sandbox 3.0.0-beta.8 → 3.0.0

package/dist/{app-K77UztMr.mjs → app-BaHpC2zy.mjs}

@@ -15,10 +15,11 @@ import childProcess, { execFile } from "node:child_process";
 import fs, { constants, writeFile } from "node:fs/promises";
 import fs$1, { createWriteStream } from "node:fs";
 import * as Auth from "@vercel/sandbox/dist/auth/index.js";
-import { OAuth, getAuth, pollForToken, updateAuthConfig } from "@vercel/sandbox/dist/auth/index.js";
+import { NotOk, OAuth, getAuth, inferScope, pollForToken, updateAuthConfig } from "@vercel/sandbox/dist/auth/index.js";
 import { EOL } from "os";
 import { z } from "zod/v4";
 import { z as z$1 } from "zod";
+import retry from "async-retry";
 import { APIError, Sandbox, Snapshot } from "@vercel/sandbox";
 import readline from "node:readline";
 import { randomUUID } from "crypto";
@@ -295,30 +296,30 @@ var init_supports_color = __esm({ "../../node_modules/.pnpm/chalk@5.6.0/node_mod
 
 //#endregion
 //#region ../../node_modules/.pnpm/chalk@5.6.0/node_modules/chalk/source/utilities.js
-function stringReplaceAll(string$1, substring, replacer) {
-	let index = string$1.indexOf(substring);
-	if (index === -1) return string$1;
+function stringReplaceAll(string$2, substring, replacer) {
+	let index = string$2.indexOf(substring);
+	if (index === -1) return string$2;
 	const substringLength = substring.length;
 	let endIndex = 0;
 	let returnValue = "";
 	do {
-		returnValue += string$1.slice(endIndex, index) + substring + replacer;
+		returnValue += string$2.slice(endIndex, index) + substring + replacer;
 		endIndex = index + substringLength;
-		index = string$1.indexOf(substring, endIndex);
+		index = string$2.indexOf(substring, endIndex);
 	} while (index !== -1);
-	returnValue += string$1.slice(endIndex);
+	returnValue += string$2.slice(endIndex);
 	return returnValue;
 }
-function stringEncaseCRLFWithFirstIndex(string$1, prefix$1, postfix, index) {
+function stringEncaseCRLFWithFirstIndex(string$2, prefix$1, postfix, index) {
 	let endIndex = 0;
 	let returnValue = "";
 	do {
-		const gotCR = string$1[index - 1] === "\r";
-		returnValue += string$1.slice(endIndex, gotCR ? index - 1 : index) + prefix$1 + (gotCR ? "\r\n" : "\n") + postfix;
+		const gotCR = string$2[index - 1] === "\r";
+		returnValue += string$2.slice(endIndex, gotCR ? index - 1 : index) + prefix$1 + (gotCR ? "\r\n" : "\n") + postfix;
 		endIndex = index + 1;
-		index = string$1.indexOf("\n", endIndex);
+		index = string$2.indexOf("\n", endIndex);
 	} while (index !== -1);
-	returnValue += string$1.slice(endIndex);
+	returnValue += string$2.slice(endIndex);
 	return returnValue;
 }
 var init_utilities = __esm({ "../../node_modules/.pnpm/chalk@5.6.0/node_modules/chalk/source/utilities.js": (() => {}) });
@@ -454,18 +455,18 @@ var init_source = __esm({ "../../node_modules/.pnpm/chalk@5.6.0/node_modules/cha
 		builder[IS_EMPTY] = _isEmpty;
 		return builder;
 	};
-	applyStyle = (self, string$1) => {
-		if (self.level <= 0 || !string$1) return self[IS_EMPTY] ? "" : string$1;
+	applyStyle = (self, string$2) => {
+		if (self.level <= 0 || !string$2) return self[IS_EMPTY] ? "" : string$2;
 		let styler = self[STYLER];
-		if (styler === void 0) return string$1;
+		if (styler === void 0) return string$2;
 		const { openAll, closeAll } = styler;
-		if (string$1.includes("\x1B")) while (styler !== void 0) {
-			string$1 = stringReplaceAll(string$1, styler.close, styler.open);
+		if (string$2.includes("\x1B")) while (styler !== void 0) {
+			string$2 = stringReplaceAll(string$2, styler.close, styler.open);
 			styler = styler.parent;
 		}
-		const lfIndex = string$1.indexOf("\n");
-		if (lfIndex !== -1) string$1 = stringEncaseCRLFWithFirstIndex(string$1, closeAll, openAll, lfIndex);
-		return openAll + string$1 + closeAll;
+		const lfIndex = string$2.indexOf("\n");
+		if (lfIndex !== -1) string$2 = stringEncaseCRLFWithFirstIndex(string$2, closeAll, openAll, lfIndex);
+		return openAll + string$2 + closeAll;
 	};
 	Object.defineProperties(createChalk.prototype, styles);
 	chalk = createChalk();
@@ -689,7 +690,7 @@ var require_type = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cmd-
 	exports.identity = void 0;
 	exports.typeDef = typeDef;
 	exports.fromFn = fromFn;
-	exports.extendType = extendType$1;
+	exports.extendType = extendType$2;
 	var from_1 = require_from();
 	Object.defineProperty(exports, "identity", {
 		enumerable: true,
@@ -721,7 +722,7 @@ var require_type = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cmd-
 	* @param base A base type from `InputA` to `OutputA`
 	* @param nextTypeOrDecodingFunction Either an entire `Type<OutputA, AnyOutput>` or just a decoding function from `OutputA` to any type
 	*/
-	function extendType$1(base, nextTypeOrDecodingFunction) {
+	function extendType$2(base, nextTypeOrDecodingFunction) {
 		const { defaultValue: _defaultValue, onMissing: _onMissing, from: _from, ...t1WithoutDefault } = base;
 		const t2Object = typeDef(nextTypeOrDecodingFunction);
 		const t2From = fromFn(nextTypeOrDecodingFunction);
@@ -1997,7 +1998,7 @@ var require_parser$1 = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/
 	};
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.parse = parse$5;
-	const debug$6 = (0, __importDefault$1(__require$1("debug")).default)("cmd-ts:parser");
+	const debug$7 = (0, __importDefault$1(__require$1("debug")).default)("cmd-ts:parser");
 	/**
 	* Create an AST from a token list
 	*
@@ -2005,14 +2006,14 @@ var require_parser$1 = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/
 	* @param forceFlag Keys to force as flag. {@see ForceFlag} to read more about it.
 	*/
 	function parse$5(tokens, forceFlag) {
-		if (debug$6.enabled) {
+		if (debug$7.enabled) {
 			const registered = {
 				shortFlags: [...forceFlag.forceFlagShortNames],
 				longFlags: [...forceFlag.forceFlagLongNames],
 				shortOptions: [...forceFlag.forceOptionShortNames],
 				longOptions: [...forceFlag.forceOptionLongNames]
 			};
-			debug$6("Registered:", JSON.stringify(registered));
+			debug$7("Registered:", JSON.stringify(registered));
 		}
 		const nodes = [];
 		let index = 0;
@@ -2143,9 +2144,9 @@ var require_parser$1 = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/
 			}
 			index++;
 		}
-		if (debug$6.enabled) {
+		if (debug$7.enabled) {
 			const objectNodes = nodes.map((node) => ({ [node.type]: node.raw }));
-			debug$6("Parsed items:", JSON.stringify(objectNodes));
+			debug$7("Parsed items:", JSON.stringify(objectNodes));
 		}
 		return nodes;
 	}
@@ -2200,8 +2201,8 @@ var require_tokenizer = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm
 			tokens.push(token$1);
 			overallIndex += token$1.raw.length;
 		};
-		for (const [stringIndex, string$1] of (0, utils_1.enumerate)(strings)) {
-			const chars = [...string$1];
+		for (const [stringIndex, string$2] of (0, utils_1.enumerate)(strings)) {
+			const chars = [...string$2];
 			for (let i = 0; i < chars.length; i++) if (chars[i] === "-" && chars[i + 1] === "-") {
 				push$1({
 					type: "longPrefix",
@@ -2997,16 +2998,17 @@ var require_cjs = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cmd-t
 
 //#endregion
 //#region src/args/runtime.ts
-var import_cjs$26 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$30 = /* @__PURE__ */ __toESM(require_cjs());
 const runtimeType = {
-	...import_cjs$26.oneOf([
+	...import_cjs$30.oneOf([
 		"node22",
 		"node24",
+		"node26",
 		"python3.13"
 	]),
 	displayName: "runtime"
 };
-const runtime = import_cjs$26.option({
+const runtime = import_cjs$30.option({
 	long: "runtime",
 	type: runtimeType,
 	defaultValue: () => "node24",
@@ -3100,13 +3102,13 @@ var require_ms = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/ms@2.1
 	* @return {String}
 	* @api private
 	*/
-	function fmtShort(ms$4) {
-		var msAbs = Math.abs(ms$4);
-		if (msAbs >= d) return Math.round(ms$4 / d) + "d";
-		if (msAbs >= h) return Math.round(ms$4 / h) + "h";
-		if (msAbs >= m) return Math.round(ms$4 / m) + "m";
-		if (msAbs >= s) return Math.round(ms$4 / s) + "s";
-		return ms$4 + "ms";
+	function fmtShort(ms$6) {
+		var msAbs = Math.abs(ms$6);
+		if (msAbs >= d) return Math.round(ms$6 / d) + "d";
+		if (msAbs >= h) return Math.round(ms$6 / h) + "h";
+		if (msAbs >= m) return Math.round(ms$6 / m) + "m";
+		if (msAbs >= s) return Math.round(ms$6 / s) + "s";
+		return ms$6 + "ms";
 	}
 	/**
 	* Long format for `ms`.
@@ -3115,34 +3117,34 @@ var require_ms = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/ms@2.1
 	* @return {String}
 	* @api private
 	*/
-	function fmtLong(ms$4) {
-		var msAbs = Math.abs(ms$4);
-		if (msAbs >= d) return plural(ms$4, msAbs, d, "day");
-		if (msAbs >= h) return plural(ms$4, msAbs, h, "hour");
-		if (msAbs >= m) return plural(ms$4, msAbs, m, "minute");
-		if (msAbs >= s) return plural(ms$4, msAbs, s, "second");
-		return ms$4 + " ms";
+	function fmtLong(ms$6) {
+		var msAbs = Math.abs(ms$6);
+		if (msAbs >= d) return plural(ms$6, msAbs, d, "day");
+		if (msAbs >= h) return plural(ms$6, msAbs, h, "hour");
+		if (msAbs >= m) return plural(ms$6, msAbs, m, "minute");
+		if (msAbs >= s) return plural(ms$6, msAbs, s, "second");
+		return ms$6 + " ms";
 	}
 	/**
 	* Pluralization helper.
 	*/
-	function plural(ms$4, msAbs, n, name) {
+	function plural(ms$6, msAbs, n, name) {
 		var isPlural = msAbs >= n * 1.5;
-		return Math.round(ms$4 / n) + " " + name + (isPlural ? "s" : "");
+		return Math.round(ms$6 / n) + " " + name + (isPlural ? "s" : "");
 	}
 }) });
 
 //#endregion
 //#region src/types/duration.ts
-var import_cjs$25 = require_cjs();
+var import_cjs$29 = require_cjs();
 init_source();
-const Duration = (0, import_cjs$25.extendType)(import_cjs$25.string, {
+const Duration = (0, import_cjs$29.extendType)(import_cjs$29.string, {
 	displayName: "num UNIT",
 	description: "A duration, e.g. 5m, 10s, 1h",
-	async from(string$1) {
-		const match$1 = string$1.match(/^(\d+) ?(ms|milliseconds?|msecs?|s(?:econds?)?|m(?:inutes?)?|h(?:ours?)?|d(?:ays?)?)?$/);
+	async from(string$2) {
+		const match$1 = string$2.match(/^(\d+) ?(ms|milliseconds?|msecs?|s(?:econds?)?|m(?:inutes?)?|h(?:ours?)?|d(?:ays?)?)?$/);
 		if (!match$1) throw new Error([
-			`Malformed duration: "${string$1}".`,
+			`Malformed duration: "${string$2}".`,
 			`${source_default.bold("hint:")} Use a number followed by a unit: s (seconds), m (minutes), h (hours), d (days).`,
 			"╰▶ Examples: 30s, 5m, 2h, 1d"
 		].join("\n"));
@@ -3152,28 +3154,28 @@ const Duration = (0, import_cjs$25.extendType)(import_cjs$25.string, {
 
 //#endregion
 //#region src/args/timeout.ts
-var import_cjs$24 = /* @__PURE__ */ __toESM(require_cjs());
-const timeout = import_cjs$24.option({
+var import_cjs$28 = /* @__PURE__ */ __toESM(require_cjs());
+const timeout = import_cjs$28.option({
 	long: "timeout",
 	type: Duration,
-	description: "The maximum duration a sandbox can run for. Example: 5m, 1h",
+	description: "The maximum duration a sandbox can run for. Example: 5m, 30m",
 	defaultValue: () => "5 minutes",
 	defaultValueIsSerializable: true
 });
 
 //#endregion
 //#region src/args/vcpus.ts
-var import_cjs$23 = /* @__PURE__ */ __toESM(require_cjs());
-const vcpusType = import_cjs$23.extendType(import_cjs$23.number, {
+var import_cjs$27 = /* @__PURE__ */ __toESM(require_cjs());
+const vcpusType = import_cjs$27.extendType(import_cjs$27.number, {
 	displayName: "COUNT",
 	async from(n) {
 		if (!Number.isInteger(n) || n < 1) throw new Error(`Invalid vCPU count: ${n}. Must be a positive integer.`);
 		return n;
 	}
 });
-const vcpus = import_cjs$23.option({
+const vcpus = import_cjs$27.option({
 	long: "vcpus",
-	type: import_cjs$23.optional(vcpusType),
+	type: import_cjs$27.optional(vcpusType),
 	description: "Number of vCPUs to allocate (each vCPU includes 2048 MB of memory)"
 });
 
@@ -3242,7 +3244,7 @@ const formatDistanceLocale = {
 		other: "almost {{count}} years"
 	}
 };
-const formatDistance$1 = (token$1, count, options) => {
+const formatDistance = (token$1, count, options) => {
 	let result;
 	const tokenValue = formatDistanceLocale[token$1];
 	if (typeof tokenValue === "string") result = tokenValue;
@@ -3255,10 +3257,10 @@ const formatDistance$1 = (token$1, count, options) => {
 
 //#endregion
 //#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/_lib/buildFormatLongFn.js
-function buildFormatLongFn(args$4) {
+function buildFormatLongFn(args$5) {
 	return (options = {}) => {
-		const width = options.width ? String(options.width) : args$4.defaultWidth;
-		return args$4.formats[width] || args$4.formats[args$4.defaultWidth];
+		const width = options.width ? String(options.width) : args$5.defaultWidth;
+		return args$5.formats[width] || args$5.formats[args$5.defaultWidth];
 	};
 }
 
@@ -3342,20 +3344,20 @@ const formatRelative = (token$1, _date, _baseDate, _options$1) => formatRelative
 /**
 * The tuple of localized month values. The first element represents January.
 */
-function buildLocalizeFn(args$4) {
+function buildLocalizeFn(args$5) {
 	return (value, options) => {
 		const context = options?.context ? String(options.context) : "standalone";
 		let valuesArray;
-		if (context === "formatting" && args$4.formattingValues) {
-			const defaultWidth = args$4.defaultFormattingWidth || args$4.defaultWidth;
+		if (context === "formatting" && args$5.formattingValues) {
+			const defaultWidth = args$5.defaultFormattingWidth || args$5.defaultWidth;
 			const width = options?.width ? String(options.width) : defaultWidth;
-			valuesArray = args$4.formattingValues[width] || args$4.formattingValues[defaultWidth];
+			valuesArray = args$5.formattingValues[width] || args$5.formattingValues[defaultWidth];
 		} else {
-			const defaultWidth = args$4.defaultWidth;
-			const width = options?.width ? String(options.width) : args$4.defaultWidth;
-			valuesArray = args$4.values[width] || args$4.values[defaultWidth];
+			const defaultWidth = args$5.defaultWidth;
+			const width = options?.width ? String(options.width) : args$5.defaultWidth;
+			valuesArray = args$5.values[width] || args$5.values[defaultWidth];
 		}
-		const index = args$4.argumentCallback ? args$4.argumentCallback(value) : value;
+		const index = args$5.argumentCallback ? args$5.argumentCallback(value) : value;
 		return valuesArray[index];
 	};
 }
@@ -3572,19 +3574,19 @@ const localize = {
 
