@getmonoceros/workbench 1.36.0 → 1.36.2

package/dist/bin.js

@@ -2860,7 +2860,7 @@ function windowsSshPort(name) {
   for (let i = 0; i < name.length; i++) {
     h = h * 31 + name.charCodeAt(i) >>> 0;
   }
-  return 49152 + h % 16384;
+  return 2e4 + h % 2e4;
 }
 function windowsHostBlock(hostAlias, keyWin, port) {
   const head = [
@@ -4451,6 +4451,33 @@ function generateAgentsMd(input) {
       "the URL, so they can open it themselves if no bridge is active."
     );
     lines.push("");
+    lines.push("### Dev servers (so the proxy and LAN can reach them)");
+    lines.push("");
+    lines.push(
+      "A dev server you start must be reachable through the Monoceros proxy",
+      "(and, when the user shares it to their phone/LAN, over the network).",
+      "Configure it so:"
+    );
+    lines.push("");
+    lines.push(
+      "- it **listens on `0.0.0.0`**, not `127.0.0.1` (otherwise the proxy",
+      "  cannot reach it);",
+      "- it **accepts the proxy/LAN hostnames** \u2014 Vite `server.allowedHosts`,",
+      "  Angular `--allowed-hosts`, CRA `DANGEROUSLY_DISABLE_HOST_CHECK`;",
+      "- it does **not pin the HMR/live-reload socket** to a fixed host or port",
+      "  \u2014 let it follow the page URL (e.g. for Vite, do not set",
+      "  `server.hmr.clientPort`), so HMR works on `<name>.localhost` and over",
+      "  the LAN alike;",
+      "- the **backend is reached via the dev-server proxy** under a relative",
+      "  path (Vite `server.proxy`, Angular `proxy.conf.json`, CRA",
+      "  `setupProxy.js`) so the browser only ever talks to one origin."
+    );
+    lines.push("");
+    lines.push(
+      "These are dev-server-only settings (a production build ignores them), so",
+      "they are safe to keep."
+    );
+    lines.push("");
   }
   lines.push("## How to extend this container");
   lines.push("");
@@ -7012,7 +7039,7 @@ async function cleanupDockerObjects(opts) {
   return { exitCode: rmExit, removedIds: ids };
 }
 function composeProjectName(root) {
-  return `${path18.basename(root)}_devcontainer`;
+  return `${path18.basename(root)}_devcontainer`.toLowerCase().replace(/[^a-z0-9_-]/g, "");
 }
 function assertDevcontainer(root) {
   if (!existsSync10(path18.join(root, ".devcontainer"))) {
@@ -8772,7 +8799,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "1.36.0" : "dev";
+    CLI_VERSION = true ? "1.36.2" : "dev";
   }
 });
 
@@ -9324,6 +9351,22 @@ async function listAppCandidates(ctx) {
     return [];
   }
 }
+async function listAppOrServiceCandidates(ctx) {
+  const name = containerNameFromCtx(ctx);
+  if (!name) return [];
+  const apps = await listApps(name, ctx.opts.monocerosHome).catch(() => []);
+  let services = [];
+  try {
+    const parsed = await readConfig(
+      containerConfigPath(name, ctx.opts.monocerosHome)
+    );
+    services = solutionConfigToCreateOptions(parsed.config).services.map(
+      (s) => s.name
+    );
+  } catch {
+  }
+  return [.../* @__PURE__ */ new Set([...apps, ...services])].sort();
+}
 async function listTargetCandidates(ctx) {
   const name = containerNameFromCtx(ctx);
   const app = positionalFromCtx(ctx, 1);
@@ -9437,6 +9480,8 @@ var init_resolve = __esm({
   "src/completion/resolve.ts"() {
     "use strict";
     init_paths();
+    init_io();
+    init_transform();
     init_launch_config();
     init_components();
     init_manifest();
@@ -9476,6 +9521,7 @@ var init_resolve = __esm({
       "remove-port",
       "port",
       "tunnel",
+      "share",
       "completion"
     ];
     containerName = (ctx) => listContainerNames(ctx);
@@ -9543,7 +9589,9 @@ var init_resolve = __esm({
           "--target": { type: "value", values: (ctx) => listTargetCandidates(ctx) }
         }
       },
-      status: { positionals: [containerName] },
+      status: {
+        positionals: [containerName, (ctx) => listAppOrServiceCandidates(ctx)]
+      },
       "list-apps": { positionals: [containerName] },
       "add-language": {
         positionals: [containerName, () => listLanguageNames()]
@@ -9613,6 +9661,9 @@ var init_resolve = __esm({
           "--local-address": { type: "value" }
         }
       },
+      share: {
+        positionals: [containerName, (ctx) => listAppCandidates(ctx)]
+      },
       completion: {
         positionals: [() => listShellNames()]
       },
@@ -11921,530 +11972,494 @@ var init_run2 = __esm({
   }
 });
 
-// src/commands/shell.ts
-import { defineCommand as defineCommand29 } from "citty";
-import { consola as consola34 } from "consola";
-var shellCommand;
-var init_shell2 = __esm({
-  "src/commands/shell.ts"() {
-    "use strict";
-    init_paths();
-    init_shell();
-    shellCommand = defineCommand29({
-      meta: {
-        name: "shell",
-        group: "run",
-        description: "Open an interactive bash session inside the named dev-container."
-      },
-      args: {
-        name: {
-          type: "positional",
-          description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
-          required: true
-        }
-      },
-      async run({ args }) {
-        try {
-          const exitCode = await runShell({
-            root: containerDir(args.name),
-            name: args.name
-          });
-          process.exit(exitCode);
-        } catch (err) {
-          consola34.error(err instanceof Error ? err.message : String(err));
-          process.exit(1);
-        }
-      }
+// src/tunnel/resolve.ts
+import { existsSync as existsSync20 } from "fs";
+import path32 from "path";
+async function resolveTunnelTarget(opts) {
+  const ymlPath = containerConfigPath(opts.name, opts.monocerosHome);
+  if (!existsSync20(ymlPath)) {
+    throw new Error(
+      `No yml profile for '${opts.name}' at ${ymlPath}. Run \`monoceros init ${opts.name}\` first.`
+    );
+  }
+  const parsed = await readConfig(ymlPath);
+  const config = parsed.config;
+  const containerRoot = containerDir(opts.name, opts.monocerosHome);
+  if (!existsSync20(containerRoot)) {
+    throw new Error(
+      `Container '${opts.name}' is not materialised at ${containerRoot}. Run \`monoceros apply ${opts.name}\` first.`
+    );
+  }
+  const composePath = path32.join(containerRoot, ".devcontainer", "compose.yaml");
+  const isCompose = existsSync20(composePath);
+  const parsedTarget = parseTargetArg(opts.target, config);
+  const docker = opts.docker ?? defaultDockerExec;
+  if (isCompose) {
+    return resolveCompose2({
+      name: opts.name,
+      containerRoot,
+      parsedTarget
     });
   }
-});
-
-// src/commands/start.ts
-import { defineCommand as defineCommand30 } from "citty";
-import { consola as consola35 } from "consola";
-async function bringContainerUp(name, openTool) {
-  {
-    const args = { name, open: openTool };
-    let needsProxy = false;
-    let hostPort = 80;
-    let deferred = [];
-    let runtimeVersion;
-    try {
-      const parsed = await readConfig(containerConfigPath(args.name));
-      runtimeVersion = parsed.config.runtimeVersion;
-      if ((parsed.config.routing?.ports ?? []).length > 0) {
-        needsProxy = true;
-        const global = await readMonocerosConfig();
-        hostPort = proxyHostPort(global);
-      }
-      deferred = (parsed.config.services ?? []).filter((s) => serviceDefersStart(s.name)).map((s) => s.name);
-    } catch (err) {
-      consola35.warn(
-        `Could not read container yml ahead of start: ${err instanceof Error ? err.message : String(err)}. Skipping Traefik pre-flight.`
+  return resolveImageMode({
+    name: opts.name,
+    containerRoot,
+    parsedTarget,
+    config,
+    docker
+  });
+}
+function parseTargetArg(raw, config) {
+  const colon = raw.indexOf(":");
+  if (colon > 0) {
+    const name = raw.slice(0, colon);
+    const port = Number(raw.slice(colon + 1));
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      throw new Error(
+        `Invalid target '${raw}'. Use <service>:<port> with a numeric port (1\u201365535), a bare port number, or a configured service name.`
       );
     }
-    if (needsProxy) {
-      await preflightHostPort(hostPort);
-      await ensureProxy({ hostPort });
-    }
-    const exitCode = await runStart({
-      root: containerDir(args.name),
-      silent: true,
-      logger: { info: () => {
-      } }
-    });
-    if (exitCode === 0 && runtimeSupportsBrowserBridge(runtimeVersion)) {
-      spawnBridgeDaemon(containerDir(args.name));
-    }
-    if (exitCode === 0 && deferred.length > 0) {
-      try {
-        const deferExit = await startDeferredServices({
-          root: containerDir(args.name),
-          services: deferred,
-          logger: consola35
-        });
-        if (deferExit !== 0) {
-          consola35.warn(
-            `Deferred service(s) ${deferred.join(", ")} did not start cleanly (exit ${deferExit}).`
-          );
-        }
-      } catch (err) {
-        consola35.warn(
-          `Could not start deferred service(s) ${deferred.join(", ")}: ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-    }
-    if (exitCode === 0) {
-      consola35.success(`Container '${args.name}' is up.`);
-    }
-    if (args.open && exitCode === 0) {
-      try {
-        await runOpen({ name: args.name, tool: args.open });
-      } catch (err) {
-        consola35.warn(err instanceof Error ? err.message : String(err));
-      }
-    }
-    return exitCode;
+    findConfiguredService(config, name);
+    return { kind: "service", service: name, port };
   }
-}
-var startCommand;
-var init_start = __esm({
-  "src/commands/start.ts"() {
-    "use strict";
-    init_global();
-    init_io();
-    init_paths();
-    init_bridge_daemon();
-    init_compose();
-    init_catalog();
-    init_open();
-    init_proxy();
-    init_port_check();
-    init_app_control();
-    init_dispatch();
-    startCommand = defineCommand30({
-      meta: {
-        name: "start",
-        group: "run",
-        description: "Bring the named dev-container up. With an <app>, start that app inside it (per its projects/<app>/.monoceros/launch.json); the container is brought up first if needed."
