ghostdock 0.0.16 → 0.0.18

package/dist/index.js

@@ -863,6 +863,14 @@ var GENERATED_TOOL_CATALOG = [
           description: "Mark the sandbox ephemeral: every stop destroys the machine and the next start boots fresh, while the record, URLs, and settings stay. Omit to use the image label ghostdock.ephemeral, or false when that label is absent. Does not change idle-stop or auto-delete.",
           type: "boolean"
         },
+        imageBase: {
+          description: "How the disk is made for one of Ghostdock's VM images: auto (default) clones the host's image base, a disk with the image already on it, when there is one; off always starts from an empty disk that pulls the image. For tests and comparisons; other images always start empty.",
+          type: "string",
+          enum: [
+            "auto",
+            "off"
+          ]
+        },
         urls: {
           description: "Changes to the image’s or snapshot’s URLs, keyed by port. Omit for the image URLs as they are; otherwise you get the image URLs plus yours: an entry on the same port replaces that URL completely (omitted fields take their defaults), and { port, remove: true } drops it; removing a port the image does not declare does nothing. A required port cannot be removed. TCP URLs are always public.",
           maxItems: 100,
@@ -9175,8 +9183,25 @@ function getCliName(argv = process.argv) {
   const invoked = basename(entry);
   return CLI_NAMES.find((name) => name === invoked) ?? "ghostdock";
 }
+
+// src/commands/docker.ts
+import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
+
+// ../../shared/lib/private-network.ts
+var ALL_BITS = (1n << 128n) - 1n;
+
+// ../../shared/lib/docker-access.ts
+var DOCKER_CERTIFICATE_RENEW_DAYS = 10;
+var DOCKER_CLIENT_URI_PREFIX = {
+  user: "urn:ghostdock:user:",
+  device: "urn:ghostdock:device:",
+  organization: "urn:ghostdock:org:"
+};
+function dockerContextName(orgSlug, sandboxName) {
+  return `ghostdock-${orgSlug}-${sandboxName}`;
+}
 // package.json
-var version = "0.0.16";
+var version = "0.0.18";
 var package_default = {
   name: "ghostdock",
   description: "Ghostdock CLI — device login and agent tool invocation from the command line",
@@ -9284,6 +9309,380 @@ async function clearCredentials(path = getCredentialsPath()) {
   await rm(path, { force: true });
 }
 
+// ../../shared/lib/private-network-pause.ts
+function formatPauseLimit(seconds) {
+  const minutes = Math.max(1, Math.round(seconds / 60));
+  if (minutes >= 2 * 1440 && minutes % 1440 === 0)
+    return `${minutes / 1440} days`;
+  const hours = Math.floor(minutes / 60);
+  const rest = minutes % 60;
+  if (hours === 0)
+    return `${rest} min`;
+  return rest === 0 ? `${hours} h` : `${hours} h ${rest} min`;
+}
+function devicePauseReasonText(reason, limits) {
+  switch (reason) {
+    case "idle":
+      return `idle ${formatPauseLimit(limits.idleTimeoutSeconds)}`;
+    case "max_session":
+      return `${formatPauseLimit(limits.maxSessionSeconds)} session limit`;
+    case "manual":
+      return "paused in the web app";
+  }
+}
+
+// src/output.ts
+var SYMBOLS = {
+  ready: "⚓",
+  done: "✓",
+  url: "↗",
+  stopped: "◌",
+  failed: "✗",
+  progress: "▂▄▆",
+  item: "•"
+};
+var jsonOutput = false;
+function setJsonOutput(on) {
+  jsonOutput = on;
+}
+function isJsonOutput() {
+  return jsonOutput;
+}
+function colorEnabled(stream, env = process.env) {
+  if (env.FORCE_COLOR !== undefined)
+    return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "false";
+  if (env.NO_COLOR !== undefined && env.NO_COLOR !== "")
+    return false;
+  if (env.TERM === "dumb")
+    return false;
+  return stream.isTTY === true;
+}
+function trueColor(env = process.env) {
+  return env.COLORTERM === "truecolor" || env.COLORTERM === "24bit";
+}
+function accent(text, enabled) {
+  if (!enabled)
+    return text;
+  const open = trueColor() ? "\x1B[38;2;124;255;203m" : "\x1B[38;5;122m";
+  return `${open}${text}\x1B[39m`;
+}
+function red(text, enabled) {
+  return enabled ? `\x1B[31m${text}\x1B[39m` : text;
+}
+function dim(text, enabled) {
+  return enabled ? `\x1B[2m${text}\x1B[22m` : text;
+}
+function eventLine(symbol, message, color = colorEnabled(process.stdout)) {
+  return `  ${accent(SYMBOLS[symbol], color)} ${message}`;
+}
+function errorLine(message, color = colorEnabled(process.stderr)) {
+  return red(`  ${SYMBOLS.failed} ${message}`, color);
+}
+function printNotice(message) {
+  process.stderr.write(`${message}
+`);
+}
+function printError(message) {
+  process.stderr.write(`${errorLine(message)}
+`);
+}
+function printResult(data, human, log = console.log) {
+  if (jsonOutput) {
+    log(JSON.stringify(data, null, 2));
+    return;
+  }
+  for (const line of human())
+    log(line);
+}
+
+// src/network/pause.ts
+var DEVICE_HEADER = "ghostdock-device";
+var DEVICE_STATE_HEADER = "ghostdock-device-state";
+function parseDeviceStateHeader(value) {
+  if (!value)
+    return null;
+  const [state, ...params] = value.split(";").map((part) => part.trim());
+  if (state !== "paused")
+    return null;
+  const fields = new Map(params.map((param) => {
+    const [key, ...rest] = param.split("=");
+    return [key?.trim() ?? "", rest.join("=").trim()];
+  }));
+  const reason = fields.get("reason");
+  if (reason !== "idle" && reason !== "max_session" && reason !== "manual")
+    return null;
+  const limit = Number(fields.get("limit"));
+  return { reason, limitSeconds: Number.isInteger(limit) && limit > 0 ? limit : null };
+}
+function pausedNotice(paused) {
+  const limit = paused.limitSeconds ?? 0;
+  const why = paused.reason === "manual" || limit > 0 ? ` (${devicePauseReasonText(paused.reason, { idleTimeoutSeconds: limit, maxSessionSeconds: limit })})` : "";
+  return `Network access for this device is paused${why}. Run: ${getCliName()} network connect`;
+}
+var noticeShown = false;
+var noticeSuppressed = false;
+function notePausedDevice(header, write = (line) => process.stderr.write(`${line}
+`)) {
+  if (noticeShown || noticeSuppressed)
+    return;
+  const paused = parseDeviceStateHeader(header);
+  if (!paused)
+    return;
+  noticeShown = true;
+  write(`! ${pausedNotice(paused)}`);
+}
+function suppressPausedNotice() {
+  noticeSuppressed = true;
+}
+function clockTime(iso, now = new Date) {
+  const at = new Date(iso);
+  const time = at.toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit" });
+  if (at.toDateString() === now.toDateString())
+    return time;
+  return `${at.toLocaleDateString("en-GB", { weekday: "short" })} ${time}`;
+}
+function setBy(slug) {
+  return slug ? `, set by ${slug}` : "";
+}
+function pauseHint(state, now = new Date) {
+  const idle = `after ${formatPauseLimit(state.idleTimeoutSeconds)} without traffic${setBy(state.setBy.idle)}`;
+  const sessionEnd = sessionEndsAt(state, now);
+  const session = `${formatPauseLimit(state.maxSessionSeconds)} after connecting${sessionEnd ? ` (at ${clockTime(sessionEnd, now)})` : ""}${setBy(state.setBy.maxSession)}`;
+  return [
+    "ℹ  For security, this device's network access pauses automatically:",
+    `   ${idle}, and ${session}.`,
+    `   Resume any time: ${getCliName()} network connect, or Reconnect in the web app.`
+  ];
+}
+function sessionEndsAt(state, now) {
+  if (state.status !== "active" || !state.pausesAt)
+    return null;
+  if (state.pauseCause === "max_session")
+    return state.pausesAt;
+  return new Date(now.getTime() + state.maxSessionSeconds * 1000).toISOString();
+}
+function bold2(text, enabled = colorEnabled(process.stderr)) {
+  return enabled ? `\x1B[1m${text}\x1B[22m` : text;
+}
+function deviceStateText(state, now = new Date) {
+  if (!state)
+    return "Not connected (logged out)";
+  if (state.status === "paused" && state.pauseReason) {
+    const text = state.pauseReason === "manual" ? "Paused by you" : `Paused: ${devicePauseReasonText(state.pauseReason, state)}`;
+    if (state.connected)
+      return text;
+    return state.connecting ? `${text}, connecting` : `Not connected (${text.toLowerCase()})`;
+  }
+  const left = state.pausesAt ? new Date(state.pausesAt).getTime() - now.getTime() : 0;
+  const active = `Active, pauses in ${formatRemaining(Math.max(left, 0) / 1000)}`;
+  if (state.connected)
+    return active;
+  return state.connecting ? `${active}, connecting` : `Not connected (armed, pauses in ${formatRemaining(Math.max(left, 0) / 1000)})`;
+}
+function formatRemaining(seconds) {
+  const minutes = Math.floor(seconds / 60);
+  const days = Math.floor(minutes / 1440);
+  const hours = Math.floor(minutes % 1440 / 60);
+  const rest = minutes % 60;
+  const dayText = days === 1 ? "1 day" : `${days} days`;
+  if (days > 0)
+    return hours ? `${dayText} ${hours} h` : dayText;
+  if (hours > 0)
+    return rest ? `${hours} h ${rest} min` : `${hours} h`;
+  return `${Math.max(rest, 1)} min`;
+}
+
+// src/network/tunnel.ts
+import { createPrivateKey, createPublicKey, generateKeyPairSync } from "node:crypto";
+import { existsSync } from "node:fs";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2, join as join2 } from "node:path";
+var INTERFACE = "gdock";
+function networkDir() {
+  return join2(getConfigDir(), "network");
+}
+function configPath(dir = networkDir()) {
+  return join2(dir, `${INTERFACE}.conf`);
+}
+function keyPath(dir) {
+  return join2(dir, "private.key");
+}
+function statePath(dir) {
+  return join2(dir, "device.json");
+}
+function isProvider(value) {
+  const provider = value;
+  return typeof provider?.id === "string" && typeof provider.name === "string";
+}
+var X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
+function keyPairFromPrivate(privateKey) {
+  const raw = Buffer.from(privateKey, "base64");
+  if (raw.length !== 32)
+    throw new Error("The stored WireGuard key is not 32 bytes.");
+  const key = createPrivateKey({
+    key: Buffer.concat([X25519_PKCS8_PREFIX, raw]),
+    format: "der",
+    type: "pkcs8"
+  });
+  const spki = createPublicKey(key).export({ format: "der", type: "spki" });
+  return { privateKey, publicKey: spki.subarray(spki.length - 32).toString("base64") };
+}
+async function loadOrCreateKey(dir = networkDir()) {
+  try {
+    return keyPairFromPrivate((await readFile2(keyPath(dir), "utf8")).trim());
+  } catch (err) {
+    if (err.code !== "ENOENT")
+      throw err;
+  }
+  const { privateKey } = generateKeyPairSync("x25519");
+  const der = privateKey.export({ format: "der", type: "pkcs8" });
+  const raw = der.subarray(der.length - 32).toString("base64");
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await writeFile2(keyPath(dir), `${raw}
+`, { mode: 384 });
+  return keyPairFromPrivate(raw);
+}
+async function readDeviceState(dir = networkDir()) {
+  try {
+    const parsed = JSON.parse(await readFile2(statePath(dir), "utf8"));
+    if (typeof parsed.deviceId === "string" && typeof parsed.baseUrl === "string") {
+      return {
+        baseUrl: parsed.baseUrl,
+        deviceId: parsed.deviceId,
+        address: typeof parsed.address === "string" ? parsed.address : "",
+        gatewayProvider: isProvider(parsed.gatewayProvider) ? { id: parsed.gatewayProvider.id, name: parsed.gatewayProvider.name } : null,
+        zones: Array.isArray(parsed.zones) ? parsed.zones.filter((zone) => typeof zone === "string" && isDnsZone(zone)) : []
+      };
+    }
+  } catch {}
+  return null;
+}
+async function writeDeviceState(state, dir = networkDir()) {
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await writeFile2(statePath(dir), `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+}
+function detectDnsMode(platform = process.platform, exists = existsSync) {
+  if (platform === "darwin")
+    return "macos-resolver";
+  if (platform === "linux" && exists("/run/systemd/resolve"))
+    return "resolved";
+  return "none";
+}
+function renderConfig(input) {
+  const { device, network, gateway } = input.registered;
+  const zones = [network.zone, ...network.netZone ? [network.netZone] : []];
+  for (const zone of zones) {
+    if (!isDnsZone(zone))
+      throw new Error(`The server sent a zone that is not a DNS name: ${zone}`);
+  }
+  if (!device.address || !isIPv6Address(device.address)) {
+    throw new Error(`The server sent no IPv6 address for this device: ${device.address}`);
+  }
+  if (!isIPv6Address(network.gatewayAddress)) {
+    throw new Error(`The server sent a gateway that is not an IPv6 address: ${network.gatewayAddress}`);
+  }
+  const ipv4 = device.address4 && network.ingress4 ? { address: device.address4, ingress: network.ingress4 } : null;
+  if (ipv4 && (!isIPv4Address(ipv4.address) || !isIPv4Address(ipv4.ingress))) {
+    throw new Error(`The server sent an IPv4 address that is not one: ${ipv4.address}, ${ipv4.ingress}`);
+  }
+  const lines = [
+    "# Written by `ghostdock network connect`. Run it again rather than editing this file.",
+    "[Interface]",
+    `PrivateKey = ${input.privateKey}`,
+    `Address = ${device.address}/128${ipv4 ? `, ${ipv4.address}/32` : ""}`,
+    `MTU = ${network.mtu}`
+  ];
+  if (input.dns === "macos-resolver") {
+    for (const zone of zones) {
+      const file = `/etc/resolver/${zone}`;
+      lines.push(`PostUp = mkdir -p /etc/resolver && printf 'nameserver ${network.gatewayAddress}\\n' > ${file}`, `PostDown = rm -f ${file}`);
+    }
+  } else if (input.dns === "resolved") {
+    const domains = zones.map((zone) => `'~${zone}'`).join(" ");
+    lines.push(`PostUp = resolvectl dns %i ${network.gatewayAddress} && resolvectl domain %i ${domains}`);
+  }
+  lines.push("", "[Peer]", `PublicKey = ${gateway.publicKey}`, `Endpoint = ${gateway.endpoint}`, `AllowedIPs = ${network.prefix}${ipv4 ? `, ${ipv4.ingress}/32` : ""}`, "PersistentKeepalive = 25", "");
+  return lines.join(`
+`);
+}
+var DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function isDnsZone(zone) {
+  const labels = zone.split(".");
+  return zone.length <= 253 && labels.length >= 2 && labels.every((label) => DNS_LABEL.test(label));
+}
+function isIPv4Address(text) {
+  return /^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}$/.test(text);
+}
+function ipv4RouteOwner(platform, output) {
+  if (platform === "darwin") {
+    if (/^\s*destination: default$/m.test(output))
+      return null;
+    return /^\s*interface: (\S+)$/m.exec(output)?.[1] ?? null;
+  }
+  for (const line of output.split(`
+`).map((l) => l.trim())) {
+    if (!line || /^(default|broadcast)\b/.test(line))
+      continue;
+    return /\bdev (\S+)/.exec(line)?.[1] ?? "another route";
+  }
+  return null;
+}
+function ipv4RouteCommand(platform, address) {
+  return platform === "darwin" ? ["route", ["-n", "get", address]] : ["ip", ["-4", "route", "show", "table", "all", "match", address]];
+}
+function isIPv6Address(text) {
+  return /^[0-9a-f:]{2,39}$/.test(text) && text.includes(":");
+}
+async function readConfig(path = configPath()) {
+  try {
+    return await readFile2(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function configResolverZones(config) {
+  if (!config)
+    return [];
+  const zones = [];
+  for (const match of config.matchAll(/^PostDown = rm -f \/etc\/resolver\/(\S+)$/gm)) {
+    const zone = match[1] ?? "";
+    if (isDnsZone(zone) && !zones.includes(zone))
+      zones.push(zone);
+  }
+  return zones;
+}
+function resolverFile(zone) {
+  return `/etc/resolver/${zone}`;
+}
+async function readConfigMtu(path = configPath()) {
+  let contents;
+  try {
+    contents = await readFile2(path, "utf8");
+  } catch {
+    return null;
+  }
+  const match = /^MTU = (\d+)$/m.exec(contents);
+  return match ? Number(match[1]) : null;
+}
+async function writeConfig(contents, path = configPath()) {
+  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+  await writeFile2(path, contents, { mode: 384 });
+  await chmod2(path, 384);
+}
+function tunnelUp(platform = process.platform, exists = existsSync) {
+  if (platform === "darwin")
+    return exists(`/var/run/wireguard/${INTERFACE}.name`);
+  return exists(`/sys/class/net/${INTERFACE}`);
+}
+function installHint(platform = process.platform) {
+  if (platform === "darwin")
+    return "brew install wireguard-tools";
+  if (platform === "linux")
+    return "sudo apt install wireguard-tools (or your distribution’s package)";
+  return "Install wireguard-tools. On Windows, run the CLI inside WSL.";
+}
+
 // src/api-client.ts
 var CLI_USER_AGENT = `ghostdock-cli/${version}`;
 
@@ -9325,6 +9724,7 @@ async function request(path, init = {}) {
       ...init.headers
     }
   });
+  notePausedDevice(res.headers.get(DEVICE_STATE_HEADER));
   if (!res.ok) {
     const payload = await readErrorPayload(res);
     throw new ApiError(res.status, payload.message, payload.data);
@@ -9356,6 +9756,11 @@ function deviceRevoke(body) {
     body: JSON.stringify(body)
   });
 }
+var deviceIdOnce = null;
+function currentDeviceId() {
+  deviceIdOnce ??= readDeviceState().then((state) => state && state.baseUrl === getBaseUrl() ? state.deviceId : null).catch(() => null);
+  return deviceIdOnce;
+}
 var refreshInFlight = null;
 async function refreshStoredCredentials(refreshToken) {
   if (refreshInFlight)
@@ -9378,10 +9783,12 @@ async function authorizedRequest(path, init = {}) {
   if (!credentials) {
     throw new AuthRequiredError;
   }
+  const deviceId = await currentDeviceId();
   const withAuth = (accessToken) => ({
     ...init,
     headers: {
       ...init.headers,
+      ...deviceId ? { [DEVICE_HEADER]: deviceId } : {},
       authorization: `Bearer ${accessToken}`
     }
   });
@@ -9405,75 +9812,388 @@ async function authorizedRequest(path, init = {}) {
   }
 }
 
