cloudhop 1.1.0 → 1.2.0

package/dist/cli.js

@@ -1511,7 +1511,7 @@ var require_stringify = __commonJS({
         props.push(doc.directives.tagString(tag));
       return props.join(" ");
     }
-    function stringify2(item, ctx, onComment, onChompKeep) {
+    function stringify3(item, ctx, onComment, onChompKeep) {
       if (identity.isPair(item))
         return item.toString(ctx, onComment, onChompKeep);
       if (identity.isAlias(item)) {
@@ -1540,7 +1540,7 @@ var require_stringify = __commonJS({
 ${ctx.indent}${str}`;
     }
     exports.createStringifyContext = createStringifyContext;
-    exports.stringify = stringify2;
+    exports.stringify = stringify3;
   }
 });
 
@@ -1550,7 +1550,7 @@ var require_stringifyPair = __commonJS({
     "use strict";
     var identity = require_identity();
     var Scalar = require_Scalar();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
       const { allNullValues, doc, indent, indentStep, options: { commentString, indentSeq, simpleKeys } } = ctx;
@@ -1572,7 +1572,7 @@ var require_stringifyPair = __commonJS({
       });
       let keyCommentDone = false;
       let chompKeep = false;
-      let str = stringify2.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
+      let str = stringify3.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
       if (!explicitKey && !ctx.inFlow && str.length > 1024) {
         if (simpleKeys)
           throw new Error("With simple keys, single line scalar must not span more than 1024 characters");
@@ -1624,7 +1624,7 @@ ${indent}:`;
         ctx.indent = ctx.indent.substring(2);
       }
       let valueCommentDone = false;
-      const valueStr = stringify2.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
+      const valueStr = stringify3.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
       let ws = " ";
       if (keyComment || vsb || vcb) {
         ws = vsb ? "\n" : "";
@@ -1765,7 +1765,7 @@ var require_addPairToJSMap = __commonJS({
     "use strict";
     var log2 = require_log();
     var merge = require_merge();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var identity = require_identity();
     var toJS = require_toJS();
     function addPairToJSMap(ctx, map, { key, value }) {
@@ -1801,7 +1801,7 @@ var require_addPairToJSMap = __commonJS({
       if (typeof jsKey !== "object")
         return String(jsKey);
       if (identity.isNode(key) && ctx?.doc) {
-        const strCtx = stringify2.createStringifyContext(ctx.doc, {});
+        const strCtx = stringify3.createStringifyContext(ctx.doc, {});
         strCtx.anchors = /* @__PURE__ */ new Set();
         for (const node of ctx.anchors.keys())
           strCtx.anchors.add(node.anchor);
@@ -1868,12 +1868,12 @@ var require_stringifyCollection = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/stringify/stringifyCollection.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyCollection(collection, ctx, options) {
       const flow = ctx.inFlow ?? collection.flow;
-      const stringify3 = flow ? stringifyFlowCollection : stringifyBlockCollection;
-      return stringify3(collection, ctx, options);
+      const stringify4 = flow ? stringifyFlowCollection : stringifyBlockCollection;
+      return stringify4(collection, ctx, options);
     }
     function stringifyBlockCollection({ comment, items }, ctx, { blockItemPrefix, flowChars, itemIndent, onChompKeep, onComment }) {
       const { indent, options: { commentString } } = ctx;
@@ -1898,7 +1898,7 @@ var require_stringifyCollection = __commonJS({
           }
         }
         chompKeep = false;
-        let str2 = stringify2.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
+        let str2 = stringify3.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
         if (comment2)
           str2 += stringifyComment.lineComment(str2, itemIndent, commentString(comment2));
         if (chompKeep && comment2)
@@ -1965,7 +1965,7 @@ ${indent}${line}` : "\n";
         }
         if (comment)
           reqNewline = true;
-        let str = stringify2.stringify(item, itemCtx, () => comment = null);
+        let str = stringify3.stringify(item, itemCtx, () => comment = null);
         reqNewline || (reqNewline = lines.length > linesAtValue || str.includes("\n"));
         if (i2 < items.length - 1) {
           str += ",";
@@ -3326,7 +3326,7 @@ var require_stringifyDocument = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/stringify/stringifyDocument.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyDocument(doc, options) {
       const lines = [];
@@ -3341,7 +3341,7 @@ var require_stringifyDocument = __commonJS({
       }
       if (hasDirectives)
         lines.push("---");
-      const ctx = stringify2.createStringifyContext(doc, options);
+      const ctx = stringify3.createStringifyContext(doc, options);
       const { commentString } = ctx.options;
       if (doc.commentBefore) {
         if (lines.length !== 1)
@@ -3363,7 +3363,7 @@ var require_stringifyDocument = __commonJS({
           contentComment = doc.contents.comment;
         }
         const onChompKeep = contentComment ? void 0 : () => chompKeep = true;
-        let body = stringify2.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
+        let body = stringify3.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
         if (contentComment)
           body += stringifyComment.lineComment(body, "", commentString(contentComment));
         if ((body[0] === "|" || body[0] === ">") && lines[lines.length - 1] === "---") {
@@ -3371,7 +3371,7 @@ var require_stringifyDocument = __commonJS({
         } else
           lines.push(body);
       } else {
-        lines.push(stringify2.stringify(doc.contents, ctx));
+        lines.push(stringify3.stringify(doc.contents, ctx));
       }
       if (doc.directives?.docEnd) {
         if (doc.comment) {
@@ -5507,7 +5507,7 @@ var require_cst_scalar = __commonJS({
 var require_cst_stringify = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/parse/cst-stringify.js"(exports) {
     "use strict";
-    var stringify2 = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
+    var stringify3 = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
     function stringifyToken(token) {
       switch (token.type) {
         case "block-scalar": {
@@ -5560,7 +5560,7 @@ var require_cst_stringify = __commonJS({
         res += stringifyToken(value);
       return res;
     }
-    exports.stringify = stringify2;
+    exports.stringify = stringify3;
   }
 });
 
@@ -6046,9 +6046,9 @@ var require_lexer = __commonJS({
         }
       }
       *parseQuotedScalar() {
-        const quote = this.charAt(0);
-        let end = this.buffer.indexOf(quote, this.pos + 1);
-        if (quote === "'") {
+        const quote2 = this.charAt(0);
+        let end = this.buffer.indexOf(quote2, this.pos + 1);
+        if (quote2 === "'") {
           while (end !== -1 && this.buffer[end + 1] === "'")
             end = this.buffer.indexOf("'", end + 2);
         } else {
@@ -7271,7 +7271,7 @@ var require_public_api = __commonJS({
       }
       return doc;
     }
-    function parse3(src, reviver, options) {
+    function parse4(src, reviver, options) {
       let _reviver = void 0;
       if (typeof reviver === "function") {
         _reviver = reviver;
@@ -7290,7 +7290,7 @@ var require_public_api = __commonJS({
       }
       return doc.toJS(Object.assign({ reviver: _reviver }, options));
     }
-    function stringify2(value, replacer, options) {
+    function stringify3(value, replacer, options) {
       let _replacer = null;
       if (typeof replacer === "function" || Array.isArray(replacer)) {
         _replacer = replacer;
@@ -7312,10 +7312,10 @@ var require_public_api = __commonJS({
         return value.toString(options);
       return new Document.Document(value, _replacer, options).toString(options);
     }
-    exports.parse = parse3;
+    exports.parse = parse4;
     exports.parseAllDocuments = parseAllDocuments;
     exports.parseDocument = parseDocument;
-    exports.stringify = stringify2;
+    exports.stringify = stringify3;
   }
 });
 
@@ -7427,6 +7427,9 @@ var require_src = __commonJS({
   }
 });
 
+// src/cli.ts
+import { basename } from "path";
+
 // ../adapters-node/src/node-browser-opener.ts
 import { spawn } from "child_process";
 var NodeBrowserOpener = class {
@@ -7602,6 +7605,14 @@ var RESERVED_NAMES = /* @__PURE__ */ new Set([
   "agent",
   "alias",
   "login",
+  "team",
+  "shell",
+  "use",
+  "each",
+  "console",
+  "prod",
+  "rename",
+  "mv",
   "mcp",
   "region",
   "setup",
@@ -7639,6 +7650,56 @@ function suggestAliasName(...parts) {
   const slug = parts.join("-").toLowerCase().replace(/access$/i, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
   return slug || "alias";
 }
+var slugTokens = (text4) => text4.toLowerCase().replace(/access$/i, "").split(/[^a-z0-9]+/).filter(Boolean);
+var ROLE_WORDS = {
+  administrator: "admin",
+  administratoraccess: "admin",
+  readonly: "ro",
+  readonlyaccess: "ro",
+  developer: "dev",
+  poweruser: "power",
+  poweruseraccess: "power",
+  viewonly: "view"
+};
+var ROLE_NOISE = /* @__PURE__ */ new Set(["aws", "access", "role", "ps", "iam"]);
+var PRODUCTION = /(^|[^a-z])(prod|prd|production|live)([^a-z]|$)/i;
+var looksLikeProduction = (...texts) => texts.some((text4) => PRODUCTION.test(text4));
+function suggestAliases(targets, sourceId, taken = /* @__PURE__ */ new Set()) {
+  const sourceWords = new Set(
+    slugTokens(sourceId).filter((w) => w.length > 2 && !/^(test|dev|main)$/.test(w))
+  );
+  const accountOf = (t2) => {
+    let words = slugTokens(t2.attributes.accountName ?? t2.label.split(" / ")[0] ?? t2.id);
+    if (words.length > 1 && sourceWords.has(words[0])) words = words.slice(1);
+    while (words.length > 1 && /^\d{1,2}$/.test(words[words.length - 1]))
+      words = words.slice(0, -1);
+    return words;
+  };
+  const roleOf = (t2, accountWords) => {
+    const raw = t2.attributes.roleName ?? t2.label.split(" / ")[1] ?? "";
+    const compact = raw.toLowerCase().replace(/[^a-z0-9]/g, "").replace(/^aws/, "").replace(/access$/, "");
+    if (ROLE_WORDS[compact]) return [ROLE_WORDS[compact]];
+    const skip = /* @__PURE__ */ new Set([...accountWords, ...sourceWords, ...ROLE_NOISE]);
+    const words = slugTokens(raw).filter((w) => !skip.has(w)).map((w) => ROLE_WORDS[w] ?? w);
+    return words.length ? words : slugTokens(raw).slice(-1);
+  };
+  const accounts = targets.map(accountOf);
+  const count = /* @__PURE__ */ new Map();
+  for (const words of accounts) count.set(words.join("-"), (count.get(words.join("-")) ?? 0) + 1);
+  const used = new Set(taken);
+  const result = /* @__PURE__ */ new Map();
+  targets.forEach((target, i2) => {
+    const accountWords = accounts[i2];
+    const base = accountWords.join("-");
+    const words = (count.get(base) ?? 0) > 1 ? [...accountWords, ...roleOf(target, accountWords)] : accountWords;
+    const stem = suggestAliasName(words.join("-"));
+    let name = stem;
+    for (let n3 = 2; used.has(name) || RESERVED_NAMES.has(name); n3++) name = `${stem}-${n3}`;
+    used.add(name);
+    result.set(target.id, name);
+  });
+  return result;
+}
 
 // ../core/src/domain/version.ts
 function compareVersions(a2, b3) {
@@ -7868,6 +7929,7 @@ var CloudhopApp = class {
           available: Boolean(resolved.target),
           region: resolved.region,
           attributes: resolved.target?.attributes ?? {},
+          prod: alias.prod === true,
           session: source.session,
           next: source.next
         };
@@ -7888,6 +7950,30 @@ var CloudhopApp = class {
     }
     return status;
   }
+  /** Renames an alias and its profile, keeping its account, role, region and production mark. */
+  async renameAlias(from, to) {
+    assertValidName("alias", to);
+    const config = await this.deps.config.load();
+    const alias = this.findAlias(config, from);
+    if (from === to) return;
+    if (config.aliases.some((a2) => a2.name === to)) {
+      throw new CloudhopError("ALIAS_EXISTS", `Alias "${to}" already exists.`);
+    }
+    alias.name = to;
+    const source = this.findSource(config, alias.source);
+    await this.syncProfiles(source.provider, config);
+    await this.deps.config.save(config);
+  }
+  /** Marks aliases as production (or not). Production aliases ask before changing anything. */
+  async setProduction(names, prod) {
+    const config = await this.deps.config.load();
+    for (const name of names) {
+      const alias = this.findAlias(config, name);
+      if (prod) alias.prod = true;
+      else delete alias.prod;
+    }
+    await this.deps.config.save(config);
+  }
   /** Changes an alias' region; matching the source's region clears the override. */
   async setAliasRegion(name, region) {
     const config = await this.deps.config.load();
@@ -7930,6 +8016,49 @@ ${result.stderr}`)) {
     }
     return result;
   }
+  /**
+   * Whether running these CLI arguments (or, with `args` undefined, any
+   * command through `cloudhop exec`) as this alias needs a person's OK: true
+   * for production aliases unless the command surely only reads.
+   */
+  async needsProductionConfirmation(name, args) {
+    const resolved = await this.resolveAlias(name);
+    if (!resolved.alias.prod) return false;
+    if (!args) return true;
+    return !this.provider(resolved.source.provider).isReadOnly(args);
+  }
+  /**
+   * A URL that opens the web console as the alias, signing in first if the
+   * session expired. The URL is a short-lived secret: open it, never print it.
+   */
+  async consoleUrl(name, { service, region } = {}) {
+    const resolved = await this.usableAlias(name, region ? { region } : {});
+    const provider = this.provider(resolved.source.provider);
+    if (!provider.consoleUrl) {
+      throw new CloudhopError(
+        "PROVIDER_NOT_AVAILABLE",
+        `${provider.displayName} has no console sign-in in cloudhop yet.`
+      );
+    }
+    if (service !== void 0 && !/^[a-z0-9-]{1,40}$/.test(service)) {
+      throw new CloudhopError(
+        "INVALID_NAME",
+        `"${service}" doesn't look like a service name.`,
+        "Examples: s3, ec2, lambda, cloudwatch."
+      );
+    }
+    await this.ensureSession(resolved.source.id);
+    return provider.consoleUrl(resolved, service);
+  }
+  /**
+   * Opens the web console as the alias in the user's browser. The sign-in URL
+   * stays inside cloudhop: callers only learn how the user got in.
+   */
+  async openConsole(name, options = {}) {
+    const { url, via } = await this.consoleUrl(name, options);
+    await this.deps.browser.open(url);
+    return via;
+  }
   /** The command that shows who an alias is, e.g. `aws sts get-caller-identity`. */
   identityArgs(name) {
     return this.resolveAlias(name).then((r2) => this.provider(r2.source.provider).identityArgs);
@@ -8260,6 +8389,10 @@ function createTools(app) {
           region: {
             type: "string",
             description: "Optional region for this call only; defaults to the alias' region."
+          },
+          confirm_production: {
+            type: "boolean",
+            description: "Only for production aliases (prod: true) and commands that may change resources: set it to true after the user explicitly approved this exact command."
           }
         },
         required: ["alias", "args"],
@@ -8288,6 +8421,14 @@ function createTools(app) {
           );
         }
         const region = typeof args.region === "string" && args.region.trim() ? args.region.trim() : void 0;
+        if (args.confirm_production !== true && await app.needsProductionConfirmation(alias, cliArgs)) {
+          const status = await app.aliasStatus(alias);
+          throw new CloudhopError(
+            "PROD_CONFIRMATION_REQUIRED",
+            `${alias} is PRODUCTION (${status.label ?? status.target}, ${status.region ?? "default region"}) and this command may change resources.`,
+            "Show the user the alias, account, region and the exact command, and ask for explicit approval. Only if they approve, call run_cloud_cli again with confirm_production: true."
+          );
+        }
         const result = await app.captureAsAlias(alias, cliArgs, region ? { region } : {});
         return {
           alias,
@@ -8303,7 +8444,7 @@ function createTools(app) {
 // ../mcp/src/server.ts
 var MCP_INSTRUCTIONS = `cloudhop gives each cloud account + role + region a short alias and signs the user in only when a session expired.
 Before the first cloud operation in a conversation: call list_aliases, show the user the aliases (name, account/role, region) and ask which one to use. Never guess the alias.
-Use run_cloud_cli for cloud CLI commands, never --profile. Read-only commands may run once the alias is chosen; before anything that creates, changes or deletes resources, show the alias, account, region and exact command, and wait for the user's explicit OK. Be extra careful with production aliases.
+Use run_cloud_cli for cloud CLI commands, never --profile. Read-only commands may run once the alias is chosen; before anything that creates, changes or deletes resources, show the alias, account, region and exact command, and wait for the user's explicit OK. Aliases with prod: true are production: run_cloud_cli refuses changes there until the user approves and you pass confirm_production: true.
 If a tool returns LOGIN_REQUIRED or alias_status says browser-sign-in: tell the user their browser will open, then call login (it waits up to 5 minutes for them to approve). Never print or ask for credentials.`;
 var SUPPORTED_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
 function serveMcp({
@@ -8404,7 +8545,17 @@ function serveMcp({
 }
 
 // src/flags.ts
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["yes", "all", "list", "noOpen", "json", "noMcp", "force"]);
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+  "yes",
+  "all",
+  "list",
+  "noOpen",
+  "json",
+  "noMcp",
+  "force",
+  "prod",
+  "off"
+]);
 var camel = (name) => name.replace(/-([a-z])/g, (_2, c3) => c3.toUpperCase());
 function parseArgs(argv) {
   const positional = [];
@@ -11362,14 +11513,12 @@ async function chooseAliases(app, source, targets) {
   );
   const validateRegion2 = regionValidator(app, source);
   let defaultRegion = source.settings.region ?? "";
+  const suggestions = suggestAliases(targets, source.id, existing);
   const aliases = [];
   for (const target of selected) {
     dist_exports.log.step(target.label);
     const suggestion = uniqueName(
-      targets.length === 1 && target.id === "console" ? source.id : suggestAliasName(
-        target.attributes.accountName ?? target.label,
-        target.attributes.roleName ?? ""
-      ),
+      targets.length === 1 && target.id === "console" ? source.id : suggestions.get(target.id) ?? suggestAliasName(target.label),
       existing
     );
     const name = answer(
@@ -11388,13 +11537,20 @@ async function chooseAliases(app, source, targets) {
         validate: (v) => v?.trim() ? validateRegion2?.(v.trim()) : void 0
       })
     ).trim() || defaultRegion;
+    const prod = answer(
+      await dist_exports.confirm({
+        message: `Is ${name} production? (cloudhop then asks before any change)`,
+        initialValue: looksLikeProduction(name, target.label)
+      })
+    );
     defaultRegion = region;
     existing.add(name);
     aliases.push({
       name,
       source: source.id,
       target: target.id,
-      ...region && region !== source.settings.region ? { region } : {}
+      ...region && region !== source.settings.region ? { region } : {},
+      ...prod ? { prod: true } : {}
     });
   }
   return aliases;
@@ -11486,14 +11642,20 @@ async function aliasCommand(app, { positional, flags }) {
         `See the options with \`cloudhop alias ${id} --list\`.`
       );
     }
-    const name = flags.name ?? suggestAliasName(
-      target.attributes.accountName ?? target.label,
-      target.attributes.roleName ?? ""
-    );
+    const taken = new Set((await app.config()).aliases.map((a2) => a2.name));
+    const name = flags.name ?? suggestAliases(targets, id, taken).get(target.id) ?? id;
     await app.addAliases([
-      { name, source: id, target: target.id, ...flags.region ? { region: flags.region } : {} }
+      {
+        name,
+        source: id,
+        target: target.id,
+        ...flags.region ? { region: flags.region } : {},
+        ...flags.prod ? { prod: true } : {}
+      }
     ]);
-    console.log(`Alias "${name}" \u2192 ${target.label}. Try:  hop ${name}`);
+    console.log(
+      `Alias "${name}" \u2192 ${target.label}${flags.prod ? " (production)" : ""}. Try:  hop ${name}`
+    );
     return;
   }
   if (scripted) {
@@ -11517,7 +11679,7 @@ import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, r
 import { dirname as dirname2, join as join4 } from "path";
 
