ghostdock 0.0.9 → 0.0.11

package/dist/cli-reference.md

@@ -228,7 +228,7 @@ MCP tool: `images_update_dockerfile`.
 
 ## `ghostdock login`
 
-Sign in and store a device access token for this CLI.
+Sign in and store a device access token for this machine (~/.config/ghostdock/credentials.json).
 
 ```
 ghostdock login [flags]
@@ -255,14 +255,15 @@ The private network: reach your sandboxes by address and name from this machine.
 
 ### `ghostdock network connect`
 
-Put this machine into the private network: WireGuard and split DNS. Asks for sudo once.
+Put this machine into the private network through one provider: WireGuard and split DNS. Asks for sudo once.
 
 ```
-ghostdock network connect [flags]
+ghostdock network connect [provider] [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
+| `<provider>` | Sandbox provider name or id. Omit for the organization's default provider (else the platform default). Only its sandboxes are reachable; connecting through another replaces the connection. |
 | `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
 
 ### `ghostdock network devices`
@@ -295,7 +296,7 @@ ghostdock network disconnect
 
 ### `ghostdock network ls`
 
-Sandboxes of an organization with their private addresses and names.
+Sandboxes of an organization with their private addresses and names, and which are reachable through the current connection.
 
 ```
 ghostdock network ls [flags]
@@ -307,25 +308,12 @@ ghostdock network ls [flags]
 
 ### `ghostdock network status`
 
-Whether this machine is connected, and as which device.
+Whether this machine is connected, through which provider, and as which device.
 
 ```
 ghostdock network status
 ```
 
-### `ghostdock network use`
-
-Choose the organization <sandbox>.gdock.internal names resolve in on this machine.
-
-```
-ghostdock network use [org] [flags]
-```
-
-| Argument | Description |
-| --- | --- |
-| `<org>` | Organization id or slug. |
-| `--clear` | Turn short names off. |
-
 ## `ghostdock organizations`
 
 Organizations you belong to.
@@ -354,7 +342,7 @@ MCP tool: `organizations_list`.
 
 ### `ghostdock organizations use`
 
-Set the default organization for commands run in this directory.
+Set the default organization for commands run without --org (in every directory).
 
 ```
 ghostdock organizations use [org] [flags]

package/dist/cli.md

@@ -99,7 +99,7 @@ Commands are grouped by resource, like `gh` or `kubectl`: `ghostdock <resource>
 ghostdock apps            Published apps of an organization.
 ghostdock env             Manage organization environment variables and secrets.
 ghostdock images          Organization image catalog: OCI bookmarks, Dockerfiles and Compose files.
-ghostdock login           Sign in and store a device access token for this CLI.
+ghostdock login           Sign in and store a device access token for this machine…
 ghostdock logout          Revoke the device session and remove stored credentials.
 ghostdock network         The private network: reach your sandboxes by address and name from this machine.
 ghostdock organizations   Organizations you belong to.
@@ -128,21 +128,25 @@ Every organization-scoped command acts on one organization, taken from the first
 
 1. `--org <id-or-slug>` on the command
 2. the `GHOSTDOCK_ORG` environment variable
-3. the default set with `ghostdock organizations use <id-or-slug>`
+3. the default set with `ghostdock organizations use <id-or-slug>`, stored in
+   `~/.config/ghostdock/settings.json`
+
+With one organization there is nothing to do: `login` makes it the default, and every command,
+in any directory, uses it.
 
 ```bash
-ghostdock organizations use acme      # default for this directory (login sets one when it can)
-ghostdock sandboxes list              # stderr: Using organization acme (default, …)
+ghostdock organizations use acme      # the default (login sets one when it can)
+ghostdock sandboxes list              # stderr: Using organization acme (default from ~/.config/ghostdock/settings.json)
 ghostdock sandboxes list --org beta   # --org always wins
 ghostdock organizations current       # which organization, and where it comes from
 ghostdock organizations use --clear
 ```
 
 When the organization does not come from `--org`, the command says which one it uses on stderr,
-so a default never acts silently. The default is stored next to the credentials
-(`./.ghostdock/settings.json`), so it belongs to that directory's login. **Scripts and CI should
-pass `--org` or set `GHOSTDOCK_ORG`** rather than depend on (or change) a stored default, and use
-the organization id: renaming an organization changes its slug, not its id.
+so a default never acts silently. The default is stored next to the credentials, so it belongs to
+the same login. **Scripts and CI should pass `--org` or set `GHOSTDOCK_ORG`** rather than depend on
+(or change) a stored default, and use the organization id: renaming an organization changes its
+slug, not its id.
 
