cloudhop 1.2.1 → 1.3.0

package/dist/cli.js

@@ -26,9 +26,9 @@ var __export = (target, all) => {
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    for (let key2 of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key2) && key2 !== except)
+        __defProp(to, key2, { get: () => from[key2], enumerable: !(desc = __getOwnPropDesc(from, key2)) || desc.enumerable });
   }
   return to;
 };
@@ -118,11 +118,11 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path2) {
-      const ctrl = callVisitor(key, node, visitor, path2);
+    function visit_(key2, node, visitor, path2) {
+      const ctrl = callVisitor(key2, node, visitor, path2);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path2, ctrl);
-        return visit_(key, ctrl, visitor, path2);
+        replaceNode(key2, path2, ctrl);
+        return visit_(key2, ctrl, visitor, path2);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
@@ -166,11 +166,11 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path2) {
-      const ctrl = await callVisitor(key, node, visitor, path2);
+    async function visitAsync_(key2, node, visitor, path2) {
+      const ctrl = await callVisitor(key2, node, visitor, path2);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path2, ctrl);
-        return visitAsync_(key, ctrl, visitor, path2);
+        replaceNode(key2, path2, ctrl);
+        return visitAsync_(key2, ctrl, visitor, path2);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
@@ -220,27 +220,27 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path2) {
+    function callVisitor(key2, node, visitor, path2) {
       if (typeof visitor === "function")
-        return visitor(key, node, path2);
+        return visitor(key2, node, path2);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path2);
+        return visitor.Map?.(key2, node, path2);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path2);
+        return visitor.Seq?.(key2, node, path2);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path2);
+        return visitor.Pair?.(key2, node, path2);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path2);
+        return visitor.Scalar?.(key2, node, path2);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path2);
+        return visitor.Alias?.(key2, node, path2);
       return void 0;
     }
-    function replaceNode(key, path2, node) {
+    function replaceNode(key2, path2, node) {
       const parent = path2[path2.length - 1];
       if (identity.isCollection(parent)) {
-        parent.items[key] = node;
+        parent.items[key2] = node;
       } else if (identity.isPair(parent)) {
-        if (key === "key")
+        if (key2 === "key")
           parent.key = node;
         else
           parent.value = node;
@@ -501,7 +501,7 @@ var require_anchors = __commonJS({
 var require_applyReviver = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/doc/applyReviver.js"(exports) {
     "use strict";
-    function applyReviver(reviver, obj, key, val) {
+    function applyReviver(reviver, obj, key2, val) {
       if (val && typeof val === "object") {
         if (Array.isArray(val)) {
           for (let i2 = 0, len = val.length; i2 < len; ++i2) {
@@ -541,7 +541,7 @@ var require_applyReviver = __commonJS({
           }
         }
       }
-      return reviver.call(obj, key, val);
+      return reviver.call(obj, key2, val);
     }
     exports.applyReviver = applyReviver;
   }
@@ -904,14 +904,14 @@ var require_Collection = __commonJS({
         if (isEmptyPath(path2))
           this.add(value);
         else {
-          const [key, ...rest] = path2;
-          const node = this.get(key, true);
+          const [key2, ...rest] = path2;
+          const node = this.get(key2, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
           else if (node === void 0 && this.schema)
-            this.set(key, collectionFromPath(this.schema, rest, value));
+            this.set(key2, collectionFromPath(this.schema, rest, value));
           else
-            throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
+            throw new Error(`Expected YAML collection at ${key2}. Remaining path: ${rest}`);
         }
       }
       /**
@@ -919,14 +919,14 @@ var require_Collection = __commonJS({
        * @returns `true` if the item was found and removed.
        */
       deleteIn(path2) {
-        const [key, ...rest] = path2;
+        const [key2, ...rest] = path2;
         if (rest.length === 0)
-          return this.delete(key);
-        const node = this.get(key, true);
+          return this.delete(key2);
+        const node = this.get(key2, true);
         if (identity.isCollection(node))
           return node.deleteIn(rest);
         else
-          throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
+          throw new Error(`Expected YAML collection at ${key2}. Remaining path: ${rest}`);
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -934,8 +934,8 @@ var require_Collection = __commonJS({
        * `true` (collections are always returned intact).
        */
       getIn(path2, keepScalar) {
-        const [key, ...rest] = path2;
-        const node = this.get(key, true);
+        const [key2, ...rest] = path2;
+        const node = this.get(key2, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
         else
@@ -953,10 +953,10 @@ var require_Collection = __commonJS({
        * Checks if the collection includes a value with the key `key`.
        */
       hasIn(path2) {
-        const [key, ...rest] = path2;
+        const [key2, ...rest] = path2;
         if (rest.length === 0)
-          return this.has(key);
-        const node = this.get(key, true);
+          return this.has(key2);
+        const node = this.get(key2, true);
         return identity.isCollection(node) ? node.hasIn(rest) : false;
       }
       /**
@@ -964,17 +964,17 @@ var require_Collection = __commonJS({
        * boolean to add/remove the item from the set.
        */
       setIn(path2, value) {
-        const [key, ...rest] = path2;
+        const [key2, ...rest] = path2;
         if (rest.length === 0) {
-          this.set(key, value);
+          this.set(key2, value);
         } else {
-          const node = this.get(key, true);
+          const node = this.get(key2, true);
           if (identity.isCollection(node))
             node.setIn(rest, value);
           else if (node === void 0 && this.schema)
-            this.set(key, collectionFromPath(this.schema, rest, value));
+            this.set(key2, collectionFromPath(this.schema, rest, value));
           else
-            throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
+            throw new Error(`Expected YAML collection at ${key2}. Remaining path: ${rest}`);
         }
       }
     };
@@ -1552,19 +1552,19 @@ var require_stringifyPair = __commonJS({
     var Scalar = require_Scalar();
     var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
-    function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
+    function stringifyPair({ key: key2, value }, ctx, onComment, onChompKeep) {
       const { allNullValues, doc, indent, indentStep, options: { commentString, indentSeq, simpleKeys } } = ctx;
-      let keyComment = identity.isNode(key) && key.comment || null;
+      let keyComment = identity.isNode(key2) && key2.comment || null;
       if (simpleKeys) {
         if (keyComment) {
           throw new Error("With simple keys, key nodes cannot have comments");
         }
-        if (identity.isCollection(key) || !identity.isNode(key) && typeof key === "object") {
+        if (identity.isCollection(key2) || !identity.isNode(key2) && typeof key2 === "object") {
           const msg = "With simple keys, collection cannot be used as a key value";
           throw new Error(msg);
         }
       }
-      let explicitKey = !simpleKeys && (!key || keyComment && value == null && !ctx.inFlow || identity.isCollection(key) || (identity.isScalar(key) ? key.type === Scalar.Scalar.BLOCK_FOLDED || key.type === Scalar.Scalar.BLOCK_LITERAL : typeof key === "object"));
+      let explicitKey = !simpleKeys && (!key2 || keyComment && value == null && !ctx.inFlow || identity.isCollection(key2) || (identity.isScalar(key2) ? key2.type === Scalar.Scalar.BLOCK_FOLDED || key2.type === Scalar.Scalar.BLOCK_LITERAL : typeof key2 === "object"));
       ctx = Object.assign({}, ctx, {
         allNullValues: false,
         implicitKey: !explicitKey && (simpleKeys || !allNullValues),
@@ -1572,7 +1572,7 @@ var require_stringifyPair = __commonJS({
       });
       let keyCommentDone = false;
       let chompKeep = false;
-      let str = stringify3.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
+      let str = stringify3.stringify(key2, ctx, () => keyCommentDone = true, () => chompKeep = true);
       if (!explicitKey && !ctx.inFlow && str.length > 1024) {
         if (simpleKeys)
           throw new Error("With simple keys, single line scalar must not span more than 1024 characters");
@@ -1716,7 +1716,7 @@ var require_merge = __commonJS({
       }),
       stringify: () => MERGE_KEY
     };
-    var isMergeKey = (ctx, key) => (merge.identify(key) || identity.isScalar(key) && (!key.type || key.type === Scalar.Scalar.PLAIN) && merge.identify(key.value)) && ctx?.doc.schema.tags.some((tag) => tag.tag === merge.tag && tag.default);
+    var isMergeKey = (ctx, key2) => (merge.identify(key2) || identity.isScalar(key2) && (!key2.type || key2.type === Scalar.Scalar.PLAIN) && merge.identify(key2.value)) && ctx?.doc.schema.tags.some((tag) => tag.tag === merge.tag && tag.default);
     function addMergeToJSMap(ctx, map, value) {
       const source = resolveAliasValue(ctx, value);
       if (identity.isSeq(source))
@@ -1733,14 +1733,14 @@ var require_merge = __commonJS({
       if (!identity.isMap(source))
         throw new Error("Merge sources must be maps or map aliases");
       const srcMap = source.toJSON(null, ctx, Map);
-      for (const [key, value2] of srcMap) {
+      for (const [key2, value2] of srcMap) {
         if (map instanceof Map) {
-          if (!map.has(key))
-            map.set(key, value2);
+          if (!map.has(key2))
+            map.set(key2, value2);
         } else if (map instanceof Set) {
-          map.add(key);
-        } else if (!Object.prototype.hasOwnProperty.call(map, key)) {
-          Object.defineProperty(map, key, {
+          map.add(key2);
+        } else if (!Object.prototype.hasOwnProperty.call(map, key2)) {
+          Object.defineProperty(map, key2, {
             value: value2,
             writable: true,
             enumerable: true,
@@ -1768,19 +1768,19 @@ var require_addPairToJSMap = __commonJS({
     var stringify3 = require_stringify();
     var identity = require_identity();
     var toJS = require_toJS();
-    function addPairToJSMap(ctx, map, { key, value }) {
-      if (identity.isNode(key) && key.addToJSMap)
-        key.addToJSMap(ctx, map, value);
-      else if (merge.isMergeKey(ctx, key))
+    function addPairToJSMap(ctx, map, { key: key2, value }) {
+      if (identity.isNode(key2) && key2.addToJSMap)
+        key2.addToJSMap(ctx, map, value);
+      else if (merge.isMergeKey(ctx, key2))
         merge.addMergeToJSMap(ctx, map, value);
       else {
-        const jsKey = toJS.toJS(key, "", ctx);
+        const jsKey = toJS.toJS(key2, "", ctx);
         if (map instanceof Map) {
           map.set(jsKey, toJS.toJS(value, jsKey, ctx));
         } else if (map instanceof Set) {
           map.add(jsKey);
         } else {
-          const stringKey = stringifyKey(key, jsKey, ctx);
+          const stringKey = stringifyKey(key2, jsKey, ctx);
           const jsValue = toJS.toJS(value, stringKey, ctx);
           if (stringKey in map)
             Object.defineProperty(map, stringKey, {
@@ -1795,19 +1795,19 @@ var require_addPairToJSMap = __commonJS({
       }
       return map;
     }
-    function stringifyKey(key, jsKey, ctx) {
+    function stringifyKey(key2, jsKey, ctx) {
       if (jsKey === null)
         return "";
       if (typeof jsKey !== "object")
         return String(jsKey);
-      if (identity.isNode(key) && ctx?.doc) {
+      if (identity.isNode(key2) && ctx?.doc) {
         const strCtx = stringify3.createStringifyContext(ctx.doc, {});
         strCtx.anchors = /* @__PURE__ */ new Set();
         for (const node of ctx.anchors.keys())
           strCtx.anchors.add(node.anchor);
         strCtx.inFlow = true;
         strCtx.inStringifyKey = true;
-        const strKey = key.toString(strCtx);
+        const strKey = key2.toString(strCtx);
         if (!ctx.mapKeyWarned) {
           let jsonStr = JSON.stringify(strKey);
           if (jsonStr.length > 40)
@@ -1831,24 +1831,24 @@ var require_Pair = __commonJS({
     var stringifyPair = require_stringifyPair();
     var addPairToJSMap = require_addPairToJSMap();
     var identity = require_identity();
-    function createPair(key, value, ctx) {
-      const k = createNode.createNode(key, void 0, ctx);
+    function createPair(key2, value, ctx) {
+      const k = createNode.createNode(key2, void 0, ctx);
       const v = createNode.createNode(value, void 0, ctx);
       return new Pair(k, v);
     }
     var Pair = class _Pair {
-      constructor(key, value = null) {
+      constructor(key2, value = null) {
         Object.defineProperty(this, identity.NODE_TYPE, { value: identity.PAIR });
-        this.key = key;
+        this.key = key2;
         this.value = value;
       }
       clone(schema) {
-        let { key, value } = this;
-        if (identity.isNode(key))
-          key = key.clone(schema);
+        let { key: key2, value } = this;
+        if (identity.isNode(key2))
+          key2 = key2.clone(schema);
         if (identity.isNode(value))
           value = value.clone(schema);
-        return new _Pair(key, value);
+        return new _Pair(key2, value);
       }
       toJSON(_2, ctx) {
         const pair = ctx?.mapAsMap ? /* @__PURE__ */ new Map() : {};
@@ -2024,11 +2024,11 @@ var require_YAMLMap = __commonJS({
     var identity = require_identity();
     var Pair = require_Pair();
     var Scalar = require_Scalar();
-    function findPair(items, key) {
-      const k = identity.isScalar(key) ? key.value : key;
+    function findPair(items, key2) {
+      const k = identity.isScalar(key2) ? key2.value : key2;
       for (const it of items) {
         if (identity.isPair(it)) {
-          if (it.key === key || it.key === k)
+          if (it.key === key2 || it.key === k)
             return it;
           if (identity.isScalar(it.key) && it.key.value === k)
             return it;
@@ -2051,20 +2051,20 @@ var require_YAMLMap = __commonJS({
       static from(schema, obj, ctx) {
         const { keepUndefined, replacer } = ctx;
         const map = new this(schema);
-        const add = (key, value) => {
+        const add = (key2, value) => {
           if (typeof replacer === "function")
-            value = replacer.call(obj, key, value);
-          else if (Array.isArray(replacer) && !replacer.includes(key))
+            value = replacer.call(obj, key2, value);
+          else if (Array.isArray(replacer) && !replacer.includes(key2))
             return;
           if (value !== void 0 || keepUndefined)
-            map.items.push(Pair.createPair(key, value, ctx));
+            map.items.push(Pair.createPair(key2, value, ctx));
         };
         if (obj instanceof Map) {
-          for (const [key, value] of obj)
-            add(key, value);
+          for (const [key2, value] of obj)
+            add(key2, value);
         } else if (obj && typeof obj === "object") {
-          for (const key of Object.keys(obj))
-            add(key, obj[key]);
+          for (const key2 of Object.keys(obj))
+            add(key2, obj[key2]);
         }
         if (typeof schema.sortMapEntries === "function") {
           map.items.sort(schema.sortMapEntries);
@@ -2104,23 +2104,23 @@ var require_YAMLMap = __commonJS({
           this.items.push(_pair);
         }
       }
-      delete(key) {
-        const it = findPair(this.items, key);
+      delete(key2) {
+        const it = findPair(this.items, key2);
         if (!it)
           return false;
         const del = this.items.splice(this.items.indexOf(it), 1);
         return del.length > 0;
       }
-      get(key, keepScalar) {
-        const it = findPair(this.items, key);
+      get(key2, keepScalar) {
+        const it = findPair(this.items, key2);
         const node = it?.value;
         return (!keepScalar && identity.isScalar(node) ? node.value : node) ?? void 0;
       }
-      has(key) {
-        return !!findPair(this.items, key);
+      has(key2) {
+        return !!findPair(this.items, key2);
       }
-      set(key, value) {
-        this.add(new Pair.Pair(key, value), true);
+      set(key2, value) {
+        this.add(new Pair.Pair(key2, value), true);
       }
       /**
        * @param ctx - Conversion context, originally set in Document#toJS()
@@ -2209,15 +2209,15 @@ var require_YAMLSeq = __commonJS({
        *
        * @returns `true` if the item was found and removed.
        */
-      delete(key) {
-        const idx = asItemIndex(key);
+      delete(key2) {
+        const idx = asItemIndex(key2);
         if (typeof idx !== "number")
           return false;
         const del = this.items.splice(idx, 1);
         return del.length > 0;
       }
-      get(key, keepScalar) {
-        const idx = asItemIndex(key);
+      get(key2, keepScalar) {
+        const idx = asItemIndex(key2);
         if (typeof idx !== "number")
           return void 0;
         const it = this.items[idx];
@@ -2229,8 +2229,8 @@ var require_YAMLSeq = __commonJS({
        * `key` must contain a representation of an integer for this to succeed.
        * It may be wrapped in a `Scalar`.
        */
-      has(key) {
-        const idx = asItemIndex(key);
+      has(key2) {
+        const idx = asItemIndex(key2);
         return typeof idx === "number" && idx < this.items.length;
       }
       /**
@@ -2240,10 +2240,10 @@ var require_YAMLSeq = __commonJS({
        * If `key` does not contain a representation of an integer, this will throw.
        * It may be wrapped in a `Scalar`.
        */
-      set(key, value) {
-        const idx = asItemIndex(key);
+      set(key2, value) {
+        const idx = asItemIndex(key2);
         if (typeof idx !== "number")
-          throw new Error(`Expected a valid index, not ${key}.`);
+          throw new Error(`Expected a valid index, not ${key2}.`);
         const prev = this.items[idx];
         if (identity.isScalar(prev) && Scalar.isScalarValue(value))
           prev.value = value;
@@ -2277,8 +2277,8 @@ var require_YAMLSeq = __commonJS({
           let i2 = 0;
           for (let it of obj) {
             if (typeof replacer === "function") {
-              const key = obj instanceof Set ? it : String(i2++);
-              it = replacer.call(obj, key, it);
+              const key2 = obj instanceof Set ? it : String(i2++);
+              it = replacer.call(obj, key2, it);
             }
             seq.items.push(createNode.createNode(it, void 0, ctx));
           }
@@ -2286,8 +2286,8 @@ var require_YAMLSeq = __commonJS({
         return seq;
       }
     };
-    function asItemIndex(key) {
-      let idx = identity.isScalar(key) ? key.value : key;
+    function asItemIndex(key2) {
+      let idx = identity.isScalar(key2) ? key2.value : key2;
       if (idx && typeof idx === "string")
         idx = Number(idx);
       return typeof idx === "number" && Number.isInteger(idx) && idx >= 0 ? idx : null;
@@ -2701,25 +2701,25 @@ ${cn.comment}` : item.comment;
         for (let it of iterable) {
           if (typeof replacer === "function")
             it = replacer.call(iterable, String(i2++), it);
-          let key, value;
+          let key2, value;
           if (Array.isArray(it)) {
             if (it.length === 2) {
-              key = it[0];
+              key2 = it[0];
               value = it[1];
             } else
               throw new TypeError(`Expected [key, value] tuple: ${it}`);
           } else if (it && it instanceof Object) {
             const keys = Object.keys(it);
             if (keys.length === 1) {
-              key = keys[0];
-              value = it[key];
+              key2 = keys[0];
+              value = it[key2];
             } else {
               throw new TypeError(`Expected tuple with one key, not ${keys.length} keys`);
             }
           } else {
-            key = it;
+            key2 = it;
           }
-          pairs2.items.push(Pair.createPair(key, value, ctx));
+          pairs2.items.push(Pair.createPair(key2, value, ctx));
         }
       return pairs2;
     }
@@ -2766,16 +2766,16 @@ var require_omap = __commonJS({
         if (ctx?.onCreate)
           ctx.onCreate(map);
         for (const pair of this.items) {
-          let key, value;
+          let key2, value;
           if (identity.isPair(pair)) {
-            key = toJS.toJS(pair.key, "", ctx);
-            value = toJS.toJS(pair.value, key, ctx);
+            key2 = toJS.toJS(pair.key, "", ctx);
+            value = toJS.toJS(pair.value, key2, ctx);
           } else {
-            key = toJS.toJS(pair, "", ctx);
+            key2 = toJS.toJS(pair, "", ctx);
           }
-          if (map.has(key))
+          if (map.has(key2))
             throw new Error("Ordered maps must not include duplicate keys");
-          map.set(key, value);
+          map.set(key2, value);
         }
         return map;
       }
@@ -2796,12 +2796,12 @@ var require_omap = __commonJS({
       resolve(seq, onError) {
         const pairs$1 = pairs.resolvePairs(seq, onError);
         const seenKeys = [];
-        for (const { key } of pairs$1.items) {
-          if (identity.isScalar(key)) {
-            if (seenKeys.includes(key.value)) {
-              onError(`Ordered maps must not include duplicate keys: ${key.value}`);
+        for (const { key: key2 } of pairs$1.items) {
+          if (identity.isScalar(key2)) {
+            if (seenKeys.includes(key2.value)) {
+              onError(`Ordered maps must not include duplicate keys: ${key2.value}`);
             } else {
-              seenKeys.push(key.value);
+              seenKeys.push(key2.value);
             }
           }
         }
@@ -2986,14 +2986,14 @@ var require_set = __commonJS({
         super(schema);
         this.tag = _YAMLSet.tag;
       }
-      add(key) {
+      add(key2) {
         let pair;
-        if (identity.isPair(key))
-          pair = key;
-        else if (key && typeof key === "object" && "key" in key && "value" in key && key.value === null)
-          pair = new Pair.Pair(key.key, null);
+        if (identity.isPair(key2))
+          pair = key2;
+        else if (key2 && typeof key2 === "object" && "key" in key2 && "value" in key2 && key2.value === null)
+          pair = new Pair.Pair(key2.key, null);
         else
-          pair = new Pair.Pair(key, null);
+          pair = new Pair.Pair(key2, null);
         const prev = YAMLMap.findPair(this.items, pair.key);
         if (!prev)
           this.items.push(pair);
@@ -3002,18 +3002,18 @@ var require_set = __commonJS({
        * If `keepPair` is `true`, returns the Pair matching `key`.
        * Otherwise, returns the value of that Pair's key.
        */
-      get(key, keepPair) {
-        const pair = YAMLMap.findPair(this.items, key);
+      get(key2, keepPair) {
+        const pair = YAMLMap.findPair(this.items, key2);
         return !keepPair && identity.isPair(pair) ? identity.isScalar(pair.key) ? pair.key.value : pair.key : pair;
       }
-      set(key, value) {
+      set(key2, value) {
         if (typeof value !== "boolean")
           throw new Error(`Expected boolean value for set(key, value) in a YAML set, not ${typeof value}`);
-        const prev = YAMLMap.findPair(this.items, key);
+        const prev = YAMLMap.findPair(this.items, key2);
         if (prev && !value) {
           this.items.splice(this.items.indexOf(prev), 1);
         } else if (!prev && value) {
-          this.items.push(new Pair.Pair(key));
+          this.items.push(new Pair.Pair(key2));
         }
       }
       toJSON(_2, ctx) {
@@ -3260,7 +3260,7 @@ var require_tags = __commonJS({
         if (Array.isArray(customTags))
           tags = [];
         else {
-          const keys = Array.from(schemas.keys()).filter((key) => key !== "yaml11").map((key) => JSON.stringify(key)).join(", ");
+          const keys = Array.from(schemas.keys()).filter((key2) => key2 !== "yaml11").map((key2) => JSON.stringify(key2)).join(", ");
           throw new Error(`Unknown schema "${schemaName}"; use one of ${keys} or define customTags array`);
         }
       }
@@ -3276,7 +3276,7 @@ var require_tags = __commonJS({
         const tagObj = typeof tag === "string" ? tagsByName[tag] : tag;
         if (!tagObj) {
           const tagName = JSON.stringify(tag);
-          const keys = Object.keys(tagsByName).map((key) => JSON.stringify(key)).join(", ");
+          const keys = Object.keys(tagsByName).map((key2) => JSON.stringify(key2)).join(", ");
           throw new Error(`Unknown custom tag ${tagName}; use one of ${keys}`);
         }
         if (!tags2.includes(tagObj))
@@ -3540,8 +3540,8 @@ var require_Document = __commonJS({
        * Convert a key and a value into a `Pair` using the current schema,
        * recursively wrapping all values as `Scalar` or `Collection` nodes.
        */
-      createPair(key, value, options = {}) {
-        const k = this.createNode(key, null, options);
+      createPair(key2, value, options = {}) {
+        const k = this.createNode(key2, null, options);
         const v = this.createNode(value, null, options);
         return new Pair.Pair(k, v);
       }
@@ -3549,8 +3549,8 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      delete(key) {
-        return assertCollection(this.contents) ? this.contents.delete(key) : false;
+      delete(key2) {
+        return assertCollection(this.contents) ? this.contents.delete(key2) : false;
       }
       /**
        * Removes a value from the document.
@@ -3570,8 +3570,8 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      get(key, keepScalar) {
-        return identity.isCollection(this.contents) ? this.contents.get(key, keepScalar) : void 0;
+      get(key2, keepScalar) {
+        return identity.isCollection(this.contents) ? this.contents.get(key2, keepScalar) : void 0;
       }
       /**
        * Returns item at `path`, or `undefined` if not found. By default unwraps
@@ -3586,8 +3586,8 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value with the key `key`.
        */
-      has(key) {
-        return identity.isCollection(this.contents) ? this.contents.has(key) : false;
+      has(key2) {
+        return identity.isCollection(this.contents) ? this.contents.has(key2) : false;
       }
       /**
        * Checks if the document includes a value at `path`.
@@ -3601,11 +3601,11 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      set(key, value) {
+      set(key2, value) {
         if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, [key], value);
+          this.contents = Collection.collectionFromPath(this.schema, [key2], value);
         } else if (assertCollection(this.contents)) {
-          this.contents.set(key, value);
+          this.contents.set(key2, value);
         }
       }
       /**
@@ -3913,24 +3913,24 @@ var require_resolve_props = __commonJS({
 var require_util_contains_newline = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/compose/util-contains-newline.js"(exports) {
     "use strict";
-    function containsNewline(key) {
-      if (!key)
+    function containsNewline(key2) {
+      if (!key2)
         return null;
-      switch (key.type) {
+      switch (key2.type) {
         case "alias":
         case "scalar":
         case "double-quoted-scalar":
         case "single-quoted-scalar":
-          if (key.source.includes("\n"))
+          if (key2.source.includes("\n"))
             return true;
-          if (key.end) {
-            for (const st of key.end)
+          if (key2.end) {
+            for (const st of key2.end)
               if (st.type === "newline")
                 return true;
           }
           return false;
         case "flow-collection":
-          for (const it of key.items) {
+          for (const it of key2.items) {
             for (const st of it.start)
               if (st.type === "newline")
                 return true;
@@ -4004,10 +4004,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep, value } = collItem;
+        const { start, key: key2, sep, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep?.[0],
+          next: key2 ?? sep?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -4015,10 +4015,10 @@ var require_resolve_block_map = __commonJS({
         });
         const implicitKey = !keyProps.found;
         if (implicitKey) {
-          if (key) {
-            if (key.type === "block-seq")
+          if (key2) {
+            if (key2.type === "block-seq")
               onError(offset, "BLOCK_AS_IMPLICIT_KEY", "A block sequence may not be used as an implicit map key");
-            else if ("indent" in key && key.indent !== bm.indent)
+            else if ("indent" in key2 && key2.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
           if (!keyProps.anchor && !keyProps.tag && !sep) {
@@ -4031,17 +4031,17 @@ var require_resolve_block_map = __commonJS({
             }
             continue;
           }
-          if (keyProps.newlineAfterProp || utilContainsNewline.containsNewline(key)) {
-            onError(key ?? start[start.length - 1], "MULTILINE_IMPLICIT_KEY", "Implicit keys need to be on a single line");
+          if (keyProps.newlineAfterProp || utilContainsNewline.containsNewline(key2)) {
+            onError(key2 ?? start[start.length - 1], "MULTILINE_IMPLICIT_KEY", "Implicit keys need to be on a single line");
           }
         } else if (keyProps.found?.indent !== bm.indent) {
           onError(offset, "BAD_INDENT", startColMsg);
         }
         ctx.atKey = true;
         const keyStart = keyProps.end;
-        const keyNode = key ? composeNode(ctx, key, keyProps, onError) : composeEmptyNode(ctx, keyStart, start, null, keyProps, onError);
+        const keyNode = key2 ? composeNode(ctx, key2, keyProps, onError) : composeEmptyNode(ctx, keyStart, start, null, keyProps, onError);
         if (ctx.schema.compat)
-          utilFlowIndentCheck.flowIndentCheck(bm.indent, key, onError);
+          utilFlowIndentCheck.flowIndentCheck(bm.indent, key2, onError);
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
@@ -4051,7 +4051,7 @@ var require_resolve_block_map = __commonJS({
           offset: keyNode.range[2],
           onError,
           parentIndent: bm.indent,
-          startOnNewline: !key || key.type === "block-scalar"
+          startOnNewline: !key2 || key2.type === "block-scalar"
         });
         offset = valueProps.end;
         if (valueProps.found) {
@@ -4215,11 +4215,11 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i2 = 0; i2 < fc.items.length; ++i2) {
         const collItem = fc.items[i2];
-        const { start, key, sep, value } = collItem;
+        const { start, key: key2, sep, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep?.[0],
+          next: key2 ?? sep?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
@@ -4240,9 +4240,9 @@ var require_resolve_flow_collection = __commonJS({
             offset = props.end;
             continue;
           }
-          if (!isMap && ctx.options.strict && utilContainsNewline.containsNewline(key))
+          if (!isMap && ctx.options.strict && utilContainsNewline.containsNewline(key2))
             onError(
-              key,
+              key2,
               // checked by containsNewline()
               "MULTILINE_IMPLICIT_KEY",
               "Implicit keys of flow sequence pairs need to be on a single line"
@@ -4289,8 +4289,8 @@ var require_resolve_flow_collection = __commonJS({
         } else {
           ctx.atKey = true;
           const keyStart = props.end;
-          const keyNode = key ? composeNode(ctx, key, props, onError) : composeEmptyNode(ctx, keyStart, start, null, props, onError);
-          if (isBlock(key))
+          const keyNode = key2 ? composeNode(ctx, key2, props, onError) : composeEmptyNode(ctx, keyStart, start, null, props, onError);
+          if (isBlock(key2))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
           const valueProps = resolveProps.resolveProps(sep ?? [], {
@@ -5440,9 +5440,9 @@ var require_cst_scalar = __commonJS({
         ];
         if (!addEndtoBlockProps(props, "end" in token ? token.end : void 0))
           props.push({ type: "newline", offset: -1, indent, source: "\n" });
-        for (const key of Object.keys(token))
-          if (key !== "type" && key !== "offset")
-            delete token[key];
+        for (const key2 of Object.keys(token))
+          if (key2 !== "type" && key2 !== "offset")
+            delete token[key2];
         Object.assign(token, { type: "block-scalar", indent, props, source: body });
       }
     }
@@ -5490,9 +5490,9 @@ var require_cst_scalar = __commonJS({
         default: {
           const indent = "indent" in token ? token.indent : -1;
           const end = "end" in token && Array.isArray(token.end) ? token.end.filter((st) => st.type === "space" || st.type === "comment" || st.type === "newline") : [];
-          for (const key of Object.keys(token))
-            if (key !== "type" && key !== "offset")
-              delete token[key];
+          for (const key2 of Object.keys(token))
+            if (key2 !== "type" && key2 !== "offset")
+              delete token[key2];
           Object.assign(token, { type, indent, source, end });
         }
       }
@@ -5547,12 +5547,12 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep, value }) {
+    function stringifyItem({ start, key: key2, sep, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
-      if (key)
-        res += stringifyToken(key);
+      if (key2)
+        res += stringifyToken(key2);
       if (sep)
         for (const st of sep)
           res += st.source;
@@ -6884,7 +6884,7 @@ var require_parser = __commonJS({
                   });
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
-                  const key = it.key;
+                  const key2 = it.key;
                   const sep = it.sep;
                   sep.push(this.sourceToken);
                   delete it.key;
@@ -6893,7 +6893,7 @@ var require_parser = __commonJS({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep }]
+                    items: [{ start: start2, key: key2, sep }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -7430,162 +7430,11 @@ var require_src = __commonJS({
 // src/cli.ts
 import { basename } from "path";
 
