directionallylocal 0.3.0 → 0.4.0

package/dist/laptop/config.js

@@ -9,47 +9,127 @@ export function remotesPath(env = process.env) {
     return join(configHome, "autopilot", "remotes.json");
 }
 export async function loadRemotes(path = remotesPath()) {
+    return (await loadRemotesFile(path)).remotes;
+}
+/**
+ * The remotes with the default and last-used names. A name that no longer matches a
+ * remote (it was removed, or renamed by something that didn't know) is dropped.
+ */
+export async function loadRemotesFile(path = remotesPath()) {
     let raw;
     try {
         raw = await readFile(path, "utf8");
     }
     catch (error) {
         if (error.code === "ENOENT")
-            return [];
+            return { remotes: [] };
         throw error;
     }
     const parsed = JSON.parse(raw);
-    return Array.isArray(parsed.remotes) ? parsed.remotes.filter(isRemote) : [];
+    const remotes = Array.isArray(parsed.remotes) ? parsed.remotes.filter(isRemote) : [];
+    const known = (name) => typeof name === "string" && remotes.some((entry) => entry.name === name);
+    return {
+        remotes,
+        ...(known(parsed.default) ? { default: parsed.default } : {}),
+        ...(known(parsed.lastUsed) ? { lastUsed: parsed.lastUsed } : {}),
+    };
 }
-/** Adds or replaces a remote by name. The file holds bearer tokens, so it is 0600 in a 0700 directory. */
+/**
+ * Adds or replaces a remote by name. The file holds bearer tokens, so it is 0600 in a 0700
+ * directory. When no default is set yet, the first place saved becomes it (an older file's
+ * first entry, if it had any), so the first setup needs no `dl use`.
+ */
 export async function saveRemote(remote, path = remotesPath()) {
-    const remotes = (await loadRemotes(path)).filter((entry) => entry.name !== remote.name);
+    const file = await loadRemotesFile(path);
+    const remotes = file.remotes.filter((entry) => entry.name !== remote.name);
     remotes.push(remote);
-    await writeRemotes(remotes, path);
+    await writeRemotes({ ...file, remotes, default: file.default ?? file.remotes[0]?.name ?? remote.name }, path);
 }
 export async function removeRemote(name, path = remotesPath()) {
-    const remotes = await loadRemotes(path);
-    const kept = remotes.filter((entry) => entry.name !== name);
-    if (kept.length === remotes.length)
+    const file = await loadRemotesFile(path);
+    const kept = file.remotes.filter((entry) => entry.name !== name);
+    if (kept.length === file.remotes.length)
         return false;
-    await writeRemotes(kept, path);
+    // Forgetting the default leaves none; with one place left, that one is used anyway.
+    await writeRemotes({
+        remotes: kept,
+        ...(file.default && file.default !== name ? { default: file.default } : {}),
+        ...(file.lastUsed && file.lastUsed !== name ? { lastUsed: file.lastUsed } : {}),
+    }, path);
     return true;
 }
-/** The named remote, or the only one when no name is given. */
-export async function resolveRemote(name, path = remotesPath()) {
-    const remotes = await loadRemotes(path);
-    if (remotes.length === 0)
-        throw new Error("No servers paired yet. Run: autopilot remote add https://your-server");
-    if (name === undefined) {
-        if (remotes.length === 1)
-            return remotes[0];
-        throw new Error(`Several servers are paired; pick one with --on (${remotes.map((entry) => entry.name).join(", ")})`);
+/**
+ * `dl servers rename OLD NEW`: renames a place in this laptop's list (the server itself doesn't
+ * change). The `default` and `lastUsed` pointers follow the entry to its new name.
