diff --git a/README.md b/README.md
index 61a5b5d..8fb235f 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,7 @@ Run an external command or a named wrapper inside the profile:
 
 ```bash
 runseal bash -lc 'echo "$APP_SSH_CONFIG"'
-runseal :ssh-run host
+runseal :ssh host --run ./probe.sh
 ```
 
 ## Inspect What Runseal Sees
@@ -52,7 +52,7 @@ runseal @resolve resource:// resource://ssh/config
 runseal @transpile --input-lang=seal --output-lang=bash ./operator.seal
 runseal @tool json get '{"releaseVersion":"v0.6.0"}' '.releaseVersion'
 runseal @wrappers
-runseal @which :ssh-run
+runseal @which :ssh
 ```
 
 These commands answer the first debugging questions: which profile was selected,
@@ -227,7 +227,7 @@ If the command token starts with `:`, runseal resolves it as a wrapper
 executable instead of a literal program name:
 
 ```bash
-runseal :ssh-run host ./probe.sh -- arg
+runseal :ssh host --run ./probe.sh -- arg
 ```
 
 Wrapper lookup order is:
@@ -251,15 +251,26 @@ extension.
 
 ### Seal wrappers
 
-`.seal` files are bash-runnable wrapper glue. They are meant for small
-cross-platform repository operations where the shared shape is clear:
+`.seal` files are bash-runnable wrapper glue. They are meant for
+cross-platform repository operations where the bash/PowerShell shared shape is
+clear. The boundary is syntax shape, not script size:
 
 - ordinary command execution, assignment, functions, `if`, `while`, `case`,
-  `shift`, and `"$@"`
+  `shift`, `"$@"`, command success predicates such as
+  `if git checkout "$branch"; then`, and command-scoped env overlays such as
+  `KUBECONFIG="$kubeconfig" kubectl "$@"`
 - bash `[ ... ]` tests for ordinary predicates
 - explicit `runseal @tool ...` calls for atomic glue where bash and PowerShell
   do not share a clean expression
 
+Use `.seal` as the profile integration layer: it should pass caller-specific
+paths, env names, and defaults explicitly. Keep reusable domain atoms in
+`@tool`, such as SSH config inspection, stdin script execution, path-list
+joining, branch slugging, Gitee PR API calls, and encrypted local archive
+round trips. For example, a wrapper can expose `:ssh <host> --run <script>`
+while `runseal @tool ssh script run` owns the stdin, argv forwarding, and host
+config details.
+
 For example:
 
 ```bash
@@ -295,7 +306,7 @@ runseal @resources
 runseal @resolve resource:// resource://ssh/config
 runseal @transpile --input-lang=seal --output-lang=sealir ./operator.seal
 runseal @wrappers
-runseal @which :ssh-run
+runseal @which :ssh
 ```
 
 Runseal-owned commands do not run profile injections. Inspection commands are
@@ -311,8 +322,11 @@ read-only; `@tool` is the explicit atomic tool runtime.
   `bash`, `seal`, `powershell`, and `sealir` inputs and outputs for the
   currently recognized intersection.
 - `@tool <namespace> <command> ...` runs an atomic runseal tool command. Cold
-  start supports JSON, string, regex, integer, process, filesystem, GitHub, and
-  Cloudflare helpers. Run `runseal @tool --help` for the complete tool index.
+  start supports JSON, string, regex, integer, process, filesystem, archive,
+  SSH config, GitHub, Gitee, and Cloudflare helpers. Run `runseal @tool --help`
+  for the complete tool index. Tools are reusable atoms: they may read generic
+  defaults such as service tokens, but profile-specific paths and env names
+  should be supplied by the calling wrapper.
 - `@wrappers` lists the effective wrappers visible to the current profile.
 - `@which :<name>` prints the wrapper file that `:<name>` resolves to.
 
diff --git a/app/src/core/internal_help.rs b/app/src/core/internal_help.rs
index c178399..7de23ae 100644
--- a/app/src/core/internal_help.rs
+++ b/app/src/core/internal_help.rs
@@ -126,9 +126,13 @@ shell files use the .sh suffix and must be executable. Seal wrappers use the
 .seal suffix and are interpreted directly by runseal. On Windows, runseal also
 checks .exe, .cmd, and .bat when the wrapper name has no extension.
 
-.seal wrappers are bash-runnable wrapper glue. They are intended for small
-cross-platform repository operations: shared shell-shaped control flow plus
-explicit runseal @tool calls for atomic glue.
+.seal wrappers are bash-runnable wrapper glue. They are intended for
+cross-platform repository operations where bash and PowerShell share a clear
+shape: shell-shaped control flow, command success predicates, command-scoped env
+overlays, and explicit runseal @tool calls for atomic glue.
+
+The boundary is syntax shape, not script size. Keep reusable domain atoms in
+@tool and pass profile-specific paths or env names from the wrapper.
 
 @wrappers is read-only and does not run profile injections.
 ";
diff --git a/app/src/core/tool/archive/mod.rs b/app/src/core/tool/archive/mod.rs
new file mode 100644
index 0000000..69e16b3
--- /dev/null
+++ b/app/src/core/tool/archive/mod.rs
@@ -0,0 +1,379 @@
+use std::{
+    ffi::OsStr,
+    path::{Component, Path, PathBuf},
+    process::{Command, Stdio},
+};
+
+use anyhow::{Context, Result, bail};
+use tempfile::TempDir;
+
+pub fn eval(command: &str, args: &[String]) -> Result<Option<String>> {
+    match command {
+        "local" => local(args),
+        _ => bail!("unknown tool command: archive {command}"),
+    }
+}
+
+fn local(args: &[String]) -> Result<Option<String>> {
+    let [command, rest @ ..] = args else {
+        bail!("usage: runseal @tool archive local export|import ...");
+    };
+    match command.as_str() {
+        "export" => export_local(rest),
+        "import" => import_local(rest),
+        _ => bail!("usage: runseal @tool archive local export|import ..."),
+    }
+}
+
+fn export_local(args: &[String]) -> Result<Option<String>> {
+    let options = LocalOptions::parse(args, false)?;
+    let source = options.source()?;
+    if !source.is_dir() {
+        bail!("archive source is not a directory: {}", source.display());
+    }
+    let archive = options.archive()?;
+    if archive.exists() {
+        bail!(
+            "refusing to overwrite existing archive: {}",
+            archive.display()
+        );
+    }
+    if let Some(parent) = archive.parent()
+        && !parent.as_os_str().is_empty()
+    {
+        std::fs::create_dir_all(parent)
+            .with_context(|| format!("failed to create parent directory: {}", parent.display()))?;
+    }
+
+    let password = options.password()?;
+    let temp = TempDir::new().context("failed to create temporary archive directory")?;
+    let tar_path = temp.path().join("local.tar.gz");
+    let source_parent = source
+        .parent()
+        .filter(|path| !path.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."));
+    let source_name = source
+        .file_name()
+        .ok_or_else(|| anyhow::anyhow!("invalid source path: {}", source.display()))?;
+
+    run(
+        Command::new("tar")
+            .arg("-czf")
+            .arg(&tar_path)
+            .arg("-C")
+            .arg(source_parent)
+            .arg(source_name),
+        "tar export",
+    )?;
+    openssl_encrypt(&tar_path, &archive, &password)?;
+    chmod_path(&archive, 0o600)?;
+    Ok(None)
+}
+
+fn import_local(args: &[String]) -> Result<Option<String>> {
+    let options = LocalOptions::parse(args, true)?;
+    let dest = options.source()?;
+    let archive = options.archive()?;
+    if !archive.is_file() {
+        bail!("archive not found: {}", archive.display());
+    }
+    if dest.exists() && !options.force {
+        bail!("refusing to replace existing local directory without --force");
+    }
+    let password = options.password()?;
+    let temp = TempDir::new().context("failed to create temporary archive directory")?;
+    let tar_path = temp.path().join("local.tar.gz");
+    openssl_decrypt(&archive, &tar_path, &password)?;
+    validate_tar_entries(&tar_path)?;
+
+    let extract_dir = temp.path().join("extract");
+    std::fs::create_dir_all(&extract_dir)
+        .with_context(|| format!("failed to create {}", extract_dir.display()))?;
+    run(
+        Command::new("tar")
+            .arg("-xzf")
+            .arg(&tar_path)
+            .arg("-C")
+            .arg(&extract_dir),
+        "tar import",
+    )?;
+
+    let restored = extract_dir.join(
+        dest.file_name()
+            .ok_or_else(|| anyhow::anyhow!("invalid destination path: {}", dest.display()))?,
+    );
+    if !restored.is_dir() {
+        bail!("archive does not contain {}", restored.display());
+    }
+    if dest.exists() {
+        std::fs::remove_dir_all(&dest)
+            .with_context(|| format!("failed to remove {}", dest.display()))?;
+    }
+    copy_dir_all(&restored, &dest)?;
+    fix_local_permissions(&dest)?;
+    Ok(None)
+}
+
+#[derive(Default)]
+struct LocalOptions {
+    source: Option<String>,
+    archive: Option<String>,
+    password: Option<String>,
+    password_env: Option<String>,
+    force: bool,
+}
+
+impl LocalOptions {
+    fn parse(args: &[String], allow_force: bool) -> Result<Self> {
+        let mut options = LocalOptions::default();
+        let mut rest = args;
+        while let Some((flag, tail)) = rest.split_first() {
+            match flag.as_str() {
+                "--source" => {
+                    let Some((value, next)) = tail.split_first() else {
+                        bail!("missing value for --source");
+                    };
+                    options.source = Some(value.clone());
+                    rest = next;
+                }
+                "--archive" => {
+                    let Some((value, next)) = tail.split_first() else {
+                        bail!("missing value for --archive");
+                    };
+                    options.archive = Some(value.clone());
+                    rest = next;
+                }
+                "--password" => {
+                    let Some((value, next)) = tail.split_first() else {
+                        bail!("missing value for --password");
+                    };
+                    options.password = Some(value.clone());
+                    rest = next;
+                }
+                "--password-env" => {
+                    let Some((value, next)) = tail.split_first() else {
+                        bail!("missing value for --password-env");
+                    };
+                    options.password_env = Some(value.clone());
+                    rest = next;
+                }
+                "--force" if allow_force => {
+                    options.force = true;
+                    rest = tail;
+                }
+                _ => bail!(
+                    "usage: runseal @tool archive local export|import --source <dir> --archive <path> (--password <text>|--password-env <name>) [--force]"
+                ),
+            }
+        }
+        Ok(options)
+    }
+
+    fn source(&self) -> Result<PathBuf> {
+        self.source
+            .as_ref()
+            .map(PathBuf::from)
+            .ok_or_else(|| anyhow::anyhow!("missing --source"))
+    }
+
+    fn archive(&self) -> Result<PathBuf> {
+        self.archive
+            .as_ref()
+            .map(PathBuf::from)
+            .ok_or_else(|| anyhow::anyhow!("missing --archive"))
+    }
+
+    fn password(&self) -> Result<String> {
+        match (&self.password, &self.password_env) {
+            (Some(password), None) if !password.is_empty() => Ok(password.clone()),
+            (None, Some(name)) => {
+                let value = std::env::var(name)
+                    .with_context(|| format!("missing password env var: {name}"))?;
+                if value.is_empty() {
+                    bail!("password env var is empty: {name}");
+                }
+                Ok(value)
+            }
+            (Some(_), Some(_)) => bail!("use only one of --password or --password-env"),
+            _ => bail!("missing --password or --password-env"),
+        }
+    }
+}
+
+fn openssl_encrypt(input: &Path, output: &Path, password: &str) -> Result<()> {
+    let mut child = Command::new("openssl")
+        .args(["enc", "-aes-256-cbc", "-salt", "-pbkdf2", "-out"])
+        .arg(output)
+        .arg("-pass")
+        .arg("stdin")
+        .arg("-in")
+        .arg(input)
+        .stdin(Stdio::piped())
+        .spawn()
+        .context("failed to start openssl encryption")?;
+    write_password(&mut child, password)?;
+    let status = child.wait().context("failed to wait for openssl")?;
+    if !status.success() {
+        bail!("openssl encryption failed");
+    }
+    Ok(())
+}
+
+fn openssl_decrypt(input: &Path, output: &Path, password: &str) -> Result<()> {
+    let mut child = Command::new("openssl")
+        .args(["enc", "-d", "-aes-256-cbc", "-pbkdf2", "-in"])
+        .arg(input)
+        .arg("-pass")
+        .arg("stdin")
+        .arg("-out")
+        .arg(output)
+        .stdin(Stdio::piped())
+        .spawn()
+        .context("failed to start openssl decryption")?;
+    write_password(&mut child, password)?;
+    let status = child.wait().context("failed to wait for openssl")?;
+    if !status.success() {
+        bail!("openssl decryption failed");
+    }
+    Ok(())
+}
+
+fn write_password(child: &mut std::process::Child, password: &str) -> Result<()> {
+    use std::io::Write;
+
+    let mut stdin = child
+        .stdin
+        .take()
+        .ok_or_else(|| anyhow::anyhow!("failed to open openssl stdin"))?;
+    stdin
+        .write_all(password.as_bytes())
+        .context("failed to write openssl password")?;
+    stdin
+        .write_all(b"\n")
+        .context("failed to finish openssl password")?;
+    Ok(())
+}
+
+fn validate_tar_entries(path: &Path) -> Result<()> {
+    let output = Command::new("tar")
+        .arg("-tzf")
+        .arg(path)
+        .output()
+        .context("failed to list tar archive")?;
+    if !output.status.success() {
+        bail!("failed to list tar archive");
+    }
+    let stdout = String::from_utf8(output.stdout).context("tar listing was not UTF-8")?;
+    for line in stdout.lines() {
+        validate_relative_entry(line)?;
+    }
+    Ok(())
+}
+
+fn validate_relative_entry(entry: &str) -> Result<()> {
+    let path = Path::new(entry);
+    if path.is_absolute() {
+        bail!("unsafe archive path: {entry}");
+    }
+    let mut components = path.components();
+    let Some(Component::Normal(first)) = components.next() else {
+        bail!("unsafe archive path: {entry}");
+    };
+    if first != OsStr::new(".local") {
+        bail!("archive entry must be under .local/: {entry}");
+    }
+    for component in components {
+        match component {
+            Component::Normal(_) => {}
+            _ => bail!("unsafe archive path: {entry}"),
+        }
+    }
+    Ok(())
+}
+
+fn run(command: &mut Command, label: &str) -> Result<()> {
+    let status = command
+        .status()
+        .with_context(|| format!("failed to execute {label}"))?;
+    if !status.success() {
+        bail!("{label} failed");
+    }
+    Ok(())
+}
+
+fn copy_dir_all(source: &Path, dest: &Path) -> Result<()> {
+    std::fs::create_dir_all(dest)
+        .with_context(|| format!("failed to create {}", dest.display()))?;
+    for entry in
+        std::fs::read_dir(source).with_context(|| format!("failed to read {}", source.display()))?
+    {
+        let entry = entry.with_context(|| format!("failed to read {}", source.display()))?;
+        let file_type = entry
+            .file_type()
+            .with_context(|| format!("failed to read file type: {}", entry.path().display()))?;
+        let target = dest.join(entry.file_name());
+        if file_type.is_dir() {
+            copy_dir_all(&entry.path(), &target)?;
+        } else if file_type.is_file() {
+            std::fs::copy(entry.path(), &target)
+                .with_context(|| format!("failed to copy {}", entry.path().display()))?;
+        }
+    }
+    Ok(())
+}
+
+fn fix_local_permissions(local: &Path) -> Result<()> {
+    if local.is_dir() {
+        chmod_path(local, 0o700)?;
+    }
+    for name in ["ssh", "kube", "secrets", "tmp"] {
+        let path = local.join(name);
+        if path.is_dir() {
+            chmod_path(&path, 0o700)?;
+        }
+    }
+    for name in ["ssh", "kube", "secrets"] {
+        let path = local.join(name);
+        if path.is_dir() {
+            chmod_files_recursive(&path, 0o600)?;
+        }
+    }
+    Ok(())
+}
+
+fn chmod_files_recursive(path: &Path, mode: u32) -> Result<()> {
+    for entry in
+        std::fs::read_dir(path).with_context(|| format!("failed to read {}", path.display()))?
+    {
+        let entry = entry.with_context(|| format!("failed to read {}", path.display()))?;
+        let file_type = entry
+            .file_type()
+            .with_context(|| format!("failed to read file type: {}", entry.path().display()))?;
+        if file_type.is_dir() {
+            chmod_files_recursive(&entry.path(), mode)?;
+        } else if file_type.is_file() {
+            chmod_path(&entry.path(), mode)?;
+        }
+    }
+    Ok(())
+}
+
+#[cfg(unix)]
+fn chmod_path(path: &Path, mode: u32) -> Result<()> {
+    use std::os::unix::fs::PermissionsExt;
+
+    let mut permissions = std::fs::metadata(path)
+        .with_context(|| format!("failed to read metadata: {}", path.display()))?