-// ../adapters-node/src/node-browser-opener.ts
-import { spawn } from "child_process";
-var NodeBrowserOpener = class {
-  async open(url) {
-    const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", '""', url.replace(/&/g, "^&")]] : ["xdg-open", [url]];
-    await new Promise((resolve) => {
-      const child = spawn(command, args, { stdio: "ignore", detached: true });
-      child.on("error", () => resolve());
-      child.on("spawn", () => {
-        child.unref();
-        resolve();
-      });
-    });
-  }
-};
-
-// ../adapters-node/src/node-process-runner.ts
-import { spawn as spawn2 } from "child_process";
-var STDERR_TAIL_BYTES = 8 * 1024;
-function buildEnv(overrides) {
-  const env = { ...process.env };
-  for (const [key, value] of Object.entries(overrides ?? {})) {
-    if (value === void 0) delete env[key];
-    else env[key] = value;
-  }
-  return env;
-}
-var useShell = process.platform === "win32";
-var NodeProcessRunner = class {
-  run(command, args, options = {}) {
-    return new Promise((resolve, reject) => {
-      const child = spawn2(command, args, {
-        env: buildEnv(options.env),
-        stdio: ["inherit", "inherit", options.captureStderr ? "pipe" : "inherit"],
-        shell: useShell
-      });
-      let tail = "";
-      child.stderr?.on("data", (chunk) => {
-        process.stderr.write(chunk);
-        tail = (tail + chunk.toString()).slice(-STDERR_TAIL_BYTES);
-      });
-      const ignore = () => {
-      };
-      process.on("SIGINT", ignore);
-      process.on("SIGTERM", ignore);
-      const cleanup = () => {
-        process.off("SIGINT", ignore);
-        process.off("SIGTERM", ignore);
-      };
-      child.on("error", (error) => {
-        cleanup();
-        reject(error);
-      });
-      child.on("close", (code, signal) => {
-        cleanup();
-        resolve({ exitCode: code ?? (signal ? 128 + 2 : 1), stderrTail: tail });
-      });
-    });
-  }
-  capture(command, args, options = {}) {
-    return new Promise((resolve) => {
-      const child = spawn2(command, args, { env: buildEnv(options.env), shell: useShell });
-      child.stdin.end();
-      let stdout2 = "";
-      let stderr = "";
-      child.stdout.on("data", (c3) => {
-        stdout2 += c3.toString();
-      });
-      child.stderr.on("data", (c3) => {
-        stderr += c3.toString();
-      });
-      child.on("error", (error) => resolve({ exitCode: 127, stdout: stdout2, stderr: error.message }));
-      child.on("close", (code) => resolve({ exitCode: code ?? 1, stdout: stdout2, stderr }));
-    });
-  }
-  async probe(command) {
-    const result = await this.capture(command, ["--version"]);
-    if (result.exitCode !== 0) return { installed: false };
-    const output = `${result.stdout} ${result.stderr}`;
-    const version = output.match(/(\d+\.\d+\.\d+)/)?.[1];
-    return { installed: true, ...version ? { version } : {} };
-  }
-};
-
-// ../adapters-node/src/system-tool-installer.ts
-var TOOLS = {
-  aws: {
-    manualUrl: "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html",
-    recipes: {
-      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "awscli"] }],
-      win32: [
-        { via: "winget", command: "winget", args: ["install", "--exact", "--id", "Amazon.AWSCLI"] }
-      ]
-    }
-  },
-  az: {
-    manualUrl: "https://learn.microsoft.com/cli/azure/install-azure-cli",
-    recipes: {
-      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "azure-cli"] }],
-      win32: [
-        {
-          via: "winget",
-          command: "winget",
-          args: ["install", "--exact", "--id", "Microsoft.AzureCLI"]
-        }
-      ]
-    }
-  },
-  gcloud: {
-    manualUrl: "https://cloud.google.com/sdk/docs/install",
-    recipes: {
-      darwin: [
-        { via: "Homebrew", command: "brew", args: ["install", "--cask", "google-cloud-sdk"] }
-      ],
-      win32: [
-        {
-          via: "winget",
-          command: "winget",
-          args: ["install", "--exact", "--id", "Google.CloudSDK"]
-        }
-      ]
-    }
-  }
-};
-var SystemToolInstaller = class {
-  constructor(runner, platform = process.platform) {
-    this.runner = runner;
-    this.platform = platform;
-  }
-  runner;
-  platform;
-  available = /* @__PURE__ */ new Map();
-  recipeFor(command) {
-    const tool = TOOLS[command];
-    if (!tool) return void 0;
-    const recipe = tool.recipes[this.platform]?.[0];
-    return recipe ? { ...recipe, manualUrl: tool.manualUrl } : { via: "official installer", command: "", args: [], manualUrl: tool.manualUrl };
-  }
-  async install(recipe) {
-    if (!recipe.command) return false;
-    if (!await this.hasCommand(recipe.command)) return false;
-    const { exitCode } = await this.runner.run(recipe.command, recipe.args);
-    return exitCode === 0;
-  }
-  async hasCommand(command) {
-    if (!this.available.has(command)) {
-      this.available.set(command, (await this.runner.probe(command)).installed);
-    }
-    return this.available.get(command) ?? false;
-  }
-};
-
-// ../adapters-node/src/yaml-config-store.ts
-import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { join } from "path";
+// ../adapters-node/src/folder-files.ts
+import { createHash } from "crypto";
+import { readFileSync, realpathSync, statSync } from "fs";
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { dirname, join, resolve } from "path";
 
 // ../core/src/domain/errors.ts
 var CloudhopError = class extends Error {
@@ -7602,6 +7451,8 @@ var CloudhopError = class extends Error {
 // ../core/src/domain/naming.ts
 var RESERVED_NAMES = /* @__PURE__ */ new Set([
   "add",
+  "allow",
+  "deny",
   "agent",
   "alias",
   "login",
@@ -7647,8 +7498,15 @@ function assertValidName(kind, name) {
   }
 }
 function suggestAliasName(...parts) {
-  const slug = parts.join("-").toLowerCase().replace(/access$/i, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
-  return slug || "alias";
+  const slug = parts.join("-").toLowerCase().replace(/access$/i, "").replace(/[^a-z0-9]+/g, "-");
+  return trimDashes(slug).slice(0, 63) || "alias";
+}
+function trimDashes(text4) {
+  let start = 0;
+  let end = text4.length;
+  while (start < end && text4[start] === "-") start++;
+  while (end > start && text4[end - 1] === "-") end--;
+  return text4.slice(start, end);
 }
 var slugTokens = (text4) => text4.toLowerCase().replace(/access$/i, "").split(/[^a-z0-9]+/).filter(Boolean);
 var ROLE_WORDS = {
@@ -8078,6 +7936,29 @@ ${result.stderr}`)) {
     await this.ensureSession(resolved.source.id);
     return provider.processEnv(resolved, mode);
   }
+  /**
+   * What `cloudhop use` puts in a shell: the alias' CLI environment (profile
+   * and region, never credentials) and every variable of that provider to
+   * clear first. With `login: false` it never signs in, so entering a folder
+   * never opens a browser: the first command does it if needed.
+   */
+  async shellEnv(name, { login }) {
+    const resolved = await this.usableAlias(name, {});
+    const provider = this.provider(resolved.source.provider);
+    if (login) await this.ensureSession(resolved.source.id);
+    return {
+      provider: provider.id,
+      clear: provider.shellVars,
+      env: await provider.processEnv(resolved, "cli"),
+      region: resolved.region,
+      label: resolved.target?.label,
+      prod: resolved.alias.prod === true
+    };
+  }
+  /** The variables `cloudhop use --off <provider>` removes from a shell. */
+  shellVars(provider) {
+    return this.provider(provider).shellVars;
+  }
   // ── Health ───────────────────────────────────────────────────────────────
   async doctor() {
     const config = await this.deps.config.load();
@@ -8193,19 +8074,268 @@ ${result.stderr}`)) {
         "Run `cloudhop ls` to see your aliases."
       );
     }
-    return alias;
+    return alias;
+  }
+};
+
+// ../core/src/domain/model.ts
+var PROVIDER_IDS = ["aws", "azure", "gcp"];
+var emptyConfig = () => ({ providers: [], sources: [], aliases: [] });
+
+// ../core/src/domain/folder.ts
+var FOLDER_FILE = ".cloudhoprc";
+var bad = (why) => new CloudhopError(
+  "INVALID_NAME",
+  `Not a valid ${FOLDER_FILE}: ${why}.`,
+  "Write one line per cloud, like `aws: my-alias`."
+);
+function parseFolderFile(text4) {
+  const result = {};
+  for (const raw of text4.split(/\r?\n/)) {
+    const line = raw.replace(/#.*/, "").trim();
+    if (!line) continue;
+    const match = /^([a-z]+)\s*[:=]\s*(\S+)$/.exec(line);
+    const key2 = match ? match[1] : "any";
+    const alias = match ? match[2] : line;
+    if (key2 !== "any" && !PROVIDER_IDS.includes(key2)) throw bad(`unknown cloud "${key2}"`);
+    if (result[key2]) throw bad(`"${key2}" appears twice`);
+    assertValidName("alias", alias);
+    result[key2] = alias;
+  }
+  if (Object.keys(result).length === 0) throw bad("it names no alias");
+  return result;
+}
+function formatFolderFile(aliases) {
+  const lines = Object.entries(aliases).map(
+    ([key2, alias]) => key2 === "any" ? alias : `${key2}: ${alias}`
+  );
+  return `# cloudhop: aliases for this folder (https://dayepesb.github.io/cloudhop/guides/shell/)
+${lines.join("\n")}
+`;
+}
+
+// ../adapters-node/src/folder-files.ts
+function findFolderFile(start) {
+  let dir = resolve(start);
+  for (; ; ) {
+    const file = join(dir, FOLDER_FILE);
+    try {
+      if (statSync(file).isFile()) return file;
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+var key = (path2) => {
+  try {
+    return realpathSync.native(path2);
+  } catch {
+    return resolve(path2);
+  }
+};
+var digest = (content) => createHash("sha256").update(content).digest("hex");
+var TrustedFolders = class {
+  file;
+  constructor(configDir) {
+    this.file = join(configDir, "trusted-folders.json");
+  }
+  isTrusted(path2, content) {
+    return this.load().files[key(path2)] === digest(content);
+  }
+  async trust(path2, content) {
+    const data = this.load();
+    data.files[key(path2)] = digest(content);
+    await this.save(data);
+  }
+  /** Returns false when the file was not trusted. */
+  async forget(path2) {
+    const data = this.load();
+    const file = key(path2);
+    if (!(file in data.files)) return false;
+    delete data.files[file];
+    await this.save(data);
+    return true;
+  }
+  load() {
+    try {
+      const data = JSON.parse(readFileSync(this.file, "utf8"));
+      return data?.version === 1 && data.files ? data : { version: 1, files: {} };
+    } catch {
+      return { version: 1, files: {} };
+    }
+  }
+  async save(data) {
+    await mkdir(dirname(this.file), { recursive: true });
+    await writeFile(this.file, `${JSON.stringify(data, null, 2)}
+`, { mode: 384 });
+  }
+};
+async function readFolderFile(path2) {
+  return readFile(path2, "utf8").catch(() => void 0);
+}
+
+// ../adapters-node/src/node-browser-opener.ts
+import { spawn } from "child_process";
+var NodeBrowserOpener = class {
+  async open(url) {
+    const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", '""', url.replace(/&/g, "^&")]] : ["xdg-open", [url]];
+    await new Promise((resolve3) => {
+      const child = spawn(command, args, { stdio: "ignore", detached: true });
+      child.on("error", () => resolve3());
+      child.on("spawn", () => {
+        child.unref();
+        resolve3();
+      });
+    });
+  }
+};
+
+// ../adapters-node/src/node-process-runner.ts
+import { spawn as spawn2 } from "child_process";
+var STDERR_TAIL_BYTES = 8 * 1024;
+function buildEnv(overrides) {
+  const env = { ...process.env };
+  for (const [key2, value] of Object.entries(overrides ?? {})) {
+    if (value === void 0) delete env[key2];
+    else env[key2] = value;
+  }
+  return env;
+}
+var useShell = process.platform === "win32";
+var NodeProcessRunner = class {
+  run(command, args, options = {}) {
+    return new Promise((resolve3, reject) => {
+      const child = spawn2(command, args, {
+        env: buildEnv(options.env),
+        stdio: ["inherit", "inherit", options.captureStderr ? "pipe" : "inherit"],
+        shell: useShell
+      });
+      let tail = "";
+      child.stderr?.on("data", (chunk) => {
+        process.stderr.write(chunk);
+        tail = (tail + chunk.toString()).slice(-STDERR_TAIL_BYTES);
+      });
+      const ignore = () => {
+      };
+      process.on("SIGINT", ignore);
+      process.on("SIGTERM", ignore);
+      const cleanup = () => {
+        process.off("SIGINT", ignore);
+        process.off("SIGTERM", ignore);
+      };
+      child.on("error", (error) => {
+        cleanup();
+        reject(error);
+      });
+      child.on("close", (code, signal) => {
+        cleanup();
+        resolve3({ exitCode: code ?? (signal ? 128 + 2 : 1), stderrTail: tail });
+      });
+    });
+  }
+  capture(command, args, options = {}) {
+    return new Promise((resolve3) => {
+      const child = spawn2(command, args, { env: buildEnv(options.env), shell: useShell });
+      child.stdin.end();
+      let stdout2 = "";
+      let stderr = "";
+      child.stdout.on("data", (c3) => {
+        stdout2 += c3.toString();
+      });
+      child.stderr.on("data", (c3) => {
+        stderr += c3.toString();
+      });
+      child.on("error", (error) => resolve3({ exitCode: 127, stdout: stdout2, stderr: error.message }));
+      child.on("close", (code) => resolve3({ exitCode: code ?? 1, stdout: stdout2, stderr }));
+    });
+  }
+  async probe(command) {
+    const result = await this.capture(command, ["--version"]);
+    if (result.exitCode !== 0) return { installed: false };
+    const output = `${result.stdout} ${result.stderr}`;
+    const version = output.match(/(\d+\.\d+\.\d+)/)?.[1];
+    return { installed: true, ...version ? { version } : {} };
+  }
+};
+
+// ../adapters-node/src/system-tool-installer.ts
+var TOOLS = {
+  aws: {
+    manualUrl: "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html",
+    recipes: {
+      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "awscli"] }],
+      win32: [
+        { via: "winget", command: "winget", args: ["install", "--exact", "--id", "Amazon.AWSCLI"] }
+      ]
+    }
+  },
+  az: {
+    manualUrl: "https://learn.microsoft.com/cli/azure/install-azure-cli",
+    recipes: {
+      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "azure-cli"] }],
+      win32: [
+        {
+          via: "winget",
+          command: "winget",
+          args: ["install", "--exact", "--id", "Microsoft.AzureCLI"]
+        }
+      ]
+    }
+  },
+  gcloud: {
+    manualUrl: "https://cloud.google.com/sdk/docs/install",
+    recipes: {
+      darwin: [
+        { via: "Homebrew", command: "brew", args: ["install", "--cask", "google-cloud-sdk"] }
+      ],
+      win32: [
+        {
+          via: "winget",
+          command: "winget",
+          args: ["install", "--exact", "--id", "Google.CloudSDK"]
+        }
+      ]
+    }
+  }
+};
+var SystemToolInstaller = class {
+  constructor(runner, platform = process.platform) {
+    this.runner = runner;
+    this.platform = platform;
+  }
+  runner;
+  platform;
+  available = /* @__PURE__ */ new Map();
+  recipeFor(command) {
+    const tool = TOOLS[command];
+    if (!tool) return void 0;
+    const recipe = tool.recipes[this.platform]?.[0];
+    return recipe ? { ...recipe, manualUrl: tool.manualUrl } : { via: "official installer", command: "", args: [], manualUrl: tool.manualUrl };
+  }
+  async install(recipe) {
+    if (!recipe.command) return false;
+    if (!await this.hasCommand(recipe.command)) return false;
+    const { exitCode } = await this.runner.run(recipe.command, recipe.args);
+    return exitCode === 0;
+  }
+  async hasCommand(command) {
+    if (!this.available.has(command)) {
+      this.available.set(command, (await this.runner.probe(command)).installed);
+    }
+    return this.available.get(command) ?? false;
   }
 };
 
-// ../core/src/domain/model.ts
-var PROVIDER_IDS = ["aws", "azure", "gcp"];
-var emptyConfig = () => ({ providers: [], sources: [], aliases: [] });
-
 // ../adapters-node/src/yaml-config-store.ts
+import { mkdir as mkdir2, readFile as readFile2, rename, rm, writeFile as writeFile2 } from "fs/promises";
+import { homedir } from "os";
+import { join as join2 } from "path";
 var import_yaml = __toESM(require_dist(), 1);
 function defaultConfigDir(env = process.env) {
   if (env.CLOUDHOP_HOME) return env.CLOUDHOP_HOME;
-  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "cloudhop");
+  return join2(env.XDG_CONFIG_HOME || join2(homedir(), ".config"), "cloudhop");
 }
 var HEADER = "# cloudhop configuration. Contains no secrets.\n# Docs: https://github.com/dayepesb/cloudhop\n";
 var YamlConfigStore = class {
@@ -8214,10 +8344,10 @@ var YamlConfigStore = class {
   }
   dir;
   get configPath() {
-    return join(this.dir, "config.yaml");
+    return join2(this.dir, "config.yaml");
   }
   get targetsPath() {
-    return join(this.dir, "targets.json");
+    return join2(this.dir, "targets.json");
   }
   async load() {
     const raw = await this.read(this.configPath);
@@ -8265,7 +8395,7 @@ var YamlConfigStore = class {
   }
   async read(path2) {
     try {
-      return await readFile(path2, "utf8");
+      return await readFile2(path2, "utf8");
     } catch (error) {
       if (error.code === "ENOENT") return void 0;
       throw error;
@@ -8273,9 +8403,9 @@ var YamlConfigStore = class {
   }
   /** Writes through a temp file so a crash never leaves a half-written config. */
   async write(path2, content) {
-    await mkdir(this.dir, { recursive: true, mode: 448 });
+    await mkdir2(this.dir, { recursive: true, mode: 448 });
     const tmp = `${path2}.${process.pid}.tmp`;
-    await writeFile(tmp, content, { mode: 384 });
+    await writeFile2(tmp, content, { mode: 384 });
     await rename(tmp, path2);
   }
 };
@@ -8288,17 +8418,17 @@ var MAX_OUTPUT = 1e5;
 var cap = (text4) => text4.length > MAX_OUTPUT ? `${text4.slice(0, MAX_OUTPUT)}
 \u2026 [truncated: ${text4.length - MAX_OUTPUT} more characters. Narrow the command with --query or filters.]` : text4;
 var WINDOWS_SHELL_CHARS = /[&|<>^%!"\r\n]/;
-var text = (args, key) => {
-  const value = args[key];
+var text = (args, key2) => {
+  const value = args[key2];
   if (typeof value !== "string" || !value.trim()) {
-    throw new CloudhopError("INVALID_NAME", `"${key}" is required.`);
+    throw new CloudhopError("INVALID_NAME", `"${key2}" is required.`);
   }
   return value.trim();
 };
-var stringArray = (args, key) => {
-  const value = args[key];
+var stringArray = (args, key2) => {
+  const value = args[key2];
   if (!Array.isArray(value) || !value.every((v) => typeof v === "string")) {
-    throw new CloudhopError("INVALID_NAME", `"${key}" must be an array of strings.`);
+    throw new CloudhopError("INVALID_NAME", `"${key2}" must be an array of strings.`);
   }
   return value;
 };
@@ -8308,15 +8438,15 @@ var aliasInput = {
     description: "The cloudhop alias to use, as listed by list_aliases. Ask the user which one."
   }
 };
-function createTools(app) {
+function createTools(app, context) {
   return [
     {
       name: "list_aliases",
       title: "List cloudhop aliases",
-      description: "Lists every cloudhop source (SSO portal or personal account) with its session state, and every alias: name, account/role label, region and whether a sign-in is needed. Call this first, then ask the user which alias to work with. Never contains secrets.",
+      description: "Lists every cloudhop source (SSO portal or personal account) with its session state, and every alias: name, account/role label, region and whether a sign-in is needed. Also hints: `folder` (the aliases this project pins in its .cloudhoprc, and whether the user trusted it) and `inUse` (aliases the user switched their terminal to). Call this first, then ask the user which alias to work with, offering the hinted one first. Never contains secrets.",
       inputSchema: { type: "object", properties: {}, additionalProperties: false },
       annotations: { readOnlyHint: true, openWorldHint: false },
-      run: () => app.overview()
+      run: async () => ({ ...await app.overview(), ...await context?.() })
     },
     {
       name: "alias_status",
@@ -8476,7 +8606,7 @@ function createTools(app) {
 
 // ../mcp/src/server.ts
 var MCP_INSTRUCTIONS = `cloudhop gives each cloud account + role + region a short alias and signs the user in only when a session expired.
-Before the first cloud operation in a conversation: call list_aliases, show the user the aliases (name, account/role, region) and ask which one to use. Never guess the alias.
+Before the first cloud operation in a conversation: call list_aliases, show the user the aliases (name, account/role, region) and ask which one to use. Never guess the alias. If list_aliases has folder.aliases (the project's .cloudhoprc) or inUse, offer that alias first, but still ask.
 Use run_cloud_cli for cloud CLI commands, never --profile. Read-only commands may run once the alias is chosen; before anything that creates, changes or deletes resources, show the alias, account, region and exact command, and wait for the user's explicit OK. Aliases with prod: true are production: run_cloud_cli refuses changes there until the user approves and you pass confirm_production: true.
 To show the user something in the web console, call open_console (it opens their browser, already signed in).
 If a tool returns LOGIN_REQUIRED or alias_status says browser-sign-in: tell the user their browser will open, then call login (it waits up to 5 minutes for them to approve). Never print or ask for credentials.`;
@@ -8485,9 +8615,10 @@ function serveMcp({
   app,
   version,
   input = process.stdin,
-  output = process.stdout
+  output = process.stdout,
+  context
 }) {
-  const tools = createTools(app);
+  const tools = createTools(app, context);
   const byName = new Map(tools.map((t2) => [t2.name, t2]));
   const send2 = (message) => output.write(`${JSON.stringify(message)}
 `);
@@ -8553,7 +8684,7 @@ function serveMcp({
         if (!isNotification) fail(id, -32601, `Method not found: ${method}`);
     }
   };
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     const lines = createInterface({ input, crlfDelay: Number.POSITIVE_INFINITY });
     const pending = /* @__PURE__ */ new Set();
     lines.on("line", (line) => {
@@ -8573,7 +8704,7 @@ function serveMcp({
       task.finally(() => pending.delete(task));
     });
     lines.on("close", () => {
-      Promise.allSettled([...pending]).then(() => resolve());
+      Promise.allSettled([...pending]).then(() => resolve3());
     });
   });
 }
@@ -8588,7 +8719,9 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "noMcp",
   "force",
   "prod",
-  "off"
+  "off",
+  "save",
+  "leave"
 ]);
 var camel = (name) => name.replace(/-([a-z])/g, (_2, c3) => c3.toUpperCase());
 function parseArgs(argv) {
@@ -10009,7 +10142,7 @@ import { styleText as styleText2, stripVTControlCharacters } from "util";
 import process$1 from "process";
 var import_sisteransi2 = __toESM(require_src(), 1);
 import { existsSync, lstatSync, readdirSync } from "fs";
-import { dirname, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 function isUnicodeSupported() {
   if (process$1.platform !== "win32") {
     return process$1.env.TERM !== "linux";
@@ -10947,10 +11080,10 @@ var path = (e) => {
         return [];
       try {
         let i2;
-        existsSync(t2) ? lstatSync(t2).isDirectory() && (!e.directory || t2.endsWith("/")) ? i2 = t2 : i2 = dirname(t2) : i2 = dirname(t2);
+        existsSync(t2) ? lstatSync(t2).isDirectory() && (!e.directory || t2.endsWith("/")) ? i2 = t2 : i2 = dirname2(t2) : i2 = dirname2(t2);
         const c3 = t2.length > 1 && t2.endsWith("/") ? t2.slice(0, -1) : t2;
         return readdirSync(i2).map((r2) => {
-          const n3 = join2(i2, r2), m3 = lstatSync(n3);
+          const n3 = join3(i2, r2), m3 = lstatSync(n3);
           return {
             name: r2,
             path: n3,
@@ -11707,16 +11840,16 @@ import { homedir as homedir2 } from "os";
 import { isAbsolute, relative } from "path";
 
 // ../assistants/src/installer.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync2 } from "fs";
-import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, rmdir, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, join as join4 } from "path";
+import { mkdir as mkdir3, readFile as readFile3, rename as rename2, rm as rm2, rmdir, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, join as join5 } from "path";
 