-// src/output.ts
-var SYMBOLS = {
-  ready: "⚓",
-  done: "✓",
-  url: "↗",
-  stopped: "◌",
-  failed: "✗",
-  progress: "▂▄▆",
-  item: "•"
+// src/docker/certificates.ts
+import { spawnSync } from "node:child_process";
+
+// src/docker/context.ts
+function contextDescription(sandbox, orgSlug) {
+  return `Ghostdock sandbox ${sandbox} (${orgSlug}; needs ${getCliName()} network connect)`;
+}
+function csvField(field) {
+  return /[",\r\n]/.test(field) ? `"${field.replaceAll('"', '""')}"` : field;
+}
+function contextArgs(verb, spec) {
+  const endpoint = [
+    `host=${spec.host}`,
+    `ca=${spec.files.ca}`,
+    `cert=${spec.files.cert}`,
+    `key=${spec.files.key}`
+  ].map(csvField).join(",");
+  return ["context", verb, spec.name, "--description", spec.description, "--docker", endpoint];
+}
+function contextHost(exec, name) {
+  const result = exec("docker", [
+    "context",
+    "inspect",
+    "--format",
+    "{{.Endpoints.docker.Host}}",
+    name
+  ]);
+  return result.status === 0 ? result.stdout.trim() : null;
+}
+function dockerFailure(args, result) {
+  const said = result.stderr.trim() || result.stdout.trim();
+  return new Error(`docker ${args.slice(0, 3).join(" ")} failed (exit ${result.status})${said ? `: ${said}` : "."}`);
+}
+function writeContext(exec, spec) {
+  const created = contextHost(exec, spec.name) === null;
+  const args = contextArgs(created ? "create" : "update", spec);
+  const result = exec("docker", args);
+  if (result.status !== 0)
+    throw dockerFailure(args, result);
+  return { created };
+}
+function useContext(exec, name) {
+  const args = ["context", "use", name];
+  const result = exec("docker", args);
+  if (result.status !== 0)
+    throw dockerFailure(args, result);
+}
+
+// src/docker/csr.ts
+import { createPublicKey as createPublicKey2, sign } from "node:crypto";
+var TAG = {
+  integer: 2,
+  bitString: 3,
+  utf8String: 12,
+  sequence: 48,
+  set: 49,
+  context0: 160
 };
-var jsonOutput = false;
-function setJsonOutput(on) {
-  jsonOutput = on;
+var OID_COMMON_NAME = Buffer.from("0603550403", "hex");
+var OID_ECDSA_WITH_SHA256 = Buffer.from("06082a8648ce3d040302", "hex");
+function der(tag, content) {
+  const length = content.length;
+  if (length < 128)
+    return Buffer.concat([Buffer.from([tag, length]), content]);
+  const bytes = [];
+  for (let rest = length;rest > 0; rest >>= 8)
+    bytes.unshift(rest & 255);
+  return Buffer.concat([Buffer.from([tag, 128 | bytes.length, ...bytes]), content]);
+}
+function csrSubject(deviceId) {
+  return `ghostdock device ${deviceId}`;
+}
+function buildCsr(privateKey, deviceId) {
+  const spki = createPublicKey2(privateKey).export({ type: "spki", format: "der" });
+  const commonName = der(TAG.sequence, Buffer.concat([OID_COMMON_NAME, der(TAG.utf8String, Buffer.from(csrSubject(deviceId)))]));
+  const subject = der(TAG.sequence, der(TAG.set, commonName));
+  const info = der(TAG.sequence, Buffer.concat([
+    der(TAG.integer, Buffer.from([0])),
+    subject,
+    spki,
+    der(TAG.context0, Buffer.alloc(0))
+  ]));
+  const signature = sign("sha256", info, { key: privateKey, dsaEncoding: "der" });
+  return der(TAG.sequence, Buffer.concat([
+    info,
+    der(TAG.sequence, OID_ECDSA_WITH_SHA256),
+    der(TAG.bitString, Buffer.concat([Buffer.from([0]), signature]))
+  ]));
+}
+function buildCsrPem(privateKey, deviceId) {
+  const base64 = buildCsr(privateKey, deviceId).toString("base64");
+  const lines = base64.match(/.{1,64}/g) ?? [];
+  return `-----BEGIN CERTIFICATE REQUEST-----
+${lines.join(`
+`)}
+-----END CERTIFICATE REQUEST-----
+`;
 }
-function isJsonOutput() {
-  return jsonOutput;
+
+// src/docker/store.ts
+import {
+  createPrivateKey as createPrivateKey2,
+  generateKeyPairSync as generateKeyPairSync2,
+  randomBytes,
+  X509Certificate
+} from "node:crypto";
+import { chmod as chmod3, link, mkdir as mkdir3, readdir, readFile as readFile3, rename, unlink, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname3, join as join3 } from "node:path";
+function dockerDirFor(networkDir) {
+  return join3(dirname3(networkDir), "docker");
 }
-function colorEnabled(stream, env = process.env) {
-  if (env.FORCE_COLOR !== undefined)
-    return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "false";
-  if (env.NO_COLOR !== undefined && env.NO_COLOR !== "")
-    return false;
-  if (env.TERM === "dumb")
-    return false;
-  return stream.isTTY === true;
+function isOrganizationId(id) {
+  return /^[A-Za-z0-9_-]{1,128}$/.test(id);
 }
-function trueColor(env = process.env) {
-  return env.COLORTERM === "truecolor" || env.COLORTERM === "24bit";
+function organizationFiles(dockerDir, organizationId) {
+  if (!isOrganizationId(organizationId)) {
+    throw new Error(`Not an organization id: ${JSON.stringify(organizationId)}`);
+  }
+  const dir = join3(dockerDir, organizationId);
+  return {
+    dir,
+    key: join3(dir, "key.pem"),
+    cert: join3(dir, "cert.pem"),
+    ca: join3(dir, "ca.pem"),
+    meta: join3(dir, "certificate.json")
+  };
 }
-function accent(text, enabled) {
-  if (!enabled)
-    return text;
-  const open = trueColor() ? "\x1B[38;2;124;255;203m" : "\x1B[38;5;122m";
-  return `${open}${text}\x1B[39m`;
+async function listOrganizationIds(dockerDir) {
+  try {
+    const entries = await readdir(dockerDir, { withFileTypes: true });
+    return entries.filter((entry) => entry.isDirectory() && isOrganizationId(entry.name)).map((entry) => entry.name).sort();
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return [];
+    throw err;
+  }
 }
-function red(text, enabled) {
-  return enabled ? `\x1B[31m${text}\x1B[39m` : text;
+function tempPath(path) {
+  return `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
 }
-function dim(text, enabled) {
-  return enabled ? `\x1B[2m${text}\x1B[22m` : text;
+async function writeFileAtomic(path, contents, mode) {
+  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
+  const temp = tempPath(path);
+  try {
+    await writeFile3(temp, contents, { mode });
+    await chmod3(temp, mode);
+    await rename(temp, path);
+  } catch (err) {
+    await unlink(temp).catch(() => {});
+    throw err;
+  }
 }
-function eventLine(symbol, message, color = colorEnabled(process.stdout)) {
-  return `  ${accent(SYMBOLS[symbol], color)} ${message}`;
+function isP256(key) {
+  return key.asymmetricKeyType === "ec" && key.asymmetricKeyDetails?.namedCurve === "prime256v1";
 }
-function errorLine(message, color = colorEnabled(process.stderr)) {
-  return red(`  ${SYMBOLS.failed} ${message}`, color);
+async function loadOrCreateDockerKey(files) {
+  const existing = await readDockerKey(files);
+  if (existing)
+    return existing;
+  const { privateKey } = generateKeyPairSync2("ec", { namedCurve: "prime256v1" });
+  const pem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+  await mkdir3(files.dir, { recursive: true, mode: 448 });
+  const temp = tempPath(files.key);
+  try {
+    await writeFile3(temp, pem, { mode: 384 });
+    await chmod3(temp, 384);
+    await link(temp, files.key);
+  } catch (err) {
+    if (err.code !== "EEXIST")
+      throw err;
+    const created = await readDockerKey(files);
+    if (created)
+      return created;
+    throw err;
+  } finally {
+    await unlink(temp).catch(() => {});
+  }
+  return privateKey;
 }
-function printNotice(message) {
-  process.stderr.write(`${message}
-`);
+async function readDockerKey(files) {
+  let pem;
+  try {
+    pem = await readFile3(files.key, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return null;
+    throw err;
+  }
+  const key = createPrivateKey2(pem);
+  if (!isP256(key))
+    throw new Error(`${files.key} is not an ECDSA P-256 key.`);
+  return key;
 }
-function printError(message) {
-  process.stderr.write(`${errorLine(message)}
-`);
+function uriSan(certificate, prefix) {
+  for (const name of (certificate.subjectAltName ?? "").split(/,\s*/)) {
+    if (name.startsWith(`URI:${prefix}`))
+      return name.slice(`URI:${prefix}`.length);
+  }
+  return null;
 }
-function printResult(data, human, log = console.log) {
-  if (jsonOutput) {
-    log(JSON.stringify(data, null, 2));
+function parseClientCertificate(pem, key) {
+  const certificate = new X509Certificate(pem);
+  if (!certificate.checkPrivateKey(key)) {
+    throw new Error("The certificate is not for this machine's Docker key.");
+  }
+  return {
+    pem,
+    serial: certificate.serialNumber.toLowerCase(),
+    notAfter: new Date(certificate.validTo),
+    deviceId: uriSan(certificate, DOCKER_CLIENT_URI_PREFIX.device),
+    organizationId: uriSan(certificate, DOCKER_CLIENT_URI_PREFIX.organization)
+  };
+}
+async function readClientCertificate(files, key) {
+  try {
+    const [pem] = await Promise.all([readFile3(files.cert, "utf8"), readFile3(files.ca, "utf8")]);
+    return parseClientCertificate(pem, key);
+  } catch {
+    return null;
+  }
+}
+var DAY_MS = 24 * 60 * 60 * 1000;
+function certificateDue(certificate, deviceId, now) {
+  return certificate.deviceId !== deviceId || certificate.notAfter.getTime() - now.getTime() < DOCKER_CERTIFICATE_RENEW_DAYS * DAY_MS;
+}
+async function readCertificateMeta(files) {
+  try {
+    const parsed = JSON.parse(await readFile3(files.meta, "utf8"));
+    if (typeof parsed.baseUrl === "string" && typeof parsed.organization?.id === "string" && typeof parsed.organization.slug === "string") {
+      return {
+        baseUrl: parsed.baseUrl,
+        organization: { id: parsed.organization.id, slug: parsed.organization.slug },
+        serial: typeof parsed.serial === "string" ? parsed.serial : "",
+        notAfter: typeof parsed.notAfter === "string" ? parsed.notAfter : ""
+      };
+    }
+  } catch {}
+  return null;
+}
+async function writeIssuedCertificate(files, issued) {
+  await writeFileAtomic(files.ca, issued.caPem, 420);
+  await writeFileAtomic(files.cert, issued.certificatePem, 420);
+  await writeFileAtomic(files.meta, `${JSON.stringify(issued.meta, null, 2)}
+`, 420);
+}
+function contextsPath(dockerDir) {
+  return join3(dockerDir, "contexts.json");
+}
+async function readContexts(dockerDir) {
+  try {
+    const parsed = JSON.parse(await readFile3(contextsPath(dockerDir), "utf8"));
+    return (parsed.contexts ?? []).filter((c) => typeof c?.name === "string" && typeof c.organizationId === "string" && typeof c.sandbox === "string");
+  } catch {
+    return [];
+  }
+}
+async function writeContexts(dockerDir, contexts) {
+  const unique = [...new Map(contexts.map((c) => [c.name, c])).values()].sort((a, b) => a.name.localeCompare(b.name));
+  await writeFileAtomic(contextsPath(dockerDir), `${JSON.stringify({ contexts: unique }, null, 2)}
+`, 420);
+}
+async function recordContext(dockerDir, context) {
+  const others = (await readContexts(dockerDir)).filter((c) => c.name !== context.name);
+  await writeContexts(dockerDir, [...others, context]);
+}
+
+// src/docker/certificates.ts
+function execDocker(command, args) {
+  const result = spawnSync(command, args, { encoding: "utf8" });
+  return {
+    status: result.status ?? 1,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? result.error?.message ?? ""
+  };
+}
+async function issueCertificate(input, request) {
+  const body = {
+    organization: input.organizationId,
+    deviceId: input.deviceId,
+    csrPem: buildCsrPem(input.key, input.deviceId)
+  };
+  const issued = await request("/api/v1/docker/certificates", {
+    method: "POST",
+    body: JSON.stringify(body)
+  });
+  const certificate = parseClientCertificate(issued.certificatePem, input.key);
+  if (certificate.deviceId !== input.deviceId || issued.organization.id !== input.organizationId || certificate.organizationId !== null && certificate.organizationId !== input.organizationId) {
+    throw new Error("The app sent a certificate for another device or organization: not stored.");
+  }
+  const meta = {
+    baseUrl: input.baseUrl,
+    organization: issued.organization,
+    serial: certificate.serial,
+    notAfter: certificate.notAfter.toISOString()
+  };
+  await writeIssuedCertificate(input.files, {
+    certificatePem: issued.certificatePem,
+    caPem: issued.caPem,
+    meta
+  });
+  return { certificate, meta };
+}
+async function ensureCertificate(input, request) {
+  const key = await loadOrCreateDockerKey(input.files);
+  const stored = await readClientCertificate(input.files, key);
+  if (stored && !certificateDue(stored, input.deviceId, input.now)) {
+    return { certificate: stored, issued: false };
+  }
+  const { certificate } = await issueCertificate({ ...input, key }, request);
+  return { certificate, issued: true };
+}
+function message(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function day(date) {
+  return date.toISOString().slice(0, 10);
+}
+async function renewDockerCertificates(deps, options = {}) {
+  const exec = deps.exec ?? execDocker;
+  const dockerDir = deps.dockerDir ?? dockerDirFor(deps.dir);
+  const now = (deps.now ?? (() => new Date))();
+  let organizationIds;
+  let state;
+  try {
+    organizationIds = (await listOrganizationIds(dockerDir)).filter((id) => id !== options.except);
+    state = organizationIds.length > 0 ? await readDeviceState(deps.dir) : null;
+  } catch (err) {
+    deps.notice(`Could not check the Docker certificates: ${message(err)}`);
     return;
   }
-  for (const line of human())
-    log(line);
+  if (!state || !deps.has("docker"))
+    return;
+  const deviceId = state.deviceId;
+  let contexts = await readContexts(dockerDir);
+  let contextsChanged = false;
+  for (const organizationId of organizationIds) {
+    const files = organizationFiles(dockerDir, organizationId);
+    const meta = await readCertificateMeta(files);
+    const label = meta?.organization.slug ?? organizationId;
+    try {
+      if (meta && meta.baseUrl !== state.baseUrl)
+        continue;
+      const key = await readDockerKey(files);
+      const stored = key ? await readClientCertificate(files, key) : null;
+      if (!key || !stored || !certificateDue(stored, deviceId, now))
+        continue;
+      const { certificate } = await issueCertificate({ files, key, organizationId, deviceId, baseUrl: state.baseUrl }, deps.request);
+      const updated = [];
+      for (const context of contexts.filter((c) => c.organizationId === organizationId)) {
+        const host = contextHost(exec, context.name);
+        if (host === null) {
+          contexts = contexts.filter((c) => c.name !== context.name);
+          contextsChanged = true;
+          continue;
+        }
+        writeContext(exec, {
+          name: context.name,
+          description: contextDescription(context.sandbox, label),
+          host,
+          files
+        });
+        updated.push(context.name);
+      }
+      deps.notice(`Renewed the Docker certificate for ${label}, valid until ${day(certificate.notAfter)}${updated.length > 0 ? `; updated ${updated.join(", ")}` : ""}.`);
+    } catch (err) {
+      deps.notice(`Could not renew the Docker certificate for ${label} (${message(err)}). Run \`${getCliName()} docker context <sandbox> --org ${label}\` to try again.`);
+    }
+  }
+  if (contextsChanged) {
+    try {
+      await writeContexts(dockerDir, contexts);
+    } catch (err) {
+      deps.notice(`Could not update ${dockerDir}/contexts.json: ${message(err)}`);
+    }
+  }
 }
 
 // src/settings.ts
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname4, join as join4 } from "node:path";
 function getSettingsPath() {
-  return join2(dirname2(getCredentialsPath()), "settings.json");
+  return join4(dirname4(getCredentialsPath()), "settings.json");
 }
 function isDefaultOrganization(value) {
   if (!value || typeof value !== "object")
@@ -9483,15 +10203,15 @@ function isDefaultOrganization(value) {
 }
 async function readSettings(path = getSettingsPath()) {
   try {
-    const parsed = JSON.parse(await readFile2(path, "utf8"));
+    const parsed = JSON.parse(await readFile4(path, "utf8"));
     return isDefaultOrganization(parsed.defaultOrganization) ? { defaultOrganization: parsed.defaultOrganization } : {};
   } catch {
     return {};
   }
 }
 async function writeSettings(settings, path = getSettingsPath()) {
-  await mkdir2(dirname2(path), { recursive: true });
-  await writeFile2(path, `${JSON.stringify(settings, null, 2)}
+  await mkdir4(dirname4(path), { recursive: true });
+  await writeFile4(path, `${JSON.stringify(settings, null, 2)}
 `, "utf8");
 }
 
@@ -9556,1667 +10276,1769 @@ async function resolveOrganizationId(flag) {
   return (await findMyOrganization(await requireOrganizationRef(flag))).id;
 }
 