+        .permissions();
+    permissions.set_mode(mode);
+    std::fs::set_permissions(path, permissions)
+        .with_context(|| format!("failed to chmod {}", path.display()))?;
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn chmod_path(path: &Path, _mode: u32) -> Result<()> {
+    std::fs::metadata(path)
+        .with_context(|| format!("failed to read metadata: {}", path.display()))?;
+    Ok(())
+}
diff --git a/app/src/core/tool/fs.rs b/app/src/core/tool/fs.rs
index 8a512fd..1bd85ac 100644
--- a/app/src/core/tool/fs.rs
+++ b/app/src/core/tool/fs.rs
@@ -6,8 +6,12 @@ use base64::Engine;
 pub fn eval(command: &str, args: &[String]) -> Result<Option<String>> {
     match command {
         "mkdir" => mkdir(args),
+        "write" => write(args),
         "write-base64" => write_base64(args),
         "chmod" => chmod(args),
+        "mode" => mode(args),
+        "touch" => touch(args),
+        "list" => list(args),
         "contains-any" => contains_any(args),
         "backup-numbered" => backup_numbered(args),
         _ => bail!("unknown tool command: fs {command}"),
@@ -27,6 +31,25 @@ fn mkdir(args: &[String]) -> Result<Option<String>> {
     Ok(None)
 }
 
+fn write(args: &[String]) -> Result<Option<String>> {
+    let (path, text, mode) = match args {
+        [path, text] => (path, text, None),
+        [path, text, mode] => (path, text, Some(mode)),
+        _ => bail!("usage: runseal @tool fs write <path> <text> [mode]"),
+    };
+    if let Some(parent) = Path::new(path).parent()
+        && !parent.as_os_str().is_empty()
+    {
+        std::fs::create_dir_all(parent)
+            .with_context(|| format!("failed to create parent directory: {}", parent.display()))?;
+    }
+    std::fs::write(path, text).with_context(|| format!("failed to write file: {path}"))?;
+    if let Some(mode) = mode {
+        chmod_path(Path::new(path), mode)?;
+    }
+    Ok(None)
+}
+
 fn write_base64(args: &[String]) -> Result<Option<String>> {
     let [path, encoded] = args else {
         bail!("usage: runseal @tool fs write-base64 <path> <base64>");
@@ -52,6 +75,111 @@ fn chmod(args: &[String]) -> Result<Option<String>> {
     Ok(None)
 }
 
+fn mode(args: &[String]) -> Result<Option<String>> {
+    let [path] = args else {
+        bail!("usage: runseal @tool fs mode <path>");
+    };
+    mode_path(Path::new(path))
+}
+
+fn touch(args: &[String]) -> Result<Option<String>> {
+    let (path, mode) = match args {
+        [path] => (path, None),
+        [path, mode] => (path, Some(mode)),
+        _ => bail!("usage: runseal @tool fs touch <path> [mode]"),
+    };
+    let path = Path::new(path);
+    if let Some(parent) = path.parent()
+        && !parent.as_os_str().is_empty()
+    {
+        std::fs::create_dir_all(parent)
+            .with_context(|| format!("failed to create parent directory: {}", parent.display()))?;
+    }
+    std::fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(path)
+        .with_context(|| format!("failed to touch {}", path.display()))?;
+    if let Some(mode) = mode {
+        chmod_path(path, mode)?;
+    }
+    Ok(None)
+}
+
+fn list(args: &[String]) -> Result<Option<String>> {
+    let [dir, rest @ ..] = args else {
+        bail!(
+            "usage: runseal @tool fs list <path> [--glob <pattern>] [--files] [--dirs] [--require-nonempty]"
+        );
+    };
+    let mut glob = "*".to_string();
+    let mut files = false;
+    let mut dirs = false;
+    let mut require_nonempty = false;
+    let mut index = 0;
+    while index < rest.len() {
+        match rest[index].as_str() {
+            "--glob" => {
+                let Some(value) = rest.get(index + 1) else {
+                    bail!("--glob requires a value");
+                };
+                glob = value.clone();
+                index += 2;
+            }
+            "--files" => {
+                files = true;
+                index += 1;
+            }
+            "--dirs" => {
+                dirs = true;
+                index += 1;
+            }
+            "--require-nonempty" => {
+                require_nonempty = true;
+                index += 1;
+            }
+            other => bail!("unknown fs list argument: {other}"),
+        }
+    }
+    if !files && !dirs {
+        files = true;
+        dirs = true;
+    }
+    let dir_path = Path::new(dir);
+    if !dir_path.is_dir() {
+        bail!("fs list path is not a directory: {}", dir_path.display());
+    }
+    let mut matches = Vec::new();
+    for entry in std::fs::read_dir(dir_path)
+        .with_context(|| format!("failed to read directory: {}", dir_path.display()))?
+    {
+        let entry =
+            entry.with_context(|| format!("failed to read entry in {}", dir_path.display()))?;
+        let file_name = entry.file_name();
+        let Some(name) = file_name.to_str() else {
+            continue;
+        };
+        if !glob_match(&glob, name) {
+            continue;
+        }
+        let file_type = entry
+            .file_type()
+            .with_context(|| format!("failed to read file type: {}", entry.path().display()))?;
+        if (file_type.is_file() && files) || (file_type.is_dir() && dirs) {
+            let path = entry
+                .path()
+                .canonicalize()
+                .with_context(|| format!("failed to canonicalize {}", entry.path().display()))?;
+            matches.push(path.to_string_lossy().into_owned());
+        }
+    }
+    matches.sort();
+    if require_nonempty && matches.is_empty() {
+        bail!("fs list found no matches in {}", dir_path.display());
+    }
+    Ok(Some(serde_json::to_string(&matches)?))
+}
+
 fn contains_any(args: &[String]) -> Result<Option<String>> {
     let [path, needles @ ..] = args else {
         bail!("usage: runseal @tool fs contains-any <path> <text>...");
@@ -106,6 +234,28 @@ fn next_backup_path(path: &Path) -> Result<PathBuf> {
     bail!("too many existing backups for {}", path.display())
 }
 
+fn glob_match(pattern: &str, value: &str) -> bool {
+    glob_match_inner(pattern.as_bytes(), value.as_bytes())
+}
+
+fn glob_match_inner(pattern: &[u8], value: &[u8]) -> bool {
+    match (pattern.split_first(), value.split_first()) {
+        (None, None) => true,
+        (None, Some(_)) => false,
+        (Some((&b'*', rest)), _) => {
+            glob_match_inner(rest, value)
+                || value
+                    .split_first()
+                    .is_some_and(|(_, tail)| glob_match_inner(pattern, tail))
+        }
+        (Some((&b'?', rest)), Some((_, tail))) => glob_match_inner(rest, tail),
+        (Some((&expected, rest)), Some((&actual, tail))) if expected == actual => {
+            glob_match_inner(rest, tail)
+        }
+        _ => false,
+    }
+}
+
 #[cfg(unix)]
 fn chmod_path(path: &Path, mode: &str) -> Result<()> {
     use std::os::unix::fs::PermissionsExt;
@@ -125,3 +275,22 @@ fn chmod_path(path: &Path, mode: &str) -> Result<()> {
 fn chmod_path(_path: &Path, _mode: &str) -> Result<()> {
     Ok(())
 }
+
+#[cfg(unix)]
+fn mode_path(path: &Path) -> Result<Option<String>> {
+    use std::os::unix::fs::PermissionsExt;
+
+    let mode = std::fs::metadata(path)
+        .with_context(|| format!("failed to read metadata: {}", path.display()))?
+        .permissions()
+        .mode()
+        & 0o777;
+    Ok(Some(format!("{mode:03o}")))
+}
+
+#[cfg(not(unix))]
+fn mode_path(path: &Path) -> Result<Option<String>> {
+    std::fs::metadata(path)
+        .with_context(|| format!("failed to read metadata: {}", path.display()))?;
+    Ok(Some("".to_string()))
+}
diff --git a/app/src/core/tool/gitee/mod.rs b/app/src/core/tool/gitee/mod.rs
new file mode 100644
index 0000000..51844f2
--- /dev/null
+++ b/app/src/core/tool/gitee/mod.rs
@@ -0,0 +1,235 @@
+use std::{collections::BTreeMap, path::Path, time::Duration};
+
+use anyhow::{Context, Result, bail};
+use serde_json::Value as JsonValue;
+
+pub fn eval(command: &str, args: &[String]) -> Result<Option<String>> {
+    match command {
+        "pr" => pr(args),
+        "repo" => repo(args),
+        _ => bail!("unknown tool command: gitee {command}"),
+    }
+}
+
+fn repo(args: &[String]) -> Result<Option<String>> {
+    let [command, rest @ ..] = args else {
+        bail!("usage: runseal @tool gitee repo parse-origin <url>");
+    };
+    match command.as_str() {
+        "parse-origin" => repo_parse_origin(rest),
+        _ => bail!("usage: runseal @tool gitee repo parse-origin <url>"),
+    }
+}
+
+fn repo_parse_origin(args: &[String]) -> Result<Option<String>> {
+    let [url] = args else {
+        bail!("usage: runseal @tool gitee repo parse-origin <url>");
+    };
+    let (owner, repo) = parse_origin(url)?;
+    Ok(Some(serde_json::to_string(&serde_json::json!({
+        "owner": owner,
+        "repo": repo,
+    }))?))
+}
+
+fn pr(args: &[String]) -> Result<Option<String>> {
+    let [command, rest @ ..] = args else {
+        bail!("usage: runseal @tool gitee pr create|pass-gates|merge ...");
+    };
+    match command.as_str() {
+        "create" => pr_create(rest),
+        "pass-gates" => pr_pass_gates(rest),
+        "merge" => pr_merge(rest),
+        _ => bail!("usage: runseal @tool gitee pr create|pass-gates|merge ..."),
+    }
+}
+
+fn pr_create(args: &[String]) -> Result<Option<String>> {
+    let owner = required_option(args, "--owner")?;
+    let repo = required_option(args, "--repo")?;
+    let token = token(args)?;
+    let base = required_option(args, "--base")?;
+    let head = required_option(args, "--head")?;
+    let title = required_option(args, "--title")?;
+    let body = required_option(args, "--body")?;
+    request(
+        "POST",
+        &format!("/repos/{owner}/{repo}/pulls"),
+        &token,
+        serde_json::json!({
+            "title": title,
+            "head": head,
+            "base": base,
+            "body": body,
+        }),
+    )
+}
+
+fn pr_pass_gates(args: &[String]) -> Result<Option<String>> {
+    let owner = required_option(args, "--owner")?;
+    let repo = required_option(args, "--repo")?;
+    let token = token(args)?;
+    let number = required_option(args, "--number")?;
+    let mut result = serde_json::Map::new();
+    for op in ["review", "test"] {
+        let passed = request(
+            "POST",
+            &format!("/repos/{owner}/{repo}/pulls/{number}/{op}"),
+            &token,
+            serde_json::json!({}),
+        )
+        .is_ok();
+        result.insert(op.to_string(), JsonValue::Bool(passed));
+    }
+    Ok(Some(serde_json::to_string(&JsonValue::Object(result))?))
+}
+
+fn pr_merge(args: &[String]) -> Result<Option<String>> {
+    let owner = required_option(args, "--owner")?;
+    let repo = required_option(args, "--repo")?;
+    let token = token(args)?;
+    let number = required_option(args, "--number")?;
+    let method = optional_option(args, "--method").unwrap_or_else(|| "squash".to_string());
+    request(
+        "PUT",
+        &format!("/repos/{owner}/{repo}/pulls/{number}/merge"),
+        &token,
+        serde_json::json!({
+            "merge_method": method,
+        }),
+    )
+}
+
+fn request(method: &str, path: &str, token: &str, mut body: JsonValue) -> Result<Option<String>> {
+    let Some(object) = body.as_object_mut() else {
+        bail!("Gitee request body must be a JSON object");
+    };
+    object.insert(
+        "access_token".to_string(),
+        JsonValue::String(token.to_string()),
+    );
+    let base = std::env::var("RUNSEAL_GITEE_API_BASE")
+        .unwrap_or_else(|_| "https://gitee.com/api/v5".to_string());
+    let path = if path.starts_with('/') {
+        path.to_string()
+    } else {
+        format!("/{path}")
+    };
+    let url = format!("{base}{path}");
+    let client = reqwest::blocking::Client::builder()
+        .timeout(Duration::from_secs(30))
+        .build()?;
+    let method = method
+        .parse::<reqwest::Method>()
+        .with_context(|| format!("invalid HTTP method: {method}"))?;
+    let response = client
+        .request(method.clone(), &url)
+        .header(reqwest::header::ACCEPT, "application/json")
+        .header(reqwest::header::CONTENT_TYPE, "application/json")
+        .header(reqwest::header::AUTHORIZATION, format!("token {token}"))
+        .json(&body)
+        .send()
+        .with_context(|| format!("Gitee API {method} {path} unreachable"))?;
+    let status = response.status();
+    let raw = response
+        .text()
+        .with_context(|| format!("Gitee API {method} {path} returned unreadable body"))?;
+    if !status.is_success() {
+        bail!("Gitee API {method} {path} -> {}: {raw}", status.as_u16());
+    }
+    let payload: JsonValue = if raw.trim().is_empty() {
+        JsonValue::Object(Default::default())
+    } else {
+        serde_json::from_str(&raw)
+            .with_context(|| format!("Gitee API returned invalid JSON for {path}"))?
+    };
+    Ok(Some(serde_json::to_string(&payload)?))
