ghostdock 0.0.11 → 0.0.13

package/dist/cli-reference.md

@@ -255,7 +255,7 @@ The private network: reach your sandboxes by address and name from this machine.
 
 ### `ghostdock network connect`
 
-Put this machine into the private network through one provider: WireGuard and split DNS. Asks for sudo once.
+Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Asks for sudo once.
 
 ```
 ghostdock network connect [provider] [flags]

package/dist/cli.md

@@ -498,6 +498,8 @@ ghostdock network connect helsinki     # or name a provider (name or id)
 ghostdock network ls --org acme        # sandboxes, addresses, names, and what is reachable
 curl http://quiet-harbor.acme.ghostdock.internal:8080/
 open https://quiet-harbor--acme.ghostdock.net:8080/   # in a browser: HTTPS, any port
+open https://quiet-harbor.ghostdock.net:8080/         # the short name, for the connect organization
+ghostdock network connect --org beta   # short names now mean beta's sandboxes
 ghostdock network status
 ghostdock network disconnect
 ```
@@ -513,6 +515,10 @@ ghostdock network disconnect
   may not use answers 403.
 - **Needs `wg-quick`** (`brew install wireguard-tools`, `apt install wireguard-tools`). macOS
   and Linux. On Windows, run the CLI in WSL: then only tools inside WSL reach sandboxes.
+- **Tunnel MTU 1280**, so the tunnel works on networks with a smaller path than 1500 bytes
+  (DS-Lite, VPNs, mobile). A config written before 2026-10-20 has 1420: `network status` and
+  `network ls` then say *This machine's tunnel has MTU 1420, the network now uses 1280*. Run
+  `ghostdock network connect` again; until then TCP works, other large packets can be lost.
 - **One key per machine**, kept in `~/.config/ghostdock/network/`.
   Only the public key is sent. The device belongs to the login it was connected with:
   `ghostdock logout` takes it out of the network, and so does not connecting for 90 days.
@@ -528,6 +534,28 @@ ghostdock network disconnect
   sandbox sees the request from `198.18.0.0`, and your device's address in
   `X-Forwarded-For`. The desktop image's Desktop opens only this way, never on the raw
   address.
+- **Short names** in a browser: `https://<sandbox>.ghostdock.net:<port>` means the sandbox of
+  this machine's organization: the one `network connect` resolved (`--org`, `GHOSTDOCK_ORG`,
+  the default from `organizations use`). `connect` says which; `network status` too, and
+  `network ls` shows a sandbox's short name next to its full one when it is that
+  organization's. With one organization you need nothing else. To use another organization's
+  short names, connect again with `--org <other>`: there is no other way to change it, so a
+  short name never changes meaning behind your back (`cd` into another project does not
+  change it). Full names (`<sandbox>--<org>`) keep working for every organization and never
+  change meaning: use them in scripts, CI, `.env` files and links you share.
+  - **When the organization changes,** each short-name site clears its browser data once
+    (local storage, cache, cookies) before the other organization's sandbox sees a request, so
+    it never reads the first one's data. Cookies are cleared for the whole site, not only the
+    short name: every site under the net domain's registrable domain (`ghostdock.net`: every
+    sandbox app there, full names included; a net domain under the app's domain, as on staging:
+    the Ghostdock app too). `connect` names the site when the organization changes. A tab opened on a short name before the
+    change keeps the old page until you reload it: reload or close those tabs (`connect` says
+    so). The page *Switching organization* is that clearing and reloads by itself; *Clear this
+    site's data* means your browser could not clear it (Safari before 17): clear the site's
+    data in its settings, or use the full name.
+  - Tools may use short names too (`curl https://quiet-harbor.ghostdock.net:8080/`), but a
+    short name in a script means whatever this machine is connected with: prefer the full
+    name.
 - **Browsers use the HTTPS name; tools keep the raw address.** A browser that opens
   `http://quiet-harbor.acme.ghostdock.internal:3000/app` (or the raw IPv6 address) gets a
   `308` to `https://quiet-harbor--acme.ghostdock.net:3000/app`. Any other browser request on

