thinkncollab-shell 2.0.0-beta.2 → 2.0.0-beta.3

package/Readme.md

@@ -43,17 +43,17 @@ Every command has its own help, for example `thinknsh run --help`. The full list
 | Area | Commands |
 | :--- | :--- |
 | Containers | `run`, `create`, `start`, `stop`, `restart`, `kill`, `rm`, `ps`, `logs`, `exec`, `wait`, `inspect` |
-| Images | `images`, `pull`, `push`, `build`, `tag`, `rmi`, `image prune` |
+| Images | `images`, `pull`, `push`, `build` (`--platform a,b --push`), `tag`, `rmi`, `image prune`, `search`, `manifest create / inspect / push / rm` |
 | Registries | `login [-u USER] [--password-stdin] [REGISTRY]`, `logout [REGISTRY]` |
 | Agent workspaces | `workspace up / open / apps / ls / shell / exec / ssh-config / stop / rm` |
 | Dev services | `service start postgres\|redis\|mysql [-p PORT]`, `service stop / restart / status / logs / rm [-v]` |
 | Local registry | `registry start [PORT] / stop / status / push IMAGE / pull IMAGE` |
-| Apps | `compose up / down / ps / logs / exec / build / pull / start / stop / restart / rm / config` |
+| Apps | `compose up / down / ps / logs / exec / run / create / build / pull / push / start / stop / restart / kill / pause / unpause / rm / top / port / images / cp / scale / wait / events / ls / watch / config` |
 | Storage and networks | `volume ls / create / rm / inspect / prune`, `network ls / create / rm / connect / disconnect / prune` |
 | Files and state | `cp`, `diff`, `export`, `commit`, `save`, `load`, `import`, `history`, `stats`, `top`, `pause` / `unpause`, `rename`, `update`, `port` |
-| Engine | `system info / df / prune`, `dock setup / start / stop / status / selftest / check / config`, `dock autostart [--off]` (macOS: start at login) |
+| Engine | `system info / df / prune`, `events`, `dock setup / start / stop / status / selftest / check / config / autostart / diagnose / reset` |
 | Other tools and engines | `dock use [--system] [--off]` (engine CLI, compose, buildx, VS Code Dev Containers, testcontainers, the standard socket path), `dock env`, `dock migrate` |
-| Dashboard | `dock ui` — containers, logs, live stats, images, volumes, networks in the browser; `dock app` — TNC Dock in the macOS menu bar |
+| Desktop | `dock app install` (menu-bar app on macOS, tray icon on Windows), `dock ui` — dashboard in the browser: containers by compose app, logs with a filter, live stats, a terminal, images, volumes, networks, settings, troubleshooting |
 | CI on this machine | `ci run [WORKFLOW] [--job ID]`, `ci list` — `.tnc/workflows` jobs, matrix legs for amd64 and arm64, services, JavaScript / composite / container actions, artifacts, each in a fresh container |
 
 ### One container for all your coding agents: `thinknsh workspace`
@@ -107,21 +107,44 @@ New here? Read the step-by-step guide: [`docs/HOW-TO-USE.md`](docs/HOW-TO-USE.md
 | :--- | :--- |
 | Run, attach, interactive terminals, exec, logs, exit codes, signals | ✅ |
 | Pull from public and private OCI registries (token and basic auth) | ✅ |
-| Build: Containerfile, multi-stage, build args, targets, layer cache, `.tncignore`, `RUN --mount` (cache, secret, bind, tmpfs), heredocs | ✅ |
+| Build: Containerfile, multi-stage, build args, targets, layer cache, `.tncignore`, `RUN --mount` (cache, secret, bind, tmpfs, ssh), heredocs | ✅ |
+| Build: independent stages at the same time; `--cache-from` / `--cache-to` (registry, local folder, inline) to share the cache with CI and other machines | ✅ |
+| Build: `--ssh default` (your SSH agent for `RUN --mount=type=ssh`, e.g. `git clone` of private repos; keys never leave the agent) | ✅ needs runtime bundle 0.2.3+ |
+| Pushes and pulls that survive a dropped connection (chunked uploads, resumed downloads) | ✅ |
+| Image signatures: `trust key generate`, `trust sign`, `trust verify` (the format cosign reads); only signed pulls with `dock config --trust-key`; keyless with `--keyless` | ✅ keyless needs cosign installed |
+| Vulnerability scan and SBOM: `image scan` (apk, deb, rpm, npm, Python packages against OSV; `--exit-code` for CI; CycloneDX / SPDX) | ✅ OS advisories for Alpine, Debian, Ubuntu, AlmaLinux, Rocky, openSUSE; Fedora and Amazon Linux: packages listed only |
+| userns-remap: the root of containers (and of build steps) is an unprivileged id range on the host (`dock config --userns-remap default`) | ✅ Linux as root; needs runtime bundle 0.2.3+ |
+| Overlay networks across machines (`network create -d overlay`, VXLAN), names of every machine's containers | ✅ Linux as root; the tunnel is not encrypted |
 | BuildKit: buildx and BuildKit-mode builds through the engine CLI (`--secret`, cache mounts, and SSH-agent forwarding in BuildKit mode) | ✅ |
+| buildx multi-platform: `buildx build --platform linux/amd64,linux/arm64 --push` (one OCI index, pushed with dock's logins), `--load` | ✅ |
 | Compose: build, depends_on with `service_healthy`, healthchecks, profiles, `.env`, `extends`, `secrets`, `configs`, recreate on change | ✅ |
+| Compose `run`, `watch` (sync, sync+restart, rebuild), `scale`, `cp`, `top`, `port`, `ls`, `events` and the other verbs | ✅ |
+| Multi-platform images: `build --platform linux/amd64,linux/arm64 --push`, `manifest`; image `search` | ✅ |
 | Networks with name resolution, named volumes, bind mounts, published TCP and UDP ports, `host.tnc.internal` | ✅ |
+| IPv6 dual-stack networks (`network create --ipv6 [--subnet …/64]`, compose `enable_ipv6`): addresses, routes, AAAA, outbound NAT | ✅ |
+| macvlan / ipvlan networks (containers with their own address on the LAN) | ✅ Linux as root; ❌ not possible inside the macOS VM, WSL or rootless (they sit behind NAT) |
+| Embedded DNS on user networks (`127.0.0.11`: every replica of a scaled service in turn, PTR, TCP, forwarding; needs runtime bundle 0.2.3+) | ✅ |
+| systemd as PID 1 and kind/k3d nodes (`--privileged`: writable cgroups, host devices, `SIGRTMIN+3` stop signal) | ✅ |
+| cgroup v1 Linux hosts (for example RHEL/CentOS 8): limits, `stats`, `top` | ✅ (CI covers v2 only) |
 | `linux/amd64` images on Apple Silicon (Rosetta 2; P8 compatibility check is optional) | ✅ |
 | Copy files in and out (`cp`), commit, save/load, export/import, stats, top | ✅ |
 | Unmodified tools: engine CLI, compose, VS Code Dev Containers (incl. Features), testcontainers | ✅ checked by `tests/ecosystem` |
 | Move images and volumes over from another engine (`dock migrate`) | ✅ |
-| Dashboard in the browser (`dock ui`) | ✅ |
+| Dashboard in the browser (`dock ui`), with settings, troubleshooting and a terminal | ✅ |
 | Local CI (`ci run`, and TNC CI/CD runs from the dashboard): jobs, `needs`, matrix, both CPUs on one machine, `services` on localhost, `GITHUB_ENV`/`GITHUB_OUTPUT` | ✅ (macOS/Windows jobs and third-party actions are skipped) |
 | `--network container:<name>` and compose `network_mode: service:<name>` | ✅ |
-| GPUs | ❌ not yet (not possible on macOS) |
+| Menu-bar app (macOS) / tray icon (Windows), start at login (`dock autostart`) | ✅ |
+| Installers with their own Node.js: `.pkg`/`.dmg`, Windows setup, Linux tarball + systemd | ✅ built in CI (`dock-bundle.yml`); signing when the certificates are set |
+| Corporate proxy and CA certificates, registry mirrors, insecure registries (`dock config`) | ✅ |
+| Registry passwords in the system keychain (macOS Keychain, Windows Credential Manager, Secret Service) | ✅ |
+| Diagnostics bundle, factory reset (`dock diagnose`, `dock reset`) | ✅ |
+| GPUs (`--gpus`, compose `deploy.resources.reservations.devices`, CDI names like `nvidia.com/gpu=all`) | ✅ Linux and WSL2 through CDI (NVIDIA Container Toolkit); ❌ not possible on macOS |
+| Registry logins from credential helpers (ECR, GCR, OS keychains: `credHelpers` / `credsStore` of the engine CLI config, or `dock config --credential-helper`) | ✅ |
+| zstd-compressed image layers | ✅ |
+| Prometheus metrics (`GET /metrics` on the engine socket) | ✅ |
 | Push to a registry (skips existing layers, cross-repo mount), registry login/logout | ✅ |
 | Agent workspaces over SSH (key-only, loopback, no capabilities) | ✅ |
-| Rootless mode | ❌ not yet |
+| Rootless mode on Linux (a normal user, no sudo: user namespaces, pasta / slirp4netns; limits and pause through the cgroup systemd delegates to the user) | ✅ |
 | Deploy compose apps to your own servers | ✅ `thinknsh cluster deploy` |
 
 ### Platforms
@@ -147,6 +170,13 @@ Measured on an Apple Silicon Mac with `thinknsh bench`. Run the same command on
 
 Downloads and the full guide are at **https://thinkncollab.com/dock**.
 
