@getmonoceros/workbench 1.0.0

package/dist/bin.js

@@ -0,0 +1,3640 @@
+#!/usr/bin/env node
+
+// src/bin.ts
+import { runMain } from "citty";
+
+// src/help.ts
+var ANSI_BOLD = "\x1B[1m";
+var ANSI_UNDERLINE = "\x1B[4m";
+var ANSI_CYAN = "\x1B[36m";
+var ANSI_GREY = "\x1B[90m";
+var ANSI_RESET = "\x1B[0m";
+function isTty() {
+  return process.stdout.isTTY ?? false;
+}
+function color(text, ...codes) {
+  if (!isTty()) return text;
+  return codes.join("") + text + ANSI_RESET;
+}
+var bold = (s) => color(s, ANSI_BOLD);
+var underline = (s) => color(s, ANSI_UNDERLINE);
+var cyan = (s) => color(s, ANSI_CYAN);
+var grey = (s) => color(s, ANSI_GREY);
+function resolveArgs(argsDef) {
+  if (!argsDef) return [];
+  const out = [];
+  for (const [name, defRaw] of Object.entries(argsDef)) {
+    const def = defRaw ?? {};
+    out.push({
+      name,
+      type: def.type ?? "string",
+      required: def.required,
+      description: def.description,
+      default: def.default,
+      alias: def.alias,
+      valueHint: def.valueHint
+    });
+  }
+  return out;
+}
+function renderValueHint(arg) {
+  if (arg.type === "boolean") return "";
+  const hint = arg.valueHint ?? arg.name;
+  return `=<${hint}>`;
+}
+function renderArgDescription(arg, isRequired) {
+  const parts = [];
+  if (arg.description) parts.push(arg.description);
+  if (isRequired) parts.push(grey("(Required)"));
+  if (arg.default !== void 0 && arg.type !== "boolean") {
+    parts.push(grey(`(Default: ${JSON.stringify(arg.default)})`));
+  }
+  return parts.join(" ");
+}
+var ANSI_RE = /\x1b\[[0-9;]*m/g;
+function alignTable(rows, indent) {
+  if (rows.length === 0) return "";
+  const visibleLen = (s) => s.replace(ANSI_RE, "").length;
+  const width = Math.max(...rows.map((r) => visibleLen(r[0])));
+  return rows.map(([left, right]) => {
+    const pad = " ".repeat(width - visibleLen(left));
+    return `${indent}${left}${pad}    ${right}`;
+  }).join("\n");
+}
+function renderUsageBlock(cmd, commandPath) {
+  const meta = cmd.meta ?? {};
+  const args = resolveArgs(cmd.args ?? {});
+  const subCommands = cmd.subCommands ?? {};
+  const fullName = commandPath.join(" ") || meta.name || "monoceros";
+  const positionals = args.filter((a) => a.type === "positional");
+  const flags = args.filter((a) => a.type !== "positional");
+  const usageTokens = [];
+  for (const p of positionals) {
+    const isRequired = p.required !== false && p.default === void 0;
+    const t = p.name.toUpperCase();
+    usageTokens.push(isRequired ? `<${t}>` : `[${t}]`);
+  }
+  const subCommandNames = Object.keys(subCommands).filter((n) => {
+    const sub = subCommands[n];
+    const subMeta = sub?.meta ?? {};
+    return !subMeta.hidden;
+  });
+  if (subCommandNames.length > 0) usageTokens.push(subCommandNames.join("|"));
+  if (flags.length > 0) usageTokens.push("[OPTIONS]");
+  const lines = [];
+  const version = meta.version;
+  const header = `${meta.description ?? ""} (${fullName}${version ? ` v${version}` : ""})`;
+  lines.push(grey(header));
+  lines.push("");
+  lines.push(
+    `${underline(bold("USAGE"))} ${cyan([fullName, ...usageTokens].join(" "))}`
+  );
+  lines.push("");
+  if (positionals.length > 0) {
+    lines.push(underline(bold("ARGUMENTS")));
+    lines.push("");
+    const rows = positionals.map((p) => {
+      const isRequired = p.required !== false && p.default === void 0;
+      return [cyan(p.name.toUpperCase()), renderArgDescription(p, isRequired)];
+    });
+    lines.push(alignTable(rows, "  "));
+    lines.push("");
+  }
+  if (flags.length > 0) {
+    lines.push(underline(bold("OPTIONS")));
+    lines.push("");
+    const rows = flags.map((f) => {
+      const isRequired = f.required === true && f.default === void 0;
+      const aliases = (Array.isArray(f.alias) ? f.alias : f.alias ? [f.alias] : []).map((a) => `-${a}`);
+      const label = [...aliases, `--${f.name}`].join(", ") + renderValueHint(f);
+      return [cyan(label), renderArgDescription(f, isRequired)];
+    });
+    lines.push(alignTable(rows, "  "));
+    lines.push("");
+  }
+  if (subCommandNames.length > 0) {
+    lines.push(underline(bold("COMMANDS")));
+    lines.push("");
+    const rows = [];
+    for (const n of subCommandNames) {
+      const sub = subCommands[n];
+      const subMeta = sub?.meta ?? {};
+      rows.push([cyan(n), subMeta.description ?? ""]);
+    }
+    lines.push(alignTable(rows, "  "));
+    lines.push("");
+    lines.push(
+      `Use ${cyan(`${fullName} <command> --help`)} for more information about a command.`
+    );
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function detectHelpRequest(argv, main2) {
+  const helpIdx = argv.findIndex((a) => a === "--help" || a === "-h");
+  const separatorIdx = argv.indexOf("--");
+  if (helpIdx === -1) return null;
+  if (separatorIdx !== -1 && separatorIdx < helpIdx) return null;
+  const path14 = [];
+  const tokens = argv.slice(
+    0,
+    separatorIdx === -1 ? argv.length : separatorIdx
+  );
+  let cursor = main2;
+  const mainName = (main2.meta ?? {}).name ?? "monoceros";
+  path14.push(mainName);
+  for (const tok of tokens) {
+    if (tok.startsWith("-")) continue;
+    const subs = cursor.subCommands ?? {};
+    if (tok in subs) {
+      cursor = subs[tok];
+      path14.push(tok);
+      continue;
+    }
+    break;
+  }
+  return { path: path14, cmd: cursor };
+}
+async function maybeRenderHelp(argv, main2) {
+  const hit = detectHelpRequest(argv, main2);
+  if (!hit) return false;
+  process.stdout.write(renderUsageBlock(hit.cmd, hit.path) + "\n");
+  return true;
+}
+
+// src/inner-args.ts
+var innerArgs = [];
+function splitInnerArgs(userArgs) {
+  const dashIdx = userArgs.indexOf("--");
+  if (dashIdx === -1) {
+    return { outerArgs: [...userArgs], innerArgs: [] };
+  }
+  return {
+    outerArgs: userArgs.slice(0, dashIdx),
+    innerArgs: userArgs.slice(dashIdx + 1)
+  };
+}
+function consumeInnerArgsFromProcessArgv() {
+  const userArgs = process.argv.slice(2);
+  const split = splitInnerArgs(userArgs);
+  process.argv = [...process.argv.slice(0, 2), ...split.outerArgs];
+  innerArgs = split.innerArgs;
+}
+function getInnerArgs() {
+  return innerArgs;
+}
+
+// src/main.ts
+import { defineCommand as defineCommand24 } from "citty";
+
+// src/commands/add-apt-packages.ts
+import { defineCommand } from "citty";
+import { consola as consola2 } from "consola";
+
+// src/modify/index.ts
+import { promises as fs3 } from "fs";
+import { consola } from "consola";
+import { createPatch } from "diff";
+
+// src/config/io.ts
+import { promises as fs } from "fs";
+import { Document, parseDocument } from "yaml";
+
+// src/config/schema.ts
+import { z } from "zod";
+var SOLUTION_NAME_RE = /^[A-Za-z0-9._-]+$/;
+var APT_PACKAGE_NAME_RE = /^[a-z0-9][a-z0-9.+-]*$/;
+var FEATURE_REF_RE = /^[a-z0-9.-]+(\/[a-z0-9._-]+)+:[a-z0-9._-]+$/;
+var INSTALL_URL_RE = /^https:\/\/[A-Za-z0-9.\-_~/:?#[\]@!&'()*+,;=%]+$/;
+var REPO_URL_RE = /^[A-Za-z0-9@:/+_~.#=&?-]+$/;
+var REPO_NAME_RE = /^[A-Za-z0-9._-]+$/;
+var REPO_BRANCH_RE = /^[A-Za-z0-9._/-]+$/;
+var POSTGRES_URL_RE = /^postgres(ql)?:\/\//;
+var REGEX = {
+  solutionName: SOLUTION_NAME_RE,
+  aptPackage: APT_PACKAGE_NAME_RE,
+  featureRef: FEATURE_REF_RE,
+  installUrl: INSTALL_URL_RE,
+  repoUrl: REPO_URL_RE,
+  repoName: REPO_NAME_RE,
+  repoBranch: REPO_BRANCH_RE,
+  postgresUrl: POSTGRES_URL_RE
+};
+var CONFIG_SCHEMA_VERSION = 1;
+var FeatureOptionValueSchema = z.union([
+  z.string(),
+  z.number(),
+  z.boolean()
+]);
+var FeatureEntrySchema = z.object({
+  ref: z.string().regex(
+    FEATURE_REF_RE,
+    "Invalid feature ref. Expected an OCI-image-style ref like 'ghcr.io/devcontainers/features/<name>:<tag>'."
+  ),
+  options: z.record(z.string(), FeatureOptionValueSchema).optional()
+});
+var RepoEntrySchema = z.object({
+  url: z.string().regex(
+    REPO_URL_RE,
+    "Invalid repo URL. Use HTTPS or SSH/git@ form; no shell metacharacters."
+  ),
+  name: z.string().regex(
+    REPO_NAME_RE,
+    "Invalid repo name. Folder name must match /^[A-Za-z0-9._-]+$/."
+  ).optional(),
+  branch: z.string().regex(
+    REPO_BRANCH_RE,
+    "Invalid branch name. Must match /^[A-Za-z0-9._/-]+$/."
+  ).optional()
+});
+var GitUserSchema = z.object({
+  name: z.string().min(1),
+  email: z.string().min(3).regex(/^[^\s@]+@[^\s@]+\.[^\s@]+$/, "Invalid email")
+});
+var ExternalServicesSchema = z.object({
+  postgres: z.string().regex(
+    POSTGRES_URL_RE,
+    "Postgres URL must start with 'postgres://' or 'postgresql://'"
+  ).optional()
+});
+var SolutionConfigSchema = z.object({
+  schemaVersion: z.literal(CONFIG_SCHEMA_VERSION),
+  name: z.string().regex(
+    SOLUTION_NAME_RE,
+    "Invalid solution name. Use letters, digits, '.', '_' or '-'."
+  ),
+  languages: z.array(z.string().min(1)).default([]),
+  aptPackages: z.array(
+    z.string().regex(
+      APT_PACKAGE_NAME_RE,
+      "Invalid apt package name. Expected lowercase alphanumeric plus '.+-'."
+    )
+  ).default([]),
+  features: z.array(FeatureEntrySchema).default([]),
+  installUrls: z.array(
+    z.string().regex(
+      INSTALL_URL_RE,
+      "Invalid install URL. Must start with 'https://' and contain only URL-safe characters (no shell metacharacters)."
+    )
+  ).default([]),
+  services: z.array(z.string().min(1)).default([]),
+  repos: z.array(RepoEntrySchema).default([]),
+  externalServices: ExternalServicesSchema.default({}),
+  git: z.object({
+    user: GitUserSchema.optional()
+  }).optional()
+});
+function validateConfig(input) {
+  const result = SolutionConfigSchema.safeParse(input);
+  if (!result.success) {
+    const issues = result.error.issues.map((issue) => {
+      const where = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+      return `  - ${where}: ${issue.message}`;
+    }).join("\n");
+    throw new Error(`Invalid solution config:
+${issues}`);
+  }
+  return result.data;
+}
+
+// src/config/io.ts
+function parseConfig(yamlText, source = "<inline>") {
+  const doc = parseDocument(yamlText, { prettyErrors: true });
+  if (doc.errors.length > 0) {
+    const first = doc.errors[0];
+    throw new Error(`yaml parse error in ${source}: ${first.message}`);
+  }
+  const config = validateConfig(doc.toJS());
+  return { config, doc, source };
+}
+async function readConfig(filePath) {
+  const text = await fs.readFile(filePath, "utf8");
+  return parseConfig(text, filePath);
+}
+function stringifyConfig(doc) {
+  return String(doc);
+}
+
+// src/config/paths.ts
+import { existsSync } from "fs";
+import path from "path";
+import os from "os";
+import { fileURLToPath } from "url";
+var MONOCEROS_HOME_MARKER = "monoceros-config.sample.yml";
+var WORKBENCH_MARKER = path.join("templates", "components", "README.md");
+var CHECKOUT_MARKER = "pnpm-workspace.yaml";
+var cachedWorkbenchRoot = null;
+var cachedMonocerosHome = null;
+var cachedCheckoutRoot = void 0;
+function workbenchRoot() {
+  if (cachedWorkbenchRoot) return cachedWorkbenchRoot;
+  let dir = path.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    if (existsSync(path.join(dir, WORKBENCH_MARKER))) {
+      cachedWorkbenchRoot = dir;
+      return dir;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) {
+      throw new Error(
+        `Could not locate the monoceros workbench checkout (no ${WORKBENCH_MARKER} found by walking up). Run the CLI from a workbench checkout.`
+      );
+    }
+    dir = parent;
+  }
+}
+function monocerosHome(opts = {}) {
+  if (!opts.force && cachedMonocerosHome) return cachedMonocerosHome;
+  const fromEnv = process.env.MONOCEROS_HOME;
+  if (fromEnv && fromEnv.length > 0) {
+    cachedMonocerosHome = path.resolve(fromEnv);
+    return cachedMonocerosHome;
+  }
+  let dir = path.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    const candidate = path.join(dir, ".local");
+    if (existsSync(path.join(candidate, MONOCEROS_HOME_MARKER))) {
+      cachedMonocerosHome = candidate;
+      return candidate;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  cachedMonocerosHome = path.join(os.homedir(), ".monoceros");
+  return cachedMonocerosHome;
+}
+function workbenchCheckoutRoot() {
+  if (cachedCheckoutRoot !== void 0) return cachedCheckoutRoot;
+  let dir = path.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    if (existsSync(path.join(dir, CHECKOUT_MARKER))) {
+      cachedCheckoutRoot = dir;
+      return dir;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) {
+      cachedCheckoutRoot = null;
+      return null;
+    }
+    dir = parent;
+  }
+}
+function componentsDir(root = workbenchRoot()) {
+  return path.join(root, "templates", "components");
+}
+function containerConfigsDir(home = monocerosHome()) {
+  return path.join(home, "container-configs");
+}
+function containerConfigPath(name, home = monocerosHome()) {
+  return path.join(containerConfigsDir(home), `${name}.yml`);
+}
+function containersDir(home = monocerosHome()) {
+  return path.join(home, "container");
+}
+function containerDir(name, home = monocerosHome()) {
+  return path.join(containersDir(home), name);
+}
+function monocerosConfigPath(home = monocerosHome()) {
+  return path.join(home, "monoceros-config.yml");
+}
+
+// src/create/catalog.ts
+var DEFAULT_BASE_IMAGE = "ghcr.io/getmonoceros/monoceros-runtime:1";
+var override = process.env.MONOCEROS_BASE_IMAGE_OVERRIDE?.trim();
+var BASE_IMAGE = override && override.length > 0 ? override : DEFAULT_BASE_IMAGE;
+var BUILTIN_LANGUAGES = /* @__PURE__ */ new Set(["node"]);
+var LANGUAGE_CATALOG = {
+  node: { id: "node", feature: "ghcr.io/devcontainers/features/node:1" },
+  python: { id: "python", feature: "ghcr.io/devcontainers/features/python:1" },
+  java: { id: "java", feature: "ghcr.io/devcontainers/features/java:1" },
+  go: { id: "go", feature: "ghcr.io/devcontainers/features/go:1" },
+  rust: { id: "rust", feature: "ghcr.io/devcontainers/features/rust:1" },
+  dotnet: { id: "dotnet", feature: "ghcr.io/devcontainers/features/dotnet:2" }
+};
+var LANGUAGE_SPEC_RE = /^([a-z][a-z0-9-]*)(?::([A-Za-z0-9._-]+))?$/;
+function parseLanguageSpec(spec) {
+  const m = LANGUAGE_SPEC_RE.exec(spec);
+  if (!m) return null;
+  return { name: m[1], ...m[2] !== void 0 ? { version: m[2] } : {} };
+}
+var SERVICE_CATALOG = {
+  postgres: {
+    id: "postgres",
+    image: "postgres:18",
+    env: {
+      POSTGRES_USER: "monoceros",
+      POSTGRES_PASSWORD: "monoceros",
+      POSTGRES_DB: "monoceros"
+    },
+    // Postgres 18+ stores data under /var/lib/postgresql/<major>/, so
+    // the recommended mount is the parent directory; pre-18 used
+    // /var/lib/postgresql/data directly. See
+    // https://github.com/docker-library/postgres/pull/1259.
