@getmonoceros/workbench 1.26.5 → 1.27.0

package/dist/bin.js

@@ -2146,9 +2146,9 @@ function compareRuntimeVersions(a, b) {
   }
   return 0;
 }
-function runtimeSupportsIdeVolumes(version) {
+function runtimeSupportsSshAttach(version) {
   if (!version) return false;
-  return compareRuntimeVersions(version, MIN_RUNTIME_FOR_IDE_VOLUMES) >= 0;
+  return compareRuntimeVersions(version, MIN_RUNTIME_FOR_SSH_ATTACH) >= 0;
 }
 function descriptorOptionDefaults(options) {
   const out = {};
@@ -2269,7 +2269,7 @@ function deriveServiceName(image) {
   const noTag = lastSegment.split("@")[0].split(":")[0];
   return noTag.toLowerCase().replace(/[^a-z0-9_-]/g, "-");
 }
-var DEFAULT_BASE_IMAGE, override, BASE_IMAGE, RUNTIME_IMAGE_REPO, DEFAULT_RUNTIME_VERSION, MIN_RUNTIME_FOR_IDE_VOLUMES, DESCRIPTORS, BUILTIN_LANGUAGES, LANGUAGE_CATALOG, LANGUAGE_SPEC_RE, SERVICE_CATALOG;
+var DEFAULT_BASE_IMAGE, override, BASE_IMAGE, RUNTIME_IMAGE_REPO, DEFAULT_RUNTIME_VERSION, MIN_RUNTIME_FOR_SSH_ATTACH, DESCRIPTORS, BUILTIN_LANGUAGES, LANGUAGE_CATALOG, LANGUAGE_SPEC_RE, SERVICE_CATALOG;
 var init_catalog = __esm({
   "src/create/catalog.ts"() {
     "use strict";
@@ -2278,13 +2278,13 @@ var init_catalog = __esm({
     override = process.env.MONOCEROS_BASE_IMAGE_OVERRIDE?.trim();
     BASE_IMAGE = override && override.length > 0 ? override : DEFAULT_BASE_IMAGE;
     RUNTIME_IMAGE_REPO = "ghcr.io/getmonoceros/monoceros-runtime";
-    DEFAULT_RUNTIME_VERSION = true ? "1.1.0" : readFileSync3(
+    DEFAULT_RUNTIME_VERSION = true ? "1.2.0" : readFileSync3(
       fileURLToPath2(
         new URL("../../../../images/runtime/VERSION", import.meta.url)
       ),
       "utf8"
     ).trim();
-    MIN_RUNTIME_FOR_IDE_VOLUMES = "1.1.0";
+    MIN_RUNTIME_FOR_SSH_ATTACH = "1.2.0";
     DESCRIPTORS = loadDescriptorCatalogSync();
     BUILTIN_LANGUAGES = new Set(
       [...DESCRIPTORS.values()].filter((c) => c.category === "language" && c.descriptor.language?.builtin).map(descriptorSelector)
@@ -2947,14 +2947,32 @@ function ideStateVolumes(name) {
   return [
     {
       volume: `monoceros-${name}-vscode-extensions`,
-      target: "/home/node/.vscode-server/extensions"
+      target: "/home/node/.vscode-server/extensions",
+      minRuntime: "1.1.0"
     },
     {
       volume: `monoceros-${name}-vscode-userdata`,
-      target: "/home/node/.vscode-server/data/User"
+      target: "/home/node/.vscode-server/data/User",
+      minRuntime: "1.1.0"
+    },
+    {
+      volume: `monoceros-${name}-vscodium-extensions`,
+      target: "/home/node/.vscodium-server/extensions",
+      minRuntime: "1.2.0"
+    },
+    {
+      volume: `monoceros-${name}-vscodium-userdata`,
+      target: "/home/node/.vscodium-server/data/User",
+      minRuntime: "1.2.0"
     }
   ];
 }
+function ideStateVolumesForRuntime(name, version) {
+  if (!version) return [];
+  return ideStateVolumes(name).filter(
+    (v) => compareRuntimeVersions(version, v.minRuntime) >= 0
+  );
+}
 function buildDevcontainerJson(opts, dockerMode = "rootful") {
   const resolvedFeatures = resolveFeatures(opts);
   const features = {};
@@ -2986,6 +3004,7 @@ function buildDevcontainerJson(opts, dockerMode = "rootful") {
       }
     }
   } : void 0;
+  const sshPostStart = runtimeSupportsSshAttach(opts.runtimeVersion) ? { postStartCommand: "sudo /usr/local/bin/monoceros-sshd-up.sh" } : {};
   if (needsCompose(opts)) {
     return {
       name: opts.name,
@@ -2996,20 +3015,22 @@ function buildDevcontainerJson(opts, dockerMode = "rootful") {
       remoteUser: "node",
       forwardPorts: ports,
       postCreateCommand: ".devcontainer/post-create.sh",
+      ...sshPostStart,
       ...featuresField ?? {},
       ...customizationsField ?? {}
     };
   }
-  const ideMounts = runtimeSupportsIdeVolumes(opts.runtimeVersion) ? ideStateVolumes(opts.name).map(
-    (v) => `source=${v.volume},target=${v.target},type=volume`
-  ) : [];
+  const ideMounts = ideStateVolumesForRuntime(
+    opts.name,
+    opts.runtimeVersion
+  ).map((v) => `source=${v.volume},target=${v.target},type=volume`);
   const mounts = [...homeMounts, ...ideMounts];
   const mountsField = mounts.length > 0 ? { mounts } : {};
   const workspaceMountField = {
     workspaceMount: `source=\${localWorkspaceFolder},target=/workspaces/${opts.name},type=bind,consistency=cached`,
     workspaceFolder: `/workspaces/${opts.name}`
   };
-  const runArgs = ["--cap-add=NET_ADMIN"];
+  const runArgs = ["--cap-add=NET_ADMIN", `--name=monoceros-${opts.name}`];
   if (ports.length > 0) {
     runArgs.push("--network=monoceros-proxy");
     runArgs.push(`--network-alias=${opts.name}`);
@@ -3023,6 +3044,7 @@ function buildDevcontainerJson(opts, dockerMode = "rootful") {
     runArgs,
     forwardPorts: ports,
     postCreateCommand: ".devcontainer/post-create.sh",
+    ...sshPostStart,
     ...featuresField ?? {},
     ...customizationsField ?? {}
   };
@@ -3043,9 +3065,10 @@ function buildComposeYaml(opts, dockerMode = "rootful") {
   void dockerMode;
   const hasPorts = (opts.ports?.length ?? 0) > 0;
   const lines = ["services:"];
-  const ideVolumes = runtimeSupportsIdeVolumes(opts.runtimeVersion) ? ideStateVolumes(opts.name) : [];
+  const ideVolumes = ideStateVolumesForRuntime(opts.name, opts.runtimeVersion);
   lines.push("  workspace:");
   lines.push(`    image: ${resolveRuntimeImage(opts.runtimeVersion)}`);
+  lines.push(`    container_name: monoceros-${opts.name}`);
   lines.push("    command: 'sleep infinity'");
   lines.push("    cap_add:");
   lines.push("      - NET_ADMIN");
@@ -3917,8 +3940,8 @@ function removeRepoFromDoc(doc, urlOrPath) {
     if (!isMap2(item)) return false;
     const url = item.get("url");
     if (url === urlOrPath) return true;
-    const path28 = item.get("path");
-    const effectivePath = typeof path28 === "string" ? path28 : typeof url === "string" ? deriveRepoName(url) : void 0;
+    const path30 = item.get("path");
+    const effectivePath = typeof path30 === "string" ? path30 : typeof url === "string" ? deriveRepoName(url) : void 0;
     return effectivePath === urlOrPath;
   });
   if (idx < 0) return false;
@@ -4040,7 +4063,7 @@ async function runAddRepo(input) {
       "Missing repo URL. Usage: monoceros add-repo <containername> <url>."
     );
   }
-  const path28 = (input.path ?? deriveRepoName(url)).trim();
+  const path30 = (input.path ?? deriveRepoName(url)).trim();
   const hasName = typeof input.gitName === "string" && input.gitName.trim().length > 0;
   const hasEmail = typeof input.gitEmail === "string" && input.gitEmail.trim().length > 0;
   if (hasName !== hasEmail) {
@@ -4077,7 +4100,7 @@ async function runAddRepo(input) {
   const providerToWrite = !canonical && explicitProvider ? explicitProvider : void 0;
   const entry2 = {
     url,
-    path: path28,
+    path: path30,
     ...hasName && hasEmail ? {
       gitUser: {
         name: input.gitName.trim(),
@@ -5120,9 +5143,163 @@ var init_transform = __esm({
   }
 });
 