package/dist/index.js

@@ -8588,7 +8588,7 @@ function getCliName(argv = process.argv) {
   return CLI_NAMES.find((name) => name === invoked) ?? "ghostdock";
 }
 // package.json
-var version = "0.0.11";
+var version = "0.0.13";
 var package_default = {
   name: "ghostdock",
   description: "Ghostdock CLI — device login and agent tool invocation from the command line",
@@ -9958,6 +9958,16 @@ function isDnsZone(zone) {
 function isIPv6Address(text) {
   return /^[0-9a-f:]{2,39}$/.test(text) && text.includes(":");
 }
+async function readConfigMtu(path = configPath()) {
+  let contents;
+  try {
+    contents = await readFile3(path, "utf8");
+  } catch {
+    return null;
+  }
+  const match = /^MTU = (\d+)$/m.exec(contents);
+  return match ? Number(match[1]) : null;
+}
 async function writeConfig(contents, path = configPath()) {
   await mkdir3(dirname3(path), { recursive: true, mode: 448 });
   await writeFile3(path, contents, { mode: 384 });
@@ -10060,9 +10070,10 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
     deps.error(`wg-quick exited ${code}. The config is in ${configPath(deps.dir)}.`);
     return 1;
   }
-  const { device, network, provider } = registered;
+  const { device, network, provider, shortNameOrganizationChanged } = registered;
+  const pinned = device.shortNameOrganization;
   const switched = wasUp && previous?.gatewayProvider && previous.gatewayProvider.id !== provider.id ? previous.gatewayProvider : null;
-  printResult({ device, network, provider, interface: INTERFACE, dns }, () => [
+  printResult({ device, network, provider, shortNameOrganizationChanged, interface: INTERFACE, dns }, () => [
     eventLine("done", `Connected through ${provider.name}. This machine is ${device.address} in the private network.`),
     ...switched ? [
       `    Replaced the connection through ${switched.name}: its sandboxes are out of reach now.`
@@ -10070,6 +10081,11 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
     `    Reachable: the sandboxes on ${provider.name}. One provider at a time.`,
     `    Names: <sandbox>.<org>.${network.zone}`,
     ...network.netZone ? [`    In a browser: https://<sandbox>--<org>.${network.netZone}:<port>`] : [],
+    ...network.netZone && pinned ? [
+      `    Short names: https://<sandbox>.${network.netZone}:<port> for ${pinned.slug}'s sandboxes, on this machine.`,
+      `    Another organization: ${getCliName()} network connect --org <org>.`
+    ] : [],
+    ...network.netZone && pinned && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : [],
     ...dns === "none" ? [
       "    No split DNS on this machine (no systemd-resolved): use the addresses from",
       `    \`${getCliName()} network ls\`.`
@@ -10078,6 +10094,15 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
   ], deps.log);
   return 0;
 }
+function clearingNotice(cookieSite) {
+  const site = cookieSite?.site ?? "the net domain";
+  return [
+    "    Short names meant another organization's sandboxes before. The first short-name site each",
+    `    browser opens now clears its data once: the site's storage, and every cookie of ${site}.`,
+    `    That signs the browser out of every site under ${site}${cookieSite?.includesApp ? ", the Ghostdock app included" : ""}.`,
+    "    Reload or close browser tabs opened on short names before this connect."
+  ];
+}
 async function runNetworkDisconnect(deps = defaultDeps()) {
   if (!deps.up()) {
     printResult({ connected: false }, () => [eventLine("item", "Not connected.")], deps.log);
@@ -10095,25 +10120,38 @@ async function readConnection(deps) {
   const state = await readDeviceState(deps.dir);
   const up = deps.up();
   if (!state)
-    return { state, up, device: null, asked: true, provider: null };
+    return { state, up, device: null, asked: true, provider: null, staleMtu: null };
   try {
-    const { devices } = await deps.request("/api/v1/network/devices");
+    const { devices, mtu } = await deps.request("/api/v1/network/devices");
     const device = devices.find((d) => d.id === state.deviceId) ?? null;
+    const config = await readConfigMtu(configPath(deps.dir));
+    const staleMtu = config !== null && config !== mtu ? { config, current: mtu } : null;
+    if (staleMtu) {
+      deps.notice(`This machine's tunnel has MTU ${staleMtu.config}, the network now uses ${staleMtu.current}. ` + `Run \`${getCliName()} network connect\` again: until then, large packets other than TCP ` + "can be lost on the way.");
+    }
     return {
       state,
       up,
       device,
       asked: true,
-      provider: up ? device?.gatewayProvider ?? null : null
+      provider: up ? device?.gatewayProvider ?? null : null,
+      staleMtu
     };
   } catch (err) {
     deps.notice(`Could not ask the app about this device: ${message(err)}`);
-    return { state, up, device: null, asked: false, provider: up ? state.gatewayProvider : null };
+    return {
+      state,
+      up,
+      device: null,
+      asked: false,
+      provider: up ? state.gatewayProvider : null,
+      staleMtu: null
+    };
   }
 }
 async function runNetworkStatus(deps = defaultDeps()) {
-  const { state, up, device, asked, provider } = await readConnection(deps);
-  printResult({ connected: up, device, provider }, () => {
+  const { state, up, device, asked, provider, staleMtu } = await readConnection(deps);
+  printResult({ connected: up, device, provider, staleMtu }, () => {
     if (!state) {
       return [eventLine("item", `Not set up. Run \`${getCliName()} network connect\`.`)];
     }
@@ -10123,6 +10161,9 @@ async function runNetworkStatus(deps = defaultDeps()) {
     ];
     if (device) {
       lines.push(`    Device ${device.name}, valid until ${device.expiresAt.slice(0, 10)}.`);
+      if (device.shortNameOrganization) {
+        lines.push(`    Short names: ${device.shortNameOrganization.slug}'s sandboxes.`);
+      }
       if (!device.gatewayProvider) {
         lines.push(`    Its provider is gone, so no gateway serves it. Run \`${getCliName()} network connect\`.`);
       }
@@ -10146,8 +10187,10 @@ function unreachableNote(sandbox, connected) {
 async function runNetworkLs(args, deps = defaultDeps()) {
   try {
     const organization = await requireOrganizationRef(args.org, deps.notice);
-    const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes`);
-    const connected = (await readConnection(deps)).provider;
+    const connection = await readConnection(deps);
+    const deviceId = connection.device?.id;
+    const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes${deviceId ? `?device=${encodeURIComponent(deviceId)}` : ""}`);
+    const connected = connection.provider;
     const sandboxes = listed.sandboxes.map((sandbox) => ({
       ...sandbox,
       reachable: unreachableNote(sandbox, connected) === null
@@ -10159,6 +10202,7 @@ async function runNetworkLs(args, deps = defaultDeps()) {
       const width = Math.max(...listed.sandboxes.map((s) => s.name.length));
       const canonicalWidth = Math.max(...listed.sandboxes.map((s) => s.canonicalName.length));
       const httpsWidth = Math.max(...listed.sandboxes.map((s) => (s.httpsName?.length ?? 0) + 8));
+      const shortWidth = Math.max(...listed.sandboxes.map((s) => (s.shortName?.length ?? 0) + 8));
       const lines = [
         connected ? eventLine("item", `Connected through ${connected.name}.`) : eventLine("item", `Not connected: nothing is reachable. Run \`${getCliName()} network connect [provider]\`.`)
       ];
@@ -10169,6 +10213,7 @@ async function runNetworkLs(args, deps = defaultDeps()) {
           s.address.padEnd(28),
           s.canonicalName.padEnd(canonicalWidth),
           ...s.httpsName ? [`https://${s.httpsName}`.padEnd(httpsWidth)] : [],
+          ...s.shortName ? [`https://${s.shortName}`.padEnd(shortWidth)] : [],
           s.status,
           ...note ? [`(${note})`] : []
         ].join("  "));
@@ -10207,7 +10252,7 @@ async function runNetworkDevicesRemove(args, deps = defaultDeps()) {
 var connectCommand = defineCommand({
   meta: {
     name: "connect",
-    description: "Put this machine into the private network through one provider: WireGuard and split DNS. Asks for sudo once."
+    description: "Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Asks for sudo once."
   },
   args: {
     provider: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ghostdock",
   "description": "Ghostdock CLI — device login and agent tool invocation from the command line",
-  "version": "0.0.11",
+  "version": "0.0.13",
   "type": "module",
   "bin": {
     "ghostdock": "dist/index.js",