@getmonoceros/workbench 1.17.0 → 1.18.0

package/dist/bin.js

@@ -3216,8 +3216,8 @@ function removeRepoFromDoc(doc, urlOrPath) {
     if (!isMap2(item)) return false;
     const url = item.get("url");
     if (url === urlOrPath) return true;
-    const path22 = item.get("path");
-    const effectivePath = typeof path22 === "string" ? path22 : typeof url === "string" ? deriveRepoName(url) : void 0;
+    const path23 = item.get("path");
+    const effectivePath = typeof path23 === "string" ? path23 : typeof url === "string" ? deriveRepoName(url) : void 0;
     return effectivePath === urlOrPath;
   });
   if (idx < 0) return false;
@@ -3329,7 +3329,7 @@ async function runAddRepo(input) {
       "Missing repo URL. Usage: monoceros add-repo <containername> <url>."
     );
   }
-  const path22 = (input.path ?? deriveRepoName(url)).trim();
+  const path23 = (input.path ?? deriveRepoName(url)).trim();
   const hasName = typeof input.gitName === "string" && input.gitName.trim().length > 0;
   const hasEmail = typeof input.gitEmail === "string" && input.gitEmail.trim().length > 0;
   if (hasName !== hasEmail) {
@@ -3366,7 +3366,7 @@ async function runAddRepo(input) {
   const providerToWrite = !canonical && explicitProvider ? explicitProvider : void 0;
   const entry2 = {
     url,
-    path: path22,
+    path: path23,
     ...hasName && hasEmail ? {
       gitUser: {
         name: input.gitName.trim(),
@@ -6293,7 +6293,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "1.17.0" : "dev";
+    CLI_VERSION = true ? "1.18.0" : "dev";
   }
 });
 
@@ -6455,8 +6455,8 @@ var init_completion = __esm({
         name: "completion",
         group: "tooling",
         // Hidden from `monoceros --help`: the install scripts wire up
-        // completion automatically; manual setup is documented in
-        // docs/commands/completion.md. Still runnable directly.
+        // completion automatically; manual setup is documented at
+        // getmonoceros.build/docs/reference/utilities/completion. Still runnable directly.
         hidden: true,
         description: "Print a shell completion script for bash, zsh or PowerShell to stdout. Pipe the output into a file your shell loads at startup. The install scripts (install.sh / install.ps1) call this automatically."
       },
@@ -6482,6 +6482,43 @@ var init_completion = __esm({
   }
 });
 
+// src/login/services.ts
+function featureLeaf(ref) {
+  const noTag = ref.replace(/:[^/:]*$/, "");
+  return noTag.slice(noTag.lastIndexOf("/") + 1);
+}
+function loginCapableServices(refs) {
+  const out = [];
+  for (const ref of refs) {
+    const service = LOGIN_SERVICE_BY_LEAF[featureLeaf(ref)];
+    if (service && !out.includes(service)) out.push(service);
+  }
+  return out;
+}
+function parseCallbackTarget(authUrl) {
+  try {
+    const u = new URL(authUrl);
+    const redirect = u.searchParams.get("redirect_uri");
+    if (!redirect) return null;
+    const r = new URL(redirect);
+    if (r.hostname !== "localhost" && r.hostname !== "127.0.0.1") return null;
+    const port = Number(r.port);
+    if (!Number.isInteger(port) || port <= 0) return null;
+    return { port, pathname: r.pathname };
+  } catch {
+    return null;
+  }
+}
+var LOGIN_SERVICE_BY_LEAF;
+var init_services = __esm({
+  "src/login/services.ts"() {
+    "use strict";
+    LOGIN_SERVICE_BY_LEAF = {
+      "claude-code": "claude"
+    };
+  }
+});
+
 // src/completion/resolve.ts
 import { existsSync as existsSync8, promises as fs13 } from "fs";
 import path16 from "path";
@@ -6551,6 +6588,7 @@ function dispatchCommand(spec, argTokens, ctx) {
   if (inPostDash && spec.innerArgs) {
     return resolveValues(spec.innerArgs, ctx, ctx.current);
   }
+  if (inPostDash) return [];
   return resolvePreDash(spec, preDash, ctx);
 }
 async function resolvePreDash(spec, preDash, ctx) {
@@ -6637,6 +6675,20 @@ async function listContainerNames(ctx) {
   const entries = await fs13.readdir(dir);
   return entries.filter((e) => e.endsWith(".yml")).map((e) => e.slice(0, -".yml".length)).sort();
 }
+async function listLoginServices(ctx) {
+  const after = ctx.prev.slice(2);
+  const name = after.find((t) => !t.startsWith("-"));
+  if (!name) return [];
+  const home = ctx.opts.monocerosHome ?? monocerosHome();
+  const cfgPath = path16.join(home, "container-configs", `${name}.yml`);
+  if (!existsSync8(cfgPath)) return [];
+  try {
+    const { config } = await readConfig(cfgPath);
+    return loginCapableServices(config.features.map((f) => f.ref));
+  } catch {
+    return [];
+  }
+}
 async function listFeatureComponents() {
   const catalog = await loadComponentCatalog();
   return [...catalog.values()].filter((c) => c.file.category === "feature").map((c) => c.name).sort();
@@ -6704,15 +6756,18 @@ var init_resolve = __esm({
   "src/completion/resolve.ts"() {
     "use strict";
     init_paths();
+    init_io();
     init_components();
     init_manifest();
     init_catalog();
+    init_services();
     init_schema();
     ALL_COMMANDS = [
       "init",
       "list-components",
       "shell",
       "run",
+      "login",
       "logs",
       "start",
       "stop",
@@ -6777,7 +6832,11 @@ var init_resolve = __esm({
         }
       },
       shell: { positionals: [containerName] },
-      run: { positionals: [containerName] },
+      run: {
+        positionals: [containerName],
+        flags: { "--in": { type: "value" } }
+      },
+      login: { positionals: [containerName, (ctx) => listLoginServices(ctx)] },
       logs: { positionals: [containerName] },
       start: { positionals: [containerName] },
       stop: { positionals: [containerName] },
@@ -7750,8 +7809,262 @@ var init_list_components = __esm({
   }
 });
 