-// src/commands/env.ts
-function reportError(err, error) {
-  if (err instanceof AuthRequiredError || err instanceof Error) {
-    error(err.message);
-  } else {
-    error(String(err));
-  }
-  return 1;
+// src/commands/network.ts
+import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
+import { hostname } from "node:os";
+function defaultDeps() {
+  return {
+    request: authorizedRequest,
+    run: (command, args) => new Promise((resolve, reject) => {
+      const child = spawn(command, args, { stdio: "inherit" });
+      child.on("error", reject);
+      child.on("close", (code) => resolve(code ?? 1));
+    }),
+    output: (command, args) => {
+      const result = spawnSync2(command, args, { encoding: "utf8" });
+      return result.status === 0 ? result.stdout : "";
+    },
+    platform: process.platform,
+    has: (command) => spawnSync2("sh", ["-c", `command -v ${command}`]).status === 0,
+    dir: networkDir(),
+    up: () => tunnelUp(),
+    exists: existsSync2,
+    log: console.log,
+    error: printError,
+    notice: printNotice
+  };
 }
-function invokeTool(tool, input) {
-  return authorizedRequest(`/api/v1/tools/${tool}`, {
-    method: "POST",
-    body: JSON.stringify(input)
-  });
+function message2(err) {
+  return err instanceof Error ? err.message : String(err);
 }
-function displayValue(entry) {
-  if (entry.valueOmittedReason === "secret")
-    return "<secret>";
-  if (entry.valueOmittedReason === "too_large") {
-    return `<${entry.valueLength} chars — read with \`${getCliName()} env get\`>`;
-  }
-  return entry.value ?? "";
+function connectCommandFor(provider) {
+  const ref = provider.connectRef;
+  const arg = /^[A-Za-z0-9._-]+$/.test(ref) ? ref : JSON.stringify(ref);
+  return `${getCliName()} network connect ${arg}`;
 }
-function formatTable(entries) {
-  const rows = entries.map((entry) => [
-    entry.name,
-    entry.kind,
-    displayValue(entry),
-    entry.comment ?? ""
-  ]);
-  const header = ["NAME", "KIND", "VALUE", "COMMENT"];
-  const widths = header.map((_, column) => Math.max(header[column]?.length ?? 0, ...rows.map((row) => row[column]?.length ?? 0)));
-  const line = (cells) => cells.map((cell, column) => column === cells.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
-  return [line(header), ...rows.map(line)].join(`
-`);
+async function wgQuick(deps, verb) {
+  const args = ["wg-quick", verb, configPath(deps.dir)];
+  deps.notice(`Running: sudo ${args.join(" ")}`);
+  return deps.run("sudo", args);
 }
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(Buffer.from(chunk));
+async function runNetworkConnect(args = {}, deps = defaultDeps()) {
+  suppressPausedNotice();
+  if (!deps.has("wg-quick")) {
+    deps.error(`wg-quick is not installed. ${installHint()}`);
+    return 1;
   }
-  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
-}
-async function runEnvList(args, log = console.log, error = printError) {
+  let registered;
+  let privateKey;
+  const previous = await readDeviceState(deps.dir);
   try {
-    const result = await invokeTool("env_list", {
-      organization: args.organization
+    const organization = await requireOrganizationRef(args.org, deps.notice);
+    const provider = args.provider?.trim();
+    const key = await loadOrCreateKey(deps.dir);
+    privateKey = key.privateKey;
+    registered = await deps.request("/api/v1/network/devices", {
+      method: "POST",
+      body: JSON.stringify({
+        publicKey: key.publicKey,
+        name: hostname().slice(0, 64) || "device",
+        organization,
+        ...provider ? { provider } : {}
+      })
     });
-    if (args.json) {
-      log(JSON.stringify(result.entries, null, 2));
-      return 0;
-    }
-    if (result.entries.length === 0) {
-      log("  No variables or secrets.");
-      return 0;
-    }
-    log(formatTable(result.entries));
-    return 0;
   } catch (err) {
-    return reportError(err, error);
+    deps.error(message2(err));
+    return 1;
   }
-}
-async function runEnvGet(args, log = console.log, error = printError) {
+  const dns = detectDnsMode();
+  let config;
   try {
-    const result = await invokeTool("env_get", {
-      organization: args.organization,
-      name: args.name
-    });
-    log(args.json ? JSON.stringify(result.entry, null, 2) : result.entry.value ?? "");
-    return 0;
+    config = renderConfig({ privateKey, registered, dns });
   } catch (err) {
-    return reportError(err, error);
+    deps.error(message2(err));
+    return 1;
   }
-}
-function resolveKind(args) {
-  if (args.kind !== undefined && args.kind !== "variable" && args.kind !== "secret") {
-    return { error: `--kind must be "variable" or "secret", got "${args.kind}".` };
+  const previousConfig = await readConfig(configPath(deps.dir));
+  await writeConfig(config, configPath(deps.dir));
+  await writeDeviceState({
+    baseUrl: getBaseUrl(),
+    deviceId: registered.device.id,
+    address: registered.device.address ?? "",
+    gatewayProvider: registered.provider,
+    zones: [
+      registered.network.zone,
+      ...registered.network.netZone ? [registered.network.netZone] : []
+    ]
+  }, deps.dir);
+  const wasUp = deps.up();
+  if (wasUp && previousConfig === config) {
+    const { device, network, provider, shortNameOrganizationChanged } = registered;
+    printResult({
+      device,
+      network,
+      provider,
+      shortNameOrganizationChanged,
+      interface: INTERFACE,
+      dns,
+      rearmed: true,
+      pause: device.state
+    }, () => [
+      eventLine("done", rearmedLine(device.state)),
+      ...network.netZone && device.shortNameOrganization && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : []
+    ], deps.log);
+    printPauseHint(device.state, deps);
+    await renewDockerCertificates(deps);
+    return 0;
   }
-  const fromKind = args.kind;
-  if (args.secret && fromKind === "variable") {
-    return { error: "Pass either --secret or --kind variable, not both." };
+  if (wasUp) {
+    const down = await wgQuick(deps, "down");
+    if (down !== 0) {
+      deps.error(`Could not take the old tunnel down (wg-quick exited ${down}).`);
+      return 1;
+    }
   }
-  return { kind: fromKind ?? (args.secret ? "secret" : undefined) };
-}
-async function runEnvSet(args, log = console.log, error = printError, stdin = readStdin) {
-  if (args.value !== undefined && args.valueStdin) {
-    error("Pass either --value or --value-stdin, not both.");
+  const ipv4Clashes = ipv4Clashes4(registered, deps);
+  const code = await wgQuick(deps, "up");
+  if (code !== 0) {
+    deps.error(`wg-quick exited ${code}. The config is in ${configPath(deps.dir)}.`);
     return 1;
   }
-  if (args.value === undefined && !args.valueStdin) {
-    error("Provide --value, or --value-stdin to read the value from stdin.");
-    return 1;
+  const { device, network, provider, shortNameOrganizationChanged } = registered;
+  const pinned = device.shortNameOrganization;
+  const switched = wasUp && previous?.gatewayProvider && previous.gatewayProvider.id !== provider.id ? previous.gatewayProvider : null;
+  printResult({
+    device,
+    network,
+    provider,
+    shortNameOrganizationChanged,
+    interface: INTERFACE,
+    dns,
+    rearmed: false,
+    pause: device.state
+  }, () => [
+    eventLine("done", `Connected through ${provider.name}. This machine is ${device.address} in the private network.`),
+    ...switched ? [
+      `    Replaced the connection through ${switched.name}: its sandboxes are out of reach now.`
+    ] : [],
+    `    Reachable: the sandboxes on ${provider.name}. One provider at a time.`,
+    `    Names: <sandbox>.<org>.${network.zone}`,
+    ...network.netZone ? [`    In a browser: https://<sandbox>--<org>.${network.netZone}:<port>`] : [],
+    ...network.netZone && pinned ? [
+      `    Short names: https://<sandbox>.${network.netZone}:<port> for ${pinned.slug}'s sandboxes, on this machine.`,
+      `    Another organization: ${getCliName()} network connect --org <org>.`
+    ] : [],
+    ...network.netZone && pinned && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : [],
+    ...network.ingress4 && !device.address4 ? [
+      "    No IPv4 address was free on this provider's host, so browser names work over IPv6 only:",
+      "    Chrome on a network without IPv6 cannot open them on this machine. Firefox and Safari",
+      "    can. Run connect again later: an address frees up when another device goes."
+    ] : [],
+    ...ipv4Clashes.map(({ address, owner }) => `    ${address} is already routed through ${owner} on this machine: browsers may not reach the private network's names over IPv4 while it is. Ask your Ghostdock admin about the IPv4 block.`),
+    ...dns === "none" ? [
+      "    No split DNS on this machine (no systemd-resolved): use the addresses from",
+      `    \`${getCliName()} network ls\`.`
+    ] : [],
+    `    → ${getCliName()} network ls`
+  ], deps.log);
+  printPauseHint(device.state, deps);
+  await renewDockerCertificates(deps);
+  return 0;
+}
+function rearmedLine(state, now = new Date) {
+  if (!state)
+    return "Re-armed.";
+  const until = clockTime(new Date(now.getTime() + state.maxSessionSeconds * 1000).toISOString(), now);
+  return `Re-armed: network access for this device runs until ${until} (pauses after ${formatPauseLimit(state.idleTimeoutSeconds)} idle).`;
+}
+function printPauseHint(state, deps) {
+  if (!state || isJsonOutput())
+    return;
+  const [first = "", ...rest] = pauseHint(state);
+  deps.notice(["", bold2(first), ...rest].join(`
+`));
+}
+function ipv4Clashes4(registered, deps) {
+  const addresses = [registered.network.ingress4, registered.device.address4].filter((a) => typeof a === "string" && isIPv4Address(a));
+  const clashes = [];
+  for (const address of addresses) {
+    const [command, args] = ipv4RouteCommand(deps.platform, address);
+    const owner = ipv4RouteOwner(deps.platform, deps.output(command, args));
+    if (owner)
+      clashes.push({ address, owner });
   }
-  const resolved = resolveKind(args);
-  if ("error" in resolved) {
-    error(resolved.error);
-    return 1;
+  return clashes;
+}
+function clearingNotice(cookieSite) {
+  const site = cookieSite?.site ?? "the net domain";
+  return [
+    "    Short names meant another organization's sandboxes before. The first short-name site each",
+    `    browser opens now clears its data once: the site's storage, and every cookie of ${site}.`,
+    `    That signs the browser out of every site under ${site}${cookieSite?.includesApp ? ", the Ghostdock app included" : ""}.`,
+    "    Reload or close browser tabs opened on short names before this connect."
+  ];
+}
+async function staleResolverFiles(deps) {
+  if (deps.platform !== "darwin")
+    return [];
+  const state = await readDeviceState(deps.dir);
+  const zones = new Set([
+    ...configResolverZones(await readConfig(configPath(deps.dir))),
+    ...state?.zones ?? []
+  ]);
+  return [...zones].map(resolverFile).filter((file) => deps.exists(file));
+}
+async function runNetworkDisconnect(deps = defaultDeps()) {
+  const wasUp = deps.up();
+  let failed = false;
+  if (wasUp) {
+    const code = await wgQuick(deps, "down");
+    if (code !== 0) {
+      deps.error(`wg-quick exited ${code}.`);
+      failed = true;
+    }
+  }
+  const stale = await staleResolverFiles(deps);
+  if (stale.length) {
+    const args = ["rm", "-f", ...stale];
+    deps.notice(`Removing split DNS left from an earlier connection. Running: sudo ${args.join(" ")}`);
+    const code = await deps.run("sudo", args);
+    if (code !== 0) {
+      deps.error(`Could not remove ${stale.join(", ")} (rm exited ${code}).`);
+      return 1;
+    }
   }
-  const value = args.valueStdin ? await stdin() : args.value ?? "";
+  if (failed)
+    return 1;
+  printResult({ connected: false, removedSplitDns: stale }, () => [
+    wasUp ? eventLine("done", "Disconnected.") : eventLine(stale.length ? "done" : "item", stale.length ? "Not connected; removed the leftover split DNS." : "Not connected.")
+  ], deps.log);
+  return 0;
+}
+async function readConnection(deps) {
+  const state = await readDeviceState(deps.dir);
+  const up = deps.up();
+  if (!state)
+    return { state, up, device: null, asked: true, provider: null, staleMtu: null };
   try {
-    const result = await invokeTool("env_set", {
-      organization: args.organization,
-      name: args.name,
-      value,
-      ...resolved.kind ? { kind: resolved.kind } : {},
-      ...args.comment ? { comment: args.comment } : {}
-    });
-    if (args.json) {
-      log(JSON.stringify(result, null, 2));
-      return 0;
+    const { devices, mtu } = await deps.request("/api/v1/network/devices");
+    const device = devices.find((d) => d.id === state.deviceId) ?? null;
+    const config = await readConfigMtu(configPath(deps.dir));
+    const staleMtu = config !== null && config !== mtu ? { config, current: mtu } : null;
+    if (staleMtu) {
+      deps.notice(`This machine's tunnel has MTU ${staleMtu.config}, the network now uses ${staleMtu.current}. ` + `Run \`${getCliName()} network connect\` again: until then, large packets other than TCP ` + "can be lost on the way.");
     }
-    log(eventLine("done", `${result.created ? "Created" : "Updated"} ${result.entry.kind} ${result.entry.name}.`));
-    if (result.previousKind === "secret") {
-      log(eventLine("item", `Warning: ${result.entry.name} was a secret and is now a variable — its value is readable by everyone in the organization.`));
-    } else if (result.previousKind === "variable") {
-      log(eventLine("item", `${result.entry.name} was a variable and is now a secret; its value is no longer shown.`));
+    return {
+      state,
+      up,
+      device,
+      asked: true,
+      provider: up ? device?.gatewayProvider ?? null : null,
+      staleMtu
+    };
+  } catch (err) {
+    deps.notice(`Could not ask the app about this device: ${message2(err)}`);
+    return {
+      state,
+      up,
+      device: null,
+      asked: false,
+      provider: up ? state.gatewayProvider : null,
+      staleMtu: null
+    };
+  }
+}
+async function runNetworkStatus(deps = defaultDeps()) {
+  const { state, up, device, asked, provider, staleMtu } = await readConnection(deps);
+  const staleSplitDns = up ? [] : await staleResolverFiles(deps);
+  for (const file of staleSplitDns) {
+    deps.notice(`Split DNS from an earlier connection is still set (${file}): names of the private network will hang. Run: ${getCliName()} network disconnect`);
+  }
+  printResult({ connected: up, device, provider, staleMtu, staleSplitDns }, () => {
+    if (!state) {
+      return [eventLine("item", `Not set up. Run \`${getCliName()} network connect\`.`)];
+    }
+    const through = provider ? ` through ${provider.name}` : "";
+    const lines = [
+      eventLine("item", `${up ? `Connected${through}` : "Not connected"}: ${state.address}`)
+    ];
+    if (device) {
+      lines.push(`    Device ${device.name}, valid until ${device.expiresAt.slice(0, 10)}.`);
+      lines.push(`    ${deviceStateText(device.state)}.`);
+      if (device.shortNameOrganization) {
+        lines.push(`    Short names: ${device.shortNameOrganization.slug}'s sandboxes.`);
+      }
+      if (!device.gatewayProvider) {
+        lines.push(`    Its provider is gone, so no gateway serves it. Run \`${getCliName()} network connect\`.`);
+      }
+    } else if (asked) {
+      lines.push(`    The app no longer knows this device (removed, expired or logged out). Run \`${getCliName()} network connect\`.`);
     }
+    if (provider)
+      lines.push(`    Reachable: the sandboxes on ${provider.name}.`);
+    return lines;
+  }, deps.log);
+  return 0;
+}
+function unreachableNote(sandbox, connected) {
+  if (!sandbox.provider.privateNetwork) {
+    return `not reachable: ${sandbox.provider.name} has no private network yet`;
+  }
+  if (connected?.id === sandbox.provider.id)
+    return null;
+  return `not reachable: on ${sandbox.provider.name} → ${connectCommandFor(sandbox.provider)}`;
+}
+async function runNetworkLs(args, deps = defaultDeps()) {
+  try {
+    const organization = await requireOrganizationRef(args.org, deps.notice);
+    const connection = await readConnection(deps);
+    const deviceId = connection.device?.id;
+    const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes${deviceId ? `?device=${encodeURIComponent(deviceId)}` : ""}`);
+    const connected = connection.provider;
+    const sandboxes = listed.sandboxes.map((sandbox) => ({
+      ...sandbox,
+      reachable: unreachableNote(sandbox, connected) === null
+    }));
+    printResult({ ...listed, connectedProvider: connected, sandboxes }, () => {
+      if (listed.sandboxes.length === 0) {
+        return [eventLine("item", `No sandboxes in ${listed.organization.slug}.`)];
+      }
+      const width = Math.max(...listed.sandboxes.map((s) => s.name.length));
+      const canonicalWidth = Math.max(...listed.sandboxes.map((s) => s.canonicalName.length));
+      const httpsWidth = Math.max(...listed.sandboxes.map((s) => (s.httpsName?.length ?? 0) + 8));
+      const shortWidth = Math.max(...listed.sandboxes.map((s) => (s.shortName?.length ?? 0) + 8));
+      const lines = [
+        connected ? eventLine("item", `Connected through ${connected.name}.`) : eventLine("item", `Not connected: nothing is reachable. Run \`${getCliName()} network connect [provider]\`.`)
+      ];
+      for (const s of listed.sandboxes) {
+        const note = unreachableNote(s, connected);
+        lines.push([
+          `  ${s.name.padEnd(width)}`,
+          (s.address ?? "-").padEnd(28),
+          s.canonicalName.padEnd(canonicalWidth),
+          ...s.httpsName ? [`https://${s.httpsName}`.padEnd(httpsWidth)] : [],
+          ...s.shortName ? [`https://${s.shortName}`.padEnd(shortWidth)] : [],
+          s.status,
+          ...note ? [`(${note})`] : []
+        ].join("  "));
+      }
+      return lines;
+    }, deps.log);
     return 0;
   } catch (err) {
-    return reportError(err, error);
+    deps.error(message2(err));
+    return 1;
   }
 }
-async function runEnvDelete(args, log = console.log, error = printError) {
+async function runNetworkDevices(deps = defaultDeps()) {
   try {
-    await invokeTool("env_delete", {
-      organization: args.organization,
-      name: args.name
+    const { devices } = await deps.request("/api/v1/network/devices");
+    const own = (await readDeviceState(deps.dir))?.deviceId;
+    printResult({ devices }, () => devices.length === 0 ? [eventLine("item", "No devices.")] : devices.map((d) => `  ${d.id === own ? "*" : " "} ${d.id}  ${d.name}  ${d.address}  until ${d.expiresAt.slice(0, 10)}  ${deviceStateText(d.state)}`), deps.log);
+    return 0;
+  } catch (err) {
+    deps.error(message2(err));
+    return 1;
+  }
+}
+async function runNetworkDevicesRemove(args, deps = defaultDeps()) {
+  try {
+    await deps.request(`/api/v1/network/devices/${encodeURIComponent(args.id)}`, {
+      method: "DELETE"
     });
-    log(eventLine("done", `Deleted ${args.name}.`));
+    printResult({ removed: args.id }, () => [eventLine("done", `Removed device ${args.id}.`)], deps.log);
     return 0;
   } catch (err) {
-    return reportError(err, error);
+    deps.error(message2(err));
+    return 1;
   }
 }
-var nameArg = {
-  type: "positional",
-  description: "Environment variable name.",
-  required: true
-};
-var envCommand = defineCommand({
+var connectCommand = defineCommand({
   meta: {
-    name: "env",
-    description: "Manage organization environment variables and secrets."
+    name: "connect",
+    description: "Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Also re-arms a paused device: with the tunnel up and nothing changed, without sudo."
   },
-  subCommands: {
-    list: defineCommand({
-      meta: { name: "list", description: "List variables and secrets." },
-      args: {
-        org: orgArg
-      },
-      async run({ args }) {
-        process.exitCode = await withOrganization(args.org, (organization) => runEnvList({
-          organization,
-          json: isJsonOutput()
-        }));
-      }
-    }),
-    get: defineCommand({
-      meta: {
-        name: "get",
-        description: "Print one variable value in full (secrets cannot be read)."
-      },
-      args: {
-        name: nameArg,
-        org: orgArg
-      },
-      async run({ args }) {
-        process.exitCode = await withOrganization(args.org, (organization) => runEnvGet({
-          organization,
-          name: args.name,
-          json: isJsonOutput()
-        }));
-      }
-    }),
-    set: defineCommand({
-      meta: { name: "set", description: "Create or replace a variable or secret." },
-      args: {
-        name: nameArg,
-        org: orgArg,
-        value: { type: "string", description: "Value to store." },
-        "value-stdin": {
-          type: "boolean",
-          description: "Read the value from stdin — keeps secrets out of shell history.",
-          default: false
-        },
-        secret: {
-          type: "boolean",
-          description: "Shorthand for --kind secret. Required when creating a secret.",
-          default: false
-        },
-        kind: {
-          type: "string",
-          description: "variable or secret. Required when creating; on an update, omit to keep the existing kind or pass the other to convert."
-        },
-        comment: { type: "string", description: "Note about what this value is for." }
-      },
-      async run({ args }) {
-        process.exitCode = await withOrganization(args.org, (organization) => runEnvSet({
-          organization,
-          name: args.name,
-          value: args.value,
-          valueStdin: args["value-stdin"],
-          secret: args.secret,
-          kind: args.kind,
-          comment: args.comment,
-          json: isJsonOutput()
-        }));
-      }
-    }),
-    delete: defineCommand({
-      meta: { name: "delete", description: "Delete a variable or secret." },
-      args: {
-        name: nameArg,
-        org: orgArg
-      },
-      async run({ args }) {
-        process.exitCode = await withOrganization(args.org, (organization) => runEnvDelete({
-          organization,
-          name: args.name
-        }));
-      }
-    })
-  }
-});
-
-// src/container-picker.ts
-import { createInterface } from "node:readline/promises";
-function notRunningContainerOf(error) {
-  if (!(error instanceof ApiError) || !error.data || typeof error.data !== "object")
-    return null;
-  const { code, params } = error.data;
-  if (code !== "container_not_running")
-    return null;
-  const container = params && typeof params === "object" ? params : {};
-  return typeof container.container === "string" && container.container ? container.container : null;
-}
-function containerQuestionOf(error) {
-  if (!(error instanceof ApiError) || !error.data || typeof error.data !== "object")
-    return null;
-  const { code, params } = error.data;
-  if (code !== "container_choice_required" && code !== "container_default_missing")
-    return null;
-  const record = params && typeof params === "object" ? params : {};
-  const running = typeof record.containers === "string" ? record.containers.split(",").map((name) => name.trim()).filter(Boolean) : [];
-  if (running.length === 0)
-    return null;
-  return {
-    running,
-    ...code === "container_default_missing" && typeof record.container === "string" ? { missingDefault: record.container } : {}
-  };
-}
-var say = (line) => process.stderr.write(`${line}
-`);
-var chooseContainerOnTerminal = async ({ running, missingDefault }) => {
-  if (missingDefault) {
-    say(`
-The default container ${missingDefault} is gone.`);
-  }
-  say(missingDefault ? "Which container?" : `
-Several containers are running. Which one?`);
-  running.forEach((name, index) => {
-    say(`  ${index + 1}. ${name}`);
-  });
-  const prompt = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = (await prompt.question("Number (Enter to cancel): ")).trim();
-    const index = Number.parseInt(answer, 10) - 1;
-    return Number.isInteger(index) && index >= 0 && index < running.length ? running[index] ?? null : null;
-  } finally {
-    prompt.close();
-  }
-};
-var confirmDefaultOnTerminal = async (container) => {
-  const prompt = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = (await prompt.question(`Make ${container} the default? [y/N] `)).trim();
-    return /^y(es)?$/i.test(answer);
-  } finally {
-    prompt.close();
-  }
-};
-var confirmStartOnTerminal = async (container) => {
-  const prompt = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = (await prompt.question(`Container ${container} is not running. Start it? [Y/n] `)).trim();
-    return answer === "" || /^y(es)?$/i.test(answer);
-  } finally {
-    prompt.close();
-  }
-};
-function defaultContainerPickers() {
-  return process.stdin.isTTY && process.stderr.isTTY ? {
-    choose: chooseContainerOnTerminal,
-    confirmDefault: confirmDefaultOnTerminal,
-    confirmStart: confirmStartOnTerminal
-  } : undefined;
-}
-
-// src/progress.ts
-var PROGRESS_FRAMES = ["▂▄▆", "▄▆█", "▆█▆", "█▆▄", "▆▄▂", "▄▂▄"];
-var FRAME_MS = 120;
-function formatElapsed(ms) {
-  return ms < 1000 ? `${Math.round(ms)}ms` : `${(ms / 1000).toFixed(1)}s`;
-}
-function startProgress(message, options = {}) {
-  const stream = options.stream ?? process.stderr;
-  const now = options.now ?? Date.now;
-  const started = now();
-  const elapsed = () => formatElapsed(now() - started);
-  if (isJsonOutput())
-    return { stop: elapsed };
-  const animate = options.animate ?? stream.isTTY === true;
-  if (!animate) {
-    stream.write(`  ${SYMBOLS.progress} ${message}
-`);
-    return { stop: elapsed };
-  }
-  const color = colorEnabled(stream);
-  let frame = 0;
-  const draw = () => {
-    const bars = accent(PROGRESS_FRAMES[frame % PROGRESS_FRAMES.length] ?? SYMBOLS.progress, color);
-    stream.write(`\r\x1B[2K  ${bars} ${message} ${dim(elapsed(), color)}`);
-    frame += 1;
-  };
-  const restore = () => stream.write("\r\x1B[2K\x1B[?25h");
-  const onInterrupt = () => {
-    restore();
-    process.exit(130);
-  };
-  stream.write("\x1B[?25l");
-  draw();
-  const timer = setInterval(draw, FRAME_MS);
-  timer.unref?.();
-  process.once("SIGINT", onInterrupt);
-  let stopped = false;
-  return {
-    stop() {
-      if (!stopped) {
-        stopped = true;
-        clearInterval(timer);
-        process.off("SIGINT", onInterrupt);
-        restore();
-      }
-      return elapsed();
-    }
-  };
-}
-async function withProgress(message, work, options) {
-  const progress = startProgress(message, options);
-  try {
-    const value = await work();
-    return { value, elapsed: progress.stop() };
-  } catch (err) {
-    progress.stop();
-    throw err;
-  }
-}
-
-// src/container-flow.ts
-async function withContainerPick(call, send, pickers, notice) {
-  try {
-    return await send();
-  } catch (err) {
-    const question = containerQuestionOf(err);
-    if (!pickers || !question || !call.canPick)
-      throw err;
-    const container = await pickers.choose(question);
-    if (!container)
-      throw err;
-    call.setContainer(container);
-    const result = await send();
-    if (call.sandboxId !== undefined && await pickers.confirmDefault(container)) {
-      try {
-        await authorizedRequest("/api/v1/tools/sandboxes_default_container", {
-          method: "POST",
-          body: JSON.stringify({
-            organization: call.organization,
-            sandboxId: call.sandboxId,
-            container
-          })
-        });
-        notice(eventLine("done", `Default container: ${container}.`));
-      } catch (err) {
-        notice(eventLine("failed", `The default container was not set: ${err instanceof Error ? err.message : String(err)}`));
-      }
-    }
-    return result;
-  }
-}
-async function withContainerStart(call, send, start, pickers, notice) {
-  try {
-    return await send();
-  } catch (err) {
-    const container = notRunningContainerOf(err);
-    if (!container || call.sandboxId === undefined)
-      throw err;
-    if (!start && !(pickers && await pickers.confirmStart(container)))
-      throw err;
-    await withProgress("Starting container…", () => authorizedRequest("/api/v1/tools/sandboxes_containers_start", {
-      method: "POST",
-      body: JSON.stringify({
-        organization: call.organization,
-        sandboxId: call.sandboxId,
-        container
-      })
-    }));
-    notice(eventLine("done", `Started ${container}.`));
-    return await send();
-  }
-}
-
-// src/container-logs.ts
-var FOLLOW_INTERVAL_MS = 2000;
-function defaultLogsDeps(follow) {
-  let stop = false;
-  if (follow) {
-    process.once("SIGINT", () => {
-      stop = true;
-    });
-  }
-  return {
-    request: (input) => authorizedRequest("/api/v1/tools/sandboxes_containers_logs", {
-      method: "POST",
-      body: JSON.stringify(input)
-    }),
-    out: (line) => process.stdout.write(`${line}
-`),
-    err: (line) => process.stderr.write(`${line}
-`),
-    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-    stopped: () => stop
-  };
-}
-async function runContainerLogs(input, options, deps = defaultLogsDeps(options.follow)) {
-  const json = isJsonOutput();
-  const color = colorEnabled(process.stdout);
-  const print = (line) => {
-    if (json) {
-      deps.out(JSON.stringify(line));
-      return;
-    }
-    const text = options.timestamps && line.time ? `${dim(line.time, color)} ${line.text}` : line.text;
-    (line.stream === "stderr" ? deps.err : deps.out)(text);
-  };
-  let result = await deps.request(input);
-  if (!result.running) {
-    deps.err("The sandbox is stopped: it has no logs to show.");
-    return 1;
-  }
-  let last = null;
-  for (;; ) {
-    for (const line of result.lines) {
-      print(line);
-      if (line.time)
-        last = line.time;
-    }
-    if (!options.follow) {
-      if (result.truncated && json) {
-        deps.out(JSON.stringify({ truncated: true }));
-      } else if (result.truncated) {
-        deps.err(dim("(older lines left out: use --tail for more)", colorEnabled(process.stderr)));
-      }
-      return 0;
-    }
-    if (!result.truncated)
-      await deps.sleep(FOLLOW_INTERVAL_MS);
-    if (deps.stopped())
-      return 0;
-    const { tail: _tail, ...rest } = input;
-    try {
-      result = await deps.request(last ? { ...rest, after: last } : input);
-    } catch (error) {
-      deps.err(red(error instanceof Error ? error.message : String(error), colorEnabled(process.stderr)));
-      return 1;
-    }
-    if (!result.running) {
-      deps.err("The sandbox stopped.");
-      return 0;
-    }
-  }
-}
-
-// src/human.ts
-var ID_KEYS = [
-  "sandboxId",
-  "siteId",
-  "projectId",
-  "deploymentId",
-  "imageId",
-  "snapshotId",
-  "urlId",
-  "mcpId",
-  "commandId",
-  "sessionId",
-  "sandboxProviderId",
-  "id"
-];
-var LABEL_KEYS = ["displayName", "name", "title", "slug", "label", "path", "uri", "ref"];
-var STATUS_KEYS = ["status", "outcome", "state"];
-var URL_KEYS = ["url", "liveUrl", "publicUrl", "sshCommand"];
-function isItem(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function isScalar(value) {
-  return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
-}
-function firstKey(item, keys) {
-  return keys.find((key) => {
-    const value = item[key];
-    return typeof value === "string" && value.trim() !== "";
-  });
-}
-function firstString(item, keys) {
-  const key = firstKey(item, keys);
-  return key ? item[key] : undefined;
-}
-function symbolForStatus(status) {
-  const s = (status ?? "").toLowerCase();
-  if (/(fail|error|denied)/.test(s))
-    return "failed";
-  if (/^(running|active|ready|deployed|published|online|verified|ok)$/.test(s))
-    return "ready";
-  if (/^(stopped|deleted|unpublished|vanished|archived|revoked|closed|killed|exited|dead|paused)$/.test(s)) {
-    return "stopped";
-  }
-  if (/(pending|starting|spawning|stopping|building|progress|awaiting|queued|creating|restarting|removing)/.test(s)) {
-    return "progress";
-  }
-  return "item";
-}
-function isSandbox(item) {
-  return typeof item.sandboxId === "string" && typeof item.name === "string" && !("id" in item);
-}
-function lineKeys(item) {
-  if (isSandbox(item)) {
-    return { id: "name", label: firstKey(item, ["displayName"]) };
-  }
-  const idKeys = "id" in item ? ID_KEYS.filter((key) => key !== "sandboxId") : ID_KEYS;
-  return { id: firstKey(item, idKeys), label: firstKey(item, LABEL_KEYS) };
-}
-function shortId(id) {
-  return /^[0-9a-f]{64}$/.test(id) ? id.slice(0, 12) : id;
-}
-function itemLine(item, color) {
-  const keys = lineKeys(item);
-  const id = keys.id ? item[keys.id] : undefined;
-  const label = keys.label ? item[keys.label] : undefined;
-  const status = firstString(item, STATUS_KEYS);
-  const url = firstString(item, URL_KEYS);
-  const parts = [label ?? id ?? "(unnamed)"];
-  if (label && id && id !== label)
-    parts.push(dim(shortId(id), color));
-  if (status)
-    parts.push(status);
-  if (url)
-    parts.push(`${SYMBOLS.url} ${url}`);
-  return eventLine(symbolForStatus(status), parts.join("  "), color);
-}
-function scalarText(value) {
-  if (value === null)
-    return "—";
-  if (isScalar(value))
-    return String(value);
-  if (Array.isArray(value) && value.every(isScalar))
-    return value.join(", ");
-  if (Array.isArray(value))
-    return `${value.length} item${value.length === 1 ? "" : "s"}`;
-  return "…";
-}
-function fieldLines(item, color, skip) {
-  const lines = [];
-  for (const [key, value] of Object.entries(item)) {
-    if (skip.has(key) || value === undefined)
-      continue;
-    if (Array.isArray(value) && value.some(isItem)) {
-      lines.push(`    ${dim(`${key}:`, color)}`);
-      for (const entry of value) {
-        lines.push(`  ${isItem(entry) ? itemLine(entry, color) : eventLine("item", scalarText(entry), color)}`);
-      }
-      continue;
-    }
-    if (isItem(value)) {
-      for (const [sub, subValue] of Object.entries(value)) {
-        if (subValue === undefined || isItem(subValue))
-          continue;
-        lines.push(`    ${dim(`${key}.${sub}:`, color)} ${scalarText(subValue)}`);
-      }
-      continue;
-    }
-    lines.push(`    ${dim(`${key}:`, color)} ${scalarText(value)}`);
+  args: {
+    provider: {
+      type: "positional",
+      required: false,
+      description: "Sandbox provider name or id. Omit for the organization's default provider (else the platform default). Only its sandboxes are reachable; connecting through another replaces the connection."
+    },
+    org: orgArg
+  },
+  async run({ args }) {
+    process.exitCode = await runNetworkConnect({ provider: args.provider, org: args.org });
   }
-  return lines;
-}
-function listLines(items, color) {
-  if (items.length === 0)
-    return [`  ${dim("(none)", color)}`];
-  return items.map((item) => isItem(item) ? itemLine(item, color) : eventLine("item", scalarText(item), color));
-}
-function bootPhase(value) {
-  return isItem(value) && typeof value.ms === "number" && Number.isFinite(value.ms) ? { ms: value.ms } : null;
-}
-function bootLines(data, color) {
-  if (!isItem(data) || !isItem(data.boot))
-    return [];
-  const sandbox = bootPhase(data.boot.sandbox);
-  if (!sandbox)
-    return [];
-  const lines = [eventLine("ready", `sandbox started in ${formatElapsed(sandbox.ms)}`, color)];
-  const container = bootPhase(data.boot.container);
-  if (container) {
-    lines.push(eventLine("done", `container started in ${formatElapsed(container.ms)}`, color));
+});
+var disconnectCommand = defineCommand({
+  meta: {
+    name: "disconnect",
+    description: "Take this machine out of the private network, and remove split DNS an earlier connection left (macOS)."
+  },
+  async run() {
+    process.exitCode = await runNetworkDisconnect();
   }
-  return lines;
-}
-function renderResult(data, color) {
-  if (data === null || data === undefined)
-    return [eventLine("done", "Done.", color)];
-  if (Array.isArray(data))
-    return listLines(data, color);
-  if (!isItem(data))
-    return [eventLine("item", scalarText(data), color)];
-  const entries = Object.entries(data).filter(([, value]) => value !== undefined);
-  if (entries.length === 0 || entries.length === 1 && data.ok === true) {
-    return [eventLine("done", "Done.", color)];
+});
+var statusCommand = defineCommand({
+  meta: {
+    name: "status",
+    description: "Whether this machine is connected, through which provider, and as which device."
+  },
+  async run() {
+    process.exitCode = await runNetworkStatus();
   }
-  const lists = entries.filter(([, value]) => Array.isArray(value) && (value.length === 0 || value.some(isItem)));
-  if (lists.length === 1 && !firstString(data, ID_KEYS)) {
-    const [listKey, list] = lists[0];
-    const rest = fieldLines(data, color, new Set([listKey]));
-    return [...rest, ...listLines(list, color)];
+});
+var lsCommand = defineCommand({
+  meta: {
+    name: "ls",
+    description: "Sandboxes of an organization with their private addresses and names, and which are reachable through the current connection."
+  },
+  args: { org: orgArg },
+  async run({ args }) {
+    process.exitCode = await runNetworkLs({ org: args.org });
   }
-  const { id: idKey, label: labelKey } = lineKeys(data);
-  const used = [idKey, labelKey, firstKey(data, STATUS_KEYS), firstKey(data, URL_KEYS)].filter((key) => key !== undefined);
-  const head = used.length > 0 ? [itemLine(data, color)] : [];
-  const boot = bootLines(data, color);
-  if ("boot" in data && (boot.length > 0 || data.boot === null))
-    used.push("boot");
-  return [...head, ...boot, ...fieldLines(data, color, new Set(used))];
-}
-
-// src/cli-help-text.ts
-var CLI_HELP_DESCRIPTION_MAX_LENGTH = 80;
-function cliHelpDescription(description, maxLength = CLI_HELP_DESCRIPTION_MAX_LENGTH) {
-  const oneLine = description.replace(/\s+/g, " ").trim();
-  if (oneLine.length <= maxLength) {
-    return oneLine;
+});
+var devicesRemoveCommand = defineCommand({
+  meta: { name: "remove", description: "Remove one of your devices from the private network." },
+  args: {
+    id: { type: "positional", description: "Device id, from `network devices`.", required: true }
+  },
+  async run({ args }) {
+    process.exitCode = await runNetworkDevicesRemove({ id: args.id });
   }
-  const budget = Math.max(1, maxLength - 1);
-  const slice = oneLine.slice(0, budget);
-  const breakAt = slice.lastIndexOf(" ");
-  const cut = breakAt >= Math.floor(budget * 0.6) ? slice.slice(0, breakAt) : slice;
-  return `${cut.trimEnd()}…`;
-}
+});
+var devicesCommand = defineCommand({
+  meta: { name: "devices", description: "Your devices in the private network." },
+  subCommands: { remove: devicesRemoveCommand },
+  async run({ rawArgs }) {
+    if (rawArgs[0] === "remove")
+      return;
+    process.exitCode = await runNetworkDevices();
+  }
+});
+var networkCommand = defineCommand({
+  meta: {
+    name: "network",
+    description: "The private network: reach your sandboxes by address and name from this machine."
+  },
+  subCommands: {
+    connect: connectCommand,
+    disconnect: disconnectCommand,
+    status: statusCommand,
+    ls: lsCommand,
+    devices: devicesCommand
+  }
+});
 
