ghostdock 0.0.16 → 0.0.17

package/dist/cli-reference.md

@@ -259,7 +259,7 @@ The private network: reach your sandboxes by address and name from this machine.
 
 ### `ghostdock network connect`
 
-Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Asks for sudo once.
+Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Also re-arms a paused device: with the tunnel up and nothing changed, without sudo.
 
 ```
 ghostdock network connect [provider] [flags]
@@ -292,7 +292,7 @@ ghostdock network devices remove <id>
 
 ### `ghostdock network disconnect`
 
-Take this machine out of the private network.
+Take this machine out of the private network, and remove split DNS an earlier connection left (macOS).
 
 ```
 ghostdock network disconnect
@@ -942,6 +942,7 @@ ghostdock sandboxes create --source <object> [flags]
 | `--sandbox-provider-id <string>` | Configured sandbox-provider instance id from providers list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new sandboxes and has it is used. When no provider fits, the call fails with a not-configured error. |
 | `--environment <object>` | Environment to give this sandbox. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: sandbox-only variables/secrets to create with the sandbox (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a sandbox gets nothing unless listed here. (JSON object) |
 | `--ephemeral` | Mark the sandbox ephemeral: every stop destroys the machine and the next start boots fresh, while the record, URLs, and settings stay. Omit to use the image label ghostdock.ephemeral, or false when that label is absent. Does not change idle-stop or auto-delete. |
+| `--image-base <string>` | How the disk is made for one of Ghostdock's VM images: auto (default) clones the host's image base, a disk with the image already on it, when there is one; off always starts from an empty disk that pulls the image. For tests and comparisons; other images always start empty. |
 | `--urls <array>` | Changes to the image’s or snapshot’s URLs, keyed by port. Omit for the image URLs as they are; otherwise you get the image URLs plus yours: an entry on the same port replaces that URL completely (omitted fields take their defaults), and { port, remove: true } drops it; removing a port the image does not declare does nothing. A required port cannot be removed. TCP URLs are always public. (JSON array) |
 | `--mcps <array>` | Changes to the image’s or snapshot’s MCP exposures, keyed by name. Omit for the image MCPs as they are; otherwise you get the image MCPs plus yours: an entry with the same name replaces that MCP completely, and { name, remove: true } drops it; removing a name the image does not declare does nothing. A required MCP (requiredMcps) cannot be removed. (JSON array) |
 

package/dist/cli.md

@@ -607,8 +607,30 @@ ghostdock network disconnect
     (`iptables -A INPUT`, an nft `hook input` chain): `FORWARD` and `DOCKER-USER` rules no
     longer see them, because the guard connects to a published container port from inside
     the VM.
-- `ghostdock network devices` lists your devices, `ghostdock network devices remove <id>`
-  removes one.
+- **The network pause** ([ADR 0033](../../docs/adr/0033-gdo-net-dead-mans-switch.md)): a
+  device that sent no traffic to a sandbox for its idle timeout (default 4 h), or whose session
+  since the last connect reached its maximum (default 12 h), is paused at the gateway. Your
+  organizations set both (Settings → Security). If you are in several, the strictest value
+  applies. `connect` ends with this device's own numbers and names the organization that set a
+  stricter one.
+  - **While paused**, names still resolve, but every port of a sandbox answers `Connection
+    refused`, and UDP and ping get *administratively prohibited*. Browsers get a pause page
+    with a *Reconnect* button, and Docker gets `Ghostdock: network access for this device is
+    paused (idle 4 h)`. Every `ghostdock` command prints `! Network access for this device is
+    paused (…). Run: ghostdock network connect` once.
+  - **To resume**, run `ghostdock network connect`, or click *Reconnect* in the web app (User
+    settings → Network devices). With the tunnel up and nothing changed, `connect` only
+    re-arms: no sudo, *Re-armed: network access for this device runs until 22:14 (pauses after
+    4 h idle).* *Pause now* in the web app pauses a device at once.
+  - DNS, WireGuard keepalives and ping do not count as traffic. A long stream does (a `docker
+    logs -f`, an open desktop tab).
+- `ghostdock network devices` lists your devices with their state (*Active, pauses in 3 h 12
+  min*, *Paused: idle 4 h*, *Paused: 12 h session limit*, *Paused by you*, *Not connected
+  (…)*). `ghostdock network devices remove <id>` removes one.
+- **`ghostdock network disconnect`** also removes the split-DNS files a reboot or a crashed
+  `wg-quick` left on macOS (`/etc/resolver/<zone>`), even when the tunnel is already down.
+  Without that, names of the private network hang while you are disconnected. `network status`
+  says when such a file is still there.
 
 ## Command index
 
@@ -663,7 +685,7 @@ or read [`cli-reference.md`](cli-reference.md) for every command's full descript
 | `ghostdock network connect [provider] [flags]` | Put this machine into the private network through one provider: WireGuard and… |
 | `ghostdock network devices <command>` | Your devices in the private network. |
 | `ghostdock network devices remove <id>` | Remove one of your devices from the private network. |
-| `ghostdock network disconnect` | Take this machine out of the private network. |
+| `ghostdock network disconnect` | Take this machine out of the private network, and remove split DNS an earlier… |
 | `ghostdock network ls [flags]` | Sandboxes of an organization with their private addresses and names, and which… |
 | `ghostdock network status` | Whether this machine is connected, through which provider, and as which device. |
 