 // ../assistants/src/assets/skill.md
-var skill_default = "---\nname: cloudhop\ndescription: Run AWS CLI commands and other cloud tools as a specific account, role and region through cloudhop aliases (the `hop` and `cloudhop` commands). Use whenever the user asks to do anything in their AWS accounts, inspect or change cloud resources, run aws/terraform/cdk against an account, list their cloud accounts or aliases, or mentions hop or cloudhop.\n---\n\n# Working with cloud accounts through cloudhop\n\nThe user manages their cloud access with **cloudhop**. Each **alias** (for\nexample `acme-dev`) points to one account, one role and one region. cloudhop\nsigns the user in through their browser only when a session has expired. There\nare no access keys: never ask for, create, print or store credentials.\n\n## 1. Pick the alias with the user, every time\n\nBefore the first cloud operation in a conversation:\n\n1. List the aliases. Use the `list_aliases` tool if the cloudhop MCP server is\n   connected; otherwise run `cloudhop ls --json`.\n2. Show the user the options (alias, account / role, region) and **ask which\n   one to use**. Don't guess, even if one name looks right, and don't pick\n   one just because there is only one: confirm it.\n3. Use that alias for the rest of the conversation. Ask again if the user\n   moves to another environment, account or task.\n\n## 2. Check the session before running anything\n\nRun `cloudhop status <alias> --json` (or the `alias_status` tool) and read\n`next`:\n\n| `next`            | Meaning                                      | What to do                                                                                                                                        |\n| ----------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `ready`           | Session valid                                | Go ahead                                                                                                                                          |\n| `silent-renewal`  | Expired but renewable without the user       | Go ahead; cloudhop renews it                                                                                                                      |\n| `browser-sign-in` | The user must sign in                        | Tell the user their browser will open and they need to approve, then run `cloudhop login <source>` (or the `login` tool) and wait up to 5 minutes |\n| `unknown`         | Managed by the cloud CLI (personal accounts) | Go ahead; if it fails, run `cloudhop login <source>`                                                                                              |\n\nDon't start several cloud commands in parallel while a sign-in is pending.\n\n## 3. Run commands through the alias\n\n- **AWS CLI**: `hop <alias> <aws arguments>`, e.g. `hop acme-dev s3 ls`.\n  It is exactly `aws <arguments>` with the alias' account, role and region.\n  Never add `--profile`. Use `--region <r>` only to override the region once.\n  With the MCP server, use `run_cloud_cli` with `args` (no program name).\n- **Who am I**: `hop <alias>` with no arguments (or the `whoami` tool).\n- **Other tools** (Terraform, CDK, SDK scripts):\n  `cloudhop exec <alias> -- <command>`, e.g.\n  `cloudhop exec acme-dev -- terraform plan`.\n- Prefer `--output json` and `--query` to keep output small.\n- Don't export `AWS_PROFILE`, `AWS_ACCESS_KEY_ID` or similar variables, don't\n  run commands that print credentials (`env`, `printenv`, `export-credentials`)\n  and never edit `~/.aws/config`, `~/.aws/credentials` or cloudhop's own files.\n\n## 4. Confirm before changing anything\n\n- Read-only commands (`list`, `describe`, `get`, `s3 ls`, `logs tail`) can run\n  once the user has chosen the alias.\n- Before any command that **creates, changes, deletes or costs money**, show\n  the alias, account, region and the exact command, and wait for the user's\n  explicit \"yes\". One confirmation covers one command, not a series.\n- Treat aliases or accounts that look like production (`prod`, `prd`,\n  `production`, `live`) with extra care: confirm every change, and suggest a\n  dry run (`--dryrun`, `terraform plan`) first.\n- Don't change cloudhop itself (`cloudhop add`, `rm`, `region`, `login` for\n  another source) unless the user asked for it.\n\n## 5. When something goes wrong\n\n| You see                                             | Do this                                                                        |\n| --------------------------------------------------- | ------------------------------------------------------------------------------ |\n| \"Opening your browser to log in\"                    | Tell the user to approve in the browser; the command continues by itself       |\n| The command was cut off while waiting for a sign-in | Run `cloudhop login <source>` with a timeout of at least 5 minutes, then retry |\n| `LOGIN_REQUIRED`                                    | Same as `browser-sign-in` above                                                |\n| No browser on this machine (remote, container)      | Run `cloudhop login <source> --device-code` and show the user the URL and code |\n| `Alias \"x\" not found`                               | Run `cloudhop ls` and ask the user again                                       |\n| AWS CLI missing or too old                          | Suggest `cloudhop doctor`; don't install anything without asking               |\n| `AccessDenied`                                      | The role lacks permission: tell the user; don't try other aliases on your own  |\n\nMore: https://dayepesb.github.io/cloudhop/guides/hop-like-aws/\n";
+var skill_default = "---\nname: cloudhop\ndescription: Run AWS CLI commands and other cloud tools as a specific account, role and region through cloudhop aliases (the `hop` and `cloudhop` commands). Use whenever the user asks to do anything in their AWS accounts, inspect or change cloud resources, run aws/terraform/cdk against an account, list their cloud accounts or aliases, or mentions hop or cloudhop.\n---\n\n# Working with cloud accounts through cloudhop\n\nThe user manages their cloud access with **cloudhop**. Each **alias** (for\nexample `acme-dev`) points to one account, one role and one region. cloudhop\nsigns the user in through their browser only when a session has expired. There\nare no access keys: never ask for, create, print or store credentials.\n\n## 1. Pick the alias with the user, every time\n\nBefore the first cloud operation in a conversation:\n\n1. List the aliases. Use the `list_aliases` tool if the cloudhop MCP server is\n   connected; otherwise run `cloudhop ls --json`.\n2. Show the user the options (alias, account / role, region) and **ask which\n   one to use**. Don't guess, even if one name looks right, and don't pick\n   one just because there is only one: confirm it.\n3. Use that alias for the rest of the conversation. Ask again if the user\n   moves to another environment, account or task.\n\n## 2. Check the session before running anything\n\nRun `cloudhop status <alias> --json` (or the `alias_status` tool) and read\n`next`:\n\n| `next`            | Meaning                                      | What to do                                                                                                                                        |\n| ----------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `ready`           | Session valid                                | Go ahead                                                                                                                                          |\n| `silent-renewal`  | Expired but renewable without the user       | Go ahead; cloudhop renews it                                                                                                                      |\n| `browser-sign-in` | The user must sign in                        | Tell the user their browser will open and they need to approve, then run `cloudhop login <source>` (or the `login` tool) and wait up to 5 minutes |\n| `unknown`         | Managed by the cloud CLI (personal accounts) | Go ahead; if it fails, run `cloudhop login <source>`                                                                                              |\n\nDon't start several cloud commands in parallel while a sign-in is pending.\n\n## 3. Run commands through the alias\n\n- **AWS CLI**: `hop <alias> <aws arguments>`, e.g. `hop acme-dev s3 ls`.\n  It is exactly `aws <arguments>` with the alias' account, role and region.\n  Never add `--profile`. Use `--region <r>` only to override the region once.\n  With the MCP server, use `run_cloud_cli` with `args` (no program name).\n- **Who am I**: `hop <alias>` with no arguments (or the `whoami` tool).\n- **The same command in several aliases** (after the user chose them):\n  `cloudhop each a,b,c --yes -- <aws arguments>`; add `--json` to parse the\n  results.\n- **The AWS web console**: `cloudhop console <alias> [service]` opens it in\n  the user's browser, already signed in. Never try to print or fetch its URL.\n- **Other tools** (Terraform, CDK, SDK scripts):\n  `cloudhop exec <alias> -- <command>`, e.g.\n  `cloudhop exec acme-dev -- terraform plan`.\n- Prefer `--output json` and `--query` to keep output small.\n- Don't export `AWS_PROFILE`, `AWS_ACCESS_KEY_ID` or similar variables, don't\n  run commands that print credentials (`env`, `printenv`, `export-credentials`)\n  and never edit `~/.aws/config`, `~/.aws/credentials` or cloudhop's own files.\n\n## 4. Confirm before changing anything\n\n- Read-only commands (`list`, `describe`, `get`, `s3 ls`, `logs tail`) can run\n  once the user has chosen the alias.\n- Before any command that **creates, changes, deletes or costs money**, show\n  the alias, account, region and the exact command, and wait for the user's\n  explicit \"yes\". One confirmation covers one command, not a series.\n- **Production aliases** have `\"prod\": true` in `cloudhop ls --json` (and\n  `PROD` in `cloudhop ls`). Confirm every change there and suggest a dry run\n  (`--dryrun`, `terraform plan`) first. cloudhop enforces it: without a\n  terminal, `hop`/`cloudhop exec` refuse changes on production with\n  `PROD_CONFIRMATION_REQUIRED`. After the user explicitly approves the exact\n  command, rerun it with `CLOUDHOP_CONFIRM_PROD=1` in that command's\n  environment (with MCP: `confirm_production: true`). Never set it on your own.\n- Treat aliases or accounts that merely look like production (`prd`, `live`)\n  the same way, even if they are not marked.\n- Don't change cloudhop itself (`cloudhop add`, `rm`, `region`, `login` for\n  another source) unless the user asked for it.\n\n## 5. When something goes wrong\n\n| You see                                             | Do this                                                                        |\n| --------------------------------------------------- | ------------------------------------------------------------------------------ |\n| \"Opening your browser to log in\"                    | Tell the user to approve in the browser; the command continues by itself       |\n| The command was cut off while waiting for a sign-in | Run `cloudhop login <source>` with a timeout of at least 5 minutes, then retry |\n| `LOGIN_REQUIRED`                                    | Same as `browser-sign-in` above                                                |\n| No browser on this machine (remote, container)      | Run `cloudhop login <source> --device-code` and show the user the URL and code |\n| `Alias \"x\" not found`                               | Run `cloudhop ls` and ask the user again                                       |\n| AWS CLI missing or too old                          | Suggest `cloudhop doctor`; don't install anything without asking               |\n| `AccessDenied`                                      | The role lacks permission: tell the user; don't try other aliases on your own  |\n\nMore: https://dayepesb.github.io/cloudhop/guides/hop-like-aws/\n";
 
 // ../assistants/src/targets.ts
 import { join as join3 } from "path";
@@ -12017,6 +12179,216 @@ async function agentCommand(installer, args) {
   }
 }
 
+// src/picker.ts
+async function pickAlias(app, message = "Which alias?") {
+  if (!interactive()) {
+    throw new CloudhopError(
+      "NOT_INTERACTIVE",
+      "Say which alias to use.",
+      "See them with `cloudhop ls`."
+    );
+  }
+  const { aliases } = await app.overview();
+  if (aliases.length === 0) {
+    throw new CloudhopError(
+      "ALIAS_NOT_FOUND",
+      "No aliases yet.",
+      "Create one with `cloudhop alias <source>`."
+    );
+  }
+  const haystack = new Map(
+    aliases.map((a2) => [
+      a2.name,
+      `${a2.name} ${a2.label ?? a2.target} ${a2.region ?? ""} ${a2.source}`.toLowerCase()
+    ])
+  );
+  return answer(
+    await dist_exports.autocomplete({
+      message: `${message} ${paint("dim", "(type to filter)")}`,
+      maxItems: 12,
+      options: aliases.map((a2) => ({
+        value: a2.name,
+        label: a2.prod ? `${a2.name} ${paint("red", "PROD")}` : a2.name,
+        hint: `${a2.label ?? a2.target} \xB7 ${a2.region ?? "no region"}`
+      })),
+      filter: (search, option) => {
+        const text4 = haystack.get(option.value) ?? "";
+        return search.toLowerCase().split(/\s+/).filter(Boolean).every((word) => text4.includes(word));
+      }
+    })
+  );
+}
+
+// src/commands/console.ts
+var HOW = {
+  "signed-in": "signed in",
+  portal: "through the SSO portal (AWS did not accept a direct sign-in)",
+  "sign-in-page": "at the sign-in page (sign in with your console user)"
+};
+async function consoleCommand(app, args) {
+  const { positional, flags } = parseArgs(args);
+  const alias = positional[0] ?? await pickAlias(app, "Open the console as");
+  const service = positional[1];
+  const via = await app.openConsole(alias, {
+    ...service ? { service } : {},
+    ...flags.region ? { region: flags.region } : {}
+  });
+  notify(`Opened the ${service ? `${service} ` : ""}console for ${alias}, ${HOW[via]}.`);
+}
+
+// src/commands/each.ts
+function matcher(selector) {
+  const regex = /^\/(.+)\/([a-z]*)$/.exec(selector);
+  if (regex) {
+    try {
+      const re = new RegExp(regex[1], regex[2]);
+      return (name) => re.test(name);
+    } catch {
+      throw new CloudhopError("INVALID_NAME", `Invalid regular expression: ${selector}`);
+    }
+  }
+  if (/[*?]/.test(selector)) {
+    const escaped = selector.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+    const re = new RegExp(`^${escaped}$`);
+    return (name) => re.test(name);
+  }
+  return (name) => name === selector;
+}
+function selectAliases(aliases, selectors, filters) {
+  const patterns = selectors.flatMap((s) => s.split(",")).map((s) => s.trim()).filter(Boolean);
+  const tests = patterns.map(matcher);
+  for (const [i2, pattern] of patterns.entries()) {
+    const plain = !/[*?]/.test(pattern) && !pattern.startsWith("/");
+    if (plain && !aliases.some((a2) => tests[i2]?.(a2.name))) {
+      throw new CloudhopError(
+        "ALIAS_NOT_FOUND",
+        `Alias "${pattern}" not found.`,
+        "See your aliases with `cloudhop ls`."
+      );
+    }
+  }
+  return aliases.filter(
+    (a2) => (tests.length === 0 || tests.some((t2) => t2(a2.name))) && (filters.source === void 0 || a2.source === filters.source) && (filters.prod === void 0 || a2.prod === filters.prod)
+  );
+}
+async function mapLimit(items, limit, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const i2 = next++;
+      results[i2] = await fn(items[i2]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, worker));
+  return results;
+}
+async function eachCommand(app, args) {
+  const separator = args.indexOf("--");
+  if (separator === -1 || separator === args.length - 1) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      "Usage: cloudhop each <alias|list|pattern|/regex/...> [--source <s>] [--prod|--no-prod] -- <command>",
+      "Example: cloudhop each 'creci-*' -- s3 ls"
+    );
+  }
+  const { positional, flags } = parseArgs(args.slice(0, separator));
+  const cliArgs = args.slice(separator + 1);
+  if (positional.length === 0 && !flags.source && !flags.prod && !flags.noProd) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      'Say which aliases: names, a pattern like "globex-*", /regex/, --source or --prod.'
+    );
+  }
+  const prodFilter = flags.prod ? true : flags.noProd ? false : void 0;
+  const { aliases } = await app.overview();
+  const selected = selectAliases(aliases, positional, {
+    ...flags.source ? { source: flags.source } : {},
+    ...prodFilter !== void 0 ? { prod: prodFilter } : {}
+  });
+  if (selected.length === 0)
+    throw new CloudhopError("ALIAS_NOT_FOUND", "No alias matches that selection.");
+  const command = `aws ${cliArgs.join(" ")}`;
+  const width = Math.max(...selected.map((a2) => a2.name.length)) + 2;
+  const listing = selected.map(
+    (a2) => `  ${a2.name.padEnd(width)}${(a2.region ?? "-").padEnd(12)}${a2.label ?? a2.target}${a2.prod ? `  ${paint("red", "PROD")}` : ""}`
+  ).join("\n");
+  const risky = [];
+  for (const a2 of selected)
+    if (await app.needsProductionConfirmation(a2.name, cliArgs)) risky.push(a2.name);
+  const tty = interactive();
+  if (!flags.json)
+    process.stderr.write(
+      `${bold(`${selected.length} alias(es)`)} will run ${paint("sky", command)}
+${listing}
+`
+    );
+  if (!flags.yes) {
+    if (!tty)
+      throw new CloudhopError(
+        "NOT_INTERACTIVE",
+        "Confirm with --yes to run in several aliases without a terminal."
+      );
+    if (!answer(
+      await dist_exports.confirm({
+        message: `Run it in these ${selected.length} alias(es)?`,
+        initialValue: false
+      })
+    ))
+      return 130;
+  }
+  if (risky.length > 0 && process.env.CLOUDHOP_CONFIRM_PROD !== "1") {
+    if (!tty) {
+      throw new CloudhopError(
+        "PROD_CONFIRMATION_REQUIRED",
+        `This may change resources in production: ${risky.join(", ")}.`,
+        "Run it in a terminal to confirm, or set CLOUDHOP_CONFIRM_PROD=1 once a person has approved it."
+      );
+    }
+    dist_exports.log.warn(
+      `${paint("red", bold("PRODUCTION"))} ${risky.join(", ")}: this may change resources.`
+    );
+    if (!answer(await dist_exports.confirm({ message: "Also run it in production?", initialValue: false })))
+      return 130;
+  }
+  for (const source of new Set(selected.map((a2) => a2.source))) {
+    await app.ensureSession(source, { interactive: tty });
+  }
+  const parallel = Math.max(1, Math.min(16, Number(flags.parallel) || 4));
+  const outcomes = await mapLimit(selected, parallel, async (a2) => {
+    try {
+      const r2 = await app.captureAsAlias(a2.name, cliArgs);
+      const outcome = { alias: a2.name, exitCode: r2.exitCode, stdout: r2.stdout, stderr: r2.stderr };
+      if (!flags.json) printOutcome(outcome, width);
+      return outcome;
+    } catch (error) {
+      const outcome = { alias: a2.name, exitCode: 1, stdout: "", stderr: error.message };
+      if (!flags.json) printOutcome(outcome, width);
+      return outcome;
+    }
+  });
+  const failed = outcomes.filter((o2) => o2.exitCode !== 0);
+  if (flags.json) {
+    console.log(JSON.stringify({ version: 1, command: cliArgs, results: outcomes }, null, 2));
+  } else {
+    const summary = `${outcomes.length - failed.length} ok${failed.length ? `, ${failed.length} failed: ${failed.map((f2) => f2.alias).join(", ")}` : ""}`;
+    process.stderr.write(`${failed.length ? paint("red", summary) : paint("green", summary)}
+`);
+  }
+  return failed.length ? 1 : 0;
+}
+function printOutcome({ alias, exitCode, stdout: stdout2, stderr }, width) {
+  const tag = paint(exitCode === 0 ? "sky" : "red", `[${alias}]`.padEnd(width + 2));
+  for (const line of stdout2.replace(/\n$/, "").split("\n"))
+    if (line) process.stdout.write(`${tag} ${line}
+`);
+  for (const line of stderr.replace(/\n$/, "").split("\n"))
+    if (line) process.stderr.write(`${tag} ${paint("dim", line)}
+`);
+  if (exitCode !== 0) process.stderr.write(`${tag} ${paint("red", `exit ${exitCode}`)}
+`);
+}
+
 // src/commands/manage.ts
 function printReport(report) {
   const changes = [
@@ -12113,8 +12485,9 @@ async function listCommand(app, args = []) {
     );
     for (const { alias, target, region } of own) {
       const label = target ? target.label : paint("red", `${alias.target} (no longer available)`);
+      const tag = alias.prod ? `  ${paint("red", "PROD")}` : "";
       console.log(
-        `  ${alias.name.padEnd(nameWidth)}${(region ?? "-").padEnd(regionWidth)}${label}`
+        `  ${alias.name.padEnd(nameWidth)}${(region ?? "-").padEnd(regionWidth)}${label}${tag}`
       );
     }
   }
@@ -12200,16 +12573,16 @@ async function regionCommand(app, args) {
     })
   );
   const current = await app.resolveAlias(name);
-  const validate = regionValidator(app, current.source);
+  const validate2 = regionValidator(app, current.source);
   const region = regionArg?.trim() ?? (answer(
     await dist_exports.text({
       message: `Region for ${name}`,
       placeholder: current.region,
       defaultValue: current.region,
-      validate: (v) => v?.trim() ? validate?.(v.trim()) : void 0
+      validate: (v) => v?.trim() ? validate2?.(v.trim()) : void 0
     })
   ).trim() || current.region);
-  const problem = region ? validate?.(region) : "Say which region.";
+  const problem = region ? validate2?.(region) : "Say which region.";
   if (!region || problem) throw new CloudhopError("INVALID_NAME", problem ?? "Invalid region.");
   await app.setAliasRegion(name, region);
   console.log(`${name}: ${current.region ?? "(none)"} \u2192 ${region}`);
@@ -12234,7 +12607,7 @@ async function statusCommand(app, args) {
     if (flags.json) return printJson({ alias: status });
     const account = status.attributes.accountId ? ` (${status.attributes.accountId})` : "";
     console.log(
-      `${bold(paint("sky", status.name))} \u2192 ${status.label ?? status.target}${account}, ${status.region ?? "no region"}`
+      `${bold(paint("sky", status.name))} \u2192 ${status.label ?? status.target}${account}, ${status.region ?? "no region"}${status.prod ? `  ${paint("red", "PROD")}` : ""}`
     );
     console.log(`  ${STATE_SHORT[status.session]}: ${NEXT_TEXT[status.next]}`);
     if (status.next === "browser-sign-in") {
@@ -12255,10 +12628,61 @@ async function statusCommand(app, args) {
     );
   }
 }
+async function prodCommand(app, args) {
+  const { positional, flags } = parseArgs(args);
+  if (positional.length === 0) {
+    const prod = (await app.overview()).aliases.filter((a2) => a2.prod).map((a2) => a2.name);
+    console.log(
+      prod.length ? `Production aliases: ${prod.join(", ")}` : "No alias is marked as production."
+    );
+    console.log(paint("dim", "Mark one with `cloudhop prod <alias>`, unmark with `--off`."));
+    return;
+  }
+  const on = !flags.off;
+  await app.setProduction(positional, on);
+  for (const name of positional) {
+    console.log(
+      on ? `${paint("red", "PROD")} ${name}: cloudhop asks before any change.` : `${name} is no longer marked as production.`
+    );
+  }
+}
+async function renameCommand(app, args) {
+  const [from, to] = args;
+  if (!from || !to)
+    throw new CloudhopError("INVALID_NAME", "Usage: cloudhop mv <alias> <new-name>");
+  await app.renameAlias(from, to);
+  console.log(`${from} \u2192 ${to}`);
+}
 
