rshow 0.0.2 → 0.0.4

package/dist/main.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/main.ts
-import path24 from "node:path";
-import process17 from "node:process";
+import path25 from "node:path";
+import process23 from "node:process";
 
 // src/binary.ts
 import { mkdir, mkdtemp, rename, rm, stat, writeFile } from "node:fs/promises";
@@ -13,7 +13,7 @@ import process from "node:process";
 // src/version.ts
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-var VERSION = true ? "0.0.2" : versionFromPackage();
+var VERSION = true ? "0.0.4" : versionFromPackage();
 
 // src/binary.ts
 var ASSET_MANIFEST = "assets.json";
@@ -72,9 +72,9 @@ async function extractAssets(bundle, dir) {
 function safeKey(key2) {
   return key2 !== "" && !path.isAbsolute(key2) && !key2.split("/").includes("..");
 }
-function manifestKeys(read2) {
+function manifestKeys(read4) {
   try {
-    const doc = JSON.parse(new TextDecoder().decode(read2(ASSET_MANIFEST)));
+    const doc = JSON.parse(new TextDecoder().decode(read4(ASSET_MANIFEST)));
     if (doc !== null && typeof doc === "object" && Array.isArray(doc.keys)) {
       const keys = doc.keys.filter((key2) => typeof key2 === "string");
       if (keys.length > 0) return keys.filter(safeKey);
@@ -85,9 +85,9 @@ function manifestKeys(read2) {
 }
 function bundleOf(mod) {
   const raw = mod.getRawAsset;
-  const read2 = (key2) => new Uint8Array(raw(key2));
-  const withManifest = manifestKeys(read2);
-  return { keys: withManifest.length > 0 ? withManifest : (mod.getAssetKeys?.() ?? []).filter(safeKey), read: read2 };
+  const read4 = (key2) => new Uint8Array(raw(key2));
+  const withManifest = manifestKeys(read4);
+  return { keys: withManifest.length > 0 ? withManifest : (mod.getAssetKeys?.() ?? []).filter(safeKey), read: read4 };
 }
 async function unpack(env) {
   if (!await isBinary()) return void 0;
@@ -148,10 +148,145 @@ var CheckError = class extends Error {
   }
 };
 
-// src/client.ts
+// src/network.ts
+import { readFile } from "node:fs/promises";
+import process3 from "node:process";
+import tls from "node:tls";
+
+// src/warn.ts
+import process2 from "node:process";
+function warn(message) {
+  process2.stderr.write(`rshow: warning: ${message}
+`);
+}
+
+// src/network.ts
+var PROXY_VARIABLES = ["https_proxy", "HTTPS_PROXY", "http_proxy", "HTTP_PROXY"];
+var TRUST_HINT = "your network may inspect HTTPS: set RSHOW_EXTRA_CA_FILE to its root certificate, or check that the system store has it";
+var PROXY_HINT = "if a proxy stands between you and that host, set https_proxy and run with NODE_USE_ENV_PROXY=1";
+var DNS_HINT = "check the url in rshow config and your DNS";
+var TRUSTED = { reason: "certificate not trusted", hint: TRUST_HINT };
+var REASONS = {
+  UNABLE_TO_GET_ISSUER_CERT_LOCALLY: TRUSTED,
+  UNABLE_TO_VERIFY_LEAF_SIGNATURE: TRUSTED,
+  SELF_SIGNED_CERT_IN_CHAIN: TRUSTED,
+  DEPTH_ZERO_SELF_SIGNED_CERT: TRUSTED,
+  CERT_HAS_EXPIRED: TRUSTED,
+  ERR_TLS_CERT_ALTNAME_INVALID: TRUSTED,
+  ENOTFOUND: { reason: "host not found", hint: DNS_HINT },
+  EAI_AGAIN: { reason: "host not found", hint: DNS_HINT },
+  ECONNREFUSED: { reason: "connection refused" },
+  ETIMEDOUT: { reason: "connection timed out", proxyHint: true },
+  UND_ERR_CONNECT_TIMEOUT: { reason: "connection timed out", proxyHint: true },
+  ECONNRESET: { reason: "connection reset", proxyHint: true }
+};
 function messageOf(err) {
   return err instanceof Error ? err.message : String(err);
 }
+function pemCertificatesOf(text) {
+  return text.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) ?? [];
+}
+async function extraCertificates(env) {
+  const file = (env.RSHOW_EXTRA_CA_FILE ?? "").trim();
+  if (file === "") return [];
+  let text;
+  try {
+    text = await readFile(file, "utf8");
+  } catch (err) {
+    warn(`cannot read RSHOW_EXTRA_CA_FILE ${file}: ${messageOf(err)}`);
+    return [];
+  }
+  const certs = pemCertificatesOf(text);
+  if (certs.length === 0) warn(`RSHOW_EXTRA_CA_FILE ${file} holds no PEM certificate`);
+  return certs;
+}
+async function installCaCertificates(env = process3.env) {
+  const extra = await extraCertificates(env);
+  const api = tls;
+  if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") return;
+  try {
+    const certs = [...api.getCACertificates("default")];
+    if (env.RSHOW_SYSTEM_CA !== "0") certs.push(...api.getCACertificates("system"));
+    certs.push(...extra);
+    api.setDefaultCACertificates([...new Set(certs)]);
+  } catch {
+  }
+}
+function proxyVariableOf(env) {
+  return PROXY_VARIABLES.find((name) => (env[name] ?? "").trim() !== "");
+}
+function envProxyEnabled(env) {
+  const flag = (env.NODE_USE_ENV_PROXY ?? "").trim();
+  if (flag !== "" && flag !== "0") return true;
+  return process3.execArgv.includes("--use-env-proxy");
+}
+var proxyNoticed = false;
+function noticeProxy(env) {
+  if (proxyNoticed) return;
+  proxyNoticed = true;
+  const name = proxyVariableOf(env);
+  if (name === void 0 || envProxyEnabled(env)) return;
+  warn(`${name} is set; run with NODE_USE_ENV_PROXY=1 (Node 24+) so rshow uses it`);
+}
+var installed;
+function readyNetwork(env = process3.env) {
+  installed ??= installCaCertificates(env);
+  noticeProxy(env);
+  return installed;
+}
+function codesOf(err, depth = 0) {
+  if (depth > 5 || err === null || typeof err !== "object") return [];
+  const out = [];
+  const code = err.code;
+  if (typeof code === "string" && code !== "") out.push(code);
+  const inner = err.errors;
+  if (Array.isArray(inner)) for (const one of inner) out.push(...codesOf(one, depth + 1));
+  out.push(...codesOf(err.cause, depth + 1));
+  return out;
+}
+function deepestMessageOf(err, depth = 0) {
+  if (depth > 5 || err === null || typeof err !== "object") return "";
+  const cause = deepestMessageOf(err.cause, depth + 1);
+  if (cause !== "") return cause;
+  const message = messageOf(err);
+  return message === "" ? "" : message;
+}
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url;
+  }
+}
+function faultOf(err, env = process3.env) {
+  const codes = codesOf(err).reverse();
+  for (const code of codes) {
+    const known = REASONS[code];
+    if (known === void 0) continue;
+    const hint = known.proxyHint === true ? proxyVariableOf(env) === void 0 ? PROXY_HINT : void 0 : known.hint;
+    return hint === void 0 ? { reason: known.reason } : { reason: known.reason, hint };
+  }
+  return { reason: codes[0] ?? deepestMessageOf(err) };
+}
+function networkDetail(err, url, env = process3.env) {
+  return `network error: ${hostOf(url)}: ${faultOf(err, env).reason}`;
+}
+function networkText(err, url, env = process3.env) {
+  const fault = faultOf(err, env);
+  const line = `network error: ${hostOf(url)}: ${fault.reason}`;
+  return fault.hint === void 0 ? line : `${line}
+hint: ${fault.hint}`;
+}
+async function sendRequest(fetchImpl, url, init, env = process3.env) {
+  await readyNetwork(env);
+  try {
+    return await fetchImpl(url, init);
+  } catch (err) {
+    throw new ApiError(networkText(err, url, env));
+  }
+}
+
+// src/client.ts
 function errorText(body, status2) {
   if (body !== null && typeof body === "object" && typeof body.error === "string") {
     return body.error;
@@ -189,12 +324,7 @@ var Client = class {
       headers["content-type"] = opts.contentType ?? "application/octet-stream";
       body = opts.bytes;
     }
-    let res;
-    try {
-      res = await this.fetchImpl(this.baseUrl + pathname, { method, headers, body });
-    } catch (err) {
-      throw new ApiError(`network error: ${messageOf(err)}`);
-    }
+    const res = await sendRequest(this.fetchImpl, this.baseUrl + pathname, { method, headers, body });
     const text = await res.text();
     const parsed = parseBody(text);
     if (opts.allow404 === true && res.status === 404) return { status: 404, body: void 0 };
@@ -280,73 +410,9 @@ var Client = class {
 };
 
 // src/config.ts
-import { readFile } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import path2 from "node:path";
-
-// src/keychain.ts
-import { spawn } from "node:child_process";
-import process2 from "node:process";
-var SERVICE = "rshow";
-var MISSING = 44;
-var NO_MACOS = "the keychain needs macOS; set RSHOW_TOKEN instead";
-function bin() {
-  return process2.env.RSHOW_SECURITY_BIN ?? "security";
-}
-function usable() {
-  return process2.platform === "darwin" || process2.env.RSHOW_SECURITY_BIN !== void 0;
-}
-function run(args, input) {
-  return new Promise((resolve2, reject) => {
-    const child = spawn(bin(), args, { stdio: ["pipe", "pipe", "pipe"] });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.setEncoding("utf8");
-    child.stdout.on("data", (chunk2) => {
-      stdout += chunk2;
-    });
-    child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (chunk2) => {
-      stderr += chunk2;
-    });
-    child.stdin.on("error", () => {
-    });
-    child.on("error", (err) => {
-      if (err.code === "ENOENT") resolve2({ code: -1, stdout, stderr, absent: true });
-      else reject(new ApiError(`keychain: ${err.message}`));
-    });
-    child.on("close", (code) => resolve2({ code: code ?? -1, stdout, stderr, absent: false }));
-    child.stdin.end(input ?? "");
-  });
-}
-function failure(doing, result, secret) {
-  const text = secret === void 0 ? result.stderr : result.stderr.split(secret).join("[redacted]");
-  const detail = text.trim();
-  return new ApiError(`${doing}: ${detail === "" ? `exit ${result.code}` : detail}`);
-}
-async function save(url, token) {
-  if (!usable()) throw new UsageError(NO_MACOS);
-  const line = `add-generic-password -U -s ${SERVICE} -a ${url} -w ${token}
-`;
-  const result = await run(["-i"], line);
-  if (result.code !== 0) throw failure("cannot save the token in the keychain", result, token);
-  if (await read(url) !== token) throw failure("cannot save the token in the keychain", result, token);
-}
-async function read(url) {
-  if (!usable()) return void 0;
-  const result = await run(["find-generic-password", "-s", SERVICE, "-a", url, "-w"]);
-  if (result.absent || result.code === MISSING) return void 0;
-  if (result.code !== 0) throw failure("cannot read the token from the keychain", result);
-  const token = result.stdout.trim();
-  return token === "" ? void 0 : token;
-}
-async function remove(url) {
-  if (!usable()) throw new UsageError(NO_MACOS);
-  const result = await run(["delete-generic-password", "-s", SERVICE, "-a", url]);
-  if (result.absent || result.code === MISSING) return false;
-  if (result.code !== 0) throw failure("cannot remove the token from the keychain", result);
-  return true;
-}
+import { readFile as readFile3 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import path3 from "node:path";
 
 // ../shared/src/index.ts
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
@@ -393,8 +459,8 @@ function tagsOf(value) {
   if (!Array.isArray(value)) return [];
   return value.filter((tag) => typeof tag === "string").map((tag) => tag.toLowerCase());
 }
-function withTags(current, add2, remove3) {
-  const next = unique(tagsOf(current)).filter((tag) => !remove3.includes(tag));
+function withTags(current, add2, remove5) {
+  const next = unique(tagsOf(current)).filter((tag) => !remove5.includes(tag));
   for (const tag of add2) {
     if (!next.includes(tag)) next.push(tag);
   }
@@ -406,16 +472,326 @@ function sameTags(left, right) {
   return a.length === b.length && a.every((tag, index) => tag === b[index]);
 }
 
