@gamecrate/cli 1.4.1 → 2.0.0

package/dist/gamecrate.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { chown, cp, mkdir as mkdir6, readdir as readdir11, readFile as readFile12, rm as rm5, rmdir, stat as stat6, writeFile as writeFile7 } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
-import { basename as basename11, dirname as dirname10, join as join22 } from "node:path";
-import { setTimeout as sleep7 } from "node:timers/promises";
+import { existsSync as existsSync15 } from "node:fs";
+import { chown, cp, mkdir as mkdir6, readdir as readdir11, readFile as readFile13, rm as rm5, rmdir, stat as stat6, writeFile as writeFile7 } from "node:fs/promises";
+import { homedir as homedir7 } from "node:os";
+import { basename as basename11, dirname as dirname13, join as join27 } from "node:path";
+import { setTimeout as sleep8 } from "node:timers/promises";
 
 // src/cli/args.ts
 import { Command, CommanderError, Option } from "commander";
@@ -59,7 +59,9 @@ var RESERVED_NAMES = [
   "wait",
   "add",
   "rm",
-  "sync"
+  "sync",
+  "steam",
+  "login"
 ];
 var NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function own(bag, key) {
@@ -94,7 +96,8 @@ var RUN_FLAGS = [
   "--worktree",
   "--no-worktree",
   "--instance",
-  "--use"
+  "--use",
+  "--image"
 ];
 var SUBCOMMANDS = [
   {
@@ -201,6 +204,29 @@ var SUBCOMMANDS = [
     positionals: ["game"],
     flags: ["--pull"]
   },
+  {
+    name: "steam",
+    summary: "build a game image from steam, or prime a steam session",
+    usage: "build <game> | login",
+    positionals: ["game"],
+    subverbs: {
+      build: ["game"],
+      login: []
+    },
+    flags: [
+      "--variant",
+      "--beta",
+      "--image",
+      "--plugin",
+      "--load",
+      "--push",
+      "--base",
+      "--platform",
+      "--force",
+      "--print",
+      "--username"
+    ]
+  },
   {
     name: "shell",
     summary: "same mounts, bash instead of the game",
@@ -289,13 +315,220 @@ function enumOption(flags, summary, values) {
   const long = flags.split(/[ ,]+/).find((token) => token.startsWith("--"));
   return new Option(flags, summary).choices([...values]).argParser(choice(long, values));
 }
+var OPTIONS = {
+  "--mod": (cmd) => {
+    cmd.option("--mod <id>", "add a mod to the profile set", collect, []);
+  },
+  "--without": (cmd) => {
+    cmd.option("--without <id>", "drop a mod from the resolved set", collect, []);
+  },
+  "--only": (cmd) => {
+    cmd.option("--only <id>", "restrict the resolved set to these mods", collect, []);
+  },
+  "--worktree": (cmd) => {
+    cmd.option("--worktree <path>", "promote mods from this git worktree, in its own instance ($GAMECRATE_WORKTREE)", collect, []);
+  },
+  "--use": (cmd) => {
+    cmd.option("--use <packageId>=<path>", "force one mod to load from this directory, whatever the profile pins", collect, []);
+  },
+  "--no-worktree": (cmd) => {
+    cmd.option("--no-worktree", "ignore the current worktree and $GAMECRATE_WORKTREE");
+  },
+  "--instance": (cmd) => {
+    cmd.option("--instance <name>", "run under a named sub-profile with its own saves, logs and container");
+  },
+  "--mode": (cmd) => {
+    cmd.addOption(enumOption(`--mode <${MODES.join("|")}>`, "how the game is displayed", MODES));
+  },
+  "--marker": (cmd) => {
+    cmd.option("--marker <str>", "exit 0 as soon as this string appears in the log");
+  },
+  "--timeout": (cmd) => {
+    cmd.option("--timeout <seconds>", "bound a marker run, or a headless run with no marker", (v) => seconds("--timeout", v));
+  },
+  "--render-wait": (cmd) => {
+    cmd.option("--render-wait <seconds>", "settle time before a screenshot is taken", (v) => seconds("--render-wait", v));
+  },
+  "--resolution": (cmd) => {
+    cmd.option("--resolution <width>x<height>", "override the game resolution", parseResolution);
+  },
+  "--network": (cmd) => {
+    cmd.addOption(enumOption(`--network <${NETWORK_POLICIES.join("|")}>`, "the container's network mode", NETWORK_POLICIES));
+  },
+  "--log": (cmd) => {
+    cmd.option("--log <path>", "route launch stdout and stderr to one file");
+  },
+  "--pull": (cmd) => {
+    cmd.addOption(enumOption(`--pull <${PULL_POLICIES.join("|")}>`, "when to pull the runtime image", PULL_POLICIES));
+  },
+  "--build": (cmd) => {
+    cmd.option("--build", "build local C# mods before launching");
+  },
+  "--no-build": (cmd) => {
+    cmd.option("--no-build", "never build, even when an assembly is stale");
+  },
+  "--no-stale-check": (cmd) => {
+    cmd.option("--no-stale-check", "do not warn when a mod's sources are newer than its assemblies");
+  },
+  "--replace": (cmd) => {
+    cmd.option("--replace", "stop whatever is holding this profile and instance, then launch");
+  },
+  "--no-replace": (cmd) => {
+    cmd.option("--no-replace", "refuse when this profile and instance are already running");
+  },
+  "--detach": (cmd) => {
+    cmd.option("--detach", "start the run in the background and return the prompt");
+  },
+  "--no-detach": (cmd) => {
+    cmd.option("--no-detach", "stay in the foreground, whatever the profile or project config asks for");
+  },
+  "--supervised": (cmd) => {
+    cmd.addOption(new Option("--supervised <instanceDir>").hideHelp());
+  },
+  "--sort": (cmd) => {
+    cmd.addOption(enumOption(`--sort <${SORTS.join("|")}>`, "load order: the profile order, or a topological sort", SORTS));
+  },
+  "--docker-arg": (cmd) => {
+    cmd.option("--docker-arg <arg>", "one extra argv element for docker run", collect, []);
+  },
+  "--dry-run": (cmd) => {
+    cmd.option("--dry-run", "resolve and validate fully, write nothing");
+  },
+  "--print-plan": (cmd) => {
+    cmd.option("--print-plan", "print the resolved launch plan instead of launching");
+  },
+  "--json": (cmd) => {
+    cmd.option("--json", "machine-readable output");
+  },
+  "--root": (cmd) => {
+    cmd.option("--root", "run as root instead of mapping the host uid");
+  },
+  "--staging": (cmd) => {
+    cmd.option("--staging", "clean: wipe .stage only (the default)");
+  },
+  "--logs": (cmd) => {
+    cmd.option("--logs", "clean: wipe the captured run logs");
+  },
+  "--all": (cmd) => {
+    cmd.option("--all", "clean: wipe the whole profile and the game downloads (needs --yes)");
+  },
+  "--downloads": (cmd) => {
+    cmd.option("--downloads", "clean: wipe this game's workshop downloads, keeping steamcmd");
+  },
+  "--follow": (cmd) => {
+    cmd.option("-f, --follow", "keep printing as the run writes");
+  },
+  "--yes": (cmd) => {
+    cmd.option("-y, --yes", "skip destructive-action confirmation");
+  },
+  "--path": (cmd) => {
+    cmd.option("--path <dir>", "mods add: take the mod from this directory");
+  },
+  "--workshop": (cmd) => {
+    cmd.option("--workshop <id>", "mods add: take the mod from this steam workshop item", workshopId);
+  },
+  "--git": (cmd) => {
+    cmd.option("--git <url>", "mods add: clone the mod from this repository");
+  },
+  "--branch": (cmd) => {
+    cmd.option("--branch <name>", "mods add: track this git branch");
+  },
+  "--tag": (cmd) => {
+    cmd.option("--tag <name>", "mods add: pin this git tag");
+  },
+  "--commit": (cmd) => {
+    cmd.option("--commit <sha>", "mods add: pin this git commit");
+  },
+  "--subdir": (cmd) => {
+    cmd.option("--subdir <path>", "mods add: the mod folder inside the repository");
+  },
+  "--global": (cmd) => {
+    cmd.option("--global", "write to the global config");
+  },
+  "--project": (cmd) => {
+    cmd.option("--project", "write to the project config");
+  },
+  "--force": (cmd) => {
+    cmd.option("--force", "mods add: overwrite an existing entry; steam build: rebuild even when the buildid matches");
+  },
+  "--variant": (cmd) => {
+    cmd.option("--variant <name>", "steam build: only this image variant", collect, []);
+  },
+  "--beta": (cmd) => {
+    cmd.option("--beta <name>", "steam build: only this steam branch", collect, []);
+  },
+  "--plugin": (cmd) => {
+    cmd.option("--plugin <spec>", "steam build: an explicit plugin package", collect, []);
+  },
+  "--image": (cmd) => {
+    cmd.option("--image <ref>", "run: launch this gamecrate-built image; steam build: the target repository");
+  },
+  "--load": (cmd) => {
+    cmd.option("--load", "steam build: load the result into the local docker daemon");
+  },
+  "--push": (cmd) => {
+    cmd.option("--push", "steam build: push the result to a registry");
+  },
+  "--base": (cmd) => {
+    cmd.option("--base <ref>", "steam build: override the published runtime base");
+  },
+  "--platform": (cmd) => {
+    cmd.option("--platform <os/arch>", "steam build: what the manifest claims", "linux/amd64");
+  },
+  "--print": (cmd) => {
+    cmd.option("--print", "steam login: also print the session as base64");
+  },
+  "--username": (cmd) => {
+    cmd.option("--username <name>", "steam login: skip the account name prompt");
+  },
+  "--help": (cmd) => {
+    cmd.option("-h, --help", "this help");
+  }
+};
+function quiet(cmd) {
+  return cmd.exitOverride().helpOption(false).allowExcessArguments(true).showSuggestionAfterError(false).configureOutput({ writeOut: () => {}, writeErr: () => {} });
+}
+function attach(cmd, names) {
+  for (const name of names)
+    OPTIONS[name]?.(cmd);
+  return cmd;
+}
 function buildProgram() {
-  const program = new Command;
-  program.name("gamecrate").exitOverride().helpOption(false).allowExcessArguments(true).showSuggestionAfterError(false).configureOutput({ writeOut: () => {}, writeErr: () => {} }).argument("[args...]").option("--mod <id>", "add a mod to the profile set", collect, []).option("--without <id>", "drop a mod from the resolved set", collect, []).option("--only <id>", "restrict the resolved set to these mods", collect, []).option("--worktree <path>", "promote mods from this git worktree, in its own instance ($GAMECRATE_WORKTREE)", collect, []).option("--use <packageId>=<path>", "force one mod to load from this directory, whatever the profile pins", collect, []).option("--no-worktree", "ignore the current worktree and $GAMECRATE_WORKTREE").option("--instance <name>", "run under a named sub-profile with its own saves, logs and container").addOption(enumOption(`--mode <${MODES.join("|")}>`, "how the game is displayed", MODES)).option("--marker <str>", "exit 0 as soon as this string appears in the log").option("--timeout <seconds>", "bound a marker run, or a headless run with no marker", (v) => seconds("--timeout", v)).option("--render-wait <seconds>", "settle time before a screenshot is taken", (v) => seconds("--render-wait", v)).option("--resolution <width>x<height>", "override the game resolution", parseResolution).addOption(enumOption(`--network <${NETWORK_POLICIES.join("|")}>`, "the container's network mode", NETWORK_POLICIES)).option("--log <path>", "route launch stdout and stderr to one file").addOption(enumOption(`--pull <${PULL_POLICIES.join("|")}>`, "when to pull the runtime image", PULL_POLICIES)).option("--build", "build local C# mods before launching").option("--no-build", "never build, even when an assembly is stale").option("--no-stale-check", "do not warn when a mod's sources are newer than its assemblies").option("--replace", "stop whatever is holding this profile and instance, then launch").option("--no-replace", "refuse when this profile and instance are already running").option("--detach", "start the run in the background and return the prompt").option("--no-detach", "stay in the foreground, whatever the profile or project config asks for").addOption(new Option("--supervised <instanceDir>").hideHelp()).addOption(enumOption(`--sort <${SORTS.join("|")}>`, "load order: the profile order, or a topological sort", SORTS)).option("--docker-arg <arg>", "one extra argv element for docker run", collect, []).option("--dry-run", "resolve and validate fully, write nothing").option("--print-plan", "print the resolved launch plan instead of launching").option("--json", "machine-readable output").option("--root", "run as root instead of mapping the host uid").option("--staging", "clean: wipe .stage only (the default)").option("--logs", "clean: wipe the captured run logs").option("--all", "clean: wipe the whole profile and the game downloads (needs --yes)").option("--downloads", "clean: wipe this game's workshop downloads, keeping steamcmd").option("-f, --follow", "keep printing as the run writes").option("-y, --yes", "skip destructive-action confirmation").option("--path <dir>", "mods add: take the mod from this directory").option("--workshop <id>", "mods add: take the mod from this steam workshop item", workshopId).option("--git <url>", "mods add: clone the mod from this repository").option("--branch <name>", "mods add: track this git branch").option("--tag <name>", "mods add: pin this git tag").option("--commit <sha>", "mods add: pin this git commit").option("--subdir <path>", "mods add: the mod folder inside the repository").option("--global", "write to the global config").option("--project", "write to the project config").option("--force", "overwrite an entry that is already there").option("-h, --help", "this help");
+  const program = quiet(new Command).name("gamecrate").enablePositionalOptions().argument("[args...]");
+  attach(program, [...RUN_FLAGS, ...GLOBAL_FLAGS, "--supervised"]);
+  track(program);
+  for (const sub of SUBCOMMANDS) {
+    if (sub.name === "run")
+      continue;
+    const cmd = quiet(program.command(sub.name)).argument("[args...]");
+    attach(cmd, [...sub.flags, ...GLOBAL_FLAGS]);
+    track(cmd);
+  }
   return program;
 }
+var ACTIVE = new WeakMap;
+function track(cmd) {
+  cmd.action((_args, _opts, self) => {
+    ACTIVE.set(self.parent ?? self, self);
+  });
+}
+function matched(program) {
+  const cmd = ACTIVE.get(program) ?? program;
+  const positional = cmd === program ? [...program.args] : [cmd.name(), ...cmd.args];
+  return { cmd, positional, values: { ...program.opts(), ...cmd.opts() } };
+}
+function allOptions(program) {
+  return [...program.options, ...program.commands.flatMap((c) => c.options)];
+}
+var REFUSALS = {
+  "shell --detach": "shell cannot detach: a shell needs the terminal --detach gives up"
+};
+function ownersOf(name) {
+  const run = RUN_FLAGS.includes(name) ? ["run"] : [];
+  return [...run, ...SUBCOMMANDS.filter((s) => s.name !== "run" && s.flags.includes(name)).map((s) => s.name)];
+}
 function checkValueTokens(program, head) {
-  const valued = (name) => program.options.find((o) => (o.long === name || o.short === name) && (o.required || o.optional));
+  const valued = (name) => allOptions(program).find((o) => (o.long === name || o.short === name) && (o.required || o.optional));
   for (let i = 0;i < head.length; i++) {
     const token = head[i];
     if (!token.startsWith("-") || token === "-")
@@ -334,18 +567,18 @@ function parseArgs(argv, opts = {}) {
   try {
     program.parse(head, { from: "user" });
   } catch (error) {
-    throw translate(error, program);
+    throw translate(error, program, SUBCOMMANDS.some((x) => x.name === head[0]) ? head[0] : undefined);
   }
   checkRepeats(program, counts);
   checkContradictions(seen);
-  const values = program.opts();
-  const envBuild = applyEnv(program, seen, env, values);
+  const { cmd, positional, values } = matched(program);
+  const envBuild = applyEnv(cmd, seen, env, values);
   const out = {
     subcommand: "run",
-    mods: values["mod"],
-    without: values["without"],
-    only: values["only"],
-    dockerArgs: values["dockerArg"],
+    mods: values["mod"] ?? [],
+    without: values["without"] ?? [],
+    only: values["only"] ?? [],
+    dockerArgs: values["dockerArg"] ?? [],
     gameArgs: sep === -1 ? [] : argv.slice(sep + 1),
     dryRun: values["dryRun"] === true,
     printPlan: values["printPlan"] === true,
@@ -363,7 +596,7 @@ function parseArgs(argv, opts = {}) {
     detach: values["detach"] === true,
     noDetach: seen.has("--no-detach"),
     supervised: typeof values["supervised"] === "string",
-    use: values["use"],
+    use: values["use"] ?? [],
     rest: []
   };
   out.mode = values["mode"];
@@ -378,10 +611,20 @@ function parseArgs(argv, opts = {}) {
   out.instance = values["instance"];
   out.build = envBuild ?? policy(values["build"]);
   out.cleanTier = log.cleanTier;
+  out.variant = values["variant"] ?? [];
+  out.branches = values["beta"] ?? [];
+  out.plugin = values["plugin"] ?? [];
+  out.image = values["image"];
+  out.load = values["load"] === true;
+  out.push = values["push"] === true;
+  out.base = values["base"];
+  out.platform = values["platform"] ?? "linux/amd64";
+  out.print = values["print"] === true;
+  out.username = values["username"];
   if (opts.defaults?.game !== undefined)
     out.game = opts.defaults.game;
-  applyPositionals(out, program.args, opts.games, out.help);
-  if (out.subverb !== undefined && !out.help) {
+  applyPositionals(out, positional, opts.games, out.help);
+  if (out.subcommand === "mods" && out.subverb !== undefined && !out.help) {
     if (out.subverb === "add")
       out.source = modSource(values);
     if (out.subverb !== "sync")
@@ -389,29 +632,28 @@ function parseArgs(argv, opts = {}) {
   }
   if (opts.defaults !== undefined)
     applyDefaults(out, seen, opts.defaults, sep !== -1);
-  if (seen.has("--detach") && out.subcommand === "shell") {
