thinkncollab-shell 2.0.0-beta.2 → 2.0.0-beta.4

package/Readme.md

@@ -1,3 +1,5 @@
+<p align="center"><img src="native/brand/thinkncollab-logo.png" alt="ThinkNCollab" width="320"></p>
+
 # ThinkNCollab Shell V2 (`thinknsh`)
 
 > **The Native-First Collaborative Developer OS: Lightweight MicroVM Sandbox & Zero-Daemon Dev Runner with Live Database Snapshots, P2P Terminal Multiplexing, and OCI Compatibility.**
@@ -43,17 +45,17 @@ Every command has its own help, for example `thinknsh run --help`. The full list
 | Area | Commands |
 | :--- | :--- |
 | Containers | `run`, `create`, `start`, `stop`, `restart`, `kill`, `rm`, `ps`, `logs`, `exec`, `wait`, `inspect` |
-| Images | `images`, `pull`, `push`, `build`, `tag`, `rmi`, `image prune` |
+| Images | `images`, `pull`, `push`, `build` (`--platform a,b --push`), `tag`, `rmi`, `image prune`, `search`, `manifest create / inspect / push / rm` |
 | Registries | `login [-u USER] [--password-stdin] [REGISTRY]`, `logout [REGISTRY]` |
 | Agent workspaces | `workspace up / open / apps / ls / shell / exec / ssh-config / stop / rm` |
 | Dev services | `service start postgres\|redis\|mysql [-p PORT]`, `service stop / restart / status / logs / rm [-v]` |
 | Local registry | `registry start [PORT] / stop / status / push IMAGE / pull IMAGE` |
-| Apps | `compose up / down / ps / logs / exec / build / pull / start / stop / restart / rm / config` |
+| Apps | `compose up / down / ps / logs / exec / run / create / build / pull / push / start / stop / restart / kill / pause / unpause / rm / top / port / images / cp / scale / wait / events / ls / watch / config` |
 | Storage and networks | `volume ls / create / rm / inspect / prune`, `network ls / create / rm / connect / disconnect / prune` |
 | Files and state | `cp`, `diff`, `export`, `commit`, `save`, `load`, `import`, `history`, `stats`, `top`, `pause` / `unpause`, `rename`, `update`, `port` |
-| Engine | `system info / df / prune`, `dock setup / start / stop / status / selftest / check / config`, `dock autostart [--off]` (macOS: start at login) |
+| Engine | `system info / df / prune`, `events`, `dock setup / start / stop / status / selftest / check / config / autostart / diagnose / reset` |
 | Other tools and engines | `dock use [--system] [--off]` (engine CLI, compose, buildx, VS Code Dev Containers, testcontainers, the standard socket path), `dock env`, `dock migrate` |
-| Dashboard | `dock ui` — containers, logs, live stats, images, volumes, networks in the browser; `dock app` — TNC Dock in the macOS menu bar |
+| Desktop | `dock app install` (menu-bar app on macOS, tray icon on Windows), `dock ui` — dashboard in the browser: containers by compose app, logs with a filter, live stats, a terminal, images, volumes, networks, settings, troubleshooting |
 | CI on this machine | `ci run [WORKFLOW] [--job ID]`, `ci list` — `.tnc/workflows` jobs, matrix legs for amd64 and arm64, services, JavaScript / composite / container actions, artifacts, each in a fresh container |
 