+// src/devcontainer/ssh-attach.ts
+import { spawn as spawn4 } from "child_process";
+import { promises as fs10 } from "fs";
+import { existsSync as existsSync8 } from "fs";
+import os2 from "os";
+import path13 from "path";
+function sshHomeDir(home) {
+  return path13.join(home, "ssh");
+}
+function sshConfigEntryPath(home, name) {
+  return path13.join(sshHomeDir(home), "config.d", name);
+}
+function sshProxyScriptPath(home, name) {
+  return path13.join(sshHomeDir(home), `exec-${name}.sh`);
+}
+function privateKeyPath(targetDir) {
+  return path13.join(targetDir, ".monoceros", "ssh", "id_ed25519");
+}
+async function ensureKeypair(targetDir, name, keygen, logger) {
+  const privateKey = privateKeyPath(targetDir);
+  const publicKey = `${privateKey}.pub`;
+  if (existsSync8(privateKey) && existsSync8(publicKey)) {
+    return { privateKey, publicKey };
+  }
+  await fs10.mkdir(path13.dirname(privateKey), { recursive: true });
+  try {
+    const res = await keygen([
+      "-t",
+      "ed25519",
+      "-N",
+      "",
+      "-f",
+      privateKey,
+      "-C",
+      `monoceros-${name}`,
+      "-q"
+    ]);
+    if (res.exitCode !== 0) {
+      logger.warn(
+        `ssh-keygen failed (exit ${res.exitCode})${res.stderr ? `: ${res.stderr.trim()}` : ""}; IDE SSH attach not set up.`
+      );
+      return null;
+    }
+  } catch (err) {
+    logger.warn(
+      `ssh-keygen not runnable (${err instanceof Error ? err.message : String(err)}); IDE SSH attach not set up.`
+    );
+    return null;
+  }
+  return { privateKey, publicKey };
+}
+function proxyScriptContent(name, targetDir) {
+  return `#!/bin/sh
+# Generated by Monoceros (ADR 0022) - do not edit.
+# Portless SSH transport into the running dev container '${name}'.
+# Resolves the container by the devcontainer.local_folder label (the
+# same handle 'monoceros shell' uses), so it follows rebuilds.
+set -e
+cid=$(docker ps -q \\
+  --filter "label=devcontainer.local_folder=${targetDir}" \\
+  --filter status=running | head -n1)
+if [ -z "$cid" ]; then
+  echo "monoceros: dev container '${name}' is not running. Start it with: monoceros apply ${name}" >&2
+  exit 1
+fi
+exec docker exec -i "$cid" socat - TCP:127.0.0.1:22
+`;
+}
+function configEntryContent(name, hostAlias, privateKey, proxyScript) {
+  return `# Generated by Monoceros (ADR 0022) - do not edit.
+# Attach an SSH-capable IDE (Codium, IntelliJ, Zed) to host
+# '${hostAlias}', or run: ssh ${hostAlias}
+Host ${hostAlias}
+    User node
+    IdentityFile "${privateKey}"
+    IdentitiesOnly yes
+    StrictHostKeyChecking no
+    UserKnownHostsFile /dev/null
+    ProxyCommand "${proxyScript}"
+`;
+}
+async function ensureInclude(userSshDir, home) {
+  const configPath = path13.join(userSshDir, "config");
+  const includeTarget = path13.join(sshHomeDir(home), "config.d", "*");
+  const includeLine = `Include "${includeTarget}"`;
+  await fs10.mkdir(userSshDir, { recursive: true });
+  let existing = "";
+  try {
+    existing = await fs10.readFile(configPath, "utf8");
+  } catch {
+    existing = "";
+  }
+  if (existing.includes(includeTarget)) return;
+  const banner = "# Added by Monoceros (ADR 0022): per-container SSH attach entries.";
+  const prefix = `${banner}
+${includeLine}
+`;
+  const next = existing.length > 0 ? `${prefix}
+${existing}` : prefix;
+  await fs10.writeFile(configPath, next, { mode: 384 });
+  await fs10.chmod(configPath, 384).catch(() => {
+  });
+}
+async function setupSshAttach(opts) {
+  const hostAlias = `monoceros-${opts.name}`;
+  const logger = opts.logger ?? { info: () => {
+  }, warn: () => {
+  } };
+  const keygen = opts.keygen ?? realKeygen;
+  const userSshDir = opts.userSshDir ?? path13.join(os2.homedir(), ".ssh");
+  const keys = await ensureKeypair(opts.targetDir, opts.name, keygen, logger);
+  if (!keys) return { hostAlias, configured: false };
+  const proxyScript = sshProxyScriptPath(opts.home, opts.name);
+  const configEntry = sshConfigEntryPath(opts.home, opts.name);
+  await fs10.mkdir(path13.dirname(proxyScript), { recursive: true });
+  await fs10.mkdir(path13.dirname(configEntry), { recursive: true });
+  await fs10.writeFile(
+    proxyScript,
+    proxyScriptContent(opts.name, opts.targetDir),
+    { mode: 493 }
+  );
+  await fs10.chmod(proxyScript, 493).catch(() => {
+  });
+  await fs10.writeFile(
+    configEntry,
+    configEntryContent(opts.name, hostAlias, keys.privateKey, proxyScript)
+  );
+  await ensureInclude(userSshDir, opts.home);
+  return { hostAlias, configured: true };
+}
+async function removeSshAttach(home, name) {
+  await fs10.rm(sshProxyScriptPath(home, name), { force: true });
+  await fs10.rm(sshConfigEntryPath(home, name), { force: true });
+}
+var realKeygen;
+var init_ssh_attach = __esm({
+  "src/devcontainer/ssh-attach.ts"() {
+    "use strict";
+    realKeygen = (args) => {
+      return new Promise((resolve, reject) => {
+        const child = spawn4("ssh-keygen", args, {
+          stdio: ["ignore", "ignore", "pipe"]
+        });
+        let stderr = "";
+        child.stderr.on("data", (chunk) => {
+          stderr += chunk.toString();
+        });
+        child.on("error", reject);
+        child.on("exit", (code) => resolve({ exitCode: code ?? 0, stderr }));
+      });
+    };
+  }
+});
+
 // src/apply/apply-log.ts
 import { createWriteStream, mkdirSync } from "fs";
-import path13 from "path";
+import path14 from "path";
 import { Writable } from "stream";
 function safeIsoStamp(d) {
   return d.toISOString().replace(/[:.]/g, "-");
@@ -5132,7 +5309,7 @@ function createApplyLog(opts) {
   const dir = containerLogsDir(opts.name, opts.home);
   mkdirSync(dir, { recursive: true });
   const file = `apply-${opts.name}-${safeIsoStamp(now)}.log`;
-  const fullPath = path13.join(dir, file);
+  const fullPath = path14.join(dir, file);
   const stream = createWriteStream(fullPath, { flags: "w" });
   const header = [
     `# monoceros apply log`,
@@ -5999,8 +6176,8 @@ var init_markers = __esm({
 });
 
 // src/briefing/index.ts
-import { promises as fs10 } from "fs";
-import path14 from "path";
+import { promises as fs11 } from "fs";
+import path15 from "path";
 async function writeBriefing(input) {
   const subCommands = input.subCommands ?? await loadSubCommandsDynamic();
   const manifestLoader = input.manifestLoader ?? ((ref) => loadFeatureManifestSummary(ref));
@@ -6013,12 +6190,12 @@ async function writeBriefing(input) {
   );
   const claudeBody = generateClaudeMd();
   const commandsBody = generateCommandsMd(subCommands);
-  await writeMarkerAware(path14.join(input.targetDir, "AGENTS.md"), agentsBody);
-  await writeMarkerAware(path14.join(input.targetDir, "CLAUDE.md"), claudeBody);
-  const monocerosDir = path14.join(input.targetDir, ".monoceros");
-  await fs10.mkdir(monocerosDir, { recursive: true });
-  await fs10.writeFile(
-    path14.join(monocerosDir, "commands.md"),
+  await writeMarkerAware(path15.join(input.targetDir, "AGENTS.md"), agentsBody);
+  await writeMarkerAware(path15.join(input.targetDir, "CLAUDE.md"), claudeBody);
+  const monocerosDir = path15.join(input.targetDir, ".monoceros");
+  await fs11.mkdir(monocerosDir, { recursive: true });
+  await fs11.writeFile(
+    path15.join(monocerosDir, "commands.md"),
     commandsBody,
     "utf8"
   );
@@ -6038,18 +6215,18 @@ function featureDisplayMap(components) {
 async function writeMarkerAware(filePath, body) {
   let existing = null;
   try {
-    existing = await fs10.readFile(filePath, "utf8");
+    existing = await fs11.readFile(filePath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
   if (existing) {
     const updated = replaceMarkerBlock(existing, body);
     if (updated !== null) {
-      await fs10.writeFile(filePath, updated, "utf8");
+      await fs11.writeFile(filePath, updated, "utf8");
       return;
     }
   }
-  await fs10.writeFile(filePath, wrapWithMarkers(body), "utf8");
+  await fs11.writeFile(filePath, wrapWithMarkers(body), "utf8");
 }
 async function loadSubCommandsDynamic() {
   const mod = await Promise.resolve().then(() => (init_main(), main_exports));
@@ -6174,10 +6351,10 @@ var init_runtime_pull_hint = __esm({
 });
 
 // src/devcontainer/cli.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { readFileSync as readFileSync4 } from "fs";
 import { createRequire } from "module";
-import path15 from "path";
+import path16 from "path";
 function devcontainerCliPath() {
   if (cachedBinaryPath) return cachedBinaryPath;
   const pkgJsonPath = require_.resolve("@devcontainers/cli/package.json");
@@ -6186,7 +6363,7 @@ function devcontainerCliPath() {
   if (!binEntry) {
     throw new Error("Could not resolve @devcontainers/cli bin entry.");
   }
-  cachedBinaryPath = path15.resolve(path15.dirname(pkgJsonPath), binEntry);
+  cachedBinaryPath = path16.resolve(path16.dirname(pkgJsonPath), binEntry);
   return cachedBinaryPath;
 }
 var require_, cachedBinaryPath, spawnDevcontainer;
@@ -6202,7 +6379,7 @@ var init_cli = __esm({
       const env = { ...process.env, DOCKER_CLI_HINTS: "false" };
       return new Promise((resolve, reject) => {
         if (options.interactive) {
-          const child2 = spawn4(process.execPath, [binPath, ...args], {
+          const child2 = spawn5(process.execPath, [binPath, ...args], {
             cwd,
             env,
             stdio: "inherit"
@@ -6211,7 +6388,7 @@ var init_cli = __esm({
           child2.on("exit", (code) => resolve(code ?? 0));
           return;
         }
-        const child = spawn4(process.execPath, [binPath, ...args], {
+        const child = spawn5(process.execPath, [binPath, ...args], {
           cwd,
           env,
           stdio: ["ignore", "pipe", "pipe"]
@@ -6259,9 +6436,9 @@ var init_cli = __esm({
 });
 
 // src/devcontainer/compose.ts
-import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync8 } from "fs";
-import path16 from "path";
+import { spawn as spawn6 } from "child_process";
+import { existsSync as existsSync9 } from "fs";
+import path17 from "path";
 import { Writable as Writable3 } from "stream";
 import { consola as consola10 } from "consola";
 async function findContainerIds(filters, exec = spawnDocker) {
@@ -6311,18 +6488,24 @@ async function cleanupDockerObjects(opts) {
   return { exitCode: rmExit, removedIds: ids };
 }
 function composeProjectName(root) {
-  return `${path16.basename(root)}_devcontainer`;
+  return `${path17.basename(root)}_devcontainer`;
 }
-function resolveCompose(root) {
-  if (!existsSync8(path16.join(root, ".devcontainer"))) {
+function assertDevcontainer(root) {
+  if (!existsSync9(path17.join(root, ".devcontainer"))) {
     throw new Error(
       `No .devcontainer/ at ${root}. Run \`monoceros apply <name>\` first.`
     );
   }
-  const composeFile = path16.join(root, ".devcontainer", "compose.yaml");
-  if (!existsSync8(composeFile)) {
+}
+function isComposeMode(root) {
+  return existsSync9(path17.join(root, ".devcontainer", "compose.yaml"));
+}
+function resolveCompose(root) {
+  assertDevcontainer(root);
+  const composeFile = path17.join(root, ".devcontainer", "compose.yaml");
+  if (!existsSync9(composeFile)) {
     throw new Error(
-      `No compose.yaml at ${composeFile}. \`start\` / \`stop\` / \`status\` / \`logs\` require services configured via \`monoceros add-service <name> <svc>\`. Use \`monoceros shell <name>\` to enter the container directly.`
+      `No compose.yaml at ${composeFile}. \`monoceros logs\` tails compose service logs, which require services configured via \`monoceros add-service <name> <svc>\`. For a bare container, use \`monoceros shell <name>\` or read logs/<app>.log.`
     );
   }
   return { composeFile, projectName: composeProjectName(root) };
@@ -6334,7 +6517,7 @@ async function runComposeAction(buildSubArgs, opts) {
   return spawnFn(["-f", composeFile, "-p", projectName, ...subArgs], opts.root);
 }
 async function runStart(opts) {
-  resolveCompose(opts.root);
+  assertDevcontainer(opts.root);
   const logger = opts.logger ?? { info: (msg) => consola10.info(msg) };
   const spawnFn = opts.spawn ?? spawnDevcontainer;
   logger.info(`Bringing devcontainer up at ${opts.root}\u2026`);
@@ -6477,16 +6660,71 @@ and retry \`monoceros apply\`.`
   );
 }
 function runStop(opts) {
-  return runComposeAction(
-    (service) => ["stop", ...service ? [service] : []],
-    opts
-  );
+  assertDevcontainer(opts.root);
+  if (isComposeMode(opts.root)) {
+    return runComposeAction(
+      (service) => ["stop", ...service ? [service] : []],
+      opts
+    );
+  }
+  return stopImageContainer(opts);
 }
 function runStatus(opts) {
-  return runComposeAction(
-    (service) => ["ps", ...service ? [service] : []],
-    opts
+  assertDevcontainer(opts.root);
+  if (isComposeMode(opts.root)) {
+    return runComposeAction(
+      (service) => ["ps", ...service ? [service] : []],
+      opts
+    );
+  }
+  return statusImageContainer(opts);
+}
+function imageContainerFilter(root) {
+  return `label=devcontainer.local_folder=${root}`;
+}
+async function stopImageContainer(opts) {
+  const exec = opts.dockerExec ?? spawnDocker;
+  const logger = opts.logger ?? { info: (msg) => consola10.info(msg) };
+  const name = path17.basename(opts.root);
+  const ps = await exec([
+    "ps",
+    "-q",
+    "--filter",
+    imageContainerFilter(opts.root),
+    "--filter",
+    "status=running"
+  ]);
+  const id = ps.stdout.split("\n").map((s) => s.trim()).find((s) => s.length > 0);
+  if (!id) {
+    logger.info(`Container '${name}' is not running.`);
+    return 0;
+  }
+  const res = await exec(["stop", id]);
+  if (res.exitCode === 0) logger.info(`Stopped '${name}'.`);
+  return res.exitCode;
+}
+async function statusImageContainer(opts) {
+  const exec = opts.dockerExec ?? spawnDocker;
+  const logger = opts.logger ?? { info: (msg) => consola10.info(msg) };
+  const name = path17.basename(opts.root);
+  const res = await exec([
+    "ps",
+    "-a",
+    "--filter",
+    imageContainerFilter(opts.root)
+  ]);
+  const rows = res.stdout.split("\n").filter((l) => l.trim().length > 0);
+  if (rows.length <= 1) {
+    logger.info(
+      `Container '${name}' does not exist. Run \`monoceros apply ${name}\`.`
+    );
+    return 0;
+  }
+  process.stdout.write(
+    res.stdout.endsWith("\n") ? res.stdout : `${res.stdout}
+`
   );
+  return res.exitCode;
 }
 function runLogs(opts) {
   const follow = opts.follow ?? true;
@@ -6509,7 +6747,7 @@ var init_compose = __esm({
     init_proxy();
     spawnDockerCompose = (args, cwd) => {
       return new Promise((resolve, reject) => {
-        const child = spawn5("docker", ["compose", ...args], {
+        const child = spawn6("docker", ["compose", ...args], {
           cwd,
           stdio: ["inherit", "pipe", "pipe"]
         });
@@ -6521,7 +6759,7 @@ var init_compose = __esm({
     };
     spawnDocker = (args) => {
       return new Promise((resolve, reject) => {
-        const child = spawn5("docker", args, {
+        const child = spawn6("docker", args, {
           stdio: ["ignore", "pipe", "pipe"]
         });
         let stdout = "";
@@ -6582,9 +6820,9 @@ var init_images = __esm({
 
