cloudhop 1.0.0 → 1.2.0

package/dist/cli.js

@@ -41,62 +41,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// ../../node_modules/.pnpm/sisteransi@1.0.5/node_modules/sisteransi/src/index.js
-var require_src = __commonJS({
-  "../../node_modules/.pnpm/sisteransi@1.0.5/node_modules/sisteransi/src/index.js"(exports, module) {
-    "use strict";
-    var ESC2 = "\x1B";
-    var CSI2 = `${ESC2}[`;
-    var beep = "\x07";
-    var cursor3 = {
-      to(x2, y2) {
-        if (!y2) return `${CSI2}${x2 + 1}G`;
-        return `${CSI2}${y2 + 1};${x2 + 1}H`;
-      },
-      move(x2, y2) {
-        let ret = "";
-        if (x2 < 0) ret += `${CSI2}${-x2}D`;
-        else if (x2 > 0) ret += `${CSI2}${x2}C`;
-        if (y2 < 0) ret += `${CSI2}${-y2}A`;
-        else if (y2 > 0) ret += `${CSI2}${y2}B`;
-        return ret;
-      },
-      up: (count = 1) => `${CSI2}${count}A`,
-      down: (count = 1) => `${CSI2}${count}B`,
-      forward: (count = 1) => `${CSI2}${count}C`,
-      backward: (count = 1) => `${CSI2}${count}D`,
-      nextLine: (count = 1) => `${CSI2}E`.repeat(count),
-      prevLine: (count = 1) => `${CSI2}F`.repeat(count),
-      left: `${CSI2}G`,
-      hide: `${CSI2}?25l`,
-      show: `${CSI2}?25h`,
-      save: `${ESC2}7`,
-      restore: `${ESC2}8`
-    };
-    var scroll = {
-      up: (count = 1) => `${CSI2}S`.repeat(count),
-      down: (count = 1) => `${CSI2}T`.repeat(count)
-    };
-    var erase3 = {
-      screen: `${CSI2}2J`,
-      up: (count = 1) => `${CSI2}1J`.repeat(count),
-      down: (count = 1) => `${CSI2}J`.repeat(count),
-      line: `${CSI2}2K`,
-      lineEnd: `${CSI2}K`,
-      lineStart: `${CSI2}1K`,
-      lines(count) {
-        let clear = "";
-        for (let i2 = 0; i2 < count; i2++)
-          clear += this.line + (i2 < count - 1 ? cursor3.up() : "");
-        if (count)
-          clear += cursor3.left;
-        return clear;
-      }
-    };
-    module.exports = { cursor: cursor3, scroll, erase: erase3, beep };
-  }
-});
-
 // ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/nodes/identity.js"(exports) {
@@ -1064,14 +1008,14 @@ var require_foldFlowLines = __commonJS({
     var FOLD_FLOW = "flow";
     var FOLD_BLOCK = "block";
     var FOLD_QUOTED = "quoted";
-    function foldFlowLines(text3, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
+    function foldFlowLines(text4, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
       if (!lineWidth || lineWidth < 0)
-        return text3;
+        return text4;
       if (lineWidth < minContentWidth)
         minContentWidth = 0;
       const endStep = Math.max(1 + minContentWidth, 1 + lineWidth - indent.length);
-      if (text3.length <= endStep)
-        return text3;
+      if (text4.length <= endStep)
+        return text4;
       const folds = [];
       const escapedFolds = {};
       let end = lineWidth - indent.length;
@@ -1088,14 +1032,14 @@ var require_foldFlowLines = __commonJS({
       let escStart = -1;
       let escEnd = -1;
       if (mode === FOLD_BLOCK) {
-        i2 = consumeMoreIndentedLines(text3, i2, indent.length);
+        i2 = consumeMoreIndentedLines(text4, i2, indent.length);
         if (i2 !== -1)
           end = i2 + endStep;
       }
-      for (let ch; ch = text3[i2 += 1]; ) {
+      for (let ch; ch = text4[i2 += 1]; ) {
         if (mode === FOLD_QUOTED && ch === "\\") {
           escStart = i2;
-          switch (text3[i2 + 1]) {
+          switch (text4[i2 + 1]) {
             case "x":
               i2 += 3;
               break;
@@ -1112,12 +1056,12 @@ var require_foldFlowLines = __commonJS({
         }
         if (ch === "\n") {
           if (mode === FOLD_BLOCK)
-            i2 = consumeMoreIndentedLines(text3, i2, indent.length);
+            i2 = consumeMoreIndentedLines(text4, i2, indent.length);
           end = i2 + indent.length + endStep;
           split = void 0;
         } else {
           if (ch === " " && prev && prev !== " " && prev !== "\n" && prev !== "	") {
-            const next = text3[i2 + 1];
+            const next = text4[i2 + 1];
             if (next && next !== " " && next !== "\n" && next !== "	")
               split = i2;
           }
@@ -1129,12 +1073,12 @@ var require_foldFlowLines = __commonJS({
             } else if (mode === FOLD_QUOTED) {
               while (prev === " " || prev === "	") {
                 prev = ch;
-                ch = text3[i2 += 1];
+                ch = text4[i2 += 1];
                 overflow = true;
               }
               const j2 = i2 > escEnd + 1 ? i2 - 2 : escStart - 1;
               if (escapedFolds[j2])
-                return text3;
+                return text4;
               folds.push(j2);
               escapedFolds[j2] = true;
               end = j2 + endStep;
@@ -1149,39 +1093,39 @@ var require_foldFlowLines = __commonJS({
       if (overflow && onOverflow)
         onOverflow();
       if (folds.length === 0)
-        return text3;
+        return text4;
       if (onFold)
         onFold();
-      let res = text3.slice(0, folds[0]);
+      let res = text4.slice(0, folds[0]);
       for (let i3 = 0; i3 < folds.length; ++i3) {
         const fold = folds[i3];
-        const end2 = folds[i3 + 1] || text3.length;
+        const end2 = folds[i3 + 1] || text4.length;
         if (fold === 0)
           res = `
-${indent}${text3.slice(0, end2)}`;
+${indent}${text4.slice(0, end2)}`;
         else {
           if (mode === FOLD_QUOTED && escapedFolds[fold])
-            res += `${text3[fold]}\\`;
+            res += `${text4[fold]}\\`;
           res += `
-${indent}${text3.slice(fold + 1, end2)}`;
+${indent}${text4.slice(fold + 1, end2)}`;
         }
       }
       return res;
     }
-    function consumeMoreIndentedLines(text3, i2, indent) {
+    function consumeMoreIndentedLines(text4, i2, indent) {
       let end = i2;
       let start = i2 + 1;
-      let ch = text3[start];
+      let ch = text4[start];
       while (ch === " " || ch === "	") {
         if (i2 < start + indent) {
-          ch = text3[++i2];
+          ch = text4[++i2];
         } else {
           do {
-            ch = text3[++i2];
+            ch = text4[++i2];
           } while (ch && ch !== "\n");
           end = i2;
           start = i2 + 1;
-          ch = text3[start];
+          ch = text4[start];
         }
       }
       return end;
@@ -1567,7 +1511,7 @@ var require_stringify = __commonJS({
         props.push(doc.directives.tagString(tag));
       return props.join(" ");
     }
-    function stringify2(item, ctx, onComment, onChompKeep) {
+    function stringify3(item, ctx, onComment, onChompKeep) {
       if (identity.isPair(item))
         return item.toString(ctx, onComment, onChompKeep);
       if (identity.isAlias(item)) {
@@ -1596,7 +1540,7 @@ var require_stringify = __commonJS({
 ${ctx.indent}${str}`;
     }
     exports.createStringifyContext = createStringifyContext;
-    exports.stringify = stringify2;
+    exports.stringify = stringify3;
   }
 });
 
@@ -1606,7 +1550,7 @@ var require_stringifyPair = __commonJS({
     "use strict";
     var identity = require_identity();
     var Scalar = require_Scalar();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
       const { allNullValues, doc, indent, indentStep, options: { commentString, indentSeq, simpleKeys } } = ctx;
@@ -1628,7 +1572,7 @@ var require_stringifyPair = __commonJS({
       });
       let keyCommentDone = false;
       let chompKeep = false;
-      let str = stringify2.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
+      let str = stringify3.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
       if (!explicitKey && !ctx.inFlow && str.length > 1024) {
         if (simpleKeys)
           throw new Error("With simple keys, single line scalar must not span more than 1024 characters");
@@ -1680,7 +1624,7 @@ ${indent}:`;
         ctx.indent = ctx.indent.substring(2);
       }
       let valueCommentDone = false;
-      const valueStr = stringify2.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
+      const valueStr = stringify3.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
       let ws = " ";
       if (keyComment || vsb || vcb) {
         ws = vsb ? "\n" : "";
@@ -1821,7 +1765,7 @@ var require_addPairToJSMap = __commonJS({
     "use strict";
     var log2 = require_log();
     var merge = require_merge();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var identity = require_identity();
     var toJS = require_toJS();
     function addPairToJSMap(ctx, map, { key, value }) {
@@ -1857,7 +1801,7 @@ var require_addPairToJSMap = __commonJS({
       if (typeof jsKey !== "object")
         return String(jsKey);
       if (identity.isNode(key) && ctx?.doc) {
-        const strCtx = stringify2.createStringifyContext(ctx.doc, {});
+        const strCtx = stringify3.createStringifyContext(ctx.doc, {});
         strCtx.anchors = /* @__PURE__ */ new Set();
         for (const node of ctx.anchors.keys())
           strCtx.anchors.add(node.anchor);
@@ -1924,12 +1868,12 @@ var require_stringifyCollection = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/stringify/stringifyCollection.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyCollection(collection, ctx, options) {
       const flow = ctx.inFlow ?? collection.flow;
-      const stringify3 = flow ? stringifyFlowCollection : stringifyBlockCollection;
-      return stringify3(collection, ctx, options);
+      const stringify4 = flow ? stringifyFlowCollection : stringifyBlockCollection;
+      return stringify4(collection, ctx, options);
     }
     function stringifyBlockCollection({ comment, items }, ctx, { blockItemPrefix, flowChars, itemIndent, onChompKeep, onComment }) {
       const { indent, options: { commentString } } = ctx;
@@ -1954,7 +1898,7 @@ var require_stringifyCollection = __commonJS({
           }
         }
         chompKeep = false;
-        let str2 = stringify2.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
+        let str2 = stringify3.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
         if (comment2)
           str2 += stringifyComment.lineComment(str2, itemIndent, commentString(comment2));
         if (chompKeep && comment2)
@@ -2021,7 +1965,7 @@ ${indent}${line}` : "\n";
         }
         if (comment)
           reqNewline = true;
-        let str = stringify2.stringify(item, itemCtx, () => comment = null);
+        let str = stringify3.stringify(item, itemCtx, () => comment = null);
         reqNewline || (reqNewline = lines.length > linesAtValue || str.includes("\n"));
         if (i2 < items.length - 1) {
           str += ",";
@@ -3382,7 +3326,7 @@ var require_stringifyDocument = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/stringify/stringifyDocument.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyDocument(doc, options) {
       const lines = [];
@@ -3397,7 +3341,7 @@ var require_stringifyDocument = __commonJS({
       }
       if (hasDirectives)
         lines.push("---");
-      const ctx = stringify2.createStringifyContext(doc, options);
+      const ctx = stringify3.createStringifyContext(doc, options);
       const { commentString } = ctx.options;
       if (doc.commentBefore) {
         if (lines.length !== 1)
@@ -3419,7 +3363,7 @@ var require_stringifyDocument = __commonJS({
           contentComment = doc.contents.comment;
         }
         const onChompKeep = contentComment ? void 0 : () => chompKeep = true;
-        let body = stringify2.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
+        let body = stringify3.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
         if (contentComment)
           body += stringifyComment.lineComment(body, "", commentString(contentComment));
         if ((body[0] === "|" || body[0] === ">") && lines[lines.length - 1] === "---") {
@@ -3427,7 +3371,7 @@ var require_stringifyDocument = __commonJS({
         } else
           lines.push(body);
       } else {
-        lines.push(stringify2.stringify(doc.contents, ctx));
+        lines.push(stringify3.stringify(doc.contents, ctx));
       }
       if (doc.directives?.docEnd) {
         if (doc.comment) {
@@ -5563,7 +5507,7 @@ var require_cst_scalar = __commonJS({
 var require_cst_stringify = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/parse/cst-stringify.js"(exports) {
     "use strict";
-    var stringify2 = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
+    var stringify3 = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
     function stringifyToken(token) {
       switch (token.type) {
         case "block-scalar": {
@@ -5616,7 +5560,7 @@ var require_cst_stringify = __commonJS({
         res += stringifyToken(value);
       return res;
     }
-    exports.stringify = stringify2;
+    exports.stringify = stringify3;
   }
 });
 
@@ -6102,9 +6046,9 @@ var require_lexer = __commonJS({
         }
       }
       *parseQuotedScalar() {
-        const quote = this.charAt(0);
-        let end = this.buffer.indexOf(quote, this.pos + 1);
-        if (quote === "'") {
+        const quote2 = this.charAt(0);
+        let end = this.buffer.indexOf(quote2, this.pos + 1);
+        if (quote2 === "'") {
           while (end !== -1 && this.buffer[end + 1] === "'")
             end = this.buffer.indexOf("'", end + 2);
         } else {
@@ -7327,7 +7271,7 @@ var require_public_api = __commonJS({
       }
       return doc;
     }
-    function parse3(src, reviver, options) {
+    function parse4(src, reviver, options) {
       let _reviver = void 0;
       if (typeof reviver === "function") {
         _reviver = reviver;
@@ -7346,7 +7290,7 @@ var require_public_api = __commonJS({
       }
       return doc.toJS(Object.assign({ reviver: _reviver }, options));
     }
-    function stringify2(value, replacer, options) {
+    function stringify3(value, replacer, options) {
       let _replacer = null;
       if (typeof replacer === "function" || Array.isArray(replacer)) {
         _replacer = replacer;
@@ -7368,10 +7312,10 @@ var require_public_api = __commonJS({
         return value.toString(options);
       return new Document.Document(value, _replacer, options).toString(options);
     }
-    exports.parse = parse3;
+    exports.parse = parse4;
     exports.parseAllDocuments = parseAllDocuments;
     exports.parseDocument = parseDocument;
-    exports.stringify = stringify2;
+    exports.stringify = stringify3;
   }
 });
 
@@ -7427,90 +7371,378 @@ var require_dist = __commonJS({
   }
 });
 
-// ../core/src/domain/errors.ts
-var CloudhopError = class extends Error {
-  constructor(code, message, hint) {
-    super(message);
-    this.code = code;
-    this.hint = hint;
-    this.name = "CloudhopError";
+// ../../node_modules/.pnpm/sisteransi@1.0.5/node_modules/sisteransi/src/index.js
+var require_src = __commonJS({
+  "../../node_modules/.pnpm/sisteransi@1.0.5/node_modules/sisteransi/src/index.js"(exports, module) {
+    "use strict";
+    var ESC2 = "\x1B";
+    var CSI2 = `${ESC2}[`;
+    var beep = "\x07";
+    var cursor3 = {
+      to(x2, y2) {
+        if (!y2) return `${CSI2}${x2 + 1}G`;
+        return `${CSI2}${y2 + 1};${x2 + 1}H`;
+      },
+      move(x2, y2) {
+        let ret = "";
+        if (x2 < 0) ret += `${CSI2}${-x2}D`;
+        else if (x2 > 0) ret += `${CSI2}${x2}C`;
+        if (y2 < 0) ret += `${CSI2}${-y2}A`;
+        else if (y2 > 0) ret += `${CSI2}${y2}B`;
+        return ret;
+      },
+      up: (count = 1) => `${CSI2}${count}A`,
+      down: (count = 1) => `${CSI2}${count}B`,
+      forward: (count = 1) => `${CSI2}${count}C`,
+      backward: (count = 1) => `${CSI2}${count}D`,
+      nextLine: (count = 1) => `${CSI2}E`.repeat(count),
+      prevLine: (count = 1) => `${CSI2}F`.repeat(count),
+      left: `${CSI2}G`,
+      hide: `${CSI2}?25l`,
+      show: `${CSI2}?25h`,
+      save: `${ESC2}7`,
+      restore: `${ESC2}8`
+    };
+    var scroll = {
+      up: (count = 1) => `${CSI2}S`.repeat(count),
+      down: (count = 1) => `${CSI2}T`.repeat(count)
+    };
+    var erase3 = {
+      screen: `${CSI2}2J`,
+      up: (count = 1) => `${CSI2}1J`.repeat(count),
+      down: (count = 1) => `${CSI2}J`.repeat(count),
+      line: `${CSI2}2K`,
+      lineEnd: `${CSI2}K`,
+      lineStart: `${CSI2}1K`,
+      lines(count) {
+        let clear = "";
+        for (let i2 = 0; i2 < count; i2++)
+          clear += this.line + (i2 < count - 1 ? cursor3.up() : "");
+        if (count)
+          clear += cursor3.left;
+        return clear;
+      }
+    };
+    module.exports = { cursor: cursor3, scroll, erase: erase3, beep };
   }
-  code;
-  hint;
-};
+});
 
-// ../core/src/domain/naming.ts
-var RESERVED_NAMES = /* @__PURE__ */ new Set([
-  "add",
-  "alias",
-  "login",
-  "region",
-  "setup",
-  "sync",
-  "ls",
-  "list",
-  "rm",
-  "remove",
-  "doctor",
-  "exec",
-  "provider",
-  "ui",
-  "help",
-  "version"
-]);
-var NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,62}$/;
-function assertValidName(kind, name) {
-  if (!NAME_PATTERN.test(name)) {
-    throw new CloudhopError(
-      "INVALID_NAME",
-      `Invalid ${kind} name "${name}".`,
-      'Use lowercase letters, numbers, "-" or "_" (max 63 characters).'
-    );
-  }
-  if (kind === "alias" && RESERVED_NAMES.has(name)) {
-    throw new CloudhopError(
-      "INVALID_NAME",
-      `"${name}" is a cloudhop command.`,
-      "Pick another alias name."
-    );
+// src/cli.ts
+import { basename } from "path";
+
+// ../adapters-node/src/node-browser-opener.ts
+import { spawn } from "child_process";
+var NodeBrowserOpener = class {
+  async open(url) {
+    const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", '""', url.replace(/&/g, "^&")]] : ["xdg-open", [url]];
+    await new Promise((resolve) => {
+      const child = spawn(command, args, { stdio: "ignore", detached: true });
+      child.on("error", () => resolve());
+      child.on("spawn", () => {
+        child.unref();
+        resolve();
+      });
+    });
   }
-}
-function suggestAliasName(...parts) {
-  const slug = parts.join("-").toLowerCase().replace(/access$/i, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
-  return slug || "alias";
-}
+};
 
-// ../core/src/domain/version.ts
-function compareVersions(a2, b3) {
-  const pa = a2.split(".").map((n3) => Number.parseInt(n3, 10) || 0);
-  const pb = b3.split(".").map((n3) => Number.parseInt(n3, 10) || 0);
-  for (let i2 = 0; i2 < Math.max(pa.length, pb.length); i2++) {
-    const diff = (pa[i2] ?? 0) - (pb[i2] ?? 0);
-    if (diff !== 0) return diff;
+// ../adapters-node/src/node-process-runner.ts
+import { spawn as spawn2 } from "child_process";
+var STDERR_TAIL_BYTES = 8 * 1024;
+function buildEnv(overrides) {
+  const env = { ...process.env };
+  for (const [key, value] of Object.entries(overrides ?? {})) {
+    if (value === void 0) delete env[key];
+    else env[key] = value;
   }
-  return 0;
+  return env;
 }
-
-// ../core/src/application/cloudhop-app.ts
-var CloudhopApp = class {
-  constructor(deps) {
-    this.deps = deps;
+var useShell = process.platform === "win32";
+var NodeProcessRunner = class {
+  run(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+      const child = spawn2(command, args, {
+        env: buildEnv(options.env),
+        stdio: ["inherit", "inherit", options.captureStderr ? "pipe" : "inherit"],
+        shell: useShell
+      });
+      let tail = "";
+      child.stderr?.on("data", (chunk) => {
+        process.stderr.write(chunk);
+        tail = (tail + chunk.toString()).slice(-STDERR_TAIL_BYTES);
+      });
+      const ignore = () => {
+      };
+      process.on("SIGINT", ignore);
+      process.on("SIGTERM", ignore);
+      const cleanup = () => {
+        process.off("SIGINT", ignore);
+        process.off("SIGTERM", ignore);
+      };
+      child.on("error", (error) => {
+        cleanup();
+        reject(error);
+      });
+      child.on("close", (code, signal) => {
+        cleanup();
+        resolve({ exitCode: code ?? (signal ? 128 + 2 : 1), stderrTail: tail });
+      });
+    });
   }
-  deps;
-  // ── Providers ────────────────────────────────────────────────────────────
-  availableProviders() {
-    return this.deps.providers;
+  capture(command, args, options = {}) {
+    return new Promise((resolve) => {
+      const child = spawn2(command, args, { env: buildEnv(options.env), shell: useShell });
+      child.stdin.end();
+      let stdout2 = "";
+      let stderr = "";
+      child.stdout.on("data", (c3) => {
+        stdout2 += c3.toString();
+      });
+      child.stderr.on("data", (c3) => {
+        stderr += c3.toString();
+      });
+      child.on("error", (error) => resolve({ exitCode: 127, stdout: stdout2, stderr: error.message }));
+      child.on("close", (code) => resolve({ exitCode: code ?? 1, stdout: stdout2, stderr }));
+    });
   }
-  provider(id) {
-    const provider = this.deps.providers.find((p3) => p3.id === id);
-    if (!provider) {
-      throw new CloudhopError(
-        "PROVIDER_NOT_AVAILABLE",
-        `The ${id} provider is not available yet.`,
-        "Follow https://github.com/dayepesb/cloudhop for upcoming providers."
-      );
-    }
-    return provider;
+  async probe(command) {
+    const result = await this.capture(command, ["--version"]);
+    if (result.exitCode !== 0) return { installed: false };
+    const output = `${result.stdout} ${result.stderr}`;
+    const version = output.match(/(\d+\.\d+\.\d+)/)?.[1];
+    return { installed: true, ...version ? { version } : {} };
+  }
+};
+
+// ../adapters-node/src/system-tool-installer.ts
+var TOOLS = {
+  aws: {
+    manualUrl: "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html",
+    recipes: {
+      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "awscli"] }],
+      win32: [
+        { via: "winget", command: "winget", args: ["install", "--exact", "--id", "Amazon.AWSCLI"] }
+      ]
+    }
+  },
+  az: {
+    manualUrl: "https://learn.microsoft.com/cli/azure/install-azure-cli",
+    recipes: {
+      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "azure-cli"] }],
+      win32: [
+        {
+          via: "winget",
+          command: "winget",
+          args: ["install", "--exact", "--id", "Microsoft.AzureCLI"]
+        }
+      ]
+    }
+  },
+  gcloud: {
+    manualUrl: "https://cloud.google.com/sdk/docs/install",
+    recipes: {
+      darwin: [
+        { via: "Homebrew", command: "brew", args: ["install", "--cask", "google-cloud-sdk"] }
+      ],
+      win32: [
+        {
+          via: "winget",
+          command: "winget",
+          args: ["install", "--exact", "--id", "Google.CloudSDK"]
+        }
+      ]
+    }
+  }
+};
+var SystemToolInstaller = class {
+  constructor(runner, platform = process.platform) {
+    this.runner = runner;
+    this.platform = platform;
+  }
+  runner;
+  platform;
+  available = /* @__PURE__ */ new Map();
+  recipeFor(command) {
+    const tool = TOOLS[command];
+    if (!tool) return void 0;
+    const recipe = tool.recipes[this.platform]?.[0];
+    return recipe ? { ...recipe, manualUrl: tool.manualUrl } : { via: "official installer", command: "", args: [], manualUrl: tool.manualUrl };
+  }
+  async install(recipe) {
+    if (!recipe.command) return false;
+    if (!await this.hasCommand(recipe.command)) return false;
+    const { exitCode } = await this.runner.run(recipe.command, recipe.args);
+    return exitCode === 0;
+  }
+  async hasCommand(command) {
+    if (!this.available.has(command)) {
+      this.available.set(command, (await this.runner.probe(command)).installed);
+    }
+    return this.available.get(command) ?? false;
+  }
+};
+
+// ../adapters-node/src/yaml-config-store.ts
+import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+
+// ../core/src/domain/errors.ts
+var CloudhopError = class extends Error {
+  constructor(code, message, hint) {
+    super(message);
+    this.code = code;
+    this.hint = hint;
+    this.name = "CloudhopError";
+  }
+  code;
+  hint;
+};
+
+// ../core/src/domain/naming.ts
+var RESERVED_NAMES = /* @__PURE__ */ new Set([
+  "add",
+  "agent",
+  "alias",
+  "login",
+  "team",
+  "shell",
+  "use",
+  "each",
+  "console",
+  "prod",
+  "rename",
+  "mv",
+  "mcp",
+  "region",
+  "setup",
+  "status",
+  "sync",
+  "ls",
+  "list",
+  "rm",
+  "remove",
+  "doctor",
+  "exec",
+  "provider",
+  "ui",
+  "help",
+  "version"
+]);
+var NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,62}$/;
+function assertValidName(kind, name) {
+  if (!NAME_PATTERN.test(name)) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `Invalid ${kind} name "${name}".`,
+      'Use lowercase letters, numbers, "-" or "_" (max 63 characters).'
+    );
+  }
+  if (kind === "alias" && RESERVED_NAMES.has(name)) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `"${name}" is a cloudhop command.`,
+      "Pick another alias name."
+    );
+  }
+}
+function suggestAliasName(...parts) {
+  const slug = parts.join("-").toLowerCase().replace(/access$/i, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
+  return slug || "alias";
+}
+var slugTokens = (text4) => text4.toLowerCase().replace(/access$/i, "").split(/[^a-z0-9]+/).filter(Boolean);
+var ROLE_WORDS = {
+  administrator: "admin",
+  administratoraccess: "admin",
+  readonly: "ro",
+  readonlyaccess: "ro",
+  developer: "dev",
+  poweruser: "power",
+  poweruseraccess: "power",
+  viewonly: "view"
+};
+var ROLE_NOISE = /* @__PURE__ */ new Set(["aws", "access", "role", "ps", "iam"]);
+var PRODUCTION = /(^|[^a-z])(prod|prd|production|live)([^a-z]|$)/i;
+var looksLikeProduction = (...texts) => texts.some((text4) => PRODUCTION.test(text4));
+function suggestAliases(targets, sourceId, taken = /* @__PURE__ */ new Set()) {
+  const sourceWords = new Set(
+    slugTokens(sourceId).filter((w) => w.length > 2 && !/^(test|dev|main)$/.test(w))
+  );
+  const accountOf = (t2) => {
+    let words = slugTokens(t2.attributes.accountName ?? t2.label.split(" / ")[0] ?? t2.id);
+    if (words.length > 1 && sourceWords.has(words[0])) words = words.slice(1);
+    while (words.length > 1 && /^\d{1,2}$/.test(words[words.length - 1]))
+      words = words.slice(0, -1);
+    return words;
+  };
+  const roleOf = (t2, accountWords) => {
+    const raw = t2.attributes.roleName ?? t2.label.split(" / ")[1] ?? "";
+    const compact = raw.toLowerCase().replace(/[^a-z0-9]/g, "").replace(/^aws/, "").replace(/access$/, "");
+    if (ROLE_WORDS[compact]) return [ROLE_WORDS[compact]];
+    const skip = /* @__PURE__ */ new Set([...accountWords, ...sourceWords, ...ROLE_NOISE]);
+    const words = slugTokens(raw).filter((w) => !skip.has(w)).map((w) => ROLE_WORDS[w] ?? w);
+    return words.length ? words : slugTokens(raw).slice(-1);
+  };
+  const accounts = targets.map(accountOf);
+  const count = /* @__PURE__ */ new Map();
+  for (const words of accounts) count.set(words.join("-"), (count.get(words.join("-")) ?? 0) + 1);
+  const used = new Set(taken);
+  const result = /* @__PURE__ */ new Map();
+  targets.forEach((target, i2) => {
+    const accountWords = accounts[i2];
+    const base = accountWords.join("-");
+    const words = (count.get(base) ?? 0) > 1 ? [...accountWords, ...roleOf(target, accountWords)] : accountWords;
+    const stem = suggestAliasName(words.join("-"));
+    let name = stem;
+    for (let n3 = 2; used.has(name) || RESERVED_NAMES.has(name); n3++) name = `${stem}-${n3}`;
+    used.add(name);
+    result.set(target.id, name);
+  });
+  return result;
+}
+
+// ../core/src/domain/version.ts
+function compareVersions(a2, b3) {
+  const pa = a2.split(".").map((n3) => Number.parseInt(n3, 10) || 0);
+  const pb = b3.split(".").map((n3) => Number.parseInt(n3, 10) || 0);
+  for (let i2 = 0; i2 < Math.max(pa.length, pb.length); i2++) {
+    const diff = (pa[i2] ?? 0) - (pb[i2] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+
+// ../core/src/application/cloudhop-app.ts
+var loginRequired = (sourceId) => new CloudhopError(
+  "LOGIN_REQUIRED",
+  `The session of "${sourceId}" expired and needs a browser sign-in.`,
+  `Run \`cloudhop login ${sourceId}\` (it opens the browser), then try again.`
+);
+var NEXT_BY_STATE = {
+  valid: "ready",
+  refreshable: "silent-renewal",
+  expired: "browser-sign-in",
+  unknown: "unknown"
+};
+var CloudhopApp = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  // ── Providers ────────────────────────────────────────────────────────────
+  availableProviders() {
+    return this.deps.providers;
+  }
+  provider(id) {
+    const provider = this.deps.providers.find((p3) => p3.id === id);
+    if (!provider) {
+      throw new CloudhopError(
+        "PROVIDER_NOT_AVAILABLE",
+        `The ${id} provider is not available yet.`,
+        "Follow https://github.com/dayepesb/cloudhop for upcoming providers."
+      );
+    }
+    return provider;
   }
   async config() {
     return this.deps.config.load();
@@ -7591,13 +7823,19 @@ var CloudhopApp = class {
     return this.syncSource(sourceId);
   }
   /** Makes sure the source has a usable session, renewing it silently or via login. */
-  async ensureSession(sourceId) {
+  /**
+   * Makes the source's session usable: renews it silently when possible, and
+   * otherwise signs in through the browser, unless `interactive` is false, in
+   * which case it fails with LOGIN_REQUIRED instead of opening a browser.
+   */
+  async ensureSession(sourceId, { interactive: interactive2 = true } = {}) {
     const config = await this.deps.config.load();
     const source = this.findSource(config, sourceId);
     const provider = this.provider(source.provider);
     const state = await provider.sessionState(source);
     if (state === "valid" || state === "unknown") return "none";
     if (state === "refreshable" && await provider.refreshSession(source)) return "refreshed";
+    if (!interactive2) throw loginRequired(sourceId);
     await this.login(sourceId);
     return "logged-in";
   }
@@ -7661,6 +7899,81 @@ var CloudhopApp = class {
     const config = await this.deps.config.load();
     return Promise.all(config.aliases.map((a2) => this.resolve(config, a2)));
   }
+  /** Sources with their session state and every alias, checked without signing in. */
+  async overview() {
+    const config = await this.deps.config.load();
+    const sources = await Promise.all(
+      config.sources.map(async (source) => {
+        const session = await this.provider(source.provider).sessionState(source);
+        return {
+          id: source.id,
+          provider: source.provider,
+          kind: source.kind,
+          settings: source.settings,
+          session,
+          next: NEXT_BY_STATE[session]
+        };
+      })
+    );
+    const bySource = new Map(sources.map((s) => [s.id, s]));
+    const aliases = await Promise.all(
+      config.aliases.map(async (alias) => {
+        const resolved = await this.resolve(config, alias);
+        const source = bySource.get(alias.source);
+        return {
+          name: alias.name,
+          source: alias.source,
+          provider: resolved.source.provider,
+          target: alias.target,
+          label: resolved.target?.label,
+          available: Boolean(resolved.target),
+          region: resolved.region,
+          attributes: resolved.target?.attributes ?? {},
+          prod: alias.prod === true,
+          session: source.session,
+          next: source.next
+        };
+      })
+    );
+    return { sources, aliases };
+  }
+  /** The status of one alias: which account it points to and whether it can run right away. */
+  async aliasStatus(name) {
+    const { aliases } = await this.overview();
+    const status = aliases.find((a2) => a2.name === name);
+    if (!status) {
+      throw new CloudhopError(
+        "ALIAS_NOT_FOUND",
+        `Alias "${name}" not found.`,
+        "See your aliases with `cloudhop ls`."
+      );
+    }
+    return status;
+  }
+  /** Renames an alias and its profile, keeping its account, role, region and production mark. */
+  async renameAlias(from, to) {
+    assertValidName("alias", to);
+    const config = await this.deps.config.load();
+    const alias = this.findAlias(config, from);
+    if (from === to) return;
+    if (config.aliases.some((a2) => a2.name === to)) {
+      throw new CloudhopError("ALIAS_EXISTS", `Alias "${to}" already exists.`);
+    }
+    alias.name = to;
+    const source = this.findSource(config, alias.source);
+    await this.syncProfiles(source.provider, config);
+    await this.deps.config.save(config);
+  }
+  /** Marks aliases as production (or not). Production aliases ask before changing anything. */
+  async setProduction(names, prod) {
+    const config = await this.deps.config.load();
+    for (const name of names) {
+      const alias = this.findAlias(config, name);
+      if (prod) alias.prod = true;
+      else delete alias.prod;
+    }
+    await this.deps.config.save(config);
+  }
   /** Changes an alias' region; matching the source's region clears the override. */
   async setAliasRegion(name, region) {
     const config = await this.deps.config.load();
@@ -7685,6 +7998,71 @@ var CloudhopApp = class {
     return this.runWithSession(resolved, provider, "cli", provider.cli.command, args);
   }
   /** Runs any command with the alias' temporary credentials in its environment. */
+  /**
+   * Runs the alias' cloud CLI without a terminal and returns what it printed.
+   * Used where stdin/stdout belong to someone else (the MCP server). It never
+   * opens a browser: an expired session fails with LOGIN_REQUIRED.
+   */
+  async captureAsAlias(name, args, overrides = {}) {
+    const resolved = await this.usableAlias(name, overrides);
+    const provider = this.provider(resolved.source.provider);
+    await this.requireCli(provider);
+    await this.ensureSession(resolved.source.id, { interactive: false });
+    const env = await provider.processEnv(resolved, "cli");
+    const result = await this.deps.runner.capture(provider.cli.command, args, { env });
+    if (result.exitCode !== 0 && provider.isSessionError(`${result.stdout}
+${result.stderr}`)) {
+      throw loginRequired(resolved.source.id);
+    }
+    return result;
+  }
+  /**
+   * Whether running these CLI arguments (or, with `args` undefined, any
+   * command through `cloudhop exec`) as this alias needs a person's OK: true
+   * for production aliases unless the command surely only reads.
+   */
+  async needsProductionConfirmation(name, args) {
+    const resolved = await this.resolveAlias(name);
+    if (!resolved.alias.prod) return false;
+    if (!args) return true;
+    return !this.provider(resolved.source.provider).isReadOnly(args);
+  }
+  /**
+   * A URL that opens the web console as the alias, signing in first if the
+   * session expired. The URL is a short-lived secret: open it, never print it.
+   */
+  async consoleUrl(name, { service, region } = {}) {
+    const resolved = await this.usableAlias(name, region ? { region } : {});
+    const provider = this.provider(resolved.source.provider);
+    if (!provider.consoleUrl) {
+      throw new CloudhopError(
+        "PROVIDER_NOT_AVAILABLE",
+        `${provider.displayName} has no console sign-in in cloudhop yet.`
+      );
+    }
+    if (service !== void 0 && !/^[a-z0-9-]{1,40}$/.test(service)) {
+      throw new CloudhopError(
+        "INVALID_NAME",
+        `"${service}" doesn't look like a service name.`,
+        "Examples: s3, ec2, lambda, cloudwatch."
+      );
+    }
+    await this.ensureSession(resolved.source.id);
+    return provider.consoleUrl(resolved, service);
+  }
+  /**
+   * Opens the web console as the alias in the user's browser. The sign-in URL
+   * stays inside cloudhop: callers only learn how the user got in.
+   */
+  async openConsole(name, options = {}) {
+    const { url, via } = await this.consoleUrl(name, options);
+    await this.deps.browser.open(url);
+    return via;
+  }
+  /** The command that shows who an alias is, e.g. `aws sts get-caller-identity`. */
+  identityArgs(name) {
+    return this.resolveAlias(name).then((r2) => this.provider(r2.source.provider).identityArgs);
+  }
   async execAsAlias(name, command, args, overrides = {}) {
     const resolved = await this.usableAlias(name, overrides);
     const provider = this.provider(resolved.source.provider);
@@ -7819,30 +8197,387 @@ var CloudhopApp = class {
 var PROVIDER_IDS = ["aws", "azure", "gcp"];
 var emptyConfig = () => ({ providers: [], sources: [], aliases: [] });
 