-      },
-      args: {
-        name: {
-          type: "positional",
-          description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
-          required: true
-        },
-        app: {
-          type: "positional",
-          description: "App to start (a path under projects/ with .monoceros/launch.json). Omit to just bring the container up.",
-          required: false
-        },
-        target: {
-          type: "string",
-          description: `Which launch target to start (defaults to the app's "default" target, or its only one).`
-        },
-        open: {
-          type: "string",
-          description: `After a successful start, open the container in this tool (${OPEN_TOOLS.join("|")}).`
-        }
-      },
-      run({ args }) {
-        if (typeof args.app === "string" && args.app.length > 0) {
-          const app = args.app;
-          const target = typeof args.target === "string" ? args.target : void 0;
-          return dispatch(async () => {
-            if (!await findRunningContainer(args.name)) {
-              const up = await bringContainerUp(args.name, void 0);
-              if (up !== 0) return up;
-            }
-            return runAppCtl(args.name, ctlArgs("start", app, target));
-          });
-        }
-        return dispatch(
-          () => bringContainerUp(
-            args.name,
-            typeof args.open === "string" ? args.open : void 0
-          )
-        );
-      }
-    });
+  const asNumber = Number(raw);
+  if (Number.isInteger(asNumber) && asNumber > 0 && asNumber < 65536) {
+    return { kind: "port", port: asNumber };
   }
-});
-
-// src/status/index.ts
-function shortFeatureName2(ref) {
-  const withoutTag = ref.replace(/:[^:/@]+$/, "");
-  const idx = withoutTag.lastIndexOf("/");
-  return idx >= 0 ? withoutTag.slice(idx + 1) : withoutTag;
-}
-function cols(line) {
-  return line.split("	");
+  const match = findConfiguredService(config, raw);
+  if (match.port === void 0) {
+    throw new Error(
+      `Service '${raw}' declares no port, so tunnel can't know what to forward. Add \`port: <n>\` to the service in the yml and re-apply, or pass one explicitly: \`monoceros tunnel <name> ${raw}:<port>\`.`
+    );
+  }
+  return { kind: "service", service: raw, port: match.port };
 }
-function nonEmptyLines(s) {
-  return s.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+function findConfiguredService(config, name) {
+  const services = config.services.map(resolveService);
+  const match = services.find((s) => s.name === name);
+  if (!match) {
+    const names = services.map((s) => s.name);
+    const list = names.length > 0 ? names.join(", ") : "(none configured)";
+    throw new Error(
+      `Service '${name}' is not configured in this container's yml. Configured services: ${list}. Or pass a port number (e.g. \`monoceros tunnel <name> 8080\`).`
+    );
+  }
+  return match;
 }
-async function gatherStatus(name, opts = {}) {
-  const docker = opts.docker ?? realDockerLookup;
-  const root = containerDir(name, opts.home);
-  let runtimeVersion;
-  let languages = [];
-  let features = [];
-  let declaredServices = [];
-  let declaredPorts = [];
-  let configured = false;
-  try {
-    const parsed = await readConfig(containerConfigPath(name, opts.home));
-    const createOpts = solutionConfigToCreateOptions(parsed.config);
-    configured = true;
-    runtimeVersion = createOpts.runtimeVersion;
-    languages = createOpts.languages;
-    features = Object.keys(createOpts.features ?? {}).map(shortFeatureName2);
-    declaredServices = createOpts.services.map((s) => ({
-      name: s.name,
-      ...typeof s.port === "number" ? { port: s.port } : {}
-    }));
-    declaredPorts = createOpts.ports ?? [];
-  } catch {
+function resolveCompose2(args) {
+  const network = `${composeProjectName(args.containerRoot)}_default`;
+  if (args.parsedTarget.kind === "service") {
+    return {
+      network,
+      targetHost: args.parsedTarget.service,
+      internalPort: args.parsedTarget.port,
+      display: `${args.name}/${args.parsedTarget.service}:${args.parsedTarget.port}`
+    };
   }
-  let container = {
-    exists: false,
-    running: false,
-    status: "",
-    dockerName: ""
+  return {
+    network,
+    targetHost: "workspace",
+    internalPort: args.parsedTarget.port,
+    display: `${args.name}:${args.parsedTarget.port}`
   };
-  let containerId = "";
-  let composeProject = "";
-  const cps = await docker([
+}
+async function resolveImageMode(args) {
+  if (args.parsedTarget.kind === "service") {
+    throw new Error(
+      `Service '${args.parsedTarget.service}' is declared in the yml but '${args.name}' is image-mode (no compose.yaml). Services need compose mode \u2014 re-apply with at least one \`services:\` entry to get a compose setup.`
+    );
+  }
+  const ports = args.config.routing?.ports ?? [];
+  if (ports.length > 0) {
+    return {
+      network: PROXY_NETWORK_NAME,
+      targetHost: args.name,
+      internalPort: args.parsedTarget.port,
+      display: `${args.name}:${args.parsedTarget.port}`
+    };
+  }
+  const { network, ip } = await lookupContainerNetwork({
+    containerRoot: args.containerRoot,
+    docker: args.docker
+  });
+  return {
+    network,
+    targetHost: ip,
+    internalPort: args.parsedTarget.port,
+    display: `${args.name}:${args.parsedTarget.port}`
+  };
+}
+async function lookupContainerNetwork(args) {
+  const psResult = await args.docker([
     "ps",
-    "-a",
-    "--no-trunc",
+    "-q",
     "--filter",
-    `label=devcontainer.local_folder=${root}`,
-    "--format",
-    '{{.ID}}	{{.State}}	{{.Status}}	{{.Names}}	{{.Label "com.docker.compose.project"}}'
+    `label=devcontainer.local_folder=${args.containerRoot}`
   ]);
-  const row2 = nonEmptyLines(cps.stdout)[0];
-  if (row2) {
-    const [id, state, status, names, project] = cols(row2);
-    containerId = id ?? "";
-    composeProject = project ?? "";
-    container = {
-      exists: true,
-      running: state === "running",
-      status: status ?? "",
-      dockerName: names ?? ""
-    };
-  }
-  const services = [];
-  if (declaredServices.length > 0) {
-    const live = /* @__PURE__ */ new Map();
-    if (composeProject) {
-      const sps = await docker([
-        "ps",
-        "-a",
-        "--filter",
-        `label=com.docker.compose.project=${composeProject}`,
-        "--format",
-        '{{.Label "com.docker.compose.service"}}	{{.State}}	{{.Status}}'
-      ]);
-      for (const l of nonEmptyLines(sps.stdout)) {
-        const [svc, state, status] = cols(l);
-        if (svc)
-          live.set(svc, { running: state === "running", status: status ?? "" });
-      }
-    }
-    for (const s of declaredServices) {
-      const m = live.get(s.name);
-      services.push({
-        name: s.name,
-        running: m?.running ?? false,
-        status: m?.status ?? "not created",
-        ...typeof s.port === "number" ? { port: s.port } : {}
-      });
-    }
-  }
-  const apps = [];
-  for (const app of await listApps(name, opts.home)) {
-    const cfg = await readLaunchConfig(name, app, opts.home);
-    if (!cfg) continue;
-    for (const t of cfg.configurations) {
-      apps.push({
-        app,
-        target: t.name,
-        port: typeof t.port === "number" ? t.port : null,
-        default: t.default === true,
-        running: void 0,
-        pid: null
-      });
-    }
+  if (psResult.exitCode !== 0) {
+    throw new Error(
+      `docker ps failed: ${psResult.stderr.trim() || `exit ${psResult.exitCode}`}`
+    );
   }
-  const appsSupported = runtimeSupportsAppStatus(runtimeVersion);
-  let appStateKnown = container.running && appsSupported && containerId !== "";
-  let appStateNote;
-  if (appStateKnown) {
-    const res = await docker([
-      "exec",
-      containerId,
-      "monoceros-ctl",
-      "list",
-      "--json"
-    ]);
-    if (res.exitCode === 0) {
-      const byKey = /* @__PURE__ */ new Map();
-      for (const l of nonEmptyLines(res.stdout)) {
-        try {
-          const o = JSON.parse(l);
-          byKey.set(`${o.app}\0${o.target}`, {
-            running: !!o.running,
-            pid: o.pid ?? null
-          });
-        } catch {
-        }
-      }
-      for (const a of apps) {
-        const o = byKey.get(`${a.app}\0${a.target}`);
-        if (o) {
-          a.running = o.running;
-          a.pid = o.pid;
-        } else {
-          a.running = false;
-        }
-      }
-    } else {
-      appStateKnown = false;
-      appStateNote = `could not read run state from the runner - rebuild the runtime image, then \`monoceros upgrade ${name}\``;
-    }
+  const containerId = psResult.stdout.trim().split("\n")[0]?.trim();
+  if (!containerId) {