+**Installers** (no Node.js needed; they bring Node 24): `Thinknsh-<version>.dmg` for macOS,
+`Thinknsh-<version>-<arch>-setup.exe` for Windows, `thinknsh-<version>-linux-<arch>.tar.gz`
+for Linux (`sudo ./thinknsh/install.sh`). They set up the runtime, start dock at login and
+install the menu-bar / tray app. Built by `native/installer/` (see `.github/workflows/dock-bundle.yml`).
+
+**With npm:**
+
 1. **Node.js 22.5 or newer.** dock stores its state with `node:sqlite`.
 2. **Windows only:** turn on WSL2 in an administrator PowerShell, then reboot. If WSL is already installed, run `wsl --update` instead.
    ```powershell
@@ -157,13 +187,14 @@ Downloads and the full guide are at **https://thinkncollab.com/dock**.
    npm install -g https://thinkncollab.com/downloads/dock/0.2.0/thinkncollab-shell.tgz
    thinknsh dock setup
    ```
-   On Linux, dock runs containers natively as root: run `sudo thinknsh dock setup` and `sudo thinknsh dock start`, then `sudo groupadd tnc-dock && sudo usermod -aG tnc-dock $USER` and restart dock to use the commands without sudo.
+   On Linux, as a normal user, dock runs **rootless** (no sudo): it needs `uidmap` and `passt`, and subordinate ids (`sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USER`); `thinknsh dock setup` lists anything missing. To run it as a system service instead, run `sudo thinknsh dock setup` and `sudo thinknsh dock start` (or `sudo thinknsh dock autostart on` for a systemd service), then `sudo groupadd tnc-dock && sudo usermod -aG tnc-dock $USER` and restart dock to use the commands without sudo. The engine listens on `/run/thinknsh/dock.sock` for every user; settings are system-wide in `/etc/thinknsh/config.json` (change them with `sudo thinknsh dock config …`).
    On a machine without internet, download the files for your platform and `manifest.json` from the downloads page into one folder, then run `thinknsh dock setup --from <folder>`.
 4. **Run something:**
    ```bash
    thinknsh run --rm -p 8080:80 nginx:alpine
    ```
    Then open http://localhost:8080.
+5. **Optional:** `thinknsh dock autostart on` (start at login) and `thinknsh dock app install` (menu-bar / tray app).
 
 ### Check it works on your machine
 
@@ -318,4 +349,4 @@ thinknsh dep sync                  # Reconcile environment from thinkncollab.yml
 ## 📄 License
 
 Apache License 2.0. See [LICENSE](LICENSE) for details.  
-Copyright (c) 2024-2026 ThinkNCollab Systems Inc. All rights reserved.
+Copyright (c) 2024-2026 ThinkNCollab Systems Inc. All rights reserved.

package/dist/native/tnc-tray/build-macos.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+#
+# native/tnc-tray/build-macos.sh — builds Thinknsh.app, the menu-bar app (Intel + Apple Silicon).
+#
+#   build-macos.sh <outdir>         <outdir>/Thinknsh.app
+#
+# Signing: TNC_SIGN_IDENTITY="Developer ID Application: …" signs with the
+# hardened runtime (needed for notarization); without it the app is signed ad hoc.
+#
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+OUT="${1:?usage: build-macos.sh <outdir>}"
+VERSION="${TNC_APP_VERSION:-$(node -p "require('$HERE/../../package.json').version" 2>/dev/null || echo 0.0.0)}"
+mkdir -p "$OUT"
+OUT="$(cd "$OUT" && pwd)"
+APP="$OUT/Thinknsh.app"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+rm -rf "$APP"
+mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
+
+for arch in arm64 x86_64; do
+  xcrun swiftc -O -target "$arch-apple-macos13" -o "$WORK/tray-$arch" "$HERE/main.swift"
+done
+lipo -create -output "$APP/Contents/MacOS/thinknsh-tray" "$WORK/tray-arm64" "$WORK/tray-x86_64"
+
+cat > "$APP/Contents/Info.plist" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key><string>Thinknsh</string>
+  <key>CFBundleDisplayName</key><string>Thinknsh</string>
+  <key>CFBundleIdentifier</key><string>com.thinkncollab.thinknsh</string>
+  <key>CFBundleExecutable</key><string>thinknsh-tray</string>
+  <key>CFBundlePackageType</key><string>APPL</string>
+  <key>CFBundleShortVersionString</key><string>${VERSION}</string>
+  <key>CFBundleVersion</key><string>${VERSION}</string>
+  <key>LSMinimumSystemVersion</key><string>13.0</string>
+  <key>LSUIElement</key><true/>
+  <key>NSHighResolutionCapable</key><true/>
+  <key>NSAppleEventsUsageDescription</key><string>Opens Terminal windows for container logs and shells.</string>
+</dict>
+</plist>
+PLIST
+
+if [[ -n "${TNC_SIGN_IDENTITY:-}" ]]; then
+  codesign --force --options runtime --timestamp --sign "$TNC_SIGN_IDENTITY" "$APP"
+else
+  codesign --force --sign - "$APP"
+fi
+echo "✓ $APP"

package/dist/native/tnc-tray/main.swift

@@ -0,0 +1,201 @@
+// native/tnc-tray/main.swift — the thinknsh menu-bar app (macOS 13+).
+//
+// A thin shell: it runs `thinknsh dock tray` (src/dock/tray/agent.js) and draws
+// the menu that process sends, one JSON object per line on its stdout. Clicks
+// go back as {"click": ID} on its stdin, after a confirm dialog when the item
+// asks for one. All engine logic lives in the agent.
+//
+// The agent command comes from the bundle: Resources/node/bin/node and
+// Resources/cli/bin/thinknsh.js (installer builds), or Resources/agent.json
+// {"node": …, "cli": …} written by `thinknsh dock app install`.
+
+import Cocoa
+
+final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
+    private var statusItem: NSStatusItem!
+    private var agent: Process?
+    private var agentInput: FileHandle?
+    private var buffer = Data()
+    private var restarts = 0
+    private var quitting = false
+
+    func applicationDidFinishLaunching(_ notification: Notification) {
+        statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
+        setIcon("stopped")
+        let menu = NSMenu()
+        menu.autoenablesItems = false
+        menu.delegate = self
+        statusItem.menu = menu
+        showMessage("Starting…")
+        startAgent()
+    }
+
+    func applicationWillTerminate(_ notification: Notification) {
+        quitting = true
+        agent?.terminate()
+    }
+
+    // MARK: agent process
+
+    private func agentCommand() -> (String, [String])? {
+        guard let res = Bundle.main.resourceURL else { return nil }
+        let fm = FileManager.default
+        let node = res.appendingPathComponent("node/bin/node").path
+        let cli = res.appendingPathComponent("cli/bin/thinknsh.js").path
+        if fm.isExecutableFile(atPath: node) && fm.fileExists(atPath: cli) { return (node, [cli, "dock", "tray"]) }
+        if let data = try? Data(contentsOf: res.appendingPathComponent("agent.json")),
+           let json = try? JSONSerialization.jsonObject(with: data) as? [String: String],
+           let n = json["node"], let c = json["cli"] {
+            return (n, [c, "dock", "tray"])
+        }
+        return nil
+    }
+
+    private func startAgent() {
+        guard let (exe, args) = agentCommand() else {
+            showMessage("thinknsh not found: run thinknsh dock app install")
+            return
+        }
+        let p = Process()
+        p.executableURL = URL(fileURLWithPath: exe)
+        p.arguments = args
+        var env = ProcessInfo.processInfo.environment
+        env["PATH"] = "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin:" + (env["PATH"] ?? "")
+        env["FORCE_COLOR"] = "0"
+        p.environment = env
+        let out = Pipe(), inp = Pipe()
+        p.standardOutput = out
+        p.standardInput = inp
+        p.standardError = FileHandle.nullDevice
+        out.fileHandleForReading.readabilityHandler = { [weak self] h in
+            let d = h.availableData
+            DispatchQueue.main.async { self?.received(d) }
+        }
+        p.terminationHandler = { [weak self] _ in
+            DispatchQueue.main.async { self?.agentEnded() }
+        }
+        do {
+            try p.run()
+            agent = p
+            agentInput = inp.fileHandleForWriting
+        } catch {
+            showMessage("Cannot start thinknsh: \(error.localizedDescription)")
+        }
+    }
+
+    private func agentEnded() {
+        agent = nil
+        agentInput = nil
+        if quitting { NSApp.terminate(nil); return }
+        restarts += 1
+        if restarts > 5 { showMessage("thinknsh tray stopped; reopen the app"); return }
+        DispatchQueue.main.asyncAfter(deadline: .now() + 2) { [weak self] in self?.startAgent() }
+    }
+
+    private func received(_ data: Data) {
+        if data.isEmpty { return }
+        buffer.append(data)
+        while let nl = buffer.firstIndex(of: 0x0a) {
+            let line = buffer.subdata(in: buffer.startIndex..<nl)
+            buffer.removeSubrange(buffer.startIndex...nl)
+            handle(line)
+        }
+    }
+
+    private func handle(_ line: Data) {
+        guard let msg = (try? JSONSerialization.jsonObject(with: line)) as? [String: Any] else { return }
+        if let menu = msg["menu"] as? [String: Any] { render(menu) }
+        if let text = msg["notify"] as? String { notify(text) }
+        if msg["exit"] as? Bool == true {
+            quitting = true
+            NSApp.terminate(nil)
+        }
+    }
+
+    private func send(_ obj: [String: Any]) {
+        guard let input = agentInput, let d = try? JSONSerialization.data(withJSONObject: obj) else { return }
+        var line = d
+        line.append(0x0a)
+        try? input.write(contentsOf: line)
+    }
+
+    // MARK: menu
+
+    private func setIcon(_ status: String) {
+        let name = status == "running" ? "shippingbox.fill" : "shippingbox"
+        let img = NSImage(systemSymbolName: name, accessibilityDescription: "thinknsh dock \(status)")
+        img?.isTemplate = true
+        statusItem.button?.image = img
+        statusItem.button?.appearsDisabled = status != "running"
+    }
+
+    private func showMessage(_ text: String) {
+        let menu = statusItem.menu!
+        menu.removeAllItems()
+        let item = NSMenuItem(title: text, action: nil, keyEquivalent: "")
+        item.isEnabled = false
+        menu.addItem(item)
+        menu.addItem(.separator())
+        menu.addItem(NSMenuItem(title: "Quit", action: #selector(NSApplication.terminate(_:)), keyEquivalent: "q"))
+    }
+
+    private func render(_ model: [String: Any]) {
+        setIcon(model["status"] as? String ?? "stopped")
+        let title = model["title"] as? String ?? ""
+        statusItem.button?.title = title.isEmpty ? "" : " \(title)"
+        let menu = statusItem.menu!
+        menu.removeAllItems()
+        fill(menu, model["items"] as? [[String: Any]] ?? [])
+    }
+
+    private func fill(_ menu: NSMenu, _ items: [[String: Any]]) {
+        for it in items {
+            if it["separator"] as? Bool == true { menu.addItem(.separator()); continue }
+            let item = NSMenuItem(title: it["label"] as? String ?? "", action: nil, keyEquivalent: "")
+            item.isEnabled = it["enabled"] as? Bool ?? true
+            if it["checked"] as? Bool == true { item.state = .on }
+            if let sub = it["items"] as? [[String: Any]] {
+                let submenu = NSMenu()
+                submenu.autoenablesItems = false
+                fill(submenu, sub)
+                item.submenu = submenu
+            } else {
+                item.target = self
+                item.action = #selector(clicked(_:))
+                item.representedObject = it
+            }
+            menu.addItem(item)
+        }
+    }
+
+    @objc private func clicked(_ sender: NSMenuItem) {
+        guard let it = sender.representedObject as? [String: Any], let id = it["id"] as? String else { return }
+        if let question = it["confirm"] as? String {
+            NSApp.activate(ignoringOtherApps: true)
+            let alert = NSAlert()
+            alert.messageText = question
+            alert.alertStyle = .warning
+            alert.addButton(withTitle: "Continue")
+            alert.addButton(withTitle: "Cancel")
+            if alert.runModal() != .alertFirstButtonReturn { return }
+        }
+        send(["click": id])
+    }
+
+    func menuWillOpen(_ menu: NSMenu) {
+        send(["refresh": true])
+    }
+
+    private func notify(_ text: String) {
+        let p = Process()
+        p.executableURL = URL(fileURLWithPath: "/usr/bin/osascript")
+        p.arguments = ["-e", "on run argv\ndisplay notification (item 1 of argv) with title \"thinknsh dock\"\nend run", text]
+        try? p.run()
+    }
+}
+
+let app = NSApplication.shared
+let delegate = AppDelegate()
+app.delegate = delegate
+app.setActivationPolicy(.accessory)
+app.run()