 ### One container for all your coding agents: `thinknsh workspace`
@@ -107,21 +109,44 @@ New here? Read the step-by-step guide: [`docs/HOW-TO-USE.md`](docs/HOW-TO-USE.md
 | :--- | :--- |
 | Run, attach, interactive terminals, exec, logs, exit codes, signals | ✅ |
 | Pull from public and private OCI registries (token and basic auth) | ✅ |
-| Build: Containerfile, multi-stage, build args, targets, layer cache, `.tncignore`, `RUN --mount` (cache, secret, bind, tmpfs), heredocs | ✅ |
+| Build: Containerfile, multi-stage, build args, targets, layer cache, `.tncignore`, `RUN --mount` (cache, secret, bind, tmpfs, ssh), heredocs | ✅ |
+| Build: independent stages at the same time; `--cache-from` / `--cache-to` (registry, local folder, inline) to share the cache with CI and other machines | ✅ |
+| Build: `--ssh default` (your SSH agent for `RUN --mount=type=ssh`, e.g. `git clone` of private repos; keys never leave the agent) | ✅ needs runtime bundle 0.2.3+ |
+| Pushes and pulls that survive a dropped connection (chunked uploads, resumed downloads) | ✅ |
+| Image signatures: `trust key generate`, `trust sign`, `trust verify` (the format cosign reads); only signed pulls with `dock config --trust-key`; keyless with `--keyless` | ✅ keyless needs cosign installed |
+| Vulnerability scan and SBOM: `image scan` (apk, deb, rpm, npm, Python packages against OSV; `--exit-code` for CI; CycloneDX / SPDX) | ✅ OS advisories for Alpine, Debian, Ubuntu, AlmaLinux, Rocky, openSUSE; Fedora and Amazon Linux: packages listed only |
+| userns-remap: the root of containers (and of build steps) is an unprivileged id range on the host (`dock config --userns-remap default`) | ✅ Linux as root; needs runtime bundle 0.2.3+ |
+| Overlay networks across machines (`network create -d overlay`, VXLAN), names of every machine's containers | ✅ Linux as root; the tunnel is not encrypted |
 | BuildKit: buildx and BuildKit-mode builds through the engine CLI (`--secret`, cache mounts, and SSH-agent forwarding in BuildKit mode) | ✅ |
+| buildx multi-platform: `buildx build --platform linux/amd64,linux/arm64 --push` (one OCI index, pushed with dock's logins), `--load` | ✅ |
 | Compose: build, depends_on with `service_healthy`, healthchecks, profiles, `.env`, `extends`, `secrets`, `configs`, recreate on change | ✅ |
+| Compose `run`, `watch` (sync, sync+restart, rebuild), `scale`, `cp`, `top`, `port`, `ls`, `events` and the other verbs | ✅ |
+| Multi-platform images: `build --platform linux/amd64,linux/arm64 --push`, `manifest`; image `search` | ✅ |
 | Networks with name resolution, named volumes, bind mounts, published TCP and UDP ports, `host.tnc.internal` | ✅ |
+| IPv6 dual-stack networks (`network create --ipv6 [--subnet …/64]`, compose `enable_ipv6`): addresses, routes, AAAA, outbound NAT | ✅ |
+| macvlan / ipvlan networks (containers with their own address on the LAN) | ✅ Linux as root; ❌ not possible inside the macOS VM, WSL or rootless (they sit behind NAT) |
+| Embedded DNS on user networks (`127.0.0.11`: every replica of a scaled service in turn, PTR, TCP, forwarding; needs runtime bundle 0.2.3+) | ✅ |
+| systemd as PID 1 and kind/k3d nodes (`--privileged`: writable cgroups, host devices, `SIGRTMIN+3` stop signal) | ✅ |
+| cgroup v1 Linux hosts (for example RHEL/CentOS 8): limits, `stats`, `top` | ✅ (CI covers v2 only) |
 | `linux/amd64` images on Apple Silicon (Rosetta 2; P8 compatibility check is optional) | ✅ |
 | Copy files in and out (`cp`), commit, save/load, export/import, stats, top | ✅ |
 | Unmodified tools: engine CLI, compose, VS Code Dev Containers (incl. Features), testcontainers | ✅ checked by `tests/ecosystem` |
 | Move images and volumes over from another engine (`dock migrate`) | ✅ |
-| Dashboard in the browser (`dock ui`) | ✅ |
+| Dashboard in the browser (`dock ui`), with settings, troubleshooting and a terminal | ✅ |
 | Local CI (`ci run`, and TNC CI/CD runs from the dashboard): jobs, `needs`, matrix, both CPUs on one machine, `services` on localhost, `GITHUB_ENV`/`GITHUB_OUTPUT` | ✅ (macOS/Windows jobs and third-party actions are skipped) |
 | `--network container:<name>` and compose `network_mode: service:<name>` | ✅ |
-| GPUs | ❌ not yet (not possible on macOS) |
+| Menu-bar app (macOS) / tray icon (Windows), start at login (`dock autostart`) | ✅ |
+| Installers with their own Node.js: `.pkg`/`.dmg`, Windows setup, Linux tarball + systemd | ✅ built in CI (`dock-bundle.yml`); signing when the certificates are set |
+| Corporate proxy and CA certificates, registry mirrors, insecure registries (`dock config`) | ✅ |
+| Registry passwords in the system keychain (macOS Keychain, Windows Credential Manager, Secret Service) | ✅ |
+| Diagnostics bundle, factory reset (`dock diagnose`, `dock reset`) | ✅ |
+| GPUs (`--gpus`, compose `deploy.resources.reservations.devices`, CDI names like `nvidia.com/gpu=all`) | ✅ Linux and WSL2 through CDI (NVIDIA Container Toolkit); ❌ not possible on macOS |
+| Registry logins from credential helpers (ECR, GCR, OS keychains: `credHelpers` / `credsStore` of the engine CLI config, or `dock config --credential-helper`) | ✅ |
+| zstd-compressed image layers | ✅ |
+| Prometheus metrics (`GET /metrics` on the engine socket) | ✅ |
 | Push to a registry (skips existing layers, cross-repo mount), registry login/logout | ✅ |
 | Agent workspaces over SSH (key-only, loopback, no capabilities) | ✅ |
-| Rootless mode | ❌ not yet |
+| Rootless mode on Linux (a normal user, no sudo: user namespaces, pasta / slirp4netns; limits and pause through the cgroup systemd delegates to the user) | ✅ |
 | Deploy compose apps to your own servers | ✅ `thinknsh cluster deploy` |
 
 ### Platforms
@@ -147,6 +172,13 @@ Measured on an Apple Silicon Mac with `thinknsh bench`. Run the same command on
 
 Downloads and the full guide are at **https://thinkncollab.com/dock**.
 