package/dist/index.js

@@ -863,6 +863,14 @@ var GENERATED_TOOL_CATALOG = [
           description: "Mark the sandbox ephemeral: every stop destroys the machine and the next start boots fresh, while the record, URLs, and settings stay. Omit to use the image label ghostdock.ephemeral, or false when that label is absent. Does not change idle-stop or auto-delete.",
           type: "boolean"
         },
+        imageBase: {
+          description: "How the disk is made for one of Ghostdock's VM images: auto (default) clones the host's image base, a disk with the image already on it, when there is one; off always starts from an empty disk that pulls the image. For tests and comparisons; other images always start empty.",
+          type: "string",
+          enum: [
+            "auto",
+            "off"
+          ]
+        },
         urls: {
           description: "Changes to the image’s or snapshot’s URLs, keyed by port. Omit for the image URLs as they are; otherwise you get the image URLs plus yours: an entry on the same port replaces that URL completely (omitted fields take their defaults), and { port, remove: true } drops it; removing a port the image does not declare does nothing. A required port cannot be removed. TCP URLs are always public.",
           maxItems: 100,
@@ -9176,7 +9184,7 @@ function getCliName(argv = process.argv) {
   return CLI_NAMES.find((name) => name === invoked) ?? "ghostdock";
 }
 // package.json
-var version = "0.0.16";
+var version = "0.0.17";
 var package_default = {
   name: "ghostdock",
   description: "Ghostdock CLI — device login and agent tool invocation from the command line",
@@ -9284,6 +9292,376 @@ async function clearCredentials(path = getCredentialsPath()) {
   await rm(path, { force: true });
 }
 