+// src/tokenstore.ts
+import process8 from "node:process";
+
+// src/credfile.ts
+import { chmod, mkdir as mkdir2, readFile as readFile2, rename as rename2, stat as stat2, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import path2 from "node:path";
+import process4 from "node:process";
+var DIR = "rshow";
+var FILE = "credentials";
+var VERSION2 = 1;
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var SHARED = 63;
+var fixed = /* @__PURE__ */ new Set();
+function messageOf2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function credentialsPath(env) {
+  const xdg = (env.XDG_CONFIG_HOME ?? "").trim();
+  const home = (env.HOME ?? "").trim();
+  const base = xdg !== "" ? xdg : path2.join(home !== "" ? home : homedir2(), ".config");
+  return path2.join(base, DIR, FILE);
+}
+async function tighten(file) {
+  await chmod(file, FILE_MODE).catch(() => {
+  });
+  if (fixed.has(file)) return;
+  fixed.add(file);
+  warn(`${file} was readable by group or other; its mode is now 600`);
+}
+async function load(file) {
+  const info = await stat2(file).catch(() => void 0);
+  if (info === void 0) return {};
+  if ((info.mode & SHARED) !== 0) await tighten(file);
+  let text;
+  try {
+    text = await readFile2(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw new UsageError(`cannot read ${file}: ${messageOf2(err)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new UsageError(`invalid JSON in ${file}`);
+  }
+  if (!isRecord(parsed)) throw new UsageError(`${file} must hold a JSON object`);
+  if (parsed.version !== void 0 && parsed.version !== VERSION2) {
+    throw new UsageError(`${file}: version must be ${VERSION2}`);
+  }
+  const raw = parsed.tokens ?? {};
+  if (!isRecord(raw)) throw new UsageError(`${file}: tokens must be an object`);
+  const tokens = {};
+  for (const [url, token] of Object.entries(raw)) {
+    if (typeof token !== "string") throw new UsageError(`${file}: tokens.${url} must be a string`);
+    tokens[url] = token;
+  }
+  return tokens;
+}
+async function store(file, tokens) {
+  const dir = path2.dirname(file);
+  let created;
+  try {
+    created = await mkdir2(dir, { recursive: true, mode: DIR_MODE });
+  } catch (err) {
+    throw new UsageError(`cannot make ${dir}: ${messageOf2(err)}`);
+  }
+  if (created !== void 0) await chmod(dir, DIR_MODE).catch(() => {
+  });
+  const temp = path2.join(dir, `.${path2.basename(file)}.${process4.pid}.${Date.now()}.tmp`);
+  const body = `${JSON.stringify({ version: VERSION2, tokens }, null, 2)}
+`;
+  try {
+    await writeFile2(temp, body, { mode: FILE_MODE, flag: "wx" });
+    await chmod(temp, FILE_MODE);
+    await rename2(temp, file);
+  } catch (err) {
+    await unlink(temp).catch(() => {
+    });
+    throw new UsageError(`cannot write ${file}: ${messageOf2(err)}`);
+  }
+}
+async function read(file, url) {
+  return (await load(file))[url];
+}
+async function save(file, url, token) {
+  const tokens = await load(file);
+  tokens[url] = token;
+  await store(file, tokens);
+}
+async function remove(file, url) {
+  const tokens = await load(file);
+  if (tokens[url] === void 0) return false;
+  delete tokens[url];
+  if (Object.keys(tokens).length === 0) {
+    await unlink(file).catch((err) => {
+      if (err.code !== "ENOENT") throw new UsageError(`cannot remove ${file}: ${messageOf2(err)}`);
+    });
+    return true;
+  }
+  await store(file, tokens);
+  return true;
+}
+
+// src/keychain.ts
+import process6 from "node:process";
+
+// src/tool.ts
+import { spawn } from "node:child_process";
+import process5 from "node:process";
+function childEnv(env) {
+  const out = { ...process5.env };
+  for (const [key2, value] of Object.entries(env ?? {})) {
+    if (value === void 0) delete out[key2];
+    else out[key2] = value;
+  }
+  return out;
+}
+function runTool(bin3, args, input, env) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(bin3, args, { stdio: ["pipe", "pipe", "pipe"], env: childEnv(env) });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk2) => {
+      stdout += chunk2;
+    });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk2) => {
+      stderr += chunk2;
+    });
+    child.stdin.on("error", () => {
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") resolve2({ code: -1, stdout, stderr, absent: true });
+      else reject(new ApiError(`${bin3}: ${err.message}`));
+    });
+    child.on("close", (code) => resolve2({ code: code ?? -1, stdout, stderr, absent: false }));
+    child.stdin.end(input ?? "");
+  });
+}
+function toolFailure(doing, result, secret) {
+  const text = secret === void 0 ? result.stderr : result.stderr.split(secret).join("[redacted]");
+  const detail = text.trim();
+  return new ApiError(`${doing}: ${detail === "" ? `exit ${result.code}` : detail}`);
+}
+
+// src/keychain.ts
+var SERVICE = "rshow";
+var MISSING = 44;
+function bin(env) {
+  const set = (env.RSHOW_SECURITY_BIN ?? "").trim();
+  return set === "" ? "security" : set;
+}
+function canSave(platform = process6.platform, securityBin = process6.env.RSHOW_SECURITY_BIN) {
+  return platform === "darwin" || (securityBin ?? "").trim() !== "";
+}
+async function save2(url, token, env = process6.env) {
+  if (!canSave(process6.platform, env.RSHOW_SECURITY_BIN)) {
+    throw new UsageError("the keychain needs macOS; set RSHOW_TOKEN instead");
+  }
+  const line = `add-generic-password -U -s ${SERVICE} -a ${url} -w ${token}
+`;
+  const result = await runTool(bin(env), ["-i"], line, env);
+  if (result.code !== 0) throw toolFailure("cannot save the token in the keychain", result, token);
+  if (await read2(url, env) !== token) {
+    throw toolFailure("cannot save the token in the keychain", result, token);
+  }
+}
+async function read2(url, env = process6.env) {
+  if (!canSave(process6.platform, env.RSHOW_SECURITY_BIN)) return void 0;
+  const args = ["find-generic-password", "-s", SERVICE, "-a", url, "-w"];
+  const result = await runTool(bin(env), args, void 0, env);
+  if (result.absent || result.code === MISSING) return void 0;
+  if (result.code !== 0) throw toolFailure("cannot read the token from the keychain", result);
+  const token = result.stdout.trim();
+  return token === "" ? void 0 : token;
+}
+async function remove2(url, env = process6.env) {
+  if (!canSave(process6.platform, env.RSHOW_SECURITY_BIN)) return false;
+  const args = ["delete-generic-password", "-s", SERVICE, "-a", url];
+  const result = await runTool(bin(env), args, void 0, env);
+  if (result.absent || result.code === MISSING) return false;
+  if (result.code !== 0) throw toolFailure("cannot remove the token from the keychain", result);
+  return true;
+}
+
+// src/keyring.ts
+import process7 from "node:process";
+var SERVICE2 = "rshow";
+var PROBE_SERVICE = "rshow-probe";
+var PROBE_ACCOUNT = "probe";
+var NOT_FOUND = 1;
+function bin2(env) {
+  const set = (env.RSHOW_SECRET_TOOL_BIN ?? "").trim();
+  return set === "" ? "secret-tool" : set;
+}
+function canUse(env, platform = process7.platform) {
+  return platform === "linux" || (env.RSHOW_SECRET_TOOL_BIN ?? "").trim() !== "";
+}
+async function usable(env = process7.env) {
+  const args = ["lookup", "service", PROBE_SERVICE, "account", PROBE_ACCOUNT];
+  const result = await runTool(bin2(env), args, void 0, env);
+  return !result.absent && (result.code === 0 || result.code === NOT_FOUND);
+}
+async function save3(url, token, env = process7.env) {
+  const args = ["store", "--label", `rshow ${url}`, "service", SERVICE2, "account", url];
+  const result = await runTool(bin2(env), args, token, env);
+  if (result.code !== 0) throw toolFailure("cannot save the token in the keyring", result, token);
+  if (await read3(url, env) !== token) {
+    throw toolFailure("cannot save the token in the keyring", result, token);
+  }
+}
+async function read3(url, env = process7.env) {
+  const args = ["lookup", "service", SERVICE2, "account", url];
+  const result = await runTool(bin2(env), args, void 0, env);
+  if (result.absent || result.code === NOT_FOUND) return void 0;
+  if (result.code !== 0) throw toolFailure("cannot read the token from the keyring", result);
+  const token = result.stdout.trim();
+  return token === "" ? void 0 : token;
+}
+async function remove3(url, env = process7.env) {
+  const args = ["clear", "service", SERVICE2, "account", url];
+  const result = await runTool(bin2(env), args, void 0, env);
+  if (result.absent || result.code === NOT_FOUND) return false;
+  if (result.code !== 0) throw toolFailure("cannot remove the token from the keyring", result);
+  return true;
+}
+
+// src/tokenstore.ts
+var BACKENDS = ["keychain", "keyring", "file"];
+function storeOf(backend, env) {
+  if (backend === "keychain") {
+    return {
+      backend,
+      detail: "keychain",
+      description: "the macOS Keychain",
+      read: (url) => read2(url, env),
+      save: (url, token) => save2(url, token, env),
+      remove: (url) => remove2(url, env)
+    };
+  }
+  if (backend === "keyring") {
+    return {
+      backend,
+      detail: "keyring",
+      description: "the Linux keyring",
+      read: (url) => read3(url, env),
+      save: (url, token) => save3(url, token, env),
+      remove: (url) => remove3(url, env)
+    };
+  }
+  const file = credentialsPath(env);
+  return {
+    backend,
+    detail: `file ${file}`,
+    description: `${file} (mode 600)`,
+    read: (url) => read(file, url),
+    save: (url, token) => save(file, url, token),
+    remove: (url) => remove(file, url)
+  };
+}
+function forced(env) {
+  const text = (env.RSHOW_TOKEN_STORE ?? "").trim();
+  if (text === "") return void 0;
+  for (const backend of BACKENDS) {
+    if (backend === text) return backend;
+  }
+  throw new UsageError(`RSHOW_TOKEN_STORE must be keychain, keyring or file, not ${text}`);
+}
+async function choose(env = process8.env, platform = process8.platform) {
+  const forcedBackend = forced(env);
+  if (forcedBackend !== void 0) return storeOf(forcedBackend, env);
+  if (canSave(platform, env.RSHOW_SECURITY_BIN)) return storeOf("keychain", env);
+  if (canUse(env, platform) && await usable(env)) return storeOf("keyring", env);
+  return storeOf("file", env);
+}
+function fileStore(env = process8.env) {
+  return storeOf("file", env);
+}
+async function every(env = process8.env, platform = process8.platform) {
+  const stores = [];
+  if (canSave(platform, env.RSHOW_SECURITY_BIN)) stores.push(storeOf("keychain", env));
+  if (canUse(env, platform) && await usable(env)) stores.push(storeOf("keyring", env));
+  stores.push(storeOf("file", env));
+  return stores;
+}
+async function find(env, url, platform = process8.platform) {
+  const forcedBackend = forced(env);
+  const stores = forcedBackend === void 0 ? await every(env, platform) : [storeOf(forcedBackend, env)];
+  let failed = false;
+  let firstError;
+  for (const store2 of stores) {
+    try {
+      const token = await store2.read(url);
+      if (token !== void 0) return { store: store2, token };
+    } catch (err) {
+      if (!failed) firstError = err;
+      failed = true;
+    }
+  }
+  if (failed) throw firstError;
+  return void 0;
+}
+
 // src/config.ts
 var DEFAULT_OUT = "dist";
 var GLOBAL_DIR = "rshow";
 var GLOBAL_FILE = "config.json";
 var LOCAL_FILE = "rshow.json";
 var NO_SERVER = "no server configured: run rshow init --url <admin-url> --art <viewer-url>";
-function messageOf2(err) {
+function messageOf3(err) {
   return err instanceof Error ? err.message : String(err);
 }
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function withoutSlash(value) {
@@ -424,14 +800,14 @@ function withoutSlash(value) {
 function globalConfigPath(env) {
   const xdg = (env.XDG_CONFIG_HOME ?? "").trim();
   const home = (env.HOME ?? "").trim();
-  const base = xdg !== "" ? xdg : path2.join(home !== "" ? home : homedir2(), ".config");
-  return path2.join(base, GLOBAL_DIR, GLOBAL_FILE);
+  const base = xdg !== "" ? xdg : path3.join(home !== "" ? home : homedir3(), ".config");
+  return path3.join(base, GLOBAL_DIR, GLOBAL_FILE);
 }
 function localConfigPath(dir) {
-  return path2.join(path2.resolve(dir), LOCAL_FILE);
+  return path3.join(path3.resolve(dir), LOCAL_FILE);
 }
 function layerOf(file, value) {
-  if (!isRecord(value)) throw new UsageError(`${file} must hold a JSON object`);
+  if (!isRecord2(value)) throw new UsageError(`${file} must hold a JSON object`);
   const fieldOf = (key2) => {
     const raw = value[key2];
     if (raw === void 0 || raw === null) return void 0;
@@ -451,7 +827,7 @@ function layerOf(file, value) {
   };
   const rawTokens = value.tokens;
   if (rawTokens !== void 0 && rawTokens !== null) {
-    if (!isRecord(rawTokens)) throw new UsageError(`${file}: tokens must be an object`);
+    if (!isRecord2(rawTokens)) throw new UsageError(`${file}: tokens must be an object`);
     const tokens = {};
     for (const [key2, raw] of Object.entries(rawTokens)) {
       if (typeof raw !== "string") throw new UsageError(`${file}: tokens.${key2} must be a string`);
@@ -473,10 +849,10 @@ function layerOf(file, value) {
 async function readConfigFile(file) {
   let text;
   try {
-    text = await readFile(file, "utf8");
+    text = await readFile3(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return {};
-    throw new UsageError(`cannot read ${file}: ${messageOf2(err)}`);
+    throw new UsageError(`cannot read ${file}: ${messageOf3(err)}`);
   }
   let parsed;
   try {
@@ -538,13 +914,13 @@ function requireArt(config) {
 async function readToken(env, url) {
   const token = (env.RSHOW_TOKEN ?? "").trim();
   if (token !== "") return token;
-  const saved = await read(url);
-  if (saved !== void 0) return saved;
+  const found = await find(env, url);
+  if (found !== void 0) return found.token;
   throw new UsageError("no token: run rshow login, or set RSHOW_TOKEN");
 }
 
 // src/output.ts
-import process3 from "node:process";
+import process9 from "node:process";
 var Output = class {
   json;
   constructor(json) {
@@ -552,16 +928,16 @@ var Output = class {
   }
   data(value) {
     if (!this.json) return;
-    process3.stdout.write(`${JSON.stringify(value ?? null, null, 2)}
+    process9.stdout.write(`${JSON.stringify(value ?? null, null, 2)}
 `);
   }
   line(text) {
     if (this.json) return;
-    process3.stdout.write(`${text}
+    process9.stdout.write(`${text}
 `);
   }
   raw(text) {
-    process3.stdout.write(`${text}
+    process9.stdout.write(`${text}
 `);
   }
 };
@@ -591,7 +967,7 @@ commands:
   share <slug>            set mode or change shares
   pin <slug> <n|live>     serve version n, or live for the newest
   delete <slug> --yes     delete an artifact
-  login [--url u]         save the API token in the macOS Keychain
+  login [--url u]         save the API token for this account
   logout [--url u]        remove the saved token for a server
 
 global:
@@ -602,9 +978,13 @@ global:
 environment:
   RSHOW_URL               API base URL, overrides the config file
   RSHOW_ART               art base URL, overrides the config file
-  RSHOW_TOKEN             the API token, else the token saved by rshow login
-                          in the macOS Keychain; never read from a file
-  XDG_CONFIG_HOME         where to find rshow/config.json (default ~/.config)
+  RSHOW_TOKEN             the API token, else the token rshow login saved in
+                          the macOS Keychain, the Linux keyring or a 0600 file
+  RSHOW_TOKEN_STORE       force the keychain, keyring or file token store
+  XDG_CONFIG_HOME         where rshow keeps config.json and credentials
+  RSHOW_SYSTEM_CA         set to 0 to trust only the roots node bundles
+  RSHOW_EXTRA_CA_FILE     a PEM file of extra roots, such as a cluster's CA
+  NODE_USE_ENV_PROXY      set to 1 so fetch uses https_proxy (Node 24+)
 
 Start here: rshow init --url <admin-url> --art <viewer-url>, then rshow login.
 
@@ -702,8 +1082,8 @@ files win. Run rshow init to write url and art.
 A theme with no version, or @latest, is looked up on the art host and printed
 as <name>@<n>; when that fails a warning goes to stderr. --offline skips it, and
 so does a config with no art host.
-The token is RSHOW_TOKEN, else the token saved by rshow login in the macOS
-Keychain; never read from a file.`;
+The token is RSHOW_TOKEN, else the token rshow login saved in the macOS
+Keychain, the Linux keyring or a file with mode 600.`;
 var INIT_USAGE = `usage: rshow init --url <admin-url> --art <viewer-url> [--theme <name>] [--force]
 
 Writes the global config file that rshow reads first:
@@ -723,6 +1103,7 @@ package, the config files, the token, the api, the art host, the theme and the
 skills, one line each: ok|warn|fail  <check>  <detail>. With [dir] it reads
 <dir>/rshow.json too. A skill line warns and never fails.
 Network calls time out after 5 s. Exit 0 when no check failed, 6 when one did.
+The token line names its source: env, keychain, keyring, or file and its path.
 The token is never printed.`;
 var THEME_USAGE = `usage: rshow theme <new|check|preview|publish|list> [options]
 
@@ -849,14 +1230,19 @@ var DELETE_USAGE = `usage: rshow delete <slug> --yes
 Deletes the artifact and needs --yes.`;
 var LOGIN_USAGE = `usage: rshow login [--url u]
 
-Reads the token from stdin, checks it against the API, then saves it in the
-macOS Keychain. On a terminal it asks for the token with echo off, so it is
-never typed on a command line or pasted anywhere. The API base URL is the
-account, so each server keeps its own token; --url logs in to another one.
-RSHOW_TOKEN still wins over the saved token.`;
+Reads the token from stdin, checks it with the API, then saves it in the macOS
+Keychain, in the Linux keyring, or in $XDG_CONFIG_HOME/rshow/credentials with
+mode 600: the first store this machine has, and it reads it back to confirm.
+On a terminal it asks for the token with echo off, so it is never typed on a
+command line or pasted anywhere. The API base URL is the account, so each
+server keeps its own token; --url logs in to another one.
+Prints the email, the scope and where the token went.
+RSHOW_TOKEN still wins over the saved token, and RSHOW_TOKEN_STORE forces one
+of keychain, keyring or file.`;
 var LOGOUT_USAGE = `usage: rshow logout [--url u]
 
-Removes the token this server has in the macOS Keychain.`;
+Removes the token this server has from every store that holds it: the macOS
+Keychain, the Linux keyring and the 0600 credentials file.`;
 var PROJECT_USAGE = `usage: rshow project <create|list|show|share|delete> [options]
 
   project create <slug> [--title t] [--description d]
@@ -982,14 +1368,14 @@ function usageLine(usage) {
 }
 
 // src/commands/publish.ts
-import { stat as stat4 } from "node:fs/promises";
-import path7 from "node:path";
+import { stat as stat5 } from "node:fs/promises";
+import path8 from "node:path";
 
 // src/args.ts
 import { parseArgs } from "node:util";
 var LIST_FLAGS = /* @__PURE__ */ new Set(["--add", "--editor", "--remove", "--tag"]);
 var LOWERCASE_TAG = new RegExp(TAG_PATTERN.source, "i");
-function messageOf3(err) {
+function messageOf4(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function isListValue(token) {
@@ -1025,7 +1411,7 @@ function parseCommandArgs(argv, options, minPositionals, maxPositionals, hint) {
   try {
     parsed = parseArgs({ args: expanded, options, allowPositionals: true, strict: true });
   } catch (err) {
-    throw new UsageError(`${messageOf3(err)} (try: ${usageLine(hint)})`);
+    throw new UsageError(`${messageOf4(err)} (try: ${usageLine(hint)})`);
   }
   const count = parsed.positionals.length;
   if (count < minPositionals || count > maxPositionals) {
@@ -1057,21 +1443,21 @@ function emailList(args, name) {
 
 // src/build.ts
 import { spawn as spawn2 } from "node:child_process";
-import process4 from "node:process";
-function messageOf4(err) {
+import process10 from "node:process";
+function messageOf5(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function shellPath(env) {
   const shell = (env.SHELL ?? "").trim();
   return shell === "" ? "/bin/sh" : shell;
 }
-async function runBuild(dir, command, env = process4.env) {
+async function runBuild(dir, command, env = process10.env) {
   const code = await new Promise((resolve2, reject) => {
     const child = spawn2(shellPath(env), ["-c", command], { cwd: dir, stdio: "inherit" });
     child.once("error", reject);
     child.once("close", (value) => resolve2(value));
   }).catch((err) => {
-    throw new BuildError(`build failed: ${messageOf4(err)}`);
+    throw new BuildError(`build failed: ${messageOf5(err)}`);
   });
   if (code !== 0) {
     throw new BuildError(`build failed: ${code === null ? "killed by a signal" : `exit ${code}`}`);
@@ -1079,12 +1465,12 @@ async function runBuild(dir, command, env = process4.env) {
 }
 
 // src/check.ts
-import { readFile as readFile4, readdir, stat as stat2 } from "node:fs/promises";
-import path5 from "node:path";
+import { readFile as readFile6, readdir, stat as stat3 } from "node:fs/promises";
+import path6 from "node:path";
 