+**Installers** (no Node.js needed; they bring Node 24): `Thinknsh-<version>.dmg` for macOS,
+`Thinknsh-<version>-<arch>-setup.exe` for Windows, `thinknsh-<version>-linux-<arch>.tar.gz`
+for Linux (`sudo ./thinknsh/install.sh`). They set up the runtime, start dock at login and
+install the menu-bar / tray app. Built by `native/installer/` (see `.github/workflows/dock-bundle.yml`).
+
+**With npm:**
+
 1. **Node.js 22.5 or newer.** dock stores its state with `node:sqlite`.
 2. **Windows only:** turn on WSL2 in an administrator PowerShell, then reboot. If WSL is already installed, run `wsl --update` instead.
    ```powershell
@@ -157,13 +189,14 @@ Downloads and the full guide are at **https://thinkncollab.com/dock**.
    npm install -g https://thinkncollab.com/downloads/dock/0.2.0/thinkncollab-shell.tgz
    thinknsh dock setup
    ```
-   On Linux, dock runs containers natively as root: run `sudo thinknsh dock setup` and `sudo thinknsh dock start`, then `sudo groupadd tnc-dock && sudo usermod -aG tnc-dock $USER` and restart dock to use the commands without sudo.
+   On Linux, as a normal user, dock runs **rootless** (no sudo): it needs `uidmap` and `passt`, and subordinate ids (`sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USER`); `thinknsh dock setup` lists anything missing. To run it as a system service instead, run `sudo thinknsh dock setup` and `sudo thinknsh dock start` (or `sudo thinknsh dock autostart on` for a systemd service), then `sudo groupadd tnc-dock && sudo usermod -aG tnc-dock $USER` and restart dock to use the commands without sudo. The engine listens on `/run/thinknsh/dock.sock` for every user; settings are system-wide in `/etc/thinknsh/config.json` (change them with `sudo thinknsh dock config …`).
    On a machine without internet, download the files for your platform and `manifest.json` from the downloads page into one folder, then run `thinknsh dock setup --from <folder>`.
 4. **Run something:**
    ```bash
    thinknsh run --rm -p 8080:80 nginx:alpine
    ```
    Then open http://localhost:8080.
+5. **Optional:** `thinknsh dock autostart on` (start at login) and `thinknsh dock app install` (menu-bar / tray app).
 
 ### Check it works on your machine
 
@@ -318,4 +351,4 @@ thinknsh dep sync                  # Reconcile environment from thinkncollab.yml
 ## 📄 License
 
 Apache License 2.0. See [LICENSE](LICENSE) for details.  
-Copyright (c) 2024-2026 ThinkNCollab Systems Inc. All rights reserved.
+Copyright (c) 2024-2026 ThinkNCollab Systems Inc. All rights reserved.

package/dist/native/tnc-tray/build-macos.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+#
+# native/tnc-tray/build-macos.sh — builds Thinknsh.app, the menu-bar app (Intel + Apple Silicon).
+#
+#   build-macos.sh <outdir>         <outdir>/Thinknsh.app
+#
+# Signing: TNC_SIGN_IDENTITY="Developer ID Application: …" signs with the
+# hardened runtime (needed for notarization); without it the app is signed ad hoc.
+#
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+OUT="${1:?usage: build-macos.sh <outdir>}"
+VERSION="${TNC_APP_VERSION:-$(node -p "require('$HERE/../../package.json').version" 2>/dev/null || echo 0.0.0)}"
+mkdir -p "$OUT"
+OUT="$(cd "$OUT" && pwd)"
+APP="$OUT/Thinknsh.app"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+rm -rf "$APP"
+mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
+
+for arch in arm64 x86_64; do
+  xcrun swiftc -O -target "$arch-apple-macos13" -o "$WORK/tray-$arch" "$HERE/main.swift"
+done
+lipo -create -output "$APP/Contents/MacOS/thinknsh-tray" "$WORK/tray-arm64" "$WORK/tray-x86_64"
+# ThinkNCollab icons (native/brand, made by make-icons.py): the app icon and the menu bar template
+for f in AppIcon.icns menubar.png menubar@2x.png; do
+  cp "$HERE/../brand/$f" "$APP/Contents/Resources/$f"
+done
+
+cat > "$APP/Contents/Info.plist" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key><string>Thinknsh</string>
+  <key>CFBundleDisplayName</key><string>Thinknsh</string>
+  <key>CFBundleIdentifier</key><string>com.thinkncollab.thinknsh</string>
+  <key>CFBundleExecutable</key><string>thinknsh-tray</string>
+  <key>CFBundlePackageType</key><string>APPL</string>
+  <key>CFBundleIconFile</key><string>AppIcon</string>
+  <key>CFBundleShortVersionString</key><string>${VERSION}</string>
+  <key>CFBundleVersion</key><string>${VERSION}</string>
+  <key>LSMinimumSystemVersion</key><string>13.0</string>
+  <key>LSUIElement</key><true/>
+  <key>NSHighResolutionCapable</key><true/>
+  <key>NSAppleEventsUsageDescription</key><string>Opens Terminal windows for container logs and shells.</string>
+</dict>
+</plist>
+PLIST
+
+if [[ -n "${TNC_SIGN_IDENTITY:-}" ]]; then
+  codesign --force --options runtime --timestamp --sign "$TNC_SIGN_IDENTITY" "$APP"
+else
+  codesign --force --sign - "$APP"
+fi
+echo "✓ $APP"

