContentWidth)
         minContentWidth = 0;
       const endStep = Math.max(1 + minContentWidth, 1 + lineWidth - indent.length);
-      if (text3.length <= endStep)
-        return text3;
+      if (text4.length <= endStep)
+        return text4;
       const folds = [];
       const escapedFolds = {};
       let end = lineWidth - indent.length;
@@ -1088,14 +1032,14 @@ var require_foldFlowLines = __commonJS({
       let escStart = -1;
       let escEnd = -1;
       if (mode === FOLD_BLOCK) {
-        i2 = consumeMoreIndentedLines(text3, i2, indent.length);
+        i2 = consumeMoreIndentedLines(text4, i2, indent.length);
         if (i2 !== -1)
           end = i2 + endStep;
       }
-      for (let ch; ch = text3[i2 += 1]; ) {
+      for (let ch; ch = text4[i2 += 1]; ) {
         if (mode === FOLD_QUOTED && ch === "\\") {
           escStart = i2;
-          switch (text3[i2 + 1]) {
+          switch (text4[i2 + 1]) {
             case "x":
               i2 += 3;
               break;
@@ -1112,12 +1056,12 @@ var require_foldFlowLines = __commonJS({
         }
         if (ch === "\n") {
           if (mode === FOLD_BLOCK)
-            i2 = consumeMoreIndentedLines(text3, i2, indent.length);
+            i2 = consumeMoreIndentedLines(text4, i2, indent.length);
           end = i2 + indent.length + endStep;
           split = void 0;
         } else {
           if (ch === " " && prev && prev !== " " && prev !== "\n" && prev !== "	") {
-            const next = text3[i2 + 1];
+            const next = text4[i2 + 1];
             if (next && next !== " " && next !== "\n" && next !== "	")
               split = i2;
           }
@@ -1129,12 +1073,12 @@ var require_foldFlowLines = __commonJS({
             } else if (mode === FOLD_QUOTED) {
               while (prev === " " || prev === "	") {
                 prev = ch;
-                ch = text3[i2 += 1];
+                ch = text4[i2 += 1];
                 overflow = true;
               }
               const j2 = i2 > escEnd + 1 ? i2 - 2 : escStart - 1;
               if (escapedFolds[j2])
-                return text3;
+                return text4;
               folds.push(j2);
               escapedFolds[j2] = true;
               end = j2 + endStep;
@@ -1149,39 +1093,39 @@ var require_foldFlowLines = __commonJS({
       if (overflow && onOverflow)
         onOverflow();
       if (folds.length === 0)
-        return text3;
+        return text4;
       if (onFold)
         onFold();
-      let res = text3.slice(0, folds[0]);
+      let res = text4.slice(0, folds[0]);
       for (let i3 = 0; i3 < folds.length; ++i3) {
         const fold = folds[i3];
-        const end2 = folds[i3 + 1] || text3.length;
+        const end2 = folds[i3 + 1] || text4.length;
         if (fold === 0)
           res = `
-${indent}${text3.slice(0, end2)}`;
+${indent}${text4.slice(0, end2)}`;
         else {
           if (mode === FOLD_QUOTED && escapedFolds[fold])
-            res += `${text3[fold]}\\`;
+            res += `${text4[fold]}\\`;
           res += `
-${indent}${text3.slice(fold + 1, end2)}`;
+${indent}${text4.slice(fold + 1, end2)}`;
         }
       }
       return res;
     }
-    function consumeMoreIndentedLines(text3, i2, indent) {
+    function consumeMoreIndentedLines(text4, i2, indent) {
       let end = i2;
       let start = i2 + 1;
-      let ch = text3[start];
+      let ch = text4[start];
       while (ch === " " || ch === "	") {
         if (i2 < start + indent) {
-          ch = text3[++i2];
+          ch = text4[++i2];
         } else {
           do {
-            ch = text3[++i2];
+            ch = text4[++i2];
           } while (ch && ch !== "\n");
           end = i2;
           start = i2 + 1;
-          ch = text3[start];
+          ch = text4[start];
         }
       }
       return end;
@@ -7427,92 +7371,319 @@ var require_dist = __commonJS({
   }
 });
 
-// ../core/src/domain/errors.ts
-var CloudhopError = class extends Error {
-  constructor(code, message, hint) {
-    super(message);
-    this.code = code;
-    this.hint = hint;
-    this.name = "CloudhopError";
+// ../../node_modules/.pnpm/sisteransi@1.0.5/node_modules/sisteransi/src/index.js
+var require_src = __commonJS({
+  "../../node_modules/.pnpm/sisteransi@1.0.5/node_modules/sisteransi/src/index.js"(exports, module) {
+    "use strict";
+    var ESC2 = "\x1B";
+    var CSI2 = `${ESC2}[`;
+    var beep = "\x07";
+    var cursor3 = {
+      to(x2, y2) {
+        if (!y2) return `${CSI2}${x2 + 1}G`;
+        return `${CSI2}${y2 + 1};${x2 + 1}H`;
+      },
+      move(x2, y2) {
+        let ret = "";
+        if (x2 < 0) ret += `${CSI2}${-x2}D`;
+        else if (x2 > 0) ret += `${CSI2}${x2}C`;
+        if (y2 < 0) ret += `${CSI2}${-y2}A`;
+        else if (y2 > 0) ret += `${CSI2}${y2}B`;
+        return ret;
+      },
+      up: (count = 1) => `${CSI2}${count}A`,
+      down: (count = 1) => `${CSI2}${count}B`,
+      forward: (count = 1) => `${CSI2}${count}C`,
+      backward: (count = 1) => `${CSI2}${count}D`,
+      nextLine: (count = 1) => `${CSI2}E`.repeat(count),
+      prevLine: (count = 1) => `${CSI2}F`.repeat(count),
+      left: `${CSI2}G`,
+      hide: `${CSI2}?25l`,
+      show: `${CSI2}?25h`,
+      save: `${ESC2}7`,
+      restore: `${ESC2}8`
+    };
+    var scroll = {
+      up: (count = 1) => `${CSI2}S`.repeat(count),
+      down: (count = 1) => `${CSI2}T`.repeat(count)
+    };
+    var erase3 = {
+      screen: `${CSI2}2J`,
+      up: (count = 1) => `${CSI2}1J`.repeat(count),
+      down: (count = 1) => `${CSI2}J`.repeat(count),
+      line: `${CSI2}2K`,
+      lineEnd: `${CSI2}K`,
+      lineStart: `${CSI2}1K`,
+      lines(count) {
+        let clear = "";
+        for (let i2 = 0; i2 < count; i2++)
+          clear += this.line + (i2 < count - 1 ? cursor3.up() : "");
+        if (count)
+          clear += cursor3.left;
+        return clear;
+      }
+    };
+    module.exports = { cursor: cursor3, scroll, erase: erase3, beep };
   }
-  code;
-  hint;
-};
+});
 
-// ../core/src/domain/naming.ts
-var RESERVED_NAMES = /* @__PURE__ */ new Set([
-  "add",
-  "alias",
-  "login",
-  "region",
-  "setup",
-  "sync",
-  "ls",
-  "list",
-  "rm",
-  "remove",
-  "doctor",
-  "exec",
-  "provider",
-  "ui",
-  "help",
-  "version"
-]);
-var NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,62}$/;
-function assertValidName(kind, name) {
-  if (!NAME_PATTERN.test(name)) {
-    throw new CloudhopError(
-      "INVALID_NAME",
-      `Invalid ${kind} name "${name}".`,
-      'Use lowercase letters, numbers, "-" or "_" (max 63 characters).'
-    );
-  }
-  if (kind === "alias" && RESERVED_NAMES.has(name)) {
-    throw new CloudhopError(
-      "INVALID_NAME",
-      `"${name}" is a cloudhop command.`,
-      "Pick another alias name."
-    );
+// ../adapters-node/src/node-browser-opener.ts
+import { spawn } from "child_process";
+var NodeBrowserOpener = class {
+  async open(url) {
+    const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", '""', url.replace(/&/g, "^&")]] : ["xdg-open", [url]];
+    await new Promise((resolve) => {
+      const child = spawn(command, args, { stdio: "ignore", detached: true });
+      child.on("error", () => resolve());
+      child.on("spawn", () => {
+        child.unref();
+        resolve();
+      });
+    });
   }
-}
-function suggestAliasName(...parts) {
-  const slug = parts.join("-").toLowerCase().replace(/access$/i, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
-  return slug || "alias";
-}
+};
 
-// ../core/src/domain/version.ts
-function compareVersions(a2, b3) {
-  const pa = a2.split(".").map((n3) => Number.parseInt(n3, 10) || 0);
-  const pb = b3.split(".").map((n3) => Number.parseInt(n3, 10) || 0);
-  for (let i2 = 0; i2 < Math.max(pa.length, pb.length); i2++) {
-    const diff = (pa[i2] ?? 0) - (pb[i2] ?? 0);
-    if (diff !== 0) return diff;
+// ../adapters-node/src/node-process-runner.ts
+import { spawn as spawn2 } from "child_process";
+var STDERR_TAIL_BYTES = 8 * 1024;
+function buildEnv(overrides) {
+  const env = { ...process.env };
+  for (const [key, value] of Object.entries(overrides ?? {})) {
+    if (value === void 0) delete env[key];
+    else env[key] = value;
   }
-  return 0;
+  return env;
 }
-
-// ../core/src/application/cloudhop-app.ts
-var CloudhopApp = class {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  deps;
-  // ── Providers ────────────────────────────────────────────────────────────
-  availableProviders() {
-    return this.deps.providers;
+var useShell = process.platform === "win32";
+var NodeProcessRunner = class {
+  run(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+      const child = spawn2(command, args, {
+        env: buildEnv(options.env),
+        stdio: ["inherit", "inherit", options.captureStderr ? "pipe" : "inherit"],
+        shell: useShell
+      });
+      let tail = "";
+      child.stderr?.on("data", (chunk) => {
+        process.stderr.write(chunk);
+        tail = (tail + chunk.toString()).slice(-STDERR_TAIL_BYTES);
+      });
+      const ignore = () => {
+      };
+      process.on("SIGINT", ignore);
+      process.on("SIGTERM", ignore);
+      const cleanup = () => {
+        process.off("SIGINT", ignore);
+        process.off("SIGTERM", ignore);
+      };
+      child.on("error", (error) => {
+        cleanup();
+        reject(error);
+      });
+      child.on("close", (code, signal) => {
+        cleanup();
+        resolve({ exitCode: code ?? (signal ? 128 + 2 : 1), stderrTail: tail });
+      });
+    });
   }
-  provider(id) {
-    const provider = this.deps.providers.find((p3) => p3.id === id);
-    if (!provider) {
-      throw new CloudhopError(
-        "PROVIDER_NOT_AVAILABLE",
-        `The ${id} provider is not available yet.`,
-        "Follow https://github.com/dayepesb/cloudhop for upcoming providers."
-      );
-    }
-    return provider;
+  capture(command, args, options = {}) {
+    return new Promise((resolve) => {
+      const child = spawn2(command, args, { env: buildEnv(options.env), shell: useShell });
+      child.stdin.end();
+      let stdout2 = "";
+      let stderr = "";
+      child.stdout.on("data", (c3) => {
+        stdout2 += c3.toString();
+      });
+      child.stderr.on("data", (c3) => {
+        stderr += c3.toString();
+      });
+      child.on("error", (error) => resolve({ exitCode: 127, stdout: stdout2, stderr: error.message }));
+      child.on("close", (code) => resolve({ exitCode: code ?? 1, stdout: stdout2, stderr }));
+    });
   }
-  async config() {
+  async probe(command) {
+    const result = await this.capture(command, ["--version"]);
+    if (result.exitCode !== 0) return { installed: false };
+    const output = `${result.stdout} ${result.stderr}`;
+    const version = output.match(/(\d+\.\d+\.\d+)/)?.[1];
+    return { installed: true, ...version ? { version } : {} };
+  }
+};
+
+// ../adapters-node/src/system-tool-installer.ts
+var TOOLS = {
+  aws: {
+    manualUrl: "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html",
+    recipes: {
+      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "awscli"] }],
+      win32: [
+        { via: "winget", command: "winget", args: ["install", "--exact", "--id", "Amazon.AWSCLI"] }
+      ]
+    }
+  },
+  az: {
+    manualUrl: "https://learn.microsoft.com/cli/azure/install-azure-cli",
+    recipes: {
+      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "azure-cli"] }],
+      win32: [
+        {
+          via: "winget",
+          command: "winget",
+          args: ["install", "--exact", "--id", "Microsoft.AzureCLI"]
+        }
+      ]
+    }
+  },
+  gcloud: {
+    manualUrl: "https://cloud.google.com/sdk/docs/install",
+    recipes: {
+      darwin: [
+        { via: "Homebrew", command: "brew", args: ["install", "--cask", "google-cloud-sdk"] }
+      ],
+      win32: [
+        {
+          via: "winget",
+          command: "winget",
+          args: ["install", "--exact", "--id", "Google.CloudSDK"]
+        }
+      ]
+    }
+  }
+};
+var SystemToolInstaller = class {
+  constructor(runner, platform = process.platform) {
+    this.runner = runner;
+    this.platform = platform;
+  }
+  runner;
+  platform;
+  available = /* @__PURE__ */ new Map();
+  recipeFor(command) {
+    const tool = TOOLS[command];
+    if (!tool) return void 0;
+    const recipe = tool.recipes[this.platform]?.[0];
+    return recipe ? { ...recipe, manualUrl: tool.manualUrl } : { via: "official installer", command: "", args: [], manualUrl: tool.manualUrl };
+  }
+  async install(recipe) {
+    if (!recipe.command) return false;
+    if (!await this.hasCommand(recipe.command)) return false;
+    const { exitCode } = await this.runner.run(recipe.command, recipe.args);
+    return exitCode === 0;
+  }
+  async hasCommand(command) {
+    if (!this.available.has(command)) {
+      this.available.set(command, (await this.runner.probe(command)).installed);
+    }
+    return this.available.get(command) ?? false;
+  }
+};
+
+// ../adapters-node/src/yaml-config-store.ts
+import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+
+// ../core/src/domain/errors.ts
+var CloudhopError = class extends Error {
+  constructor(code, message, hint) {
+    super(message);
+    this.code = code;
+    this.hint = hint;
+    this.name = "CloudhopError";
+  }
+  code;
+  hint;
+};
+
+// ../core/src/domain/naming.ts
+var RESERVED_NAMES = /* @__PURE__ */ new Set([
+  "add",
+  "agent",
+  "alias",
+  "login",
+  "mcp",
+  "region",
+  "setup",
+  "status",
+  "sync",
+  "ls",
+  "list",
+  "rm",
+  "remove",
+  "doctor",
+  "exec",
+  "provider",
+  "ui",
+  "help",
+  "version"
+]);
+var NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,62}$/;
+function assertValidName(kind, name) {
+  if (!NAME_PATTERN.test(name)) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `Invalid ${kind} name "${name}".`,
+      'Use lowercase letters, numbers, "-" or "_" (max 63 characters).'
+    );
+  }
+  if (kind === "alias" && RESERVED_NAMES.has(name)) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `"${name}" is a cloudhop command.`,
+      "Pick another alias name."
+    );
+  }
+}
+function suggestAliasName(...parts) {
+  const slug = parts.join("-").toLowerCase().replace(/access$/i, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
+  return slug || "alias";
+}
+
+// ../core/src/domain/version.ts
+function compareVersions(a2, b3) {
+  const pa = a2.split(".").map((n3) => Number.parseInt(n3, 10) || 0);
+  const pb = b3.split(".").map((n3) => Number.parseInt(n3, 10) || 0);
+  for (let i2 = 0; i2 < Math.max(pa.length, pb.length); i2++) {
+    const diff = (pa[i2] ?? 0) - (pb[i2] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+
+// ../core/src/application/cloudhop-app.ts
+var loginRequired = (sourceId) => new CloudhopError(
+  "LOGIN_REQUIRED",
+  `The session of "${sourceId}" expired and needs a browser sign-in.`,
+  `Run \`cloudhop login ${sourceId}\` (it opens the browser), then try again.`
+);
+var NEXT_BY_STATE = {
+  valid: "ready",
+  refreshable: "silent-renewal",
+  expired: "browser-sign-in",
+  unknown: "unknown"
+};
+var CloudhopApp = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  // ── Providers ────────────────────────────────────────────────────────────
+  availableProviders() {
+    return this.deps.providers;
+  }
+  provider(id) {
+    const provider = this.deps.providers.find((p3) => p3.id === id);
+    if (!provider) {
+      throw new CloudhopError(
+        "PROVIDER_NOT_AVAILABLE",
+        `The ${id} provider is not available yet.`,
+        "Follow https://github.com/dayepesb/cloudhop for upcoming providers."
+      );
+    }
+    return provider;
+  }
+  async config() {
     return this.deps.config.load();
   }
   async setEnabledProviders(ids) {
@@ -7591,13 +7762,19 @@ var CloudhopApp = class {
     return this.syncSource(sourceId);
   }
   /** Makes sure the source has a usable session, renewing it silently or via login. */
-  async ensureSession(sourceId) {
+  /**
+   * Makes the source's session usable: renews it silently when possible, and
+   * otherwise signs in through the browser, unless `interactive` is false, in
+   * which case it fails with LOGIN_REQUIRED instead of opening a browser.
+   */
+  async ensureSession(sourceId, { interactive: interactive2 = true } = {}) {
     const config = await this.deps.config.load();
     const source = this.findSource(config, sourceId);
     const provider = this.provider(source.provider);
     const state = await provider.sessionState(source);
     if (state === "valid" || state === "unknown") return "none";
     if (state === "refreshable" && await provider.refreshSession(source)) return "refreshed";
+    if (!interactive2) throw loginRequired(sourceId);
     await this.login(sourceId);
     return "logged-in";
   }
@@ -7661,6 +7838,56 @@ var CloudhopApp = class {
     const config = await this.deps.config.load();
     return Promise.all(config.aliases.map((a2) => this.resolve(config, a2)));
   }
+  /** Sources with their session state and every alias, checked without signing in. */
+  async overview() {
+    const config = await this.deps.config.load();
+    const sources = await Promise.all(
+      config.sources.map(async (source) => {
+        const session = await this.provider(source.provider).sessionState(source);
+        return {
+          id: source.id,
+          provider: source.provider,
+          kind: source.kind,
+          settings: source.settings,
+          session,
+          next: NEXT_BY_STATE[session]
+        };
+      })
+    );
+    const bySource = new Map(sources.map((s) => [s.id, s]));
+    const aliases = await Promise.all(
+      config.aliases.map(async (alias) => {
+        const resolved = await this.resolve(config, alias);
+        const source = bySource.get(alias.source);
+        return {
+          name: alias.name,
+          source: alias.source,
+          provider: resolved.source.provider,
+          target: alias.target,
+          label: resolved.target?.label,
+          available: Boolean(resolved.target),
+          region: resolved.region,
+          attributes: resolved.target?.attributes ?? {},
+          session: source.session,
+          next: source.next
+        };
+      })
+    );
+    return { sources, aliases };
+  }
+  /** The status of one alias: which account it points to and whether it can run right away. */
+  async aliasStatus(name) {
+    const { aliases } = await this.overview();
+    const status = aliases.find((a2) => a2.name === name);
+    if (!status) {
+      throw new CloudhopError(
+        "ALIAS_NOT_FOUND",
+        `Alias "${name}" not found.`,
+        "See your aliases with `cloudhop ls`."
+      );
+    }
+    return status;
+  }
   /** Changes an alias' region; matching the source's region clears the override. */
   async setAliasRegion(name, region) {
     const config = await this.deps.config.load();
@@ -7685,6 +7912,28 @@ var CloudhopApp = class {
     return this.runWithSession(resolved, provider, "cli", provider.cli.command, args);
   }
   /** Runs any command with the alias' temporary credentials in its environment. */
+  /**
+   * Runs the alias' cloud CLI without a terminal and returns what it printed.
+   * Used where stdin/stdout belong to someone else (the MCP server). It never
+   * opens a browser: an expired session fails with LOGIN_REQUIRED.
+   */
+  async captureAsAlias(name, args, overrides = {}) {
+    const resolved = await this.usableAlias(name, overrides);
+    const provider = this.provider(resolved.source.provider);
+    await this.requireCli(provider);
+    await this.ensureSession(resolved.source.id, { interactive: false });
+    const env = await provider.processEnv(resolved, "cli");
+    const result = await this.deps.runner.capture(provider.cli.command, args, { env });
+    if (result.exitCode !== 0 && provider.isSessionError(`${result.stdout}
+${result.stderr}`)) {
+      throw loginRequired(resolved.source.id);
+    }
+    return result;
+  }
+  /** The command that shows who an alias is, e.g. `aws sts get-caller-identity`. */
+  identityArgs(name) {
+    return this.resolveAlias(name).then((r2) => this.provider(r2.source.provider).identityArgs);
+  }
   async execAsAlias(name, command, args, overrides = {}) {
     const resolved = await this.usableAlias(name, overrides);
     const provider = this.provider(resolved.source.provider);
@@ -7819,62 +8068,397 @@ var CloudhopApp = class {
 var PROVIDER_IDS = ["aws", "azure", "gcp"];
 var emptyConfig = () => ({ providers: [], sources: [], aliases: [] });
 