 // ../assistants/src/assets/skill.md
-var skill_default = "---\nname: cloudhop\ndescription: Run AWS CLI commands and other cloud tools as a specific account, role and region through cloudhop aliases (the `hop` and `cloudhop` commands). Use whenever the user asks to do anything in their AWS accounts, inspect or change cloud resources, run aws/terraform/cdk against an account, list their cloud accounts or aliases, or mentions hop or cloudhop.\n---\n\n# Working with cloud accounts through cloudhop\n\nThe user manages their cloud access with **cloudhop**. Each **alias** (for\nexample `acme-dev`) points to one account, one role and one region. cloudhop\nsigns the user in through their browser only when a session has expired. There\nare no access keys: never ask for, create, print or store credentials.\n\n## 1. Pick the alias with the user, every time\n\nBefore the first cloud operation in a conversation:\n\n1. List the aliases. Use the `list_aliases` tool if the cloudhop MCP server is\n   connected; otherwise run `cloudhop ls --json`.\n2. Show the user the options (alias, account / role, region) and **ask which\n   one to use**. Don't guess, even if one name looks right, and don't pick\n   one just because there is only one: confirm it.\n3. Use that alias for the rest of the conversation. Ask again if the user\n   moves to another environment, account or task.\n\n## 2. Check the session before running anything\n\nRun `cloudhop status <alias> --json` (or the `alias_status` tool) and read\n`next`:\n\n| `next`            | Meaning                                      | What to do                                                                                                                                        |\n| ----------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `ready`           | Session valid                                | Go ahead                                                                                                                                          |\n| `silent-renewal`  | Expired but renewable without the user       | Go ahead; cloudhop renews it                                                                                                                      |\n| `browser-sign-in` | The user must sign in                        | Tell the user their browser will open and they need to approve, then run `cloudhop login <source>` (or the `login` tool) and wait up to 5 minutes |\n| `unknown`         | Managed by the cloud CLI (personal accounts) | Go ahead; if it fails, run `cloudhop login <source>`                                                                                              |\n\nDon't start several cloud commands in parallel while a sign-in is pending.\n\n## 3. Run commands through the alias\n\n- **AWS CLI**: `hop <alias> <aws arguments>`, e.g. `hop acme-dev s3 ls`.\n  It is exactly `aws <arguments>` with the alias' account, role and region.\n  Never add `--profile`. Use `--region <r>` only to override the region once.\n  With the MCP server, use `run_cloud_cli` with `args` (no program name).\n- **Who am I**: `hop <alias>` with no arguments (or the `whoami` tool).\n- **The same command in several aliases** (after the user chose them):\n  `cloudhop each a,b,c --yes -- <aws arguments>`; add `--json` to parse the\n  results.\n- **The AWS web console**: `cloudhop console <alias> [service]` (or the\n  `open_console` tool) opens it in the user's browser, already signed in.\n  Never try to print or fetch its URL.\n- **Always name the alias.** Never run the interactive forms meant for a\n  person at a terminal: `hop` or `hop -` without an alias, `cloudhop console`\n  without an alias, `cloudhop use` (it only changes an interactive shell),\n  `cloudhop setup`, or `cloudhop add`/`alias` without flags. Nobody can answer\n  their prompts in your terminal.\n- **Other tools** (Terraform, CDK, SDK scripts):\n  `cloudhop exec <alias> -- <command>`, e.g.\n  `cloudhop exec acme-dev -- terraform plan`.\n- Prefer `--output json` and `--query` to keep output small.\n- Don't export `AWS_PROFILE`, `AWS_ACCESS_KEY_ID` or similar variables, don't\n  run commands that print credentials (`env`, `printenv`, `export-credentials`)\n  and never edit `~/.aws/config`, `~/.aws/credentials` or cloudhop's own files.\n\n## 4. Confirm before changing anything\n\n- Read-only commands (`list`, `describe`, `get`, `s3 ls`, `logs tail`) can run\n  once the user has chosen the alias.\n- Before any command that **creates, changes, deletes or costs money**, show\n  the alias, account, region and the exact command, and wait for the user's\n  explicit \"yes\". One confirmation covers one command, not a series.\n- **Production aliases** have `\"prod\": true` in `cloudhop ls --json` (and\n  `PROD` in `cloudhop ls`). Confirm every change there and suggest a dry run\n  (`--dryrun`, `terraform plan`) first. cloudhop enforces it: without a\n  terminal, `hop`/`cloudhop exec` refuse changes on production with\n  `PROD_CONFIRMATION_REQUIRED`. After the user explicitly approves the exact\n  command, rerun it with `CLOUDHOP_CONFIRM_PROD=1` in that command's\n  environment (with MCP: `confirm_production: true`). Never set it on your own.\n- Treat aliases or accounts that merely look like production (`prd`, `live`)\n  the same way, even if they are not marked.\n- Don't change cloudhop itself (`cloudhop add`, `rm`, `mv`, `region`, `prod`,\n  `team import`, `agent`, `login` for another source) unless the user asked\n  for it. Never unmark a production alias to get around a confirmation.\n\n## 5. When something goes wrong\n\n| You see                                             | Do this                                                                        |\n| --------------------------------------------------- | ------------------------------------------------------------------------------ |\n| \"Opening your browser to log in\"                    | Tell the user to approve in the browser; the command continues by itself       |\n| The command was cut off while waiting for a sign-in | Run `cloudhop login <source>` with a timeout of at least 5 minutes, then retry |\n| `LOGIN_REQUIRED`                                    | Same as `browser-sign-in` above                                                |\n| No browser on this machine (remote, container)      | Run `cloudhop login <source> --device-code` and show the user the URL and code |\n| `Alias \"x\" not found`                               | Run `cloudhop ls` and ask the user again                                       |\n| AWS CLI missing or too old                          | Suggest `cloudhop doctor`; don't install anything without asking               |\n| `AccessDenied`                                      | The role lacks permission: tell the user; don't try other aliases on your own  |\n\nMore: https://dayepesb.github.io/cloudhop/guides/hop-like-aws/\n";
+var skill_default = "---\nname: cloudhop\ndescription: Run AWS CLI commands and other cloud tools as a specific account, role and region through cloudhop aliases (the `hop` and `cloudhop` commands). Use whenever the user asks to do anything in their AWS accounts, inspect or change cloud resources, run aws/terraform/cdk against an account, list their cloud accounts or aliases, or mentions hop or cloudhop.\n---\n\n# Working with cloud accounts through cloudhop\n\nThe user manages their cloud access with **cloudhop**. Each **alias** (for\nexample `acme-dev`) points to one account, one role and one region. cloudhop\nsigns the user in through their browser only when a session has expired. There\nare no access keys: never ask for, create, print or store credentials.\n\n## How the user works (to guide them)\n\nWhen the user asks how to set up or use cloudhop themselves, describe this\npath; these are commands for **them** to run in their own terminal:\n\n1. **Once**: `npm install --global cloudhop`, then `cloudhop add` (signs in\n   to an SSO portal or personal account and names each account/role as an\n   alias), then `cloudhop shell` (adds one line to their shell's startup\n   file and, with Starship, the alias segment to `starship.toml`; they open\n   a new terminal afterwards). `cloudhop setup` does all of it in one\n   guided run. Works in zsh, bash (Git Bash too), fish and PowerShell;\n   in Windows `cmd.exe`, `cloudhop use` opens a new `cmd` with the alias in\n   its prompt.\n2. **Every day**: `cloudhop use <alias>` switches that terminal to an\n   account; after that they type plain `aws ...`, Terraform\n   or SDK commands. `cloudhop use <other>` switches accounts and\n   `cloudhop use --off` goes back. Expired sessions sign in by themselves,\n   and on production aliases `aws` asks before changes. Their prompt shows\n   the alias in use, in red for production, and `cloudhop status` tells\n   them which alias their terminal uses.\n3. **Per project**: `cloudhop use <alias> --save` writes a `.cloudhoprc` in\n   the folder, so `cd` into it switches the terminal; teammates run\n   `cloudhop allow` once after cloning (and again after the file changes);\n   `cloudhop deny` withdraws it. A file does nothing until it is trusted.\n4. **One-offs**: `hop <alias> <aws args>` runs one command in another\n   account without switching; `cloudhop each` runs it in many;\n   `cloudhop console <alias> [service]` opens the web console signed in.\n\nWhy `cloudhop shell` is needed: a program can't change the environment of\nthe terminal that started it, only the shell can.\nWithout it, `cloudhop use` opens a new shell instead; `hop` always works.\n\nSwitches, for the user: `CLOUDHOP_WRAP=0` keeps `aws` as the plain AWS\nCLI, `CLOUDHOP_AUTO_USE=0` ignores `.cloudhoprc` files, `CLOUDHOP_PROMPT=0`\nhides the prompt label. `cloudhop shell starship` prints the Starship\nsegment for people who place it by hand.\n\nWhen their terminal doesn't do what they expect:\n\n| They say | Suggest |\n| --- | --- |\n| \"Which account am I in?\" | `cloudhop status` (first line) |\n| `cloudhop use` opened a new shell / says it needs the integration | `cloudhop shell`, then a new terminal |\n| No label in the prompt | Run `cloudhop shell` again (it adds what's missing), then a new terminal |\n| `cd` into the project doesn't switch | `cloudhop allow` in that folder; check the alias name exists (`cloudhop ls`) |\n| `aws` runs in the wrong account | `cloudhop status`, then `cloudhop use <alias>` or `cloudhop use --off` |\n\nThat is the user's way. **You** work differently, below: you always name the\nalias with `hop <alias>`, because your shell doesn't have their integration.\n\n## 1. Pick the alias with the user, every time\n\nBefore the first cloud operation in a conversation:\n\n1. List the aliases. Use the `list_aliases` tool if the cloudhop MCP server is\n   connected; otherwise run `cloudhop ls --json`.\n2. Show the user the options (alias, account / role, region) and **ask which\n   one to use**. Don't guess, even if one name looks right, and don't pick\n   one just because there is only one: confirm it.\n   - The listing may carry hints: `folder.aliases` is what this project pins\n     in its `.cloudhoprc` (`folder.trusted` says whether the user approved\n     it), and `inUse` is what the user switched their terminal to with\n     `cloudhop use` (`cloudhop status --json` has `inUse` too). Offer that\n     alias first (\"This project uses\n     `license-qa`, use it?\"), but still wait for the answer.\n3. Use that alias for the rest of the conversation. Ask again if the user\n   moves to another environment, account or task.\n\n## 2. Check the session before running anything\n\nRun `cloudhop status <alias> --json` (or the `alias_status` tool) and read\n`next`:\n\n| `next`            | Meaning                                      | What to do                                                                                                                                        |\n| ----------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `ready`           | Session valid                                | Go ahead                                                                                                                                          |\n| `silent-renewal`  | Expired but renewable without the user       | Go ahead; cloudhop renews it                                                                                                                      |\n| `browser-sign-in` | The user must sign in                        | Tell the user their browser will open and they need to approve, then run `cloudhop login <source>` (or the `login` tool) and wait up to 5 minutes |\n| `unknown`         | Managed by the cloud CLI (personal accounts) | Go ahead; if it fails, run `cloudhop login <source>`                                                                                              |\n\nDon't start several cloud commands in parallel while a sign-in is pending.\n\n## 3. Run commands through the alias\n\n- **AWS CLI**: `hop <alias> <aws arguments>`, e.g. `hop acme-dev s3 ls`.\n  It is exactly `aws <arguments>` with the alias' account, role and region.\n  Never add `--profile`. Use `--region <r>` only to override the region once.\n  With the MCP server, use `run_cloud_cli` with `args` (no program name).\n- **Who am I**: `hop <alias>` with no arguments (or the `whoami` tool).\n- **The same command in several aliases** (after the user chose them):\n  `cloudhop each a,b,c --yes -- <aws arguments>`; add `--json` to parse the\n  results.\n- **The AWS web console**: `cloudhop console <alias> [service]` (or the\n  `open_console` tool) opens it in the user's browser, already signed in.\n  Never try to print or fetch its URL.\n- **Always name the alias**, even when the project has a `.cloudhoprc` or\n  the user's terminal uses an alias: your shell doesn't have the user's\n  cloudhop integration, so a plain `aws` may run as anything. Use\n  `hop <alias> ...`, never bare `aws`.\n- Never run the interactive forms meant for a person at a terminal: `hop` or\n  `hop -` without an alias, `cloudhop console` without an alias,\n  `cloudhop use` (it changes or opens an interactive shell), `cloudhop\n  allow`/`deny` (trusting a folder is the user's decision), `cloudhop setup`,\n  or `cloudhop add`/`alias` without flags. Nobody can answer their prompts in\n  your terminal.\n- **Other tools** (Terraform, CDK, SDK scripts):\n  `cloudhop exec <alias> -- <command>`, e.g.\n  `cloudhop exec acme-dev -- terraform plan`.\n- Prefer `--output json` and `--query` to keep output small.\n- Don't export `AWS_PROFILE`, `AWS_ACCESS_KEY_ID` or similar variables, don't\n  run commands that print credentials (`env`, `printenv`, `export-credentials`)\n  and never edit `~/.aws/config`, `~/.aws/credentials` or cloudhop's own files.\n\n## 4. Confirm before changing anything\n\n- Read-only commands (`list`, `describe`, `get`, `s3 ls`, `logs tail`) can run\n  once the user has chosen the alias.\n- Before any command that **creates, changes, deletes or costs money**, show\n  the alias, account, region and the exact command, and wait for the user's\n  explicit \"yes\". One confirmation covers one command, not a series.\n- **Production aliases** have `\"prod\": true` in `cloudhop ls --json` (and\n  `PROD` in `cloudhop ls`). Confirm every change there and suggest a dry run\n  (`--dryrun`, `terraform plan`) first. cloudhop enforces it: without a\n  terminal, `hop`/`cloudhop exec` refuse changes on production with\n  `PROD_CONFIRMATION_REQUIRED`. After the user explicitly approves the exact\n  command, rerun it with `CLOUDHOP_CONFIRM_PROD=1` in that command's\n  environment (with MCP: `confirm_production: true`). Never set it on your own.\n- Treat aliases or accounts that merely look like production (`prd`, `live`)\n  the same way, even if they are not marked.\n- Don't change cloudhop itself (`cloudhop add`, `rm`, `mv`, `region`, `prod`,\n  `team import`, `agent`, `login` for another source) or write a\n  `.cloudhoprc` unless the user asked for it. Never unmark a production\n  alias to get around a confirmation.\n\n## 5. When something goes wrong\n\n| You see                                             | Do this                                                                        |\n| --------------------------------------------------- | ------------------------------------------------------------------------------ |\n| \"Opening your browser to log in\"                    | Tell the user to approve in the browser; the command continues by itself       |\n| The command was cut off while waiting for a sign-in | Run `cloudhop login <source>` with a timeout of at least 5 minutes, then retry |\n| `LOGIN_REQUIRED`                                    | Same as `browser-sign-in` above                                                |\n| No browser on this machine (remote, container)      | Run `cloudhop login <source> --device-code` and show the user the URL and code |\n| `Alias \"x\" not found`                               | Run `cloudhop ls` and ask the user again                                       |\n| AWS CLI missing or too old                          | Suggest `cloudhop doctor`; don't install anything without asking               |\n| `AccessDenied`                                      | The role lacks permission: tell the user; don't try other aliases on your own  |\n\nMore: https://dayepesb.github.io/cloudhop/guides/hop-like-aws/\n";
 
 // ../assistants/src/targets.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var ASSISTANT_IDS = [
   "claude",
   "kiro",
@@ -11731,9 +11864,9 @@ var ASSISTANTS = {
   claude: {
     id: "claude",
     name: "Claude Code",
-    markers: ({ home }) => [join3(home, ".claude")],
-    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".claude", "skills", SKILL_NAME),
-    mcp: (scope, { project }) => scope === "project" ? { kind: "json", file: join3(project, ".mcp.json"), key: "mcpServers", withType: false } : {
+    markers: ({ home }) => [join4(home, ".claude")],
+    skillDir: (scope, { home, project }) => join4(scope === "user" ? home : project, ".claude", "skills", SKILL_NAME),
+    mcp: (scope, { project }) => scope === "project" ? { kind: "json", file: join4(project, ".mcp.json"), key: "mcpServers", withType: false } : {
       kind: "cli",
       command: "claude",
       add: ["mcp", "add", "--scope", "user", "cloudhop", "--", MCP_COMMAND, ...MCP_ARGS],
@@ -11744,11 +11877,11 @@ var ASSISTANTS = {
   kiro: {
     id: "kiro",
     name: "Kiro",
-    markers: ({ home }) => [join3(home, ".kiro")],
-    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".kiro", "skills", SKILL_NAME),
+    markers: ({ home }) => [join4(home, ".kiro")],
+    skillDir: (scope, { home, project }) => join4(scope === "user" ? home : project, ".kiro", "skills", SKILL_NAME),
     mcp: (scope, { home, project }) => ({
       kind: "json",
-      file: join3(scope === "user" ? home : project, ".kiro", "settings", "mcp.json"),
+      file: join4(scope === "user" ? home : project, ".kiro", "settings", "mcp.json"),
       key: "mcpServers",
       withType: false
     })
@@ -11756,11 +11889,11 @@ var ASSISTANTS = {
   copilot: {
     id: "copilot",
     name: "GitHub Copilot (VS Code)",
-    markers: ({ home }) => [join3(home, ".copilot"), join3(home, ".vscode")],
-    skillDir: (scope, { home, project }) => scope === "user" ? join3(home, ".copilot", "skills", SKILL_NAME) : join3(project, ".github", "skills", SKILL_NAME),
+    markers: ({ home }) => [join4(home, ".copilot"), join4(home, ".vscode")],
+    skillDir: (scope, { home, project }) => scope === "user" ? join4(home, ".copilot", "skills", SKILL_NAME) : join4(project, ".github", "skills", SKILL_NAME),
     mcp: (scope, { project }) => scope === "project" ? {
       kind: "json",
-      file: join3(project, ".vscode", "mcp.json"),
+      file: join4(project, ".vscode", "mcp.json"),
       key: "servers",
       withType: true
     } : {
@@ -11782,11 +11915,11 @@ var ASSISTANTS = {
   cursor: {
     id: "cursor",
     name: "Cursor",
-    markers: ({ home }) => [join3(home, ".cursor")],
-    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".cursor", "skills", SKILL_NAME),
+    markers: ({ home }) => [join4(home, ".cursor")],
+    skillDir: (scope, { home, project }) => join4(scope === "user" ? home : project, ".cursor", "skills", SKILL_NAME),
     mcp: (scope, { home, project }) => ({
       kind: "json",
-      file: join3(scope === "user" ? home : project, ".cursor", "mcp.json"),
+      file: join4(scope === "user" ? home : project, ".cursor", "mcp.json"),
       key: "mcpServers",
       withType: true
     })
@@ -11794,29 +11927,29 @@ var ASSISTANTS = {
   codex: {
     id: "codex",
     name: "Codex",
-    markers: ({ home }) => [join3(home, ".codex"), join3(home, ".agents")],
-    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".agents", "skills", SKILL_NAME),
+    markers: ({ home }) => [join4(home, ".codex"), join4(home, ".agents")],
+    skillDir: (scope, { home, project }) => join4(scope === "user" ? home : project, ".agents", "skills", SKILL_NAME),
     mcp: (scope, { home, project }) => ({
       kind: "toml",
-      file: join3(scope === "user" ? home : project, ".codex", "config.toml")
+      file: join4(scope === "user" ? home : project, ".codex", "config.toml")
     })
   }
 };
 
 // ../assistants/src/installer.ts
-var sha = (text4) => createHash("sha256").update(text4).digest("hex");
+var sha = (text4) => createHash2("sha256").update(text4).digest("hex");
 async function writeAtomic(file, content) {
-  await mkdir2(dirname2(file), { recursive: true });
+  await mkdir3(dirname3(file), { recursive: true });
   const tmp = `${file}.cloudhop-${process.pid}.tmp`;
-  await writeFile2(tmp, content);
+  await writeFile3(tmp, content);
   await rename2(tmp, file);
 }
 async function removeFileAndEmptyDir(file) {
   await rm2(file, { force: true });
-  await rmdir(dirname2(file)).catch(() => {
+  await rmdir(dirname3(file)).catch(() => {
   });
 }
-var readText = (file) => readFile2(file, "utf8").catch(() => void 0);
+var readText = (file) => readFile3(file, "utf8").catch(() => void 0);
 var AssistantsInstaller = class {
   constructor(options) {
     this.options = options;
@@ -11840,7 +11973,7 @@ var AssistantsInstaller = class {
     return Promise.all(
       ASSISTANT_IDS.map(async (id) => {
         const assistant = ASSISTANTS[id];
-        const skillPath = join4(assistant.skillDir(scope, this.options.places), "SKILL.md");
+        const skillPath = join5(assistant.skillDir(scope, this.options.places), "SKILL.md");
         const entry = manifest.find((e) => e.skillFile === skillPath);
         return {
           assistant: id,
@@ -11859,7 +11992,7 @@ var AssistantsInstaller = class {
     const manifest = await this.readManifest();
     for (const id of ids) {
       const assistant = ASSISTANTS[id];
-      const skillPath = join4(assistant.skillDir(scope, this.options.places), "SKILL.md");
+      const skillPath = join5(assistant.skillDir(scope, this.options.places), "SKILL.md");
       const content = this.skillContent;
       await writeAtomic(skillPath, content);
       const kept = manifest.filter((e) => e.skillFile !== skillPath);
@@ -11884,9 +12017,9 @@ var AssistantsInstaller = class {
     for (const id of ids) {
       const assistant = ASSISTANTS[id];
       const dir = assistant.skillDir(scope, this.options.places);
-      const skillPath = join4(dir, "SKILL.md");
+      const skillPath = join5(dir, "SKILL.md");
       await rm2(dir, { recursive: true, force: true });
-      await rmdir(dirname2(dir)).then(() => rmdir(dirname2(dirname2(dir)))).catch(() => {
+      await rmdir(dirname3(dir)).then(() => rmdir(dirname3(dirname3(dir)))).catch(() => {
       });
       manifest = manifest.filter((e) => e.skillFile !== skillPath);
       const outcome = await this.removeMcp(assistant.mcp(scope, this.options.places));
@@ -12040,7 +12173,7 @@ args = [${MCP_ARGS.map((a2) => `"${a2}"`).join(", ")}]
   }
   // ───────────── manifest ─────────────
   get manifestPath() {
-    return join4(this.options.configDir, "assistants.json");
+    return join5(this.options.configDir, "assistants.json");
   }
   async readManifest() {
     const text4 = await readText(this.manifestPath);
@@ -12271,9 +12404,16 @@ async function consoleCommand(app, args) {
 }
 