 // src/mockup.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import path3 from "node:path";
+import { readFile as readFile4 } from "node:fs/promises";
+import path4 from "node:path";
 var MAX_SCAN_BYTES = 4 * 1024 * 1024;
 var HTML_EXTENSIONS = /* @__PURE__ */ new Set([".html", ".htm"]);
 var MIN_COLS = 80;
@@ -1154,20 +1540,20 @@ function idOf(value) {
   const id = String(value ?? "").trim().replace(/^#/, "");
   return id === "" ? void 0 : id;
 }
-function warn(scan, line, message) {
+function warn2(scan, line, message) {
   scan.out.push({ path: scan.path, line, message });
 }
 function keyHint(scan, masked, from, to, line) {
   const hit = TERMINAL_KEYS.exec(masked.slice(from, to).replace(ANY_TAG, ""));
   if (hit === null) return;
-  warn(scan, line, `key hint binds the terminal's key: ${hit[0].trim()}`);
+  warn2(scan, line, `key hint binds the terminal's key: ${hit[0].trim()}`);
 }
 function sizeGate(scan, attrs, line) {
   if (attrs.has("data-allow-small")) return;
   const cols = sizeOf(attrs, "data-cols", MIN_COLS);
   const rows = sizeOf(attrs, "data-rows", MIN_ROWS);
   if (cols >= MIN_COLS && rows >= MIN_ROWS) return;
-  warn(scan, line, `tui below the 80x24 minimum (${cols}x${rows}), or mark it with data-allow-small`);
+  warn2(scan, line, `tui below the 80x24 minimum (${cols}x${rows}), or mark it with data-allow-small`);
 }
 function walk(scan, masked) {
   const stack = [];
@@ -1247,25 +1633,25 @@ function resolve(scan) {
     ids.add(item.id);
     const count = (seen.get(item.id) ?? 0) + 1;
     seen.set(item.id, count);
-    if (count === 2) warn(scan, item.line, `duplicate artboard id: ${item.id}`);
+    if (count === 2) warn2(scan, item.line, `duplicate artboard id: ${item.id}`);
   }
   const unknown = /* @__PURE__ */ new Set();
   for (const flow of scan.flows) {
     if (ids.has(flow.id) || unknown.has(flow.id)) continue;
     unknown.add(flow.id);
-    warn(scan, flow.line, `flow to #${flow.id} is not an artboard id in this file`);
+    warn2(scan, flow.line, `flow to #${flow.id} is not an artboard id in this file`);
   }
   for (const item of scan.boards) {
-    if (!item.title) warn(scan, item.line, `artboard ${item.label} has no data-title`);
+    if (!item.title) warn2(scan, item.line, `artboard ${item.label} has no data-title`);
     for (const block of item.blocks) {
       const missing = block.states.filter((state) => state !== "default" && !item.states.includes(state));
       if (missing.length === 0) continue;
-      warn(scan, block.line, `block data-state "${missing.join(",")}" is not in the artboard data-states`);
+      warn2(scan, block.line, `block data-state "${missing.join(",")}" is not in the artboard data-states`);
     }
     for (const state of item.states) {
       if (state === "default") continue;
       if (item.blocks.some((block) => block.states.includes(state))) continue;
-      warn(scan, item.line, `artboard ${item.label} lists state "${state}" that no block uses`);
+      warn2(scan, item.line, `artboard ${item.label} lists state "${state}" that no block uses`);
     }
   }
 }
@@ -1279,9 +1665,9 @@ function htmlWarnings(rel, text) {
 async function mockupWarnings(entries) {
   const out = [];
   for (const entry of entries) {
-    const ext = path3.extname(entry.rel).toLowerCase();
+    const ext = path4.extname(entry.rel).toLowerCase();
     if (!HTML_EXTENSIONS.has(ext) || entry.size > MAX_SCAN_BYTES) continue;
-    const text = await readFile2(entry.abs, "utf8").catch(() => void 0);
+    const text = await readFile4(entry.abs, "utf8").catch(() => void 0);
     if (text === void 0) continue;
     out.push(...htmlWarnings(entry.rel, text));
   }
@@ -1289,8 +1675,8 @@ async function mockupWarnings(entries) {
 }
 
 // src/style.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import path4 from "node:path";
+import { readFile as readFile5 } from "node:fs/promises";
+import path5 from "node:path";
 var MAX_SCAN_BYTES2 = 4 * 1024 * 1024;
 var STYLE_EXTENSIONS = /* @__PURE__ */ new Set([".html", ".htm", ".css"]);
 var GENERIC_FAMILIES = /* @__PURE__ */ new Set([
@@ -1687,9 +2073,9 @@ async function styleWarnings(entries) {
   const loaded = /* @__PURE__ */ new Set();
   const used = [];
   for (const entry of entries) {
-    const ext = path4.extname(entry.rel).toLowerCase();
+    const ext = path5.extname(entry.rel).toLowerCase();
     if (!STYLE_EXTENSIONS.has(ext) || entry.size > MAX_SCAN_BYTES2) continue;
-    const text = await readFile3(entry.abs, "utf8").catch(() => void 0);
+    const text = await readFile5(entry.abs, "utf8").catch(() => void 0);
     if (text === void 0) continue;
     collectLoaded(text, loaded);
     if (stylePathSkipped(entry.rel)) continue;
@@ -1740,9 +2126,6 @@ var CONNECT_PATTERNS = [
     pattern: /\.open\s*\(\s*["'`][A-Za-z]+["'`]\s*,\s*["'`](https?:\/\/[^"'`\s)]+)/g
   }
 ];
-function messageOf5(err) {
-  return err instanceof Error ? err.message : String(err);
-}
 function add(scan, file, line, severity, message) {
   scan.findings.push({ path: file, line, severity, message });
 }
@@ -1793,7 +2176,7 @@ function attributes2(raw) {
   }
   return found;
 }
-function hostOf(value) {
+function hostOf2(value) {
   if (!EXTERNAL.test(value) || IGNORED.test(value)) return void 0;
   try {
     const host = new URL(value, BASE_URL).hostname;
@@ -1817,7 +2200,7 @@ function resolvePath(file, ref) {
     decoded = ref;
   }
   const wantsIndex = decoded.endsWith("/");
-  const base = path5.posix.dirname(file);
+  const base = path6.posix.dirname(file);
   const parts2 = base === "." ? [] : base.split("/");
   for (const segment of decoded.split("/")) {
     if (segment === "" || segment === ".") continue;
@@ -1868,7 +2251,7 @@ function resolveRef(scan, file, raw, line) {
 }
 function checkScript(scan, file, line, attrs) {
   const value = (attrs.get("src") ?? "").trim();
-  const host = hostOf(value);
+  const host = hostOf2(value);
   if (host === void 0) return;
   if (!SCRIPT_HOSTS.includes(host)) {
     add(scan, file, line, "error", `script host not allowed: ${value} (allowed: ${SCRIPT_HOSTS.join(", ")})`);
@@ -1884,7 +2267,7 @@ function checkLink(scan, file, line, attrs) {
   const rel = (attrs.get("rel") ?? "").toLowerCase().split(/\s+/);
   if (!rel.includes("stylesheet")) return;
   const value = (attrs.get("href") ?? "").trim();
-  const host = hostOf(value);
+  const host = hostOf2(value);
   if (host === void 0 || STYLE_HOSTS.includes(host)) return;
   add(scan, file, line, "error", `stylesheet host not allowed: ${value} (allowed: ${STYLE_HOSTS.join(", ")})`);
 }
@@ -1940,9 +2323,9 @@ function scanHtml(scan, file, text, facts) {
   scanConnect(scan, file, masked, at);
 }
 async function scanFile(scan, entry, facts) {
-  const ext = path5.extname(entry.rel).toLowerCase();
+  const ext = path6.extname(entry.rel).toLowerCase();
   if (!SCAN_EXTENSIONS.has(ext) || entry.size > MAX_SCAN_BYTES3) return;
-  const text = await readFile4(entry.abs, "utf8");
+  const text = await readFile6(entry.abs, "utf8");
   if (ext === ".html" || ext === ".htm") {
     scanHtml(scan, entry.rel, text, facts);
     return;
@@ -1957,7 +2340,7 @@ async function collect(scan, dir, prefix, entries) {
   for (const item of items) {
     if (item.name.startsWith(".") || SKIPPED_NAMES.has(item.name)) continue;
     const rel = prefix === "" ? item.name : `${prefix}/${item.name}`;
-    const abs = path5.join(dir, item.name);
+    const abs = path6.join(dir, item.name);
     const problem = pathProblem(rel);
     if (problem !== void 0) add(scan, rel, 1, "error", problem);
     if (item.isDirectory()) {
@@ -1965,7 +2348,7 @@ async function collect(scan, dir, prefix, entries) {
       continue;
     }
     if (!item.isFile()) continue;
-    const info = await stat2(abs).catch(() => void 0);
+    const info = await stat3(abs).catch(() => void 0);
     if (info === void 0) continue;
     entries.push({ rel, abs, size: info.size });
   }
@@ -1973,11 +2356,12 @@ async function collect(scan, dir, prefix, entries) {
 async function checkThemeFile(scan, key2, rel, where) {
   const url = `${scan.art}/_themes/${key2}/${rel}`;
   let status2;
+  await readyNetwork();
   try {
     const reply = await scan.fetchImpl(url, { method: "HEAD" });
     status2 = reply.status;
   } catch (err) {
-    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}/${rel}: ${messageOf5(err)}`);
+    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}/${rel}: ${networkDetail(err, url)}`);
     return;
   }
   if (status2 === 404) add(scan, where.file, where.line, "error", `theme ${key2} has no ${rel} (${url})`);
@@ -1989,11 +2373,12 @@ async function checkTheme(scan, key2, where) {
   if (scan.offline || scan.art === "") return;
   const url = `${scan.art}/_themes/${key2}/tokens.css`;
   let status2;
+  await readyNetwork();
   try {
     const reply = await scan.fetchImpl(url, { method: "HEAD" });
     status2 = reply.status;
   } catch (err) {
-    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}: ${messageOf5(err)}`);
+    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}: ${networkDetail(err, url)}`);
     return;
   }
   if (status2 === 404) {
@@ -2011,8 +2396,8 @@ async function checkTheme(scan, key2, where) {
   }
 }
 async function checkFolder(input, opts = {}) {
-  const root2 = path5.resolve(input);
-  const info = await stat2(root2).catch(() => void 0);
+  const root2 = path6.resolve(input);
+  const info = await stat3(root2).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) throw new UsageError(`no such folder: ${input}`);
   const scan = {
     files: /* @__PURE__ */ new Set(),
@@ -2104,7 +2489,7 @@ function reportCheck(out, result) {
   out.line(summaryLine(result));
 }
 async function enforceCheck(out, target, opts = {}) {
-  const info = await stat2(target).catch(() => void 0);
+  const info = await stat3(target).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) return;
   const result = await checkFolder(target, opts);
   if (result.findings.length > 0) reportCheck(out, result);
@@ -2112,12 +2497,12 @@ async function enforceCheck(out, target, opts = {}) {
 }
 
 // src/publish.ts
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile8 } from "node:fs/promises";
 
 // src/files.ts
 import { createHash } from "node:crypto";
-import { readdir as readdir2, readFile as readFile5, stat as stat3 } from "node:fs/promises";
-import path6 from "node:path";
+import { readdir as readdir2, readFile as readFile7, stat as stat4 } from "node:fs/promises";
+import path7 from "node:path";
 var CONTENT_TYPES = {
   html: "text/html; charset=utf-8",
   css: "text/css; charset=utf-8",
@@ -2149,14 +2534,14 @@ var CONTENT_TYPES = {
 var DEFAULT_CONTENT_TYPE = "application/octet-stream";
 var SKIPPED_NAMES2 = /* @__PURE__ */ new Set(["node_modules"]);
 function contentTypeFor(filePath) {
-  const ext = path6.extname(filePath).replace(/^\./, "").toLowerCase();
+  const ext = path7.extname(filePath).replace(/^\./, "").toLowerCase();
   return CONTENT_TYPES[ext] ?? DEFAULT_CONTENT_TYPE;
 }
 function sha256Hex(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
 }
 async function readEntry(abs, rel) {
-  const bytes = await readFile5(abs);
+  const bytes = await readFile7(abs);
   return {
     path: rel,
     file: abs,
@@ -2174,7 +2559,7 @@ async function collectPaths(root2) {
       if (entry.name.startsWith(".")) continue;
       if (SKIPPED_NAMES2.has(entry.name)) continue;
       const rel = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
-      const abs = path6.join(dir, entry.name);
+      const abs = path7.join(dir, entry.name);
       if (entry.isDirectory()) {
         await walk2(abs, rel);
         continue;
@@ -2187,8 +2572,8 @@ async function collectPaths(root2) {
   return found;
 }
 async function buildManifest(input, opts = {}) {
-  const root2 = path6.resolve(input);
-  const info = await stat3(root2).catch(() => void 0);
+  const root2 = path7.resolve(input);
+  const info = await stat4(root2).catch(() => void 0);
   if (info === void 0) throw new UsageError(`no such file or folder: ${input}`);
   const entries = [];
   if (info.isFile()) {
@@ -2198,7 +2583,7 @@ async function buildManifest(input, opts = {}) {
     if (opts.requireIndex !== false && !paths.includes("index.html")) {
       throw new UsageError(`${input} has no index.html`);
     }
-    for (const rel of paths) entries.push(await readEntry(path6.join(root2, rel), rel));
+    for (const rel of paths) entries.push(await readEntry(path7.join(root2, rel), rel));
   } else {
     throw new UsageError(`not a file or folder: ${input}`);
   }
@@ -2316,7 +2701,7 @@ async function publishTarget(api, target, opts) {
   let uploaded = 0;
   await runPool(missing, UPLOAD_CONCURRENCY, async (hash) => {
     const entry = byHash.get(hash);
-    await api.putBlob(hash, await readFile6(entry.file));
+    await api.putBlob(hash, await readFile8(entry.file));
     uploaded += 1;
   });
   const version = await api.createVersion(opts.slug, { label: opts.label, files: manifest.files });
@@ -2344,7 +2729,7 @@ function sameFiles(local, remote) {
   const paths = Object.keys(local);
   const other = remote;
   if (paths.length !== Object.keys(other).length) return false;
-  return paths.every((path25) => other[path25]?.hash === local[path25]?.hash);
+  return paths.every((path26) => other[path26]?.hash === local[path26]?.hash);
 }
 function reportUnchanged(out, result) {
   out.data({ unchanged: true, slug: result.slug, version: result.version.n });
@@ -2372,26 +2757,19 @@ function validateSlug(slug) {
   return slug;
 }
 
-// src/warn.ts
-import process5 from "node:process";
-function warn2(message) {
-  process5.stderr.write(`rshow: warning: ${message}
-`);
-}
-
 // src/commands/publish.ts
 async function directoryOf(input) {
-  const dir = path7.resolve(input);
-  const info = await stat4(dir).catch(() => void 0);
+  const dir = path8.resolve(input);
+  const info = await stat5(dir).catch(() => void 0);
   return info !== void 0 && info.isDirectory() ? dir : void 0;
 }
 async function targetOf(input, dir, built, out) {
-  if (dir === void 0) return path7.resolve(input);
-  if (built) return path7.resolve(dir, out);
+  if (dir === void 0) return path8.resolve(input);
+  if (built) return path8.resolve(dir, out);
   const local = await readConfigFile(localConfigPath(dir));
-  return local.out === void 0 ? dir : path7.resolve(dir, out);
+  return local.out === void 0 ? dir : path8.resolve(dir, out);
 }
-async function run2(argv, ctx) {
+async function run(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     {
@@ -2418,7 +2796,7 @@ async function run2(argv, ctx) {
   }
   const target = await targetOf(input, dir, build !== void 0, config.out);
   const slug = validateSlug(
-    stringValue(args, "slug") ?? config.slug ?? deriveSlug(path7.basename(path7.resolve(input)))
+    stringValue(args, "slug") ?? config.slug ?? deriveSlug(path8.basename(path8.resolve(input)))
   );
   const title = stringValue(args, "title") ?? config.title;
   const label = stringValue(args, "label");
@@ -2429,7 +2807,7 @@ async function run2(argv, ctx) {
   const opts = { slug, title, label, project, tags, force: boolValue(args, "force") };
   if (!boolValue(args, "no-check")) {
     opts.beforeUpload = () => {
-      if (config.art === void 0) warn2("no art host configured; skipping theme checks");
+      if (config.art === void 0) warn("no art host configured; skipping theme checks");
       return enforceCheck(ctx.out, target, { art: config.art, offline: config.art === void 0 });
     };
   }
@@ -2453,9 +2831,9 @@ async function run2(argv, ctx) {
 }
 
 // src/commands/check.ts
-import { stat as stat5 } from "node:fs/promises";
-import path8 from "node:path";
-async function run3(argv, ctx) {
+import { stat as stat6 } from "node:fs/promises";
+import path9 from "node:path";
+async function run2(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     { offline: { type: "boolean" }, "no-style": { type: "boolean" } },
@@ -2464,13 +2842,13 @@ async function run3(argv, ctx) {
     CHECK_USAGE
   );
   const input = args.positionals[0];
-  const dir = path8.resolve(input);
-  const info = await stat5(dir).catch(() => void 0);
+  const dir = path9.resolve(input);
+  const info = await stat6(dir).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) throw new UsageError(`no such folder: ${input}`);
   const config = await ctx.config(dir);
   const offline = boolValue(args, "offline");
   const art = config.art;
-  if (art === void 0 && !offline) warn2("no art host configured; skipping theme checks");
+  if (art === void 0 && !offline) warn("no art host configured; skipping theme checks");
   const result = await checkFolder(dir, {
     art,
     offline: offline || art === void 0,
@@ -2488,21 +2866,21 @@ async function run3(argv, ctx) {
 }
 
 // src/commands/preview.ts
-import { stat as stat8 } from "node:fs/promises";
-import path11 from "node:path";
+import { stat as stat9 } from "node:fs/promises";
+import path12 from "node:path";
 
 // src/serve.ts
 import { watch } from "node:fs";
-import { mkdtemp as mkdtemp2, readFile as readFile8, rm as rm3, stat as stat7, writeFile as writeFile3 } from "node:fs/promises";
+import { mkdtemp as mkdtemp2, readFile as readFile10, rm as rm3, stat as stat8, writeFile as writeFile4 } from "node:fs/promises";
 import { createHash as createHash2 } from "node:crypto";
 import { createServer } from "node:http";
 import { tmpdir } from "node:os";
-import path10 from "node:path";
-import process6 from "node:process";
+import path11 from "node:path";
+import process11 from "node:process";
 