-// src/schema-flags.ts
-function toFlagName(propertyName) {
-  if (propertyName === "organization")
-    return "org";
-  return propertyName.replace(/([KMGTP])iB(?![a-z])/g, "$1ib").replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[_\s]+/g, "-").toLowerCase();
-}
-function isJsonSchemaProperty(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+// src/commands/docker.ts
+function defaultDeps2() {
+  const dir = networkDir();
+  return {
+    request: authorizedRequest,
+    run: (command, args) => new Promise((resolve, reject) => {
+      const child = spawn2(command, args, { stdio: "inherit" });
+      child.on("error", reject);
+      child.on("close", (code) => resolve(code ?? 1));
+    }),
+    output: (command, args) => {
+      const result = spawnSync3(command, args, { encoding: "utf8" });
+      return result.status === 0 ? result.stdout : "";
+    },
+    platform: process.platform,
+    has: (command) => spawnSync3("sh", ["-c", `command -v ${command}`]).status === 0,
+    dir,
+    up: () => tunnelUp(),
+    log: console.log,
+    error: printError,
+    notice: printNotice,
+    exec: execDocker,
+    dockerDir: dockerDirFor(dir),
+    now: () => new Date,
+    env: process.env
+  };
 }
-function schemaVariants(prop) {
-  const variants = [];
-  for (const key of ["anyOf", "oneOf", "allOf"]) {
-    const group = prop[key];
-    if (!Array.isArray(group))
-      continue;
-    for (const item of group) {
-      if (isJsonSchemaProperty(item))
-        variants.push(item);
-    }
-  }
-  return variants;
+function message3(err) {
+  return err instanceof Error ? err.message : String(err);
 }
-function primaryJsonType(prop) {
-  if (prop.type !== undefined) {
-    if (Array.isArray(prop.type)) {
-      return prop.type.find((t) => t !== "null");
-    }
-    return prop.type === "null" ? undefined : prop.type;
+var DNS_LABEL2 = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function noDockerHostReason(sandbox, orgSlug) {
+  if (!sandbox.provider.privateNetwork) {
+    return `${sandbox.name} runs on ${sandbox.provider.name}, which has no private network yet: no Docker context reaches it.`;
   }
-  const types = new Set;
-  for (const variant of schemaVariants(prop)) {
-    const type = primaryJsonType(variant);
-    if (type)
-      types.add(type);
+  if (!sandbox.address) {
+    return `${sandbox.name} has no address in the private network yet (${sandbox.provider.name} has no host on it).`;
   }
-  if (types.has("object"))
-    return "object";
-  if (types.has("array"))
-    return "array";
-  if (types.size === 1) {
-    const [only] = types;
-    return only;
+  const notLabel = [sandbox.name, orgSlug].find((name) => !DNS_LABEL2.test(name));
+  if (notLabel) {
+    return `${sandbox.name} has no Docker engine over the network: "${notLabel}" is not a DNS label (lower-case letters, digits and hyphens), so its Docker engine stays closed.`;
   }
-  return;
-}
-function allowsNull(prop) {
-  if (prop.type === "null")
-    return true;
-  if (Array.isArray(prop.type) && prop.type.includes("null"))
-    return true;
-  return schemaVariants(prop).some(allowsNull);
+  return `${sandbox.name} has no Docker engine over the network.`;
 }
-function buildToolArgs(schema, describe = cliHelpDescription, positionals = []) {
-  const properties = schema.properties ?? {};
-  const required = new Set(schema.required ?? []);
-  const args = {};
-  for (const name of positionals) {
-    const prop = properties[name];
-    if (!prop)
-      continue;
-    const jsonType = primaryJsonType(prop);
-    args[toFlagName(name)] = {
-      type: "positional",
-      description: describe(prop.description ?? name),
-      required: true,
-      valueHint: jsonType
-    };
+function sandboxWarnings(sandbox, gateway, up) {
+  const warnings = [];
+  if (gateway?.id !== sandbox.provider.id) {
+    warnings.push(`${sandbox.name} runs on ${sandbox.provider.name}, and this machine connects through ${gateway?.name ?? "no provider"}: Docker reaches it only after \`${connectCommandFor(sandbox.provider)}\`.`);
+  } else if (!up) {
+    warnings.push(`This machine is not connected to the private network: run \`${connectCommandFor(sandbox.provider)}\` before using the context.`);
   }
-  for (const [name, prop] of Object.entries(properties)) {
-    if (positionals.includes(name))
-      continue;
-    const jsonType = primaryJsonType(prop);
-    const isBoolean = jsonType === "boolean";
-    const isJsonValue = jsonType === "object" || jsonType === "array";
-    const typeNote = isJsonValue ? ` (JSON ${jsonType})` : "";
-    const isOrganization = name === "organization";
-    const isRequired = required.has(name) && prop.default === undefined && !isOrganization;
-    const defaultNote = isOrganization ? " Defaults to GHOSTDOCK_ORG, then `organizations use`." : "";
-    args[toFlagName(name)] = isBoolean ? {
-      type: "boolean",
-      description: describe(`${prop.description ?? name}${typeNote}${defaultNote}`),
-      required: isRequired
-    } : {
-      type: "string",
-      description: describe(`${prop.description ?? name}${typeNote}${defaultNote}`),
-      required: isRequired,
-      valueHint: jsonType
-    };
+  if (sandbox.dockerDoor === "none") {
+    warnings.push(`${sandbox.name}: this sandbox's base image is too old for Docker over the network; restart it to update.`);
   }
-  return args;
+  return warnings;
 }
-function coerceFlagValue(raw, prop, flagName) {
-  if (raw === "null" && allowsNull(prop))
-    return null;
-  const jsonType = primaryJsonType(prop);
-  if (jsonType === "boolean") {
-    return typeof raw === "boolean" ? raw : raw === "true";
+var NO_DEVICE = () => `Run ${getCliName()} network connect first: the Docker context uses this machine's device.`;
+async function runDockerContext(args, deps = defaultDeps2()) {
+  const state = await readDeviceStateFor(deps);
+  if (!state) {
+    deps.error(NO_DEVICE());
+    return 1;
   }
-  if (jsonType === "number" || jsonType === "integer") {
-    const num = Number(raw);
-    if (Number.isNaN(num)) {
-      throw new Error(`Invalid number for --${flagName}: ${String(raw)}`);
+  if (!deps.has("docker")) {
+    deps.error("docker is not installed: the context is for Docker's CLI. Install Docker (Docker Desktop, OrbStack, or the docker CLI alone), then run this again.");
+    return 1;
+  }
+  const use = args.use !== false;
+  try {
+    const organization = await requireOrganizationRef(args.org, deps.notice);
+    const connection = await readConnection(deps);
+    if (connection.asked && !connection.device) {
+      deps.error(`The app no longer knows this machine's device (removed, expired or logged out). ${NO_DEVICE()}`);
+      return 1;
+    }
+    const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes?device=${encodeURIComponent(state.deviceId)}`);
+    const slug = listed.organization.slug;
+    const wanted = args.sandbox.trim().toLowerCase();
+    const sandbox = listed.sandboxes.find((s) => s.name.toLowerCase() === wanted);
+    if (!sandbox) {
+      deps.error(`No sandbox ${args.sandbox} in ${slug}. Run \`${getCliName()} network ls --org ${slug}\` for its sandboxes.`);
+      return 1;
+    }
+    if (!sandbox.dockerHost) {
+      deps.error(noDockerHostReason(sandbox, slug));
+      return 1;
     }
-    return num;
+    const gateway = connection.device?.gatewayProvider ?? connection.state?.gatewayProvider ?? null;
+    for (const warning of sandboxWarnings(sandbox, gateway, connection.up))
+      deps.notice(warning);
+    const organizationId = listed.organization.id;
+    if (!isOrganizationId(organizationId)) {
+      throw new Error(`The app sent an organization id that is not one: ${organizationId}`);
+    }
+    const files = organizationFiles(deps.dockerDir, organizationId);
+    const { certificate, issued } = await ensureCertificate({ files, organizationId, deviceId: state.deviceId, baseUrl: state.baseUrl, now: deps.now() }, deps.request);
+    const name = dockerContextName(slug, sandbox.name);
+    const { created } = writeContext(deps.exec, {
+      name,
+      description: contextDescription(sandbox.name, slug),
+      host: sandbox.dockerHost,
+      files
+    });
+    await recordContext(deps.dockerDir, { name, organizationId, sandbox: sandbox.name });
+    if (use) {
+      useContext(deps.exec, name);
+      for (const variable of ["DOCKER_HOST", "DOCKER_CONTEXT"]) {
+        if (deps.env[variable]) {
+          deps.notice(`${variable} is set in this shell and wins over \`docker context use\`: unset it, or pass \`docker --context ${name}\`.`);
+        }
+      }
+    }
+    printResult({
+      context: { name, host: sandbox.dockerHost, created, inUse: use },
+      sandbox: {
+        name: sandbox.name,
+        canonicalName: sandbox.canonicalName,
+        provider: sandbox.provider,
+        dockerDoor: sandbox.dockerDoor
+      },
+      organization: listed.organization,
+      certificate: {
+        serial: certificate.serial,
+        notAfter: certificate.notAfter.toISOString(),
+        issued,
+        files: { ca: files.ca, cert: files.cert, key: files.key }
+      }
+    }, () => [
+      eventLine("done", `Docker context ${name}${use ? " (in use)" : ""}`),
+      `    ${sandbox.dockerHost}`,
+      `    Certificate for this device, valid until ${day(certificate.notAfter)}.`,
+      `    → ${use ? "docker ps" : `docker --context ${name} ps`}`
+    ], deps.log);
+    await renewDockerCertificates(deps, { except: organizationId });
+    return 0;
+  } catch (err) {
+    deps.error(message3(err));
+    return 1;
   }
-  if (jsonType === "object" || jsonType === "array") {
-    if (typeof raw !== "string")
-      return raw;
-    try {
-      return JSON.parse(raw);
-    } catch {
-      throw new Error(`Invalid JSON for --${flagName}: ${String(raw)}`);
+}
+async function readDeviceStateFor(deps) {
+  const state = await readDeviceState(deps.dir);
+  return state && state.baseUrl === getBaseUrl() ? state : null;
+}
+var contextCommand = defineCommand({
+  meta: {
+    name: "context",
+    description: `Point Docker at a sandbox's Docker engine over the private network: plain \`docker\` and \`docker compose\` then run there. Creates (or updates) the Docker context ghostdock-<org>-<sandbox> for tcp://<sandbox>.<org>.ghostdock.internal:2376 with a client certificate of this machine's device, and makes it the current context. Needs \`${getCliName()} network connect\` first, and Docker's CLI. The certificate lives 30 days; \`network connect\` and this command renew it with 10 days left. An expired certificate fails Docker's TLS handshake with Docker's own error: run this command again. Docker's \`no such host\` on a ghostdock.internal address means this machine is not connected: run \`${getCliName()} network connect\`. After an organization rename the old name stops resolving: run it again to update the host.`
+  },
+  args: {
+    sandbox: {
+      type: "positional",
+      required: true,
+      description: "Sandbox name, from `network ls`."
+    },
+    org: orgArg,
+    use: {
+      type: "boolean",
+      default: true,
+      description: "Make it the current Docker context (`docker context use`). `--no-use` only creates or updates it.",
+      negativeDescription: "Only create or update the context; then pass `docker --context <name>`."
     }
+  },
+  async run({ args }) {
+    process.exitCode = await runDockerContext({
+      sandbox: args.sandbox,
+      org: args.org,
+      use: args.use
+    });
   }
-  return raw;
+});
+var dockerCommand = defineCommand({
+  meta: {
+    name: "docker",
+    description: "Docker over the private network: a sandbox's Docker engine from this machine."
+  },
+  subCommands: { context: contextCommand }
+});
+
+// src/commands/env.ts
+function reportError(err, error) {
+  if (err instanceof AuthRequiredError || err instanceof Error) {
+    error(err.message);
+  } else {
+    error(String(err));
+  }
+  return 1;
 }
-function buildToolInput(schema, rawArgs) {
-  const properties = schema.properties ?? {};
-  const input = {};
-  for (const [name, prop] of Object.entries(properties)) {
-    const flagName = toFlagName(name);
-    const raw = rawArgs[flagName] ?? rawArgs[name];
-    if (raw === undefined)
-      continue;
-    input[name] = coerceFlagValue(raw, prop, flagName);
+function invokeTool(tool, input) {
+  return authorizedRequest(`/api/v1/tools/${tool}`, {
+    method: "POST",
+    body: JSON.stringify(input)
+  });
+}
+function displayValue(entry) {
+  if (entry.valueOmittedReason === "secret")
+    return "<secret>";
+  if (entry.valueOmittedReason === "too_large") {
+    return `<${entry.valueLength} chars — read with \`${getCliName()} env get\`>`;
   }
-  return input;
+  return entry.value ?? "";
 }
-
-// src/commands/invoke.ts
-async function runToolInvoke(tool, rawArgs, log = console.log, error = printError, notice = printNotice, pickers = defaultContainerPickers()) {
-  const properties = tool.inputSchema.properties;
-  let input;
+function formatTable(entries) {
+  const rows = entries.map((entry) => [
+    entry.name,
+    entry.kind,
+    displayValue(entry),
+    entry.comment ?? ""
+  ]);
+  const header = ["NAME", "KIND", "VALUE", "COMMENT"];
+  const widths = header.map((_, column) => Math.max(header[column]?.length ?? 0, ...rows.map((row) => row[column]?.length ?? 0)));
+  const line = (cells) => cells.map((cell, column) => column === cells.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
+  return [line(header), ...rows.map(line)].join(`
+`);
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+async function runEnvList(args, log = console.log, error = printError) {
   try {
-    input = buildToolInput(tool.inputSchema, rawArgs);
-    if (properties && "organization" in properties && input.organization === undefined) {
-      input.organization = await requireOrganizationRef(undefined, notice);
+    const result = await invokeTool("env_list", {
+      organization: args.organization
+    });
+    if (args.json) {
+      log(JSON.stringify(result.entries, null, 2));
+      return 0;
     }
-  } catch (err) {
-    error(err instanceof Error ? err.message : String(err));
-    return 1;
-  }
-  if (tool.name === "sandboxes_containers_logs") {
-    try {
-      return await runContainerLogs(input, {
-        follow: rawArgs.follow === true,
-        timestamps: rawArgs.timestamps === true
-      });
-    } catch (err) {
-      error(err instanceof Error ? err.message : `${tool.name} failed.`);
-      return 1;
+    if (result.entries.length === 0) {
+      log("  No variables or secrets.");
+      return 0;
     }
+    log(formatTable(result.entries));
+    return 0;
+  } catch (err) {
+    return reportError(err, error);
   }
-  const call = {
-    organization: typeof input.organization === "string" ? input.organization : undefined,
-    sandboxId: typeof input.sandboxId === "string" ? input.sandboxId : undefined,
-    canPick: !!properties && "container" in properties && !input.container,
-    setContainer: (container) => {
-      input.container = container;
-    }
-  };
+}
+async function runEnvGet(args, log = console.log, error = printError) {
   try {
-    const post = () => authorizedRequest(`/api/v1/tools/${tool.name}`, {
-      method: "POST",
-      body: JSON.stringify(input)
+    const result = await invokeTool("env_get", {
+      organization: args.organization,
+      name: args.name
     });
-    const waitMessage = PROGRESS_MESSAGES[tool.name];
-    let elapsed;
-    const send = async () => {
-      if (!waitMessage)
-        return post();
-      const timed = await withProgress(waitMessage, post);
-      elapsed = timed.elapsed;
-      return timed.value;
-    };
-    const result = await withContainerPick(call, () => withContainerStart(call, send, rawArgs.start === true, pickers, notice), pickers, notice);
-    printResult(result, () => {
-      const color = colorEnabled(process.stdout);
-      const lines = renderResult(result, color);
-      return elapsed === undefined || bootLines(result, color).length > 0 ? lines : withElapsed(lines, elapsed);
-    }, log);
-    stopNote(result, notice);
+    log(args.json ? JSON.stringify(result.entry, null, 2) : result.entry.value ?? "");
     return 0;
   } catch (err) {
-    error(err instanceof Error ? err.message : `${tool.name} failed.`);
-    return 1;
+    return reportError(err, error);
   }
 }
-function stopNote(result, notice) {
-  if (!result || typeof result !== "object")
-    return;
-  const { action, note, container } = result;
-  if (action !== "stop" || typeof container !== "string")
-    return;
-  if (note === "default") {
-    notice(`${container} is the sandbox's default container: SSH, commands and files ask which container until it runs again.`);
-  } else if (note === "last_running") {
-    notice("No container is running now: SSH, commands and files have none to land in until one runs.");
-  } else if (note === "sandbox_stopped") {
-    notice(`The sandbox is stopped, so ${container} is too: nothing was done.`);
+function resolveKind(args) {
+  if (args.kind !== undefined && args.kind !== "variable" && args.kind !== "secret") {
+    return { error: `--kind must be "variable" or "secret", got "${args.kind}".` };
   }
-}
-var PROGRESS_MESSAGES = {
-  sandboxes_create: "Creating sandbox…",
-  sandboxes_wake: "Waking sandbox…",
-  sandboxes_stop: "Stopping sandbox…",
-  sandboxes_delete: "Deleting sandbox…",
-  sandboxes_resize: "Resizing sandbox…",
-  sandboxes_resize_disk: "Resizing disk…",
-  sandboxes_commands_run: "Running command…",
-  sandboxes_containers_start: "Starting container…",
-  sandboxes_containers_stop: "Stopping container…",
-  sandboxes_containers_restart: "Restarting container…",
-  snapshots_create: "Saving snapshot…",
-  projects_redeploy: "Redeploying…",
-  providers_verify_incus: "Checking the Incus host…"
-};
-function withElapsed(lines, elapsed) {
-  const color = colorEnabled(process.stdout);
-  const [first, ...rest] = lines;
-  if (first === undefined || first.startsWith("    ")) {
-    return [eventLine("done", `Done in ${elapsed}.`, color), ...lines];
+  const fromKind = args.kind;
+  if (args.secret && fromKind === "variable") {
+    return { error: "Pass either --secret or --kind variable, not both." };
   }
-  return [`${first}  ${dim(`in ${elapsed}`, color)}`, ...rest];
-}
-function cliText(catalog, skills = BUILTIN_SKILL_NAMES) {
-  const paths = new Map(catalog.filter((tool) => tool.cli).map((tool) => [tool.name, tool.cli]));
-  const names = [...paths.keys()].sort((a, b) => b.length - a.length);
-  const pattern = names.length > 0 ? new RegExp(`\\b(${names.join("|")})\\b`, "g") : null;
-  return (text) => {
-    const oneLine = text.replace(/\s+/g, " ").trim();
-    const commands = pattern ? oneLine.replace(pattern, (name) => paths.get(name)?.join(" ") ?? name) : oneLine;
-    return commands.replace(/\bthe ([a-z][a-z0-9-]*) skill\b/g, (phrase, skill) => skills.includes(skill) ? `the ${skill} skill (\`${getCliName()} skills get ${skill}\`)` : phrase);
-  };
+  return { kind: fromKind ?? (args.secret ? "secret" : undefined) };
 }
-function cliOnlyArgs(tool) {
-  const schema = tool.inputSchema;
-  const args = {};
-  if (schema.properties && "container" in schema.properties && !schema.required?.includes("container")) {
-    args.start = {
-      type: "boolean",
-      description: "Start the container first when it is not running, without asking."
-    };
+async function runEnvSet(args, log = console.log, error = printError, stdin = readStdin) {
+  if (args.value !== undefined && args.valueStdin) {
+    error("Pass either --value or --value-stdin, not both.");
+    return 1;
   }
-  if (tool.name === "sandboxes_containers_logs") {
-    args.follow = {
-      type: "boolean",
-      alias: "f",
-      description: "Keep printing new lines until Ctrl-C."
-    };
-    args.timestamps = { type: "boolean", description: "Put each line's time in front of it." };
+  if (args.value === undefined && !args.valueStdin) {
+    error("Provide --value, or --value-stdin to read the value from stdin.");
+    return 1;
+  }
+  const resolved = resolveKind(args);
+  if ("error" in resolved) {
+    error(resolved.error);
+    return 1;
+  }
+  const value = args.valueStdin ? await stdin() : args.value ?? "";
+  try {
+    const result = await invokeTool("env_set", {
+      organization: args.organization,
+      name: args.name,
+      value,
+      ...resolved.kind ? { kind: resolved.kind } : {},
+      ...args.comment ? { comment: args.comment } : {}
+    });
+    if (args.json) {
+      log(JSON.stringify(result, null, 2));
+      return 0;
+    }
+    log(eventLine("done", `${result.created ? "Created" : "Updated"} ${result.entry.kind} ${result.entry.name}.`));
+    if (result.previousKind === "secret") {
+      log(eventLine("item", `Warning: ${result.entry.name} was a secret and is now a variable — its value is readable by everyone in the organization.`));
+    } else if (result.previousKind === "variable") {
+      log(eventLine("item", `${result.entry.name} was a variable and is now a secret; its value is no longer shown.`));
+    }
+    return 0;
+  } catch (err) {
+    return reportError(err, error);
   }
-  return args;
 }
-var generatedToolCommands = new WeakSet;
-function createToolCommands(catalog) {
-  const commands = {};
-  const toCliText = cliText(catalog);
-  for (const tool of catalog) {
-    const command = defineCommand({
+async function runEnvDelete(args, log = console.log, error = printError) {
+  try {
+    await invokeTool("env_delete", {
+      organization: args.organization,
+      name: args.name
+    });
+    log(eventLine("done", `Deleted ${args.name}.`));
+    return 0;
+  } catch (err) {
+    return reportError(err, error);
+  }
+}
+var nameArg = {
+  type: "positional",
+  description: "Environment variable name.",
+  required: true
+};
+var envCommand = defineCommand({
+  meta: {
+    name: "env",
+    description: "Manage organization environment variables and secrets."
+  },
+  subCommands: {
+    list: defineCommand({
+      meta: { name: "list", description: "List variables and secrets." },
+      args: {
+        org: orgArg
+      },
+      async run({ args }) {
+        process.exitCode = await withOrganization(args.org, (organization) => runEnvList({
+          organization,
+          json: isJsonOutput()
+        }));
+      }
+    }),
+    get: defineCommand({
       meta: {
-        name: tool.cli?.at(-1) ?? tool.name,
-        description: toCliText(tool.description)
+        name: "get",
+        description: "Print one variable value in full (secrets cannot be read)."
+      },
+      args: {
+        name: nameArg,
+        org: orgArg
       },
-      args: { ...buildToolArgs(tool.inputSchema, toCliText, tool.cliArgs), ...cliOnlyArgs(tool) },
       async run({ args }) {
-        process.exitCode = await runToolInvoke(tool, args);
+        process.exitCode = await withOrganization(args.org, (organization) => runEnvGet({
+          organization,
+          name: args.name,
+          json: isJsonOutput()
+        }));
       }
-    });
-    generatedToolCommands.add(command);
-    commands[tool.name] = command;
+    }),
+    set: defineCommand({
+      meta: { name: "set", description: "Create or replace a variable or secret." },
+      args: {
+        name: nameArg,
+        org: orgArg,
+        value: { type: "string", description: "Value to store." },
+        "value-stdin": {
+          type: "boolean",
+          description: "Read the value from stdin — keeps secrets out of shell history.",
+          default: false
+        },
+        secret: {
+          type: "boolean",
+          description: "Shorthand for --kind secret. Required when creating a secret.",
+          default: false
+        },
+        kind: {
+          type: "string",
+          description: "variable or secret. Required when creating; on an update, omit to keep the existing kind or pass the other to convert."
+        },
+        comment: { type: "string", description: "Note about what this value is for." }
+      },
+      async run({ args }) {
+        process.exitCode = await withOrganization(args.org, (organization) => runEnvSet({
+          organization,
+          name: args.name,
+          value: args.value,
+          valueStdin: args["value-stdin"],
+          secret: args.secret,
+          kind: args.kind,
+          comment: args.comment,
+          json: isJsonOutput()
+        }));
+      }
+    }),
+    delete: defineCommand({
+      meta: { name: "delete", description: "Delete a variable or secret." },
+      args: {
+        name: nameArg,
+        org: orgArg
+      },
+      async run({ args }) {
+        process.exitCode = await withOrganization(args.org, (organization) => runEnvDelete({
+          organization,
+          name: args.name
+        }));
+      }
+    })
   }
-  return commands;
-}
-
-// src/commands/login.ts
-import { hostname } from "node:os";
+});
 