 // src/config/machine-state.ts
 import { promises as fsp4 } from "fs";
-import path17 from "path";
+import path18 from "path";
 function machineStatePath(home = monocerosHome()) {
-  return path17.join(home, ".machine-state.json");
+  return path18.join(home, ".machine-state.json");
 }
 async function readMachineState(home = monocerosHome()) {
   try {
@@ -6639,7 +6877,7 @@ var init_machine_state = __esm({
 });
 
 // src/devcontainer/docker-mode.ts
-import { spawn as spawn6 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 async function detectDockerMode(options = {}) {
   const spawnFn = options.spawn ?? realDockerInfo;
   try {
@@ -6689,7 +6927,7 @@ var init_docker_mode = __esm({
     init_format();
     realDockerInfo = () => {
       return new Promise((resolve, reject) => {
-        const child = spawn6(
+        const child = spawn7(
           "docker",
           ["info", "--format", "{{json .SecurityOptions}}"],
           {
@@ -6708,9 +6946,9 @@ var init_docker_mode = __esm({
 });
 
 // src/devcontainer/identity.ts
-import { spawn as spawn7 } from "child_process";
-import { promises as fs11 } from "fs";
-import path18 from "path";
+import { spawn as spawn8 } from "child_process";
+import { promises as fs12 } from "fs";
+import path19 from "path";
 import { consola as consola11 } from "consola";
 async function resolveIdentityWithPrompt(options = {}) {
   const spawnFn = options.spawn ?? realGitConfigGet;
@@ -6766,8 +7004,8 @@ async function resolveIdentityWithPrompt(options = {}) {
   };
 }
 async function collectGitIdentity(devContainerRoot, options = {}) {
-  const gitconfigDir = path18.join(devContainerRoot, ".monoceros");
-  const gitconfigPath = path18.join(gitconfigDir, "gitconfig");
+  const gitconfigDir = path19.join(devContainerRoot, ".monoceros");
+  const gitconfigPath = path19.join(gitconfigDir, "gitconfig");
   const logger = options.logger ?? { info: () => {
   }, warn: () => {
   } };
@@ -6780,8 +7018,8 @@ async function collectGitIdentity(devContainerRoot, options = {}) {
   const lines = ["[user]"];
   if (resolved.name !== void 0) lines.push(`	name = ${resolved.name}`);
   if (resolved.email !== void 0) lines.push(`	email = ${resolved.email}`);
-  await fs11.mkdir(gitconfigDir, { recursive: true });
-  await fs11.writeFile(gitconfigPath, lines.join("\n") + "\n");
+  await fs12.mkdir(gitconfigDir, { recursive: true });
+  await fs12.writeFile(gitconfigPath, lines.join("\n") + "\n");
   return {
     ...resolved.name !== void 0 ? { name: resolved.name } : {},
     ...resolved.email !== void 0 ? { email: resolved.email } : {},
@@ -6824,7 +7062,7 @@ async function readKeyFromHost(spawnFn, key, logger) {
 }
 async function readExistingGitconfig(filePath) {
   try {
-    const content = await fs11.readFile(filePath, "utf8");
+    const content = await fs12.readFile(filePath, "utf8");
     const result = {};
     const nameMatch = /^\s*name\s*=\s*(.+?)\s*$/m.exec(content);
     const emailMatch = /^\s*email\s*=\s*(.+?)\s*$/m.exec(content);
@@ -6841,7 +7079,7 @@ var init_identity = __esm({
     "use strict";
     realGitConfigGet = (key) => {
       return new Promise((resolve, reject) => {
-        const child = spawn7("git", ["config", "--global", "--get", key], {
+        const child = spawn8("git", ["config", "--global", "--get", key], {
           stdio: ["ignore", "pipe", "inherit"]
         });
         let stdout = "";
@@ -6901,7 +7139,7 @@ var init_identity = __esm({
 });
 
 // src/apply/index.ts
-import { existsSync as existsSync9, promises as fs12 } from "fs";
+import { existsSync as existsSync10, promises as fs13 } from "fs";
 import { consola as consola12 } from "consola";
 async function runApply(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
@@ -6923,7 +7161,7 @@ ${sectionLine(label)}
     );
   }
   const ymlPath = containerConfigPath(opts.name, home);
-  if (!existsSync9(ymlPath)) {
+  if (!existsSync10(ymlPath)) {
     throw new Error(
       `No such config: ${ymlPath}. Run \`monoceros init <template> ${opts.name}\` first.`
     );
@@ -7041,7 +7279,7 @@ Fix the value in the env file (or the yml).`
   if (dockerMode === "rootless") {
     throw new Error(formatRootlessNotSupportedError());
   }
-  await fs12.mkdir(targetDir, { recursive: true });
+  await fs13.mkdir(targetDir, { recursive: true });
   await writeScaffold(createOpts, targetDir, { dockerMode });
   await writeStateFile(
     targetDir,
@@ -7052,6 +7290,27 @@ Fix the value in the env file (or the yml).`
       ...opts.now ? { now: opts.now } : {}
     })
   );
+  if (runtimeSupportsSshAttach(createOpts.runtimeVersion)) {
+    try {
+      const ssh = await setupSshAttach({
+        name: opts.name,
+        targetDir,
+        home,
+        ...opts.sshKeygen ? { keygen: opts.sshKeygen } : {},
+        ...opts.sshUserSshDir ? { userSshDir: opts.sshUserSshDir } : {},
+        logger: idLogger
+      });
+      if (ssh.configured) {
+        logger.info(
+          `SSH attach: \`ssh ${ssh.hostAlias}\` (or pick it in your IDE)`
+        );
+      }
+    } catch (err) {
+      (logger.warn ?? logger.info)(
+        `SSH attach setup skipped: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
   try {
     const components = await loadComponentCatalog();
     await writeBriefing({ targetDir, createOpts, components });
@@ -7196,8 +7455,8 @@ ${stripAnsi(formatted)}
   return { targetDir, configPath: ymlPath, containerExitCode: exitCode };
 }
 async function assertSafeTargetDir(targetDir, expectedOrigin) {
-  if (!existsSync9(targetDir)) return;
-  const entries = await fs12.readdir(targetDir);
+  if (!existsSync10(targetDir)) return;
+  const entries = await fs13.readdir(targetDir);
   if (entries.length === 0) return;
   const state = await readStateFile(targetDir);
   if (state) {
@@ -7267,7 +7526,7 @@ async function persistPromptedIdentity(prompted, ymlPath, home, logger) {
   }
   if (wantContainer) {
     try {
-      const text = await fs12.readFile(ymlPath, "utf8");
+      const text = await fs13.readFile(ymlPath, "utf8");
       const parsed = parseConfig(text, ymlPath);
       const changed = setContainerGitUserInDoc(parsed.doc, {
         name: prompted.name,
@@ -7275,7 +7534,7 @@ async function persistPromptedIdentity(prompted, ymlPath, home, logger) {
       });
       if (changed) {
         const out = stringifyConfig(parsed.doc);
-        await fs12.writeFile(ymlPath, out, "utf8");
+        await fs13.writeFile(ymlPath, out, "utf8");
         logger.info(
           `Saved identity in this container \u2014 wrote git.user into ${prettyPath(ymlPath)}.`
         );
@@ -7298,6 +7557,7 @@ var init_apply = __esm({
     init_state();
     init_transform();
     init_catalog();
+    init_ssh_attach();
     init_scaffold();
     init_format();
     init_ref();
@@ -7321,90 +7581,386 @@ var init_apply = __esm({
   }
 });
 