-// src/flags.ts
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["yes", "all", "list", "noOpen"]);
-var camel = (name) => name.replace(/-([a-z])/g, (_2, c3) => c3.toUpperCase());
-function parseArgs(argv) {
-  const positional = [];
-  const flags = {};
-  for (let i2 = 0; i2 < argv.length; i2++) {
-    const arg = argv[i2];
-    if (!arg.startsWith("--")) {
-      positional.push(arg);
-      continue;
-    }
-    const [rawName, inline] = arg.slice(2).split(/=(.*)/s, 2);
-    const name = camel(rawName);
-    if (inline !== void 0) flags[name] = inline;
-    else if (BOOLEAN_FLAGS.has(name)) flags[name] = "true";
-    else flags[name] = argv[++i2] ?? "";
-  }
-  return { positional, flags };
+// ../adapters-node/src/yaml-config-store.ts
+var import_yaml = __toESM(require_dist(), 1);
+function defaultConfigDir(env = process.env) {
+  if (env.CLOUDHOP_HOME) return env.CLOUDHOP_HOME;
+  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "cloudhop");
 }
-var interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
-
-// ../../node_modules/.pnpm/@clack+prompts@1.8.1/node_modules/@clack/prompts/dist/index.mjs
-var dist_exports = {};
-__export(dist_exports, {
-  CANCEL_SYMBOL: () => CANCEL_SYMBOL,
-  MULTISELECT_INSTRUCTIONS: () => MULTISELECT_INSTRUCTIONS,
-  SELECT_INSTRUCTIONS: () => SELECT_INSTRUCTIONS,
-  S_BAR: () => S_BAR,
-  S_BAR_END: () => S_BAR_END,
-  S_BAR_END_RIGHT: () => S_BAR_END_RIGHT,
-  S_BAR_H: () => S_BAR_H,
-  S_BAR_START: () => S_BAR_START,
-  S_BAR_START_RIGHT: () => S_BAR_START_RIGHT,
-  S_CHECKBOX_ACTIVE: () => S_CHECKBOX_ACTIVE,
-  S_CHECKBOX_INACTIVE: () => S_CHECKBOX_INACTIVE,
-  S_CHECKBOX_SELECTED: () => S_CHECKBOX_SELECTED,
-  S_CONNECT_LEFT: () => S_CONNECT_LEFT,
-  S_CORNER_BOTTOM_LEFT: () => S_CORNER_BOTTOM_LEFT,
-  S_CORNER_BOTTOM_RIGHT: () => S_CORNER_BOTTOM_RIGHT,
-  S_CORNER_TOP_LEFT: () => S_CORNER_TOP_LEFT,
-  S_CORNER_TOP_RIGHT: () => S_CORNER_TOP_RIGHT,
-  S_ERROR: () => S_ERROR,
-  S_INFO: () => S_INFO,
-  S_PASSWORD_MASK: () => S_PASSWORD_MASK,
-  S_RADIO_ACTIVE: () => S_RADIO_ACTIVE,
-  S_RADIO_INACTIVE: () => S_RADIO_INACTIVE,
-  S_STEP_ACTIVE: () => S_STEP_ACTIVE,
-  S_STEP_CANCEL: () => S_STEP_CANCEL,
-  S_STEP_ERROR: () => S_STEP_ERROR,
-  S_STEP_SUBMIT: () => S_STEP_SUBMIT,
-  S_SUCCESS: () => S_SUCCESS,
-  S_WARN: () => S_WARN,
-  autocomplete: () => autocomplete,
-  autocompleteMultiselect: () => autocompleteMultiselect,
-  box: () => box,
+var HEADER = "# cloudhop configuration. Contains no secrets.\n# Docs: https://github.com/dayepesb/cloudhop\n";
+var YamlConfigStore = class {
+  constructor(dir = defaultConfigDir()) {
+    this.dir = dir;
+  }
+  dir;
+  get configPath() {
+    return join(this.dir, "config.yaml");
+  }
+  get targetsPath() {
+    return join(this.dir, "targets.json");
+  }
+  async load() {
+    const raw = await this.read(this.configPath);
+    if (!raw) return emptyConfig();
+    const file = (0, import_yaml.parse)(raw) ?? {};
+    return {
+      providers: (file.providers ?? []).filter(
+        (p3) => PROVIDER_IDS.includes(p3)
+      ),
+      sources: Object.entries(file.sources ?? {}).map(([id, s]) => ({
+        id,
+        ...s,
+        settings: s.settings ?? {}
+      })),
+      aliases: Object.entries(file.aliases ?? {}).map(([name, a2]) => ({ name, ...a2 }))
+    };
+  }
+  async save(config) {
+    const file = {
+      providers: config.providers,
+      sources: Object.fromEntries(config.sources.map(({ id, ...rest }) => [id, rest])),
+      aliases: Object.fromEntries(config.aliases.map(({ name, ...rest }) => [name, rest]))
+    };
+    await this.write(this.configPath, HEADER + (0, import_yaml.stringify)(file));
+  }
+  async loadTargets(sourceId) {
+    return (await this.allTargets())[sourceId] ?? [];
+  }
+  async saveTargets(sourceId, targets) {
+    const all = await this.allTargets();
+    all[sourceId] = targets;
+    await this.write(this.targetsPath, JSON.stringify(all, null, 2));
+  }
+  async removeTargets(sourceId) {
+    const all = await this.allTargets();
+    delete all[sourceId];
+    await this.write(this.targetsPath, JSON.stringify(all, null, 2));
+  }
+  async reset() {
+    await rm(this.dir, { recursive: true, force: true });
+  }
+  async allTargets() {
+    const raw = await this.read(this.targetsPath);
+    return raw ? JSON.parse(raw) : {};
+  }
+  async read(path2) {
+    try {
+      return await readFile(path2, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+  }
+  /** Writes through a temp file so a crash never leaves a half-written config. */
+  async write(path2, content) {
+    await mkdir(this.dir, { recursive: true, mode: 448 });
+    const tmp = `${path2}.${process.pid}.tmp`;
+    await writeFile(tmp, content, { mode: 384 });
+    await rename(tmp, path2);
+  }
+};
+
+// ../mcp/src/server.ts
+import { createInterface } from "readline";
+
+// ../mcp/src/tools.ts
+var MAX_OUTPUT = 1e5;
+var cap = (text4) => text4.length > MAX_OUTPUT ? `${text4.slice(0, MAX_OUTPUT)}
+\u2026 [truncated: ${text4.length - MAX_OUTPUT} more characters. Narrow the command with --query or filters.]` : text4;
+var WINDOWS_SHELL_CHARS = /[&|<>^%!"\r\n]/;
+var text = (args, key) => {
+  const value = args[key];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CloudhopError("INVALID_NAME", `"${key}" is required.`);
+  }
+  return value.trim();
+};
+var stringArray = (args, key) => {
+  const value = args[key];
+  if (!Array.isArray(value) || !value.every((v) => typeof v === "string")) {
+    throw new CloudhopError("INVALID_NAME", `"${key}" must be an array of strings.`);
+  }
+  return value;
+};
+var aliasInput = {
+  alias: {
+    type: "string",
+    description: "The cloudhop alias to use, as listed by list_aliases. Ask the user which one."
+  }
+};
+function createTools(app) {
+  return [
+    {
+      name: "list_aliases",
+      title: "List cloudhop aliases",
+      description: "Lists every cloudhop source (SSO portal or personal account) with its session state, and every alias: name, account/role label, region and whether a sign-in is needed. Call this first, then ask the user which alias to work with. Never contains secrets.",
+      inputSchema: { type: "object", properties: {}, additionalProperties: false },
+      annotations: { readOnlyHint: true, openWorldHint: false },
+      run: () => app.overview()
+    },
+    {
+      name: "alias_status",
+      title: "Check an alias",
+      description: 'Shows which account, role and region an alias points to and whether it can run now. `next` is "ready", "silent-renewal" (runs without asking), "browser-sign-in" (call login first, or ask the user to run `cloudhop login <source>`) or "unknown".',
+      inputSchema: {
+        type: "object",
+        properties: aliasInput,
+        required: ["alias"],
+        additionalProperties: false
+      },
+      annotations: { readOnlyHint: true, openWorldHint: false },
+      run: (args) => app.aliasStatus(text(args, "alias"))
+    },
+    {
+      name: "whoami",
+      title: "Who am I in this alias",
+      description: "Asks the cloud who the alias really is (for AWS: `aws sts get-caller-identity`). Use it to confirm the account before doing anything important.",
+      inputSchema: {
+        type: "object",
+        properties: aliasInput,
+        required: ["alias"],
+        additionalProperties: false
+      },
+      annotations: { readOnlyHint: true, openWorldHint: true },
+      run: async (args) => {
+        const alias = text(args, "alias");
+        const result = await app.captureAsAlias(alias, await app.identityArgs(alias));
+        return {
+          alias,
+          exitCode: result.exitCode,
+          output: cap(result.stdout),
+          errors: cap(result.stderr)
+        };
+      }
+    },
+    {
+      name: "login",
+      title: "Sign in to a source",
+      description: "Opens the user's browser to sign in to a source (an SSO portal or a personal account) and waits up to 5 minutes for them to approve, then refreshes its accounts and roles. Tell the user to look at their browser before calling it. Only call it when alias_status says `browser-sign-in` or a tool returned LOGIN_REQUIRED.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          source: { type: "string", description: "The source id, as shown in list_aliases." }
+        },
+        required: ["source"],
+        additionalProperties: false
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      },
+      run: async (args) => {
+        const source = text(args, "source");
+        const report = await app.login(source);
+        return { source, signedIn: true, targets: report.targets.length };
+      }
+    },
+    {
+      name: "run_cloud_cli",
+      title: "Run the cloud CLI as an alias",
+      description: 'Runs the alias\' cloud CLI (`aws` for AWS aliases) with the alias\' account, role and region, like `hop <alias> <args>`. `args` are the CLI arguments without the program name and without --profile, e.g. ["s3", "ls"]. Returns stdout, stderr and the exit code. It can create, change or delete cloud resources: before any command that is not read-only, show the user the alias, account, region and exact command and get their explicit confirmation.',
+      inputSchema: {
+        type: "object",
+        properties: {
+          ...aliasInput,
+          args: {
+            type: "array",
+            items: { type: "string" },
+            description: 'CLI arguments, e.g. ["ec2", "describe-instances", "--output", "json"].'
+          },
+          region: {
+            type: "string",
+            description: "Optional region for this call only; defaults to the alias' region."
+          }
+        },
+        required: ["alias", "args"],
+        additionalProperties: false
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true
+      },
+      run: async (args) => {
+        const alias = text(args, "alias");
+        const cliArgs = stringArray(args, "args");
+        if (cliArgs.includes("--profile")) {
+          throw new CloudhopError(
+            "INVALID_NAME",
+            "Do not pass --profile: the alias already chooses the account and role."
+          );
+        }
+        if (process.platform === "win32" && cliArgs.some((a2) => WINDOWS_SHELL_CHARS.test(a2))) {
+          throw new CloudhopError(
+            "INVALID_NAME",
+            'On Windows, arguments cannot contain & | < > ^ % ! " or line breaks.',
+            "Ask the user to run this command in their terminal with hop instead."
+          );
+        }
+        const region = typeof args.region === "string" && args.region.trim() ? args.region.trim() : void 0;
+        const result = await app.captureAsAlias(alias, cliArgs, region ? { region } : {});
+        return {
+          alias,
+          exitCode: result.exitCode,
+          stdout: cap(result.stdout),
+          stderr: cap(result.stderr)
+        };
+      }
+    }
+  ];
+}
+
+// ../mcp/src/server.ts
+var MCP_INSTRUCTIONS = `cloudhop gives each cloud account + role + region a short alias and signs the user in only when a session expired.
+Before the first cloud operation in a conversation: call list_aliases, show the user the aliases (name, account/role, region) and ask which one to use. Never guess the alias.
+Use run_cloud_cli for cloud CLI commands, never --profile. Read-only commands may run once the alias is chosen; before anything that creates, changes or deletes resources, show the alias, account, region and exact command, and wait for the user's explicit OK. Be extra careful with production aliases.
+If a tool returns LOGIN_REQUIRED or alias_status says browser-sign-in: tell the user their browser will open, then call login (it waits up to 5 minutes for them to approve). Never print or ask for credentials.`;
+var SUPPORTED_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
+function serveMcp({
+  app,
+  version,
+  input = process.stdin,
+  output = process.stdout
+}) {
+  const tools = createTools(app);
+  const byName = new Map(tools.map((t2) => [t2.name, t2]));
+  const send2 = (message) => output.write(`${JSON.stringify(message)}
+`);
+  const reply = (id, result) => send2({ jsonrpc: "2.0", id, result });
+  const fail = (id, code, message) => send2({ jsonrpc: "2.0", id: id ?? null, error: { code, message } });
+  const handle = async (request) => {
+    const { id, method, params = {} } = request;
+    const isNotification = id === void 0;
+    switch (method) {
+      case "initialize": {
+        const asked = typeof params.protocolVersion === "string" ? params.protocolVersion : "";
+        reply(id, {
+          protocolVersion: SUPPORTED_VERSIONS.includes(asked) ? asked : SUPPORTED_VERSIONS[0],
+          capabilities: { tools: { listChanged: false } },
+          serverInfo: { name: "cloudhop", title: "cloudhop", version },
+          instructions: MCP_INSTRUCTIONS
+        });
+        return;
+      }
+      case "ping":
+        reply(id, {});
+        return;
+      case "tools/list":
+        reply(id, {
+          tools: tools.map(({ name, title, description, inputSchema, annotations }) => ({
+            name,
+            title,
+            description,
+            inputSchema,
+            annotations
+          }))
+        });
+        return;
+      case "tools/call": {
+        const tool = byName.get(String(params.name));
+        if (!tool) {
+          fail(id, -32602, `Unknown tool: ${String(params.name)}`);
+          return;
+        }
+        const args = params.arguments ?? {};
+        try {
+          const result = await tool.run(args);
+          reply(id, {
+            content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+            structuredContent: result
+          });
+        } catch (error) {
+          const known = error instanceof CloudhopError;
+          const body = {
+            error: known ? error.code : "UNEXPECTED",
+            message: error.message,
+            ...known && error.hint ? { hint: error.hint } : {}
+          };
+          reply(id, {
+            content: [{ type: "text", text: JSON.stringify(body, null, 2) }],
+            structuredContent: body,
+            isError: true
+          });
+        }
+        return;
+      }
+      default:
+        if (!isNotification) fail(id, -32601, `Method not found: ${method}`);
+    }
+  };
+  return new Promise((resolve) => {
+    const lines = createInterface({ input, crlfDelay: Number.POSITIVE_INFINITY });
+    const pending = /* @__PURE__ */ new Set();
+    lines.on("line", (line) => {
+      if (!line.trim()) return;
+      let request;
+      try {
+        request = JSON.parse(line);
+      } catch {
+        fail(null, -32700, "Parse error");
+        return;
+      }
+      if (typeof request.method !== "string") return;
+      const task = handle(request).catch((error) => {
+        if (request.id !== void 0) fail(request.id, -32603, error.message);
+      });
+      pending.add(task);
+      task.finally(() => pending.delete(task));
+    });
+    lines.on("close", () => {
+      Promise.allSettled([...pending]).then(() => resolve());
+    });
+  });
+}
+
+// src/flags.ts
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["yes", "all", "list", "noOpen", "json", "noMcp", "force"]);
+var camel = (name) => name.replace(/-([a-z])/g, (_2, c3) => c3.toUpperCase());
+function parseArgs(argv) {
+  const positional = [];
+  const flags = {};
+  for (let i2 = 0; i2 < argv.length; i2++) {
+    const arg = argv[i2];
+    if (!arg.startsWith("--")) {
+      positional.push(arg);
+      continue;
+    }
+    const [rawName, inline] = arg.slice(2).split(/=(.*)/s, 2);
+    const name = camel(rawName);
+    if (inline !== void 0) flags[name] = inline;
+    else if (BOOLEAN_FLAGS.has(name)) flags[name] = "true";
+    else flags[name] = argv[++i2] ?? "";
+  }
+  return { positional, flags };
+}
+var interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+
+// ../../node_modules/.pnpm/@clack+prompts@1.8.1/node_modules/@clack/prompts/dist/index.mjs
+var dist_exports = {};
+__export(dist_exports, {
+  CANCEL_SYMBOL: () => CANCEL_SYMBOL,
+  MULTISELECT_INSTRUCTIONS: () => MULTISELECT_INSTRUCTIONS,
+  SELECT_INSTRUCTIONS: () => SELECT_INSTRUCTIONS,
+  S_BAR: () => S_BAR,
+  S_BAR_END: () => S_BAR_END,
+  S_BAR_END_RIGHT: () => S_BAR_END_RIGHT,
+  S_BAR_H: () => S_BAR_H,
+  S_BAR_START: () => S_BAR_START,
+  S_BAR_START_RIGHT: () => S_BAR_START_RIGHT,
+  S_CHECKBOX_ACTIVE: () => S_CHECKBOX_ACTIVE,
+  S_CHECKBOX_INACTIVE: () => S_CHECKBOX_INACTIVE,
+  S_CHECKBOX_SELECTED: () => S_CHECKBOX_SELECTED,
+  S_CONNECT_LEFT: () => S_CONNECT_LEFT,
+  S_CORNER_BOTTOM_LEFT: () => S_CORNER_BOTTOM_LEFT,
+  S_CORNER_BOTTOM_RIGHT: () => S_CORNER_BOTTOM_RIGHT,
+  S_CORNER_TOP_LEFT: () => S_CORNER_TOP_LEFT,
+  S_CORNER_TOP_RIGHT: () => S_CORNER_TOP_RIGHT,
+  S_ERROR: () => S_ERROR,
+  S_INFO: () => S_INFO,
+  S_PASSWORD_MASK: () => S_PASSWORD_MASK,
+  S_RADIO_ACTIVE: () => S_RADIO_ACTIVE,
+  S_RADIO_INACTIVE: () => S_RADIO_INACTIVE,
+  S_STEP_ACTIVE: () => S_STEP_ACTIVE,
+  S_STEP_CANCEL: () => S_STEP_CANCEL,
+  S_STEP_ERROR: () => S_STEP_ERROR,
+  S_STEP_SUBMIT: () => S_STEP_SUBMIT,
+  S_SUCCESS: () => S_SUCCESS,
+  S_WARN: () => S_WARN,
+  autocomplete: () => autocomplete,
+  autocompleteMultiselect: () => autocompleteMultiselect,
+  box: () => box,
   cancel: () => cancel,
   confirm: () => confirm,
   date: () => date,
@@ -7903,7 +8487,7 @@ __export(dist_exports, {
   symbolBar: () => symbolBar,
   taskLog: () => taskLog,
   tasks: () => tasks,
-  text: () => text,
+  text: () => text2,
   unicode: () => unicode,
   unicodeOr: () => unicodeOr,
   updateSettings: () => updateSettings
@@ -9240,7 +9824,7 @@ import { styleText as styleText2, stripVTControlCharacters } from "util";
 import process$1 from "process";
 var import_sisteransi2 = __toESM(require_src(), 1);
 import { existsSync, lstatSync, readdirSync } from "fs";
-import { dirname, join } from "path";
+import { dirname, join as join2 } from "path";
 function isUnicodeSupported() {
   if (process$1.platform !== "win32") {
     return process$1.env.TERM !== "linux";
@@ -10181,7 +10765,7 @@ var path = (e) => {
         existsSync(t2) ? lstatSync(t2).isDirectory() && (!e.directory || t2.endsWith("/")) ? i2 = t2 : i2 = dirname(t2) : i2 = dirname(t2);
         const c3 = t2.length > 1 && t2.endsWith("/") ? t2.slice(0, -1) : t2;
         return readdirSync(i2).map((r2) => {
-          const n3 = join(i2, r2), m3 = lstatSync(n3);
+          const n3 = join2(i2, r2), m3 = lstatSync(n3);
           return {
             name: r2,
             path: n3,
@@ -10608,7 +11192,7 @@ ${e.value}` : e.value;
     }
   };
 };
-var text = (t2) => new n2({
+var text2 = (t2) => new n2({
   validate: t2.validate,
   placeholder: t2.placeholder,
   defaultValue: t2.defaultValue,
@@ -10665,8 +11249,8 @@ function answer(value) {
 }
 var colorful = (stream2) => Boolean(stream2.isTTY) && !process.env.NO_COLOR;
 var truecolor = /truecolor|24bit/i.test(process.env.COLORTERM ?? "");
-var dim = (text3) => colorful(process.stderr) ? `\x1B[2m${text3}\x1B[22m` : text3;
-var bold = (text3) => colorful(process.stdout) ? `\x1B[1m${text3}\x1B[22m` : text3;
+var dim = (text4) => colorful(process.stderr) ? `\x1B[2m${text4}\x1B[22m` : text4;
+var bold = (text4) => colorful(process.stdout) ? `\x1B[1m${text4}\x1B[22m` : text4;
 var STYLES = {
   dim: ["2", "22"],
   green: ["32", "39"],
@@ -10675,7 +11259,7 @@ var STYLES = {
   sky: [truecolor ? "38;2;59;184;245" : "38;5;75", "39"],
   coral: [truecolor ? "38;2;255;122;89" : "38;5;209", "39"]
 };
-var paint = (style, text3) => colorful(process.stdout) ? `\x1B[${STYLES[style][0]}m${text3}\x1B[${STYLES[style][1]}m` : text3;
+var paint = (style, text4) => colorful(process.stdout) ? `\x1B[${STYLES[style][0]}m${text4}\x1B[${STYLES[style][1]}m` : text4;
 var BANNER = [
   "       _                    _  _",
   "  ___ | |  ___   _   _   __| || |__    ___   _ __",
@@ -10922,50 +11506,578 @@ async function aliasCommand(app, { positional, flags }) {
   dist_exports.outro(`Created ${aliases.length} alias(es).`);
 }
 
