Deployed 5287b59 with MkDocs version: 1.6.1

2026-10-10 16:05:35 +02:00 · 2026-05-12 21:45:50 +00:00
427 changed files with 76266 additions and 18069 deletions
@@ -1,18 +0,0 @@
-#!/bin/sh
-
-set -e
-
-export VERSION="${CIRRUS_TAG:-0}"
-
-mkdir -p .ci/pkg/
-cp .build/arm64-apple-macosx/release/tart .ci/pkg/tart
-cp Resources/embedded.provisionprofile .ci/pkg/embedded.provisionprofile
-cp Resources/AppIcon.png .ci/pkg/AppIcon.png
-cp Resources/Info.plist .ci/pkg/Info.plist
-pkgbuild --root .ci/pkg/ --identifier com.github.cirruslabs.tart --version $VERSION \
-  --scripts .ci/pkg/scripts \
-  --install-location "/Library/Application Support/Tart" \
-  --sign "Developer ID Installer: Cirrus Labs, Inc. (9M2P8L4D89)" \
-  "./.ci/Tart-$VERSION.pkg"
-xcrun notarytool submit "./.ci/Tart-$VERSION.pkg" --keychain-profile "notarytool" --wait
-xcrun stapler staple "./.ci/Tart-$VERSION.pkg"
@@ -1,15 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# fix structure
-mkdir -p "$2/tart.app/Contents/MacOS" "$2/tart.app/Resources"
-mv "$2/tart" "$2/tart.app/Contents/MacOS/tart"
-mv "$2/embedded.provisionprofile" "$2/tart.app/Contents/embedded.provisionprofile"
-mv "$2/AppIcon.png" "$2/tart.app/Resources/AppIcon.png"
-mv "$2/Info.plist" "$2/tart.app/Contents/Info.plist"
-
-echo "#!/bin/sh" > /usr/local/bin/tart
-echo "exec '$2/tart.app/Contents/MacOS/tart' \"\$@\"" >> /usr/local/bin/tart
-
-chmod +x /usr/local/bin/tart
@@ -1,7 +0,0 @@
-#!/bin/sh
-
-TMPFILE=$(mktemp)
-envsubst < Sources/tart/CI/CI.swift > $TMPFILE
-mv $TMPFILE Sources/tart/CI/CI.swift
-
-/usr/libexec/PlistBuddy -c "Add :CFBundleShortVersionString string ${CIRRUS_TAG}" Resources/Info.plist
@@ -1,163 +0,0 @@
-use_compute_credits: true
-
-task:
-  name: Test
-  alias: test
-  persistent_worker:
-    labels:
-      name: dev-mini
-    resources:
-      tart-vms: 1
-  build_script:
-    - swift build
-  test_script:
-    # Add /usr/sbin to PATH, otherwise testDiskutilInfo() fails to locate "diskutil"
-    - export PATH=$PATH:/usr/sbin
-    - swift test
-  integration_test_script:
-    - codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/debug/tart
-    - export PATH=$(pwd)/.build/arm64-apple-macosx/debug:$PATH
-    # Run integration tests
-    - cd integration-tests
-    - python3 -m venv --symlinks venv
-    - source venv/bin/activate
-    - pip install -r requirements.txt
-    - pytest --verbose --junit-xml=pytest-junit.xml
-    - go test -v ./...
-  pytest_junit_result_artifacts:
-    path: "integration-tests/pytest-junit.xml"
-    format: junit
-
-task:
-  name: Markdown Lint
-  only_if: $CIRRUS_BRANCH != 'gh-pages' && changesInclude('**.md')
-  container:
-    image: node:latest
-  install_script: npm install -g markdownlint-cli
-  lint_script: markdownlint --config=docs/.markdownlint.yml docs/
-
-task:
-  name: Lint
-  alias: lint
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:tahoe
-  lint_script:
-    - swift package plugin --allow-writing-to-package-directory swiftformat --cache ignore --lint --report swiftformat.json .
-  always:
-    swiftformat_report_artifacts:
-      path: swiftformat.json
-      format: swiftformat
-
-task:
-  only_if: $CIRRUS_TAG == ''
-  env:
-    matrix:
-      BUILD_ARCH: arm64
-      BUILD_ARCH: x86_64
-  name: Build ($BUILD_ARCH)
-  alias: build
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:tahoe
-  build_script: swift build --arch $BUILD_ARCH --product tart
-  sign_script: codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/$BUILD_ARCH-apple-macosx/debug/tart
-  binary_artifacts:
-    path: .build/$BUILD_ARCH-apple-macosx/debug/tart
-
-task:
-  only_if: $CIRRUS_TAG == '' && ($CIRRUS_USER_PERMISSION == 'write' || $CIRRUS_USER_PERMISSION == 'admin')
-  name: Release (Dry Run)
-  depends_on:
-    - lint
-    - build
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:tahoe
-  env:
-    MACOS_CERTIFICATE: ENCRYPTED[552b9d275d1c2bdbc1bff778b104a8f9a53cbd0d59344d4b7f6d0ca3c811a5cefb97bef9ba0ef31c219cb07bdacdd2c2]
-    AC_PASSWORD: ENCRYPTED[4a761023e7e06fe2eb350c8b6e8e7ca961af193cb9ba47605f25f1d353abc3142606f412e405be48fd897a78787ea8c2]
-    GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
-    GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
-  setup_script:
-    - cd $HOME
-    - echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
-    - security create-keychain -p password101 build.keychain
-    - security default-keychain -s build.keychain
-    - security unlock-keychain -p password101 build.keychain
-    - security import certificate.p12 -k build.keychain -P password101 -T /usr/bin/codesign -T /usr/bin/pkgbuild
-    - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k password101 build.keychain
-    - xcrun notarytool store-credentials "notarytool" --apple-id "hello@cirruslabs.org" --team-id "9M2P8L4D89" --password $AC_PASSWORD
-  install_script:
-    - brew install go
-    - brew install mitchellh/gon/gon
-    - brew install --cask goreleaser/tap/goreleaser-pro
-  info_script:
-    - security find-identity -v
-    - xcodebuild -version
-    - swift -version
-  goreleaser_script: goreleaser release --skip=publish --snapshot --clean
-  always:
-    dist_artifacts:
-      path: "dist/*"
-
-task:
-  name: Release
-  only_if: $CIRRUS_TAG != ''
-  depends_on:
-    - lint
-    - build
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:tahoe
-  env:
-    MACOS_CERTIFICATE: ENCRYPTED[552b9d275d1c2bdbc1bff778b104a8f9a53cbd0d59344d4b7f6d0ca3c811a5cefb97bef9ba0ef31c219cb07bdacdd2c2]
-    AC_PASSWORD: ENCRYPTED[4a761023e7e06fe2eb350c8b6e8e7ca961af193cb9ba47605f25f1d353abc3142606f412e405be48fd897a78787ea8c2]
-    GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
-    GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
-    SENTRY_ORG: cirrus-labs
-    SENTRY_PROJECT: persistent-workers
-    SENTRY_AUTH_TOKEN: ENCRYPTED[!9eaf2875d51b113e2f68598441ff8e6b2e53242e48fcb93633bd75a373fbe2e7caa900d837cc92f0b142b65579731644!]
-  setup_script:
-    - cd $HOME
-    - echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
-    - security create-keychain -p password101 build.keychain
-    - security default-keychain -s build.keychain
-    - security unlock-keychain -p password101 build.keychain
-    - security import certificate.p12 -k build.keychain -P password101 -T /usr/bin/codesign -T /usr/bin/pkgbuild
-    - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k password101 build.keychain
-    - xcrun notarytool store-credentials "notarytool" --apple-id "hello@cirruslabs.org" --team-id "9M2P8L4D89" --password $AC_PASSWORD
-  install_script:
-    - brew install go getsentry/tools/sentry-cli
-    - brew install mitchellh/gon/gon
-    - brew install --cask goreleaser/tap/goreleaser-pro
-  info_script:
-    - security find-identity -v
-    - xcodebuild -version
-    - swift -version
-  release_script: goreleaser
-  upload_sentry_debug_files_script:
-    - cd .build/arm64-apple-macosx/release/
-    # Generate and upload symbols
-    - dsymutil tart
-    - sentry-cli debug-files upload tart.dSYM/
-    - SENTRY_PROJECT=tart sentry-cli debug-files upload tart.dSYM/
-    # Bundle and upload sources
-    - sentry-cli debug-files bundle-sources tart.dSYM
-    - sentry-cli debug-files upload tart.src.zip
-    - SENTRY_PROJECT=tart sentry-cli debug-files upload tart.src.zip
-  create_sentry_release_script:
-    - export SENTRY_RELEASE="tart@$CIRRUS_TAG"
-    - sentry-cli releases new $SENTRY_RELEASE
-    - sentry-cli releases set-commits $SENTRY_RELEASE --auto
-    - sentry-cli releases finalize $SENTRY_RELEASE
-
-task:
-  name: Deploy Documentation
-  only_if: $CIRRUS_BRANCH == 'main'
-  container:
-    image: ghcr.io/squidfunk/mkdocs-material:latest
-    registry_config: ENCRYPTED[!cf1a0f25325aa75bad3ce6ebc890bc53eb0044c02efa70d8cefb83ba9766275a994b4831706c52630a0692b2fa9cfb9e!]
-  env:
-    DEPLOY_TOKEN: ENCRYPTED[!45ed45666558902ed1c2400add734ec063103bec31841847e8c8764802fca229bfa6d85c690e16ad159e047574b48793!]
-  deploy_script:
-    - git config --global user.name "Cirrus CI"
-    - git config --global user.name "hello@cirruslabs.org"
-    - git remote set-url origin https://$DEPLOY_TOKEN@github.com/cirruslabs/tart/
-    - mkdocs --verbose gh-deploy --force --remote-branch gh-pages
@@ -1,11 +0,0 @@
-root = true
-
-[*]
-indent_style = space
-indent_size = 2
-insert_final_newline = true
-
-[integration-tests/**]
-indent_style = unset
-indent_size = unset
-insert_final_newline = unset
@@ -1 +0,0 @@
-* @edigaryev @fkorotkov
@@ -1 +0,0 @@
-github: [cirruslabs]
@@ -1,37 +0,0 @@
-name: Build
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  build_cached:
-    name: Build tart (cached)
-    runs-on: ghcr.io/cirruslabs/macos-runner:tahoe
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v5
-      - name: Build
-        run: |
-          export COMPILATION_CACHE_ENABLE_CACHING=YES
-          export COMPILATION_CACHE_REMOTE_SERVICE_PATH="$HOME/.cirruslabs/omni-cache.sock"
-          export COMPILATION_CACHE_ENABLE_PLUGIN=YES
-          export COMPILATION_CACHE_ENABLE_INTEGRATED_QUERIES=YES
-          export COMPILATION_CACHE_ENABLE_DETACHED_KEY_QUERIES=YES
-          export SWIFT_ENABLE_COMPILE_CACHE=YES
-          export SWIFT_ENABLE_EXPLICIT_MODULES=YES
-          export SWIFT_USE_INTEGRATED_DRIVER=YES
-          export CLANG_ENABLE_COMPILE_CACHE=YES
-          export CLANG_ENABLE_MODULES=YES
-          swift build --build-system swiftbuild --product tart
-
-  build_no_cache:
-    name: Build tart (no cache)
-    runs-on: ghcr.io/cirruslabs/macos-runner:tahoe
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v5
-      - name: Build
-        run: swift build --build-system swiftbuild --product tart
@@ -1,24 +0,0 @@
-# Xcode's user settings
-xcuserdata/
-tart.xcodeproj/
-
-# SwiftPM
-.swiftpm/
-
-# AppCode
-.idea/
-
-# VS Code
-.vscode/
-
-# Swift
-.build/
-
-# GoReleaser
-dist/
-
-# mkdocs
-.cache
-
-# mkdocs-material
-site
@@ -1,78 +0,0 @@
-version: 2
-
-project_name: tart
-
-before:
-  hooks:
-    - .ci/set-version.sh
-    - swift build --arch arm64 --configuration release --product tart
-    - swift build --arch x86_64 --configuration release --product tart
-
-builds:
-  - id: tart
-    builder: prebuilt
-    goamd64: [v1]
-    goos:
-      - darwin
-    goarch:
-      - arm64
-      - amd64
-    binary: tart.app/Contents/MacOS/tart
-    prebuilt:
-      path: '.build/{{- if eq .Arch "arm64" }}arm64{{- else }}x86_64{{ end }}-apple-macosx/release/tart'
-
-universal_binaries:
-  - name_template: tart.app/Contents/MacOS/tart
-    replace: true
-    hooks:
-      post:
-        - mkdir -p dist/tart_darwin_all/tart.app/Contents/Resources
-        - cp Resources/embedded.provisionprofile dist/tart_darwin_all/tart.app/Contents/
-        - cp Resources/Info.plist dist/tart_darwin_all/tart.app/Contents/
-        - cp "Resources/actool/UPW Tart.icns" "Resources/actool/Assets.car" dist/tart_darwin_all/tart.app/Contents/Resources/
-        - gon gon.hcl
-
-archives:
-  - name_template: "{{ .ProjectName }}"
-    files:
-      - src: dist/tart_darwin_all/tart.app/Contents/Info.plist
-        dst: tart.app/Contents/Info.plist
-      - src: dist/tart_darwin_all/tart.app/Contents/embedded.provisionprofile
-        dst: tart.app/Contents/embedded.provisionprofile
-      - src: dist/tart_darwin_all/tart.app/Contents/Resources/UPW Tart.icns
-        dst: tart.app/Contents/Resources/UPW Tart.icns
-      - src: dist/tart_darwin_all/tart.app/Contents/Resources/Assets.car
-        dst: tart.app/Contents/Resources/Assets.car
-      - src: dist/tart_darwin_all/tart.app/Contents/_CodeSignature/CodeResources
-        dst: tart.app/Contents/_CodeSignature/CodeResources
-      - LICENSE
-
-release:
-  prerelease: auto
-
-brews:
-  - name: tart
-    repository:
-      owner: cirruslabs
-      name: homebrew-cli
-    caveats: |
-      Tart has been installed. You might want to reduce the default DHCP lease time
-      from 86,400 to 600 seconds to avoid DHCP shortage when running lots of VMs daily:
-
-        sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.InternetSharing.default.plist bootpd -dict DHCPLeaseTimeSecs -int 600
-
-      See https://tart.run/faq/#changing-the-default-dhcp-lease-time for more details.
-    homepage: https://github.com/cirruslabs/tart
-    license: "Fair Source"
-    description: Run macOS and Linux VMs on Apple Hardware
-    skip_upload: auto
-    dependencies:
-      - "cirruslabs/cli/softnet"
-    install: |
-      libexec.install Dir["*"]
-      bin.write_exec_script "#{libexec}/tart.app/Contents/MacOS/tart"
-    custom_block: |
-      depends_on :macos => :ventura
-      def post_install
-        generate_completions_from_executable(libexec/"tart.app/Contents/MacOS/tart", "--generate-completion-script")
-      end
@@ -1,5 +0,0 @@
--disable all
--enable indent
--indent 2
--exclude Sources/tart/OCI/Reference/Generated
--swiftversion 5.7
@@ -1,41 +0,0 @@
-# Contributing to Tart
-
-Table of Contents
-----------------
-
- [How to Build](#how-to-build)
- [How to Create an Issue/Enhancement](#how-to-create-an-issueenhancement)
- [Style Guidelines](#style-guidelines)
- [Pull Requests](#Pull-Requests)
-
-## How to Build
-
-1. Fork the repository to your own GitHub account
-2. Clone the forked repository to your local machine
-3. If using Xcode, use from Xcode 15 or newer
-4. Run ./scripts/run-signed.sh from the root of your repository
-
-```bash
-./scripts/run-signed.sh list
-```
-## How to Create an Issue/Enhancement
-
-1. Go to the [Issue page](https://github.com/cirruslabs/tart/issues) of the repository
-2. Click on the "New Issue" button
-3. Provide a descriptive title and detailed description of the issue or enhancement you're suggesting
-4. Submit the issue
-
-## Style Guidelines
-
-1. Code should follow camel case
-2. Code should follow [SwiftFormat](https://github.com/nicklockwood/SwiftFormat#swift-package-manager-plugin) guidelines. You can auto-format the code by running the following command:
-
-```bash
-swift package plugin --allow-writing-to-package-directory swiftformat --cache ignore .
-```
-
-## Pull Requests
-
-1. Provide a detailed description of the changes you made in the pull request
-2. Wait for pull request to be reviewed 
-3. Make adjustments if necessary
@@ -1,45 +0,0 @@
-Fair Source License, version 0.9
-
-Copyright (C) 2023 Cirrus Labs, Inc.
-
-Licensor: Cirrus Labs, Inc.
-
-Software: Tart
-
-Use Limitation: 100 users. User is defined as a single core of a central processing unit (CPU) used by the product.
-The Use Limitation does not apply to CPUs installed in devices used by a single individual.
-
-License Grant. Licensor hereby grants to each recipient of the
-Software ("you") a non-exclusive, non-transferable, royalty-free and
-fully-paid-up license, under all of the Licensor's copyright and
-patent rights, to use, copy, distribute, prepare derivative works of,
-publicly perform and display the Software, subject to the Use
-Limitation and the conditions set forth below.
-
-Use Limitation. The license granted above allows use by up to the
-number of users per entity set forth above (the "Use Limitation"). For
-determining the number of users, "you" includes all affiliates,
-meaning legal entities controlling, controlled by, or under common
-control with you. If you exceed the Use Limitation, your use is
-subject to payment of Licensor's then-current list price for licenses.
-
-Conditions. Redistribution in source code or other forms must include
-a copy of this license document to be provided in a reasonable
-manner. Any redistribution of the Software is only allowed subject to
-this license.
-
-Trademarks. This license does not grant you any right in the
-trademarks, service marks, brand names or logos of Licensor.
-
-DISCLAIMER. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OR
-CONDITION, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES
-OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. LICENSORS HEREBY DISCLAIM ALL LIABILITY, WHETHER IN
-AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE.
-
-Termination. If you violate the terms of this license, your rights
-will terminate automatically and will not be reinstated without the
-prior written consent of Licensor. Any such termination will not
-affect the right of others who may have received copies of the
-Software from you.
@@ -1,64 +0,0 @@
-# Profiling Tart
-
-## Using `time(1)`
-
-Perhaps, the easiest, but not the most comprehensive way to tell what's going on with Tart is to use the [`time(1)`](https://ss64.com/mac/time.html) command.
-
-In the example below, you will run `tart pull` via `time(1)` to gather generalized CPU, I/O and memory usage metrics:
-
-```shell
-/usr/bin/time -l tart pull ghcr.io/cirruslabs/macos-tahoe-base:latest
-```
-
-**Note:** you need to specify a full path to `time(1)` binary, otherwise the shell's built-in `time` command will be invoked, which doesn't have the `-l` command-line argument.
-
-**Note:** The `-l` command-line argument makes `time(1)` return much more useful information, for example, maximum memory usage.
-
-When running the command above, you'll see the `tart pull` output first as it pulls the image, and then the `time(1)` output, which will be printed once the Tart process finishes:
-
-```
-      172.17 real        10.29 user         8.36 sys
-           353796096  maximum resident set size
-                   0  average shared memory size
-                   0  average unshared data size
-                   0  average unshared stack size
-               23838  page reclaims
-                  35  page faults
-                   0  swaps
-                   0  block input operations
-                   0  block output operations
-                   8  messages sent
-                   8  messages received
-                   0  signals received
-                 146  voluntary context switches
-              222950  involuntary context switches
-         39683070975  instructions retired
-         27562035252  cycles elapsed
-           170920448  peak memory footprint
-```
-
-From the output above, you can tell that `tart pull` spent nearly 90% of time off-CPU (`real` > `user` + `sys`), which means that Tart was mostly waiting for the I/O (be it a network or disk), instead of decompressing disk layers or doing other useful computations.