-    throw usage("shell cannot detach: a shell needs the terminal --detach gives up");
-  }
   return out;
 }
 function recordFlags(program) {
   const log = { seen: new Set, counts: new Map, worktree: [] };
-  for (const option of program.options) {
-    const long = option.long ?? option.flags;
-    program.on(`option:${option.name()}`, (value) => {
-      log.seen.add(long);
-      log.counts.set(long, (log.counts.get(long) ?? 0) + 1);
-      if (long === "--worktree" && value !== undefined)
-        log.worktree.push(value);
-      if (long === "--staging" || long === "--logs" || long === "--all" || long === "--downloads") {
-        log.cleanTier = long.slice(2);
-      }
-    });
+  for (const cmd of [program, ...program.commands]) {
+    for (const option of cmd.options) {
+      const long = option.long ?? option.flags;
+      cmd.on(`option:${option.name()}`, (value) => {
+        log.seen.add(long);
+        log.counts.set(long, (log.counts.get(long) ?? 0) + 1);
+        if (long === "--worktree" && value !== undefined)
+          log.worktree.push(value);
+        if (long === "--staging" || long === "--logs" || long === "--all" || long === "--downloads") {
+          log.cleanTier = long.slice(2);
+        }
+      });
+    }
   }
   return log;
 }
 function checkRepeats(program, counts) {
-  for (const option of program.options) {
+  for (const option of allOptions(program)) {
     const long = option.long ?? option.flags;
     const repeatable = Array.isArray(option.defaultValue);
     if (option.required && !repeatable && (counts.get(long) ?? 0) > 1) {
@@ -440,15 +682,22 @@ function policy(value) {
     return "never";
   return;
 }
-function translate(error, program) {
+function translate(error, program, verb) {
   if (!(error instanceof CommanderError))
     return error;
   const token = /'([^']+)'/.exec(error.message)?.[1] ?? "";
   if (error.code === "commander.unknownOption") {
     const name = token.split("=")[0];
-    const known = program.options.find((o) => o.long === name || o.short === name);
-    if (known !== undefined)
+    const here = (verb === undefined ? program : program.commands.find((c) => c.name() === verb))?.options;
+    if (here?.some((o) => o.long === name || o.short === name))
       return usage(`${name} takes no value`);
+    const bespoke = REFUSALS[`${verb ?? "run"} ${name}`];
+    if (bespoke !== undefined)
+      return usage(bespoke);
+    const owners = ownersOf(name);
+    if (owners.length > 0) {
+      return usage(`${verb ?? "run"} does not take ${name}`, owners.map((o) => `gamecrate ${o}`).join(" or "));
+    }
     return usage(`unknown flag ${name}`, suggest(name, flagNames(program)));
   }
   if (error.code === "commander.optionMissingArgument") {
@@ -473,6 +722,13 @@ function applyPositionals(out, positional, games, help = false) {
     if (out.subverb === "rm" && out.rest.length === 0)
       throw usage("mods rm needs at least one mod id");
   }
+  if (!help && out.subcommand === "steam") {
+    if (out.subverb === undefined) {
+      throw usage("steam needs a subverb", "gamecrate steam build <game>, or gamecrate steam login");
+    }
+    if (out.subverb === "build" && out.game === undefined)
+      throw usage("steam build needs a game");
+  }
   if (left.length > 0) {
     const shape = sub ? `${sub.name} ${sub.usage}`.trim() : `${out.game} [profile]`;
     throw usage(`unexpected argument ${left[0]}`, `gamecrate ${shape}`);
@@ -526,6 +782,8 @@ function applyEnv(program, seen, env, values) {
       continue;
     if (flag === "--build" && seen.has("--no-build"))
       continue;
+    if (!program.options.some((o) => o.long === flag))
+      continue;
     const raw = env[name];
     if (raw === undefined || raw === "")
       continue;
@@ -546,6 +804,8 @@ function envBuildPolicy(name, raw) {
 }
 function applyEnvValue(program, flag, name, raw, values) {
   const option = program.options.find((o) => o.long === flag);
+  if (option === undefined)
+    return;
   const key = option.attributeName();
   if (!option.required) {
     if (truthy(raw))
@@ -624,7 +884,7 @@ function truthy(value) {
   return value === "1" || value.toLowerCase() === "true" || value.toLowerCase() === "yes";
 }
 function flagNames(program) {
-  return program.options.flatMap((o) => [o.long, o.short].filter((f) => f !== undefined));
+  return allOptions(program).flatMap((o) => [o.long, o.short].filter((f) => f !== undefined));
 }
 function seconds(flag, value) {
   const n = Number(value);
@@ -851,7 +1111,7 @@ import { readFileSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { exports as exportsField, legacy } from "resolve.exports";
-var PLUGIN_API_VERSION = 1;
+var PLUGIN_API_VERSION = 2;
 var REQUIRED_FUNCTIONS = [
   "parseManifest",
   "renderModsConfig",
@@ -1146,6 +1406,8 @@ var profile = obj({
   alias: str.optional(),
   aliases: strArray.optional(),
   description: str.optional(),
+  gameVersion: str.optional(),
+  image: str.optional(),
   detach: bool.optional(),
   replace: bool.optional(),
   build: oneOf(["auto", "always", "never"]).optional()
@@ -1190,6 +1452,95 @@ var libraryEntry = obj({
     push('"subdir" must be a relative path inside the repo, with no ".." segment', ["subdir"]);
   }
 });
+function repeats(entries, key) {
+  const seen = new Set;
+  const found = [];
+  entries.forEach((entry, index) => {
+    const name = entry?.[key];
+    if (typeof name !== "string")
+      return;
+    if (seen.has(name))
+      found.push({ index, name });
+    else
+      seen.add(name);
+  });
+  return found;
+}
+var TAG_COMPONENT = /^[A-Za-z0-9_][A-Za-z0-9._-]*$/;
+function steamBuildRules(ctx) {
+  const push = (message, path, suggestion) => {
+    ctx.issues.push({
+      code: "custom",
+      message,
+      path,
+      input: ctx.value,
+      ...suggestion === undefined ? {} : { params: { suggestion } }
+    });
+  };
+  const branches = ctx.value["branches"];
+  const variants = ctx.value["variants"];
+  if (Array.isArray(variants) && variants.length === 0) {
+    push("steamBuild.variants cannot be empty", ["variants"]);
+  }
+  if (Array.isArray(branches)) {
+    if (branches.length === 0)
+      push("steamBuild.branches cannot be empty", ["branches"]);
+    for (const dup of repeats(branches, "name")) {
+      push(`duplicate branch name "${dup.name}"`, ["branches", dup.index, "name"]);
+    }
+    branches.forEach((branch, index) => {
+      const name = branch?.["name"];
+      if (typeof name === "string" && !TAG_COMPONENT.test(name)) {
+        push(`branch name "${name}" must match ${TAG_COMPONENT.source}`, ["branches", index, "name"]);
+      }
+      const tags = branch?.["tags"];
+      if (!Array.isArray(tags))
+        return;
+      tags.forEach((tag, at) => {
+        if (typeof tag !== "string" || TAG_COMPONENT.test(tag))
+          return;
+        push(`branch tag "${String(tag)}" must match ${TAG_COMPONENT.source}`, ["branches", index, "tags", at]);
+      });
+    });
+  }
+  if (!Array.isArray(variants))
+    return;
+  for (const dup of repeats(variants, "name")) {
+    push(`duplicate variant name "${dup.name}"`, ["variants", dup.index, "name"]);
+  }
+  variants.forEach((variant, index) => {
+    const v = variant;
+    const base = v?.["base"];
+    if (base !== "xvfb" && base !== "proton")
+      return;
+    const depot = v?.["depot"] ?? "linux";
+    if (depot === "macos") {
+      push("a macos depot cannot be runnable", ["variants", index, "base"], 'set base to "none"; no macos container runtime exists');
+      return;
+    }
+    const wants = depot === "windows" ? "proton" : "xvfb";
+    if (base === wants)
+      return;
+    push(`a ${String(depot)} depot cannot run on the "${base}" base`, ["variants", index, "base"], depot === "windows" ? 'set base to "proton"; it is the only base with wine' : 'set base to "xvfb", or set depot to "windows" if the image should run under wine');
+  });
+}
+var steamBuildSchema = obj({
+  branches: z.array(obj({
+    name: str,
+    password: bool.optional(),
+    tags: strArray.optional(),
+    executable: z.record(str, str).optional()
+  }), {
+    error: "expected an array"
+  }),
+  variants: z.array(obj({
+    name: str,
+    depot: oneOf(["linux", "windows", "macos"]).optional(),
+    base: oneOf(["xvfb", "proton", "none"]),
+    include: strArray,
+    executable: str.optional()
+  }), { error: "expected an array" })
+}).check(steamBuildRules);
 var game = obj({
   gameFiles: obj({ source: oneOf(["mount", "image"]), host: str.optional(), container: str }).check(requiredWhen("host", (v) => v["source"] === "mount")),
   dataDir: obj({
@@ -1200,7 +1551,12 @@ var game = obj({
   }).check(requiredWhen("arg", (v) => v["mode"] === "arg"), requiredWhen("env", (v) => v["mode"] === "env")),
   modsDir: obj({ container: str, mask: strArray.optional() }),
   logFile: obj({ mode: oneOf(["arg", "copy-out"]), arg: str.optional(), from: str.optional() }).check(requiredWhen("arg", (v) => v["mode"] === "arg"), requiredWhen("from", (v) => v["mode"] === "copy-out")),
-  image: obj({ ref: str, acquire: oneOf(["pull", "build"]), context: str.optional() }).check(requiredWhen("context", (v) => v["acquire"] === "build")),
+  image: obj({
+    ref: str,
+    acquire: oneOf(["pull", "build"]),
+    context: str.optional(),
+    updates: obj({ check: bool.optional(), everyHours: num.optional() }).optional()
+  }).check(requiredWhen("context", (v) => v["acquire"] === "build")),
   executable: str,
   steamAppId: num,
   workshopRoot: z.union([z.string(), z.null()], { error: "expected a string or null" }),
@@ -1210,6 +1566,8 @@ var game = obj({
   manifest: obj({ file: str }),
   modsConfig: obj({ file: str }),
   prefs: obj({ file: str }),
+  version: obj({ file: str }),
+  steamBuild: steamBuildSchema,
   saveExtensions: strArray,
   core: str,
   dlc: strArray,
@@ -1299,6 +1657,7 @@ function crossReference(p, games) {
     checkName(p, where, gameName, "game");
     if (!isObj(game_))
       continue;
+    checkVariantNames(p, where, game_);
     const profiles = game_["profiles"];
     if (!isObj(profiles))
       continue;
@@ -1311,6 +1670,18 @@ function crossReference(p, games) {
     checkCollisions(p, where, gameName, profiles, containers);
   }
 }
+function checkVariantNames(p, where, game_) {
+  const steamBuild = game_["steamBuild"];
+  const variants = isObj(steamBuild) ? steamBuild["variants"] : undefined;
+  if (!Array.isArray(variants))
+    return;
+  variants.forEach((variant, index) => {
+    const name = isObj(variant) ? variant["name"] : undefined;
+    if (typeof name !== "string")
+      return;
+    checkName(p, `${where}/steamBuild/variants/${index}/name`, name, "variant");
+  });
+}
 function checkProfile(p, w, name, prof, profiles) {
   const names = Object.keys(profiles);
   checkExtends(p, w, prof, profiles, names);
@@ -1618,7 +1989,7 @@ async function loadConfig(path, project) {
     defaults: { settings: structuredClone(DEFAULT_SETTINGS) },
     games: Object.fromEntries([...plugins].map(([name, plugin]) => [name, structuredClone(plugin.defaults)]))
   };
-  const merged = user === undefined || user === null ? base : deepMerge(base, user);
+  const merged = user === undefined || user === null ? base : mergeUserConfig(base, user);
   const spliced = applyProject(merged, project);
   const { config, problems } = validateConfig(spliced);
   if (problems.length > 0) {
@@ -1731,6 +2102,11 @@ function resolveNamed(game, name, seen) {
   const auto = self.autoDependencies ?? parent.autoDependencies;
   if (auto !== undefined)
     out.autoDependencies = auto;
+  for (const field of ["detach", "replace", "build", "gameVersion", "image"]) {
+    const value = self[field] ?? parent[field];
+    if (value !== undefined)
+      Object.assign(out, { [field]: value });
+  }
   return out;
 }
 function canonicalProfile(game, name) {
@@ -1789,6 +2165,47 @@ function globToRegExp(pattern) {
   const body = pattern.replaceAll(/[.+^${}()|[\]\\]/g, String.raw`\$&`).replaceAll("*", ".*").replaceAll("?", ".");
   return new RegExp(`^${body}$`, "i");
 }
+function mergeUserConfig(base, user) {
+  const out = deepMerge(base, user);
+  const games = isObj(user) ? user["games"] : undefined;
+  if (!isObj(games))
+    return out;
+  for (const name of Object.keys(games)) {
+    const theirs = own(games, name);
+    const steamBuild = isObj(theirs) ? theirs["steamBuild"] : undefined;
+    const added = isObj(steamBuild) ? steamBuild["branches"] : undefined;
+    const declared = own(base.games, name)?.steamBuild?.branches;
+    const target = own(out.games, name);
+    if (!Array.isArray(added) || !Array.isArray(declared) || target === undefined)
+      continue;
+    target.steamBuild.branches = concatBranches(declared, added);
+  }
+  return out;
+}
+function branchName(entry) {
+  return isObj(entry) && typeof entry["name"] === "string" ? entry["name"] : undefined;
+}
+function concatBranches(declared, added) {
+  const out = [...declared];
+  const at = new Map;
+  out.forEach((branch, index) => {
+    const name = branchName(branch);
+    if (name !== undefined && !at.has(name))
+      at.set(name, index);
+  });
+  for (const entry of added) {
+    const name = branchName(entry);
+    const index = name === undefined ? undefined : at.get(name);
+    if (index === undefined) {
+      if (name !== undefined)
+        at.set(name, out.length);
+      out.push(entry);
+      continue;
+    }
+    out[index] = deepMerge(out[index], entry);
+  }
+  return out;
+}
 function deepMerge(base, over, concatArrays = false) {
   if (Array.isArray(base) && Array.isArray(over)) {
     return concatArrays ? [...base, ...over] : [...over];
@@ -1933,7 +2350,12 @@ var CONTAINER_XDG_DIR = "/xdg";
 var RUNTIME_DIR_SIZE = "64m";
 var HOME_SIZE = "64m";
 var MASK_SIZE = "1m";
-function buildRunSpec(plan, modMounts, identity) {
+function refuseProtonHeaded(game, mode, image) {
+  if (image?.launcher !== "proton" || mode !== "headed")
+    return;
+  throw new GamecrateError(`${game}: a proton image only runs offscreen`, Exit.Config, 'relaunch with --mode headless, or use a variant whose gamecrate.launcher is "direct"');
+}
+function buildRunSpec(plan, modMounts, identity, image) {
   const { gameConfig: game, settings } = plan;
   const headed = plan.mode === "headed";
   const mounts = [];
@@ -1944,19 +2366,32 @@ function buildRunSpec(plan, modMounts, identity) {
   };
   addGameFiles(mounts, plan);
   addStage(mounts, plan, modMounts);
-  const command = headed ? [game.executable] : [
+  const proton = image?.launcher === "proton";
+  const executable = image?.executable ?? game.executable;
+  refuseProtonHeaded(plan.game, plan.mode, image);
+  const command = proton ? ["run-headless-windows", winPath(join4(game.gameFiles.container, basename3(executable)))] : headed ? [executable] : [
     "xvfb-run",
     "-a",
     `--server-args=-screen 0 ${settings.width}x${settings.height}x24`,
-    game.executable
+    executable
   ];
-  if (game.dataDir.mode === "arg")
-    command.push(validateDataDirArg(game.dataDir));
-  else
+  if (proton) {
+    Object.assign(env, {
+      SCREEN: `${settings.width}x${settings.height}x24`,
+      DESKTOP: `${settings.width}x${settings.height}`,
+      STEAM_COMPAT_DATA_PATH: `${CONTAINER_XDG_DIR}/proton`
+    });
+  }
+  if (game.dataDir.mode === "arg") {
+    const arg = validateDataDirArg(game.dataDir);
+    const eq = arg.indexOf("=");
+    command.push(proton ? `${arg.slice(0, eq + 1)}${winPath(arg.slice(eq + 1))}` : arg);
+  } else
     Object.assign(env, game.dataDir.env);
   if (game.logFile.mode === "arg") {
     mounts.push({ type: "bind", source: hostPath(plan.runDirHost), target: CONTAINER_LOG_DIR });
-    command.push(game.logFile.arg, `${CONTAINER_LOG_DIR}/Player.log`);
+    const log = `${CONTAINER_LOG_DIR}/Player.log`;
+    command.push(game.logFile.arg, proton ? winPath(log) : log);
   }
   addScratch(mounts, env, plan, identity);
   if (headed)
@@ -2122,6 +2557,9 @@ function csvField(field) {
     return field;
   return `"${field.replaceAll('"', '""')}"`;
 }
+function winPath(unix) {
+  return `Z:${unix.replaceAll("/", "\\")}`;
+}
 function validateDataDirArg(dataDir) {
   if (dataDir.container.includes("=")) {
     throw new GamecrateError(`container data path contains "=": ${dataDir.container}`, Exit.Config, "RimWorld silently ignores -savedatafolder when the argv element does not split into exactly two parts, and the save is lost with --rm.");
@@ -2224,6 +2662,18 @@ async function capture(argv) {
     return { code: 127, stdout: "", stderr: error instanceof Error ? error.message : String(error) };
   }
 }
+async function captureLive(argv, env) {
+  const proc = spawn(argv[0], argv.slice(1), { stdio: ["ignore", "pipe", "pipe"], env });
+  const chunks = [];
+  const keep = async (stream) => {
+    for await (const chunk of stream) {
+      process.stderr.write(chunk);
+      chunks.push(chunk);
+    }
+  };
+  const [, , code] = await Promise.all([keep(proc.stdout), keep(proc.stderr), exited(proc)]);
+  return { code, text: Buffer.concat(chunks).toString("utf8") };
+}
 var STDOUT_LOG = "stdout.log";
 var MARKER_POLL_MS = 200;
 async function runContainer(spec, opts) {
@@ -2640,13 +3090,9 @@ function rotateRuns(logsDir, keep) {
 }
 