-// src/commands/manage.ts
-function printReport(report) {
-  const changes = [
-    `${report.targets.length} available`,
-    report.added.length ? `${report.added.length} new` : "",
-    report.removed.length ? `${report.removed.length} removed` : ""
-  ].filter(Boolean);
-  dist_exports.log.success(`${report.sourceId}: ${changes.join(", ")}.`);
-  for (const t2 of report.added) dist_exports.log.message(`  + ${t2.label}`);
-  for (const t2 of report.removed) dist_exports.log.message(`  - ${t2.label}`);
-  if (report.orphanedAliases.length) {
-    dist_exports.log.warn(
-      `No longer available: ${report.orphanedAliases.join(", ")}. Remove them with \`cloudhop rm <alias>\`.`
-    );
+// src/commands/agent.ts
+import { homedir as homedir2 } from "os";
+import { isAbsolute, relative } from "path";
+
+// ../assistants/src/installer.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2 } from "fs";
+import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, rmdir, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join4 } from "path";
+
+// ../assistants/src/assets/skill.md
+var skill_default = "---\nname: cloudhop\ndescription: Run AWS CLI commands and other cloud tools as a specific account, role and region through cloudhop aliases (the `hop` and `cloudhop` commands). Use whenever the user asks to do anything in their AWS accounts, inspect or change cloud resources, run aws/terraform/cdk against an account, list their cloud accounts or aliases, or mentions hop or cloudhop.\n---\n\n# Working with cloud accounts through cloudhop\n\nThe user manages their cloud access with **cloudhop**. Each **alias** (for\nexample `acme-dev`) points to one account, one role and one region. cloudhop\nsigns the user in through their browser only when a session has expired. There\nare no access keys: never ask for, create, print or store credentials.\n\n## 1. Pick the alias with the user, every time\n\nBefore the first cloud operation in a conversation:\n\n1. List the aliases. Use the `list_aliases` tool if the cloudhop MCP server is\n   connected; otherwise run `cloudhop ls --json`.\n2. Show the user the options (alias, account / role, region) and **ask which\n   one to use**. Don't guess, even if one name looks right, and don't pick\n   one just because there is only one: confirm it.\n3. Use that alias for the rest of the conversation. Ask again if the user\n   moves to another environment, account or task.\n\n## 2. Check the session before running anything\n\nRun `cloudhop status <alias> --json` (or the `alias_status` tool) and read\n`next`:\n\n| `next`            | Meaning                                      | What to do                                                                                                                                        |\n| ----------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `ready`           | Session valid                                | Go ahead                                                                                                                                          |\n| `silent-renewal`  | Expired but renewable without the user       | Go ahead; cloudhop renews it                                                                                                                      |\n| `browser-sign-in` | The user must sign in                        | Tell the user their browser will open and they need to approve, then run `cloudhop login <source>` (or the `login` tool) and wait up to 5 minutes |\n| `unknown`         | Managed by the cloud CLI (personal accounts) | Go ahead; if it fails, run `cloudhop login <source>`                                                                                              |\n\nDon't start several cloud commands in parallel while a sign-in is pending.\n\n## 3. Run commands through the alias\n\n- **AWS CLI**: `hop <alias> <aws arguments>`, e.g. `hop acme-dev s3 ls`.\n  It is exactly `aws <arguments>` with the alias' account, role and region.\n  Never add `--profile`. Use `--region <r>` only to override the region once.\n  With the MCP server, use `run_cloud_cli` with `args` (no program name).\n- **Who am I**: `hop <alias>` with no arguments (or the `whoami` tool).\n- **Other tools** (Terraform, CDK, SDK scripts):\n  `cloudhop exec <alias> -- <command>`, e.g.\n  `cloudhop exec acme-dev -- terraform plan`.\n- Prefer `--output json` and `--query` to keep output small.\n- Don't export `AWS_PROFILE`, `AWS_ACCESS_KEY_ID` or similar variables, don't\n  run commands that print credentials (`env`, `printenv`, `export-credentials`)\n  and never edit `~/.aws/config`, `~/.aws/credentials` or cloudhop's own files.\n\n## 4. Confirm before changing anything\n\n- Read-only commands (`list`, `describe`, `get`, `s3 ls`, `logs tail`) can run\n  once the user has chosen the alias.\n- Before any command that **creates, changes, deletes or costs money**, show\n  the alias, account, region and the exact command, and wait for the user's\n  explicit \"yes\". One confirmation covers one command, not a series.\n- Treat aliases or accounts that look like production (`prod`, `prd`,\n  `production`, `live`) with extra care: confirm every change, and suggest a\n  dry run (`--dryrun`, `terraform plan`) first.\n- Don't change cloudhop itself (`cloudhop add`, `rm`, `region`, `login` for\n  another source) unless the user asked for it.\n\n## 5. When something goes wrong\n\n| You see                                             | Do this                                                                        |\n| --------------------------------------------------- | ------------------------------------------------------------------------------ |\n| \"Opening your browser to log in\"                    | Tell the user to approve in the browser; the command continues by itself       |\n| The command was cut off while waiting for a sign-in | Run `cloudhop login <source>` with a timeout of at least 5 minutes, then retry |\n| `LOGIN_REQUIRED`                                    | Same as `browser-sign-in` above                                                |\n| No browser on this machine (remote, container)      | Run `cloudhop login <source> --device-code` and show the user the URL and code |\n| `Alias \"x\" not found`                               | Run `cloudhop ls` and ask the user again                                       |\n| AWS CLI missing or too old                          | Suggest `cloudhop doctor`; don't install anything without asking               |\n| `AccessDenied`                                      | The role lacks permission: tell the user; don't try other aliases on your own  |\n\nMore: https://dayepesb.github.io/cloudhop/guides/hop-like-aws/\n";
+
+// ../assistants/src/targets.ts
+import { join as join3 } from "path";
+var ASSISTANT_IDS = [
+  "claude",
+  "kiro",
+  "copilot",
+  "cursor",
+  "codex"
+];
+var SKILL_NAME = "cloudhop";
+var MCP_COMMAND = "cloudhop";
+var MCP_ARGS = ["mcp"];
+var ASSISTANTS = {
+  claude: {
+    id: "claude",
+    name: "Claude Code",
+    markers: ({ home }) => [join3(home, ".claude")],
+    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".claude", "skills", SKILL_NAME),
+    mcp: (scope, { project }) => scope === "project" ? { kind: "json", file: join3(project, ".mcp.json"), key: "mcpServers", withType: false } : {
+      kind: "cli",
+      command: "claude",
+      add: ["mcp", "add", "--scope", "user", "cloudhop", "--", MCP_COMMAND, ...MCP_ARGS],
+      remove: ["mcp", "remove", "--scope", "user", "cloudhop"],
+      manual: "claude mcp add --scope user cloudhop -- cloudhop mcp"
+    }
+  },
+  kiro: {
+    id: "kiro",
+    name: "Kiro",
+    markers: ({ home }) => [join3(home, ".kiro")],
+    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".kiro", "skills", SKILL_NAME),
+    mcp: (scope, { home, project }) => ({
+      kind: "json",
+      file: join3(scope === "user" ? home : project, ".kiro", "settings", "mcp.json"),
+      key: "mcpServers",
+      withType: false
+    })
+  },
+  copilot: {
+    id: "copilot",
+    name: "GitHub Copilot (VS Code)",
+    markers: ({ home }) => [join3(home, ".copilot"), join3(home, ".vscode")],
+    skillDir: (scope, { home, project }) => scope === "user" ? join3(home, ".copilot", "skills", SKILL_NAME) : join3(project, ".github", "skills", SKILL_NAME),
+    mcp: (scope, { project }) => scope === "project" ? {
+      kind: "json",
+      file: join3(project, ".vscode", "mcp.json"),
+      key: "servers",
+      withType: true
+    } : {
+      kind: "cli",
+      command: "code",
+      add: [
+        "--add-mcp",
+        JSON.stringify({
+          name: "cloudhop",
+          type: "stdio",
+          command: MCP_COMMAND,
+          args: MCP_ARGS
+        })
+      ],
+      remove: void 0,
+      manual: 'VS Code \u2192 "MCP: Add Server" \u2192 stdio \u2192 command `cloudhop mcp`'
+    }
+  },
+  cursor: {
+    id: "cursor",
+    name: "Cursor",
+    markers: ({ home }) => [join3(home, ".cursor")],
+    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".cursor", "skills", SKILL_NAME),
+    mcp: (scope, { home, project }) => ({
+      kind: "json",
+      file: join3(scope === "user" ? home : project, ".cursor", "mcp.json"),
+      key: "mcpServers",
+      withType: true
+    })
+  },
+  codex: {
+    id: "codex",
+    name: "Codex",
+    markers: ({ home }) => [join3(home, ".codex"), join3(home, ".agents")],
+    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".agents", "skills", SKILL_NAME),
+    mcp: (scope, { home, project }) => ({
+      kind: "toml",
+      file: join3(scope === "user" ? home : project, ".codex", "config.toml")
+    })
   }
+};
+
+// ../assistants/src/installer.ts
+var sha = (text4) => createHash("sha256").update(text4).digest("hex");
+async function writeAtomic(file, content) {
+  await mkdir2(dirname2(file), { recursive: true });
+  const tmp = `${file}.cloudhop-${process.pid}.tmp`;
+  await writeFile2(tmp, content);
+  await rename2(tmp, file);
 }
-async function syncCommand(app, sourceId) {
-  const ids = sourceId ? [sourceId] : (await app.config()).sources.map((s) => s.id);
-  if (ids.length === 0) {
-    dist_exports.log.info("No sources yet. Run `cloudhop add`.");
-    return;
+async function removeFileAndEmptyDir(file) {
+  await rm2(file, { force: true });
+  await rmdir(dirname2(file)).catch(() => {
+  });
+}
+var readText = (file) => readFile2(file, "utf8").catch(() => void 0);
+var AssistantsInstaller = class {
+  constructor(options) {
+    this.options = options;
   }
-  for (const id of ids) {
-    await app.ensureSession(id);
-    printReport(await app.syncSource(id));
+  options;
+  /** The skill as written to disk: the bundled content plus a footer naming the version. */
+  get skillContent() {
+    return `${skill_default.replace(/\r\n/g, "\n").trimEnd()}
+
+<!-- Installed by cloudhop ${this.options.cloudhopVersion}. Refresh with \`cloudhop agent update\`; edits here are kept. -->
+`;
   }
-}
-async function loginCommand(app, sourceId) {
-  const { sources } = await app.config();
-  const id = sourceId ?? answer(
-    await dist_exports.select({
-      message: "Log in to which source?",
-      options: sources.map((s) => ({ value: s.id, label: s.id }))
-    })
-  );
-  printReport(await app.login(id));
-}
+  /** Assistants that look installed on this machine. */
+  detect() {
+    const { places } = this.options;
+    return ASSISTANT_IDS.filter((id) => ASSISTANTS[id].markers(places).some((p3) => existsSync2(p3)));
+  }
+  async status(scope) {
+    const detected = new Set(this.detect());
+    const manifest = await this.readManifest();
+    return Promise.all(
+      ASSISTANT_IDS.map(async (id) => {
+        const assistant = ASSISTANTS[id];
+        const skillPath = join4(assistant.skillDir(scope, this.options.places), "SKILL.md");
+        const entry = manifest.find((e) => e.skillFile === skillPath);
+        return {
+          assistant: id,
+          name: assistant.name,
+          scope,
+          detected: detected.has(id),
+          skill: await this.skillState(skillPath, entry),
+          skillPath,
+          mcp: await this.mcpState(assistant.mcp(scope, this.options.places))
+        };
+      })
+    );
+  }
+  async install(ids, scope, { mcp = true } = {}) {
+    const results = [];
+    const manifest = await this.readManifest();
+    for (const id of ids) {
+      const assistant = ASSISTANTS[id];
+      const skillPath = join4(assistant.skillDir(scope, this.options.places), "SKILL.md");
+      const content = this.skillContent;
+      await writeAtomic(skillPath, content);
+      const kept = manifest.filter((e) => e.skillFile !== skillPath);
+      kept.push({
+        assistant: id,
+        scope,
+        skillFile: skillPath,
+        hash: sha(content),
+        cloudhopVersion: this.options.cloudhopVersion
+      });
+      manifest.splice(0, manifest.length, ...kept);
+      const target = assistant.mcp(scope, this.options.places);
+      const outcome = mcp ? await this.addMcp(target) : { mcp: "skipped" };
+      results.push({ assistant: id, name: assistant.name, scope, skillPath, ...outcome });
+    }
+    await this.writeManifest(manifest);
+    return results;
+  }
+  async remove(ids, scope) {
+    const results = [];
+    let manifest = await this.readManifest();
+    for (const id of ids) {
+      const assistant = ASSISTANTS[id];
+      const dir = assistant.skillDir(scope, this.options.places);
+      const skillPath = join4(dir, "SKILL.md");
+      await rm2(dir, { recursive: true, force: true });
+      await rmdir(dirname2(dir)).then(() => rmdir(dirname2(dirname2(dir)))).catch(() => {
+      });
+      manifest = manifest.filter((e) => e.skillFile !== skillPath);
+      const outcome = await this.removeMcp(assistant.mcp(scope, this.options.places));
+      results.push({ assistant: id, name: assistant.name, scope, skillPath, ...outcome });
+    }
+    await this.writeManifest(manifest);
+    return results;
+  }
+  /**
+   * Refreshes skills written by an older cloudhop. Copies the user edited are
+   * left alone unless `force`. Cheap when there is nothing to do: one small read.
+   */
+  async update({ force = false } = {}) {
+    const manifest = await this.readManifest();
+    const content = this.skillContent;
+    const target = sha(content);
+    const updated = [];
+    const edited = [];
+    let changed = false;
+    for (const entry of manifest) {
+      if (entry.hash === target) continue;
+      const onDisk = await readText(entry.skillFile);
+      if (onDisk === void 0) continue;
+      if (sha(onDisk) !== entry.hash && !force) {
+        edited.push(entry.skillFile);
+        continue;
+      }
+      await writeAtomic(entry.skillFile, content);
+      entry.hash = target;
+      entry.cloudhopVersion = this.options.cloudhopVersion;
+      updated.push(entry.skillFile);
+      changed = true;
+    }
+    if (changed) await this.writeManifest(manifest);
+    return { updated, edited };
+  }
+  // ───────────── skill state ─────────────
+  async skillState(path2, entry) {
+    const onDisk = await readText(path2);
+    if (onDisk === void 0) return "missing";
+    if (onDisk === this.skillContent) return "current";
+    if (entry && sha(onDisk) !== entry.hash) return "modified";
+    return "outdated";
+  }
+  // ───────────── MCP registration ─────────────
+  async mcpState(target) {
+    if (target.kind === "cli") return "unknown";
+    const text4 = await readText(target.file);
+    if (text4 === void 0) return "missing";
+    if (target.kind === "toml")
+      return /^\[mcp_servers\.cloudhop\]/m.test(text4) ? "registered" : "missing";
+    try {
+      const servers = JSON.parse(text4)[target.key];
+      return servers?.cloudhop ? "registered" : "missing";
+    } catch {
+      return "unknown";
+    }
+  }
+  async addMcp(target) {
+    switch (target.kind) {
+      case "json": {
+        const config = await this.readJsonConfig(target.file);
+        config[target.key] ??= {};
+        const servers = config[target.key];
+        const entry = {
+          ...target.withType ? { type: "stdio" } : {},
+          command: MCP_COMMAND,
+          args: MCP_ARGS
+        };
+        if (JSON.stringify(servers.cloudhop) === JSON.stringify(entry)) return { mcp: "already" };
+        servers.cloudhop = entry;
+        await writeAtomic(target.file, `${JSON.stringify(config, null, 2)}
+`);
+        return { mcp: "added" };
+      }
+      case "toml": {
+        const text4 = await readText(target.file) ?? "";
+        if (/^\[mcp_servers\.cloudhop\]/m.test(text4)) return { mcp: "already" };
+        const block2 = `${TOML_MARK}
+[mcp_servers.cloudhop]
+command = "${MCP_COMMAND}"
+args = [${MCP_ARGS.map((a2) => `"${a2}"`).join(", ")}]
+`;
+        await writeAtomic(
+          target.file,
+          `${text4}${text4 && !text4.endsWith("\n") ? "\n" : ""}${text4 ? "\n" : ""}${block2}`
+        );
+        return { mcp: "added" };
+      }
+      case "cli": {
+        if (!(await this.options.runner.probe(target.command)).installed) {
+          return { mcp: "manual", mcpManual: target.manual };
+        }
+        const result = await this.options.runner.capture(target.command, target.add);
+        if (result.exitCode === 0) return { mcp: "added" };
+        if (/already exists/i.test(`${result.stdout}${result.stderr}`)) return { mcp: "already" };
+        return { mcp: "manual", mcpManual: target.manual };
+      }
+    }
+  }
+  async removeMcp(target) {
+    switch (target.kind) {
+      case "json": {
+        const text4 = await readText(target.file);
+        if (text4 === void 0) return { mcp: "already" };
+        const config = await this.readJsonConfig(target.file);
+        const servers = config[target.key];
+        if (!servers?.cloudhop) return { mcp: "already" };
+        delete servers.cloudhop;
+        const onlyEmptyKey = Object.keys(servers).length === 0 && Object.keys(config).length === 1;
+        if (onlyEmptyKey) await removeFileAndEmptyDir(target.file);
+        else await writeAtomic(target.file, `${JSON.stringify(config, null, 2)}
+`);
+        return { mcp: "removed" };
+      }
+      case "toml": {
+        const text4 = await readText(target.file);
+        if (!text4 || !/^\[mcp_servers\.cloudhop\]/m.test(text4)) return { mcp: "already" };
+        const cleaned = text4.replace(new RegExp(`${escapeRegExp(TOML_MARK)}\\n`, "g"), "").replace(/^\[mcp_servers\.cloudhop\]\n(?:(?!\[)[^\n]*\n?)*/m, "").replace(/\n{3,}/g, "\n\n");
+        if (cleaned.trim()) await writeAtomic(target.file, `${cleaned.trimEnd()}
+`);
+        else await removeFileAndEmptyDir(target.file);
+        return { mcp: "removed" };
+      }
+      case "cli": {
+        if (!target.remove || !(await this.options.runner.probe(target.command)).installed) {
+          return {
+            mcp: "manual",
+            mcpManual: `Remove the "cloudhop" MCP server in ${target.command === "code" ? "VS Code (MCP: List Servers)" : target.command}.`
+          };
+        }
+        await this.options.runner.capture(target.command, target.remove);
+        return { mcp: "removed" };
+      }
+    }
+  }
+  async readJsonConfig(file) {
+    const text4 = await readText(file);
+    if (text4 === void 0 || !text4.trim()) return {};
+    try {
+      const value = JSON.parse(text4);
+      if (value && typeof value === "object" && !Array.isArray(value))
+        return value;
+    } catch {
+    }
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `${file} isn't plain JSON (it may have comments), so cloudhop won't rewrite it.`,
+      `Add the server by hand: "cloudhop": { "command": "cloudhop", "args": ["mcp"] }, or rerun with --no-mcp.`
+    );
+  }
+  // ───────────── manifest ─────────────
+  get manifestPath() {
+    return join4(this.options.configDir, "assistants.json");
+  }
+  async readManifest() {
+    const text4 = await readText(this.manifestPath);
+    if (!text4) return [];
+    try {
+      const parsed = JSON.parse(text4);
+      return Array.isArray(parsed.installs) ? parsed.installs : [];
+    } catch {
+      return [];
+    }
+  }
+  async writeManifest(installs) {
+    await writeAtomic(this.manifestPath, `${JSON.stringify({ installs }, null, 2)}
+`);
+  }
+};
+var TOML_MARK = "# Added by cloudhop (`cloudhop agent remove` deletes it)";
+var escapeRegExp = (text4) => text4.replace(/[.*+?^${}()|[\]\\`]/g, "\\$&");
+
+// src/commands/agent.ts
+var MCP_TEXT = {
+  added: paint("green", "MCP server added"),
+  already: "MCP server already there",
+  removed: "MCP server removed",
+  manual: paint("yellow", "MCP server: add it by hand"),
+  skipped: paint("dim", "MCP server skipped")
+};
+var tilde = (path2) => {
+  const inProject = relative(process.cwd(), path2);
+  if (!inProject.startsWith("..") && !isAbsolute(inProject)) return inProject;
+  return path2.replace(homedir2(), "~");
+};
+function parseTools(value, fallback) {
+  if (!value) return fallback;
+  const ids = value.split(",").map((v) => v.trim().toLowerCase());
+  const unknown = ids.filter((id) => !ASSISTANT_IDS.includes(id));
+  if (unknown.length) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `Unknown assistant: ${unknown.join(", ")}.`,
+      `Use any of: ${ASSISTANT_IDS.join(", ")}.`
+    );
+  }
+  return ids;
+}
+function parseScope(value) {
+  if (value === void 0) return void 0;
+  if (value === "user" || value === "project") return value;
+  throw new CloudhopError("INVALID_NAME", '--scope must be "user" or "project".');
+}
+function printResults(results) {
+  for (const r2 of results) {
+    console.log(`${paint("green", "\u2714")} ${bold(r2.name)}`);
+    console.log(`  skill  ${tilde(r2.skillPath)}`);
+    console.log(`  ${MCP_TEXT[r2.mcp]}${r2.mcpManual ? `: ${r2.mcpManual}` : ""}`);
+  }
+}
+async function agentCommand(installer, args) {
+  const { positional, flags } = parseArgs(args);
+  const action = positional[0] ?? "status";
+  const scopeFlag = parseScope(flags.scope);
+  switch (action) {
+    case "status": {
+      for (const scope of scopeFlag ? [scopeFlag] : ["user", "project"]) {
+        console.log(
+          bold(
+            scope === "user" ? "For you (all projects)" : `This project (${tilde(process.cwd())})`
+          )
+        );
+        for (const s of await installer.status(scope)) {
+          const skill = s.skill === "current" ? paint("green", "\u25CF skill up to date") : s.skill === "outdated" ? paint("yellow", "\u25D0 skill outdated (run `cloudhop agent update`)") : s.skill === "modified" ? paint(
+            "yellow",
+            "\u25D0 skill edited by you (`cloudhop agent update --force` replaces it)"
+          ) : paint("dim", "\u25CB no skill");
+          const mcp = s.mcp === "registered" ? ", MCP on" : s.mcp === "unknown" ? ", MCP: check in the app" : "";
+          const seen = s.detected ? "" : paint("dim", " (not detected)");
+          console.log(`  ${s.name.padEnd(26)} ${skill}${s.skill === "missing" ? "" : mcp}${seen}`);
+        }
+      }
+      return;
+    }
+    case "install": {
+      const detected = installer.detect();
+      let tools = parseTools(flags.tools, detected);
+      let scope = scopeFlag ?? "user";
+      let mcp = !flags.noMcp;
+      if (!flags.tools && interactive() && !flags.yes) {
+        dist_exports.intro("cloudhop agent install");
+        dist_exports.note(
+          "Installs a skill that teaches your AI assistant to ask which cloudhop alias to use,\nrun commands with hop, and confirm before changing anything. Optionally also\nregisters the cloudhop MCP server (tools to list aliases, check sessions and run the CLI).",
+          "Teach your AI assistant cloudhop"
+        );
+        tools = answer(
+          await dist_exports.multiselect({
+            message: "Which assistants do you use?",
+            options: ASSISTANT_IDS.map((id) => ({
+              value: id,
+              label: ASSISTANTS[id].name,
+              ...detected.includes(id) ? { hint: "detected" } : {}
+            })),
+            initialValues: detected,
+            required: true
+          })
+        );
+        if (!scopeFlag) {
+          scope = answer(
+            await dist_exports.select({
+              message: "Where should it go?",
+              options: [
+                { value: "user", label: "For me, in every project", hint: "your home folder" },
+                {
+                  value: "project",
+                  label: "Only this project",
+                  hint: "commit it and your team gets it too"
+                }
+              ]
+            })
+          );
+        }
+        if (!flags.noMcp) {
+          mcp = answer(
+            await dist_exports.confirm({
+              message: "Also register the cloudhop MCP server?",
+              initialValue: true
+            })
+          );
+        }
+      }
+      if (tools.length === 0) {
+        throw new CloudhopError(
+          "INVALID_NAME",
+          "No AI assistant detected.",
+          `Choose them with --tools ${ASSISTANT_IDS.join(",")}.`
+        );
+      }
+      printResults(await installer.install(tools, scope, { mcp }));
+      console.log(
+        paint("dim", "\nStart a new chat (or restart the assistant) so it picks up the skill.")
+      );
+      return;
+    }
+    case "update": {
+      const { updated, edited } = await installer.update({ force: Boolean(flags.force) });
+      for (const file of updated) console.log(`${paint("green", "\u2714")} updated ${tilde(file)}`);
+      for (const file of edited)
+        console.log(
+          `${paint("yellow", "\u25D0")} kept your edits in ${tilde(file)} (use --force to replace)`
+        );
+      if (!updated.length && !edited.length) console.log("Every installed skill is up to date.");
+      return;
+    }
+    case "remove": {