-
-## Using `xctrace(1)`
-
-[`xctrace(1)`](https://keith.github.io/xcode-man-pages/xctrace.1.html) is a `.trace` format recorder for the [Instruments](https://en.wikipedia.org/wiki/Instruments_(software)) app, which yields much more powerful insights compared to `time(1)`. For example, it can tell which Tart functions spent the most time on the CPU, thus allowing the Tart developers to further optimize these functions.
-
-To use it, make sure that [Xcode](https://developer.apple.com/xcode/resources/) is installed. If you're installing Xcode for the first time on the machine, you'll need to launch it once and click the blue "Install" button. There's no need to choose any platforms except for the macOS.
-
-Once done, you can create a CPU profile of `tart pull`:
-
-```shell
-xctrace record --template "CPU Profiler" --target-stdout - --launch -- /opt/homebrew/bin/tart pull ghcr.io/cirruslabs/macos-tahoe-base:latest
-```
-
-Now that `xctrace(1)` is running, you'll see the `tart pull`-related output first, and once finished, the following line will appear:
-
-```
-Output file saved as: Launch_[...].trace
-```
-
-To view this trace in the Instruments app, simply find this directory in Finder and double-click it. Instruments app will appear:
-
-![](Resources/Instruments.png)
-
-To send this trace, right-click its directory in Finder and choose "Compress [...]". This will result in a similarly named file with a `.zip` at the end, which can now be conveniently sent via email or uploaded.
@@ -1,303 +0,0 @@
-{
-  "originHash" : "061dfe6cdf4e6dbf32b51c5e7023c4ae69726dcafb42a35b34e5489b0338c17f",
-  "pins" : [
-    {
-      "identity" : "antlr4",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/antlr/antlr4",
-      "state" : {
-        "revision" : "cc82115a4e7f53d71d9d905caa2c2dfa4da58899",
-        "version" : "4.13.2"
-      }
-    },
-    {
-      "identity" : "cirruslabs_tart-guest-agent_apple_swift",
-      "kind" : "remoteSourceControl",
-      "location" : "https://buf.build/gen/swift/git/1.33.3-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_apple_swift.git",
-      "state" : {
-        "revision" : "5c49a653f4b003161077d194bc708b7373628c99",
-        "version" : "1.33.3-20260114140118-bd09c26a260f.1"
-      }
-    },
-    {
-      "identity" : "cirruslabs_tart-guest-agent_grpc_swift",
-      "kind" : "remoteSourceControl",
-      "location" : "https://buf.build/gen/swift/git/1.27.1-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_grpc_swift.git",
-      "state" : {
-        "branch" : "main",
-        "revision" : "4935078c2fe2508360843596d71a1f844ce639a6"
-      }
-    },
-    {
-      "identity" : "dynamic",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/mhdhejazi/Dynamic",
-      "state" : {
-        "branch" : "master",
-        "revision" : "772883073d044bc754d401cabb6574624eb3778f"
-      }
-    },
-    {
-      "identity" : "grpc-swift",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/grpc/grpc-swift.git",
-      "state" : {
-        "revision" : "8f57f68b9d247fe3759fa9f18e1fe919911e6031",
-        "version" : "1.27.1"
-      }
-    },
-    {
-      "identity" : "opentelemetry-swift",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/open-telemetry/opentelemetry-swift",
-      "state" : {
-        "branch" : "main",
-        "revision" : "ed37be9525081509ab62410d38b705c2b3f0d5a4"
-      }
-    },
-    {
-      "identity" : "opentelemetry-swift-core",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/open-telemetry/opentelemetry-swift-core.git",
-      "state" : {
-        "revision" : "240c8d5e36c3c7b774ed961325369f0b1f2c965f",
-        "version" : "2.3.0"
-      }
-    },
-    {
-      "identity" : "opentracing-objc",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/undefinedlabs/opentracing-objc",
-      "state" : {
-        "revision" : "18c1a35ca966236cee0c5a714a51a73ff33384c1",
-        "version" : "0.5.2"
-      }
-    },
-    {
-      "identity" : "semaphore",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/groue/Semaphore",
-      "state" : {
-        "revision" : "2543679282aa6f6c8ecf2138acd613ed20790bc2",
-        "version" : "0.1.0"
-      }
-    },
-    {
-      "identity" : "swift-algorithms",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-algorithms",
-      "state" : {
-        "revision" : "f6919dfc309e7f1b56224378b11e28bab5bccc42",
-        "version" : "1.2.0"
-      }
-    },
-    {
-      "identity" : "swift-argument-parser",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-argument-parser",
-      "state" : {
-        "revision" : "309a47b2b1d9b5e991f36961c983ecec72275be3",
-        "version" : "1.6.1"
-      }
-    },
-    {
-      "identity" : "swift-atomics",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-atomics.git",
-      "state" : {
-        "revision" : "b601256eab081c0f92f059e12818ac1d4f178ff7",
-        "version" : "1.3.0"
-      }
-    },
-    {
-      "identity" : "swift-collections",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-collections.git",
-      "state" : {
-        "revision" : "671108c96644956dddcd89dd59c203dcdb36cec7",
-        "version" : "1.1.4"
-      }
-    },
-    {
-      "identity" : "swift-http-structured-headers",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-http-structured-headers.git",
-      "state" : {
-        "revision" : "db6eea3692638a65e2124990155cd220c2915903",
-        "version" : "1.3.0"
-      }
-    },
-    {
-      "identity" : "swift-http-types",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-http-types.git",
-      "state" : {
-        "revision" : "a0a57e949a8903563aba4615869310c0ebf14c03",
-        "version" : "1.4.0"
-      }
-    },
-    {
-      "identity" : "swift-log",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-log.git",
-      "state" : {
-        "revision" : "2778fd4e5a12a8aaa30a3ee8285f4ce54c5f3181",
-        "version" : "1.9.1"
-      }
-    },
-    {
-      "identity" : "swift-metrics",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-metrics.git",
-      "state" : {
-        "revision" : "0743a9364382629da3bf5677b46a2c4b1ce5d2a6",
-        "version" : "2.7.1"
-      }
-    },
-    {
-      "identity" : "swift-nio",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio.git",
-      "state" : {
-        "revision" : "233f61bc2cfbb22d0edeb2594da27a20d2ce514e",
-        "version" : "2.93.0"
-      }
-    },
-    {
-      "identity" : "swift-nio-extras",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-extras.git",
-      "state" : {
-        "revision" : "f1f6f772198bee35d99dd145f1513d8581a54f2c",
-        "version" : "1.26.0"
-      }
-    },
-    {
-      "identity" : "swift-nio-http2",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-http2.git",
-      "state" : {
-        "revision" : "4281466512f63d1bd530e33f4aa6993ee7864be0",
-        "version" : "1.36.0"
-      }
-    },
-    {
-      "identity" : "swift-nio-ssl",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-ssl.git",
-      "state" : {
-        "revision" : "4b38f35946d00d8f6176fe58f96d83aba64b36c7",
-        "version" : "2.31.0"
-      }
-    },
-    {
-      "identity" : "swift-nio-transport-services",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-transport-services.git",
-      "state" : {
-        "revision" : "cd1e89816d345d2523b11c55654570acd5cd4c56",
-        "version" : "1.24.0"
-      }
-    },
-    {
-      "identity" : "swift-numerics",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-numerics",
-      "state" : {
-        "revision" : "0a5bc04095a675662cf24757cc0640aa2204253b",
-        "version" : "1.0.2"
-      }
-    },
-    {
-      "identity" : "swift-protobuf",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-protobuf.git",
-      "state" : {
-        "revision" : "c169a5744230951031770e27e475ff6eefe51f9d",
-        "version" : "1.33.3"
-      }
-    },
-    {
-      "identity" : "swift-retry",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/fumoboy007/swift-retry",
-      "state" : {
-        "revision" : "df9d7b185d2e433147ec0083a73c257e665eea0d",
-        "version" : "0.2.4"
-      }
-    },
-    {
-      "identity" : "swift-sysctl",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/sersoft-gmbh/swift-sysctl.git",
-      "state" : {
-        "revision" : "a91be36de6803ebe48f678699dfd0694c2200d2f",
-        "version" : "1.8.0"
-      }
-    },
-    {
-      "identity" : "swift-system",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-system.git",
-      "state" : {
-        "revision" : "a34201439c74b53f0fd71ef11741af7e7caf01e1",
-        "version" : "1.4.2"
-      }
-    },
-    {
-      "identity" : "swift-xattr",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/jozefizso/swift-xattr",
-      "state" : {
-        "revision" : "f8605af7b3290dbb235fb182ec6e9035d0c8c3ac",
-        "version" : "3.0.0"
-      }
-    },
-    {
-      "identity" : "swiftdate",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/malcommac/SwiftDate",
-      "state" : {
-        "revision" : "5d943224c3bb173e6ecf27295611615eba90c80e",
-        "version" : "7.0.0"
-      }
-    },
-    {
-      "identity" : "swiftformat",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/nicklockwood/SwiftFormat",
-      "state" : {
-        "revision" : "ab6844edb79a7b88dc6320e6cee0a0db7674dac3",
-        "version" : "0.54.5"
-      }
-    },
-    {
-      "identity" : "swiftradix",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/orchetect/SwiftRadix",
-      "state" : {
-        "revision" : "a52c37a4c213403f7377ae77b4c68451bcab8330",
-        "version" : "1.3.1"
-      }
-    },
-    {
-      "identity" : "texttable",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/cfilipov/TextTable",
-      "state" : {
-        "branch" : "master",
-        "revision" : "e03289289155b4e7aa565e32862f9cb42140596a"
-      }
-    },
-    {
-      "identity" : "thrift-swift",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/undefinedlabs/Thrift-Swift",
-      "state" : {
-        "revision" : "18ff09e6b30e589ed38f90a1af23e193b8ecef8e",
-        "version" : "1.1.2"
-      }
-    }
-  ],
-  "version" : 3
-}
@@ -1,62 +0,0 @@
-// swift-tools-version:5.10
-
-import PackageDescription
-let package = Package(
-  name: "Tart",
-  platforms: [
-    .macOS(.v13)
-  ],
-  products: [
-    .executable(name: "tart", targets: ["tart"])
-  ],
-  dependencies: [
-    .package(url: "https://github.com/apple/swift-argument-parser", from: "1.6.1"),
-    .package(url: "https://github.com/mhdhejazi/Dynamic", branch: "master"),
-    .package(url: "https://github.com/apple/swift-algorithms", from: "1.2.0"),
-    .package(url: "https://github.com/malcommac/SwiftDate", from: "7.0.0"),
-    .package(url: "https://github.com/antlr/antlr4", exact: "4.13.2"),
-    .package(url: "https://github.com/apple/swift-atomics.git", .upToNextMajor(from: "1.2.0")),
-    .package(url: "https://github.com/nicklockwood/SwiftFormat", from: "0.53.6"),
-    .package(url: "https://github.com/cfilipov/TextTable", branch: "master"),
-    .package(url: "https://github.com/sersoft-gmbh/swift-sysctl.git", from: "1.8.0"),
-    .package(url: "https://github.com/orchetect/SwiftRadix", from: "1.3.1"),
-    .package(url: "https://github.com/groue/Semaphore", from: "0.0.8"),
-    .package(url: "https://github.com/fumoboy007/swift-retry", from: "0.2.3"),
-    .package(url: "https://github.com/jozefizso/swift-xattr", from: "3.0.0"),
-    .package(url: "https://github.com/grpc/grpc-swift.git", .upToNextMajor(from: "1.27.0")),
-    .package(url: "https://buf.build/gen/swift/git/1.27.1-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_grpc_swift.git", branch: "main"),
-    .package(url: "https://github.com/open-telemetry/opentelemetry-swift", branch: "main"),
-    .package(url: "https://github.com/open-telemetry/opentelemetry-swift-core", from: "2.3.0"),
-
-  ],
-  targets: [
-    .executableTarget(name: "tart", dependencies: [
-      .product(name: "Algorithms", package: "swift-algorithms"),
-      .product(name: "ArgumentParser", package: "swift-argument-parser"),
-      .product(name: "Dynamic", package: "Dynamic"),
-      .product(name: "SwiftDate", package: "SwiftDate"),
-      .product(name: "Antlr4Static", package: "Antlr4"),
-      .product(name: "Atomics", package: "swift-atomics"),
-      .product(name: "TextTable", package: "TextTable"),
-      .product(name: "Sysctl", package: "swift-sysctl"),
-      .product(name: "SwiftRadix", package: "SwiftRadix"),
-      .product(name: "Semaphore", package: "Semaphore"),
-      .product(name: "DMRetry", package: "swift-retry"),
-      .product(name: "XAttr", package: "swift-xattr"),
-      .product(name: "GRPC", package: "grpc-swift"),
-      .product(name: "Cirruslabs_TartGuestAgent_Grpc_Swift", package: "cirruslabs_tart-guest-agent_grpc_swift"),
-      .product(name: "OpenTelemetryApi", package: "opentelemetry-swift-core"),
-      .product(name: "OpenTelemetrySdk", package: "opentelemetry-swift-core"),
-      .product(name: "OpenTelemetryProtocolExporterHTTP", package: "opentelemetry-swift"),
-      .product(name: "ResourceExtension", package: "opentelemetry-swift"),
-    ], exclude: [
-      "OCI/Reference/Makefile",
-      "OCI/Reference/Reference.g4",
-      "OCI/Reference/Generated/Reference.interp",
-      "OCI/Reference/Generated/Reference.tokens",
-      "OCI/Reference/Generated/ReferenceLexer.interp",
-      "OCI/Reference/Generated/ReferenceLexer.tokens",
-    ]),
-    .testTarget(name: "TartTests", dependencies: ["tart"])
-  ]
-)
@@ -1,74 +0,0 @@
-<img src="https://github.com/cirruslabs/tart/raw/main/Resources/TartSocial.png"/>
-
-*Tart* is a virtualization toolset to build, run and manage macOS and Linux virtual machines (VMs) on Apple Silicon.
-Built by CI engineers for your automation needs. Here are some highlights of Tart:
-
-* Tart uses Apple's own `Virtualization.Framework` for [near-native performance](https://browser.geekbench.com/v5/cpu/compare/20382844?baseline=20382722).
-* Push/Pull virtual machines from any OCI-compatible container registry.
-* Use Tart Packer Plugin to automate VM creation.
-* Easily integrates with any CI system.
-
-Tart powers [Cirrus Runners](https://cirrus-runners.app/)
-service — a drop-in replacement for the standard GitHub-hosted runners, offering 2-3 times better performance for a fraction of the price.
-
-<p align="center">
-  <a href="https://cirrus-runners.app/?utm_source=github&utm_medium=referral" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/CirrusRunnersForGHA.png" height="65"/>
-  </a>
-</p>
-
-Many companies are using Tart in their internal setups. Here are just a few of them:
-
-<p align="center">
-  <a href="https://atlassian.com/" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/Users/Atlassian.png" height="65"/>
-  </a>
-  <a href="https://www.figma.com/" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/Users/Figma.png" height="65"/>
-  </a>
-  <a href="https://mullvad.net/" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/Users/Mullvad.png" height="65"/>
-  </a>
-  <a href="https://krisp.ai/" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/Users/Krisp.png" height="65"/>
-  </a>
-  <a href="https://testingbot.com/" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/Users/TestingBot.png" height="65"/>
-  </a>
-  <a href="https://symflower.com/" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/Users/Symflower.png" height="65"/>
-  </a>
-  <a href="https://transloadit.com/" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/Users/Transloadit.png" height="65"/>
-  </a>
-  <a href="https://cirrus-ci.org/" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/Users/CirrusCI.png" height="65"/>
-  </a>
-  <a href="https://www.pitsdatarecovery.net/" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/Users/PITSGlobalDataRecoveryServices.png" height="65"/>
-  </a>
-  <a href="https://expo.dev/" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/Users/Expo.png" height="65"/>
-  </a>
-</p>
-
-**Note:** If your company or project is using Tart please consider [sharing with the community](https://github.com/cirruslabs/tart/discussions/857).
-
-<p align="center">
-  <a href="https://aws.amazon.com/marketplace/pp/prodview-qczco34wlkdws?utm_source=github&utm_medium=referral" target=_blank>
-    <img src="https://github.com/cirruslabs/tart/raw/main/Resources/AWSMarkeplaceLogo.png" height="90"/>
-  </a>
-</p>
-
-## Usage
-
-Try running a Tart VM on your Apple Silicon device running macOS 13.0 (Ventura) or later (will download a 25 GB image):
-
-```bash
-brew install cirruslabs/cli/tart
-tart clone ghcr.io/cirruslabs/macos-tahoe-base:latest tahoe-base
-tart run tahoe-base
-```
-
-Please check the [official documentation](https://tart.run) for more information and/or feel free to use [discussions](https://github.com/cirruslabs/tart/discussions)
-for remaining questions.
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleName</key>
-	<string>Tart</string>
-	<key>CFBundleDisplayName</key>
-	<string>Tart</string>
-	<key>CFBundleIdentifier</key>
-	<string>com.github.cirruslabs.tart</string>
-	<key>CFBundleExecutable</key>
-	<string>tart</string>
-	<key>CFBundlePackageType</key>
-	<string>APPL</string>
-	<key>LSApplicationCategoryType</key>
-	<string>public.app-category.developer-tools</string>
-	<key>CFBundleIconFile</key>
-	<string>UPW Tart</string>
-	<key>CFBundleIconName</key>
-	<string>UPW Tart</string>
-	<key>NSAppTransportSecurity</key>
-	<dict>
-		<key>NSAllowsArbitraryLoads</key>
-		<true/>
-	</dict>
-  <key>NSLocalNetworkUsageDescription</key>
-  <string>Access to OCI registries on the local network</string>
-</dict>
-</plist>
@@ -1,140 +0,0 @@
-{
-  "fill" : "automatic",
-  "groups" : [
-    {
-      "blend-mode" : "normal",
-      "blur-material" : 0.5,
-      "layers" : [
-        {
-          "hidden" : false,
-          "image-name-specializations" : [
-            {
-              "value" : "4.4-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L4.png"
-            }
-          ],
-          "name" : "UPW Tart L4"
-        }
-      ],
-      "opacity" : 1,
-      "shadow" : {
-        "kind" : "neutral",
-        "opacity" : 1
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    },
-    {
-      "layers" : [
-        {
-          "image-name-specializations" : [
-            {
-              "value" : "3.3-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L3.png"
-            }
-          ],
-          "name" : "UPW Tart L3",
-          "position-specializations" : [
-            {
-              "idiom" : "square",
-              "value" : {
-                "scale" : 1,
-                "translation-in-points" : [
-                  0,
-                  0
-                ]
-              }
-            }
-          ]
-        }
-      ],
-      "shadow" : {
-        "kind" : "none",
-        "opacity" : 1
-      },
-      "specular" : false,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    },
-    {
-      "blur-material" : null,
-      "layers" : [
-        {
-          "image-name-specializations" : [
-            {
-              "value" : "2.2-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L2.png"
-            }
-          ],
-          "name" : "UPW Tart L2"
-        }
-      ],
-      "position-specializations" : [
-        {
-          "idiom" : "square",
-          "value" : {
-            "scale" : 1,
-            "translation-in-points" : [
-              0,
-              0
-            ]
-          }
-        }
-      ],
-      "shadow" : {
-        "kind" : "none",
-        "opacity" : 1
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    },
-    {
-      "layers" : [
-        {
-          "image-name-specializations" : [
-            {
-              "value" : "1.1-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L1.png"
-            }
-          ],
-          "name" : "UPW Tart L1"
-        }
-      ],
-      "shadow" : {
-        "kind" : "layer-color",
-        "opacity" : 0.5
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    }
-  ],
-  "supported-platforms" : {
-    "circles" : [
-      "watchOS"
-    ],
-    "squares" : "shared"
-  }
-}
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleIconFile</key>
-	<string>UPW Tart</string>
-	<key>CFBundleIconName</key>
-	<string>UPW Tart</string>
-</dict>
-</plist>
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>com.apple.security.virtualization</key>
-	<true/>
-	<key>com.apple.security.get-task-allow</key>
-	<true/>
-</dict>
-</plist>
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>com.apple.security.virtualization</key>
-	<true/>
-	<key>com.apple.vm.networking</key>
-	<true/>
-</dict>
-</plist>
@@ -1,17 +0,0 @@
-struct CI {
-  private static let rawVersion = "${CIRRUS_TAG}"
-
-  static var version: String {
-    rawVersion.expanded() ? rawVersion : "SNAPSHOT"
-  }
-
-  static var release: String? {
-    rawVersion.expanded() ? "tart@\(rawVersion)" : nil
-  }
-}
-
-private extension String {
-  func expanded() -> Bool {
-    !isEmpty && !starts(with: "$")
-  }
-}
@@ -1,91 +0,0 @@
-import ArgumentParser
-import Foundation
-import SystemConfiguration
-
-struct Clone: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(
-    abstract: "Clone a VM",
-    discussion: """
-    Creates a local virtual machine by cloning either a remote or another local virtual machine.
