@boxes-dev/dvb 1.0.53 → 1.0.55

package/dist/bin/dvb.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 "use strict";
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5b27d1b2-cb5a-5370-b4ca-61330f7946e5")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4d4f5269-c2cd-5397-a6d4-993b4d24cfdc")}catch(e){}}();
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -21725,7 +21725,7 @@ var require_ProcessDetector = __commonJS({
     exports2.processDetector = void 0;
     var api_1 = require_src();
     var semconv_1 = require_semconv5();
-    var os23 = require("os");
+    var os24 = require("os");
     var ProcessDetector = class {
       detect(_config) {
         const attributes = {
@@ -21745,7 +21745,7 @@ var require_ProcessDetector = __commonJS({
           attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
         }
         try {
-          const userInfo = os23.userInfo();
+          const userInfo = os24.userInfo();
           attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
         } catch (e2) {
           api_1.diag.debug(`error obtaining process owner: ${e2}`);
@@ -37305,7 +37305,7 @@ var require_service_config = __commonJS({
     exports2.validateRetryThrottling = validateRetryThrottling;
     exports2.validateServiceConfig = validateServiceConfig;
     exports2.extractAndSelectServiceConfig = extractAndSelectServiceConfig;
-    var os23 = require("os");
+    var os24 = require("os");
     var constants_1 = require_constants9();
     var DURATION_REGEX = /^\d+(\.\d{1,9})?s$/;
     var CLIENT_LANGUAGE_STRING = "node";
@@ -37604,7 +37604,7 @@ var require_service_config = __commonJS({
         if (Array.isArray(validatedConfig.clientHostname)) {
           let hostnameMatched = false;
           for (const hostname2 of validatedConfig.clientHostname) {
-            if (hostname2 === os23.hostname()) {
+            if (hostname2 === os24.hostname()) {
               hostnameMatched = true;
             }
           }
@@ -51408,7 +51408,7 @@ var require_subchannel_call = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.Http2SubchannelCall = void 0;
     var http22 = require("http2");
-    var os23 = require("os");
+    var os24 = require("os");
     var constants_1 = require_constants9();
     var metadata_1 = require_metadata();
     var stream_decoder_1 = require_stream_decoder();
@@ -51416,7 +51416,7 @@ var require_subchannel_call = __commonJS({
     var constants_2 = require_constants9();
     var TRACER_NAME = "subchannel_call";
     function getSystemErrorName(errno) {
-      for (const [name, num] of Object.entries(os23.constants.errno)) {
+      for (const [name, num] of Object.entries(os24.constants.errno)) {
         if (num === errno) {
           return name;
         }
@@ -88683,8 +88683,8 @@ var init_otel = __esm({
       return trimmed && trimmed.length > 0 ? trimmed : void 0;
     };
     readBuildMetadata = () => {
-      const rawPackageVersion = "1.0.53";
-      const rawGitSha = "cf1d2a8bda7651429d5043ead7b5caf47d35e42d";
+      const rawPackageVersion = "1.0.55";
+      const rawGitSha = "fd6acb6139b570fb0b4ff18a48c7dfe864bb6513";
       const packageVersion = typeof rawPackageVersion === "string" ? rawPackageVersion : void 0;
       const gitSha = typeof rawGitSha === "string" ? rawGitSha : void 0;
       return { packageVersion, gitSha };
@@ -120672,9 +120672,9 @@ var init_sentry = __esm({
     sentryEnabled = false;
     uncaughtExceptionMonitorInstalled = false;
     readBuildMetadata2 = () => {
-      const rawPackageVersion = "1.0.53";
-      const rawGitSha = "cf1d2a8bda7651429d5043ead7b5caf47d35e42d";
-      const rawSentryRelease = "boxes-dev-dvb@1.0.53+cf1d2a8bda7651429d5043ead7b5caf47d35e42d";
+      const rawPackageVersion = "1.0.55";
+      const rawGitSha = "fd6acb6139b570fb0b4ff18a48c7dfe864bb6513";
+      const rawSentryRelease = "boxes-dev-dvb@1.0.55+fd6acb6139b570fb0b4ff18a48c7dfe864bb6513";
       const packageVersion = typeof rawPackageVersion === "string" ? rawPackageVersion : void 0;
       const gitSha = typeof rawGitSha === "string" ? rawGitSha : void 0;
       const sentryRelease = typeof rawSentryRelease === "string" ? rawSentryRelease : void 0;
@@ -182511,14 +182511,14 @@ var init_simple_client_node = __esm({
       "../common/temp/node_modules/.pnpm/node-gyp-build@4.8.4/node_modules/node-gyp-build/node-gyp-build.js"(exports2, module2) {
         var fs29 = __require("fs");
         var path38 = __require("path");
-        var os23 = __require("os");
+        var os24 = __require("os");
         var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
         var vars = process.config && process.config.variables || {};
         var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
         var abi = process.versions.modules;
         var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-        var arch2 = process.env.npm_config_arch || os23.arch();
-        var platform2 = process.env.npm_config_platform || os23.platform();
+        var arch2 = process.env.npm_config_arch || os24.arch();
+        var platform2 = process.env.npm_config_platform || os24.platform();
         var libc = process.env.LIBC || (isAlpine(platform2) ? "musl" : "glibc");
         var armv = process.env.ARM_VERSION || (arch2 === "arm64" ? "8" : vars.arm_version) || "";
         var uv = (process.versions.uv || "").split(".")[0];
@@ -197021,12 +197021,19 @@ var init_destroyLocalState = __esm({
 });
 
 // src/devbox/commands/commandProvider.ts
-var normalizeBoxKey, resolveRegistryEntry, resolveCommandComputeProvider, assertCommandProviderCapability;
+var MODAL_CONNECT_CAPABILITIES, MODAL_MOUNT_CAPABILITIES, normalizeBoxKey, resolveRegistryEntry, resolveCommandComputeProvider, assertCommandProviderCapability, hasCommandProviderCapability;
 var init_commandProvider = __esm({
   "src/devbox/commands/commandProvider.ts"() {
     "use strict";
     init_src();
     init_destroyLocalState();
+    MODAL_CONNECT_CAPABILITIES = /* @__PURE__ */ new Set([
+      "exec.sessions.open",
+      "exec.sessions.attach",
+      "exec.sessions.list",
+      "exec.sessions.kill"
+    ]);
+    MODAL_MOUNT_CAPABILITIES = /* @__PURE__ */ new Set(["files.read"]);
     normalizeBoxKey = (value) => {
       if (typeof value !== "string") return null;
       const trimmed = value.trim();
@@ -197081,7 +197088,10 @@ var init_commandProvider = __esm({
       if (provider === "sprites") {
         return;
       }
-      if (provider === "modal" && command === "connect" && capability === "exec.sessions.open") {
+      if (provider === "modal" && command === "connect" && MODAL_CONNECT_CAPABILITIES.has(capability)) {
+        return;
+      }
+      if (provider === "modal" && command === "mount" && MODAL_MOUNT_CAPABILITIES.has(capability)) {
         return;
       }
       throw new ProviderCapabilityError({
@@ -197091,14 +197101,30 @@ var init_commandProvider = __esm({
         message: `dvb ${command} does not support ${provider} devboxes yet.`
       });
     };
+    hasCommandProviderCapability = ({
+      provider,
+      command,
+      capability
+    }) => {
+      try {
+        assertCommandProviderCapability({ provider, command, capability });
+        return true;
+      } catch (error2) {
+        if (error2 instanceof ProviderCapabilityError && error2.code === "unsupported_capability") {
+          return false;
+        }
+        throw error2;
+      }
+    };
   }
 });
 