package/dist/native/tnc-tray/main.swift

@@ -0,0 +1,204 @@
+// native/tnc-tray/main.swift — the thinknsh menu-bar app (macOS 13+).
+//
+// A thin shell: it runs `thinknsh dock tray` (src/dock/tray/agent.js) and draws
+// the menu that process sends, one JSON object per line on its stdout. Clicks
+// go back as {"click": ID} on its stdin, after a confirm dialog when the item
+// asks for one. All engine logic lives in the agent.
+//
+// The agent command comes from the bundle: Resources/node/bin/node and
+// Resources/cli/bin/thinknsh.js (installer builds), or Resources/agent.json
+// {"node": …, "cli": …} written by `thinknsh dock app install`.
+
+import Cocoa
+
+final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
+    private var statusItem: NSStatusItem!
+    private var agent: Process?
+    private var agentInput: FileHandle?
+    private var buffer = Data()
+    private var restarts = 0
+    private var quitting = false
+
+    func applicationDidFinishLaunching(_ notification: Notification) {
+        statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
+        setIcon("stopped")
+        let menu = NSMenu()
+        menu.autoenablesItems = false
+        menu.delegate = self
+        statusItem.menu = menu
+        showMessage("Starting…")
+        startAgent()
+    }
+
+    func applicationWillTerminate(_ notification: Notification) {
+        quitting = true
+        agent?.terminate()
+    }
+
+    // MARK: agent process
+
+    private func agentCommand() -> (String, [String])? {
+        guard let res = Bundle.main.resourceURL else { return nil }
+        let fm = FileManager.default
+        let node = res.appendingPathComponent("node/bin/node").path
+        let cli = res.appendingPathComponent("cli/bin/thinknsh.js").path
+        if fm.isExecutableFile(atPath: node) && fm.fileExists(atPath: cli) { return (node, [cli, "dock", "tray"]) }
+        if let data = try? Data(contentsOf: res.appendingPathComponent("agent.json")),
+           let json = try? JSONSerialization.jsonObject(with: data) as? [String: String],
+           let n = json["node"], let c = json["cli"] {
+            return (n, [c, "dock", "tray"])
+        }
+        return nil
+    }
+
+    private func startAgent() {
+        guard let (exe, args) = agentCommand() else {
+            showMessage("thinknsh not found: run thinknsh dock app install")
+            return
+        }
+        let p = Process()
+        p.executableURL = URL(fileURLWithPath: exe)
+        p.arguments = args
+        var env = ProcessInfo.processInfo.environment
+        env["PATH"] = "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin:" + (env["PATH"] ?? "")
+        env["FORCE_COLOR"] = "0"
+        p.environment = env
+        let out = Pipe(), inp = Pipe()
+        p.standardOutput = out
+        p.standardInput = inp
+        p.standardError = FileHandle.nullDevice
+        out.fileHandleForReading.readabilityHandler = { [weak self] h in
+            let d = h.availableData
+            DispatchQueue.main.async { self?.received(d) }
+        }
+        p.terminationHandler = { [weak self] _ in
+            DispatchQueue.main.async { self?.agentEnded() }
+        }
+        do {
+            try p.run()
+            agent = p
+            agentInput = inp.fileHandleForWriting
+        } catch {
+            showMessage("Cannot start thinknsh: \(error.localizedDescription)")
+        }
+    }
+
+    private func agentEnded() {
+        agent = nil
+        agentInput = nil
+        if quitting { NSApp.terminate(nil); return }
+        restarts += 1
+        if restarts > 5 { showMessage("thinknsh tray stopped; reopen the app"); return }
+        DispatchQueue.main.asyncAfter(deadline: .now() + 2) { [weak self] in self?.startAgent() }
+    }
+
+    private func received(_ data: Data) {
+        if data.isEmpty { return }
+        buffer.append(data)
+        while let nl = buffer.firstIndex(of: 0x0a) {
+            let line = buffer.subdata(in: buffer.startIndex..<nl)
+            buffer.removeSubrange(buffer.startIndex...nl)
+            handle(line)
+        }
+    }