+ */
+export async function renameRemote(from, to, path = remotesPath()) {
+    if (!REMOTE_NAME_RE.test(to))
+        throw new Error(`"${to}" can't be a server name: use lowercase letters, digits, and dashes (up to 40), starting with a letter or digit`);
+    const file = await loadRemotesFile(path);
+    if (!file.remotes.some((entry) => entry.name === from)) {
+        throw new Error(`No server named "${from}". Connected: ${file.remotes.map((entry) => entry.name).join(", ") || "none"}`);
     }
-    const remote = remotes.find((entry) => entry.name === name);
+    if (from === to)
+        return;
+    if (file.remotes.some((entry) => entry.name === to))
+        throw new Error(`There's already a server named "${to}"`);
+    const follow = (name) => (name === from ? to : name);
+    const defaultName = follow(file.default);
+    const lastUsed = follow(file.lastUsed);
+    await writeRemotes({
+        remotes: file.remotes.map((entry) => (entry.name === from ? { ...entry, name: to } : entry)),
+        ...(defaultName ? { default: defaultName } : {}),
+        ...(lastUsed ? { lastUsed } : {}),
+    }, path);
+}
+/** `dl use NAME`: where commands go when none is named. */
+export async function setDefaultRemote(name, path = remotesPath()) {
+    const file = await loadRemotesFile(path);
+    const remote = file.remotes.find((entry) => entry.name === name);
     if (!remote)
-        throw new Error(`No server named "${name}". Paired: ${remotes.map((entry) => entry.name).join(", ")}`);
+        throw new Error(unknownName(name, file.remotes));
+    await writeRemotes({ ...file, default: name }, path);
     return remote;
 }
+/** Remembers where the last task went (the fallback when there's no default). */
+export async function recordLastUsed(name, path = remotesPath()) {
+    const file = await loadRemotesFile(path);
+    if (file.lastUsed === name || !file.remotes.some((entry) => entry.name === name))
+        return;
+    await writeRemotes({ ...file, lastUsed: name }, path);
+}
+/** The named remote, else the default, else the only one, else the last one used. */
+export async function resolveRemote(name, path = remotesPath()) {
+    return (await resolveTarget(name, path)).remote;
+}
+/** resolveRemote, and why that one (for the command's first line). */
+export async function resolveTarget(name, path = remotesPath()) {
+    const file = await loadRemotesFile(path);
+    const { remotes } = file;
+    if (remotes.length === 0)
+        throw new Error("Nothing is set up yet. Run: dl setup");
+    const named = (wanted) => remotes.find((entry) => entry.name === wanted);
+    if (name !== undefined) {
+        const remote = named(name);
+        if (!remote)
+            throw new Error(unknownName(name, remotes));
+        return { remote, reason: "named" };
+    }
+    if (remotes.length === 1)
+        return { remote: remotes[0], reason: "only" };
+    const chosen = file.default ? named(file.default) : undefined;
+    if (chosen)
+        return { remote: chosen, reason: "default" };
+    const last = file.lastUsed ? named(file.lastUsed) : undefined;
+    if (last)
+        return { remote: last, reason: "last used" };
+    throw new Error(`Several places are set up (${remotes.map((entry) => entry.name).join(", ")}). Pick one with --server NAME, or set a default: dl use NAME`);
+}
+function unknownName(name, remotes) {
+    return remotes.length
+        ? `Nothing named "${name}" is set up. Set up: ${remotes.map((entry) => entry.name).join(", ")}`
+        : `Nothing named "${name}" is set up; nothing is yet. Run: dl setup`;
+}
 /** A short default name from the URL's host: https://acme.example.com -> acme. */
 export function defaultRemoteName(url) {
