<p align="center">
  <br>
  <br>
  <img src="logo.svg" width="160" alt="Pickey Mouse">
  <br>
  <br>
</p>

# 🔑🤏 pickey

_/ˈpɪkiː/_

**Two GitHub accounts, one laptop?**
*`pickey`* picks the right SSH key, automatically!

---

- 🔑 **Automatic SSH key selection** — rules match by host, org, or repo path
- 👀 **Observable** — every `git push` / `pull` shows which key is being used
- ⚡ **Fast** — single static Rust binary, no runtime dependencies
- 🤖 **Just works** — at clone time, from `/tmp`, from AI agent terminals, any shell

```
$ git push
[🔑🤏] git@github.com:WORK/my-api.git → ~/.ssh/id_work
Pushing…
```

## Install

### Homebrew

```bash
brew install simeoncode/tap/pickey
pickey init # --dry-run (to only preview changes)
```

### Cargo

```bash
cargo install pickey --locked
pickey init # --dry-run (to only preview changes)
```

### Prebuilt Binary

```bash
curl -fsSL https://raw.githubusercontent.com/simeoncode/pickey/main/install.sh | sh
…
pickey init # --dry-run (to only preview changes)
```

## Usage

```bash
pickey [status]           # Shows pickey status + current repo
pickey init               # Enable pickey
pickey init --dry-run     # Preview activation changes
pickey init --revert      # Undo changes made by init
pickey list               # List all rules
pickey check <url>        # See matching rules for URL
pickey test               # Test SSH connection
```

## Configuration

`~/.config/pickey/config.toml`:

```toml
[[rule]]
host = "github.com"
match = "WORK-Internal/*"
key = "~/.ssh/id_work"
email = "email@work.com"
name = "My Name"

[[rule]]
host = "github.com"
match = "MyPersonalOrg/*"
key = "~/.ssh/id_personal"
```

Rules auto-detected by `pickey init` include `auto = true` — these are safely replaced when you re-run init. Manually added rules (without `auto = true`) are always preserved.

Rules are evaluated top-to-bottom, first match wins. `match` is a glob pattern against the full path after the host. If no rule matches, pickey falls through to plain `ssh` (with a warning).

### Fields

| Field | Required? | Description |
|-------|----------|-------------|
| `auto` |  | This rule was auto-generated by `pickey init` |
| `host` | yes | Exact match against the SSH hostname |
| `match` |  | Glob against the path after the host. Omit to match any path on that host |
| `key` | yes | Path to private key (`~` expansion supported) |
| `port` |  | SSH port override (for non-standard ports) |
| `email` |  | Sets repo-local `user.email` — [see why](DESIGN.md#why-emailname-in-config) |
| `name` |  | Sets repo-local `user.name` |

## How it works

pickey sits as git's `sshCommand`. When git calls SSH, pickey matches the remote against your rules and injects `-i <key>` with `-o IdentityAgent=none` — so the right key is used and the ssh-agent can't override it. That's the whole trick.