+
+    private func handle(_ line: Data) {
+        guard let msg = (try? JSONSerialization.jsonObject(with: line)) as? [String: Any] else { return }
+        if let menu = msg["menu"] as? [String: Any] { render(menu) }
+        if let text = msg["notify"] as? String { notify(text) }
+        if msg["exit"] as? Bool == true {
+            quitting = true
+            NSApp.terminate(nil)
+        }
+    }
+
+    private func send(_ obj: [String: Any]) {
+        guard let input = agentInput, let d = try? JSONSerialization.data(withJSONObject: obj) else { return }
+        var line = d
+        line.append(0x0a)
+        try? input.write(contentsOf: line)
+    }
+
+    // MARK: menu
+
+    // The TNC mark (Resources/menubar.png + @2x, a template macOS tints for light and dark),
+    // dimmed while dock is not running; a system symbol when the bundle has no icon.
+    private func setIcon(_ status: String) {
+        let img = Bundle.main.image(forResource: "menubar")
+            ?? NSImage(systemSymbolName: status == "running" ? "shippingbox.fill" : "shippingbox", accessibilityDescription: nil)
+        img?.isTemplate = true
+        img?.accessibilityDescription = "thinknsh dock \(status)"
+        statusItem.button?.image = img
+        statusItem.button?.appearsDisabled = status != "running"
+    }
+
+    private func showMessage(_ text: String) {
+        let menu = statusItem.menu!
+        menu.removeAllItems()
+        let item = NSMenuItem(title: text, action: nil, keyEquivalent: "")
+        item.isEnabled = false
+        menu.addItem(item)
+        menu.addItem(.separator())
+        menu.addItem(NSMenuItem(title: "Quit", action: #selector(NSApplication.terminate(_:)), keyEquivalent: "q"))
+    }
+
+    private func render(_ model: [String: Any]) {
+        setIcon(model["status"] as? String ?? "stopped")
+        let title = model["title"] as? String ?? ""
+        statusItem.button?.title = title.isEmpty ? "" : " \(title)"
+        let menu = statusItem.menu!
+        menu.removeAllItems()
+        fill(menu, model["items"] as? [[String: Any]] ?? [])
+    }
+
+    private func fill(_ menu: NSMenu, _ items: [[String: Any]]) {
+        for it in items {
+            if it["separator"] as? Bool == true { menu.addItem(.separator()); continue }
+            let item = NSMenuItem(title: it["label"] as? String ?? "", action: nil, keyEquivalent: "")
+            item.isEnabled = it["enabled"] as? Bool ?? true
+            if it["checked"] as? Bool == true { item.state = .on }
+            if let sub = it["items"] as? [[String: Any]] {
+                let submenu = NSMenu()
+                submenu.autoenablesItems = false
+                fill(submenu, sub)
+                item.submenu = submenu
+            } else {
+                item.target = self
+                item.action = #selector(clicked(_:))
+                item.representedObject = it
+            }
+            menu.addItem(item)
+        }
+    }
+
+    @objc private func clicked(_ sender: NSMenuItem) {
+        guard let it = sender.representedObject as? [String: Any], let id = it["id"] as? String else { return }
+        if let question = it["confirm"] as? String {
+            NSApp.activate(ignoringOtherApps: true)
+            let alert = NSAlert()
+            alert.messageText = question
+            alert.alertStyle = .warning
+            alert.addButton(withTitle: "Continue")
+            alert.addButton(withTitle: "Cancel")
+            if alert.runModal() != .alertFirstButtonReturn { return }
+        }
+        send(["click": id])
+    }
+
+    func menuWillOpen(_ menu: NSMenu) {
+        send(["refresh": true])
+    }
+
+    private func notify(_ text: String) {
+        let p = Process()
+        p.executableURL = URL(fileURLWithPath: "/usr/bin/osascript")
+        p.arguments = ["-e", "on run argv\ndisplay notification (item 1 of argv) with title \"thinknsh dock\"\nend run", text]
+        try? p.run()
+    }
+}
+
+let app = NSApplication.shared
+let delegate = AppDelegate()
+app.delegate = delegate
+app.setActivationPolicy(.accessory)
+app.run()