     const host = new URL(url).hostname.toLowerCase();
@@ -74,10 +154,16 @@ export function normalizeServerUrl(input) {
         throw new Error("The server URL must not include credentials, a query, or a fragment");
     return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
 }
-async function writeRemotes(remotes, path) {
+async function writeRemotes(file, path) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
     const temp = `${path}.${process.pid}.tmp`;
-    await writeFile(temp, `${JSON.stringify({ version: 1, remotes }, null, 2)}\n`, { mode: 0o600 });
+    const body = {
+        version: 1,
+        remotes: file.remotes,
+        ...(file.default ? { default: file.default } : {}),
+        ...(file.lastUsed ? { lastUsed: file.lastUsed } : {}),
+    };
+    await writeFile(temp, `${JSON.stringify(body, null, 2)}\n`, { mode: 0o600 });
     await chmod(temp, 0o600);
     await rename(temp, path);
 }

package/dist/laptop/credentials.js

@@ -52,7 +52,7 @@ export async function gatherKeys(needs, input) {
         answers.openrouterKey = await openrouterKey(input);
     return answers;
 }
-async function githubToken({ ui, prompter, sources }) {
+export async function githubToken({ ui, prompter, sources }) {
     const fromCli = (await sources.gh().catch(() => undefined))?.trim();
     if (fromCli) {
         const checked = await validateGitHubToken(fromCli, sources.fetch);
@@ -73,7 +73,7 @@ async function githubToken({ ui, prompter, sources }) {
         return { value: token, ...(checked.problem ? { problem: checked.problem } : {}), ...(checked.login ? { detail: `signed in as ${checked.login}` } : {}) };
     });
 }
-async function openrouterKey({ ui, prompter, sources }) {
+export async function openrouterKey({ ui, prompter, sources }) {
     const candidates = [];
     const fromEnv = sources.env.OPENROUTER_API_KEY?.trim();
     if (fromEnv)

package/dist/laptop/keys.js

@@ -0,0 +1,133 @@
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { promisify } from "node:util";
+import { KEY_LABELS, formatKeyListing, parseKeyName } from "../keys.js";
+import { listLocalKeys, setLocalKey } from "../local/keys.js";
+import { PAIRED_NAME } from "../local/layout.js";
+import { TtyPrompter } from "../prompt.js";
+import { palette, PlainUi, TerminalUi } from "../ui.js";
+import { resolveRemote } from "./config.js";
+import { githubToken, openrouterKey } from "./credentials.js";
+import { checkServer, realSshExec } from "./ssh.js";
+export const LAPTOP_KEYS_USAGE = "  Usage: dl keys [openrouter|github] [--server NAME]\n"
+    + "         dl keys              which keys are set where your agents run\n"
+    + "         dl keys openrouter   replace the OpenRouter key     dl keys github   replace the GitHub token\n";
+export async function laptopKeys(args, options, deps) {
+    const [first, ...rest] = args;
+    const which = first === undefined || first === "ls" || first === "list" ? undefined : parseKeyName(first);
+    if ((first !== undefined && first !== "ls" && first !== "list" && !which) || rest.length > 0) {
+        deps.write(LAPTOP_KEYS_USAGE);
+        return 2;
+    }
+    const target = await resolveTarget(options.server, deps.remotesFile);
+    const again = (key) => `dl keys ${key}${options.server ? ` --server ${target.remote.name}` : ""}`;
+    if (!which) {
+        const listing = target.kind === "local" ? await deps.local.list() : await listOverSsh(target, deps.ssh);
+        deps.write(formatKeyListing(listing, palette(deps.color), `on ${target.kind === "local" ? "this computer" : target.remote.name}`, again));
+        return 0;
+    }
+    // Reach the server before asking for anything, so a dead connection doesn't waste a key.