 ### `ghostdock login`
 
@@ -187,6 +191,9 @@ ghostdock login --code <paste-code>
 On success, credentials are written and the command exits `0`. If the code hasn't been approved
 yet, it exits `1` — approve it in the browser first.
 
+Credentials are stored per machine, in `~/.config/ghostdock/credentials.json` (see
+[Credentials file](#credentials-file)), so one login works in every directory.
+
 **Default organization after login.** Once logged in (with `--wait` or `--code`), `login` sets the
 default organization when that is unambiguous:
 
@@ -207,7 +214,8 @@ ghostdock logout
 ```
 
 Revokes the device session on the server (best-effort — still clears local credentials even if the
-server call fails, e.g. when offline) and deletes the local credentials file.
+server call fails, e.g. when offline) and deletes the credentials file. The default organization
+stays.
 
 ### `ghostdock whoami`
 
@@ -478,31 +486,75 @@ secret is public.
 
 ### `ghostdock network`
 
-Reach your organization's sandboxes from this machine by private address and name, over
+Reach your organizations' sandboxes from this machine by private address and name, over
 WireGuard ([ADR 0027](../../docs/adr/0027-private-sandbox-network.md)). Everything on a
 sandbox's address is reachable: a container that publishes port 80 answers on
-`http://quiet-harbor.gdock.internal/`, as it would on `localhost` inside the sandbox.
+`http://quiet-harbor.acme.ghostdock.internal/`, as it would on `localhost` inside the sandbox.
 Nothing reaches your machine from a sandbox.
 