package/dist/native/tnc-tray/tray.ps1

@@ -0,0 +1,136 @@
+# native/tnc-tray/tray.ps1 — the thinknsh notification-area (tray) icon on Windows.
+#
+# Same design as the macOS app: runs `thinknsh dock tray` (src/dock/tray/agent.js)
+# and draws the menu it sends, one JSON object per line; clicks go back as
+# {"click": ID}. Installed and started by `thinknsh dock app install`.
+#
+#   powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File tray.ps1 -Node <node.exe> -Cli <thinknsh.js>
+#   powershell -File tray.ps1 -CompileOnly      compile the C# part and exit (CI)
+
+param(
+  [string]$Node,
+  [string]$Cli,
+  [switch]$CompileOnly
+)
+
+$ErrorActionPreference = 'Stop'
+
+Add-Type -ReferencedAssemblies System.Windows.Forms, System.Drawing, System.Web.Extensions -TypeDefinition @'
+using System;
+using System.Collections;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Drawing;
+using System.Reflection;
+using System.Threading;
+using System.Web.Script.Serialization;
+using System.Windows.Forms;
+
+public static class TncTray {
+  static Process agent;
+  static NotifyIcon icon;
+  static readonly ConcurrentQueue<string> lines = new ConcurrentQueue<string>();
+  static readonly JavaScriptSerializer json = new JavaScriptSerializer();
+
+  public static void Run(string node, string cli) {
+    var psi = new ProcessStartInfo(node, "\"" + cli + "\" dock tray");
+    psi.UseShellExecute = false;
+    psi.RedirectStandardInput = true;
+    psi.RedirectStandardOutput = true;
+    psi.RedirectStandardError = true;
+    psi.CreateNoWindow = true;
+    psi.StandardOutputEncoding = System.Text.Encoding.UTF8;   // menu labels are UTF-8 (●, …)
+    psi.EnvironmentVariables["FORCE_COLOR"] = "0";
+    agent = Process.Start(psi);
+    var reader = new Thread(() => {
+      string l;
+      while ((l = agent.StandardOutput.ReadLine()) != null) lines.Enqueue(l);
+      lines.Enqueue("{\"exit\":true}");
+    });
+    reader.IsBackground = true;
+    reader.Start();
+    var errors = new Thread(() => { agent.StandardError.ReadToEnd(); });
+    errors.IsBackground = true;
+    errors.Start();
+
+    icon = new NotifyIcon();
+    icon.Icon = SystemIcons.Application;
+    icon.Text = "thinknsh dock";
+    icon.Visible = true;
+    icon.ContextMenuStrip = new ContextMenuStrip();
+    icon.ContextMenuStrip.Items.Add(new ToolStripMenuItem("Starting...") { Enabled = false });
+    icon.ContextMenuStrip.Opening += (s, e) => Send("{\"refresh\":true}");
+    icon.MouseClick += (s, e) => {
+      if (e.Button != MouseButtons.Left) return;
+      var show = typeof(NotifyIcon).GetMethod("ShowContextMenu", BindingFlags.Instance | BindingFlags.NonPublic);
+      if (show != null) show.Invoke(icon, null);
+    };
+
+    var timer = new System.Windows.Forms.Timer();
+    timer.Interval = 150;
+    timer.Tick += (s, e) => Drain();
+    timer.Start();
+    Application.Run();
+    icon.Visible = false;
+    try { if (!agent.HasExited) agent.Kill(); } catch (Exception) { }
+  }
+
+  static void Send(string line) {
+    try { agent.StandardInput.WriteLine(line); agent.StandardInput.Flush(); } catch (Exception) { }
+  }
+
+  static void Drain() {
+    string l;
+    while (lines.TryDequeue(out l)) {
+      Dictionary<string, object> m;
+      try { m = json.Deserialize<Dictionary<string, object>>(l); } catch (Exception) { continue; }
+      if (m == null) continue;
+      if (m.ContainsKey("notify")) icon.ShowBalloonTip(5000, "thinknsh dock", Convert.ToString(m["notify"]), ToolTipIcon.Info);
+      if (m.ContainsKey("menu")) Render(m["menu"] as IDictionary<string, object>);
+      if (m.ContainsKey("exit")) { Application.Exit(); return; }
+    }
+  }
+
+  static void Render(IDictionary<string, object> menu) {
+    if (menu == null) return;
+    var strip = icon.ContextMenuStrip;
+    strip.Items.Clear();
+    Fill(strip.Items, menu["items"] as IEnumerable);
+    string status = Convert.ToString(menu["status"]);
+    string title = menu.ContainsKey("title") ? Convert.ToString(menu["title"]) : "";
+    string text = "thinknsh dock: " + status + (title.Length > 0 ? " (" + title + " running)" : "");
+    icon.Text = text.Length > 63 ? text.Substring(0, 63) : text;
+  }
+
+  static void Fill(ToolStripItemCollection items, IEnumerable list) {
+    if (list == null) return;
+    foreach (object o in list) {
+      var it = o as IDictionary<string, object>;
+      if (it == null) continue;
+      if (it.ContainsKey("separator")) { items.Add(new ToolStripSeparator()); continue; }
+      var mi = new ToolStripMenuItem(Convert.ToString(it["label"]));
+      if (it.ContainsKey("enabled") && !Convert.ToBoolean(it["enabled"])) mi.Enabled = false;
+      if (it.ContainsKey("checked") && Convert.ToBoolean(it["checked"])) mi.Checked = true;
+      if (it.ContainsKey("items")) {
+        Fill(mi.DropDownItems, it["items"] as IEnumerable);
+      } else {
+        string id = Convert.ToString(it["id"]);
+        string confirm = it.ContainsKey("confirm") ? Convert.ToString(it["confirm"]) : null;
+        mi.Click += (s, e) => {
+          if (confirm != null && MessageBox.Show(confirm, "thinknsh dock", MessageBoxButtons.OKCancel, MessageBoxIcon.Warning) != DialogResult.OK) return;
+          var click = new Dictionary<string, object>();
+          click["click"] = id;
+          Send(json.Serialize(click));
+        };
+      }
+      items.Add(mi);
+    }
+  }
+}
+'@
+
+if ($CompileOnly) { Write-Output 'tray compiled'; exit 0 }
+if (-not $Node -or -not $Cli) { throw 'usage: tray.ps1 -Node <node.exe> -Cli <thinknsh.js>' }
+[System.Windows.Forms.Application]::EnableVisualStyles()
+[TncTray]::Run($Node, $Cli)