-
-    Due to copy-on-write magic in Apple File System, a cloned VM won't actually claim all the space right away.
-    Only changes to a cloned disk will be written and claim new space. This also speeds up clones enormously.
-
-    By default, Tart checks available capacity in Tart's home directory and tries to reclaim minimum possible storage for the cloned image
-    to fit. This behaviour is called "automatic pruning" and can be disabled by setting TART_NO_AUTO_PRUNE environment variable.
-    """
-  )
-
-  @Argument(help: "source VM name", completion: .custom(completeMachines))
-  var sourceName: String
-
-  @Argument(help: "new VM name")
-  var newName: String
-
-  @Flag(help: "connect to the OCI registry via insecure HTTP protocol")
-  var insecure: Bool = false
-
-  @Option(help: "network concurrency to use when pulling a remote VM from the OCI-compatible registry")
-  var concurrency: UInt = 4
-
-  @Flag(help: .hidden)
-  var deduplicate: Bool = false
-
-  @Option(help: ArgumentHelp("limit automatic pruning to n gigabytes", valueName: "n"))
-  var pruneLimit: UInt = 100
-
-  func validate() throws {
-    if newName.contains("/") {
-      throw ValidationError("<new-name> should be a local name")
-    }
-
-    if concurrency < 1 {
-      throw ValidationError("network concurrency cannot be less than 1")
-    }
-  }
-
-  func run() async throws {
-    let ociStorage = try VMStorageOCI()
-    let localStorage = try VMStorageLocal()
-
-    if let remoteName = try? RemoteName(sourceName), !ociStorage.exists(remoteName) {
-      // Pull the VM in case it's OCI-based and doesn't exist locally yet
-      let registry = try Registry(host: remoteName.host, namespace: remoteName.namespace, insecure: insecure)
-      try await ociStorage.pull(remoteName, registry: registry, concurrency: concurrency, deduplicate: deduplicate)
-    }
-
-    let sourceVM = try VMStorageHelper.open(sourceName)
-    let tmpVMDir = try VMDirectory.temporary()
-
-    // Lock the temporary VM directory to prevent it's garbage collection
-    let tmpVMDirLock = try FileLock(lockURL: tmpVMDir.baseURL)
-    try tmpVMDirLock.lock()
-
-    try await withTaskCancellationHandler(operation: {
-      // Acquire a global lock
-      let lock = try FileLock(lockURL: Config().tartHomeDir)
-      try lock.lock()
-
-      let generateMAC = try localStorage.hasVMsWithMACAddress(macAddress: sourceVM.macAddress())
-        && sourceVM.state() != .Suspended
-      try sourceVM.clone(to: tmpVMDir, generateMAC: generateMAC)
-
-      try localStorage.move(newName, from: tmpVMDir)
-
-      try lock.unlock()
-
-      // APFS is doing copy-on-write, so the above cloning operation (just copying files on disk)
-      // is not actually claiming new space until the VM is started and it writes something to disk.
-      //
-      // So, once we clone the VM let's try to claim the rest of space for the VM to run without errors.
-      let unallocatedBytes = try sourceVM.sizeBytes() - sourceVM.allocatedSizeBytes()
-      // Avoid reclaiming an excessive amount of disk space.
-      let reclaimBytes = min(unallocatedBytes, Int(pruneLimit) * 1024 * 1024 * 1024)
-      if reclaimBytes > 0 {
-        try Prune.reclaimIfNeeded(UInt64(reclaimBytes), sourceVM)
-      }
-    }, onCancel: {
-      try? FileManager.default.removeItem(at: tmpVMDir.baseURL)
-    })
-  }
-}
@@ -1,82 +0,0 @@
-import ArgumentParser
-import Dispatch
-import Foundation
-import SwiftUI
-import Virtualization
-
-struct Create: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Create a VM")
-
-  @Argument(help: "VM name")
-  var name: String
-
-  @Option(help: ArgumentHelp("create a macOS VM using path to the IPSW file or URL (or \"latest\", to fetch the latest supported IPSW automatically)", valueName: "path"), completion: .file())
-  var fromIPSW: String?
-
-  @Flag(help: "create a Linux VM")
-  var linux: Bool = false
-
-  @Option(help: ArgumentHelp("Disk size in GB"))
-  var diskSize: UInt16 = 50
-
-  @Option(help: ArgumentHelp("Disk image format", discussion: "ASIF format provides better performance but requires macOS 26 Tahoe or later"))
-  var diskFormat: DiskImageFormat = .raw
-
-  func validate() throws {
-    if fromIPSW == nil && !linux {
-      throw ValidationError("Please specify either a --from-ipsw or --linux option!")
-    }
-    #if arch(x86_64)
-      if fromIPSW != nil {
-        throw ValidationError("Only Linux VMs are supported on Intel!")
-      }
-    #endif
-
-    // Validate disk format support
-    if !diskFormat.isSupported {
-      throw ValidationError("Disk format '\(diskFormat.rawValue)' is not supported on this system.")
-    }
-  }
-
-  func run() async throws {
-    let tmpVMDir = try VMDirectory.temporary()
-
-    // Lock the temporary VM directory to prevent it's garbage collection
-    let tmpVMDirLock = try FileLock(lockURL: tmpVMDir.baseURL)
-    try tmpVMDirLock.lock()
-
-    try await withTaskCancellationHandler(operation: {
-      #if arch(arm64)
-        if let fromIPSW = fromIPSW {
-          let ipswURL: URL
-
-          if fromIPSW == "latest" {
-            defaultLogger.appendNewLine("Looking up the latest supported IPSW...")
-
-            let image = try await withCheckedThrowingContinuation { continuation in
-              VZMacOSRestoreImage.fetchLatestSupported() { result in
-                continuation.resume(with: result)
-              }
-            }
-
-            ipswURL = image.url
-          } else if fromIPSW.starts(with: "http://") || fromIPSW.starts(with: "https://") {
-            ipswURL = URL(string: fromIPSW)!
-          } else {
-            ipswURL = URL(fileURLWithPath: NSString(string: fromIPSW).expandingTildeInPath)
-          }
-
-          _ = try await VM(vmDir: tmpVMDir, ipswURL: ipswURL, diskSizeGB: diskSize, diskFormat: diskFormat)
-        }
-      #endif
-
-      if linux {
-        _ = try await VM.linux(vmDir: tmpVMDir, diskSizeGB: diskSize, diskFormat: diskFormat)
-      }
-
-      try VMStorageLocal().move(name, from: tmpVMDir)
-    }, onCancel: {
-      try? FileManager.default.removeItem(at: tmpVMDir.baseURL)
-    })
-  }
-}
@@ -1,16 +0,0 @@
-import ArgumentParser
-import Dispatch
-import SwiftUI
-
-struct Delete: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Delete a VM")
-
-  @Argument(help: "VM name", completion: .custom(completeMachines))
-  var name: [String]
-
-  func run() async throws {
-    for it in name {
-      try VMStorageHelper.delete(it)
-    }
-  }
-}
@@ -1,233 +0,0 @@
-import ArgumentParser
-import Foundation
-import NIOPosix
-import GRPC
-import Cirruslabs_TartGuestAgent_Grpc_Swift
-
-struct ExecCustomExitCodeError: Error {
-  let exitCode: Int32
-}
-
-struct Exec: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Execute a command in a running VM", discussion: """
-  Requires Tart Guest Agent running in a guest VM.
-
-  Note that all non-vanilla Cirrus Labs VM images already have the Tart Guest Agent installed.
-  """)
-
-  @Flag(name: [.customShort("i")], help: "Attach host's standard input to a remote command")
-  var interactive: Bool = false
-
-  @Flag(name: [.customShort("t")], help: "Allocate a remote pseudo-terminal (PTY)")
-  var tty: Bool = false
-
-  @Argument(help: "VM name", completion: .custom(completeLocalMachines))
-  var name: String
-
-  @Argument(parsing: .captureForPassthrough, help: "Command to execute")
-  var command: [String]
-
-  func run() async throws {
-    // We only have withThrowingDiscardingTaskGroup available starting from macOS 14
-    if #unavailable(macOS 14) {
-      throw RuntimeError.Generic("\"tart exec\" is only available on macOS 14 (Sonoma) or newer")
-    }
-
-    // Open VM's directory
-    let vmDir = try VMStorageLocal().open(name)
-
-    // Ensure that the VM is running
-    if try !vmDir.running() {
-      throw RuntimeError.VMNotRunning(name)
-    }
-
-    // Create a gRPC channel connected to the VM's control socket
-    let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
-    defer {
-      try! group.syncShutdownGracefully()
-    }
-
-    // Change the current working directory to a VM's base directory
-    // to work around Unix domain socket 104 byte limitation [1]
-    //
-    // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
-    if let baseURL = vmDir.controlSocketURL.baseURL {
-      FileManager.default.changeCurrentDirectoryPath(baseURL.path())
-    }
-
-    let channel = try GRPCChannelPool.with(
-      target: .unixDomainSocket(vmDir.controlSocketURL.relativePath),
-      transportSecurity: .plaintext,
-      eventLoopGroup: group,
-    )
-    defer {
-      try! channel.close().wait()
-    }
-
-    // Switch controlling terminal into raw mode when remote pseudo-terminal is requested
-    var state: State? = nil
-
-    if tty && Term.IsTerminal() {
-      state = try Term.MakeRaw()
-    }
-    defer {
-      // Restore terminal to its initial state
-      if let state {
-        try! Term.Restore(state)
-      }
-    }
-
-    // Execute a command in a running VM
-    do {
-      try await execute(channel)
-    } catch let error as GRPCConnectionPoolError {
-      throw RuntimeError.Generic("Failed to connect to the VM using its control socket: \(error.localizedDescription), is the Tart Guest Agent running?")
-    }
-  }
-
-  private func execute(_ channel: GRPCChannel) async throws {
-    let agentAsyncClient = AgentAsyncClient(channel: channel)
-    let execCall = agentAsyncClient.makeExecCall()
-
-    try await execCall.requestStream.send(.with {
-      $0.type = .command(.with {
-        $0.name = command[0]
-        $0.args = Array(command.dropFirst(1))
-        $0.interactive = interactive
-        $0.tty = tty
-        if tty {
-          $0.terminalSize = .with {
-            let (width, height) = try! Term.GetSize()
-
-            $0.cols = UInt32(width)
-            $0.rows = UInt32(height)
-          }
-        }
-      })
-    })
-
-    // Process command events and optionally send our standard input and/or terminal dimensions
-    try await withThrowingTaskGroup { group in
-      // Stream host's standard input if interactive mode is enabled
-      if interactive {
-        let stdinStream = AsyncThrowingStream<Data, Error> { continuation in
-          let handle = FileHandle.standardInput
-
-          if isRegularFile(handle.fileDescriptor) {
-            // Standard input can be a regular file when input redirection (<) is used,
-            // in which case the handle won't receive any new readability events, so we
-            // just read the file normally here in chunks and consider done with it
-            //
-            // Ideally this is best handled by using non-blocking I/O, but Swift's
-            // standard library only offers inefficient bytes[1] property and SwiftNIO's
-            // NIOFileSystem doesn't seem to support opening raw file descriptors.
-            //
-            // [1]: https://developer.apple.com/documentation/foundation/filehandle/bytes
-            while true {
-              do {
-                let data = try handle.read(upToCount: 64 * 1024)
-                if let data = data {
-                  continuation.yield(data)
-                } else {
-                  continuation.finish()
-                  break
-                }
-              } catch (let error) {
-                continuation.finish(throwing: error)
-                break
-              }
-            }
-          } else {
-            handle.readabilityHandler = { handle in
-              let data = handle.availableData
-
-              if data.isEmpty {
-                continuation.finish()
-              } else {
-                continuation.yield(data)
-              }
-            }
-          }
-        }
-
-        group.addTask {
-          for try await stdinData in stdinStream {
-            try await execCall.requestStream.send(.with {
-              $0.type = .standardInput(.with {
-                $0.data = stdinData
-              })
-            })
-          }
-
-          // Signal EOF as we're done reading standard input
-          try await execCall.requestStream.send(.with {
-            $0.type = .standardInput(.with {
-              $0.data = Data()
-            })
-          })
-        }
-      }
-
-      // Stream host's terminal dimensions if pseudo-terminal is requested
-      signal(SIGWINCH, SIG_IGN)
-      let sigwinchSrc = DispatchSource.makeSignalSource(signal: SIGWINCH)
-      sigwinchSrc.activate()
-
-      if tty {
-        let terminalDimensionsStream = AsyncStream { continuation in
-          sigwinchSrc.setEventHandler {
-            continuation.yield(try! Term.GetSize())
-          }
-        }
-
-        group.addTask {
-          for await (width, height) in terminalDimensionsStream {
-            try await execCall.requestStream.send(.with {
-              $0.type = .terminalResize(.with {
-                $0.cols = UInt32(width)
-                $0.rows = UInt32(height)
-              })
-            })
-          }
-        }
-      }
-
-      // Process command events
-      group.addTask {
-        for try await response in execCall.responseStream {
-          switch response.type {
-          case .standardOutput(let ioChunk):
-            try FileHandle.standardOutput.write(contentsOf: ioChunk.data)
-          case .standardError(let ioChunk):
-            try FileHandle.standardError.write(contentsOf: ioChunk.data)
-          case .exit(let exit):
-            throw ExecCustomExitCodeError(exitCode: exit.code)
-          default:
-            // Unknown event, do nothing
-            continue
-          }
-        }
-      }
-
-      while !group.isEmpty {
-        do {
-          try await group.next()
-        } catch {
-          group.cancelAll()
-
-          throw error
-        }
-      }
-    }
-  }
-}
-
-private func isRegularFile(_ fileDescriptor: Int32) -> Bool {
-  var stat = stat()
-
-  if fstat(fileDescriptor, &stat) != 0 {
-    return false
-  }
-
-  return (stat.st_mode & S_IFMT) == S_IFREG
-}
@@ -1,44 +0,0 @@
-import ArgumentParser
-import Foundation
-
-struct Export: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Export VM to a compressed .tvm file")
-
-  @Argument(help: "Source VM name.", completion: .custom(completeMachines))
-  var name: String
-
-  @Argument(help: "Path to the destination file.", completion: .file())
-  var path: String?
-
-  func run() async throws {
-    let correctedPath: String
-
-    if let path = path {
-      correctedPath = path
-    } else {
-      correctedPath = "\(name).tvm"
-
-      if FileManager.default.fileExists(atPath: correctedPath) {
-        while true {
-          if userWantsOverwrite(correctedPath) {
-            break
-          } else {
-            return
-          }
-        }
-      }
-    }
-
-    print("exporting...")
-
-    try VMStorageHelper.open(name).exportToArchive(path: correctedPath)
-  }
-
-  func userWantsOverwrite(_ filename: String) -> Bool {
-    print("file \(filename) already exists, are you sure you want to overwrite it? (yes, [no])? ", terminator: "")
-
-    let answer = readLine()!
-
-    return answer == "yes"
-  }
-}
@@ -1,22 +0,0 @@
-import ArgumentParser
-import Foundation
-import SystemConfiguration
-
-struct FQN: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Get a fully-qualified VM name", shouldDisplay: false)
-
-  @Argument(help: "VM name", completion: .custom(completeMachines))
-  var name: String
-
-  func run() async throws {
-    if var remoteName = try? RemoteName(name) {
-      let digest = try VMStorageOCI().digest(remoteName)
-
-      remoteName.reference = Reference(digest: digest)
-
-      print(remoteName)
-    } else {
-      print(name)
-    }
-  }
-}
@@ -1,33 +0,0 @@
-import ArgumentParser
-import Foundation
-
-fileprivate struct VMInfo: Encodable {
-  let OS: OS
-  let CPU: Int
-  let Memory: UInt64
-  let Disk: Int
-  let DiskFormat: String
-  let Size: String
-  let Display: String
-  let Running: Bool
-  let State: String
-}
-
-struct Get: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(commandName: "get", abstract: "Get a VM's configuration")
-
-  @Argument(help: "VM name.", completion: .custom(completeLocalMachines))
-  var name: String
-
-  @Option(help: "Output format: text or json")
-  var format: Format = .text
-
-  func run() async throws {
-    let vmDir = try VMStorageLocal().open(name)
-    let vmConfig = try VMConfig(fromURL: vmDir.configURL)
-    let memorySizeInMb = vmConfig.memorySize / 1024 / 1024
-
-    let info = VMInfo(OS: vmConfig.os, CPU: vmConfig.cpuCount, Memory: memorySizeInMb, Disk: try vmDir.sizeGB(), DiskFormat: vmConfig.diskFormat.rawValue, Size: String(format: "%.3f", Float(try vmDir.allocatedSizeBytes()) / 1000 / 1000 / 1000), Display: vmConfig.display.description, Running: try vmDir.running(), State: try vmDir.state().rawValue)
-    print(format.renderSingle(info))
-  }
-}
@@ -1,90 +0,0 @@
-import ArgumentParser
-import Foundation
-import Network
-import SystemConfiguration
-
-enum IPResolutionStrategy: String, ExpressibleByArgument, CaseIterable {
-  case dhcp, arp, agent
-
-  private(set) static var allValueStrings: [String] = Self.allCases.map { "\($0)"}
-}
-
-struct IP: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Get VM's IP address")
-
-  @Argument(help: "VM name", completion: .custom(completeLocalMachines))
-  var name: String
-
-  @Option(help: "Number of seconds to wait for a potential VM booting")
-  var wait: UInt16 = 0
-
-  @Option(help: ArgumentHelp("Strategy for resolving IP address",
-                             discussion: """
-                             By default, Tart is using a "dhcp" resolver which parses the DHCP lease file on host and tries to find an entry containing the VM's MAC address. This method is fast and the most reliable, but only works for VMs are not using the bridged networking.\n
-                             Alternatively, Tart has an "arp" resolver which calls an external "arp" executable and parses it's output. This works for VMs using bridged networking and returns their IP, but when they generate enough network activity to populate the host's ARP table. Note that "arp" strategy won't work for VMs using the Softnet networking.\n
-                             A third strategy, "agent" works in all cases reliably, but requires Guest agent for Tart VMs (https://github.com/cirruslabs/tart-guest-agent) to be installed inside of a VM.