+    throw new Error(
+      `No running container for '${args.containerRoot}'. Start it with \`monoceros start <name>\` (or open a shell with \`monoceros shell <name>\`) and retry.`
+    );
   }
-  if (apps.length > 0 && !appStateKnown && !appStateNote) {
-    appStateNote = !container.running ? `start the container to see run state (\`monoceros start ${name}\`)` : `run state needs runtime 1.6.0+ (this one: ${runtimeVersion ?? "unpinned"})`;
+  const inspect = await args.docker([
+    "inspect",
+    "--format",
+    "{{json .NetworkSettings.Networks}}",
+    containerId
+  ]);
+  if (inspect.exitCode !== 0) {
+    throw new Error(
+      `docker inspect failed: ${inspect.stderr.trim() || `exit ${inspect.exitCode}`}`
+    );
   }
-  let hostPort = 80;
+  let networks = null;
   try {
-    hostPort = proxyHostPort(
-      await readMonocerosConfig({
-        ...opts.home ? { monocerosHome: opts.home } : {}
-      })
-    );
+    networks = JSON.parse(inspect.stdout);
   } catch {
+    throw new Error(
+      `Unexpected docker inspect output: ${inspect.stdout.slice(0, 200)}`
+    );
   }
-  const ports = proxyUrlsFor(name, declaredPorts, hostPort);
-  return {
-    name,
-    configured,
-    container,
-    services,
-    apps,
-    appStateKnown,
-    ...appStateNote ? { appStateNote } : {},
-    ports,
-    builtIn: { languages, features }
-  };
-}
-function row(p, marker, name, detail, pad, indent = 2) {
-  const gap = Math.max(2, pad - name.length + 2);
-  return `${" ".repeat(indent)}${marker} ${p.cyan(name)}${" ".repeat(gap)}${detail}`;
-}
-function liveMarker(p, running) {
-  if (running === void 0) return " ";
-  return running ? p.green("\u2713") : p.dim("\xB7");
-}
-function renderContainer(p, m) {
-  const out = [p.sectionLine(m.name)];
-  if (!m.container.exists) {
-    out.push(
-      row(
-        p,
-        p.dim("\xB7"),
-        "(not created)",
-        p.dim(`run \`monoceros apply ${m.name}\``),
-        14
-      )
+  if (!networks) {
+    throw new Error(
+      `Container ${containerId} reports no networks. Restart it and retry.`
     );
-    return out;
   }
-  const detail = m.container.running ? p.dim(m.container.status || "running") : p.dim(m.container.status || "stopped");
-  out.push(
-    row(
-      p,
-      liveMarker(p, m.container.running),
-      m.container.dockerName,
-      detail,
-      14
-    )
+  for (const [name, settings] of Object.entries(networks)) {
+    if (settings.IPAddress && settings.IPAddress.length > 0) {
+      return { network: name, ip: settings.IPAddress };
+    }
+  }
+  throw new Error(
+    `Container ${containerId} has no network with a reachable IP. Restart it and retry.`
   );
-  return out;
 }
-function renderServices(p, m) {
-  if (m.services.length === 0) return [];
-  const pad = Math.max(...m.services.map((s) => s.name.length));
-  const out = ["", p.sectionLine("Services")];
-  for (const s of m.services) {
-    const detail = s.running ? p.dim(typeof s.port === "number" ? `running    :${s.port}` : "running") : p.dim(s.status || "stopped");
-    out.push(row(p, liveMarker(p, s.running), s.name, detail, pad));
+var init_resolve2 = __esm({
+  "src/tunnel/resolve.ts"() {
+    "use strict";
+    init_paths();
+    init_io();
+    init_compose();
+    init_catalog();
+    init_proxy();
   }
-  return out;
+});
+
+// src/tunnel/port-check.ts
+import { Socket as Socket2 } from "net";
+async function preflightLocalPort(opts) {
+  const probe = opts.probe ?? realPortProbe2;
+  const result = await probe(opts.port, opts.address);
+  if (result.ok) return;
+  throw new Error(formatLocalPortHeldError(opts.port, opts.address, result));
 }
-function appTargetDetail(p, name, t) {
-  const bits = [];
-  if (t.running === true) {
-    bits.push(
-      t.port !== null ? p.dim(`http://${name}-${t.port}.localhost`) : p.dim("running")
+function formatLocalPortHeldError(port, address, result) {
+  const lines = [];
+  if (result.code === "EADDRINUSE") {
+    lines.push(`Local port ${port} on ${address} is already in use.`);
+    lines.push("");
+    lines.push("Identify the holder, then either stop it or pick a different");
+    lines.push("port for the tunnel:");
+    lines.push("");
+    lines.push(`  sudo lsof -iTCP:${port} -sTCP:LISTEN -n -P`);
+    lines.push(`  # or:   sudo ss -tlnp | grep ":${port}\\b"`);
+    lines.push("");
+    lines.push("Re-run with an explicit local port:");
+    lines.push(`  monoceros tunnel \u2026 --local-port=${port + 1}`);
+  } else {
+    lines.push(
+      `Cannot probe local port ${port} on ${address}: ${result.message}`
     );
-    if (t.pid !== null) bits.push(p.dim(`pid ${t.pid}`));
-  } else if (t.running === false) {
-    bits.push(p.dim("stopped"));
+    lines.push("");
+    lines.push(
+      "Most likely the host network stack (firewall, namespace) is interfering."
+    );
+    lines.push("Try a different local port via `--local-port=<n>`.");
   }
-  if (t.default) bits.push(p.dim("(default)"));
-  return bits.join("    ");
+  return lines.join("\n");
 }
-function renderApps(p, m) {
-  if (m.apps.length === 0) return [];
-  const out = ["", p.sectionLine("Apps")];
-  if (m.appStateNote) out.push(`  ${p.dim(m.appStateNote)}`);
-  const byApp = /* @__PURE__ */ new Map();
-  for (const a of m.apps) {
-    const list = byApp.get(a.app) ?? [];
-    list.push(a);
-    byApp.set(a.app, list);
+var CONNECT_TIMEOUT_MS2, realPortProbe2;
+var init_port_check2 = __esm({
+  "src/tunnel/port-check.ts"() {
+    "use strict";
+    CONNECT_TIMEOUT_MS2 = 750;
+    realPortProbe2 = (port, address) => {
+      const probeHost = address === "0.0.0.0" ? "127.0.0.1" : address;
+      return new Promise((resolve) => {
+        const socket = new Socket2();
+        let settled = false;
+        const settle = (result) => {
+          if (settled) return;
+          settled = true;
+          socket.destroy();
+          resolve(result);
+        };
+        socket.setTimeout(CONNECT_TIMEOUT_MS2);
+        socket.once("connect", () => {
+          settle({
+            ok: false,
+            code: "EADDRINUSE",
+            message: `another process is listening on ${port}`
+          });
+        });
+        socket.once("timeout", () => {
+          settle({ ok: true });
+        });
+        socket.once("error", (err) => {
+          const code = err.code ?? "UNKNOWN";
+          if (code === "ECONNREFUSED") {
+            settle({ ok: true });
+          } else {
+            settle({ ok: false, code, message: err.message });
+          }
+        });
+        socket.connect(port, probeHost);
+      });
+    };
   }
-  for (const [app, targets] of byApp) {
-    out.push(`  ${p.cyan(app)}`);
-    const pad = Math.max(...targets.map((t) => t.target.length));
-    for (const t of targets) {
-      out.push(
-        row(
-          p,
-          liveMarker(p, t.running),
-          t.target,
-          appTargetDetail(p, m.name, t),
-          pad,
-          4
-        )
-      );
-    }
+});
+
+// src/tunnel/run.ts
+import { spawn as spawn14 } from "child_process";
+import { consola as consola34 } from "consola";
+function signalNumber(signal) {
+  switch (signal) {
+    case "SIGINT":
+      return 2;
+    case "SIGTERM":
+      return 15;
+    default:
+      return 1;
   }
-  return out;
 }
-function renderPorts(p, m) {
-  if (m.ports.length === 0) return [];
-  const pad = Math.max(...m.ports.map((r) => String(r.port).length));
-  const out = ["", p.sectionLine("Ports")];
-  for (const r of m.ports) {
-    const hosts = r.isDefault ? `${m.name}.localhost \xB7 ${m.name}-${r.port}.localhost` : `${m.name}-${r.port}.localhost`;
-    out.push(row(p, " ", String(r.port), p.dim(hosts), pad));
+async function runTunnel(opts) {
+  const log = opts.logger ?? {
+    info: (m) => consola34.info(m),
+    warn: (m) => consola34.warn(m)
+  };
+  const resolve = opts.resolve ?? resolveTunnelTarget;
+  const resolveArgs3 = {
+    name: opts.name,
+    target: opts.target,
+    ...opts.monocerosHome !== void 0 ? { monocerosHome: opts.monocerosHome } : {}
+  };
+  const resolved = await resolve(resolveArgs3);
+  const localPort = opts.localPort ?? resolved.internalPort;
+  const localAddress = opts.localAddress ?? DEFAULT_LOCAL_ADDRESS;
+  validateLocalAddress(localAddress);
+  const preflight = opts.preflight ?? preflightLocalPort;
+  await preflight({ port: localPort, address: localAddress });
+  const dockerSpawn = opts.dockerSpawn ?? defaultDockerSpawn;
+  const installSignalHandler = opts.installSignalHandler ?? installSigintDefault;
+  const dockerArgs = buildDockerArgs({
+    localAddress,
+    localPort,
+    internalPort: resolved.internalPort,
+    network: resolved.network,
+    targetHost: resolved.targetHost
+  });
