clonebox 1.1.18__py3-none-any.whl → 1.1.20__py3-none-any.whl

clonebox/cli.py

@@ -7,8 +7,10 @@ import argparse
 import json
 import os
 import re
+import secrets
 import sys
 import time
+from dataclasses import asdict
 from typing import Any, Dict, Optional, Tuple
 from datetime import datetime
 from pathlib import Path
@@ -37,6 +39,7 @@ from clonebox.health import HealthCheckManager, ProbeConfig, ProbeType
 from clonebox.audit import get_audit_logger, AuditQuery, AuditEventType, AuditOutcome
 from clonebox.orchestrator import Orchestrator, OrchestrationResult
 from clonebox.plugins import get_plugin_manager, PluginHook, PluginContext
+from clonebox.policies import PolicyEngine, PolicyValidationError, PolicyViolationError
 from clonebox.remote import RemoteCloner, RemoteConnection
 
 # Custom questionary style
@@ -263,8 +266,6 @@ def run_vm_diagnostics(
             console.print(f"[dim]{domifaddr.stdout.strip()}[/]")
         else:
             console.print("[yellow]⚠️  No interface address detected via virsh domifaddr[/]")
-            if verbose and domifaddr.stderr.strip():
-                console.print(f"[dim]{domifaddr.stderr.strip()}[/]")
             # Fallback: try to get IP via QEMU Guest Agent (useful for slirp/user networking)
             if guest_agent_ready:
                 try:
@@ -349,7 +350,7 @@ def run_vm_diagnostics(
     if not guest_agent_ready:
         result["cloud_init"] = {"status": "unknown", "reason": "qga_not_ready"}
         console.print(
-            "[yellow]⏳ Cloud-init status: Unknown (QEMU guest agent not connected yet)[/]"
+            "[yellow]⏳ Cloud-init status: Unknown (QEMU Guest Agent not connected yet)[/]"
         )
     else:
         ready_msg = _qga_exec(
@@ -453,7 +454,7 @@ def run_vm_diagnostics(
     console.print("\n[bold]🏥 Health Check Status...[/]")
     if not guest_agent_ready:
         result["health"]["status"] = "unknown"
-        console.print("[dim]Health status: Not available yet (QEMU guest agent not ready)[/]")
+        console.print("[dim]Health status: Not available yet (QEMU Guest Agent not ready)[/]")
     else:
         health_status = _qga_exec(
             vm_name, conn_uri, "cat /var/log/clonebox-health-status 2>/dev/null || true", timeout=10
@@ -609,7 +610,6 @@ def cmd_logs(args):
     
     name = args.name
     user_session = getattr(args, "user", False)
-    show_all = getattr(args, "all", False)
     
     try:
         vm_name, _ = _resolve_vm_name_and_config_file(name)
@@ -629,7 +629,7 @@ def cmd_logs(args):
     try:
         console.print(f"[cyan]📋 Opening logs for VM: {vm_name}[/]")
         subprocess.run(
-            [str(logs_script), vm_name, "true" if user_session else "false", "true" if show_all else "false"],
+            [str(logs_script), vm_name, "true" if user_session else "false", "true" if getattr(args, "all", False) else "false"],
             check=True
         )
     except subprocess.CalledProcessError as e:
@@ -942,7 +942,7 @@ def interactive_mode():
     )
 
     try:
-        cloner = SelectiveVMCloner(user_session=user_session)
+        cloner = SelectiveVMCloner(user_session=getattr(args, "user", False))
 
         # Check prerequisites
         checks = cloner.check_prerequisites()
@@ -1192,13 +1192,42 @@ def cmd_delete(args):
     # If name is a path, load config
     if name and (name.startswith(".") or name.startswith("/") or name.startswith("~")):
         target_path = Path(name).expanduser().resolve()
-        config_file = target_path / ".clonebox.yaml" if target_path.is_dir() else target_path
+
+        if target_path.is_dir():
+            config_file = target_path / CLONEBOX_CONFIG_FILE
+        else:
+            config_file = target_path
+
         if config_file.exists():
             config = load_clonebox_config(config_file)
             name = config["vm"]["name"]
         else:
             console.print(f"[red]❌ Config not found: {config_file}[/]")
             return
+    elif not name or name == ".":
+        config_file = Path.cwd() / ".clonebox.yaml"
+        if config_file.exists():
+            config = load_clonebox_config(config_file)
+            name = config["vm"]["name"]
+        else:
+            console.print("[red]❌ No .clonebox.yaml found in current directory[/]")
+            console.print("[dim]Usage: clonebox delete . or clonebox delete <vm-name>[/]")
+            return
+
+    policy_start = None
+    if name and (name.startswith(".") or name.startswith("/") or name.startswith("~")):
+        policy_start = Path(name).expanduser().resolve()
+
+    policy = PolicyEngine.load_effective(start=policy_start)
+    if policy is not None:
+        try:
+            policy.assert_operation_approved(
+                AuditEventType.VM_DELETE.value,
+                approved=getattr(args, "approve", False),
+            )
+        except PolicyViolationError as e:
+            console.print(f"[red]❌ {e}[/]")
+            sys.exit(1)
 
     if not args.yes:
         if not questionary.confirm(
@@ -1207,6 +1236,19 @@ def cmd_delete(args):
             console.print("[yellow]Cancelled.[/]")
             return
 
+    cloner = SelectiveVMCloner(user_session=getattr(args, "user", False))
+    delete_storage = not getattr(args, "keep_storage", False)
+    console.print(f"[cyan]🗑️ Deleting VM: {name}[/]")
+    try:
+        ok = cloner.delete_vm(
+            name, delete_storage=delete_storage, console=console, approved=getattr(args, "approve", False)
+        )
+        if not ok:
+            sys.exit(1)
+    except Exception as e:
+        console.print(f"[red]❌ Failed to delete VM: {e}[/]")
+        sys.exit(1)
+
 
 def cmd_list(args):
     """List all VMs."""
@@ -1418,7 +1460,12 @@ def cmd_export(args):
     # If name is a path, load config
     if name and (name.startswith(".") or name.startswith("/") or name.startswith("~")):
         target_path = Path(name).expanduser().resolve()
-        config_file = target_path / ".clonebox.yaml" if target_path.is_dir() else target_path
+
+        if target_path.is_dir():
+            config_file = target_path / CLONEBOX_CONFIG_FILE
+        else:
+            config_file = target_path
+
         if config_file.exists():
             config = load_clonebox_config(config_file)
             name = config["vm"]["name"]
@@ -1649,6 +1696,16 @@ def cmd_import(args):
                     f"[red]❌ VM '{vm_name}' already exists. Use --replace to overwrite.[/]"
                 )
                 return
+            policy = PolicyEngine.load_effective(start=vm_storage)
+            if policy is not None:
+                try:
+                    policy.assert_operation_approved(
+                        AuditEventType.VM_DELETE.value,
+                        approved=getattr(args, "approve", False),
+                    )
+                except PolicyViolationError as e:
+                    console.print(f"[red]❌ {e}[/]")
+                    sys.exit(1)
             shutil.rmtree(vm_storage)
 
         vm_storage.mkdir(parents=True)
@@ -1811,7 +1868,7 @@ def cmd_test(args):
     console.print()
 
     # Test 2: Check VM state
-    console.print("[bold]2. VM State Check[/]")
+    cloud_init_running = False
     try:
         result = subprocess.run(
             ["virsh", "--connect", conn_uri, "domstate", vm_name],
@@ -1820,17 +1877,37 @@ def cmd_test(args):
             timeout=10,
         )
         state = result.stdout.strip()
+
         if state == "running":
             console.print("[green]✅ VM is running[/]")
 