-// src/flags.ts
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["yes", "all", "list", "noOpen"]);
-var camel = (name) => name.replace(/-([a-z])/g, (_2, c3) => c3.toUpperCase());
-function parseArgs(argv) {
-  const positional = [];
-  const flags = {};
-  for (let i2 = 0; i2 < argv.length; i2++) {
-    const arg = argv[i2];
-    if (!arg.startsWith("--")) {
-      positional.push(arg);
-      continue;
-    }
-    const [rawName, inline] = arg.slice(2).split(/=(.*)/s, 2);
-    const name = camel(rawName);
-    if (inline !== void 0) flags[name] = inline;
-    else if (BOOLEAN_FLAGS.has(name)) flags[name] = "true";
-    else flags[name] = argv[++i2] ?? "";
-  }
-  return { positional, flags };
+// ../adapters-node/src/yaml-config-store.ts
+var import_yaml = __toESM(require_dist(), 1);
+function defaultConfigDir(env = process.env) {
+  if (env.CLOUDHOP_HOME) return env.CLOUDHOP_HOME;
+  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "cloudhop");
 }
-var interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
-
-// ../../node_modules/.pnpm/@clack+prompts@1.8.1/node_modules/@clack/prompts/dist/index.mjs
-var dist_exports = {};
+var HEADER = "# cloudhop configuration. Contains no secrets.\n# Docs: https://github.com/dayepesb/cloudhop\n";
+var YamlConfigStore = class {
+  constructor(dir = defaultConfigDir()) {
+    this.dir = dir;
+  }
+  dir;
+  get configPath() {
+    return join(this.dir, "config.yaml");
+  }
+  get targetsPath() {
+    return join(this.dir, "targets.json");
+  }
+  async load() {
+    const raw = await this.read(this.configPath);
+    if (!raw) return emptyConfig();
+    const file = (0, import_yaml.parse)(raw) ?? {};
+    return {
+      providers: (file.providers ?? []).filter(
+        (p3) => PROVIDER_IDS.includes(p3)
+      ),
+      sources: Object.entries(file.sources ?? {}).map(([id, s]) => ({
+        id,
+        ...s,
+        settings: s.settings ?? {}
+      })),
+      aliases: Object.entries(file.aliases ?? {}).map(([name, a2]) => ({ name, ...a2 }))
+    };
+  }
+  async save(config) {
+    const file = {
+      providers: config.providers,
+      sources: Object.fromEntries(config.sources.map(({ id, ...rest }) => [id, rest])),
+      aliases: Object.fromEntries(config.aliases.map(({ name, ...rest }) => [name, rest]))
+    };
+    await this.write(this.configPath, HEADER + (0, import_yaml.stringify)(file));
+  }
+  async loadTargets(sourceId) {
+    return (await this.allTargets())[sourceId] ?? [];
+  }
+  async saveTargets(sourceId, targets) {
+    const all = await this.allTargets();
+    all[sourceId] = targets;
+    await this.write(this.targetsPath, JSON.stringify(all, null, 2));
+  }
+  async removeTargets(sourceId) {
+    const all = await this.allTargets();
+    delete all[sourceId];
+    await this.write(this.targetsPath, JSON.stringify(all, null, 2));
+  }
+  async reset() {
+    await rm(this.dir, { recursive: true, force: true });
+  }
+  async allTargets() {
+    const raw = await this.read(this.targetsPath);
+    return raw ? JSON.parse(raw) : {};
+  }
+  async read(path2) {
+    try {
+      return await readFile(path2, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+  }
+  /** Writes through a temp file so a crash never leaves a half-written config. */
+  async write(path2, content) {
+    await mkdir(this.dir, { recursive: true, mode: 448 });
+    const tmp = `${path2}.${process.pid}.tmp`;
+    await writeFile(tmp, content, { mode: 384 });
+    await rename(tmp, path2);
+  }
+};
+
+// ../mcp/src/server.ts
+import { createInterface } from "readline";
+
+// ../mcp/src/tools.ts
+var MAX_OUTPUT = 1e5;
+var cap = (text4) => text4.length > MAX_OUTPUT ? `${text4.slice(0, MAX_OUTPUT)}
+\u2026 [truncated: ${text4.length - MAX_OUTPUT} more characters. Narrow the command with --query or filters.]` : text4;
+var WINDOWS_SHELL_CHARS = /[&|<>^%!"\r\n]/;
+var text = (args, key) => {
+  const value = args[key];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CloudhopError("INVALID_NAME", `"${key}" is required.`);
+  }
+  return value.trim();
+};
+var stringArray = (args, key) => {
+  const value = args[key];
+  if (!Array.isArray(value) || !value.every((v) => typeof v === "string")) {
+    throw new CloudhopError("INVALID_NAME", `"${key}" must be an array of strings.`);
+  }
+  return value;
+};
+var aliasInput = {
+  alias: {
+    type: "string",
+    description: "The cloudhop alias to use, as listed by list_aliases. Ask the user which one."
+  }
+};
+function createTools(app) {
+  return [
+    {
+      name: "list_aliases",
+      title: "List cloudhop aliases",
+      description: "Lists every cloudhop source (SSO portal or personal account) with its session state, and every alias: name, account/role label, region and whether a sign-in is needed. Call this first, then ask the user which alias to work with. Never contains secrets.",
+      inputSchema: { type: "object", properties: {}, additionalProperties: false },
+      annotations: { readOnlyHint: true, openWorldHint: false },
+      run: () => app.overview()
+    },
+    {
+      name: "alias_status",
+      title: "Check an alias",
+      description: 'Shows which account, role and region an alias points to and whether it can run now. `next` is "ready", "silent-renewal" (runs without asking), "browser-sign-in" (call login first, or ask the user to run `cloudhop login <source>`) or "unknown".',
+      inputSchema: {
+        type: "object",
+        properties: aliasInput,
+        required: ["alias"],
+        additionalProperties: false
+      },
+      annotations: { readOnlyHint: true, openWorldHint: false },
+      run: (args) => app.aliasStatus(text(args, "alias"))
+    },
+    {
+      name: "whoami",
+      title: "Who am I in this alias",
+      description: "Asks the cloud who the alias really is (for AWS: `aws sts get-caller-identity`). Use it to confirm the account before doing anything important.",
+      inputSchema: {
+        type: "object",
+        properties: aliasInput,
+        required: ["alias"],
+        additionalProperties: false
+      },
+      annotations: { readOnlyHint: true, openWorldHint: true },
+      run: async (args) => {
+        const alias = text(args, "alias");
+        const result = await app.captureAsAlias(alias, await app.identityArgs(alias));
+        return {
+          alias,
+          exitCode: result.exitCode,
+          output: cap(result.stdout),
+          errors: cap(result.stderr)
+        };
+      }
+    },
+    {
+      name: "login",
+      title: "Sign in to a source",
+      description: "Opens the user's browser to sign in to a source (an SSO portal or a personal account) and waits up to 5 minutes for them to approve, then refreshes its accounts and roles. Tell the user to look at their browser before calling it. Only call it when alias_status says `browser-sign-in` or a tool returned LOGIN_REQUIRED.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          source: { type: "string", description: "The source id, as shown in list_aliases." }
+        },
+        required: ["source"],
+        additionalProperties: false
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      },
+      run: async (args) => {
+        const source = text(args, "source");
+        const report = await app.login(source);
+        return { source, signedIn: true, targets: report.targets.length };
+      }
+    },
+    {
+      name: "run_cloud_cli",
+      title: "Run the cloud CLI as an alias",
+      description: 'Runs the alias\' cloud CLI (`aws` for AWS aliases) with the alias\' account, role and region, like `hop <alias> <args>`. `args` are the CLI arguments without the program name and without --profile, e.g. ["s3", "ls"]. Returns stdout, stderr and the exit code. It can create, change or delete cloud resources: before any command that is not read-only, show the user the alias, account, region and exact command and get their explicit confirmation.',
+      inputSchema: {
+        type: "object",
+        properties: {
+          ...aliasInput,
+          args: {
+            type: "array",
+            items: { type: "string" },
+            description: 'CLI arguments, e.g. ["ec2", "describe-instances", "--output", "json"].'
+          },
+          region: {
+            type: "string",
+            description: "Optional region for this call only; defaults to the alias' region."
+          },
+          confirm_production: {
+            type: "boolean",
+            description: "Only for production aliases (prod: true) and commands that may change resources: set it to true after the user explicitly approved this exact command."
+          }
+        },
+        required: ["alias", "args"],
+        additionalProperties: false
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true
+      },
+      run: async (args) => {
+        const alias = text(args, "alias");
+        const cliArgs = stringArray(args, "args");
+        if (cliArgs.includes("--profile")) {
+          throw new CloudhopError(
+            "INVALID_NAME",
+            "Do not pass --profile: the alias already chooses the account and role."
+          );
+        }
+        if (process.platform === "win32" && cliArgs.some((a2) => WINDOWS_SHELL_CHARS.test(a2))) {
+          throw new CloudhopError(
+            "INVALID_NAME",
+            'On Windows, arguments cannot contain & | < > ^ % ! " or line breaks.',
+            "Ask the user to run this command in their terminal with hop instead."
+          );
+        }
+        const region = typeof args.region === "string" && args.region.trim() ? args.region.trim() : void 0;
+        if (args.confirm_production !== true && await app.needsProductionConfirmation(alias, cliArgs)) {
+          const status = await app.aliasStatus(alias);
+          throw new CloudhopError(
+            "PROD_CONFIRMATION_REQUIRED",
+            `${alias} is PRODUCTION (${status.label ?? status.target}, ${status.region ?? "default region"}) and this command may change resources.`,
+            "Show the user the alias, account, region and the exact command, and ask for explicit approval. Only if they approve, call run_cloud_cli again with confirm_production: true."
+          );
+        }
+        const result = await app.captureAsAlias(alias, cliArgs, region ? { region } : {});
+        return {
+          alias,
+          exitCode: result.exitCode,
+          stdout: cap(result.stdout),
+          stderr: cap(result.stderr)
+        };
+      }
+    }
+  ];
+}
+
+// ../mcp/src/server.ts
+var MCP_INSTRUCTIONS = `cloudhop gives each cloud account + role + region a short alias and signs the user in only when a session expired.
+Before the first cloud operation in a conversation: call list_aliases, show the user the aliases (name, account/role, region) and ask which one to use. Never guess the alias.
+Use run_cloud_cli for cloud CLI commands, never --profile. Read-only commands may run once the alias is chosen; before anything that creates, changes or deletes resources, show the alias, account, region and exact command, and wait for the user's explicit OK. Aliases with prod: true are production: run_cloud_cli refuses changes there until the user approves and you pass confirm_production: true.
+If a tool returns LOGIN_REQUIRED or alias_status says browser-sign-in: tell the user their browser will open, then call login (it waits up to 5 minutes for them to approve). Never print or ask for credentials.`;
+var SUPPORTED_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
+function serveMcp({
+  app,
+  version,
+  input = process.stdin,
+  output = process.stdout
+}) {
+  const tools = createTools(app);
+  const byName = new Map(tools.map((t2) => [t2.name, t2]));
+  const send2 = (message) => output.write(`${JSON.stringify(message)}
+`);
+  const reply = (id, result) => send2({ jsonrpc: "2.0", id, result });
+  const fail = (id, code, message) => send2({ jsonrpc: "2.0", id: id ?? null, error: { code, message } });
+  const handle = async (request) => {
+    const { id, method, params = {} } = request;
+    const isNotification = id === void 0;
+    switch (method) {
+      case "initialize": {
+        const asked = typeof params.protocolVersion === "string" ? params.protocolVersion : "";
+        reply(id, {
+          protocolVersion: SUPPORTED_VERSIONS.includes(asked) ? asked : SUPPORTED_VERSIONS[0],
+          capabilities: { tools: { listChanged: false } },
+          serverInfo: { name: "cloudhop", title: "cloudhop", version },
+          instructions: MCP_INSTRUCTIONS
+        });
+        return;
+      }
+      case "ping":
+        reply(id, {});
+        return;
+      case "tools/list":
+        reply(id, {
+          tools: tools.map(({ name, title, description, inputSchema, annotations }) => ({
+            name,
+            title,
+            description,
+            inputSchema,
+            annotations
+          }))
+        });
+        return;
+      case "tools/call": {
+        const tool = byName.get(String(params.name));
+        if (!tool) {
+          fail(id, -32602, `Unknown tool: ${String(params.name)}`);
+          return;
+        }
+        const args = params.arguments ?? {};
+        try {
+          const result = await tool.run(args);
+          reply(id, {
+            content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+            structuredContent: result
+          });
+        } catch (error) {
+          const known = error instanceof CloudhopError;
+          const body = {
+            error: known ? error.code : "UNEXPECTED",
+            message: error.message,
+            ...known && error.hint ? { hint: error.hint } : {}
+          };
+          reply(id, {
+            content: [{ type: "text", text: JSON.stringify(body, null, 2) }],
+            structuredContent: body,
+            isError: true
+          });
+        }
+        return;
+      }
+      default:
+        if (!isNotification) fail(id, -32601, `Method not found: ${method}`);
+    }
+  };
+  return new Promise((resolve) => {
+    const lines = createInterface({ input, crlfDelay: Number.POSITIVE_INFINITY });
+    const pending = /* @__PURE__ */ new Set();
+    lines.on("line", (line) => {
+      if (!line.trim()) return;
+      let request;
+      try {
+        request = JSON.parse(line);
+      } catch {
+        fail(null, -32700, "Parse error");
+        return;
+      }
+      if (typeof request.method !== "string") return;
+      const task = handle(request).catch((error) => {
+        if (request.id !== void 0) fail(request.id, -32603, error.message);
+      });
+      pending.add(task);
+      task.finally(() => pending.delete(task));
+    });
+    lines.on("close", () => {
+      Promise.allSettled([...pending]).then(() => resolve());
+    });
+  });
+}
+
+// src/flags.ts
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+  "yes",
+  "all",
+  "list",
+  "noOpen",
+  "json",
+  "noMcp",
+  "force",
+  "prod",
+  "off"
+]);
+var camel = (name) => name.replace(/-([a-z])/g, (_2, c3) => c3.toUpperCase());
+function parseArgs(argv) {
+  const positional = [];
+  const flags = {};
+  for (let i2 = 0; i2 < argv.length; i2++) {
+    const arg = argv[i2];
+    if (!arg.startsWith("--")) {
+      positional.push(arg);
+      continue;
+    }
+    const [rawName, inline] = arg.slice(2).split(/=(.*)/s, 2);
+    const name = camel(rawName);
+    if (inline !== void 0) flags[name] = inline;
+    else if (BOOLEAN_FLAGS.has(name)) flags[name] = "true";
+    else flags[name] = argv[++i2] ?? "";
+  }
+  return { positional, flags };
+}
+var interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+
+// ../../node_modules/.pnpm/@clack+prompts@1.8.1/node_modules/@clack/prompts/dist/index.mjs
+var dist_exports = {};
 __export(dist_exports, {
   CANCEL_SYMBOL: () => CANCEL_SYMBOL,
   MULTISELECT_INSTRUCTIONS: () => MULTISELECT_INSTRUCTIONS,
@@ -7903,7 +8638,7 @@ __export(dist_exports, {
   symbolBar: () => symbolBar,
   taskLog: () => taskLog,
   tasks: () => tasks,
-  text: () => text,
+  text: () => text2,
   unicode: () => unicode,
   unicodeOr: () => unicodeOr,
   updateSettings: () => updateSettings
@@ -9240,7 +9975,7 @@ import { styleText as styleText2, stripVTControlCharacters } from "util";
 import process$1 from "process";
 var import_sisteransi2 = __toESM(require_src(), 1);
 import { existsSync, lstatSync, readdirSync } from "fs";
-import { dirname, join } from "path";
+import { dirname, join as join2 } from "path";
 function isUnicodeSupported() {
   if (process$1.platform !== "win32") {
     return process$1.env.TERM !== "linux";
@@ -10181,7 +10916,7 @@ var path = (e) => {
         existsSync(t2) ? lstatSync(t2).isDirectory() && (!e.directory || t2.endsWith("/")) ? i2 = t2 : i2 = dirname(t2) : i2 = dirname(t2);
         const c3 = t2.length > 1 && t2.endsWith("/") ? t2.slice(0, -1) : t2;
         return readdirSync(i2).map((r2) => {
-          const n3 = join(i2, r2), m3 = lstatSync(n3);
+          const n3 = join2(i2, r2), m3 = lstatSync(n3);
           return {
             name: r2,
             path: n3,
@@ -10608,7 +11343,7 @@ ${e.value}` : e.value;
     }
   };
 };
-var text = (t2) => new n2({
+var text2 = (t2) => new n2({
   validate: t2.validate,
   placeholder: t2.placeholder,
   defaultValue: t2.defaultValue,
@@ -10665,8 +11400,8 @@ function answer(value) {
 }
 var colorful = (stream2) => Boolean(stream2.isTTY) && !process.env.NO_COLOR;
 var truecolor = /truecolor|24bit/i.test(process.env.COLORTERM ?? "");
-var dim = (text3) => colorful(process.stderr) ? `\x1B[2m${text3}\x1B[22m` : text3;
-var bold = (text3) => colorful(process.stdout) ? `\x1B[1m${text3}\x1B[22m` : text3;
+var dim = (text4) => colorful(process.stderr) ? `\x1B[2m${text4}\x1B[22m` : text4;
+var bold = (text4) => colorful(process.stdout) ? `\x1B[1m${text4}\x1B[22m` : text4;
 var STYLES = {
   dim: ["2", "22"],
   green: ["32", "39"],
@@ -10675,7 +11410,7 @@ var STYLES = {
   sky: [truecolor ? "38;2;59;184;245" : "38;5;75", "39"],
   coral: [truecolor ? "38;2;255;122;89" : "38;5;209", "39"]
 };
-var paint = (style, text3) => colorful(process.stdout) ? `\x1B[${STYLES[style][0]}m${text3}\x1B[${STYLES[style][1]}m` : text3;
+var paint = (style, text4) => colorful(process.stdout) ? `\x1B[${STYLES[style][0]}m${text4}\x1B[${STYLES[style][1]}m` : text4;
 var BANNER = [
   "       _                    _  _",
   "  ___ | |  ___   _   _   __| || |__    ___   _ __",
@@ -10778,14 +11513,12 @@ async function chooseAliases(app, source, targets) {
   );
   const validateRegion2 = regionValidator(app, source);
   let defaultRegion = source.settings.region ?? "";
+  const suggestions = suggestAliases(targets, source.id, existing);
   const aliases = [];
   for (const target of selected) {
     dist_exports.log.step(target.label);
     const suggestion = uniqueName(
-      targets.length === 1 && target.id === "console" ? source.id : suggestAliasName(
-        target.attributes.accountName ?? target.label,
-        target.attributes.roleName ?? ""
-      ),
+      targets.length === 1 && target.id === "console" ? source.id : suggestions.get(target.id) ?? suggestAliasName(target.label),
       existing
     );
     const name = answer(
@@ -10804,13 +11537,20 @@ async function chooseAliases(app, source, targets) {
         validate: (v) => v?.trim() ? validateRegion2?.(v.trim()) : void 0
       })
     ).trim() || defaultRegion;
+    const prod = answer(
+      await dist_exports.confirm({
+        message: `Is ${name} production? (cloudhop then asks before any change)`,
+        initialValue: looksLikeProduction(name, target.label)
+      })
+    );
     defaultRegion = region;
     existing.add(name);
     aliases.push({
       name,
       source: source.id,
       target: target.id,
-      ...region && region !== source.settings.region ? { region } : {}
+      ...region && region !== source.settings.region ? { region } : {},
+      ...prod ? { prod: true } : {}
     });
   }
   return aliases;
@@ -10902,14 +11642,20 @@ async function aliasCommand(app, { positional, flags }) {
         `See the options with \`cloudhop alias ${id} --list\`.`
       );
     }
-    const name = flags.name ?? suggestAliasName(
-      target.attributes.accountName ?? target.label,
-      target.attributes.roleName ?? ""
-    );
+    const taken = new Set((await app.config()).aliases.map((a2) => a2.name));
+    const name = flags.name ?? suggestAliases(targets, id, taken).get(target.id) ?? id;
     await app.addAliases([
-      { name, source: id, target: target.id, ...flags.region ? { region: flags.region } : {} }
+      {
+        name,
+        source: id,
+        target: target.id,
+        ...flags.region ? { region: flags.region } : {},
+        ...flags.prod ? { prod: true } : {}
+      }
     ]);
-    console.log(`Alias "${name}" \u2192 ${target.label}. Try:  hop ${name}`);
+    console.log(
+      `Alias "${name}" \u2192 ${target.label}${flags.prod ? " (production)" : ""}. Try:  hop ${name}`
+    );
     return;
   }
   if (scripted) {
@@ -10922,65 +11668,803 @@ async function aliasCommand(app, { positional, flags }) {
   dist_exports.outro(`Created ${aliases.length} alias(es).`);
 }
 