+    dataMount: "/var/lib/postgresql"
+  },
+  mysql: {
+    id: "mysql",
+    image: "mysql:8",
+    env: {
+      MYSQL_ROOT_PASSWORD: "monoceros",
+      MYSQL_DATABASE: "monoceros"
+    },
+    dataMount: "/var/lib/mysql"
+  },
+  redis: {
+    id: "redis",
+    image: "redis:8",
+    dataMount: "/data"
+  }
+};
+function knownLanguages() {
+  return [...BUILTIN_LANGUAGES, ...Object.keys(LANGUAGE_CATALOG)].sort();
+}
+function knownServices() {
+  return Object.keys(SERVICE_CATALOG).sort();
+}
+
+// src/create/scaffold.ts
+import { existsSync as existsSync2, readFileSync, promises as fs2 } from "fs";
+import path2 from "path";
+
+// src/util/ref.ts
+var FEATURE_NAME_CHARSET = "[a-z0-9._-]+";
+var FEATURE_TAG_CHARSET = "[a-z0-9._-]+";
+var MONOCEROS_FEATURE_RE = new RegExp(
+  `^ghcr\\.io/getmonoceros/monoceros-features/(${FEATURE_NAME_CHARSET}):${FEATURE_TAG_CHARSET}$`
+);
+var DEPRECATED_MONOCEROS_FEATURE_RE = new RegExp(
+  `^ghcr\\.io/monoceros/features/(${FEATURE_NAME_CHARSET}):(${FEATURE_TAG_CHARSET})$`
+);
+function matchMonocerosFeature(ref) {
+  const match = MONOCEROS_FEATURE_RE.exec(ref);
+  if (!match) return null;
+  return { name: match[1] };
+}
+function migrateDeprecatedFeatureRef(ref) {
+  const match = DEPRECATED_MONOCEROS_FEATURE_RE.exec(ref);
+  if (!match) return null;
+  const name = match[1];
+  const tag = match[2];
+  return `ghcr.io/getmonoceros/monoceros-features/${name}:${tag}`;
+}
+
+// src/create/scaffold.ts
+var APT_PACKAGE_NAME_RE2 = /^[a-z0-9][a-z0-9.+-]*$/;
+var FEATURE_REF_RE2 = /^[a-z0-9.-]+(\/[a-z0-9._-]+)+:[a-z0-9._-]+$/;
+var INSTALL_URL_RE2 = /^https:\/\/[A-Za-z0-9.\-_~/:?#[\]@!&'()*+,;=%]+$/;
+var REPO_URL_RE2 = /^[A-Za-z0-9@:/+_~.#=&?-]+$/;
+var REPO_NAME_RE2 = /^[A-Za-z0-9._-]+$/;
+var REPO_BRANCH_RE2 = /^[A-Za-z0-9._/-]+$/;
+function deriveRepoName(url) {
+  const lastSep = Math.max(url.lastIndexOf("/"), url.lastIndexOf(":"));
+  const tail = url.slice(lastSep + 1);
+  return tail.replace(/\.git$/, "");
+}
+function validateOptions(opts) {
+  if (!opts.name || !/^[a-zA-Z0-9._-]+$/.test(opts.name)) {
+    throw new Error(
+      `Invalid solution name: ${JSON.stringify(opts.name)}. Use letters, digits, '.', '_' or '-'.`
+    );
+  }
+  for (const langSpec of opts.languages) {
+    const parsed = parseLanguageSpec(langSpec);
+    if (!parsed) {
+      throw new Error(
+        `Invalid language spec: ${JSON.stringify(langSpec)}. Expected '<name>' or '<name>:<version>'.`
+      );
+    }
+    if (!BUILTIN_LANGUAGES.has(parsed.name) && !LANGUAGE_CATALOG[parsed.name]) {
+      throw new Error(
+        `Unknown language: ${parsed.name}. Known: ${knownLanguages().join(", ")}.`
+      );
+    }
+  }
+  for (const svc of opts.services) {
+    if (!SERVICE_CATALOG[svc]) {
+      throw new Error(
+        `Unknown service: ${svc}. Known: ${knownServices().join(", ")}.`
+      );
+    }
+  }
+  for (const pkg of opts.aptPackages ?? []) {
+    if (!APT_PACKAGE_NAME_RE2.test(pkg)) {
+      throw new Error(
+        `Invalid apt package name: ${JSON.stringify(pkg)}. Expected lowercase alphanumeric plus '.+-'.`
+      );
+    }
+  }
+  for (const ref of Object.keys(opts.features ?? {})) {
+    if (!FEATURE_REF_RE2.test(ref)) {
+      throw new Error(
+        `Invalid devcontainer feature ref: ${JSON.stringify(ref)}. Expected OCI-image-style ref like 'ghcr.io/devcontainers/features/<name>:<tag>'.`
+      );
+    }
+  }
+  for (const url of opts.installUrls ?? []) {
+    if (!INSTALL_URL_RE2.test(url)) {
+      throw new Error(
+        `Invalid install URL: ${JSON.stringify(url)}. Must start with 'https://' and contain only URL-safe characters (no shell metacharacters).`
+      );
+    }
+  }
+  const seenRepoNames = /* @__PURE__ */ new Set();
+  for (const repo of opts.repos ?? []) {
+    if (!REPO_URL_RE2.test(repo.url)) {
+      throw new Error(
+        `Invalid repo URL: ${JSON.stringify(repo.url)}. Use HTTPS or SSH/git@ form; no shell metacharacters.`
+      );
+    }
+    if (!REPO_NAME_RE2.test(repo.name)) {
+      throw new Error(
+        `Invalid repo name: ${JSON.stringify(repo.name)}. Folder name must match ${REPO_NAME_RE2}.`
+      );
+    }
+    if (repo.branch !== void 0 && !REPO_BRANCH_RE2.test(repo.branch)) {
+      throw new Error(
+        `Invalid branch name: ${JSON.stringify(repo.branch)}. Must match ${REPO_BRANCH_RE2}.`
+      );
+    }
+    if (seenRepoNames.has(repo.name)) {
+      throw new Error(
+        `Duplicate repo name: ${JSON.stringify(repo.name)}. Each projects/<name> folder must be unique \u2014 pass --name to disambiguate.`
+      );
+    }
+    seenRepoNames.add(repo.name);
+  }
+}
+function normalizeOptions(opts) {
+  const languages = [...new Set(opts.languages)].sort();
+  let services = [...new Set(opts.services)].sort();
+  if (opts.postgresUrl) {
+    services = services.filter((s) => s !== "postgres");
+  }
+  const aptPackages = [...new Set(opts.aptPackages ?? [])].sort();
+  const features = opts.features ? Object.fromEntries(
+    Object.entries(opts.features).sort(([a], [b]) => a.localeCompare(b))
+  ) : void 0;
+  const installUrls = opts.installUrls ? [...new Set(opts.installUrls)] : void 0;
+  const repos = opts.repos ? Array.from(
+    new Map(
+      opts.repos.map((r) => [`${r.url}
${r.name}
${r.branch ?? ""}`, r])
+    ).values()
+  ) : void 0;
+  return {
+    name: opts.name,
+    languages,
+    services,
+    postgresUrl: opts.postgresUrl,
+    ...aptPackages.length > 0 ? { aptPackages } : {},
+    ...features && Object.keys(features).length > 0 ? { features } : {},
+    ...installUrls && installUrls.length > 0 ? { installUrls } : {},
+    ...repos && repos.length > 0 ? { repos } : {}
+  };
+}
+function needsCompose(opts) {
+  return opts.services.length > 0;
+}
+var SSH_AGENT_TARGET = "/ssh-agent";
+var GIT_SSH_COMMAND = "ssh -o StrictHostKeyChecking=accept-new";
+function buildRepoAuthMounts() {
+  return [
+    `source=\${localEnv:SSH_AUTH_SOCK},target=${SSH_AGENT_TARGET},type=bind`
+  ];
+}
+function buildRepoAuthEnv() {
+  return {
+    SSH_AUTH_SOCK: SSH_AGENT_TARGET,
+    GIT_SSH_COMMAND
+  };
+}
+function resolveFeatures(opts) {
+  const resolved = [];
+  for (const langSpec of opts.languages) {
+    const parsed = parseLanguageSpec(langSpec);
+    if (!parsed) continue;
+    if (BUILTIN_LANGUAGES.has(parsed.name) && parsed.version === void 0) {
+      continue;
+    }
+    const entry2 = LANGUAGE_CATALOG[parsed.name];
+    if (!entry2) continue;
+    const options = {};
+    if (parsed.version !== void 0) options.version = parsed.version;
+    resolved.push({
+      devcontainerKey: entry2.feature,
+      options,
+      persistentHomePaths: [],
+      persistentHomeFiles: []
+    });
+  }
+  if (opts.aptPackages && opts.aptPackages.length > 0) {
+    resolved.push({
+      devcontainerKey: "ghcr.io/devcontainers-contrib/features/apt-packages:1",
+      options: { packages: opts.aptPackages.join(",") },
+      persistentHomePaths: [],
+      persistentHomeFiles: []
+    });
+  }
+  if (opts.features) {
+    for (const [rawRef, options] of Object.entries(opts.features)) {
+      const match = matchMonocerosFeature(rawRef);
+      if (match) {
+        const name = match.name;
+        const checkout = workbenchCheckoutRoot();
+        const localSourceDir = checkout ? path2.join(checkout, "images", "features", name) : null;
+        if (localSourceDir && existsSync2(localSourceDir)) {
+          const { paths, files } = readPersistentHomeEntries(localSourceDir);
+          resolved.push({
+            devcontainerKey: `./features/${name}`,
+            options,
+            localSourceDir,
+            localName: name,
+            persistentHomePaths: paths,
+            persistentHomeFiles: files
+          });
+          continue;
+        }
+      }
+      resolved.push({
+        devcontainerKey: rawRef,
+        options,
+        persistentHomePaths: [],
+        persistentHomeFiles: []
+      });
+    }
+  }
+  return resolved;
+}
+function readPersistentHomeEntries(localSourceDir) {
+  const manifestPath = path2.join(localSourceDir, "devcontainer-feature.json");
+  try {
+    const text = readFileSync(manifestPath, "utf8");
+    const parsed = JSON.parse(text);
+    return {
+      paths: filterSubpaths(parsed["x-monoceros"]?.persistentHomePaths),
+      files: filterFileEntries(parsed["x-monoceros"]?.persistentHomeFiles)
+    };
+  } catch {
+    return { paths: [], files: [] };
+  }
+}
+function filterSubpaths(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.filter(
+    (p) => typeof p === "string" && p.length > 0 && !p.startsWith("/") && !p.includes("..") && HOME_SUBPATH_RE.test(p)
+  );
+}
+function filterFileEntries(raw) {
+  if (!Array.isArray(raw)) return [];
+  const result = [];
+  for (const entry2 of raw) {
+    if (typeof entry2 === "string") {
+      if (isValidHomeSubpath(entry2)) {
+        result.push({ path: entry2, initialContent: "" });
+      }
+      continue;
+    }
+    if (entry2 !== null && typeof entry2 === "object" && "path" in entry2 && typeof entry2.path === "string") {
+      const e = entry2;
+      if (!isValidHomeSubpath(e.path)) continue;
+      const initialContent = typeof e.initialContent === "string" ? e.initialContent : "";
+      result.push({ path: e.path, initialContent });
+    }
+  }
+  return result;
+}
+function isValidHomeSubpath(p) {
+  return p.length > 0 && !p.startsWith("/") && !p.includes("..") && HOME_SUBPATH_RE.test(p);
+}
+var HOME_SUBPATH_RE = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/;
+function buildDevcontainerJson(opts) {
+  const resolvedFeatures = resolveFeatures(opts);
+  const features = {};
+  for (const f of resolvedFeatures) {
+    features[f.devcontainerKey] = f.options;
+  }
+  const featuresField = Object.keys(features).length > 0 ? { features } : void 0;
+  const homeMounts = [];
+  for (const f of resolvedFeatures) {
+    const allSubs = [
+      ...f.persistentHomePaths,
+      ...f.persistentHomeFiles.map((entry2) => entry2.path)
+    ];
+    for (const sub of allSubs) {
+      homeMounts.push(
+        `source=\${localWorkspaceFolder}/home/${sub},target=/home/node/${sub},type=bind`
+      );
+    }
+  }
+  const wantsRepoAuth = (opts.repos?.length ?? 0) > 0;
+  const repoAuthEnv = wantsRepoAuth ? { containerEnv: buildRepoAuthEnv() } : {};
+  if (needsCompose(opts)) {
+    return {
+      name: opts.name,
+      dockerComposeFile: "compose.yaml",
+      service: "workspace",
+      ...opts.services.length > 0 ? { runServices: opts.services } : {},
+      workspaceFolder: `/workspaces/${opts.name}`,
+      remoteUser: "node",
+      forwardPorts: [3e3, 4e3],
+      postCreateCommand: ".devcontainer/post-create.sh",
+      ...featuresField ?? {},
+      ...repoAuthEnv
+    };
+  }
+  const mounts = [
+    ...wantsRepoAuth ? buildRepoAuthMounts() : [],
+    ...homeMounts
+  ];
+  const mountsField = mounts.length > 0 ? { mounts } : {};
+  return {
+    name: opts.name,
+    image: BASE_IMAGE,
+    remoteUser: "node",
+    ...mountsField,
+    runArgs: ["--cap-add=NET_ADMIN"],
+    forwardPorts: [3e3, 4e3],
+    postCreateCommand: ".devcontainer/post-create.sh",
+    ...featuresField ?? {},
+    ...repoAuthEnv
+  };
+}
+function buildComposeYaml(opts) {
+  const lines = ["services:"];
+  lines.push("  workspace:");
+  lines.push(`    image: ${BASE_IMAGE}`);
+  lines.push("    command: 'sleep infinity'");
+  lines.push("    cap_add:");
+  lines.push("      - NET_ADMIN");
+  lines.push("    volumes:");
+  lines.push(`      - ..:/workspaces/${opts.name}:cached`);
+  const resolvedFeatures = resolveFeatures(opts);
+  for (const f of resolvedFeatures) {
+    const allSubs = [
+      ...f.persistentHomePaths,
+      ...f.persistentHomeFiles.map((entry2) => entry2.path)
+    ];
+    for (const sub of allSubs) {
+      lines.push(`      - ../home/${sub}:/home/node/${sub}`);
+    }
+  }
+  const wantsRepoAuth = (opts.repos?.length ?? 0) > 0;
+  if (wantsRepoAuth) {
+    lines.push(`      - \${SSH_AUTH_SOCK:-/dev/null}:${SSH_AGENT_TARGET}`);
+    lines.push("    environment:");
+    lines.push(`      SSH_AUTH_SOCK: ${SSH_AGENT_TARGET}`);
+    lines.push(`      GIT_SSH_COMMAND: "${GIT_SSH_COMMAND}"`);
+  }
+  for (const svcId of opts.services) {
+    const def = SERVICE_CATALOG[svcId];
+    if (!def) continue;
+    lines.push(`  ${def.id}:`);
+    lines.push(`    image: ${def.image}`);
+    if (def.env) {
+      lines.push("    environment:");
+      for (const [k, v] of Object.entries(def.env)) {
+        lines.push(`      ${k}: ${v}`);
+      }
+    }
+    if (def.dataMount) {
+      lines.push("    volumes:");
+      lines.push(`      - ../data/${def.id}:${def.dataMount}`);
+    }
+  }
+  return lines.join("\n") + "\n";
+}
+function buildCodeWorkspaceJson(opts) {