+// ../../shared/lib/private-network-pause.ts
+function formatPauseLimit(seconds) {
+  const minutes = Math.max(1, Math.round(seconds / 60));
+  if (minutes >= 2 * 1440 && minutes % 1440 === 0)
+    return `${minutes / 1440} days`;
+  const hours = Math.floor(minutes / 60);
+  const rest = minutes % 60;
+  if (hours === 0)
+    return `${rest} min`;
+  return rest === 0 ? `${hours} h` : `${hours} h ${rest} min`;
+}
+function devicePauseReasonText(reason, limits) {
+  switch (reason) {
+    case "idle":
+      return `idle ${formatPauseLimit(limits.idleTimeoutSeconds)}`;
+    case "max_session":
+      return `${formatPauseLimit(limits.maxSessionSeconds)} session limit`;
+    case "manual":
+      return "paused in the web app";
+  }
+}
+
+// src/output.ts
+var SYMBOLS = {
+  ready: "⚓",
+  done: "✓",
+  url: "↗",
+  stopped: "◌",
+  failed: "✗",
+  progress: "▂▄▆",
+  item: "•"
+};
+var jsonOutput = false;
+function setJsonOutput(on) {
+  jsonOutput = on;
+}
+function isJsonOutput() {
+  return jsonOutput;
+}
+function colorEnabled(stream, env = process.env) {
+  if (env.FORCE_COLOR !== undefined)
+    return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "false";
+  if (env.NO_COLOR !== undefined && env.NO_COLOR !== "")
+    return false;
+  if (env.TERM === "dumb")
+    return false;
+  return stream.isTTY === true;
+}
+function trueColor(env = process.env) {
+  return env.COLORTERM === "truecolor" || env.COLORTERM === "24bit";
+}
+function accent(text, enabled) {
+  if (!enabled)
+    return text;
+  const open = trueColor() ? "\x1B[38;2;124;255;203m" : "\x1B[38;5;122m";
+  return `${open}${text}\x1B[39m`;
+}
+function red(text, enabled) {
+  return enabled ? `\x1B[31m${text}\x1B[39m` : text;
+}
+function dim(text, enabled) {
+  return enabled ? `\x1B[2m${text}\x1B[22m` : text;
+}
+function eventLine(symbol, message, color = colorEnabled(process.stdout)) {
+  return `  ${accent(SYMBOLS[symbol], color)} ${message}`;
+}
+function errorLine(message, color = colorEnabled(process.stderr)) {
+  return red(`  ${SYMBOLS.failed} ${message}`, color);
+}
+function printNotice(message) {
+  process.stderr.write(`${message}
+`);
+}
+function printError(message) {
+  process.stderr.write(`${errorLine(message)}
+`);
+}
+function printResult(data, human, log = console.log) {
+  if (jsonOutput) {
+    log(JSON.stringify(data, null, 2));
+    return;
+  }
+  for (const line of human())
+    log(line);
+}
+
+// src/network/pause.ts
+var DEVICE_HEADER = "ghostdock-device";
+var DEVICE_STATE_HEADER = "ghostdock-device-state";
+function parseDeviceStateHeader(value) {
+  if (!value)
+    return null;
+  const [state, ...params] = value.split(";").map((part) => part.trim());
+  if (state !== "paused")
+    return null;
+  const fields = new Map(params.map((param) => {
+    const [key, ...rest] = param.split("=");
+    return [key?.trim() ?? "", rest.join("=").trim()];
+  }));
+  const reason = fields.get("reason");
+  if (reason !== "idle" && reason !== "max_session" && reason !== "manual")
+    return null;
+  const limit = Number(fields.get("limit"));
+  return { reason, limitSeconds: Number.isInteger(limit) && limit > 0 ? limit : null };
+}
+function pausedNotice(paused) {
+  const limit = paused.limitSeconds ?? 0;
+  const why = paused.reason === "manual" || limit > 0 ? ` (${devicePauseReasonText(paused.reason, { idleTimeoutSeconds: limit, maxSessionSeconds: limit })})` : "";
+  return `Network access for this device is paused${why}. Run: ${getCliName()} network connect`;
+}
+var noticeShown = false;
+var noticeSuppressed = false;
+function notePausedDevice(header, write = (line) => process.stderr.write(`${line}
+`)) {
+  if (noticeShown || noticeSuppressed)
+    return;
+  const paused = parseDeviceStateHeader(header);
+  if (!paused)
+    return;
+  noticeShown = true;
+  write(`! ${pausedNotice(paused)}`);
+}
+function suppressPausedNotice() {
+  noticeSuppressed = true;
+}
+function clockTime(iso, now = new Date) {
+  const at = new Date(iso);
+  const time = at.toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit" });
+  if (at.toDateString() === now.toDateString())
+    return time;
+  return `${at.toLocaleDateString("en-GB", { weekday: "short" })} ${time}`;
+}
+function setBy(slug) {
+  return slug ? `, set by ${slug}` : "";
+}
+function pauseHint(state, now = new Date) {
+  const idle = `after ${formatPauseLimit(state.idleTimeoutSeconds)} without traffic${setBy(state.setBy.idle)}`;
+  const sessionEnd = sessionEndsAt(state, now);
+  const session = `${formatPauseLimit(state.maxSessionSeconds)} after connecting${sessionEnd ? ` (at ${clockTime(sessionEnd, now)})` : ""}${setBy(state.setBy.maxSession)}`;
+  return [
+    "ℹ  For security, this device's network access pauses automatically:",
+    `   ${idle}, and ${session}.`,
+    `   Resume any time: ${getCliName()} network connect, or Reconnect in the web app.`
+  ];
+}
+function sessionEndsAt(state, now) {
+  if (state.status !== "active" || !state.pausesAt)
+    return null;
+  if (state.pauseCause === "max_session")
+    return state.pausesAt;
+  return new Date(now.getTime() + state.maxSessionSeconds * 1000).toISOString();
+}
+function bold2(text, enabled = colorEnabled(process.stderr)) {
+  return enabled ? `\x1B[1m${text}\x1B[22m` : text;
+}
+function deviceStateText(state, now = new Date) {
+  if (!state)
+    return "Not connected (logged out)";
+  if (state.status === "paused" && state.pauseReason) {
+    const text = state.pauseReason === "manual" ? "Paused by you" : `Paused: ${devicePauseReasonText(state.pauseReason, state)}`;
+    return state.connected ? text : `Not connected (${text.toLowerCase()})`;
+  }
+  const left = state.pausesAt ? new Date(state.pausesAt).getTime() - now.getTime() : 0;
+  const active = `Active, pauses in ${formatRemaining(Math.max(left, 0) / 1000)}`;
+  return state.connected ? active : `Not connected (armed, pauses in ${formatRemaining(Math.max(left, 0) / 1000)})`;
+}
+function formatRemaining(seconds) {
+  const minutes = Math.floor(seconds / 60);
+  const days = Math.floor(minutes / 1440);
+  const hours = Math.floor(minutes % 1440 / 60);
+  const rest = minutes % 60;
+  const dayText = days === 1 ? "1 day" : `${days} days`;
+  if (days > 0)
+    return hours ? `${dayText} ${hours} h` : dayText;
+  if (hours > 0)
+    return rest ? `${hours} h ${rest} min` : `${hours} h`;
+  return `${Math.max(rest, 1)} min`;
+}
+
+// src/network/tunnel.ts
+import { createPrivateKey, createPublicKey, generateKeyPairSync } from "node:crypto";
+import { existsSync } from "node:fs";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2, join as join2 } from "node:path";
+var INTERFACE = "gdock";
+function networkDir() {
+  return join2(getConfigDir(), "network");
+}
+function configPath(dir = networkDir()) {
+  return join2(dir, `${INTERFACE}.conf`);
+}
+function keyPath(dir) {
+  return join2(dir, "private.key");
+}
+function statePath(dir) {
+  return join2(dir, "device.json");
+}