+    const root = target.kind === "ssh" ? (await checkServer(target.access, deps.ssh, target.remote.name)).root : true;
+    const where = target.kind === "local" ? "this computer" : target.remote.name;
+    const label = `${KEY_LABELS[which]} ${which === "github" ? "token" : "key"}`;
+    const askUi = deps.newUi();
+    askUi.questions(`A new ${label} for ${where}; it replaces the one there. Typing is hidden.`);
+    const value = which === "github"
+        ? await githubToken({ ui: askUi, prompter: deps.prompter, sources: deps.sources })
+        : await openrouterKey({ ui: askUi, prompter: deps.prompter, sources: deps.sources });
+    askUi.finish();
+    const ui = deps.newUi();
+    ui.plan([{ id: "apply", label: `Replacing the ${label} on ${where}` }]);
+    ui.start("apply");
+    try {
+        const result = target.kind === "local" ? await deps.local.set(which, value) : await setOverSsh(target, root, which, value, deps.ssh);
+        ui.done("apply", result.detail);
+    }
+    catch (error) {
+        ui.fail("apply", error instanceof Error ? error.message.split("\n")[0] : String(error));
+        ui.finish();
+        throw error;
+    }
+    ui.finish();
+    return 0;
+}
+/** The server in use: `--server NAME`, or the only (or default) one. */
+async function resolveTarget(server, remotesFile) {
+    const remote = remotesFile ? await resolveRemote(server, remotesFile) : await resolveRemote(server);
+    if (remote.ssh)
+        return { kind: "ssh", remote, access: remote.ssh };
+    if (remote.name === PAIRED_NAME)
+        return { kind: "local", remote };
+    throw new Error(`${remote.name} was connected with dl connect, so this laptop can't reach its keys. On that server, run: sudo dl keys`);
+}
+function sudo(root) {
+    return root ? "" : "sudo -n ";
+}
+async function setOverSsh(target, root, which, value, ssh) {
+    // The key travels on stdin only; the command line names which key, never its value.
+    const result = await ssh(target.access, `${sudo(root)}dl keys set ${which} --stdin --json`, { input: `${value}\n` });
+    const parsed = lastJson(result.stdout);
+    if (parsed?.ok === true)
+        return { ok: true, key: which, detail: typeof parsed.detail === "string" ? parsed.detail : "replaced" };
+    if (typeof parsed?.error === "string")
+        throw new Error(`${target.remote.name}: ${parsed.error}`);
+    throw serverFailure(target.remote.name, result);
+}
+async function listOverSsh(target, ssh) {
+    const { root } = await checkServer(target.access, ssh, target.remote.name);
+    const result = await ssh(target.access, `${sudo(root)}dl keys --json`);
+    const parsed = lastJson(result.stdout);
+    if (result.code !== 0 || !parsed || !Array.isArray(parsed.keys))
+        throw serverFailure(target.remote.name, result);
+    return parsed.keys.filter(isListing);
+}
+function serverFailure(name, result) {
+    if (/Unknown command "keys"|Unknown option '--(stdin|json)'/.test(result.stderr)) {
+        return new Error(`The dl on ${name} is too old for dl keys; update it with dl setup (it keeps your keys), then try again.`);
+    }
+    return new Error(`Couldn't change the keys on ${name}: ${lastLine(result.stderr) || lastLine(result.stdout) || `exit ${result.code}`}`);
+}
+function isListing(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const entry = value;
+    return (entry.key === "openrouter" || entry.key === "github") && typeof entry.set === "boolean"
+        && (entry.detail === undefined || typeof entry.detail === "string") && (entry.problem === undefined || typeof entry.problem === "string");
+}
+function lastJson(stdout) {
+    for (const line of stdout.trim().split("\n").reverse()) {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            // not JSON; keep looking
+        }
+    }
+    return undefined;
+}
+function lastLine(text) {
+    return text.trim().split("\n").filter((line) => line.trim() && !/Permanently added/i.test(line)).at(-1)?.trim() ?? "";
+}
+/** `dl keys` on a laptop with the real terminal, ssh, gh, and filesystem. */
+export async function keys(args, options) {
+    const { io, terminal } = options;
+    const color = io.color === true;
+    const execFileAsync = promisify(execFile);
+    return laptopKeys(args, options.server ? { server: options.server } : {}, {
+        newUi: () => terminal ? new TerminalUi(io.out, undefined, color) : new PlainUi(io.out),
+        prompter: new TtyPrompter(),
+        write: io.out,
+        color,
+        ssh: realSshExec,
+        sources: {
+            env: process.env,
+            home: homedir(),
+            readFile: (path) => readFile(path, "utf8").catch(() => undefined),
+            gh: () => execFileAsync("gh", ["auth", "token"], { timeout: 5000 }).then(({ stdout }) => stdout.trim() || undefined, () => undefined),
+            fetch: globalThis.fetch,
+        },
+        // Checked online here already; this computer re-checks only the format.
