ghostdock 0.0.15 → 0.0.17

package/dist/index.js

@@ -863,6 +863,14 @@ var GENERATED_TOOL_CATALOG = [
           description: "Mark the sandbox ephemeral: every stop destroys the machine and the next start boots fresh, while the record, URLs, and settings stay. Omit to use the image label ghostdock.ephemeral, or false when that label is absent. Does not change idle-stop or auto-delete.",
           type: "boolean"
         },
+        imageBase: {
+          description: "How the disk is made for one of Ghostdock's VM images: auto (default) clones the host's image base, a disk with the image already on it, when there is one; off always starts from an empty disk that pulls the image. For tests and comparisons; other images always start empty.",
+          type: "string",
+          enum: [
+            "auto",
+            "off"
+          ]
+        },
         urls: {
           description: "Changes to the image’s or snapshot’s URLs, keyed by port. Omit for the image URLs as they are; otherwise you get the image URLs plus yours: an entry on the same port replaces that URL completely (omitted fields take their defaults), and { port, remove: true } drops it; removing a port the image does not declare does nothing. A required port cannot be removed. TCP URLs are always public.",
           maxItems: 100,
@@ -9176,7 +9184,7 @@ function getCliName(argv = process.argv) {
   return CLI_NAMES.find((name) => name === invoked) ?? "ghostdock";
 }
 // package.json
-var version = "0.0.15";
+var version = "0.0.17";
 var package_default = {
   name: "ghostdock",
   description: "Ghostdock CLI — device login and agent tool invocation from the command line",
@@ -9284,6 +9292,376 @@ async function clearCredentials(path = getCredentialsPath()) {
   await rm(path, { force: true });
 }
 
+// ../../shared/lib/private-network-pause.ts
+function formatPauseLimit(seconds) {
+  const minutes = Math.max(1, Math.round(seconds / 60));
+  if (minutes >= 2 * 1440 && minutes % 1440 === 0)
+    return `${minutes / 1440} days`;
+  const hours = Math.floor(minutes / 60);
+  const rest = minutes % 60;
+  if (hours === 0)
+    return `${rest} min`;
+  return rest === 0 ? `${hours} h` : `${hours} h ${rest} min`;
+}
+function devicePauseReasonText(reason, limits) {
+  switch (reason) {
+    case "idle":
+      return `idle ${formatPauseLimit(limits.idleTimeoutSeconds)}`;
+    case "max_session":
+      return `${formatPauseLimit(limits.maxSessionSeconds)} session limit`;
+    case "manual":
+      return "paused in the web app";
+  }
+}
+
+// src/output.ts
+var SYMBOLS = {
+  ready: "⚓",
+  done: "✓",
+  url: "↗",
+  stopped: "◌",
+  failed: "✗",
+  progress: "▂▄▆",
+  item: "•"
+};
+var jsonOutput = false;
+function setJsonOutput(on) {
+  jsonOutput = on;
+}
+function isJsonOutput() {
+  return jsonOutput;
+}
+function colorEnabled(stream, env = process.env) {
+  if (env.FORCE_COLOR !== undefined)
+    return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "false";
+  if (env.NO_COLOR !== undefined && env.NO_COLOR !== "")
+    return false;
+  if (env.TERM === "dumb")
+    return false;
+  return stream.isTTY === true;
+}
+function trueColor(env = process.env) {
+  return env.COLORTERM === "truecolor" || env.COLORTERM === "24bit";
+}
+function accent(text, enabled) {
+  if (!enabled)
+    return text;
+  const open = trueColor() ? "\x1B[38;2;124;255;203m" : "\x1B[38;5;122m";
+  return `${open}${text}\x1B[39m`;
+}
+function red(text, enabled) {
+  return enabled ? `\x1B[31m${text}\x1B[39m` : text;
+}
+function dim(text, enabled) {
+  return enabled ? `\x1B[2m${text}\x1B[22m` : text;
+}
+function eventLine(symbol, message, color = colorEnabled(process.stdout)) {
+  return `  ${accent(SYMBOLS[symbol], color)} ${message}`;
+}
+function errorLine(message, color = colorEnabled(process.stderr)) {
+  return red(`  ${SYMBOLS.failed} ${message}`, color);
+}
+function printNotice(message) {
+  process.stderr.write(`${message}
+`);
+}
+function printError(message) {
+  process.stderr.write(`${errorLine(message)}
+`);
+}
+function printResult(data, human, log = console.log) {
+  if (jsonOutput) {
+    log(JSON.stringify(data, null, 2));
+    return;
+  }
+  for (const line of human())
+    log(line);
+}
+
+// src/network/pause.ts
+var DEVICE_HEADER = "ghostdock-device";
+var DEVICE_STATE_HEADER = "ghostdock-device-state";
+function parseDeviceStateHeader(value) {
+  if (!value)
+    return null;
+  const [state, ...params] = value.split(";").map((part) => part.trim());
+  if (state !== "paused")
+    return null;
+  const fields = new Map(params.map((param) => {
+    const [key, ...rest] = param.split("=");
+    return [key?.trim() ?? "", rest.join("=").trim()];
+  }));
+  const reason = fields.get("reason");
+  if (reason !== "idle" && reason !== "max_session" && reason !== "manual")
+    return null;
+  const limit = Number(fields.get("limit"));
+  return { reason, limitSeconds: Number.isInteger(limit) && limit > 0 ? limit : null };
+}
+function pausedNotice(paused) {
+  const limit = paused.limitSeconds ?? 0;
+  const why = paused.reason === "manual" || limit > 0 ? ` (${devicePauseReasonText(paused.reason, { idleTimeoutSeconds: limit, maxSessionSeconds: limit })})` : "";
+  return `Network access for this device is paused${why}. Run: ${getCliName()} network connect`;
+}
+var noticeShown = false;
+var noticeSuppressed = false;
+function notePausedDevice(header, write = (line) => process.stderr.write(`${line}
+`)) {
+  if (noticeShown || noticeSuppressed)
+    return;
+  const paused = parseDeviceStateHeader(header);
+  if (!paused)
+    return;
+  noticeShown = true;
+  write(`! ${pausedNotice(paused)}`);
+}
+function suppressPausedNotice() {
+  noticeSuppressed = true;
+}
+function clockTime(iso, now = new Date) {
+  const at = new Date(iso);
+  const time = at.toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit" });
+  if (at.toDateString() === now.toDateString())
+    return time;
+  return `${at.toLocaleDateString("en-GB", { weekday: "short" })} ${time}`;
+}
+function setBy(slug) {
+  return slug ? `, set by ${slug}` : "";
+}
+function pauseHint(state, now = new Date) {
+  const idle = `after ${formatPauseLimit(state.idleTimeoutSeconds)} without traffic${setBy(state.setBy.idle)}`;
+  const sessionEnd = sessionEndsAt(state, now);