 // src/commands/run.ts
+async function guardProduction(app, alias, args) {
+  const status = await app.aliasStatus(alias).catch(() => void 0);
+  if (!status?.prod) return;
+  const where = `${status.label ?? status.target}${status.region ? `, ${status.region}` : ""}`;
+  if (!await app.needsProductionConfirmation(alias, args)) {
+    if (process.stderr.isTTY) notify(paint("red", `${alias} is production (${where})`));
+    return;
+  }
+  if (process.env.CLOUDHOP_CONFIRM_PROD === "1") return;
+  const what = args ? `aws ${args.join(" ")}` : "this command";
+  if (!interactive()) {
+    throw new CloudhopError(
+      "PROD_CONFIRMATION_REQUIRED",
+      `${alias} is production and ${what} may change resources.`,
+      "Run it in a terminal to confirm, or set CLOUDHOP_CONFIRM_PROD=1 once a person has approved it."
+    );
+  }
+  dist_exports.log.warn(
+    `${paint("red", bold("PRODUCTION"))}  ${bold(alias)} \u2192 ${where}
+${paint("dim", "This may change resources:")} ${what}`
+  );
+  const ok = answer(await dist_exports.confirm({ message: `Run it in ${alias}?`, initialValue: false }));
+  if (!ok) throw new CloudhopError("PROD_CONFIRMATION_REQUIRED", "Cancelled: nothing ran.");
+}
 async function proxyCommand(app, alias, args) {
-  return app.runAsAlias(alias, args.length > 0 ? args : await app.identityArgs(alias));
+  const cliArgs = args.length > 0 ? args : await app.identityArgs(alias);
+  await guardProduction(app, alias, cliArgs);
+  return app.runAsAlias(alias, cliArgs);
 }
 async function execCommand(app, args) {
   const separator = args.indexOf("--");
@@ -12272,6 +12696,7 @@ async function execCommand(app, args) {
   const regionIndex = flags.indexOf("--region");
   if (regionIndex !== -1 && flags[regionIndex + 1])
     overrides.region = flags[regionIndex + 1];
+  await guardProduction(app, alias);
   const [bin, ...rest] = command;
   return app.execAsAlias(alias, bin, rest, overrides);
 }
@@ -12371,6 +12796,408 @@ async function doctorCommand(app) {
   );
 }
 
+// src/commands/shell.ts
+import { existsSync as existsSync3 } from "fs";
+import { appendFile, mkdir as mkdir3, readFile as readFile3 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, join as join5 } from "path";
+var SHELLS = ["zsh", "bash", "fish", "pwsh"];
+var ALIAS_COMMANDS = "use status console region mv prod rm exec";
+var SOURCE_COMMANDS = "alias login sync ls";
+var SCRIPTS = {
+  zsh: `# cloudhop shell integration (zsh). Load it after compinit:  eval "$(cloudhop shell zsh)"
+cloudhop() {
+  if [ "$1" = "use" ]; then
+    local out; out="$(command cloudhop use --emit zsh "\${@:2}")" || return $?
+    eval "$out"
+  else
+    command cloudhop "$@"
+  fi
+}
+_cloudhop_words() { command cloudhop __complete "$1" 2>/dev/null }
+_hop() { (( CURRENT == 2 )) && { local -a a; a=(\${(f)"$(_cloudhop_words aliases)"}); compadd -a a; } }
+_cloudhop() {
+  local -a w
+  if (( CURRENT == 2 )); then w=(\${(f)"$(_cloudhop_words commands)"}); compadd -a w; return; fi
+  (( CURRENT == 3 )) || return
+  case " ${ALIAS_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words aliases)"});; esac
+  case " ${SOURCE_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words sources)"});; esac
+  compadd -a w
+}
+(( $+functions[compdef] )) && { compdef _hop hop; compdef _cloudhop cloudhop; }
+# Add $(cloudhop_prompt) to your prompt to see the alias set with \`cloudhop use\`.
+cloudhop_prompt() { [ -n "$CLOUDHOP_ALIAS" ] && printf '\u2601 %s%s' "$CLOUDHOP_ALIAS" "\${CLOUDHOP_PROD:+ PROD}"; }
+`,
+  bash: `# cloudhop shell integration (bash):  eval "$(cloudhop shell bash)"
+cloudhop() {
+  if [ "$1" = "use" ]; then
+    local out; out="$(command cloudhop use --emit bash "\${@:2}")" || return $?
+    eval "$out"
+  else
+    command cloudhop "$@"
+  fi
+}
+_cloudhop_complete() {
+  local cur=\${COMP_WORDS[COMP_CWORD]} cmd=\${COMP_WORDS[0]##*/} kind=""
+  if [ "$cmd" = hop ]; then [ "$COMP_CWORD" -eq 1 ] && kind=aliases
+  elif [ "$COMP_CWORD" -eq 1 ]; then kind=commands
+  elif [ "$COMP_CWORD" -eq 2 ]; then
+    case " ${ALIAS_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=aliases;; esac
+    case " ${SOURCE_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=sources;; esac
+  fi
+  [ -n "$kind" ] && COMPREPLY=($(compgen -W "$(command cloudhop __complete $kind 2>/dev/null)" -- "$cur"))
+}
+complete -o default -F _cloudhop_complete hop cloudhop
+# Add $(cloudhop_prompt) to PS1 to see the alias set with \`cloudhop use\`.
+cloudhop_prompt() { [ -n "$CLOUDHOP_ALIAS" ] && printf '\u2601 %s%s' "$CLOUDHOP_ALIAS" "\${CLOUDHOP_PROD:+ PROD}"; }
+`,
+  fish: `# cloudhop shell integration (fish):  cloudhop shell fish | source
+function cloudhop
+  if test "$argv[1]" = use
+    set -l out (command cloudhop use --emit fish $argv[2..-1]); or return $status
+    printf '%s\\n' $out | source
+  else
+    command cloudhop $argv
+  end
+end
+complete -c hop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete aliases 2>/dev/null)'
+complete -c cloudhop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete commands 2>/dev/null)'
+complete -c cloudhop -f -n '__fish_seen_subcommand_from ${ALIAS_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete aliases 2>/dev/null)'
+complete -c cloudhop -f -n '__fish_seen_subcommand_from ${SOURCE_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete sources 2>/dev/null)'
+# Call cloudhop_prompt from fish_prompt to see the alias set with \`cloudhop use\`.
+function cloudhop_prompt
+  test -n "$CLOUDHOP_ALIAS"; and printf '\u2601 %s%s' $CLOUDHOP_ALIAS (test -n "$CLOUDHOP_PROD"; and echo ' PROD')
+end
+`,
+  pwsh: `# cloudhop shell integration (PowerShell):  cloudhop shell pwsh | Out-String | Invoke-Expression
+$script:CloudhopExe = (Get-Command cloudhop -CommandType Application, ExternalScript | Select-Object -First 1).Source
+function cloudhop {
+  if ($args.Count -gt 0 -and $args[0] -eq 'use') {
+    $out = & $script:CloudhopExe use --emit pwsh @($args | Select-Object -Skip 1)
+    if ($LASTEXITCODE -eq 0) { $out | Out-String | Invoke-Expression }
+  } else { & $script:CloudhopExe @args }
+}
+Register-ArgumentCompleter -Native -CommandName hop, cloudhop -ScriptBlock {
+  param($word, $ast)
+  $n = $ast.CommandElements.Count - [int]($word -eq '')
+  $kind = if ($ast.CommandElements[0].Value -match 'hop$' -and $ast.CommandElements[0].Value -notmatch 'cloudhop') { if ($n -le 1) { 'aliases' } }
+          elseif ($n -le 1) { 'commands' }
+          elseif ($n -eq 2 -and ' ${ALIAS_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'aliases' }
+          elseif ($n -eq 2 -and ' ${SOURCE_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'sources' }
+  if ($kind) { & $script:CloudhopExe __complete $kind | Where-Object { $_ -like "$word*" } }
+}
+function cloudhop_prompt { if ($env:CLOUDHOP_ALIAS) { "\u2601 $env:CLOUDHOP_ALIAS$(if ($env:CLOUDHOP_PROD) { ' PROD' })" } }
+`
+};
+var quote = (shell, value) => shell === "pwsh" ? `'${value.replace(/'/g, "''")}'` : `'${value.replace(/'/g, "'\\''")}'`;
+function shellExports(shell, env) {
+  return Object.entries(env).map(([key, value]) => {
+    if (value === void 0) {
+      if (shell === "fish") return `set -e ${key}`;
+      if (shell === "pwsh") return `Remove-Item Env:${key} -ErrorAction SilentlyContinue`;
+      return `unset ${key}`;
+    }
+    if (shell === "fish") return `set -gx ${key} ${quote(shell, value)}`;
+    if (shell === "pwsh") return `$env:${key} = ${quote(shell, value)}`;
+    return `export ${key}=${quote(shell, value)}`;
+  }).join("\n");
+}
+function detectShell() {
+  if (process.platform === "win32") return "pwsh";
+  const name = (process.env.SHELL ?? "").split("/").pop();
+  return SHELLS.includes(name) ? name : "bash";
+}
+function parseShell(value) {
+  if (!value) return detectShell();
+  const shell = value === "powershell" ? "pwsh" : value;
+  if (!SHELLS.includes(shell)) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `Unknown shell "${value}".`,
+      `Use one of: ${SHELLS.join(", ")}.`
+    );
+  }
+  return shell;
+}
+var RC_FILES = {
+  zsh: (home) => join5(home, ".zshrc"),
+  bash: (home) => join5(home, ".bashrc"),
+  fish: (home) => join5(home, ".config", "fish", "config.fish"),
+  pwsh: (home) => process.platform === "win32" ? join5(home, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1") : join5(home, ".config", "powershell", "Microsoft.PowerShell_profile.ps1")
+};
+var LOAD_LINE = {
+  zsh: 'eval "$(cloudhop shell zsh)"',
+  bash: 'eval "$(cloudhop shell bash)"',
+  fish: "cloudhop shell fish | source",
+  pwsh: "cloudhop shell pwsh | Out-String | Invoke-Expression"
+};
+async function shellCommand(args) {
+  const { positional, flags } = parseArgs(args);
+  if (positional[0] !== "install") {
+    process.stdout.write(SCRIPTS[parseShell(positional[0])]);
+    return;
+  }
+  const shell = parseShell(positional[1]);
+  const file = RC_FILES[shell](homedir3());
+  const line = LOAD_LINE[shell];
+  const current = existsSync3(file) ? await readFile3(file, "utf8") : "";
+  if (current.includes(line)) {
+    console.log(`Already set up in ${file.replace(homedir3(), "~")}.`);
+    return;
+  }
+  if (!flags.yes) {
+    if (!interactive())
+      throw new CloudhopError(
+        "NOT_INTERACTIVE",
+        `Add this line to ${file} yourself, or rerun with --yes:
+  ${line}`
+      );
+    const ok = answer(
+      await dist_exports.confirm({
+        message: `Add cloudhop to ${file.replace(homedir3(), "~")}?`,
+        initialValue: true
+      })
+    );
+    if (!ok) return;
+  }
+  await mkdir3(dirname3(file), { recursive: true });
+  const note2 = shell === "zsh" ? "  # after compinit" : "";
+  await appendFile(
+    file,
+    `${current && !current.endsWith("\n") ? "\n" : ""}
+# cloudhop: \`cloudhop use\`, tab completion and cloudhop_prompt${note2}
+${line}
+`
+  );
+  console.log(
+    `${paint("green", "\u2714")} Added to ${file.replace(homedir3(), "~")}. Open a new terminal to use it.`
+  );
+}
+async function useCommand(app, args) {
+  const { positional, flags } = parseArgs(args);
+  const shell = flags.emit ? parseShell(flags.emit) : void 0;
+  if (!shell) {
+    throw new CloudhopError(
+      "NOT_INTERACTIVE",
+      "`cloudhop use` needs the shell integration to change your current shell.",
+      `Set it up once with \`cloudhop shell install\` (or add ${LOAD_LINE[detectShell()]} to your shell's startup file), then open a new terminal.`
+    );
+  }
+  const clear = {
+    AWS_ACCESS_KEY_ID: void 0,
+    AWS_SECRET_ACCESS_KEY: void 0,
+    AWS_SESSION_TOKEN: void 0
+  };
+  if (flags.off) {
+    process.stdout.write(
+      `${shellExports(shell, { ...clear, AWS_PROFILE: void 0, AWS_REGION: void 0, AWS_DEFAULT_REGION: void 0, CLOUDHOP_ALIAS: void 0, CLOUDHOP_PROD: void 0 })}
+`
+    );
+    notify("No alias in this shell anymore.");
+    return;
+  }
+  const alias = positional[0] ?? await pickAlias(app, "Use which alias in this shell?");
+  const env = await app.envForAlias(alias, "cli");
+  const status = await app.aliasStatus(alias);
+  process.stdout.write(
+    `${shellExports(shell, { ...clear, ...env, CLOUDHOP_ALIAS: alias, CLOUDHOP_PROD: status.prod ? "1" : void 0 })}
+`
+  );
+  notify(
+    `This shell now uses ${alias} (${status.label ?? status.target}, ${status.region ?? "no region"}).`
+  );
+  if (status.prod) {
+    notify(
+      paint(
+        "red",
+        `${alias} is production. Plain \`aws\` commands are not protected here: use \`hop ${alias}\` to be asked before changes.`
+      )
+    );
+  }
+}
+async function completeCommand(app, kind) {
+  if (kind === "commands") {
+    console.log(
+      [...RESERVED_NAMES, "each", "shell", "use"].filter((c3, i2, a2) => a2.indexOf(c3) === i2).sort().join("\n")
+    );
+    return;
+  }
+  const config = await app.config();
+  const words = kind === "sources" ? config.sources.map((s) => s.id) : config.aliases.map((a2) => a2.name);
+  if (words.length) console.log(words.join("\n"));
+}
+
+// src/commands/team.ts
+import { readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+var import_yaml2 = __toESM(require_dist(), 1);
+var MAX_BYTES = 256 * 1024;
+var HEADER2 = `# cloudhop team setup: import it with \`cloudhop team import <this file or its https URL>\`.
+# No secrets: portal URLs, regions, account ids and role names only.
+`;
+function validate(app, raw) {
+  const bad = (why) => new CloudhopError("INVALID_NAME", `Not a cloudhop team file: ${why}.`);
+  if (!raw || typeof raw !== "object") throw bad("it is empty");
+  const file = raw;
+  if (file.version !== 1) throw bad('unknown "version" (expected 1)');
+  const sources = file.sources ?? {};
+  const aliases = file.aliases ?? {};
+  for (const [id, source] of Object.entries(sources)) {
+    assertValidName("source", id);
+    if (!PROVIDER_IDS.includes(source?.provider))
+      throw bad(`source "${id}" has an unknown provider`);
+    const kind = app.provider(source.provider).sourceKinds.find((k) => k.kind === source.kind);
+    if (!kind) throw bad(`source "${id}" has an unknown kind`);
+    for (const field of kind.fields) {
+      const value = source.settings?.[field.key];
+      if (typeof value !== "string" || !value) throw bad(`source "${id}" is missing ${field.key}`);
+      const problem = field.validate?.(value);
+      if (problem) throw bad(`source "${id}": ${problem}`);
+    }
+  }
+  for (const [name, alias] of Object.entries(aliases)) {
+    assertValidName("alias", name);
+    if (!alias || typeof alias.target !== "string" || !sources[alias.source]) {
+      throw bad(`alias "${name}" must name a source of this file and a target`);
+    }
+  }
+  return { version: 1, sources, aliases };
+}
+async function load(location) {
+  if (/^http:\/\//i.test(location)) throw new CloudhopError("INVALID_NAME", "Use an https:// URL.");
+  if (/^https:\/\//i.test(location)) {
+    const response = await fetch(location, { signal: AbortSignal.timeout(1e4) });
+    if (!response.ok)
+      throw new CloudhopError("INVALID_NAME", `Could not download it (HTTP ${response.status}).`);
+    const text4 = await response.text();
+    if (text4.length > MAX_BYTES)
+      throw new CloudhopError("INVALID_NAME", "That file is too big for a team setup.");
+    return text4;
+  }
+  return readFile4(location, "utf8");
+}
+async function teamCommand(app, args) {
+  const { positional, flags } = parseArgs(args);
+  const [action, location] = positional;
+  if (action === "export") {
+    const config2 = await app.config();
+    const wanted = flags.sources?.split(",").map((s) => s.trim());
+    const sources = config2.sources.filter(
+      (s) => s.kind !== "console-login" && (!wanted || wanted.includes(s.id))
+    );
+    const ids = new Set(sources.map((s) => s.id));
+    const file = {
+      version: 1,
+      sources: Object.fromEntries(sources.map(({ id, ...rest }) => [id, rest])),
+      aliases: Object.fromEntries(
+        config2.aliases.filter((a2) => ids.has(a2.source)).map(({ name, ...rest }) => [name, rest])
+      )
+    };
+    const text4 = HEADER2 + (0, import_yaml2.stringify)(file);
+    if (flags.out) {
+      await writeFile3(flags.out, text4);
+      console.error(
+        `${paint("green", "\u2714")} Wrote ${sources.length} source(s) and ${Object.keys(file.aliases).length} alias(es) to ${flags.out}.`
+      );
+    } else {
+      process.stdout.write(text4);
+    }
+    return;
+  }
+  if (action !== "import" || !location) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      "Usage: cloudhop team export [--out file] | cloudhop team import <file|https URL>"
+    );
+  }
+  const team = validate(app, (0, import_yaml2.parse)(await load(location)));
+  const config = await app.config();
+  const existingSources = new Map(config.sources.map((s) => [s.id, s]));
+  const sameUrl = (a2, b3) => a2.startUrl !== void 0 && a2.startUrl === b3.startUrl;
+  const newSources = [];
+  const sourceMap = /* @__PURE__ */ new Map();
+  for (const [id, source] of Object.entries(team.sources)) {
+    const match = config.sources.find(
+      (s) => s.provider === source.provider && sameUrl(s.settings, source.settings)
+    );
+    if (match) {
+      sourceMap.set(id, match.id);
+      continue;
+    }
+    if (existingSources.has(id))
+      throw new CloudhopError(
+        "SOURCE_EXISTS",
+        `You already have a different source named "${id}".`,
+        "Rename yours with `cloudhop rm` and add it again, or edit the team file."
+      );
+    newSources.push({ id, ...source });
+    sourceMap.set(id, id);
+  }
+  const takenAliases = new Set(config.aliases.map((a2) => a2.name));
+  const newAliases = [];
+  const skipped = [];
+  for (const [name, alias] of Object.entries(team.aliases)) {
+    if (takenAliases.has(name)) skipped.push(name);
+    else newAliases.push({ name, ...alias, source: sourceMap.get(alias.source) });
+  }
+  if (newSources.length === 0 && newAliases.length === 0) {
+    console.log("Nothing to import: you already have everything in this file.");
+    return;
+  }
+  console.log(bold("This team setup will add:"));
+  for (const s of newSources)
+    console.log(
+      `  source ${bold(s.id)}  ${paint("sky", s.settings.startUrl ?? s.kind)}  ${s.settings.region ?? ""}`
+    );
+  for (const a2 of newAliases)
+    console.log(`  alias  ${a2.name}  ${a2.target}${a2.prod ? `  ${paint("red", "PROD")}` : ""}`);
+  if (skipped.length)
+    console.log(paint("dim", `  (skipping aliases you already have: ${skipped.join(", ")})`));
+  if (newSources.length)
+    console.log(
+      paint("yellow", "Check that these portal URLs are your organization's before signing in.")
+    );
+  if (!flags.yes) {
+    if (!interactive())
+      throw new CloudhopError(
+        "NOT_INTERACTIVE",
+        "Review the list above and rerun with --yes to import it."
+      );
+    if (!answer(
+      await dist_exports.confirm({
+        message: "Import it? Each new portal opens your browser to sign in.",
+        initialValue: true
+      })
+    ))
+      return;
+  }
+  const providers = new Set((await app.config()).providers);
+  for (const s of newSources) if (!providers.has(s.provider)) await app.enableProvider(s.provider);
+  for (const source of newSources) {
+    const report = await app.connectSource(source);
+    console.log(
+      `${paint("green", "\u2714")} ${source.id}: signed in, ${report.targets.length} account/role(s).`
+    );
+  }
+  const usable = [];
+  const missing = [];
+  for (const alias of newAliases) {
+    const targets = await app.listTargets(alias.source);
+    if (targets.some((t2) => t2.id === alias.target)) usable.push(alias);
+    else missing.push(alias.name);
+  }
+  if (usable.length) await app.addAliases(usable);
+  console.log(
+    `${paint("green", "\u2714")} Created ${usable.length} alias(es)${usable.length ? `: ${usable.map((a2) => a2.name).join(", ")}` : ""}.`
+  );
+  if (missing.length)
+    console.log(
+      paint(
+        "yellow",
+        `Not created, you don't have access to their account/role: ${missing.join(", ")}.`
+      )
+    );
+}
+
 // ../ui/src/api.ts
 var text3 = (body, key) => {
   const value = body[key];
@@ -12409,8 +13236,8 @@ function createApi(app, assistants) {
     return assistants;
   };
   const regionCheck = (source, region) => {
-    const validate = app.provider(source.provider).sourceKinds.find((k) => k.kind === source.kind)?.fields.find((f2) => f2.key === "region")?.validate;
-    const problem = region ? validate?.(region) : "Region is required.";
+    const validate2 = app.provider(source.provider).sourceKinds.find((k) => k.kind === source.kind)?.fields.find((f2) => f2.key === "region")?.validate;
+    const problem = region ? validate2?.(region) : "Region is required.";
     if (problem) throw badRequest(problem);
   };
   const findSource = async (id) => {
@@ -12461,7 +13288,8 @@ function createApi(app, assistants) {
           target: alias.target,
           label: target?.label,
           missing: !target,
-          region
+          region,
+          prod: alias.prod === true
         }))
       };
     },
@@ -12556,12 +13384,28 @@ function createApi(app, assistants) {
       await app.addAliases(aliases);
       return { created: aliases.map((a2) => a2.name) };
     },
+    /** Changes an alias: any of `region`, `prod` (production mark) and `name` (rename, applied last). */
     "PATCH /api/aliases/:name": async ([name], body) => {
-      const resolved = await app.resolveAlias(name);
-      const region = text3(body, "region");
-      regionCheck(resolved.source, region);
-      await app.setAliasRegion(name, region);
-      return { name, region };
+      let current = name;
+      if ("region" in body) {
+        const resolved = await app.resolveAlias(current);
+        const region = text3(body, "region");
+        regionCheck(resolved.source, region);
+        await app.setAliasRegion(current, region);
+      }
+      if (typeof body.prod === "boolean") await app.setProduction([current], body.prod);
+      if ("name" in body) {
+        const to = text3(body, "name");
+        await app.renameAlias(current, to);
+        current = to;
+      }
+      return { name: current };
+    },
+    /** Opens the web console in the user's browser; the sign-in URL never reaches the page. */
+    "POST /api/aliases/:name/console": async ([name], body) => {
+      const service = text3(body, "service");
+      const via = await app.openConsole(name, service ? { service } : {});
+      return { via };
     },
     "DELETE /api/aliases/:name": async ([name]) => {
       await app.removeAlias(name);
@@ -12598,7 +13442,7 @@ import { randomBytes, timingSafeEqual } from "crypto";
 import { createServer } from "http";
 