-// src/commands/manage.ts
-function printReport(report) {
-  const changes = [
-    `${report.targets.length} available`,
-    report.added.length ? `${report.added.length} new` : "",
-    report.removed.length ? `${report.removed.length} removed` : ""
-  ].filter(Boolean);
-  dist_exports.log.success(`${report.sourceId}: ${changes.join(", ")}.`);
-  for (const t2 of report.added) dist_exports.log.message(`  + ${t2.label}`);
-  for (const t2 of report.removed) dist_exports.log.message(`  - ${t2.label}`);
-  if (report.orphanedAliases.length) {
-    dist_exports.log.warn(
-      `No longer available: ${report.orphanedAliases.join(", ")}. Remove them with \`cloudhop rm <alias>\`.`
-    );
-  }
-}
-async function syncCommand(app, sourceId) {
-  const ids = sourceId ? [sourceId] : (await app.config()).sources.map((s) => s.id);
-  if (ids.length === 0) {
-    dist_exports.log.info("No sources yet. Run `cloudhop add`.");
-    return;
-  }
-  for (const id of ids) {
-    await app.ensureSession(id);
-    printReport(await app.syncSource(id));
+// src/commands/agent.ts
+import { homedir as homedir2 } from "os";
+import { isAbsolute, relative } from "path";
+
+// ../assistants/src/installer.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2 } from "fs";
+import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, rmdir, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join4 } from "path";
+
+// ../assistants/src/assets/skill.md
+var skill_default = "---\nname: cloudhop\ndescription: Run AWS CLI commands and other cloud tools as a specific account, role and region through cloudhop aliases (the `hop` and `cloudhop` commands). Use whenever the user asks to do anything in their AWS accounts, inspect or change cloud resources, run aws/terraform/cdk against an account, list their cloud accounts or aliases, or mentions hop or cloudhop.\n---\n\n# Working with cloud accounts through cloudhop\n\nThe user manages their cloud access with **cloudhop**. Each **alias** (for\nexample `acme-dev`) points to one account, one role and one region. cloudhop\nsigns the user in through their browser only when a session has expired. There\nare no access keys: never ask for, create, print or store credentials.\n\n## 1. Pick the alias with the user, every time\n\nBefore the first cloud operation in a conversation:\n\n1. List the aliases. Use the `list_aliases` tool if the cloudhop MCP server is\n   connected; otherwise run `cloudhop ls --json`.\n2. Show the user the options (alias, account / role, region) and **ask which\n   one to use**. Don't guess, even if one name looks right, and don't pick\n   one just because there is only one: confirm it.\n3. Use that alias for the rest of the conversation. Ask again if the user\n   moves to another environment, account or task.\n\n## 2. Check the session before running anything\n\nRun `cloudhop status <alias> --json` (or the `alias_status` tool) and read\n`next`:\n\n| `next`            | Meaning                                      | What to do                                                                                                                                        |\n| ----------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `ready`           | Session valid                                | Go ahead                                                                                                                                          |\n| `silent-renewal`  | Expired but renewable without the user       | Go ahead; cloudhop renews it                                                                                                                      |\n| `browser-sign-in` | The user must sign in                        | Tell the user their browser will open and they need to approve, then run `cloudhop login <source>` (or the `login` tool) and wait up to 5 minutes |\n| `unknown`         | Managed by the cloud CLI (personal accounts) | Go ahead; if it fails, run `cloudhop login <source>`                                                                                              |\n\nDon't start several cloud commands in parallel while a sign-in is pending.\n\n## 3. Run commands through the alias\n\n- **AWS CLI**: `hop <alias> <aws arguments>`, e.g. `hop acme-dev s3 ls`.\n  It is exactly `aws <arguments>` with the alias' account, role and region.\n  Never add `--profile`. Use `--region <r>` only to override the region once.\n  With the MCP server, use `run_cloud_cli` with `args` (no program name).\n- **Who am I**: `hop <alias>` with no arguments (or the `whoami` tool).\n- **The same command in several aliases** (after the user chose them):\n  `cloudhop each a,b,c --yes -- <aws arguments>`; add `--json` to parse the\n  results.\n- **The AWS web console**: `cloudhop console <alias> [service]` opens it in\n  the user's browser, already signed in. Never try to print or fetch its URL.\n- **Other tools** (Terraform, CDK, SDK scripts):\n  `cloudhop exec <alias> -- <command>`, e.g.\n  `cloudhop exec acme-dev -- terraform plan`.\n- Prefer `--output json` and `--query` to keep output small.\n- Don't export `AWS_PROFILE`, `AWS_ACCESS_KEY_ID` or similar variables, don't\n  run commands that print credentials (`env`, `printenv`, `export-credentials`)\n  and never edit `~/.aws/config`, `~/.aws/credentials` or cloudhop's own files.\n\n## 4. Confirm before changing anything\n\n- Read-only commands (`list`, `describe`, `get`, `s3 ls`, `logs tail`) can run\n  once the user has chosen the alias.\n- Before any command that **creates, changes, deletes or costs money**, show\n  the alias, account, region and the exact command, and wait for the user's\n  explicit \"yes\". One confirmation covers one command, not a series.\n- **Production aliases** have `\"prod\": true` in `cloudhop ls --json` (and\n  `PROD` in `cloudhop ls`). Confirm every change there and suggest a dry run\n  (`--dryrun`, `terraform plan`) first. cloudhop enforces it: without a\n  terminal, `hop`/`cloudhop exec` refuse changes on production with\n  `PROD_CONFIRMATION_REQUIRED`. After the user explicitly approves the exact\n  command, rerun it with `CLOUDHOP_CONFIRM_PROD=1` in that command's\n  environment (with MCP: `confirm_production: true`). Never set it on your own.\n- Treat aliases or accounts that merely look like production (`prd`, `live`)\n  the same way, even if they are not marked.\n- Don't change cloudhop itself (`cloudhop add`, `rm`, `region`, `login` for\n  another source) unless the user asked for it.\n\n## 5. When something goes wrong\n\n| You see                                             | Do this                                                                        |\n| --------------------------------------------------- | ------------------------------------------------------------------------------ |\n| \"Opening your browser to log in\"                    | Tell the user to approve in the browser; the command continues by itself       |\n| The command was cut off while waiting for a sign-in | Run `cloudhop login <source>` with a timeout of at least 5 minutes, then retry |\n| `LOGIN_REQUIRED`                                    | Same as `browser-sign-in` above                                                |\n| No browser on this machine (remote, container)      | Run `cloudhop login <source> --device-code` and show the user the URL and code |\n| `Alias \"x\" not found`                               | Run `cloudhop ls` and ask the user again                                       |\n| AWS CLI missing or too old                          | Suggest `cloudhop doctor`; don't install anything without asking               |\n| `AccessDenied`                                      | The role lacks permission: tell the user; don't try other aliases on your own  |\n\nMore: https://dayepesb.github.io/cloudhop/guides/hop-like-aws/\n";
+
+// ../assistants/src/targets.ts
+import { join as join3 } from "path";
+var ASSISTANT_IDS = [
+  "claude",
+  "kiro",
+  "copilot",
+  "cursor",
+  "codex"
+];
+var SKILL_NAME = "cloudhop";
+var MCP_COMMAND = "cloudhop";
+var MCP_ARGS = ["mcp"];
+var ASSISTANTS = {
+  claude: {
+    id: "claude",
+    name: "Claude Code",
+    markers: ({ home }) => [join3(home, ".claude")],
+    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".claude", "skills", SKILL_NAME),
+    mcp: (scope, { project }) => scope === "project" ? { kind: "json", file: join3(project, ".mcp.json"), key: "mcpServers", withType: false } : {
+      kind: "cli",
+      command: "claude",
+      add: ["mcp", "add", "--scope", "user", "cloudhop", "--", MCP_COMMAND, ...MCP_ARGS],
+      remove: ["mcp", "remove", "--scope", "user", "cloudhop"],
+      manual: "claude mcp add --scope user cloudhop -- cloudhop mcp"
+    }
+  },
+  kiro: {
+    id: "kiro",
+    name: "Kiro",
+    markers: ({ home }) => [join3(home, ".kiro")],
+    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".kiro", "skills", SKILL_NAME),
+    mcp: (scope, { home, project }) => ({
+      kind: "json",
+      file: join3(scope === "user" ? home : project, ".kiro", "settings", "mcp.json"),
+      key: "mcpServers",
+      withType: false
+    })
+  },
+  copilot: {
+    id: "copilot",
+    name: "GitHub Copilot (VS Code)",
+    markers: ({ home }) => [join3(home, ".copilot"), join3(home, ".vscode")],
+    skillDir: (scope, { home, project }) => scope === "user" ? join3(home, ".copilot", "skills", SKILL_NAME) : join3(project, ".github", "skills", SKILL_NAME),
+    mcp: (scope, { project }) => scope === "project" ? {
+      kind: "json",
+      file: join3(project, ".vscode", "mcp.json"),
+      key: "servers",
+      withType: true
+    } : {
+      kind: "cli",
+      command: "code",
+      add: [
+        "--add-mcp",
+        JSON.stringify({
+          name: "cloudhop",
+          type: "stdio",
+          command: MCP_COMMAND,
+          args: MCP_ARGS
+        })
+      ],
+      remove: void 0,
+      manual: 'VS Code \u2192 "MCP: Add Server" \u2192 stdio \u2192 command `cloudhop mcp`'
+    }
+  },
+  cursor: {
+    id: "cursor",
+    name: "Cursor",
+    markers: ({ home }) => [join3(home, ".cursor")],
+    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".cursor", "skills", SKILL_NAME),
+    mcp: (scope, { home, project }) => ({
+      kind: "json",
+      file: join3(scope === "user" ? home : project, ".cursor", "mcp.json"),
+      key: "mcpServers",
+      withType: true
+    })
+  },
+  codex: {
+    id: "codex",
+    name: "Codex",
+    markers: ({ home }) => [join3(home, ".codex"), join3(home, ".agents")],
+    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".agents", "skills", SKILL_NAME),
+    mcp: (scope, { home, project }) => ({
+      kind: "toml",
+      file: join3(scope === "user" ? home : project, ".codex", "config.toml")
+    })
   }
+};
+
+// ../assistants/src/installer.ts
+var sha = (text4) => createHash("sha256").update(text4).digest("hex");
+async function writeAtomic(file, content) {
+  await mkdir2(dirname2(file), { recursive: true });
+  const tmp = `${file}.cloudhop-${process.pid}.tmp`;
+  await writeFile2(tmp, content);
+  await rename2(tmp, file);
 }
-async function loginCommand(app, sourceId) {
-  const { sources } = await app.config();
-  const id = sourceId ?? answer(
-    await dist_exports.select({
-      message: "Log in to which source?",
-      options: sources.map((s) => ({ value: s.id, label: s.id }))
-    })
-  );
-  printReport(await app.login(id));
+async function removeFileAndEmptyDir(file) {
+  await rm2(file, { force: true });
+  await rmdir(dirname2(file)).catch(() => {
+  });
 }
-var SESSION_LABEL = {
-  valid: paint("green", "\u25CF session valid"),
-  refreshable: paint("yellow", "\u25D0 renews automatically on next use"),
-  expired: paint("red", "\u25CB expired, opens the browser on next use"),
-  unknown: paint("dim", "\xB7 session managed by the cloud CLI")
-};
-async function listCommand(app, sourceId) {
-  const config = await app.config();
-  if (config.sources.length === 0) {
-    console.log("Nothing here yet. Run `cloudhop setup` to get started.");
-    return;
+var readText = (file) => readFile2(file, "utf8").catch(() => void 0);
+var AssistantsInstaller = class {
+  constructor(options) {
+    this.options = options;
   }
-  const sources = sourceId ? config.sources.filter((s) => s.id === sourceId) : config.sources;
-  if (sources.length === 0) {
-    throw new CloudhopError(
-      "SOURCE_NOT_FOUND",
-      `Source "${sourceId}" not found.`,
-      `Sources: ${config.sources.map((s) => s.id).join(", ")}.`
-    );
+  options;
+  /** The skill as written to disk: the bundled content plus a footer naming the version. */
+  get skillContent() {
+    return `${skill_default.replace(/\r\n/g, "\n").trimEnd()}
+
+<!-- Installed by cloudhop ${this.options.cloudhopVersion}. Refresh with \`cloudhop agent update\`; edits here are kept. -->
+`;
   }
-  const aliases = await app.listAliases();
-  const nameWidth = Math.max(5, ...aliases.map((a2) => a2.alias.name.length)) + 2;
+  /** Assistants that look installed on this machine. */
+  detect() {
+    const { places } = this.options;
+    return ASSISTANT_IDS.filter((id) => ASSISTANTS[id].markers(places).some((p3) => existsSync2(p3)));
+  }
+  async status(scope) {
+    const detected = new Set(this.detect());
+    const manifest = await this.readManifest();
+    return Promise.all(
+      ASSISTANT_IDS.map(async (id) => {
+        const assistant = ASSISTANTS[id];
+        const skillPath = join4(assistant.skillDir(scope, this.options.places), "SKILL.md");
+        const entry = manifest.find((e) => e.skillFile === skillPath);
+        return {
+          assistant: id,
+          name: assistant.name,
+          scope,
+          detected: detected.has(id),
+          skill: await this.skillState(skillPath, entry),
+          skillPath,
+          mcp: await this.mcpState(assistant.mcp(scope, this.options.places))
+        };
+      })
+    );
+  }
+  async install(ids, scope, { mcp = true } = {}) {
+    const results = [];
+    const manifest = await this.readManifest();
+    for (const id of ids) {
+      const assistant = ASSISTANTS[id];
+      const skillPath = join4(assistant.skillDir(scope, this.options.places), "SKILL.md");
+      const content = this.skillContent;
+      await writeAtomic(skillPath, content);
+      const kept = manifest.filter((e) => e.skillFile !== skillPath);
+      kept.push({
+        assistant: id,
+        scope,
+        skillFile: skillPath,
+        hash: sha(content),
+        cloudhopVersion: this.options.cloudhopVersion
+      });
+      manifest.splice(0, manifest.length, ...kept);
+      const target = assistant.mcp(scope, this.options.places);
+      const outcome = mcp ? await this.addMcp(target) : { mcp: "skipped" };
+      results.push({ assistant: id, name: assistant.name, scope, skillPath, ...outcome });
+    }
+    await this.writeManifest(manifest);
+    return results;
+  }
+  async remove(ids, scope) {
+    const results = [];
+    let manifest = await this.readManifest();
+    for (const id of ids) {
+      const assistant = ASSISTANTS[id];
+      const dir = assistant.skillDir(scope, this.options.places);
+      const skillPath = join4(dir, "SKILL.md");
+      await rm2(dir, { recursive: true, force: true });
+      await rmdir(dirname2(dir)).then(() => rmdir(dirname2(dirname2(dir)))).catch(() => {
+      });
+      manifest = manifest.filter((e) => e.skillFile !== skillPath);
+      const outcome = await this.removeMcp(assistant.mcp(scope, this.options.places));
+      results.push({ assistant: id, name: assistant.name, scope, skillPath, ...outcome });
+    }
+    await this.writeManifest(manifest);
+    return results;
+  }
+  /**
+   * Refreshes skills written by an older cloudhop. Copies the user edited are
+   * left alone unless `force`. Cheap when there is nothing to do: one small read.
+   */
+  async update({ force = false } = {}) {
+    const manifest = await this.readManifest();
+    const content = this.skillContent;
+    const target = sha(content);
+    const updated = [];
+    const edited = [];
+    let changed = false;
+    for (const entry of manifest) {
+      if (entry.hash === target) continue;
+      const onDisk = await readText(entry.skillFile);
+      if (onDisk === void 0) continue;
+      if (sha(onDisk) !== entry.hash && !force) {
+        edited.push(entry.skillFile);
+        continue;
+      }
+      await writeAtomic(entry.skillFile, content);
+      entry.hash = target;
+      entry.cloudhopVersion = this.options.cloudhopVersion;
+      updated.push(entry.skillFile);
+      changed = true;
+    }
+    if (changed) await this.writeManifest(manifest);
+    return { updated, edited };
+  }
+  // ───────────── skill state ─────────────
+  async skillState(path2, entry) {
+    const onDisk = await readText(path2);
+    if (onDisk === void 0) return "missing";
+    if (onDisk === this.skillContent) return "current";
+    if (entry && sha(onDisk) !== entry.hash) return "modified";
+    return "outdated";
+  }
+  // ───────────── MCP registration ─────────────
+  async mcpState(target) {
+    if (target.kind === "cli") return "unknown";
+    const text4 = await readText(target.file);
+    if (text4 === void 0) return "missing";
+    if (target.kind === "toml")
+      return /^\[mcp_servers\.cloudhop\]/m.test(text4) ? "registered" : "missing";
+    try {
+      const servers = JSON.parse(text4)[target.key];
+      return servers?.cloudhop ? "registered" : "missing";
+    } catch {
+      return "unknown";
+    }
+  }
+  async addMcp(target) {
+    switch (target.kind) {
+      case "json": {
+        const config = await this.readJsonConfig(target.file);
+        config[target.key] ??= {};
+        const servers = config[target.key];
+        const entry = {
+          ...target.withType ? { type: "stdio" } : {},
+          command: MCP_COMMAND,
+          args: MCP_ARGS
+        };
+        if (JSON.stringify(servers.cloudhop) === JSON.stringify(entry)) return { mcp: "already" };
+        servers.cloudhop = entry;
+        await writeAtomic(target.file, `${JSON.stringify(config, null, 2)}
+`);
+        return { mcp: "added" };
+      }
+      case "toml": {
+        const text4 = await readText(target.file) ?? "";
+        if (/^\[mcp_servers\.cloudhop\]/m.test(text4)) return { mcp: "already" };
+        const block2 = `${TOML_MARK}
+[mcp_servers.cloudhop]
+command = "${MCP_COMMAND}"
+args = [${MCP_ARGS.map((a2) => `"${a2}"`).join(", ")}]
+`;
+        await writeAtomic(
+          target.file,
+          `${text4}${text4 && !text4.endsWith("\n") ? "\n" : ""}${text4 ? "\n" : ""}${block2}`
+        );
+        return { mcp: "added" };
+      }
+      case "cli": {
+        if (!(await this.options.runner.probe(target.command)).installed) {
+          return { mcp: "manual", mcpManual: target.manual };
+        }
+        const result = await this.options.runner.capture(target.command, target.add);
+        if (result.exitCode === 0) return { mcp: "added" };
+        if (/already exists/i.test(`${result.stdout}${result.stderr}`)) return { mcp: "already" };
+        return { mcp: "manual", mcpManual: target.manual };
+      }
+    }
+  }
+  async removeMcp(target) {
+    switch (target.kind) {
+      case "json": {
+        const text4 = await readText(target.file);
+        if (text4 === void 0) return { mcp: "already" };
+        const config = await this.readJsonConfig(target.file);
+        const servers = config[target.key];
+        if (!servers?.cloudhop) return { mcp: "already" };
+        delete servers.cloudhop;
+        const onlyEmptyKey = Object.keys(servers).length === 0 && Object.keys(config).length === 1;
+        if (onlyEmptyKey) await removeFileAndEmptyDir(target.file);
+        else await writeAtomic(target.file, `${JSON.stringify(config, null, 2)}
+`);
+        return { mcp: "removed" };
+      }
+      case "toml": {
+        const text4 = await readText(target.file);
+        if (!text4 || !/^\[mcp_servers\.cloudhop\]/m.test(text4)) return { mcp: "already" };
+        const cleaned = text4.replace(new RegExp(`${escapeRegExp(TOML_MARK)}\\n`, "g"), "").replace(/^\[mcp_servers\.cloudhop\]\n(?:(?!\[)[^\n]*\n?)*/m, "").replace(/\n{3,}/g, "\n\n");
+        if (cleaned.trim()) await writeAtomic(target.file, `${cleaned.trimEnd()}
+`);
+        else await removeFileAndEmptyDir(target.file);
+        return { mcp: "removed" };
+      }
+      case "cli": {
+        if (!target.remove || !(await this.options.runner.probe(target.command)).installed) {
+          return {
+            mcp: "manual",
+            mcpManual: `Remove the "cloudhop" MCP server in ${target.command === "code" ? "VS Code (MCP: List Servers)" : target.command}.`
+          };
+        }
+        await this.options.runner.capture(target.command, target.remove);
+        return { mcp: "removed" };
+      }
+    }
+  }
+  async readJsonConfig(file) {
+    const text4 = await readText(file);
+    if (text4 === void 0 || !text4.trim()) return {};
+    try {
+      const value = JSON.parse(text4);
+      if (value && typeof value === "object" && !Array.isArray(value))
+        return value;
+    } catch {
+    }
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `${file} isn't plain JSON (it may have comments), so cloudhop won't rewrite it.`,
+      `Add the server by hand: "cloudhop": { "command": "cloudhop", "args": ["mcp"] }, or rerun with --no-mcp.`
+    );
+  }
+  // ───────────── manifest ─────────────
+  get manifestPath() {
+    return join4(this.options.configDir, "assistants.json");
+  }
+  async readManifest() {
+    const text4 = await readText(this.manifestPath);
+    if (!text4) return [];
+    try {
+      const parsed = JSON.parse(text4);
+      return Array.isArray(parsed.installs) ? parsed.installs : [];
+    } catch {
+      return [];
+    }
+  }
+  async writeManifest(installs) {
+    await writeAtomic(this.manifestPath, `${JSON.stringify({ installs }, null, 2)}
+`);
+  }
+};
+var TOML_MARK = "# Added by cloudhop (`cloudhop agent remove` deletes it)";
+var escapeRegExp = (text4) => text4.replace(/[.*+?^${}()|[\]\\`]/g, "\\$&");
+
+// src/commands/agent.ts
+var MCP_TEXT = {
+  added: paint("green", "MCP server added"),
+  already: "MCP server already there",
+  removed: "MCP server removed",
+  manual: paint("yellow", "MCP server: add it by hand"),
+  skipped: paint("dim", "MCP server skipped")
+};
+var tilde = (path2) => {
+  const inProject = relative(process.cwd(), path2);
+  if (!inProject.startsWith("..") && !isAbsolute(inProject)) return inProject;
+  return path2.replace(homedir2(), "~");
+};
+function parseTools(value, fallback) {
+  if (!value) return fallback;
+  const ids = value.split(",").map((v) => v.trim().toLowerCase());
+  const unknown = ids.filter((id) => !ASSISTANT_IDS.includes(id));
+  if (unknown.length) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `Unknown assistant: ${unknown.join(", ")}.`,
+      `Use any of: ${ASSISTANT_IDS.join(", ")}.`
+    );
+  }
+  return ids;
+}
+function parseScope(value) {
+  if (value === void 0) return void 0;
+  if (value === "user" || value === "project") return value;
+  throw new CloudhopError("INVALID_NAME", '--scope must be "user" or "project".');
+}
+function printResults(results) {
+  for (const r2 of results) {
+    console.log(`${paint("green", "\u2714")} ${bold(r2.name)}`);
+    console.log(`  skill  ${tilde(r2.skillPath)}`);
+    console.log(`  ${MCP_TEXT[r2.mcp]}${r2.mcpManual ? `: ${r2.mcpManual}` : ""}`);
+  }
+}
+async function agentCommand(installer, args) {
+  const { positional, flags } = parseArgs(args);
+  const action = positional[0] ?? "status";
+  const scopeFlag = parseScope(flags.scope);
+  switch (action) {
+    case "status": {
+      for (const scope of scopeFlag ? [scopeFlag] : ["user", "project"]) {
+        console.log(
+          bold(
+            scope === "user" ? "For you (all projects)" : `This project (${tilde(process.cwd())})`
+          )
+        );
+        for (const s of await installer.status(scope)) {
+          const skill = s.skill === "current" ? paint("green", "\u25CF skill up to date") : s.skill === "outdated" ? paint("yellow", "\u25D0 skill outdated (run `cloudhop agent update`)") : s.skill === "modified" ? paint(
+            "yellow",
+            "\u25D0 skill edited by you (`cloudhop agent update --force` replaces it)"
+          ) : paint("dim", "\u25CB no skill");
+          const mcp = s.mcp === "registered" ? ", MCP on" : s.mcp === "unknown" ? ", MCP: check in the app" : "";
+          const seen = s.detected ? "" : paint("dim", " (not detected)");
+          console.log(`  ${s.name.padEnd(26)} ${skill}${s.skill === "missing" ? "" : mcp}${seen}`);
+        }
+      }
+      return;
+    }
+    case "install": {
+      const detected = installer.detect();
+      let tools = parseTools(flags.tools, detected);
+      let scope = scopeFlag ?? "user";
+      let mcp = !flags.noMcp;
+      if (!flags.tools && interactive() && !flags.yes) {
+        dist_exports.intro("cloudhop agent install");
+        dist_exports.note(
+          "Installs a skill that teaches your AI assistant to ask which cloudhop alias to use,\nrun commands with hop, and confirm before changing anything. Optionally also\nregisters the cloudhop MCP server (tools to list aliases, check sessions and run the CLI).",
+          "Teach your AI assistant cloudhop"
+        );
+        tools = answer(
+          await dist_exports.multiselect({
+            message: "Which assistants do you use?",
+            options: ASSISTANT_IDS.map((id) => ({
+              value: id,
+              label: ASSISTANTS[id].name,
+              ...detected.includes(id) ? { hint: "detected" } : {}
+            })),
+            initialValues: detected,
+            required: true
+          })
+        );
+        if (!scopeFlag) {
+          scope = answer(
+            await dist_exports.select({
+              message: "Where should it go?",
+              options: [
+                { value: "user", label: "For me, in every project", hint: "your home folder" },
+                {
+                  value: "project",
+                  label: "Only this project",
+                  hint: "commit it and your team gets it too"
+                }
+              ]
+            })
+          );
+        }
+        if (!flags.noMcp) {
+          mcp = answer(
+            await dist_exports.confirm({
+              message: "Also register the cloudhop MCP server?",
+              initialValue: true
+            })
+          );
+        }
+      }
+      if (tools.length === 0) {
+        throw new CloudhopError(
+          "INVALID_NAME",
+          "No AI assistant detected.",
+          `Choose them with --tools ${ASSISTANT_IDS.join(",")}.`
+        );
+      }
+      printResults(await installer.install(tools, scope, { mcp }));
+      console.log(
+        paint("dim", "\nStart a new chat (or restart the assistant) so it picks up the skill.")
+      );
+      return;
+    }
+    case "update": {
+      const { updated, edited } = await installer.update({ force: Boolean(flags.force) });
+      for (const file of updated) console.log(`${paint("green", "\u2714")} updated ${tilde(file)}`);
+      for (const file of edited)
+        console.log(
+          `${paint("yellow", "\u25D0")} kept your edits in ${tilde(file)} (use --force to replace)`
+        );
+      if (!updated.length && !edited.length) console.log("Every installed skill is up to date.");
+      return;
+    }
+    case "remove": {
+      const scope = scopeFlag ?? "user";
+      const statuses = await installer.status(scope);
+      const installed = statuses.filter((s) => s.skill !== "missing" || s.mcp === "registered").map((s) => s.assistant);
+      const tools = parseTools(flags.tools, installed);
+      if (tools.length === 0) {
+        console.log(`Nothing to remove for scope "${scope}".`);
+        return;
+      }
+      printResults(await installer.remove(tools, scope));
+      return;
+    }
+    default:
+      throw new CloudhopError(
+        "INVALID_NAME",
+        `Unknown action "${action}".`,
+        "Use: cloudhop agent [status | install | update | remove]"
+      );
+  }
+}
+
+// src/picker.ts
+async function pickAlias(app, message = "Which alias?") {
+  if (!interactive()) {
+    throw new CloudhopError(
+      "NOT_INTERACTIVE",
+      "Say which alias to use.",
+      "See them with `cloudhop ls`."
+    );
+  }
+  const { aliases } = await app.overview();
+  if (aliases.length === 0) {
+    throw new CloudhopError(
+      "ALIAS_NOT_FOUND",
+      "No aliases yet.",
+      "Create one with `cloudhop alias <source>`."
+    );
+  }
+  const haystack = new Map(
+    aliases.map((a2) => [
+      a2.name,
+      `${a2.name} ${a2.label ?? a2.target} ${a2.region ?? ""} ${a2.source}`.toLowerCase()
+    ])
+  );
+  return answer(
+    await dist_exports.autocomplete({
+      message: `${message} ${paint("dim", "(type to filter)")}`,
+      maxItems: 12,
+      options: aliases.map((a2) => ({
+        value: a2.name,
+        label: a2.prod ? `${a2.name} ${paint("red", "PROD")}` : a2.name,
+        hint: `${a2.label ?? a2.target} \xB7 ${a2.region ?? "no region"}`
+      })),
+      filter: (search, option) => {
+        const text4 = haystack.get(option.value) ?? "";
+        return search.toLowerCase().split(/\s+/).filter(Boolean).every((word) => text4.includes(word));
+      }
+    })
+  );
+}
+
+// src/commands/console.ts
+var HOW = {
+  "signed-in": "signed in",
+  portal: "through the SSO portal (AWS did not accept a direct sign-in)",
+  "sign-in-page": "at the sign-in page (sign in with your console user)"
+};
+async function consoleCommand(app, args) {
+  const { positional, flags } = parseArgs(args);
+  const alias = positional[0] ?? await pickAlias(app, "Open the console as");
+  const service = positional[1];
+  const via = await app.openConsole(alias, {
+    ...service ? { service } : {},
+    ...flags.region ? { region: flags.region } : {}
+  });
+  notify(`Opened the ${service ? `${service} ` : ""}console for ${alias}, ${HOW[via]}.`);
+}
+
+// src/commands/each.ts
+function matcher(selector) {
+  const regex = /^\/(.+)\/([a-z]*)$/.exec(selector);
+  if (regex) {
+    try {
+      const re = new RegExp(regex[1], regex[2]);
+      return (name) => re.test(name);
+    } catch {
+      throw new CloudhopError("INVALID_NAME", `Invalid regular expression: ${selector}`);
+    }
+  }
+  if (/[*?]/.test(selector)) {
+    const escaped = selector.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+    const re = new RegExp(`^${escaped}$`);
+    return (name) => re.test(name);
+  }
+  return (name) => name === selector;
+}
+function selectAliases(aliases, selectors, filters) {
+  const patterns = selectors.flatMap((s) => s.split(",")).map((s) => s.trim()).filter(Boolean);
+  const tests = patterns.map(matcher);
+  for (const [i2, pattern] of patterns.entries()) {
+    const plain = !/[*?]/.test(pattern) && !pattern.startsWith("/");
+    if (plain && !aliases.some((a2) => tests[i2]?.(a2.name))) {
+      throw new CloudhopError(
+        "ALIAS_NOT_FOUND",
+        `Alias "${pattern}" not found.`,
+        "See your aliases with `cloudhop ls`."
+      );
+    }
+  }
+  return aliases.filter(
+    (a2) => (tests.length === 0 || tests.some((t2) => t2(a2.name))) && (filters.source === void 0 || a2.source === filters.source) && (filters.prod === void 0 || a2.prod === filters.prod)
+  );
+}
+async function mapLimit(items, limit, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const i2 = next++;
+      results[i2] = await fn(items[i2]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, worker));
+  return results;
+}
+async function eachCommand(app, args) {
+  const separator = args.indexOf("--");
+  if (separator === -1 || separator === args.length - 1) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      "Usage: cloudhop each <alias|list|pattern|/regex/...> [--source <s>] [--prod|--no-prod] -- <command>",
+      "Example: cloudhop each 'creci-*' -- s3 ls"
+    );
+  }
+  const { positional, flags } = parseArgs(args.slice(0, separator));
+  const cliArgs = args.slice(separator + 1);
+  if (positional.length === 0 && !flags.source && !flags.prod && !flags.noProd) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      'Say which aliases: names, a pattern like "globex-*", /regex/, --source or --prod.'
+    );
+  }
+  const prodFilter = flags.prod ? true : flags.noProd ? false : void 0;
+  const { aliases } = await app.overview();
+  const selected = selectAliases(aliases, positional, {
+    ...flags.source ? { source: flags.source } : {},
+    ...prodFilter !== void 0 ? { prod: prodFilter } : {}
+  });
+  if (selected.length === 0)
+    throw new CloudhopError("ALIAS_NOT_FOUND", "No alias matches that selection.");
+  const command = `aws ${cliArgs.join(" ")}`;
+  const width = Math.max(...selected.map((a2) => a2.name.length)) + 2;
+  const listing = selected.map(
+    (a2) => `  ${a2.name.padEnd(width)}${(a2.region ?? "-").padEnd(12)}${a2.label ?? a2.target}${a2.prod ? `  ${paint("red", "PROD")}` : ""}`
+  ).join("\n");
+  const risky = [];
+  for (const a2 of selected)
+    if (await app.needsProductionConfirmation(a2.name, cliArgs)) risky.push(a2.name);
+  const tty = interactive();
+  if (!flags.json)
+    process.stderr.write(
+      `${bold(`${selected.length} alias(es)`)} will run ${paint("sky", command)}
+${listing}
+`
+    );
+  if (!flags.yes) {
+    if (!tty)
+      throw new CloudhopError(
+        "NOT_INTERACTIVE",
+        "Confirm with --yes to run in several aliases without a terminal."
+      );
+    if (!answer(
+      await dist_exports.confirm({
+        message: `Run it in these ${selected.length} alias(es)?`,
+        initialValue: false
+      })
+    ))
+      return 130;
+  }
+  if (risky.length > 0 && process.env.CLOUDHOP_CONFIRM_PROD !== "1") {
+    if (!tty) {
+      throw new CloudhopError(
+        "PROD_CONFIRMATION_REQUIRED",
+        `This may change resources in production: ${risky.join(", ")}.`,
+        "Run it in a terminal to confirm, or set CLOUDHOP_CONFIRM_PROD=1 once a person has approved it."
+      );
+    }
+    dist_exports.log.warn(
+      `${paint("red", bold("PRODUCTION"))} ${risky.join(", ")}: this may change resources.`
+    );
+    if (!answer(await dist_exports.confirm({ message: "Also run it in production?", initialValue: false })))
+      return 130;
+  }
+  for (const source of new Set(selected.map((a2) => a2.source))) {
+    await app.ensureSession(source, { interactive: tty });
+  }
+  const parallel = Math.max(1, Math.min(16, Number(flags.parallel) || 4));
+  const outcomes = await mapLimit(selected, parallel, async (a2) => {
+    try {
+      const r2 = await app.captureAsAlias(a2.name, cliArgs);
+      const outcome = { alias: a2.name, exitCode: r2.exitCode, stdout: r2.stdout, stderr: r2.stderr };
+      if (!flags.json) printOutcome(outcome, width);
+      return outcome;
+    } catch (error) {
+      const outcome = { alias: a2.name, exitCode: 1, stdout: "", stderr: error.message };
+      if (!flags.json) printOutcome(outcome, width);
+      return outcome;
+    }
+  });
+  const failed = outcomes.filter((o2) => o2.exitCode !== 0);
+  if (flags.json) {
+    console.log(JSON.stringify({ version: 1, command: cliArgs, results: outcomes }, null, 2));
+  } else {
+    const summary = `${outcomes.length - failed.length} ok${failed.length ? `, ${failed.length} failed: ${failed.map((f2) => f2.alias).join(", ")}` : ""}`;
+    process.stderr.write(`${failed.length ? paint("red", summary) : paint("green", summary)}
+`);
+  }
+  return failed.length ? 1 : 0;
+}
+function printOutcome({ alias, exitCode, stdout: stdout2, stderr }, width) {
+  const tag = paint(exitCode === 0 ? "sky" : "red", `[${alias}]`.padEnd(width + 2));
+  for (const line of stdout2.replace(/\n$/, "").split("\n"))
+    if (line) process.stdout.write(`${tag} ${line}
+`);
+  for (const line of stderr.replace(/\n$/, "").split("\n"))
+    if (line) process.stderr.write(`${tag} ${paint("dim", line)}
+`);
+  if (exitCode !== 0) process.stderr.write(`${tag} ${paint("red", `exit ${exitCode}`)}
+`);
+}
+
+// src/commands/manage.ts
+function printReport(report) {
+  const changes = [
+    `${report.targets.length} available`,
+    report.added.length ? `${report.added.length} new` : "",
+    report.removed.length ? `${report.removed.length} removed` : ""
+  ].filter(Boolean);
+  dist_exports.log.success(`${report.sourceId}: ${changes.join(", ")}.`);
+  for (const t2 of report.added) dist_exports.log.message(`  + ${t2.label}`);
+  for (const t2 of report.removed) dist_exports.log.message(`  - ${t2.label}`);
+  if (report.orphanedAliases.length) {
+    dist_exports.log.warn(
+      `No longer available: ${report.orphanedAliases.join(", ")}. Remove them with \`cloudhop rm <alias>\`.`
+    );
+  }
+}
+async function syncCommand(app, sourceId) {
+  const ids = sourceId ? [sourceId] : (await app.config()).sources.map((s) => s.id);
+  if (ids.length === 0) {
+    dist_exports.log.info("No sources yet. Run `cloudhop add`.");
+    return;
+  }
+  for (const id of ids) {
+    await app.ensureSession(id);
+    printReport(await app.syncSource(id));
+  }
+}
+async function loginCommand(app, sourceId) {
+  const { sources } = await app.config();
+  const id = sourceId ?? answer(
+    await dist_exports.select({
+      message: "Log in to which source?",
+      options: sources.map((s) => ({ value: s.id, label: s.id }))
+    })
+  );
+  printReport(await app.login(id));
+}
+var SESSION_LABEL = {
+  valid: paint("green", "\u25CF session valid"),
+  refreshable: paint("yellow", "\u25D0 renews automatically on next use"),
+  expired: paint("red", "\u25CB expired, opens the browser on next use"),
+  unknown: paint("dim", "\xB7 session managed by the cloud CLI")
+};
+var JSON_VERSION = 1;
+var printJson = (value) => console.log(JSON.stringify({ version: JSON_VERSION, ...value }, null, 2));
+async function listCommand(app, args = []) {
+  const { positional, flags } = parseArgs(args);
+  const sourceId = positional[0];
+  if (flags.json) {
+    const overview = await app.overview();
+    if (sourceId && !overview.sources.some((s) => s.id === sourceId)) {
+      throw new CloudhopError("SOURCE_NOT_FOUND", `Source "${sourceId}" not found.`);
+    }
+    printJson(
+      sourceId ? {
+        sources: overview.sources.filter((s) => s.id === sourceId),
+        aliases: overview.aliases.filter((a2) => a2.source === sourceId)
+      } : overview
+    );
+    return;
+  }
+  const config = await app.config();
+  if (config.sources.length === 0) {
+    console.log("Nothing here yet. Run `cloudhop setup` to get started.");
+    return;
+  }
+  const sources = sourceId ? config.sources.filter((s) => s.id === sourceId) : config.sources;
+  if (sources.length === 0) {
+    throw new CloudhopError(
+      "SOURCE_NOT_FOUND",
+      `Source "${sourceId}" not found.`,
+      `Sources: ${config.sources.map((s) => s.id).join(", ")}.`
+    );
+  }
+  const aliases = await app.listAliases();
+  const nameWidth = Math.max(5, ...aliases.map((a2) => a2.alias.name.length)) + 2;
   const regionWidth = Math.max(6, ...aliases.map((a2) => (a2.region ?? "-").length)) + 2;
   for (const [index, source] of sources.entries()) {
     const provider = app.provider(source.provider);
@@ -11001,8 +12485,9 @@ async function listCommand(app, sourceId) {
     );
     for (const { alias, target, region } of own) {
       const label = target ? target.label : paint("red", `${alias.target} (no longer available)`);
+      const tag = alias.prod ? `  ${paint("red", "PROD")}` : "";
       console.log(
-        `  ${alias.name.padEnd(nameWidth)}${(region ?? "-").padEnd(regionWidth)}${label}`
+        `  ${alias.name.padEnd(nameWidth)}${(region ?? "-").padEnd(regionWidth)}${label}${tag}`
       );
     }
   }
@@ -11088,26 +12573,116 @@ async function regionCommand(app, args) {
     })
   );
   const current = await app.resolveAlias(name);
-  const validate = regionValidator(app, current.source);
+  const validate2 = regionValidator(app, current.source);
   const region = regionArg?.trim() ?? (answer(
     await dist_exports.text({
       message: `Region for ${name}`,
       placeholder: current.region,
       defaultValue: current.region,
-      validate: (v) => v?.trim() ? validate?.(v.trim()) : void 0
+      validate: (v) => v?.trim() ? validate2?.(v.trim()) : void 0
     })
   ).trim() || current.region);
-  const problem = region ? validate?.(region) : "Say which region.";
+  const problem = region ? validate2?.(region) : "Say which region.";
   if (!region || problem) throw new CloudhopError("INVALID_NAME", problem ?? "Invalid region.");
   await app.setAliasRegion(name, region);
   console.log(`${name}: ${current.region ?? "(none)"} \u2192 ${region}`);
 }
+var STATE_SHORT = {
+  valid: paint("green", "\u25CF session valid"),
+  refreshable: paint("yellow", "\u25D0 session expired, renewable"),
+  expired: paint("red", "\u25CB session expired"),
+  unknown: paint("dim", "\xB7 session")
+};
+var NEXT_TEXT = {
+  ready: "ready to run",
+  "silent-renewal": "the next command renews the session silently",
+  "browser-sign-in": "the next command opens the browser to sign in",
+  unknown: "the cloud CLI manages this session"
+};
+async function statusCommand(app, args) {
+  const { positional, flags } = parseArgs(args);
+  const name = positional[0];
+  if (name) {
+    const status = await app.aliasStatus(name);
+    if (flags.json) return printJson({ alias: status });
+    const account = status.attributes.accountId ? ` (${status.attributes.accountId})` : "";
+    console.log(
+      `${bold(paint("sky", status.name))} \u2192 ${status.label ?? status.target}${account}, ${status.region ?? "no region"}${status.prod ? `  ${paint("red", "PROD")}` : ""}`
+    );
+    console.log(`  ${STATE_SHORT[status.session]}: ${NEXT_TEXT[status.next]}`);
+    if (status.next === "browser-sign-in") {
+      console.log(paint("dim", `  Sign in now with \`cloudhop login ${status.source}\`.`));
+    }
+    if (!status.available) console.log(paint("red", "  This account/role is no longer available."));
+    return;
+  }
+  const overview = await app.overview();
+  if (flags.json) return printJson({ sources: overview.sources });
+  if (overview.sources.length === 0) {
+    console.log("Nothing here yet. Run `cloudhop setup` to get started.");
+    return;
+  }
+  for (const source of overview.sources) {
+    console.log(
+      `${bold(paint("sky", source.id))}  ${STATE_SHORT[source.session]}: ${NEXT_TEXT[source.next]}`
+    );
+  }
+}
+async function prodCommand(app, args) {
+  const { positional, flags } = parseArgs(args);
+  if (positional.length === 0) {
+    const prod = (await app.overview()).aliases.filter((a2) => a2.prod).map((a2) => a2.name);
+    console.log(
+      prod.length ? `Production aliases: ${prod.join(", ")}` : "No alias is marked as production."
+    );
+    console.log(paint("dim", "Mark one with `cloudhop prod <alias>`, unmark with `--off`."));
+    return;
+  }
+  const on = !flags.off;
+  await app.setProduction(positional, on);
+  for (const name of positional) {
+    console.log(
+      on ? `${paint("red", "PROD")} ${name}: cloudhop asks before any change.` : `${name} is no longer marked as production.`
+    );
+  }
+}
+async function renameCommand(app, args) {
+  const [from, to] = args;
+  if (!from || !to)
+    throw new CloudhopError("INVALID_NAME", "Usage: cloudhop mv <alias> <new-name>");
+  await app.renameAlias(from, to);
+  console.log(`${from} \u2192 ${to}`);
+}
 