-// src/commands/logs.ts
+// src/devcontainer/shell.ts
+import { existsSync as existsSync10 } from "fs";
+import path18 from "path";
+async function runShell(opts) {
+  assertContainerExists(opts.root);
+  const spawnFn = opts.spawn ?? spawnDevcontainer;
+  const upCode = await spawnFn(
+    ["up", "--workspace-folder", opts.root, "--mount-workspace-git-root=false"],
+    opts.root,
+    { quiet: true }
+  );
+  if (upCode !== 0) return upCode;
+  return spawnFn(
+    [
+      "exec",
+      "--workspace-folder",
+      opts.root,
+      "--mount-workspace-git-root=false",
+      "bash"
+    ],
+    opts.root,
+    { interactive: true }
+  );
+}
+function assertContainerExists(root) {
+  if (!existsSync10(path18.join(root, ".devcontainer"))) {
+    throw new Error(
+      `No .devcontainer/ at ${root}. Run \`monoceros apply <name>\` first.`
+    );
+  }
+}
+var init_shell = __esm({
+  "src/devcontainer/shell.ts"() {
+    "use strict";
+    init_cli();
+  }
+});
+
+// src/login/index.ts
+import { spawn as spawn8 } from "child_process";
+import { existsSync as existsSync11, promises as fsp2, readFileSync as readFileSync6 } from "fs";
+import http from "http";
+import path19 from "path";
+import { consola as consola16 } from "consola";
+function openInBrowser(url) {
+  const platform = process.platform;
+  const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn8(cmd, args, {
+      stdio: "ignore",
+      detached: true
+    });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function runLogin(opts) {
+  const root = containerDir(opts.name);
+  assertContainerExists(root);
+  const { config } = await readConfig(containerConfigPath(opts.name));
+  const capable = loginCapableServices(config.features.map((f) => f.ref));
+  if (capable.length === 0) {
+    consola16.error(
+      `Container "${opts.name}" has no tool with a Monoceros login. (Supported today: claude.)`
+    );
+    return 1;
+  }
+  if (!opts.feature) {
+    consola16.info(
+      `Login-capable tools in "${opts.name}": ${capable.join(", ")}.`
+    );
+    consola16.info(`Log one in with: monoceros login ${opts.name} <tool>`);
+    return 0;
+  }
+  const service = opts.feature;
+  if (!capable.includes(service)) {
+    consola16.error(
+      `"${service}" is not a login-capable tool in "${opts.name}". Available: ${capable.join(", ")}.`
+    );
+    return 1;
+  }
+  if (service !== "claude") {
+    consola16.error(
+      `Login for "${service}" is not implemented yet (only claude).`
+    );
+    return 1;
+  }
+  return runClaudeLogin(opts.name, root, opts.spawn ?? spawnDevcontainer);
+}
+async function runClaudeLogin(name, root, spawnFn) {
+  const credFile = path19.join(root, "home", ".claude", ".credentials.json");
+  if (existsSync11(credFile)) {
+    consola16.success(
+      `Claude is already logged in for "${name}". Re-apply or remove the credential to log in again.`
+    );
+    return 0;
+  }
+  const upCode = await spawnFn(
+    ["up", "--workspace-folder", root, "--mount-workspace-git-root=false"],
+    root,
+    { quiet: true }
+  );
+  if (upCode !== 0) return upCode;
+  const relayDir = path19.join(root, RELAY_DIRNAME);
+  const relayScript = path19.join(relayDir, "xdg-open");
+  const urlFile = path19.join(relayDir, "url");
+  await fsp2.mkdir(relayDir, { recursive: true });
+  await fsp2.rm(urlFile, { force: true });
+  await fsp2.writeFile(
+    relayScript,
+    `#!/bin/sh
+printf '%s\\n' "$1" > "$(dirname "$0")/url"
+exit 0
+`,
+    { mode: 493 }
+  );
+  await fsp2.chmod(relayScript, 493);
+  const servers = [];
+  let handledUrl = false;
+  const onAuthUrl = (authUrl) => {
+    consola16.info("Opening the Claude sign-in page in your browser\u2026");
+    openInBrowser(authUrl);
+    const target = parseCallbackTarget(authUrl);
+    if (!target) {
+      return;
+    }
+    const server = http.createServer((req, res) => {
+      const reqUrl = req.url ?? target.pathname;
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(
+        '<html><body style="font-family:sans-serif;padding:3rem">You are signed in. You can close this tab and return to the terminal.</body></html>'
+      );
+      void spawnFn(
+        [
+          "exec",
+          "--workspace-folder",
+          root,
+          "--mount-workspace-git-root=false",
+          "curl",
+          "-fsS",
+          `http://localhost:${target.port}${reqUrl}`
+        ],
+        root,
+        { quiet: true }
+      );
+    });
+    server.on("error", (err) => {
+      consola16.warn(
+        `Could not start the local callback helper on port ${target.port} (${err.message}). If the browser shows a code, paste it into the terminal instead.`
+      );
+    });
+    server.listen(target.port, "127.0.0.1");
+    servers.push(server);
+  };
+  const poll = setInterval(() => {
+    if (handledUrl || !existsSync11(urlFile)) return;
+    let content = "";
+    try {
+      content = readFileSync6(urlFile, "utf8");
+    } catch {
+      return;
+    }
+    if (!content.trim()) return;
+    handledUrl = true;
+    onAuthUrl(content.trim());
+  }, 250);
+  consola16.info(
+    "Starting Claude login. Pick your account in Claude's menu \u2014 the browser opens for you, no copying."
+  );
+  const child = spawn8(
+    process.execPath,
+    [
+      devcontainerCliPath(),
+      "exec",
+      "--workspace-folder",
+      root,
+      "--mount-workspace-git-root=false",
+      "bash",
+      "-lc",
+      `export PATH="/workspaces/${name}/${RELAY_DIRNAME}:$PATH"; exec claude`
+    ],
+    { cwd: root, stdio: "inherit" }
+  );
+  const code = await new Promise((resolve) => {
+    child.on("error", () => resolve(1));
+    child.on("exit", (c) => resolve(c ?? 0));
+  });
+  clearInterval(poll);
+  for (const s of servers) s.close();
+  await fsp2.rm(relayDir, { recursive: true, force: true });
+  if (existsSync11(credFile)) {
+    consola16.success(
+      `Claude is logged in for "${name}". The credential persists across rebuilds.`
+    );
+  }
+  return code;
+}
+var RELAY_DIRNAME;
+var init_login = __esm({
+  "src/login/index.ts"() {
+    "use strict";
+    init_io();
+    init_paths();
+    init_cli();
+    init_shell();
+    init_services();
+    RELAY_DIRNAME = ".monoceros-login";
+  }
+});
+
+// src/commands/login.ts
 import { defineCommand as defineCommand13 } from "citty";
+import { consola as consola17 } from "consola";
+var loginCommand;
+var init_login2 = __esm({
+  "src/commands/login.ts"() {
+    "use strict";
+    init_login();
+    loginCommand = defineCommand13({
+      meta: {
+        name: "login",
+        group: "lifecycle",
+        description: "Log a curated tool in inside the container. Opens the sign-in page in your browser for you \u2014 no copying URLs. Today: Claude."
+      },
+      args: {
+        name: {
+          type: "positional",
+          description: "Container name.",
+          required: true
+        },
+        feature: {
+          type: "positional",
+          description: "Which tool to log in (e.g. `claude`). Optional when the container has only one login-capable tool.",
+          required: false
+        }
+      },
+      async run({ args }) {
+        try {
+          const code = await runLogin({
+            name: args.name,
+            ...args.feature ? { feature: args.feature } : {}
+          });
+          process.exit(code);
+        } catch (err) {
+          consola17.error(err instanceof Error ? err.message : String(err));
+          process.exit(1);
+        }
+      }
+    });
+  }
+});
+
+// src/commands/logs.ts
+import { defineCommand as defineCommand14 } from "citty";
 var logsCommand;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
@@ -7759,7 +8072,7 @@ var init_logs = __esm({
     init_paths();
     init_compose();
     init_dispatch();
-    logsCommand = defineCommand13({
+    logsCommand = defineCommand14({
       meta: {
         name: "logs",
         group: "run",
@@ -7796,11 +8109,11 @@ var init_logs = __esm({
 });
 