 // ../ui/src/assets/app.js
-var app_default = "// cloudhop local UI. Plain DOM, no build step: served as-is by `cloudhop ui`.\n\nconst TOKEN_KEY = 'cloudhop-token';\nconst SESSION_TEXT = {\n  valid: 'Session valid',\n  refreshable: 'Renews on next use',\n  expired: 'Expired: sign in on next use',\n  unknown: 'Managed by the cloud CLI',\n};\n\n// The token arrives in the URL fragment once; keep it for this tab and clean the address bar.\nconst fromHash = new URLSearchParams(location.hash.slice(1)).get('token');\nif (fromHash) {\n  try {\n    sessionStorage.setItem(TOKEN_KEY, fromHash);\n  } catch {}\n  history.replaceState(null, '', location.pathname);\n}\nlet token = fromHash;\ntry {\n  token = token ?? sessionStorage.getItem(TOKEN_KEY);\n} catch {}\n\n// A fresh link opened in this same tab only changes the fragment: reload to pick up its token.\naddEventListener('hashchange', () => {\n  if (new URLSearchParams(location.hash.slice(1)).has('token')) location.reload();\n});\n\nconst $main = document.getElementById('main');\nconst $dialog = document.getElementById('dialog');\nconst $toasts = document.getElementById('toasts');\nconst $addSource = document.getElementById('add-source');\nlet state;\n\n/** Tiny element builder: h('button', { class: 'primary', onclick }, 'Save'). */\nfunction h(tag, attrs = {}, ...children) {\n  const el = document.createElement(tag);\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null || value === false) continue;\n    if (key.startsWith('on')) el.addEventListener(key.slice(2), value);\n    else if (key === 'class') el.className = value;\n    else if (value === true) el.setAttribute(key, '');\n    else el.setAttribute(key, value);\n  }\n  for (const child of children.flat()) {\n    if (child === undefined || child === null || child === false) continue;\n    el.append(child instanceof Node ? child : document.createTextNode(String(child)));\n  }\n  return el;\n}\n\nclass ApiError extends Error {\n  constructor(message, hint) {\n    super(message);\n    this.hint = hint;\n  }\n}\n\n// Calls that may sign in wait for the person in the browser; everything else should answer quickly.\nconst MAY_SIGN_IN = /^\\/api\\/sources(\\/[^/]+\\/(login|sync|targets))?$/;\nconst QUICK_TIMEOUT_MS = 20_000;\n\nasync function api(method, path, body) {\n  const waitsForPerson = MAY_SIGN_IN.test(path);\n  let response;\n  try {\n    response = await fetch(path, {\n      method,\n      headers: {\n        'x-cloudhop-token': token ?? '',\n        ...(body ? { 'content-type': 'application/json' } : {}),\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: waitsForPerson ? undefined : AbortSignal.timeout(QUICK_TIMEOUT_MS),\n    });\n  } catch (error) {\n    if (error.name === 'TimeoutError') {\n      throw new ApiError(\n        'cloudhop ui is not responding.',\n        'Is it paused in your terminal (Ctrl-Z)? Run `fg` there, or stop it and run `cloudhop ui` again.',\n      );\n    }\n    throw new ApiError(\n      'cloudhop ui is not running.',\n      'Run `cloudhop ui` again and open the new link it prints.',\n    );\n  }\n  const data = await response.json().catch(() => ({}));\n  if (!response.ok)\n    throw new ApiError(data.error ?? `Request failed (${response.status}).`, data.hint);\n  return data;\n}\n\nfunction toast(message, { error = false, hint } = {}) {\n  const el = h(\n    'div',\n    { class: `toast${error ? ' error' : ''}` },\n    message,\n    hint && h('small', {}, hint),\n  );\n  $toasts.append(el);\n  setTimeout(() => el.remove(), error ? 9000 : 4000);\n}\n\nconst fail = (error) => toast(error.message, { error: true, hint: error.hint });\n\n/** Disables a button while its action runs. */\nasync function busy(button, action) {\n  button.disabled = true;\n  try {\n    return await action();\n  } finally {\n    button.disabled = false;\n  }\n}\n\nasync function refresh() {\n  try {\n    state = await api('GET', '/api/state');\n    render();\n    checkDoctor();\n  } catch (error) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Cannot reach cloudhop'),\n        h('p', {}, error.message, error.hint ? ` ${error.hint}` : ''),\n      ),\n    );\n  }\n}\n\nasync function checkDoctor() {\n  try {\n    const entries = await api('GET', '/api/doctor');\n    const problems = entries.filter((e) => !e.installed || e.outdated);\n    document.getElementById('doctor')?.remove();\n    if (problems.length === 0) return;\n    $main.prepend(\n      h(\n        'div',\n        { class: 'notice', id: 'doctor' },\n        ...problems.map((e) =>\n          h(\n            'div',\n            {},\n            e.installed\n              ? `${e.cli} ${e.version} is older than ${e.minVersion}. `\n              : `${e.cli} is not installed, so aliases cannot run commands yet. `,\n            'Run ',\n            h('code', {}, 'cloudhop doctor'),\n            ' in a terminal to install it.',\n          ),\n        ),\n      ),\n    );\n  } catch {}\n}\n\n// ---------- main view ----------\n\nfunction render() {\n  const enabled = state.enabledProviders;\n  $addSource.hidden = enabled.length === 0;\n  if (enabled.length === 0) return renderChooseClouds();\n  if (state.sources.length === 0) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Add your first account'),\n        h(\n          'p',\n          {},\n          'Add a company SSO portal or a personal account. cloudhop signs you in, finds every account and role you can use, and lets you give each one a short alias.',\n        ),\n        h('button', { class: 'primary', onclick: () => openAddSource() }, '+ Add source'),\n      ),\n      assistantsCard(),\n    );\n    loadAssistants();\n    return;\n  }\n  $main.replaceChildren(...state.sources.map(sourceCard), assistantsCard());\n  loadAssistants();\n}\n\n// ---------- AI assistants ----------\n\nlet assistantScope = 'user';\ntry {\n  assistantScope =\n    localStorage.getItem('cloudhop-assistant-scope') === 'project' ? 'project' : 'user';\n} catch {}\nlet assistantsData;\n\nconst SKILL_TEXT = {\n  current: ['valid', 'Up to date'],\n  outdated: ['refreshable', 'Outdated'],\n  modified: ['refreshable', 'Edited by you'],\n  missing: ['', 'Not installed'],\n};\nconst MCP_TEXT = { registered: 'On', missing: 'Off', unknown: 'Check in the app' };\n\nfunction assistantsCard() {\n  return h('section', { class: 'card', id: 'assistants', hidden: true });\n}\n\nasync function loadAssistants() {\n  try {\n    assistantsData = await api('GET', '/api/assistants');\n    renderAssistants();\n  } catch {\n    document.getElementById('assistants')?.remove();\n  }\n}\n\nfunction setAssistantScope(scope) {\n  assistantScope = scope;\n  try {\n    localStorage.setItem('cloudhop-assistant-scope', scope);\n  } catch {}\n  renderAssistants();\n}\n\nfunction assistantAction(label, run, { danger = false, confirmText } = {}) {\n  return h(\n    'button',\n    {\n      class: danger ? 'danger' : undefined,\n      onclick: (e) => {\n        if (confirmText && !confirm(confirmText)) return;\n        busy(e.currentTarget, async () => {\n          try {\n            await run();\n          } catch (error) {\n            fail(error);\n          }\n          await loadAssistants();\n        });\n      },\n    },\n    label,\n  );\n}\n\nfunction reportInstall(results) {\n  for (const r of results) {\n    if (r.mcp === 'manual') {\n      toast(`${r.name}: skill installed. Add the MCP server by hand.`, { hint: r.mcpManual });\n    } else {\n      toast(`${r.name} now knows cloudhop. Start a new chat so it picks it up.`);\n    }\n  }\n}\n\nfunction renderAssistants() {\n  const el = document.getElementById('assistants');\n  if (!el || !assistantsData) return;\n  const rows = assistantScope === 'user' ? assistantsData.user : assistantsData.projectScope;\n  const scope = assistantScope;\n  const install = (tools) =>\n    api('POST', '/api/assistants', { tools, scope, mcp: true }).then((r) =>\n      reportInstall(r.results),\n    );\n  const missingDetected = rows\n    .filter((r) => r.detected && r.skill === 'missing')\n    .map((r) => r.assistant);\n\n  const seg = h(\n    'div',\n    { class: 'seg', role: 'group', 'aria-label': 'Where' },\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'user'), onclick: () => setAssistantScope('user') },\n      'For me',\n    ),\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'project'), onclick: () => setAssistantScope('project') },\n      'This project',\n    ),\n  );\n\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, 'AI assistants'),\n    h(\n      'span',\n      { class: 'meta' },\n      scope === 'user'\n        ? 'Installed in your home folder, for every project'\n        : assistantsData.project,\n    ),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      seg,\n      missingDetected.length > 1\n        ? assistantAction('Install for all detected', () => install(missingDetected))\n        : null,\n    ),\n  );\n\n  const table = h(\n    'table',\n    { class: 'assistants' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Assistant'),\n        h('th', {}, 'Skill'),\n        h('th', {}, 'MCP server'),\n        h('th'),\n      ),\n    ),\n    h(\n      'tbody',\n      {},\n      rows.map((r) => {\n        const [badgeClass, skillText] = SKILL_TEXT[r.skill];\n        const actions = [];\n        if (r.skill === 'missing')\n          actions.push(assistantAction('Install', () => install([r.assistant])));\n        if (r.skill === 'outdated') {\n          actions.push(\n            assistantAction('Update', () =>\n              api('POST', '/api/assistants/update', {}).then(() =>\n                toast(`${r.name}: skill updated.`),\n              ),\n            ),\n          );\n        }\n        if (r.skill === 'modified') {\n          actions.push(\n            assistantAction(\n              'Replace',\n              () =>\n                api('POST', '/api/assistants/update', { force: true }).then(() =>\n                  toast('Edited skills replaced.'),\n                ),\n              {\n                confirmText: 'Replace your edited copies with the current cloudhop skill?',\n              },\n            ),\n          );\n        }\n        if (r.skill !== 'missing' || r.mcp === 'registered') {\n          actions.push(\n            assistantAction(\n              'Remove',\n              () => api('POST', '/api/assistants/remove', { tools: [r.assistant], scope }),\n              {\n                danger: true,\n                confirmText: `Remove the cloudhop skill and MCP server from ${r.name}?`,\n              },\n            ),\n          );\n        }\n        return h(\n          'tr',\n          {},\n          h(\n            'td',\n            { class: 'alias' },\n            r.name,\n            r.detected ? null : h('small', { class: 'muted-inline' }, ' not detected'),\n          ),\n          h('td', {}, h('span', { class: `badge ${badgeClass}`, title: r.skillPath }, skillText)),\n          h('td', {}, r.skill === 'missing' && r.mcp !== 'registered' ? '' : MCP_TEXT[r.mcp]),\n          h(\n            'td',\n            { style: 'text-align:right' },\n            h('div', { class: 'actions', style: 'justify-content:flex-end' }, actions),\n          ),\n        );\n      }),\n    ),\n  );\n\n  el.replaceChildren(\n    head,\n    h(\n      'div',\n      { class: 'card-body' },\n      h(\n        'p',\n        { class: 'card-help' },\n        'Teach your AI assistant to use cloudhop: it asks you which alias to work with, runs commands with hop, and confirms before changing anything. Includes the cloudhop MCP server.',\n      ),\n      table,\n    ),\n  );\n  el.hidden = false;\n}\n\nfunction renderChooseClouds() {\n  const boxes = state.providers.map((p) =>\n    h(\n      'label',\n      { class: 'choice' },\n      h('input', { type: 'checkbox', value: p.id, checked: true }),\n      h('span', {}, p.name),\n    ),\n  );\n  const save = h(\n    'button',\n    {\n      class: 'primary',\n      onclick: (e) =>\n        busy(e.currentTarget, async () => {\n          const ids = boxes\n            .map((b) => b.querySelector('input'))\n            .filter((i) => i.checked)\n            .map((i) => i.value);\n          await api('PUT', '/api/providers', { enabled: ids }).catch(fail);\n          await refresh();\n        }),\n    },\n    'Continue',\n  );\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Which clouds do you use?'),\n      h('p', {}, 'Azure and Google Cloud are coming soon.'),\n      h(\n        'div',\n        { class: 'choices', style: 'max-width:320px;margin:0 auto 16px;text-align:left' },\n        boxes,\n      ),\n      save,\n    ),\n  );\n}\n\nfunction sourceCard(source) {\n  const aliases = state.aliases.filter((a) => a.source === source.id);\n  const where = source.settings.startUrl ?? source.kindLabel;\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, source.id),\n    h('span', { class: `badge ${source.session}` }, SESSION_TEXT[source.session] ?? source.session),\n    h('span', { class: 'meta' }, `${source.providerName} \xB7 ${where}`),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      h('button', { onclick: () => openAliasPicker(source) }, '+ Aliases'),\n      h(\n        'button',\n        {\n          title: 'Sign in again and refresh its accounts',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              toast('Opening the browser to sign in\u2026');\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/login`,\n              ).catch(fail);\n              if (report)\n                toast(`${source.id}: signed in, ${report.targets.length} account/role(s).`);\n              await refresh();\n            }),\n        },\n        'Sign in',\n      ),\n      h(\n        'button',\n        {\n          title: 'Refresh the accounts and roles you have access to',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/sync`,\n              ).catch(fail);\n              if (report) toast(syncMessage(source.id, report));\n              await refresh();\n            }),\n        },\n        'Sync',\n      ),\n      h(\n        'button',\n        {\n          class: 'danger',\n          onclick: (e) => {\n            const count = aliases.length;\n            const message = `Remove \"${source.id}\"${count ? ` and its ${count} alias(es)` : ''}?`;\n            if (!confirm(message)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/sources/${encodeURIComponent(source.id)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        'Remove',\n      ),\n    ),\n  );\n\n  const body =\n    aliases.length === 0\n      ? h(\n          'div',\n          { class: 'empty' },\n          'No aliases yet. ',\n          h(\n            'button',\n            { class: 'primary', onclick: () => openAliasPicker(source) },\n            'Pick accounts',\n          ),\n        )\n      : h(\n          'table',\n          {},\n          h(\n            'thead',\n            {},\n            h(\n              'tr',\n              {},\n              h('th', {}, 'Alias'),\n              h('th', {}, 'Region'),\n              h('th', {}, 'Account / role'),\n              h('th'),\n            ),\n          ),\n          h('tbody', {}, aliases.map(aliasRow)),\n        );\n  return h('section', { class: 'card' }, head, h('div', { class: 'card-body' }, body));\n}\n\nfunction syncMessage(id, report) {\n  const parts = [`${report.targets.length} available`];\n  if (report.added) parts.push(`${report.added} new`);\n  if (report.removed) parts.push(`${report.removed} removed`);\n  const orphaned = report.orphanedAliases.length\n    ? ` No longer available: ${report.orphanedAliases.join(', ')}.`\n    : '';\n  return `${id}: ${parts.join(', ')}.${orphaned}`;\n}\n\nfunction aliasRow(alias) {\n  const input = h('input', {\n    value: alias.region ?? '',\n    'aria-label': `Region for ${alias.name}`,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  const save = h('button', { hidden: true }, 'Save');\n  const commit = () =>\n    busy(save, async () => {\n      const region = input.value.trim();\n      const done = await api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, {\n        region,\n      }).catch(fail);\n      if (done) toast(`${alias.name} now runs in ${region}.`);\n      await refresh();\n    });\n  input.addEventListener('input', () => {\n    save.hidden = input.value.trim() === (alias.region ?? '');\n  });\n  input.addEventListener('keydown', (e) => {\n    if (e.key === 'Enter' && !save.hidden) commit();\n    if (e.key === 'Escape') {\n      input.value = alias.region ?? '';\n      save.hidden = true;\n    }\n  });\n  save.addEventListener('click', commit);\n\n  return h(\n    'tr',\n    {},\n    h('td', { class: 'alias', title: `hop ${alias.name} <command>` }, alias.name),\n    h('td', {}, h('div', { class: 'region' }, input, save)),\n    h(\n      'td',\n      {},\n      alias.missing\n        ? h('span', { class: 'missing' }, `${alias.target} (no longer available)`)\n        : alias.label,\n    ),\n    h(\n      'td',\n      { style: 'text-align:right' },\n      h(\n        'button',\n        {\n          class: 'link',\n          title: `Remove ${alias.name}`,\n          'aria-label': `Remove ${alias.name}`,\n          onclick: (e) => {\n            if (!confirm(`Remove alias \"${alias.name}\"?`)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/aliases/${encodeURIComponent(alias.name)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        '\u2715',\n      ),\n    ),\n  );\n}\n\n// ---------- dialogs ----------\n\nfunction showDialog(title, body, footer) {\n  $dialog.replaceChildren(\n    h(\n      'div',\n      { class: 'dlg-head' },\n      h('h2', {}, title),\n      h('button', { class: 'link', 'aria-label': 'Close', onclick: () => $dialog.close() }, '\u2715'),\n    ),\n    h('div', { class: 'dlg-body' }, body),\n    footer ? h('div', { class: 'dlg-foot' }, footer) : null,\n  );\n  if (!$dialog.open) $dialog.showModal();\n}\n\nfunction suggestSourceId(settings, kind) {\n  const host = /^https:\\/\\/([^./]+)\\./.exec(settings.startUrl ?? '')?.[1];\n  return slug(host ?? (kind === 'console-login' ? 'personal' : 'main'));\n}\n\nconst slug = (text) =>\n  text\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 63) || 'main';\n\n/** `previous` refills the form after a failed sign-in: { provider, kind, id, settings, error }. */\nfunction openAddSource(previous) {\n  const providers = state.providers.filter((p) => state.enabledProviders.includes(p.id));\n  let provider = providers.find((p) => p.id === previous?.provider) ?? providers[0];\n  let kind = provider.kinds.find((k) => k.kind === previous?.kind) ?? provider.kinds[0];\n\n  const form = h('form', { onsubmit: (e) => e.preventDefault() });\n  const nameInput = h('input', {\n    id: 'f-name',\n    required: true,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  let nameTouched = Boolean(previous);\n  nameInput.addEventListener('input', () => {\n    nameTouched = true;\n  });\n\n  const fieldInputs = {};\n  const fieldsBox = h('div');\n  const nameLabel = h('label', { for: 'f-name' });\n\n  function updateSuggestion() {\n    if (nameTouched) return;\n    const settings = Object.fromEntries(\n      Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n    );\n    const taken = new Set(state.sources.map((s) => s.id));\n    let id = suggestSourceId(settings, kind.kind);\n    for (let i = 2; taken.has(id); i++) id = `${suggestSourceId(settings, kind.kind)}-${i}`;\n    nameInput.value = id;\n  }\n\n  function renderFields() {\n    for (const key of Object.keys(fieldInputs)) delete fieldInputs[key];\n    fieldsBox.replaceChildren(\n      ...kind.fields.map((f) => {\n        const input = h('input', {\n          id: `f-${f.key}`,\n          placeholder: f.placeholder ?? f.defaultValue ?? '',\n          value: previous?.settings?.[f.key] ?? f.defaultValue ?? '',\n          required: true,\n          class: 'mono',\n          spellcheck: 'false',\n          oninput: updateSuggestion,\n        });\n        fieldInputs[f.key] = input;\n        return h('div', { class: 'field' }, h('label', { for: input.id }, f.label), input);\n      }),\n    );\n    nameLabel.textContent = kind.nameLabel ?? 'Short name for this source';\n    updateSuggestion();\n  }\n\n  const providerSelect =\n    providers.length > 1\n      ? h(\n          'div',\n          { class: 'field' },\n          h('label', { for: 'f-provider' }, 'Cloud'),\n          h(\n            'select',\n            {\n              id: 'f-provider',\n              onchange: (e) => {\n                provider = providers.find((p) => p.id === e.target.value);\n                kind = provider.kinds[0];\n                renderKinds();\n              },\n            },\n            providers.map((p) => h('option', { value: p.id, selected: p === provider }, p.name)),\n          ),\n        )\n      : null;\n\n  const kindsBox = h('div', { class: 'choices' });\n  function renderKinds() {\n    kindsBox.replaceChildren(\n      ...provider.kinds.map((k) =>\n        h(\n          'label',\n          { class: 'choice' },\n          h('input', {\n            type: 'radio',\n            name: 'kind',\n            value: k.kind,\n            checked: k === kind,\n            onchange: () => {\n              kind = k;\n              renderFields();\n            },\n          }),\n          h('span', {}, h('strong', {}, k.label), k.hint ? h('small', {}, k.hint) : null),\n        ),\n      ),\n    );\n    renderFields();\n  }\n\n  form.append(\n    previous?.error\n      ? h(\n          'div',\n          { class: 'notice error' },\n          h('strong', {}, 'Could not sign in, so nothing was saved. '),\n          previous.error.message,\n          previous.error.hint ? h('div', { class: 'help' }, previous.error.hint) : null,\n        )\n      : '',\n    providerSelect ?? '',\n    h('div', { class: 'field' }, h('label', {}, 'What do you want to add?')),\n    kindsBox,\n    fieldsBox,\n    h(\n      'div',\n      { class: 'field' },\n      nameLabel,\n      nameInput,\n      h(\n        'span',\n        { class: 'help' },\n        'Lowercase letters, numbers and dashes. You will see it in ',\n        h('code', {}, 'cloudhop ls'),\n        '.',\n      ),\n    ),\n  );\n  renderKinds();\n  if (previous) nameInput.value = previous.id;\n\n  const submit = h('button', { class: 'primary', type: 'submit' }, 'Add and sign in');\n  form.addEventListener('submit', async () => {\n    if (!form.reportValidity()) return;\n    const body = {\n      provider: provider.id,\n      kind: kind.kind,\n      id: nameInput.value.trim(),\n      settings: Object.fromEntries(\n        Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n      ),\n    };\n    showDialog(\n      'Sign in',\n      h(\n        'div',\n        { class: 'waiting' },\n        h('div', { class: 'spinner' }),\n        h('strong', {}, 'Finish signing in in the browser tab that just opened.'),\n        h('p', { class: 'help' }, 'This page continues on its own once you approve the request.'),\n      ),\n    );\n    try {\n      const report = await api('POST', '/api/sources', body);\n      await refresh();\n      const source = state.sources.find((s) => s.id === body.id);\n      toast(`Signed in to ${body.id}. ${report.targets.length} account/role(s) found.`);\n      openAliasPicker(source, report.targets);\n    } catch (error) {\n      // Nothing was saved: reopen the form with what was typed so it can be fixed.\n      await refresh();\n      openAddSource({ ...body, error });\n    }\n  });\n\n  showDialog('Add source', form, [\n    h('button', { type: 'button', onclick: () => $dialog.close() }, 'Cancel'),\n    submit,\n  ]);\n  submit.setAttribute('form', 'add-form');\n  form.id = 'add-form';\n}\n\nasync function openAliasPicker(source, preloaded) {\n  let targets = preloaded;\n  if (!targets) {\n    showDialog(\n      `Aliases for ${source.id}`,\n      h('div', { class: 'waiting' }, h('div', { class: 'spinner' }), 'Loading accounts\u2026'),\n    );\n    try {\n      targets = (await api('GET', `/api/sources/${encodeURIComponent(source.id)}/targets`)).targets;\n    } catch (error) {\n      $dialog.close();\n      return fail(error);\n    }\n  }\n\n  const used = new Map(\n    state.aliases.filter((a) => a.source === source.id).map((a) => [a.target, a.name]),\n  );\n  const taken = new Set(state.aliases.map((a) => a.name));\n  const defaultRegion = source.settings.region ?? '';\n  const filter = h('input', {\n    type: 'search',\n    placeholder: `Filter ${targets.length} account/role(s)\u2026`,\n    style: 'width:100%;margin-bottom:12px',\n  });\n\n  const rows = targets.map((t) => {\n    const existing = used.get(t.id);\n    let name = t.suggestedAlias;\n    for (let i = 2; taken.has(name); i++) name = `${t.suggestedAlias}-${i}`;\n    const check = h('input', {\n      type: 'checkbox',\n      disabled: Boolean(existing),\n      'aria-label': t.label,\n    });\n    const aliasInput = h('input', {\n      value: name,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Alias for ${t.label}`,\n      placeholder: 'alias',\n    });\n    const regionInput = h('input', {\n      value: defaultRegion,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Region for ${t.label}`,\n      placeholder: 'region',\n    });\n    // Only the checkbox and its text sit in the label, so clicking the inputs never toggles it.\n    const el = h(\n      'div',\n      { class: 'target' },\n      h(\n        'label',\n        { class: 'pick' },\n        check,\n        h(\n          'span',\n          {},\n          t.label,\n          existing ? h('small', { class: 'already' }, `Already: ${existing}`) : null,\n        ),\n      ),\n      h('div', { class: 'inputs' }, aliasInput, regionInput),\n    );\n    return { target: t, el, check, aliasInput, regionInput };\n  });\n\n  filter.addEventListener('input', () => {\n    const q = filter.value.trim().toLowerCase();\n    for (const row of rows) row.el.hidden = q !== '' && !row.target.label.toLowerCase().includes(q);\n  });\n\n  const save = h('button', { class: 'primary' }, 'Create aliases');\n  save.addEventListener('click', () =>\n    busy(save, async () => {\n      const aliases = rows\n        .filter((r) => r.check.checked)\n        .map((r) => ({\n          source: source.id,\n          target: r.target.id,\n          name: r.aliasInput.value.trim(),\n          region: r.regionInput.value.trim(),\n        }));\n      if (aliases.length === 0) return toast('Pick at least one account/role.', { error: true });\n      try {\n        const result = await api('POST', '/api/aliases', { aliases });\n        $dialog.close();\n        toast(`Created ${result.created.join(', ')}. Try: hop ${result.created[0]}`);\n        await refresh();\n      } catch (error) {\n        fail(error);\n      }\n    }),\n  );\n\n  const body =\n    targets.length === 0\n      ? h('p', { class: 'empty' }, 'This source has no accounts or roles assigned to you.')\n      : h(\n          'div',\n          {},\n          filter,\n          h(\n            'div',\n            { class: 'targets' },\n            rows.map((r) => r.el),\n          ),\n        );\n  showDialog(`Aliases for ${source.id}`, body, [\n    h('span', { class: 'note' }, 'Check an account/role, then name its alias and region.'),\n    h('button', { onclick: () => $dialog.close() }, 'Cancel'),\n    targets.length ? save : null,\n  ]);\n}\n\n$addSource.addEventListener('click', () => openAddSource());\n\nif (!token) {\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Open the link from your terminal'),\n      h('p', {}, 'Run cloudhop ui and open the link it prints. It includes a one-time access key.'),\n    ),\n  );\n} else {\n  refresh();\n}\n";
+var app_default = "// cloudhop local UI. Plain DOM, no build step: served as-is by `cloudhop ui`.\n\nconst TOKEN_KEY = 'cloudhop-token';\nconst SESSION_TEXT = {\n  valid: 'Session valid',\n  refreshable: 'Renews on next use',\n  expired: 'Expired: sign in on next use',\n  unknown: 'Managed by the cloud CLI',\n};\n\n// The token arrives in the URL fragment once; keep it for this tab and clean the address bar.\nconst fromHash = new URLSearchParams(location.hash.slice(1)).get('token');\nif (fromHash) {\n  try {\n    sessionStorage.setItem(TOKEN_KEY, fromHash);\n  } catch {}\n  history.replaceState(null, '', location.pathname);\n}\nlet token = fromHash;\ntry {\n  token = token ?? sessionStorage.getItem(TOKEN_KEY);\n} catch {}\n\n// ---------- pages ----------\n\nconst PAGES = {\n  aliases: 'Aliases',\n  sources: 'Sources',\n  assistants: 'AI assistants',\n  tools: 'Tools',\n};\nlet route = 'aliases';\nconst aliasFilter = { text: '', source: '', prodOnly: false };\n\n/** `#/aliases?source=acme` \u2192 route \"aliases\", filtered by that source. */\nfunction readRoute() {\n  const match = /^#\\/([a-z]+)(?:\\?(.*))?$/.exec(location.hash);\n  route = match && PAGES[match[1]] ? match[1] : 'aliases';\n  const query = new URLSearchParams(match?.[2] ?? '');\n  if (query.has('source')) aliasFilter.source = query.get('source');\n}\n\nfunction go(page, query) {\n  location.hash = `#/${page}${query ? `?${new URLSearchParams(query)}` : ''}`;\n}\n\n// A fresh link opened in this same tab carries a new token: reload to pick it up.\n// Any other fragment is a page change.\naddEventListener('hashchange', () => {\n  if (new URLSearchParams(location.hash.slice(1)).has('token')) {\n    location.reload();\n    return;\n  }\n  readRoute();\n  if (state) render();\n});\n\nconst $main = document.getElementById('main');\nconst $dialog = document.getElementById('dialog');\nconst $toasts = document.getElementById('toasts');\nconst $addSource = document.getElementById('add-source');\nconst $nav = document.getElementById('nav');\nlet state;\n\n/** Tiny element builder: h('button', { class: 'primary', onclick }, 'Save'). */\nfunction h(tag, attrs = {}, ...children) {\n  const el = document.createElement(tag);\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null || value === false) continue;\n    if (key.startsWith('on')) el.addEventListener(key.slice(2), value);\n    else if (key === 'class') el.className = value;\n    else if (value === true) el.setAttribute(key, '');\n    else el.setAttribute(key, value);\n  }\n  for (const child of children.flat()) {\n    if (child === undefined || child === null || child === false) continue;\n    el.append(child instanceof Node ? child : document.createTextNode(String(child)));\n  }\n  return el;\n}\n\nclass ApiError extends Error {\n  constructor(message, hint) {\n    super(message);\n    this.hint = hint;\n  }\n}\n\n// Calls that may sign in wait for the person in the browser; everything else should answer quickly.\nconst MAY_SIGN_IN = /^\\/api\\/(sources(\\/[^/]+\\/(login|sync|targets))?|aliases\\/[^/]+\\/console)$/;\nconst QUICK_TIMEOUT_MS = 20_000;\n\nasync function api(method, path, body) {\n  const waitsForPerson = MAY_SIGN_IN.test(path);\n  let response;\n  try {\n    response = await fetch(path, {\n      method,\n      headers: {\n        'x-cloudhop-token': token ?? '',\n        ...(body ? { 'content-type': 'application/json' } : {}),\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: waitsForPerson ? undefined : AbortSignal.timeout(QUICK_TIMEOUT_MS),\n    });\n  } catch (error) {\n    if (error.name === 'TimeoutError') {\n      throw new ApiError(\n        'cloudhop ui is not responding.',\n        'Is it paused in your terminal (Ctrl-Z)? Run `fg` there, or stop it and run `cloudhop ui` again.',\n      );\n    }\n    throw new ApiError(\n      'cloudhop ui is not running.',\n      'Run `cloudhop ui` again and open the new link it prints.',\n    );\n  }\n  const data = await response.json().catch(() => ({}));\n  if (!response.ok)\n    throw new ApiError(data.error ?? `Request failed (${response.status}).`, data.hint);\n  return data;\n}\n\nfunction toast(message, { error = false, hint } = {}) {\n  const el = h(\n    'div',\n    { class: `toast${error ? ' error' : ''}` },\n    message,\n    hint && h('small', {}, hint),\n  );\n  $toasts.append(el);\n  setTimeout(() => el.remove(), error ? 