+  const folders = [{ path: "." }];
+  const sortedRepos = [...opts.repos ?? []].sort(
+    (a, b) => a.name.localeCompare(b.name)
+  );
+  for (const repo of sortedRepos) {
+    folders.push({ path: `projects/${repo.name}`, name: repo.name });
+  }
+  return { folders };
+}
+function buildPostCreateScript(opts) {
+  const lines = [
+    "#!/usr/bin/env bash",
+    "set -euo pipefail",
+    "",
+    "# Inherit host-side git identity (user.name / user.email) captured",
+    "# into .monoceros/gitconfig by `monoceros apply`. Container-local",
+    "# git config loads first; the include below merges the host's",
+    "# identity values in.",
+    `git config --global include.path "/workspaces/${opts.name}/.monoceros/gitconfig"`,
+    "",
+    "# Per-feature post-create hooks. Each Monoceros-curated feature",
+    "# may drop a script into /usr/local/share/monoceros/post-create.d/",
+    "# during its install.sh \u2014 typical job is a non-interactive login",
+    "# against bind-mounted state under /home/node, using the option",
+    "# values the feature received as env vars at install time. Scripts",
+    "# run in lexicographic order, each in its own subshell, and a",
+    "# failure aborts post-create (set -e is in effect).",
+    "if [ -d /usr/local/share/monoceros/post-create.d ]; then",
+    "  for hook in /usr/local/share/monoceros/post-create.d/*.sh; do",
+    '    [ -f "$hook" ] || continue',
+    '    echo "\u2192 post-create hook: $(basename "$hook")"',
+    '    bash "$hook"',
+    "  done",
+    "fi",
+    "",
+    "# Bring up Node dependencies if the workspace has a package.json.",
+    "if [ -f package.json ]; then",
+    "  pnpm install",
+    "fi"
+  ];
+  if (opts.installUrls && opts.installUrls.length > 0) {
+    lines.push(
+      "",
+      "# Custom install URLs added via `monoceros add-from-url`. Each is",
+      "# fetched and piped to `sh` on every container rebuild. URLs run",
+      "# in insertion order so later installs can build on earlier ones.",
+      "#",
+      "# Why `sh` (not `bash`): most install scripts target POSIX `sh`",
+      "# and some (starship, rustup, \u2026) explicitly refuse to run under",
+      "# `bash`. Outer `set -o pipefail` in this script makes a curl",
+      "# failure abort the post-create as expected.",
+      `echo "\u2192 Running ${opts.installUrls.length} install URL(s) added via add-from-url\u2026"`
+    );
+    for (const url of opts.installUrls) {
+      lines.push(`echo "\u2192 ${url}"`, `curl -fsSL "${url}" | sh`);
+    }
+  }
+  if (opts.repos && opts.repos.length > 0) {
+    const hasHttpsRepo = opts.repos.some((r) => r.url.startsWith("https://"));
+    if (hasHttpsRepo) {
+      lines.push(
+        "",
+        "# Wire git to the per-dev-container credentials file populated",
+        "# by `monoceros apply` (via `git credential fill` on the host).",
+        "# Path uses the workspace bind-mount so the file is reachable",
+        "# from inside the container.",
+        `git config --global credential.helper "store --file=/workspaces/${opts.name}/.monoceros/git-credentials"`
+      );
+    }
+    lines.push(
+      "",
+      "# Repos managed by `monoceros add-repo`. Each entry is cloned",
+      "# into `projects/<name>/` if (and only if) the directory does",
+      "# not exist yet. Existing project subfolders are left alone so",
+      "# local changes survive `monoceros apply` rebuilds.",
+      "mkdir -p projects"
+    );
+    for (const repo of opts.repos) {
+      const branchFlag = repo.branch ? ` --branch ${repo.branch}` : "";
+      const branchLabel = repo.branch ? ` (branch: ${repo.branch})` : "";
+      lines.push(
+        `if [ ! -d "projects/${repo.name}" ]; then`,
+        `  echo "\u2192 Cloning ${repo.name} from ${repo.url}${branchLabel}\u2026"`,
+        `  git clone${branchFlag} "${repo.url}" "projects/${repo.name}"`,
+        `else`,
+        `  echo "\u2192 projects/${repo.name} already exists, skipping clone"`,
+        `fi`
+      );
+    }
+  }
+  return lines.join("\n") + "\n";
+}
+async function writePostCreateScript(devcontainerDir, opts) {
+  const dest = path2.join(devcontainerDir, "post-create.sh");
+  await fs2.writeFile(dest, buildPostCreateScript(opts));
+  await fs2.chmod(dest, 493);
+}
+async function writeScaffold(opts, targetDir) {
+  const devcontainerDir = path2.join(targetDir, ".devcontainer");
+  const monocerosDir = path2.join(targetDir, ".monoceros");
+  const projectsDir = path2.join(targetDir, "projects");
+  const homeDir = path2.join(targetDir, "home");
+  const dataDir = path2.join(targetDir, "data");
+  await fs2.mkdir(devcontainerDir, { recursive: true });
+  await fs2.mkdir(monocerosDir, { recursive: true });
+  await fs2.mkdir(projectsDir, { recursive: true });
+  await fs2.mkdir(homeDir, { recursive: true });
+  if (needsCompose(opts)) {
+    await fs2.mkdir(dataDir, { recursive: true });
+    for (const svcId of opts.services) {
+      const def = SERVICE_CATALOG[svcId];
+      if (def?.dataMount) {
+        await fs2.mkdir(path2.join(dataDir, def.id), { recursive: true });
+      }
+    }
+  }
+  const containerGitignore = path2.join(targetDir, ".gitignore");
+  await fs2.writeFile(containerGitignore, "/home/\n/.monoceros/\n/data/\n");
+  const gitkeep = path2.join(projectsDir, ".gitkeep");
+  if (!existsSync2(gitkeep)) {
+    await fs2.writeFile(gitkeep, "");
+  }
+  await fs2.writeFile(
+    path2.join(monocerosDir, ".gitignore"),
+    "git-credentials*\ngitconfig\n"
+  );
+  const devcontainerJson = buildDevcontainerJson(opts);
+  await fs2.writeFile(
+    path2.join(devcontainerDir, "devcontainer.json"),
+    JSON.stringify(devcontainerJson, null, 2) + "\n"
+  );
+  const featuresDir = path2.join(devcontainerDir, "features");
+  if (existsSync2(featuresDir)) {
+    await fs2.rm(featuresDir, { recursive: true, force: true });
+  }
+  const resolvedFeatures = resolveFeatures(opts);
+  for (const f of resolvedFeatures) {
+    if (!f.localSourceDir || !f.localName) continue;
+    const dest = path2.join(featuresDir, f.localName);
+    await fs2.mkdir(dest, { recursive: true });
+    await fs2.cp(f.localSourceDir, dest, { recursive: true });
+  }
+  for (const f of resolvedFeatures) {
+    for (const sub of f.persistentHomePaths) {
+      await fs2.mkdir(path2.join(homeDir, sub), { recursive: true });
+    }
+    for (const entry2 of f.persistentHomeFiles) {
+      const filePath = path2.join(homeDir, entry2.path);
+      await fs2.mkdir(path2.dirname(filePath), { recursive: true });
+      if (!existsSync2(filePath)) {
+        await fs2.writeFile(filePath, entry2.initialContent);
+      }
+    }
+  }
+  await writePostCreateScript(devcontainerDir, opts);
+  const composePath = path2.join(devcontainerDir, "compose.yaml");
+  if (needsCompose(opts)) {
+    await fs2.writeFile(composePath, buildComposeYaml(opts));
+  } else if (existsSync2(composePath)) {
+    await fs2.rm(composePath);
+  }
+  await fs2.writeFile(
+    path2.join(targetDir, `${opts.name}.code-workspace`),
+    JSON.stringify(buildCodeWorkspaceJson(opts), null, 2) + "\n"
+  );
+}
+
+// src/modify/yml.ts
+import { isMap, isScalar, isSeq, YAMLMap, YAMLSeq } from "yaml";
+function ensureSeq(doc, key) {
+  const existing = doc.get(key, true);
+  if (existing && isSeq(existing)) return existing;
+  const seq = new YAMLSeq();
+  doc.set(key, seq);
+  return seq;
+}
+function pruneEmptySeq(doc, key) {
+  const node = doc.get(key, true);
+  if (node && isSeq(node) && node.items.length === 0) {
+    doc.delete(key);
+  }
+}
+function scalarValue(item) {
+  return isScalar(item) ? item.value : item;
+}
+function addLanguageToDoc(doc, lang) {
+  const seq = ensureSeq(doc, "languages");
+  if (seq.items.some((i) => scalarValue(i) === lang)) return false;
+  seq.add(lang);
+  return true;
+}
+function addServiceToDoc(doc, service) {
+  const seq = ensureSeq(doc, "services");
+  if (seq.items.some((i) => scalarValue(i) === service)) return false;
+  seq.add(service);
+  return true;
+}
+function addAptPackagesToDoc(doc, packages) {
+  const seq = ensureSeq(doc, "aptPackages");
+  let changed = false;
+  for (const pkg of packages) {
+    if (seq.items.some((i) => scalarValue(i) === pkg)) continue;
+    seq.add(pkg);
+    changed = true;
+  }
+  return changed;
+}
+function addInstallUrlToDoc(doc, url) {
+  const seq = ensureSeq(doc, "installUrls");
+  if (seq.items.some((i) => scalarValue(i) === url)) return false;
+  seq.add(url);
+  return true;
+}
+function addFeatureToDoc(doc, ref, options = {}) {
+  const seq = ensureSeq(doc, "features");
+  for (const item of seq.items) {
+    if (!isMap(item)) continue;
+    const itemRef = item.get("ref");
+    if (itemRef !== ref) continue;
+    const itemJs = item.toJS(doc);
+    const existingJs = itemJs.options ?? {};
+    if (JSON.stringify(existingJs) === JSON.stringify(options)) {
+      return false;
+    }
+    throw new Error(
+      `Feature ${ref} is already configured with different options. Remove it first (\`monoceros remove-feature ${ref}\`) before re-adding.`
+    );
+  }
+  const entry2 = new YAMLMap();
+  entry2.set("ref", ref);
+  if (Object.keys(options).length > 0) {
+    entry2.set("options", options);
+  }
+  seq.add(entry2);
+  return true;
+}
+function addRepoToDoc(doc, repo) {
+  const seq = ensureSeq(doc, "repos");
+  const repoName = repo.name ?? deriveRepoName(repo.url);
+  for (const item of seq.items) {
+    if (!isMap(item)) continue;
+    const url = item.get("url");
+    if (url !== repo.url) continue;
+    const existingName = item.get("name");
+    const effectiveName = typeof existingName === "string" ? existingName : deriveRepoName(url);
+    const existingBranch = item.get("branch");
+    if (effectiveName === repoName && (existingBranch ?? void 0) === (repo.branch ?? void 0)) {
+      return false;
+    }
+  }
+  const entry2 = new YAMLMap();
+  entry2.set("url", repo.url);
+  if (repo.name !== void 0 && repo.name !== deriveRepoName(repo.url)) {
+    entry2.set("name", repo.name);
+  }
+  if (repo.branch !== void 0) {
+    entry2.set("branch", repo.branch);
+  }
+  seq.add(entry2);
+  return true;
+}
+function removeLanguageFromDoc(doc, lang) {
+  return removeScalarFromSeq(doc, "languages", lang);
+}
+function removeServiceFromDoc(doc, service) {
+  return removeScalarFromSeq(doc, "services", service);
+}
+function removeAptPackageFromDoc(doc, pkg) {
+  return removeScalarFromSeq(doc, "aptPackages", pkg);
+}
+function removeAptPackagesFromDoc(doc, packages) {
+  let changed = false;
+  for (const pkg of packages) {
+    if (removeAptPackageFromDoc(doc, pkg)) changed = true;
+  }
+  return changed;
+}
+function removeInstallUrlFromDoc(doc, url) {
+  return removeScalarFromSeq(doc, "installUrls", url);
+}
+function removeFeatureFromDoc(doc, ref) {
+  const seq = doc.get("features", true);
+  if (!seq || !isSeq(seq)) return false;
+  const idx = seq.items.findIndex((i) => isMap(i) && i.get("ref") === ref);
+  if (idx < 0) return false;
+  seq.items.splice(idx, 1);
+  pruneEmptySeq(doc, "features");
+  return true;
+}
+function removeRepoFromDoc(doc, urlOrName) {
+  const seq = doc.get("repos", true);
+  if (!seq || !isSeq(seq)) return false;
+  const idx = seq.items.findIndex((item) => {
+    if (!isMap(item)) return false;
+    const url = item.get("url");
+    if (url === urlOrName) return true;
+    const name = item.get("name");
+    const effectiveName = typeof name === "string" ? name : typeof url === "string" ? deriveRepoName(url) : void 0;
+    return effectiveName === urlOrName;
+  });
+  if (idx < 0) return false;
+  seq.items.splice(idx, 1);
+  pruneEmptySeq(doc, "repos");
+  return true;
+}
+function removeScalarFromSeq(doc, key, value) {
+  const seq = doc.get(key, true);
+  if (!seq || !isSeq(seq)) return false;
+  const idx = seq.items.findIndex((i) => scalarValue(i) === value);
+  if (idx < 0) return false;
+  seq.items.splice(idx, 1);
+  pruneEmptySeq(doc, key);
+  return true;
+}
+
+// src/modify/index.ts
+function runAddLanguage(input) {
+  if (!BUILTIN_LANGUAGES.has(input.language) && !LANGUAGE_CATALOG[input.language]) {
+    throw new Error(
+      `Unknown language: ${input.language}. Known: ${knownLanguages().join(", ")}.`
+    );
+  }
+  return mutate(input, (doc) => addLanguageToDoc(doc, input.language));
+}
+function runAddService(input) {
+  if (!SERVICE_CATALOG[input.service]) {
+    throw new Error(
+      `Unknown service: ${input.service}. Known: ${knownServices().join(", ")}.`
+    );
+  }
+  return mutate(input, (doc) => addServiceToDoc(doc, input.service));
+}
+function runAddAptPackages(input) {
+  if (input.packages.length === 0) {
+    throw new Error(
+      "No package names given. Usage: monoceros add-apt-packages <containername> -- <pkg> [<pkg> \u2026]."