 // src/devbox/commands/init/provider/modalRuntime.ts
-var import_node_path16, import_ws3, SERVICE_BASE_DIR, SERVICE_META_SUFFIX, SERVICE_RUN_SUFFIX, SERVICE_PID_SUFFIX, SERVICE_LOG_SUFFIX, SERVICE_NAME_PATTERN, shellQuote2, MODAL_EXEC_WS_PATH2, MODAL_CONNECT_TOKEN_QUERY2, serviceMetaPath, serviceRunnerPath, servicePidPath, serviceLogPath, validateServiceName, isSandboxNotFoundError2, resolveReadPath, buildWsUrlFromConnectToken, decodeBase642, parseJsonRecord2, readCreateConnectToken2, ModalDaemonExecSocket, createModalInitRuntimeClient;
+var import_node_crypto8, import_node_path16, import_ws3, SERVICE_BASE_DIR, SERVICE_META_SUFFIX, SERVICE_RUN_SUFFIX, SERVICE_PID_SUFFIX, SERVICE_LOG_SUFFIX, SERVICE_NAME_PATTERN, shellQuote2, MODAL_EXEC_WS_PATH2, MODAL_CONNECT_TOKEN_QUERY2, MODAL_DAEMON_HANDSHAKE_TIMEOUT_MS, MODAL_DAEMON_REQUEST_TIMEOUT_MS, MODAL_DAEMON_TTY_HANDSHAKE_TIMEOUT_MS, MODAL_SANDBOX_RESOLVE_TIMEOUT_MS, serviceMetaPath, serviceRunnerPath, servicePidPath, serviceLogPath, validateServiceName, isSandboxNotFoundError2, resolveReadPath, buildWsUrlFromConnectToken, decodeBase642, parseJsonRecord2, readCreateConnectToken2, withTimeout2, connectModalDaemonWebSocket, awaitModalDaemonMessage, parseControlError, mapControlSessionRecord, ModalDaemonExecSocket, createModalInitRuntimeClient;
 var init_modalRuntime = __esm({
   "src/devbox/commands/init/provider/modalRuntime.ts"() {
     "use strict";
+    import_node_crypto8 = require("node:crypto");
     import_node_path16 = __toESM(require("node:path"), 1);
     init_dist3();
     import_ws3 = __toESM(require("ws"), 1);
@@ -197112,6 +197138,10 @@ var init_modalRuntime = __esm({
     shellQuote2 = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
     MODAL_EXEC_WS_PATH2 = "/ws";
     MODAL_CONNECT_TOKEN_QUERY2 = "_modal_connect_token";
+    MODAL_DAEMON_HANDSHAKE_TIMEOUT_MS = 1e4;
+    MODAL_DAEMON_REQUEST_TIMEOUT_MS = 15e3;
+    MODAL_DAEMON_TTY_HANDSHAKE_TIMEOUT_MS = 3e4;
+    MODAL_SANDBOX_RESOLVE_TIMEOUT_MS = 3e4;
     serviceMetaPath = (service) => `${SERVICE_BASE_DIR}/${service}${SERVICE_META_SUFFIX}`;
     serviceRunnerPath = (service) => `${SERVICE_BASE_DIR}/${service}${SERVICE_RUN_SUFFIX}`;
     servicePidPath = (service) => `${SERVICE_BASE_DIR}/${service}${SERVICE_PID_SUFFIX}`;
@@ -197174,6 +197204,122 @@ var init_modalRuntime = __esm({
       }
       return candidate.createConnectToken.bind(candidate);
     };
+    withTimeout2 = async (promise, timeoutMs, message) => {
+      let timeout = null;
+      try {
+        return await Promise.race([
+          promise,
+          new Promise((_2, reject) => {
+            timeout = setTimeout(() => {
+              reject(new Error(message));
+            }, timeoutMs);
+            timeout.unref();
+          })
+        ]);
+      } finally {
+        if (timeout) {
+          clearTimeout(timeout);
+        }
+      }
+    };
+    connectModalDaemonWebSocket = async (sandbox) => {
+      const resolvedSandbox = await sandbox;
+      const createConnectToken = readCreateConnectToken2(resolvedSandbox);
+      const credentials = await createConnectToken();
+      const wsUrl = buildWsUrlFromConnectToken(credentials);
+      const ws = new import_ws3.default(wsUrl);
+      await withTimeout2(
+        new Promise((resolve2, reject) => {
+          const onOpen = () => {
+            ws.off("error", onError);
+            resolve2();
+          };
+          const onError = (error2) => {
+            ws.off("open", onOpen);
+            reject(error2);
+          };
+          ws.once("open", onOpen);
+          ws.once("error", onError);
+        }),
+        MODAL_DAEMON_HANDSHAKE_TIMEOUT_MS,
+        "Timed out connecting to modal daemon websocket."
+      );
+      return ws;
+    };
+    awaitModalDaemonMessage = async (ws, matcher) => await withTimeout2(
+      new Promise((resolve2, reject) => {
+        const onMessage = (raw) => {
+          const parsed = parseJsonRecord2(raw);
+          if (!parsed) {
+            return;
+          }
+          if (parsed.type === "error") {
+            cleanup();
+            const reason = typeof parsed.message === "string" ? parsed.message : "modal daemon error";
+            reject(new Error(reason));
+            return;
+          }
+          if (!matcher(parsed)) {
+            return;
+          }
+          cleanup();
+          resolve2(parsed);
+        };
+        const onClose = (code2, reason) => {
+          cleanup();
+          reject(
+            new Error(
+              `Modal daemon socket closed (${String(code2)}): ${reason.toString("utf8") || "no reason"}`
+            )
+          );
+        };
+        const onError = (error2) => {
+          cleanup();
+          reject(error2);
+        };
+        const cleanup = () => {
+          ws.off("message", onMessage);
+          ws.off("close", onClose);
+          ws.off("error", onError);
+        };
+        ws.on("message", onMessage);
+        ws.once("close", onClose);
+        ws.once("error", onError);
+      }),
+      MODAL_DAEMON_REQUEST_TIMEOUT_MS,
+      "Timed out waiting for modal daemon response."
+    );
+    parseControlError = (message) => {
+      const errorPayload = message.error && typeof message.error === "object" ? message.error : null;
+      const code2 = errorPayload && typeof errorPayload.code === "string" ? errorPayload.code : null;
+      const text = errorPayload && typeof errorPayload.message === "string" ? errorPayload.message : typeof message.message === "string" ? message.message : "Modal daemon control request failed.";
+      return { code: code2, text };
+    };
+    mapControlSessionRecord = (entry) => {
+      if (!entry || typeof entry !== "object") {
+        return null;
+      }
+      const record = entry;
+      const id = typeof record.id === "string" ? record.id : "";
+      if (!id) {
+        return null;
+      }
+      const command = Array.isArray(record.command) ? record.command.map((part) => String(part)) : void 0;
+      const createdAt = typeof record.createdAt === "string" ? record.createdAt : void 0;
+      const lastActivityAt = typeof record.lastActivityAt === "string" ? record.lastActivityAt : void 0;
+      const tty2 = typeof record.tty === "boolean" ? record.tty : void 0;
+      const isActive = typeof record.isActive === "boolean" ? record.isActive : void 0;
+      const bytesPerSecond = typeof record.bytesPerSecond === "number" ? record.bytesPerSecond : void 0;
+      return {
+        id,
+        ...command ? { command } : {},
+        ...createdAt ? { createdAt } : {},
+        ...lastActivityAt ? { lastActivityAt } : {},
+        ...tty2 !== void 0 ? { tty: tty2 } : {},
+        ...isActive !== void 0 ? { isActive } : {},
+        ...bytesPerSecond !== void 0 ? { bytesPerSecond } : {}
+      };
+    };
     ModalDaemonExecSocket = class {
       constructor(sandbox, options) {
         this.sandbox = sandbox;
@@ -197191,6 +197337,7 @@ var init_modalRuntime = __esm({
       ws = null;
       closed = false;
       pongListeners = /* @__PURE__ */ new Set();
+      handshakeTimer = null;
       emit(type, event = {}) {
         for (const listener of this.listeners[type]) {
           listener(event);
@@ -197201,6 +197348,26 @@ var init_modalRuntime = __esm({
           listener();
         }
       }
+      clearHandshakeTimer() {
+        if (!this.handshakeTimer) {
+          return;
+        }
+        clearTimeout(this.handshakeTimer);
+        this.handshakeTimer = null;
+      }
+      startHandshakeTimer() {
+        this.clearHandshakeTimer();
+        this.handshakeTimer = setTimeout(() => {
+          if (this.closed || this.readyState !== 0) {
+            return;
+          }
+          this.emit("error", {
+            data: new Error("Timed out waiting for modal tty session handshake.")
+          });
+          this.close();
+        }, MODAL_DAEMON_TTY_HANDSHAKE_TIMEOUT_MS);
+        this.handshakeTimer.unref();
+      }
       emitMessagePayload(streamId, payload) {
         if (this.closed) return;
         const framed = new Uint8Array(payload.length + 1);
@@ -197218,6 +197385,7 @@ var init_modalRuntime = __esm({
         const type = typeof message.type === "string" ? message.type : "";
         if (type === "tty_ready") {
           const sessionId = typeof message.sessionId === "string" ? message.sessionId : "";
+          this.clearHandshakeTimer();
           this.readyState = 1;
           this.emit("open");
           this.emit("message", {
@@ -197262,15 +197430,21 @@ var init_modalRuntime = __esm({
           const wsUrl = buildWsUrlFromConnectToken(credentials);
           const ws = new import_ws3.default(wsUrl);
           this.ws = ws;
+          this.startHandshakeTimer();
           ws.on("open", () => {
             try {
-              this.sendJson({
+              const authPayload = {
                 type: "auth",
                 mode: "tty",
-                command: this.options.cmd,
                 cols: this.options.cols,
                 rows: this.options.rows
-              });
+              };
+              if (this.options.sessionId) {
+                authPayload.sessionId = this.options.sessionId;
+              } else {
+                authPayload.command = this.options.cmd;
+              }
+              this.sendJson(authPayload);
             } catch (error2) {
               this.emit("error", {
                 data: error2 instanceof Error ? error2 : new Error(String(error2))
@@ -197287,17 +197461,20 @@ var init_modalRuntime = __esm({
             this.emitPong();
           });
           ws.on("error", (error2) => {
+            this.clearHandshakeTimer();
             this.emit("error", {
               data: error2 instanceof Error ? error2 : new Error(String(error2))
             });
           });
           ws.on("close", (code2) => {
+            this.clearHandshakeTimer();
             if (this.closed) return;
             this.closed = true;
             this.readyState = 3;
             this.emit("close", { code: code2 });
           });
         } catch (error2) {
+          this.clearHandshakeTimer();
           const err = error2 instanceof Error ? error2 : new Error(String(error2));
           this.emit("error", { data: err });
           this.close();
@@ -197326,6 +197503,11 @@ var init_modalRuntime = __esm({
                   cb?.();
                   return;
                 }
+                if (record.type === "detach") {
+                  this.sendJson({ type: "detach" });
+                  cb?.();
+                  return;
+                }
               }
             } catch {
             }
@@ -197347,6 +197529,7 @@ var init_modalRuntime = __esm({
       }
       close() {
         if (this.closed) return;
+        this.clearHandshakeTimer();
         this.closed = true;
         this.readyState = 3;
         if (this.ws && this.ws.readyState <= import_ws3.default.OPEN) {
@@ -197425,7 +197608,11 @@ var init_modalRuntime = __esm({
         if (sandboxPromise) return sandboxPromise;
         sandboxPromise = (async () => {
           try {
-            const runningSandbox = await modal.sandboxes.fromName(appName, alias);
+            const runningSandbox = await withTimeout2(
+              modal.sandboxes.fromName(appName, alias),
+              MODAL_SANDBOX_RESOLVE_TIMEOUT_MS,
+              "Timed out resolving running modal sandbox by name."
+            );
             sandboxId = runningSandbox.sandboxId;
             return runningSandbox;
           } catch (error2) {
@@ -197434,12 +197621,24 @@ var init_modalRuntime = __esm({
             }
           }
           if (ensureActive) {
-            const ensured = await ensureActive(intent);
+            const ensured = await withTimeout2(
+              ensureActive(intent),
+              MODAL_SANDBOX_RESOLVE_TIMEOUT_MS,
+              "Timed out waiting for modal devbox wake."
+            );
             appName = ensured.appName;
             sandboxId = ensured.sandboxId;
-            return await modal.sandboxes.fromId(ensured.sandboxId);
+            return await withTimeout2(
+              modal.sandboxes.fromId(ensured.sandboxId),
+              MODAL_SANDBOX_RESOLVE_TIMEOUT_MS,
+              "Timed out resolving modal sandbox after wake."
+            );
           }
-          return await modal.sandboxes.fromId(sandboxId);
+          return await withTimeout2(
+            modal.sandboxes.fromId(sandboxId),
+            MODAL_SANDBOX_RESOLVE_TIMEOUT_MS,
+            "Timed out resolving modal sandbox by id."
+          );
         })().catch((error2) => {
           sandboxPromise = null;
           throw error2;
@@ -197696,10 +197895,102 @@ var init_modalRuntime = __esm({
           }
         ];
       };
+      const parseKillTimeoutOption = (value) => {
+        if (!value) return void 0;
+        const trimmed = value.trim().toLowerCase();
+        if (!trimmed) return void 0;
+        const match2 = /^(\d+)(ms|s|m)?$/.exec(trimmed);
+        if (!match2) return void 0;
+        const amount = Number.parseInt(match2[1] ?? "", 10);
+        if (!Number.isFinite(amount) || amount <= 0) {
+          return void 0;
+        }
+        const unit = match2[2] ?? "ms";
+        if (unit === "ms") return amount;
+        if (unit === "s") return amount * 1e3;
+        if (unit === "m") return amount * 6e4;
+        return void 0;
+      };
+      const runControlRequest = async (requestPayload, expectedType) => {
+        const ws = await connectModalDaemonWebSocket(resolveSandbox());
+        const requestId = (0, import_node_crypto8.randomUUID)().replace(/-/g, "");
+        try {
+          ws.send(JSON.stringify({ type: "auth", mode: "control" }));
+          await awaitModalDaemonMessage(
+            ws,
+            (message) => message.type === "control_ready"
+          );
+          ws.send(JSON.stringify({ ...requestPayload, requestId }));
+          return await awaitModalDaemonMessage(
+            ws,
+            (message) => message.type === expectedType && message.requestId === requestId
+          );
+        } finally {
+          if (ws.readyState === import_ws3.default.OPEN) {
+            ws.close();
+          } else if (ws.readyState === import_ws3.default.CONNECTING) {
+            ws.terminate();
+          }
+        }
+      };
+      const listExecSessions2 = async (name) => {
+        requireAlias(name);
+        const response = await runControlRequest(
+          { type: "sessions_list" },
+          "sessions_list_result"
+        );
+        if (response.status !== "ok") {
+          const { text } = parseControlError(response);
+          throw new Error(text);
+        }
+        const records = Array.isArray(response.sessions) ? response.sessions : [];
+        const sessions = [];
+        for (const entry of records) {
+          const mapped = mapControlSessionRecord(entry);
+          if (!mapped) continue;
+          sessions.push(mapped);
+        }
+        return sessions;
+      };
+      const killExecSession = async (name, sessionId, options) => {
+        requireAlias(name);
+        const timeoutMs = parseKillTimeoutOption(options?.timeout);
+        const response = await runControlRequest(
+          {
+            type: "session_kill",
+            sessionId,
+            ...options?.signal ? { signal: options.signal } : {},
+            ...typeof timeoutMs === "number" ? { timeoutMs } : {}
+          },
+          "session_kill_result"
+        );
+        if (response.status !== "ok") {
+          const { code: code2, text } = parseControlError(response);
+          if (code2 === "not_found") {
+            throw new SpritesApiError(
+              404,
+              "DELETE",
+              `/v1/sprites/${encodeURIComponent(name)}/exec/${encodeURIComponent(sessionId)}`,
+              text
+            );
+          }
+          throw new Error(text);
+        }
+        return Array.isArray(response.events) ? response.events.filter((entry) => entry && typeof entry === "object").map((entry) => entry) : [{ event: "killed", session_id: sessionId }];
+      };
       const openExecSession = (name, options) => {
         requireAlias(name);
         return new ModalDaemonExecSocket(resolveSandbox("shell"), options);
       };
+      const attachExecSession = (name, sessionId) => {
+        requireAlias(name);
+        return new ModalDaemonExecSocket(resolveSandbox(), {
+          cmd: [],
+          tty: true,
+          stdin: true,
+          sessionId
+        });
+      };
       const createCheckpoint = async (_name, options) => {
         const sandbox = await resolveSandbox();
         const image = await sandbox.snapshotFilesystem();
@@ -197718,18 +198009,21 @@ var init_modalRuntime = __esm({
         writeFile: writeFile2,
         readFile: readFile3,
         exec,
+        listExecSessions: listExecSessions2,
+        killExecSession,
         createCheckpoint,
         getService,
         createService,
         startService: startService2,
-        openExecSession
+        openExecSession,
+        attachExecSession
       };
     };
   }
 });
 