 // src/launch/prepare.ts
-async function inherit(argv, stdin) {
-  const proc = spawnArgv(argv, [stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"]);
+async function inherit(argv) {
+  const proc = spawnArgv(argv, ["ignore", "pipe", "pipe"]);
   const code = exited(proc);
-  if (stdin !== undefined) {
-    proc.stdin.on("error", () => {});
-    proc.stdin.end(stdin);
-  }
   await Promise.all([
     forwardOutput(proc.stdout, process.stdout),
     forwardOutput(proc.stderr, process.stderr)
@@ -2658,6 +3104,10 @@ async function imageDigest(ref) {
   const id = stdout.trim();
   return code === 0 && id.length > 0 ? id : null;
 }
+async function readFromImage(ref, path) {
+  const { code, stdout } = await capture(["docker", "run", "--rm", "--entrypoint", "cat", ref, path]);
+  return code === 0 ? stdout : null;
+}
 async function imageLabel(ref, label) {
   const format = `{{index .Config.Labels "${label}"}}`;
   const { code, stdout } = await capture(["docker", "image", "inspect", "--format", format, ref]);
@@ -2694,44 +3144,6 @@ async function buildImage(game, image, present, pull) {
     throw new GamecrateError(`docker build failed for ${image.ref}`, Exit.Environment);
   }
 }
-var RUNTIME_PACKAGES = ["xorg-server-xvfb", "xorg-xwd", "imagemagick", "mesa", "ttf-dejavu"];
-var RUNTIME_SUFFIX = "-gamecrate";
-var BASE_LABEL = "gamecrate.base";
-function runtimeLayerRef(ref) {
-  const at = ref.indexOf("@");
-  const head = at > 0 ? ref.slice(0, at) : ref;
-  const colon = head.lastIndexOf(":");
-  const tagged = colon > head.lastIndexOf("/");
-  const name = tagged ? head.slice(0, colon) : head;
-  if (at > 0) {
-    const digest = ref.slice(at + 1);
-    const hex = digest.slice(digest.indexOf(":") + 1);
-    return `${name}:sha-${hex.slice(0, 12)}${RUNTIME_SUFFIX}`;
-  }
-  return `${name}:${tagged ? head.slice(colon + 1) : "latest"}${RUNTIME_SUFFIX}`;
-}
-async function ensureRuntimeLayer(ref) {
-  const derived = runtimeLayerRef(ref);
-  const base = await imageDigest(ref);
-  if (base !== null && await imageLabel(derived, BASE_LABEL) === base)
-    return derived;
-  const pacman = `pacman -Syu --noconfirm --needed ${RUNTIME_PACKAGES.join(" ")} && pacman -Scc --noconfirm`;
-  const apt = "apt-get update && apt-get install -y --no-install-recommends" + " xvfb x11-apps imagemagick libgl1-mesa-dri fonts-dejavu && rm -rf /var/lib/apt/lists/*";
-  const install = `if command -v pacman >/dev/null 2>&1; then ${pacman};` + ` elif command -v apt-get >/dev/null 2>&1; then ${apt};` + ' else echo "no supported package manager in the base image" >&2; exit 1; fi';
-  const dockerfile = [
-    `FROM ${ref}`,
-    "USER root",
-    `RUN ${install}`,
-    "RUN command -v xvfb-run && command -v Xvfb",
-    `LABEL ${BASE_LABEL}=${base}`
-  ].join(`
-`);
-  const code = await inherit(["docker", "build", "--tag", derived, "-f", "-", "."], new TextEncoder().encode(dockerfile));
-  if (code !== 0) {
-    throw new GamecrateError(`could not build the offscreen runtime layer ${derived}`, Exit.Environment, "headless and screenshot modes need an X server in the image");
-  }
-  return derived;
-}
 async function buildTarget(dir) {
   let entries;
   try {
@@ -2920,7 +3332,7 @@ function bootTime() {
 async function captureScreenshot(container, plan) {
   const name = `${plan.game}.png`;
   const target = `${CONTAINER_LOG_DIR}/${name}`;
-  const script = 'D=":$(ls /tmp/.X11-unix 2>/dev/null | head -1 | tr -d X)";' + ' [ "$D" = ":" ] && { echo "no X socket in the container" >&2; exit 1; };' + ` import -display "$D" -window root ${target} 2>/dev/null` + ` || xwd -root -display "$D" | magick xwd:- ${target}`;
+  const script = 'D=":$(ls /tmp/.X11-unix 2>/dev/null | head -1 | tr -d X)";' + ' [ "$D" = ":" ] && { echo "no X socket in the container" >&2; exit 1; };' + " X=$(ls -d /tmp/xvfb-run.*/Xauthority 2>/dev/null | head -1);" + ' [ -n "$X" ] && export XAUTHORITY="$X";' + " M=$(command -v magick || command -v convert);" + ' [ -z "$M" ] && { echo "no imagemagick in the container" >&2; exit 1; };' + ` import -display "$D" -window root ${target} 2>/dev/null` + ` || xwd -root -display "$D" | "$M" xwd:- ${target}`;
   const code = await inherit(["docker", "exec", container, "sh", "-c", script]);
   const host = join8(plan.runDirHost, name);
   if (code !== 0 || !existsSync3(host))
@@ -3227,7 +3639,17 @@ async function prepareSources(game, profileName, args, dataRoot, allowFetch) {
 
 // src/mods/steamcmd.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync, constants, existsSync as existsSync5, mkdirSync as mkdirSync3, statSync as statSync2 } from "node:fs";
+import { randomBytes } from "node:crypto";
+import {
+  accessSync,
+  constants,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  rmSync as rmSync2,
+  statSync as statSync2,
+  writeFileSync
+} from "node:fs";
 import { readdir as readdir5, rm as rm2 } from "node:fs/promises";
 import { delimiter, dirname as dirname5, join as join10 } from "node:path";
 import { setTimeout as sleep4 } from "node:timers/promises";
@@ -3235,6 +3657,19 @@ var STEAMCMD_IMAGE = "steamcmd/steamcmd";
 function steamHome(dataRoot) {
   return join10(dataRoot, "steam");
 }
+function accountFile(dataRoot) {
+  return join10(steamHome(dataRoot), "account");
+}
+function steamAccount(dataRoot) {
+  const fromEnv = process.env.STEAM_USERNAME;
+  if (fromEnv !== undefined && fromEnv !== "")
+    return fromEnv;
+  const file = accountFile(dataRoot);
+  const saved = existsSync5(file) ? readFileSync3(file, "utf8").trim() : "";
+  if (saved !== "")
+    return saved;
+  throw new GamecrateError("a game download needs a steam account", Exit.Environment, `set STEAM_USERNAME, or run \`gamecrate steam login\` once to record one at ${file}`);
+}
 function downloadRoot(dataRoot, game) {
   return join10(steamHome(dataRoot), "steamapps", "workshop", "content", String(game.steamAppId));
 }
@@ -3353,7 +3788,7 @@ async function downloadItems(config, game, dataRoot, ids) {
   return { items, warnings };
 }
 function run(runner, game, dataRoot, ids) {
-  const argv = [
+  return spawnSteamcmd([
     ...runner.argv,
     "+force_install_dir",
     steamHome(dataRoot),
@@ -3361,7 +3796,18 @@ function run(runner, game, dataRoot, ids) {
     "anonymous",
     ...ids.flatMap((id) => ["+workshop_download_item", String(game.steamAppId), id]),
     "+quit"
-  ];
+  ], runner);
+}
+async function spawnSteamcmdLive(argv, runner) {
+  let text;
+  try {
+    ({ text } = await captureLive(argv, { ...process.env, ...runner.env }));
+  } catch (error) {
+    throw new GamecrateError(`could not run steamcmd: ${argv[0]}`, Exit.Environment, error instanceof Error ? error.message : String(error));
+  }
+  return text.replace(ANSI, "");
+}
+function spawnSteamcmd(argv, runner) {
   const r = spawnSync2(argv[0], argv.slice(1), {
     encoding: "utf8",
     env: { ...process.env, ...runner.env },
@@ -3373,6 +3819,107 @@ function run(runner, game, dataRoot, ids) {
   return `${r.stdout ?? ""}
 ${r.stderr ?? ""}`.replace(ANSI, "");
 }
+function appDownloadRoot(dataRoot, appId, branch, depot) {
+  return join10(steamHome(dataRoot), "apps", `${appId}-${branch}-${depot ?? "native"}`);
+}
+var appOk = (id) => new RegExp(`Success! App '${id}'`);
+var appState = (id) => new RegExp(`Error! App '${id}' state is (0x[0-9a-fA-F]+)`);
+var LOGIN_FAILED = /Login Failure|FAILED \(Invalid Password\)|Account Logon Denied|Two-factor/i;
+async function downloadApp(config, opts) {
+  const user = steamAccount(opts.dataRoot);
+  const runner = resolveSteamcmd(config);
+  const dir = appDownloadRoot(opts.dataRoot, opts.steamAppId, opts.branch, opts.depot);
+  mkdirSync3(dir, { recursive: true });
+  const commands = [
+    ["@ShutdownOnFailedCommand", "1"],
+    ["@NoPromptForPassword", "1"],
+    ["force_install_dir", dir],
+    ...opts.depot === undefined ? [] : [["@sSteamCmdForcePlatformType", opts.depot]],
+    ["login", user],
+    [
+      "app_update",
+      String(opts.steamAppId),
+      "-beta",
+      opts.branch,
+      ...opts.password === undefined ? [] : ["-betapassword", opts.password]
+    ],
+    ["quit"]
+  ];
+  const script = opts.password === undefined ? undefined : writeRunscript(opts.dataRoot, commands);
+  const argv = script === undefined ? [...runner.argv, ...commands.flatMap((c) => [`+${c[0]}`, ...c.slice(1)])] : [...runner.argv, "+runscript", script];
+  const release = await lockDir(steamHome(opts.dataRoot));
+  let output;
+  try {
+    output = await spawnSteamcmdLive(argv, runner);
+  } finally {
+    if (script !== undefined)
+      rmSync2(script, { force: true });
+    await release();
+  }
+  if (appOk(opts.steamAppId).test(output))
+    return { dir, warnings: [] };
+  if (LOGIN_FAILED.test(output)) {
+    throw new GamecrateError(`the steam login failed for ${user}`, Exit.Environment, "run `gamecrate steam login` to sign in again, including any steam guard code");
+  }
+  const state = appState(opts.steamAppId).exec(output);
+  throw new GamecrateError(`steamcmd did not install app ${opts.steamAppId} on branch "${opts.branch}"`, Exit.Environment, state === null ? "the branch may not exist, or the password may be wrong. steam reports both the same way" : `steam left the app in state ${state[1]}. the branch may not exist, or the password may be wrong`);
+}
+function writeRunscript(dataRoot, commands) {
+  const home = steamHome(dataRoot);
+  mkdirSync3(home, { recursive: true });
+  const path = join10(home, `runscript-${randomBytes(9).toString("hex")}.txt`);
+  const body = commands.map((c) => c.map(quoteIfSpaced).join(" ")).join(`
+`);
+  writeFileSync(path, `${body}
+`, { mode: 384, flag: "wx" });
+  return path;
+}
+function quoteIfSpaced(arg) {
+  return /\s/.test(arg) ? `"${arg}"` : arg;
+}
+async function publishedBuildId(config, appId, branch) {
+  const user = steamAccount(config.dataRoot);
+  mkdirSync3(steamHome(config.dataRoot), { recursive: true });
+  const release = await lockDir(steamHome(config.dataRoot));
+  let output;
+  try {
+    const runner = resolveSteamcmd(config);
+    output = spawnSteamcmd([
+      ...runner.argv,
+      "+@ShutdownOnFailedCommand",
+      "1",
+      "+@NoPromptForPassword",
+      "1",
+      "+login",
+      user,
+      "+app_info_update",
+      "1",
+      "+app_info_print",
+      String(appId),
+      "+quit"
+    ], runner);
+  } finally {
+    await release();
+  }
+  return buildIdFor(output, branch);
+}
+function buildIdFor(output, branch) {
+  const key = `"${branch}"`;
+  let inBranches = false;
+  let inBranch = false;
+  for (const line of output.split(`
+`)) {
+    if (line.includes('"branches"'))
+      inBranches = true;
+    if (inBranches && line.includes(key))
+      inBranch = true;
+    if (inBranch && line.includes('"buildid"')) {
+      const digits = (line.split('"').at(-2) ?? "").replaceAll(/\D/g, "");
+      return digits === "" ? null : digits;
+    }
+  }
+  return null;
+}
 