+  log.info(
+    `Tunnel: ${localAddress}:${localPort} \u2192 ${resolved.display}:${resolved.internalPort} (Ctrl+C to stop)`
+  );
+  const handle = dockerSpawn(dockerArgs);
+  const uninstall = installSignalHandler(() => {
+  });
+  try {
+    const exitCode = await handle.exited;
+    if (exitCode === 130) return 0;
+    return exitCode;
+  } finally {
+    uninstall();
   }
-  return out;
 }
-function renderBuiltIn(p, m) {
-  const lines = [];
-  if (m.builtIn.languages.length > 0)
-    lines.push({ label: "Languages", values: m.builtIn.languages });
-  if (m.builtIn.features.length > 0)
-    lines.push({ label: "Features", values: m.builtIn.features });
-  if (lines.length === 0) return [];
-  const labelWidth = Math.max(...lines.map((l) => l.label.length));
-  const out = ["", `${p.sectionLine("Built in")}  ${p.dim("from the yml")}`];
-  for (const l of lines) {
-    out.push(`  ${l.label.padEnd(labelWidth)}  ${p.cyan(l.values.join(", "))}`);
+function buildDockerArgs(input) {
+  return [
+    "run",
+    "--rm",
+    "-i",
+    `--network=${input.network}`,
+    "-p",
+    `${input.localAddress}:${input.localPort}:${input.internalPort}`,
+    SOCAT_IMAGE,
+    `TCP-LISTEN:${input.internalPort},fork,reuseaddr`,
+    `TCP:${input.targetHost}:${input.internalPort}`
+  ];
+}
+function validateLocalAddress(addr) {
+  if (addr === "localhost") return;
+  if (IPV4_RE.test(addr)) {
+    for (const part of addr.split(".")) {
+      const n = Number(part);
+      if (n < 0 || n > 255) {
+        throw new Error(
+          `Invalid --local-address '${addr}': each dotted-quad octet must be 0-255.`
+        );
+      }
+    }
+    return;
   }
-  return out;
+  throw new Error(
+    `Invalid --local-address '${addr}'. Use 127.0.0.1 (default), 0.0.0.0, or a specific IPv4 address.`
+  );
 }
-function renderStatus(m, p) {
-  return [
-    ...renderContainer(p, m),
-    ...renderServices(p, m),
-    ...renderApps(p, m),
-    ...renderPorts(p, m),
-    ...renderBuiltIn(p, m)
-  ].join("\n");
+var SOCAT_IMAGE, defaultDockerSpawn, installSigintDefault, DEFAULT_LOCAL_ADDRESS, IPV4_RE;
+var init_run3 = __esm({
+  "src/tunnel/run.ts"() {
+    "use strict";
+    init_resolve2();
+    init_port_check2();
+    SOCAT_IMAGE = "alpine/socat:1.8.0.3";
+    defaultDockerSpawn = (args) => {
+      const child = spawn14("docker", args, {
+        stdio: "inherit"
+      });
+      const exited = new Promise((resolve, reject) => {
+        child.on("error", reject);
+        child.on("exit", (code, signal) => {
+          if (typeof code === "number") resolve(code);
+          else if (signal) resolve(128 + signalNumber(signal));
+          else resolve(0);
+        });
+      });
+      return {
+        exited,
+        kill: (signal) => {
+          try {
+            child.kill(signal);
+          } catch {
+          }
+        }
+      };
+    };
+    installSigintDefault = (handler) => {
+      process.on("SIGINT", handler);
+      return () => process.off("SIGINT", handler);
+    };
+    DEFAULT_LOCAL_ADDRESS = "127.0.0.1";
+    IPV4_RE = /^(\d{1,3}\.){3}\d{1,3}$/;
+  }
+});
+
+// src/share/run.ts
+import os3 from "os";
+import { consola as consola35 } from "consola";
+function realHostAddresses() {
+  let ip;
+  for (const list of Object.values(os3.networkInterfaces())) {
+    for (const addr of list ?? []) {
+      if (addr.family === "IPv4" && !addr.internal) {
+        ip = addr.address;
+        break;
+      }
+    }
+    if (ip) break;
+  }
+  const hn = os3.hostname();
+  const mdnsName = hn.endsWith(".local") ? hn : `${hn}.local`;
+  return { ...ip ? { ip } : {}, mdnsName };
 }
-function renderApp(m, app, p) {
-  const targets = m.apps.filter((a) => a.app === app);
-  if (targets.length === 0) {
-    const known = [...new Set(m.apps.map((a) => a.app))];
+async function runShare(opts) {
+  const log = opts.logger ?? {
+    info: (m) => consola35.info(m),
+    warn: (m) => consola35.warn(m)
+  };
+  const cfg = await readLaunchConfig(opts.name, opts.app, opts.monocerosHome);
+  if (!cfg) {
     throw new Error(
-      `No app "${app}" in ${m.name} (have: ${known.join(", ") || "none"}).`
+      `No launch config for '${opts.app}' (expected projects/${opts.app}/.monoceros/launch.json). Nothing to share.`
     );
   }
-  const out = [p.sectionLine(app)];
-  if (m.appStateNote) out.push(`  ${p.dim(m.appStateNote)}`);
-  const pad = Math.max(...targets.map((t) => t.target.length));
-  for (const t of targets) {
-    out.push(
-      row(
-        p,
-        liveMarker(p, t.running),
-        t.target,
-        appTargetDetail(p, m.name, t),
-        pad,
-        2
-      )
+  const ported = cfg.configurations.filter(
+    (t) => typeof t.port === "number"
+  );
+  if (ported.length === 0) {
+    throw new Error(
+      `No target in '${opts.app}' declares a port, so there is nothing to share. Add a \`port\` to a target in its launch.json.`
     );
   }
-  return out.join("\n");
-}
-function renderService(m, name, p) {
-  const s = m.services.find((svc) => svc.name === name);
-  if (!s) {
-    throw new Error(
-      `No service "${name}" in ${m.name} (have: ${m.services.map((x) => x.name).join(", ") || "none"}).`
+  const ports = [...new Set(ported.map((t) => t.port))];
+  const resolve = opts.resolve ?? resolveTunnelTarget;
+  const base = await resolve({
+    name: opts.name,
+    target: String(ports[0]),
+    ...opts.monocerosHome !== void 0 ? { monocerosHome: opts.monocerosHome } : {}
+  });
+  const preflight = opts.preflight ?? preflightLocalPort;
+  for (const port of ports) {
+    await preflight({ port, address: SHARE_ADDRESS });
+  }
+  const dockerSpawn = opts.dockerSpawn ?? defaultDockerSpawn;
+  const handles = ports.map(
+    (port) => dockerSpawn(
+      buildDockerArgs({
+        localAddress: SHARE_ADDRESS,
+        localPort: port,
+        internalPort: port,
+        network: base.network,
+        targetHost: base.targetHost
+      })
+    )
+  );
+  const { ip, mdnsName } = (opts.hostAddresses ?? realHostAddresses)();
+  const host = ip ?? mdnsName ?? "<host-ip>";
+  log.info(
+    `Sharing ${opts.name}/${opts.app} on the local network (Ctrl+C to stop):`
+  );
+  for (const t of ported) {
+    log.info(`  ${cyan2(t.name)}  http://${host}:${t.port}`);
+  }
+  if (mdnsName && ip) {
+    log.info(
+      dim(`  also reachable as http://${mdnsName}:<port> where mDNS resolves`)
     );
   }
-  const detail = s.running ? p.dim(typeof s.port === "number" ? `running    :${s.port}` : "running") : p.dim(s.status || "stopped");
-  return [
-    p.sectionLine("Services"),
-    row(p, liveMarker(p, s.running), s.name, detail, s.name.length)
-  ].join("\n");
+  const installSignalHandler = opts.installSignalHandler ?? installSigintDefault;
+  let stopping = false;
+  const uninstall = installSignalHandler(() => {
+    if (stopping) return;
+    stopping = true;
+    for (const h of handles) h.kill("SIGTERM");
+  });
+  try {
+    const codes = await Promise.all(handles.map((h) => h.exited));
+    const bad = codes.find((c) => c !== 0 && c !== 130);
+    return bad ?? 0;
+  } finally {
+    uninstall();
+  }
 }
-var init_status = __esm({
-  "src/status/index.ts"() {
+var SHARE_ADDRESS;
+var init_run4 = __esm({
+  "src/share/run.ts"() {
     "use strict";
-    init_io();
-    init_paths();
-    init_global();
-    init_transform();
     init_launch_config();
-    init_catalog();
-    init_locate_running();
-    init_dynamic();
+    init_resolve2();
+    init_port_check2();
+    init_run3();
     init_format();
+    SHARE_ADDRESS = "0.0.0.0";
   }
 });
 
-// src/commands/status.ts
-import { defineCommand as defineCommand31 } from "citty";
-var statusCommand;
-var init_status2 = __esm({
-  "src/commands/status.ts"() {
+// src/commands/share.ts
+import { defineCommand as defineCommand29 } from "citty";
+import { consola as consola36 } from "consola";
+var shareCommand;
+var init_share = __esm({
+  "src/commands/share.ts"() {
     "use strict";
-    init_status();
-    init_format();
-    init_dispatch();
-    statusCommand = defineCommand31({
+    init_run4();
+    shareCommand = defineCommand29({
       meta: {
-        name: "status",
-        group: "run",
-        description: "Show the dev-container at a glance: container, services and apps (up/down), the ports it routes, and what the yml built in. With an <app> (or a service name), narrow to just that."
+        name: "share",
+        group: "discovery",
+        description: "Expose an app's ports to the local network (phone, tablet, other devices) so any device can open it - reached via the host's LAN IP (or `.local` name). Every target in the app's launch.json that declares a port is shared. Foreground: Ctrl+C stops sharing. See ADR 0030."
