silicon-cli 1.0.9__tar.gz → 1.0.12__tar.gz

{silicon_cli-1.0.9/silicon_cli.egg-info → silicon_cli-1.0.12}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: silicon-cli
-Version: 1.0.9
+Version: 1.0.12
 Summary: Silicon CLI — create, run, and manage your silicon instances.
 Author: Saket
 Project-URL: Homepage, https://github.com/saket1225/silicon-cli
@@ -13,6 +13,7 @@ Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: certifi>=2024.2.2
+Dynamic: license-file
 
 # silicon-cli
 
@@ -21,7 +22,7 @@ package is named `silicon-cli`, and the code lives here in this `silicon-cli`
 repo.
 
 The command manages silicon instances on a machine: create them from the
-[silicon-stemcell](https://github.com/unlikefraction/silicon-stemcell) base,
+[silicon-stemcell](https://github.com/teamofsilicons/silicon-stemcell) base,
 start/stop them under an auto-restart watchdog, stream logs, and back them up to
 Glass. It reads the same `~/.silicon/registry.json`, so existing installs carry
 over unchanged.
@@ -46,6 +47,8 @@ silicon restart <target>     Restart silicon(s). target = name, *, all, 1,2,4, o
 silicon agent <start|stop|status> [name]   Manage the per-silicon glass agent
 silicon status [name]        Show instance status
 silicon browser [name]       Open a headed browser for login
+silicon browser-profile setup <token>  Create a Steel browser profile through Glass
+silicon browser-profile finish <token> <session_id> [before_ids_csv]  Finish profile setup
 silicon debug [name]         Tail a running instance's logs
 silicon attach [path]        Register an existing silicon directory
 silicon pull [api_token]     Pull a Glass team or silicon into local folders
@@ -53,6 +56,14 @@ silicon push [name] [now|stop]   Daily 23:59 GMT backups to Glass (now = one-sho
 silicon backup [name] [now|stop] Alias for silicon push
 silicon update <target>      Update silicon(s) from the latest stemcell
 silicon list                 List all instances
+silicon docker init [--root ~/silicons] [--image teamofsilicons/silicon-runtime:latest]
+                             Install/check Docker and enable one-container-per-Silicon runtime
+silicon docker doctor        Check/repair Docker runtime setup
+silicon docker login [claude|codex|all]
+                             Set up shared Claude/Codex auth for Docker silicons
+silicon docker compose       Print generated Compose file path
+silicon claude [args...]     Run Claude Code with shared Docker auth
+silicon codex [args...]      Run Codex with shared Docker auth
 silicon script update        Update this CLI itself
 silicon help                 Show help
 ```
@@ -63,21 +74,117 @@ silicon help                 Show help
 | --- | --- | --- |
 | `SILICON_HOME` | `~/.silicon` | registry + CLI state |
 | `GLASS_SERVER_URL` | `https://glass.teamofsilicons.com` | Glass sync server (pull/push) |
-| `SILICON_STEMCELL_REPO` | `unlikefraction/silicon-stemcell` | base for `new` |
-| `SILICON_GLASS_CLI_REPO` | `unlikefraction/glass` | glass backup CLI |
+| `SILICON_STEMCELL_REPO` | `teamofsilicons/silicon-stemcell` | base for `new` |
+| `SILICON_GLASS_CLI_REPO` | `teamofsilicons/glass` | glass backup CLI |
 | `SILICON_PYTHON` | `python3` | interpreter used to run a silicon's `main.py` |
 | `SILICON_INTERFACE_CLI_PACKAGE` | `@teamofsilicons/silicon-interface-cli` | npm package used to install the Silicon Interface CLI |
 | `SILICON_INTERFACE_CLI_TARBALL` | versioned npm tarball | fallback package URL if registry metadata is briefly unavailable |
 | `SILICON_INTERFACE_CLI_SOURCE` | *(empty)* | local package dir or `silicon-interface.mjs` path for dev installs |
 | `SILICON_INTERFACE_CLI_SKIP` | *(empty)* | set to `1` to skip interface CLI setup |
 | `SILICON_INTERFACE_DAEMON_SKIP` | *(empty)* | set to `1` to install the CLI without starting its listener daemon |
+| `SILICON_RUNTIME` | *(empty)* | default pull uses Docker; set to `local` to opt out |
+| `SILICON_RUNTIME_IMAGE` | `teamofsilicons/silicon-runtime:latest` | runtime image for Docker-backed silicons |
+| `SILICON_DOCKER_ROOT` | `~/silicons` | Docker-backed instance root |