+    );
+  }
+  return mutate(input, (doc) => addAptPackagesToDoc(doc, input.packages));
+}
+function runAddRepo(input) {
+  const url = input.url.trim();
+  if (url.length === 0) {
+    throw new Error(
+      "Missing repo URL. Usage: monoceros add-repo <containername> <url>."
+    );
+  }
+  const name = (input.repoName ?? deriveRepoName(url)).trim();
+  const entry2 = {
+    url,
+    name,
+    ...input.branch !== void 0 ? { branch: input.branch } : {}
+  };
+  return mutate(input, (doc) => addRepoToDoc(doc, entry2));
+}
+function runAddFromUrl(input) {
+  const url = input.url.trim();
+  if (url.length === 0) {
+    throw new Error(
+      "Missing URL. Usage: monoceros add-from-url <containername> <url>."
+    );
+  }
+  return mutate(input, (doc) => addInstallUrlToDoc(doc, url));
+}
+function runAddFeature(input) {
+  const ref = input.ref.trim();
+  if (ref.length === 0) {
+    throw new Error(
+      "Missing feature ref. Usage: monoceros add-feature <containername> <ref>."
+    );
+  }
+  return mutate(input, (doc) => addFeatureToDoc(doc, ref, input.options ?? {}));
+}
+function runRemoveLanguage(input) {
+  return mutate(input, (doc) => removeLanguageFromDoc(doc, input.language));
+}
+function runRemoveService(input) {
+  return mutate(input, (doc) => removeServiceFromDoc(doc, input.service));
+}
+function runRemoveAptPackages(input) {
+  if (input.packages.length === 0) {
+    throw new Error(
+      "No package names given. Usage: monoceros remove-apt-packages <containername> -- <pkg> [<pkg> \u2026]."
+    );
+  }
+  return mutate(input, (doc) => removeAptPackagesFromDoc(doc, input.packages));
+}
+function runRemoveFeature(input) {
+  const ref = input.ref.trim();
+  if (ref.length === 0) {
+    throw new Error(
+      "Missing feature ref. Usage: monoceros remove-feature <containername> <ref>."
+    );
+  }
+  return mutate(input, (doc) => removeFeatureFromDoc(doc, ref));
+}
+function runRemoveFromUrl(input) {
+  const url = input.url.trim();
+  if (url.length === 0) {
+    throw new Error(
+      "Missing URL. Usage: monoceros remove-from-url <containername> <url>."
+    );
+  }
+  return mutate(input, (doc) => removeInstallUrlFromDoc(doc, url));
+}
+function runRemoveRepo(input) {
+  const target = input.target.trim();
+  if (target.length === 0) {
+    throw new Error(
+      "Missing repo identifier. Usage: monoceros remove-repo <containername> <url-or-name>."
+    );
+  }
+  return mutate(input, (doc) => removeRepoFromDoc(doc, target));
+}
+async function mutate(opts, apply) {
+  if (!REGEX.solutionName.test(opts.name)) {
+    throw new Error(
+      `Invalid container name: ${JSON.stringify(opts.name)}. Use letters, digits, '.', '_' or '-'.`
+    );
+  }
+  const home = opts.monocerosHome ?? monocerosHome();
+  const ymlPath = containerConfigPath(opts.name, home);
+  const logger = opts.logger ?? defaultLogger();
+  let oldText;
+  try {
+    oldText = await fs3.readFile(ymlPath, "utf8");
+  } catch {
+    throw new Error(
+      `No such config: ${ymlPath}. Run \`monoceros init <template> ${opts.name}\` first.`
+    );
+  }
+  const parsed = parseConfig(oldText, ymlPath);
+  const changed = apply(parsed.doc);
+  if (!changed) {
+    logger.info("No changes \u2014 yml is already in the desired state.");
+    return { status: "no-change" };
+  }
+  const newText = stringifyConfig(parsed.doc);
+  parseConfig(newText, ymlPath);
+  const out = opts.output ?? ((line) => process.stdout.write(line + "\n"));
+  out(createPatch(ymlPath, oldText, newText, "before", "after"));
+  if (!opts.yes) {
+    const confirm = opts.confirm ?? defaultConfirm;
+    const ok = await confirm("Apply these changes to the yml?");
+    if (!ok) {
+      logger.warn("Aborted by user. The yml was not modified.");
+      return { status: "aborted" };
+    }
+  }
+  await fs3.writeFile(ymlPath, newText, "utf8");
+  logger.success(`Updated ${ymlPath}.`);
+  logger.info(
+    `Run \`monoceros apply ${opts.name}\` to rebuild the dev-container and pick up the change.`
+  );
+  return { status: "updated", changedPaths: [ymlPath] };
+}
+function defaultLogger() {
+  return {
+    info: (m) => consola.info(m),
+    success: (m) => consola.success(m),
+    warn: (m) => consola.warn(m)
+  };
+}
+var defaultConfirm = async (message) => {
+  const result = await consola.prompt(message, {
+    type: "confirm",
+    initial: false
+  });
+  return result === true;
+};
+
+// src/commands/add-apt-packages.ts
+var addAptPackagesCommand = defineCommand({
+  meta: {
+    name: "add-apt-packages",
+    description: "Add Debian/Ubuntu apt packages to the container config. Pass package names after `--` (e.g. `monoceros add-apt-packages sandbox -- make openssh-client jq`). Idempotent. No curated whitelist \u2014 invalid names surface as apt errors at container build time."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    const packages = [...getInnerArgs()];
+    if (packages.length === 0) {
+      consola2.error(
+        "No package names given. Usage: `monoceros add-apt-packages <containername> [--yes] -- <pkg> [<pkg> \u2026]`."
+      );
+      process.exit(1);
+    }
+    try {
+      const result = await runAddAptPackages({
+        name: args.name,
+        packages,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola2.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/add-feature.ts
+import { defineCommand as defineCommand2 } from "citty";
+import { consola as consola3 } from "consola";
+var addFeatureCommand = defineCommand2({
+  meta: {
+    name: "add-feature",
+    description: "Add a devcontainer feature by ref to the container config. Options follow `--` as `key=value` pairs. Idempotent (same ref + same options is a no-op). Adding the same ref with different options is an error."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    ref: {
+      type: "positional",
+      description: "Devcontainer feature ref (OCI image style, e.g. `ghcr.io/devcontainers/features/docker-in-docker:2`).",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    let options;
+    try {
+      options = parseOptionsAfterDashes(getInnerArgs());
+    } catch (err) {
+      consola3.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+    try {
+      const result = await runAddFeature({
+        name: args.name,
+        ref: args.ref,
+        options,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola3.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+function parseOptionsAfterDashes(tokens) {
+  const result = {};
+  for (const token of tokens) {
+    const eqIdx = token.indexOf("=");
+    if (eqIdx <= 0) {
+      throw new Error(
+        `Invalid option: ${JSON.stringify(token)}. Expected key=value (e.g. version=latest).`
+      );
+    }
+    const key = token.slice(0, eqIdx);
+    const raw = token.slice(eqIdx + 1);
+    result[key] = coerce(raw);
+  }
+  return result;
+}
+function coerce(value) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  if (/^-?\d+$/.test(value)) {
+    const n = Number(value);
+    if (Number.isSafeInteger(n)) return n;
+  }
+  return value;
+}
+
+// src/commands/add-from-url.ts
+import { defineCommand as defineCommand3 } from "citty";
+import { consola as consola4 } from "consola";
+var addFromUrlCommand = defineCommand3({
+  meta: {
+    name: "add-from-url",
+    description: "Add an https:// install URL to the container config. The URL gets piped to sh on every container rebuild. Loudly warns about remote-code execution before persisting. Idempotent."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    url: {
+      type: "positional",
+      description: "https:// URL of an install script (e.g. https://starship.rs/install.sh).",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the security warning + diff confirm. Use only in scripts where you have already audited the URL.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    if (!args.yes) {
+      printSecurityWarning(args.url);
+    }
+    try {
+      const result = await runAddFromUrl({
+        name: args.name,
+        url: args.url,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola4.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+function printSecurityWarning(url) {
+  const w = (line) => process.stderr.write(line + "\n");
+  w("");
+  w("\u26A0\uFE0F  SECURITY WARNING \u2014 `monoceros add-from-url`");
+  w("");
+  w(`  URL: ${url}`);
+  w("");
+  w("  This URL will be fetched and piped to sh on every container rebuild.");
+  w(
+    "  Remote-code execution against a URL you do not control is a supply-chain"
+  );
+  w(
+    "  risk: the maintainer could change the script tomorrow and your container"
+  );
+  w("  would silently run the new payload.");
+  w("");
+  w("  Before confirming below:");
+  w("    1. Open the URL in a browser, read what the script does.");
+  w(
+    "    2. Verify the maintainer is who you think they are (HTTPS cert, repo)."
+  );
+  w("    3. Ideally, vendor the install steps as `add-apt-packages` or");
+  w(
+    "       `add-feature` instead \u2014 those reference signed/versioned artifacts."
+  );
+  w("");
+}
+
+// src/commands/add-repo.ts
+import { defineCommand as defineCommand4 } from "citty";
+import { consola as consola5 } from "consola";
+var addRepoCommand = defineCommand4({
+  meta: {
+    name: "add-repo",
+    description: "Add a git repo to the container config. Cloned into projects/<folder>/ on container build. Idempotent \u2014 existing project subfolders are left alone. Folder name derived from URL by default; override with --as."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    url: {
+      type: "positional",
+      description: "Git URL (HTTPS or SSH/git@ form). E.g. https://github.com/foo/bar.git, git@github.com:foo/bar.git.",
+      required: true
+    },
+    as: {
+      type: "string",
+      description: "Folder name under projects/. Default: derived from URL (e.g. bar.git \u2192 bar)."
+    },
+    branch: {
+      type: "string",
+      description: "Specific branch to clone (default: repo default branch)."
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const result = await runAddRepo({
+        name: args.name,
+        url: args.url,
+        ...typeof args.as === "string" ? { repoName: args.as } : {},
+        ...typeof args.branch === "string" ? { branch: args.branch } : {},
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola5.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/add-language.ts
+import { defineCommand as defineCommand5 } from "citty";
+import { consola as consola6 } from "consola";
+var addLanguageCommand = defineCommand5({
+  meta: {
+    name: "add-language",
+    description: "Add a language toolchain (devcontainer feature) to the container config. Idempotent, prints a diff before writing."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    language: {
+      type: "positional",
+      description: "Language identifier from the feature whitelist (e.g. python, java, rust).",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const result = await runAddLanguage({
+        name: args.name,
+        language: args.language,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola6.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/add-service.ts
+import { defineCommand as defineCommand6 } from "citty";
+import { consola as consola7 } from "consola";
+var addServiceCommand = defineCommand6({
+  meta: {
+    name: "add-service",
+    description: "Add a compose service (postgres, mysql, redis, \u2026) to the container config. Idempotent, prints a diff before writing."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    service: {
+      type: "positional",
+      description: "Service identifier (postgres, mysql, redis).",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const result = await runAddService({
+        name: args.name,
+        service: args.service,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola7.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/apply.ts
+import { defineCommand as defineCommand7 } from "citty";
+
+// src/apply/index.ts
+import { existsSync as existsSync4, promises as fs8 } from "fs";
+import { consola as consola10 } from "consola";
+
+// src/config/global.ts
+import { promises as fs4 } from "fs";
+import { z as z2 } from "zod";
+import { parseDocument as parseDocument2 } from "yaml";
+var SCHEMA_VERSION = 1;
+var MonocerosConfigSchema = z2.object({
+  schemaVersion: z2.literal(SCHEMA_VERSION),
+  defaults: z2.object({
+    git: z2.object({
+      user: GitUserSchema.optional()
+    }).optional(),
+    features: z2.record(
+      z2.string().regex(
+        REGEX.featureRef,
+        "Invalid feature ref. Expected an OCI-image-style ref like 'ghcr.io/getmonoceros/monoceros-features/<name>:<tag>'."
+      ),
+      z2.record(z2.string(), FeatureOptionValueSchema)
+    ).optional()
+  }).optional()
+});
+async function readMonocerosConfig(opts = {}) {
+  const home = opts.monocerosHome ?? monocerosHome();
+  const filePath = monocerosConfigPath(home);
+  let text;
+  try {
+    text = await fs4.readFile(filePath, "utf8");
+  } catch {
+    return void 0;
+  }
+  const doc = parseDocument2(text, { prettyErrors: true });
+  if (doc.errors.length > 0) {
+    throw new Error(
+      `yaml parse error in ${filePath}: ${doc.errors[0].message}`
+    );
+  }
+  const result = MonocerosConfigSchema.safeParse(doc.toJS());
+  if (!result.success) {
+    const issues = result.error.issues.map((issue) => {
+      const where = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+      return `  - ${where}: ${issue.message}`;
+    }).join("\n");
+    throw new Error(
+      `Invalid ${filePath}:
+${issues}
+
+See ${filePath.replace(
+        /\.yml$/,
+        ".sample.yml"
+      )} for a valid example.`
+    );
+  }
+  return result.data;
+}
+
+// src/config/state.ts
+import { promises as fs5 } from "fs";
+import path3 from "path";
+function buildStateFile(opts) {
+  return {
+    schemaVersion: CONFIG_SCHEMA_VERSION,
+    origin: opts.origin,
+    monocerosCliVersion: opts.cliVersion,
+    materializedAt: (opts.now ?? /* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function stateFilePath(targetDir) {
+  return path3.join(targetDir, ".monoceros", "state.json");
+}
+async function readStateFile(targetDir) {
+  try {
+    const content = await fs5.readFile(stateFilePath(targetDir), "utf8");
+    return JSON.parse(content);
+  } catch {
+    return void 0;
+  }
+}
+async function writeStateFile(targetDir, state) {
+  const monocerosDir = path3.join(targetDir, ".monoceros");
+  await fs5.mkdir(monocerosDir, { recursive: true });
+  await fs5.writeFile(
+    stateFilePath(targetDir),
+    JSON.stringify(state, null, 2) + "\n"
+  );
+}
+
+// src/config/transform.ts
+function solutionConfigToCreateOptions(config, featureDefaults = {}) {
+  const featureRecord = {};
+  for (const entry2 of config.features) {
+    const defaults = featureDefaults[entry2.ref] ?? {};
+    featureRecord[entry2.ref] = { ...defaults, ...entry2.options ?? {} };
+  }
+  const result = {
+    name: config.name,
+    languages: [...config.languages],
+    services: [...config.services]
+  };
+  if (config.externalServices.postgres !== void 0) {
+    result.postgresUrl = config.externalServices.postgres;
+  }
+  if (config.aptPackages.length > 0) {
+    result.aptPackages = [...config.aptPackages];
+  }
+  if (Object.keys(featureRecord).length > 0) {
+    result.features = featureRecord;
+  }
+  if (config.installUrls.length > 0) {
+    result.installUrls = [...config.installUrls];
+  }
+  if (config.repos.length > 0) {
+    result.repos = config.repos.map((r) => ({
+      url: r.url,
+      // `name` is optional in the yml (derived from URL on apply),
+      // required in CreateOptions; the caller derives it via
+      // `deriveRepoName` when undefined.
+      name: r.name ?? deriveRepoName(r.url),
+      ...r.branch !== void 0 ? { branch: r.branch } : {}
+    }));
+  }
+  return result;
+}
+
+// src/devcontainer/compose.ts
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync3 } from "fs";
+import path5 from "path";
+import { consola as consola8 } from "consola";
+
+// src/util/mask-secrets.ts
+import { Transform } from "stream";
+var PATTERNS = [
+  // Atlassian Cloud API token. Starts with literal `ATATT3xFf` plus
+  // a long URL-safe-base64 tail. Tightened to that prefix to avoid
+  // matching unrelated all-caps words.