       },
       args: {
         name: {
@@ -12454,49 +12469,149 @@ var init_status2 = __esm({
         },
         app: {
           type: "positional",
-          description: "Narrow to one app (a path under projects/ with .monoceros/launch.json) or one compose service (e.g. postgres). Omit for the whole stack.",
-          required: false
+          description: "App to share (a path under projects/ with .monoceros/launch.json). Every target with a `port` is exposed on the LAN.",
+          required: true
         }
       },
-      run({ args }) {
-        const filter = typeof args.app === "string" ? args.app : void 0;
-        return dispatch(async () => {
-          const model = await gatherStatus(args.name);
-          const p = colorsFor(process.stdout);
-          let block;
-          if (filter) {
-            const isApp = model.apps.some((a) => a.app === filter);
-            block = isApp ? renderApp(model, filter, p) : renderService(model, filter, p);
-          } else {
-            block = renderStatus(model, p);
-          }
-          process.stdout.write(`
-${block}
-`);
-          return 0;
-        });
+      async run({ args }) {
+        try {
+          const exitCode = await runShare({ name: args.name, app: args.app });
+          process.exit(exitCode);
+        } catch (err) {
+          consola36.error(err instanceof Error ? err.message : String(err));
+          process.exit(1);
+        }
       }
     });
   }
 });
 
-// src/commands/stop.ts
-import { defineCommand as defineCommand32 } from "citty";
-import { consola as consola36 } from "consola";
-var stopCommand;
-var init_stop = __esm({
-  "src/commands/stop.ts"() {
+// src/commands/shell.ts
+import { defineCommand as defineCommand30 } from "citty";
+import { consola as consola37 } from "consola";
+var shellCommand;
+var init_shell2 = __esm({
+  "src/commands/shell.ts"() {
+    "use strict";
+    init_paths();
+    init_shell();
+    shellCommand = defineCommand30({
+      meta: {
+        name: "shell",
+        group: "run",
+        description: "Open an interactive bash session inside the named dev-container."
+      },
+      args: {
+        name: {
+          type: "positional",
+          description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+          required: true
+        }
+      },
+      async run({ args }) {
+        try {
+          const exitCode = await runShell({
+            root: containerDir(args.name),
+            name: args.name
+          });
+          process.exit(exitCode);
+        } catch (err) {
+          consola37.error(err instanceof Error ? err.message : String(err));
+          process.exit(1);
+        }
+      }
+    });
+  }
+});
+
+// src/commands/start.ts
+import { defineCommand as defineCommand31 } from "citty";
+import { consola as consola38 } from "consola";
+async function bringContainerUp(name, openTool) {
+  {
+    const args = { name, open: openTool };
+    let needsProxy = false;
+    let hostPort = 80;
+    let deferred = [];
+    let runtimeVersion;
+    try {
+      const parsed = await readConfig(containerConfigPath(args.name));
+      runtimeVersion = parsed.config.runtimeVersion;
+      if ((parsed.config.routing?.ports ?? []).length > 0) {
+        needsProxy = true;
+        const global = await readMonocerosConfig();
+        hostPort = proxyHostPort(global);
+      }
+      deferred = (parsed.config.services ?? []).filter((s) => serviceDefersStart(s.name)).map((s) => s.name);
+    } catch (err) {
+      consola38.warn(
+        `Could not read container yml ahead of start: ${err instanceof Error ? err.message : String(err)}. Skipping Traefik pre-flight.`
+      );
+    }
+    if (needsProxy) {
+      await preflightHostPort(hostPort);
+      await ensureProxy({ hostPort });
+    }
+    const exitCode = await runStart({
+      root: containerDir(args.name),
+      silent: true,
+      logger: { info: () => {
+      } }
+    });
+    if (exitCode === 0 && runtimeSupportsBrowserBridge(runtimeVersion)) {
+      spawnBridgeDaemon(containerDir(args.name));
+    }
+    if (exitCode === 0 && deferred.length > 0) {
+      try {
+        const deferExit = await startDeferredServices({
+          root: containerDir(args.name),
+          services: deferred,
+          logger: consola38
+        });
+        if (deferExit !== 0) {
+          consola38.warn(
+            `Deferred service(s) ${deferred.join(", ")} did not start cleanly (exit ${deferExit}).`
+          );
+        }
+      } catch (err) {
+        consola38.warn(
+          `Could not start deferred service(s) ${deferred.join(", ")}: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    if (exitCode === 0) {
+      consola38.success(`Container '${args.name}' is up.`);
+    }
+    if (args.open && exitCode === 0) {
+      try {
+        await runOpen({ name: args.name, tool: args.open });
+      } catch (err) {
+        consola38.warn(err instanceof Error ? err.message : String(err));
+      }
+    }
+    return exitCode;
+  }
+}
+var startCommand;
+var init_start = __esm({
+  "src/commands/start.ts"() {
     "use strict";
+    init_global();
+    init_io();
     init_paths();
+    init_bridge_daemon();
     init_compose();
+    init_catalog();
+    init_open();
     init_proxy();
+    init_port_check();
     init_app_control();
     init_dispatch();
-    stopCommand = defineCommand32({
+    startCommand = defineCommand31({
       meta: {
-        name: "stop",
+        name: "start",
         group: "run",
-        description: "Stop the compose services for the named dev-container. With an <app>, stop that long-running app inside it instead (kills its process group)."
+        description: "Bring the named dev-container up. With an <app>, start that app inside it (per its projects/<app>/.monoceros/launch.json); the container is brought up first if needed."
       },
       args: {
         name: {
@@ -12506,430 +12621,506 @@ var init_stop = __esm({
         },
         app: {
           type: "positional",
-          description: "App to stop (a path under projects/ with .monoceros/launch.json). Omit to stop the container.",
+          description: "App to start (a path under projects/ with .monoceros/launch.json). Omit to just bring the container up.",
           required: false
         },
         target: {
           type: "string",
-          description: `Which launch target to stop (defaults to the app's "default" target, or its only one).`
+          description: `Which launch target to start (defaults to the app's "default" target, or its only one).`
         },
-        service: {
+        open: {
           type: "string",
-          description: "Restrict to a single compose service (e.g. postgres). Defaults to all."
+          description: `After a successful start, open the container in this tool (${OPEN_TOOLS.join("|")}).`
         }
       },
       run({ args }) {
         if (typeof args.app === "string" && args.app.length > 0) {
           const app = args.app;
           const target = typeof args.target === "string" ? args.target : void 0;
-          return dispatch(() => runAppCtl(args.name, ctlArgs("stop", app, target)));
-        }
-        return dispatch(async () => {
-          const service = typeof args.service === "string" ? args.service : void 0;
-          const exit = await runStop({
-            root: containerDir(args.name),
-            ...service ? { service } : {},
-            logger: { info: () => {
-            } }
-          });
-          if (exit === 0) {
-            consola36.success(
-              service ? `Container '${args.name}' service '${service}' stopped.` : `Container '${args.name}' stopped.`
-            );
-          }
-          try {
-            await maybeStopProxy({
-              logger: { info: (msg) => consola36.info(msg) }
-            });
-          } catch (err) {
-            consola36.warn(
-              `Could not tear down the Traefik proxy: ${err instanceof Error ? err.message : String(err)}. Ignored.`
-            );
-          }
-          return exit;
-        });
+          return dispatch(async () => {
+            if (!await findRunningContainer(args.name)) {
+              const up = await bringContainerUp(args.name, void 0);
+              if (up !== 0) return up;
+            }
+            return runAppCtl(args.name, ctlArgs("start", app, target));
+          });
+        }
+        return dispatch(
+          () => bringContainerUp(
+            args.name,
+            typeof args.open === "string" ? args.open : void 0
+          )
+        );
       }
     });
   }
 });
 
-// src/tunnel/resolve.ts
-import { existsSync as existsSync20 } from "fs";
-import path32 from "path";
-async function resolveTunnelTarget(opts) {
-  const ymlPath = containerConfigPath(opts.name, opts.monocerosHome);
-  if (!existsSync20(ymlPath)) {
-    throw new Error(
-      `No yml profile for '${opts.name}' at ${ymlPath}. Run \`monoceros init ${opts.name}\` first.`
-    );
-  }
-  const parsed = await readConfig(ymlPath);
-  const config = parsed.config;
-  const containerRoot = containerDir(opts.name, opts.monocerosHome);
-  if (!existsSync20(containerRoot)) {
-    throw new Error(
-      `Container '${opts.name}' is not materialised at ${containerRoot}. Run \`monoceros apply ${opts.name}\` first.`
-    );
-  }
-  const composePath = path32.join(containerRoot, ".devcontainer", "compose.yaml");
-  const isCompose = existsSync20(composePath);
-  const parsedTarget = parseTargetArg(opts.target, config);
-  const docker = opts.docker ?? defaultDockerExec;
-  if (isCompose) {
-    return resolveCompose2({
-      name: opts.name,
-      containerRoot,
-      parsedTarget
-    });
-  }
-  return resolveImageMode({
-    name: opts.name,
-    containerRoot,
-    parsedTarget,
-    config,
-    docker
-  });
-}
-function parseTargetArg(raw, config) {
-  const colon = raw.indexOf(":");
-  if (colon > 0) {
-    const name = raw.slice(0, colon);
-    const port = Number(raw.slice(colon + 1));
-    if (!Number.isInteger(port) || port < 1 || port > 65535) {
-      throw new Error(
-        `Invalid target '${raw}'. Use <service>:<port> with a numeric port (1\u201365535), a bare port number, or a configured service name.`
-      );
-    }
-    findConfiguredService(config, name);
-    return { kind: "service", service: name, port };
-  }
-  const asNumber = Number(raw);
-  if (Number.isInteger(asNumber) && asNumber > 0 && asNumber < 65536) {
-    return { kind: "port", port: asNumber };
-  }
-  const match = findConfiguredService(config, raw);
-  if (match.port === void 0) {
-    throw new Error(
-      `Service '${raw}' declares no port, so tunnel can't know what to forward. Add \`port: <n>\` to the service in the yml and re-apply, or pass one explicitly: \`monoceros tunnel <name> ${raw}:<port>\`.`
-    );
-  }
-  return { kind: "service", service: raw, port: match.port };
+// src/status/index.ts
+function shortFeatureName2(ref) {
+  const withoutTag = ref.replace(/:[^:/@]+$/, "");
+  const idx = withoutTag.lastIndexOf("/");