+  const session = `${formatPauseLimit(state.maxSessionSeconds)} after connecting${sessionEnd ? ` (at ${clockTime(sessionEnd, now)})` : ""}${setBy(state.setBy.maxSession)}`;
+  return [
+    "ℹ  For security, this device's network access pauses automatically:",
+    `   ${idle}, and ${session}.`,
+    `   Resume any time: ${getCliName()} network connect, or Reconnect in the web app.`
+  ];
+}
+function sessionEndsAt(state, now) {
+  if (state.status !== "active" || !state.pausesAt)
+    return null;
+  if (state.pauseCause === "max_session")
+    return state.pausesAt;
+  return new Date(now.getTime() + state.maxSessionSeconds * 1000).toISOString();
+}
+function bold2(text, enabled = colorEnabled(process.stderr)) {
+  return enabled ? `\x1B[1m${text}\x1B[22m` : text;
+}
+function deviceStateText(state, now = new Date) {
+  if (!state)
+    return "Not connected (logged out)";
+  if (state.status === "paused" && state.pauseReason) {
+    const text = state.pauseReason === "manual" ? "Paused by you" : `Paused: ${devicePauseReasonText(state.pauseReason, state)}`;
+    return state.connected ? text : `Not connected (${text.toLowerCase()})`;
+  }
+  const left = state.pausesAt ? new Date(state.pausesAt).getTime() - now.getTime() : 0;
+  const active = `Active, pauses in ${formatRemaining(Math.max(left, 0) / 1000)}`;
+  return state.connected ? active : `Not connected (armed, pauses in ${formatRemaining(Math.max(left, 0) / 1000)})`;
+}
+function formatRemaining(seconds) {
+  const minutes = Math.floor(seconds / 60);
+  const days = Math.floor(minutes / 1440);
+  const hours = Math.floor(minutes % 1440 / 60);
+  const rest = minutes % 60;
+  const dayText = days === 1 ? "1 day" : `${days} days`;
+  if (days > 0)
+    return hours ? `${dayText} ${hours} h` : dayText;
+  if (hours > 0)
+    return rest ? `${hours} h ${rest} min` : `${hours} h`;
+  return `${Math.max(rest, 1)} min`;
+}
+
+// src/network/tunnel.ts
+import { createPrivateKey, createPublicKey, generateKeyPairSync } from "node:crypto";
+import { existsSync } from "node:fs";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2, join as join2 } from "node:path";
+var INTERFACE = "gdock";
+function networkDir() {
+  return join2(getConfigDir(), "network");
+}
+function configPath(dir = networkDir()) {
+  return join2(dir, `${INTERFACE}.conf`);
+}
+function keyPath(dir) {
+  return join2(dir, "private.key");
+}
+function statePath(dir) {
+  return join2(dir, "device.json");
+}
+function isProvider(value) {
+  const provider = value;
+  return typeof provider?.id === "string" && typeof provider.name === "string";
+}
+var X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
+function keyPairFromPrivate(privateKey) {
+  const raw = Buffer.from(privateKey, "base64");
+  if (raw.length !== 32)
+    throw new Error("The stored WireGuard key is not 32 bytes.");
+  const key = createPrivateKey({
+    key: Buffer.concat([X25519_PKCS8_PREFIX, raw]),
+    format: "der",
+    type: "pkcs8"
+  });
+  const spki = createPublicKey(key).export({ format: "der", type: "spki" });
+  return { privateKey, publicKey: spki.subarray(spki.length - 32).toString("base64") };
+}
+async function loadOrCreateKey(dir = networkDir()) {
+  try {
+    return keyPairFromPrivate((await readFile2(keyPath(dir), "utf8")).trim());
+  } catch (err) {
+    if (err.code !== "ENOENT")
+      throw err;
+  }
+  const { privateKey } = generateKeyPairSync("x25519");
+  const der = privateKey.export({ format: "der", type: "pkcs8" });
+  const raw = der.subarray(der.length - 32).toString("base64");
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await writeFile2(keyPath(dir), `${raw}
+`, { mode: 384 });
+  return keyPairFromPrivate(raw);
+}
+async function readDeviceState(dir = networkDir()) {
+  try {
+    const parsed = JSON.parse(await readFile2(statePath(dir), "utf8"));
+    if (typeof parsed.deviceId === "string" && typeof parsed.baseUrl === "string") {
+      return {
+        baseUrl: parsed.baseUrl,
+        deviceId: parsed.deviceId,
+        address: typeof parsed.address === "string" ? parsed.address : "",
+        gatewayProvider: isProvider(parsed.gatewayProvider) ? { id: parsed.gatewayProvider.id, name: parsed.gatewayProvider.name } : null,
+        zones: Array.isArray(parsed.zones) ? parsed.zones.filter((zone) => typeof zone === "string" && isDnsZone(zone)) : []
+      };
+    }
+  } catch {}
+  return null;
+}
+async function writeDeviceState(state, dir = networkDir()) {
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await writeFile2(statePath(dir), `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+}
+function detectDnsMode(platform = process.platform, exists = existsSync) {
+  if (platform === "darwin")
+    return "macos-resolver";
+  if (platform === "linux" && exists("/run/systemd/resolve"))
+    return "resolved";
+  return "none";
+}
+function renderConfig(input) {
+  const { device, network, gateway } = input.registered;
+  const zones = [network.zone, ...network.netZone ? [network.netZone] : []];
+  for (const zone of zones) {
+    if (!isDnsZone(zone))
+      throw new Error(`The server sent a zone that is not a DNS name: ${zone}`);
+  }
+  if (!device.address || !isIPv6Address(device.address)) {
+    throw new Error(`The server sent no IPv6 address for this device: ${device.address}`);
+  }
+  if (!isIPv6Address(network.gatewayAddress)) {
+    throw new Error(`The server sent a gateway that is not an IPv6 address: ${network.gatewayAddress}`);
+  }
+  const ipv4 = device.address4 && network.ingress4 ? { address: device.address4, ingress: network.ingress4 } : null;
+  if (ipv4 && (!isIPv4Address(ipv4.address) || !isIPv4Address(ipv4.ingress))) {
+    throw new Error(`The server sent an IPv4 address that is not one: ${ipv4.address}, ${ipv4.ingress}`);
+  }
+  const lines = [
+    "# Written by `ghostdock network connect`. Run it again rather than editing this file.",
+    "[Interface]",
+    `PrivateKey = ${input.privateKey}`,
+    `Address = ${device.address}/128${ipv4 ? `, ${ipv4.address}/32` : ""}`,
+    `MTU = ${network.mtu}`
+  ];
+  if (input.dns === "macos-resolver") {
+    for (const zone of zones) {
+      const file = `/etc/resolver/${zone}`;
+      lines.push(`PostUp = mkdir -p /etc/resolver && printf 'nameserver ${network.gatewayAddress}\\n' > ${file}`, `PostDown = rm -f ${file}`);
+    }
+  } else if (input.dns === "resolved") {