+function isProvider(value) {
+  const provider = value;
+  return typeof provider?.id === "string" && typeof provider.name === "string";
+}
+var X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
+function keyPairFromPrivate(privateKey) {
+  const raw = Buffer.from(privateKey, "base64");
+  if (raw.length !== 32)
+    throw new Error("The stored WireGuard key is not 32 bytes.");
+  const key = createPrivateKey({
+    key: Buffer.concat([X25519_PKCS8_PREFIX, raw]),
+    format: "der",
+    type: "pkcs8"
+  });
+  const spki = createPublicKey(key).export({ format: "der", type: "spki" });
+  return { privateKey, publicKey: spki.subarray(spki.length - 32).toString("base64") };
+}
+async function loadOrCreateKey(dir = networkDir()) {
+  try {
+    return keyPairFromPrivate((await readFile2(keyPath(dir), "utf8")).trim());
+  } catch (err) {
+    if (err.code !== "ENOENT")
+      throw err;
+  }
+  const { privateKey } = generateKeyPairSync("x25519");
+  const der = privateKey.export({ format: "der", type: "pkcs8" });
+  const raw = der.subarray(der.length - 32).toString("base64");
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await writeFile2(keyPath(dir), `${raw}
+`, { mode: 384 });
+  return keyPairFromPrivate(raw);
+}
+async function readDeviceState(dir = networkDir()) {
+  try {
+    const parsed = JSON.parse(await readFile2(statePath(dir), "utf8"));
+    if (typeof parsed.deviceId === "string" && typeof parsed.baseUrl === "string") {
+      return {
+        baseUrl: parsed.baseUrl,
+        deviceId: parsed.deviceId,
+        address: typeof parsed.address === "string" ? parsed.address : "",
+        gatewayProvider: isProvider(parsed.gatewayProvider) ? { id: parsed.gatewayProvider.id, name: parsed.gatewayProvider.name } : null,
+        zones: Array.isArray(parsed.zones) ? parsed.zones.filter((zone) => typeof zone === "string" && isDnsZone(zone)) : []
+      };
+    }
+  } catch {}
+  return null;
+}
+async function writeDeviceState(state, dir = networkDir()) {
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await writeFile2(statePath(dir), `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+}
+function detectDnsMode(platform = process.platform, exists = existsSync) {
+  if (platform === "darwin")
+    return "macos-resolver";
+  if (platform === "linux" && exists("/run/systemd/resolve"))
+    return "resolved";
+  return "none";
+}
+function renderConfig(input) {
+  const { device, network, gateway } = input.registered;
+  const zones = [network.zone, ...network.netZone ? [network.netZone] : []];
+  for (const zone of zones) {
+    if (!isDnsZone(zone))
+      throw new Error(`The server sent a zone that is not a DNS name: ${zone}`);
+  }
+  if (!device.address || !isIPv6Address(device.address)) {
+    throw new Error(`The server sent no IPv6 address for this device: ${device.address}`);
+  }
+  if (!isIPv6Address(network.gatewayAddress)) {
+    throw new Error(`The server sent a gateway that is not an IPv6 address: ${network.gatewayAddress}`);
+  }
+  const ipv4 = device.address4 && network.ingress4 ? { address: device.address4, ingress: network.ingress4 } : null;
+  if (ipv4 && (!isIPv4Address(ipv4.address) || !isIPv4Address(ipv4.ingress))) {
+    throw new Error(`The server sent an IPv4 address that is not one: ${ipv4.address}, ${ipv4.ingress}`);
+  }
+  const lines = [
+    "# Written by `ghostdock network connect`. Run it again rather than editing this file.",
+    "[Interface]",
+    `PrivateKey = ${input.privateKey}`,
+    `Address = ${device.address}/128${ipv4 ? `, ${ipv4.address}/32` : ""}`,
+    `MTU = ${network.mtu}`
+  ];
+  if (input.dns === "macos-resolver") {
+    for (const zone of zones) {
+      const file = `/etc/resolver/${zone}`;
+      lines.push(`PostUp = mkdir -p /etc/resolver && printf 'nameserver ${network.gatewayAddress}\\n' > ${file}`, `PostDown = rm -f ${file}`);
+    }
+  } else if (input.dns === "resolved") {
+    const domains = zones.map((zone) => `'~${zone}'`).join(" ");
+    lines.push(`PostUp = resolvectl dns %i ${network.gatewayAddress} && resolvectl domain %i ${domains}`);
+  }
+  lines.push("", "[Peer]", `PublicKey = ${gateway.publicKey}`, `Endpoint = ${gateway.endpoint}`, `AllowedIPs = ${network.prefix}${ipv4 ? `, ${ipv4.ingress}/32` : ""}`, "PersistentKeepalive = 25", "");
+  return lines.join(`
+`);
+}
+var DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function isDnsZone(zone) {
+  const labels = zone.split(".");
+  return zone.length <= 253 && labels.length >= 2 && labels.every((label) => DNS_LABEL.test(label));
+}
+function isIPv4Address(text) {
+  return /^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}$/.test(text);
+}
+function ipv4RouteOwner(platform, output) {
+  if (platform === "darwin") {
+    if (/^\s*destination: default$/m.test(output))
+      return null;
+    return /^\s*interface: (\S+)$/m.exec(output)?.[1] ?? null;
+  }
+  for (const line of output.split(`
+`).map((l) => l.trim())) {
+    if (!line || /^(default|broadcast)\b/.test(line))
+      continue;
+    return /\bdev (\S+)/.exec(line)?.[1] ?? "another route";
+  }
+  return null;
+}
+function ipv4RouteCommand(platform, address) {
+  return platform === "darwin" ? ["route", ["-n", "get", address]] : ["ip", ["-4", "route", "show", "table", "all", "match", address]];
+}
+function isIPv6Address(text) {
+  return /^[0-9a-f:]{2,39}$/.test(text) && text.includes(":");
+}
+async function readConfig(path = configPath()) {
+  try {
+    return await readFile2(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function configResolverZones(config) {
+  if (!config)
+    return [];
+  const zones = [];
+  for (const match of config.matchAll(/^PostDown = rm -f \/etc\/resolver\/(\S+)$/gm)) {
+    const zone = match[1] ?? "";
+    if (isDnsZone(zone) && !zones.includes(zone))
+      zones.push(zone);
+  }
+  return zones;
+}
+function resolverFile(zone) {
+  return `/etc/resolver/${zone}`;
+}
+async function readConfigMtu(path = configPath()) {
+  let contents;
+  try {
+    contents = await readFile2(path, "utf8");
+  } catch {
+    return null;
+  }
+  const match = /^MTU = (\d+)$/m.exec(contents);
+  return match ? Number(match[1]) : null;
+}
+async function writeConfig(contents, path = configPath()) {
+  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+  await writeFile2(path, contents, { mode: 384 });
+  await chmod2(path, 384);
+}
+function tunnelUp(platform = process.platform, exists = existsSync) {
+  if (platform === "darwin")
+    return exists(`/var/run/wireguard/${INTERFACE}.name`);
+  return exists(`/sys/class/net/${INTERFACE}`);
+}
+function installHint(platform = process.platform) {
+  if (platform === "darwin")
+    return "brew install wireguard-tools";
+  if (platform === "linux")
+    return "sudo apt install wireguard-tools (or your distribution’s package)";
+  return "Install wireguard-tools. On Windows, run the CLI inside WSL.";
+}
+
 // src/api-client.ts
 var CLI_USER_AGENT = `ghostdock-cli/${version}`;
 