-// src/version.ts
-var CLI_VERSION;
-var init_version = __esm({
-  "src/version.ts"() {
-    "use strict";
-    CLI_VERSION = true ? "1.26.5" : "dev";
-  }
-});
-
-// src/commands/_dispatch.ts
-import { consola as consola13 } from "consola";
-async function dispatch(runner) {
+// src/devcontainer/browser-bridge.ts
+import { spawn as spawn9 } from "child_process";
+import { existsSync as existsSync11, promises as fsp5, readFileSync as readFileSync5 } from "fs";
+import http from "http";
+import path20 from "path";
+function parseCallbackTarget(authUrl) {
   try {
-    const exitCode = await runner();
-    process.exit(exitCode);
-  } catch (err) {
-    consola13.error(err instanceof Error ? err.message : String(err));
-    process.exit(1);
+    const u = new URL(authUrl);
+    const redirect = u.searchParams.get("redirect_uri");
+    if (!redirect) return null;
+    const r = new URL(redirect);
+    if (r.hostname !== "localhost" && r.hostname !== "127.0.0.1") return null;
+    const port = Number(r.port);
+    if (!Number.isInteger(port) || port <= 0) return null;
+    return { port, pathname: r.pathname };
+  } catch {
+    return null;
   }
 }
-var init_dispatch = __esm({
-  "src/commands/_dispatch.ts"() {
-    "use strict";
+function nextRelayUrl(content, lastOpened) {
+  const url = content.trim();
+  return url && url !== lastOpened ? url : null;
+}
+function wrapExec(command, opts) {
+  const leading = [];
+  const stmts = [];
+  if (opts.pathPrepend) {
+    leading.push(opts.pathPrepend);
+    const i = leading.length;
+    stmts.push(`export PATH="$${i}:$PATH"`);
+    stmts.push(`export BROWSER="$${i}/xdg-open"`);
   }
-});
-
-// src/commands/apply.ts
-import { defineCommand as defineCommand8 } from "citty";
-var applyCommand;
-var init_apply2 = __esm({
-  "src/commands/apply.ts"() {
-    "use strict";
-    init_apply();
-    init_version();
-    init_dispatch();
-    applyCommand = defineCommand8({
-      meta: {
-        name: "apply",
-        group: "lifecycle",
-        description: "Materialize a container config into $MONOCEROS_HOME/container/<name>/ and bring the dev-container up. Close any VS Code Remote Containers session for the target first \u2014 the extension auto-recreates and races with apply."
-      },
-      args: {
-        name: {
-          type: "positional",
-          description: "Config name. Resolves to $MONOCEROS_HOME/container-configs/<name>.yml.",
-          required: true
-        },
-        verbose: {
-          type: "boolean",
-          description: "Stream the raw @devcontainers/cli output to stderr instead of showing a phase spinner. Auto-enabled when stderr is not a TTY.",
-          default: false
-        }
-      },
-      run({ args }) {
-        return dispatch(async () => {
-          const result = await runApply({
-            name: args.name,
-            cliVersion: CLI_VERSION,
-            verbose: args.verbose
-          });
-          return result.containerExitCode;
-        });
-      }
+  if (opts.cwd) {
+    leading.push(opts.cwd);
+    stmts.push(`cd -- "$${leading.length}"`);
+  }
+  if (leading.length === 0) return command;
+  const shift = leading.length === 1 ? "shift" : `shift ${leading.length}`;
+  const script = `${stmts.join(" && ")} && ${shift} && exec "$@"`;
+  return ["bash", "-lc", script, "bash", ...leading, ...command];
+}
+function openInBrowser(url) {
+  const platform = process.platform;
+  const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn9(cmd, args, {
+      stdio: "ignore",
+      detached: true
+    });
+    child.on("error", () => {
     });
+    child.unref();
+  } catch {
   }
-});
-
-// src/commands/completion.ts
-import { defineCommand as defineCommand9 } from "citty";
-function renderCompletionScript(shell) {
-  if (shell === "bash") {
-    return [
-      "# bash completion for monoceros",
-      "# install: source this file from .bashrc, e.g.",
-      "#   monoceros completion bash > ~/.bash_completion.d/monoceros",
-      '#   echo "source ~/.bash_completion.d/monoceros" >> ~/.bashrc',
-      "#",
-      "# The work is done by `monoceros __complete --line --point`; this",
-      "# shell wrapper only forwards the cursor view.",
-      "",
-      "_monoceros() {",
-      "  local IFS=$'\\n'",
-      "  local candidates",
-      '  candidates=$(monoceros __complete --line "$COMP_LINE" --point "$COMP_POINT" 2>/dev/null)',
+}
+async function startBrowserBridge(opts) {
+  const relayDir = path20.join(opts.root, RELAY_DIRNAME);
+  const relayScript = path20.join(relayDir, "xdg-open");
+  const urlFile = path20.join(relayDir, "url");
+  await fsp5.mkdir(relayDir, { recursive: true });
+  await fsp5.rm(urlFile, { force: true });
+  await fsp5.writeFile(
+    relayScript,
+    `#!/bin/sh
+printf '%s\\n' "$1" > "$(dirname "$0")/url"
+exit 0
+`,
+    { mode: 493 }
+  );
+  await fsp5.chmod(relayScript, 493);
+  const servers = [];
+  let lastOpened = null;
+  const onUrl = (url) => {
+    openInBrowser(url);
+    const target = parseCallbackTarget(url);
+    if (!target) return;
+    const server = http.createServer((req, res) => {
+      const reqUrl = req.url ?? target.pathname;
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(
+        '<html><body style="font-family:sans-serif;padding:3rem">You are signed in. You can close this tab and return to the terminal.</body></html>'
+      );
+      void opts.spawn(
+        [
+          "exec",
+          "--workspace-folder",
+          opts.root,
+          "--mount-workspace-git-root=false",
+          "curl",
+          "-fsS",
+          `http://localhost:${target.port}${reqUrl}`
+        ],
+        opts.root,
+        { quiet: true }
+      );
+    });
+    server.on("error", () => {
+    });
+    server.listen(target.port, "127.0.0.1");
+    servers.push(server);
+  };
+  const poll = setInterval(() => {
+    if (!existsSync11(urlFile)) return;
+    let content = "";
+    try {
+      content = readFileSync5(urlFile, "utf8");
+    } catch {
+      return;
+    }
+    const url = nextRelayUrl(content, lastOpened);
+    if (!url) return;
+    lastOpened = url;
+    onUrl(url);
+  }, 250);
+  return {
+    relayDirInContainer: `/workspaces/${opts.name}/${RELAY_DIRNAME}`,
+    async dispose() {
+      clearInterval(poll);
+      for (const s of servers) s.close();
+      await fsp5.rm(relayDir, { recursive: true, force: true });
+    }
+  };
+}
+var RELAY_DIRNAME;
+var init_browser_bridge = __esm({
+  "src/devcontainer/browser-bridge.ts"() {
+    "use strict";
+    RELAY_DIRNAME = ".monoceros-bridge";
+  }
+});
+
+// src/devcontainer/shell.ts
+import { existsSync as existsSync12 } from "fs";
+import path21 from "path";
+async function runShell(opts) {
+  assertContainerExists(opts.root);
+  const spawnFn = opts.spawn ?? spawnDevcontainer;
+  const upCode = await spawnFn(
+    ["up", "--workspace-folder", opts.root, "--mount-workspace-git-root=false"],
+    opts.root,
+    { quiet: true }
+  );
+  if (upCode !== 0) return upCode;
+  const name = opts.name ?? path21.basename(opts.root);
+  const isTty2 = opts.isTty ?? process.stdout.isTTY;
+  const bridge = isTty2 ? await startBrowserBridge({ name, root: opts.root, spawn: spawnFn }) : null;
+  try {
+    const innerExec = wrapExec(
+      ["bash"],
+      bridge ? { pathPrepend: bridge.relayDirInContainer } : {}
+    );
+    return await spawnFn(
+      [
+        "exec",
+        "--workspace-folder",
+        opts.root,
+        "--mount-workspace-git-root=false",
+        ...innerExec
+      ],
+      opts.root,
+      { interactive: true }
+    );
+  } finally {
+    if (bridge) await bridge.dispose();
+  }
+}
+function assertContainerExists(root) {
+  if (!existsSync12(path21.join(root, ".devcontainer"))) {
+    throw new Error(
+      `No .devcontainer/ at ${root}. Run \`monoceros apply <name>\` first.`
+    );
+  }
+}
+var init_shell = __esm({
+  "src/devcontainer/shell.ts"() {
+    "use strict";
+    init_browser_bridge();
+    init_cli();
+  }
+});
+
+// src/open/index.ts
+import { spawn as spawn10 } from "child_process";
+import { accessSync, constants, existsSync as existsSync13 } from "fs";
+import path22 from "path";
+import { consola as consola13 } from "consola";
+function resolveOnPath(bin) {
+  const dirs = (process.env.PATH ?? "").split(path22.delimiter).filter(Boolean);
+  for (const dir of dirs) {
+    const candidate = path22.join(dir, bin);
+    try {
+      accessSync(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function resolveEditorBinary(tool) {
+  if (resolveOnPath(tool.bin)) return tool.bin;
+  if (process.platform === "darwin" && existsSync13(tool.macAppBin)) {
+    return tool.macAppBin;
+  }
+  return null;
+}
+function realLaunch(bin, args) {
+  const child = spawn10(bin, args, {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.unref();
+}
+async function runOpen(opts) {
+  const home = opts.monocerosHome ?? monocerosHome();
+  const logger = opts.logger ?? {
+    info: (m) => consola13.info(m),
+    warn: (m) => consola13.warn(m)
+  };
+  const root = containerDir(opts.name, home);
+  if (opts.tool === "shell") {
+    const shellRunner = opts.shellRunner ?? runShell;
+    return shellRunner({ root, name: opts.name });
+  }
+  const editor = EDITORS[opts.tool];
+  if (!editor) {
+    throw new Error(
+      `Unknown tool '${opts.tool}'. Supported: ${OPEN_TOOLS.join(", ")}.`
+    );
+  }
+  if (!existsSync13(sshConfigEntryPath(home, opts.name))) {
+    throw new Error(
+      `SSH attach isn't set up for '${opts.name}'. Run \`monoceros apply ${opts.name}\` first (needs a runtime >= 1.2.0).`
+    );
+  }
+  const running = await findRunningContainerByLocalFolder(
+    root,
+    opts.dockerLookup ? { docker: opts.dockerLookup } : {}
+  );
+  if (!running) {
+    throw new Error(
+      `Container '${opts.name}' isn't running. Bring it up with \`monoceros apply ${opts.name}\`, then retry.`
+    );
+  }
+  const resolve = opts.binResolver ?? resolveEditorBinary;
+  const bin = resolve(editor);
+  if (!bin) {
+    const where = process.platform === "darwin" ? " on PATH or in /Applications" : " on PATH";
+    throw new Error(
+      `${editor.label} ('${editor.bin}') not found${where}. In ${editor.label}, ${editor.setupHint}.`
+    );
+  }
+  const uri = `vscode-remote://ssh-remote+monoceros-${opts.name}/workspaces/${opts.name}/${opts.name}.code-workspace`;
+  const launch = opts.launch ?? realLaunch;
+  launch(bin, ["--file-uri", uri]);
+  logger.info(`Opening '${opts.name}' in ${editor.label}...`);
+  return 0;
+}
+var EDITORS, OPEN_TOOLS;
+var init_open = __esm({
+  "src/open/index.ts"() {
+    "use strict";
+    init_paths();
+    init_locate_running();
+    init_shell();
+    init_ssh_attach();
+    EDITORS = {
+      code: {
+        label: "VS Code",
+        bin: "code",
+        macAppBin: "/Applications/Visual Studio Code.app/Contents/Resources/app/bin/code",
+        setupHint: `install the Remote-SSH extension and run "Shell Command: Install 'code' command in PATH"`
+      },
+      codium: {
+        label: "VS Codium",
+        bin: "codium",
+        macAppBin: "/Applications/VSCodium.app/Contents/Resources/app/bin/codium",
+        setupHint: 'install the "Open Remote - SSH" extension (the codium CLI ships with the app)'
+      }
+    };
+    OPEN_TOOLS = [...Object.keys(EDITORS), "shell"];
+  }
+});
+
+// src/version.ts
+var CLI_VERSION;
+var init_version = __esm({
+  "src/version.ts"() {
+    "use strict";
+    CLI_VERSION = true ? "1.27.0" : "dev";
+  }
+});
+
+// src/commands/_dispatch.ts
+import { consola as consola14 } from "consola";
+async function dispatch(runner) {
+  try {
+    const exitCode = await runner();
+    process.exit(exitCode);
+  } catch (err) {
+    consola14.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+var init_dispatch = __esm({
+  "src/commands/_dispatch.ts"() {
+    "use strict";
+  }
+});
+
+// src/commands/apply.ts
+import { defineCommand as defineCommand8 } from "citty";
+import { consola as consola15 } from "consola";
+var applyCommand;
+var init_apply2 = __esm({
+  "src/commands/apply.ts"() {
+    "use strict";
+    init_apply();
+    init_open();
+    init_version();
+    init_dispatch();
+    applyCommand = defineCommand8({
+      meta: {
+        name: "apply",
+        group: "lifecycle",
+        description: "Materialize a container config into $MONOCEROS_HOME/container/<name>/ and bring the dev-container up. Close any VS Code Remote Containers session for the target first \u2014 the extension auto-recreates and races with apply."
+      },
+      args: {
+        name: {
+          type: "positional",
+          description: "Config name. Resolves to $MONOCEROS_HOME/container-configs/<name>.yml.",
+          required: true
+        },
+        verbose: {
+          type: "boolean",
+          description: "Stream the raw @devcontainers/cli output to stderr instead of showing a phase spinner. Auto-enabled when stderr is not a TTY.",
+          default: false
+        },
+        open: {
+          type: "string",
+          description: `After a successful apply, open the container in this tool (${OPEN_TOOLS.join("|")}).`
+        }
+      },
+      run({ args }) {
+        return dispatch(async () => {
+          const result = await runApply({
+            name: args.name,
+            cliVersion: CLI_VERSION,
+            verbose: args.verbose
+          });
+          if (args.open && result.containerExitCode === 0) {
+            try {
+              await runOpen({ name: args.name, tool: args.open });
+            } catch (err) {
+              consola15.warn(err instanceof Error ? err.message : String(err));
+            }
+          }
+          return result.containerExitCode;
+        });
+      }
+    });
+  }
+});
+
+// src/commands/completion.ts
+import { defineCommand as defineCommand9 } from "citty";
+function renderCompletionScript(shell) {
+  if (shell === "bash") {
+    return [
+      "# bash completion for monoceros",
+      "# install: source this file from .bashrc, e.g.",
+      "#   monoceros completion bash > ~/.bash_completion.d/monoceros",
+      '#   echo "source ~/.bash_completion.d/monoceros" >> ~/.bashrc',
+      "#",
+      "# The work is done by `monoceros __complete --line --point`; this",
+      "# shell wrapper only forwards the cursor view.",
+      "",
+      "_monoceros() {",
+      "  local IFS=$'\\n'",
+      "  local candidates",
+      '  candidates=$(monoceros __complete --line "$COMP_LINE" --point "$COMP_POINT" 2>/dev/null)',
       '  local cur="${COMP_WORDS[COMP_CWORD]}"',
       '  COMPREPLY=( $(compgen -W "$candidates" -- "$cur") )',
       "  # Suppress the trailing space when bash narrowed the candidate",
@@ -7516,8 +8072,8 @@ var init_completion = __esm({
 });
 