 // src/themes.ts
-import { cp, mkdir as mkdir2, readFile as readFile7, rm as rm2, stat as stat6, writeFile as writeFile2 } from "node:fs/promises";
-import path9 from "node:path";
+import { cp, mkdir as mkdir3, readFile as readFile9, rm as rm2, stat as stat7, writeFile as writeFile3 } from "node:fs/promises";
+import path10 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/color.ts
@@ -2837,7 +3215,7 @@ function flattenDtcg(tree) {
 function sourceDir() {
   try {
     const url = import.meta.url;
-    return typeof url === "string" && url !== "" ? path9.dirname(fileURLToPath2(url)) : void 0;
+    return typeof url === "string" && url !== "" ? path10.dirname(fileURLToPath2(url)) : void 0;
   } catch {
     return void 0;
   }
@@ -2845,7 +3223,7 @@ function sourceDir() {
 var HERE = sourceDir();
 function nearSource(...segments) {
   if (HERE === void 0) return [];
-  return [path9.resolve(HERE, "..", "..", "..", ...segments), path9.resolve(HERE, "..", ...segments)];
+  return [path10.resolve(HERE, "..", "..", "..", ...segments), path10.resolve(HERE, "..", ...segments)];
 }
 var BUILTIN_BASES = nearSource("themes");
 var BUILTIN_SKILL_BASES = nearSource("skills");
@@ -2863,7 +3241,7 @@ var FONT_FORMATS = {
   ".ttf": "truetype",
   ".otf": "opentype"
 };
-function isRecord2(value) {
+function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function stringField(value) {
@@ -2873,16 +3251,16 @@ function messageOf6(err) {
   return err instanceof Error ? err.message : String(err);
 }
 async function isFile(file) {
-  const info = await stat6(file).catch(() => void 0);
+  const info = await stat7(file).catch(() => void 0);
   return info !== void 0 && info.isFile();
 }
 async function isDir(dir) {
-  const info = await stat6(dir).catch(() => void 0);
+  const info = await stat7(dir).catch(() => void 0);
   return info !== void 0 && info.isDirectory();
 }
 function tokenMap(value) {
   const out = {};
-  if (!isRecord2(value)) return out;
+  if (!isRecord3(value)) return out;
   for (const [name, raw] of Object.entries(value)) {
     if (typeof raw === "string" && raw.trim() !== "") out[name] = raw.trim();
   }
@@ -2892,7 +3270,7 @@ function fontList(value) {
   if (!Array.isArray(value)) return [];
   const out = [];
   for (const item of value) {
-    if (!isRecord2(item)) continue;
+    if (!isRecord3(item)) continue;
     const family = stringField(item.family);
     const file = stringField(item.file);
     if (family === void 0 || file === void 0) continue;
@@ -2903,8 +3281,8 @@ function fontList(value) {
   return out;
 }
 function themeValues(json) {
-  const doc = isRecord2(json) ? json : {};
-  const modes = isRecord2(doc.modeTokens) ? doc.modeTokens : {};
+  const doc = isRecord3(json) ? json : {};
+  const modes = isRecord3(doc.modeTokens) ? doc.modeTokens : {};
   return {
     tokens: tokenMap(doc.tokens),
     light: tokenMap(modes.light),
@@ -2912,10 +3290,10 @@ function themeValues(json) {
   };
 }
 async function readThemeJson(dir) {
-  const file = path9.join(dir, "theme.json");
+  const file = path10.join(dir, "theme.json");
   let text;
   try {
-    text = await readFile7(file, "utf8");
+    text = await readFile9(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") throw new UsageError(`${dir} has no theme.json`);
     throw new UsageError(`cannot read ${file}: ${messageOf6(err)}`);
@@ -2926,13 +3304,13 @@ async function readThemeJson(dir) {
   } catch {
     throw new UsageError(`invalid JSON in ${file}`);
   }
-  if (!isRecord2(parsed)) throw new UsageError(`${file} must hold a JSON object`);
+  if (!isRecord3(parsed)) throw new UsageError(`${file} must hold a JSON object`);
   return { dir, text, json: parsed };
 }
 async function builtinThemeDir(name, bases = BUILTIN_BASES) {
   if (!THEME_NAME_PATTERN.test(name)) return void 0;
   for (const base of [...await binaryThemeBases(), ...bases]) {
-    const dir = path9.join(base, name);
+    const dir = path10.join(base, name);
     if (await isDir(dir)) return dir;
   }
   return void 0;
@@ -2968,8 +3346,8 @@ function stripPrint(css) {
   return out;
 }
 async function themeTokenSets(dir) {
-  const file = path9.join(dir, "tokens.css");
-  const text = await readFile7(file, "utf8").catch(() => void 0);
+  const file = path10.join(dir, "tokens.css");
+  const text = await readFile9(file, "utf8").catch(() => void 0);
   return extractTokens(text === void 0 ? [] : [stripPrint(text)]);
 }
 function declMap(list3) {
@@ -3022,7 +3400,7 @@ function presetFontCss(fonts) {
     lines.push(`  font-weight: ${font.weight ?? "400"};`);
     lines.push("  font-display: swap;");
     const url = fontUrl(font.file);
-    const format = FONT_FORMATS[path9.extname(url).toLowerCase()];
+    const format = FONT_FORMATS[path10.extname(url).toLowerCase()];
     const source = format === void 0 ? `url("${url}")` : `url("${url}") format("${format}")`;
     lines.push(`  src: ${source};`);
     return `@font-face {
@@ -3047,15 +3425,15 @@ function mergeTheme(base, preset, baseName) {
 }
 async function appendFile(file, addition) {
   if (addition === "") return;
-  const before = await readFile7(file, "utf8").catch(() => "");
+  const before = await readFile9(file, "utf8").catch(() => "");
   const glue = before === "" || before.endsWith("\n") ? "" : "\n";
-  await writeFile2(file, `${before}${glue}${addition}`);
+  await writeFile3(file, `${before}${glue}${addition}`);
 }
 async function buildPreset(presetDir, outDir) {
   const preset = await readThemeJson(presetDir);
   const baseName = stringField(preset.json.extends);
   await rm2(outDir, { recursive: true, force: true });
-  await mkdir2(outDir, { recursive: true });
+  await mkdir3(outDir, { recursive: true });
   if (baseName === void 0) {
     await cp(presetDir, outDir, { recursive: true });
     return;
@@ -3066,15 +3444,15 @@ async function buildPreset(presetDir, outDir) {
   await cp(baseDir, outDir, { recursive: true });
   const values = themeValues(preset.json);
   const name = stringField(preset.json.name) ?? baseName;
-  await appendFile(path9.join(outDir, "tokens.css"), presetTokenCss(name, values));
+  await appendFile(path10.join(outDir, "tokens.css"), presetTokenCss(name, values));
   const fonts = fontList(preset.json.fonts);
   if (fonts.length > 0) {
-    const from = path9.join(presetDir, "fonts");
-    if (await isDir(from)) await cp(from, path9.join(outDir, "fonts"), { recursive: true });
-    await appendFile(path9.join(outDir, "fonts.css"), presetFontCss(fonts));
+    const from = path10.join(presetDir, "fonts");
+    if (await isDir(from)) await cp(from, path10.join(outDir, "fonts"), { recursive: true });
+    await appendFile(path10.join(outDir, "fonts.css"), presetFontCss(fonts));
   }
   const merged = mergeTheme(base.json, preset.json, baseName);
-  await writeFile2(path9.join(outDir, "theme.json"), `${JSON.stringify(merged, null, 2)}
+  await writeFile3(path10.join(outDir, "theme.json"), `${JSON.stringify(merged, null, 2)}
 `);
 }
 function keyLine(text, key2, mode) {
@@ -3089,8 +3467,8 @@ function keyLine(text, key2, mode) {
   }
   return 0;
 }
-function finding(path25, line, severity, message) {
-  return { path: path25, line: Math.max(1, line), severity, message };
+function finding(path26, line, severity, message) {
+  return { path: path26, line: Math.max(1, line), severity, message };
 }
 function resolveValue(name, map, fallback) {
   let current = map[name] ?? fallback[name];
@@ -3188,13 +3566,13 @@ async function checkPreset(presetDir) {
   }
   const fonts = fontList(preset.json.fonts);
   for (const font of fonts) {
-    const file = path9.join(presetDir, font.file);
+    const file = path10.join(presetDir, font.file);
     if (!await isFile(file)) {
       findings.push(finding("theme.json", keyLine(text, "file"), "error", `missing font file: ${font.file}`));
     }
   }
   if (fonts.length > 0) {
-    const found = await Promise.all(LICENCE_FILES.map((rel) => isFile(path9.join(presetDir, "fonts", rel))));
+    const found = await Promise.all(LICENCE_FILES.map((rel) => isFile(path10.join(presetDir, "fonts", rel))));
     if (!found.some(Boolean)) {
       findings.push(
         finding(
@@ -3292,7 +3670,7 @@ var SCRIPT_TYPE = "text/javascript; charset=utf-8";
 function messageOf7(err) {
   return err instanceof Error ? err.message : String(err);
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function etagOf(text) {
@@ -3327,25 +3705,26 @@ async function resolveFile(root2, pathname) {
     return void 0;
   }
   if (decoded.includes("\0")) return void 0;
-  const target = path10.resolve(root2, decoded.replace(/^\/+/, ""));
-  const rel = path10.relative(root2, target);
-  if (rel.startsWith("..") || path10.isAbsolute(rel)) return void 0;
-  const info = await stat7(target).catch(() => void 0);
+  const target = path11.resolve(root2, decoded.replace(/^\/+/, ""));
+  const rel = path11.relative(root2, target);
+  if (rel.startsWith("..") || path11.isAbsolute(rel)) return void 0;
+  const info = await stat8(target).catch(() => void 0);
   if (info === void 0) return void 0;
   if (info.isFile()) return target;
   if (!info.isDirectory()) return void 0;
-  const index = path10.join(target, "index.html");
-  const indexInfo = await stat7(index).catch(() => void 0);
+  const index = path11.join(target, "index.html");
+  const indexInfo = await stat8(index).catch(() => void 0);
   if (indexInfo === void 0 || !indexInfo.isFile()) return void 0;
   return index;
 }
 async function proxy(art, pathname, method, res) {
   let reply;
+  await readyNetwork();
   try {
     reply = await fetch(art + pathname, { method: method === "HEAD" ? "HEAD" : "GET" });
   } catch (err) {
     res.writeHead(502, { "content-type": TEXT_TYPE, "x-rshow-source": "proxy" });
-    res.end(`proxy error: ${messageOf7(err)}
+    res.end(`proxy error: ${networkText(err, art + pathname)}
 `);
     return;
   }
@@ -3361,10 +3740,10 @@ async function proxy(art, pathname, method, res) {
 async function prepareTheme(dir) {
   const doc = await readThemeJson(dir);
   const declared = typeof doc.json.name === "string" ? doc.json.name.trim() : "";
-  const name = declared === "" ? path10.basename(dir) : declared;
+  const name = declared === "" ? path11.basename(dir) : declared;
   const base = typeof doc.json.extends === "string" ? doc.json.extends.trim() : "";
   if (base === "") return { name, source: dir, built: dir, label: "local" };
-  const built = await mkdtemp2(path10.join(tmpdir(), "rshow-theme-"));
+  const built = await mkdtemp2(path11.join(tmpdir(), "rshow-theme-"));
   await buildPreset(dir, built);
   return { name, source: dir, built, label: "preset" };
 }
@@ -3435,9 +3814,9 @@ function createDataStore() {
   const values = /* @__PURE__ */ new Map();
   let dir;
   const persist = async () => {
-    if (dir === void 0) dir = await mkdtemp2(path10.join(tmpdir(), "rshow-data-"));
+    if (dir === void 0) dir = await mkdtemp2(path11.join(tmpdir(), "rshow-data-"));
     const doc = Object.fromEntries(values);
-    await writeFile3(path10.join(dir, "data.json"), `${JSON.stringify(doc, null, 2)}
+    await writeFile4(path11.join(dir, "data.json"), `${JSON.stringify(doc, null, 2)}
 `);
   };
   return {
@@ -3483,9 +3862,9 @@ async function readBody(req, limit) {
 function valueText(value) {
   return JSON.stringify(value === void 0 ? null : value);
 }
-async function handleData(req, res, store, key2, method) {
+async function handleData(req, res, store2, key2, method) {
   if (method === "GET" || method === "HEAD") {
-    const entry = store.get(key2);
+    const entry = store2.get(key2);
     if (entry === void 0) {
       jsonError(res, "not found", 404);
       return;
@@ -3526,12 +3905,12 @@ async function handleData(req, res, store, key2, method) {
     jsonError(res, "expected a JSON body", 400);
     return;
   }
-  if (!isRecord3(parsed) || !("value" in parsed)) {
+  if (!isRecord4(parsed) || !("value" in parsed)) {
     jsonError(res, "expected {value}", 400);
     return;
   }
   const text = valueText(parsed.value);
-  const existing = store.get(key2);
+  const existing = store2.get(key2);
   const ifMatch = req.headers["if-match"] ?? null;
   if (ifMatch !== null && ifMatch.trim() !== "") {
     if (existing === void 0 || !etagMatches(ifMatch, etagOf(existing.text))) {
@@ -3539,7 +3918,7 @@ async function handleData(req, res, store, key2, method) {
       return;
     }
   }
-  if (existing === void 0 && store.count() >= MAX_DATA_KEYS) {
+  if (existing === void 0 && store2.count() >= MAX_DATA_KEYS) {
     jsonError(res, "too many keys for this artifact", 409);
     return;
   }
@@ -3547,7 +3926,7 @@ async function handleData(req, res, store, key2, method) {
     jsonError(res, "value too large", 413);
     return;
   }
-  const written = await store.write(key2, text);
+  const written = await store2.write(key2, text);
   jsonReply(res, 200, { ok: true, key: key2, updated_at: written.updated_at }, { etag: written.etag });
 }
 function subscribe(res, session) {
@@ -3578,7 +3957,7 @@ function injectReload(html) {
 ${html.slice(at)}`;
 }
 async function sendFile(res, method, session, file, headers = {}) {
-  const bytes = await readFile8(file);
+  const bytes = await readFile10(file);
   const type = contentTypeFor(file);
   const all = { "content-type": type, "cache-control": "no-store", ...headers };
   if (method === "HEAD") {
@@ -3603,7 +3982,7 @@ function startWatchers(session, targets) {
         const done = rebuild ? buildPreset(theme.source, theme.built) : Promise.resolve();
         done.then(
           () => broadcast(session),
-          (err) => warn2(`cannot rebuild ${target.dir}: ${messageOf7(err)}`)
+          (err) => warn(`cannot rebuild ${target.dir}: ${messageOf7(err)}`)
         );
       }, DEBOUNCE_MS);
       timer.unref();
@@ -3613,7 +3992,7 @@ function startWatchers(session, targets) {
       watcher.on("error", () => void 0);
       watchers.push(watcher);
     } catch (err) {
-      warn2(`cannot watch ${target.dir}: ${messageOf7(err)}`);
+      warn(`cannot watch ${target.dir}: ${messageOf7(err)}`);
     }
   }
   return watchers;
@@ -3656,16 +4035,16 @@ async function handle(req, res, session) {
 }
 function closeOnSignals(preview2) {
   const stop = () => {
-    preview2.close().catch(() => void 0).finally(() => process6.exit(0));
+    preview2.close().catch(() => void 0).finally(() => process11.exit(0));
   };
-  process6.once("SIGINT", stop);
-  process6.once("SIGTERM", stop);
+  process11.once("SIGINT", stop);
+  process11.once("SIGTERM", stop);
 }
 async function startPreview(opts) {
-  const dir = path10.resolve(opts.dir);
+  const dir = path11.resolve(opts.dir);
   const art = (opts.art ?? "").replace(/\/+$/, "");
   const host = opts.host ?? "127.0.0.1";
-  const theme = opts.theme === void 0 ? void 0 : await prepareTheme(path10.resolve(opts.theme));
+  const theme = opts.theme === void 0 ? void 0 : await prepareTheme(path11.resolve(opts.theme));
   const root2 = opts.root === "theme" && theme !== void 0 ? theme.built : dir;
   const session = {
     root: root2,
@@ -3733,12 +4112,12 @@ function portOf(value) {
   return port;
 }
 async function requireFolder(input, what) {
-  const dir = path11.resolve(input);
-  const info = await stat8(dir).catch(() => void 0);
+  const dir = path12.resolve(input);
+  const info = await stat9(dir).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) throw new UsageError(`no such ${what}: ${input}`);
   return dir;
 }
-async function run4(argv, ctx) {
+async function run3(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     {
@@ -3757,7 +4136,7 @@ async function run4(argv, ctx) {
   const offline = boolValue(args, "offline");
   const port = portOf(stringValue(args, "port"));
   const config = await ctx.config(dir);
-  if (config.art === void 0 && !offline) warn2("no art host configured; skipping the /_themes proxy");
+  if (config.art === void 0 && !offline) warn("no art host configured; skipping the /_themes proxy");
   const preview2 = await startPreview({
     dir,
     art: offline ? "" : config.art ?? "",
@@ -3781,7 +4160,14 @@ function themeRefOf(theme) {
   return { name: theme.slice(0, at), version: theme.slice(at + 1) };
 }
 async function fetchVersion(art, name) {
-  const reply = await fetch(`${art}/_themes/${name}.json`, { signal: AbortSignal.timeout(THEME_TIMEOUT_MS) });
+  const url = `${art}/_themes/${name}.json`;
+  await readyNetwork();
+  let reply;
+  try {
+    reply = await fetch(url, { signal: AbortSignal.timeout(THEME_TIMEOUT_MS) });
+  } catch (err) {
+    throw new Error(networkDetail(err, url));
+  }
   if (reply.status !== 200) throw new Error(`HTTP ${reply.status}`);
   const body = await reply.json();
   const version = body?.version;
@@ -3800,17 +4186,17 @@ async function resolveTheme2(config) {
   const ref = themeRefOf(theme);
   if (ref.version !== void 0 && ref.version !== "latest") return config;
   if (config.art === void 0) {
-    warn2("no art host configured; skipping theme version lookup");
+    warn("no art host configured; skipping theme version lookup");
     return config;
   }
   try {
     return { ...config, theme: await resolvedTheme(config.art, theme) };
   } catch (err) {
-    warn2(`cannot resolve theme ${ref.name}: ${messageOf8(err)}`);
+    warn(`cannot resolve theme ${ref.name}: ${messageOf8(err)}`);
     return config.theme === void 0 ? config : { ...config, theme: ref.name };
   }
 }
-async function run5(argv, ctx) {
+async function run4(argv, ctx) {
   const args = parseCommandArgs(argv, { offline: { type: "boolean" } }, 0, 1, CONFIG_USAGE);
   const dir = args.positionals[0];
   const loaded = await ctx.config(dir);
@@ -3820,14 +4206,14 @@ async function run5(argv, ctx) {
 }
 
