ghostdock 0.0.13 → 0.0.15

package/dist/index.js

@@ -718,9 +718,33 @@ var GENERATED_TOOL_CATALOG = [
                 "files"
               ],
               additionalProperties: false
+            },
+            {
+              type: "object",
+              properties: {
+                type: {
+                  type: "string",
+                  const: "compose"
+                },
+                reference: {
+                  type: "string",
+                  minLength: 1,
+                  maxLength: 512,
+                  pattern: "^oci:\\/\\/(?:[a-z0-9]+(?:[.-][a-z0-9]+)*(?::\\d{1,5})?\\/)?[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*(?::[A-Za-z0-9_][A-Za-z0-9_.-]{0,127})?(?:@sha256:[a-f0-9]{64})?$"
+                },
+                override: {
+                  type: "string",
+                  maxLength: 262144
+                }
+              },
+              required: [
+                "type",
+                "reference"
+              ],
+              additionalProperties: false
             }
           ],
-          description: 'What the sandbox boots from. Required. "image" boots an org catalog row by id ({ id } from images_list / images_get — images_add OCI bookmarks, images_add_dockerfile, and images_add_compose rows) or any OCI ref ({ ref }); "dockerfile" builds inline Dockerfile text only (ghostdock.* LABEL lines parsed for manifest; this tool has no build directory, so COPY/ADD of local files fails — use the CLI `ghostdock sandboxes build --kind dockerfile` with a directory or ZIP); "compose" boots Docker-in-Docker from the given inline files (must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels parsed for manifest). A Compose project that needs extra files is not accepted here — use `ghostdock sandboxes build --kind compose`. Image, dockerfile, and compose sources never appear in snapshots_list. Published static sites use sites_publish (CDN), not a snapshot.'
+          description: 'What the sandbox boots from. Required. "image" boots an org catalog row by id ({ id } from images_list / images_get — images_add OCI bookmarks, images_add_dockerfile, and images_add_compose rows) or any OCI ref ({ ref }); "dockerfile" builds inline Dockerfile text only (ghostdock.* LABEL lines parsed for manifest; this tool has no build directory, so COPY/ADD of local files fails — use the CLI `ghostdock sandboxes build --kind dockerfile` with a directory or ZIP); "compose" boots Docker-in-Docker from the given inline files (must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels parsed for manifest). A Compose project that needs extra files is not accepted here — use `ghostdock sandboxes build --kind compose`. "compose" also takes a published Compose project instead of files ({ reference: "oci://…", override? }): it runs through include:, the override merged into it. Image, dockerfile, and compose sources never appear in snapshots_list. Published static sites use sites_publish (CDN), not a snapshot.'
         },
         resources: {
           type: "object",
@@ -4454,11 +4478,16 @@ var GENERATED_TOOL_CATALOG = [
       "images",
       "add-compose"
     ],
-    description: "Add Compose files to the organization’s image catalog. Must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels become its manifest. Fails if the name is taken.",
+    description: "Add a Compose project to the organization’s image catalog. Give its files, or a reference: a Compose project published as an OCI artifact (oci://…), used through include: with an optional override. ghostdock.* service labels (of the files, or of the override) become its manifest. Fails if the name is taken.",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
       properties: {
+        organization: {
+          type: "string",
+          minLength: 1,
+          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+        },
         name: {
           type: "string",
           minLength: 1,
@@ -4466,6 +4495,7 @@ var GENERATED_TOOL_CATALOG = [
           description: "Image name, unique in the organization."
         },
         files: {
+          description: "Compose files by file name. Must include docker-compose.yml/yaml or compose.yml/yaml.",
           type: "object",
           propertyNames: {
             type: "string"
@@ -4474,19 +4504,24 @@ var GENERATED_TOOL_CATALOG = [
             type: "string",
             minLength: 1,
             maxLength: 512000
-          },
-          description: "Compose files by file name. Must include docker-compose.yml/yaml or compose.yml/yaml."
+          }
         },
-        organization: {
+        reference: {
+          description: "A published Compose project instead of files, e.g. oci://docker.io/ghostdockhq/vm-compose:ubuntu-26.04.",
           type: "string",
           minLength: 1,
-          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+          maxLength: 512,
+          pattern: "^oci:\\/\\/(?:[a-z0-9]+(?:[.-][a-z0-9]+)*(?::\\d{1,5})?\\/)?[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*(?::[A-Za-z0-9_][A-Za-z0-9_.-]{0,127})?(?:@sha256:[a-f0-9]{64})?$"
+        },
+        override: {
+          description: "With reference: a Compose file merged into it (services, environment, labels).",
+          type: "string",
+          maxLength: 262144
         }
       },
       required: [
-        "name",
-        "files",
-        "organization"
+        "organization",
+        "name"
       ],
       additionalProperties: false
     },
@@ -4509,7 +4544,7 @@ var GENERATED_TOOL_CATALOG = [
     cliArgs: [
       "imageId"
     ],
-    description: "Replace a catalog Compose image’s files and/or name. Re-parses its labels.",
+    description: "Replace a catalog Compose image’s files, reference, override and/or name. Re-parses its labels.",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -4536,6 +4571,25 @@ var GENERATED_TOOL_CATALOG = [
             maxLength: 512000
           }
         },
+        reference: {
+          description: "A new reference (oci://…): the image becomes a Compose reference.",
+          type: "string",
+          minLength: 1,
+          maxLength: 512,
+          pattern: "^oci:\\/\\/(?:[a-z0-9]+(?:[.-][a-z0-9]+)*(?::\\d{1,5})?\\/)?[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*(?::[A-Za-z0-9_][A-Za-z0-9_.-]{0,127})?(?:@sha256:[a-f0-9]{64})?$"
+        },
+        override: {
+          description: "A reference’s new override; null removes it.",
+          anyOf: [
+            {
+              type: "string",
+              maxLength: 262144
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
         name: {
           description: "New image name. Omit to keep it.",
           type: "string",
@@ -4625,6 +4679,13 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
+        container: {
+          description: "Container to work in, by name, from sandboxes_containers_list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them.",
+          type: "string",
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
+        },
         files: {
           description: "Small inline files: { path, content } for utf8 text, or { path, contentBase64 } for binary.",
           type: "array",
@@ -4701,6 +4762,13 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
+        container: {
+          description: "Container to work in, by name, from sandboxes_containers_list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them.",
+          type: "string",
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
+        },
         path: {
           description: "Directory to list. Absolute or relative to /. Defaults to /workspace.",
           type: "string",
@@ -4780,6 +4848,13 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
+        container: {
+          description: "Container to work in, by name, from sandboxes_containers_list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them.",
+          type: "string",
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
+        },
         path: {
           type: "string",
           minLength: 1,
@@ -5922,6 +5997,13 @@ var GENERATED_TOOL_CATALOG = [
           type: "string",
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
+        },
+        container: {
+          description: "Container to work in, by name, from sandboxes_containers_list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them.",
+          type: "string",
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
         }
       },
       required: [
@@ -5982,17 +6064,17 @@ var GENERATED_TOOL_CATALOG = [
     }
   },
   {
-    id: "sandboxes_commands_run",
-    name: "sandboxes_commands_run",
+    id: "sandboxes_containers_list",
+    name: "sandboxes_containers_list",
     cli: [
       "sandboxes",
-      "commands",
-      "run"
+      "containers",
+      "list"
     ],
     cliArgs: [
       "sandboxId"
     ],
-    description: "Run a shell command in a sandbox. Waits up to 120 seconds, then returns sessionId and commandId to poll. Starts the sandbox when allowed. Sessions do not survive idle-stop: for a process that must keep running, read the sandbox-boot skill. Never put secret values in the command; it is logged.",
+    description: "List the containers of a sandbox, running or not. Each with state, health, restart policy, ports, Compose project and service, deletion protection, ghostdock.* labels, and which one is the default. A stopped sandbox lists none (it is not started for this).",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -6006,31 +6088,11 @@ var GENERATED_TOOL_CATALOG = [
           type: "string",
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
-        },
-        command: {
-          type: "string",
-          minLength: 1,
-          description: "Shell command to run. Never include secret values: commands are logged."
-        },
-        sessionId: {
-          description: "Session from sandboxes_shells_create, to keep cwd and environment from earlier commands. Omit for a one-off session.",
-          type: "string",
-          minLength: 1
-        },
-        cwd: {
-          description: "Directory to run the command in.",
-          type: "string",
-          minLength: 1
-        },
-        waitSeconds: {
-          description: "Seconds to wait before returning handles to poll: 1 to 120, default 120.",
-          type: "number"
         }
       },
       required: [
         "organization",
-        "sandboxId",
-        "command"
+        "sandboxId"
       ],
       additionalProperties: false
     },
@@ -6044,17 +6106,16 @@ var GENERATED_TOOL_CATALOG = [
     }
   },
   {
-    id: "sandboxes_commands_get",
-    name: "sandboxes_commands_get",
+    id: "sandboxes_default_container",
+    name: "sandboxes_default_container",
     cli: [
       "sandboxes",
-      "commands",
-      "get"
+      "default-container"
     ],
     cliArgs: [
-      "commandId"
+      "sandboxId"
     ],
-    description: "Get a shell command’s status and exit code.",
+    description: "Show, set or clear the sandbox’s default container. SSH, the terminal, files, commands and MCP land there when no container is named. Without container or clear it only shows the setting.",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -6069,22 +6130,21 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
-        sessionId: {
+        container: {
+          description: "Container to make the default, by name. The running sandbox must have it.",
           type: "string",
           minLength: 1,
-          description: "Session id returned by sandboxes_commands_run together with the commandId."
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
         },
-        commandId: {
-          type: "string",
-          minLength: 1,
-          description: "Command id returned by sandboxes_commands_run."
+        clear: {
+          description: "Clear the default.",
+          type: "boolean"
         }
       },
       required: [
         "organization",
-        "sandboxId",
-        "sessionId",
-        "commandId"
+        "sandboxId"
       ],
       additionalProperties: false
     },
@@ -6098,17 +6158,18 @@ var GENERATED_TOOL_CATALOG = [
     }
   },
   {
-    id: "sandboxes_commands_logs",
-    name: "sandboxes_commands_logs",
+    id: "sandboxes_containers_protection",
+    name: "sandboxes_containers_protection",
     cli: [
       "sandboxes",
-      "commands",
-      "logs"
+      "containers",
+      "protection"
     ],
     cliArgs: [
-      "commandId"
+      "sandboxId",
+      "container"
     ],
-    description: "Get a page of a shell command’s stdout and stderr.",
+    description: "Switch a container’s deletion protection on or off. A protected container cannot be removed or recreated (docker rm, compose down) until its protection is off. Starts the sandbox when needed.",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -6123,28 +6184,23 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
-        sessionId: {
-          type: "string",
-          minLength: 1,
-          description: "Session id returned by sandboxes_commands_run together with the commandId."
-        },
-        commandId: {
+        container: {
           type: "string",
           minLength: 1,
-          description: "Command id returned by sandboxes_commands_run."
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$",
+          description: "Container, by name."
         },
-        offset: {
-          description: "Character offset to continue reading from. Default 0.",
-          type: "integer",
-          minimum: 0,
-          maximum: 9007199254740991
+        protected: {
+          type: "boolean",
+          description: "true: protect it; false: allow removing it."
         }
       },
       required: [
         "organization",
         "sandboxId",
-        "sessionId",
-        "commandId"
+        "container",
+        "protected"
       ],
       additionalProperties: false
     },
@@ -6158,17 +6214,18 @@ var GENERATED_TOOL_CATALOG = [
     }
   },
   {
-    id: "sandboxes_commands_kill",
-    name: "sandboxes_commands_kill",
+    id: "sandboxes_containers_start",
+    name: "sandboxes_containers_start",
     cli: [
       "sandboxes",
-      "commands",
-      "kill"
+      "containers",
+      "start"
     ],
     cliArgs: [
-      "commandId"
+      "sandboxId",
+      "container"
     ],
-    description: "Interrupt a running shell command.",
+    description: "Start a stopped container, as docker start does. A running container stays as it is. Starts the sandbox when needed.",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -6183,22 +6240,18 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
-        sessionId: {
-          type: "string",
-          minLength: 1,
-          description: "Session id returned by sandboxes_commands_run together with the commandId."
-        },
-        commandId: {
+        container: {
           type: "string",
           minLength: 1,
-          description: "Command id returned by sandboxes_commands_run."
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$",
+          description: "Container, by name."
         }
       },
       required: [
         "organization",
         "sandboxId",
-        "sessionId",
-        "commandId"
+        "container"
       ],
       additionalProperties: false
     },
@@ -6212,17 +6265,18 @@ var GENERATED_TOOL_CATALOG = [
     }
   },
   {
-    id: "sandboxes_shells_create",
-    name: "sandboxes_shells_create",
+    id: "sandboxes_containers_stop",
+    name: "sandboxes_containers_stop",
     cli: [
       "sandboxes",
-      "shells",
-      "create"
+      "containers",
+      "stop"
     ],
     cliArgs: [
-      "sandboxId"
+      "sandboxId",
+      "container"
     ],
-    description: "Open a shell session that keeps cwd and environment between commands. Starts the sandbox when allowed; the session ends at idle-stop.",
+    description: "Stop a container, as docker stop does. It gets its own stop signal, then a kill after its own stop timeout. It stays stopped while the sandbox sleeps and wakes, as Docker keeps a stopped container stopped, unless its restart policy is always. On a stopped sandbox it does nothing (note sandbox_stopped). The container main runs the sandbox: its stop is refused (main_is_the_sandbox), pause the sandbox instead. Deletion protection does not block it. note says when it was the default container or the last one running: then SSH, commands and files have nowhere to land until one runs.",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -6237,15 +6291,18 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
-        sessionId: {
-          description: "Id for the new session: a slug; user-cmd, image-cmd and compose are reserved. Omit to generate one.",
+        container: {
           type: "string",
-          minLength: 1
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$",
+          description: "Container, by name."
         }
       },
       required: [
         "organization",
-        "sandboxId"
+        "sandboxId",
+        "container"
       ],
       additionalProperties: false
     },
@@ -6259,17 +6316,18 @@ var GENERATED_TOOL_CATALOG = [
     }
   },
   {
-    id: "sandboxes_shells_close",
-    name: "sandboxes_shells_close",
+    id: "sandboxes_containers_restart",
+    name: "sandboxes_containers_restart",
     cli: [
       "sandboxes",
-      "shells",
-      "close"
+      "containers",
+      "restart"
     ],
     cliArgs: [
-      "sessionId"
+      "sandboxId",
+      "container"
     ],
-    description: "Close a shell session.",
+    description: "Restart a container, as docker restart does (stopping as docker stop does). Starts the sandbox when needed.",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -6284,16 +6342,18 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
-        sessionId: {
+        container: {
           type: "string",
           minLength: 1,
-          description: "Session id from sandboxes_shells_create."
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$",
+          description: "Container, by name."
         }
       },
       required: [
         "organization",
         "sandboxId",
-        "sessionId"
+        "container"
       ],
       additionalProperties: false
     },
@@ -6307,16 +6367,18 @@ var GENERATED_TOOL_CATALOG = [
     }
   },
   {
-    id: "sandboxes_set_boot",
-    name: "sandboxes_set_boot",
+    id: "sandboxes_containers_logs",
+    name: "sandboxes_containers_logs",
     cli: [
       "sandboxes",
-      "set-boot"
+      "containers",
+      "logs"
     ],
     cliArgs: [
-      "sandboxId"
+      "sandboxId",
+      "container"
     ],
-    description: "Register a command that starts now and again after every restart. For example bun dev. On Compose it runs after the stack; on a Dockerfile it replaces the image CMD. Snapshots cannot register one. Read the sandbox-boot skill.",
+    description: "Read a container’s output, as docker logs does. Oldest first, each line with its stream (stdout, stderr) and time. The last tail lines (default 200), or with after only the lines after that time: pass the last line’s time to follow. truncated says lines were left out. A stopped sandbox has none (it is not started for this).",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -6331,25 +6393,29 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
-        command: {
+        container: {
           type: "string",
           minLength: 1,
-          description: "Command to start, e.g. bun dev."
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$",
+          description: "Container, by name."
         },
-        cwd: {
-          description: "Directory to run it in. Default /.",
-          type: "string",
-          minLength: 1
+        tail: {
+          description: "The last N lines (at most 5000).",
+          type: "integer",
+          minimum: 1,
+          maximum: 5000
         },
-        start: {
-          description: "Also start it now, not only after restarts. Default true.",
-          type: "boolean"
+        after: {
+          description: "Only lines after this time: the time of the last line already read.",
+          type: "string",
+          pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?(Z|[+-]\\d{2}:\\d{2})$"
         }
       },
       required: [
         "organization",
         "sandboxId",
-        "command"
+        "container"
       ],
       additionalProperties: false
     },
@@ -6363,16 +6429,17 @@ var GENERATED_TOOL_CATALOG = [
     }
   },
   {
-    id: "sandboxes_update",
-    name: "sandboxes_update",
+    id: "sandboxes_storage_list",
+    name: "sandboxes_storage_list",
     cli: [
       "sandboxes",
-      "update"
+      "storage",
+      "list"
     ],
     cliArgs: [
       "sandboxId"
     ],
-    description: "Change a sandbox’s display name, idle-stop or auto-delete interval. Omit a field to keep it; null resets it to the platform default.",
+    description: "List a sandbox’s volumes and sandbox folders. The sandbox folders are where bind mounts land. Each with its size and sizeState (measured; measuring: ask again in a few seconds; tooBig: too big to measure cheaply; outside: a volume bound outside the sandbox folders, not measured nor browsable) and the containers using it, plus every container’s mounts. truncated says entries were left out. A stopped sandbox lists none (it is not started for this).",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -6386,39 +6453,6 @@ var GENERATED_TOOL_CATALOG = [
           type: "string",
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
-        },
-        displayName: {
-          description: "New display name. Null clears it; omit to keep it.",
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ]
-        },
-        autoStopIntervalMinutes: {
-          description: "Minutes of inactivity before the platform worker idle-stops the sandbox. -1 always on. 0 is rejected. Null resets to the platform default. Provider-native timers are optional backup.",
-          anyOf: [
-            {
-              type: "number"
-            },
-            {
-              type: "null"
-            }
-          ]
-        },
-        autoDeleteIntervalMinutes: {
-          description: "Minutes the sandbox stays stopped before the record is deleted. 0 deletes it when it stops. -1 keeps it. Null resets to the platform default. Provider-native timers are optional backup.",
-          anyOf: [
-            {
-              type: "number"
-            },
-            {
-              type: "null"
-            }
-          ]
         }
       },
       required: [
@@ -6437,16 +6471,17 @@ var GENERATED_TOOL_CATALOG = [
     }
   },
   {
-    id: "sandboxes_resize",
-    name: "sandboxes_resize",
+    id: "sandboxes_storage_delete",
+    name: "sandboxes_storage_delete",
     cli: [
       "sandboxes",
-      "resize"
+      "storage",
+      "delete"
     ],
     cliArgs: [
       "sandboxId"
     ],
-    description: "Change a sandbox’s CPU and/or memory. While running only increases are allowed; stop it first to decrease (this tool does not stop it). Disk: sandboxes_resize_disk.",
+    description: "Delete a named volume or a top-level sandbox folder, with everything in it. Refused while a container mounts it (in any state: a stopped one counts, so stopping does not help), mounts a folder above it (a bind of /), or a volume keeps its data in the folder: remove those first.",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -6461,20 +6496,25 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
-        cpu: {
-          description: "Number of CPUs.",
-          type: "number",
-          exclusiveMinimum: 0
+        kind: {
+          type: "string",
+          enum: [
+            "volume",
+            "folder"
+          ],
+          description: "volume or folder."
         },
-        memoryGiB: {
-          description: "Memory in GiB.",
-          type: "number",
-          exclusiveMinimum: 0
+        name: {
+          type: "string",
+          minLength: 1,
+          description: "The volume’s name, or the folder’s path in the sandbox (/srv, not /srv/app)."