 // src/completion/resolve.ts
-import { existsSync as existsSync10, promises as fs13 } from "fs";
-import path19 from "path";
+import { existsSync as existsSync14, promises as fs14 } from "fs";
+import path23 from "path";
 async function resolveCompletions(line, point, opts = {}) {
   const { prev, current } = parseCompletionLine(line, point);
   const ctx = { prev, current, opts };
@@ -7666,9 +8222,9 @@ function filterPrefix(values, fragment) {
 }
 async function listContainerNames(ctx) {
   const home = ctx.opts.monocerosHome ?? monocerosHome();
-  const dir = path19.join(home, "container-configs");
-  if (!existsSync10(dir)) return [];
-  const entries = await fs13.readdir(dir);
+  const dir = path23.join(home, "container-configs");
+  if (!existsSync14(dir)) return [];
+  const entries = await fs14.readdir(dir);
   return entries.filter((e) => e.endsWith(".yml")).map((e) => e.slice(0, -".yml".length)).sort();
 }
 async function listFeatureComponents() {
@@ -7742,10 +8298,12 @@ var init_resolve = __esm({
     init_manifest();
     init_catalog();
     init_schema();
+    init_open();
     ALL_COMMANDS = [
       "init",
       "list-components",
       "shell",
+      "open",
       "run",
       "logs",
       "start",
@@ -7795,7 +8353,10 @@ var init_resolve = __esm({
       },
       apply: {
         positionals: [containerName],
-        flags: { "--yes": { type: "boolean", aliases: ["-y"] } }
+        flags: {
+          "--yes": { type: "boolean", aliases: ["-y"] },
+          "--open": { type: "value", values: () => [...OPEN_TOOLS] }
+        }
       },
       upgrade: {
         // First positional is a container name; the second is a version
@@ -7811,12 +8372,16 @@ var init_resolve = __esm({
         }
       },
       shell: { positionals: [containerName] },
+      open: { positionals: [containerName, () => [...OPEN_TOOLS]] },
       run: {
         positionals: [containerName],
         flags: { "--in": { type: "value" } }
       },
       logs: { positionals: [containerName] },
-      start: { positionals: [containerName] },
+      start: {
+        positionals: [containerName],
+        flags: { "--open": { type: "value", values: () => [...OPEN_TOOLS] } }
+      },
       stop: { positionals: [containerName] },
       status: { positionals: [containerName] },
       "add-language": {
@@ -8335,14 +8900,14 @@ var init_generator = __esm({
 });
 
 // src/init/index.ts
-import { existsSync as existsSync11, promises as fs14 } from "fs";
-import path20 from "path";
-import { consola as consola14 } from "consola";
+import { existsSync as existsSync15, promises as fs15 } from "fs";
+import path24 from "path";
+import { consola as consola16 } from "consola";
 async function runInit(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
   const logger = opts.logger ?? {
-    success: (msg) => consola14.success(msg),
-    info: (msg) => consola14.info(msg)
+    success: (msg) => consola16.success(msg),
+    info: (msg) => consola16.info(msg)
   };
   if (!REGEX.solutionName.test(opts.name)) {
     throw new Error(
@@ -8350,12 +8915,12 @@ async function runInit(opts) {
     );
   }
   const dest = containerConfigPath(opts.name, home);
-  if (existsSync11(dest)) {
+  if (existsSync15(dest)) {
     throw new Error(
       `Config already exists: ${dest}. Delete it manually before re-running \`monoceros init\` \u2014 this protects any hand-edits.`
     );
   }
-  const componentsRoot = opts.workbenchRoot ? path20.join(opts.workbenchRoot, "components") : componentsRootDir();
+  const componentsRoot = opts.workbenchRoot ? path24.join(opts.workbenchRoot, "components") : componentsRootDir();
   const catalog = await loadComponentCatalog(componentsRoot);
   if (catalog.size === 0) {
     throw new Error(
@@ -8421,9 +8986,9 @@ async function runInit(opts) {
   } else {
     text = generateComposedYml(opts.name, composed, lookup, repos, ports);
   }
-  await fs14.mkdir(containerConfigsDir(home), { recursive: true });
+  await fs15.mkdir(containerConfigsDir(home), { recursive: true });
   await ensureEnvGitignored(containerConfigsDir(home));
-  await fs14.writeFile(dest, text, "utf8");
+  await fs15.writeFile(dest, text, "utf8");
   const envPath = containerEnvPath(opts.name, home);
   const seedVars = {};
   for (const f of composed.features) {
@@ -8446,8 +9011,8 @@ async function runInit(opts) {
   }
   await ensureEnvVars(envPath, opts.name, seedVars);
   const documented = !anyComposed;
-  const ymlRel = path20.relative(home, dest);
-  const envRel = path20.relative(home, envPath);
+  const ymlRel = path24.relative(home, dest);
+  const envRel = path24.relative(home, envPath);
   if (documented) {
     logger.success(`Wrote documented default to ${ymlRel} and ${envRel}.`);
     logger.info(
@@ -8591,7 +9156,7 @@ var init_init = __esm({
 
 // src/commands/init.ts
 import { defineCommand as defineCommand11 } from "citty";
-import { consola as consola15 } from "consola";
+import { consola as consola17 } from "consola";
 function collectListFlag(flag, rawArgs) {
   const eq = `${flag}=`;
   const pieces = [];
@@ -8717,7 +9282,7 @@ var init_init2 = __esm({
             ...ports && ports.length > 0 ? { withPorts: ports } : {}
           });
         } catch (err) {
-          consola15.error(err instanceof Error ? err.message : String(err));
+          consola17.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8766,7 +9331,7 @@ var init_expand = __esm({
 
 // src/commands/list-components.ts
 import { defineCommand as defineCommand12 } from "citty";
-import { consola as consola16 } from "consola";
+import { consola as consola18 } from "consola";
 var CATEGORY_LABELS, CATEGORY_ORDER, listComponentsCommand;
 var init_list_components = __esm({
   "src/commands/list-components.ts"() {
@@ -8795,7 +9360,7 @@ var init_list_components = __esm({
         try {
           const catalog = expandSelectable(await loadDescriptorCatalog());
           if (catalog.size === 0) {
-            consola16.warn(
+            consola18.warn(
               "No components found. The workbench checkout looks incomplete."
             );
             process.exit(0);
@@ -8846,7 +9411,7 @@ var init_list_components = __esm({
           }
           process.exit(0);
         } catch (err) {
-          consola16.error(err instanceof Error ? err.message : String(err));
+          consola18.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -8855,14 +9420,14 @@ var init_list_components = __esm({
 });
 
 // src/commands/logs.ts
-import { spawn as spawn8 } from "child_process";
-import { existsSync as existsSync12 } from "fs";
-import path21 from "path";
+import { spawn as spawn11 } from "child_process";
+import { existsSync as existsSync16 } from "fs";
+import path25 from "path";
 import { defineCommand as defineCommand13 } from "citty";
 function tailLogFile(file, follow) {
   const [cmd, args] = follow ? ["tail", ["-F", file]] : ["cat", [file]];
   return new Promise((resolve, reject) => {
-    const child = spawn8(cmd, args, { stdio: "inherit" });
+    const child = spawn11(cmd, args, { stdio: "inherit" });
     child.on("error", reject);
     child.on("exit", (code) => resolve(code ?? 0));
   });
@@ -8900,8 +9465,8 @@ var init_logs = __esm({
       run({ args }) {
         const service = typeof args.service === "string" ? args.service : void 0;
         if (service) {
-          const logFile = path21.join(containerLogsDir(args.name), `${service}.log`);
-          if (existsSync12(logFile)) {
+          const logFile = path25.join(containerLogsDir(args.name), `${service}.log`);
+          if (existsSync16(logFile)) {
             return dispatch(() => tailLogFile(logFile, args.follow));
           }
         }
@@ -8917,12 +9482,45 @@ var init_logs = __esm({
   }
 });
 
-// src/commands/port.ts
+// src/commands/open.ts
 import { defineCommand as defineCommand14 } from "citty";
-import { consola as consola17 } from "consola";
+var openCommand;
+var init_open2 = __esm({
+  "src/commands/open.ts"() {
+    "use strict";
+    init_open();
+    init_dispatch();
+    openCommand = defineCommand14({
+      meta: {
+        name: "open",
+        group: "run",
+        description: `Attach an editor to the named dev-container over SSH, or drop into a shell. Tools: ${OPEN_TOOLS.join(", ")}. The container must be applied (runtime >= 1.2.0) and running.`
+      },
+      args: {
+        name: {
+          type: "positional",
+          description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+          required: true
+        },
+        tool: {
+          type: "positional",
+          description: `What to open it in: ${OPEN_TOOLS.join(", ")}.`,
+          required: true
+        }
+      },
+      run({ args }) {
+        return dispatch(() => runOpen({ name: args.name, tool: args.tool }));
+      }
+    });
+  }
+});
+
+// src/commands/port.ts
+import { defineCommand as defineCommand15 } from "citty";
+import { consola as consola19 } from "consola";
 async function runPortListing(opts) {
   const out = opts.out ?? process.stdout;
-  const info = opts.info ?? ((m) => consola17.info(m));
+  const info = opts.info ?? ((m) => consola19.info(m));
   const parsed = await readConfig(
     containerConfigPath(opts.name, opts.monocerosHome)
   );
@@ -8980,7 +9578,7 @@ var init_port = __esm({
     init_schema();
     init_dynamic();
     init_format();
-    portCommand = defineCommand14({
+    portCommand = defineCommand15({
       meta: {
         name: "port",
         group: "discovery",
@@ -8998,7 +9596,7 @@ var init_port = __esm({
           const code = await runPortListing({ name: args.name });
           process.exit(code);
         } catch (err) {
-          consola17.error(err instanceof Error ? err.message : String(err));
+          consola19.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9007,15 +9605,15 @@ var init_port = __esm({
 });
 
 // src/commands/remove-apt-packages.ts
-import { defineCommand as defineCommand15 } from "citty";
-import { consola as consola18 } from "consola";
+import { defineCommand as defineCommand16 } from "citty";
+import { consola as consola20 } from "consola";
 var removeAptPackagesCommand;
 var init_remove_apt_packages = __esm({
   "src/commands/remove-apt-packages.ts"() {
     "use strict";
     init_inner_args();
     init_modify();
-    removeAptPackagesCommand = defineCommand15({
+    removeAptPackagesCommand = defineCommand16({
       meta: {
         name: "remove-apt-packages",
         group: "edit",
@@ -9037,7 +9635,7 @@ var init_remove_apt_packages = __esm({
       async run({ args }) {
         const packages = [...getInnerArgs()];
         if (packages.length === 0) {
-          consola18.error(
+          consola20.error(
             "No package names given. Usage: `monoceros remove-apt-packages <containername> [--yes] -- <pkg> [<pkg> \u2026]`."
           );
           process.exit(1);
@@ -9050,7 +9648,7 @@ var init_remove_apt_packages = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola18.error(err instanceof Error ? err.message : String(err));
+          consola20.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9059,14 +9657,14 @@ var init_remove_apt_packages = __esm({
 });
 
 // src/commands/remove-feature.ts
-import { defineCommand as defineCommand16 } from "citty";
-import { consola as consola19 } from "consola";
+import { defineCommand as defineCommand17 } from "citty";
+import { consola as consola21 } from "consola";
 var removeFeatureCommand;
 var init_remove_feature = __esm({
   "src/commands/remove-feature.ts"() {
     "use strict";
     init_modify();
-    removeFeatureCommand = defineCommand16({
+    removeFeatureCommand = defineCommand17({
       meta: {
         name: "remove-feature",
         group: "edit",
@@ -9099,7 +9697,7 @@ var init_remove_feature = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola19.error(err instanceof Error ? err.message : String(err));
+          consola21.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9108,15 +9706,15 @@ var init_remove_feature = __esm({
 });
 