 // src/commands/run.ts
+async function guardProduction(app, alias, args) {
+  const status = await app.aliasStatus(alias).catch(() => void 0);
+  if (!status?.prod) return;
+  const where = `${status.label ?? status.target}${status.region ? `, ${status.region}` : ""}`;
+  if (!await app.needsProductionConfirmation(alias, args)) {
+    if (process.stderr.isTTY) notify(paint("red", `${alias} is production (${where})`));
+    return;
+  }
+  if (process.env.CLOUDHOP_CONFIRM_PROD === "1") return;
+  const what = args ? `aws ${args.join(" ")}` : "this command";
+  if (!interactive()) {
+    throw new CloudhopError(
+      "PROD_CONFIRMATION_REQUIRED",
+      `${alias} is production and ${what} may change resources.`,
+      "Run it in a terminal to confirm, or set CLOUDHOP_CONFIRM_PROD=1 once a person has approved it."
+    );
+  }
+  dist_exports.log.warn(
+    `${paint("red", bold("PRODUCTION"))}  ${bold(alias)} \u2192 ${where}
+${paint("dim", "This may change resources:")} ${what}`
+  );
+  const ok = answer(await dist_exports.confirm({ message: `Run it in ${alias}?`, initialValue: false }));
+  if (!ok) throw new CloudhopError("PROD_CONFIRMATION_REQUIRED", "Cancelled: nothing ran.");
+}
 async function proxyCommand(app, alias, args) {
-  const resolved = await app.resolveAlias(alias);
-  const defaultArgs = resolved.source.provider === "aws" ? ["sts", "get-caller-identity"] : [];
-  return app.runAsAlias(alias, args.length > 0 ? args : defaultArgs);
+  const cliArgs = args.length > 0 ? args : await app.identityArgs(alias);
+  await guardProduction(app, alias, cliArgs);
+  return app.runAsAlias(alias, cliArgs);
 }
 async function execCommand(app, args) {
   const separator = args.indexOf("--");
@@ -11121,6 +12696,7 @@ async function execCommand(app, args) {
   const regionIndex = flags.indexOf("--region");
   if (regionIndex !== -1 && flags[regionIndex + 1])
     overrides.region = flags[regionIndex + 1];
+  await guardProduction(app, alias);
   const [bin, ...rest] = command;
   return app.execAsAlias(alias, bin, rest, overrides);
 }
@@ -11154,7 +12730,7 @@ async function offerInstall(app, entry) {
   else dist_exports.log.error(`Could not install automatically. See ${recipe.manualUrl}`);
   return ok;
 }
-async function setupCommand(app) {
+async function setupCommand(app, assistants) {
   requireInteractive(
     "setup",
     "Run it in a regular terminal, or script it: `cloudhop provider enable aws`, then `cloudhop add aws sso --start-url <url> --region <r>`."
@@ -11181,11 +12757,24 @@ async function setupCommand(app) {
     }
   }
   const addNow = answer(await dist_exports.confirm({ message: "Add an account or SSO portal now?" }));
-  if (!addNow) {
-    dist_exports.outro("All set. Run `cloudhop add` whenever you are ready.");
-    return;
+  if (addNow) await addCommand(app, { positional: [], flags: {} });
+  else dist_exports.log.info("Run `cloudhop add` whenever you are ready.");
+  const detected = assistants.detect();
+  if (detected.length > 0) {
+    const names = detected.map((id) => ASSISTANTS[id].name).join(", ");
+    const teach = answer(
+      await dist_exports.confirm({
+        message: `Teach your AI assistant (${names}) to use cloudhop?`,
+        initialValue: true
+      })
+    );
+    if (teach) {
+      await agentCommand(assistants, ["install"]);
+      return;
+    }
+    dist_exports.log.info("You can do it later with `cloudhop agent install`.");
   }
-  await addCommand(app, { positional: [], flags: {} });
+  if (!addNow) dist_exports.outro("All set.");
 }
 async function doctorCommand(app) {
   dist_exports.intro("cloudhop doctor");
@@ -11195,253 +12784,422 @@ async function doctorCommand(app) {
     return;
   }
   let healthy = true;
-  for (const entry of entries) {
-    if (entry.tool.installed && !entry.outdated) {
-      dist_exports.log.success(`${entry.displayName}: ${entry.cli.displayName} ${entry.tool.version ?? ""}`);
-    } else {
-      healthy = await offerInstall(app, entry) && healthy;
-    }
-  }
-  dist_exports.outro(
-    healthy ? "Everything looks good." : "Some tools are missing; login and `cloudhop exec` still work."
-  );
-}
-
-// ../adapters-node/src/node-browser-opener.ts
-import { spawn } from "child_process";
-var NodeBrowserOpener = class {
-  async open(url) {
-    const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", '""', url.replace(/&/g, "^&")]] : ["xdg-open", [url]];
-    await new Promise((resolve) => {
-      const child = spawn(command, args, { stdio: "ignore", detached: true });
-      child.on("error", () => resolve());
-      child.on("spawn", () => {
-        child.unref();
-        resolve();
-      });
-    });
-  }
-};
-
-// ../adapters-node/src/node-process-runner.ts
-import { spawn as spawn2 } from "child_process";
-var STDERR_TAIL_BYTES = 8 * 1024;
-function buildEnv(overrides) {
-  const env = { ...process.env };
-  for (const [key, value] of Object.entries(overrides ?? {})) {
-    if (value === void 0) delete env[key];
-    else env[key] = value;
-  }
-  return env;
-}
-var useShell = process.platform === "win32";
-var NodeProcessRunner = class {
-  run(command, args, options = {}) {
-    return new Promise((resolve, reject) => {
-      const child = spawn2(command, args, {
-        env: buildEnv(options.env),
-        stdio: ["inherit", "inherit", options.captureStderr ? "pipe" : "inherit"],
-        shell: useShell
-      });
-      let tail = "";
-      child.stderr?.on("data", (chunk) => {
-        process.stderr.write(chunk);
-        tail = (tail + chunk.toString()).slice(-STDERR_TAIL_BYTES);
-      });
-      const ignore = () => {
-      };
-      process.on("SIGINT", ignore);
-      process.on("SIGTERM", ignore);
-      const cleanup = () => {
-        process.off("SIGINT", ignore);
-        process.off("SIGTERM", ignore);
-      };
-      child.on("error", (error) => {
-        cleanup();
-        reject(error);
-      });
-      child.on("close", (code, signal) => {
-        cleanup();
-        resolve({ exitCode: code ?? (signal ? 128 + 2 : 1), stderrTail: tail });
-      });
-    });
-  }
-  capture(command, args, options = {}) {
-    return new Promise((resolve) => {
-      const child = spawn2(command, args, { env: buildEnv(options.env), shell: useShell });
-      let stdout2 = "";
-      let stderr = "";
-      child.stdout.on("data", (c3) => {
-        stdout2 += c3.toString();
-      });
-      child.stderr.on("data", (c3) => {
-        stderr += c3.toString();
-      });
-      child.on("error", (error) => resolve({ exitCode: 127, stdout: stdout2, stderr: error.message }));
-      child.on("close", (code) => resolve({ exitCode: code ?? 1, stdout: stdout2, stderr }));
-    });
-  }
-  async probe(command) {
-    const result = await this.capture(command, ["--version"]);
-    if (result.exitCode !== 0) return { installed: false };
-    const output = `${result.stdout} ${result.stderr}`;
-    const version = output.match(/(\d+\.\d+\.\d+)/)?.[1];
-    return { installed: true, ...version ? { version } : {} };
-  }
-};
-
-// ../adapters-node/src/system-tool-installer.ts
-var TOOLS = {
-  aws: {
-    manualUrl: "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html",
-    recipes: {
-      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "awscli"] }],
-      win32: [
-        { via: "winget", command: "winget", args: ["install", "--exact", "--id", "Amazon.AWSCLI"] }
-      ]
-    }
-  },
-  az: {
-    manualUrl: "https://learn.microsoft.com/cli/azure/install-azure-cli",
-    recipes: {
-      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "azure-cli"] }],
-      win32: [
-        {
-          via: "winget",
-          command: "winget",
-          args: ["install", "--exact", "--id", "Microsoft.AzureCLI"]
-        }
-      ]
-    }
-  },
-  gcloud: {
-    manualUrl: "https://cloud.google.com/sdk/docs/install",
-    recipes: {
-      darwin: [
-        { via: "Homebrew", command: "brew", args: ["install", "--cask", "google-cloud-sdk"] }
-      ],
-      win32: [
-        {
-          via: "winget",
-          command: "winget",
-          args: ["install", "--exact", "--id", "Google.CloudSDK"]
-        }
-      ]
+  for (const entry of entries) {
+    if (entry.tool.installed && !entry.outdated) {
+      dist_exports.log.success(`${entry.displayName}: ${entry.cli.displayName} ${entry.tool.version ?? ""}`);
+    } else {
+      healthy = await offerInstall(app, entry) && healthy;
     }
   }
+  dist_exports.outro(
+    healthy ? "Everything looks good." : "Some tools are missing; login and `cloudhop exec` still work."
+  );
+}
+
+// src/commands/shell.ts
+import { existsSync as existsSync3 } from "fs";
+import { appendFile, mkdir as mkdir3, readFile as readFile3 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, join as join5 } from "path";
+var SHELLS = ["zsh", "bash", "fish", "pwsh"];
+var ALIAS_COMMANDS = "use status console region mv prod rm exec";
+var SOURCE_COMMANDS = "alias login sync ls";
+var SCRIPTS = {
+  zsh: `# cloudhop shell integration (zsh). Load it after compinit:  eval "$(cloudhop shell zsh)"
+cloudhop() {
+  if [ "$1" = "use" ]; then
+    local out; out="$(command cloudhop use --emit zsh "\${@:2}")" || return $?
+    eval "$out"
+  else
+    command cloudhop "$@"
+  fi
+}
+_cloudhop_words() { command cloudhop __complete "$1" 2>/dev/null }
+_hop() { (( CURRENT == 2 )) && { local -a a; a=(\${(f)"$(_cloudhop_words aliases)"}); compadd -a a; } }
+_cloudhop() {
+  local -a w
+  if (( CURRENT == 2 )); then w=(\${(f)"$(_cloudhop_words commands)"}); compadd -a w; return; fi
+  (( CURRENT == 3 )) || return
+  case " ${ALIAS_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words aliases)"});; esac
+  case " ${SOURCE_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words sources)"});; esac
+  compadd -a w
+}
+(( $+functions[compdef] )) && { compdef _hop hop; compdef _cloudhop cloudhop; }
+# Add $(cloudhop_prompt) to your prompt to see the alias set with \`cloudhop use\`.
+cloudhop_prompt() { [ -n "$CLOUDHOP_ALIAS" ] && printf '\u2601 %s%s' "$CLOUDHOP_ALIAS" "\${CLOUDHOP_PROD:+ PROD}"; }
+`,
+  bash: `# cloudhop shell integration (bash):  eval "$(cloudhop shell bash)"
+cloudhop() {
+  if [ "$1" = "use" ]; then
+    local out; out="$(command cloudhop use --emit bash "\${@:2}")" || return $?
+    eval "$out"
+  else
+    command cloudhop "$@"
+  fi
+}
+_cloudhop_complete() {
+  local cur=\${COMP_WORDS[COMP_CWORD]} cmd=\${COMP_WORDS[0]##*/} kind=""
+  if [ "$cmd" = hop ]; then [ "$COMP_CWORD" -eq 1 ] && kind=aliases
+  elif [ "$COMP_CWORD" -eq 1 ]; then kind=commands
+  elif [ "$COMP_CWORD" -eq 2 ]; then
+    case " ${ALIAS_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=aliases;; esac
+    case " ${SOURCE_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=sources;; esac
+  fi
+  [ -n "$kind" ] && COMPREPLY=($(compgen -W "$(command cloudhop __complete $kind 2>/dev/null)" -- "$cur"))
+}
+complete -o default -F _cloudhop_complete hop cloudhop
+# Add $(cloudhop_prompt) to PS1 to see the alias set with \`cloudhop use\`.
+cloudhop_prompt() { [ -n "$CLOUDHOP_ALIAS" ] && printf '\u2601 %s%s' "$CLOUDHOP_ALIAS" "\${CLOUDHOP_PROD:+ PROD}"; }
+`,
+  fish: `# cloudhop shell integration (fish):  cloudhop shell fish | source
+function cloudhop
+  if test "$argv[1]" = use
+    set -l out (command cloudhop use --emit fish $argv[2..-1]); or return $status
+    printf '%s\\n' $out | source
+  else
+    command cloudhop $argv
+  end
+end
+complete -c hop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete aliases 2>/dev/null)'
+complete -c cloudhop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete commands 2>/dev/null)'
+complete -c cloudhop -f -n '__fish_seen_subcommand_from ${ALIAS_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete aliases 2>/dev/null)'
+complete -c cloudhop -f -n '__fish_seen_subcommand_from ${SOURCE_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete sources 2>/dev/null)'
+# Call cloudhop_prompt from fish_prompt to see the alias set with \`cloudhop use\`.
+function cloudhop_prompt
+  test -n "$CLOUDHOP_ALIAS"; and printf '\u2601 %s%s' $CLOUDHOP_ALIAS (test -n "$CLOUDHOP_PROD"; and echo ' PROD')
+end
+`,
+  pwsh: `# cloudhop shell integration (PowerShell):  cloudhop shell pwsh | Out-String | Invoke-Expression
+$script:CloudhopExe = (Get-Command cloudhop -CommandType Application, ExternalScript | Select-Object -First 1).Source
+function cloudhop {
+  if ($args.Count -gt 0 -and $args[0] -eq 'use') {
+    $out = & $script:CloudhopExe use --emit pwsh @($args | Select-Object -Skip 1)
+    if ($LASTEXITCODE -eq 0) { $out | Out-String | Invoke-Expression }
+  } else { & $script:CloudhopExe @args }
+}
+Register-ArgumentCompleter -Native -CommandName hop, cloudhop -ScriptBlock {
+  param($word, $ast)
+  $n = $ast.CommandElements.Count - [int]($word -eq '')
+  $kind = if ($ast.CommandElements[0].Value -match 'hop$' -and $ast.CommandElements[0].Value -notmatch 'cloudhop') { if ($n -le 1) { 'aliases' } }
+          elseif ($n -le 1) { 'commands' }
+          elseif ($n -eq 2 -and ' ${ALIAS_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'aliases' }
+          elseif ($n -eq 2 -and ' ${SOURCE_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'sources' }
+  if ($kind) { & $script:CloudhopExe __complete $kind | Where-Object { $_ -like "$word*" } }
+}
+function cloudhop_prompt { if ($env:CLOUDHOP_ALIAS) { "\u2601 $env:CLOUDHOP_ALIAS$(if ($env:CLOUDHOP_PROD) { ' PROD' })" } }
+`
 };
-var SystemToolInstaller = class {
-  constructor(runner, platform = process.platform) {
-    this.runner = runner;
-    this.platform = platform;
-  }
-  runner;
-  platform;
-  available = /* @__PURE__ */ new Map();
-  recipeFor(command) {
-    const tool = TOOLS[command];
-    if (!tool) return void 0;
-    const recipe = tool.recipes[this.platform]?.[0];
-    return recipe ? { ...recipe, manualUrl: tool.manualUrl } : { via: "official installer", command: "", args: [], manualUrl: tool.manualUrl };
+var quote = (shell, value) => shell === "pwsh" ? `'${value.replace(/'/g, "''")}'` : `'${value.replace(/'/g, "'\\''")}'`;
+function shellExports(shell, env) {
+  return Object.entries(env).map(([key, value]) => {
+    if (value === void 0) {
+      if (shell === "fish") return `set -e ${key}`;
+      if (shell === "pwsh") return `Remove-Item Env:${key} -ErrorAction SilentlyContinue`;
+      return `unset ${key}`;
+    }
+    if (shell === "fish") return `set -gx ${key} ${quote(shell, value)}`;
+    if (shell === "pwsh") return `$env:${key} = ${quote(shell, value)}`;
+    return `export ${key}=${quote(shell, value)}`;
+  }).join("\n");
+}
+function detectShell() {
+  if (process.platform === "win32") return "pwsh";
+  const name = (process.env.SHELL ?? "").split("/").pop();
+  return SHELLS.includes(name) ? name : "bash";
+}
+function parseShell(value) {
+  if (!value) return detectShell();
+  const shell = value === "powershell" ? "pwsh" : value;
+  if (!SHELLS.includes(shell)) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `Unknown shell "${value}".`,
+      `Use one of: ${SHELLS.join(", ")}.`
+    );
   }
-  async install(recipe) {
-    if (!recipe.command) return false;
-    if (!await this.hasCommand(recipe.command)) return false;
-    const { exitCode } = await this.runner.run(recipe.command, recipe.args);
-    return exitCode === 0;
+  return shell;
+}
+var RC_FILES = {
+  zsh: (home) => join5(home, ".zshrc"),
+  bash: (home) => join5(home, ".bashrc"),
+  fish: (home) => join5(home, ".config", "fish", "config.fish"),
+  pwsh: (home) => process.platform === "win32" ? join5(home, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1") : join5(home, ".config", "powershell", "Microsoft.PowerShell_profile.ps1")
+};
+var LOAD_LINE = {
+  zsh: 'eval "$(cloudhop shell zsh)"',
+  bash: 'eval "$(cloudhop shell bash)"',
+  fish: "cloudhop shell fish | source",
+  pwsh: "cloudhop shell pwsh | Out-String | Invoke-Expression"
+};
+async function shellCommand(args) {
+  const { positional, flags } = parseArgs(args);
+  if (positional[0] !== "install") {
+    process.stdout.write(SCRIPTS[parseShell(positional[0])]);
+    return;
   }
-  async hasCommand(command) {
-    if (!this.available.has(command)) {
-      this.available.set(command, (await this.runner.probe(command)).installed);
-    }
-    return this.available.get(command) ?? false;
+  const shell = parseShell(positional[1]);
+  const file = RC_FILES[shell](homedir3());
+  const line = LOAD_LINE[shell];
+  const current = existsSync3(file) ? await readFile3(file, "utf8") : "";
+  if (current.includes(line)) {
+    console.log(`Already set up in ${file.replace(homedir3(), "~")}.`);
+    return;
   }
-};
-
-// ../adapters-node/src/yaml-config-store.ts
-import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { join as join2 } from "path";
-var import_yaml = __toESM(require_dist(), 1);
-function defaultConfigDir(env = process.env) {
-  if (env.CLOUDHOP_HOME) return env.CLOUDHOP_HOME;
-  return join2(env.XDG_CONFIG_HOME || join2(homedir(), ".config"), "cloudhop");
+  if (!flags.yes) {
+    if (!interactive())
+      throw new CloudhopError(
+        "NOT_INTERACTIVE",
+        `Add this line to ${file} yourself, or rerun with --yes:
+  ${line}`
+      );
+    const ok = answer(
+      await dist_exports.confirm({
+        message: `Add cloudhop to ${file.replace(homedir3(), "~")}?`,
+        initialValue: true
+      })
+    );
+    if (!ok) return;
+  }
+  await mkdir3(dirname3(file), { recursive: true });
+  const note2 = shell === "zsh" ? "  # after compinit" : "";
+  await appendFile(
+    file,
+    `${current && !current.endsWith("\n") ? "\n" : ""}
+# cloudhop: \`cloudhop use\`, tab completion and cloudhop_prompt${note2}
+${line}
+`
+  );
+  console.log(
+    `${paint("green", "\u2714")} Added to ${file.replace(homedir3(), "~")}. Open a new terminal to use it.`
+  );
 }
-var HEADER = "# cloudhop configuration. Contains no secrets.\n# Docs: https://github.com/dayepesb/cloudhop\n";
-var YamlConfigStore = class {
-  constructor(dir = defaultConfigDir()) {
-    this.dir = dir;
+async function useCommand(app, args) {
+  const { positional, flags } = parseArgs(args);
+  const shell = flags.emit ? parseShell(flags.emit) : void 0;
+  if (!shell) {
+    throw new CloudhopError(
+      "NOT_INTERACTIVE",
+      "`cloudhop use` needs the shell integration to change your current shell.",
+      `Set it up once with \`cloudhop shell install\` (or add ${LOAD_LINE[detectShell()]} to your shell's startup file), then open a new terminal.`
+    );
   }
-  dir;
-  get configPath() {
-    return join2(this.dir, "config.yaml");
+  const clear = {
+    AWS_ACCESS_KEY_ID: void 0,
+    AWS_SECRET_ACCESS_KEY: void 0,
+    AWS_SESSION_TOKEN: void 0
+  };
+  if (flags.off) {
+    process.stdout.write(
+      `${shellExports(shell, { ...clear, AWS_PROFILE: void 0, AWS_REGION: void 0, AWS_DEFAULT_REGION: void 0, CLOUDHOP_ALIAS: void 0, CLOUDHOP_PROD: void 0 })}
+`
+    );
+    notify("No alias in this shell anymore.");
+    return;
   }
-  get targetsPath() {
-    return join2(this.dir, "targets.json");
+  const alias = positional[0] ?? await pickAlias(app, "Use which alias in this shell?");
+  const env = await app.envForAlias(alias, "cli");
+  const status = await app.aliasStatus(alias);
+  process.stdout.write(
+    `${shellExports(shell, { ...clear, ...env, CLOUDHOP_ALIAS: alias, CLOUDHOP_PROD: status.prod ? "1" : void 0 })}
+`
+  );
+  notify(
+    `This shell now uses ${alias} (${status.label ?? status.target}, ${status.region ?? "no region"}).`
+  );
+  if (status.prod) {
+    notify(
+      paint(
+        "red",
+        `${alias} is production. Plain \`aws\` commands are not protected here: use \`hop ${alias}\` to be asked before changes.`
+      )
+    );
   }
-  async load() {
-    const raw = await this.read(this.configPath);
-    if (!raw) return emptyConfig();
-    const file = (0, import_yaml.parse)(raw) ?? {};
-    return {
-      providers: (file.providers ?? []).filter(
-        (p3) => PROVIDER_IDS.includes(p3)
-      ),
-      sources: Object.entries(file.sources ?? {}).map(([id, s]) => ({
-        id,
-        ...s,
-        settings: s.settings ?? {}
-      })),
-      aliases: Object.entries(file.aliases ?? {}).map(([name, a2]) => ({ name, ...a2 }))
-    };
+}
+async function completeCommand(app, kind) {
+  if (kind === "commands") {
+    console.log(
+      [...RESERVED_NAMES, "each", "shell", "use"].filter((c3, i2, a2) => a2.indexOf(c3) === i2).sort().join("\n")
+    );
+    return;
   }
-  async save(config) {
+  const config = await app.config();
+  const words = kind === "sources" ? config.sources.map((s) => s.id) : config.aliases.map((a2) => a2.name);
+  if (words.length) console.log(words.join("\n"));
+}
+
+// src/commands/team.ts
+import { readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+var import_yaml2 = __toESM(require_dist(), 1);
+var MAX_BYTES = 256 * 1024;
+var HEADER2 = `# cloudhop team setup: import it with \`cloudhop team import <this file or its https URL>\`.
+# No secrets: portal URLs, regions, account ids and role names only.
+`;
+function validate(app, raw) {
+  const bad = (why) => new CloudhopError("INVALID_NAME", `Not a cloudhop team file: ${why}.`);
+  if (!raw || typeof raw !== "object") throw bad("it is empty");
+  const file = raw;
+  if (file.version !== 1) throw bad('unknown "version" (expected 1)');
+  const sources = file.sources ?? {};
+  const aliases = file.aliases ?? {};
+  for (const [id, source] of Object.entries(sources)) {
+    assertValidName("source", id);
+    if (!PROVIDER_IDS.includes(source?.provider))
+      throw bad(`source "${id}" has an unknown provider`);
+    const kind = app.provider(source.provider).sourceKinds.find((k) => k.kind === source.kind);
+    if (!kind) throw bad(`source "${id}" has an unknown kind`);
+    for (const field of kind.fields) {
+      const value = source.settings?.[field.key];
+      if (typeof value !== "string" || !value) throw bad(`source "${id}" is missing ${field.key}`);
+      const problem = field.validate?.(value);
+      if (problem) throw bad(`source "${id}": ${problem}`);
+    }
+  }
+  for (const [name, alias] of Object.entries(aliases)) {
+    assertValidName("alias", name);
+    if (!alias || typeof alias.target !== "string" || !sources[alias.source]) {
+      throw bad(`alias "${name}" must name a source of this file and a target`);
+    }
+  }
+  return { version: 1, sources, aliases };
+}
+async function load(location) {
+  if (/^http:\/\//i.test(location)) throw new CloudhopError("INVALID_NAME", "Use an https:// URL.");
+  if (/^https:\/\//i.test(location)) {
+    const response = await fetch(location, { signal: AbortSignal.timeout(1e4) });
+    if (!response.ok)
+      throw new CloudhopError("INVALID_NAME", `Could not download it (HTTP ${response.status}).`);
+    const text4 = await response.text();
+    if (text4.length > MAX_BYTES)
+      throw new CloudhopError("INVALID_NAME", "That file is too big for a team setup.");
+    return text4;
+  }
+  return readFile4(location, "utf8");
+}
+async function teamCommand(app, args) {
+  const { positional, flags } = parseArgs(args);
+  const [action, location] = positional;
+  if (action === "export") {
+    const config2 = await app.config();
+    const wanted = flags.sources?.split(",").map((s) => s.trim());
+    const sources = config2.sources.filter(
+      (s) => s.kind !== "console-login" && (!wanted || wanted.includes(s.id))
+    );
+    const ids = new Set(sources.map((s) => s.id));
     const file = {
-      providers: config.providers,
-      sources: Object.fromEntries(config.sources.map(({ id, ...rest }) => [id, rest])),
-      aliases: Object.fromEntries(config.aliases.map(({ name, ...rest }) => [name, rest]))
+      version: 1,
+      sources: Object.fromEntries(sources.map(({ id, ...rest }) => [id, rest])),
+      aliases: Object.fromEntries(
+        config2.aliases.filter((a2) => ids.has(a2.source)).map(({ name, ...rest }) => [name, rest])
+      )
     };
-    await this.write(this.configPath, HEADER + (0, import_yaml.stringify)(file));
-  }
-  async loadTargets(sourceId) {
-    return (await this.allTargets())[sourceId] ?? [];
-  }
-  async saveTargets(sourceId, targets) {
-    const all = await this.allTargets();
-    all[sourceId] = targets;
-    await this.write(this.targetsPath, JSON.stringify(all, null, 2));
+    const text4 = HEADER2 + (0, import_yaml2.stringify)(file);
+    if (flags.out) {
+      await writeFile3(flags.out, text4);
+      console.error(
+        `${paint("green", "\u2714")} Wrote ${sources.length} source(s) and ${Object.keys(file.aliases).length} alias(es) to ${flags.out}.`
+      );
+    } else {
+      process.stdout.write(text4);
+    }
+    return;
   }
-  async removeTargets(sourceId) {
-    const all = await this.allTargets();
-    delete all[sourceId];
-    await this.write(this.targetsPath, JSON.stringify(all, null, 2));
+  if (action !== "import" || !location) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      "Usage: cloudhop team export [--out file] | cloudhop team import <file|https URL>"
+    );
   }
-  async reset() {
-    await rm(this.dir, { recursive: true, force: true });
+  const team = validate(app, (0, import_yaml2.parse)(await load(location)));
+  const config = await app.config();
+  const existingSources = new Map(config.sources.map((s) => [s.id, s]));
+  const sameUrl = (a2, b3) => a2.startUrl !== void 0 && a2.startUrl === b3.startUrl;
+  const newSources = [];
+  const sourceMap = /* @__PURE__ */ new Map();
+  for (const [id, source] of Object.entries(team.sources)) {
+    const match = config.sources.find(
+      (s) => s.provider === source.provider && sameUrl(s.settings, source.settings)
+    );
+    if (match) {
+      sourceMap.set(id, match.id);
+      continue;
+    }
+    if (existingSources.has(id))
+      throw new CloudhopError(
+        "SOURCE_EXISTS",
+        `You already have a different source named "${id}".`,
+        "Rename yours with `cloudhop rm` and add it again, or edit the team file."
+      );
+    newSources.push({ id, ...source });
+    sourceMap.set(id, id);
+  }
+  const takenAliases = new Set(config.aliases.map((a2) => a2.name));
+  const newAliases = [];
+  const skipped = [];
+  for (const [name, alias] of Object.entries(team.aliases)) {
+    if (takenAliases.has(name)) skipped.push(name);
+    else newAliases.push({ name, ...alias, source: sourceMap.get(alias.source) });
+  }
+  if (newSources.length === 0 && newAliases.length === 0) {
+    console.log("Nothing to import: you already have everything in this file.");
+    return;
   }
-  async allTargets() {
-    const raw = await this.read(this.targetsPath);
-    return raw ? JSON.parse(raw) : {};
+  console.log(bold("This team setup will add:"));
+  for (const s of newSources)
+    console.log(
+      `  source ${bold(s.id)}  ${paint("sky", s.settings.startUrl ?? s.kind)}  ${s.settings.region ?? ""}`
+    );
+  for (const a2 of newAliases)
+    console.log(`  alias  ${a2.name}  ${a2.target}${a2.prod ? `  ${paint("red", "PROD")}` : ""}`);
+  if (skipped.length)
+    console.log(paint("dim", `  (skipping aliases you already have: ${skipped.join(", ")})`));
+  if (newSources.length)
+    console.log(
+      paint("yellow", "Check that these portal URLs are your organization's before signing in.")
+    );
+  if (!flags.yes) {
+    if (!interactive())
+      throw new CloudhopError(
+        "NOT_INTERACTIVE",
+        "Review the list above and rerun with --yes to import it."
+      );
+    if (!answer(
+      await dist_exports.confirm({
+        message: "Import it? Each new portal opens your browser to sign in.",
+        initialValue: true
+      })
+    ))
+      return;
   }
-  async read(path2) {
-    try {
-      return await readFile(path2, "utf8");
-    } catch (error) {
-      if (error.code === "ENOENT") return void 0;
-      throw error;
-    }
+  const providers = new Set((await app.config()).providers);
+  for (const s of newSources) if (!providers.has(s.provider)) await app.enableProvider(s.provider);
+  for (const source of newSources) {
+    const report = await app.connectSource(source);
+    console.log(
+      `${paint("green", "\u2714")} ${source.id}: signed in, ${report.targets.length} account/role(s).`
+    );
   }
-  /** Writes through a temp file so a crash never leaves a half-written config. */
-  async write(path2, content) {
-    await mkdir(this.dir, { recursive: true, mode: 448 });
-    const tmp = `${path2}.${process.pid}.tmp`;
-    await writeFile(tmp, content, { mode: 384 });
-    await rename(tmp, path2);
+  const usable = [];
+  const missing = [];
+  for (const alias of newAliases) {
+    const targets = await app.listTargets(alias.source);
+    if (targets.some((t2) => t2.id === alias.target)) usable.push(alias);
+    else missing.push(alias.name);
   }
-};
+  if (usable.length) await app.addAliases(usable);
+  console.log(
+    `${paint("green", "\u2714")} Created ${usable.length} alias(es)${usable.length ? `: ${usable.map((a2) => a2.name).join(", ")}` : ""}.`
+  );
+  if (missing.length)
+    console.log(
+      paint(
+        "yellow",
+        `Not created, you don't have access to their account/role: ${missing.join(", ")}.`
+      )
+    );
+}
 