 // src/mods/workshopapi.ts
 import { readFile as readFile6, stat as stat4 } from "node:fs/promises";
@@ -3924,11 +4471,688 @@ async function readId(dir, manifestFile, plugin) {
 function profileOf(args, defaults) {
   return args.profile ?? defaults.defaultProfile ?? defaults.profileOrder?.[0] ?? "modless";
 }
+function launchProfile(args, defaults, game) {
+  const named = args.profile ?? defaults.defaultProfile ?? defaults.profileOrder?.[0];
+  if (named !== undefined)
+    return named;
+  const known = Object.keys(game.profiles);
+  if (known.length === 0)
+    return "modless";
+  throw new GamecrateError("no profile named, and no defaultProfile is set", Exit.Usage, `known profiles: ${[...known, "modless"].join(", ")}. set defaults.defaultProfile to pick one every time`);
+}
+
+// src/cli/steam.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname9, join as join16 } from "node:path";
+import { createInterface } from "node:readline/promises";
+
+// src/image/build.ts
+import { mkdirSync as mkdirSync4, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { readFile as readFile8 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join15 } from "node:path";
+
+// src/image/base.ts
+var RUNTIME_BASE = {
+  xvfb: "ghcr.io/rimworks/gamecrate/runtime-base@sha256:bb56228089823908bc3f6452ba3eb10f35f395813b2358758080452201ee4792",
+  proton: "ghcr.io/rimworks/gamecrate/runtime-base-proton@sha256:55ee5e995a88207074ac455fc1932adb57239da66536bed26041436cb7f44fea"
+};
+function resolveBase(kind, override) {
+  if (kind === "none")
+    return null;
+  const pinned = RUNTIME_BASE[kind];
+  if (!pinned) {
+    throw new GamecrateError(`unknown runtime base "${kind}"`, Exit.Config, `known values: ${[...Object.keys(RUNTIME_BASE), "none"].join(", ")}`);
+  }
+  return override ?? pinned;
+}
+
+// src/image/crane.ts
+import { existsSync as existsSync7, readFileSync as readFileSync4 } from "node:fs";
+import { dirname as dirname8, join as join13 } from "node:path";
+import { setTimeout as sleep5 } from "node:timers/promises";
+var CRANE_IMAGE = "gcr.io/go-containerregistry/crane:debug";
+var ATTEMPTS2 = 3;
+var RETRY_DELAY_MS2 = 1000;
+var CONTAINER_CONFIG = "/tmp/gamecrate-docker";
+var USER_VAR = "GAMECRATE_REGISTRY_USER";
+var PASSWORD_VAR = "GAMECRATE_REGISTRY_PASSWORD";
+function registryCreds() {
+  const user = process.env[USER_VAR] ?? "";
+  const password = process.env[PASSWORD_VAR] ?? "";
+  if (user !== "" && password !== "")
+    return { user };
+  if (user === "" && password === "")
+    return null;
+  throw new GamecrateError(`only one of ${USER_VAR} and ${PASSWORD_VAR} is set`, Exit.Environment, "set both, or neither to fall back to the docker config");
+}
+function dockerConfigDir() {
+  const dir = process.env.DOCKER_CONFIG ?? join13(process.env.HOME ?? "", ".docker");
+  if (dir === ".docker" || !existsSync7(join13(dir, "config.json")))
+    return;
+  return dir;
+}
+function authArgs() {
+  if (registryCreds() !== null) {
+    return ["-e", PASSWORD_VAR, "-e", `DOCKER_CONFIG=${CONTAINER_CONFIG}`];
+  }
+  const dir = dockerConfigDir();
+  if (dir === undefined)
+    return [];
+  return ["-v", `${dir}:/dockercfg:ro`, "-e", "DOCKER_CONFIG=/dockercfg"];
+}
+var DOCKER_HUB = "index.docker.io";
+function registryOf(ref) {
+  const slash = ref.indexOf("/");
+  if (slash === -1)
+    return DOCKER_HUB;
+  const head = ref.slice(0, slash);
+  if (head === "docker.io")
+    return DOCKER_HUB;
+  if (head === "localhost" || head.includes(".") || head.includes(":"))
+    return head;
+  return DOCKER_HUB;
+}
+function keyHost(key) {
+  return key.replace(/^https?:\/\//, "").split("/")[0] ?? key;
+}
+function forRegistry(table, registry) {
+  for (const [key, value] of Object.entries(table ?? {})) {
+    if (keyHost(key) === registry)
+      return value;
+  }
+  return;
+}
+function checkRegistryAuthEarly(ref) {
+  if (registryCreds() !== null)
+    return;
+  const dir = dockerConfigDir();
+  if (dir === undefined) {
+    throw new GamecrateError(`no registry credentials for ${registryOf(ref)}`, Exit.Environment, `there is no docker config.json to read. set ${USER_VAR} and ${PASSWORD_VAR}`);
+  }
+  const path = join13(dir, "config.json");
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    return;
+  }
+  const registry = registryOf(ref);
+  const entry = forRegistry(parsed.auths, registry);
+  if ((entry?.auth ?? entry?.identitytoken ?? "") !== "")
+    return;
+  const helper = forRegistry(parsed.credHelpers, registry) ?? parsed.credsStore ?? "";
+  throw new GamecrateError(`no registry credentials for ${registry}`, Exit.Environment, helper === "" ? `${path} has no auths entry for ${registry}. set ${USER_VAR} and ${PASSWORD_VAR}` : `${path} stores ${registry} credentials in a helper (${helper}) the crane container cannot run. set ${USER_VAR} and ${PASSWORD_VAR}`);
+}
+function dockerRun(mounts, script) {
+  return [
+    "docker",
+    "run",
+    "--rm",
+    "--user",
+    `${process.getuid?.() ?? 0}:${process.getgid?.() ?? 0}`,
+    ...mounts.flatMap((m) => ["-v", m]),
+    ...authArgs(),
+    "--entrypoint",
+    "sh",
+    CRANE_IMAGE,
+    "-c",
+    script
+  ];
+}
+function shq(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function craneArgv(mounts, ref, lines) {
+  const creds = ref === null ? null : registryCreds();
+  const login = creds === null ? [] : ["crane", "auth", "login", registryOf(ref), "-u", creds.user, "--password-stdin"];
+  const script = [
+    "set -e",
+    ...login.length === 0 ? [] : [`printf '%s' "$${PASSWORD_VAR}" | ${login.map(shq).join(" ")} >&2`],
+    ...lines.map((line) => line.map(shq).join(" "))
+  ].join(`
+`);
+  return dockerRun(mounts, script);
+}
+async function runOnce(argv, what) {
+  const { code, stdout, stderr } = await capture(argv);
+  if (code === 0)
+    return;
+  throw new GamecrateError(`${what} failed`, Exit.Environment, `${stdout}
+${stderr}`.trim());
+}
+var HEARTBEAT_MS = 1000;
+async function live(argv, what) {
+  const since = Date.now();
+  let lastNotice = 0;
+  const timer = setInterval(() => {
+    const waited = Date.now() - since;
+    const notice = waitNotice(waited, lastNotice);
+    if (notice === undefined)
+      return;
+    lastNotice = waited;
+    status(`${what} (${notice})`);
+  }, HEARTBEAT_MS);
+  try {
+    return await captureLive(argv).catch((error) => ({
+      code: 127,
+      text: error instanceof Error ? error.message : String(error)
+    }));
+  } finally {
+    clearInterval(timer);
+  }
+}
+async function runLive(argv, what) {
+  const { code, text } = await live(argv, what);
+  if (code === 0)
+    return;
+  throw new GamecrateError(`${what} failed`, Exit.Environment, text.trim());
+}
+function lastLine(text) {
+  return text.split(`
+`).map((l) => l.trim()).filter((l) => l !== "").at(-1) ?? "no output";
+}
+async function craneAppend(opts) {
+  for (const p of opts.include) {
+    if (!existsSync7(join13(opts.gameDir, p))) {
+      throw new GamecrateError(`include path not found in the game dir: ${p}`, Exit.Resolution, `looked under ${opts.gameDir}. check the variant's include list`);
+    }
+  }
+  const outDir = dirname8(opts.out);
+  const layer = `${opts.out}.layer.tar`;
+  const prefix = opts.gamePath.replace(/^\/+/, "");
+  const stage = `/stage/${prefix}`;
+  const tar = opts.include.length > 0 ? ["tar", "-C", "/stage", "-cf", layer, ...opts.include.map((p) => `${prefix}/${p}`)] : [
+    "tar",
+    "-C",
+    "/stage",
+    `--exclude=${prefix}/steamapps`,
+    `--exclude=${prefix}/lost+found`,
+    "-cf",
+    layer,
+    prefix
+  ];
+  const append = [
+    "crane",
+    "append",
+    "--platform",
+    opts.platform,
+    ...opts.base === null ? [] : ["-b", opts.base],
+    "-t",
+    opts.tag,
+    "-f",
+    layer,
+    "-o",
+    opts.out
+  ];
+  const argv = craneArgv([`${opts.gameDir}:${stage}:ro`, `${outDir}:${outDir}`], null, [
+    tar,
+    append,
+    ["rm", "-f", layer]
+  ]);
+  await runLive(argv, `crane append for ${opts.out}`);
+}
+async function cranePush(tar, ref) {
+  const dir = dirname8(tar);
+  checkRegistryAuthEarly(ref);
+  const argv = craneArgv([`${dir}:${dir}:ro`], ref, [["crane", "push", tar, ref]]);
+  let last = "";
+  status(`pushing ${tar} to ${ref}`);
+  for (let attempt = 0;attempt < ATTEMPTS2; attempt++) {
+    const { code, text } = await live(argv, `crane push ${ref}`);
+    if (code === 0)
+      return;
+    last = text.trim();
+    if (attempt + 1 < ATTEMPTS2) {
+      warn(`push attempt ${attempt + 1} of ${ATTEMPTS2} failed: ${lastLine(last)}. retrying`);
+      await sleep5(RETRY_DELAY_MS2);
+    }
+  }
+  throw new GamecrateError(`crane push failed for ${ref}`, Exit.Environment, last);
+}
+async function craneTag(ref, tag) {
+  await runOnce(craneArgv([], ref, [["crane", "tag", ref, tag]]), `crane tag ${ref} ${tag}`);
+}
+async function craneMutateLabels(ref, labels) {
+  const args = ["crane", "mutate", ref];
+  for (const [key, value] of Object.entries(labels))
+    args.push("--label", `${key}=${value}`);
+  args.push("-t", ref);
+  await runOnce(craneArgv([], ref, [args]), `crane mutate ${ref}`);
+}
+async function craneLabels(ref) {
+  const { code, stdout } = await capture(craneArgv([], ref, [["crane", "config", ref]]));
+  if (code !== 0)
+    return null;
+  try {
+    const parsed = JSON.parse(stdout);
+    return parsed.config?.Labels ?? {};
+  } catch {
+    return null;
+  }
+}
+
+// src/image/gate.ts
+function decideGate(input) {
+  if (input.force)
+    return { build: true, reason: "forced" };
+  if (!input.imagePresent)
+    return { build: true, reason: "no-image" };
+  if (input.labelled === null)
+    return { build: true, reason: "no-label" };
+  if (input.published === null)
+    return { build: true, reason: "unknown-published" };
+  if (input.published === input.labelled)
+    return { build: false, reason: "up-to-date" };
+  return { build: true, reason: "buildid-changed" };
+}
+
+// src/image/input.ts
+import { join as join14 } from "node:path";
+function branchPasswordKey(branch) {
+  return `STEAM_BRANCH_PASSWORD_${branch.toUpperCase().replaceAll(/[^A-Z0-9]/g, "_")}`;
+}
+function branchPassword(branch) {
+  const key = branchPasswordKey(branch.name);
+  const keyed = process.env[key];
+  if (keyed !== undefined && keyed !== "")
+    return keyed;
+  if (branch.password !== true)
+    return;
+  const bare = process.env.STEAM_BRANCH_PASSWORD;
+  if (bare === undefined || bare === "") {
+    throw new GamecrateError(`branch "${branch.name}" needs a password and none is set`, Exit.Environment, `set ${key}, or STEAM_BRANCH_PASSWORD, when you build one branch`);
+  }
+  return bare;
+}
+function repoOf(ref) {
+  const at = ref.indexOf("@");
+  const head = at > 0 ? ref.slice(0, at) : ref;
+  const colon = head.lastIndexOf(":");
+  return colon > head.lastIndexOf("/") ? head.slice(0, colon) : head;
+}
+function resolveImage(flags, game, configured) {
+  if (configured !== undefined)
+    return repoOf(configured);
+  if (flags.push) {
+    throw new GamecrateError("--push needs a target repository", Exit.Usage, `pass --image <repo>, or set games.${game}.image.ref in a config file`);
+  }
+  return `gamecrate/${game}-game`;
+}
+function mergeForGame(game, defaults, config) {
+  const base = { dataRoot: "", games: { [game]: defaults } };
+  const user = { games: { [game]: config?.games?.[game] ?? {} } };
+  return mergeUserConfig(base, user).games[game];
+}
+async function resolveSteamBuildInput(game, config, overrides, cwd, configFile) {
+  const fromConfig = overrides.plugins === undefined && config?.plugins !== undefined;
+  const specs = overrides.plugins ?? config?.plugins ?? [`@gamecrate/${game}`];
+  const from = fromConfig && configFile !== undefined ? configFile : join14(cwd, ".gamecrate.yaml");
+  const plugins = await loadPlugins(specs, from);
+  const plugin = plugins.get(game);
+  if (plugin === undefined) {
+    throw new GamecrateError(`no plugin provides the game "${game}"`, Exit.Resolution, `tried: ${specs.join(", ")}. loaded: ${[...plugins.keys()].join(", ") || "(none)"}`);
+  }
+  const merged = mergeForGame(game, plugin.defaults, config);
+  const want = (value, key) => {
+    if (value === undefined) {
+      throw new GamecrateError(`${game} has no ${key}`, Exit.Config, `the plugin ${specs.join(", ")} must declare ${key} in its defaults`);
+    }
+    return value;
+  };
+  const steamBuild = want(merged.steamBuild, "steamBuild");
+  const checked = steamBuildSchema.safeParse(steamBuild);
+  if (!checked.success) {
+    const first = checked.error.issues[0];
+    throw new GamecrateError(`${game} steamBuild is wrong: ${first.message}`, Exit.Config, `at steamBuild.${first.path.join(".")}, declared by ${specs.join(", ")}`);
+  }
+  const push = overrides.push === true;
+  const image = resolveImage({ load: !push, push }, game, overrides.image ?? merged.image?.ref);
+  return {
+    game,
+    steamAppId: want(merged.steamAppId, "steamAppId"),
+    versionFile: want(merged.version, "version.file").file,
+    gamePath: want(merged.gameFiles, "gameFiles").container,
+    executable: want(merged.executable, "executable"),
+    branches: steamBuild.branches,
+    variants: steamBuild.variants,
+    image: image.toLowerCase()
+  };
+}
+
+// src/image/tags.ts
+function sanitizeVersion(raw, fallback) {
+  const first = raw.trim().split(/\s+/)[0] ?? "";
+  const mapped = first.replaceAll(/[^A-Za-z0-9._-]/g, "-").replace(/-+$/, "");
+  return mapped.length > 0 ? mapped : fallback;
+}
+function versionPrefixes(version) {
+  const parts = version.split(".");
+  if (parts.length < 2 || parts.some((p) => p === ""))
+    return [];
+  return parts.slice(0, -1).map((_, i) => parts.slice(0, i + 1).join("."));
+}
+function tagsFor(input) {
+  const scope = input.defaultBranch ? "" : `-${input.branch}`;
+  const versioned = [];
+  const latest = [];
+  if (input.defaultVariant) {
+    versioned.push(`${input.version}${scope}`);
+    latest.push(`latest${scope}`);
+  }
+  versioned.push(`${input.version}${scope}-${input.variant}`);
+  latest.push(`latest${scope}-${input.variant}`);
+  for (const prefix of versionPrefixes(input.version)) {
+    if (input.defaultVariant)
+      latest.push(`${prefix}${scope}`);
+    latest.push(`${prefix}${scope}-${input.variant}`);
+  }
+  for (const alias of input.aliases ?? []) {
+    if (input.defaultVariant)
+      latest.push(alias);
+    latest.push(`${alias}-${input.variant}`);
+  }
+  return [...versioned, ...latest];
+}
+
+// src/image/build.ts
+async function steamBuild(input, opts) {
+  const branches = narrow(input.branches, opts.onlyBranches, "branch", "branches");
+  const variants = narrow(input.variants, opts.onlyVariants, "variant", "variants");
+  if (opts.push)
+    checkRegistryAuthEarly(input.image);
+  const defaultBranch = input.branches[0].name;
+  const defaultVariant = input.variants[0].name;
+  const results = [];
+  for (const branch of branches) {
+    const published = await publishedBuildId(opts.config, input.steamAppId, branch.name).catch(() => null);
+    const downloads = new Map;
+    for (const variant of variants) {
+      results.push(await cell(input, opts, { branch, variant, published, defaultBranch, defaultVariant, downloads }));
+    }
+  }
+  return results;
+}
+function narrow(all, only, kind, plural) {
+  if (only === undefined || only.length === 0)
+    return all;
+  const known = new Set(all.map((entry) => entry.name));
+  const missing = only.filter((name) => !known.has(name));
+  if (missing.length > 0) {
+    throw new GamecrateError(`unknown ${kind} ${missing.join(", ")}`, Exit.Usage, `declared ${plural}: ${all.map((entry) => entry.name).join(", ")}`);
+  }
+  return all.filter((entry) => only.includes(entry.name));
+}
+async function cell(input, opts, ctx) {
+  const { branch, variant } = ctx;
+  const row = { branch: branch.name, variant: variant.name };
+  const say = (text) => status(`${branch.name}/${variant.name}  ${text}`);
+  if (!opts.push && variant.base === "none") {
+    say("skipped, reference-only, use --push");
+    return { ...row, status: "skipped", reason: "reference-only, use --push", tags: [] };
+  }
+  const tagInput = {
+    branch: branch.name,
+    variant: variant.name,
+    defaultBranch: branch.name === ctx.defaultBranch,
+    defaultVariant: variant.name === ctx.defaultVariant,
+    aliases: branch.tags
+  };
+  const probe = tagsFor({ version: "0", ...tagInput });
+  const gateRef = `${input.image}:${probe.find((tag) => tag.startsWith("latest"))}`;
+  const found = await readGate(gateRef, opts);
+  const decision = decideGate({
+    published: ctx.published,
+    imagePresent: found.present,
+    labelled: found.buildid,
+    force: opts.force
+  });
+  if (!decision.build) {
+    say(`skipped, ${decision.reason}`);
+    return { ...row, status: "skipped", reason: decision.reason, tags: [] };
+  }
+  try {
+    const dir = await download(input, opts, ctx, say);
+    const raw = await readFile8(join15(dir, input.versionFile), "utf8");
+    const version = sanitizeVersion(raw, ctx.published ?? "unknown");
+    const tags = tagsFor({ ...tagInput, version });
+    const layers = join15(steamHome(opts.config.dataRoot), "layers");
+    mkdirSync4(layers, { recursive: true });
+    const tar = join15(layers, `${branch.name}-${variant.name}-${version}.tar`);
+    const base = resolveBase(variant.base, opts.baseOverride);
+    const versioned = `${input.image}:${tags[0]}`;
+    try {
+      say(`appending onto ${base ?? "scratch"}`);
+      await craneAppend({
+        gameDir: dir,
+        include: variant.include,
+        gamePath: input.gamePath,
+        base,
+        platform: opts.platform,
+        tag: versioned,
+        out: tar
+      });
+      if (opts.push) {
+        say(`pushing ${versioned}`);
+        await cranePush(tar, versioned);
+        await craneMutateLabels(versioned, labelsFor(input, ctx, base));
+        for (const tag of tags.slice(1))
+          await craneTag(versioned, tag);
+      }
+      if (opts.load && base !== null) {
+        say(`loading ${versioned}`);
+        await dockerLoad(tar, versioned);
+        await dockerLabel(versioned, labelsFor(input, ctx, base));
+        for (const tag of tags.slice(1))
+          await dockerTag(versioned, `${input.image}:${tag}`);
+      }
+    } finally {
+      rmSync3(tar, { force: true });
+      rmSync3(`${tar}.layer.tar`, { force: true });
+    }
+    return { ...row, status: "built", reason: decision.reason, tags };
+  } catch (error) {
+    return { ...row, status: "failed", reason: message(error), tags: [] };
+  }
+}
+async function download(input, opts, ctx, say) {
+  const key = ctx.variant.depot ?? "default";
+  let pending = ctx.downloads.get(key);
+  if (pending === undefined) {
+    say(`downloading ${input.steamAppId} (branch ${ctx.branch.name}, depot ${key})`);
+    pending = downloadApp(opts.config, {
+      steamAppId: input.steamAppId,
+      branch: ctx.branch.name,
+      depot: ctx.variant.depot,
+      password: branchPassword(ctx.branch),
+      dataRoot: opts.config.dataRoot
+    });
+    ctx.downloads.set(key, pending);
+  } else {
+    say(`reusing the ${ctx.branch.name} ${key} download`);
+  }
+  return (await pending).dir;
+}
+function labelsFor(input, ctx, base) {
+  const labels = {
+    "gamecrate.variant": ctx.variant.name,
+    "gamecrate.branch": ctx.branch.name,
+    "gamecrate.executable": ctx.branch.executable?.[ctx.variant.name] ?? ctx.variant.executable ?? input.executable,
+    "gamecrate.launcher": ctx.variant.base === "proton" ? "proton" : "direct"
+  };
+  if (ctx.published !== null)
+    labels["steam.buildid"] = ctx.published;
+  if (base !== null)
+    labels["gamecrate.runtime"] = base;
+  return labels;
+}
+async function readGate(ref, opts) {
+  const reads = [];
+  if (opts.push)
+    reads.push(await craneLabels(ref));
+  if (opts.load)
+    reads.push(await inspectLabels(ref));
+  if (reads.some((labels) => labels === null))
+    return { present: false, buildid: null };
+  const ids = reads.map((labels) => labels?.["steam.buildid"] ?? null);
+  return { present: reads.length > 0, buildid: ids.every((id) => id === ids[0]) ? ids[0] ?? null : null };
+}
+async function inspectLabels(ref) {
+  const { code, stdout } = await capture(["docker", "image", "inspect", "--format", "{{json .Config.Labels}}", ref]);
+  if (code !== 0)
+    return null;
+  try {
+    return JSON.parse(stdout.trim()) ?? {};
+  } catch {
+    return null;
+  }
+}
+async function dockerLoad(tar, ref) {
+  const { code, stdout, stderr } = await capture(["docker", "load", "-i", tar]);
+  if (code !== 0 || !stdout.includes(`Loaded image: ${ref}`)) {
+    throw new GamecrateError(`docker load failed for ${tar}`, Exit.Environment, `expected "Loaded image: ${ref}", got: ${`${stdout}
+${stderr}`.trim() || "(no output)"}`);
+  }
+}
+async function dockerLabel(ref, labels) {
+  const dir = mkdtempSync(join15(tmpdir(), "gamecrate-label-"));
+  writeFileSync2(join15(dir, "Dockerfile"), `FROM ${ref}
+`);
+  const argv = ["docker", "build", "-f", join15(dir, "Dockerfile"), "-t", ref];
+  for (const [key, value] of Object.entries(labels))
+    argv.push("--label", `${key}=${value}`);
+  argv.push(dir);
+  const { code, stdout, stderr } = await capture(argv);
+  rmSync3(dir, { recursive: true, force: true });
+  if (code !== 0) {
+    throw new GamecrateError(`docker build --label failed for ${ref}`, Exit.Environment, `${stdout}
+${stderr}`.trim());
+  }
+}
+async function dockerTag(from, ref) {
+  const { code, stdout, stderr } = await capture(["docker", "tag", from, ref]);
+  if (code !== 0) {
+    throw new GamecrateError(`docker tag ${ref} failed`, Exit.Environment, `${stdout}
+${stderr}`.trim());
+  }
+}
+function message(error) {
+  const head = error instanceof Error ? error.message : String(error);
+  const detail = error instanceof GamecrateError ? error.detail?.replaceAll(/\s+/g, " ").trim() : undefined;
+  return detail ? `${head}: ${detail}` : head;
+}
+
+// src/cli/steam.ts
+function sessionPaths(home) {
+  return [
+    join16(home, ".steam", "config", "config.vdf"),
+    join16(home, ".local", "share", "Steam", "config", "config.vdf"),
+    join16(home, "Steam", "config", "config.vdf")
+  ];
+}
+function findSession(home) {
+  return sessionPaths(home).find((path) => existsSync8(path));
+}
+function seedSession(home, body) {
+  for (const path of sessionPaths(home)) {
+    mkdirSync5(dirname9(path), { recursive: true });
+    writeFileSync3(path, body);
+  }
+}
+function resolveSession(config, env = process.env) {
+  const home = steamHome(config.dataRoot);
+  const raw = env["STEAM_CONFIG_VDF"];
+  if (raw !== undefined && raw !== "") {
+    seedSession(home, Buffer.from(raw, "base64"));
+    return sessionPaths(home)[0];
+  }
+  const mine = findSession(home);
+  if (mine !== undefined)
+    return mine;
+  const fallback = findSession(homedir3());
+  if (fallback !== undefined) {
+    seedSession(home, readFileSync5(fallback));
+    return fallback;
+  }
+  throw new GamecrateError("no steam session found", Exit.Environment, `run gamecrate steam login, or set STEAM_CONFIG_VDF. looked under ${home} and ${homedir3()}`);
+}
+async function steamBuildCommand(args, ctx) {
+  const game = args.game;
+  if (game === undefined)
+    throw new GamecrateError("steam build needs a game", Exit.Usage);
+  status(`steam session from ${resolveSession(ctx.config)}`);
+  steamAccount(ctx.config.dataRoot);
+  const push = args.push === true;
+  const load = args.load === true || !push;
+  const plugins = args.plugin !== undefined && args.plugin.length > 0 ? args.plugin : undefined;
+  const input = await resolveSteamBuildInput(game, ctx.config, { image: args.image, plugins, push }, ctx.cwd, ctx.configFile);
+  const results = await steamBuild(input, {
+    config: ctx.config,
+    push,
+    load,
+    platform: args.platform ?? "linux/amd64",
+    baseOverride: args.base,
+    force: args.force === true,
+    onlyBranches: args.branches,
+    onlyVariants: args.variant
+  });
+  if (args.json)
+    process.stdout.write(`${JSON.stringify(results, null, 2)}
+`);
+  else
+    for (const row of results)
+      status(`${row.branch}/${row.variant}  ${row.status}  ${row.reason}`);
+  return results.some((row) => row.status === "failed") ? Exit.Environment : Exit.Ok;
+}
+async function steamLogin(args, ctx) {
+  const home = steamHome(ctx.config.dataRoot);
+  mkdirSync5(home, { recursive: true });
+  const runner = resolveSteamcmd(ctx.config);
+  const username = args.username ?? await prompt("steam account name: ");
+  if (username === "")
+    throw new GamecrateError("steam login needs an account name", Exit.Usage);
+  const argv = runner.kind === "docker" ? [...runner.argv.slice(0, 2), "-it", ...runner.argv.slice(2)] : [...runner.argv];
+  const result = spawnSync3(argv[0], [...argv.slice(1), "+login", username, "+quit"], {
+    stdio: "inherit",
+    env: { ...process.env, ...runner.env }
+  });
+  if (result.error) {
+    throw new GamecrateError(`could not run steamcmd: ${argv[0]}`, Exit.Environment, result.error.message);
+  }
+  const vdf = findSession(home);
+  if (result.status !== 0 || vdf === undefined) {
+    throw new GamecrateError("steam login did not leave a session behind", Exit.Environment, `steamcmd exited ${result.status ?? "on a signal"} and wrote no config.vdf under ${home}`);
+  }
+  writeFileSync3(accountFile(ctx.config.dataRoot), `${username}
+`);
+  status(`session written to ${vdf}`);
+  if (args.print === true)
+    process.stdout.write(`${readFileSync5(vdf).toString("base64")}
+`);
+  return Exit.Ok;
+}
+async function prompt(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
+  }
+}
 