+  { name: "atlassian-api", re: /ATATT3xFf[A-Za-z0-9+/=_-]{20,}/g },
+  // Bitbucket Cloud app password.
+  { name: "bitbucket-app", re: /ATBB[A-Za-z0-9+/=_-]{20,}/g },
+  // GitHub PAT (classic), OAuth, user, server, refresh — all share
+  // the `gh<lower-letter>_<base62>` shape per GitHub's token format.
+  { name: "github-token", re: /gh[a-z]_[A-Za-z0-9]{20,}/g },
+  // GitHub fine-grained PAT.
+  { name: "github-pat", re: /github_pat_[A-Za-z0-9_]{20,}/g },
+  // Anthropic API key.
+  { name: "anthropic-api", re: /sk-ant-[A-Za-z0-9_-]{20,}/g }
+];
+function maskSecrets(text) {
+  let result = text;
+  for (const { re } of PATTERNS) {
+    result = result.replace(re, maskOne);
+  }
+  return result;
+}
+function maskOne(token) {
+  if (token.length <= 12) return token;
+  return `${token.slice(0, 5)}\u2026${token.slice(-6)}`;
+}
+function createSecretMaskStream() {
+  let buffer = "";
+  return new Transform({
+    decodeStrings: true,
+    transform(chunk, _enc, cb) {
+      const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      buffer += text;
+      const lastNewline = buffer.lastIndexOf("\n");
+      if (lastNewline === -1) {
+        cb(null);
+        return;
+      }
+      const flushable = buffer.slice(0, lastNewline + 1);
+      buffer = buffer.slice(lastNewline + 1);
+      cb(null, maskSecrets(flushable));
+    },
+    flush(cb) {
+      if (buffer.length > 0) {
+        const tail = maskSecrets(buffer);
+        buffer = "";
+        cb(null, tail);
+        return;
+      }
+      cb(null);
+    }
+  });
+}
+
+// src/devcontainer/cli.ts
+import { spawn } from "child_process";
+import { readFileSync as readFileSync2 } from "fs";
+import { createRequire } from "module";
+import path4 from "path";
+var require_ = createRequire(import.meta.url);
+var cachedBinaryPath = null;
+function devcontainerCliPath() {
+  if (cachedBinaryPath) return cachedBinaryPath;
+  const pkgJsonPath = require_.resolve("@devcontainers/cli/package.json");
+  const pkg = JSON.parse(readFileSync2(pkgJsonPath, "utf8"));
+  const binEntry = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.devcontainer ?? "";
+  if (!binEntry) {
+    throw new Error("Could not resolve @devcontainers/cli bin entry.");
+  }
+  cachedBinaryPath = path4.resolve(path4.dirname(pkgJsonPath), binEntry);
+  return cachedBinaryPath;
+}
+var spawnDevcontainer = (args, cwd, options = {}) => {
+  const binPath = devcontainerCliPath();
+  return new Promise((resolve, reject) => {
+    if (options.interactive) {
+      const child2 = spawn(process.execPath, [binPath, ...args], {
+        cwd,
+        stdio: "inherit"
+      });
+      child2.on("error", reject);
+      child2.on("exit", (code) => resolve(code ?? 0));
+      return;
+    }
+    const child = spawn(process.execPath, [binPath, ...args], {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (options.quiet) {
+      const stdoutChunks = [];
+      const stderrChunks = [];
+      child.stdout?.on("data", (chunk) => stdoutChunks.push(chunk));
+      child.stderr?.on("data", (chunk) => stderrChunks.push(chunk));
+      child.on("error", reject);
+      child.on("exit", (code) => {
+        const exitCode = code ?? 0;
+        if (exitCode !== 0) {
+          process.stderr.write(
+            maskSecrets(Buffer.concat(stderrChunks).toString("utf8"))
+          );
+          process.stderr.write(
+            maskSecrets(Buffer.concat(stdoutChunks).toString("utf8"))
+          );
+        }
+        resolve(exitCode);
+      });
+      return;
+    }
+    child.stdout?.pipe(createSecretMaskStream()).pipe(process.stdout);
+    child.stderr?.pipe(createSecretMaskStream()).pipe(process.stderr);
+    child.on("error", reject);
+    child.on("exit", (code) => resolve(code ?? 0));
+  });
+};
+
+// src/devcontainer/compose.ts
+var spawnDockerCompose = (args, cwd) => {
+  return new Promise((resolve, reject) => {
+    const child = spawn2("docker", ["compose", ...args], {
+      cwd,
+      stdio: ["inherit", "pipe", "pipe"]
+    });
+    child.stdout?.pipe(createSecretMaskStream()).pipe(process.stdout);
+    child.stderr?.pipe(createSecretMaskStream()).pipe(process.stderr);
+    child.on("error", reject);
+    child.on("exit", (code) => resolve(code ?? 0));
+  });
+};
+var spawnBash = (args, cwd) => {
+  return new Promise((resolve, reject) => {
+    const child = spawn2("bash", args, {
+      cwd,
+      stdio: ["inherit", "pipe", "pipe"]
+    });
+    child.stdout?.pipe(createSecretMaskStream()).pipe(process.stdout);
+    child.stderr?.pipe(createSecretMaskStream()).pipe(process.stderr);
+    child.on("error", reject);
+    child.on("exit", (code) => resolve(code ?? 0));
+  });
+};
+function composeProjectName(root) {
+  return `${path5.basename(root)}_devcontainer`;
+}
+function resolveCompose(root) {
+  if (!existsSync3(path5.join(root, ".devcontainer"))) {
+    throw new Error(
+      `No .devcontainer/ at ${root}. Run \`monoceros apply <name>\` first.`
+    );
+  }
+  const composeFile = path5.join(root, ".devcontainer", "compose.yaml");
+  if (!existsSync3(composeFile)) {
+    throw new Error(
+      `No compose.yaml at ${composeFile}. \`start\` / \`stop\` / \`status\` / \`logs\` require services configured via \`monoceros add-service <name> <svc>\`. Use \`monoceros shell <name>\` to enter the container directly.`
+    );
+  }
+  return { composeFile, projectName: composeProjectName(root) };
+}
+async function runComposeAction(buildSubArgs, opts) {
+  const { composeFile, projectName } = resolveCompose(opts.root);
+  const spawnFn = opts.spawn ?? spawnDockerCompose;
+  const subArgs = buildSubArgs(opts.service);
+  return spawnFn(["-f", composeFile, "-p", projectName, ...subArgs], opts.root);
+}
+async function runStart(opts) {
+  resolveCompose(opts.root);
+  const logger = opts.logger ?? { info: (msg) => consola8.info(msg) };
+  const spawnFn = opts.spawn ?? spawnDevcontainer;
+  logger.info(`Bringing devcontainer up at ${opts.root}\u2026`);
+  return spawnFn(["up", "--workspace-folder", opts.root], opts.root);
+}
+async function runContainerCycle(root, opts) {
+  const { hasCompose, logger } = opts;
+  if (hasCompose) {
+    const projectName = composeProjectName(root);
+    logger.info(
+      `Force-removing existing ${projectName} containers (volumes preserved)\u2026`
+    );
+    const cleanupSpawn = opts.cleanupSpawn ?? spawnBash;
+    const script = [
+      `set -u`,
+      `echo "[cleanup] checking project ${projectName}\u2026"`,
+      `by_label=$(docker ps -aq --filter "label=com.docker.compose.project=${projectName}" 2>/dev/null || true)`,
+      `by_name=$(docker ps -aq --filter "name=^${projectName}-" 2>/dev/null || true)`,
+      `to_remove=$(printf "%s\\n%s\\n" "$by_label" "$by_name" | sort -u | grep -v "^$" || true)`,
+      `if [ -n "$to_remove" ]; then echo "[cleanup] removing: $(echo $to_remove | tr "\\n" " ")"; docker rm -f $to_remove >/dev/null || true; else echo "[cleanup] no containers to remove"; fi`,
+      `docker network rm ${projectName}_default 2>/dev/null && echo "[cleanup] network ${projectName}_default removed" || echo "[cleanup] network ${projectName}_default not present"`,
+      `remaining_label=$(docker ps -aq --filter "label=com.docker.compose.project=${projectName}" 2>/dev/null || true)`,
+      `remaining_name=$(docker ps -aq --filter "name=^${projectName}-" 2>/dev/null || true)`,
+      `if [ -n "$remaining_label" ] || [ -n "$remaining_name" ]; then echo "" >&2; echo "ERROR: containers under project ${projectName} reappeared after removal." >&2; echo "This typically means VS Code's Remote Containers extension is connected to" >&2; echo "this devcontainer and auto-recreated it. Close the dev container session" >&2; echo "in VS Code (Cmd+Shift+P \u2192 'Dev Containers: Close Remote Connection')" >&2; echo "and retry \\\`monoceros apply\\\`." >&2; exit 1; fi`,
+      `echo "[cleanup] done"`
+    ].join("; ");
+    const cleanupCode = await cleanupSpawn(["-c", script], root);
+    if (cleanupCode !== 0) return cleanupCode;
+    return runStart({
+      root,
+      ...opts.devcontainerSpawn ? { spawn: opts.devcontainerSpawn } : {},
+      logger
+    });
+  }
+  logger.info(`Recreating image-mode devcontainer at ${root}\u2026`);
+  const spawnFn = opts.devcontainerSpawn ?? spawnDevcontainer;
+  return spawnFn(
+    ["up", "--workspace-folder", root, "--remove-existing-container"],
+    root
+  );
+}
+function runStop(opts) {
+  return runComposeAction(
+    (service) => ["stop", ...service ? [service] : []],
+    opts
+  );
+}
+function runStatus(opts) {
+  return runComposeAction(
+    (service) => ["ps", ...service ? [service] : []],
+    opts
+  );
+}
+function runLogs(opts) {
+  const follow = opts.follow ?? true;
+  return runComposeAction(
+    (service) => [
+      "logs",
+      ...follow ? ["-f"] : [],
+      ...service ? [service] : []
+    ],
+    opts
+  );
+}
+
+// src/devcontainer/credentials.ts
+import { spawn as spawn3 } from "child_process";
+import { promises as fs6 } from "fs";
+import path6 from "path";
+var realGitCredentialFill = (input) => {
+  return new Promise((resolve, reject) => {
+    const child = spawn3("git", ["credential", "fill"], {
+      stdio: ["pipe", "pipe", "inherit"]
+    });
+    let stdout = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => resolve({ stdout, exitCode: code ?? 0 }));
+    child.stdin.write(input);
+    child.stdin.end();
+  });
+};
+function uniqueHttpsHosts(repos) {
+  const hosts = /* @__PURE__ */ new Set();
+  for (const repo of repos) {
+    if (!repo.url.startsWith("https://")) continue;
+    try {
+      hosts.add(new URL(repo.url).hostname);
+    } catch {
+    }
+  }
+  return [...hosts];
+}
+function parseCredentialFillOutput(output) {
+  const result = {};
+  for (const line of output.split("\n")) {
+    const eqIdx = line.indexOf("=");
+    if (eqIdx <= 0) continue;
+    const key = line.slice(0, eqIdx);
+    const value = line.slice(eqIdx + 1);
+    if (key === "username") result.username = value;
+    if (key === "password") result.password = value;
+  }
+  return result;
+}
+function formatCredentialLine(host, username, password) {
+  const encUser = encodeURIComponent(username);
+  const encPass = encodeURIComponent(password);
+  return `https://${encUser}:${encPass}@${host}`;
+}
+async function collectGitCredentials(devContainerRoot, repos, options = {}) {
+  const credsDir = path6.join(devContainerRoot, ".monoceros");
+  const credentialsPath = path6.join(credsDir, "git-credentials");
+  const hosts = uniqueHttpsHosts(repos);
+  const spawnFn = options.spawn ?? realGitCredentialFill;
+  const logger = options.logger ?? { info: () => {
+  }, warn: () => {
+  } };
+  const lines = [];
+  let hostsSkipped = 0;
+  for (const host of hosts) {
+    logger.info(`Fetching credentials for ${host} from host git\u2026`);
+    const input = `protocol=https
+host=${host}
+
+`;
+    let result;
+    try {
+      result = await spawnFn(input);
+    } catch (err) {
+      logger.warn(
+        `git credential fill not runnable for ${host} (${err instanceof Error ? err.message : String(err)}); skipping.`
+      );
+      hostsSkipped += 1;
+      continue;
+    }
+    if (result.exitCode !== 0) {
+      logger.warn(
+        `git credential fill exited ${result.exitCode} for ${host}; container clone will prompt.`
+      );
+      hostsSkipped += 1;
+      continue;
+    }
+    const { username, password } = parseCredentialFillOutput(result.stdout);
+    if (!username || !password) {
+      logger.warn(
+        `git credential fill returned no username/password for ${host}; container clone will prompt.`
+      );
+      hostsSkipped += 1;
+      continue;
+    }
+    lines.push(formatCredentialLine(host, username, password));
+  }
+  await fs6.mkdir(credsDir, { recursive: true });
+  await fs6.writeFile(
+    credentialsPath,
+    lines.join("\n") + (lines.length > 0 ? "\n" : ""),
+    {
+      mode: 384
+    }
+  );
+  return {
+    hostsWritten: lines.length,
+    hostsSkipped,
+    credentialsPath
+  };
+}
+
+// src/devcontainer/identity.ts
+import { spawn as spawn4 } from "child_process";
+import { promises as fs7 } from "fs";
+import path7 from "path";
+import { consola as consola9 } from "consola";
+var realGitConfigGet = (key) => {
+  return new Promise((resolve, reject) => {
+    const child = spawn4("git", ["config", "--global", "--get", key], {
+      stdio: ["ignore", "pipe", "inherit"]
+    });
+    let stdout = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.on("error", reject);
+    child.on(
+      "exit",
+      (code) => resolve({ value: stdout.trim(), exitCode: code ?? 0 })
+    );
+  });
+};
+var realIdentityPrompt = async (key) => {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    return void 0;
+  }
+  const label = key === "user.name" ? "Git user.name for this dev container (full name)" : "Git user.email for this dev container";
+  const value = await consola9.prompt(`${label}:`, { type: "text" });
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+};
+async function collectGitIdentity(devContainerRoot, options = {}) {
+  const gitconfigDir = path7.join(devContainerRoot, ".monoceros");
+  const gitconfigPath = path7.join(gitconfigDir, "gitconfig");
+  const spawnFn = options.spawn ?? realGitConfigGet;
+  const promptFn = options.prompt ?? realIdentityPrompt;
+  const logger = options.logger ?? { info: () => {
+  }, warn: () => {
+  } };
+  const existing = await readExistingGitconfig(gitconfigPath);
+  const name = await resolveKey("user.name", {
+    override: options.containerOverride?.name,
+    defaultValue: options.defaults?.name,
+    spawnFn,
+    persistedValue: existing.name,
+    promptFn,
+    logger
+  });
+  const email = await resolveKey("user.email", {
+    override: options.containerOverride?.email,