-                             """))
-  var resolver: IPResolutionStrategy = .dhcp
-
-  func run() async throws {
-    let vmDir = try VMStorageLocal().open(name)
-    let vmConfig = try VMConfig.init(fromURL: vmDir.configURL)
-    let vmMACAddress = MACAddress(fromString: vmConfig.macAddress.string)!
-
-    guard let ip = try await IP.resolveIP(vmMACAddress, resolutionStrategy: resolver, secondsToWait: wait, controlSocketURL: vmDir.controlSocketURL) else {
-      var message = "no IP address found"
-
-      if try !vmDir.running() {
-        message += ", is your VM running?"
-      }
-
-      if (resolver == .agent) {
-        message += " (also make sure that Guest agent for Tart is running inside of a VM)"
-      } else if (vmConfig.os == .linux && resolver == .arp) {
-        message += " (not all Linux distributions are compatible with the ARP resolver)"
-      }
-
-      throw RuntimeError.NoIPAddressFound(message)
-    }
-
-    print(ip)
-  }
-
-  static public func resolveIP(_ vmMACAddress: MACAddress, resolutionStrategy: IPResolutionStrategy = .dhcp, secondsToWait: UInt16 = 0, controlSocketURL: URL? = nil) async throws -> IPv4Address? {
-    let waitUntil = Calendar.current.date(byAdding: .second, value: Int(secondsToWait), to: Date.now)!
-
-    repeat {
-      switch resolutionStrategy {
-      case .arp:
-        if let ip = try ARPCache().ResolveMACAddress(macAddress: vmMACAddress) {
-          return ip
-        }
-      case .dhcp:
-        if let leases = try Leases(), let ip = leases.ResolveMACAddress(macAddress: vmMACAddress) {
-          return ip
-        }
-      case .agent:
-        guard let controlSocketURL = controlSocketURL else {
-          throw RuntimeError.Generic("Cannot perform IP resolution via Tart Guest Agent when control socket URL is not set")
-        }
-
-        // Change the current working directory to a VM's base directory
-        // to work around Unix domain socket 104 byte limitation [1]
-        //
-        // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
-        if let baseURL = controlSocketURL.baseURL {
-          FileManager.default.changeCurrentDirectoryPath(baseURL.path())
-        }
-
-        if let ip = try await AgentResolver.ResolveIP(controlSocketURL.relativePath) {
-          return ip
-        }
-      }
-
-      // wait a second
-      try await Task.sleep(nanoseconds: 1_000_000_000)
-    } while Date.now < waitUntil
-
-    return nil
-  }
-}
@@ -1,51 +0,0 @@
-import ArgumentParser
-import Foundation
-
-struct Import: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Import VM from a compressed .tvm file")
-
-  @Argument(help: "Path to a file created with \"tart export\".", completion: .file())
-  var path: String
-
-  @Argument(help: "Destination VM name.", completion: .custom(completeLocalMachines))
-  var name: String
-
-  func validate() throws {
-    if name.contains("/") {
-      throw ValidationError("<name> should be a local name")
-    }
-  }
-
-  func run() async throws {
-    let localStorage = try VMStorageLocal()
-
-    // Create a temporary VM directory to which we will load the export file
-    let tmpVMDir = try VMDirectory.temporary()
-
-    // Lock the temporary VM directory to prevent it's garbage collection
-    // while we're running
-    let tmpVMDirLock = try FileLock(lockURL: tmpVMDir.baseURL)
-    try tmpVMDirLock.lock()
-
-    // Populate the temporary VM directory with the export file contents
-    print("importing...")
-    try tmpVMDir.importFromArchive(path: path)
-
-    try await withTaskCancellationHandler(operation: {
-      // Acquire a global lock
-      let lock = try FileLock(lockURL: Config().tartHomeDir)
-      try lock.lock()
-
-      // Re-generate the VM's MAC address importing it will result in address collision
-      if try localStorage.hasVMsWithMACAddress(macAddress: tmpVMDir.macAddress()) {
-        try tmpVMDir.regenerateMACAddress()
-      }
-
-      try localStorage.move(name, from: tmpVMDir)
-
-      try lock.unlock()
-    }, onCancel: {
-      try? FileManager.default.removeItem(at: tmpVMDir.baseURL)
-    })
-  }
-}
@@ -1,92 +0,0 @@
-import ArgumentParser
-import Dispatch
-import SwiftUI
-
-fileprivate struct VMInfo: Encodable {
-  let Source: String
-  let Name: String
-  let Disk: Int
-  let Size: Int
-  let Accessed: String
-  let Running: Bool
-  let State: String
-}
-
-struct List: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "List created VMs")
-
-  @Option(help: ArgumentHelp("Only display VMs from the specified source (e.g. --source local, --source oci)."))
-  var source: String?
-
-  @Option(help: "Output format: text or json", completion: .list(["text", "json"]))
-  var format: Format = .text
-
-  @Flag(name: [.short, .long], help: ArgumentHelp("Only display VM names."))
-  var quiet: Bool = false
-
-  func validate() throws {
-    guard let source = source else {
-      return
-    }
-
-    if !["local", "oci"].contains(source) {
-      throw ValidationError("'\(source)' is not a valid <source>")
-    }
-  }
-
-  func run() async throws {
-    var infos: [VMInfo] = []
-
-    if source == nil || source == "local" {
-      infos += sortedInfos(try VMStorageLocal().list().map { (name, vmDir) in
-        try VMInfo(
-          Source: "local",
-          Name: name,
-          Disk: vmDir.sizeGB(),
-          Size: vmDir.allocatedSizeGB(),
-          Accessed: formatAccessDate(try vmDir.accessDate()),
-          Running: vmDir.running(),
-          State: vmDir.state().rawValue
-        )
-      })
-    }
-
-    if source == nil || source == "oci" {
-      infos += sortedInfos(try VMStorageOCI().list().map { (name, vmDir, _) in
-        try VMInfo(
-          Source: "OCI",
-          Name: name,
-          Disk: vmDir.sizeGB(),
-          Size: vmDir.allocatedSizeGB(),
-          Accessed: formatAccessDate(try vmDir.accessDate()),
-          Running: vmDir.running(),
-          State: vmDir.state().rawValue
-        )
-      })
-    }
-
-    if (quiet) {
-      for info in infos {
-        print(info.Name)
-      }
-    } else {
-      print(format.renderList(infos))
-    }
-  }
-
-  private func sortedInfos(_ infos: [VMInfo]) -> [VMInfo] {
-    infos.sorted(by: { left, right in left.Name < right.Name })
-  }
-
-  private func formatAccessDate(_ accessDate: Date) -> String {
-    switch format {
-    case .text:
-      let formatter = RelativeDateTimeFormatter()
-      formatter.unitsStyle = .full
-      return formatter.localizedString(for: accessDate, relativeTo: Date())
-    case .json:
-      let formatter = ISO8601DateFormatter()
-      return formatter.string(from: accessDate)
-    }
-  }
-}
@@ -1,82 +0,0 @@
-import ArgumentParser
-import Dispatch
-import SwiftUI
-
-struct Login: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Login to a registry")
-
-  @Argument(help: "host")
-  var host: String
-
-  @Option(help: "username")
-  var username: String?
-
-  @Flag(help: "password-stdin")
-  var passwordStdin: Bool = false
-
-  @Flag(help: "connect to the OCI registry via insecure HTTP protocol")
-  var insecure: Bool = false
-
-  @Flag(help: "skip validation of the registry's credentials before logging-in")
-  var noValidate: Bool = false
-
-  func validate() throws {
-    let usernameProvided = username != nil
-    let passwordProvided = passwordStdin
-
-    if usernameProvided != passwordProvided {
-      throw ValidationError("both --username and --password-stdin are required")
-    }
-  }
-
-  func run() async throws {
-    var user: String
-    var password: String
-
-    if let username = username {
-      user = username
-
-      let passwordData = FileHandle.standardInput.readDataToEndOfFile()
-      password = String(decoding: passwordData, as: UTF8.self)
-
-      // Support "echo $PASSWORD | tart login --username $USERNAME --password-stdin $REGISTRY"
-      password.trimSuffix { c in c.isNewline }
-    } else {
-      (user, password) = try StdinCredentials.retrieve()
-    }
-    let credentialsProvider = DictionaryCredentialsProvider([
-      host: (user, password)
-    ])
-
-    if !noValidate {
-      let registry = try Registry(host: host, namespace: "", insecure: insecure,
-                                  credentialsProviders: [credentialsProvider])
-
-      do {
-        try await registry.ping()
-      } catch {
-        throw RuntimeError.InvalidCredentials("invalid credentials: \(error)")
-      }
-    }
-
-    try KeychainCredentialsProvider().store(host: host, user: user, password: password)
-  }
-}
-
-fileprivate class DictionaryCredentialsProvider: CredentialsProvider {
-  let userFriendlyName = "static dictionary credentials provider"
-
-  var credentials: Dictionary<String, (String, String)>
-
-  init(_ credentials: Dictionary<String, (String, String)>) {
-    self.credentials = credentials
-  }
-
-  func retrieve(host: String) throws -> (String, String)? {
-    credentials[host]
-  }
-
-  func store(host: String, user: String, password: String) throws {
-    credentials[host] = (user, password)
-  }
-}
@@ -1,14 +0,0 @@
-import ArgumentParser
-import Dispatch
-import SwiftUI
-
-struct Logout: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Logout from a registry")
-
-  @Argument(help: "host")
-  var host: String
-
-  func run() async throws {
-    try KeychainCredentialsProvider().remove(host: host)
-  }
-}
@@ -1,190 +0,0 @@
-import ArgumentParser
-import Dispatch
-import OpenTelemetryApi
-import SwiftUI
-import SwiftDate
-
-struct Prune: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Prune OCI and IPSW caches or local VMs")
-
-  @Option(help: ArgumentHelp("Entries to remove: \"caches\" targets OCI and IPSW caches and \"vms\" targets local VMs."), completion: .list(["caches", "vms"]))
-  var entries: String = "caches"
-
-  @Option(help: ArgumentHelp("Remove entries that were last accessed more than n days ago",
-                             discussion: "For example, --older-than=7 will remove entries that weren't accessed by Tart in the last 7 days.",
-                             valueName: "n"))
-  var olderThan: UInt?
-
-  @Option(help: .hidden)
-  var cacheBudget: UInt?
-
-  @Option(help: ArgumentHelp("Remove the least recently used entries that do not fit the specified space size budget n, expressed in gigabytes",
-                             discussion: "For example, --space-budget=50 will effectively shrink all entries to a total size of 50 gigabytes.",
-                             valueName: "n"))
-  var spaceBudget: UInt?
-
-  @Flag(help: .hidden)
-  var gc: Bool = false
-
-  mutating func validate() throws {
-    // --cache-budget deprecation logic
-    if let cacheBudget = cacheBudget {
-      fputs("--cache-budget is deprecated, please use --space-budget\n", stderr)
-
-      if spaceBudget != nil {
-        throw ValidationError("--cache-budget is deprecated, please use --space-budget")
-      }
-
-      spaceBudget = cacheBudget
-    }
-
-    if olderThan == nil && spaceBudget == nil && !gc {
-      throw ValidationError("at least one pruning criteria must be specified")
-    }
-  }
-
-  func run() async throws {
-    if gc {
-      try VMStorageOCI().gc()
-    }
-
-    // Build a list of prunable storages that we're going to prune based on user's request
-    let prunableStorages: [PrunableStorage]
-
-    switch entries {
-    case "caches":
-      prunableStorages = [try VMStorageOCI(), try IPSWCache()]
-    case "vms":
-      prunableStorages = [try VMStorageLocal()]
-    default:
-      throw ValidationError("unsupported --entries value, please specify either \"caches\" or \"vms\"")
-    }
-
-    // Clean up cache entries based on last accessed date
-    if let olderThan = olderThan {
-      let olderThanInterval = Int(exactly: olderThan)!.days.timeInterval
-      let olderThanDate = Date() - olderThanInterval
-
-      try Prune.pruneOlderThan(prunableStorages: prunableStorages, olderThanDate: olderThanDate)
-    }
-
-    // Clean up cache entries based on imposed cache size limit and entry's last accessed date
-    if let spaceBudget = spaceBudget {
-      try Prune.pruneSpaceBudget(prunableStorages: prunableStorages, spaceBudgetBytes: UInt64(spaceBudget) * 1024 * 1024 * 1024)
-    }
-  }
-
-  static func pruneOlderThan(prunableStorages: [PrunableStorage], olderThanDate: Date) throws {
-    let prunables: [Prunable] = try prunableStorages.flatMap { try $0.prunables() }
-
-    try prunables.filter { try $0.accessDate() <= olderThanDate }.forEach { try $0.delete() }
-  }
-
-  static func pruneSpaceBudget(prunableStorages: [PrunableStorage], spaceBudgetBytes: UInt64) throws {
-    let prunables: [Prunable] = try prunableStorages
-      .flatMap { try $0.prunables() }
-      .sorted { try $0.accessDate() > $1.accessDate() }
-
-    var spaceBudgetBytes = spaceBudgetBytes
-    var prunablesToDelete: [Prunable] = []
-
-    for prunable in prunables {
-      let prunableSizeBytes = UInt64(try prunable.allocatedSizeBytes())
-
-      if prunableSizeBytes <= spaceBudgetBytes {
-        // Don't mark for deletion as
-        // there's a budget available
-        spaceBudgetBytes -= prunableSizeBytes
-      } else {
-        // Mark for deletion
-        prunablesToDelete.append(prunable)
-      }
-    }
-
-    try prunablesToDelete.forEach { try $0.delete() }
-  }
-
-  static func reclaimIfNeeded(_ requiredBytes: UInt64, _ initiator: Prunable? = nil) throws {
-    if ProcessInfo.processInfo.environment.keys.contains("TART_NO_AUTO_PRUNE") {
-      return
-    }
-
-    OpenTelemetry.instance.contextProvider.activeSpan?.setAttribute(
-      key: "prune.required-bytes",
-      value: .int(Int(requiredBytes))
-    )
-
-    // Figure out how much disk space is available
-    let attrs = try Config().tartCacheDir.resourceValues(forKeys: [
-      .volumeAvailableCapacityKey,
-      .volumeAvailableCapacityForImportantUsageKey
-    ])
-    let volumeAvailableCapacityCalculated = max(
-      UInt64(attrs.volumeAvailableCapacity!),
-      UInt64(attrs.volumeAvailableCapacityForImportantUsage!)
-    )
-
-    OpenTelemetry.instance.contextProvider.activeSpan?.setAttributes([
-      "prune.volume-available-capacity-bytes": .int(Int(attrs.volumeAvailableCapacity!)),
-      "prune.volume-available-capacity-for-important-usage-bytes": .int(Int(attrs.volumeAvailableCapacityForImportantUsage!)),
-      "prune.volume-available-capacity-calculated": .int(Int(volumeAvailableCapacityCalculated)),
-    ])
-
-    if volumeAvailableCapacityCalculated <= 0 {
-      OpenTelemetry.instance.contextProvider.activeSpan?.addEvent(name: "Zero volume capacity reported")
-
-      return
-    }
-
-    // Now that we know how much free space is left,
-    // check if we even need to reclaim anything
-    if requiredBytes < volumeAvailableCapacityCalculated {
-      return
-    }
-
-    try Prune.reclaimIfPossible(requiredBytes - volumeAvailableCapacityCalculated, initiator)
-  }
-
-  private static func reclaimIfPossible(_ reclaimBytes: UInt64, _ initiator: Prunable? = nil) throws {
-    let span = OTel.shared.tracer.spanBuilder(spanName: "prune").startSpan()
-    defer { span.end() }
-
-    let prunableStorages: [PrunableStorage] = [try VMStorageOCI(), try IPSWCache()]
-    let prunables: [Prunable] = try prunableStorages
-      .flatMap { try $0.prunables() }
-      .sorted { try $0.accessDate() < $1.accessDate() }
-
-    // Does it even make sense to start?
-    let cacheUsedBytes = try prunables.map { try $0.allocatedSizeBytes() }.reduce(0, +)
-    if cacheUsedBytes < reclaimBytes {
-      return
-    }
-
-    var cacheReclaimedBytes: Int = 0
-
-    var it = prunables.makeIterator()
-
-    while cacheReclaimedBytes <= reclaimBytes {
-      guard let prunable = it.next() else {
-        break
-      }
-
-      if prunable.url == initiator?.url.resolvingSymlinksInPath() {
-        // do not prune the initiator
-        continue
-      }
-
-      let allocatedSizeBytes = try prunable.allocatedSizeBytes()
-
-      OpenTelemetry.instance.contextProvider.activeSpan?
-        .addEvent(name: "Pruned \(allocatedSizeBytes) bytes for \(prunable.url.path)")
-
-      cacheReclaimedBytes += allocatedSizeBytes
-
-      try prunable.delete()
-    }
-
-    OpenTelemetry.instance.contextProvider.activeSpan?
-      .addEvent(name: "Reclaimed \(cacheReclaimedBytes) bytes")
-  }
-}
@@ -1,51 +0,0 @@
-import ArgumentParser
-import Dispatch
-import SwiftUI
-
-struct Pull: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(
-    abstract: "Pull a VM from a registry",
-    discussion: """
-    Pulls a virtual machine from a remote OCI-compatible registry. Supports authorization via Keychain (see "tart login --help"),
-    Docker credential helpers defined in ~/.docker/config.json or via TART_REGISTRY_USERNAME/TART_REGISTRY_PASSWORD environment variables.
-
-    By default, Tart checks available capacity in Tart's home directory and tries to reclaim minimum possible storage for the remote image
-    to fit. This behaviour is called "automatic pruning" and can be disabled by setting TART_NO_AUTO_PRUNE environment variable.
-    """
-  )
-
-  @Argument(help: "remote VM name")
-  var remoteName: String
-
-  @Flag(help: "connect to the OCI registry via insecure HTTP protocol")
-  var insecure: Bool = false
-
-  @Option(help: "network concurrency to use when pulling a remote VM from the OCI-compatible registry")
-  var concurrency: UInt = 4
-
-  @Flag(help: .hidden)
-  var deduplicate: Bool = false
-
-  func validate() throws {
-    if concurrency < 1 {
-      throw ValidationError("network concurrency cannot be less than 1")
-    }
-  }
-
-  func run() async throws {
-    // Be more liberal when accepting local image as argument,
-    // see https://github.com/cirruslabs/tart/issues/36
-    if try VMStorageLocal().exists(remoteName) {
-      print("\"\(remoteName)\" is a local image, nothing to pull here!")
-
-      return
-    }
-
-    let remoteName = try RemoteName(remoteName)
-    let registry = try Registry(host: remoteName.host, namespace: remoteName.namespace, insecure: insecure)
-
-    defaultLogger.appendNewLine("pulling \(remoteName)...")
-
-    try await VMStorageOCI().pull(remoteName, registry: registry, concurrency: concurrency, deduplicate: deduplicate)
-  }
-}
@@ -1,154 +0,0 @@
-import ArgumentParser
-import Dispatch
-import Foundation
-import Compression
-
-struct Push: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Push a VM to a registry")
-
-  @Argument(help: "local or remote VM name", completion: .custom(completeMachines))
-  var localName: String
-
-  @Argument(help: "remote VM name(s)")
-  var remoteNames: [String]
-
-  @Flag(help: "connect to the OCI registry via insecure HTTP protocol")
-  var insecure: Bool = false
-
-  @Option(help: "network concurrency to use when pushing a local VM to the OCI-compatible registry")
-  var concurrency: UInt = 4
-
-  @Option(help: ArgumentHelp("chunk size in MB if registry supports chunked uploads",
-                             discussion: """
-                             By default monolithic method is used for uploading blobs to the registry but some registries support a more efficient chunked method.