 // src/remove/index.ts
-import { existsSync as existsSync13, promises as fs15 } from "fs";
-import path22 from "path";
-import { consola as consola20 } from "consola";
+import { existsSync as existsSync17, promises as fs16 } from "fs";
+import path26 from "path";
+import { consola as consola22 } from "consola";
 async function runRemove(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
   const logger = opts.logger ?? {
-    info: (msg) => consola20.info(msg),
-    success: (msg) => consola20.success(msg),
-    warn: (msg) => consola20.warn(msg)
+    info: (msg) => consola22.info(msg),
+    success: (msg) => consola22.success(msg),
+    warn: (msg) => consola22.warn(msg)
   };
   if (!REGEX.solutionName.test(opts.name)) {
     throw new Error(
@@ -9126,9 +9724,9 @@ async function runRemove(opts) {
   const ymlPath = containerConfigPath(opts.name, home);
   const envPath = containerEnvPath(opts.name, home);
   const containerPath = containerDir(opts.name, home);
-  const hasYml = existsSync13(ymlPath);
-  const hasEnv = existsSync13(envPath);
-  const hasContainer = existsSync13(containerPath);
+  const hasYml = existsSync17(ymlPath);
+  const hasEnv = existsSync17(envPath);
+  const hasContainer = existsSync17(containerPath);
   if (!hasYml && !hasContainer) {
     throw new Error(
       `Nothing to remove for '${opts.name}': neither ${ymlPath} nor ${containerPath} exists.`
@@ -9154,30 +9752,30 @@ async function runRemove(opts) {
   let backupPath = null;
   if (!opts.noBackup && (hasYml || hasContainer)) {
     const ts = (opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    backupPath = path22.join(home, "container-backups", `${opts.name}-${ts}`);
-    await fs15.mkdir(backupPath, { recursive: true });
+    backupPath = path26.join(home, "container-backups", `${opts.name}-${ts}`);
+    await fs16.mkdir(backupPath, { recursive: true });
     if (hasYml) {
-      await fs15.copyFile(ymlPath, path22.join(backupPath, `${opts.name}.yml`));
+      await fs16.copyFile(ymlPath, path26.join(backupPath, `${opts.name}.yml`));
     }
     if (hasEnv) {
-      await fs15.copyFile(envPath, path22.join(backupPath, `${opts.name}.env`));
+      await fs16.copyFile(envPath, path26.join(backupPath, `${opts.name}.env`));
     }
     if (hasContainer) {
-      await fs15.cp(containerPath, path22.join(backupPath, "container"), {
+      await fs16.cp(containerPath, path26.join(backupPath, "container"), {
         recursive: true
       });
     }
     logger.info(`Backup written to ${prettyPath(backupPath)}.`);
   }
   if (hasYml) {
-    await fs15.rm(ymlPath, { force: true });
+    await fs16.rm(ymlPath, { force: true });
   }
   if (hasEnv) {
-    await fs15.rm(envPath, { force: true });
+    await fs16.rm(envPath, { force: true });
   }
   if (hasContainer) {
     try {
-      await fs15.rm(containerPath, { recursive: true, force: true });
+      await fs16.rm(containerPath, { recursive: true, force: true });
     } catch (err) {
       const code = err.code;
       if (code !== "EACCES" && code !== "EPERM") {
@@ -9199,7 +9797,7 @@ async function runRemove(opts) {
         "-delete"
       ]);
       try {
-        await fs15.rm(containerPath, { recursive: true, force: true });
+        await fs16.rm(containerPath, { recursive: true, force: true });
       } catch (err2) {
         const code2 = err2.code;
         throw new Error(
@@ -9213,7 +9811,14 @@ async function runRemove(opts) {
   );
   if (!backupPath) {
     logger.warn?.(
-      "No backup created (--no-backup). The host-side state is gone for good."
+      "No backup created (--no-backup). The host-side state is gone for good."
+    );
+  }
+  try {
+    await removeSshAttach(home, opts.name);
+  } catch (err) {
+    logger.warn?.(
+      `Could not remove SSH attach config for ${opts.name}: ${err instanceof Error ? err.message : String(err)}. Ignored.`
     );
   }
   try {
@@ -9248,21 +9853,22 @@ var init_remove = __esm({
     init_schema();
     init_compose();
     init_scaffold();
+    init_ssh_attach();
     init_proxy();
     init_dynamic();
   }
 });
 
 // src/commands/remove.ts
-import { defineCommand as defineCommand17 } from "citty";
-import { consola as consola21 } from "consola";
+import { defineCommand as defineCommand18 } from "citty";
+import { consola as consola23 } from "consola";
 import { createInterface } from "readline/promises";
 var removeCommand;
 var init_remove2 = __esm({
   "src/commands/remove.ts"() {
     "use strict";
     init_remove();
-    removeCommand = defineCommand17({
+    removeCommand = defineCommand18({
       meta: {
         name: "remove",
         group: "lifecycle",
@@ -9299,7 +9905,7 @@ var init_remove2 = __esm({
           const skipPrompt = args.yes === true;
           if (!skipPrompt) {
             const warning = noBackup ? `About to remove '${args.name}' WITHOUT a backup. Docker objects, container-configs entry, and container directory will all be deleted.` : `About to remove '${args.name}'. A backup will be written to container-backups/ first, then docker objects, container-configs entry, and container directory will all be deleted.`;
-            consola21.warn(warning);
+            consola23.warn(warning);
             const rl = createInterface({
               input: process.stdin,
               output: process.stdout
@@ -9307,7 +9913,7 @@ var init_remove2 = __esm({
             const answer = await rl.question("Continue? [y/N] ");
             rl.close();
             if (!/^y(es)?$/i.test(answer.trim())) {
-              consola21.info("Aborted. Nothing changed.");
+              consola23.info("Aborted. Nothing changed.");
               process.exit(0);
             }
           }
@@ -9316,7 +9922,7 @@ var init_remove2 = __esm({
             ...noBackup ? { noBackup: true } : {}
           });
         } catch (err) {
-          consola21.error(err instanceof Error ? err.message : String(err));
+          consola23.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9325,24 +9931,24 @@ var init_remove2 = __esm({
 });
 
 // src/restore/index.ts
-import { existsSync as existsSync14, promises as fs16 } from "fs";
-import path23 from "path";
-import { consola as consola22 } from "consola";
+import { existsSync as existsSync18, promises as fs17 } from "fs";
+import path27 from "path";
+import { consola as consola24 } from "consola";
 async function runRestore(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
   const logger = opts.logger ?? {
-    info: (msg) => consola22.info(msg),
-    success: (msg) => consola22.success(msg)
+    info: (msg) => consola24.info(msg),
+    success: (msg) => consola24.success(msg)
   };
-  const backup = path23.resolve(opts.backupPath);
-  if (!existsSync14(backup)) {
+  const backup = path27.resolve(opts.backupPath);
+  if (!existsSync18(backup)) {
     throw new Error(`Backup not found: ${backup}.`);
   }
-  const stat = await fs16.stat(backup);
+  const stat = await fs17.stat(backup);
   if (!stat.isDirectory()) {
     throw new Error(`Backup path is not a directory: ${backup}.`);
   }
-  const entries = await fs16.readdir(backup);
+  const entries = await fs17.readdir(backup);
   const ymlFiles = entries.filter((f) => f.endsWith(".yml"));
   if (ymlFiles.length === 0) {
     throw new Error(
@@ -9356,29 +9962,29 @@ async function runRestore(opts) {
   }
   const ymlFile = ymlFiles[0];
   const name = ymlFile.replace(/\.yml$/, "");
-  const containerInBackup = path23.join(backup, "container");
-  const hasContainer = existsSync14(containerInBackup);
-  const envInBackup = path23.join(backup, `${name}.env`);
-  const hasEnv = existsSync14(envInBackup);
+  const containerInBackup = path27.join(backup, "container");
+  const hasContainer = existsSync18(containerInBackup);
+  const envInBackup = path27.join(backup, `${name}.env`);
+  const hasEnv = existsSync18(envInBackup);
   const destYml = containerConfigPath(name, home);
   const destContainer = containerDir(name, home);
-  if (existsSync14(destYml)) {
+  if (existsSync18(destYml)) {
     throw new Error(
       `Refusing to restore: ${destYml} already exists. Remove the current container first (\`monoceros remove ${name}\`) or rename the existing config.`
     );
   }
-  if (hasContainer && existsSync14(destContainer)) {
+  if (hasContainer && existsSync18(destContainer)) {
     throw new Error(
       `Refusing to restore: ${destContainer} already exists. Remove the current container first (\`monoceros remove ${name}\`).`
     );
   }
-  await fs16.mkdir(containerConfigsDir(home), { recursive: true });
-  await fs16.copyFile(path23.join(backup, ymlFile), destYml);
+  await fs17.mkdir(containerConfigsDir(home), { recursive: true });
+  await fs17.copyFile(path27.join(backup, ymlFile), destYml);
   if (hasEnv) {
-    await fs16.copyFile(envInBackup, containerEnvPath(name, home));
+    await fs17.copyFile(envInBackup, containerEnvPath(name, home));
   }
   if (hasContainer) {
-    await fs16.cp(containerInBackup, destContainer, { recursive: true });
+    await fs17.cp(containerInBackup, destContainer, { recursive: true });
   }
   logger.success(`Restored '${name}' from ${prettyPath(backup)}.`);
   logger.info(
@@ -9398,14 +10004,14 @@ var init_restore = __esm({
 });
 
 // src/commands/restore.ts
-import { defineCommand as defineCommand18 } from "citty";
-import { consola as consola23 } from "consola";
+import { defineCommand as defineCommand19 } from "citty";
+import { consola as consola25 } from "consola";
 var restoreCommand;
 var init_restore2 = __esm({
   "src/commands/restore.ts"() {
     "use strict";
     init_restore();
-    restoreCommand = defineCommand18({
+    restoreCommand = defineCommand19({
       meta: {
         name: "restore",
         group: "lifecycle",
@@ -9422,7 +10028,7 @@ var init_restore2 = __esm({
         try {
           await runRestore({ backupPath: args["backup-path"] });
         } catch (err) {
-          consola23.error(err instanceof Error ? err.message : String(err));
+          consola25.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9431,14 +10037,14 @@ var init_restore2 = __esm({
 });
 
 // src/commands/remove-from-url.ts
-import { defineCommand as defineCommand19 } from "citty";
-import { consola as consola24 } from "consola";
+import { defineCommand as defineCommand20 } from "citty";
+import { consola as consola26 } from "consola";
 var removeFromUrlCommand;
 var init_remove_from_url = __esm({
   "src/commands/remove-from-url.ts"() {
     "use strict";
     init_modify();
-    removeFromUrlCommand = defineCommand19({
+    removeFromUrlCommand = defineCommand20({
       meta: {
         name: "remove-from-url",
         group: "edit",
@@ -9471,7 +10077,7 @@ var init_remove_from_url = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola24.error(err instanceof Error ? err.message : String(err));
+          consola26.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9480,14 +10086,14 @@ var init_remove_from_url = __esm({
 });
 
 // src/commands/remove-language.ts
-import { defineCommand as defineCommand20 } from "citty";
-import { consola as consola25 } from "consola";
+import { defineCommand as defineCommand21 } from "citty";
+import { consola as consola27 } from "consola";
 var removeLanguageCommand;
 var init_remove_language = __esm({
   "src/commands/remove-language.ts"() {
     "use strict";
     init_modify();
-    removeLanguageCommand = defineCommand20({
+    removeLanguageCommand = defineCommand21({
       meta: {
         name: "remove-language",
         group: "edit",
@@ -9520,7 +10126,7 @@ var init_remove_language = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola25.error(err instanceof Error ? err.message : String(err));
+          consola27.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9529,8 +10135,8 @@ var init_remove_language = __esm({
 });
 