package/dist/src/commands/dock/containers.js

@@ -4,4 +4,4 @@
  * PROPRIETARY INTELLECTUAL PROPERTY & TRADE SECRETS.
  * UNAUTHORIZED REVERSE ENGINEERING, DECOMPILATION, OR RE-DISTRIBUTION IS STRICTLY PROHIBITED.
  */
-"use strict";const{runCommand}=require("../../dock/cli/commands"),DESCRIPTIONS={run:"Run a container (pulls the image if needed)",create:"Create a container without starting it",start:"Start stopped containers",stop:"Stop running containers",restart:"Restart containers",kill:"Send a signal to containers",rm:"Remove containers",wait:"Wait for containers to stop and print exit codes",ps:"List containers",logs:"Show container output",exec:"Run a command in a running container",inspect:"Show details of containers, images, volumes or networks",images:"List images",pull:"Download an image",push:"Upload an image to a registry (also: sandbox push ecr://… / --export)",login:"Log in to a container registry (-u USER [REGISTRY]); with an email, to ThinkNCollab",logout:"Log out of a container registry (REGISTRY); without one, of ThinkNCollab",rmi:"Remove images",tag:"Give an image another name",build:"Build an image from a Containerfile",cp:"Copy files between a container and this machine (CONTAINER:PATH)",stats:"Live CPU, memory, network and disk use of containers",top:"Show the processes of a container",pause:"Freeze every process of containers",unpause:"Thaw paused containers",rename:"Rename a container",update:"Change memory/CPU limits or the restart policy of containers",diff:"Show files changed in a container",port:"Show the published ports of a container",commit:"Make an image from a container's changes",save:"Write images to a tar file (loads in any engine)",load:"Read images from a tar file",import:"Make an image from a root filesystem tar",compose:"Run multi-container apps from a compose file",workspace:"One secure container per project for all coding agents and editors (Claude, Codex, Antigravity, Cursor)",service:"Dev databases as containers: postgres, redis, mysql (start, stop, status, logs, rm)",registry:"A local image registry as a container (start, stop, status, push, pull)",capsule:"Older name for image commands (build, images, run, rmi)",vault:"Older name for volume commands, plus backup and restore",mesh:"Older name for network commands",stack:"Older name for compose",vm:"Older name for dock setup/start/stop/status",volume:"Manage volumes",network:"Manage networks",system:"Disk usage, cleanup and engine info",container:"Manage containers (ls, rm, prune, …)",image:"Manage images (ls, rm, prune, …)"},NAMES=Object.keys(DESCRIPTIONS),looksLikeRegistry=e=>!!e&&!e.startsWith("-")&&!e.includes("@")&&(e.includes(".")||e.includes(":")||"localhost"===e),REGISTRY_FORM={login:e=>e.some(e=>/^(-u|--username|--password-stdin)(=|$)/.test(e)||/^-u./.test(e))||1===e.length&&looksLikeRegistry(e[0])||["--help","-h"].includes(e[0]),logout:e=>1===e.length&&(looksLikeRegistry(e[0])||["--help","-h"].includes(e[0])),push:e=>!e.some(e=>/^[a-z][a-z0-9+.-]*:\/\//.test(e)||/^--export/.test(e))&&"export"!==e[0]},LEGACY={login:"../auth/login",logout:"../auth/logout",push:"../sandbox/push"},ALIASES={volume:["vol","volumes"],network:["net","networks"],images:["img"],service:["svc","services","db"],capsule:["cap"],vm:["microvm","vz"]};async function runLegacy(e,a,o,s){const t=require(LEGACY[e]);if(!t.requiresAuth||o?.api?.isAuthenticated())return t.execute(a,o,s);console.log(require("chalk").red("[FAIL] Please login first: login"))}module.exports=NAMES.map(e=>({name:e,description:DESCRIPTIONS[e],usage:`thinknsh ${e} --help`,requiresAuth:!1,selfExiting:!0,...LEGACY[e]?{aliases:require(LEGACY[e]).aliases}:ALIASES[e]?{aliases:ALIASES[e]}:{},async execute(a=[],o,s=e){if(LEGACY[e]&&(s!==e||!REGISTRY_FORM[e](a)))return runLegacy(e,a,o,s);process.exitCode=await runCommand(e,a)}})),module.exports.REGISTRY_FORM=REGISTRY_FORM,module.exports.NAMES=NAMES,module.exports.ALL_NAMES=module.exports.flatMap(e=>[e.name,...e.aliases||[]]);
+"use strict";const{runCommand}=require("../../dock/cli/commands"),DESCRIPTIONS={run:"Run a container (pulls the image if needed)",create:"Create a container without starting it",start:"Start stopped containers",stop:"Stop running containers",restart:"Restart containers",kill:"Send a signal to containers",rm:"Remove containers",wait:"Wait for containers to stop and print exit codes",ps:"List containers",logs:"Show container output",exec:"Run a command in a running container",inspect:"Show details of containers, images, volumes or networks",images:"List images",pull:"Download an image",push:"Upload an image to a registry (also: sandbox push ecr://… / --export)",login:"Log in to a container registry (-u USER [REGISTRY]); with an email, to ThinkNCollab",logout:"Log out of a container registry (REGISTRY); without one, of ThinkNCollab",rmi:"Remove images",tag:"Give an image another name",manifest:"Multi-platform images from local images (create, inspect, push, rm)",search:"Search the public image registry",events:"Stream engine events (container, image, volume, network)",build:"Build an image from a Containerfile",trust:"Sign images and check their signatures (key generate, sign, verify)",scan:"Packages and known vulnerabilities of an image (also: image scan), or its SBOM",cp:"Copy files between a container and this machine (CONTAINER:PATH)",stats:"Live CPU, memory, network and disk use of containers",top:"Show the processes of a container",pause:"Freeze every process of containers",unpause:"Thaw paused containers",rename:"Rename a container",update:"Change memory/CPU limits or the restart policy of containers",diff:"Show files changed in a container",port:"Show the published ports of a container",commit:"Make an image from a container's changes",save:"Write images to a tar file (loads in any engine)",load:"Read images from a tar file",import:"Make an image from a root filesystem tar",compose:"Run multi-container apps from a compose file",workspace:"One secure container per project for all coding agents and editors (Claude, Codex, Antigravity, Cursor)",service:"Dev databases as containers: postgres, redis, mysql (start, stop, status, logs, rm)",registry:"A local image registry as a container (start, stop, status, push, pull)",capsule:"Older name for image commands (build, images, run, rmi)",vault:"Older name for volume commands, plus backup and restore",mesh:"Older name for network commands",stack:"Older name for compose",vm:"Older name for dock setup/start/stop/status",volume:"Manage volumes",network:"Manage networks",system:"Disk usage, cleanup and engine info",container:"Manage containers (ls, rm, prune, …)",image:"Manage images (ls, rm, prune, …)"},NAMES=Object.keys(DESCRIPTIONS),looksLikeRegistry=e=>!!e&&!e.startsWith("-")&&!e.includes("@")&&(e.includes(".")||e.includes(":")||"localhost"===e),REGISTRY_FORM={login:e=>e.some(e=>/^(-u|--username|--password-stdin)(=|$)/.test(e)||/^-u./.test(e))||1===e.length&&looksLikeRegistry(e[0])||["--help","-h"].includes(e[0]),logout:e=>1===e.length&&(looksLikeRegistry(e[0])||["--help","-h"].includes(e[0])),push:e=>!e.some(e=>/^[a-z][a-z0-9+.-]*:\/\//.test(e)||/^--export/.test(e))&&"export"!==e[0]},LEGACY={login:"../auth/login",logout:"../auth/logout",push:"../sandbox/push"},ALIASES={volume:["vol","volumes"],network:["net","networks"],images:["img"],service:["svc","services","db"],capsule:["cap"],vm:["microvm","vz"]};async function runLegacy(e,a,s,t){const n=require(LEGACY[e]);if(!n.requiresAuth||s?.api?.isAuthenticated())return n.execute(a,s,t);console.log(require("chalk").red("[FAIL] Please login first: login"))}module.exports=NAMES.map(e=>({name:e,description:DESCRIPTIONS[e],usage:`thinknsh ${e} --help`,requiresAuth:!1,selfExiting:!0,...LEGACY[e]?{aliases:require(LEGACY[e]).aliases}:ALIASES[e]?{aliases:ALIASES[e]}:{},async execute(a=[],s,t=e){if(LEGACY[e]&&(t!==e||!REGISTRY_FORM[e](a)))return runLegacy(e,a,s,t);process.exitCode=await runCommand(e,a)}})),module.exports.REGISTRY_FORM=REGISTRY_FORM,module.exports.NAMES=NAMES,module.exports.ALL_NAMES=module.exports.flatMap(e=>[e.name,...e.aliases||[]]);

