promigence 0.1.0-beta.16 → 0.1.0-beta.17

package/dist/account.js

@@ -69,6 +69,21 @@ export function planDisplay(me, b) {
     const name = b?.plan_status?.name;
     return typeof name === "string" && name ? name : planName(me, b);
 }
+function gbText(bytes) {
+    const r = Math.round((bytes / 2 ** 30) * 10) / 10;
+    return Number.isInteger(r) ? String(r) : r.toFixed(1);
+}
+export function storageLine(me) {
+    const s = me?.storage;
+    if (!s || typeof s.used_bytes !== "number")
+        return undefined;
+    const lim = me?.limits ?? {};
+    const of = (used, max) => `${gbText(used)} GB${typeof max === "number" ? ` of ${max} GB` : ""}`;
+    const capMax = lim.max_capture_storage_gb;
+    const captures = typeof s.captures_bytes === "number" ? s.captures_bytes : 0;
+    return `storage: ${of(s.used_bytes, lim.max_storage_gb)} used · saved failures ${of(captures, capMax)}` +
+        (typeof capMax === "number" ? ", the oldest removed at that limit" : "");
+}
 export function sessionLimit(seconds) {
     return seconds % 3600 === 0 ? `${seconds / 3600} h per sandbox` : `${span(seconds)} per sandbox`;
 }
@@ -184,7 +199,7 @@ const me = async (ctx) => {
         lines.push(`  plan: ${shown}${trial?.on_trial ? " (trial)" : ""}`);
     if (conc)
         lines.push(`  concurrency: ${concurrencyText(conc)}`);
-    const billCredits = creditsLine(bill?.credits);
+    const billCredits = creditsLine(bill);
     if (billCredits)
         lines.push(`  ${billCredits}`);
     else if (trial) {
@@ -210,6 +225,9 @@ const me = async (ctx) => {
     ].filter(Boolean);
     if (shape.length)
         lines.push(`  limits: ${shape.join(" · ")}`);
+    const stored = storageLine(info);
+    if (stored)
+        lines.push(`  ${stored}`);
     if (outcomes && outcomes.sandboxes > 0) {
         const [head, ...rest] = outcomeLines(outcomes);
         lines.push(`  ${head}:`, ...rest.map((l) => `  ${l}`));
@@ -350,7 +368,7 @@ const billingUsage = async (ctx) => {
         lines.push(`  paid from credits: ${usd(usage["credits_applied"])}`);
     }
     const trial = b.trial;
-    const credits = creditsLine(b.credits) ?? (trial?.credits_remaining === undefined ? undefined : `credits: ${dollars(trial.credits_remaining)} available`);
+    const credits = creditsLine(b) ?? (trial?.credits_remaining === undefined ? undefined : `credits: ${dollars(trial.credits_remaining)} available`);
     if (credits)
         lines.push(`  ${credits}`);
     if (b.auto_reload)
@@ -551,20 +569,54 @@ function stateFlag(ctx, states) {
 }
 const BUILD_STATES = ["queued", "running", "verified", "built", "rejected", "failed"];
 const RUN_STATES = ["running", "completed", "cap_killed", "aborted"];
+export const FILTER_PAGES = 10;
+export async function filteredPage(page, keep, limit, cursor) {
+    const rows = [];
+    const from = (at) => (at === undefined ? {} : { cursor: at });
+    let at = cursor;
+    let read = 0;
+    for (let n = 0; n < FILTER_PAGES; n++) {
+        const p = await page({ limit: 500, ...from(at) });
+        for (let i = 0; i < p.items.length; i++) {
+            const row = p.items[i];
+            if (!keep(row))
+                continue;
+            if (rows.length < limit) {
+                rows.push(row);
+                continue;
+            }
+            read += i;
+            const nextCursor = i === 0 ? at ?? null : (await page({ limit: i, ...from(at) })).nextCursor ?? at ?? null;
+            return { rows, nextCursor, read, bounded: false };
+        }
+        read += p.items.length;