 // src/devbox/commands/provider/modalLifecycle.ts
-var DEFAULT_APP_NAME, DEFAULT_MODAL_DEVBOX_IMAGE, DEFAULT_TIMEOUT_MS, SANDBOX_LIST_PAGE_LIMIT, FINISHED_STATUS_LABELS, trimEnv3, decodeJwtExpMs, createSafeModalAuthTokenManager, installSafeModalAuthTokenManager, parsePositiveInt, resolveRegions, resolveAppName, resolveModalSandboxTimeoutMs, isNotFoundError, isModalAlreadyExistsError, withModalClient, resolveModalApp, listSandboxesRaw, formatSandboxStatus, isRunningSandbox, resolveImageFromTag, provisionModalSandbox, findModalSandbox, terminateModalSandboxesByAlias;
+var DEFAULT_APP_NAME, DEFAULT_MODAL_DEVBOX_IMAGE, DEFAULT_TIMEOUT_MS, SANDBOX_LIST_PAGE_LIMIT, MODAL_DAEMON_WRAPPER_PATH, MODAL_DAEMON_SUPERVISOR_ENTRYPOINT, FINISHED_STATUS_LABELS, trimEnv3, decodeJwtExpMs, createSafeModalAuthTokenManager, installSafeModalAuthTokenManager, parsePositiveInt, resolveRegions, resolveAppName, resolveModalSandboxTimeoutMs, isNotFoundError, isModalAlreadyExistsError, withModalClient, resolveModalApp, listSandboxesRaw, formatSandboxStatus, isRunningSandbox, resolveImageFromTag, provisionModalSandbox, findModalSandbox, terminateModalSandboxesByAlias;
 var init_modalLifecycle = __esm({
   "src/devbox/commands/provider/modalLifecycle.ts"() {
     "use strict";
@@ -197739,6 +198033,22 @@ var init_modalLifecycle = __esm({
     DEFAULT_MODAL_DEVBOX_IMAGE = "public.ecr.aws/d8m4p4w9/modal-devbox:latest";
     DEFAULT_TIMEOUT_MS = 24 * 60 * 60 * 1e3;
     SANDBOX_LIST_PAGE_LIMIT = 100;
+    MODAL_DAEMON_WRAPPER_PATH = "/home/sprite/.devbox/daemon/run-daemon.sh";
+    MODAL_DAEMON_SUPERVISOR_ENTRYPOINT = [
+      "/bin/sh",
+      "-lc",
+      [
+        "set -u",
+        `wrapper=${JSON.stringify(MODAL_DAEMON_WRAPPER_PATH)}`,
+        'until [ -x "$wrapper" ]; do sleep 0.25; done',
+        "while true; do",
+        '  "$wrapper"',
+        "  status=$?",
+        '  echo "sprite-daemon exited with status $status; restarting" >&2',
+        "  sleep 1",
+        "done"
+      ].join("\n")
+    ];
     FINISHED_STATUS_LABELS = {
       1: "success",
       2: "failure",
@@ -197942,6 +198252,7 @@ var init_modalLifecycle = __esm({
             timeoutSecs,
             name: alias,
             ...regions.length > 0 ? { schedulerPlacement: { regions } } : {},
+            entrypointArgs: MODAL_DAEMON_SUPERVISOR_ENTRYPOINT,
             enableSnapshot: true
           }
         });
@@ -198087,10 +198398,11 @@ var init_providerClient = __esm({
       appName,
       sandboxId,
       operationOptions,
-      ensureActive
+      ensureActive,
+      runtimeClient
     }) => {
       assertModalRuntimeCredentialPair(operationOptions);
-      const runtime = createModalInitRuntimeClient({
+      const runtime = runtimeClient ?? createModalInitRuntimeClient({
         alias,
         appName,
         sandboxId,
@@ -198107,8 +198419,8 @@ var init_providerClient = __esm({
         writeFile: runtime.writeFile,
         readFile: runtime.readFile,
         exec: runtime.exec,
-        listExecSessions: async () => throwModalConnectUnsupported("listExecSessions (modal connect client)"),
-        killExecSession: async () => throwModalConnectUnsupported("killExecSession (modal connect client)"),
+        listExecSessions: runtime.listExecSessions,
+        killExecSession: runtime.killExecSession,
         createCheckpoint: runtime.createCheckpoint,
         listServices: async () => throwModalConnectUnsupported("listServices (modal connect client)"),
         getService: runtime.getService,
@@ -198116,7 +198428,7 @@ var init_providerClient = __esm({
         startService: runtime.startService,
         stopService: async () => throwModalConnectUnsupported("stopService (modal connect client)"),
         openExecSession: runtime.openExecSession,
-        attachExecSession: () => throwModalConnectUnsupported("attachExecSession (modal connect client)"),
+        attachExecSession: runtime.attachExecSession,
         openProxySocket: () => throwModalConnectUnsupported("openProxySocket (modal connect client)")
       };
     };
@@ -198289,6 +198601,76 @@ var init_providerClient = __esm({
   }
 });
 
+// src/devbox/commands/provider/modalCommandContext.ts
+var resolveModalCommandContext;
+var init_modalCommandContext = __esm({
+  "src/devbox/commands/provider/modalCommandContext.ts"() {
+    "use strict";
+    init_src();
+    init_auth();
+    init_controlPlane();
+    init_providerClient();
+    resolveModalCommandContext = async (options) => {
+      const config4 = await loadConfig(
+        process.env.HOME ? { homeDir: process.env.HOME } : void 0
+      );
+      const store = await createSecretStore(
+        config4?.tokenStore,
+        process.env.HOME ? { homeDir: process.env.HOME } : void 0
+      );
+      const modalCredentialContext = createProviderCredentialContext({
+        mode: "auto",
+        controlPlaneToken: await store.getControlPlaneToken()
+      });
+      let operationOptions = await resolveModalCommandOperationOptions({
+        credentials: modalCredentialContext,
+        cwd: options.cwd
+      });
+      if (operationOptions.credentialMode === "shared" && (!operationOptions.credentials.modalTokenId || !operationOptions.credentials.modalTokenSecret)) {
+        const controlPlaneToken2 = await ensureControlPlaneToken(
+          store,
+          options.stage
+        );
+        if (controlPlaneToken2) {
+          operationOptions = await resolveModalCommandOperationOptions({
+            credentials: createProviderCredentialContext({
+              mode: "auto",
+              controlPlaneToken: controlPlaneToken2
+            }),
+            cwd: options.cwd
+          });
+        }
+      }
+      let controlPlaneToken = modalCredentialContext.controlPlaneToken;
+      const ensureActive = async (intent) => {
+        if (!controlPlaneToken) {
+          controlPlaneToken = await ensureControlPlaneToken(store, options.stage);
+        }
+        if (!controlPlaneToken) {
+          throw new Error(
+            "Control plane authentication is required to wake modal devboxes. Run `dvb setup` and retry."
+          );
+        }
+        const ensured = await ensureModalDevboxActive2(
+          controlPlaneToken,
+          options.alias,
+          intent
+        );
+        return {
+          appName: ensured.appName,
+          sandboxId: ensured.sandboxId,
+          woke: ensured.woke,
+          wakeSource: ensured.wakeSource
+        };
+      };
+      return {
+        operationOptions,
+        ensureActive
+      };
+    };
+  }
+});
+
 // src/devbox/commands/sessionUtils.ts
 var AUTO_SESSION_PREFIX, parseAutoSessionSuffix, getNextAutoSessionName, ensureUniqueAutoSessionName, shellQuote3, sanitizeSessionName, buildSessionLogPath, renameSessionLog;
 var init_sessionUtils = __esm({
@@ -198341,12 +198723,12 @@ var init_sessionUtils = __esm({
 });
 
