ghostdock 0.0.17 → 0.0.18

package/dist/index.js

@@ -9183,8 +9183,25 @@ function getCliName(argv = process.argv) {
   const invoked = basename(entry);
   return CLI_NAMES.find((name) => name === invoked) ?? "ghostdock";
 }
+
+// src/commands/docker.ts
+import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
+
+// ../../shared/lib/private-network.ts
+var ALL_BITS = (1n << 128n) - 1n;
+
+// ../../shared/lib/docker-access.ts
+var DOCKER_CERTIFICATE_RENEW_DAYS = 10;
+var DOCKER_CLIENT_URI_PREFIX = {
+  user: "urn:ghostdock:user:",
+  device: "urn:ghostdock:device:",
+  organization: "urn:ghostdock:org:"
+};
+function dockerContextName(orgSlug, sandboxName) {
+  return `ghostdock-${orgSlug}-${sandboxName}`;
+}
 // package.json
-var version = "0.0.17";
+var version = "0.0.18";
 var package_default = {
   name: "ghostdock",
   description: "Ghostdock CLI — device login and agent tool invocation from the command line",
@@ -9452,11 +9469,15 @@ function deviceStateText(state, now = new Date) {
     return "Not connected (logged out)";
   if (state.status === "paused" && state.pauseReason) {
     const text = state.pauseReason === "manual" ? "Paused by you" : `Paused: ${devicePauseReasonText(state.pauseReason, state)}`;
-    return state.connected ? text : `Not connected (${text.toLowerCase()})`;
+    if (state.connected)
+      return text;
+    return state.connecting ? `${text}, connecting` : `Not connected (${text.toLowerCase()})`;
   }
   const left = state.pausesAt ? new Date(state.pausesAt).getTime() - now.getTime() : 0;
   const active = `Active, pauses in ${formatRemaining(Math.max(left, 0) / 1000)}`;
-  return state.connected ? active : `Not connected (armed, pauses in ${formatRemaining(Math.max(left, 0) / 1000)})`;
+  if (state.connected)
+    return active;
+  return state.connecting ? `${active}, connecting` : `Not connected (armed, pauses in ${formatRemaining(Math.max(left, 0) / 1000)})`;
 }
 function formatRemaining(seconds) {
   const minutes = Math.floor(seconds / 60);
@@ -9791,11 +9812,388 @@ async function authorizedRequest(path, init = {}) {
   }
 }
 
-// src/settings.ts
-import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+// src/docker/certificates.ts
+import { spawnSync } from "node:child_process";
+
+// src/docker/context.ts
+function contextDescription(sandbox, orgSlug) {
+  return `Ghostdock sandbox ${sandbox} (${orgSlug}; needs ${getCliName()} network connect)`;
+}
+function csvField(field) {
+  return /[",\r\n]/.test(field) ? `"${field.replaceAll('"', '""')}"` : field;
+}
+function contextArgs(verb, spec) {
+  const endpoint = [
+    `host=${spec.host}`,
+    `ca=${spec.files.ca}`,
+    `cert=${spec.files.cert}`,
+    `key=${spec.files.key}`
+  ].map(csvField).join(",");
+  return ["context", verb, spec.name, "--description", spec.description, "--docker", endpoint];
+}
+function contextHost(exec, name) {
+  const result = exec("docker", [
+    "context",
+    "inspect",
+    "--format",
+    "{{.Endpoints.docker.Host}}",
+    name
+  ]);
+  return result.status === 0 ? result.stdout.trim() : null;
+}
+function dockerFailure(args, result) {
+  const said = result.stderr.trim() || result.stdout.trim();
+  return new Error(`docker ${args.slice(0, 3).join(" ")} failed (exit ${result.status})${said ? `: ${said}` : "."}`);
+}
+function writeContext(exec, spec) {
+  const created = contextHost(exec, spec.name) === null;
+  const args = contextArgs(created ? "create" : "update", spec);
+  const result = exec("docker", args);
+  if (result.status !== 0)
+    throw dockerFailure(args, result);
+  return { created };
+}
+function useContext(exec, name) {
+  const args = ["context", "use", name];
+  const result = exec("docker", args);
+  if (result.status !== 0)
+    throw dockerFailure(args, result);
+}
+
+// src/docker/csr.ts
+import { createPublicKey as createPublicKey2, sign } from "node:crypto";
+var TAG = {
+  integer: 2,
+  bitString: 3,
+  utf8String: 12,
+  sequence: 48,
+  set: 49,
+  context0: 160
+};
+var OID_COMMON_NAME = Buffer.from("0603550403", "hex");
+var OID_ECDSA_WITH_SHA256 = Buffer.from("06082a8648ce3d040302", "hex");
+function der(tag, content) {
+  const length = content.length;
+  if (length < 128)
+    return Buffer.concat([Buffer.from([tag, length]), content]);
+  const bytes = [];
+  for (let rest = length;rest > 0; rest >>= 8)
+    bytes.unshift(rest & 255);
+  return Buffer.concat([Buffer.from([tag, 128 | bytes.length, ...bytes]), content]);
+}
+function csrSubject(deviceId) {
+  return `ghostdock device ${deviceId}`;
+}
+function buildCsr(privateKey, deviceId) {
+  const spki = createPublicKey2(privateKey).export({ type: "spki", format: "der" });
+  const commonName = der(TAG.sequence, Buffer.concat([OID_COMMON_NAME, der(TAG.utf8String, Buffer.from(csrSubject(deviceId)))]));
+  const subject = der(TAG.sequence, der(TAG.set, commonName));
+  const info = der(TAG.sequence, Buffer.concat([
+    der(TAG.integer, Buffer.from([0])),
+    subject,
+    spki,
+    der(TAG.context0, Buffer.alloc(0))
+  ]));
+  const signature = sign("sha256", info, { key: privateKey, dsaEncoding: "der" });
+  return der(TAG.sequence, Buffer.concat([
+    info,
+    der(TAG.sequence, OID_ECDSA_WITH_SHA256),
+    der(TAG.bitString, Buffer.concat([Buffer.from([0]), signature]))
+  ]));
+}
+function buildCsrPem(privateKey, deviceId) {
+  const base64 = buildCsr(privateKey, deviceId).toString("base64");
+  const lines = base64.match(/.{1,64}/g) ?? [];
+  return `-----BEGIN CERTIFICATE REQUEST-----
+${lines.join(`
+`)}
+-----END CERTIFICATE REQUEST-----
+`;
+}
+
+// src/docker/store.ts
+import {
+  createPrivateKey as createPrivateKey2,
+  generateKeyPairSync as generateKeyPairSync2,
+  randomBytes,
+  X509Certificate
+} from "node:crypto";
+import { chmod as chmod3, link, mkdir as mkdir3, readdir, readFile as readFile3, rename, unlink, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname3, join as join3 } from "node:path";
+function dockerDirFor(networkDir) {
+  return join3(dirname3(networkDir), "docker");
+}
+function isOrganizationId(id) {
+  return /^[A-Za-z0-9_-]{1,128}$/.test(id);
+}
+function organizationFiles(dockerDir, organizationId) {
+  if (!isOrganizationId(organizationId)) {
+    throw new Error(`Not an organization id: ${JSON.stringify(organizationId)}`);
+  }
+  const dir = join3(dockerDir, organizationId);
+  return {
+    dir,
+    key: join3(dir, "key.pem"),
+    cert: join3(dir, "cert.pem"),
+    ca: join3(dir, "ca.pem"),
+    meta: join3(dir, "certificate.json")
+  };
+}
+async function listOrganizationIds(dockerDir) {
+  try {
+    const entries = await readdir(dockerDir, { withFileTypes: true });
+    return entries.filter((entry) => entry.isDirectory() && isOrganizationId(entry.name)).map((entry) => entry.name).sort();
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return [];
+    throw err;
+  }
+}
+function tempPath(path) {
+  return `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+}
+async function writeFileAtomic(path, contents, mode) {
+  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
+  const temp = tempPath(path);
+  try {
+    await writeFile3(temp, contents, { mode });
+    await chmod3(temp, mode);
+    await rename(temp, path);
+  } catch (err) {
+    await unlink(temp).catch(() => {});
+    throw err;
+  }
+}
+function isP256(key) {
+  return key.asymmetricKeyType === "ec" && key.asymmetricKeyDetails?.namedCurve === "prime256v1";
+}
+async function loadOrCreateDockerKey(files) {
+  const existing = await readDockerKey(files);
+  if (existing)
+    return existing;
+  const { privateKey } = generateKeyPairSync2("ec", { namedCurve: "prime256v1" });
+  const pem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+  await mkdir3(files.dir, { recursive: true, mode: 448 });
+  const temp = tempPath(files.key);
+  try {
+    await writeFile3(temp, pem, { mode: 384 });
+    await chmod3(temp, 384);
+    await link(temp, files.key);
+  } catch (err) {
+    if (err.code !== "EEXIST")
+      throw err;
+    const created = await readDockerKey(files);
+    if (created)
+      return created;
+    throw err;
+  } finally {
+    await unlink(temp).catch(() => {});
+  }
+  return privateKey;
+}
+async function readDockerKey(files) {
+  let pem;
+  try {
+    pem = await readFile3(files.key, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return null;
+    throw err;
+  }
+  const key = createPrivateKey2(pem);
+  if (!isP256(key))
+    throw new Error(`${files.key} is not an ECDSA P-256 key.`);
+  return key;
+}
+function uriSan(certificate, prefix) {
+  for (const name of (certificate.subjectAltName ?? "").split(/,\s*/)) {
+    if (name.startsWith(`URI:${prefix}`))
+      return name.slice(`URI:${prefix}`.length);
+  }
+  return null;
+}
+function parseClientCertificate(pem, key) {
+  const certificate = new X509Certificate(pem);
+  if (!certificate.checkPrivateKey(key)) {
+    throw new Error("The certificate is not for this machine's Docker key.");
+  }
+  return {
+    pem,
+    serial: certificate.serialNumber.toLowerCase(),
+    notAfter: new Date(certificate.validTo),
+    deviceId: uriSan(certificate, DOCKER_CLIENT_URI_PREFIX.device),
+    organizationId: uriSan(certificate, DOCKER_CLIENT_URI_PREFIX.organization)
+  };
+}
+async function readClientCertificate(files, key) {
+  try {
+    const [pem] = await Promise.all([readFile3(files.cert, "utf8"), readFile3(files.ca, "utf8")]);
+    return parseClientCertificate(pem, key);
+  } catch {
+    return null;
+  }
+}
+var DAY_MS = 24 * 60 * 60 * 1000;
+function certificateDue(certificate, deviceId, now) {
+  return certificate.deviceId !== deviceId || certificate.notAfter.getTime() - now.getTime() < DOCKER_CERTIFICATE_RENEW_DAYS * DAY_MS;
+}
+async function readCertificateMeta(files) {
+  try {
+    const parsed = JSON.parse(await readFile3(files.meta, "utf8"));
+    if (typeof parsed.baseUrl === "string" && typeof parsed.organization?.id === "string" && typeof parsed.organization.slug === "string") {
+      return {
+        baseUrl: parsed.baseUrl,
+        organization: { id: parsed.organization.id, slug: parsed.organization.slug },
+        serial: typeof parsed.serial === "string" ? parsed.serial : "",
+        notAfter: typeof parsed.notAfter === "string" ? parsed.notAfter : ""
+      };
+    }
+  } catch {}
+  return null;
+}
+async function writeIssuedCertificate(files, issued) {
+  await writeFileAtomic(files.ca, issued.caPem, 420);
+  await writeFileAtomic(files.cert, issued.certificatePem, 420);
+  await writeFileAtomic(files.meta, `${JSON.stringify(issued.meta, null, 2)}
+`, 420);
+}
+function contextsPath(dockerDir) {
+  return join3(dockerDir, "contexts.json");
+}
+async function readContexts(dockerDir) {
+  try {
+    const parsed = JSON.parse(await readFile3(contextsPath(dockerDir), "utf8"));
+    return (parsed.contexts ?? []).filter((c) => typeof c?.name === "string" && typeof c.organizationId === "string" && typeof c.sandbox === "string");
+  } catch {
+    return [];
+  }
+}
+async function writeContexts(dockerDir, contexts) {
+  const unique = [...new Map(contexts.map((c) => [c.name, c])).values()].sort((a, b) => a.name.localeCompare(b.name));
+  await writeFileAtomic(contextsPath(dockerDir), `${JSON.stringify({ contexts: unique }, null, 2)}
+`, 420);
+}
+async function recordContext(dockerDir, context) {
+  const others = (await readContexts(dockerDir)).filter((c) => c.name !== context.name);
+  await writeContexts(dockerDir, [...others, context]);
+}
+
+// src/docker/certificates.ts
+function execDocker(command, args) {
+  const result = spawnSync(command, args, { encoding: "utf8" });
+  return {
+    status: result.status ?? 1,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? result.error?.message ?? ""
+  };
+}
+async function issueCertificate(input, request) {
+  const body = {
+    organization: input.organizationId,
+    deviceId: input.deviceId,
+    csrPem: buildCsrPem(input.key, input.deviceId)
+  };
+  const issued = await request("/api/v1/docker/certificates", {
+    method: "POST",
+    body: JSON.stringify(body)
+  });
+  const certificate = parseClientCertificate(issued.certificatePem, input.key);
+  if (certificate.deviceId !== input.deviceId || issued.organization.id !== input.organizationId || certificate.organizationId !== null && certificate.organizationId !== input.organizationId) {
+    throw new Error("The app sent a certificate for another device or organization: not stored.");
+  }
+  const meta = {
+    baseUrl: input.baseUrl,
+    organization: issued.organization,
+    serial: certificate.serial,
+    notAfter: certificate.notAfter.toISOString()
+  };
+  await writeIssuedCertificate(input.files, {
+    certificatePem: issued.certificatePem,
+    caPem: issued.caPem,
+    meta
+  });
+  return { certificate, meta };
+}
+async function ensureCertificate(input, request) {
+  const key = await loadOrCreateDockerKey(input.files);
+  const stored = await readClientCertificate(input.files, key);
+  if (stored && !certificateDue(stored, input.deviceId, input.now)) {
+    return { certificate: stored, issued: false };
+  }
+  const { certificate } = await issueCertificate({ ...input, key }, request);
+  return { certificate, issued: true };
+}
+function message(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function day(date) {
+  return date.toISOString().slice(0, 10);
+}
+async function renewDockerCertificates(deps, options = {}) {
+  const exec = deps.exec ?? execDocker;
+  const dockerDir = deps.dockerDir ?? dockerDirFor(deps.dir);
+  const now = (deps.now ?? (() => new Date))();
+  let organizationIds;
+  let state;
+  try {
+    organizationIds = (await listOrganizationIds(dockerDir)).filter((id) => id !== options.except);
+    state = organizationIds.length > 0 ? await readDeviceState(deps.dir) : null;
+  } catch (err) {
+    deps.notice(`Could not check the Docker certificates: ${message(err)}`);
+    return;
+  }
+  if (!state || !deps.has("docker"))
+    return;
+  const deviceId = state.deviceId;
+  let contexts = await readContexts(dockerDir);
+  let contextsChanged = false;
+  for (const organizationId of organizationIds) {
+    const files = organizationFiles(dockerDir, organizationId);
+    const meta = await readCertificateMeta(files);
+    const label = meta?.organization.slug ?? organizationId;
+    try {
+      if (meta && meta.baseUrl !== state.baseUrl)
+        continue;
+      const key = await readDockerKey(files);
+      const stored = key ? await readClientCertificate(files, key) : null;
+      if (!key || !stored || !certificateDue(stored, deviceId, now))
+        continue;
+      const { certificate } = await issueCertificate({ files, key, organizationId, deviceId, baseUrl: state.baseUrl }, deps.request);
+      const updated = [];
+      for (const context of contexts.filter((c) => c.organizationId === organizationId)) {
+        const host = contextHost(exec, context.name);
+        if (host === null) {
+          contexts = contexts.filter((c) => c.name !== context.name);
+          contextsChanged = true;
+          continue;
+        }
+        writeContext(exec, {
+          name: context.name,
+          description: contextDescription(context.sandbox, label),
+          host,
+          files
+        });
+        updated.push(context.name);
+      }
+      deps.notice(`Renewed the Docker certificate for ${label}, valid until ${day(certificate.notAfter)}${updated.length > 0 ? `; updated ${updated.join(", ")}` : ""}.`);
+    } catch (err) {
+      deps.notice(`Could not renew the Docker certificate for ${label} (${message(err)}). Run \`${getCliName()} docker context <sandbox> --org ${label}\` to try again.`);
+    }
+  }
+  if (contextsChanged) {
+    try {
+      await writeContexts(dockerDir, contexts);
+    } catch (err) {
+      deps.notice(`Could not update ${dockerDir}/contexts.json: ${message(err)}`);
+    }
+  }
+}
+
+// src/settings.ts
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname4, join as join4 } from "node:path";
 function getSettingsPath() {
-  return join3(dirname3(getCredentialsPath()), "settings.json");
+  return join4(dirname4(getCredentialsPath()), "settings.json");
 }
 function isDefaultOrganization(value) {
   if (!value || typeof value !== "object")
@@ -9805,15 +10203,15 @@ function isDefaultOrganization(value) {
 }
 async function readSettings(path = getSettingsPath()) {
   try {
-    const parsed = JSON.parse(await readFile3(path, "utf8"));
+    const parsed = JSON.parse(await readFile4(path, "utf8"));
     return isDefaultOrganization(parsed.defaultOrganization) ? { defaultOrganization: parsed.defaultOrganization } : {};
   } catch {
     return {};
   }
 }
 async function writeSettings(settings, path = getSettingsPath()) {
-  await mkdir3(dirname3(path), { recursive: true });
-  await writeFile3(path, `${JSON.stringify(settings, null, 2)}
+  await mkdir4(dirname4(path), { recursive: true });
+  await writeFile4(path, `${JSON.stringify(settings, null, 2)}
 `, "utf8");
 }
 
@@ -9878,1588 +10276,1769 @@ async function resolveOrganizationId(flag) {
   return (await findMyOrganization(await requireOrganizationRef(flag))).id;
 }
 
-// src/commands/env.ts
-function reportError(err, error) {
-  if (err instanceof AuthRequiredError || err instanceof Error) {
-    error(err.message);
-  } else {
-    error(String(err));
-  }
-  return 1;
+// src/commands/network.ts
+import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
+import { hostname } from "node:os";
+function defaultDeps() {
+  return {
+    request: authorizedRequest,
+    run: (command, args) => new Promise((resolve, reject) => {
+      const child = spawn(command, args, { stdio: "inherit" });
+      child.on("error", reject);
+      child.on("close", (code) => resolve(code ?? 1));