@@ -9325,6 +9703,7 @@ async function request(path, init = {}) {
       ...init.headers
     }
   });
+  notePausedDevice(res.headers.get(DEVICE_STATE_HEADER));
   if (!res.ok) {
     const payload = await readErrorPayload(res);
     throw new ApiError(res.status, payload.message, payload.data);
@@ -9356,6 +9735,11 @@ function deviceRevoke(body) {
     body: JSON.stringify(body)
   });
 }
+var deviceIdOnce = null;
+function currentDeviceId() {
+  deviceIdOnce ??= readDeviceState().then((state) => state && state.baseUrl === getBaseUrl() ? state.deviceId : null).catch(() => null);
+  return deviceIdOnce;
+}
 var refreshInFlight = null;
 async function refreshStoredCredentials(refreshToken) {
   if (refreshInFlight)
@@ -9378,10 +9762,12 @@ async function authorizedRequest(path, init = {}) {
   if (!credentials) {
     throw new AuthRequiredError;
   }
+  const deviceId = await currentDeviceId();
   const withAuth = (accessToken) => ({
     ...init,
     headers: {
       ...init.headers,
+      ...deviceId ? { [DEVICE_HEADER]: deviceId } : {},
       authorization: `Bearer ${accessToken}`
     }
   });
@@ -9405,75 +9791,11 @@ async function authorizedRequest(path, init = {}) {
   }
 }
 