             # Give QEMU Guest Agent some time to come up (common during early boot)
             qga_ready = _qga_ping(vm_name, conn_uri)
             if not qga_ready:
-                for _ in range(12):  # ~60s
+                console.print("[yellow]⏳ Waiting for QEMU Guest Agent (up to 60s)...[/]")
+                qga_wait_start = time.time()
+                for attempt in range(12):  # ~60s
                     time.sleep(5)
                     qga_ready = _qga_ping(vm_name, conn_uri)
+                    elapsed = int(time.time() - qga_wait_start)
                     if qga_ready:
+                        console.print(f"[green]✅ QEMU Guest Agent connected after {elapsed}s[/]")
                         break
+                    if attempt % 2 == 1:
+                        console.print(f"[dim]   ...still waiting ({elapsed}s elapsed)[/]")
+
+                if not qga_ready:
+                    console.print("[yellow]⚠️  QEMU Guest Agent still not connected[/]")
+            
+            # Check cloud-init status immediately if QGA is ready
+            if qga_ready:
+                console.print("[dim]   Checking cloud-init status via QGA...[/]")
+                status = _qga_exec(
+                    vm_name, conn_uri, "cloud-init status 2>/dev/null || true", timeout=15
+                )
+                if status and "running" in status.lower():
+                    cloud_init_running = True
+                    console.print("[yellow]⏳ Setup in progress (cloud-init is running)[/]")
 
             # Test network if running
             console.print("\n   Checking network...")
@@ -1859,8 +1936,9 @@ def cmd_test(args):
                                 timeout=5,
                             )
                             if ip_out and ip_out.strip():
+                                ip_clean = ip_out.strip().replace("\n", ", ")
                                 console.print(
-                                    f"[green]✅ VM has network access (IP via QGA: {ip_out.strip()})[/]"
+                                    f"[green]✅ VM has network access (IP via QGA: {ip_clean})[/]"
                                 )
                             else:
                                 console.print("[yellow]⚠️  IP not available via QGA[/]")
@@ -1880,14 +1958,15 @@ def cmd_test(args):
 
     # Test 3: Check cloud-init status (if running)
     cloud_init_complete: Optional[bool] = None
-    cloud_init_running: bool = False
     if not quick and state == "running":
         console.print("[bold]3. Cloud-init Status[/]")
         try:
             if not qga_ready:
                 console.print("[yellow]⚠️  Cloud-init status unknown (QEMU Guest Agent not connected)[/]")
             else:
-                status = _qga_exec(vm_name, conn_uri, "cloud-init status 2>/dev/null || true", timeout=15)
+                status = _qga_exec(
+                    vm_name, conn_uri, "cloud-init status 2>/dev/null || true", timeout=15
+                )
                 if status is None:
                     console.print("[yellow]⚠️  Could not check cloud-init (QGA command failed)[/]")
                     cloud_init_complete = None
@@ -1914,9 +1993,11 @@ def cmd_test(args):
     if not quick and state == "running":
         console.print("[bold]4. Mount Points Check[/]")
         paths = config.get("paths", {})
-        app_data_paths = config.get("app_data_paths", {})
+        copy_paths = config.get("copy_paths", None)
+        if not isinstance(copy_paths, dict) or not copy_paths:
+            copy_paths = config.get("app_data_paths", {})
 
-        if paths or app_data_paths:
+        if paths or copy_paths:
             if not _qga_ping(vm_name, conn_uri):
                 console.print("[yellow]⚠️  QEMU guest agent not connected - cannot verify mounts[/]")
             else:
@@ -1938,7 +2019,7 @@ def cmd_test(args):
                         console.print(f"[yellow]⚠️  {guest_path} (could not check)[/]")
                 
                 # Check copied paths
-                for idx, (host_path, guest_path) in enumerate(app_data_paths.items()):
+                for idx, (host_path, guest_path) in enumerate(copy_paths.items()):
                     try:
                         is_accessible = _qga_exec(
                             vm_name, conn_uri, f"test -d {guest_path} && echo yes || echo no", timeout=5
@@ -1965,23 +2046,14 @@ def cmd_test(args):
                 console.print("[yellow]⚠️  QEMU Guest Agent not connected - cannot run health check[/]")
             else:
                 exists = _qga_exec(
-                    vm_name,
-                    conn_uri,
-                    "test -x /usr/local/bin/clonebox-health && echo yes || echo no",
-                    timeout=10,
+                    vm_name, conn_uri, "test -x /usr/local/bin/clonebox-health && echo yes || echo no", timeout=10
                 )
                 if exists and exists.strip() == "yes":
                     _qga_exec(
-                        vm_name,
-                        conn_uri,
-                        "/usr/local/bin/clonebox-health >/dev/null 2>&1 || true",
-                        timeout=60,
+                        vm_name, conn_uri, "/usr/local/bin/clonebox-health >/dev/null 2>&1 || true", timeout=60
                     )
                     health_status = _qga_exec(
-                        vm_name,
-                        conn_uri,
-                        "cat /var/log/clonebox-health-status 2>/dev/null || true",
-                        timeout=10,
+                        vm_name, conn_uri, "cat /var/log/clonebox-health-status 2>/dev/null || true", timeout=10
                     )
                     if health_status and "HEALTH_STATUS=OK" in health_status:
                         console.print("[green]✅ Health check passed[/]")
@@ -1999,9 +2071,6 @@ def cmd_test(args):
                     else:
                         console.print("[yellow]⚠️  Health check status not available yet[/]")
                         console.print("   View logs in VM: cat /var/log/clonebox-health.log")
-                else:
-                    console.print("[yellow]⚠️  Health check script not found[/]")
-                    console.print("   This is expected until cloud-init completes")
         except Exception as e:
             console.print(f"[yellow]⚠️  Could not run health check: {e}[/]")
 
@@ -2009,6 +2078,8 @@ def cmd_test(args):
 
     # Run full validation if requested
     if validate_all and state == "running":
+        console.print("[bold cyan]🔎 Starting deep validation (--validate)[/]")
+        console.print("[dim]This can take a few minutes on first boot (waiting for QGA/cloud-init, checking packages/services).[/]")
         validator = VMValidator(
             config,
             vm_name,
@@ -2147,11 +2218,11 @@ def generate_clonebox_yaml(
     paths_by_type = {"project": [], "config": [], "data": []}
     for p in snapshot.paths:
         if p.type in paths_by_type:
-            paths_by_type[p.type].append(p.path)
+            paths_by_type[p.type].append(p)
 
     if deduplicate:
         for ptype in paths_by_type:
-            paths_by_type[ptype] = deduplicate_list(paths_by_type[ptype])
+            paths_by_type[ptype] = deduplicate_list(paths_by_type[ptype], key=lambda x: x.path)
 
     # Collect working directories from running apps
     working_dirs = []
@@ -2172,7 +2243,8 @@ def generate_clonebox_yaml(
     # Build paths mapping
     paths_mapping = {}
     idx = 0
-    for host_path in paths_by_type["project"][:5]:  # Limit projects
+    for host_path_obj in paths_by_type["project"][:5]:  # Limit projects
+        host_path = host_path_obj.path if hasattr(host_path_obj, 'path') else host_path_obj
         paths_mapping[host_path] = f"/mnt/project{idx}"
         idx += 1
 
@@ -2254,10 +2326,6 @@ def generate_clonebox_yaml(
     if deduplicate:
         all_snap_packages = deduplicate_list(all_snap_packages)
 