 // src/commands/init.ts
-import { mkdir as mkdir3, readFile as readFile9, writeFile as writeFile4 } from "node:fs/promises";
-import path12 from "node:path";
-import process7 from "node:process";
+import { mkdir as mkdir4, readFile as readFile11, writeFile as writeFile5 } from "node:fs/promises";
+import path13 from "node:path";
+import process12 from "node:process";
 var LOCAL_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost"]);
 function messageOf9(err) {
   return err instanceof Error ? err.message : String(err);
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function serverUrl(value, flag) {
@@ -3849,16 +4235,16 @@ function serverUrl(value, flag) {
 async function rawConfig(file) {
   let text;
   try {
-    text = await readFile9(file, "utf8");
+    text = await readFile11(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return {};
     throw new UsageError(`cannot read ${file}: ${messageOf9(err)}`);
   }
   const parsed = JSON.parse(text);
-  if (!isRecord4(parsed)) throw new UsageError(`${file} must hold a JSON object`);
+  if (!isRecord5(parsed)) throw new UsageError(`${file} must hold a JSON object`);
   return parsed;
 }
-async function run6(argv, ctx) {
+async function run5(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     {
@@ -3874,7 +4260,7 @@ async function run6(argv, ctx) {
   const url = serverUrl(stringValue(args, "url"), "url");
   const art = serverUrl(stringValue(args, "art"), "art");
   const theme = (stringValue(args, "theme") ?? "").trim();
-  const file = globalConfigPath(process7.env);
+  const file = globalConfigPath(process12.env);
   const current = await readConfigFile(file);
   const same = (have, want) => have === void 0 || have.replace(/\/+$/, "") === want;
   if (!boolValue(args, "force")) {
@@ -3889,8 +4275,8 @@ async function run6(argv, ctx) {
   raw.url = url;
   raw.art = art;
   if (theme !== "") raw.theme = theme;
-  await mkdir3(path12.dirname(file), { recursive: true });
-  await writeFile4(file, `${JSON.stringify(raw, null, 2)}
+  await mkdir4(path13.dirname(file), { recursive: true });
+  await writeFile5(file, `${JSON.stringify(raw, null, 2)}
 `, "utf8");
   ctx.out.data({ path: file, url, art });
   ctx.out.line(`wrote ${file}`);
@@ -3898,15 +4284,15 @@ async function run6(argv, ctx) {
 }
 
 // src/commands/doctor.ts
-import { readFile as readFile11, stat as stat10 } from "node:fs/promises";
-import path14 from "node:path";
-import process8 from "node:process";
+import { readFile as readFile13, stat as stat11 } from "node:fs/promises";
+import path15 from "node:path";
+import process13 from "node:process";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/skills.ts
-import { cp as cp2, lstat, mkdir as mkdir4, readFile as readFile10, readdir as readdir3, readlink, rm as rm4, stat as stat9, symlink, writeFile as writeFile5 } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import path13 from "node:path";
+import { cp as cp2, lstat, mkdir as mkdir5, readFile as readFile12, readdir as readdir3, readlink, rm as rm4, stat as stat10, symlink, writeFile as writeFile6 } from "node:fs/promises";
+import { homedir as homedir4 } from "node:os";
+import path14 from "node:path";
 var SKILL_TARGETS = ["claude", "pi", "codex"];
 var SKILL_MARKER = ".rshow-skill";
 var SKILL_SOURCE = "rshow";
@@ -3916,26 +4302,26 @@ var TARGET_SEGMENTS = {
   codex: [".codex"]
 };
 async function isDir2(dir) {
-  const info = await stat9(dir).catch(() => void 0);
+  const info = await stat10(dir).catch(() => void 0);
   return info !== void 0 && info.isDirectory();
 }
 async function isFile2(file) {
-  const info = await stat9(file).catch(() => void 0);
+  const info = await stat10(file).catch(() => void 0);
   return info !== void 0 && info.isFile();
 }
 function isUnder(file, dir) {
-  const rel = path13.relative(dir, file);
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path13.sep}`) && !path13.isAbsolute(rel);
+  const rel = path14.relative(dir, file);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path14.sep}`) && !path14.isAbsolute(rel);
 }
 function homeDir(env) {
   const home = (env.HOME ?? "").trim();
-  return home !== "" ? home : homedir3();
+  return home !== "" ? home : homedir4();
 }
 function targetParent(home, target) {
-  return path13.join(home, ...TARGET_SEGMENTS[target]);
+  return path14.join(home, ...TARGET_SEGMENTS[target]);
 }
 function targetSkillsDir(home, target) {
-  return path13.join(targetParent(home, target), "skills");
+  return path14.join(targetParent(home, target), "skills");
 }
 async function detectedTargets(home) {
   const out = [];
@@ -3959,13 +4345,13 @@ function targetHint() {
   return SKILL_TARGETS.join(", ");
 }
 function defaultModeOf(dir) {
-  return dir.split(path13.sep).join("/").includes("/_npx/") ? "copy" : "link";
+  return dir.split(path14.sep).join("/").includes("/_npx/") ? "copy" : "link";
 }
 async function skillsSource(env) {
   const override = (env.RSHOW_SKILLS_DIR ?? "").trim();
   let dir;
   if (override !== "") {
-    dir = path13.resolve(override);
+    dir = path14.resolve(override);
     if (!await isDir2(dir)) throw new UsageError(`RSHOW_SKILLS_DIR is not a folder: ${dir}`);
   } else {
     dir = await builtinSkillsDir();
@@ -3973,22 +4359,22 @@ async function skillsSource(env) {
   if (dir === void 0) return void 0;
   const skills = [];
   for (const entry of await readdir3(dir, { withFileTypes: true }).catch(() => [])) {
-    if (entry.isDirectory() && await isFile2(path13.join(dir, entry.name, "SKILL.md"))) skills.push(entry.name);
+    if (entry.isDirectory() && await isFile2(path14.join(dir, entry.name, "SKILL.md"))) skills.push(entry.name);
   }
   skills.sort();
   return { dir, mode: await isBinary() ? "copy" : defaultModeOf(dir), skills };
 }
 function isOurLink(target, source) {
-  const resolved = path13.resolve(target);
-  if (isUnder(resolved, path13.resolve(source))) return true;
-  return /(^|\/)rshow\/skills\//.test(resolved.split(path13.sep).join("/"));
+  const resolved = path14.resolve(target);
+  if (isUnder(resolved, path14.resolve(source))) return true;
+  return /(^|\/)rshow\/skills\//.test(resolved.split(path14.sep).join("/"));
 }
 async function linkTargetOf(dst) {
   const value = await readlink(dst);
-  return path13.isAbsolute(value) ? value : path13.resolve(path13.dirname(dst), value);
+  return path14.isAbsolute(value) ? value : path14.resolve(path14.dirname(dst), value);
 }
 async function readMarker(dir) {
-  const text = await readFile10(path13.join(dir, SKILL_MARKER), "utf8").catch(() => void 0);
+  const text = await readFile12(path14.join(dir, SKILL_MARKER), "utf8").catch(() => void 0);
   if (text === void 0) return void 0;
   let parsed;
   try {
@@ -4007,7 +4393,7 @@ async function inspectSkill(dst, source, skill) {
   if (info.isSymbolicLink()) {
     const link = await linkTargetOf(dst);
     if (!isOurLink(link, source)) return { kind: "foreign" };
-    return { kind: "link", path: link, current: path13.resolve(link) === path13.join(path13.resolve(source), skill) };
+    return { kind: "link", path: link, current: path14.resolve(link) === path14.join(path14.resolve(source), skill) };
   }
   if (info.isDirectory()) {
     const marker = await readMarker(dst);
@@ -4045,17 +4431,17 @@ async function writeSkill(dst, src, mode, version) {
   }
   await cp2(src, dst, { recursive: true });
   const marker = { version, source: SKILL_SOURCE };
-  await writeFile5(path13.join(dst, SKILL_MARKER), `${JSON.stringify(marker, null, 2)}
+  await writeFile6(path14.join(dst, SKILL_MARKER), `${JSON.stringify(marker, null, 2)}
 `, "utf8");
 }
 async function installSkills(options) {
   const entries = [];
   for (const target of options.targets) {
     const dir = targetSkillsDir(options.home, target);
-    if (!options.dryRun) await mkdir4(dir, { recursive: true });
+    if (!options.dryRun) await mkdir5(dir, { recursive: true });
     for (const skill of options.source.skills) {
-      const dst = path13.join(dir, skill);
-      const src = path13.join(options.source.dir, skill);
+      const dst = path14.join(dir, skill);
+      const src = path14.join(options.source.dir, skill);
       const state = await inspectSkill(dst, options.source.dir, skill);
       const action = actionFor(state, options.version);
       if (!options.dryRun && (action === "installed" || action === "updated")) {
@@ -4072,7 +4458,7 @@ async function uninstallSkills(options) {
   for (const target of options.targets) {
     const dir = targetSkillsDir(options.home, target);
     for (const skill of (await readdir3(dir).catch(() => [])).sort()) {
-      const dst = path13.join(dir, skill);
+      const dst = path14.join(dir, skill);
       const state = await inspectSkill(dst, options.source.dir, skill);
       if (state.kind !== "link" && state.kind !== "copy") continue;
       if (!options.dryRun) await rm4(dst, { recursive: true, force: true });
@@ -4086,7 +4472,7 @@ async function skillsStatus(options) {
   for (const target of options.targets) {
     const dir = targetSkillsDir(options.home, target);
     for (const skill of options.source.skills) {
-      const dst = path13.join(dir, skill);
+      const dst = path14.join(dir, skill);
       out.push({ target, skill, state: await inspectSkill(dst, options.source.dir, skill), path: dst });
     }
   }
@@ -4099,13 +4485,13 @@ function messageOf10(err) {
   return err instanceof Error ? err.message : String(err);
 }
 async function isFile3(file) {
-  const info = await stat10(file).catch(() => void 0);
+  const info = await stat11(file).catch(() => void 0);
   return info !== void 0 && info.isFile();
 }
 function sourceDir2() {
   try {
     const url = import.meta.url;
-    return typeof url === "string" && url !== "" ? path14.dirname(fileURLToPath3(url)) : void 0;
+    return typeof url === "string" && url !== "" ? path15.dirname(fileURLToPath3(url)) : void 0;
   } catch {
     return void 0;
   }
@@ -4115,9 +4501,9 @@ async function packageJsonPath() {
   if (start === void 0) return void 0;
   let dir = start;
   for (let i = 0; i < 6; i += 1) {
-    const file = path14.join(dir, "package.json");
+    const file = path15.join(dir, "package.json");
     if (await isFile3(file)) return file;
-    const up = path14.dirname(dir);
+    const up = path15.dirname(dir);
     if (up === dir) break;
     dir = up;
   }
@@ -4141,7 +4527,7 @@ function minimumOf(range) {
 }
 async function nodeCheck() {
   const name = "node";
-  const current = process8.versions.node;
+  const current = process13.versions.node;
   const file = await packageJsonPath();
   if (file === void 0) {
     if (await isBinary()) return { name, status: "ok", detail: `v${current} (inside the binary)` };
@@ -4149,7 +4535,7 @@ async function nodeCheck() {
   }
   let range;
   try {
-    const body = JSON.parse(await readFile11(file, "utf8"));
+    const body = JSON.parse(await readFile13(file, "utf8"));
     range = typeof body.engines?.node === "string" ? body.engines.node : "";
   } catch (err) {
     return { name, status: "warn", detail: `v${current} (${messageOf10(err)})` };
@@ -4160,20 +4546,21 @@ async function nodeCheck() {
   return { name, status: status2, detail: `v${current} (needs ${range})` };
 }
 async function tokenOf(url) {
-  const env = (process8.env.RSHOW_TOKEN ?? "").trim();
+  const env = (process13.env.RSHOW_TOKEN ?? "").trim();
   if (env !== "") return { token: env, source: "env" };
-  if (url === void 0) return { source: "none" };
+  if (url === void 0) return {};
   try {
-    const saved = await read(url);
-    if (saved !== void 0) return { token: saved, source: "keychain" };
-    return { source: "none" };
+    const found = await find(process13.env, url);
+    if (found !== void 0) return { token: found.token, source: found.store.detail };
+    return {};
   } catch (err) {
-    return { source: "none", error: messageOf10(err) };
+    return { error: messageOf10(err) };
   }
 }
 async function getJson(url, token) {
   const headers = {};
   if (token !== void 0) headers.authorization = `Bearer ${token}`;
+  await readyNetwork();
   const reply = await fetch(url, { headers, signal: AbortSignal.timeout(TIMEOUT_MS) });
   if (reply.status !== 200) return { status: reply.status };
   const body = await reply.json().catch(() => void 0);
@@ -4199,7 +4586,7 @@ function tokenCheck(token) {
     const reason = token.error === void 0 ? "" : ` (${token.error})`;
     return { name, status: "fail", detail: `none${reason}: run rshow login, or set RSHOW_TOKEN` };
   }
-  return { name, status: "ok", detail: `source: ${token.source}` };
+  return { name, status: "ok", detail: `source: ${token.source ?? "none"}` };
 }
 async function apiCheck(url, token) {
   const name = "api";
@@ -4213,7 +4600,7 @@ async function apiCheck(url, token) {
     const scope = typeof body.scope === "string" ? body.scope : "";
     return { name, status: "ok", detail: `${email} (scope ${scope})` };
   } catch (err) {
-    return { name, status: "fail", detail: messageOf10(err) };
+    return { name, status: "fail", detail: networkDetail(err, `${url}/api/me`) };
   }
 }
 async function artCheck(art) {
@@ -4228,7 +4615,7 @@ async function artCheck(art) {
     }
     return { name, status: "ok", detail: `version ${version}` };
   } catch (err) {
-    return { name, status: "warn", detail: messageOf10(err) };
+    return { name, status: "warn", detail: networkDetail(err, `${art}/_themes/default.json`) };
   }
 }
 async function themeCheck(config) {
@@ -4247,10 +4634,10 @@ async function themeCheck(config) {
 }
 async function skillsCheck() {
   const name = "skills";
-  const home = homeDir(process8.env);
+  const home = homeDir(process13.env);
   const targets = await detectedTargets(home);
   if (targets.length === 0) return { name, status: "ok", detail: "no target detected" };
-  const source = await skillsSource(process8.env).catch(() => void 0);
+  const source = await skillsSource(process13.env).catch(() => void 0);
   if (source === void 0) return { name, status: "warn", detail: "no skills folder next to rshow" };
   const list3 = await skillsStatus({ home, source, targets });
   const problems = [];
@@ -4261,11 +4648,11 @@ async function skillsCheck() {
   if (problems.length === 0) return { name, status: "ok", detail: targets.join(", ") };
   return { name, status: "warn", detail: `${problems.join("; ")} (run rshow skills install)` };
 }
-async function run7(argv, ctx) {
+async function run6(argv, ctx) {
   const args = parseCommandArgs(argv, {}, 0, 1, DOCTOR_USAGE);
   const dir = args.positionals[0];
   const found = [];
-  for (const file of [globalConfigPath(process8.env), dir === void 0 ? void 0 : localConfigPath(dir)]) {
+  for (const file of [globalConfigPath(process13.env), dir === void 0 ? void 0 : localConfigPath(dir)]) {
     if (file !== void 0 && await isFile3(file)) found.push(file);
   }
   let config;
@@ -4293,13 +4680,13 @@ async function run7(argv, ctx) {
 }
 
 // src/commands/theme.ts
-import { mkdir as mkdir5, mkdtemp as mkdtemp3, rm as rm5, stat as stat12, writeFile as writeFile6 } from "node:fs/promises";
+import { mkdir as mkdir6, mkdtemp as mkdtemp3, rm as rm5, stat as stat13, writeFile as writeFile7 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import path16 from "node:path";
+import path17 from "node:path";
 
