@kvbox/cli 0.5.8 → 0.5.10

package/dist/kvbox.js

@@ -147,7 +147,7 @@ async function spin(message, work, opts = {}) {
 }
 
 // src/program.ts
-import { Command as Command39 } from "commander";
+import { Command as Command40 } from "commander";
 
 // ../shared/src/version.ts
 import { createRequire } from "module";
@@ -162,13 +162,13 @@ function versionOf(srcFileUrl, injected) {
 }
 
 // src/version.ts
-var VERSION = versionOf(import.meta.url, true ? "0.5.8" : void 0);
+var VERSION = versionOf(import.meta.url, true ? "0.5.10" : void 0);
 
 // src/commands/vm/index.ts
-import { Command as Command15 } from "commander";
+import { Command as Command16 } from "commander";
 
 // src/commands/vm/connect.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import { Command as Command2 } from "commander";
 
 // src/cert.ts
@@ -417,7 +417,9 @@ var MachineSchema = z2.object({
    */
   ssh: z2.object({ host: z2.string(), port: z2.number().int(), user: z2.string() }).optional(),
   /** Whether the owner slug is a user or an org. Only the control plane knows; it fills it in on `GET /machines`. */
-  ownerKind: z2.enum(["user", "org"]).optional()
+  ownerKind: z2.enum(["user", "org"]).optional(),
+  /** Seconds without network traffic before the host hibernates the box (#47). Absent: never. */
+  autoHibernateSec: z2.number().int().positive().optional()
 });
 var CreateMachineRequest = z2.object({
   name: z2.string().optional(),
@@ -431,7 +433,9 @@ var CreateMachineRequest = z2.object({
    * its SSH CA as one `cert-authority …` line (#51). Written into the box's authorized_keys at every
    * boot (#49); a host older than that ignores them.
    */
-  sshKeys: z2.array(z2.string()).optional()
+  sshKeys: z2.array(z2.string()).optional(),
+  /** Seconds without network traffic before the box is hibernated (#47); 0: never. Absent: the host's default. */
+  autoHibernateSec: z2.number().int().min(0).optional()
 });
 var SetSshKeysRequest = z2.object({
   sshKeys: z2.array(z2.string())
@@ -442,6 +446,10 @@ var RescaleMachineRequest = z2.object({
   memMib: z2.number().int().min(256).optional(),
   diskGib: z2.number().int().min(1).optional()
 });
+var SetMachineRequest = z2.object({
+  /** Seconds without network traffic before the box is hibernated (#47); 0: never. */
+  autoHibernateSec: z2.number().int().min(0).optional()
+});
 var SnapshotSchema = z2.object({
   name: z2.string(),
   owner: z2.string(),
@@ -466,6 +474,12 @@ var CapacitySchema = z2.object({
   reservedVcpu: z2.number().int(),
   running: z2.number().int()
 });
+var RecoveryReportSchema = z2.object({
+  at: z2.string(),
+  booted: z2.array(z2.string()),
+  leftStopped: z2.array(z2.string()),
+  failed: z2.array(z2.object({ box: z2.string(), error: z2.string() }))
+});
 var HealthSchema = z2.object({
   ok: z2.literal(true),
   version: z2.string(),
@@ -488,8 +502,13 @@ var HealthSchema = z2.object({
     /** The public IP the relay owns for this host. */
     publicIp: z2.string(),
     /** The relay's WireGuard endpoint the tunnel dials. */
-    endpoint: z2.string()
-  }).nullable().optional()
+    endpoint: z2.string(),
+    /** Times the server redialed the tunnel since it started, because the relay stopped answering. Older servers omit them. */
+    restarts: z2.number().int().optional(),
+    lastRestartAt: z2.string().nullable().optional()
+  }).nullable().optional(),
+  /** Boxes brought back at the server's last start; null when there were none or it is still at it. Older servers omit it. */
+  recovery: RecoveryReportSchema.nullable().optional()
 });
 var MachineUsageSchema = z2.object({
   name: z2.string(),
@@ -739,6 +758,34 @@ function groupWithMember(gid, user, groupFile) {
   return void 0;
 }
 