9000 : 4000);\n}\n\nconst fail = (error) => toast(error.message, { error: true, hint: error.hint });\n\n/** Disables a button while its action runs. */\nasync function busy(button, action) {\n  button.disabled = true;\n  try {\n    return await action();\n  } finally {\n    button.disabled = false;\n  }\n}\n\nasync function refresh() {\n  try {\n    state = await api('GET', '/api/state');\n    render();\n    checkDoctor();\n  } catch (error) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Cannot reach cloudhop'),\n        h('p', {}, error.message, error.hint ? ` ${error.hint}` : ''),\n      ),\n    );\n  }\n}\n\nasync function checkDoctor() {\n  try {\n    const entries = await api('GET', '/api/doctor');\n    const problems = entries.filter((e) => !e.installed || e.outdated);\n    document.getElementById('doctor')?.remove();\n    if (problems.length === 0) return;\n    $main.prepend(\n      h(\n        'div',\n        { class: 'notice', id: 'doctor' },\n        ...problems.map((e) =>\n          h(\n            'div',\n            {},\n            e.installed\n              ? `${e.cli} ${e.version} is older than ${e.minVersion}. `\n              : `${e.cli} is not installed, so aliases cannot run commands yet. `,\n            'Run ',\n            h('code', {}, 'cloudhop doctor'),\n            ' in a terminal to install it.',\n          ),\n        ),\n      ),\n    );\n  } catch {}\n}\n\n// ---------- main view ----------\n\nfunction render() {\n  const enabled = state.enabledProviders;\n  $addSource.hidden = enabled.length === 0;\n  $nav.hidden = enabled.length === 0;\n  if (enabled.length === 0) return renderChooseClouds();\n  for (const link of $nav.querySelectorAll('a')) {\n    if (link.dataset.page === route) link.setAttribute('aria-current', 'page');\n    else link.removeAttribute('aria-current');\n  }\n  document.title = `${PAGES[route]} \xB7 cloudhop`;\n  const pages = {\n    aliases: aliasesPage,\n    sources: sourcesPage,\n    assistants: assistantsPage,\n    tools: toolsPage,\n  };\n  $main.replaceChildren(...pages[route]());\n  if (route === 'assistants') loadAssistants();\n  if (route === 'tools') loadTools();\n}\n\nfunction pageHead(title, subtitle, ...actions) {\n  return h(\n    'div',\n    { class: 'page-head' },\n    h('div', {}, h('h1', {}, title), subtitle ? h('p', {}, subtitle) : null),\n    h('div', { class: 'actions' }, actions),\n  );\n}\n\nfunction firstSourceHero() {\n  return h(\n    'div',\n    { class: 'hero' },\n    h('h2', {}, 'Add your first account'),\n    h(\n      'p',\n      {},\n      'Add a company SSO portal or a personal account. cloudhop signs you in, finds every account and role you can use, and lets you give each one a short alias.',\n    ),\n    h('button', { class: 'primary', onclick: () => openAddSource() }, '+ Add source'),\n  );\n}\n\n// ---------- Aliases page ----------\n\nfunction aliasesPage() {\n  if (state.sources.length === 0) return [firstSourceHero()];\n  if (aliasFilter.source && !state.sources.some((s) => s.id === aliasFilter.source))\n    aliasFilter.source = '';\n\n  const addAliases = () => {\n    const source =\n      state.sources.find((s) => s.id === aliasFilter.source) ??\n      (state.sources.length === 1 ? state.sources[0] : undefined);\n    if (source) openAliasPicker(source);\n    else openSourceChooser();\n  };\n  const head = pageHead(\n    'Aliases',\n    'Each alias is one account, role and region. Run it with hop <alias>.',\n    h('button', { onclick: addAliases }, '+ Aliases'),\n  );\n  if (state.aliases.length === 0) {\n    return [\n      head,\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'No aliases yet'),\n        h('p', {}, 'Pick the accounts and roles you use and give each one a short name.'),\n        h('button', { class: 'primary', onclick: addAliases }, 'Pick accounts'),\n      ),\n    ];\n  }\n\n  const rows = h('tbody', { id: 'alias-rows' });\n  const count = h('span', { class: 'count' });\n  const fill = () => {\n    const words = aliasFilter.text.toLowerCase().split(/\\s+/).filter(Boolean);\n    const visible = state.aliases.filter((a) => {\n      if (aliasFilter.source && a.source !== aliasFilter.source) return false;\n      if (aliasFilter.prodOnly && !a.prod) return false;\n      const text = `${a.name} ${a.label ?? a.target} ${a.region ?? ''} ${a.source}`.toLowerCase();\n      return words.every((w) => text.includes(w));\n    });\n    rows.replaceChildren(\n      ...(visible.length\n        ? visible.map(aliasRow)\n        : [\n            h(\n              'tr',\n              {},\n              h('td', { colspan: '5', class: 'empty' }, 'No alias matches these filters.'),\n            ),\n          ]),\n    );\n    count.textContent = `${visible.length} of ${state.aliases.length}`;\n  };\n\n  const search = h('input', {\n    type: 'search',\n    placeholder: 'Filter: name, account, role or region',\n    value: aliasFilter.text,\n    'aria-label': 'Filter aliases',\n    oninput: (e) => {\n      aliasFilter.text = e.currentTarget.value;\n      fill();\n    },\n  });\n  const sourceSelect = h(\n    'select',\n    {\n      'aria-label': 'Source',\n      onchange: (e) => {\n        aliasFilter.source = e.currentTarget.value;\n        fill();\n      },\n    },\n    h('option', { value: '' }, 'All sources'),\n    state.sources.map((s) =>\n      h('option', { value: s.id, selected: s.id === aliasFilter.source }, s.id),\n    ),\n  );\n  const prodOnly = h(\n    'label',\n    { class: 'prod-toggle' },\n    h('input', {\n      type: 'checkbox',\n      checked: aliasFilter.prodOnly,\n      onchange: (e) => {\n        aliasFilter.prodOnly = e.currentTarget.checked;\n        fill();\n      },\n    }),\n    'Production only',\n  );\n\n  const table = h(\n    'table',\n    { class: 'aliases' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Alias'),\n        h('th', {}, 'Source'),\n        h('th', {}, 'Region'),\n        h('th', {}, 'Account / role'),\n        h('th'),\n      ),\n    ),\n    rows,\n  );\n  fill();\n  return [\n    head,\n    h(\n      'div',\n      { class: 'toolbar' },\n      search,\n      sourceSelect,\n      prodOnly,\n      h('div', { class: 'spacer' }),\n      count,\n    ),\n    h('section', { class: 'card' }, table),\n  ];\n}\n\n/** When several sources exist, ask which one to pick accounts from. */\nfunction openSourceChooser() {\n  showDialog(\n    'Add aliases from',\n    h(\n      'div',\n      { class: 'choices' },\n      state.sources.map((source) =>\n        h(\n          'button',\n          { class: 'choice', onclick: () => openAliasPicker(source) },\n          h(\n            'span',\n            {},\n            h('strong', {}, source.id),\n            h('small', {}, source.settings.startUrl ?? source.kindLabel),\n          ),\n        ),\n      ),\n    ),\n  );\n}\n\n// ---------- Sources page ----------\n\nfunction sourcesPage() {\n  const head = pageHead('Sources', 'The SSO portals and personal accounts you sign in to.');\n  if (state.sources.length === 0) return [head, firstSourceHero()];\n  return [head, ...state.sources.map(sourceCard)];\n}\n\n// ---------- AI assistants page ----------\n\nfunction assistantsPage() {\n  return [assistantsCard()];\n}\n\n// ---------- Tools page ----------\n\nfunction snippet(command) {\n  return h(\n    'div',\n    { class: 'snippet' },\n    h('code', {}, command),\n    h(\n      'button',\n      {\n        class: 'link',\n        title: 'Copy',\n        'aria-label': `Copy ${command}`,\n        onclick: () =>\n          navigator.clipboard\n            ?.writeText(command)\n            .then(() => toast('Copied.'))\n            .catch(() =>\n              toast('Copy it by hand: the browser blocked the clipboard.', { error: true }),\n            ),\n      },\n      'Copy',\n    ),\n  );\n}\n\nfunction toolCard(title, text, ...commands) {\n  return h(\n    'section',\n    { class: 'card' },\n    h('div', { class: 'card-head' }, h('h2', {}, title)),\n    h(\n      'div',\n      { class: 'card-body padded' },\n      h('p', { class: 'card-help' }, text),\n      commands.map(snippet),\n    ),\n  );\n}\n\nfunction toolsPage() {\n  const sample = state.aliases[0]?.name ?? 'acme-dev';\n  return [\n    pageHead('Tools', 'More ways to use cloudhop from your terminal.'),\n    h(\n      'section',\n      { class: 'card', id: 'tools-cli' },\n      h('div', { class: 'card-head' }, h('h2', {}, 'Cloud CLIs')),\n      h('div', { class: 'card-body padded' }, h('p', { class: 'card-help' }, 'Checking\u2026')),\n    ),\n    toolCard(\n      'Shell integration',\n      'Pick aliases from a list, tab-complete them, and use one in your shell so plain aws and Terraform work without hop.',\n      'cloudhop shell install',\n      `cloudhop use ${sample}`,\n      'hop',\n    ),\n    toolCard(\n      'Run in many accounts',\n      'Run one command in many aliases at once: names, lists, wildcards or /regex/. It asks before running.',\n      `cloudhop each '${sample.split('-')[0]}-*' -- s3 ls`,\n    ),\n    toolCard(\n      'Share with your team',\n      'Export your portals and aliases (no secrets) and let teammates import them in one command.',\n      'cloudhop team export --out team.yaml',\n      'cloudhop team import team.yaml',\n    ),\n  ];\n}\n\nasync function loadTools() {\n  const card = document.querySelector('#tools-cli .card-body');\n  if (!card) return;\n  try {\n    const entries = await api('GET', '/api/doctor');\n    card.replaceChildren(\n      ...entries.map((e) =>\n        h(\n          'div',\n          { class: 'tool-row' },\n          h('span', { class: `badge ${e.installed && !e.outdated ? 'valid' : 'expired'}` }, e.cli),\n          h(\n            'span',\n            {},\n            !e.installed\n              ? 'Not installed.'\n              : e.outdated\n                ? `${e.version} is older than ${e.minVersion}.`\n                : `Version ${e.version}.`,\n          ),\n          e.installed && !e.outdated ? null : snippet('cloudhop doctor'),\n        ),\n      ),\n    );\n  } catch (error) {\n    card.replaceChildren(h('p', { class: 'card-help' }, error.message));\n  }\n}\n\n// ---------- AI assistants ----------\n\nlet assistantScope = 'user';\ntry {\n  assistantScope =\n    localStorage.getItem('cloudhop-assistant-scope') === 'project' ? 'project' : 'user';\n} catch {}\nlet assistantsData;\n\nconst SKILL_TEXT = {\n  current: ['valid', 'Up to date'],\n  outdated: ['refreshable', 'Outdated'],\n  modified: ['refreshable', 'Edited by you'],\n  missing: ['', 'Not installed'],\n};\nconst MCP_TEXT = { registered: 'On', missing: 'Off', unknown: 'Check in the app' };\n\nfunction assistantsCard() {\n  return h('section', { class: 'card', id: 'assistants', hidden: true });\n}\n\nasync function loadAssistants() {\n  try {\n    assistantsData = await api('GET', '/api/assistants');\n    renderAssistants();\n  } catch {\n    document.getElementById('assistants')?.remove();\n  }\n}\n\nfunction setAssistantScope(scope) {\n  assistantScope = scope;\n  try {\n    localStorage.setItem('cloudhop-assistant-scope', scope);\n  } catch {}\n  renderAssistants();\n}\n\nfunction assistantAction(label, run, { danger = false, confirmText } = {}) {\n  return h(\n    'button',\n    {\n      class: danger ? 'danger' : undefined,\n      onclick: (e) => {\n        if (confirmText && !confirm(confirmText)) return;\n        busy(e.currentTarget, async () => {\n          try {\n            await run();\n          } catch (error) {\n            fail(error);\n          }\n          await loadAssistants();\n        });\n      },\n    },\n    label,\n  );\n}\n\nfunction reportInstall(results) {\n  for (const r of results) {\n    if (r.mcp === 'manual') {\n      toast(`${r.name}: skill installed. Add the MCP server by hand.`, { hint: r.mcpManual });\n    } else {\n      toast(`${r.name} now knows cloudhop. Start a new chat so it picks it up.`);\n    }\n  }\n}\n\nfunction renderAssistants() {\n  const el = document.getElementById('assistants');\n  if (!el || !assistantsData) return;\n  const rows = assistantScope === 'user' ? assistantsData.user : assistantsData.projectScope;\n  const scope = assistantScope;\n  const install = (tools) =>\n    api('POST', '/api/assistants', { tools, scope, mcp: true }).then((r) =>\n      reportInstall(r.results),\n    );\n  const missingDetected = rows\n    .filter((r) => r.detected && r.skill === 'missing')\n    .map((r) => r.assistant);\n\n  const seg = h(\n    'div',\n    { class: 'seg', role: 'group', 'aria-label': 'Where' },\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'user'), onclick: () => setAssistantScope('user') },\n      'For me',\n    ),\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'project'), onclick: () => setAssistantScope('project') },\n      'This project',\n    ),\n  );\n\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, 'AI assistants'),\n    h(\n      'span',\n      { class: 'meta' },\n      scope === 'user'\n        ? 'Installed in your home folder, for every project'\n        : assistantsData.project,\n    ),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      seg,\n      missingDetected.length > 1\n        ? assistantAction('Install for all detected', () => install(missingDetected))\n        : null,\n    ),\n  );\n\n  const table = h(\n    'table',\n    { class: 'assistants' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Assistant'),\n        h('th', {}, 'Skill'),\n        h('th', {}, 'MCP server'),\n        h('th'),\n      ),\n    ),\n    h(\n      'tbody',\n      {},\n      rows.map((r) => {\n        const [badgeClass, skillText] = SKILL_TEXT[r.skill];\n        const actions = [];\n        if (r.skill === 'missing')\n          actions.push(assistantAction('Install', () => install([r.assistant])));\n        if (r.skill === 'outdated') {\n          actions.push(\n            assistantAction('Update', () =>\n              api('POST', '/api/assistants/update', {}).then(() =>\n                toast(`${r.name}: skill updated.`),\n              ),\n            ),\n          );\n        }\n        if (r.skill === 'modified') {\n          actions.push(\n            assistantAction(\n              'Replace',\n              () =>\n                api('POST', '/api/assistants/update', { force: true }).then(() =>\n                  toast('Edited skills replaced.'),\n                ),\n              {\n                confirmText: 'Replace your edited copies with the current cloudhop skill?',\n              },\n            ),\n          );\n        }\n        if (r.skill !== 'missing' || r.mcp === 'registered') {\n          actions.push(\n            assistantAction(\n              'Remove',\n              () => api('POST', '/api/assistants/remove', { tools: [r.assistant], scope }),\n              {\n                danger: true,\n                confirmText: `Remove the cloudhop skill and MCP server from ${r.name}?`,\n              },\n            ),\n          );\n        }\n        return h(\n          'tr',\n          {},\n          h(\n            'td',\n            { class: 'alias' },\n            r.name,\n            r.detected ? null : h('small', { class: 'muted-inline' }, ' not detected'),\n          ),\n          h('td', {}, h('span', { class: `badge ${badgeClass}`, title: r.skillPath }, skillText)),\n          h('td', {}, r.skill === 'missing' && r.mcp !== 'registered' ? '' : MCP_TEXT[r.mcp]),\n          h(\n            'td',\n            { style: 'text-align:right' },\n            h('div', { class: 'actions', style: 'justify-content:flex-end' }, actions),\n          ),\n        );\n      }),\n    ),\n  );\n\n  el.replaceChildren(\n    head,\n    h(\n      'div',\n      { class: 'card-body' },\n      h(\n        'p',\n        { class: 'card-help' },\n        'Teach your AI assistant to use cloudhop: it asks you which alias to work with, runs commands with hop, and confirms before changing anything. Includes the cloudhop MCP server.',\n      ),\n      table,\n    ),\n  );\n  el.hidden = false;\n}\n\nfunction renderChooseClouds() {\n  const boxes = state.providers.map((p) =>\n    h(\n      'label',\n      { class: 'choice' },\n      h('input', { type: 'checkbox', value: p.id, checked: true }),\n      h('span', {}, p.name),\n    ),\n  );\n  const save = h(\n    'button',\n    {\n      class: 'primary',\n      onclick: (e) =>\n        busy(e.currentTarget, async () => {\n          const ids = boxes\n            .map((b) => b.querySelector('input'))\n            .filter((i) => i.checked)\n            .map((i) => i.value);\n          await api('PUT', '/api/providers', { enabled: ids }).catch(fail);\n          await refresh();\n        }),\n    },\n    'Continue',\n  );\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Which clouds do you use?'),\n      h('p', {}, 'Azure and Google Cloud are coming soon.'),\n      h(\n        'div',\n        { class: 'choices', style: 'max-width:320px;margin:0 auto 16px;text-align:left' },\n        boxes,\n      ),\n      save,\n    ),\n  );\n}\n\nfunction sourceCard(source) {\n  const aliases = state.aliases.filter((a) => a.source === source.id);\n  const where = source.settings.startUrl ?? source.kindLabel;\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, source.id),\n    h('span', { class: `badge ${source.session}` }, SESSION_TEXT[source.session] ?? source.session),\n    h('span', { class: 'meta' }, `${source.providerName} \xB7 ${where}`),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      h('button', { onclick: () => openAliasPicker(source) }, '+ Aliases'),\n      h(\n        'button',\n        {\n          title: 'Sign in again and refresh its accounts',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              toast('Opening the browser to sign in\u2026');\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/login`,\n              ).catch(fail);\n              if (report)\n                toast(`${source.id}: signed in, ${report.targets.length} account/role(s).`);\n              await refresh();\n            }),\n        },\n        'Sign in',\n      ),\n      h(\n        'button',\n        {\n          title: 'Refresh the accounts and roles you have access to',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/sync`,\n              ).catch(fail);\n              if (report) toast(syncMessage(source.id, report));\n              await refresh();\n            }),\n        },\n        'Sync',\n      ),\n      h(\n        'button',\n        {\n          class: 'danger',\n          onclick: (e) => {\n            const count = aliases.length;\n            const message = `Remove \"${source.id}\"${count ? ` and its ${count} alias(es)` : ''}?`;\n            if (!confirm(message)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/sources/${encodeURIComponent(source.id)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        'Remove',\n      ),\n    ),\n  );\n\n  const prodCount = aliases.filter((a) => a.prod).length;\n  const body =\n    aliases.length === 0\n      ? h(\n          'div',\n          { class: 'empty' },\n          'No aliases yet. ',\n          h(\n            'button',\n            { class: 'primary', onclick: () => openAliasPicker(source) },\n            'Pick accounts',\n          ),\n        )\n      : h(\n          'div',\n          { class: 'source-summary' },\n          h(\n            'span',\n            {},\n            `${aliases.length} alias(es)`,\n            prodCount ? h('span', { class: 'prod-tag' }, `${prodCount} PROD`) : null,\n          ),\n          h(\n            'button',\n            { class: 'link', onclick: () => go('aliases', { source: source.id }) },\n            'View aliases \u2192',\n          ),\n        );\n  return h('section', { class: 'card' }, head, h('div', { class: 'card-body' }, body));\n}\n\nfunction syncMessage(id, report) {\n  const parts = [`${report.targets.length} available`];\n  if (report.added) parts.push(`${report.added} new`);\n  if (report.removed) parts.push(`${report.removed} removed`);\n  const orphaned = report.orphanedAliases.length\n    ? ` No longer available: ${report.orphanedAliases.join(', ')}.`\n    : '';\n  return `${id}: ${parts.join(', ')}.${orphaned}`;\n}\n\nfunction aliasRow(alias) {\n  const input = h('input', {\n    value: alias.region ?? '',\n    'aria-label': `Region for ${alias.name}`,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  const save = h('button', { hidden: true }, 'Save');\n  const commit = () =>\n    busy(save, async () => {\n      const region = input.value.trim();\n      const done = await api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, {\n        region,\n      }).catch(fail);\n      if (done) toast(`${alias.name} now runs in ${region}.`);\n      await refresh();\n    });\n  input.addEventListener('input', () => {\n    save.hidden = input.value.trim() === (alias.region ?? '');\n  });\n  input.addEventListener('keydown', (e) => {\n    if (e.key === 'Enter' && !save.hidden) commit();\n    if (e.key === 'Escape') {\n      input.value = alias.region ?? '';\n      save.hidden = true;\n    }\n  });\n  save.addEventListener('click', commit);\n\n  const patch = (body, message) =>\n    api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, body)\n      .then(() => message && toast(message))\n      .catch(fail)\n      .then(refresh);\n  const iconButton = (label, title, onclick, extra = {}) =>\n    h('button', { class: 'link', title, 'aria-label': title, onclick, ...extra }, label);\n\n  const actions = h(\n    'div',\n    { class: 'row-actions' },\n    h(\n      'button',\n      {\n        title: `Open the AWS console as ${alias.name}, already signed in`,\n        disabled: alias.missing,\n        onclick: (e) =>\n          busy(e.currentTarget, async () => {\n            const result = await api(\n              'POST',\n              `/api/aliases/${encodeURIComponent(alias.name)}/console`,\n              {},\n            ).catch(fail);\n            if (result) {\n              toast(\n                result.via === 'signed-in'\n                  ? `Opened the console for ${alias.name}.`\n                  : result.via === 'portal'\n                    ? `Opened ${alias.name} through the SSO portal.`\n                    : `Opened the console sign-in page for ${alias.name}.`,\n              );\n            }\n          }),\n      },\n      'Console',\n    ),\n    h(\n      'label',\n      { class: 'prod-toggle', title: 'Production: hop and AI assistants ask before any change' },\n      h('input', {\n        type: 'checkbox',\n        checked: alias.prod,\n        'aria-label': `${alias.name} is production`,\n        onchange: (e) =>\n          patch(\n            { prod: e.currentTarget.checked },\n            e.currentTarget.checked\n              ? `${alias.name} is now production.`\n              : `${alias.name} is no longer production.`,\n          ),\n      }),\n      'Prod',\n    ),\n    iconButton('\u270E', `Rename ${alias.name}`, () => {\n      const to = prompt(`New name for \"${alias.name}\"`, alias.name)?.trim();\n      if (to && to !== alias.name) patch({ name: to }, `${alias.name} is now ${to}.`);\n    }),\n    iconButton(\n      '\u2715',\n      `Remove ${alias.name}`,\n      (e) => {\n        if (!confirm(`Remove alias \"${alias.name}\"?`)) return;\n        busy(e.currentTarget, async () => {\n          await api('DELETE', `/api/aliases/${encodeURIComponent(alias.name)}`).catch(fail);\n          await refresh();\n        });\n      },\n      { class: 'link danger-hover' },\n    ),\n  );\n\n  return h(\n    'tr',\n    { class: alias.prod ? 'prod' : undefined },\n    h(\n      'td',\n      { class: 'alias', title: `hop ${alias.name} <command>` },\n      alias.name,\n      alias.prod ? h('span', { class: 'prod-tag' }, 'PROD') : null,\n    ),\n    h('td', { class: 'muted' }, alias.source),\n    h('td', {}, h('div', { class: 'region' }, input, save)),\n    h(\n      'td',\n      {},\n      alias.missing\n        ? h('span', { class: 'missing' }, `${alias.target} (no longer available)`)\n        : alias.label,\n    ),\n    h('td', { style: 'text-align:right' }, actions),\n  );\n}\n\n// ---------- dialogs ----------\n\nfunction showDialog(title, body, footer) {\n  $dialog.replaceChildren(\n    h(\n      'div',\n      { class: 'dlg-head' },\n      h('h2', {}, title),\n      h('button', { class: 'link', 'aria-label': 'Close', onclick: () => $dialog.close() }, '\u2715'),\n    ),\n    h('div', { class: 'dlg-body' }, body),\n    footer ? h('div', { class: 'dlg-foot' }, footer) : null,\n  );\n  if (!$dialog.open) $dialog.showModal();\n}\n\nfunction suggestSourceId(settings, kind) {\n  const host = /^https:\\/\\/([^./]+)\\./.exec(settings.startUrl ?? '')?.[1];\n  return slug(host ?? (kind === 'console-login' ? 'personal' : 'main'));\n}\n\nconst slug = (text) =>\n  text\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 63) || 'main';\n\n/** `previous` refills the form after a failed sign-in: { provider, kind, id, settings, error }. */\nfunction openAddSource(previous) {\n  const providers = state.providers.filter((p) => state.enabledProviders.includes(p.id));\n  let provider = providers.find((p) => p.id === previous?.provider) ?? providers[0];\n  let kind = provider.kinds.find((k) => k.kind === previous?.kind) ?? provider.kinds[0];\n\n  const form = h('form', { onsubmit: (e) => e.preventDefault() });\n  const nameInput = h('input', {\n    id: 'f-name',\n    required: true,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  let nameTouched = Boolean(previous);\n  nameInput.addEventListener('input', () => {\n    nameTouched = true;\n  });\n\n  const fieldInputs = {};\n  const fieldsBox = h('div');\n  const nameLabel = h('label', { for: 'f-name' });\n\n  function updateSuggestion() {\n    if (nameTouched) return;\n    const settings = Object.fromEntries(\n      Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n    );\n    const taken = new Set(state.sources.map((s) => s.id));\n    let id = suggestSourceId(settings, kind.kind);\n    for (let i = 2; taken.has(id); i++) id = `${suggestSourceId(settings, kind.kind)}-${i}`;\n    nameInput.value = id;\n  }\n\n  function renderFields() {\n    for (const key of Object.keys(fieldInputs)) delete fieldInputs[key];\n    fieldsBox.replaceChildren(\n      ...kind.fields.map((f) => {\n        const input = h('input', {\n          id: `f-${f.key}`,\n          placeholder: f.placeholder ?? f.defaultValue ?? '',\n          value: previous?.settings?.[f.key] ?? f.defaultValue ?? '',\n          required: true,\n          class: 'mono',\n          spellcheck: 'false',\n          oninput: updateSuggestion,\n        });\n        fieldInputs[f.key] = input;\n        return h('div', { class: 'field' }, h('label', { for: input.id }, f.label), input);\n      }),\n    );\n    nameLabel.textContent = kind.nameLabel ?? 'Short name for this source';\n    updateSuggestion();\n  }\n\n  const providerSelect =\n    providers.length > 1\n      ? h(\n          'div',\n          { class: 'field' },\n          h('label', { for: 'f-provider' }, 'Cloud'),\n          h(\n            'select',\n            {\n              id: 'f-provider',\n              onchange: (e) => {\n                provider = providers.find((p) => p.id === e.target.value);\n                kind = provider.kinds[0];\n                renderKinds();\n              },\n            },\n            providers.map((p) => h('option', { value: p.id, selected: p === provider }, p.name)),\n          ),\n        )\n      : null;\n\n  const kindsBox = h('div', { class: 'choices' });\n  function renderKinds() {\n    kindsBox.replaceChildren(\n      ...provider.kinds.map((k) =>\n        h(\n          'label',\n          { class: 'choice' },\n          h('input', {\n            type: 'radio',\n            name: 'kind',\n            value: k.kind,\n            checked: k === kind,\n            onchange: () => {\n              kind = k;\n              renderFields();\n            },\n          }),\n          h('span', {}, h('strong', {}, k.label), k.hint ? h('small', {}, k.hint) : null),\n        ),\n      ),\n    );\n    renderFields();\n  }\n\n  form.append(\n    previous?.error\n      ? h(\n          'div',\n          { class: 'notice error' },\n          h('strong', {}, 'Could not sign in, so nothing was saved. '),\n          previous.error.message,\n          previous.error.hint ? h('div', { class: 'help' }, previous.error.hint) : null,\n        )\n      : '',\n    providerSelect ?? '',\n    h('div', { class: 'field' }, h('label', {}, 'What do you want to add?')),\n    kindsBox,\n    fieldsBox,\n    h(\n      'div',\n      { class: 'field' },\n      nameLabel,\n      nameInput,\n      h(\n        'span',\n        { class: 'help' },\n        'Lowercase letters, numbers and dashes. You will see it in ',\n        h('code', {}, 'cloudhop ls'),\n        '.',\n      ),\n    ),\n  );\n  renderKinds();\n  if (previous) nameInput.value = previous.id;\n\n  const submit = h('button', { class: 'primary', type: 'submit' }, 'Add and sign in');\n  form.addEventListener('submit', async () => {\n    if (!form.reportValidity()) return;\n    const body = {\n      provider: provider.id,\n      kind: kind.kind,\n      id: nameInput.value.trim(),\n      settings: Object.fromEntries(\n        Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n      ),\n    };\n    showDialog(\n      'Sign in',\n      h(\n        'div',\n        { class: 'waiting' },\n        h('div', { class: 'spinner' }),\n        h('strong', {}, 'Finish signing in in the browser tab that just opened.'),\n        h('p', { class: 'help' }, 'This page continues on its own once you approve the request.'),\n      ),\n    );\n    try {\n      const report = await api('POST', '/api/sources', body);\n      await refresh();\n      const source = state.sources.find((s) => s.id === body.id);\n      toast(`Signed in to ${body.id}. ${report.targets.length} account/role(s) found.`);\n      openAliasPicker(source, report.targets);\n    } catch (error) {\n      // Nothing was saved: reopen the form with what was typed so it can be fixed.\n      await refresh();\n      openAddSource({ ...body, error });\n    }\n  });\n\n  showDialog('Add source', form, [\n    h('button', { type: 'button', onclick: () => $dialog.close() }, 'Cancel'),\n    submit,\n  ]);\n  submit.setAttribute('form', 'add-form');\n  form.id = 'add-form';\n}\n\nasync function openAliasPicker(source, preloaded) {\n  let targets = preloaded;\n  if (!targets) {\n    showDialog(\n      `Aliases for ${source.id}`,\n      h('div', { class: 'waiting' }, h('div', { class: 'spinner' }), 'Loading accounts\u2026'),\n    );\n    try {\n      targets = (await api('GET', `/api/sources/${encodeURIComponent(source.id)}/targets`)).targets;\n    } catch (error) {\n      $dialog.close();\n      return fail(error);\n    }\n  }\n\n  const used = new Map(\n    state.aliases.filter((a) => a.source === source.id).map((a) => [a.target, a.name]),\n  );\n  const taken = new Set(state.aliases.map((a) => a.name));\n  const defaultRegion = source.settings.region ?? '';\n  const filter = h('input', {\n    type: 'search',\n    placeholder: `Filter ${targets.length} account/role(s)\u2026`,\n    style: 'width:100%;margin-bottom:12px',\n  });\n\n  const rows = targets.map((t) => {\n    const existing = used.get(t.id);\n    let name = t.suggestedAlias;\n    for (let i = 2; taken.has(name); i++) name = `${t.suggestedAlias}-${i}`;\n    const check = h('input', {\n      type: 'checkbox',\n      disabled: Boolean(existing),\n      'aria-label': t.label,\n    });\n    const aliasInput = h('input', {\n      value: name,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Alias for ${t.label}`,\n      placeholder: 'alias',\n    });\n    const regionInput = h('input', {\n      value: defaultRegion,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Region for ${t.label}`,\n      placeholder: 'region',\n    });\n    // Only the checkbox and its text sit in the label, so clicking the inputs never toggles it.\n    const el = h(\n      'div',\n      { class: 'target' },\n      h(\n        'label',\n        { class: 'pick' },\n        check,\n        h(\n          'span',\n          {},\n          t.label,\n          existing ? h('small', { class: 'already' }, `Already: ${existing}`) : null,\n        ),\n      ),\n      h('div', { class: 'inputs' }, aliasInput, regionInput),\n    );\n    return { target: t, el, check, aliasInput, regionInput };\n  });\n\n  filter.addEventListener('input', () => {\n    const q = filter.value.trim().toLowerCase();\n    for (const row of rows) row.el.hidden = q !== '' && !row.target.label.toLowerCase().includes(q);\n  });\n\n  const save = h('button', { class: 'primary' }, 'Create aliases');\n  save.addEventListener('click', () =>\n    busy(save, async () => {\n      const aliases = rows\n        .filter((r) => r.check.checked)\n        .map((r) => ({\n          source: source.id,\n          target: r.target.id,\n          name: r.aliasInput.value.trim(),\n          region: r.regionInput.value.trim(),\n        }));\n      if (aliases.length === 0) return toast('Pick at least one account/role.', { error: true });\n      try {\n        const result = await api('POST', '/api/aliases', { aliases });\n        $dialog.close();\n        toast(`Created ${result.created.join(', ')}. Try: hop ${result.created[0]}`);\n        await refresh();\n      } catch (error) {\n        fail(error);\n      }\n    }),\n  );\n\n  const body =\n    targets.length === 0\n      ? h('p', { class: 'empty' }, 'This source has no accounts or roles assigned to you.')\n      : h(\n          'div',\n          {},\n          filter,\n          h(\n            'div',\n            { class: 'targets' },\n            rows.map((r) => r.el),\n          ),\n        );\n  showDialog(`Aliases for ${source.id}`, body, [\n    h('span', { class: 'note' }, 'Check an account/role, then name its alias and region.'),\n    h('button', { onclick: () => $dialog.close() }, 'Cancel'),\n    targets.length ? save : null,\n  ]);\n}\n\n$addSource.addEventListener('click', () => openAddSource());\n\nif (!token) {\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Open the link from your terminal'),\n      h('p', {}, 'Run cloudhop ui and open the link it prints. It includes a one-time access key.'),\n    ),\n  );\n} else {\n  readRoute();\n  refresh();\n}\n";
 