 // src/commands/port.ts
-import { defineCommand as defineCommand14 } from "citty";
-import { consola as consola16 } from "consola";
+import { defineCommand as defineCommand15 } from "citty";
+import { consola as consola18 } from "consola";
 async function runPortListing(opts) {
   const out = opts.out ?? process.stdout;
-  const info = opts.info ?? ((m) => consola16.info(m));
+  const info = opts.info ?? ((m) => consola18.info(m));
   const parsed = await readConfig(
     containerConfigPath(opts.name, opts.monocerosHome)
   );
@@ -7858,7 +8171,7 @@ var init_port = __esm({
     init_schema();
     init_dynamic();
     init_format();
-    portCommand = defineCommand14({
+    portCommand = defineCommand15({
       meta: {
         name: "port",
         group: "discovery",
@@ -7876,7 +8189,7 @@ var init_port = __esm({
           const code = await runPortListing({ name: args.name });
           process.exit(code);
         } catch (err) {
-          consola16.error(err instanceof Error ? err.message : String(err));
+          consola18.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -7885,15 +8198,15 @@ var init_port = __esm({
 });
 
 // src/commands/remove-apt-packages.ts
-import { defineCommand as defineCommand15 } from "citty";
-import { consola as consola17 } from "consola";
+import { defineCommand as defineCommand16 } from "citty";
+import { consola as consola19 } from "consola";
 var removeAptPackagesCommand;
 var init_remove_apt_packages = __esm({
   "src/commands/remove-apt-packages.ts"() {
     "use strict";
     init_inner_args();
     init_modify();
-    removeAptPackagesCommand = defineCommand15({
+    removeAptPackagesCommand = defineCommand16({
       meta: {
         name: "remove-apt-packages",
         group: "edit",
@@ -7915,7 +8228,7 @@ var init_remove_apt_packages = __esm({
       async run({ args }) {
         const packages = [...getInnerArgs()];
         if (packages.length === 0) {
-          consola17.error(
+          consola19.error(
             "No package names given. Usage: `monoceros remove-apt-packages <containername> [--yes] -- <pkg> [<pkg> \u2026]`."
           );
           process.exit(1);
@@ -7928,7 +8241,7 @@ var init_remove_apt_packages = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola17.error(err instanceof Error ? err.message : String(err));
+          consola19.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -7937,14 +8250,14 @@ var init_remove_apt_packages = __esm({
 });
 