package/dist/src/commands/dock/dock.js

@@ -4,4 +4,4 @@
  * PROPRIETARY INTELLECTUAL PROPERTY & TRADE SECRETS.
  * UNAUTHORIZED REVERSE ENGINEERING, DECOMPILATION, OR RE-DISTRIBUTION IS STRICTLY PROHIBITED.
  */
-"use strict";const fs=require("fs"),path=require("path"),chalk=require("chalk"),{spawn}=require("child_process"),{dockPaths}=require("../../dock/paths"),{request,ping}=require("../../dock/client"),{readPid,pidAlive}=require("../../dock/daemon"),{PHASE}=require("../../dock/version"),sleep=e=>new Promise(o=>setTimeout(o,e));async function setupCmd(e){const{setup:o}=require("../../dock/setup"),s=o=>{const s=e.indexOf(o);return-1===s?void 0:e[s+1]};try{const t=await o({from:s("--from"),baseUrl:s("--url"),force:e.includes("--force"),log:e=>console.log(chalk.dim(`  ${e}`))});return console.log(chalk.green(`✓ dock runtime ${t} installed for ${process.platform}/${process.arch}`)),console.log(chalk.dim("  next: thinknsh dock start")),!0}catch(e){return console.log(chalk.red(`✗ setup failed: ${e.message}`)),!1}}async function start(e){if(await ping(e.socket))return console.log(chalk.green(`dock is already running (pid ${readPid(e.pidFile)||"?"})`)),!0;fs.mkdirSync(e.home,{recursive:!0,mode:448});const o=fs.openSync(e.logFile,"a"),s=[];try{require("node:sqlite")}catch(e){s.push("--experimental-sqlite")}const t=spawn(process.execPath,[...s,path.join(__dirname,"..","..","dock","daemon-main.js")],{detached:!0,stdio:["ignore",o,o],env:process.env});t.unref(),fs.closeSync(o);for(let o=0;o<50;o++){if(await ping(e.socket))return console.log(chalk.green(`✓ dock started (pid ${t.pid})`)),console.log(chalk.dim(`  socket: ${e.socket}`)),console.log(chalk.dim("  try: thinknsh run --rm alpine echo hello")),!0;if(null!==t.exitCode)break;await sleep(100)}console.log(chalk.red(`✗ dock failed to start. Last log lines (${e.logFile}):`));try{console.log(chalk.dim(fs.readFileSync(e.logFile,"utf8").trim().split("\n").slice(-5).join("\n")))}catch(e){}return!1}async function stop(e){const o=readPid(e.pidFile);if(!o||!pidAlive(o))return console.log(chalk.dim("dock is not running")),!0;process.kill(o,"SIGTERM");for(let e=0;e<50;e++){if(!pidAlive(o))return console.log(chalk.green(`✓ dock stopped (pid ${o})`)),!0;await sleep(100)}return console.log(chalk.red(`✗ dock (pid ${o}) did not stop within 5s`)),!1}async function status(e){if(!await ping(e.socket))return console.log(`${chalk.red("●")} dock is not running   ${chalk.dim("start it with: thinknsh dock start")}`),!1;const[o,s]=await Promise.all([request(e.socket,"GET","/version"),request(e.socket,"GET","/info")]);if(console.log(`${chalk.green("●")} dock ${o.body.Version} running (pid ${readPid(e.pidFile)||"?"})`),console.log(`  socket       ${e.socket}`),console.log(`  API version  ${o.body.ApiVersion} (min ${o.body.MinAPIVersion})`),console.log(`  phase        ${PHASE}`),console.log(`  containers   ${s.body.Containers} (${s.body.ContainersRunning} running)`),console.log(`  images       ${s.body.Images}`),"darwin"===process.platform){const e=require("../../dock/setup/autostart").installed();console.log(`  autostart    ${e?"on (starts when you log in)":chalk.dim("off (turn on: thinknsh dock autostart)")}`)}for(const e of s.body.Warnings||[])console.log(chalk.yellow(`  ${e}`));return!0}async function compat(e,o){const{runCompat:s,toMarkdown:t}=require("../../dock/compat/runner");let n=e.socket,r=null;if(!await ping(n)){const e=require("os"),{DockDaemon:o}=require("../../dock/daemon"),s=fs.mkdtempSync(path.join(e.tmpdir(),"tnc-dock-check-"));r={daemon:new o({home:s}),home:s},await r.daemon.start(),n=r.daemon.paths.socket}try{const a=await s({socketPath:n,home:r?r.home:e.home}),c={pass:chalk.green,fail:chalk.red,pending:chalk.dim,early:chalk.cyan};console.log(chalk.bold(`\ndock check — phase ${a.phase}${r?chalk.dim(" (temporary daemon)"):""}\n`));for(const e of a.results){const o=c[e.result](e.result.padEnd(8));console.log(`  ${o} ${e.phase}  ${e.id.padEnd(20)} ${chalk.dim(e.detail)}`)}const i=a.tally;console.log(`\n  ${chalk.green(`${i.pass||0} pass`)}  ${chalk.red(`${i.fail||0} fail`)}  ${i.pending||0} pending  ${i.early||0} early`);const l=o.indexOf("--md");return-1!==l&&o[l+1]&&(fs.writeFileSync(o[l+1],t(a)),console.log(chalk.dim(`  report written to ${o[l+1]}`))),a.ok}finally{r&&(await r.daemon.stop(),fs.rmSync(r.home,{recursive:!0,force:!0}))}}async function selftest(e){if(!await ping(e.socket)&&!await start(e))return!1;console.log(chalk.bold(`\ndock selftest — ${process.platform}/${process.arch}\n`));const{runSelftest:o}=require("../../dock/selftest"),{report:s,file:t}=await o({log:e=>console.log(`  ${e.startsWith("✓")?chalk.green(e):chalk.red(e)}`)}),n=s.passed===s.total?chalk.green:chalk.red;return console.log(n(`\n  ${s.passed}/${s.total} checks passed`)),console.log(chalk.dim(`  report: ${t}  (share this file)\n`)),s.passed===s.total}function parseSize(e){const o=/^(\d+(?:\.\d+)?)\s*([mg]?)b?$/i.exec(String(e||"").trim());if(!o)throw new Error(`invalid size "${e}" (examples: 4g, 6144m)`);return Math.round(parseFloat(o[1])*("m"===o[2].toLowerCase()?1:1024))}async function configCmd(e){const{readConfig:o,writeConfig:s,effective:t,configFile:n}=require("../../dock/config"),r=o();let a=!1;for(let o=0;o<e.length;o++){const s=e[o],t=()=>{if(o+1>=e.length)throw new Error(`${s} needs a value`);return e[++o]};if("--cpus"===s)r.cpus=Math.max(1,parseInt(t(),10)),a=!0;else if("--memory"===s||"-m"===s)r.memoryMB=parseSize(t()),a=!0;else if("--disk-size"===s)r.diskGB=parseInt(t(),10),a=!0;else if("--share"===s){const e=path.resolve(t().replace(/^~(?=\/|$)/,require("os").homedir()));if(!fs.existsSync(e)||!fs.statSync(e).isDirectory())throw new Error(`${e} is not a folder`);r.shares=[...new Set([...r.shares||[],e])],a=!0}else if("--unshare"===s){const e=path.resolve(t());r.shares=(r.shares||[]).filter(o=>o!==e),a=!0}else if("--publish-address"===s){const e=t();if(!require("net").isIP(e))throw new Error(`--publish-address needs an IP address (127.0.0.1, 0.0.0.0 …), not "${e}"`);r.publishAddress=e,a=!0}else{if("--reset"!==s)throw new Error(`unknown option ${s} (--cpus N, --memory 8g, --disk-size GB, --share PATH, --unshare PATH, --publish-address IP, --reset)`);for(const e of Object.keys(r))delete r[e];a=!0}}a&&s(r);const c=t(),i=(e,s)=>void 0!==o()[e]?s:`${s} ${chalk.dim("(default)")}`;console.log(`  cpus        ${i("cpus",c.cpus)}`),console.log(`  memory      ${i("memoryMB",`${c.memoryMB} MB`)}   ${chalk.dim("a ceiling: macOS backs only what containers use")}`),console.log(`  disk size   ${i("diskGB",`${c.diskGB} GB`)}   ${chalk.dim("used when the data disk is created")}`),console.log(`  shared      ${[require("os").homedir(),"/private/tmp","/private/var/folders","/Volumes",...c.shares].join(", ")}`),console.log(`  ports       ${i("publishAddress",c.publishAddress)}   ${chalk.dim("127.0.0.1"===c.publishAddress?"-p without an address: this machine only":"-p without an address: open to the network")}`),console.log(chalk.dim(`  file: ${n()}`));const l=e.filter(e=>e.startsWith("-")&&"--publish-address"!==e);return a&&l.length?console.log(chalk.yellow("  applies when the Linux VM next boots: thinknsh dock vm-restart (stops running containers)")):a&&console.log(chalk.dim("  ports: applies to containers started from now on")),!0}async function migrateCmd(e,o){const{migrate:s}=require("../../dock/setup/migrate"),t=e=>{const s=o.indexOf(e);return-1===s?void 0:o[s+1]};if(!await ping(e.socket))return console.log(chalk.red("✗ dock is not running. Start it with: thinknsh dock start")),!1;try{const n=await s({from:t("--from"),to:`unix://${e.socket}`,images:o.includes("--images"),volumes:o.includes("--volumes"),dryRun:o.includes("--dry-run"),overwrite:o.includes("--overwrite"),log:e=>console.log(chalk.dim(`  ${e}`))}),r=(e,o)=>o?