 ```bash
-ghostdock network connect --org acme   # asks for sudo once: wg-quick up and split DNS
-ghostdock network ls --org acme        # sandboxes with their addresses and names
+ghostdock network connect              # your organization's default provider; sudo once
+ghostdock network connect helsinki     # or name a provider (name or id)
+ghostdock network ls --org acme        # sandboxes, addresses, names, and what is reachable
 curl http://quiet-harbor.acme.ghostdock.internal:8080/
-curl http://quiet-harbor.gdock.internal:8080/      # short name: the organization connect used
-ghostdock network use beta             # short names in another organization, no sudo
+open https://quiet-harbor--acme.ghostdock.net:8080/   # in a browser: HTTPS, any port
 ghostdock network status
 ghostdock network disconnect
 ```
 
+- **One provider at a time.** Each sandbox provider is its own gateway, and a device reaches
+  only the sandboxes on the provider it connected through. Without an argument, `connect` takes
+  the organization (`--org`, `GHOSTDOCK_ORG`, the default from `organizations use`) and its
+  default sandbox provider, else the platform default. Connecting through another provider
+  replaces the connection: same interface and address, new gateway. `network status` says which
+  provider you are connected through; `network ls` marks sandboxes elsewhere as
+  `not reachable: on <provider>` with the `connect` command that reaches them. A provider
+  without a private network (Incus, for now) is refused by the server; one your organization
+  may not use answers 403.
 - **Needs `wg-quick`** (`brew install wireguard-tools`, `apt install wireguard-tools`). macOS
   and Linux. On Windows, run the CLI in WSL: then only tools inside WSL reach sandboxes.
-- **One key per machine**, kept in `~/.config/ghostdock/network/` (or `GHOSTDOCK_NETWORK_DIR`).
+- **One key per machine**, kept in `~/.config/ghostdock/network/`.
   Only the public key is sent. The device belongs to the login it was connected with:
   `ghostdock logout` takes it out of the network, and so does not connecting for 90 days.
-- **Names**: `<sandbox>.<org>.ghostdock.internal` always, and `<sandbox>.gdock.internal` in the
-  organization this machine is pinned to (the one `connect` resolved, changed with
-  `network use`). The pin is per machine, not per directory. Only AAAA records exist: the
-  network is IPv6, and the sandbox sees IPv4.
+- **Names**: `<sandbox>.<org>.ghostdock.internal`, for every organization you are a member
+  of. A name always says its organization, so a browser origin never changes hands between
+  organizations. Only AAAA records exist: the network is IPv6, and the sandbox sees IPv4.
+- **In a browser**, use the HTTPS name `https://<sandbox>--<org>.ghostdock.net:<port>`
+  (`network ls` shows it): any port, a real certificate, so the page is a secure context
+  (clipboard, `Secure` cookies, service workers). The host's `gdo-ingress` terminates TLS and
+  forwards to the sandbox's port; it serves only devices of the sandbox's organization, and
+  refuses background requests (fetch, forms, iframes, websockets) from pages outside that
+  organization; pages on another HTTPS name of the same organization, any port, may call it. The
+  sandbox sees the request from `198.18.0.0`, and your device's address in
+  `X-Forwarded-For`. The desktop image's Desktop opens only this way, never on the raw
+  address.
+- **Browsers use the HTTPS name; tools keep the raw address.** A browser that opens
+  `http://quiet-harbor.acme.ghostdock.internal:3000/app` (or the raw IPv6 address) gets a
+  `308` to `https://quiet-harbor--acme.ghostdock.net:3000/app`. Any other browser request on
+  the raw address (`fetch`, images, scripts, forms, websockets) gets `403` with
+  `X-Ghostdock-Blocked: browser-https-only` and the HTTPS address in the body. This keeps
+  websites you visit while connected from using your connection against your sandboxes,
+  including through DNS rebinding.
+  - **What counts as a browser:** a `User-Agent` that starts with `Mozilla/`, which every
+    browser sends on its own requests. Browsers send no `Sec-Fetch-*` headers over plain
+    `http://` to an address like this, so those cannot be the signal. (Firefox lets a page
+    set its own `User-Agent` on a `fetch`; the `Host` check below stops that one.) Tools that send a
+    browser's `User-Agent` (Playwright, Puppeteer, their request APIs) count as browsers too:
+    point them at the HTTPS name. A frontend outside the sandbox (a dev server on your laptop)
+    calls the sandbox's API by its HTTPS name as well.
+  - **Tools** (`curl`, SDKs, test runners, Prometheus) pass untouched, and every other
+    protocol does too, as long as they address the sandbox by its IP address, its
+    `.internal` name (or a container's, `web.quiet-harbor.acme.ghostdock.internal`), or
+    `localhost`: any other `Host` gets `421` (`X-Ghostdock-Blocked: host-not-allowed`). That