 // src/commands/remove-feature.ts
-import { defineCommand as defineCommand16 } from "citty";
-import { consola as consola18 } from "consola";
+import { defineCommand as defineCommand17 } from "citty";
+import { consola as consola20 } from "consola";
 var removeFeatureCommand;
 var init_remove_feature = __esm({
   "src/commands/remove-feature.ts"() {
     "use strict";
     init_modify();
-    removeFeatureCommand = defineCommand16({
+    removeFeatureCommand = defineCommand17({
       meta: {
         name: "remove-feature",
         group: "edit",
@@ -7977,7 +8290,7 @@ var init_remove_feature = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola18.error(err instanceof Error ? err.message : String(err));
+          consola20.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -7986,15 +8299,15 @@ var init_remove_feature = __esm({
 });
 
 // src/remove/index.ts
-import { existsSync as existsSync10, promises as fs15 } from "fs";
-import path18 from "path";
-import { consola as consola19 } from "consola";
+import { existsSync as existsSync12, promises as fs15 } from "fs";
+import path20 from "path";
+import { consola as consola21 } from "consola";
 async function runRemove(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
   const logger = opts.logger ?? {
-    info: (msg) => consola19.info(msg),
-    success: (msg) => consola19.success(msg),
-    warn: (msg) => consola19.warn(msg)
+    info: (msg) => consola21.info(msg),
+    success: (msg) => consola21.success(msg),
+    warn: (msg) => consola21.warn(msg)
   };
   if (!REGEX.solutionName.test(opts.name)) {
     throw new Error(
@@ -8004,9 +8317,9 @@ async function runRemove(opts) {
   const ymlPath = containerConfigPath(opts.name, home);
   const envPath = containerEnvPath(opts.name, home);
   const containerPath = containerDir(opts.name, home);
-  const hasYml = existsSync10(ymlPath);
-  const hasEnv = existsSync10(envPath);
-  const hasContainer = existsSync10(containerPath);
+  const hasYml = existsSync12(ymlPath);
+  const hasEnv = existsSync12(envPath);
+  const hasContainer = existsSync12(containerPath);
   if (!hasYml && !hasContainer) {
     throw new Error(
       `Nothing to remove for '${opts.name}': neither ${ymlPath} nor ${containerPath} exists.`
@@ -8032,16 +8345,16 @@ async function runRemove(opts) {
   let backupPath = null;
   if (!opts.noBackup && (hasYml || hasContainer)) {
     const ts = (opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    backupPath = path18.join(home, "container-backups", `${opts.name}-${ts}`);
+    backupPath = path20.join(home, "container-backups", `${opts.name}-${ts}`);
     await fs15.mkdir(backupPath, { recursive: true });
     if (hasYml) {
-      await fs15.copyFile(ymlPath, path18.join(backupPath, `${opts.name}.yml`));
+      await fs15.copyFile(ymlPath, path20.join(backupPath, `${opts.name}.yml`));
     }
     if (hasEnv) {
-      await fs15.copyFile(envPath, path18.join(backupPath, `${opts.name}.env`));
+      await fs15.copyFile(envPath, path20.join(backupPath, `${opts.name}.env`));
     }
     if (hasContainer) {
-      await fs15.cp(containerPath, path18.join(backupPath, "container"), {
+      await fs15.cp(containerPath, path20.join(backupPath, "container"), {
         recursive: true
       });
     }
@@ -8130,15 +8443,15 @@ var init_remove = __esm({
 });
 
 // src/commands/remove.ts
-import { defineCommand as defineCommand17 } from "citty";
-import { consola as consola20 } from "consola";
+import { defineCommand as defineCommand18 } from "citty";
+import { consola as consola22 } from "consola";
 import { createInterface } from "readline/promises";
 var removeCommand;
 var init_remove2 = __esm({
   "src/commands/remove.ts"() {
     "use strict";
     init_remove();
-    removeCommand = defineCommand17({
+    removeCommand = defineCommand18({
       meta: {
         name: "remove",
         group: "lifecycle",
@@ -8175,7 +8488,7 @@ var init_remove2 = __esm({
           const skipPrompt = args.yes === true;
           if (!skipPrompt) {
             const warning = noBackup ? `About to remove '${args.name}' WITHOUT a backup. Docker objects, container-configs entry, and container directory will all be deleted.` : `About to remove '${args.name}'. A backup will be written to container-backups/ first, then docker objects, container-configs entry, and container directory will all be deleted.`;
-            consola20.warn(warning);
+            consola22.warn(warning);
             const rl = createInterface({
               input: process.stdin,
               output: process.stdout
@@ -8183,7 +8496,7 @@ var init_remove2 = __esm({
             const answer = await rl.question("Continue? [y/N] ");
             rl.close();
             if (!/^y(es)?$/i.test(answer.trim())) {
-              consola20.info("Aborted. Nothing changed.");
+              consola22.info("Aborted. Nothing changed.");
               process.exit(0);
             }
           }
@@ -8192,7 +8505,7 @@ var init_remove2 = __esm({
             ...noBackup ? { noBackup: true } : {}
           });
         } catch (err) {
-          consola20.error(err instanceof Error ? err.message : String(err));
+          consola22.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8201,17 +8514,17 @@ var init_remove2 = __esm({
 });
 