+}
+
+fn token(args: &[String]) -> Result<String> {
+    if let Some(token) = optional_option(args, "--token")
+        && !token.is_empty()
+    {
+        return Ok(token);
+    }
+    if let Some(path) = optional_option(args, "--token-file") {
+        let values = parse_env_file(Path::new(&path))?;
+        if let Some(token) = values.get("GITEE_TOKEN").filter(|value| !value.is_empty()) {
+            return Ok(token.clone());
+        }
+        bail!("GITEE_TOKEN not set in {path}");
+    }
+    if let Ok(token) = std::env::var("GITEE_TOKEN")
+        && !token.is_empty()
+    {
+        return Ok(token);
+    }
+    bail!("missing Gitee token: pass --token, --token-file, or set GITEE_TOKEN")
+}
+
+fn parse_env_file(path: &Path) -> Result<BTreeMap<String, String>> {
+    let text = std::fs::read_to_string(path)
+        .with_context(|| format!("failed to read token file: {}", path.display()))?;
+    let mut values = BTreeMap::new();
+    for line in text.lines() {
+        let line = line.trim();
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        let Some((key, value)) = line.split_once('=') else {
+            bail!("invalid line in {}: {line}", path.display());
+        };
+        values.insert(
+            key.trim().to_string(),
+            value
+                .trim()
+                .trim_matches('"')
+                .trim_matches('\'')
+                .to_string(),
+        );
+    }
+    Ok(values)
+}
+
+fn required_option(args: &[String], name: &str) -> Result<String> {
+    optional_option(args, name).ok_or_else(|| anyhow::anyhow!("{name} is required"))
+}
+
+fn optional_option(args: &[String], name: &str) -> Option<String> {
+    let prefix = format!("{name}=");
+    let mut index = 0;
+    while index < args.len() {
+        let arg = &args[index];
+        if arg == name {
+            return args.get(index + 1).cloned();
+        }
+        if let Some(value) = arg.strip_prefix(&prefix) {
+            return Some(value.to_string());
+        }
+        index += 1;
+    }
+    None
+}
+
+fn parse_origin(url: &str) -> Result<(String, String)> {
+    let Some(after_host) = url
+        .strip_prefix("git@gitee.com:")
+        .or_else(|| url.strip_prefix("ssh://git@gitee.com/"))
+        .or_else(|| url.strip_prefix("https://gitee.com/"))
+        .or_else(|| url.strip_prefix("http://gitee.com/"))
+    else {
+        bail!("cannot parse Gitee owner/repo from origin url: {url}");
+    };
+    let path = after_host.trim_end_matches(".git");
+    let mut parts = path.split('/');
+    let Some(owner) = parts.next().filter(|value| !value.is_empty()) else {
+        bail!("cannot parse Gitee owner/repo from origin url: {url}");
+    };
+    let Some(repo) = parts.next().filter(|value| !value.is_empty()) else {
+        bail!("cannot parse Gitee owner/repo from origin url: {url}");
+    };
+    if parts.next().is_some() {
+        bail!("cannot parse Gitee owner/repo from origin url: {url}");
+    }
+    Ok((owner.to_string(), repo.to_string()))
+}
diff --git a/app/src/core/tool/mod.rs b/app/src/core/tool/mod.rs
index 12025c9..86f53b0 100644
--- a/app/src/core/tool/mod.rs
+++ b/app/src/core/tool/mod.rs
@@ -1,12 +1,15 @@
 use anyhow::{Result, bail};
 
+mod archive;
 mod cloudflare;
 mod fs;
+mod gitee;
 mod github;
 mod int;
 mod json;
 mod process;
 mod regex;
+mod ssh;
 mod string;
 
 pub fn run(args: &[String]) -> Result<()> {
@@ -27,7 +30,10 @@ pub fn eval(args: &[String]) -> Result<Option<String>> {
         [namespace, command, rest @ ..] if namespace == "regex" => regex::eval(command, rest),
         [namespace, command, rest @ ..] if namespace == "int" => int::eval(command, rest),
         [namespace, command, rest @ ..] if namespace == "process" => process::eval(command, rest),
+        [namespace, command, rest @ ..] if namespace == "archive" => archive::eval(command, rest),
         [namespace, command, rest @ ..] if namespace == "fs" => fs::eval(command, rest),
+        [namespace, command, rest @ ..] if namespace == "gitee" => gitee::eval(command, rest),
+        [namespace, command, rest @ ..] if namespace == "ssh" => ssh::eval(command, rest),
         [namespace, command, rest @ ..] if namespace == "github" => github::eval(command, rest),
         [namespace, command, rest @ ..] if namespace == "cloudflare" => {
             cloudflare::eval(command, rest)
@@ -52,14 +58,30 @@ Tools:
   json find <array> <field> <value>      print first object with field=value
   json filter <array> <field> <value>... print objects with field matching values
   string trim <value>                    trim leading and trailing whitespace
+  string join <array> --separator <sep>   join a JSON string array; sep=path uses platform path-list separator
+  string slug <value>                    normalize text for branch/file slugs
   regex capture <value> <pattern> <n>    print regex capture group n, or empty
   int add <left> <right>                 print integer sum
   process exists <name>                  print true when command exists on PATH
+  archive local export                   encrypt a .local-style directory archive
+  archive local import                   decrypt and restore a .local-style archive
   fs mkdir <path> [mode]                 create a directory and parents
+  fs write <path> <text> [mode]          write text to a file
   fs write-base64 <path> <base64>        write decoded bytes to a file
   fs chmod <path> <mode>                 set a file mode on Unix
+  fs mode <path>                         print file mode on Unix
+  fs touch <path> [mode]                 create a file without truncating it
+  fs list <path> [--glob <pattern>]      list matching direct children as JSON
+  ssh config host <host> --config <path> print true when Host patterns match
+  ssh config identities --config <path>  print IdentityFile paths as JSON
+  ssh script run --config <path>         run a local script on an SSH host
+  ssh script capture --config <path>     run a local script and print stdout
   fs contains-any <path> <text>...       print true when file contains any text
   fs backup-numbered <path>              move path to .bak or .bak.N and print it
+  gitee repo parse-origin <url>          parse Gitee owner/repo from origin URL
+  gitee pr create                        create a Gitee pull request
+  gitee pr pass-gates                    best-effort pass Gitee PR gates
+  gitee pr merge                         merge a Gitee pull request
   github pr checks probe <number>        print true when PR checks are reported
   cloudflare zone dns-record list        list DNS records in a zone
   cloudflare zone dns-record create      create a DNS record from JSON
diff --git a/app/src/core/tool/ssh/mod.rs b/app/src/core/tool/ssh/mod.rs
new file mode 100644
index 0000000..6613092
--- /dev/null
+++ b/app/src/core/tool/ssh/mod.rs
@@ -0,0 +1,243 @@
+use std::{
+    path::{Path, PathBuf},
+    process::{Command, Stdio},
+};
+
+use anyhow::{Context, Result, bail};
+
+pub fn eval(command: &str, args: &[String]) -> Result<Option<String>> {
+    match command {
+        "config" => config(args),
+        "script" => script(args),
+        _ => bail!("unknown tool command: ssh {command}"),
+    }
+}
+
+fn config(args: &[String]) -> Result<Option<String>> {
+    let [command, rest @ ..] = args else {
+        bail!("usage: runseal @tool ssh config host|identities ...");
+    };
+    match command.as_str() {
+        "host" => config_host(rest),
+        "identities" => config_identities(rest),
+        _ => bail!("usage: runseal @tool ssh config host|identities ..."),
+    }
+}
+
+fn script(args: &[String]) -> Result<Option<String>> {
+    let [command, rest @ ..] = args else {
+        bail!(
+            "usage: runseal @tool ssh script run|capture --config <path> --host <host> --file <path> -- <args...>"
+        );
+    };
+    match command.as_str() {
+        "run" => script_run(rest, false),
+        "capture" => script_run(rest, true),
+        _ => bail!(
+            "usage: runseal @tool ssh script run|capture --config <path> --host <host> --file <path> -- <args...>"
+        ),
+    }
+}
+
+fn script_run(args: &[String], capture: bool) -> Result<Option<String>> {
+    let (options, script_args) = split_options(args);
+    let config = required_option(options, "--config")?;
+    let host = required_option(options, "--host")?;
+    let file = required_option(options, "--file")?;
+    if !Path::new(&file).is_file() {
+        bail!("script not found: {file}");
+    }
+    let patterns = read_hosts(Path::new(&config))?;
+    if !host_allowed(&host, &patterns) {
+        bail!("host is not declared in {config}: {host}");
+    }
+    let input = std::fs::read(&file).with_context(|| format!("failed to read script: {file}"))?;
+    let mut command = Command::new("ssh");
+    command
+        .arg("-F")
+        .arg(&config)
+        .arg(&host)
+        .arg("bash")
+        .arg("-s")
+        .arg("--")
+        .args(script_args)
+        .stdin(Stdio::piped());
+    if capture {
+        command.stdout(Stdio::piped());
+    }
+    let mut child = command
+        .spawn()
+        .with_context(|| format!("failed to execute ssh for host: {host}"))?;
+    if let Some(mut stdin) = child.stdin.take() {
+        use std::io::Write;
+        stdin
+            .write_all(&input)
+            .with_context(|| format!("failed to send script to ssh for host: {host}"))?;
+    }
+    let output = child
+        .wait_with_output()
+        .with_context(|| format!("failed to wait for ssh script on host: {host}"))?;
+    if !output.status.success() {
+        let code = output.status.code().unwrap_or(1);
+        bail!("ssh script failed with exit code {code}");
+    }
+    if capture {
+        return Ok(Some(String::from_utf8_lossy(&output.stdout).into_owned()));
+    }
+    Ok(None)
+}
+
+fn split_options(args: &[String]) -> (&[String], &[String]) {
+    if let Some(index) = args.iter().position(|arg| arg == "--") {
+        (&args[..index], &args[index + 1..])
+    } else {
+        (args, &[])
+    }
+}
+
+fn config_host(args: &[String]) -> Result<Option<String>> {
+    let [host, rest @ ..] = args else {
+        bail!("usage: runseal @tool ssh config host <host> --config <path>");
+    };
+    let config = required_option(rest, "--config")?;
+    let patterns = read_hosts(Path::new(&config))?;
+    Ok(Some(host_allowed(host, &patterns).to_string()))
+}
+
+fn config_identities(args: &[String]) -> Result<Option<String>> {
+    let config = required_option(args, "--config")?;
+    let config_path = Path::new(&config);
+    let base = optional_option(args, "--base")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| {
+            config_path
+                .parent()
+                .map(Path::to_path_buf)
+                .unwrap_or_else(|| PathBuf::from("."))
+        });
+    let identities = read_identity_files(config_path, &base)?;
+    Ok(Some(serde_json::to_string(&identities)?))
+}
+
+fn read_hosts(config: &Path) -> Result<Vec<String>> {
+    let text = std::fs::read_to_string(config)
+        .with_context(|| format!("failed to read ssh config: {}", config.display()))?;
+    Ok(text
+        .lines()
+        .filter_map(config_words)
+        .filter(|words| {
+            words
+                .first()
+                .is_some_and(|word| word.eq_ignore_ascii_case("host"))
+        })
+        .flat_map(|words| words.into_iter().skip(1))
+        .collect())
+}
+
+fn read_identity_files(config: &Path, base: &Path) -> Result<Vec<String>> {
+    let text = std::fs::read_to_string(config)
+        .with_context(|| format!("failed to read ssh config: {}", config.display()))?;
+    let mut files = Vec::new();
+    for words in text.lines().filter_map(config_words) {
+        if words
+            .first()
+            .is_some_and(|word| word.eq_ignore_ascii_case("identityfile"))
+            && let Some(value) = words.get(1)
+        {
+            files.push(
+                resolve_identity_file(value, base)
+                    .to_string_lossy()
+                    .into_owned(),
+            );
+        }
+    }
+    Ok(files)
+}
+
+fn config_words(line: &str) -> Option<Vec<String>> {
+    let line = line.split_once('#').map_or(line, |(before, _)| before);
+    let words = line
+        .split_whitespace()
+        .map(str::to_string)
+        .collect::<Vec<_>>();
+    (!words.is_empty()).then_some(words)
+}
+
+fn host_allowed(host: &str, patterns: &[String]) -> bool {
+    let mut matched = false;
+    for pattern in patterns {
+        if let Some(negative) = pattern.strip_prefix('!') {
+            if glob_match(negative, host) {
+                return false;
+            }
+        } else if glob_match(pattern, host) {
+            matched = true;
+        }
+    }
+    matched
+}
+
+fn resolve_identity_file(value: &str, base: &Path) -> PathBuf {
+    if value == "~" {
+        return home_dir().unwrap_or_else(|| PathBuf::from(value));
+    }
+    if let Some(rest) = value.strip_prefix("~/")
+        && let Some(home) = home_dir()
+    {
+        return home.join(rest);
+    }
+    let path = PathBuf::from(value);
+    if path.is_absolute() {
+        path
+    } else {
+        base.join(path)
+    }
+}
+
+fn home_dir() -> Option<PathBuf> {
+    std::env::var_os("HOME")
+        .or_else(|| std::env::var_os("USERPROFILE"))
+        .map(PathBuf::from)
+}
+
+fn required_option(args: &[String], name: &str) -> Result<String> {
+    optional_option(args, name).ok_or_else(|| anyhow::anyhow!("{name} is required"))
+}
+
+fn optional_option(args: &[String], name: &str) -> Option<String> {
+    let prefix = format!("{name}=");
+    let mut index = 0;
+    while index < args.len() {
+        let arg = &args[index];
+        if arg == name {
+            return args.get(index + 1).cloned();
+        }
+        if let Some(value) = arg.strip_prefix(&prefix) {
+            return Some(value.to_string());
+        }
+        index += 1;
+    }
+    None
+}
+
+fn glob_match(pattern: &str, value: &str) -> bool {
+    glob_match_inner(pattern.as_bytes(), value.as_bytes())
+}
+
+fn glob_match_inner(pattern: &[u8], value: &[u8]) -> bool {
+    match (pattern.split_first(), value.split_first()) {
+        (None, None) => true,
+        (None, Some(_)) => false,
+        (Some((&b'*', rest)), _) => {
+            glob_match_inner(rest, value)
+                || value
+                    .split_first()
+                    .is_some_and(|(_, tail)| glob_match_inner(pattern, tail))
+        }
+        (Some((&b'?', rest)), Some((_, tail))) => glob_match_inner(rest, tail),
+        (Some((&expected, rest)), Some((&actual, tail))) if expected == actual => {
+            glob_match_inner(rest, tail)
+        }
+        _ => false,
+    }
+}
diff --git a/app/src/core/tool/string.rs b/app/src/core/tool/string.rs
index e720e9a..908801f 100644
--- a/app/src/core/tool/string.rs
+++ b/app/src/core/tool/string.rs
@@ -1,8 +1,10 @@
-use anyhow::{Result, bail};
+use anyhow::{Context, Result, bail};
 
 pub fn eval(command: &str, args: &[String]) -> Result<Option<String>> {
     match command {
         "trim" => trim(args),
+        "join" => join(args),
+        "slug" => slug(args),
         _ => bail!("unknown tool command: string {command}"),
     }
 }
@@ -13,3 +15,92 @@ fn trim(args: &[String]) -> Result<Option<String>> {
     };
     Ok(Some(value.trim().to_string()))
 }
+
+fn join(args: &[String]) -> Result<Option<String>> {
+    let [json, separator_flag, separator] = args else {
+        bail!("usage: runseal @tool string join <json-array> --separator <text|path>");
+    };
+    if separator_flag != "--separator" {
+        bail!("usage: runseal @tool string join <json-array> --separator <text|path>");
+    }
+    let values: Vec<String> = serde_json::from_str(json).context("invalid string array JSON")?;
+    if separator == "path" {
+        let joined =
+            std::env::join_paths(values.iter()).context("failed to join path-list values")?;
+        return Ok(Some(joined.to_string_lossy().into_owned()));
+    }
+    Ok(Some(values.join(separator)))
+}
+
+fn slug(args: &[String]) -> Result<Option<String>> {
+    let Some(value) = args.first() else {
+        bail!("usage: runseal @tool string slug <value> [--max-len <n>] [--fallback <text>]");
+    };
+
+    let mut max_len: Option<usize> = None;
+    let mut fallback = "value".to_string();
+    let mut rest = &args[1..];
+    while let Some((flag, tail)) = rest.split_first() {
+        match flag.as_str() {
+            "--max-len" => {
+                let Some((raw, next)) = tail.split_first() else {
+                    bail!("missing value for --max-len");
+                };
+                let parsed = raw.parse::<usize>().context("invalid --max-len value")?;
+                if parsed == 0 {
+                    bail!("--max-len must be greater than zero");
+                }
+                max_len = Some(parsed);
+                rest = next;
+            }
+            "--fallback" => {
+                let Some((raw, next)) = tail.split_first() else {
+                    bail!("missing value for --fallback");
+                };
+                fallback = raw.clone();
+                rest = next;
+            }
+            _ => bail!(
+                "usage: runseal @tool string slug <value> [--max-len <n>] [--fallback <text>]"
+            ),
+        }
+    }
+
+    let mut output = slugify(value);
+    if let Some(limit) = max_len {
+        output.truncate(limit);
+        output = trim_hyphens(&output);
+    }
+    if output.is_empty() {
+        output = slugify(&fallback);
+        if let Some(limit) = max_len {
+            output.truncate(limit);
+            output = trim_hyphens(&output);
+        }
+    }
+    if output.is_empty() {
+        output = "value".to_string();
+    }
+    Ok(Some(output))
+}
+
+fn slugify(value: &str) -> String {
+    let mut output = String::new();
+    let mut pending_dash = false;
+    for ch in value.chars() {
+        if ch.is_ascii_alphanumeric() {
+            if pending_dash && !output.is_empty() {
+                output.push('-');
+            }
+            output.push(ch.to_ascii_lowercase());
+            pending_dash = false;
+        } else {
+            pending_dash = true;
+        }
+    }
+    output
+}
+
+fn trim_hyphens(value: &str) -> String {
