Bind and connect to Unix domain sockets using relative paths (#1192 )

Switch back to github.com/open-telemetry/opentelemetry-swift upstream (#1189 )
Switch to github.com/open-telemetry/opentelemetry-swift fork (#1186 )
2026-10-01 19:51:10 +02:00 · 2026-02-05 15:51:14 +01:00 · 2026-02-02 19:40:24 +01:00 · 2026-01-29 16:54:57 +00:00 · 2026-01-27 16:17:05 +01:00 · 2026-01-23 15:16:33 -05:00
75 changed files with 1485 additions and 266 deletions
@@ -1,7 +1,7 @@
 use_compute_credits: true

 task:
-  name: Test on Sequoia
+  name: Test
  alias: test
  persistent_worker:
    labels:
@@ -11,6 +11,8 @@ task:
  build_script:
    - swift build
  test_script:
+    # Add /usr/sbin to PATH, otherwise testDiskutilInfo() fails to locate "diskutil"
+    - export PATH=$PATH:/usr/sbin
    - swift test
  integration_test_script:
    - codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/debug/tart
@@ -21,6 +23,7 @@ task:
    - source venv/bin/activate
    - pip install -r requirements.txt
    - pytest --verbose --junit-xml=pytest-junit.xml
+    - go test -v ./...
  pytest_junit_result_artifacts:
    path: "integration-tests/pytest-junit.xml"
    format: junit
@@ -83,8 +86,9 @@ task:
    - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k password101 build.keychain
    - xcrun notarytool store-credentials "notarytool" --apple-id "hello@cirruslabs.org" --team-id "9M2P8L4D89" --password $AC_PASSWORD
  install_script:
-    - brew install go goreleaser/tap/goreleaser-pro
+    - brew install go
    - brew install mitchellh/gon/gon
+    - brew install --cask goreleaser/tap/goreleaser-pro
  info_script:
    - security find-identity -v
    - xcodebuild -version
@@ -121,8 +125,9 @@ task:
    - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k password101 build.keychain
    - xcrun notarytool store-credentials "notarytool" --apple-id "hello@cirruslabs.org" --team-id "9M2P8L4D89" --password $AC_PASSWORD
  install_script:
-    - brew install go goreleaser/tap/goreleaser-pro getsentry/tools/sentry-cli
+    - brew install go getsentry/tools/sentry-cli
    - brew install mitchellh/gon/gon
+    - brew install --cask goreleaser/tap/goreleaser-pro
  info_script:
    - security find-identity -v
    - xcodebuild -version
@@ -4,3 +4,8 @@ root = true
 indent_style = space
 indent_size = 2
 insert_final_newline = true
+
+[integration-tests/**]
+indent_style = unset
+indent_size = unset
+insert_final_newline = unset
@@ -0,0 +1,37 @@
+name: Build
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build_cached:
+    name: Build tart (cached)
+    runs-on: ghcr.io/cirruslabs/macos-runner:tahoe
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+      - name: Build
+        run: |
+          export COMPILATION_CACHE_ENABLE_CACHING=YES
+          export COMPILATION_CACHE_REMOTE_SERVICE_PATH="$HOME/.cirruslabs/omni-cache.sock"
+          export COMPILATION_CACHE_ENABLE_PLUGIN=YES
+          export COMPILATION_CACHE_ENABLE_INTEGRATED_QUERIES=YES
+          export COMPILATION_CACHE_ENABLE_DETACHED_KEY_QUERIES=YES
+          export SWIFT_ENABLE_COMPILE_CACHE=YES
+          export SWIFT_ENABLE_EXPLICIT_MODULES=YES
+          export SWIFT_USE_INTEGRATED_DRIVER=YES
+          export CLANG_ENABLE_COMPILE_CACHE=YES
+          export CLANG_ENABLE_MODULES=YES
+          swift build --build-system swiftbuild --product tart
+
+  build_no_cache:
+    name: Build tart (no cache)
+    runs-on: ghcr.io/cirruslabs/macos-runner:tahoe
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+      - name: Build
+        run: swift build --build-system swiftbuild --product tart
@@ -8,6 +8,9 @@ tart.xcodeproj/
 # AppCode
 .idea/

+# VS Code
+.vscode/
+
 # Swift
 .build/

@@ -29,6 +29,7 @@ Table of Contents

 1. Code should follow camel case
 2. Code should follow [SwiftFormat](https://github.com/nicklockwood/SwiftFormat#swift-package-manager-plugin) guidelines. You can auto-format the code by running the following command:
+
 ```bash
 swift package plugin --allow-writing-to-package-directory swiftformat --cache ignore .
 ```
@@ -1,5 +1,5 @@
 {
-  "originHash" : "fe99b8634d39cad3971bde2180657a2bf711968e2e9cf5e3823bc51ea1530663",
+  "originHash" : "061dfe6cdf4e6dbf32b51c5e7023c4ae69726dcafb42a35b34e5489b0338c17f",
  "pins" : [
    {
      "identity" : "antlr4",
@@ -13,19 +13,19 @@
    {
      "identity" : "cirruslabs_tart-guest-agent_apple_swift",
      "kind" : "remoteSourceControl",
-      "location" : "https://buf.build/gen/swift/git/1.28.2-00000000000000-dfeb75ad2b39.1/cirruslabs_tart-guest-agent_apple_swift.git",
+      "location" : "https://buf.build/gen/swift/git/1.33.3-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_apple_swift.git",
      "state" : {
-        "revision" : "3e13bec2dd36788e80a2e5a2022d44d4a1f373cf",
-        "version" : "1.28.2-00000000000000-dfeb75ad2b39.1"
+        "revision" : "5c49a653f4b003161077d194bc708b7373628c99",
+        "version" : "1.33.3-20260114140118-bd09c26a260f.1"
      }
    },
    {
      "identity" : "cirruslabs_tart-guest-agent_grpc_swift",
      "kind" : "remoteSourceControl",
-      "location" : "https://buf.build/gen/swift/git/1.24.2-00000000000000-dfeb75ad2b39.1/cirruslabs_tart-guest-agent_grpc_swift.git",
+      "location" : "https://buf.build/gen/swift/git/1.27.1-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_grpc_swift.git",
      "state" : {
-        "branch" : "1.24.2-00000000000000-dfeb75ad2b39.1",
-        "revision" : "5b6ff43b580fe435f0a174e137e2b197759a7170"
+        "branch" : "main",
+        "revision" : "4935078c2fe2508360843596d71a1f844ce639a6"
      }
    },
    {
@@ -42,8 +42,35 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/grpc/grpc-swift.git",
      "state" : {
-        "revision" : "8c5e99d0255c373e0330730d191a3423c57373fb",
-        "version" : "1.24.2"
+        "revision" : "8f57f68b9d247fe3759fa9f18e1fe919911e6031",
+        "version" : "1.27.1"
+      }
+    },
+    {
+      "identity" : "opentelemetry-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/open-telemetry/opentelemetry-swift",
+      "state" : {
+        "branch" : "main",
+        "revision" : "ed37be9525081509ab62410d38b705c2b3f0d5a4"
+      }
+    },
+    {
+      "identity" : "opentelemetry-swift-core",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/open-telemetry/opentelemetry-swift-core.git",
+      "state" : {
+        "revision" : "240c8d5e36c3c7b774ed961325369f0b1f2c965f",
+        "version" : "2.3.0"
+      }
+    },
+    {
+      "identity" : "opentracing-objc",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/undefinedlabs/opentracing-objc",
+      "state" : {
+        "revision" : "18c1a35ca966236cee0c5a714a51a73ff33384c1",
+        "version" : "0.5.2"
      }
    },
    {
@@ -55,15 +82,6 @@
        "version" : "0.1.0"
      }
    },
-    {
-      "identity" : "sentry-cocoa",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/getsentry/sentry-cocoa",
-      "state" : {
-        "revision" : "5575af93efb776414f243e93d6af9f6258dc539a",
-        "version" : "8.36.0"
-      }
-    },
    {
      "identity" : "swift-algorithms",
      "kind" : "remoteSourceControl",
@@ -78,8 +96,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-argument-parser",
      "state" : {
-        "revision" : "41982a3656a71c768319979febd796c6fd111d5c",
-        "version" : "1.5.0"
+        "revision" : "309a47b2b1d9b5e991f36961c983ecec72275be3",
+        "version" : "1.6.1"
      }
    },
    {
@@ -87,8 +105,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-atomics.git",
      "state" : {
-        "revision" : "cd142fd2f64be2100422d658e7411e39489da985",
-        "version" : "1.2.0"
+        "revision" : "b601256eab081c0f92f059e12818ac1d4f178ff7",
+        "version" : "1.3.0"
      }
    },
    {
@@ -123,8 +141,17 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-log.git",
      "state" : {
-        "revision" : "9cb486020ebf03bfa5b5df985387a14a98744537",
-        "version" : "1.6.1"
+        "revision" : "2778fd4e5a12a8aaa30a3ee8285f4ce54c5f3181",
+        "version" : "1.9.1"
+      }
+    },
+    {
+      "identity" : "swift-metrics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-metrics.git",
+      "state" : {
+        "revision" : "0743a9364382629da3bf5677b46a2c4b1ce5d2a6",
+        "version" : "2.7.1"
      }
    },
    {
@@ -132,8 +159,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-nio.git",
      "state" : {
-        "revision" : "34d486b01cd891297ac615e40d5999536a1e138d",
-        "version" : "2.83.0"
+        "revision" : "233f61bc2cfbb22d0edeb2594da27a20d2ce514e",
+        "version" : "2.93.0"
      }
    },
    {
@@ -186,8 +213,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-protobuf.git",
      "state" : {
-        "revision" : "ebc7251dd5b37f627c93698e4374084d98409633",
-        "version" : "1.28.2"
+        "revision" : "c169a5744230951031770e27e475ff6eefe51f9d",
+        "version" : "1.33.3"
      }
    },
    {
@@ -261,6 +288,15 @@
        "branch" : "master",
        "revision" : "e03289289155b4e7aa565e32862f9cb42140596a"
      }
+    },
+    {
+      "identity" : "thrift-swift",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/undefinedlabs/Thrift-Swift",
+      "state" : {
+        "revision" : "18ff09e6b30e589ed38f90a1af23e193b8ecef8e",
+        "version" : "1.1.2"
+      }
    }
  ],
  "version" : 3
@@ -10,22 +10,24 @@ let package = Package(
    .executable(name: "tart", targets: ["tart"])
  ],
  dependencies: [
-    .package(url: "https://github.com/apple/swift-argument-parser", from: "1.3.1"),
+    .package(url: "https://github.com/apple/swift-argument-parser", from: "1.6.1"),
    .package(url: "https://github.com/mhdhejazi/Dynamic", branch: "master"),
    .package(url: "https://github.com/apple/swift-algorithms", from: "1.2.0"),
    .package(url: "https://github.com/malcommac/SwiftDate", from: "7.0.0"),
    .package(url: "https://github.com/antlr/antlr4", exact: "4.13.2"),
    .package(url: "https://github.com/apple/swift-atomics.git", .upToNextMajor(from: "1.2.0")),
    .package(url: "https://github.com/nicklockwood/SwiftFormat", from: "0.53.6"),
-    .package(url: "https://github.com/getsentry/sentry-cocoa", from: "8.36.0"),
    .package(url: "https://github.com/cfilipov/TextTable", branch: "master"),
    .package(url: "https://github.com/sersoft-gmbh/swift-sysctl.git", from: "1.8.0"),
    .package(url: "https://github.com/orchetect/SwiftRadix", from: "1.3.1"),
    .package(url: "https://github.com/groue/Semaphore", from: "0.0.8"),
    .package(url: "https://github.com/fumoboy007/swift-retry", from: "0.2.3"),
    .package(url: "https://github.com/jozefizso/swift-xattr", from: "3.0.0"),
-    .package(url: "https://github.com/grpc/grpc-swift.git", .upToNextMajor(from: "1.24.2")),
-    .package(url: "https://buf.build/gen/swift/git/1.24.2-00000000000000-dfeb75ad2b39.1/cirruslabs_tart-guest-agent_grpc_swift.git", revision: "1.24.2-00000000000000-dfeb75ad2b39.1"),
+    .package(url: "https://github.com/grpc/grpc-swift.git", .upToNextMajor(from: "1.27.0")),
+    .package(url: "https://buf.build/gen/swift/git/1.27.1-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_grpc_swift.git", branch: "main"),
+    .package(url: "https://github.com/open-telemetry/opentelemetry-swift", branch: "main"),
+    .package(url: "https://github.com/open-telemetry/opentelemetry-swift-core", from: "2.3.0"),
+
  ],
  targets: [
    .executableTarget(name: "tart", dependencies: [
@@ -35,7 +37,6 @@ let package = Package(
      .product(name: "SwiftDate", package: "SwiftDate"),
      .product(name: "Antlr4Static", package: "Antlr4"),
      .product(name: "Atomics", package: "swift-atomics"),
-      .product(name: "Sentry", package: "sentry-cocoa"),
      .product(name: "TextTable", package: "TextTable"),
      .product(name: "Sysctl", package: "swift-sysctl"),
      .product(name: "SwiftRadix", package: "SwiftRadix"),
@@ -44,6 +45,10 @@ let package = Package(
      .product(name: "XAttr", package: "swift-xattr"),
      .product(name: "GRPC", package: "grpc-swift"),
      .product(name: "Cirruslabs_TartGuestAgent_Grpc_Swift", package: "cirruslabs_tart-guest-agent_grpc_swift"),
+      .product(name: "OpenTelemetryApi", package: "opentelemetry-swift-core"),
+      .product(name: "OpenTelemetrySdk", package: "opentelemetry-swift-core"),
+      .product(name: "OpenTelemetryProtocolExporterHTTP", package: "opentelemetry-swift"),
+      .product(name: "ResourceExtension", package: "opentelemetry-swift"),
    ], exclude: [
      "OCI/Reference/Makefile",
      "OCI/Reference/Reference.g4",
@@ -66,8 +66,8 @@ Try running a Tart VM on your Apple Silicon device running macOS 13.0 (Ventura)

 ```bash
 brew install cirruslabs/cli/tart
-tart clone ghcr.io/cirruslabs/macos-sequoia-base:latest sequoia-base
-tart run sequoia-base
+tart clone ghcr.io/cirruslabs/macos-tahoe-base:latest tahoe-base
+tart run tahoe-base
 ```

 Please check the [official documentation](https://tart.run) for more information and/or feel free to use [discussions](https://github.com/cirruslabs/tart/discussions)
@@ -31,6 +31,9 @@ struct Clone: AsyncParsableCommand {
  @Flag(help: .hidden)
  var deduplicate: Bool = false

+  @Option(help: ArgumentHelp("limit automatic pruning to n gigabytes", valueName: "n"))
+  var pruneLimit: UInt = 100
+
  func validate() throws {
    if newName.contains("/") {
      throw ValidationError("<new-name> should be a local name")
@@ -42,8 +45,8 @@ struct Clone: AsyncParsableCommand {
  }

  func run() async throws {
-    let ociStorage = VMStorageOCI()
-    let localStorage = VMStorageLocal()
+    let ociStorage = try VMStorageOCI()
+    let localStorage = try VMStorageLocal()

    if let remoteName = try? RemoteName(sourceName), !ociStorage.exists(remoteName) {
      // Pull the VM in case it's OCI-based and doesn't exist locally yet
@@ -76,8 +79,10 @@ struct Clone: AsyncParsableCommand {
      //
      // So, once we clone the VM let's try to claim the rest of space for the VM to run without errors.
      let unallocatedBytes = try sourceVM.sizeBytes() - sourceVM.allocatedSizeBytes()
-      if unallocatedBytes > 0 {
-        try Prune.reclaimIfNeeded(UInt64(unallocatedBytes), sourceVM)
+      // Avoid reclaiming an excessive amount of disk space.
+      let reclaimBytes = min(unallocatedBytes, Int(pruneLimit) * 1024 * 1024 * 1024)
+      if reclaimBytes > 0 {
+        try Prune.reclaimIfNeeded(UInt64(reclaimBytes), sourceVM)
      }
    }, onCancel: {
      try? FileManager.default.removeItem(at: tmpVMDir.baseURL)
@@ -19,6 +19,9 @@ struct Create: AsyncParsableCommand {
  @Option(help: ArgumentHelp("Disk size in GB"))
  var diskSize: UInt16 = 50

+  @Option(help: ArgumentHelp("Disk image format", discussion: "ASIF format provides better performance but requires macOS 26 Tahoe or later"))
+  var diskFormat: DiskImageFormat = .raw
+
  func validate() throws {
    if fromIPSW == nil && !linux {
      throw ValidationError("Please specify either a --from-ipsw or --linux option!")
@@ -28,6 +31,11 @@ struct Create: AsyncParsableCommand {
        throw ValidationError("Only Linux VMs are supported on Intel!")
      }
    #endif
+
+    // Validate disk format support
+    if !diskFormat.isSupported {
+      throw ValidationError("Disk format '\(diskFormat.rawValue)' is not supported on this system.")
+    }
  }

  func run() async throws {
@@ -58,12 +66,12 @@ struct Create: AsyncParsableCommand {
            ipswURL = URL(fileURLWithPath: NSString(string: fromIPSW).expandingTildeInPath)
          }

-          _ = try await VM(vmDir: tmpVMDir, ipswURL: ipswURL, diskSizeGB: diskSize)
+          _ = try await VM(vmDir: tmpVMDir, ipswURL: ipswURL, diskSizeGB: diskSize, diskFormat: diskFormat)
        }
      #endif

      if linux {
-        _ = try await VM.linux(vmDir: tmpVMDir, diskSizeGB: diskSize)
+        _ = try await VM.linux(vmDir: tmpVMDir, diskSizeGB: diskSize, diskFormat: diskFormat)
      }

      try VMStorageLocal().move(name, from: tmpVMDir)
@@ -9,10 +9,11 @@ struct ExecCustomExitCodeError: Error {
 }

 struct Exec: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Execute a command in a running VM")
+  static var configuration = CommandConfiguration(abstract: "Execute a command in a running VM", discussion: """
+  Requires Tart Guest Agent running in a guest VM.