+// src/systemd.ts
+import { spawnSync } from "child_process";
+import { readFileSync as readFileSync2 } from "fs";
+import { resolve } from "path";
+var UNIT = "kvbox-server";
+var UNIT_FILE = `/etc/systemd/system/${UNIT}.service`;
+function hasUnitFor(p, file = UNIT_FILE) {
+  let text;
+  try {
+    text = readFileSync2(file, "utf8");
+  } catch {
+    return false;
+  }
+  const home = /^Environment="?KVBOX_HOME=([^"\n]+)"?$/m.exec(text)?.[1];
+  return home !== void 0 && resolve(home) === resolve(p.home);
+}
+function startUnitProcess() {
+  const res = spawnSync("sudo", ["-n", "systemctl", "start", UNIT], { encoding: "utf8" });
+  return { ok: res.status === 0, out: `${res.stdout ?? ""}${res.stderr ?? ""}`.trim() };
+}
+function unitActive() {
+  const res = spawnSync("systemctl", ["is-active", UNIT], { encoding: "utf8" });
+  return (res.stdout ?? "").trim() === "active";
+}
+function startsAtBoot(p) {
+  return hasUnitFor(p) && spawnSync("systemctl", ["is-enabled", "--quiet", UNIT]).status === 0;
+}
+
 // src/client.ts
 var ORG_SLUG_RE = /^[a-z0-9][a-z0-9._-]{0,31}$/;
 function orgOption(opts) {
@@ -853,6 +900,9 @@ var ServerClient = class {
   rescaleMachine(name, req) {
     return this.call("POST", `/machines/${encodeURIComponent(name)}/rescale`, MachineSchema, req);
   }
+  setMachine(name, req) {
+    return this.call("POST", `/machines/${encodeURIComponent(name)}/set`, MachineSchema, req);
+  }
   /** `since`: an ISO date, already validated; the server counts from the box's creation without it. */
   machineUsage(name, since) {
     const query = since === void 0 ? "" : `?since=${encodeURIComponent(since)}`;
@@ -979,6 +1029,9 @@ function sshArgs(ep, p = paths()) {
     ...hostKey,
     "-o",
     "LogLevel=ERROR",
+    // A quiet open session still moves a few bytes a minute, so the host's auto-hibernate (#47) sees it.
+    "-o",
+    "ServerAliveInterval=60",
     "-o",
     "SetEnv=LC_ALL=C.UTF-8",
     `${ep.user}@${ep.host}`
@@ -987,17 +1040,17 @@ function sshArgs(ep, p = paths()) {
 async function waitForSsh(ep, timeoutMs = 3e4) {
   const { connect } = await import("net");
   const deadline = Date.now() + timeoutMs;
-  const attempt = () => new Promise((resolve) => {
+  const attempt = () => new Promise((resolve2) => {
     const sock = connect({ host: ep.host, port: ep.port, timeout: 1e3 });
     sock.once("connect", () => {
       sock.destroy();
-      resolve(true);
+      resolve2(true);
     });
     sock.once("timeout", () => {
       sock.destroy();
-      resolve(false);
+      resolve2(false);
     });
-    sock.once("error", () => resolve(false));
+    sock.once("error", () => resolve2(false));
   });
   while (Date.now() < deadline) {
     if (await attempt()) return;
@@ -1006,14 +1059,15 @@ async function waitForSsh(ep, timeoutMs = 3e4) {
   throw new KvboxError(`box at ${ep.host}:${ep.port} did not answer within ${Math.round(timeoutMs / 1e3)}s`);
 }
 var NOT_A_HOST_HINT = "kvbox-server is not installed, so this machine is not a kvbox host. Set it up with install-server.sh, or log in to the cloud with: kvbox login";
-async function lastErrorLine(logPath) {
+async function lastErrorLine(logPath, from = 0) {
   const { readFile: readFile6 } = await import("fs/promises");
-  const text = await readFile6(logPath, "utf8").catch(() => "");
+  const text = (await readFile6(logPath).catch(() => Buffer.alloc(0))).subarray(from).toString("utf8");
   const lines = text.trimEnd().split("\n").slice(-20).reverse();
   return lines.find((l) => l.startsWith("error: "))?.slice("error: ".length);
 }
 async function startLocalServer(p = paths(), timeoutMs = 5e3) {
   await mkdir2(p.home, { recursive: true });
+  if (hasUnitFor(p)) return startUnit(p, timeoutMs);
   const log = openSync(p.serverLog, "a");
   const launcher = serverLauncher();
   const child = spawn(launcher.cmd, launcher.args, { detached: true, stdio: ["ignore", log, log] });
@@ -1027,33 +1081,50 @@ async function startLocalServer(p = paths(), timeoutMs = 5e3) {
       });
     });
   });
-  const ready = (async () => {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      if (await stat(p.serverSock).then(() => true, () => false)) {
-        const probe = new ServerClient({ kind: "local", socketPath: p.serverSock }, { autoStart: false });
-        try {
-          await probe.health();
-          return;
-        } catch {
-        } finally {
-          await probe.close();
-        }
-      }
-      await sleep(100);
-    }
-    throw new KvboxError(`kvbox-server did not start within ${timeoutMs / 1e3}s; see ${p.serverLog}`);
-  })();
-  await Promise.race([ready, failed]);
+  await Promise.race([serving(p, timeoutMs), failed]);
   child.removeAllListeners("exit");
   child.unref();
   const pid = Number.parseInt(await readFile3(p.serverPid, "utf8").catch(() => ""), 10);
   return { pid: Number.isNaN(pid) ? child.pid ?? -1 : pid, socketPath: p.serverSock, viaGroup: launcher.viaGroup };
 }
+async function startUnit(p, timeoutMs) {
+  const logFrom = await stat(p.serverLog).then((s) => s.size, () => 0);
+  const res = startUnitProcess();
+  if (!res.ok) {
+    const why = res.out || await lastErrorLine(p.serverLog, logFrom) || "systemctl start failed";
+    throw new KvboxError(`kvbox-server could not start: ${why} (journalctl -u ${UNIT}; rerun install-server.sh if sudo asked for a password)`);
+  }
+  await serving(p, timeoutMs, async () => {
+    if (unitActive()) return;
+    const why = await lastErrorLine(p.serverLog, logFrom) ?? "it exited right after starting";
+    throw new KvboxError(`kvbox-server could not start: ${why} (journalctl -u ${UNIT})`);
+  });
+  const pid = Number.parseInt(await readFile3(p.serverPid, "utf8").catch(() => ""), 10);
+  return { pid: Number.isNaN(pid) ? -1 : pid, socketPath: p.serverSock, viaGroup: void 0 };
+}
+async function serving(p, timeoutMs, check) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    await check?.();
+    if (await stat(p.serverSock).then(() => true, () => false)) {
+      const probe = new ServerClient({ kind: "local", socketPath: p.serverSock }, { autoStart: false });
+      try {
+        await probe.health();
+        return;
+      } catch {
+      } finally {
+        await probe.close();
+      }
+    }
+    await sleep(100);
+  }
+  throw new KvboxError(`kvbox-server did not start within ${timeoutMs / 1e3}s; see ${p.serverLog}`);
+}
 
 // src/commands/vm/new.ts
 import { Command, Option } from "commander";
-var newCommand = new Command("new").description("boot a new box from the base image or a snapshot").argument("[name]", "box name (box1, box2, \u2026 when omitted)").addOption(new Option("-s, --size <size>", "box size (default: server config, s)").choices(SIZE_NAMES)).option("-f, --from <snapshot>", "start from a snapshot instead of the base image").option("--force", "skip the capacity guard").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+var newCommand = new Command("new").description("boot a new box from the base image or a snapshot").argument("[name]", "box name (box1, box2, \u2026 when omitted)").addOption(new Option("-s, --size <size>", "box size (default: server config, s)").choices(SIZE_NAMES)).option("-f, --from <snapshot>", "start from a snapshot instead of the base image").option("--auto-hibernate <duration>", "hibernate the box after this long without network traffic (30m, 4h, 1d; off: never; default: server config, off)").option("--force", "skip the capacity guard").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+  const autoHibernateSec = opts.autoHibernate === void 0 ? void 0 : parseIdleTimeout(opts.autoHibernate);
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const what = opts.from !== void 0 ? `restoring ${name ?? "a new box"} from snapshot ${opts.from}\u2026` : `booting ${name ?? "a new box"}\u2026`;
@@ -1061,8 +1132,10 @@ var newCommand = new Command("new").description("boot a new box from the base im
       ...name !== void 0 ? { name } : {},
       ...opts.size !== void 0 ? { size: opts.size } : {},
       ...opts.from !== void 0 ? { from: opts.from } : {},
+      ...autoHibernateSec !== void 0 ? { autoHibernateSec } : {},
       ...opts.force ? { force: true } : {}
     }));
+    if (autoHibernateSec && !box.autoHibernateSec) warn(`box ${name ?? box.name}: its host runs a kvbox-server too old for auto-hibernate; it will not hibernate on its own`);
     if (opts.json) {
       json(box);
       return;
@@ -1073,6 +1146,7 @@ var newCommand = new Command("new").description("boot a new box from the base im
     info(`${color.green("\u2713")} ${describe(box, user)}`);
     if (opts.from !== void 0) info(`  connect with: kvbox connect ${displayName(box, user)}   (already up: everything that ran in the snapshot is running)`);
     else info(`  connect with: kvbox connect ${displayName(box, user)}   (SSH is up a couple of seconds after boot)`);
+    if (box.autoHibernateSec) info(`  it ${autoHibernateText(box.autoHibernateSec)}`);
   } finally {
     await client.close();
   }
@@ -1084,6 +1158,18 @@ function describe(box, user) {
   const from = box.source.startsWith("snapshot:") ? ` from snapshot ${shortRef(box.source.slice("snapshot:".length), box.owner)}` : "";
   return `box ${color.bold(displayName(box, user))} is ${box.status} at ${box.ip}${from}: ${box.vcpu} vCPU, ${gb(box.memMib * 1024 ** 2)} RAM, ${gb(box.diskBytes)} disk`;
 }
+function autoHibernateText(sec) {
+  return sec ? `hibernates after ${duration(sec)} without network traffic (kvbox connect wakes it)` : "never hibernates on its own";
+}
+var UNIT_SEC = { m: 60, h: 3600, d: 86400 };
+function parseIdleTimeout(text) {
+  const t = text.trim().toLowerCase();
+  if (t === "off" || t === "never" || t === "0") return 0;
+  if (!/^(\d+[mhd])+$/.test(t)) throw new KvboxError(`--auto-hibernate ${text}: give a duration like 30m, 4h or 1d, or off`);
+  let sec = 0;
+  for (const [, n, unit] of t.matchAll(/(\d+)([mhd])/g)) sec += Number(n) * UNIT_SEC[unit];
+  return sec;
+}
 
 // src/commands/vm/connect.ts
 var SSH_FAILED = 255;
@@ -1104,14 +1190,14 @@ var connectCommand = new Command2("connect").alias("cn").description("open a she
   } finally {
     await client.close();
   }
-  let res = spawnSync("ssh", [...sshArgs(ep), ...cmdArgs], { stdio: "inherit" });
+  let res = spawnSync2("ssh", [...sshArgs(ep), ...cmdArgs], { stdio: "inherit" });
   if (res.error) throw new KvboxError(`could not run ssh: ${res.error.message}`);
   if (res.status === SSH_FAILED) {
     const again = await clientFor(cmd.optsWithGlobals());
     const retry = await renewAfterRefusal(again, cert, owner).finally(() => again.close());
     if (retry) {
       info("renewed your SSH certificate, trying again\u2026");
-      res = spawnSync("ssh", [...sshArgs(ep), ...cmdArgs], { stdio: "inherit" });
+      res = spawnSync2("ssh", [...sshArgs(ep), ...cmdArgs], { stdio: "inherit" });
       if (res.error) throw new KvboxError(`could not run ssh: ${res.error.message}`);
     }
   }
@@ -1155,12 +1241,12 @@ async function runSsh(ssh, opts) {
     timedOut = true;
     child.kill("SIGTERM");
   }, opts.timeout * 1e3);
-  const status2 = await new Promise((resolve, reject) => {
+  const status2 = await new Promise((resolve2, reject) => {
     child.once("error", (err) => reject(new KvboxError(`could not run ssh: ${err.message}`)));
     child.once("close", (code, signal) => {
-      if (timedOut) resolve(TIMEOUT_EXIT);
-      else if (code !== null) resolve(code);
-      else resolve(signal === "SIGINT" ? 130 : 1);
+      if (timedOut) resolve2(TIMEOUT_EXIT);
+      else if (code !== null) resolve2(code);
+      else resolve2(signal === "SIGINT" ? 130 : 1);
     });
   }).finally(() => clearTimeout(timer));
   return { status: status2, chunks, timedOut };
@@ -1359,9 +1445,29 @@ var rmCommand = new Command9("rm").description("destroy a box (its disk is delet
   }
 });
 