 // src/devbox/commands/connect.ts
-var import_node_child_process4, import_node_crypto8, import_node_os10, import_node_path17, import_node_readline3, import_promises13, DEFAULT_TTY_COLS, DEFAULT_TTY_ROWS, TERMINAL_INPUT_MODE_RESET, resetTerminalInputModes, openBrowser2, warnSetupStatus, resolveTtyEnv, formatEnvExports, parseEnvSize, readStreamSize, resolveTtySize, resolveSessionEnv, parseReachabilityState, runCommand, checkReachability, watchReachabilityWithScutil, watchReachabilityWithNotifyutil, waitForNetworkOnline, parseConnectArgs, parseConnectTarget, buildLoggingCommand, CONNECT_SHELL_CANDIDATES, resolveConnectShell, confirmNewSession, promptRenameSession, HEARTBEAT_INTERVAL_MS, HEARTBEAT_TIMEOUT_MS, INPUT_PROBE_TIMEOUT_MS, WS_OPEN_STATE, streamExecSession, runConnect;
+var import_node_child_process4, import_node_crypto9, import_node_os10, import_node_path17, import_node_readline3, import_promises13, DEFAULT_TTY_COLS, DEFAULT_TTY_ROWS, TERMINAL_INPUT_MODE_RESET, resetTerminalInputModes, openBrowser2, warnSetupStatus, resolveTtyEnv, formatEnvExports, parseEnvSize, readStreamSize, resolveTtySize, resolveSessionEnv, parseReachabilityState, runCommand, checkReachability, watchReachabilityWithScutil, watchReachabilityWithNotifyutil, waitForNetworkOnline, parseConnectArgs, parseConnectTarget, buildLoggingCommand, CONNECT_SHELL_CANDIDATES, resolveConnectShell, confirmNewSession, promptRenameSession, HEARTBEAT_INTERVAL_MS, HEARTBEAT_TIMEOUT_MS, INPUT_PROBE_TIMEOUT_MS, WS_OPEN_STATE, streamExecSession, runConnect;
 var init_connect2 = __esm({
   "src/devbox/commands/connect.ts"() {
     "use strict";
     import_node_child_process4 = require("node:child_process");
-    import_node_crypto8 = require("node:crypto");
+    import_node_crypto9 = require("node:crypto");
     import_node_os10 = __toESM(require("node:os"), 1);
     import_node_path17 = require("node:path");
     import_node_readline3 = require("node:readline");
@@ -198355,7 +198737,6 @@ var init_connect2 = __esm({
     init_src();
     init_daemonClient();
     init_auth();
-    init_controlPlane();
     init_logger3();
     init_latency();
     init_osc();
@@ -198364,7 +198745,7 @@ var init_connect2 = __esm({
     init_boxSelect();
     init_commandProvider();
     init_providerClient();
-    init_modalLifecycle();
+    init_modalCommandContext();
     init_sessionUtils();
     DEFAULT_TTY_COLS = 80;
     DEFAULT_TTY_ROWS = 24;
@@ -198705,7 +199086,8 @@ var init_connect2 = __esm({
       return { box, session };
     };
     buildLoggingCommand = (logPath, shellCommand) => [
-      'mkdir -p "$HOME/.devbox/logs"',
+      `log_dir=$(dirname ${shellQuote3(logPath)})`,
+      'mkdir -p "$log_dir"',
       "if command -v script >/dev/null 2>&1; then",
       `  exec script -q -f -a ${shellQuote3(logPath)} -c ${shellQuote3(shellCommand)}`,
       "else",
@@ -199282,93 +199664,42 @@ var init_connect2 = __esm({
           command: "connect",
           capability: "exec.sessions.open"
         });
-        const supportsAttachExecSession = computeProvider === "sprites";
+        const supportsAttachExecSession = hasCommandProviderCapability({
+          provider: computeProvider,
+          command: "connect",
+          capability: "exec.sessions.attach"
+        });
+        const supportsListExecSessions = hasCommandProviderCapability({
+          provider: computeProvider,
+          command: "connect",
+          capability: "exec.sessions.list"
+        });
         const supportsResizeControlMessages = computeProvider === "sprites" || computeProvider === "modal";
-        if (computeProvider === "modal") {
-          if (isDetached) {
-            throw new Error(
-              "`dvb connect --detach` is not supported for modal devboxes yet."
-            );
-          }
-          if (sessionName) {
-            throw new Error(
-              "Named sessions are not supported for modal devboxes yet. Re-run without `--name` or `<box>/<session>`."
-            );
-          }
-          autoNameRequested = false;
-          shouldLog2 = false;
-        }
         let client2;
         let networkTargetHost = null;
         if (computeProvider === "modal") {
           stage("Loading modal auth");
-          const config4 = await loadConfig(
-            process.env.HOME ? { homeDir: process.env.HOME } : void 0
-          );
-          const store = await createSecretStore(
-            config4?.tokenStore,
-            process.env.HOME ? { homeDir: process.env.HOME } : void 0
-          );
-          const modalCredentialContext = createProviderCredentialContext({
-            mode: "auto",
-            controlPlaneToken: await store.getControlPlaneToken()
-          });
-          let modalOperationOptions = await resolveModalCommandOperationOptions({
-            credentials: modalCredentialContext,
-            cwd: process.cwd()
+          const modalContext = await resolveModalCommandContext({
+            alias: spriteAlias,
+            cwd: process.cwd(),
+            stage
           });
-          if (modalOperationOptions.credentialMode === "shared" && (!modalOperationOptions.credentials.modalTokenId || !modalOperationOptions.credentials.modalTokenSecret)) {
-            const controlPlaneToken2 = await ensureControlPlaneToken(store, stage);
-            if (controlPlaneToken2) {
-              modalOperationOptions = await resolveModalCommandOperationOptions({
-                credentials: createProviderCredentialContext({
-                  mode: "auto",
-                  controlPlaneToken: controlPlaneToken2
-                }),
-                cwd: process.cwd()
-              });
-            }
-          }
-          let controlPlaneToken = modalCredentialContext.controlPlaneToken;
           const ensureActive = async (intent) => {
-            if (!controlPlaneToken) {
-              controlPlaneToken = await ensureControlPlaneToken(store, stage);
-            }
-            if (!controlPlaneToken) {
-              throw new Error(
-                "Control plane authentication is required to wake modal devboxes. Run `dvb setup` and retry."
-              );
-            }
-            const ensured = await ensureModalDevboxActive2(
-              controlPlaneToken,
-              spriteAlias,
-              intent
-            );
+            const ensured2 = await modalContext.ensureActive(intent);
             return {
-              appName: ensured.appName,
-              sandboxId: ensured.sandboxId
+              appName: ensured2.appName,
+              sandboxId: ensured2.sandboxId
             };
           };
-          stage("Checking modal sandbox");
-          const sandbox = await findModalSandbox(
-            {
-              alias: spriteAlias,
-              includeFinished: true
-            },
-            modalOperationOptions
-          );
-          let appName = sandbox?.appName ?? "";
-          let sandboxId = sandbox?.sandboxId ?? "";
-          if (!appName || !sandboxId) {
-            const ensured = await ensureActive("shell");
-            appName = ensured.appName;
-            sandboxId = ensured.sandboxId;
-          }
+          stage("Ensuring modal sandbox");
+          const ensured = await ensureActive("shell");
+          const appName = ensured.appName;
+          const sandboxId = ensured.sandboxId;
           client2 = createModalConnectSpritesClient({
             alias: spriteAlias,
             appName,
             sandboxId,
-            operationOptions: modalOperationOptions,
+            operationOptions: modalContext.operationOptions,
             ensureActive
           });
         } else {
@@ -199526,7 +199857,7 @@ var init_connect2 = __esm({
           if (!sessionName) return;
           sessions = await readSessionsSafe(sessions);
           sessionId = sessions[sessionName];
-          if (sessionId) {
+          if (sessionId && supportsListExecSessions) {
             const available = await client2.listExecSessions(spriteAlias);
             const match2 = available.find((session) => session.id === sessionId);
             if (!match2 || match2.tty === false) {
@@ -199597,7 +199928,7 @@ var init_connect2 = __esm({
         const weztermPane = process.env.WEZTERM_PANE?.trim() || "";
         const weztermSocket = process.env.WEZTERM_UNIX_SOCKET?.trim() || "";
         const weztermSessionId = weztermPane ? `wezterm:${weztermPane}${weztermSocket ? `:${(0, import_node_path17.basename)(weztermSocket)}` : ""}` : "";
-        const terminalSessionId = process.env.DEVBOX_TERM_SESSION_ID?.trim() || weztermSessionId || process.env.TERM_SESSION_ID?.trim() || process.env.ITERM_SESSION_ID?.trim() || `dvb-${(0, import_node_crypto8.randomUUID)()}`;
+        const terminalSessionId = process.env.DEVBOX_TERM_SESSION_ID?.trim() || weztermSessionId || process.env.TERM_SESSION_ID?.trim() || process.env.ITERM_SESSION_ID?.trim() || `dvb-${(0, import_node_crypto9.randomUUID)()}`;
         const execCommand2 = (() => {
           const sessionEnv = resolveSessionEnv(terminalSessionId);
           const ttyEnv = isTty ? resolveTtyEnv(terminalSessionId) : null;
@@ -199866,14 +200197,16 @@ ${message}\r
               console.error("Connection lost. Reconnecting... (Ctrl+C to cancel)");
               reconnectNoticeShown = true;
             }
-            if (result.opened === false && sessionId && supportsAttachExecSession) {
+            if (result.opened === false && sessionId && supportsAttachExecSession && supportsListExecSessions) {
               try {
                 const available = await client2.listExecSessions(spriteAlias);
                 const match2 = available.find((session) => session.id === sessionId);
-                if ((!match2 || match2.tty === false) && sessionName) {
-                  delete sessions[sessionName];
+                if (!match2 || match2.tty === false) {
+                  if (sessionName) {
+                    delete sessions[sessionName];
+                    await writeSpriteSessions(client2, spriteAlias, sessions);
+                  }
                   sessionId = void 0;
-                  await writeSpriteSessions(client2, spriteAlias, sessions);
                 }
               } catch (error2) {
                 logger7.warn("session_lookup_failed", { error: String(error2) });
@@ -201209,11 +201542,11 @@ var init_session3 = __esm({
 });
 
 // src/devbox/commands/init/repo.ts
-var import_node_crypto9, import_node_child_process5, import_node_path21, buildSpawnEnv, runCommand2, runCommandRaw, findRepoRoot, readRepoOrigin, readLocalGitConfigValue, writeLocalGitConfigValue, ensureRepoProjectId, resolveGitCommonDir, readHeadState, readNullSeparatedPaths, readWorktreeState, confirmCopyWorktree, readGlobalGitConfigFiles, mapGlobalGitConfigDestinations;
+var import_node_crypto10, import_node_child_process5, import_node_path21, buildSpawnEnv, runCommand2, runCommandRaw, findRepoRoot, readRepoOrigin, readLocalGitConfigValue, writeLocalGitConfigValue, ensureRepoProjectId, resolveGitCommonDir, readHeadState, readNullSeparatedPaths, readWorktreeState, confirmCopyWorktree, readGlobalGitConfigFiles, mapGlobalGitConfigDestinations;
 var init_repo2 = __esm({
   "src/devbox/commands/init/repo.ts"() {
     "use strict";
-    import_node_crypto9 = require("node:crypto");
+    import_node_crypto10 = require("node:crypto");
     import_node_child_process5 = require("node:child_process");
     import_node_path21 = __toESM(require("node:path"), 1);
     init_dist5();
@@ -201300,7 +201633,7 @@ var init_repo2 = __esm({
       const key = "devbox.projectId";
       const existing = await readLocalGitConfigValue(repoRoot, key);
       if (existing) return existing;
-      const created = (0, import_node_crypto9.randomUUID)();
+      const created = (0, import_node_crypto10.randomUUID)();
       await writeLocalGitConfigValue(repoRoot, key, created);
       return created;
     };
@@ -201425,11 +201758,11 @@ var init_weztermMux = __esm({
 });
 