-  @Argument(help: "VM name", completion: .custom(completeLocalMachines))
-  var name: String
+  Note that all non-vanilla Cirrus Labs VM images already have the Tart Guest Agent installed.
+  """)

  @Flag(name: [.customShort("i")], help: "Attach host's standard input to a remote command")
  var interactive: Bool = false
@@ -20,6 +21,9 @@ struct Exec: AsyncParsableCommand {
  @Flag(name: [.customShort("t")], help: "Allocate a remote pseudo-terminal (PTY)")
  var tty: Bool = false

+  @Argument(help: "VM name", completion: .custom(completeLocalMachines))
+  var name: String
+
  @Argument(parsing: .captureForPassthrough, help: "Command to execute")
  var command: [String]

@@ -43,8 +47,16 @@ struct Exec: AsyncParsableCommand {
      try! group.syncShutdownGracefully()
    }

+    // Change the current working directory to a VM's base directory
+    // to work around Unix domain socket 104 byte limitation [1]
+    //
+    // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
+    if let baseURL = vmDir.controlSocketURL.baseURL {
+      FileManager.default.changeCurrentDirectoryPath(baseURL.path())
+    }
+
    let channel = try GRPCChannelPool.with(
-      target: .unixDomainSocket(vmDir.controlSocketURL.path()),
+      target: .unixDomainSocket(vmDir.controlSocketURL.relativePath),
      transportSecurity: .plaintext,
      eventLoopGroup: group,
    )
@@ -66,6 +78,14 @@ struct Exec: AsyncParsableCommand {
    }

    // Execute a command in a running VM
+    do {
+      try await execute(channel)
+    } catch let error as GRPCConnectionPoolError {
+      throw RuntimeError.Generic("Failed to connect to the VM using its control socket: \(error.localizedDescription), is the Tart Guest Agent running?")
+    }
+  }
+
+  private func execute(_ channel: GRPCChannel) async throws {
    let agentAsyncClient = AgentAsyncClient(channel: channel)
    let execCall = agentAsyncClient.makeExecCall()

@@ -75,11 +95,13 @@ struct Exec: AsyncParsableCommand {
        $0.args = Array(command.dropFirst(1))
        $0.interactive = interactive
        $0.tty = tty
-        $0.terminalSize = .with {
-          let (width, height) = try! Term.GetSize()
+        if tty {
+          $0.terminalSize = .with {
+            let (width, height) = try! Term.GetSize()

-          $0.cols = UInt32(width)
-          $0.rows = UInt32(height)
+            $0.cols = UInt32(width)
+            $0.rows = UInt32(height)
+          }
        }
      })
    })
@@ -88,28 +110,61 @@ struct Exec: AsyncParsableCommand {
    try await withThrowingTaskGroup { group in
      // Stream host's standard input if interactive mode is enabled
      if interactive {
-        let stdinStream = AsyncStream<Data> { continuation in
+        let stdinStream = AsyncThrowingStream<Data, Error> { continuation in
          let handle = FileHandle.standardInput

-          handle.readabilityHandler = { handle in
-            let data = handle.availableData
+          if isRegularFile(handle.fileDescriptor) {
+            // Standard input can be a regular file when input redirection (<) is used,
+            // in which case the handle won't receive any new readability events, so we
+            // just read the file normally here in chunks and consider done with it
+            //
+            // Ideally this is best handled by using non-blocking I/O, but Swift's
+            // standard library only offers inefficient bytes[1] property and SwiftNIO's
+            // NIOFileSystem doesn't seem to support opening raw file descriptors.
+            //
+            // [1]: https://developer.apple.com/documentation/foundation/filehandle/bytes
+            while true {
+              do {
+                let data = try handle.read(upToCount: 64 * 1024)
+                if let data = data {
+                  continuation.yield(data)
+                } else {
+                  continuation.finish()
+                  break
+                }
+              } catch (let error) {
+                continuation.finish(throwing: error)
+                break
+              }
+            }
+          } else {
+            handle.readabilityHandler = { handle in
+              let data = handle.availableData

-            continuation.yield(data)
-
-            if data.isEmpty {
-              continuation.finish()
+              if data.isEmpty {
+                continuation.finish()
+              } else {
+                continuation.yield(data)
+              }
            }
          }
        }

        group.addTask {
-          for await stdinData in stdinStream {
+          for try await stdinData in stdinStream {
            try await execCall.requestStream.send(.with {
              $0.type = .standardInput(.with {
                $0.data = stdinData
              })
            })
          }
+
+          // Signal EOF as we're done reading standard input
+          try await execCall.requestStream.send(.with {
+            $0.type = .standardInput(.with {
+              $0.data = Data()
+            })
+          })
        }
      }

@@ -166,3 +221,13 @@ struct Exec: AsyncParsableCommand {
    }
  }
 }
+
+private func isRegularFile(_ fileDescriptor: Int32) -> Bool {
+  var stat = stat()
+
+  if fstat(fileDescriptor, &stat) != 0 {
+    return false
+  }
+
+  return (stat.st_mode & S_IFMT) == S_IFREG
+}
@@ -6,6 +6,7 @@ fileprivate struct VMInfo: Encodable {
  let CPU: Int
  let Memory: UInt64
  let Disk: Int
+  let DiskFormat: String
  let Size: String
  let Display: String
  let Running: Bool
@@ -26,7 +27,7 @@ struct Get: AsyncParsableCommand {
    let vmConfig = try VMConfig(fromURL: vmDir.configURL)
    let memorySizeInMb = vmConfig.memorySize / 1024 / 1024

-    let info = VMInfo(OS: vmConfig.os, CPU: vmConfig.cpuCount, Memory: memorySizeInMb, Disk: try vmDir.sizeGB(), Size: String(format: "%.3f", Float(try vmDir.allocatedSizeBytes()) / 1000 / 1000 / 1000), Display: vmConfig.display.description, Running: try vmDir.running(), State: try vmDir.state().rawValue)
+    let info = VMInfo(OS: vmConfig.os, CPU: vmConfig.cpuCount, Memory: memorySizeInMb, Disk: try vmDir.sizeGB(), DiskFormat: vmConfig.diskFormat.rawValue, Size: String(format: "%.3f", Float(try vmDir.allocatedSizeBytes()) / 1000 / 1000 / 1000), Display: vmConfig.display.description, Running: try vmDir.running(), State: try vmDir.state().rawValue)
    print(format.renderSingle(info))
  }
 }
@@ -2,12 +2,11 @@ import ArgumentParser
 import Foundation
 import Network
 import SystemConfiguration
-import Sentry

 enum IPResolutionStrategy: String, ExpressibleByArgument, CaseIterable {
-  case dhcp, arp
+  case dhcp, arp, agent

-  private(set) static var allValueStrings: [String] = Format.allCases.map { "\($0)"}
+  private(set) static var allValueStrings: [String] = Self.allCases.map { "\($0)"}
 }

 struct IP: AsyncParsableCommand {
@@ -19,13 +18,11 @@ struct IP: AsyncParsableCommand {
  @Option(help: "Number of seconds to wait for a potential VM booting")
  var wait: UInt16 = 0

-  @Option(help: ArgumentHelp("Strategy for resolving IP address: dhcp or arp",
+  @Option(help: ArgumentHelp("Strategy for resolving IP address",
                             discussion: """
-                             By default, Tart is looking up and parsing DHCP lease file to determine the IP of the VM.\n
-                             This method is fast and the most reliable but only returns local IP adresses.\n
-                             Alternatively, Tart can call external `arp` executable and parse it's output.\n
-                             In case of enabled Bridged Networking this method will return VM's IP address on the network interface used for Bridged Networking.\n
-                             Note that `arp` strategy won't work for VMs using `--net-softnet`.
+                             By default, Tart is using a "dhcp" resolver which parses the DHCP lease file on host and tries to find an entry containing the VM's MAC address. This method is fast and the most reliable, but only works for VMs are not using the bridged networking.\n
+                             Alternatively, Tart has an "arp" resolver which calls an external "arp" executable and parses it's output. This works for VMs using bridged networking and returns their IP, but when they generate enough network activity to populate the host's ARP table. Note that "arp" strategy won't work for VMs using the Softnet networking.\n
+                             A third strategy, "agent" works in all cases reliably, but requires Guest agent for Tart VMs (https://github.com/cirruslabs/tart-guest-agent) to be installed inside of a VM.
                             """))
  var resolver: IPResolutionStrategy = .dhcp

@@ -34,14 +31,16 @@ struct IP: AsyncParsableCommand {
    let vmConfig = try VMConfig.init(fromURL: vmDir.configURL)
    let vmMACAddress = MACAddress(fromString: vmConfig.macAddress.string)!

-    guard let ip = try await IP.resolveIP(vmMACAddress, resolutionStrategy: resolver, secondsToWait: wait) else {
+    guard let ip = try await IP.resolveIP(vmMACAddress, resolutionStrategy: resolver, secondsToWait: wait, controlSocketURL: vmDir.controlSocketURL) else {
      var message = "no IP address found"

      if try !vmDir.running() {
        message += ", is your VM running?"
      }

-      if (vmConfig.os == .linux && resolver == .arp) {
+      if (resolver == .agent) {
+        message += " (also make sure that Guest agent for Tart is running inside of a VM)"
+      } else if (vmConfig.os == .linux && resolver == .arp) {
        message += " (not all Linux distributions are compatible with the ARP resolver)"
      }

@@ -51,7 +50,7 @@ struct IP: AsyncParsableCommand {
    print(ip)
  }

-  static public func resolveIP(_ vmMACAddress: MACAddress, resolutionStrategy: IPResolutionStrategy = .dhcp, secondsToWait: UInt16 = 0) async throws -> IPv4Address? {
+  static public func resolveIP(_ vmMACAddress: MACAddress, resolutionStrategy: IPResolutionStrategy = .dhcp, secondsToWait: UInt16 = 0, controlSocketURL: URL? = nil) async throws -> IPv4Address? {
    let waitUntil = Calendar.current.date(byAdding: .second, value: Int(secondsToWait), to: Date.now)!

    repeat {
@@ -64,6 +63,22 @@ struct IP: AsyncParsableCommand {
        if let leases = try Leases(), let ip = leases.ResolveMACAddress(macAddress: vmMACAddress) {
          return ip
        }
+      case .agent:
+        guard let controlSocketURL = controlSocketURL else {
+          throw RuntimeError.Generic("Cannot perform IP resolution via Tart Guest Agent when control socket URL is not set")
+        }
+
+        // Change the current working directory to a VM's base directory
+        // to work around Unix domain socket 104 byte limitation [1]
+        //
+        // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
+        if let baseURL = controlSocketURL.baseURL {
+          FileManager.default.changeCurrentDirectoryPath(baseURL.path())
+        }
+
+        if let ip = try await AgentResolver.ResolveIP(controlSocketURL.relativePath) {
+          return ip
+        }
      }

      // wait a second
@@ -17,7 +17,7 @@ struct Import: AsyncParsableCommand {
  }

  func run() async throws {
-    let localStorage = VMStorageLocal()
+    let localStorage = try VMStorageLocal()

    // Create a temporary VM directory to which we will load the export file
    let tmpVMDir = try VMDirectory.temporary()
@@ -64,6 +64,8 @@ struct Login: AsyncParsableCommand {
 }

 fileprivate class DictionaryCredentialsProvider: CredentialsProvider {
+  let userFriendlyName = "static dictionary credentials provider"
+
  var credentials: Dictionary<String, (String, String)>

  init(_ credentials: Dictionary<String, (String, String)>) {
@@ -1,6 +1,6 @@
 import ArgumentParser
 import Dispatch
-import Sentry
+import OpenTelemetryApi
 import SwiftUI
 import SwiftDate

@@ -53,9 +53,9 @@ struct Prune: AsyncParsableCommand {

    switch entries {
    case "caches":
-      prunableStorages = [VMStorageOCI(), try IPSWCache()]
+      prunableStorages = [try VMStorageOCI(), try IPSWCache()]
    case "vms":
-      prunableStorages = [VMStorageLocal()]
+      prunableStorages = [try VMStorageLocal()]
    default:
      throw ValidationError("unsupported --entries value, please specify either \"caches\" or \"vms\"")
    }
@@ -109,9 +109,10 @@ struct Prune: AsyncParsableCommand {
      return
    }

-    SentrySDK.configureScope { scope in
-      scope.setContext(value: ["requiredBytes": requiredBytes], key: "Prune")
-    }
+    OpenTelemetry.instance.contextProvider.activeSpan?.setAttribute(
+      key: "prune.required-bytes",
+      value: .int(Int(requiredBytes))
+    )

    // Figure out how much disk space is available
    let attrs = try Config().tartCacheDir.resourceValues(forKeys: [
@@ -123,18 +124,14 @@ struct Prune: AsyncParsableCommand {
      UInt64(attrs.volumeAvailableCapacityForImportantUsage!)
    )

-    SentrySDK.configureScope { scope in
-      scope.setContext(value: [
-        "volumeAvailableCapacity": attrs.volumeAvailableCapacity!,
-        "volumeAvailableCapacityForImportantUsage": attrs.volumeAvailableCapacityForImportantUsage!,
-        "volumeAvailableCapacityCalculated": volumeAvailableCapacityCalculated
-      ], key: "Prune")
-    }
+    OpenTelemetry.instance.contextProvider.activeSpan?.setAttributes([
+      "prune.volume-available-capacity-bytes": .int(Int(attrs.volumeAvailableCapacity!)),
+      "prune.volume-available-capacity-for-important-usage-bytes": .int(Int(attrs.volumeAvailableCapacityForImportantUsage!)),
+      "prune.volume-available-capacity-calculated": .int(Int(volumeAvailableCapacityCalculated)),
+    ])

    if volumeAvailableCapacityCalculated <= 0 {
-      SentrySDK.capture(message: "Zero volume capacity reported") { scope in
-        scope.setLevel(.warning)
-      }
+      OpenTelemetry.instance.contextProvider.activeSpan?.addEvent(name: "Zero volume capacity reported")

      return
    }
@@ -149,10 +146,10 @@ struct Prune: AsyncParsableCommand {
  }

  private static func reclaimIfPossible(_ reclaimBytes: UInt64, _ initiator: Prunable? = nil) throws {
-    let transaction = SentrySDK.startTransaction(name: "Pruning cache", operation: "prune", bindToScope: true)
-    defer { transaction.finish() }
+    let span = OTel.shared.tracer.spanBuilder(spanName: "prune").startSpan()
+    defer { span.end() }

-    let prunableStorages: [PrunableStorage] = [VMStorageOCI(), try IPSWCache()]
+    let prunableStorages: [PrunableStorage] = [try VMStorageOCI(), try IPSWCache()]
    let prunables: [Prunable] = try prunableStorages
      .flatMap { try $0.prunables() }
      .sorted { try $0.accessDate() < $1.accessDate() }
@@ -177,13 +174,17 @@ struct Prune: AsyncParsableCommand {
        continue
      }

-      try SentrySDK.span?.setData(value: prunable.allocatedSizeBytes(), key: prunable.url.path)
+      let allocatedSizeBytes = try prunable.allocatedSizeBytes()

-      cacheReclaimedBytes += try prunable.allocatedSizeBytes()
+      OpenTelemetry.instance.contextProvider.activeSpan?
+        .addEvent(name: "Pruned \(allocatedSizeBytes) bytes for \(prunable.url.path)")
+
+      cacheReclaimedBytes += allocatedSizeBytes

      try prunable.delete()
    }

-    SentrySDK.span?.setMeasurement(name: "gc_disk_reclaimed", value: cacheReclaimedBytes as NSNumber, unit: MeasurementUnitInformation.byte);
+    OpenTelemetry.instance.contextProvider.activeSpan?
+      .addEvent(name: "Reclaimed \(cacheReclaimedBytes) bytes")
  }
 }
@@ -35,7 +35,7 @@ struct Pull: AsyncParsableCommand {
  func run() async throws {
    // Be more liberal when accepting local image as argument,
    // see https://github.com/cirruslabs/tart/issues/36
-    if VMStorageLocal().exists(remoteName) {
+    if try VMStorageLocal().exists(remoteName) {
      print("\"\(remoteName)\" is a local image, nothing to pull here!")

      return
@@ -39,7 +39,7 @@ struct Push: AsyncParsableCommand {
  var populateCache: Bool = false

  func run() async throws {
-    let ociStorage = VMStorageOCI()
+    let ociStorage = try VMStorageOCI()
    let localVMDir = try VMStorageHelper.open(localName)
    let lock = try localVMDir.lock()
    if try !lock.trylock() {
@@ -17,7 +17,7 @@ struct Rename: AsyncParsableCommand {
  }

  func run() async throws {
-    let localStorage = VMStorageLocal()
+    let localStorage = try VMStorageLocal()

    if !localStorage.exists(name) {
      throw ValidationError("failed to rename a non-existent local VM: \(name)")
@@ -4,7 +4,7 @@ import Darwin
 import Dispatch
 import SwiftUI
 import Virtualization
-import Sentry
+import OpenTelemetryApi
 import System

 var vm: VM?
@@ -116,10 +116,6 @@ struct Run: AsyncParsableCommand {
  #endif
  var vncExperimental: Bool = false

-  // Note that the valueName here should really be "path[:options]" instead of just "path",
-  // see ArgumentParser issue[1] for more details.
-  //
-  // [1]: https://github.com/apple/swift-argument-parser/issues/761
  @Option(help: ArgumentHelp("""
  Additional disk attachments with an optional read-only and synchronization options in the form of path[:options] (e.g. --disk="disk.bin", --disk="ubuntu.iso:ro", --disk="/dev/disk0", --disk "ghcr.io/cirruslabs/xcode:16.0:ro" or --disk="nbd://localhost:10809/myDisk:sync=none")
  """, discussion: """
@@ -138,12 +134,13 @@ struct Run: AsyncParsableCommand {

  Learn how to create a disk image using Disk Utility here: https://support.apple.com/en-gb/guide/disk-utility/dskutl11888/mac

-  To work with block devices, the easiest way is to modify their permissions (e.g. by using "sudo chown $USER /dev/diskX") or to run the Tart binary as root, which affects locating Tart VMs.
+  To work with block devices, the easiest way is to modify their permissions to be accessible to the current user:

-  To work around this pass TART_HOME explicitly:
+  sudo chown $USER /dev/diskX
+  tart run sequoia --disk=/dev/diskX

-  sudo TART_HOME="$HOME/.tart" tart run sequoia --disk=/dev/disk0
-  """, valueName: "path"), completion: .file())
+  Warning: after running the chown command above, all software running under the current user will be able to access /dev/diskX. If that violates your threat model, we recommend avoiding mounting block devices altogether.
+  """, valueName: "path[:options]"), completion: .file())
  var disk: [String] = []

  #if arch(arm64)
@@ -162,10 +159,6 @@ struct Run: AsyncParsableCommand {
  #endif
  var rosettaTag: String?