+    }),
+    output: (command, args) => {
+      const result = spawnSync2(command, args, { encoding: "utf8" });
+      return result.status === 0 ? result.stdout : "";
+    },
+    platform: process.platform,
+    has: (command) => spawnSync2("sh", ["-c", `command -v ${command}`]).status === 0,
+    dir: networkDir(),
+    up: () => tunnelUp(),
+    exists: existsSync2,
+    log: console.log,
+    error: printError,
+    notice: printNotice
+  };
 }
-function invokeTool(tool, input) {
-  return authorizedRequest(`/api/v1/tools/${tool}`, {
-    method: "POST",
-    body: JSON.stringify(input)
-  });
+function message2(err) {
+  return err instanceof Error ? err.message : String(err);
 }
-function displayValue(entry) {
-  if (entry.valueOmittedReason === "secret")
-    return "<secret>";
-  if (entry.valueOmittedReason === "too_large") {
-    return `<${entry.valueLength} chars — read with \`${getCliName()} env get\`>`;
-  }
-  return entry.value ?? "";
+function connectCommandFor(provider) {
+  const ref = provider.connectRef;
+  const arg = /^[A-Za-z0-9._-]+$/.test(ref) ? ref : JSON.stringify(ref);
+  return `${getCliName()} network connect ${arg}`;
 }
-function formatTable(entries) {
-  const rows = entries.map((entry) => [
-    entry.name,
-    entry.kind,
-    displayValue(entry),
-    entry.comment ?? ""
-  ]);
-  const header = ["NAME", "KIND", "VALUE", "COMMENT"];
-  const widths = header.map((_, column) => Math.max(header[column]?.length ?? 0, ...rows.map((row) => row[column]?.length ?? 0)));
-  const line = (cells) => cells.map((cell, column) => column === cells.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
-  return [line(header), ...rows.map(line)].join(`
-`);
+async function wgQuick(deps, verb) {
+  const args = ["wg-quick", verb, configPath(deps.dir)];
+  deps.notice(`Running: sudo ${args.join(" ")}`);
+  return deps.run("sudo", args);
 }
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(Buffer.from(chunk));
+async function runNetworkConnect(args = {}, deps = defaultDeps()) {
+  suppressPausedNotice();
+  if (!deps.has("wg-quick")) {
+    deps.error(`wg-quick is not installed. ${installHint()}`);
+    return 1;
   }
-  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
-}
-async function runEnvList(args, log = console.log, error = printError) {
+  let registered;
+  let privateKey;
+  const previous = await readDeviceState(deps.dir);
   try {
-    const result = await invokeTool("env_list", {
-      organization: args.organization
+    const organization = await requireOrganizationRef(args.org, deps.notice);
+    const provider = args.provider?.trim();
+    const key = await loadOrCreateKey(deps.dir);
+    privateKey = key.privateKey;
+    registered = await deps.request("/api/v1/network/devices", {
+      method: "POST",
+      body: JSON.stringify({
+        publicKey: key.publicKey,
+        name: hostname().slice(0, 64) || "device",
+        organization,
+        ...provider ? { provider } : {}
+      })
     });
-    if (args.json) {
-      log(JSON.stringify(result.entries, null, 2));
-      return 0;
-    }
-    if (result.entries.length === 0) {
-      log("  No variables or secrets.");
-      return 0;
-    }
-    log(formatTable(result.entries));
-    return 0;
   } catch (err) {
-    return reportError(err, error);
+    deps.error(message2(err));
+    return 1;
   }
-}
-async function runEnvGet(args, log = console.log, error = printError) {
+  const dns = detectDnsMode();
+  let config;
   try {
-    const result = await invokeTool("env_get", {
-      organization: args.organization,
-      name: args.name
-    });
-    log(args.json ? JSON.stringify(result.entry, null, 2) : result.entry.value ?? "");
-    return 0;
+    config = renderConfig({ privateKey, registered, dns });
   } catch (err) {
-    return reportError(err, error);
-  }
-}
-function resolveKind(args) {
-  if (args.kind !== undefined && args.kind !== "variable" && args.kind !== "secret") {
-    return { error: `--kind must be "variable" or "secret", got "${args.kind}".` };
-  }
-  const fromKind = args.kind;
-  if (args.secret && fromKind === "variable") {
-    return { error: "Pass either --secret or --kind variable, not both." };
-  }
-  return { kind: fromKind ?? (args.secret ? "secret" : undefined) };
-}
-async function runEnvSet(args, log = console.log, error = printError, stdin = readStdin) {
-  if (args.value !== undefined && args.valueStdin) {
-    error("Pass either --value or --value-stdin, not both.");
-    return 1;
-  }
-  if (args.value === undefined && !args.valueStdin) {
-    error("Provide --value, or --value-stdin to read the value from stdin.");
-    return 1;
-  }
-  const resolved = resolveKind(args);
-  if ("error" in resolved) {
-    error(resolved.error);
+    deps.error(message2(err));
     return 1;
   }
-  const value = args.valueStdin ? await stdin() : args.value ?? "";
-  try {
-    const result = await invokeTool("env_set", {
-      organization: args.organization,
-      name: args.name,
-      value,
-      ...resolved.kind ? { kind: resolved.kind } : {},
-      ...args.comment ? { comment: args.comment } : {}
-    });
-    if (args.json) {
-      log(JSON.stringify(result, null, 2));
-      return 0;
-    }
-    log(eventLine("done", `${result.created ? "Created" : "Updated"} ${result.entry.kind} ${result.entry.name}.`));
-    if (result.previousKind === "secret") {
-      log(eventLine("item", `Warning: ${result.entry.name} was a secret and is now a variable — its value is readable by everyone in the organization.`));
-    } else if (result.previousKind === "variable") {
-      log(eventLine("item", `${result.entry.name} was a variable and is now a secret; its value is no longer shown.`));
-    }
+  const previousConfig = await readConfig(configPath(deps.dir));
+  await writeConfig(config, configPath(deps.dir));
+  await writeDeviceState({
+    baseUrl: getBaseUrl(),
+    deviceId: registered.device.id,
+    address: registered.device.address ?? "",
+    gatewayProvider: registered.provider,
+    zones: [
+      registered.network.zone,
+      ...registered.network.netZone ? [registered.network.netZone] : []
+    ]
+  }, deps.dir);
+  const wasUp = deps.up();
+  if (wasUp && previousConfig === config) {
+    const { device, network, provider, shortNameOrganizationChanged } = registered;
+    printResult({
+      device,
+      network,
+      provider,
+      shortNameOrganizationChanged,
+      interface: INTERFACE,
+      dns,
+      rearmed: true,
+      pause: device.state
+    }, () => [
+      eventLine("done", rearmedLine(device.state)),
+      ...network.netZone && device.shortNameOrganization && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : []
+    ], deps.log);
+    printPauseHint(device.state, deps);
+    await renewDockerCertificates(deps);
     return 0;
-  } catch (err) {
-    return reportError(err, error);
   }
-}
-async function runEnvDelete(args, log = console.log, error = printError) {
-  try {
-    await invokeTool("env_delete", {
-      organization: args.organization,
-      name: args.name
-    });
-    log(eventLine("done", `Deleted ${args.name}.`));
-    return 0;
-  } catch (err) {
-    return reportError(err, error);
+  if (wasUp) {
+    const down = await wgQuick(deps, "down");
+    if (down !== 0) {
+      deps.error(`Could not take the old tunnel down (wg-quick exited ${down}).`);
+      return 1;
+    }
   }
-}
-var nameArg = {
-  type: "positional",
-  description: "Environment variable name.",
-  required: true
-};
-var envCommand = defineCommand({
-  meta: {
-    name: "env",
-    description: "Manage organization environment variables and secrets."
-  },
-  subCommands: {
-    list: defineCommand({
-      meta: { name: "list", description: "List variables and secrets." },
-      args: {
-        org: orgArg
-      },
-      async run({ args }) {
-        process.exitCode = await withOrganization(args.org, (organization) => runEnvList({
-          organization,
-          json: isJsonOutput()
-        }));
-      }
-    }),
-    get: defineCommand({
-      meta: {
-        name: "get",
-        description: "Print one variable value in full (secrets cannot be read)."
-      },
-      args: {
-        name: nameArg,
-        org: orgArg
-      },
-      async run({ args }) {
-        process.exitCode = await withOrganization(args.org, (organization) => runEnvGet({
-          organization,
-          name: args.name,
-          json: isJsonOutput()
-        }));
-      }
-    }),
-    set: defineCommand({
-      meta: { name: "set", description: "Create or replace a variable or secret." },
-      args: {
-        name: nameArg,
-        org: orgArg,
-        value: { type: "string", description: "Value to store." },
-        "value-stdin": {
-          type: "boolean",
-          description: "Read the value from stdin — keeps secrets out of shell history.",
-          default: false
-        },
-        secret: {
-          type: "boolean",
-          description: "Shorthand for --kind secret. Required when creating a secret.",
-          default: false
-        },
-        kind: {
-          type: "string",
-          description: "variable or secret. Required when creating; on an update, omit to keep the existing kind or pass the other to convert."
-        },
-        comment: { type: "string", description: "Note about what this value is for." }
-      },
-      async run({ args }) {
-        process.exitCode = await withOrganization(args.org, (organization) => runEnvSet({
-          organization,
-          name: args.name,
-          value: args.value,
-          valueStdin: args["value-stdin"],
-          secret: args.secret,
-          kind: args.kind,
-          comment: args.comment,
-          json: isJsonOutput()
-        }));
-      }
-    }),
-    delete: defineCommand({
-      meta: { name: "delete", description: "Delete a variable or secret." },
-      args: {
-        name: nameArg,
-        org: orgArg
-      },
-      async run({ args }) {
-        process.exitCode = await withOrganization(args.org, (organization) => runEnvDelete({
-          organization,
-          name: args.name
-        }));
-      }
-    })
+  const ipv4Clashes = ipv4Clashes4(registered, deps);
+  const code = await wgQuick(deps, "up");
+  if (code !== 0) {
+    deps.error(`wg-quick exited ${code}. The config is in ${configPath(deps.dir)}.`);
+    return 1;
   }
-});
-
-// src/container-picker.ts
-import { createInterface } from "node:readline/promises";
-function notRunningContainerOf(error) {
-  if (!(error instanceof ApiError) || !error.data || typeof error.data !== "object")
-    return null;
-  const { code, params } = error.data;
-  if (code !== "container_not_running")
-    return null;
-  const container = params && typeof params === "object" ? params : {};
-  return typeof container.container === "string" && container.container ? container.container : null;
+  const { device, network, provider, shortNameOrganizationChanged } = registered;
+  const pinned = device.shortNameOrganization;
+  const switched = wasUp && previous?.gatewayProvider && previous.gatewayProvider.id !== provider.id ? previous.gatewayProvider : null;
+  printResult({
+    device,
+    network,
+    provider,
+    shortNameOrganizationChanged,
+    interface: INTERFACE,
+    dns,
+    rearmed: false,
+    pause: device.state
+  }, () => [
+    eventLine("done", `Connected through ${provider.name}. This machine is ${device.address} in the private network.`),
+    ...switched ? [
+      `    Replaced the connection through ${switched.name}: its sandboxes are out of reach now.`
+    ] : [],
+    `    Reachable: the sandboxes on ${provider.name}. One provider at a time.`,
+    `    Names: <sandbox>.<org>.${network.zone}`,
+    ...network.netZone ? [`    In a browser: https://<sandbox>--<org>.${network.netZone}:<port>`] : [],
+    ...network.netZone && pinned ? [
+      `    Short names: https://<sandbox>.${network.netZone}:<port> for ${pinned.slug}'s sandboxes, on this machine.`,
+      `    Another organization: ${getCliName()} network connect --org <org>.`
+    ] : [],
+    ...network.netZone && pinned && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : [],
+    ...network.ingress4 && !device.address4 ? [
+      "    No IPv4 address was free on this provider's host, so browser names work over IPv6 only:",
+      "    Chrome on a network without IPv6 cannot open them on this machine. Firefox and Safari",
+      "    can. Run connect again later: an address frees up when another device goes."
+    ] : [],
+    ...ipv4Clashes.map(({ address, owner }) => `    ${address} is already routed through ${owner} on this machine: browsers may not reach the private network's names over IPv4 while it is. Ask your Ghostdock admin about the IPv4 block.`),
+    ...dns === "none" ? [
+      "    No split DNS on this machine (no systemd-resolved): use the addresses from",
+      `    \`${getCliName()} network ls\`.`
+    ] : [],
+    `    → ${getCliName()} network ls`
+  ], deps.log);
+  printPauseHint(device.state, deps);
+  await renewDockerCertificates(deps);
+  return 0;
 }
-function containerQuestionOf(error) {
-  if (!(error instanceof ApiError) || !error.data || typeof error.data !== "object")
-    return null;
-  const { code, params } = error.data;
-  if (code !== "container_choice_required" && code !== "container_default_missing")
-    return null;
-  const record = params && typeof params === "object" ? params : {};
-  const running = typeof record.containers === "string" ? record.containers.split(",").map((name) => name.trim()).filter(Boolean) : [];
-  if (running.length === 0)
-    return null;
-  return {
-    running,
-    ...code === "container_default_missing" && typeof record.container === "string" ? { missingDefault: record.container } : {}
-  };
+function rearmedLine(state, now = new Date) {
+  if (!state)
+    return "Re-armed.";
+  const until = clockTime(new Date(now.getTime() + state.maxSessionSeconds * 1000).toISOString(), now);
+  return `Re-armed: network access for this device runs until ${until} (pauses after ${formatPauseLimit(state.idleTimeoutSeconds)} idle).`;
 }
-var say = (line) => process.stderr.write(`${line}
-`);
-var chooseContainerOnTerminal = async ({ running, missingDefault }) => {
-  if (missingDefault) {
-    say(`
-The default container ${missingDefault} is gone.`);
+function printPauseHint(state, deps) {
+  if (!state || isJsonOutput())
+    return;
+  const [first = "", ...rest] = pauseHint(state);
+  deps.notice(["", bold2(first), ...rest].join(`
+`));
+}
+function ipv4Clashes4(registered, deps) {
+  const addresses = [registered.network.ingress4, registered.device.address4].filter((a) => typeof a === "string" && isIPv4Address(a));
+  const clashes = [];
+  for (const address of addresses) {
+    const [command, args] = ipv4RouteCommand(deps.platform, address);
+    const owner = ipv4RouteOwner(deps.platform, deps.output(command, args));
+    if (owner)
+      clashes.push({ address, owner });
   }
-  say(missingDefault ? "Which container?" : `
-Several containers are running. Which one?`);
-  running.forEach((name, index) => {
-    say(`  ${index + 1}. ${name}`);
-  });
-  const prompt = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = (await prompt.question("Number (Enter to cancel): ")).trim();
-    const index = Number.parseInt(answer, 10) - 1;
-    return Number.isInteger(index) && index >= 0 && index < running.length ? running[index] ?? null : null;
-  } finally {
-    prompt.close();
+  return clashes;
+}
+function clearingNotice(cookieSite) {
+  const site = cookieSite?.site ?? "the net domain";
+  return [
+    "    Short names meant another organization's sandboxes before. The first short-name site each",
+    `    browser opens now clears its data once: the site's storage, and every cookie of ${site}.`,
+    `    That signs the browser out of every site under ${site}${cookieSite?.includesApp ? ", the Ghostdock app included" : ""}.`,
+    "    Reload or close browser tabs opened on short names before this connect."
+  ];
+}
+async function staleResolverFiles(deps) {
+  if (deps.platform !== "darwin")
+    return [];
+  const state = await readDeviceState(deps.dir);
+  const zones = new Set([
+    ...configResolverZones(await readConfig(configPath(deps.dir))),
+    ...state?.zones ?? []
+  ]);
+  return [...zones].map(resolverFile).filter((file) => deps.exists(file));
+}
+async function runNetworkDisconnect(deps = defaultDeps()) {
+  const wasUp = deps.up();
+  let failed = false;
+  if (wasUp) {
+    const code = await wgQuick(deps, "down");
+    if (code !== 0) {
+      deps.error(`wg-quick exited ${code}.`);
+      failed = true;
+    }
   }
-};
-var confirmDefaultOnTerminal = async (container) => {
-  const prompt = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = (await prompt.question(`Make ${container} the default? [y/N] `)).trim();
-    return /^y(es)?$/i.test(answer);
-  } finally {
-    prompt.close();
+  const stale = await staleResolverFiles(deps);
+  if (stale.length) {
+    const args = ["rm", "-f", ...stale];
+    deps.notice(`Removing split DNS left from an earlier connection. Running: sudo ${args.join(" ")}`);
+    const code = await deps.run("sudo", args);
+    if (code !== 0) {
+      deps.error(`Could not remove ${stale.join(", ")} (rm exited ${code}).`);
+      return 1;
+    }
   }
-};
-var confirmStartOnTerminal = async (container) => {
-  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  if (failed)
+    return 1;
+  printResult({ connected: false, removedSplitDns: stale }, () => [
+    wasUp ? eventLine("done", "Disconnected.") : eventLine(stale.length ? "done" : "item", stale.length ? "Not connected; removed the leftover split DNS." : "Not connected.")