+    const domains = zones.map((zone) => `'~${zone}'`).join(" ");
+    lines.push(`PostUp = resolvectl dns %i ${network.gatewayAddress} && resolvectl domain %i ${domains}`);
+  }
+  lines.push("", "[Peer]", `PublicKey = ${gateway.publicKey}`, `Endpoint = ${gateway.endpoint}`, `AllowedIPs = ${network.prefix}${ipv4 ? `, ${ipv4.ingress}/32` : ""}`, "PersistentKeepalive = 25", "");
+  return lines.join(`
+`);
+}
+var DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function isDnsZone(zone) {
+  const labels = zone.split(".");
+  return zone.length <= 253 && labels.length >= 2 && labels.every((label) => DNS_LABEL.test(label));
+}
+function isIPv4Address(text) {
+  return /^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}$/.test(text);
+}
+function ipv4RouteOwner(platform, output) {
+  if (platform === "darwin") {
+    if (/^\s*destination: default$/m.test(output))
+      return null;
+    return /^\s*interface: (\S+)$/m.exec(output)?.[1] ?? null;
+  }
+  for (const line of output.split(`
+`).map((l) => l.trim())) {
+    if (!line || /^(default|broadcast)\b/.test(line))
+      continue;
+    return /\bdev (\S+)/.exec(line)?.[1] ?? "another route";
+  }
+  return null;
+}
+function ipv4RouteCommand(platform, address) {
+  return platform === "darwin" ? ["route", ["-n", "get", address]] : ["ip", ["-4", "route", "show", "table", "all", "match", address]];
+}
+function isIPv6Address(text) {
+  return /^[0-9a-f:]{2,39}$/.test(text) && text.includes(":");
+}
+async function readConfig(path = configPath()) {
+  try {
+    return await readFile2(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function configResolverZones(config) {
+  if (!config)
+    return [];
+  const zones = [];
+  for (const match of config.matchAll(/^PostDown = rm -f \/etc\/resolver\/(\S+)$/gm)) {
+    const zone = match[1] ?? "";
+    if (isDnsZone(zone) && !zones.includes(zone))
+      zones.push(zone);
+  }
+  return zones;
+}
+function resolverFile(zone) {
+  return `/etc/resolver/${zone}`;
+}
+async function readConfigMtu(path = configPath()) {
+  let contents;
+  try {
+    contents = await readFile2(path, "utf8");
+  } catch {
+    return null;
+  }
+  const match = /^MTU = (\d+)$/m.exec(contents);
+  return match ? Number(match[1]) : null;
+}
+async function writeConfig(contents, path = configPath()) {
+  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+  await writeFile2(path, contents, { mode: 384 });
+  await chmod2(path, 384);
+}
+function tunnelUp(platform = process.platform, exists = existsSync) {
+  if (platform === "darwin")
+    return exists(`/var/run/wireguard/${INTERFACE}.name`);
+  return exists(`/sys/class/net/${INTERFACE}`);
+}
+function installHint(platform = process.platform) {
+  if (platform === "darwin")
+    return "brew install wireguard-tools";
+  if (platform === "linux")
+    return "sudo apt install wireguard-tools (or your distribution’s package)";
+  return "Install wireguard-tools. On Windows, run the CLI inside WSL.";
+}
+
 // src/api-client.ts
 var CLI_USER_AGENT = `ghostdock-cli/${version}`;
 
@@ -9325,6 +9703,7 @@ async function request(path, init = {}) {
       ...init.headers
     }
   });
+  notePausedDevice(res.headers.get(DEVICE_STATE_HEADER));
   if (!res.ok) {
     const payload = await readErrorPayload(res);
     throw new ApiError(res.status, payload.message, payload.data);
@@ -9356,6 +9735,11 @@ function deviceRevoke(body) {
     body: JSON.stringify(body)
   });
 }
+var deviceIdOnce = null;
+function currentDeviceId() {
+  deviceIdOnce ??= readDeviceState().then((state) => state && state.baseUrl === getBaseUrl() ? state.deviceId : null).catch(() => null);
+  return deviceIdOnce;
+}
 var refreshInFlight = null;
 async function refreshStoredCredentials(refreshToken) {
   if (refreshInFlight)
@@ -9378,10 +9762,12 @@ async function authorizedRequest(path, init = {}) {
   if (!credentials) {
     throw new AuthRequiredError;
   }
+  const deviceId = await currentDeviceId();
   const withAuth = (accessToken) => ({
     ...init,
     headers: {
       ...init.headers,
+      ...deviceId ? { [DEVICE_HEADER]: deviceId } : {},
       authorization: `Bearer ${accessToken}`
     }
   });
@@ -9405,75 +9791,11 @@ async function authorizedRequest(path, init = {}) {
   }
 }
 
-// src/output.ts
-var SYMBOLS = {
-  ready: "⚓",
-  done: "✓",
-  url: "↗",
-  stopped: "◌",
-  failed: "✗",
-  progress: "▂▄▆",
-  item: "•"
-};
-var jsonOutput = false;
-function setJsonOutput(on) {
-  jsonOutput = on;
-}
-function isJsonOutput() {
-  return jsonOutput;
-}
-function colorEnabled(stream, env = process.env) {
-  if (env.FORCE_COLOR !== undefined)
-    return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "false";
-  if (env.NO_COLOR !== undefined && env.NO_COLOR !== "")
-    return false;
-  if (env.TERM === "dumb")
-    return false;
-  return stream.isTTY === true;
-}
-function trueColor(env = process.env) {
-  return env.COLORTERM === "truecolor" || env.COLORTERM === "24bit";
-}
-function accent(text, enabled) {
-  if (!enabled)
-    return text;
-  const open = trueColor() ? "\x1B[38;2;124;255;203m" : "\x1B[38;5;122m";
-  return `${open}${text}\x1B[39m`;
-}
-function red(text, enabled) {
-  return enabled ? `\x1B[31m${text}\x1B[39m` : text;
-}
-function dim(text, enabled) {
-  return enabled ? `\x1B[2m${text}\x1B[22m` : text;
-}
-function eventLine(symbol, message, color = colorEnabled(process.stdout)) {
-  return `  ${accent(SYMBOLS[symbol], color)} ${message}`;
-}
-function errorLine(message, color = colorEnabled(process.stderr)) {
-  return red(`  ${SYMBOLS.failed} ${message}`, color);
-}
-function printNotice(message) {
-  process.stderr.write(`${message}
-`);
-}
-function printError(message) {
-  process.stderr.write(`${errorLine(message)}
-`);
-}
-function printResult(data, human, log = console.log) {
-  if (jsonOutput) {
-    log(JSON.stringify(data, null, 2));
-    return;
-  }
-  for (const line of human())
-    log(line);
-}
-
 // src/settings.ts
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname3, join as join3 } from "node:path";
 function getSettingsPath() {
-  return join2(dirname2(getCredentialsPath()), "settings.json");
+  return join3(dirname3(getCredentialsPath()), "settings.json");
 }
 function isDefaultOrganization(value) {
   if (!value || typeof value !== "object")
@@ -9483,15 +9805,15 @@ function isDefaultOrganization(value) {