package/dist/native/tnc-tray/tray.ps1

@@ -0,0 +1,137 @@
+# native/tnc-tray/tray.ps1 — the thinknsh notification-area (tray) icon on Windows.
+#
+# Same design as the macOS app: runs `thinknsh dock tray` (src/dock/tray/agent.js)
+# and draws the menu it sends, one JSON object per line; clicks go back as
+# {"click": ID}. Installed and started by `thinknsh dock app install`.
+#
+#   powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File tray.ps1 -Node <node.exe> -Cli <thinknsh.js>
+#   powershell -File tray.ps1 -CompileOnly      compile the C# part and exit (CI)
+
+param(
+  [string]$Node,
+  [string]$Cli,
+  [switch]$CompileOnly
+)
+
+$ErrorActionPreference = 'Stop'
+
+Add-Type -ReferencedAssemblies System.Windows.Forms, System.Drawing, System.Web.Extensions -TypeDefinition @'
+using System;
+using System.Collections;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Drawing;
+using System.Reflection;
+using System.Threading;
+using System.Web.Script.Serialization;
+using System.Windows.Forms;
+
+public static class TncTray {
+  static Process agent;
+  static NotifyIcon icon;
+  static readonly ConcurrentQueue<string> lines = new ConcurrentQueue<string>();
+  static readonly JavaScriptSerializer json = new JavaScriptSerializer();
+
+  public static void Run(string node, string cli, string dir) {
+    var psi = new ProcessStartInfo(node, "\"" + cli + "\" dock tray");
+    psi.UseShellExecute = false;
+    psi.RedirectStandardInput = true;
+    psi.RedirectStandardOutput = true;
+    psi.RedirectStandardError = true;
+    psi.CreateNoWindow = true;
+    psi.StandardOutputEncoding = System.Text.Encoding.UTF8;   // menu labels are UTF-8 (●, …)
+    psi.EnvironmentVariables["FORCE_COLOR"] = "0";
+    agent = Process.Start(psi);
+    var reader = new Thread(() => {
+      string l;
+      while ((l = agent.StandardOutput.ReadLine()) != null) lines.Enqueue(l);
+      lines.Enqueue("{\"exit\":true}");
+    });
+    reader.IsBackground = true;
+    reader.Start();
+    var errors = new Thread(() => { agent.StandardError.ReadToEnd(); });
+    errors.IsBackground = true;
+    errors.Start();
+
+    icon = new NotifyIcon();
+    var ico = System.IO.Path.Combine(dir ?? "", "tnc.ico");          // the TNC icon, next to this script
+    icon.Icon = System.IO.File.Exists(ico) ? new Icon(ico) : SystemIcons.Application;
+    icon.Text = "thinknsh dock";
+    icon.Visible = true;
+    icon.ContextMenuStrip = new ContextMenuStrip();
+    icon.ContextMenuStrip.Items.Add(new ToolStripMenuItem("Starting...") { Enabled = false });
+    icon.ContextMenuStrip.Opening += (s, e) => Send("{\"refresh\":true}");
+    icon.MouseClick += (s, e) => {
+      if (e.Button != MouseButtons.Left) return;
+      var show = typeof(NotifyIcon).GetMethod("ShowContextMenu", BindingFlags.Instance | BindingFlags.NonPublic);
+      if (show != null) show.Invoke(icon, null);
+    };
+
+    var timer = new System.Windows.Forms.Timer();
+    timer.Interval = 150;
+    timer.Tick += (s, e) => Drain();
+    timer.Start();
+    Application.Run();
+    icon.Visible = false;
+    try { if (!agent.HasExited) agent.Kill(); } catch (Exception) { }
+  }
+
+  static void Send(string line) {
+    try { agent.StandardInput.WriteLine(line); agent.StandardInput.Flush(); } catch (Exception) { }
+  }
+
+  static void Drain() {
+    string l;
+    while (lines.TryDequeue(out l)) {
+      Dictionary<string, object> m;
+      try { m = json.Deserialize<Dictionary<string, object>>(l); } catch (Exception) { continue; }
+      if (m == null) continue;
+      if (m.ContainsKey("notify")) icon.ShowBalloonTip(5000, "thinknsh dock", Convert.ToString(m["notify"]), ToolTipIcon.Info);
+      if (m.ContainsKey("menu")) Render(m["menu"] as IDictionary<string, object>);
+      if (m.ContainsKey("exit")) { Application.Exit(); return; }
+    }
+  }
+
+  static void Render(IDictionary<string, object> menu) {
+    if (menu == null) return;
+    var strip = icon.ContextMenuStrip;
+    strip.Items.Clear();
+    Fill(strip.Items, menu["items"] as IEnumerable);
+    string status = Convert.ToString(menu["status"]);
+    string title = menu.ContainsKey("title") ? Convert.ToString(menu["title"]) : "";
+    string text = "thinknsh dock: " + status + (title.Length > 0 ? " (" + title + " running)" : "");
+    icon.Text = text.Length > 63 ? text.Substring(0, 63) : text;
+  }
+
+  static void Fill(ToolStripItemCollection items, IEnumerable list) {
+    if (list == null) return;
+    foreach (object o in list) {
+      var it = o as IDictionary<string, object>;
+      if (it == null) continue;
+      if (it.ContainsKey("separator")) { items.Add(new ToolStripSeparator()); continue; }
+      var mi = new ToolStripMenuItem(Convert.ToString(it["label"]));
+      if (it.ContainsKey("enabled") && !Convert.ToBoolean(it["enabled"])) mi.Enabled = false;
+      if (it.ContainsKey("checked") && Convert.ToBoolean(it["checked"])) mi.Checked = true;
+      if (it.ContainsKey("items")) {
+        Fill(mi.DropDownItems, it["items"] as IEnumerable);
+      } else {
+        string id = Convert.ToString(it["id"]);
+        string confirm = it.ContainsKey("confirm") ? Convert.ToString(it["confirm"]) : null;
+        mi.Click += (s, e) => {
+          if (confirm != null && MessageBox.Show(confirm, "thinknsh dock", MessageBoxButtons.OKCancel, MessageBoxIcon.Warning) != DialogResult.OK) return;
+          var click = new Dictionary<string, object>();
+          click["click"] = id;
+          Send(json.Serialize(click));
+        };
+      }
+      items.Add(mi);
+    }
+  }
+}
+'@
+
+if ($CompileOnly) { Write-Output 'tray compiled'; exit 0 }
+if (-not $Node -or -not $Cli) { throw 'usage: tray.ps1 -Node <node.exe> -Cli <thinknsh.js>' }
+[System.Windows.Forms.Application]::EnableVisualStyles()
+[TncTray]::Run($Node, $Cli, $PSScriptRoot)