+  return idx >= 0 ? withoutTag.slice(idx + 1) : withoutTag;
 }
-function findConfiguredService(config, name) {
-  const services = config.services.map(resolveService);
-  const match = services.find((s) => s.name === name);
-  if (!match) {
-    const names = services.map((s) => s.name);
-    const list = names.length > 0 ? names.join(", ") : "(none configured)";
-    throw new Error(
-      `Service '${name}' is not configured in this container's yml. Configured services: ${list}. Or pass a port number (e.g. \`monoceros tunnel <name> 8080\`).`
-    );
-  }
-  return match;
+function cols(line) {
+  return line.split("	");
 }
-function resolveCompose2(args) {
-  const network = `${composeProjectName(args.containerRoot)}_default`;
-  if (args.parsedTarget.kind === "service") {
-    return {
-      network,
-      targetHost: args.parsedTarget.service,
-      internalPort: args.parsedTarget.port,
-      display: `${args.name}/${args.parsedTarget.service}:${args.parsedTarget.port}`
-    };
-  }
-  return {
-    network,
-    targetHost: "workspace",
-    internalPort: args.parsedTarget.port,
-    display: `${args.name}:${args.parsedTarget.port}`
-  };
+function nonEmptyLines(s) {
+  return s.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
 }
-async function resolveImageMode(args) {
-  if (args.parsedTarget.kind === "service") {
-    throw new Error(
-      `Service '${args.parsedTarget.service}' is declared in the yml but '${args.name}' is image-mode (no compose.yaml). Services need compose mode \u2014 re-apply with at least one \`services:\` entry to get a compose setup.`
-    );
-  }
-  const ports = args.config.routing?.ports ?? [];
-  if (ports.length > 0) {
-    return {
-      network: PROXY_NETWORK_NAME,
-      targetHost: args.name,
-      internalPort: args.parsedTarget.port,
-      display: `${args.name}:${args.parsedTarget.port}`
-    };
+async function gatherStatus(name, opts = {}) {
+  const docker = opts.docker ?? realDockerLookup;
+  const root = containerDir(name, opts.home);
+  let runtimeVersion;
+  let languages = [];
+  let features = [];
+  let declaredServices = [];
+  let declaredPorts = [];
+  let configured = false;
+  try {
+    const parsed = await readConfig(containerConfigPath(name, opts.home));
+    const createOpts = solutionConfigToCreateOptions(parsed.config);
+    configured = true;
+    runtimeVersion = createOpts.runtimeVersion;
+    languages = createOpts.languages;
+    features = Object.keys(createOpts.features ?? {}).map(shortFeatureName2);
+    declaredServices = createOpts.services.map((s) => ({
+      name: s.name,
+      ...typeof s.port === "number" ? { port: s.port } : {}
+    }));
+    declaredPorts = createOpts.ports ?? [];
+  } catch {
   }
-  const { network, ip } = await lookupContainerNetwork({
-    containerRoot: args.containerRoot,
-    docker: args.docker
-  });
-  return {
-    network,
-    targetHost: ip,
-    internalPort: args.parsedTarget.port,
-    display: `${args.name}:${args.parsedTarget.port}`
+  let container = {
+    exists: false,
+    running: false,
+    status: "",
+    dockerName: ""
   };
-}
-async function lookupContainerNetwork(args) {
-  const psResult = await args.docker([
+  let containerId = "";
+  let composeProject = "";
+  const cps = await docker([
     "ps",
-    "-q",
+    "-a",
+    "--no-trunc",
     "--filter",
-    `label=devcontainer.local_folder=${args.containerRoot}`
+    `label=devcontainer.local_folder=${root}`,
+    "--format",
+    '{{.ID}}	{{.State}}	{{.Status}}	{{.Names}}	{{.Label "com.docker.compose.project"}}'
   ]);
-  if (psResult.exitCode !== 0) {
-    throw new Error(
-      `docker ps failed: ${psResult.stderr.trim() || `exit ${psResult.exitCode}`}`
-    );
+  const row2 = nonEmptyLines(cps.stdout)[0];
+  if (row2) {
+    const [id, state, status, names, project] = cols(row2);
+    containerId = id ?? "";
+    composeProject = project ?? "";
+    container = {
+      exists: true,
+      running: state === "running",
+      status: status ?? "",
+      dockerName: names ?? ""
+    };
   }
-  const containerId = psResult.stdout.trim().split("\n")[0]?.trim();
-  if (!containerId) {
-    throw new Error(
-      `No running container for '${args.containerRoot}'. Start it with \`monoceros start <name>\` (or open a shell with \`monoceros shell <name>\`) and retry.`
-    );
+  const services = [];
+  if (declaredServices.length > 0) {
+    const live = /* @__PURE__ */ new Map();
+    if (composeProject) {
+      const sps = await docker([
+        "ps",
+        "-a",
+        "--filter",
+        `label=com.docker.compose.project=${composeProject}`,
+        "--format",
+        '{{.Label "com.docker.compose.service"}}	{{.State}}	{{.Status}}'
+      ]);
+      for (const l of nonEmptyLines(sps.stdout)) {
+        const [svc, state, status] = cols(l);
+        if (svc)
+          live.set(svc, { running: state === "running", status: status ?? "" });
+      }
+    }
+    for (const s of declaredServices) {
+      const m = live.get(s.name);
+      services.push({
+        name: s.name,
+        running: m?.running ?? false,
+        status: m?.status ?? "not created",
+        ...typeof s.port === "number" ? { port: s.port } : {}
+      });
+    }
+  }
+  const apps = [];
+  for (const app of await listApps(name, opts.home)) {
+    const cfg = await readLaunchConfig(name, app, opts.home);
+    if (!cfg) continue;
+    for (const t of cfg.configurations) {
+      apps.push({
+        app,
+        target: t.name,
+        port: typeof t.port === "number" ? t.port : null,
+        default: t.default === true,
+        running: void 0,
+        pid: null
+      });
+    }
+  }
+  const appsSupported = runtimeSupportsAppStatus(runtimeVersion);
+  let appStateKnown = container.running && appsSupported && containerId !== "";
+  let appStateNote;
+  if (appStateKnown) {
+    const res = await docker([
+      "exec",
+      containerId,
+      "monoceros-ctl",
+      "list",
+      "--json"
+    ]);
+    if (res.exitCode === 0) {
+      const byKey = /* @__PURE__ */ new Map();
+      for (const l of nonEmptyLines(res.stdout)) {
+        try {
+          const o = JSON.parse(l);
+          byKey.set(`${o.app}\0${o.target}`, {
+            running: !!o.running,
+            pid: o.pid ?? null
+          });
+        } catch {
+        }
+      }
+      for (const a of apps) {
+        const o = byKey.get(`${a.app}\0${a.target}`);
+        if (o) {
+          a.running = o.running;
+          a.pid = o.pid;
+        } else {
+          a.running = false;
+        }
+      }
+    } else {
+      appStateKnown = false;
+      appStateNote = `could not read run state from the runner - rebuild the runtime image, then \`monoceros upgrade ${name}\``;
+    }
   }
-  const inspect = await args.docker([
-    "inspect",
-    "--format",
-    "{{json .NetworkSettings.Networks}}",
-    containerId
-  ]);
-  if (inspect.exitCode !== 0) {
-    throw new Error(
-      `docker inspect failed: ${inspect.stderr.trim() || `exit ${inspect.exitCode}`}`
-    );
+  if (apps.length > 0 && !appStateKnown && !appStateNote) {
+    appStateNote = !container.running ? `start the container to see run state (\`monoceros start ${name}\`)` : `run state needs runtime 1.6.0+ (this one: ${runtimeVersion ?? "unpinned"})`;
   }
-  let networks = null;
+  let hostPort = 80;
   try {
-    networks = JSON.parse(inspect.stdout);
-  } catch {
-    throw new Error(
-      `Unexpected docker inspect output: ${inspect.stdout.slice(0, 200)}`
+    hostPort = proxyHostPort(
+      await readMonocerosConfig({
+        ...opts.home ? { monocerosHome: opts.home } : {}
+      })
     );
+  } catch {
   }
-  if (!networks) {
-    throw new Error(
-      `Container ${containerId} reports no networks. Restart it and retry.`
+  const ports = proxyUrlsFor(name, declaredPorts, hostPort);
+  return {
+    name,
+    configured,
+    container,
+    services,
+    apps,
+    appStateKnown,
+    ...appStateNote ? { appStateNote } : {},
+    ports,
+    builtIn: { languages, features }
+  };
+}
+function row(p, marker, name, detail, pad, indent = 2) {
+  const gap = Math.max(2, pad - name.length + 2);
+  return `${" ".repeat(indent)}${marker} ${p.cyan(name)}${" ".repeat(gap)}${detail}`;
+}
+function liveMarker(p, running) {
+  if (running === void 0) return " ";
+  return running ? p.green("\u2713") : p.dim("\xB7");
+}
+function renderContainer(p, m) {
+  const out = [p.sectionLine(m.name)];
+  if (!m.container.exists) {
+    out.push(
+      row(
+        p,
+        p.dim("\xB7"),
+        "(not created)",
+        p.dim(`run \`monoceros apply ${m.name}\``),
+        14
+      )
     );
+    return out;
   }
-  for (const [name, settings] of Object.entries(networks)) {
-    if (settings.IPAddress && settings.IPAddress.length > 0) {
-      return { network: name, ip: settings.IPAddress };
-    }
-  }
-  throw new Error(
-    `Container ${containerId} has no network with a reachable IP. Restart it and retry.`
+  const detail = m.container.running ? p.dim(m.container.status || "running") : p.dim(m.container.status || "stopped");
+  out.push(
+    row(
+      p,
+      liveMarker(p, m.container.running),
+      m.container.dockerName,
+      detail,
+      14
+    )
   );
+  return out;
 }
-var init_resolve2 = __esm({
-  "src/tunnel/resolve.ts"() {
-    "use strict";
-    init_paths();
-    init_io();
-    init_compose();
-    init_catalog();
-    init_proxy();
+function renderServices(p, m) {
+  if (m.services.length === 0) return [];
+  const pad = Math.max(...m.services.map((s) => s.name.length));
+  const out = ["", p.sectionLine("Services")];
+  for (const s of m.services) {
+    const detail = s.running ? p.dim(typeof s.port === "number" ? `running    :${s.port}` : "running") : p.dim(s.status || "stopped");
+    out.push(row(p, liveMarker(p, s.running), s.name, detail, pad));
   }
-});
-
-// src/tunnel/port-check.ts
-import { Socket as Socket2 } from "net";
-async function preflightLocalPort(opts) {
-  const probe = opts.probe ?? realPortProbe2;
-  const result = await probe(opts.port, opts.address);
-  if (result.ok) return;
-  throw new Error(formatLocalPortHeldError(opts.port, opts.address, result));
+  return out;
 }
-function formatLocalPortHeldError(port, address, result) {
-  const lines = [];
-  if (result.code === "EADDRINUSE") {
-    lines.push(`Local port ${port} on ${address} is already in use.`);
-    lines.push("");
-    lines.push("Identify the holder, then either stop it or pick a different");
-    lines.push("port for the tunnel:");
-    lines.push("");
-    lines.push(`  sudo lsof -iTCP:${port} -sTCP:LISTEN -n -P`);
-    lines.push(`  # or:   sudo ss -tlnp | grep ":${port}\\b"`);
-    lines.push("");
-    lines.push("Re-run with an explicit local port:");
-    lines.push(`  monoceros tunnel \u2026 --local-port=${port + 1}`);
-  } else {
-    lines.push(
-      `Cannot probe local port ${port} on ${address}: ${result.message}`
-    );
-    lines.push("");
-    lines.push(
-      "Most likely the host network stack (firewall, namespace) is interfering."