 // src/cli/help.ts
 var NAME = "gamecrate";
 function flags() {
-  return buildProgram().options.filter((o) => !o.hidden);
+  const seen = new Set;
+  return allOptions(buildProgram()).filter((o) => {
+    const long = o.long ?? o.flags;
+    if (o.hidden || seen.has(long))
+      return false;
+    seen.add(long);
+    return true;
+  });
 }
 function renderHelp(topic, config) {
   if (!topic)
@@ -4111,16 +5335,114 @@ function hostUserName(uid) {
 }
 
 // src/docker/preflight.ts
-import { existsSync as existsSync7, readFileSync as readFileSync3 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { basename as basename6, join as join13 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync6 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { basename as basename6, join as join17 } from "node:path";
+
+// src/launch/image.ts
+var NO_IMAGE = {
+  present: false,
+  runtime: null,
+  launcher: null,
+  executable: null,
+  branch: null,
+  variant: null,
+  buildid: null
+};
+async function readImageFacts(ref) {
+  if (ref.trim() === "")
+    return NO_IMAGE;
+  if (await imageDigest(ref) === null)
+    return NO_IMAGE;
+  const [runtime, launcher, executable, branch, variant, buildid] = await Promise.all([
+    imageLabel(ref, "gamecrate.runtime"),
+    imageLabel(ref, "gamecrate.launcher"),
+    imageLabel(ref, "gamecrate.executable"),
+    imageLabel(ref, "gamecrate.branch"),
+    imageLabel(ref, "gamecrate.variant"),
+    imageLabel(ref, "steam.buildid")
+  ]);
+  return { present: true, runtime, launcher, executable, branch, variant, buildid };
+}
+function imageLaunch(facts) {
+  const launcher = facts.launcher === "proton" || facts.launcher === "direct" ? facts.launcher : undefined;
+  return {
+    ...launcher === undefined ? {} : { launcher },
+    ...facts.executable === null ? {} : { executable: facts.executable }
+  };
+}
+function imageProblem(input) {
+  const { game, ref, mode, facts } = input;
+  const where = `/games/${game}/image/ref`;
+  const build = `gamecrate steam build ${game}`;
+  if (ref.trim() === "") {
+    return {
+      where,
+      message: `${game} has no image.ref configured`,
+      suggestion: `${build}, then set games.${game}.image.ref to the tag it prints`
+    };
+  }
+  if (!facts.present) {
+    return {
+      where,
+      message: `image ${ref} is not present locally and could not be pulled`,
+      suggestion: build
+    };
+  }
+  if (mode === "headed")
+    return null;
+  if (facts.runtime === null) {
+    return {
+      where,
+      message: `image ${ref} has no gamecrate.runtime label, so gamecrate did not build it and --mode ${mode} has no X server to use`,
+      suggestion: `${build} rebuilds it on a runtime base`
+    };
+  }
+  return null;
+}
+function markerProblem(input) {
+  if (input.marker !== undefined)
+    return null;
+  if (input.facts.launcher !== "proton")
+    return null;
+  return {
+    where: `/games/${input.game}/image/ref`,
+    message: `${input.game} runs under proton, which cannot report the game's exit code`,
+    suggestion: "pass --marker <text>: a log line is the only success signal this image has"
+  };
+}
+function imageFor(game, profile, flag) {
+  if (flag !== undefined)
+    return flag;
+  const spec = resolveProfile(game, profile);
+  if (spec.image !== undefined)
+    return spec.image;
+  if (spec.gameVersion === undefined)
+    return;
+  return `${repoOf2(game.image.ref)}:${spec.gameVersion}`;
+}
+function repoOf2(ref) {
+  const colon = ref.lastIndexOf(":");
+  return colon === -1 || ref.includes("/", colon) ? ref : ref.slice(0, colon);
+}
+function withImageOverride(game, ref) {
+  if (ref === undefined)
+    return game;
+  return {
+    ...game,
+    image: { ...game.image, ref, acquire: "pull" },
+    gameFiles: { ...game.gameFiles, source: "image" }
+  };
+}
+
+// src/docker/preflight.ts
 var CDI_SPEC = "/etc/cdi/nvidia.yaml";
-async function preflight(plan) {
+async function preflight(plan, asShell = false) {
   const problems = [];
   const game = plan.gameConfig;
   const dockerOk = await checkDocker(problems);
   if (dockerOk) {
-    await checkImage(plan, problems);
+    await checkImage(plan, problems, asShell);
   }
   if (plan.settings.gpu)
     checkCdi(problems);
@@ -4159,12 +5481,30 @@ async function checkImageRunnable(ref, where, game, problems) {
     suggestion: corrupt ? `docker image rm ${ref} && docker builder prune -f, then gamecrate build ${game}` : undefined
   });
 }
-async function checkImage(plan, problems) {
+async function checkImage(plan, problems, asShell) {
   const image = plan.gameConfig.image;
   const where = `/games/${plan.game}/image/ref`;
-  const present = await capture(["docker", "image", "inspect", image.ref]);
-  if (present.code === 0) {
+  const facts = await readImageFacts(image.ref);
+  const problem = imageProblem({ game: plan.game, ref: image.ref, mode: plan.mode, facts });
+  if (facts.present) {
     await checkImageRunnable(image.ref, where, plan.game, problems);
+    if (problem)
+      problems.push(problem);
+    if (asShell)
+      return;
+    const mode = protonHeadedProblem(plan, facts, where);
+    if (mode) {
+      problems.push(mode);
+      return;
+    }
+    const marker = markerProblem({ game: plan.game, facts, marker: plan.marker });
+    if (marker)
+      problems.push(marker);
+    return;
+  }
+  if (image.ref.trim() === "") {
+    if (problem)
+      problems.push(problem);
     return;
   }
   if (image.acquire === "build") {
@@ -4183,15 +5523,26 @@ async function checkImage(plan, problems) {
     problems.push({
       where,
       message: `not authenticated to ${host}, so ${image.ref} cannot be pulled`,
-      suggestion: `docker login ${host}`
+      suggestion: `docker login ${host}, or gamecrate steam build ${plan.game} to make it locally`
     });
     return;
   }
-  problems.push({
-    where,
-    message: `image ${image.ref} is not present locally and cannot be pulled: ${firstLine(remote.stderr) || exitCode(remote.code)}`,
-    suggestion: host ? `docker login ${host}` : undefined
-  });
+  if (problem) {
+    problems.push({
+      ...problem,
+      message: `${problem.message}: ${firstLine(remote.stderr) || exitCode(remote.code)}`
+    });
+  }
+}
+function protonHeadedProblem(plan, facts, where) {
+  try {
+    refuseProtonHeaded(plan.game, plan.mode, imageLaunch(facts));
+    return null;
+  } catch (error) {
+    if (!(error instanceof GamecrateError))
+      throw error;
+    return { where, message: error.message, suggestion: error.detail };
+  }
 }
 function checkDisplay(plan, problems) {
   if (plan.settings.display === "x11") {
@@ -4213,7 +5564,7 @@ function checkDisplay(plan, problems) {
   });
 }
 function checkCdi(problems) {
-  if (!existsSync7(CDI_SPEC)) {
+  if (!existsSync9(CDI_SPEC)) {
     problems.push({
       where: CDI_SPEC,
       message: "no CDI spec, so --device nvidia.com/gpu=all cannot resolve",
@@ -4223,9 +5574,9 @@ function checkCdi(problems) {
   }
   let text = "";
   try {
-    text = readFileSync3(CDI_SPEC, "utf8");
+    text = readFileSync6(CDI_SPEC, "utf8");
   } catch (error) {
-    problems.push({ where: CDI_SPEC, message: `CDI spec is unreadable: ${message(error)}` });
+    problems.push({ where: CDI_SPEC, message: `CDI spec is unreadable: ${message2(error)}` });
     return;
   }
   if (!/^[ \t]*(?:-[ \t]*)?name:[ \t]*["']?all["']?[ \t]*$/m.test(text)) {
@@ -4245,12 +5596,12 @@ function checkGameDir(plan, problems) {
     problems.push({ where, message: 'gameFiles.source is "mount" but no host path is set' });
     return;
   }
-  if (!existsSync7(files.host)) {
+  if (!existsSync9(files.host)) {
     problems.push({ where, message: `game directory does not exist: ${files.host}` });
     return;
   }
-  const executable = join13(files.host, basename6(plan.gameConfig.executable));
-  if (!existsSync7(executable)) {
+  const executable = join17(files.host, basename6(plan.gameConfig.executable));
+  if (!existsSync9(executable)) {
     problems.push({
       where,
       message: `${files.host} does not contain ${basename6(plan.gameConfig.executable)}`,
@@ -4265,7 +5616,7 @@ function checkBindSources(plan, problems) {
   } catch (error) {
     problems.push({
       where: `/games/${plan.game}`,
-      message: error instanceof GamecrateError ? error.message : message(error),
+      message: error instanceof GamecrateError ? error.message : message2(error),
       suggestion: error instanceof GamecrateError ? error.detail : undefined
     });
     return;
@@ -4273,7 +5624,7 @@ function checkBindSources(plan, problems) {
   for (const mount of mounts) {
     if (mount.type !== "bind" || !mount.source)
       continue;
-    if (existsSync7(mount.source))
+    if (existsSync9(mount.source))
       continue;
     if (mount.source.startsWith(plan.profileDir))
       continue;
@@ -4295,9 +5646,9 @@ function needsLogin(stderr) {
   return /unauthorized|authentication required|denied|forbidden/i.test(stderr);
 }
 function hasStoredAuth(host) {
-  const path = join13(process.env.DOCKER_CONFIG ?? join13(homedir3(), ".docker"), "config.json");
+  const path = join17(process.env.DOCKER_CONFIG ?? join17(homedir4(), ".docker"), "config.json");
   try {
-    const config = JSON.parse(readFileSync3(path, "utf8"));
+    const config = JSON.parse(readFileSync6(path, "utf8"));
     if (config.credsStore || config.credHelpers?.[host])
       return true;
     return Object.keys(config.auths ?? {}).some((key) => key === host || key.includes(`//${host}`));
@@ -4312,14 +5663,14 @@ function firstLine(text) {
   return text.trim().split(`
 `)[0]?.trim() ?? "";
 }
-function message(error) {
+function message2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
 // src/docker/window.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import { basename as basename7 } from "node:path";
-import { setTimeout as sleep5 } from "node:timers/promises";
+import { setTimeout as sleep6 } from "node:timers/promises";
 var WAIT_MS = 180000;
 var POLL_MS = 500;
 function newMatches(now, seen, executable) {
@@ -4335,7 +5686,7 @@ function isPeerClaim(pid, self) {
   if (pid === self)
     return false;
   try {
-    const argv = readFileSync4(`/proc/${pid}/cmdline`, "utf8").split("\x00");
+    const argv = readFileSync7(`/proc/${pid}/cmdline`, "utf8").split("\x00");
     return argv.some((arg) => basename7(arg).startsWith("gamecrate"));
   } catch {
     return false;
@@ -4377,7 +5728,7 @@ async function adoptNewWindow(opts) {
 async function pollForWindow(seen, opts, stopped) {
   const deadline = Date.now() + WAIT_MS;
   while (!stopped() && Date.now() < deadline) {
-    await sleep5(POLL_MS);
+    await sleep6(POLL_MS);
     if (stopped())
       return;
     if (await adoptFirstMatch(seen, opts, stopped))
@@ -4402,7 +5753,7 @@ async function adoptFirstMatch(seen, opts, stopped) {
 async function watchForClose(id, stopped, onClosed) {
   let misses = 0;
   while (!stopped()) {
-    await sleep5(POLL_MS);
+    await sleep6(POLL_MS);
     if (stopped())
       return;
     const now = await toplevels();
@@ -4460,19 +5811,27 @@ function parseAtoms(stdout) {
 }
 