-// src/commands/vm/start.ts
+// src/commands/vm/set.ts
 import { Command as Command10 } from "commander";
-var startCommand = new Command10("start").description("boot a stopped box again (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+var setCommand = new Command10("set").description("change a box's settings, e.g. --auto-hibernate 30m (off: never)").argument("<name>", "box name").option("--auto-hibernate <duration>", "hibernate the box after this long without network traffic (30m, 4h, 1d; off: never)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+  if (opts.autoHibernate === void 0) throw new KvboxError("nothing to change: give --auto-hibernate");
+  const autoHibernateSec = parseIdleTimeout(opts.autoHibernate);
+  const client = await clientFor(cmd.optsWithGlobals());
+  try {
+    const found = pickRef(await client.listMachines(), name, me(client));
+    if (!found) throw new KvboxError(`box ${name}: not found (kvbox ls)`);
+    const box = await spin(`updating ${name}\u2026`, client.setMachine(displayName(found, me(client)), { autoHibernateSec }));
+    if (opts.json) {
+      json(box);
+      return;
+    }
+    info(`${color.green("\u2713")} box ${color.bold(name)}: ${autoHibernateText(box.autoHibernateSec)}`);
+  } finally {
+    await client.close();
+  }
+});
+
+// src/commands/vm/start.ts
+import { Command as Command11 } from "commander";
+var startCommand = new Command11("start").description("boot a stopped box again (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`booting ${name}\u2026`, client.startMachine(name));
@@ -1373,8 +1479,8 @@ var startCommand = new Command10("start").description("boot a stopped box again
 });
 
 // src/commands/vm/stop.ts
-import { Command as Command11 } from "commander";
-var stopCommand = new Command11("stop").description("shut a box down (its disk is kept; start it again with kvbox start)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command12 } from "commander";
+var stopCommand = new Command12("stop").description("shut a box down (its disk is kept; start it again with kvbox start)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`shutting ${name} down\u2026`, client.stopMachine(name));
@@ -1386,8 +1492,8 @@ var stopCommand = new Command11("stop").description("shut a box down (its disk i
 });
 
 // src/commands/vm/update.ts
-import { Command as Command12 } from "commander";
-var updateCommand = new Command12("update").description("move a box onto the current base image (its files stay; a running box restarts)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command13 } from "commander";
+var updateCommand = new Command13("update").description("move a box onto the current base image (its files stay; a running box restarts)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const before = pickRef(await client.listMachines(), name, me(client));
@@ -1409,8 +1515,8 @@ var updateCommand = new Command12("update").description("move a box onto the cur
 });
 
 // src/commands/vm/usage.ts
-import { Command as Command13 } from "commander";
-var usageCommand = new Command13("usage").description("how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)").argument("<name>", "box name").option("--since <date>", "count from this date instead of the box's creation, e.g. 2026-10-01").option("--json", "print as JSON").action(async (name, opts, cmd) => {
+import { Command as Command14 } from "commander";
+var usageCommand = new Command14("usage").description("how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)").argument("<name>", "box name").option("--since <date>", "count from this date instead of the box's creation, e.g. 2026-10-01").option("--json", "print as JSON").action(async (name, opts, cmd) => {
   let since;
   if (opts.since !== void 0) {
     const t = Date.parse(opts.since);
@@ -1457,8 +1563,8 @@ function block(u) {
 }
 
 // src/commands/vm/wake.ts
-import { Command as Command14 } from "commander";
-var wakeCommand = new Command14("wake").description("continue a hibernated box where it left off (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command15 } from "commander";
+var wakeCommand = new Command15("wake").description("continue a hibernated box where it left off (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`waking ${name} (loading its memory from disk)\u2026`, client.wakeMachine(name));
@@ -1470,15 +1576,15 @@ var wakeCommand = new Command14("wake").description("continue a hibernated box w
 });
 
 // src/commands/vm/index.ts
-var vmCommand = new Command15("vm").enablePositionalOptions().description("manage boxes (each one is a Firecracker microVM)").addCommand(newCommand).addCommand(lsCommand).addCommand(connectCommand).addCommand(execCommand).addCommand(stopCommand).addCommand(startCommand).addCommand(pauseCommand).addCommand(resumeCommand).addCommand(hibernateCommand).addCommand(wakeCommand).addCommand(updateCommand).addCommand(rescaleCommand).addCommand(usageCommand).addCommand(rmCommand);
+var vmCommand = new Command16("vm").enablePositionalOptions().description("manage boxes (each one is a Firecracker microVM)").addCommand(newCommand).addCommand(lsCommand).addCommand(connectCommand).addCommand(execCommand).addCommand(stopCommand).addCommand(startCommand).addCommand(pauseCommand).addCommand(resumeCommand).addCommand(hibernateCommand).addCommand(wakeCommand).addCommand(updateCommand).addCommand(rescaleCommand).addCommand(setCommand).addCommand(usageCommand).addCommand(rmCommand);
 for (const cmd of vmCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 var vmAliases = [newCommand, lsCommand, connectCommand, execCommand, stopCommand, startCommand, pauseCommand, resumeCommand, hibernateCommand, wakeCommand, rmCommand];
 