+        local: { set: (which, value) => setLocalKey(which, value), list: () => listLocalKeys({ fetchImpl: globalThis.fetch }) },
+    });
+}

package/dist/laptop/setup.js

@@ -1,7 +1,7 @@
 import { execFile } from "node:child_process";
-import { readdir, readFile } from "node:fs/promises";
+import { access as fileAccess, readdir, readFile } from "node:fs/promises";
 import { homedir, hostname } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { TtyPrompter } from "../prompt.js";
 import { palette, PlainUi, TerminalUi } from "../ui.js";
@@ -40,34 +40,12 @@ export async function setupWizard(deps) {
     return setUpServer(deps);
 }
 async function setUpServer(deps) {
-    const c = palette(deps.color);
     const home = deps.sources.home;
     const sshDir = join(home, ".ssh");
     const hosts = parseSshConfig(await deps.sources.readFile(join(sshDir, "config")) ?? "", home);
     // 1. Which server, and can we get in?
-    let { access, display } = await chooseServer(deps, hosts);
-    let facts;
-    for (let attempt = 0; !facts; attempt++) {
-        const ui = deps.newUi();
-        ui.plan([{ id: "ssh", label: "Server" }]);
-        ui.start("ssh", display);
-        try {
-            facts = await checkServer(access, deps.ssh, display);
-        }
-        catch (error) {
-            ui.fail("ssh", error instanceof SshAuthError ? "SSH key not accepted" : "can't set up here");
-            ui.finish();
-            if (!(error instanceof SshAuthError) || attempt >= 2)
-                throw explainAuth(error, access);
-            access = { ...access, identityFile: await chooseKey(deps, sshDir, access) };
-            continue;
-        }
-        display = `${facts.user}@${display.replace(/^[^@]*@/, "")}`;
-        ui.done("ssh", `${display}  ${facts.os} · ${facts.arch}`);
-        ui.finish();
-        if (facts.newHostKey)
-            deps.newUi().line("info", "New server", "first connection: trusted its host key (accept-new)");
-    }
+    const chosen = await chooseServer(deps, hosts);
+    const { access, facts } = await reachServer(deps, sshDir, deps.identityFile ? { ...chosen.access, identityFile: deps.identityFile } : chosen.access, chosen.display);
     // 2. Install dl there, then ask only for the keys it still lacks.
     await bootstrap(access, facts, deps.ssh, deps.newUi(), deps.installUrl);
     const needs = await serverNeeds(access, facts, deps.ssh);
@@ -90,7 +68,7 @@ async function setUpServer(deps) {
     if (!remote) {
         const pairing = await pairLaptop(access, facts, deps.ssh, `${laptopName(deps.hostname)} (dl)`);
         remote = {
-            name: saved?.name ?? await remoteName(access, remotesFile),
+            name: saved?.name ?? await remoteName(access, remotesFile, chosen.alias ?? facts.hostname),
             url: normalizeServerUrl(pairing.url),
             token: pairing.token,
             credentialId: pairing.credentialId,
@@ -135,6 +113,7 @@ async function chooseServer(deps, hosts) {
         if (host) {
             ui.answered("SSH", host.alias);
             return {
+                alias: host.alias,
                 access: { target: host.alias },
                 display: `${host.user ? `${host.user}@` : ""}${host.hostName ?? host.alias}${host.port && host.port !== 22 ? `:${host.port}` : ""}`,
             };
@@ -155,30 +134,85 @@ async function chooseServer(deps, hosts) {
         }
     }
 }
-/** The server refused the default keys: offer the ones in ~/.ssh and retry with -i. */
-async function chooseKey(deps, sshDir, access) {
-    const c = palette(deps.color);
-    const keys = discoverKeys(sshDir, await deps.sources.listDir(sshDir)).filter((key) => key !== access.identityFile);
-    if (keys.length === 0)
-        throw explainAuth(new SshAuthError(access, "no other keys in ~/.ssh"), access);
-    deps.write(`\n  ${c.dim("Which key does this server accept?")}\n`);
-    keys.forEach((key, index) => deps.write(`  ${c.cyan(String(index + 1))}  ${key.replace(deps.sources.home, "~")}\n`));
-    deps.write("\n");
+/**
+ * Connects and checks the server. If it refuses the default keys (ssh's own: the agent and
+ * ~/.ssh/id_*), each key pair in ~/.ssh is tried in turn with -i, without asking: auth
+ * refusals come back fast, so this takes seconds. Only when none works does it stop, with
+ * what to do. A key named with --identity is the only one tried.