+        if (!p.nextCursor)
+            return { rows, nextCursor: null, read, bounded: false };
+        at = p.nextCursor;
+    }
+    return { rows, nextCursor: at ?? null, read, bounded: true };
+}
+function moreLines(more, filtered, rows, limit, read, what, bounded = false) {
+    if (!more)
+        return [];
+    return [filtered && (bounded || rows < limit) ? `  the newest ${read} ${what} were read; older ones: --cursor ${more}` : `  more: --cursor ${more}`];
+}
 const snapshotBuilds = async (ctx) => {
     const wanted = stateFlag(ctx, BUILD_STATES);
     const limit = limitOf(ctx, 20, 500);
     const cursor = str(ctx, "--cursor");
-    const page = await client(ctx).snapshots.buildsPage({ limit: wanted === undefined ? limit : 500, ...(cursor === undefined ? {} : { cursor }) });
-    const matched = wanted === undefined ? page.items : page.items.filter((b) => b.state === wanted);
-    const builds = matched.slice(0, limit);
-    const more = builds.length === matched.length ? page.nextCursor : null;
+    const c = client(ctx);
+    const found = wanted === undefined
+        ? await c.snapshots.buildsPage({ limit, ...(cursor === undefined ? {} : { cursor }) }).then((p) => ({ rows: p.items, nextCursor: p.nextCursor, read: p.items.length, bounded: false }))
+        : await filteredPage((o) => c.snapshots.buildsPage(o), (b) => b.state === wanted, limit, cursor);
+    const builds = found.rows;
+    const more = found.nextCursor;
     const next = nexts(...(more ? [[`${sh `promigence snapshot builds --limit ${String(limit)}`}${wanted ? sh ` --state ${wanted}` : ""}${sh ` --cursor ${more}`}`, "the next page"]] : []), ...(builds.length ? [[sh `promigence snapshot status ${builds[0].build_id} --log 40`, "the newest build, with the tail of its log"]] : []));
     const lines = [
         `promigence snapshot builds: ${builds.length}${wanted ? ` in state ${wanted}` : ""}`,
         ...builds.map((b) => `  ${b.build_id}  ${b.state}  ${b.snapshot_id ?? "—"}${buildAliasNote(b)}${b.error?.code ? `  ${b.error.code}` : ""}`),
         ...(builds.length ? [] : ["  (no builds)"]),
-        ...(more ? [`  more: --cursor ${more}`] : []),
+        ...moreLines(more, wanted !== undefined, builds.length, limit, found.read, "builds", found.bounded),
     ];
     return emit(ctx.mode, okEnvelope(ctx.cmd.name, { builds, count: builds.length, next_cursor: more }, next), lines, 0, ctx.pointer);
 };
@@ -598,12 +650,14 @@ const runList = async (ctx) => {
     const limit = limitOf(ctx, 20, 500);
     const cursor = str(ctx, "--cursor");
     const filtering = wanted !== undefined || labels.length > 0;
-    const page = await client(ctx).runs.listPage({ limit: filtering ? 500 : limit, ...(cursor === undefined ? {} : { cursor }) });
     const labelsOfRun = (r) => (r.labels ?? {});
     const labelled = (r) => labels.every(([k, v]) => labelsOfRun(r)[k] === v);
-    const matched = page.items.filter((r) => (wanted === undefined || r.state === wanted) && labelled(r));
-    const runs = matched.slice(0, limit);
-    const more = runs.length === matched.length ? page.nextCursor : null;
+    const c = client(ctx);
+    const found = filtering
+        ? await filteredPage((o) => c.runs.listPage(o), (r) => (wanted === undefined || r.state === wanted) && labelled(r), limit, cursor)
+        : await c.runs.listPage({ limit, ...(cursor === undefined ? {} : { cursor }) }).then((p) => ({ rows: p.items, nextCursor: p.nextCursor, read: p.items.length, bounded: false }));
+    const runs = found.rows;