+| `SILICON_DOCKER_COMPOSE` | `<root>/compose.yml` | generated Compose file path |
+| `SILICON_DOCKER_SHARED_HOME` | `<root>/.shared-home` | VM-wide Claude/Codex auth home mounted into every container |
+| `SILICON_DOCKER_SUDO` | *(empty)* | set to `1` to run Docker commands through `sudo docker` |
+| `SILICON_DOCKER_AUTO_INSTALL` | *(empty)* | set to `1` to allow non-interactive Docker install attempts |
+
+## Docker runtime
+
+Docker mode keeps the existing `silicon` command but runs each Silicon in its own
+container. Mutable instance state lives on the host under `~/silicons/<name>` and
+is bind-mounted at `/silicon` inside the container. Provider secrets are still
+Glass-managed: the container stores only the Silicon's `.glass.json` key and the
+stemcell fetches provider keys from Glass on boot.
+
+Claude Code and Codex account state is shared across all Docker-backed silicons
+on the VM. The shared auth home defaults to `~/silicons/.shared-home` and is
+mounted into every container. During an interactive `silicon pull`, the CLI asks
+whether to set up Claude Code, Codex, or both before installing the team.
+
+On a fresh Linux server, the host only needs Python and this CLI. `silicon pull`
+checks Docker Engine, Docker Compose v2, the daemon, current-user access, runtime
+config, and the runtime image. When Docker is missing on Linux, it can install
+Docker Engine through Docker's official `get.docker.com` installer, start the
+daemon, and continue.
+
+```bash
+pip install silicon-cli
+silicon pull sct_live_...
+```
+
+To run the same checks explicitly:
+
+```bash
+silicon docker bootstrap --root ~/silicons --image teamofsilicons/silicon-runtime:latest
+silicon docker doctor
+```
+
+To set up or repair shared Claude/Codex login manually:
+
+```bash
+silicon docker login        # asks which accounts to set up
+silicon docker login claude # Claude Code only
+silicon docker login codex  # Codex only
+silicon docker login all    # both
+```
+
+To use those same shared accounts directly from the VM without installing Claude
+or Codex on the host:
+
+```bash
+silicon claude
+silicon codex
+silicon claude --version
+silicon codex --version
+```
+
+The runtime image contains the Silicon runtime dependencies: Python tooling, git,
+Node, Silicon Browser, Silicon Interface CLI, Claude Code, and Codex. Each
+container creates `/silicon/.venv` and installs that Silicon's `requirements.txt`
+inside the mounted instance folder, so per-Silicon Python dependencies do not
+pollute the host.
+
+To force the older host-local install path:
+
+```bash
+SILICON_RUNTIME=local silicon pull sct_live_...
+```
+
+After that, the normal commands continue to work:
+
+```bash
+silicon list
+silicon start all
+silicon stop ada          # stops the Silicon process; container stays up
+silicon stop --full ada   # stops the container
+silicon debug ada
+silicon update ada
+silicon backup ada now
+```
+
+The generated Compose file is written to `~/silicons/compose.yml`. You can inspect
+it with:
+
+```bash
+silicon docker compose
+```
+
+Build the runtime image from this repo:
+
+```bash
+docker build -f docker/runtime/Dockerfile -t teamofsilicons/silicon-runtime:latest .
+```
 
 ## Silicon Interface CLI
 
-`silicon new`, `silicon install`, and `silicon pull` also set up the
-Silicon Interface CLI in the silicon folder when Node 22+ is available.
-When a Glass `.glass.json` is present, setup also starts the background listener
-daemon so the silicon receives live conversation frames without polling.
+For Docker-backed installs, the Silicon Interface CLI is installed inside the
+runtime image/container. For host-local installs, `silicon new`, `silicon install`,
+and `silicon pull` set up the Silicon Interface CLI in the silicon folder when
+Node 22+ is available. When a Glass `.glass.json` is present, setup also starts
+the background listener daemon so the silicon receives live conversation frames
+without polling.
 
 `silicon pull` is token-native. Generate a team setup token from Glass >
 Silicons > Team setup token, then run:
@@ -92,8 +199,8 @@ silicon pull sct_live_...
 