+    check is what stops DNS rebinding for a page that sets its own `User-Agent`. A name of
+    your own in `/etc/hosts` gets 421 too.
+  - **One difference for tools:** a port where nothing listens accepts the connection and
+    then resets it, so port checks such as `nc -z` report it open; check with a real request
+    instead.
+  - **In the sandbox,** firewall rules for these clients belong in the input path
+    (`iptables -A INPUT`, an nft `hook input` chain): `FORWARD` and `DOCKER-USER` rules no
+    longer see them, because the guard connects to a published container port from inside
+    the VM.
 - `ghostdock network devices` lists your devices, `ghostdock network devices remove <id>`
   removes one.
 
@@ -544,7 +596,7 @@ or read [`cli-reference.md`](cli-reference.md) for every command's full descript
 
 | Command | What it does |
 | --- | --- |
-| `ghostdock login [flags]` | Sign in and store a device access token for this CLI. |
+| `ghostdock login [flags]` | Sign in and store a device access token for this machine… |
 
 #### logout
 
@@ -556,13 +608,12 @@ or read [`cli-reference.md`](cli-reference.md) for every command's full descript
 
 | Command | What it does |
 | --- | --- |
-| `ghostdock network connect [flags]` | Put this machine into the private network: WireGuard and split DNS. |
+| `ghostdock network connect [provider] [flags]` | Put this machine into the private network through one provider: WireGuard and… |
 | `ghostdock network devices <command>` | Your devices in the private network. |
 | `ghostdock network devices remove <id>` | Remove one of your devices from the private network. |
 | `ghostdock network disconnect` | Take this machine out of the private network. |
-| `ghostdock network ls [flags]` | Sandboxes of an organization with their private addresses and names. |
-| `ghostdock network status` | Whether this machine is connected, and as which device. |
-| `ghostdock network use [org] [flags]` | Choose the organization <sandbox>.gdock.internal names resolve in on this… |
+| `ghostdock network ls [flags]` | Sandboxes of an organization with their private addresses and names, and which… |
+| `ghostdock network status` | Whether this machine is connected, through which provider, and as which device. |
 
 #### organizations
 
@@ -570,7 +621,7 @@ or read [`cli-reference.md`](cli-reference.md) for every command's full descript
 | --- | --- |
 | `ghostdock organizations current [flags]` | Show which organization commands use, and where it comes from. |
 | `ghostdock organizations list` | List the organizations you belong to, with their ids and slugs. |
-| `ghostdock organizations use [org] [flags]` | Set the default organization for commands run in this directory. |
+| `ghostdock organizations use [org] [flags]` | Set the default organization for commands run without --org (in every… |
 
 #### projects
 
@@ -694,7 +745,8 @@ and secrets, see [`ghostdock env`](#ghostdock-env).
 | ------------------------------- | ------------------------------------------------------------- | --------------------------------- |
 | `GHOSTDOCK_BASE_URL`           | API origin the CLI talks to. Override for local dev / self-hosted instances. | Local/dev builds default to `http://localhost:3000`. npm-published builds default to the production API origin baked at publish time. Override with `--base-url` or this env var. |
 | `GHOSTDOCK_ORG`                | Organization (id or slug) for commands run without `--org`. Takes precedence over the default from `organizations use`. | unset |
-| `GHOSTDOCK_CREDENTIALS_PATH`   | Absolute path to the credentials file, overriding the default. `settings.json` (the default organization) sits in the same directory. | `./.ghostdock/credentials.json` (relative to the current working directory) |
+| `XDG_CONFIG_HOME`              | Base directory for the CLI's per-machine state (`ghostdock/credentials.json`, `ghostdock/settings.json`, `ghostdock/network/`). | `~/.config` (native Windows: `%APPDATA%`) |
+| `GHOSTDOCK_CREDENTIALS_PATH`   | Absolute path to the credentials file, overriding the default. `settings.json` (the default organization) sits in the same directory, so each credentials file keeps its own default — handy for a second account. | `~/.config/ghostdock/credentials.json` |
 
 Example for local development against a Nuxt dev server:
 
@@ -706,8 +758,10 @@ GHOSTDOCK_BASE_URL=http://localhost:3000 ghostdock login --wait
 
 ## Credentials file
 
-Credentials are stored as JSON at `./.ghostdock/credentials.json` (relative to the directory the
-CLI is run from), with file permissions restricted to the owner (`0600`):
+Credentials are stored per machine as JSON in `~/.config/ghostdock/credentials.json`
+(`$XDG_CONFIG_HOME/ghostdock/` when that is set, `%APPDATA%\ghostdock\` on native Windows; WSL
+counts as Linux), with file permissions restricted to the owner (`0600`). `GHOSTDOCK_CREDENTIALS_PATH`
+points the CLI at another file, e.g. for a second account. The file looks like this:
 