         }
       },
       required: [
         "organization",
-        "sandboxId"
+        "sandboxId",
+        "kind",
+        "name"
       ],
       additionalProperties: false
     },
@@ -6488,16 +6528,17 @@ var GENERATED_TOOL_CATALOG = [
     }
   },
   {
-    id: "sandboxes_resize_disk",
-    name: "sandboxes_resize_disk",
+    id: "sandboxes_commands_run",
+    name: "sandboxes_commands_run",
     cli: [
       "sandboxes",
-      "resize-disk"
+      "commands",
+      "run"
     ],
     cliArgs: [
       "sandboxId"
     ],
-    description: "Grow a sandbox’s disk. The sandbox must be stopped first (this tool does not stop it). Disk only grows, never shrinks.",
+    description: "Run a shell command in a sandbox. Waits up to 120 seconds, then returns sessionId and commandId to poll. Starts the sandbox when allowed. Sessions do not survive idle-stop: for a process that must keep running, read the sandbox-boot skill. Never put secret values in the command; it is logged.",
     inputSchema: {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -6512,10 +6553,557 @@ var GENERATED_TOOL_CATALOG = [
           minLength: 1,
           description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
         },
-        diskGiB: {
-          type: "number",
-          exclusiveMinimum: 0,
-          description: "New total disk size in GiB; must be larger than the current size."
+        container: {
+          description: "Container to work in, by name, from sandboxes_containers_list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them.",
+          type: "string",
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
+        },
+        command: {
+          type: "string",
+          minLength: 1,
+          description: "Shell command to run. Never include secret values: commands are logged."
+        },
+        sessionId: {
+          description: "Session from sandboxes_shells_create, to keep cwd and environment from earlier commands. Omit for a one-off session.",
+          type: "string",
+          minLength: 1
+        },
+        cwd: {
+          description: "Directory to run the command in.",
+          type: "string",
+          minLength: 1
+        },
+        waitSeconds: {
+          description: "Seconds to wait before returning handles to poll: 1 to 120, default 120.",
+          type: "number"
+        }
+      },
+      required: [
+        "organization",
+        "sandboxId",
+        "command"
+      ],
+      additionalProperties: false
+    },
+    outputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      propertyNames: {
+        type: "string"
+      },
+      additionalProperties: {}
+    }
+  },
+  {
+    id: "sandboxes_commands_get",
+    name: "sandboxes_commands_get",
+    cli: [
+      "sandboxes",
+      "commands",
+      "get"
+    ],
+    cliArgs: [
+      "commandId"
+    ],
+    description: "Get a shell command’s status and exit code.",
+    inputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        organization: {
+          type: "string",
+          minLength: 1,
+          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+        },
+        sandboxId: {
+          type: "string",
+          minLength: 1,
+          description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
+        },
+        container: {
+          description: "Container to work in, by name, from sandboxes_containers_list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them.",
+          type: "string",
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
+        },
+        sessionId: {
+          type: "string",
+          minLength: 1,
+          description: "Session id returned by sandboxes_commands_run together with the commandId."
+        },
+        commandId: {
+          type: "string",
+          minLength: 1,
+          description: "Command id returned by sandboxes_commands_run."
+        }
+      },
+      required: [
+        "organization",
+        "sandboxId",
+        "sessionId",
+        "commandId"
+      ],
+      additionalProperties: false
+    },
+    outputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      propertyNames: {
+        type: "string"
+      },
+      additionalProperties: {}
+    }
+  },
+  {
+    id: "sandboxes_commands_logs",
+    name: "sandboxes_commands_logs",
+    cli: [
+      "sandboxes",
+      "commands",
+      "logs"
+    ],
+    cliArgs: [
+      "commandId"
+    ],
+    description: "Get a page of a shell command’s stdout and stderr.",
+    inputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        organization: {
+          type: "string",
+          minLength: 1,
+          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+        },
+        sandboxId: {
+          type: "string",
+          minLength: 1,
+          description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
+        },
+        container: {
+          description: "Container to work in, by name, from sandboxes_containers_list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them.",
+          type: "string",
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
+        },
+        sessionId: {
+          type: "string",
+          minLength: 1,
+          description: "Session id returned by sandboxes_commands_run together with the commandId."
+        },
+        commandId: {
+          type: "string",
+          minLength: 1,
+          description: "Command id returned by sandboxes_commands_run."
+        },
+        offset: {
+          description: "Character offset to continue reading from. Default 0.",
+          type: "integer",
+          minimum: 0,
+          maximum: 9007199254740991
+        }
+      },
+      required: [
+        "organization",
+        "sandboxId",
+        "sessionId",
+        "commandId"
+      ],
+      additionalProperties: false
+    },
+    outputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      propertyNames: {
+        type: "string"
+      },
+      additionalProperties: {}
+    }
+  },
+  {
+    id: "sandboxes_commands_kill",
+    name: "sandboxes_commands_kill",
+    cli: [
+      "sandboxes",
+      "commands",
+      "kill"
+    ],
+    cliArgs: [
+      "commandId"
+    ],
+    description: "Interrupt a running shell command.",
+    inputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        organization: {
+          type: "string",
+          minLength: 1,
+          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+        },
+        sandboxId: {
+          type: "string",
+          minLength: 1,
+          description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
+        },
+        container: {
+          description: "Container to work in, by name, from sandboxes_containers_list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them.",
+          type: "string",
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
+        },
+        sessionId: {
+          type: "string",
+          minLength: 1,
+          description: "Session id returned by sandboxes_commands_run together with the commandId."
+        },
+        commandId: {
+          type: "string",
+          minLength: 1,
+          description: "Command id returned by sandboxes_commands_run."
+        }
+      },
+      required: [
+        "organization",
+        "sandboxId",
+        "sessionId",
+        "commandId"
+      ],
+      additionalProperties: false
+    },
+    outputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      propertyNames: {
+        type: "string"
+      },
+      additionalProperties: {}
+    }
+  },
+  {
+    id: "sandboxes_shells_create",
+    name: "sandboxes_shells_create",
+    cli: [
+      "sandboxes",
+      "shells",
+      "create"
+    ],
+    cliArgs: [
+      "sandboxId"
+    ],
+    description: "Open a shell session that keeps cwd and environment between commands. Starts the sandbox when allowed; the session ends at idle-stop.",
+    inputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        organization: {
+          type: "string",
+          minLength: 1,
+          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+        },
+        sandboxId: {
+          type: "string",
+          minLength: 1,
+          description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
+        },
+        container: {
+          description: "Container to work in, by name, from sandboxes_containers_list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them.",
+          type: "string",
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
+        },
+        sessionId: {
+          description: "Id for the new session: a slug; user-cmd, image-cmd and compose are reserved. Omit to generate one.",
+          type: "string",
+          minLength: 1
+        }
+      },
+      required: [
+        "organization",
+        "sandboxId"
+      ],
+      additionalProperties: false
+    },
+    outputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      propertyNames: {
+        type: "string"
+      },
+      additionalProperties: {}
+    }
+  },
+  {
+    id: "sandboxes_shells_close",
+    name: "sandboxes_shells_close",
+    cli: [
+      "sandboxes",
+      "shells",
+      "close"
+    ],
+    cliArgs: [
+      "sessionId"
+    ],
+    description: "Close a shell session.",
+    inputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        organization: {
+          type: "string",
+          minLength: 1,
+          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+        },
+        sandboxId: {
+          type: "string",
+          minLength: 1,
+          description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
+        },
+        container: {
+          description: "Container to work in, by name, from sandboxes_containers_list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them.",
+          type: "string",
+          minLength: 1,
+          maxLength: 255,
+          pattern: "^[a-zA-Z0-9][a-zA-Z0-9_.-]*$"
+        },
+        sessionId: {
+          type: "string",
+          minLength: 1,
+          description: "Session id from sandboxes_shells_create."