+    defaultValue: options.defaults?.email,
+    spawnFn,
+    persistedValue: existing.email,
+    promptFn,
+    logger
+  });
+  const lines = ["[user]"];
+  if (name !== void 0) lines.push(`	name = ${name}`);
+  if (email !== void 0) lines.push(`	email = ${email}`);
+  await fs7.mkdir(gitconfigDir, { recursive: true });
+  await fs7.writeFile(gitconfigPath, lines.join("\n") + "\n");
+  return {
+    ...name !== void 0 ? { name } : {},
+    ...email !== void 0 ? { email } : {},
+    gitconfigPath
+  };
+}
+async function resolveKey(key, opts) {
+  if (opts.override !== void 0 && opts.override.length > 0) {
+    return opts.override;
+  }
+  if (opts.defaultValue !== void 0 && opts.defaultValue.length > 0) {
+    return opts.defaultValue;
+  }
+  const hostValue = await readKeyFromHost(opts.spawnFn, key, opts.logger);
+  if (hostValue !== void 0) return hostValue;
+  if (opts.persistedValue !== void 0 && opts.persistedValue.length > 0) {
+    return opts.persistedValue;
+  }
+  const prompted = await opts.promptFn(key);
+  if (prompted !== void 0) return prompted;
+  opts.logger.warn(
+    `No ${key} resolvable (yml override, monoceros-config.yml defaults, host \`git config --global\`, persisted .monoceros/gitconfig, prompt). Container git will have no ${key} until set explicitly.`
+  );
+  return void 0;
+}
+async function readKeyFromHost(spawnFn, key, logger) {
+  try {
+    const result = await spawnFn(key);
+    if (result.exitCode === 0 && result.value.length > 0) {
+      return result.value;
+    }
+    return void 0;
+  } catch (err) {
+    logger.warn(
+      `Host git not runnable (${err instanceof Error ? err.message : String(err)}); identity not captured.`
+    );
+    return void 0;
+  }
+}
+async function readExistingGitconfig(filePath) {
+  try {
+    const content = await fs7.readFile(filePath, "utf8");
+    const result = {};
+    const nameMatch = /^\s*name\s*=\s*(.+?)\s*$/m.exec(content);
+    const emailMatch = /^\s*email\s*=\s*(.+?)\s*$/m.exec(content);
+    if (nameMatch?.[1]) result.name = nameMatch[1];
+    if (emailMatch?.[1]) result.email = emailMatch[1];
+    return result;
+  } catch {
+    return {};
+  }
+}
+
+// src/apply/index.ts
+async function runApply(opts) {
+  const home = opts.monocerosHome ?? monocerosHome();
+  const logger = opts.logger ?? {
+    info: (msg) => consola10.info(msg),
+    success: (msg) => consola10.success(msg),
+    warn: (msg) => consola10.warn(msg)
+  };
+  if (!REGEX.solutionName.test(opts.name)) {
+    throw new Error(
+      `Invalid config name: ${JSON.stringify(opts.name)}. Use letters, digits, '.', '_' or '-'.`
+    );
+  }
+  const ymlPath = containerConfigPath(opts.name, home);
+  if (!existsSync4(ymlPath)) {
+    throw new Error(
+      `No such config: ${ymlPath}. Run \`monoceros init <template> ${opts.name}\` first.`
+    );
+  }
+  const targetDir = containerDir(opts.name, home);
+  await assertSafeTargetDir(targetDir, opts.name);
+  const parsed = await readConfig(ymlPath);
+  const globalConfig = await readMonocerosConfig({ monocerosHome: home });
+  warnOnDeprecatedFeatureRefs(parsed.config.features, globalConfig, logger);
+  const createOpts = normalizeOptions(
+    solutionConfigToCreateOptions(
+      parsed.config,
+      globalConfig?.defaults?.features ?? {}
+    )
+  );
+  validateOptions(createOpts);
+  await fs8.mkdir(targetDir, { recursive: true });
+  await writeScaffold(createOpts, targetDir);
+  await writeStateFile(
+    targetDir,
+    buildStateFile({
+      origin: opts.name,
+      cliVersion: opts.cliVersion,
+      ...opts.now ? { now: opts.now } : {}
+    })
+  );
+  const idLogger = {
+    info: logger.info,
+    warn: logger.warn ?? logger.info
+  };
+  await collectGitIdentity(targetDir, {
+    ...opts.identitySpawn ? { spawn: opts.identitySpawn } : {},
+    ...opts.identityPrompt ? { prompt: opts.identityPrompt } : {},
+    ...parsed.config.git?.user ? { containerOverride: parsed.config.git.user } : {},
+    ...globalConfig?.defaults?.git?.user ? { defaults: globalConfig.defaults.git.user } : {},
+    logger: idLogger
+  });
+  if (createOpts.repos && createOpts.repos.some((r) => r.url.startsWith("https://"))) {
+    await collectGitCredentials(targetDir, createOpts.repos, {
+      ...opts.credentialsSpawn ? { spawn: opts.credentialsSpawn } : {},
+      logger: idLogger
+    });
+  }
+  logger.success(
+    `Materialized config '${opts.name}' into ${targetDir}. Starting container\u2026`
+  );
+  const exitCode = await runContainerCycle(targetDir, {
+    hasCompose: needsCompose(createOpts),
+    ...opts.cleanupSpawn !== void 0 ? { cleanupSpawn: opts.cleanupSpawn } : {},
+    ...opts.devcontainerSpawn !== void 0 ? { devcontainerSpawn: opts.devcontainerSpawn } : {},
+    logger
+  });
+  return { targetDir, configPath: ymlPath, containerExitCode: exitCode };
+}
+async function assertSafeTargetDir(targetDir, expectedOrigin) {
+  if (!existsSync4(targetDir)) return;
+  const entries = await fs8.readdir(targetDir);
+  if (entries.length === 0) return;
+  const state = await readStateFile(targetDir);
+  if (state) {
+    if (state.origin !== expectedOrigin) {
+      throw new Error(
+        `${targetDir} is already materialized from config '${state.origin}', not '${expectedOrigin}'. Delete the directory to re-target, or run \`monoceros apply ${state.origin}\`.`
+      );
+    }
+    return;
+  }
+  throw new Error(
+    `Refusing to materialize into non-empty directory ${targetDir} (no Monoceros state.json found). Delete the directory before re-running.`
+  );
+}
+function warnOnDeprecatedFeatureRefs(containerFeatures, globalConfig, logger) {
+  const warn = logger.warn ?? logger.info;
+  const seen = /* @__PURE__ */ new Set();
+  const emit = (oldRef, source) => {
+    if (seen.has(oldRef)) return;
+    seen.add(oldRef);
+    const newRef = migrateDeprecatedFeatureRef(oldRef);
+    if (!newRef) return;
+    warn(
+      `Deprecated feature ref in ${source}: '${oldRef}'. Replace with '${newRef}' \u2014 the old namespace is no longer published. See docs/MIGRATION-M4.md for a sed snippet.`
+    );
+  };
+  for (const entry2 of containerFeatures) {
+    emit(entry2.ref, "container yml");
+  }
+  const globalDefaults = globalConfig?.defaults?.features;
+  if (globalDefaults) {
+    for (const ref of Object.keys(globalDefaults)) {
+      emit(ref, "monoceros-config.yml");
+    }
+  }
+}
+
+// src/version.ts
+var CLI_VERSION = "1.0.0";
+
+// src/commands/_dispatch.ts
+import { consola as consola11 } from "consola";
+async function dispatch(runner) {
+  try {
+    const exitCode = await runner();
+    process.exit(exitCode);
+  } catch (err) {
+    consola11.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+
+// src/commands/apply.ts
+var applyCommand = defineCommand7({
+  meta: {
+    name: "apply",
+    description: "Materialize a container config into $MONOCEROS_HOME/container/<name>/ and bring the dev-container up. Close any VS Code Remote Containers session for the target first \u2014 the extension auto-recreates and races with apply."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Config name. Resolves to $MONOCEROS_HOME/container-configs/<name>.yml.",
+      required: true
+    }
+  },
+  run({ args }) {
+    return dispatch(async () => {
+      const result = await runApply({
+        name: args.name,
+        cliVersion: CLI_VERSION
+      });
+      return result.containerExitCode;
+    });
+  }
+});
+
+// src/commands/init.ts
+import { defineCommand as defineCommand8 } from "citty";
+import { consola as consola13 } from "consola";
+
+// src/init/index.ts
+import { existsSync as existsSync7, promises as fs10 } from "fs";
+import path10 from "path";
+import { consola as consola12 } from "consola";
+
+// src/init/components.ts
+import { existsSync as existsSync5, promises as fs9 } from "fs";
+import path8 from "path";
+import { z as z3 } from "zod";
+import { parse as parseYaml } from "yaml";
+var CategorySchema = z3.enum(["language", "service", "feature"]);
+var FeatureContributionSchema = z3.object({
+  ref: z3.string().regex(REGEX.featureRef),
+  options: z3.record(z3.string(), FeatureOptionValueSchema).optional()
+});
+var ComponentFileSchema = z3.object({
+  displayName: z3.string().min(1),
+  description: z3.string().min(1),
+  category: CategorySchema,
+  contributes: z3.object({
+    languages: z3.array(z3.string().min(1)).optional(),
+    services: z3.array(z3.string().min(1)).optional(),
+    features: z3.array(FeatureContributionSchema).optional()
+  })
+}).superRefine((data, ctx) => {
+  const c = data.contributes;
+  const filled = [
+    c.languages && c.languages.length > 0 ? "languages" : null,
+    c.services && c.services.length > 0 ? "services" : null,
+    c.features && c.features.length > 0 ? "features" : null
+  ].filter((x) => x !== null);
+  if (filled.length === 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "contributes must set at least one of languages/services/features"
+    });
+    return;
+  }
+  if (filled.length > 1) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: `contributes must set exactly one of languages/services/features, got: ${filled.join(", ")}`
+    });
+    return;
+  }
+  const expected = data.category === "language" ? "languages" : data.category === "service" ? "services" : "features";
+  if (filled[0] !== expected) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: `category '${data.category}' requires contributes.${expected}, got contributes.${filled[0]}`
+    });
+  }
+});
+async function loadComponentCatalog(rootDir = componentsDir()) {
+  if (!existsSync5(rootDir)) {
+    return /* @__PURE__ */ new Map();
+  }
+  const out = /* @__PURE__ */ new Map();
+  await walk(rootDir, rootDir, out);
+  return out;
+}
+async function walk(baseDir, currentDir, out) {
+  const entries = await fs9.readdir(currentDir, { withFileTypes: true });
+  for (const entry2 of entries) {
+    const full = path8.join(currentDir, entry2.name);
+    if (entry2.isDirectory()) {
+      await walk(baseDir, full, out);
+      continue;
+    }
+    if (!entry2.isFile() || !entry2.name.endsWith(".yml")) continue;
+    const relative = path8.relative(baseDir, full);
+    const name = relative.replace(/\.yml$/, "").split(path8.sep).join("/");
+    const text = await fs9.readFile(full, "utf8");
+    let raw;
+    try {
+      raw = parseYaml(text);
+    } catch (err) {
+      throw new Error(
+        `Failed to parse component ${name} (${full}): ${err.message}`
+      );
+    }
+    const parsed = ComponentFileSchema.safeParse(raw);
+    if (!parsed.success) {
+      const issues = parsed.error.issues.map((issue) => {
+        const where = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+        return `  - ${where}: ${issue.message}`;
+      }).join("\n");
+      throw new Error(`Invalid component ${name} (${full}):
+${issues}`);
+    }
+    out.set(name, { name, sourcePath: full, file: parsed.data });
+  }
+}
+function mergeComponents(resolved) {
+  const languages = [];
+  const services = [];
+  const featureByRef = /* @__PURE__ */ new Map();
+  for (const entry2 of resolved) {
+    const c = isResolvedComponent(entry2) ? entry2.component : entry2;
+    const version = isResolvedComponent(entry2) ? entry2.version : void 0;
+    const ct = c.file.contributes;
+    for (const lang of ct.languages ?? []) {
+      const value = version !== void 0 ? `${lang}:${version}` : lang;
+      if (!languages.includes(value)) languages.push(value);
+    }
+    for (const svc of ct.services ?? []) {
+      if (!services.includes(svc)) services.push(svc);
+    }
+    for (const f of ct.features ?? []) {
+      const existing = featureByRef.get(f.ref);
+      if (!existing) {
+        featureByRef.set(f.ref, {
+          ref: f.ref,
+          options: { ...f.options ?? {} }
+        });
+        continue;
+      }
+      existing.options = mergeFeatureOptions(existing.options, f.options ?? {});
+    }
+  }
+  return {
+    languages,
+    services,
+    features: [...featureByRef.values()]
+  };
+}
+function isResolvedComponent(x) {
+  return "component" in x;
+}
+function mergeFeatureOptions(a, b) {
+  const result = { ...a };
+  for (const [key, valueB] of Object.entries(b)) {
+    const valueA = result[key];
+    if (typeof valueA === "boolean" && typeof valueB === "boolean") {
+      result[key] = valueA || valueB;
+      continue;
+    }
+    result[key] = valueB;
+  }
+  return result;
+}
+function resolveComponents(catalog, names) {
+  const unknown = [];
+  const out = [];
+  for (const raw of names) {
+    const colon = raw.indexOf(":");
+    const name = colon === -1 ? raw : raw.slice(0, colon);
+    const version = colon === -1 ? void 0 : raw.slice(colon + 1);
+    const c = catalog.get(name);
+    if (!c) {
+      unknown.push(raw);
+      continue;
+    }
+    if (version !== void 0 && c.file.category !== "language") {
+      throw new Error(
+        `Component '${name}' is a ${c.file.category}, not a language \u2014 a ':${version}' suffix has no meaning here.`
+      );
+    }
+    out.push({ component: c, ...version !== void 0 ? { version } : {} });
+  }
+  if (unknown.length > 0) {
+    const available = [...catalog.keys()].sort();
+    throw new Error(
+      `Unknown component${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}.
+Available: ${available.join(", ")}.`
+    );
+  }
+  return out;
+}
+
+// src/init/generator.ts
+var SCHEMA_HEADER = [
+  "# Monoceros solution-config. Edit freely, then run",
+  "# `monoceros apply <name>` to materialize a dev-container.",
+  "#",
+  "# Schema reference: see the workbench `templates/components/README.md`",
+  "# and `docs/konzept.md` for what each section does. Each feature",
+  "# under `features:` also accepts options not shown here \u2014 check",
+  "# the feature's `devcontainer-feature.json` for the full list."