 The command validates the token with Glass, mints one local silicon API key per
 team silicon, creates one folder per silicon, hydrates the stemcell, writes
-`.glass.json`, `.env`, and `env.py`, registers each instance, starts each
-Silicon Interface daemon, and starts each silicon process.
+`.glass.json`, `.env`, and `env.py`, registers each instance, regenerates Compose
+for Docker-backed installs, and starts each silicon process.
 
 During team pull, setup asks for the default brain/fallback settings once. You
 can apply those settings to every silicon, or select specific silicons that
@@ -102,9 +209,9 @@ Older per-silicon `scs_live_...` tokens still pull just that one silicon.
 
 Provider API keys for voice, browser profiles, billing, and architecture
 generation are configured on the Glass backend. After the silicon API token is
-validated, `silicon pull` reads the team's provider-key metadata from Glass,
-shows each provider as saved/missing without returning plaintext secrets, and
-asks whether the pulled silicon(s) should use the Glass-managed keys. A
+validated, `silicon pull` reads the team's provider-key metadata from Glass and
+automatically marks the pulled silicon(s) to use Glass-managed keys when every
+provider is available. Plaintext secrets are never returned to the CLI. A
 Glass-pulled silicon only stores its Glass API token plus a local marker that
 provider keys come from Glass.
 

{silicon_cli-1.0.9 → silicon_cli-1.0.12}/README.md

@@ -5,7 +5,7 @@ package is named `silicon-cli`, and the code lives here in this `silicon-cli`
 repo.
 
 The command manages silicon instances on a machine: create them from the
-[silicon-stemcell](https://github.com/unlikefraction/silicon-stemcell) base,
+[silicon-stemcell](https://github.com/teamofsilicons/silicon-stemcell) base,
 start/stop them under an auto-restart watchdog, stream logs, and back them up to
 Glass. It reads the same `~/.silicon/registry.json`, so existing installs carry
 over unchanged.
@@ -30,6 +30,8 @@ silicon restart <target>     Restart silicon(s). target = name, *, all, 1,2,4, o
 silicon agent <start|stop|status> [name]   Manage the per-silicon glass agent
 silicon status [name]        Show instance status
 silicon browser [name]       Open a headed browser for login
+silicon browser-profile setup <token>  Create a Steel browser profile through Glass
+silicon browser-profile finish <token> <session_id> [before_ids_csv]  Finish profile setup
 silicon debug [name]         Tail a running instance's logs
 silicon attach [path]        Register an existing silicon directory
 silicon pull [api_token]     Pull a Glass team or silicon into local folders
@@ -37,6 +39,14 @@ silicon push [name] [now|stop]   Daily 23:59 GMT backups to Glass (now = one-sho
 silicon backup [name] [now|stop] Alias for silicon push
 silicon update <target>      Update silicon(s) from the latest stemcell
 silicon list                 List all instances
+silicon docker init [--root ~/silicons] [--image teamofsilicons/silicon-runtime:latest]
+                             Install/check Docker and enable one-container-per-Silicon runtime
+silicon docker doctor        Check/repair Docker runtime setup
+silicon docker login [claude|codex|all]
+                             Set up shared Claude/Codex auth for Docker silicons
+silicon docker compose       Print generated Compose file path
+silicon claude [args...]     Run Claude Code with shared Docker auth
+silicon codex [args...]      Run Codex with shared Docker auth
 silicon script update        Update this CLI itself
 silicon help                 Show help
 ```
@@ -47,21 +57,117 @@ silicon help                 Show help
 | --- | --- | --- |
 | `SILICON_HOME` | `~/.silicon` | registry + CLI state |
 | `GLASS_SERVER_URL` | `https://glass.teamofsilicons.com` | Glass sync server (pull/push) |
-| `SILICON_STEMCELL_REPO` | `unlikefraction/silicon-stemcell` | base for `new` |
-| `SILICON_GLASS_CLI_REPO` | `unlikefraction/glass` | glass backup CLI |
+| `SILICON_STEMCELL_REPO` | `teamofsilicons/silicon-stemcell` | base for `new` |
+| `SILICON_GLASS_CLI_REPO` | `teamofsilicons/glass` | glass backup CLI |