+ */
+async function reachServer(deps, sshDir, first, target) {
+    const home = deps.sources.home;
     const ui = deps.newUi();
-    const answer = (await deps.prompter.text(ui.prompt("SSH key", `1-${keys.length}`))).trim();
-    const key = keys[(Number(answer) || 1) - 1] ?? keys[0];
-    ui.answered("SSH key", key.replace(deps.sources.home, "~"));
-    return key;
+    ui.plan([{ id: "ssh", label: "Server" }]);
+    ui.start("ssh", target);
+    const tried = [];
+    let searching = false;
+    let newHostKey = false;
+    const attempt = async (access) => {
+        try {
+            return await checkServer(access, deps.ssh, target);
+        }
+        catch (error) {
+            if (error instanceof SshAuthError) {
+                newHostKey ||= error.newHostKey;
+                if (access.identityFile)
+                    tried.push(access.identityFile);
+                return undefined;
+            }
+            if (searching)
+                ui.plan([{ id: "ssh", label: "Server" }]);
+            ui.fail("ssh", "can't set up here");
+            ui.finish();
+            throw error;
+        }
+    };
+    let access = first;
+    let facts = await attempt(access);
+    if (!facts && !first.identityFile) {
+        const keys = discoverKeys(sshDir, await deps.sources.listDir(sshDir));
+        searching = keys.length > 0;
+        if (searching)
+            ui.plan([{ id: "keys", label: "Trying your SSH keys…" }]);
+        for (const key of keys) {
+            access = { ...first, identityFile: key };
+            ui.start("keys", tilde(key, home));
+            facts = await attempt(access);
+            if (facts)
+                break;
+        }
+    }
+    if (searching)
+        ui.plan([{ id: "ssh", label: "Server" }]);
+    if (!facts) {
+        ui.fail("ssh", first.identityFile ? `${tilde(first.identityFile, home)} not accepted` : tried.length > 0 ? "none of your SSH keys was accepted" : "SSH key not accepted");
+        ui.finish();
+        throw noKeyWorks(first, tried, discoverKeys(sshDir, await deps.sources.listDir(sshDir)), home);
+    }
+    const display = `${facts.user}@${target.replace(/^[^@]*@/, "")}`;
+    ui.done("ssh", access.identityFile ? `${display} with ${tilde(access.identityFile, home)} · ${facts.os} · ${facts.arch}` : `${display}  ${facts.os} · ${facts.arch}`);
+    ui.finish();
+    if (facts.newHostKey || newHostKey)
+        deps.newUi().line("info", "New server", "first connection: trusted its host key (accept-new)");
+    return { access, facts };
 }
-function explainAuth(error, access) {
-    if (!(error instanceof SshAuthError))
-        return error instanceof Error ? error : new Error(String(error));
-    return new Error([
-        error.message,
-        "  Add this computer's public key to the server (it asks for the password once):",
-        `     ssh-copy-id ${access.port ? `-p ${access.port} ` : ""}${access.target}`,
+/** Every key was refused: what to do next, with this server and this laptop's own key filled in. */
+function noKeyWorks(access, tried, keys, home) {
+    const port = access.port ? `-p ${access.port} ` : "";
+    const key = keys[0] ? tilde(keys[0], home) : undefined;