`${e}: ${o.moved} copied, ${o.skipped} already here`:null;return console.log(chalk.green(`✓ ${[r("images",n.images),r("volumes",n.volumes)].filter(Boolean).join("; ")}`)),console.log(chalk.dim("  containers are not moved: recreate them here (thinknsh compose up / thinknsh run)")),!0}catch(e){return console.log(chalk.red(`✗ migrate failed: ${e.message}`)),!1}}async function uiCmd(e,o){const{startUi:s}=require("../../dock/ui/server");if(!await ping(e.socket))return console.log(chalk.red("✗ dock is not running. Start it with: thinknsh dock start")),!1;const t=await s({socketPath:e.socket,port:Number((()=>{const e=o.indexOf("--port");return-1===e?void 0:o[e+1]})())||0});if(console.log(chalk.green("✓ dock dashboard")),console.log(`  ${t.url}`),console.log(chalk.dim("  the link carries this session's token; Ctrl-C stops the dashboard")),!o.includes("--no-open")){const e="darwin"===process.platform?["open",[t.url]]:"win32"===process.platform?["cmd",["/c","start","",t.url]]:["xdg-open",[t.url]];try{spawn(e[0],e[1],{stdio:"ignore",detached:!0}).on("error",()=>{}).unref()}catch(e){}}return await new Promise(e=>{const o=()=>{t.close().then(e)};process.once("SIGINT",o),process.once("SIGTERM",o)}),!0}async function useCmd(e,o){const{use:s}=require("../../dock/setup/integrate");try{for(const t of s(e.socket,{off:o.includes("--off"),system:o.includes("--system")}))console.log(`  ${t}`);return o.includes("--off")||console.log(chalk.green("✓ tools built for other engines now use dock")+chalk.dim("   (undo: thinknsh dock use --off)")),!0}catch(e){return console.log(chalk.red(`✗ ${e.message}`)),!1}}async function vmRestart(e,o){if(await ping(e.socket)){const s=((await request(e.socket,"GET","/containers/json")).body||[]).map(e=>e.Names[0].slice(1));if(s.length&&!o.includes("--force"))return console.log(chalk.yellow(`  running containers would stop: ${s.join(", ")}`)),console.log(chalk.dim("  stop them first, or pass --force")),!1}if(await stop(e),"darwin"===process.platform){const{spawnSync:e}=require("child_process");e(path.join(require("os").homedir(),".tnc","bin","tnc-vz"),["stop"],{stdio:"ignore"})}else if("win32"===process.platform){const{spawnSync:e}=require("child_process");e("wsl.exe",["--terminate",require("../../dock/setup").WSL_DISTRO],{stdio:"ignore"})}const s=await start(e);return s&&console.log(chalk.dim("  the Linux VM boots with the new settings on the next command that needs it")),s}function appCmd(e,o){try{const s=require("../../dock/setup/app").app({off:o.includes("--off"),home:e.home,socket:e.socket,cli:process.argv[1],version:require("../../dock/setup").BUNDLE_VERSION,log:e=>console.log(chalk.dim(`  ${e}`))});for(const e of s)console.log(`  ${e}`);return!0}catch(e){return console.log(chalk.red(`✗ ${e.message}`)),!1}}function autostartCmd(e,o){try{const s=require("../../dock/setup/autostart").autostart({off:o.includes("--off"),cli:process.argv[1],logFile:e.logFile});for(const e of s)console.log(`  ${e}`);return!0}catch(e){return console.log(chalk.red(`✗ ${e.message}`)),!1}}async function foreground(){require("../../dock/daemon-main"),await new Promise(()=>{})}module.exports={name:"dock",description:"dock: ThinkNCollab container engine daemon (TNC Engine API)",usage:"thinknsh dock <setup|start|stop|status|check|selftest|config|use|env|autostart|app|vm-restart|migrate|ui|daemon>",requiresAuth:!1,examples:["thinknsh dock setup","thinknsh dock start","thinknsh dock selftest","thinknsh dock check --md check.md","thinknsh dock config --memory 8g --cpus 6","thinknsh dock use","thinknsh dock autostart","thinknsh dock app"],async execute(e=[]){const o=(e[0]||"status").toLowerCase(),s=dockPaths();let t=!0;switch(o){case"setup":t=await setupCmd(e.slice(1));break;case"start":t=await start(s);break;case"stop":t=await stop(s);break;case"status":t=await status(s);break;case"check":t=await compat(s,e.slice(1));break;case"selftest":t=await selftest(s);break;case"daemon":await foreground();break;case"config":try{t=await configCmd(e.slice(1))}catch(e){console.log(chalk.red(`✗ ${e.message}`)),t=!1}break;case"use":t=await useCmd(s,e.slice(1));break;case"env":console.log(require("../../dock/setup/integrate").env(s.socket));break;case"vm-restart":t=await vmRestart(s,e.slice(1));break;case"migrate":t=await migrateCmd(s,e.slice(1));break;case"ui":t=await uiCmd(s,e.slice(1));break;case"autostart":t=autostartCmd(s,e.slice(1));break;case"app":t=appCmd(s,e.slice(1));break;default:console.log(chalk.yellow(`unknown subcommand "${o}". Usage: ${module.exports.usage}`)),t=!1}t||(process.exitCode=1)}};
+"use strict";const fs=require("fs"),path=require("path"),chalk=require("chalk"),{spawn}=require("child_process"),{dockPaths}=require("../../dock/paths"),{request,ping}=require("../../dock/client"),{readPid,pidAlive}=require("../../dock/daemon"),{PHASE}=require("../../dock/version"),sleep=e=>new Promise(o=>setTimeout(o,e));async function setupCmd(e){const{setup:o}=require("../../dock/setup"),s=o=>{const s=e.indexOf(o);return-1===s?void 0:e[s+1]};try{const t=await o({from:s("--from"),baseUrl:s("--url"),force:e.includes("--force"),log:e=>console.log(chalk.dim(`  ${e}`))});return console.log(chalk.green(`✓ dock runtime ${t} installed for ${process.platform}/${process.arch}`)),console.log(chalk.dim("  next: thinknsh dock start")),!0}catch(e){return console.log(chalk.red(`✗ setup failed: ${e.message}`)),!1}}async function start(e){if(await ping(e.socket))return console.log(chalk.green(`dock is already running (pid ${readPid(e.pidFile)||"?"})`)),!0;fs.mkdirSync(e.home,{recursive:!0,mode:448});let o={pid:null,exitCode:null};if(!require("../../dock/setup/autostart").kickstart()){const s=fs.openSync(e.logFile,"a"),t=[];try{require("node:sqlite")}catch(e){t.push("--experimental-sqlite")}o=spawn(process.execPath,[...t,path.join(__dirname,"..","..","dock","daemon-main.js")],{detached:!0,stdio:["ignore",s,s],env:process.env,windowsHide:!0}),o.unref(),fs.closeSync(s)}for(let s=0;s<50;s++){if(await ping(e.socket))return console.log(chalk.green(`✓ dock started (pid ${readPid(e.pidFile)||o.pid})`)),console.log(chalk.dim(`  socket: ${e.socket}`)),console.log(chalk.dim("  try: thinknsh run --rm alpine echo hello")),!0;if(null!==o.exitCode)break;await sleep(100)}console.log(chalk.red(`✗ dock failed to start. Last log lines (${e.logFile}):`));try{console.log(chalk.dim(fs.readFileSync(e.logFile,"utf8").trim().split("\n").slice(-5).join("\n")))}catch(e){}return!1}async function stop(e){const o=readPid(e.pidFile);if(!o||!pidAlive(o))return console.log(chalk.dim("dock is not running")),!0;process.kill(o,"SIGTERM");for(let e=0;e<50;e++){if(!pidAlive(o))return console.log(chalk.green(`✓ dock stopped (pid ${o})`)),!0;await sleep(100)}return console.log(chalk.red(`✗ dock (pid ${o}) did not stop within 5s`)),!1}async function status(e){if(!await ping(e.socket))return console.log(`${chalk.red("●")} dock is not running   ${chalk.dim("start it with: thinknsh dock start")}`),!1;const[o,s]=await Promise.all([request(e.socket,"GET","/version"),request(e.socket,"GET","/info")]);console.log(`${chalk.green("●")} dock ${o.body.Version} running (pid ${readPid(e.pidFile)||"?"})`),console.log(`  socket       ${e.socket}`),console.log(`  API version  ${o.body.ApiVersion} (min ${o.body.MinAPIVersion})`),console.log(`  phase        ${PHASE}`),s.body.SecurityOptions?.includes("name=rootless")&&console.log("  mode         rootless (no root)"),console.log(`  containers   ${s.body.Containers} (${s.body.ContainersRunning} running)`),console.log(`  images       ${s.body.Images}`);const t=require("../../dock/setup/autostart").status().enabled;console.log(`  autostart    ${t?"on (starts when you log in)":chalk.dim("off (turn on: thinknsh dock autostart)")}`);for(const e of s.body.Warnings||[])console.log(chalk.yellow(`  ${e}`));return!0}async function compat(e,o){const{runCompat:s,toMarkdown:t}=require("../../dock/compat/runner");let r=e.socket,n=null;if(!await ping(r)){const e=require("os"),{DockDaemon:o}=require("../../dock/daemon"),s=fs.mkdtempSync(path.join(e.tmpdir(),"tnc-dock-check-"));n={daemon:new o({home:s}),home:s},await n.daemon.start(),r=n.daemon.paths.socket}try{const i=await s({socketPath:r,home:n?n.home:e.home}),a={pass:chalk.green,fail:chalk.red,pending:chalk.dim,early:chalk.cyan};console.log(chalk.bold(`\ndock check — phase ${i.phase}${n?chalk.dim(" (temporary daemon)"):""}\n`));for(const e of i.results){const o=a[e.result](e.result.padEnd(8));console.log(`  ${o} ${e.phase}  ${e.id.padEnd(20)} ${chalk.dim(e.detail)}`)}const c=i.tally;console.log(`\n  ${chalk.green(`${c.pass||0} pass`)}  ${chalk.red(`${c.fail||0} fail`)}  ${c.pending||0} pending  ${c.early||0} early`);const l=o.indexOf("--md");return-1!