+    const more = found.nextCursor;
     const labelArgs = labels.map(([k, v]) => sh ` --label ${`${k}=${v}`}`).join("");
     const next = nexts(...(more ? [[`${sh `promigence run list --limit ${String(limit)}`}${wanted ? sh ` --state ${wanted}` : ""}${labelArgs}${sh ` --cursor ${more}`}`, "the next page"]] : []), ...(runs.length ? [[sh `promigence run report ${runs[0].run_id}`, "the newest run's validity report"]] : []));
     const labelText = (r) => {
@@ -614,7 +668,7 @@ const runList = async (ctx) => {
         `promigence run list: ${runs.length}${wanted ? ` in state ${wanted}` : ""}${labels.length ? ` with ${labels.map(([k, v]) => `${k}=${v}`).join(", ")}` : ""}`,
         ...runs.map((r) => `  ${r.run_id}  ${r.state}  ${r.count ?? "?"}×  ${r.snapshot_id || r.snapshot || "—"}  ${r.started_at ?? ""}${labelText(r)}`),
         ...(runs.length ? [] : ["  (no runs)"]),
-        ...(more ? [`  more: --cursor ${more}`] : []),
+        ...moreLines(more, filtering, runs.length, limit, found.read, "runs", found.bounded),
     ];
     return emit(ctx.mode, okEnvelope(ctx.cmd.name, { runs, count: runs.length, next_cursor: more }, next), lines, 0, ctx.pointer);
 };
@@ -771,7 +825,7 @@ export function pausedLines(sid, s) {
     const wakes = Number(s.auto_pause_s ?? 0) > 0;
     return [
         wakes
-            ? "  it paused itself when idle: the next request (exec, files, ssh) wakes it"
+            ? "  it has an idle rule, so the next request (exec, files, ssh) wakes it, whether it paused itself when idle or was paused by hand"
             : `  it stays paused until \`${sh `promigence sandbox resume ${sid}`}\` (it has no idle rule, so a request does not wake it)`,
         s.pause_expires_at
             ? `  its files and state are kept until ${s.pause_expires_at} unless it is resumed before then`

package/dist/billing.js

@@ -70,14 +70,23 @@ export function autoReloadShort(a) {
     const base = `below ${dollars(a.threshold_usd)}, add ${dollars(a.amount_usd)}`;
     return a.paused_reason ? `${base} (paused: ${a.paused_reason.replaceAll("_", " ")})` : base;
 }
-export function creditsLine(c, now = Date.now()) {
-    if (!c)
+export function creditsLine(b, now = Date.now()) {
+    const c = b?.credits;
+    if (!b || !c)
         return undefined;
-    const exp = c.next_expiry;
+    const onTrial = b.trial?.on_trial === true;
+    const gated = b.model !== "postpaid" || onTrial;
+    const stopped = b.suspended === true ? "the organization is suspended" : b.hold ? "a billing hold" : "";
+    const exp = c.next_expiry && dollars(c.next_expiry.amount_usd) !== "$0" && dollars(c.balance_usd) !== "$0" ? c.next_expiry : undefined;
     const days = exp ? Math.ceil((Date.parse(exp.at) - now) / 86_400_000) : NaN;
+    const forNewWork = stopped
+        ? `${gated && c.exhausted ? "used up; " : ""}new work cannot start: ${stopped}`
+        : gated
+            ? (c.exhausted ? "used up: new work cannot start" : c.low ? "running low" : "")
+            : `postpaid: new work is billed after use, on the next invoice${b.card_on_file ? ", charged to the card on file" : ""}`;
     const notes = [
         c.held_usd > 0 ? `${dollars(c.held_usd)} held by running work` : "",
-        c.exhausted ? "used up: new work cannot start" : c.low ? "running low" : "",
+        forNewWork,
         exp ? `${dollars(exp.amount_usd)} expires ${dateWords(exp.at)}${Number.isFinite(days) && days >= 0 ? `, in ${days} day${days === 1 ? "" : "s"}` : ""}` : "",
     ].filter(Boolean);