+    value.trim_matches('-').to_string()
+}
diff --git a/app/src/core/transpile/ast.rs b/app/src/core/transpile/ast.rs
index 8234aba..227d448 100644
--- a/app/src/core/transpile/ast.rs
+++ b/app/src/core/transpile/ast.rs
@@ -21,6 +21,10 @@ pub enum Statement {
     ExecChecked {
         argv: Vec<Value>,
     },
+    EnvExecChecked {
+        env: Vec<EnvAssign>,
+        argv: Vec<Value>,
+    },
     Shift {
         count: usize,
     },
@@ -79,6 +83,12 @@ pub struct ArgvSpec {
     pub default: Option<String>,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct EnvAssign {
+    pub name: String,
+    pub value: Value,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum ArgvKind {
@@ -90,6 +100,7 @@ pub enum ArgvKind {
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum Value {
     Literal { text: String },
+    Argc,
     Var { name: String },
     Args,
     Env { name: String },
@@ -100,6 +111,7 @@ pub enum Value {
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum Predicate {
+    Command { argv: Vec<Value> },
     Empty { value: Value },
     NotEmpty { value: Value },
     Eq { left: Value, right: Value },
diff --git a/app/src/core/transpile/emit/mod.rs b/app/src/core/transpile/emit/mod.rs
index 49704ac..1c94bd6 100644
--- a/app/src/core/transpile/emit/mod.rs
+++ b/app/src/core/transpile/emit/mod.rs
@@ -42,6 +42,17 @@ fn emit_seal_statement(out: &mut String, statement: &Statement, indent: usize) {
             out.push_str(&join_values(argv, seal_value));
             out.push('\n');
         }
+        Statement::EnvExecChecked { env, argv } => {
+            out.push_str(&pad);
+            for item in env {
+                out.push_str(&item.name);
+                out.push('=');
+                out.push_str(&seal_value(&item.value));
+                out.push(' ');
+            }
+            out.push_str(&join_values(argv, seal_value));
+            out.push('\n');
+        }
         Statement::Shift { count } => {
             out.push_str(&pad);
             out.push_str("shift");
@@ -212,6 +223,17 @@ fn emit_bash_statement(out: &mut String, statement: &Statement, indent: usize) {
             out.push_str(&join_values(argv, bash_value));
             out.push('\n');
         }
+        Statement::EnvExecChecked { env, argv } => {
+            out.push_str(&pad);
+            for item in env {
+                out.push_str(&item.name);
+                out.push('=');
+                out.push_str(&bash_value(&item.value));
+                out.push(' ');
+            }
+            out.push_str(&join_values(argv, bash_value));
+            out.push('\n');
+        }
         Statement::Shift { count } => {
             out.push_str(&pad);
             out.push_str("shift");
diff --git a/app/src/core/transpile/emit/powershell.rs b/app/src/core/transpile/emit/powershell.rs
index 7e33556..4ee31a3 100644
--- a/app/src/core/transpile/emit/powershell.rs
+++ b/app/src/core/transpile/emit/powershell.rs
@@ -1,5 +1,7 @@
 use super::support::{generated_header, option_name};
-use crate::core::transpile::ast::{ArgvKind, ArgvSpec, Item, Predicate, Program, Statement, Value};
+use crate::core::transpile::ast::{
+    ArgvKind, ArgvSpec, EnvAssign, Item, Predicate, Program, Statement, Value,
+};
 
 pub(crate) fn emit_powershell(program: &Program, source_name: Option<&str>) -> String {
     let mut out = generated_header("powershell", source_name);
@@ -63,6 +65,7 @@ fn emit_statement(out: &mut String, statement: &Statement, indent: usize, positi
             out.push_str(&join_values(argv, powershell_value));
             out.push('\n');
         }
+        Statement::EnvExecChecked { env, argv } => emit_env_exec(out, &pad, env, argv),
         Statement::Shift { count } => {
             if *count == 0 {
                 out.push_str(&format!("{pad}$args = @($args)\n"));
@@ -86,9 +89,7 @@ fn emit_statement(out: &mut String, statement: &Statement, indent: usize, positi
             else_body,
         } => emit_if(out, &pad, predicate, then_body, else_body, indent),
         Statement::While { predicate, body } => {
-            out.push_str(&format!("{pad}while ({}) {{\n", predicate_text(predicate)));
-            emit_statements(out, body, indent + 1);
-            out.push_str(&format!("{pad}}}\n"));
+            emit_while(out, &pad, predicate, body, indent);
         }
         Statement::Case { value, arms } => {
             out.push_str(&format!("{pad}switch ({}) {{\n", powershell_value(value)));
@@ -235,6 +236,21 @@ fn emit_if(
     else_body: &[Statement],
     indent: usize,
 ) {
+    if let Predicate::Command { argv } = predicate {
+        out.push_str(&format!("{pad}& "));
+        out.push_str(&join_values(argv, powershell_value));
+        out.push('\n');
+        out.push_str(&format!("{pad}if ($LASTEXITCODE -eq 0) {{\n"));
+        emit_statements(out, then_body, indent + 1);
+        if else_body.is_empty() {
+            out.push_str(&format!("{pad}}}\n"));
+        } else {
+            out.push_str(&format!("{pad}}} else {{\n"));
+            emit_statements(out, else_body, indent + 1);
+            out.push_str(&format!("{pad}}}\n"));
+        }
+        return;
+    }
     out.push_str(&format!("{pad}if ({}) {{\n", predicate_text(predicate)));
     emit_statements(out, then_body, indent + 1);
     if else_body.is_empty() {
@@ -246,8 +262,39 @@ fn emit_if(
     }
 }
 
+fn emit_while(
+    out: &mut String,
+    pad: &str,
+    predicate: &Predicate,
+    body: &[Statement],
+    indent: usize,
+) {
+    if let Predicate::Command { argv } = predicate {
+        out.push_str(&format!("{pad}while ($true) {{\n"));
+        let inner = "    ".repeat(indent + 1);
+        out.push_str(&format!("{inner}& "));
+        out.push_str(&join_values(argv, powershell_value));
+        out.push('\n');
+        out.push_str(&format!(
+            "{inner}if ($LASTEXITCODE -ne 0) {{\n{inner}    break\n{inner}}}\n"
+        ));
+        emit_statements(out, body, indent + 1);
+        out.push_str(&format!("{pad}}}\n"));
+        return;
+    }
+    out.push_str(&format!("{pad}while ({}) {{\n", predicate_text(predicate)));
+    emit_statements(out, body, indent + 1);
+    out.push_str(&format!("{pad}}}\n"));
+}
+
 fn predicate_text(predicate: &Predicate) -> String {
     match predicate {
+        Predicate::Command { argv } => {
+            format!(
+                "(& {}; $LASTEXITCODE) -eq 0",
+                join_values(argv, powershell_value)
+            )
+        }
         Predicate::Empty { value } => {
             format!("[string]::IsNullOrEmpty({})", powershell_value(value))
         }
@@ -302,6 +349,7 @@ fn int_compare(left: &Value, operator: &str, right: &Value) -> String {
 fn powershell_value(value: &Value) -> String {
     match value {
         Value::Literal { text } => powershell_quote(text),
+        Value::Argc => "$args.Count".to_string(),
         Value::Var { name } => format!("${name}"),
         Value::Args => "@args".to_string(),
         Value::Env { name } => format!("$env:{name}"),
@@ -337,6 +385,7 @@ fn max_positional_statement(statement: &Statement) -> usize {
     match statement {
         Statement::Assign { value, .. } => max_positional_value(value),
         Statement::ExecChecked { argv }
+        | Statement::EnvExecChecked { argv, .. }
         | Statement::CaptureChecked { argv, .. }
         | Statement::CallFunction { argv, .. } => argv
             .iter()
@@ -370,8 +419,43 @@ fn max_positional_statement(statement: &Statement) -> usize {
     }
 }
 
+fn emit_env_exec(out: &mut String, pad: &str, env: &[EnvAssign], argv: &[Value]) {
+    out.push_str(&format!("{pad}& {{\n"));
+    for item in env {
+        out.push_str(&format!(
+            "{pad}    $__seal_old_env_{} = $env:{}\n",
+            item.name, item.name
+        ));
+    }
+    out.push_str(&format!("{pad}    try {{\n"));
+    for item in env {
+        out.push_str(&format!(
+            "{pad}        $env:{} = {}\n",
+            item.name,
+            powershell_value(&item.value)
+        ));
+    }
+    out.push_str(&format!("{pad}        & "));
+    out.push_str(&join_values(argv, powershell_value));
+    out.push('\n');
+    out.push_str(&format!("{pad}    }} finally {{\n"));
+    for item in env {
+        out.push_str(&format!(
+            "{pad}        $env:{} = $__seal_old_env_{}\n",
+            item.name, item.name
+        ));
+    }
+    out.push_str(&format!("{pad}    }}\n"));
+    out.push_str(&format!("{pad}}}\n"));
+}
+
 fn max_positional_predicate(predicate: &Predicate) -> usize {
     match predicate {
+        Predicate::Command { argv } => argv
+            .iter()
+            .map(max_positional_value)
+            .max()
+            .unwrap_or_default(),
         Predicate::Empty { value }
         | Predicate::NotEmpty { value }
         | Predicate::JsonEmpty { value }
@@ -398,7 +482,11 @@ fn max_positional_value(value: &Value) -> usize {
             .map(max_positional_value)
             .max()
             .unwrap_or_default(),
-        Value::Literal { .. } | Value::Args | Value::Env { .. } | Value::EnvDefault { .. } => 0,
+        Value::Literal { .. }
+        | Value::Argc
+        | Value::Args
+        | Value::Env { .. }
+        | Value::EnvDefault { .. } => 0,
     }
 }
 
diff --git a/app/src/core/transpile/emit/support.rs b/app/src/core/transpile/emit/support.rs
index cafc1b2..e5a0335 100644
--- a/app/src/core/transpile/emit/support.rs
+++ b/app/src/core/transpile/emit/support.rs
@@ -15,6 +15,7 @@ pub(super) fn generated_header(target: &str, source_name: Option<&str>) -> Strin
 
 pub(super) fn bash_predicate(predicate: &Predicate) -> String {
     match predicate {
+        Predicate::Command { argv } => join_values(argv, bash_value),
         Predicate::Empty { value } => format!("[ -z {} ]", bash_value(value)),
         Predicate::NotEmpty { value } => format!("[ -n {} ]", bash_value(value)),
         Predicate::Eq { left, right } => {
@@ -55,6 +56,7 @@ pub(super) fn bash_predicate(predicate: &Predicate) -> String {
 pub(super) fn seal_value(value: &Value) -> String {
     match value {
         Value::Literal { text } => sh_quote(text),
+        Value::Argc => "$#".to_string(),
         Value::Var { name } => format!("${name}"),
         Value::Args => "\"$@\"".to_string(),
         Value::Env { name } => format!("${{{name}}}"),
@@ -64,6 +66,7 @@ pub(super) fn seal_value(value: &Value) -> String {
                 .iter()
                 .map(|part| match part {
                     Value::Literal { text } => text.clone(),
+                    Value::Argc => "$#".to_string(),
                     Value::Args => "$@".to_string(),
                     _ => seal_value(part),
                 })
@@ -76,6 +79,7 @@ pub(super) fn seal_value(value: &Value) -> String {
 pub(super) fn bash_value(value: &Value) -> String {
     match value {
         Value::Literal { text } => sh_quote(text),
+        Value::Argc => "\"$#\"".to_string(),
         Value::Var { name } => format!("\"${name}\""),
         Value::Args => "\"$@\"".to_string(),
         Value::Env { name } => format!("\"${{{name}}}\""),
@@ -85,6 +89,7 @@ pub(super) fn bash_value(value: &Value) -> String {
                 .iter()
                 .map(|part| match part {
                     Value::Literal { text } => text.clone(),
+                    Value::Argc => "$#".to_string(),
                     Value::Var { name } => format!("${name}"),
                     Value::Args => "$@".to_string(),
                     Value::Env { name } => format!("${{{name}}}"),
@@ -98,6 +103,7 @@ pub(super) fn bash_value(value: &Value) -> String {
 
 pub(super) fn bash_int_value(value: &Value) -> String {
     match value {
+        Value::Argc => "$#".to_string(),
         Value::Var { name } => format!("${name}"),
         Value::Args => "\"$@\"".to_string(),
         Value::Env { name } => format!("${{{name}}}"),
diff --git a/app/src/core/transpile/guards.rs b/app/src/core/transpile/guards.rs
index 46164c9..8f7341a 100644
--- a/app/src/core/transpile/guards.rs
+++ b/app/src/core/transpile/guards.rs
@@ -48,6 +48,7 @@ fn collect_bash_tool(statement: &Statement, tools: &mut BTreeSet<&'static str>)
         Statement::Assign { .. }
         | Statement::ArgvParse { .. }
         | Statement::ExecChecked { .. }
+        | Statement::EnvExecChecked { .. }
         | Statement::Shift { .. }
         | Statement::CaptureChecked { .. }
         | Statement::CallFunction { .. }
diff --git a/app/src/core/transpile/lower.rs b/app/src/core/transpile/lower.rs
index a586211..5c75598 100644
--- a/app/src/core/transpile/lower.rs
+++ b/app/src/core/transpile/lower.rs
@@ -56,6 +56,7 @@ fn lower_statement(statement: &mut Statement, functions: &BTreeSet<String>) {
         }
         Statement::Assign { .. }
         | Statement::ArgvParse { .. }
+        | Statement::EnvExecChecked { .. }
         | Statement::Shift { .. }
         | Statement::CaptureChecked { .. }
         | Statement::CallFunction { .. }
diff --git a/app/src/core/transpile/parse.rs b/app/src/core/transpile/parse.rs
index 102b0ff..367e11a 100644
--- a/app/src/core/transpile/parse.rs
+++ b/app/src/core/transpile/parse.rs
@@ -1,6 +1,6 @@
 use anyhow::{Result, bail};
 
-use super::ast::{CaseArm, Item, Predicate, Program, Statement, Value};
+use super::ast::{CaseArm, EnvAssign, Item, Predicate, Program, Statement, Value};
 use super::lower::lower_functions;
 use super::parse_argv::parse_argv_block;
 use super::parse_lex::{
@@ -222,19 +222,24 @@ fn function_header(text: &str) -> Option<&str> {
 }
 
 fn parse_simple_statement(line: &SourceLine) -> Result<Statement> {
+    if let Some((name, value)) = assignment(&line.text)
+        && let Some(argv) = capture_argv(value, line.number)?
+    {
+        return Ok(Statement::CaptureChecked {
+            name: name.to_string(),
+            argv,
+        });
+    }
+    let tokens = split_words(&line.text, line.number)?;
+    if let Some(statement) = parse_env_exec(&tokens, line.number)? {
+        return Ok(statement);
+    }
     if let Some((name, value)) = assignment(&line.text) {
-        if let Some(argv) = capture_argv(value, line.number)? {
-            return Ok(Statement::CaptureChecked {
-                name: name.to_string(),
-                argv,
-            });
-        }
         return Ok(Statement::Assign {
             name: name.to_string(),
             value: parse_value_text(value, line.number)?,
         });
     }
-    let tokens = split_words(&line.text, line.number)?;
     let Some((command, args)) = tokens.split_first() else {
         bail!("{}: expected statement", line.number);
     };
@@ -290,16 +295,43 @@ fn parse_simple_statement(line: &SourceLine) -> Result<Statement> {
         _ if is_safe_command_name(command) => {
             validate_external_tokens(&tokens, line.number)?;
             Ok(Statement::ExecChecked {
-                argv: tokens
-                    .iter()
-                    .map(|arg| parse_value_text(arg, line.number))
-                    .collect::<Result<Vec<_>>>()?,
+                argv: parse_values(&tokens, line.number)?,
             })
         }
         _ => bail!("{}: unsupported statement: {}", line.number, line.text),
     }
 }
 
+fn parse_env_exec(tokens: &[String], line: usize) -> Result<Option<Statement>> {
+    let mut env = Vec::new();
+    let mut index = 0;
+    while let Some(token) = tokens.get(index) {
+        let Some((name, value)) = assignment(token) else {
+            break;
+        };
+        env.push(EnvAssign {
+            name: name.to_string(),
+            value: parse_value_text(value, line)?,
+        });
+        index += 1;
+    }
+    if env.is_empty() || index == tokens.len() {
+        return Ok(None);
+    }
+    let argv_tokens = &tokens[index..];
+    validate_external_tokens(argv_tokens, line)?;
+    let Some(command) = argv_tokens.first() else {
+        return Ok(None);
+    };
+    if !is_safe_command_name(command) {
+        bail!("{line}: unsupported statement: {}", tokens.join(" "));
+    }
+    Ok(Some(Statement::EnvExecChecked {
+        env,
+        argv: parse_values(argv_tokens, line)?,
+    }))
+}
+
 fn parse_printf(args: &[String], line: usize) -> Result<Statement> {
     match args {
         [format, value] if format == "'%s\\n'" => Ok(Statement::Print {
@@ -352,12 +384,7 @@ fn capture_argv(value: &str, line: usize) -> Result<Option<Vec<Value>>> {
         bail!("{line}: capture command cannot be empty");
     }
     validate_external_tokens(&tokens, line)?;
-    Ok(Some(
-        tokens
-            .iter()
-            .map(|arg| parse_value_text(arg, line))
-            .collect::<Result<Vec<_>>>()?,
-    ))
+    Ok(Some(parse_values(&tokens, line)?))
 }
 
 fn one_value(args: &[String], line: usize, command: &str) -> Result<Value> {
@@ -375,7 +402,24 @@ fn parse_predicate(text: &str, line: usize) -> Result<Predicate> {
         return parse_test_predicate(inner, line);
     }
 
-    bail!("{line}: unsupported predicate: {text}")
+    let tokens = split_words(text, line)?;
+    let Some(command) = tokens.first() else {
+        bail!("{line}: command predicate cannot be empty");
+    };
+    if !is_safe_command_name(command) {
+        bail!("{line}: unsupported predicate: {text}");
+    }
+    validate_external_tokens(&tokens, line)?;
+    Ok(Predicate::Command {
+        argv: parse_values(&tokens, line)?,
+    })
+}
+
+fn parse_values(tokens: &[String], line: usize) -> Result<Vec<Value>> {
+    tokens
+        .iter()
+        .map(|arg| parse_value_text(arg, line))
+        .collect()
 }
 
 fn parse_test_predicate(text: &str, line: usize) -> Result<Predicate> {
diff --git a/app/src/core/transpile/runner.rs b/app/src/core/transpile/runner.rs
index e403261..72cbe64 100644
--- a/app/src/core/transpile/runner.rs
+++ b/app/src/core/transpile/runner.rs
@@ -99,6 +99,18 @@ impl<'a> Runner<'a> {
                     return Ok(Flow::Exit(code));
                 }
             }
+            Statement::EnvExecChecked { env, argv } => {
+                let overlay = env
+                    .iter()
+                    .map(|item| (item.name.clone(), self.value(&item.value)))
+                    .collect::<Vec<_>>();
+                let code = self
+                    .run_external_with_env(argv, CaptureMode::None, &overlay)?