-    if chrome_profile.exists() and "google-chrome" not in [d.get("app", "") for d in app_data_dirs]:
-        if "chromium" not in all_snap_packages:
-            all_snap_packages.append("chromium")
-
     if "pycharm-community" in all_snap_packages:
         remapped = {}
         for host_path, guest_path in app_data_mapping.items():
@@ -2315,9 +2383,9 @@ def generate_clonebox_yaml(
                 for d in app_data_dirs[:15]
             ],
             "all_paths": {
-                "projects": list(paths_by_type["project"]),
-                "configs": list(paths_by_type["config"][:5]),
-                "data": list(paths_by_type["data"][:5]),
+                "projects": [{"path": p.path if hasattr(p, 'path') else p, "type": p.type if hasattr(p, 'type') else 'project', "size_mb": p.size_mb if hasattr(p, 'size_mb') else 0} for p in paths_by_type["project"]],
+                "configs": [{"path": p.path, "type": p.type, "size_mb": p.size_mb} for p in paths_by_type["config"][:5]],
+                "data": [{"path": p.path, "type": p.type, "size_mb": p.size_mb} for p in paths_by_type["data"][:5]],
             },
         },
     }
@@ -2417,7 +2485,7 @@ def _exec_in_vm_qga(vm_name: str, conn_uri: str, command: str) -> Optional[str]:
         return None
 
 
-def monitor_cloud_init_status(vm_name: str, user_session: bool = False, timeout: int = 900):
+def monitor_cloud_init_status(vm_name: str, user_session: bool = False, timeout: int = 1800):
     """Monitor cloud-init status in VM and show progress."""
     import subprocess
     import time
@@ -2429,582 +2497,454 @@ def monitor_cloud_init_status(vm_name: str, user_session: bool = False, timeout:
     last_phases = []
     seen_lines = set()
 
-    with Progress(
-        SpinnerColumn(),
-        TextColumn("[progress.description]{task.description}"),
-        console=console,
-    ) as progress:
-        task = progress.add_task("[cyan]Starting VM and initializing...", total=None)
-
-        while time.time() - start_time < timeout:
-            try:
-                elapsed = int(time.time() - start_time)
-                minutes = elapsed // 60
-                seconds = elapsed % 60
-
-                # Check VM state
-                result = subprocess.run(
-                    ["virsh", "--connect", conn_uri, "domstate", vm_name],
-                    capture_output=True,
-                    text=True,
-                    timeout=5,
-                )
+    refresh = 1.0
+    once = False
+    monitor = ResourceMonitor(conn_uri=conn_uri)
 
-                vm_state = result.stdout.strip().lower()
-
-                if "shut off" in vm_state or "shutting down" in vm_state:
-                    # VM is shutting down - count consecutive detections
-                    shutdown_count += 1
-                    if shutdown_count >= 3 and not restart_detected:
-                        # Confirmed shutdown after 3 consecutive checks
-                        restart_detected = True
-                        progress.update(
-                            task,
-                            description="[yellow]⟳ VM restarting after installation...",
+    try:
+        with Progress(
+            SpinnerColumn(),
+            TextColumn("[progress.description]{task.description}"),
+            console=console,
+        ) as progress:
+            task = progress.add_task("[cyan]Starting VM and initializing...", total=None)
+
+            while time.time() - start_time < timeout:
+                # Clear screen for live update
+                if not progress.finished:
+                    console.clear()
+
+                console.print("[bold cyan]📊 CloneBox Resource Monitor[/]")
+                console.print()
+
+                # VM Stats
+                vm_stats = monitor.get_all_vm_stats()
+                if vm_stats:
+                    table = Table(title="🖥️ Virtual Machines", border_style="cyan")
+                    table.add_column("Name", style="bold")
+                    table.add_column("State")
+                    table.add_column("CPU %")
+                    table.add_column("Memory")
+                    table.add_column("Disk")
+                    table.add_column("Network I/O")
+
+                    for vm in vm_stats:
+                        state_color = "green" if vm.state == "running" else "yellow"
+                        cpu_color = "red" if vm.cpu_percent > 80 else "green"
+                        mem_pct = (
+                            (vm.memory_used_mb / vm.memory_total_mb * 100)
+                            if vm.memory_total_mb > 0
+                            else 0
                         )
-                    time.sleep(3)
-                    continue
-                else:
-                    # VM is running - reset shutdown counter
-                    if shutdown_count > 0 and shutdown_count < 3:
-                        # Was a brief glitch, not a real shutdown
-                        shutdown_count = 0
-
-                if restart_detected and "running" in vm_state and shutdown_count >= 3:
-                    # VM restarted successfully - GUI should be ready
-                    progress.update(
-                        task, description=f"[green]✓ VM ready! Total time: {minutes}m {seconds}s"
-                    )
-                    time.sleep(2)
-                    break
-
-                # Estimate remaining time (total ~12-15 minutes for full desktop install)
-                if elapsed < 60:
-                    remaining = "~12-15 minutes"
-                elif elapsed < 300:
-                    remaining = f"~{12 - minutes} minutes"
-                elif elapsed < 600:
-                    remaining = f"~{10 - minutes} minutes"
-                elif elapsed < 800:
-                    remaining = "finishing soon..."
+                        mem_color = "red" if mem_pct > 80 else "green"
+
+                        table.add_row(
+                            vm.name,
+                            f"[{state_color}]{vm.state}[/]",
+                            f"[{cpu_color}]{vm.cpu_percent:.1f}%[/]",
+                            f"[{mem_color}]{vm.memory_used_mb}/{vm.memory_total_mb} MB[/]",
+                            f"{vm.disk_used_gb:.1f}/{vm.disk_total_gb:.1f} GB",
+                            f"↓{format_bytes(vm.network_rx_bytes)} ↑{format_bytes(vm.network_tx_bytes)}",
+                        )
+                    console.print(table)
                 else:
-                    remaining = "almost done"
-
-                # Try to get real-time progress via QGA
-                # Get last 3 unique progress lines
-                raw_info = _exec_in_vm_qga(
-                    vm_name, 
-                    conn_uri, 
-                    "grep -E '\\[[0-9]/[0-9]\\]|→' /var/log/cloud-init-output.log 2>/dev/null | tail -n 5"
-                )
-                
-                # Check disk space in real-time
-                disk_info = _exec_in_vm_qga(
-                    vm_name,
-                    conn_uri,
-                    "df / --output=pcent | tail -n 1 | tr -dc '0-9'"
-                )
-                if disk_info and disk_info.isdigit():
-                    usage = int(disk_info)
-                    if usage > 90:
-                        console.print(f"[bold red]⚠️  WARNING: VM Disk is nearly full ({usage}%)![/]")
-                        console.print("[red]   Installation may fail. Consider increasing --disk-size-gb.[/]")
-                
-                if raw_info:
-                    lines = [l.strip() for l in raw_info.strip().split('\n') if l.strip()]
-                    for line in lines:
-                        if line not in seen_lines:
-                            # If it's a new phase line, we can log it to console above the progress bar
-                            if "[" in line and "/9]" in line:
-                                console.print(f"[dim]  {line}[/]")
-                            seen_lines.add(line)
-                            last_phases.append(line)
-                    
-                    # Keep only last 2 for the progress bar description
-                    if len(last_phases) > 2:
-                        last_phases = last_phases[-2:]
-
-                if restart_detected:
-                    progress.update(
-                        task,
-                        description=f"[cyan]Finalizing setup... ({minutes}m {seconds}s, {remaining})",
-                    )
-                elif last_phases:
-                    # Show the actual phase from logs
-                    current_status = last_phases[-1]
-                    progress.update(
-                        task,
-                        description=f"[cyan]{current_status} ({minutes}m {seconds}s, {remaining})",
-                    )
+                    console.print("[dim]No VMs found.[/]")
+
+                console.print()
+
+                # Container Stats
+                container_stats = monitor.get_container_stats()
+                if container_stats:
+                    table = Table(title="🐳 Containers", border_style="blue")
+                    table.add_column("Name", style="bold")
+                    table.add_column("State")
+                    table.add_column("CPU %")
+                    table.add_column("Memory")
+                    table.add_column("Network I/O")
+                    table.add_column("PIDs")
+
+                    for c in container_stats:
+                        cpu_color = "red" if c.cpu_percent > 80 else "green"
+                        mem_pct = (
+                            (c.memory_used_mb / c.memory_limit_mb * 100)
+                            if c.memory_limit_mb > 0
+                            else 0
+                        )
+                        mem_color = "red" if mem_pct > 80 else "green"
+
+                        table.add_row(
+                            c.name,
+                            f"[green]{c.state}[/]",
+                            f"[{cpu_color}]{c.cpu_percent:.1f}%[/]",
+                            f"[{mem_color}]{c.memory_used_mb}/{c.memory_limit_mb} MB[/]",
+                            f"↓{format_bytes(c.network_rx_bytes)} ↑{format_bytes(c.network_tx_bytes)}",
+                            str(c.pids),
+                        )
+                    console.print(table)
                 else:
-                    progress.update(
-                        task,
-                        description=f"[cyan]Installing packages... ({minutes}m {seconds}s, {remaining})",
-                    )
+                    console.print("[dim]No containers running.[/]")
 