-// src/commands/login-organization.ts
-import { createInterface as createInterface2 } from "node:readline/promises";
-function label(organization) {
-  return `${organization.name} (${organization.slug ?? organization.id})`;
+// src/container-picker.ts
+import { createInterface } from "node:readline/promises";
+function notRunningContainerOf(error) {
+  if (!(error instanceof ApiError) || !error.data || typeof error.data !== "object")
+    return null;
+  const { code, params } = error.data;
+  if (code !== "container_not_running")
+    return null;
+  const container = params && typeof params === "object" ? params : {};
+  return typeof container.container === "string" && container.container ? container.container : null;
 }
-var chooseOrganizationOnTerminal = async (organizations) => {
-  console.log(`
-Which organization should commands use by default?`);
-  organizations.forEach((organization, index) => {
-    console.log(`  ${index + 1}. ${label(organization)}`);
+function containerQuestionOf(error) {
+  if (!(error instanceof ApiError) || !error.data || typeof error.data !== "object")
+    return null;
+  const { code, params } = error.data;
+  if (code !== "container_choice_required" && code !== "container_default_missing")
+    return null;
+  const record = params && typeof params === "object" ? params : {};
+  const running = typeof record.containers === "string" ? record.containers.split(",").map((name) => name.trim()).filter(Boolean) : [];
+  if (running.length === 0)
+    return null;
+  return {
+    running,
+    ...code === "container_default_missing" && typeof record.container === "string" ? { missingDefault: record.container } : {}
+  };
+}
+var say = (line) => process.stderr.write(`${line}
+`);
+var chooseContainerOnTerminal = async ({ running, missingDefault }) => {
+  if (missingDefault) {
+    say(`
+The default container ${missingDefault} is gone.`);
+  }
+  say(missingDefault ? "Which container?" : `
+Several containers are running. Which one?`);
+  running.forEach((name, index) => {
+    say(`  ${index + 1}. ${name}`);
   });
-  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = (await prompt.question(`Number (Enter to skip): `)).trim();
+    const answer = (await prompt.question("Number (Enter to cancel): ")).trim();
     const index = Number.parseInt(answer, 10) - 1;
-    return Number.isInteger(index) && index >= 0 && index < organizations.length ? index : null;
+    return Number.isInteger(index) && index >= 0 && index < running.length ? running[index] ?? null : null;
   } finally {
     prompt.close();
   }
 };
-function defaultChooser() {
-  return process.stdin.isTTY && process.stdout.isTTY ? chooseOrganizationOnTerminal : undefined;
-}
-async function chooseDefaultOrganizationAfterLogin(org, log, choose = defaultChooser()) {
-  const cli = getCliName();
-  let organizations;
+var confirmDefaultOnTerminal = async (container) => {
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    ({ organizations } = await authorizedRequest("/api/v1/tools/organizations_list", { method: "POST", body: "{}" }));
-  } catch {
-    organizations = undefined;
-  }
-  if (!Array.isArray(organizations)) {
-    log(eventLine("item", `Pick a default organization with \`${cli} organizations use <org>\`.`));
-    return org ? 1 : 0;
-  }
-  const settings = await readSettings();
-  const save = async (organization, why) => {
-    settings.defaultOrganization = { id: organization.id, slug: organization.slug };
-    await writeSettings(settings);
-    log(eventLine("done", `Default organization: ${label(organization)}${why}.`));
-  };
-  const ref = org?.trim();
-  if (ref) {
-    const match = organizations.find((organization) => organization.id === ref) ?? organizations.find((organization) => organization.slug === ref);
-    if (!match) {
-      log(eventLine("failed", `You are not a member of an organization "${ref}"; no default set.`));
-      return 1;
-    }
-    await save(match, "");
-    return 0;
-  }
-  const current = organizations.find((organization) => organization.id === settings.defaultOrganization?.id);
-  if (current) {
-    log(eventLine("item", `Default organization: ${label(current)} (unchanged).`));
-    return 0;
-  }
-  if (settings.defaultOrganization) {
-    delete settings.defaultOrganization;
-    await writeSettings(settings);
+    const answer = (await prompt.question(`Make ${container} the default? [y/N] `)).trim();
+    return /^y(es)?$/i.test(answer);
+  } finally {
+    prompt.close();
   }
-  const [only, ...others] = organizations;
-  if (!only) {
-    log(eventLine("item", "You do not belong to an organization yet."));
-    return 0;
+};
+var confirmStartOnTerminal = async (container) => {
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = (await prompt.question(`Container ${container} is not running. Start it? [Y/n] `)).trim();
+    return answer === "" || /^y(es)?$/i.test(answer);
+  } finally {
+    prompt.close();
   }
-  if (others.length === 0) {
-    await save(only, " (your only organization)");
-    return 0;
+};
+function defaultContainerPickers() {
+  return process.stdin.isTTY && process.stderr.isTTY ? {
+    choose: chooseContainerOnTerminal,
+    confirmDefault: confirmDefaultOnTerminal,
+    confirmStart: confirmStartOnTerminal
+  } : undefined;
+}
+
+// src/progress.ts
+var PROGRESS_FRAMES = ["▂▄▆", "▄▆█", "▆█▆", "█▆▄", "▆▄▂", "▄▂▄"];
+var FRAME_MS = 120;
+function formatElapsed(ms) {
+  return ms < 1000 ? `${Math.round(ms)}ms` : `${(ms / 1000).toFixed(1)}s`;
+}
+function startProgress(message, options = {}) {
+  const stream = options.stream ?? process.stderr;
+  const now = options.now ?? Date.now;
+  const started = now();
+  const elapsed = () => formatElapsed(now() - started);
+  if (isJsonOutput())
+    return { stop: elapsed };
+  const animate = options.animate ?? stream.isTTY === true;
+  if (!animate) {
+    stream.write(`  ${SYMBOLS.progress} ${message}
+`);
+    return { stop: elapsed };
   }
-  const index = choose ? await choose(organizations) : null;
-  const chosen = index === null ? undefined : organizations[index];
-  if (chosen) {
-    await save(chosen, "");
-    return 0;
+  const color = colorEnabled(stream);
+  let frame = 0;
+  const draw = () => {
+    const bars = accent(PROGRESS_FRAMES[frame % PROGRESS_FRAMES.length] ?? SYMBOLS.progress, color);
+    stream.write(`\r\x1B[2K  ${bars} ${message} ${dim(elapsed(), color)}`);
+    frame += 1;
+  };
+  const restore = () => stream.write("\r\x1B[2K\x1B[?25h");
+  const onInterrupt = () => {
+    restore();
+    process.exit(130);
+  };
+  stream.write("\x1B[?25l");
+  draw();
+  const timer = setInterval(draw, FRAME_MS);
+  timer.unref?.();
+  process.once("SIGINT", onInterrupt);
+  let stopped = false;
+  return {
+    stop() {
+      if (!stopped) {
+        stopped = true;
+        clearInterval(timer);
+        process.off("SIGINT", onInterrupt);
+        restore();
+      }
+      return elapsed();
+    }
+  };
+}
+async function withProgress(message, work, options) {
+  const progress = startProgress(message, options);
+  try {
+    const value = await work();
+    return { value, elapsed: progress.stop() };
+  } catch (err) {
+    progress.stop();
+    throw err;
   }
-  log(eventLine("item", `You belong to ${organizations.length} organizations: ${organizations.map((organization) => organization.slug ?? organization.id).join(", ")}. Pick a default with \`${cli} organizations use <org>\`, or pass --org.`));
-  return 0;
 }
 