package/dist/src/commands/dock/containers.js

@@ -4,4 +4,4 @@
  * PROPRIETARY INTELLECTUAL PROPERTY & TRADE SECRETS.
  * UNAUTHORIZED REVERSE ENGINEERING, DECOMPILATION, OR RE-DISTRIBUTION IS STRICTLY PROHIBITED.
  */
-"use strict";const{runCommand}=require("../../dock/cli/commands"),DESCRIPTIONS={run:"Run a container (pulls the image if needed)",create:"Create a container without starting it",start:"Start stopped containers",stop:"Stop running containers",restart:"Restart containers",kill:"Send a signal to containers",rm:"Remove containers",wait:"Wait for containers to stop and print exit codes",ps:"List containers",logs:"Show container output",exec:"Run a command in a running container",inspect:"Show details of containers, images, volumes or networks",images:"List images",pull:"Download an image",push:"Upload an image to a registry (also: sandbox push ecr://… / --export)",login:"Log in to a container registry (-u USER [REGISTRY]); with an email, to ThinkNCollab",logout:"Log out of a container registry (REGISTRY); without one, of ThinkNCollab",rmi:"Remove images",tag:"Give an image another name",build:"Build an image from a Containerfile",cp:"Copy files between a container and this machine (CONTAINER:PATH)",stats:"Live CPU, memory, network and disk use of containers",top:"Show the processes of a container",pause:"Freeze every process of containers",unpause:"Thaw paused containers",rename:"Rename a container",update:"Change memory/CPU limits or the restart policy of containers",diff:"Show files changed in a container",port:"Show the published ports of a container",commit:"Make an image from a container's changes",save:"Write images to a tar file (loads in any engine)",load:"Read images from a tar file",import:"Make an image from a root filesystem tar",compose:"Run multi-container apps from a compose file",workspace:"One secure container per project for all coding agents and editors (Claude, Codex, Antigravity, Cursor)",service:"Dev databases as containers: postgres, redis, mysql (start, stop, status, logs, rm)",registry:"A local image registry as a container (start, stop, status, push, pull)",capsule:"Older name for image commands (build, images, run, rmi)",vault:"Older name for volume commands, plus backup and restore",mesh:"Older name for network commands",stack:"Older name for compose",vm:"Older name for dock setup/start/stop/status",volume:"Manage volumes",network:"Manage networks",system:"Disk usage, cleanup and engine info",container:"Manage containers (ls, rm, prune, …)",image:"Manage images (ls, rm, prune, …)"},NAMES=Object.keys(DESCRIPTIONS),looksLikeRegistry=e=>!!e&&!e.startsWith("-")&&!e.includes("@")&&(e.includes(".")||e.includes(":")||"localhost"===e),REGISTRY_FORM={login:e=>e.some(e=>/^(-u|--username|--password-stdin)(=|$)/.test(e)||/^-u./.test(e))||1===e.length&&looksLikeRegistry(e[0])||["--help","-h"].includes(e[0]),logout:e=>1===e.length&&(looksLikeRegistry(e[0])||["--help","-h"].includes(e[0])),push:e=>!e.some(e=>/^[a-z][a-z0-9+.-]*:\/\//.test(e)||/^--export/.test(e))&&"export"!==e[0]},LEGACY={login:"../auth/login",logout:"../auth/logout",push:"../sandbox/push"},ALIASES={volume:["vol","volumes"],network:["net","networks"],images:["img"],service:["svc","services","db"],capsule:["cap"],vm:["microvm","vz"]};async function runLegacy(e,a,o,s){const t=require(LEGACY[e]);if(!t.requiresAuth||o?.api?.isAuthenticated())return t.execute(a,o,s);console.log(require("chalk").red("[FAIL] Please login first: login"))}module.exports=NAMES.map(e=>({name:e,description:DESCRIPTIONS[e],usage:`thinknsh ${e} --help`,requiresAuth:!1,selfExiting:!0,...LEGACY[e]?{aliases:require(LEGACY[e]).aliases}:ALIASES[e]?{aliases:ALIASES[e]}:{},async execute(a=[],o,s=e){if(LEGACY[e]&&(s!==e||!REGISTRY_FORM[e](a)))return runLegacy(e,a,o,s);process.exitCode=await runCommand(e,a)}})),module.exports.REGISTRY_FORM=REGISTRY_FORM,module.exports.NAMES=NAMES,module.exports.ALL_NAMES=module.exports.flatMap(e=>[e.name,...e.aliases||[]]);