 // src/restore/index.ts
-import { existsSync as existsSync11, promises as fs16 } from "fs";
-import path19 from "path";
-import { consola as consola21 } from "consola";
+import { existsSync as existsSync13, promises as fs16 } from "fs";
+import path21 from "path";
+import { consola as consola23 } from "consola";
 async function runRestore(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
   const logger = opts.logger ?? {
-    info: (msg) => consola21.info(msg),
-    success: (msg) => consola21.success(msg)
+    info: (msg) => consola23.info(msg),
+    success: (msg) => consola23.success(msg)
   };
-  const backup = path19.resolve(opts.backupPath);
-  if (!existsSync11(backup)) {
+  const backup = path21.resolve(opts.backupPath);
+  if (!existsSync13(backup)) {
     throw new Error(`Backup not found: ${backup}.`);
   }
   const stat = await fs16.stat(backup);
@@ -8232,24 +8545,24 @@ async function runRestore(opts) {
   }
   const ymlFile = ymlFiles[0];
   const name = ymlFile.replace(/\.yml$/, "");
-  const containerInBackup = path19.join(backup, "container");
-  const hasContainer = existsSync11(containerInBackup);
-  const envInBackup = path19.join(backup, `${name}.env`);
-  const hasEnv = existsSync11(envInBackup);
+  const containerInBackup = path21.join(backup, "container");
+  const hasContainer = existsSync13(containerInBackup);
+  const envInBackup = path21.join(backup, `${name}.env`);
+  const hasEnv = existsSync13(envInBackup);
   const destYml = containerConfigPath(name, home);
   const destContainer = containerDir(name, home);
-  if (existsSync11(destYml)) {
+  if (existsSync13(destYml)) {
     throw new Error(
       `Refusing to restore: ${destYml} already exists. Remove the current container first (\`monoceros remove ${name}\`) or rename the existing config.`
     );
   }
-  if (hasContainer && existsSync11(destContainer)) {
+  if (hasContainer && existsSync13(destContainer)) {
     throw new Error(
       `Refusing to restore: ${destContainer} already exists. Remove the current container first (\`monoceros remove ${name}\`).`
     );
   }
   await fs16.mkdir(containerConfigsDir(home), { recursive: true });
-  await fs16.copyFile(path19.join(backup, ymlFile), destYml);
+  await fs16.copyFile(path21.join(backup, ymlFile), destYml);
   if (hasEnv) {
     await fs16.copyFile(envInBackup, containerEnvPath(name, home));
   }
@@ -8274,14 +8587,14 @@ var init_restore = __esm({
 });
 
 // src/commands/restore.ts
-import { defineCommand as defineCommand18 } from "citty";
-import { consola as consola22 } from "consola";
+import { defineCommand as defineCommand19 } from "citty";
+import { consola as consola24 } from "consola";
 var restoreCommand;
 var init_restore2 = __esm({
   "src/commands/restore.ts"() {
     "use strict";
     init_restore();
-    restoreCommand = defineCommand18({
+    restoreCommand = defineCommand19({
       meta: {
         name: "restore",
         group: "lifecycle",
@@ -8298,7 +8611,7 @@ var init_restore2 = __esm({
         try {
           await runRestore({ backupPath: args["backup-path"] });
         } catch (err) {
-          consola22.error(err instanceof Error ? err.message : String(err));
+          consola24.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8307,14 +8620,14 @@ var init_restore2 = __esm({
 });
 
 // src/commands/remove-from-url.ts
-import { defineCommand as defineCommand19 } from "citty";
-import { consola as consola23 } from "consola";
+import { defineCommand as defineCommand20 } from "citty";
+import { consola as consola25 } from "consola";
 var removeFromUrlCommand;
 var init_remove_from_url = __esm({
   "src/commands/remove-from-url.ts"() {
     "use strict";
     init_modify();
-    removeFromUrlCommand = defineCommand19({
+    removeFromUrlCommand = defineCommand20({
       meta: {
         name: "remove-from-url",
         group: "edit",
@@ -8347,7 +8660,7 @@ var init_remove_from_url = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola23.error(err instanceof Error ? err.message : String(err));
+          consola25.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8356,14 +8669,14 @@ var init_remove_from_url = __esm({
 });
 
 // src/commands/remove-language.ts
-import { defineCommand as defineCommand20 } from "citty";
-import { consola as consola24 } from "consola";
+import { defineCommand as defineCommand21 } from "citty";
+import { consola as consola26 } from "consola";
 var removeLanguageCommand;
 var init_remove_language = __esm({
   "src/commands/remove-language.ts"() {
     "use strict";
     init_modify();
-    removeLanguageCommand = defineCommand20({
+    removeLanguageCommand = defineCommand21({
       meta: {
         name: "remove-language",
         group: "edit",
@@ -8396,7 +8709,7 @@ var init_remove_language = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola24.error(err instanceof Error ? err.message : String(err));
+          consola26.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8405,8 +8718,8 @@ var init_remove_language = __esm({
 });
 