 // src/devbox/commands/init/remote.ts
-var import_node_crypto10, DAEMON_DIR, DAEMON_TARBALL, DAEMON_BUNDLE_DIR, DAEMON_ENTRY, DAEMON_WRAPPER, DAEMON_SERVICE_NAME, DAEMON_CONFIG_FILE, DEFAULT_DAEMON_BASE_URL, DEFAULT_HEARTBEAT_MS, BOOTSTRAP_EXEC_TIMEOUT_MS, BOOTSTRAP_EXEC_HANDSHAKE_TIMEOUT_MS, BASHRC_PATH, ZSHRC_PATH, BASIC_ALIASES_MARKER, LEGACY_BASH_TRAP, SAFE_BASH_TRAP, BASH_HISTORY_BLOCK, ZSH_HISTORY_BLOCK, HISTORY_BLOCK_PATTERN, BASH_HISTORY_LINE_PATTERN, ZSH_HISTORY_LINE_PATTERN, logger8, truncateTail, shellQuote4, expandHome2, execWithLog, writeRemoteFile, readRemoteFile, ensureTrailingNewline, upsertHistoryBlock, patchBashrcContent, patchZshrcContent, bootstrapDevbox, buildWeztermMuxConfig, buildWeztermMuxRunner, patchRemoteRcFile, patchBashrc, patchZshrc, stageRemoteSetupArtifacts, resolveDaemonUrl, fetchDaemonBinary, buildDaemonConfig, buildDaemonWrapperScript, isSameArgs, ensureSpriteDaemonService, installWeztermMux, ensureWeztermMuxService, hasWeztermMuxBinary, isWeztermMuxHealthy, installSpriteDaemon;
+var import_node_crypto11, DAEMON_DIR, DAEMON_TARBALL, DAEMON_BUNDLE_DIR, DAEMON_ENTRY, DAEMON_WRAPPER, DAEMON_SERVICE_NAME, DAEMON_CONFIG_FILE, MODAL_DAEMON_HEALTH_PORT, DEFAULT_DAEMON_BASE_URL, DEFAULT_HEARTBEAT_MS, BOOTSTRAP_EXEC_TIMEOUT_MS, BOOTSTRAP_EXEC_HANDSHAKE_TIMEOUT_MS, BASHRC_PATH, ZSHRC_PATH, BASIC_ALIASES_MARKER, LEGACY_BASH_TRAP, SAFE_BASH_TRAP, BASH_HISTORY_BLOCK, ZSH_HISTORY_BLOCK, HISTORY_BLOCK_PATTERN, BASH_HISTORY_LINE_PATTERN, ZSH_HISTORY_LINE_PATTERN, logger8, truncateTail, shellQuote4, expandHome2, execWithLog, writeRemoteFile, readRemoteFile, ensureTrailingNewline, upsertHistoryBlock, patchBashrcContent, patchZshrcContent, bootstrapDevbox, buildWeztermMuxConfig, buildWeztermMuxRunner, patchRemoteRcFile, patchBashrc, patchZshrc, stageRemoteSetupArtifacts, resolveDaemonUrl, fetchDaemonBinary, buildDaemonConfig, buildDaemonWrapperScript, isSameArgs, ensureSpriteDaemonService, installWeztermMux, ensureWeztermMuxService, hasWeztermMuxBinary, isWeztermMuxHealthy, installSpriteDaemon;
 var init_remote = __esm({
   "src/devbox/commands/init/remote.ts"() {
     "use strict";
-    import_node_crypto10 = require("node:crypto");
+    import_node_crypto11 = require("node:crypto");
     init_src();
     init_weztermMux();
     DAEMON_DIR = "/home/sprite/.devbox/daemon";
@@ -201439,6 +201772,7 @@ var init_remote = __esm({
     DAEMON_WRAPPER = `${DAEMON_DIR}/run-daemon.sh`;
     DAEMON_SERVICE_NAME = "devbox-sprite-daemon";
     DAEMON_CONFIG_FILE = `${DAEMON_DIR}/config.json`;
+    MODAL_DAEMON_HEALTH_PORT = 8080;
     DEFAULT_DAEMON_BASE_URL = process.env.SPRITE_DAEMON_BASE_URL?.trim() || "https://deploy-dev.boxes.dev";
     DEFAULT_HEARTBEAT_MS = 3e4;
     BOOTSTRAP_EXEC_TIMEOUT_MS = 9e4;
@@ -201482,7 +201816,7 @@ var init_remote = __esm({
       return value;
     };
     execWithLog = async (client2, spriteAlias, script, stage, options) => {
-      const requestId = (0, import_node_crypto10.randomUUID)();
+      const requestId = (0, import_node_crypto11.randomUUID)();
       const startedAt2 = Date.now();
       logger8.info("sprites_request", {
         requestId,
@@ -201516,7 +201850,7 @@ var init_remote = __esm({
       return result;
     };
     writeRemoteFile = async (client2, spriteAlias, path38, content, stage) => {
-      const requestId = (0, import_node_crypto10.randomUUID)();
+      const requestId = (0, import_node_crypto11.randomUUID)();
       logger8.info("sprites_request", {
         requestId,
         method: "writeFile",
@@ -201536,7 +201870,7 @@ var init_remote = __esm({
       });
     };
     readRemoteFile = async (client2, spriteAlias, path38, stage) => {
-      const requestId = (0, import_node_crypto10.randomUUID)();
+      const requestId = (0, import_node_crypto11.randomUUID)();
       logger8.info("sprites_request", {
         requestId,
         method: "readFile",
@@ -202074,8 +202408,45 @@ ${canonicalBlock}
     };
     ensureSpriteDaemonService = async ({
       client: client2,
-      spriteName
+      spriteName,
+      computeProvider
     }) => {
+      if (computeProvider === "modal") {
+        const script = [
+          "set -euo pipefail",
+          `wrapper=${shellQuote4(DAEMON_WRAPPER)}`,
+          `health_port=${String(MODAL_DAEMON_HEALTH_PORT)}`,
+          'if [ ! -x "$wrapper" ]; then',
+          '  echo "missing sprite-daemon wrapper" >&2',
+          "  exit 1",
+          "fi",
+          "ready=0",
+          "for _ in $(seq 1 120); do",
+          '  if (echo >"/dev/tcp/127.0.0.1/${health_port}") >/dev/null 2>&1; then',
+          "    ready=1",
+          "    break",
+          "  fi",
+          "  sleep 0.25",
+          "done",
+          'if [ "$ready" -ne 1 ]; then',
+          '  echo "sprite-daemon websocket health port not ready" >&2',
+          "  exit 1",
+          "fi",
+          "echo ok"
+        ].join("\n");
+        const result = await execWithLog(
+          client2,
+          spriteName,
+          script,
+          "ensure-sprite-daemon"
+        );
+        if (result.exitCode !== 0) {
+          throw new Error(
+            result.stderr || result.stdout || "Sprite daemon health check failed."
+          );
+        }
+        return;
+      }
       const expectedCmd = DAEMON_WRAPPER;
       const expectedArgs = [];
       const existing = await client2.getService(spriteName, DAEMON_SERVICE_NAME);
@@ -202420,7 +202791,7 @@ chmod 755 ${WEZTERM_MUX_RUNNER_PATH}`,
         throw new Error(result.stderr || result.stdout || "Daemon install failed.");
       }
       reportPhase(4, "ensure daemon service");
-      await ensureSpriteDaemonService({ client: client2, spriteName });
+      await ensureSpriteDaemonService({ client: client2, spriteName, computeProvider });
       reportPhase(5, "completed");
     };
   }
@@ -202684,7 +203055,7 @@ var init_registry2 = __esm({
 });
 
 // src/devbox/commands/mountSsh.ts
-var import_node_child_process7, import_promises19, import_node_os12, import_node_path23, DEVBOX_SSH_DIR, MOUNT_KEY_PATH, MOUNT_PUBLIC_KEY_PATH, KNOWN_HOSTS_PATH, REMOTE_SSH_DIR, REMOTE_AUTH_KEYS, REMOTE_SSHD_CONFIG, SSHD_SERVICE_NAME, REMOTE_SSH_USER_PATTERN, shellEscape, runCommand4, ensureDevboxSshDir, ensureKnownHostsFile, ensureLocalMountKey, readLocalMountPublicKey, resolveRemoteSshUser, buildSshdConfig, ensureRemoteMountAccess, ensureSshdService;
+var import_node_child_process7, import_promises19, import_node_os12, import_node_path23, DEVBOX_SSH_DIR, MOUNT_KEY_PATH, MOUNT_PUBLIC_KEY_PATH, KNOWN_HOSTS_PATH, REMOTE_MOUNT_ROOT, REMOTE_SSH_DIR, REMOTE_AUTH_KEYS, REMOTE_SSHD_CONFIG, SSHD_SERVICE_NAME, REMOTE_SSH_USER_PATTERN, shellEscape, runCommand4, ensureDevboxSshDir, ensureKnownHostsFile, ensureLocalMountKey, readLocalMountPublicKey, ensureRemoteMountRoot, resolveRemoteSshUser, buildSshdConfig, ensureRemoteMountAccess, ensureSshdService, getRemoteMountRoot;
 var init_mountSsh = __esm({
   "src/devbox/commands/mountSsh.ts"() {
     "use strict";
@@ -202697,7 +203068,8 @@ var init_mountSsh = __esm({
     MOUNT_KEY_PATH = import_node_path23.default.join(DEVBOX_SSH_DIR, "mount_ed25519");
     MOUNT_PUBLIC_KEY_PATH = `${MOUNT_KEY_PATH}.pub`;
     KNOWN_HOSTS_PATH = import_node_path23.default.join(DEVBOX_SSH_DIR, "known_hosts");
-    REMOTE_SSH_DIR = "/home/sprite/.devbox/ssh";
+    REMOTE_MOUNT_ROOT = "/home/sprite";
+    REMOTE_SSH_DIR = `${REMOTE_MOUNT_ROOT}/.devbox/ssh`;
     REMOTE_AUTH_KEYS = `${REMOTE_SSH_DIR}/authorized_keys`;
     REMOTE_SSHD_CONFIG = `${REMOTE_SSH_DIR}/sshd_config`;
     SSHD_SERVICE_NAME = "devbox-sshd";
@@ -202757,6 +203129,25 @@ var init_mountSsh = __esm({
       }
       return trimmed;
     };
+    ensureRemoteMountRoot = async (client2, spriteName) => {
+      const result = await client2.exec(spriteName, [
+        "/bin/bash",
+        "-lc",
+        `test -d ${shellEscape(REMOTE_MOUNT_ROOT)}`
+      ]);
+      if (result.exitCode === 0) {
+        return;
+      }
+      const stderr = result.stderr.trim();
+      const stdout = result.stdout.trim();
+      const combined = [stderr, stdout].filter(Boolean).join("\n");
+      const details = combined ? `
+
+${combined}` : "";
+      throw new Error(
+        `Remote mount root "${REMOTE_MOUNT_ROOT}" is missing or inaccessible. Run \`dvb init --resume\` for this devbox before mounting.${details}`
+      );
+    };
     resolveRemoteSshUser = async (client2, spriteName) => {
       const detectScript = [
         "set -euo pipefail",
@@ -202833,9 +203224,9 @@ ${combined}` : "";
         "    sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends openssh-server",
         "  fi",
         "fi",
-        "sudo -n mkdir -p /home/sprite/.devbox/ssh",
-        `sudo -n chown ${shellEscape(sshUser)}:${shellEscape(sshUser)} /home/sprite/.devbox/ssh`,
-        "sudo -n chmod 700 /home/sprite/.devbox/ssh",
+        `sudo -n mkdir -p ${shellEscape(REMOTE_SSH_DIR)}`,
+        `sudo -n chown ${shellEscape(sshUser)}:${shellEscape(sshUser)} ${shellEscape(REMOTE_SSH_DIR)}`,
+        `sudo -n chmod 700 ${shellEscape(REMOTE_SSH_DIR)}`,
         ...sshUser === "root" ? [] : [
           `account_status=$(sudo -n passwd -S ${shellEscape(sshUser)} 2>/dev/null | awk '{print $2}' || true)`,
           'if [ "$account_status" = "L" ]; then',
@@ -202906,6 +203297,7 @@ ${combined}` : "";
         });
       }
     };
+    getRemoteMountRoot = () => REMOTE_MOUNT_ROOT;
   }
 });
 
@@ -204626,11 +205018,11 @@ ${usageText}`;
 });
 
 // src/devbox/commands/init/codex/artifacts.ts
-var import_node_crypto11, import_node_fs11, import_promises23, import_node_path27, import_node_os14, macCopyfileDisabledEnv, SETUP_ARTIFACT_PART_SIZE_BYTES, SETUP_ARTIFACT_PARTS_DIRNAME, SETUP_ARTIFACT_PARTS_DESCRIPTOR_FILENAME, isWithinRepo, normalizeExternalPath, expandHomePath, buildArtifactEntry, buildEntries, copyArtifact, sha256File, readSetupArtifactsPartsDescriptor, createSetupArtifacts;
+var import_node_crypto12, import_node_fs11, import_promises23, import_node_path27, import_node_os14, macCopyfileDisabledEnv, SETUP_ARTIFACT_PART_SIZE_BYTES, SETUP_ARTIFACT_PARTS_DIRNAME, SETUP_ARTIFACT_PARTS_DESCRIPTOR_FILENAME, isWithinRepo, normalizeExternalPath, expandHomePath, buildArtifactEntry, buildEntries, copyArtifact, sha256File, readSetupArtifactsPartsDescriptor, createSetupArtifacts;
 var init_artifacts = __esm({
   "src/devbox/commands/init/codex/artifacts.ts"() {
     "use strict";
-    import_node_crypto11 = require("node:crypto");
+    import_node_crypto12 = require("node:crypto");
     import_node_fs11 = require("node:fs");
     import_promises23 = __toESM(require("node:fs/promises"), 1);
     import_node_path27 = __toESM(require("node:path"), 1);
@@ -204740,7 +205132,7 @@ var init_artifacts = __esm({
       await import_promises23.default.cp(entry.sourcePath, destPath, { recursive: false });
     };
     sha256File = async (filePath) => await new Promise((resolve2, reject) => {
-      const hash = (0, import_node_crypto11.createHash)("sha256");
+      const hash = (0, import_node_crypto12.createHash)("sha256");
       const stream = (0, import_node_fs11.createReadStream)(filePath);
       stream.on("data", (chunk) => hash.update(chunk));
       stream.on("error", reject);
@@ -205143,12 +205535,12 @@ var init_progress = __esm({
 });
 