 // src/commands/server/index.ts
-import { Command as Command23 } from "commander";
+import { Command as Command24 } from "commander";
 
 // src/commands/server/join.ts
-import { Command as Command16 } from "commander";
+import { Command as Command17 } from "commander";
 
 // src/commands/server/daemon.ts
 import { spawn as spawn3 } from "child_process";
@@ -1515,7 +1621,7 @@ async function restartLocalServer(p = paths()) {
   return (await startLocalServer(p)).pid;
 }
 function runKvboxServer(args) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const child = spawn3("kvbox-server", args, { stdio: ["ignore", "pipe", "pipe"] });
     let out = "";
     let err = "";
@@ -1525,14 +1631,14 @@ function runKvboxServer(args) {
       reject(new KvboxError(e.code === "ENOENT" ? NOT_A_HOST_HINT : `could not run kvbox-server: ${e.message}`));
     });
     child.once("close", (code) => {
-      if (code === 0) resolve(out.trimEnd());
+      if (code === 0) resolve2(out.trimEnd());
       else reject(new KvboxError(err.trim().replace(/^error: /, "") || `kvbox-server ${args[0] ?? ""} exited with code ${String(code)}`, code === 2 ? 2 : 1));
     });
   });
 }
 
 // src/commands/server/join.ts
-var joinCommand = new Command16("join").description("put this machine behind a control plane (needs a one-time token minted there) and restart its server").argument("<control-plane-url>", "the control plane, e.g. https://api.kvbox.sh").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this machine at (default: its default-route address)").option("--name <name>", "how the control plane lists this machine (default: hostname)").action(async (url, opts) => {
+var joinCommand = new Command17("join").description("put this machine behind a control plane (needs a one-time token minted there) and restart its server").argument("<control-plane-url>", "the control plane, e.g. https://api.kvbox.sh").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this machine at (default: its default-route address)").option("--name <name>", "how the control plane lists this machine (default: hostname)").action(async (url, opts) => {
   const args = ["join", url, "--token", opts.token];
   if (opts.advertise !== void 0) args.push("--advertise", opts.advertise);
   if (opts.name !== void 0) args.push("--name", opts.name);
@@ -1542,8 +1648,8 @@ var joinCommand = new Command16("join").description("put this machine behind a c
 });
 
 // src/commands/server/leave.ts
-import { Command as Command17 } from "commander";
-var leaveCommand = new Command17("leave").description("take this machine out from behind its control plane and restart its server").action(async () => {
+import { Command as Command18 } from "commander";
+var leaveCommand = new Command18("leave").description("take this machine out from behind its control plane and restart its server").action(async () => {
   const p = paths();
   for (const line of (await runKvboxServer(["leave"])).split("\n")) info(line);
   if (await runningPid(p) === null) return;
@@ -1552,14 +1658,14 @@ var leaveCommand = new Command17("leave").description("take this machine out fro
 });
 
 // src/commands/server/relay.ts
-import { Command as Command18 } from "commander";
-var relayCommand = new Command18("relay").description("reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down").argument("<join-string>", "the line `kvbox-relay add` printed, or `off`").action(async (joinString) => {
+import { Command as Command19 } from "commander";
+var relayCommand = new Command19("relay").description("reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down").argument("<join-string>", "the line `kvbox-relay add` printed, or `off`").action(async (joinString) => {
   for (const line of (await runKvboxServer(["relay", joinString])).split("\n")) info(line);
 });
 
 // src/commands/server/start.ts
-import { Command as Command19 } from "commander";
-var startCommand2 = new Command19("start").description("start the local kvbox-server in the background").action(async (_opts, cmd) => {
+import { Command as Command20 } from "commander";
+var startCommand2 = new Command20("start").description("start the local kvbox-server in the background").action(async (_opts, cmd) => {
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }, { autoStart: false });
   try {
     const health = await client.health();
@@ -1575,17 +1681,30 @@ var startCommand2 = new Command19("start").description("start the local kvbox-se
 });
 
 // src/commands/server/status.ts
-import { Command as Command20 } from "commander";
-var statusCommand = new Command20("status").description("show whether this machine's server is running, its control plane and which base image new boxes get").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command21 } from "commander";
+var statusCommand = new Command21("status").description("show whether this machine's server is running, its control plane and which base image new boxes get").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true });
   try {
     const health = await client.health();
-    if (opts.json) json(health);
+    const atBoot = startsAtBoot(paths());
+    if (opts.json) json({ ...health, startsAtBoot: atBoot });
     else {
       info(`kvbox-server ${health.version} running, pid ${health.pid}`);
+      info(atBoot ? "starts at boot: yes, and brings back the boxes that were running" : "starts at boot: no (install-server.sh sets that up)");
+      const r = health.recovery;
+      if (r) {
+        if (r.booted.length > 0) info(`after the last restart it booted again: ${r.booted.join(", ")}`);
+        if (r.leftStopped.length > 0) info(`left stopped (were in standby, their memory was lost): ${r.leftStopped.join(", ")}`);
+        for (const f of r.failed) info(`did not come back: ${f.box} (${f.error})`);
+      }
       if (health.controlPlane) info(`control plane: ${health.controlPlane.name} at ${health.controlPlane.url}, this host answers it on ${health.controlPlane.hostUrl}`);
       else info("control plane: none (kvbox server join <url> --token <token> puts this machine behind one)");
-      if (health.relay) info(`relay: ${health.relay.name} lends this machine ${health.relay.publicIp} (tunnel to ${health.relay.endpoint})`);
+      if (health.relay) {
+        info(`relay: ${health.relay.name} lends this machine ${health.relay.publicIp} (tunnel to ${health.relay.endpoint})`);
+        if (health.relay.restarts && health.relay.lastRestartAt) {
+          info(`the tunnel stopped carrying traffic and was redialed ${health.relay.restarts} time(s) since the server started, last at ${health.relay.lastRestartAt}`);
+        }
+      }
       if (health.base === null) info("base image: none usable yet (run install-server.sh)");
       else info(`base image: ${health.base} (what kvbox new uses; kvbox vm update <box> moves an older box onto it)`);
     }
@@ -1595,8 +1714,8 @@ var statusCommand = new Command20("status").description("show whether this machi
 });
 