 // src/commands/remove-port.ts
-import { defineCommand as defineCommand21 } from "citty";
-import { consola as consola25 } from "consola";
+import { defineCommand as defineCommand22 } from "citty";
+import { consola as consola27 } from "consola";
 function coerceToken2(raw) {
   const n = Number(raw);
   return Number.isFinite(n) ? n : raw;
@@ -8417,7 +8730,7 @@ var init_remove_port = __esm({
     "use strict";
     init_inner_args();
     init_modify();
-    removePortCommand = defineCommand21({
+    removePortCommand = defineCommand22({
       meta: {
         name: "remove-port",
         group: "edit",
@@ -8439,7 +8752,7 @@ var init_remove_port = __esm({
       async run({ args }) {
         const tokens = [...getInnerArgs()];
         if (tokens.length === 0) {
-          consola25.error(
+          consola27.error(
             "No ports given. Usage: `monoceros remove-port <containername> [--yes] -- <port> [<port> \u2026]`."
           );
           process.exit(1);
@@ -8452,7 +8765,7 @@ var init_remove_port = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola25.error(err instanceof Error ? err.message : String(err));
+          consola27.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8461,14 +8774,14 @@ var init_remove_port = __esm({
 });
 
 // src/commands/remove-repo.ts
-import { defineCommand as defineCommand22 } from "citty";
-import { consola as consola26 } from "consola";
+import { defineCommand as defineCommand23 } from "citty";
+import { consola as consola28 } from "consola";
 var removeRepoCommand;
 var init_remove_repo = __esm({
   "src/commands/remove-repo.ts"() {
     "use strict";
     init_modify();
-    removeRepoCommand = defineCommand22({
+    removeRepoCommand = defineCommand23({
       meta: {
         name: "remove-repo",
         group: "edit",
@@ -8501,7 +8814,7 @@ var init_remove_repo = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola26.error(err instanceof Error ? err.message : String(err));
+          consola28.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8510,14 +8823,14 @@ var init_remove_repo = __esm({
 });
 
 // src/commands/remove-service.ts
-import { defineCommand as defineCommand23 } from "citty";
-import { consola as consola27 } from "consola";
+import { defineCommand as defineCommand24 } from "citty";
+import { consola as consola29 } from "consola";
 var removeServiceCommand;
 var init_remove_service = __esm({
   "src/commands/remove-service.ts"() {
     "use strict";
     init_modify();
-    removeServiceCommand = defineCommand23({
+    removeServiceCommand = defineCommand24({
       meta: {
         name: "remove-service",
         group: "edit",
@@ -8550,7 +8863,7 @@ var init_remove_service = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola27.error(err instanceof Error ? err.message : String(err));
+          consola29.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8558,44 +8871,6 @@ var init_remove_service = __esm({
   }
 });
 
-// src/devcontainer/shell.ts
-import { existsSync as existsSync12 } from "fs";
-import path20 from "path";
-async function runShell(opts) {
-  assertContainerExists(opts.root);
-  const spawnFn = opts.spawn ?? spawnDevcontainer;
-  const upCode = await spawnFn(
-    ["up", "--workspace-folder", opts.root, "--mount-workspace-git-root=false"],
-    opts.root,
-    { quiet: true }
-  );
-  if (upCode !== 0) return upCode;
-  return spawnFn(
-    [
-      "exec",
-      "--workspace-folder",
-      opts.root,
-      "--mount-workspace-git-root=false",
-      "bash"
-    ],
-    opts.root,
-    { interactive: true }
-  );
-}
-function assertContainerExists(root) {
-  if (!existsSync12(path20.join(root, ".devcontainer"))) {
-    throw new Error(
-      `No .devcontainer/ at ${root}. Run \`monoceros apply <name>\` first.`
-    );
-  }
-}
-var init_shell = __esm({
-  "src/devcontainer/shell.ts"() {
-    "use strict";
-    init_cli();
-  }
-});
-
 // src/devcontainer/run.ts
 async function runInContainer(opts) {
   if (opts.command.length === 0) {
@@ -8640,8 +8915,8 @@ var init_run = __esm({
 });
 
 // src/commands/run.ts
-import { defineCommand as defineCommand24 } from "citty";
-import { consola as consola28 } from "consola";
+import { defineCommand as defineCommand25 } from "citty";
+import { consola as consola30 } from "consola";
 var runCommand;
 var init_run2 = __esm({
   "src/commands/run.ts"() {
@@ -8649,7 +8924,7 @@ var init_run2 = __esm({
     init_paths();
     init_run();
     init_inner_args();
-    runCommand = defineCommand24({
+    runCommand = defineCommand25({
       meta: {
         name: "run",
         group: "run",
@@ -8669,7 +8944,7 @@ var init_run2 = __esm({
       async run({ args }) {
         const command = [...getInnerArgs()];
         if (command.length === 0) {
-          consola28.error(
+          consola30.error(
             "No command provided. Usage: `monoceros run <containername> -- <cmd> [args\u2026]`."
           );
           process.exit(1);
@@ -8682,7 +8957,7 @@ var init_run2 = __esm({
           });
           process.exit(exitCode);
         } catch (err) {
-          consola28.error(err instanceof Error ? err.message : String(err));
+          consola30.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8691,15 +8966,15 @@ var init_run2 = __esm({
 });
 