 }
 async function readSettings(path = getSettingsPath()) {
   try {
-    const parsed = JSON.parse(await readFile2(path, "utf8"));
+    const parsed = JSON.parse(await readFile3(path, "utf8"));
     return isDefaultOrganization(parsed.defaultOrganization) ? { defaultOrganization: parsed.defaultOrganization } : {};
   } catch {
     return {};
   }
 }
 async function writeSettings(settings, path = getSettingsPath()) {
-  await mkdir2(dirname2(path), { recursive: true });
-  await writeFile2(path, `${JSON.stringify(settings, null, 2)}
+  await mkdir3(dirname3(path), { recursive: true });
+  await writeFile3(path, `${JSON.stringify(settings, null, 2)}
 `, "utf8");
 }
 
@@ -9781,77 +10103,6 @@ var envCommand = defineCommand({
   }
 });
 
-// src/container-logs.ts
-var FOLLOW_INTERVAL_MS = 2000;
-function defaultLogsDeps(follow) {
-  let stop = false;
-  if (follow) {
-    process.once("SIGINT", () => {
-      stop = true;
-    });
-  }
-  return {
-    request: (input) => authorizedRequest("/api/v1/tools/sandboxes_containers_logs", {
-      method: "POST",
-      body: JSON.stringify(input)
-    }),
-    out: (line) => process.stdout.write(`${line}
-`),
-    err: (line) => process.stderr.write(`${line}
-`),
-    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-    stopped: () => stop
-  };
-}
-async function runContainerLogs(input, options, deps = defaultLogsDeps(options.follow)) {
-  const json = isJsonOutput();
-  const color = colorEnabled(process.stdout);
-  const print = (line) => {
-    if (json) {
-      deps.out(JSON.stringify(line));
-      return;
-    }
-    const text = options.timestamps && line.time ? `${dim(line.time, color)} ${line.text}` : line.text;
-    (line.stream === "stderr" ? deps.err : deps.out)(text);
-  };
-  let result = await deps.request(input);
-  if (!result.running) {
-    deps.err("The sandbox is stopped: it has no logs to show.");
-    return 1;
-  }
-  let last = null;
-  for (;; ) {
-    for (const line of result.lines) {
-      print(line);
-      if (line.time)
-        last = line.time;
-    }
-    if (!options.follow) {
-      if (result.truncated && json) {
-        deps.out(JSON.stringify({ truncated: true }));
-      } else if (result.truncated) {
-        deps.err(dim("(older lines left out: use --tail for more)", colorEnabled(process.stderr)));
-      }
-      return 0;
-    }
-    if (!result.truncated)
-      await deps.sleep(FOLLOW_INTERVAL_MS);
-    if (deps.stopped())
-      return 0;
-    const { tail: _tail, ...rest } = input;
-    try {
-      result = await deps.request(last ? { ...rest, after: last } : input);
-    } catch (error) {
-      deps.err(red(error instanceof Error ? error.message : String(error), colorEnabled(process.stderr)));
-      return 1;
-    }
-    if (!result.running) {
-      deps.err("The sandbox stopped.");
-      return 0;
-    }
-  }
-}
-
 // src/container-picker.ts
 import { createInterface } from "node:readline/promises";
 function notRunningContainerOf(error) {
@@ -9985,6 +10236,130 @@ async function withProgress(message, work, options) {
   }
 }
 
+// src/container-flow.ts
+async function withContainerPick(call, send, pickers, notice) {
+  try {
+    return await send();
+  } catch (err) {
+    const question = containerQuestionOf(err);
+    if (!pickers || !question || !call.canPick)
+      throw err;
+    const container = await pickers.choose(question);
+    if (!container)
+      throw err;
+    call.setContainer(container);
+    const result = await send();
+    if (call.sandboxId !== undefined && await pickers.confirmDefault(container)) {
+      try {
+        await authorizedRequest("/api/v1/tools/sandboxes_default_container", {
+          method: "POST",
+          body: JSON.stringify({
+            organization: call.organization,
+            sandboxId: call.sandboxId,
+            container
+          })
+        });
+        notice(eventLine("done", `Default container: ${container}.`));
+      } catch (err) {
+        notice(eventLine("failed", `The default container was not set: ${err instanceof Error ? err.message : String(err)}`));
+      }
+    }
+    return result;
+  }
+}
+async function withContainerStart(call, send, start, pickers, notice) {
+  try {
+    return await send();
+  } catch (err) {
+    const container = notRunningContainerOf(err);
+    if (!container || call.sandboxId === undefined)
+      throw err;
+    if (!start && !(pickers && await pickers.confirmStart(container)))
+      throw err;
+    await withProgress("Starting container…", () => authorizedRequest("/api/v1/tools/sandboxes_containers_start", {
+      method: "POST",
+      body: JSON.stringify({
+        organization: call.organization,
+        sandboxId: call.sandboxId,
+        container
+      })
+    }));
+    notice(eventLine("done", `Started ${container}.`));
+    return await send();
+  }
+}
+
+// src/container-logs.ts
+var FOLLOW_INTERVAL_MS = 2000;
+function defaultLogsDeps(follow) {
+  let stop = false;
+  if (follow) {
+    process.once("SIGINT", () => {
+      stop = true;
+    });
+  }
+  return {
+    request: (input) => authorizedRequest("/api/v1/tools/sandboxes_containers_logs", {
+      method: "POST",
+      body: JSON.stringify(input)
+    }),
+    out: (line) => process.stdout.write(`${line}
+`),
+    err: (line) => process.stderr.write(`${line}
+`),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    stopped: () => stop
+  };
+}
+async function runContainerLogs(input, options, deps = defaultLogsDeps(options.follow)) {
+  const json = isJsonOutput();
+  const color = colorEnabled(process.stdout);
+  const print = (line) => {
+    if (json) {
+      deps.out(JSON.stringify(line));
+      return;
+    }
+    const text = options.timestamps && line.time ? `${dim(line.time, color)} ${line.text}` : line.text;
+    (line.stream === "stderr" ? deps.err : deps.out)(text);
+  };
+  let result = await deps.request(input);
+  if (!result.running) {
+    deps.err("The sandbox is stopped: it has no logs to show.");
+    return 1;
+  }
+  let last = null;
+  for (;; ) {
+    for (const line of result.lines) {
+      print(line);
+      if (line.time)
+        last = line.time;
+    }
+    if (!options.follow) {
+      if (result.truncated && json) {
+        deps.out(JSON.stringify({ truncated: true }));
+      } else if (result.truncated) {