+                    .code;
+                if code != 0 {
+                    return Ok(Flow::Exit(code));
+                }
+            }
             Statement::CaptureChecked { name, argv } => {
                 let output = self.run_external(argv, CaptureMode::Stdout)?;
                 if output.code != 0 {
@@ -240,6 +252,7 @@ impl<'a> Runner<'a> {
     fn value(&self, value: &Value) -> String {
         match value {
             Value::Literal { text } => text.clone(),
+            Value::Argc => self.argc().to_string(),
             Value::Var { name } => self.vars.get(name).cloned().unwrap_or_default(),
             Value::Args => shell_words(&self.current_args()),
             Value::Env { name } => self.env.get(name).cloned().unwrap_or_default(),
@@ -255,6 +268,7 @@ impl<'a> Runner<'a> {
 
     fn predicate(&self, predicate: &Predicate) -> Result<bool> {
         Ok(match predicate {
+            Predicate::Command { argv } => self.run_external(argv, CaptureMode::None)?.code == 0,
             Predicate::Empty { value } => self.value(value).is_empty(),
             Predicate::NotEmpty { value } => !self.value(value).is_empty(),
             Predicate::Eq { left, right } => self.value(left) == self.value(right),
@@ -288,12 +302,22 @@ impl<'a> Runner<'a> {
     }
 
     fn run_external(&self, argv: &[Value], capture: CaptureMode) -> Result<CommandOutput> {
+        self.run_external_with_env(argv, capture, &[])
+    }
+
+    fn run_external_with_env(
+        &self,
+        argv: &[Value],
+        capture: CaptureMode,
+        env_overlay: &[(String, String)],
+    ) -> Result<CommandOutput> {
         let argv = self.expanded_values(argv);
         let Some((program, args)) = argv.split_first() else {
             bail!("external command cannot be empty");
         };
         let mut command = Command::new(program);
         command.args(args).envs(&self.env);
+        command.envs(env_overlay.iter().map(|(key, value)| (key, value)));
         if matches!(capture, CaptureMode::None) {
             let status = command
                 .status()
@@ -358,6 +382,7 @@ impl<'a> Runner<'a> {
         for value in values {
             match value {
                 Value::Args => expanded.extend(self.current_args()),
+                Value::Argc => expanded.push(self.argc().to_string()),
                 _ => expanded.push(self.value(value)),
             }
         }
diff --git a/app/src/core/transpile/value.rs b/app/src/core/transpile/value.rs
index fd181d9..2897a01 100644
--- a/app/src/core/transpile/value.rs
+++ b/app/src/core/transpile/value.rs
@@ -6,6 +6,9 @@ pub(crate) fn parse_value_text(text: &str, line: usize) -> Result<Value> {
     if text == "$@" || text == "\"$@\"" {
         return Ok(Value::Args);
     }
+    if text == "$#" || text == "\"$#\"" {
+        return Ok(Value::Argc);
+    }
     if let Some(value) = text
         .strip_prefix('\'')
         .and_then(|value| value.strip_suffix('\''))
diff --git a/app/tests/fixtures/estate/admin.seal b/app/tests/fixtures/estate/admin.seal
new file mode 100644
index 0000000..7a352aa
--- /dev/null
+++ b/app/tests/fixtures/estate/admin.seal
@@ -0,0 +1,191 @@
+print() {
+  printf '%s\n' "$1"
+}
+
+error() {
+  printf '%s\n' "$1" >&2
+}
+
+fail() {
+  error "$1"
+  exit 1
+}
+
+usage() {
+  print "Usage: runseal :admin <command> [args]"
+  print ""
+  print "Commands:"
+  print "  init"
+  print "  check"
+  print "  bootstrap-kube"
+  print "  export <archive.enc>"
+  print "  import [--force] <archive.enc>"
+}
+
+local_dir=${PERISH_TOP_LOCAL_DIR}
+ssh_dir=${PERISH_TOP_SSH_DIR}
+ssh_config=${PERISH_TOP_SSH_CONFIG}
+kube_dir=${PERISH_TOP_KUBE_DIR}
+secrets_dir=${PERISH_TOP_SECRETS_DIR}
+tmp_dir=${PERISH_TOP_TMP_DIR}
+
+ensure_dir() {
+  runseal @tool fs mkdir "$1" 700
+}
+
+ensure_file() {
+  runseal @tool fs touch "$1" 600
+}
+
+check_dir() {
+  if [ -d "$1" ]; then
+    current=$(runseal @tool fs mode "$1")
+    if [ "$current" = 700 ]; then
+    else
+      print "bad mode: $1 is $current, expected 700"
+      ok=false
+    fi
+  else
+    print "missing: $1"
+    ok=false
+  fi
+}
+
+check_file_mode() {
+  if [ -f "$1" ]; then
+    current=$(runseal @tool fs mode "$1")
+    if [ "$current" = "$2" ]; then
+    else
+      print "bad mode: $1 is $current, expected $2"
+      ok=false
+    fi
+  else
+    print "missing: $1"
+    ok=false
+  fi
+}
+
+check_host() {
+  allowed=$(runseal @tool ssh config host "$1" --config "$config")
+  if [ "$allowed" = true ]; then
+  else
+    print "missing ssh Host: $1"
+    ok=false
+  fi
+}
+
+if [ -z "$1" ]; then
+  usage
+  exit 0
+fi
+
+command=$1
+shift
+
+case "$command" in
+  init)
+    if [ -n "$1" ]; then
+      fail "admin init: unknown argument: $1"
+    fi
+    ensure_dir "$local_dir"
+    ensure_dir "$ssh_dir"
+    ensure_dir "$kube_dir"
+    ensure_dir "$secrets_dir"
+    ensure_dir "$tmp_dir"
+    config="$ssh_config"
+    if [ -f "$config" ]; then
+      print "exists $config"
+    else
+      runseal @tool fs write-base64 "$config" "__SSH_CONFIG_BASE64__"
+      runseal @tool fs chmod "$config" 600
+      print "created $config"
+    fi
+    ensure_file "$ssh_dir/id_perish_top_root"
+    ensure_file "$ssh_dir/known_hosts"
+    print "admin init: ok"
+    ;;
+  check)
+    if [ -n "$1" ]; then
+      fail "admin check: unknown argument: $1"
+    fi
+    ok=true
+    config="$ssh_config"
+    check_dir "$local_dir"
+    check_dir "$ssh_dir"
+    check_dir "$kube_dir"
+    check_dir "$secrets_dir"
+    check_file_mode "$config" 600
+    check_host 10m.hk.zxi
+    check_host 5m.hk.zxi
+    check_host la.us.lisa
+    check_host ny.us.lisa
+    identities=$(runseal @tool ssh config identities --config "$config")
+    identity=$(runseal @tool json get "$identities" '.[0]')
+    check_file_mode "$identity" 600
+    kube_files=$(runseal @tool fs list "$kube_dir" --glob "*.yaml" --files --require-nonempty)
+    kube_file=$(runseal @tool json get "$kube_files" '.[0]')
+    check_file_mode "$kube_file" 600
+    if [ "$ok" = true ]; then
+      print "admin check: ok"
+    else
+      print "admin check: failed"
+      exit 1
+    fi
+    ;;
+  bootstrap-kube)
+    if [ -n "$1" ]; then
+      fail "admin bootstrap-kube: unknown argument: $1"
+    fi
+    ensure_dir "$kube_dir"
+    host=10m.hk.zxi
+    context=hk-zxi
+    server=https://k8s.perish.top:6443
+    ops_admin=infra/k8s/access/ops-admin.yaml
+    setup=nodes/10m-hk-zxi/k3s/bootstrap/35-emit-kubeconfig.sh
+    kubeconfig="$kube_dir/$context.yaml"
+    runseal @tool ssh script run --config "$ssh_config" --host "$host" --file "$ops_admin"
+    raw=$(runseal @tool ssh script capture --config "$ssh_config" --host "$host" --file "$setup" -- "$server" "$context")
+    runseal @tool fs write "$kubeconfig" "$raw" 600
+    print "admin bootstrap-kube: wrote $kubeconfig"
+    ;;
+  export)
+    if [ -z "$1" ]; then
+      fail "admin export: archive path is required"
+    fi
+    archive=$1
+    shift
+    if [ -n "$1" ]; then
+      fail "admin export: unknown argument: $1"
+    fi
+    runseal @tool archive local export --source "$local_dir" --archive "$archive" --password-env PERISH_TOP_LOCAL_PASSWORD
+    print "admin export: wrote encrypted archive $archive"
+    ;;
+  import)
+    force=false
+    if [ "$1" = --force ]; then
+      force=true
+      shift
+    fi
+    if [ -z "$1" ]; then
+      fail "admin import: archive path is required"
+    fi
+    archive=$1
+    shift
+    if [ -n "$1" ]; then
+      fail "admin import: unknown argument: $1"
+    fi
+    if [ "$force" = true ]; then
+      runseal @tool archive local import --source "$local_dir" --archive "$archive" --password-env PERISH_TOP_LOCAL_PASSWORD --force
+    else
+      runseal @tool archive local import --source "$local_dir" --archive "$archive" --password-env PERISH_TOP_LOCAL_PASSWORD
+    fi
+    print "admin import: restored .local"
+    ;;
+  -h|--help|help)
+    usage
+    ;;
+  *)
+    usage
+    exit 2
+    ;;
+esac
diff --git a/app/tests/fixtures/estate/kube.seal b/app/tests/fixtures/estate/kube.seal
new file mode 100644
index 0000000..4e91e9f
--- /dev/null
+++ b/app/tests/fixtures/estate/kube.seal
@@ -0,0 +1,4 @@
+kube_dir=${PERISH_TOP_KUBE_DIR}
+configs=$(runseal @tool fs list "$kube_dir" --glob "*.yaml" --files --require-nonempty)
+kubeconfig=$(runseal @tool string join "$configs" --separator path)
+KUBECONFIG="$kubeconfig" kubectl "$@"
diff --git a/app/tests/fixtures/estate/pr.seal b/app/tests/fixtures/estate/pr.seal
new file mode 100644
index 0000000..e2c0979
--- /dev/null
+++ b/app/tests/fixtures/estate/pr.seal
@@ -0,0 +1,158 @@
+print() {
+  printf '%s\n' "$1"
+}
+
+error() {
+  printf '%s\n' "$1" >&2
+}
+
+fail() {
+  error "$1"
+  exit 1
+}
+
+usage() {
+  print "Usage: runseal :pr [options] <message>"
+}
+
+base=main
+branch=
+body=
+no_merge=false
+dry_run=false
+resume=false
+message=
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --base)
+      if [ "$#" -lt 2 ]; then
+        fail "missing value for --base"
+      fi
+      base=$2
+      shift 2
+      ;;
+    --branch)
+      if [ "$#" -lt 2 ]; then
+        fail "missing value for --branch"
+      fi
+      branch=$2
+      shift 2
+      ;;
+    --body)
+      if [ "$#" -lt 2 ]; then
+        fail "missing value for --body"
+      fi
+      body=$2
+      shift 2
+      ;;
+    --no-merge)
+      no_merge=true
+      shift
+      ;;
+    --dry-run)
+      dry_run=true
+      shift
+      ;;
+    --resume)
+      resume=true
+      shift
+      ;;
+    -h|--help|help)
+      usage
+      exit 0
+      ;;
+    *)
+      if [ -z "$message" ]; then
+        message=$1
+        shift
+      else
+        fail "pr: unexpected argument: $1"
+      fi
+      ;;
+  esac
+done
+
+if [ -z "$message" ]; then
+  usage
+  exit 2
+fi
+
+if [ -z "$body" ]; then
+  body="$message"
+fi
+
+current=$(git branch --show-current)
+
+if [ -z "$branch" ]; then
+  if [ "$resume" = true ]; then
+    branch="$current"
+  else
+    slug=$(runseal @tool string slug "$message" --max-len 48 --fallback change)
+    branch="auto/$slug"
+  fi
+fi
+
+token_file="${PERISH_TOP_SECRETS_DIR}/gitee.env"
+origin=$(git remote get-url origin)
+repo_json=$(runseal @tool gitee repo parse-origin "$origin")
+owner=$(runseal @tool json get "$repo_json" .owner)
+repo=$(runseal @tool json get "$repo_json" .repo)
+
+if [ "$dry_run" = true ]; then
+  print "branch: $branch"
+  print "base: $base"
+  print "owner: $owner"
+  print "repo: $repo"
+  print "resume: $resume"
+  exit 0
+fi
+
+if [ "$resume" = true ]; then
+  if [ "$branch" = "$base" ]; then
+    fail "pr: --resume needs a topic branch, not the base branch"
+  fi
+  if [ "$current" = "$branch" ]; then
+  else
+    if git checkout "$branch"; then
+    else
+      git fetch origin "$branch"
+      git checkout -B "$branch" "origin/$branch"
+    fi
+  fi
+  dirty=$(git status --short)
+  if [ -n "$dirty" ]; then
+    fail "pr: --resume requires a clean topic branch"
+  fi
+else
+  if [ "$current" = "$base" ]; then
+  else
+    fail "pr: must start from $base, current branch is $current"
+  fi
+  dirty=$(git status --short)
+  if [ -z "$dirty" ]; then
+    fail "pr: no local changes to land"
+  fi
+  git checkout -b "$branch"
+  git add -A
+  git commit -m "$message"
+fi
+
+git push -u origin "$branch"
+
+pr=$(runseal @tool gitee pr create --owner "$owner" --repo "$repo" --token-file "$token_file" --base "$base" --head "$branch" --title "$message" --body "$body")
+number=$(runseal @tool json get "$pr" .number)
+url=$(runseal @tool json get "$pr" .html_url)
+
+if [ "$no_merge" = false ]; then
+  runseal @tool gitee pr pass-gates --owner "$owner" --repo "$repo" --token-file "$token_file" --number "$number"
+  runseal @tool gitee pr merge --owner "$owner" --repo "$repo" --token-file "$token_file" --number "$number" --method squash
+  git checkout "$base"
+  git pull --ff-only origin "$base"
+  git push origin --delete "$branch"
+  git branch -D "$branch"
+else
+  git checkout "$base"
+fi
+
+print "$url"
diff --git a/app/tests/fixtures/estate/ssh-run.seal b/app/tests/fixtures/estate/ssh-run.seal
new file mode 100644
index 0000000..e3a43d6
--- /dev/null
+++ b/app/tests/fixtures/estate/ssh-run.seal
@@ -0,0 +1,42 @@
+print() {
+  printf '%s\n' "$1"
+}
+
+error() {
+  printf '%s\n' "$1" >&2
+}
+
+fail() {
+  error "$1"
+  exit 1
+}
+
+usage() {
+  print "Usage: runseal :ssh-run <host> <script> [-- <args>...]"
+}
+
+if [ -z "$1" ]; then
+  usage
+  exit 0
+fi
+
+host=$1
+shift
+
+if [ -z "$1" ]; then
+  usage
+  exit 2
+fi
+
+script=$1
+shift
+
+if [ -n "$1" ]; then
+  if [ "$1" = -- ]; then
+    shift
+  else
+    fail "ssh-run: script arguments must be separated with --"
+  fi
+fi
+
+runseal :ssh "$host" --run "$script" -- "$@"
diff --git a/app/tests/fixtures/estate/ssh.seal b/app/tests/fixtures/estate/ssh.seal
new file mode 100644
index 0000000..84248c5
--- /dev/null
+++ b/app/tests/fixtures/estate/ssh.seal
@@ -0,0 +1,66 @@
+print() {
+  printf '%s\n' "$1"
+}
+
+error() {
+  printf '%s\n' "$1" >&2
+}
+
+fail() {
+  error "$1"
+  exit 1
+}
+
+usage() {
+  print "Usage: runseal :ssh <host> [--run <script> [-- <args>...] | -- <remote-command>...]"