-  // Note that the valueName here should really be "[name:]path[:options]" instead of just "path",
-  // see ArgumentParser issue[1] for more details.
-  //
-  // [1]: https://github.com/apple/swift-argument-parser/issues/761
  @Option(help: ArgumentHelp("Additional directory shares with an optional read-only and mount tag options in the form of [name:]path[:options] (e.g. --dir=\"~/src/build\" or --dir=\"~/src/sources:ro\")", discussion: """
  Requires host to be macOS 13.0 (Ventura) or newer. macOS guests must be running macOS 13.0 (Ventura) or newer too.

@@ -178,7 +171,7 @@ struct Run: AsyncParsableCommand {
  Mount tag can be overridden by appending tag property to the directory share (e.g. --dir=\"~/src/build:tag=build\" or --dir=\"~/src/build:ro,tag=build\"). Then it can be mounted via "mount_virtiofs build ~/build" inside guest macOS and "mount -t virtiofs build ~/build" inside guest Linux.

  In case of passing multiple directories per mount tag it is required to prefix them with names e.g. --dir=\"build:~/src/build\" --dir=\"sources:~/src/sources:ro\". These names will be used as directory names under the mounting point inside guests. For the example above it will be "/Volumes/My Shared Files/build" and "/Volumes/My Shared Files/sources" respectively.
-  """, valueName: "path"), completion: .directory)
+  """, valueName: "[name:]path[:options]"), completion: .directory)
  var dir: [String] = []

  @Flag(help: ArgumentHelp("Enable nested virtualization if possible"))
@@ -209,15 +202,28 @@ struct Run: AsyncParsableCommand {
                           """))
  var netSoftnet: Bool = false

-  @Option(help: ArgumentHelp("Comma-separated list of CIDRs to allow the traffic to when using Softnet isolation\n(e.g. --net-softnet-allow=192.168.0.0/24)", discussion: """
+  @Option(help: ArgumentHelp("Comma-separated list of CIDRs to allow the traffic to when using Softnet isolation (e.g. --net-softnet-allow=192.168.0.0/24)", discussion: """
  This option allows you bypass the private IPv4 address space restrictions imposed by --net-softnet.

-  For example, you can allow the VM to communicate with the local network with e.g. --net-softnet-allow=10.0.0.0/16 or to completely disable the destination based restrictions with --net-softnet-allow=0.0.0.0/0.
+  For example, you can allow the VM to communicate with the local network with e.g. --net-softnet-allow=10.0.0.0/16 or with --net-softnet-allow=0.0.0.0/0 to completely disable the destination based restrictions, including VMs bridge isolation.
+
+  When used with --net-softnet-block, the longest prefix match always wins. In case the same prefix is both allowed and blocked, blocking takes precedence.

  Implies --net-softnet.
  """, valueName: "comma-separated CIDRs"))
  var netSoftnetAllow: String?

+  @Option(help: ArgumentHelp("Comma-separated list of CIDRs to block the traffic to when using Softnet isolation (e.g. --net-softnet-block=66.66.0.0/16)", discussion: """
+  This option allows you to tighten the IPv4 address space restrictions imposed by --net-softnet even further.
+
+  For example --net-softnet-block=0.0.0.0/0 may be used to establish a default deny policy that is further relaxed with --net-softnet-allow.
+
+  When used with --net-softnet-allow, the longest prefix match always wins. In case the same prefix is both allowed and blocked, blocking takes precedence.
+
+  Implies --net-softnet.
+  """, valueName: "comma-separated CIDRs"))
+  var netSoftnetBlock: String?
+
  @Option(help: ArgumentHelp("Comma-separated list of TCP ports to expose (e.g. --net-softnet-expose 2222:22,8080:80)", discussion: """
  Options are comma-separated and are as follows:

@@ -273,13 +279,19 @@ struct Run: AsyncParsableCommand {
  #endif
  var noTrackpad: Bool = false

+  @Flag(help: ArgumentHelp("Disable the pointer"))
+  var noPointer: Bool = false
+
+  @Flag(help: ArgumentHelp("Disable the keyboard"))
+  var noKeyboard: Bool = false
+
  mutating func validate() throws {
    if vnc && vncExperimental {
      throw ValidationError("--vnc and --vnc-experimental are mutually exclusive")
    }

    // Automatically enable --net-softnet when any of its related options are specified
-    if netSoftnetAllow != nil || netSoftnetExpose != nil {
+    if netSoftnetAllow != nil || netSoftnetBlock != nil || netSoftnetExpose != nil {
      netSoftnet = true
    }

@@ -309,7 +321,7 @@ struct Run: AsyncParsableCommand {
      }
    }

-    let localStorage = VMStorageLocal()
+    let localStorage = try VMStorageLocal()
    let vmDir = try localStorage.open(name)
    if try vmDir.state() == .Suspended {
      suspendable = true
@@ -320,15 +332,19 @@ struct Run: AsyncParsableCommand {
      if !(config.platform is PlatformSuspendable) {
        throw ValidationError("You can only suspend macOS VMs")
      }
-      if dir.count > 0 {
-        throw ValidationError("Suspending VMs with shared directories is not supported")
-      }

      if noTrackpad {
        throw ValidationError("--no-trackpad cannot be used with --suspendable")
      }
+      if noKeyboard {
+        throw ValidationError("--no-keyboard cannot be used with --suspendable")
+      }
+      if noPointer {
+        throw ValidationError("--no-pointer cannot be used with --suspendable")
+      }
    }

+
    if noTrackpad {
      let config = try VMConfig.init(fromURL: vmDir.configURL)
      if config.os != .darwin {
@@ -345,9 +361,15 @@ struct Run: AsyncParsableCommand {

  @MainActor
  func run() async throws {
-    let localStorage = VMStorageLocal()
+    let localStorage = try VMStorageLocal()
    let vmDir = try localStorage.open(name)

+    // Validate disk format support
+    let vmConfig = try VMConfig(fromURL: vmDir.configURL)
+    if !vmConfig.diskFormat.isSupported {
+      throw ValidationError("Disk format '\(vmConfig.diskFormat.rawValue)' is not supported on this system.")
+    }
+
    let storageLock = try FileLock(lockURL: Config().tartHomeDir)
    try storageLock.lock()
    // check if there is a running VM with the same MAC address
@@ -398,7 +420,9 @@ struct Run: AsyncParsableCommand {
      clipboard: !noClipboard,
      sync: VZDiskImageSynchronizationMode(diskOptions.syncModeRaw),
      caching: VZDiskImageCachingMode(diskOptions.cachingModeRaw),
-      noTrackpad: noTrackpad
+      noTrackpad: noTrackpad,
+      noPointer: noPointer,
+      noKeyboard: noKeyboard
    )

    let vncImpl: VNC? = try {
@@ -501,14 +525,15 @@ struct Run: AsyncParsableCommand {
          try vncImpl.stop()
        }

+        OTel.shared.flush()
        Foundation.exit(0)
      } catch {
-        // Capture the error into Sentry
-        SentrySDK.capture(error: error)
-        SentrySDK.flush(timeout: 2.seconds.timeInterval)
+        // Capture the error into OpenTelemetry
+        OpenTelemetry.instance.contextProvider.activeSpan?.recordException(error)

        fputs("\(error)\n", stderr)

+        OTel.shared.flush()
        Foundation.exit(1)
      }
    }
@@ -542,12 +567,14 @@ struct Run: AsyncParsableCommand {
            } else {
              print(RuntimeError.SuspendFailed("this functionality is only supported on macOS 14 (Sonoma) or newer"))

+              OTel.shared.flush()
              Foundation.exit(1)
            }
          #endif
        } catch (let e) {
          print(RuntimeError.SuspendFailed(e.localizedDescription))

+          OTel.shared.flush()
          Foundation.exit(1)
        }
      }
@@ -599,6 +626,10 @@ struct Run: AsyncParsableCommand {
      softnetExtraArguments += ["--allow", netSoftnetAllow]
    }

+    if let netSoftnetBlock = netSoftnetBlock {
+      softnetExtraArguments += ["--block", netSoftnetBlock]
+    }
+
    if let netSoftnetExpose = netSoftnetExpose {
      softnetExtraArguments += ["--expose", netSoftnetExpose]
    }
@@ -788,6 +819,12 @@ struct MainApp: App {
 }

 class AppDelegate: NSObject, NSApplicationDelegate, ObservableObject {
+  func applicationDidFinishLaunching(_ : Notification) {
+    let nsApp = NSApplication.shared
+    nsApp.setActivationPolicy(.regular)
+    nsApp.activate(ignoringOtherApps: true)
+  }
+
  func applicationShouldTerminate(_ sender: NSApplication) -> NSApplication.TerminateReply {
    if (kill(getpid(), MainApp.suspendable ? SIGUSR1 : SIGINT) == 0) {
      return .terminateLater
@@ -14,7 +14,7 @@ struct Set: AsyncParsableCommand {
  @Option(help: "VM memory size in megabytes")
  var memory: UInt64?

-  @Option(help: "VM display resolution in a format of <width>x<height>. For example, 1200x800")
+  @Option(help: "VM display resolution in a format of WIDTHxHEIGHT[pt|px]. For example, 1200x800, 1200x800pt or 1920x1080px. Units are treated as hints and default to \"pt\" (points) for macOS VMs and \"px\" (pixels) for Linux VMs when not specified.")
  var display: VMDisplayConfig?

  @Flag(inversion: .prefixedNo, help: ArgumentHelp("Whether to automatically reconfigure the VM's display to fit the window"))
@@ -56,6 +56,7 @@ struct Set: AsyncParsableCommand {
      if (display.height > 0) {
        vmConfig.display.height = display.height
      }
+      vmConfig.display.unit = display.unit
    }

    vmConfig.displayRefit = displayRefit
@@ -88,12 +89,24 @@ struct Set: AsyncParsableCommand {

 extension VMDisplayConfig: ExpressibleByArgument {
  public init(argument: String) {
+    var argument = argument
+    var unit: Unit? = nil
+
+    if argument.hasSuffix(Unit.pixel.rawValue) {
+      argument = String(argument.dropLast(Unit.pixel.rawValue.count))
+      unit = Unit.pixel
+    } else if argument.hasSuffix(Unit.point.rawValue) {
+      argument = String(argument.dropLast(Unit.point.rawValue.count))
+      unit = Unit.point
+    }
+
    let parts = argument.components(separatedBy: "x").map {
      Int($0) ?? 0
    }
    self = VMDisplayConfig(
      width: parts[safe: 0] ?? 0,
-      height: parts[safe: 1] ?? 0
+      height: parts[safe: 1] ?? 0,
+      unit: unit,
    )
  }
 }
@@ -9,7 +9,8 @@ struct Config {
    var tartHomeDir: URL

    if let customTartHome = ProcessInfo.processInfo.environment["TART_HOME"] {
-      tartHomeDir = URL(fileURLWithPath: customTartHome)
+      tartHomeDir = URL(fileURLWithPath: customTartHome, isDirectory: true)
+      try Self.validateTartHome(url: tartHomeDir)
    } else {
      tartHomeDir = FileManager.default
        .homeDirectoryForCurrentUser
@@ -49,4 +50,24 @@ struct Config {
  static func jsonDecoder() -> JSONDecoder {
    JSONDecoder()
  }
+
+  private static func validateTartHome(url: URL) throws {
+    let urlComponents = url.pathComponents
+
+    let descendingURLs = urlComponents.indices.map { i in
+      URL(fileURLWithPath: urlComponents[0...i].joined(separator: "/"))
+    }
+
+    for descendingURL in descendingURLs {
+      if FileManager.default.fileExists(atPath: descendingURL.path) {
+        continue
+      }
+
+      do {
+        try FileManager.default.createDirectory(at: descendingURL, withIntermediateDirectories: false)
+      } catch {
+        throw RuntimeError.Generic("TART_HOME is invalid: \(descendingURL.path) does not exist, yet we can't create it: \(error.localizedDescription)")
+      }
+    }
+  }
 }
@@ -21,8 +21,16 @@ class ControlSocket {
    // if any, otherwise we may get the "address already in use" error
    try? FileManager.default.removeItem(atPath: controlSocketURL.path())

+    // Change the current working directory to a VM's base directory
+    // to work around Unix domain socket 104 byte limitation [1]
+    //
+    // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
+    if let baseURL = controlSocketURL.baseURL {
+      FileManager.default.changeCurrentDirectoryPath(baseURL.path())
+    }
+
    let serverChannel = try await ServerBootstrap(group: eventLoopGroup)
-      .bind(unixDomainSocketPath: controlSocketURL.path()) { childChannel in
+      .bind(unixDomainSocketPath: controlSocketURL.relativePath) { childChannel in
        childChannel.eventLoop.makeCompletedFuture {
          return try NIOAsyncChannel<ByteBuffer, ByteBuffer>(
            wrappingChannelSynchronously: childChannel
@@ -5,6 +5,7 @@ enum CredentialsProviderError: Error {
 }

 protocol CredentialsProvider {
+  var userFriendlyName: String { get }
  func retrieve(host: String) throws -> (String, String)?
  func store(host: String, user: String, password: String) throws
 }
@@ -1,6 +1,8 @@
 import Foundation

 class DockerConfigCredentialsProvider: CredentialsProvider {
+  let userFriendlyName = "Docker configuration credentials provider"
+
  func retrieve(host: String) throws -> (String, String)? {
    let dockerConfigURL = FileManager.default.homeDirectoryForCurrentUser.appendingPathComponent(".docker").appendingPathComponent("config.json")
    if !FileManager.default.fileExists(atPath: dockerConfigURL.path) {
@@ -1,6 +1,8 @@
 import Foundation

 class EnvironmentCredentialsProvider: CredentialsProvider {
+  let userFriendlyName = "environment variable credentials provider"
+
  func retrieve(host: String) throws -> (String, String)? {
    if let tartRegistryHostname = ProcessInfo.processInfo.environment["TART_REGISTRY_HOSTNAME"],
       tartRegistryHostname != host {
@@ -1,6 +1,8 @@
 import Foundation

 class KeychainCredentialsProvider: CredentialsProvider {
+  let userFriendlyName = "Keychain credentials provider"
+
  func retrieve(host: String) throws -> (String, String)? {
    let query: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
                                kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
@@ -6,6 +6,8 @@ enum StdinCredentialsError: Error {
 }