-                             For example, AWS Elastic Container Registry supports only chunks larger than 5MB but GitHub Container Registry supports only chunks smaller than 4MB. Google Container Registry on the other hand doesn't support chunked uploads at all.
-                             Please refer to the documentation of your particular registry in order to see if this option is suitable for you and what's the recommended chunk size.
-                             """))
-  var chunkSize: Int = 0
-
-
-  @Option(name: [.customLong("label")], help: ArgumentHelp("additional metadata to attach to the OCI image configuration in key=value format",
-                                                           discussion: "Can be specified multiple times to attach multiple labels."))
-  var labels: [String] = []
-
-  @Flag(help: ArgumentHelp("cache pushed images locally",
-                           discussion: "Increases disk usage, but saves time if you're going to pull the pushed images later."))
-  var populateCache: Bool = false
-
-  func run() async throws {
-    let ociStorage = try VMStorageOCI()
-    let localVMDir = try VMStorageHelper.open(localName)
-    let lock = try localVMDir.lock()
-    if try !lock.trylock() {
-      throw RuntimeError.VMIsRunning(localName)
-    }
-
-    // Parse remote names supplied by the user
-    let remoteNames = try remoteNames.map{
-      try RemoteName($0)
-    }
-
-    // Group remote names by registry
-    struct RegistryIdentifier: Hashable, Equatable {
-      var host: String
-      var namespace: String
-    }
-
-    let registryGroups = Dictionary(grouping: remoteNames, by: {
-      RegistryIdentifier(host: $0.host, namespace: $0.namespace)
-    })
-
-    // Push VM
-    for (registryIdentifier, remoteNamesForRegistry) in registryGroups {
-      let registry = try Registry(host: registryIdentifier.host, namespace: registryIdentifier.namespace,
-                                  insecure: insecure)
-
-      defaultLogger.appendNewLine("pushing \(localName) to "
-        + "\(registryIdentifier.host)/\(registryIdentifier.namespace)\(remoteNamesForRegistry.referenceNames())...")
-
-      let references = remoteNamesForRegistry.map{ $0.reference.value }
-
-      let pushedRemoteName: RemoteName
-      // If we're pushing a local OCI VM, check if points to an already existing registry manifest
-      // and if so, only upload manifests (without config, disk and NVRAM) to the user-specified references
-      if let remoteName = try? RemoteName(localName) {
-        pushedRemoteName = try await lightweightPushToRegistry(
-          registry: registry, 
-          remoteName: remoteName,
-          references: references
-        )
-      } else {
-        pushedRemoteName = try await localVMDir.pushToRegistry(
-          registry: registry,
-          references: references,
-          chunkSizeMb: chunkSize,
-          concurrency: concurrency,
-          labels: parseLabels()
-        )
-        // Populate the local cache (if requested)
-        if populateCache {
-          let expectedPushedVMDir = try ociStorage.create(pushedRemoteName)
-          try localVMDir.clone(to: expectedPushedVMDir, generateMAC: false)
-        }
-      }
-
-      // link the rest remote names
-      if populateCache {
-        for remoteName in remoteNamesForRegistry {
-          try ociStorage.link(from: remoteName, to: pushedRemoteName)
-        }
-      }
-    }
-  }
-
-  func lightweightPushToRegistry(registry: Registry, remoteName: RemoteName, references: [String]) async throws -> RemoteName {
-    // Is the local OCI VM already present in the registry?
-    let digest = try VMStorageOCI().digest(remoteName)
-
-    let (remoteManifest, _) = try await registry.pullManifest(reference: digest)
-
-    // Overwrite registry's references with the retrieved manifest
-    for reference in references {
-      defaultLogger.appendNewLine("pushing manifest for \(reference)...")
-
-      _ = try await registry.pushManifest(reference: reference, manifest: remoteManifest)
-    }
-
-    return RemoteName(host: registry.host!, namespace: registry.namespace,
-                      reference: Reference(digest: digest))
-  }
-
-  // Helper method to convert labels array to dictionary
-  func parseLabels() -> [String: String] {
-    var result = [String: String]()
-
-    for label in labels {
-      let parts = label.trimmingCharacters(in: .whitespaces).split(separator: "=", maxSplits: 1, omittingEmptySubsequences: false)
-
-      let key = parts.count > 0 ? String(parts[0]) : ""
-      let value = parts.count > 1 ? String(parts[1]) : ""
-
-      // It sometimes makes sense to provide an empty value,
-      // but not an empty key
-      if key.isEmpty {
-        continue
-      }
-
-      result[key] = value
-    }
-
-    return result
-  }  
-}
-
-extension Collection where Element == RemoteName {
-  func referenceNames() -> String {
-    let references = self.map{ $0.reference.fullyQualified }
-
-    switch count {
-    case 0: return "∅"
-    case 1: return references.first!
-    default: return "{" + references.joined(separator: ",") + "}"
-    }
-  }
-}
@@ -1,32 +0,0 @@
-import ArgumentParser
-import Foundation
-
-struct Rename: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Rename a local VM")
-
-  @Argument(help: "VM name", completion: .custom(completeLocalMachines))
-  var name: String
-
-  @Argument(help: "new VM name")
-  var newName: String
-
-  func validate() throws {
-    if newName.contains("/") {
-      throw ValidationError("<new-name> should be a local name")
-    }
-  }
-
-  func run() async throws {
-    let localStorage = try VMStorageLocal()
-
-    if !localStorage.exists(name) {
-      throw ValidationError("failed to rename a non-existent local VM: \(name)")
-    }
-
-    if localStorage.exists(newName) {
-      throw ValidationError("failed to rename VM \(name), target VM \(newName) already exists, delete it first!")
-    }
-
-    try localStorage.rename(name, newName)
-  }
-}
@@ -1,112 +0,0 @@
-import ArgumentParser
-import Foundation
-import Virtualization
-
-struct Set: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(commandName: "set", abstract: "Modify VM's configuration")
-
-  @Argument(help: "VM name", completion: .custom(completeLocalMachines))
-  var name: String
-
-  @Option(help: "Number of VM CPUs")
-  var cpu: UInt16?
-
-  @Option(help: "VM memory size in megabytes")
-  var memory: UInt64?
-
-  @Option(help: "VM display resolution in a format of WIDTHxHEIGHT[pt|px]. For example, 1200x800, 1200x800pt or 1920x1080px. Units are treated as hints and default to \"pt\" (points) for macOS VMs and \"px\" (pixels) for Linux VMs when not specified.")
-  var display: VMDisplayConfig?
-
-  @Flag(inversion: .prefixedNo, help: ArgumentHelp("Whether to automatically reconfigure the VM's display to fit the window"))
-  var displayRefit: Bool? = nil
-
-  @Flag(help: ArgumentHelp("Generate a new random MAC address for the VM."))
-  var randomMAC: Bool = false
-
-  #if arch(arm64)
-    @Flag(help: ArgumentHelp("Generate a new random serial number for the macOS VM."))
-  #endif
-  var randomSerial: Bool = false
-
-  @Option(help: ArgumentHelp("Replace the VM's disk contents with the disk contents at path.", valueName: "path"))
-  var disk: String?
-
-  @Option(help: ArgumentHelp("Resize the VMs disk to the specified size in GB (note that the disk size can only be increased to avoid losing data)",
-                             discussion: """
-                             See https://tart.run/faq/#disk-resizing for more details.
-                             """))
-  var diskSize: UInt16?
-
-  func run() async throws {
-    let vmDir = try VMStorageLocal().open(name)
-    var vmConfig = try VMConfig(fromURL: vmDir.configURL)
-
-    if let cpu = cpu {
-      try vmConfig.setCPU(cpuCount: Int(cpu))
-    }
-
-    if let memory = memory {
-      try vmConfig.setMemory(memorySize: memory * 1024 * 1024)
-    }
-
-    if let display = display {
-      if (display.width > 0) {
-        vmConfig.display.width = display.width
-      }
-      if (display.height > 0) {
-        vmConfig.display.height = display.height
-      }
-      vmConfig.display.unit = display.unit
-    }
-
-    vmConfig.displayRefit = displayRefit
-
-    if randomMAC {
-      vmConfig.macAddress = VZMACAddress.randomLocallyAdministered()
-    }
-
-    #if arch(arm64)
-      if randomSerial, let oldPlatform = vmConfig.platform as? Darwin {
-        vmConfig.platform = Darwin(ecid: VZMacMachineIdentifier(), hardwareModel: oldPlatform.hardwareModel)
-      }
-    #endif
-
-    try vmConfig.save(toURL: vmDir.configURL)
-
-    if let disk = disk {
-      let temporaryDiskURL = try Config().tartTmpDir.appendingPathComponent("set-disk-\(UUID().uuidString)")
-
-      try FileManager.default.copyItem(atPath: disk, toPath: temporaryDiskURL.path())
-
-      _ = try FileManager.default.replaceItemAt(vmDir.diskURL, withItemAt: temporaryDiskURL)
-    }
-
-    if diskSize != nil {
-      try vmDir.resizeDisk(diskSize!)
-    }
-  }
-}
-
-extension VMDisplayConfig: ExpressibleByArgument {
-  public init(argument: String) {
-    var argument = argument
-    var unit: Unit? = nil
-
-    if argument.hasSuffix(Unit.pixel.rawValue) {
-      argument = String(argument.dropLast(Unit.pixel.rawValue.count))
-      unit = Unit.pixel
-    } else if argument.hasSuffix(Unit.point.rawValue) {
-      argument = String(argument.dropLast(Unit.point.rawValue.count))
-      unit = Unit.point
-    }
-
-    let parts = argument.components(separatedBy: "x").map {
-      Int($0) ?? 0
-    }
-    self = VMDisplayConfig(
-      width: parts[safe: 0] ?? 0,
-      height: parts[safe: 1] ?? 0,
-      unit: unit,
-    )
-  }
-}
@@ -1,75 +0,0 @@
-import ArgumentParser
-import Foundation
-import System
-import SwiftDate
-
-struct Stop: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(commandName: "stop", abstract: "Stop a VM")
-
-  @Argument(help: "VM name", completion: .custom(completeRunningMachines))
-  var name: String
-
-  @Option(name: [.short, .long], help: "Seconds to wait for graceful termination before forcefully terminating the VM")
-  var timeout: UInt64 = 30
-
-  func run() async throws {
-    let vmDir = try VMStorageLocal().open(name)
-    switch try vmDir.state() {
-    case .Suspended:
-      try stopSuspended(vmDir)
-    case .Running:
-      try await stopRunning(vmDir)
-    case .Stopped:
-      throw RuntimeError.VMNotRunning(name)
-    }
-  }
-
-  func stopSuspended(_ vmDir: VMDirectory) throws {
-    try? FileManager.default.removeItem(at: vmDir.stateURL)
-  }
-
-  func stopRunning(_ vmDir: VMDirectory) async throws {
-    let lock = try vmDir.lock()
-
-    // Find the VM's PID
-    var pid = try lock.pid()
-    if pid == 0 {
-      throw RuntimeError.VMNotRunning(name)
-    }
-
-    // Try to gracefully terminate the VM
-    //
-    // Note that we don't check the return code here
-    // to provide a clean exit from "tart stop" in cases
-    // when the VM is already shutting down and we hit
-    // a race condition.
-    //
-    // We check the return code in the kill(2) below, though,
-    // because it's a less common scenario and it would be
-    // nice to know for the user that we've tried all methods
-    // and failed to shutdown the VM.
-    kill(pid, SIGINT)
-
-    // Ensure that the VM has terminated
-    var gracefulWaitDuration = Measurement(value: Double(timeout), unit: UnitDuration.seconds)
-    let gracefulTickDuration = Measurement(value: Double(100), unit: UnitDuration.milliseconds)
-
-    while gracefulWaitDuration.value > 0 {
-      pid = try lock.pid()
-      if pid == 0 {
-        return
-      }
-
-      try await Task.sleep(nanoseconds: UInt64(gracefulTickDuration.converted(to: .nanoseconds).value))
-      gracefulWaitDuration = gracefulWaitDuration - gracefulTickDuration
-    }
-
-    // Seems that VM is still running, proceed with forceful termination
-    let ret = kill(pid, SIGKILL)
-    if ret != 0 {
-      let details = Errno(rawValue: CInt(errno))
-
-      throw RuntimeError.VMTerminationFailed("failed to forcefully terminate the VM \"\(name)\": \(details)")
-    }
-  }
-}
@@ -1,28 +0,0 @@
-import ArgumentParser
-import Foundation
-import System
-import SwiftDate
-
-struct Suspend: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(commandName: "suspend", abstract: "Suspend a VM")
-
-  @Argument(help: "VM name", completion: .custom(completeRunningMachines))
-  var name: String
-
-  func run() async throws {
-    let vmDir = try VMStorageLocal().open(name)
-    let lock = try vmDir.lock()
-
-    // Find the VM's PID
-    let pid = try lock.pid()
-    if pid == 0 {
-      throw RuntimeError.VMNotRunning("VM \"\(name)\" is not running")
-    }
-
-    // Tell the "tart run" process to suspend the VM
-    let ret = kill(pid, SIGUSR1)
-    if ret != 0 {
-      throw RuntimeError.SuspendFailed("failed to send SIGUSR1 signal to the \"tart run\" process running VM \"\(name)\"")
-    }
-  }
-}
@@ -1,73 +0,0 @@
-import Foundation
-
-struct Config {
-  let tartHomeDir: URL
-  let tartCacheDir: URL
-  let tartTmpDir: URL
-
-  init() throws {
-    var tartHomeDir: URL
-
-    if let customTartHome = ProcessInfo.processInfo.environment["TART_HOME"] {
-      tartHomeDir = URL(fileURLWithPath: customTartHome, isDirectory: true)
-      try Self.validateTartHome(url: tartHomeDir)
-    } else {
-      tartHomeDir = FileManager.default
-        .homeDirectoryForCurrentUser
-        .appendingPathComponent(".tart", isDirectory: true)
-    }
-    self.tartHomeDir = tartHomeDir
-
-    tartCacheDir = tartHomeDir.appendingPathComponent("cache", isDirectory: true)
-    try FileManager.default.createDirectory(at: tartCacheDir, withIntermediateDirectories: true)
-
-    tartTmpDir = tartHomeDir.appendingPathComponent("tmp", isDirectory: true)
-    try FileManager.default.createDirectory(at: tartTmpDir, withIntermediateDirectories: true)
-  }
-
-  func gc() throws {
-    for entry in try FileManager.default.contentsOfDirectory(at: tartTmpDir,
-                                                             includingPropertiesForKeys: [], options: []) {
-      let lock = try FileLock(lockURL: entry)
-      if try !lock.trylock() {
-        continue
-      }
-
-      try FileManager.default.removeItem(at: entry)
-
-      try lock.unlock()
-    }
-  }
-
-  static func jsonEncoder() -> JSONEncoder {
-    let encoder = JSONEncoder()
-
-    encoder.outputFormatting = [.sortedKeys]
-
-    return encoder
-  }
-
-  static func jsonDecoder() -> JSONDecoder {
-    JSONDecoder()
-  }
-
-  private static func validateTartHome(url: URL) throws {
-    let urlComponents = url.pathComponents
-
-    let descendingURLs = urlComponents.indices.map { i in
-      URL(fileURLWithPath: urlComponents[0...i].joined(separator: "/"))
-    }
-
-    for descendingURL in descendingURLs {
-      if FileManager.default.fileExists(atPath: descendingURL.path) {
-        continue
-      }
-
-      do {
-        try FileManager.default.createDirectory(at: descendingURL, withIntermediateDirectories: false)
-      } catch {
-        throw RuntimeError.Generic("TART_HOME is invalid: \(descendingURL.path) does not exist, yet we can't create it: \(error.localizedDescription)")
-      }
-    }
-  }
-}
@@ -1,97 +0,0 @@
-import Foundation
-import Network
-import os.log
-import NIO
-import NIOPosix
-
-@available(macOS 14, *)
-class ControlSocket {
-  let controlSocketURL: URL
-  let vmPort: UInt32
-  let eventLoopGroup = MultiThreadedEventLoopGroup(numberOfThreads: 1)
-  let logger: os.Logger = os.Logger(subsystem: "org.cirruslabs.tart.control-socket", category: "network")
-
-  init(_ controlSocketURL: URL, vmPort: UInt32 = 8080) {
-    self.controlSocketURL = controlSocketURL
-    self.vmPort = vmPort
-  }
-
-  func run() async throws {
-    // Remove control socket file from previous "tart run" invocations,
-    // if any, otherwise we may get the "address already in use" error
-    try? FileManager.default.removeItem(atPath: controlSocketURL.path())
-
-    // Change the current working directory to a VM's base directory
-    // to work around Unix domain socket 104 byte limitation [1]
-    //
-    // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
-    if let baseURL = controlSocketURL.baseURL {
-      FileManager.default.changeCurrentDirectoryPath(baseURL.path())
-    }
-
-    let serverChannel = try await ServerBootstrap(group: eventLoopGroup)
-      .bind(unixDomainSocketPath: controlSocketURL.relativePath) { childChannel in
-        childChannel.eventLoop.makeCompletedFuture {
-          return try NIOAsyncChannel<ByteBuffer, ByteBuffer>(
-            wrappingChannelSynchronously: childChannel
-          )
-        }
-      }
-
-    try await withThrowingDiscardingTaskGroup { group in
-      try await serverChannel.executeThenClose { serverInbound in
-        for try await clientChannel in serverInbound {
-          group.addTask {
-            try await self.handleClient(clientChannel)
-          }
-        }
-      }
-    }
-  }
-
-  func handleClient(_ clientChannel: NIOAsyncChannel<ByteBuffer, ByteBuffer>) async throws {
-    self.logger.info("received new control socket connection from a client")
-
-    try await clientChannel.executeThenClose { clientInbound, clientOutbound in
-      self.logger.info("dialing to VM on port \(self.vmPort)...")
-
-      do {
-        guard let vmConnection = try await vm?.connect(toPort: self.vmPort) else {
-          throw RuntimeError.VMSocketFailed(self.vmPort, "VM is not running")
-        }
-
-        self.logger.info("running control socket proxy")
-
-        let vmChannel = try await ClientBootstrap(group: eventLoopGroup).withConnectedSocket(vmConnection.fileDescriptor) { childChannel in
-          childChannel.eventLoop.makeCompletedFuture {
-            try NIOAsyncChannel<ByteBuffer, ByteBuffer>(
-              wrappingChannelSynchronously: childChannel
-            )
-          }
-        }
-
-        try await vmChannel.executeThenClose { (vmInbound, vmOutbound) in
-          try await withThrowingDiscardingTaskGroup { group in
-            // Proxy data from a client (e.g. "tart exec") to a VM
-            group.addTask {
-              for try await message in clientInbound {
-                try await vmOutbound.write(message)
-              }
-            }
-
-            // Proxy data from a VM to a client (e.g. "tart exec")
-            group.addTask {
-              for try await message in vmInbound {
-                try await clientOutbound.write(message)
-              }
-            }
-          }
-        }
-
-        self.logger.info("control socket client disconnected")
-      } catch (let error) {
-        self.logger.error("control socket connection failed: \(error)")
-      }
-    }
-  }
-}
@@ -1,11 +0,0 @@
-import Foundation
-
-enum CredentialsProviderError: Error {
-  case Failed(message: String)
-}
-
-protocol CredentialsProvider {
-  var userFriendlyName: String { get }
-  func retrieve(host: String) throws -> (String, String)?