 | `SILICON_PYTHON` | `python3` | interpreter used to run a silicon's `main.py` |
 | `SILICON_INTERFACE_CLI_PACKAGE` | `@teamofsilicons/silicon-interface-cli` | npm package used to install the Silicon Interface CLI |
 | `SILICON_INTERFACE_CLI_TARBALL` | versioned npm tarball | fallback package URL if registry metadata is briefly unavailable |
 | `SILICON_INTERFACE_CLI_SOURCE` | *(empty)* | local package dir or `silicon-interface.mjs` path for dev installs |
 | `SILICON_INTERFACE_CLI_SKIP` | *(empty)* | set to `1` to skip interface CLI setup |
 | `SILICON_INTERFACE_DAEMON_SKIP` | *(empty)* | set to `1` to install the CLI without starting its listener daemon |
+| `SILICON_RUNTIME` | *(empty)* | default pull uses Docker; set to `local` to opt out |
+| `SILICON_RUNTIME_IMAGE` | `teamofsilicons/silicon-runtime:latest` | runtime image for Docker-backed silicons |
+| `SILICON_DOCKER_ROOT` | `~/silicons` | Docker-backed instance root |
+| `SILICON_DOCKER_COMPOSE` | `<root>/compose.yml` | generated Compose file path |
+| `SILICON_DOCKER_SHARED_HOME` | `<root>/.shared-home` | VM-wide Claude/Codex auth home mounted into every container |
+| `SILICON_DOCKER_SUDO` | *(empty)* | set to `1` to run Docker commands through `sudo docker` |
+| `SILICON_DOCKER_AUTO_INSTALL` | *(empty)* | set to `1` to allow non-interactive Docker install attempts |
+
+## Docker runtime
+
+Docker mode keeps the existing `silicon` command but runs each Silicon in its own
+container. Mutable instance state lives on the host under `~/silicons/<name>` and
+is bind-mounted at `/silicon` inside the container. Provider secrets are still
+Glass-managed: the container stores only the Silicon's `.glass.json` key and the
+stemcell fetches provider keys from Glass on boot.
+
+Claude Code and Codex account state is shared across all Docker-backed silicons
+on the VM. The shared auth home defaults to `~/silicons/.shared-home` and is
+mounted into every container. During an interactive `silicon pull`, the CLI asks
+whether to set up Claude Code, Codex, or both before installing the team.
+
+On a fresh Linux server, the host only needs Python and this CLI. `silicon pull`
+checks Docker Engine, Docker Compose v2, the daemon, current-user access, runtime
+config, and the runtime image. When Docker is missing on Linux, it can install
+Docker Engine through Docker's official `get.docker.com` installer, start the
+daemon, and continue.
+
+```bash
+pip install silicon-cli
+silicon pull sct_live_...
+```
+
+To run the same checks explicitly:
+
+```bash
+silicon docker bootstrap --root ~/silicons --image teamofsilicons/silicon-runtime:latest
+silicon docker doctor
+```
+
+To set up or repair shared Claude/Codex login manually:
+
+```bash
+silicon docker login        # asks which accounts to set up
+silicon docker login claude # Claude Code only
+silicon docker login codex  # Codex only
+silicon docker login all    # both
+```
+
+To use those same shared accounts directly from the VM without installing Claude
+or Codex on the host:
+
+```bash
+silicon claude
+silicon codex
+silicon claude --version
+silicon codex --version
+```
+
+The runtime image contains the Silicon runtime dependencies: Python tooling, git,
+Node, Silicon Browser, Silicon Interface CLI, Claude Code, and Codex. Each
+container creates `/silicon/.venv` and installs that Silicon's `requirements.txt`
+inside the mounted instance folder, so per-Silicon Python dependencies do not
+pollute the host.
+
+To force the older host-local install path:
+
+```bash
+SILICON_RUNTIME=local silicon pull sct_live_...
+```
+
+After that, the normal commands continue to work:
+
+```bash
+silicon list
+silicon start all
+silicon stop ada          # stops the Silicon process; container stays up
+silicon stop --full ada   # stops the container
+silicon debug ada
+silicon update ada
+silicon backup ada now
+```
+
+The generated Compose file is written to `~/silicons/compose.yml`. You can inspect
+it with:
+
+```bash
+silicon docker compose
+```
+
+Build the runtime image from this repo:
+
+```bash
+docker build -f docker/runtime/Dockerfile -t teamofsilicons/silicon-runtime:latest .
+```
 