-// src/commands/login.ts
-function defaultClientName() {
+// src/container-flow.ts
+async function withContainerPick(call, send, pickers, notice) {
   try {
-    const host = hostname().trim();
-    if (host)
-      return host.slice(0, 64);
-  } catch {}
-  return "ghostdock-cli";
+    return await send();
+  } catch (err) {
+    const question = containerQuestionOf(err);
+    if (!pickers || !question || !call.canPick)
+      throw err;
+    const container = await pickers.choose(question);
+    if (!container)
+      throw err;
+    call.setContainer(container);
+    const result = await send();
+    if (call.sandboxId !== undefined && await pickers.confirmDefault(container)) {
+      try {
+        await authorizedRequest("/api/v1/tools/sandboxes_default_container", {
+          method: "POST",
+          body: JSON.stringify({
+            organization: call.organization,
+            sandboxId: call.sandboxId,
+            container
+          })
+        });
+        notice(eventLine("done", `Default container: ${container}.`));
+      } catch (err) {
+        notice(eventLine("failed", `The default container was not set: ${err instanceof Error ? err.message : String(err)}`));
+      }
+    }
+    return result;
+  }
 }
-var DEFAULT_TIMEOUT_SECONDS = 300;
-function toCredentials(result) {
+async function withContainerStart(call, send, start, pickers, notice) {
+  try {
+    return await send();
+  } catch (err) {
+    const container = notRunningContainerOf(err);
+    if (!container || call.sandboxId === undefined)
+      throw err;
+    if (!start && !(pickers && await pickers.confirmStart(container)))
+      throw err;
+    await withProgress("Starting container…", () => authorizedRequest("/api/v1/tools/sandboxes_containers_start", {
+      method: "POST",
+      body: JSON.stringify({
+        organization: call.organization,
+        sandboxId: call.sandboxId,
+        container
+      })
+    }));
+    notice(eventLine("done", `Started ${container}.`));
+    return await send();
+  }
+}
+
+// src/container-logs.ts
+var FOLLOW_INTERVAL_MS = 2000;
+function defaultLogsDeps(follow) {
+  let stop = false;
+  if (follow) {
+    process.once("SIGINT", () => {
+      stop = true;
+    });
+  }
   return {
-    accessToken: result.accessToken,
-    refreshToken: result.refreshToken,
-    accessExpiresAt: new Date(Date.now() + result.expiresIn * 1000).toISOString()
+    request: (input) => authorizedRequest("/api/v1/tools/sandboxes_containers_logs", {
+      method: "POST",
+      body: JSON.stringify(input)
+    }),
+    out: (line) => process.stdout.write(`${line}
+`),
+    err: (line) => process.stderr.write(`${line}
+`),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    stopped: () => stop
   };
 }
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function runLogin(args, log = console.log, choose = defaultChooser(), error = printError) {
-  const loggedIn = async () => {
-    log(eventLine("ready", "Logged in."));
-    return chooseDefaultOrganizationAfterLogin(args.org, log, choose);
-  };
-  if (args.code) {
-    const result = await deviceToken({ pasteCode: args.code });
-    if (result.status === "approved") {
-      await writeCredentials(toCredentials(result));
-      return loggedIn();
+async function runContainerLogs(input, options, deps = defaultLogsDeps(options.follow)) {
+  const json = isJsonOutput();
+  const color = colorEnabled(process.stdout);
+  const print = (line) => {
+    if (json) {
+      deps.out(JSON.stringify(line));
+      return;
     }
-    error("That code has not been approved yet. Approve it in the browser, then run this again.");
+    const text = options.timestamps && line.time ? `${dim(line.time, color)} ${line.text}` : line.text;
+    (line.stream === "stderr" ? deps.err : deps.out)(text);
+  };
+  let result = await deps.request(input);
+  if (!result.running) {
+    deps.err("The sandbox is stopped: it has no logs to show.");
     return 1;
   }
-  const start = await deviceStart({ client_name: defaultClientName() });
-  log(eventLine("url", `Open this URL to sign in: ${start.verificationUrl}`));
-  log(`    Pass --wait to finish here once you approve, or approve on another device and run \`${getCliName()} login --code <paste-code>\` with the code shown there.`);
-  if (!args.wait) {
-    return 0;
-  }
-  const timeoutSeconds = Number.parseInt(args.timeout ?? "", 10) || DEFAULT_TIMEOUT_SECONDS;
-  const deadline = Date.now() + timeoutSeconds * 1000;
-  const intervalMs = start.interval * 1000;
-  const progress = startProgress("Waiting for approval in the browser…");
-  while (Date.now() < deadline) {
-    await sleep(intervalMs);
-    try {
-      const result = await deviceToken({ deviceCode: start.deviceCode });
-      if (result.status === "approved") {
-        progress.stop();
-        await writeCredentials(toCredentials(result));
-        return loggedIn();
-      }
-    } catch (err) {
-      progress.stop();
-      if (err instanceof ApiError && err.status === 400) {
-        error(`Login failed: ${err.message}`);
-        return 1;
-      }
-      throw err;
+  let last = null;
+  for (;; ) {
+    for (const line of result.lines) {
+      print(line);
+      if (line.time)
+        last = line.time;
     }
-  }
-  progress.stop();
-  error(`Timed out waiting for approval. Run \`${getCliName()} login\` again.`);
-  return 1;
-}
-var loginCommand = defineCommand({
-  meta: {
-    name: "login",
-    description: "Sign in and store a device access token for this machine (~/.config/ghostdock/credentials.json)."
-  },
-  args: {
-    wait: {
-      type: "boolean",
-      description: "Poll until the login is approved in the browser (default timeout 5 minutes).",
-      default: false
-    },
-    code: {
-      type: "string",
-      description: "Redeem the one-time paste code shown in the browser instead of polling."
-    },
-    timeout: {
-      type: "string",
-      description: "Max seconds to poll when using --wait (default 300)."
-    },
-    org: {
-      type: "string",
-      description: "Set this organization (id or slug) as the default once logged in."
+    if (!options.follow) {
+      if (result.truncated && json) {
+        deps.out(JSON.stringify({ truncated: true }));
+      } else if (result.truncated) {
+        deps.err(dim("(older lines left out: use --tail for more)", colorEnabled(process.stderr)));
+      }
+      return 0;
     }
-  },
-  async run({ args }) {
-    process.exitCode = await runLogin(args);
-  }
-});
-
-// src/commands/logout.ts
-async function runLogout(log = console.log) {
-  const credentials = await readCredentials();
-  if (credentials) {
+    if (!result.truncated)
+      await deps.sleep(FOLLOW_INTERVAL_MS);
+    if (deps.stopped())
+      return 0;
+    const { tail: _tail, ...rest } = input;
     try {
-      await deviceRevoke({
-        accessToken: credentials.accessToken,
-        refreshToken: credentials.refreshToken
-      });
-    } catch {}
-  }
-  await clearCredentials();
-  log(eventLine("stopped", "Logged out."));
-  return 0;
-}
-var logoutCommand = defineCommand({
-  meta: {
-    name: "logout",
-    description: "Revoke the device session and remove stored credentials."
-  },
-  async run() {
-    process.exitCode = await runLogout();
+      result = await deps.request(last ? { ...rest, after: last } : input);
+    } catch (error) {
+      deps.err(red(error instanceof Error ? error.message : String(error), colorEnabled(process.stderr)));
+      return 1;
+    }
+    if (!result.running) {
+      deps.err("The sandbox stopped.");
+      return 0;
+    }
   }
-});
-
-// src/commands/network.ts
-import { spawn, spawnSync } from "node:child_process";
-import { hostname as hostname2 } from "node:os";
+}
 
-// src/network/tunnel.ts
-import { createPrivateKey, createPublicKey, generateKeyPairSync } from "node:crypto";
-import { existsSync } from "node:fs";
-import { chmod as chmod2, mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname3, join as join3 } from "node:path";
-var INTERFACE = "gdock";
-function networkDir() {
-  return join3(getConfigDir(), "network");
+// src/human.ts
+var ID_KEYS = [
+  "sandboxId",
+  "siteId",
+  "projectId",
+  "deploymentId",
+  "imageId",
+  "snapshotId",
+  "urlId",
+  "mcpId",
+  "commandId",
+  "sessionId",
+  "sandboxProviderId",
+  "id"
+];
+var LABEL_KEYS = ["displayName", "name", "title", "slug", "label", "path", "uri", "ref"];
+var STATUS_KEYS = ["status", "outcome", "state"];
+var URL_KEYS = ["url", "liveUrl", "publicUrl", "sshCommand"];
+function isItem(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function configPath(dir = networkDir()) {
-  return join3(dir, `${INTERFACE}.conf`);
+function isScalar(value) {
+  return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
 }
-function keyPath(dir) {
-  return join3(dir, "private.key");
+function firstKey(item, keys) {
+  return keys.find((key) => {
+    const value = item[key];
+    return typeof value === "string" && value.trim() !== "";
+  });
 }
-function statePath(dir) {
-  return join3(dir, "device.json");
+function firstString(item, keys) {
+  const key = firstKey(item, keys);
+  return key ? item[key] : undefined;
 }
-function isProvider(value) {
-  const provider = value;
-  return typeof provider?.id === "string" && typeof provider.name === "string";
+function symbolForStatus(status) {
+  const s = (status ?? "").toLowerCase();
+  if (/(fail|error|denied)/.test(s))
+    return "failed";
+  if (/^(running|active|ready|deployed|published|online|verified|ok)$/.test(s))
+    return "ready";
+  if (/^(stopped|deleted|unpublished|vanished|archived|revoked|closed|killed|exited|dead|paused)$/.test(s)) {
+    return "stopped";
+  }
+  if (/(pending|starting|spawning|stopping|building|progress|awaiting|queued|creating|restarting|removing)/.test(s)) {
+    return "progress";
+  }
+  return "item";
 }
-var X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
-function keyPairFromPrivate(privateKey) {
-  const raw = Buffer.from(privateKey, "base64");
-  if (raw.length !== 32)
-    throw new Error("The stored WireGuard key is not 32 bytes.");
-  const key = createPrivateKey({
-    key: Buffer.concat([X25519_PKCS8_PREFIX, raw]),
-    format: "der",
-    type: "pkcs8"
-  });
-  const spki = createPublicKey(key).export({ format: "der", type: "spki" });
-  return { privateKey, publicKey: spki.subarray(spki.length - 32).toString("base64") };
+function isSandbox(item) {
+  return typeof item.sandboxId === "string" && typeof item.name === "string" && !("id" in item);
 }
-async function loadOrCreateKey(dir = networkDir()) {
-  try {
-    return keyPairFromPrivate((await readFile3(keyPath(dir), "utf8")).trim());
-  } catch (err) {
-    if (err.code !== "ENOENT")
-      throw err;
+function lineKeys(item) {
+  if (isSandbox(item)) {
+    return { id: "name", label: firstKey(item, ["displayName"]) };
   }
-  const { privateKey } = generateKeyPairSync("x25519");
-  const der = privateKey.export({ format: "der", type: "pkcs8" });
-  const raw = der.subarray(der.length - 32).toString("base64");
-  await mkdir3(dir, { recursive: true, mode: 448 });
-  await writeFile3(keyPath(dir), `${raw}
-`, { mode: 384 });
-  return keyPairFromPrivate(raw);
+  const idKeys = "id" in item ? ID_KEYS.filter((key) => key !== "sandboxId") : ID_KEYS;
+  return { id: firstKey(item, idKeys), label: firstKey(item, LABEL_KEYS) };
 }
-async function readDeviceState(dir = networkDir()) {
-  try {
-    const parsed = JSON.parse(await readFile3(statePath(dir), "utf8"));
-    if (typeof parsed.deviceId === "string" && typeof parsed.baseUrl === "string") {
-      return {
-        baseUrl: parsed.baseUrl,
-        deviceId: parsed.deviceId,
-        address: typeof parsed.address === "string" ? parsed.address : "",
-        gatewayProvider: isProvider(parsed.gatewayProvider) ? { id: parsed.gatewayProvider.id, name: parsed.gatewayProvider.name } : null
-      };
+function shortId(id) {
+  return /^[0-9a-f]{64}$/.test(id) ? id.slice(0, 12) : id;
+}
+function itemLine(item, color) {
+  const keys = lineKeys(item);
+  const id = keys.id ? item[keys.id] : undefined;
+  const label = keys.label ? item[keys.label] : undefined;
+  const status = firstString(item, STATUS_KEYS);
+  const url = firstString(item, URL_KEYS);
+  const parts = [label ?? id ?? "(unnamed)"];
+  if (label && id && id !== label)
+    parts.push(dim(shortId(id), color));
+  if (status)
+    parts.push(status);
+  if (url)
+    parts.push(`${SYMBOLS.url} ${url}`);
+  return eventLine(symbolForStatus(status), parts.join("  "), color);
+}
+function scalarText(value) {
+  if (value === null)
+    return "—";
+  if (isScalar(value))
+    return String(value);
+  if (Array.isArray(value) && value.every(isScalar))
+    return value.join(", ");
+  if (Array.isArray(value))
+    return `${value.length} item${value.length === 1 ? "" : "s"}`;
+  return "…";
+}
+function fieldLines(item, color, skip) {
+  const lines = [];
+  for (const [key, value] of Object.entries(item)) {
+    if (skip.has(key) || value === undefined)
+      continue;
+    if (Array.isArray(value) && value.some(isItem)) {
+      lines.push(`    ${dim(`${key}:`, color)}`);
+      for (const entry of value) {
+        lines.push(`  ${isItem(entry) ? itemLine(entry, color) : eventLine("item", scalarText(entry), color)}`);
+      }
+      continue;
     }
-  } catch {}
-  return null;
+    if (isItem(value)) {
+      for (const [sub, subValue] of Object.entries(value)) {
+        if (subValue === undefined || isItem(subValue))
+          continue;
+        lines.push(`    ${dim(`${key}.${sub}:`, color)} ${scalarText(subValue)}`);
+      }
+      continue;
+    }
+    lines.push(`    ${dim(`${key}:`, color)} ${scalarText(value)}`);
+  }
+  return lines;
 }
-async function writeDeviceState(state, dir = networkDir()) {
-  await mkdir3(dir, { recursive: true, mode: 448 });
-  await writeFile3(statePath(dir), `${JSON.stringify(state, null, 2)}
-`, { mode: 384 });
+function listLines(items, color) {
+  if (items.length === 0)
+    return [`  ${dim("(none)", color)}`];
+  return items.map((item) => isItem(item) ? itemLine(item, color) : eventLine("item", scalarText(item), color));
 }
-function detectDnsMode(platform = process.platform, exists = existsSync) {
-  if (platform === "darwin")
-    return "macos-resolver";
-  if (platform === "linux" && exists("/run/systemd/resolve"))
-    return "resolved";
-  return "none";
+function bootPhase(value) {
+  return isItem(value) && typeof value.ms === "number" && Number.isFinite(value.ms) ? { ms: value.ms } : null;
 }
-function renderConfig(input) {
-  const { device, network, gateway } = input.registered;
-  const zones = [network.zone, ...network.netZone ? [network.netZone] : []];
-  for (const zone of zones) {
-    if (!isDnsZone(zone))
-      throw new Error(`The server sent a zone that is not a DNS name: ${zone}`);
+var DISK_SOURCE_TEXT = {
+  fresh: "image pulled",
+  "image-base": "image already on disk",
+  "user-snapshot": "from a snapshot"
+};
+function bootLines(data, color) {
+  if (!isItem(data) || !isItem(data.boot))
+    return [];
+  const sandbox = bootPhase(data.boot.sandbox);
+  if (!sandbox)
+    return [];
+  const lines = [eventLine("ready", `sandbox started in ${formatElapsed(sandbox.ms)}`, color)];
+  const container = bootPhase(data.boot.container);
+  if (container) {
+    lines.push(eventLine("done", `container started in ${formatElapsed(container.ms)}`, color));
   }
-  if (!device.address || !isIPv6Address(device.address)) {
-    throw new Error(`The server sent no IPv6 address for this device: ${device.address}`);
+  const provision = bootPhase(data.boot.provision);
+  if (provision) {
+    const disk = typeof data.boot.disk === "string" ? DISK_SOURCE_TEXT[data.boot.disk] : undefined;
+    const how = disk ? ` (${disk})` : "";
+    lines.push(eventLine("done", `ready in ${formatElapsed(provision.ms)}${how}`, color));
   }
-  if (!isIPv6Address(network.gatewayAddress)) {
-    throw new Error(`The server sent a gateway that is not an IPv6 address: ${network.gatewayAddress}`);
+  return lines;
+}
+function renderResult(data, color) {
+  if (data === null || data === undefined)
+    return [eventLine("done", "Done.", color)];
+  if (Array.isArray(data))
+    return listLines(data, color);
+  if (!isItem(data))
+    return [eventLine("item", scalarText(data), color)];
+  const entries = Object.entries(data).filter(([, value]) => value !== undefined);
+  if (entries.length === 0 || entries.length === 1 && data.ok === true) {
+    return [eventLine("done", "Done.", color)];
   }
-  const ipv4 = device.address4 && network.ingress4 ? { address: device.address4, ingress: network.ingress4 } : null;
-  if (ipv4 && (!isIPv4Address(ipv4.address) || !isIPv4Address(ipv4.ingress))) {
-    throw new Error(`The server sent an IPv4 address that is not one: ${ipv4.address}, ${ipv4.ingress}`);
+  const lists = entries.filter(([, value]) => Array.isArray(value) && (value.length === 0 || value.some(isItem)));
+  if (lists.length === 1 && !firstString(data, ID_KEYS)) {
+    const [listKey, list] = lists[0];
+    const rest = fieldLines(data, color, new Set([listKey]));
+    return [...rest, ...listLines(list, color)];
   }
-  const lines = [
-    "# Written by `ghostdock network connect`. Run it again rather than editing this file.",
-    "[Interface]",
-    `PrivateKey = ${input.privateKey}`,
-    `Address = ${device.address}/128${ipv4 ? `, ${ipv4.address}/32` : ""}`,
-    `MTU = ${network.mtu}`
-  ];
-  if (input.dns === "macos-resolver") {
-    for (const zone of zones) {
-      const file = `/etc/resolver/${zone}`;
-      lines.push(`PostUp = mkdir -p /etc/resolver && printf 'nameserver ${network.gatewayAddress}\\n' > ${file}`, `PostDown = rm -f ${file}`);
+  const { id: idKey, label: labelKey } = lineKeys(data);
+  const used = [idKey, labelKey, firstKey(data, STATUS_KEYS), firstKey(data, URL_KEYS)].filter((key) => key !== undefined);
+  const head = used.length > 0 ? [itemLine(data, color)] : [];
+  const boot = bootLines(data, color);
+  if ("boot" in data && (boot.length > 0 || data.boot === null))
+    used.push("boot");
+  return [...head, ...boot, ...fieldLines(data, color, new Set(used))];
+}
+
+// src/cli-help-text.ts
+var CLI_HELP_DESCRIPTION_MAX_LENGTH = 80;
+function cliHelpDescription(description, maxLength = CLI_HELP_DESCRIPTION_MAX_LENGTH) {
+  const oneLine = description.replace(/\s+/g, " ").trim();
+  if (oneLine.length <= maxLength) {
+    return oneLine;
+  }
+  const budget = Math.max(1, maxLength - 1);
+  const slice = oneLine.slice(0, budget);
+  const breakAt = slice.lastIndexOf(" ");
+  const cut = breakAt >= Math.floor(budget * 0.6) ? slice.slice(0, breakAt) : slice;
+  return `${cut.trimEnd()}…`;
+}
+
+// src/schema-flags.ts
+function toFlagName(propertyName) {
+  if (propertyName === "organization")
+    return "org";
+  return propertyName.replace(/([KMGTP])iB(?![a-z])/g, "$1ib").replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[_\s]+/g, "-").toLowerCase();
+}
+function isJsonSchemaProperty(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function schemaVariants(prop) {
+  const variants = [];
+  for (const key of ["anyOf", "oneOf", "allOf"]) {
+    const group = prop[key];
+    if (!Array.isArray(group))
+      continue;
+    for (const item of group) {
+      if (isJsonSchemaProperty(item))
+        variants.push(item);
     }
-  } else if (input.dns === "resolved") {
-    const domains = zones.map((zone) => `'~${zone}'`).join(" ");
-    lines.push(`PostUp = resolvectl dns %i ${network.gatewayAddress} && resolvectl domain %i ${domains}`);
   }
-  lines.push("", "[Peer]", `PublicKey = ${gateway.publicKey}`, `Endpoint = ${gateway.endpoint}`, `AllowedIPs = ${network.prefix}${ipv4 ? `, ${ipv4.ingress}/32` : ""}`, "PersistentKeepalive = 25", "");
-  return lines.join(`
-`);
+  return variants;
 }
-var DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-function isDnsZone(zone) {
-  const labels = zone.split(".");
-  return zone.length <= 253 && labels.length >= 2 && labels.every((label) => DNS_LABEL.test(label));
+function primaryJsonType(prop) {
+  if (prop.type !== undefined) {
+    if (Array.isArray(prop.type)) {
+      return prop.type.find((t) => t !== "null");
+    }
+    return prop.type === "null" ? undefined : prop.type;
+  }
+  const types = new Set;
+  for (const variant of schemaVariants(prop)) {
+    const type = primaryJsonType(variant);
+    if (type)
+      types.add(type);
+  }
+  if (types.has("object"))
+    return "object";
+  if (types.has("array"))
+    return "array";
+  if (types.size === 1) {
+    const [only] = types;
+    return only;
+  }
+  return;
 }
-function isIPv4Address(text) {
-  return /^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}$/.test(text);
+function allowsNull(prop) {
+  if (prop.type === "null")
+    return true;
+  if (Array.isArray(prop.type) && prop.type.includes("null"))
+    return true;
+  return schemaVariants(prop).some(allowsNull);
 }
-function ipv4RouteOwner(platform, output) {
-  if (platform === "darwin") {
-    if (/^\s*destination: default$/m.test(output))
-      return null;
-    return /^\s*interface: (\S+)$/m.exec(output)?.[1] ?? null;
+function buildToolArgs(schema, describe = cliHelpDescription, positionals = []) {
+  const properties = schema.properties ?? {};
+  const required = new Set(schema.required ?? []);
+  const args = {};
+  for (const name of positionals) {
+    const prop = properties[name];
+    if (!prop)
+      continue;
+    const jsonType = primaryJsonType(prop);
+    args[toFlagName(name)] = {
+      type: "positional",
+      description: describe(prop.description ?? name),
+      required: true,
+      valueHint: jsonType
+    };
   }
-  for (const line of output.split(`
-`).map((l) => l.trim())) {
-    if (!line || /^(default|broadcast)\b/.test(line))
+  for (const [name, prop] of Object.entries(properties)) {
+    if (positionals.includes(name))
       continue;
-    return /\bdev (\S+)/.exec(line)?.[1] ?? "another route";
+    const jsonType = primaryJsonType(prop);
+    const isBoolean = jsonType === "boolean";
+    const isJsonValue = jsonType === "object" || jsonType === "array";
+    const typeNote = isJsonValue ? ` (JSON ${jsonType})` : "";
+    const isOrganization = name === "organization";
+    const isRequired = required.has(name) && prop.default === undefined && !isOrganization;
+    const defaultNote = isOrganization ? " Defaults to GHOSTDOCK_ORG, then `organizations use`." : "";
+    args[toFlagName(name)] = isBoolean ? {
+      type: "boolean",
+      description: describe(`${prop.description ?? name}${typeNote}${defaultNote}`),
+      required: isRequired
+    } : {
+      type: "string",
+      description: describe(`${prop.description ?? name}${typeNote}${defaultNote}`),
+      required: isRequired,
+      valueHint: jsonType
+    };
   }
-  return null;
-}
-function ipv4RouteCommand(platform, address) {
-  return platform === "darwin" ? ["route", ["-n", "get", address]] : ["ip", ["-4", "route", "show", "table", "all", "match", address]];
-}
-function isIPv6Address(text) {
-  return /^[0-9a-f:]{2,39}$/.test(text) && text.includes(":");
+  return args;
 }
-async function readConfigMtu(path = configPath()) {
-  let contents;
-  try {
-    contents = await readFile3(path, "utf8");
-  } catch {
+function coerceFlagValue(raw, prop, flagName) {
+  if (raw === "null" && allowsNull(prop))
     return null;
+  const jsonType = primaryJsonType(prop);
+  if (jsonType === "boolean") {
+    return typeof raw === "boolean" ? raw : raw === "true";
   }
-  const match = /^MTU = (\d+)$/m.exec(contents);
-  return match ? Number(match[1]) : null;
-}
-async function writeConfig(contents, path = configPath()) {
-  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
-  await writeFile3(path, contents, { mode: 384 });
-  await chmod2(path, 384);
-}
-function tunnelUp(platform = process.platform, exists = existsSync) {
-  if (platform === "darwin")
-    return exists(`/var/run/wireguard/${INTERFACE}.name`);
-  return exists(`/sys/class/net/${INTERFACE}`);
+  if (jsonType === "number" || jsonType === "integer") {
+    const num = Number(raw);
+    if (Number.isNaN(num)) {
+      throw new Error(`Invalid number for --${flagName}: ${String(raw)}`);
+    }
+    return num;
+  }
+  if (jsonType === "object" || jsonType === "array") {
+    if (typeof raw !== "string")
+      return raw;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw new Error(`Invalid JSON for --${flagName}: ${String(raw)}`);
+    }
+  }
+  return raw;
 }
-function installHint(platform = process.platform) {
-  if (platform === "darwin")
-    return "brew install wireguard-tools";
-  if (platform === "linux")
-    return "sudo apt install wireguard-tools (or your distribution’s package)";
-  return "Install wireguard-tools. On Windows, run the CLI inside WSL.";
+function buildToolInput(schema, rawArgs) {
+  const properties = schema.properties ?? {};
+  const input = {};
+  for (const [name, prop] of Object.entries(properties)) {
+    const flagName = toFlagName(name);
+    const raw = rawArgs[flagName] ?? rawArgs[name];
+    if (raw === undefined)
+      continue;
+    input[name] = coerceFlagValue(raw, prop, flagName);
+  }
+  return input;
 }
 