+  ], deps.log);
+  return 0;
+}
+async function readConnection(deps) {
+  const state = await readDeviceState(deps.dir);
+  const up = deps.up();
+  if (!state)
+    return { state, up, device: null, asked: true, provider: null, staleMtu: null };
   try {
-    const answer = (await prompt.question(`Container ${container} is not running. Start it? [Y/n] `)).trim();
-    return answer === "" || /^y(es)?$/i.test(answer);
-  } finally {
-    prompt.close();
+    const { devices, mtu } = await deps.request("/api/v1/network/devices");
+    const device = devices.find((d) => d.id === state.deviceId) ?? null;
+    const config = await readConfigMtu(configPath(deps.dir));
+    const staleMtu = config !== null && config !== mtu ? { config, current: mtu } : null;
+    if (staleMtu) {
+      deps.notice(`This machine's tunnel has MTU ${staleMtu.config}, the network now uses ${staleMtu.current}. ` + `Run \`${getCliName()} network connect\` again: until then, large packets other than TCP ` + "can be lost on the way.");
+    }
+    return {
+      state,
+      up,
+      device,
+      asked: true,
+      provider: up ? device?.gatewayProvider ?? null : null,
+      staleMtu
+    };
+  } catch (err) {
+    deps.notice(`Could not ask the app about this device: ${message2(err)}`);
+    return {
+      state,
+      up,
+      device: null,
+      asked: false,
+      provider: up ? state.gatewayProvider : null,
+      staleMtu: null
+    };
   }
-};
-function defaultContainerPickers() {
-  return process.stdin.isTTY && process.stderr.isTTY ? {
-    choose: chooseContainerOnTerminal,
-    confirmDefault: confirmDefaultOnTerminal,
-    confirmStart: confirmStartOnTerminal
-  } : undefined;
 }
-
-// src/progress.ts
-var PROGRESS_FRAMES = ["▂▄▆", "▄▆█", "▆█▆", "█▆▄", "▆▄▂", "▄▂▄"];
-var FRAME_MS = 120;
-function formatElapsed(ms) {
-  return ms < 1000 ? `${Math.round(ms)}ms` : `${(ms / 1000).toFixed(1)}s`;
+async function runNetworkStatus(deps = defaultDeps()) {
+  const { state, up, device, asked, provider, staleMtu } = await readConnection(deps);
+  const staleSplitDns = up ? [] : await staleResolverFiles(deps);
+  for (const file of staleSplitDns) {
+    deps.notice(`Split DNS from an earlier connection is still set (${file}): names of the private network will hang. Run: ${getCliName()} network disconnect`);
+  }
+  printResult({ connected: up, device, provider, staleMtu, staleSplitDns }, () => {
+    if (!state) {
+      return [eventLine("item", `Not set up. Run \`${getCliName()} network connect\`.`)];
+    }
+    const through = provider ? ` through ${provider.name}` : "";
+    const lines = [
+      eventLine("item", `${up ? `Connected${through}` : "Not connected"}: ${state.address}`)
+    ];
+    if (device) {
+      lines.push(`    Device ${device.name}, valid until ${device.expiresAt.slice(0, 10)}.`);
+      lines.push(`    ${deviceStateText(device.state)}.`);
+      if (device.shortNameOrganization) {
+        lines.push(`    Short names: ${device.shortNameOrganization.slug}'s sandboxes.`);
+      }
+      if (!device.gatewayProvider) {
+        lines.push(`    Its provider is gone, so no gateway serves it. Run \`${getCliName()} network connect\`.`);
+      }
+    } else if (asked) {
+      lines.push(`    The app no longer knows this device (removed, expired or logged out). Run \`${getCliName()} network connect\`.`);
+    }
+    if (provider)
+      lines.push(`    Reachable: the sandboxes on ${provider.name}.`);
+    return lines;
+  }, deps.log);
+  return 0;
 }
-function startProgress(message, options = {}) {
-  const stream = options.stream ?? process.stderr;
-  const now = options.now ?? Date.now;
-  const started = now();
-  const elapsed = () => formatElapsed(now() - started);
-  if (isJsonOutput())
-    return { stop: elapsed };
-  const animate = options.animate ?? stream.isTTY === true;
-  if (!animate) {
-    stream.write(`  ${SYMBOLS.progress} ${message}
-`);
-    return { stop: elapsed };
+function unreachableNote(sandbox, connected) {
+  if (!sandbox.provider.privateNetwork) {
+    return `not reachable: ${sandbox.provider.name} has no private network yet`;
   }
-  const color = colorEnabled(stream);
-  let frame = 0;
-  const draw = () => {
-    const bars = accent(PROGRESS_FRAMES[frame % PROGRESS_FRAMES.length] ?? SYMBOLS.progress, color);
-    stream.write(`\r\x1B[2K  ${bars} ${message} ${dim(elapsed(), color)}`);
-    frame += 1;
-  };
-  const restore = () => stream.write("\r\x1B[2K\x1B[?25h");
-  const onInterrupt = () => {
-    restore();
-    process.exit(130);
-  };
-  stream.write("\x1B[?25l");
-  draw();
-  const timer = setInterval(draw, FRAME_MS);
-  timer.unref?.();
-  process.once("SIGINT", onInterrupt);
-  let stopped = false;
-  return {
-    stop() {
-      if (!stopped) {
-        stopped = true;
-        clearInterval(timer);
-        process.off("SIGINT", onInterrupt);
-        restore();
+  if (connected?.id === sandbox.provider.id)
+    return null;
+  return `not reachable: on ${sandbox.provider.name} → ${connectCommandFor(sandbox.provider)}`;
+}
+async function runNetworkLs(args, deps = defaultDeps()) {
+  try {
+    const organization = await requireOrganizationRef(args.org, deps.notice);
+    const connection = await readConnection(deps);
+    const deviceId = connection.device?.id;
+    const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes${deviceId ? `?device=${encodeURIComponent(deviceId)}` : ""}`);
+    const connected = connection.provider;
+    const sandboxes = listed.sandboxes.map((sandbox) => ({
+      ...sandbox,
+      reachable: unreachableNote(sandbox, connected) === null
+    }));
+    printResult({ ...listed, connectedProvider: connected, sandboxes }, () => {
+      if (listed.sandboxes.length === 0) {
+        return [eventLine("item", `No sandboxes in ${listed.organization.slug}.`)];
       }
-      return elapsed();
-    }
-  };
-}
-async function withProgress(message, work, options) {
-  const progress = startProgress(message, options);
-  try {
-    const value = await work();
-    return { value, elapsed: progress.stop() };
+      const width = Math.max(...listed.sandboxes.map((s) => s.name.length));
+      const canonicalWidth = Math.max(...listed.sandboxes.map((s) => s.canonicalName.length));
+      const httpsWidth = Math.max(...listed.sandboxes.map((s) => (s.httpsName?.length ?? 0) + 8));
+      const shortWidth = Math.max(...listed.sandboxes.map((s) => (s.shortName?.length ?? 0) + 8));
+      const lines = [
+        connected ? eventLine("item", `Connected through ${connected.name}.`) : eventLine("item", `Not connected: nothing is reachable. Run \`${getCliName()} network connect [provider]\`.`)
+      ];
+      for (const s of listed.sandboxes) {
+        const note = unreachableNote(s, connected);
+        lines.push([
+          `  ${s.name.padEnd(width)}`,
+          (s.address ?? "-").padEnd(28),
+          s.canonicalName.padEnd(canonicalWidth),
+          ...s.httpsName ? [`https://${s.httpsName}`.padEnd(httpsWidth)] : [],
+          ...s.shortName ? [`https://${s.shortName}`.padEnd(shortWidth)] : [],
+          s.status,
+          ...note ? [`(${note})`] : []
+        ].join("  "));
+      }
+      return lines;
+    }, deps.log);
+    return 0;
   } catch (err) {
-    progress.stop();
-    throw err;
+    deps.error(message2(err));
+    return 1;
   }
 }
-
-// src/container-flow.ts
-async function withContainerPick(call, send, pickers, notice) {
+async function runNetworkDevices(deps = defaultDeps()) {
   try {
-    return await send();
+    const { devices } = await deps.request("/api/v1/network/devices");
+    const own = (await readDeviceState(deps.dir))?.deviceId;
+    printResult({ devices }, () => devices.length === 0 ? [eventLine("item", "No devices.")] : devices.map((d) => `  ${d.id === own ? "*" : " "} ${d.id}  ${d.name}  ${d.address}  until ${d.expiresAt.slice(0, 10)}  ${deviceStateText(d.state)}`), deps.log);
+    return 0;
   } catch (err) {
-    const question = containerQuestionOf(err);
-    if (!pickers || !question || !call.canPick)
-      throw err;
-    const container = await pickers.choose(question);
-    if (!container)
-      throw err;
-    call.setContainer(container);
-    const result = await send();
-    if (call.sandboxId !== undefined && await pickers.confirmDefault(container)) {
-      try {
-        await authorizedRequest("/api/v1/tools/sandboxes_default_container", {
-          method: "POST",
-          body: JSON.stringify({
-            organization: call.organization,
-            sandboxId: call.sandboxId,
-            container
-          })
-        });
-        notice(eventLine("done", `Default container: ${container}.`));
-      } catch (err) {
-        notice(eventLine("failed", `The default container was not set: ${err instanceof Error ? err.message : String(err)}`));
-      }
-    }
-    return result;
+    deps.error(message2(err));
+    return 1;
   }
 }
-async function withContainerStart(call, send, start, pickers, notice) {
+async function runNetworkDevicesRemove(args, deps = defaultDeps()) {
   try {
-    return await send();
+    await deps.request(`/api/v1/network/devices/${encodeURIComponent(args.id)}`, {
+      method: "DELETE"
+    });
+    printResult({ removed: args.id }, () => [eventLine("done", `Removed device ${args.id}.`)], deps.log);
+    return 0;
   } catch (err) {
-    const container = notRunningContainerOf(err);
-    if (!container || call.sandboxId === undefined)
-      throw err;
-    if (!start && !(pickers && await pickers.confirmStart(container)))
-      throw err;
-    await withProgress("Starting container…", () => authorizedRequest("/api/v1/tools/sandboxes_containers_start", {
-      method: "POST",
-      body: JSON.stringify({
-        organization: call.organization,
-        sandboxId: call.sandboxId,
-        container
-      })
-    }));
-    notice(eventLine("done", `Started ${container}.`));
-    return await send();
+    deps.error(message2(err));
+    return 1;
   }
 }
-
-// src/container-logs.ts
-var FOLLOW_INTERVAL_MS = 2000;
-function defaultLogsDeps(follow) {
-  let stop = false;
-  if (follow) {
-    process.once("SIGINT", () => {
-      stop = true;
-    });
+var connectCommand = defineCommand({
+  meta: {
+    name: "connect",
+    description: "Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Also re-arms a paused device: with the tunnel up and nothing changed, without sudo."
+  },
+  args: {
+    provider: {
+      type: "positional",
+      required: false,
+      description: "Sandbox provider name or id. Omit for the organization's default provider (else the platform default). Only its sandboxes are reachable; connecting through another replaces the connection."
+    },
+    org: orgArg
+  },
+  async run({ args }) {
+    process.exitCode = await runNetworkConnect({ provider: args.provider, org: args.org });
   }
-  return {
-    request: (input) => authorizedRequest("/api/v1/tools/sandboxes_containers_logs", {
-      method: "POST",
-      body: JSON.stringify(input)
-    }),
-    out: (line) => process.stdout.write(`${line}
-`),
-    err: (line) => process.stderr.write(`${line}
-`),
-    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-    stopped: () => stop
-  };
-}
-async function runContainerLogs(input, options, deps = defaultLogsDeps(options.follow)) {
-  const json = isJsonOutput();
-  const color = colorEnabled(process.stdout);
-  const print = (line) => {
-    if (json) {
-      deps.out(JSON.stringify(line));
-      return;
-    }
-    const text = options.timestamps && line.time ? `${dim(line.time, color)} ${line.text}` : line.text;
-    (line.stream === "stderr" ? deps.err : deps.out)(text);
-  };
-  let result = await deps.request(input);
-  if (!result.running) {
-    deps.err("The sandbox is stopped: it has no logs to show.");
-    return 1;
+});
+var disconnectCommand = defineCommand({
+  meta: {
+    name: "disconnect",
+    description: "Take this machine out of the private network, and remove split DNS an earlier connection left (macOS)."
+  },
+  async run() {
+    process.exitCode = await runNetworkDisconnect();
   }
-  let last = null;
-  for (;; ) {
-    for (const line of result.lines) {
-      print(line);
-      if (line.time)
-        last = line.time;
-    }
-    if (!options.follow) {
-      if (result.truncated && json) {
-        deps.out(JSON.stringify({ truncated: true }));
-      } else if (result.truncated) {
-        deps.err(dim("(older lines left out: use --tail for more)", colorEnabled(process.stderr)));
-      }
-      return 0;
-    }
-    if (!result.truncated)
-      await deps.sleep(FOLLOW_INTERVAL_MS);
-    if (deps.stopped())
-      return 0;
-    const { tail: _tail, ...rest } = input;
-    try {
-      result = await deps.request(last ? { ...rest, after: last } : input);
-    } catch (error) {
-      deps.err(red(error instanceof Error ? error.message : String(error), colorEnabled(process.stderr)));
-      return 1;
-    }
-    if (!result.running) {
-      deps.err("The sandbox stopped.");
-      return 0;
-    }
+});
+var statusCommand = defineCommand({
+  meta: {
+    name: "status",
+    description: "Whether this machine is connected, through which provider, and as which device."
+  },
+  async run() {
+    process.exitCode = await runNetworkStatus();
   }
-}
-
-// src/human.ts
-var ID_KEYS = [
-  "sandboxId",
-  "siteId",
-  "projectId",
-  "deploymentId",
-  "imageId",
-  "snapshotId",
-  "urlId",
-  "mcpId",
-  "commandId",
-  "sessionId",
-  "sandboxProviderId",
-  "id"
-];
-var LABEL_KEYS = ["displayName", "name", "title", "slug", "label", "path", "uri", "ref"];
-var STATUS_KEYS = ["status", "outcome", "state"];
-var URL_KEYS = ["url", "liveUrl", "publicUrl", "sshCommand"];
-function isItem(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function isScalar(value) {
-  return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
-}
-function firstKey(item, keys) {
-  return keys.find((key) => {
-    const value = item[key];
-    return typeof value === "string" && value.trim() !== "";
-  });
-}
-function firstString(item, keys) {
-  const key = firstKey(item, keys);
-  return key ? item[key] : undefined;
-}
-function symbolForStatus(status) {
-  const s = (status ?? "").toLowerCase();
-  if (/(fail|error|denied)/.test(s))
-    return "failed";
-  if (/^(running|active|ready|deployed|published|online|verified|ok)$/.test(s))
-    return "ready";
-  if (/^(stopped|deleted|unpublished|vanished|archived|revoked|closed|killed|exited|dead|paused)$/.test(s)) {
-    return "stopped";
+});
+var lsCommand = defineCommand({
+  meta: {
+    name: "ls",
+    description: "Sandboxes of an organization with their private addresses and names, and which are reachable through the current connection."
+  },
+  args: { org: orgArg },
+  async run({ args }) {
+    process.exitCode = await runNetworkLs({ org: args.org });
+  }
+});
+var devicesRemoveCommand = defineCommand({
+  meta: { name: "remove", description: "Remove one of your devices from the private network." },
+  args: {
+    id: { type: "positional", description: "Device id, from `network devices`.", required: true }
+  },
+  async run({ args }) {
+    process.exitCode = await runNetworkDevicesRemove({ id: args.id });
+  }
+});
+var devicesCommand = defineCommand({
+  meta: { name: "devices", description: "Your devices in the private network." },
+  subCommands: { remove: devicesRemoveCommand },
+  async run({ rawArgs }) {
+    if (rawArgs[0] === "remove")
+      return;
+    process.exitCode = await runNetworkDevices();
   }
-  if (/(pending|starting|spawning|stopping|building|progress|awaiting|queued|creating|restarting|removing)/.test(s)) {
-    return "progress";
+});
+var networkCommand = defineCommand({
+  meta: {
+    name: "network",
+    description: "The private network: reach your sandboxes by address and name from this machine."