 ## Silicon Interface CLI
 
-`silicon new`, `silicon install`, and `silicon pull` also set up the
-Silicon Interface CLI in the silicon folder when Node 22+ is available.
-When a Glass `.glass.json` is present, setup also starts the background listener
-daemon so the silicon receives live conversation frames without polling.
+For Docker-backed installs, the Silicon Interface CLI is installed inside the
+runtime image/container. For host-local installs, `silicon new`, `silicon install`,
+and `silicon pull` set up the Silicon Interface CLI in the silicon folder when
+Node 22+ is available. When a Glass `.glass.json` is present, setup also starts
+the background listener daemon so the silicon receives live conversation frames
+without polling.
 
 `silicon pull` is token-native. Generate a team setup token from Glass >
 Silicons > Team setup token, then run:
@@ -76,8 +182,8 @@ silicon pull sct_live_...
 
 The command validates the token with Glass, mints one local silicon API key per
 team silicon, creates one folder per silicon, hydrates the stemcell, writes
-`.glass.json`, `.env`, and `env.py`, registers each instance, starts each
-Silicon Interface daemon, and starts each silicon process.
+`.glass.json`, `.env`, and `env.py`, registers each instance, regenerates Compose
+for Docker-backed installs, and starts each silicon process.
 
 During team pull, setup asks for the default brain/fallback settings once. You
 can apply those settings to every silicon, or select specific silicons that
@@ -86,9 +192,9 @@ Older per-silicon `scs_live_...` tokens still pull just that one silicon.
 
 Provider API keys for voice, browser profiles, billing, and architecture
 generation are configured on the Glass backend. After the silicon API token is
-validated, `silicon pull` reads the team's provider-key metadata from Glass,
-shows each provider as saved/missing without returning plaintext secrets, and
-asks whether the pulled silicon(s) should use the Glass-managed keys. A
+validated, `silicon pull` reads the team's provider-key metadata from Glass and
+automatically marks the pulled silicon(s) to use Glass-managed keys when every
+provider is available. Plaintext secrets are never returned to the CLI. A
 Glass-pulled silicon only stores its Glass API token plus a local marker that
 provider keys come from Glass.
 

{silicon_cli-1.0.9 → silicon_cli-1.0.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "silicon-cli"
-version = "1.0.9"
+version = "1.0.12"
 description = "Silicon CLI — create, run, and manage your silicon instances."
 readme = "README.md"
 requires-python = ">=3.9"

{silicon_cli-1.0.9 → silicon_cli-1.0.12}/silicon_cli/__init__.py

@@ -1,2 +1,2 @@
 """Silicon CLI — manage silicon instances. Python port of the original bash manager."""
-__version__ = "1.0.9"
+__version__ = "1.0.10"

{silicon_cli-1.0.9 → silicon_cli-1.0.12}/silicon_cli/cli.py

@@ -5,12 +5,13 @@ import subprocess
 import sys
 from pathlib import Path
 
-from . import glassagent, process, registry, stemcell, sync, ui, update
+from . import docker_runtime, glassagent, process, registry, stemcell, sync, ui, update
 from .config import python_run_cmd
 
 COMMANDS = ["start", "stop", "restart", "status", "browser", "debug", "attach",
             "pull", "push", "backup", "update", "update-check", "check-update",
-            "list", "install", "new", "help", "script", "agent"]
+            "browser-profile", "list", "install", "new", "help", "script", "agent",
+            "docker", "claude", "codex"]
 
 
 # ----------------------------------------------------------------- commands
@@ -24,17 +25,21 @@ def cmd_list() -> None:
     print(f"  {ui.DIM}{'#':<4}{'NAME':<22}{'STATUS':<10}PATH{ui.RESET}")
     print(f"  {ui.DIM}{'---':<4}{'----':<22}{'------':<10}----{ui.RESET}")
     for i in rows:
-        if process.is_running(i.pid_file):
+        if process.install_is_running(i):
             pid = process.get_pid(i.pid_file)
             status = f"{ui.GREEN}● running{ui.RESET}"
-            extra = f" {ui.DIM}(PID {pid}){ui.RESET}"
+            extra = f" {ui.DIM}(Docker){ui.RESET}" if i.is_docker else f" {ui.DIM}(PID {pid}){ui.RESET}"
         else:
-            status, extra = f"{ui.DIM}○ stopped{ui.RESET}", ""
+            status = f"{ui.DIM}○ stopped{ui.RESET}"
+            extra = f" {ui.DIM}(Docker){ui.RESET}" if i.is_docker else ""
         print(f"  {i.index + 1:<4}{i.name:<22}{status}{extra}  {ui.DIM}{i.path}{ui.RESET}")
     print()
 