-// src/commands/network.ts
-function defaultDeps() {
-  return {
-    request: authorizedRequest,
-    run: (command, args) => new Promise((resolve, reject) => {
-      const child = spawn(command, args, { stdio: "inherit" });
-      child.on("error", reject);
-      child.on("close", (code) => resolve(code ?? 1));
-    }),
-    output: (command, args) => {
-      const result = spawnSync(command, args, { encoding: "utf8" });
-      return result.status === 0 ? result.stdout : "";
-    },
-    platform: process.platform,
-    has: (command) => spawnSync("sh", ["-c", `command -v ${command}`]).status === 0,
-    dir: networkDir(),
-    up: () => tunnelUp(),
-    log: console.log,
-    error: printError,
-    notice: printNotice
-  };
-}
-function message(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-function connectCommandFor(provider) {
-  const ref = provider.connectRef;
-  const arg = /^[A-Za-z0-9._-]+$/.test(ref) ? ref : JSON.stringify(ref);
-  return `${getCliName()} network connect ${arg}`;
-}
-async function wgQuick(deps, verb) {
-  const args = ["wg-quick", verb, configPath(deps.dir)];
-  deps.notice(`Running: sudo ${args.join(" ")}`);
-  return deps.run("sudo", args);
-}
-async function runNetworkConnect(args = {}, deps = defaultDeps()) {
-  if (!deps.has("wg-quick")) {
-    deps.error(`wg-quick is not installed. ${installHint()}`);
-    return 1;
-  }
-  let registered;
-  let privateKey;
-  const previous = await readDeviceState(deps.dir);
+// src/commands/invoke.ts
+async function runToolInvoke(tool, rawArgs, log = console.log, error = printError, notice = printNotice, pickers = defaultContainerPickers()) {
+  const properties = tool.inputSchema.properties;
+  let input;
   try {
-    const organization = await requireOrganizationRef(args.org, deps.notice);
-    const provider = args.provider?.trim();
-    const key = await loadOrCreateKey(deps.dir);
-    privateKey = key.privateKey;
-    registered = await deps.request("/api/v1/network/devices", {
-      method: "POST",
-      body: JSON.stringify({
-        publicKey: key.publicKey,
-        name: hostname2().slice(0, 64) || "device",
-        organization,
-        ...provider ? { provider } : {}
-      })
-    });
+    input = buildToolInput(tool.inputSchema, rawArgs);
+    if (properties && "organization" in properties && input.organization === undefined) {
+      input.organization = await requireOrganizationRef(undefined, notice);
+    }
   } catch (err) {
-    deps.error(message(err));
+    error(err instanceof Error ? err.message : String(err));
     return 1;
   }
-  const dns = detectDnsMode();
-  let config;
+  if (tool.name === "sandboxes_containers_logs") {
+    try {
+      return await runContainerLogs(input, {
+        follow: rawArgs.follow === true,
+        timestamps: rawArgs.timestamps === true
+      });
+    } catch (err) {
+      error(err instanceof Error ? err.message : `${tool.name} failed.`);
+      return 1;
+    }
+  }
+  const call = {
+    organization: typeof input.organization === "string" ? input.organization : undefined,
+    sandboxId: typeof input.sandboxId === "string" ? input.sandboxId : undefined,
+    canPick: !!properties && "container" in properties && !input.container,
+    setContainer: (container) => {
+      input.container = container;
+    }
+  };
   try {
-    config = renderConfig({ privateKey, registered, dns });
+    const post = () => authorizedRequest(`/api/v1/tools/${tool.name}`, {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+    const waitMessage = PROGRESS_MESSAGES[tool.name];
+    let elapsed;
+    const send = async () => {
+      if (!waitMessage)
+        return post();
+      const timed = await withProgress(waitMessage, post);
+      elapsed = timed.elapsed;
+      return timed.value;
+    };
+    const result = await withContainerPick(call, () => withContainerStart(call, send, rawArgs.start === true, pickers, notice), pickers, notice);
+    printResult(result, () => {
+      const color = colorEnabled(process.stdout);
+      const lines = renderResult(result, color);
+      return elapsed === undefined || bootLines(result, color).length > 0 ? lines : withElapsed(lines, elapsed);
+    }, log);
+    stopNote(result, notice);
+    return 0;
   } catch (err) {
-    deps.error(message(err));
-    return 1;
-  }
-  await writeConfig(config, configPath(deps.dir));
-  await writeDeviceState({
-    baseUrl: getBaseUrl(),
-    deviceId: registered.device.id,
-    address: registered.device.address ?? "",
-    gatewayProvider: registered.provider
-  }, deps.dir);
-  const wasUp = deps.up();
-  if (wasUp) {
-    const down = await wgQuick(deps, "down");
-    if (down !== 0) {
-      deps.error(`Could not take the old tunnel down (wg-quick exited ${down}).`);
-      return 1;
-    }
-  }
-  const ipv4Clashes = ipv4Clashes4(registered, deps);
-  const code = await wgQuick(deps, "up");
-  if (code !== 0) {
-    deps.error(`wg-quick exited ${code}. The config is in ${configPath(deps.dir)}.`);
+    error(err instanceof Error ? err.message : `${tool.name} failed.`);
     return 1;
   }
-  const { device, network, provider, shortNameOrganizationChanged } = registered;
-  const pinned = device.shortNameOrganization;
-  const switched = wasUp && previous?.gatewayProvider && previous.gatewayProvider.id !== provider.id ? previous.gatewayProvider : null;
-  printResult({ device, network, provider, shortNameOrganizationChanged, interface: INTERFACE, dns }, () => [
-    eventLine("done", `Connected through ${provider.name}. This machine is ${device.address} in the private network.`),
-    ...switched ? [
-      `    Replaced the connection through ${switched.name}: its sandboxes are out of reach now.`
-    ] : [],
-    `    Reachable: the sandboxes on ${provider.name}. One provider at a time.`,
-    `    Names: <sandbox>.<org>.${network.zone}`,
-    ...network.netZone ? [`    In a browser: https://<sandbox>--<org>.${network.netZone}:<port>`] : [],
-    ...network.netZone && pinned ? [
-      `    Short names: https://<sandbox>.${network.netZone}:<port> for ${pinned.slug}'s sandboxes, on this machine.`,
-      `    Another organization: ${getCliName()} network connect --org <org>.`
-    ] : [],
-    ...network.netZone && pinned && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : [],
-    ...network.ingress4 && !device.address4 ? [
-      "    No IPv4 address was free on this provider's host, so browser names work over IPv6 only:",
-      "    Chrome on a network without IPv6 cannot open them on this machine. Firefox and Safari",
-      "    can. Run connect again later: an address frees up when another device goes."
-    ] : [],
-    ...ipv4Clashes.map(({ address, owner }) => `    ${address} is already routed through ${owner} on this machine: browsers may not reach the private network's names over IPv4 while it is. Ask your Ghostdock admin about the IPv4 block.`),
-    ...dns === "none" ? [
-      "    No split DNS on this machine (no systemd-resolved): use the addresses from",
-      `    \`${getCliName()} network ls\`.`
-    ] : [],
-    `    → ${getCliName()} network ls`
-  ], deps.log);
-  return 0;
 }
-function ipv4Clashes4(registered, deps) {
-  const addresses = [registered.network.ingress4, registered.device.address4].filter((a) => typeof a === "string" && isIPv4Address(a));
-  const clashes = [];
-  for (const address of addresses) {
-    const [command, args] = ipv4RouteCommand(deps.platform, address);
-    const owner = ipv4RouteOwner(deps.platform, deps.output(command, args));
-    if (owner)
-      clashes.push({ address, owner });
+function stopNote(result, notice) {
+  if (!result || typeof result !== "object")
+    return;
+  const { action, note, container } = result;
+  if (action !== "stop" || typeof container !== "string")
+    return;
+  if (note === "default") {
+    notice(`${container} is the sandbox's default container: SSH, commands and files ask which container until it runs again.`);
+  } else if (note === "last_running") {
+    notice("No container is running now: SSH, commands and files have none to land in until one runs.");
+  } else if (note === "sandbox_stopped") {
+    notice(`The sandbox is stopped, so ${container} is too: nothing was done.`);
   }
-  return clashes;
-}
-function clearingNotice(cookieSite) {
-  const site = cookieSite?.site ?? "the net domain";
-  return [
-    "    Short names meant another organization's sandboxes before. The first short-name site each",
-    `    browser opens now clears its data once: the site's storage, and every cookie of ${site}.`,
-    `    That signs the browser out of every site under ${site}${cookieSite?.includesApp ? ", the Ghostdock app included" : ""}.`,
-    "    Reload or close browser tabs opened on short names before this connect."
-  ];
 }
-async function runNetworkDisconnect(deps = defaultDeps()) {
-  if (!deps.up()) {
-    printResult({ connected: false }, () => [eventLine("item", "Not connected.")], deps.log);
-    return 0;
-  }
-  const code = await wgQuick(deps, "down");
-  if (code !== 0) {
-    deps.error(`wg-quick exited ${code}.`);
-    return 1;
+var PROGRESS_MESSAGES = {
+  sandboxes_create: "Creating sandbox…",
+  sandboxes_wake: "Waking sandbox…",
+  sandboxes_stop: "Stopping sandbox…",
+  sandboxes_delete: "Deleting sandbox…",
+  sandboxes_resize: "Resizing sandbox…",
+  sandboxes_resize_disk: "Resizing disk…",
+  sandboxes_commands_run: "Running command…",
+  sandboxes_containers_start: "Starting container…",
+  sandboxes_containers_stop: "Stopping container…",
+  sandboxes_containers_restart: "Restarting container…",
+  snapshots_create: "Saving snapshot…",
+  projects_redeploy: "Redeploying…",
+  providers_verify_incus: "Checking the Incus host…"
+};
+function withElapsed(lines, elapsed) {
+  const color = colorEnabled(process.stdout);
+  const [first, ...rest] = lines;
+  if (first === undefined || first.startsWith("    ")) {
+    return [eventLine("done", `Done in ${elapsed}.`, color), ...lines];
   }
-  printResult({ connected: false }, () => [eventLine("done", "Disconnected.")], deps.log);
-  return 0;
+  return [`${first}  ${dim(`in ${elapsed}`, color)}`, ...rest];
 }
-async function readConnection(deps) {
-  const state = await readDeviceState(deps.dir);
-  const up = deps.up();
-  if (!state)
-    return { state, up, device: null, asked: true, provider: null, staleMtu: null };
-  try {
-    const { devices, mtu } = await deps.request("/api/v1/network/devices");
-    const device = devices.find((d) => d.id === state.deviceId) ?? null;
-    const config = await readConfigMtu(configPath(deps.dir));
-    const staleMtu = config !== null && config !== mtu ? { config, current: mtu } : null;
-    if (staleMtu) {
-      deps.notice(`This machine's tunnel has MTU ${staleMtu.config}, the network now uses ${staleMtu.current}. ` + `Run \`${getCliName()} network connect\` again: until then, large packets other than TCP ` + "can be lost on the way.");
-    }
-    return {
-      state,
-      up,
-      device,
-      asked: true,
-      provider: up ? device?.gatewayProvider ?? null : null,
-      staleMtu
+function cliText(catalog, skills = BUILTIN_SKILL_NAMES) {
+  const paths = new Map(catalog.filter((tool) => tool.cli).map((tool) => [tool.name, tool.cli]));
+  const names = [...paths.keys()].sort((a, b) => b.length - a.length);
+  const pattern = names.length > 0 ? new RegExp(`\\b(${names.join("|")})\\b`, "g") : null;
+  return (text) => {
+    const oneLine = text.replace(/\s+/g, " ").trim();
+    const commands = pattern ? oneLine.replace(pattern, (name) => paths.get(name)?.join(" ") ?? name) : oneLine;
+    return commands.replace(/\bthe ([a-z][a-z0-9-]*) skill\b/g, (phrase, skill) => skills.includes(skill) ? `the ${skill} skill (\`${getCliName()} skills get ${skill}\`)` : phrase);
+  };
+}
+function cliOnlyArgs(tool) {
+  const schema = tool.inputSchema;
+  const args = {};
+  if (schema.properties && "container" in schema.properties && !schema.required?.includes("container")) {
+    args.start = {
+      type: "boolean",
+      description: "Start the container first when it is not running, without asking."
     };
-  } catch (err) {
-    deps.notice(`Could not ask the app about this device: ${message(err)}`);
-    return {
-      state,
-      up,
-      device: null,
-      asked: false,
-      provider: up ? state.gatewayProvider : null,
-      staleMtu: null
+  }
+  if (tool.name === "sandboxes_containers_logs") {
+    args.follow = {
+      type: "boolean",
+      alias: "f",
+      description: "Keep printing new lines until Ctrl-C."
     };
+    args.timestamps = { type: "boolean", description: "Put each line's time in front of it." };
   }
+  return args;
 }
-async function runNetworkStatus(deps = defaultDeps()) {
-  const { state, up, device, asked, provider, staleMtu } = await readConnection(deps);
-  printResult({ connected: up, device, provider, staleMtu }, () => {
-    if (!state) {
-      return [eventLine("item", `Not set up. Run \`${getCliName()} network connect\`.`)];
-    }
-    const through = provider ? ` through ${provider.name}` : "";
-    const lines = [
-      eventLine("item", `${up ? `Connected${through}` : "Not connected"}: ${state.address}`)
-    ];
-    if (device) {
-      lines.push(`    Device ${device.name}, valid until ${device.expiresAt.slice(0, 10)}.`);
-      if (device.shortNameOrganization) {
-        lines.push(`    Short names: ${device.shortNameOrganization.slug}'s sandboxes.`);
-      }
-      if (!device.gatewayProvider) {
-        lines.push(`    Its provider is gone, so no gateway serves it. Run \`${getCliName()} network connect\`.`);
+var generatedToolCommands = new WeakSet;
+function createToolCommands(catalog) {
+  const commands = {};
+  const toCliText = cliText(catalog);
+  for (const tool of catalog) {
+    const command = defineCommand({
+      meta: {
+        name: tool.cli?.at(-1) ?? tool.name,
+        description: toCliText(tool.description)
+      },
+      args: { ...buildToolArgs(tool.inputSchema, toCliText, tool.cliArgs), ...cliOnlyArgs(tool) },
+      async run({ args }) {
+        process.exitCode = await runToolInvoke(tool, args);
       }
-    } else if (asked) {
-      lines.push(`    The app no longer knows this device (removed, expired or logged out). Run \`${getCliName()} network connect\`.`);
-    }
-    if (provider)
-      lines.push(`    Reachable: the sandboxes on ${provider.name}.`);
-    return lines;
-  }, deps.log);
-  return 0;
-}
-function unreachableNote(sandbox, connected) {
-  if (!sandbox.provider.privateNetwork) {
-    return `not reachable: ${sandbox.provider.name} has no private network yet`;
+    });
+    generatedToolCommands.add(command);
+    commands[tool.name] = command;
   }
-  if (connected?.id === sandbox.provider.id)
-    return null;
-  return `not reachable: on ${sandbox.provider.name} → ${connectCommandFor(sandbox.provider)}`;
+  return commands;
 }
-async function runNetworkLs(args, deps = defaultDeps()) {
-  try {
-    const organization = await requireOrganizationRef(args.org, deps.notice);
-    const connection = await readConnection(deps);
-    const deviceId = connection.device?.id;
-    const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes${deviceId ? `?device=${encodeURIComponent(deviceId)}` : ""}`);
-    const connected = connection.provider;
-    const sandboxes = listed.sandboxes.map((sandbox) => ({
-      ...sandbox,
-      reachable: unreachableNote(sandbox, connected) === null
-    }));
-    printResult({ ...listed, connectedProvider: connected, sandboxes }, () => {
-      if (listed.sandboxes.length === 0) {
-        return [eventLine("item", `No sandboxes in ${listed.organization.slug}.`)];
-      }
-      const width = Math.max(...listed.sandboxes.map((s) => s.name.length));
-      const canonicalWidth = Math.max(...listed.sandboxes.map((s) => s.canonicalName.length));
-      const httpsWidth = Math.max(...listed.sandboxes.map((s) => (s.httpsName?.length ?? 0) + 8));
-      const shortWidth = Math.max(...listed.sandboxes.map((s) => (s.shortName?.length ?? 0) + 8));
-      const lines = [
-        connected ? eventLine("item", `Connected through ${connected.name}.`) : eventLine("item", `Not connected: nothing is reachable. Run \`${getCliName()} network connect [provider]\`.`)
-      ];
-      for (const s of listed.sandboxes) {
-        const note = unreachableNote(s, connected);
-        lines.push([
-          `  ${s.name.padEnd(width)}`,
-          (s.address ?? "-").padEnd(28),
-          s.canonicalName.padEnd(canonicalWidth),
-          ...s.httpsName ? [`https://${s.httpsName}`.padEnd(httpsWidth)] : [],
-          ...s.shortName ? [`https://${s.shortName}`.padEnd(shortWidth)] : [],
-          s.status,
-          ...note ? [`(${note})`] : []
-        ].join("  "));
-      }
-      return lines;
-    }, deps.log);
-    return 0;
-  } catch (err) {
-    deps.error(message(err));
-    return 1;
+
+// src/commands/login.ts
+import { hostname as hostname2 } from "node:os";
+
+// src/commands/login-organization.ts
+import { createInterface as createInterface2 } from "node:readline/promises";
+function label(organization) {
+  return `${organization.name} (${organization.slug ?? organization.id})`;
+}
+var chooseOrganizationOnTerminal = async (organizations) => {
+  console.log(`
+Which organization should commands use by default?`);
+  organizations.forEach((organization, index) => {
+    console.log(`  ${index + 1}. ${label(organization)}`);
+  });
+  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await prompt.question(`Number (Enter to skip): `)).trim();
+    const index = Number.parseInt(answer, 10) - 1;
+    return Number.isInteger(index) && index >= 0 && index < organizations.length ? index : null;
+  } finally {
+    prompt.close();
   }
+};
+function defaultChooser() {
+  return process.stdin.isTTY && process.stdout.isTTY ? chooseOrganizationOnTerminal : undefined;
 }
-async function runNetworkDevices(deps = defaultDeps()) {
+async function chooseDefaultOrganizationAfterLogin(org, log, choose = defaultChooser()) {
+  const cli = getCliName();
+  let organizations;
   try {
-    const { devices } = await deps.request("/api/v1/network/devices");
-    const own = (await readDeviceState(deps.dir))?.deviceId;
-    printResult({ devices }, () => devices.length === 0 ? [eventLine("item", "No devices.")] : devices.map((d) => `  ${d.id === own ? "*" : " "} ${d.id}  ${d.name}  ${d.address}  until ${d.expiresAt.slice(0, 10)}`), deps.log);
+    ({ organizations } = await authorizedRequest("/api/v1/tools/organizations_list", { method: "POST", body: "{}" }));
+  } catch {
+    organizations = undefined;
+  }
+  if (!Array.isArray(organizations)) {
+    log(eventLine("item", `Pick a default organization with \`${cli} organizations use <org>\`.`));
+    return org ? 1 : 0;
+  }
+  const settings = await readSettings();
+  const save = async (organization, why) => {
+    settings.defaultOrganization = { id: organization.id, slug: organization.slug };
+    await writeSettings(settings);
+    log(eventLine("done", `Default organization: ${label(organization)}${why}.`));
+  };
+  const ref = org?.trim();
+  if (ref) {
+    const match = organizations.find((organization) => organization.id === ref) ?? organizations.find((organization) => organization.slug === ref);
+    if (!match) {
+      log(eventLine("failed", `You are not a member of an organization "${ref}"; no default set.`));
+      return 1;
+    }
+    await save(match, "");
+    return 0;
+  }
+  const current = organizations.find((organization) => organization.id === settings.defaultOrganization?.id);
+  if (current) {
+    log(eventLine("item", `Default organization: ${label(current)} (unchanged).`));
+    return 0;
+  }
+  if (settings.defaultOrganization) {
+    delete settings.defaultOrganization;
+    await writeSettings(settings);
+  }
+  const [only, ...others] = organizations;
+  if (!only) {
+    log(eventLine("item", "You do not belong to an organization yet."));
+    return 0;
+  }
+  if (others.length === 0) {
+    await save(only, " (your only organization)");
+    return 0;
+  }
+  const index = choose ? await choose(organizations) : null;
+  const chosen = index === null ? undefined : organizations[index];
+  if (chosen) {
+    await save(chosen, "");
     return 0;
-  } catch (err) {
-    deps.error(message(err));
-    return 1;
   }
+  log(eventLine("item", `You belong to ${organizations.length} organizations: ${organizations.map((organization) => organization.slug ?? organization.id).join(", ")}. Pick a default with \`${cli} organizations use <org>\`, or pass --org.`));
+  return 0;
 }
-async function runNetworkDevicesRemove(args, deps = defaultDeps()) {
+
+// src/commands/login.ts
+function defaultClientName() {
   try {
-    await deps.request(`/api/v1/network/devices/${encodeURIComponent(args.id)}`, {
-      method: "DELETE"
-    });
-    printResult({ removed: args.id }, () => [eventLine("done", `Removed device ${args.id}.`)], deps.log);
-    return 0;
-  } catch (err) {
-    deps.error(message(err));
+    const host = hostname2().trim();
+    if (host)
+      return host.slice(0, 64);
+  } catch {}
+  return "ghostdock-cli";
+}
+var DEFAULT_TIMEOUT_SECONDS = 300;
+function toCredentials(result) {
+  return {
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    accessExpiresAt: new Date(Date.now() + result.expiresIn * 1000).toISOString()
+  };
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function runLogin(args, log = console.log, choose = defaultChooser(), error = printError) {
+  const loggedIn = async () => {
+    log(eventLine("ready", "Logged in."));
+    return chooseDefaultOrganizationAfterLogin(args.org, log, choose);
+  };
+  if (args.code) {
+    const result = await deviceToken({ pasteCode: args.code });
+    if (result.status === "approved") {
+      await writeCredentials(toCredentials(result));
+      return loggedIn();
+    }
+    error("That code has not been approved yet. Approve it in the browser, then run this again.");
     return 1;
   }
+  const start = await deviceStart({ client_name: defaultClientName() });
+  log(eventLine("url", `Open this URL to sign in: ${start.verificationUrl}`));
+  log(`    Pass --wait to finish here once you approve, or approve on another device and run \`${getCliName()} login --code <paste-code>\` with the code shown there.`);
+  if (!args.wait) {
+    return 0;
+  }
+  const timeoutSeconds = Number.parseInt(args.timeout ?? "", 10) || DEFAULT_TIMEOUT_SECONDS;
+  const deadline = Date.now() + timeoutSeconds * 1000;
+  const intervalMs = start.interval * 1000;
+  const progress = startProgress("Waiting for approval in the browser…");
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    try {
+      const result = await deviceToken({ deviceCode: start.deviceCode });
+      if (result.status === "approved") {
+        progress.stop();
+        await writeCredentials(toCredentials(result));
+        return loggedIn();
+      }
+    } catch (err) {
+      progress.stop();
+      if (err instanceof ApiError && err.status === 400) {
+        error(`Login failed: ${err.message}`);
+        return 1;
+      }
+      throw err;
+    }
+  }
+  progress.stop();
+  error(`Timed out waiting for approval. Run \`${getCliName()} login\` again.`);
+  return 1;
 }
-var connectCommand = defineCommand({
+var loginCommand = defineCommand({
   meta: {
-    name: "connect",
-    description: "Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Asks for sudo once."
+    name: "login",
+    description: "Sign in and store a device access token for this machine (~/.config/ghostdock/credentials.json)."
   },
   args: {
-    provider: {
-      type: "positional",
-      required: false,
-      description: "Sandbox provider name or id. Omit for the organization's default provider (else the platform default). Only its sandboxes are reachable; connecting through another replaces the connection."
+    wait: {
+      type: "boolean",
+      description: "Poll until the login is approved in the browser (default timeout 5 minutes).",
+      default: false
     },
-    org: orgArg
+    code: {
+      type: "string",
+      description: "Redeem the one-time paste code shown in the browser instead of polling."
+    },
+    timeout: {
+      type: "string",
+      description: "Max seconds to poll when using --wait (default 300)."
+    },
+    org: {
+      type: "string",
+      description: "Set this organization (id or slug) as the default once logged in."
+    }
   },
   async run({ args }) {
-    process.exitCode = await runNetworkConnect({ provider: args.provider, org: args.org });
+    process.exitCode = await runLogin(args);
   }
 });
-var disconnectCommand = defineCommand({
-  meta: { name: "disconnect", description: "Take this machine out of the private network." },
-  async run() {
-    process.exitCode = await runNetworkDisconnect();
+
+// src/commands/logout.ts
+async function runLogout(log = console.log) {
+  const credentials = await readCredentials();
+  if (credentials) {
+    try {
+      await deviceRevoke({
+        accessToken: credentials.accessToken,
+        refreshToken: credentials.refreshToken
+      });
+    } catch {}
   }
-});
-var statusCommand = defineCommand({
+  await clearCredentials();
+  log(eventLine("stopped", "Logged out."));
+  return 0;
+}
+var logoutCommand = defineCommand({
   meta: {
-    name: "status",
-    description: "Whether this machine is connected, through which provider, and as which device."
+    name: "logout",
+    description: "Revoke the device session and remove stored credentials."
   },
   async run() {
-    process.exitCode = await runNetworkStatus();
-  }
-});
-var lsCommand = defineCommand({
-  meta: {
-    name: "ls",
-    description: "Sandboxes of an organization with their private addresses and names, and which are reachable through the current connection."
-  },
-  args: { org: orgArg },
-  async run({ args }) {
-    process.exitCode = await runNetworkLs({ org: args.org });
-  }
-});
-var devicesRemoveCommand = defineCommand({
-  meta: { name: "remove", description: "Remove one of your devices from the private network." },
-  args: {
-    id: { type: "positional", description: "Device id, from `network devices`.", required: true }
-  },
-  async run({ args }) {
-    process.exitCode = await runNetworkDevicesRemove({ id: args.id });
-  }
-});
-var devicesCommand = defineCommand({
-  meta: { name: "devices", description: "Your devices in the private network." },
-  subCommands: { remove: devicesRemoveCommand },
-  async run({ rawArgs }) {
-    if (rawArgs[0] === "remove")
-      return;
-    process.exitCode = await runNetworkDevices();
-  }
-});
-var networkCommand = defineCommand({
-  meta: {
-    name: "network",
-    description: "The private network: reach your sandboxes by address and name from this machine."
-  },
-  subCommands: {
-    connect: connectCommand,
-    disconnect: disconnectCommand,
-    status: statusCommand,
-    ls: lsCommand,
-    devices: devicesCommand
+    process.exitCode = await runLogout();
   }
 });
 