 // src/launch/generate.ts
-import { mkdir as mkdir3, readdir as readdir7, readFile as readFile8, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname8, join as join14 } from "node:path";
+import { mkdir as mkdir3, readdir as readdir7, readFile as readFile9, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname10, join as join18 } from "node:path";
 async function readInstallVersion(game, plugin) {
+  const raw = await installVersionText(game);
+  if (raw === null)
+    return null;
+  return plugin.parseVersion(raw.replace(/^/, "").trim());
+}
+async function installVersionText(game) {
+  if (game.gameFiles.source !== "mount") {
+    const ref = game.image?.ref;
+    return ref === undefined || ref === "" ? null : await readFromImage(ref, `${game.gameFiles.container}/${game.version.file}`);
+  }
   const host = game.gameFiles.host;
-  if (game.gameFiles.source !== "mount" || host === undefined)
+  if (host === undefined)
     return null;
-  let raw;
   try {
-    raw = await readFile8(join14(expandHome(host), "Version.txt"), "utf8");
+    return await readFile9(join18(expandHome(host), game.version.file), "utf8");
   } catch {
     return null;
   }
-  return plugin.parseVersion(raw.replace(/^/, "").trim());
 }
 async function readKnownExpansions(game, plugin, warnings) {
   if (game.dlc.length === 0)
@@ -4480,7 +5839,7 @@ async function readKnownExpansions(game, plugin, warnings) {
   const host = game.gameFiles.host;
   if (game.gameFiles.source !== "mount" || host === undefined)
     return [...game.dlc];
-  const dataDir = join14(expandHome(host), "Data");
+  const dataDir = join18(expandHome(host), "Data");
   let entries;
   try {
     entries = await readdir7(dataDir, { withFileTypes: true });
@@ -4494,7 +5853,7 @@ async function readKnownExpansions(game, plugin, warnings) {
       continue;
     let id = null;
     try {
-      id = plugin.parseManifest(await readFile8(join14(dataDir, entry.name, game.manifest.file), "utf8"))?.packageId ?? null;
+      id = plugin.parseManifest(await readFile9(join18(dataDir, entry.name, game.manifest.file), "utf8"))?.packageId ?? null;
     } catch {
       continue;
     }
@@ -4510,11 +5869,11 @@ async function readKnownExpansions(game, plugin, warnings) {
 }
 async function generateModsConfig(plan) {
   const game = plan.gameConfig;
-  const target = join14(plan.dataDirHost, game.modsConfig.file);
-  await mkdir3(dirname8(target), { recursive: true });
+  const target = join18(plan.dataDirHost, game.modsConfig.file);
+  await mkdir3(dirname10(target), { recursive: true });
   const installed = await readInstallVersion(game, plan.plugin);
   if (installed === null) {
-    plan.warnings.push(`could not read Version.txt for ${plan.game}; ModsConfig version may be rejected`);
+    plan.warnings.push(`could not read ${game.version.file} for ${plan.game}; ModsConfig version may be rejected`);
   }
   const declared = new Map([game.core, ...game.dlc].map((id) => [id.toLowerCase(), id]));
   const seen = new Set;
@@ -4561,11 +5920,11 @@ function ownedPrefs(plan) {
   return owned;
 }
 async function mergePrefs(plan) {
-  const target = join14(plan.dataDirHost, plan.gameConfig.prefs.file);
-  await mkdir3(dirname8(target), { recursive: true });
+  const target = join18(plan.dataDirHost, plan.gameConfig.prefs.file);
+  await mkdir3(dirname10(target), { recursive: true });
   let existing = null;
   try {
-    existing = await readFile8(target, "utf8");
+    existing = await readFile9(target, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
       throw error;
@@ -4574,11 +5933,89 @@ async function mergePrefs(plan) {
   return target;
 }
 
+// src/index.ts
+import { createInterface as createInterface2 } from "node:readline/promises";
+
+// src/launch/updates.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname11, join as join19 } from "node:path";
+var DEFAULT_HOURS = 6;
+function shouldCheck(input) {
+  if (input.spec?.check === false)
+    return { check: false, reason: "disabled" };
+  const { branch, buildid } = input.facts;
+  if (!input.facts.present || branch === null || buildid === null) {
+    return { check: false, reason: "not-ours" };
+  }
+  const hours = input.spec?.everyHours ?? DEFAULT_HOURS;
+  if (hours <= 0 || input.lastCheckedAt === null)
+    return { check: true };
+  const due = input.lastCheckedAt + hours * 3600000;
+  return input.now >= due ? { check: true } : { check: false, reason: "throttled" };
+}
+function stampFile(imageId) {
+  const root = process.env["XDG_CACHE_HOME"] ?? join19(homedir5(), ".cache");
+  return join19(root, "gamecrate", "updates", `${imageId.replace(/[^A-Za-z0-9]/g, "-")}.json`);
+}
+function lastCheckedAt(imageId) {
+  const file = stampFile(imageId);
+  if (!existsSync10(file))
+    return null;
+  try {
+    const at = JSON.parse(readFileSync8(file, "utf8")).at;
+    return typeof at === "number" ? at : null;
+  } catch {
+    return null;
+  }
+}
+function recordCheck(imageId, now) {
+  const file = stampFile(imageId);
+  try {
+    mkdirSync6(dirname11(file), { recursive: true });
+    writeFileSync4(file, JSON.stringify({ at: now }));
+  } catch {}
+}
+async function offerRebuild(input) {
+  const { game, config, args, facts } = input;
+  const spec = config.games[game]?.image.updates;
+  const ref = config.games[game].image.ref;
+  const id = await imageDigest(ref);
+  if (id === null)
+    return;
+  const now = Date.now();
+  const verdict = shouldCheck({ facts, spec, lastCheckedAt: lastCheckedAt(id), now });
+  if (!verdict.check)
+    return;
+  const plugins = args.plugin !== undefined && args.plugin.length > 0 ? args.plugin : undefined;
+  const built = await resolveSteamBuildInput(game, config, { plugins }, input.cwd, input.configFile);
+  const published = await publishedBuildId(config, built.steamAppId, facts.branch);
+  recordCheck(id, now);
+  const decision = decideGate({ published, imagePresent: true, labelled: facts.buildid, force: false });
+  if (!decision.build || decision.reason !== "buildid-changed")
+    return;
+  const cell = `${facts.branch}/${facts.variant ?? "default"}`;
+  warn(`${game} ${cell} is at build ${facts.buildid}, steam publishes ${published}`);
+  if (!await input.ask(`rebuild ${ref} now? this downloads the game again [y/N] `)) {
+    status(`keeping the current image. gamecrate steam build ${game} rebuilds it later`);
+    return;
+  }
+  await steamBuild(built, {
+    config,
+    push: false,
+    load: true,
+    platform: args.platform ?? "linux/amd64",
+    force: true,
+    onlyBranches: [facts.branch],
+    onlyVariants: facts.variant === null ? [] : [facts.variant]
+  });
+}
+
 // src/launch/supervisor.ts
-import { existsSync as existsSync8 } from "node:fs";
-import { readFile as readFile9, readlink, rm as rm3, writeFile as writeFile5 } from "node:fs/promises";
-import { basename as basename8, join as join15 } from "node:path";
-import { setTimeout as sleep6 } from "node:timers/promises";
+import { existsSync as existsSync11 } from "node:fs";
+import { readFile as readFile10, readlink, rm as rm3, writeFile as writeFile5 } from "node:fs/promises";
+import { basename as basename8, join as join20 } from "node:path";
+import { setTimeout as sleep7 } from "node:timers/promises";
 async function forkSupervisor(plan, argv) {
   await clearLock(plan);
   const name = containerName(plan);
@@ -4635,15 +6072,15 @@ async function supervisorFailed(dir, code) {
   const record = { at: new Date().toISOString(), code, reason: "failed" };
   const wrote = await writeExit(dir, record).then(() => true, () => false);
   if (wrote)
-    await rm3(join15(dir, ".gamecrate", "lock"), { force: true }).catch(() => {});
+    await rm3(join20(dir, ".gamecrate", "lock"), { force: true }).catch(() => {});
   return code;
 }
 async function writeExit(instanceDir, record) {
-  await writeFile5(join15(instanceDir, ".gamecrate", "last-exit.json"), `${JSON.stringify(record)}
+  await writeFile5(join20(instanceDir, ".gamecrate", "last-exit.json"), `${JSON.stringify(record)}
 `);
 }
 async function lastExit(instanceDir) {
-  const text = await readFile9(join15(instanceDir, ".gamecrate", "last-exit.json"), "utf8").catch(() => {
+  const text = await readFile10(join20(instanceDir, ".gamecrate", "last-exit.json"), "utf8").catch(() => {
     return;
   });
   if (text === undefined)
@@ -4666,7 +6103,7 @@ function endedAfter(record, notBefore) {
   return !Number.isNaN(at) && at >= began;
 }
 async function awaitExit(instanceDir, poll = WAIT_POLL_MS) {
-  const file = join15(instanceDir, ".gamecrate", "lock");
+  const file = join20(instanceDir, ".gamecrate", "lock");
   let watching;
   for (;; ) {
     const lock = await readLock(file) ?? watching;
@@ -4678,12 +6115,12 @@ async function awaitExit(instanceDir, poll = WAIT_POLL_MS) {
     if (!isRunning(lock.pid, lock.startedAt))
       return "orphaned";
     watching = lock;
-    await sleep6(poll);
+    await sleep7(poll);
   }
 }
 var RUN_LOG_POLL_MS = 250;
 async function awaitRunLog(instanceDir, lock, poll = RUN_LOG_POLL_MS, notice = WAIT_NOTICE) {
-  const link = join15(instanceDir, "logs", "current");
+  const link = join20(instanceDir, "logs", "current");
   const written = Date.parse(lock.startedAt);
   const since = Date.now();
   let lastNotice = 0;
@@ -4693,7 +6130,7 @@ async function awaitRunLog(instanceDir, lock, poll = RUN_LOG_POLL_MS, notice = W
     });
     const began = target === undefined ? undefined : runStartedAt(basename8(target));
     const current = began !== undefined && (Number.isNaN(written) || began >= written);
-    if (current && existsSync8(currentLog(instanceDir)))
+    if (current && existsSync11(currentLog(instanceDir)))
       return true;
     if (!isRunning(lock.pid, lock.startedAt))
       return false;
@@ -4703,20 +6140,20 @@ async function awaitRunLog(instanceDir, lock, poll = RUN_LOG_POLL_MS, notice = W
       status(`waiting for ${lock.game} ${lock.profile} to open its log (${label})`);
       lastNotice = waited;
     }
-    await sleep6(poll);
+    await sleep7(poll);
   }
 }
 
 // src/launch/instance.ts
 import { createHash as createHash2 } from "node:crypto";
-import { basename as basename9, join as join16 } from "node:path";
+import { basename as basename9, join as join21 } from "node:path";
 
 // src/mods/worktree.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync9, realpathSync as realpathSync2 } from "node:fs";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync12, realpathSync as realpathSync2 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve5, sep } from "node:path";
 function inspect(dir) {
-  const r = spawnSync3("git", ["-C", dir, "rev-parse", "--path-format=absolute", "--show-toplevel", "--git-dir", "--git-common-dir", "--abbrev-ref", "HEAD"], { encoding: "utf8" });
+  const r = spawnSync4("git", ["-C", dir, "rev-parse", "--path-format=absolute", "--show-toplevel", "--git-dir", "--git-common-dir", "--abbrev-ref", "HEAD"], { encoding: "utf8" });
   if (r.status !== 0 || typeof r.stdout !== "string")
     return null;
   const lines = r.stdout.trim().split(`
@@ -4736,7 +6173,7 @@ function canonical(p) {
 function resolveWorktree(dir, source, order) {
   const raw = expandHome(dir);
   const abs = isAbsolute2(raw) ? raw : resolve5(process.cwd(), raw);
-  if (!existsSync9(abs)) {
+  if (!existsSync12(abs)) {
     return { where: abs, message: `--worktree path does not exist`, suggestion: "check the path, or drop the flag" };
   }
   const info = inspect(abs);
@@ -4791,7 +6228,7 @@ function resolveInstance(options) {
   const name = args.instance === undefined ? derive(requests) : named(args.instance);
   return {
     ...name === undefined ? {} : { name },
-    dir: name === undefined ? profileDir : join16(profileDir, "instances", name),
+    dir: name === undefined ? profileDir : join21(profileDir, "instances", name),
     requests,
     problems,
     ...configured?.settings === undefined ? {} : { settings: configured.settings }
@@ -4829,17 +6266,17 @@ function slug2(root) {
 }
 
 // src/launch/resolve.ts
-import { join as join18 } from "node:path";
+import { join as join23 } from "node:path";
 