-// src/output.ts
-var SYMBOLS = {
-  ready: "⚓",
-  done: "✓",
-  url: "↗",
-  stopped: "◌",
-  failed: "✗",
-  progress: "▂▄▆",
-  item: "•"
-};
-var jsonOutput = false;
-function setJsonOutput(on) {
-  jsonOutput = on;
-}
-function isJsonOutput() {
-  return jsonOutput;
-}
-function colorEnabled(stream, env = process.env) {
-  if (env.FORCE_COLOR !== undefined)
-    return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "false";
-  if (env.NO_COLOR !== undefined && env.NO_COLOR !== "")
-    return false;
-  if (env.TERM === "dumb")
-    return false;
-  return stream.isTTY === true;
-}
-function trueColor(env = process.env) {
-  return env.COLORTERM === "truecolor" || env.COLORTERM === "24bit";
-}
-function accent(text, enabled) {
-  if (!enabled)
-    return text;
-  const open = trueColor() ? "\x1B[38;2;124;255;203m" : "\x1B[38;5;122m";
-  return `${open}${text}\x1B[39m`;
-}
-function red(text, enabled) {
-  return enabled ? `\x1B[31m${text}\x1B[39m` : text;
-}
-function dim(text, enabled) {
-  return enabled ? `\x1B[2m${text}\x1B[22m` : text;
-}
-function eventLine(symbol, message, color = colorEnabled(process.stdout)) {
-  return `  ${accent(SYMBOLS[symbol], color)} ${message}`;
-}
-function errorLine(message, color = colorEnabled(process.stderr)) {
-  return red(`  ${SYMBOLS.failed} ${message}`, color);
-}
-function printNotice(message) {
-  process.stderr.write(`${message}
-`);
-}
-function printError(message) {
-  process.stderr.write(`${errorLine(message)}
-`);
-}
-function printResult(data, human, log = console.log) {
-  if (jsonOutput) {
-    log(JSON.stringify(data, null, 2));
-    return;
-  }
-  for (const line of human())
-    log(line);
-}
-
 // src/settings.ts
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname3, join as join3 } from "node:path";
 function getSettingsPath() {
-  return join2(dirname2(getCredentialsPath()), "settings.json");
+  return join3(dirname3(getCredentialsPath()), "settings.json");
 }
 function isDefaultOrganization(value) {
   if (!value || typeof value !== "object")
@@ -9483,15 +9805,15 @@ function isDefaultOrganization(value) {
 }
 async function readSettings(path = getSettingsPath()) {
   try {
-    const parsed = JSON.parse(await readFile2(path, "utf8"));
+    const parsed = JSON.parse(await readFile3(path, "utf8"));
     return isDefaultOrganization(parsed.defaultOrganization) ? { defaultOrganization: parsed.defaultOrganization } : {};
   } catch {
     return {};
   }
 }
 async function writeSettings(settings, path = getSettingsPath()) {
-  await mkdir2(dirname2(path), { recursive: true });
-  await writeFile2(path, `${JSON.stringify(settings, null, 2)}
+  await mkdir3(dirname3(path), { recursive: true });
+  await writeFile3(path, `${JSON.stringify(settings, null, 2)}
 `, "utf8");
 }
 
@@ -10157,6 +10479,11 @@ function listLines(items, color) {
 function bootPhase(value) {
   return isItem(value) && typeof value.ms === "number" && Number.isFinite(value.ms) ? { ms: value.ms } : null;
 }
+var DISK_SOURCE_TEXT = {
+  fresh: "image pulled",
+  "image-base": "image already on disk",
+  "user-snapshot": "from a snapshot"
+};
 function bootLines(data, color) {
   if (!isItem(data) || !isItem(data.boot))
     return [];
@@ -10168,6 +10495,12 @@ function bootLines(data, color) {
   if (container) {
     lines.push(eventLine("done", `container started in ${formatElapsed(container.ms)}`, color));
   }
+  const provision = bootPhase(data.boot.provision);
+  if (provision) {
+    const disk = typeof data.boot.disk === "string" ? DISK_SOURCE_TEXT[data.boot.disk] : undefined;
+    const how = disk ? ` (${disk})` : "";
+    lines.push(eventLine("done", `ready in ${formatElapsed(provision.ms)}${how}`, color));
+  }
   return lines;
 }
 function renderResult(data, color) {
@@ -10689,178 +11022,8 @@ var logoutCommand = defineCommand({
 
