ghostdock 0.0.11 → 0.0.12

package/dist/cli-reference.md

@@ -255,7 +255,7 @@ The private network: reach your sandboxes by address and name from this machine.
 
 ### `ghostdock network connect`
 
-Put this machine into the private network through one provider: WireGuard and split DNS. Asks for sudo once.
+Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Asks for sudo once.
 
 ```
 ghostdock network connect [provider] [flags]

package/dist/cli.md

@@ -498,6 +498,8 @@ ghostdock network connect helsinki     # or name a provider (name or id)
 ghostdock network ls --org acme        # sandboxes, addresses, names, and what is reachable
 curl http://quiet-harbor.acme.ghostdock.internal:8080/
 open https://quiet-harbor--acme.ghostdock.net:8080/   # in a browser: HTTPS, any port
+open https://quiet-harbor.ghostdock.net:8080/         # the short name, for the connect organization
+ghostdock network connect --org beta   # short names now mean beta's sandboxes
 ghostdock network status
 ghostdock network disconnect
 ```
@@ -528,6 +530,28 @@ ghostdock network disconnect
   sandbox sees the request from `198.18.0.0`, and your device's address in
   `X-Forwarded-For`. The desktop image's Desktop opens only this way, never on the raw
   address.
+- **Short names** in a browser: `https://<sandbox>.ghostdock.net:<port>` means the sandbox of
+  this machine's organization: the one `network connect` resolved (`--org`, `GHOSTDOCK_ORG`,
+  the default from `organizations use`). `connect` says which; `network status` too, and
+  `network ls` shows a sandbox's short name next to its full one when it is that
+  organization's. With one organization you need nothing else. To use another organization's
+  short names, connect again with `--org <other>`: there is no other way to change it, so a
+  short name never changes meaning behind your back (`cd` into another project does not
+  change it). Full names (`<sandbox>--<org>`) keep working for every organization and never
+  change meaning: use them in scripts, CI, `.env` files and links you share.
+  - **When the organization changes,** each short-name site clears its browser data once
+    (local storage, cache, cookies) before the other organization's sandbox sees a request, so
+    it never reads the first one's data. Cookies are cleared for the whole site, not only the
+    short name: every site under the net domain's registrable domain (`ghostdock.net`: every
+    sandbox app there, full names included; a net domain under the app's domain, as on staging:
+    the Ghostdock app too). `connect` names the site when the organization changes. A tab opened on a short name before the
+    change keeps the old page until you reload it: reload or close those tabs (`connect` says
+    so). The page *Switching organization* is that clearing and reloads by itself; *Clear this
+    site's data* means your browser could not clear it (Safari before 17): clear the site's
+    data in its settings, or use the full name.
+  - Tools may use short names too (`curl https://quiet-harbor.ghostdock.net:8080/`), but a
+    short name in a script means whatever this machine is connected with: prefer the full
+    name.
 - **Browsers use the HTTPS name; tools keep the raw address.** A browser that opens
   `http://quiet-harbor.acme.ghostdock.internal:3000/app` (or the raw IPv6 address) gets a
   `308` to `https://quiet-harbor--acme.ghostdock.net:3000/app`. Any other browser request on