@@ -11295,8 +12117,8 @@ var organizationsCurrentCommand = defineCommand({
 });
 
 // src/commands/publish-auto.ts
-import { readdir, readFile as readFile4, stat } from "node:fs/promises";
-import { basename as basename2, join as join4, relative, sep } from "node:path";
+import { readdir as readdir2, readFile as readFile5, stat } from "node:fs/promises";
+import { basename as basename2, join as join5, relative, sep } from "node:path";
 function publishAutoLines(result) {
   const [summaryLine, ...rest] = formatPublishAutoResult(result).split(`
 `);
@@ -11373,23 +12195,23 @@ function formatAttemptedSpec(spec) {
 async function collectPath(path) {
   const pathStats = await stat(path);
   if (pathStats.isFile()) {
-    return [{ path: basename2(path), data: await readFile4(path) }];
+    return [{ path: basename2(path), data: await readFile5(path) }];
   }
   if (!pathStats.isDirectory()) {
     throw new Error(`Publish path must be a file or directory: ${path}`);
   }
   const files = [];
   async function visit(currentPath) {
-    const entries = await readdir(currentPath, { withFileTypes: true });
+    const entries = await readdir2(currentPath, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const entryPath = join4(currentPath, entry.name);
+      const entryPath = join5(currentPath, entry.name);
       if (entry.isDirectory()) {
         await visit(entryPath);
       } else if (entry.isFile()) {
         files.push({
           path: relative(path, entryPath).split(sep).join("/"),
-          data: await readFile4(entryPath)
+          data: await readFile5(entryPath)
         });
       }
     }
@@ -11432,7 +12254,7 @@ async function runPublishAuto(options, log = console.log, error = printError) {
       }
     }
     if (options.zip) {
-      form.append("zip", new Blob([await readFile4(options.zip)]), basename2(options.zip));
+      form.append("zip", new Blob([await readFile5(options.zip)]), basename2(options.zip));
     }
     const { value: result } = await withProgress("Planning and deploying… (this can take a few minutes)", () => authorizedRequest(`/api/v1/organizations/${encodeURIComponent(options.organizationId)}/publish-auto`, { method: "POST", body: form }));
     printResult(result, () => publishAutoLines(result), log);
@@ -11555,28 +12377,28 @@ var publishAutoCommand = defineCommand({
 });
 
 // src/commands/publish-static.ts
-import { readdir as readdir2, readFile as readFile5, stat as stat2 } from "node:fs/promises";
-import { basename as basename3, join as join5, relative as relative2, sep as sep2 } from "node:path";
+import { readdir as readdir3, readFile as readFile6, stat as stat2 } from "node:fs/promises";
+import { basename as basename3, join as join6, relative as relative2, sep as sep2 } from "node:path";
 async function collectPath2(path) {
   const pathStats = await stat2(path);
   if (pathStats.isFile()) {
-    return [{ path: basename3(path), data: await readFile5(path) }];
+    return [{ path: basename3(path), data: await readFile6(path) }];
   }
   if (!pathStats.isDirectory()) {
     throw new Error(`Publish path must be a file or directory: ${path}`);
   }
   const files = [];
   async function visit(currentPath) {
-    const entries = await readdir2(currentPath, { withFileTypes: true });
+    const entries = await readdir3(currentPath, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const entryPath = join5(currentPath, entry.name);
+      const entryPath = join6(currentPath, entry.name);
       if (entry.isDirectory()) {
         await visit(entryPath);
       } else if (entry.isFile()) {
         files.push({
           path: relative2(path, entryPath).split(sep2).join("/"),
-          data: await readFile5(entryPath)
+          data: await readFile6(entryPath)
         });
       }
     }
@@ -11599,7 +12421,7 @@ async function runPublishStatic(options, log = console.log, error = printError)
       }
     }
     if (options.zip) {
-      form.append("zip", new Blob([await readFile5(options.zip)]), basename3(options.zip));
+      form.append("zip", new Blob([await readFile6(options.zip)]), basename3(options.zip));
     }
     const { value: result } = await withProgress("Publishing…", () => authorizedRequest(`/api/v1/organizations/${encodeURIComponent(options.organizationId)}/static-sites`, { method: "POST", body: form }));
     printResult(result, () => [eventLine("url", result.url), eventLine("done", `Published site ${result.siteId}.`)], log);
@@ -11653,7 +12475,7 @@ var publishStaticCommand = defineCommand({
 });
 
 // src/commands/registry.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 function reportError2(err, error) {
   if (err instanceof AuthRequiredError || err instanceof Error) {
     error(err.message);
@@ -11670,7 +12492,7 @@ function defaultInvoke(input) {
 }
 function dockerLogin(input) {
   return new Promise((resolve, reject) => {
-    const child = spawn2("docker", ["login", input.host, "-u", input.username, "--password-stdin"], {
+    const child = spawn3("docker", ["login", input.host, "-u", input.username, "--password-stdin"], {
       stdio: ["pipe", "inherit", "pipe"]
     });
     let stderr = "";
@@ -11768,8 +12590,8 @@ var registryCommand = defineCommand({
 });
 
 // src/commands/sandbox-create.ts
-import { readdir as readdir3, readFile as readFile6, stat as stat3 } from "node:fs/promises";
-import { basename as basename4, join as join6, relative as relative3, sep as sep3 } from "node:path";
+import { readdir as readdir4, readFile as readFile7, stat as stat3 } from "node:fs/promises";
+import { basename as basename4, join as join7, relative as relative3, sep as sep3 } from "node:path";
 
 // ../../node_modules/fflate/esm/index.mjs
 import { createRequire } from "module";
@@ -12422,16 +13244,16 @@ async function collectDirectory(path) {
   }
   const files = [];
   async function visit(currentPath) {
-    const entries = await readdir3(currentPath, { withFileTypes: true });
+    const entries = await readdir4(currentPath, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const entryPath = join6(currentPath, entry.name);
+      const entryPath = join7(currentPath, entry.name);
       if (entry.isDirectory()) {
         await visit(entryPath);
       } else if (entry.isFile()) {
         files.push({
           path: relative3(path, entryPath).split(sep3).join("/"),
-          data: await readFile6(entryPath)
+          data: await readFile7(entryPath)
         });
       }
     }
@@ -12464,7 +13286,7 @@ async function runSandboxCreate(options, log = console.log, error = printError)
     return 1;
   }
   try {
-    const zipBytes = options.zip ? new Uint8Array(await readFile6(options.zip)) : zipDirectory(await collectDirectory(options.paths[0] ?? ""));
+    const zipBytes = options.zip ? new Uint8Array(await readFile7(options.zip)) : zipDirectory(await collectDirectory(options.paths[0] ?? ""));
     const form = new FormData;
     form.append("kind", options.kind);
     if (options.displayName)
@@ -12725,28 +13547,28 @@ var toolsCommand = defineCommand({
 });
 
 // src/commands/upload-files.ts
-import { readdir as readdir4, readFile as readFile7, stat as stat4 } from "node:fs/promises";
-import { basename as basename5, join as join7, relative as relative4, sep as sep4 } from "node:path";
+import { readdir as readdir5, readFile as readFile8, stat as stat4 } from "node:fs/promises";
+import { basename as basename5, join as join8, relative as relative4, sep as sep4 } from "node:path";
 async function collectPath3(path) {
   const pathStats = await stat4(path);
   if (pathStats.isFile()) {
-    return [{ path: basename5(path), data: await readFile7(path) }];
+    return [{ path: basename5(path), data: await readFile8(path) }];
   }
   if (!pathStats.isDirectory()) {
     throw new Error(`Upload path must be a file or directory: ${path}`);
   }
   const files = [];
   async function visit(currentPath) {
-    const entries = await readdir4(currentPath, { withFileTypes: true });
+    const entries = await readdir5(currentPath, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const entryPath = join7(currentPath, entry.name);
+      const entryPath = join8(currentPath, entry.name);
       if (entry.isDirectory()) {
         await visit(entryPath);
       } else if (entry.isFile()) {
         files.push({
           path: relative4(path, entryPath).split(sep4).join("/"),
-          data: await readFile7(entryPath)
+          data: await readFile8(entryPath)
         });
       }
     }
@@ -12768,7 +13590,7 @@ async function runSandboxUpload(options, log = console.log, error = printError,
       }
     }
     if (options.zip) {
-      form.append("zip", new Blob([await readFile7(options.zip)]), basename5(options.zip));
+      form.append("zip", new Blob([await readFile8(options.zip)]), basename5(options.zip));
     }
     let container = options.container;
     const call = {
@@ -12910,7 +13732,8 @@ var HANDWRITTEN_COMMANDS = [
   [["sandboxes", "files", "upload"], sandboxUploadCommand],
   [["sites", "publish"], publishStaticCommand],
   [["projects", "publish"], publishAutoCommand],
-  [["network"], networkCommand]
+  [["network"], networkCommand],
+  [["docker"], dockerCommand]
 ];
 var HANDWRITTEN_PATHS = new Set(HANDWRITTEN_COMMANDS.map(([path]) => path.join(" ")));
 function createMainCommand(catalog = OFFLINE_TOOL_CATALOG) {