 class StdinCredentials {
+  let userFriendlyName = "standard input credentials provider"
+
  static func retrieve() throws -> (String, String) {
    let user = try readStdinCredential(name: "username", prompt: "User: ", isSensitive: false)
    let password = try readStdinCredential(name: "password", prompt: "Password: ", isSensitive: true)
@@ -0,0 +1,43 @@
+import Foundation
+import ArgumentParser
+
+enum DiskImageFormat: String, CaseIterable, Codable {
+  case raw = "raw"
+  case asif = "asif"
+
+  var displayName: String {
+    switch self {
+    case .raw:
+      return "RAW"
+    case .asif:
+      return "ASIF (Apple Sparse Image Format)"
+    }
+  }
+
+
+  /// Check if the format is supported on the current system
+  var isSupported: Bool {
+    switch self {
+    case .raw:
+      return true
+    case .asif:
+      if #available(macOS 26, *) {
+        return true
+      } else {
+        return false
+      }
+    }
+  }
+
+
+}
+
+extension DiskImageFormat: ExpressibleByArgument {
+  init?(argument: String) {
+    self.init(rawValue: argument.lowercased())
+  }
+
+  static var allValueStrings: [String] {
+    return allCases.map { $0.rawValue }
+  }
+}
@@ -0,0 +1,108 @@
+import Foundation
+
+struct ImageInfo: Codable {
+  let sizeInfo: SizeInfo?
+  let size: UInt64?
+
+  enum CodingKeys: String, CodingKey {
+    case sizeInfo = "Size Info"
+    case size = "Size"
+  }
+
+  func totalBytes() throws -> Int {
+    if let totalBytes = self.sizeInfo?.totalBytes {
+      return Int(totalBytes)
+    }
+
+    if let size = self.size {
+      return Int(size)
+    }
+
+    throw RuntimeError.Generic("Could not find size information in disk image info")
+  }
+}
+
+struct SizeInfo: Codable {
+  let totalBytes: UInt64?
+
+  enum CodingKeys: String, CodingKey {
+    case totalBytes = "Total Bytes"
+  }
+}
+
+struct Diskutil {
+  static func imageCreate(diskURL: URL, sizeGB: UInt16) throws {
+    do {
+      _ = try run([
+        "image", "create", "blank",
+        "--format", "ASIF",
+        "--size", "\(sizeGB)G",
+        "--volumeName", "Tart",
+        diskURL.path
+      ])
+    } catch {
+      throw RuntimeError.FailedToCreateDisk("Failed to create ASIF disk image: \(error)")
+    }
+  }
+
+  static func imageInfo(_ diskURL: URL) throws -> ImageInfo {
+    do {
+      let (stdoutData, _) = try run([
+        "image", "info", "--plist",
+        diskURL.path
+      ])
+
+      do {
+        return try PropertyListDecoder().decode(ImageInfo.self, from: stdoutData)
+      } catch {
+        throw RuntimeError.Generic("Failed to parse \"diskutil image info --plist\" output: \(error)")
+      }
+    }
+  }
+
+  private static func run(_ arguments: [String]) throws -> (Data, Data) {
+    guard let diskutilURL = resolveBinaryPath("diskutil") else {
+      throw RuntimeError.Generic("\"diskutil\" binary is not found in PATH")
+    }
+
+    let process = Process()
+    process.executableURL = diskutilURL
+    process.arguments = arguments
+
+    let stdoutPipe = Pipe()
+    process.standardOutput = stdoutPipe
+    let stderrPipe = Pipe()
+    process.standardError = stderrPipe
+
+    do {
+      try process.run()
+    } catch {
+      throw RuntimeError.Generic("\"\(arguments.joined(separator: " "))\" failed: \(error)")
+    }
+    process.waitUntilExit()
+
+    let stdoutData = stdoutPipe.fileHandleForReading.readDataToEndOfFile()
+    let stderrData = stderrPipe.fileHandleForReading.readDataToEndOfFile()
+
+    if process.terminationStatus != 0 {
+      let stdoutString = String(data: stdoutData, encoding: .utf8) ?? ""
+      let stderrString = String(data: stderrData, encoding: .utf8) ?? ""
+
+      throw RuntimeError.Generic("\"\(arguments.joined(separator: " "))\" failed with exit code \(process.terminationStatus): \(firstNonEmptyLine(stderrString, stdoutString))")
+    }
+
+    return (stdoutData, stderrData)
+  }
+
+  private static func firstNonEmptyLine(_ outputs: String...) -> String {
+    for output in outputs {
+      for line in output.split(separator: "\n", omittingEmptySubsequences: false) {
+        if !line.isEmpty {
+          return String(line)
+        }
+      }
+    }
+
+    return ""
+  }
+}
@@ -4,18 +4,28 @@ public class ProgressObserver: NSObject {
  @objc var progressToObserve: Progress
  var observation: NSKeyValueObservation?
  var lastTimeUpdated = Date.now
+  private var lastRenderedLine: String?

  public init(_ progress: Progress) {
    progressToObserve = progress
  }

  func log(_ renderer: Logger) {
-    renderer.appendNewLine(ProgressObserver.lineToRender(progressToObserve))
+    let initialLine = ProgressObserver.lineToRender(progressToObserve)
+    renderer.appendNewLine(initialLine)
+    lastRenderedLine = initialLine
    observation = observe(\.progressToObserve.fractionCompleted) { progress, _ in
      let currentTime = Date.now
      if self.progressToObserve.isFinished || currentTime.timeIntervalSince(self.lastTimeUpdated) >= 1.0 {
        self.lastTimeUpdated = currentTime
-        renderer.updateLastLine(ProgressObserver.lineToRender(self.progressToObserve))
+        let line = ProgressObserver.lineToRender(self.progressToObserve)
+        // Skip identical renders so non-interactive logs only see new percent values.
+        if line == self.lastRenderedLine {
+          return
+        }
+
+        self.lastRenderedLine = line
+        renderer.updateLastLine(line)
      }
    }
  }
@@ -0,0 +1,42 @@
+import Foundation
+import Network
+import NIOPosix
+import GRPC
+import Cirruslabs_TartGuestAgent_Apple_Swift
+import Cirruslabs_TartGuestAgent_Grpc_Swift
+
+class AgentResolver {
+  static func ResolveIP(_ controlSocketPath: String) async throws -> IPv4Address? {
+    do {
+      return try await resolveIP(controlSocketPath)
+    } catch let error as GRPCConnectionPoolError {
+      return nil
+    }
+  }
+
+  private static func resolveIP(_ controlSocketPath: String) async throws -> IPv4Address? {
+    // Create a gRPC channel connected to the VM's control socket
+    let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
+    defer {
+      try! group.syncShutdownGracefully()
+    }
+
+    let channel = try GRPCChannelPool.with(
+      target: .unixDomainSocket(controlSocketPath),
+      transportSecurity: .plaintext,
+      eventLoopGroup: group,
+    )
+    defer {
+      try! channel.close().wait()
+    }
+
+    // Invoke ResolveIP() gRPC method
+    let callOptions = CallOptions(timeLimit: .timeout(.seconds(1)))
+    let agentAsyncClient = AgentAsyncClient(channel: channel)
+    let resolveIPCall = agentAsyncClient.makeResolveIpCall(ResolveIPRequest(), callOptions: callOptions)
+
+    let response = try await resolveIPCall.response
+
+    return IPv4Address(response.ip)
+  }
+}
@@ -14,6 +14,9 @@ let nvramMediaType = "application/vnd.cirruslabs.tart.nvram.v1"
 let uncompressedDiskSizeAnnotation = "org.cirruslabs.tart.uncompressed-disk-size"
 let uploadTimeAnnotation = "org.cirruslabs.tart.upload-time"

+// Manifest labels
+let diskFormatLabel = "org.cirruslabs.tart.disk.format"
+
 // Layer annotations
 let uncompressedSizeAnnotation = "org.cirruslabs.tart.uncompressed-size"
 let uncompressedContentDigestAnnotation = "org.cirruslabs.tart.uncompressed-content-digest"
@@ -429,8 +429,12 @@ class Registry {
    }

    for provider in credentialsProviders {
-      if let (user, password) = try provider.retrieve(host: host) {
-        return (user, password)
+      do {
+        if let (user, password) = try provider.retrieve(host: host) {
+          return (user, password)
+        }
+      } catch (let e) {
+        print("Failed to retrieve credentials using \(provider.userFriendlyName), authentication may fail: \(e)")
      }
    }
    return nil
@@ -0,0 +1,64 @@
+import Foundation
+import OpenTelemetryApi
+import OpenTelemetrySdk
+import OpenTelemetryProtocolExporterHttp
+import ResourceExtension
+
+class OTel {
+  let tracerProvider: TracerProviderSdk?
+  let tracer: Tracer
+
+  static let shared = OTel()
+
+  init() {
+    tracerProvider = Self.initializeTracing()
+    tracer = OpenTelemetry.instance.tracerProvider.get(instrumentationName: "tart", instrumentationVersion: CI.version)
+  }
+
+  static func initializeTracing() -> TracerProviderSdk? {
+    guard let _ = ProcessInfo.processInfo.environment["TRACEPARENT"] else {
+      return nil
+    }
+
+    var resource = DefaultResources().get()
+
+    resource.merge(other: Resource(attributes: [
+      SemanticConventions.Service.name.rawValue: .string("tart"),
+      SemanticConventions.Service.version.rawValue: .string(CI.version)
+    ]))
+
+    let spanExporter: SpanExporter
+    if let endpointRaw = ProcessInfo.processInfo.environment["OTEL_EXPORTER_OTLP_TRACES_ENDPOINT"],
+       let endpoint = URL(string: endpointRaw) {
+      spanExporter = OtlpHttpTraceExporter(endpoint: endpoint)
+    } else {
+      spanExporter = OtlpHttpTraceExporter()
+    }
+    let spanProcessor = SimpleSpanProcessor(spanExporter: spanExporter)
+    let tracerProvider = TracerProviderBuilder()
+      .add(spanProcessor: spanProcessor)
+      .with(resource: resource)
+      .build()
+
+    OpenTelemetry.registerTracerProvider(tracerProvider: tracerProvider)
+
+    return tracerProvider
+  }
+
+  func flush() {
+    OpenTelemetry.instance.contextProvider.activeSpan?.end()
+
+    guard let tracerProvider else {
+      // No tracing was initialized, so just ending a span is enough
+      return
+    }
+
+    tracerProvider.forceFlush()
+
+    // Work around OpenTelemtry not flushing traces after explicitly asking it to do so
+    //
+    // [1]: https://github.com/open-telemetry/opentelemetry-swift/issues/685
+    // [2]: https://github.com/open-telemetry/opentelemetry-swift/issues/555
+    Thread.sleep(forTimeInterval: .fromMilliseconds(100))
+  }
+}
@@ -82,7 +82,7 @@ struct UnsupportedHostOSError: Error, CustomStringConvertible {
    func graphicsDevice(vmConfig: VMConfig) -> VZGraphicsDeviceConfiguration {
      let result = VZMacGraphicsDeviceConfiguration()

-      if let hostMainScreen = NSScreen.main {
+      if (vmConfig.display.unit ?? .point) == .point, let hostMainScreen = NSScreen.main {
        let vmScreenSize = NSSize(width: vmConfig.display.width, height: vmConfig.display.height)
        result.displays = [
          VZMacGraphicsDisplayConfiguration(for: hostMainScreen, sizeInPoints: vmScreenSize)
@@ -1,7 +1,9 @@
 import ArgumentParser
 import Darwin
 import Foundation
-import Sentry
+import OpenTelemetryApi
+import OpenTelemetrySdk
+import OpenTelemetryProtocolExporterHttp

@main
 struct Root: AsyncParsableCommand {
@@ -31,39 +33,6 @@ struct Root: AsyncParsableCommand {
    ])

  public static func main() async throws {
-    // Initialize Sentry
-    if let dsn = ProcessInfo.processInfo.environment["SENTRY_DSN"] {
-      SentrySDK.start { options in
-        options.dsn = dsn
-        options.releaseName = CI.release
-        options.tracesSampleRate = Float(
-          ProcessInfo.processInfo.environment["SENTRY_TRACES_SAMPLE_RATE"] ?? "1.0"
-        ) as NSNumber?
-
-        // By default only 5XX are captured
-        // Let's capture everything but 401 (unauthorized)
-        options.enableCaptureFailedRequests = true
-        options.failedRequestStatusCodes = [
-          HttpStatusCodeRange(min: 400, max: 400),
-          HttpStatusCodeRange(min: 402, max: 599)
-        ]
-      }
-    }
-    defer { SentrySDK.flush(timeout: 2.seconds.timeInterval) }
-
-    SentrySDK.configureScope { scope in
-      scope.setExtra(value: ProcessInfo.processInfo.arguments, key: "Command-line arguments")
-    }
-
-    // Enrich future events with Cirrus CI-specific tags
-    if let tags = ProcessInfo.processInfo.environment["CIRRUS_SENTRY_TAGS"] {
-      SentrySDK.configureScope { scope in
-        for (key, value) in tags.split(separator: ",").compactMap({ parseCirrusSentryTag($0) }) {
-          scope.setTag(value: value, key: key)
-        }
-      }
-    }
-
    // Add commands that are only available on specific macOS versions
    if #available(macOS 14, *) {
      configuration.subcommands.append(Suspend.self)
@@ -83,19 +52,40 @@ struct Root: AsyncParsableCommand {
    // Set line-buffered output for stdout
    setlinebuf(stdout)

-    // Parse and run command
+    defer { OTel.shared.flush() }
+
    do {
+      // Parse command
      var command = try parseAsRoot()

+      // Create a root span for the command we're about to run
+      let span = OTel.shared.tracer.spanBuilder(spanName: type(of: command)._commandName).startSpan()
+      defer { span.end() }
+      OpenTelemetry.instance.contextProvider.setActiveSpan(span)
+
+      // Enrich root command span with command's arguments
+      let commandLineArguments = ProcessInfo.processInfo.arguments.map { argument in
+        AttributeValue.string(argument)
+      }
+      span.setAttribute(key: "Command-line arguments", value: .array(AttributeArray(values: commandLineArguments)))
+
+      // Enrich root command span with Cirrus CI-specific tags
+      if let tags = ProcessInfo.processInfo.environment["CIRRUS_SENTRY_TAGS"] {
+        for (key, value) in tags.split(separator: ",").compactMap(splitEnvironmentVariable) {
+          span.setAttribute(key: key, value: .string(value))
+        }
+      }
+
      // Run garbage-collection before each command (shouldn't take too long)
      if type(of: command) != type(of: Pull()) && type(of: command) != type(of: Clone()){
        do {
          try Config().gc()
        } catch {
-          fputs("Failed to perform garbage collection!\n\(error)\n", stderr)
+          fputs("Failed to perform garbage collection: \(error)\n", stderr)
        }
      }

+      // Run command
      if var asyncCommand = command as? AsyncParsableCommand {
        try await asyncCommand.run()
      } else {
@@ -104,17 +94,18 @@ struct Root: AsyncParsableCommand {
    } catch {
      // Not an error, just a custom exit code from "tart exec"
      if let execCustomExitCodeError = error as? ExecCustomExitCodeError {
+        OTel.shared.flush()
        Foundation.exit(execCustomExitCodeError.exitCode)
      }

-      // Capture the error into Sentry
-      SentrySDK.capture(error: error)
-      SentrySDK.flush(timeout: 2.seconds.timeInterval)
+      // Capture the error into OpenTelemetry
+      OpenTelemetry.instance.contextProvider.activeSpan?.recordException(error)

      // Handle a non-ArgumentParser's exception that requires a specific exit code to be set
      if let errorWithExitCode = error as? HasExitCode {
        fputs("\(error)\n", stderr)

+        OTel.shared.flush()
        Foundation.exit(errorWithExitCode.exitCode)
      }

@@ -123,7 +114,7 @@ struct Root: AsyncParsableCommand {
    }
  }

-  private static func parseCirrusSentryTag(_ tag: String.SubSequence) -> (String, String)? {
+  private static func splitEnvironmentVariable(_ tag: String.SubSequence) -> (String, String)? {
    let splits = tag.split(separator: "=", maxSplits: 1)
    if splits.count != 2 {
      return nil
@@ -5,7 +5,7 @@ fileprivate func normalizeName(_ name: String) -> String {
  return name.replacingOccurrences(of: ":", with: "\\:")
 }

-func completeMachines(_ arguments: [String]) -> [String] {
+func completeMachines(_ arguments: [String], _ argumentIdx: Int, _ argumentPrefix: String) -> [String] {
  let localVMs = (try? VMStorageLocal().list().map { name, _ in
    normalizeName(name)
  }) ?? []
@@ -15,12 +15,12 @@ func completeMachines(_ arguments: [String]) -> [String] {
  return (localVMs + ociVMs)
 }

-func completeLocalMachines(_ arguments: [String]) -> [String] {
+func completeLocalMachines(_ arguments: [String], _ argumentIdx: Int, _ argumentPrefix: String) -> [String] {
  let localVMs = (try? VMStorageLocal().list()) ?? []
  return localVMs.map { name, _ in normalizeName(name) }
 }

-func completeRunningMachines(_ arguments: [String]) -> [String] {
+func completeRunningMachines(_ arguments: [String], _ argumentIdx: Int, _ argumentPrefix: String) -> [String] {
  let localVMs = (try? VMStorageLocal().list()) ?? []
  return localVMs
    .filter { _, vmDir in (try? vmDir.state() == .Running) ?? false}
@@ -51,7 +51,9 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
       clipboard: Bool = true,
       sync: VZDiskImageSynchronizationMode = .full,
       caching: VZDiskImageCachingMode? = nil,
-       noTrackpad: Bool = false
+       noTrackpad: Bool = false,
+       noPointer: Bool = false,
+       noKeyboard: Bool = false
  ) throws {
    name = vmDir.name
    config = try VMConfig.init(fromURL: vmDir.configURL)
@@ -73,7 +75,9 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
                                                clipboard: clipboard,
                                                sync: sync,
                                                caching: caching,
-                                                noTrackpad: noTrackpad
+                                                noTrackpad: noTrackpad,
+                                                noPointer: noPointer,
+                                                noKeyboard: noKeyboard
    )
    virtualMachine = VZVirtualMachine(configuration: configuration)

@@ -143,6 +147,7 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
      vmDir: VMDirectory,
      ipswURL: URL,
      diskSizeGB: UInt16,
+      diskFormat: DiskImageFormat = .raw,
      network: Network = NetworkShared(),
      additionalStorageDevices: [VZStorageDeviceConfiguration] = [],
      directorySharingDevices: [VZDirectorySharingDeviceConfiguration] = [],
@@ -175,14 +180,15 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
      _ = try VZMacAuxiliaryStorage(creatingStorageAt: vmDir.nvramURL, hardwareModel: requirements.hardwareModel)

      // Create disk
-      try vmDir.resizeDisk(diskSizeGB)
+      try vmDir.resizeDisk(diskSizeGB, format: diskFormat)

      name = vmDir.name
      // Create config
      config = VMConfig(
        platform: Darwin(ecid: VZMacMachineIdentifier(), hardwareModel: requirements.hardwareModel),
        cpuCountMin: requirements.minimumSupportedCPUCount,
-        memorySizeMin: requirements.minimumSupportedMemorySize
+        memorySizeMin: requirements.minimumSupportedMemorySize,
+        diskFormat: diskFormat
      )
      // allocate at least 4 CPUs because otherwise VMs are frequently freezing
      try config.setCPU(cpuCount: max(4, requirements.minimumSupportedCPUCount))
@@ -224,15 +230,15 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
  #endif