 // ../ui/src/api.ts
-var text2 = (body, key) => {
+var text3 = (body, key) => {
   const value = body[key];
   return typeof value === "string" ? value.trim() : "";
 };
@@ -11460,10 +13218,26 @@ var reportView = (report) => ({
   removed: report.removed.length,
   orphanedAliases: report.orphanedAliases
 });
-function createApi(app) {
+var SCOPES = /* @__PURE__ */ new Set(["user", "project"]);
+var scopeOf = (value) => {
+  if (SCOPES.has(value)) return value;
+  throw badRequest('Scope must be "user" or "project".');
+};
+var assistantIds = (value) => {
+  const ids = Array.isArray(value) ? value : [];
+  if (ids.length === 0 || !ids.every((id) => ASSISTANT_IDS.includes(id))) {
+    throw badRequest("Choose at least one assistant.");
+  }
+  return ids;
+};
+function createApi(app, assistants) {
+  const requireAssistants = () => {
+    if (!assistants) throw badRequest("AI assistant setup is not available here.");
+    return assistants;
+  };
   const regionCheck = (source, region) => {
-    const validate = app.provider(source.provider).sourceKinds.find((k) => k.kind === source.kind)?.fields.find((f2) => f2.key === "region")?.validate;
-    const problem = region ? validate?.(region) : "Region is required.";
+    const validate2 = app.provider(source.provider).sourceKinds.find((k) => k.kind === source.kind)?.fields.find((f2) => f2.key === "region")?.validate;
+    const problem = region ? validate2?.(region) : "Region is required.";
     if (problem) throw badRequest(problem);
   };
   const findSource = async (id) => {
@@ -11514,10 +13288,31 @@ function createApi(app) {
           target: alias.target,
           label: target?.label,
           missing: !target,
-          region
+          region,
+          prod: alias.prod === true
         }))
       };
     },
+    /** Which AI assistants know cloudhop, for both scopes. Paths are shown, never file contents. */
+    "GET /api/assistants": async () => {
+      const installer = requireAssistants();
+      return {
+        project: process.cwd(),
+        user: await installer.status("user"),
+        projectScope: await installer.status("project")
+      };
+    },
+    "POST /api/assistants": async (_2, body) => {
+      const tools = assistantIds(body.tools);
+      const scope = scopeOf(body.scope);
+      return {
+        results: await requireAssistants().install(tools, scope, { mcp: body.mcp !== false })
+      };
+    },
+    "POST /api/assistants/remove": async (_2, body) => ({
+      results: await requireAssistants().remove(assistantIds(body.tools), scopeOf(body.scope))
+    }),
+    "POST /api/assistants/update": async (_2, body) => requireAssistants().update({ force: body.force === true }),
     "GET /api/doctor": async () => (await app.doctor()).map((entry) => ({
       provider: entry.provider,
       cli: entry.cli.displayName,
@@ -11536,19 +13331,19 @@ function createApi(app) {
     },
     /** Adds a source and logs in right away, like `cloudhop add`; a failed login adds nothing. */
     "POST /api/sources": async (_2, body) => {
-      const provider = app.provider(text2(body, "provider"));
-      const kind = provider.sourceKinds.find((k) => k.kind === text2(body, "kind"));
+      const provider = app.provider(text3(body, "provider"));
+      const kind = provider.sourceKinds.find((k) => k.kind === text3(body, "kind"));
       if (!kind) throw badRequest("Choose what you want to add.");
       const input = body.settings ?? {};
       const settings2 = {};
       for (const field of kind.fields) {
-        const value = text2(input, field.key) || field.defaultValue || "";
+        const value = text3(input, field.key) || field.defaultValue || "";
         if (!value) throw badRequest(`${field.label} is required.`);
         const problem = field.validate?.(value);
         if (problem) throw badRequest(`${field.label}: ${problem}`);
         settings2[field.key] = value;
       }
-      const id = text2(body, "id");
+      const id = text3(body, "id");
       return reportView(
         await app.connectSource({ id, provider: provider.id, kind: kind.kind, settings: settings2 })
       );
@@ -11576,25 +13371,41 @@ function createApi(app) {
       if (items.length === 0) throw badRequest("Pick at least one account/role.");
       const aliases = [];
       for (const item of items) {
-        const source = await findSource(text2(item, "source"));
-        const region = text2(item, "region");
+        const source = await findSource(text3(item, "source"));
+        const region = text3(item, "region");
         if (region) regionCheck(source, region);
         aliases.push({
-          name: text2(item, "name"),
+          name: text3(item, "name"),
           source: source.id,
-          target: text2(item, "target"),
+          target: text3(item, "target"),
           ...region && region !== source.settings.region ? { region } : {}
         });
       }
       await app.addAliases(aliases);
       return { created: aliases.map((a2) => a2.name) };
     },
+    /** Changes an alias: any of `region`, `prod` (production mark) and `name` (rename, applied last). */
     "PATCH /api/aliases/:name": async ([name], body) => {
-      const resolved = await app.resolveAlias(name);
-      const region = text2(body, "region");
-      regionCheck(resolved.source, region);
-      await app.setAliasRegion(name, region);
-      return { name, region };
+      let current = name;
+      if ("region" in body) {
+        const resolved = await app.resolveAlias(current);
+        const region = text3(body, "region");
+        regionCheck(resolved.source, region);
+        await app.setAliasRegion(current, region);
+      }
+      if (typeof body.prod === "boolean") await app.setProduction([current], body.prod);
+      if ("name" in body) {
+        const to = text3(body, "name");
+        await app.renameAlias(current, to);
+        current = to;
+      }
+      return { name: current };
+    },
+    /** Opens the web console in the user's browser; the sign-in URL never reaches the page. */
+    "POST /api/aliases/:name/console": async ([name], body) => {
+      const service = text3(body, "service");
+      const via = await app.openConsole(name, service ? { service } : {});
+      return { via };
     },
     "DELETE /api/aliases/:name": async ([name]) => {
       await app.removeAlias(name);
@@ -11631,7 +13442,7 @@ import { randomBytes, timingSafeEqual } from "crypto";
 import { createServer } from "http";
 