+}
+
+ssh_config=${PERISH_TOP_SSH_CONFIG}
+run_script=false
+script=
+
+if [ -z "$1" ]; then
+  usage
+  exit 0
+fi
+
+host=$1
+shift
+
+if [ -n "$1" ]; then
+  if [ "$1" = --run ]; then
+    run_script=true
+    shift
+    if [ -z "$1" ]; then
+      usage
+      exit 2
+    fi
+    script=$1
+    shift
+    if [ -n "$1" ]; then
+      if [ "$1" = -- ]; then
+        shift
+      else
+        fail "ssh: script arguments must be separated with --"
+      fi
+    fi
+  else
+    if [ "$1" = -- ]; then
+      shift
+    else
+      fail "ssh: remote command must be separated with --"
+    fi
+  fi
+fi
+
+if [ "$run_script" = true ]; then
+  runseal @tool ssh script run --config "$ssh_config" --host "$host" --file "$script" -- "$@"
+else
+  allowed=$(runseal @tool ssh config host "$host" --config "$ssh_config")
+  if [ "$allowed" = true ]; then
+  else
+    fail "ssh: host is not declared in $ssh_config: $host"
+  fi
+
+  ssh -F "$ssh_config" "$host" "$@"
+fi
diff --git a/app/tests/internal_tool.rs b/app/tests/internal_tool.rs
index 1a405c7..3573474 100644
--- a/app/tests/internal_tool.rs
+++ b/app/tests/internal_tool.rs
@@ -1,3 +1,13 @@
+#[path = "internal_tool/archive.rs"]
+#[cfg(unix)]
+mod archive;
+#[path = "internal_tool/gitee.rs"]
+mod gitee;
+#[path = "internal_tool/ssh.rs"]
+mod ssh;
+#[path = "internal_tool/string.rs"]
+mod string;
+
 use std::{path::PathBuf, process::Command};
 
 use tempfile::TempDir;
@@ -24,6 +34,19 @@ fn tool_runs_without_profile() {
             "123\n",
         ),
         (vec!["@tool", "string", "trim", "  value  "], "value\n"),
+        (
+            vec![
+                "@tool",
+                "string",
+                "slug",
+                "Land Change: ship .seal!",
+                "--max-len",
+                "48",
+                "--fallback",
+                "change",
+            ],
+            "land-change-ship-seal\n",
+        ),
         (
             vec![
                 "@tool",
@@ -89,6 +112,38 @@ fn fs_runs_without_profile() {
         "seal marker\n"
     );
 
+    let text_file = cwd.join("text");
+    let write_text = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args([
+            "@tool",
+            "fs",
+            "write",
+            text_file.to_str().unwrap(),
+            "plain text",
+            "600",
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(write_text.status.success());
+    assert_eq!(
+        std::fs::read_to_string(&text_file).expect("file should be readable"),
+        "plain text"
+    );
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        assert_eq!(
+            std::fs::metadata(&text_file)
+                .expect("metadata should be readable")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o600
+        );
+    }
+
     let contains = bin()
         .current_dir(&cwd)
         .env("RUNSEAL_HOME", temp.path().join("home"))
@@ -116,3 +171,71 @@ fn fs_runs_without_profile() {
     let backup_path = PathBuf::from(String::from_utf8(backup.stdout).unwrap().trim());
     assert!(backup_path.is_file());
 }
+
+#[test]
+fn fs_mode_touch_list() {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let cwd = temp.path().join("empty");
+    std::fs::create_dir_all(&cwd).expect("empty cwd should be created");
+    let dir = cwd.join("kube");
+    let first = dir.join("b.yaml");
+    let second = dir.join("a.yaml");
+    let ignored = dir.join("notes.txt");
+
+    let touch = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args(["@tool", "fs", "touch", first.to_str().unwrap(), "600"])
+        .output()
+        .expect("runseal should run");
+    assert!(touch.status.success());
+    std::fs::write(&first, "existing").expect("file should be writable");
+
+    let touch_again = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args(["@tool", "fs", "touch", first.to_str().unwrap(), "600"])
+        .output()
+        .expect("runseal should run");
+    assert!(touch_again.status.success());
+    assert_eq!(
+        std::fs::read_to_string(&first).expect("file should be readable"),
+        "existing"
+    );
+
+    std::fs::write(&second, "").expect("file should be written");
+    std::fs::write(&ignored, "").expect("file should be written");
+
+    let mode = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args(["@tool", "fs", "mode", first.to_str().unwrap()])
+        .output()
+        .expect("runseal should run");
+    assert!(mode.status.success());
+    #[cfg(unix)]
+    assert_eq!(String::from_utf8(mode.stdout).unwrap(), "600\n");
+
+    let list = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args([
+            "@tool",
+            "fs",
+            "list",
+            dir.to_str().unwrap(),
+            "--glob",
+            "*.yaml",
+            "--files",
+            "--require-nonempty",
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(list.status.success());
+    let paths: Vec<String> =
+        serde_json::from_slice(&list.stdout).expect("stdout should be JSON array");
+    assert_eq!(paths.len(), 2);
+    assert!(PathBuf::from(&paths[0]).is_absolute());
+    assert!(paths[0].ends_with("a.yaml"));
+    assert!(paths[1].ends_with("b.yaml"));
+}
diff --git a/app/tests/internal_tool/archive.rs b/app/tests/internal_tool/archive.rs
new file mode 100644
index 0000000..961429e
--- /dev/null
+++ b/app/tests/internal_tool/archive.rs
@@ -0,0 +1,121 @@
+use std::process::Command;
+
+use tempfile::TempDir;
+
+fn bin() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_runseal"))
+}
+
+#[test]
+fn archive_roundtrip() {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let cwd = temp.path().join("empty");
+    std::fs::create_dir_all(&cwd).expect("empty cwd should be created");
+    let local = cwd.join(".local");
+    let ssh = local.join("ssh");
+    let kube = local.join("kube");
+    std::fs::create_dir_all(&ssh).expect("ssh dir should exist");
+    std::fs::create_dir_all(&kube).expect("kube dir should exist");
+    std::fs::write(ssh.join("config"), "Host test\n").expect("ssh config should be written");
+    std::fs::write(kube.join("test.yaml"), "kube").expect("kube config should be written");
+    let archive = cwd.join("local.enc");
+
+    let export = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .env("RUNSEAL_TEST_PASSWORD", "secret")
+        .args([
+            "@tool",
+            "archive",
+            "local",
+            "export",
+            "--source",
+            local.to_str().unwrap(),
+            "--archive",
+            archive.to_str().unwrap(),
+            "--password-env",
+            "RUNSEAL_TEST_PASSWORD",
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(
+        export.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&export.stderr)
+    );
+    assert!(archive.is_file());
+
+    let overwrite = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .env("RUNSEAL_TEST_PASSWORD", "secret")
+        .args([
+            "@tool",
+            "archive",
+            "local",
+            "export",
+            "--source",
+            local.to_str().unwrap(),
+            "--archive",
+            archive.to_str().unwrap(),
+            "--password-env",
+            "RUNSEAL_TEST_PASSWORD",
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(!overwrite.status.success());
+
+    std::fs::remove_dir_all(&local).expect("local dir should be removable");
+    let import = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .env("RUNSEAL_TEST_PASSWORD", "secret")
+        .args([
+            "@tool",
+            "archive",
+            "local",
+            "import",
+            "--source",
+            local.to_str().unwrap(),
+            "--archive",
+            archive.to_str().unwrap(),
+            "--password-env",
+            "RUNSEAL_TEST_PASSWORD",
+            "--force",
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(
+        import.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&import.stderr)
+    );
+    assert_eq!(
+        std::fs::read_to_string(ssh.join("config")).expect("ssh config should be restored"),
+        "Host test\n"
+    );
+    assert_eq!(
+        std::fs::read_to_string(kube.join("test.yaml")).expect("kube config should be restored"),
+        "kube"
+    );
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        assert_eq!(
+            std::fs::metadata(&local)
+                .expect("local metadata should exist")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o700
+        );
+        assert_eq!(
+            std::fs::metadata(ssh.join("config"))
+                .expect("ssh config metadata should exist")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o600
+        );
+    }
+}
diff --git a/app/tests/internal_tool/gitee.rs b/app/tests/internal_tool/gitee.rs
new file mode 100644
index 0000000..c934631
--- /dev/null
+++ b/app/tests/internal_tool/gitee.rs
@@ -0,0 +1,150 @@
+use std::{
+    io::{Read, Write},
+    net::TcpListener,
+    process::Command,
+    thread,
+};
+
+use tempfile::TempDir;
+
+fn bin() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_runseal"))
+}
+
+#[test]
+fn gitee_pr() {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let cwd = temp.path().join("empty");
+    std::fs::create_dir_all(&cwd).expect("empty cwd should be created");
+    let token_file = cwd.join("gitee.env");
+    std::fs::write(&token_file, "GITEE_TOKEN=file-token\n").expect("token file should be written");
+
+    let (api_base, handle) = mock_gitee(
+        |request| {
+            assert!(request.starts_with("POST /repos/perishme/perish.top/pulls "));
+            assert!(request.contains("authorization: token file-token"));
+            assert!(request.contains(r#""title":"Land change""#));
+            assert!(request.contains(r#""access_token":"file-token""#));
+        },
+        r#"{"number":42,"html_url":"https://gitee.test/pr/42"}"#,
+    );
+    let create = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .env("RUNSEAL_GITEE_API_BASE", api_base)
+        .args([
+            "@tool",
+            "gitee",
+            "pr",
+            "create",
+            "--owner",
+            "perishme",
+            "--repo",
+            "perish.top",
+            "--token-file",
+            token_file.to_str().unwrap(),
+            "--base",
+            "main",
+            "--head",
+            "feat/seal",
+            "--title",
+            "Land change",
+            "--body",
+            "Body",
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(create.status.success());
+    handle.join().expect("mock server should finish");
+    let payload: serde_json::Value =
+        serde_json::from_slice(&create.stdout).expect("stdout should be JSON");
+    assert_eq!(payload["number"], 42);
+
+    let (api_base, handle) = mock_gitee(
+        |request| {
+            assert!(request.starts_with("PUT /repos/perishme/perish.top/pulls/42/merge "));
+            assert!(request.contains("authorization: token env-token"));
+            assert!(request.contains(r#""merge_method":"squash""#));
+            assert!(request.contains(r#""access_token":"env-token""#));
+        },
+        r#"{"merged":true}"#,
+    );
+    let merge = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .env("RUNSEAL_GITEE_API_BASE", api_base)
+        .env("GITEE_TOKEN", "env-token")
+        .args([
+            "@tool",
+            "gitee",
+            "pr",
+            "merge",
+            "--owner",
+            "perishme",
+            "--repo",
+            "perish.top",
+            "--number",
+            "42",
+            "--method",
+            "squash",
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(merge.status.success());
+    handle.join().expect("mock server should finish");
+    let payload: serde_json::Value =
+        serde_json::from_slice(&merge.stdout).expect("stdout should be JSON");
+    assert_eq!(payload["merged"], true);
+}
+
+#[test]
+fn gitee_origin() {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let cwd = temp.path().join("empty");
+    std::fs::create_dir_all(&cwd).expect("empty cwd should be created");
+
+    for url in [
+        "git@gitee.com:perishme/perish.top.git",
+        "https://gitee.com/perishme/perish.top.git",
+        "ssh://git@gitee.com/perishme/perish.top",
+    ] {
+        let output = bin()
+            .current_dir(&cwd)
+            .env("RUNSEAL_HOME", temp.path().join("home"))
+            .args(["@tool", "gitee", "repo", "parse-origin", url])
+            .output()
+            .expect("runseal should run");
+        assert!(output.status.success());
+        let payload: serde_json::Value =
+            serde_json::from_slice(&output.stdout).expect("stdout should be JSON");
+        assert_eq!(payload["owner"], "perishme");
+        assert_eq!(payload["repo"], "perish.top");
+    }
+}
+
+fn mock_gitee<F>(assert_request: F, body: &'static str) -> (String, thread::JoinHandle<()>)
+where
+    F: FnOnce(&str) + Send + 'static,
+{
+    let server = TcpListener::bind("127.0.0.1:0").expect("mock server should bind");
+    let address = server
+        .local_addr()
+        .expect("mock server address should exist");
+    let handle = thread::spawn(move || {
+        let (mut stream, _) = server.accept().expect("mock request should arrive");
+        let mut request = [0_u8; 4096];
+        let read = stream
+            .read(&mut request)
+            .expect("request should be readable");
+        let request = String::from_utf8_lossy(&request[..read]);
+        assert_request(&request);
+        write!(
+            stream,
+            "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        )
+        .expect("response should be written");
+    });
+    (format!("http://{address}"), handle)
+}
diff --git a/app/tests/internal_tool/ssh.rs b/app/tests/internal_tool/ssh.rs
new file mode 100644
index 0000000..b187ac4
--- /dev/null
+++ b/app/tests/internal_tool/ssh.rs
@@ -0,0 +1,241 @@
+use std::{path::PathBuf, process::Command};
+
+use tempfile::TempDir;
+
+fn bin() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_runseal"))
+}
+
+#[test]
+fn ssh_config() {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let cwd = temp.path().join("empty");
+    let base = cwd.join("ssh");
+    std::fs::create_dir_all(&base).expect("ssh dir should be created");
+    let config = base.join("config");
+    std::fs::write(
+        &config,
+        r#"
+Host 10m.hk.zxi *.lisa !blocked.lisa
+  IdentityFile id_root
+  IdentityFile ~/.ssh/id_extra
+"#,
+    )
+    .expect("config should be written");
+
+    let exact = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args([
+            "@tool",
+            "ssh",
+            "config",
+            "host",
+            "10m.hk.zxi",
+            "--config",
+            config.to_str().unwrap(),
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(exact.status.success());
+    assert_eq!(String::from_utf8(exact.stdout).unwrap(), "true\n");
+
+    let wildcard = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args([
+            "@tool",
+            "ssh",
+            "config",
+            "host",
+            "ny.lisa",
+            "--config",
+            config.to_str().unwrap(),
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(wildcard.status.success());
+    assert_eq!(String::from_utf8(wildcard.stdout).unwrap(), "true\n");
+
+    let blocked = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args([
+            "@tool",
+            "ssh",
+            "config",
+            "host",
+            "blocked.lisa",
+            "--config",
+            config.to_str().unwrap(),
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(blocked.status.success());
+    assert_eq!(String::from_utf8(blocked.stdout).unwrap(), "false\n");
+
+    let identities = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args([
+            "@tool",
+            "ssh",
+            "config",
+            "identities",
+            "--config",
+            config.to_str().unwrap(),
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(identities.status.success());
+    let files: Vec<String> =
+        serde_json::from_slice(&identities.stdout).expect("stdout should be JSON array");
+    assert_eq!(files.len(), 2);
+    assert_eq!(PathBuf::from(&files[0]), base.join("id_root"));
+    assert!(files[1].ends_with(".ssh/id_extra"));
+
+    let override_base = cwd.join("repo");
+    let identities = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args([
+            "@tool",
+            "ssh",
+            "config",
+            "identities",
+            "--config",
+            config.to_str().unwrap(),
+            "--base",
+            override_base.to_str().unwrap(),
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(identities.status.success());
+    let files: Vec<String> =
+        serde_json::from_slice(&identities.stdout).expect("stdout should be JSON array");
+    assert_eq!(PathBuf::from(&files[0]), override_base.join("id_root"));
+}
+
+#[test]
+#[cfg(unix)]
+fn ssh_script() {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let cwd = temp.path().join("empty");
+    let bin_dir = temp.path().join("bin");
+    let ssh_dir = cwd.join("ssh");
+    std::fs::create_dir_all(&bin_dir).expect("bin dir should be created");
+    std::fs::create_dir_all(&ssh_dir).expect("ssh dir should be created");