 // src/commands/remove-port.ts
-import { defineCommand as defineCommand21 } from "citty";
-import { consola as consola26 } from "consola";
+import { defineCommand as defineCommand22 } from "citty";
+import { consola as consola28 } from "consola";
 function coerceToken2(raw) {
   const n = Number(raw);
   return Number.isFinite(n) ? n : raw;
@@ -9541,7 +10147,7 @@ var init_remove_port = __esm({
     "use strict";
     init_inner_args();
     init_modify();
-    removePortCommand = defineCommand21({
+    removePortCommand = defineCommand22({
       meta: {
         name: "remove-port",
         group: "edit",
@@ -9563,7 +10169,7 @@ var init_remove_port = __esm({
       async run({ args }) {
         const tokens = [...getInnerArgs()];
         if (tokens.length === 0) {
-          consola26.error(
+          consola28.error(
             "No ports given. Usage: `monoceros remove-port <containername> [--yes] -- <port> [<port> \u2026]`."
           );
           process.exit(1);
@@ -9576,7 +10182,7 @@ var init_remove_port = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola26.error(err instanceof Error ? err.message : String(err));
+          consola28.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9585,14 +10191,14 @@ var init_remove_port = __esm({
 });
 
 // src/commands/remove-repo.ts
-import { defineCommand as defineCommand22 } from "citty";
-import { consola as consola27 } from "consola";
+import { defineCommand as defineCommand23 } from "citty";
+import { consola as consola29 } from "consola";
 var removeRepoCommand;
 var init_remove_repo = __esm({
   "src/commands/remove-repo.ts"() {
     "use strict";
     init_modify();
-    removeRepoCommand = defineCommand22({
+    removeRepoCommand = defineCommand23({
       meta: {
         name: "remove-repo",
         group: "edit",
@@ -9625,7 +10231,7 @@ var init_remove_repo = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola27.error(err instanceof Error ? err.message : String(err));
+          consola29.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9634,14 +10240,14 @@ var init_remove_repo = __esm({
 });
 
 // src/commands/remove-service.ts
-import { defineCommand as defineCommand23 } from "citty";
-import { consola as consola28 } from "consola";
+import { defineCommand as defineCommand24 } from "citty";
+import { consola as consola30 } from "consola";
 var removeServiceCommand;
 var init_remove_service = __esm({
   "src/commands/remove-service.ts"() {
     "use strict";
     init_modify();
-    removeServiceCommand = defineCommand23({
+    removeServiceCommand = defineCommand24({
       meta: {
         name: "remove-service",
         group: "edit",
@@ -9674,7 +10280,7 @@ var init_remove_service = __esm({
           });
           process.exit(result.status === "aborted" ? 1 : 0);
         } catch (err) {
-          consola28.error(err instanceof Error ? err.message : String(err));
+          consola30.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -9682,148 +10288,17 @@ var init_remove_service = __esm({
   }
 });
 
-// src/devcontainer/browser-bridge.ts
-import { spawn as spawn9 } from "child_process";
-import { existsSync as existsSync15, promises as fsp5, readFileSync as readFileSync5 } from "fs";
-import http from "http";
-import path24 from "path";
-function parseCallbackTarget(authUrl) {
-  try {
-    const u = new URL(authUrl);
-    const redirect = u.searchParams.get("redirect_uri");
-    if (!redirect) return null;
-    const r = new URL(redirect);
-    if (r.hostname !== "localhost" && r.hostname !== "127.0.0.1") return null;
-    const port = Number(r.port);
-    if (!Number.isInteger(port) || port <= 0) return null;
-    return { port, pathname: r.pathname };
-  } catch {
-    return null;
-  }
-}
-function nextRelayUrl(content, lastOpened) {
-  const url = content.trim();
-  return url && url !== lastOpened ? url : null;
-}
-function wrapExec(command, opts) {
-  const leading = [];
-  const stmts = [];
-  if (opts.pathPrepend) {
-    leading.push(opts.pathPrepend);
-    const i = leading.length;
-    stmts.push(`export PATH="$${i}:$PATH"`);
-    stmts.push(`export BROWSER="$${i}/xdg-open"`);
-  }
-  if (opts.cwd) {
-    leading.push(opts.cwd);
-    stmts.push(`cd -- "$${leading.length}"`);
-  }
-  if (leading.length === 0) return command;
-  const shift = leading.length === 1 ? "shift" : `shift ${leading.length}`;
-  const script = `${stmts.join(" && ")} && ${shift} && exec "$@"`;
-  return ["bash", "-lc", script, "bash", ...leading, ...command];
-}
-function openInBrowser(url) {
-  const platform = process.platform;
-  const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
-  try {
-    const child = spawn9(cmd, args, {
-      stdio: "ignore",
-      detached: true
-    });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-async function startBrowserBridge(opts) {
-  const relayDir = path24.join(opts.root, RELAY_DIRNAME);
-  const relayScript = path24.join(relayDir, "xdg-open");
-  const urlFile = path24.join(relayDir, "url");
-  await fsp5.mkdir(relayDir, { recursive: true });
-  await fsp5.rm(urlFile, { force: true });
-  await fsp5.writeFile(
-    relayScript,
-    `#!/bin/sh
-printf '%s\\n' "$1" > "$(dirname "$0")/url"
-exit 0
-`,
-    { mode: 493 }
-  );
-  await fsp5.chmod(relayScript, 493);
-  const servers = [];
-  let lastOpened = null;
-  const onUrl = (url) => {
-    openInBrowser(url);
-    const target = parseCallbackTarget(url);
-    if (!target) return;
-    const server = http.createServer((req, res) => {
-      const reqUrl = req.url ?? target.pathname;
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end(
-        '<html><body style="font-family:sans-serif;padding:3rem">You are signed in. You can close this tab and return to the terminal.</body></html>'
-      );
-      void opts.spawn(
-        [
-          "exec",
-          "--workspace-folder",
-          opts.root,
-          "--mount-workspace-git-root=false",
-          "curl",
-          "-fsS",
-          `http://localhost:${target.port}${reqUrl}`
-        ],
-        opts.root,
-        { quiet: true }
-      );
-    });
-    server.on("error", () => {
-    });
-    server.listen(target.port, "127.0.0.1");
-    servers.push(server);
-  };
-  const poll = setInterval(() => {
-    if (!existsSync15(urlFile)) return;
-    let content = "";
-    try {
-      content = readFileSync5(urlFile, "utf8");
-    } catch {
-      return;
-    }
-    const url = nextRelayUrl(content, lastOpened);
-    if (!url) return;
-    lastOpened = url;
-    onUrl(url);
-  }, 250);
-  return {
-    relayDirInContainer: `/workspaces/${opts.name}/${RELAY_DIRNAME}`,
-    async dispose() {
-      clearInterval(poll);
-      for (const s of servers) s.close();
-      await fsp5.rm(relayDir, { recursive: true, force: true });
-    }
-  };
-}
-var RELAY_DIRNAME;
-var init_browser_bridge = __esm({
-  "src/devcontainer/browser-bridge.ts"() {
-    "use strict";
-    RELAY_DIRNAME = ".monoceros-bridge";
-  }
-});
-
 // src/devcontainer/claude-trust.ts
-import { existsSync as existsSync16, promises as fsp6 } from "fs";
-import path25 from "path";
+import { existsSync as existsSync19, promises as fsp6 } from "fs";
+import path28 from "path";
 function resolveContainerCwd(name, cwd) {
   const workspace = `/workspaces/${name}`;
   if (!cwd) return workspace;
-  return path25.posix.isAbsolute(cwd) ? cwd : path25.posix.join(workspace, cwd);
+  return path28.posix.isAbsolute(cwd) ? cwd : path28.posix.join(workspace, cwd);
 }
 async function preApproveClaudeProject(opts) {
-  const file = path25.join(opts.root, "home", ".claude.json");
-  if (!existsSync16(file)) return;
+  const file = path28.join(opts.root, "home", ".claude.json");
+  if (!existsSync19(file)) return;
   try {
     const raw = await fsp6.readFile(file, "utf8");
     const config = raw.trim() ? JSON.parse(raw) : {};
@@ -9856,56 +10331,6 @@ var init_claude_trust = __esm({
   }
 });
 
-// src/devcontainer/shell.ts
-import { existsSync as existsSync17 } from "fs";
-import path26 from "path";
-async function runShell(opts) {
-  assertContainerExists(opts.root);
-  const spawnFn = opts.spawn ?? spawnDevcontainer;
-  const upCode = await spawnFn(
-    ["up", "--workspace-folder", opts.root, "--mount-workspace-git-root=false"],
-    opts.root,
-    { quiet: true }
-  );
-  if (upCode !== 0) return upCode;
-  const name = opts.name ?? path26.basename(opts.root);
-  const isTty2 = opts.isTty ?? process.stdout.isTTY;
-  const bridge = isTty2 ? await startBrowserBridge({ name, root: opts.root, spawn: spawnFn }) : null;
-  try {
-    const innerExec = wrapExec(
-      ["bash"],
-      bridge ? { pathPrepend: bridge.relayDirInContainer } : {}
-    );
-    return await spawnFn(
-      [
-        "exec",
-        "--workspace-folder",
-        opts.root,
-        "--mount-workspace-git-root=false",
-        ...innerExec
-      ],
-      opts.root,
-      { interactive: true }
-    );
-  } finally {
-    if (bridge) await bridge.dispose();
-  }
-}
-function assertContainerExists(root) {
-  if (!existsSync17(path26.join(root, ".devcontainer"))) {
-    throw new Error(
-      `No .devcontainer/ at ${root}. Run \`monoceros apply <name>\` first.`
-    );
-  }
-}
-var init_shell = __esm({
-  "src/devcontainer/shell.ts"() {
-    "use strict";
-    init_browser_bridge();
-    init_cli();
-  }
-});
-
 // src/devcontainer/run.ts
 async function runInContainer(opts) {
   if (opts.command.length === 0) {
@@ -9964,8 +10389,8 @@ var init_run = __esm({
 });
 
 // src/commands/run.ts
-import { defineCommand as defineCommand24 } from "citty";
-import { consola as consola29 } from "consola";
+import { defineCommand as defineCommand25 } from "citty";
+import { consola as consola31 } from "consola";
 var runCommand;
 var init_run2 = __esm({
   "src/commands/run.ts"() {
@@ -9973,7 +10398,7 @@ var init_run2 = __esm({
     init_paths();
     init_run();
     init_inner_args();
-    runCommand = defineCommand24({
+    runCommand = defineCommand25({
       meta: {
         name: "run",
         group: "run",
@@ -9993,7 +10418,7 @@ var init_run2 = __esm({
       async run({ args }) {
         const command = [...getInnerArgs()];
         if (command.length === 0) {
-          consola29.error(
+          consola31.error(
             "No command provided. Usage: `monoceros run <containername> -- <cmd> [args\u2026]`."
           );
           process.exit(1);
@@ -10007,7 +10432,7 @@ var init_run2 = __esm({
           });
           process.exit(exitCode);
         } catch (err) {
-          consola29.error(err instanceof Error ? err.message : String(err));
+          consola31.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -10016,15 +10441,15 @@ var init_run2 = __esm({
 });
 
 // src/commands/shell.ts
-import { defineCommand as defineCommand25 } from "citty";
-import { consola as consola30 } from "consola";
+import { defineCommand as defineCommand26 } from "citty";
+import { consola as consola32 } from "consola";
 var shellCommand;
 var init_shell2 = __esm({
   "src/commands/shell.ts"() {
     "use strict";
     init_paths();
     init_shell();
-    shellCommand = defineCommand25({
+    shellCommand = defineCommand26({
       meta: {
         name: "shell",
         group: "run",
@@ -10045,7 +10470,7 @@ var init_shell2 = __esm({
           });
           process.exit(exitCode);
         } catch (err) {
-          consola30.error(err instanceof Error ? err.message : String(err));
+          consola32.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -10054,8 +10479,8 @@ var init_shell2 = __esm({
 });
 