+    const lines = [
+        access.identityFile
+            ? `${access.target} didn't accept ${tilde(access.identityFile, home)}.`
+            : `${access.target} didn't accept this computer's SSH keys (${["the default ones", ...tried.map((file) => tilde(file, home))].join(", ")}).`,
+        "  Add your public key to the server (it asks for the password once):",
+        ...(key ? [] : ["     ssh-keygen -t ed25519"]),
+        `     ssh-copy-id -i ${key ?? "~/.ssh/id_ed25519"}.pub ${port}${access.target}`,
         "  If your key has a passphrase, load it first with: ssh-add",
-    ].join("\n"));
+        "  Or name the key this server takes: dl setup --identity ~/.ssh/KEY",
+    ];
+    return new Error(lines.join("\n"));
+}
+function tilde(path, home) {
+    return path.startsWith(`${home}/`) ? `~${path.slice(home.length)}` : path;
 }
 function sameServer(remote, access) {
     return remote.ssh?.target === access.target && remote.ssh.port === access.port;
@@ -189,12 +223,14 @@ async function stillWorks(remote, open) {
         return true;
     }).catch(() => false);
 }
-/** box (from an ssh alias) or 203-0-113-10, unique unless it's this same server again. */
-async function remoteName(access, remotesFile) {
+/**
+ * What this laptop calls the server: the ~/.ssh/config alias the user picked, else the
+ * server's own hostname, else its address (203-0-113-10). Unique unless it's this same server.
+ */
+async function remoteName(access, remotesFile, preferred) {
     const host = hostOf(access.target).toLowerCase();
-    const label = /^\d+(\.\d+){3}$/.test(host) || host.includes(":") ? host.replace(/[.:]/g, "-") : host.split(".")[0] ?? "server";
-    const base = label.replace(/[^a-z0-9-]/g, "-").replace(/^-+/, "").slice(0, 36) || "server";
-    const name = REMOTE_NAME_RE.test(base) ? base : "server";
+    const fromAddress = /^\d+(\.\d+){3}$/.test(host) || host.includes(":") ? host.replace(/[.:]/g, "-") : host.split(".")[0] ?? "";
+    const name = [preferred, fromAddress].map((label) => serverLabel(label ?? "")).find((label) => label !== undefined) ?? "server";
     const remotes = await loadRemotes(remotesFile);
     for (let n = 1;; n++) {
         const candidate = n === 1 ? name : `${name}-${n}`;
@@ -203,6 +239,11 @@ async function remoteName(access, remotesFile) {
             return candidate;
     }
 }
+/** A hostname as a server name (lowercase, dashes, room for a -2), or undefined if nothing usable is left. */
+export function serverLabel(text) {
+    const label = text.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 36).replace(/-+$/, "");
+    return REMOTE_NAME_RE.test(label) && label !== "localhost" ? label : undefined;
+}
 function finishScreen(ui, capacity) {
     ui.ready(capacity ? `Ready · fits ~${capacity} agents at once (estimate)` : "Ready", [
         { label: "From any GitHub repository", value: RUN_EXAMPLE },
@@ -230,6 +271,12 @@ export async function setup(options) {
     const color = io.color === true;
     const execFileAsync = promisify(execFile);
     const home = homedir();
+    let identityFile;
+    if (options.identityFile !== undefined) {
+        // The private key, even when the .pub next to it was named.