+];
+function generateComposedYml(name, components, lookupManifest) {
+  const merged = mergeComponents(components);
+  const lines = [];
+  for (const h of SCHEMA_HEADER) lines.push(h);
+  lines.push("");
+  lines.push("schemaVersion: 1");
+  lines.push(`name: ${name}`);
+  lines.push("");
+  if (merged.languages.length > 0) {
+    lines.push("languages:");
+    for (const lang of merged.languages) lines.push(`  - ${lang}`);
+    lines.push("");
+  }
+  if (merged.services.length > 0) {
+    lines.push("services:");
+    for (const svc of merged.services) lines.push(`  - ${svc}`);
+    lines.push("");
+  }
+  if (merged.features.length > 0) {
+    lines.push("features:");
+    for (const f of merged.features) {
+      const hints = lookupManifest(f.ref)?.optionHints ?? [];
+      renderFeatureBlock(
+        lines,
+        f,
+        hints,
+        /* commented */
+        false
+      );
+    }
+    lines.push("");
+  }
+  return ensureTrailingNewline(lines.join("\n"));
+}
+function generateDocumentedYml(name, catalog, lookupManifest) {
+  const byCategory = groupByCategory(catalog);
+  const lines = [];
+  for (const h of SCHEMA_HEADER) lines.push(h);
+  lines.push("#");
+  lines.push("# Below is the full set of components shipped with this");
+  lines.push("# workbench, every one commented out. Un-comment the lines");
+  lines.push("# you want active. The same effect (and a cleaner yml) is");
+  lines.push("# achievable by running `monoceros init <name> --with=\u2026`");
+  lines.push("# with a comma-separated list of component names.");
+  lines.push("");
+  lines.push("schemaVersion: 1");
+  lines.push(`name: ${name}`);
+  lines.push("");
+  if (byCategory.language.length > 0) {
+    const items = byCategory.language.flatMap(
+      (c) => (c.file.contributes.languages ?? []).map((lang) => ({
+        value: lang,
+        label: c.file.displayName
+      }))
+    );
+    const width = Math.max(...items.map((i) => i.value.length)) + 2;
+    lines.push("# Languages \u2014 runtime toolchains.");
+    lines.push("# languages:");
+    for (const item of items) {
+      const pad = " ".repeat(width - item.value.length);
+      lines.push(`#   - ${item.value}${pad}# ${item.label}`);
+    }
+    lines.push("");
+  }
+  if (byCategory.service.length > 0) {
+    const items = byCategory.service.flatMap(
+      (c) => (c.file.contributes.services ?? []).map((svc) => ({
+        value: svc,
+        label: c.file.displayName
+      }))
+    );
+    const width = Math.max(...items.map((i) => i.value.length)) + 2;
+    lines.push("# Services \u2014 compose-mode siblings of the workspace");
+    lines.push("# container (compose mode kicks in as soon as at least");
+    lines.push("# one service is active).");
+    lines.push("# services:");
+    for (const item of items) {
+      const pad = " ".repeat(width - item.value.length);
+      lines.push(`#   - ${item.value}${pad}# ${item.label}`);
+    }
+    lines.push("");
+  }
+  if (byCategory.feature.length > 0) {
+    lines.push("# Features \u2014 devcontainer features installed inside the");
+    lines.push("# container. Each entry has an OCI-style `ref` plus an");
+    lines.push("# optional `options` map. Credentials/auth keys appear");
+    lines.push("# as commented hints; set them here per container, or");
+    lines.push("# globally in monoceros-config.yml under");
+    lines.push("# `defaults.features.<ref>`.");
+    lines.push("#");
+    lines.push("# Catalog:");
+    lines.push("#");
+    const nameColumnWidth = Math.max(...byCategory.feature.map((c) => c.name.length)) + 2;
+    for (const c of byCategory.feature) {
+      const pad = " ".repeat(nameColumnWidth - c.name.length);
+      lines.push(`#   ${c.name}${pad}${c.file.displayName}`);
+    }
+    lines.push("#");
+    lines.push("# Below: one block per feature ref. Un-comment what");
+    lines.push("# you want active. Sub-components share their parent's");
+    lines.push("# block \u2014 pick the parent for the full preset, swap to");
+    lines.push("# a sub-component name for a partial install.");
+    lines.push("#");
+    lines.push("# features:");
+    const renderedRefs = /* @__PURE__ */ new Set();
+    const topLevel = byCategory.feature.filter((c) => !c.name.includes("/"));
+    for (const c of topLevel) {
+      for (const f of c.file.contributes.features ?? []) {
+        if (renderedRefs.has(f.ref)) continue;
+        renderedRefs.add(f.ref);
+        const hints = lookupManifest(f.ref)?.optionHints ?? [];
+        renderFeatureBlock(
+          lines,
+          f,
+          hints,
+          /* commented */
+          true
+        );
+      }
+    }
+    for (const c of byCategory.feature) {
+      if (!c.name.includes("/")) continue;
+      for (const f of c.file.contributes.features ?? []) {
+        if (renderedRefs.has(f.ref)) continue;
+        renderedRefs.add(f.ref);
+        const hints = lookupManifest(f.ref)?.optionHints ?? [];
+        renderFeatureBlock(
+          lines,
+          f,
+          hints,
+          /* commented */
+          true
+        );
+      }
+    }
+    lines.push("");
+  }
+  return ensureTrailingNewline(lines.join("\n"));
+}
+function renderFeatureBlock(out, feature, optionHints, commented) {
+  const c = commented ? "#   " : "  ";
+  out.push(`${c}- ref: ${feature.ref}`);
+  const options = feature.options ?? {};
+  const activeOptions = Object.entries(options);
+  const remainingHints = optionHints.filter((h) => !(h in options));
+  if (activeOptions.length > 0) {
+    out.push(`${c}  options:`);
+    for (const [key, value] of activeOptions) {
+      out.push(`${c}    ${key}: ${renderScalarValue(value)}`);
+    }
+    if (remainingHints.length > 0) {
+      out.push(
+        `${c}    # Optional \u2014 override monoceros-config.yml defaults.features:`
+      );
+      for (const hint of remainingHints) {
+        out.push(`${c}    # ${hint}:`);
+      }
+    }
+  } else if (remainingHints.length > 0) {
+    out.push(
+      `${c}  # Optional \u2014 override monoceros-config.yml defaults.features:`
+    );
+    out.push(`${c}  # options:`);
+    for (const hint of remainingHints) {
+      out.push(`${c}  #   ${hint}:`);
+    }
+  }
+}
+function renderScalarValue(value) {
+  if (typeof value === "string") {
+    return /^[A-Za-z_][A-Za-z0-9._-]*$/.test(value) ? value : JSON.stringify(value);
+  }
+  return String(value);
+}
+function groupByCategory(catalog) {
+  const out = {
+    language: [],
+    service: [],
+    feature: []
+  };
+  const sorted = [...catalog.values()].sort(
+    (a, b) => a.name.localeCompare(b.name)
+  );
+  for (const c of sorted) {
+    out[c.file.category].push(c);
+  }
+  return out;
+}
+function ensureTrailingNewline(s) {
+  return s.endsWith("\n") ? s : s + "\n";
+}
+
+// src/init/manifest.ts
+import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
+import path9 from "path";
+function loadFeatureManifestSummary(ref, checkoutRoot = workbenchCheckoutRoot()) {
+  if (!checkoutRoot) return void 0;
+  const match = matchMonocerosFeature(ref);
+  if (!match) return void 0;
+  const name = match.name;
+  const manifestPath = path9.join(
+    checkoutRoot,
+    "images",
+    "features",
+    name,
+    "devcontainer-feature.json"
+  );
+  if (!existsSync6(manifestPath)) return void 0;
+  try {
+    const text = readFileSync3(manifestPath, "utf8");
+    const parsed = JSON.parse(text);
+    const raw = parsed["x-monoceros"]?.optionHints;
+    if (!Array.isArray(raw)) return { optionHints: [] };
+    const hints = raw.filter(
+      (x) => typeof x === "string" && x.length > 0
+    );
+    return { optionHints: hints };
+  } catch {
+    return void 0;
+  }
+}
+
+// src/init/index.ts
+async function runInit(opts) {
+  const workbench = opts.workbenchRoot ?? workbenchRoot();
+  const home = opts.monocerosHome ?? monocerosHome();
+  const logger = opts.logger ?? {
+    success: (msg) => consola12.success(msg),
+    info: (msg) => consola12.info(msg)
+  };
+  if (!REGEX.solutionName.test(opts.name)) {
+    throw new Error(
+      `Invalid config name: ${JSON.stringify(opts.name)}. Use letters, digits, '.', '_' or '-'.`
+    );
+  }
+  const dest = containerConfigPath(opts.name, home);
+  if (existsSync7(dest)) {
+    throw new Error(
+      `Config already exists: ${dest}. Delete it manually before re-running \`monoceros init\` \u2014 this protects any hand-edits.`
+    );
+  }
+  const catalog = await loadComponentCatalog(componentsDir(workbench));
+  if (catalog.size === 0) {
+    throw new Error(
+      `No components found under ${componentsDir(workbench)}. The workbench checkout is incomplete.`
+    );
+  }
+  const checkoutRoot = opts.workbenchRoot ?? workbenchCheckoutRoot();
+  const lookup = (ref) => loadFeatureManifestSummary(ref, checkoutRoot);
+  let text;
+  const requested = opts.with ?? [];
+  if (requested.length === 0) {
+    text = generateDocumentedYml(opts.name, catalog, lookup);
+  } else {
+    const components = resolveComponents(catalog, requested);
+    text = generateComposedYml(opts.name, components, lookup);
+  }
+  await fs10.mkdir(containerConfigsDir(home), { recursive: true });
+  await fs10.writeFile(dest, text, "utf8");
+  const documented = requested.length === 0;
+  const rel = path10.relative(home, dest) || dest;
+  if (documented) {
+    logger.success(
+      `Wrote documented default to ${rel}. Un-comment what you need, then \`monoceros apply ${opts.name}\`.`
+    );
+  } else {
+    logger.success(
+      `Composed ${requested.length} component(s) into ${rel}: ${requested.join(", ")}`
+    );
+    logger.info(
+      `Edit the file if you need to tweak, then \`monoceros apply ${opts.name}\`.`
+    );
+  }
+  return { configPath: dest, documented };
+}
+
+// src/commands/init.ts
+var initCommand = defineCommand8({
+  meta: {
+    name: "init",
+    description: "Create a fresh container-config yml at .local/container-configs/<name>.yml. Without --with, the file is a documented default with every component commented out. With --with=<names>, the named components are composed into an active, immediately-applyable yml. Then run `monoceros apply <name>`."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Config name. The yml lands at <MONOCEROS_HOME>/container-configs/<name>.yml and becomes the source-of-truth for `monoceros apply <name>`.",
+      required: true
+    },
+    with: {
+      type: "string",
+      description: "Comma-separated list of component names to compose, e.g. 'node,postgres,github,claude'. Sub-components use a slash, e.g. 'atlassian/twg'. When omitted, init writes a documented default with every catalog component commented out.",
+      required: false
+    }
+  },
+  async run({ args, rawArgs }) {
+    try {
+      const withList = collectWithList(args.with, rawArgs);
+      await runInit({
+        name: args.name,
+        ...withList ? { with: withList } : {}
+      });
+    } catch (err) {
+      consola13.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+function collectWithList(withArg, rawArgs) {
+  if (typeof withArg !== "string" || withArg.trim().length === 0) {
+    return void 0;
+  }
+  let combined = withArg.trim();
+  const startIdx = rawArgs.findIndex(
+    (t) => t === "--with" || t.startsWith("--with=")
+  );
+  if (startIdx >= 0) {
+    let scanFrom = startIdx + 1;
+    if (rawArgs[startIdx] === "--with") scanFrom += 1;
+    for (let i = scanFrom; i < rawArgs.length; i += 1) {
+      const t = rawArgs[i];
+      if (t.startsWith("--") || t === "-h" || t === "--help") break;
+      const sep = combined.endsWith(",") ? "" : ",";
+      combined += sep + t;
+    }
+  }
+  const pieces = combined.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  return pieces.length > 0 ? pieces : void 0;
+}
+
+// src/commands/list-components.ts
+import { defineCommand as defineCommand9 } from "citty";
+import { consola as consola14 } from "consola";
+var listComponentsCommand = defineCommand9({
+  meta: {
+    name: "list-components",
+    description: "Print the components catalog used by `monoceros init --with=\u2026`. Each line is `name<TAB>category<TAB>displayName`, grouped by category for readability."
+  },
+  args: {},
+  async run() {
+    try {
+      const catalog = await loadComponentCatalog();
+      if (catalog.size === 0) {
+        consola14.warn(
+          "No components found. The workbench checkout looks incomplete."
+        );
+        process.exit(0);
+      }
+      const sorted = [...catalog.values()].sort((a, b) => {
+        const order = { language: 0, service: 1, feature: 2 };
+        const ca = order[a.file.category];
+        const cb = order[b.file.category];
+        if (ca !== cb) return ca - cb;
+        return a.name.localeCompare(b.name);
+      });
+      let currentCategory = null;
+      for (const c of sorted) {
+        if (c.file.category !== currentCategory) {
+          if (currentCategory !== null) process.stdout.write("\n");
+          process.stdout.write(`# ${c.file.category}
+`);
+          currentCategory = c.file.category;
+        }
+        process.stdout.write(`${c.name}	${c.file.displayName}
+`);
+      }
+      process.exit(0);
+    } catch (err) {
+      consola14.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/logs.ts
+import { defineCommand as defineCommand10 } from "citty";
+var logsCommand = defineCommand10({
+  meta: {
+    name: "logs",
+    description: "Tail logs from the compose services of the named dev-container. Pass --no-follow for a one-shot dump."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    service: {
+      type: "string",
+      description: "Restrict to a single compose service (e.g. postgres). Defaults to all."
+    },
+    follow: {
+      type: "boolean",
+      description: "Follow log output (default: true). Use --no-follow to disable.",
+      alias: ["f"],
+      default: true
+    }
+  },
+  run({ args }) {
+    return dispatch(
+      () => runLogs({
+        root: containerDir(args.name),
+        ...typeof args.service === "string" ? { service: args.service } : {},
+        follow: args.follow
+      })
+    );
+  }
+});
+
+// src/commands/remove-apt-packages.ts
+import { defineCommand as defineCommand11 } from "citty";
+import { consola as consola15 } from "consola";
+var removeAptPackagesCommand = defineCommand11({
+  meta: {
+    name: "remove-apt-packages",
+    description: "Remove apt packages from the container config. Pass package names after `--` (e.g. `monoceros remove-apt-packages sandbox -- make jq`). Idempotent, prints a diff before writing."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    const packages = [...getInnerArgs()];
+    if (packages.length === 0) {
+      consola15.error(
+        "No package names given. Usage: `monoceros remove-apt-packages <containername> [--yes] -- <pkg> [<pkg> \u2026]`."
+      );
+      process.exit(1);
+    }
+    try {
+      const result = await runRemoveAptPackages({
+        name: args.name,
+        packages,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola15.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/remove-feature.ts
+import { defineCommand as defineCommand12 } from "citty";
+import { consola as consola16 } from "consola";
+var removeFeatureCommand = defineCommand12({
+  meta: {
+    name: "remove-feature",
+    description: "Remove a devcontainer feature from the container config (by its OCI ref). Idempotent, prints a diff before writing."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    ref: {
+      type: "positional",
+      description: "Feature ref (e.g. ghcr.io/devcontainers/features/docker-in-docker:2).",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const result = await runRemoveFeature({
+        name: args.name,
+        ref: args.ref,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola16.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/remove.ts
+import { defineCommand as defineCommand13 } from "citty";
+import { consola as consola18 } from "consola";
+import { createInterface } from "readline/promises";
+
+// src/remove/index.ts
+import { existsSync as existsSync8, promises as fs11 } from "fs";
+import path11 from "path";
+import { consola as consola17 } from "consola";
+async function runRemove(opts) {
+  const home = opts.monocerosHome ?? monocerosHome();
+  const logger = opts.logger ?? {
+    info: (msg) => consola17.info(msg),
+    success: (msg) => consola17.success(msg),
+    warn: (msg) => consola17.warn(msg)
+  };
+  if (!REGEX.solutionName.test(opts.name)) {
+    throw new Error(
+      `Invalid config name: ${JSON.stringify(opts.name)}. Use letters, digits, '.', '_' or '-'.`
+    );
+  }
+  const ymlPath = containerConfigPath(opts.name, home);
+  const containerPath = containerDir(opts.name, home);
+  const hasYml = existsSync8(ymlPath);
+  const hasContainer = existsSync8(containerPath);
+  if (!hasYml && !hasContainer) {
+    throw new Error(
+      `Nothing to remove for '${opts.name}': neither ${ymlPath} nor ${containerPath} exists.`
+    );
+  }
+  const projectName = composeProjectName(containerPath);
+  const dockerSpawn = opts.dockerSpawn ?? spawnBash;
+  const script = [
+    `set -u`,
+    `echo "[remove] tearing down docker project ${projectName}\u2026"`,
+    // Compose-mode containers, identified by the project label
+    `by_label=$(docker ps -aq --filter "label=com.docker.compose.project=${projectName}" 2>/dev/null || true)`,
+    // Container-name prefix fallback (catches half-broken state)
+    `by_compose_name=$(docker ps -aq --filter "name=^${projectName}-" 2>/dev/null || true)`,
+    // Image-mode devcontainer-cli container
+    `by_image_name=$(docker ps -aq --filter "name=^vsc-${opts.name}-" 2>/dev/null || true)`,
+    `to_remove=$(printf "%s\\n%s\\n%s\\n" "$by_label" "$by_compose_name" "$by_image_name" | sort -u | grep -v "^$" || true)`,
+    `if [ -n "$to_remove" ]; then echo "[remove] removing containers: $(echo $to_remove | tr "\\n" " ")"; docker rm -f $to_remove >/dev/null || true; else echo "[remove] no containers found"; fi`,
+    `docker network rm ${projectName}_default 2>/dev/null && echo "[remove] network ${projectName}_default removed" || true`,
+    `echo "[remove] docker cleanup done"`
+  ].join("; ");
+  const dockerExitCode = await dockerSpawn(["-c", script], home);
+  let backupPath = null;
+  if (!opts.noBackup && (hasYml || hasContainer)) {
+    const ts = (opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    backupPath = path11.join(home, "container-backups", `${opts.name}-${ts}`);
+    await fs11.mkdir(backupPath, { recursive: true });
+    if (hasYml) {
+      await fs11.copyFile(ymlPath, path11.join(backupPath, `${opts.name}.yml`));
+    }
+    if (hasContainer) {
+      await fs11.cp(containerPath, path11.join(backupPath, "container"), {
+        recursive: true
+      });
+    }
+    logger.info(
+      `Backup written to ${path11.relative(home, backupPath) || backupPath}.`
+    );
+  }
+  if (hasYml) {
+    await fs11.rm(ymlPath, { force: true });
+  }
+  if (hasContainer) {
+    await fs11.rm(containerPath, { recursive: true, force: true });
+  }
+  logger.success(
+    `Removed '${opts.name}': docker objects gone, container-configs entry deleted, container directory deleted.`
+  );
+  if (!backupPath) {
+    logger.warn?.(
+      "No backup created (--no-backup). The host-side state is gone for good."