  @available(macOS 13, *)
-  static func linux(vmDir: VMDirectory, diskSizeGB: UInt16) async throws -> VM {
+  static func linux(vmDir: VMDirectory, diskSizeGB: UInt16, diskFormat: DiskImageFormat = .raw) async throws -> VM {
    // Create NVRAM
    _ = try VZEFIVariableStore(creatingVariableStoreAt: vmDir.nvramURL)

    // Create disk
-    try vmDir.resizeDisk(diskSizeGB)
+    try vmDir.resizeDisk(diskSizeGB, format: diskFormat)

    // Create config
-    let config = VMConfig(platform: Linux(), cpuCountMin: 4, memorySizeMin: 4096 * 1024 * 1024)
+    let config = VMConfig(platform: Linux(), cpuCountMin: 4, memorySizeMin: 4096 * 1024 * 1024, diskFormat: diskFormat)
    try config.save(toURL: vmDir.configURL)

    return try VM(vmDir: vmDir)
@@ -314,7 +320,9 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
    clipboard: Bool = true,
    sync: VZDiskImageSynchronizationMode = .full,
    caching: VZDiskImageCachingMode? = nil,
-    noTrackpad: Bool = false
+    noTrackpad: Bool = false,
+    noPointer: Bool = false,
+    noKeyboard: Bool = false
  ) throws -> VZVirtualMachineConfiguration {
    let configuration = VZVirtualMachineConfiguration()

@@ -354,8 +362,16 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
      configuration.keyboards = platformSuspendable.keyboardsSuspendable()
      configuration.pointingDevices = platformSuspendable.pointingDevicesSuspendable()
    } else {
-      configuration.keyboards = vmConfig.platform.keyboards()
-      if noTrackpad {
+
+      if noKeyboard {
+        configuration.keyboards = []
+      } else {
+        configuration.keyboards = vmConfig.platform.keyboards()
+      }
+
+      if noPointer {
+        configuration.pointingDevices = []
+      } else if noTrackpad {
        configuration.pointingDevices = vmConfig.platform.pointingDevicesSimplified()
      } else {
        configuration.pointingDevices = vmConfig.platform.pointingDevices()
@@ -412,15 +428,13 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
    //
    // A dummy console device useful for implementing
    // host feature checks in the guest agent software.
-    if !suspendable {
-      let consolePort = VZVirtioConsolePortConfiguration()
-      consolePort.name = "tart-version-\(CI.version)"
+    let consolePort = VZVirtioConsolePortConfiguration()
+    consolePort.name = "tart-version-\(CI.version)"

-      let consoleDevice = VZVirtioConsoleDeviceConfiguration()
-      consoleDevice.ports[0] = consolePort
+    let consoleDevice = VZVirtioConsoleDeviceConfiguration()
+    consoleDevice.ports[0] = consolePort

-      configuration.consoleDevices.append(consoleDevice)
-    }
+    configuration.consoleDevices.append(consoleDevice)

    // Socket device
    configuration.socketDevices = [VZVirtioSocketDeviceConfiguration()]
@@ -25,20 +25,31 @@ enum CodingKeys: String, CodingKey {
  case macAddress
  case display
  case displayRefit
+  case diskFormat

  // macOS-specific keys
  case ecid
  case hardwareModel
 }

-struct VMDisplayConfig: Codable {
+struct VMDisplayConfig: Codable, Equatable {
+  enum Unit: String, Codable {
+    case point = "pt"
+    case pixel = "px"
+  }
+
  var width: Int = 1024
  var height: Int = 768
+  var unit: Unit?
 }

 extension VMDisplayConfig: CustomStringConvertible {
  var description: String {
-    "\(width)x\(height)"
+    if let unit {
+      "\(width)x\(height)\(unit.rawValue)"
+    } else {
+      "\(width)x\(height)"
+    }
  }
 }

@@ -54,12 +65,14 @@ struct VMConfig: Codable {
  var macAddress: VZMACAddress
  var display: VMDisplayConfig = VMDisplayConfig()
  var displayRefit: Bool?
+  var diskFormat: DiskImageFormat = .raw

  init(
    platform: Platform,
    cpuCountMin: Int,
    memorySizeMin: UInt64,
-    macAddress: VZMACAddress = VZMACAddress.randomLocallyAdministered()
+    macAddress: VZMACAddress = VZMACAddress.randomLocallyAdministered(),
+    diskFormat: DiskImageFormat = .raw
  ) {
    self.os = platform.os()
    self.arch = CurrentArchitecture()
@@ -67,6 +80,7 @@ struct VMConfig: Codable {
    self.macAddress = macAddress
    self.cpuCountMin = cpuCountMin
    self.memorySizeMin = memorySizeMin
+    self.diskFormat = diskFormat
    cpuCount = cpuCountMin
    memorySize = memorySizeMin
  }
@@ -124,6 +138,8 @@ struct VMConfig: Codable {

    display = try container.decodeIfPresent(VMDisplayConfig.self, forKey: .display) ?? VMDisplayConfig()
    displayRefit = try container.decodeIfPresent(Bool.self, forKey: .displayRefit)
+    let diskFormatString = try container.decodeIfPresent(String.self, forKey: .diskFormat) ?? "raw"
+    diskFormat = DiskImageFormat(rawValue: diskFormatString) ?? .raw
  }

  func encode(to encoder: Encoder) throws {
@@ -142,6 +158,7 @@ struct VMConfig: Codable {
    if let displayRefit = displayRefit {
      try container.encode(displayRefit, forKey: .displayRefit)
    }
+    try container.encode(diskFormat.rawValue, forKey: .diskFormat)
  }

  mutating func setCPU(cpuCount: Int) throws {
@@ -1,6 +1,6 @@
 import Compression
 import Foundation
-import Sentry
+import OpenTelemetryApi

 enum OCIError: Error {
  case ShouldBeExactlyOneLayer
@@ -43,7 +43,10 @@ extension VMDirectory {
    }

    let diskCompressedSize = layers.map { Int64($0.size) }.reduce(0, +)
-    SentrySDK.span?.setMeasurement(name: "compressed_disk_size", value: diskCompressedSize as NSNumber, unit: MeasurementUnitInformation.byte)
+    OpenTelemetry.instance.contextProvider.activeSpan?.setAttribute(
+      key: "compressed_disk_size_bytes",
+      value: .int(Int(diskCompressedSize))
+    )

    let prettyDiskSize = String(format: "%.1f", Double(diskCompressedSize) / 1_000_000_000.0)
    defaultLogger.appendNewLine("pulling disk (\(prettyDiskSize) GB compressed)...")
@@ -92,6 +95,10 @@ extension VMDirectory {

    // Read VM's config and push it as blob
    let config = try VMConfig(fromURL: configURL)
+
+    // Add disk format label automatically
+    var labels = labels
+    labels[diskFormatLabel] = config.diskFormat.rawValue
    let configJSON = try JSONEncoder().encode(config)
    defaultLogger.appendNewLine("pushing config...")
    let configDigest = try await registry.pushBlob(fromData: configJSON, chunkSizeMb: chunkSizeMb)
@@ -27,7 +27,7 @@ struct VMDirectory: Prunable {
    baseURL.appendingPathComponent("manifest.json")
  }
  var controlSocketURL: URL {
-    baseURL.appendingPathComponent("control.sock")
+    URL(fileURLWithPath: "control.sock", relativeTo: baseURL)
  }

  var explicitlyPulledMark: URL {
@@ -142,14 +142,34 @@ struct VMDirectory: Prunable {
    try vmConfig.save(toURL: configURL)
  }

-  func resizeDisk(_ sizeGB: UInt16) throws {
-    if !FileManager.default.fileExists(atPath: diskURL.path) {
-      FileManager.default.createFile(atPath: diskURL.path, contents: nil, attributes: nil)
-    }
+  func resizeDisk(_ sizeGB: UInt16, format: DiskImageFormat = .raw) throws {
+    let diskExists = FileManager.default.fileExists(atPath: diskURL.path)

+    if diskExists {
+      // Existing disk - resize it
+      try resizeExistingDisk(sizeGB)
+    } else {
+      // New disk - create it with the specified format
+      try createDisk(sizeGB: sizeGB, format: format)
+    }
+  }
+
+  private func resizeExistingDisk(_ sizeGB: UInt16) throws {
+    // Check if this is an ASIF disk by reading the VM config
+    let vmConfig = try VMConfig(fromURL: configURL)
+
+    if vmConfig.diskFormat == .asif {
+      try resizeASIFDisk(sizeGB)
+    } else {
+      try resizeRawDisk(sizeGB)
+    }
+  }
+
+  private func resizeRawDisk(_ sizeGB: UInt16) throws {
    let diskFileHandle = try FileHandle.init(forWritingTo: diskURL)
    let currentDiskFileLength = try diskFileHandle.seekToEnd()
    let desiredDiskFileLength = UInt64(sizeGB) * 1000 * 1000 * 1000
+
    if desiredDiskFileLength < currentDiskFileLength {
      let currentLengthHuman = ByteCountFormatter().string(fromByteCount: Int64(currentDiskFileLength))
      let desiredLengthHuman = ByteCountFormatter().string(fromByteCount: Int64(desiredDiskFileLength))
@@ -161,6 +181,84 @@ struct VMDirectory: Prunable {
    try diskFileHandle.close()
  }

+  private func resizeASIFDisk(_ sizeGB: UInt16) throws {
+    do {
+      let diskImageInfo = try Diskutil.imageInfo(diskURL)
+
+      let currentSizeBytes = try diskImageInfo.totalBytes()
+      let desiredSizeBytes = UInt64(sizeGB) * 1000 * 1000 * 1000
+
+      if desiredSizeBytes < currentSizeBytes {
+        let currentLengthHuman = ByteCountFormatter().string(fromByteCount: Int64(currentSizeBytes))
+        let desiredLengthHuman = ByteCountFormatter().string(fromByteCount: Int64(desiredSizeBytes))
+
+        throw RuntimeError.InvalidDiskSize("New disk size of \(desiredLengthHuman) should be larger " +
+          "than the current disk size of \(currentLengthHuman)")
+      } else if desiredSizeBytes > currentSizeBytes {
+        // Resize the ASIF disk image using diskutil
+        try performASIFResize(sizeGB)
+      } else {
+        // If sizes are equal, no action needed
+      }
+    } catch let error as RuntimeError {
+      throw error
+    } catch {
+      throw RuntimeError.FailedToResizeDisk("\(error)")
+    }
+  }
+
+  private func performASIFResize(_ sizeGB: UInt16) throws {
+    guard let diskutilURL = resolveBinaryPath("diskutil") else {
+      throw RuntimeError.FailedToResizeDisk("diskutil not found in PATH")
+    }
+
+    let process = Process()
+    process.executableURL = diskutilURL
+    process.arguments = [
+      "image", "resize",
+      "--size", "\(sizeGB)G",
+      diskURL.path
+    ]
+
+    let pipe = Pipe()
+    process.standardOutput = pipe
+    process.standardError = pipe
+
+    do {
+      try process.run()
+      process.waitUntilExit()
+
+      let data = pipe.fileHandleForReading.readDataToEndOfFile()
+
+      if process.terminationStatus != 0 {
+        let output = String(data: data, encoding: .utf8) ?? "Unknown error"
+        throw RuntimeError.FailedToResizeDisk("Failed to resize ASIF disk image: \(output)")
+      }
+    } catch {
+      throw RuntimeError.FailedToResizeDisk("Failed to execute diskutil resize: \(error)")
+    }
+  }
+
+  private func createDisk(sizeGB: UInt16, format: DiskImageFormat) throws {
+    switch format {
+    case .raw:
+      try createRawDisk(sizeGB: sizeGB)
+    case .asif:
+      try Diskutil.imageCreate(diskURL: diskURL, sizeGB: sizeGB)
+    }
+  }
+
+  private func createRawDisk(sizeGB: UInt16) throws {
+    // Create traditional raw disk image
+    FileManager.default.createFile(atPath: diskURL.path, contents: nil, attributes: nil)
+
+    let diskFileHandle = try FileHandle.init(forWritingTo: diskURL)
+    let desiredDiskFileLength = UInt64(sizeGB) * 1000 * 1000 * 1000
+    try diskFileHandle.truncate(atOffset: desiredDiskFileLength)
+    try diskFileHandle.close()
+  }
+
+
  func delete() throws {
    let lock = try lock()

@@ -201,6 +299,21 @@ struct VMDirectory: Prunable {
    try sizeBytes() / 1000 / 1000 / 1000
  }

+  func diskSizeBytes() throws -> Int {
+    let vmConfig = try VMConfig(fromURL: configURL)
+
+    return switch vmConfig.diskFormat {
+    case .raw:
+      try sizeBytes()
+    case .asif:
+      try Diskutil.imageInfo(diskURL).totalBytes()
+    }
+  }
+
+  func diskSizeGB() throws -> Int {
+    try diskSizeBytes() / 1000 / 1000 / 1000
+  }
+
  func markExplicitlyPulled() {
    FileManager.default.createFile(atPath: explicitlyPulledMark.path, contents: nil)
  }
@@ -60,6 +60,8 @@ enum RuntimeError : Error {
  case DiskAlreadyInUse(_ message: String)
  case FailedToOpenBlockDevice(_ path: String, _ explanation: String)
  case InvalidDiskSize(_ message: String)
+  case FailedToCreateDisk(_ message: String)
+  case FailedToResizeDisk(_ message: String)
  case FailedToUpdateAccessDate(_ message: String)
  case PIDLockFailed(_ message: String)
  case PIDLockMissing(_ message: String)
@@ -109,6 +111,10 @@ extension RuntimeError : CustomStringConvertible {
      return "failed to open block device \(path): \(explanation)"
    case .InvalidDiskSize(let message):
      return message
+    case .FailedToCreateDisk(let message):
+      return message
+    case .FailedToResizeDisk(let message):
+      return message
    case .FailedToUpdateAccessDate(let message):
      return message
    case .PIDLockFailed(let message):
@@ -163,14 +169,3 @@ extension RuntimeError : HasExitCode {
    }
  }
 }
-
-// Customize error description for Sentry[1]
-//
-// [1]: https://docs.sentry.io/platforms/apple/guides/ios/usage/#customizing-error-descriptions
-extension RuntimeError : CustomNSError {
-  var errorUserInfo: [String : Any] {
-    [
-      NSDebugDescriptionErrorKey: description,
-    ]
-  }
-}
@@ -1,7 +1,11 @@
 import Foundation

 class VMStorageLocal: PrunableStorage {
-  let baseURL: URL = try! Config().tartHomeDir.appendingPathComponent("vms", isDirectory: true)
+  let baseURL: URL
+
+  init() throws {
+    baseURL = try Config().tartHomeDir.appendingPathComponent("vms", isDirectory: true)
+  }

  private func vmURL(_ name: String) -> URL {
    baseURL.appendingPathComponent(name, isDirectory: true)
@@ -1,9 +1,13 @@
 import Foundation
-import Sentry
+import OpenTelemetryApi
 import Retry

 class VMStorageOCI: PrunableStorage {
-  let baseURL = try! Config().tartCacheDir.appendingPathComponent("OCIs", isDirectory: true)
+  let baseURL: URL
+
+  init() throws {
+    baseURL = try Config().tartCacheDir.appendingPathComponent("OCIs", isDirectory: true)
+  }

  private func vmURL(_ name: RemoteName) -> URL {
    baseURL.appendingRemoteName(name)
@@ -27,12 +31,12 @@ class VMStorageOCI: PrunableStorage {
    return digest
  }

-  func open(_ name: RemoteName) throws -> VMDirectory {
+  func open(_ name: RemoteName, _ accessDate: Date = Date()) throws -> VMDirectory {
    let vmDir = VMDirectory(baseURL: vmURL(name))

    try vmDir.validate(userFriendlyName: name.description)

-    try vmDir.baseURL.updateAccessDate()
+    try vmDir.baseURL.updateAccessDate(accessDate)

    return vmDir
  }
@@ -141,9 +145,10 @@ class VMStorageOCI: PrunableStorage {
  }

  func pull(_ name: RemoteName, registry: Registry, concurrency: UInt, deduplicate: Bool) async throws {
-    SentrySDK.configureScope { scope in
-      scope.setContext(value: ["imageName": name.description], key: "OCI")
-    }
+    OpenTelemetry.instance.contextProvider.activeSpan?.setAttribute(
+      key: "oci.image-name",
+      value: .string(name.description)
+    )

    defaultLogger.appendNewLine("pulling manifest...")