+        deps.err(dim("(older lines left out: use --tail for more)", colorEnabled(process.stderr)));
+      }
+      return 0;
+    }
+    if (!result.truncated)
+      await deps.sleep(FOLLOW_INTERVAL_MS);
+    if (deps.stopped())
+      return 0;
+    const { tail: _tail, ...rest } = input;
+    try {
+      result = await deps.request(last ? { ...rest, after: last } : input);
+    } catch (error) {
+      deps.err(red(error instanceof Error ? error.message : String(error), colorEnabled(process.stderr)));
+      return 1;
+    }
+    if (!result.running) {
+      deps.err("The sandbox stopped.");
+      return 0;
+    }
+  }
+}
+
 // src/human.ts
 var ID_KEYS = [
   "sandboxId",
@@ -10104,6 +10479,11 @@ function listLines(items, color) {
 function bootPhase(value) {
   return isItem(value) && typeof value.ms === "number" && Number.isFinite(value.ms) ? { ms: value.ms } : null;
 }
+var DISK_SOURCE_TEXT = {
+  fresh: "image pulled",
+  "image-base": "image already on disk",
+  "user-snapshot": "from a snapshot"
+};
 function bootLines(data, color) {
   if (!isItem(data) || !isItem(data.boot))
     return [];
@@ -10115,6 +10495,12 @@ function bootLines(data, color) {
   if (container) {
     lines.push(eventLine("done", `container started in ${formatElapsed(container.ms)}`, color));
   }
+  const provision = bootPhase(data.boot.provision);
+  if (provision) {
+    const disk = typeof data.boot.disk === "string" ? DISK_SOURCE_TEXT[data.boot.disk] : undefined;
+    const how = disk ? ` (${disk})` : "";
+    lines.push(eventLine("done", `ready in ${formatElapsed(provision.ms)}${how}`, color));
+  }
   return lines;
 }
 function renderResult(data, color) {
@@ -10288,10 +10674,10 @@ function buildToolInput(schema, rawArgs) {
 
 // src/commands/invoke.ts
 async function runToolInvoke(tool, rawArgs, log = console.log, error = printError, notice = printNotice, pickers = defaultContainerPickers()) {
+  const properties = tool.inputSchema.properties;
   let input;
   try {
     input = buildToolInput(tool.inputSchema, rawArgs);
-    const properties = tool.inputSchema.properties;
     if (properties && "organization" in properties && input.organization === undefined) {
       input.organization = await requireOrganizationRef(undefined, notice);
     }
@@ -10310,24 +10696,33 @@ async function runToolInvoke(tool, rawArgs, log = console.log, error = printErro
       return 1;
     }
   }
+  const call = {
+    organization: typeof input.organization === "string" ? input.organization : undefined,
+    sandboxId: typeof input.sandboxId === "string" ? input.sandboxId : undefined,
+    canPick: !!properties && "container" in properties && !input.container,
+    setContainer: (container) => {
+      input.container = container;
+    }
+  };
   try {
-    const send = () => authorizedRequest(`/api/v1/tools/${tool.name}`, {
+    const post = () => authorizedRequest(`/api/v1/tools/${tool.name}`, {
       method: "POST",
       body: JSON.stringify(input)
     });
-    const request = () => withContainerStart(input, send, rawArgs.start === true, pickers, notice);
     const waitMessage = PROGRESS_MESSAGES[tool.name];
-    if (!waitMessage) {
-      const result = await withContainerPick(tool, input, request, pickers, notice);
-      printResult(result, () => renderResult(result, colorEnabled(process.stdout)), log);
-      stopNote(result, notice);
-      return 0;
-    }
-    const { value: result, elapsed } = await withContainerPick(tool, input, () => withProgress(waitMessage, request), pickers, notice);
+    let elapsed;
+    const send = async () => {
+      if (!waitMessage)
+        return post();
+      const timed = await withProgress(waitMessage, post);
+      elapsed = timed.elapsed;
+      return timed.value;
+    };
+    const result = await withContainerPick(call, () => withContainerStart(call, send, rawArgs.start === true, pickers, notice), pickers, notice);
     printResult(result, () => {
       const color = colorEnabled(process.stdout);
       const lines = renderResult(result, color);
-      return bootLines(result, color).length > 0 ? lines : withElapsed(lines, elapsed);
+      return elapsed === undefined || bootLines(result, color).length > 0 ? lines : withElapsed(lines, elapsed);
     }, log);
     stopNote(result, notice);
     return 0;
@@ -10336,59 +10731,6 @@ async function runToolInvoke(tool, rawArgs, log = console.log, error = printErro
     return 1;
   }
 }
-async function withContainerPick(tool, input, send, pickers, notice) {
-  try {
-    return await send();
-  } catch (err) {
-    const properties = tool.inputSchema.properties;
-    const question = containerQuestionOf(err);
-    if (!pickers || !question || !properties || !("container" in properties) || input.container) {
-      throw err;
-    }
-    const container = await pickers.choose(question);
-    if (!container)
-      throw err;
-    input.container = container;
-    const result = await send();
-    if (typeof input.sandboxId === "string" && await pickers.confirmDefault(container)) {
-      try {
-        await authorizedRequest("/api/v1/tools/sandboxes_default_container", {
-          method: "POST",
-          body: JSON.stringify({
-            organization: input.organization,
-            sandboxId: input.sandboxId,
-            container
-          })
-        });
-        notice(eventLine("done", `Default container: ${container}.`));
-      } catch (err) {
-        notice(eventLine("failed", `The default container was not set: ${err instanceof Error ? err.message : String(err)}`));
-      }
-    }
-    return result;
-  }
-}
-async function withContainerStart(input, send, start, pickers, notice) {
-  try {
-    return await send();
-  } catch (err) {
-    const container = notRunningContainerOf(err);
-    if (!container || typeof input.sandboxId !== "string")
-      throw err;
-    if (!start && !(pickers && await pickers.confirmStart(container)))
-      throw err;
-    await authorizedRequest("/api/v1/tools/sandboxes_containers_start", {
-      method: "POST",
-      body: JSON.stringify({
-        organization: input.organization,
-        sandboxId: input.sandboxId,
-        container
-      })
-    });
-    notice(eventLine("done", `Started ${container}.`));
-    return await send();
-  }
-}
 function stopNote(result, notice) {
   if (!result || typeof result !== "object")
     return;