-            except (subprocess.TimeoutExpired, Exception) as e:
-                elapsed = int(time.time() - start_time)
-                minutes = elapsed // 60
-                seconds = elapsed % 60
-                progress.update(
-                    task, description=f"[cyan]Configuring VM... ({minutes}m {seconds}s)"
-                )
+                if once:
+                    break
 
-            time.sleep(3)
+                console.print(f"\n[dim]Refreshing every {refresh}s. Press Ctrl+C to exit.[/]")
+                time.sleep(refresh)
 
-        # Final status
-        if time.time() - start_time >= timeout:
-            progress.update(
-                task, description="[yellow]⚠ Monitoring timeout - VM continues in background"
-            )
+    except KeyboardInterrupt:
+        console.print("\n[yellow]Monitoring stopped.[/]")
+    finally:
+        monitor.close()
 
 
-def create_vm_from_config(
-    config: dict,
-    start: bool = False,
-    user_session: bool = False,
-    replace: bool = False,
-) -> str:
-    """Create VM from YAML config dict."""
-    paths = config.get("paths", {})
-    # Backwards compatible: v1 uses app_data_paths, newer configs may use copy_paths
-    copy_paths = config.get("copy_paths", None)
-    if not isinstance(copy_paths, dict) or not copy_paths:
-        copy_paths = config.get("app_data_paths", {})
-
-    vm_section = config.get("vm") or {}
-    
-    # Support both v1 (auth_method) and v2 (auth.method) config formats
-    auth_section = vm_section.get("auth") or {}
-    auth_method = auth_section.get("method") or vm_section.get("auth_method") or "ssh_key"
-    
-    # v2 config: secrets provider
-    secrets_section = config.get("secrets") or {}
-    secrets_provider = secrets_section.get("provider", "auto")
+def create_vm_from_config(config, start=False, user_session=False, replace=False, approved=False):
+    """Create VM from configuration dict."""
+    vm_config_dict = config.get("vm", {})
     
-    # v2 config: resource limits
-    limits_section = config.get("limits") or {}
-    resources = {
-        "memory_limit": limits_section.get("memory_limit"),
-        "cpu_shares": limits_section.get("cpu_shares"),
-        "disk_limit": limits_section.get("disk_limit"),
-        "network_limit": limits_section.get("network_limit"),
-    }
-    # Remove None values
-    resources = {k: v for k, v in resources.items() if v is not None}
-
+    # Create VMConfig object
     vm_config = VMConfig(
-        name=config["vm"]["name"],
-        ram_mb=config["vm"].get("ram_mb", 8192),
-        vcpus=config["vm"].get("vcpus", 8),
-        disk_size_gb=config["vm"].get("disk_size_gb", 10),
-        gui=config["vm"].get("gui", True),
-        base_image=config["vm"].get("base_image"),
-        paths=paths,
-        copy_paths=copy_paths,
+        name=vm_config_dict.get("name", "clonebox-vm"),
+        ram_mb=vm_config_dict.get("ram_mb", 8192),
+        vcpus=vm_config_dict.get("vcpus", 4),
+        disk_size_gb=vm_config_dict.get("disk_size_gb", 20),
+        gui=vm_config_dict.get("gui", True),
+        base_image=vm_config_dict.get("base_image"),
+        network_mode=vm_config_dict.get("network_mode", "auto"),
+        username=vm_config_dict.get("username", "ubuntu"),
+        password=vm_config_dict.get("password", "ubuntu"),
+        user_session=user_session,
+        paths=config.get("paths", {}),
         packages=config.get("packages", []),
         snap_packages=config.get("snap_packages", []),
         services=config.get("services", []),
         post_commands=config.get("post_commands", []),
-        user_session=user_session,
-        network_mode=config["vm"].get("network_mode", "auto"),
-        username=config["vm"].get("username", "ubuntu"),
-        password=config["vm"].get("password", "ubuntu"),
-        auth_method=auth_method,
-        ssh_public_key=vm_section.get("ssh_public_key") or auth_section.get("ssh_public_key"),
-        resources=resources if resources else config["vm"].get("resources", {}),
+        copy_paths=(config.get("copy_paths") or config.get("app_data_paths") or {}),
+        resources=config.get("resources", {}),
     )
-
+    
     cloner = SelectiveVMCloner(user_session=user_session)
-
-    # Check prerequisites and show detailed info
+    
+    # Check prerequisites
     checks = cloner.check_prerequisites()
-
-    if not checks["images_dir_writable"]:
-        console.print(f"[yellow]⚠️  Storage directory: {checks['images_dir']}[/]")
-        if "images_dir_error" in checks:
-            console.print(f"[red]{checks['images_dir_error']}[/]")
-            raise PermissionError(checks["images_dir_error"])
-
-    console.print(f"[dim]Session: {checks['session_type']}, Storage: {checks['images_dir']}[/]")
-
-    vm_uuid = cloner.create_vm(vm_config, console=console, replace=replace)
-
+    if not all(checks.values()):
+        console.print("[yellow]⚠️  Prerequisites check:[/]")
+        for check, passed in checks.items():
+            icon = "✅" if passed else "❌"
+            console.print(f"   {icon} {check}")
+    
+    # Create VM
+    vm_uuid = cloner.create_vm(
+        vm_config,
+        replace=replace,
+        console=console,
+        approved=approved,
+    )
+    
     if start:
-        cloner.start_vm(vm_config.name, open_viewer=vm_config.gui, console=console)
-
-        # Monitor cloud-init progress if GUI is enabled
-        if vm_config.gui:
-            console.print("\n[bold cyan]📊 Monitoring setup progress...[/]")
-            try:
-                monitor_cloud_init_status(vm_config.name, user_session=user_session)
-            except KeyboardInterrupt:
-                console.print("\n[yellow]Monitoring stopped. VM continues setup in background.[/]")
-            except Exception as e:
-                console.print(
-                    f"\n[dim]Note: Could not monitor status ({e}). VM continues setup in background.[/]"
-                )
-
+        cloner.start_vm(vm_config.name, open_viewer=True, console=console)
+    
     return vm_uuid
 