 // ../ui/src/assets/index.html
 var assets_default = `<!doctype html>
@@ -12729,9 +13573,29 @@ var assets_default = `<!doctype html>
       }
       /* Fixed columns so every source's table lines up with the others. */
       table { width: 100%; border-collapse: collapse; table-layout: fixed; }
-      th:nth-child(1) { width: 26%; }
-      th:nth-child(2) { width: 190px; }
-      th:nth-child(4) { width: 56px; }
+      table.aliases th:nth-child(1) { width: 22%; }
+      table.aliases th:nth-child(2) { width: 15%; }
+      table.aliases th:nth-child(3) { width: 180px; }
+      table.aliases th:nth-child(5) { width: 264px; }
+      td.muted { color: var(--muted); font-size: 14px; }
+      .nav { display: flex; gap: 4px; margin-left: 12px; }
+      .nav a { color: var(--muted); text-decoration: none; font-size: 14px; font-weight: 500; padding: 6px 12px; border-radius: 8px; }
+      .nav a:hover { color: var(--text); background: var(--surface-2); }
+      .nav a[aria-current="page"] { color: var(--accent-strong); background: var(--accent-soft); font-weight: 600; }
+      .page-head { display: flex; align-items: flex-end; gap: 16px; margin: 4px 0 16px; flex-wrap: wrap; }
+      .page-head > div:first-child { flex: 1; min-width: 220px; }
+      .page-head h1 { font-size: 22px; margin: 0; letter-spacing: -0.01em; }
+      .page-head p { margin: 4px 0 0; color: var(--muted); font-size: 14px; }
+      .toolbar { display: flex; gap: 10px; align-items: center; flex-wrap: wrap; margin-bottom: 12px; }
+      .toolbar input[type="search"] { flex: 1 1 260px; }
+      .toolbar .count { color: var(--muted); font-size: 13px; }
+      .source-summary { display: flex; align-items: center; gap: 12px; padding: 12px 16px; color: var(--muted); }
+      .card-body.padded { padding: 4px 16px 14px; }
+      .snippet { display: flex; align-items: center; gap: 8px; background: var(--surface-2); border: 1px solid var(--border); border-radius: 8px; padding: 6px 6px 6px 12px; margin-bottom: 8px; }
+      .snippet code { flex: 1; overflow-x: auto; white-space: nowrap; }
+      .tool-row { display: flex; align-items: center; gap: 12px; flex-wrap: wrap; padding: 6px 0; }
+      .tool-row .snippet { margin: 0; flex: 1 1 220px; }
+      button.choice { width: 100%; text-align: left; background: var(--surface); }
       td { overflow-wrap: anywhere; }
       th {
         text-align: left;
@@ -12844,23 +13708,36 @@ var assets_default = `<!doctype html>
         margin-bottom: 18px;
       }
       .notice.error { border-left-color: var(--bad); }
+      .row-actions { display: flex; gap: 6px; align-items: center; justify-content: flex-end; white-space: nowrap; }
+      .prod-toggle { display: inline-flex; align-items: center; gap: 4px; font-size: 13px; color: var(--muted); cursor: pointer; }
+      .prod-tag { display: inline-block; white-space: nowrap; margin-left: 8px; font-size: 11px; font-weight: 700; letter-spacing: 0.04em; color: var(--bad); border: 1px solid currentColor; border-radius: 4px; padding: 0 4px; vertical-align: 1px; }
+      tr.prod td:first-child { box-shadow: inset 3px 0 0 var(--bad); }
+      button.link.danger-hover:hover { color: var(--bad); }
       .seg { display: inline-flex; border: 1px solid var(--border); border-radius: 8px; overflow: hidden; }
       .seg button { border: 0; border-radius: 0; }
       .seg button + button { border-left: 1px solid var(--border); }
       .seg button[aria-pressed="true"] { background: var(--accent-soft); color: var(--accent-strong); font-weight: 600; }
       .card-help { color: var(--muted); font-size: 14px; margin: 10px 16px 6px; }
+      .card-body.padded .card-help { margin: 8px 0 10px; }
       .muted-inline { color: var(--muted); font-weight: 400; font-size: 12px; }
       table.assistants th:nth-child(2) { width: 170px; }
       table.assistants th:nth-child(3) { width: 140px; }
       table.assistants th:nth-child(4) { width: 230px; }
       @media (max-width: 640px) {
         .tagline { display: none; }
-        th:nth-child(3), td:nth-child(3) { display: none; }
+        .nav { margin-left: 4px; overflow-x: auto; }
+        .nav a { padding: 6px 8px; }
+        table.aliases th:nth-child(2), table.aliases td:nth-child(2),
+        table.aliases th:nth-child(4), table.aliases td:nth-child(4),
+        table.assistants th:nth-child(3), table.assistants td:nth-child(3) { display: none; }
         td, th { padding: 8px 10px; }
         td.alias { white-space: normal; overflow-wrap: anywhere; }
         .region input { width: 96px; }
-        th:nth-child(1) { width: auto; }
-        th:nth-child(2) { width: 124px; }
+        table.aliases th:nth-child(1) { width: auto; }
+        table.aliases th:nth-child(3) { width: 124px; }
+        table.aliases th:nth-child(5) { width: 132px; }
+        .bar { flex-wrap: wrap; }
+        .row-actions { flex-wrap: wrap; }
         table.assistants th:nth-child(2) { width: 112px; }
         table.assistants th:nth-child(4) { width: 96px; }
         table.assistants .actions { flex-direction: column; align-items: flex-end; }
@@ -12872,7 +13749,12 @@ var assets_default = `<!doctype html>
     <header>
       <div class="bar">
         <div class="logo"><img src="data:image/svg+xml,%3Csvg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 64 64%22 role=%22img%22 aria-label=%22cloudhop%22%3E%3Cdefs%3E%3ClinearGradient id=%22ch-bg%22 x1=%220%22 y1=%220%22 x2=%221%22 y2=%221%22%3E%3Cstop offset=%220%22 stop-color=%22%233BB8F5%22/%3E%3Cstop offset=%221%22 stop-color=%22%231450A8%22/%3E%3C/linearGradient%3E%3C/defs%3E%3Crect width=%2264%22 height=%2264%22 rx=%2215%22 fill=%22url(%23ch-bg)%22/%3E%3Cpath d=%22M8.5 47.5a5.5 5.5 0 0 1 5-5.5 6.8 6.8 0 0 1 13 1.6 4.4 4.4 0 0 1-.9 8.7H13.4a4.9 4.9 0 0 1-4.9-4.8z%22 fill=%22%23fff%22 fill-opacity=%22.55%22/%3E%3Cpath d=%22M31 44.6a7.6 7.6 0 0 1 7-7.6 9.6 9.6 0 0 1 18.2 2.6 6.3 6.3 0 0 1-1.3 12.5H38.3A7.4 7.4 0 0 1 31 44.6z%22 fill=%22%23fff%22/%3E%3Cpath d=%22M18 37.5C19 21 33 13.5 40.6 23%22 fill=%22none%22 stroke=%22%23fff%22 stroke-width=%223.6%22 stroke-linecap=%22round%22 stroke-dasharray=%220.01 6.3%22/%3E%3Cpath d=%22M46 30.2l-7.4-2.1 5.4-4.3z%22 fill=%22%23fff%22 stroke=%22%23fff%22 stroke-width=%222.4%22 stroke-linejoin=%22round%22/%3E%3C/svg%3E" alt="" width="28" height="28" /><span>cloud<span>hop</span></span></div>
-        <div class="tagline">Hop between cloud accounts, roles and regions</div>
+        <nav id="nav" class="nav" aria-label="Sections" hidden>
+          <a href="#/aliases" data-page="aliases">Aliases</a>
+          <a href="#/sources" data-page="sources">Sources</a>
+          <a href="#/assistants" data-page="assistants">AI assistants</a>
+          <a href="#/tools" data-page="tools">Tools</a>
+        </nav>
         <div class="spacer"></div>
         <button type="button" class="primary" id="add-source" hidden>+ Add source</button>
       </div>
@@ -12996,15 +13878,15 @@ async function uiCommand(app, assistants, { flags }) {
 }
 