+        }
+      },
+      required: [
+        "organization",
+        "sandboxId",
+        "sessionId"
+      ],
+      additionalProperties: false
+    },
+    outputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      propertyNames: {
+        type: "string"
+      },
+      additionalProperties: {}
+    }
+  },
+  {
+    id: "sandboxes_set_boot",
+    name: "sandboxes_set_boot",
+    cli: [
+      "sandboxes",
+      "set-boot"
+    ],
+    cliArgs: [
+      "sandboxId"
+    ],
+    description: "Register a command that starts now and again after every restart. For example bun dev. On Compose it runs after the stack; on a Dockerfile it replaces the image CMD. Snapshots cannot register one. Read the sandbox-boot skill.",
+    inputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        organization: {
+          type: "string",
+          minLength: 1,
+          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+        },
+        sandboxId: {
+          type: "string",
+          minLength: 1,
+          description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
+        },
+        command: {
+          type: "string",
+          minLength: 1,
+          description: "Command to start, e.g. bun dev."
+        },
+        cwd: {
+          description: "Directory to run it in. Default /.",
+          type: "string",
+          minLength: 1
+        },
+        start: {
+          description: "Also start it now, not only after restarts. Default true.",
+          type: "boolean"
+        }
+      },
+      required: [
+        "organization",
+        "sandboxId",
+        "command"
+      ],
+      additionalProperties: false
+    },
+    outputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      propertyNames: {
+        type: "string"
+      },
+      additionalProperties: {}
+    }
+  },
+  {
+    id: "sandboxes_update",
+    name: "sandboxes_update",
+    cli: [
+      "sandboxes",
+      "update"
+    ],
+    cliArgs: [
+      "sandboxId"
+    ],
+    description: "Change a sandbox’s display name, idle-stop or auto-delete interval. Omit a field to keep it; null resets it to the platform default.",
+    inputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        organization: {
+          type: "string",
+          minLength: 1,
+          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+        },
+        sandboxId: {
+          type: "string",
+          minLength: 1,
+          description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
+        },
+        displayName: {
+          description: "New display name. Null clears it; omit to keep it.",
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        autoStopIntervalMinutes: {
+          description: "Minutes of inactivity before the platform worker idle-stops the sandbox. -1 always on. 0 is rejected. Null resets to the platform default. Provider-native timers are optional backup.",
+          anyOf: [
+            {
+              type: "number"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        autoDeleteIntervalMinutes: {
+          description: "Minutes the sandbox stays stopped before the record is deleted. 0 deletes it when it stops. -1 keeps it. Null resets to the platform default. Provider-native timers are optional backup.",
+          anyOf: [
+            {
+              type: "number"
+            },
+            {
+              type: "null"
+            }
+          ]
+        }
+      },
+      required: [
+        "organization",
+        "sandboxId"
+      ],
+      additionalProperties: false
+    },
+    outputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      propertyNames: {
+        type: "string"
+      },
+      additionalProperties: {}
+    }
+  },
+  {
+    id: "sandboxes_resize",
+    name: "sandboxes_resize",
+    cli: [
+      "sandboxes",
+      "resize"
+    ],
+    cliArgs: [
+      "sandboxId"
+    ],
+    description: "Change a sandbox’s CPU and/or memory. While running only increases are allowed; stop it first to decrease (this tool does not stop it). Disk: sandboxes_resize_disk.",
+    inputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        organization: {
+          type: "string",
+          minLength: 1,
+          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+        },
+        sandboxId: {
+          type: "string",
+          minLength: 1,
+          description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
+        },
+        cpu: {
+          description: "Number of CPUs.",
+          type: "number",
+          exclusiveMinimum: 0
+        },
+        memoryGiB: {
+          description: "Memory in GiB.",
+          type: "number",
+          exclusiveMinimum: 0
+        }
+      },
+      required: [
+        "organization",
+        "sandboxId"
+      ],
+      additionalProperties: false
+    },
+    outputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      propertyNames: {
+        type: "string"
+      },
+      additionalProperties: {}
+    }
+  },
+  {
+    id: "sandboxes_resize_disk",
+    name: "sandboxes_resize_disk",
+    cli: [
+      "sandboxes",
+      "resize-disk"
+    ],
+    cliArgs: [
+      "sandboxId"
+    ],
+    description: "Grow a sandbox’s disk. The sandbox must be stopped first (this tool does not stop it). Disk only grows, never shrinks.",
+    inputSchema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        organization: {
+          type: "string",
+          minLength: 1,
+          description: "Organization id or slug, from organizations_list. Ids survive renames; slugs change when the organization is renamed."
+        },
+        sandboxId: {
+          type: "string",
+          minLength: 1,
+          description: "Sandbox name (e.g. quiet-harbor) or id, from sandboxes_list or sandboxes_create. Names are unique within the organization."
+        },
+        diskGiB: {
+          type: "number",
+          exclusiveMinimum: 0,
+          description: "New total disk size in GiB; must be larger than the current size."