 
 def _print_status(inst) -> None:
+    if inst.is_docker:
+        docker_runtime.print_status(inst)
+        return
     if process.is_running(inst.pid_file):
         pid = process.get_pid(inst.pid_file)
         print(f"\n{ui.BOLD}{inst.name}{ui.RESET} {ui.GREEN}● running{ui.RESET} (PID {pid})")
@@ -60,13 +65,19 @@ def cmd_status(target: str | None) -> None:
 
 def cmd_browser(target: str | None) -> None:
     inst = registry.resolve_one(target)
+    if inst.is_docker:
+        docker_runtime.run_silicon(inst, ["browser", inst.name])
+        return
     ui.info(f"Opening browser for '{inst.name}'...")
-    subprocess.run([python_run_cmd(), "main.py", "browser"], cwd=inst.path)
+    subprocess.run([python_run_cmd(inst.path), "main.py", "browser"], cwd=inst.path)
 
 
 def cmd_debug(target: str | None) -> None:
     inst = registry.resolve_one(target)
-    if not process.is_running(inst.pid_file):
+    if inst.is_docker:
+        docker_runtime.debug(inst)
+        return
+    if not process.install_is_running(inst):
         ui.error(f"'{inst.name}' is not running. Start it first with: silicon start {inst.name}")
         sys.exit(1)
     log_file = Path(inst.path) / ".silicon.log"
@@ -121,6 +132,11 @@ def cmd_agent(subcmd: str | None, target: str | None) -> None:
         ui.error("Usage: silicon agent <start|stop|status> [name]")
         sys.exit(1)
     inst = registry.resolve_one(target)
+    if inst.is_docker:
+        code = docker_runtime.run_silicon(inst, ["agent", subcmd, inst.name])
+        if code:
+            sys.exit(code)
+        return
     if subcmd == "start":
         glassagent.start(inst.path)
     elif subcmd == "stop":
@@ -137,6 +153,28 @@ def cmd_agent(subcmd: str | None, target: str | None) -> None:
 
 
 def cmd_new(target: str | None) -> None:
+    if docker_runtime.enabled():
+        docker_runtime.ensure_ready(auto_init=False, install=True, pull_image=True, quiet=True)
+        docker_target = docker_runtime.target_path(target)
+        stemcell.hydrate(
+            str(docker_target),
+            install_deps=False,
+            setup_interface=False,
+            register_install=False,
+        )
+        name = docker_target.name
+        sj = docker_target / "silicon.json"
+        if sj.exists():
+            import json
+
+            try:
+                data = json.loads(sj.read_text())
+                name = (data.get("address") or data.get("name") or name).strip() or name
+            except Exception:
+                pass
+        docker_runtime.register_instance(name, docker_target)
+        ui.info(f"Run 'silicon start {name}' when you're ready.")
+        return
     if target:
         stemcell.hydrate(target)
         return
@@ -163,6 +201,10 @@ def cmd_help() -> None:
   silicon agent <start|stop|status> [name]  Manage glass agent
   silicon status [name]       Show instance status
   silicon browser [name]      Open headed browser for login
+  silicon browser-profile setup <token>
+                             Create a Steel browser profile through Glass
+  silicon browser-profile finish <token> <session_id> [before_ids_csv]
+                             Finish a browser profile setup session
   silicon debug [name]        Attach to running instance (live logs)
   silicon attach [path]       Register an existing silicon instance
   silicon pull [api_token]    Pull a Glass team or silicon into local folders
@@ -174,6 +216,11 @@ def cmd_help() -> None:
   silicon update check [name] Trigger this silicon's system update check now
   silicon update-check [name] Trigger this silicon's system update check now
   silicon list                List all instances
+  silicon docker init         Install/check Docker and enable Docker-backed installs
+  silicon docker doctor       Repair/check Docker runtime setup
+  silicon docker login        Set up shared Claude/Codex auth for Docker silicons
+  silicon claude [args...]    Run Claude Code with shared Docker auth
+  silicon codex [args...]     Run Codex with shared Docker auth
   silicon script update       Update the silicon CLI itself
   silicon install             Install a new instance
   silicon help                Show this help
@@ -220,8 +267,24 @@ def main(argv: list[str] | None = None) -> None:
         cmd_status(a1)
     elif cmd == "browser":
         cmd_browser(a1)
+    elif cmd == "browser-profile":
+        if a1 == "setup":
+            sync.browser_profile_setup(a2)
+        elif a1 == "finish":
+            sync.browser_profile_finish(
+                a2,
+                argv[3] if len(argv) > 3 else None,
+                argv[4] if len(argv) > 4 else None,
+            )
+        else:
+            ui.error("Usage: silicon browser-profile <setup|finish> ...")
+            sys.exit(1)
     elif cmd == "debug":
         cmd_debug(a1)
+    elif cmd == "docker":
+        docker_runtime.cmd_docker(argv[1:])
+    elif cmd in ("claude", "codex"):
+        docker_runtime.run_shared_tool(cmd, argv[1:])
     elif cmd == "attach":
         cmd_attach(a1)
     elif cmd == "pull":