+      const scope = scopeFlag ?? "user";
+      const statuses = await installer.status(scope);
+      const installed = statuses.filter((s) => s.skill !== "missing" || s.mcp === "registered").map((s) => s.assistant);
+      const tools = parseTools(flags.tools, installed);
+      if (tools.length === 0) {
+        console.log(`Nothing to remove for scope "${scope}".`);
+        return;
+      }
+      printResults(await installer.remove(tools, scope));
+      return;
+    }
+    default:
+      throw new CloudhopError(
+        "INVALID_NAME",
+        `Unknown action "${action}".`,
+        "Use: cloudhop agent [status | install | update | remove]"
+      );
+  }
+}
+
+// src/commands/manage.ts
+function printReport(report) {
+  const changes = [
+    `${report.targets.length} available`,
+    report.added.length ? `${report.added.length} new` : "",
+    report.removed.length ? `${report.removed.length} removed` : ""
+  ].filter(Boolean);
+  dist_exports.log.success(`${report.sourceId}: ${changes.join(", ")}.`);
+  for (const t2 of report.added) dist_exports.log.message(`  + ${t2.label}`);
+  for (const t2 of report.removed) dist_exports.log.message(`  - ${t2.label}`);
+  if (report.orphanedAliases.length) {
+    dist_exports.log.warn(
+      `No longer available: ${report.orphanedAliases.join(", ")}. Remove them with \`cloudhop rm <alias>\`.`
+    );
+  }
+}
+async function syncCommand(app, sourceId) {
+  const ids = sourceId ? [sourceId] : (await app.config()).sources.map((s) => s.id);
+  if (ids.length === 0) {
+    dist_exports.log.info("No sources yet. Run `cloudhop add`.");
+    return;
+  }
+  for (const id of ids) {
+    await app.ensureSession(id);
+    printReport(await app.syncSource(id));
+  }
+}
+async function loginCommand(app, sourceId) {
+  const { sources } = await app.config();
+  const id = sourceId ?? answer(
+    await dist_exports.select({
+      message: "Log in to which source?",
+      options: sources.map((s) => ({ value: s.id, label: s.id }))
+    })
+  );
+  printReport(await app.login(id));
+}
 var SESSION_LABEL = {
   valid: paint("green", "\u25CF session valid"),
   refreshable: paint("yellow", "\u25D0 renews automatically on next use"),
   expired: paint("red", "\u25CB expired, opens the browser on next use"),
   unknown: paint("dim", "\xB7 session managed by the cloud CLI")
 };
-async function listCommand(app, sourceId) {
+var JSON_VERSION = 1;
+var printJson = (value) => console.log(JSON.stringify({ version: JSON_VERSION, ...value }, null, 2));
+async function listCommand(app, args = []) {
+  const { positional, flags } = parseArgs(args);
+  const sourceId = positional[0];
+  if (flags.json) {
+    const overview = await app.overview();
+    if (sourceId && !overview.sources.some((s) => s.id === sourceId)) {
+      throw new CloudhopError("SOURCE_NOT_FOUND", `Source "${sourceId}" not found.`);
+    }
+    printJson(
+      sourceId ? {
+        sources: overview.sources.filter((s) => s.id === sourceId),
+        aliases: overview.aliases.filter((a2) => a2.source === sourceId)
+      } : overview
+    );
+    return;
+  }
   const config = await app.config();
   if (config.sources.length === 0) {
     console.log("Nothing here yet. Run `cloudhop setup` to get started.");
@@ -11059,389 +12171,208 @@ async function providerCommand(app, args) {
     for (const pid of PROVIDER_IDS) {
       const available = app.availableProviders().some((x2) => x2.id === pid);
       const status = providers.includes(pid) ? "enabled" : available ? "disabled" : "coming soon";
-      console.log(`  ${pid.padEnd(8)} ${status}`);
-    }
-    return;
-  }
-  if (!id || !PROVIDER_IDS.includes(id)) {
-    throw new Error(`Usage: cloudhop provider ${action} <${PROVIDER_IDS.join("|")}>`);
-  }
-  if (action === "enable") await app.enableProvider(id);
-  else if (action === "disable") await app.disableProvider(id);
-  else throw new Error("Usage: cloudhop provider [ls|enable|disable] <provider>");
-  dist_exports.log.success(`${id} ${action}d.`);
-}
-async function regionCommand(app, args) {
-  const [aliasArg, regionArg] = args;
-  if ((!aliasArg || !regionArg) && !interactive()) {
-    throw new CloudhopError("INVALID_NAME", "Usage: cloudhop region <alias> <region>");
-  }
-  const aliases = await app.listAliases();
-  const name = aliasArg ?? answer(
-    await dist_exports.select({
-      message: "Which alias?",
-      options: aliases.map((a2) => ({
-        value: a2.alias.name,
-        label: a2.alias.name,
-        hint: `${a2.target?.label ?? a2.alias.target}, ${a2.region}`
-      }))
-    })
-  );
-  const current = await app.resolveAlias(name);
-  const validate = regionValidator(app, current.source);
-  const region = regionArg?.trim() ?? (answer(
-    await dist_exports.text({
-      message: `Region for ${name}`,
-      placeholder: current.region,
-      defaultValue: current.region,
-      validate: (v) => v?.trim() ? validate?.(v.trim()) : void 0
-    })
-  ).trim() || current.region);
-  const problem = region ? validate?.(region) : "Say which region.";
-  if (!region || problem) throw new CloudhopError("INVALID_NAME", problem ?? "Invalid region.");
-  await app.setAliasRegion(name, region);
-  console.log(`${name}: ${current.region ?? "(none)"} \u2192 ${region}`);
-}
-
-// src/commands/run.ts
-async function proxyCommand(app, alias, args) {
-  const resolved = await app.resolveAlias(alias);
-  const defaultArgs = resolved.source.provider === "aws" ? ["sts", "get-caller-identity"] : [];
-  return app.runAsAlias(alias, args.length > 0 ? args : defaultArgs);
-}
-async function execCommand(app, args) {
-  const separator = args.indexOf("--");
-  const before = separator === -1 ? args.slice(0, 1) : args.slice(0, separator);
-  const command = separator === -1 ? args.slice(1) : args.slice(separator + 1);
-  const [alias, ...flags] = before;
-  if (!alias || command.length === 0) {
-    throw new Error("Usage: cloudhop exec <alias> [--region <region>] -- <command> [args...]");
-  }
-  const overrides = {};
-  const regionIndex = flags.indexOf("--region");
-  if (regionIndex !== -1 && flags[regionIndex + 1])
-    overrides.region = flags[regionIndex + 1];
-  const [bin, ...rest] = command;
-  return app.execAsAlias(alias, bin, rest, overrides);
-}
-
-// src/commands/setup.ts
-var UPCOMING = ["Azure", "Google Cloud"];
-var WELCOME = [
-  "cloudhop lets you hop between cloud accounts, roles and regions with one command.",
-  "Add your SSO portals and personal accounts once and give each account/role a short",
-  "alias. Then `hop <alias> <command>` runs the cloud CLI as that account: cloudhop",
-  "logs you in when a session expires, and never stores access keys."
-].join("\n");
-async function offerInstall(app, entry) {
-  const { cli, tool, recipe, outdated } = entry;
-  if (tool.installed && !outdated) return true;
-  const problem = outdated ? `${cli.displayName} ${tool.version} is too old (cloudhop needs ${cli.minVersion}+).` : `${cli.displayName} is not installed. cloudhop can still log you in, but needs it to run \`${cli.command}\` commands.`;
-  dist_exports.log.warn(problem);
-  if (!recipe?.command) {
-    dist_exports.log.info(
-      `Install it from ${recipe?.manualUrl ?? "the official docs"}, then run \`cloudhop doctor\`.`
-    );
-    return false;
-  }
-  const command = [recipe.command, ...recipe.args].join(" ");
-  const install = answer(
-    await dist_exports.confirm({ message: `Install it with ${recipe.via}?  (${command})` })
-  );
-  if (!install) return false;
-  const ok = await app.installCli(recipe);
-  if (ok) dist_exports.log.success(`${cli.displayName} installed.`);
-  else dist_exports.log.error(`Could not install automatically. See ${recipe.manualUrl}`);
-  return ok;
-}
-async function setupCommand(app) {
-  requireInteractive(
-    "setup",
-    "Run it in a regular terminal, or script it: `cloudhop provider enable aws`, then `cloudhop add aws sso --start-url <url> --region <r>`."
-  );
-  printBanner();
-  dist_exports.intro("cloudhop setup");
-  dist_exports.note(WELCOME, "Welcome");
-  const config = await app.config();
-  const providers = answer(
-    await dist_exports.multiselect({
-      message: "Which clouds do you use?",
-      options: app.availableProviders().map((provider) => ({ value: provider.id, label: provider.displayName })),
-      initialValues: config.providers.length > 0 ? config.providers : ["aws"],
-      required: true
-    })
-  );
-  dist_exports.log.info(`Coming soon: ${UPCOMING.join(", ")}.`);
-  await app.setEnabledProviders(providers);
-  for (const entry of await app.doctor()) {
-    if (entry.tool.installed && !entry.outdated) {
-      dist_exports.log.success(`${entry.cli.displayName} ${entry.tool.version ?? ""} found.`);
-    } else {
-      await offerInstall(app, entry);
-    }
-  }
-  const addNow = answer(await dist_exports.confirm({ message: "Add an account or SSO portal now?" }));
-  if (!addNow) {
-    dist_exports.outro("All set. Run `cloudhop add` whenever you are ready.");
-    return;
-  }
-  await addCommand(app, { positional: [], flags: {} });
-}
-async function doctorCommand(app) {
-  dist_exports.intro("cloudhop doctor");
-  const entries = await app.doctor();
-  if (entries.length === 0) {
-    dist_exports.outro("No cloud enabled. Run `cloudhop setup`.");
-    return;
-  }
-  let healthy = true;
-  for (const entry of entries) {
-    if (entry.tool.installed && !entry.outdated) {
-      dist_exports.log.success(`${entry.displayName}: ${entry.cli.displayName} ${entry.tool.version ?? ""}`);
-    } else {
-      healthy = await offerInstall(app, entry) && healthy;
-    }
-  }
-  dist_exports.outro(
-    healthy ? "Everything looks good." : "Some tools are missing; login and `cloudhop exec` still work."
-  );
-}
-
-// ../adapters-node/src/node-browser-opener.ts
-import { spawn } from "child_process";
-var NodeBrowserOpener = class {
-  async open(url) {
-    const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", '""', url.replace(/&/g, "^&")]] : ["xdg-open", [url]];
-    await new Promise((resolve) => {
-      const child = spawn(command, args, { stdio: "ignore", detached: true });
-      child.on("error", () => resolve());
-      child.on("spawn", () => {
-        child.unref();
-        resolve();
-      });
-    });
-  }
-};
-
-// ../adapters-node/src/node-process-runner.ts
-import { spawn as spawn2 } from "child_process";
-var STDERR_TAIL_BYTES = 8 * 1024;
-function buildEnv(overrides) {
-  const env = { ...process.env };
-  for (const [key, value] of Object.entries(overrides ?? {})) {
-    if (value === void 0) delete env[key];
-    else env[key] = value;
-  }
-  return env;
-}
-var useShell = process.platform === "win32";
-var NodeProcessRunner = class {
-  run(command, args, options = {}) {
-    return new Promise((resolve, reject) => {
-      const child = spawn2(command, args, {
-        env: buildEnv(options.env),
-        stdio: ["inherit", "inherit", options.captureStderr ? "pipe" : "inherit"],
-        shell: useShell
-      });
-      let tail = "";
-      child.stderr?.on("data", (chunk) => {
-        process.stderr.write(chunk);
-        tail = (tail + chunk.toString()).slice(-STDERR_TAIL_BYTES);
-      });
-      const ignore = () => {
-      };
-      process.on("SIGINT", ignore);
-      process.on("SIGTERM", ignore);
-      const cleanup = () => {
-        process.off("SIGINT", ignore);
-        process.off("SIGTERM", ignore);
-      };
-      child.on("error", (error) => {
-        cleanup();
-        reject(error);
-      });
-      child.on("close", (code, signal) => {
-        cleanup();
-        resolve({ exitCode: code ?? (signal ? 128 + 2 : 1), stderrTail: tail });
-      });
-    });
-  }
-  capture(command, args, options = {}) {
-    return new Promise((resolve) => {
-      const child = spawn2(command, args, { env: buildEnv(options.env), shell: useShell });
-      let stdout2 = "";
-      let stderr = "";
-      child.stdout.on("data", (c3) => {
-        stdout2 += c3.toString();
-      });
-      child.stderr.on("data", (c3) => {
-        stderr += c3.toString();
-      });
-      child.on("error", (error) => resolve({ exitCode: 127, stdout: stdout2, stderr: error.message }));
-      child.on("close", (code) => resolve({ exitCode: code ?? 1, stdout: stdout2, stderr }));
-    });
-  }
-  async probe(command) {
-    const result = await this.capture(command, ["--version"]);
-    if (result.exitCode !== 0) return { installed: false };
-    const output = `${result.stdout} ${result.stderr}`;
-    const version = output.match(/(\d+\.\d+\.\d+)/)?.[1];
-    return { installed: true, ...version ? { version } : {} };
-  }
-};
-
-// ../adapters-node/src/system-tool-installer.ts
-var TOOLS = {
-  aws: {
-    manualUrl: "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html",
-    recipes: {
-      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "awscli"] }],
-      win32: [
-        { via: "winget", command: "winget", args: ["install", "--exact", "--id", "Amazon.AWSCLI"] }
-      ]
-    }
-  },
-  az: {
-    manualUrl: "https://learn.microsoft.com/cli/azure/install-azure-cli",
-    recipes: {
-      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "azure-cli"] }],
-      win32: [
-        {
-          via: "winget",
-          command: "winget",
-          args: ["install", "--exact", "--id", "Microsoft.AzureCLI"]
-        }
-      ]
-    }
-  },
-  gcloud: {
-    manualUrl: "https://cloud.google.com/sdk/docs/install",
-    recipes: {
-      darwin: [
-        { via: "Homebrew", command: "brew", args: ["install", "--cask", "google-cloud-sdk"] }
-      ],
-      win32: [
-        {
-          via: "winget",
-          command: "winget",
-          args: ["install", "--exact", "--id", "Google.CloudSDK"]
-        }
-      ]
-    }
-  }
-};
-var SystemToolInstaller = class {
-  constructor(runner, platform = process.platform) {
-    this.runner = runner;
-    this.platform = platform;
-  }
-  runner;
-  platform;
-  available = /* @__PURE__ */ new Map();
-  recipeFor(command) {
-    const tool = TOOLS[command];
-    if (!tool) return void 0;
-    const recipe = tool.recipes[this.platform]?.[0];
-    return recipe ? { ...recipe, manualUrl: tool.manualUrl } : { via: "official installer", command: "", args: [], manualUrl: tool.manualUrl };
-  }
-  async install(recipe) {
-    if (!recipe.command) return false;
-    if (!await this.hasCommand(recipe.command)) return false;
-    const { exitCode } = await this.runner.run(recipe.command, recipe.args);
-    return exitCode === 0;
-  }
-  async hasCommand(command) {
-    if (!this.available.has(command)) {
-      this.available.set(command, (await this.runner.probe(command)).installed);
+      console.log(`  ${pid.padEnd(8)} ${status}`);
     }
-    return this.available.get(command) ?? false;
+    return;
   }
-};
-
-// ../adapters-node/src/yaml-config-store.ts
-import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { join as join2 } from "path";
-var import_yaml = __toESM(require_dist(), 1);
-function defaultConfigDir(env = process.env) {
-  if (env.CLOUDHOP_HOME) return env.CLOUDHOP_HOME;
-  return join2(env.XDG_CONFIG_HOME || join2(homedir(), ".config"), "cloudhop");
-}
-var HEADER = "# cloudhop configuration. Contains no secrets.\n# Docs: https://github.com/dayepesb/cloudhop\n";
-var YamlConfigStore = class {
-  constructor(dir = defaultConfigDir()) {
-    this.dir = dir;
+  if (!id || !PROVIDER_IDS.includes(id)) {
+    throw new Error(`Usage: cloudhop provider ${action} <${PROVIDER_IDS.join("|")}>`);
   }
-  dir;
-  get configPath() {
-    return join2(this.dir, "config.yaml");
+  if (action === "enable") await app.enableProvider(id);
+  else if (action === "disable") await app.disableProvider(id);
+  else throw new Error("Usage: cloudhop provider [ls|enable|disable] <provider>");
+  dist_exports.log.success(`${id} ${action}d.`);
+}
+async function regionCommand(app, args) {
+  const [aliasArg, regionArg] = args;
+  if ((!aliasArg || !regionArg) && !interactive()) {
+    throw new CloudhopError("INVALID_NAME", "Usage: cloudhop region <alias> <region>");
   }
-  get targetsPath() {
-    return join2(this.dir, "targets.json");
+  const aliases = await app.listAliases();
+  const name = aliasArg ?? answer(
+    await dist_exports.select({
+      message: "Which alias?",
+      options: aliases.map((a2) => ({
+        value: a2.alias.name,
+        label: a2.alias.name,
+        hint: `${a2.target?.label ?? a2.alias.target}, ${a2.region}`
+      }))
+    })
+  );
+  const current = await app.resolveAlias(name);
+  const validate = regionValidator(app, current.source);
+  const region = regionArg?.trim() ?? (answer(
+    await dist_exports.text({
+      message: `Region for ${name}`,
+      placeholder: current.region,
+      defaultValue: current.region,
+      validate: (v) => v?.trim() ? validate?.(v.trim()) : void 0
+    })
+  ).trim() || current.region);
+  const problem = region ? validate?.(region) : "Say which region.";
+  if (!region || problem) throw new CloudhopError("INVALID_NAME", problem ?? "Invalid region.");
+  await app.setAliasRegion(name, region);
+  console.log(`${name}: ${current.region ?? "(none)"} \u2192 ${region}`);
+}
+var STATE_SHORT = {
+  valid: paint("green", "\u25CF session valid"),
+  refreshable: paint("yellow", "\u25D0 session expired, renewable"),
+  expired: paint("red", "\u25CB session expired"),
+  unknown: paint("dim", "\xB7 session")
+};
+var NEXT_TEXT = {
+  ready: "ready to run",
+  "silent-renewal": "the next command renews the session silently",
+  "browser-sign-in": "the next command opens the browser to sign in",
+  unknown: "the cloud CLI manages this session"
+};
+async function statusCommand(app, args) {
+  const { positional, flags } = parseArgs(args);
+  const name = positional[0];
+  if (name) {
+    const status = await app.aliasStatus(name);
+    if (flags.json) return printJson({ alias: status });
+    const account = status.attributes.accountId ? ` (${status.attributes.accountId})` : "";
+    console.log(
+      `${bold(paint("sky", status.name))} \u2192 ${status.label ?? status.target}${account}, ${status.region ?? "no region"}`
+    );
+    console.log(`  ${STATE_SHORT[status.session]}: ${NEXT_TEXT[status.next]}`);
+    if (status.next === "browser-sign-in") {
+      console.log(paint("dim", `  Sign in now with \`cloudhop login ${status.source}\`.`));
+    }
+    if (!status.available) console.log(paint("red", "  This account/role is no longer available."));
+    return;
   }
-  async load() {
-    const raw = await this.read(this.configPath);
-    if (!raw) return emptyConfig();
-    const file = (0, import_yaml.parse)(raw) ?? {};
-    return {
-      providers: (file.providers ?? []).filter(
-        (p3) => PROVIDER_IDS.includes(p3)
-      ),
-      sources: Object.entries(file.sources ?? {}).map(([id, s]) => ({
-        id,
-        ...s,
-        settings: s.settings ?? {}
-      })),
-      aliases: Object.entries(file.aliases ?? {}).map(([name, a2]) => ({ name, ...a2 }))
-    };
+  const overview = await app.overview();
+  if (flags.json) return printJson({ sources: overview.sources });
+  if (overview.sources.length === 0) {
+    console.log("Nothing here yet. Run `cloudhop setup` to get started.");
+    return;
   }
-  async save(config) {
-    const file = {
-      providers: config.providers,
-      sources: Object.fromEntries(config.sources.map(({ id, ...rest }) => [id, rest])),
-      aliases: Object.fromEntries(config.aliases.map(({ name, ...rest }) => [name, rest]))
-    };
-    await this.write(this.configPath, HEADER + (0, import_yaml.stringify)(file));
+  for (const source of overview.sources) {
+    console.log(
+      `${bold(paint("sky", source.id))}  ${STATE_SHORT[source.session]}: ${NEXT_TEXT[source.next]}`
+    );
   }
-  async loadTargets(sourceId) {
-    return (await this.allTargets())[sourceId] ?? [];
+}
+
+// src/commands/run.ts
+async function proxyCommand(app, alias, args) {
+  return app.runAsAlias(alias, args.length > 0 ? args : await app.identityArgs(alias));
+}
+async function execCommand(app, args) {
+  const separator = args.indexOf("--");
+  const before = separator === -1 ? args.slice(0, 1) : args.slice(0, separator);
+  const command = separator === -1 ? args.slice(1) : args.slice(separator + 1);
+  const [alias, ...flags] = before;
+  if (!alias || command.length === 0) {
+    throw new Error("Usage: cloudhop exec <alias> [--region <region>] -- <command> [args...]");
   }
-  async saveTargets(sourceId, targets) {
-    const all = await this.allTargets();
-    all[sourceId] = targets;
-    await this.write(this.targetsPath, JSON.stringify(all, null, 2));
+  const overrides = {};
+  const regionIndex = flags.indexOf("--region");
+  if (regionIndex !== -1 && flags[regionIndex + 1])
+    overrides.region = flags[regionIndex + 1];
+  const [bin, ...rest] = command;
+  return app.execAsAlias(alias, bin, rest, overrides);
+}
+
+// src/commands/setup.ts
+var UPCOMING = ["Azure", "Google Cloud"];
+var WELCOME = [
+  "cloudhop lets you hop between cloud accounts, roles and regions with one command.",
+  "Add your SSO portals and personal accounts once and give each account/role a short",
+  "alias. Then `hop <alias> <command>` runs the cloud CLI as that account: cloudhop",
+  "logs you in when a session expires, and never stores access keys."
+].join("\n");
+async function offerInstall(app, entry) {
+  const { cli, tool, recipe, outdated } = entry;
+  if (tool.installed && !outdated) return true;
+  const problem = outdated ? `${cli.displayName} ${tool.version} is too old (cloudhop needs ${cli.minVersion}+).` : `${cli.displayName} is not installed. cloudhop can still log you in, but needs it to run \`${cli.command}\` commands.`;
+  dist_exports.log.warn(problem);
+  if (!recipe?.command) {
+    dist_exports.log.info(
+      `Install it from ${recipe?.manualUrl ?? "the official docs"}, then run \`cloudhop doctor\`.`
+    );
+    return false;
   }
-  async removeTargets(sourceId) {
-    const all = await this.allTargets();
-    delete all[sourceId];
-    await this.write(this.targetsPath, JSON.stringify(all, null, 2));
+  const command = [recipe.command, ...recipe.args].join(" ");
+  const install = answer(
+    await dist_exports.confirm({ message: `Install it with ${recipe.via}?  (${command})` })
+  );
+  if (!install) return false;
+  const ok = await app.installCli(recipe);
+  if (ok) dist_exports.log.success(`${cli.displayName} installed.`);
+  else dist_exports.log.error(`Could not install automatically. See ${recipe.manualUrl}`);
+  return ok;
+}
+async function setupCommand(app, assistants) {
+  requireInteractive(
+    "setup",
+    "Run it in a regular terminal, or script it: `cloudhop provider enable aws`, then `cloudhop add aws sso --start-url <url> --region <r>`."
+  );
+  printBanner();
+  dist_exports.intro("cloudhop setup");
+  dist_exports.note(WELCOME, "Welcome");
+  const config = await app.config();
+  const providers = answer(
+    await dist_exports.multiselect({
+      message: "Which clouds do you use?",
+      options: app.availableProviders().map((provider) => ({ value: provider.id, label: provider.displayName })),
+      initialValues: config.providers.length > 0 ? config.providers : ["aws"],
+      required: true
+    })
+  );
+  dist_exports.log.info(`Coming soon: ${UPCOMING.join(", ")}.`);
+  await app.setEnabledProviders(providers);
+  for (const entry of await app.doctor()) {
+    if (entry.tool.installed && !entry.outdated) {
+      dist_exports.log.success(`${entry.cli.displayName} ${entry.tool.version ?? ""} found.`);
+    } else {
+      await offerInstall(app, entry);
+    }
   }
-  async reset() {
-    await rm(this.dir, { recursive: true, force: true });
+  const addNow = answer(await dist_exports.confirm({ message: "Add an account or SSO portal now?" }));
+  if (addNow) await addCommand(app, { positional: [], flags: {} });
+  else dist_exports.log.info("Run `cloudhop add` whenever you are ready.");
+  const detected = assistants.detect();
+  if (detected.length > 0) {
+    const names = detected.map((id) => ASSISTANTS[id].name).join(", ");
+    const teach = answer(
+      await dist_exports.confirm({
+        message: `Teach your AI assistant (${names}) to use cloudhop?`,
+        initialValue: true
+      })
+    );
+    if (teach) {
+      await agentCommand(assistants, ["install"]);
+      return;
+    }
+    dist_exports.log.info("You can do it later with `cloudhop agent install`.");
   }
-  async allTargets() {
-    const raw = await this.read(this.targetsPath);
-    return raw ? JSON.parse(raw) : {};
+  if (!addNow) dist_exports.outro("All set.");
+}
+async function doctorCommand(app) {
+  dist_exports.intro("cloudhop doctor");
+  const entries = await app.doctor();
+  if (entries.length === 0) {
+    dist_exports.outro("No cloud enabled. Run `cloudhop setup`.");
+    return;
   }
-  async read(path2) {
-    try {
-      return await readFile(path2, "utf8");
-    } catch (error) {
-      if (error.code === "ENOENT") return void 0;
-      throw error;
+  let healthy = true;
+  for (const entry of entries) {
+    if (entry.tool.installed && !entry.outdated) {
+      dist_exports.log.success(`${entry.displayName}: ${entry.cli.displayName} ${entry.tool.version ?? ""}`);
+    } else {
+      healthy = await offerInstall(app, entry) && healthy;
     }
   }
-  /** Writes through a temp file so a crash never leaves a half-written config. */
-  async write(path2, content) {
-    await mkdir(this.dir, { recursive: true, mode: 448 });
-    const tmp = `${path2}.${process.pid}.tmp`;
-    await writeFile(tmp, content, { mode: 384 });
-    await rename(tmp, path2);
-  }
-};
+  dist_exports.outro(
+    healthy ? "Everything looks good." : "Some tools are missing; login and `cloudhop exec` still work."
+  );
+}
 