 // src/commands/network.ts
 import { spawn, spawnSync } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
 import { hostname as hostname2 } from "node:os";
-
-// src/network/tunnel.ts
-import { createPrivateKey, createPublicKey, generateKeyPairSync } from "node:crypto";
-import { existsSync } from "node:fs";
-import { chmod as chmod2, mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname3, join as join3 } from "node:path";
-var INTERFACE = "gdock";
-function networkDir() {
-  return join3(getConfigDir(), "network");
-}
-function configPath(dir = networkDir()) {
-  return join3(dir, `${INTERFACE}.conf`);
-}
-function keyPath(dir) {
-  return join3(dir, "private.key");
-}
-function statePath(dir) {
-  return join3(dir, "device.json");
-}
-function isProvider(value) {
-  const provider = value;
-  return typeof provider?.id === "string" && typeof provider.name === "string";
-}
-var X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
-function keyPairFromPrivate(privateKey) {
-  const raw = Buffer.from(privateKey, "base64");
-  if (raw.length !== 32)
-    throw new Error("The stored WireGuard key is not 32 bytes.");
-  const key = createPrivateKey({
-    key: Buffer.concat([X25519_PKCS8_PREFIX, raw]),
-    format: "der",
-    type: "pkcs8"
-  });
-  const spki = createPublicKey(key).export({ format: "der", type: "spki" });
-  return { privateKey, publicKey: spki.subarray(spki.length - 32).toString("base64") };
-}
-async function loadOrCreateKey(dir = networkDir()) {
-  try {
-    return keyPairFromPrivate((await readFile3(keyPath(dir), "utf8")).trim());
-  } catch (err) {
-    if (err.code !== "ENOENT")
-      throw err;
-  }
-  const { privateKey } = generateKeyPairSync("x25519");
-  const der = privateKey.export({ format: "der", type: "pkcs8" });
-  const raw = der.subarray(der.length - 32).toString("base64");
-  await mkdir3(dir, { recursive: true, mode: 448 });
-  await writeFile3(keyPath(dir), `${raw}
-`, { mode: 384 });
-  return keyPairFromPrivate(raw);
-}
-async function readDeviceState(dir = networkDir()) {
-  try {
-    const parsed = JSON.parse(await readFile3(statePath(dir), "utf8"));
-    if (typeof parsed.deviceId === "string" && typeof parsed.baseUrl === "string") {
-      return {
-        baseUrl: parsed.baseUrl,
-        deviceId: parsed.deviceId,
-        address: typeof parsed.address === "string" ? parsed.address : "",
-        gatewayProvider: isProvider(parsed.gatewayProvider) ? { id: parsed.gatewayProvider.id, name: parsed.gatewayProvider.name } : null
-      };
-    }
-  } catch {}
-  return null;
-}
-async function writeDeviceState(state, dir = networkDir()) {
-  await mkdir3(dir, { recursive: true, mode: 448 });
-  await writeFile3(statePath(dir), `${JSON.stringify(state, null, 2)}
-`, { mode: 384 });
-}
-function detectDnsMode(platform = process.platform, exists = existsSync) {
-  if (platform === "darwin")
-    return "macos-resolver";
-  if (platform === "linux" && exists("/run/systemd/resolve"))
-    return "resolved";
-  return "none";
-}
-function renderConfig(input) {
-  const { device, network, gateway } = input.registered;
-  const zones = [network.zone, ...network.netZone ? [network.netZone] : []];
-  for (const zone of zones) {
-    if (!isDnsZone(zone))
-      throw new Error(`The server sent a zone that is not a DNS name: ${zone}`);
-  }
-  if (!device.address || !isIPv6Address(device.address)) {
-    throw new Error(`The server sent no IPv6 address for this device: ${device.address}`);
-  }
-  if (!isIPv6Address(network.gatewayAddress)) {
-    throw new Error(`The server sent a gateway that is not an IPv6 address: ${network.gatewayAddress}`);
-  }
-  const ipv4 = device.address4 && network.ingress4 ? { address: device.address4, ingress: network.ingress4 } : null;
-  if (ipv4 && (!isIPv4Address(ipv4.address) || !isIPv4Address(ipv4.ingress))) {
-    throw new Error(`The server sent an IPv4 address that is not one: ${ipv4.address}, ${ipv4.ingress}`);
-  }
-  const lines = [
-    "# Written by `ghostdock network connect`. Run it again rather than editing this file.",
-    "[Interface]",
-    `PrivateKey = ${input.privateKey}`,
-    `Address = ${device.address}/128${ipv4 ? `, ${ipv4.address}/32` : ""}`,
-    `MTU = ${network.mtu}`
-  ];
-  if (input.dns === "macos-resolver") {
-    for (const zone of zones) {
-      const file = `/etc/resolver/${zone}`;
-      lines.push(`PostUp = mkdir -p /etc/resolver && printf 'nameserver ${network.gatewayAddress}\\n' > ${file}`, `PostDown = rm -f ${file}`);
-    }
-  } else if (input.dns === "resolved") {
-    const domains = zones.map((zone) => `'~${zone}'`).join(" ");
-    lines.push(`PostUp = resolvectl dns %i ${network.gatewayAddress} && resolvectl domain %i ${domains}`);
-  }
-  lines.push("", "[Peer]", `PublicKey = ${gateway.publicKey}`, `Endpoint = ${gateway.endpoint}`, `AllowedIPs = ${network.prefix}${ipv4 ? `, ${ipv4.ingress}/32` : ""}`, "PersistentKeepalive = 25", "");
-  return lines.join(`
-`);
-}
-var DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-function isDnsZone(zone) {
-  const labels = zone.split(".");
-  return zone.length <= 253 && labels.length >= 2 && labels.every((label) => DNS_LABEL.test(label));
-}
-function isIPv4Address(text) {
-  return /^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}$/.test(text);
-}
-function ipv4RouteOwner(platform, output) {
-  if (platform === "darwin") {
-    if (/^\s*destination: default$/m.test(output))
-      return null;
-    return /^\s*interface: (\S+)$/m.exec(output)?.[1] ?? null;
-  }
-  for (const line of output.split(`
-`).map((l) => l.trim())) {
-    if (!line || /^(default|broadcast)\b/.test(line))
-      continue;
-    return /\bdev (\S+)/.exec(line)?.[1] ?? "another route";
-  }
-  return null;
-}
-function ipv4RouteCommand(platform, address) {
-  return platform === "darwin" ? ["route", ["-n", "get", address]] : ["ip", ["-4", "route", "show", "table", "all", "match", address]];
-}
-function isIPv6Address(text) {
-  return /^[0-9a-f:]{2,39}$/.test(text) && text.includes(":");
-}
-async function readConfigMtu(path = configPath()) {
-  let contents;
-  try {
-    contents = await readFile3(path, "utf8");
-  } catch {
-    return null;
-  }
-  const match = /^MTU = (\d+)$/m.exec(contents);
-  return match ? Number(match[1]) : null;
-}
-async function writeConfig(contents, path = configPath()) {
-  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
-  await writeFile3(path, contents, { mode: 384 });
-  await chmod2(path, 384);
-}
-function tunnelUp(platform = process.platform, exists = existsSync) {
-  if (platform === "darwin")
-    return exists(`/var/run/wireguard/${INTERFACE}.name`);
-  return exists(`/sys/class/net/${INTERFACE}`);
-}
-function installHint(platform = process.platform) {
-  if (platform === "darwin")
-    return "brew install wireguard-tools";
-  if (platform === "linux")
-    return "sudo apt install wireguard-tools (or your distribution’s package)";
-  return "Install wireguard-tools. On Windows, run the CLI inside WSL.";
-}
-
-// src/commands/network.ts
 function defaultDeps() {
   return {
     request: authorizedRequest,
@@ -10877,6 +11040,7 @@ function defaultDeps() {
     has: (command) => spawnSync("sh", ["-c", `command -v ${command}`]).status === 0,
     dir: networkDir(),
     up: () => tunnelUp(),
+    exists: existsSync2,
     log: console.log,
     error: printError,
     notice: printNotice
@@ -10896,6 +11060,7 @@ async function wgQuick(deps, verb) {
   return deps.run("sudo", args);
 }
 async function runNetworkConnect(args = {}, deps = defaultDeps()) {
+  suppressPausedNotice();
   if (!deps.has("wg-quick")) {
     deps.error(`wg-quick is not installed. ${installHint()}`);
     return 1;
@@ -10929,14 +11094,37 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
     deps.error(message(err));
     return 1;
   }
+  const previousConfig = await readConfig(configPath(deps.dir));