 
-def cmd_clone(args):
+def cmd_clone(args) -> None:
     """Generate clone config from path and optionally create VM."""
-    target_path = Path(args.path).resolve()
-    dry_run = getattr(args, "dry_run", False)
-
+    from clonebox.detector import SystemDetector
+    
+    target_path = Path(args.path).expanduser().resolve() if args.path else Path.cwd()
+    
     if not target_path.exists():
         console.print(f"[red]❌ Path does not exist: {target_path}[/]")
         return
-
-    if dry_run:
-        console.print(f"[bold cyan]🔍 DRY RUN - Analyzing: {target_path}[/]\n")
-    else:
-        console.print(f"[bold cyan]📦 Generating clone config for: {target_path}[/]\n")
-
+    
+    console.print(f"[cyan]🔍 Analyzing system for cloning...[/]")
+    
     # Detect system state
+    detector = SystemDetector()
+    
     with Progress(
         SpinnerColumn(),
         TextColumn("[progress.description]{task.description}"),
         console=console,
-        transient=True,
     ) as progress:
-        progress.add_task("Scanning system...", total=None)
-        detector = SystemDetector()
+        task = progress.add_task("Scanning system...", total=None)
+        
+        # Take snapshot
         snapshot = detector.detect_all()
-
+        
+        # Detect Docker containers
+        containers = detector.detect_docker_containers()
+        
+        progress.update(task, description="Finalizing...")
+    
     # Generate config
-    vm_name = args.name or f"clone-{target_path.name}"
     yaml_content = generate_clonebox_yaml(
         snapshot,
         detector,
         deduplicate=args.dedupe,
-        target_path=str(target_path),
-        vm_name=vm_name,
+        target_path=str(target_path) if args.path else None,
+        vm_name=args.name,
         network_mode=args.network,
-        base_image=getattr(args, "base_image", None),
-        disk_size_gb=getattr(args, "disk_size_gb", None),
+        base_image=args.base_image,
+        disk_size_gb=args.disk_size_gb,
     )
-
-    profile_name = getattr(args, "profile", None)
-    if profile_name:
-        merged_config = merge_with_profile(yaml.safe_load(yaml_content), profile_name)
-        if isinstance(merged_config, dict):
-            vm_section = merged_config.get("vm")
-            if isinstance(vm_section, dict):
-                vm_packages = vm_section.pop("packages", None)
-                if isinstance(vm_packages, list):
-                    packages = merged_config.get("packages")
-                    if not isinstance(packages, list):
-                        packages = []
-                    for p in vm_packages:
-                        if p not in packages:
-                            packages.append(p)
-                    merged_config["packages"] = packages
-
-            if "container" in merged_config:
-                merged_config.pop("container", None)
-
-            yaml_content = yaml.dump(
-                merged_config,
-                default_flow_style=False,
-                allow_unicode=True,
-                sort_keys=False,
-            )
-
-    # Dry run - show what would be created and exit
-    if dry_run:
-        config = yaml.safe_load(yaml_content)
-        console.print(
-            Panel(
-                f"[bold]VM Name:[/] {config['vm']['name']}\n"
-                f"[bold]RAM:[/] {config['vm'].get('ram_mb', 4096)} MB\n"
-                f"[bold]vCPUs:[/] {config['vm'].get('vcpus', 4)}\n"
-                f"[bold]Network:[/] {config['vm'].get('network_mode', 'auto')}\n"
-                f"[bold]Paths:[/] {len(config.get('paths', {}))} mounts\n"
-                f"[bold]Packages:[/] {len(config.get('packages', []))} packages\n"
-                f"[bold]Services:[/] {len(config.get('services', []))} services",
-                title="[bold cyan]Would create VM[/]",
-                border_style="cyan",
-            )
-        )
-        console.print("\n[dim]Config preview:[/]")
-        console.print(Panel(yaml_content, title="[bold].clonebox.yaml[/]", border_style="dim"))
-        console.print("\n[yellow]ℹ️  Dry run complete. No changes made.[/]")
-        return
-
+    
     # Save config file
-    config_file = (
-        target_path / CLONEBOX_CONFIG_FILE
-        if target_path.is_dir()
-        else target_path.parent / CLONEBOX_CONFIG_FILE
-    )
-    config_file.write_text(yaml_content)
-    console.print(f"[green]✅ Config saved: {config_file}[/]\n")
-
-    # Show config
-    console.print(Panel(yaml_content, title="[bold].clonebox.yaml[/]", border_style="cyan"))
-
-    # Open in editor if requested
+    config_file = target_path / CLONEBOX_CONFIG_FILE
+    
+    if config_file.exists() and not args.replace:
+        console.print(f"[yellow]⚠️  Config file already exists: {config_file}[/]")
+        if not questionary.confirm(
+            "Overwrite existing config?", default=False, style=custom_style
+        ).ask():
+            console.print("[dim]Cancelled.[/]")
+            return
+    
+    with open(config_file, "w") as f:
+        f.write(yaml_content)
+    
+    console.print(f"[green]✅ Config saved to: {config_file}[/]")
+    
+    # Edit if requested
     if args.edit:
         editor = os.environ.get("EDITOR", "nano")
-        console.print(f"[cyan]Opening {editor}...[/]")
         os.system(f"{editor} {config_file}")
-        # Reload after edit
-        yaml_content = config_file.read_text()
-
-    # Ask to create VM
+    
+    # Run VM if requested
     if args.run:
-        create_now = True
-    else:
-        create_now = questionary.confirm(
-            "Create VM with this config?", default=True, style=custom_style
-        ).ask()
-
-    if create_now:
-        # Load config with environment variable expansion
-        config = load_clonebox_config(config_file.parent)
-        user_session = getattr(args, "user", False)
-
-        console.print("\n[bold cyan]🔧 Creating VM...[/]\n")
-        if user_session:
-            console.print("[cyan]Using user session (qemu:///session) - no root required[/]")
-
-        try:
-            vm_uuid = create_vm_from_config(
-                config,
-                start=True,
-                user_session=user_session,
-                replace=getattr(args, "replace", False),
-            )
-            console.print(f"\n[bold green]🎉 VM '{config['vm']['name']}' is running![/]")
-            console.print(f"[dim]UUID: {vm_uuid}[/]")
-
-            # Show GUI startup info if GUI is enabled
-            if config.get("vm", {}).get("gui", False):
-                username = config["vm"].get("username", "ubuntu")
-                password = config["vm"].get("password", "ubuntu")
-                console.print("\n[bold yellow]⏰ GUI Setup Process:[/]")
-                console.print("  [yellow]•[/] Installing desktop environment (~5-10 minutes)")
-                console.print("  [yellow]•[/] Running health checks on all components")
-                console.print("  [yellow]•[/] Automatic restart after installation")
-                console.print("  [yellow]•[/] GUI login screen will appear")
-                console.print(
-                    f"  [yellow]•[/] Login: [cyan]{username}[/] / [cyan]{'*' * len(password)}[/] (from .env)"
-                )
-                console.print("\n[dim]💡 Progress will be monitored automatically below[/]")
-
-            # Show health check info
-            console.print("\n[bold]📊 Health Check (inside VM):[/]")
-            console.print("  [cyan]cat /var/log/clonebox-health.log[/]  # View full report")
-            console.print("  [cyan]cat /var/log/clonebox-health-status[/]  # Quick status")
-            console.print("  [cyan]clonebox-health[/]  # Re-run health check")
-
-            # Show mount instructions
-            paths = config.get("paths", {})
-            app_data_paths = config.get("app_data_paths", {})
-
-            if paths:
-                console.print("\n[bold]📁 Mounted paths (shared live):[/]")
-                for idx, (host, guest) in enumerate(list(paths.items())[:5]):
-                    console.print(f"  [dim]{host}[/] → [cyan]{guest}[/]")
-                if len(paths) > 5:
-                    console.print(f"  [dim]... and {len(paths) - 5} more paths[/]")
-
-            if app_data_paths:
-                console.print("\n[bold]📥 Copied paths (one-time import):[/]")
-                for idx, (host, guest) in enumerate(list(app_data_paths.items())[:5]):
-                    console.print(f"  [dim]{host}[/] → [cyan]{guest}[/]")
-                if len(app_data_paths) > 5:
-                    console.print(f"  [dim]... and {len(app_data_paths) - 5} more paths[/]")
-        except PermissionError as e:
-            console.print(f"[red]❌ Permission Error:[/]\n{e}")
-            console.print("\n[yellow]💡 Try running with --user flag:[/]")
-            console.print(f"  [cyan]clonebox clone {target_path} --user[/]")
-        except Exception as e:
-            console.print(f"[red]❌ Error: {e}[/]")
-    else:
-        console.print("\n[dim]To create VM later, run:[/]")
-        console.print(f"  [cyan]clonebox start {target_path}[/]")
+        console.print("[cyan]🚀 Creating VM from config...[/]")
+        config = load_clonebox_config(config_file)
+        vm_uuid = create_vm_from_config(
+            config, start=True, user_session=args.user, replace=args.replace, approved=args.approve
+        )
+        console.print(f"[green]✅ VM created: {vm_uuid}[/]")
 