 // ../ui/src/api.ts
-var text2 = (body, key) => {
+var text3 = (body, key) => {
   const value = body[key];
   return typeof value === "string" ? value.trim() : "";
 };
@@ -11460,7 +12391,23 @@ var reportView = (report) => ({
   removed: report.removed.length,
   orphanedAliases: report.orphanedAliases
 });
-function createApi(app) {
+var SCOPES = /* @__PURE__ */ new Set(["user", "project"]);
+var scopeOf = (value) => {
+  if (SCOPES.has(value)) return value;
+  throw badRequest('Scope must be "user" or "project".');
+};
+var assistantIds = (value) => {
+  const ids = Array.isArray(value) ? value : [];
+  if (ids.length === 0 || !ids.every((id) => ASSISTANT_IDS.includes(id))) {
+    throw badRequest("Choose at least one assistant.");
+  }
+  return ids;
+};
+function createApi(app, assistants) {
+  const requireAssistants = () => {
+    if (!assistants) throw badRequest("AI assistant setup is not available here.");
+    return assistants;
+  };
   const regionCheck = (source, region) => {
     const validate = app.provider(source.provider).sourceKinds.find((k) => k.kind === source.kind)?.fields.find((f2) => f2.key === "region")?.validate;
     const problem = region ? validate?.(region) : "Region is required.";
@@ -11518,6 +12465,26 @@ function createApi(app) {
         }))
       };
     },
+    /** Which AI assistants know cloudhop, for both scopes. Paths are shown, never file contents. */
+    "GET /api/assistants": async () => {
+      const installer = requireAssistants();
+      return {
+        project: process.cwd(),
+        user: await installer.status("user"),
+        projectScope: await installer.status("project")
+      };
+    },
+    "POST /api/assistants": async (_2, body) => {
+      const tools = assistantIds(body.tools);
+      const scope = scopeOf(body.scope);
+      return {
+        results: await requireAssistants().install(tools, scope, { mcp: body.mcp !== false })
+      };
+    },
+    "POST /api/assistants/remove": async (_2, body) => ({
+      results: await requireAssistants().remove(assistantIds(body.tools), scopeOf(body.scope))
+    }),
+    "POST /api/assistants/update": async (_2, body) => requireAssistants().update({ force: body.force === true }),
     "GET /api/doctor": async () => (await app.doctor()).map((entry) => ({
       provider: entry.provider,
       cli: entry.cli.displayName,
@@ -11536,19 +12503,19 @@ function createApi(app) {
     },
     /** Adds a source and logs in right away, like `cloudhop add`; a failed login adds nothing. */
     "POST /api/sources": async (_2, body) => {
-      const provider = app.provider(text2(body, "provider"));
-      const kind = provider.sourceKinds.find((k) => k.kind === text2(body, "kind"));
+      const provider = app.provider(text3(body, "provider"));
+      const kind = provider.sourceKinds.find((k) => k.kind === text3(body, "kind"));
       if (!kind) throw badRequest("Choose what you want to add.");
       const input = body.settings ?? {};
       const settings2 = {};
       for (const field of kind.fields) {
-        const value = text2(input, field.key) || field.defaultValue || "";
+        const value = text3(input, field.key) || field.defaultValue || "";
         if (!value) throw badRequest(`${field.label} is required.`);
         const problem = field.validate?.(value);
         if (problem) throw badRequest(`${field.label}: ${problem}`);
         settings2[field.key] = value;
       }
-      const id = text2(body, "id");
+      const id = text3(body, "id");
       return reportView(
         await app.connectSource({ id, provider: provider.id, kind: kind.kind, settings: settings2 })
       );
@@ -11576,13 +12543,13 @@ function createApi(app) {
       if (items.length === 0) throw badRequest("Pick at least one account/role.");
       const aliases = [];
       for (const item of items) {
-        const source = await findSource(text2(item, "source"));
-        const region = text2(item, "region");
+        const source = await findSource(text3(item, "source"));
+        const region = text3(item, "region");
         if (region) regionCheck(source, region);
         aliases.push({
-          name: text2(item, "name"),
+          name: text3(item, "name"),
           source: source.id,
-          target: text2(item, "target"),
+          target: text3(item, "target"),
           ...region && region !== source.settings.region ? { region } : {}
         });
       }
@@ -11591,7 +12558,7 @@ function createApi(app) {
     },
     "PATCH /api/aliases/:name": async ([name], body) => {
       const resolved = await app.resolveAlias(name);
-      const region = text2(body, "region");
+      const region = text3(body, "region");
       regionCheck(resolved.source, region);
       await app.setAliasRegion(name, region);
       return { name, region };
@@ -11631,7 +12598,7 @@ import { randomBytes, timingSafeEqual } from "crypto";
 import { createServer } from "http";
 