 //#endregion
 //#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/_lib/buildMatchFn.js
-function buildMatchFn(args$4) {
-	return (string$1, options = {}) => {
+function buildMatchFn(args$5) {
+	return (string$2, options = {}) => {
 		const width = options.width;
-		const matchPattern = width && args$4.matchPatterns[width] || args$4.matchPatterns[args$4.defaultMatchWidth];
-		const matchResult = string$1.match(matchPattern);
+		const matchPattern = width && args$5.matchPatterns[width] || args$5.matchPatterns[args$5.defaultMatchWidth];
+		const matchResult = string$2.match(matchPattern);
 		if (!matchResult) return null;
 		const matchedString = matchResult[0];
-		const parsePatterns = width && args$4.parsePatterns[width] || args$4.parsePatterns[args$4.defaultParseWidth];
+		const parsePatterns = width && args$5.parsePatterns[width] || args$5.parsePatterns[args$5.defaultParseWidth];
 		const key = Array.isArray(parsePatterns) ? findIndex(parsePatterns, (pattern) => pattern.test(matchedString)) : findKey(parsePatterns, (pattern) => pattern.test(matchedString));
 		let value;
-		value = args$4.valueCallback ? args$4.valueCallback(key) : key;
+		value = args$5.valueCallback ? args$5.valueCallback(key) : key;
 		value = options.valueCallback ? options.valueCallback(value) : value;
-		const rest$1 = string$1.slice(matchedString.length);
+		const rest$1 = string$2.slice(matchedString.length);
 		return {
 			value,
 			rest: rest$1
@@ -3600,16 +3602,16 @@ function findIndex(array$1, predicate) {
 
 //#endregion
 //#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/_lib/buildMatchPatternFn.js
-function buildMatchPatternFn(args$4) {
-	return (string$1, options = {}) => {
-		const matchResult = string$1.match(args$4.matchPattern);
+function buildMatchPatternFn(args$5) {
+	return (string$2, options = {}) => {
+		const matchResult = string$2.match(args$5.matchPattern);
 		if (!matchResult) return null;
 		const matchedString = matchResult[0];
-		const parseResult = string$1.match(args$4.parsePattern);
+		const parseResult = string$2.match(args$5.parsePattern);
 		if (!parseResult) return null;
-		let value = args$4.valueCallback ? args$4.valueCallback(parseResult[0]) : parseResult[0];
+		let value = args$5.valueCallback ? args$5.valueCallback(parseResult[0]) : parseResult[0];
 		value = options.valueCallback ? options.valueCallback(value) : value;
-		const rest$1 = string$1.slice(matchedString.length);
+		const rest$1 = string$2.slice(matchedString.length);
 		return {
 			value,
 			rest: rest$1
@@ -3764,7 +3766,7 @@ const match = {
 */
 const enUS = {
 	code: "en-US",
-	formatDistance: formatDistance$1,
+	formatDistance,
 	formatLong,
 	formatRelative,
 	localize,
@@ -3782,6 +3784,15 @@ function getDefaultOptions() {
 	return defaultOptions;
 }
 
+//#endregion
+//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/_lib/getRoundingMethod.js
+function getRoundingMethod(method) {
+	return (number) => {
+		const result = (method ? Math[method] : Math.trunc)(number);
+		return result === 0 ? 0 : result;
+	};
+}
+
 //#endregion
 //#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/constants.js
 /**
@@ -3815,6 +3826,18 @@ const daysInYear = 365.2425;
 const maxTime = Math.pow(10, 8) * 24 * 60 * 60 * 1e3;
 /**
 * @constant
+* @name millisecondsInMinute
+* @summary Milliseconds in 1 minute
+*/
+const millisecondsInMinute = 6e4;
+/**
+* @constant
+* @name minutesInYear
+* @summary Minutes in 1 year.
+*/
+const minutesInYear = 525600;
+/**
+* @constant
 * @name minutesInMonth
 * @summary Minutes in 1 month.
 */
@@ -4031,277 +4054,31 @@ function compareAsc(dateLeft, dateRight) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/differenceInCalendarMonths.js
-/**
-* The {@link differenceInCalendarMonths} function options.
-*/
-/**
-* @name differenceInCalendarMonths
-* @category Month Helpers
-* @summary Get the number of calendar months between the given dates.
-*
-* @description
-* Get the number of calendar months between the given dates.
-*
-* @param laterDate - The later date
-* @param earlierDate - The earlier date
-* @param options - An object with options
-*
-* @returns The number of calendar months
-*
-* @example
-* // How many calendar months are between 31 January 2014 and 1 September 2014?
-* const result = differenceInCalendarMonths(
-*   new Date(2014, 8, 1),
-*   new Date(2014, 0, 31)
-* )
-* //=> 8
-*/
-function differenceInCalendarMonths(laterDate, earlierDate, options) {
-	const [laterDate_, earlierDate_] = normalizeDates(options?.in, laterDate, earlierDate);
-	const yearsDiff = laterDate_.getFullYear() - earlierDate_.getFullYear();
-	const monthsDiff = laterDate_.getMonth() - earlierDate_.getMonth();
-	return yearsDiff * 12 + monthsDiff;
-}
-
-//#endregion
-//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/endOfDay.js
-/**
-* The {@link endOfDay} function options.
-*/
-/**
-* @name endOfDay
-* @category Day Helpers
-* @summary Return the end of a day for the given date.
-*
-* @description
-* Return the end of a day for the given date.
-* The result will be in the local timezone.
-*
-* @typeParam DateType - The `Date` type, the function operates on. Gets inferred from passed arguments. Allows to use extensions like [`UTCDate`](https://github.com/date-fns/utc).
-* @typeParam ResultDate - The result `Date` type, it is the type returned from the context function if it is passed, or inferred from the arguments.
-*
-* @param date - The original date
-* @param options - An object with options
-*
-* @returns The end of a day
-*
-* @example
-* // The end of a day for 2 September 2014 11:55:00:
-* const result = endOfDay(new Date(2014, 8, 2, 11, 55, 0))
-* //=> Tue Sep 02 2014 23:59:59.999
-*/
-function endOfDay(date, options) {
-	const _date = toDate(date, options?.in);
-	_date.setHours(23, 59, 59, 999);
-	return _date;
-}
-
-//#endregion
-//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/endOfMonth.js
-/**
-* The {@link endOfMonth} function options.
-*/
-/**
-* @name endOfMonth
-* @category Month Helpers
-* @summary Return the end of a month for the given date.
-*
-* @description
-* Return the end of a month for the given date.
-* The result will be in the local timezone.
-*
-* @typeParam DateType - The `Date` type, the function operates on. Gets inferred from passed arguments. Allows to use extensions like [`UTCDate`](https://github.com/date-fns/utc).
-* @typeParam ResultDate - The result `Date` type, it is the type returned from the context function if it is passed, or inferred from the arguments.
-*
-* @param date - The original date
-* @param options - An object with options
-*
-* @returns The end of a month
-*
-* @example
-* // The end of a month for 2 September 2014 11:55:00:
-* const result = endOfMonth(new Date(2014, 8, 2, 11, 55, 0))
-* //=> Tue Sep 30 2014 23:59:59.999
-*/
-function endOfMonth(date, options) {
-	const _date = toDate(date, options?.in);
-	const month = _date.getMonth();
-	_date.setFullYear(_date.getFullYear(), month + 1, 0);
-	_date.setHours(23, 59, 59, 999);
-	return _date;
-}
-
-//#endregion
-//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/isLastDayOfMonth.js
-/**
-* @name isLastDayOfMonth
-* @category Month Helpers
-* @summary Is the given date the last day of a month?
-*
-* @description
-* Is the given date the last day of a month?
-*
-* @param date - The date to check
-* @param options - An object with options
-*
-* @returns The date is the last day of a month
-*
-* @example
-* // Is 28 February 2014 the last day of a month?
-* const result = isLastDayOfMonth(new Date(2014, 1, 28))
-* //=> true
-*/
-function isLastDayOfMonth(date, options) {
-	const _date = toDate(date, options?.in);
-	return +endOfDay(_date, options) === +endOfMonth(_date, options);
-}
-
-//#endregion
-//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/differenceInMonths.js
-/**
-* The {@link differenceInMonths} function options.
-*/
-/**
-* @name differenceInMonths
-* @category Month Helpers
-* @summary Get the number of full months between the given dates.
-*
-* @param laterDate - The later date
-* @param earlierDate - The earlier date
-* @param options - An object with options
-*
-* @returns The number of full months
-*
-* @example
-* // How many full months are between 31 January 2014 and 1 September 2014?
-* const result = differenceInMonths(new Date(2014, 8, 1), new Date(2014, 0, 31))
-* //=> 7
-*/
-function differenceInMonths(laterDate, earlierDate, options) {
-	const [laterDate_, workingLaterDate, earlierDate_] = normalizeDates(options?.in, laterDate, laterDate, earlierDate);
-	const sign = compareAsc(workingLaterDate, earlierDate_);
-	const difference = Math.abs(differenceInCalendarMonths(workingLaterDate, earlierDate_));
-	if (difference < 1) return 0;
-	if (workingLaterDate.getMonth() === 1 && workingLaterDate.getDate() > 27) workingLaterDate.setDate(30);
-	workingLaterDate.setMonth(workingLaterDate.getMonth() - sign * difference);
-	let isLastMonthNotFull = compareAsc(workingLaterDate, earlierDate_) === -sign;
-	if (isLastDayOfMonth(laterDate_) && difference === 1 && compareAsc(laterDate_, earlierDate_) === 1) isLastMonthNotFull = false;
-	const result = sign * (difference - +isLastMonthNotFull);
-	return result === 0 ? 0 : result;
-}
-
-//#endregion
-//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/_lib/getRoundingMethod.js
-function getRoundingMethod(method) {
-	return (number) => {
-		const result = (method ? Math[method] : Math.trunc)(number);
-		return result === 0 ? 0 : result;
-	};
-}
-
-//#endregion
-//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/differenceInMilliseconds.js
-/**
-* @name differenceInMilliseconds
-* @category Millisecond Helpers
-* @summary Get the number of milliseconds between the given dates.
-*
-* @description
-* Get the number of milliseconds between the given dates.
-*
-* @param laterDate - The later date
-* @param earlierDate - The earlier date
-*
-* @returns The number of milliseconds
-*
-* @example
-* // How many milliseconds are between
-* // 2 July 2014 12:30:20.600 and 2 July 2014 12:30:21.700?
-* const result = differenceInMilliseconds(
-*   new Date(2014, 6, 2, 12, 30, 21, 700),
-*   new Date(2014, 6, 2, 12, 30, 20, 600)
-* )
-* //=> 1100
-*/
-function differenceInMilliseconds(laterDate, earlierDate) {
-	return +toDate(laterDate) - +toDate(earlierDate);
-}
-
-//#endregion
-//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/differenceInSeconds.js
+//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/formatDistanceStrict.js
 /**
-* The {@link differenceInSeconds} function options.
+* The {@link formatDistanceStrict} function options.
 */
 /**
-* @name differenceInSeconds
-* @category Second Helpers
-* @summary Get the number of seconds between the given dates.
-*
-* @description
-* Get the number of seconds between the given dates.
-*
-* @param laterDate - The later date
-* @param earlierDate - The earlier date
-* @param options - An object with options.
-*
-* @returns The number of seconds
-*
-* @example
-* // How many seconds are between
-* // 2 July 2014 12:30:07.999 and 2 July 2014 12:30:20.000?
-* const result = differenceInSeconds(
-*   new Date(2014, 6, 2, 12, 30, 20, 0),
-*   new Date(2014, 6, 2, 12, 30, 7, 999)
-* )
-* //=> 12
-*/
-function differenceInSeconds(laterDate, earlierDate, options) {
-	const diff = differenceInMilliseconds(laterDate, earlierDate) / 1e3;
-	return getRoundingMethod(options?.roundingMethod)(diff);
-}
-
-//#endregion
-//#region ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/formatDistance.js
-/**
-* The {@link formatDistance} function options.
+* The unit used to format the distance in {@link formatDistanceStrict}.
 */
 /**
-* @name formatDistance
+* @name formatDistanceStrict
 * @category Common Helpers
 * @summary Return the distance between the given dates in words.
 *
 * @description
-* Return the distance between the given dates in words.
+* Return the distance between the given dates in words, using strict units.
+* This is like `formatDistance`, but does not use helpers like 'almost', 'over',
+* 'less than' and the like.
 *
-* | Distance between dates                                            | Result              |
-* |-------------------------------------------------------------------|---------------------|
-* | 0 ... 30 secs                                                     | less than a minute  |
-* | 30 secs ... 1 min 30 secs                                         | 1 minute            |
-* | 1 min 30 secs ... 44 mins 30 secs                                 | [2..44] minutes     |
-* | 44 mins ... 30 secs ... 89 mins 30 secs                           | about 1 hour        |
-* | 89 mins 30 secs ... 23 hrs 59 mins 30 secs                        | about [2..24] hours |
-* | 23 hrs 59 mins 30 secs ... 41 hrs 59 mins 30 secs                 | 1 day               |
-* | 41 hrs 59 mins 30 secs ... 29 days 23 hrs 59 mins 30 secs         | [2..30] days        |
-* | 29 days 23 hrs 59 mins 30 secs ... 44 days 23 hrs 59 mins 30 secs | about 1 month       |
-* | 44 days 23 hrs 59 mins 30 secs ... 59 days 23 hrs 59 mins 30 secs | about 2 months      |
-* | 59 days 23 hrs 59 mins 30 secs ... 1 yr                           | [2..12] months      |
-* | 1 yr ... 1 yr 3 months                                            | about 1 year        |
-* | 1 yr 3 months ... 1 yr 9 month s                                  | over 1 year         |
-* | 1 yr 9 months ... 2 yrs                                           | almost 2 years      |
-* | N yrs ... N yrs 3 months                                          | about N years       |
-* | N yrs 3 months ... N yrs 9 months                                 | over N years        |
-* | N yrs 9 months ... N+1 yrs                                        | almost N+1 years    |
-*
-* With `options.includeSeconds == true`:
-* | Distance between dates | Result               |
-* |------------------------|----------------------|
-* | 0 secs ... 5 secs      | less than 5 seconds  |
-* | 5 secs ... 10 secs     | less than 10 seconds |
-* | 10 secs ... 20 secs    | less than 20 seconds |
-* | 20 secs ... 40 secs    | half a minute        |
-* | 40 secs ... 60 secs    | less than a minute   |
-* | 60 secs ... 90 secs    | 1 minute             |
+* | Distance between dates | Result              |
+* |------------------------|---------------------|
+* | 0 ... 59 secs          | [0..59] seconds     |
+* | 1 ... 59 mins          | [1..59] minutes     |
+* | 1 ... 23 hrs           | [1..23] hours       |
+* | 1 ... 29 days          | [1..29] days        |
+* | 1 ... 11 months        | [1..11] months      |
+* | 1 ... N years          | [1..N]  years       |
 *
 * @param laterDate - The date
 * @param earlierDate - The date to compare with
@@ -4311,43 +4088,59 @@ function differenceInSeconds(laterDate, earlierDate, options) {
 *
 * @throws `date` must not be Invalid Date
 * @throws `baseDate` must not be Invalid Date
+* @throws `options.unit` must be 'second', 'minute', 'hour', 'day', 'month' or 'year'
 * @throws `options.locale` must contain `formatDistance` property
 *
 * @example
 * // What is the distance between 2 July 2014 and 1 January 2015?
-* const result = formatDistance(new Date(2014, 6, 2), new Date(2015, 0, 1))
+* const result = formatDistanceStrict(new Date(2014, 6, 2), new Date(2015, 0, 2))
 * //=> '6 months'
 *
 * @example
 * // What is the distance between 1 January 2015 00:00:15
-* // and 1 January 2015 00:00:00, including seconds?
-* const result = formatDistance(
+* // and 1 January 2015 00:00:00?
+* const result = formatDistanceStrict(
 *   new Date(2015, 0, 1, 0, 0, 15),
-*   new Date(2015, 0, 1, 0, 0, 0),
-*   { includeSeconds: true }
+*   new Date(2015, 0, 1, 0, 0, 0)
 * )
-* //=> 'less than 20 seconds'
+* //=> '15 seconds'
 *
 * @example
 * // What is the distance from 1 January 2016
 * // to 1 January 2015, with a suffix?
-* const result = formatDistance(new Date(2015, 0, 1), new Date(2016, 0, 1), {
+* const result = formatDistanceStrict(new Date(2015, 0, 1), new Date(2016, 0, 1), {
 *   addSuffix: true
 * })
-* //=> 'about 1 year ago'
+* //=> '1 year ago'
+*
+* @example
+* // What is the distance from 1 January 2016
+* // to 1 January 2015, in minutes?
+* const result = formatDistanceStrict(new Date(2016, 0, 1), new Date(2015, 0, 1), {
+*   unit: 'minute'
+* })
+* //=> '525600 minutes'
+*
+* @example
+* // What is the distance from 1 January 2015
+* // to 28 January 2015, in months, rounded up?
+* const result = formatDistanceStrict(new Date(2015, 0, 28), new Date(2015, 0, 1), {
+*   unit: 'month',
+*   roundingMethod: 'ceil'
+* })
+* //=> '1 month'
 *
 * @example
 * // What is the distance between 1 August 2016 and 1 January 2015 in Esperanto?
 * import { eoLocale } from 'date-fns/locale/eo'
-* const result = formatDistance(new Date(2016, 7, 1), new Date(2015, 0, 1), {
+* const result = formatDistanceStrict(new Date(2016, 7, 1), new Date(2015, 0, 1), {
 *   locale: eoLocale
 * })
-* //=> 'pli ol 1 jaro'
+* //=> '1 jaro'
 */
-function formatDistance(laterDate, earlierDate, options) {
+function formatDistanceStrict(laterDate, earlierDate, options) {
 	const defaultOptions$1 = getDefaultOptions();
 	const locale = options?.locale ?? defaultOptions$1.locale ?? enUS;
-	const minutesInAlmostTwoDays = 2520;
 	const comparison = compareAsc(laterDate, earlierDate);
 	if (isNaN(comparison)) throw new RangeError("Invalid time value");
 	const localizeOptions = Object.assign({}, options, {
@@ -4355,41 +4148,37 @@ function formatDistance(laterDate, earlierDate, options) {
 		comparison
 	});
 	const [laterDate_, earlierDate_] = normalizeDates(options?.in, ...comparison > 0 ? [earlierDate, laterDate] : [laterDate, earlierDate]);
-	const seconds = differenceInSeconds(earlierDate_, laterDate_);
-	const offsetInSeconds = (getTimezoneOffsetInMilliseconds(earlierDate_) - getTimezoneOffsetInMilliseconds(laterDate_)) / 1e3;
-	const minutes = Math.round((seconds - offsetInSeconds) / 60);
-	let months;
-	if (minutes < 2) if (options?.includeSeconds) if (seconds < 5) return locale.formatDistance("lessThanXSeconds", 5, localizeOptions);
-	else if (seconds < 10) return locale.formatDistance("lessThanXSeconds", 10, localizeOptions);
-	else if (seconds < 20) return locale.formatDistance("lessThanXSeconds", 20, localizeOptions);
-	else if (seconds < 40) return locale.formatDistance("halfAMinute", 0, localizeOptions);
-	else if (seconds < 60) return locale.formatDistance("lessThanXMinutes", 1, localizeOptions);
-	else return locale.formatDistance("xMinutes", 1, localizeOptions);
-	else if (minutes === 0) return locale.formatDistance("lessThanXMinutes", 1, localizeOptions);
-	else return locale.formatDistance("xMinutes", minutes, localizeOptions);
-	else if (minutes < 45) return locale.formatDistance("xMinutes", minutes, localizeOptions);
-	else if (minutes < 90) return locale.formatDistance("aboutXHours", 1, localizeOptions);
-	else if (minutes < minutesInDay) {
-		const hours = Math.round(minutes / 60);
-		return locale.formatDistance("aboutXHours", hours, localizeOptions);
-	} else if (minutes < minutesInAlmostTwoDays) return locale.formatDistance("xDays", 1, localizeOptions);
-	else if (minutes < minutesInMonth) {
-		const days = Math.round(minutes / minutesInDay);
+	const roundingMethod = getRoundingMethod(options?.roundingMethod ?? "round");
+	const milliseconds = earlierDate_.getTime() - laterDate_.getTime();
+	const minutes = milliseconds / millisecondsInMinute;
+	const dstNormalizedMinutes = (milliseconds - (getTimezoneOffsetInMilliseconds(earlierDate_) - getTimezoneOffsetInMilliseconds(laterDate_))) / millisecondsInMinute;
+	const defaultUnit = options?.unit;
+	let unit;
+	if (!defaultUnit) if (minutes < 1) unit = "second";
+	else if (minutes < 60) unit = "minute";
+	else if (minutes < minutesInDay) unit = "hour";
+	else if (dstNormalizedMinutes < minutesInMonth) unit = "day";
+	else if (dstNormalizedMinutes < minutesInYear) unit = "month";
+	else unit = "year";
+	else unit = defaultUnit;
+	if (unit === "second") {
+		const seconds = roundingMethod(milliseconds / 1e3);
+		return locale.formatDistance("xSeconds", seconds, localizeOptions);
+	} else if (unit === "minute") {
+		const roundedMinutes = roundingMethod(minutes);
+		return locale.formatDistance("xMinutes", roundedMinutes, localizeOptions);
+	} else if (unit === "hour") {
+		const hours = roundingMethod(minutes / 60);
+		return locale.formatDistance("xHours", hours, localizeOptions);
+	} else if (unit === "day") {
+		const days = roundingMethod(dstNormalizedMinutes / minutesInDay);
 		return locale.formatDistance("xDays", days, localizeOptions);
-	} else if (minutes < minutesInMonth * 2) {
-		months = Math.round(minutes / minutesInMonth);
-		return locale.formatDistance("aboutXMonths", months, localizeOptions);
-	}
-	months = differenceInMonths(earlierDate_, laterDate_);
-	if (months < 12) {
-		const nearestMonth = Math.round(minutes / minutesInMonth);
-		return locale.formatDistance("xMonths", nearestMonth, localizeOptions);
+	} else if (unit === "month") {
+		const months = roundingMethod(dstNormalizedMinutes / minutesInMonth);
+		return months === 12 && defaultUnit !== "month" ? locale.formatDistance("xYears", 1, localizeOptions) : locale.formatDistance("xMonths", months, localizeOptions);
 	} else {
-		const monthsSinceStartOfYear = months % 12;
-		const years = Math.trunc(months / 12);
-		if (monthsSinceStartOfYear < 3) return locale.formatDistance("aboutXYears", years, localizeOptions);
-		else if (monthsSinceStartOfYear < 9) return locale.formatDistance("overXYears", years, localizeOptions);
-		else return locale.formatDistance("almostXYears", years + 1, localizeOptions);
+		const years = roundingMethod(dstNormalizedMinutes / minutesInYear);
+		return locale.formatDistance("xYears", years, localizeOptions);
 	}
 }
 