 // src/theme.ts
-import { readFile as readFile12, stat as stat11 } from "node:fs/promises";
-import path15 from "node:path";
+import { readFile as readFile14, stat as stat12 } from "node:fs/promises";
+import path16 from "node:path";
 function themeSlug(name) {
   return `theme-${name}`;
 }
@@ -4307,10 +4694,10 @@ function themeUrl(name, n) {
   return `/_themes/${name}@${n}/`;
 }
 async function readThemeMeta(dir) {
-  const file = path15.join(dir, "theme.json");
+  const file = path16.join(dir, "theme.json");
   let text;
   try {
-    text = await readFile12(file, "utf8");
+    text = await readFile14(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") throw new UsageError(`${dir} has no theme.json`);
     throw new UsageError(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
@@ -4331,8 +4718,8 @@ async function readThemeMeta(dir) {
   return { name };
 }
 async function requireThemeDir(input) {
-  const dir = path15.resolve(input);
-  const info = await stat11(dir).catch(() => void 0);
+  const dir = path16.resolve(input);
+  const info = await stat12(dir).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) throw new UsageError(`no such folder: ${input}`);
   return dir;
 }
@@ -4340,7 +4727,7 @@ async function requireThemeDir(input) {
 // src/commands/theme.ts
 async function presetCheck(dir) {
   const findings = await checkPreset(dir);
-  const info = await stat12(path16.join(dir, "theme.json")).catch(() => void 0);
+  const info = await stat13(path17.join(dir, "theme.json")).catch(() => void 0);
   const errors = findings.filter((finding2) => finding2.severity === "error").length;
   return { findings, errors, warnings: findings.length - errors, files: 1, bytes: info?.size ?? 0 };
 }
@@ -4369,14 +4756,14 @@ async function publish(argv, ctx) {
   if (!boolValue(args, "no-check")) {
     if (preset) await enforcePresetCheck(ctx.out, dir);
     else {
-      if (config.art === void 0) warn2("no art host configured; skipping theme checks");
+      if (config.art === void 0) warn("no art host configured; skipping theme checks");
       await enforceCheck(ctx.out, dir, { art: config.art, offline: config.art === void 0 });
     }
   }
   let target = dir;
   let temp;
   if (preset) {
-    temp = await mkdtemp3(path16.join(tmpdir2(), "rshow-theme-"));
+    temp = await mkdtemp3(path17.join(tmpdir2(), "rshow-theme-"));
     await buildPreset(dir, temp);
     target = temp;
   }
@@ -4464,14 +4851,14 @@ async function create(argv, ctx) {
   const from = stringValue(args, "from") ?? "default";
   const baseDir = await builtinThemeDir(from);
   if (baseDir === void 0) throw new UsageError(`no built-in theme: ${from}`);
-  const parent = path16.resolve(stringValue(args, "dir") ?? ".");
-  const target = path16.join(parent, name);
-  const exists2 = await stat12(target).catch(() => void 0);
+  const parent = path17.resolve(stringValue(args, "dir") ?? ".");
+  const target = path17.join(parent, name);
+  const exists2 = await stat13(target).catch(() => void 0);
   if (exists2 !== void 0) throw new UsageError(`${target} already exists`);
   const values = await baseRoleValues(baseDir, ROLE_TOKENS);
   const doc = { name, extends: from, tokens: {}, modeTokens: values };
-  await mkdir5(target, { recursive: true });
-  await writeFile6(path16.join(target, "theme.json"), `${JSON.stringify(doc, null, 2)}
+  await mkdir6(target, { recursive: true });
+  await writeFile7(path17.join(target, "theme.json"), `${JSON.stringify(doc, null, 2)}
 `);
   ctx.out.data({ path: target, name, extends: from });
   ctx.out.line(target);
@@ -4506,7 +4893,7 @@ async function preview(argv, ctx) {
   const port = portOf(stringValue(args, "port"));
   const offline = boolValue(args, "offline");
   const config = await ctx.config(dir);
-  if (config.art === void 0 && !offline) warn2("no art host configured; skipping the /_themes proxy");
+  if (config.art === void 0 && !offline) warn("no art host configured; skipping the /_themes proxy");
   const server = await startPreview({
     dir,
     theme: dir,
@@ -4520,7 +4907,7 @@ async function preview(argv, ctx) {
   ctx.out.raw(`${server.url}/index.html`);
   return EXIT.ok;
 }
-async function run8(argv, ctx) {
+async function run7(argv, ctx) {
   const [sub, ...rest] = argv;
   if (sub === void 0) throw new UsageError(`expected a theme command (try: ${usageLine(THEME_USAGE)})`);
   if (sub === "new") return create(rest, ctx);
@@ -4538,11 +4925,11 @@ async function run8(argv, ctx) {
 }
 
 // src/commands/skills.ts
-import path17 from "node:path";
-import process9 from "node:process";
+import path18 from "node:path";
+import process14 from "node:process";
 var CHANGE_ACTIONS = /* @__PURE__ */ new Set(["installed", "updated", "removed"]);
 async function sourceOf() {
-  const source = await skillsSource(process9.env);
+  const source = await skillsSource(process14.env);
   if (source === void 0) {
     throw new UsageError(`no skills folder next to rshow (set RSHOW_SKILLS_DIR to one)`);
   }
@@ -4555,7 +4942,7 @@ async function targetsWithDetection(names, home) {
 }
 function noTargetsError(home) {
   return new UsageError(
-    `no target detected (looked for ${path17.join(home, ".claude")}, ${path17.join(home, ".pi/agent")} and ${path17.join(home, ".codex")}); name one of ${targetHint()}`
+    `no target detected (looked for ${path18.join(home, ".claude")}, ${path18.join(home, ".pi/agent")} and ${path18.join(home, ".codex")}); name one of ${targetHint()}`
   );
 }
 function actionLine(entry, dryRun) {
@@ -4581,7 +4968,7 @@ async function install(argv, ctx) {
   const link = boolValue(args, "link");
   const copy = boolValue(args, "copy");
   if (link && copy) throw new UsageError(`--link and --copy cannot be used together (try: ${usageLine(SKILLS_INSTALL_USAGE)})`);
-  const home = homeDir(process9.env);
+  const home = homeDir(process14.env);
   const targets = await targetsWithDetection(args.positionals, home);
   if (targets.length === 0) throw noTargetsError(home);
   const source = await sourceOf();
@@ -4595,13 +4982,13 @@ async function install(argv, ctx) {
     else ctx.out.line(actionLine(entry, dryRun));
   }
   ctx.out.line(summaryLine2("installed", entries, targets, dryRun));
-  for (const dst of skipped) process9.stderr.write(`skip ${dst}: exists and is not from rshow
+  for (const dst of skipped) process14.stderr.write(`skip ${dst}: exists and is not from rshow
 `);
   return skipped.length > 0 ? EXIT.check : EXIT.ok;
 }
 async function uninstall(argv, ctx) {
   const args = parseCommandArgs(argv, { "dry-run": { type: "boolean" } }, 0, 3, SKILLS_UNINSTALL_USAGE);
-  const home = homeDir(process9.env);
+  const home = homeDir(process14.env);
   const targets = await targetsWithDetection(args.positionals, home);
   if (targets.length === 0) return EXIT.ok;
   const source = await sourceOf();
@@ -4619,7 +5006,7 @@ function actionOf(item) {
 }
 async function status(argv, ctx) {
   const args = parseCommandArgs(argv, {}, 0, 3, SKILLS_STATUS_USAGE);
-  const home = homeDir(process9.env);
+  const home = homeDir(process14.env);
   const targets = await targetsWithDetection(args.positionals, home);
   if (targets.length === 0) return EXIT.ok;
   const source = await sourceOf();
@@ -4634,12 +5021,12 @@ async function status(argv, ctx) {
     const name = `${item.target.padEnd(targetWidth)}  ${item.skill.padEnd(skillWidth)}`;
     ctx.out.line(`${name}  ${skillStateLabel(item.state)}`);
     if (item.state.kind === "copy" && !skillIsCurrent(item.state, VERSION)) {
-      warn2(`${item.path} is a copy of v${item.state.version}, this rshow is ${VERSION}: run rshow skills install`);
+      warn(`${item.path} is a copy of v${item.state.version}, this rshow is ${VERSION}: run rshow skills install`);
     }
   }
   return EXIT.ok;
 }
-async function run9(argv, ctx) {
+async function run8(argv, ctx) {
   const [sub, ...rest] = argv;
   switch (sub) {
     case "install":
@@ -4654,7 +5041,7 @@ async function run9(argv, ctx) {
 }
 
 // src/commands/list.ts
-async function run10(argv, ctx) {
+async function run9(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     { project: { type: "string" }, tag: { type: "string" }, q: { type: "string" } },
@@ -4687,7 +5074,7 @@ async function run10(argv, ctx) {
 }
 
 // src/commands/show.ts
-async function run11(argv, ctx) {
+async function run10(argv, ctx) {
   const args = parseCommandArgs(argv, {}, 1, 1, SHOW_USAGE);
   const slug = validateSlug(args.positionals[0]);
   const api = await ctx.api();
@@ -4720,7 +5107,7 @@ async function run11(argv, ctx) {
 
 // src/commands/share.ts
 var MODES = /* @__PURE__ */ new Set(["private", "people", "public"]);
-async function run12(argv, ctx) {
+async function run11(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     {
@@ -4760,7 +5147,7 @@ async function run12(argv, ctx) {
 }
 
 // src/commands/pin.ts
-async function run13(argv, ctx) {
+async function run12(argv, ctx) {
   const args = parseCommandArgs(argv, {}, 2, 2, PIN_USAGE);
   const slug = validateSlug(args.positionals[0]);
   const target = args.positionals[1];
@@ -4782,7 +5169,7 @@ async function run13(argv, ctx) {
 }
 
 // src/commands/delete.ts
-async function run14(argv, ctx) {
+async function run13(argv, ctx) {
   const args = parseCommandArgs(argv, { yes: { type: "boolean" } }, 1, 1, DELETE_USAGE);
   const slug = validateSlug(args.positionals[0]);
   if (!boolValue(args, "yes")) throw new UsageError(`delete needs --yes (try: ${usageLine(DELETE_USAGE)})`);
@@ -4896,7 +5283,7 @@ async function share(argv, ctx) {
   for (const member of members) ctx.out.line(`member ${member.email} ${member.role}`);
   for (const email of removals) ctx.out.line(`removed ${email}`);
 }
-async function remove2(argv, ctx) {
+async function remove4(argv, ctx) {
   const args = parseCommandArgs(argv, { yes: { type: "boolean" } }, 1, 1, PROJECT_DELETE_USAGE);
   const slug = validateSlug(args.positionals[0]);
   if (!boolValue(args, "yes")) {
@@ -4907,7 +5294,7 @@ async function remove2(argv, ctx) {
   ctx.out.data(null);
   ctx.out.line(`deleted: ${slug}`);
 }
-async function run15(argv, ctx) {
+async function run14(argv, ctx) {
   const [sub, ...rest] = argv;
   if (sub === void 0) {
     throw new UsageError(`expected a project command (try: ${usageLine(PROJECT_USAGE)})`);
@@ -4916,12 +5303,12 @@ async function run15(argv, ctx) {
   if (sub === "list") return list2(rest, ctx);
   if (sub === "show") return show(rest, ctx);
   if (sub === "share") return share(rest, ctx);
-  if (sub === "delete") return remove2(rest, ctx);
+  if (sub === "delete") return remove4(rest, ctx);
   throw new UsageError(`unknown project command: ${sub} (try: ${usageLine(PROJECT_USAGE)})`);
 }
 
 // src/commands/tag.ts
-async function run16(argv, ctx) {
+async function run15(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     { add: { type: "string", multiple: true }, remove: { type: "string", multiple: true } },
@@ -4931,13 +5318,13 @@ async function run16(argv, ctx) {
   );
   const slug = validateSlug(args.positionals[0]);
   const add2 = normalizeTags(stringList(args, "add"));
-  const remove3 = normalizeTags(stringList(args, "remove"));
-  if (add2.length === 0 && remove3.length === 0) {
+  const remove5 = normalizeTags(stringList(args, "remove"));
+  if (add2.length === 0 && remove5.length === 0) {
     throw new UsageError(`nothing to change (try: ${usageLine(TAG_USAGE)})`);
   }
   const api = await ctx.api();
   const current = await api.artifact(slug);
-  const tags = withTags(tagsOf(current?.tags), add2, remove3);
+  const tags = withTags(tagsOf(current?.tags), add2, remove5);
   const artifact = await api.patchArtifact(slug, { tags });
   ctx.out.data({ artifact, tags });
   ctx.out.line(`slug: ${slug}`);
@@ -4945,20 +5332,20 @@ async function run16(argv, ctx) {
 }
 
 // src/commands/handoff.ts
-import process13 from "node:process";
+import process18 from "node:process";
 
 // src/handoff.ts
-import { mkdir as mkdir6, stat as stat13, writeFile as writeFile8 } from "node:fs/promises";
-import path20 from "node:path";
-import process12 from "node:process";
+import { mkdir as mkdir7, stat as stat14, writeFile as writeFile9 } from "node:fs/promises";
+import path21 from "node:path";
+import process17 from "node:process";
 
 // src/cdp.ts
 import { spawn as spawn3 } from "node:child_process";
 import { existsSync, rmSync } from "node:fs";
 import { mkdtemp as mkdtemp4, rm as rm6 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import path18 from "node:path";
-import process10 from "node:process";
+import path19 from "node:path";
+import process15 from "node:process";
 var CHROME_CANDIDATES = [
   "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
   "/Applications/Chromium.app/Contents/MacOS/Chromium",
@@ -4978,9 +5365,9 @@ var LOAD_TIMEOUT_MS = 2e4;
 var liveBrowsers = /* @__PURE__ */ new Map();
 var signalHandlersInstalled = false;
 function killBrowser(child, signal) {
-  if (process10.platform !== "win32" && child.pid !== void 0) {
+  if (process15.platform !== "win32" && child.pid !== void 0) {
     try {
-      process10.kill(-child.pid, signal);
+      process15.kill(-child.pid, signal);
       return;
     } catch {
     }
@@ -5005,24 +5392,24 @@ function reapBrowsers() {
 }
 function onInterrupt() {
   reapBrowsers();
-  process10.exit(130);
+  process15.exit(130);
 }
 function onTerminate() {
   reapBrowsers();
-  process10.exit(143);
+  process15.exit(143);
 }
 function dropSignalHandlers() {
   if (!signalHandlersInstalled) return;
   signalHandlersInstalled = false;
-  process10.off("SIGINT", onInterrupt);
-  process10.off("SIGTERM", onTerminate);
+  process15.off("SIGINT", onInterrupt);
+  process15.off("SIGTERM", onTerminate);
 }
 function trackBrowser(child, profile) {
   liveBrowsers.set(child, profile);
   if (!signalHandlersInstalled) {
     signalHandlersInstalled = true;
-    process10.on("SIGINT", onInterrupt);
-    process10.on("SIGTERM", onTerminate);
+    process15.on("SIGINT", onInterrupt);
+    process15.on("SIGTERM", onTerminate);
   }
 }
 function forgetBrowser(child) {
@@ -5033,20 +5420,20 @@ var exitHookInstalled = false;
 function installExitHook() {
   if (exitHookInstalled) return;
   exitHookInstalled = true;
-  process10.once("exit", reapBrowsers);
+  process15.once("exit", reapBrowsers);
 }
 function messageOf11(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function whichInPath(name, pathValue) {
-  for (const dir of String(pathValue ?? "").split(path18.delimiter)) {
+  for (const dir of String(pathValue ?? "").split(path19.delimiter)) {
     if (dir === "") continue;
-    const file = path18.join(dir, name);
+    const file = path19.join(dir, name);
     if (existsSync(file)) return file;
   }
   return void 0;
 }
-function findChrome(env = process10.env) {
+function findChrome(env = process15.env) {
   const explicit = (env.CHROME ?? "").trim();
   if (explicit !== "") {
     if (existsSync(explicit)) return explicit;
@@ -5217,7 +5604,7 @@ var Chrome = class _Chrome {
   static async launch(opts = {}) {
     const binary = opts.binary ?? findChrome();
     if (binary === void 0) throw new UsageError("no Chrome or Chromium found, set CHROME");
-    const profile = await mkdtemp4(path18.join(tmpdir3(), "rshow-chrome-"));
+    const profile = await mkdtemp4(path19.join(tmpdir3(), "rshow-chrome-"));
     const child = spawn3(
       binary,
       [
@@ -5237,7 +5624,7 @@ var Chrome = class _Chrome {
         "--window-size=1440,900",
         "about:blank"
       ],
-      { stdio: ["ignore", "pipe", "pipe"], detached: process10.platform !== "win32" }
+      { stdio: ["ignore", "pipe", "pipe"], detached: process15.platform !== "win32" }
     );
     installExitHook();
     trackBrowser(child, profile);
@@ -5369,16 +5756,16 @@ var Page = class _Page {
 };
 