{silicon_cli-1.0.9 → silicon_cli-1.0.12}/silicon_cli/config.py

@@ -15,12 +15,12 @@ CLI_SOURCE_FILE = REGISTRY_DIR / "cli-source"  # where `silicon script update` r
 GLASS_SERVER_URL = os.environ.get("GLASS_SERVER_URL", "https://glass.teamofsilicons.com").rstrip("/")
 
 # Stemcell — the base every new silicon is hydrated from.
-STEMCELL_REPO = os.environ.get("SILICON_STEMCELL_REPO", "unlikefraction/silicon-stemcell")
+STEMCELL_REPO = os.environ.get("SILICON_STEMCELL_REPO", "teamofsilicons/silicon-stemcell")
 STEMCELL_GIT_URL = f"https://github.com/{STEMCELL_REPO}.git"
 STEMCELL_ZIP_URL = f"https://github.com/{STEMCELL_REPO}/archive/refs/heads/main.zip"
 
 # Glass CLI (used by pull/push for backups).
-GLASS_CLI_REPO = os.environ.get("SILICON_GLASS_CLI_REPO", "unlikefraction/glass")
+GLASS_CLI_REPO = os.environ.get("SILICON_GLASS_CLI_REPO", "teamofsilicons/glass")
 
 # Silicon Interface CLI. During local development, silicon-cli will auto-detect
 # a sibling silicon-interface checkout; in production this package spec is used.
@@ -41,6 +41,29 @@ SILICON_INTERFACE_DAEMON_SKIP = os.environ.get("SILICON_INTERFACE_DAEMON_SKIP",
 }
 
 
-def python_run_cmd() -> str:
-    """The interpreter used to RUN a silicon's main.py (not this CLI's venv)."""
+def venv_python(path: str | os.PathLike) -> str | None:
+    """The silicon's own .venv interpreter, if one exists."""
+    sub = "Scripts/python.exe" if os.name == "nt" else "bin/python"
+    cand = Path(path) / ".venv" / sub
+    return str(cand) if cand.exists() else None
+
+
+def base_python_cmd() -> str:
+    """The interpreter used to CREATE a silicon's venv (not this CLI's venv)."""
     return os.environ.get("SILICON_PYTHON") or shutil.which("python3") or shutil.which("python") or "python3"
+
+
+def python_run_cmd(path: str | os.PathLike | None = None) -> str:
+    """The interpreter used to RUN a silicon's code (not this CLI's venv).
+
+    SILICON_PYTHON always wins; otherwise prefer the silicon's own .venv —
+    system interpreters are often externally managed (PEP 668) and never
+    received the silicon's dependencies.
+    """
+    if os.environ.get("SILICON_PYTHON"):
+        return os.environ["SILICON_PYTHON"]
+    if path:
+        venv = venv_python(path)
+        if venv:
+            return venv
+    return shutil.which("python3") or shutil.which("python") or "python3"