-  func store(host: String, user: String, password: String) throws
-}
@@ -1,120 +0,0 @@
-import Foundation
-
-class DockerConfigCredentialsProvider: CredentialsProvider {
-  let userFriendlyName = "Docker configuration credentials provider"
-
-  func retrieve(host: String) throws -> (String, String)? {
-    let dockerConfigURL = FileManager.default.homeDirectoryForCurrentUser.appendingPathComponent(".docker").appendingPathComponent("config.json")
-    if !FileManager.default.fileExists(atPath: dockerConfigURL.path) {
-      return nil
-    }
-    let config = try JSONDecoder().decode(DockerConfig.self, from: Data(contentsOf: dockerConfigURL))
-
-    if let credentialsFromAuth = config.auths?[host]?.decodeCredentials() {
-      return credentialsFromAuth
-    }
-    if let helperProgram = try config.findCredHelper(host: host) {
-      return try executeHelper(binaryName: "docker-credential-\(helperProgram)", host: host)
-    }
-
-    return nil
-  }
-
-  private func executeHelper(binaryName: String, host: String) throws -> (String, String)? {
-    guard let executableURL = resolveBinaryPath(binaryName) else {
-      throw CredentialsProviderError.Failed(message: "\(binaryName) not found in PATH")
-    }
-
-    let process = Process.init()
-    process.executableURL = executableURL
-    process.arguments = ["get"]
-
-    let outPipe = Pipe()
-    let inPipe = Pipe()
-
-    process.standardOutput = outPipe
-    process.standardError = outPipe
-    process.standardInput = inPipe
-
-    process.launch()
-
-    do {
-      try inPipe.fileHandleForWriting.write(contentsOf: "\(host)\n".data(using: .utf8)!)
-    } catch {
-      throw CredentialsProviderError.Failed(message: "Failed to write host to Docker helper!")
-    }
-    inPipe.fileHandleForWriting.closeFile()
-
-    let outputData = try outPipe.fileHandleForReading.readToEnd()
-
-    process.waitUntilExit()
-
-    if !(process.terminationReason == .exit && process.terminationStatus == 0) {
-      if let outputData = outputData {
-        print(String(decoding: outputData, as: UTF8.self))
-      }
-      throw CredentialsProviderError.Failed(message: "Docker helper failed!")
-    }
-    if outputData == nil || outputData?.count == 0 {
-      throw CredentialsProviderError.Failed(message: "Docker helper output is empty!")
-    }
-
-    let getOutput = try JSONDecoder().decode(DockerGetOutput.self, from: outputData!)
-    return (getOutput.Username, getOutput.Secret)
-  }
-
-  func store(host: String, user: String, password: String) throws {
-    throw CredentialsProviderError.Failed(message: "Docker helpers don't support storing!")
-  }
-}
-
-struct DockerConfig: Codable {
-  var auths: Dictionary<String, DockerAuthConfig>? = Dictionary()
-  var credHelpers: Dictionary<String, String>? = Dictionary()
-
-  func findCredHelper(host: String) throws -> String? {
-    // Tart supports wildcards in credHelpers
-    // Similar to what is requested from Docker: https://github.com/docker/cli/issues/2928
-
-    guard let credHelpers else {
-      return nil
-    }
-
-    for (hostPattern, helperProgram) in credHelpers {
-      if (hostPattern == host) {
-        return helperProgram
-      }
-      let compiledPattern = try? Regex(hostPattern)
-      if (try compiledPattern?.wholeMatch(in: host) != nil) {
-        return helperProgram
-      }
-    }
-    return nil
-  }
-}
-
-struct DockerAuthConfig: Codable {
-  var auth: String? = nil
-
-  func decodeCredentials() -> (String, String)? {
-    // auth is a base64("username:password")
-    guard let authBase64 = auth else {
-      return nil
-    }
-    guard let data = Data(base64Encoded: authBase64) else {
-      return nil
-    }
-    guard let components = String(data: data, encoding: .utf8)?.components(separatedBy: ":") else {
-      return nil
-    }
-    if components.count != 2 {
-      return nil
-    }
-    return (components[0], components[1])
-  }
-}
-
-struct DockerGetOutput: Codable {
-  var Username: String
-  var Secret: String
-}
@@ -1,22 +0,0 @@
-import Foundation
-
-class EnvironmentCredentialsProvider: CredentialsProvider {
-  let userFriendlyName = "environment variable credentials provider"
-
-  func retrieve(host: String) throws -> (String, String)? {
-    if let tartRegistryHostname = ProcessInfo.processInfo.environment["TART_REGISTRY_HOSTNAME"],
-       tartRegistryHostname != host {
-      return nil
-    }
-
-    let username = ProcessInfo.processInfo.environment["TART_REGISTRY_USERNAME"]
-    let password = ProcessInfo.processInfo.environment["TART_REGISTRY_PASSWORD"]
-    if let username = username, let password = password {
-      return (username, password)
-    }
-    return nil
-  }
-
-  func store(host: String, user: String, password: String) throws {
-  }
-}
@@ -1,90 +0,0 @@
-import Foundation
-
-class KeychainCredentialsProvider: CredentialsProvider {
-  let userFriendlyName = "Keychain credentials provider"
-
-  func retrieve(host: String) throws -> (String, String)? {
-    let query: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
-                                kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
-                                kSecAttrServer as String: host,
-                                kSecMatchLimit as String: kSecMatchLimitOne,
-                                kSecReturnAttributes as String: true,
-                                kSecReturnData as String: true,
-                                kSecAttrLabel as String: "Tart Credentials",
-    ]
-
-    var item: CFTypeRef?
-    let status = SecItemCopyMatching(query as CFDictionary, &item)
-
-    if status != errSecSuccess {
-      if status == errSecItemNotFound {
-        return nil
-      }
-
-      throw CredentialsProviderError.Failed(message: "Keychain returned unsuccessful status \(status)")
-    }
-
-    guard let item = item as? [String: Any],
-          let user = item[kSecAttrAccount as String] as? String,
-          let passwordData = item[kSecValueData as String] as? Data,
-          let password = String(data: passwordData, encoding: .utf8)
-    else {
-      throw CredentialsProviderError.Failed(message: "Keychain item has unexpected format")
-    }
-
-    return (user, password)
-  }
-
-  func store(host: String, user: String, password: String) throws {
-    let passwordData = password.data(using: .utf8)
-    let key: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
-                              kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
-                              kSecAttrServer as String: host,
-                              kSecAttrLabel as String: "Tart Credentials",
-    ]
-    let value: [String: Any] = [kSecAttrAccount as String: user,
-                                kSecValueData as String: passwordData as Any,
-    ]
-
-    let status = SecItemCopyMatching(key as CFDictionary, nil)
-
-    switch status {
-    case errSecItemNotFound:
-      let status = SecItemAdd(key.merging(value) { (current, _) in current } as CFDictionary, nil)
-      if status != errSecSuccess {
-        throw CredentialsProviderError.Failed(message: "Keychain failed to add item: \(status.explanation())")
-      }
-    case errSecSuccess:
-      let status = SecItemUpdate(key as CFDictionary, value as CFDictionary)
-      if status != errSecSuccess {
-        throw CredentialsProviderError.Failed(message: "Keychain failed to update item: \(status.explanation())")
-      }
-    default:
-      throw CredentialsProviderError.Failed(message: "Keychain failed to find item: \(status.explanation())")
-    }
-  }
-
-  func remove(host: String) throws {
-    let query: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
-                                kSecAttrServer as String: host,
-                                kSecAttrLabel as String: "Tart Credentials",
-    ]
-
-    let status = SecItemDelete(query as CFDictionary)
-
-    switch status {
-    case errSecSuccess:
-      return
-    case errSecItemNotFound:
-      return
-    default:
-      throw CredentialsProviderError.Failed(message: "Failed to remove Keychain item(s): \(status.explanation())")
-    }
-  }
-}
-
-extension OSStatus {
-  func explanation() -> CFString {
-    SecCopyErrorMessageString(self, nil) ?? "Unknown status code \(self)." as CFString
-  }
-}
@@ -1,33 +0,0 @@
-import Foundation
-
-enum StdinCredentialsError: Error {
-  case CredentialRequired(which: String)
-  case CredentialTooLong(message: String)
-}
-
-class StdinCredentials {
-  let userFriendlyName = "standard input credentials provider"
-
-  static func retrieve() throws -> (String, String) {
-    let user = try readStdinCredential(name: "username", prompt: "User: ", isSensitive: false)
-    let password = try readStdinCredential(name: "password", prompt: "Password: ", isSensitive: true)
-
-    return (user, password)
-  }
-
-  private static func readStdinCredential(name: String, prompt: String, maxCharacters: Int = 8192, isSensitive: Bool) throws -> String {
-    var buf = [CChar](repeating: 0, count: maxCharacters + 1 /* sentinel */ + 1 /* NUL */)
-    guard let rawCredential = readpassphrase(prompt, &buf, buf.count, isSensitive ? RPP_ECHO_OFF : RPP_ECHO_ON) else {
-      throw StdinCredentialsError.CredentialRequired(which: name)
-    }
-
-    let credential = String(cString: rawCredential).trimmingCharacters(in: .newlines)
-
-    if credential.count > maxCharacters {
-      throw StdinCredentialsError.CredentialTooLong(
-        message: "\(name) should contain no more than \(maxCharacters) characters")
-    }
-
-    return credential
-  }
-}
@@ -1,37 +0,0 @@
-import Foundation
-import Sysctl
-
-class DeviceInfo {
-  private static var osMemoized: String? = nil
-  private static var modelMemoized: String? = nil
-
-  static var os: String {
-    if let os = osMemoized {
-      return os
-    }
-
-    osMemoized = getOS()
-
-    return osMemoized!
-  }
-
-  static var model: String {
-    if let model = modelMemoized {
-      return model
-    }
-
-    modelMemoized = getModel()
-
-    return modelMemoized!
-  }
-
-  private static func getOS() -> String {
-    let osVersion = ProcessInfo.processInfo.operatingSystemVersion
-
-    return "macOS \(osVersion.majorVersion).\(osVersion.minorVersion).\(osVersion.patchVersion)"
-  }
-
-  private static func getModel() -> String {
-    return SystemControl().hardware.model
-  }
-}
@@ -1,43 +0,0 @@
-import Foundation
-import ArgumentParser
-
-enum DiskImageFormat: String, CaseIterable, Codable {
-  case raw = "raw"
-  case asif = "asif"
-
-  var displayName: String {
-    switch self {
-    case .raw:
-      return "RAW"
-    case .asif:
-      return "ASIF (Apple Sparse Image Format)"
-    }
-  }
-
-
-  /// Check if the format is supported on the current system
-  var isSupported: Bool {
-    switch self {
-    case .raw:
-      return true
-    case .asif:
-      if #available(macOS 26, *) {
-        return true
-      } else {
-        return false
-      }
-    }
-  }
-
-
-}
-
-extension DiskImageFormat: ExpressibleByArgument {
-  init?(argument: String) {
-    self.init(rawValue: argument.lowercased())
-  }
-
-  static var allValueStrings: [String] {
-    return allCases.map { $0.rawValue }
-  }
-}
@@ -1,108 +0,0 @@
-import Foundation
-
-struct ImageInfo: Codable {
-  let sizeInfo: SizeInfo?
-  let size: UInt64?
-
-  enum CodingKeys: String, CodingKey {
-    case sizeInfo = "Size Info"
-    case size = "Size"
-  }
-
-  func totalBytes() throws -> Int {
-    if let totalBytes = self.sizeInfo?.totalBytes {
-      return Int(totalBytes)
-    }
-
-    if let size = self.size {
-      return Int(size)
-    }
-
-    throw RuntimeError.Generic("Could not find size information in disk image info")
-  }
-}
-
-struct SizeInfo: Codable {
-  let totalBytes: UInt64?
-
-  enum CodingKeys: String, CodingKey {
-    case totalBytes = "Total Bytes"
-  }
-}
-
-struct Diskutil {
-  static func imageCreate(diskURL: URL, sizeGB: UInt16) throws {
-    do {
-      _ = try run([
-        "image", "create", "blank",
-        "--format", "ASIF",
-        "--size", "\(sizeGB)G",
-        "--volumeName", "Tart",
-        diskURL.path
-      ])
-    } catch {
-      throw RuntimeError.FailedToCreateDisk("Failed to create ASIF disk image: \(error)")
-    }
-  }
-
-  static func imageInfo(_ diskURL: URL) throws -> ImageInfo {
-    do {
-      let (stdoutData, _) = try run([
-        "image", "info", "--plist",
-        diskURL.path
-      ])
-
-      do {
-        return try PropertyListDecoder().decode(ImageInfo.self, from: stdoutData)
-      } catch {
-        throw RuntimeError.Generic("Failed to parse \"diskutil image info --plist\" output: \(error)")
-      }
-    }
-  }
-
-  private static func run(_ arguments: [String]) throws -> (Data, Data) {
-    guard let diskutilURL = resolveBinaryPath("diskutil") else {
-      throw RuntimeError.Generic("\"diskutil\" binary is not found in PATH")
-    }
-
-    let process = Process()
-    process.executableURL = diskutilURL
-    process.arguments = arguments
-
-    let stdoutPipe = Pipe()
-    process.standardOutput = stdoutPipe
-    let stderrPipe = Pipe()
-    process.standardError = stderrPipe
-
-    do {
-      try process.run()
-    } catch {
-      throw RuntimeError.Generic("\"\(arguments.joined(separator: " "))\" failed: \(error)")
-    }
-    process.waitUntilExit()
-
-    let stdoutData = stdoutPipe.fileHandleForReading.readDataToEndOfFile()
-    let stderrData = stderrPipe.fileHandleForReading.readDataToEndOfFile()
-
-    if process.terminationStatus != 0 {
-      let stdoutString = String(data: stdoutData, encoding: .utf8) ?? ""
-      let stderrString = String(data: stderrData, encoding: .utf8) ?? ""
-
-      throw RuntimeError.Generic("\"\(arguments.joined(separator: " "))\" failed with exit code \(process.terminationStatus): \(firstNonEmptyLine(stderrString, stdoutString))")
-    }
-
-    return (stdoutData, stderrData)
-  }
-
-  private static func firstNonEmptyLine(_ outputs: String...) -> String {
-    for output in outputs {
-      for line in output.split(separator: "\n", omittingEmptySubsequences: false) {
-        if !line.isEmpty {
-          return String(line)
-        }
-      }
-    }
-
-    return ""
-  }
-}
@@ -1,97 +0,0 @@
-import Foundation
-
-fileprivate var urlSession: URLSession = {
-  let config = URLSessionConfiguration.default
-
-  // Harbor expects a CSRF token to be present if the HTTP client
-  // carries a session cookie between its requests[1] and fails if
-  // it was not present[2].
-  //
-  // To fix that, we disable the automatic cookies carry in URLSession.
-  //
-  // [1]: https://github.com/goharbor/harbor/blob/a4c577f9ec4f18396207a5e686433a6ba203d4ef/src/server/middleware/csrf/csrf.go#L78
-  // [2]: https://github.com/cirruslabs/tart/issues/295
-  config.httpShouldSetCookies = false
-
-  return URLSession(configuration: config)
-}()
-
-class Fetcher {
-  static func fetch(_ request: URLRequest, viaFile: Bool = false) async throws -> (AsyncThrowingStream<Data, Error>, HTTPURLResponse) {
-    let task = urlSession.dataTask(with: request)
-
-    let delegate = Delegate()
-    task.delegate = delegate
-
-    let stream = AsyncThrowingStream<Data, Error> { continuation in
-      delegate.streamContinuation = continuation
-    }
-
-    let response = try await withCheckedThrowingContinuation { continuation in
-      delegate.responseContinuation = continuation
-      task.resume()
-    }
-
-    return (stream, response as! HTTPURLResponse)
-  }
-}
-
-fileprivate class Delegate: NSObject, URLSessionDataDelegate {
-  var responseContinuation: CheckedContinuation<URLResponse, Error>?
-  var streamContinuation: AsyncThrowingStream<Data, Error>.Continuation?
-
-  private var buffer: Data = Data()
-  private let bufferFlushSize = 16 * 1024 * 1024
-
-  func urlSession(
-    _ session: URLSession,
-    dataTask: URLSessionDataTask,
-    didReceive response: URLResponse,
-    completionHandler: @escaping (URLSession.ResponseDisposition) -> Void
-  ) {
-    // Soft-limit for the maximum buffer capacity
-    let capacity = min(response.expectedContentLength, Int64(bufferFlushSize))
-
-    // Pre-initialize buffer as we now know the capacity
-    buffer = Data(capacity: Int(capacity))
-
-    responseContinuation?.resume(returning: response)
-    responseContinuation = nil
-    completionHandler(.allow)
-  }
-
-  func urlSession(
-    _ session: URLSession,
-    dataTask: URLSessionDataTask,
-    didReceive data: Data
-  ) {
-    buffer.append(data)
-
-    if buffer.count >= bufferFlushSize {
-      streamContinuation?.yield(buffer)
-      buffer.removeAll(keepingCapacity: true)
-    }
-  }
-
-  func urlSession(
-    _ session: URLSession,
-    task: URLSessionTask,
-    didCompleteWithError error: Error?
-  ) {
-    if let error = error {
-      responseContinuation?.resume(throwing: error)
-      responseContinuation = nil
-
-      streamContinuation?.finish(throwing: error)
-      streamContinuation = nil
-    } else {
-      if !buffer.isEmpty {
-        streamContinuation?.yield(buffer)
-        buffer.removeAll(keepingCapacity: true)
-      }
-
-      streamContinuation?.finish()
-      streamContinuation = nil
-    }
-  }
-}
@@ -1,48 +0,0 @@
-import Foundation
-import System
-
-enum FileLockError: Error, Equatable {
-  case Failed(_ message: String)
-  case AlreadyLocked
-}
-
-class FileLock {
-  let url: URL
-  let fd: Int32
-
-  init(lockURL: URL) throws {
-    url = lockURL
-    fd = open(lockURL.path, 0)
-  }
-
-  deinit {
-    close(fd)
-  }
-
-  func trylock() throws -> Bool {
-    try flockWrapper(LOCK_EX | LOCK_NB)
-  }
-
-  func lock() throws {
-    _ = try flockWrapper(LOCK_EX)
-  }
-
-  func unlock() throws {
-    _ = try flockWrapper(LOCK_UN)
-  }
-
-  func flockWrapper(_ operation: Int32) throws -> Bool {
-    let ret = flock(fd, operation)
-    if ret != 0 {
-      let details = Errno(rawValue: CInt(errno))
-
-      if (operation & LOCK_NB) != 0 && details == .wouldBlock {
-        return false
-      }
-
-      throw FileLockError.Failed("failed to lock \(url): \(details)")
-    }
-
-    return true
-  }
-}
@@ -1,47 +0,0 @@
-import ArgumentParser
-import Foundation
-import TextTable
-
-enum Format: String, ExpressibleByArgument, CaseIterable {
-  case text, json
-
-  private(set) static var allValueStrings: [String] = Format.allCases.map { "\($0)"}
-
-  func renderSingle<T>(_ data: T) -> String where T: Encodable {
-    switch self {
-    case .text:
-      return renderList([data])
-    case .json:
-      let encoder = JSONEncoder()
-      encoder.outputFormatting = .prettyPrinted
-      return try! encoder.encode(data).asText()
-    }
-  }
-
-  func renderList<T>(_ data: Array<T>) -> String where T: Encodable {
-    switch self {
-    case .text:
-      if (data.count == 0) {
-        return ""
-      }
-      let table = TextTable<T> { (item: T) in
-        let mirroredObject = Mirror(reflecting: item)
-        return mirroredObject.children.enumerated()
-          .filter {(_, element) in
-            // Deprecate the "Running" field: only make it available
-            // from JSON for backwards-compatibility
-            element.label! != "Running"
-          }
-          .map { (_, element) in
-            let fieldName = element.label!