 // ../ui/src/assets/app.js
-var app_default = "// cloudhop local UI. Plain DOM, no build step: served as-is by `cloudhop ui`.\n\nconst TOKEN_KEY = 'cloudhop-token';\nconst SESSION_TEXT = {\n  valid: 'Session valid',\n  refreshable: 'Renews on next use',\n  expired: 'Expired: sign in on next use',\n  unknown: 'Managed by the cloud CLI',\n};\n\n// The token arrives in the URL fragment once; keep it for this tab and clean the address bar.\nconst fromHash = new URLSearchParams(location.hash.slice(1)).get('token');\nif (fromHash) {\n  try {\n    sessionStorage.setItem(TOKEN_KEY, fromHash);\n  } catch {}\n  history.replaceState(null, '', location.pathname);\n}\nlet token = fromHash;\ntry {\n  token = token ?? sessionStorage.getItem(TOKEN_KEY);\n} catch {}\n\n// A fresh link opened in this same tab only changes the fragment: reload to pick up its token.\naddEventListener('hashchange', () => {\n  if (new URLSearchParams(location.hash.slice(1)).has('token')) location.reload();\n});\n\nconst $main = document.getElementById('main');\nconst $dialog = document.getElementById('dialog');\nconst $toasts = document.getElementById('toasts');\nconst $addSource = document.getElementById('add-source');\nlet state;\n\n/** Tiny element builder: h('button', { class: 'primary', onclick }, 'Save'). */\nfunction h(tag, attrs = {}, ...children) {\n  const el = document.createElement(tag);\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null || value === false) continue;\n    if (key.startsWith('on')) el.addEventListener(key.slice(2), value);\n    else if (key === 'class') el.className = value;\n    else if (value === true) el.setAttribute(key, '');\n    else el.setAttribute(key, value);\n  }\n  for (const child of children.flat()) {\n    if (child === undefined || child === null || child === false) continue;\n    el.append(child instanceof Node ? child : document.createTextNode(String(child)));\n  }\n  return el;\n}\n\nclass ApiError extends Error {\n  constructor(message, hint) {\n    super(message);\n    this.hint = hint;\n  }\n}\n\n// Calls that may sign in wait for the person in the browser; everything else should answer quickly.\nconst MAY_SIGN_IN = /^\\/api\\/sources(\\/[^/]+\\/(login|sync|targets))?$/;\nconst QUICK_TIMEOUT_MS = 20_000;\n\nasync function api(method, path, body) {\n  const waitsForPerson = MAY_SIGN_IN.test(path);\n  let response;\n  try {\n    response = await fetch(path, {\n      method,\n      headers: {\n        'x-cloudhop-token': token ?? '',\n        ...(body ? { 'content-type': 'application/json' } : {}),\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: waitsForPerson ? undefined : AbortSignal.timeout(QUICK_TIMEOUT_MS),\n    });\n  } catch (error) {\n    if (error.name === 'TimeoutError') {\n      throw new ApiError(\n        'cloudhop ui is not responding.',\n        'Is it paused in your terminal (Ctrl-Z)? Run `fg` there, or stop it and run `cloudhop ui` again.',\n      );\n    }\n    throw new ApiError(\n      'cloudhop ui is not running.',\n      'Run `cloudhop ui` again and open the new link it prints.',\n    );\n  }\n  const data = await response.json().catch(() => ({}));\n  if (!response.ok)\n    throw new ApiError(data.error ?? `Request failed (${response.status}).`, data.hint);\n  return data;\n}\n\nfunction toast(message, { error = false, hint } = {}) {\n  const el = h(\n    'div',\n    { class: `toast${error ? ' error' : ''}` },\n    message,\n    hint && h('small', {}, hint),\n  );\n  $toasts.append(el);\n  setTimeout(() => el.remove(), error ? 9000 : 4000);\n}\n\nconst fail = (error) => toast(error.message, { error: true, hint: error.hint });\n\n/** Disables a button while its action runs. */\nasync function busy(button, action) {\n  button.disabled = true;\n  try {\n    return await action();\n  } finally {\n    button.disabled = false;\n  }\n}\n\nasync function refresh() {\n  try {\n    state = await api('GET', '/api/state');\n    render();\n    checkDoctor();\n  } catch (error) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Cannot reach cloudhop'),\n        h('p', {}, error.message, error.hint ? ` ${error.hint}` : ''),\n      ),\n    );\n  }\n}\n\nasync function checkDoctor() {\n  try {\n    const entries = await api('GET', '/api/doctor');\n    const problems = entries.filter((e) => !e.installed || e.outdated);\n    document.getElementById('doctor')?.remove();\n    if (problems.length === 0) return;\n    $main.prepend(\n      h(\n        'div',\n        { class: 'notice', id: 'doctor' },\n        ...problems.map((e) =>\n          h(\n            'div',\n            {},\n            e.installed\n              ? `${e.cli} ${e.version} is older than ${e.minVersion}. `\n              : `${e.cli} is not installed, so aliases cannot run commands yet. `,\n            'Run ',\n            h('code', {}, 'cloudhop doctor'),\n            ' in a terminal to install it.',\n          ),\n        ),\n      ),\n    );\n  } catch {}\n}\n\n// ---------- main view ----------\n\nfunction render() {\n  const enabled = state.enabledProviders;\n  $addSource.hidden = enabled.length === 0;\n  if (enabled.length === 0) return renderChooseClouds();\n  if (state.sources.length === 0) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Add your first account'),\n        h(\n          'p',\n          {},\n          'Add a company SSO portal or a personal account. cloudhop signs you in, finds every account and role you can use, and lets you give each one a short alias.',\n        ),\n        h('button', { class: 'primary', onclick: () => openAddSource() }, '+ Add source'),\n      ),\n    );\n    return;\n  }\n  $main.replaceChildren(...state.sources.map(sourceCard));\n}\n\nfunction renderChooseClouds() {\n  const boxes = state.providers.map((p) =>\n    h(\n      'label',\n      { class: 'choice' },\n      h('input', { type: 'checkbox', value: p.id, checked: true }),\n      h('span', {}, p.name),\n    ),\n  );\n  const save = h(\n    'button',\n    {\n      class: 'primary',\n      onclick: (e) =>\n        busy(e.currentTarget, async () => {\n          const ids = boxes\n            .map((b) => b.querySelector('input'))\n            .filter((i) => i.checked)\n            .map((i) => i.value);\n          await api('PUT', '/api/providers', { enabled: ids }).catch(fail);\n          await refresh();\n        }),\n    },\n    'Continue',\n  );\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Which clouds do you use?'),\n      h('p', {}, 'Azure and Google Cloud are coming soon.'),\n      h(\n        'div',\n        { class: 'choices', style: 'max-width:320px;margin:0 auto 16px;text-align:left' },\n        boxes,\n      ),\n      save,\n    ),\n  );\n}\n\nfunction sourceCard(source) {\n  const aliases = state.aliases.filter((a) => a.source === source.id);\n  const where = source.settings.startUrl ?? source.kindLabel;\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, source.id),\n    h('span', { class: `badge ${source.session}` }, SESSION_TEXT[source.session] ?? source.session),\n    h('span', { class: 'meta' }, `${source.providerName} \xB7 ${where}`),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      h('button', { onclick: () => openAliasPicker(source) }, '+ Aliases'),\n      h(\n        'button',\n        {\n          title: 'Sign in again and refresh its accounts',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              toast('Opening the browser to sign in\u2026');\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/login`,\n              ).catch(fail);\n              if (report)\n                toast(`${source.id}: signed in, ${report.targets.length} account/role(s).`);\n              await refresh();\n            }),\n        },\n        'Sign in',\n      ),\n      h(\n        'button',\n        {\n          title: 'Refresh the accounts and roles you have access to',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/sync`,\n              ).catch(fail);\n              if (report) toast(syncMessage(source.id, report));\n              await refresh();\n            }),\n        },\n        'Sync',\n      ),\n      h(\n        'button',\n        {\n          class: 'danger',\n          onclick: (e) => {\n            const count = aliases.length;\n            const message = `Remove \"${source.id}\"${count ? ` and its ${count} alias(es)` : ''}?`;\n            if (!confirm(message)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/sources/${encodeURIComponent(source.id)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        'Remove',\n      ),\n    ),\n  );\n\n  const body =\n    aliases.length === 0\n      ? h(\n          'div',\n          { class: 'empty' },\n          'No aliases yet. ',\n          h(\n            'button',\n            { class: 'primary', onclick: () => openAliasPicker(source) },\n            'Pick accounts',\n          ),\n        )\n      : h(\n          'table',\n          {},\n          h(\n            'thead',\n            {},\n            h(\n              'tr',\n              {},\n              h('th', {}, 'Alias'),\n              h('th', {}, 'Region'),\n              h('th', {}, 'Account / role'),\n              h('th'),\n            ),\n          ),\n          h('tbody', {}, aliases.map(aliasRow)),\n        );\n  return h('section', { class: 'card' }, head, h('div', { class: 'card-body' }, body));\n}\n\nfunction syncMessage(id, report) {\n  const parts = [`${report.targets.length} available`];\n  if (report.added) parts.push(`${report.added} new`);\n  if (report.removed) parts.push(`${report.removed} removed`);\n  const orphaned = report.orphanedAliases.length\n    ? ` No longer available: ${report.orphanedAliases.join(', ')}.`\n    : '';\n  return `${id}: ${parts.join(', ')}.${orphaned}`;\n}\n\nfunction aliasRow(alias) {\n  const input = h('input', {\n    value: alias.region ?? '',\n    'aria-label': `Region for ${alias.name}`,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  const save = h('button', { hidden: true }, 'Save');\n  const commit = () =>\n    busy(save, async () => {\n      const region = input.value.trim();\n      const done = await api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, {\n        region,\n      }).catch(fail);\n      if (done) toast(`${alias.name} now runs in ${region}.`);\n      await refresh();\n    });\n  input.addEventListener('input', () => {\n    save.hidden = input.value.trim() === (alias.region ?? '');\n  });\n  input.addEventListener('keydown', (e) => {\n    if (e.key === 'Enter' && !save.hidden) commit();\n    if (e.key === 'Escape') {\n      input.value = alias.region ?? '';\n      save.hidden = true;\n    }\n  });\n  save.addEventListener('click', commit);\n\n  return h(\n    'tr',\n    {},\n    h('td', { class: 'alias', title: `hop ${alias.name} <command>` }, alias.name),\n    h('td', {}, h('div', { class: 'region' }, input, save)),\n    h(\n      'td',\n      {},\n      alias.missing\n        ? h('span', { class: 'missing' }, `${alias.target} (no longer available)`)\n        : alias.label,\n    ),\n    h(\n      'td',\n      { style: 'text-align:right' },\n      h(\n        'button',\n        {\n          class: 'link',\n          title: `Remove ${alias.name}`,\n          'aria-label': `Remove ${alias.name}`,\n          onclick: (e) => {\n            if (!confirm(`Remove alias \"${alias.name}\"?`)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/aliases/${encodeURIComponent(alias.name)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        '\u2715',\n      ),\n    ),\n  );\n}\n\n// ---------- dialogs ----------\n\nfunction showDialog(title, body, footer) {\n  $dialog.replaceChildren(\n    h(\n      'div',\n      { class: 'dlg-head' },\n      h('h2', {}, title),\n      h('button', { class: 'link', 'aria-label': 'Close', onclick: () => $dialog.close() }, '\u2715'),\n    ),\n    h('div', { class: 'dlg-body' }, body),\n    footer ? h('div', { class: 'dlg-foot' }, footer) : null,\n  );\n  if (!$dialog.open) $dialog.showModal();\n}\n\nfunction suggestSourceId(settings, kind) {\n  const host = /^https:\\/\\/([^./]+)\\./.exec(settings.startUrl ?? '')?.[1];\n  return slug(host ?? (kind === 'console-login' ? 'personal' : 'main'));\n}\n\nconst slug = (text) =>\n  text\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 63) || 'main';\n\n/** `previous` refills the form after a failed sign-in: { provider, kind, id, settings, error }. */\nfunction openAddSource(previous) {\n  const providers = state.providers.filter((p) => state.enabledProviders.includes(p.id));\n  let provider = providers.find((p) => p.id === previous?.provider) ?? providers[0];\n  let kind = provider.kinds.find((k) => k.kind === previous?.kind) ?? provider.kinds[0];\n\n  const form = h('form', { onsubmit: (e) => e.preventDefault() });\n  const nameInput = h('input', {\n    id: 'f-name',\n    required: true,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  let nameTouched = Boolean(previous);\n  nameInput.addEventListener('input', () => {\n    nameTouched = true;\n  });\n\n  const fieldInputs = {};\n  const fieldsBox = h('div');\n  const nameLabel = h('label', { for: 'f-name' });\n\n  function updateSuggestion() {\n    if (nameTouched) return;\n    const settings = Object.fromEntries(\n      Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n    );\n    const taken = new Set(state.sources.map((s) => s.id));\n    let id = suggestSourceId(settings, kind.kind);\n    for (let i = 2; taken.has(id); i++) id = `${suggestSourceId(settings, kind.kind)}-${i}`;\n    nameInput.value = id;\n  }\n\n  function renderFields() {\n    for (const key of Object.keys(fieldInputs)) delete fieldInputs[key];\n    fieldsBox.replaceChildren(\n      ...kind.fields.map((f) => {\n        const input = h('input', {\n          id: `f-${f.key}`,\n          placeholder: f.placeholder ?? f.defaultValue ?? '',\n          value: previous?.settings?.[f.key] ?? f.defaultValue ?? '',\n          required: true,\n          class: 'mono',\n          spellcheck: 'false',\n          oninput: updateSuggestion,\n        });\n        fieldInputs[f.key] = input;\n        return h('div', { class: 'field' }, h('label', { for: input.id }, f.label), input);\n      }),\n    );\n    nameLabel.textContent = kind.nameLabel ?? 'Short name for this source';\n    updateSuggestion();\n  }\n\n  const providerSelect =\n    providers.length > 1\n      ? h(\n          'div',\n          { class: 'field' },\n          h('label', { for: 'f-provider' }, 'Cloud'),\n          h(\n            'select',\n            {\n              id: 'f-provider',\n              onchange: (e) => {\n                provider = providers.find((p) => p.id === e.target.value);\n                kind = provider.kinds[0];\n                renderKinds();\n              },\n            },\n            providers.map((p) => h('option', { value: p.id, selected: p === provider }, p.name)),\n          ),\n        )\n      : null;\n\n  const kindsBox = h('div', { class: 'choices' });\n  function renderKinds() {\n    kindsBox.replaceChildren(\n      ...provider.kinds.map((k) =>\n        h(\n          'label',\n          { class: 'choice' },\n          h('input', {\n            type: 'radio',\n            name: 'kind',\n            value: k.kind,\n            checked: k === kind,\n            onchange: () => {\n              kind = k;\n              renderFields();\n            },\n          }),\n          h('span', {}, h('strong', {}, k.label), k.hint ? h('small', {}, k.hint) : null),\n        ),\n      ),\n    );\n    renderFields();\n  }\n\n  form.append(\n    previous?.error\n      ? h(\n          'div',\n          { class: 'notice error' },\n          h('strong', {}, 'Could not sign in, so nothing was saved. '),\n          previous.error.message,\n          previous.error.hint ? h('div', { class: 'help' }, previous.error.hint) : null,\n        )\n      : '',\n    providerSelect ?? '',\n    h('div', { class: 'field' }, h('label', {}, 'What do you want to add?')),\n    kindsBox,\n    fieldsBox,\n    h(\n      'div',\n      { class: 'field' },\n      nameLabel,\n      nameInput,\n      h(\n        'span',\n        { class: 'help' },\n        'Lowercase letters, numbers and dashes. You will see it in ',\n        h('code', {}, 'cloudhop ls'),\n        '.',\n      ),\n    ),\n  );\n  renderKinds();\n  if (previous) nameInput.value = previous.id;\n\n  const submit = h('button', { class: 'primary', type: 'submit' }, 'Add and sign in');\n  form.addEventListener('submit', async () => {\n    if (!form.reportValidity()) return;\n    const body = {\n      provider: provider.id,\n      kind: kind.kind,\n      id: nameInput.value.trim(),\n      settings: Object.fromEntries(\n        Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n      ),\n    };\n    showDialog(\n      'Sign in',\n      h(\n        'div',\n        { class: 'waiting' },\n        h('div', { class: 'spinner' }),\n        h('strong', {}, 'Finish signing in in the browser tab that just opened.'),\n        h('p', { class: 'help' }, 'This page continues on its own once you approve the request.'),\n      ),\n    );\n    try {\n      const report = await api('POST', '/api/sources', body);\n      await refresh();\n      const source = state.sources.find((s) => s.id === body.id);\n      toast(`Signed in to ${body.id}. ${report.targets.length} account/role(s) found.`);\n      openAliasPicker(source, report.targets);\n    } catch (error) {\n      // Nothing was saved: reopen the form with what was typed so it can be fixed.\n      await refresh();\n      openAddSource({ ...body, error });\n    }\n  });\n\n  showDialog('Add source', form, [\n    h('button', { type: 'button', onclick: () => $dialog.close() }, 'Cancel'),\n    submit,\n  ]);\n  submit.setAttribute('form', 'add-form');\n  form.id = 'add-form';\n}\n\nasync function openAliasPicker(source, preloaded) {\n  let targets = preloaded;\n  if (!targets) {\n    showDialog(\n      `Aliases for ${source.id}`,\n      h('div', { class: 'waiting' }, h('div', { class: 'spinner' }), 'Loading accounts\u2026'),\n    );\n    try {\n      targets = (await api('GET', `/api/sources/${encodeURIComponent(source.id)}/targets`)).targets;\n    } catch (error) {\n      $dialog.close();\n      return fail(error);\n    }\n  }\n\n  const used = new Map(\n    state.aliases.filter((a) => a.source === source.id).map((a) => [a.target, a.name]),\n  );\n  const taken = new Set(state.aliases.map((a) => a.name));\n  const defaultRegion = source.settings.region ?? '';\n  const filter = h('input', {\n    type: 'search',\n    placeholder: `Filter ${targets.length} account/role(s)\u2026`,\n    style: 'width:100%;margin-bottom:12px',\n  });\n\n  const rows = targets.map((t) => {\n    const existing = used.get(t.id);\n    let name = t.suggestedAlias;\n    for (let i = 2; taken.has(name); i++) name = `${t.suggestedAlias}-${i}`;\n    const check = h('input', {\n      type: 'checkbox',\n      disabled: Boolean(existing),\n      'aria-label': t.label,\n    });\n    const aliasInput = h('input', {\n      value: name,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Alias for ${t.label}`,\n      placeholder: 'alias',\n    });\n    const regionInput = h('input', {\n      value: defaultRegion,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Region for ${t.label}`,\n      placeholder: 'region',\n    });\n    // Only the checkbox and its text sit in the label, so clicking the inputs never toggles it.\n    const el = h(\n      'div',\n      { class: 'target' },\n      h(\n        'label',\n        { class: 'pick' },\n        check,\n        h(\n          'span',\n          {},\n          t.label,\n          existing ? h('small', { class: 'already' }, `Already: ${existing}`) : null,\n        ),\n      ),\n      h('div', { class: 'inputs' }, aliasInput, regionInput),\n    );\n    return { target: t, el, check, aliasInput, regionInput };\n  });\n\n  filter.addEventListener('input', () => {\n    const q = filter.value.trim().toLowerCase();\n    for (const row of rows) row.el.hidden = q !== '' && !row.target.label.toLowerCase().includes(q);\n  });\n\n  const save = h('button', { class: 'primary' }, 'Create aliases');\n  save.addEventListener('click', () =>\n    busy(save, async () => {\n      const aliases = rows\n        .filter((r) => r.check.checked)\n        .map((r) => ({\n          source: source.id,\n          target: r.target.id,\n          name: r.aliasInput.value.trim(),\n          region: r.regionInput.value.trim(),\n        }));\n      if (aliases.length === 0) return toast('Pick at least one account/role.', { error: true });\n      try {\n        const result = await api('POST', '/api/aliases', { aliases });\n        $dialog.close();\n        toast(`Created ${result.created.join(', ')}. Try: hop ${result.created[0]}`);\n        await refresh();\n      } catch (error) {\n        fail(error);\n      }\n    }),\n  );\n\n  const body =\n    targets.length === 0\n      ? h('p', { class: 'empty' }, 'This source has no accounts or roles assigned to you.')\n      : h(\n          'div',\n          {},\n          filter,\n          h(\n            'div',\n            { class: 'targets' },\n            rows.map((r) => r.el),\n          ),\n        );\n  showDialog(`Aliases for ${source.id}`, body, [\n    h('span', { class: 'note' }, 'Check an account/role, then name its alias and region.'),\n    h('button', { onclick: () => $dialog.close() }, 'Cancel'),\n    targets.length ? save : null,\n  ]);\n}\n\n$addSource.addEventListener('click', () => openAddSource());\n\nif (!token) {\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Open the link from your terminal'),\n      h('p', {}, 'Run cloudhop ui and open the link it prints. It includes a one-time access key.'),\n    ),\n  );\n} else {\n  refresh();\n}\n";
+var app_default = "// cloudhop local UI. Plain DOM, no build step: served as-is by `cloudhop ui`.\n\nconst TOKEN_KEY = 'cloudhop-token';\nconst SESSION_TEXT = {\n  valid: 'Session valid',\n  refreshable: 'Renews on next use',\n  expired: 'Expired: sign in on next use',\n  unknown: 'Managed by the cloud CLI',\n};\n\n// The token arrives in the URL fragment once; keep it for this tab and clean the address bar.\nconst fromHash = new URLSearchParams(location.hash.slice(1)).get('token');\nif (fromHash) {\n  try {\n    sessionStorage.setItem(TOKEN_KEY, fromHash);\n  } catch {}\n  history.replaceState(null, '', location.pathname);\n}\nlet token = fromHash;\ntry {\n  token = token ?? sessionStorage.getItem(TOKEN_KEY);\n} catch {}\n\n// ---------- pages ----------\n\nconst PAGES = {\n  aliases: 'Aliases',\n  sources: 'Sources',\n  assistants: 'AI assistants',\n  tools: 'Tools',\n};\nlet route = 'aliases';\nconst aliasFilter = { text: '', source: '', prodOnly: false };\n\n/** `#/aliases?source=acme` \u2192 route \"aliases\", filtered by that source. */\nfunction readRoute() {\n  const match = /^#\\/([a-z]+)(?:\\?(.*))?$/.exec(location.hash);\n  route = match && PAGES[match[1]] ? match[1] : 'aliases';\n  const query = new URLSearchParams(match?.[2] ?? '');\n  if (query.has('source')) aliasFilter.source = query.get('source');\n}\n\nfunction go(page, query) {\n  location.hash = `#/${page}${query ? `?${new URLSearchParams(query)}` : ''}`;\n}\n\n// A fresh link opened in this same tab carries a new token: reload to pick it up.\n// Any other fragment is a page change.\naddEventListener('hashchange', () => {\n  if (new URLSearchParams(location.hash.slice(1)).has('token')) {\n    location.reload();\n    return;\n  }\n  readRoute();\n  if (state) render();\n});\n\nconst $main = document.getElementById('main');\nconst $dialog = document.getElementById('dialog');\nconst $toasts = document.getElementById('toasts');\nconst $addSource = document.getElementById('add-source');\nconst $nav = document.getElementById('nav');\nlet state;\n\n/** Tiny element builder: h('button', { class: 'primary', onclick }, 'Save'). */\nfunction h(tag, attrs = {}, ...children) {\n  const el = document.createElement(tag);\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null || value === false) continue;\n    if (key.startsWith('on')) el.addEventListener(key.slice(2), value);\n    else if (key === 'class') el.className = value;\n    else if (value === true) el.setAttribute(key, '');\n    else el.setAttribute(key, value);\n  }\n  for (const child of children.flat()) {\n    if (child === undefined || child === null || child === false) continue;\n    el.append(child instanceof Node ? child : document.createTextNode(String(child)));\n  }\n  return el;\n}\n\nclass ApiError extends Error {\n  constructor(message, hint) {\n    super(message);\n    this.hint = hint;\n  }\n}\n\n// Calls that may sign in wait for the person in the browser; everything else should answer quickly.\nconst MAY_SIGN_IN = /^\\/api\\/(sources(\\/[^/]+\\/(login|sync|targets))?|aliases\\/[^/]+\\/console)$/;\nconst QUICK_TIMEOUT_MS = 20_000;\n\nasync function api(method, path, body) {\n  const waitsForPerson = MAY_SIGN_IN.test(path);\n  let response;\n  try {\n    response = await fetch(path, {\n      method,\n      headers: {\n        'x-cloudhop-token': token ?? '',\n        ...(body ? { 'content-type': 'application/json' } : {}),\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: waitsForPerson ? undefined : AbortSignal.timeout(QUICK_TIMEOUT_MS),\n    });\n  } catch (error) {\n    if (error.name === 'TimeoutError') {\n      throw new ApiError(\n        'cloudhop ui is not responding.',\n        'Is it paused in your terminal (Ctrl-Z)? Run `fg` there, or stop it and run `cloudhop ui` again.',\n      );\n    }\n    throw new ApiError(\n      'cloudhop ui is not running.',\n      'Run `cloudhop ui` again and open the new link it prints.',\n    );\n  }\n  const data = await response.json().catch(() => ({}));\n  if (!response.ok)\n    throw new ApiError(data.error ?? `Request failed (${response.status}).`, data.hint);\n  return data;\n}\n\nfunction toast(message, { error = false, hint } = {}) {\n  const el = h(\n    'div',\n    { class: `toast${error ? ' error' : ''}` },\n    message,\n    hint && h('small', {}, hint),\n  );\n  $toasts.append(el);\n  setTimeout(() => el.remove(), error ? 9000 : 4000);\n}\n\nconst fail = (error) => toast(error.message, { error: true, hint: error.hint });\n\n/** Disables a button while its action runs. */\nasync function busy(button, action) {\n  button.disabled = true;\n  try {\n    return await action();\n  } finally {\n    button.disabled = false;\n  }\n}\n\nasync function refresh() {\n  try {\n    state = await api('GET', '/api/state');\n    render();\n    checkDoctor();\n  } catch (error) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Cannot reach cloudhop'),\n        h('p', {}, error.message, error.hint ? ` ${error.hint}` : ''),\n      ),\n    );\n  }\n}\n\nasync function checkDoctor() {\n  try {\n    const entries = await api('GET', '/api/doctor');\n    const problems = entries.filter((e) => !e.installed || e.outdated);\n    document.getElementById('doctor')?.remove();\n    if (problems.length === 0) return;\n    $main.prepend(\n      h(\n        'div',\n        { class: 'notice', id: 'doctor' },\n        ...problems.map((e) =>\n          h(\n            'div',\n            {},\n            e.installed\n              ? `${e.cli} ${e.version} is older than ${e.minVersion}. `\n              : `${e.cli} is not installed, so aliases cannot run commands yet. `,\n            'Run ',\n            h('code', {}, 'cloudhop doctor'),\n            ' in a terminal to install it.',\n          ),\n        ),\n      ),\n    );\n  } catch {}\n}\n\n// ---------- main view ----------\n\nfunction render() {\n  const enabled = state.enabledProviders;\n  $addSource.hidden = enabled.length === 0;\n  $nav.hidden = enabled.length === 0;\n  if (enabled.length === 0) return renderChooseClouds();\n  for (const link of $nav.querySelectorAll('a')) {\n    if (link.dataset.page === route) link.setAttribute('aria-current', 'page');\n    else link.removeAttribute('aria-current');\n  }\n  document.title = `${PAGES[route]} \xB7 cloudhop`;\n  const pages = {\n    aliases: aliasesPage,\n    sources: sourcesPage,\n    assistants: assistantsPage,\n    tools: toolsPage,\n  };\n  $main.replaceChildren(...pages[route]());\n  if (route === 'assistants') loadAssistants();\n  if (route === 'tools') loadTools();\n}\n\nfunction pageHead(title, subtitle, ...actions) {\n  return h(\n    'div',\n    { class: 'page-head' },\n    h('div', {}, h('h1', {}, title), subtitle ? h('p', {}, subtitle) : null),\n    h('div', { class: 'actions' }, actions),\n  );\n}\n\nfunction firstSourceHero() {\n  return h(\n    'div',\n    { class: 'hero' },\n    h('h2', {}, 'Add your first account'),\n    h(\n      'p',\n      {},\n      'Add a company SSO portal or a personal account. cloudhop signs you in, finds every account and role you can use, and lets you give each one a short alias.',\n    ),\n    h('button', { class: 'primary', onclick: () => openAddSource() }, '+ Add source'),\n  );\n}\n\n// ---------- Aliases page ----------\n\nfunction aliasesPage() {\n  if (state.sources.length === 0) return [firstSourceHero()];\n  if (aliasFilter.source && !state.sources.some((s) => s.id === aliasFilter.source))\n    aliasFilter.source = '';\n\n  const addAliases = () => {\n    const source =\n      state.sources.find((s) => s.id === aliasFilter.source) ??\n      (state.sources.length === 1 ? state.sources[0] : undefined);\n    if (source) openAliasPicker(source);\n    else openSourceChooser();\n  };\n  const head = pageHead(\n    'Aliases',\n    'Each alias is one account, role and region. Run it with hop <alias>.',\n    h('button', { onclick: addAliases }, '+ Aliases'),\n  );\n  if (state.aliases.length === 0) {\n    return [\n      head,\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'No aliases yet'),\n        h('p', {}, 'Pick the accounts and roles you use and give each one a short name.'),\n        h('button', { class: 'primary', onclick: addAliases }, 'Pick accounts'),\n      ),\n    ];\n  }\n\n  const rows = h('tbody', { id: 'alias-rows' });\n  const count = h('span', { class: 'count' });\n  const fill = () => {\n    const words = aliasFilter.text.toLowerCase().split(/\\s+/).filter(Boolean);\n    const visible = state.aliases.filter((a) => {\n      if (aliasFilter.source && a.source !== aliasFilter.source) return false;\n      if (aliasFilter.prodOnly && !a.prod) return false;\n      const text = `${a.name} ${a.label ?? a.target} ${a.region ?? ''} ${a.source}`.toLowerCase();\n      return words.every((w) => text.includes(w));\n    });\n    rows.replaceChildren(\n      ...(visible.length\n        ? visible.map(aliasRow)\n        : [\n            h(\n              'tr',\n              {},\n              h('td', { colspan: '5', class: 'empty' }, 'No alias matches these filters.'),\n            ),\n          ]),\n    );\n    count.textContent = `${visible.length} of ${state.aliases.length}`;\n  };\n\n  const search = h('input', {\n    type: 'search',\n    placeholder: 'Filter: name, account, role or region',\n    value: aliasFilter.text,\n    'aria-label': 'Filter aliases',\n    oninput: (e) => {\n      aliasFilter.text = e.currentTarget.value;\n      fill();\n    },\n  });\n  const sourceSelect = h(\n    'select',\n    {\n      'aria-label': 'Source',\n      onchange: (e) => {\n        aliasFilter.source = e.currentTarget.value;\n        fill();\n      },\n    },\n    h('option', { value: '' }, 'All sources'),\n    state.sources.map((s) =>\n      h('option', { value: s.id, selected: s.id === aliasFilter.source }, s.id),\n    ),\n  );\n  const prodOnly = h(\n    'label',\n    { class: 'prod-toggle' },\n    h('input', {\n      type: 'checkbox',\n      checked: aliasFilter.prodOnly,\n      onchange: (e) => {\n        aliasFilter.prodOnly = e.currentTarget.checked;\n        fill();\n      },\n    }),\n    'Production only',\n  );\n\n  const table = h(\n    'table',\n    { class: 'aliases' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Alias'),\n        h('th', {}, 'Source'),\n        h('th', {}, 'Region'),\n        h('th', {}, 'Account / role'),\n        h('th'),\n      ),\n    ),\n    rows,\n  );\n  fill();\n  return [\n    head,\n    h(\n      'div',\n      { class: 'toolbar' },\n      search,\n      sourceSelect,\n      prodOnly,\n      h('div', { class: 'spacer' }),\n      count,\n    ),\n    h('section', { class: 'card' }, table),\n  ];\n}\n\n/** When several sources exist, ask which one to pick accounts from. */\nfunction openSourceChooser() {\n  showDialog(\n    'Add aliases from',\n    h(\n      'div',\n      { class: 'choices' },\n      state.sources.map((source) =>\n        h(\n          'button',\n          { class: 'choice', onclick: () => openAliasPicker(source) },\n          h(\n            'span',\n            {},\n            h('strong', {}, source.id),\n            h('small', {}, source.settings.startUrl ?? source.kindLabel),\n          ),\n        ),\n      ),\n    ),\n  );\n}\n\n// ---------- Sources page ----------\n\nfunction sourcesPage() {\n  const head = pageHead('Sources', 'The SSO portals and personal accounts you sign in to.');\n  if (state.sources.length === 0) return [head, firstSourceHero()];\n  return [head, ...state.sources.map(sourceCard)];\n}\n\n// ---------- AI assistants page ----------\n\nfunction assistantsPage() {\n  return [assistantsCard()];\n}\n\n// ---------- Tools page ----------\n\nfunction snippet(command) {\n  return h(\n    'div',\n    { class: 'snippet' },\n    h('code', {}, command),\n    h(\n      'button',\n      {\n        class: 'link',\n        title: 'Copy',\n        'aria-label': `Copy ${command}`,\n        onclick: () =>\n          navigator.clipboard\n            ?.writeText(command)\n            .then(() => toast('Copied.'))\n            .catch(() =>\n              toast('Copy it by hand: the browser blocked the clipboard.', { error: true }),\n            ),\n      },\n      'Copy',\n    ),\n  );\n}\n\nfunction toolCard(title, text, ...commands) {\n  return h(\n    'section',\n    { class: 'card' },\n    h('div', { class: 'card-head' }, h('h2', {}, title)),\n    h(\n      'div',\n      { class: 'card-body padded' },\n      h('p', { class: 'card-help' }, text),\n      commands.map(snippet),\n    ),\n  );\n}\n\nfunction toolsPage() {\n  const sample = state.aliases[0]?.name ?? 'acme-dev';\n  return [\n    pageHead('Tools', 'More ways to use cloudhop from your terminal.'),\n    h(\n      'section',\n      { class: 'card', id: 'tools-cli' },\n      h('div', { class: 'card-head' }, h('h2', {}, 'Cloud CLIs')),\n      h('div', { class: 'card-body padded' }, h('p', { class: 'card-help' }, 'Checking\u2026')),\n    ),\n    toolCard(\n      'Shell integration',\n      'Pick aliases from a list, tab-complete them, and use one in your shell so plain aws and Terraform work without hop.',\n      'cloudhop shell install',\n      `cloudhop use ${sample}`,\n      'hop',\n    ),\n    toolCard(\n      'Run in many accounts',\n      'Run one command in many aliases at once: names, lists, wildcards or /regex/. It asks before running.',\n      `cloudhop each '${sample.split('-')[0]}-*' -- s3 ls`,\n    ),\n    toolCard(\n      'Share with your team',\n      'Export your portals and aliases (no secrets) and let teammates import them in one command.',\n      'cloudhop team export --out team.yaml',\n      'cloudhop team import team.yaml',\n    ),\n  ];\n}\n\nasync function loadTools() {\n  const card = document.querySelector('#tools-cli .card-body');\n  if (!card) return;\n  try {\n    const entries = await api('GET', '/api/doctor');\n    card.replaceChildren(\n      ...entries.map((e) =>\n        h(\n          'div',\n          { class: 'tool-row' },\n          h('span', { class: `badge ${e.installed && !e.outdated ? 'valid' : 'expired'}` }, e.cli),\n          h(\n            'span',\n            {},\n            !e.installed\n              ? 'Not installed.'\n              : e.outdated\n                ? `${e.version} is older than ${e.minVersion}.`\n                : `Version ${e.version}.`,\n          ),\n          e.installed && !e.outdated ? null : snippet('cloudhop doctor'),\n        ),\n      ),\n    );\n  } catch (error) {\n    card.replaceChildren(h('p', { class: 'card-help' }, error.message));\n  }\n}\n\n// ---------- AI assistants ----------\n\nlet assistantScope = 'user';\ntry {\n  assistantScope =\n    localStorage.getItem('cloudhop-assistant-scope') === 'project' ? 'project' : 'user';\n} catch {}\nlet assistantsData;\n\nconst SKILL_TEXT = {\n  current: ['valid', 'Up to date'],\n  outdated: ['refreshable', 'Outdated'],\n  modified: ['refreshable', 'Edited by you'],\n  missing: ['', 'Not installed'],\n};\nconst MCP_TEXT = { registered: 'On', missing: 'Off', unknown: 'Check in the app' };\n\nfunction assistantsCard() {\n  return h('section', { class: 'card', id: 'assistants', hidden: true });\n}\n\nasync function loadAssistants() {\n  try {\n    assistantsData = await api('GET', '/api/assistants');\n    renderAssistants();\n  } catch {\n    document.getElementById('assistants')?.remove();\n  }\n}\n\nfunction setAssistantScope(scope) {\n  assistantScope = scope;\n  try {\n    localStorage.setItem('cloudhop-assistant-scope', scope);\n  } catch {}\n  renderAssistants();\n}\n\nfunction assistantAction(label, run, { danger = false, confirmText } = {}) {\n  return h(\n    'button',\n    {\n      class: danger ? 'danger' : undefined,\n      onclick: (e) => {\n        if (confirmText && !confirm(confirmText)) return;\n        busy(e.currentTarget, async () => {\n          try {\n            await run();\n          } catch (error) {\n            fail(error);\n          }\n          await loadAssistants();\n        });\n      },\n    },\n    label,\n  );\n}\n\nfunction reportInstall(results) {\n  for (const r of results) {\n    if (r.mcp === 'manual') {\n      toast(`${r.name}: skill installed. Add the MCP server by hand.`, { hint: r.mcpManual });\n    } else {\n      toast(`${r.name} now knows cloudhop. Start a new chat so it picks it up.`);\n    }\n  }\n}\n\nfunction renderAssistants() {\n  const el = document.getElementById('assistants');\n  if (!el || !assistantsData) return;\n  const rows = assistantScope === 'user' ? assistantsData.user : assistantsData.projectScope;\n  const scope = assistantScope;\n  const install = (tools) =>\n    api('POST', '/api/assistants', { tools, scope, mcp: true }).then((r) =>\n      reportInstall(r.results),\n    );\n  const missingDetected = rows\n    .filter((r) => r.detected && r.skill === 'missing')\n    .map((r) => r.assistant);\n\n  const seg = h(\n    'div',\n    { class: 'seg', role: 'group', 'aria-label': 'Where' },\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'user'), onclick: () => setAssistantScope('user') },\n      'For me',\n    ),\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'project'), onclick: () => setAssistantScope('project') },\n      'This project',\n    ),\n  );\n\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, 'AI assistants'),\n    h(\n      'span',\n      { class: 'meta' },\n      scope === 'user'\n        ? 'Installed in your home folder, for every project'\n        : assistantsData.project,\n    ),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      seg,\n      missingDetected.length > 1\n        ? assistantAction('Install for all detected', () => install(missingDetected))\n        : null,\n    ),\n  );\n\n  const table = h(\n    'table',\n    { class: 'assistants' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Assistant'),\n        h('th', {}, 'Skill'),\n        h('th', {}, 'MCP server'),\n        h('th'),\n      ),\n    ),\n    h(\n      'tbody',\n      {},\n      rows.map((r) => {\n        const [badgeClass, skillText] = SKILL_TEXT[r.skill];\n        const actions = [];\n        if (r.skill === 'missing')\n          actions.push(assistantAction('Install', () => install([r.assistant])));\n        if (r.skill === 'outdated') {\n          actions.push(\n            assistantAction('Update', () =>\n              api('POST', '/api/assistants/update', {}).then(() =>\n                toast(`${r.name}: skill updated.`),\n              ),\n            ),\n          );\n        }\n        if (r.skill === 'modified') {\n          actions.push(\n            assistantAction(\n              'Replace',\n              () =>\n                api('POST', '/api/assistants/update', { force: true }).then(() =>\n                  toast('Edited skills replaced.'),\n                ),\n              {\n                confirmText: 'Replace your edited copies with the current cloudhop skill?',\n              },\n            ),\n          );\n        }\n        if (r.skill !== 'missing' || r.mcp === 'registered') {\n          actions.push(\n            assistantAction(\n              'Remove',\n              () => api('POST', '/api/assistants/remove', { tools: [r.assistant], scope }),\n              {\n                danger: true,\n                confirmText: `Remove the cloudhop skill and MCP server from ${r.name}?`,\n              },\n            ),\n          );\n        }\n        return h(\n          'tr',\n          {},\n          h(\n            'td',\n            { class: 'alias' },\n            r.name,\n            r.detected ? null : h('small', { class: 'muted-inline' }, ' not detected'),\n          ),\n          h('td', {}, h('span', { class: `badge ${badgeClass}`, title: r.skillPath }, skillText)),\n          h('td', {}, r.skill === 'missing' && r.mcp !== 'registered' ? '' : MCP_TEXT[r.mcp]),\n          h(\n            'td',\n            { style: 'text-align:right' },\n            h('div', { class: 'actions', style: 'justify-content:flex-end' }, actions),\n          ),\n        );\n      }),\n    ),\n  );\n\n  el.replaceChildren(\n    head,\n    h(\n      'div',\n      { class: 'card-body' },\n      h(\n        'p',\n        { class: 'card-help' },\n        'Teach your AI assistant to use cloudhop: it asks you which alias to work with, runs commands with hop, and confirms before changing anything. Includes the cloudhop MCP server.',\n      ),\n      table,\n    ),\n  );\n  el.hidden = false;\n}\n\nfunction renderChooseClouds() {\n  const boxes = state.providers.map((p) =>\n    h(\n      'label',\n      { class: 'choice' },\n      h('input', { type: 'checkbox', value: p.id, checked: true }),\n      h('span', {}, p.name),\n    ),\n  );\n  const save = h(\n    'button',\n    {\n      class: 'primary',\n      onclick: (e) =>\n        busy(e.currentTarget, async () => {\n          const ids = boxes\n            .map((b) => b.querySelector('input'))\n            .filter((i) => i.checked)\n            .map((i) => i.value);\n          await api('PUT', '/api/providers', { enabled: ids }).catch(fail);\n          await refresh();\n        }),\n    },\n    'Continue',\n  );\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Which clouds do you use?'),\n      h('p', {}, 'Azure and Google Cloud are coming soon.'),\n      h(\n        'div',\n        { class: 'choices', style: 'max-width:320px;margin:0 auto 16px;text-align:left' },\n        boxes,\n      ),\n      save,\n    ),\n  );\n}\n\nfunction sourceCard(source) {\n  const aliases = state.aliases.filter((a) => a.source === source.id);\n  const where = source.settings.startUrl ?? source.kindLabel;\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, source.id),\n    h('span', { class: `badge ${source.session}` }, SESSION_TEXT[source.session] ?? source.session),\n    h('span', { class: 'meta' }, `${source.providerName} \xB7 ${where}`),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      h('button', { onclick: () => openAliasPicker(source) }, '+ Aliases'),\n      h(\n        'button',\n        {\n          title: 'Sign in again and refresh its accounts',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              toast('Opening the browser to sign in\u2026');\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/login`,\n              ).catch(fail);\n              if (report)\n                toast(`${source.id}: signed in, ${report.targets.length} account/role(s).`);\n              await refresh();\n            }),\n        },\n        'Sign in',\n      ),\n      h(\n        'button',\n        {\n          title: 'Refresh the accounts and roles you have access to',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/sync`,\n              ).catch(fail);\n              if (report) toast(syncMessage(source.id, report));\n              await refresh();\n            }),\n        },\n        'Sync',\n      ),\n      h(\n        'button',\n        {\n          class: 'danger',\n          onclick: (e) => {\n            const count = aliases.length;\n            const message = `Remove \"${source.id}\"${count ? ` and its ${count} alias(es)` : ''}?`;\n            if (!confirm(message)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/sources/${encodeURIComponent(source.id)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        'Remove',\n      ),\n    ),\n  );\n\n  const prodCount = aliases.filter((a) => a.prod).length;\n  const body =\n    aliases.length === 0\n      ? h(\n          'div',\n          { class: 'empty' },\n          'No aliases yet. ',\n          h(\n            'button',\n            { class: 'primary', onclick: () => openAliasPicker(source) },\n            'Pick accounts',\n          ),\n        )\n      : h(\n          'div',\n          { class: 'source-summary' },\n          h(\n            'span',\n            {},\n            `${aliases.length} alias(es)`,\n            prodCount ? h('span', { class: 'prod-tag' }, `${prodCount} PROD`) : null,\n          ),\n          h(\n            'button',\n            { class: 'link', onclick: () => go('aliases', { source: source.id }) },\n            'View aliases \u2192',\n          ),\n        );\n  return h('section', { class: 'card' }, head, h('div', { class: 'card-body' }, body));\n}\n\nfunction syncMessage(id, report) {\n  const parts = [`${report.targets.length} available`];\n  if (report.added) parts.push(`${report.added} new`);\n  if (report.removed) parts.push(`${report.removed} removed`);\n  const orphaned = report.orphanedAliases.length\n    ? ` No longer available: ${report.orphanedAliases.join(', ')}.`\n    : '';\n  return `${id}: ${parts.join(', ')}.${orphaned}`;\n}\n\nfunction aliasRow(alias) {\n  const input = h('input', {\n    value: alias.region ?? '',\n    'aria-label': `Region for ${alias.name}`,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  const save = h('button', { hidden: true }, 'Save');\n  const commit = () =>\n    busy(save, async () => {\n      const region = input.value.trim();\n      const done = await api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, {\n        region,\n      }).catch(fail);\n      if (done) toast(`${alias.name} now runs in ${region}.`);\n      await refresh();\n    });\n  input.addEventListener('input', () => {\n    save.hidden = input.value.trim() === (alias.region ?? '');\n  });\n  input.addEventListener('keydown', (e) => {\n    if (e.key === 'Enter' && !save.hidden) commit();\n    if (e.key === 'Escape') {\n      input.value = alias.region ?? '';\n      save.hidden = true;\n    }\n  });\n  save.addEventListener('click', commit);\n\n  const patch = (body, message) =>\n    api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, body)\n      .then(() => message && toast(message))\n      .catch(fail)\n      .then(refresh);\n  const iconButton = (label, title, onclick, extra = {}) =>\n    h('button', { class: 'link', title, 'aria-label': title, onclick, ...extra }, label);\n\n  const actions = h(\n    'div',\n    { class: 'row-actions' },\n    h(\n      'button',\n      {\n        title: `Open the AWS console as ${alias.name}, already signed in`,\n        disabled: alias.missing,\n        onclick: (e) =>\n          busy(e.currentTarget, async () => {\n            const result = await api(\n              'POST',\n              `/api/aliases/${encodeURIComponent(alias.name)}/console`,\n              {},\n            ).catch(fail);\n            if (result) {\n              toast(\n                result.via === 'signed-in'\n                  ? `Opened the console for ${alias.name}.`\n                  : result.via === 'portal'\n                    ? `Opened ${alias.name} through the SSO portal.`\n                    : `Opened the console sign-in page for ${alias.name}.`,\n              );\n            }\n          }),\n      },\n      'Console',\n    ),\n    h(\n      'label',\n      { class: 'prod-toggle', title: 'Production: hop and AI assistants ask before any change' },\n      h('input', {\n        type: 'checkbox',\n        checked: alias.prod,\n        'aria-label': `${alias.name} is production`,\n        onchange: (e) =>\n          patch(\n            { prod: e.currentTarget.checked },\n            e.currentTarget.checked\n              ? `${alias.name} is now production.`\n              : `${alias.name} is no longer production.`,\n          ),\n      }),\n      'Prod',\n    ),\n    iconButton('\u270E', `Rename ${alias.name}`, () => {\n      const to = prompt(`New name for \"${alias.name}\"`, alias.name)?.trim();\n      if (to && to !== alias.name) patch({ name: to }, `${alias.name} is now ${to}.`);\n    }),\n    iconButton(\n      '\u2715',\n      `Remove ${alias.name}`,\n      (e) => {\n        if (!confirm(`Remove alias \"${alias.name}\"?`)) return;\n        busy(e.currentTarget, async () => {\n          await api('DELETE', `/api/aliases/${encodeURIComponent(alias.name)}`).catch(fail);\n          await refresh();\n        });\n      },\n      { class: 'link danger-hover' },\n    ),\n  );\n\n  return h(\n    'tr',\n    { class: alias.prod ? 'prod' : undefined },\n    h(\n      'td',\n      { class: 'alias', title: `hop ${alias.name} <command>` },\n      alias.name,\n      alias.prod ? h('span', { class: 'prod-tag' }, 'PROD') : null,\n    ),\n    h('td', { class: 'muted' }, alias.source),\n    h('td', {}, h('div', { class: 'region' }, input, save)),\n    h(\n      'td',\n      {},\n      alias.missing\n        ? h('span', { class: 'missing' }, `${alias.target} (no longer available)`)\n        : alias.label,\n    ),\n    h('td', { style: 'text-align:right' }, actions),\n  );\n}\n\n// ---------- dialogs ----------\n\nfunction showDialog(title, body, footer) {\n  $dialog.replaceChildren(\n    h(\n      'div',\n      { class: 'dlg-head' },\n      h('h2', {}, title),\n      h('button', { class: 'link', 'aria-label': 'Close', onclick: () => $dialog.close() }, '\u2715'),\n    ),\n    h('div', { class: 'dlg-body' }, body),\n    footer ? h('div', { class: 'dlg-foot' }, footer) : null,\n  );\n  if (!$dialog.open) $dialog.showModal();\n}\n\nfunction suggestSourceId(settings, kind) {\n  const host = /^https:\\/\\/([^./]+)\\./.exec(settings.startUrl ?? '')?.[1];\n  return slug(host ?? (kind === 'console-login' ? 'personal' : 'main'));\n}\n\nconst slug = (text) =>\n  text\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 63) || 'main';\n\n/** `previous` refills the form after a failed sign-in: { provider, kind, id, settings, error }. */\nfunction openAddSource(previous) {\n  const providers = state.providers.filter((p) => state.enabledProviders.includes(p.id));\n  let provider = providers.find((p) => p.id === previous?.provider) ?? providers[0];\n  let kind = provider.kinds.find((k) => k.kind === previous?.kind) ?? provider.kinds[0];\n\n  const form = h('form', { onsubmit: (e) => e.preventDefault() });\n  const nameInput = h('input', {\n    id: 'f-name',\n    required: true,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  let nameTouched = Boolean(previous);\n  nameInput.addEventListener('input', () => {\n    nameTouched = true;\n  });\n\n  const fieldInputs = {};\n  const fieldsBox = h('div');\n  const nameLabel = h('label', { for: 'f-name' });\n\n  function updateSuggestion() {\n    if (nameTouched) return;\n    const settings = Object.fromEntries(\n      Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n    );\n    const taken = new Set(state.sources.map((s) => s.id));\n    let id = suggestSourceId(settings, kind.kind);\n    for (let i = 2; taken.has(id); i++) id = `${suggestSourceId(settings, kind.kind)}-${i}`;\n    nameInput.value = id;\n  }\n\n  function renderFields() {\n    for (const key of Object.keys(fieldInputs)) delete fieldInputs[key];\n    fieldsBox.replaceChildren(\n      ...kind.fields.map((f) => {\n        const input = h('input', {\n          id: `f-${f.key}`,\n          placeholder: f.placeholder ?? f.defaultValue ?? '',\n          value: previous?.settings?.[f.key] ?? f.defaultValue ?? '',\n          required: true,\n          class: 'mono',\n          spellcheck: 'false',\n          oninput: updateSuggestion,\n        });\n        fieldInputs[f.key] = input;\n        return h('div', { class: 'field' }, h('label', { for: input.id }, f.label), input);\n      }),\n    );\n    nameLabel.textContent = kind.nameLabel ?? 'Short name for this source';\n    updateSuggestion();\n  }\n\n  const providerSelect =\n    providers.length > 1\n      ? h(\n          'div',\n          { class: 'field' },\n          h('label', { for: 'f-provider' }, 'Cloud'),\n          h(\n            'select',\n            {\n              id: 'f-provider',\n              onchange: (e) => {\n                provider = providers.find((p) => p.id === e.target.value);\n                kind = provider.kinds[0];\n                renderKinds();\n              },\n            },\n            providers.map((p) => h('option', { value: p.id, selected: p === provider }, p.name)),\n          ),\n        )\n      : null;\n\n  const kindsBox = h('div', { class: 'choices' });\n  function renderKinds() {\n    kindsBox.replaceChildren(\n      ...provider.kinds.map((k) =>\n        h(\n          'label',\n          { class: 'choice' },\n          h('input', {\n            type: 'radio',\n            name: 'kind',\n            value: k.kind,\n            checked: k === kind,\n            onchange: () => {\n              kind = k;\n              renderFields();\n            },\n          }),\n          h('span', {}, h('strong', {}, k.label), k.hint ? h('small', {}, k.hint) : null),\n        ),\n      ),\n    );\n    renderFields();\n  }\n\n  form.append(\n    previous?.error\n      ? h(\n          'div',\n          { class: 'notice error' },\n          h('strong', {}, 'Could not sign in, so nothing was saved. '),\n          previous.error.message,\n          previous.error.hint ? h('div', { class: 'help' }, previous.error.hint) : null,\n        )\n      : '',\n    providerSelect ?? '',\n    h('div', { class: 'field' }, h('label', {}, 'What do you want to add?')),\n    kindsBox,\n    fieldsBox,\n    h(\n      'div',\n      { class: 'field' },\n      nameLabel,\n      nameInput,\n      h(\n        'span',\n        { class: 'help' },\n        'Lowercase letters, numbers and dashes. You will see it in ',\n        h('code', {}, 'cloudhop ls'),\n        '.',\n      ),\n    ),\n  );\n  renderKinds();\n  if (previous) nameInput.value = previous.id;\n\n  const submit = h('button', { class: 'primary', type: 'submit' }, 'Add and sign in');\n  form.addEventListener('submit', async () => {\n    if (!form.reportValidity()) return;\n    const body = {\n      provider: provider.id,\n      kind: kind.kind,\n      id: nameInput.value.trim(),\n      settings: Object.fromEntries(\n        Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n      ),\n    };\n    showDialog(\n      'Sign in',\n      h(\n        'div',\n        { class: 'waiting' },\n        h('div', { class: 'spinner' }),\n        h('strong', {}, 'Finish signing in in the browser tab that just opened.'),\n        h('p', { class: 'help' }, 'This page continues on its own once you approve the request.'),\n      ),\n    );\n    try {\n      const report = await api('POST', '/api/sources', body);\n      await refresh();\n      const source = state.sources.find((s) => s.id === body.id);\n      toast(`Signed in to ${body.id}. ${report.targets.length} account/role(s) found.`);\n      openAliasPicker(source, report.targets);\n    } catch (error) {\n      // Nothing was saved: reopen the form with what was typed so it can be fixed.\n      await refresh();\n      openAddSource({ ...body, error });\n    }\n  });\n\n  showDialog('Add source', form, [\n    h('button', { type: 'button', onclick: () => $dialog.close() }, 'Cancel'),\n    submit,\n  ]);\n  submit.setAttribute('form', 'add-form');\n  form.id = 'add-form';\n}\n\nasync function openAliasPicker(source, preloaded) {\n  let targets = preloaded;\n  if (!targets) {\n    showDialog(\n      `Aliases for ${source.id}`,\n      h('div', { class: 'waiting' }, h('div', { class: 'spinner' }), 'Loading accounts\u2026'),\n    );\n    try {\n      targets = (await api('GET', `/api/sources/${encodeURIComponent(source.id)}/targets`)).targets;\n    } catch (error) {\n      $dialog.close();\n      return fail(error);\n    }\n  }\n\n  const used = new Map(\n    state.aliases.filter((a) => a.source === source.id).map((a) => [a.target, a.name]),\n  );\n  const taken = new Set(state.aliases.map((a) => a.name));\n  const defaultRegion = source.settings.region ?? '';\n  const filter = h('input', {\n    type: 'search',\n    placeholder: `Filter ${targets.length} account/role(s)\u2026`,\n    style: 'width:100%;margin-bottom:12px',\n  });\n\n  const rows = targets.map((t) => {\n    const existing = used.get(t.id);\n    let name = t.suggestedAlias;\n    for (let i = 2; taken.has(name); i++) name = `${t.suggestedAlias}-${i}`;\n    const check = h('input', {\n      type: 'checkbox',\n      disabled: Boolean(existing),\n      'aria-label': t.label,\n    });\n    const aliasInput = h('input', {\n      value: name,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Alias for ${t.label}`,\n      placeholder: 'alias',\n    });\n    const regionInput = h('input', {\n      value: defaultRegion,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Region for ${t.label}`,\n      placeholder: 'region',\n    });\n    // Only the checkbox and its text sit in the label, so clicking the inputs never toggles it.\n    const el = h(\n      'div',\n      { class: 'target' },\n      h(\n        'label',\n        { class: 'pick' },\n        check,\n        h(\n          'span',\n          {},\n          t.label,\n          existing ? h('small', { class: 'already' }, `Already: ${existing}`) : null,\n        ),\n      ),\n      h('div', { class: 'inputs' }, aliasInput, regionInput),\n    );\n    return { target: t, el, check, aliasInput, regionInput };\n  });\n\n  filter.addEventListener('input', () => {\n    const q = filter.value.trim().toLowerCase();\n    for (const row of rows) row.el.hidden = q !== '' && !row.target.label.toLowerCase().includes(q);\n  });\n\n  const save = h('button', { class: 'primary' }, 'Create aliases');\n  save.addEventListener('click', () =>\n    busy(save, async () => {\n      const aliases = rows\n        .filter((r) => r.check.checked)\n        .map((r) => ({\n          source: source.id,\n          target: r.target.id,\n          name: r.aliasInput.value.trim(),\n          region: r.regionInput.value.trim(),\n        }));\n      if (aliases.length === 0) return toast('Pick at least one account/role.', { error: true });\n      try {\n        const result = await api('POST', '/api/aliases', { aliases });\n        $dialog.close();\n        toast(`Created ${result.created.join(', ')}. Try: hop ${result.created[0]}`);\n        await refresh();\n      } catch (error) {\n        fail(error);\n      }\n    }),\n  );\n\n  const body =\n    targets.length === 0\n      ? h('p', { class: 'empty' }, 'This source has no accounts or roles assigned to you.')\n      : h(\n          'div',\n          {},\n          filter,\n          h(\n            'div',\n            { class: 'targets' },\n            rows.map((r) => r.el),\n          ),\n        );\n  showDialog(`Aliases for ${source.id}`, body, [\n    h('span', { class: 'note' }, 'Check an account/role, then name its alias and region.'),\n    h('button', { onclick: () => $dialog.close() }, 'Cancel'),\n    targets.length ? save : null,\n  ]);\n}\n\n$addSource.addEventListener('click', () => openAddSource());\n\nif (!token) {\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Open the link from your terminal'),\n      h('p', {}, 'Run cloudhop ui and open the link it prints. It includes a one-time access key.'),\n    ),\n  );\n} else {\n  readRoute();\n  refresh();\n}\n";
 