 // src/devbox/commands/init/codex/index.ts
-var import_node_path28, import_node_crypto12, import_promises24, import_node_os15, resolveLocalCodexRoot, readLocalCodexAuthCache, syncLocalCodexAuthCacheToSprite, uploadSetupPlan, runRemoteCodexSetup;
+var import_node_path28, import_node_crypto13, import_promises24, import_node_os15, resolveLocalCodexRoot, readLocalCodexAuthCache, syncLocalCodexAuthCacheToSprite, uploadSetupPlan, runRemoteCodexSetup;
 var init_codex = __esm({
   "src/devbox/commands/init/codex/index.ts"() {
     "use strict";
     import_node_path28 = __toESM(require("node:path"), 1);
-    import_node_crypto12 = require("node:crypto");
+    import_node_crypto13 = require("node:crypto");
     import_promises24 = __toESM(require("node:fs/promises"), 1);
     import_node_os15 = require("node:os");
     init_dist5();
@@ -205389,7 +205781,7 @@ var init_codex = __esm({
       }
       if (splitArtifacts && remoteArtifactsBundlePath) {
         status.stage("Assembling artifacts on remote");
-        const assembledTmpPath = `${remoteArtifactsBundlePath}.tmp-assemble-${(0, import_node_crypto12.randomUUID)()}`;
+        const assembledTmpPath = `${remoteArtifactsBundlePath}.tmp-assemble-${(0, import_node_crypto13.randomUUID)()}`;
         const assembleScript = [
           "set -euo pipefail",
           `bundle=${shellQuote4(remoteArtifactsBundlePath)}`,
@@ -205591,7 +205983,7 @@ codex login`
         entrypoints
       });
       const codexLastMessagePath = "/home/sprite/.devbox/codex-setup-output.txt";
-      const proxyRoot = proxyOptions ? `/home/sprite/.devbox/tmp/codex-proxy-${(0, import_node_crypto12.randomUUID)()}` : null;
+      const proxyRoot = proxyOptions ? `/home/sprite/.devbox/tmp/codex-proxy-${(0, import_node_crypto13.randomUUID)()}` : null;
       const proxyTokenPath = proxyRoot ? `${proxyRoot}/devbox-token` : null;
       const proxyCodexHome = proxyRoot ? `${proxyRoot}/codex-home` : null;
       const proxyConfigPath = proxyCodexHome ? `${proxyCodexHome}/config.toml` : null;
@@ -206620,7 +207012,6 @@ var init_setupPlanFlow = __esm({
             }
             outsideRepoPaths.sort();
             directoryPaths.sort();
-            const hasRisk = outsideRepoPaths.length > 0 || directoryPaths.length > 0;
             const warningLines = [];
             if (outsideRepoPaths.length > 0) {
               warningLines.push("Outside repo:");
@@ -206637,8 +207028,7 @@ var init_setupPlanFlow = __esm({
             }
             return {
               summary: lines.join("\n"),
-              warning: warningLines.length > 0 ? warningLines.join("\n") : null,
-              hasRisk
+              warning: warningLines.length > 0 ? warningLines.join("\n") : null
             };
           };
           let draftSetup = setupPlan;
@@ -206653,7 +207043,7 @@ var init_setupPlanFlow = __esm({
               initialSelection: draftSetup?.services ?? null
             });
             const nextPlan = { ...nextSetup, services: nextServices };
-            const { summary, warning, hasRisk } = await buildApprovalSummary(nextPlan);
+            const { summary, warning } = await buildApprovalSummary(nextPlan);
             kt2(summary, "Selected setup requirements");
             if (warning) {
               kt2(warning, "Special attention");
@@ -206674,21 +207064,6 @@ var init_setupPlanFlow = __esm({
               draftSetup = nextPlan;
               continue;
             }
-            if (hasRisk) {
-              const confirmed = await Mt2({
-                message: "You selected items outside the repo and/or directories. Continue?",
-                active: "Continue",
-                inactive: "Edit selections",
-                initialValue: true
-              });
-              if (Ct(confirmed)) {
-                throwInitCanceled2();
-              }
-              if (!confirmed) {
-                draftSetup = nextPlan;
-                continue;
-              }
-            }
             approvedPlan = nextPlan;
             break;
           }
@@ -207220,11 +207595,11 @@ var init_provisionFlow = __esm({
 });
 
 // src/devbox/commands/init/ssh.ts
-var import_node_crypto13, import_node_child_process10, logger9, SSH_IDENTITY_FILE, SSH_ED25519_PUBLIC_KEY_PATTERN, stripGitSuffix2, buildSshUrl, buildSettingsUrl, parseScpLike, parseGitRemote, execRemote, extractEd25519PublicKey, readRemoteOrigin, setRemoteOrigin, ensureSshKey, ensureSshConfig, verifySshAuth, openBrowser4, runClipboardCommand, copyToClipboard;
+var import_node_crypto14, import_node_child_process10, logger9, SSH_IDENTITY_FILE, SSH_ED25519_PUBLIC_KEY_PATTERN, stripGitSuffix2, buildSshUrl, buildSettingsUrl, parseScpLike, parseGitRemote, execRemote, extractEd25519PublicKey, readRemoteOrigin, setRemoteOrigin, ensureSshKey, ensureSshConfig, verifySshAuth, openBrowser4, runClipboardCommand, copyToClipboard;
 var init_ssh = __esm({
   "src/devbox/commands/init/ssh.ts"() {
     "use strict";
-    import_node_crypto13 = require("node:crypto");
+    import_node_crypto14 = require("node:crypto");
     import_node_child_process10 = require("node:child_process");
     init_src();
     init_remote();
@@ -207306,7 +207681,7 @@ var init_ssh = __esm({
       return null;
     };
     execRemote = async (client2, spriteAlias, script, stage) => {
-      const requestId = (0, import_node_crypto13.randomUUID)();
+      const requestId = (0, import_node_crypto14.randomUUID)();
       logger9.info("sprites_request", {
         requestId,
         method: "exec",
@@ -207844,13 +208219,15 @@ var init_finalizeFlow = __esm({
     promptBeforeOpenBrowser = async ({
       url,
       title,
+      promptMessage,
       consequence,
       throwInitCanceled: throwInitCanceled2
     }) => {
       if (!process.stdin.isTTY) return false;
       showCopyableUrl(url, title);
+      const message = typeof promptMessage === "string" && promptMessage.trim().length > 0 ? promptMessage : `Open ${title} in your browser?`;
       const choice = await qt({
-        message: `Open ${title} in your browser?`,
+        message,
         options: [
           { value: "open", label: "Open in browser" },
           { value: "skip", label: "Skip" }
@@ -208176,9 +208553,11 @@ var init_finalizeFlow = __esm({
               } else {
                 R2.warn("Could not copy the SSH key automatically.");
               }
+              const openBrowserPromptMessage = copied ? `Open ${remoteInfo.host} SSH key page in your browser? (SSH key copied to clipboard; paste it into the key box, then click "Add SSH key".)` : `Open ${remoteInfo.host} SSH key page in your browser?`;
               const shouldOpen = await promptBeforeOpenBrowser({
                 url: remoteInfo.settingsUrl,
                 title: `${remoteInfo.host} SSH key page`,
+                promptMessage: openBrowserPromptMessage,
                 consequence: [
                   "Skipping browser open.",
                   "You must add the SSH key before git pull/push will work via SSH."
@@ -209913,7 +210292,8 @@ var init_init = __esm({
                 title: "Ensuring daemon service",
                 fn: async () => await ensureSpriteDaemonService({
                   client: client2,
-                  spriteName: alias
+                  spriteName: alias,
+                  computeProvider
                 })
               });
               await updateInitState({ steps: { daemonServiceEnsured: true } });
@@ -210485,7 +210865,7 @@ var init_logout = __esm({
 });
 