@@ -4421,7 +4210,7 @@ function formatBytes(bytes) {
 }
 function timeAgo(date) {
 	if (date === void 0) return "-";
-	return formatDistance(date, /* @__PURE__ */ new Date(), { addSuffix: true }).replace("about ", "").replace("less than ", "");
+	return formatDistanceStrict(date, /* @__PURE__ */ new Date(), { addSuffix: true });
 }
 function table(opts) {
 	const titles = Object.keys(opts.columns);
@@ -4447,6 +4236,19 @@ function formatRunDuration(d$1) {
 	if (d$1 < 1e3) return `${d$1}ms`;
 	return `${d$1 / 1e3}s`;
 }
+function formatNextCursorHint(cursor) {
+	const args$5 = process.argv.slice(2);
+	const filtered = [];
+	for (let i = 0; i < args$5.length; i++) {
+		if (args$5[i] === "--cursor") {
+			i++;
+			continue;
+		}
+		if (args$5[i].startsWith("--cursor=")) continue;
+		filtered.push(args$5[i]);
+	}
+	return `\nMore results: sandbox ${filtered.join(" ")} --cursor ${cursor}`;
+}
 
 //#endregion
 //#region ../../node_modules/.pnpm/is-docker@3.0.0/node_modules/is-docker/index.js
@@ -4651,7 +4453,7 @@ async function defaultBrowser$1(_execFileAsync = execFileAsync$1) {
 //#endregion
 //#region ../../node_modules/.pnpm/default-browser@5.2.1/node_modules/default-browser/index.js
 const execFileAsync = promisify(execFile);
-const titleize = (string$1) => string$1.toLowerCase().replaceAll(/(?:^|\s|-)\S/g, (x) => x.toUpperCase());
+const titleize = (string$2) => string$2.toLowerCase().replaceAll(/(?:^|\s|-)\S/g, (x) => x.toUpperCase());
 async function defaultBrowser() {
 	if (process$1.platform === "darwin") {
 		const id = await defaultBrowserId();
@@ -6509,9 +6311,9 @@ function ansiRegex({ onlyFirst = false } = {}) {
 //#endregion
 //#region ../../node_modules/.pnpm/strip-ansi@7.1.0/node_modules/strip-ansi/index.js
 const regex = ansiRegex();
-function stripAnsi(string$1) {
-	if (typeof string$1 !== "string") throw new TypeError(`Expected a \`string\`, got \`${typeof string$1}\``);
-	return string$1.replace(regex, "");
+function stripAnsi(string$2) {
+	if (typeof string$2 !== "string") throw new TypeError(`Expected a \`string\`, got \`${typeof string$2}\``);
+	return string$2.replace(regex, "");
 }
 
 //#endregion
@@ -6890,7 +6692,7 @@ function createAbortController(reason) {
 			signal: controller.signal,
 			ignoreInterruptions: ignoreAbortErrors(controller.signal)
 		};
-	}, (c) => c.abort(reason));
+	}, (c$1) => c$1.abort(reason));
 }
 
 //#endregion
@@ -6952,10 +6754,10 @@ function _usingCtx() {
 
 //#endregion
 //#region src/commands/login.ts
-var import_cjs$22 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$26 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const debug$5 = createDebugger("sandbox:login");
-const login = import_cjs$22.command({
+const debug$6 = createDebugger("sandbox:login");
+const login = import_cjs$26.command({
 	name: "login",
 	description: "Log in to the Sandbox CLI",
 	args: {},
@@ -6996,13 +6798,13 @@ const login = import_cjs$22.command({
 				oauth
 			})) switch (event._tag) {
 				case "Timeout":
-					debug$5(`Connection timeout. Slowing down, polling every ${event.newInterval / 1e3}s...`);
+					debug$6(`Connection timeout. Slowing down, polling every ${event.newInterval / 1e3}s...`);
 					break;
 				case "SlowDown":
-					debug$5(`Authorization server requests to slow down. Polling every ${event.newInterval / 1e3}s...`);
+					debug$6(`Authorization server requests to slow down. Polling every ${event.newInterval / 1e3}s...`);
 					break;
 				case "Response":
-					debug$5("Device Access Token response:", await event.response.text());
+					debug$6("Device Access Token response:", await event.response.text());
 					break;
 				case "Error":
 					error = event.error;
@@ -7019,7 +6821,15 @@ const login = import_cjs$22.command({
 			if (error) {
 				spinner.fail(`${source_default.red("error:")} ${error.message}`);
 				process.exitCode = 1;
-			} else spinner.succeed(`${source_default.cyan("Congratulations!")} You are now signed in.`);
+			} else {
+				spinner.succeed(`${source_default.cyan("Congratulations!")} You are now signed in.`);
+				const auth = getAuth();
+				if (auth?.token) try {
+					const { teamId, teamSlug, projectId, projectSlug } = await inferScope({ token: auth.token });
+					process.stderr.write(source_default.dim("   │ ") + "team: " + source_default.cyan(teamSlug ?? teamId) + "\n");
+					process.stderr.write(source_default.dim("   ╰ ") + "project: " + source_default.cyan(projectSlug ?? projectId) + "\n");
+				} catch {}
+			}
 		} catch (_) {
 			_usingCtx$1.e = _;
 		} finally {
@@ -7165,15 +6975,28 @@ var require_dist = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/@ver
 
 //#endregion
 //#region src/args/auth.ts
-var import_cjs$21 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$25 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
 var import_dist = require_dist();
-const debug$4 = createDebugger("sandbox:args:auth");
-const token = import_cjs$21.option({
+const debug$5 = createDebugger("sandbox:args:auth");
+/**
+* Timestamp (ms epoch) of the most recent auto-login. Used to identify
+* tokens so that the first 401/403 against a freshly-issued token can be
+* retried instead of surfaced to the user.
+*/
+let freshTokenAcquiredAt;
+const FRESH_TOKEN_WINDOW_MS = 1e4;
+function isTokenFresh() {
+	return freshTokenAcquiredAt !== void 0 && Date.now() - freshTokenAcquiredAt < FRESH_TOKEN_WINDOW_MS;
+}
+function markTokenAsFresh() {
+	freshTokenAcquiredAt = Date.now();
+}
+const token = import_cjs$25.option({
 	long: "token",
 	description: "A Vercel authentication token. If not provided, will use the token stored in your system from `VERCEL_AUTH_TOKEN` or will start a log in process.",
 	type: {
-		...import_cjs$21.string,
+		...import_cjs$25.string,
 		displayName: "pat_or_oidc",
 		defaultValueIsSerializable: false,
 		onMissing: async () => {
@@ -7181,18 +7004,20 @@ const token = import_cjs$21.option({
 			if (process.env.VERCEL_OIDC_TOKEN) try {
 				return await (0, import_dist.getVercelOidcToken)();
 			} catch (cause) {
-				debug$4(`Failed to get or refresh OIDC token: ${getMessage(cause)}`);
+				debug$5(`Failed to get or refresh OIDC token: ${getMessage(cause)}`);
 				console.warn(source_default.yellow(`${source_default.bold("warn:")} failed to get or refresh OIDC token, using personal token authentication.`));
 			}
 			try {
 				return await (0, import_dist.getVercelToken)();
 			} catch (error) {
 				if (error instanceof import_dist.AccessTokenMissingError || error instanceof import_dist.RefreshAccessTokenFailedError) {
-					debug$4(`CLI token unavailable (${error.name}), prompting for login...`);
+					debug$5(`CLI token unavailable (${error.name}), prompting for login...`);
 					console.warn(source_default.yellow(`${source_default.bold("notice:")} Your session has expired. Please log in again.`));
 					await login.handler({});
 					try {
-						return await (0, import_dist.getVercelToken)();
+						const refreshed = await (0, import_dist.getVercelToken)();
+						markTokenAsFresh();
+						return refreshed;
 					} catch (retryError) {
 						throw new Error([
 							`Failed to retrieve authentication token.`,
@@ -7244,8 +7069,8 @@ const ProjectConfiguration = jsonCodec(z.object({
 function readProjectConfiguration(cwd) {
 	try {
 		const pathname = path.join(cwd, ".vercel", "project.json");
-		const string$1 = fs$1.readFileSync(pathname, "utf8");
-		return ProjectConfiguration.decode(string$1);
+		const string$2 = fs$1.readFileSync(pathname, "utf8");
+		return ProjectConfiguration.decode(string$2);
 	} catch {
 		return null;
 	}
@@ -7253,18 +7078,18 @@ function readProjectConfiguration(cwd) {
 
 //#endregion
 //#region src/util/infer-scope.ts
-const debug$3 = createDebugger("sandbox:scope");
-async function inferScope({ token: token$1, team: team$1 }) {
+const debug$4 = createDebugger("sandbox:scope");
+async function inferScope$1({ token: token$1, team: team$1 }) {
 	const jwt = z.jwt().safeParse(token$1);
 	if (jwt.success) {
-		debug$3("trying to infer scope from OIDC JWT");
+		debug$4("trying to infer scope from OIDC JWT");
 		const data = await inferFromJwt(jwt.data);
-		debug$3("Using scope from OIDC JWT", data);
+		debug$4("Using scope from OIDC JWT", data);
 		return data;
 	}
 	const projectJson = readProjectConfiguration(process.cwd());
 	if (projectJson) {
-		debug$3("Using scope from project configuration", {
+		debug$4("Using scope from project configuration", {
 			owner: projectJson.orgId,
 			project: projectJson.projectId
 		});
@@ -7273,12 +7098,12 @@ async function inferScope({ token: token$1, team: team$1 }) {
 			project: projectJson.projectId
 		};
 	}
-	debug$3("trying to infer scope from API token", {
+	debug$4("trying to infer scope from API token", {
 		token: token$1,
 		team: team$1
 	});
 	const fromToken = await inferFromToken(token$1, team$1);
-	debug$3("Using scope from API token", fromToken);
+	debug$4("Using scope from API token", fromToken);
 	return fromToken;
 }
 const JwtSchema = z.object({
@@ -7302,43 +7127,81 @@ async function inferFromJwt(jwt) {
 	};
 }
 async function inferFromToken(token$1, requestedTeam) {
-	const { teamId, projectId } = await Auth.inferScope({
+	const { teamId, teamSlug, projectId, projectSlug } = await Auth.inferScope({
 		token: token$1,
 		teamId: requestedTeam
 	});
 	return {
 		owner: teamId,
 		project: projectId,
-		ownerSlug: teamId,
-		projectSlug: projectId
+		ownerSlug: teamSlug ?? teamId,
+		projectSlug: projectSlug ?? projectId
 	};
 }
 