 // src/mods/modindex.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync10, readFileSync as readFileSync5, statSync as statSync3 } from "node:fs";
-import { mkdir as mkdir4, readdir as readdir8, readFile as readFile10, writeFile as writeFile6 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname9, join as join17, relative as relative3, sep as sep2, resolve as resolvePath } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync9, statSync as statSync3 } from "node:fs";
+import { mkdir as mkdir4, readdir as readdir8, readFile as readFile11, writeFile as writeFile6 } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
+import { dirname as dirname12, join as join22, relative as relative3, sep as sep2, resolve as resolvePath } from "node:path";
 import picomatch from "picomatch";
 function cacheDir() {
-  return join17(process.env["XDG_CACHE_HOME"] ?? join17(homedir4(), ".cache"), "gamecrate");
+  return join22(process.env["XDG_CACHE_HOME"] ?? join22(homedir6(), ".cache"), "gamecrate");
 }
 function globMatch(pattern, path) {
   return picomatch.isMatch(path, pattern.replaceAll(/[[\]{}()!,@+|^$.\\]/g, String.raw`\$&`), { dot: true });
@@ -4851,8 +6288,8 @@ var ALWAYS_EXCLUDE = ["**/.worktrees/**", "**/.claude/worktrees/**"];
 function inLinkedWorktree(dir, stopAt) {
   let current = dir;
   for (;; ) {
-    const git = join17(current, ".git");
-    if (existsSync10(git)) {
+    const git = join22(current, ".git");
+    if (existsSync13(git)) {
       try {
         if (statSync3(git).isFile())
           return true;
@@ -4863,7 +6300,7 @@ function inLinkedWorktree(dir, stopAt) {
     }
     if (current === stopAt)
       return false;
-    const parent = dirname9(current);
+    const parent = dirname12(current);
     if (parent === current)
       return false;
     current = parent;
@@ -4873,8 +6310,8 @@ async function scanLocalRoot(root, rootIndex, manifestFile, found) {
   const base = resolvePath(expandHome(root.path));
   const exclude = [...root.exclude ?? [], ...rootIndex === -1 ? [] : ALWAYS_EXCLUDE];
   const walk = async (dir, depth) => {
-    const manifest = join17(dir, manifestFile);
-    if (existsSync10(manifest)) {
+    const manifest = join22(dir, manifestFile);
+    if (existsSync13(manifest)) {
       found.push({
         dir,
         kind: "local",
@@ -4894,13 +6331,13 @@ async function scanLocalRoot(root, rootIndex, manifestFile, found) {
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.name.startsWith(".git"))
         continue;
-      const child = join17(dir, entry.name);
+      const child = join22(dir, entry.name);
       if (excluded(exclude, relative3(base, child)))
         continue;
       await walk(child, depth + 1);
     }
   };
-  if (!existsSync10(base))
+  if (!existsSync13(base))
     return;
   await walk(base, 0);
 }
@@ -4915,17 +6352,68 @@ async function scanWorkshopRoot(workshopRoot, rootIndex, manifestFile, found) {
   for (const entry of entries) {
     if (!entry.isDirectory() || !/^\d+$/.test(entry.name))
       continue;
-    const dir = join17(base, entry.name);
-    if (!existsSync10(join17(dir, manifestFile)))
+    const dir = join22(base, entry.name);
+    if (!existsSync13(join22(dir, manifestFile)))
       continue;
     found.push({ dir, kind: "workshop", rootIndex, linkedWorktree: false, workshopId: Number(entry.name) });
   }
 }
-async function scanGameData(game, rootIndex, found) {
-  const host = game.gameFiles.host;
-  if (game.gameFiles.source !== "mount" || host === undefined)
+async function gameDataDir(game) {
+  if (game.gameFiles.source === "mount") {
+    const host = game.gameFiles.host;
+    return host === undefined ? null : join22(resolvePath(expandHome(host)), "Data");
+  }
+  const ref = game.image?.ref;
+  if (ref === undefined || ref === "")
+    return null;
+  const id = await imageDigest(ref);
+  if (id === null)
+    return null;
+  const out = join22(cacheDir(), "official", id.replace(/[^A-Za-z0-9]/g, "-"), "Data");
+  if (!existsSync13(out))
+    await copyOfficialManifests(game, ref, out);
+  return existsSync13(out) ? out : null;
+}
+var MARK = "@@gamecrate@@ ";
+async function copyOfficialManifests(game, ref, out) {
+  const script = [
+    "for d in " + game.gameFiles.container + "/Data/*/; do",
+    '  f="${d}' + game.manifest.file + '"',
+    '  [ -f "$f" ] || continue',
+    '  echo "' + MARK + '$(basename "${d%/}")"',
+    '  cat "$f"',
+    "done"
+  ].join(`
+`);
+  const { code, stdout } = await capture(["docker", "run", "--rm", "--entrypoint", "sh", ref, "-c", script]);
+  if (code !== 0)
     return;
-  const data = join17(resolvePath(expandHome(host)), "Data");
+  for (const block of stdout.split(MARK).slice(1)) {
+    const cut = block.indexOf(`
+`);
+    if (cut === -1)
+      continue;
+    const name = block.slice(0, cut).trim();
+    if (name === "" || name.includes("/"))
+      continue;
+    const file = join22(out, name, game.manifest.file);
+    await mkdir4(dirname12(file), { recursive: true });
+    await writeFile6(file, block.slice(cut + 1));
+  }
+}
+async function scanGameData(game, rootIndex, found, problems, gameName) {
+  const data = await gameDataDir(game);
+  if (data === null) {
+    const ref = game.image?.ref;
+    if (game.gameFiles.source !== "mount" && ref !== undefined && ref !== "") {
+      problems.push({
+        where: `/games/${gameName}/image/ref`,
+        message: `${ref} is not present, so ${gameName} has no core or expansions to load`,
+        suggestion: `gamecrate steam build ${gameName}, or docker pull ${ref}`
+      });
+    }
+    return;
+  }
   let entries;
   try {
     entries = await readdir8(data, { withFileTypes: true });
@@ -4935,20 +6423,20 @@ async function scanGameData(game, rootIndex, found) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const dir = join17(data, entry.name);
-    if (!existsSync10(join17(dir, game.manifest.file)))
+    const dir = join22(data, entry.name);
+    if (!existsSync13(join22(dir, game.manifest.file)))
       continue;
     found.push({ dir, kind: "official", rootIndex, linkedWorktree: false });
   }
 }
 var CACHE_VERSION = 4;
 function acfPath2(root, steamAppId) {
-  return join17(dirname9(dirname9(resolvePath(expandHome(root)))), `appworkshop_${steamAppId}.acf`);
+  return join22(dirname12(dirname12(resolvePath(expandHome(root)))), `appworkshop_${steamAppId}.acf`);
 }
 function contentPairs(acf) {
   let text;
   try {
-    text = readFileSync5(acf, "utf8");
+    text = readFileSync9(acf, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return [];
@@ -4980,7 +6468,7 @@ function workshopStamp(game, dataRoot) {
 }
 async function readWorkshopCache(game, stamp) {
   try {
-    const raw = JSON.parse(await readFile10(join17(cacheDir(), `${game}.workshop.json`), "utf8"));
+    const raw = JSON.parse(await readFile11(join22(cacheDir(), `${game}.workshop.json`), "utf8"));
     if (raw.version !== CACHE_VERSION || raw.stamp !== stamp)
       return null;
     return raw.records;
@@ -4992,7 +6480,7 @@ async function writeWorkshopCache(game, stamp, records) {
   const payload = { version: CACHE_VERSION, stamp, records };
   try {
     await mkdir4(cacheDir(), { recursive: true });
-    await writeFile6(join17(cacheDir(), `${game}.workshop.json`), JSON.stringify(payload));
+    await writeFile6(join22(cacheDir(), `${game}.workshop.json`), JSON.stringify(payload));
   } catch {}
 }
 function toRecord(candidate, manifest, game) {
@@ -5085,8 +6573,8 @@ async function applySourceOverrides(index, overrides, config) {
     }
     const wanted = spec.slice(0, eq);
     const dir = resolvePath(expandHome(spec.slice(eq + 1)));
-    const file = join17(dir, config.manifest.file);
-    if (!existsSync10(file)) {
+    const file = join22(dir, config.manifest.file);
+    if (!existsSync13(file)) {
       problems.push({
         where: spec,
         message: `no ${config.manifest.file} under ${dir}`,
@@ -5096,7 +6584,7 @@ async function applySourceOverrides(index, overrides, config) {
     }
     let manifest;
     try {
-      manifest = index.plugin.parseManifest(readFileSync5(file, "utf8"));
+      manifest = index.plugin.parseManifest(readFileSync9(file, "utf8"));
     } catch (error) {
       problems.push({ where: file, message: `could not parse: ${String(error)}` });
       continue;
@@ -5165,7 +6653,7 @@ async function buildIndex(game, config, plugin, sourcesDir, dataRoot) {
 }
 async function indexLocal(index, config, sourcesDir, cacheIndex) {
   const local = [];
-  await scanGameData(config, -1, local);
+  await scanGameData(config, -1, local, index.problems, index.game);
   for (const [i, root] of config.scanRoots.entries()) {
     await scanLocalRoot(root, i, config.manifest.file, local);
   }
@@ -5209,7 +6697,7 @@ function oneModPerClone(records, sourcesDir) {
   const stamps = new Map;
   for (const record of [...records].sort((a, b) => Number(a.dir > b.dir) - Number(a.dir < b.dir))) {
     const clone = relative3(sourcesDir, record.dir).split(sep2).slice(0, 2).join(sep2);
-    const at = join17(sourcesDir, clone);
+    const at = join22(sourcesDir, clone);
     let stamp = stamps.get(at);
     if (stamp === undefined) {
       stamp = statSync3(at).mtimeMs;
@@ -5224,9 +6712,9 @@ function oneModPerClone(records, sourcesDir) {
 }
 async function parseAll(candidates, config, plugin, problems) {
   const records = await Promise.all(candidates.map(async (candidate) => {
-    const file = join17(candidate.dir, config.manifest.file);
+    const file = join22(candidate.dir, config.manifest.file);
     try {
-      const manifest = plugin.parseManifest(await readFile10(file, "utf8"));
+      const manifest = plugin.parseManifest(await readFile11(file, "utf8"));
       return manifest === null ? null : toRecord(candidate, manifest, config);
     } catch (error) {
       problems.push({
@@ -5297,11 +6785,11 @@ function byPath(index, raw, game) {
     if (hit)
       return hit;
   }
-  const file = join17(dir, game.manifest.file);
-  if (!existsSync10(file))
+  const file = join22(dir, game.manifest.file);
+  if (!existsSync13(file))
     return null;
   try {
-    const manifest = index.plugin.parseManifest(readFileSync5(file, "utf8"));
+    const manifest = index.plugin.parseManifest(readFileSync9(file, "utf8"));
     if (manifest === null)
       return null;
     return toRecord({ dir, kind: "local", rootIndex: -1, linkedWorktree: false }, manifest, game);
@@ -5335,7 +6823,7 @@ function refFor(entry, game, sources) {
   if (pin?.git !== undefined) {
     const dir = sources.get(object.id.toLowerCase());
     if (dir !== undefined)
-      return `path:${pin.subdir === undefined ? dir : join18(dir, pin.subdir)}`;
+      return `path:${pin.subdir === undefined ? dir : join23(dir, pin.subdir)}`;
   }
   return object.id;
 }
@@ -5672,11 +7160,11 @@ async function resolvePlan(options) {
     profileDir,
     ...instance.name === undefined ? {} : { instance: instance.name },
     instanceDir: instance.dir,
-    dataDirHost: join18(instance.dir, "game"),
-    configDirHost: join18(profileDir, "config"),
-    stageDirHost: join18(instance.dir, ".stage"),
-    logsDirHost: join18(instance.dir, "logs"),
-    runDirHost: join18(instance.dir, "logs"),
+    dataDirHost: join23(instance.dir, "game"),
+    configDirHost: join23(profileDir, "config"),
+    stageDirHost: join23(instance.dir, ".stage"),
+    logsDirHost: join23(instance.dir, "logs"),
+    runDirHost: join23(instance.dir, "logs"),
     mode,
     ...args.marker === undefined ? {} : { marker: args.marker },
     timeoutSeconds: args.timeout ?? DEFAULT_TIMEOUT_SECONDS,
@@ -5689,7 +7177,7 @@ async function resolvePlan(options) {
 
 // src/run/registry.ts
 import { readdir as readdir9 } from "node:fs/promises";
-import { join as join19 } from "node:path";
+import { join as join24 } from "node:path";
 var FORMAT = '{{.Names}}\t{{.Label "gamecrate.game"}}\t{{.Label "gamecrate.profile"}}\t{{.Label "gamecrate.instance"}}\t{{.Status}}';
 function parseDockerRuns(stdout) {
   const out = [];
@@ -5714,13 +7202,13 @@ function parseDockerRuns(stdout) {
 async function walkLocks(dataRoot) {
   const out = [];
   for (const game of await entries(dataRoot)) {
-    const gameDir = join19(dataRoot, game);
+    const gameDir = join24(dataRoot, game);
     for (const profile of await entries(gameDir)) {
-      const profileDir = join19(gameDir, profile);
-      await push(out, join19(profileDir, ".gamecrate", "lock"));
-      const instancesDir = join19(profileDir, "instances");
+      const profileDir = join24(gameDir, profile);
+      await push(out, join24(profileDir, ".gamecrate", "lock"));
+      const instancesDir = join24(profileDir, "instances");
       for (const instance of await entries(instancesDir)) {
-        await push(out, join19(instancesDir, instance, ".gamecrate", "lock"));
+        await push(out, join24(instancesDir, instance, ".gamecrate", "lock"));
       }
     }
   }
@@ -5783,7 +7271,7 @@ function fromLock(lock) {
 
 // src/launch/stage.ts
 import { lstat, mkdir as mkdir5, readdir as readdir10, realpath as realpath2, rm as rm4, stat as stat5 } from "node:fs/promises";
-import { basename as basename10, join as join20 } from "node:path";
+import { basename as basename10, join as join25 } from "node:path";
 async function stageMods(plan) {
   await rm4(plan.stageDirHost, { recursive: true, force: true });
   await mkdir5(plan.stageDirHost, { recursive: true });
@@ -5800,7 +7288,7 @@ async function stageMods(plan) {
     if (!(await stat5(source)).isDirectory()) {
       throw new GamecrateError(`${mod.packageId} does not resolve to a directory`, Exit.Environment, source);
     }
-    await mkdir5(join20(plan.stageDirHost, basename10(mod.containerDir)), { recursive: true });
+    await mkdir5(join25(plan.stageDirHost, basename10(mod.containerDir)), { recursive: true });
     mounts.push({ type: "bind", source, target: mod.containerDir, readonly: true });
   }
   return mounts;
@@ -5810,12 +7298,12 @@ async function ensureProfileTree(plan) {
     plan.profileDir,
     plan.instanceDir,
     plan.dataDirHost,
-    join20(plan.configDirHost, "config"),
-    join20(plan.configDirHost, "data"),
-    join20(plan.configDirHost, "cache"),
-    join20(plan.logsDirHost, "runs"),
+    join25(plan.configDirHost, "config"),
+    join25(plan.configDirHost, "data"),
+    join25(plan.configDirHost, "cache"),
+    join25(plan.logsDirHost, "runs"),
     plan.stageDirHost,
-    join20(plan.instanceDir, ".gamecrate"),
+    join25(plan.instanceDir, ".gamecrate"),
     ...engineDirs(plan)
   ]) {
     await mkdir5(dir, { recursive: true });
@@ -5825,7 +7313,7 @@ function engineDirs(plan) {
   const { dataDir, modsDir } = plan.gameConfig;
   if (!modsDir.container.startsWith(`${dataDir.container}/`))
     return [];
-  return [join20(plan.dataDirHost, modsDir.container.slice(dataDir.container.length + 1))];
+  return [join25(plan.dataDirHost, modsDir.container.slice(dataDir.container.length + 1))];
 }
 async function detectForeignOwnership(dir, uid, limit = 100) {
   const foreign = [];
@@ -5847,7 +7335,7 @@ async function detectForeignOwnership(dir, uid, limit = 100) {
       continue;
     try {
       for (const entry of await readdir10(current))
-        queue.push(join20(current, entry));
+        queue.push(join25(current, entry));
     } catch {
       continue;
     }
@@ -5856,9 +7344,9 @@ async function detectForeignOwnership(dir, uid, limit = 100) {
 }
 
 // src/mods/workshop.ts
-import { existsSync as existsSync11 } from "node:fs";
-import { readFile as readFile11 } from "node:fs/promises";
-import { join as join21, resolve as resolvePath2 } from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { readFile as readFile12 } from "node:fs/promises";
+import { join as join26, resolve as resolvePath2 } from "node:path";
 var ROUNDS = 5;
 async function prepareWorkshop(game, profileName, args, config, allowFetch, plugin, sources) {
   const roots = mountedRoots(config.dataRoot, game);
@@ -5909,18 +7397,18 @@ function mountedRoots(dataRoot, game) {
   return [downloadRoot(dataRoot, game), ...game.workshopRoot === null ? [] : [game.workshopRoot]];
 }
 function itemDir(roots, id) {
-  return roots.map((root) => join21(root, id)).find((dir) => existsSync11(dir));
+  return roots.map((root) => join26(root, id)).find((dir) => existsSync14(dir));
 }
 async function manifestOf(roots, id, game, plugin, problems) {
   const dir = itemDir(roots, id);
   return dir === undefined ? null : await manifestAt(dir, game, plugin, problems);
 }
 async function manifestAt(dir, game, plugin, problems) {
-  const file = join21(dir, game.manifest.file);
-  if (!existsSync11(file))
+  const file = join26(dir, game.manifest.file);
+  if (!existsSync14(file))
     return null;
   try {
-    return plugin.parseManifest(await readFile11(file, "utf8"));
+    return plugin.parseManifest(await readFile12(file, "utf8"));
   } catch (error) {
     problems.push({ where: file, message: error instanceof Error ? error.message : String(error) });
     return null;
@@ -5958,7 +7446,7 @@ function localDirOf(entry, game, sources) {
   const pin = libraryPin(game, object.id);
   const clone = sources.get(object.id.toLowerCase());
   if (clone !== undefined)
-    return pin?.subdir === undefined ? clone : join21(clone, pin.subdir);
+    return pin?.subdir === undefined ? clone : join26(clone, pin.subdir);
   return pin?.path === undefined ? undefined : resolvePath2(expandHome(pin.path));
 }
 function wantedIds(game, profile, args) {
@@ -5992,7 +7480,7 @@ function published2(value) {
 }
 