==l&&o[l+1]&&(fs.writeFileSync(o[l+1],t(i)),console.log(chalk.dim(`  report written to ${o[l+1]}`))),i.ok}finally{n&&(await n.daemon.stop(),fs.rmSync(n.home,{recursive:!0,force:!0}))}}async function selftest(e){if(!await ping(e.socket)&&!await start(e))return!1;console.log(chalk.bold(`\ndock selftest — ${process.platform}/${process.arch}\n`));const{runSelftest:o}=require("../../dock/selftest"),{report:s,file:t}=await o({log:e=>console.log(`  ${e.startsWith("✓")?chalk.green(e):chalk.red(e)}`)}),r=s.passed===s.total?chalk.green:chalk.red;return console.log(r(`\n  ${s.passed}/${s.total} checks passed`)),console.log(chalk.dim(`  report: ${t}  (share this file)\n`)),s.passed===s.total}function parseSize(e){const o=/^(\d+(?:\.\d+)?)\s*([mg]?)b?$/i.exec(String(e||"").trim());if(!o)throw new Error(`invalid size "${e}" (examples: 4g, 6144m)`);return Math.round(parseFloat(o[1])*("m"===o[2].toLowerCase()?1:1024))}async function configCmd(e){const{readConfig:o,writeConfig:s,effective:t,configFile:r}=require("../../dock/config"),n=o();let i=!1;for(let o=0;o<e.length;o++){const s=e[o],t=()=>{if(o+1>=e.length)throw new Error(`${s} needs a value`);return e[++o]};if("--cpus"===s)n.cpus=Math.max(1,parseInt(t(),10)),i=!0;else if("--memory"===s||"-m"===s)n.memoryMB=parseSize(t()),i=!0;else if("--disk-size"===s)n.diskGB=parseInt(t(),10),i=!0;else if("--share"===s){const e=path.resolve(t().replace(/^~(?=\/|$)/,require("os").homedir()));if(!fs.existsSync(e)||!fs.statSync(e).isDirectory())throw new Error(`${e} is not a folder`);n.shares=[...new Set([...n.shares||[],e])],i=!0}else if("--unshare"===s){const e=path.resolve(t());n.shares=(n.shares||[]).filter(o=>o!==e),i=!0}else if("--http-proxy"===s||"--https-proxy"===s||"--no-proxy"===s){const e={"--http-proxy":"http","--https-proxy":"https","--no-proxy":"noProxy"}[s],o=t();if(n.proxy={...n.proxy||{}},o){if("noProxy"!==e&&!/^https?:\/\/\S+$/.test(o))throw new Error(`${s} takes a URL like http://proxy.corp:3128`);n.proxy[e]=o}else delete n.proxy[e];i=!0}else if("--proxy-containers"===s){const e=t();if(!["on","off"].includes(e))throw new Error("--proxy-containers takes on or off");n.proxy={...n.proxy||{},containers:"on"===e},i=!0}else if("--ca-cert"===s){const e=path.resolve(t().replace(/^~(?=\/|$)/,require("os").homedir()));if(!fs.existsSync(e)||!/-----BEGIN CERTIFICATE-----/.test(fs.readFileSync(e,"utf8")))throw new Error(`${e} is not a PEM certificate file`);n.caCerts=[...new Set([...n.caCerts||[],e])],i=!0}else if("--no-ca-cert"===s){const e=path.resolve(t());n.caCerts=(n.caCerts||[]).filter(o=>o!==e),i=!0}else if("--mirror"===s){const e=t();if(!/^https?:\/\/[^\s/]+/.test(e))throw new Error("--mirror takes a URL like https://mirror.gcr.io");n.registryMirrors=[...new Set([...n.registryMirrors||[],e.replace(/\/+$/,"")])],i=!0}else if("--no-mirror"===s){const e=t().replace(/\/+$/,"");n.registryMirrors=(n.registryMirrors||[]).filter(o=>o!==e),i=!0}else if("--insecure-registry"===s){const e=t().toLowerCase();if(!/^[a-z0-9.-]+(:\d+)?$|^\[[0-9a-f:]+\](:\d+)?$/.test(e))throw new Error("--insecure-registry takes host or host:port");n.insecureRegistries=[...new Set([...n.insecureRegistries||[],e])],i=!0}else if("--no-insecure-registry"===s){const e=t().toLowerCase();n.insecureRegistries=(n.insecureRegistries||[]).filter(o=>o!==e),i=!0}else if("--credential-store"===s){const e=t();if(!["auto","file"].includes(e))throw new Error("--credential-store takes auto (system keychain) or file");n.credentialStore=e,i=!0}else if("--credential-helper"===s){const e=t(),o=/^([a-z0-9.-]+(?::\d+)?)=([A-Za-z0-9._-]*)$/i.exec(e);if(!o)throw new Error("--credential-helper takes HOST=HELPER, e.g. 123456789.dkr.ecr.eu-west-1.amazonaws.com=ecr-login (empty HELPER removes it)");n.credentialHelpers={...n.credentialHelpers||{}},o[2]?n.credentialHelpers[o[1].toLowerCase()]=o[2]:delete n.credentialHelpers[o[1].toLowerCase()],i=!0}else if("--publish-address"===s){const e=t();if(!require("net").isIP(e))throw new Error(`--publish-address needs an IP address (127.0.0.1, 0.0.0.0 …), not "${e}"`);n.publishAddress=e,i=!0}else if("--trust-key"===s){const e=t(),o=/^([^=]+)=(.+)$/.exec(e);if(!o)throw new Error("--trust-key takes SCOPE=PUBLIC_KEY, e.g. ghcr.io/me/*=~/keys/tnc-sign.pub");const s=path.resolve(o[2].replace(/^~(?=\/|$)/,require("os").homedir()));if(!fs.existsSync(s)||!/PUBLIC KEY/.test(fs.readFileSync(s,"utf8")))throw new Error(`${s} is not a PEM public key`);n.trustPolicy=[...(n.trustPolicy||[]).filter(e=>e.scope!==o[1]),{scope:o[1],key:s}],i=!0}else if("--no-trust-key"===s){const e=t();n.trustPolicy=(n.trustPolicy||[]).filter(o=>o.scope!==e),i=!0}else if("--userns-remap"===s){const e=t();if("off"!==e&&"default"!==e&&!/^[a-z_][a-z0-9_-]*(:[a-z_][a-z0-9_-]*)?$/i.test(e))throw new Error("--userns-remap takes default, a user name, user:group, or off");"off"===e?delete n.usernsRemap:n.usernsRemap=e,i=!0}else{if("--reset"!==s)throw new Error(`unknown option ${s} (--cpus N, --memory 8g, --disk-size GB, --share PATH, --unshare PATH, --http-proxy URL, --https-proxy URL, --no-proxy LIST, --proxy-containers on|off, --ca-cert FILE, --mirror URL, --insecure-registry HOST, --credential-store auto|file, --credential-helper HOST=NAME, --publish-address IP, --userns-remap default|USER|off, --trust-key SCOPE=KEY.pub, --no-trust-key SCOPE, --reset)`);for(const e of Object.keys(n))delete n[e];i=!0}}i&&s(n);const a=t(),c=(e,s)=>void 0!==o()[e]?s:`${s} ${chalk.dim("(default)")}`;console.log(`  cpus        ${c("cpus",a.cpus)}`),console.log(`  memory      ${c("memoryMB",`${a.memoryMB} MB`)}   ${chalk.dim("a ceiling: macOS backs only what containers use")}`),console.log(`  disk size   ${c("diskGB",`${a.diskGB} GB`)}   ${chalk.dim("used when the data disk is created")}`),console.log(`  shared      ${[require("os").homedir(),"/private/tmp","/private/var/folders","/Volumes",...a.shares].join(", ")}`),console.log(`  ports       ${c("publishAddress",a.publishAddress)}   ${chalk.dim("127.0.0.1"===a.publishAddress?"-p without an address: this machine only":"-p without an address: open to the network")}`);const l=a.proxy||{},{redact:d}=require("../../dock/setup/diagnose"),u=e=>e||chalk.dim("none");console.log(`  http proxy  ${u(l.http&&d(l.http))}`),console.log(`  https proxy ${u(l.https&&d(l.https))}${l.noProxy?`   no proxy: ${l.noProxy}`:""}${(l.http||l.https)&&!1===l.containers?chalk.dim("   (not handed to containers)"):""}`),console.log(`  CA certs    ${u(a.caCerts.join(", "))}`),console.log(`  mirrors     ${u(a.registryMirrors.join(", "))}`),console.log(`  insecure    ${u(a.insecureRegistries.join(", "))}`),"linux"===process.platform&&console.log(`  userns remap ${u(a.usernsRemap)}${a.usernsRemap?chalk.dim("   containers created from now: root is an unprivileged id range"):""}`);const h=a.trustPolicy||[];console.log(`  signed only ${u(h.map(e=>`${e.scope} (${path.basename(e.key)})`).join(", "))}`),console.log(`  logins in   ${"file"===a.credentialStore?"auth.json":require("../../dock/image/keychain").describe()}`);const p=Object.entries(a.credentialHelpers||{});if(p.length&&console.log(`  helpers     ${p.map(([e,o])=>`${e} → ${o}`).join(", ")}`),console.log(chalk.dim(`  file: ${r()}`)),i){const o=e.filter(e=>e.startsWith("-"));o.some(e=>["--cpus","--memory","-m","--disk-size","--share","--unshare","--reset"].includes(e))&&console.log(chalk.yellow("  VM settings apply when the Linux VM next boots: thinknsh dock vm-restart (stops running containers)")),o.some(e=>/proxy|ca-cert|--reset/.test(e))&&console.log(chalk.yellow("  proxy and CA settings apply when dock next starts: thinknsh dock stop && thinknsh dock start")),o.includes("--userns-remap")&&console.log(chalk.yellow("  userns-remap applies to containers created after dock next starts: thinknsh dock stop && thinknsh dock start")),o.includes("--publish-address")&&console.log(chalk.dim("  ports: applies to containers started from now on")),!l.http&&!l.https||require("../../dock/config").nodeHasEnvProxy()||console.log(chalk.red(`  node ${process.version} ignores proxy settings: install Node 22.21+ or 24.5+`))}return!0}async function autostartCmd(e){const o=require("../../dock/setup/autostart"),s=e.includes("--off")?"off":e.find(e=>!e.startsWith("-"))||"on";try{if("on"===s){for(const s of o.enable({app:!e.includes("--no-app")}))console.log(`  ${s}`);console.log(chalk.green("✓ dock starts at login")+chalk.dim("   (undo: thinknsh dock autostart off)"))}else if("off"===s){for(const e of o.disable())console.log(`  ${e}`);console.log(chalk.green("✓ dock no longer starts at login")+chalk.dim("   (it keeps running now; thinknsh dock stop stops it)"))}else{if("status"!