 // src/commands/server/stop.ts
-import { Command as Command21 } from "commander";
-var stopCommand2 = new Command21("stop").description("stop the local server (running boxes are not affected)").action(async () => {
+import { Command as Command22 } from "commander";
+var stopCommand2 = new Command22("stop").description("stop the local server (running boxes are not affected)").action(async () => {
   const pid = await runningPid(paths());
   if (pid === null) throw new KvboxError("kvbox-server is not running");
   await stopLocalServer(pid);
@@ -1604,8 +1723,8 @@ var stopCommand2 = new Command21("stop").description("stop the local server (run
 });
 
 // src/commands/server/trust-ca.ts
-import { Command as Command22 } from "commander";
-var trustCaCommand = new Command22("trust-ca").description("make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)").argument("[public-key]", "the CA public key (or its cert-authority line); or --from-cloud").option("--from-cloud", "ask the control plane this host joined for its current CA, show the fingerprint, then ask").option("-y, --yes", "do not ask for confirmation").option("--json", "print the report as JSON").action(async (publicKey, opts, cmd) => {
+import { Command as Command23 } from "commander";
+var trustCaCommand = new Command23("trust-ca").description("make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)").argument("[public-key]", "the CA public key (or its cert-authority line); or --from-cloud").option("--from-cloud", "ask the control plane this host joined for its current CA, show the fingerprint, then ask").option("-y, --yes", "do not ask for confirmation").option("--json", "print the report as JSON").action(async (publicKey, opts, cmd) => {
   if (publicKey === void 0 && !opts.fromCloud) throw new KvboxError("give the CA public key, or --from-cloud to fetch it from the control plane this host joined");
   if (publicKey !== void 0 && opts.fromCloud) throw new KvboxError("either a public key or --from-cloud, not both");
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true });
@@ -1643,16 +1762,16 @@ function describeReport(report) {
 }
 
 // src/commands/server/index.ts
-var serverCommand = new Command23("server").description("run or manage the kvbox server").addCommand(startCommand2).addCommand(statusCommand).addCommand(stopCommand2).addCommand(joinCommand).addCommand(leaveCommand).addCommand(relayCommand).addCommand(trustCaCommand);
+var serverCommand = new Command24("server").description("run or manage the kvbox server").addCommand(startCommand2).addCommand(statusCommand).addCommand(stopCommand2).addCommand(joinCommand).addCommand(leaveCommand).addCommand(relayCommand).addCommand(trustCaCommand);
 
 // src/commands/login.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
 import { hostname as osHostname } from "os";
 import { createInterface } from "readline/promises";
 import { Writable } from "stream";
-import { Command as Command24 } from "commander";
-var loginCommand = new Command24("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
+import { Command as Command25 } from "commander";
+var loginCommand = new Command25("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
   const url = normalizeUrl(urlArg ?? DEFAULT_CLOUD_URL);
   const creds = await readCredentials(opts);
   const session = await runLogin(url, creds, paths());
@@ -1698,7 +1817,7 @@ async function ensureSshKey(p = paths(), hostname = osHostname()) {
   await mkdir3(p.ssh, { recursive: true, mode: 448 });
   const havePrivate = await readFile5(p.sshKey).then(() => true, () => false);
   const args = havePrivate ? ["-y", "-f", p.sshKey] : ["-q", "-t", "ed25519", "-N", "", "-C", `kvbox@${hostname}`, "-f", p.sshKey];
-  const res = spawnSync2("ssh-keygen", args, { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
+  const res = spawnSync3("ssh-keygen", args, { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
   if (res.error) {
     if (res.error.code === "ENOENT") throw new KvboxError("ssh-keygen not found; install OpenSSH");
     throw new KvboxError(`could not run ssh-keygen: ${res.error.message}`);
@@ -1750,8 +1869,8 @@ async function firstLine(stream) {
 }
 
 // src/commands/logout.ts
-import { Command as Command25 } from "commander";
-var logoutCommand = new Command25("logout").description("log out of the control plane; commands target this machine's kvbox-server again").action(async () => {
+import { Command as Command26 } from "commander";
+var logoutCommand = new Command26("logout").description("log out of the control plane; commands target this machine's kvbox-server again").action(async () => {
   const p = paths();
   const session = await readSession(p).catch(() => null);
   switch (await runLogout(p)) {
@@ -1788,8 +1907,8 @@ async function runLogout(p = paths()) {
 }
 
 // src/commands/whoami.ts
-import { Command as Command26 } from "commander";
-var whoamiCommand = new Command26("whoami").description("show which account and control plane commands target (or local mode)").option("--json", "print as JSON").action(async (opts) => {
+import { Command as Command27 } from "commander";
+var whoamiCommand = new Command27("whoami").description("show which account and control plane commands target (or local mode)").option("--json", "print as JSON").action(async (opts) => {
   const session = await readSession();
   if (opts.json) {
     json(session ? { user: session.user, url: session.url, sshCertExpires: session.sshCertExpires ?? null } : null);
@@ -1805,11 +1924,11 @@ function describeSession(session) {
 }
 