+//#endregion
+//#region src/util/fresh-auth-retry.ts
+const debug$3 = createDebugger("sandbox:fresh-auth-retry");
+/**
+* Run an async operation, transparently retrying on 401/403 when the auth
+* token was just acquired via auto-login.
+*/
+async function withFreshAuthRetry(factory) {
+	return retry(async (bail, attempt) => {
+		try {
+			return await factory();
+		} catch (error) {
+			const status = getAuthFailureStatus(error);
+			if (status !== void 0 && isTokenFresh()) {
+				debug$3(`fresh-auth retry attempt ${attempt} (status ${status})`);
+				throw error;
+			}
+			bail(error);
+			return;
+		}
+	}, {
+		retries: 3,
+		minTimeout: 250,
+		factor: 2,
+		maxRetryTime: 3e3
+	});
+}
+/**
+* Returns the HTTP status if the error represents a 401 or 403.
+* Returns undefined for any other error.
+*/
+function getAuthFailureStatus(error) {
+	let status;
+	if (error instanceof APIError) status = error.response.status;
+	else if (error instanceof NotOk) status = error.response.statusCode;
+	return status === 401 || status === 403 ? status : void 0;
+}
+
 //#endregion
 //#region src/args/scope.ts
-var import_cjs$20 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$24 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const project = import_cjs$20.option({
+const project = import_cjs$24.option({
 	long: "project",
 	type: {
-		...import_cjs$20.optional(import_cjs$20.string),
+		...import_cjs$24.optional(import_cjs$24.string),
 		displayName: "my-project"
 	},
 	description: "The project name or ID to associate with the command. Can be inferred from VERCEL_OIDC_TOKEN."
 });
 /** Parser for the `--team` option. */
-const teamParser = import_cjs$20.option({
+const teamParser = import_cjs$24.option({
 	long: "team",
 	type: {
-		...import_cjs$20.optional(import_cjs$20.string),
+		...import_cjs$24.optional(import_cjs$24.string),
 		displayName: "my-team"
 	}
 });
 /** Parser for the `--scope` option. */
-const scopeParser = import_cjs$20.option({
+const scopeParser = import_cjs$24.option({
 	long: "scope",
 	type: {
-		...import_cjs$20.optional(import_cjs$20.string),
+		...import_cjs$24.optional(import_cjs$24.string),
 		displayName: "my-team"
 	},
 	description: "The scope/team to associate with the command. Can be inferred from VERCEL_OIDC_TOKEN. [alias: --team]"
@@ -7381,10 +7244,10 @@ const scope = {
 		let projectSlug;
 		let teamSlug;
 		if (typeof projectId.value === "undefined" || typeof teamId.value === "undefined") try {
-			const scope$1 = await inferScope({
+			const scope$1 = await withFreshAuthRetry(() => inferScope$1({
 				token: t.value,
 				team: teamId.value
-			});
+			}));
 			projectId.value ?? (projectId.value = scope$1.project);
 			teamId.value ?? (teamId.value = scope$1.owner);
 			projectSlug = scope$1.projectSlug;
@@ -7427,7 +7290,7 @@ const scope = {
 
 //#endregion
 //#region package.json
-var version = "3.0.0-beta.8";
+var version = "3.0.0";
 
 //#endregion
 //#region src/error.ts
@@ -7446,26 +7309,34 @@ init_source();
 * A {@link Sandbox} wrapper that adds user-agent headers and error handling.
 */
 const sandboxClient = {
-	get: (params) => withErrorHandling(Sandbox.get({
+	get: (params) => withErrorHandling(() => Sandbox.get({
 		fetch: fetchWithUserAgent,
 		resume: false,
 		...params
 	})),
-	create: (params) => withErrorHandling(Sandbox.create({
+	create: (params) => withErrorHandling(() => Sandbox.create({
 		fetch: fetchWithUserAgent,
 		...params
 	})),
-	list: (params) => withErrorHandling(Sandbox.list({
+	fork: (params) => withErrorHandling(() => Sandbox.fork({
+		fetch: fetchWithUserAgent,
+		...params
+	})),
+	list: (params) => withErrorHandling(() => Sandbox.list({
 		fetch: fetchWithUserAgent,
 		...params
 	}))
 };
 const snapshotClient = {
-	list: (params) => withErrorHandling(Snapshot.list({
+	list: (params) => withErrorHandling(() => Snapshot.list({
 		fetch: fetchWithUserAgent,
 		...params
 	})),
-	get: (params) => withErrorHandling(Snapshot.get({ ...params }))
+	get: (params) => withErrorHandling(() => Snapshot.get({ ...params })),
+	tree: (params) => withErrorHandling(() => Snapshot.tree({
+		fetch: fetchWithUserAgent,
+		...params
+	}))
 };
 const fetchWithUserAgent = (input, init$1) => {
 	const headers = new Headers(init$1?.headers ?? (input && typeof input === "object" && "headers" in input ? input?.headers : {}));
@@ -7478,9 +7349,9 @@ const fetchWithUserAgent = (input, init$1) => {
 		headers
 	});
 };
-async function withErrorHandling(promise) {
+async function withErrorHandling(factory) {
 	try {
-		return await promise;
+		return await withFreshAuthRetry(factory);
 	} catch (error) {
 		if (error instanceof APIError) return await handleApiError(error);
 		throw error;
@@ -7518,9 +7389,9 @@ async function writeResponseToTemp({ response, text }) {
 
 //#endregion
 //#region src/args/snapshot-id.ts
-var import_cjs$19 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$23 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const snapshotId = import_cjs$19.extendType(import_cjs$19.string, {
+const snapshotId = import_cjs$23.extendType(import_cjs$23.string, {
 	displayName: "snapshot_id",
 	description: "The ID of the snapshot",
 	async from(s$1) {
@@ -7529,11 +7400,83 @@ const snapshotId = import_cjs$19.extendType(import_cjs$19.string, {
 	}
 });
 
+//#endregion
+//#region src/args/ports.ts
+var import_cjs$22 = /* @__PURE__ */ __toESM(require_cjs());
+init_source();
+const publishPorts = import_cjs$22.multioption({
+	long: "publish-port",
+	short: "p",
+	description: "Publish sandbox port(s) to DOMAIN.vercel.run",
+	type: import_cjs$22.array(import_cjs$22.extendType(import_cjs$22.number, {
+		displayName: "PORT",
+		async from(number) {
+			if (!Number.isInteger(number) || number < 1024 || number > 65535) throw new Error([
+				`Invalid port: ${number}.`,
+				`${source_default.bold("hint:")} Ports must be integers between 1024-65535 (privileged ports 0-1023 are reserved).`,
+				"Examples: 3000, 8443"
+			].join("\n"));
+			return number;
+		}
+	}))
+});
+
+//#endregion
+//#region src/types/snapshot-expiration.ts
+var import_cjs$21 = require_cjs();
+const SnapshotExpiration = (0, import_cjs$21.extendType)(import_cjs$21.string, {
+	displayName: "DURATION|none",
+	description: "A duration (e.g. 7d, 30d) or \"none\" for no expiration",
+	async from(value) {
+		if (value === "none") return "0";
+		return Duration.from(value);
+	}
+});
+
+//#endregion
+//#region src/args/snapshot-retention.ts
+var import_cjs$20 = /* @__PURE__ */ __toESM(require_cjs());
+const snapshotExpiration = import_cjs$20.option({
+	long: "snapshot-expiration",
+	type: import_cjs$20.optional(SnapshotExpiration),
+	description: "Default snapshot expiration. Use \"none\" or 0 for no expiration. Example: 7d, 30d"
+});
+const keepLastSnapshots = import_cjs$20.option({
+	long: "keep-last-snapshots",
+	type: import_cjs$20.optional(import_cjs$20.extendType(import_cjs$20.number, {
+		displayName: "COUNT",
+		async from(n) {
+			if (!Number.isInteger(n) || n < 1 || n > 10) throw new Error(`Invalid --keep-last-snapshots value: ${n}. Must be an integer between 1 and 10.`);
+			return n;
+		}
+	})),
+	description: "Keep only the N most recent snapshots of this sandbox (1-10)."
+});
+const keepLastSnapshotsFor = import_cjs$20.option({
+	long: "keep-last-snapshots-for",
+	type: import_cjs$20.optional(SnapshotExpiration),
+	description: "Expiration applied to kept snapshots. Use \"none\" or 0 for no expiration. Example: 7d, 30d"
+});
+const deleteEvictedSnapshots = import_cjs$20.option({
+	long: "delete-evicted-snapshots",
+	type: import_cjs$20.optional({
+		...import_cjs$20.oneOf(["true", "false"]),
+		displayName: "true|false"
+	}),
+	description: "When \"true\" (the default), evicted snapshots are deleted immediately; when \"false\", they keep the default expiration."
+});
+const snapshotRetentionArgs = {
+	snapshotExpiration,
+	keepLastSnapshots,
+	keepLastSnapshotsFor,
+	deleteEvictedSnapshots
+};
+
 //#endregion
 //#region src/args/sandbox-name.ts
-var import_cjs$18 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$19 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const sandboxName = import_cjs$18.extendType(import_cjs$18.string, {
+const sandboxName = import_cjs$19.extendType(import_cjs$19.string, {
 	displayName: "name",
 	description: "The name of the sandbox",
 	async from(s$1) {
@@ -11241,15 +11184,15 @@ async function waitForOpen(ws) {
 //#endregion
 //#region src/util/print-command.ts
 init_source();
-function printCommand(command$1, args$4) {
-	return source_default.gray(source_default.dim("$ ") + [command$1, ...args$4].join(" "));
+function printCommand(command$1, args$5) {
+	return source_default.gray(source_default.dim("$ ") + [command$1, ...args$5].join(" "));
 }
 
 //#endregion
 //#region src/interactive-shell/extend-sandbox-timeout.ts
-var import_ms$3 = /* @__PURE__ */ __toESM(require_ms());
+var import_ms$5 = /* @__PURE__ */ __toESM(require_ms());
 const debug$2 = createDebugger("sandbox:timeout");
-const BUFFER = (0, import_ms$3.default)("10 seconds");
+const BUFFER = (0, import_ms$5.default)("10 seconds");
 async function extendSandboxTimeoutPeriodically(sandbox, signal) {
 	const session = sandbox.currentSession();
 	const timeout$1 = session.timeout;
@@ -11264,7 +11207,7 @@ async function extendSandboxTimeoutPeriodically(sandbox, signal) {
 			debug$2(`sleeping for ${sleepMs}ms until next timeout extension`);
 			await setTimeout$1(sleepMs, null, { signal });
 		}
-		await sandbox.extendTimeout((0, import_ms$3.default)("5 minutes"));
+		await sandbox.extendTimeout((0, import_ms$5.default)("5 minutes"));
 		const updatedTimeout = session.timeout;
 		if (updatedTimeout == null) return;
 		const nextTick$1 = session.createdAt.getTime() + updatedTimeout;
@@ -11538,9 +11481,9 @@ function getStderrStream() {
 
 //#endregion
 //#region src/args/key-value-pair.ts
-var import_cjs$17 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$18 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const KeyValuePair = import_cjs$17.extendType(import_cjs$17.string, {
+const KeyValuePair = import_cjs$18.extendType(import_cjs$18.string, {
 	displayName: "key=value",
 	async from(input) {
 		if (!input.includes("=")) return {
@@ -11554,7 +11497,7 @@ const KeyValuePair = import_cjs$17.extendType(import_cjs$17.string, {
 		};
 	}
 });
-const ObjectFromKeyValue = import_cjs$17.extendType(import_cjs$17.array(KeyValuePair), { async from(input) {
+const ObjectFromKeyValue = import_cjs$18.extendType(import_cjs$18.array(KeyValuePair), { async from(input) {
 	const obj = Object.create(null);
 	const missingVars = [];
 	for (const { key, value } of input) if (value === void 0) missingVars.push(key);
@@ -11568,27 +11511,27 @@ const ObjectFromKeyValue = import_cjs$17.extendType(import_cjs$17.array(KeyValue
 
 //#endregion
 //#region src/commands/exec.ts
-var import_cjs$16 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$17 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const args$3 = {
-	sandbox: import_cjs$16.positional({ type: sandboxName }),
-	command: import_cjs$16.positional({
+const args$4 = {
+	sandbox: import_cjs$17.positional({ type: sandboxName }),
+	command: import_cjs$17.positional({
 		displayName: "command",
 		description: "The executable to invoke"
 	}),
-	args: import_cjs$16.rest({
+	args: import_cjs$17.rest({
 		displayName: "args",
 		description: "arguments to pass to the command"
 	}),
-	asSudo: import_cjs$16.flag({
+	asSudo: import_cjs$17.flag({
 		long: "sudo",
 		description: "Give extended privileges to the command."
 	}),
-	interactive: import_cjs$16.flag({
+	interactive: import_cjs$17.flag({
 		long: "interactive",
 		short: "i",
 		description: "Run the command in a secure interactive shell",
-		type: import_cjs$16.extendType(import_cjs$16.boolean, {
+		type: import_cjs$17.extendType(import_cjs$17.boolean, {
 			defaultValue() {
 				return false;
 			},
@@ -11598,22 +11541,22 @@ const args$3 = {
 			}
 		})
 	}),
-	skipExtendingTimeout: import_cjs$16.flag({
+	skipExtendingTimeout: import_cjs$17.flag({
 		long: "no-extend-timeout",
 		description: "Do not extend the sandbox timeout while running an interactive command. Only affects interactive executions."
 	}),
-	tty: import_cjs$16.flag({
+	tty: import_cjs$17.flag({
 		long: "tty",
 		short: "t",
 		description: "Allocate a tty for an interactive command. This is a no-op."
 	}),
-	cwd: import_cjs$16.option({
+	cwd: import_cjs$17.option({
 		long: "workdir",
 		short: "w",
 		description: "The working directory to run the command in",
-		type: import_cjs$16.optional(import_cjs$16.string)
+		type: import_cjs$17.optional(import_cjs$17.string)
 	}),
-	envVars: import_cjs$16.multioption({
+	envVars: import_cjs$17.multioption({
 		long: "env",
 		short: "e",
 		type: ObjectFromKeyValue,
@@ -11621,11 +11564,11 @@ const args$3 = {
 	}),
 	scope
 };
-const exec = import_cjs$16.command({
+const exec = import_cjs$17.command({
 	name: "exec",
 	description: "Execute a command in an existing sandbox",
-	args: args$3,
-	async handler({ command: command$1, cwd, args: args$4, asSudo, sandbox: sandboxName$1, scope: { token: token$1, team: team$1, project: project$1 }, interactive, envVars, skipExtendingTimeout }) {
+	args: args$4,
+	async handler({ command: command$1, cwd, args: args$5, asSudo, sandbox: sandboxName$1, scope: { token: token$1, team: team$1, project: project$1 }, interactive, envVars, skipExtendingTimeout }) {
 		const sandbox = typeof sandboxName$1 !== "string" ? sandboxName$1 : await sandboxClient.get({
 			name: sandboxName$1,
 			projectId: project$1,
@@ -11634,10 +11577,10 @@ const exec = import_cjs$16.command({
 			__includeSystemRoutes: true
 		});
 		if (!interactive) {
-			console.error(printCommand(command$1, args$4));
+			console.error(printCommand(command$1, args$5));
 			const result = await sandbox.runCommand({
 				cmd: command$1,
-				args: args$4,
+				args: args$5,
 				stderr: process.stderr,
 				stdout: process.stdout,
 				sudo: asSudo,
@@ -11648,7 +11591,7 @@ const exec = import_cjs$16.command({
 		} else await startInteractiveShell({
 			sandbox,
 			cwd,
-			execution: [command$1, ...args$4],
+			execution: [command$1, ...args$5],
 			envVars,
 			sudo: asSudo,
 			skipExtendingTimeout
@@ -11658,9 +11601,9 @@ const exec = import_cjs$16.command({
 