-            return Column(title: fieldName, value: element.value)
-          }
-      }
-      return table.string(for: data, style: Style.plain)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
-    case .json:
-      let encoder = JSONEncoder()
-      encoder.outputFormatting = .prettyPrinted
-      return try! encoder.encode(data).asText()
-    }
-  }
-}
@@ -1,20 +0,0 @@
-import Foundation
-import Virtualization
-
-class IPSWCache: PrunableStorage {
-  let baseURL: URL
-
-  init() throws {
-    baseURL = try Config().tartCacheDir.appendingPathComponent("IPSWs", isDirectory: true)
-    try FileManager.default.createDirectory(at: baseURL, withIntermediateDirectories: true)
-  }
-
-  func locationFor(fileName: String) -> URL {
-    baseURL.appendingPathComponent(fileName, isDirectory: false)
-  }
-
-  func prunables() throws -> [Prunable] {
-    try FileManager.default.contentsOfDirectory(at: baseURL, includingPropertiesForKeys: nil)
-      .filter { $0.lastPathComponent.hasSuffix(".ipsw")}
-  }
-}
@@ -1,57 +0,0 @@
-import Foundation
-
-struct LocalLayerCache {
-  struct DigestInfo {
-    let range: Range<Data.Index>
-    let compressedDigest: String
-    let uncompressedContentDigest: String?
-  }
-
-  let name: String
-  let deduplicatedBytes: UInt64
-  let diskURL: URL
-
-  private let mappedDisk: Data
-  private var digestToRange: [String: DigestInfo] = [:]
-  private var offsetToRange: [UInt64: DigestInfo] = [:]
-
-  init?(_ name: String, _ deduplicatedBytes: UInt64, _ diskURL: URL, _ manifest: OCIManifest) throws {
-    self.name = name
-    self.deduplicatedBytes = deduplicatedBytes
-    self.diskURL = diskURL
-
-    // mmap(2) the disk that contains the layers from the manifest
-    self.mappedDisk = try Data(contentsOf: diskURL, options: [.alwaysMapped])
-
-    // Record the ranges of the disk layers listed in the manifest
-    var offset: UInt64 = 0
-
-    for layer in manifest.layers.filter({ $0.mediaType == diskV2MediaType }) {
-      guard let uncompressedSize = layer.uncompressedSize() else {
-        return nil
-      }
-
-      let info = DigestInfo(
-        range: Int(offset)..<Int(offset + uncompressedSize),
-        compressedDigest: layer.digest,
-        uncompressedContentDigest: layer.uncompressedContentDigest()!
-      )
-      self.digestToRange[layer.digest] = info
-      self.offsetToRange[offset] = info
-
-      offset += uncompressedSize
-    }
-  }
-
-  func findInfo(digest: String, offsetHint: UInt64) -> DigestInfo? {
-    // Layers can have the same digests, for example, empty ones. Let's use the offset hint to make a better guess.
-    if let info = self.offsetToRange[offsetHint], info.compressedDigest == digest {
-      return info
-    }
-    return self.digestToRange[digest]
-  }
-
-  func subdata(_ range: Range<Data.Index>) -> Data {
-    return self.mappedDisk.subdata(in: range)
-  }
-}
@@ -1,46 +0,0 @@
-import Foundation
-
-public protocol Logger {
-  func appendNewLine(_ line: String) -> Void
-  func updateLastLine(_ line: String) -> Void
-}
-
-var defaultLogger: Logger = {
-  if ProcessInfo.processInfo.environment["CI"] != nil {
-    return SimpleConsoleLogger()
-  } else {
-    return InteractiveConsoleLogger()
-  }
-}()
-
-public class InteractiveConsoleLogger: Logger {
-  private let eraseCursorDown = "\u{001B}[J" // clear entire line
-  private let moveUp = "\u{001B}[1A" // move one line up
-  private let moveBeginningOfLine = "\r" // 
-
-  public init() {
-
-  }
-
-  public func appendNewLine(_ line: String) {
-    print(line, terminator: "\n")
-  }
-
-  public func updateLastLine(_ line: String) {
-    print(moveUp, moveBeginningOfLine, eraseCursorDown, line, separator: "", terminator: "\n")
-  }
-}
-
-public class SimpleConsoleLogger: Logger {
-  public init() {
-
-  }
-
-  public func appendNewLine(_ line: String) {
-    print(line, terminator: "\n")
-  }
-
-  public func updateLastLine(_ line: String) {
-    print(line, terminator: "\n")
-  }
-}
@@ -1,36 +0,0 @@
-import Foundation
-
-public class ProgressObserver: NSObject {
-  @objc var progressToObserve: Progress
-  var observation: NSKeyValueObservation?
-  var lastTimeUpdated = Date.now
-  private var lastRenderedLine: String?
-
-  public init(_ progress: Progress) {
-    progressToObserve = progress
-  }
-
-  func log(_ renderer: Logger) {
-    let initialLine = ProgressObserver.lineToRender(progressToObserve)
-    renderer.appendNewLine(initialLine)
-    lastRenderedLine = initialLine
-    observation = observe(\.progressToObserve.fractionCompleted) { progress, _ in
-      let currentTime = Date.now
-      if self.progressToObserve.isFinished || currentTime.timeIntervalSince(self.lastTimeUpdated) >= 1.0 {
-        self.lastTimeUpdated = currentTime
-        let line = ProgressObserver.lineToRender(self.progressToObserve)
-        // Skip identical renders so non-interactive logs only see new percent values.
-        if line == self.lastRenderedLine {
-          return
-        }
-
-        self.lastRenderedLine = line
-        renderer.updateLastLine(line)
-      }
-    }
-  }
-
-  private static func lineToRender(_ progress: Progress) -> String {
-    String(Int(100 * progress.fractionCompleted)) + "%"
-  }
-}
@@ -1,17 +0,0 @@
-import Foundation
-
-public class URLSessionLogger: NSObject, URLSessionTaskDelegate {
-  let renderer: Logger
-
-  public init(_ renderer: Logger) {
-    self.renderer = renderer
-  }
-
-  public func urlSession(_ session: URLSession, task: URLSessionTask, didSendBodyData bytesSent: Int64, totalBytesSent: Int64, totalBytesExpectedToSend: Int64) {
-    renderer.updateLastLine(URLSessionLogger.lineToRender(task.progress))
-  }
-
-  private static func lineToRender(_ progress: Progress) -> String {
-    String(100 * progress.completedUnitCount / progress.totalUnitCount) + "%"
-  }
-}
@@ -1,122 +0,0 @@
-import Foundation
-import Network
-import Virtualization
-
-struct ARPCommandFailedError: Error, CustomStringConvertible {
-  var terminationReason: Process.TerminationReason
-  var terminationStatus: Int32
-
-  var description: String {
-    var reason: String
-
-    switch terminationReason {
-    case .exit:
-      reason = "exit code \(terminationStatus)"
-    case .uncaughtSignal:
-      reason = "uncaught signal"
-    default:
-      reason = "unknown reason"
-    }
-
-    return "arp command failed: \(reason)"
-  }
-}
-
-struct ARPCommandYieldedInvalidOutputError: Error, CustomStringConvertible {
-  var explanation: String
-
-  var description: String {
-    "arp command yielded invalid output: \(explanation)"
-  }
-}
-
-struct ARPCacheInternalError: Error, CustomStringConvertible {
-  var explanation: String
-
-  var description: String {
-    "ARPCache internal error: \(explanation)"
-  }
-}
-
-struct ARPCache {
-  let arpCommandOutput: Data
-
-  init() throws {
-    let process = Process.init()
-    process.executableURL = URL.init(fileURLWithPath: "/usr/sbin/arp")
-    process.arguments = ["-an"]
-
-    let pipe = Pipe()
-    process.standardOutput = pipe
-    process.standardError = pipe
-    process.standardInput = FileHandle.nullDevice
-
-    try process.run()
-
-    guard let arpCommandOutput = try pipe.fileHandleForReading.readToEnd() else {
-      throw ARPCommandYieldedInvalidOutputError(explanation: "empty output")
-    }
-
-    process.waitUntilExit()
-
-    if !(process.terminationReason == .exit && process.terminationStatus == 0) {
-      throw ARPCommandFailedError(
-        terminationReason: process.terminationReason,
-        terminationStatus: process.terminationStatus)
-    }
-
-    self.arpCommandOutput = arpCommandOutput
-  }
-
-  func ResolveMACAddress(macAddress: MACAddress) throws -> IPv4Address? {
-    let lines = String(decoding: arpCommandOutput, as: UTF8.self)
-      .trimmingCharacters(in: .whitespacesAndNewlines)
-      .components(separatedBy: "\n")
-
-    // Based on https://opensource.apple.com/source/network_cmds/network_cmds-606.40.2/arp.tproj/arp.c.auto.html
-    let regex = try NSRegularExpression(pattern: #"^.* \((?<ip>.*)\) at (?<mac>.*) on (?<interface>.*) .*$"#)
-
-    for line in lines {
-      let nsLineRange = NSRange(line.startIndex..<line.endIndex, in: line)
-
-      guard let match = regex.firstMatch(in: line, range: nsLineRange) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "unparseable entry \"\(line)\"")
-      }
-
-      let rawIP = try match.getCaptureGroup(name: "ip", for: line)
-      guard let ip = IPv4Address(rawIP) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "failed to parse IPv4 address \(rawIP)")
-      }
-
-      let rawMAC = try match.getCaptureGroup(name: "mac", for: line)
-      if rawMAC == "(incomplete)" {
-        continue
-      }
-      guard let mac = MACAddress(fromString: rawMAC) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "failed to parse MAC address \(rawMAC)")
-      }
-
-      if macAddress == mac {
-        return ip
-      }
-    }
-
-    return nil
-  }
-}
-
-extension NSTextCheckingResult {
-  func getCaptureGroup(name: String, for string: String) throws -> String {
-    let nsRange = self.range(withName: name)
-
-    if nsRange.location == NSNotFound {
-      throw ARPCacheInternalError(explanation: "attempted to retrieve non-existent named capture group \(name)")
-    }
-
-    guard let range = Range.init(nsRange, in: string) else {
-      throw ARPCacheInternalError(explanation: "failed to convert NSRange to Range")
-    }
-
-    return String(string[range])
-  }
-}
@@ -1,42 +0,0 @@
-import Foundation
-import Network
-import NIOPosix
-import GRPC
-import Cirruslabs_TartGuestAgent_Apple_Swift
-import Cirruslabs_TartGuestAgent_Grpc_Swift
-
-class AgentResolver {
-  static func ResolveIP(_ controlSocketPath: String) async throws -> IPv4Address? {
-    do {
-      return try await resolveIP(controlSocketPath)
-    } catch let error as GRPCConnectionPoolError {
-      return nil
-    }
-  }
-
-  private static func resolveIP(_ controlSocketPath: String) async throws -> IPv4Address? {
-    // Create a gRPC channel connected to the VM's control socket
-    let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
-    defer {
-      try! group.syncShutdownGracefully()
-    }
-
-    let channel = try GRPCChannelPool.with(
-      target: .unixDomainSocket(controlSocketPath),
-      transportSecurity: .plaintext,
-      eventLoopGroup: group,
-    )
-    defer {
-      try! channel.close().wait()
-    }
-
-    // Invoke ResolveIP() gRPC method
-    let callOptions = CallOptions(timeLimit: .timeout(.seconds(1)))
-    let agentAsyncClient = AgentAsyncClient(channel: channel)
-    let resolveIPCall = agentAsyncClient.makeResolveIpCall(ResolveIPRequest(), callOptions: callOptions)
-
-    let response = try await resolveIPCall.response
-
-    return IPv4Address(response.ip)
-  }
-}
@@ -1,42 +0,0 @@
-import Foundation
-import Network
-import SwiftRadix
-
-struct Lease {
-  var mac: MACAddress
-  var ip: IPv4Address
-  var expiresAt: Date
-
-  init?(fromRawLease: [String : String]) {
-    // Retrieve the required fields
-    guard let hwAddress = fromRawLease["hw_address"] else { return nil }
-    guard let ipAddress = fromRawLease["ip_address"] else { return nil }
-    guard let lease = fromRawLease["lease"] else { return nil }
-
-    // Parse MAC address
-    let hwAddressSplits = hwAddress.split(separator: ",")
-    if hwAddressSplits.count != 2 {
-      return nil
-    }
-    if let hwAddressProto = Int(hwAddressSplits[0]), hwAddressProto != ARPHRD_ETHER {
-      return nil
-    }
-    guard let mac = MACAddress(fromString: String(hwAddressSplits[1])) else {
-      return nil
-    }
-
-    // Parse IP address
-    guard let ip = IPv4Address(ipAddress) else {
-      return nil
-    }
-
-    // Parse expiration timestamp
-    guard let leaseTimestamp = lease.hex?.value else {
-      return nil
-    }
-
-    self.ip = ip
-    self.mac = mac
-    self.expiresAt = Date(timeIntervalSince1970: TimeInterval(leaseTimestamp))
-  }
-}
@@ -1,118 +0,0 @@
-import Foundation
-import Network
-
-enum LeasesError: Error {
-  case UnexpectedFormat(name: String = "unexpected DHCPD leases file format", message: String, line: Int)
-  case Truncated(name: String = "truncated DHCPD leases file")
-
-  var description: String {
-    switch self {
-
-    case .UnexpectedFormat(name: let name, message: let message, line: let line):
-      return "\(name) on line \(line): \(message)"
-    case .Truncated(name: let name):
-      return "\(name)"
-    }
-  }
-}
-
-class Leases {
-  private let leases: [MACAddress : Lease]
-
-  convenience init?() throws {
-    try self.init(URL(fileURLWithPath: "/var/db/dhcpd_leases"))
-  }
-
-  convenience init?(_ fromURL: URL) throws {
-    do {
-      let urlContents = try String(contentsOf: fromURL, encoding: .utf8)
-      try self.init(urlContents)
-    } catch {
-      if error.isFileNotFound() {
-        return nil
-      }
-
-      throw error
-    }
-  }
-
-  init(_ fromString: String) throws {
-    let leases = try Self.retrieveRawLeases(fromString).compactMap({ rawLease in
-      Lease(fromRawLease: rawLease)
-    }).filter({ lease in
-      lease.expiresAt.isInFuture
-    }).map({ lease in
-      (lease.mac, lease)
-    })
-
-    self.leases = Dictionary(leases) { (left, right) in
-      // When duplicate lease is found, prefer a newer lease over the older one
-      (left.expiresAt > right.expiresAt) ? left : right
-    }
-  }
-
-  /// Parse leases from the host cache similarly to the PLCache_read() function found in Apple's Open Source releases.
-  ///
-  /// [1]: https://github.com/apple-opensource/bootp/blob/master/bootplib/NICache.c#L285-L391
-  private static func retrieveRawLeases(_ dhcpdLeasesContents: String) throws -> [[String : String]] {
-    var rawLeases: [[String : String]] = Array()
-
-    enum State {
-      case Nowhere
-      case Start
-      case Body
-      case End
-    }
-    var state = State.Nowhere
-
-    var currentRawLease: [String : String] = Dictionary()
-
-    for (lineNumber, line) in dhcpdLeasesContents.split(separator: "\n").enumerated().map({ ($0 + 1, $1) }) {
-      if line == "{" {
-        // Handle lease block start
-        if state != .Nowhere && state != .End {
-          throw LeasesError.UnexpectedFormat(message: "unexpected lease block start ({)", line: lineNumber)
-        }
-
-        state = .Start
-      } else if line == "}" {
-        // Handle lease block end
-        if state != .Body {
-          throw LeasesError.UnexpectedFormat(message: "unexpected lease block end (})", line: lineNumber)
-        }
-
-        rawLeases.append(currentRawLease)
-        currentRawLease = Dictionary()
-
-        state = .End
-      } else {
-        // Handle lease block contents
-        let lineWithoutTabs = String(line.drop { $0 == " " || $0 == "\t"})
-
-        if lineWithoutTabs.isEmpty {
-          continue
-        }
-
-        let splits = lineWithoutTabs.split(separator: "=", maxSplits: 1)
-        if splits.count != 2 {
-          throw LeasesError.UnexpectedFormat(message: "key-value pair with only a key", line: lineNumber)
-        }
-        let (key, value) = (String(splits[0]), String(splits[1]))
-
-        currentRawLease[key] = value
-
-        state = .Body
-      }
-    }
-
-    if state == .Start || state == .Body {
-      throw LeasesError.Truncated()
-    }
-
-    return rawLeases
-  }
-
-  func ResolveMACAddress(macAddress: MACAddress) -> IPv4Address? {
-    leases[macAddress]?.ip
-  }
-}
@@ -1,21 +0,0 @@
-import Foundation
-
-struct MACAddress: Equatable, Hashable, CustomStringConvertible {
-  var mac: [UInt8] = Array(repeating: 0, count: 6)
-
-  init?(fromString: String) {
-    let components = fromString.components(separatedBy: ":")
-
-    if components.count != 6 {
-      return nil
-    }
-
-    for (index, component) in components.enumerated() {
-      mac[index] = UInt8(component, radix: 16)!
-    }
-  }
-
-  var description: String {
-    String(format: "%02x:%02x:%02x:%02x:%02x:%02x", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5])
-  }
-}
@@ -1,8 +0,0 @@
-import Virtualization
-import Semaphore
-
-protocol Network {
-  func attachments() -> [VZNetworkDeviceAttachment]
-  func run(_ sema: AsyncSemaphore) throws
-  func stop() async throws
-}
@@ -1,23 +0,0 @@
-import Foundation
-import Semaphore
-import Virtualization
-
-class NetworkBridged: Network {
-  let interfaces: [VZBridgedNetworkInterface]
-
-  init(interfaces: [VZBridgedNetworkInterface]) {
-    self.interfaces = interfaces
-  }
-
-  func attachments() -> [VZNetworkDeviceAttachment] {
-    interfaces.map { VZBridgedNetworkDeviceAttachment(interface: $0) }
-  }
-
-  func run(_ sema: AsyncSemaphore) throws {
-    // no-op, only used for Softnet
-  }
-
-  func stop() async throws {
-    // no-op, only used for Softnet
-  }
-}
@@ -1,17 +0,0 @@
-import Foundation
-import Semaphore
-import Virtualization
-
-class NetworkShared: Network {
-  func attachments() -> [VZNetworkDeviceAttachment] {
-    [VZNATNetworkDeviceAttachment()]
-  }
-
-  func run(_ sema: AsyncSemaphore) throws {
-    // no-op, only used for Softnet
-  }
-
-  func stop() async throws {
-    // no-op, only used for Softnet
-  }
-}
@@ -1,159 +0,0 @@
-import Atomics
-import Foundation
-import Semaphore
-import System
-import Virtualization
-
-enum SoftnetError: Error {
-  case InitializationFailed(why: String)
-  case RuntimeFailed(why: String)
-}
-
-class Softnet: Network {
-  private let process = Process()
-  private var monitorTask: Task<Void, Error>? = nil
-  private let monitorTaskFinished = ManagedAtomic<Bool>(false)
-
-  let vmFD: Int32
-
-  init(vmMACAddress: String, extraArguments: [String] = []) throws {
-    let fds = UnsafeMutablePointer<Int32>.allocate(capacity: MemoryLayout<Int>.stride * 2)
-
-    let ret = socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)
-    if ret != 0 {
-      throw SoftnetError.InitializationFailed(why: "socketpair() failed with exit code \(ret)")
-    }
-
-    vmFD = fds[0]
-    let softnetFD = fds[1]
-
-    try setSocketBuffers(vmFD, 1 * 1024 * 1024);
-    try setSocketBuffers(softnetFD, 1 * 1024 * 1024);
-
-    process.executableURL = try Self.softnetExecutableURL()
-    process.arguments = ["--vm-fd", String(STDIN_FILENO), "--vm-mac-address", vmMACAddress] + extraArguments
-    process.standardInput = FileHandle(fileDescriptor: softnetFD, closeOnDealloc: false)
-  }
-
-  static func softnetExecutableURL() throws -> URL {
-    let binaryName = "softnet"
-
-    guard let executableURL = resolveBinaryPath(binaryName) else {
-      throw SoftnetError.InitializationFailed(why: "\(binaryName) not found in PATH")
-    }
-
-    return executableURL
-  }
-
-  func run(_ sema: AsyncSemaphore) throws {
-    try process.run()
-
-    monitorTask = Task {
-      // Wait for the Softnet to finish
-      process.waitUntilExit()
-
-      // Signal to the caller that the Softnet has finished
-      sema.signal()
-
-      // Signal to ourselves that the Softnet has finished
-      monitorTaskFinished.store(true, ordering: .sequentiallyConsistent)
-    }
-  }
-
-  func stop() async throws {
-    if monitorTaskFinished.load(ordering: .sequentiallyConsistent) {
-      // Consume the monitor task's value to ensure the task has finished
-      _ = try await monitorTask?.value
-
-      throw SoftnetError.RuntimeFailed(why: "Softnet process terminated prematurely")
-    } else {
-      process.interrupt()
-
-      // Consume the monitor task's value to ensure the task has finished
-      _ = try await monitorTask?.value
-    }
-  }
-
-  private func setSocketBuffers(_ fd: Int32, _ sizeBytes: Int) throws {
-    let option_len = socklen_t(MemoryLayout<Int>.size)
-
-    // The system expects the value of SO_RCVBUF to be at least double the value of SO_SNDBUF,
-    // and for optimal performance, the recommended value of SO_RCVBUF is four times the value of SO_SNDBUF.