 // src/commands/each.ts
+var MAX_PATTERN = 200;
 function matcher(selector) {
   const regex = /^\/(.+)\/([a-z]*)$/.exec(selector);
   if (regex) {
+    if (selector.length > MAX_PATTERN) {
+      throw new CloudhopError(
+        "INVALID_NAME",
+        `That regular expression is too long (max ${MAX_PATTERN}).`
+      );
+    }
     try {
       const re = new RegExp(regex[1], regex[2]);
       return (name) => re.test(name);
@@ -12371,56 +12511,831 @@ ${listing}
     ))
       return 130;
   }
-  if (risky.length > 0 && process.env.CLOUDHOP_CONFIRM_PROD !== "1") {
-    if (!tty) {
+  if (risky.length > 0 && process.env.CLOUDHOP_CONFIRM_PROD !== "1") {
+    if (!tty) {
+      throw new CloudhopError(
+        "PROD_CONFIRMATION_REQUIRED",
+        `This may change resources in production: ${risky.join(", ")}.`,
+        "Run it in a terminal to confirm, or set CLOUDHOP_CONFIRM_PROD=1 once a person has approved it."
+      );
+    }
+    dist_exports.log.warn(
+      `${paint("red", bold("PRODUCTION"))} ${risky.join(", ")}: this may change resources.`
+    );
+    if (!answer(await dist_exports.confirm({ message: "Also run it in production?", initialValue: false })))
+      return 130;
+  }
+  for (const source of new Set(selected.map((a2) => a2.source))) {
+    await app.ensureSession(source, { interactive: tty });
+  }
+  const parallel = Math.max(1, Math.min(16, Number(flags.parallel) || 4));
+  const outcomes = await mapLimit(selected, parallel, async (a2) => {
+    try {
+      const r2 = await app.captureAsAlias(a2.name, cliArgs);
+      const outcome = { alias: a2.name, exitCode: r2.exitCode, stdout: r2.stdout, stderr: r2.stderr };
+      if (!flags.json) printOutcome(outcome, width);
+      return outcome;
+    } catch (error) {
+      const outcome = { alias: a2.name, exitCode: 1, stdout: "", stderr: error.message };
+      if (!flags.json) printOutcome(outcome, width);
+      return outcome;
+    }
+  });
+  const failed = outcomes.filter((o2) => o2.exitCode !== 0);
+  if (flags.json) {
+    console.log(JSON.stringify({ version: 1, command: cliArgs, results: outcomes }, null, 2));
+  } else {
+    const summary = `${outcomes.length - failed.length} ok${failed.length ? `, ${failed.length} failed: ${failed.map((f2) => f2.alias).join(", ")}` : ""}`;
+    process.stderr.write(`${failed.length ? paint("red", summary) : paint("green", summary)}
+`);
+  }
+  return failed.length ? 1 : 0;
+}
+function printOutcome({ alias, exitCode, stdout: stdout2, stderr }, width) {
+  const tag = paint(exitCode === 0 ? "sky" : "red", `[${alias}]`.padEnd(width + 2));
+  for (const line of stdout2.replace(/\n$/, "").split("\n"))
+    if (line) process.stdout.write(`${tag} ${line}
+`);
+  for (const line of stderr.replace(/\n$/, "").split("\n"))
+    if (line) process.stderr.write(`${tag} ${paint("dim", line)}
+`);
+  if (exitCode !== 0) process.stderr.write(`${tag} ${paint("red", `exit ${exitCode}`)}
+`);
+}
+
+// src/commands/use.ts
+import { spawnSync } from "child_process";
+import { writeFile as writeFile5 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname5, join as join7, resolve as resolve2 } from "path";
+
+// src/commands/shell.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { appendFile, mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join6 } from "path";
+
+// src/commands/starship.ts
+var BEGIN = "# >>> cloudhop >>> (added by `cloudhop shell`; remove this block and the ${env_var.cloudhop_*} segments in `format` to undo)";
+var END = "# <<< cloudhop <<<";
+var SKY = "#3bb8f5";
+var ON_SKY = "#0b1124";
+var RED = "#be123c";
+var STARSHIP_SEGMENTS = PROVIDER_IDS.map(
+  (p3) => `\${env_var.cloudhop_${p3}}\${env_var.cloudhop_${p3}_prod}`
+).join("");
+function starshipModules(powerline) {
+  const segment = (provider, prod) => {
+    if (!powerline) {
+      return prod ? `[${provider} $env_value PROD ](bold #fb7185)` : `[${provider} $env_value ](bold ${SKY})`;
+    }
+    const { glyph, color } = powerline;
+    const bg = prod ? RED : SKY;
+    const fg = prod ? "#ffffff" : ON_SKY;
+    return `[${glyph}](fg:${color} bg:${bg})[ ${provider} $env_value${prod ? " PROD" : ""} ](bold fg:${fg} bg:${bg})[${glyph}](fg:${bg} bg:${color})`;
+  };
+  return PROVIDER_IDS.map((p3) => {
+    const variable = `CLOUDHOP_${p3.toUpperCase()}`;
+    return `[env_var.cloudhop_${p3}]
+variable = '${variable}_SEGMENT'
+format = '${segment(p3, false)}'
+
+[env_var.cloudhop_${p3}_prod]
+variable = '${variable}_PROD_SEGMENT'
+format = '${segment(p3, true)}'`;
+  }).join("\n\n");
+}
+var hasCloudhopStarship = (text4) => text4.includes("[env_var.cloudhop_aws]");
+var CLOSING_GROUP = /\[\s*([-])\s*\]\(\s*fg:\s*(#[0-9a-fA-F]{3,8}|[a-z_]+)\s*\)/g;
+function addToStarshipConfig(text4) {
+  if (hasCloudhopStarship(text4)) return text4;
+  let result = text4;
+  let powerline;
+  const format = findTopLevelFormat(result);
+  if (format && !/\$all\b|\$\{?env_var\}?(?![._])/.test(format.content)) {
+    const { content, multiline: multiline2 } = format;
+    const continuation = multiline2 ? "\\\n" : "";
+    const closing = [...content.matchAll(CLOSING_GROUP)].at(-1);
+    const lineBreak = [content.lastIndexOf("$line_break"), content.lastIndexOf("$character")].find(
+      (i2) => i2 >= 0
+    );
+    let updated;
+    if (closing?.index !== void 0 && (lineBreak === void 0 || closing.index < lineBreak)) {
+      powerline = { glyph: closing[1], color: closing[2] };
+      updated = `${content.slice(0, closing.index)}${STARSHIP_SEGMENTS}${continuation}${content.slice(closing.index)}`;
+    } else if (lineBreak !== void 0) {
+      updated = `${content.slice(0, lineBreak)}${STARSHIP_SEGMENTS}${continuation}${content.slice(lineBreak)}`;
+    } else {
+      const body = content.trimEnd();
+      const tail = content.slice(body.length);
+      const joiner = multiline2 && body.endsWith("\\") ? "\n" : "";
+      updated = `${body}${joiner}${STARSHIP_SEGMENTS}${multiline2 ? "\\" : ""}${tail}`;
+    }
+    result = result.slice(0, format.start) + updated + result.slice(format.end);
+  }
+  const separator = result.length === 0 || result.endsWith("\n") ? "" : "\n";
+  return `${result}${separator}
+${BEGIN}
+${starshipModules(powerline)}
+${END}
+`;
+}
+function findTopLevelFormat(text4) {
+  const firstTable = text4.search(/^[ \t]*\[/m);
+  const head = firstTable === -1 ? text4 : text4.slice(0, firstTable);
+  const match = /^format\s*=\s*("""|'''|"|')/m.exec(head);
+  if (!match) return void 0;
+  const quote2 = match[1];
+  const start = match.index + match[0].length;
+  const end = text4.indexOf(quote2, start);
+  if (end === -1) return void 0;
+  return { start, end, content: text4.slice(start, end), multiline: quote2.length === 3 };
+}
+
+// src/commands/shell.ts
+var SHELLS = ["zsh", "bash", "fish", "pwsh"];
+var ALIAS_COMMANDS = "use status console region mv prod rm exec";
+var SOURCE_COMMANDS = "alias login sync ls";
+var aliasVar = (provider) => `CLOUDHOP_${provider.toUpperCase()}_ALIAS`;
+var prodVar = (provider) => `CLOUDHOP_${provider.toUpperCase()}_PROD`;
+function posixScript(shell, clis) {
+  const wrappers = clis.map(
+    ({ command, provider }) => `${command}() {
+  case " $* " in *" --profile"*) command ${command} "$@"; return $?;; esac
+  if [ -n "$${aliasVar(provider)}" ] && [ "$CLOUDHOP_WRAP" != 0 ]; then
+    command cloudhop "$${aliasVar(provider)}" "$@"
+  else
+    command ${command} "$@"
+  fi
+}`
+  ).join("\n");
+  const prompt = PROVIDER_IDS.map(
+    (p3) => `  [ -n "$${aliasVar(p3)}" ] && out="$out\${out:+ }${p3}:$${aliasVar(p3)}\${${prodVar(p3)}:+ PROD}"`
+  ).join("\n");
+  const hook = shell === "zsh" ? `autoload -Uz add-zsh-hook && add-zsh-hook chpwd _cloudhop_cd` : `case ";$PROMPT_COMMAND;" in *";_cloudhop_cd;"*) ;; *) PROMPT_COMMAND="_cloudhop_cd;_cloudhop_show_prompt\${PROMPT_COMMAND:+;$PROMPT_COMMAND}";; esac`;
+  const promptHook = shell === "zsh" ? `_cloudhop_show_prompt() {
+  [ "$CLOUDHOP_PROMPT" = 0 ] && return 0
+  case "$PROMPT$RPROMPT" in *starship*|*oh-my-posh*|*_cloudhop_rprompt*) return 0 ;; esac
+  setopt prompt_subst
+  RPROMPT='$(_cloudhop_rprompt)'"\${RPROMPT:+ $RPROMPT}"
+}
+# Sky for the alias, rose for production, like the CLI.
+_cloudhop_rprompt() {
+  local p; p="$(cloudhop_prompt)"; [ -n "$p" ] || return 0
+  case "$p" in *PROD*) printf '%%F{204}%s%%f' "$p" ;; *) printf '%%F{75}%s%%f' "$p" ;; esac
+}
+add-zsh-hook precmd _cloudhop_show_prompt` : `# \\001 and \\002 tell readline the colors take no room, so long lines still wrap right.
+_cloudhop_ps1() {
+  local p c=75; p="$(cloudhop_prompt)"; [ -n "$p" ] || return 0
+  case "$p" in *PROD*) c=204 ;; esac
+  printf '\\001\\033[38;5;%sm\\002[%s]\\001\\033[0m\\002 ' "$c" "$p"
+}
+_cloudhop_show_prompt() {
+  [ "$CLOUDHOP_PROMPT" = 0 ] && return 0
+  case "$PS1" in *starship*|*oh-my-posh*|*_cloudhop_ps1*) return 0 ;; esac
+  PS1='$(_cloudhop_ps1)'"$PS1"
+}`;
+  const completion = shell === "zsh" ? `_cloudhop_words() { command cloudhop __complete "$1" 2>/dev/null }
+_hop() { (( CURRENT == 2 )) && { local -a a; a=(\${(f)"$(_cloudhop_words aliases)"}); compadd -a a; } }
+_cloudhop() {
+  local -a w
+  if (( CURRENT == 2 )); then w=(\${(f)"$(_cloudhop_words commands)"}); compadd -a w; return; fi
+  (( CURRENT == 3 )) || return
+  case " ${ALIAS_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words aliases)"});; esac
+  case " ${SOURCE_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words sources)"});; esac
+  compadd -a w
+}
+(( $+functions[compdef] )) && { compdef _hop hop; compdef _cloudhop cloudhop; }` : `_cloudhop_complete() {
+  local cur=\${COMP_WORDS[COMP_CWORD]} cmd=\${COMP_WORDS[0]##*/} kind=""
+  if [ "$cmd" = hop ]; then [ "$COMP_CWORD" -eq 1 ] && kind=aliases
+  elif [ "$COMP_CWORD" -eq 1 ]; then kind=commands
+  elif [ "$COMP_CWORD" -eq 2 ]; then
+    case " ${ALIAS_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=aliases;; esac
+    case " ${SOURCE_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=sources;; esac
+  fi
+  [ -n "$kind" ] && COMPREPLY=($(compgen -W "$(command cloudhop __complete $kind 2>/dev/null)" -- "$cur"))
+}
+complete -o default -F _cloudhop_complete hop cloudhop`;
+  return `# cloudhop shell integration (${shell}). Load it${shell === "zsh" ? " after compinit" : ""}:  ${LOAD_LINE[shell]}
+# - \`cloudhop use <alias>\` switches this shell; \`cloudhop use --off\` goes back.
+# - A folder with a trusted .cloudhoprc switches on cd (off: CLOUDHOP_AUTO_USE=0).
+# - With an alias in use, \`${clis.map((c3) => c3.command).join("`, `") || "aws"}\` signs in when needed and asks before changing production (off: CLOUDHOP_WRAP=0).
+# - Your prompt shows the alias in use (off: CLOUDHOP_PROMPT=0).
+cloudhop() {
+  case "$1" in
+    use)
+      local out; out="$(command cloudhop use --emit ${shell} "\${@:2}")" || return $?
+      eval "$out"; _cloudhop_rc_seen=\${CLOUDHOP_RC:-$_cloudhop_rc_seen} ;;
+    allow|deny) command cloudhop "$@" || return $?; _cloudhop_rc_seen=-; _cloudhop_cd ;;
+    *) command cloudhop "$@" ;;
+  esac
+}
+_cloudhop_cd() {
+  [ "$CLOUDHOP_AUTO_USE" = 0 ] && return
+  [ "$PWD" = "$_cloudhop_pwd" ] && [ "$_cloudhop_rc_seen" != - ] && return
+  _cloudhop_pwd=$PWD
+  local dir=$PWD rc=
+  while :; do
+    if [ -f "$dir/.cloudhoprc" ]; then rc="$dir/.cloudhoprc"; break; fi
+    { [ -z "$dir" ] || [ "$dir" = / ]; } && break
+    dir="\${dir%/*}"
+  done
+  [ "$rc" = "$_cloudhop_rc_seen" ] && return
+  _cloudhop_rc_seen=$rc
+  local out
+  if [ -n "$rc" ]; then out="$(command cloudhop use --emit ${shell} --from "$rc")"
+  elif [ -n "$CLOUDHOP_RC" ]; then out="$(command cloudhop use --emit ${shell} --leave)"
+  else return 0; fi
+  eval "$out"
+}
+${hook}
+_cloudhop_cd
+${wrappers}
+${completion}
+# The aliases in use, e.g. "aws:acme-dev". Shown in your prompt by itself
+# (off: CLOUDHOP_PROMPT=0); Starship gets its own segments from \`cloudhop shell\`.
+cloudhop_prompt() {
+  local out=
+${prompt}
+  [ -n "$out" ] && printf '%s' "$out"
+}
+${promptHook}
+`;
+}
+function fishScript(clis) {
+  const wrappers = clis.map(
+    ({ command, provider }) => `function ${command} --wraps ${command}
+  if test -n "$${aliasVar(provider)}" -a "$CLOUDHOP_WRAP" != 0; and not string match -q -- '--profile*' $argv
+    command cloudhop $${aliasVar(provider)} $argv
+  else
+    command ${command} $argv
+  end
+end`
+  ).join("\n");
+  const prompt = PROVIDER_IDS.map(
+    (p3) => `  test -n "$${aliasVar(p3)}"; and set out $out "${p3}:$${aliasVar(p3)}"(test -n "$${prodVar(p3)}"; and echo ' PROD')`
+  ).join("\n");
+  return `# cloudhop shell integration (fish):  ${LOAD_LINE.fish}
+# - \`cloudhop use <alias>\` switches this shell; \`cloudhop use --off\` goes back.
+# - A folder with a trusted .cloudhoprc switches on cd (off: set -gx CLOUDHOP_AUTO_USE 0).
+# - With an alias in use, the cloud CLI signs in when needed and asks before changing production (off: set -gx CLOUDHOP_WRAP 0).
+function cloudhop
+  switch "$argv[1]"
+    case use
+      set -l out (command cloudhop use --emit fish $argv[2..-1]); or return $status
+      printf '%s\\n' $out | source
+      set -q CLOUDHOP_RC; and set -g _cloudhop_rc_seen $CLOUDHOP_RC
+    case allow deny
+      command cloudhop $argv; or return $status
+      set -g _cloudhop_rc_seen -
+      _cloudhop_cd
+    case '*'
+      command cloudhop $argv
+  end
+end
+function _cloudhop_cd --on-variable PWD
+  test "$CLOUDHOP_AUTO_USE" = 0; and return
+  set -l dir $PWD
+  set -l rc ''
+  while true
+    if test -f "$dir/.cloudhoprc"; set rc "$dir/.cloudhoprc"; break; end
+    if test -z "$dir" -o "$dir" = /; break; end
+    set dir (string replace -r '/[^/]*$' '' -- $dir)
+  end
+  test "$rc" = "$_cloudhop_rc_seen"; and return
+  set -g _cloudhop_rc_seen $rc
+  if test -n "$rc"
+    command cloudhop use --emit fish --from $rc | source
+  else if test -n "$CLOUDHOP_RC"
+    command cloudhop use --emit fish --leave | source
+  end
+end
+_cloudhop_cd
+${wrappers}
+complete -c hop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete aliases 2>/dev/null)'
+complete -c cloudhop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete commands 2>/dev/null)'
+complete -c cloudhop -f -n '__fish_seen_subcommand_from ${ALIAS_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete aliases 2>/dev/null)'
+complete -c cloudhop -f -n '__fish_seen_subcommand_from ${SOURCE_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete sources 2>/dev/null)'
+# The aliases in use, e.g. "aws:acme-dev", at the right of the prompt unless
+# something else (like Starship) draws it (off: set -gx CLOUDHOP_PROMPT 0).
+function cloudhop_prompt
+  set -l out
+${prompt}
+  test -n "$out"; and printf '%s' (string join ' ' $out)
+end
+if not functions -q fish_right_prompt
+  function fish_right_prompt
+    test "$CLOUDHOP_PROMPT" = 0; and return
+    set -l label (cloudhop_prompt)
+    test -n "$label"; or return
+    if string match -q '*PROD*' -- $label; set_color fb7185; else; set_color 3bb8f5; end
+    printf '%s' $label; set_color normal
+  end
+end
+`;
+}
+function pwshScript(clis) {
+  const wrappers = clis.map(
+    ({
+      command,
+      provider
+    }) => `$script:CloudhopCli_${provider} = (Get-Command ${command} -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1).Source
+function ${command} {
+  if ($env:${aliasVar(provider)} -and $env:CLOUDHOP_WRAP -ne '0' -and -not ($args -like '--profile*')) { & $script:CloudhopExe $env:${aliasVar(provider)} @args }
+  elseif ($script:CloudhopCli_${provider}) { & $script:CloudhopCli_${provider} @args }
+  else { Write-Error '${command}: command not found' }
+}`
+  ).join("\n");
+  const prompt = PROVIDER_IDS.map(
+    (p3) => `  if ($env:${aliasVar(p3)}) { $out += "${p3}:$env:${aliasVar(p3)}$(if ($env:${prodVar(p3)}) { ' PROD' })" }`
+  ).join("\n");
+  return `# cloudhop shell integration (PowerShell):  ${LOAD_LINE.pwsh}
+# - \`cloudhop use <alias>\` switches this shell; \`cloudhop use --off\` goes back.
+# - A folder with a trusted .cloudhoprc switches on cd (off: $env:CLOUDHOP_AUTO_USE = '0').
+# - With an alias in use, the cloud CLI signs in when needed and asks before changing production (off: $env:CLOUDHOP_WRAP = '0').
+$script:CloudhopExe = (Get-Command cloudhop -CommandType Application, ExternalScript | Select-Object -First 1).Source
+function cloudhop {
+  if ($args.Count -gt 0 -and $args[0] -eq 'use') {
+    $out = & $script:CloudhopExe use --emit pwsh @($args | Select-Object -Skip 1)
+    if ($LASTEXITCODE -eq 0) { $out | Out-String | Invoke-Expression; if ($env:CLOUDHOP_RC) { $script:CloudhopRcSeen = $env:CLOUDHOP_RC } }
+  } elseif ($args.Count -gt 0 -and $args[0] -in 'allow', 'deny') {
+    & $script:CloudhopExe @args
+    if ($LASTEXITCODE -eq 0) { $script:CloudhopRcSeen = '-'; $script:CloudhopPwd = ''; _CloudhopCd }
+  } else { & $script:CloudhopExe @args }
+}
+function _CloudhopCd {
+  if ($env:CLOUDHOP_AUTO_USE -eq '0' -or $PWD.ProviderPath -eq $script:CloudhopPwd) { return }
+  $script:CloudhopPwd = $PWD.ProviderPath
+  $dir = $PWD.ProviderPath; $rc = ''
+  while ($dir) {
+    $file = Join-Path $dir '.cloudhoprc'
+    if (Test-Path -LiteralPath $file -PathType Leaf) { $rc = $file; break }
+    $dir = Split-Path -Parent $dir
+  }
+  if ($rc -eq $script:CloudhopRcSeen) { return }
+  $script:CloudhopRcSeen = $rc
+  $out = if ($rc) { & $script:CloudhopExe use --emit pwsh --from $rc } elseif ($env:CLOUDHOP_RC) { & $script:CloudhopExe use --emit pwsh --leave }
+  if ($out) { $out | Out-String | Invoke-Expression }
+}
+$script:CloudhopPrompt = $function:prompt
+function prompt {
+  _CloudhopCd
+  $out = & $script:CloudhopPrompt
+  # The alias in use before your prompt, unless Starship draws it (off: $env:CLOUDHOP_PROMPT = '0').
+  if ($env:CLOUDHOP_PROMPT -ne '0' -and "$script:CloudhopPrompt" -notmatch 'starship|oh-my-posh') {
+    $label = cloudhop_prompt
+    if ($label) {
+      if (-not $Host.UI.SupportsVirtualTerminal) { return "[$label] $out" }
+      $color = if ($label -match 'PROD') { 204 } else { 75 }
+      return "$([char]27)[38;5;$($color)m[$label]$([char]27)[0m $out"
+    }
+  }
+  $out
+}
+${wrappers}
+Register-ArgumentCompleter -Native -CommandName hop, cloudhop -ScriptBlock {
+  param($word, $ast)
+  $n = $ast.CommandElements.Count - [int]($word -eq '')
+  $kind = if ($ast.CommandElements[0].Value -match 'hop$' -and $ast.CommandElements[0].Value -notmatch 'cloudhop') { if ($n -le 1) { 'aliases' } }
+          elseif ($n -le 1) { 'commands' }
+          elseif ($n -eq 2 -and ' ${ALIAS_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'aliases' }
+          elseif ($n -eq 2 -and ' ${SOURCE_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'sources' }
+  if ($kind) { & $script:CloudhopExe __complete $kind | Where-Object { $_ -like "$word*" } }
+}
+function cloudhop_prompt {
+  $out = @()
+${prompt}
+  $out -join ' '
+}
+`;
+}
+function shellScript(shell, clis) {
+  if (shell === "fish") return fishScript(clis);
+  if (shell === "pwsh") return pwshScript(clis);
+  return posixScript(shell, clis);
+}
+function starshipSnippet() {
+  return `# cloudhop: the alias each cloud uses in this shell (\`cloudhop use\`, .cloudhoprc).
+# \`cloudhop shell\` adds this for you. By hand: append it to starship.toml and, if
+# your config has a top-level \`format\`, add this where you want the segments:
+#   ${STARSHIP_SEGMENTS}
+
+${starshipModules()}
+`;
+}
+var quote = (shell, value) => shell === "pwsh" ? `'${value.replace(/'/g, "''")}'` : `'${value.replace(/'/g, "'\\''")}'`;
+function shellExports(shell, env) {
+  return Object.entries(env).map(([key2, value]) => {
+    if (value === void 0) {
+      if (shell === "fish") return `set -e ${key2}`;
+      if (shell === "pwsh") return `Remove-Item Env:${key2} -ErrorAction SilentlyContinue`;
+      return `unset ${key2}`;
+    }
+    if (shell === "fish") return `set -gx ${key2} ${quote(shell, value)}`;
+    if (shell === "pwsh") return `$env:${key2} = ${quote(shell, value)}`;
+    return `export ${key2}=${quote(shell, value)}`;
+  }).join("\n");
+}
+function detectShell() {
+  if (process.platform === "win32") return "pwsh";
+  const name = (process.env.SHELL ?? "").split("/").pop();
+  return SHELLS.includes(name) ? name : "bash";
+}
+function parseShell(value) {
+  if (!value) return detectShell();
+  const shell = value === "powershell" ? "pwsh" : value;
+  if (!SHELLS.includes(shell)) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `Unknown shell "${value}".`,
+      `Use one of: ${SHELLS.join(", ")}.`
+    );
+  }
+  return shell;
+}
+var RC_FILES = {
+  zsh: (home) => join6(home, ".zshrc"),
+  bash: (home) => join6(home, ".bashrc"),
+  fish: (home) => join6(home, ".config", "fish", "config.fish"),
+  pwsh: (home) => process.platform === "win32" ? join6(home, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1") : join6(home, ".config", "powershell", "Microsoft.PowerShell_profile.ps1")
+};
+var LOAD_LINE = {
+  zsh: 'eval "$(cloudhop shell zsh)"',
+  bash: 'eval "$(cloudhop shell bash)"',
+  fish: "cloudhop shell fish | source",
+  pwsh: "cloudhop shell pwsh | Out-String | Invoke-Expression"
+};
+function shellIntegrationInstalled() {
+  const shell = detectShell();
+  const read = (file) => {
+    try {
+      return readFileSync2(file, "utf8");
+    } catch {
+      return void 0;
+    }
+  };
+  const rc = read(RC_FILES[shell](homedir3())) ?? "";
+  if (!rc.includes(LOAD_LINE[shell])) return false;
+  const starship = read(starshipFile());
+  if (starship === void 0) return !rc.includes("starship init");
+  return hasCloudhopStarship(starship);
+}
+var starshipFile = () => process.env.STARSHIP_CONFIG || join6(homedir3(), ".config", "starship.toml");
+async function shellCommand(args, clis) {
+  const { positional, flags } = parseArgs(args);
+  if (positional[0] === "starship") {
+    process.stdout.write(starshipSnippet());
+    return;
+  }
+  const setUp = positional[0] === "install" || !positional[0] && process.stdout.isTTY;
+  if (!setUp) {
+    process.stdout.write(shellScript(parseShell(positional[0]), clis));
+    return;
+  }
+  const shell = parseShell(positional[1]);
+  const file = RC_FILES[shell](homedir3());
+  const line = LOAD_LINE[shell];
+  const current = await readIfExists(file) ?? "";
+  const starship = await starshipConfig(current);
+  const needsLine = !current.includes(line);
+  const needsStarship = starship !== void 0 && !hasCloudhopStarship(starship.text);
+  const rcName = file.replace(homedir3(), "~");
+  if (!needsLine && !needsStarship) {
+    console.log(`Already set up in ${rcName}${starship ? " and your Starship prompt" : ""}.`);
+    return;
+  }
+  const changes = [
+    needsLine && `add one line to ${rcName}: \`cloudhop use\`, .cloudhoprc folders, the alias in your prompt`,
+    needsStarship && `show the alias in your Starship prompt (${starship.file.replace(homedir3(), "~")}, keeping a backup)`
+  ].filter(Boolean);
+  if (!flags.yes) {
+    if (!interactive())
+      throw new CloudhopError(
+        "NOT_INTERACTIVE",
+        `Rerun with --yes to ${changes.join(" and ")}.${needsLine ? `
+Or add this line to ${file} yourself:
+  ${line}` : ""}`
+      );
+    console.log(`cloudhop will:
+${changes.map((c3) => `  - ${c3}`).join("\n")}`);
+    const ok = answer(await dist_exports.confirm({ message: "Set up your terminal?", initialValue: true }));
+    if (!ok) return;
+  }
+  if (needsLine) {
+    await mkdir4(dirname4(file), { recursive: true });
+    const note2 = shell === "zsh" ? "  # after compinit" : "";
+    await appendFile(
+      file,
+      `${current && !current.endsWith("\n") ? "\n" : ""}
+# cloudhop: \`cloudhop use\`, .cloudhoprc folders, tab completion, prompt${note2}
+${line}
+`
+    );
+    console.log(`${paint("green", "\u2714")} Added to ${rcName}.`);
+  }
+  if (needsStarship) {
+    await mkdir4(dirname4(starship.file), { recursive: true });
+    if (starship.exists) await writeFile4(`${starship.file}.cloudhop-backup`, starship.text);
+    await writeFile4(starship.file, addToStarshipConfig(starship.text));
+    console.log(
+      `${paint("green", "\u2714")} Your Starship prompt shows the alias in use (backup: ${starship.file.replace(homedir3(), "~")}.cloudhop-backup).`
+    );
+  }
+  console.log(
+    `Open a new terminal (or run ${paint("sky", shell === "pwsh" ? ". $PROFILE" : `exec ${shell}`)}), then:`
+  );
+  console.log(`  ${paint("sky", "cloudhop use <alias>")}   switch this terminal to an account`);
+  console.log(`  ${paint("sky", "aws s3 ls")}              plain aws commands, as that alias`);
+}
+async function starshipConfig(rc) {
+  const file = starshipFile();
+  const text4 = await readIfExists(file);
+  if (text4 === void 0 && !rc.includes("starship init") && !process.env.STARSHIP_SHELL) {
+    return void 0;
+  }
+  return { file, text: text4 ?? "", exists: text4 !== void 0 };
+}
+async function readIfExists(file) {
+  try {
+    return await readFile4(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+async function completeCommand(app, kind) {
+  if (kind === "commands") {
+    console.log(
+      [...RESERVED_NAMES, "each", "shell", "use"].filter((c3, i2, a2) => a2.indexOf(c3) === i2).sort().join("\n")
+    );
+    return;
+  }
+  const config = await app.config();
+  const words = kind === "sources" ? config.sources.map((s) => s.id) : config.aliases.map((a2) => a2.name);
+  if (words.length) console.log(words.join("\n"));
+}
+
+// src/commands/use.ts
+var activeVars = (provider) => {
+  const prefix = `CLOUDHOP_${provider.toUpperCase()}`;
+  return {
+    alias: `${prefix}_ALIAS`,
+    prod: `${prefix}_PROD`,
+    prompt: `${prefix}_PROMPT`,
+    // One or the other, so prompt themes can style production apart (Starship's env_var).
+    segment: `${prefix}_SEGMENT`,
+    prodSegment: `${prefix}_PROD_SEGMENT`
+  };
+};
+function activeAliases(env = process.env) {
+  return Object.fromEntries(
+    PROVIDER_IDS.filter((p3) => env[activeVars(p3).alias]).map((p3) => [p3, env[activeVars(p3).alias]])
+  );
+}
+async function shellContext(trusted, cwd = process.cwd()) {
+  const file = findFolderFile(cwd);
+  const content = file ? await readFolderFile(file) : void 0;
+  let folder;
+  if (file && content !== void 0) {
+    try {
+      folder = {
+        file,
+        aliases: parseFolderFile(content),
+        trusted: trusted.isTrusted(file, content)
+      };
+    } catch {
+    }
+  }
+  return { inUse: activeAliases(), ...folder ? { folder } : {} };
+}
+var tilde2 = (path2) => path2.replace(homedir4(), "~");
+var folderProviders = () => (process.env.CLOUDHOP_RC_PROVIDERS ?? "").split(",").filter((p3) => PROVIDER_IDS.includes(p3));
+async function activate(app, alias, login) {
+  const shellEnv = await app.shellEnv(alias, { login });
+  const vars = activeVars(shellEnv.provider);
+  const label = shellEnv.region ? `${alias} (${shellEnv.region})` : alias;
+  const env = Object.fromEntries(shellEnv.clear.map((name) => [name, void 0]));
+  Object.assign(env, shellEnv.env, {
+    [vars.alias]: alias,
+    [vars.prod]: shellEnv.prod ? "1" : void 0,
+    [vars.prompt]: label,
+    [vars.segment]: shellEnv.prod ? void 0 : label,
+    [vars.prodSegment]: shellEnv.prod ? label : void 0,
+    // The cloud-neutral pair from cloudhop 1.2, kept for prompts already using it.
+    CLOUDHOP_ALIAS: alias,
+    CLOUDHOP_PROD: shellEnv.prod ? "1" : void 0
+  });
+  const where = [shellEnv.label, shellEnv.region ?? "no region"].filter(Boolean).join(", ");
+  return { provider: shellEnv.provider, env, summary: `${alias} (${where})`, prod: shellEnv.prod };
+}
+function deactivate(app, provider) {
+  const vars = activeVars(provider);
+  const env = Object.fromEntries(app.shellVars(provider).map((n3) => [n3, void 0]));
+  for (const name of Object.values(vars)) env[name] = void 0;
+  if (process.env.CLOUDHOP_ALIAS && process.env.CLOUDHOP_ALIAS === process.env[vars.alias]) {
+    Object.assign(env, { CLOUDHOP_ALIAS: void 0, CLOUDHOP_PROD: void 0 });
+  }
+  return env;
+}
+function warnProduction(activation) {
+  if (!activation.prod) return;
+  const alias = activation.summary.split(" ")[0];
+  notify(
+    paint(
+      "red",
+      `${alias} is production: with the shell integration, \`aws\` asks before changes. Other tools (terraform, scripts) don't.`
+    )
+  );
+}
+async function useCommand(app, trusted, args) {
+  const { positional, flags } = parseArgs(args);
+  const shell = flags.emit ? parseShell(flags.emit) : void 0;
+  if (flags.from !== void 0 || flags.leave) {
+    if (!shell) throw new CloudhopError("INVALID_NAME", "--from and --leave need --emit <shell>.");
+    const env2 = await folderEnv(app, trusted, flags.leave ? void 0 : flags.from);
+    process.stdout.write(`${shellExports(shell, env2)}
+`);
+    return 0;
+  }
+  if (flags.off) {
+    if (!shell) throw noIntegration("Nothing to turn off: this shell has no cloudhop integration.");
+    const which = positional[0];
+    if (which && !PROVIDER_IDS.includes(which)) {
       throw new CloudhopError(
-        "PROD_CONFIRMATION_REQUIRED",
-        `This may change resources in production: ${risky.join(", ")}.`,
-        "Run it in a terminal to confirm, or set CLOUDHOP_CONFIRM_PROD=1 once a person has approved it."
+        "INVALID_NAME",
+        `Unknown cloud "${which}".`,
+        `Use one of: ${PROVIDER_IDS.join(", ")}, or nothing to turn them all off.`
       );
     }
-    dist_exports.log.warn(
-      `${paint("red", bold("PRODUCTION"))} ${risky.join(", ")}: this may change resources.`
+    const providers = which ? [which] : app.availableProviders().map((provider) => provider.id);
+    const env2 = {};
+    for (const provider of providers) Object.assign(env2, deactivate(app, provider));
+    const remaining = folderProviders().filter((p3) => !providers.includes(p3));
+    Object.assign(
+      env2,
+      folderMarks(remaining.length ? process.env.CLOUDHOP_RC : void 0, remaining)
     );
-    if (!answer(await dist_exports.confirm({ message: "Also run it in production?", initialValue: false })))
-      return 130;
+    process.stdout.write(`${shellExports(shell, env2)}
+`);
+    notify(which ? `No ${which} alias in this shell anymore.` : "No alias in this shell anymore.");
+    return 0;
   }
-  for (const source of new Set(selected.map((a2) => a2.source))) {
-    await app.ensureSession(source, { interactive: tty });
+  const alias = positional[0] ?? await pickAlias(app, "Use which alias in this shell?");
+  const activation = await activate(app, alias, true);
+  let folder;
+  if (flags.save) folder = await saveFolderFile(trusted, activation.provider, alias);
+  if (!shell) {
+    if (!interactive()) {
+      throw noIntegration("`cloudhop use` needs a terminal or the shell integration.");
+    }
+    return subshell(alias, activation);
   }
-  const parallel = Math.max(1, Math.min(16, Number(flags.parallel) || 4));
-  const outcomes = await mapLimit(selected, parallel, async (a2) => {
+  const fromFolder = folderProviders().filter((p3) => p3 !== activation.provider);
+  const env = { ...activation.env };
+  if (folder) Object.assign(env, folderMarks(folder, [...fromFolder, activation.provider]));
+  else
+    Object.assign(
+      env,
+      folderMarks(fromFolder.length ? process.env.CLOUDHOP_RC : void 0, fromFolder)
+    );
+  process.stdout.write(`${shellExports(shell, env)}
+`);
+  notify(`This shell now uses ${activation.summary}.`);
+  if (folder) notify(`Saved in ${tilde2(folder)}: this folder switches to ${alias} on cd.`);
+  warnProduction(activation);
+  return 0;
+}
+var folderMarks = (file, providers) => ({
+  CLOUDHOP_RC: providers.length && file ? file : void 0,
+  CLOUDHOP_RC_PROVIDERS: providers.length && file ? providers.join(",") : void 0
+});
+var noIntegration = (message) => new CloudhopError(
+  "NOT_INTERACTIVE",
+  message,
+  `Set it up once with \`cloudhop shell install\` (or add ${LOAD_LINE[detectShell()]} to your shell's startup file), then open a new terminal.`
+);
+async function folderEnv(app, trusted, file) {
+  const previous = folderProviders();
+  const activations = [];
+  const path2 = file ? resolve2(file) : void 0;
+  const content = path2 ? await readFolderFile(path2) : void 0;
+  if (path2 && content !== void 0) {
+    let aliases;
     try {
-      const r2 = await app.captureAsAlias(a2.name, cliArgs);
-      const outcome = { alias: a2.name, exitCode: r2.exitCode, stdout: r2.stdout, stderr: r2.stderr };
-      if (!flags.json) printOutcome(outcome, width);
-      return outcome;
+      aliases = parseFolderFile(content);
     } catch (error) {
-      const outcome = { alias: a2.name, exitCode: 1, stdout: "", stderr: error.message };
-      if (!flags.json) printOutcome(outcome, width);
-      return outcome;
+      notify(`${tilde2(path2)}: ${error.message}`);
+    }
+    if (aliases && !trusted.isTrusted(path2, content)) {
+      notify(
+        `${tilde2(path2)} wants this folder to use ${Object.values(aliases).join(", ")}. Run ${bold("cloudhop allow")} if you trust it.`
+      );
+    } else if (aliases) {
+      for (const alias of Object.values(aliases)) {
+        try {
+          activations.push(await activate(app, alias, false));
+        } catch (error) {
+          notify(`${tilde2(path2)}: ${error.message}`);
+        }
+      }
     }
-  });
-  const failed = outcomes.filter((o2) => o2.exitCode !== 0);
-  if (flags.json) {
-    console.log(JSON.stringify({ version: 1, command: cliArgs, results: outcomes }, null, 2));
-  } else {
-    const summary = `${outcomes.length - failed.length} ok${failed.length ? `, ${failed.length} failed: ${failed.map((f2) => f2.alias).join(", ")}` : ""}`;
-    process.stderr.write(`${failed.length ? paint("red", summary) : paint("green", summary)}
-`);
   }
-  return failed.length ? 1 : 0;
+  const applied = activations.map((a2) => a2.provider);
+  const env = {};
+  const left = previous.filter((p3) => !applied.includes(p3));
+  for (const provider of left) Object.assign(env, deactivate(app, provider));
+  for (const activation of activations) Object.assign(env, activation.env);
+  Object.assign(env, folderMarks(path2, applied));
+  if (activations.length) {
+    notify(`Using ${activations.map((a2) => a2.summary).join(" and ")}, from ${FOLDER_FILE}.`);
+    for (const activation of activations) warnProduction(activation);
+  } else if (left.length) {
+    const names = left.map((p3) => process.env[activeVars(p3).alias]).filter(Boolean);
+    notify(`Left the folder of ${names.join(", ")}: no alias in this shell.`);
+  }
+  return env;
 }
-function printOutcome({ alias, exitCode, stdout: stdout2, stderr }, width) {
-  const tag = paint(exitCode === 0 ? "sky" : "red", `[${alias}]`.padEnd(width + 2));
-  for (const line of stdout2.replace(/\n$/, "").split("\n"))
-    if (line) process.stdout.write(`${tag} ${line}
-`);
-  for (const line of stderr.replace(/\n$/, "").split("\n"))
-    if (line) process.stderr.write(`${tag} ${paint("dim", line)}
-`);
-  if (exitCode !== 0) process.stderr.write(`${tag} ${paint("red", `exit ${exitCode}`)}
-`);
+async function saveFolderFile(trusted, provider, alias) {
+  const file = join7(process.cwd(), FOLDER_FILE);
+  const content = await readFolderFile(file);
+  let aliases = {};
+  if (content !== void 0) {
+    aliases = parseFolderFile(content);
+    delete aliases.any;
+  }
+  aliases[provider] = alias;
+  const text4 = formatFolderFile(aliases);
+  await writeFile5(file, text4);
+  await trusted.trust(file, text4);
+  return file;
+}
+function subshell(alias, activation) {
+  const env = { ...process.env, CLOUDHOP_SUBSHELL: alias };
+  for (const [name, value] of Object.entries(activation.env)) {
+    if (value === void 0) delete env[name];
+    else env[name] = value;
+  }
+  const shell = process.platform === "win32" ? process.env.ComSpec ?? "cmd.exe" : process.env.SHELL ?? "/bin/sh";
+  if (/cmd(\.exe)?$/i.test(shell)) {
+    const label = `${activation.provider}:${alias}${activation.prod ? " PROD" : ""}`;
+    env.PROMPT = `[${label}] ${process.env.PROMPT ?? "$P$G"}`;
+  }
+  if (process.env.CLOUDHOP_SUBSHELL) {
+    notify(
+      `You are already in a cloudhop shell (${process.env.CLOUDHOP_SUBSHELL}): this one goes inside it.`
+    );
+  }
+  notify(`New shell using ${activation.summary}. Type ${bold("exit")} to go back.`);
+  notify(
+    paint(
+      "dim",
+      "Tip: `cloudhop shell install` makes `cloudhop use` switch this same terminal instead."
+    )
+  );
+  warnProduction(activation);
+  const result = spawnSync(shell, [], { stdio: "inherit", env });
+  notify(`Back from ${alias}.`);
+  return result.status ?? 0;
+}
+async function allowCommand(app, trusted, args, allow) {
+  const { positional } = parseArgs(args);
+  const given = positional[0];
+  const file = given ? given.endsWith(FOLDER_FILE) ? resolve2(given) : join7(resolve2(given), FOLDER_FILE) : findFolderFile(process.cwd());
+  if (!file) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `No ${FOLDER_FILE} in this folder or above it.`,
+      "Create one with `cloudhop use <alias> --save`."
+    );
+  }
+  if (!allow) {
+    const forgotten = await trusted.forget(file);
+    console.log(
+      forgotten ? `${paint("green", "\u2714")} ${tilde2(file)} is no longer trusted: its folder won't switch aliases.` : `${tilde2(file)} was not trusted.`
+    );
+    return;
+  }
+  const content = await readFolderFile(file);
+  if (content === void 0) throw new CloudhopError("INVALID_NAME", `Can't read ${file}.`);
+  const aliases = parseFolderFile(content);
+  const lines = [];
+  for (const alias of Object.values(aliases)) {
+    try {
+      const status = await app.aliasStatus(alias);
+      lines.push(
+        `  ${bold(alias)}  ${status.label ?? status.target}  ${status.region ?? ""}${status.prod ? `  ${paint("red", "PROD")}` : ""}`
+      );
+    } catch {
+      lines.push(
+        `  ${bold(alias)}  ${paint("yellow", "you don't have this alias: it will be skipped")}`
+      );
+    }
+  }
+  await trusted.trust(file, content);
+  console.log(
+    `${paint("green", "\u2714")} Trusted ${tilde2(file)}. In ${tilde2(dirname5(file))} this shell uses:`
+  );
+  console.log(lines.join("\n"));
 }
 