package/dist/index.js

@@ -8588,7 +8588,7 @@ function getCliName(argv = process.argv) {
   return CLI_NAMES.find((name) => name === invoked) ?? "ghostdock";
 }
 // package.json
-var version = "0.0.11";
+var version = "0.0.12";
 var package_default = {
   name: "ghostdock",
   description: "Ghostdock CLI — device login and agent tool invocation from the command line",
@@ -10060,9 +10060,10 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
     deps.error(`wg-quick exited ${code}. The config is in ${configPath(deps.dir)}.`);
     return 1;
   }
-  const { device, network, provider } = registered;
+  const { device, network, provider, shortNameOrganizationChanged } = registered;
+  const pinned = device.shortNameOrganization;
   const switched = wasUp && previous?.gatewayProvider && previous.gatewayProvider.id !== provider.id ? previous.gatewayProvider : null;
-  printResult({ device, network, provider, interface: INTERFACE, dns }, () => [
+  printResult({ device, network, provider, shortNameOrganizationChanged, interface: INTERFACE, dns }, () => [
     eventLine("done", `Connected through ${provider.name}. This machine is ${device.address} in the private network.`),
     ...switched ? [
       `    Replaced the connection through ${switched.name}: its sandboxes are out of reach now.`
@@ -10070,6 +10071,11 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
     `    Reachable: the sandboxes on ${provider.name}. One provider at a time.`,
     `    Names: <sandbox>.<org>.${network.zone}`,
     ...network.netZone ? [`    In a browser: https://<sandbox>--<org>.${network.netZone}:<port>`] : [],
+    ...network.netZone && pinned ? [
+      `    Short names: https://<sandbox>.${network.netZone}:<port> for ${pinned.slug}'s sandboxes, on this machine.`,
+      `    Another organization: ${getCliName()} network connect --org <org>.`
+    ] : [],
+    ...network.netZone && pinned && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : [],
     ...dns === "none" ? [
       "    No split DNS on this machine (no systemd-resolved): use the addresses from",
       `    \`${getCliName()} network ls\`.`
@@ -10078,6 +10084,15 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
   ], deps.log);
   return 0;
 }
+function clearingNotice(cookieSite) {
+  const site = cookieSite?.site ?? "the net domain";
+  return [
+    "    Short names meant another organization's sandboxes before. The first short-name site each",
+    `    browser opens now clears its data once: the site's storage, and every cookie of ${site}.`,
+    `    That signs the browser out of every site under ${site}${cookieSite?.includesApp ? ", the Ghostdock app included" : ""}.`,
+    "    Reload or close browser tabs opened on short names before this connect."
+  ];
+}
 async function runNetworkDisconnect(deps = defaultDeps()) {
   if (!deps.up()) {
     printResult({ connected: false }, () => [eventLine("item", "Not connected.")], deps.log);
@@ -10123,6 +10138,9 @@ async function runNetworkStatus(deps = defaultDeps()) {
     ];
     if (device) {
       lines.push(`    Device ${device.name}, valid until ${device.expiresAt.slice(0, 10)}.`);
+      if (device.shortNameOrganization) {
+        lines.push(`    Short names: ${device.shortNameOrganization.slug}'s sandboxes.`);
+      }
       if (!device.gatewayProvider) {
         lines.push(`    Its provider is gone, so no gateway serves it. Run \`${getCliName()} network connect\`.`);
       }
@@ -10146,8 +10164,10 @@ function unreachableNote(sandbox, connected) {
 async function runNetworkLs(args, deps = defaultDeps()) {
   try {
     const organization = await requireOrganizationRef(args.org, deps.notice);
-    const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes`);
-    const connected = (await readConnection(deps)).provider;
+    const connection = await readConnection(deps);
+    const deviceId = connection.device?.id;
+    const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes${deviceId ? `?device=${encodeURIComponent(deviceId)}` : ""}`);
+    const connected = connection.provider;
     const sandboxes = listed.sandboxes.map((sandbox) => ({
       ...sandbox,
       reachable: unreachableNote(sandbox, connected) === null
@@ -10159,6 +10179,7 @@ async function runNetworkLs(args, deps = defaultDeps()) {
       const width = Math.max(...listed.sandboxes.map((s) => s.name.length));
       const canonicalWidth = Math.max(...listed.sandboxes.map((s) => s.canonicalName.length));
       const httpsWidth = Math.max(...listed.sandboxes.map((s) => (s.httpsName?.length ?? 0) + 8));
+      const shortWidth = Math.max(...listed.sandboxes.map((s) => (s.shortName?.length ?? 0) + 8));
       const lines = [
         connected ? eventLine("item", `Connected through ${connected.name}.`) : eventLine("item", `Not connected: nothing is reachable. Run \`${getCliName()} network connect [provider]\`.`)
       ];
@@ -10169,6 +10190,7 @@ async function runNetworkLs(args, deps = defaultDeps()) {
           s.address.padEnd(28),
           s.canonicalName.padEnd(canonicalWidth),
           ...s.httpsName ? [`https://${s.httpsName}`.padEnd(httpsWidth)] : [],
+          ...s.shortName ? [`https://${s.shortName}`.padEnd(shortWidth)] : [],
           s.status,
           ...note ? [`(${note})`] : []
         ].join("  "));
@@ -10207,7 +10229,7 @@ async function runNetworkDevicesRemove(args, deps = defaultDeps()) {
 var connectCommand = defineCommand({
   meta: {
     name: "connect",
-    description: "Put this machine into the private network through one provider: WireGuard and split DNS. Asks for sudo once."
+    description: "Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Asks for sudo once."
   },
   args: {
     provider: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ghostdock",
   "description": "Ghostdock CLI — device login and agent tool invocation from the command line",
-  "version": "0.0.11",
+  "version": "0.0.12",
   "type": "module",
   "bin": {
     "ghostdock": "dist/index.js",