 // src/container.ts
-import { homedir as homedir3 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join8 } from "path";
 
 // ../provider-aws/src/aws-provider.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // ../provider-aws/src/aws-config.ts
-import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname3 } from "path";
+import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname4 } from "path";
 var BLOCK_START = "# >>> cloudhop managed >>> (edit with `cloudhop`, not by hand)";
 var BLOCK_END = "# <<< cloudhop managed <<<";
 function renderBlock(sections) {
@@ -13051,13 +13933,64 @@ function replaceManagedBlock(content, sections) {
 async function writeManagedBlock(path2, sections) {
   let content = "";
   try {
-    content = await readFile3(path2, "utf8");
+    content = await readFile5(path2, "utf8");
   } catch {
   }
   const next = replaceManagedBlock(content, sections);
   if (next === content) return;
-  await mkdir3(dirname3(path2), { recursive: true, mode: 448 });
-  await writeFile3(path2, next, { mode: 384 });
+  await mkdir4(dirname4(path2), { recursive: true, mode: 448 });
+  await writeFile4(path2, next, { mode: 384 });
+}
+
+// ../provider-aws/src/console.ts
+var ISSUER = "https://dayepesb.github.io/cloudhop/";
+function partitionHosts(region) {
+  if (region?.startsWith("cn-")) {
+    return { signin: "https://signin.amazonaws.cn", console: "https://console.amazonaws.cn" };
+  }
+  if (region?.startsWith("us-gov-")) {
+    return {
+      signin: "https://signin.amazonaws-us-gov.com",
+      console: "https://console.amazonaws-us-gov.com"
+    };
+  }
+  return { signin: "https://signin.aws.amazon.com", console: "https://console.aws.amazon.com" };
+}
+function consoleDestination(region, service) {
+  const { console: console2 } = partitionHosts(region);
+  const path2 = service ? `${service}/home` : "console/home";
+  return `${console2}/${path2}${region ? `?region=${encodeURIComponent(region)}` : ""}`;
+}
+async function federatedConsoleUrl(credentials, destination, region, fetchFn) {
+  const {
+    AWS_ACCESS_KEY_ID: id,
+    AWS_SECRET_ACCESS_KEY: key,
+    AWS_SESSION_TOKEN: token
+  } = credentials;
+  if (!id || !key || !token) return void 0;
+  const { signin } = partitionHosts(region);
+  const response = await fetchFn(`${signin}/federation`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      Action: "getSigninToken",
+      Session: JSON.stringify({ sessionId: id, sessionKey: key, sessionToken: token })
+    }).toString()
+  }).catch(() => void 0);
+  if (!response?.ok) return void 0;
+  const signinToken = (await response.json().catch(() => ({}))).SigninToken;
+  if (!signinToken) return void 0;
+  const params = new URLSearchParams({
+    Action: "login",
+    Issuer: ISSUER,
+    Destination: destination,
+    SigninToken: signinToken
+  });
+  return `${signin}/federation?${params}`;
+}
+function portalShortcutUrl(startUrl, accountId, roleName, destination) {
+  const params = new URLSearchParams({ account_id: accountId, role_name: roleName, destination });
+  return `${startUrl.replace(/\/+$/, "")}/#/console?${params}`;
 }
 