 // src/commands/manage.ts
@@ -12468,11 +13383,11 @@ var SESSION_LABEL = {
 };
 var JSON_VERSION = 1;
 var printJson = (value) => console.log(JSON.stringify({ version: JSON_VERSION, ...value }, null, 2));
-async function listCommand(app, args = []) {
+async function listCommand(app, args = [], context) {
   const { positional, flags } = parseArgs(args);
   const sourceId = positional[0];
   if (flags.json) {
-    const overview = await app.overview();
+    const overview = { ...await app.overview(), ...await context?.() };
     if (sourceId && !overview.sources.some((s) => s.id === sourceId)) {
       throw new CloudhopError("SOURCE_NOT_FOUND", `Source "${sourceId}" not found.`);
     }
@@ -12651,7 +13566,16 @@ async function statusCommand(app, args) {
     return;
   }
   const overview = await app.overview();
-  if (flags.json) return printJson({ sources: overview.sources });
+  const inUse = activeAliases();
+  if (flags.json) return printJson({ inUse, sources: overview.sources });
+  const using = Object.entries(inUse).map(([cloud, alias]) => {
+    const status = overview.aliases.find((a2) => a2.name === alias);
+    const region = status?.region ? ` (${status.region})` : "";
+    return `${cloud} ${bold(paint(status?.prod ? "red" : "sky", alias))}${region}${status?.prod ? ` ${paint("red", "PROD")}` : ""}`;
+  });
+  console.log(
+    using.length ? `This terminal uses ${using.join(", ")}.` : paint("dim", "This terminal uses no alias (`cloudhop use <alias>` to pick one).")
+  );
   if (overview.sources.length === 0) {
     console.log("Nothing here yet. Run `cloudhop setup` to get started.");
     return;
@@ -12793,6 +13717,23 @@ async function setupCommand(app, assistants) {
   const addNow = answer(await dist_exports.confirm({ message: "Add an account or SSO portal now?" }));
   if (addNow) await addCommand(app, { positional: [], flags: {} });
   else dist_exports.log.info("Run `cloudhop add` whenever you are ready.");
+  if (!shellIntegrationInstalled()) {
+    dist_exports.note(
+      [
+        "`hop <alias>`, `each` and `console` work as they are. To also switch a terminal",
+        "to an alias (`cloudhop use`, then plain `aws`), switch on `cd` into a folder with",
+        "a .cloudhoprc, see the alias in your prompt (Starship too) and complete aliases",
+        "with <Tab>, your shell loads one line from its startup file. A program can only",
+        "change your terminal this way."
+      ].join("\n"),
+      "Terminal"
+    );
+    const install = answer(
+      await dist_exports.confirm({ message: "Set up your terminal for cloudhop?", initialValue: true })
+    );
+    if (install) await shellCommand(["install", "--yes"], []);
+    else dist_exports.log.info("Later: `cloudhop shell install`. `cloudhop use` still works, in a new shell.");
+  }
   const detected = assistants.detect();
   if (detected.length > 0) {
     const names = detected.map((id) => ASSISTANTS[id].name).join(", ");
@@ -12830,268 +13771,37 @@ async function doctorCommand(app) {
   );
 }
 
-// src/commands/shell.ts
-import { existsSync as existsSync3 } from "fs";
-import { appendFile, mkdir as mkdir3, readFile as readFile3 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join5 } from "path";
-var SHELLS = ["zsh", "bash", "fish", "pwsh"];
-var ALIAS_COMMANDS = "use status console region mv prod rm exec";
-var SOURCE_COMMANDS = "alias login sync ls";
-var SCRIPTS = {
-  zsh: `# cloudhop shell integration (zsh). Load it after compinit:  eval "$(cloudhop shell zsh)"
-cloudhop() {
-  if [ "$1" = "use" ]; then
-    local out; out="$(command cloudhop use --emit zsh "\${@:2}")" || return $?
-    eval "$out"
-  else
-    command cloudhop "$@"
-  fi
-}
-_cloudhop_words() { command cloudhop __complete "$1" 2>/dev/null }
-_hop() { (( CURRENT == 2 )) && { local -a a; a=(\${(f)"$(_cloudhop_words aliases)"}); compadd -a a; } }
-_cloudhop() {
-  local -a w
-  if (( CURRENT == 2 )); then w=(\${(f)"$(_cloudhop_words commands)"}); compadd -a w; return; fi
-  (( CURRENT == 3 )) || return
-  case " ${ALIAS_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words aliases)"});; esac
-  case " ${SOURCE_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words sources)"});; esac
-  compadd -a w
-}
-(( $+functions[compdef] )) && { compdef _hop hop; compdef _cloudhop cloudhop; }
-# Add $(cloudhop_prompt) to your prompt to see the alias set with \`cloudhop use\`.
-cloudhop_prompt() { [ -n "$CLOUDHOP_ALIAS" ] && printf '\u2601 %s%s' "$CLOUDHOP_ALIAS" "\${CLOUDHOP_PROD:+ PROD}"; }
-`,
-  bash: `# cloudhop shell integration (bash):  eval "$(cloudhop shell bash)"
-cloudhop() {
-  if [ "$1" = "use" ]; then
-    local out; out="$(command cloudhop use --emit bash "\${@:2}")" || return $?
-    eval "$out"
-  else
-    command cloudhop "$@"
-  fi
-}
-_cloudhop_complete() {
-  local cur=\${COMP_WORDS[COMP_CWORD]} cmd=\${COMP_WORDS[0]##*/} kind=""
-  if [ "$cmd" = hop ]; then [ "$COMP_CWORD" -eq 1 ] && kind=aliases
-  elif [ "$COMP_CWORD" -eq 1 ]; then kind=commands
-  elif [ "$COMP_CWORD" -eq 2 ]; then
-    case " ${ALIAS_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=aliases;; esac
-    case " ${SOURCE_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=sources;; esac
-  fi
-  [ -n "$kind" ] && COMPREPLY=($(compgen -W "$(command cloudhop __complete $kind 2>/dev/null)" -- "$cur"))
-}
-complete -o default -F _cloudhop_complete hop cloudhop
-# Add $(cloudhop_prompt) to PS1 to see the alias set with \`cloudhop use\`.
-cloudhop_prompt() { [ -n "$CLOUDHOP_ALIAS" ] && printf '\u2601 %s%s' "$CLOUDHOP_ALIAS" "\${CLOUDHOP_PROD:+ PROD}"; }
-`,
-  fish: `# cloudhop shell integration (fish):  cloudhop shell fish | source
-function cloudhop
-  if test "$argv[1]" = use
-    set -l out (command cloudhop use --emit fish $argv[2..-1]); or return $status
-    printf '%s\\n' $out | source
-  else
-    command cloudhop $argv
-  end
-end
-complete -c hop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete aliases 2>/dev/null)'
-complete -c cloudhop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete commands 2>/dev/null)'
-complete -c cloudhop -f -n '__fish_seen_subcommand_from ${ALIAS_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete aliases 2>/dev/null)'
-complete -c cloudhop -f -n '__fish_seen_subcommand_from ${SOURCE_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete sources 2>/dev/null)'
-# Call cloudhop_prompt from fish_prompt to see the alias set with \`cloudhop use\`.
-function cloudhop_prompt
-  test -n "$CLOUDHOP_ALIAS"; and printf '\u2601 %s%s' $CLOUDHOP_ALIAS (test -n "$CLOUDHOP_PROD"; and echo ' PROD')
-end
-`,
-  pwsh: `# cloudhop shell integration (PowerShell):  cloudhop shell pwsh | Out-String | Invoke-Expression
-$script:CloudhopExe = (Get-Command cloudhop -CommandType Application, ExternalScript | Select-Object -First 1).Source
-function cloudhop {
-  if ($args.Count -gt 0 -and $args[0] -eq 'use') {
-    $out = & $script:CloudhopExe use --emit pwsh @($args | Select-Object -Skip 1)
-    if ($LASTEXITCODE -eq 0) { $out | Out-String | Invoke-Expression }
-  } else { & $script:CloudhopExe @args }
-}
-Register-ArgumentCompleter -Native -CommandName hop, cloudhop -ScriptBlock {
-  param($word, $ast)
-  $n = $ast.CommandElements.Count - [int]($word -eq '')
-  $kind = if ($ast.CommandElements[0].Value -match 'hop$' -and $ast.CommandElements[0].Value -notmatch 'cloudhop') { if ($n -le 1) { 'aliases' } }
-          elseif ($n -le 1) { 'commands' }
-          elseif ($n -eq 2 -and ' ${ALIAS_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'aliases' }
-          elseif ($n -eq 2 -and ' ${SOURCE_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'sources' }
-  if ($kind) { & $script:CloudhopExe __complete $kind | Where-Object { $_ -like "$word*" } }
-}
-function cloudhop_prompt { if ($env:CLOUDHOP_ALIAS) { "\u2601 $env:CLOUDHOP_ALIAS$(if ($env:CLOUDHOP_PROD) { ' PROD' })" } }
-`
-};
-var quote = (shell, value) => shell === "pwsh" ? `'${value.replace(/'/g, "''")}'` : `'${value.replace(/'/g, "'\\''")}'`;
-function shellExports(shell, env) {
-  return Object.entries(env).map(([key, value]) => {
-    if (value === void 0) {
-      if (shell === "fish") return `set -e ${key}`;
-      if (shell === "pwsh") return `Remove-Item Env:${key} -ErrorAction SilentlyContinue`;
-      return `unset ${key}`;
-    }
-    if (shell === "fish") return `set -gx ${key} ${quote(shell, value)}`;
-    if (shell === "pwsh") return `$env:${key} = ${quote(shell, value)}`;
-    return `export ${key}=${quote(shell, value)}`;
-  }).join("\n");
-}
-function detectShell() {
-  if (process.platform === "win32") return "pwsh";
-  const name = (process.env.SHELL ?? "").split("/").pop();
-  return SHELLS.includes(name) ? name : "bash";
-}
-function parseShell(value) {
-  if (!value) return detectShell();
-  const shell = value === "powershell" ? "pwsh" : value;
-  if (!SHELLS.includes(shell)) {
-    throw new CloudhopError(
-      "INVALID_NAME",
-      `Unknown shell "${value}".`,
-      `Use one of: ${SHELLS.join(", ")}.`
-    );
-  }
-  return shell;
-}
-var RC_FILES = {
-  zsh: (home) => join5(home, ".zshrc"),
-  bash: (home) => join5(home, ".bashrc"),
-  fish: (home) => join5(home, ".config", "fish", "config.fish"),
-  pwsh: (home) => process.platform === "win32" ? join5(home, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1") : join5(home, ".config", "powershell", "Microsoft.PowerShell_profile.ps1")
-};
-var LOAD_LINE = {
-  zsh: 'eval "$(cloudhop shell zsh)"',
-  bash: 'eval "$(cloudhop shell bash)"',
-  fish: "cloudhop shell fish | source",
-  pwsh: "cloudhop shell pwsh | Out-String | Invoke-Expression"
-};
-async function shellCommand(args) {
-  const { positional, flags } = parseArgs(args);
-  if (positional[0] !== "install") {
-    process.stdout.write(SCRIPTS[parseShell(positional[0])]);
-    return;
-  }
-  const shell = parseShell(positional[1]);
-  const file = RC_FILES[shell](homedir3());
-  const line = LOAD_LINE[shell];
-  const current = existsSync3(file) ? await readFile3(file, "utf8") : "";
-  if (current.includes(line)) {
-    console.log(`Already set up in ${file.replace(homedir3(), "~")}.`);
-    return;
-  }
-  if (!flags.yes) {
-    if (!interactive())
-      throw new CloudhopError(
-        "NOT_INTERACTIVE",
-        `Add this line to ${file} yourself, or rerun with --yes:
-  ${line}`
-      );
-    const ok = answer(
-      await dist_exports.confirm({
-        message: `Add cloudhop to ${file.replace(homedir3(), "~")}?`,
-        initialValue: true
-      })
-    );
-    if (!ok) return;
-  }
-  await mkdir3(dirname3(file), { recursive: true });
-  const note2 = shell === "zsh" ? "  # after compinit" : "";
-  await appendFile(
-    file,
-    `${current && !current.endsWith("\n") ? "\n" : ""}
-# cloudhop: \`cloudhop use\`, tab completion and cloudhop_prompt${note2}
-${line}
-`
-  );
-  console.log(
-    `${paint("green", "\u2714")} Added to ${file.replace(homedir3(), "~")}. Open a new terminal to use it.`
-  );
-}
-async function useCommand(app, args) {
-  const { positional, flags } = parseArgs(args);
-  const shell = flags.emit ? parseShell(flags.emit) : void 0;
-  if (!shell) {
-    throw new CloudhopError(
-      "NOT_INTERACTIVE",
-      "`cloudhop use` needs the shell integration to change your current shell.",
-      `Set it up once with \`cloudhop shell install\` (or add ${LOAD_LINE[detectShell()]} to your shell's startup file), then open a new terminal.`
-    );
-  }
-  const clear = {
-    AWS_ACCESS_KEY_ID: void 0,
-    AWS_SECRET_ACCESS_KEY: void 0,
-    AWS_SESSION_TOKEN: void 0
-  };
-  if (flags.off) {
-    process.stdout.write(
-      `${shellExports(shell, { ...clear, AWS_PROFILE: void 0, AWS_REGION: void 0, AWS_DEFAULT_REGION: void 0, CLOUDHOP_ALIAS: void 0, CLOUDHOP_PROD: void 0 })}
-`
-    );
-    notify("No alias in this shell anymore.");
-    return;
-  }
-  const alias = positional[0] ?? await pickAlias(app, "Use which alias in this shell?");
-  const env = await app.envForAlias(alias, "cli");
-  const status = await app.aliasStatus(alias);
-  process.stdout.write(
-    `${shellExports(shell, { ...clear, ...env, CLOUDHOP_ALIAS: alias, CLOUDHOP_PROD: status.prod ? "1" : void 0 })}
-`
-  );
-  notify(
-    `This shell now uses ${alias} (${status.label ?? status.target}, ${status.region ?? "no region"}).`
-  );
-  if (status.prod) {
-    notify(
-      paint(
-        "red",
-        `${alias} is production. Plain \`aws\` commands are not protected here: use \`hop ${alias}\` to be asked before changes.`
-      )
-    );
-  }
-}
-async function completeCommand(app, kind) {
-  if (kind === "commands") {
-    console.log(
-      [...RESERVED_NAMES, "each", "shell", "use"].filter((c3, i2, a2) => a2.indexOf(c3) === i2).sort().join("\n")
-    );
-    return;
-  }
-  const config = await app.config();
-  const words = kind === "sources" ? config.sources.map((s) => s.id) : config.aliases.map((a2) => a2.name);
-  if (words.length) console.log(words.join("\n"));
-}
-
 // src/commands/team.ts
-import { readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile6 } from "fs/promises";
 var import_yaml2 = __toESM(require_dist(), 1);
 var MAX_BYTES = 256 * 1024;
 var HEADER2 = `# cloudhop team setup: import it with \`cloudhop team import <this file or its https URL>\`.
 # No secrets: portal URLs, regions, account ids and role names only.
 `;
 function validate(app, raw) {
-  const bad = (why) => new CloudhopError("INVALID_NAME", `Not a cloudhop team file: ${why}.`);
-  if (!raw || typeof raw !== "object") throw bad("it is empty");
+  const bad2 = (why) => new CloudhopError("INVALID_NAME", `Not a cloudhop team file: ${why}.`);
+  if (!raw || typeof raw !== "object") throw bad2("it is empty");
   const file = raw;
-  if (file.version !== 1) throw bad('unknown "version" (expected 1)');
+  if (file.version !== 1) throw bad2('unknown "version" (expected 1)');
   const sources = file.sources ?? {};
   const aliases = file.aliases ?? {};
   for (const [id, source] of Object.entries(sources)) {
     assertValidName("source", id);
     if (!PROVIDER_IDS.includes(source?.provider))
-      throw bad(`source "${id}" has an unknown provider`);
+      throw bad2(`source "${id}" has an unknown provider`);
     const kind = app.provider(source.provider).sourceKinds.find((k) => k.kind === source.kind);
-    if (!kind) throw bad(`source "${id}" has an unknown kind`);
+    if (!kind) throw bad2(`source "${id}" has an unknown kind`);
     for (const field of kind.fields) {
       const value = source.settings?.[field.key];
-      if (typeof value !== "string" || !value) throw bad(`source "${id}" is missing ${field.key}`);
+      if (typeof value !== "string" || !value) throw bad2(`source "${id}" is missing ${field.key}`);
       const problem = field.validate?.(value);
-      if (problem) throw bad(`source "${id}": ${problem}`);
+      if (problem) throw bad2(`source "${id}": ${problem}`);
     }
   }
   for (const [name, alias] of Object.entries(aliases)) {
     assertValidName("alias", name);
     if (!alias || typeof alias.target !== "string" || !sources[alias.source]) {
-      throw bad(`alias "${name}" must name a source of this file and a target`);
+      throw bad2(`alias "${name}" must name a source of this file and a target`);
     }
   }
   return { version: 1, sources, aliases };
@@ -13107,7 +13817,7 @@ async function load(location) {
       throw new CloudhopError("INVALID_NAME", "That file is too big for a team setup.");
     return text4;
   }
-  return readFile4(location, "utf8");
+  return readFile5(location, "utf8");
 }
 async function teamCommand(app, args) {
   const { positional, flags } = parseArgs(args);
@@ -13128,7 +13838,7 @@ async function teamCommand(app, args) {
     };
     const text4 = HEADER2 + (0, import_yaml2.stringify)(file);
     if (flags.out) {
-      await writeFile3(flags.out, text4);
+      await writeFile6(flags.out, text4);
       console.error(
         `${paint("green", "\u2714")} Wrote ${sources.length} source(s) and ${Object.keys(file.aliases).length} alias(es) to ${flags.out}.`
       );
@@ -13233,8 +13943,8 @@ async function teamCommand(app, args) {
 }
 
 // ../ui/src/api.ts
-var text3 = (body, key) => {
-  const value = body[key];
+var text3 = (body, key2) => {
+  const value = body[key2];
   return typeof value === "string" ? value.trim() : "";
 };
 var badRequest = (message) => new CloudhopError("INVALID_NAME", message);
@@ -13307,8 +14017,8 @@ function createApi(app, assistants) {
             label: kind.label,
             hint: kind.hint,
             nameLabel: kind.nameLabel,
-            fields: kind.fields.map(({ key, label, placeholder, defaultValue }) => ({
-              key,
+            fields: kind.fields.map(({ key: key2, label, placeholder, defaultValue }) => ({
+              key: key2,
               label,
               placeholder,
               defaultValue
@@ -13446,8 +14156,8 @@ function createApi(app, assistants) {
       return { removed: name };
     }
   };
-  const table = Object.entries(routes).map(([key, handler]) => {
-    const [method, pattern] = key.split(" ");
+  const table = Object.entries(routes).map(([key2, handler]) => {
+    const [method, pattern] = key2.split(" ");
     const regex = new RegExp(`^${pattern.replace(/:[a-z]+/g, "([^/]+)")}$`);
     return { method, regex, handler };
   });
@@ -13476,7 +14186,7 @@ import { randomBytes, timingSafeEqual } from "crypto";
 import { createServer } from "http";
 