 // src/devbox/commands/mount.ts
-var import_node_child_process11, import_promises29, import_node_os19, import_node_path35, parseMountArgs, resolveMountDir, commandExists, ensureLocalDependencies, resolveSpriteAlias, runCommand5, forwardSshPort, stopSshPort, unmount, runMount, runUnmount;
+var import_node_child_process11, import_promises29, import_node_os19, import_node_path35, parseMountArgs, resolveMountDir, commandExists, ensureLocalDependencies, resolveSpritesMountRuntimeClient, resolveModalMountRuntimeClient, resolveMountRuntimeClient, resolveSpriteAlias, runCommand5, forwardSshPort, stopSshPort, resolveMountProviderTarget, unmount, runMount, runUnmount;
 var init_mount = __esm({
   "src/devbox/commands/mount.ts"() {
     "use strict";
@@ -210499,7 +210879,10 @@ var init_mount = __esm({
     init_logger3();
     init_boxSelect();
     init_commandProvider();
+    init_modalRuntime();
     init_mountSsh();
+    init_modalCommandContext();
+    init_modalLifecycle();
     parseMountArgs = (args) => {
       const parsed = {};
       for (const arg of args) {
@@ -210530,6 +210913,86 @@ var init_mount = __esm({
         throw new Error("Missing ssh client.");
       }
     };
+    resolveSpritesMountRuntimeClient = async () => {
+      const config4 = await loadConfig(
+        process.env.HOME ? { homeDir: process.env.HOME } : void 0
+      );
+      const store = await createSecretStore(
+        config4?.tokenStore,
+        process.env.HOME ? { homeDir: process.env.HOME } : void 0
+      );
+      const apiBaseUrl = resolveSpritesApiUrl(config4);
+      const { token } = await ensureSpritesToken(store, void 0, {
+        apiBaseUrl
+      });
+      return createSpritesClient({ apiBaseUrl, token });
+    };
+    resolveModalMountRuntimeClient = async (options, dependencies = {}) => {
+      const resolveModalContext = dependencies.resolveModalContext ?? resolveModalCommandContext;
+      const findSandbox = dependencies.findSandbox ?? findModalSandbox;
+      const createRuntimeClient = dependencies.createRuntimeClient ?? createModalInitRuntimeClient;
+      const modalContext = await resolveModalContext({
+        alias: options.alias,
+        cwd: options.cwd
+      });
+      const sandbox = await findSandbox(
+        {
+          alias: options.alias,
+          includeFinished: true
+        },
+        modalContext.operationOptions
+      );
+      let appName = sandbox?.appName ?? "";
+      let sandboxId = sandbox?.sandboxId ?? "";
+      if (!sandbox || sandbox.status !== "running") {
+        try {
+          const ensured = await modalContext.ensureActive("proxy");
+          appName = ensured.appName;
+          sandboxId = ensured.sandboxId;
+        } catch (error2) {
+          const reason = error2 instanceof Error ? error2.message : String(error2);
+          if (!sandbox) {
+            throw new Error(
+              `No running modal sandbox found named "${options.targetBox}" and it could not be resumed for mount.
+
+${reason}`
+            );
+          }
+          throw new Error(
+            `Modal sandbox "${options.targetBox}" is ${sandbox.status} and could not be resumed for mount.
+
+${reason}`
+          );
+        }
+      }
+      return createRuntimeClient({
+        alias: options.alias,
+        appName,
+        sandboxId,
+        credentialMode: modalContext.operationOptions.credentialMode,
+        credentials: modalContext.operationOptions.credentials,
+        ...modalContext.operationOptions.cwd ? { cwd: modalContext.operationOptions.cwd } : {},
+        ensureActive: async (intent) => {
+          const ensured = await modalContext.ensureActive(intent);
+          return {
+            appName: ensured.appName,
+            sandboxId: ensured.sandboxId
+          };
+        }
+      });
+    };
+    resolveMountRuntimeClient = async (options, dependencies = {}) => {
+      if (options.provider === "modal") {
+        const resolveModalRuntimeClient = dependencies.resolveModalRuntimeClient ?? (async (modalOptions) => await resolveModalMountRuntimeClient(modalOptions));
+        return await resolveModalRuntimeClient({
+          alias: options.alias,
+          targetBox: options.targetBox,
+          cwd: options.cwd
+        });
+      }
+      const resolveSpritesRuntimeClient = dependencies.resolveSpritesRuntimeClient ?? resolveSpritesMountRuntimeClient;
+      return await resolveSpritesRuntimeClient();
+    };
     resolveSpriteAlias = async (_socketPath, box) => box;
     runCommand5 = (command, args, options = {}) => new Promise((resolve2, reject) => {
       const child = (0, import_node_child_process11.spawn)(command, args, {
@@ -210568,28 +211031,8 @@ var init_mount = __esm({
         throw new Error(`dvbd error: ${response.status}`);
       }
     };
-    unmount = async (mountDir) => {
-      const command = process.platform === "darwin" ? "diskutil" : "umount";
-      const args = process.platform === "darwin" ? ["unmount", mountDir] : [mountDir];
-      const exitCode = await runCommand5(command, args);
-      if (exitCode !== 0) {
-        throw new Error(`Failed to unmount ${mountDir}`);
-      }
-    };
-    runMount = async (args) => {
-      const parsed = parseMountArgs(args);
-      let targetBox = parsed.box;
-      if (!targetBox) {
-        const selected = await selectDevbox(
-          "Use `dvb mount <box>` to target a specific box."
-        );
-        if (!selected) return;
-        targetBox = selected.box;
-      }
-      const socketInfo = resolveSocketInfo();
-      await ensureDaemonRunning(socketInfo.socketPath);
-      await requireDaemonFeatures(socketInfo.socketPath, ["ports.forward"]);
-      let spriteAlias = await resolveSpriteAlias(socketInfo.socketPath, targetBox);
+    resolveMountProviderTarget = async (socketPath, targetBox) => {
+      const spriteAlias = await resolveSpriteAlias(socketPath, targetBox);
       let providerLookupBoxes = null;
       try {
         providerLookupBoxes = await listDevboxes();
@@ -210599,14 +211042,14 @@ var init_mount = __esm({
           error: String(error2)
         });
       }
-      const providerTarget = await resolveCommandComputeProvider({
+      return await resolveCommandComputeProvider({
         box: spriteAlias,
         boxes: providerLookupBoxes,
         homeDir: process.env.HOME ?? import_node_os19.default.homedir(),
         persistAssumedComputeProvider: async ({ alias, computeProvider }) => {
           try {
             const response = await requestJson3(
-              socketInfo.socketPath,
+              socketPath,
               "POST",
               "/registry/upsert",
               DAEMON_TIMEOUT_MS.registry,
@@ -210632,26 +211075,49 @@ var init_mount = __esm({
           }
         }
       });
+    };
+    unmount = async (mountDir) => {
+      const command = process.platform === "darwin" ? "diskutil" : "umount";
+      const args = process.platform === "darwin" ? ["unmount", mountDir] : [mountDir];
+      const exitCode = await runCommand5(command, args);
+      if (exitCode !== 0) {
+        throw new Error(`Failed to unmount ${mountDir}`);
+      }
+    };
+    runMount = async (args) => {
+      const parsed = parseMountArgs(args);
+      let targetBox = parsed.box;
+      if (!targetBox) {
+        const selected = await selectDevbox(
+          "Use `dvb mount <box>` to target a specific box."
+        );
+        if (!selected) return;
+        targetBox = selected.box;
+      }
+      const socketInfo = resolveSocketInfo();
+      await ensureDaemonRunning(socketInfo.socketPath);
+      await requireDaemonFeatures(socketInfo.socketPath, ["ports.forward"]);
+      const providerTarget = await resolveMountProviderTarget(
+        socketInfo.socketPath,
+        targetBox
+      );
       assertCommandProviderCapability({
         provider: providerTarget.computeProvider,
         command: "mount",
         capability: "files.read"
       });
-      spriteAlias = providerTarget.alias;
+      const spriteAlias = providerTarget.alias;
       ensureLocalDependencies();
-      const config4 = await loadConfig(
-        process.env.HOME ? { homeDir: process.env.HOME } : void 0
-      );
-      const store = await createSecretStore(
-        config4?.tokenStore,
-        process.env.HOME ? { homeDir: process.env.HOME } : void 0
-      );
-      const apiBaseUrl = resolveSpritesApiUrl(config4);
-      const { token } = await ensureSpritesToken(store, void 0, { apiBaseUrl });
-      const client2 = createSpritesClient({ apiBaseUrl, token });
+      const client2 = await resolveMountRuntimeClient({
+        provider: providerTarget.computeProvider,
+        alias: spriteAlias,
+        targetBox,
+        cwd: process.cwd()
+      });
       const { privateKeyPath } = await ensureLocalMountKey();
       const publicKey = await readLocalMountPublicKey();
       const knownHostsPath = await ensureKnownHostsFile();
+      await ensureRemoteMountRoot(client2, spriteAlias);
       const remoteMountAccess = await ensureRemoteMountAccess(
         client2,
         spriteAlias,
@@ -210672,12 +211138,24 @@ var init_mount = __esm({
         "StrictHostKeyChecking=accept-new",
         "-p",
         String(localPort),
-        `${remoteMountAccess.sshUser}@localhost:/home/sprite`,
+        `${remoteMountAccess.sshUser}@localhost:${getRemoteMountRoot()}`,
         mountDir
       ];
-      const exitCode = await runCommand5("sshfs", sshfsArgs);
-      if (exitCode !== 0) {
-        throw new Error("sshfs failed to mount.");
+      try {
+        const exitCode = await runCommand5("sshfs", sshfsArgs);
+        if (exitCode !== 0) {
+          throw new Error("sshfs failed to mount.");
+        }
+      } catch (error2) {
+        try {
+          await stopSshPort(socketInfo.socketPath, spriteAlias);
+        } catch (stopError) {
+          logger7.warn("mount_forward_cleanup_failed", {
+            box: spriteAlias,
+            error: String(stopError)
+          });
+        }
+        throw error2;
       }
       console.log(`Mounted ${spriteAlias} at ${mountDir}`);
     };
@@ -210694,10 +211172,11 @@ var init_mount = __esm({
       const socketInfo = resolveSocketInfo();
       await ensureDaemonRunning(socketInfo.socketPath);
       await requireDaemonFeatures(socketInfo.socketPath, ["ports.forward"]);
-      const spriteAlias = await resolveSpriteAlias(
+      const providerTarget = await resolveMountProviderTarget(
         socketInfo.socketPath,
         targetBox
       );
+      const spriteAlias = providerTarget.alias;
       const mountDir = resolveMountDir(spriteAlias);
       await unmount(mountDir);
       await stopSshPort(socketInfo.socketPath, spriteAlias);
@@ -211303,16 +211782,20 @@ var init_uninstall = __esm({
 });
 
 // src/devbox/commands/sessions.ts
-var renameUsage, killUsage, listUsage, parseSessionsArgs, parseSessionTarget, parseKillTarget, runRename, runKill, runSessions;
+var import_node_os21, renameUsage, killUsage, listUsage, parseSessionsArgs, parseSessionTarget, parseKillTarget, loadBoxesSnapshot, resolveSessionsClient, runRename, runKill, runSessions;
 var init_sessions2 = __esm({
   "src/devbox/commands/sessions.ts"() {
     "use strict";
+    import_node_os21 = __toESM(require("node:os"), 1);
     init_src();
     init_daemonClient();
     init_auth();
     init_colors();
     init_listFormatting();
     init_boxSelect();
+    init_commandProvider();
+    init_providerClient();
+    init_modalLifecycle();
     init_sessionUtils();
     init_completions();
     renameUsage = "Usage: dvb sessions rename <session> -n <name> or dvb sessions rename <box>/<session> -n <name>";
@@ -211412,24 +211895,89 @@ var init_sessions2 = __esm({
       }
       return { box, session };
     };
-    runRename = async (target2, name) => {
-      const trimmed = name.trim();
-      if (!trimmed) {
-        throw new Error("Session name cannot be empty.");
-      }
-      const parsedTarget = parseSessionTarget(target2);
-      let targetBox = parsedTarget.box;
-      if (!targetBox) {
-        const selected = await selectDevbox(
-          "To rename a session on a specific box, use `dvb sessions rename <box>/<session> -n <name>`."
+    loadBoxesSnapshot = async (socketPath) => {
+      try {
+        const response = await requestJson3(
+          socketPath,
+          "GET",
+          "/boxes",
+          DAEMON_TIMEOUT_MS.registry
         );
-        if (!selected) return;
-        targetBox = selected.box;
+        if (response.status !== 200) {
+          return null;
+        }
+        return response.body.boxes;
+      } catch {
+        return null;
       }
+    };
+    resolveSessionsClient = async (targetBox) => {
       const socketInfo = resolveSocketInfo();
       await ensureDaemonRunning(socketInfo.socketPath);
       await requireDaemonFeatures(socketInfo.socketPath, ["registry"]);
-      const spriteAlias = targetBox;
+      const boxes = await loadBoxesSnapshot(socketInfo.socketPath);
+      const providerTarget = await resolveCommandComputeProvider({
+        box: targetBox,
+        ...boxes ? { boxes } : {},
+        homeDir: process.env.HOME ?? import_node_os21.default.homedir()
+      });
+      const spriteAlias = providerTarget.alias;
+      if (providerTarget.computeProvider === "modal") {
+        const config5 = await loadConfig(
+          process.env.HOME ? { homeDir: process.env.HOME } : void 0
+        );
+        const store2 = await createSecretStore(
+          config5?.tokenStore,
+          process.env.HOME ? { homeDir: process.env.HOME } : void 0
+        );
+        const modalCredentialContext = createProviderCredentialContext({
+          mode: "auto",
+          controlPlaneToken: await store2.getControlPlaneToken()
+        });
+        let modalOperationOptions = await resolveModalCommandOperationOptions({
+          credentials: modalCredentialContext,
+          cwd: process.cwd()
+        });
+        if (modalOperationOptions.credentialMode === "shared" && (!modalOperationOptions.credentials.modalTokenId || !modalOperationOptions.credentials.modalTokenSecret)) {
+          const controlPlaneToken = await ensureControlPlaneToken(store2);
+          if (controlPlaneToken) {
+            modalOperationOptions = await resolveModalCommandOperationOptions({
+              credentials: createProviderCredentialContext({
+                mode: "auto",
+                controlPlaneToken
+              }),
+              cwd: process.cwd()
+            });
+          }
+        }
+        const sandbox = await findModalSandbox(
+          {
+            alias: spriteAlias,
+            includeFinished: true
+          },
+          modalOperationOptions
+        );
+        if (!sandbox) {
+          throw new Error(
+            `No modal sandbox found named "${targetBox}". Run "dvb init --compute modal" to create one, or "dvb list" to see existing devboxes.`
+          );
+        }
+        if (sandbox.status !== "running") {
+          throw new Error(
+            `Modal sandbox "${targetBox}" is ${sandbox.status}. Run "dvb init --resume" to reprovision it.`
+          );
+        }
+        return {
+          spriteAlias,
+          computeProvider: "modal",
+          client: createModalConnectSpritesClient({
+            alias: spriteAlias,
+            appName: sandbox.appName,
+            sandboxId: sandbox.sandboxId,
+            operationOptions: modalOperationOptions
+          })
+        };
+      }
       const config4 = await loadConfig(
         process.env.HOME ? { homeDir: process.env.HOME } : void 0
       );
@@ -211439,7 +211987,27 @@ var init_sessions2 = __esm({
       );
       const apiBaseUrl = resolveSpritesApiUrl(config4);
       const { token } = await ensureSpritesToken(store, void 0, { apiBaseUrl });
-      const client2 = createSpritesClient({ apiBaseUrl, token });
+      return {
+        spriteAlias,
+        computeProvider: "sprites",
+        client: createSpritesClient({ apiBaseUrl, token })
+      };
+    };
+    runRename = async (target2, name) => {
+      const trimmed = name.trim();
+      if (!trimmed) {
+        throw new Error("Session name cannot be empty.");
+      }
+      const parsedTarget = parseSessionTarget(target2);
+      let targetBox = parsedTarget.box;
+      if (!targetBox) {
+        const selected = await selectDevbox(
+          "To rename a session on a specific box, use `dvb sessions rename <box>/<session> -n <name>`."
+        );
+        if (!selected) return;
+        targetBox = selected.box;
+      }
+      const { spriteAlias, client: client2 } = await resolveSessionsClient(targetBox);
       const sessions = await readSpriteSessions(client2, spriteAlias);
       const sessionId = sessions[parsedTarget.session];
       if (!sessionId) {
@@ -211472,20 +212040,7 @@ var init_sessions2 = __esm({
         if (!selected) return;
         targetBox = selected.box;
       }
-      const socketInfo = resolveSocketInfo();
-      await ensureDaemonRunning(socketInfo.socketPath);
-      await requireDaemonFeatures(socketInfo.socketPath, ["registry"]);
-      const spriteAlias = targetBox;
-      const config4 = await loadConfig(
-        process.env.HOME ? { homeDir: process.env.HOME } : void 0
-      );
-      const store = await createSecretStore(
-        config4?.tokenStore,
-        process.env.HOME ? { homeDir: process.env.HOME } : void 0
-      );
-      const apiBaseUrl = resolveSpritesApiUrl(config4);
-      const { token } = await ensureSpritesToken(store, void 0, { apiBaseUrl });
-      const client2 = createSpritesClient({ apiBaseUrl, token });
+      const { spriteAlias, client: client2 } = await resolveSessionsClient(targetBox);
       const sessionRef = parsedTarget.session;
       const sessions = await readSpriteSessions(client2, spriteAlias);
       let sessionId = sessions[sessionRef];
@@ -211560,24 +212115,31 @@ var init_sessions2 = __esm({
         if (!selected) return;
         targetArg = selected.box;
       }
+      const { spriteAlias, client: client2 } = await resolveSessionsClient(targetArg);
       const socketInfo = resolveSocketInfo();
       await ensureDaemonRunning(socketInfo.socketPath);
-      await requireDaemonFeatures(socketInfo.socketPath, ["registry", "ports"]);
-      const spriteAlias = targetArg;
-      const config4 = await loadConfig(
-        process.env.HOME ? { homeDir: process.env.HOME } : void 0
-      );
-      const store = await createSecretStore(
-        config4?.tokenStore,
-        process.env.HOME ? { homeDir: process.env.HOME } : void 0
-      );
-      const apiBaseUrl = resolveSpritesApiUrl(config4);
-      const { token } = await ensureSpritesToken(store, void 0, { apiBaseUrl });
-      const client2 = createSpritesClient({ apiBaseUrl, token });
-      const [sessions, sessionMap, portsResponse] = await Promise.all([
+      const readPortsSnapshot = async () => {
+        try {
+          await requireDaemonFeatures(socketInfo.socketPath, ["ports"]);
+          const response = await requestJson3(socketInfo.socketPath, "GET", "/ports", DAEMON_TIMEOUT_MS.quick);
+          if (response.status < 200 || response.status >= 300) {
+            return {
+              forwards: [],
+              detected: []
+            };
+          }
+          return response.body;
+        } catch {
+          return {
+            forwards: [],
+            detected: []
+          };
+        }
+      };
+      const [sessions, sessionMap, portsSnapshot] = await Promise.all([
         client2.listExecSessions(spriteAlias),
         readSpriteSessions(client2, spriteAlias),
-        requestJson3(socketInfo.socketPath, "GET", "/ports", DAEMON_TIMEOUT_MS.quick)
+        readPortsSnapshot()
       ]);
       const idToName = /* @__PURE__ */ new Map();
       for (const [name, id] of Object.entries(sessionMap)) {
@@ -211598,10 +212160,10 @@ var init_sessions2 = __esm({
         return view;
       });
       const ports = {
-        forwards: portsResponse.body.forwards.filter(
+        forwards: portsSnapshot.forwards.filter(
           (entry) => entry.box === spriteAlias
         ),
-        detected: portsResponse.body.detected.filter(
+        detected: portsSnapshot.detected.filter(
           (entry) => entry.box === spriteAlias
         )
       };
@@ -213462,11 +214024,11 @@ var init_qr = __esm({
 });
 