     return `credits: ${dollars(c.available_usd)} available${notes.length ? ` (${notes.join("; ")})` : ""}`;
@@ -96,7 +105,7 @@ const billing = async (ctx) => {
             : `Your ${plan.name} renewal did not go through.${plan.renewal.next_try_at ? ` We try again on ${dateWords(plan.renewal.next_try_at)}.` : ""}`;
         lines.push(`  renewal: ${said}${plan.renewal.pay_url ? ` ${plan.renewal.pay_url}` : ""}`);
     }
-    const credits = creditsLine(b.credits);
+    const credits = creditsLine(b);
     if (credits)
         lines.push(`  ${credits}`);
     if (b.model === "postpaid" && b.switch) {

package/dist/bin.js

@@ -362,6 +362,7 @@ async function main(argv) {
             keySource: () => keySourceOf(ctx),
             flags: p.flags,
             ...(flagValue(p, "--sandbox") === undefined ? {} : { sandbox: flagValue(p, "--sandbox") }),
+            argv: p.cmdTail,
             ownAliases: () => client(ctx).snapshots.list({ limit: 200 })
                 .then((xs) => xs.map((s) => s.alias).filter((a) => typeof a === "string" && a !== "")),
             billingOff: () => (billingOff ??= client(ctx).billing.usage()
@@ -393,10 +394,13 @@ async function main(argv) {
             Object.assign(env.error, refined.fields);
         if (runId !== undefined)
             env["run_id"] = runId;
+        const lostIn = e.code === "exec_lost" ? e.sandboxId : undefined;
+        if (typeof lostIn === "string")
+            env["sandbox_id"] = lostIn;
         let exit = e.cliExit;
         if (cmd.passthroughExit && !p.flags.has("--no-passthrough") && !(cmd.name === "exec" && p.flags.has("--run"))) {
             env.promigence_exit = exit;
-            exit = e.code === "enoent" ? 127 : cmd.passthroughExit;
+            exit = e.code === "enoent" ? 127 : exit === 2 ? 2 : cmd.passthroughExit;
         }
         if (e.code === "credit_unclaimed" && mode === "text" && canAsk()) {
             const lines = await claimOnRefusal(ctx).catch(() => undefined);

package/dist/commands.d.ts

@@ -1,4 +1,4 @@
-import { PromigenceClient, PromigenceError, type ExecResponse, type KeyOrigin, type OptimizeFor, type RunReport, type SandboxRef, type ScoreMode, type SecretRecord, type SnapshotBuild } from "./sdk/index.js";
+import { PromigenceClient, PromigenceError, type CaptureMode, type ExecResponse, type KeyOrigin, type OptimizeFor, type RunReport, type SandboxRef, type ScoreMode, type SecretRecord, type SnapshotBuild } from "./sdk/index.js";
 import { type Mode } from "./io.js";
 import { type BuildPrice } from "./pricing.js";
 import { type Command, type NextHint } from "./surface.js";
@@ -47,6 +47,7 @@ export declare function buildReplayNote(started: {
     idempotent_replay_age_s?: number;
 }, callersKey: boolean): string | undefined;
 export declare function optimizeForFlag(ctx: Ctx): OptimizeFor | undefined;
+export declare function captureFlag(ctx: Ctx): CaptureMode | undefined;
 export declare function envFlags(ctx: Ctx): Record<string, string> | undefined;
 export declare function emptyAllowList(flag: "--allow" | "allow_hosts"): PromigenceError;
 export declare function gradeOpts(ctx: Ctx): {
@@ -114,6 +115,13 @@ export declare function runHeadline(report: RunReport, count: number): string;
 export declare const FAILURES_SHOWN = 5;
 export declare function limitPauseLines(report: RunReport): string[];
 export declare function failureLines(report: RunReport, outputs: ReadonlyMap<string, OutputTail>, stderrTail: boolean): string[];
+export declare function failedSandboxNext(runId: string, s: {
+    sandbox_id: string;
+    failure?: unknown;