 // ../ui/src/assets/app.js
-var app_default = "// cloudhop local UI. Plain DOM, no build step: served as-is by `cloudhop ui`.\n\nconst TOKEN_KEY = 'cloudhop-token';\nconst SESSION_TEXT = {\n  valid: 'Session valid',\n  refreshable: 'Renews on next use',\n  expired: 'Expired: sign in on next use',\n  unknown: 'Managed by the cloud CLI',\n};\n\n// The token arrives in the URL fragment once; keep it for this tab and clean the address bar.\nconst fromHash = new URLSearchParams(location.hash.slice(1)).get('token');\nif (fromHash) {\n  try {\n    sessionStorage.setItem(TOKEN_KEY, fromHash);\n  } catch {}\n  history.replaceState(null, '', location.pathname);\n}\nlet token = fromHash;\ntry {\n  token = token ?? sessionStorage.getItem(TOKEN_KEY);\n} catch {}\n\n// ---------- pages ----------\n\nconst PAGES = {\n  aliases: 'Aliases',\n  sources: 'Sources',\n  assistants: 'AI assistants',\n  tools: 'Tools',\n};\nlet route = 'aliases';\nconst aliasFilter = { text: '', source: '', prodOnly: false };\n\n/** `#/aliases?source=acme` \u2192 route \"aliases\", filtered by that source. */\nfunction readRoute() {\n  const match = /^#\\/([a-z]+)(?:\\?(.*))?$/.exec(location.hash);\n  route = match && PAGES[match[1]] ? match[1] : 'aliases';\n  const query = new URLSearchParams(match?.[2] ?? '');\n  if (query.has('source')) aliasFilter.source = query.get('source');\n}\n\nfunction go(page, query) {\n  location.hash = `#/${page}${query ? `?${new URLSearchParams(query)}` : ''}`;\n}\n\n// A fresh link opened in this same tab carries a new token: reload to pick it up.\n// Any other fragment is a page change.\naddEventListener('hashchange', () => {\n  if (new URLSearchParams(location.hash.slice(1)).has('token')) {\n    location.reload();\n    return;\n  }\n  readRoute();\n  if (state) render();\n});\n\nconst $main = document.getElementById('main');\nconst $dialog = document.getElementById('dialog');\nconst $toasts = document.getElementById('toasts');\nconst $addSource = document.getElementById('add-source');\nconst $nav = document.getElementById('nav');\nlet state;\n\n/** Tiny element builder: h('button', { class: 'primary', onclick }, 'Save'). */\nfunction h(tag, attrs = {}, ...children) {\n  const el = document.createElement(tag);\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null || value === false) continue;\n    if (key.startsWith('on')) el.addEventListener(key.slice(2), value);\n    else if (key === 'class') el.className = value;\n    else if (value === true) el.setAttribute(key, '');\n    else el.setAttribute(key, value);\n  }\n  for (const child of children.flat()) {\n    if (child === undefined || child === null || child === false) continue;\n    el.append(child instanceof Node ? child : document.createTextNode(String(child)));\n  }\n  return el;\n}\n\nclass ApiError extends Error {\n  constructor(message, hint) {\n    super(message);\n    this.hint = hint;\n  }\n}\n\n// Calls that may sign in wait for the person in the browser; everything else should answer quickly.\nconst MAY_SIGN_IN = /^\\/api\\/(sources(\\/[^/]+\\/(login|sync|targets))?|aliases\\/[^/]+\\/console)$/;\nconst QUICK_TIMEOUT_MS = 20_000;\n\nasync function api(method, path, body) {\n  const waitsForPerson = MAY_SIGN_IN.test(path);\n  let response;\n  try {\n    response = await fetch(path, {\n      method,\n      headers: {\n        'x-cloudhop-token': token ?? '',\n        ...(body ? { 'content-type': 'application/json' } : {}),\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: waitsForPerson ? undefined : AbortSignal.timeout(QUICK_TIMEOUT_MS),\n    });\n  } catch (error) {\n    if (error.name === 'TimeoutError') {\n      throw new ApiError(\n        'cloudhop ui is not responding.',\n        'Is it paused in your terminal (Ctrl-Z)? Run `fg` there, or stop it and run `cloudhop ui` again.',\n      );\n    }\n    throw new ApiError(\n      'cloudhop ui is not running.',\n      'Run `cloudhop ui` again and open the new link it prints.',\n    );\n  }\n  const data = await response.json().catch(() => ({}));\n  if (!response.ok)\n    throw new ApiError(data.error ?? `Request failed (${response.status}).`, data.hint);\n  return data;\n}\n\nfunction toast(message, { error = false, hint } = {}) {\n  const el = h(\n    'div',\n    { class: `toast${error ? ' error' : ''}` },\n    message,\n    hint && h('small', {}, hint),\n  );\n  $toasts.append(el);\n  setTimeout(() => el.remove(), error ? 9000 : 4000);\n}\n\nconst fail = (error) => toast(error.message, { error: true, hint: error.hint });\n\n/** Disables a button while its action runs. */\nasync function busy(button, action) {\n  button.disabled = true;\n  try {\n    return await action();\n  } finally {\n    button.disabled = false;\n  }\n}\n\nasync function refresh() {\n  try {\n    state = await api('GET', '/api/state');\n    render();\n    checkDoctor();\n  } catch (error) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Cannot reach cloudhop'),\n        h('p', {}, error.message, error.hint ? ` ${error.hint}` : ''),\n      ),\n    );\n  }\n}\n\nasync function checkDoctor() {\n  try {\n    const entries = await api('GET', '/api/doctor');\n    const problems = entries.filter((e) => !e.installed || e.outdated);\n    document.getElementById('doctor')?.remove();\n    if (problems.length === 0) return;\n    $main.prepend(\n      h(\n        'div',\n        { class: 'notice', id: 'doctor' },\n        ...problems.map((e) =>\n          h(\n            'div',\n            {},\n            e.installed\n              ? `${e.cli} ${e.version} is older than ${e.minVersion}. `\n              : `${e.cli} is not installed, so aliases cannot run commands yet. `,\n            'Run ',\n            h('code', {}, 'cloudhop doctor'),\n            ' in a terminal to install it.',\n          ),\n        ),\n      ),\n    );\n  } catch {}\n}\n\n// ---------- main view ----------\n\nfunction render() {\n  const enabled = state.enabledProviders;\n  $addSource.hidden = enabled.length === 0;\n  $nav.hidden = enabled.length === 0;\n  if (enabled.length === 0) return renderChooseClouds();\n  for (const link of $nav.querySelectorAll('a')) {\n    if (link.dataset.page === route) link.setAttribute('aria-current', 'page');\n    else link.removeAttribute('aria-current');\n  }\n  document.title = `${PAGES[route]} \xB7 cloudhop`;\n  const pages = {\n    aliases: aliasesPage,\n    sources: sourcesPage,\n    assistants: assistantsPage,\n    tools: toolsPage,\n  };\n  $main.replaceChildren(...pages[route]());\n  if (route === 'assistants') loadAssistants();\n  if (route === 'tools') loadTools();\n}\n\nfunction pageHead(title, subtitle, ...actions) {\n  return h(\n    'div',\n    { class: 'page-head' },\n    h('div', {}, h('h1', {}, title), subtitle ? h('p', {}, subtitle) : null),\n    h('div', { class: 'actions' }, actions),\n  );\n}\n\nfunction firstSourceHero() {\n  return h(\n    'div',\n    { class: 'hero' },\n    h('h2', {}, 'Add your first account'),\n    h(\n      'p',\n      {},\n      'Add a company SSO portal or a personal account. cloudhop signs you in, finds every account and role you can use, and lets you give each one a short alias.',\n    ),\n    h('button', { class: 'primary', onclick: () => openAddSource() }, '+ Add source'),\n  );\n}\n\n// ---------- Aliases page ----------\n\nfunction aliasesPage() {\n  if (state.sources.length === 0) return [firstSourceHero()];\n  if (aliasFilter.source && !state.sources.some((s) => s.id === aliasFilter.source))\n    aliasFilter.source = '';\n\n  const addAliases = () => {\n    const source =\n      state.sources.find((s) => s.id === aliasFilter.source) ??\n      (state.sources.length === 1 ? state.sources[0] : undefined);\n    if (source) openAliasPicker(source);\n    else openSourceChooser();\n  };\n  const head = pageHead(\n    'Aliases',\n    'Each alias is one account, role and region. Run it with hop <alias>.',\n    h('button', { onclick: addAliases }, '+ Aliases'),\n  );\n  if (state.aliases.length === 0) {\n    return [\n      head,\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'No aliases yet'),\n        h('p', {}, 'Pick the accounts and roles you use and give each one a short name.'),\n        h('button', { class: 'primary', onclick: addAliases }, 'Pick accounts'),\n      ),\n    ];\n  }\n\n  const rows = h('tbody', { id: 'alias-rows' });\n  const count = h('span', { class: 'count' });\n  const fill = () => {\n    const words = aliasFilter.text.toLowerCase().split(/\\s+/).filter(Boolean);\n    const visible = state.aliases.filter((a) => {\n      if (aliasFilter.source && a.source !== aliasFilter.source) return false;\n      if (aliasFilter.prodOnly && !a.prod) return false;\n      const text = `${a.name} ${a.label ?? a.target} ${a.region ?? ''} ${a.source}`.toLowerCase();\n      return words.every((w) => text.includes(w));\n    });\n    rows.replaceChildren(\n      ...(visible.length\n        ? visible.map(aliasRow)\n        : [\n            h(\n              'tr',\n              {},\n              h('td', { colspan: '5', class: 'empty' }, 'No alias matches these filters.'),\n            ),\n          ]),\n    );\n    count.textContent = `${visible.length} of ${state.aliases.length}`;\n  };\n\n  const search = h('input', {\n    type: 'search',\n    placeholder: 'Filter: name, account, role or region',\n    value: aliasFilter.text,\n    'aria-label': 'Filter aliases',\n    oninput: (e) => {\n      aliasFilter.text = e.currentTarget.value;\n      fill();\n    },\n  });\n  const sourceSelect = h(\n    'select',\n    {\n      'aria-label': 'Source',\n      onchange: (e) => {\n        aliasFilter.source = e.currentTarget.value;\n        fill();\n      },\n    },\n    h('option', { value: '' }, 'All sources'),\n    state.sources.map((s) =>\n      h('option', { value: s.id, selected: s.id === aliasFilter.source }, s.id),\n    ),\n  );\n  const prodOnly = h(\n    'label',\n    { class: 'prod-toggle' },\n    h('input', {\n      type: 'checkbox',\n      checked: aliasFilter.prodOnly,\n      onchange: (e) => {\n        aliasFilter.prodOnly = e.currentTarget.checked;\n        fill();\n      },\n    }),\n    'Production only',\n  );\n\n  const table = h(\n    'table',\n    { class: 'aliases' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Alias'),\n        h('th', {}, 'Source'),\n        h('th', {}, 'Region'),\n        h('th', {}, 'Account / role'),\n        h('th'),\n      ),\n    ),\n    rows,\n  );\n  fill();\n  return [\n    head,\n    h(\n      'div',\n      { class: 'toolbar' },\n      search,\n      sourceSelect,\n      prodOnly,\n      h('div', { class: 'spacer' }),\n      count,\n    ),\n    h('section', { class: 'card' }, table),\n  ];\n}\n\n/** When several sources exist, ask which one to pick accounts from. */\nfunction openSourceChooser() {\n  showDialog(\n    'Add aliases from',\n    h(\n      'div',\n      { class: 'choices' },\n      state.sources.map((source) =>\n        h(\n          'button',\n          { class: 'choice', onclick: () => openAliasPicker(source) },\n          h(\n            'span',\n            {},\n            h('strong', {}, source.id),\n            h('small', {}, source.settings.startUrl ?? source.kindLabel),\n          ),\n        ),\n      ),\n    ),\n  );\n}\n\n// ---------- Sources page ----------\n\nfunction sourcesPage() {\n  const head = pageHead('Sources', 'The SSO portals and personal accounts you sign in to.');\n  if (state.sources.length === 0) return [head, firstSourceHero()];\n  return [head, ...state.sources.map(sourceCard)];\n}\n\n// ---------- AI assistants page ----------\n\nfunction assistantsPage() {\n  return [assistantsCard()];\n}\n\n// ---------- Tools page ----------\n\nfunction snippet(command) {\n  return h(\n    'div',\n    { class: 'snippet' },\n    h('code', {}, command),\n    h(\n      'button',\n      {\n        class: 'link',\n        title: 'Copy',\n        'aria-label': `Copy ${command}`,\n        onclick: () =>\n          navigator.clipboard\n            ?.writeText(command)\n            .then(() => toast('Copied.'))\n            .catch(() =>\n              toast('Copy it by hand: the browser blocked the clipboard.', { error: true }),\n            ),\n      },\n      'Copy',\n    ),\n  );\n}\n\nfunction toolCard(title, text, ...commands) {\n  return h(\n    'section',\n    { class: 'card' },\n    h('div', { class: 'card-head' }, h('h2', {}, title)),\n    h(\n      'div',\n      { class: 'card-body padded' },\n      h('p', { class: 'card-help' }, text),\n      commands.map(snippet),\n    ),\n  );\n}\n\nfunction toolsPage() {\n  const sample = state.aliases[0]?.name ?? 'acme-dev';\n  return [\n    pageHead('Tools', 'More ways to use cloudhop from your terminal.'),\n    h(\n      'section',\n      { class: 'card', id: 'tools-cli' },\n      h('div', { class: 'card-head' }, h('h2', {}, 'Cloud CLIs')),\n      h('div', { class: 'card-body padded' }, h('p', { class: 'card-help' }, 'Checking\u2026')),\n    ),\n    toolCard(\n      'Shell integration',\n      'Pick aliases from a list, tab-complete them, and use one in your shell so plain aws and Terraform work without hop.',\n      'cloudhop shell install',\n      `cloudhop use ${sample}`,\n      'hop',\n    ),\n    toolCard(\n      'Run in many accounts',\n      'Run one command in many aliases at once: names, lists, wildcards or /regex/. It asks before running.',\n      `cloudhop each '${sample.split('-')[0]}-*' -- s3 ls`,\n    ),\n    toolCard(\n      'Share with your team',\n      'Export your portals and aliases (no secrets) and let teammates import them in one command.',\n      'cloudhop team export --out team.yaml',\n      'cloudhop team import team.yaml',\n    ),\n  ];\n}\n\nasync function loadTools() {\n  const card = document.querySelector('#tools-cli .card-body');\n  if (!card) return;\n  try {\n    const entries = await api('GET', '/api/doctor');\n    card.replaceChildren(\n      ...entries.map((e) =>\n        h(\n          'div',\n          { class: 'tool-row' },\n          h('span', { class: `badge ${e.installed && !e.outdated ? 'valid' : 'expired'}` }, e.cli),\n          h(\n            'span',\n            {},\n            !e.installed\n              ? 'Not installed.'\n              : e.outdated\n                ? `${e.version} is older than ${e.minVersion}.`\n                : `Version ${e.version}.`,\n          ),\n          e.installed && !e.outdated ? null : snippet('cloudhop doctor'),\n        ),\n      ),\n    );\n  } catch (error) {\n    card.replaceChildren(h('p', { class: 'card-help' }, error.message));\n  }\n}\n\n// ---------- AI assistants ----------\n\nlet assistantScope = 'user';\ntry {\n  assistantScope =\n    localStorage.getItem('cloudhop-assistant-scope') === 'project' ? 'project' : 'user';\n} catch {}\nlet assistantsData;\n\nconst SKILL_TEXT = {\n  current: ['valid', 'Up to date'],\n  outdated: ['refreshable', 'Outdated'],\n  modified: ['refreshable', 'Edited by you'],\n  missing: ['', 'Not installed'],\n};\nconst MCP_TEXT = { registered: 'On', missing: 'Off', unknown: 'Check in the app' };\n\nfunction assistantsCard() {\n  return h('section', { class: 'card', id: 'assistants', hidden: true });\n}\n\nasync function loadAssistants() {\n  try {\n    assistantsData = await api('GET', '/api/assistants');\n    renderAssistants();\n  } catch {\n    document.getElementById('assistants')?.remove();\n  }\n}\n\nfunction setAssistantScope(scope) {\n  assistantScope = scope;\n  try {\n    localStorage.setItem('cloudhop-assistant-scope', scope);\n  } catch {}\n  renderAssistants();\n}\n\nfunction assistantAction(label, run, { danger = false, confirmText } = {}) {\n  return h(\n    'button',\n    {\n      class: danger ? 'danger' : undefined,\n      onclick: (e) => {\n        if (confirmText && !confirm(confirmText)) return;\n        busy(e.currentTarget, async () => {\n          try {\n            await run();\n          } catch (error) {\n            fail(error);\n          }\n          await loadAssistants();\n        });\n      },\n    },\n    label,\n  );\n}\n\nfunction reportInstall(results) {\n  for (const r of results) {\n    if (r.mcp === 'manual') {\n      toast(`${r.name}: skill installed. Add the MCP server by hand.`, { hint: r.mcpManual });\n    } else {\n      toast(`${r.name} now knows cloudhop. Start a new chat so it picks it up.`);\n    }\n  }\n}\n\nfunction renderAssistants() {\n  const el = document.getElementById('assistants');\n  if (!el || !assistantsData) return;\n  const rows = assistantScope === 'user' ? assistantsData.user : assistantsData.projectScope;\n  const scope = assistantScope;\n  const install = (tools) =>\n    api('POST', '/api/assistants', { tools, scope, mcp: true }).then((r) =>\n      reportInstall(r.results),\n    );\n  const missingDetected = rows\n    .filter((r) => r.detected && r.skill === 'missing')\n    .map((r) => r.assistant);\n\n  const seg = h(\n    'div',\n    { class: 'seg', role: 'group', 'aria-label': 'Where' },\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'user'), onclick: () => setAssistantScope('user') },\n      'For me',\n    ),\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'project'), onclick: () => setAssistantScope('project') },\n      'This project',\n    ),\n  );\n\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, 'AI assistants'),\n    h(\n      'span',\n      { class: 'meta' },\n      scope === 'user'\n        ? 'Installed in your home folder, for every project'\n        : assistantsData.project,\n    ),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      seg,\n      missingDetected.length > 1\n        ? assistantAction('Install for all detected', () => install(missingDetected))\n        : null,\n    ),\n  );\n\n  const table = h(\n    'table',\n    { class: 'assistants' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Assistant'),\n        h('th', {}, 'Skill'),\n        h('th', {}, 'MCP server'),\n        h('th'),\n      ),\n    ),\n    h(\n      'tbody',\n      {},\n      rows.map((r) => {\n        const [badgeClass, skillText] = SKILL_TEXT[r.skill];\n        const actions = [];\n        if (r.skill === 'missing')\n          actions.push(assistantAction('Install', () => install([r.assistant])));\n        if (r.skill === 'outdated') {\n          actions.push(\n            assistantAction('Update', () =>\n              api('POST', '/api/assistants/update', {}).then(() =>\n                toast(`${r.name}: skill updated.`),\n              ),\n            ),\n          );\n        }\n        if (r.skill === 'modified') {\n          actions.push(\n            assistantAction(\n              'Replace',\n              () =>\n                api('POST', '/api/assistants/update', { force: true }).then(() =>\n                  toast('Edited skills replaced.'),\n                ),\n              {\n                confirmText: 'Replace your edited copies with the current cloudhop skill?',\n              },\n            ),\n          );\n        }\n        if (r.skill !== 'missing' || r.mcp === 'registered') {\n          actions.push(\n            assistantAction(\n              'Remove',\n              () => api('POST', '/api/assistants/remove', { tools: [r.assistant], scope }),\n              {\n                danger: true,\n                confirmText: `Remove the cloudhop skill and MCP server from ${r.name}?`,\n              },\n            ),\n          );\n        }\n        return h(\n          'tr',\n          {},\n          h(\n            'td',\n            { class: 'alias' },\n            r.name,\n            r.detected ? null : h('small', { class: 'muted-inline' }, ' not detected'),\n          ),\n          h('td', {}, h('span', { class: `badge ${badgeClass}`, title: r.skillPath }, skillText)),\n          h('td', {}, r.skill === 'missing' && r.mcp !== 'registered' ? '' : MCP_TEXT[r.mcp]),\n          h(\n            'td',\n            { style: 'text-align:right' },\n            h('div', { class: 'actions', style: 'justify-content:flex-end' }, actions),\n          ),\n        );\n      }),\n    ),\n  );\n\n  el.replaceChildren(\n    head,\n    h(\n      'div',\n      { class: 'card-body' },\n      h(\n        'p',\n        { class: 'card-help' },\n        'Teach your AI assistant to use cloudhop: it asks you which alias to work with, runs commands with hop, and confirms before changing anything. Includes the cloudhop MCP server.',\n      ),\n      table,\n    ),\n  );\n  el.hidden = false;\n}\n\nfunction renderChooseClouds() {\n  const boxes = state.providers.map((p) =>\n    h(\n      'label',\n      { class: 'choice' },\n      h('input', { type: 'checkbox', value: p.id, checked: true }),\n      h('span', {}, p.name),\n    ),\n  );\n  const save = h(\n    'button',\n    {\n      class: 'primary',\n      onclick: (e) =>\n        busy(e.currentTarget, async () => {\n          const ids = boxes\n            .map((b) => b.querySelector('input'))\n            .filter((i) => i.checked)\n            .map((i) => i.value);\n          await api('PUT', '/api/providers', { enabled: ids }).catch(fail);\n          await refresh();\n        }),\n    },\n    'Continue',\n  );\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Which clouds do you use?'),\n      h('p', {}, 'Azure and Google Cloud are coming soon.'),\n      h(\n        'div',\n        { class: 'choices', style: 'max-width:320px;margin:0 auto 16px;text-align:left' },\n        boxes,\n      ),\n      save,\n    ),\n  );\n}\n\nfunction sourceCard(source) {\n  const aliases = state.aliases.filter((a) => a.source === source.id);\n  const where = source.settings.startUrl ?? source.kindLabel;\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, source.id),\n    h('span', { class: `badge ${source.session}` }, SESSION_TEXT[source.session] ?? source.session),\n    h('span', { class: 'meta' }, `${source.providerName} \xB7 ${where}`),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      h('button', { onclick: () => openAliasPicker(source) }, '+ Aliases'),\n      h(\n        'button',\n        {\n          title: 'Sign in again and refresh its accounts',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              toast('Opening the browser to sign in\u2026');\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/login`,\n              ).catch(fail);\n              if (report)\n                toast(`${source.id}: signed in, ${report.targets.length} account/role(s).`);\n              await refresh();\n            }),\n        },\n        'Sign in',\n      ),\n      h(\n        'button',\n        {\n          title: 'Refresh the accounts and roles you have access to',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/sync`,\n              ).catch(fail);\n              if (report) toast(syncMessage(source.id, report));\n              await refresh();\n            }),\n        },\n        'Sync',\n      ),\n      h(\n        'button',\n        {\n          class: 'danger',\n          onclick: (e) => {\n            const count = aliases.length;\n            const message = `Remove \"${source.id}\"${count ? ` and its ${count} alias(es)` : ''}?`;\n            if (!confirm(message)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/sources/${encodeURIComponent(source.id)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        'Remove',\n      ),\n    ),\n  );\n\n  const prodCount = aliases.filter((a) => a.prod).length;\n  const body =\n    aliases.length === 0\n      ? h(\n          'div',\n          { class: 'empty' },\n          'No aliases yet. ',\n          h(\n            'button',\n            { class: 'primary', onclick: () => openAliasPicker(source) },\n            'Pick accounts',\n          ),\n        )\n      : h(\n          'div',\n          { class: 'source-summary' },\n          h(\n            'span',\n            {},\n            `${aliases.length} alias(es)`,\n            prodCount ? h('span', { class: 'prod-tag' }, `${prodCount} PROD`) : null,\n          ),\n          h(\n            'button',\n            { class: 'link', onclick: () => go('aliases', { source: source.id }) },\n            'View aliases \u2192',\n          ),\n        );\n  return h('section', { class: 'card' }, head, h('div', { class: 'card-body' }, body));\n}\n\nfunction syncMessage(id, report) {\n  const parts = [`${report.targets.length} available`];\n  if (report.added) parts.push(`${report.added} new`);\n  if (report.removed) parts.push(`${report.removed} removed`);\n  const orphaned = report.orphanedAliases.length\n    ? ` No longer available: ${report.orphanedAliases.join(', ')}.`\n    : '';\n  return `${id}: ${parts.join(', ')}.${orphaned}`;\n}\n\nfunction aliasRow(alias) {\n  const input = h('input', {\n    value: alias.region ?? '',\n    'aria-label': `Region for ${alias.name}`,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  const save = h('button', { hidden: true }, 'Save');\n  const commit = () =>\n    busy(save, async () => {\n      const region = input.value.trim();\n      const done = await api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, {\n        region,\n      }).catch(fail);\n      if (done) toast(`${alias.name} now runs in ${region}.`);\n      await refresh();\n    });\n  input.addEventListener('input', () => {\n    save.hidden = input.value.trim() === (alias.region ?? '');\n  });\n  input.addEventListener('keydown', (e) => {\n    if (e.key === 'Enter' && !save.hidden) commit();\n    if (e.key === 'Escape') {\n      input.value = alias.region ?? '';\n      save.hidden = true;\n    }\n  });\n  save.addEventListener('click', commit);\n\n  const patch = (body, message) =>\n    api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, body)\n      .then(() => message && toast(message))\n      .catch(fail)\n      .then(refresh);\n  const iconButton = (label, title, onclick, extra = {}) =>\n    h('button', { class: 'link', title, 'aria-label': title, onclick, ...extra }, label);\n\n  const actions = h(\n    'div',\n    { class: 'row-actions' },\n    h(\n      'button',\n      {\n        title: `Open the AWS console as ${alias.name}, already signed in`,\n        disabled: alias.missing,\n        onclick: (e) =>\n          busy(e.currentTarget, async () => {\n            const result = await api(\n              'POST',\n              `/api/aliases/${encodeURIComponent(alias.name)}/console`,\n              {},\n            ).catch(fail);\n            if (result) {\n              toast(\n                result.via === 'signed-in'\n                  ? `Opened the console for ${alias.name}.`\n                  : result.via === 'portal'\n                    ? `Opened ${alias.name} through the SSO portal.`\n                    : `Opened the console sign-in page for ${alias.name}.`,\n              );\n            }\n          }),\n      },\n      'Console',\n    ),\n    h(\n      'label',\n      { class: 'prod-toggle', title: 'Production: hop and AI assistants ask before any change' },\n      h('input', {\n        type: 'checkbox',\n        checked: alias.prod,\n        'aria-label': `${alias.name} is production`,\n        onchange: (e) =>\n          patch(\n            { prod: e.currentTarget.checked },\n            e.currentTarget.checked\n              ? `${alias.name} is now production.`\n              : `${alias.name} is no longer production.`,\n          ),\n      }),\n      'Prod',\n    ),\n    iconButton('\u270E', `Rename ${alias.name}`, () => {\n      const to = prompt(`New name for \"${alias.name}\"`, alias.name)?.trim();\n      if (to && to !== alias.name) patch({ name: to }, `${alias.name} is now ${to}.`);\n    }),\n    iconButton(\n      '\u2715',\n      `Remove ${alias.name}`,\n      (e) => {\n        if (!confirm(`Remove alias \"${alias.name}\"?`)) return;\n        busy(e.currentTarget, async () => {\n          await api('DELETE', `/api/aliases/${encodeURIComponent(alias.name)}`).catch(fail);\n          await refresh();\n        });\n      },\n      { class: 'link danger-hover' },\n    ),\n  );\n\n  return h(\n    'tr',\n    { class: alias.prod ? 'prod' : undefined },\n    h(\n      'td',\n      { class: 'alias', title: `hop ${alias.name} <command>` },\n      alias.name,\n      alias.prod ? h('span', { class: 'prod-tag' }, 'PROD') : null,\n    ),\n    h('td', { class: 'muted' }, alias.source),\n    h('td', {}, h('div', { class: 'region' }, input, save)),\n    h(\n      'td',\n      {},\n      alias.missing\n        ? h('span', { class: 'missing' }, `${alias.target} (no longer available)`)\n        : alias.label,\n    ),\n    h('td', { style: 'text-align:right' }, actions),\n  );\n}\n\n// ---------- dialogs ----------\n\nfunction showDialog(title, body, footer) {\n  $dialog.replaceChildren(\n    h(\n      'div',\n      { class: 'dlg-head' },\n      h('h2', {}, title),\n      h('button', { class: 'link', 'aria-label': 'Close', onclick: () => $dialog.close() }, '\u2715'),\n    ),\n    h('div', { class: 'dlg-body' }, body),\n    footer ? h('div', { class: 'dlg-foot' }, footer) : null,\n  );\n  if (!$dialog.open) $dialog.showModal();\n}\n\nfunction suggestSourceId(settings, kind) {\n  const host = /^https:\\/\\/([^./]+)\\./.exec(settings.startUrl ?? '')?.[1];\n  return slug(host ?? (kind === 'console-login' ? 'personal' : 'main'));\n}\n\nconst slug = (text) =>\n  text\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 63) || 'main';\n\n/** `previous` refills the form after a failed sign-in: { provider, kind, id, settings, error }. */\nfunction openAddSource(previous) {\n  const providers = state.providers.filter((p) => state.enabledProviders.includes(p.id));\n  let provider = providers.find((p) => p.id === previous?.provider) ?? providers[0];\n  let kind = provider.kinds.find((k) => k.kind === previous?.kind) ?? provider.kinds[0];\n\n  const form = h('form', { onsubmit: (e) => e.preventDefault() });\n  const nameInput = h('input', {\n    id: 'f-name',\n    required: true,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  let nameTouched = Boolean(previous);\n  nameInput.addEventListener('input', () => {\n    nameTouched = true;\n  });\n\n  const fieldInputs = {};\n  const fieldsBox = h('div');\n  const nameLabel = h('label', { for: 'f-name' });\n\n  function updateSuggestion() {\n    if (nameTouched) return;\n    const settings = Object.fromEntries(\n      Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n    );\n    const taken = new Set(state.sources.map((s) => s.id));\n    let id = suggestSourceId(settings, kind.kind);\n    for (let i = 2; taken.has(id); i++) id = `${suggestSourceId(settings, kind.kind)}-${i}`;\n    nameInput.value = id;\n  }\n\n  function renderFields() {\n    for (const key of Object.keys(fieldInputs)) delete fieldInputs[key];\n    fieldsBox.replaceChildren(\n      ...kind.fields.map((f) => {\n        const input = h('input', {\n          id: `f-${f.key}`,\n          placeholder: f.placeholder ?? f.defaultValue ?? '',\n          value: previous?.settings?.[f.key] ?? f.defaultValue ?? '',\n          required: true,\n          class: 'mono',\n          spellcheck: 'false',\n          oninput: updateSuggestion,\n        });\n        fieldInputs[f.key] = input;\n        return h('div', { class: 'field' }, h('label', { for: input.id }, f.label), input);\n      }),\n    );\n    nameLabel.textContent = kind.nameLabel ?? 'Short name for this source';\n    updateSuggestion();\n  }\n\n  const providerSelect =\n    providers.length > 1\n      ? h(\n          'div',\n          { class: 'field' },\n          h('label', { for: 'f-provider' }, 'Cloud'),\n          h(\n            'select',\n            {\n              id: 'f-provider',\n              onchange: (e) => {\n                provider = providers.find((p) => p.id === e.target.value);\n                kind = provider.kinds[0];\n                renderKinds();\n              },\n            },\n            providers.map((p) => h('option', { value: p.id, selected: p === provider }, p.name)),\n          ),\n        )\n      : null;\n\n  const kindsBox = h('div', { class: 'choices' });\n  function renderKinds() {\n    kindsBox.replaceChildren(\n      ...provider.kinds.map((k) =>\n        h(\n          'label',\n          { class: 'choice' },\n          h('input', {\n            type: 'radio',\n            name: 'kind',\n            value: k.kind,\n            checked: k === kind,\n            onchange: () => {\n              kind = k;\n              renderFields();\n            },\n          }),\n          h('span', {}, h('strong', {}, k.label), k.hint ? h('small', {}, k.hint) : null),\n        ),\n      ),\n    );\n    renderFields();\n  }\n\n  form.append(\n    previous?.error\n      ? h(\n          'div',\n          { class: 'notice error' },\n          h('strong', {}, 'Could not sign in, so nothing was saved. '),\n          previous.error.message,\n          previous.error.hint ? h('div', { class: 'help' }, previous.error.hint) : null,\n        )\n      : '',\n    providerSelect ?? '',\n    h('div', { class: 'field' }, h('label', {}, 'What do you want to add?')),\n    kindsBox,\n    fieldsBox,\n    h(\n      'div',\n      { class: 'field' },\n      nameLabel,\n      nameInput,\n      h(\n        'span',\n        { class: 'help' },\n        'Lowercase letters, numbers and dashes. You will see it in ',\n        h('code', {}, 'cloudhop ls'),\n        '.',\n      ),\n    ),\n  );\n  renderKinds();\n  if (previous) nameInput.value = previous.id;\n\n  const submit = h('button', { class: 'primary', type: 'submit' }, 'Add and sign in');\n  form.addEventListener('submit', async () => {\n    if (!form.reportValidity()) return;\n    const body = {\n      provider: provider.id,\n      kind: kind.kind,\n      id: nameInput.value.trim(),\n      settings: Object.fromEntries(\n        Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n      ),\n    };\n    showDialog(\n      'Sign in',\n      h(\n        'div',\n        { class: 'waiting' },\n        h('div', { class: 'spinner' }),\n        h('strong', {}, 'Finish signing in in the browser tab that just opened.'),\n        h('p', { class: 'help' }, 'This page continues on its own once you approve the request.'),\n      ),\n    );\n    try {\n      const report = await api('POST', '/api/sources', body);\n      await refresh();\n      const source = state.sources.find((s) => s.id === body.id);\n      toast(`Signed in to ${body.id}. ${report.targets.length} account/role(s) found.`);\n      openAliasPicker(source, report.targets);\n    } catch (error) {\n      // Nothing was saved: reopen the form with what was typed so it can be fixed.\n      await refresh();\n      openAddSource({ ...body, error });\n    }\n  });\n\n  showDialog('Add source', form, [\n    h('button', { type: 'button', onclick: () => $dialog.close() }, 'Cancel'),\n    submit,\n  ]);\n  submit.setAttribute('form', 'add-form');\n  form.id = 'add-form';\n}\n\nasync function openAliasPicker(source, preloaded) {\n  let targets = preloaded;\n  if (!targets) {\n    showDialog(\n      `Aliases for ${source.id}`,\n      h('div', { class: 'waiting' }, h('div', { class: 'spinner' }), 'Loading accounts\u2026'),\n    );\n    try {\n      targets = (await api('GET', `/api/sources/${encodeURIComponent(source.id)}/targets`)).targets;\n    } catch (error) {\n      $dialog.close();\n      return fail(error);\n    }\n  }\n\n  const used = new Map(\n    state.aliases.filter((a) => a.source === source.id).map((a) => [a.target, a.name]),\n  );\n  const taken = new Set(state.aliases.map((a) => a.name));\n  const defaultRegion = source.settings.region ?? '';\n  const filter = h('input', {\n    type: 'search',\n    placeholder: `Filter ${targets.length} account/role(s)\u2026`,\n    style: 'width:100%;margin-bottom:12px',\n  });\n\n  const rows = targets.map((t) => {\n    const existing = used.get(t.id);\n    let name = t.suggestedAlias;\n    for (let i = 2; taken.has(name); i++) name = `${t.suggestedAlias}-${i}`;\n    const check = h('input', {\n      type: 'checkbox',\n      disabled: Boolean(existing),\n      'aria-label': t.label,\n    });\n    const aliasInput = h('input', {\n      value: name,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Alias for ${t.label}`,\n      placeholder: 'alias',\n    });\n    const regionInput = h('input', {\n      value: defaultRegion,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Region for ${t.label}`,\n      placeholder: 'region',\n    });\n    // Only the checkbox and its text sit in the label, so clicking the inputs never toggles it.\n    const el = h(\n      'div',\n      { class: 'target' },\n      h(\n        'label',\n        { class: 'pick' },\n        check,\n        h(\n          'span',\n          {},\n          t.label,\n          existing ? h('small', { class: 'already' }, `Already: ${existing}`) : null,\n        ),\n      ),\n      h('div', { class: 'inputs' }, aliasInput, regionInput),\n    );\n    return { target: t, el, check, aliasInput, regionInput };\n  });\n\n  filter.addEventListener('input', () => {\n    const q = filter.value.trim().toLowerCase();\n    for (const row of rows) row.el.hidden = q !== '' && !row.target.label.toLowerCase().includes(q);\n  });\n\n  const save = h('button', { class: 'primary' }, 'Create aliases');\n  save.addEventListener('click', () =>\n    busy(save, async () => {\n      const aliases = rows\n        .filter((r) => r.check.checked)\n        .map((r) => ({\n          source: source.id,\n          target: r.target.id,\n          name: r.aliasInput.value.trim(),\n          region: r.regionInput.value.trim(),\n        }));\n      if (aliases.length === 0) return toast('Pick at least one account/role.', { error: true });\n      try {\n        const result = await api('POST', '/api/aliases', { aliases });\n        $dialog.close();\n        toast(`Created ${result.created.join(', ')}. Try: hop ${result.created[0]}`);\n        await refresh();\n      } catch (error) {\n        fail(error);\n      }\n    }),\n  );\n\n  const body =\n    targets.length === 0\n      ? h('p', { class: 'empty' }, 'This source has no accounts or roles assigned to you.')\n      : h(\n          'div',\n          {},\n          filter,\n          h(\n            'div',\n            { class: 'targets' },\n            rows.map((r) => r.el),\n          ),\n        );\n  showDialog(`Aliases for ${source.id}`, body, [\n    h('span', { class: 'note' }, 'Check an account/role, then name its alias and region.'),\n    h('button', { onclick: () => $dialog.close() }, 'Cancel'),\n    targets.length ? save : null,\n  ]);\n}\n\n$addSource.addEventListener('click', () => openAddSource());\n\nif (!token) {\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Open the link from your terminal'),\n      h('p', {}, 'Run cloudhop ui and open the link it prints. It includes a one-time access key.'),\n    ),\n  );\n} else {\n  readRoute();\n  refresh();\n}\n";
+var app_default = "// cloudhop local UI. Plain DOM, no build step: served as-is by `cloudhop ui`.\n\nconst TOKEN_KEY = 'cloudhop-token';\nconst SESSION_TEXT = {\n  valid: 'Session valid',\n  refreshable: 'Renews on next use',\n  expired: 'Expired: sign in on next use',\n  unknown: 'Managed by the cloud CLI',\n};\n\n// The token arrives in the URL fragment once; keep it for this tab and clean the address bar.\nconst fromHash = new URLSearchParams(location.hash.slice(1)).get('token');\nif (fromHash) {\n  try {\n    sessionStorage.setItem(TOKEN_KEY, fromHash);\n  } catch {}\n  history.replaceState(null, '', location.pathname);\n}\nlet token = fromHash;\ntry {\n  token = token ?? sessionStorage.getItem(TOKEN_KEY);\n} catch {}\n\n// ---------- pages ----------\n\nconst PAGES = {\n  aliases: 'Aliases',\n  sources: 'Sources',\n  assistants: 'AI assistants',\n  tools: 'Tools',\n};\nlet route = 'aliases';\nconst aliasFilter = { text: '', source: '', prodOnly: false };\n\n/** `#/aliases?source=acme` \u2192 route \"aliases\", filtered by that source. */\nfunction readRoute() {\n  const match = /^#\\/([a-z]+)(?:\\?(.*))?$/.exec(location.hash);\n  // Own keys only: \"#/constructor\" must not reach Object.prototype.\n  route = match && Object.hasOwn(PAGES, match[1]) ? match[1] : 'aliases';\n  const query = new URLSearchParams(match?.[2] ?? '');\n  if (query.has('source')) aliasFilter.source = query.get('source');\n}\n\nfunction go(page, query) {\n  location.hash = `#/${page}${query ? `?${new URLSearchParams(query)}` : ''}`;\n}\n\n// A fresh link opened in this same tab carries a new token: reload to pick it up.\n// Any other fragment is a page change.\naddEventListener('hashchange', () => {\n  if (new URLSearchParams(location.hash.slice(1)).has('token')) {\n    location.reload();\n    return;\n  }\n  readRoute();\n  if (state) render();\n});\n\nconst $main = document.getElementById('main');\nconst $dialog = document.getElementById('dialog');\nconst $toasts = document.getElementById('toasts');\nconst $addSource = document.getElementById('add-source');\nconst $nav = document.getElementById('nav');\nlet state;\n\n/** Tiny element builder: h('button', { class: 'primary', onclick }, 'Save'). */\nfunction h(tag, attrs = {}, ...children) {\n  const el = document.createElement(tag);\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null || value === false) continue;\n    if (key.startsWith('on')) el.addEventListener(key.slice(2), value);\n    else if (key === 'class') el.className = value;\n    else if (value === true) el.setAttribute(key, '');\n    else el.setAttribute(key, value);\n  }\n  for (const child of children.flat()) {\n    if (child === undefined || child === null || child === false) continue;\n    el.append(child instanceof Node ? child : document.createTextNode(String(child)));\n  }\n  return el;\n}\n\nclass ApiError extends Error {\n  constructor(message, hint) {\n    super(message);\n    this.hint = hint;\n  }\n}\n\n// Calls that may sign in wait for the person in the browser; everything else should answer quickly.\nconst MAY_SIGN_IN = /^\\/api\\/(sources(\\/[^/]+\\/(login|sync|targets))?|aliases\\/[^/]+\\/console)$/;\nconst QUICK_TIMEOUT_MS = 20_000;\n\nasync function api(method, path, body) {\n  const waitsForPerson = MAY_SIGN_IN.test(path);\n  let response;\n  try {\n    response = await fetch(path, {\n      method,\n      headers: {\n        'x-cloudhop-token': token ?? '',\n        ...(body ? { 'content-type': 'application/json' } : {}),\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: waitsForPerson ? undefined : AbortSignal.timeout(QUICK_TIMEOUT_MS),\n    });\n  } catch (error) {\n    if (error.name === 'TimeoutError') {\n      throw new ApiError(\n        'cloudhop ui is not responding.',\n        'Is it paused in your terminal (Ctrl-Z)? Run `fg` there, or stop it and run `cloudhop ui` again.',\n      );\n    }\n    throw new ApiError(\n      'cloudhop ui is not running.',\n      'Run `cloudhop ui` again and open the new link it prints.',\n    );\n  }\n  const data = await response.json().catch(() => ({}));\n  if (!response.ok)\n    throw new ApiError(data.error ?? `Request failed (${response.status}).`, data.hint);\n  return data;\n}\n\nfunction toast(message, { error = false, hint } = {}) {\n  const el = h(\n    'div',\n    { class: `toast${error ? ' error' : ''}` },\n    message,\n    hint && h('small', {}, hint),\n  );\n  $toasts.append(el);\n  setTimeout(() => el.remove(), error ? 9000 : 4000);\n}\n\nconst fail = (error) => toast(error.message, { error: true, hint: error.hint });\n\n/** Disables a button while its action runs. */\nasync function busy(button, action) {\n  button.disabled = true;\n  try {\n    return await action();\n  } finally {\n    button.disabled = false;\n  }\n}\n\nasync function refresh() {\n  try {\n    state = await api('GET', '/api/state');\n    render();\n    checkDoctor();\n  } catch (error) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Cannot reach cloudhop'),\n        h('p', {}, error.message, error.hint ? ` ${error.hint}` : ''),\n      ),\n    );\n  }\n}\n\nasync function checkDoctor() {\n  try {\n    const entries = await api('GET', '/api/doctor');\n    const problems = entries.filter((e) => !e.installed || e.outdated);\n    document.getElementById('doctor')?.remove();\n    if (problems.length === 0) return;\n    $main.prepend(\n      h(\n        'div',\n        { class: 'notice', id: 'doctor' },\n        ...problems.map((e) =>\n          h(\n            'div',\n            {},\n            e.installed\n              ? `${e.cli} ${e.version} is older than ${e.minVersion}. `\n              : `${e.cli} is not installed, so aliases cannot run commands yet. `,\n            'Run ',\n            h('code', {}, 'cloudhop doctor'),\n            ' in a terminal to install it.',\n          ),\n        ),\n      ),\n    );\n  } catch {}\n}\n\n// ---------- main view ----------\n\nfunction render() {\n  const enabled = state.enabledProviders;\n  $addSource.hidden = enabled.length === 0;\n  $nav.hidden = enabled.length === 0;\n  if (enabled.length === 0) return renderChooseClouds();\n  for (const link of $nav.querySelectorAll('a')) {\n    if (link.dataset.page === route) link.setAttribute('aria-current', 'page');\n    else link.removeAttribute('aria-current');\n  }\n  document.title = `${PAGES[route]} \xB7 cloudhop`;\n  const pages = new Map([\n    ['aliases', aliasesPage],\n    ['sources', sourcesPage],\n    ['assistants', assistantsPage],\n    ['tools', toolsPage],\n  ]);\n  const page = pages.get(route) ?? aliasesPage;\n  $main.replaceChildren(...page());\n  if (route === 'assistants') loadAssistants();\n  if (route === 'tools') loadTools();\n}\n\nfunction pageHead(title, subtitle, ...actions) {\n  return h(\n    'div',\n    { class: 'page-head' },\n    h('div', {}, h('h1', {}, title), subtitle ? h('p', {}, subtitle) : null),\n    h('div', { class: 'actions' }, actions),\n  );\n}\n\nfunction firstSourceHero() {\n  return h(\n    'div',\n    { class: 'hero' },\n    h('h2', {}, 'Add your first account'),\n    h(\n      'p',\n      {},\n      'Add a company SSO portal or a personal account. cloudhop signs you in, finds every account and role you can use, and lets you give each one a short alias.',\n    ),\n    h('button', { class: 'primary', onclick: () => openAddSource() }, '+ Add source'),\n  );\n}\n\n// ---------- Aliases page ----------\n\nfunction aliasesPage() {\n  if (state.sources.length === 0) return [firstSourceHero()];\n  if (aliasFilter.source && !state.sources.some((s) => s.id === aliasFilter.source))\n    aliasFilter.source = '';\n\n  const addAliases = () => {\n    const source =\n      state.sources.find((s) => s.id === aliasFilter.source) ??\n      (state.sources.length === 1 ? state.sources[0] : undefined);\n    if (source) openAliasPicker(source);\n    else openSourceChooser();\n  };\n  const head = pageHead(\n    'Aliases',\n    'Each alias is one account, role and region. Run it with hop <alias>.',\n    h('button', { onclick: addAliases }, '+ Aliases'),\n  );\n  if (state.aliases.length === 0) {\n    return [\n      head,\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'No aliases yet'),\n        h('p', {}, 'Pick the accounts and roles you use and give each one a short name.'),\n        h('button', { class: 'primary', onclick: addAliases }, 'Pick accounts'),\n      ),\n    ];\n  }\n\n  const rows = h('tbody', { id: 'alias-rows' });\n  const count = h('span', { class: 'count' });\n  const fill = () => {\n    const words = aliasFilter.text.toLowerCase().split(/\\s+/).filter(Boolean);\n    const visible = state.aliases.filter((a) => {\n      if (aliasFilter.source && a.source !== aliasFilter.source) return false;\n      if (aliasFilter.prodOnly && !a.prod) return false;\n      const text = `${a.name} ${a.label ?? a.target} ${a.region ?? ''} ${a.source}`.toLowerCase();\n      return words.every((w) => text.includes(w));\n    });\n    rows.replaceChildren(\n      ...(visible.length\n        ? visible.map(aliasRow)\n        : [\n            h(\n              'tr',\n              {},\n              h('td', { colspan: '5', class: 'empty' }, 'No alias matches these filters.'),\n            ),\n          ]),\n    );\n    count.textContent = `${visible.length} of ${state.aliases.length}`;\n  };\n\n  const search = h('input', {\n    type: 'search',\n    placeholder: 'Filter: name, account, role or region',\n    value: aliasFilter.text,\n    'aria-label': 'Filter aliases',\n    oninput: (e) => {\n      aliasFilter.text = e.currentTarget.value;\n      fill();\n    },\n  });\n  const sourceSelect = h(\n    'select',\n    {\n      'aria-label': 'Source',\n      onchange: (e) => {\n        aliasFilter.source = e.currentTarget.value;\n        fill();\n      },\n    },\n    h('option', { value: '' }, 'All sources'),\n    state.sources.map((s) =>\n      h('option', { value: s.id, selected: s.id === aliasFilter.source }, s.id),\n    ),\n  );\n  const prodOnly = h(\n    'label',\n    { class: 'prod-toggle' },\n    h('input', {\n      type: 'checkbox',\n      checked: aliasFilter.prodOnly,\n      onchange: (e) => {\n        aliasFilter.prodOnly = e.currentTarget.checked;\n        fill();\n      },\n    }),\n    'Production only',\n  );\n\n  const table = h(\n    'table',\n    { class: 'aliases' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Alias'),\n        h('th', {}, 'Source'),\n        h('th', {}, 'Region'),\n        h('th', {}, 'Account / role'),\n        h('th'),\n      ),\n    ),\n    rows,\n  );\n  fill();\n  return [\n    head,\n    h(\n      'div',\n      { class: 'toolbar' },\n      search,\n      sourceSelect,\n      prodOnly,\n      h('div', { class: 'spacer' }),\n      count,\n    ),\n    h('section', { class: 'card' }, table),\n  ];\n}\n\n/** When several sources exist, ask which one to pick accounts from. */\nfunction openSourceChooser() {\n  showDialog(\n    'Add aliases from',\n    h(\n      'div',\n      { class: 'choices' },\n      state.sources.map((source) =>\n        h(\n          'button',\n          { class: 'choice', onclick: () => openAliasPicker(source) },\n          h(\n            'span',\n            {},\n            h('strong', {}, source.id),\n            h('small', {}, source.settings.startUrl ?? source.kindLabel),\n          ),\n        ),\n      ),\n    ),\n  );\n}\n\n// ---------- Sources page ----------\n\nfunction sourcesPage() {\n  const head = pageHead('Sources', 'The SSO portals and personal accounts you sign in to.');\n  if (state.sources.length === 0) return [head, firstSourceHero()];\n  return [head, ...state.sources.map(sourceCard)];\n}\n\n// ---------- AI assistants page ----------\n\nfunction assistantsPage() {\n  return [assistantsCard()];\n}\n\n// ---------- Tools page ----------\n\nfunction snippet(command) {\n  return h(\n    'div',\n    { class: 'snippet' },\n    h('code', {}, command),\n    h(\n      'button',\n      {\n        class: 'link',\n        title: 'Copy',\n        'aria-label': `Copy ${command}`,\n        onclick: () =>\n          navigator.clipboard\n            ?.writeText(command)\n            .then(() => toast('Copied.'))\n            .catch(() =>\n              toast('Copy it by hand: the browser blocked the clipboard.', { error: true }),\n            ),\n      },\n      'Copy',\n    ),\n  );\n}\n\nfunction toolCard(title, text, ...commands) {\n  return h(\n    'section',\n    { class: 'card' },\n    h('div', { class: 'card-head' }, h('h2', {}, title)),\n    h(\n      'div',\n      { class: 'card-body padded' },\n      h('p', { class: 'card-help' }, text),\n      commands.map(snippet),\n    ),\n  );\n}\n\nfunction toolsPage() {\n  const sample = state.aliases[0]?.name ?? 'acme-dev';\n  return [\n    pageHead('Tools', 'More ways to use cloudhop from your terminal.'),\n    h(\n      'section',\n      { class: 'card', id: 'tools-cli' },\n      h('div', { class: 'card-head' }, h('h2', {}, 'Cloud CLIs')),\n      h('div', { class: 'card-body padded' }, h('p', { class: 'card-help' }, 'Checking\u2026')),\n    ),\n    toolCard(\n      'Shell integration',\n      'Pick aliases from a list, tab-complete them, and use one in your shell so plain aws and Terraform work without hop.',\n      'cloudhop shell install',\n      `cloudhop use ${sample}`,\n      'hop',\n    ),\n    toolCard(\n      'Run in many accounts',\n      'Run one command in many aliases at once: names, lists, wildcards or /regex/. It asks before running.',\n      `cloudhop each '${sample.split('-')[0]}-*' -- s3 ls`,\n    ),\n    toolCard(\n      'Share with your team',\n      'Export your portals and aliases (no secrets) and let teammates import them in one command.',\n      'cloudhop team export --out team.yaml',\n      'cloudhop team import team.yaml',\n    ),\n  ];\n}\n\nasync function loadTools() {\n  const card = document.querySelector('#tools-cli .card-body');\n  if (!card) return;\n  try {\n    const entries = await api('GET', '/api/doctor');\n    card.replaceChildren(\n      ...entries.map((e) =>\n        h(\n          'div',\n          { class: 'tool-row' },\n          h('span', { class: `badge ${e.installed && !e.outdated ? 'valid' : 'expired'}` }, e.cli),\n          h(\n            'span',\n            {},\n            !e.installed\n              ? 'Not installed.'\n              : e.outdated\n                ? `${e.version} is older than ${e.minVersion}.`\n                : `Version ${e.version}.`,\n          ),\n          e.installed && !e.outdated ? null : snippet('cloudhop doctor'),\n        ),\n      ),\n    );\n  } catch (error) {\n    card.replaceChildren(h('p', { class: 'card-help' }, error.message));\n  }\n}\n\n// ---------- AI assistants ----------\n\nlet assistantScope = 'user';\ntry {\n  assistantScope =\n    localStorage.getItem('cloudhop-assistant-scope') === 'project' ? 'project' : 'user';\n} catch {}\nlet assistantsData;\n\nconst SKILL_TEXT = {\n  current: ['valid', 'Up to date'],\n  outdated: ['refreshable', 'Outdated'],\n  modified: ['refreshable', 'Edited by you'],\n  missing: ['', 'Not installed'],\n};\nconst MCP_TEXT = { registered: 'On', missing: 'Off', unknown: 'Check in the app' };\n\nfunction assistantsCard() {\n  return h('section', { class: 'card', id: 'assistants', hidden: true });\n}\n\nasync function loadAssistants() {\n  try {\n    assistantsData = await api('GET', '/api/assistants');\n    renderAssistants();\n  } catch {\n    document.getElementById('assistants')?.remove();\n  }\n}\n\nfunction setAssistantScope(scope) {\n  assistantScope = scope;\n  try {\n    localStorage.setItem('cloudhop-assistant-scope', scope);\n  } catch {}\n  renderAssistants();\n}\n\nfunction assistantAction(label, run, { danger = false, confirmText } = {}) {\n  return h(\n    'button',\n    {\n      class: danger ? 'danger' : undefined,\n      onclick: (e) => {\n        if (confirmText && !confirm(confirmText)) return;\n        busy(e.currentTarget, async () => {\n          try {\n            await run();\n          } catch (error) {\n            fail(error);\n          }\n          await loadAssistants();\n        });\n      },\n    },\n    label,\n  );\n}\n\nfunction reportInstall(results) {\n  for (const r of results) {\n    if (r.mcp === 'manual') {\n      toast(`${r.name}: skill installed. Add the MCP server by hand.`, { hint: r.mcpManual });\n    } else {\n      toast(`${r.name} now knows cloudhop. Start a new chat so it picks it up.`);\n    }\n  }\n}\n\nfunction renderAssistants() {\n  const el = document.getElementById('assistants');\n  if (!el || !assistantsData) return;\n  const rows = assistantScope === 'user' ? assistantsData.user : assistantsData.projectScope;\n  const scope = assistantScope;\n  const install = (tools) =>\n    api('POST', '/api/assistants', { tools, scope, mcp: true }).then((r) =>\n      reportInstall(r.results),\n    );\n  const missingDetected = rows\n    .filter((r) => r.detected && r.skill === 'missing')\n    .map((r) => r.assistant);\n\n  const seg = h(\n    'div',\n    { class: 'seg', role: 'group', 'aria-label': 'Where' },\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'user'), onclick: () => setAssistantScope('user') },\n      'For me',\n    ),\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'project'), onclick: () => setAssistantScope('project') },\n      'This project',\n    ),\n  );\n\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, 'AI assistants'),\n    h(\n      'span',\n      { class: 'meta' },\n      scope === 'user'\n        ? 'Installed in your home folder, for every project'\n        : assistantsData.project,\n    ),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      seg,\n      missingDetected.length > 1\n        ? assistantAction('Install for all detected', () => install(missingDetected))\n        : null,\n    ),\n  );\n\n  const table = h(\n    'table',\n    { class: 'assistants' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Assistant'),\n        h('th', {}, 'Skill'),\n        h('th', {}, 'MCP server'),\n        h('th'),\n      ),\n    ),\n    h(\n      'tbody',\n      {},\n      rows.map((r) => {\n        const [badgeClass, skillText] = SKILL_TEXT[r.skill];\n        const actions = [];\n        if (r.skill === 'missing')\n          actions.push(assistantAction('Install', () => install([r.assistant])));\n        if (r.skill === 'outdated') {\n          actions.push(\n            assistantAction('Update', () =>\n              api('POST', '/api/assistants/update', {}).then(() =>\n                toast(`${r.name}: skill updated.`),\n              ),\n            ),\n          );\n        }\n        if (r.skill === 'modified') {\n          actions.push(\n            assistantAction(\n              'Replace',\n              () =>\n                api('POST', '/api/assistants/update', { force: true }).then(() =>\n                  toast('Edited skills replaced.'),\n                ),\n              {\n                confirmText: 'Replace your edited copies with the current cloudhop skill?',\n              },\n            ),\n          );\n        }\n        if (r.skill !== 'missing' || r.mcp === 'registered') {\n          actions.push(\n            assistantAction(\n              'Remove',\n              () => api('POST', '/api/assistants/remove', { tools: [r.assistant], scope }),\n              {\n                danger: true,\n                confirmText: `Remove the cloudhop skill and MCP server from ${r.name}?`,\n              },\n            ),\n          );\n        }\n        return h(\n          'tr',\n          {},\n          h(\n            'td',\n            { class: 'alias' },\n            r.name,\n            r.detected ? null : h('small', { class: 'muted-inline' }, ' not detected'),\n          ),\n          h('td', {}, h('span', { class: `badge ${badgeClass}`, title: r.skillPath }, skillText)),\n          h('td', {}, r.skill === 'missing' && r.mcp !== 'registered' ? '' : MCP_TEXT[r.mcp]),\n          h(\n            'td',\n            { style: 'text-align:right' },\n            h('div', { class: 'actions', style: 'justify-content:flex-end' }, actions),\n          ),\n        );\n      }),\n    ),\n  );\n\n  el.replaceChildren(\n    head,\n    h(\n      'div',\n      { class: 'card-body' },\n      h(\n        'p',\n        { class: 'card-help' },\n        'Teach your AI assistant to use cloudhop: it asks you which alias to work with, runs commands with hop, and confirms before changing anything. Includes the cloudhop MCP server.',\n      ),\n      table,\n    ),\n  );\n  el.hidden = false;\n}\n\nfunction renderChooseClouds() {\n  const boxes = state.providers.map((p) =>\n    h(\n      'label',\n      { class: 'choice' },\n      h('input', { type: 'checkbox', value: p.id, checked: true }),\n      h('span', {}, p.name),\n    ),\n  );\n  const save = h(\n    'button',\n    {\n      class: 'primary',\n      onclick: (e) =>\n        busy(e.currentTarget, async () => {\n          const ids = boxes\n            .map((b) => b.querySelector('input'))\n            .filter((i) => i.checked)\n            .map((i) => i.value);\n          await api('PUT', '/api/providers', { enabled: ids }).catch(fail);\n          await refresh();\n        }),\n    },\n    'Continue',\n  );\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Which clouds do you use?'),\n      h('p', {}, 'Azure and Google Cloud are coming soon.'),\n      h(\n        'div',\n        { class: 'choices', style: 'max-width:320px;margin:0 auto 16px;text-align:left' },\n        boxes,\n      ),\n      save,\n    ),\n  );\n}\n\nfunction sourceCard(source) {\n  const aliases = state.aliases.filter((a) => a.source === source.id);\n  const where = source.settings.startUrl ?? source.kindLabel;\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, source.id),\n    h('span', { class: `badge ${source.session}` }, SESSION_TEXT[source.session] ?? source.session),\n    h('span', { class: 'meta' }, `${source.providerName} \xB7 ${where}`),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      h('button', { onclick: () => openAliasPicker(source) }, '+ Aliases'),\n      h(\n        'button',\n        {\n          title: 'Sign in again and refresh its accounts',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              toast('Opening the browser to sign in\u2026');\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/login`,\n              ).catch(fail);\n              if (report)\n                toast(`${source.id}: signed in, ${report.targets.length} account/role(s).`);\n              await refresh();\n            }),\n        },\n        'Sign in',\n      ),\n      h(\n        'button',\n        {\n          title: 'Refresh the accounts and roles you have access to',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/sync`,\n              ).catch(fail);\n              if (report) toast(syncMessage(source.id, report));\n              await refresh();\n            }),\n        },\n        'Sync',\n      ),\n      h(\n        'button',\n        {\n          class: 'danger',\n          onclick: (e) => {\n            const count = aliases.length;\n            const message = `Remove \"${source.id}\"${count ? ` and its ${count} alias(es)` : ''}?`;\n            if (!confirm(message)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/sources/${encodeURIComponent(source.id)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        'Remove',\n      ),\n    ),\n  );\n\n  const prodCount = aliases.filter((a) => a.prod).length;\n  const body =\n    aliases.length === 0\n      ? h(\n          'div',\n          { class: 'empty' },\n          'No aliases yet. ',\n          h(\n            'button',\n            { class: 'primary', onclick: () => openAliasPicker(source) },\n            'Pick accounts',\n          ),\n        )\n      : h(\n          'div',\n          { class: 'source-summary' },\n          h(\n            'span',\n            {},\n            `${aliases.length} alias(es)`,\n            prodCount ? h('span', { class: 'prod-tag' }, `${prodCount} PROD`) : null,\n          ),\n          h(\n            'button',\n            { class: 'link', onclick: () => go('aliases', { source: source.id }) },\n            'View aliases \u2192',\n          ),\n        );\n  return h('section', { class: 'card' }, head, h('div', { class: 'card-body' }, body));\n}\n\nfunction syncMessage(id, report) {\n  const parts = [`${report.targets.length} available`];\n  if (report.added) parts.push(`${report.added} new`);\n  if (report.removed) parts.push(`${report.removed} removed`);\n  const orphaned = report.orphanedAliases.length\n    ? ` No longer available: ${report.orphanedAliases.join(', ')}.`\n    : '';\n  return `${id}: ${parts.join(', ')}.${orphaned}`;\n}\n\nfunction aliasRow(alias) {\n  const input = h('input', {\n    value: alias.region ?? '',\n    'aria-label': `Region for ${alias.name}`,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  const save = h('button', { hidden: true }, 'Save');\n  const commit = () =>\n    busy(save, async () => {\n      const region = input.value.trim();\n      const done = await api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, {\n        region,\n      }).catch(fail);\n      if (done) toast(`${alias.name} now runs in ${region}.`);\n      await refresh();\n    });\n  input.addEventListener('input', () => {\n    save.hidden = input.value.trim() === (alias.region ?? '');\n  });\n  input.addEventListener('keydown', (e) => {\n    if (e.key === 'Enter' && !save.hidden) commit();\n    if (e.key === 'Escape') {\n      input.value = alias.region ?? '';\n      save.hidden = true;\n    }\n  });\n  save.addEventListener('click', commit);\n\n  const patch = (body, message) =>\n    api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, body)\n      .then(() => message && toast(message))\n      .catch(fail)\n      .then(refresh);\n  const iconButton = (label, title, onclick, extra = {}) =>\n    h('button', { class: 'link', title, 'aria-label': title, onclick, ...extra }, label);\n\n  const actions = h(\n    'div',\n    { class: 'row-actions' },\n    h(\n      'button',\n      {\n        title: `Open the AWS console as ${alias.name}, already signed in`,\n        disabled: alias.missing,\n        onclick: (e) =>\n          busy(e.currentTarget, async () => {\n            const result = await api(\n              'POST',\n              `/api/aliases/${encodeURIComponent(alias.name)}/console`,\n              {},\n            ).catch(fail);\n            if (result) {\n              toast(\n                result.via === 'signed-in'\n                  ? `Opened the console for ${alias.name}.`\n                  : result.via === 'portal'\n                    ? `Opened ${alias.name} through the SSO portal.`\n                    : `Opened the console sign-in page for ${alias.name}.`,\n              );\n            }\n          }),\n      },\n      'Console',\n    ),\n    h(\n      'label',\n      { class: 'prod-toggle', title: 'Production: hop and AI assistants ask before any change' },\n      h('input', {\n        type: 'checkbox',\n        checked: alias.prod,\n        'aria-label': `${alias.name} is production`,\n        onchange: (e) =>\n          patch(\n            { prod: e.currentTarget.checked },\n            e.currentTarget.checked\n              ? `${alias.name} is now production.`\n              : `${alias.name} is no longer production.`,\n          ),\n      }),\n      'Prod',\n    ),\n    iconButton('\u270E', `Rename ${alias.name}`, () => {\n      const to = prompt(`New name for \"${alias.name}\"`, alias.name)?.trim();\n      if (to && to !== alias.name) patch({ name: to }, `${alias.name} is now ${to}.`);\n    }),\n    iconButton(\n      '\u2715',\n      `Remove ${alias.name}`,\n      (e) => {\n        if (!confirm(`Remove alias \"${alias.name}\"?`)) return;\n        busy(e.currentTarget, async () => {\n          await api('DELETE', `/api/aliases/${encodeURIComponent(alias.name)}`).catch(fail);\n          await refresh();\n        });\n      },\n      { class: 'link danger-hover' },\n    ),\n  );\n\n  return h(\n    'tr',\n    { class: alias.prod ? 'prod' : undefined },\n    h(\n      'td',\n      { class: 'alias', title: `hop ${alias.name} <command>` },\n      alias.name,\n      alias.prod ? h('span', { class: 'prod-tag' }, 'PROD') : null,\n    ),\n    h('td', { class: 'muted' }, alias.source),\n    h('td', {}, h('div', { class: 'region' }, input, save)),\n    h(\n      'td',\n      {},\n      alias.missing\n        ? h('span', { class: 'missing' }, `${alias.target} (no longer available)`)\n        : alias.label,\n    ),\n    h('td', { style: 'text-align:right' }, actions),\n  );\n}\n\n// ---------- dialogs ----------\n\nfunction showDialog(title, body, footer) {\n  $dialog.replaceChildren(\n    h(\n      'div',\n      { class: 'dlg-head' },\n      h('h2', {}, title),\n      h('button', { class: 'link', 'aria-label': 'Close', onclick: () => $dialog.close() }, '\u2715'),\n    ),\n    h('div', { class: 'dlg-body' }, body),\n    footer ? h('div', { class: 'dlg-foot' }, footer) : null,\n  );\n  if (!$dialog.open) $dialog.showModal();\n}\n\nfunction suggestSourceId(settings, kind) {\n  const host = /^https:\\/\\/([^./]+)\\./.exec(settings.startUrl ?? '')?.[1];\n  return slug(host ?? (kind === 'console-login' ? 'personal' : 'main'));\n}\n\nconst slug = (text) =>\n  text\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 63) || 'main';\n\n/** `previous` refills the form after a failed sign-in: { provider, kind, id, settings, error }. */\nfunction openAddSource(previous) {\n  const providers = state.providers.filter((p) => state.enabledProviders.includes(p.id));\n  let provider = providers.find((p) => p.id === previous?.provider) ?? providers[0];\n  let kind = provider.kinds.find((k) => k.kind === previous?.kind) ?? provider.kinds[0];\n\n  const form = h('form', { onsubmit: (e) => e.preventDefault() });\n  const nameInput = h('input', {\n    id: 'f-name',\n    required: true,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  let nameTouched = Boolean(previous);\n  nameInput.addEventListener('input', () => {\n    nameTouched = true;\n  });\n\n  const fieldInputs = {};\n  const fieldsBox = h('div');\n  const nameLabel = h('label', { for: 'f-name' });\n\n  function updateSuggestion() {\n    if (nameTouched) return;\n    const settings = Object.fromEntries(\n      Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n    );\n    const taken = new Set(state.sources.map((s) => s.id));\n    let id = suggestSourceId(settings, kind.kind);\n    for (let i = 2; taken.has(id); i++) id = `${suggestSourceId(settings, kind.kind)}-${i}`;\n    nameInput.value = id;\n  }\n\n  function renderFields() {\n    for (const key of Object.keys(fieldInputs)) delete fieldInputs[key];\n    fieldsBox.replaceChildren(\n      ...kind.fields.map((f) => {\n        const input = h('input', {\n          id: `f-${f.key}`,\n          placeholder: f.placeholder ?? f.defaultValue ?? '',\n          value: previous?.settings?.[f.key] ?? f.defaultValue ?? '',\n          required: true,\n          class: 'mono',\n          spellcheck: 'false',\n          oninput: updateSuggestion,\n        });\n        fieldInputs[f.key] = input;\n        return h('div', { class: 'field' }, h('label', { for: input.id }, f.label), input);\n      }),\n    );\n    nameLabel.textContent = kind.nameLabel ?? 'Short name for this source';\n    updateSuggestion();\n  }\n\n  const providerSelect =\n    providers.length > 1\n      ? h(\n          'div',\n          { class: 'field' },\n          h('label', { for: 'f-provider' }, 'Cloud'),\n          h(\n            'select',\n            {\n              id: 'f-provider',\n              onchange: (e) => {\n                provider = providers.find((p) => p.id === e.target.value);\n                kind = provider.kinds[0];\n                renderKinds();\n              },\n            },\n            providers.map((p) => h('option', { value: p.id, selected: p === provider }, p.name)),\n          ),\n        )\n      : null;\n\n  const kindsBox = h('div', { class: 'choices' });\n  function renderKinds() {\n    kindsBox.replaceChildren(\n      ...provider.kinds.map((k) =>\n        h(\n          'label',\n          { class: 'choice' },\n          h('input', {\n            type: 'radio',\n            name: 'kind',\n            value: k.kind,\n            checked: k === kind,\n            onchange: () => {\n              kind = k;\n              renderFields();\n            },\n          }),\n          h('span', {}, h('strong', {}, k.label), k.hint ? h('small', {}, k.hint) : null),\n        ),\n      ),\n    );\n    renderFields();\n  }\n\n  form.append(\n    previous?.error\n      ? h(\n          'div',\n          { class: 'notice error' },\n          h('strong', {}, 'Could not sign in, so nothing was saved. '),\n          previous.error.message,\n          previous.error.hint ? h('div', { class: 'help' }, previous.error.hint) : null,\n        )\n      : '',\n    providerSelect ?? '',\n    h('div', { class: 'field' }, h('label', {}, 'What do you want to add?')),\n    kindsBox,\n    fieldsBox,\n    h(\n      'div',\n      { class: 'field' },\n      nameLabel,\n      nameInput,\n      h(\n        'span',\n        { class: 'help' },\n        'Lowercase letters, numbers and dashes. You will see it in ',\n        h('code', {}, 'cloudhop ls'),\n        '.',\n      ),\n    ),\n  );\n  renderKinds();\n  if (previous) nameInput.value = previous.id;\n\n  const submit = h('button', { class: 'primary', type: 'submit' }, 'Add and sign in');\n  form.addEventListener('submit', async () => {\n    if (!form.reportValidity()) return;\n    const body = {\n      provider: provider.id,\n      kind: kind.kind,\n      id: nameInput.value.trim(),\n      settings: Object.fromEntries(\n        Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n      ),\n    };\n    showDialog(\n      'Sign in',\n      h(\n        'div',\n        { class: 'waiting' },\n        h('div', { class: 'spinner' }),\n        h('strong', {}, 'Finish signing in in the browser tab that just opened.'),\n        h('p', { class: 'help' }, 'This page continues on its own once you approve the request.'),\n      ),\n    );\n    try {\n      const report = await api('POST', '/api/sources', body);\n      await refresh();\n      const source = state.sources.find((s) => s.id === body.id);\n      toast(`Signed in to ${body.id}. ${report.targets.length} account/role(s) found.`);\n      openAliasPicker(source, report.targets);\n    } catch (error) {\n      // Nothing was saved: reopen the form with what was typed so it can be fixed.\n      await refresh();\n      openAddSource({ ...body, error });\n    }\n  });\n\n  showDialog('Add source', form, [\n    h('button', { type: 'button', onclick: () => $dialog.close() }, 'Cancel'),\n    submit,\n  ]);\n  submit.setAttribute('form', 'add-form');\n  form.id = 'add-form';\n}\n\nasync function openAliasPicker(source, preloaded) {\n  let targets = preloaded;\n  if (!targets) {\n    showDialog(\n      `Aliases for ${source.id}`,\n      h('div', { class: 'waiting' }, h('div', { class: 'spinner' }), 'Loading accounts\u2026'),\n    );\n    try {\n      targets = (await api('GET', `/api/sources/${encodeURIComponent(source.id)}/targets`)).targets;\n    } catch (error) {\n      $dialog.close();\n      return fail(error);\n    }\n  }\n\n  const used = new Map(\n    state.aliases.filter((a) => a.source === source.id).map((a) => [a.target, a.name]),\n  );\n  const taken = new Set(state.aliases.map((a) => a.name));\n  const defaultRegion = source.settings.region ?? '';\n  const filter = h('input', {\n    type: 'search',\n    placeholder: `Filter ${targets.length} account/role(s)\u2026`,\n    style: 'width:100%;margin-bottom:12px',\n  });\n\n  const rows = targets.map((t) => {\n    const existing = used.get(t.id);\n    let name = t.suggestedAlias;\n    for (let i = 2; taken.has(name); i++) name = `${t.suggestedAlias}-${i}`;\n    const check = h('input', {\n      type: 'checkbox',\n      disabled: Boolean(existing),\n      'aria-label': t.label,\n    });\n    const aliasInput = h('input', {\n      value: name,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Alias for ${t.label}`,\n      placeholder: 'alias',\n    });\n    const regionInput = h('input', {\n      value: defaultRegion,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Region for ${t.label}`,\n      placeholder: 'region',\n    });\n    // Only the checkbox and its text sit in the label, so clicking the inputs never toggles it.\n    const el = h(\n      'div',\n      { class: 'target' },\n      h(\n        'label',\n        { class: 'pick' },\n        check,\n        h(\n          'span',\n          {},\n          t.label,\n          existing ? h('small', { class: 'already' }, `Already: ${existing}`) : null,\n        ),\n      ),\n      h('div', { class: 'inputs' }, aliasInput, regionInput),\n    );\n    return { target: t, el, check, aliasInput, regionInput };\n  });\n\n  filter.addEventListener('input', () => {\n    const q = filter.value.trim().toLowerCase();\n    for (const row of rows) row.el.hidden = q !== '' && !row.target.label.toLowerCase().includes(q);\n  });\n\n  const save = h('button', { class: 'primary' }, 'Create aliases');\n  save.addEventListener('click', () =>\n    busy(save, async () => {\n      const aliases = rows\n        .filter((r) => r.check.checked)\n        .map((r) => ({\n          source: source.id,\n          target: r.target.id,\n          name: r.aliasInput.value.trim(),\n          region: r.regionInput.value.trim(),\n        }));\n      if (aliases.length === 0) return toast('Pick at least one account/role.', { error: true });\n      try {\n        const result = await api('POST', '/api/aliases', { aliases });\n        $dialog.close();\n        toast(`Created ${result.created.join(', ')}. Try: hop ${result.created[0]}`);\n        await refresh();\n      } catch (error) {\n        fail(error);\n      }\n    }),\n  );\n\n  const body =\n    targets.length === 0\n      ? h('p', { class: 'empty' }, 'This source has no accounts or roles assigned to you.')\n      : h(\n          'div',\n          {},\n          filter,\n          h(\n            'div',\n            { class: 'targets' },\n            rows.map((r) => r.el),\n          ),\n        );\n  showDialog(`Aliases for ${source.id}`, body, [\n    h('span', { class: 'note' }, 'Check an account/role, then name its alias and region.'),\n    h('button', { onclick: () => $dialog.close() }, 'Cancel'),\n    targets.length ? save : null,\n  ]);\n}\n\n$addSource.addEventListener('click', () => openAddSource());\n\nif (!token) {\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Open the link from your terminal'),\n      h('p', {}, 'Run cloudhop ui and open the link it prints. It includes a one-time access key.'),\n    ),\n  );\n} else {\n  readRoute();\n  refresh();\n}\n";
 