 // ../ui/src/assets/app.js
-var app_default = "// cloudhop local UI. Plain DOM, no build step: served as-is by `cloudhop ui`.\n\nconst TOKEN_KEY = 'cloudhop-token';\nconst SESSION_TEXT = {\n  valid: 'Session valid',\n  refreshable: 'Renews on next use',\n  expired: 'Expired: sign in on next use',\n  unknown: 'Managed by the cloud CLI',\n};\n\n// The token arrives in the URL fragment once; keep it for this tab and clean the address bar.\nconst fromHash = new URLSearchParams(location.hash.slice(1)).get('token');\nif (fromHash) {\n  try {\n    sessionStorage.setItem(TOKEN_KEY, fromHash);\n  } catch {}\n  history.replaceState(null, '', location.pathname);\n}\nlet token = fromHash;\ntry {\n  token = token ?? sessionStorage.getItem(TOKEN_KEY);\n} catch {}\n\n// A fresh link opened in this same tab only changes the fragment: reload to pick up its token.\naddEventListener('hashchange', () => {\n  if (new URLSearchParams(location.hash.slice(1)).has('token')) location.reload();\n});\n\nconst $main = document.getElementById('main');\nconst $dialog = document.getElementById('dialog');\nconst $toasts = document.getElementById('toasts');\nconst $addSource = document.getElementById('add-source');\nlet state;\n\n/** Tiny element builder: h('button', { class: 'primary', onclick }, 'Save'). */\nfunction h(tag, attrs = {}, ...children) {\n  const el = document.createElement(tag);\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null || value === false) continue;\n    if (key.startsWith('on')) el.addEventListener(key.slice(2), value);\n    else if (key === 'class') el.className = value;\n    else if (value === true) el.setAttribute(key, '');\n    else el.setAttribute(key, value);\n  }\n  for (const child of children.flat()) {\n    if (child === undefined || child === null || child === false) continue;\n    el.append(child instanceof Node ? child : document.createTextNode(String(child)));\n  }\n  return el;\n}\n\nclass ApiError extends Error {\n  constructor(message, hint) {\n    super(message);\n    this.hint = hint;\n  }\n}\n\n// Calls that may sign in wait for the person in the browser; everything else should answer quickly.\nconst MAY_SIGN_IN = /^\\/api\\/sources(\\/[^/]+\\/(login|sync|targets))?$/;\nconst QUICK_TIMEOUT_MS = 20_000;\n\nasync function api(method, path, body) {\n  const waitsForPerson = MAY_SIGN_IN.test(path);\n  let response;\n  try {\n    response = await fetch(path, {\n      method,\n      headers: {\n        'x-cloudhop-token': token ?? '',\n        ...(body ? { 'content-type': 'application/json' } : {}),\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: waitsForPerson ? undefined : AbortSignal.timeout(QUICK_TIMEOUT_MS),\n    });\n  } catch (error) {\n    if (error.name === 'TimeoutError') {\n      throw new ApiError(\n        'cloudhop ui is not responding.',\n        'Is it paused in your terminal (Ctrl-Z)? Run `fg` there, or stop it and run `cloudhop ui` again.',\n      );\n    }\n    throw new ApiError(\n      'cloudhop ui is not running.',\n      'Run `cloudhop ui` again and open the new link it prints.',\n    );\n  }\n  const data = await response.json().catch(() => ({}));\n  if (!response.ok)\n    throw new ApiError(data.error ?? `Request failed (${response.status}).`, data.hint);\n  return data;\n}\n\nfunction toast(message, { error = false, hint } = {}) {\n  const el = h(\n    'div',\n    { class: `toast${error ? ' error' : ''}` },\n    message,\n    hint && h('small', {}, hint),\n  );\n  $toasts.append(el);\n  setTimeout(() => el.remove(), error ? 9000 : 4000);\n}\n\nconst fail = (error) => toast(error.message, { error: true, hint: error.hint });\n\n/** Disables a button while its action runs. */\nasync function busy(button, action) {\n  button.disabled = true;\n  try {\n    return await action();\n  } finally {\n    button.disabled = false;\n  }\n}\n\nasync function refresh() {\n  try {\n    state = await api('GET', '/api/state');\n    render();\n    checkDoctor();\n  } catch (error) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Cannot reach cloudhop'),\n        h('p', {}, error.message, error.hint ? ` ${error.hint}` : ''),\n      ),\n    );\n  }\n}\n\nasync function checkDoctor() {\n  try {\n    const entries = await api('GET', '/api/doctor');\n    const problems = entries.filter((e) => !e.installed || e.outdated);\n    document.getElementById('doctor')?.remove();\n    if (problems.length === 0) return;\n    $main.prepend(\n      h(\n        'div',\n        { class: 'notice', id: 'doctor' },\n        ...problems.map((e) =>\n          h(\n            'div',\n            {},\n            e.installed\n              ? `${e.cli} ${e.version} is older than ${e.minVersion}. `\n              : `${e.cli} is not installed, so aliases cannot run commands yet. `,\n            'Run ',\n            h('code', {}, 'cloudhop doctor'),\n            ' in a terminal to install it.',\n          ),\n        ),\n      ),\n    );\n  } catch {}\n}\n\n// ---------- main view ----------\n\nfunction render() {\n  const enabled = state.enabledProviders;\n  $addSource.hidden = enabled.length === 0;\n  if (enabled.length === 0) return renderChooseClouds();\n  if (state.sources.length === 0) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Add your first account'),\n        h(\n          'p',\n          {},\n          'Add a company SSO portal or a personal account. cloudhop signs you in, finds every account and role you can use, and lets you give each one a short alias.',\n        ),\n        h('button', { class: 'primary', onclick: () => openAddSource() }, '+ Add source'),\n      ),\n    );\n    return;\n  }\n  $main.replaceChildren(...state.sources.map(sourceCard));\n}\n\nfunction renderChooseClouds() {\n  const boxes = state.providers.map((p) =>\n    h(\n      'label',\n      { class: 'choice' },\n      h('input', { type: 'checkbox', value: p.id, checked: true }),\n      h('span', {}, p.name),\n    ),\n  );\n  const save = h(\n    'button',\n    {\n      class: 'primary',\n      onclick: (e) =>\n        busy(e.currentTarget, async () => {\n          const ids = boxes\n            .map((b) => b.querySelector('input'))\n            .filter((i) => i.checked)\n            .map((i) => i.value);\n          await api('PUT', '/api/providers', { enabled: ids }).catch(fail);\n          await refresh();\n        }),\n    },\n    'Continue',\n  );\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Which clouds do you use?'),\n      h('p', {}, 'Azure and Google Cloud are coming soon.'),\n      h(\n        'div',\n        { class: 'choices', style: 'max-width:320px;margin:0 auto 16px;text-align:left' },\n        boxes,\n      ),\n      save,\n    ),\n  );\n}\n\nfunction sourceCard(source) {\n  const aliases = state.aliases.filter((a) => a.source === source.id);\n  const where = source.settings.startUrl ?? source.kindLabel;\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, source.id),\n    h('span', { class: `badge ${source.session}` }, SESSION_TEXT[source.session] ?? source.session),\n    h('span', { class: 'meta' }, `${source.providerName} \xB7 ${where}`),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      h('button', { onclick: () => openAliasPicker(source) }, '+ Aliases'),\n      h(\n        'button',\n        {\n          title: 'Sign in again and refresh its accounts',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              toast('Opening the browser to sign in\u2026');\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/login`,\n              ).catch(fail);\n              if (report)\n                toast(`${source.id}: signed in, ${report.targets.length} account/role(s).`);\n              await refresh();\n            }),\n        },\n        'Sign in',\n      ),\n      h(\n        'button',\n        {\n          title: 'Refresh the accounts and roles you have access to',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/sync`,\n              ).catch(fail);\n              if (report) toast(syncMessage(source.id, report));\n              await refresh();\n            }),\n        },\n        'Sync',\n      ),\n      h(\n        'button',\n        {\n          class: 'danger',\n          onclick: (e) => {\n            const count = aliases.length;\n            const message = `Remove \"${source.id}\"${count ? ` and its ${count} alias(es)` : ''}?`;\n            if (!confirm(message)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/sources/${encodeURIComponent(source.id)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        'Remove',\n      ),\n    ),\n  );\n\n  const body =\n    aliases.length === 0\n      ? h(\n          'div',\n          { class: 'empty' },\n          'No aliases yet. ',\n          h(\n            'button',\n            { class: 'primary', onclick: () => openAliasPicker(source) },\n            'Pick accounts',\n          ),\n        )\n      : h(\n          'table',\n          {},\n          h(\n            'thead',\n            {},\n            h(\n              'tr',\n              {},\n              h('th', {}, 'Alias'),\n              h('th', {}, 'Region'),\n              h('th', {}, 'Account / role'),\n              h('th'),\n            ),\n          ),\n          h('tbody', {}, aliases.map(aliasRow)),\n        );\n  return h('section', { class: 'card' }, head, h('div', { class: 'card-body' }, body));\n}\n\nfunction syncMessage(id, report) {\n  const parts = [`${report.targets.length} available`];\n  if (report.added) parts.push(`${report.added} new`);\n  if (report.removed) parts.push(`${report.removed} removed`);\n  const orphaned = report.orphanedAliases.length\n    ? ` No longer available: ${report.orphanedAliases.join(', ')}.`\n    : '';\n  return `${id}: ${parts.join(', ')}.${orphaned}`;\n}\n\nfunction aliasRow(alias) {\n  const input = h('input', {\n    value: alias.region ?? '',\n    'aria-label': `Region for ${alias.name}`,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  const save = h('button', { hidden: true }, 'Save');\n  const commit = () =>\n    busy(save, async () => {\n      const region = input.value.trim();\n      const done = await api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, {\n        region,\n      }).catch(fail);\n      if (done) toast(`${alias.name} now runs in ${region}.`);\n      await refresh();\n    });\n  input.addEventListener('input', () => {\n    save.hidden = input.value.trim() === (alias.region ?? '');\n  });\n  input.addEventListener('keydown', (e) => {\n    if (e.key === 'Enter' && !save.hidden) commit();\n    if (e.key === 'Escape') {\n      input.value = alias.region ?? '';\n      save.hidden = true;\n    }\n  });\n  save.addEventListener('click', commit);\n\n  return h(\n    'tr',\n    {},\n    h('td', { class: 'alias', title: `hop ${alias.name} <command>` }, alias.name),\n    h('td', {}, h('div', { class: 'region' }, input, save)),\n    h(\n      'td',\n      {},\n      alias.missing\n        ? h('span', { class: 'missing' }, `${alias.target} (no longer available)`)\n        : alias.label,\n    ),\n    h(\n      'td',\n      { style: 'text-align:right' },\n      h(\n        'button',\n        {\n          class: 'link',\n          title: `Remove ${alias.name}`,\n          'aria-label': `Remove ${alias.name}`,\n          onclick: (e) => {\n            if (!confirm(`Remove alias \"${alias.name}\"?`)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/aliases/${encodeURIComponent(alias.name)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        '\u2715',\n      ),\n    ),\n  );\n}\n\n// ---------- dialogs ----------\n\nfunction showDialog(title, body, footer) {\n  $dialog.replaceChildren(\n    h(\n      'div',\n      { class: 'dlg-head' },\n      h('h2', {}, title),\n      h('button', { class: 'link', 'aria-label': 'Close', onclick: () => $dialog.close() }, '\u2715'),\n    ),\n    h('div', { class: 'dlg-body' }, body),\n    footer ? h('div', { class: 'dlg-foot' }, footer) : null,\n  );\n  if (!$dialog.open) $dialog.showModal();\n}\n\nfunction suggestSourceId(settings, kind) {\n  const host = /^https:\\/\\/([^./]+)\\./.exec(settings.startUrl ?? '')?.[1];\n  return slug(host ?? (kind === 'console-login' ? 'personal' : 'main'));\n}\n\nconst slug = (text) =>\n  text\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 63) || 'main';\n\n/** `previous` refills the form after a failed sign-in: { provider, kind, id, settings, error }. */\nfunction openAddSource(previous) {\n  const providers = state.providers.filter((p) => state.enabledProviders.includes(p.id));\n  let provider = providers.find((p) => p.id === previous?.provider) ?? providers[0];\n  let kind = provider.kinds.find((k) => k.kind === previous?.kind) ?? provider.kinds[0];\n\n  const form = h('form', { onsubmit: (e) => e.preventDefault() });\n  const nameInput = h('input', {\n    id: 'f-name',\n    required: true,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  let nameTouched = Boolean(previous);\n  nameInput.addEventListener('input', () => {\n    nameTouched = true;\n  });\n\n  const fieldInputs = {};\n  const fieldsBox = h('div');\n  const nameLabel = h('label', { for: 'f-name' });\n\n  function updateSuggestion() {\n    if (nameTouched) return;\n    const settings = Object.fromEntries(\n      Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n    );\n    const taken = new Set(state.sources.map((s) => s.id));\n    let id = suggestSourceId(settings, kind.kind);\n    for (let i = 2; taken.has(id); i++) id = `${suggestSourceId(settings, kind.kind)}-${i}`;\n    nameInput.value = id;\n  }\n\n  function renderFields() {\n    for (const key of Object.keys(fieldInputs)) delete fieldInputs[key];\n    fieldsBox.replaceChildren(\n      ...kind.fields.map((f) => {\n        const input = h('input', {\n          id: `f-${f.key}`,\n          placeholder: f.placeholder ?? f.defaultValue ?? '',\n          value: previous?.settings?.[f.key] ?? f.defaultValue ?? '',\n          required: true,\n          class: 'mono',\n          spellcheck: 'false',\n          oninput: updateSuggestion,\n        });\n        fieldInputs[f.key] = input;\n        return h('div', { class: 'field' }, h('label', { for: input.id }, f.label), input);\n      }),\n    );\n    nameLabel.textContent = kind.nameLabel ?? 'Short name for this source';\n    updateSuggestion();\n  }\n\n  const providerSelect =\n    providers.length > 1\n      ? h(\n          'div',\n          { class: 'field' },\n          h('label', { for: 'f-provider' }, 'Cloud'),\n          h(\n            'select',\n            {\n              id: 'f-provider',\n              onchange: (e) => {\n                provider = providers.find((p) => p.id === e.target.value);\n                kind = provider.kinds[0];\n                renderKinds();\n              },\n            },\n            providers.map((p) => h('option', { value: p.id, selected: p === provider }, p.name)),\n          ),\n        )\n      : null;\n\n  const kindsBox = h('div', { class: 'choices' });\n  function renderKinds() {\n    kindsBox.replaceChildren(\n      ...provider.kinds.map((k) =>\n        h(\n          'label',\n          { class: 'choice' },\n          h('input', {\n            type: 'radio',\n            name: 'kind',\n            value: k.kind,\n            checked: k === kind,\n            onchange: () => {\n              kind = k;\n              renderFields();\n            },\n          }),\n          h('span', {}, h('strong', {}, k.label), k.hint ? h('small', {}, k.hint) : null),\n        ),\n      ),\n    );\n    renderFields();\n  }\n\n  form.append(\n    previous?.error\n      ? h(\n          'div',\n          { class: 'notice error' },\n          h('strong', {}, 'Could not sign in, so nothing was saved. '),\n          previous.error.message,\n          previous.error.hint ? h('div', { class: 'help' }, previous.error.hint) : null,\n        )\n      : '',\n    providerSelect ?? '',\n    h('div', { class: 'field' }, h('label', {}, 'What do you want to add?')),\n    kindsBox,\n    fieldsBox,\n    h(\n      'div',\n      { class: 'field' },\n      nameLabel,\n      nameInput,\n      h(\n        'span',\n        { class: 'help' },\n        'Lowercase letters, numbers and dashes. You will see it in ',\n        h('code', {}, 'cloudhop ls'),\n        '.',\n      ),\n    ),\n  );\n  renderKinds();\n  if (previous) nameInput.value = previous.id;\n\n  const submit = h('button', { class: 'primary', type: 'submit' }, 'Add and sign in');\n  form.addEventListener('submit', async () => {\n    if (!form.reportValidity()) return;\n    const body = {\n      provider: provider.id,\n      kind: kind.kind,\n      id: nameInput.value.trim(),\n      settings: Object.fromEntries(\n        Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n      ),\n    };\n    showDialog(\n      'Sign in',\n      h(\n        'div',\n        { class: 'waiting' },\n        h('div', { class: 'spinner' }),\n        h('strong', {}, 'Finish signing in in the browser tab that just opened.'),\n        h('p', { class: 'help' }, 'This page continues on its own once you approve the request.'),\n      ),\n    );\n    try {\n      const report = await api('POST', '/api/sources', body);\n      await refresh();\n      const source = state.sources.find((s) => s.id === body.id);\n      toast(`Signed in to ${body.id}. ${report.targets.length} account/role(s) found.`);\n      openAliasPicker(source, report.targets);\n    } catch (error) {\n      // Nothing was saved: reopen the form with what was typed so it can be fixed.\n      await refresh();\n      openAddSource({ ...body, error });\n    }\n  });\n\n  showDialog('Add source', form, [\n    h('button', { type: 'button', onclick: () => $dialog.close() }, 'Cancel'),\n    submit,\n  ]);\n  submit.setAttribute('form', 'add-form');\n  form.id = 'add-form';\n}\n\nasync function openAliasPicker(source, preloaded) {\n  let targets = preloaded;\n  if (!targets) {\n    showDialog(\n      `Aliases for ${source.id}`,\n      h('div', { class: 'waiting' }, h('div', { class: 'spinner' }), 'Loading accounts\u2026'),\n    );\n    try {\n      targets = (await api('GET', `/api/sources/${encodeURIComponent(source.id)}/targets`)).targets;\n    } catch (error) {\n      $dialog.close();\n      return fail(error);\n    }\n  }\n\n  const used = new Map(\n    state.aliases.filter((a) => a.source === source.id).map((a) => [a.target, a.name]),\n  );\n  const taken = new Set(state.aliases.map((a) => a.name));\n  const defaultRegion = source.settings.region ?? '';\n  const filter = h('input', {\n    type: 'search',\n    placeholder: `Filter ${targets.length} account/role(s)\u2026`,\n    style: 'width:100%;margin-bottom:12px',\n  });\n\n  const rows = targets.map((t) => {\n    const existing = used.get(t.id);\n    let name = t.suggestedAlias;\n    for (let i = 2; taken.has(name); i++) name = `${t.suggestedAlias}-${i}`;\n    const check = h('input', {\n      type: 'checkbox',\n      disabled: Boolean(existing),\n      'aria-label': t.label,\n    });\n    const aliasInput = h('input', {\n      value: name,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Alias for ${t.label}`,\n      placeholder: 'alias',\n    });\n    const regionInput = h('input', {\n      value: defaultRegion,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Region for ${t.label}`,\n      placeholder: 'region',\n    });\n    // Only the checkbox and its text sit in the label, so clicking the inputs never toggles it.\n    const el = h(\n      'div',\n      { class: 'target' },\n      h(\n        'label',\n        { class: 'pick' },\n        check,\n        h(\n          'span',\n          {},\n          t.label,\n          existing ? h('small', { class: 'already' }, `Already: ${existing}`) : null,\n        ),\n      ),\n      h('div', { class: 'inputs' }, aliasInput, regionInput),\n    );\n    return { target: t, el, check, aliasInput, regionInput };\n  });\n\n  filter.addEventListener('input', () => {\n    const q = filter.value.trim().toLowerCase();\n    for (const row of rows) row.el.hidden = q !== '' && !row.target.label.toLowerCase().includes(q);\n  });\n\n  const save = h('button', { class: 'primary' }, 'Create aliases');\n  save.addEventListener('click', () =>\n    busy(save, async () => {\n      const aliases = rows\n        .filter((r) => r.check.checked)\n        .map((r) => ({\n          source: source.id,\n          target: r.target.id,\n          name: r.aliasInput.value.trim(),\n          region: r.regionInput.value.trim(),\n        }));\n      if (aliases.length === 0) return toast('Pick at least one account/role.', { error: true });\n      try {\n        const result = await api('POST', '/api/aliases', { aliases });\n        $dialog.close();\n        toast(`Created ${result.created.join(', ')}. Try: hop ${result.created[0]}`);\n        await refresh();\n      } catch (error) {\n        fail(error);\n      }\n    }),\n  );\n\n  const body =\n    targets.length === 0\n      ? h('p', { class: 'empty' }, 'This source has no accounts or roles assigned to you.')\n      : h(\n          'div',\n          {},\n          filter,\n          h(\n            'div',\n            { class: 'targets' },\n            rows.map((r) => r.el),\n          ),\n        );\n  showDialog(`Aliases for ${source.id}`, body, [\n    h('span', { class: 'note' }, 'Check an account/role, then name its alias and region.'),\n    h('button', { onclick: () => $dialog.close() }, 'Cancel'),\n    targets.length ? save : null,\n  ]);\n}\n\n$addSource.addEventListener('click', () => openAddSource());\n\nif (!token) {\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Open the link from your terminal'),\n      h('p', {}, 'Run cloudhop ui and open the link it prints. It includes a one-time access key.'),\n    ),\n  );\n} else {\n  refresh();\n}\n";
+var app_default = "// cloudhop local UI. Plain DOM, no build step: served as-is by `cloudhop ui`.\n\nconst TOKEN_KEY = 'cloudhop-token';\nconst SESSION_TEXT = {\n  valid: 'Session valid',\n  refreshable: 'Renews on next use',\n  expired: 'Expired: sign in on next use',\n  unknown: 'Managed by the cloud CLI',\n};\n\n// The token arrives in the URL fragment once; keep it for this tab and clean the address bar.\nconst fromHash = new URLSearchParams(location.hash.slice(1)).get('token');\nif (fromHash) {\n  try {\n    sessionStorage.setItem(TOKEN_KEY, fromHash);\n  } catch {}\n  history.replaceState(null, '', location.pathname);\n}\nlet token = fromHash;\ntry {\n  token = token ?? sessionStorage.getItem(TOKEN_KEY);\n} catch {}\n\n// A fresh link opened in this same tab only changes the fragment: reload to pick up its token.\naddEventListener('hashchange', () => {\n  if (new URLSearchParams(location.hash.slice(1)).has('token')) location.reload();\n});\n\nconst $main = document.getElementById('main');\nconst $dialog = document.getElementById('dialog');\nconst $toasts = document.getElementById('toasts');\nconst $addSource = document.getElementById('add-source');\nlet state;\n\n/** Tiny element builder: h('button', { class: 'primary', onclick }, 'Save'). */\nfunction h(tag, attrs = {}, ...children) {\n  const el = document.createElement(tag);\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null || value === false) continue;\n    if (key.startsWith('on')) el.addEventListener(key.slice(2), value);\n    else if (key === 'class') el.className = value;\n    else if (value === true) el.setAttribute(key, '');\n    else el.setAttribute(key, value);\n  }\n  for (const child of children.flat()) {\n    if (child === undefined || child === null || child === false) continue;\n    el.append(child instanceof Node ? child : document.createTextNode(String(child)));\n  }\n  return el;\n}\n\nclass ApiError extends Error {\n  constructor(message, hint) {\n    super(message);\n    this.hint = hint;\n  }\n}\n\n// Calls that may sign in wait for the person in the browser; everything else should answer quickly.\nconst MAY_SIGN_IN = /^\\/api\\/sources(\\/[^/]+\\/(login|sync|targets))?$/;\nconst QUICK_TIMEOUT_MS = 20_000;\n\nasync function api(method, path, body) {\n  const waitsForPerson = MAY_SIGN_IN.test(path);\n  let response;\n  try {\n    response = await fetch(path, {\n      method,\n      headers: {\n        'x-cloudhop-token': token ?? '',\n        ...(body ? { 'content-type': 'application/json' } : {}),\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: waitsForPerson ? undefined : AbortSignal.timeout(QUICK_TIMEOUT_MS),\n    });\n  } catch (error) {\n    if (error.name === 'TimeoutError') {\n      throw new ApiError(\n        'cloudhop ui is not responding.',\n        'Is it paused in your terminal (Ctrl-Z)? Run `fg` there, or stop it and run `cloudhop ui` again.',\n      );\n    }\n    throw new ApiError(\n      'cloudhop ui is not running.',\n      'Run `cloudhop ui` again and open the new link it prints.',\n    );\n  }\n  const data = await response.json().catch(() => ({}));\n  if (!response.ok)\n    throw new ApiError(data.error ?? `Request failed (${response.status}).`, data.hint);\n  return data;\n}\n\nfunction toast(message, { error = false, hint } = {}) {\n  const el = h(\n    'div',\n    { class: `toast${error ? ' error' : ''}` },\n    message,\n    hint && h('small', {}, hint),\n  );\n  $toasts.append(el);\n  setTimeout(() => el.remove(), error ? 9000 : 4000);\n}\n\nconst fail = (error) => toast(error.message, { error: true, hint: error.hint });\n\n/** Disables a button while its action runs. */\nasync function busy(button, action) {\n  button.disabled = true;\n  try {\n    return await action();\n  } finally {\n    button.disabled = false;\n  }\n}\n\nasync function refresh() {\n  try {\n    state = await api('GET', '/api/state');\n    render();\n    checkDoctor();\n  } catch (error) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Cannot reach cloudhop'),\n        h('p', {}, error.message, error.hint ? ` ${error.hint}` : ''),\n      ),\n    );\n  }\n}\n\nasync function checkDoctor() {\n  try {\n    const entries = await api('GET', '/api/doctor');\n    const problems = entries.filter((e) => !e.installed || e.outdated);\n    document.getElementById('doctor')?.remove();\n    if (problems.length === 0) return;\n    $main.prepend(\n      h(\n        'div',\n        { class: 'notice', id: 'doctor' },\n        ...problems.map((e) =>\n          h(\n            'div',\n            {},\n            e.installed\n              ? `${e.cli} ${e.version} is older than ${e.minVersion}. `\n              : `${e.cli} is not installed, so aliases cannot run commands yet. `,\n            'Run ',\n            h('code', {}, 'cloudhop doctor'),\n            ' in a terminal to install it.',\n          ),\n        ),\n      ),\n    );\n  } catch {}\n}\n\n// ---------- main view ----------\n\nfunction render() {\n  const enabled = state.enabledProviders;\n  $addSource.hidden = enabled.length === 0;\n  if (enabled.length === 0) return renderChooseClouds();\n  if (state.sources.length === 0) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Add your first account'),\n        h(\n          'p',\n          {},\n          'Add a company SSO portal or a personal account. cloudhop signs you in, finds every account and role you can use, and lets you give each one a short alias.',\n        ),\n        h('button', { class: 'primary', onclick: () => openAddSource() }, '+ Add source'),\n      ),\n      assistantsCard(),\n    );\n    loadAssistants();\n    return;\n  }\n  $main.replaceChildren(...state.sources.map(sourceCard), assistantsCard());\n  loadAssistants();\n}\n\n// ---------- AI assistants ----------\n\nlet assistantScope = 'user';\ntry {\n  assistantScope =\n    localStorage.getItem('cloudhop-assistant-scope') === 'project' ? 'project' : 'user';\n} catch {}\nlet assistantsData;\n\nconst SKILL_TEXT = {\n  current: ['valid', 'Up to date'],\n  outdated: ['refreshable', 'Outdated'],\n  modified: ['refreshable', 'Edited by you'],\n  missing: ['', 'Not installed'],\n};\nconst MCP_TEXT = { registered: 'On', missing: 'Off', unknown: 'Check in the app' };\n\nfunction assistantsCard() {\n  return h('section', { class: 'card', id: 'assistants', hidden: true });\n}\n\nasync function loadAssistants() {\n  try {\n    assistantsData = await api('GET', '/api/assistants');\n    renderAssistants();\n  } catch {\n    document.getElementById('assistants')?.remove();\n  }\n}\n\nfunction setAssistantScope(scope) {\n  assistantScope = scope;\n  try {\n    localStorage.setItem('cloudhop-assistant-scope', scope);\n  } catch {}\n  renderAssistants();\n}\n\nfunction assistantAction(label, run, { danger = false, confirmText } = {}) {\n  return h(\n    'button',\n    {\n      class: danger ? 'danger' : undefined,\n      onclick: (e) => {\n        if (confirmText && !confirm(confirmText)) return;\n        busy(e.currentTarget, async () => {\n          try {\n            await run();\n          } catch (error) {\n            fail(error);\n          }\n          await loadAssistants();\n        });\n      },\n    },\n    label,\n  );\n}\n\nfunction reportInstall(results) {\n  for (const r of results) {\n    if (r.mcp === 'manual') {\n      toast(`${r.name}: skill installed. Add the MCP server by hand.`, { hint: r.mcpManual });\n    } else {\n      toast(`${r.name} now knows cloudhop. Start a new chat so it picks it up.`);\n    }\n  }\n}\n\nfunction renderAssistants() {\n  const el = document.getElementById('assistants');\n  if (!el || !assistantsData) return;\n  const rows = assistantScope === 'user' ? assistantsData.user : assistantsData.projectScope;\n  const scope = assistantScope;\n  const install = (tools) =>\n    api('POST', '/api/assistants', { tools, scope, mcp: true }).then((r) =>\n      reportInstall(r.results),\n    );\n  const missingDetected = rows\n    .filter((r) => r.detected && r.skill === 'missing')\n    .map((r) => r.assistant);\n\n  const seg = h(\n    'div',\n    { class: 'seg', role: 'group', 'aria-label': 'Where' },\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'user'), onclick: () => setAssistantScope('user') },\n      'For me',\n    ),\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'project'), onclick: () => setAssistantScope('project') },\n      'This project',\n    ),\n  );\n\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, 'AI assistants'),\n    h(\n      'span',\n      { class: 'meta' },\n      scope === 'user'\n        ? 'Installed in your home folder, for every project'\n        : assistantsData.project,\n    ),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      seg,\n      missingDetected.length > 1\n        ? assistantAction('Install for all detected', () => install(missingDetected))\n        : null,\n    ),\n  );\n\n  const table = h(\n    'table',\n    { class: 'assistants' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Assistant'),\n        h('th', {}, 'Skill'),\n        h('th', {}, 'MCP server'),\n        h('th'),\n      ),\n    ),\n    h(\n      'tbody',\n      {},\n      rows.map((r) => {\n        const [badgeClass, skillText] = SKILL_TEXT[r.skill];\n        const actions = [];\n        if (r.skill === 'missing')\n          actions.push(assistantAction('Install', () => install([r.assistant])));\n        if (r.skill === 'outdated') {\n          actions.push(\n            assistantAction('Update', () =>\n              api('POST', '/api/assistants/update', {}).then(() =>\n                toast(`${r.name}: skill updated.`),\n              ),\n            ),\n          );\n        }\n        if (r.skill === 'modified') {\n          actions.push(\n            assistantAction(\n              'Replace',\n              () =>\n                api('POST', '/api/assistants/update', { force: true }).then(() =>\n                  toast('Edited skills replaced.'),\n                ),\n              {\n                confirmText: 'Replace your edited copies with the current cloudhop skill?',\n              },\n            ),\n          );\n        }\n        if (r.skill !== 'missing' || r.mcp === 'registered') {\n          actions.push(\n            assistantAction(\n              'Remove',\n              () => api('POST', '/api/assistants/remove', { tools: [r.assistant], scope }),\n              {\n                danger: true,\n                confirmText: `Remove the cloudhop skill and MCP server from ${r.name}?`,\n              },\n            ),\n          );\n        }\n        return h(\n          'tr',\n          {},\n          h(\n            'td',\n            { class: 'alias' },\n            r.name,\n            r.detected ? null : h('small', { class: 'muted-inline' }, ' not detected'),\n          ),\n          h('td', {}, h('span', { class: `badge ${badgeClass}`, title: r.skillPath }, skillText)),\n          h('td', {}, r.skill === 'missing' && r.mcp !== 'registered' ? '' : MCP_TEXT[r.mcp]),\n          h(\n            'td',\n            { style: 'text-align:right' },\n            h('div', { class: 'actions', style: 'justify-content:flex-end' }, actions),\n          ),\n        );\n      }),\n    ),\n  );\n\n  el.replaceChildren(\n    head,\n    h(\n      'div',\n      { class: 'card-body' },\n      h(\n        'p',\n        { class: 'card-help' },\n        'Teach your AI assistant to use cloudhop: it asks you which alias to work with, runs commands with hop, and confirms before changing anything. Includes the cloudhop MCP server.',\n      ),\n      table,\n    ),\n  );\n  el.hidden = false;\n}\n\nfunction renderChooseClouds() {\n  const boxes = state.providers.map((p) =>\n    h(\n      'label',\n      { class: 'choice' },\n      h('input', { type: 'checkbox', value: p.id, checked: true }),\n      h('span', {}, p.name),\n    ),\n  );\n  const save = h(\n    'button',\n    {\n      class: 'primary',\n      onclick: (e) =>\n        busy(e.currentTarget, async () => {\n          const ids = boxes\n            .map((b) => b.querySelector('input'))\n            .filter((i) => i.checked)\n            .map((i) => i.value);\n          await api('PUT', '/api/providers', { enabled: ids }).catch(fail);\n          await refresh();\n        }),\n    },\n    'Continue',\n  );\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Which clouds do you use?'),\n      h('p', {}, 'Azure and Google Cloud are coming soon.'),\n      h(\n        'div',\n        { class: 'choices', style: 'max-width:320px;margin:0 auto 16px;text-align:left' },\n        boxes,\n      ),\n      save,\n    ),\n  );\n}\n\nfunction sourceCard(source) {\n  const aliases = state.aliases.filter((a) => a.source === source.id);\n  const where = source.settings.startUrl ?? source.kindLabel;\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, source.id),\n    h('span', { class: `badge ${source.session}` }, SESSION_TEXT[source.session] ?? source.session),\n    h('span', { class: 'meta' }, `${source.providerName} \xB7 ${where}`),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      h('button', { onclick: () => openAliasPicker(source) }, '+ Aliases'),\n      h(\n        'button',\n        {\n          title: 'Sign in again and refresh its accounts',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              toast('Opening the browser to sign in\u2026');\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/login`,\n              ).catch(fail);\n              if (report)\n                toast(`${source.id}: signed in, ${report.targets.length} account/role(s).`);\n              await refresh();\n            }),\n        },\n        'Sign in',\n      ),\n      h(\n        'button',\n        {\n          title: 'Refresh the accounts and roles you have access to',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/sync`,\n              ).catch(fail);\n              if (report) toast(syncMessage(source.id, report));\n              await refresh();\n            }),\n        },\n        'Sync',\n      ),\n      h(\n        'button',\n        {\n          class: 'danger',\n          onclick: (e) => {\n            const count = aliases.length;\n            const message = `Remove \"${source.id}\"${count ? ` and its ${count} alias(es)` : ''}?`;\n            if (!confirm(message)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/sources/${encodeURIComponent(source.id)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        'Remove',\n      ),\n    ),\n  );\n\n  const body =\n    aliases.length === 0\n      ? h(\n          'div',\n          { class: 'empty' },\n          'No aliases yet. ',\n          h(\n            'button',\n            { class: 'primary', onclick: () => openAliasPicker(source) },\n            'Pick accounts',\n          ),\n        )\n      : h(\n          'table',\n          {},\n          h(\n            'thead',\n            {},\n            h(\n              'tr',\n              {},\n              h('th', {}, 'Alias'),\n              h('th', {}, 'Region'),\n              h('th', {}, 'Account / role'),\n              h('th'),\n            ),\n          ),\n          h('tbody', {}, aliases.map(aliasRow)),\n        );\n  return h('section', { class: 'card' }, head, h('div', { class: 'card-body' }, body));\n}\n\nfunction syncMessage(id, report) {\n  const parts = [`${report.targets.length} available`];\n  if (report.added) parts.push(`${report.added} new`);\n  if (report.removed) parts.push(`${report.removed} removed`);\n  const orphaned = report.orphanedAliases.length\n    ? ` No longer available: ${report.orphanedAliases.join(', ')}.`\n    : '';\n  return `${id}: ${parts.join(', ')}.${orphaned}`;\n}\n\nfunction aliasRow(alias) {\n  const input = h('input', {\n    value: alias.region ?? '',\n    'aria-label': `Region for ${alias.name}`,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  const save = h('button', { hidden: true }, 'Save');\n  const commit = () =>\n    busy(save, async () => {\n      const region = input.value.trim();\n      const done = await api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, {\n        region,\n      }).catch(fail);\n      if (done) toast(`${alias.name} now runs in ${region}.`);\n      await refresh();\n    });\n  input.addEventListener('input', () => {\n    save.hidden = input.value.trim() === (alias.region ?? '');\n  });\n  input.addEventListener('keydown', (e) => {\n    if (e.key === 'Enter' && !save.hidden) commit();\n    if (e.key === 'Escape') {\n      input.value = alias.region ?? '';\n      save.hidden = true;\n    }\n  });\n  save.addEventListener('click', commit);\n\n  return h(\n    'tr',\n    {},\n    h('td', { class: 'alias', title: `hop ${alias.name} <command>` }, alias.name),\n    h('td', {}, h('div', { class: 'region' }, input, save)),\n    h(\n      'td',\n      {},\n      alias.missing\n        ? h('span', { class: 'missing' }, `${alias.target} (no longer available)`)\n        : alias.label,\n    ),\n    h(\n      'td',\n      { style: 'text-align:right' },\n      h(\n        'button',\n        {\n          class: 'link',\n          title: `Remove ${alias.name}`,\n          'aria-label': `Remove ${alias.name}`,\n          onclick: (e) => {\n            if (!confirm(`Remove alias \"${alias.name}\"?`)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/aliases/${encodeURIComponent(alias.name)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        '\u2715',\n      ),\n    ),\n  );\n}\n\n// ---------- dialogs ----------\n\nfunction showDialog(title, body, footer) {\n  $dialog.replaceChildren(\n    h(\n      'div',\n      { class: 'dlg-head' },\n      h('h2', {}, title),\n      h('button', { class: 'link', 'aria-label': 'Close', onclick: () => $dialog.close() }, '\u2715'),\n    ),\n    h('div', { class: 'dlg-body' }, body),\n    footer ? h('div', { class: 'dlg-foot' }, footer) : null,\n  );\n  if (!$dialog.open) $dialog.showModal();\n}\n\nfunction suggestSourceId(settings, kind) {\n  const host = /^https:\\/\\/([^./]+)\\./.exec(settings.startUrl ?? '')?.[1];\n  return slug(host ?? (kind === 'console-login' ? 'personal' : 'main'));\n}\n\nconst slug = (text) =>\n  text\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 63) || 'main';\n\n/** `previous` refills the form after a failed sign-in: { provider, kind, id, settings, error }. */\nfunction openAddSource(previous) {\n  const providers = state.providers.filter((p) => state.enabledProviders.includes(p.id));\n  let provider = providers.find((p) => p.id === previous?.provider) ?? providers[0];\n  let kind = provider.kinds.find((k) => k.kind === previous?.kind) ?? provider.kinds[0];\n\n  const form = h('form', { onsubmit: (e) => e.preventDefault() });\n  const nameInput = h('input', {\n    id: 'f-name',\n    required: true,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  let nameTouched = Boolean(previous);\n  nameInput.addEventListener('input', () => {\n    nameTouched = true;\n  });\n\n  const fieldInputs = {};\n  const fieldsBox = h('div');\n  const nameLabel = h('label', { for: 'f-name' });\n\n  function updateSuggestion() {\n    if (nameTouched) return;\n    const settings = Object.fromEntries(\n      Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n    );\n    const taken = new Set(state.sources.map((s) => s.id));\n    let id = suggestSourceId(settings, kind.kind);\n    for (let i = 2; taken.has(id); i++) id = `${suggestSourceId(settings, kind.kind)}-${i}`;\n    nameInput.value = id;\n  }\n\n  function renderFields() {\n    for (const key of Object.keys(fieldInputs)) delete fieldInputs[key];\n    fieldsBox.replaceChildren(\n      ...kind.fields.map((f) => {\n        const input = h('input', {\n          id: `f-${f.key}`,\n          placeholder: f.placeholder ?? f.defaultValue ?? '',\n          value: previous?.settings?.[f.key] ?? f.defaultValue ?? '',\n          required: true,\n          class: 'mono',\n          spellcheck: 'false',\n          oninput: updateSuggestion,\n        });\n        fieldInputs[f.key] = input;\n        return h('div', { class: 'field' }, h('label', { for: input.id }, f.label), input);\n      }),\n    );\n    nameLabel.textContent = kind.nameLabel ?? 'Short name for this source';\n    updateSuggestion();\n  }\n\n  const providerSelect =\n    providers.length > 1\n      ? h(\n          'div',\n          { class: 'field' },\n          h('label', { for: 'f-provider' }, 'Cloud'),\n          h(\n            'select',\n            {\n              id: 'f-provider',\n              onchange: (e) => {\n                provider = providers.find((p) => p.id === e.target.value);\n                kind = provider.kinds[0];\n                renderKinds();\n              },\n            },\n            providers.map((p) => h('option', { value: p.id, selected: p === provider }, p.name)),\n          ),\n        )\n      : null;\n\n  const kindsBox = h('div', { class: 'choices' });\n  function renderKinds() {\n    kindsBox.replaceChildren(\n      ...provider.kinds.map((k) =>\n        h(\n          'label',\n          { class: 'choice' },\n          h('input', {\n            type: 'radio',\n            name: 'kind',\n            value: k.kind,\n            checked: k === kind,\n            onchange: () => {\n              kind = k;\n              renderFields();\n            },\n          }),\n          h('span', {}, h('strong', {}, k.label), k.hint ? h('small', {}, k.hint) : null),\n        ),\n      ),\n    );\n    renderFields();\n  }\n\n  form.append(\n    previous?.error\n      ? h(\n          'div',\n          { class: 'notice error' },\n          h('strong', {}, 'Could not sign in, so nothing was saved. '),\n          previous.error.message,\n          previous.error.hint ? h('div', { class: 'help' }, previous.error.hint) : null,\n        )\n      : '',\n    providerSelect ?? '',\n    h('div', { class: 'field' }, h('label', {}, 'What do you want to add?')),\n    kindsBox,\n    fieldsBox,\n    h(\n      'div',\n      { class: 'field' },\n      nameLabel,\n      nameInput,\n      h(\n        'span',\n        { class: 'help' },\n        'Lowercase letters, numbers and dashes. You will see it in ',\n        h('code', {}, 'cloudhop ls'),\n        '.',\n      ),\n    ),\n  );\n  renderKinds();\n  if (previous) nameInput.value = previous.id;\n\n  const submit = h('button', { class: 'primary', type: 'submit' }, 'Add and sign in');\n  form.addEventListener('submit', async () => {\n    if (!form.reportValidity()) return;\n    const body = {\n      provider: provider.id,\n      kind: kind.kind,\n      id: nameInput.value.trim(),\n      settings: Object.fromEntries(\n        Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n      ),\n    };\n    showDialog(\n      'Sign in',\n      h(\n        'div',\n        { class: 'waiting' },\n        h('div', { class: 'spinner' }),\n        h('strong', {}, 'Finish signing in in the browser tab that just opened.'),\n        h('p', { class: 'help' }, 'This page continues on its own once you approve the request.'),\n      ),\n    );\n    try {\n      const report = await api('POST', '/api/sources', body);\n      await refresh();\n      const source = state.sources.find((s) => s.id === body.id);\n      toast(`Signed in to ${body.id}. ${report.targets.length} account/role(s) found.`);\n      openAliasPicker(source, report.targets);\n    } catch (error) {\n      // Nothing was saved: reopen the form with what was typed so it can be fixed.\n      await refresh();\n      openAddSource({ ...body, error });\n    }\n  });\n\n  showDialog('Add source', form, [\n    h('button', { type: 'button', onclick: () => $dialog.close() }, 'Cancel'),\n    submit,\n  ]);\n  submit.setAttribute('form', 'add-form');\n  form.id = 'add-form';\n}\n\nasync function openAliasPicker(source, preloaded) {\n  let targets = preloaded;\n  if (!targets) {\n    showDialog(\n      `Aliases for ${source.id}`,\n      h('div', { class: 'waiting' }, h('div', { class: 'spinner' }), 'Loading accounts\u2026'),\n    );\n    try {\n      targets = (await api('GET', `/api/sources/${encodeURIComponent(source.id)}/targets`)).targets;\n    } catch (error) {\n      $dialog.close();\n      return fail(error);\n    }\n  }\n\n  const used = new Map(\n    state.aliases.filter((a) => a.source === source.id).map((a) => [a.target, a.name]),\n  );\n  const taken = new Set(state.aliases.map((a) => a.name));\n  const defaultRegion = source.settings.region ?? '';\n  const filter = h('input', {\n    type: 'search',\n    placeholder: `Filter ${targets.length} account/role(s)\u2026`,\n    style: 'width:100%;margin-bottom:12px',\n  });\n\n  const rows = targets.map((t) => {\n    const existing = used.get(t.id);\n    let name = t.suggestedAlias;\n    for (let i = 2; taken.has(name); i++) name = `${t.suggestedAlias}-${i}`;\n    const check = h('input', {\n      type: 'checkbox',\n      disabled: Boolean(existing),\n      'aria-label': t.label,\n    });\n    const aliasInput = h('input', {\n      value: name,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Alias for ${t.label}`,\n      placeholder: 'alias',\n    });\n    const regionInput = h('input', {\n      value: defaultRegion,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Region for ${t.label}`,\n      placeholder: 'region',\n    });\n    // Only the checkbox and its text sit in the label, so clicking the inputs never toggles it.\n    const el = h(\n      'div',\n      { class: 'target' },\n      h(\n        'label',\n        { class: 'pick' },\n        check,\n        h(\n          'span',\n          {},\n          t.label,\n          existing ? h('small', { class: 'already' }, `Already: ${existing}`) : null,\n        ),\n      ),\n      h('div', { class: 'inputs' }, aliasInput, regionInput),\n    );\n    return { target: t, el, check, aliasInput, regionInput };\n  });\n\n  filter.addEventListener('input', () => {\n    const q = filter.value.trim().toLowerCase();\n    for (const row of rows) row.el.hidden = q !== '' && !row.target.label.toLowerCase().includes(q);\n  });\n\n  const save = h('button', { class: 'primary' }, 'Create aliases');\n  save.addEventListener('click', () =>\n    busy(save, async () => {\n      const aliases = rows\n        .filter((r) => r.check.checked)\n        .map((r) => ({\n          source: source.id,\n          target: r.target.id,\n          name: r.aliasInput.value.trim(),\n          region: r.regionInput.value.trim(),\n        }));\n      if (aliases.length === 0) return toast('Pick at least one account/role.', { error: true });\n      try {\n        const result = await api('POST', '/api/aliases', { aliases });\n        $dialog.close();\n        toast(`Created ${result.created.join(', ')}. Try: hop ${result.created[0]}`);\n        await refresh();\n      } catch (error) {\n        fail(error);\n      }\n    }),\n  );\n\n  const body =\n    targets.length === 0\n      ? h('p', { class: 'empty' }, 'This source has no accounts or roles assigned to you.')\n      : h(\n          'div',\n          {},\n          filter,\n          h(\n            'div',\n            { class: 'targets' },\n            rows.map((r) => r.el),\n          ),\n        );\n  showDialog(`Aliases for ${source.id}`, body, [\n    h('span', { class: 'note' }, 'Check an account/role, then name its alias and region.'),\n    h('button', { onclick: () => $dialog.close() }, 'Cancel'),\n    targets.length ? save : null,\n  ]);\n}\n\n$addSource.addEventListener('click', () => openAddSource());\n\nif (!token) {\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Open the link from your terminal'),\n      h('p', {}, 'Run cloudhop ui and open the link it prints. It includes a one-time access key.'),\n    ),\n  );\n} else {\n  refresh();\n}\n";
 