 //#endregion
 //#region src/args/network-policy.ts
-var import_cjs$15 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$16 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const networkPolicyMode = import_cjs$15.extendType(import_cjs$15.string, {
+const networkPolicyMode = import_cjs$16.extendType(import_cjs$16.string, {
 	displayName: "MODE",
 	async from(value) {
 		const validModes = ["allow-all", "deny-all"];
@@ -11668,28 +11611,28 @@ const networkPolicyMode = import_cjs$15.extendType(import_cjs$15.string, {
 		return value;
 	}
 });
-const networkPolicy = import_cjs$15.option({
+const networkPolicy = import_cjs$16.option({
 	long: "network-policy",
 	description: `Network policy mode: "allow-all" or "deny-all"
       - allow-all: sandbox can access any website/domain
       - deny-all: sandbox has no network access
     Omit this option and use --allowed-domain / --allowed-cidr / --denied-cidr for custom policies.`,
-	type: import_cjs$15.optional(networkPolicyMode)
+	type: import_cjs$16.optional(networkPolicyMode)
 });
-const allowedDomains = import_cjs$15.multioption({
+const allowedDomains = import_cjs$16.multioption({
 	long: "allowed-domain",
 	description: `Domain to allow traffic to (creates a custom network policy). Supports "*" for wildcards for a segment (e.g. '*.vercel.com', 'www.*.com'). If used as the first segment, will match any subdomain.`,
-	type: import_cjs$15.array(import_cjs$15.string)
+	type: import_cjs$16.array(import_cjs$16.string)
 });
-const allowedCIDRs = import_cjs$15.multioption({
+const allowedCIDRs = import_cjs$16.multioption({
 	long: "allowed-cidr",
 	description: `CIDR to allow traffic to (creates a custom network policy). Takes precedence over 'allowed-domain'.`,
-	type: import_cjs$15.array(import_cjs$15.string)
+	type: import_cjs$16.array(import_cjs$16.string)
 });
-const deniedCIDRs = import_cjs$15.multioption({
+const deniedCIDRs = import_cjs$16.multioption({
 	long: "denied-cidr",
 	description: `CIDR to deny traffic to (creates a custom network policy). Takes precedence over allowed domains/CIDRs.`,
-	type: import_cjs$15.array(import_cjs$15.string)
+	type: import_cjs$16.array(import_cjs$16.string)
 });
 const networkPolicyArgs = {
 	networkPolicy,
@@ -11712,8 +11655,8 @@ function resolveMode(networkPolicy$1, mode) {
 /**
 * Builds a NetworkPolicy from CLI arguments.
 */
-function buildNetworkPolicy(args$4) {
-	const { networkPolicy: networkPolicy$1, allowedDomains: allowedDomains$1, allowedCIDRs: allowedCIDRs$1, deniedCIDRs: deniedCIDRs$1 } = args$4;
+function buildNetworkPolicy(args$5) {
+	const { networkPolicy: networkPolicy$1, allowedDomains: allowedDomains$1, allowedCIDRs: allowedCIDRs$1, deniedCIDRs: deniedCIDRs$1 } = args$5;
 	const hasListOptions = allowedDomains$1.length > 0 || allowedCIDRs$1.length > 0 || deniedCIDRs$1.length > 0;
 	if (networkPolicy$1 && hasListOptions) throw new Error([`Cannot combine --network-policy=${networkPolicy$1} with --allowed-domain, --allowed-cidr, or --denied-cidr.`, `${source_default.bold("hint:")} Use --allowed-domain / --allowed-cidr / --denied-cidr without --network-policy for custom policies.`].join("\n"));
 	if (hasListOptions) return {
@@ -11726,84 +11669,132 @@ function buildNetworkPolicy(args$4) {
 	return networkPolicy$1 ?? "allow-all";
 }
 
+//#endregion
+//#region src/util/keep-last-snapshots.ts
+var import_ms$4 = /* @__PURE__ */ __toESM(require_ms());
+init_source();
+/**
+* Validates the `--keep-last-snapshots*` flag combination and builds the
+* payload object that the SDK expects, or returns `undefined` when no
+* retention policy was configured.
+*
+* Throws when `--keep-last-snapshots-for` or `--delete-evicted-snapshots` are
+* passed without `--keep-last-snapshots`.
+*/
+function buildKeepLastSnapshotsPayload(input) {
+	const { keepLastSnapshots: keepLastSnapshots$1, keepLastSnapshotsFor: keepLastSnapshotsFor$1, deleteEvictedSnapshots: deleteEvictedSnapshots$1 } = input;
+	if (keepLastSnapshots$1 === void 0 && (keepLastSnapshotsFor$1 !== void 0 || deleteEvictedSnapshots$1 !== void 0)) throw new Error(["--keep-last-snapshots-for and --delete-evicted-snapshots require --keep-last-snapshots.", `${source_default.bold("hint:")} Pass --keep-last-snapshots <count> to enable the retention policy.`].join("\n"));
+	if (keepLastSnapshots$1 === void 0) return;
+	return {
+		count: keepLastSnapshots$1,
+		expiration: keepLastSnapshotsFor$1 !== void 0 ? (0, import_ms$4.default)(keepLastSnapshotsFor$1) : void 0,
+		deleteEvicted: deleteEvictedSnapshots$1 !== void 0 ? deleteEvictedSnapshots$1 === "true" : void 0
+	};
+}
+
+//#endregion
+//#region src/util/print-sandbox-summary.ts
+init_source();
+/**
+* Print the "✅ Sandbox <name> <action>." summary that the create and fork
+* commands emit after a successful creation, including project/team and any
+* published port routes.
+*
+* - The sandbox name is written to stdout, everything else to stderr — so
+*   `sandbox create | xargs -I {} sandbox exec {} -- ...` keeps working.
+* - Pass `action: "created"` for create, or `action: \`forked from ${chalk.cyan(source)}\``
+*   for fork.
+*/
+function printSandboxSummary(opts) {
+	const { sandbox, scope: scope$1, action } = opts;
+	const teamDisplay = scope$1.teamSlug ?? scope$1.team;
+	const projectDisplay = scope$1.projectSlug ?? scope$1.project;
+	const routes = sandbox.routes.filter((x) => x.port !== sandbox.interactivePort);
+	const hasPorts = routes.length > 0;
+	process.stderr.write("✅ Sandbox ");
+	process.stdout.write(source_default.cyan(sandbox.name));
+	process.stderr.write(" " + action + ".\n");
+	process.stderr.write(source_default.dim("   │ ") + "team: " + source_default.cyan(teamDisplay) + "\n");
+	if (hasPorts) {
+		process.stderr.write(source_default.dim("   │ ") + "project: " + source_default.cyan(projectDisplay) + "\n");
+		process.stderr.write(source_default.dim("   │ ") + "ports:\n");
+		for (let i = 0; i < routes.length; i++) {
+			const route = routes[i];
+			const prefix$1 = i === routes.length - 1 ? source_default.dim("   ╰ ") : source_default.dim("   │ ");
+			process.stderr.write(prefix$1 + "• " + route.port + " -> " + source_default.cyan(route.url) + "\n");
+		}
+	} else process.stderr.write(source_default.dim("   ╰ ") + "project: " + source_default.cyan(projectDisplay) + "\n");
+}
+
 //#endregion
 //#region src/commands/create.ts
-var import_cjs$14 = /* @__PURE__ */ __toESM(require_cjs());
-var import_ms$2 = /* @__PURE__ */ __toESM(require_ms());
+var import_cjs$15 = /* @__PURE__ */ __toESM(require_cjs());
+var import_ms$3 = /* @__PURE__ */ __toESM(require_ms());
 init_source();
-const args$2 = {
-	name: import_cjs$14.option({
+const args$3 = {
+	name: import_cjs$15.option({
 		long: "name",
 		description: "A user-chosen name for the sandbox. It must be unique per project.",
-		type: import_cjs$14.optional(import_cjs$14.string)
+		type: import_cjs$15.optional(import_cjs$15.string)
 	}),
-	nonPersistent: import_cjs$14.flag({
+	nonPersistent: import_cjs$15.flag({
 		long: "non-persistent",
 		description: "Disable automatic restore of the filesystem between sessions."
 	}),
 	runtime,
 	timeout,
 	vcpus,
-	ports: import_cjs$14.multioption({
-		long: "publish-port",
-		short: "p",
-		description: "Publish sandbox port(s) to DOMAIN.vercel.run",
-		type: import_cjs$14.array(import_cjs$14.extendType(import_cjs$14.number, {
-			displayName: "PORT",
-			async from(number) {
-				if (number < 1024 || number > 65535) throw new Error([
-					`Invalid port: ${number}.`,
-					`${source_default.bold("hint:")} Ports must be between 1024-65535 (privileged ports 0-1023 are reserved).`,
-					"╰▶ Examples: 3000, 8080, 8443"
-				].join("\n"));
-				return number;
-			}
-		}))
-	}),
-	silent: import_cjs$14.flag({
+	ports: publishPorts,
+	silent: import_cjs$15.flag({
 		long: "silent",
 		description: "Don't write sandbox name to stdout"
 	}),
-	snapshot: import_cjs$14.option({
+	snapshot: import_cjs$15.option({
 		long: "snapshot",
 		short: "s",
 		description: "Start the sandbox from a snapshot ID",
-		type: import_cjs$14.optional(snapshotId)
+		type: import_cjs$15.optional(snapshotId)
 	}),
-	connect: import_cjs$14.flag({
+	connect: import_cjs$15.flag({
 		long: "connect",
 		description: "Start an interactive shell session after creating the sandbox"
 	}),
-	envVars: import_cjs$14.multioption({
+	envVars: import_cjs$15.multioption({
 		long: "env",
 		short: "e",
 		type: ObjectFromKeyValue,
 		description: "Default environment variables for sandbox commands"
 	}),
-	tags: import_cjs$14.multioption({
+	tags: import_cjs$15.multioption({
 		long: "tag",
 		short: "t",
 		type: ObjectFromKeyValue,
 		description: "Key-value tags to associate with the sandbox (e.g. --tag env=staging)"
 	}),
+	...snapshotRetentionArgs,
 	...networkPolicyArgs,
 	scope
 };
-const create = import_cjs$14.command({
+const create = import_cjs$15.command({
 	name: "create",
 	description: "Create a sandbox in the specified account and project.",
-	args: args$2,
+	args: args$3,
 	examples: [{
 		description: "Create and connect to a sandbox without a network access",
 		command: `sandbox run --network-policy=none --connect`
 	}],
-	async handler({ name, nonPersistent, ports, scope: scope$1, runtime: runtime$1, timeout: timeout$1, vcpus: vcpus$1, silent, snapshot: snapshot$1, connect: connect$2, envVars, tags, networkPolicy: networkPolicyMode$1, allowedDomains: allowedDomains$1, allowedCIDRs: allowedCIDRs$1, deniedCIDRs: deniedCIDRs$1 }) {
+	async handler({ name, nonPersistent, ports, scope: scope$1, runtime: runtime$1, timeout: timeout$1, vcpus: vcpus$1, silent, snapshot: snapshot$1, connect: connect$2, envVars, tags, snapshotExpiration: snapshotExpiration$1, keepLastSnapshots: keepLastSnapshots$1, keepLastSnapshotsFor: keepLastSnapshotsFor$1, deleteEvictedSnapshots: deleteEvictedSnapshots$1, networkPolicy: networkPolicyMode$1, allowedDomains: allowedDomains$1, allowedCIDRs: allowedCIDRs$1, deniedCIDRs: deniedCIDRs$1 }) {
 		const networkPolicy$1 = buildNetworkPolicy({
 			networkPolicy: networkPolicyMode$1,
 			allowedDomains: allowedDomains$1,
 			allowedCIDRs: allowedCIDRs$1,
 			deniedCIDRs: deniedCIDRs$1
 		});
+		const keepLastSnapshotsPayload = buildKeepLastSnapshotsPayload({
+			keepLastSnapshots: keepLastSnapshots$1,
+			keepLastSnapshotsFor: keepLastSnapshotsFor$1,
+			deleteEvictedSnapshots: deleteEvictedSnapshots$1
+		});
 		const persistent = !nonPersistent;
 		const resources = vcpus$1 ? { vcpus: vcpus$1 } : void 0;
 		const tagsObj = Object.keys(tags).length > 0 ? tags : void 0;
@@ -11818,12 +11809,14 @@ const create = import_cjs$14.command({
 			projectId: scope$1.project,
 			token: scope$1.token,
 			ports,
-			timeout: (0, import_ms$2.default)(timeout$1),
+			timeout: (0, import_ms$3.default)(timeout$1),
 			resources,
 			networkPolicy: networkPolicy$1,
 			env: envVars,
 			tags: tagsObj,
 			persistent,
+			snapshotExpiration: snapshotExpiration$1 ? (0, import_ms$3.default)(snapshotExpiration$1) : void 0,
+			keepLastSnapshots: keepLastSnapshotsPayload,
 			__interactive: true
 		}) : await sandboxClient.create({
 			name,
@@ -11832,12 +11825,14 @@ const create = import_cjs$14.command({
 			token: scope$1.token,
 			ports,
 			runtime: runtime$1,
-			timeout: (0, import_ms$2.default)(timeout$1),
+			timeout: (0, import_ms$3.default)(timeout$1),
 			resources,
 			networkPolicy: networkPolicy$1,
 			env: envVars,
 			tags: tagsObj,
 			persistent,
+			snapshotExpiration: snapshotExpiration$1 ? (0, import_ms$3.default)(snapshotExpiration$1) : void 0,
+			keepLastSnapshots: keepLastSnapshotsPayload,
 			__interactive: true
 		});
 		spinner?.stop();
@@ -11846,25 +11841,11 @@ const create = import_cjs$14.command({
 			`${source_default.bold("hint:")} This is an internal error. Please try again.`,
 			"╰▶ Report this issue: https://github.com/vercel/sandbox/issues"
 		].join("\n"));
-		const routes = sandbox.routes.filter((x) => x.port !== sandbox.interactivePort);
-		if (!silent) {
-			const teamDisplay = scope$1.teamSlug ?? scope$1.team;
-			const projectDisplay = scope$1.projectSlug ?? scope$1.project;
-			const hasPorts = routes.length > 0;
-			process.stderr.write("✅ Sandbox ");
-			process.stdout.write(source_default.cyan(sandbox.name));
-			process.stderr.write(" created.\n");
-			process.stderr.write(source_default.dim("   │ ") + "team: " + source_default.cyan(teamDisplay) + "\n");
-			if (hasPorts) {
-				process.stderr.write(source_default.dim("   │ ") + "project: " + source_default.cyan(projectDisplay) + "\n");
-				process.stderr.write(source_default.dim("   │ ") + "ports:\n");
-				for (let i = 0; i < routes.length; i++) {
-					const route = routes[i];
-					const prefix$1 = i === routes.length - 1 ? source_default.dim("   ╰ ") : source_default.dim("   │ ");
-					process.stderr.write(prefix$1 + "• " + route.port + " -> " + source_default.cyan(route.url) + "\n");
-				}
-			} else process.stderr.write(source_default.dim("   ╰ ") + "project: " + source_default.cyan(projectDisplay) + "\n");
-		}
+		if (!silent) printSandboxSummary({
+			sandbox,
+			scope: scope$1,
+			action: "created"
+		});
 		if (connect$2) await exec.handler({
 			scope: scope$1,
 			asSudo: false,
@@ -11882,22 +11863,143 @@ const create = import_cjs$14.command({
 });
 