 
-def cmd_detect(args):
+def cmd_detect(args) -> None:
     """Detect and show system state."""
-    console.print("[bold cyan]🔍 Detecting system state...[/]\n")
-
-    detector = SystemDetector()
-    snapshot = detector.detect_all()
-
-    # JSON output
-    if args.json:
-        result = {
-            "services": [{"name": s.name, "status": s.status} for s in snapshot.running_services],
+    from clonebox.detector import SystemDetector
+    
+    console.print("[cyan]🔍 Detecting system state...[/]")
+    
+    try:
+        detector = SystemDetector()
+        
+        # Detect system info
+        sys_info = detector.get_system_info()
+        
+        # Detect all services, apps, and paths
+        snapshot = detector.detect_all()
+        
+        # Detect Docker containers
+        containers = detector.detect_docker_containers()
+        
+        # Prepare output
+        output = {
+            "system": sys_info,
+            "services": [
+                {
+                    "name": s.name,
+                    "status": s.status,
+                    "enabled": s.enabled,
+                    "description": s.description,
+                }
+                for s in snapshot.running_services
+            ],
             "applications": [
-                {"name": a.name, "pid": a.pid, "cwd": a.working_dir} for a in snapshot.applications
+                {
+                    "name": a.name,
+                    "pid": a.pid,
+                    "memory_mb": round(a.memory_mb, 2),
+                    "working_dir": a.working_dir or "",
+                }
+                for a in snapshot.applications
             ],
             "paths": [
-                {"path": p.path, "type": p.type, "size_mb": p.size_mb} for p in snapshot.paths
+                {"path": p.path, "type": p.type, "size_mb": p.size_mb}
+                for p in snapshot.paths
+            ],
+            "docker_containers": [
+                {
+                    "name": c["name"],
+                    "status": c["status"],
+                    "image": c["image"],
+                    "ports": c.get("ports", ""),
+                }
+                for c in containers
             ],
         }
-        print(json.dumps(result, indent=2))
-        return
-
-    # YAML output
-    if args.yaml:
-        result = generate_clonebox_yaml(snapshot, detector, deduplicate=args.dedupe)
-
+        
+        # Apply deduplication if requested
+        if args.dedupe:
+            output["services"] = deduplicate_list(output["services"], key=lambda x: x["name"])
+            output["applications"] = deduplicate_list(output["applications"], key=lambda x: (x["name"], x["pid"]))
+            output["paths"] = deduplicate_list(output["paths"], key=lambda x: x["path"])
+        
+        # Format output
+        if args.json:
+            content = json.dumps(output, indent=2)
+        elif args.yaml:
+            content = yaml.dump(output, default_flow_style=False, allow_unicode=True)
+        else:
+            # Pretty print
+            content = format_detection_output(output, sys_info)
+        
+        # Save to file or print
         if args.output:
-            output_path = Path(args.output)
-            output_path.write_text(result)
-            console.print(f"[green]✅ Config saved to: {output_path}[/]")
+            with open(args.output, "w") as f:
+                f.write(content)
+            console.print(f"[green]✅ Output saved to: {args.output}[/]")
         else:
-            print(result)
-        return
-
-    # Services
-    services = detector.detect_services()
-    running = [s for s in services if s.status == "running"]
-
-    if running:
-        table = Table(title="Running Services", border_style="green")
-        table.add_column("Service")
-        table.add_column("Status")
-        table.add_column("Enabled")
-
-        for svc in running:
-            table.add_row(svc.name, f"[green]{svc.status}[/]", "✓" if svc.enabled else "")
-
-        console.print(table)
-
-    # Applications
-    apps = detector.detect_applications()
-
-    if apps:
-        console.print()
-        table = Table(title="Running Applications", border_style="blue")
-        table.add_column("Name")
-        table.add_column("PID")
-        table.add_column("Memory")
-        table.add_column("Working Dir")
-
-        for app in apps[:15]:
-            table.add_row(
-                app.name,
-                str(app.pid),
-                f"{app.memory_mb:.0f} MB",
-                app.working_dir[:40] if app.working_dir else "",
-            )
-
-        console.print(table)
-
-    # Paths
-    paths = detector.detect_paths()
-
-    if paths:
-        console.print()
-        table = Table(title="Detected Paths", border_style="yellow")
-        table.add_column("Type")
-        table.add_column("Path")
-        table.add_column("Size")
+            console.print(content)
+    
+    except Exception as e:
+        console.print(f"[red]Error: {e}[/]")
+        import traceback
+        traceback.print_exc()
 
-        for p in paths[:20]:
-            table.add_row(
-                f"[cyan]{p.type}[/]", p.path, f"{p.size_mb:.0f} MB" if p.size_mb > 0 else "-"
-            )
 
-        console.print(table)
+def format_detection_output(output, sys_info):
+    """Format detection output for console display."""
+    from rich.table import Table
+    from rich.text import Text
+    
+    # System info
+    system_text = Text()
+    system_text.append(f"Hostname: {sys_info['hostname']}\n", style="bold")
+    system_text.append(f"User: {sys_info['user']}\n")
+    system_text.append(f"CPU: {sys_info['cpu_count']} cores\n")
+    system_text.append(
+        f"Memory: {sys_info['memory_total_gb']:.1f} GB total, {sys_info['memory_available_gb']:.1f} GB available\n"
+    )
+    system_text.append(
+        f"Disk: {sys_info['disk_total_gb']:.1f} GB total, {sys_info['disk_free_gb']:.1f} GB free"
+    )
+    
+    # Services table
+    services_table = Table(title="Services", show_header=True, header_style="bold magenta")
+    services_table.add_column("Name", style="cyan")
+    services_table.add_column("Status", style="green")
+    services_table.add_column("Enabled", style="yellow")
+    services_table.add_column("Description", style="dim")
+    
+    for svc in output["services"]:
+        status_style = "green" if svc["status"] == "running" else "red"
+        enabled_text = "✓" if svc["enabled"] else "✗"
+        services_table.add_row(
+            svc["name"],
+            Text(svc["status"], style=status_style),
+            enabled_text,
+            svc["description"] or "-",
+        )
+    
+    # Applications table
+    apps_table = Table(title="Applications", show_header=True, header_style="bold magenta")
+    apps_table.add_column("Name", style="cyan")
+    apps_table.add_column("PID", justify="right")
+    apps_table.add_column("Memory (MB)", justify="right")
+    apps_table.add_column("Working Dir", style="dim")
+    
+    for app in output["applications"]:
+        apps_table.add_row(
+            app["name"],
+            str(app["pid"]),
+            f"{app['memory_mb']:.1f}",
+            app["working_dir"] or "-",
+        )
+    
+    # Combine output
+    result = Panel(system_text, title="System Information", border_style="blue")
+    result += "\n\n"
+    result += services_table
+    result += "\n\n"
+    result += apps_table
+    
+    return result
 