 // ../ui/src/assets/index.html
 var assets_default = `<!doctype html>
@@ -13877,18 +14587,18 @@ async function startUiServer({
       sendJson(res, 400, { error: error.message });
     }
   });
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve3, reject) => {
     server.once("error", reject);
-    server.listen(port, "127.0.0.1", resolve);
+    server.listen(port, "127.0.0.1", resolve3);
   });
   const actualPort = server.address().port;
   allowedHosts = /* @__PURE__ */ new Set([`127.0.0.1:${actualPort}`, `localhost:${actualPort}`]);
   return {
     // The token travels in the fragment, so it never reaches server logs or Referer headers.
     url: `http://127.0.0.1:${actualPort}/#token=${token}`,
-    close: () => new Promise((resolve) => {
+    close: () => new Promise((resolve3) => {
       server.closeAllConnections();
-      server.close(() => resolve());
+      server.close(() => resolve3());
     })
   };
 }
@@ -13904,23 +14614,23 @@ async function uiCommand(app, assistants, { flags }) {
   console.log("Only this computer can open it, and the link works only while this runs.");
   console.log("Press Ctrl-C to stop.");
   if (!flags.noOpen) await new NodeBrowserOpener().open(server.url);
-  await new Promise((resolve) => {
-    process.once("SIGINT", resolve);
-    process.once("SIGTERM", resolve);
+  await new Promise((resolve3) => {
+    process.once("SIGINT", resolve3);
+    process.once("SIGTERM", resolve3);
   });
   await server.close();
 }
 