+  },
+  subCommands: {
+    connect: connectCommand,
+    disconnect: disconnectCommand,
+    status: statusCommand,
+    ls: lsCommand,
+    devices: devicesCommand
   }
-  return "item";
+});
+
+// src/commands/docker.ts
+function defaultDeps2() {
+  const dir = networkDir();
+  return {
+    request: authorizedRequest,
+    run: (command, args) => new Promise((resolve, reject) => {
+      const child = spawn2(command, args, { stdio: "inherit" });
+      child.on("error", reject);
+      child.on("close", (code) => resolve(code ?? 1));
+    }),
+    output: (command, args) => {
+      const result = spawnSync3(command, args, { encoding: "utf8" });
+      return result.status === 0 ? result.stdout : "";
+    },
+    platform: process.platform,
+    has: (command) => spawnSync3("sh", ["-c", `command -v ${command}`]).status === 0,
+    dir,
+    up: () => tunnelUp(),
+    log: console.log,
+    error: printError,
+    notice: printNotice,
+    exec: execDocker,
+    dockerDir: dockerDirFor(dir),
+    now: () => new Date,
+    env: process.env
+  };
 }
-function isSandbox(item) {
-  return typeof item.sandboxId === "string" && typeof item.name === "string" && !("id" in item);
+function message3(err) {
+  return err instanceof Error ? err.message : String(err);
 }
-function lineKeys(item) {
-  if (isSandbox(item)) {
-    return { id: "name", label: firstKey(item, ["displayName"]) };
+var DNS_LABEL2 = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function noDockerHostReason(sandbox, orgSlug) {
+  if (!sandbox.provider.privateNetwork) {
+    return `${sandbox.name} runs on ${sandbox.provider.name}, which has no private network yet: no Docker context reaches it.`;
   }
-  const idKeys = "id" in item ? ID_KEYS.filter((key) => key !== "sandboxId") : ID_KEYS;
-  return { id: firstKey(item, idKeys), label: firstKey(item, LABEL_KEYS) };
-}
-function shortId(id) {
-  return /^[0-9a-f]{64}$/.test(id) ? id.slice(0, 12) : id;
-}
-function itemLine(item, color) {
-  const keys = lineKeys(item);
-  const id = keys.id ? item[keys.id] : undefined;
-  const label = keys.label ? item[keys.label] : undefined;
-  const status = firstString(item, STATUS_KEYS);
-  const url = firstString(item, URL_KEYS);
-  const parts = [label ?? id ?? "(unnamed)"];
-  if (label && id && id !== label)
-    parts.push(dim(shortId(id), color));
-  if (status)
-    parts.push(status);
-  if (url)
-    parts.push(`${SYMBOLS.url} ${url}`);
-  return eventLine(symbolForStatus(status), parts.join("  "), color);
+  if (!sandbox.address) {
+    return `${sandbox.name} has no address in the private network yet (${sandbox.provider.name} has no host on it).`;
+  }
+  const notLabel = [sandbox.name, orgSlug].find((name) => !DNS_LABEL2.test(name));
+  if (notLabel) {
+    return `${sandbox.name} has no Docker engine over the network: "${notLabel}" is not a DNS label (lower-case letters, digits and hyphens), so its Docker engine stays closed.`;
+  }
+  return `${sandbox.name} has no Docker engine over the network.`;
 }
-function scalarText(value) {
-  if (value === null)
-    return "—";
-  if (isScalar(value))
-    return String(value);
-  if (Array.isArray(value) && value.every(isScalar))
-    return value.join(", ");
-  if (Array.isArray(value))
-    return `${value.length} item${value.length === 1 ? "" : "s"}`;
-  return "…";
+function sandboxWarnings(sandbox, gateway, up) {
+  const warnings = [];
+  if (gateway?.id !== sandbox.provider.id) {
+    warnings.push(`${sandbox.name} runs on ${sandbox.provider.name}, and this machine connects through ${gateway?.name ?? "no provider"}: Docker reaches it only after \`${connectCommandFor(sandbox.provider)}\`.`);
+  } else if (!up) {
+    warnings.push(`This machine is not connected to the private network: run \`${connectCommandFor(sandbox.provider)}\` before using the context.`);
+  }
+  if (sandbox.dockerDoor === "none") {
+    warnings.push(`${sandbox.name}: this sandbox's base image is too old for Docker over the network; restart it to update.`);
+  }
+  return warnings;
 }
-function fieldLines(item, color, skip) {
-  const lines = [];
-  for (const [key, value] of Object.entries(item)) {
-    if (skip.has(key) || value === undefined)
-      continue;
-    if (Array.isArray(value) && value.some(isItem)) {
-      lines.push(`    ${dim(`${key}:`, color)}`);
-      for (const entry of value) {
-        lines.push(`  ${isItem(entry) ? itemLine(entry, color) : eventLine("item", scalarText(entry), color)}`);
-      }
-      continue;
+var NO_DEVICE = () => `Run ${getCliName()} network connect first: the Docker context uses this machine's device.`;
+async function runDockerContext(args, deps = defaultDeps2()) {
+  const state = await readDeviceStateFor(deps);
+  if (!state) {
+    deps.error(NO_DEVICE());
+    return 1;
+  }
+  if (!deps.has("docker")) {
+    deps.error("docker is not installed: the context is for Docker's CLI. Install Docker (Docker Desktop, OrbStack, or the docker CLI alone), then run this again.");
+    return 1;
+  }
+  const use = args.use !== false;
+  try {
+    const organization = await requireOrganizationRef(args.org, deps.notice);
+    const connection = await readConnection(deps);
+    if (connection.asked && !connection.device) {
+      deps.error(`The app no longer knows this machine's device (removed, expired or logged out). ${NO_DEVICE()}`);
+      return 1;
     }
-    if (isItem(value)) {
-      for (const [sub, subValue] of Object.entries(value)) {
-        if (subValue === undefined || isItem(subValue))
-          continue;
-        lines.push(`    ${dim(`${key}.${sub}:`, color)} ${scalarText(subValue)}`);
+    const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes?device=${encodeURIComponent(state.deviceId)}`);
+    const slug = listed.organization.slug;
+    const wanted = args.sandbox.trim().toLowerCase();
+    const sandbox = listed.sandboxes.find((s) => s.name.toLowerCase() === wanted);
+    if (!sandbox) {
+      deps.error(`No sandbox ${args.sandbox} in ${slug}. Run \`${getCliName()} network ls --org ${slug}\` for its sandboxes.`);
+      return 1;
+    }
+    if (!sandbox.dockerHost) {
+      deps.error(noDockerHostReason(sandbox, slug));
+      return 1;
+    }
+    const gateway = connection.device?.gatewayProvider ?? connection.state?.gatewayProvider ?? null;
+    for (const warning of sandboxWarnings(sandbox, gateway, connection.up))
+      deps.notice(warning);
+    const organizationId = listed.organization.id;
+    if (!isOrganizationId(organizationId)) {
+      throw new Error(`The app sent an organization id that is not one: ${organizationId}`);
+    }
+    const files = organizationFiles(deps.dockerDir, organizationId);
+    const { certificate, issued } = await ensureCertificate({ files, organizationId, deviceId: state.deviceId, baseUrl: state.baseUrl, now: deps.now() }, deps.request);
+    const name = dockerContextName(slug, sandbox.name);
+    const { created } = writeContext(deps.exec, {
+      name,
+      description: contextDescription(sandbox.name, slug),
+      host: sandbox.dockerHost,
+      files
+    });
+    await recordContext(deps.dockerDir, { name, organizationId, sandbox: sandbox.name });
+    if (use) {
+      useContext(deps.exec, name);
+      for (const variable of ["DOCKER_HOST", "DOCKER_CONTEXT"]) {
+        if (deps.env[variable]) {
+          deps.notice(`${variable} is set in this shell and wins over \`docker context use\`: unset it, or pass \`docker --context ${name}\`.`);
+        }
       }
-      continue;
     }
-    lines.push(`    ${dim(`${key}:`, color)} ${scalarText(value)}`);
+    printResult({
+      context: { name, host: sandbox.dockerHost, created, inUse: use },
+      sandbox: {
+        name: sandbox.name,
+        canonicalName: sandbox.canonicalName,
+        provider: sandbox.provider,
+        dockerDoor: sandbox.dockerDoor
+      },
+      organization: listed.organization,
+      certificate: {
+        serial: certificate.serial,
+        notAfter: certificate.notAfter.toISOString(),
+        issued,
+        files: { ca: files.ca, cert: files.cert, key: files.key }
+      }
+    }, () => [
+      eventLine("done", `Docker context ${name}${use ? " (in use)" : ""}`),
+      `    ${sandbox.dockerHost}`,
+      `    Certificate for this device, valid until ${day(certificate.notAfter)}.`,
+      `    → ${use ? "docker ps" : `docker --context ${name} ps`}`
+    ], deps.log);
+    await renewDockerCertificates(deps, { except: organizationId });
+    return 0;
+  } catch (err) {
+    deps.error(message3(err));
+    return 1;
   }
-  return lines;
-}
-function listLines(items, color) {
-  if (items.length === 0)
-    return [`  ${dim("(none)", color)}`];
-  return items.map((item) => isItem(item) ? itemLine(item, color) : eventLine("item", scalarText(item), color));
 }
-function bootPhase(value) {
-  return isItem(value) && typeof value.ms === "number" && Number.isFinite(value.ms) ? { ms: value.ms } : null;
+async function readDeviceStateFor(deps) {
+  const state = await readDeviceState(deps.dir);
+  return state && state.baseUrl === getBaseUrl() ? state : null;
 }
-var DISK_SOURCE_TEXT = {
-  fresh: "image pulled",
-  "image-base": "image already on disk",
-  "user-snapshot": "from a snapshot"
-};
-function bootLines(data, color) {
-  if (!isItem(data) || !isItem(data.boot))
-    return [];
-  const sandbox = bootPhase(data.boot.sandbox);
-  if (!sandbox)
-    return [];
-  const lines = [eventLine("ready", `sandbox started in ${formatElapsed(sandbox.ms)}`, color)];
-  const container = bootPhase(data.boot.container);
-  if (container) {
-    lines.push(eventLine("done", `container started in ${formatElapsed(container.ms)}`, color));
+var contextCommand = defineCommand({
+  meta: {
+    name: "context",
+    description: `Point Docker at a sandbox's Docker engine over the private network: plain \`docker\` and \`docker compose\` then run there. Creates (or updates) the Docker context ghostdock-<org>-<sandbox> for tcp://<sandbox>.<org>.ghostdock.internal:2376 with a client certificate of this machine's device, and makes it the current context. Needs \`${getCliName()} network connect\` first, and Docker's CLI. The certificate lives 30 days; \`network connect\` and this command renew it with 10 days left. An expired certificate fails Docker's TLS handshake with Docker's own error: run this command again. Docker's \`no such host\` on a ghostdock.internal address means this machine is not connected: run \`${getCliName()} network connect\`. After an organization rename the old name stops resolving: run it again to update the host.`
+  },
+  args: {
+    sandbox: {
+      type: "positional",
+      required: true,
+      description: "Sandbox name, from `network ls`."
+    },
+    org: orgArg,
+    use: {
+      type: "boolean",
+      default: true,
+      description: "Make it the current Docker context (`docker context use`). `--no-use` only creates or updates it.",
+      negativeDescription: "Only create or update the context; then pass `docker --context <name>`."
+    }
+  },
+  async run({ args }) {
+    process.exitCode = await runDockerContext({
+      sandbox: args.sandbox,
+      org: args.org,
+      use: args.use
+    });
   }
-  const provision = bootPhase(data.boot.provision);
-  if (provision) {
-    const disk = typeof data.boot.disk === "string" ? DISK_SOURCE_TEXT[data.boot.disk] : undefined;
-    const how = disk ? ` (${disk})` : "";
-    lines.push(eventLine("done", `ready in ${formatElapsed(provision.ms)}${how}`, color));
+});
+var dockerCommand = defineCommand({
+  meta: {
+    name: "docker",
+    description: "Docker over the private network: a sandbox's Docker engine from this machine."
+  },
+  subCommands: { context: contextCommand }
+});
+
+// src/commands/env.ts
+function reportError(err, error) {
+  if (err instanceof AuthRequiredError || err instanceof Error) {
+    error(err.message);
+  } else {
+    error(String(err));
   }
-  return lines;
+  return 1;
 }
-function renderResult(data, color) {
-  if (data === null || data === undefined)
-    return [eventLine("done", "Done.", color)];
-  if (Array.isArray(data))
-    return listLines(data, color);
-  if (!isItem(data))
-    return [eventLine("item", scalarText(data), color)];
-  const entries = Object.entries(data).filter(([, value]) => value !== undefined);
-  if (entries.length === 0 || entries.length === 1 && data.ok === true) {
-    return [eventLine("done", "Done.", color)];
-  }
-  const lists = entries.filter(([, value]) => Array.isArray(value) && (value.length === 0 || value.some(isItem)));
-  if (lists.length === 1 && !firstString(data, ID_KEYS)) {
-    const [listKey, list] = lists[0];
-    const rest = fieldLines(data, color, new Set([listKey]));
-    return [...rest, ...listLines(list, color)];
-  }
-  const { id: idKey, label: labelKey } = lineKeys(data);
-  const used = [idKey, labelKey, firstKey(data, STATUS_KEYS), firstKey(data, URL_KEYS)].filter((key) => key !== undefined);
-  const head = used.length > 0 ? [itemLine(data, color)] : [];
-  const boot = bootLines(data, color);
-  if ("boot" in data && (boot.length > 0 || data.boot === null))
-    used.push("boot");
-  return [...head, ...boot, ...fieldLines(data, color, new Set(used))];
+function invokeTool(tool, input) {
+  return authorizedRequest(`/api/v1/tools/${tool}`, {
+    method: "POST",
+    body: JSON.stringify(input)
+  });
 }
-
-// src/cli-help-text.ts
-var CLI_HELP_DESCRIPTION_MAX_LENGTH = 80;
-function cliHelpDescription(description, maxLength = CLI_HELP_DESCRIPTION_MAX_LENGTH) {
-  const oneLine = description.replace(/\s+/g, " ").trim();
-  if (oneLine.length <= maxLength) {
-    return oneLine;
+function displayValue(entry) {
+  if (entry.valueOmittedReason === "secret")
+    return "<secret>";
+  if (entry.valueOmittedReason === "too_large") {
+    return `<${entry.valueLength} chars — read with \`${getCliName()} env get\`>`;
   }
-  const budget = Math.max(1, maxLength - 1);
-  const slice = oneLine.slice(0, budget);
-  const breakAt = slice.lastIndexOf(" ");
-  const cut = breakAt >= Math.floor(budget * 0.6) ? slice.slice(0, breakAt) : slice;
-  return `${cut.trimEnd()}…`;
+  return entry.value ?? "";
 }
-
-// src/schema-flags.ts
-function toFlagName(propertyName) {
-  if (propertyName === "organization")
-    return "org";
-  return propertyName.replace(/([KMGTP])iB(?![a-z])/g, "$1ib").replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[_\s]+/g, "-").toLowerCase();
+function formatTable(entries) {
+  const rows = entries.map((entry) => [
+    entry.name,
+    entry.kind,
+    displayValue(entry),
+    entry.comment ?? ""
+  ]);
+  const header = ["NAME", "KIND", "VALUE", "COMMENT"];
+  const widths = header.map((_, column) => Math.max(header[column]?.length ?? 0, ...rows.map((row) => row[column]?.length ?? 0)));
+  const line = (cells) => cells.map((cell, column) => column === cells.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
+  return [line(header), ...rows.map(line)].join(`
+`);
 }
-function isJsonSchemaProperty(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
 }
-function schemaVariants(prop) {
-  const variants = [];
-  for (const key of ["anyOf", "oneOf", "allOf"]) {
-    const group = prop[key];
-    if (!Array.isArray(group))
-      continue;
-    for (const item of group) {
-      if (isJsonSchemaProperty(item))
-        variants.push(item);
+async function runEnvList(args, log = console.log, error = printError) {
+  try {
+    const result = await invokeTool("env_list", {
+      organization: args.organization
+    });
+    if (args.json) {
+      log(JSON.stringify(result.entries, null, 2));
+      return 0;
+    }
+    if (result.entries.length === 0) {
+      log("  No variables or secrets.");
+      return 0;
     }
+    log(formatTable(result.entries));
+    return 0;
+  } catch (err) {
+    return reportError(err, error);
   }
-  return variants;
 }
-function primaryJsonType(prop) {
-  if (prop.type !== undefined) {
-    if (Array.isArray(prop.type)) {
-      return prop.type.find((t) => t !== "null");
-    }
-    return prop.type === "null" ? undefined : prop.type;
+async function runEnvGet(args, log = console.log, error = printError) {
+  try {
+    const result = await invokeTool("env_get", {
+      organization: args.organization,
+      name: args.name
+    });
+    log(args.json ? JSON.stringify(result.entry, null, 2) : result.entry.value ?? "");
+    return 0;
+  } catch (err) {
+    return reportError(err, error);
   }
-  const types = new Set;
-  for (const variant of schemaVariants(prop)) {
-    const type = primaryJsonType(variant);
-    if (type)
-      types.add(type);
+}
+function resolveKind(args) {
+  if (args.kind !== undefined && args.kind !== "variable" && args.kind !== "secret") {
+    return { error: `--kind must be "variable" or "secret", got "${args.kind}".` };
   }
-  if (types.has("object"))
-    return "object";
-  if (types.has("array"))
-    return "array";
-  if (types.size === 1) {
-    const [only] = types;
-    return only;
+  const fromKind = args.kind;
+  if (args.secret && fromKind === "variable") {
+    return { error: "Pass either --secret or --kind variable, not both." };
   }
-  return;
-}
-function allowsNull(prop) {
-  if (prop.type === "null")
-    return true;
-  if (Array.isArray(prop.type) && prop.type.includes("null"))
-    return true;
-  return schemaVariants(prop).some(allowsNull);
+  return { kind: fromKind ?? (args.secret ? "secret" : undefined) };
 }
-function buildToolArgs(schema, describe = cliHelpDescription, positionals = []) {
-  const properties = schema.properties ?? {};
-  const required = new Set(schema.required ?? []);
-  const args = {};
-  for (const name of positionals) {
-    const prop = properties[name];
-    if (!prop)
-      continue;
-    const jsonType = primaryJsonType(prop);
-    args[toFlagName(name)] = {
-      type: "positional",
-      description: describe(prop.description ?? name),
-      required: true,
-      valueHint: jsonType
-    };
+async function runEnvSet(args, log = console.log, error = printError, stdin = readStdin) {
+  if (args.value !== undefined && args.valueStdin) {
+    error("Pass either --value or --value-stdin, not both.");
+    return 1;
   }
-  for (const [name, prop] of Object.entries(properties)) {
-    if (positionals.includes(name))
-      continue;
-    const jsonType = primaryJsonType(prop);
-    const isBoolean = jsonType === "boolean";
-    const isJsonValue = jsonType === "object" || jsonType === "array";
-    const typeNote = isJsonValue ? ` (JSON ${jsonType})` : "";
-    const isOrganization = name === "organization";
-    const isRequired = required.has(name) && prop.default === undefined && !isOrganization;
-    const defaultNote = isOrganization ? " Defaults to GHOSTDOCK_ORG, then `organizations use`." : "";
-    args[toFlagName(name)] = isBoolean ? {
-      type: "boolean",
-      description: describe(`${prop.description ?? name}${typeNote}${defaultNote}`),
-      required: isRequired
-    } : {
-      type: "string",
-      description: describe(`${prop.description ?? name}${typeNote}${defaultNote}`),
-      required: isRequired,
-      valueHint: jsonType
-    };
+  if (args.value === undefined && !args.valueStdin) {
+    error("Provide --value, or --value-stdin to read the value from stdin.");
+    return 1;
   }
-  return args;
-}
-function coerceFlagValue(raw, prop, flagName) {
-  if (raw === "null" && allowsNull(prop))
-    return null;
-  const jsonType = primaryJsonType(prop);
-  if (jsonType === "boolean") {
-    return typeof raw === "boolean" ? raw : raw === "true";
+  const resolved = resolveKind(args);
+  if ("error" in resolved) {
+    error(resolved.error);
+    return 1;
   }
-  if (jsonType === "number" || jsonType === "integer") {
-    const num = Number(raw);
-    if (Number.isNaN(num)) {
-      throw new Error(`Invalid number for --${flagName}: ${String(raw)}`);
+  const value = args.valueStdin ? await stdin() : args.value ?? "";
+  try {
+    const result = await invokeTool("env_set", {
+      organization: args.organization,
+      name: args.name,
+      value,
+      ...resolved.kind ? { kind: resolved.kind } : {},
+      ...args.comment ? { comment: args.comment } : {}
+    });
+    if (args.json) {
+      log(JSON.stringify(result, null, 2));
+      return 0;
     }
-    return num;
-  }
-  if (jsonType === "object" || jsonType === "array") {
-    if (typeof raw !== "string")
-      return raw;
-    try {
-      return JSON.parse(raw);
-    } catch {
-      throw new Error(`Invalid JSON for --${flagName}: ${String(raw)}`);
+    log(eventLine("done", `${result.created ? "Created" : "Updated"} ${result.entry.kind} ${result.entry.name}.`));
+    if (result.previousKind === "secret") {
+      log(eventLine("item", `Warning: ${result.entry.name} was a secret and is now a variable — its value is readable by everyone in the organization.`));
+    } else if (result.previousKind === "variable") {
+      log(eventLine("item", `${result.entry.name} was a variable and is now a secret; its value is no longer shown.`));
     }
+    return 0;
+  } catch (err) {
+    return reportError(err, error);
   }
-  return raw;
 }
-function buildToolInput(schema, rawArgs) {
-  const properties = schema.properties ?? {};
-  const input = {};
-  for (const [name, prop] of Object.entries(properties)) {
-    const flagName = toFlagName(name);
-    const raw = rawArgs[flagName] ?? rawArgs[name];
-    if (raw === undefined)
-      continue;
-    input[name] = coerceFlagValue(raw, prop, flagName);
+async function runEnvDelete(args, log = console.log, error = printError) {
+  try {
+    await invokeTool("env_delete", {
+      organization: args.organization,
+      name: args.name
+    });
+    log(eventLine("done", `Deleted ${args.name}.`));
+    return 0;
+  } catch (err) {
+    return reportError(err, error);
+  }
+}
+var nameArg = {
+  type: "positional",
+  description: "Environment variable name.",
+  required: true
+};
+var envCommand = defineCommand({
+  meta: {
+    name: "env",
+    description: "Manage organization environment variables and secrets."