 //#endregion
-//#region src/util/omit.ts
-function omit(obj, ...keys) {
-	const result = { ...obj };
-	for (const key of keys) delete result[key];
-	return result;
-}
-
-//#endregion
-//#region src/commands/run.ts
-var import_cjs$13 = /* @__PURE__ */ __toESM(require_cjs());
-const args$1 = {
-	...args$2,
-	...omit(args$3, "sandbox"),
-	removeAfterUse: import_cjs$13.flag({
-		long: "rm",
-		description: "Automatically remove the sandbox when the command exits."
+//#region src/commands/fork.ts
+var import_cjs$14 = /* @__PURE__ */ __toESM(require_cjs());
+var import_ms$2 = /* @__PURE__ */ __toESM(require_ms());
+init_source();
+const args$2 = {
+	source: import_cjs$14.positional({
+		displayName: "source",
+		description: "Name of the source sandbox to fork from.",
+		type: sandboxName
+	}),
+	name: import_cjs$14.option({
+		long: "name",
+		description: "A user-chosen name for the forked sandbox. Must be unique per project.",
+		type: import_cjs$14.optional(import_cjs$14.string)
+	}),
+	nonPersistent: import_cjs$14.flag({
+		long: "non-persistent",
+		description: "Disable automatic restore of the filesystem between sessions."
+	}),
+	timeout: import_cjs$14.option({
+		long: "timeout",
+		type: import_cjs$14.optional(Duration),
+		description: "Override the maximum sandbox runtime (inherited from source if omitted). Example: 5m, 30m"
+	}),
+	vcpus,
+	ports: publishPorts,
+	silent: import_cjs$14.flag({
+		long: "silent",
+		description: "Don't write sandbox name to stdout"
+	}),
+	connect: import_cjs$14.flag({
+		long: "connect",
+		description: "Start an interactive shell session after creating the forked sandbox"
+	}),
+	envVars: import_cjs$14.multioption({
+		long: "env",
+		short: "e",
+		type: ObjectFromKeyValue,
+		description: "Environment variables to set on the fork. Env vars from the source sandbox are not copied (encrypted server-side)."
+	}),
+	tags: import_cjs$14.multioption({
+		long: "tag",
+		short: "t",
+		type: ObjectFromKeyValue,
+		description: "Key-value tags to associate with the fork. When provided, fully replaces the tags copied from the source (no per-key merge)."
+	}),
+	...snapshotRetentionArgs,
+	...networkPolicyArgs,
+	scope
+};
+const fork = import_cjs$14.command({
+	name: "fork",
+	description: "Fork an existing sandbox into a new one. Copies config (cpu, timeout, network policy, tags, etc.) from the source sandbox; env vars are NOT copied and must be re-supplied via --env.",
+	args: args$2,
+	examples: [{
+		description: "Fork a sandbox with all config copied from the source",
+		command: `sandbox fork my-source`
+	}, {
+		description: "Fork with a specific name and overridden vcpus",
+		command: `sandbox fork my-source --name my-forked-sandbox --vcpus 4`
+	}],
+	async handler({ source, name, nonPersistent, ports, scope: scope$1, timeout: timeout$1, vcpus: vcpus$1, silent, connect: connect$2, envVars, tags, snapshotExpiration: snapshotExpiration$1, keepLastSnapshots: keepLastSnapshots$1, keepLastSnapshotsFor: keepLastSnapshotsFor$1, deleteEvictedSnapshots: deleteEvictedSnapshots$1, networkPolicy: networkPolicyMode$1, allowedDomains: allowedDomains$1, allowedCIDRs: allowedCIDRs$1, deniedCIDRs: deniedCIDRs$1 }) {
+		const networkPolicy$1 = networkPolicyMode$1 !== void 0 || allowedDomains$1.length > 0 || allowedCIDRs$1.length > 0 || deniedCIDRs$1.length > 0 ? buildNetworkPolicy({
+			networkPolicy: networkPolicyMode$1,
+			allowedDomains: allowedDomains$1,
+			allowedCIDRs: allowedCIDRs$1,
+			deniedCIDRs: deniedCIDRs$1
+		}) : void 0;
+		const keepLastSnapshotsPayload = buildKeepLastSnapshotsPayload({
+			keepLastSnapshots: keepLastSnapshots$1,
+			keepLastSnapshotsFor: keepLastSnapshotsFor$1,
+			deleteEvictedSnapshots: deleteEvictedSnapshots$1
+		});
+		const tagsObj = Object.keys(tags).length > 0 ? tags : void 0;
+		const envObj = Object.keys(envVars).length > 0 ? envVars : void 0;
+		const spinner = silent ? void 0 : ora(`Forking sandbox ${source_default.cyan(source)}...`).start();
+		const sandbox = await sandboxClient.fork({
+			sourceSandbox: source,
+			teamId: scope$1.team,
+			projectId: scope$1.project,
+			token: scope$1.token,
+			...name !== void 0 && { name },
+			...ports.length > 0 && { ports },
+			...timeout$1 !== void 0 && { timeout: (0, import_ms$2.default)(timeout$1) },
+			...vcpus$1 !== void 0 && { resources: { vcpus: vcpus$1 } },
+			...networkPolicy$1 !== void 0 && { networkPolicy: networkPolicy$1 },
+			...envObj !== void 0 && { env: envObj },
+			...tagsObj !== void 0 && { tags: tagsObj },
+			...nonPersistent && { persistent: false },
+			...snapshotExpiration$1 !== void 0 && { snapshotExpiration: (0, import_ms$2.default)(snapshotExpiration$1) },
+			...keepLastSnapshotsPayload !== void 0 && { keepLastSnapshots: keepLastSnapshotsPayload },
+			__interactive: true
+		});
+		spinner?.stop();
+		if (!sandbox.interactivePort) throw new Error([
+			`Sandbox forked but interactive port is missing.`,
+			`${source_default.bold("hint:")} This is an internal error. Please try again.`,
+			"╰▶ Report this issue: https://github.com/vercel/sandbox/issues"
+		].join("\n"));
+		if (!silent) printSandboxSummary({
+			sandbox,
+			scope: scope$1,
+			action: `forked from ${source_default.cyan(source)}`
+		});
+		if (connect$2) await exec.handler({
+			scope: scope$1,
+			asSudo: false,
+			args: [],
+			cwd: void 0,
+			skipExtendingTimeout: false,
+			envVars: {},
+			command: "sh",
+			interactive: true,
+			tty: true,
+			sandbox
+		});
+		return sandbox;
+	}
+});
+
+//#endregion
+//#region src/util/omit.ts
+function omit(obj, ...keys) {
+	const result = { ...obj };
+	for (const key of keys) delete result[key];
+	return result;
+}
+
+//#endregion
+//#region src/commands/run.ts
+var import_cjs$13 = /* @__PURE__ */ __toESM(require_cjs());
+const args$1 = {
+	...args$3,
+	...omit(args$4, "sandbox"),
+	removeAfterUse: import_cjs$13.flag({
+		long: "rm",
+		description: "Automatically remove the sandbox when the command exits."
 	}),
 	stopAfterUse: import_cjs$13.flag({
 		long: "stop",
@@ -11964,38 +12066,65 @@ const list = import_cjs$12.command({
 		}),
 		sortBy: import_cjs$12.option({
 			long: "sort-by",
-			description: "Sort sandboxes by field. Options: createdAt (default), name",
-			type: import_cjs$12.optional(import_cjs$12.oneOf(["createdAt", "name"]))
+			description: "Sort sandboxes by field. Options: createdAt (default), name, statusUpdatedAt",
+			type: import_cjs$12.optional(import_cjs$12.oneOf([
+				"createdAt",
+				"name",
+				"statusUpdatedAt"
+			]))
+		}),
+		sortOrder: import_cjs$12.option({
+			long: "sort-order",
+			description: "Sort order. Options: asc, desc (default)",
+			type: import_cjs$12.optional(import_cjs$12.oneOf(["asc", "desc"]))
 		}),
 		tags: import_cjs$12.multioption({
 			long: "tag",
 			description: "Filter sandboxes by tag. Format: \"key=value\"",
 			type: ObjectFromKeyValue
 		}),
+		limit: import_cjs$12.option({
+			long: "limit",
+			description: "Maximum number of sandboxes per page (default 50).",
+			type: import_cjs$12.optional(import_cjs$12.number)
+		}),
+		cursor: import_cjs$12.option({
+			long: "cursor",
+			description: "Pagination cursor from a previous 'More results' hint.",
+			type: import_cjs$12.optional(import_cjs$12.string)
+		}),
 		scope
 	},
-	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, all, namePrefix, sortBy, tags }) {
-		const sandboxes = await (async () => {
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, all, namePrefix, sortBy, sortOrder, tags, limit, cursor }) {
+		if (namePrefix) {
+			if (sortBy && sortBy !== "name") {
+				console.error(source_default.red("Error: --sort-by must be 'name' when using --name-prefix"));
+				return;
+			}
+			sortBy = "name";
+		}
+		const { sandboxes, pagination } = await (async () => {
 			try {
 				var _usingCtx$1 = _usingCtx();
 				const _spinner$1 = _usingCtx$1.u(acquireRelease(() => ora("Fetching sandboxes...").start(), (s$1) => s$1.stop()));
-				let { sandboxes: sandboxes$1 } = await sandboxClient.list({
+				return sandboxClient.list({
 					token: token$1,
 					teamId: team$1,
 					projectId: project$1,
-					limit: 100,
+					limit: limit ?? 50,
+					...cursor && { cursor },
 					...namePrefix && { namePrefix },
 					...sortBy && { sortBy },
+					...sortOrder && { sortOrder },
 					...Object.keys(tags).length > 0 && { tags }
 				});
-				if (!all) sandboxes$1 = sandboxes$1.filter((x) => x.status === "running");
-				return sandboxes$1;
 			} catch (_) {
 				_usingCtx$1.e = _;
 			} finally {
 				_usingCtx$1.d();
 			}
 		})();
+		const displayedSandboxes = all ? sandboxes : sandboxes.filter((x) => x.status === "running");
 		const memoryFormatter = new Intl.NumberFormat(void 0, {
 			style: "unit",
 			unit: "megabyte"
@@ -12019,9 +12148,10 @@ const list = import_cjs$12.command({
 			columns["NETWORK (OUT/IN)"] = { value: (s$1) => s$1.totalEgressBytes || s$1.totalIngressBytes ? `${formatBytes(s$1.totalEgressBytes ?? 0)} / ${formatBytes(s$1.totalIngressBytes ?? 0)}` : "- / -" };
 		}
 		console.log(table({
-			rows: sandboxes,
+			rows: displayedSandboxes,
 			columns
 		}));
+		if (pagination.next !== null) console.log(formatNextCursorHint(pagination.next));
 	}
 });
 const SandboxStatusColor = {
@@ -12041,18 +12171,118 @@ const connect = import_cjs$11.command({
 	name: "connect",
 	aliases: ["ssh", "shell"],
 	description: "Start an interactive shell in an existing sandbox",
-	args: omit(args$3, "command", "args", "interactive", "tty"),
-	async handler(args$4) {
+	args: omit(args$4, "command", "args", "interactive", "tty"),
+	async handler(args$5) {
 		return exec.handler({
 			command: "sh",
 			args: [],
 			interactive: true,
 			tty: true,
-			...args$4
+			...args$5
 		});
 	}
 });
 
+//#endregion
+//#region src/commands/stop.ts
+var import_cjs$10 = /* @__PURE__ */ __toESM(require_cjs());
+init_source();
+function c(label, value) {
+	return {
+		label,
+		value
+	};
+}
+/** Visible width of a cell (label + value, no ANSI). */
+function cellWidth(cell) {
+	return cell ? cell.label.length + cell.value.length : 0;
+}
+/** Print rows as a tree with column-aligned label: value pairs. */
+function printTree(rows) {
+	const widths = [];
+	for (const row of rows) for (let i = 0; i < row.length; i++) widths[i] = Math.max(widths[i] ?? 0, cellWidth(row[i]));
+	for (let r = 0; r < rows.length; r++) {
+		const prefix$1 = r === rows.length - 1 ? source_default.dim("   ╰ ") : source_default.dim("   │ ");
+		const line = rows[r].map((cell, i) => {
+			if (!cell) return " ".repeat(widths[i]);
+			const pad = widths[i] - cell.label.length - cell.value.length;
+			return cell.label + source_default.cyan(cell.value) + " ".repeat(Math.max(0, pad));
+		}).join("  ").trimEnd();
+		process.stderr.write(prefix$1 + line + "\n");
+	}
+}
+function printStopResult(name, sandbox, sessionSnapshot) {
+	process.stderr.write(source_default.green("✔") + " Sandbox stopped.\n");
+	const snapshot$1 = sessionSnapshot.snapshot;
+	printTree([
+		[
+			c("sandbox: ", name),
+			sandbox.totalActiveCpuDurationMs != null ? c("active cpu: ", formatRunDuration(sandbox.totalActiveCpuDurationMs)) : null,
+			sandbox.memory != null ? c("mem: ", `${sandbox.memory} MB`) : null,
+			sandbox.totalDurationMs != null ? c("duration: ", formatRunDuration(sandbox.totalDurationMs)) : null,
+			sandbox.totalIngressBytes != null ? c("ingress: ", formatBytes(sandbox.totalIngressBytes)) : null,
+			sandbox.totalEgressBytes != null ? c("egress: ", formatBytes(sandbox.totalEgressBytes)) : null
+		],
+		[
+			c("session: ", sessionSnapshot.id),
+			sessionSnapshot.activeCpuDurationMs != null ? c("active cpu: ", formatRunDuration(sessionSnapshot.activeCpuDurationMs)) : null,
+			c("mem: ", `${sessionSnapshot.memory} MB`),
+			sessionSnapshot.duration != null ? c("duration: ", formatRunDuration(sessionSnapshot.duration)) : null,
+			sessionSnapshot.networkTransfer ? c("ingress: ", formatBytes(sessionSnapshot.networkTransfer.ingress)) : null,
+			sessionSnapshot.networkTransfer ? c("egress: ", formatBytes(sessionSnapshot.networkTransfer.egress)) : null
+		],
+		...snapshot$1 ? [[
+			c("snapshot: ", snapshot$1.id),
+			c("size: ", formatBytes(snapshot$1.sizeBytes)),
+			c("expires: ", snapshot$1.expiresAt ? timeAgo(snapshot$1.expiresAt) : "never")
+		]] : []
+	]);
+}
+const stop = import_cjs$10.command({
+	name: "stop",
+	description: "Stop the current session of one or more sandboxes",
+	args: {
+		sandboxName: import_cjs$10.positional({
+			type: sandboxName,
+			description: "A sandbox name to stop"
+		}),
+		sandboxNames: import_cjs$10.restPositionals({
+			type: sandboxName,
+			description: "More sandboxes to stop"
+		}),
+		scope
+	},
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandboxName: sandboxName$1, sandboxNames }) {
+		const names = Array.from(new Set([sandboxName$1, ...sandboxNames]));
+		const spinner = ora({
+			text: names.length === 1 ? `Stopping ${names[0]}` : `Stopping ${names.length} sandboxes`,
+			stream: process.stderr
+		}).start();
+		const results = await Promise.allSettled(names.map(async (name) => {
+			const sandbox = await sandboxClient.get({
+				token: token$1,
+				teamId: team$1,
+				projectId: project$1,
+				name
+			});
+			return {
+				name,
+				sandbox,
+				sessionSnapshot: await sandbox.stop()
+			};
+		}));
+		spinner.stop();
+		for (const result of results) if (result.status === "fulfilled") {
+			const { name, sandbox, sessionSnapshot } = result.value;
+			printStopResult(name, sandbox, sessionSnapshot);
+		} else {
+			const error = result.reason;
+			process.stderr.write(source_default.red("✖") + ` ${error.message ?? error}\n`);
+			process.exitCode = 1;
+		}
+	}
+});
+
 //#endregion
 //#region ../../node_modules/.pnpm/eventemitter3@5.0.1/node_modules/eventemitter3/index.js
 var require_eventemitter3 = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/eventemitter3@5.0.1/node_modules/eventemitter3/index.js": ((exports, module) => {
@@ -12175,7 +12405,7 @@ var require_eventemitter3 = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.
 	EventEmitter$1.prototype.emit = function emit(event, a1, a2, a3, a4, a5) {
 		var evt = prefix ? prefix + event : event;
 		if (!this._events[evt]) return false;
-		var listeners = this._events[evt], len = arguments.length, args$4, i;
+		var listeners = this._events[evt], len = arguments.length, args$5, i;
 		if (listeners.fn) {
 			if (listeners.once) this.removeListener(event, listeners.fn, void 0, true);
 			switch (len) {
@@ -12186,8 +12416,8 @@ var require_eventemitter3 = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.
 				case 5: return listeners.fn.call(listeners.context, a1, a2, a3, a4), true;
 				case 6: return listeners.fn.call(listeners.context, a1, a2, a3, a4, a5), true;
 			}
-			for (i = 1, args$4 = new Array(len - 1); i < len; i++) args$4[i - 1] = arguments[i];
-			listeners.fn.apply(listeners.context, args$4);
+			for (i = 1, args$5 = new Array(len - 1); i < len; i++) args$5[i - 1] = arguments[i];
+			listeners.fn.apply(listeners.context, args$5);
 		} else {
 			var length = listeners.length, j;
 			for (i = 0; i < length; i++) {
@@ -12206,8 +12436,8 @@ var require_eventemitter3 = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.
 						listeners[i].fn.call(listeners[i].context, a1, a2, a3);
 						break;
 					default:
-						if (!args$4) for (j = 1, args$4 = new Array(len - 1); j < len; j++) args$4[j - 1] = arguments[j];
-						listeners[i].fn.apply(listeners[i].context, args$4);
+						if (!args$5) for (j = 1, args$5 = new Array(len - 1); j < len; j++) args$5[j - 1] = arguments[j];
+						listeners[i].fn.apply(listeners[i].context, args$5);
 				}
 			}
 		}
@@ -12304,9 +12534,9 @@ const isDumbTerminal = env.TERM === "dumb";
 const isCompatibleTerminal = tty$1 && tty$1.isatty && tty$1.isatty(1) && env.TERM && !isDumbTerminal;
 const isCI = "CI" in env && ("GITHUB_ACTIONS" in env || "GITLAB_CI" in env || "CIRCLECI" in env);
 const isColorSupported = !isDisabled && (isForced || isWindows && !isDumbTerminal || isCompatibleTerminal || isCI);
-const replaceClose = (index, string$1, close, replace, head = string$1.substring(0, index) + replace, tail = string$1.substring(index + close.length), next = tail.indexOf(close)) => head + (next < 0 ? tail : replaceClose(next, tail, close, replace));
-const clearBleed = (index, string$1, open$1, close, replace) => index < 0 ? open$1 + string$1 + close : open$1 + replaceClose(index, string$1, close, replace) + close;
-const filterEmpty = (open$1, close, replace = open$1, at = open$1.length + 1) => (string$1) => string$1 || !(string$1 === "" || string$1 === void 0) ? clearBleed(("" + string$1).indexOf(close, at), string$1, open$1, close, replace) : "";
+const replaceClose = (index, string$2, close, replace, head = string$2.substring(0, index) + replace, tail = string$2.substring(index + close.length), next = tail.indexOf(close)) => head + (next < 0 ? tail : replaceClose(next, tail, close, replace));
+const clearBleed = (index, string$2, open$1, close, replace) => index < 0 ? open$1 + string$2 + close : open$1 + replaceClose(index, string$2, close, replace) + close;
+const filterEmpty = (open$1, close, replace = open$1, at = open$1.length + 1) => (string$2) => string$2 || !(string$2 === "" || string$2 === void 0) ? clearBleed(("" + string$2).indexOf(close, at), string$2, open$1, close, replace) : "";
 const init = (open$1, close, replace) => filterEmpty(`\x1b[${open$1}m`, `\x1b[${close}m`, replace);
 const colors = {
 	reset: init(0, 0),
@@ -12620,8 +12850,8 @@ var EventManager = class {
 	constructor() {
 		this.emitter = new eventemitter3_default();
 	}
-	emit(dispatch, args$4) {
-		this.emitter.emit(dispatch, args$4);
+	emit(dispatch, args$5) {
+		this.emitter.emit(dispatch, args$5);
 	}
 	on(dispatch, handler) {
 		this.emitter.addListener(dispatch, handler);
@@ -12665,8 +12895,8 @@ function cleanseAnsi(chunk) {
 * @see {@link https://www.npmjs.com/package/colorette}
 */
 const color = createColors();
-function indent(string$1, count) {
-	return string$1.replace(/^(?!\s*$)/gm, " ".repeat(count));
+function indent(string$2, count) {
+	return string$2.replace(/^(?!\s*$)/gm, " ".repeat(count));
 }
 const FIGURES_MAIN = {
 	warning: "⚠",
@@ -12773,9 +13003,9 @@ var ListrLogger = class {
 		if (!message) return message;
 		return this.applyFormat(`[${message}]`, options);
 	}
-	splat(...args$4) {
-		const message = args$4.shift() ?? "";
-		return args$4.length === 0 ? message : splat(message, args$4);
+	splat(...args$5) {
+		const message = args$5.shift() ?? "";
+		return args$5.length === 0 ? message : splat(message, args$5);
 	}
 	suffix(message, ...suffixes) {
 		suffixes.filter(Boolean).forEach((suffix) => {
@@ -12857,12 +13087,12 @@ var ProcessOutputBuffer = class {
 	get length() {
 		return this.buffer.length;
 	}
-	write(data, ...args$4) {
-		const callback = args$4[args$4.length - 1];
+	write(data, ...args$5) {
+		const callback = args$5[args$5.length - 1];
 		this.buffer.push({
 			time: Date.now(),
 			stream: this.options?.stream,
-			entry: this.decoder.write(typeof data === "string" ? Buffer.from(data, typeof args$4[0] === "string" ? args$4[0] : void 0) : Buffer.from(data))
+			entry: this.decoder.write(typeof data === "string" ? Buffer.from(data, typeof args$5[0] === "string" ? args$5[0] : void 0) : Buffer.from(data))
 		});
 		if (this.options?.limit) this.buffer = this.buffer.slice(-this.options.limit);
 		if (typeof callback === "function") callback();
@@ -12890,8 +13120,8 @@ var ProcessOutputStream = class {
 		this.buffer.reset();
 		return buffer;
 	}
-	write(...args$4) {
-		return this.method.apply(this.stream, args$4);
+	write(...args$5) {
+		return this.method.apply(this.stream, args$5);
 	}
 };
 /**
@@ -13754,8 +13984,8 @@ function getRenderer(options) {
 * If the value itself is a function it will evaluate it with the passed in arguments,
 * elsewise it will directly return itself.
 */
-function assertFunctionOrSelf(functionOrSelf, ...args$4) {
-	if (typeof functionOrSelf === "function") return functionOrSelf(...args$4);
+function assertFunctionOrSelf(functionOrSelf, ...args$5) {
+	if (typeof functionOrSelf === "function") return functionOrSelf(...args$5);
 	else return functionOrSelf;
 }
 const clone = (0, import_rfdc.default)({ circles: true });
@@ -14336,45 +14566,6 @@ var Listr = class {
 	}
 };
 