@@ -177,18 +182,25 @@ class VMStorageOCI: PrunableStorage {
    }

    if !exists(digestName) {
-      let transaction = SentrySDK.startTransaction(name: name.description, operation: "pull", bindToScope: true)
+      let span = OTel.shared.tracer.spanBuilder(spanName: "pull").setActive(true).startSpan()
+      defer { span.end() }
+
      let tmpVMDir = try VMDirectory.temporaryDeterministic(key: name.description)

+      // Open an existing VM directory corresponding to this name, if any,
+      // marking it as outdated to speed up the garbage collection process
+      _ = try? open(name, Date(timeIntervalSince1970: 0))
+
      // Lock the temporary VM directory to prevent it's garbage collection
      let tmpVMDirLock = try FileLock(lockURL: tmpVMDir.baseURL)
      try tmpVMDirLock.lock()

      // Try to reclaim some cache space if we know the VM size in advance
      if let uncompressedDiskSize = manifest.uncompressedDiskSize() {
-        SentrySDK.configureScope { scope in
-          scope.setContext(value: ["imageUncompressedDiskSize": uncompressedDiskSize], key: "OCI")
-        }
+        OpenTelemetry.instance.contextProvider.activeSpan?.setAttribute(
+          key: "oci.image-uncompressed-disk-size-bytes",
+          value: .int(Int(uncompressedDiskSize))
+        )

        let otherVMFilesSize: UInt64 = 128 * 1024 * 1024

@@ -221,9 +233,7 @@ class VMStorageOCI: PrunableStorage {
          return .throw
        }
        try move(digestName, from: tmpVMDir)
-        transaction.finish()
      }, onCancel: {
-        transaction.finish(status: SentrySpanStatus.cancelled)
        try? FileManager.default.removeItem(at: tmpVMDir.baseURL)
      })
    } else {
@@ -0,0 +1,63 @@
+import XCTest
+@testable import tart
+
+final class DiskImageFormatTests: XCTestCase {
+  func testASIFFormatSupport() throws {
+    // ASIF should be supported on macOS 26+
+    if #available(macOS 26, *) {
+      XCTAssertTrue(DiskImageFormat.asif.isSupported)
+    } else {
+      XCTAssertFalse(DiskImageFormat.asif.isSupported)
+    }
+  }
+
+  func testFormatFromString() throws {
+    XCTAssertEqual(DiskImageFormat(rawValue: "raw"), .raw)
+    XCTAssertEqual(DiskImageFormat(rawValue: "asif"), .asif)
+    XCTAssertNil(DiskImageFormat(rawValue: "invalid"))
+  }
+
+  func testCaseInsensitivity() throws {
+    XCTAssertEqual(DiskImageFormat(argument: "ASIF"), .asif) // case insensitive
+    XCTAssertEqual(DiskImageFormat(argument: "Raw"), .raw)  // case insensitive
+  }
+
+  func testAllValueStrings() throws {
+    let allValues = DiskImageFormat.allValueStrings
+    XCTAssertTrue(allValues.contains("raw"))
+    XCTAssertTrue(allValues.contains("asif"))
+    XCTAssertEqual(allValues.count, 2)
+  }
+
+  func testVMConfigDiskFormatSerialization() throws {
+    // Test that VMConfig properly serializes and deserializes disk format
+    let config = VMConfig(
+      platform: Linux(),
+      cpuCountMin: 2,
+      memorySizeMin: 1024 * 1024 * 1024,
+      diskFormat: .asif
+    )
+
+    XCTAssertEqual(config.diskFormat, .asif)
+
+    // Test JSON encoding/decoding
+    let encoder = JSONEncoder()
+    let data = try encoder.encode(config)
+
+    let decoder = JSONDecoder()
+    let decodedConfig = try decoder.decode(VMConfig.self, from: data)
+
+    XCTAssertEqual(decodedConfig.diskFormat, .asif)
+  }
+
+  func testVMConfigDefaultDiskFormat() throws {
+    // Test that VMConfig defaults to raw format
+    let config = VMConfig(
+      platform: Linux(),
+      cpuCountMin: 2,
+      memorySizeMin: 1024 * 1024 * 1024
+    )
+
+    XCTAssertEqual(config.diskFormat, .raw)
+  }
+}
@@ -0,0 +1,21 @@
+import XCTest
+@testable import tart
+
+final class DiskutilTests: XCTestCase {
+  func testDiskutilInfo() throws {
+    // Create a temporary directory
+    let tempDirURL = FileManager.default.temporaryDirectory.appendingPathComponent("tart-diskutil-tests-\(UUID().uuidString)")
+    try? FileManager.default.createDirectory(at: tempDirURL, withIntermediateDirectories: true)
+    addTeardownBlock {
+      try? FileManager.default.removeItem(at: tempDirURL)
+    }
+
+    // Create a 123 GB ASIF disk
+    let diskURL = tempDirURL.appendingPathComponent("disk.asif")
+    try Diskutil.imageCreate(diskURL: diskURL, sizeGB: 123)
+
+    // Retrieve its information and ensure that it does indeed take 123 GB
+    let info = try Diskutil.imageInfo(diskURL)
+    XCTAssertEqual(123 * 1000 * 1000 * 1000, try info.totalBytes())
+  }
+}
@@ -0,0 +1,18 @@
+import XCTest
+@testable import tart
+
+final class VMConfigTests: XCTestCase {
+  func testVMDisplayConfig() throws {
+    // Defaults units (points)
+    var vmDisplayConfig = VMDisplayConfig.init(argument: "1234x5678")
+    XCTAssertEqual(VMDisplayConfig(width: 1234, height: 5678, unit: nil), vmDisplayConfig)
+
+    // Explicit units (points)
+    vmDisplayConfig = VMDisplayConfig.init(argument: "1234x5678pt")
+    XCTAssertEqual(VMDisplayConfig(width: 1234, height: 5678, unit: .point), vmDisplayConfig)
+
+    // Explicit units (pixels)
+    vmDisplayConfig = VMDisplayConfig.init(argument: "1234x5678px")
+    XCTAssertEqual(VMDisplayConfig(width: 1234, height: 5678, unit: .pixel), vmDisplayConfig)
+  }
+}
@@ -1,6 +1,7 @@
 module github.com/cirruslabs/tart/benchmark

-go 1.22.1
+go 1.23.0
+
 toolchain go1.24.1

 require (
@@ -9,4 +9,6 @@
 "MD033": false # Inline HTML
 "MD041": false # First line in file should be a top level heading
 "MD045": false # OK not to have a description for an image
-"MD046": false #  Code block style [Expected: fenced; Actual: indented]
+"MD046": false #  Code block style [Expected: fenced; Actual: indented]
+"MD059": false # It's OK to have "here" links
+"MD051": false # MkDocs generates "#-no-pki" anchors, but markdownlint expects "#--no-pki" anchors
@@ -60,9 +60,9 @@ device without a physical display connected. For example, a Mac Mini with a HDMI
 but a Mac Mini on a desk with a connected physical display is considered a personal computer. **Usage on personal computers
 and before reaching the 100 CPU cores limit is royalty-free and does not have the viral properties of AGPL.**

-When an organization surpasses the 100 CPU cores limit, they will be required to obtain a [Gold Tier License](/licensing#license-tiers),
-which costs \$1000 per month. Upon reaching a limit of 500 CPU cores, a [Platinum Tier License](/licensing#license-tiers)
-(\$3000 per month) will be required, and for organizations that exceed 3000 CPU cores, a custom [Diamond Tier License](/licensing#license-tiers)
+When an organization surpasses the 100 CPU cores limit, they will be required to obtain a [Gold Tier License](../../licensing.md#license-tiers),
+which costs \$1000 per month. Upon reaching a limit of 500 CPU cores, a [Platinum Tier License](../../licensing.md#license-tiers)
+(\$3000 per month) will be required, and for organizations that exceed 3000 CPU cores, a custom [Diamond Tier License](../../licensing.md#license-tiers)
 (\$1 per core per month) will be necessary. **All paid license tiers will include priority feature development and SLAs on support with urgent issues.**

 ## Have we considered alternatives?
@@ -89,6 +89,6 @@ orchard dev
 This will launch a development cluster with a single worker on your machine. Refer to [Orchard documentation](https://github.com/cirruslabs/orchard#creating-virtual-machines)
 on how to create your first virtual machine and access it.

-In a [separate blog post](/blog/2023/04/28/ssh-over-grpc-or-how-orchard-simplifies-accessing-vms-in-private-networks/)
+In a [separate blog post](2023-04-28-orchard-ssh-over-grpc.md)
 we’ll cover how Orchard implements seamless SSH access over a gRPC connection. Stay tuned and please don’t hesitate to
 [reach out](https://github.com/cirruslabs/orchard/discussions/landing)! 
@@ -64,7 +64,7 @@ We’ve also initially considered using [Yamux](https://github.com/hashicorp/yam

 First of all, we’ve made the new port-forwarding functionality available for integrations via the Orchard’s REST API:

-![OpenAPI documentation for Orchard's port-forwarding endpoint](/assets/images/orchard-port-forwarding-api.png)
+![OpenAPI documentation for Orchard's port-forwarding endpoint](../../assets/images/orchard-port-forwarding-api.png)

 All you need is to use a WebSocket client when accessing this endpoint to make it work.

@@ -43,7 +43,7 @@ allocate time to continue improving Tart which brings us to the section below.
 In the last 7 months we've had 12 feature releases that brought a lot of features requested by the community. Here are just
 a few of them to highlight:

-[Custom GitLab Runner Executor](/integrations/gitlab-runner/).
+-[Custom GitLab Runner Executor](../../integrations/gitlab-runner.md).
 -[Cluster Management via Orchard](2023-04-25-orchard-ga.md).
 -Numerous compatibility improvements for all kinds of OCI-registries.
 -Sonoma Support (see details [below](#macos-sonoma-updates)).
@@ -17,7 +17,7 @@ with preconfigured Tart installation that is optimized to work within AWS infras
 EC2 Mac Instances is a gem of engineering powered by AWS Nitro devices. Just imagine there is a physical Mac Mini with
 a plugged in Nitro device that can push the physical power button!

-![EC2 M2 Pro](/blog/images/ec2-mac2-m2pro.png)
+![EC2 M2 Pro](../images/ec2-mac2-m2pro.png)

 This clever synergy between Apple Hardware and Nitro System allows seamless integration with VPC networking and booting macOS from an EBS volume.

@@ -34,7 +34,7 @@ than recently announced Apple Silicon GitHub-manged runners that cost $0.16 per
 Now lets take a look at the new Cirrus Runners dashboard of a real customers that run their workflows on Cirrus Runners
 and **practically pushing the price performance pretty close to the theoretical minimum**.

-![Cirrus Runners Dashboard](/blog/images/runners-price-performance-2.png)
+![Cirrus Runners Dashboard](../images/runners-price-performance-2.png)

 As you can see above Cirrus Runners Dashboard focuses on 4 core metrics:

@@ -50,7 +50,7 @@ we can see that the downside of such great price performance is that jobs are wa
 Here is another example of Cirrus Runners Dashboard for a different customer that has a slightly higher price performance of $0.017 per minute
 but at the same time doesn't experience queue time at all. **Note that $0.017 is still 10 times cheaper than GitHub-managed Apple Silicon runners**.

-![Cirrus Runners Dashboard](/blog/images/runners-price-performance-3.png)
+![Cirrus Runners Dashboard](../images/runners-price-performance-3.png)

 ## Conclusion

@@ -0,0 +1,72 @@
+---
+draft: false
+date: 2025-06-01
+search:
+  exclude: true
+authors:
+  - edigaryev
+categories:
+  - announcement
+---
+
+# Bridging the gaps with the Tart Guest Agent
+
+We're introducing a new improvement for the Tart usability experience: a [Tart Guest Agent](https://github.com/cirruslabs/tart-guest-agent).
+
+This agent provides automatic disk resizing, seamless clipboard sharing for macOS guests (a [long-awaited](https://github.com/cirruslabs/tart/issues/14) feature), and the ability to run commands, without SSH and networking, using the new `tart exec` command.
+
+As of recently, we include this agent in all non-vanilla Cirrus Labs images, so you likely won't need to do anything to benefit from these usability improvements.
+
+Read on to learn why we chose to implement the agent from scratch in Golang, and which features we plan to add next.
+
+<!-- more -->
+
+## Existing solutions
+
+Tart uses the Virtualization.Framework, and the latter implemented a SPICE client some time ago, however, one piece was missing: the agent that runs inside the guest.
+
+The original [SPICE `vdagent` implementation](https://gitlab.freedesktop.org/spice/linux/vd_agent) only supports Linux. While [a fork](https://github.com/utmapp/vd_agent) from the UTM project adds macOS support, the long-term viability of maintaining this fork without upstreaming changes is uncertain.
+
+Moreover, if we were to add some extra functionality (as we did), there would be more than one agent binary to ship and install, which complicates maintenance and makes it harder to explain to users why we need a bunch of agent binaries.
+
+In the end, we decided to go with our own solution, one that would easily accomodate future ideas.
+
+## Rolling our own agent
+
+After carefully inspecting the [`vdagent` protocol](https://www.spice-space.org/agent-protocol.html) we've realized that the clipboard sharing is actually a small subset of the whole protocol, making it relatively simple to implement.
+
+Thanks to Golang, we were able to implement the protocol much faster than we could have with a lower-level language like C (with all due respect), which requires manual memory management and complex event loops.
+
+As for the command execution via `tart exec`, we've decided to go with gRPC with a rather simple protocol:
+
+![An visualization of gRPC protocol used by the Tart Guest Agent](../images/tart-guest-agent-grpc-protocol.png)
+
+For each `tart exec` invocation a new gRPC `Exec` bidirectional stream is established with the agent running inside a VM. After the gRPC stream is established, `tart exec` sends a command to execute to the guest and streams the I/O. Once the command terminates, `tart exec` collects the process exit code and quits with exactly that exit code.
+
+Using gRPC simplifies `tart exec` implementation because of code generation and forms a nice bridge between the host and the guest which allows us to easily expand the protocol later down the road when we decide to introduce new features.
+
+Thanks to [gRPC Swift](https://github.com/grpc/grpc-swift), which is built on top of [SwiftNIO](https://github.com/apple/swift-nio), we get [`async/await`](https://docs.swift.org/swift-book/documentation/the-swift-programming-language/concurrency/) support for free, further simplifying the `tart exec` logic.
+
+As for the Tart Guest Agent, the final result is a Golang binary that [can be customized](https://github.com/cirruslabs/tart-guest-agent?tab=readme-ov-file#guest-agent-for-tart-vms) depending on the execution context:
+
+* launchd global daemon — runs as a privileged user (`root`), has no clipboard access
+    * `--resize-disk` — resizes the disk when there's a free space at the end of a disk (assuming that one previously ran `tart set --disk-size`)
+* launchd global agent — runs as a normal user (`admin`), has clipboard access
+    * `--run-vdagent` — clipboard sharing
+    * `--run-rpc` — `tart exec` and new functionality in the future
+
+We’ve also introduced `--run-daemon` (which implies `--resize-disk`) and `--run-agent` (which implies both `--run-vdagent` and `--run-rpc`) to help run the most appropriate functionality based on the given context.
+
+## Future plans
+
+First, we'd like to thank our paid clients, without whom this feature wouldn't have been possible.
+
+[Become one now](../../licensing.md) and enjoy higher allowances for Tart VMs and Orchard workers—while helping ensure that our roadmap aligns with your company's needs.
+
+In the near future we plan to implement:
+
+* Linux support — to provide seamless experience for Linux guests too
+* a new `tart ip` resolver — to provide a more robust IP retrieval facility for Linux guests, which often struggle to populate the host's ARP table with their network activity
+* `tart cp` command — to copy files from/to guest VMs
+
+Stay tuned, and feel free to send us feedback on [GitHub](https://github.com/cirruslabs/tart) and [Twitter](https://x.com/cirrus_labs)!
@@ -0,0 +1,44 @@
+---
+draft: false
+date: 2025-10-27
+search:
+  exclude: true
+authors:
+  - fkorotkov
+categories:
+  - announcement
+---
+
+# Press Release: Cirrus Labs Successfully Enforces Its Fair Source License
+
+**New York City, NY – October 27th, 2025 – Cirrus Labs, Inc.**, a leading provider of platforms for digital transformation, today announced that it has reached a settlement agreement regarding a violation of its Fair Source License.
+
+<!-- more -->
+
+Cirrus Labs makes its Tart Virtualization Toolset, a leading virtualization toolset to build, run and manage macOS and Linux virtual machines (VMs) on Apple Silicon,
+freely available on GitHub under the Fair Source License, a source-available license. Tart is used by tens of thousands of engineers at no charge within its generous free‑use limits.
+Many large enterprises that need to exceed those limits support continued development through paid licenses. Cirrus Labs also uses Tart to power [Cirrus Runners](https://cirrus-runners.app/)
+— a drop‑in replacement for macOS and Linux runners for GitHub Actions — offered at a fixed monthly price for unlimited usage.
+
+Cirrus Labs discovered that, **despite a prior licensing request that was declined due to a conflict of interest**, another company used Tart in a manner that exceeded the license’s free‑use limits,
+in order to create a competing product.
+
+After several months of negotiations, the matter was settled and a settlement payment to Cirrus Labs was agreed upon.
+
+!!! quote "Comment by Fedor Korotkov, CEO of Cirrus Labs"
+    
+    As a company we embrace healthy competition that ultimately benefits the end user. Most of our users have no trouble complying with our license,
+    and even when they need something more than our free use limits, we can almost always grant them a license that fits their needs. **This was an exceptional case.**
+    We are pleased to have reached this settlement, which validates our source-available licensing strategy and reinforces our commitment to protecting our company and serving our community.
+
+Cirrus Labs was represented in this matter by [Jordan Raphael](https://byronraphael.com/attorneys/jordan-raphael/) of Byron Raphael LLP, a boutique intellectual property law firm,
+and [Heather Meeker](https://www.techlawpartners.com/heather), a well-known specialist in open source and source available licensing.
+
+The specific financial terms of the settlement and the identity of the counterparty remain confidential.
+
+**About Cirrus Labs:** Cirrus Labs, Inc. is a bootstrapped developer-infrastructure company founded in 2017. Our offerings among others include Tart and Cirrus Runners,
+and our software is used by teams at category-leading companies including Atlassian, Figma, Zendesk, Sentry and many more.
+
+Learn more at [https://tart.run/](https://tart.run/) and [https://cirrus-runners.app/](https://cirrus-runners.app/).
+
+**Contact:** [hello@cirruslabs.org](mailto:hello@cirruslabs.org)
@@ -5,6 +5,42 @@ title: Frequently Asked Questions
 description: Advanced configuration and troubleshooting tips for advanced configurations.
 ---