 // ../ui/src/assets/index.html
 var assets_default = `<!doctype html>
@@ -11877,6 +12844,15 @@ var assets_default = `<!doctype html>
         margin-bottom: 18px;
       }
       .notice.error { border-left-color: var(--bad); }
+      .seg { display: inline-flex; border: 1px solid var(--border); border-radius: 8px; overflow: hidden; }
+      .seg button { border: 0; border-radius: 0; }
+      .seg button + button { border-left: 1px solid var(--border); }
+      .seg button[aria-pressed="true"] { background: var(--accent-soft); color: var(--accent-strong); font-weight: 600; }
+      .card-help { color: var(--muted); font-size: 14px; margin: 10px 16px 6px; }
+      .muted-inline { color: var(--muted); font-weight: 400; font-size: 12px; }
+      table.assistants th:nth-child(2) { width: 170px; }
+      table.assistants th:nth-child(3) { width: 140px; }
+      table.assistants th:nth-child(4) { width: 230px; }
       @media (max-width: 640px) {
         .tagline { display: none; }
         th:nth-child(3), td:nth-child(3) { display: none; }
@@ -11885,6 +12861,10 @@ var assets_default = `<!doctype html>
         .region input { width: 96px; }
         th:nth-child(1) { width: auto; }
         th:nth-child(2) { width: 124px; }
+        table.assistants th:nth-child(2) { width: 112px; }
+        table.assistants th:nth-child(4) { width: 96px; }
+        table.assistants .actions { flex-direction: column; align-items: flex-end; }
+        .card-help { margin: 10px 10px 6px; }
       }
     </style>
   </head>
@@ -11932,9 +12912,13 @@ async function readJson(req) {
   return raw ? JSON.parse(raw) : {};
 }
 var sameSecret = (given, expected) => given !== void 0 && given.length === expected.length && timingSafeEqual(Buffer.from(given), Buffer.from(expected));
-async function startUiServer({ app, port = 0 }) {
+async function startUiServer({
+  app,
+  assistants,
+  port = 0
+}) {
   const token = randomBytes(24).toString("base64url");
-  const handle = createApi(app);
+  const handle = createApi(app, assistants);
   let allowedHosts = /* @__PURE__ */ new Set();
   const server = createServer(async (req, res) => {
     try {
@@ -11994,12 +12978,12 @@ async function startUiServer({ app, port = 0 }) {
 }
 