@@ -10680,178 +11022,8 @@ var logoutCommand = defineCommand({
 
 // src/commands/network.ts
 import { spawn, spawnSync } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
 import { hostname as hostname2 } from "node:os";
-
-// src/network/tunnel.ts
-import { createPrivateKey, createPublicKey, generateKeyPairSync } from "node:crypto";
-import { existsSync } from "node:fs";
-import { chmod as chmod2, mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname3, join as join3 } from "node:path";
-var INTERFACE = "gdock";
-function networkDir() {
-  return join3(getConfigDir(), "network");
-}
-function configPath(dir = networkDir()) {
-  return join3(dir, `${INTERFACE}.conf`);
-}
-function keyPath(dir) {
-  return join3(dir, "private.key");
-}
-function statePath(dir) {
-  return join3(dir, "device.json");
-}
-function isProvider(value) {
-  const provider = value;
-  return typeof provider?.id === "string" && typeof provider.name === "string";
-}
-var X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
-function keyPairFromPrivate(privateKey) {
-  const raw = Buffer.from(privateKey, "base64");
-  if (raw.length !== 32)
-    throw new Error("The stored WireGuard key is not 32 bytes.");
-  const key = createPrivateKey({
-    key: Buffer.concat([X25519_PKCS8_PREFIX, raw]),
-    format: "der",
-    type: "pkcs8"
-  });
-  const spki = createPublicKey(key).export({ format: "der", type: "spki" });
-  return { privateKey, publicKey: spki.subarray(spki.length - 32).toString("base64") };
-}
-async function loadOrCreateKey(dir = networkDir()) {
-  try {
-    return keyPairFromPrivate((await readFile3(keyPath(dir), "utf8")).trim());
-  } catch (err) {
-    if (err.code !== "ENOENT")
-      throw err;
-  }
-  const { privateKey } = generateKeyPairSync("x25519");
-  const der = privateKey.export({ format: "der", type: "pkcs8" });
-  const raw = der.subarray(der.length - 32).toString("base64");
-  await mkdir3(dir, { recursive: true, mode: 448 });
-  await writeFile3(keyPath(dir), `${raw}
-`, { mode: 384 });
-  return keyPairFromPrivate(raw);
-}
-async function readDeviceState(dir = networkDir()) {
-  try {
-    const parsed = JSON.parse(await readFile3(statePath(dir), "utf8"));
-    if (typeof parsed.deviceId === "string" && typeof parsed.baseUrl === "string") {
-      return {
-        baseUrl: parsed.baseUrl,
-        deviceId: parsed.deviceId,
-        address: typeof parsed.address === "string" ? parsed.address : "",
-        gatewayProvider: isProvider(parsed.gatewayProvider) ? { id: parsed.gatewayProvider.id, name: parsed.gatewayProvider.name } : null
-      };
-    }
-  } catch {}
-  return null;
-}
-async function writeDeviceState(state, dir = networkDir()) {
-  await mkdir3(dir, { recursive: true, mode: 448 });
-  await writeFile3(statePath(dir), `${JSON.stringify(state, null, 2)}
-`, { mode: 384 });
-}
-function detectDnsMode(platform = process.platform, exists = existsSync) {
-  if (platform === "darwin")
-    return "macos-resolver";
-  if (platform === "linux" && exists("/run/systemd/resolve"))
-    return "resolved";
-  return "none";
-}
-function renderConfig(input) {
-  const { device, network, gateway } = input.registered;
-  const zones = [network.zone, ...network.netZone ? [network.netZone] : []];
-  for (const zone of zones) {
-    if (!isDnsZone(zone))
-      throw new Error(`The server sent a zone that is not a DNS name: ${zone}`);
-  }
-  if (!device.address || !isIPv6Address(device.address)) {
-    throw new Error(`The server sent no IPv6 address for this device: ${device.address}`);
-  }
-  if (!isIPv6Address(network.gatewayAddress)) {
-    throw new Error(`The server sent a gateway that is not an IPv6 address: ${network.gatewayAddress}`);
-  }
-  const ipv4 = device.address4 && network.ingress4 ? { address: device.address4, ingress: network.ingress4 } : null;
-  if (ipv4 && (!isIPv4Address(ipv4.address) || !isIPv4Address(ipv4.ingress))) {
-    throw new Error(`The server sent an IPv4 address that is not one: ${ipv4.address}, ${ipv4.ingress}`);
-  }
-  const lines = [
-    "# Written by `ghostdock network connect`. Run it again rather than editing this file.",
-    "[Interface]",
-    `PrivateKey = ${input.privateKey}`,
-    `Address = ${device.address}/128${ipv4 ? `, ${ipv4.address}/32` : ""}`,
-    `MTU = ${network.mtu}`
-  ];
-  if (input.dns === "macos-resolver") {
-    for (const zone of zones) {
-      const file = `/etc/resolver/${zone}`;
-      lines.push(`PostUp = mkdir -p /etc/resolver && printf 'nameserver ${network.gatewayAddress}\\n' > ${file}`, `PostDown = rm -f ${file}`);
-    }
-  } else if (input.dns === "resolved") {
-    const domains = zones.map((zone) => `'~${zone}'`).join(" ");
-    lines.push(`PostUp = resolvectl dns %i ${network.gatewayAddress} && resolvectl domain %i ${domains}`);
-  }
-  lines.push("", "[Peer]", `PublicKey = ${gateway.publicKey}`, `Endpoint = ${gateway.endpoint}`, `AllowedIPs = ${network.prefix}${ipv4 ? `, ${ipv4.ingress}/32` : ""}`, "PersistentKeepalive = 25", "");
-  return lines.join(`
-`);
-}
-var DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-function isDnsZone(zone) {
-  const labels = zone.split(".");
-  return zone.length <= 253 && labels.length >= 2 && labels.every((label) => DNS_LABEL.test(label));
-}
-function isIPv4Address(text) {
-  return /^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}$/.test(text);
-}
-function ipv4RouteOwner(platform, output) {
-  if (platform === "darwin") {
-    if (/^\s*destination: default$/m.test(output))
-      return null;
-    return /^\s*interface: (\S+)$/m.exec(output)?.[1] ?? null;
-  }
-  for (const line of output.split(`
-`).map((l) => l.trim())) {
-    if (!line || /^(default|broadcast)\b/.test(line))
-      continue;
-    return /\bdev (\S+)/.exec(line)?.[1] ?? "another route";
-  }
-  return null;
-}
-function ipv4RouteCommand(platform, address) {
-  return platform === "darwin" ? ["route", ["-n", "get", address]] : ["ip", ["-4", "route", "show", "table", "all", "match", address]];
-}
-function isIPv6Address(text) {
-  return /^[0-9a-f:]{2,39}$/.test(text) && text.includes(":");
-}
-async function readConfigMtu(path = configPath()) {
-  let contents;
-  try {
-    contents = await readFile3(path, "utf8");
-  } catch {
-    return null;
-  }
-  const match = /^MTU = (\d+)$/m.exec(contents);
-  return match ? Number(match[1]) : null;