 // src/commands/shell.ts
-import { defineCommand as defineCommand25 } from "citty";
-import { consola as consola29 } from "consola";
+import { defineCommand as defineCommand26 } from "citty";
+import { consola as consola31 } from "consola";
 var shellCommand;
 var init_shell2 = __esm({
   "src/commands/shell.ts"() {
     "use strict";
     init_paths();
     init_shell();
-    shellCommand = defineCommand25({
+    shellCommand = defineCommand26({
       meta: {
         name: "shell",
         group: "run",
@@ -8717,7 +8992,7 @@ var init_shell2 = __esm({
           const exitCode = await runShell({ root: containerDir(args.name) });
           process.exit(exitCode);
         } catch (err) {
-          consola29.error(err instanceof Error ? err.message : String(err));
+          consola31.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8726,8 +9001,8 @@ var init_shell2 = __esm({
 });
 
 // src/commands/start.ts
-import { defineCommand as defineCommand26 } from "citty";
-import { consola as consola30 } from "consola";
+import { defineCommand as defineCommand27 } from "citty";
+import { consola as consola32 } from "consola";
 var startCommand;
 var init_start = __esm({
   "src/commands/start.ts"() {
@@ -8739,7 +9014,7 @@ var init_start = __esm({
     init_proxy();
     init_port_check();
     init_dispatch();
-    startCommand = defineCommand26({
+    startCommand = defineCommand27({
       meta: {
         name: "start",
         group: "run",
@@ -8764,7 +9039,7 @@ var init_start = __esm({
               hostPort = proxyHostPort(global);
             }
           } catch (err) {
-            consola30.warn(
+            consola32.warn(
               `Could not read container yml ahead of start: ${err instanceof Error ? err.message : String(err)}. Skipping Traefik pre-flight.`
             );
           }
@@ -8780,7 +9055,7 @@ var init_start = __esm({
 });
 
 // src/commands/status.ts
-import { defineCommand as defineCommand27 } from "citty";
+import { defineCommand as defineCommand28 } from "citty";
 var statusCommand;
 var init_status = __esm({
   "src/commands/status.ts"() {
@@ -8788,7 +9063,7 @@ var init_status = __esm({
     init_paths();
     init_compose();
     init_dispatch();
-    statusCommand = defineCommand27({
+    statusCommand = defineCommand28({
       meta: {
         name: "status",
         group: "run",
@@ -8818,8 +9093,8 @@ var init_status = __esm({
 });
 
 // src/commands/stop.ts
-import { defineCommand as defineCommand28 } from "citty";
-import { consola as consola31 } from "consola";
+import { defineCommand as defineCommand29 } from "citty";
+import { consola as consola33 } from "consola";
 var stopCommand;
 var init_stop = __esm({
   "src/commands/stop.ts"() {
@@ -8828,7 +9103,7 @@ var init_stop = __esm({
     init_compose();
     init_proxy();
     init_dispatch();
-    stopCommand = defineCommand28({
+    stopCommand = defineCommand29({
       meta: {
         name: "stop",
         group: "run",
@@ -8853,10 +9128,10 @@ var init_stop = __esm({
           });
           try {
             await maybeStopProxy({
-              logger: { info: (msg) => consola31.info(msg) }
+              logger: { info: (msg) => consola33.info(msg) }
             });
           } catch (err) {
-            consola31.warn(
+            consola33.warn(
               `Could not tear down the Traefik proxy: ${err instanceof Error ? err.message : String(err)}. Ignored.`
             );
           }
@@ -8868,11 +9143,11 @@ var init_stop = __esm({
 });
 
 // src/tunnel/resolve.ts
-import { existsSync as existsSync13 } from "fs";
-import path21 from "path";
+import { existsSync as existsSync14 } from "fs";
+import path22 from "path";
 async function resolveTunnelTarget(opts) {
   const ymlPath = containerConfigPath(opts.name, opts.monocerosHome);
-  if (!existsSync13(ymlPath)) {
+  if (!existsSync14(ymlPath)) {
     throw new Error(
       `No yml profile for '${opts.name}' at ${ymlPath}. Run \`monoceros init ${opts.name}\` first.`
     );
@@ -8880,13 +9155,13 @@ async function resolveTunnelTarget(opts) {
   const parsed = await readConfig(ymlPath);
   const config = parsed.config;
   const containerRoot = containerDir(opts.name, opts.monocerosHome);
-  if (!existsSync13(containerRoot)) {
+  if (!existsSync14(containerRoot)) {
     throw new Error(
       `Container '${opts.name}' is not materialised at ${containerRoot}. Run \`monoceros apply ${opts.name}\` first.`
     );
   }
-  const composePath = path21.join(containerRoot, ".devcontainer", "compose.yaml");
-  const isCompose = existsSync13(composePath);
+  const composePath = path22.join(containerRoot, ".devcontainer", "compose.yaml");
+  const isCompose = existsSync14(composePath);
   const parsedTarget = parseTargetArg(opts.target, config);
   const docker = opts.docker ?? defaultDockerExec;
   if (isCompose) {
@@ -9121,8 +9396,8 @@ var init_port_check2 = __esm({
 });
 
 // src/tunnel/run.ts
-import { spawn as spawn8 } from "child_process";
-import { consola as consola32 } from "consola";
+import { spawn as spawn9 } from "child_process";
+import { consola as consola34 } from "consola";
 function signalNumber(signal) {
   switch (signal) {
     case "SIGINT":
@@ -9135,8 +9410,8 @@ function signalNumber(signal) {
 }
 async function runTunnel(opts) {
   const log = opts.logger ?? {
-    info: (m) => consola32.info(m),
-    warn: (m) => consola32.warn(m)
+    info: (m) => consola34.info(m),
+    warn: (m) => consola34.warn(m)
   };
   const resolve = opts.resolve ?? resolveTunnelTarget;
   const resolveArgs3 = {
@@ -9211,7 +9486,7 @@ var init_run3 = __esm({
     init_port_check2();
     SOCAT_IMAGE = "alpine/socat:1.8.0.3";
     defaultDockerSpawn = (args) => {
-      const child = spawn8("docker", args, {
+      const child = spawn9("docker", args, {
         stdio: "inherit"
       });
       const exited = new Promise((resolve, reject) => {
@@ -9242,8 +9517,8 @@ var init_run3 = __esm({
 });
 