 // src/commands/ui.ts
-async function uiCommand(app, { flags }) {
+async function uiCommand(app, assistants, { flags }) {
   const port = flags.port ? Number(flags.port) : 0;
   if (!Number.isInteger(port) || port < 0 || port > 65535) {
     throw new CloudhopError("INVALID_NAME", `--port must be a number between 1 and 65535.`);
   }
-  const server = await startUiServer({ app, port });
+  const server = await startUiServer({ app, assistants, port });
   console.log(`cloudhop UI running at ${bold(server.url)}`);
   console.log("Only this computer can open it, and the link works only while this runs.");
   console.log("Press Ctrl-C to stop.");
@@ -12012,15 +12996,15 @@ async function uiCommand(app, { flags }) {
 }
 
 // src/container.ts
-import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join7 } from "path";
 
 // ../provider-aws/src/aws-provider.ts
-import { join as join4 } from "path";
+import { join as join6 } from "path";
 
 // ../provider-aws/src/aws-config.ts
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2 } from "path";
+import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3 } from "path";
 var BLOCK_START = "# >>> cloudhop managed >>> (edit with `cloudhop`, not by hand)";
 var BLOCK_END = "# <<< cloudhop managed <<<";
 function renderBlock(sections) {
@@ -12067,13 +13051,13 @@ function replaceManagedBlock(content, sections) {
 async function writeManagedBlock(path2, sections) {
   let content = "";
   try {
-    content = await readFile2(path2, "utf8");
+    content = await readFile3(path2, "utf8");
   } catch {
   }
   const next = replaceManagedBlock(content, sections);
   if (next === content) return;
-  await mkdir2(dirname2(path2), { recursive: true, mode: 448 });
-  await writeFile2(path2, next, { mode: 384 });
+  await mkdir3(dirname3(path2), { recursive: true, mode: 448 });
+  await writeFile3(path2, next, { mode: 384 });
 }
 
 // ../provider-aws/src/http.ts
@@ -12088,11 +13072,11 @@ var AwsHttpError = class extends Error {
   code;
 };
 async function parse2(response) {
-  const text3 = await response.text();
-  const body = text3 ? JSON.parse(text3) : {};
+  const text4 = await response.text();
+  const body = text4 ? JSON.parse(text4) : {};
   if (!response.ok) {
     const code = body.error ?? body.__type ?? body.code;
-    const description = body.error_description ?? body.message ?? text3;
+    const description = body.error_description ?? body.message ?? text4;
     throw new AwsHttpError(
       response.status,
       code,
@@ -12160,7 +13144,7 @@ var PortalClient = class {
 };
 
 // ../provider-aws/src/sso/sso-login.ts
-import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
 
 // ../provider-aws/src/sso/loopback.ts
 import { createServer as createServer2 } from "http";
@@ -12293,24 +13277,24 @@ var OidcClient = class {
 };
 
 // ../provider-aws/src/sso/token-cache.ts
-import { createHash } from "crypto";
-import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import { join as join3 } from "path";
+import { createHash as createHash2 } from "crypto";
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
+import { join as join5 } from "path";
 var EXPIRY_MARGIN_MS = 5 * 60 * 1e3;
 function tokenCachePath(awsDir, sessionName) {
-  const hash = createHash("sha1").update(sessionName).digest("hex");
-  return join3(awsDir, "sso", "cache", `${hash}.json`);
+  const hash = createHash2("sha1").update(sessionName).digest("hex");
+  return join5(awsDir, "sso", "cache", `${hash}.json`);
 }
 async function readToken(awsDir, sessionName) {
   try {
-    return JSON.parse(await readFile3(tokenCachePath(awsDir, sessionName), "utf8"));
+    return JSON.parse(await readFile4(tokenCachePath(awsDir, sessionName), "utf8"));
   } catch {
     return void 0;
   }
 }
 async function writeToken(awsDir, sessionName, token) {
-  await mkdir3(join3(awsDir, "sso", "cache"), { recursive: true, mode: 448 });
-  await writeFile3(tokenCachePath(awsDir, sessionName), JSON.stringify(token, null, 2), {
+  await mkdir4(join5(awsDir, "sso", "cache"), { recursive: true, mode: 448 });
+  await writeFile4(tokenCachePath(awsDir, sessionName), JSON.stringify(token, null, 2), {
     mode: 384
   });
 }
@@ -12353,7 +13337,7 @@ async function authorizationCodeLogin(options) {
       clientId: client.clientId,
       redirectUri: server.redirectUri,
       state,
-      codeChallenge: base64url(createHash2("sha256").update(codeVerifier).digest())
+      codeChallenge: base64url(createHash3("sha256").update(codeVerifier).digest())
     });
     options.interaction.notify("Opening your browser to log in\u2026");
     options.interaction.notify(`If it doesn't open, visit: ${url}`);
@@ -12458,6 +13442,7 @@ var AwsProvider = class {
   id = "aws";
   displayName = "AWS";
   cli = { command: "aws", displayName: "AWS CLI v2", minVersion: "2.32.0" };
+  identityArgs = ["sts", "get-caller-identity"];
   sourceKinds = [
     {
       kind: SSO_KIND,
@@ -12566,7 +13551,7 @@ var AwsProvider = class {
         }
       });
     }
-    await writeManagedBlock(join4(this.options.awsDir, "config"), sections);
+    await writeManagedBlock(join6(this.options.awsDir, "config"), sections);
   }
   async processEnv(resolved, mode) {
     const region = resolved.region;
@@ -12631,7 +13616,7 @@ var AwsProvider = class {
 // src/container.ts
 function createApp(env = process.env) {
   const runner = new NodeProcessRunner();
-  const awsDir = env.CLOUDHOP_AWS_DIR ?? join5(homedir2(), ".aws");
+  const awsDir = env.CLOUDHOP_AWS_DIR ?? join7(homedir3(), ".aws");
   return new CloudhopApp({
     config: new YamlConfigStore(),
     providers: [
@@ -12648,9 +13633,55 @@ function createApp(env = process.env) {
     notify
   });
 }
+function createAssistants(version, env = process.env) {
+  return new AssistantsInstaller({
+    places: { home: homedir3(), project: process.cwd() },
+    configDir: defaultConfigDir(env),
+    runner: new NodeProcessRunner(),
+    cloudhopVersion: version
+  });
+}
+
+// src/update-check.ts
+import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
+import { join as join8 } from "path";
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var REGISTRY_URL = "https://registry.npmjs.org/cloudhop/latest";
+function startUpdateCheck(configDir, current) {
+  const env = process.env;
+  if (env.CLOUDHOP_NO_UPDATE_CHECK === "1" || env.CI || !process.stderr.isTTY)
+    return async () => {
+    };
+  const file = join8(configDir, "update-check.json");
+  const work = (async () => {
+    let cache = { checkedAt: 0 };
+    try {
+      cache = JSON.parse(await readFile5(file, "utf8"));
+    } catch {
+    }
+    if (cache.latest && compareVersions(cache.latest, current) > 0) {
+      process.stderr.write(
+        `\x1B[2mcloudhop \u203A\x1B[22m cloudhop ${cache.latest} is available (you have ${current}): npm i -g cloudhop
+`
+      );
+    }
+    if (Date.now() - cache.checkedAt < DAY_MS) return;
+    const response = await fetch(REGISTRY_URL, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(1500)
+    });
+    if (!response.ok) return;
+    const { version } = await response.json();
+    if (typeof version !== "string") return;
+    await mkdir5(configDir, { recursive: true });
+    await writeFile5(file, JSON.stringify({ checkedAt: Date.now(), latest: version }));
+  })().catch(() => {
+  });
+  return () => Promise.race([work, new Promise((resolve) => setTimeout(resolve, 300))]);
+}
 
 // src/cli.ts
-var HELP = `cloudhop ${"1.0.0"}
+var HELP = `cloudhop ${"1.1.0"}
 Hop between cloud accounts, roles and regions with one command.
 
 Usage
@@ -12669,10 +13700,15 @@ Setup
                                  Change the region an alias runs in
   cloudhop login [source]        Log in again and refresh its accounts
   cloudhop sync [source]         Refresh the accounts/roles you have access to
-  cloudhop ls [source]           List sources and their aliases
+  cloudhop ls [source] [--json]  List sources and their aliases
+  cloudhop status [alias] [--json]
+                                 Can it run now, or will it need a sign-in?
   cloudhop rm <name...> [--yes]  Remove aliases or sources (a source takes its aliases)
   cloudhop provider [ls|enable|disable] <provider>
   cloudhop doctor                Check (and install) the cloud CLIs
+  cloudhop agent [status|install|update|remove] [--tools <list>] [--scope user|project] [--no-mcp]
+                                 Teach Claude Code, Kiro, Copilot, Cursor or Codex to use cloudhop
+  cloudhop mcp                   Model Context Protocol server for AI assistants (stdio)
   cloudhop ui [--port <n>] [--no-open]
                                  Manage sources and aliases in a local web page
 
@@ -12696,14 +13732,38 @@ async function main(argv) {
     return 0;
   }
   if (command === "--version" || command === "-v" || command === "version") {
-    console.log("1.0.0");
+    console.log("1.1.0");
     return 0;
   }
   const app = createApp();
   const local = RESERVED_NAMES.has(command) ? takeGlobalFlags(args) : args;
+  if (command === "mcp") {
+    await serveMcp({ app, version: "1.1.0" });
+    return 0;
+  }
+  const assistants = createAssistants("1.1.0");
+  await refreshAssistantSkills(assistants, command);
+  const finishUpdateCheck = startUpdateCheck(defaultConfigDir(), "1.1.0");
+  try {
+    return await dispatch(app, assistants, command, args, local);
+  } finally {
+    await finishUpdateCheck();
+  }
+}
+async function refreshAssistantSkills(assistants, command) {
+  if (command === "agent") return;
+  try {
+    const { updated } = await assistants.update();
+    if (updated.length > 0) {
+      notify(`Updated the cloudhop skill for your AI assistants (${updated.length} file(s)).`);
+    }
+  } catch {
+  }
+}
+async function dispatch(app, assistants, command, args, local) {
   switch (command) {
     case "setup":
-      await setupCommand(app);
+      await setupCommand(app, assistants);
       return 0;
     case "add":
       await addCommand(app, parseArgs(local));
@@ -12711,6 +13771,9 @@ async function main(argv) {
     case "alias":
       await aliasCommand(app, parseArgs(local));
       return 0;
+    case "status":
+      await statusCommand(app, local);
+      return 0;
     case "region":
       await regionCommand(app, local);
       return 0;
@@ -12722,7 +13785,7 @@ async function main(argv) {
       return 0;
     case "ls":
     case "list":
-      await listCommand(app, local[0]);
+      await listCommand(app, local);
       return 0;
     case "rm":
     case "remove":
@@ -12736,8 +13799,11 @@ async function main(argv) {
       return 0;
     case "exec":
       return execCommand(app, local);
+    case "agent":
+      await agentCommand(assistants, local);
+      return 0;
     case "ui":
-      await uiCommand(app, parseArgs(local));
+      await uiCommand(app, assistants, parseArgs(local));
       return 0;
     default:
       return proxyCommand(app, command, args);