+  },
+  subCommands: {
+    list: defineCommand({
+      meta: { name: "list", description: "List variables and secrets." },
+      args: {
+        org: orgArg
+      },
+      async run({ args }) {
+        process.exitCode = await withOrganization(args.org, (organization) => runEnvList({
+          organization,
+          json: isJsonOutput()
+        }));
+      }
+    }),
+    get: defineCommand({
+      meta: {
+        name: "get",
+        description: "Print one variable value in full (secrets cannot be read)."
+      },
+      args: {
+        name: nameArg,
+        org: orgArg
+      },
+      async run({ args }) {
+        process.exitCode = await withOrganization(args.org, (organization) => runEnvGet({
+          organization,
+          name: args.name,
+          json: isJsonOutput()
+        }));
+      }
+    }),
+    set: defineCommand({
+      meta: { name: "set", description: "Create or replace a variable or secret." },
+      args: {
+        name: nameArg,
+        org: orgArg,
+        value: { type: "string", description: "Value to store." },
+        "value-stdin": {
+          type: "boolean",
+          description: "Read the value from stdin — keeps secrets out of shell history.",
+          default: false
+        },
+        secret: {
+          type: "boolean",
+          description: "Shorthand for --kind secret. Required when creating a secret.",
+          default: false
+        },
+        kind: {
+          type: "string",
+          description: "variable or secret. Required when creating; on an update, omit to keep the existing kind or pass the other to convert."
+        },
+        comment: { type: "string", description: "Note about what this value is for." }
+      },
+      async run({ args }) {
+        process.exitCode = await withOrganization(args.org, (organization) => runEnvSet({
+          organization,
+          name: args.name,
+          value: args.value,
+          valueStdin: args["value-stdin"],
+          secret: args.secret,
+          kind: args.kind,
+          comment: args.comment,
+          json: isJsonOutput()
+        }));
+      }
+    }),
+    delete: defineCommand({
+      meta: { name: "delete", description: "Delete a variable or secret." },
+      args: {
+        name: nameArg,
+        org: orgArg
+      },
+      async run({ args }) {
+        process.exitCode = await withOrganization(args.org, (organization) => runEnvDelete({
+          organization,
+          name: args.name
+        }));
+      }
+    })
   }
-  return input;
-}
+});
 
-// src/commands/invoke.ts
-async function runToolInvoke(tool, rawArgs, log = console.log, error = printError, notice = printNotice, pickers = defaultContainerPickers()) {
-  const properties = tool.inputSchema.properties;
-  let input;
-  try {
-    input = buildToolInput(tool.inputSchema, rawArgs);
-    if (properties && "organization" in properties && input.organization === undefined) {
-      input.organization = await requireOrganizationRef(undefined, notice);
-    }
-  } catch (err) {
-    error(err instanceof Error ? err.message : String(err));
-    return 1;
-  }
-  if (tool.name === "sandboxes_containers_logs") {
-    try {
-      return await runContainerLogs(input, {
-        follow: rawArgs.follow === true,
-        timestamps: rawArgs.timestamps === true
-      });
-    } catch (err) {
-      error(err instanceof Error ? err.message : `${tool.name} failed.`);
-      return 1;
-    }
-  }
-  const call = {
-    organization: typeof input.organization === "string" ? input.organization : undefined,
-    sandboxId: typeof input.sandboxId === "string" ? input.sandboxId : undefined,
-    canPick: !!properties && "container" in properties && !input.container,
-    setContainer: (container) => {
-      input.container = container;
-    }
+// src/container-picker.ts
+import { createInterface } from "node:readline/promises";
+function notRunningContainerOf(error) {
+  if (!(error instanceof ApiError) || !error.data || typeof error.data !== "object")
+    return null;
+  const { code, params } = error.data;
+  if (code !== "container_not_running")
+    return null;
+  const container = params && typeof params === "object" ? params : {};
+  return typeof container.container === "string" && container.container ? container.container : null;
+}
+function containerQuestionOf(error) {
+  if (!(error instanceof ApiError) || !error.data || typeof error.data !== "object")
+    return null;
+  const { code, params } = error.data;
+  if (code !== "container_choice_required" && code !== "container_default_missing")
+    return null;
+  const record = params && typeof params === "object" ? params : {};
+  const running = typeof record.containers === "string" ? record.containers.split(",").map((name) => name.trim()).filter(Boolean) : [];
+  if (running.length === 0)
+    return null;
+  return {
+    running,
+    ...code === "container_default_missing" && typeof record.container === "string" ? { missingDefault: record.container } : {}
   };
+}
+var say = (line) => process.stderr.write(`${line}
+`);
+var chooseContainerOnTerminal = async ({ running, missingDefault }) => {
+  if (missingDefault) {
+    say(`
+The default container ${missingDefault} is gone.`);
+  }
+  say(missingDefault ? "Which container?" : `
+Several containers are running. Which one?`);
+  running.forEach((name, index) => {
+    say(`  ${index + 1}. ${name}`);
+  });
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const post = () => authorizedRequest(`/api/v1/tools/${tool.name}`, {
-      method: "POST",
-      body: JSON.stringify(input)
-    });
-    const waitMessage = PROGRESS_MESSAGES[tool.name];
-    let elapsed;
-    const send = async () => {
-      if (!waitMessage)
-        return post();
-      const timed = await withProgress(waitMessage, post);
-      elapsed = timed.elapsed;
-      return timed.value;
-    };
-    const result = await withContainerPick(call, () => withContainerStart(call, send, rawArgs.start === true, pickers, notice), pickers, notice);
-    printResult(result, () => {
-      const color = colorEnabled(process.stdout);
-      const lines = renderResult(result, color);
-      return elapsed === undefined || bootLines(result, color).length > 0 ? lines : withElapsed(lines, elapsed);
-    }, log);
-    stopNote(result, notice);
-    return 0;
-  } catch (err) {
-    error(err instanceof Error ? err.message : `${tool.name} failed.`);
-    return 1;
+    const answer = (await prompt.question("Number (Enter to cancel): ")).trim();
+    const index = Number.parseInt(answer, 10) - 1;
+    return Number.isInteger(index) && index >= 0 && index < running.length ? running[index] ?? null : null;
+  } finally {
+    prompt.close();
   }
-}
-function stopNote(result, notice) {
-  if (!result || typeof result !== "object")
-    return;
-  const { action, note, container } = result;
-  if (action !== "stop" || typeof container !== "string")
-    return;
-  if (note === "default") {
-    notice(`${container} is the sandbox's default container: SSH, commands and files ask which container until it runs again.`);
-  } else if (note === "last_running") {
-    notice("No container is running now: SSH, commands and files have none to land in until one runs.");
-  } else if (note === "sandbox_stopped") {
-    notice(`The sandbox is stopped, so ${container} is too: nothing was done.`);
+};
+var confirmDefaultOnTerminal = async (container) => {
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = (await prompt.question(`Make ${container} the default? [y/N] `)).trim();
+    return /^y(es)?$/i.test(answer);
+  } finally {
+    prompt.close();
   }
-}
-var PROGRESS_MESSAGES = {
-  sandboxes_create: "Creating sandbox…",
-  sandboxes_wake: "Waking sandbox…",
-  sandboxes_stop: "Stopping sandbox…",
-  sandboxes_delete: "Deleting sandbox…",
-  sandboxes_resize: "Resizing sandbox…",
-  sandboxes_resize_disk: "Resizing disk…",
-  sandboxes_commands_run: "Running command…",
-  sandboxes_containers_start: "Starting container…",
-  sandboxes_containers_stop: "Stopping container…",
-  sandboxes_containers_restart: "Restarting container…",
-  snapshots_create: "Saving snapshot…",
-  projects_redeploy: "Redeploying…",
-  providers_verify_incus: "Checking the Incus host…"
 };
-function withElapsed(lines, elapsed) {
-  const color = colorEnabled(process.stdout);
-  const [first, ...rest] = lines;
-  if (first === undefined || first.startsWith("    ")) {
-    return [eventLine("done", `Done in ${elapsed}.`, color), ...lines];
+var confirmStartOnTerminal = async (container) => {
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = (await prompt.question(`Container ${container} is not running. Start it? [Y/n] `)).trim();
+    return answer === "" || /^y(es)?$/i.test(answer);
+  } finally {
+    prompt.close();
   }
-  return [`${first}  ${dim(`in ${elapsed}`, color)}`, ...rest];
+};
+function defaultContainerPickers() {
+  return process.stdin.isTTY && process.stderr.isTTY ? {
+    choose: chooseContainerOnTerminal,
+    confirmDefault: confirmDefaultOnTerminal,
+    confirmStart: confirmStartOnTerminal
+  } : undefined;
 }
-function cliText(catalog, skills = BUILTIN_SKILL_NAMES) {
-  const paths = new Map(catalog.filter((tool) => tool.cli).map((tool) => [tool.name, tool.cli]));
-  const names = [...paths.keys()].sort((a, b) => b.length - a.length);
-  const pattern = names.length > 0 ? new RegExp(`\\b(${names.join("|")})\\b`, "g") : null;
-  return (text) => {
-    const oneLine = text.replace(/\s+/g, " ").trim();
-    const commands = pattern ? oneLine.replace(pattern, (name) => paths.get(name)?.join(" ") ?? name) : oneLine;
-    return commands.replace(/\bthe ([a-z][a-z0-9-]*) skill\b/g, (phrase, skill) => skills.includes(skill) ? `the ${skill} skill (\`${getCliName()} skills get ${skill}\`)` : phrase);
-  };
+
+// src/progress.ts
+var PROGRESS_FRAMES = ["▂▄▆", "▄▆█", "▆█▆", "█▆▄", "▆▄▂", "▄▂▄"];
+var FRAME_MS = 120;
+function formatElapsed(ms) {
+  return ms < 1000 ? `${Math.round(ms)}ms` : `${(ms / 1000).toFixed(1)}s`;
 }
-function cliOnlyArgs(tool) {
-  const schema = tool.inputSchema;
-  const args = {};
-  if (schema.properties && "container" in schema.properties && !schema.required?.includes("container")) {
-    args.start = {
-      type: "boolean",
-      description: "Start the container first when it is not running, without asking."
-    };
-  }
-  if (tool.name === "sandboxes_containers_logs") {
-    args.follow = {
-      type: "boolean",
-      alias: "f",
-      description: "Keep printing new lines until Ctrl-C."
-    };
-    args.timestamps = { type: "boolean", description: "Put each line's time in front of it." };
+function startProgress(message, options = {}) {
+  const stream = options.stream ?? process.stderr;
+  const now = options.now ?? Date.now;
+  const started = now();
+  const elapsed = () => formatElapsed(now() - started);
+  if (isJsonOutput())
+    return { stop: elapsed };
+  const animate = options.animate ?? stream.isTTY === true;
+  if (!animate) {
+    stream.write(`  ${SYMBOLS.progress} ${message}
+`);
+    return { stop: elapsed };
   }
-  return args;
-}
-var generatedToolCommands = new WeakSet;
-function createToolCommands(catalog) {
-  const commands = {};
-  const toCliText = cliText(catalog);
-  for (const tool of catalog) {
-    const command = defineCommand({
-      meta: {
-        name: tool.cli?.at(-1) ?? tool.name,
-        description: toCliText(tool.description)
-      },
-      args: { ...buildToolArgs(tool.inputSchema, toCliText, tool.cliArgs), ...cliOnlyArgs(tool) },
-      async run({ args }) {
-        process.exitCode = await runToolInvoke(tool, args);
+  const color = colorEnabled(stream);
+  let frame = 0;
+  const draw = () => {
+    const bars = accent(PROGRESS_FRAMES[frame % PROGRESS_FRAMES.length] ?? SYMBOLS.progress, color);
+    stream.write(`\r\x1B[2K  ${bars} ${message} ${dim(elapsed(), color)}`);
+    frame += 1;
+  };
+  const restore = () => stream.write("\r\x1B[2K\x1B[?25h");
+  const onInterrupt = () => {
+    restore();
+    process.exit(130);
+  };
+  stream.write("\x1B[?25l");
+  draw();
+  const timer = setInterval(draw, FRAME_MS);
+  timer.unref?.();
+  process.once("SIGINT", onInterrupt);
+  let stopped = false;
+  return {
+    stop() {
+      if (!stopped) {
+        stopped = true;
+        clearInterval(timer);
+        process.off("SIGINT", onInterrupt);
+        restore();
       }
-    });
-    generatedToolCommands.add(command);
-    commands[tool.name] = command;
-  }
-  return commands;
-}
-
-// src/commands/login.ts
-import { hostname } from "node:os";
-
-// src/commands/login-organization.ts
-import { createInterface as createInterface2 } from "node:readline/promises";
-function label(organization) {
-  return `${organization.name} (${organization.slug ?? organization.id})`;
+      return elapsed();
+    }
+  };
 }
-var chooseOrganizationOnTerminal = async (organizations) => {
-  console.log(`
-Which organization should commands use by default?`);
-  organizations.forEach((organization, index) => {
-    console.log(`  ${index + 1}. ${label(organization)}`);
-  });
-  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
+async function withProgress(message, work, options) {
+  const progress = startProgress(message, options);
   try {
-    const answer = (await prompt.question(`Number (Enter to skip): `)).trim();
-    const index = Number.parseInt(answer, 10) - 1;
-    return Number.isInteger(index) && index >= 0 && index < organizations.length ? index : null;
-  } finally {
-    prompt.close();
+    const value = await work();
+    return { value, elapsed: progress.stop() };
+  } catch (err) {
+    progress.stop();
+    throw err;
   }
-};
-function defaultChooser() {
-  return process.stdin.isTTY && process.stdout.isTTY ? chooseOrganizationOnTerminal : undefined;
 }
-async function chooseDefaultOrganizationAfterLogin(org, log, choose = defaultChooser()) {
-  const cli = getCliName();
-  let organizations;
+
+// src/container-flow.ts
+async function withContainerPick(call, send, pickers, notice) {
   try {
-    ({ organizations } = await authorizedRequest("/api/v1/tools/organizations_list", { method: "POST", body: "{}" }));
-  } catch {
-    organizations = undefined;
-  }
-  if (!Array.isArray(organizations)) {
-    log(eventLine("item", `Pick a default organization with \`${cli} organizations use <org>\`.`));
-    return org ? 1 : 0;
-  }
-  const settings = await readSettings();
-  const save = async (organization, why) => {
-    settings.defaultOrganization = { id: organization.id, slug: organization.slug };
-    await writeSettings(settings);
-    log(eventLine("done", `Default organization: ${label(organization)}${why}.`));
-  };
-  const ref = org?.trim();
-  if (ref) {
-    const match = organizations.find((organization) => organization.id === ref) ?? organizations.find((organization) => organization.slug === ref);
-    if (!match) {
-      log(eventLine("failed", `You are not a member of an organization "${ref}"; no default set.`));
-      return 1;
+    return await send();
+  } catch (err) {
+    const question = containerQuestionOf(err);
+    if (!pickers || !question || !call.canPick)
+      throw err;
+    const container = await pickers.choose(question);
+    if (!container)
+      throw err;
+    call.setContainer(container);
+    const result = await send();
+    if (call.sandboxId !== undefined && await pickers.confirmDefault(container)) {
+      try {
+        await authorizedRequest("/api/v1/tools/sandboxes_default_container", {
+          method: "POST",
+          body: JSON.stringify({
+            organization: call.organization,
+            sandboxId: call.sandboxId,
+            container
+          })
+        });
+        notice(eventLine("done", `Default container: ${container}.`));
+      } catch (err) {
+        notice(eventLine("failed", `The default container was not set: ${err instanceof Error ? err.message : String(err)}`));
+      }
     }
-    await save(match, "");
-    return 0;
-  }
-  const current = organizations.find((organization) => organization.id === settings.defaultOrganization?.id);
-  if (current) {
-    log(eventLine("item", `Default organization: ${label(current)} (unchanged).`));
-    return 0;
-  }
-  if (settings.defaultOrganization) {
-    delete settings.defaultOrganization;
-    await writeSettings(settings);
-  }
-  const [only, ...others] = organizations;
-  if (!only) {
-    log(eventLine("item", "You do not belong to an organization yet."));
-    return 0;
-  }
-  if (others.length === 0) {
-    await save(only, " (your only organization)");
-    return 0;
-  }
-  const index = choose ? await choose(organizations) : null;
-  const chosen = index === null ? undefined : organizations[index];
-  if (chosen) {
-    await save(chosen, "");
-    return 0;
+    return result;
   }
-  log(eventLine("item", `You belong to ${organizations.length} organizations: ${organizations.map((organization) => organization.slug ?? organization.id).join(", ")}. Pick a default with \`${cli} organizations use <org>\`, or pass --org.`));
-  return 0;
 }
-
-// src/commands/login.ts
-function defaultClientName() {
+async function withContainerStart(call, send, start, pickers, notice) {
   try {
-    const host = hostname().trim();
-    if (host)
-      return host.slice(0, 64);
-  } catch {}
-  return "ghostdock-cli";
+    return await send();
+  } catch (err) {
+    const container = notRunningContainerOf(err);
+    if (!container || call.sandboxId === undefined)
+      throw err;
+    if (!start && !(pickers && await pickers.confirmStart(container)))
+      throw err;
+    await withProgress("Starting container…", () => authorizedRequest("/api/v1/tools/sandboxes_containers_start", {
+      method: "POST",
+      body: JSON.stringify({
+        organization: call.organization,
+        sandboxId: call.sandboxId,
+        container
+      })
+    }));
+    notice(eventLine("done", `Started ${container}.`));
+    return await send();
+  }
 }
-var DEFAULT_TIMEOUT_SECONDS = 300;
-function toCredentials(result) {
+
+// src/container-logs.ts
+var FOLLOW_INTERVAL_MS = 2000;
+function defaultLogsDeps(follow) {
+  let stop = false;
+  if (follow) {
+    process.once("SIGINT", () => {
+      stop = true;
+    });
+  }
   return {
-    accessToken: result.accessToken,
-    refreshToken: result.refreshToken,
-    accessExpiresAt: new Date(Date.now() + result.expiresIn * 1000).toISOString()
+    request: (input) => authorizedRequest("/api/v1/tools/sandboxes_containers_logs", {
+      method: "POST",
+      body: JSON.stringify(input)
+    }),
+    out: (line) => process.stdout.write(`${line}
+`),
+    err: (line) => process.stderr.write(`${line}
+`),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    stopped: () => stop
   };
 }
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function runLogin(args, log = console.log, choose = defaultChooser(), error = printError) {
-  const loggedIn = async () => {
-    log(eventLine("ready", "Logged in."));
-    return chooseDefaultOrganizationAfterLogin(args.org, log, choose);
-  };
-  if (args.code) {
-    const result = await deviceToken({ pasteCode: args.code });
-    if (result.status === "approved") {
-      await writeCredentials(toCredentials(result));
-      return loggedIn();
+async function runContainerLogs(input, options, deps = defaultLogsDeps(options.follow)) {
+  const json = isJsonOutput();
+  const color = colorEnabled(process.stdout);
+  const print = (line) => {
+    if (json) {
+      deps.out(JSON.stringify(line));
+      return;
     }
-    error("That code has not been approved yet. Approve it in the browser, then run this again.");
+    const text = options.timestamps && line.time ? `${dim(line.time, color)} ${line.text}` : line.text;
+    (line.stream === "stderr" ? deps.err : deps.out)(text);
+  };
+  let result = await deps.request(input);
+  if (!result.running) {
+    deps.err("The sandbox is stopped: it has no logs to show.");
     return 1;
   }
-  const start = await deviceStart({ client_name: defaultClientName() });
-  log(eventLine("url", `Open this URL to sign in: ${start.verificationUrl}`));
-  log(`    Pass --wait to finish here once you approve, or approve on another device and run \`${getCliName()} login --code <paste-code>\` with the code shown there.`);
-  if (!args.wait) {
-    return 0;
-  }
-  const timeoutSeconds = Number.parseInt(args.timeout ?? "", 10) || DEFAULT_TIMEOUT_SECONDS;
-  const deadline = Date.now() + timeoutSeconds * 1000;
-  const intervalMs = start.interval * 1000;
-  const progress = startProgress("Waiting for approval in the browser…");
-  while (Date.now() < deadline) {
-    await sleep(intervalMs);
-    try {
-      const result = await deviceToken({ deviceCode: start.deviceCode });
-      if (result.status === "approved") {
-        progress.stop();
-        await writeCredentials(toCredentials(result));
-        return loggedIn();
-      }
-    } catch (err) {
-      progress.stop();
-      if (err instanceof ApiError && err.status === 400) {
-        error(`Login failed: ${err.message}`);
-        return 1;
+  let last = null;
+  for (;; ) {
+    for (const line of result.lines) {
+      print(line);
+      if (line.time)
+        last = line.time;
+    }
+    if (!options.follow) {
+      if (result.truncated && json) {
+        deps.out(JSON.stringify({ truncated: true }));
+      } else if (result.truncated) {
+        deps.err(dim("(older lines left out: use --tail for more)", colorEnabled(process.stderr)));
       }
-      throw err;
+      return 0;
     }
-  }
-  progress.stop();
-  error(`Timed out waiting for approval. Run \`${getCliName()} login\` again.`);
-  return 1;
-}
-var loginCommand = defineCommand({
-  meta: {
-    name: "login",
-    description: "Sign in and store a device access token for this machine (~/.config/ghostdock/credentials.json)."