 // src/map.ts
-import { readFile as readFile13, writeFile as writeFile7 } from "node:fs/promises";
-import path19 from "node:path";
-import process11 from "node:process";
+import { readFile as readFile15, writeFile as writeFile8 } from "node:fs/promises";
+import path20 from "node:path";
+import process16 from "node:process";
 var MAP_FILE = "rshow.map.json";
-function isRecord5(value) {
+function isRecord6(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function textMap(file, key2, value) {
   if (value === void 0 || value === null) return {};
-  if (!isRecord5(value)) throw new UsageError(`${file}: ${key2} must be an object`);
+  if (!isRecord6(value)) throw new UsageError(`${file}: ${key2} must be an object`);
   const out = {};
   for (const [name, target] of Object.entries(value)) {
     if (typeof target !== "string") throw new UsageError(`${file}: ${key2}.${name} must be a string`);
@@ -5387,12 +5774,12 @@ function textMap(file, key2, value) {
   return out;
 }
 function mapPath(dir) {
-  return path19.resolve(dir ?? process11.cwd(), MAP_FILE);
+  return path20.resolve(dir ?? process16.cwd(), MAP_FILE);
 }
 async function readMapFile(file) {
   let text;
   try {
-    text = await readFile13(file, "utf8");
+    text = await readFile15(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return void 0;
     throw new UsageError(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
@@ -5403,7 +5790,7 @@ async function readMapFile(file) {
   } catch {
     throw new UsageError(`invalid JSON in ${file}`);
   }
-  if (!isRecord5(parsed)) throw new UsageError(`${file} must hold a JSON object`);
+  if (!isRecord6(parsed)) throw new UsageError(`${file} must hold a JSON object`);
   return {
     components: textMap(file, "components", parsed.components),
     tokens: textMap(file, "tokens", parsed.tokens),
@@ -5411,7 +5798,7 @@ async function readMapFile(file) {
   };
 }
 async function writeMapFile(file, map) {
-  await writeFile7(file, `${JSON.stringify(sortMap(map), null, 2)}
+  await writeFile8(file, `${JSON.stringify(sortMap(map), null, 2)}
 `);
 }
 function sortRecord(value) {
@@ -5855,14 +6242,14 @@ function parseTarget(input) {
   if (remote !== null) {
     return { kind: "remote", slug: remote[1], version: Number(remote[2]) };
   }
-  const dir = path20.resolve(input);
-  return { kind: "local", dir, slug: deriveSlug(path20.basename(dir)) || "handoff" };
+  const dir = path21.resolve(input);
+  return { kind: "local", dir, slug: deriveSlug(path21.basename(dir)) || "handoff" };
 }
 async function requireLocalDir(target) {
   if (target.kind !== "local") throw new UsageError("expected a local folder");
-  const info = await stat13(target.dir).catch(() => void 0);
+  const info = await stat14(target.dir).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) throw new UsageError(`no such folder: ${target.dir}`);
-  const index = await stat13(path20.join(target.dir, "index.html")).catch(() => void 0);
+  const index = await stat14(path21.join(target.dir, "index.html")).catch(() => void 0);
   if (index === void 0 || !index.isFile()) throw new UsageError(`${target.dir} has no index.html`);
   return target.dir;
 }
@@ -5877,10 +6264,10 @@ function safeName(text) {
   return cleaned === "" ? "screen" : cleaned;
 }
 function displayPath(target) {
-  const resolved = path20.resolve(target);
-  const relative = path20.relative(process12.cwd(), resolved);
+  const resolved = path21.resolve(target);
+  const relative = path21.relative(process17.cwd(), resolved);
   if (relative === "") return ".";
-  if (relative.startsWith("..") || path20.isAbsolute(relative)) return resolved;
+  if (relative.startsWith("..") || path21.isAbsolute(relative)) return resolved;
   return relative;
 }
 function baselineName(screen, state, width, mode) {
@@ -5915,10 +6302,11 @@ async function collectStyleTexts(url, fetchImpl = fetch) {
 }
 async function assertPublic(url, art, fetchImpl = fetch) {
   let reply;
+  await readyNetwork();
   try {
     reply = await fetchImpl(url, { headers: { accept: "text/html" }, redirect: "follow" });
   } catch (err) {
-    throw new UsageError(`cannot reach ${url}: ${err instanceof Error ? err.message : String(err)}`);
+    throw new UsageError(`cannot reach ${url}: ${networkDetail(err, url)}`);
   }
   const host = new URL(art).host;
   const wandered = new URL(reply.url === "" ? url : reply.url).host !== host;
@@ -6041,7 +6429,7 @@ async function runHandoff(target, opts) {
   const version = target.kind === "remote" ? target.version : null;
   const slug = target.slug;
   const url = target.kind === "remote" ? `${art}/${slug}/v${version}/` : "";
-  const out = path20.resolve(opts.out);
+  const out = path21.resolve(opts.out);
   let closePreview;
   let pageUrl = url;
   if (target.kind === "remote") {
@@ -6056,8 +6444,8 @@ async function runHandoff(target, opts) {
   const styleTexts = await collectStyleTexts(pageUrl, fetchImpl);
   const tokens = extractTokens(styleTexts);
   say(`tokens: ${tokens.light.length} light, ${tokens.dark.length} dark`);
-  await mkdir6(path20.join(out, "baseline"), { recursive: true });
-  await writeFile8(path20.join(out, "tokens.json"), `${JSON.stringify(dtcgTokens(tokens), null, 2)}
+  await mkdir7(path21.join(out, "baseline"), { recursive: true });
+  await writeFile9(path21.join(out, "tokens.json"), `${JSON.stringify(dtcgTokens(tokens), null, 2)}
 `);
   const screens = [];
   const baselines = [];
@@ -6108,7 +6496,7 @@ async function runHandoff(target, opts) {
             }
             const png = await capture(page, screen);
             const name = baselineName(screen.id, state, width, mode);
-            await writeFile8(path20.join(out, "baseline", name), png);
+            await writeFile9(path21.join(out, "baseline", name), png);
             baselines.push({ screen: screen.id, state, width, mode, file: `baseline/${name}` });
           }
         }
@@ -6137,7 +6525,7 @@ async function runHandoff(target, opts) {
     screens,
     baselines
   };
-  await writeFile8(path20.join(out, "spec.json"), `${JSON.stringify(spec, null, 2)}
+  await writeFile9(path21.join(out, "spec.json"), `${JSON.stringify(spec, null, 2)}
 `);
   const mapFile = MAP_FILE;
   let mapWritten = false;
@@ -6156,7 +6544,7 @@ async function runHandoff(target, opts) {
     createdAt,
     mapFile
   });
-  await writeFile8(path20.join(out, "HANDOFF.md"), markdown);
+  await writeFile9(path21.join(out, "HANDOFF.md"), markdown);
   return {
     out,
     url: pageUrl,
@@ -6197,7 +6585,7 @@ function modeList(text) {
   }
   return out;
 }
-async function run17(argv, ctx) {
+async function run16(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     { out: { type: "string" }, widths: { type: "string" }, modes: { type: "string" } },
@@ -6213,14 +6601,14 @@ async function run17(argv, ctx) {
     requireUrl(config);
     requireArt(config);
   } else if (config.art === void 0) {
-    warn2("no art host configured; skipping the /_themes proxy");
+    warn("no art host configured; skipping the /_themes proxy");
   }
   const result = await runHandoff(target, {
     out,
     widths: widthList(stringValue(args, "widths")),
     modes: modeList(stringValue(args, "modes")),
     art: config.art ?? "",
-    chrome: process13.env.CHROME,
+    chrome: process18.env.CHROME,
     onProgress: (line) => ctx.out.line(line)
   });
   const display = displayPath(result.out);
@@ -6246,11 +6634,11 @@ async function run17(argv, ctx) {
 }
 
 // src/commands/compare.ts
-import process15 from "node:process";
+import process20 from "node:process";
 
 // src/compare.ts
-import { copyFile, mkdir as mkdir7, readFile as readFile15, writeFile as writeFile9 } from "node:fs/promises";
-import path22 from "node:path";
+import { copyFile, mkdir as mkdir8, readFile as readFile17, writeFile as writeFile10 } from "node:fs/promises";
+import path23 from "node:path";
 
 // src/diff.ts
 var MAX_Y = 35215;
@@ -6412,10 +6800,10 @@ function diffImages(before, after, opts = {}) {
 
 // src/native.ts
 import { spawn as spawn4 } from "node:child_process";
-import { readFile as readFile14, unlink } from "node:fs/promises";
+import { readFile as readFile16, unlink as unlink2 } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
-import path21 from "node:path";
-import process14 from "node:process";
+import path22 from "node:path";
+import process19 from "node:process";
 var FILE_PREFIX = "file:";
 var WINDOW_PREFIX = "window:";
 var TMUX_PREFIX = "tmux:";
@@ -6444,9 +6832,9 @@ function isNative(source) {
 }
 async function captureNative(source, mapDir, deps = {}) {
   if (source.kind === "file") {
-    const file = path21.resolve(mapDir, source.file);
+    const file = path22.resolve(mapDir, source.file);
     try {
-      return new Uint8Array(await readFile14(file));
+      return new Uint8Array(await readFile16(file));
     } catch {
       throw new UsageError(`no screenshot at ${source.file}, which is relative to rshow.map.json`);
     }
@@ -6494,8 +6882,8 @@ function noWindow(title, seen) {
   return new UsageError(`no window matches ${JSON.stringify(title)} (${list3}); use ${WINDOW_PREFIX} with an owner name or a title, or ${NATIVE_HINT}`);
 }
 var systemRunner = {
-  run: (bin2, args) => new Promise((resolve2, reject) => {
-    const child = spawn4(bin2, [...args], { stdio: ["ignore", "pipe", "pipe"] });
+  run: (bin3, args) => new Promise((resolve2, reject) => {
+    const child = spawn4(bin3, [...args], { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     child.stdout?.setEncoding("utf8");
@@ -6506,10 +6894,10 @@ var systemRunner = {
     child.stderr?.on("data", (chunk2) => {
       stderr += chunk2;
     });
-    child.on("error", (err) => reject(new UsageError(`cannot run ${bin2}: ${err.message}`)));
+    child.on("error", (err) => reject(new UsageError(`cannot run ${bin3}: ${err.message}`)));
     child.on("close", (code) => {
       if (code !== 0) {
-        reject(new UsageError(stderr.trim() === "" ? `${bin2} exited ${code}` : `${bin2}: ${stderr.trim()}`));
+        reject(new UsageError(stderr.trim() === "" ? `${bin3} exited ${code}` : `${bin3}: ${stderr.trim()}`));
         return;
       }
       resolve2(stdout);
@@ -6517,9 +6905,9 @@ var systemRunner = {
   })
 };
 async function captureWindow(title, deps = {}) {
-  const platform = deps.platform ?? process14.platform;
+  const platform = deps.platform ?? process19.platform;
   const runner = deps.runner ?? systemRunner;
-  const scratch = path21.join(tmpdir4(), `rshow-window-${process14.pid}-${Date.now()}.png`);
+  const scratch = path22.join(tmpdir4(), `rshow-window-${process19.pid}-${Date.now()}.png`);
   const wrap = (err) => err instanceof UsageError ? err : new UsageError(`window: ${title}: ${err instanceof Error ? err.message : String(err)}; ${NATIVE_HINT}`);
   try {
     if (platform === "darwin") {
@@ -6535,11 +6923,11 @@ async function captureWindow(title, deps = {}) {
     } else {
       throw new UsageError(`window: capture is not supported on ${platform}; ${NATIVE_HINT}`);
     }
-    return new Uint8Array(await readFile14(scratch));
+    return new Uint8Array(await readFile16(scratch));
   } catch (err) {
     throw wrap(err);
   } finally {
-    await unlink(scratch).catch(() => {
+    await unlink2(scratch).catch(() => {
     });
   }
 }
@@ -6576,23 +6964,23 @@ function extractPalette(image, k = 8) {
       const g = image.data[pos + 1];
       const b = image.data[pos + 2];
       const key2 = r >> BIN_SHIFT << BITS * 2 | g >> BIN_SHIFT << BITS | b >> BIN_SHIFT;
-      const bin2 = bins.get(key2);
-      if (bin2 === void 0) bins.set(key2, { count: 1, r, g, b });
+      const bin3 = bins.get(key2);
+      if (bin3 === void 0) bins.set(key2, { count: 1, r, g, b });
       else {
-        bin2.count += 1;
-        bin2.r += r;
-        bin2.g += g;
-        bin2.b += b;
+        bin3.count += 1;
+        bin3.r += r;
+        bin3.g += g;
+        bin3.b += b;
       }
       used += 1;
     }
   }
   if (used === 0) return [];
   const seeds = [...bins.values()].sort((left, right) => right.count - left.count).slice(0, k);
-  let centers = seeds.map((bin2) => ({ r: bin2.r / bin2.count, g: bin2.g / bin2.count, b: bin2.b / bin2.count }));
-  const points = [...bins.values()].map((bin2) => ({
-    color: { r: bin2.r / bin2.count, g: bin2.g / bin2.count, b: bin2.b / bin2.count },
-    weight: bin2.count
+  let centers = seeds.map((bin3) => ({ r: bin3.r / bin3.count, g: bin3.g / bin3.count, b: bin3.b / bin3.count }));
+  const points = [...bins.values()].map((bin3) => ({
+    color: { r: bin3.r / bin3.count, g: bin3.g / bin3.count, b: bin3.b / bin3.count },
+    weight: bin3.count
   }));
   for (let round2 = 0; round2 < ROUNDS && centers.length > 1; round2 += 1) {
     const sums = centers.map(() => ({ r: 0, g: 0, b: 0, weight: 0 }));
@@ -7307,9 +7695,9 @@ function compareGrid(expected, actual) {
   }
   return { rows, differing, pass: differing.length === 0 };
 }
-function captureTmux(target, bin2 = "tmux") {
+function captureTmux(target, bin3 = "tmux") {
   return new Promise((resolve2, reject) => {
-    const child = spawn5(bin2, ["capture-pane", "-p", "-e", "-t", target], { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn5(bin3, ["capture-pane", "-p", "-e", "-t", target], { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     child.stdout?.setEncoding("utf8");
@@ -7321,11 +7709,11 @@ function captureTmux(target, bin2 = "tmux") {
       stderr += chunk2;
     });
     child.on("error", (err) => {
-      reject(new ApiError(`cannot run ${bin2}: ${err.message}`));
+      reject(new ApiError(`cannot run ${bin3}: ${err.message}`));
     });
     child.on("close", (code) => {
       if (code !== 0) {
-        reject(new ApiError(stderr.trim() === "" ? `${bin2} exited ${code}` : stderr.trim()));
+        reject(new ApiError(stderr.trim() === "" ? `${bin3} exited ${code}` : stderr.trim()));
         return;
       }
       resolve2(stdout);
@@ -7349,9 +7737,9 @@ var EMPTY_MAP = { components: {}, tokens: {}, screens: {} };
 async function readJson(file, what) {
   let text;
   try {
-    text = await readFile15(file, "utf8");
+    text = await readFile17(file, "utf8");
   } catch {
-    throw new UsageError(`${what} is missing ${path22.basename(file)} (run rshow handoff first)`);
+    throw new UsageError(`${what} is missing ${path23.basename(file)} (run rshow handoff first)`);
   }
   try {
     return JSON.parse(text);
@@ -7360,13 +7748,13 @@ async function readJson(file, what) {
   }
 }
 async function readHandoff(dir) {
-  const spec = await readJson(path22.join(dir, "spec.json"), dir);
+  const spec = await readJson(path23.join(dir, "spec.json"), dir);
   if (spec === null || typeof spec !== "object" || !Array.isArray(spec.screens)) {
     throw new UsageError(`${dir}/spec.json does not hold a handoff spec`);
   }
   let tokens = { light: [], dark: [] };
   try {
-    tokens = flattenDtcg(JSON.parse(await readFile15(path22.join(dir, "tokens.json"), "utf8")));
+    tokens = flattenDtcg(JSON.parse(await readFile17(path23.join(dir, "tokens.json"), "utf8")));
   } catch {
     tokens = { light: [], dark: [] };
   }
@@ -7389,15 +7777,15 @@ function clipOf(info, screenId) {
 async function runCompare(opts) {
   const say = opts.onProgress ?? (() => {
   });
-  const dir = path22.resolve(opts.against);
+  const dir = path23.resolve(opts.against);
   const { spec, tokens } = await readHandoff(dir);
-  const mapFile = opts.map === void 0 ? mapPath() : path22.resolve(opts.map);
+  const mapFile = opts.map === void 0 ? mapPath() : path23.resolve(opts.map);
   const map = await readMapFile(mapFile) ?? EMPTY_MAP;
-  const mapDir = path22.dirname(mapFile);
-  const reportDir = path22.join(dir, "compare-report");
-  const imagesDir = path22.join(reportDir, "images");
-  await mkdir7(imagesDir, { recursive: true });
-  await mkdir7(path22.join(dir, "diff"), { recursive: true });
+  const mapDir = path23.dirname(mapFile);
+  const reportDir = path23.join(dir, "compare-report");
+  const imagesDir = path23.join(reportDir, "images");
+  await mkdir8(imagesDir, { recursive: true });
+  await mkdir8(path23.join(dir, "diff"), { recursive: true });
   const results = [];
   const collected = [];
   let skipped = 0;
@@ -7432,16 +7820,16 @@ async function runCompare(opts) {
       throw new UsageError(`tmux capture failed for ${target}: ${err instanceof Error ? err.message : String(err)}`);
     });
     const text = opts.tuiColors ? captured : stripAnsi(captured);
-    const baselineFile = path22.join(dir, "baseline", `${safeName(screen)}.txt`);
+    const baselineFile = path23.join(dir, "baseline", `${safeName(screen)}.txt`);
     let expected;
     try {
-      expected = await readFile15(baselineFile, "utf8");
+      expected = await readFile17(baselineFile, "utf8");
     } catch {
       expected = void 0;
     }
     if (expected === void 0) {
-      await mkdir7(path22.dirname(baselineFile), { recursive: true });
-      await writeFile9(baselineFile, text);
+      await mkdir8(path23.dirname(baselineFile), { recursive: true });
+      await writeFile10(baselineFile, text);
       results.push({
         screen,
         state: "default",
@@ -7486,12 +7874,12 @@ async function runCompare(opts) {
     const raw = (map.screens[screen] ?? "").trim();
     say(`capture: ${raw}`);
     let capture2;
-    let failure2;
+    let failure;
     try {
       capture2 = decodePng(await captureNative(group.source, mapDir));
     } catch (err) {
       if (err instanceof UsageError) throw err;
-      failure2 = err instanceof Error ? err.message : String(err);
+      failure = err instanceof Error ? err.message : String(err);
     }
     const screenSpec = spec.screens.find((item) => item.id === screen);
     const rubricFile = nativeName(screen);
@@ -7510,13 +7898,13 @@ async function runCompare(opts) {
         rubric: rubricFile,
         mismatches: []
       };
-      if (failure2 !== void 0 || capture2 === void 0) {
-        results.push({ ...base, note: `capture failed: ${failure2 ?? "no pixels"}` });
+      if (failure !== void 0 || capture2 === void 0) {
+        results.push({ ...base, note: `capture failed: ${failure ?? "no pixels"}` });
         continue;
       }
       let expectedImage;
       try {
-        expectedImage = decodePng(new Uint8Array(await readFile15(path22.join(dir, baseline.file))));
+        expectedImage = decodePng(new Uint8Array(await readFile17(path23.join(dir, baseline.file))));
       } catch {
         results.push({ ...base, note: `missing baseline ${baseline.file}` });
         continue;
@@ -7528,10 +7916,10 @@ async function runCompare(opts) {
         threshold: opts.threshold
       });
       const diffPng = encodePng(diff.image);
-      await writeFile9(path22.join(imagesDir, `${stem}-diff.png`), diffPng);
-      await writeFile9(path22.join(dir, "diff", `${stem}.png`), diffPng);
-      await writeFile9(path22.join(imagesDir, `${stem}-capture.png`), encodePng(scaled));
-      await copyFile(path22.join(dir, baseline.file), path22.join(imagesDir, `${stem}-baseline.png`));
+      await writeFile10(path23.join(imagesDir, `${stem}-diff.png`), diffPng);
+      await writeFile10(path23.join(dir, "diff", `${stem}.png`), diffPng);
+      await writeFile10(path23.join(imagesDir, `${stem}-capture.png`), encodePng(scaled));
+      await copyFile(path23.join(dir, baseline.file), path23.join(imagesDir, `${stem}-baseline.png`));
       const expected = screenSpec === void 0 ? [] : normativeColors(screenSpec, tokens, baseline.state, baseline.mode);
       const palette = checkPalette(extractPalette(scaled), expected);
       const pixelOk = diff.ratio <= opts.nativeMaxDiffRatio;
@@ -7576,7 +7964,7 @@ async function runCompare(opts) {
       });
     }
     if (screenSpec !== void 0) {
-      await writeFile9(path22.join(reportDir, rubricFile), `${rubricMarkdown({ screen: screenSpec, shots })}
+      await writeFile10(path23.join(reportDir, rubricFile), `${rubricMarkdown({ screen: screenSpec, shots })}
 `);
     }
   }
@@ -7633,12 +8021,12 @@ async function runCompare(opts) {
               }
               const clip = clipOf(info, screenId) ? await screenClip(page, screenId) : null;
               const actual = await page.screenshot(clip ?? void 0);
-              const actualFile = path22.join(imagesDir, `${stem}-actual.png`);
-              await writeFile9(actualFile, actual);
-              const baselineFile = path22.join(dir, baseline.file);
+              const actualFile = path23.join(imagesDir, `${stem}-actual.png`);
+              await writeFile10(actualFile, actual);
+              const baselineFile = path23.join(dir, baseline.file);
               let expected;
               try {
-                expected = new Uint8Array(await readFile15(baselineFile));
+                expected = new Uint8Array(await readFile17(baselineFile));
               } catch {
                 results.push({
                   screen: baseline.screen,
@@ -7653,14 +8041,14 @@ async function runCompare(opts) {
                 });
                 continue;
               }
-              const baselineCopy = path22.join(imagesDir, `${stem}-baseline.png`);
+              const baselineCopy = path23.join(imagesDir, `${stem}-baseline.png`);
               await copyFile(baselineFile, baselineCopy);
               const left = decodePng(expected);
               const right = decodePng(actual);
               const diff = diffImages(left, right, { threshold: opts.threshold });
               const diffPng = encodePng(diff.image);
-              await writeFile9(path22.join(imagesDir, `${stem}-diff.png`), diffPng);
-              await writeFile9(path22.join(dir, "diff", `${stem}.png`), diffPng);
+              await writeFile10(path23.join(imagesDir, `${stem}-diff.png`), diffPng);
+              await writeFile10(path23.join(dir, "diff", `${stem}.png`), diffPng);
               const note = left.width === right.width && left.height === right.height ? void 0 : `size ${left.width}x${left.height} against ${right.width}x${right.height}`;
               results.push({
                 screen: baseline.screen,
@@ -7729,8 +8117,8 @@ async function runCompare(opts) {
   const checked = results.filter((item) => item.source !== "").length;
   const review = results.filter((item) => item.status === "review").length;
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  await writeFile9(
-    path22.join(reportDir, "report.json"),
+  await writeFile10(
+    path23.join(reportDir, "report.json"),
     `${JSON.stringify(
       {
         schema: 1,
@@ -7766,8 +8154,8 @@ async function runCompare(opts) {
     )}
 `
   );
-  await writeFile9(
-    path22.join(reportDir, "index.html"),
+  await writeFile10(
+    path23.join(reportDir, "index.html"),
     reportHtml({
       spec,
       results,
@@ -7888,7 +8276,7 @@ function ratioValue(text, name, fallback) {
   }
   return value;
 }
-async function run18(argv, ctx) {
+async function run17(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     {
@@ -7918,7 +8306,7 @@ async function run18(argv, ctx) {
       DEFAULT_NATIVE_MAX_DIFF_RATIO
     ),
     tuiColors: boolValue(args, "tui-colors"),
-    chrome: process15.env.CHROME,
+    chrome: process20.env.CHROME,
     onProgress: (line) => ctx.out.line(line)
   });
   const failing = result.results.filter((item) => !item.pass);
@@ -7966,8 +8354,8 @@ async function run18(argv, ctx) {
 }
 