+    execs?: ReadonlyArray<{
+        exec_id?: string;
+    }> | null;
+}, gradeOutput?: boolean): [string, string] | undefined;
 export interface OutputTail {
     stdout: string;
     stderr: string;

package/dist/commands.js

@@ -177,6 +177,16 @@ export function optimizeForFlag(ctx) {
     }
     return v;
 }
+const CAPTURE_MODES = ["on_failure", "off", "always"];
+export function captureFlag(ctx) {
+    const v = str(ctx, "--capture");
+    if (v === undefined)
+        return undefined;
+    if (!CAPTURE_MODES.includes(v)) {
+        throw usageError(`--capture: '${v}' is not a choice`, `Pass --capture ${CAPTURE_MODES.join(" | ")}.`);
+    }
+    return v;
+}
 export function envFlags(ctx) {
     const env = {};
     for (const kv of list(ctx, "--env")) {
@@ -210,6 +220,9 @@ async function runStartOpts(ctx, c, resolved) {
     const optimizeFor = optimizeForFlag(ctx);
     if (optimizeFor !== undefined)
         opts.optimizeFor = optimizeFor;
+    const capture = captureFlag(ctx);
+    if (capture !== undefined)
+        opts.capture = capture;
     const network = str(ctx, "--network");
     const allow = list(ctx, "--allow").flatMap((h) => h.split(",")).map((h) => h.trim()).filter(Boolean);
     if (ctx.flags.has("--allow") && !allow.length)
@@ -417,7 +430,9 @@ const secretsSet = async (ctx) => {
         ...(noRaw ? { raw: "refused" } : {}),
     };
     const res = await c.secrets.set(name, value, opts);
-    const next = nexts([`${sh `promigence run --count 1 --cap 1 --secret ${name}`} -- CMD`, "give it to every sandbox of a run"], ["promigence secrets set --list", "what this org has stored"]);
+    const warnings = (res.warnings ?? []).filter((w) => typeof w === "string");
+    const isKey = warnings.some((w) => w.startsWith("api_key_value:"));
+    const next = nexts([`${sh `promigence run --count 1 --cap 1 --secret ${name}`} -- CMD`, "give it to every sandbox of a run"], ...(isKey ? [[sh `promigence secrets set ${name} --delete`, "delete it: a sandbox given it can use the key"]] : []), ["promigence secrets set --list", "what this org has stored"]);
     return emit(ctx.mode, okEnvelope(ctx.cmd.name, {
         name: res.name, bytes: res.bytes, created: res.created ?? true, source,
         ...(res.hosts?.length
@@ -427,6 +442,7 @@ const secretsSet = async (ctx) => {
                 ...(res.env && Object.keys(res.env).length ? { env: res.env } : {}),
             }
             : {}),
+        ...(warnings.length ? { warnings } : {}),
     }, next), [
         `${sh `promigence secrets set ${name}`}: stored ${res.bytes} bytes from ${source}`,
         ...(res.hosts?.length
@@ -437,6 +453,7 @@ const secretsSet = async (ctx) => {
             ]
             : ["  the value is encrypted at rest and redacted wherever it appears verbatim in logs, reports and command output",
                 "  redaction is best effort (an encoded or altered value prints in clear): never print a secret"]),
+        ...warnings.map((w) => `  warning: ${w}`),
         `  next: ${next[0].cmd}`,
     ], 0, false);
 };
@@ -1410,6 +1427,7 @@ function wantsStream(ctx) {
     return Boolean(process.stdout.isTTY);
 }
 let followKill;
+const EXEC_STOP_WAIT_MS = 4_000;
 const FOLLOW_MAX_OUTPUT = 8 * 1024 * 1024;
 const FOLLOW_RECONNECT_MS = 10 * 60_000;
 async function followExec(c, sandboxId, execOpts, cut) {
@@ -1674,14 +1692,25 @@ const exec = async (ctx) => {
         if (ctx.mode === "text" && !process.stdout.isTTY && execOpts.maxOutputBytes === undefined) {
             execOpts.maxOutputBytes = MAX_OUTPUT_BYTES_PIPED;