 // src/commands/tunnel.ts
-import { defineCommand as defineCommand29 } from "citty";
-import { consola as consola33 } from "consola";
+import { defineCommand as defineCommand30 } from "citty";
+import { consola as consola35 } from "consola";
 function parseLocalPort(raw) {
   if (raw === void 0) return void 0;
   const n = Number(raw);
@@ -9259,7 +9534,7 @@ var init_tunnel = __esm({
   "src/commands/tunnel.ts"() {
     "use strict";
     init_run3();
-    tunnelCommand = defineCommand29({
+    tunnelCommand = defineCommand30({
       meta: {
         name: "tunnel",
         group: "discovery",
@@ -9296,7 +9571,7 @@ var init_tunnel = __esm({
           });
           process.exit(exitCode);
         } catch (err) {
-          consola33.error(err instanceof Error ? err.message : String(err));
+          consola35.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9305,8 +9580,8 @@ var init_tunnel = __esm({
 });
 
 // src/upgrade/index.ts
-import { existsSync as existsSync14, promises as fs17 } from "fs";
-import { consola as consola34 } from "consola";
+import { existsSync as existsSync15, promises as fs17 } from "fs";
+import { consola as consola36 } from "consola";
 async function fetchRuntimeVersions() {
   const tokenUrl = `https://ghcr.io/token?service=ghcr.io&scope=repository:${RUNTIME_REPO}:pull`;
   const tokenRes = await fetch(tokenUrl);
@@ -9344,7 +9619,7 @@ ${yml}`;
 }
 async function runUpgrade(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
-  const logger = opts.logger ?? consola34;
+  const logger = opts.logger ?? consola36;
   const fetchVersions = opts.fetchVersions ?? fetchRuntimeVersions;
   if (opts.list) {
     const versions = await fetchVersions();
@@ -9364,7 +9639,7 @@ async function runUpgrade(opts) {
     );
   }
   const ymlPath = containerConfigPath(opts.name, home);
-  if (!existsSync14(ymlPath)) {
+  if (!existsSync15(ymlPath)) {
     throw new Error(
       `No such config: ${ymlPath}. Run \`monoceros init <template> ${opts.name}\` first.`
     );
@@ -9412,7 +9687,7 @@ var init_upgrade = __esm({
 });
 
 // src/commands/upgrade.ts
-import { defineCommand as defineCommand30 } from "citty";
+import { defineCommand as defineCommand31 } from "citty";
 var upgradeCommand;
 var init_upgrade2 = __esm({
   "src/commands/upgrade.ts"() {
@@ -9420,7 +9695,7 @@ var init_upgrade2 = __esm({
     init_upgrade();
     init_version();
     init_dispatch();
-    upgradeCommand = defineCommand30({
+    upgradeCommand = defineCommand31({
       meta: {
         name: "upgrade",
         group: "lifecycle",
@@ -9462,7 +9737,7 @@ var main_exports = {};
 __export(main_exports, {
   main: () => main
 });
-import { defineCommand as defineCommand31 } from "citty";
+import { defineCommand as defineCommand32 } from "citty";
 var main;
 var init_main = __esm({
   "src/main.ts"() {
@@ -9479,6 +9754,7 @@ var init_main = __esm({
     init_complete();
     init_init2();
     init_list_components();
+    init_login2();
     init_logs();
     init_port();
     init_remove_apt_packages();
@@ -9498,7 +9774,7 @@ var init_main = __esm({
     init_tunnel();
     init_upgrade2();
     init_version();
-    main = defineCommand31({
+    main = defineCommand32({
       meta: {
         name: "monoceros",
         version: CLI_VERSION,
@@ -9509,6 +9785,7 @@ var init_main = __esm({
         "list-components": listComponentsCommand,
         shell: shellCommand,
         run: runCommand,
+        login: loginCommand,
         logs: logsCommand,
         start: startCommand,
         stop: stopCommand,
@@ -9794,25 +10071,25 @@ function detectHelpRequest(argv, main2) {
   const separatorIdx = argv.indexOf("--");
   if (helpIdx === -1) return null;
   if (separatorIdx !== -1 && separatorIdx < helpIdx) return null;
-  const path22 = [];
+  const path23 = [];
   const tokens = argv.slice(
     0,
     separatorIdx === -1 ? argv.length : separatorIdx
   );
   let cursor = main2;
   const mainName = (main2.meta ?? {}).name ?? "monoceros";
-  path22.push(mainName);
+  path23.push(mainName);
   for (const tok of tokens) {
     if (tok.startsWith("-")) continue;
     const subs = cursor.subCommands ?? {};
     if (tok in subs) {
       cursor = subs[tok];
-      path22.push(tok);
+      path23.push(tok);
       continue;
     }
     break;
   }
-  return { path: path22, cmd: cursor };
+  return { path: path23, cmd: cursor };
 }
 async function maybeRenderHelp(argv, main2) {
   const hit = detectHelpRequest(argv, main2);