         }
       },
       required: [
@@ -8588,7 +9176,7 @@ function getCliName(argv = process.argv) {
   return CLI_NAMES.find((name) => name === invoked) ?? "ghostdock";
 }
 // package.json
-var version = "0.0.13";
+var version = "0.0.15";
 var package_default = {
   name: "ghostdock",
   description: "Ghostdock CLI — device login and agent tool invocation from the command line",
@@ -9193,6 +9781,150 @@ var envCommand = defineCommand({
   }
 });
 
+// src/container-logs.ts
+var FOLLOW_INTERVAL_MS = 2000;
+function defaultLogsDeps(follow) {
+  let stop = false;
+  if (follow) {
+    process.once("SIGINT", () => {
+      stop = true;
+    });
+  }
+  return {
+    request: (input) => authorizedRequest("/api/v1/tools/sandboxes_containers_logs", {
+      method: "POST",
+      body: JSON.stringify(input)
+    }),
+    out: (line) => process.stdout.write(`${line}
+`),
+    err: (line) => process.stderr.write(`${line}
+`),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    stopped: () => stop
+  };
+}
+async function runContainerLogs(input, options, deps = defaultLogsDeps(options.follow)) {
+  const json = isJsonOutput();
+  const color = colorEnabled(process.stdout);
+  const print = (line) => {
+    if (json) {
+      deps.out(JSON.stringify(line));
+      return;
+    }
+    const text = options.timestamps && line.time ? `${dim(line.time, color)} ${line.text}` : line.text;
+    (line.stream === "stderr" ? deps.err : deps.out)(text);
+  };
+  let result = await deps.request(input);
+  if (!result.running) {
+    deps.err("The sandbox is stopped: it has no logs to show.");
+    return 1;
+  }
+  let last = null;
+  for (;; ) {
+    for (const line of result.lines) {
+      print(line);
+      if (line.time)
+        last = line.time;
+    }
+    if (!options.follow) {
+      if (result.truncated && json) {
+        deps.out(JSON.stringify({ truncated: true }));
+      } else if (result.truncated) {
+        deps.err(dim("(older lines left out: use --tail for more)", colorEnabled(process.stderr)));
+      }
+      return 0;
+    }
+    if (!result.truncated)
+      await deps.sleep(FOLLOW_INTERVAL_MS);
+    if (deps.stopped())
+      return 0;
+    const { tail: _tail, ...rest } = input;
+    try {
+      result = await deps.request(last ? { ...rest, after: last } : input);
+    } catch (error) {
+      deps.err(red(error instanceof Error ? error.message : String(error), colorEnabled(process.stderr)));
+      return 1;
+    }
+    if (!result.running) {
+      deps.err("The sandbox stopped.");
+      return 0;
+    }
+  }
+}
+
+// src/container-picker.ts
+import { createInterface } from "node:readline/promises";
+function notRunningContainerOf(error) {
+  if (!(error instanceof ApiError) || !error.data || typeof error.data !== "object")
+    return null;
+  const { code, params } = error.data;
+  if (code !== "container_not_running")
+    return null;
+  const container = params && typeof params === "object" ? params : {};
+  return typeof container.container === "string" && container.container ? container.container : null;
+}
+function containerQuestionOf(error) {
+  if (!(error instanceof ApiError) || !error.data || typeof error.data !== "object")
+    return null;
+  const { code, params } = error.data;
+  if (code !== "container_choice_required" && code !== "container_default_missing")
+    return null;
+  const record = params && typeof params === "object" ? params : {};
+  const running = typeof record.containers === "string" ? record.containers.split(",").map((name) => name.trim()).filter(Boolean) : [];
+  if (running.length === 0)
+    return null;
+  return {
+    running,
+    ...code === "container_default_missing" && typeof record.container === "string" ? { missingDefault: record.container } : {}
+  };
+}
+var say = (line) => process.stderr.write(`${line}
+`);
+var chooseContainerOnTerminal = async ({ running, missingDefault }) => {
+  if (missingDefault) {
+    say(`
+The default container ${missingDefault} is gone.`);
+  }
+  say(missingDefault ? "Which container?" : `
+Several containers are running. Which one?`);
+  running.forEach((name, index) => {
+    say(`  ${index + 1}. ${name}`);
+  });
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = (await prompt.question("Number (Enter to cancel): ")).trim();
+    const index = Number.parseInt(answer, 10) - 1;
+    return Number.isInteger(index) && index >= 0 && index < running.length ? running[index] ?? null : null;
+  } finally {
+    prompt.close();
+  }
+};
+var confirmDefaultOnTerminal = async (container) => {
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = (await prompt.question(`Make ${container} the default? [y/N] `)).trim();
+    return /^y(es)?$/i.test(answer);
+  } finally {
+    prompt.close();
+  }
+};
+var confirmStartOnTerminal = async (container) => {
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = (await prompt.question(`Container ${container} is not running. Start it? [Y/n] `)).trim();
+    return answer === "" || /^y(es)?$/i.test(answer);
+  } finally {
+    prompt.close();
+  }
+};
+function defaultContainerPickers() {
+  return process.stdin.isTTY && process.stderr.isTTY ? {
+    choose: chooseContainerOnTerminal,
+    confirmDefault: confirmDefaultOnTerminal,
+    confirmStart: confirmStartOnTerminal
+  } : undefined;
+}
+
 // src/progress.ts
 var PROGRESS_FRAMES = ["▂▄▆", "▄▆█", "▆█▆", "█▆▄", "▆▄▂", "▄▂▄"];
 var FRAME_MS = 120;
@@ -9293,10 +10025,10 @@ function symbolForStatus(status) {
     return "failed";
   if (/^(running|active|ready|deployed|published|online|verified|ok)$/.test(s))
     return "ready";
-  if (/^(stopped|deleted|unpublished|vanished|archived|revoked|closed|killed)$/.test(s)) {
+  if (/^(stopped|deleted|unpublished|vanished|archived|revoked|closed|killed|exited|dead|paused)$/.test(s)) {
     return "stopped";
   }
-  if (/(pending|starting|spawning|stopping|building|progress|awaiting|queued|creating)/.test(s)) {
+  if (/(pending|starting|spawning|stopping|building|progress|awaiting|queued|creating|restarting|removing)/.test(s)) {
     return "progress";
   }
   return "item";
@@ -9311,6 +10043,9 @@ function lineKeys(item) {
   const idKeys = "id" in item ? ID_KEYS.filter((key) => key !== "sandboxId") : ID_KEYS;
   return { id: firstKey(item, idKeys), label: firstKey(item, LABEL_KEYS) };
 }
+function shortId(id) {
+  return /^[0-9a-f]{64}$/.test(id) ? id.slice(0, 12) : id;
+}
 function itemLine(item, color) {
   const keys = lineKeys(item);