+"use strict";const{runCommand}=require("../../dock/cli/commands"),DESCRIPTIONS={run:"Run a container (pulls the image if needed)",create:"Create a container without starting it",start:"Start stopped containers",stop:"Stop running containers",restart:"Restart containers",kill:"Send a signal to containers",rm:"Remove containers",wait:"Wait for containers to stop and print exit codes",ps:"List containers",logs:"Show container output",exec:"Run a command in a running container",inspect:"Show details of containers, images, volumes or networks",images:"List images",pull:"Download an image",push:"Upload an image to a registry (also: sandbox push ecr://… / --export)",login:"Log in to a container registry (-u USER [REGISTRY]); with an email, to ThinkNCollab",logout:"Log out of a container registry (REGISTRY); without one, of ThinkNCollab",rmi:"Remove images",tag:"Give an image another name",manifest:"Multi-platform images from local images (create, inspect, push, rm)",search:"Search the public image registry",events:"Stream engine events (container, image, volume, network)",build:"Build an image from a Containerfile",trust:"Sign images and check their signatures (key generate, sign, verify)",scan:"Packages and known vulnerabilities of an image (also: image scan), or its SBOM",cp:"Copy files between a container and this machine (CONTAINER:PATH)",stats:"Live CPU, memory, network and disk use of containers",top:"Show the processes of a container",pause:"Freeze every process of containers",unpause:"Thaw paused containers",rename:"Rename a container",update:"Change memory/CPU limits or the restart policy of containers",diff:"Show files changed in a container",port:"Show the published ports of a container",commit:"Make an image from a container's changes",save:"Write images to a tar file (loads in any engine)",load:"Read images from a tar file",import:"Make an image from a root filesystem tar",compose:"Run multi-container apps from a compose file",workspace:"One secure container per project for all coding agents and editors (Claude, Codex, Antigravity, Cursor)",service:"Dev databases as containers: postgres, redis, mysql (start, stop, status, logs, rm)",registry:"A local image registry as a container (start, stop, status, push, pull)",capsule:"Older name for image commands (build, images, run, rmi)",vault:"Older name for volume commands, plus backup and restore",mesh:"Older name for network commands",stack:"Older name for compose",vm:"Older name for dock setup/start/stop/status",volume:"Manage volumes",network:"Manage networks",system:"Disk usage, cleanup and engine info",container:"Manage containers (ls, rm, prune, …)",image:"Manage images (ls, rm, prune, …)"},NAMES=Object.keys(DESCRIPTIONS),looksLikeRegistry=e=>!!e&&!e.startsWith("-")&&!e.includes("@")&&(e.includes(".")||e.includes(":")||"localhost"===e),REGISTRY_FORM={login:e=>e.some(e=>/^(-u|--username|--password-stdin)(=|$)/.test(e)||/^-u./.test(e))||1===e.length&&looksLikeRegistry(e[0])||["--help","-h"].includes(e[0]),logout:e=>1===e.length&&(looksLikeRegistry(e[0])||["--help","-h"].includes(e[0])),push:e=>!e.some(e=>/^[a-z][a-z0-9+.-]*:\/\//.test(e)||/^--export/.test(e))&&"export"!==e[0]},LEGACY={login:"../auth/login",logout:"../auth/logout",push:"../sandbox/push"},ALIASES={volume:["vol","volumes"],network:["net","networks"],images:["img"],service:["svc","services","db"],capsule:["cap"],vm:["microvm","vz"]};async function runLegacy(e,a,s,t){const n=require(LEGACY[e]);if(!n.requiresAuth||s?.api?.isAuthenticated())return n.execute(a,s,t);console.log(require("chalk").red("[FAIL] Please login first: login"))}module.exports=NAMES.map(e=>({name:e,description:DESCRIPTIONS[e],usage:`thinknsh ${e} --help`,requiresAuth:!1,selfExiting:!0,...LEGACY[e]?{aliases:require(LEGACY[e]).aliases}:ALIASES[e]?{aliases:ALIASES[e]}:{},async execute(a=[],s,t=e){if(LEGACY[e]&&(t!==e||!REGISTRY_FORM[e](a)))return runLegacy(e,a,s,t);process.exitCode=await runCommand(e,a)}})),module.exports.REGISTRY_FORM=REGISTRY_FORM,module.exports.NAMES=NAMES,module.exports.ALL_NAMES=module.exports.flatMap(e=>[e.name,...e.aliases||[]]);