 // src/index.ts
-var VERSION = "1.4.1";
+var VERSION = "2.0.0";
 async function main(argv) {
   const supervised = supervisedDir(argv);
   try {
@@ -6043,6 +7531,12 @@ async function dispatch(argv, args, config, plugins, defaults) {
         return modsSync(args, ctx);
       return mods(args, config, plugins, defaults);
     }
+    case "steam": {
+      const ctx = { config, plugins, cwd: process.cwd(), configFile: await globalConfigPath() };
+      if (args.subverb === "login")
+        return steamLogin(args, ctx);
+      return steamBuildCommand(args, ctx);
+    }
     case "doctor":
       return doctor(config, plugins);
     case "clean":
@@ -6060,7 +7554,7 @@ async function dispatch(argv, args, config, plugins, defaults) {
     case "stop":
       return stop(args, config, defaults);
     case "attach":
-      return attach(args, config, defaults);
+      return attach2(args, config, defaults);
     case "wait":
       return waitFor(args, config, defaults);
     case "shell":
@@ -6118,8 +7612,9 @@ function reportEnvironment(problems) {
 }
 async function run2(argv, args, config, plugins, defaults, asShell) {
   const game = requireGame(args, config);
-  const profile = profileOf(args, defaults);
-  const gameConfig = config.games[game];
+  const profile = launchProfile(args, defaults, config.games[game]);
+  const gameConfig = withImageOverride(config.games[game], imageFor(config.games[game], profile, args.image));
+  config.games[game] = gameConfig;
   const allowFetch = !args.dryRun && !args.printPlan;
   const sources = await prepareSources(gameConfig, profile, args, config.dataRoot, allowFetch);
   try {
@@ -6151,8 +7646,8 @@ async function resolved(inputs) {
     reportProblems(fatal);
   const identity = resolveIdentity(args.root);
   if (args.printPlan || args.dryRun)
-    return await reportPlanOnly(plan, args, profile, identity);
-  const environment = await preflight(plan);
+    return await reportPlanOnly(plan, args, profile, identity, asShell);
+  const environment = await preflight(plan, asShell);
   if (environment.length > 0)
     reportEnvironment(environment);
   await ensureProfileTree(plan);
@@ -6171,8 +7666,8 @@ async function resolved(inputs) {
     await lock.release();
   }
 }
-async function reportPlanOnly(plan, args, profile, identity) {
-  const environment = await preflight(plan);
+async function reportPlanOnly(plan, args, profile, identity, asShell) {
+  const environment = await preflight(plan, asShell);
   buildRunSpec(plan, [], identity);
   if (args.printPlan)
     printPlan(plan, args.json);
@@ -6197,7 +7692,7 @@ run: gamecrate fix-perms ${game} ${profile}`);
   }
   const runDir = openRunLog(plan.logsDirHost);
   plan.runDirHost = runDir;
-  const supervisorLog = args.supervised && args.log === undefined ? redirectOutput(join22(runDir, "supervisor.log")) : undefined;
+  const supervisorLog = args.supervised && args.log === undefined ? redirectOutput(join27(runDir, "supervisor.log")) : undefined;
   try {
     return await execute({ plan, args, config, identity, asShell, profileSpec, runDir, releaseSources });
   } finally {
@@ -6206,87 +7701,140 @@ run: gamecrate fix-perms ${game} ${profile}`);
 }
 async function execute(inputs) {
   const { plan, args, config, identity, asShell, profileSpec, runDir, releaseSources } = inputs;
-  const game = plan.game;
   await buildLocalMods(plan, buildPolicy(args, profileSpec));
   await releaseSources();
-  await acquireImage(game, config.games[game], args.pull ?? "missing");
-  const runtimeImage = plan.mode === "headed" ? config.games[game].image.ref : await ensureRuntimeLayer(config.games[game].image.ref);
+  const { facts, imageStart } = await readyImage(plan, config, args, asShell);
   const modMounts = await stageMods(plan);
   await generateModsConfig(plan);
   await mergePrefs(plan);
   for (const warning of planWarnings(plan))
     warn(warning);
-  const spec = buildRunSpec(plan, modMounts, identity);
-  spec.image = runtimeImage;
+  const spec = buildRunSpec(plan, modMounts, identity, imageStart);
   if (asShell) {
     spec.command = ["/bin/bash"];
     spec.extraArgs = [...spec.extraArgs, "--interactive", "--tty"];
   }
   await writeLaunchRecord(plan, spec.image);
+  const trustExit = facts.launcher !== "proton";
+  try {
+    return await dispatchRun(spec, plan, runDir, trustExit, asShell);
+  } finally {
+    await copyOutLogs(plan);
+  }
+}
+async function readyImage(plan, config, args, asShell) {
+  const game = plan.game;
+  const ref = config.games[game].image.ref;
   try {
-    if (plan.marker !== undefined && !asShell)
-      return await runWithMarker(spec, plan, runDir);
-    if (plan.mode === "screenshot" && !asShell)
-      return await runWithScreenshot(spec, plan, runDir);
-    if (plan.mode !== "headed" && !asShell)
-      return await runBounded(spec, plan, runDir);
-    let windowClosed = false;
-    const window = asShell || plan.settings.display !== "x11" ? null : await adoptNewWindow({
-      executable: plan.gameConfig.executable,
-      title: windowTitle(plan),
-      stripDelete: plan.gameConfig.ignoresWmDelete === true,
-      onClosed: () => {
-        windowClosed = true;
-        stopContainer(spec.name, STOP_TIMEOUT_SECONDS);
+    await acquireImage(game, config.games[game], args.pull ?? "missing");
+  } catch (error) {
+    const absent = imageProblem({ game, ref, mode: plan.mode, facts: await readImageFacts(ref) });
+    if (absent === null)
+      throw error;
+    throw new GamecrateError(absent.message, Exit.Environment, absent.suggestion);
+  }
+  let facts = await readImageFacts(ref);
+  if (await rebuiltForUpdate(plan, config, args))
+    facts = await readImageFacts(ref);
+  const problem = imageProblem({ game, ref, mode: plan.mode, facts });
+  if (problem !== null) {
+    throw new GamecrateError(problem.message, Exit.Environment, problem.suggestion);
+  }
+  const imageStart = asShell ? undefined : imageLaunch(facts);
+  refuseProtonHeaded(game, plan.mode, imageStart);
+  const needsMarker = asShell ? null : markerProblem({ game, facts, marker: plan.marker });
+  if (needsMarker !== null) {
+    throw new GamecrateError(needsMarker.message, Exit.Usage, needsMarker.suggestion);
+  }
+  return { facts, imageStart };
+}
+async function rebuiltForUpdate(plan, config, args) {
+  const facts = await readImageFacts(config.games[plan.game].image.ref);
+  let rebuilt = false;
+  await offerRebuild({
+    game: plan.game,
+    config,
+    args,
+    facts,
+    cwd: process.cwd(),
+    configFile: await globalConfigPath(),
+    ask: async (question) => {
+      if (args.yes)
+        return rebuilt = true;
+      if (process.stdin.isTTY !== true || args.json) {
+        warn("no terminal to ask, so the launch keeps the current image");
+        return false;
       }
-    });
-    try {
-      const code = await runContainer(spec, {
-        logDir: runDir,
-        stopTimeoutSeconds: STOP_TIMEOUT_SECONDS
-      });
-      if (windowClosed)
-        return { code: Exit.Ok, reason: "window-closed" };
-      return { code: normalize(code), reason: reasonFor(code) };
-    } finally {
-      window?.stop();
+      const rl = createInterface2({ input: process.stdin, output: process.stderr });
+      try {
+        const said = (await rl.question(question)).trim().toLowerCase();
+        rebuilt = said === "y" || said === "yes";
+        return rebuilt;
+      } finally {
+        rl.close();
+      }
+    }
+  });
+  return rebuilt;
+}
+async function dispatchRun(spec, plan, runDir, trustExit, asShell) {
+  if (plan.marker !== undefined && !asShell)
+    return await runWithMarker(spec, plan, runDir, trustExit);
+  if (plan.mode === "screenshot" && !asShell)
+    return await runWithScreenshot(spec, plan, runDir, trustExit);
+  if (plan.mode !== "headed" && !asShell)
+    return await runBounded(spec, plan, runDir, trustExit);
+  let windowClosed = false;
+  const window = asShell || plan.settings.display !== "x11" ? null : await adoptNewWindow({
+    executable: plan.gameConfig.executable,
+    title: windowTitle(plan),
+    stripDelete: plan.gameConfig.ignoresWmDelete === true,
+    onClosed: () => {
+      windowClosed = true;
+      stopContainer(spec.name, STOP_TIMEOUT_SECONDS);
     }
+  });
+  try {
+    const code = await runContainer(spec, { logDir: runDir, stopTimeoutSeconds: STOP_TIMEOUT_SECONDS });
+    if (windowClosed)
+      return { code: Exit.Ok, reason: "window-closed" };
+    return { code: normalize(code), reason: reasonFor(code) };
   } finally {
-    await copyOutLogs(plan);
+    window?.stop();
   }
 }
 function markerSources(plan, logDir) {
-  const sources = [join22(logDir, STDOUT_LOG)];
+  const sources = [join27(logDir, STDOUT_LOG)];
   const { logFile } = plan.gameConfig;
   if (logFile.mode === "arg")
-    sources.push(join22(logDir, "Player.log"));
+    sources.push(join27(logDir, "Player.log"));
   else
-    sources.push(join22(plan.dataDirHost, logFile.from));
+    sources.push(join27(plan.dataDirHost, logFile.from));
   return sources;
 }
-async function runBounded(spec, plan, logDir) {
+async function runBounded(spec, plan, logDir, trustExit) {
   const container = runContainer(spec, { logDir, stopTimeoutSeconds: STOP_TIMEOUT_SECONDS });
   const winner = await Promise.race([
     container.then((code) => ({ kind: "exit", code })),
-    sleep7(plan.timeoutSeconds * 1000).then(() => ({ kind: "timeout" }))
+    sleep8(plan.timeoutSeconds * 1000).then(() => ({ kind: "timeout" }))
   ]);
   if (winner.kind === "exit")
-    return { code: normalize(winner.code), reason: reasonFor(winner.code) };
+    return exitResult(winner.code, trustExit);
   status(`no marker given; stopping after ${plan.timeoutSeconds}s`);
   await stopContainer(spec.name, STOP_TIMEOUT_SECONDS);
   await container;
   return { code: Exit.Ok, reason: "timeout" };
 }
-async function runWithScreenshot(spec, plan, logDir) {
+async function runWithScreenshot(spec, plan, logDir, trustExit) {
   const container = runContainer(spec, { logDir, stopTimeoutSeconds: STOP_TIMEOUT_SECONDS });
-  const settled = sleep7(plan.renderWaitSeconds * 1000).then(() => "ready");
+  const settled = sleep8(plan.renderWaitSeconds * 1000).then(() => "ready");
   const winner = await Promise.race([
     container.then((code) => ({ kind: "exit", code })),
     settled.then(() => ({ kind: "ready" }))
   ]);
   if (winner.kind === "exit") {
     status(`game exited before the ${plan.renderWaitSeconds}s render wait finished; no frame captured`);
-    return { code: normalize(winner.code), reason: reasonFor(winner.code) };
+    return exitResult(winner.code, trustExit);
   }
   const shot = await grabFrame(spec.name, plan);
   await stopContainer(spec.name, STOP_TIMEOUT_SECONDS);
@@ -6296,21 +7844,35 @@ async function runWithScreenshot(spec, plan, logDir) {
 async function grabFrame(container, plan) {
   const path = await captureScreenshot(container, plan);
   if (path === null)
-    warn("screenshot capture failed; is imagemagick in the image?");
+    warn("screenshot capture failed; the capture command printed the reason above");
   else
     status(`screenshot: ${path}`);
   return path;
 }
-async function runWithMarker(spec, plan, logDir) {
+var MARKER_GRACE_MS = 1000;
+async function runWithMarker(spec, plan, logDir, trustExit) {
   const marker = plan.marker;
   const container = runContainer(spec, { logDir, stopTimeoutSeconds: STOP_TIMEOUT_SECONDS });
-  const seen = waitForMarker(markerSources(plan, logDir), marker, plan.timeoutSeconds);
+  let waited;
+  const seen = waitForMarker(markerSources(plan, logDir), marker, plan.timeoutSeconds).then((hit) => {
+    waited = hit;
+    return hit;
+  });
   const winner = await Promise.race([
     container.then((code) => ({ kind: "exit", code })),
     seen.then((hit) => ({ kind: "marker", hit }))
   ]);
-  if (winner.kind === "exit")
-    return { code: normalize(winner.code), reason: reasonFor(winner.code) };
+  if (winner.kind === "exit") {
+    if (trustExit || winner.code === Exit.Interrupted)
+      return exitResult(winner.code, trustExit);
+    const hit = await Promise.race([seen, sleep8(MARKER_GRACE_MS).then(() => false)]);
+    if (hit) {
+      status(`marker seen: ${marker}`);
+      return { code: Exit.Ok, reason: "marker" };
+    }
+    status(`container exited before the marker "${marker}" appeared`);
+    return waited === false ? { code: Exit.MarkerTimeout, reason: "marker-timeout" } : { code: Exit.GameFailed, reason: "exited" };
+  }
   if (plan.mode === "screenshot")
     await grabFrame(spec.name, plan);
   await stopContainer(spec.name, STOP_TIMEOUT_SECONDS);
@@ -6322,6 +7884,12 @@ async function runWithMarker(spec, plan, logDir) {
   status(`marker "${marker}" not seen within ${plan.timeoutSeconds}s`);
   return { code: Exit.MarkerTimeout, reason: "marker-timeout" };
 }
+function exitResult(code, trustExit) {
+  if (trustExit || code === Exit.Interrupted) {
+    return { code: normalize(code), reason: reasonFor(code) };
+  }
+  return { code: Exit.GameFailed, reason: "exited" };
+}
 function normalize(code) {
   return Number.isInteger(code) && code >= 0 && code <= 255 ? code : Exit.GameFailed;
 }
@@ -6329,10 +7897,10 @@ async function copyOutLogs(plan) {
   const spec = plan.gameConfig.logFile;
   if (spec.mode !== "copy-out")
     return;
-  const source = join22(plan.dataDirHost, spec.from);
-  if (!existsSync12(source))
+  const source = join27(plan.dataDirHost, spec.from);
+  if (!existsSync15(source))
     return;
-  const target = join22(plan.runDirHost, basename11(spec.from));
+  const target = join27(plan.runDirHost, basename11(spec.from));
   try {
     await cp(source, target, { recursive: true, force: true });
   } catch (error) {
@@ -6399,7 +7967,7 @@ function steamcmdProblems(game, gameConfig, config) {
     });
   }
   const root = downloadRoot(config.dataRoot, gameConfig);
-  status(`${game}: workshop downloads ${root}${existsSync12(root) ? "" : " (not created yet)"}`);
+  status(`${game}: workshop downloads ${root}${existsSync15(root) ? "" : " (not created yet)"}`);
   return problems;
 }
 function reportDoctor(game, all) {
@@ -6424,12 +7992,12 @@ async function logs(args, config, defaults) {
   const dir = instanceDir(args, config, game, profile);
   if (args.follow)
     return await follow(dir, false, `${game} ${profile}`);
-  const runs = join22(dir, "logs", "runs");
+  const runs = join27(dir, "logs", "runs");
   const latest = (await readdir11(runs, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort().at(-1);
   if (latest === undefined) {
     throw new GamecrateError(`no runs recorded for ${game} ${profile}`, Exit.Usage, runs);
   }
-  const runDir = join22(runs, latest);
+  const runDir = join27(runs, latest);
   const files = (await readdir11(runDir, { withFileTypes: true })).filter((entry) => entry.isFile()).map((entry) => entry.name).sort();
   if (args.json) {
     process.stdout.write(`${JSON.stringify({ run: latest, dir: runDir, files }, null, 2)}
@@ -6438,7 +8006,7 @@ async function logs(args, config, defaults) {
   }
   status(runDir);
   for (const name of files) {
-    const text = await readFile12(join22(runDir, name), "utf8").catch(() => "");
+    const text = await readFile13(join27(runDir, name), "utf8").catch(() => "");
     for (const line of text.split(`
 `)) {
       if (line.length > 0)
@@ -6555,7 +8123,7 @@ function renderVerify(name, info, plan, boundMods) {
 `);
 }
 function shortenHome(path) {
-  const home = homedir5();
+  const home = homedir7();
   return path === home || path.startsWith(`${home}/`) ? `~${path.slice(home.length)}` : path;
 }
 async function clean(args, config, defaults) {
@@ -6570,7 +8138,7 @@ async function clean(args, config, defaults) {
     return Exit.Ok;
   }
   if (tier !== "all") {
-    const target = join22(instanceDir(args, config, game, profile), tier === "logs" ? "logs" : ".stage");
+    const target = join27(instanceDir(args, config, game, profile), tier === "logs" ? "logs" : ".stage");
     await rm5(target, { recursive: true, force: true });
     status(`removed ${target}`);
     return Exit.Ok;
@@ -6597,7 +8165,7 @@ async function countSaves(dir, suffixes) {
     }
     for (const entry of entries) {
       if (entry.isDirectory())
-        queue.push(join22(current, entry.name));
+        queue.push(join27(current, entry.name));
       else if (suffixes.some((s) => entry.name.toLowerCase().endsWith(s)))
         count++;
     }
@@ -6610,11 +8178,11 @@ async function clone(args, config) {
   if (src === undefined || dst === undefined) {
     throw new GamecrateError("clone needs a source and a destination profile", Exit.Usage);
   }
-  const from = join22(profileDataDir(config, game, src), "game");
-  const to = join22(profileDataDir(config, game, dst), "game");
-  if (!existsSync12(from))
+  const from = join27(profileDataDir(config, game, src), "game");
+  const to = join27(profileDataDir(config, game, dst), "game");
+  if (!existsSync15(from))
     throw new GamecrateError(`${from} does not exist`, Exit.Usage);
-  if (existsSync12(to) && !args.yes) {
+  if (existsSync15(to) && !args.yes) {
     throw new GamecrateError(`${to} already exists`, Exit.Usage, "add --yes to overwrite");
   }
   await mkdir6(to, { recursive: true });
@@ -6656,7 +8224,7 @@ async function ps(args, config) {
 async function stop(args, config, defaults) {
   const game = requireGame(args, config);
   const profile = profileOf(args, defaults);
-  const file = join22(instanceDir(args, config, game, profile), ".gamecrate", "lock");
+  const file = join27(instanceDir(args, config, game, profile), ".gamecrate", "lock");
   const record = await readLock(file);
   if (record === undefined) {
     status(`${game} ${profile} is not running`);
@@ -6670,17 +8238,17 @@ async function stop(args, config, defaults) {
   status(outcome === "signalled" ? `stopped ${record.container}` : `cleared the stale lock for ${record.container}`);
   return Exit.Ok;
 }
-async function attach(args, config, defaults) {
+async function attach2(args, config, defaults) {
   const game = requireGame(args, config);
   const profile = profileOf(args, defaults);
   return await follow(instanceDir(args, config, game, profile), true, `${game} ${profile}`);
 }
 async function follow(dir, fromStart, what) {
-  const lock = await readLock(join22(dir, ".gamecrate", "lock"));
+  const lock = await readLock(join27(dir, ".gamecrate", "lock"));
   const held = lock !== undefined && isRunning(lock.pid, lock.startedAt);
   const live = held && await awaitRunLog(dir, lock);
   const file = currentLog(dir);
-  if (!existsSync12(file)) {
+  if (!existsSync15(file)) {
     throw new GamecrateError(`no captured output for ${what}`, Exit.Usage, file);
   }
   return await spawnStatus(tailArgv(file, fromStart, live ? lock.pid : undefined), true);
@@ -6713,9 +8281,9 @@ async function configEdit(args) {
   if (args.rest[0] !== "edit")
     throw new GamecrateError("config takes one word: edit", Exit.Usage);
   const existing = await findGlobalConfig();
-  const path = existing ?? join22(globalConfigDir(), "profiles.yml");
-  await mkdir6(dirname10(path), { recursive: true });
-  if (!existsSync12(path)) {
+  const path = existing ?? join27(globalConfigDir(), "profiles.yml");
+  await mkdir6(dirname13(path), { recursive: true });
+  if (!existsSync15(path)) {
     await writeFile7(path, `# gamecrate config. see https://github.com/RimWorks/gamecrate
 ` + `plugins: []
 ` + `games: {}
@@ -6753,7 +8321,7 @@ async function fixPerms(args, config) {
   const identity = resolveIdentity(false);
   const found = [];
   for (const dir of await profileDirs(config, game, args.profile)) {
-    if (!existsSync12(dir))
+    if (!existsSync15(dir))
       continue;
     found.push(...await detectForeignOwnership(dir, identity.uid, 1e4));
   }