   const id = keys.id ? item[keys.id] : undefined;
@@ -9319,7 +10054,7 @@ function itemLine(item, color) {
   const url = firstString(item, URL_KEYS);
   const parts = [label ?? id ?? "(unnamed)"];
   if (label && id && id !== label)
-    parts.push(dim(id, color));
+    parts.push(dim(shortId(id), color));
   if (status)
     parts.push(status);
   if (url)
@@ -9552,7 +10287,7 @@ function buildToolInput(schema, rawArgs) {
 }
 
 // src/commands/invoke.ts
-async function runToolInvoke(tool, rawArgs, log = console.log, error = printError, notice = printNotice) {
+async function runToolInvoke(tool, rawArgs, log = console.log, error = printError, notice = printNotice, pickers = defaultContainerPickers()) {
   let input;
   try {
     input = buildToolInput(tool.inputSchema, rawArgs);
@@ -9564,29 +10299,110 @@ async function runToolInvoke(tool, rawArgs, log = console.log, error = printErro
     error(err instanceof Error ? err.message : String(err));
     return 1;
   }
+  if (tool.name === "sandboxes_containers_logs") {
+    try {
+      return await runContainerLogs(input, {
+        follow: rawArgs.follow === true,
+        timestamps: rawArgs.timestamps === true
+      });
+    } catch (err) {
+      error(err instanceof Error ? err.message : `${tool.name} failed.`);
+      return 1;
+    }
+  }
   try {
-    const request = () => authorizedRequest(`/api/v1/tools/${tool.name}`, {
+    const send = () => authorizedRequest(`/api/v1/tools/${tool.name}`, {
       method: "POST",
       body: JSON.stringify(input)
     });
+    const request = () => withContainerStart(input, send, rawArgs.start === true, pickers, notice);
     const waitMessage = PROGRESS_MESSAGES[tool.name];
     if (!waitMessage) {
-      const result = await request();
+      const result = await withContainerPick(tool, input, request, pickers, notice);
       printResult(result, () => renderResult(result, colorEnabled(process.stdout)), log);
+      stopNote(result, notice);
       return 0;
     }
-    const { value: result, elapsed } = await withProgress(waitMessage, request);
+    const { value: result, elapsed } = await withContainerPick(tool, input, () => withProgress(waitMessage, request), pickers, notice);
     printResult(result, () => {
       const color = colorEnabled(process.stdout);
       const lines = renderResult(result, color);
       return bootLines(result, color).length > 0 ? lines : withElapsed(lines, elapsed);
     }, log);
+    stopNote(result, notice);
     return 0;
   } catch (err) {
     error(err instanceof Error ? err.message : `${tool.name} failed.`);
     return 1;
   }
 }
+async function withContainerPick(tool, input, send, pickers, notice) {
+  try {
+    return await send();
+  } catch (err) {
+    const properties = tool.inputSchema.properties;
+    const question = containerQuestionOf(err);
+    if (!pickers || !question || !properties || !("container" in properties) || input.container) {
+      throw err;
+    }
+    const container = await pickers.choose(question);
+    if (!container)
+      throw err;
+    input.container = container;
+    const result = await send();
+    if (typeof input.sandboxId === "string" && await pickers.confirmDefault(container)) {
+      try {
+        await authorizedRequest("/api/v1/tools/sandboxes_default_container", {
+          method: "POST",
+          body: JSON.stringify({
+            organization: input.organization,
+            sandboxId: input.sandboxId,
+            container
+          })
+        });
+        notice(eventLine("done", `Default container: ${container}.`));
+      } catch (err) {
+        notice(eventLine("failed", `The default container was not set: ${err instanceof Error ? err.message : String(err)}`));
+      }
+    }
+    return result;
+  }
+}
+async function withContainerStart(input, send, start, pickers, notice) {
+  try {
+    return await send();
+  } catch (err) {
+    const container = notRunningContainerOf(err);
+    if (!container || typeof input.sandboxId !== "string")
+      throw err;
+    if (!start && !(pickers && await pickers.confirmStart(container)))
+      throw err;
+    await authorizedRequest("/api/v1/tools/sandboxes_containers_start", {
+      method: "POST",
+      body: JSON.stringify({
+        organization: input.organization,
+        sandboxId: input.sandboxId,
+        container
+      })
+    });
+    notice(eventLine("done", `Started ${container}.`));
+    return await send();
+  }
+}
+function stopNote(result, notice) {
+  if (!result || typeof result !== "object")
+    return;
+  const { action, note, container } = result;
+  if (action !== "stop" || typeof container !== "string")
+    return;
+  if (note === "default") {
+    notice(`${container} is the sandbox's default container: SSH, commands and files ask which container until it runs again.`);
+  } else if (note === "last_running") {
+    notice("No container is running now: SSH, commands and files have none to land in until one runs.");
+  } else if (note === "sandbox_stopped") {
+    notice(`The sandbox is stopped, so ${container} is too: nothing was done.`);
+  }
+}
 var PROGRESS_MESSAGES = {
   sandboxes_create: "Creating sandbox…",
   sandboxes_wake: "Waking sandbox…",
@@ -9595,6 +10411,9 @@ var PROGRESS_MESSAGES = {
   sandboxes_resize: "Resizing sandbox…",
   sandboxes_resize_disk: "Resizing disk…",
   sandboxes_commands_run: "Running command…",
+  sandboxes_containers_start: "Starting container…",
+  sandboxes_containers_stop: "Stopping container…",
+  sandboxes_containers_restart: "Restarting container…",
   snapshots_create: "Saving snapshot…",
   projects_redeploy: "Redeploying…",
   providers_verify_incus: "Checking the Incus host…"
@@ -9617,6 +10436,25 @@ function cliText(catalog, skills = BUILTIN_SKILL_NAMES) {
     return commands.replace(/\bthe ([a-z][a-z0-9-]*) skill\b/g, (phrase, skill) => skills.includes(skill) ? `the ${skill} skill (\`${getCliName()} skills get ${skill}\`)` : phrase);
   };
 }
+function cliOnlyArgs(tool) {
+  const schema = tool.inputSchema;
+  const args = {};
+  if (schema.properties && "container" in schema.properties && !schema.required?.includes("container")) {
+    args.start = {
+      type: "boolean",
+      description: "Start the container first when it is not running, without asking."
+    };
+  }
+  if (tool.name === "sandboxes_containers_logs") {
+    args.follow = {
+      type: "boolean",
+      alias: "f",
+      description: "Keep printing new lines until Ctrl-C."