 
 def cmd_monitor(args) -> None:
-    """Real-time resource monitoring for VMs and containers."""
-    conn_uri = "qemu:///session" if getattr(args, "user", False) else "qemu:///system"
+    """Real-time resource monitoring."""
+    from clonebox.cloner import SelectiveVMCloner
+    
+    user_session = getattr(args, "user", False)
     refresh = getattr(args, "refresh", 2.0)
     once = getattr(args, "once", False)
-
-    monitor = ResourceMonitor(conn_uri)
-
+    
+    cloner = SelectiveVMCloner(user_session=user_session)
+    
     try:
-        while True:
-            # Clear screen for live update
-            if not once:
-                console.clear()
-
-            console.print("[bold cyan]📊 CloneBox Resource Monitor[/]")
-            console.print()
-
-            # VM Stats
-            vm_stats = monitor.get_all_vm_stats()
-            if vm_stats:
-                table = Table(title="🖥️ Virtual Machines", border_style="cyan")
-                table.add_column("Name", style="bold")
-                table.add_column("State")
-                table.add_column("CPU %")
-                table.add_column("Memory")
-                table.add_column("Disk")
-                table.add_column("Network I/O")
-
-                for vm in vm_stats:
-                    state_color = "green" if vm.state == "running" else "yellow"
-                    cpu_color = "red" if vm.cpu_percent > 80 else "green"
-                    mem_pct = (
-                        (vm.memory_used_mb / vm.memory_total_mb * 100)
-                        if vm.memory_total_mb > 0
-                        else 0
-                    )
-                    mem_color = "red" if mem_pct > 80 else "green"
-
+        vms = cloner.list_vms()
+        
+        if not vms:
+            console.print("[dim]No VMs found.[/]")
+            return
+        
+        # Create monitor
+        monitor = ResourceMonitor(conn_uri="qemu:///session" if user_session else "qemu:///system")
+        
+        if once:
+            # Show stats once
+            table = Table(title="VM Resource Usage", show_header=True, header_style="bold magenta")
+            table.add_column("VM Name", style="cyan")
+            table.add_column("CPU %", justify="right")
+            table.add_column("Memory", justify="right")
+            table.add_column("Disk I/O", justify="right")
+            table.add_column("Network I/O", justify="right")
+            
+            for vm in vms:
+                if vm["state"] == "running":
+                    stats = monitor.get_vm_stats(vm["name"])
                     table.add_row(
-                        vm.name,
-                        f"[{state_color}]{vm.state}[/]",
-                        f"[{cpu_color}]{vm.cpu_percent:.1f}%[/]",
-                        f"[{mem_color}]{vm.memory_used_mb}/{vm.memory_total_mb} MB[/]",
-                        f"{vm.disk_used_gb:.1f}/{vm.disk_total_gb:.1f} GB",
-                        f"↓{format_bytes(vm.network_rx_bytes)} ↑{format_bytes(vm.network_tx_bytes)}",
+                        vm["name"],
+                        f"{stats.get('cpu_percent', 0):.1f}%",
+                        format_bytes(stats.get("memory_usage", 0)),
+                        f"{stats.get('disk_read', 0)}/{stats.get('disk_write', 0)} MB/s",
+                        f"{stats.get('net_rx', 0)}/{stats.get('net_tx', 0)} MB/s",
                     )
-                console.print(table)
-            else:
-                console.print("[dim]No VMs found.[/]")
-
-            console.print()
-
-            # Container Stats
-            container_stats = monitor.get_container_stats()
-            if container_stats:
-                table = Table(title="🐳 Containers", border_style="blue")
-                table.add_column("Name", style="bold")
-                table.add_column("State")
-                table.add_column("CPU %")
-                table.add_column("Memory")
-                table.add_column("Network I/O")
-                table.add_column("PIDs")
-
-                for c in container_stats:
-                    cpu_color = "red" if c.cpu_percent > 80 else "green"
-                    mem_pct = (
-                        (c.memory_used_mb / c.memory_limit_mb * 100) if c.memory_limit_mb > 0 else 0
-                    )
-                    mem_color = "red" if mem_pct > 80 else "green"
-
-                    table.add_row(
-                        c.name,
-                        f"[green]{c.state}[/]",
-                        f"[{cpu_color}]{c.cpu_percent:.1f}%[/]",
-                        f"[{mem_color}]{c.memory_used_mb}/{c.memory_limit_mb} MB[/]",
-                        f"↓{format_bytes(c.network_rx_bytes)} ↑{format_bytes(c.network_tx_bytes)}",
-                        str(c.pids),
+                else:
+                    table.add_row(vm["name"], "[dim]not running[/]", "-", "-", "-")
+            
+            console.print(table)
+        else:
+            # Continuous monitoring
+            console.print(f"[cyan]Monitoring VMs (refresh every {refresh}s). Press Ctrl+C to exit.[/]\n")
+            
+            try:
+                while True:
+                    # Clear screen
+                    console.clear()
+                    
+                    # Create table
+                    table = Table(
+                        title=f"VM Resource Usage - {datetime.now().strftime('%H:%M:%S')}",
+                        show_header=True,
+                        header_style="bold magenta",
                     )
-                console.print(table)
-            else:
-                console.print("[dim]No containers running.[/]")
-
-            if once:
-                break
-
-            console.print(f"\n[dim]Refreshing every {refresh}s. Press Ctrl+C to exit.[/]")
-            time.sleep(refresh)
-
-    except KeyboardInterrupt:
-        console.print("\n[yellow]Monitoring stopped.[/]")
+                    table.add_column("VM Name", style="cyan")
+                    table.add_column("State", style="green")
+                    table.add_column("CPU %", justify="right")
+                    table.add_column("Memory", justify="right")
+                    table.add_column("Disk I/O", justify="right")
+                    table.add_column("Network I/O", justify="right")
+                    
+                    for vm in vms:
+                        if vm["state"] == "running":
+                            stats = monitor.get_vm_stats(vm["name"])
+                            table.add_row(
+                                vm["name"],
+                                vm["state"],
+                                f"{stats.get('cpu_percent', 0):.1f}%",
+                                format_bytes(stats.get("memory_usage", 0)),
+                                f"{stats.get('disk_read', 0):.1f}/{stats.get('disk_write', 0):.1f} MB/s",
+                                f"{stats.get('net_rx', 0):.1f}/{stats.get('net_tx', 0):.1f} MB/s",
+                            )
+                        else:
+                            table.add_row(vm["name"], f"[dim]{vm['state']}[/]", "-", "-", "-", "-")
+                    
+                    console.print(table)
+                    time.sleep(refresh)
+                    
+            except KeyboardInterrupt:
+                console.print("\n[yellow]Monitoring stopped.[/]")
+    
     finally:
         monitor.close()
 