+function appTargetDetail(p, name, t) {
+  const bits = [];
+  if (t.running === true) {
+    bits.push(
+      t.port !== null ? p.dim(`http://${name}-${t.port}.localhost`) : p.dim("running")
     );
-    lines.push("Try a different local port via `--local-port=<n>`.");
+    if (t.pid !== null) bits.push(p.dim(`pid ${t.pid}`));
+  } else if (t.running === false) {
+    bits.push(p.dim("stopped"));
   }
-  return lines.join("\n");
+  if (t.default) bits.push(p.dim("(default)"));
+  return bits.join("    ");
 }
-var CONNECT_TIMEOUT_MS2, realPortProbe2;
-var init_port_check2 = __esm({
-  "src/tunnel/port-check.ts"() {
-    "use strict";
-    CONNECT_TIMEOUT_MS2 = 750;
-    realPortProbe2 = (port, address) => {
-      const probeHost = address === "0.0.0.0" ? "127.0.0.1" : address;
-      return new Promise((resolve) => {
-        const socket = new Socket2();
-        let settled = false;
-        const settle = (result) => {
-          if (settled) return;
-          settled = true;
-          socket.destroy();
-          resolve(result);
-        };
-        socket.setTimeout(CONNECT_TIMEOUT_MS2);
-        socket.once("connect", () => {
-          settle({
-            ok: false,
-            code: "EADDRINUSE",
-            message: `another process is listening on ${port}`
-          });
-        });
-        socket.once("timeout", () => {
-          settle({ ok: true });
-        });
-        socket.once("error", (err) => {
-          const code = err.code ?? "UNKNOWN";
-          if (code === "ECONNREFUSED") {
-            settle({ ok: true });
-          } else {
-            settle({ ok: false, code, message: err.message });
-          }
-        });
-        socket.connect(port, probeHost);
-      });
-    };
+function renderApps(p, m) {
+  if (m.apps.length === 0) return [];
+  const out = ["", p.sectionLine("Apps")];
+  if (m.appStateNote) out.push(`  ${p.dim(m.appStateNote)}`);
+  const byApp = /* @__PURE__ */ new Map();
+  for (const a of m.apps) {
+    const list = byApp.get(a.app) ?? [];
+    list.push(a);
+    byApp.set(a.app, list);
   }
-});
-
-// src/tunnel/run.ts
-import { spawn as spawn14 } from "child_process";
-import { consola as consola37 } from "consola";
-function signalNumber(signal) {
-  switch (signal) {
-    case "SIGINT":
-      return 2;
-    case "SIGTERM":
-      return 15;
-    default:
-      return 1;
+  for (const [app, targets] of byApp) {
+    out.push(`  ${p.cyan(app)}`);
+    const pad = Math.max(...targets.map((t) => t.target.length));
+    for (const t of targets) {
+      out.push(
+        row(
+          p,
+          liveMarker(p, t.running),
+          t.target,
+          appTargetDetail(p, m.name, t),
+          pad,
+          4
+        )
+      );
+    }
   }
-}
-async function runTunnel(opts) {
-  const log = opts.logger ?? {
-    info: (m) => consola37.info(m),
-    warn: (m) => consola37.warn(m)
-  };
-  const resolve = opts.resolve ?? resolveTunnelTarget;
-  const resolveArgs3 = {
-    name: opts.name,
-    target: opts.target,
-    ...opts.monocerosHome !== void 0 ? { monocerosHome: opts.monocerosHome } : {}
-  };
-  const resolved = await resolve(resolveArgs3);
-  const localPort = opts.localPort ?? resolved.internalPort;
-  const localAddress = opts.localAddress ?? DEFAULT_LOCAL_ADDRESS;
-  validateLocalAddress(localAddress);
-  const preflight = opts.preflight ?? preflightLocalPort;
-  await preflight({ port: localPort, address: localAddress });
-  const dockerSpawn = opts.dockerSpawn ?? defaultDockerSpawn;
-  const installSignalHandler = opts.installSignalHandler ?? installSigintDefault;
-  const dockerArgs = buildDockerArgs({
-    localAddress,
-    localPort,
-    internalPort: resolved.internalPort,
-    network: resolved.network,
-    targetHost: resolved.targetHost
-  });
-  log.info(
-    `Tunnel: ${localAddress}:${localPort} \u2192 ${resolved.display}:${resolved.internalPort} (Ctrl+C to stop)`
-  );
-  const handle = dockerSpawn(dockerArgs);
-  const uninstall = installSignalHandler(() => {
-  });
-  try {
-    const exitCode = await handle.exited;
-    if (exitCode === 130) return 0;
-    return exitCode;
-  } finally {
-    uninstall();
+  return out;
+}
+function renderPorts(p, m) {
+  if (m.ports.length === 0) return [];
+  const pad = Math.max(...m.ports.map((r) => String(r.port).length));
+  const out = ["", p.sectionLine("Ports")];
+  for (const r of m.ports) {
+    const hosts = r.isDefault ? `${m.name}.localhost \xB7 ${m.name}-${r.port}.localhost` : `${m.name}-${r.port}.localhost`;
+    out.push(row(p, " ", String(r.port), p.dim(hosts), pad));
   }
+  return out;
 }
-function buildDockerArgs(input) {
+function renderBuiltIn(p, m) {
+  const lines = [];
+  if (m.builtIn.languages.length > 0)
+    lines.push({ label: "Languages", values: m.builtIn.languages });
+  if (m.builtIn.features.length > 0)
+    lines.push({ label: "Features", values: m.builtIn.features });
+  if (lines.length === 0) return [];
+  const labelWidth = Math.max(...lines.map((l) => l.label.length));
+  const out = ["", `${p.sectionLine("Built in")}  ${p.dim("from the yml")}`];
+  for (const l of lines) {
+    out.push(`  ${l.label.padEnd(labelWidth)}  ${p.cyan(l.values.join(", "))}`);
+  }
+  return out;
+}
+function renderStatus(m, p) {
   return [
-    "run",
-    "--rm",
-    "-i",
-    `--network=${input.network}`,
-    "-p",
-    `${input.localAddress}:${input.localPort}:${input.internalPort}`,
-    SOCAT_IMAGE,
-    `TCP-LISTEN:${input.internalPort},fork,reuseaddr`,
-    `TCP:${input.targetHost}:${input.internalPort}`
-  ];
+    ...renderContainer(p, m),
+    ...renderServices(p, m),
+    ...renderApps(p, m),
+    ...renderPorts(p, m),
+    ...renderBuiltIn(p, m)
+  ].join("\n");
 }
-function validateLocalAddress(addr) {
-  if (addr === "localhost") return;
-  if (IPV4_RE.test(addr)) {
-    for (const part of addr.split(".")) {
-      const n = Number(part);
-      if (n < 0 || n > 255) {
-        throw new Error(
-          `Invalid --local-address '${addr}': each dotted-quad octet must be 0-255.`
-        );
-      }
-    }
-    return;
+function renderApp(m, app, p) {
+  const targets = m.apps.filter((a) => a.app === app);
+  if (targets.length === 0) {
+    const known = [...new Set(m.apps.map((a) => a.app))];
+    throw new Error(
+      `No app "${app}" in ${m.name} (have: ${known.join(", ") || "none"}).`
+    );
   }
-  throw new Error(
-    `Invalid --local-address '${addr}'. Use 127.0.0.1 (default), 0.0.0.0, or a specific IPv4 address.`
-  );
+  const out = [p.sectionLine(app)];
+  if (m.appStateNote) out.push(`  ${p.dim(m.appStateNote)}`);
+  const pad = Math.max(...targets.map((t) => t.target.length));
+  for (const t of targets) {
+    out.push(
+      row(
+        p,
+        liveMarker(p, t.running),
+        t.target,
+        appTargetDetail(p, m.name, t),
+        pad,
+        2
+      )
+    );
+  }
+  return out.join("\n");
 }
-var SOCAT_IMAGE, defaultDockerSpawn, installSigintDefault, DEFAULT_LOCAL_ADDRESS, IPV4_RE;
-var init_run3 = __esm({
-  "src/tunnel/run.ts"() {
+function renderService(m, name, p) {
+  const s = m.services.find((svc) => svc.name === name);
+  if (!s) {
+    throw new Error(
+      `No service "${name}" in ${m.name} (have: ${m.services.map((x) => x.name).join(", ") || "none"}).`
+    );
+  }
+  const detail = s.running ? p.dim(typeof s.port === "number" ? `running    :${s.port}` : "running") : p.dim(s.status || "stopped");
+  return [
+    p.sectionLine("Services"),
+    row(p, liveMarker(p, s.running), s.name, detail, s.name.length)
+  ].join("\n");
+}
+var init_status = __esm({
+  "src/status/index.ts"() {
     "use strict";
-    init_resolve2();
-    init_port_check2();
-    SOCAT_IMAGE = "alpine/socat:1.8.0.3";
-    defaultDockerSpawn = (args) => {
-      const child = spawn14("docker", args, {
-        stdio: "inherit"
-      });
-      const exited = new Promise((resolve, reject) => {
-        child.on("error", reject);
-        child.on("exit", (code, signal) => {
-          if (typeof code === "number") resolve(code);
-          else if (signal) resolve(128 + signalNumber(signal));
-          else resolve(0);
+    init_io();
+    init_paths();
+    init_global();
+    init_transform();
+    init_launch_config();
+    init_catalog();
+    init_locate_running();
+    init_dynamic();
+    init_format();
+  }
+});
+
+// src/commands/status.ts
+import { defineCommand as defineCommand32 } from "citty";
+var statusCommand;
+var init_status2 = __esm({
+  "src/commands/status.ts"() {
+    "use strict";
+    init_status();
+    init_format();
+    init_dispatch();
+    statusCommand = defineCommand32({
+      meta: {
+        name: "status",
+        group: "run",
+        description: "Show the dev-container at a glance: container, services and apps (up/down), the ports it routes, and what the yml built in. With an <app> (or a service name), narrow to just that."