 // src/commands/start.ts
-import { defineCommand as defineCommand26 } from "citty";
-import { consola as consola31 } from "consola";
+import { defineCommand as defineCommand27 } from "citty";
+import { consola as consola33 } from "consola";
 var startCommand;
 var init_start = __esm({
   "src/commands/start.ts"() {
@@ -10064,10 +10489,11 @@ var init_start = __esm({
     init_io();
     init_paths();
     init_compose();
+    init_open();
     init_proxy();
     init_port_check();
     init_dispatch();
-    startCommand = defineCommand26({
+    startCommand = defineCommand27({
       meta: {
         name: "start",
         group: "run",
@@ -10078,6 +10504,10 @@ var init_start = __esm({
           type: "positional",
           description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
           required: true
+        },
+        open: {
+          type: "string",
+          description: `After a successful start, open the container in this tool (${OPEN_TOOLS.join("|")}).`
         }
       },
       run({ args }) {
@@ -10092,7 +10522,7 @@ var init_start = __esm({
               hostPort = proxyHostPort(global);
             }
           } catch (err) {
-            consola31.warn(
+            consola33.warn(
               `Could not read container yml ahead of start: ${err instanceof Error ? err.message : String(err)}. Skipping Traefik pre-flight.`
             );
           }
@@ -10100,7 +10530,15 @@ var init_start = __esm({
             await preflightHostPort(hostPort);
             await ensureProxy({ hostPort });
           }
-          return runStart({ root: containerDir(args.name) });
+          const exitCode = await runStart({ root: containerDir(args.name) });
+          if (args.open && exitCode === 0) {
+            try {
+              await runOpen({ name: args.name, tool: args.open });
+            } catch (err) {
+              consola33.warn(err instanceof Error ? err.message : String(err));
+            }
+          }
+          return exitCode;
         });
       }
     });
@@ -10108,7 +10546,7 @@ var init_start = __esm({
 });
 
 // src/commands/status.ts
-import { defineCommand as defineCommand27 } from "citty";
+import { defineCommand as defineCommand28 } from "citty";
 var statusCommand;
 var init_status = __esm({
   "src/commands/status.ts"() {
@@ -10116,7 +10554,7 @@ var init_status = __esm({
     init_paths();
     init_compose();
     init_dispatch();
-    statusCommand = defineCommand27({
+    statusCommand = defineCommand28({
       meta: {
         name: "status",
         group: "run",
@@ -10146,8 +10584,8 @@ var init_status = __esm({
 });
 
 // src/commands/stop.ts
-import { defineCommand as defineCommand28 } from "citty";
-import { consola as consola32 } from "consola";
+import { defineCommand as defineCommand29 } from "citty";
+import { consola as consola34 } from "consola";
 var stopCommand;
 var init_stop = __esm({
   "src/commands/stop.ts"() {
@@ -10156,7 +10594,7 @@ var init_stop = __esm({
     init_compose();
     init_proxy();
     init_dispatch();
-    stopCommand = defineCommand28({
+    stopCommand = defineCommand29({
       meta: {
         name: "stop",
         group: "run",
@@ -10181,10 +10619,10 @@ var init_stop = __esm({
           });
           try {
             await maybeStopProxy({
-              logger: { info: (msg) => consola32.info(msg) }
+              logger: { info: (msg) => consola34.info(msg) }
             });
           } catch (err) {
-            consola32.warn(
+            consola34.warn(
               `Could not tear down the Traefik proxy: ${err instanceof Error ? err.message : String(err)}. Ignored.`
             );
           }
@@ -10196,11 +10634,11 @@ var init_stop = __esm({
 });
 
 // src/tunnel/resolve.ts
-import { existsSync as existsSync18 } from "fs";
-import path27 from "path";
+import { existsSync as existsSync20 } from "fs";
+import path29 from "path";
 async function resolveTunnelTarget(opts) {
   const ymlPath = containerConfigPath(opts.name, opts.monocerosHome);
-  if (!existsSync18(ymlPath)) {
+  if (!existsSync20(ymlPath)) {
     throw new Error(
       `No yml profile for '${opts.name}' at ${ymlPath}. Run \`monoceros init ${opts.name}\` first.`
     );
@@ -10208,13 +10646,13 @@ async function resolveTunnelTarget(opts) {
   const parsed = await readConfig(ymlPath);
   const config = parsed.config;
   const containerRoot = containerDir(opts.name, opts.monocerosHome);
-  if (!existsSync18(containerRoot)) {
+  if (!existsSync20(containerRoot)) {
     throw new Error(
       `Container '${opts.name}' is not materialised at ${containerRoot}. Run \`monoceros apply ${opts.name}\` first.`
     );
   }
-  const composePath = path27.join(containerRoot, ".devcontainer", "compose.yaml");
-  const isCompose = existsSync18(composePath);
+  const composePath = path29.join(containerRoot, ".devcontainer", "compose.yaml");
+  const isCompose = existsSync20(composePath);
   const parsedTarget = parseTargetArg(opts.target, config);
   const docker = opts.docker ?? defaultDockerExec;
   if (isCompose) {
@@ -10449,8 +10887,8 @@ var init_port_check2 = __esm({
 });
 
 // src/tunnel/run.ts
-import { spawn as spawn10 } from "child_process";
-import { consola as consola33 } from "consola";
+import { spawn as spawn12 } from "child_process";
+import { consola as consola35 } from "consola";
 function signalNumber(signal) {
   switch (signal) {
     case "SIGINT":
@@ -10463,8 +10901,8 @@ function signalNumber(signal) {
 }
 async function runTunnel(opts) {
   const log = opts.logger ?? {
-    info: (m) => consola33.info(m),
-    warn: (m) => consola33.warn(m)
+    info: (m) => consola35.info(m),
+    warn: (m) => consola35.warn(m)
   };
   const resolve = opts.resolve ?? resolveTunnelTarget;
   const resolveArgs3 = {
@@ -10539,7 +10977,7 @@ var init_run3 = __esm({
     init_port_check2();
     SOCAT_IMAGE = "alpine/socat:1.8.0.3";
     defaultDockerSpawn = (args) => {
-      const child = spawn10("docker", args, {
+      const child = spawn12("docker", args, {
         stdio: "inherit"
       });
       const exited = new Promise((resolve, reject) => {
@@ -10570,8 +11008,8 @@ var init_run3 = __esm({
 });
 
 // src/commands/tunnel.ts
-import { defineCommand as defineCommand29 } from "citty";
-import { consola as consola34 } from "consola";
+import { defineCommand as defineCommand30 } from "citty";
+import { consola as consola36 } from "consola";
 function parseLocalPort(raw) {
   if (raw === void 0) return void 0;
   const n = Number(raw);
@@ -10587,7 +11025,7 @@ var init_tunnel = __esm({
   "src/commands/tunnel.ts"() {
     "use strict";
     init_run3();
-    tunnelCommand = defineCommand29({
+    tunnelCommand = defineCommand30({
       meta: {
         name: "tunnel",
         group: "discovery",
@@ -10624,7 +11062,7 @@ var init_tunnel = __esm({
           });
           process.exit(exitCode);
         } catch (err) {
-          consola34.error(err instanceof Error ? err.message : String(err));
+          consola36.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -10694,8 +11132,8 @@ var init_prune = __esm({
 });
 
 // src/upgrade/index.ts
-import { existsSync as existsSync19, promises as fs17 } from "fs";
-import { consola as consola35 } from "consola";
+import { existsSync as existsSync21, promises as fs18 } from "fs";
+import { consola as consola37 } from "consola";
 async function fetchRuntimeVersions() {
   const tokenUrl = `https://ghcr.io/token?service=ghcr.io&scope=repository:${RUNTIME_REPO}:pull`;
   const tokenRes = await fetch(tokenUrl);
@@ -10733,7 +11171,7 @@ ${yml}`;
 }
 async function runUpgrade(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
-  const logger = opts.logger ?? consola35;
+  const logger = opts.logger ?? consola37;
   const fetchVersions = opts.fetchVersions ?? fetchRuntimeVersions;
   if (opts.list) {
     const versions = await fetchVersions();
@@ -10759,7 +11197,7 @@ async function runUpgrade(opts) {
       );
     }
   }
-  if (opts.name && !existsSync19(containerConfigPath(opts.name, home))) {
+  if (opts.name && !existsSync21(containerConfigPath(opts.name, home))) {
     throw new Error(
       `No such config: ${containerConfigPath(opts.name, home)}. Run \`monoceros init <template> ${opts.name}\` first.`
     );
@@ -10810,11 +11248,11 @@ async function runUpgrade(opts) {
   let bumped = 0;
   for (const name of targets) {
     const ymlPath = containerConfigPath(name, home);
-    if (!existsSync19(ymlPath)) continue;
-    const raw = await fs17.readFile(ymlPath, "utf8");
+    if (!existsSync21(ymlPath)) continue;
+    const raw = await fs18.readFile(ymlPath, "utf8");
     const updated = setRuntimeVersion(raw, pinVersion);
     if (updated !== raw) {
-      await fs17.writeFile(ymlPath, updated);
+      await fs18.writeFile(ymlPath, updated);
       bumped += 1;
       logger.info(`Pinned '${name}' to runtime ${pinVersion}.`);
     }
@@ -10856,7 +11294,7 @@ function formatPruneLine(prune) {
 }
 async function listContainerNames2(home) {
   try {
-    const entries = await fs17.readdir(containerConfigsDir(home));
+    const entries = await fs18.readdir(containerConfigsDir(home));
     return entries.filter((e) => e.endsWith(".yml")).map((e) => e.slice(0, -".yml".length));
   } catch {
     return [];
@@ -10879,7 +11317,7 @@ var init_upgrade = __esm({
 });
 
 // src/commands/upgrade.ts
-import { defineCommand as defineCommand30 } from "citty";
+import { defineCommand as defineCommand31 } from "citty";
 var upgradeCommand;
 var init_upgrade2 = __esm({
   "src/commands/upgrade.ts"() {
@@ -10887,7 +11325,7 @@ var init_upgrade2 = __esm({
     init_upgrade();
     init_version();
     init_dispatch();
-    upgradeCommand = defineCommand30({
+    upgradeCommand = defineCommand31({
       meta: {
         name: "upgrade",
         group: "lifecycle",
@@ -10929,7 +11367,7 @@ var main_exports = {};
 __export(main_exports, {
   main: () => main
 });
-import { defineCommand as defineCommand31 } from "citty";
+import { defineCommand as defineCommand32 } from "citty";
 var main;
 var init_main = __esm({
   "src/main.ts"() {
@@ -10947,6 +11385,7 @@ var init_main = __esm({
     init_init2();
     init_list_components();
     init_logs();
+    init_open2();
     init_port();
     init_remove_apt_packages();
     init_remove_feature();
@@ -10965,7 +11404,7 @@ var init_main = __esm({
     init_tunnel();
     init_upgrade2();
     init_version();
-    main = defineCommand31({
+    main = defineCommand32({
       meta: {
         name: "monoceros",
         version: CLI_VERSION,
@@ -10975,6 +11414,7 @@ var init_main = __esm({
         init: initCommand,
         "list-components": listComponentsCommand,
         shell: shellCommand,
+        open: openCommand,
         run: runCommand,
         logs: logsCommand,
         start: startCommand,
@@ -11261,25 +11701,25 @@ function detectHelpRequest(argv, main2) {
   const separatorIdx = argv.indexOf("--");
   if (helpIdx === -1) return null;
   if (separatorIdx !== -1 && separatorIdx < helpIdx) return null;
-  const path28 = [];
+  const path30 = [];
   const tokens = argv.slice(
     0,
     separatorIdx === -1 ? argv.length : separatorIdx
   );
   let cursor = main2;
   const mainName = (main2.meta ?? {}).name ?? "monoceros";
-  path28.push(mainName);
+  path30.push(mainName);
   for (const tok of tokens) {
     if (tok.startsWith("-")) continue;
     const subs = cursor.subCommands ?? {};
     if (tok in subs) {
       cursor = subs[tok];
-      path28.push(tok);
+      path30.push(tok);
       continue;
     }
     break;
   }
-  return { path: path28, cmd: cursor };
+  return { path: path30, cmd: cursor };
 }
 async function maybeRenderHelp(argv, main2) {
   const hit = detectHelpRequest(argv, main2);