+    );
+  }
+  return {
+    configPath: hasYml ? ymlPath : null,
+    containerPath: hasContainer ? containerPath : null,
+    backupPath,
+    dockerExitCode
+  };
+}
+
+// src/commands/remove.ts
+var removeCommand = defineCommand13({
+  meta: {
+    name: "remove",
+    description: "Wipe everything belonging to a container: stop and remove the docker objects, back up the container-configs yml + container directory (incl. home/, projects/, data/), then delete them from disk. Shared docker images stay. By default the destructive step is confirmed interactively; pass -y to skip."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    backup: {
+      type: "boolean",
+      // citty turns a default-true boolean automatically into a
+      // `--no-X` flag for negation, so the builder gets the natural
+      // `monoceros remove <name> --no-backup` form without us
+      // needing to special-case the parsing. Defining the arg as
+      // `no-backup` directly conflicts with citty's prefix logic
+      // and silently fails to bind, so we always go through the
+      // positive form.
+      description: "Write a backup of <container-dir> and the yml under container-backups/ before deleting. Default on; use `--no-backup` to skip.",
+      default: true
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip the interactive confirmation prompt. Useful in scripts.",
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const noBackup = args.backup === false;
+      const skipPrompt = args.yes === true;
+      if (!skipPrompt) {
+        const warning = noBackup ? `About to remove '${args.name}' WITHOUT a backup. Docker objects, container-configs entry, and container directory will all be deleted.` : `About to remove '${args.name}'. A backup will be written to container-backups/ first, then docker objects, container-configs entry, and container directory will all be deleted.`;
+        consola18.warn(warning);
+        const rl = createInterface({
+          input: process.stdin,
+          output: process.stdout
+        });
+        const answer = await rl.question("Continue? [y/N] ");
+        rl.close();
+        if (!/^y(es)?$/i.test(answer.trim())) {
+          consola18.info("Aborted. Nothing changed.");
+          process.exit(0);
+        }
+      }
+      await runRemove({
+        name: args.name,
+        ...noBackup ? { noBackup: true } : {}
+      });
+    } catch (err) {
+      consola18.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/restore.ts
+import { defineCommand as defineCommand14 } from "citty";
+import { consola as consola20 } from "consola";
+
+// src/restore/index.ts
+import { existsSync as existsSync9, promises as fs12 } from "fs";
+import path12 from "path";
+import { consola as consola19 } from "consola";
+async function runRestore(opts) {
+  const home = opts.monocerosHome ?? monocerosHome();
+  const logger = opts.logger ?? {
+    info: (msg) => consola19.info(msg),
+    success: (msg) => consola19.success(msg)
+  };
+  const backup = path12.resolve(opts.backupPath);
+  if (!existsSync9(backup)) {
+    throw new Error(`Backup not found: ${backup}.`);
+  }
+  const stat = await fs12.stat(backup);
+  if (!stat.isDirectory()) {
+    throw new Error(`Backup path is not a directory: ${backup}.`);
+  }
+  const entries = await fs12.readdir(backup);
+  const ymlFiles = entries.filter((f) => f.endsWith(".yml"));
+  if (ymlFiles.length === 0) {
+    throw new Error(
+      `Backup at ${backup} doesn't contain a *.yml \u2014 expected a single config file at the root.`
+    );
+  }
+  if (ymlFiles.length > 1) {
+    throw new Error(
+      `Backup at ${backup} contains multiple .yml files (${ymlFiles.join(", ")}). Expected exactly one.`
+    );
+  }
+  const ymlFile = ymlFiles[0];
+  const name = ymlFile.replace(/\.yml$/, "");
+  const containerInBackup = path12.join(backup, "container");
+  const hasContainer = existsSync9(containerInBackup);
+  const destYml = containerConfigPath(name, home);
+  const destContainer = containerDir(name, home);
+  if (existsSync9(destYml)) {
+    throw new Error(
+      `Refusing to restore: ${destYml} already exists. Remove the current container first (\`monoceros remove ${name}\`) or rename the existing config.`
+    );
+  }
+  if (hasContainer && existsSync9(destContainer)) {
+    throw new Error(
+      `Refusing to restore: ${destContainer} already exists. Remove the current container first (\`monoceros remove ${name}\`).`
+    );
+  }
+  await fs12.mkdir(containerConfigsDir(home), { recursive: true });
+  await fs12.copyFile(path12.join(backup, ymlFile), destYml);
+  if (hasContainer) {
+    await fs12.cp(containerInBackup, destContainer, { recursive: true });
+  }
+  logger.success(
+    `Restored '${name}' from ${path12.relative(home, backup) || backup}.`
+  );
+  logger.info(
+    `Run \`monoceros apply ${name}\` to bring the container back up.`
+  );
+  return {
+    name,
+    configPath: destYml,
+    containerPath: hasContainer ? destContainer : null
+  };
+}
+
+// src/commands/restore.ts
+var restoreCommand = defineCommand14({
+  meta: {
+    name: "restore",
+    description: "Restore a container's host-side state from a backup written by `monoceros remove`. Copies the yml and the container directory back into $MONOCEROS_HOME. Refuses to overwrite an existing config or container \u2014 remove the in-place container first if you need to clobber. Run `monoceros apply <name>` afterwards to bring it back up."
+  },
+  args: {
+    "backup-path": {
+      type: "positional",
+      description: "Path to a backup directory (typically `<MONOCEROS_HOME>/container-backups/<name>-<timestamp>/`).",
+      required: true
+    }
+  },
+  async run({ args }) {
+    try {
+      await runRestore({ backupPath: args["backup-path"] });
+    } catch (err) {
+      consola20.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/remove-from-url.ts
+import { defineCommand as defineCommand15 } from "citty";
+import { consola as consola21 } from "consola";
+var removeFromUrlCommand = defineCommand15({
+  meta: {
+    name: "remove-from-url",
+    description: "Remove a previously-added install URL from the container config. Idempotent, prints a diff before writing. The URL is dropped from post-create.sh on the next `monoceros apply`."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    url: {
+      type: "positional",
+      description: "Install URL to remove (must match the original exactly).",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const result = await runRemoveFromUrl({
+        name: args.name,
+        url: args.url,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola21.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/remove-language.ts
+import { defineCommand as defineCommand16 } from "citty";
+import { consola as consola22 } from "consola";
+var removeLanguageCommand = defineCommand16({
+  meta: {
+    name: "remove-language",
+    description: "Remove a language toolchain from the container config. Idempotent, prints a diff before writing."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    language: {
+      type: "positional",
+      description: "Language identifier (e.g. python, java, rust).",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const result = await runRemoveLanguage({
+        name: args.name,
+        language: args.language,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola22.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/remove-repo.ts
+import { defineCommand as defineCommand17 } from "citty";
+import { consola as consola23 } from "consola";
+var removeRepoCommand = defineCommand17({
+  meta: {
+    name: "remove-repo",
+    description: "Remove a repo from the container config (matches by URL or by its projects/<folder> name). Does NOT delete the existing projects/<folder> directory \u2014 local edits are preserved; clean it up manually."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    target: {
+      type: "positional",
+      description: "Repo URL or its projects/<folder> name. Either works.",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const result = await runRemoveRepo({
+        name: args.name,
+        target: args.target,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola23.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/remove-service.ts
+import { defineCommand as defineCommand18 } from "citty";
+import { consola as consola24 } from "consola";
+var removeServiceCommand = defineCommand18({
+  meta: {
+    name: "remove-service",
+    description: "Remove a compose service from the container config. Idempotent, prints a diff before writing. Note: data volumes (e.g. postgres-data) are NOT cleaned up automatically."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    service: {
+      type: "positional",
+      description: "Service identifier (e.g. postgres, redis).",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation and apply the diff.",
+      alias: ["y"],
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const result = await runRemoveService({
+        name: args.name,
+        service: args.service,
+        yes: args.yes
+      });
+      process.exit(result.status === "aborted" ? 1 : 0);
+    } catch (err) {
+      consola24.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/run.ts
+import { defineCommand as defineCommand19 } from "citty";
+import { consola as consola25 } from "consola";
+
+// src/devcontainer/shell.ts
+import { existsSync as existsSync10 } from "fs";
+import path13 from "path";
+async function runShell(opts) {
+  assertContainerExists(opts.root);
+  const spawnFn = opts.spawn ?? spawnDevcontainer;
+  const upCode = await spawnFn(
+    ["up", "--workspace-folder", opts.root],
+    opts.root,
+    { quiet: true }
+  );
+  if (upCode !== 0) return upCode;
+  return spawnFn(["exec", "--workspace-folder", opts.root, "bash"], opts.root, {
+    interactive: true
+  });
+}
+function assertContainerExists(root) {
+  if (!existsSync10(path13.join(root, ".devcontainer"))) {
+    throw new Error(
+      `No .devcontainer/ at ${root}. Run \`monoceros apply <name>\` first.`
+    );
+  }
+}
+
+// src/devcontainer/run.ts
+async function runInContainer(opts) {
+  if (opts.command.length === 0) {
+    throw new Error(
+      "No command provided. Usage: `monoceros run <containername> -- <cmd> [args\u2026]`."
+    );
+  }
+  assertContainerExists(opts.root);
+  const spawnFn = opts.spawn ?? spawnDevcontainer;
+  const upCode = await spawnFn(
+    ["up", "--workspace-folder", opts.root],
+    opts.root,
+    { quiet: true }
+  );
+  if (upCode !== 0) return upCode;
+  return spawnFn(
+    ["exec", "--workspace-folder", opts.root, ...opts.command],
+    opts.root,
+    { interactive: true }
+  );
+}
+
+// src/commands/run.ts
+var runCommand = defineCommand19({
+  meta: {
+    name: "run",
+    description: "Run a one-off command inside the named dev-container. Use `--` to separate monoceros flags from the inner command."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const command = [...getInnerArgs()];
+    if (command.length === 0) {
+      consola25.error(
+        "No command provided. Usage: `monoceros run <containername> -- <cmd> [args\u2026]`."
+      );
+      process.exit(1);
+    }
+    try {
+      const exitCode = await runInContainer({
+        root: containerDir(args.name),
+        command
+      });
+      process.exit(exitCode);
+    } catch (err) {
+      consola25.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/shell.ts
+import { defineCommand as defineCommand20 } from "citty";
+import { consola as consola26 } from "consola";
+var shellCommand = defineCommand20({
+  meta: {
+    name: "shell",
+    description: "Open an interactive bash session inside the named dev-container."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    }
+  },
+  async run({ args }) {
+    try {
+      const exitCode = await runShell({ root: containerDir(args.name) });
+      process.exit(exitCode);
+    } catch (err) {
+      consola26.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/start.ts
+import { defineCommand as defineCommand21 } from "citty";
+var startCommand = defineCommand21({
+  meta: {
+    name: "start",
+    description: "Bring the named dev-container up via `devcontainer up` (workspace + runServices, postCreate, features)."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    }
+  },
+  run({ args }) {
+    return dispatch(() => runStart({ root: containerDir(args.name) }));
+  }
+});
+
+// src/commands/status.ts
+import { defineCommand as defineCommand22 } from "citty";
+var statusCommand = defineCommand22({
+  meta: {
+    name: "status",
+    description: "Show whether the compose services for the named dev-container are running."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    service: {
+      type: "string",
+      description: "Restrict to a single compose service (e.g. postgres). Defaults to all."
+    }
+  },
+  run({ args }) {
+    return dispatch(
+      () => runStatus({
+        root: containerDir(args.name),
+        ...typeof args.service === "string" ? { service: args.service } : {}
+      })
+    );
+  }
+});
+
+// src/commands/stop.ts
+import { defineCommand as defineCommand23 } from "citty";
+var stopCommand = defineCommand23({
+  meta: {
+    name: "stop",
+    description: "Stop the compose services for the named dev-container. Volumes are preserved."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+      required: true
+    },
+    service: {
+      type: "string",
+      description: "Restrict to a single compose service (e.g. postgres). Defaults to all."
+    }
+  },
+  run({ args }) {
+    return dispatch(
+      () => runStop({
+        root: containerDir(args.name),
+        ...typeof args.service === "string" ? { service: args.service } : {}
+      })
+    );
+  }
+});
+
+// src/main.ts
+var main = defineCommand24({
+  meta: {
+    name: "monoceros",
+    version: CLI_VERSION,
+    description: "Monoceros workbench \u2014 local, sandboxed AI-coding environment for solution builders."
+  },
+  subCommands: {
+    init: initCommand,
+    "list-components": listComponentsCommand,
+    shell: shellCommand,
+    run: runCommand,
+    logs: logsCommand,
+    start: startCommand,
+    stop: stopCommand,
+    status: statusCommand,
+    apply: applyCommand,
+    remove: removeCommand,
+    restore: restoreCommand,
+    "add-service": addServiceCommand,
+    "add-language": addLanguageCommand,
+    "add-apt-packages": addAptPackagesCommand,
+    "add-feature": addFeatureCommand,
+    "add-from-url": addFromUrlCommand,
+    "add-repo": addRepoCommand,
+    "remove-service": removeServiceCommand,
+    "remove-language": removeLanguageCommand,
+    "remove-apt-packages": removeAptPackagesCommand,
+    "remove-feature": removeFeatureCommand,
+    "remove-from-url": removeFromUrlCommand,
+    "remove-repo": removeRepoCommand
+  }
+});
+
+// src/bin.ts
+consumeInnerArgsFromProcessArgv();
+async function entry() {
+  if (await maybeRenderHelp(process.argv.slice(2), main)) {
+    return;
+  }
+  await runMain(main);
+}
+entry().catch((err) => {
+  console.error(
+    err instanceof Error ? err.stack ?? err.message : String(err)
+  );
+  process.exit(1);
+});
+//# sourceMappingURL=bin.js.map