         }
+        const stop = new AbortController();
+        let foreground;
+        const stopForeground = () => {
+            stop.abort();
+            if (foreground === undefined)
+                return Promise.resolve();
+            return Promise.race([
+                foreground.then(() => undefined, () => undefined),
+                new Promise((r) => setTimeout(r, EXEC_STOP_WAIT_MS)),
+            ]);
+        };
         const interrupted = (sig) => {
-            const ending = followKill?.() ?? Promise.resolve();
+            const ending = followKill?.() ?? stopForeground();
             void ending.finally(() => interruptedEnvelope(sig));
         };
         const interruptedEnvelope = (sig) => {
             const err = new PromigenceError({
                 code: "aborted_by_client",
-                message: `interrupted by ${sig}; the command in the sandbox ends with this connection`,
+                message: `interrupted by ${sig}; the command in the sandbox is stopped`,
                 fix: "Nothing to fix; billed for the seconds used. The sandbox itself is still running.",
                 exitCode: 130,
             });
@@ -1696,9 +1725,22 @@ const exec = async (ctx) => {
         const followed = streaming && ctx.mode === "text" && process.env["PROMIGENCE_EXEC_FOLLOW"] !== "0"
             ? await followExec(c, sandboxId, execOpts, maxOutput === undefined ? undefined : execOpts.maxOutputBytes)
             : undefined;
-        const res = followed ?? (streaming
-            ? await streamExec(ctx, c, sandboxId, execOpts)
-            : asText(await c.sandboxes.exec(sandboxId, { ...execOpts, encoding: "base64" })));
+        let res;
+        if (followed !== undefined)
+            res = followed;
+        else {
+            foreground = streaming
+                ? streamExec(ctx, c, sandboxId, { ...execOpts, signal: stop.signal })
+                : c.sandboxes.exec(sandboxId, { ...execOpts, encoding: "base64", signal: stop.signal }).then(asText);
+            try {
+                res = await foreground;
+            }
+            catch (err) {
+                if (stop.signal.aborted)
+                    return new Promise(() => { });
+                throw err;
+            }
+        }
         const execTotalMs = performance.now() - execStarted;
         const outcome = execOutcome(res, sandboxId, execOpts.timeoutMs);
         const passthrough = !bool(ctx, "--no-passthrough");
@@ -1766,9 +1808,22 @@ const exec = async (ctx) => {
                 ? "still waiting for capacity being added (pass --wait)"
                 : s.state === "queued" ? "not ready (pass --wait)" : "ended",
     }));
+    const stop = new AbortController();
+    const running = [];
+    const onSignal = (sig) => {
+        for (const s of ["SIGINT", "SIGTERM", "SIGHUP"])
+            process.removeListener(s, onSignal);
+        stop.abort();
+        void Promise.race([Promise.allSettled(running), new Promise((r) => setTimeout(r, EXEC_STOP_WAIT_MS))])
+            .finally(() => process.kill(process.pid, sig));
+    };
+    for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"])
+        process.once(sig, onSignal);
     const rows = await Promise.all(targets.map(async (s) => {
         try {
-            const res = await c.sandboxes.exec(s.sandbox_id, execOpts);
+            const call = c.sandboxes.exec(s.sandbox_id, { ...execOpts, signal: stop.signal });
+            running.push(call);
+            const res = await call;