-  },
-  args: {
-    wait: {
-      type: "boolean",
-      description: "Poll until the login is approved in the browser (default timeout 5 minutes).",
-      default: false
-    },
-    code: {
-      type: "string",
-      description: "Redeem the one-time paste code shown in the browser instead of polling."
-    },
-    timeout: {
-      type: "string",
-      description: "Max seconds to poll when using --wait (default 300)."
-    },
-    org: {
-      type: "string",
-      description: "Set this organization (id or slug) as the default once logged in."
+    if (!result.truncated)
+      await deps.sleep(FOLLOW_INTERVAL_MS);
+    if (deps.stopped())
+      return 0;
+    const { tail: _tail, ...rest } = input;
+    try {
+      result = await deps.request(last ? { ...rest, after: last } : input);
+    } catch (error) {
+      deps.err(red(error instanceof Error ? error.message : String(error), colorEnabled(process.stderr)));
+      return 1;
+    }
+    if (!result.running) {
+      deps.err("The sandbox stopped.");
+      return 0;
     }
-  },
-  async run({ args }) {
-    process.exitCode = await runLogin(args);
   }
-});
+}
 
-// src/commands/logout.ts
-async function runLogout(log = console.log) {
-  const credentials = await readCredentials();
-  if (credentials) {
-    try {
-      await deviceRevoke({
-        accessToken: credentials.accessToken,
-        refreshToken: credentials.refreshToken
-      });
-    } catch {}
+// src/human.ts
+var ID_KEYS = [
+  "sandboxId",
+  "siteId",
+  "projectId",
+  "deploymentId",
+  "imageId",
+  "snapshotId",
+  "urlId",
+  "mcpId",
+  "commandId",
+  "sessionId",
+  "sandboxProviderId",
+  "id"
+];
+var LABEL_KEYS = ["displayName", "name", "title", "slug", "label", "path", "uri", "ref"];
+var STATUS_KEYS = ["status", "outcome", "state"];
+var URL_KEYS = ["url", "liveUrl", "publicUrl", "sshCommand"];
+function isItem(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isScalar(value) {
+  return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function firstKey(item, keys) {
+  return keys.find((key) => {
+    const value = item[key];
+    return typeof value === "string" && value.trim() !== "";
+  });
+}
+function firstString(item, keys) {
+  const key = firstKey(item, keys);
+  return key ? item[key] : undefined;
+}
+function symbolForStatus(status) {
+  const s = (status ?? "").toLowerCase();
+  if (/(fail|error|denied)/.test(s))
+    return "failed";
+  if (/^(running|active|ready|deployed|published|online|verified|ok)$/.test(s))
+    return "ready";
+  if (/^(stopped|deleted|unpublished|vanished|archived|revoked|closed|killed|exited|dead|paused)$/.test(s)) {
+    return "stopped";
   }
-  await clearCredentials();
-  log(eventLine("stopped", "Logged out."));
-  return 0;
+  if (/(pending|starting|spawning|stopping|building|progress|awaiting|queued|creating|restarting|removing)/.test(s)) {
+    return "progress";
+  }
+  return "item";
 }
-var logoutCommand = defineCommand({
-  meta: {
-    name: "logout",
-    description: "Revoke the device session and remove stored credentials."
-  },
-  async run() {
-    process.exitCode = await runLogout();
+function isSandbox(item) {
+  return typeof item.sandboxId === "string" && typeof item.name === "string" && !("id" in item);
+}
+function lineKeys(item) {
+  if (isSandbox(item)) {
+    return { id: "name", label: firstKey(item, ["displayName"]) };
   }
-});
-
-// src/commands/network.ts
-import { spawn, spawnSync } from "node:child_process";
-import { existsSync as existsSync2 } from "node:fs";
-import { hostname as hostname2 } from "node:os";
-function defaultDeps() {
-  return {
-    request: authorizedRequest,
-    run: (command, args) => new Promise((resolve, reject) => {
-      const child = spawn(command, args, { stdio: "inherit" });
-      child.on("error", reject);
-      child.on("close", (code) => resolve(code ?? 1));
-    }),
-    output: (command, args) => {
-      const result = spawnSync(command, args, { encoding: "utf8" });
-      return result.status === 0 ? result.stdout : "";
-    },
-    platform: process.platform,
-    has: (command) => spawnSync("sh", ["-c", `command -v ${command}`]).status === 0,
-    dir: networkDir(),
-    up: () => tunnelUp(),
-    exists: existsSync2,
-    log: console.log,
-    error: printError,
-    notice: printNotice
-  };
+  const idKeys = "id" in item ? ID_KEYS.filter((key) => key !== "sandboxId") : ID_KEYS;
+  return { id: firstKey(item, idKeys), label: firstKey(item, LABEL_KEYS) };
 }
-function message(err) {
-  return err instanceof Error ? err.message : String(err);
+function shortId(id) {
+  return /^[0-9a-f]{64}$/.test(id) ? id.slice(0, 12) : id;
 }
-function connectCommandFor(provider) {
-  const ref = provider.connectRef;
-  const arg = /^[A-Za-z0-9._-]+$/.test(ref) ? ref : JSON.stringify(ref);
-  return `${getCliName()} network connect ${arg}`;
+function itemLine(item, color) {
+  const keys = lineKeys(item);
+  const id = keys.id ? item[keys.id] : undefined;
+  const label = keys.label ? item[keys.label] : undefined;
+  const status = firstString(item, STATUS_KEYS);
+  const url = firstString(item, URL_KEYS);
+  const parts = [label ?? id ?? "(unnamed)"];
+  if (label && id && id !== label)
+    parts.push(dim(shortId(id), color));
+  if (status)
+    parts.push(status);
+  if (url)
+    parts.push(`${SYMBOLS.url} ${url}`);
+  return eventLine(symbolForStatus(status), parts.join("  "), color);
 }
-async function wgQuick(deps, verb) {
-  const args = ["wg-quick", verb, configPath(deps.dir)];
-  deps.notice(`Running: sudo ${args.join(" ")}`);
-  return deps.run("sudo", args);
+function scalarText(value) {
+  if (value === null)
+    return "—";
+  if (isScalar(value))
+    return String(value);
+  if (Array.isArray(value) && value.every(isScalar))
+    return value.join(", ");
+  if (Array.isArray(value))
+    return `${value.length} item${value.length === 1 ? "" : "s"}`;
+  return "…";
 }
-async function runNetworkConnect(args = {}, deps = defaultDeps()) {
-  suppressPausedNotice();
-  if (!deps.has("wg-quick")) {
-    deps.error(`wg-quick is not installed. ${installHint()}`);
-    return 1;
+function fieldLines(item, color, skip) {
+  const lines = [];
+  for (const [key, value] of Object.entries(item)) {
+    if (skip.has(key) || value === undefined)
+      continue;
+    if (Array.isArray(value) && value.some(isItem)) {
+      lines.push(`    ${dim(`${key}:`, color)}`);
+      for (const entry of value) {
+        lines.push(`  ${isItem(entry) ? itemLine(entry, color) : eventLine("item", scalarText(entry), color)}`);
+      }
+      continue;
+    }
+    if (isItem(value)) {
+      for (const [sub, subValue] of Object.entries(value)) {
+        if (subValue === undefined || isItem(subValue))
+          continue;
+        lines.push(`    ${dim(`${key}.${sub}:`, color)} ${scalarText(subValue)}`);
+      }
+      continue;
+    }
+    lines.push(`    ${dim(`${key}:`, color)} ${scalarText(value)}`);
   }
-  let registered;
-  let privateKey;
-  const previous = await readDeviceState(deps.dir);
-  try {
-    const organization = await requireOrganizationRef(args.org, deps.notice);
-    const provider = args.provider?.trim();
-    const key = await loadOrCreateKey(deps.dir);
-    privateKey = key.privateKey;
-    registered = await deps.request("/api/v1/network/devices", {
-      method: "POST",
-      body: JSON.stringify({
-        publicKey: key.publicKey,
-        name: hostname2().slice(0, 64) || "device",
-        organization,
-        ...provider ? { provider } : {}
-      })
-    });
-  } catch (err) {
-    deps.error(message(err));
-    return 1;
+  return lines;
+}
+function listLines(items, color) {
+  if (items.length === 0)
+    return [`  ${dim("(none)", color)}`];
+  return items.map((item) => isItem(item) ? itemLine(item, color) : eventLine("item", scalarText(item), color));
+}
+function bootPhase(value) {
+  return isItem(value) && typeof value.ms === "number" && Number.isFinite(value.ms) ? { ms: value.ms } : null;
+}
+var DISK_SOURCE_TEXT = {
+  fresh: "image pulled",
+  "image-base": "image already on disk",
+  "user-snapshot": "from a snapshot"
+};
+function bootLines(data, color) {
+  if (!isItem(data) || !isItem(data.boot))
+    return [];
+  const sandbox = bootPhase(data.boot.sandbox);
+  if (!sandbox)
+    return [];
+  const lines = [eventLine("ready", `sandbox started in ${formatElapsed(sandbox.ms)}`, color)];
+  const container = bootPhase(data.boot.container);
+  if (container) {
+    lines.push(eventLine("done", `container started in ${formatElapsed(container.ms)}`, color));
   }
-  const dns = detectDnsMode();
-  let config;
-  try {
-    config = renderConfig({ privateKey, registered, dns });
-  } catch (err) {
-    deps.error(message(err));
-    return 1;
+  const provision = bootPhase(data.boot.provision);
+  if (provision) {
+    const disk = typeof data.boot.disk === "string" ? DISK_SOURCE_TEXT[data.boot.disk] : undefined;
+    const how = disk ? ` (${disk})` : "";
+    lines.push(eventLine("done", `ready in ${formatElapsed(provision.ms)}${how}`, color));
+  }
+  return lines;
+}
+function renderResult(data, color) {
+  if (data === null || data === undefined)
+    return [eventLine("done", "Done.", color)];
+  if (Array.isArray(data))
+    return listLines(data, color);
+  if (!isItem(data))
+    return [eventLine("item", scalarText(data), color)];
+  const entries = Object.entries(data).filter(([, value]) => value !== undefined);
+  if (entries.length === 0 || entries.length === 1 && data.ok === true) {
+    return [eventLine("done", "Done.", color)];
+  }
+  const lists = entries.filter(([, value]) => Array.isArray(value) && (value.length === 0 || value.some(isItem)));
+  if (lists.length === 1 && !firstString(data, ID_KEYS)) {
+    const [listKey, list] = lists[0];
+    const rest = fieldLines(data, color, new Set([listKey]));
+    return [...rest, ...listLines(list, color)];
+  }
+  const { id: idKey, label: labelKey } = lineKeys(data);
+  const used = [idKey, labelKey, firstKey(data, STATUS_KEYS), firstKey(data, URL_KEYS)].filter((key) => key !== undefined);
+  const head = used.length > 0 ? [itemLine(data, color)] : [];
+  const boot = bootLines(data, color);
+  if ("boot" in data && (boot.length > 0 || data.boot === null))
+    used.push("boot");
+  return [...head, ...boot, ...fieldLines(data, color, new Set(used))];
+}
+
+// src/cli-help-text.ts
+var CLI_HELP_DESCRIPTION_MAX_LENGTH = 80;
+function cliHelpDescription(description, maxLength = CLI_HELP_DESCRIPTION_MAX_LENGTH) {
+  const oneLine = description.replace(/\s+/g, " ").trim();
+  if (oneLine.length <= maxLength) {
+    return oneLine;
   }
-  const previousConfig = await readConfig(configPath(deps.dir));
-  await writeConfig(config, configPath(deps.dir));
-  await writeDeviceState({
-    baseUrl: getBaseUrl(),
-    deviceId: registered.device.id,
-    address: registered.device.address ?? "",
-    gatewayProvider: registered.provider,
-    zones: [
-      registered.network.zone,
-      ...registered.network.netZone ? [registered.network.netZone] : []
-    ]
-  }, deps.dir);
-  const wasUp = deps.up();
-  if (wasUp && previousConfig === config) {
-    const { device, network, provider, shortNameOrganizationChanged } = registered;
-    printResult({
-      device,
-      network,
-      provider,
-      shortNameOrganizationChanged,
-      interface: INTERFACE,
-      dns,
-      rearmed: true,
-      pause: device.state
-    }, () => [
-      eventLine("done", rearmedLine(device.state)),
-      ...network.netZone && device.shortNameOrganization && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : []
-    ], deps.log);
-    printPauseHint(device.state, deps);
-    return 0;
+  const budget = Math.max(1, maxLength - 1);
+  const slice = oneLine.slice(0, budget);
+  const breakAt = slice.lastIndexOf(" ");
+  const cut = breakAt >= Math.floor(budget * 0.6) ? slice.slice(0, breakAt) : slice;
+  return `${cut.trimEnd()}…`;
+}
+
+// src/schema-flags.ts
+function toFlagName(propertyName) {
+  if (propertyName === "organization")
+    return "org";
+  return propertyName.replace(/([KMGTP])iB(?![a-z])/g, "$1ib").replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[_\s]+/g, "-").toLowerCase();
+}
+function isJsonSchemaProperty(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function schemaVariants(prop) {
+  const variants = [];
+  for (const key of ["anyOf", "oneOf", "allOf"]) {
+    const group = prop[key];
+    if (!Array.isArray(group))
+      continue;
+    for (const item of group) {
+      if (isJsonSchemaProperty(item))
+        variants.push(item);
+    }
   }
-  if (wasUp) {
-    const down = await wgQuick(deps, "down");
-    if (down !== 0) {
-      deps.error(`Could not take the old tunnel down (wg-quick exited ${down}).`);
-      return 1;
+  return variants;
+}
+function primaryJsonType(prop) {
+  if (prop.type !== undefined) {
+    if (Array.isArray(prop.type)) {
+      return prop.type.find((t) => t !== "null");
     }
+    return prop.type === "null" ? undefined : prop.type;
   }
-  const ipv4Clashes = ipv4Clashes4(registered, deps);
-  const code = await wgQuick(deps, "up");
-  if (code !== 0) {
-    deps.error(`wg-quick exited ${code}. The config is in ${configPath(deps.dir)}.`);
-    return 1;
+  const types = new Set;
+  for (const variant of schemaVariants(prop)) {
+    const type = primaryJsonType(variant);
+    if (type)
+      types.add(type);
   }
-  const { device, network, provider, shortNameOrganizationChanged } = registered;
-  const pinned = device.shortNameOrganization;
-  const switched = wasUp && previous?.gatewayProvider && previous.gatewayProvider.id !== provider.id ? previous.gatewayProvider : null;
-  printResult({
-    device,
-    network,
-    provider,
-    shortNameOrganizationChanged,
-    interface: INTERFACE,
-    dns,
-    rearmed: false,
-    pause: device.state
-  }, () => [
-    eventLine("done", `Connected through ${provider.name}. This machine is ${device.address} in the private network.`),
-    ...switched ? [
-      `    Replaced the connection through ${switched.name}: its sandboxes are out of reach now.`
-    ] : [],
-    `    Reachable: the sandboxes on ${provider.name}. One provider at a time.`,
-    `    Names: <sandbox>.<org>.${network.zone}`,
-    ...network.netZone ? [`    In a browser: https://<sandbox>--<org>.${network.netZone}:<port>`] : [],
-    ...network.netZone && pinned ? [
-      `    Short names: https://<sandbox>.${network.netZone}:<port> for ${pinned.slug}'s sandboxes, on this machine.`,
-      `    Another organization: ${getCliName()} network connect --org <org>.`
-    ] : [],
-    ...network.netZone && pinned && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : [],
-    ...network.ingress4 && !device.address4 ? [
-      "    No IPv4 address was free on this provider's host, so browser names work over IPv6 only:",
-      "    Chrome on a network without IPv6 cannot open them on this machine. Firefox and Safari",
-      "    can. Run connect again later: an address frees up when another device goes."