+    };
+    args.timestamps = { type: "boolean", description: "Put each line's time in front of it." };
+  }
+  return args;
+}
 var generatedToolCommands = new WeakSet;
 function createToolCommands(catalog) {
   const commands = {};
@@ -9627,7 +10465,7 @@ function createToolCommands(catalog) {
         name: tool.cli?.at(-1) ?? tool.name,
         description: toCliText(tool.description)
       },
-      args: buildToolArgs(tool.inputSchema, toCliText, tool.cliArgs),
+      args: { ...buildToolArgs(tool.inputSchema, toCliText, tool.cliArgs), ...cliOnlyArgs(tool) },
       async run({ args }) {
         process.exitCode = await runToolInvoke(tool, args);
       }
@@ -9642,7 +10480,7 @@ function createToolCommands(catalog) {
 import { hostname } from "node:os";
 
 // src/commands/login-organization.ts
-import { createInterface } from "node:readline/promises";
+import { createInterface as createInterface2 } from "node:readline/promises";
 function label(organization) {
   return `${organization.name} (${organization.slug ?? organization.id})`;
 }
@@ -9652,7 +10490,7 @@ Which organization should commands use by default?`);
   organizations.forEach((organization, index) => {
     console.log(`  ${index + 1}. ${label(organization)}`);
   });
-  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
   try {
     const answer = (await prompt.question(`Number (Enter to skip): `)).trim();
     const index = Number.parseInt(answer, 10) - 1;
@@ -9927,14 +10765,21 @@ function renderConfig(input) {
     if (!isDnsZone(zone))
       throw new Error(`The server sent a zone that is not a DNS name: ${zone}`);
   }
+  if (!device.address || !isIPv6Address(device.address)) {
+    throw new Error(`The server sent no IPv6 address for this device: ${device.address}`);
+  }
   if (!isIPv6Address(network.gatewayAddress)) {
     throw new Error(`The server sent a gateway that is not an IPv6 address: ${network.gatewayAddress}`);
   }
+  const ipv4 = device.address4 && network.ingress4 ? { address: device.address4, ingress: network.ingress4 } : null;
+  if (ipv4 && (!isIPv4Address(ipv4.address) || !isIPv4Address(ipv4.ingress))) {
+    throw new Error(`The server sent an IPv4 address that is not one: ${ipv4.address}, ${ipv4.ingress}`);
+  }
   const lines = [
     "# Written by `ghostdock network connect`. Run it again rather than editing this file.",
     "[Interface]",
     `PrivateKey = ${input.privateKey}`,
-    `Address = ${device.address}/128`,
+    `Address = ${device.address}/128${ipv4 ? `, ${ipv4.address}/32` : ""}`,
     `MTU = ${network.mtu}`
   ];
   if (input.dns === "macos-resolver") {
@@ -9946,7 +10791,7 @@ function renderConfig(input) {
     const domains = zones.map((zone) => `'~${zone}'`).join(" ");
     lines.push(`PostUp = resolvectl dns %i ${network.gatewayAddress} && resolvectl domain %i ${domains}`);
   }
-  lines.push("", "[Peer]", `PublicKey = ${gateway.publicKey}`, `Endpoint = ${gateway.endpoint}`, `AllowedIPs = ${network.platformPrefix}`, "PersistentKeepalive = 25", "");
+  lines.push("", "[Peer]", `PublicKey = ${gateway.publicKey}`, `Endpoint = ${gateway.endpoint}`, `AllowedIPs = ${network.prefix}${ipv4 ? `, ${ipv4.ingress}/32` : ""}`, "PersistentKeepalive = 25", "");
   return lines.join(`
 `);
 }
@@ -9955,6 +10800,26 @@ function isDnsZone(zone) {
   const labels = zone.split(".");
   return zone.length <= 253 && labels.length >= 2 && labels.every((label) => DNS_LABEL.test(label));
 }
+function isIPv4Address(text) {
+  return /^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}$/.test(text);
+}
+function ipv4RouteOwner(platform, output) {
+  if (platform === "darwin") {
+    if (/^\s*destination: default$/m.test(output))
+      return null;
+    return /^\s*interface: (\S+)$/m.exec(output)?.[1] ?? null;
+  }
+  for (const line of output.split(`
+`).map((l) => l.trim())) {
+    if (!line || /^(default|broadcast)\b/.test(line))
+      continue;
+    return /\bdev (\S+)/.exec(line)?.[1] ?? "another route";
+  }
+  return null;
+}
+function ipv4RouteCommand(platform, address) {
+  return platform === "darwin" ? ["route", ["-n", "get", address]] : ["ip", ["-4", "route", "show", "table", "all", "match", address]];
+}
 function isIPv6Address(text) {
   return /^[0-9a-f:]{2,39}$/.test(text) && text.includes(":");
 }
@@ -9995,6 +10860,11 @@ function defaultDeps() {
       child.on("error", reject);
       child.on("close", (code) => resolve(code ?? 1));
     }),
+    output: (command, args) => {
+      const result = spawnSync(command, args, { encoding: "utf8" });
+      return result.status === 0 ? result.stdout : "";
+    },
+    platform: process.platform,
     has: (command) => spawnSync("sh", ["-c", `command -v ${command}`]).status === 0,
     dir: networkDir(),
     up: () => tunnelUp(),
@@ -10054,7 +10924,7 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
   await writeDeviceState({
     baseUrl: getBaseUrl(),
     deviceId: registered.device.id,
-    address: registered.device.address,
+    address: registered.device.address ?? "",
     gatewayProvider: registered.provider
   }, deps.dir);
   const wasUp = deps.up();
@@ -10065,6 +10935,7 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
       return 1;
     }
   }
+  const ipv4Clashes = ipv4Clashes4(registered, deps);
   const code = await wgQuick(deps, "up");
   if (code !== 0) {
     deps.error(`wg-quick exited ${code}. The config is in ${configPath(deps.dir)}.`);
@@ -10086,6 +10957,12 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
       `    Another organization: ${getCliName()} network connect --org <org>.`
     ] : [],
     ...network.netZone && pinned && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : [],
+    ...network.ingress4 && !device.address4 ? [
+      "    No IPv4 address was free on this provider's host, so browser names work over IPv6 only:",
+      "    Chrome on a network without IPv6 cannot open them on this machine. Firefox and Safari",
+      "    can. Run connect again later: an address frees up when another device goes."
+    ] : [],
+    ...ipv4Clashes.map(({ address, owner }) => `    ${address} is already routed through ${owner} on this machine: browsers may not reach the private network's names over IPv4 while it is. Ask your Ghostdock admin about the IPv4 block.`),
     ...dns === "none" ? [
       "    No split DNS on this machine (no systemd-resolved): use the addresses from",
       `    \`${getCliName()} network ls\`.`
@@ -10094,6 +10971,17 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
   ], deps.log);
   return 0;
 }
+function ipv4Clashes4(registered, deps) {
+  const addresses = [registered.network.ingress4, registered.device.address4].filter((a) => typeof a === "string" && isIPv4Address(a));
+  const clashes = [];
+  for (const address of addresses) {
+    const [command, args] = ipv4RouteCommand(deps.platform, address);
+    const owner = ipv4RouteOwner(deps.platform, deps.output(command, args));
+    if (owner)
+      clashes.push({ address, owner });
+  }
+  return clashes;
+}
 function clearingNotice(cookieSite) {
   const site = cookieSite?.site ?? "the net domain";
   return [
@@ -10210,7 +11098,7 @@ async function runNetworkLs(args, deps = defaultDeps()) {
         const note = unreachableNote(s, connected);
         lines.push([
           `  ${s.name.padEnd(width)}`,
-          s.address.padEnd(28),
+          (s.address ?? "-").padEnd(28),
           s.canonicalName.padEnd(canonicalWidth),
           ...s.httpsName ? [`https://${s.httpsName}`.padEnd(httpsWidth)] : [],
           ...s.shortName ? [`https://${s.shortName}`.padEnd(shortWidth)] : [],
@@ -11961,6 +12849,7 @@ var GROUP_DESCRIPTIONS = {
   providers: "Sandbox providers of an organization.",
   sandboxes: "Create, run and manage sandboxes.",
   "sandboxes commands": "Run commands in a sandbox and read their output.",
+  "sandboxes containers": "Containers of a sandbox’s Docker engine.",
   "sandboxes env": "Environment of one sandbox.",
   "sandboxes files": "Files inside a sandbox.",
   "sandboxes mcps": "MCP endpoints a sandbox exposes.",