 // ../ui/src/assets/index.html
 var assets_default = `<!doctype html>
@@ -11762,9 +13573,29 @@ var assets_default = `<!doctype html>
       }
       /* Fixed columns so every source's table lines up with the others. */
       table { width: 100%; border-collapse: collapse; table-layout: fixed; }
-      th:nth-child(1) { width: 26%; }
-      th:nth-child(2) { width: 190px; }
-      th:nth-child(4) { width: 56px; }
+      table.aliases th:nth-child(1) { width: 22%; }
+      table.aliases th:nth-child(2) { width: 15%; }
+      table.aliases th:nth-child(3) { width: 180px; }
+      table.aliases th:nth-child(5) { width: 264px; }
+      td.muted { color: var(--muted); font-size: 14px; }
+      .nav { display: flex; gap: 4px; margin-left: 12px; }
+      .nav a { color: var(--muted); text-decoration: none; font-size: 14px; font-weight: 500; padding: 6px 12px; border-radius: 8px; }
+      .nav a:hover { color: var(--text); background: var(--surface-2); }
+      .nav a[aria-current="page"] { color: var(--accent-strong); background: var(--accent-soft); font-weight: 600; }
+      .page-head { display: flex; align-items: flex-end; gap: 16px; margin: 4px 0 16px; flex-wrap: wrap; }
+      .page-head > div:first-child { flex: 1; min-width: 220px; }
+      .page-head h1 { font-size: 22px; margin: 0; letter-spacing: -0.01em; }
+      .page-head p { margin: 4px 0 0; color: var(--muted); font-size: 14px; }
+      .toolbar { display: flex; gap: 10px; align-items: center; flex-wrap: wrap; margin-bottom: 12px; }
+      .toolbar input[type="search"] { flex: 1 1 260px; }
+      .toolbar .count { color: var(--muted); font-size: 13px; }
+      .source-summary { display: flex; align-items: center; gap: 12px; padding: 12px 16px; color: var(--muted); }
+      .card-body.padded { padding: 4px 16px 14px; }
+      .snippet { display: flex; align-items: center; gap: 8px; background: var(--surface-2); border: 1px solid var(--border); border-radius: 8px; padding: 6px 6px 6px 12px; margin-bottom: 8px; }
+      .snippet code { flex: 1; overflow-x: auto; white-space: nowrap; }
+      .tool-row { display: flex; align-items: center; gap: 12px; flex-wrap: wrap; padding: 6px 0; }
+      .tool-row .snippet { margin: 0; flex: 1 1 220px; }
+      button.choice { width: 100%; text-align: left; background: var(--surface); }
       td { overflow-wrap: anywhere; }
       th {
         text-align: left;
@@ -11877,14 +13708,40 @@ var assets_default = `<!doctype html>
         margin-bottom: 18px;
       }
       .notice.error { border-left-color: var(--bad); }
+      .row-actions { display: flex; gap: 6px; align-items: center; justify-content: flex-end; white-space: nowrap; }
+      .prod-toggle { display: inline-flex; align-items: center; gap: 4px; font-size: 13px; color: var(--muted); cursor: pointer; }
+      .prod-tag { display: inline-block; white-space: nowrap; margin-left: 8px; font-size: 11px; font-weight: 700; letter-spacing: 0.04em; color: var(--bad); border: 1px solid currentColor; border-radius: 4px; padding: 0 4px; vertical-align: 1px; }
+      tr.prod td:first-child { box-shadow: inset 3px 0 0 var(--bad); }
+      button.link.danger-hover:hover { color: var(--bad); }
+      .seg { display: inline-flex; border: 1px solid var(--border); border-radius: 8px; overflow: hidden; }
+      .seg button { border: 0; border-radius: 0; }
+      .seg button + button { border-left: 1px solid var(--border); }
+      .seg button[aria-pressed="true"] { background: var(--accent-soft); color: var(--accent-strong); font-weight: 600; }
+      .card-help { color: var(--muted); font-size: 14px; margin: 10px 16px 6px; }
+      .card-body.padded .card-help { margin: 8px 0 10px; }
+      .muted-inline { color: var(--muted); font-weight: 400; font-size: 12px; }
+      table.assistants th:nth-child(2) { width: 170px; }
+      table.assistants th:nth-child(3) { width: 140px; }
+      table.assistants th:nth-child(4) { width: 230px; }
       @media (max-width: 640px) {
         .tagline { display: none; }
-        th:nth-child(3), td:nth-child(3) { display: none; }
+        .nav { margin-left: 4px; overflow-x: auto; }
+        .nav a { padding: 6px 8px; }
+        table.aliases th:nth-child(2), table.aliases td:nth-child(2),
+        table.aliases th:nth-child(4), table.aliases td:nth-child(4),
+        table.assistants th:nth-child(3), table.assistants td:nth-child(3) { display: none; }
         td, th { padding: 8px 10px; }
         td.alias { white-space: normal; overflow-wrap: anywhere; }
         .region input { width: 96px; }
-        th:nth-child(1) { width: auto; }
-        th:nth-child(2) { width: 124px; }
+        table.aliases th:nth-child(1) { width: auto; }
+        table.aliases th:nth-child(3) { width: 124px; }
+        table.aliases th:nth-child(5) { width: 132px; }
+        .bar { flex-wrap: wrap; }
+        .row-actions { flex-wrap: wrap; }
+        table.assistants th:nth-child(2) { width: 112px; }
+        table.assistants th:nth-child(4) { width: 96px; }
+        table.assistants .actions { flex-direction: column; align-items: flex-end; }
+        .card-help { margin: 10px 10px 6px; }
       }
     </style>
   </head>
@@ -11892,7 +13749,12 @@ var assets_default = `<!doctype html>
     <header>
       <div class="bar">
         <div class="logo"><img src="data:image/svg+xml,%3Csvg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 64 64%22 role=%22img%22 aria-label=%22cloudhop%22%3E%3Cdefs%3E%3ClinearGradient id=%22ch-bg%22 x1=%220%22 y1=%220%22 x2=%221%22 y2=%221%22%3E%3Cstop offset=%220%22 stop-color=%22%233BB8F5%22/%3E%3Cstop offset=%221%22 stop-color=%22%231450A8%22/%3E%3C/linearGradient%3E%3C/defs%3E%3Crect width=%2264%22 height=%2264%22 rx=%2215%22 fill=%22url(%23ch-bg)%22/%3E%3Cpath d=%22M8.5 47.5a5.5 5.5 0 0 1 5-5.5 6.8 6.8 0 0 1 13 1.6 4.4 4.4 0 0 1-.9 8.7H13.4a4.9 4.9 0 0 1-4.9-4.8z%22 fill=%22%23fff%22 fill-opacity=%22.55%22/%3E%3Cpath d=%22M31 44.6a7.6 7.6 0 0 1 7-7.6 9.6 9.6 0 0 1 18.2 2.6 6.3 6.3 0 0 1-1.3 12.5H38.3A7.4 7.4 0 0 1 31 44.6z%22 fill=%22%23fff%22/%3E%3Cpath d=%22M18 37.5C19 21 33 13.5 40.6 23%22 fill=%22none%22 stroke=%22%23fff%22 stroke-width=%223.6%22 stroke-linecap=%22round%22 stroke-dasharray=%220.01 6.3%22/%3E%3Cpath d=%22M46 30.2l-7.4-2.1 5.4-4.3z%22 fill=%22%23fff%22 stroke=%22%23fff%22 stroke-width=%222.4%22 stroke-linejoin=%22round%22/%3E%3C/svg%3E" alt="" width="28" height="28" /><span>cloud<span>hop</span></span></div>
-        <div class="tagline">Hop between cloud accounts, roles and regions</div>
+        <nav id="nav" class="nav" aria-label="Sections" hidden>
+          <a href="#/aliases" data-page="aliases">Aliases</a>
+          <a href="#/sources" data-page="sources">Sources</a>
+          <a href="#/assistants" data-page="assistants">AI assistants</a>
+          <a href="#/tools" data-page="tools">Tools</a>
+        </nav>
         <div class="spacer"></div>
         <button type="button" class="primary" id="add-source" hidden>+ Add source</button>
       </div>
@@ -11932,9 +13794,13 @@ async function readJson(req) {
   return raw ? JSON.parse(raw) : {};
 }
 var sameSecret = (given, expected) => given !== void 0 && given.length === expected.length && timingSafeEqual(Buffer.from(given), Buffer.from(expected));
-async function startUiServer({ app, port = 0 }) {
+async function startUiServer({
+  app,
+  assistants,
+  port = 0
+}) {
   const token = randomBytes(24).toString("base64url");
-  const handle = createApi(app);
+  const handle = createApi(app, assistants);
   let allowedHosts = /* @__PURE__ */ new Set();
   const server = createServer(async (req, res) => {
     try {
@@ -11994,12 +13860,12 @@ async function startUiServer({ app, port = 0 }) {
 }
 