-}
-async function writeConfig(contents, path = configPath()) {
-  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
-  await writeFile3(path, contents, { mode: 384 });
-  await chmod2(path, 384);
-}
-function tunnelUp(platform = process.platform, exists = existsSync) {
-  if (platform === "darwin")
-    return exists(`/var/run/wireguard/${INTERFACE}.name`);
-  return exists(`/sys/class/net/${INTERFACE}`);
-}
-function installHint(platform = process.platform) {
-  if (platform === "darwin")
-    return "brew install wireguard-tools";
-  if (platform === "linux")
-    return "sudo apt install wireguard-tools (or your distribution’s package)";
-  return "Install wireguard-tools. On Windows, run the CLI inside WSL.";
-}
-
-// src/commands/network.ts
 function defaultDeps() {
   return {
     request: authorizedRequest,
@@ -10868,6 +11040,7 @@ function defaultDeps() {
     has: (command) => spawnSync("sh", ["-c", `command -v ${command}`]).status === 0,
     dir: networkDir(),
     up: () => tunnelUp(),
+    exists: existsSync2,
     log: console.log,
     error: printError,
     notice: printNotice
@@ -10887,6 +11060,7 @@ async function wgQuick(deps, verb) {
   return deps.run("sudo", args);
 }
 async function runNetworkConnect(args = {}, deps = defaultDeps()) {
+  suppressPausedNotice();
   if (!deps.has("wg-quick")) {
     deps.error(`wg-quick is not installed. ${installHint()}`);
     return 1;
@@ -10920,14 +11094,37 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
     deps.error(message(err));
     return 1;
   }
+  const previousConfig = await readConfig(configPath(deps.dir));
   await writeConfig(config, configPath(deps.dir));
   await writeDeviceState({
     baseUrl: getBaseUrl(),
     deviceId: registered.device.id,
     address: registered.device.address ?? "",
-    gatewayProvider: registered.provider
+    gatewayProvider: registered.provider,
+    zones: [
+      registered.network.zone,
+      ...registered.network.netZone ? [registered.network.netZone] : []
+    ]
   }, deps.dir);
   const wasUp = deps.up();
+  if (wasUp && previousConfig === config) {
+    const { device, network, provider, shortNameOrganizationChanged } = registered;
+    printResult({
+      device,
+      network,
+      provider,
+      shortNameOrganizationChanged,
+      interface: INTERFACE,
+      dns,
+      rearmed: true,
+      pause: device.state
+    }, () => [
+      eventLine("done", rearmedLine(device.state)),
+      ...network.netZone && device.shortNameOrganization && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : []
+    ], deps.log);
+    printPauseHint(device.state, deps);
+    return 0;
+  }
   if (wasUp) {
     const down = await wgQuick(deps, "down");
     if (down !== 0) {
@@ -10944,7 +11141,16 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
   const { device, network, provider, shortNameOrganizationChanged } = registered;
   const pinned = device.shortNameOrganization;
   const switched = wasUp && previous?.gatewayProvider && previous.gatewayProvider.id !== provider.id ? previous.gatewayProvider : null;
-  printResult({ device, network, provider, shortNameOrganizationChanged, interface: INTERFACE, dns }, () => [
+  printResult({
+    device,
+    network,
+    provider,
+    shortNameOrganizationChanged,
+    interface: INTERFACE,
+    dns,
+    rearmed: false,
+    pause: device.state
+  }, () => [
     eventLine("done", `Connected through ${provider.name}. This machine is ${device.address} in the private network.`),
     ...switched ? [
       `    Replaced the connection through ${switched.name}: its sandboxes are out of reach now.`
@@ -10969,8 +11175,22 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
     ] : [],
     `    → ${getCliName()} network ls`
   ], deps.log);
+  printPauseHint(device.state, deps);
   return 0;
 }
+function rearmedLine(state, now = new Date) {
+  if (!state)
+    return "Re-armed.";
+  const until = clockTime(new Date(now.getTime() + state.maxSessionSeconds * 1000).toISOString(), now);
+  return `Re-armed: network access for this device runs until ${until} (pauses after ${formatPauseLimit(state.idleTimeoutSeconds)} idle).`;
+}
+function printPauseHint(state, deps) {
+  if (!state || isJsonOutput())
+    return;
+  const [first = "", ...rest] = pauseHint(state);
+  deps.notice(["", bold2(first), ...rest].join(`
+`));
+}
 function ipv4Clashes4(registered, deps) {
   const addresses = [registered.network.ingress4, registered.device.address4].filter((a) => typeof a === "string" && isIPv4Address(a));
   const clashes = [];
@@ -10991,17 +11211,41 @@ function clearingNotice(cookieSite) {
     "    Reload or close browser tabs opened on short names before this connect."
   ];
 }
+async function staleResolverFiles(deps) {
+  if (deps.platform !== "darwin")
+    return [];
+  const state = await readDeviceState(deps.dir);
+  const zones = new Set([
+    ...configResolverZones(await readConfig(configPath(deps.dir))),
+    ...state?.zones ?? []
+  ]);
+  return [...zones].map(resolverFile).filter((file) => deps.exists(file));
+}
 async function runNetworkDisconnect(deps = defaultDeps()) {
-  if (!deps.up()) {
-    printResult({ connected: false }, () => [eventLine("item", "Not connected.")], deps.log);
-    return 0;
+  const wasUp = deps.up();
+  let failed = false;
+  if (wasUp) {
+    const code = await wgQuick(deps, "down");
+    if (code !== 0) {
+      deps.error(`wg-quick exited ${code}.`);
+      failed = true;
+    }
+  }
+  const stale = await staleResolverFiles(deps);
+  if (stale.length) {
+    const args = ["rm", "-f", ...stale];
+    deps.notice(`Removing split DNS left from an earlier connection. Running: sudo ${args.join(" ")}`);
+    const code = await deps.run("sudo", args);
+    if (code !== 0) {
+      deps.error(`Could not remove ${stale.join(", ")} (rm exited ${code}).`);
+      return 1;
+    }
   }
-  const code = await wgQuick(deps, "down");
-  if (code !== 0) {
-    deps.error(`wg-quick exited ${code}.`);
+  if (failed)
     return 1;
-  }
-  printResult({ connected: false }, () => [eventLine("done", "Disconnected.")], deps.log);
+  printResult({ connected: false, removedSplitDns: stale }, () => [
+    wasUp ? eventLine("done", "Disconnected.") : eventLine(stale.length ? "done" : "item", stale.length ? "Not connected; removed the leftover split DNS." : "Not connected.")