   await writeConfig(config, configPath(deps.dir));
   await writeDeviceState({
     baseUrl: getBaseUrl(),
     deviceId: registered.device.id,
     address: registered.device.address ?? "",
-    gatewayProvider: registered.provider
+    gatewayProvider: registered.provider,
+    zones: [
+      registered.network.zone,
+      ...registered.network.netZone ? [registered.network.netZone] : []
+    ]
   }, deps.dir);
   const wasUp = deps.up();
+  if (wasUp && previousConfig === config) {
+    const { device, network, provider, shortNameOrganizationChanged } = registered;
+    printResult({
+      device,
+      network,
+      provider,
+      shortNameOrganizationChanged,
+      interface: INTERFACE,
+      dns,
+      rearmed: true,
+      pause: device.state
+    }, () => [
+      eventLine("done", rearmedLine(device.state)),
+      ...network.netZone && device.shortNameOrganization && shortNameOrganizationChanged ? clearingNotice(network.netCookieSite) : []
+    ], deps.log);
+    printPauseHint(device.state, deps);
+    return 0;
+  }
   if (wasUp) {
     const down = await wgQuick(deps, "down");
     if (down !== 0) {
@@ -10953,7 +11141,16 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
   const { device, network, provider, shortNameOrganizationChanged } = registered;
   const pinned = device.shortNameOrganization;
   const switched = wasUp && previous?.gatewayProvider && previous.gatewayProvider.id !== provider.id ? previous.gatewayProvider : null;
-  printResult({ device, network, provider, shortNameOrganizationChanged, interface: INTERFACE, dns }, () => [
+  printResult({
+    device,
+    network,
+    provider,
+    shortNameOrganizationChanged,
+    interface: INTERFACE,
+    dns,
+    rearmed: false,
+    pause: device.state
+  }, () => [
     eventLine("done", `Connected through ${provider.name}. This machine is ${device.address} in the private network.`),
     ...switched ? [
       `    Replaced the connection through ${switched.name}: its sandboxes are out of reach now.`
@@ -10978,8 +11175,22 @@ async function runNetworkConnect(args = {}, deps = defaultDeps()) {
     ] : [],
     `    → ${getCliName()} network ls`
   ], deps.log);
+  printPauseHint(device.state, deps);
   return 0;
 }
+function rearmedLine(state, now = new Date) {
+  if (!state)
+    return "Re-armed.";
+  const until = clockTime(new Date(now.getTime() + state.maxSessionSeconds * 1000).toISOString(), now);
+  return `Re-armed: network access for this device runs until ${until} (pauses after ${formatPauseLimit(state.idleTimeoutSeconds)} idle).`;
+}
+function printPauseHint(state, deps) {
+  if (!state || isJsonOutput())
+    return;
+  const [first = "", ...rest] = pauseHint(state);
+  deps.notice(["", bold2(first), ...rest].join(`
+`));
+}
 function ipv4Clashes4(registered, deps) {
   const addresses = [registered.network.ingress4, registered.device.address4].filter((a) => typeof a === "string" && isIPv4Address(a));
   const clashes = [];
@@ -11000,17 +11211,41 @@ function clearingNotice(cookieSite) {
     "    Reload or close browser tabs opened on short names before this connect."
   ];
 }
+async function staleResolverFiles(deps) {
+  if (deps.platform !== "darwin")
+    return [];
+  const state = await readDeviceState(deps.dir);
+  const zones = new Set([
+    ...configResolverZones(await readConfig(configPath(deps.dir))),
+    ...state?.zones ?? []
+  ]);
+  return [...zones].map(resolverFile).filter((file) => deps.exists(file));
+}
 async function runNetworkDisconnect(deps = defaultDeps()) {
-  if (!deps.up()) {
-    printResult({ connected: false }, () => [eventLine("item", "Not connected.")], deps.log);
-    return 0;
+  const wasUp = deps.up();
+  let failed = false;
+  if (wasUp) {
+    const code = await wgQuick(deps, "down");
+    if (code !== 0) {
+      deps.error(`wg-quick exited ${code}.`);
+      failed = true;
+    }
+  }
+  const stale = await staleResolverFiles(deps);
+  if (stale.length) {
+    const args = ["rm", "-f", ...stale];
+    deps.notice(`Removing split DNS left from an earlier connection. Running: sudo ${args.join(" ")}`);
+    const code = await deps.run("sudo", args);
+    if (code !== 0) {
+      deps.error(`Could not remove ${stale.join(", ")} (rm exited ${code}).`);
+      return 1;
+    }
   }
-  const code = await wgQuick(deps, "down");
-  if (code !== 0) {
-    deps.error(`wg-quick exited ${code}.`);
+  if (failed)
     return 1;
-  }
-  printResult({ connected: false }, () => [eventLine("done", "Disconnected.")], deps.log);
+  printResult({ connected: false, removedSplitDns: stale }, () => [
+    wasUp ? eventLine("done", "Disconnected.") : eventLine(stale.length ? "done" : "item", stale.length ? "Not connected; removed the leftover split DNS." : "Not connected.")
+  ], deps.log);
   return 0;
 }
 async function readConnection(deps) {
@@ -11048,7 +11283,11 @@ async function readConnection(deps) {
 }
 async function runNetworkStatus(deps = defaultDeps()) {
   const { state, up, device, asked, provider, staleMtu } = await readConnection(deps);
-  printResult({ connected: up, device, provider, staleMtu }, () => {
+  const staleSplitDns = up ? [] : await staleResolverFiles(deps);
+  for (const file of staleSplitDns) {
+    deps.notice(`Split DNS from an earlier connection is still set (${file}): names of the private network will hang. Run: ${getCliName()} network disconnect`);
+  }
+  printResult({ connected: up, device, provider, staleMtu, staleSplitDns }, () => {
     if (!state) {
       return [eventLine("item", `Not set up. Run \`${getCliName()} network connect\`.`)];
     }
@@ -11058,6 +11297,7 @@ async function runNetworkStatus(deps = defaultDeps()) {
     ];
     if (device) {
       lines.push(`    Device ${device.name}, valid until ${device.expiresAt.slice(0, 10)}.`);
+      lines.push(`    ${deviceStateText(device.state)}.`);
       if (device.shortNameOrganization) {
         lines.push(`    Short names: ${device.shortNameOrganization.slug}'s sandboxes.`);
       }
@@ -11127,7 +11367,7 @@ async function runNetworkDevices(deps = defaultDeps()) {
   try {
     const { devices } = await deps.request("/api/v1/network/devices");
     const own = (await readDeviceState(deps.dir))?.deviceId;
-    printResult({ devices }, () => devices.length === 0 ? [eventLine("item", "No devices.")] : devices.map((d) => `  ${d.id === own ? "*" : " "} ${d.id}  ${d.name}  ${d.address}  until ${d.expiresAt.slice(0, 10)}`), deps.log);
+    printResult({ devices }, () => devices.length === 0 ? [eventLine("item", "No devices.")] : devices.map((d) => `  ${d.id === own ? "*" : " "} ${d.id}  ${d.name}  ${d.address}  until ${d.expiresAt.slice(0, 10)}  ${deviceStateText(d.state)}`), deps.log);
     return 0;
   } catch (err) {
     deps.error(message(err));
@@ -11149,7 +11389,7 @@ async function runNetworkDevicesRemove(args, deps = defaultDeps()) {
 var connectCommand = defineCommand({
   meta: {
     name: "connect",
-    description: "Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Asks for sudo once."
+    description: "Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Also re-arms a paused device: with the tunnel up and nothing changed, without sudo."
   },
   args: {
     provider: {
@@ -11164,7 +11404,10 @@ var connectCommand = defineCommand({
   }
 });
 var disconnectCommand = defineCommand({
-  meta: { name: "disconnect", description: "Take this machine out of the private network." },
+  meta: {
+    name: "disconnect",
+    description: "Take this machine out of the private network, and remove split DNS an earlier connection left (macOS)."
+  },
   async run() {
     process.exitCode = await runNetworkDisconnect();
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ghostdock",
   "description": "Ghostdock CLI — device login and agent tool invocation from the command line",
-  "version": "0.0.16",
+  "version": "0.0.17",
   "type": "module",
   "bin": {
     "ghostdock": "dist/index.js",