 // src/devbox/commands/setup.ts
-var import_node_crypto14, trim, normalizeOrgSlug, extractOrgFromSpriteToken, parseCodexAuthMode, parseSpriteAuthMode, resolveSpriteAuthMode, normalizeSiteUrl, resolveSiteUrl, MOBILE_DOWNLOAD_LINK, parseSetupArgs, splitQrLines, printMobileDownloadQr, printFirstSetupCompleteMessage, normalizeUrlForCompare, resolveCliName3, formatSpritesApiError, probeSpritesAccess, runSetup;
+var import_node_crypto15, trim, normalizeOrgSlug, extractOrgFromSpriteToken, parseCodexAuthMode, parseSpriteAuthMode, resolveSpriteAuthMode, normalizeSiteUrl, resolveSiteUrl, MOBILE_DOWNLOAD_LINK, parseSetupArgs, splitQrLines, printMobileDownloadQr, printFirstSetupCompleteMessage, normalizeUrlForCompare, resolveCliName3, formatSpritesApiError, probeSpritesAccess, runSetup;
 var init_setup = __esm({
   "src/devbox/commands/setup.ts"() {
     "use strict";
-    import_node_crypto14 = require("node:crypto");
+    import_node_crypto15 = require("node:crypto");
     init_src();
     init_src();
     init_auth();
@@ -213663,7 +214225,7 @@ var init_setup = __esm({
       return lines.join("\n");
     };
     probeSpritesAccess = async (apiBaseUrl, token) => {
-      const requestId = (0, import_node_crypto14.randomUUID)();
+      const requestId = (0, import_node_crypto15.randomUUID)();
       const url = new URL("/v1/sprites", apiBaseUrl);
       url.searchParams.set("max_results", "1");
       logger7.info("sprites_request", {
@@ -214260,14 +214822,14 @@ var init_whoami = __esm({
 });
 
 // src/devbox/commands/wezterm.ts
-var import_node_crypto15, import_node_child_process12, import_promises32, import_node_os21, import_node_path38, import_promises33, logger10, WEZTERM_APP_PATH, WEZTERM_BIN_PATH, WEZTERM_BIN_DIR, WEZTERM_INSTALL_URL, WEZTERM_PATH_EXPORT, WEZTERM_HEALTH_POLL_INTERVAL_MS, WEZTERM_HEALTH_POLL_TIMEOUT_MS, WEZTERM_PROXY_BASE_ENV, WEZTERM_PROXY_LOG_NAME, WEZTERM_USAGE, parseWeztermArgs, resolveSpriteAlias3, initWeztermClient, waitForWeztermMuxHealthy, ensureWeztermMuxReady, runWeztermProxy, runCommand6, promptYesNo2, fileExists, hasWeztermOnPath, resolveShellProfilePath, ensureWeztermOnPath, ensureWeztermInstalled, expandPath, resolveDefaultConfigPath, escapeRegExp2, resolveCliName4, resolveDvbCommand, formatLuaArgs, resolveWeztermProxyEnv, buildProxyCommand, buildDomainBlock, canAppendToConfig, countReturns, applyReturnTableTransform, insertBlock, runWeztermSetup, startWeztermDomain, runWezterm;
+var import_node_crypto16, import_node_child_process12, import_promises32, import_node_os22, import_node_path38, import_promises33, logger10, WEZTERM_APP_PATH, WEZTERM_BIN_PATH, WEZTERM_BIN_DIR, WEZTERM_INSTALL_URL, WEZTERM_PATH_EXPORT, WEZTERM_HEALTH_POLL_INTERVAL_MS, WEZTERM_HEALTH_POLL_TIMEOUT_MS, WEZTERM_PROXY_BASE_ENV, WEZTERM_PROXY_LOG_NAME, WEZTERM_USAGE, parseWeztermArgs, resolveSpriteAlias3, initWeztermClient, waitForWeztermMuxHealthy, ensureWeztermMuxReady, runWeztermProxy, runCommand6, promptYesNo2, fileExists, hasWeztermOnPath, resolveShellProfilePath, ensureWeztermOnPath, ensureWeztermInstalled, expandPath, resolveDefaultConfigPath, escapeRegExp2, resolveCliName4, resolveDvbCommand, formatLuaArgs, resolveWeztermProxyEnv, buildProxyCommand, buildDomainBlock, canAppendToConfig, countReturns, applyReturnTableTransform, insertBlock, runWeztermSetup, startWeztermDomain, runWezterm;
 var init_wezterm = __esm({
   "src/devbox/commands/wezterm.ts"() {
     "use strict";
-    import_node_crypto15 = require("node:crypto");
+    import_node_crypto16 = require("node:crypto");
     import_node_child_process12 = require("node:child_process");
     import_promises32 = __toESM(require("node:fs/promises"), 1);
-    import_node_os21 = __toESM(require("node:os"), 1);
+    import_node_os22 = __toESM(require("node:os"), 1);
     import_node_path38 = __toESM(require("node:path"), 1);
     import_promises33 = __toESM(require("node:readline/promises"), 1);
     init_src();
@@ -214454,7 +215016,7 @@ var init_wezterm = __esm({
     runWeztermProxy = async (box, port, options) => {
       const writeProxyLog = async (message) => {
         if (process.env.DEVBOX_WEZTERM_PROXY !== "1") return;
-        const homeDir = import_node_os21.default.homedir();
+        const homeDir = import_node_os22.default.homedir();
         if (!homeDir) return;
         try {
           const logDir = import_node_path38.default.join(resolveDevboxDir(homeDir), "wezterm");
@@ -214475,7 +215037,7 @@ var init_wezterm = __esm({
       await writeProxyLog(
         `proxy_ready box=${spriteAlias} setup=${skipSetup ? "skip" : "full"}`
       );
-      const requestId = (0, import_node_crypto15.randomUUID)();
+      const requestId = (0, import_node_crypto16.randomUUID)();
       const proxyPath = `/v1/sprites/${spriteAlias}/proxy`;
       logger10.info("sprites_request", {
         requestId,
@@ -215374,7 +215936,7 @@ var init_cli = __esm({
 
 // src/bin/dvb.ts
 var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_os22 = __toESM(require("node:os"), 1);
+var import_node_os23 = __toESM(require("node:os"), 1);
 var import_node_path40 = __toESM(require("node:path"), 1);
 init_src();
 var MIN_NODE_MAJOR = 24;
@@ -215456,7 +216018,7 @@ run().catch(async (error2) => {
   await flushDevboxTelemetry();
   const message = formatErrorMessage(error2);
   if (process.env.DEVBOX_WEZTERM_PROXY === "1") {
-    const homeDir = import_node_os22.default.homedir();
+    const homeDir = import_node_os23.default.homedir();
     if (homeDir) {
       try {
         const logDir = import_node_path40.default.join(resolveDevboxDir(homeDir), "wezterm");
@@ -215556,4 +216118,4 @@ smol-toml/dist/index.js:
 */
 //# sourceMappingURL=dvb.cjs.map
 
-//# debugId=5b27d1b2-cb5a-5370-b4ca-61330f7946e5
+//# debugId=4d4f5269-c2cd-5397-a6d4-993b4d24cfdc