 // src/container.ts
-import { homedir as homedir4 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join10 } from "path";
 
 // ../provider-aws/src/aws-provider.ts
-import { join as join7 } from "path";
+import { join as join9 } from "path";
 
 // ../provider-aws/src/aws-config.ts
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname4 } from "path";
+import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile7 } from "fs/promises";
+import { dirname as dirname6 } from "path";
 var BLOCK_START = "# >>> cloudhop managed >>> (edit with `cloudhop`, not by hand)";
 var BLOCK_END = "# <<< cloudhop managed <<<";
 function renderBlock(sections) {
@@ -13967,13 +14677,13 @@ function replaceManagedBlock(content, sections) {
 async function writeManagedBlock(path2, sections) {
   let content = "";
   try {
-    content = await readFile5(path2, "utf8");
+    content = await readFile6(path2, "utf8");
   } catch {
   }
   const next = replaceManagedBlock(content, sections);
   if (next === content) return;
-  await mkdir4(dirname4(path2), { recursive: true, mode: 448 });
-  await writeFile4(path2, next, { mode: 384 });
+  await mkdir5(dirname6(path2), { recursive: true, mode: 448 });
+  await writeFile7(path2, next, { mode: 384 });
 }
 
 // ../provider-aws/src/console.ts
@@ -13998,17 +14708,17 @@ function consoleDestination(region, service) {
 async function federatedConsoleUrl(credentials, destination, region, fetchFn) {
   const {
     AWS_ACCESS_KEY_ID: id,
-    AWS_SECRET_ACCESS_KEY: key,
+    AWS_SECRET_ACCESS_KEY: key2,
     AWS_SESSION_TOKEN: token
   } = credentials;
-  if (!id || !key || !token) return void 0;
+  if (!id || !key2 || !token) return void 0;
   const { signin } = partitionHosts(region);
   const response = await fetchFn(`${signin}/federation`, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       Action: "getSigninToken",
-      Session: JSON.stringify({ sessionId: id, sessionKey: key, sessionToken: token })
+      Session: JSON.stringify({ sessionId: id, sessionKey: key2, sessionToken: token })
     }).toString()
   }).catch(() => void 0);
   if (!response?.ok) return void 0;
@@ -14024,7 +14734,9 @@ async function federatedConsoleUrl(credentials, destination, region, fetchFn) {
 }
 function portalShortcutUrl(startUrl, accountId, roleName, destination) {
   const params = new URLSearchParams({ account_id: accountId, role_name: roleName, destination });
-  return `${startUrl.replace(/\/+$/, "")}/#/console?${params}`;
+  let base = startUrl;
+  while (base.endsWith("/")) base = base.slice(0, -1);
+  return `${base}/#/console?${params}`;
 }
 
 // ../provider-aws/src/http.ts
@@ -14089,7 +14801,7 @@ var PortalClient = class {
     );
     return body.roleCredentials;
   }
-  async paginate(path2, params, key) {
+  async paginate(path2, params, key2) {
     const items = [];
     let nextToken;
     do {
@@ -14100,7 +14812,7 @@ var PortalClient = class {
         `${this.endpoint}${path2}?${query}`,
         this.headers()
       );
-      items.push(...page[key] ?? []);
+      items.push(...page[key2] ?? []);
       nextToken = page.nextToken;
     } while (nextToken);
     return items;
@@ -14111,7 +14823,7 @@ var PortalClient = class {
 };
 
 // ../provider-aws/src/sso/sso-login.ts
-import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash4, randomBytes as randomBytes2 } from "crypto";
 
 // ../provider-aws/src/sso/loopback.ts
 import { createServer as createServer2 } from "http";
@@ -14122,8 +14834,8 @@ var PAGE = (title, body) => `<!doctype html><meta charset="utf-8"><title>cloudho
 async function startLoopbackServer() {
   let resolveRequest = () => {
   };
-  const request = new Promise((resolve) => {
-    resolveRequest = resolve;
+  const request = new Promise((resolve3) => {
+    resolveRequest = resolve3;
   });
   const server = createServer2((req, res) => {
     const url = new URL(req.url ?? "/", "http://127.0.0.1");
@@ -14138,7 +14850,7 @@ async function startLoopbackServer() {
     );
     resolveRequest(url);
   });
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  await new Promise((resolve3) => server.listen(0, "127.0.0.1", resolve3));
   const { port } = server.address();
   return {
     redirectUri: `http://127.0.0.1:${port}${CALLBACK_PATH}`,
@@ -14244,24 +14956,24 @@ var OidcClient = class {
 };
 
 // ../provider-aws/src/sso/token-cache.ts
-import { createHash as createHash2 } from "crypto";
-import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
-import { join as join6 } from "path";
+import { createHash as createHash3 } from "crypto";
+import { mkdir as mkdir6, readFile as readFile7, writeFile as writeFile8 } from "fs/promises";
+import { join as join8 } from "path";
 var EXPIRY_MARGIN_MS = 5 * 60 * 1e3;
 function tokenCachePath(awsDir, sessionName) {
-  const hash = createHash2("sha1").update(sessionName).digest("hex");
-  return join6(awsDir, "sso", "cache", `${hash}.json`);
+  const hash = createHash3("sha1").update(sessionName).digest("hex");
+  return join8(awsDir, "sso", "cache", `${hash}.json`);
 }
 async function readToken(awsDir, sessionName) {
   try {
-    return JSON.parse(await readFile6(tokenCachePath(awsDir, sessionName), "utf8"));
+    return JSON.parse(await readFile7(tokenCachePath(awsDir, sessionName), "utf8"));
   } catch {
     return void 0;
   }
 }
 async function writeToken(awsDir, sessionName, token) {
-  await mkdir5(join6(awsDir, "sso", "cache"), { recursive: true, mode: 448 });
-  await writeFile5(tokenCachePath(awsDir, sessionName), JSON.stringify(token, null, 2), {
+  await mkdir6(join8(awsDir, "sso", "cache"), { recursive: true, mode: 448 });
+  await writeFile8(tokenCachePath(awsDir, sessionName), JSON.stringify(token, null, 2), {
     mode: 384
   });
 }
@@ -14304,7 +15016,7 @@ async function authorizationCodeLogin(options) {
       clientId: client.clientId,
       redirectUri: server.redirectUri,
       state,
-      codeChallenge: base64url(createHash3("sha256").update(codeVerifier).digest())
+      codeChallenge: base64url(createHash4("sha256").update(codeVerifier).digest())
     });
     options.interaction.notify("Opening your browser to log in\u2026");
     options.interaction.notify(`If it doesn't open, visit: ${url}`);
@@ -14330,7 +15042,7 @@ async function deviceCodeLogin(options) {
   let intervalMs = (device.interval ?? 5) * 1e3;
   const deadline = Date.now() + device.expiresIn * 1e3;
   while (Date.now() < deadline) {
-    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    await new Promise((resolve3) => setTimeout(resolve3, intervalMs));
     try {
       return toCachedToken(
         options,
@@ -14446,6 +15158,7 @@ var AwsProvider = class {
   displayName = "AWS";
   cli = { command: "aws", displayName: "AWS CLI v2", minVersion: "2.32.0" };
   identityArgs = ["sts", "get-caller-identity"];
+  shellVars = [...CREDENTIAL_VARS, "AWS_PROFILE", "AWS_REGION", "AWS_DEFAULT_REGION"];
   sourceKinds = [
     {
       kind: SSO_KIND,
@@ -14554,7 +15267,7 @@ var AwsProvider = class {
         }
       });
     }
-    await writeManagedBlock(join7(this.options.awsDir, "config"), sections);
+    await writeManagedBlock(join9(this.options.awsDir, "config"), sections);
   }
   async processEnv(resolved, mode) {
     const region = resolved.region;
@@ -14628,9 +15341,9 @@ var AwsProvider = class {
     if (!token) throw new CloudhopError("LOGIN_FAILED", `Not logged in to ${source.id}.`);
     return new PortalClient(this.setting(source, "region"), token.accessToken, this.fetchFn);
   }
-  setting(source, key) {
-    const value = source.settings[key];
-    if (!value) throw new CloudhopError("SOURCE_NOT_FOUND", `Source "${source.id}" has no ${key}.`);
+  setting(source, key2) {
+    const value = source.settings[key2];
+    if (!value) throw new CloudhopError("SOURCE_NOT_FOUND", `Source "${source.id}" has no ${key2}.`);
     return value;
   }
 };
@@ -14639,7 +15352,7 @@ var AwsProvider = class {
 var browser = new NodeBrowserOpener();
 function createApp(env = process.env) {
   const runner = new NodeProcessRunner();
-  const awsDir = env.CLOUDHOP_AWS_DIR ?? join8(homedir4(), ".aws");
+  const awsDir = env.CLOUDHOP_AWS_DIR ?? join10(homedir5(), ".aws");
   return new CloudhopApp({
     config: new YamlConfigStore(),
     providers: [
@@ -14658,33 +15371,39 @@ function createApp(env = process.env) {
 }
 function createAssistants(version, env = process.env) {
   return new AssistantsInstaller({
-    places: { home: homedir4(), project: process.cwd() },
+    places: { home: homedir5(), project: process.cwd() },
     configDir: defaultConfigDir(env),
     runner: new NodeProcessRunner(),
     cloudhopVersion: version
   });
 }
+function createTrustedFolders(env = process.env) {
+  return new TrustedFolders(defaultConfigDir(env));
+}
 
 // src/update-check.ts
-import { mkdir as mkdir6, readFile as readFile7, writeFile as writeFile6 } from "fs/promises";
-import { join as join9 } from "path";
+import { mkdir as mkdir7, readFile as readFile8, writeFile as writeFile9 } from "fs/promises";
+import { join as join11 } from "path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var REGISTRY_URL = "https://registry.npmjs.org/cloudhop/latest";
+var VERSION = /^\d{1,6}\.\d{1,6}\.\d{1,6}(?:-[0-9A-Za-z.]{1,40})?$/;
+var validVersion = (value) => typeof value === "string" && VERSION.test(value) ? value : void 0;
 function startUpdateCheck(configDir, current) {
   const env = process.env;
   if (env.CLOUDHOP_NO_UPDATE_CHECK === "1" || env.CI || !process.stderr.isTTY)
     return async () => {
     };
-  const file = join9(configDir, "update-check.json");
+  const file = join11(configDir, "update-check.json");
   const work = (async () => {
     let cache = { checkedAt: 0 };
     try {
-      cache = JSON.parse(await readFile7(file, "utf8"));
+      cache = JSON.parse(await readFile8(file, "utf8"));
     } catch {
     }
-    if (cache.latest && compareVersions(cache.latest, current) > 0) {
+    const cached = validVersion(cache.latest);
+    if (cached && compareVersions(cached, current) > 0) {
       process.stderr.write(
-        `\x1B[2mcloudhop \u203A\x1B[22m cloudhop ${cache.latest} is available (you have ${current}): npm i -g cloudhop
+        `\x1B[2mcloudhop \u203A\x1B[22m cloudhop ${cached} is available (you have ${current}): npm i -g cloudhop
 `
       );
     }
@@ -14694,19 +15413,24 @@ function startUpdateCheck(configDir, current) {
       signal: AbortSignal.timeout(1500)
     });
     if (!response.ok) return;
-    const { version } = await response.json();
-    if (typeof version !== "string") return;
-    await mkdir6(configDir, { recursive: true });
-    await writeFile6(file, JSON.stringify({ checkedAt: Date.now(), latest: version }));
+    const latest = validVersion((await response.json()).version);
+    if (!latest) return;
+    await mkdir7(configDir, { recursive: true });
+    await writeFile9(file, JSON.stringify({ checkedAt: Date.now(), latest }));
   })().catch(() => {
   });
-  return () => Promise.race([work, new Promise((resolve) => setTimeout(resolve, 300))]);
+  return () => Promise.race([work, new Promise((resolve3) => setTimeout(resolve3, 300))]);
 }
 
 // src/cli.ts
-var HELP = `cloudhop ${"1.2.1"}
+var HELP = `cloudhop ${"1.3.0"}
 Hop between cloud accounts, roles and regions with one command.
 
+Quick start
+  cloudhop add                   Sign in to an SSO portal or personal account, name aliases
+  cloudhop shell                 Set up your terminal (once)
+  cloudhop use <alias>           Switch this terminal to an alias, then type plain aws ...
+
 Usage
   hop <alias> [args...]          Run the cloud CLI as <alias> (no args: who am I)
   hop                            Pick the alias from a list, then type the command
@@ -14715,8 +15439,12 @@ Usage
                                  Open the web console as <alias>, already signed in
   cloudhop each <selection...> [--source <s>] [--prod|--no-prod] [--yes] [--json] -- <args...>
                                  Run one command in many aliases (names, a,b lists, 'globex-*', /regex/)
-  cloudhop use [alias] | --off    Use an alias in this shell (aws, terraform... without hop)
-  cloudhop shell [install]       Shell integration: cloudhop use, tab completion, cloudhop_prompt
+  cloudhop use [alias] [--save]  Use an alias in this terminal: then plain aws, terraform... run as it
+                                 (--save: remember it for this folder in .cloudhoprc)
+  cloudhop use --off [cloud]     Stop using the alias of every cloud, or just one (aws)
+  cloudhop allow | deny [folder] Trust (or stop trusting) a folder's .cloudhoprc
+  cloudhop shell                 Set up your terminal once: cloudhop use, .cloudhoprc on cd, completion
+  cloudhop shell starship        Prompt segments for Starship (alias in use, PROD in red)
   cloudhop exec <alias> [--region <r>] -- <cmd...>
                                  Run any tool with the alias' temporary credentials
 
@@ -14784,7 +15512,7 @@ async function main(argv) {
     return 0;
   }
   if (command === "--version" || command === "-v" || command === "version") {
-    console.log("1.2.1");
+    console.log("1.3.0");
     return 0;
   }
   const app = createApp();
@@ -14794,16 +15522,24 @@ async function main(argv) {
     return 0;
   }
   if (command === "shell") {
-    await shellCommand(local);
+    const clis = app.availableProviders().map((p3) => ({ command: p3.cli.command, provider: p3.id }));
+    await shellCommand(local, clis);
     return 0;
   }
+  if (command === "use" && local.some((a2) => a2 === "--emit" || a2.startsWith("--emit="))) {
+    return useCommand(app, createTrustedFolders(), local);
+  }
   if (command === "mcp") {
-    await serveMcp({ app, version: "1.2.1" });
+    await serveMcp({
+      app,
+      version: "1.3.0",
+      context: () => shellContext(createTrustedFolders())
+    });
     return 0;
   }
-  const assistants = createAssistants("1.2.1");
+  const assistants = createAssistants("1.3.0");
   await refreshAssistantSkills(assistants, command);
-  const finishUpdateCheck = startUpdateCheck(defaultConfigDir(), "1.2.1");
+  const finishUpdateCheck = startUpdateCheck(defaultConfigDir(), "1.3.0");
   try {
     return await dispatch(app, assistants, command, args, local);
   } finally {
@@ -14852,7 +15588,7 @@ async function dispatch(app, assistants, command, args, local) {
       return 0;
     case "ls":
     case "list":
-      await listCommand(app, local);
+      await listCommand(app, local, () => shellContext(createTrustedFolders()));
       return 0;
     case "rm":
     case "remove":
@@ -14873,7 +15609,10 @@ async function dispatch(app, assistants, command, args, local) {
       await teamCommand(app, local);
       return 0;
     case "use":
-      await useCommand(app, local);
+      return useCommand(app, createTrustedFolders(), local);
+    case "allow":
+    case "deny":
+      await allowCommand(app, createTrustedFolders(), local, command === "allow");
       return 0;
     case "each":
       return eachCommand(app, args);