 // src/commands/docs.ts
-import { mkdir as mkdir8, readFile as readFile16, rm as rm7, writeFile as writeFile10 } from "node:fs/promises";
-import path23 from "node:path";
+import { mkdir as mkdir9, readFile as readFile18, rm as rm7, writeFile as writeFile11 } from "node:fs/promises";
+import path24 from "node:path";
 var USAGE = {
   publish: PUBLISH_USAGE,
   check: CHECK_USAGE,
@@ -8246,7 +8634,7 @@ function heading(label) {
 async function themeTokensPage() {
   const dir = await builtinThemeDir("default");
   if (dir === void 0) throw new Error("no built-in theme: default");
-  const css = await readFile16(path23.join(dir, "tokens.css"), "utf8");
+  const css = await readFile18(path24.join(dir, "tokens.css"), "utf8");
   const end = css.indexOf("*/");
   const roles = parseRoles(end < 0 ? css : css.slice(0, end));
   const sections = parseSections(rootBlock(css));
@@ -8294,45 +8682,45 @@ function exitCodesPage() {
 `;
 }
 async function generate(out) {
-  const dir = path23.join(out, "commands");
+  const dir = path24.join(out, "commands");
   await rm7(dir, { recursive: true, force: true });
-  await mkdir8(dir, { recursive: true });
+  await mkdir9(dir, { recursive: true });
   const rows = commandRows();
   const files = [];
   for (const row of rows) {
-    const file = path23.join(dir, row.file);
-    await writeFile10(file, commandPage(row, rows));
+    const file = path24.join(dir, row.file);
+    await writeFile11(file, commandPage(row, rows));
     files.push(file);
   }
-  const index = path23.join(dir, "index.md");
-  await writeFile10(index, indexPage(rows));
+  const index = path24.join(dir, "index.md");
+  await writeFile11(index, indexPage(rows));
   files.push(index);
   for (const [name, text] of [
     ["theme-tokens.md", await themeTokensPage()],
     ["exit-codes.md", exitCodesPage()]
   ]) {
-    const file = path23.join(out, name);
-    await writeFile10(file, text);
+    const file = path24.join(out, name);
+    await writeFile11(file, text);
     files.push(file);
   }
-  return { commands: rows.length, files: files.map((file) => path23.relative(out, file)).sort() };
+  return { commands: rows.length, files: files.map((file) => path24.relative(out, file)).sort() };
 }
-async function run19(argv, ctx) {
+async function run18(argv, ctx) {
   const args = parseCommandArgs(argv, { out: { type: "string" } }, 0, 0, DOCS_USAGE);
   const out = stringValue(args, "out");
   if (out === void 0) throw new UsageError(`docs needs --out <dir> (try: ${usageLine(DOCS_USAGE)})`);
   const result = await generate(out);
   ctx.out.data(result);
-  ctx.out.line(`wrote ${result.commands} command pages and the index under ${path23.join(out, "commands")}`);
-  ctx.out.line(`wrote ${path23.join(out, "theme-tokens.md")}`);
-  ctx.out.line(`wrote ${path23.join(out, "exit-codes.md")}`);
+  ctx.out.line(`wrote ${result.commands} command pages and the index under ${path24.join(out, "commands")}`);
+  ctx.out.line(`wrote ${path24.join(out, "theme-tokens.md")}`);
+  ctx.out.line(`wrote ${path24.join(out, "exit-codes.md")}`);
 }
 
 // src/commands/login.ts
-import process16 from "node:process";
+import process21 from "node:process";
 async function hiddenLine() {
-  process16.stderr.write("token: ");
-  const stdin = process16.stdin;
+  process21.stderr.write("token: ");
+  const stdin = process21.stdin;
   stdin.setRawMode(true);
   stdin.resume();
   stdin.setEncoding("utf8");
@@ -8342,7 +8730,7 @@ async function hiddenLine() {
       stdin.off("data", onData);
       stdin.setRawMode(false);
       stdin.pause();
-      process16.stderr.write("\n");
+      process21.stderr.write("\n");
       if (err === void 0) resolve2(text);
       else reject(err);
     };
@@ -8365,16 +8753,27 @@ async function hiddenLine() {
 }
 async function pipedText() {
   const chunks = [];
-  for await (const chunk2 of process16.stdin) chunks.push(chunk2);
+  for await (const chunk2 of process21.stdin) chunks.push(chunk2);
   return Buffer.concat(chunks).toString("utf8").trim();
 }
 async function tokenFromStdin() {
-  const token = process16.stdin.isTTY === true ? await hiddenLine() : await pipedText();
+  const token = process21.stdin.isTTY === true ? await hiddenLine() : await pipedText();
   if (token === "") throw new UsageError("expected a token on stdin");
   if (!token.startsWith(TOKEN_PREFIX)) throw new UsageError(`that is not an rshow token: it must start with ${TOKEN_PREFIX}`);
   return token;
 }
-async function run20(argv, ctx) {
+async function saveIn(store2, url, token) {
+  await store2.save(url, token);
+  if (await store2.read(url) !== token) {
+    throw new ApiError(`cannot save the token in ${store2.description}`);
+  }
+}
+function reasonOf(err) {
+  const text = (err instanceof Error ? err.message : String(err)).replace(/^cannot save the token in the keyring: /, "");
+  const lines = text.split("\n").map((part) => part.trim()).filter((part) => part !== "");
+  return lines.at(-1) ?? "";
+}
+async function run19(argv, ctx, platform = process21.platform) {
   const args = parseCommandArgs(argv, { url: { type: "string" } }, 0, 0, LOGIN_USAGE);
   const settings = await ctx.config();
   const given = (stringValue(args, "url") ?? "").trim();
@@ -8383,48 +8782,69 @@ async function run20(argv, ctx) {
   const me = (await new Client(url, token).send("GET", "/api/me")).body;
   const email = typeof me?.email === "string" ? me.email : "";
   const scope = typeof me?.scope === "string" ? me.scope : "";
-  await save(url, token);
+  let store2 = await choose(process21.env, platform);
+  if (store2.backend === "keyring" && forced(process21.env) === void 0) {
+    try {
+      await saveIn(store2, url, token);
+    } catch (err) {
+      warn(`the Linux keyring cannot save the token (${reasonOf(err)}); saving it in a file`);
+      await store2.remove(url).catch(() => {
+      });
+      store2 = fileStore(process21.env);
+      await saveIn(store2, url, token);
+    }
+  } else {
+    await saveIn(store2, url, token);
+  }
   ctx.out.data({ email, scope, url });
-  ctx.out.line(`logged in as ${email} (scope ${scope}) for ${url}`);
+  ctx.out.line(`logged in as ${email} (scope ${scope}) for ${url}, saved in ${store2.description}`);
 }
 
 // src/commands/logout.ts
-async function run21(argv, ctx) {
+import process22 from "node:process";
+async function run20(argv, ctx, platform = process22.platform) {
   const args = parseCommandArgs(argv, { url: { type: "string" } }, 0, 0, LOGOUT_USAGE);
   const settings = await ctx.config();
   const given = (stringValue(args, "url") ?? "").trim();
   const url = (given === "" ? requireUrl(settings) : given).replace(/\/+$/, "");
-  const removed = await remove(url);
-  ctx.out.line(removed ? `logged out of ${url}` : `no saved token for ${url}`);
+  const removed = [];
+  for (const store2 of await every(process22.env, platform)) {
+    if (await store2.remove(url)) removed.push(store2.description);
+  }
+  if (removed.length === 0) {
+    ctx.out.line(`no saved token for ${url}`);
+    return;
+  }
+  ctx.out.line(`logged out of ${url}, removed from ${removed.join(" and ")}`);
 }
 
 // src/main.ts
 var COMMANDS = {
-  publish: { usage: PUBLISH_USAGE, run: run2 },
-  check: { usage: CHECK_USAGE, run: run3 },
-  handoff: { usage: HANDOFF_USAGE, run: run17 },
-  compare: { usage: COMPARE_USAGE, run: run18 },
-  preview: { usage: PREVIEW_USAGE, run: run4 },
-  config: { usage: CONFIG_USAGE, run: run5 },
-  init: { usage: INIT_USAGE, run: run6 },
-  doctor: { usage: DOCTOR_USAGE, run: run7 },
-  theme: { usage: THEME_USAGE, run: run8 },
-  skills: { usage: SKILLS_USAGE, run: run9 },
-  project: { usage: PROJECT_USAGE, run: run15 },
-  tag: { usage: TAG_USAGE, run: run16 },
-  list: { usage: LIST_USAGE, run: run10 },
-  show: { usage: SHOW_USAGE, run: run11 },
-  share: { usage: SHARE_USAGE, run: run12 },
-  pin: { usage: PIN_USAGE, run: run13 },
-  delete: { usage: DELETE_USAGE, run: run14 },
-  login: { usage: LOGIN_USAGE, run: run20 },
-  logout: { usage: LOGOUT_USAGE, run: run21 },
+  publish: { usage: PUBLISH_USAGE, run },
+  check: { usage: CHECK_USAGE, run: run2 },
+  handoff: { usage: HANDOFF_USAGE, run: run16 },
+  compare: { usage: COMPARE_USAGE, run: run17 },
+  preview: { usage: PREVIEW_USAGE, run: run3 },
+  config: { usage: CONFIG_USAGE, run: run4 },
+  init: { usage: INIT_USAGE, run: run5 },
+  doctor: { usage: DOCTOR_USAGE, run: run6 },
+  theme: { usage: THEME_USAGE, run: run7 },
+  skills: { usage: SKILLS_USAGE, run: run8 },
+  project: { usage: PROJECT_USAGE, run: run14 },
+  tag: { usage: TAG_USAGE, run: run15 },
+  list: { usage: LIST_USAGE, run: run9 },
+  show: { usage: SHOW_USAGE, run: run10 },
+  share: { usage: SHARE_USAGE, run: run11 },
+  pin: { usage: PIN_USAGE, run: run12 },
+  delete: { usage: DELETE_USAGE, run: run13 },
+  login: { usage: LOGIN_USAGE, run: run19 },
+  logout: { usage: LOGOUT_USAGE, run: run20 },
   // Kept out of the general help: the docs site runs it, a person rarely does.
-  docs: { usage: DOCS_USAGE, run: run19 }
+  docs: { usage: DOCS_USAGE, run: run18 }
 };
 function fail(err) {
   const message = err instanceof Error ? err.message : String(err);
-  process17.stderr.write(`rshow: ${message}
+  process23.stderr.write(`rshow: ${message}
 `);
   if (err instanceof UsageError) return EXIT.usage;
   if (err instanceof CheckError) return EXIT.check;
@@ -8442,17 +8862,17 @@ async function main(argv) {
   const spec = name === void 0 ? void 0 : COMMANDS[name];
   if (wantsVersion) {
     const suffix = await isBinary() ? " (binary)" : "";
-    process17.stdout.write(`rshow ${VERSION}${suffix}
+    process23.stdout.write(`rshow ${VERSION}${suffix}
 `);
     return EXIT.ok;
   }
   if (wantsHelp) {
-    process17.stdout.write(`${spec === void 0 ? GENERAL_USAGE : spec.usage}
+    process23.stdout.write(`${spec === void 0 ? GENERAL_USAGE : spec.usage}
 `);
     return EXIT.ok;
   }
   if (name === void 0) {
-    process17.stderr.write(`${GENERAL_USAGE}
+    process23.stderr.write(`${GENERAL_USAGE}
 `);
     return EXIT.usage;
   }
@@ -8463,12 +8883,12 @@ async function main(argv) {
   const rest = [...args.slice(0, index), ...args.slice(index + 1)];
   const configs = /* @__PURE__ */ new Map();
   const clients = /* @__PURE__ */ new Map();
-  const keyOf = (dir) => dir === void 0 ? "" : path24.resolve(dir);
+  const keyOf = (dir) => dir === void 0 ? "" : path25.resolve(dir);
   const configFor = (dir) => {
     const key2 = keyOf(dir);
     let pending = configs.get(key2);
     if (pending === void 0) {
-      pending = loadConfig(process17.env, dir);
+      pending = loadConfig(process23.env, dir);
       configs.set(key2, pending);
     }
     return pending;
@@ -8481,7 +8901,7 @@ async function main(argv) {
       if (cached !== void 0) return cached;
       const settings = await configFor(dir);
       const url = requireUrl(settings);
-      const client = new Client(url, await readToken(process17.env, url));
+      const client = new Client(url, await readToken(process23.env, url));
       clients.set(key2, client);
       return client;
     },
@@ -8490,11 +8910,11 @@ async function main(argv) {
   const code = await spec.run(rest, ctx);
   return code ?? EXIT.ok;
 }
-main(process17.argv.slice(2)).then(
+main(process23.argv.slice(2)).then(
   (code) => {
-    process17.exitCode = code;
+    process23.exitCode = code;
   },
   (err) => {
-    process17.exitCode = fail(err);
+    process23.exitCode = fail(err);
   }
 );