+## Headless machines
+
+Starting from macOS 15 (Sequoia), there's an undocumented requirement from [Virtualization.Framework](https://developer.apple.com/documentation/virtualization) (which Tart uses) to have an unlocked `login.keychain` available at the times when running a VM.
+
+Without an existing and unlocked `login.keychain`, the VM won't start with errors like:
+
+* `SecKeyCreateRandomKey_ios failed`
+* `Failed to generate keypair`
+* `Interaction is not allowed with the Security Server`
+
+Below you'll find a couple of workarounds for this behavior.
+
+### Log in via GUI at least once
+
+Connect to the headless machine via [Screen Sharing](https://support.apple.com/guide/mac-help/share-the-screen-of-another-mac-mh14066/mac) and log in to a Mac user account. If you haven't done already, you can enable Screen Sharing [via the terminal](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-to-mac-instance.html#mac-instance-vnc).
+
+Logging in graphically will automatically create the `login.keychain`. Afterward, you have two options:
+
+* configure [automatic log in to a Mac user account](https://support.apple.com/en-us/102316)
+    * this will maintain a running user session (GUI) even after the machine reboots
+    * moreover, you can still lock the screen (either manually [or automatically](https://support.apple.com/guide/mac-help/change-lock-screen-settings-on-mac-mh11784/mac)), however, the security benefit of this is questionable
+* use `security unlock-keychain login.keychain` to unlock the login keychain via the terminal
+    * this command also supports the `-p` command-line argument, which allows you to supply a password and unlock non-interactively
+
+### Create and unlock the login keychain via the terminal
+
+Compared to the previous approach, this one is fully automated, but might stop working at some point in the future:
+
+```shell
+security create-keychain -p '' login.keychain
+security unlock-keychain -p '' login.keychain
+security login-keychain -s login.keychain
+```
+
+Note that this will create a `login.keychain` with an empty password. Consider supplying a different value to `-p` or omitting the `-p` to enter the password interactively. 
+
 ## Troubleshooting crashes

 If you experience a crash or encounter another error while using the tart executable, you can collect debug information to assist with troubleshooting. Run the following command in a separate terminal window to gather logs from the Tart process and the macOS Virtualization subsystem:
@@ -34,7 +70,7 @@ Then from within a virtual machine you can access the service using the router's
 or by running the following command in the Terminal:

 ```shell
-netstat -nr | grep default | head -n 1 | awk '{print $2}'
+netstat -nr | awk '/default/{print $2; exit}'
 ```

 Note: that accessing host is only possible with the default NAT network. If you are running your virtual machines with
@@ -143,14 +179,14 @@ This is because Tart uses [Keychain](https://en.wikipedia.org/wiki/Keychain_(sof
 To unlock the Keychain in an SSH session, run the following command, which will ask for your user's password:

 ```shell
-security unlock-keychain
+security unlock-keychain login.keychain
 ```

-This command also supports the `-p` command-line argument that allows you to supply the password and unlock non-interactively, which is great for scripts.
+This command also supports the `-p` command-line argument that allows you to supply a password and unlock non-interactively, which is great for scripts.

-If that doesn't work for you for some reason, you can pass the credentials via the environment variables, see [Registry Authorization](integrations/vm-management.md#registry-authorization) for more details on how to do that.
+Alternatively, you can pass the credentials via the environment variables, see [Registry Authorization](integrations/vm-management.md#registry-authorization) for more details on how to do that.

-## How Tart is different from Anka?
+## How is Tart different from Anka?

 Under the hood Tart is using the same technology as Anka 3.0 so there should be no real difference in performance
 or features supported. If there is some feature missing please don't hesitate to [create a feature request](https://github.com/cirruslabs/tart/issues).
@@ -166,6 +202,8 @@ Tart does have an analogue of Anka Controller for managing VMs across a cluster

 In case there's not enough space to fit the newly pulled or cloned VM image, Tart will remove the least recently accessed VMs from OCI cache and `.ipsw` files from IPSW cache until enough free space is available.

+The `tart clone` command limits this automatic pruning to 100 GB by default to avoid removing too many cached items. You can change this limit with the `--prune-limit` option (in gigabytes).
+
 To disable this functionality, set the `TART_NO_AUTO_PRUNE` environment variable either globally:

 ```shell
@@ -7,7 +7,7 @@ description: Run pipeline steps in isolated ephemeral Tart Virtual Machines.

 It is possible to run [Buildkite](https://buildkite.com/) pipeline steps in isolated ephemeral Tart Virtual Machines with the help of [Tart Buildkite Plugin](https://github.com/cirruslabs/tart-buildkite-plugin):

-![](/assets/images/BuildkiteTartPlugin.png)
+![](../assets/images/BuildkiteTartPlugin.png)

 ## Configuration

@@ -33,7 +33,7 @@ brew install cirruslabs/cli/cirrus
 cirrus run
 ```

-![](/assets/images/TartCirrusCLI.gif)
+![](../assets/images/TartCirrusCLI.gif)

 [Cirrus CI](https://cirrus-ci.org/) already leverages Tart to power its macOS cloud infrastructure. The `.cirrus.yml`
 config from above will just work in Cirrus CI and your tasks will be executed inside Tart VMs in our cloud.
@@ -4,7 +4,7 @@ Orchard cluster consists of three components:

 * Controller — responsible for managing the cluster and scheduling of resources 
 * Worker — responsible for executing the VMs
-* Client — responsible for creating, modifying and removing the resources on the Controller, can either be an [Orchard CLI](/orchard/using-orchard-cli) or [an API consumer](/orchard/integration-guide)
+* Client — responsible for creating, modifying and removing the resources on the Controller, can either be an [Orchard CLI](using-orchard-cli.md) or [an API consumer](integration-guide.md)

 At the moment, only one Controller instance is currently supported, while you can deploy one or more Workers and run any number of Clients.

@@ -14,7 +14,7 @@ In terms of networking requirements, only Controller needs to be directly access

 When an Orchard Client or a Worker connects to the Controller, they need to establish trust and verify that they're talking to the right Controller, so that no [man-in-the-middle attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) is possible.

-Similarly to web-browsers (that rely on the [public key infrastructure](https://en.wikipedia.org/wiki/Public_key_infrastructure)) and SSH (which relies on semi-automated fingerprint verification), Orchard combines these two traits in a hybrid approach by defaulting to automatic PKI verification (can be disabled by [`--no-pki`](#--no-pki-override)) and falling-back to a manual verification for self-signed certificates.
+Similarly to web-browsers (that rely on the [public key infrastructure](https://en.wikipedia.org/wiki/Public_key_infrastructure)) and SSH (which relies on semi-automated fingerprint verification), Orchard combines these two traits in a hybrid approach by defaulting to automatic PKI verification (can be disabled by [`--no-pki`](#-no-pki-override)) and falling-back to a manual verification for self-signed certificates.

 This hybrid approach is needed because the Controller can be configured in two ways:

@@ -29,7 +29,7 @@ Below we'll explain how Orchard client and Worker secure the connection when acc

 Client is associated with the Controller using a `orchard context create` command, which works as follows:

-* Client attempts to connect to the Controller and validate its certificate using host's root CA set (can be disabled with [`--no-pki`](#--no-pki-override))
+* Client attempts to connect to the Controller and validate its certificate using host's root CA set (can be disabled with [`--no-pki`](#-no-pki-override))
 * if the Client encounters a  *Controller with a publicly valid certificate*, that would be the last step and the association would succeed
 * if the Client is dealing with *Controller with a self-signed certificate*, the Client will do another connection attempt to probe the Controller's certificate
 * the probed Controller's certificate fingerprint is then presented to the user, and if the user agrees to trust it, the Client then considers that certificate to be trusted for a given context
@@ -53,7 +53,7 @@ The way Worker connects to the Controller using the `orchard worker run` command
 * when the Bootstrap Token contains the Controller's certificate:
    * the Orchard Worker will try to connect to the Controller with a trusted CA set containing only that certificate
 * when the Bootstrap Token has no Controller's certificate:
-    * the Orchard Worker will try the PKI approach (can be disabled with [`--no-pki`](#--no-pki-override) to effectively prevent the Worker from connecting) and fail if certificate verification using PKI is not possible
+    * the Orchard Worker will try the PKI approach (can be disabled with [`--no-pki`](#-no-pki-override) to effectively prevent the Worker from connecting) and fail if certificate verification using PKI is not possible

 ### `--no-pki` override

@@ -53,7 +53,7 @@ Here's other command-line arguments associated with this functionality:
 * `--insecure-ssh-no-client-auth` — allow SSH clients to connect to the controller's SSH server without authentication, thus only authenticating on the target worker/VM's SSH server
    * useful when you already have strong credentials on your VMs, and you want to share these VMs to others without additionally giving out Orchard Cluster credentials

-Check out our [Jumping through the hoops: SSH jump host functionality in Orchard](/blog/2024/06/20/jumping-through-the-hoops-ssh-jump-host-functionality-in-orchard/) blog post for more information.
+Check out our [Jumping through the hoops: SSH jump host functionality in Orchard](../blog/posts/2024-06-20-jumping-through-the-hoops.md) blog post for more information.

 ## Deployment Methods

@@ -2,7 +2,7 @@ Orchard has a REST API that follows [OpenAPI specification](https://swagger.io/s

 You can run `orchard dev` locally and navigate to `http://127.0.0.1:6120/v1/` for interactive documentation.

-![](/assets/images/orchard/orchard-api-documentation-browser.png)
+![](../assets/images/orchard/orchard-api-documentation-browser.png)

 ## Using the API

@@ -4,7 +4,7 @@ a couple of VMs is not enough anymore for your needs? This is where [Orchard](ht
 comes in to play!

 It allows you to orchestrate multiple Tart-capable hosts from either an Orchard CLI (which we demonstrate below)
-or [through the API](/orchard/integration-guide).
+or [through the API](integration-guide.md).

 The easiest way to start is to run Orchard in local development mode:

@@ -18,7 +18,7 @@ test both the CLI functionality and the API from a tool like cURL or programming
 authenticate requests.

 Note that in production deployments, these two components are started separately and enable security by default. Please
-refer to [Deploying Controller](/orchard/deploying-controller) and [Deploying Workers](/orchard/deploying-workers) for
+refer to [Deploying Controller](deploying-controller.md) and [Deploying Workers](deploying-workers.md) for
 more information.

 ## Creating Virtual Machines
@@ -92,10 +92,10 @@ orchard delete vm sequoia-base
 In addition to controlling the Orchard via the CLI arguments, there are environment variables that may be beneficial
 both when automating Orchard and in daily use:

-| Variable name                   | Description                                                                                                                                                                                                                                                                                                                                                                  |
-|---------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `ORCHARD_HOME`                  | Override Orchard's home directory. Useful when running multiple Orchard instances on the same host and when testing.                                                                                                                                                                                                                                                         |
-| `ORCHARD_LICENSE_TIER`          | The default license limit only allows connecting 4 Orchard Workers to the Orchard Controller. If you've purchased a [Gold Tier License](/licensing/), set this variable to `gold` to increase the limit to 20 Orchard Workers. And if you've purchased a [Platinum Tier License](/licensing/), set this variable to `platinum` to increase the limit to 200 Orchard Workers. |
-| `ORCHARD_URL`                   | Override controller URL on per-command basis.                                                                                                                                                                                                                                                                                                                                |
-| `ORCHARD_SERVICE_ACCOUNT_NAME`  | Override service account name (used for controller API auth) on per-command basis.                                                                                                                                                                                                                                                                                           |
-| `ORCHARD_SERVICE_ACCOUNT_TOKEN` | Override service account token (used for controller API auth) on per-command basis.                                                                                                                                                                                                                                                                                          |
+| Variable name                   | Description                                                                                                                                                                                                                                                                                                                                                                          |
+|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `ORCHARD_HOME`                  | Override Orchard's home directory. Useful when running multiple Orchard instances on the same host and when testing.                                                                                                                                                                                                                                                                 |
+| `ORCHARD_LICENSE_TIER`          | The default license limit only allows connecting 4 Orchard Workers to the Orchard Controller. If you've purchased a [Gold Tier License](../licensing.md), set this variable to `gold` to increase the limit to 20 Orchard Workers. And if you've purchased a [Platinum Tier License](../licensing.md), set this variable to `platinum` to increase the limit to 200 Orchard Workers. |
+| `ORCHARD_URL`                   | Override controller URL on per-command basis.                                                                                                                                                                                                                                                                                                                                        |
+| `ORCHARD_SERVICE_ACCOUNT_NAME`  | Override service account name (used for controller API auth) on per-command basis.                                                                                                                                                                                                                                                                                                   |
+| `ORCHARD_SERVICE_ACCOUNT_TOKEN` | Override service account token (used for controller API auth) on per-command basis.                                                                                                                                                                                                                                                                                                  |
@@ -75,3 +75,12 @@ orchard create vm --resources bandwidth-mbps=7500 <NAME>
 However, after this VM is scheduled, the 10 Gbps Mac Studio will only be able to accommodate one more VM (due to internal Apple EULA limit for macOS virtualization) with `bandwidth-mbps=2500` or less.

 After the VM finishes, the unused resources will be available again.
+
+## Automatic resources
+
+In addition to manually specifying resources when starting a worker, the following resources are discovered and set automatically by the worker for convenience:
+
+* `org.cirruslabs.logical-cores` — number of logical cores on the host
+* `org.cirruslabs.memory-mib` — total memory in MiB (mebibytes) on the host
+
+Note that the values for these resources are scraped only once at worker startup.
@@ -95,8 +95,8 @@ ssh admin@$(tart ip sequoia-base)

    ```bash
    brew install cirruslabs/cli/sshpass
-    sshpass -p admin ssh -o "StrictHostKeyChecking no" admin@$(tart ip sequoia-base) "uname -a"
-    sshpass -p admin ssh -o "StrictHostKeyChecking no" admin@$(tart ip sequoia-base) < script.sh
+    sshpass -p admin ssh -o "StrictHostKeyChecking no" -o "UserKnownHostsFile=/dev/null" admin@$(tart ip sequoia-base) "uname -a"
+    sshpass -p admin ssh -o "StrictHostKeyChecking no" -o "UserKnownHostsFile=/dev/null" admin@$(tart ip sequoia-base) < script.sh
    ```

 ## Mounting directories
@@ -0,0 +1,24 @@
+module integration
+
+go 1.25
+
+require (
+	github.com/stretchr/testify v1.11.1
+	go.opentelemetry.io/otel v1.38.0
+	go.opentelemetry.io/proto/otlp v1.9.0
+	google.golang.org/protobuf v1.36.11
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.5 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/sys v0.40.0 // indirect
+	golang.org/x/text v0.33.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 // indirect
+	google.golang.org/grpc v1.78.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
@@ -0,0 +1,59 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.5 h1:jP1RStw811EvUDzsUQ9oESqw2e4RqCjSAD9qIL8eMns=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.5/go.mod h1:WXNBZ64q3+ZUemCMXD9kYnr56H7CgZxDBHCVwstfl3s=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
+go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
+go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
+go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
+go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
+go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
+go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
+go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
+go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
+go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
+go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
+go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
+golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516 h1:vmC/ws+pLzWjj/gzApyoZuSVrDtF1aod4u/+bbj8hgM=
+google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516/go.mod h1:p3MLuOwURrGBRoEyFHBT3GjUwaCQVKeNqqWxlcISGdw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 h1:sNrWoksmOyF5bvJUcnmbeAmQi8baNhqg5IWaI3llQqU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
+google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
+google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -0,0 +1,109 @@
+package integration_test
+
+import (
+    "compress/gzip"
+    "encoding/hex"
+    "integration/tart"
+    "io"
+    "net/http"
+    "net/http/httptest"
+    "net/url"
+    "testing"
+
+    "github.com/stretchr/testify/require"
+    semconv "go.opentelemetry.io/otel/semconv/v1.37.0"
+    tracepkg "go.opentelemetry.io/proto/otlp/collector/trace/v1"
+    v1 "go.opentelemetry.io/proto/otlp/common/v1"
+    "google.golang.org/protobuf/proto"
+)
+
+func TestOpenTelemetry(t *testing.T) {
+    // Start a mock OpenTelemetry collector server
+    var traces []*tracepkg.ExportTraceServiceRequest
+
+    server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+        var trace tracepkg.ExportTraceServiceRequest
+
+        reader := request.Body
+        var err error
+
+        if request.Header.Get("Content-Encoding") == "gzip" {
+            reader, err = gzip.NewReader(reader)
+            require.NoError(t, err)
+        }
+
+        requestBytes, err := io.ReadAll(reader)
+        require.NoError(t, err)
+
+        switch request.Header.Get("Content-Type") {
+        case "application/x-protobuf":
+            require.NoError(t, proto.Unmarshal(requestBytes, &trace))
+        default:
+            require.FailNowf(t, "unsupported content type",
+                "we do not support %q yet", request.Header.Get("Content-Type"))
+        }
+
+        traces = append(traces, &trace)
+
+        var response tracepkg.ExportTraceServiceResponse
+
+        responseBytes, err := proto.Marshal(&response)
+        require.NoError(t, err)
+
+        writer.Header().Set("Content-Type", "application/x-protobuf")
+        _, err = writer.Write(responseBytes)
+        require.NoError(t, err)
+    }))
+
+    // Start a "tart list" command
+    serverURL, err := url.Parse(server.URL)
+    require.NoError(t, err)
+
+    t.Setenv("OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", serverURL.JoinPath("v1/traces").String())
+    t.Setenv("CIRRUS_SENTRY_TAGS", "A=B,C=D")
+    t.Setenv("TRACEPARENT", "00-00000000000000000000000000000001-0000000000000001-01")
+
+    _, _, err = tart.Tart(t, "list")
+    require.NoError(t, err)
+
+    // Ensure that the mock OpenTelemetry collector received a trace from "tart list"
+    require.Len(t, traces, 1)
+
+    resourceSpans := traces[0].GetResourceSpans()
+    require.Len(t, resourceSpans, 1)
+
+    // Ensure that service name and version resources are set
+    resourceSpan := resourceSpans[0]
+    stringAttributes := stringAttributesToMap(resourceSpan.GetResource().GetAttributes())
+    require.Equal(t, "tart", stringAttributes[string(semconv.ServiceNameKey)])
+    require.Equal(t, "SNAPSHOT", stringAttributes[string(semconv.ServiceVersionKey)])
+
+    scopeSpans := resourceSpan.GetScopeSpans()
+    require.Len(t, scopeSpans, 1)
+
+    spans := scopeSpans[0].GetSpans()
+    require.Len(t, spans, 1)
+
+    // Ensure that the root span is correctly named
+    span := spans[0]
+    require.Equal(t, "list", span.Name)
+
+    // Ensure that CIRRUS_SENTRY_TAGS are propagated
+    stringAttributes = stringAttributesToMap(span.GetAttributes())
+    require.Equal(t, stringAttributes["A"], "B")
+    require.Equal(t, stringAttributes["C"], "D")
+
+    // Ensure that W3C Trace Context is propagated
+    require.Equal(t, "00000000000000000000000000000001", hex.EncodeToString(span.GetTraceId()))
+    require.Equal(t, "0000000000000001", hex.EncodeToString(span.GetParentSpanId()))
+}
+
+func stringAttributesToMap(attributes []*v1.KeyValue) map[string]string {
+    result := map[string]string{}
+
+    for _, attribute := range attributes {
+        result[attribute.GetKey()] = attribute.GetValue().GetStringValue()
+    }
+
+    return result
+}
@@ -1,6 +1,6 @@
 pytest
 testcontainers
-requests == 2.31.0 # work around https://github.com/psf/requests/issues/6707
+requests
 bitmath
 pytest-dependency
 paramiko
@@ -0,0 +1,56 @@
+package tart
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+const tartCommandName = "tart"
+
+var (
+	ErrTartNotFound = errors.New("tart command not found")
+	ErrTartFailed   = errors.New("tart command returned non-zero exit code")
+)
+
+func Tart(t *testing.T, args ...string) (string, string, error) {
+	t.Helper()
+
+	cmd := exec.CommandContext(t.Context(), tartCommandName, args...)
+
+	var stdout, stderr bytes.Buffer
+
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err := cmd.Run()
+	if err != nil {
+		if errors.Is(err, exec.ErrNotFound) {
+			return "", "", fmt.Errorf("%w: %s command not found in PATH, make sure Tart is installed",
+				ErrTartNotFound, tartCommandName)
+		}
+
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			// Tart command failed, redefine the error to be the Tart-specific output
+			err = fmt.Errorf("%w: %q", ErrTartFailed, firstNonEmptyLine(stderr.String(), stdout.String()))
+		}
+	}
+
+	return stdout.String(), stderr.String(), err
+}
+
+func firstNonEmptyLine(outputs ...string) string {
+	for _, output := range outputs {
+		for _, line := range strings.Split(output, "\n") {
+			if line != "" {
+				return line
+			}
+		}
+	}
+
+	return ""
+}
@@ -9,7 +9,7 @@ def test_run(tart, run_opts):
    vm_name = f"integration-test-run-{uuid.uuid4()}"