-//#endregion
-//#region src/commands/stop.ts
-var import_cjs$10 = /* @__PURE__ */ __toESM(require_cjs());
-const stop = import_cjs$10.command({
-	name: "stop",
-	description: "Stop the current session of one or more sandboxes",
-	args: {
-		sandboxName: import_cjs$10.positional({
-			type: sandboxName,
-			description: "A sandbox name to stop"
-		}),
-		sandboxNames: import_cjs$10.restPositionals({
-			type: sandboxName,
-			description: "More sandboxes to stop"
-		}),
-		scope
-	},
-	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandboxName: sandboxName$1, sandboxNames }) {
-		const tasks = Array.from(new Set([sandboxName$1, ...sandboxNames]), (sandboxName$2) => {
-			return {
-				title: `Stopping active session from ${sandboxName$2}`,
-				async task() {
-					await (await sandboxClient.get({
-						token: token$1,
-						teamId: team$1,
-						projectId: project$1,
-						name: sandboxName$2
-					})).stop();
-				}
-			};
-		});
-		try {
-			await new Listr(tasks, { concurrent: true }).run();
-		} catch {
-			process.exitCode = 1;
-		}
-	}
-});
-
 //#endregion
 //#region src/commands/remove.ts
 var import_cjs$9 = /* @__PURE__ */ __toESM(require_cjs());
@@ -14569,6 +14760,75 @@ const snapshot = import_cjs$6.command({
 	}
 });
 