+    let log = cwd.join("ssh.log");
+    let stdin_file = cwd.join("stdin.txt");
+    write_ssh_tool_stub(&bin_dir.join("ssh"), &log, &stdin_file);
+
+    let config = ssh_dir.join("config");
+    std::fs::write(&config, "Host demo.host\n  HostName 127.0.0.1\n")
+        .expect("config should be written");
+    let script = cwd.join("probe.sh");
+    std::fs::write(&script, "echo from-script\n").expect("script should be written");
+
+    let run = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .env("PATH", prepend_path_for_test(&bin_dir))
+        .args([
+            "@tool",
+            "ssh",
+            "script",
+            "run",
+            "--config",
+            config.to_str().unwrap(),
+            "--host",
+            "demo.host",
+            "--file",
+            script.to_str().unwrap(),
+            "--",
+            "one",
+            "two",
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(
+        run.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&run.stderr)
+    );
+    assert_eq!(
+        std::fs::read_to_string(&log).expect("log should be readable"),
+        format!("ssh|-F|{}|demo.host|bash|-s|--|one|two\n", config.display())
+    );
+    assert_eq!(
+        std::fs::read_to_string(&stdin_file).expect("stdin should be readable"),
+        "echo from-script\n"
+    );
+
+    let capture = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .env("PATH", prepend_path_for_test(&bin_dir))
+        .args([
+            "@tool",
+            "ssh",
+            "script",
+            "capture",
+            "--config",
+            config.to_str().unwrap(),
+            "--host",
+            "demo.host",
+            "--file",
+            script.to_str().unwrap(),
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(
+        capture.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&capture.stderr)
+    );
+    assert_eq!(String::from_utf8(capture.stdout).unwrap(), "captured\n\n");
+}
+
+#[cfg(unix)]
+fn write_ssh_tool_stub(
+    path: &std::path::Path,
+    log: &std::path::Path,
+    stdin_file: &std::path::Path,
+) {
+    use std::os::unix::fs::PermissionsExt;
+
+    std::fs::write(
+        path,
+        format!(
+            r#"#!/usr/bin/env sh
+set -eu
+printf 'ssh' > '{}'
+for arg in "$@"; do
+  printf '|%s' "$arg" >> '{}'
+done
+printf '\n' >> '{}'
+cat > '{}'
+printf 'captured\n'
+"#,
+            log.display(),
+            log.display(),
+            log.display(),
+            stdin_file.display()
+        ),
+    )
+    .expect("ssh stub should be written");
+    let mut permissions = std::fs::metadata(path)
+        .expect("ssh stub metadata should be readable")
+        .permissions();
+    permissions.set_mode(0o755);
+    std::fs::set_permissions(path, permissions).expect("ssh stub should be executable");
+}
+
+#[cfg(unix)]
+fn prepend_path_for_test(first: &std::path::Path) -> std::ffi::OsString {
+    let mut paths = vec![first.to_path_buf()];
+    if let Some(existing) = std::env::var_os("PATH") {
+        paths.extend(std::env::split_paths(&existing));
+    }
+    std::env::join_paths(paths).expect("PATH should be joinable")
+}
diff --git a/app/tests/internal_tool/string.rs b/app/tests/internal_tool/string.rs
new file mode 100644
index 0000000..d415e20
--- /dev/null
+++ b/app/tests/internal_tool/string.rs
@@ -0,0 +1,76 @@
+use std::process::Command;
+
+use tempfile::TempDir;
+
+fn bin() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_runseal"))
+}
+
+#[test]
+fn string_join() {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let cwd = temp.path().join("empty");
+    std::fs::create_dir_all(&cwd).expect("empty cwd should be created");
+
+    let literal = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args([
+            "@tool",
+            "string",
+            "join",
+            r#"["left","right"]"#,
+            "--separator",
+            ",",
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(literal.status.success());
+    assert_eq!(String::from_utf8(literal.stdout).unwrap(), "left,right\n");
+
+    let path = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args([
+            "@tool",
+            "string",
+            "join",
+            r#"["left","right"]"#,
+            "--separator",
+            "path",
+        ])
+        .output()
+        .expect("runseal should run");
+    assert!(path.status.success());
+    let expected = std::env::join_paths(["left", "right"])
+        .expect("paths should join")
+        .to_string_lossy()
+        .into_owned()
+        + "\n";
+    assert_eq!(String::from_utf8(path.stdout).unwrap(), expected);
+}
+
+#[test]
+fn string_slug() {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let cwd = temp.path().join("empty");
+    std::fs::create_dir_all(&cwd).expect("empty cwd should be created");
+
+    let limited = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args(["@tool", "string", "slug", "One Two Three", "--max-len", "7"])
+        .output()
+        .expect("runseal should run");
+    assert!(limited.status.success());
+    assert_eq!(String::from_utf8(limited.stdout).unwrap(), "one-two\n");
+
+    let fallback = bin()
+        .current_dir(&cwd)
+        .env("RUNSEAL_HOME", temp.path().join("home"))
+        .args(["@tool", "string", "slug", "!!!", "--fallback", "change"])
+        .output()
+        .expect("runseal should run");
+    assert!(fallback.status.success());
+    assert_eq!(String::from_utf8(fallback.stdout).unwrap(), "change\n");
+}
diff --git a/app/tests/internal_wrappers.rs b/app/tests/internal_wrappers.rs
index 2d47aa1..d23c274 100644
--- a/app/tests/internal_wrappers.rs
+++ b/app/tests/internal_wrappers.rs
@@ -220,6 +220,23 @@ fn seal_wrapper_shadows() {
     assert_eq!(stdout, "seal\n");
 }
 
+#[test]
+fn seal_env_overlay() {
+    let fx = fixture();
+    make_seal_wrapper(
+        &fx.project_wrappers.join("env-tool.seal"),
+        r#"
+RUNSEAL_MARKER=sealed sh -c 'printf %s "$RUNSEAL_MARKER"'
+"#,
+    );
+
+    let output = run_in(&fx, &[":env-tool"]);
+
+    assert!(output.status.success());
+    let stdout = String::from_utf8(output.stdout).expect("stdout should be UTF-8");
+    assert_eq!(stdout, "sealed");
+}
+
 #[test]
 fn wrappers_hide_shadow() {
     let fx = fixture();
diff --git a/app/tests/operator.rs b/app/tests/operator.rs
index bca7afa..4cef94b 100644
--- a/app/tests/operator.rs
+++ b/app/tests/operator.rs
@@ -1,5 +1,7 @@
 #[path = "operator/cloudflare.rs"]
 mod cloudflare;
+#[path = "operator/estate.rs"]
+mod estate;
 #[path = "operator/init.rs"]
 mod init;
 #[path = "operator/repo.rs"]
diff --git a/app/tests/operator/estate.rs b/app/tests/operator/estate.rs
new file mode 100644
index 0000000..e34785b
--- /dev/null
+++ b/app/tests/operator/estate.rs
@@ -0,0 +1,468 @@
+#![cfg(unix)]
+
+#[path = "estate/pr.rs"]
+mod pr;
+
+use std::{
+    ffi::OsString,
+    path::{Path, PathBuf},
+    process::Command,
+};
+
+use tempfile::TempDir;
+
+struct Fixture {
+    _temp: TempDir,
+    project: PathBuf,
+    bin: PathBuf,
+    log: PathBuf,
+}
+
+fn fixture() -> Fixture {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let project = temp.path().join("project");
+    let bin = temp.path().join("bin");
+    let log = temp.path().join("commands.log");
+    std::fs::create_dir_all(project.join(".runseal/wrappers"))
+        .expect("wrapper dir should be created");
+    std::fs::create_dir_all(&bin).expect("bin dir should be created");
+    write_profile(&project);
+    write_wrappers(&project);
+    write_git_stub(&bin.join("git"));
+    write_ssh_stub(&bin.join("ssh"));
+    write_kubectl_stub(&bin.join("kubectl"));
+    Fixture {
+        _temp: temp,
+        project,
+        bin,
+        log,
+    }
+}
+
+fn write_profile(project: &Path) {
+    std::fs::write(
+        project.join("runseal.toml"),
+        r#"
+[resources]
+root = ".local"
+
+[[injections]]
+type = "env"
+
+[injections.vars]
+PERISH_TOP_LOCAL_DIR = "resource://"
+PERISH_TOP_SSH_DIR = "resource://ssh"
+PERISH_TOP_SSH_CONFIG = "resource://ssh/config"
+PERISH_TOP_KUBE_DIR = "resource://kube"
+PERISH_TOP_SECRETS_DIR = "resource://secrets"
+PERISH_TOP_TMP_DIR = "resource://tmp"
+"#,
+    )
+    .expect("profile should be written");
+}
+
+fn write_wrappers(project: &Path) {
+    let wrappers = project.join(".runseal/wrappers");
+    std::fs::write(
+        wrappers.join("admin.seal"),
+        ADMIN_SEAL.replace("__SSH_CONFIG_BASE64__", SSH_CONFIG_BASE64),
+    )
+    .expect("admin seal should be written");
+    std::fs::write(wrappers.join("ssh.seal"), SSH_SEAL).expect("ssh seal should be written");
+    std::fs::write(wrappers.join("ssh-run.seal"), SSH_RUN_SEAL)
+        .expect("ssh-run seal should be written");
+    std::fs::write(wrappers.join("kube.seal"), KUBE_SEAL).expect("kube seal should be written");
+    std::fs::write(wrappers.join("pr.seal"), PR_SEAL).expect("pr seal should be written");
+}
+
+fn write_git_stub(path: &Path) {
+    write_executable(
+        path,
+        r#"#!/usr/bin/env sh
+set -eu
+case "$1" in
+  checkout)
+    if [ "${RUNSEAL_TEST_CHECKOUT_FAIL:-}" = "${2:-}" ]; then
+      printf 'git' >> "$RUNSEAL_TEST_LOG"
+      for arg in "$@"; do
+        printf '|%s' "$arg" >> "$RUNSEAL_TEST_LOG"
+      done
+      printf '\n' >> "$RUNSEAL_TEST_LOG"
+      exit 1
+    fi
+    ;;
+  branch)
+    if [ "${2:-}" = "--show-current" ]; then
+      printf '%s\n' "${RUNSEAL_TEST_BRANCH:-main}"
+      exit 0
+    fi
+    ;;
+  remote)
+    if [ "${2:-}" = "get-url" ] && [ "${3:-}" = "origin" ]; then
+      printf 'git@gitee.com:perishme/perish.top.git\n'
+      exit 0
+    fi
+    ;;
+  status)
+    if [ "${2:-}" = "--short" ]; then
+      printf '%s\n' "${RUNSEAL_TEST_STATUS- M docs.md}"
+      exit 0
+    fi
+    ;;
+esac
+printf 'git' >> "$RUNSEAL_TEST_LOG"
+for arg in "$@"; do
+  printf '|%s' "$arg" >> "$RUNSEAL_TEST_LOG"
+done
+printf '\n' >> "$RUNSEAL_TEST_LOG"
+"#,
+    );
+}
+
+fn write_ssh_stub(path: &Path) {
+    write_executable(
+        path,
+        r#"#!/usr/bin/env sh
+set -eu
+printf 'ssh' >> "$RUNSEAL_TEST_LOG"
+for arg in "$@"; do
+  printf '|%s' "$arg" >> "$RUNSEAL_TEST_LOG"
+done
+printf '\n' >> "$RUNSEAL_TEST_LOG"
+cat >/dev/null
+printf 'captured-kube'
+"#,
+    );
+}
+
+fn write_kubectl_stub(path: &Path) {
+    write_executable(
+        path,
+        r#"#!/usr/bin/env sh
+set -eu
+printf 'kubectl|KUBECONFIG=%s' "${KUBECONFIG:-}" >> "$RUNSEAL_TEST_LOG"
+for arg in "$@"; do
+  printf '|%s' "$arg" >> "$RUNSEAL_TEST_LOG"
+done
+printf '\n' >> "$RUNSEAL_TEST_LOG"
+"#,
+    );
+}
+
+fn write_executable(path: &Path, content: &str) {
+    use std::os::unix::fs::PermissionsExt;
+
+    std::fs::write(path, content).expect("stub should be written");
+    let mut permissions = std::fs::metadata(path)
+        .expect("stub metadata should be readable")
+        .permissions();
+    permissions.set_mode(0o755);
+    std::fs::set_permissions(path, permissions).expect("stub should be executable");
+}
+
+fn run_wrapper(fx: &Fixture, name: &str, args: &[&str]) -> std::process::Output {
+    run_wrapper_env(fx, name, args, &[])
+}
+
+fn run_wrapper_env(
+    fx: &Fixture,
+    name: &str,
+    args: &[&str],
+    envs: &[(&str, String)],
+) -> std::process::Output {
+    let mut command = Command::new(env!("CARGO_BIN_EXE_runseal"));
+    command
+        .current_dir(&fx.project)
+        .env("PATH", prepend_path(&fx.bin))
+        .env("RUNSEAL_TEST_LOG", &fx.log)
+        .arg("-p")
+        .arg(fx.project.join("runseal.toml"))
+        .arg(format!(":{name}"))
+        .args(args);
+    for (key, value) in envs {
+        command.env(key, value);
+    }
+    command.output().expect("runseal wrapper should run")
+}
+
+fn prepend_path(first: &Path) -> OsString {
+    let mut paths = vec![first.to_path_buf()];
+    if let Some(runseal_dir) = Path::new(env!("CARGO_BIN_EXE_runseal")).parent() {
+        paths.push(runseal_dir.to_path_buf());
+    }
+    if let Some(existing) = std::env::var_os("PATH") {
+        paths.extend(std::env::split_paths(&existing));
+    }
+    std::env::join_paths(paths).expect("PATH should be joinable")
+}
+
+fn log(fx: &Fixture) -> String {
+    std::fs::read_to_string(&fx.log).unwrap_or_default()
+}
+
+#[test]
+fn admin_init_check() {
+    let fx = fixture();
+
+    let init = run_wrapper(&fx, "admin", &["init"]);
+    assert!(
+        init.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&init.stderr)
+    );
+
+    for path in [".local/ssh", ".local/kube", ".local/secrets", ".local/tmp"] {
+        assert!(fx.project.join(path).is_dir(), "{path} should exist");
+    }
+    assert!(fx.project.join(".local/ssh/config").is_file());
+    assert!(fx.project.join(".local/ssh/id_perish_top_root").is_file());
+    assert!(fx.project.join(".local/ssh/known_hosts").is_file());
+
+    std::fs::write(fx.project.join(".local/ssh/id_perish_top_root"), "key")
+        .expect("root key should be filled");
+    let kubeconfig = fx.project.join(".local/kube/hk-zxi.yaml");
+    std::fs::write(&kubeconfig, "kube").expect("kubeconfig should be written");
+    set_mode(&kubeconfig, 0o600);
+
+    let check = run_wrapper(&fx, "admin", &["check"]);
+    assert!(
+        check.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&check.stdout),
+        String::from_utf8_lossy(&check.stderr)
+    );
+    assert!(String::from_utf8_lossy(&check.stdout).contains("admin check: ok"));
+}
+
+#[test]
+fn ssh_remote_args() {
+    let fx = fixture();
+    let init = run_wrapper(&fx, "admin", &["init"]);
+    assert!(init.status.success());
+
+    let ok = run_wrapper(&fx, "ssh", &["10m.hk.zxi", "--", "uptime", "-p"]);
+    assert!(
+        ok.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&ok.stderr)
+    );
+    assert_eq!(
+        log(&fx),
+        format!(
+            "ssh|-F|{}|10m.hk.zxi|uptime|-p\n",
+            fx.project.join(".local/ssh/config").display()
+        )
+    );
+
+    let denied = run_wrapper(&fx, "ssh", &["unknown.example"]);
+    assert!(!denied.status.success());
+    assert!(String::from_utf8_lossy(&denied.stderr).contains("host is not declared"));
+}
+
+#[test]
+fn ssh_run_mode() {
+    let fx = fixture();
+    let init = run_wrapper(&fx, "admin", &["init"]);
+    assert!(init.status.success());
+    let script = fx.project.join("probe.sh");
+    std::fs::write(&script, "echo probe").expect("script should be written");
+
+    let output = run_wrapper(
+        &fx,
+        "ssh",
+        &[
+            "10m.hk.zxi",
+            "--run",
+            script.to_str().unwrap(),
+            "--",
+            "one",
+            "two",
+        ],
+    );
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert_eq!(
+        log(&fx),
+        format!(
+            "ssh|-F|{}|10m.hk.zxi|bash|-s|--|one|two\n",
+            fx.project.join(".local/ssh/config").display()
+        )
+    );
+}
+
+#[test]
+fn ssh_run_forward() {
+    let fx = fixture();
+    let init = run_wrapper(&fx, "admin", &["init"]);
+    assert!(init.status.success());
+    let script = fx.project.join("probe.sh");
+    std::fs::write(&script, "echo probe").expect("script should be written");
+
+    let output = run_wrapper(
+        &fx,
+        "ssh-run",
+        &["10m.hk.zxi", script.to_str().unwrap(), "--", "one"],
+    );
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let log = log(&fx);
+    assert!(log.contains("ssh|-F|"));
+    assert!(log.ends_with("|10m.hk.zxi|bash|-s|--|one\n"));
+}
+
+#[test]
+fn admin_bootstrap_kube() {
+    let fx = fixture();
+    let init = run_wrapper(&fx, "admin", &["init"]);
+    assert!(init.status.success());
+    let ops_admin = fx.project.join("infra/k8s/access/ops-admin.yaml");
+    let setup = fx
+        .project
+        .join("nodes/10m-hk-zxi/k3s/bootstrap/35-emit-kubeconfig.sh");
+    std::fs::create_dir_all(ops_admin.parent().expect("ops parent should exist"))
+        .expect("ops parent should be created");
+    std::fs::create_dir_all(setup.parent().expect("setup parent should exist"))
+        .expect("setup parent should be created");
+    std::fs::write(&ops_admin, "ops").expect("ops file should be written");
+    std::fs::write(&setup, "setup").expect("setup file should be written");
+
+    let output = run_wrapper(&fx, "admin", &["bootstrap-kube"]);
+    assert!(
+        output.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let kubeconfig = fx.project.join(".local/kube/hk-zxi.yaml");
+    assert_eq!(
+        std::fs::read_to_string(&kubeconfig).expect("kubeconfig should be readable"),
+        "captured-kube"
+    );
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        assert_eq!(
+            std::fs::metadata(&kubeconfig)
+                .expect("metadata should be readable")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o600
+        );
+    }
+    assert_eq!(
+        log(&fx),
+        format!(
+            "ssh|-F|{}|10m.hk.zxi|bash|-s|--\nssh|-F|{}|10m.hk.zxi|bash|-s|--|https://k8s.perish.top:6443|hk-zxi\n",
+            fx.project.join(".local/ssh/config").display(),
+            fx.project.join(".local/ssh/config").display()
+        )
+    );
+}
+
+#[test]
+fn admin_archive() {
+    let fx = fixture();
+    let init = run_wrapper(&fx, "admin", &["init"]);
+    assert!(init.status.success());
+    std::fs::write(