 // src/commands/snapshots/index.ts
-import { Command as Command30 } from "commander";
+import { Command as Command31 } from "commander";
 
 // src/commands/snapshots/ls.ts
-import { Command as Command27, Option as Option4 } from "commander";
-var lsCommand2 = new Command27("ls").description("list snapshots (yours and your orgs'; --org <slug> for one org)").addOption(new Option4("-a, --all", "kept for older scripts: the listing covers everything you can see anyway").hideHelp()).option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command28, Option as Option4 } from "commander";
+var lsCommand2 = new Command28("ls").description("list snapshots (yours and your orgs'; --org <slug> for one org)").addOption(new Option4("-a, --all", "kept for older scripts: the listing covers everything you can see anyway").hideHelp()).option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const cloud = client.target.kind === "cloud";
@@ -1840,8 +1959,8 @@ var lsCommand2 = new Command27("ls").description("list snapshots (yours and your
 });
 
 // src/commands/snapshots/new.ts
-import { Command as Command28 } from "commander";
-var newCommand2 = new Command28("new").description("freeze a running box (memory + disk) into a snapshot; the box keeps running").argument("<box>", "box name").argument("<name>", "snapshot name").option("--json", "print the snapshot as JSON").action(async (box, name, opts, cmd) => {
+import { Command as Command29 } from "commander";
+var newCommand2 = new Command29("new").description("freeze a running box (memory + disk) into a snapshot; the box keeps running").argument("<box>", "box name").argument("<name>", "snapshot name").option("--json", "print the snapshot as JSON").action(async (box, name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const snap = await spin(`saving snapshot ${name} from box ${box} (memory + disk)\u2026`, client.createSnapshot({ box, name }));
@@ -1853,8 +1972,8 @@ var newCommand2 = new Command28("new").description("freeze a running box (memory
 });
 
 // src/commands/snapshots/rm.ts
-import { Command as Command29 } from "commander";
-var rmCommand2 = new Command29("rm").description("delete a snapshot (boxes made from it are not affected)").argument("<name>", "snapshot name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+import { Command as Command30 } from "commander";
+var rmCommand2 = new Command30("rm").description("delete a snapshot (boxes made from it are not affected)").argument("<name>", "snapshot name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   if (!await confirm(`Delete snapshot ${name}?`, opts.yes ?? false)) {
     info("cancelled");
     process.exitCode = 1;
@@ -1870,14 +1989,14 @@ var rmCommand2 = new Command29("rm").description("delete a snapshot (boxes made
 });
 
 // src/commands/snapshots/index.ts
-var snapshotsCommand = new Command30("snapshots").aliases(["snapshot", "snap"]).description("freeze running boxes into snapshots and manage them").addCommand(newCommand2).addCommand(lsCommand2).addCommand(rmCommand2);
+var snapshotsCommand = new Command31("snapshots").aliases(["snapshot", "snap"]).description("freeze running boxes into snapshots and manage them").addCommand(newCommand2).addCommand(lsCommand2).addCommand(rmCommand2);
 for (const cmd of snapshotsCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 
 // src/commands/org/index.ts
-import { Command as Command36 } from "commander";
+import { Command as Command37 } from "commander";
 
 // src/commands/org/ls.ts
-import { Command as Command31 } from "commander";
+import { Command as Command32 } from "commander";
 
 // src/commands/org/context.ts
 var NOT_LOGGED_IN = "orgs live on the control plane: kvbox login first";
@@ -1897,7 +2016,7 @@ function orgFor(opts, target) {
 }
 
 // src/commands/org/ls.ts
-var lsCommand3 = new Command31("ls").description("list the orgs you belong to and your role in each").option("--json", "print as JSON").action(async (opts, cmd) => {
+var lsCommand3 = new Command32("ls").description("list the orgs you belong to and your role in each").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const orgs = await client.listOrgs();
@@ -1919,8 +2038,8 @@ function orgRows(orgs) {
 }
 
 // src/commands/org/members.ts
-import { Command as Command32, Option as Option5 } from "commander";
-var lsCommand4 = new Command32("ls").description("list an org's members and their roles").option("-o, --org <slug>", "the org (or --org before the command)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command33, Option as Option5 } from "commander";
+var lsCommand4 = new Command33("ls").description("list an org's members and their roles").option("-o, --org <slug>", "the org (or --org before the command)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const org = await client.getOrg(orgFor(opts, client.target));
@@ -1934,7 +2053,7 @@ var lsCommand4 = new Command32("ls").description("list an org's members and thei
     await client.close();
   }
 });
-var addCommand = new Command32("add").description("add a user to an org (admins and owners; only an owner can add an owner)").argument("<user>", "their username").addOption(new Option5("-r, --role <role>", "their role").choices(ORG_ROLES).default("member")).option("-o, --org <slug>", "the org (or --org before the command)").action(async (user, opts, cmd) => {
+var addCommand = new Command33("add").description("add a user to an org (admins and owners; only an owner can add an owner)").argument("<user>", "their username").addOption(new Option5("-r, --role <role>", "their role").choices(ORG_ROLES).default("member")).option("-o, --org <slug>", "the org (or --org before the command)").action(async (user, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -1944,7 +2063,7 @@ var addCommand = new Command32("add").description("add a user to an org (admins
     await client.close();
   }
 });
-var rmCommand3 = new Command32("rm").description("remove a member (or leave: remove yourself)").argument("<user>", "their username").option("-o, --org <slug>", "the org (or --org before the command)").option("-y, --yes", "do not ask for confirmation").action(async (user, opts, cmd) => {
+var rmCommand3 = new Command33("rm").description("remove a member (or leave: remove yourself)").argument("<user>", "their username").option("-o, --org <slug>", "the org (or --org before the command)").option("-y, --yes", "do not ask for confirmation").action(async (user, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -1960,11 +2079,11 @@ var rmCommand3 = new Command32("rm").description("remove a member (or leave: rem
     await client.close();
   }
 });
-var membersCommand = new Command32("members").description("who is in an org and what they may do").addCommand(lsCommand4).addCommand(addCommand).addCommand(rmCommand3);
+var membersCommand = new Command33("members").description("who is in an org and what they may do").addCommand(lsCommand4).addCommand(addCommand).addCommand(rmCommand3);
 