             const o = execOutcome(res, s.sandbox_id, execOpts.timeoutMs);
             return {
                 sandbox_id: s.sandbox_id, exec_id: res.exec_id, ...o.fields, exit_code: o.exitCode,
@@ -1781,6 +1836,10 @@ const exec = async (ctx) => {
             return { sandbox_id: s.sandbox_id, error: e.toJSON(), exit: e.cliExit };
         }
     }));
+    if (stop.signal.aborted)
+        return new Promise(() => { });
+    for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"])
+        process.removeListener(sig, onSignal);
     const codes = [];
     for (const r of rows) {
         if (!("exec_id" in r))
@@ -2113,17 +2172,14 @@ const runComposite = async (ctx) => {
         : []));
     const outputs = streaming ? new Map() : await outputTails(c, report.sandboxes ?? []);
     const culprit = exit === 0 ? undefined : (report.sandboxes ?? []).find((s) => s.state === "ended" && OUTCOME_EXIT[s.outcome ?? ""] === exit && s.execs?.length);
-    const gradeFailed = culprit !== undefined && culprit.failure?.code === "grade_not_passed";
-    const firstExec = culprit ?? (report.sandboxes ?? []).find((s) => s.execs?.length);
-    if (gradeFailed) {
-        next.push(...nexts([sh `promigence run report ${runId} --sandbox ${culprit.sandbox_id}`,
-            report.requested?.grade_output ? "its grade, and what the grader printed" : "its grade (what the grader prints is kept only with --grade-output)"]));
+    const culpritNext = culprit === undefined ? undefined : failedSandboxNext(runId, culprit, Boolean(report.requested?.grade_output));
+    const firstExec = (report.sandboxes ?? []).find((s) => s.execs?.length);
+    if (culpritNext) {
+        next.push(...nexts(culpritNext));
     }
     else if (firstExec) {
         const eid = firstExec.execs[firstExec.execs.length - 1].exec_id;
-        next.push(...nexts(culprit
-            ? [sh `promigence exec output ${eid} --sandbox ${firstExec.sandbox_id} --stderr`, "the failed sandbox's command output (stderr; drop --stderr for stdout)"]
-            : [sh `promigence exec output ${eid} --sandbox ${firstExec.sandbox_id}`, "one sandbox's full command output"]));
+        next.push(...nexts([sh `promigence exec output ${eid} --sandbox ${firstExec.sandbox_id}`, "one sandbox's full command output"]));
     }
     const common = commonWarnings(report.sandboxes ?? []);
     const ownWarnings = (w) => (w ?? []).filter((x) => !common.includes(x));
@@ -2370,8 +2426,9 @@ export function failureLines(report, outputs, stderrTail) {
                     lines.push(`    stderr: ${l}`);
         }
         lines.push(`    fix: ${failureFix(report.run_id, s)}`);
-        if (ex?.exec_id)
-            lines.push(`    next: ${sh `promigence exec output ${ex.exec_id} --sandbox ${s.sandbox_id} --stderr`}`);
+        const next = failedSandboxNext(report.run_id, s);
+        if (next)
+            lines.push(`    next: ${next[0]}`);
     }
     if (failed.length > FAILURES_SHOWN) {
         lines.push(`  … ${failed.length - FAILURES_SHOWN} more: ${sh `promigence run report ${report.run_id} --sandboxes failed`}`);
@@ -2381,6 +2438,14 @@ export function failureLines(report, outputs, stderrTail) {
         lines.push(`  note: ${net}`);
     return lines;
 }
+export function failedSandboxNext(runId, s, gradeOutput = false) {
+    if (s.failure?.code === "grade_not_passed") {
+        return [sh `promigence run report ${runId} --sandbox ${s.sandbox_id}`,
+            gradeOutput ? "its grade, and what the grader printed" : "its grade (what the grader prints is kept only with --grade-output)"];