 // ../provider-aws/src/http.ts
@@ -13071,7 +14004,7 @@ var AwsHttpError = class extends Error {
   status;
   code;
 };
-async function parse2(response) {
+async function parse3(response) {
   const text4 = await response.text();
   const body = text4 ? JSON.parse(text4) : {};
   if (!response.ok) {
@@ -13091,10 +14024,10 @@ async function postJson(fetchFn, url, body) {
     headers: { "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  return parse2(response);
+  return parse3(response);
 }
 async function getJson(fetchFn, url, headers) {
-  return parse2(await fetchFn(url, { headers }));
+  return parse3(await fetchFn(url, { headers }));
 }
 
 // ../provider-aws/src/sso/portal.ts
@@ -13278,23 +14211,23 @@ var OidcClient = class {
 
 // ../provider-aws/src/sso/token-cache.ts
 import { createHash as createHash2 } from "crypto";
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
-import { join as join5 } from "path";
+import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
+import { join as join6 } from "path";
 var EXPIRY_MARGIN_MS = 5 * 60 * 1e3;
 function tokenCachePath(awsDir, sessionName) {
   const hash = createHash2("sha1").update(sessionName).digest("hex");
-  return join5(awsDir, "sso", "cache", `${hash}.json`);
+  return join6(awsDir, "sso", "cache", `${hash}.json`);
 }
 async function readToken(awsDir, sessionName) {
   try {
-    return JSON.parse(await readFile4(tokenCachePath(awsDir, sessionName), "utf8"));
+    return JSON.parse(await readFile6(tokenCachePath(awsDir, sessionName), "utf8"));
   } catch {
     return void 0;
   }
 }
 async function writeToken(awsDir, sessionName, token) {
-  await mkdir4(join5(awsDir, "sso", "cache"), { recursive: true, mode: 448 });
-  await writeFile4(tokenCachePath(awsDir, sessionName), JSON.stringify(token, null, 2), {
+  await mkdir5(join6(awsDir, "sso", "cache"), { recursive: true, mode: 448 });
+  await writeFile5(tokenCachePath(awsDir, sessionName), JSON.stringify(token, null, 2), {
     mode: 384
   });
 }
@@ -13433,6 +14366,42 @@ var CONSOLE_LOGIN_KIND = "console-login";
 var CONSOLE_TARGET = { id: "console", label: "Console sign-in", attributes: {} };
 var ssoSessionName = (sourceId) => `cloudhop-${sourceId}`;
 var consoleProfileName = (sourceId) => `cloudhop-${sourceId}`;
+var GLOBAL_WITH_VALUE = /* @__PURE__ */ new Set([
+  "--region",
+  "--output",
+  "--profile",
+  "--endpoint-url",
+  "--query",
+  "--color",
+  "--ca-bundle",
+  "--cli-read-timeout",
+  "--cli-connect-timeout",
+  "--cli-binary-format"
+]);
+var READ_VERBS = /^(describe|list|get|head|lookup|search|scan|query|select|filter|tail|batch-get|check|preview|simulate|validate|estimate|test|wait|help|download|ls|presign)(-|$)/;
+function isAwsReadOnly(args) {
+  if (args.includes("--dryrun") || args.includes("--dry-run") || args.includes("help")) return true;
+  const words = [];
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const arg = args[i2];
+    if (arg.startsWith("--")) {
+      if (GLOBAL_WITH_VALUE.has(arg) && words.length < 2) i2++;
+      continue;
+    }
+    words.push(arg);
+  }
+  const [service, operation] = words;
+  if (!service || !operation) return true;
+  if (service === "sts" || service === "configure") return true;
+  if (service === "s3") {
+    if (operation === "cp" || operation === "sync") {
+      const destination = words[words.length - 1] ?? "";
+      return !destination.startsWith("s3://");
+    }
+    return operation === "ls" || operation === "presign";
+  }
+  return READ_VERBS.test(operation);
+}
 var AwsProvider = class {
   constructor(options) {
     this.options = options;
@@ -13551,7 +14520,7 @@ var AwsProvider = class {
         }
       });
     }
-    await writeManagedBlock(join6(this.options.awsDir, "config"), sections);
+    await writeManagedBlock(join7(this.options.awsDir, "config"), sections);
   }
   async processEnv(resolved, mode) {
     const region = resolved.region;
@@ -13567,6 +14536,25 @@ var AwsProvider = class {
     const credentials = resolved.source.kind === CONSOLE_LOGIN_KIND ? await this.exportedCredentials(profile) : await this.roleCredentials(resolved);
     return { AWS_PROFILE: void 0, ...credentials, ...regionEnv };
   }
+  async consoleUrl(resolved, service) {
+    const destination = consoleDestination(resolved.region, service);
+    const sso = resolved.source.kind !== CONSOLE_LOGIN_KIND;
+    const credentials = sso ? await this.roleCredentials(resolved) : await this.exportedCredentials(consoleProfileName(resolved.source.id)).catch(() => ({}));
+    const url = await federatedConsoleUrl(credentials, destination, resolved.region, this.fetchFn);
+    if (url) return { url, via: "signed-in" };
+    const attrs = resolved.target?.attributes ?? {};
+    const startUrl = resolved.source.settings.startUrl;
+    if (sso && startUrl && attrs.accountId && attrs.roleName) {
+      return {
+        url: portalShortcutUrl(startUrl, attrs.accountId, attrs.roleName, destination),
+        via: "portal"
+      };
+    }
+    return { url: destination, via: "sign-in-page" };
+  }
+  isReadOnly(args) {
+    return isAwsReadOnly(args);
+  }
   isSessionError(output) {
     return SESSION_ERROR_PATTERNS.some((pattern) => pattern.test(output));
   }
@@ -13614,9 +14602,10 @@ var AwsProvider = class {
 };
 
 // src/container.ts
+var browser = new NodeBrowserOpener();
 function createApp(env = process.env) {
   const runner = new NodeProcessRunner();
-  const awsDir = env.CLOUDHOP_AWS_DIR ?? join7(homedir3(), ".aws");
+  const awsDir = env.CLOUDHOP_AWS_DIR ?? join8(homedir4(), ".aws");
   return new CloudhopApp({
     config: new YamlConfigStore(),
     providers: [
@@ -13628,14 +14617,14 @@ function createApp(env = process.env) {
       // Azure and Google Cloud providers plug in here.
     ],
     runner,
-    browser: new NodeBrowserOpener(),
+    browser,
     installer: new SystemToolInstaller(runner),
     notify
   });
 }
 function createAssistants(version, env = process.env) {
   return new AssistantsInstaller({
-    places: { home: homedir3(), project: process.cwd() },
+    places: { home: homedir4(), project: process.cwd() },
     configDir: defaultConfigDir(env),
     runner: new NodeProcessRunner(),
     cloudhopVersion: version
@@ -13643,8 +14632,8 @@ function createAssistants(version, env = process.env) {
 }
 
 // src/update-check.ts
-import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
-import { join as join8 } from "path";
+import { mkdir as mkdir6, readFile as readFile7, writeFile as writeFile6 } from "fs/promises";
+import { join as join9 } from "path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var REGISTRY_URL = "https://registry.npmjs.org/cloudhop/latest";
 function startUpdateCheck(configDir, current) {
@@ -13652,11 +14641,11 @@ function startUpdateCheck(configDir, current) {
   if (env.CLOUDHOP_NO_UPDATE_CHECK === "1" || env.CI || !process.stderr.isTTY)
     return async () => {
     };
-  const file = join8(configDir, "update-check.json");
+  const file = join9(configDir, "update-check.json");
   const work = (async () => {
     let cache = { checkedAt: 0 };
     try {
-      cache = JSON.parse(await readFile5(file, "utf8"));
+      cache = JSON.parse(await readFile7(file, "utf8"));
     } catch {
     }
     if (cache.latest && compareVersions(cache.latest, current) > 0) {
@@ -13673,19 +14662,27 @@ function startUpdateCheck(configDir, current) {
     if (!response.ok) return;
     const { version } = await response.json();
     if (typeof version !== "string") return;
-    await mkdir5(configDir, { recursive: true });
-    await writeFile5(file, JSON.stringify({ checkedAt: Date.now(), latest: version }));
+    await mkdir6(configDir, { recursive: true });
+    await writeFile6(file, JSON.stringify({ checkedAt: Date.now(), latest: version }));
   })().catch(() => {
   });
   return () => Promise.race([work, new Promise((resolve) => setTimeout(resolve, 300))]);
 }
 
 // src/cli.ts
-var HELP = `cloudhop ${"1.1.0"}
+var HELP = `cloudhop ${"1.2.0"}
 Hop between cloud accounts, roles and regions with one command.
 
 Usage
   hop <alias> [args...]          Run the cloud CLI as <alias> (no args: who am I)
+  hop                            Pick the alias from a list, then type the command
+  hop - [args...]                Pick the alias from a list and run [args...]
+  cloudhop console [alias] [service] [--region <r>]
+                                 Open the web console as <alias>, already signed in
+  cloudhop each <selection...> [--source <s>] [--prod|--no-prod] [--yes] [--json] -- <args...>
+                                 Run one command in many aliases (names, a,b lists, 'globex-*', /regex/)
+  cloudhop use [alias] | --off    Use an alias in this shell (aws, terraform... without hop)
+  cloudhop shell [install]       Shell integration: cloudhop use, tab completion, cloudhop_prompt
   cloudhop exec <alias> [--region <r>] -- <cmd...>
                                  Run any tool with the alias' temporary credentials
 
@@ -13694,8 +14691,13 @@ Setup
   cloudhop add                   Add an SSO portal or a personal account
   cloudhop add aws sso --start-url <url> [--region <r>] [--name <id>]
   cloudhop add aws console-login [--region <r>] [--name <id>]
+  cloudhop team export [--out <file>] | team import <file|https URL>
+                                 Share portals and aliases with your team (no secrets)
   cloudhop alias [source]        Create more aliases from a source
   cloudhop alias <source> --list | --target <id> [--name <alias>] [--region <r>]
+  cloudhop mv <alias> <new-name> Rename an alias
+  cloudhop prod [alias...] [--off]
+                                 Mark aliases as production (asks before changes)
   cloudhop region <alias> [region]
                                  Change the region an alias runs in
   cloudhop login [source]        Log in again and refresh its accounts
@@ -13727,23 +14729,47 @@ function takeGlobalFlags(argv) {
 }
 async function main(argv) {
   const [command, ...args] = argv;
+  const invokedAsHop = /^hop(\.js|\.cmd)?$/i.test(basename(process.argv[1] ?? ""));
+  if (!command && invokedAsHop && interactive() || command === "-") {
+    const app2 = createApp();
+    const alias = await pickAlias(app2);
+    let rest = args;
+    if (!command) {
+      const typed = answer(
+        await dist_exports.text({
+          message: `aws command to run as ${alias}`,
+          placeholder: "empty = who am I, e.g. s3 ls"
+        })
+      ).trim();
+      rest = typed ? (typed.match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((w) => w.replace(/^(["'])(.*)\1$/, "$2")) : [];
+    }
+    return proxyCommand(app2, alias, rest);
+  }
   if (!command || command === "help" || command === "--help" || command === "-h") {
     console.log(HELP);
     return 0;
   }
   if (command === "--version" || command === "-v" || command === "version") {
-    console.log("1.1.0");
+    console.log("1.2.0");
     return 0;
   }
   const app = createApp();
   const local = RESERVED_NAMES.has(command) ? takeGlobalFlags(args) : args;
+  if (command === "__complete") {
+    await completeCommand(app, args[0]);
+    return 0;
+  }
+  if (command === "shell") {
+    await shellCommand(local);
+    return 0;
+  }
   if (command === "mcp") {
-    await serveMcp({ app, version: "1.1.0" });
+    await serveMcp({ app, version: "1.2.0" });
     return 0;
   }
-  const assistants = createAssistants("1.1.0");
+  const assistants = createAssistants("1.2.0");
   await refreshAssistantSkills(assistants, command);
-  const finishUpdateCheck = startUpdateCheck(defaultConfigDir(), "1.1.0");
+  const finishUpdateCheck = startUpdateCheck(defaultConfigDir(), "1.2.0");
   try {
     return await dispatch(app, assistants, command, args, local);
   } finally {
@@ -13774,6 +14800,13 @@ async function dispatch(app, assistants, command, args, local) {
     case "status":
       await statusCommand(app, local);
       return 0;
+    case "prod":
+      await prodCommand(app, local);
+      return 0;
+    case "mv":
+    case "rename":
+      await renameCommand(app, local);
+      return 0;
     case "region":
       await regionCommand(app, local);
       return 0;
@@ -13802,6 +14835,17 @@ async function dispatch(app, assistants, command, args, local) {
     case "agent":
       await agentCommand(assistants, local);
       return 0;
+    case "team":
+      await teamCommand(app, local);
+      return 0;
+    case "use":
+      await useCommand(app, local);
+      return 0;
+    case "each":
+      return eachCommand(app, args);
+    case "console":
+      await consoleCommand(app, local);
+      return 0;
     case "ui":
       await uiCommand(app, assistants, parseArgs(local));
       return 0;