==s)throw new Error("usage: thinknsh dock autostart [on] [--no-app] | off | status");{const e=o.status();console.log(e.enabled?`${chalk.green("●")} starts at login  ${chalk.dim(e.file)}${e.app?chalk.dim("  (with the menu-bar app)"):""}`:`${chalk.dim("○")} does not start at login   ${chalk.dim("turn on: thinknsh dock autostart on")}`)}}return!0}catch(e){return console.log(chalk.red(`✗ ${e.message}`)),!1}}async function appCmd(e){const o=require("../../dock/tray/install"),s=e.includes("--off")?"uninstall":e.find(e=>!e.startsWith("-"))||(o.installedPath()?"open":"install");try{if("install"===s){for(const e of o.install({log:e=>console.log(chalk.dim(`  ${e}`))}))console.log(`  ${e}`);console.log(chalk.green("✓ tray app installed")+chalk.dim("   (it opens at login when dock autostart is on)"))}else if("uninstall"===s)for(const e of o.uninstall())console.log(`  ${e}`);else{if("open"!==s)throw new Error("usage: thinknsh dock app install | uninstall | open");o.open()}return!0}catch(e){return console.log(chalk.red(`✗ ${e.message}`)),!1}}async function trayCmd(){const{TrayAgent:e}=require("../../dock/tray/agent");return await(new e).run(),!0}async function diagnoseCmd(e){const{diagnose:o}=require("../../dock/setup/diagnose"),s=await o({paths:e});return console.log(chalk.green(`✓ diagnostics bundle: ${s}`)),console.log(chalk.dim("  attach it to a bug report; it has no registry logins, env values or proxy passwords")),!0}async function resetCmd(e,o){const{reset:s}=require("../../dock/setup/diagnose"),t=o.includes("--all"),r=require("../../dock/paths").rootlessMode();if("linux"===process.platform&&0!==process.getuid?.()&&!r)throw new Error("dock runs as root on Linux: sudo thinknsh dock reset");if(console.log(chalk.yellow("  this deletes every container, image, volume and network, the build cache and the Linux VM disk"+(t?", plus settings and registry logins":""))),!o.includes("--yes")){if(!process.stdin.isTTY)throw new Error("refusing to reset without confirmation; pass --yes");const e=require("readline").createInterface({input:process.stdin,output:process.stderr}),o=await new Promise(o=>e.question("Reset dock to factory defaults? [y/N] ",o));if(e.close(),!/^y(es)?$/i.test(o.trim()))return!0}await stop(e);const{spawnSync:n}=require("child_process");if("darwin"===process.platform)n(path.join(require("os").homedir(),".tnc","bin","tnc-vz"),["stop"],{stdio:"ignore"});else if("win32"===process.platform){const e=require("../../dock/setup").WSL_DISTRO;n("wsl.exe",["-d",e,"-u","root","--","sh","-c","rm -rf /var/lib/tnc-dock/*"],{stdio:"ignore"}),n("wsl.exe",["--terminate",e],{stdio:"ignore"})}else r?((new(require("../../dock/linux/host").RootlessLinuxHost)).stop(),n("unshare",["--user","--map-root-user","--map-auto","--","rm","-rf",path.join(e.home,"rootless")],{stdio:"ignore"})):"linux"===process.platform&&n("sh",["-c",'for m in $(grep " /var/lib/tnc-dock" /proc/mounts | cut -d" " -f2 | sort -r); do umount -l "$m"; done; rm -rf /var/lib/tnc-dock'],{stdio:"ignore"});const i=s({paths:e,all:t});return console.log(chalk.green(`✓ dock reset (${i.length} items removed)`)),console.log(chalk.dim("  start again with: thinknsh dock start")),!0}async function migrateCmd(e,o){const{migrate:s}=require("../../dock/setup/migrate"),t=e=>{const s=o.indexOf(e);return-1===s?void 0:o[s+1]};if(!await ping(e.socket))return console.log(chalk.red("✗ dock is not running. Start it with: thinknsh dock start")),!1;try{const r=await s({from:t("--from"),to:`unix://${e.socket}`,images:o.includes("--images"),volumes:o.includes("--volumes"),dryRun:o.includes("--dry-run"),overwrite:o.includes("--overwrite"),log:e=>console.log(chalk.dim(`  ${e}`))}),n=(e,o)=>o?`${e}: ${o.moved} copied, ${o.skipped} already here`:null;return console.log(chalk.green(`✓ ${[n("images",r.images),n("volumes",r.volumes)].filter(Boolean).join("; ")}`)),console.log(chalk.dim("  containers are not moved: recreate them here (thinknsh compose up / thinknsh run)")),!0}catch(e){return console.log(chalk.red(`✗ migrate failed: ${e.message}`)),!1}}async function uiCmd(e,o){const{startUi:s}=require("../../dock/ui/server");if(!await ping(e.socket))return console.log(chalk.red("✗ dock is not running. Start it with: thinknsh dock start")),!1;const t=await s({socketPath:e.socket,port:Number((()=>{const e=o.indexOf("--port");return-1===e?void 0:o[e+1]})())||0});return console.log(chalk.green("✓ dock dashboard")),console.log(`  ${t.url}`),console.log(chalk.dim("  the link carries this session's token; Ctrl-C stops the dashboard")),o.includes("--no-open")||require("../../dock/tray/agent").openTarget(t.url),await new Promise(e=>{const o=()=>{t.close().then(e)};process.once("SIGINT",o),process.once("SIGTERM",o)}),!0}async function useCmd(e,o){const{use:s}=require("../../dock/setup/integrate");try{for(const t of s(e.socket,{off:o.includes("--off"),system:o.includes("--system")}))console.log(`  ${t}`);return o.includes("--off")||console.log(chalk.green("✓ tools built for other engines now use dock")+chalk.dim("   (undo: thinknsh dock use --off)")),!0}catch(e){return console.log(chalk.red(`✗ ${e.message}`)),!1}}async function vmRestart(e,o){if(await ping(e.socket)){const s=((await request(e.socket,"GET","/containers/json")).body||[]).map(e=>e.Names[0].slice(1));if(s.length&&!o.includes("--force"))return console.log(chalk.yellow(`  running containers would stop: ${s.join(", ")}`)),console.log(chalk.dim("  stop them first, or pass --force")),!1}if(await stop(e),"darwin"===process.platform){const{spawnSync:e}=require("child_process");e(path.join(require("os").homedir(),".tnc","bin","tnc-vz"),["stop"],{stdio:"ignore"})}else if("win32"===process.platform){const{spawnSync:e}=require("child_process");e("wsl.exe",["--terminate",require("../../dock/setup").WSL_DISTRO],{stdio:"ignore"})}else require("../../dock/paths").rootlessMode()&&(new(require("../../dock/linux/host").RootlessLinuxHost)).stop();const s=await start(e);return s&&console.log(chalk.dim("  the Linux VM boots with the new settings on the next command that needs it")),s}async function foreground(){require("../../dock/daemon-main"),await new Promise(()=>{})}module.exports={name:"dock",description:"dock: ThinkNCollab container engine daemon (TNC Engine API)",usage:"thinknsh dock <setup|start|stop|status|check|selftest|config|use|env|vm-restart|migrate|ui|autostart|app|tray|diagnose|reset|daemon>",requiresAuth:!1,examples:["thinknsh dock setup","thinknsh dock start","thinknsh dock selftest","thinknsh dock check --md check.md","thinknsh dock config --memory 8g --cpus 6","thinknsh dock use","thinknsh dock autostart","thinknsh dock app"],async execute(e=[]){const o=(e[0]||"status").toLowerCase(),s=dockPaths();let t=!0;switch(o){case"setup":t=await setupCmd(e.slice(1));break;case"start":t=await start(s);break;case"stop":t=await stop(s);break;case"status":t=await status(s);break;case"check":t=await compat(s,e.slice(1));break;case"selftest":t=await selftest(s);break;case"daemon":await foreground();break;case"config":try{t=await configCmd(e.slice(1))}catch(e){console.log(chalk.red(`✗ ${e.message}`)),t=!1}break;case"use":t=await useCmd(s,e.slice(1));break;case"env":console.log(require("../../dock/setup/integrate").env(s.socket));break;case"vm-restart":t=await vmRestart(s,e.slice(1));break;case"migrate":t=await migrateCmd(s,e.slice(1));break;case"ui":t=await uiCmd(s,e.slice(1));break;case"autostart":t=await autostartCmd(e.slice(1));break;case"app":t=await appCmd(e.slice(1));break;case"tray":t=await trayCmd();break;case"diagnose":t=await diagnoseCmd(s);break;case"reset":try{t=await resetCmd(s,e.slice(1))}catch(e){console.log(chalk.red(`✗ ${e.message}`)),t=!1}break;default:console.log(chalk.yellow(`unknown subcommand "${o}". Usage: ${module.exports.usage}`)),t=!1}t||(process.exitCode=1)}};