+    }
+    const eid = s.execs?.at(-1)?.exec_id;
+    return eid ? [sh `promigence exec output ${eid} --sandbox ${s.sandbox_id} --stderr`, "the failed sandbox's command output (stderr; drop --stderr for stdout)"] : undefined;
+}
 export const OUTPUT_TAIL_SANDBOXES = 20;
 export const OUTPUT_TAIL_CHARS = 4096;
 export async function outputTails(c, sandboxes) {
@@ -2609,7 +2674,9 @@ const sandboxNetwork = async (ctx) => {
     const v = await client(ctx).sandboxes.network(sid);
     const mode = typeof v.network === "string" ? v.network : `only ${v.network.allow.join(", ")}`;
     const lines = [`sandbox ${sid}: ${mode}`, `  ${networkMeaning(v.network)}`];
-    const refused = v.refused_hosts ?? [];
+    const refused = Array.isArray(v.refused_hosts) ? v.refused_hosts : [];
+    const counted = (k) => typeof v[k] === "number";
+    const known = counted("refused_lookups") || counted("refused_connections");
     for (const r of refused) {
         lines.push(`  refused  ${r.host}${r.count ? ` (looked up ${r.count} time${r.count === 1 ? "" : "s"})` : ""}`);
     }
@@ -2617,11 +2684,18 @@ const sandboxNetwork = async (ctx) => {
     if (toAddresses > 0) {
         lines.push(`  refused  ${toAddresses} connection${toAddresses === 1 ? "" : "s"} to an address with no name (counted; addresses are not recorded)`);
     }
+    if (refused.length && !known)
+        lines.push("  (as recorded while it ran: it may not list every refusal)");
     if (refused.length) {
         lines.push(`add one with --allow HOST when you start the sandbox`);
     }
     else if (typeof v.network !== "string" && toAddresses === 0) {
-        lines.push("  nothing has been refused");
+        const why = v.state === "ended"
+            ? "it has ended, and refusals are listed while a sandbox runs"
+            : v.state === "ready" || v.state === "running"
+                ? "they could not be read just now; run this again"
+                : `it is ${v.state || "not running"}, and refusals are listed while a sandbox runs`;
+        lines.push(known ? "  nothing has been refused" : `  what it was refused is not known: ${why}`);
     }
     for (const b of v.via_secret ?? []) {
         lines.push(`  via secret ${b.secret}: ${b.hosts.join(", ") || "(no hosts)"}`);
@@ -2847,10 +2921,12 @@ const filesPut = async (ctx) => {
 export function transferProgress(label, total, mode, out = process.stderr, now = Date.now, env = process.env) {
     if (mode !== "text" || !out.isTTY || env["PROMIGENCE_QUIET"] === "1")
         return { add: () => { }, done: () => { } };
+    const plain = "NO_COLOR" in env || env["TERM"] === "dumb";
     const t0 = now();
     let moved = 0;
     let drawn = 0;
     let shown = false;
+    let width = 0;
     return {
         add: (n) => {
             moved += n;
@@ -2860,11 +2936,13 @@ export function transferProgress(label, total, mode, out = process.stderr, now =
             drawn = t;
             shown = true;
             const of = total ? ` of ${bytes(total)} (${Math.min(100, Math.floor((moved * 100) / total))}%)` : "";
-            out.write(`\r${label}: ${bytes(moved)}${of}\x1b[K`);
+            const line = `${label}: ${bytes(moved)}${of}`;
+            out.write(plain ? `\r${line}${" ".repeat(Math.max(0, width - line.length))}` : `\r${line}\x1b[K`);
+            width = line.length;
         },
         done: () => {
             if (shown)
-                out.write("\r\x1b[K");
+                out.write(plain ? `\r${" ".repeat(width)}\r` : "\r\x1b[K");
         },
     };
 }