+        fx.project.join(".local/secrets/gitee.env"),
+        "GITEE_TOKEN=test-token\n",
+    )
+    .expect("secret should be written");
+    let archive = fx.project.join("local.enc");
+
+    let export = run_wrapper_env(
+        &fx,
+        "admin",
+        &["export", archive.to_str().unwrap()],
+        &[("PERISH_TOP_LOCAL_PASSWORD", "secret".to_string())],
+    );
+    assert!(
+        export.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&export.stdout),
+        String::from_utf8_lossy(&export.stderr)
+    );
+    assert!(archive.is_file());
+
+    std::fs::remove_dir_all(fx.project.join(".local")).expect(".local should be removable");
+    let import = run_wrapper_env(
+        &fx,
+        "admin",
+        &["import", "--force", archive.to_str().unwrap()],
+        &[("PERISH_TOP_LOCAL_PASSWORD", "secret".to_string())],
+    );
+    assert!(
+        import.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&import.stdout),
+        String::from_utf8_lossy(&import.stderr)
+    );
+    assert_eq!(
+        std::fs::read_to_string(fx.project.join(".local/secrets/gitee.env"))
+            .expect("secret should be restored"),
+        "GITEE_TOKEN=test-token\n"
+    );
+    assert!(String::from_utf8_lossy(&export.stdout).contains("admin export: wrote"));
+    assert!(String::from_utf8_lossy(&import.stdout).contains("admin import: restored .local"));
+}
+
+#[test]
+fn kube_env() {
+    let fx = fixture();
+    std::fs::create_dir_all(fx.project.join(".local/kube")).expect("kube dir should be created");
+    std::fs::write(fx.project.join(".local/kube/b.yaml"), "b").expect("kubeconfig should exist");
+    std::fs::write(fx.project.join(".local/kube/a.yaml"), "a").expect("kubeconfig should exist");
+
+    let output = run_wrapper(&fx, "kube", &["auth", "whoami"]);
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert_eq!(
+        log(&fx),
+        format!(
+            "kubectl|KUBECONFIG={}:{}|auth|whoami\n",
+            fx.project
+                .join(".local/kube/a.yaml")
+                .canonicalize()
+                .expect("a path should canonicalize")
+                .display(),
+            fx.project
+                .join(".local/kube/b.yaml")
+                .canonicalize()
+                .expect("b path should canonicalize")
+                .display()
+        )
+    );
+}
+
+fn set_mode(path: &Path, mode: u32) {
+    use std::os::unix::fs::PermissionsExt;
+
+    let mut permissions = std::fs::metadata(path)
+        .expect("metadata should be readable")
+        .permissions();
+    permissions.set_mode(mode);
+    std::fs::set_permissions(path, permissions).expect("mode should be set");
+}
+
+const SSH_CONFIG_BASE64: &str = "SG9zdCAxMG0uaGsuenhpCiAgSG9zdE5hbWUgNDMuMjUxLjIyNS4xMTMKICBVc2VyIHJvb3QKICBJZGVudGl0eUZpbGUgaWRfcGVyaXNoX3RvcF9yb290CgpIb3N0IDVtLmhrLnp4aQogIEhvc3ROYW1lIDQzLjI1MS4yMjUuODUKICBVc2VyIHJvb3QKICBJZGVudGl0eUZpbGUgaWRfcGVyaXNoX3RvcF9yb290CgpIb3N0IGxhLnVzLmxpc2EKICBIb3N0TmFtZSAxNTQuMjkuMTU4LjEzNAogIFBvcnQgMjc2OTEKICBVc2VyIHJvb3QKICBJZGVudGl0eUZpbGUgaWRfcGVyaXNoX3RvcF9yb290CgpIb3N0IG55LnVzLmxpc2EKICBIb3N0TmFtZSAzOC43Ny4xMzMuMTExCiAgUG9ydCAyMTM2OQogIFVzZXIgcm9vdAogIElkZW50aXR5RmlsZSBpZF9wZXJpc2hfdG9wX3Jvb3QK";
+
+const ADMIN_SEAL: &str = include_str!("../fixtures/estate/admin.seal");
+
+const SSH_SEAL: &str = include_str!("../fixtures/estate/ssh.seal");
+
+const SSH_RUN_SEAL: &str = include_str!("../fixtures/estate/ssh-run.seal");
+
+const KUBE_SEAL: &str = include_str!("../fixtures/estate/kube.seal");
+
+const PR_SEAL: &str = include_str!("../fixtures/estate/pr.seal");
diff --git a/app/tests/operator/estate/pr.rs b/app/tests/operator/estate/pr.rs
new file mode 100644
index 0000000..1a68418
--- /dev/null
+++ b/app/tests/operator/estate/pr.rs
@@ -0,0 +1,269 @@
+use std::{
+    io::{Read, Write},
+    net::TcpListener,
+    thread,
+};
+
+use super::{fixture, log, run_wrapper, run_wrapper_env};
+
+#[test]
+fn api_flow() {
+    let fx = fixture();
+    let secrets = fx.project.join(".local/secrets");
+    std::fs::create_dir_all(&secrets).expect("secrets dir should exist");
+    std::fs::write(secrets.join("gitee.env"), "GITEE_TOKEN=test-token\n")
+        .expect("token file should be written");
+    let (api_base, handle) = mock_gitee_sequence("feat/seal", true);
+
+    let output = run_wrapper_env(
+        &fx,
+        "pr",
+        &["--branch", "feat/seal", "--body", "Body", "Land change"],
+        &[("RUNSEAL_GITEE_API_BASE", api_base)],
+    );
+
+    assert!(
+        output.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    handle.join().expect("mock server should finish");
+    assert!(String::from_utf8_lossy(&output.stdout).contains("https://gitee.test/pr/42"));
+    assert_eq!(
+        log(&fx),
+        "git|checkout|-b|feat/seal\ngit|add|-A\ngit|commit|-m|Land change\ngit|push|-u|origin|feat/seal\ngit|checkout|main\ngit|pull|--ff-only|origin|main\ngit|push|origin|--delete|feat/seal\ngit|branch|-D|feat/seal\n"
+    );
+}
+
+#[test]
+fn default_branch() {
+    let fx = fixture();
+    let secrets = fx.project.join(".local/secrets");
+    std::fs::create_dir_all(&secrets).expect("secrets dir should exist");
+    std::fs::write(secrets.join("gitee.env"), "GITEE_TOKEN=test-token\n")
+        .expect("token file should be written");
+    let (api_base, handle) = mock_gitee_sequence("auto/land-change", true);
+
+    let output = run_wrapper_env(
+        &fx,
+        "pr",
+        &["Land Change"],
+        &[("RUNSEAL_GITEE_API_BASE", api_base)],
+    );
+
+    assert!(
+        output.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    handle.join().expect("mock server should finish");
+    assert_eq!(
+        log(&fx),
+        "git|checkout|-b|auto/land-change\ngit|add|-A\ngit|commit|-m|Land Change\ngit|push|-u|origin|auto/land-change\ngit|checkout|main\ngit|pull|--ff-only|origin|main\ngit|push|origin|--delete|auto/land-change\ngit|branch|-D|auto/land-change\n"
+    );
+}
+
+#[test]
+fn dry_run() {
+    let fx = fixture();
+
+    let output = run_wrapper(
+        &fx,
+        "pr",
+        &["--branch", "feat/seal", "--dry-run", "Land change"],
+    );
+
+    assert!(
+        output.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("branch: feat/seal"));
+    assert!(stdout.contains("owner: perishme"));
+    assert!(stdout.contains("repo: perish.top"));
+    assert_eq!(log(&fx), "");
+}
+
+#[test]
+fn no_merge() {
+    let fx = fixture();
+    let secrets = fx.project.join(".local/secrets");
+    std::fs::create_dir_all(&secrets).expect("secrets dir should exist");
+    std::fs::write(secrets.join("gitee.env"), "GITEE_TOKEN=test-token\n")
+        .expect("token file should be written");
+    let (api_base, handle) = mock_gitee_sequence("feat/no-merge", false);
+
+    let output = run_wrapper_env(
+        &fx,
+        "pr",
+        &["--branch", "feat/no-merge", "--no-merge", "No merge"],
+        &[("RUNSEAL_GITEE_API_BASE", api_base)],
+    );
+
+    assert!(
+        output.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    handle.join().expect("mock server should finish");
+    assert_eq!(
+        log(&fx),
+        "git|checkout|-b|feat/no-merge\ngit|add|-A\ngit|commit|-m|No merge\ngit|push|-u|origin|feat/no-merge\ngit|checkout|main\n"
+    );
+}
+
+#[test]
+fn resume_local() {
+    let fx = fixture();
+    let secrets = fx.project.join(".local/secrets");
+    std::fs::create_dir_all(&secrets).expect("secrets dir should exist");
+    std::fs::write(secrets.join("gitee.env"), "GITEE_TOKEN=test-token\n")
+        .expect("token file should be written");
+    let (api_base, handle) = mock_gitee_sequence("feat/resume", true);
+
+    let output = run_wrapper_env(
+        &fx,
+        "pr",
+        &["--resume", "Resume change"],
+        &[
+            ("RUNSEAL_GITEE_API_BASE", api_base),
+            ("RUNSEAL_TEST_BRANCH", "feat/resume".to_string()),
+            ("RUNSEAL_TEST_STATUS", "".to_string()),
+        ],
+    );
+
+    assert!(
+        output.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    handle.join().expect("mock server should finish");
+    assert_eq!(
+        log(&fx),
+        "git|push|-u|origin|feat/resume\ngit|checkout|main\ngit|pull|--ff-only|origin|main\ngit|push|origin|--delete|feat/resume\ngit|branch|-D|feat/resume\n"
+    );
+}
+
+#[test]
+fn resume_remote() {
+    let fx = fixture();
+    let secrets = fx.project.join(".local/secrets");
+    std::fs::create_dir_all(&secrets).expect("secrets dir should exist");
+    std::fs::write(secrets.join("gitee.env"), "GITEE_TOKEN=test-token\n")
+        .expect("token file should be written");
+    let (api_base, handle) = mock_gitee_sequence("feat/remote", true);
+
+    let output = run_wrapper_env(
+        &fx,
+        "pr",
+        &["--resume", "--branch", "feat/remote", "Resume remote"],
+        &[
+            ("RUNSEAL_GITEE_API_BASE", api_base),
+            ("RUNSEAL_TEST_BRANCH", "main".to_string()),
+            ("RUNSEAL_TEST_CHECKOUT_FAIL", "feat/remote".to_string()),
+            ("RUNSEAL_TEST_STATUS", "".to_string()),
+        ],
+    );
+
+    assert!(
+        output.status.success(),
+        "stdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    handle.join().expect("mock server should finish");
+    assert_eq!(
+        log(&fx),
+        "git|checkout|feat/remote\ngit|fetch|origin|feat/remote\ngit|checkout|-B|feat/remote|origin/feat/remote\ngit|push|-u|origin|feat/remote\ngit|checkout|main\ngit|pull|--ff-only|origin|main\ngit|push|origin|--delete|feat/remote\ngit|branch|-D|feat/remote\n"
+    );
+}
+
+#[test]
+fn clean_start() {
+    let fx = fixture();
+
+    let output = run_wrapper_env(
+        &fx,
+        "pr",
+        &["--branch", "feat/empty", "Empty change"],
+        &[("RUNSEAL_TEST_STATUS", "".to_string())],
+    );
+
+    assert!(!output.status.success());
+    assert!(String::from_utf8_lossy(&output.stderr).contains("pr: no local changes to land"));
+    assert_eq!(log(&fx), "");
+}
+
+#[test]
+fn resume_clean() {
+    let fx = fixture();
+
+    let output = run_wrapper_env(
+        &fx,
+        "pr",
+        &["--resume", "Resume dirty"],
+        &[
+            ("RUNSEAL_TEST_BRANCH", "feat/resume".to_string()),
+            ("RUNSEAL_TEST_STATUS", " M docs.md".to_string()),
+        ],
+    );
+
+    assert!(!output.status.success());
+    assert!(
+        String::from_utf8_lossy(&output.stderr)
+            .contains("pr: --resume requires a clean topic branch")
+    );
+    assert_eq!(log(&fx), "");
+}
+
+fn mock_gitee_sequence(
+    expected_head: &'static str,
+    merge: bool,
+) -> (String, thread::JoinHandle<()>) {
+    let server = TcpListener::bind("127.0.0.1:0").expect("mock server should bind");
+    let address = server
+        .local_addr()
+        .expect("mock server address should exist");
+    let handle = thread::spawn(move || {
+        let mut expected = vec![("POST", "/repos/perishme/perish.top/pulls")];
+        if merge {
+            expected.push(("POST", "/repos/perishme/perish.top/pulls/42/review"));
+            expected.push(("POST", "/repos/perishme/perish.top/pulls/42/test"));
+            expected.push(("PUT", "/repos/perishme/perish.top/pulls/42/merge"));
+        }
+        for (index, expected) in expected.into_iter().enumerate() {
+            let (mut stream, _) = server.accept().expect("mock request should arrive");
+            let mut request = [0_u8; 4096];
+            let read = stream
+                .read(&mut request)
+                .expect("request should be readable");
+            let request = String::from_utf8_lossy(&request[..read]);
+            assert!(
+                request.starts_with(&format!("{} {} ", expected.0, expected.1)),
+                "unexpected request: {request}"
+            );
+            assert!(request.contains("authorization: token test-token"));
+            assert!(request.contains(r#""access_token":"test-token""#));
+            let body = if index == 0 {
+                assert!(request.contains(&format!(r#""head":"{expected_head}""#)));
+                r#"{"number":42,"html_url":"https://gitee.test/pr/42"}"#
+            } else {
+                r#"{}"#
+            };
+            write!(
+                stream,
+                "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: {}\r\n\r\n{}",
+                body.len(),
+                body
+            )
+            .expect("response should be written");
+        }
+    });
+    (format!("http://{address}"), handle)
+}
diff --git a/app/tests/transpile_cases.rs b/app/tests/transpile_cases.rs
index 26de6e9..1980a21 100644
--- a/app/tests/transpile_cases.rs
+++ b/app/tests/transpile_cases.rs
@@ -1,5 +1,9 @@
 #[path = "transpile_cases/argv.rs"]
 mod argv;
+#[path = "transpile_cases/command_predicate.rs"]
+mod command_predicate;
+#[path = "transpile_cases/env.rs"]
+mod env;
 #[path = "transpile_cases/regex.rs"]
 mod regex;
 #[path = "transpile_cases/release.rs"]
diff --git a/app/tests/transpile_cases/command_predicate.rs b/app/tests/transpile_cases/command_predicate.rs
new file mode 100644
index 0000000..d219316
--- /dev/null
+++ b/app/tests/transpile_cases/command_predicate.rs
@@ -0,0 +1,77 @@
+use std::path::PathBuf;
+use std::process::Command;
+
+use tempfile::TempDir;
+
+use super::syntax;
+
+fn bin() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_runseal"))
+}
+
+struct Fixture {
+    _temp: TempDir,
+    dir: PathBuf,
+    source: PathBuf,
+}
+
+fn fixture(source: &str) -> Fixture {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let dir = temp.path().join("project-without-profile");
+    std::fs::create_dir_all(&dir).expect("project dir should be created");
+    let source_path = dir.join("operator.seal");
+    std::fs::write(&source_path, source).expect("source should be written");
+    Fixture {
+        _temp: temp,
+        dir,
+        source: source_path,
+    }
+}
+
+fn run_transpile(fx: &Fixture, output_lang: &str) -> std::process::Output {
+    bin()
+        .current_dir(&fx.dir)
+        .arg("@transpile")
+        .arg("--input-lang=seal")
+        .arg("--output-lang")
+        .arg(output_lang)
+        .arg(&fx.source)
+        .output()
+        .expect("runseal should run")
+}
+
+#[test]
+fn command_predicate_emits_targets() {
+    let fx = fixture(
+        r#"
+branch=feat/remote
+if git checkout "$branch"; then
+  print ok
+else
+  git fetch origin "$branch"
+  git checkout -B "$branch" "origin/$branch"
+fi
+"#,
+    );
+
+    let bash = run_transpile(&fx, "bash");
+    let powershell = run_transpile(&fx, "powershell");
+
+    assert!(
+        bash.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&bash.stderr)
+    );
+    assert!(
+        powershell.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&powershell.stderr)
+    );
+    let bash = String::from_utf8(bash.stdout).expect("stdout should be UTF-8");
+    let powershell = String::from_utf8(powershell.stdout).expect("stdout should be UTF-8");
+    assert!(bash.contains("if git checkout \"$branch\"; then"));
+    assert!(powershell.contains("& 'git' 'checkout' $branch"));
+    assert!(powershell.contains("if ($LASTEXITCODE -eq 0)"));
+    syntax::assert_bash(&bash);
+    syntax::assert_pwsh(&powershell);
+}
diff --git a/app/tests/transpile_cases/env.rs b/app/tests/transpile_cases/env.rs
new file mode 100644
index 0000000..391ef86
--- /dev/null
+++ b/app/tests/transpile_cases/env.rs
@@ -0,0 +1,65 @@
+use std::path::PathBuf;
+use std::process::Command;
+
+use tempfile::TempDir;
+
+use super::syntax;
+
+fn bin() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_runseal"))
+}
+
+struct Fixture {
+    _temp: TempDir,
+    dir: PathBuf,
+    source: PathBuf,
+}
+
+fn fixture(source: &str) -> Fixture {
+    let temp = TempDir::new().expect("temp dir should be created");
+    let dir = temp.path().join("project-without-profile");
+    std::fs::create_dir_all(&dir).expect("project dir should be created");
+    let source_path = dir.join("operator.seal");
+    std::fs::write(&source_path, source).expect("source should be written");
+    Fixture {
+        _temp: temp,
+        dir,
+        source: source_path,
+    }
+}
+
+fn run_transpile(fx: &Fixture, output_lang: &str) -> std::process::Output {
+    bin()
+        .current_dir(&fx.dir)
+        .arg("@transpile")
+        .arg("--input-lang=seal")
+        .arg("--output-lang")
+        .arg(output_lang)
+        .arg(&fx.source)
+        .output()
+        .expect("runseal should run")
+}
+
+#[test]
+fn env_overlay_emits_targets() {
+    let fx = fixture(
+        r#"
+kubeconfig=/tmp/a.yaml
+KUBECONFIG="$kubeconfig" kubectl "$@"
+"#,
+    );
+
+    let bash = run_transpile(&fx, "bash");
+    let powershell = run_transpile(&fx, "powershell");
+
+    assert!(bash.status.success());
+    assert!(powershell.status.success());
+    let bash = String::from_utf8(bash.stdout).expect("stdout should be UTF-8");
+    let powershell = String::from_utf8(powershell.stdout).expect("stdout should be UTF-8");
+    assert!(bash.contains("KUBECONFIG=\"$kubeconfig\" kubectl \"$@\""));
+    assert!(powershell.contains("$__seal_old_env_KUBECONFIG = $env:KUBECONFIG"));
+    assert!(powershell.contains("$env:KUBECONFIG = $kubeconfig"));
+    assert!(powershell.contains("& 'kubectl' @args"));
+    syntax::assert_bash(&bash);
+    syntax::assert_pwsh(&powershell);
+}