+      },
+      args: {
+        name: {
+          type: "positional",
+          description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+          required: true
+        },
+        app: {
+          type: "positional",
+          description: "Narrow to one app (a path under projects/ with .monoceros/launch.json) or one compose service (e.g. postgres). Omit for the whole stack.",
+          required: false
+        }
+      },
+      run({ args }) {
+        const filter = typeof args.app === "string" ? args.app : void 0;
+        return dispatch(async () => {
+          const model = await gatherStatus(args.name);
+          const p = colorsFor(process.stdout);
+          let block;
+          if (filter) {
+            const isApp = model.apps.some((a) => a.app === filter);
+            block = isApp ? renderApp(model, filter, p) : renderService(model, filter, p);
+          } else {
+            block = renderStatus(model, p);
+          }
+          process.stdout.write(`
+${block}
+`);
+          return 0;
         });
-      });
-      return {
-        exited,
-        kill: (signal) => {
+      }
+    });
+  }
+});
+
+// src/commands/stop.ts
+import { defineCommand as defineCommand33 } from "citty";
+import { consola as consola39 } from "consola";
+var stopCommand;
+var init_stop = __esm({
+  "src/commands/stop.ts"() {
+    "use strict";
+    init_paths();
+    init_compose();
+    init_proxy();
+    init_app_control();
+    init_dispatch();
+    stopCommand = defineCommand33({
+      meta: {
+        name: "stop",
+        group: "run",
+        description: "Stop the compose services for the named dev-container. With an <app>, stop that long-running app inside it instead (kills its process group)."
+      },
+      args: {
+        name: {
+          type: "positional",
+          description: "Container name (yml in $MONOCEROS_HOME/container-configs/).",
+          required: true
+        },
+        app: {
+          type: "positional",
+          description: "App to stop (a path under projects/ with .monoceros/launch.json). Omit to stop the container.",
+          required: false
+        },
+        target: {
+          type: "string",
+          description: `Which launch target to stop (defaults to the app's "default" target, or its only one).`
+        },
+        service: {
+          type: "string",
+          description: "Restrict to a single compose service (e.g. postgres). Defaults to all."
+        }
+      },
+      run({ args }) {
+        if (typeof args.app === "string" && args.app.length > 0) {
+          const app = args.app;
+          const target = typeof args.target === "string" ? args.target : void 0;
+          return dispatch(() => runAppCtl(args.name, ctlArgs("stop", app, target)));
+        }
+        return dispatch(async () => {
+          const service = typeof args.service === "string" ? args.service : void 0;
+          const exit = await runStop({
+            root: containerDir(args.name),
+            ...service ? { service } : {},
+            logger: { info: () => {
+            } }
+          });
+          if (exit === 0) {
+            consola39.success(
+              service ? `Container '${args.name}' service '${service}' stopped.` : `Container '${args.name}' stopped.`
+            );
+          }
           try {
-            child.kill(signal);
-          } catch {
+            await maybeStopProxy({
+              logger: { info: (msg) => consola39.info(msg) }
+            });
+          } catch (err) {
+            consola39.warn(
+              `Could not tear down the Traefik proxy: ${err instanceof Error ? err.message : String(err)}. Ignored.`
+            );
           }
-        }
-      };
-    };
-    installSigintDefault = (handler) => {
-      process.on("SIGINT", handler);
-      return () => process.off("SIGINT", handler);
-    };
-    DEFAULT_LOCAL_ADDRESS = "127.0.0.1";
-    IPV4_RE = /^(\d{1,3}\.){3}\d{1,3}$/;
+          return exit;
+        });
+      }
+    });
   }
 });
 
 // src/commands/tunnel.ts
-import { defineCommand as defineCommand33 } from "citty";
-import { consola as consola38 } from "consola";
+import { defineCommand as defineCommand34 } from "citty";
+import { consola as consola40 } from "consola";
 function parseLocalPort(raw) {
   if (raw === void 0) return void 0;
   const n = Number(raw);
@@ -12945,7 +13136,7 @@ var init_tunnel = __esm({
   "src/commands/tunnel.ts"() {
     "use strict";
     init_run3();
-    tunnelCommand = defineCommand33({
+    tunnelCommand = defineCommand34({
       meta: {
         name: "tunnel",
         group: "discovery",
@@ -12982,7 +13173,7 @@ var init_tunnel = __esm({
           });
           process.exit(exitCode);
         } catch (err) {
-          consola38.error(err instanceof Error ? err.message : String(err));
+          consola40.error(err instanceof Error ? err.message : String(err));
           process.exit(1);
         }
       }
@@ -13053,7 +13244,7 @@ var init_prune = __esm({
 
 // src/upgrade/index.ts
 import { existsSync as existsSync21, promises as fs20 } from "fs";
-import { consola as consola39 } from "consola";
+import { consola as consola41 } from "consola";
 async function fetchRuntimeVersions() {
   const tokenUrl = `https://ghcr.io/token?service=ghcr.io&scope=repository:${RUNTIME_REPO}:pull`;
   const tokenRes = await fetch(tokenUrl);
@@ -13091,7 +13282,7 @@ ${yml}`;
 }
 async function runUpgrade(opts) {
   const home = opts.monocerosHome ?? monocerosHome();
-  const logger = opts.logger ?? consola39;
+  const logger = opts.logger ?? consola41;
   const fetchVersions = opts.fetchVersions ?? fetchRuntimeVersions;
   if (opts.list) {
     const versions = await fetchVersions();
@@ -13237,7 +13428,7 @@ var init_upgrade = __esm({
 });
 
 // src/commands/upgrade.ts
-import { defineCommand as defineCommand34 } from "citty";
+import { defineCommand as defineCommand35 } from "citty";
 var upgradeCommand;
 var init_upgrade2 = __esm({
   "src/commands/upgrade.ts"() {
@@ -13245,7 +13436,7 @@ var init_upgrade2 = __esm({
     init_upgrade();
     init_version();
     init_dispatch();
-    upgradeCommand = defineCommand34({
+    upgradeCommand = defineCommand35({
       meta: {
         name: "upgrade",
         group: "lifecycle",
@@ -13287,7 +13478,7 @@ var main_exports = {};
 __export(main_exports, {
   main: () => main
 });
-import { defineCommand as defineCommand35 } from "citty";
+import { defineCommand as defineCommand36 } from "citty";
 var main;
 var init_main = __esm({
   "src/main.ts"() {
@@ -13320,6 +13511,7 @@ var init_main = __esm({
     init_remove_repo();
     init_remove_service();
     init_run2();
+    init_share();
     init_shell2();
     init_start();
     init_status2();
@@ -13327,7 +13519,7 @@ var init_main = __esm({
     init_tunnel();
     init_upgrade2();
     init_version();
-    main = defineCommand35({
+    main = defineCommand36({
       meta: {
         name: "monoceros",
         version: CLI_VERSION,
@@ -13364,6 +13556,7 @@ var init_main = __esm({
         "remove-port": removePortCommand,
         port: portCommand,
         tunnel: tunnelCommand,
+        share: shareCommand,
         completion: completionCommand,
         __complete: __completeCommand,
         "__update-check": __updateCheckCommand,