    # Instantiate a VM with admin:admin SSH access
-    tart.run(["clone", "ghcr.io/cirruslabs/macos-sonoma-base:latest", vm_name])
+    tart.run(["clone", "ghcr.io/cirruslabs/macos-tahoe-base:latest", vm_name])

    # Run the VM asynchronously
    tart_run_process = tart.run_async(["run", vm_name] + run_opts)
@@ -46,6 +46,7 @@ plugins:
      match_path: blog/posts/.*
      date_from_meta:
        as_creation: date
+      abstract_chars_count: -1
  - social:
      cards_layout_dir: docs/layouts
      cards_layout: custom
Author	SHA1	Message	Date
Nikolay Edigaryev	863e3c2925	Bind and connect to Unix domain sockets using relative paths (#1192 )	2026-02-05 15:51:14 +01:00
Nikolay Edigaryev	372affb0dc	Switch back to github.com/open-telemetry/opentelemetry-swift upstream (#1189 )	2026-02-02 19:40:24 +01:00
Nikolay Edigaryev	37b8219579	Switch to github.com/open-telemetry/opentelemetry-swift fork (#1186 ) * Switch to github.com/open-telemetry/opentelemetry-swift fork * Use cirruslabs-owned fork	2026-01-29 16:54:57 +00:00
Nikolay Edigaryev	f1aa591935	OpenTelemetry: set default resources, service.name and service.version (#1184 ) * OpenTelemetry: set default resources, service.name and service.version * Ensure that service name and version resources are set	2026-01-27 16:17:05 +01:00
Fedor KorotkovandClaude Opus 4.5	6189dc23af	Fix VM window not appearing on tart run (#1183 ) Restore the applicationDidFinishLaunching method that was accidentally removed in commit `b1e88e1` ("tart run: do not remove 'Edit' menu as its not present anymore"). That commit intended to remove the Edit menu removal code (since the menu no longer exists), but also removed the crucial activation code: - setActivationPolicy(.regular) - tells macOS this is a GUI app - activate(ignoringOtherApps:) - brings the window to the foreground Without these calls, the VM runs fine (SSH works) but no window appears on screen. Fixes #1181 Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-23 15:16:33 -05:00
Fedor Korotkov	361465748b	Add build workflow for testing (#1180 ) * Add build workflow * Split build workflows * Combine build workflows	2026-01-23 09:41:13 -05:00
Nikolay Edigaryev	e0147448a8	OpenTelemetry: only initialize tracing when TRACEPARENT env. var. is set (#1182 )	2026-01-23 14:57:53 +01:00
Nikolay Edigaryev	7038c45f8b	Switch to OpenTelemetry (#1179 ) * Switch to OpenTelemetry * Integration tests in Golang	2026-01-23 12:04:21 +01:00
Nikolay Edigaryev	44892c5def	Refactor "diskutil create" and "diskutil info" into a separate class (#1172 ) * Show true ASIF disk sizes * Use older sizeGB()	2026-01-22 13:00:27 +01:00
Nikolay Edigaryev	20dcfc83f2	Disable Sentry's app launch profiling (#1164 ) And access SentrySDK only when SENTRY_DSN is set.	2025-11-10 23:50:32 +04:00
Fedor Korotkov	c192de20f5	[docs] clarify licensing request details in press release (#1159 )	2025-10-27 16:04:35 +00:00
Fedor Korotkov	e28d9337a5	[docs] publish press release about licensing violation (#1158 ) * [docs] publish press release about licensing violation Highlighting that this is an exceptional case since the company did contact us about a license, and we explicitly declined due to conflict of interests. * Fixed linting	2025-10-27 11:21:46 -04:00
Nikolay Edigaryev	68ffa6c5e4	tart set: support optional "pt" and "px" units for "--display" argument (#1155 ) * tart set: support optional "pt" and "px" units for "--display" argument * Don't forget to update "unit" too	2025-10-21 21:35:42 -04:00
Nikolay Edigaryev	1b091e9db0	tart run: introduce new "--net-softnet-block" command-line argument (#1156 )	2025-10-21 21:14:43 +04:00
Nikolay Edigaryev	902b1a6c9c	Fix integration tests (#1149 ) * Use ghcr.io/cirruslabs/macos-tahoe-base:latest * CI: "Test on Sequoia" can be named just "Test" * integration-test: can use latest requests now that the bug is fixed	2025-10-09 18:55:59 -04:00
Eric Kolve	90d9500133	chore: adding no-keyboard, no-pointer options for run (#1091 )	2025-10-09 15:29:28 -04:00
Nikolay Edigaryev	b05c731510	FAQ: document creation and unlocking of the keychain headless machines (#1148 ) * FAQ: document creation and unlocking of the keychain headless machines * Remove extra spaces * Fix typo: this commands → this command	2025-10-08 22:19:02 +04:00
Nikolay Edigaryev	d762fe6fc1	tart run: do not recommend running "tart run" as root (#1147 )	2025-10-08 12:44:05 +00:00
Stefan MitterrutznerandNikolay Edigaryev	eff964b62a	Avoid duplicate progress updates in CI logs (#1140 ) * Avoid duplicate progress updates in CI logs * Update Sources/tart/Logging/ProgressObserver.swift Co-authored-by: Nikolay Edigaryev <edigaryev@gmail.com> --------- Co-authored-by: Nikolay Edigaryev <edigaryev@gmail.com>	2025-09-29 15:57:39 +04:00
fsc-eriker	590e064e35	Update faq.md: Avoid useless use of grep \| awk (#1142 ) In "Connecting to a service running on host", refactor to a single Awk script in favor of grep \| head \| awk	2025-09-29 07:43:48 -04:00
fsc-eriker	839c6e7562	Update faq.md: Use question word order in subheading (#1143 ) "How Tart is different from Anka" is not a question, and thus should not have a question mark. This PR proposes to change it into a question, but an equally valid fix is to drop the question mark.	2025-09-29 07:43:14 -04:00
Nikolay Edigaryev	e3ee2da2fd	Validate custom TART_HOME and provide a human-friendly error message (#1138 ) * Validate custom TART_HOME and provide a human-friendly error message * Safer way to calculate "descendingURLs"	2025-09-25 20:44:57 +04:00
Nikolay Edigaryev	84147f29b5	Document automatic resources set by the Orchard Worker (#1134 ) * Fix MkDocs warnings w.r.t. absolute instead of relative links * Document automatic resources set by the Orchard Worker * .markdownlint.yml: ignore MD051	2025-09-23 00:02:39 +04:00
jxlwqqandjinxiaolong	a655edd826	docs: update sshpass command to ignore known hosts file (#1136 ) Co-authored-by: jinxiaolong <jinxiaolong@tuhu.cn>	2025-09-22 23:12:45 +04:00
Nikolay Edigaryev	df100f1ca2	Improve credential provider errors (#1133 )	2025-09-22 22:57:05 +04:00
Fedor Korotkov	02bf5651e7	tart clone: make pruning limit configurable (#1126 ) * tart clone: make pruning limit configurable * Fixed compilation	2025-09-14 12:38:57 -04:00
Fedor Korotkov	96c89ad76e	tart clone: cap automatic pruning at 100 GB (#1124 )	2025-09-14 09:40:58 -04:00
Nikolay Edigaryev	b78fa6ba1c	ASIF is available only starting from macOS 26 (Tahoe) (#1096 ) * ASIF is available only starting from macOS 26 (Tahoe) * Remove testRawFormatIsAlwaysSupported() test * Fix testASIFFormatSupport() test to check for macOS 26+	2025-09-14 09:40:06 -04:00
Nikolay Edigaryev	e443cfa9a2	tart exec: do not attempt to call TTY-related methods when no -t is set (#1122 )	2025-09-12 19:17:17 +04:00
Nikolay Edigaryev	e35c13425e	tart exec: handle input redirection of regular files (#1106 )	2025-07-14 19:49:12 +04:00
Nikolay Edigaryev	0debec1266	docs: include full article content in RSS (#1104 )	2025-07-08 21:06:37 +04:00
Nikolay Edigaryev	294c5fc5e5	Upgrade Swift Argument Parser to 1.6.1 (#1103 ) * Upgrade Swift Argument Parser to 1.6.1 * Remove ArgumentParser workaround	2025-07-08 00:19:50 +04:00
Fedor Korotkov	99777b6740	Update README example to use macOS Tahoe (#1101 )	2025-07-07 13:50:16 +04:00
Fedor KorotkovandClaude	a2972aa4d9	feat: prioritize pruning of old SHA when pulling updated tags (#1102 ) * feat: prioritize pruning of old SHA when pulling updated tags When pulling a new version of a tagged image (e.g., ghcr.io/cirruslabs/macos-runner:sonoma), set the access date of the previous SHA to epoch time (1970-01-01). This ensures that the old SHA will be prioritized for pruning, even if it was accessed more recently than other cached images. This helps manage disk space more efficiently by automatically cleaning up superseded versions of frequently-updated tagged images. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * format * Review comments --------- Co-authored-by: Claude <noreply@anthropic.com>	2025-07-07 08:52:05 +00:00
Fedor KorotkovandNikolay Edigaryev	3a6c5fb81d	feat: Add disk image format selection with ASIF support (#1094 ) * feat: Add disk image format selection with ASIF support * fixed goreleaser-pro * Fix ASIF disk format compatibility issues - Use .uncached caching mode for ASIF disks to avoid Virtualization framework compatibility issues - Improve caching mode selection logic for better maintainability - Fix compiler warning by changing var to let for attachment variable This resolves VM startup failures when using ASIF disk format by ensuring proper disk attachment configuration. * Update goreleaser installation to use tap-specific formula Change from 'brew install --cask goreleaser-pro' to 'brew install --cask goreleaser/tap/goreleaser-pro' for proper installation from the official goreleaser tap. * Remove VS Code configuration and add to gitignore - Remove .vscode/launch.json from repository - Add .vscode/ to .gitignore to prevent VS Code settings from being tracked * Implement ASIF disk resize using diskutil - Add support for resizing ASIF disk images using diskutil image resize - Detect disk format from VM config and route to appropriate resize method - Use diskutil image info to get current ASIF disk size and validate resize - Remove restriction that prevented ASIF disk resizing in Set command - Add FailedToResizeDisk error case for proper error handling - Maintain backward compatibility with raw disk resizing - Add comprehensive size validation to prevent data loss * Update Sources/tart/Commands/Create.swift Co-authored-by: Nikolay Edigaryev <edigaryev@gmail.com> * Update Sources/tart/DiskImageFormat.swift Co-authored-by: Nikolay Edigaryev <edigaryev@gmail.com> * Update Sources/tart/DiskImageFormat.swift Co-authored-by: Nikolay Edigaryev <edigaryev@gmail.com> * Fix test naming and remove redundant test cases - Rename testFormatArgument to testCaseInsensitivity for clarity - Remove redundant 'raw' and 'invalid' test cases already covered in testFormatFromString - Remove testFormatDescriptions test as it's not very useful Addresses review comment: https://github.com/cirruslabs/tart/pull/1094#discussion_r2152093510 * Remove canCreate property and simplify DiskImageFormat - Remove canCreate property since it's the same as isSupported - Remove description property entirely as it's not used - Fix displayName for RAW format (remove UDIF reference) - Remove checkDiskutilASIFSupport helper function Addresses review comments: - https://github.com/cirruslabs/tart/pull/1094#discussion_r2152109450 - https://github.com/cirruslabs/tart/pull/1094#discussion_r2152115610 - https://github.com/cirruslabs/tart/pull/1094#discussion_r2152124330 * Update Create command validation and help text - Simplify ArgumentParser help text to let it show possible values automatically - Remove canCreate validation since property was removed - Simplify error message for unsupported disk formats Addresses review comment: https://github.com/cirruslabs/tart/pull/1094#discussion_r2152113480 * Add disk format validation to Run command - Add validation to ensure ASIF disk format is supported on current system - Check disk format compatibility before attempting to run VM Addresses review comment: https://github.com/cirruslabs/tart/pull/1094#discussion_r2152109450 * Use proper namespaced constant for OCI label - Add diskFormatLabelAnnotation constant in Manifest.swift - Use org.cirruslabs.tart.disk.format namespace for consistency - Use variable shadowing instead of new variable name for labels Addresses review comment: https://github.com/cirruslabs/tart/pull/1094#discussion_r2152163515 * Remove special ASIF caching mode - Remove .uncached caching mode for ASIF disks - Use default caching logic for all disk formats - Testing shows .cached mode works fine on macOS 26.0 Addresses review comment: https://github.com/cirruslabs/tart/pull/1094#discussion_r2152133589 * Improve code structure in VMDirectory - Use guard let instead of nested if let for better readability - Reduce nesting in resizeASIFDisk function - Improve error handling flow Addresses review comment: https://github.com/cirruslabs/tart/pull/1094#discussion_r2152141916 * diskFormatLabel * reverted caching mode * Use PropertyListDecoder --------- Co-authored-by: Nikolay Edigaryev <edigaryev@gmail.com>	2025-06-19 18:27:30 +04:00
Nikolay Edigaryev	5793935317	tart ip: implement --resolver=agent (#1095 ) * tart ip: implement --resolver=agent * CI: fix GoReleaser installation	2025-06-19 13:07:06 +04:00
Nikolay Edigaryev	8dc8b644b2	tart exec: do not limit RPC call duration to 1 second	2025-06-11 20:15:18 +02:00
Nikolay Edigaryev	b625c04131	tart exec: make sure <name> goes after flags like -i and -t in --help (#1090 )	2025-06-11 21:58:30 +04:00
Nikolay Edigaryev	a0c03dcce6	docs: new "Bridging the gaps with the Tart Guest Agent" blog post (#1080 )	2025-06-01 19:54:45 -04:00
Nikolay Edigaryev	8539b8faae	Delay Sentry initialization until after we parse the CLI arguments (#1085 )	2025-05-30 17:24:19 +04:00
Nikolay Edigaryev	71159373e5	tart run: allow "--dir" with "--suspendable" (#1082 )	2025-05-30 17:24:09 +04:00
Fedor Korotkov	8248f19943	Update sentry (#1079 )	2025-05-28 23:06:10 +00:00
fedor	1cbc1e2cda	Suspendable VMs now support consoles	2025-05-28 17:09:54 -04:00
Nikolay Edigaryev	0187834c34	tart exec: explain that Tart Guest Agent is required (#1078 ) * tart exec: explain that Tart Guest Agent is required Also handle decrease the connection timeout to 1 second and provide a hint to the user. * execute() can be made private * Include error.localizedDescription	2025-05-27 12:57:56 +04:00