 // src/commands/org/new.ts
-import { Command as Command33 } from "commander";
-var newCommand3 = new Command33("new").description("create an org; you become its owner (the slug is permanent, the name is not)").argument("<slug>", "the org's slug: lowercase, like a username (acme)").option("-n, --name <name>", "display name (default: the slug)").option("--json", "print the org as JSON").action(async (slug, opts, cmd) => {
+import { Command as Command34 } from "commander";
+var newCommand3 = new Command34("new").description("create an org; you become its owner (the slug is permanent, the name is not)").argument("<slug>", "the org's slug: lowercase, like a username (acme)").option("-n, --name <name>", "display name (default: the slug)").option("--json", "print the org as JSON").action(async (slug, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const org = await client.createOrg({ slug, name: opts.name ?? slug });
@@ -1980,8 +2099,8 @@ var newCommand3 = new Command33("new").description("create an org; you become it
 });
 
 // src/commands/org/rm.ts
-import { Command as Command34 } from "commander";
-var rmCommand4 = new Command34("rm").description("delete an org (owners only; remove its boxes and snapshots first)").argument("<slug>", "the org").option("-y, --yes", "do not ask for confirmation").action(async (slug, opts, cmd) => {
+import { Command as Command35 } from "commander";
+var rmCommand4 = new Command35("rm").description("delete an org (owners only; remove its boxes and snapshots first)").argument("<slug>", "the org").option("-y, --yes", "do not ask for confirmation").action(async (slug, opts, cmd) => {
   if (!await confirm(`Delete org ${slug}? Its members lose access; its slug stays taken.`, opts.yes ?? false)) {
     info("cancelled");
     process.exitCode = 1;
@@ -1997,8 +2116,8 @@ var rmCommand4 = new Command34("rm").description("delete an org (owners only; re
 });
 
 // src/commands/org/role.ts
-import { Argument, Command as Command35 } from "commander";
-var roleCommand = new Command35("role").description("change a member's role (owners only)").argument("<user>", "their username").addArgument(new Argument("<role>", "owner, admin or member").choices(ORG_ROLES)).option("-o, --org <slug>", "the org (default: the current context)").action(async (user, role, opts, cmd) => {
+import { Argument, Command as Command36 } from "commander";
+var roleCommand = new Command36("role").description("change a member's role (owners only)").argument("<user>", "their username").addArgument(new Argument("<role>", "owner, admin or member").choices(ORG_ROLES)).option("-o, --org <slug>", "the org (default: the current context)").action(async (user, role, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2010,11 +2129,11 @@ var roleCommand = new Command35("role").description("change a member's role (own
 });
 
 // src/commands/org/index.ts
-var orgCommand = new Command36("org").description("orgs: shared slugs that own boxes, with owners, admins and members").addCommand(lsCommand3).addCommand(newCommand3).addCommand(membersCommand).addCommand(roleCommand).addCommand(rmCommand4);
+var orgCommand = new Command37("org").description("orgs: shared slugs that own boxes, with owners, admins and members").addCommand(lsCommand3).addCommand(newCommand3).addCommand(membersCommand).addCommand(roleCommand).addCommand(rmCommand4);
 
 // src/commands/usage.ts
-import { Command as Command37 } from "commander";
-var usageCommand2 = new Command37("usage").description("what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost").option("--since <date>", "count from this date, e.g. 2026-10-01 (default: the 1st of this month)").option("--until <date>", "count up to this date (default: now)").option("--org <slug>", "one org's boxes only").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command38 } from "commander";
+var usageCommand2 = new Command38("usage").description("what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost").option("--since <date>", "count from this date, e.g. 2026-10-01 (default: the 1st of this month)").option("--until <date>", "count up to this date (default: now)").option("--org <slug>", "one org's boxes only").option("--json", "print as JSON").action(async (opts, cmd) => {
   for (const [name, value] of [
     ["since", opts.since],
     ["until", opts.until]
@@ -2087,8 +2206,8 @@ function usageRows(report, cloud) {
 }
 
 // src/commands/credit.ts
-import { Command as Command38 } from "commander";
-var creditCommand = new Command38("credit").description("the prepaid credit left on your account and on each of your orgs").option("--org <slug>", "one org only").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command39 } from "commander";
+var creditCommand = new Command39("credit").description("the prepaid credit left on your account and on each of your orgs").option("--org <slug>", "one org only").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals(), { autoStart: false });
   try {
     if (client.target.kind === "local") throw new KvboxError("credit lives on the control plane: kvbox login first");
@@ -2117,7 +2236,7 @@ function creditRow(b, me2) {
 
 // src/program.ts
 function buildProgram() {
-  const program = new Command39("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
+  const program = new Command40("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
   program.addCommand(vmCommand);
   program.addCommand(snapshotsCommand);
   program.addCommand(serverCommand);