+//#endregion
+//#region src/util/snapshot-tree.ts
+init_source();
+function formatExpires(expiresAt) {
+	if (expiresAt === void 0) return source_default.gray("never");
+	const ms$6 = expiresAt - Date.now();
+	if (ms$6 <= 0) return source_default.red("expired");
+	const formatted = timeAgo(expiresAt);
+	return ms$6 <= 3600 * 1e3 ? source_default.red(formatted) : source_default.green(formatted);
+}
+function renderNode(id, expiresAt, isCurrent) {
+	const bullet = isCurrent ? source_default.magenta.bold("●") : source_default.magenta("●");
+	const suffix = isCurrent ? `  ${source_default.green("◂ current")}` : "";
+	return `${bullet} ${source_default.yellow(id)}   expires: ${formatExpires(expiresAt)}${suffix}`;
+}
+function renderSiblings(siblings, count) {
+	const lines = [];
+	const shown = siblings.slice(0, 5);
+	const totalCount = parseInt(count, 10);
+	const hasPlus = count.endsWith("+");
+	const remaining = totalCount - 1 - shown.length;
+	for (let i = 0; i < shown.length; i++) {
+		const connector = i === shown.length - 1 && remaining <= 0 ? "╰──" : "├──";
+		lines.push(`│   ${connector} ${source_default.gray(shown[i].sourceSessionId)}`);
+	}
+	if (remaining > 0) {
+		const suffix = hasPlus ? "+" : "";
+		lines.push(`│   ╰── ${source_default.gray(`+${remaining}${suffix} more sandboxes`)}`);
+	}
+	return lines;
+}
+function renderSnapshotTree(params) {
+	const { ancestors, descendants } = params;
+	const hideCurrent = params.hideCurrent === true;
+	const currentSnapshotId = hideCurrent ? void 0 : params.currentSnapshotId;
+	const lines = [];
+	const pushNode = (node, isCurrent) => {
+		lines.push("│");
+		lines.push(renderNode(node.snapshot.id, node.snapshot.expiresAt, isCurrent));
+		if (node.siblings.length > 0) lines.push(...renderSiblings(node.siblings, node.count));
+	};
+	const descendantNodes = descendants.snapshots.filter((n) => n.snapshot.id !== currentSnapshotId);
+	if (descendantNodes.length > 0) for (const node of [...descendantNodes].reverse()) pushNode(node, false);
+	if (!hideCurrent) {
+		const { currentSnapshotId: id, currentSnapshotExpiresAt } = params;
+		pushNode(ancestors.snapshots.find((n) => n.snapshot.id === id) ?? descendants.snapshots.find((n) => n.snapshot.id === id) ?? {
+			snapshot: {
+				id,
+				sourceSessionId: "",
+				expiresAt: currentSnapshotExpiresAt
+			},
+			siblings: [],
+			count: "1"
+		}, true);
+	}
+	const ancestorNodes = ancestors.snapshots.filter((n) => n.snapshot.id !== currentSnapshotId);
+	for (const node of ancestorNodes) pushNode(node, false);
+	if (!hideCurrent) {
+		const lastAncestor = ancestorNodes[ancestorNodes.length - 1];
+		if (ancestors.pagination.next === null) {
+			if (lastAncestor && !lastAncestor.snapshot.parentId || ancestorNodes.length === 0) {
+				lines.push("│");
+				lines.push(`${source_default.white("○")} ${source_default.gray("(root)")}`);
+			}
+		}
+	}
+	return lines.join("\n");
+}
+
 //#endregion
 //#region src/commands/snapshots.ts
 var import_cjs$4 = /* @__PURE__ */ __toESM(require_cjs());
@@ -14584,21 +14844,37 @@ const list$2 = import_cjs$4.command({
 			type: import_cjs$4.optional(sandboxName),
 			long: "name",
 			description: "Filter snapshots by sandbox."
+		}),
+		sortOrder: import_cjs$4.option({
+			long: "sort-order",
+			description: "Sort order. Options: asc, desc (default)",
+			type: import_cjs$4.optional(import_cjs$4.oneOf(["asc", "desc"]))
+		}),
+		limit: import_cjs$4.option({
+			long: "limit",
+			description: "Maximum number of snapshots per page (default 50).",
+			type: import_cjs$4.optional(import_cjs$4.number)
+		}),
+		cursor: import_cjs$4.option({
+			long: "cursor",
+			description: "Pagination cursor from a previous 'More results' hint.",
+			type: import_cjs$4.optional(import_cjs$4.string)
 		})
 	},
-	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, name }) {
-		const snapshots$1 = await (async () => {
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, name, sortOrder, limit, cursor }) {
+		const { snapshots: snapshots$1, pagination } = await (async () => {
 			try {
 				var _usingCtx$1 = _usingCtx();
 				const _spinner$1 = _usingCtx$1.u(acquireRelease(() => ora("Fetching snapshots...").start(), (s$1) => s$1.stop()));
-				const { snapshots: snapshots$2 } = await snapshotClient.list({
+				return snapshotClient.list({
 					token: token$1,
 					teamId: team$1,
 					projectId: project$1,
 					name,
-					limit: 100
+					limit: limit ?? 50,
+					...cursor && { cursor },
+					...sortOrder && { sortOrder }
 				});
-				return snapshots$2;
 			} catch (_) {
 				_usingCtx$1.e = _;
 			} finally {
@@ -14619,6 +14895,7 @@ const list$2 = import_cjs$4.command({
 				["SOURCE SESSION"]: { value: (s$1) => s$1.sourceSessionId }
 			}
 		}));
+		if (pagination.next !== null) console.log(formatNextCursorHint(pagination.next));
 	}
 });
 const get = import_cjs$4.command({
@@ -14702,12 +14979,154 @@ const remove$1 = import_cjs$4.command({
 		}
 	}
 });
+const tree = import_cjs$4.command({
+	name: "tree",
+	description: "Show the snapshot ancestry tree for a sandbox.",
+	args: {
+		scope,
+		sandboxName: import_cjs$4.positional({
+			type: sandboxName,
+			description: "Sandbox name"
+		}),
+		sortOrder: import_cjs$4.option({
+			long: "sort-order",
+			description: "Sort order. Options: asc, desc (default). 'desc' walks ancestors, 'asc' walks descendants. Requires --cursor.",
+			type: import_cjs$4.optional(import_cjs$4.oneOf(["asc", "desc"]))
+		}),
+		limit: import_cjs$4.option({
+			long: "limit",
+			description: "Maximum number of snapshots per page (1–10, default 10).",
+			type: import_cjs$4.optional(import_cjs$4.number)
+		}),
+		cursor: import_cjs$4.option({
+			long: "cursor",
+			description: "Pagination cursor from a previous 'More ancestors' or 'More descendants' hint.",
+			type: import_cjs$4.optional(import_cjs$4.string)
+		})
+	},
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandboxName: name, sortOrder, limit, cursor }) {
+		if (limit !== void 0 && (limit < 1 || limit > 10)) {
+			console.error(source_default.red("Error: --limit must be between 1 and 10."));
+			process.exitCode = 1;
+			return;
+		}
+		if (sortOrder !== void 0 && !cursor) {
+			console.error(source_default.red("Error: --sort-order requires --cursor."));
+			process.exitCode = 1;
+			return;
+		}
+		const pageLimit = limit ?? 10;
+		if (cursor) {
+			const effectiveSortOrder = sortOrder ?? "desc";
+			const page = await (async () => {
+				try {
+					var _usingCtx4 = _usingCtx();
+					const _spinner$1 = _usingCtx4.u(acquireRelease(() => ora("Fetching snapshot tree...").start(), (s$1) => s$1.stop()));
+					return snapshotClient.tree({
+						snapshotId: cursor,
+						sortOrder: effectiveSortOrder,
+						limit: pageLimit,
+						token: token$1,
+						teamId: team$1,
+						projectId: project$1
+					});
+				} catch (_) {
+					_usingCtx4.e = _;
+				} finally {
+					_usingCtx4.d();
+				}
+			})();
+			const ancestors = effectiveSortOrder === "desc" ? page : {
+				snapshots: [],
+				pagination: {
+					count: 0,
+					next: null
+				}
+			};
+			const descendants = effectiveSortOrder === "asc" ? page : {
+				snapshots: [],
+				pagination: {
+					count: 0,
+					next: null
+				}
+			};
+			console.log(renderSnapshotTree({
+				hideCurrent: true,
+				ancestors,
+				descendants
+			}));
+			if (page.pagination.next !== null) console.log(formatNextCursorHint(page.pagination.next));
+			return;
+		}
+		const result = await (async () => {
+			try {
+				var _usingCtx5 = _usingCtx();
+				const _spinner$1 = _usingCtx5.u(acquireRelease(() => ora("Fetching snapshot tree...").start(), (s$1) => s$1.stop()));
+				const currentSnapshotId = (await sandboxClient.get({
+					name,
+					token: token$1,
+					teamId: team$1,
+					projectId: project$1
+				})).currentSnapshotId;
+				if (!currentSnapshotId) return null;
+				const [currentSnap, ancestors, descendants] = await Promise.all([
+					snapshotClient.get({
+						snapshotId: currentSnapshotId,
+						token: token$1,
+						teamId: team$1,
+						projectId: project$1
+					}),
+					snapshotClient.tree({
+						snapshotId: currentSnapshotId,
+						sortOrder: "desc",
+						limit: pageLimit,
+						token: token$1,
+						teamId: team$1,
+						projectId: project$1
+					}),
+					snapshotClient.tree({
+						snapshotId: currentSnapshotId,
+						sortOrder: "asc",
+						limit: pageLimit,
+						token: token$1,
+						teamId: team$1,
+						projectId: project$1
+					})
+				]);
+				return {
+					currentSnap,
+					currentSnapshotId,
+					ancestors,
+					descendants
+				};
+			} catch (_) {
+				_usingCtx5.e = _;
+			} finally {
+				_usingCtx5.d();
+			}
+		})();
+		if (!result) {
+			console.log(source_default.yellow("No snapshots found for this sandbox."));
+			return;
+		}
+		console.log(renderSnapshotTree({
+			currentSnapshotId: result.currentSnapshotId,
+			currentSnapshotExpiresAt: result.currentSnap.expiresAt?.getTime(),
+			ancestors: result.ancestors,
+			descendants: result.descendants
+		}));
+		const limitArg = limit !== void 0 ? ` --limit ${limit}` : "";
+		if (result.ancestors.pagination.next !== null) console.log(`\nMore ancestors: sandbox snapshots tree ${name} --sort-order desc${limitArg} --cursor ${result.ancestors.pagination.next}`);
+		if (result.descendants.pagination.next !== null) console.log(`More descendants: sandbox snapshots tree ${name} --sort-order asc${limitArg} --cursor ${result.descendants.pagination.next}`);
+	}
+});
 const snapshots = (0, import_cjs$5.subcommands)({
 	name: "snapshots",
 	description: "Manage sandbox snapshots",
 	cmds: {
 		list: list$2,
 		get,
+		tree,
 		delete: remove$1
 	}
 });
@@ -14736,27 +15155,46 @@ const list$1 = import_cjs$2.command({
 			type: sandboxName,
 			description: "Sandbox name to list sessions for"
 		}),
+		sortOrder: import_cjs$2.option({
+			long: "sort-order",
+			description: "Sort order. Options: asc, desc (default)",
+			type: import_cjs$2.optional(import_cjs$2.oneOf(["asc", "desc"]))
+		}),
+		limit: import_cjs$2.option({
+			long: "limit",
+			description: "Maximum number of sessions per page (default 50).",
+			type: import_cjs$2.optional(import_cjs$2.number)
+		}),
+		cursor: import_cjs$2.option({
+			long: "cursor",
+			description: "Pagination cursor from a previous 'More results' hint.",
+			type: import_cjs$2.optional(import_cjs$2.string)
+		}),
 		scope
 	},
-	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, all, sandbox: name }) {
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, all, sandbox: name, sortOrder, limit, cursor }) {
 		const sandbox = await sandboxClient.get({
 			name,
 			projectId: project$1,
 			teamId: team$1,
 			token: token$1
 		});
-		let { sessions: sessions$1 } = await (async () => {
+		const { sessions: sessions$1, pagination } = await (async () => {
 			try {
 				var _usingCtx$1 = _usingCtx();
 				const _spinner$1 = _usingCtx$1.u(acquireRelease(() => ora("Fetching sessions...").start(), (s$1) => s$1.stop()));
-				return sandbox.listSessions();
+				return sandbox.listSessions({
+					limit: limit ?? 50,
+					...cursor && { cursor },
+					...sortOrder && { sortOrder }
+				});
 			} catch (_) {
 				_usingCtx$1.e = _;
 			} finally {
 				_usingCtx$1.d();
 			}
 		})();
-		if (!all) sessions$1 = sessions$1.filter((x) => x.status === "running");
+		const displayedSessions = all ? sessions$1 : sessions$1.filter((x) => x.status === "running");
 		const memoryFormatter = new Intl.NumberFormat(void 0, {
 			style: "unit",
 			unit: "megabyte"
@@ -14780,9 +15218,10 @@ const list$1 = import_cjs$2.command({
 			columns["NETWORK (OUT/IN)"] = { value: (s$1) => s$1.networkTransfer?.egress || s$1.networkTransfer?.ingress ? `${formatBytes(s$1.networkTransfer?.egress ?? 0)} / ${formatBytes(s$1.networkTransfer?.ingress ?? 0)}` : "- / -" };
 		}
 		console.log(table({
-			rows: sessions$1,
+			rows: displayedSessions,
 			columns
 		}));
+		if (pagination.next !== null) console.log(formatNextCursorHint(pagination.next));
 	}
 });
 const sessions = (0, import_cjs$3.subcommands)({
@@ -14907,6 +15346,245 @@ const persistentCommand = import_cjs$1.command({
 		}
 	}
 });
+const snapshotExpirationCommand = import_cjs$1.command({
+	name: "snapshot-expiration",
+	description: "Update the default snapshot expiration of a sandbox",
+	args: {
+		sandbox: import_cjs$1.positional({
+			type: sandboxName,
+			description: "Sandbox name to update"
+		}),
+		duration: import_cjs$1.positional({
+			type: SnapshotExpiration,
+			description: "Snapshot expiration duration (e.g. 7d, 30d) or \"none\" for no expiration"
+		}),
+		scope
+	},
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandbox: name, duration }) {
+		const sandbox = await sandboxClient.get({
+			name,
+			projectId: project$1,
+			teamId: team$1,
+			token: token$1
+		});
+		const spinner = ora("Updating sandbox configuration...").start();
+		try {
+			await sandbox.update({ snapshotExpiration: (0, import_ms.default)(duration) });
+			spinner.stop();
+			const display = (0, import_ms.default)(duration) === 0 ? "none" : duration;
+			process.stderr.write("✅ Configuration updated for sandbox " + source_default.cyan(name) + "\n");
+			process.stderr.write(source_default.dim("   ╰ ") + "snapshot-expiration: " + source_default.cyan(display) + "\n");
+		} catch (error) {
+			spinner.stop();
+			throw error;
+		}
+	}
+});
+const keepLastCountType = import_cjs$1.extendType(import_cjs$1.number, {
+	displayName: "COUNT",
+	async from(n) {
+		if (!Number.isInteger(n) || n < 0 || n > 10) throw new Error(`Invalid count: ${n}. Must be an integer between 0 and 10 (0 removes the policy).`);
+		return n;
+	}
+});
+const keepLastSnapshotsCommand = import_cjs$1.command({
+	name: "keep-last-snapshots",
+	description: "Update the snapshot retention policy (keep only the N most recent snapshots) of a sandbox",
+	args: {
+		sandbox: import_cjs$1.positional({
+			type: sandboxName,
+			description: "Sandbox name to update"
+		}),
+		count: import_cjs$1.positional({
+			type: keepLastCountType,
+			description: "Number of most recent snapshots to keep (1-10). Pass 0 to remove the policy."
+		}),
+		scope
+	},
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandbox: name, count }) {
+		const sandbox = await sandboxClient.get({
+			name,
+			projectId: project$1,
+			teamId: team$1,
+			token: token$1
+		});
+		const spinner = ora("Updating sandbox configuration...").start();
+		try {
+			if (count === 0) await sandbox.update({ keepLastSnapshots: null });
+			else {
+				const current = sandbox.keepLastSnapshots;
+				await sandbox.update({ keepLastSnapshots: {
+					count,
+					expiration: current?.expiration,
+					deleteEvicted: current?.deleteEvicted
+				} });
+			}
+			spinner.stop();
+			process.stderr.write("✅ Configuration updated for sandbox " + source_default.cyan(name) + "\n");
+			process.stderr.write(source_default.dim("   ╰ ") + "keep-last-snapshots: " + source_default.cyan(count === 0 ? "cleared" : `count=${count}`) + "\n");
+		} catch (error) {
+			spinner.stop();
+			throw error;
+		}
+	}
+});
+const keepLastSnapshotsForCommand = import_cjs$1.command({
+	name: "keep-last-snapshots-for",
+	description: "Update the expiration applied to snapshots kept by the retention policy",
+	args: {
+		sandbox: import_cjs$1.positional({
+			type: sandboxName,
+			description: "Sandbox name to update"
+		}),
+		duration: import_cjs$1.positional({
+			type: SnapshotExpiration,
+			description: "Expiration for kept snapshots. Use \"none\" or 0 for no expiration. Example: 7d, 30d"
+		}),
+		scope
+	},
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandbox: name, duration }) {
+		const sandbox = await sandboxClient.get({
+			name,
+			projectId: project$1,
+			teamId: team$1,
+			token: token$1
+		});
+		const current = sandbox.keepLastSnapshots;
+		if (!current) throw new Error(["No keep-last-snapshots policy is set on this sandbox.", `${source_default.bold("hint:")} Set a count first with: sandbox config keep-last-snapshots ${name} <count>`].join("\n"));
+		const spinner = ora("Updating sandbox configuration...").start();
+		try {
+			await sandbox.update({ keepLastSnapshots: {
+				count: current.count,
+				expiration: (0, import_ms.default)(duration),
+				deleteEvicted: current.deleteEvicted
+			} });
+			spinner.stop();
+			const display = (0, import_ms.default)(duration) === 0 ? "none" : duration;
+			process.stderr.write("✅ Configuration updated for sandbox " + source_default.cyan(name) + "\n");
+			process.stderr.write(source_default.dim("   ╰ ") + "keep-last-snapshots-for: " + source_default.cyan(display) + "\n");
+		} catch (error) {
+			spinner.stop();
+			throw error;
+		}
+	}
+});
+const deleteEvictedSnapshotsCommand = import_cjs$1.command({
+	name: "delete-evicted-snapshots",
+	description: "When \"true\" (the default), snapshots evicted by the keep-last-snapshots policy are deleted immediately; when \"false\", they keep the default expiration.",
+	args: {
+		sandbox: import_cjs$1.positional({
+			type: sandboxName,
+			description: "Sandbox name to update"
+		}),
+		value: import_cjs$1.positional({
+			type: {
+				...import_cjs$1.oneOf(["true", "false"]),
+				displayName: "true|false"
+			},
+			description: "Whether to delete evicted snapshots immediately (\"true\") or let them keep the default expiration (\"false\")."
+		}),
+		scope
+	},
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandbox: name, value }) {
+		const sandbox = await sandboxClient.get({
+			name,
+			projectId: project$1,
+			teamId: team$1,
+			token: token$1
+		});
+		const current = sandbox.keepLastSnapshots;
+		if (!current) throw new Error(["No keep-last-snapshots policy is set on this sandbox.", `${source_default.bold("hint:")} Set a count first with: sandbox config keep-last-snapshots ${name} <count>`].join("\n"));
+		const spinner = ora("Updating sandbox configuration...").start();
+		try {
+			await sandbox.update({ keepLastSnapshots: {
+				count: current.count,
+				expiration: current.expiration,
+				deleteEvicted: value === "true"
+			} });
+			spinner.stop();
+			process.stderr.write("✅ Configuration updated for sandbox " + source_default.cyan(name) + "\n");
+			process.stderr.write(source_default.dim("   ╰ ") + "delete-evicted-snapshots: " + source_default.cyan(value) + "\n");
+		} catch (error) {
+			spinner.stop();
+			throw error;
+		}
+	}
+});
+const currentSnapshotCommand = import_cjs$1.command({
+	name: "current-snapshot",
+	description: "Update the current snapshot of a sandbox",
+	args: {
+		sandbox: import_cjs$1.positional({
+			type: sandboxName,
+			description: "Sandbox name to update"
+		}),
+		snapshotId: import_cjs$1.positional({
+			type: snapshotId,
+			description: "Snapshot ID to set as the current snapshot"
+		}),
+		scope
+	},
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandbox: name, snapshotId: snapshotId$1 }) {
+		const sandbox = await sandboxClient.get({
+			name,
+			projectId: project$1,
+			teamId: team$1,
+			token: token$1
+		});
+		const spinner = ora("Updating sandbox configuration...").start();
+		try {
+			await sandbox.update({ currentSnapshotId: snapshotId$1 });
+			spinner.stop();
+			process.stderr.write("✅ Configuration updated for sandbox " + source_default.cyan(name) + "\n");
+			process.stderr.write(source_default.dim("   ╰ ") + "current-snapshot: " + source_default.cyan(snapshotId$1) + "\n");
+		} catch (error) {
+			spinner.stop();
+			if (error instanceof APIError && error.response.status === 404) throw new StyledError(`Snapshot '${snapshotId$1}' was not found or does not belong to this project.`, error);
+			throw error;
+		}
+	}
+});
+const portsCommand = import_cjs$1.command({
+	name: "ports",
+	description: "Update the published ports of a sandbox. Replaces all existing published ports.",
+	args: {
+		sandbox: import_cjs$1.positional({
+			type: sandboxName,
+			description: "Sandbox name to update"
+		}),
+		ports: publishPorts,
+		scope
+	},
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandbox: name, ports }) {
+		const sandbox = await sandboxClient.get({
+			name,
+			projectId: project$1,
+			teamId: team$1,
+			token: token$1
+		});
+		const spinner = ora("Updating sandbox ports...").start();
+		try {
+			await sandbox.update({ ports });
+			spinner.stop();
+			process.stderr.write("✅ Ports updated for sandbox " + source_default.cyan(name) + "\n");
+			if (ports.length === 0) process.stderr.write(source_default.dim("   ╰ ") + "all ports unpublished\n");
+			else {
+				const routes = getPublishedRoutes(sandbox);
+				process.stderr.write(source_default.dim("   │ ") + "ports:\n");
+				for (let i = 0; i < ports.length; i++) {
+					const port = ports[i];
+					const route = routes?.find((route$1) => route$1.port === port);
+					const prefix$1 = i === ports.length - 1 ? source_default.dim("   ╰ ") : source_default.dim("   │ ");
+					const url = route ? " -> " + source_default.cyan(route.url) : "";
+					process.stderr.write(prefix$1 + "• " + port + url + "\n");
+				}
+			}
+		} catch (error) {
+			spinner.stop();
+			throw error;
+		}
+	}
+});
 const listCommand = import_cjs$1.command({
 	name: "list",
 	description: "Display the current configuration of a sandbox",
@@ -14935,6 +15613,7 @@ const listCommand = import_cjs$1.command({
 			}
 		})();
 		const networkPolicy$1 = typeof sandbox.networkPolicy === "string" ? sandbox.networkPolicy : "restricted";
+		const tagsDisplay = sandbox.tags && Object.keys(sandbox.tags).length > 0 ? Object.entries(sandbox.tags).map(([k, v]) => `${k}=${v}`).join(", ") : "-";
 		const rows = [
 			{
 				field: "vCPUs",
@@ -14951,6 +15630,26 @@ const listCommand = import_cjs$1.command({
 			{
 				field: "Network policy",
 				value: String(networkPolicy$1)
+			},
+			{
+				field: "Ports",
+				value: formatPorts(sandbox)
+			},
+			{
+				field: "Snapshot expiration",
+				value: sandbox.snapshotExpiration != null && sandbox.snapshotExpiration > 0 ? (0, import_ms.default)(sandbox.snapshotExpiration, { long: true }) : sandbox.snapshotExpiration === 0 ? "none" : "-"
+			},
+			{
+				field: "Keep last snapshots",
+				value: formatKeepLastSnapshots(sandbox.keepLastSnapshots)
+			},
+			{
+				field: "Current snapshot",
+				value: sandbox.currentSnapshotId ?? "-"
+			},
+			{
+				field: "Tags",
+				value: tagsDisplay
 			}
 		];
 		console.log(table({
@@ -15006,6 +15705,63 @@ const networkPolicyCommand = import_cjs$1.command({
 		}
 	}
 });
+const tagsCommand = import_cjs$1.command({
+	name: "tags",
+	description: "Update the tags of a sandbox. Replaces all existing tags with the provided tags.",
+	args: {
+		sandbox: import_cjs$1.positional({
+			type: sandboxName,
+			description: "Sandbox name to update"
+		}),
+		tags: import_cjs$1.multioption({
+			long: "tag",
+			short: "t",
+			type: ObjectFromKeyValue,
+			description: "Key-value tags to set (e.g. --tag env=staging). Omit to clear all tags."
+		}),
+		scope
+	},
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandbox: name, tags }) {
+		const sandbox = await sandboxClient.get({
+			name,
+			projectId: project$1,
+			teamId: team$1,
+			token: token$1
+		});
+		const tagsObj = Object.keys(tags).length > 0 ? tags : {};
+		const spinner = ora("Updating sandbox tags...").start();
+		try {
+			await sandbox.update({ tags: tagsObj });
+			spinner.stop();
+			process.stderr.write("✅ Tags updated for sandbox " + source_default.cyan(name) + "\n");
+			const entries$1 = Object.entries(tagsObj);
+			if (entries$1.length === 0) process.stderr.write(source_default.dim("   ╰ ") + "all tags cleared\n");
+			else for (let i = 0; i < entries$1.length; i++) {
+				const [k, v] = entries$1[i];
+				const prefix$1 = i === entries$1.length - 1 ? source_default.dim("   ╰ ") : source_default.dim("   │ ");
+				process.stderr.write(prefix$1 + source_default.cyan(k) + "=" + source_default.cyan(v) + "\n");
+			}
+		} catch (error) {
+			spinner.stop();
+			throw error;
+		}
+	}
+});
+function formatKeepLastSnapshots(keepLastSnapshots$1) {
+	if (!keepLastSnapshots$1) return "-";
+	const parts = [`count=${keepLastSnapshots$1.count}`];
+	if (keepLastSnapshots$1.expiration !== void 0) parts.push(`for=${keepLastSnapshots$1.expiration === 0 ? "none" : (0, import_ms.default)(keepLastSnapshots$1.expiration, { long: true })}`);
+	if (keepLastSnapshots$1.deleteEvicted !== void 0) parts.push(`delete-evicted-snapshots=${keepLastSnapshots$1.deleteEvicted}`);
+	return parts.join(", ");
+}
+function formatPorts(sandbox) {
+	const ports = getPublishedRoutes(sandbox)?.map((route) => route.port) ?? [];
+	if (ports.length === 0) return "-";
+	return ports.join(", ");
+}
+function getPublishedRoutes(sandbox) {
+	return sandbox.routes.filter((route) => route.port !== sandbox.interactivePort);
+}
 const config = import_cjs$1.subcommands({
 	name: "config",
 	description: "View and update sandbox configuration",
@@ -15014,7 +15770,14 @@ const config = import_cjs$1.subcommands({
 		vcpus: vcpusCommand,
 		timeout: timeoutCommand,
 		persistent: persistentCommand,
-		"network-policy": networkPolicyCommand
+		"network-policy": networkPolicyCommand,
+		"snapshot-expiration": snapshotExpirationCommand,
+		"keep-last-snapshots": keepLastSnapshotsCommand,
+		"keep-last-snapshots-for": keepLastSnapshotsForCommand,
+		"delete-evicted-snapshots": deleteEvictedSnapshotsCommand,
+		"current-snapshot": currentSnapshotCommand,
+		ports: portsCommand,
+		tags: tagsCommand
 	}
 });
 
@@ -15028,6 +15791,7 @@ const app = (opts) => (0, import_cjs.subcommands)({
 	cmds: {
 		list,
 		create,
+		fork,
 		config,
 		copy: cp,
 		exec,
@@ -15061,4 +15825,4 @@ const app = (opts) => (0, import_cjs.subcommands)({
 
 //#endregion
 export { source_exports as a, init_source as i, StyledError as n, require_cjs as r, app as t };
-//# sourceMappingURL=app-K77UztMr.mjs.map
+//# sourceMappingURL=app-BaHpC2zy.mjs.map