-    ] : [],
-    ...ipv4Clashes.map(({ address, owner }) => `    ${address} is already routed through ${owner} on this machine: browsers may not reach the private network's names over IPv4 while it is. Ask your Ghostdock admin about the IPv4 block.`),
-    ...dns === "none" ? [
-      "    No split DNS on this machine (no systemd-resolved): use the addresses from",
-      `    \`${getCliName()} network ls\`.`
-    ] : [],
-    `    → ${getCliName()} network ls`
-  ], deps.log);
-  printPauseHint(device.state, deps);
-  return 0;
-}
-function rearmedLine(state, now = new Date) {
-  if (!state)
-    return "Re-armed.";
-  const until = clockTime(new Date(now.getTime() + state.maxSessionSeconds * 1000).toISOString(), now);
-  return `Re-armed: network access for this device runs until ${until} (pauses after ${formatPauseLimit(state.idleTimeoutSeconds)} idle).`;
+  if (types.has("object"))
+    return "object";
+  if (types.has("array"))
+    return "array";
+  if (types.size === 1) {
+    const [only] = types;
+    return only;
+  }
+  return;
 }
-function printPauseHint(state, deps) {
-  if (!state || isJsonOutput())
-    return;
-  const [first = "", ...rest] = pauseHint(state);
-  deps.notice(["", bold2(first), ...rest].join(`
-`));
+function allowsNull(prop) {
+  if (prop.type === "null")
+    return true;
+  if (Array.isArray(prop.type) && prop.type.includes("null"))
+    return true;
+  return schemaVariants(prop).some(allowsNull);
 }
-function ipv4Clashes4(registered, deps) {
-  const addresses = [registered.network.ingress4, registered.device.address4].filter((a) => typeof a === "string" && isIPv4Address(a));
-  const clashes = [];
-  for (const address of addresses) {
-    const [command, args] = ipv4RouteCommand(deps.platform, address);
-    const owner = ipv4RouteOwner(deps.platform, deps.output(command, args));
-    if (owner)
-      clashes.push({ address, owner });
+function buildToolArgs(schema, describe = cliHelpDescription, positionals = []) {
+  const properties = schema.properties ?? {};
+  const required = new Set(schema.required ?? []);
+  const args = {};
+  for (const name of positionals) {
+    const prop = properties[name];
+    if (!prop)
+      continue;
+    const jsonType = primaryJsonType(prop);
+    args[toFlagName(name)] = {
+      type: "positional",
+      description: describe(prop.description ?? name),
+      required: true,
+      valueHint: jsonType
+    };
   }
-  return clashes;
+  for (const [name, prop] of Object.entries(properties)) {
+    if (positionals.includes(name))
+      continue;
+    const jsonType = primaryJsonType(prop);
+    const isBoolean = jsonType === "boolean";
+    const isJsonValue = jsonType === "object" || jsonType === "array";
+    const typeNote = isJsonValue ? ` (JSON ${jsonType})` : "";
+    const isOrganization = name === "organization";
+    const isRequired = required.has(name) && prop.default === undefined && !isOrganization;
+    const defaultNote = isOrganization ? " Defaults to GHOSTDOCK_ORG, then `organizations use`." : "";
+    args[toFlagName(name)] = isBoolean ? {
+      type: "boolean",
+      description: describe(`${prop.description ?? name}${typeNote}${defaultNote}`),
+      required: isRequired
+    } : {
+      type: "string",
+      description: describe(`${prop.description ?? name}${typeNote}${defaultNote}`),
+      required: isRequired,
+      valueHint: jsonType
+    };
+  }
+  return args;
 }
-function clearingNotice(cookieSite) {
-  const site = cookieSite?.site ?? "the net domain";
-  return [
-    "    Short names meant another organization's sandboxes before. The first short-name site each",
-    `    browser opens now clears its data once: the site's storage, and every cookie of ${site}.`,
-    `    That signs the browser out of every site under ${site}${cookieSite?.includesApp ? ", the Ghostdock app included" : ""}.`,
-    "    Reload or close browser tabs opened on short names before this connect."
-  ];
+function coerceFlagValue(raw, prop, flagName) {
+  if (raw === "null" && allowsNull(prop))
+    return null;
+  const jsonType = primaryJsonType(prop);
+  if (jsonType === "boolean") {
+    return typeof raw === "boolean" ? raw : raw === "true";
+  }
+  if (jsonType === "number" || jsonType === "integer") {
+    const num = Number(raw);
+    if (Number.isNaN(num)) {
+      throw new Error(`Invalid number for --${flagName}: ${String(raw)}`);
+    }
+    return num;
+  }
+  if (jsonType === "object" || jsonType === "array") {
+    if (typeof raw !== "string")
+      return raw;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw new Error(`Invalid JSON for --${flagName}: ${String(raw)}`);
+    }
+  }
+  return raw;
 }
-async function staleResolverFiles(deps) {
-  if (deps.platform !== "darwin")
-    return [];
-  const state = await readDeviceState(deps.dir);
-  const zones = new Set([
-    ...configResolverZones(await readConfig(configPath(deps.dir))),
-    ...state?.zones ?? []
-  ]);
-  return [...zones].map(resolverFile).filter((file) => deps.exists(file));
+function buildToolInput(schema, rawArgs) {
+  const properties = schema.properties ?? {};
+  const input = {};
+  for (const [name, prop] of Object.entries(properties)) {
+    const flagName = toFlagName(name);
+    const raw = rawArgs[flagName] ?? rawArgs[name];
+    if (raw === undefined)
+      continue;
+    input[name] = coerceFlagValue(raw, prop, flagName);
+  }
+  return input;
 }
-async function runNetworkDisconnect(deps = defaultDeps()) {
-  const wasUp = deps.up();
-  let failed = false;
-  if (wasUp) {
-    const code = await wgQuick(deps, "down");
-    if (code !== 0) {
-      deps.error(`wg-quick exited ${code}.`);
-      failed = true;
+
+// src/commands/invoke.ts
+async function runToolInvoke(tool, rawArgs, log = console.log, error = printError, notice = printNotice, pickers = defaultContainerPickers()) {
+  const properties = tool.inputSchema.properties;
+  let input;
+  try {
+    input = buildToolInput(tool.inputSchema, rawArgs);
+    if (properties && "organization" in properties && input.organization === undefined) {
+      input.organization = await requireOrganizationRef(undefined, notice);
     }
+  } catch (err) {
+    error(err instanceof Error ? err.message : String(err));
+    return 1;
   }
-  const stale = await staleResolverFiles(deps);
-  if (stale.length) {
-    const args = ["rm", "-f", ...stale];
-    deps.notice(`Removing split DNS left from an earlier connection. Running: sudo ${args.join(" ")}`);
-    const code = await deps.run("sudo", args);
-    if (code !== 0) {
-      deps.error(`Could not remove ${stale.join(", ")} (rm exited ${code}).`);
+  if (tool.name === "sandboxes_containers_logs") {
+    try {
+      return await runContainerLogs(input, {
+        follow: rawArgs.follow === true,
+        timestamps: rawArgs.timestamps === true
+      });
+    } catch (err) {
+      error(err instanceof Error ? err.message : `${tool.name} failed.`);
       return 1;
     }
   }
-  if (failed)
-    return 1;
-  printResult({ connected: false, removedSplitDns: stale }, () => [
-    wasUp ? eventLine("done", "Disconnected.") : eventLine(stale.length ? "done" : "item", stale.length ? "Not connected; removed the leftover split DNS." : "Not connected.")
-  ], deps.log);
-  return 0;
-}
-async function readConnection(deps) {
-  const state = await readDeviceState(deps.dir);
-  const up = deps.up();
-  if (!state)
-    return { state, up, device: null, asked: true, provider: null, staleMtu: null };
-  try {
-    const { devices, mtu } = await deps.request("/api/v1/network/devices");
-    const device = devices.find((d) => d.id === state.deviceId) ?? null;
-    const config = await readConfigMtu(configPath(deps.dir));
-    const staleMtu = config !== null && config !== mtu ? { config, current: mtu } : null;
-    if (staleMtu) {
-      deps.notice(`This machine's tunnel has MTU ${staleMtu.config}, the network now uses ${staleMtu.current}. ` + `Run \`${getCliName()} network connect\` again: until then, large packets other than TCP ` + "can be lost on the way.");
+  const call = {
+    organization: typeof input.organization === "string" ? input.organization : undefined,
+    sandboxId: typeof input.sandboxId === "string" ? input.sandboxId : undefined,
+    canPick: !!properties && "container" in properties && !input.container,
+    setContainer: (container) => {
+      input.container = container;
     }
-    return {
-      state,
-      up,
-      device,
-      asked: true,
-      provider: up ? device?.gatewayProvider ?? null : null,
-      staleMtu
+  };
+  try {
+    const post = () => authorizedRequest(`/api/v1/tools/${tool.name}`, {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+    const waitMessage = PROGRESS_MESSAGES[tool.name];
+    let elapsed;
+    const send = async () => {
+      if (!waitMessage)
+        return post();
+      const timed = await withProgress(waitMessage, post);
+      elapsed = timed.elapsed;
+      return timed.value;
     };
+    const result = await withContainerPick(call, () => withContainerStart(call, send, rawArgs.start === true, pickers, notice), pickers, notice);
+    printResult(result, () => {
+      const color = colorEnabled(process.stdout);
+      const lines = renderResult(result, color);
+      return elapsed === undefined || bootLines(result, color).length > 0 ? lines : withElapsed(lines, elapsed);
+    }, log);
+    stopNote(result, notice);
+    return 0;
   } catch (err) {
-    deps.notice(`Could not ask the app about this device: ${message(err)}`);
-    return {
-      state,
-      up,
-      device: null,
-      asked: false,
-      provider: up ? state.gatewayProvider : null,
-      staleMtu: null
-    };
+    error(err instanceof Error ? err.message : `${tool.name} failed.`);
+    return 1;
   }
 }
-async function runNetworkStatus(deps = defaultDeps()) {
-  const { state, up, device, asked, provider, staleMtu } = await readConnection(deps);
-  const staleSplitDns = up ? [] : await staleResolverFiles(deps);
-  for (const file of staleSplitDns) {
-    deps.notice(`Split DNS from an earlier connection is still set (${file}): names of the private network will hang. Run: ${getCliName()} network disconnect`);
+function stopNote(result, notice) {
+  if (!result || typeof result !== "object")
+    return;
+  const { action, note, container } = result;
+  if (action !== "stop" || typeof container !== "string")
+    return;
+  if (note === "default") {
+    notice(`${container} is the sandbox's default container: SSH, commands and files ask which container until it runs again.`);
+  } else if (note === "last_running") {
+    notice("No container is running now: SSH, commands and files have none to land in until one runs.");
+  } else if (note === "sandbox_stopped") {
+    notice(`The sandbox is stopped, so ${container} is too: nothing was done.`);
   }
-  printResult({ connected: up, device, provider, staleMtu, staleSplitDns }, () => {
-    if (!state) {
-      return [eventLine("item", `Not set up. Run \`${getCliName()} network connect\`.`)];
-    }
-    const through = provider ? ` through ${provider.name}` : "";
-    const lines = [
-      eventLine("item", `${up ? `Connected${through}` : "Not connected"}: ${state.address}`)
-    ];
-    if (device) {
-      lines.push(`    Device ${device.name}, valid until ${device.expiresAt.slice(0, 10)}.`);
-      lines.push(`    ${deviceStateText(device.state)}.`);
-      if (device.shortNameOrganization) {
-        lines.push(`    Short names: ${device.shortNameOrganization.slug}'s sandboxes.`);
-      }
-      if (!device.gatewayProvider) {
-        lines.push(`    Its provider is gone, so no gateway serves it. Run \`${getCliName()} network connect\`.`);
-      }
-    } else if (asked) {
-      lines.push(`    The app no longer knows this device (removed, expired or logged out). Run \`${getCliName()} network connect\`.`);
-    }
-    if (provider)
-      lines.push(`    Reachable: the sandboxes on ${provider.name}.`);
-    return lines;
-  }, deps.log);
-  return 0;
 }
-function unreachableNote(sandbox, connected) {
-  if (!sandbox.provider.privateNetwork) {
-    return `not reachable: ${sandbox.provider.name} has no private network yet`;
+var PROGRESS_MESSAGES = {
+  sandboxes_create: "Creating sandbox…",
+  sandboxes_wake: "Waking sandbox…",
+  sandboxes_stop: "Stopping sandbox…",
+  sandboxes_delete: "Deleting sandbox…",
+  sandboxes_resize: "Resizing sandbox…",
+  sandboxes_resize_disk: "Resizing disk…",
+  sandboxes_commands_run: "Running command…",
+  sandboxes_containers_start: "Starting container…",
+  sandboxes_containers_stop: "Stopping container…",
+  sandboxes_containers_restart: "Restarting container…",
+  snapshots_create: "Saving snapshot…",
+  projects_redeploy: "Redeploying…",
+  providers_verify_incus: "Checking the Incus host…"
+};
+function withElapsed(lines, elapsed) {
+  const color = colorEnabled(process.stdout);
+  const [first, ...rest] = lines;
+  if (first === undefined || first.startsWith("    ")) {
+    return [eventLine("done", `Done in ${elapsed}.`, color), ...lines];
   }
-  if (connected?.id === sandbox.provider.id)
-    return null;
-  return `not reachable: on ${sandbox.provider.name} → ${connectCommandFor(sandbox.provider)}`;
+  return [`${first}  ${dim(`in ${elapsed}`, color)}`, ...rest];
 }
-async function runNetworkLs(args, deps = defaultDeps()) {
-  try {
-    const organization = await requireOrganizationRef(args.org, deps.notice);
-    const connection = await readConnection(deps);
-    const deviceId = connection.device?.id;
-    const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes${deviceId ? `?device=${encodeURIComponent(deviceId)}` : ""}`);
-    const connected = connection.provider;
-    const sandboxes = listed.sandboxes.map((sandbox) => ({
-      ...sandbox,
-      reachable: unreachableNote(sandbox, connected) === null
-    }));
-    printResult({ ...listed, connectedProvider: connected, sandboxes }, () => {
-      if (listed.sandboxes.length === 0) {
-        return [eventLine("item", `No sandboxes in ${listed.organization.slug}.`)];
-      }
-      const width = Math.max(...listed.sandboxes.map((s) => s.name.length));
-      const canonicalWidth = Math.max(...listed.sandboxes.map((s) => s.canonicalName.length));
-      const httpsWidth = Math.max(...listed.sandboxes.map((s) => (s.httpsName?.length ?? 0) + 8));
-      const shortWidth = Math.max(...listed.sandboxes.map((s) => (s.shortName?.length ?? 0) + 8));
-      const lines = [
-        connected ? eventLine("item", `Connected through ${connected.name}.`) : eventLine("item", `Not connected: nothing is reachable. Run \`${getCliName()} network connect [provider]\`.`)
-      ];
-      for (const s of listed.sandboxes) {
-        const note = unreachableNote(s, connected);
-        lines.push([
-          `  ${s.name.padEnd(width)}`,
-          (s.address ?? "-").padEnd(28),
-          s.canonicalName.padEnd(canonicalWidth),
-          ...s.httpsName ? [`https://${s.httpsName}`.padEnd(httpsWidth)] : [],
-          ...s.shortName ? [`https://${s.shortName}`.padEnd(shortWidth)] : [],
-          s.status,
-          ...note ? [`(${note})`] : []
-        ].join("  "));
+function cliText(catalog, skills = BUILTIN_SKILL_NAMES) {
+  const paths = new Map(catalog.filter((tool) => tool.cli).map((tool) => [tool.name, tool.cli]));
+  const names = [...paths.keys()].sort((a, b) => b.length - a.length);
+  const pattern = names.length > 0 ? new RegExp(`\\b(${names.join("|")})\\b`, "g") : null;
+  return (text) => {
+    const oneLine = text.replace(/\s+/g, " ").trim();
+    const commands = pattern ? oneLine.replace(pattern, (name) => paths.get(name)?.join(" ") ?? name) : oneLine;
+    return commands.replace(/\bthe ([a-z][a-z0-9-]*) skill\b/g, (phrase, skill) => skills.includes(skill) ? `the ${skill} skill (\`${getCliName()} skills get ${skill}\`)` : phrase);
+  };
+}
+function cliOnlyArgs(tool) {
+  const schema = tool.inputSchema;
+  const args = {};
+  if (schema.properties && "container" in schema.properties && !schema.required?.includes("container")) {
+    args.start = {
+      type: "boolean",
+      description: "Start the container first when it is not running, without asking."
+    };
+  }
+  if (tool.name === "sandboxes_containers_logs") {
+    args.follow = {
+      type: "boolean",
+      alias: "f",
+      description: "Keep printing new lines until Ctrl-C."