 // src/commands/ui.ts
-async function uiCommand(app, { flags }) {
+async function uiCommand(app, assistants, { flags }) {
   const port = flags.port ? Number(flags.port) : 0;
   if (!Number.isInteger(port) || port < 0 || port > 65535) {
     throw new CloudhopError("INVALID_NAME", `--port must be a number between 1 and 65535.`);
   }
-  const server = await startUiServer({ app, port });
+  const server = await startUiServer({ app, assistants, port });
   console.log(`cloudhop UI running at ${bold(server.url)}`);
   console.log("Only this computer can open it, and the link works only while this runs.");
   console.log("Press Ctrl-C to stop.");
@@ -12012,15 +13878,15 @@ async function uiCommand(app, { flags }) {
 }
 
 // src/container.ts
-import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join8 } from "path";
 
 // ../provider-aws/src/aws-provider.ts
-import { join as join4 } from "path";
+import { join as join7 } from "path";
 
 // ../provider-aws/src/aws-config.ts
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2 } from "path";
+import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname4 } from "path";
 var BLOCK_START = "# >>> cloudhop managed >>> (edit with `cloudhop`, not by hand)";
 var BLOCK_END = "# <<< cloudhop managed <<<";
 function renderBlock(sections) {
@@ -12067,13 +13933,64 @@ function replaceManagedBlock(content, sections) {
 async function writeManagedBlock(path2, sections) {
   let content = "";
   try {
-    content = await readFile2(path2, "utf8");
+    content = await readFile5(path2, "utf8");
   } catch {
   }
   const next = replaceManagedBlock(content, sections);
   if (next === content) return;
-  await mkdir2(dirname2(path2), { recursive: true, mode: 448 });
-  await writeFile2(path2, next, { mode: 384 });
+  await mkdir4(dirname4(path2), { recursive: true, mode: 448 });
+  await writeFile4(path2, next, { mode: 384 });
+}
+
+// ../provider-aws/src/console.ts
+var ISSUER = "https://dayepesb.github.io/cloudhop/";
+function partitionHosts(region) {
+  if (region?.startsWith("cn-")) {
+    return { signin: "https://signin.amazonaws.cn", console: "https://console.amazonaws.cn" };
+  }
+  if (region?.startsWith("us-gov-")) {
+    return {
+      signin: "https://signin.amazonaws-us-gov.com",
+      console: "https://console.amazonaws-us-gov.com"
+    };
+  }
+  return { signin: "https://signin.aws.amazon.com", console: "https://console.aws.amazon.com" };
+}
+function consoleDestination(region, service) {
+  const { console: console2 } = partitionHosts(region);
+  const path2 = service ? `${service}/home` : "console/home";
+  return `${console2}/${path2}${region ? `?region=${encodeURIComponent(region)}` : ""}`;
+}
+async function federatedConsoleUrl(credentials, destination, region, fetchFn) {
+  const {
+    AWS_ACCESS_KEY_ID: id,
+    AWS_SECRET_ACCESS_KEY: key,
+    AWS_SESSION_TOKEN: token
+  } = credentials;
+  if (!id || !key || !token) return void 0;
+  const { signin } = partitionHosts(region);
+  const response = await fetchFn(`${signin}/federation`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      Action: "getSigninToken",
+      Session: JSON.stringify({ sessionId: id, sessionKey: key, sessionToken: token })
+    }).toString()
+  }).catch(() => void 0);
+  if (!response?.ok) return void 0;
+  const signinToken = (await response.json().catch(() => ({}))).SigninToken;
+  if (!signinToken) return void 0;
+  const params = new URLSearchParams({
+    Action: "login",
+    Issuer: ISSUER,
+    Destination: destination,
+    SigninToken: signinToken
+  });
+  return `${signin}/federation?${params}`;
+}
+function portalShortcutUrl(startUrl, accountId, roleName, destination) {
+  const params = new URLSearchParams({ account_id: accountId, role_name: roleName, destination });
+  return `${startUrl.replace(/\/+$/, "")}/#/console?${params}`;
 }
 
 // ../provider-aws/src/http.ts
@@ -12087,12 +14004,12 @@ var AwsHttpError = class extends Error {
   status;
   code;
 };
-async function parse2(response) {
-  const text3 = await response.text();
-  const body = text3 ? JSON.parse(text3) : {};
+async function parse3(response) {
+  const text4 = await response.text();
+  const body = text4 ? JSON.parse(text4) : {};
   if (!response.ok) {
     const code = body.error ?? body.__type ?? body.code;
-    const description = body.error_description ?? body.message ?? text3;
+    const description = body.error_description ?? body.message ?? text4;
     throw new AwsHttpError(
       response.status,
       code,
@@ -12107,10 +14024,10 @@ async function postJson(fetchFn, url, body) {
     headers: { "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  return parse2(response);
+  return parse3(response);
 }
 async function getJson(fetchFn, url, headers) {
-  return parse2(await fetchFn(url, { headers }));
+  return parse3(await fetchFn(url, { headers }));
 }
 
 // ../provider-aws/src/sso/portal.ts
@@ -12160,7 +14077,7 @@ var PortalClient = class {
 };
 
 // ../provider-aws/src/sso/sso-login.ts
-import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
 
 // ../provider-aws/src/sso/loopback.ts
 import { createServer as createServer2 } from "http";
@@ -12293,24 +14210,24 @@ var OidcClient = class {
 };
 
 // ../provider-aws/src/sso/token-cache.ts
-import { createHash } from "crypto";
-import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import { join as join3 } from "path";
+import { createHash as createHash2 } from "crypto";
+import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
+import { join as join6 } from "path";
 var EXPIRY_MARGIN_MS = 5 * 60 * 1e3;
 function tokenCachePath(awsDir, sessionName) {
-  const hash = createHash("sha1").update(sessionName).digest("hex");
-  return join3(awsDir, "sso", "cache", `${hash}.json`);
+  const hash = createHash2("sha1").update(sessionName).digest("hex");
+  return join6(awsDir, "sso", "cache", `${hash}.json`);
 }
 async function readToken(awsDir, sessionName) {
   try {
-    return JSON.parse(await readFile3(tokenCachePath(awsDir, sessionName), "utf8"));
+    return JSON.parse(await readFile6(tokenCachePath(awsDir, sessionName), "utf8"));
   } catch {
     return void 0;
   }
 }
 async function writeToken(awsDir, sessionName, token) {
-  await mkdir3(join3(awsDir, "sso", "cache"), { recursive: true, mode: 448 });
-  await writeFile3(tokenCachePath(awsDir, sessionName), JSON.stringify(token, null, 2), {
+  await mkdir5(join6(awsDir, "sso", "cache"), { recursive: true, mode: 448 });
+  await writeFile5(tokenCachePath(awsDir, sessionName), JSON.stringify(token, null, 2), {
     mode: 384
   });
 }
@@ -12353,7 +14270,7 @@ async function authorizationCodeLogin(options) {
       clientId: client.clientId,
       redirectUri: server.redirectUri,
       state,
-      codeChallenge: base64url(createHash2("sha256").update(codeVerifier).digest())
+      codeChallenge: base64url(createHash3("sha256").update(codeVerifier).digest())
     });
     options.interaction.notify("Opening your browser to log in\u2026");
     options.interaction.notify(`If it doesn't open, visit: ${url}`);
@@ -12449,6 +14366,42 @@ var CONSOLE_LOGIN_KIND = "console-login";
 var CONSOLE_TARGET = { id: "console", label: "Console sign-in", attributes: {} };
 var ssoSessionName = (sourceId) => `cloudhop-${sourceId}`;
 var consoleProfileName = (sourceId) => `cloudhop-${sourceId}`;
+var GLOBAL_WITH_VALUE = /* @__PURE__ */ new Set([
+  "--region",
+  "--output",
+  "--profile",
+  "--endpoint-url",
+  "--query",
+  "--color",
+  "--ca-bundle",
+  "--cli-read-timeout",
+  "--cli-connect-timeout",
+  "--cli-binary-format"
+]);
+var READ_VERBS = /^(describe|list|get|head|lookup|search|scan|query|select|filter|tail|batch-get|check|preview|simulate|validate|estimate|test|wait|help|download|ls|presign)(-|$)/;
+function isAwsReadOnly(args) {
+  if (args.includes("--dryrun") || args.includes("--dry-run") || args.includes("help")) return true;
+  const words = [];
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const arg = args[i2];
+    if (arg.startsWith("--")) {
+      if (GLOBAL_WITH_VALUE.has(arg) && words.length < 2) i2++;
+      continue;
+    }
+    words.push(arg);
+  }
+  const [service, operation] = words;
+  if (!service || !operation) return true;
+  if (service === "sts" || service === "configure") return true;
+  if (service === "s3") {
+    if (operation === "cp" || operation === "sync") {
+      const destination = words[words.length - 1] ?? "";
+      return !destination.startsWith("s3://");
+    }
+    return operation === "ls" || operation === "presign";
+  }
+  return READ_VERBS.test(operation);
+}
 var AwsProvider = class {
   constructor(options) {
     this.options = options;
@@ -12458,6 +14411,7 @@ var AwsProvider = class {
   id = "aws";
   displayName = "AWS";
   cli = { command: "aws", displayName: "AWS CLI v2", minVersion: "2.32.0" };
+  identityArgs = ["sts", "get-caller-identity"];
   sourceKinds = [
     {
       kind: SSO_KIND,
@@ -12566,7 +14520,7 @@ var AwsProvider = class {
         }
       });
     }
-    await writeManagedBlock(join4(this.options.awsDir, "config"), sections);
+    await writeManagedBlock(join7(this.options.awsDir, "config"), sections);
   }
   async processEnv(resolved, mode) {
     const region = resolved.region;
@@ -12582,6 +14536,25 @@ var AwsProvider = class {
     const credentials = resolved.source.kind === CONSOLE_LOGIN_KIND ? await this.exportedCredentials(profile) : await this.roleCredentials(resolved);
     return { AWS_PROFILE: void 0, ...credentials, ...regionEnv };
   }
+  async consoleUrl(resolved, service) {
+    const destination = consoleDestination(resolved.region, service);
+    const sso = resolved.source.kind !== CONSOLE_LOGIN_KIND;
+    const credentials = sso ? await this.roleCredentials(resolved) : await this.exportedCredentials(consoleProfileName(resolved.source.id)).catch(() => ({}));
+    const url = await federatedConsoleUrl(credentials, destination, resolved.region, this.fetchFn);
+    if (url) return { url, via: "signed-in" };
+    const attrs = resolved.target?.attributes ?? {};
+    const startUrl = resolved.source.settings.startUrl;
+    if (sso && startUrl && attrs.accountId && attrs.roleName) {
+      return {
+        url: portalShortcutUrl(startUrl, attrs.accountId, attrs.roleName, destination),
+        via: "portal"
+      };
+    }
+    return { url: destination, via: "sign-in-page" };
+  }
+  isReadOnly(args) {
+    return isAwsReadOnly(args);
+  }
   isSessionError(output) {
     return SESSION_ERROR_PATTERNS.some((pattern) => pattern.test(output));
   }
@@ -12629,9 +14602,10 @@ var AwsProvider = class {
 };
 
 // src/container.ts
+var browser = new NodeBrowserOpener();
 function createApp(env = process.env) {
   const runner = new NodeProcessRunner();
-  const awsDir = env.CLOUDHOP_AWS_DIR ?? join5(homedir2(), ".aws");
+  const awsDir = env.CLOUDHOP_AWS_DIR ?? join8(homedir4(), ".aws");
   return new CloudhopApp({
     config: new YamlConfigStore(),
     providers: [
@@ -12643,18 +14617,72 @@ function createApp(env = process.env) {
       // Azure and Google Cloud providers plug in here.
     ],
     runner,
-    browser: new NodeBrowserOpener(),
+    browser,
     installer: new SystemToolInstaller(runner),
     notify
   });
 }
+function createAssistants(version, env = process.env) {
+  return new AssistantsInstaller({
+    places: { home: homedir4(), project: process.cwd() },
+    configDir: defaultConfigDir(env),
+    runner: new NodeProcessRunner(),
+    cloudhopVersion: version
+  });
+}
+
+// src/update-check.ts
+import { mkdir as mkdir6, readFile as readFile7, writeFile as writeFile6 } from "fs/promises";
+import { join as join9 } from "path";
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var REGISTRY_URL = "https://registry.npmjs.org/cloudhop/latest";
+function startUpdateCheck(configDir, current) {
+  const env = process.env;
+  if (env.CLOUDHOP_NO_UPDATE_CHECK === "1" || env.CI || !process.stderr.isTTY)
+    return async () => {
+    };
+  const file = join9(configDir, "update-check.json");
+  const work = (async () => {
+    let cache = { checkedAt: 0 };
+    try {
+      cache = JSON.parse(await readFile7(file, "utf8"));
+    } catch {
+    }
+    if (cache.latest && compareVersions(cache.latest, current) > 0) {
+      process.stderr.write(
+        `\x1B[2mcloudhop \u203A\x1B[22m cloudhop ${cache.latest} is available (you have ${current}): npm i -g cloudhop
+`
+      );
+    }
+    if (Date.now() - cache.checkedAt < DAY_MS) return;
+    const response = await fetch(REGISTRY_URL, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(1500)
+    });
+    if (!response.ok) return;
+    const { version } = await response.json();
+    if (typeof version !== "string") return;
+    await mkdir6(configDir, { recursive: true });
+    await writeFile6(file, JSON.stringify({ checkedAt: Date.now(), latest: version }));
+  })().catch(() => {
+  });
+  return () => Promise.race([work, new Promise((resolve) => setTimeout(resolve, 300))]);
+}
 
 // src/cli.ts
-var HELP = `cloudhop ${"1.0.0"}
+var HELP = `cloudhop ${"1.2.0"}
 Hop between cloud accounts, roles and regions with one command.
 
 Usage
   hop <alias> [args...]          Run the cloud CLI as <alias> (no args: who am I)
+  hop                            Pick the alias from a list, then type the command
+  hop - [args...]                Pick the alias from a list and run [args...]
+  cloudhop console [alias] [service] [--region <r>]
+                                 Open the web console as <alias>, already signed in
+  cloudhop each <selection...> [--source <s>] [--prod|--no-prod] [--yes] [--json] -- <args...>
+                                 Run one command in many aliases (names, a,b lists, 'globex-*', /regex/)
+  cloudhop use [alias] | --off    Use an alias in this shell (aws, terraform... without hop)
+  cloudhop shell [install]       Shell integration: cloudhop use, tab completion, cloudhop_prompt
   cloudhop exec <alias> [--region <r>] -- <cmd...>
                                  Run any tool with the alias' temporary credentials
 
@@ -12663,16 +14691,26 @@ Setup
   cloudhop add                   Add an SSO portal or a personal account
   cloudhop add aws sso --start-url <url> [--region <r>] [--name <id>]
   cloudhop add aws console-login [--region <r>] [--name <id>]
+  cloudhop team export [--out <file>] | team import <file|https URL>
+                                 Share portals and aliases with your team (no secrets)
   cloudhop alias [source]        Create more aliases from a source
   cloudhop alias <source> --list | --target <id> [--name <alias>] [--region <r>]
+  cloudhop mv <alias> <new-name> Rename an alias
+  cloudhop prod [alias...] [--off]
+                                 Mark aliases as production (asks before changes)
   cloudhop region <alias> [region]
                                  Change the region an alias runs in
   cloudhop login [source]        Log in again and refresh its accounts
   cloudhop sync [source]         Refresh the accounts/roles you have access to
-  cloudhop ls [source]           List sources and their aliases
+  cloudhop ls [source] [--json]  List sources and their aliases
+  cloudhop status [alias] [--json]
+                                 Can it run now, or will it need a sign-in?
   cloudhop rm <name...> [--yes]  Remove aliases or sources (a source takes its aliases)
   cloudhop provider [ls|enable|disable] <provider>
   cloudhop doctor                Check (and install) the cloud CLIs
+  cloudhop agent [status|install|update|remove] [--tools <list>] [--scope user|project] [--no-mcp]
+                                 Teach Claude Code, Kiro, Copilot, Cursor or Codex to use cloudhop
+  cloudhop mcp                   Model Context Protocol server for AI assistants (stdio)
   cloudhop ui [--port <n>] [--no-open]
                                  Manage sources and aliases in a local web page
 
@@ -12691,19 +14729,67 @@ function takeGlobalFlags(argv) {
 }
 async function main(argv) {
   const [command, ...args] = argv;
+  const invokedAsHop = /^hop(\.js|\.cmd)?$/i.test(basename(process.argv[1] ?? ""));
+  if (!command && invokedAsHop && interactive() || command === "-") {
+    const app2 = createApp();
+    const alias = await pickAlias(app2);
+    let rest = args;
+    if (!command) {
+      const typed = answer(
+        await dist_exports.text({
+          message: `aws command to run as ${alias}`,
+          placeholder: "empty = who am I, e.g. s3 ls"
+        })
+      ).trim();
+      rest = typed ? (typed.match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((w) => w.replace(/^(["'])(.*)\1$/, "$2")) : [];
+    }
+    return proxyCommand(app2, alias, rest);
+  }
   if (!command || command === "help" || command === "--help" || command === "-h") {
     console.log(HELP);
     return 0;
   }
   if (command === "--version" || command === "-v" || command === "version") {
-    console.log("1.0.0");
+    console.log("1.2.0");
     return 0;
   }
   const app = createApp();
   const local = RESERVED_NAMES.has(command) ? takeGlobalFlags(args) : args;
+  if (command === "__complete") {
+    await completeCommand(app, args[0]);
+    return 0;
+  }
+  if (command === "shell") {
+    await shellCommand(local);
+    return 0;
+  }
+  if (command === "mcp") {
+    await serveMcp({ app, version: "1.2.0" });
+    return 0;
+  }
+  const assistants = createAssistants("1.2.0");
+  await refreshAssistantSkills(assistants, command);
+  const finishUpdateCheck = startUpdateCheck(defaultConfigDir(), "1.2.0");
+  try {
+    return await dispatch(app, assistants, command, args, local);
+  } finally {
+    await finishUpdateCheck();
+  }
+}
+async function refreshAssistantSkills(assistants, command) {
+  if (command === "agent") return;
+  try {
+    const { updated } = await assistants.update();
+    if (updated.length > 0) {
+      notify(`Updated the cloudhop skill for your AI assistants (${updated.length} file(s)).`);
+    }
+  } catch {
+  }
+}
+async function dispatch(app, assistants, command, args, local) {
   switch (command) {
     case "setup":
-      await setupCommand(app);
+      await setupCommand(app, assistants);
       return 0;
     case "add":
       await addCommand(app, parseArgs(local));
@@ -12711,6 +14797,16 @@ async function main(argv) {
     case "alias":
       await aliasCommand(app, parseArgs(local));
       return 0;
+    case "status":
+      await statusCommand(app, local);
+      return 0;
+    case "prod":
+      await prodCommand(app, local);
+      return 0;
+    case "mv":
+    case "rename":
+      await renameCommand(app, local);
+      return 0;
     case "region":
       await regionCommand(app, local);
       return 0;
@@ -12722,7 +14818,7 @@ async function main(argv) {
       return 0;
     case "ls":
     case "list":
-      await listCommand(app, local[0]);
+      await listCommand(app, local);
       return 0;
     case "rm":
     case "remove":
@@ -12736,8 +14832,22 @@ async function main(argv) {
       return 0;
     case "exec":
       return execCommand(app, local);
+    case "agent":
+      await agentCommand(assistants, local);
+      return 0;
+    case "team":
+      await teamCommand(app, local);
+      return 0;
+    case "use":
+      await useCommand(app, local);
+      return 0;
+    case "each":
+      return eachCommand(app, args);
+    case "console":
+      await consoleCommand(app, local);
+      return 0;
     case "ui":
-      await uiCommand(app, parseArgs(local));
+      await uiCommand(app, assistants, parseArgs(local));
       return 0;
     default:
       return proxyCommand(app, command, args);