@@ -3159,6 +3099,17 @@ def cmd_snapshot_restore(args) -> None:
     vm_name, config_file = _resolve_vm_name_and_config_file(args.vm_name)
     conn_uri = "qemu:///session" if getattr(args, "user", False) else "qemu:///system"
 
+    policy = PolicyEngine.load_effective(start=config_file)
+    if policy is not None:
+        try:
+            policy.assert_operation_approved(
+                AuditEventType.VM_SNAPSHOT_RESTORE.value,
+                approved=getattr(args, "approve", False),
+            )
+        except PolicyViolationError as e:
+            console.print(f"[red]❌ {e}[/]")
+            sys.exit(1)
+
     console.print(f"[cyan]🔄 Restoring snapshot: {args.name}[/]")
 
     try:
@@ -3364,6 +3315,46 @@ def cmd_list_remote(args) -> None:
         console.print("[yellow]No VMs found on remote host.[/]")
 
 
+def cmd_policy_validate(args) -> None:
+    """Validate a policy file."""
+    try:
+        file_arg = getattr(args, "file", None)
+        if file_arg:
+            policy_path = Path(file_arg).expanduser().resolve()
+        else:
+            policy_path = PolicyEngine.find_policy_file()
+
+        if not policy_path:
+            console.print("[red]❌ Policy file not found[/]")
+            sys.exit(1)
+
+        PolicyEngine.load(policy_path)
+        console.print(f"[green]✅ Policy valid: {policy_path}[/]")
+    except (PolicyValidationError, FileNotFoundError) as e:
+        console.print(f"[red]❌ Policy invalid: {e}[/]")
+        sys.exit(1)
+
+
+def cmd_policy_apply(args) -> None:
+    """Apply a policy file as project or global policy."""
+    try:
+        src = Path(args.file).expanduser().resolve()
+        PolicyEngine.load(src)
+
+        scope = getattr(args, "scope", "project")
+        if scope == "global":
+            dest = Path.home() / ".clonebox.d" / "policy.yaml"
+            dest.parent.mkdir(parents=True, exist_ok=True)
+        else:
+            dest = Path.cwd() / ".clonebox-policy.yaml"
+
+        dest.write_text(src.read_text())
+        console.print(f"[green]✅ Policy applied: {dest}[/]")
+    except (PolicyValidationError, FileNotFoundError) as e:
+        console.print(f"[red]❌ Failed to apply policy: {e}[/]")
+        sys.exit(1)
+
+
 # === Audit Commands ===
 
 
@@ -3930,6 +3921,17 @@ def cmd_remote_delete(args) -> None:
     user_session = getattr(args, "user", False)
     keep_storage = getattr(args, "keep_storage", False)
 
+    policy = PolicyEngine.load_effective()
+    if policy is not None:
+        try:
+            policy.assert_operation_approved(
+                AuditEventType.VM_DELETE.value,
+                approved=getattr(args, "approve", False),
+            )
+        except PolicyViolationError as e:
+            console.print(f"[red]❌ {e}[/]")
+            sys.exit(1)
+
     if not getattr(args, "yes", False):
         confirm = questionary.confirm(
             f"Delete VM '{vm_name}' on {host}?",
@@ -4105,6 +4107,11 @@ def main():
         action="store_true",
         help="Use user session (qemu:///session) - no root required",
     )
+    delete_parser.add_argument(
+        "--approve",
+        action="store_true",
+        help="Approve policy-gated operation",
+    )
     delete_parser.set_defaults(func=cmd_delete)
 
     # List command
@@ -4274,6 +4281,11 @@ def main():
         action="store_true",
         help="If VM already exists, stop+undefine it and recreate (also deletes its storage)",
     )
+    clone_parser.add_argument(
+        "--approve",
+        action="store_true",
+        help="Approve policy-gated operation (required for --replace if policy demands)",
+    )
     clone_parser.add_argument(
         "--dry-run",
         action="store_true",
@@ -4413,14 +4425,12 @@ def main():
     export_parser.add_argument(
         "-u", "--user", action="store_true", help="Use user session (qemu:///session)"
     )
-    export_parser.add_argument(
-        "-o", "--output", help="Output archive filename (default: <vmname>-export.tar.gz)"
-    )
+    export_parser.add_argument("-o", "--output", help="Output archive filename (default: <vmname>-export.tar.gz)")
     export_parser.add_argument(
         "--include-data",
         "-d",
         action="store_true",
-        help="Include shared data (browser profiles, configs) in export",
+        help="Include shared data (browser profiles, configs)",
     )
     export_parser.set_defaults(func=cmd_export)
 
@@ -4433,6 +4443,11 @@ def main():
     import_parser.add_argument(
         "--replace", action="store_true", help="Replace existing VM if exists"
     )
+    import_parser.add_argument(
+        "--approve",
+        action="store_true",
+        help="Approve policy-gated operation (required for --replace if policy demands)",
+    )
     import_parser.set_defaults(func=cmd_import)
 
     # Test command - validate VM configuration
@@ -4512,6 +4527,11 @@ def main():
     snap_restore.add_argument(
         "-f", "--force", action="store_true", help="Force restore even if running"
     )
+    snap_restore.add_argument(
+        "--approve",
+        action="store_true",
+        help="Approve policy-gated operation",
+    )
     snap_restore.set_defaults(func=cmd_snapshot_restore)
 
     snap_delete = snapshot_sub.add_parser("delete", aliases=["rm"], help="Delete snapshot")
@@ -4700,6 +4720,28 @@ def main():
     plugin_uninstall.add_argument("name", help="Plugin name")
     plugin_uninstall.set_defaults(func=cmd_plugin_uninstall)
 
+    policy_parser = subparsers.add_parser("policy", help="Manage security policies")
+    policy_parser.set_defaults(func=lambda args, p=policy_parser: p.print_help())
+    policy_sub = policy_parser.add_subparsers(dest="policy_command", help="Policy commands")
+
+    policy_validate = policy_sub.add_parser("validate", help="Validate policy file")
+    policy_validate.add_argument(
+        "--file",
+        "-f",
+        help="Policy file (default: auto-detect .clonebox-policy.yaml/.yml or ~/.clonebox.d/policy.yaml)",
+    )
+    policy_validate.set_defaults(func=cmd_policy_validate)
+
+    policy_apply = policy_sub.add_parser("apply", help="Apply policy file")
+    policy_apply.add_argument("--file", "-f", required=True, help="Policy file to apply")
+    policy_apply.add_argument(
+        "--scope",
+        choices=["project", "global"],
+        default="project",
+        help="Apply scope: project writes .clonebox-policy.yaml in CWD, global writes ~/.clonebox.d/policy.yaml",
+    )
+    policy_apply.set_defaults(func=cmd_policy_apply)
+
     # === Remote Management Commands ===
     remote_parser = subparsers.add_parser("remote", help="Manage VMs on remote hosts")
     remote_sub = remote_parser.add_subparsers(dest="remote_command", help="Remote commands")
@@ -4735,6 +4777,11 @@ def main():
     remote_delete.add_argument("-u", "--user", action="store_true", help="Use user session on remote")
     remote_delete.add_argument("-y", "--yes", action="store_true", help="Skip confirmation")
     remote_delete.add_argument("--keep-storage", action="store_true", help="Keep disk images")
+    remote_delete.add_argument(
+        "--approve",
+        action="store_true",
+        help="Approve policy-gated operation",
+    )
     remote_delete.set_defaults(func=cmd_remote_delete)
 
     remote_exec = remote_sub.add_parser("exec", help="Execute command in VM on remote host")