- `/connecttunnelservice <tunnel-name> <wg-quick-config-path>` installs and starts a tunnel from a pending config file.
- `/uninstalltunnelservice <tunnel-name>` stops and removes the tunnel service.

## Linux CLI

Install AmneziaWG tools first so `awg` and `awg-quick` are available. The Linux client stores its API token and private key as `0600` files under the SailCat user config directory.

Build the CLI:

```bash
GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -trimpath -o dist/sailcat ./cmd/sailcat
```

Use it:

```bash
./dist/sailcat signin --server https://vpn.sailcat.space --email user@example.com --password '...'
./dist/sailcat nodes
./dist/sailcat select-node 1
./dist/sailcat connect
./dist/sailcat status
./dist/sailcat disconnect
```

The Linux tunnel interface is `sailcat0`. Connecting writes `sailcat0.conf` with `0600` permissions and runs `sudo awg-quick up <config-path>` when not already root. Disconnecting runs `sudo awg-quick down <config-path>`.

## Linux Tray

Build the tray on Linux with CGO enabled:
