ghostdock 0.0.15 → 0.0.17

package/dist/cli-reference.md

@@ -259,7 +259,7 @@ The private network: reach your sandboxes by address and name from this machine.
 
 ### `ghostdock network connect`
 
-Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Asks for sudo once.
+Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Also re-arms a paused device: with the tunnel up and nothing changed, without sudo.
 
 ```
 ghostdock network connect [provider] [flags]
@@ -292,7 +292,7 @@ ghostdock network devices remove <id>
 
 ### `ghostdock network disconnect`
 
-Take this machine out of the private network.
+Take this machine out of the private network, and remove split DNS an earlier connection left (macOS).
 
 ```
 ghostdock network disconnect
@@ -942,6 +942,7 @@ ghostdock sandboxes create --source <object> [flags]
 | `--sandbox-provider-id <string>` | Configured sandbox-provider instance id from providers list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new sandboxes and has it is used. When no provider fits, the call fails with a not-configured error. |
 | `--environment <object>` | Environment to give this sandbox. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: sandbox-only variables/secrets to create with the sandbox (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a sandbox gets nothing unless listed here. (JSON object) |
 | `--ephemeral` | Mark the sandbox ephemeral: every stop destroys the machine and the next start boots fresh, while the record, URLs, and settings stay. Omit to use the image label ghostdock.ephemeral, or false when that label is absent. Does not change idle-stop or auto-delete. |
+| `--image-base <string>` | How the disk is made for one of Ghostdock's VM images: auto (default) clones the host's image base, a disk with the image already on it, when there is one; off always starts from an empty disk that pulls the image. For tests and comparisons; other images always start empty. |
 | `--urls <array>` | Changes to the image’s or snapshot’s URLs, keyed by port. Omit for the image URLs as they are; otherwise you get the image URLs plus yours: an entry on the same port replaces that URL completely (omitted fields take their defaults), and { port, remove: true } drops it; removing a port the image does not declare does nothing. A required port cannot be removed. TCP URLs are always public. (JSON array) |
 | `--mcps <array>` | Changes to the image’s or snapshot’s MCP exposures, keyed by name. Omit for the image MCPs as they are; otherwise you get the image MCPs plus yours: an entry with the same name replaces that MCP completely, and { name, remove: true } drops it; removing a name the image does not declare does nothing. A required MCP (requiredMcps) cannot be removed. (JSON array) |
 
@@ -1106,6 +1107,8 @@ ghostdock sandboxes files upload <sandbox-id> [path] [flags]
 | --- | --- |
 | `<sandbox-id>` | Sandbox name or id. Required. |
 | `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--container <value>` | Container the files land in, by name, from `ghostdock sandboxes containers list`. Default: the sandbox's default container, else the one running container. |
+| `--start` | Start the container first when it is not running, without asking. |
 | `--zip <value>` | Local ZIP file to upload. |
 | `<path>` | File or directory to upload (additional paths are allowed). |
 

package/dist/cli.md

@@ -451,11 +451,16 @@ multiple files, or a large ZIP, use the dedicated multipart upload command inste
 ghostdock sandboxes files upload quiet-harbor ./dist
 ghostdock sandboxes files upload quiet-harbor ./index.html ./assets
 ghostdock sandboxes files upload quiet-harbor --zip ./site.zip
+ghostdock sandboxes files upload quiet-harbor ./dist --container web --start
 ```
 
 Each positional path may be a file or directory. Directory contents are uploaded recursively,
 preserving their relative paths; a file is uploaded by its basename. A `sandboxes files upload` call needs
 at least one path or `--zip`. Uploading to a stopped sandbox resumes it automatically.
+The files land in a container as the other `files` commands do (see
+[Containers in a sandbox](#containers-in-a-sandbox)): `--container <name>`, else the default,
+else the one running, and the CLI asks which one when it cannot tell. A stopped target container
+is started after a "Start it?" at the keyboard, or at once with `--start`.
 
 ### `ghostdock env`
 
@@ -602,8 +607,30 @@ ghostdock network disconnect
     (`iptables -A INPUT`, an nft `hook input` chain): `FORWARD` and `DOCKER-USER` rules no
     longer see them, because the guard connects to a published container port from inside
     the VM.
-- `ghostdock network devices` lists your devices, `ghostdock network devices remove <id>`
-  removes one.
+- **The network pause** ([ADR 0033](../../docs/adr/0033-gdo-net-dead-mans-switch.md)): a
+  device that sent no traffic to a sandbox for its idle timeout (default 4 h), or whose session
+  since the last connect reached its maximum (default 12 h), is paused at the gateway. Your
+  organizations set both (Settings → Security). If you are in several, the strictest value
+  applies. `connect` ends with this device's own numbers and names the organization that set a
+  stricter one.
+  - **While paused**, names still resolve, but every port of a sandbox answers `Connection
+    refused`, and UDP and ping get *administratively prohibited*. Browsers get a pause page
+    with a *Reconnect* button, and Docker gets `Ghostdock: network access for this device is
+    paused (idle 4 h)`. Every `ghostdock` command prints `! Network access for this device is
+    paused (…). Run: ghostdock network connect` once.
+  - **To resume**, run `ghostdock network connect`, or click *Reconnect* in the web app (User
+    settings → Network devices). With the tunnel up and nothing changed, `connect` only
+    re-arms: no sudo, *Re-armed: network access for this device runs until 22:14 (pauses after
+    4 h idle).* *Pause now* in the web app pauses a device at once.
+  - DNS, WireGuard keepalives and ping do not count as traffic. A long stream does (a `docker
+    logs -f`, an open desktop tab).
+- `ghostdock network devices` lists your devices with their state (*Active, pauses in 3 h 12
+  min*, *Paused: idle 4 h*, *Paused: 12 h session limit*, *Paused by you*, *Not connected
+  (…)*). `ghostdock network devices remove <id>` removes one.
+- **`ghostdock network disconnect`** also removes the split-DNS files a reboot or a crashed
+  `wg-quick` left on macOS (`/etc/resolver/<zone>`), even when the tunnel is already down.
+  Without that, names of the private network hang while you are disconnected. `network status`
+  says when such a file is still there.
 
 ## Command index
 
@@ -658,7 +685,7 @@ or read [`cli-reference.md`](cli-reference.md) for every command's full descript
 | `ghostdock network connect [provider] [flags]` | Put this machine into the private network through one provider: WireGuard and… |
 | `ghostdock network devices <command>` | Your devices in the private network. |
 | `ghostdock network devices remove <id>` | Remove one of your devices from the private network. |
-| `ghostdock network disconnect` | Take this machine out of the private network. |
+| `ghostdock network disconnect` | Take this machine out of the private network, and remove split DNS an earlier… |
 | `ghostdock network ls [flags]` | Sandboxes of an organization with their private addresses and names, and which… |
 | `ghostdock network status` | Whether this machine is connected, through which provider, and as which device. |