+  ], deps.log);
   return 0;
 }
 async function readConnection(deps) {
@@ -11039,7 +11283,11 @@ async function readConnection(deps) {
 }
 async function runNetworkStatus(deps = defaultDeps()) {
   const { state, up, device, asked, provider, staleMtu } = await readConnection(deps);
-  printResult({ connected: up, device, provider, staleMtu }, () => {
+  const staleSplitDns = up ? [] : await staleResolverFiles(deps);
+  for (const file of staleSplitDns) {
+    deps.notice(`Split DNS from an earlier connection is still set (${file}): names of the private network will hang. Run: ${getCliName()} network disconnect`);
+  }
+  printResult({ connected: up, device, provider, staleMtu, staleSplitDns }, () => {
     if (!state) {
       return [eventLine("item", `Not set up. Run \`${getCliName()} network connect\`.`)];
     }
@@ -11049,6 +11297,7 @@ async function runNetworkStatus(deps = defaultDeps()) {
     ];
     if (device) {
       lines.push(`    Device ${device.name}, valid until ${device.expiresAt.slice(0, 10)}.`);
+      lines.push(`    ${deviceStateText(device.state)}.`);
       if (device.shortNameOrganization) {
         lines.push(`    Short names: ${device.shortNameOrganization.slug}'s sandboxes.`);
       }
@@ -11118,7 +11367,7 @@ async function runNetworkDevices(deps = defaultDeps()) {
   try {
     const { devices } = await deps.request("/api/v1/network/devices");
     const own = (await readDeviceState(deps.dir))?.deviceId;
-    printResult({ devices }, () => devices.length === 0 ? [eventLine("item", "No devices.")] : devices.map((d) => `  ${d.id === own ? "*" : " "} ${d.id}  ${d.name}  ${d.address}  until ${d.expiresAt.slice(0, 10)}`), deps.log);
+    printResult({ devices }, () => devices.length === 0 ? [eventLine("item", "No devices.")] : devices.map((d) => `  ${d.id === own ? "*" : " "} ${d.id}  ${d.name}  ${d.address}  until ${d.expiresAt.slice(0, 10)}  ${deviceStateText(d.state)}`), deps.log);
     return 0;
   } catch (err) {
     deps.error(message(err));
@@ -11140,7 +11389,7 @@ async function runNetworkDevicesRemove(args, deps = defaultDeps()) {
 var connectCommand = defineCommand({
   meta: {
     name: "connect",
-    description: "Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Asks for sudo once."
+    description: "Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Also re-arms a paused device: with the tunnel up and nothing changed, without sudo."
   },
   args: {
     provider: {
@@ -11155,7 +11404,10 @@ var connectCommand = defineCommand({
   }
 });
 var disconnectCommand = defineCommand({
-  meta: { name: "disconnect", description: "Take this machine out of the private network." },
+  meta: {
+    name: "disconnect",
+    description: "Take this machine out of the private network, and remove split DNS an earlier connection left (macOS)."
+  },
   async run() {
     process.exitCode = await runNetworkDisconnect();
   }
@@ -12745,7 +12997,7 @@ async function collectPath3(path) {
   await visit(path);
   return files;
 }
-async function runSandboxUpload(options, log = console.log, error = printError) {
+async function runSandboxUpload(options, log = console.log, error = printError, notice = printNotice, pickers = defaultContainerPickers()) {
   if (options.paths.length === 0 && !options.zip) {
     error("Provide at least one path or --zip.");
     return 1;
@@ -12761,9 +13013,26 @@ async function runSandboxUpload(options, log = console.log, error = printError)
     if (options.zip) {
       form.append("zip", new Blob([await readFile7(options.zip)]), basename5(options.zip));
     }
-    const { value: result } = await withProgress("Uploading…", () => authorizedRequest(`/api/v1/sandboxes/${encodeURIComponent(options.sandboxId)}/files?organization=${encodeURIComponent(organization)}`, { method: "POST", body: form }));
+    let container = options.container;
+    const call = {
+      organization,
+      sandboxId: options.sandboxId,
+      canPick: !container,
+      setContainer: (picked) => {
+        container = picked;
+      }
+    };
+    const send = async () => {
+      const query = new URLSearchParams({ organization });
+      if (container)
+        query.set("container", container);
+      const { value } = await withProgress("Uploading…", () => authorizedRequest(`/api/v1/sandboxes/${encodeURIComponent(options.sandboxId)}/files?${query}`, { method: "POST", body: form }));
+      return value;
+    };
+    const result = await withContainerPick(call, () => withContainerStart(call, send, options.start === true, pickers, notice), pickers, notice);
+    const count = `${result.written.length} file${result.written.length === 1 ? "" : "s"}`;
     printResult(result, () => [
-      eventLine("done", `Uploaded ${result.written.length} file${result.written.length === 1 ? "" : "s"} to ${options.sandboxId}.`)
+      eventLine("done", result.container ? `Uploaded ${count} to ${result.container} in ${options.sandboxId}.` : `Uploaded ${count} to ${options.sandboxId}.`)
     ], log);
     return 0;
   } catch (err) {
@@ -12787,6 +13056,14 @@ var sandboxUploadCommand = defineCommand({
       required: true
     },
     org: orgArg,
+    container: {
+      type: "string",
+      description: `Container the files land in, by name, from \`${getCliName()} sandboxes containers list\`. Default: the sandbox's default container, else the one running container.`
+    },
+    start: {
+      type: "boolean",
+      description: "Start the container first when it is not running, without asking."
+    },
     zip: {
       type: "string",
       description: "Local ZIP file to upload."
@@ -12802,7 +13079,9 @@ var sandboxUploadCommand = defineCommand({
       sandboxId: args["sandbox-id"],
       org: args.org,
       paths: args._.slice(1),
-      zip: args.zip
+      zip: args.zip,
+      container: args.container,
+      start: args.start
     });
   }
 });