+    };
+    args.timestamps = { type: "boolean", description: "Put each line's time in front of it." };
+  }
+  return args;
+}
+var generatedToolCommands = new WeakSet;
+function createToolCommands(catalog) {
+  const commands = {};
+  const toCliText = cliText(catalog);
+  for (const tool of catalog) {
+    const command = defineCommand({
+      meta: {
+        name: tool.cli?.at(-1) ?? tool.name,
+        description: toCliText(tool.description)
+      },
+      args: { ...buildToolArgs(tool.inputSchema, toCliText, tool.cliArgs), ...cliOnlyArgs(tool) },
+      async run({ args }) {
+        process.exitCode = await runToolInvoke(tool, args);
       }
-      return lines;
-    }, deps.log);
-    return 0;
-  } catch (err) {
-    deps.error(message(err));
-    return 1;
+    });
+    generatedToolCommands.add(command);
+    commands[tool.name] = command;
+  }
+  return commands;
+}
+
+// src/commands/login.ts
+import { hostname as hostname2 } from "node:os";
+
+// src/commands/login-organization.ts
+import { createInterface as createInterface2 } from "node:readline/promises";
+function label(organization) {
+  return `${organization.name} (${organization.slug ?? organization.id})`;
+}
+var chooseOrganizationOnTerminal = async (organizations) => {
+  console.log(`
+Which organization should commands use by default?`);
+  organizations.forEach((organization, index) => {
+    console.log(`  ${index + 1}. ${label(organization)}`);
+  });
+  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await prompt.question(`Number (Enter to skip): `)).trim();
+    const index = Number.parseInt(answer, 10) - 1;
+    return Number.isInteger(index) && index >= 0 && index < organizations.length ? index : null;
+  } finally {
+    prompt.close();
   }
+};
+function defaultChooser() {
+  return process.stdin.isTTY && process.stdout.isTTY ? chooseOrganizationOnTerminal : undefined;
 }
-async function runNetworkDevices(deps = defaultDeps()) {
+async function chooseDefaultOrganizationAfterLogin(org, log, choose = defaultChooser()) {
+  const cli = getCliName();
+  let organizations;
   try {
-    const { devices } = await deps.request("/api/v1/network/devices");
-    const own = (await readDeviceState(deps.dir))?.deviceId;
-    printResult({ devices }, () => devices.length === 0 ? [eventLine("item", "No devices.")] : devices.map((d) => `  ${d.id === own ? "*" : " "} ${d.id}  ${d.name}  ${d.address}  until ${d.expiresAt.slice(0, 10)}  ${deviceStateText(d.state)}`), deps.log);
+    ({ organizations } = await authorizedRequest("/api/v1/tools/organizations_list", { method: "POST", body: "{}" }));
+  } catch {
+    organizations = undefined;
+  }
+  if (!Array.isArray(organizations)) {
+    log(eventLine("item", `Pick a default organization with \`${cli} organizations use <org>\`.`));
+    return org ? 1 : 0;
+  }
+  const settings = await readSettings();
+  const save = async (organization, why) => {
+    settings.defaultOrganization = { id: organization.id, slug: organization.slug };
+    await writeSettings(settings);
+    log(eventLine("done", `Default organization: ${label(organization)}${why}.`));
+  };
+  const ref = org?.trim();
+  if (ref) {
+    const match = organizations.find((organization) => organization.id === ref) ?? organizations.find((organization) => organization.slug === ref);
+    if (!match) {
+      log(eventLine("failed", `You are not a member of an organization "${ref}"; no default set.`));
+      return 1;
+    }
+    await save(match, "");
+    return 0;
+  }
+  const current = organizations.find((organization) => organization.id === settings.defaultOrganization?.id);
+  if (current) {
+    log(eventLine("item", `Default organization: ${label(current)} (unchanged).`));
+    return 0;
+  }
+  if (settings.defaultOrganization) {
+    delete settings.defaultOrganization;
+    await writeSettings(settings);
+  }
+  const [only, ...others] = organizations;
+  if (!only) {
+    log(eventLine("item", "You do not belong to an organization yet."));
+    return 0;
+  }
+  if (others.length === 0) {
+    await save(only, " (your only organization)");
+    return 0;
+  }
+  const index = choose ? await choose(organizations) : null;
+  const chosen = index === null ? undefined : organizations[index];
+  if (chosen) {
+    await save(chosen, "");
     return 0;
-  } catch (err) {
-    deps.error(message(err));
-    return 1;
   }
+  log(eventLine("item", `You belong to ${organizations.length} organizations: ${organizations.map((organization) => organization.slug ?? organization.id).join(", ")}. Pick a default with \`${cli} organizations use <org>\`, or pass --org.`));
+  return 0;
 }
-async function runNetworkDevicesRemove(args, deps = defaultDeps()) {
+
+// src/commands/login.ts
+function defaultClientName() {
   try {
-    await deps.request(`/api/v1/network/devices/${encodeURIComponent(args.id)}`, {
-      method: "DELETE"
-    });
-    printResult({ removed: args.id }, () => [eventLine("done", `Removed device ${args.id}.`)], deps.log);
-    return 0;
-  } catch (err) {
-    deps.error(message(err));
+    const host = hostname2().trim();
+    if (host)
+      return host.slice(0, 64);
+  } catch {}
+  return "ghostdock-cli";
+}
+var DEFAULT_TIMEOUT_SECONDS = 300;
+function toCredentials(result) {
+  return {
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    accessExpiresAt: new Date(Date.now() + result.expiresIn * 1000).toISOString()
+  };
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function runLogin(args, log = console.log, choose = defaultChooser(), error = printError) {
+  const loggedIn = async () => {
+    log(eventLine("ready", "Logged in."));
+    return chooseDefaultOrganizationAfterLogin(args.org, log, choose);
+  };
+  if (args.code) {
+    const result = await deviceToken({ pasteCode: args.code });
+    if (result.status === "approved") {
+      await writeCredentials(toCredentials(result));
+      return loggedIn();
+    }
+    error("That code has not been approved yet. Approve it in the browser, then run this again.");
     return 1;
   }
+  const start = await deviceStart({ client_name: defaultClientName() });
+  log(eventLine("url", `Open this URL to sign in: ${start.verificationUrl}`));
+  log(`    Pass --wait to finish here once you approve, or approve on another device and run \`${getCliName()} login --code <paste-code>\` with the code shown there.`);
+  if (!args.wait) {
+    return 0;
+  }
+  const timeoutSeconds = Number.parseInt(args.timeout ?? "", 10) || DEFAULT_TIMEOUT_SECONDS;
+  const deadline = Date.now() + timeoutSeconds * 1000;
+  const intervalMs = start.interval * 1000;
+  const progress = startProgress("Waiting for approval in the browser…");
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    try {
+      const result = await deviceToken({ deviceCode: start.deviceCode });
+      if (result.status === "approved") {
+        progress.stop();
+        await writeCredentials(toCredentials(result));
+        return loggedIn();
+      }
+    } catch (err) {
+      progress.stop();
+      if (err instanceof ApiError && err.status === 400) {
+        error(`Login failed: ${err.message}`);
+        return 1;
+      }
+      throw err;
+    }
+  }
+  progress.stop();
+  error(`Timed out waiting for approval. Run \`${getCliName()} login\` again.`);
+  return 1;
 }
-var connectCommand = defineCommand({
+var loginCommand = defineCommand({
   meta: {
-    name: "connect",
-    description: "Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Also re-arms a paused device: with the tunnel up and nothing changed, without sudo."
+    name: "login",
+    description: "Sign in and store a device access token for this machine (~/.config/ghostdock/credentials.json)."
   },
   args: {
-    provider: {
-      type: "positional",
-      required: false,
-      description: "Sandbox provider name or id. Omit for the organization's default provider (else the platform default). Only its sandboxes are reachable; connecting through another replaces the connection."
+    wait: {
+      type: "boolean",
+      description: "Poll until the login is approved in the browser (default timeout 5 minutes).",
+      default: false
     },
-    org: orgArg
+    code: {
+      type: "string",
+      description: "Redeem the one-time paste code shown in the browser instead of polling."
+    },
+    timeout: {
+      type: "string",
+      description: "Max seconds to poll when using --wait (default 300)."
+    },
+    org: {
+      type: "string",
+      description: "Set this organization (id or slug) as the default once logged in."
+    }
   },
   async run({ args }) {
-    process.exitCode = await runNetworkConnect({ provider: args.provider, org: args.org });
+    process.exitCode = await runLogin(args);
   }
 });
-var disconnectCommand = defineCommand({
-  meta: {
-    name: "disconnect",
-    description: "Take this machine out of the private network, and remove split DNS an earlier connection left (macOS)."
-  },
-  async run() {
-    process.exitCode = await runNetworkDisconnect();
+
+// src/commands/logout.ts
+async function runLogout(log = console.log) {
+  const credentials = await readCredentials();
+  if (credentials) {
+    try {
+      await deviceRevoke({
+        accessToken: credentials.accessToken,
+        refreshToken: credentials.refreshToken
+      });
+    } catch {}
   }
-});
-var statusCommand = defineCommand({
+  await clearCredentials();
+  log(eventLine("stopped", "Logged out."));
+  return 0;
+}
+var logoutCommand = defineCommand({
   meta: {
-    name: "status",
-    description: "Whether this machine is connected, through which provider, and as which device."
+    name: "logout",
+    description: "Revoke the device session and remove stored credentials."
   },
   async run() {
-    process.exitCode = await runNetworkStatus();
-  }
-});
-var lsCommand = defineCommand({
-  meta: {
-    name: "ls",
-    description: "Sandboxes of an organization with their private addresses and names, and which are reachable through the current connection."
-  },
-  args: { org: orgArg },
-  async run({ args }) {
-    process.exitCode = await runNetworkLs({ org: args.org });
-  }
-});
-var devicesRemoveCommand = defineCommand({
-  meta: { name: "remove", description: "Remove one of your devices from the private network." },
-  args: {
-    id: { type: "positional", description: "Device id, from `network devices`.", required: true }
-  },
-  async run({ args }) {
-    process.exitCode = await runNetworkDevicesRemove({ id: args.id });
-  }
-});
-var devicesCommand = defineCommand({
-  meta: { name: "devices", description: "Your devices in the private network." },
-  subCommands: { remove: devicesRemoveCommand },
-  async run({ rawArgs }) {
-    if (rawArgs[0] === "remove")
-      return;
-    process.exitCode = await runNetworkDevices();
-  }
-});
-var networkCommand = defineCommand({
-  meta: {
-    name: "network",
-    description: "The private network: reach your sandboxes by address and name from this machine."
-  },
-  subCommands: {
-    connect: connectCommand,
-    disconnect: disconnectCommand,
-    status: statusCommand,
-    ls: lsCommand,
-    devices: devicesCommand
+    process.exitCode = await runLogout();
   }
 });
 
@@ -11538,8 +12117,8 @@ var organizationsCurrentCommand = defineCommand({
 });
 
 // src/commands/publish-auto.ts
-import { readdir, readFile as readFile4, stat } from "node:fs/promises";
-import { basename as basename2, join as join4, relative, sep } from "node:path";
+import { readdir as readdir2, readFile as readFile5, stat } from "node:fs/promises";
+import { basename as basename2, join as join5, relative, sep } from "node:path";
 function publishAutoLines(result) {
   const [summaryLine, ...rest] = formatPublishAutoResult(result).split(`
 `);
@@ -11616,23 +12195,23 @@ function formatAttemptedSpec(spec) {
 async function collectPath(path) {
   const pathStats = await stat(path);
   if (pathStats.isFile()) {
-    return [{ path: basename2(path), data: await readFile4(path) }];
+    return [{ path: basename2(path), data: await readFile5(path) }];
   }
   if (!pathStats.isDirectory()) {
     throw new Error(`Publish path must be a file or directory: ${path}`);
   }
   const files = [];
   async function visit(currentPath) {
-    const entries = await readdir(currentPath, { withFileTypes: true });
+    const entries = await readdir2(currentPath, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const entryPath = join4(currentPath, entry.name);
+      const entryPath = join5(currentPath, entry.name);
       if (entry.isDirectory()) {
         await visit(entryPath);
       } else if (entry.isFile()) {
         files.push({
           path: relative(path, entryPath).split(sep).join("/"),
-          data: await readFile4(entryPath)
+          data: await readFile5(entryPath)
         });
       }
     }
@@ -11675,7 +12254,7 @@ async function runPublishAuto(options, log = console.log, error = printError) {
       }
     }
     if (options.zip) {
-      form.append("zip", new Blob([await readFile4(options.zip)]), basename2(options.zip));
+      form.append("zip", new Blob([await readFile5(options.zip)]), basename2(options.zip));
     }
     const { value: result } = await withProgress("Planning and deploying… (this can take a few minutes)", () => authorizedRequest(`/api/v1/organizations/${encodeURIComponent(options.organizationId)}/publish-auto`, { method: "POST", body: form }));
     printResult(result, () => publishAutoLines(result), log);
@@ -11798,28 +12377,28 @@ var publishAutoCommand = defineCommand({
 });
 
 // src/commands/publish-static.ts
-import { readdir as readdir2, readFile as readFile5, stat as stat2 } from "node:fs/promises";
-import { basename as basename3, join as join5, relative as relative2, sep as sep2 } from "node:path";
+import { readdir as readdir3, readFile as readFile6, stat as stat2 } from "node:fs/promises";
+import { basename as basename3, join as join6, relative as relative2, sep as sep2 } from "node:path";
 async function collectPath2(path) {
   const pathStats = await stat2(path);
   if (pathStats.isFile()) {
-    return [{ path: basename3(path), data: await readFile5(path) }];
+    return [{ path: basename3(path), data: await readFile6(path) }];
   }
   if (!pathStats.isDirectory()) {
     throw new Error(`Publish path must be a file or directory: ${path}`);
   }
   const files = [];
   async function visit(currentPath) {
-    const entries = await readdir2(currentPath, { withFileTypes: true });
+    const entries = await readdir3(currentPath, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const entryPath = join5(currentPath, entry.name);
+      const entryPath = join6(currentPath, entry.name);
       if (entry.isDirectory()) {
         await visit(entryPath);
       } else if (entry.isFile()) {
         files.push({
           path: relative2(path, entryPath).split(sep2).join("/"),
-          data: await readFile5(entryPath)
+          data: await readFile6(entryPath)
         });
       }
     }
@@ -11842,7 +12421,7 @@ async function runPublishStatic(options, log = console.log, error = printError)
       }
     }
     if (options.zip) {
-      form.append("zip", new Blob([await readFile5(options.zip)]), basename3(options.zip));
+      form.append("zip", new Blob([await readFile6(options.zip)]), basename3(options.zip));
     }
     const { value: result } = await withProgress("Publishing…", () => authorizedRequest(`/api/v1/organizations/${encodeURIComponent(options.organizationId)}/static-sites`, { method: "POST", body: form }));
     printResult(result, () => [eventLine("url", result.url), eventLine("done", `Published site ${result.siteId}.`)], log);
@@ -11896,7 +12475,7 @@ var publishStaticCommand = defineCommand({
 });
 
 // src/commands/registry.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 function reportError2(err, error) {
   if (err instanceof AuthRequiredError || err instanceof Error) {
     error(err.message);
@@ -11913,7 +12492,7 @@ function defaultInvoke(input) {
 }
 function dockerLogin(input) {
   return new Promise((resolve, reject) => {
-    const child = spawn2("docker", ["login", input.host, "-u", input.username, "--password-stdin"], {
+    const child = spawn3("docker", ["login", input.host, "-u", input.username, "--password-stdin"], {
       stdio: ["pipe", "inherit", "pipe"]
     });
     let stderr = "";
@@ -12011,8 +12590,8 @@ var registryCommand = defineCommand({
 });
 
 // src/commands/sandbox-create.ts
-import { readdir as readdir3, readFile as readFile6, stat as stat3 } from "node:fs/promises";
-import { basename as basename4, join as join6, relative as relative3, sep as sep3 } from "node:path";
+import { readdir as readdir4, readFile as readFile7, stat as stat3 } from "node:fs/promises";
+import { basename as basename4, join as join7, relative as relative3, sep as sep3 } from "node:path";
 
 // ../../node_modules/fflate/esm/index.mjs
 import { createRequire } from "module";
@@ -12665,16 +13244,16 @@ async function collectDirectory(path) {
   }
   const files = [];
   async function visit(currentPath) {
-    const entries = await readdir3(currentPath, { withFileTypes: true });
+    const entries = await readdir4(currentPath, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const entryPath = join6(currentPath, entry.name);
+      const entryPath = join7(currentPath, entry.name);
       if (entry.isDirectory()) {
         await visit(entryPath);
       } else if (entry.isFile()) {
         files.push({
           path: relative3(path, entryPath).split(sep3).join("/"),
-          data: await readFile6(entryPath)
+          data: await readFile7(entryPath)
         });
       }
     }
@@ -12707,7 +13286,7 @@ async function runSandboxCreate(options, log = console.log, error = printError)
     return 1;
   }
   try {
-    const zipBytes = options.zip ? new Uint8Array(await readFile6(options.zip)) : zipDirectory(await collectDirectory(options.paths[0] ?? ""));
+    const zipBytes = options.zip ? new Uint8Array(await readFile7(options.zip)) : zipDirectory(await collectDirectory(options.paths[0] ?? ""));
     const form = new FormData;
     form.append("kind", options.kind);
     if (options.displayName)
@@ -12968,28 +13547,28 @@ var toolsCommand = defineCommand({
 });
 
 // src/commands/upload-files.ts
-import { readdir as readdir4, readFile as readFile7, stat as stat4 } from "node:fs/promises";
-import { basename as basename5, join as join7, relative as relative4, sep as sep4 } from "node:path";
+import { readdir as readdir5, readFile as readFile8, stat as stat4 } from "node:fs/promises";
+import { basename as basename5, join as join8, relative as relative4, sep as sep4 } from "node:path";
 async function collectPath3(path) {
   const pathStats = await stat4(path);
   if (pathStats.isFile()) {
-    return [{ path: basename5(path), data: await readFile7(path) }];
+    return [{ path: basename5(path), data: await readFile8(path) }];
   }
   if (!pathStats.isDirectory()) {
     throw new Error(`Upload path must be a file or directory: ${path}`);
   }
   const files = [];
   async function visit(currentPath) {
-    const entries = await readdir4(currentPath, { withFileTypes: true });
+    const entries = await readdir5(currentPath, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const entryPath = join7(currentPath, entry.name);
+      const entryPath = join8(currentPath, entry.name);
       if (entry.isDirectory()) {
         await visit(entryPath);
       } else if (entry.isFile()) {
         files.push({
           path: relative4(path, entryPath).split(sep4).join("/"),
-          data: await readFile7(entryPath)
+          data: await readFile8(entryPath)
         });
       }
     }
@@ -13011,7 +13590,7 @@ async function runSandboxUpload(options, log = console.log, error = printError,
       }
     }
     if (options.zip) {
-      form.append("zip", new Blob([await readFile7(options.zip)]), basename5(options.zip));
+      form.append("zip", new Blob([await readFile8(options.zip)]), basename5(options.zip));
     }
     let container = options.container;
     const call = {
@@ -13153,7 +13732,8 @@ var HANDWRITTEN_COMMANDS = [
   [["sandboxes", "files", "upload"], sandboxUploadCommand],
   [["sites", "publish"], publishStaticCommand],
   [["projects", "publish"], publishAutoCommand],
-  [["network"], networkCommand]
+  [["network"], networkCommand],
+  [["docker"], dockerCommand]
 ];
 var HANDWRITTEN_PATHS = new Set(HANDWRITTEN_COMMANDS.map(([path]) => path.join(" ")));
 function createMainCommand(catalog = OFFLINE_TOOL_CATALOG) {