-    // See: https://developer.apple.com/documentation/virtualization/vzfilehandlenetworkdeviceattachment/3969266-maximumtransmissionunit
-    var receiveBufferSize = 4 * sizeBytes
-    var ret = setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &receiveBufferSize, option_len)
-    if ret != 0 {
-      throw SoftnetError.InitializationFailed(why: "setsockopt(SO_RCVBUF) returned \(ret)")
-    }
-
-    var sendBufferSize = sizeBytes
-    ret = setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sendBufferSize, option_len)
-    if ret != 0 {
-      throw SoftnetError.InitializationFailed(why: "setsockopt(SO_SNDBUF) returned \(ret)")
-    }
-  }
-
-  func attachments() -> [VZNetworkDeviceAttachment] {
-    let fh = FileHandle.init(fileDescriptor: vmFD)
-    return [VZFileHandleNetworkDeviceAttachment(fileHandle: fh)]
-  }
-
-  static func configureSUIDBitIfNeeded() throws {
-    // Obtain the Softnet executable path
-    //
-    // It's important to use resolvingSymlinksInPath() here, because otherwise
-    // we will get something like "/opt/homebrew/bin/softnet" instead of
-    // "/opt/homebrew/Cellar/softnet/0.6.2/bin/softnet"
-    let softnetExecutablePath = try Softnet.softnetExecutableURL().resolvingSymlinksInPath().path
-
-    // Check if the SUID bit is already configured
-    let info = try FileManager.default.attributesOfItem(atPath: softnetExecutablePath) as NSDictionary
-    if info.fileOwnerAccountID() == 0 && (info.filePosixPermissions() & Int(S_ISUID)) != 0 {
-      return
-    }
-
-    // Check if the passwordless Sudo is already configured for Softnet
-    let sudoBinaryName = "sudo"
-
-    guard let sudoExecutableURL = resolveBinaryPath(sudoBinaryName) else {
-      throw SoftnetError.InitializationFailed(why: "\(sudoBinaryName) not found in PATH")
-    }
-
-    var process = Process()
-    process.executableURL = sudoExecutableURL
-    process.arguments = ["--non-interactive", "softnet", "--help"]
-    process.standardInput = nil
-    process.standardOutput = nil
-    process.standardError = nil
-    try process.run()
-    process.waitUntilExit()
-    if process.terminationStatus == 0 {
-      return
-    }
-
-    // Configure the SUID bit by spawning the Sudo process in interactive mode
-    // and asking the user for password required to run chown & chmod
-    fputs("Softnet requires a Sudo password to set the SUID bit on the Softnet executable, please enter it below.\n",
-          stderr)
-
-    process = try Process.run(sudoExecutableURL, arguments: [
-      "sh",
-      "-c",
-      "chown root \(softnetExecutablePath) && chmod u+s \(softnetExecutablePath)",
-    ])
-
-    // Set TTY's foreground process group to that of the Sudo process,
-    // otherwise it will get stopped by a SIGTTIN once user input arrives
-    if tcsetpgrp(STDIN_FILENO, process.processIdentifier) == -1 {
-      let details = Errno(rawValue: CInt(errno))
-
-      throw RuntimeError.SoftnetFailed("tcsetpgrp(2) failed: \(details)")
-    }
-
-    process.waitUntilExit()
-
-    if process.terminationStatus != 0 {
-      throw RuntimeError.SoftnetFailed("failed to configure SUID bit on Softnet executable with Sudo")
-    }
-  }
-}
@@ -1,21 +0,0 @@
-import Foundation
-
-protocol Authentication {
-  func header() -> (String, String)
-  func isValid() -> Bool
-}
-
-struct BasicAuthentication: Authentication {
-  let user: String
-  let password: String
-
-  func header() -> (String, String) {
-    let creds = Data("\(user):\(password)".utf8).base64EncodedString()
-
-    return ("Authorization", "Basic \(creds)")
-  }
-
-  func isValid() -> Bool {
-    true
-  }
-}
@@ -1,25 +0,0 @@
-import Foundation
-
-actor AuthenticationKeeper {
-  var authentication: Authentication? = nil
-
-  func set(_ authentication: Authentication) {
-    self.authentication = authentication
-  }
-
-  func header() -> (String, String)? {
-    if let authentication = authentication {
-      // Do not suggest any headers if the
-      // authentication token has expired
-      if !authentication.isValid() {
-        return nil
-      }
-
-      return authentication.header()
-    }
-
-    // Do not suggest any headers if the
-    // authentication token is not set
-    return nil
-  }
-}
@@ -1,63 +0,0 @@
-import Foundation
-import CryptoKit
-
-enum DigestError: Error {
-  case InvalidOffset
-  case InvalidSize
-}
-
-class Digest {
-  var hash: SHA256 = SHA256()
-
-  func update(_ data: Data) {
-    hash.update(data: data)
-  }
-
-  func finalize() -> String {
-    hash.finalize().hexdigest()
-  }
-
-  static func hash(_ data: Data) -> String {
-    SHA256.hash(data: data).hexdigest()
-  }
-
-  static func hash(_ url: URL) throws -> String {
-    hash(try Data(contentsOf: url))
-  }
-
-  static func hash(_ url: URL, offset: UInt64, size: UInt64) throws -> String {
-    // Sanity check
-    let fhSanity = try FileHandle(forReadingFrom: url)
-    try fhSanity.seekToEnd()
-    let fileSize = try fhSanity.offset()
-    try fhSanity.close()
-
-    if offset > fileSize {
-      throw DigestError.InvalidOffset
-    }
-
-    if (offset + size) > fileSize {
-      throw DigestError.InvalidSize
-    }
-
-    // Read a chunk of size ``size`` at offset ``offset``
-    // and calculate it's digest
-    let fh = try FileHandle(forReadingFrom: url)
-    defer { try! fh.close() }
-
-    try fh.seek(toOffset: offset)
-
-    let data = try fh.read(upToCount: Int(size))!
-
-    return hash(data)
-  }
-}
-
-extension SHA256.Digest {
-  func hexdigest() -> String {
-    "sha256:" + self.map {
-      String(format: "%02x", $0)
-    }
-    .joined()
-  }
-}
@@ -1,6 +0,0 @@
-import Foundation
-
-protocol Disk {
-  static func push(diskURL: URL, registry: Registry, chunkSizeMb: Int, concurrency: UInt, progress: Progress) async throws -> [OCIManifestLayer]
-  static func pull(registry: Registry, diskLayers: [OCIManifestLayer], diskURL: URL, concurrency: UInt, progress: Progress, localLayerCache: LocalLayerCache?, deduplicate: Bool) async throws
-}
@@ -1,293 +0,0 @@
-import Foundation
-import Compression
-import System
-import Retry
-
-class DiskV2: Disk {
-  private static let bufferSizeBytes = 4 * 1024 * 1024
-  private static let layerLimitBytes = 512 * 1024 * 1024
-
-  // A zero chunk for faster than byte-by-byte comparisons
-  //
-  // Assumes that the other Data(...) is equal in size, but it's fine to get a false-negative
-  // on the last block since it costs only 4 MiB of excess data per 512 MiB layer.
-  //
-  // Some simple benchmarks ("sync && sudo purge" command was used to negate the disk caching effects):
-  // +--------------------------------------+---------------------------------------------------+
-  // | Operation                            | time(1) result                                    |
-  // +--------------------------------------+---------------------------------------------------+
-  // | Data(...) == zeroChunk               | 2.16s user 11.71s system 73% cpu 18.928 total     |
-  // | Data(...).contains(where: {$0 != 0}) | 603.68s user 12.97s system 99% cpu 10:22.85 total |
-  // +--------------------------------------+---------------------------------------------------+
-  private static let holeGranularityBytes = 4 * 1024 * 1024
-  private static let zeroChunk = Data(count: holeGranularityBytes)
-
-  static func push(diskURL: URL, registry: Registry, chunkSizeMb: Int, concurrency: UInt, progress: Progress) async throws -> [OCIManifestLayer] {
-    var pushedLayers: [(index: Int, pushedLayer: OCIManifestLayer)] = []
-
-    // Open the disk file
-    let mappedDisk = try Data(contentsOf: diskURL, options: [.alwaysMapped])
-
-    // Compress the disk file as multiple individually decompressible streams,
-    // each equal ``Self.layerLimitBytes`` bytes or less due to LZ4 compression
-    try await withThrowingTaskGroup(of: (Int, OCIManifestLayer).self) { group in
-      for (index, data) in mappedDisk.chunks(ofCount: layerLimitBytes).enumerated() {
-        // Respect the concurrency limit
-        if index >= concurrency {
-          if let (index, pushedLayer) = try await group.next() {
-            pushedLayers.append((index, pushedLayer))
-          }
-        }
-
-        // Launch a disk layer pushing task
-        group.addTask {
-          let compressedData = try (data as NSData).compressed(using: .lz4) as Data
-          let compressedDataDigest = Digest.hash(compressedData)
-
-          try await retry(maxAttempts: 5) {
-            if try await !registry.blobExists(compressedDataDigest) {
-              _ = try await registry.pushBlob(fromData: compressedData, chunkSizeMb: chunkSizeMb, digest: compressedDataDigest)
-            }
-          } recoverFromFailure: { error in
-            if error is URLError {
-              print("Error: \(error.localizedDescription)")
-              print("Attempting to re-try...")
-
-              return .retry
-            }
-
-            return .throw
-          }
-
-          // Update progress using a relative value
-          progress.completedUnitCount += Int64(data.count)
-
-          return (index, OCIManifestLayer(
-            mediaType: diskV2MediaType,
-            size: compressedData.count,
-            digest: compressedDataDigest,
-            uncompressedSize: UInt64(data.count),
-            uncompressedContentDigest: Digest.hash(data)
-          ))
-        }
-      }
-
-      for try await pushedLayer in group {
-        pushedLayers.append(pushedLayer)
-      }
-    }
-
-    return pushedLayers.sorted {
-      $0.index < $1.index
-    }.map {
-      $0.pushedLayer
-    }
-  }
-
-  static func pull(registry: Registry, diskLayers: [OCIManifestLayer], diskURL: URL, concurrency: UInt, progress: Progress, localLayerCache: LocalLayerCache? = nil, deduplicate: Bool = false) async throws {
-    // Support resumable pulls
-    let pullResumed = FileManager.default.fileExists(atPath: diskURL.path)
-
-    if !pullResumed {
-      if deduplicate, let localLayerCache = localLayerCache {
-        // Clone the local layer cache's disk and use it as a base, potentially
-        // reducing the space usage since some blocks won't be written at all
-        try FileManager.default.copyItem(at: localLayerCache.diskURL, to: diskURL)
-      } else {
-        // Otherwise create an empty disk
-        if !FileManager.default.createFile(atPath: diskURL.path, contents: nil) {
-          throw OCIError.FailedToCreateVmFile
-        }
-      }
-    }
-
-    // Calculate the uncompressed disk size
-    var uncompressedDiskSize: UInt64 = 0
-
-    for layer in diskLayers {
-      guard let uncompressedLayerSize = layer.uncompressedSize() else {
-        throw OCIError.LayerIsMissingUncompressedSizeAnnotation
-      }
-
-      uncompressedDiskSize += uncompressedLayerSize
-    }
-
-    // Truncate the target disk file so that it will be able
-    // to accomodate the uncompressed disk size
-    let disk = try FileHandle(forWritingTo: diskURL)
-    try disk.truncate(atOffset: uncompressedDiskSize)
-    try disk.close()
-
-    // Determine the file system block size
-    var st = stat()
-    if stat(diskURL.path, &st) == -1 {
-      let details = Errno(rawValue: errno)
-
-      throw RuntimeError.PullFailed("failed to stat(2) disk \(diskURL.path): \(details)")
-    }
-    let fsBlockSize = UInt64(st.st_blksize)
-
-    // Concurrently fetch and decompress layers
-    try await withThrowingTaskGroup(of: Void.self) { group in
-      var globalDiskWritingOffset: UInt64 = 0
-
-      for (index, diskLayer) in diskLayers.enumerated() {
-        // Respect the concurrency limit
-        if index >= concurrency {
-          try await group.next()
-        }
-
-        // Retrieve layer annotations
-        guard let uncompressedLayerSize = diskLayer.uncompressedSize() else {
-          throw OCIError.LayerIsMissingUncompressedSizeAnnotation
-        }
-        guard let uncompressedLayerContentDigest = diskLayer.uncompressedContentDigest() else {
-          throw OCIError.LayerIsMissingUncompressedDigestAnnotation
-        }
-
-        // Capture the current disk writing offset
-        let diskWritingOffset = globalDiskWritingOffset
-
-        // Launch a fetching and decompression task
-        group.addTask {
-          // No need to fetch and decompress anything if we've already done so
-          if pullResumed {
-            // do not check hash in the condition above to make it lazy e.g. only do expensive calculations if needed
-            if try Digest.hash(diskURL, offset: diskWritingOffset, size: uncompressedLayerSize) == uncompressedLayerContentDigest {
-              // Update the progress
-              progress.completedUnitCount += Int64(diskLayer.size)
-
-              return
-            }
-          }
-
-          // Open the disk file for writing
-          let disk = try FileHandle(forWritingTo: diskURL)
-
-          // Also open the disk file for reading and verifying
-          // its contents in case the local layer cache is used
-          let rdisk: FileHandle? = if deduplicate && localLayerCache != nil {
-            try FileHandle(forReadingFrom: diskURL)
-          } else {
-            nil
-          }
-
-          // Check if we already have this layer contents in the local layer cache,
-          // or perhaps even on the cloned disk (when the deduplication is enabled)
-          if let localLayerCache = localLayerCache,
-             let localLayerInfo = localLayerCache.findInfo(digest: diskLayer.digest, offsetHint: diskWritingOffset),
-             localLayerInfo.uncompressedContentDigest == uncompressedLayerContentDigest {
-            if deduplicate && localLayerInfo.range.lowerBound == diskWritingOffset {
-              // Do nothing, because the data is already on the disk that we've inherited from
-            } else {
-              // Fulfil the layer contents from the local blob cache
-              let data = localLayerCache.subdata(localLayerInfo.range)
-              _ = try zeroSkippingWrite(disk, rdisk, fsBlockSize, diskWritingOffset, data)
-            }
-
-            try disk.close()
-
-            if let rdisk = rdisk {
-              try rdisk.close()
-            }
-
-            // Update the progress
-            progress.completedUnitCount += Int64(diskLayer.size)
-
-            return
-          }
-
-          var diskWritingOffset = diskWritingOffset
-
-          // Pull and decompress a single layer into the specific offset on disk
-          let filter = try OutputFilter(.decompress, using: .lz4, bufferCapacity: Self.bufferSizeBytes) { data in
-            guard let data = data else {
-              return
-            }
-
-            diskWritingOffset = try zeroSkippingWrite(disk, rdisk, fsBlockSize, diskWritingOffset, data)
-          }
-
-          var rangeStart: Int64 = 0
-
-          try await retry(maxAttempts: 5) {
-            try await registry.pullBlob(diskLayer.digest, rangeStart: rangeStart) { data in
-              try filter.write(data)
-
-              // Update the progress
-              progress.completedUnitCount += Int64(data.count)
-
-              // Update the current range start
-              rangeStart += Int64(data.count)
-            }
-          } recoverFromFailure: { error in
-            if error is URLError {
-              print("Error pulling disk layer \(index + 1): \"\(error.localizedDescription)\", attempting to re-try...")
-
-              return .retry
-            }
-
-            return .throw
-          }
-
-          try filter.finalize()
-
-          try disk.close()
-
-          if let rdisk = rdisk {
-            try rdisk.close()
-          }
-        }
-
-        globalDiskWritingOffset += uncompressedLayerSize
-      }
-    }
-  }
-
-  private static func zeroSkippingWrite(_ disk: FileHandle, _ rdisk: FileHandle?, _ fsBlockSize: UInt64, _ offset: UInt64, _ data: Data) throws -> UInt64 {
-    var offset = offset
-
-    for chunk in data.chunks(ofCount: holeGranularityBytes) {
-      // If the local layer cache is used, only write chunks that differ
-      // since the base disk can contain anything at any position
-      if let rdisk = rdisk {
-        // F_PUNCHHOLE requires the holes to be aligned to file system block boundaries
-        let isHoleAligned = (offset % fsBlockSize) == 0 && (UInt64(chunk.count) % fsBlockSize) == 0
-
-        if isHoleAligned && chunk == zeroChunk {
-          var arg = fpunchhole_t(fp_flags: 0, reserved: 0, fp_offset: off_t(offset), fp_length: off_t(chunk.count))
-
-          if fcntl(disk.fileDescriptor, F_PUNCHHOLE, &arg) == -1 {
-            let details = Errno(rawValue: errno)
-
-            throw RuntimeError.PullFailed("failed to punch hole: \(details)")
-          }
-        } else {
-          try rdisk.seek(toOffset: offset)
-          let actualContentsOnDisk = try rdisk.read(upToCount: chunk.count)
-
-          if chunk != actualContentsOnDisk {
-            try disk.seek(toOffset: offset)
-            try disk.write(contentsOf: chunk)
-          }
-        }
-
-        offset += UInt64(chunk.count)
-
-        continue
-      }
-
-      // Otherwise, only write chunks that are not zero
-      // since the base disk is created from scratch and
-      // is zeroed via truncate(2)
-      if chunk != zeroChunk {
-        try disk.seek(toOffset: offset)
-        try disk.write(contentsOf: chunk)
-      }
-
-      offset += UInt64(chunk.count)
-    }
-
-    return offset
-  }
-}
--- a/Show More
+++ b/Show More