+        identityFile = resolve(options.identityFile.replace(/^~(?=$|\/)/, home).replace(/\.pub$/, ""));
+        await fileAccess(identityFile).catch(() => { throw new Error(`No SSH key at ${options.identityFile} (--identity takes the private key, e.g. ~/.ssh/id_ed25519)`); });
+    }
     await setupWizard({
         newUi: () => terminal ? new TerminalUi(io.out, undefined, color) : new PlainUi(io.out),
         prompter: new TtyPrompter(),
@@ -248,6 +295,7 @@ export async function setup(options) {
         hostname: hostname(),
         installUrl: process.env.DL_INSTALL_URL || INSTALL_URL,
         ...(options.localSetup ? { localSetup: options.localSetup } : {}),
+        ...(identityFile ? { identityFile } : {}),
     });
     return 0;
 }

package/dist/laptop/ssh.js

@@ -139,19 +139,23 @@ export function lines(collect, onLine) {
             onLine(part.replace(/\r$/, ""));
     };
 }
-/** The server refused our keys; the wizard offers others from ~/.ssh. */
+/** The server refused our keys; the wizard tries the others in ~/.ssh. */
 export class SshAuthError extends Error {
     access;
-    constructor(access, detail) {
+    newHostKey;
+    constructor(access, detail, newHostKey = false) {
         super(`The server didn't accept this computer's SSH key (${detail}).`);
         this.access = access;
+        this.newHostKey = newHostKey;
         this.name = "SshAuthError";
     }
 }
 const SUPPORTED_OS = new Set(["ubuntu 22.04", "ubuntu 24.04", "debian 12"]);
-// One round trip: who we are, the OS, the CPU, and whether we can become root without a password.
+// One round trip: who we are, the OS, the CPU, whether we can become root without a password,
+// and the server's own name (what the laptop calls it unless ~/.ssh/config already names it).
 const PROBE = 'id -u; id -un; . /etc/os-release; echo "$ID $VERSION_ID"; uname -m; ' +
-    'if [ "$(id -u)" = 0 ]; then echo root; elif sudo -n true 2>/dev/null; then echo sudo; else echo nosudo; fi';
+    'if [ "$(id -u)" = 0 ]; then echo root; elif sudo -n true 2>/dev/null; then echo sudo; else echo nosudo; fi; ' +
+    'hostname -s 2>/dev/null || cat /etc/hostname 2>/dev/null';
 /** Connects once and checks the server can take an install: a supported OS, and root or passwordless sudo. */
 export async function checkServer(access, ssh, display) {
     const result = await ssh(access, PROBE);
@@ -159,14 +163,14 @@ export async function checkServer(access, ssh, display) {
     if (result.code === 255 || result.stdout.trim() === "") {
         const detail = lastLine(result.stderr) || `ssh exited with ${result.code}`;
         if (/Permission denied|Too many authentication failures|no mutual signature|Authentication failed/i.test(result.stderr)) {
-            throw new SshAuthError(access, detail);
+            throw new SshAuthError(access, detail, newHostKey);
         }
         if (/Host key verification failed|REMOTE HOST IDENTIFICATION HAS CHANGED/i.test(result.stderr)) {
             throw new Error(`${display}'s SSH host key changed since this computer last connected, so it stopped (that can mean someone is in the middle). If you rebuilt the server, remove the old key with: ssh-keygen -R ${hostOf(access.target)}`);
         }
         throw new Error(`Couldn't reach ${display} over SSH: ${detail}\n  Check that this works: ${sshCommandLine(access)}`);
     }
-    const [uid, user, osLine, arch, privilege] = result.stdout.trim().split("\n").map((line) => line.trim());
+    const [uid, user, osLine, arch, privilege, name] = result.stdout.trim().split("\n").map((line) => line.trim());
     const os = formatOs(osLine ?? "");
     const facts = {
         user: user || "?",
@@ -175,6 +179,7 @@ export async function checkServer(access, ssh, display) {
         os,
         arch: arch === "aarch64" ? "arm64" : arch || "?",
         newHostKey,
+        ...(name ? { hostname: name } : {}),
     };
     if (!facts.root && !facts.sudo) {
         throw new Error([