 ```json
 {
@@ -717,10 +771,6 @@ CLI is run from), with file permissions restricted to the owner (`0600`):
 }
 ```
 
-**Add `.ghostdock/` to your project's `.gitignore`.** These are live tokens — never commit them.
-This repository's own `.gitignore` already ignores `.ghostdock/` for local development/testing of
-the CLI itself.
-
 Access tokens are short-lived (1 hour); the CLI refreshes them automatically using the refresh token
 (30-day rolling expiry) whenever a request gets a `401`. If both tokens are invalid or revoked (e.g.
 after `ghostdock logout` from another session), re-run `ghostdock login`.

package/dist/index.js

@@ -1121,6 +1121,9 @@ var GENERATED_TOOL_CATALOG = [
                   },
                   mcp: {
                     type: "boolean"
+                  },
+                  private_network: {
+                    type: "boolean"
                   }
                 },
                 required: [
@@ -1135,7 +1138,8 @@ var GENERATED_TOOL_CATALOG = [
                   "compose",
                   "kubernetes",
                   "env",
-                  "mcp"
+                  "mcp",
+                  "private_network"
                 ],
                 additionalProperties: false
               },
@@ -1563,6 +1567,9 @@ var GENERATED_TOOL_CATALOG = [
                   },
                   mcp: {
                     type: "boolean"
+                  },
+                  private_network: {
+                    type: "boolean"
                   }
                 },
                 required: [
@@ -1577,7 +1584,8 @@ var GENERATED_TOOL_CATALOG = [
                   "compose",
                   "kubernetes",
                   "env",
-                  "mcp"
+                  "mcp",
+                  "private_network"
                 ],
                 additionalProperties: false
               },
@@ -2102,6 +2110,9 @@ var GENERATED_TOOL_CATALOG = [
                 },
                 mcp: {
                   type: "boolean"
+                },
+                private_network: {
+                  type: "boolean"
                 }
               },
               required: [
@@ -2116,7 +2127,8 @@ var GENERATED_TOOL_CATALOG = [
                 "compose",
                 "kubernetes",
                 "env",
-                "mcp"
+                "mcp",
+                "private_network"
               ],
               additionalProperties: false
             },
@@ -2495,6 +2507,9 @@ var GENERATED_TOOL_CATALOG = [
                       },
                       mcp: {
                         type: "boolean"
+                      },
+                      private_network: {
+                        type: "boolean"
                       }
                     },
                     required: [
@@ -2509,7 +2524,8 @@ var GENERATED_TOOL_CATALOG = [
                       "compose",
                       "kubernetes",
                       "env",
-                      "mcp"
+                      "mcp",
+                      "private_network"
                     ],
                     additionalProperties: false
                   },
@@ -2949,6 +2965,9 @@ var GENERATED_TOOL_CATALOG = [
                 },
                 mcp: {
                   type: "boolean"
+                },
+                private_network: {
+                  type: "boolean"
                 }
               },
               required: [
@@ -2963,7 +2982,8 @@ var GENERATED_TOOL_CATALOG = [
                 "compose",
                 "kubernetes",
                 "env",
-                "mcp"
+                "mcp",
+                "private_network"
               ],
               additionalProperties: false
             },
@@ -3339,6 +3359,9 @@ var GENERATED_TOOL_CATALOG = [
                       },
                       mcp: {
                         type: "boolean"
+                      },
+                      private_network: {
+                        type: "boolean"
                       }
                     },
                     required: [
@@ -3353,7 +3376,8 @@ var GENERATED_TOOL_CATALOG = [
                       "compose",
                       "kubernetes",
                       "env",
-                      "mcp"
+                      "mcp",
+                      "private_network"
                     ],
                     additionalProperties: false
                   },
@@ -8555,12 +8579,16 @@ var BUILTIN_SKILL_NAMES = GENERATED_SKILL_NAMES;
 // src/cli-name.ts
 import { basename } from "node:path";
 var CLI_NAMES = ["ghostdock", "gdock"];
+var NPX_CACHE_SEGMENT = /[\\/]_npx[\\/]/;
 function getCliName(argv = process.argv) {
-  const invoked = basename(argv[1] ?? "");
+  const entry = argv[1] ?? "";
+  if (NPX_CACHE_SEGMENT.test(entry))
+    return "npx ghostdock";
+  const invoked = basename(entry);
   return CLI_NAMES.find((name) => name === invoked) ?? "ghostdock";
 }
 // package.json
-var version = "0.0.9";
+var version = "0.0.11";
 var package_default = {
   name: "ghostdock",
   description: "Ghostdock CLI — device login and agent tool invocation from the command line",
@@ -8597,6 +8625,7 @@ var package_default = {
 };
 
 // src/config.ts
+import { homedir } from "node:os";
 import { join } from "node:path";
 var FALLBACK_DEFAULT_BASE_URL = "http://localhost:3000";
 var cliBaseUrlOverride;
@@ -8618,9 +8647,22 @@ function getBaseUrl() {
     return fromEnv.replace(/\/+$/, "");
   return resolveDefaultBaseUrl();
 }
+function getConfigDir() {
+  const xdg = process.env.XDG_CONFIG_HOME?.trim();
+  if (xdg)
+    return join(xdg, "ghostdock");
+  const appData = process.env.APPDATA?.trim();
+  if (process.platform === "win32" && appData)
+    return join(appData, "ghostdock");
+  return join(homedir(), ".config", "ghostdock");
+}
 function getCredentialsPath() {
   const override = process.env.GHOSTDOCK_CREDENTIALS_PATH?.trim();
-  return override || join(process.cwd(), ".ghostdock", "credentials.json");
+  return override || join(getConfigDir(), "credentials.json");
+}
+function displayPath(path) {
+  const home = homedir();
+  return home && (path === home || path.startsWith(`${home}/`)) ? `~${path.slice(home.length)}` : path;
 }
 
 // src/credentials.ts
@@ -8882,7 +8924,8 @@ async function findOrganizationRef(flag) {
     return {
       ref: defaultOrganization.id,
       source: "default",
-      label: defaultOrganization.slug ?? defaultOrganization.id
+      label: defaultOrganization.slug ?? defaultOrganization.id,
+      path: getSettingsPath()
     };
   }
   return null;
@@ -8893,15 +8936,15 @@ async function requireOrganizationRef(flag, notice = printNotice) {
     throw new Error(`No organization. Pass --org <id-or-slug>, set GHOSTDOCK_ORG, or run \`${getCliName()} organizations use <org>\`.`);
   }
   if (found.source !== "flag")
-    notice(`Using organization ${found.label} (${describeSource(found.source)}).`);
+    notice(`Using organization ${found.label} (${describeSource(found)}).`);
   return found.ref;
 }
-function describeSource(source) {
+function describeSource({ source, path }) {
   if (source === "flag")
     return "--org";
   if (source === "env")
     return "GHOSTDOCK_ORG";
-  return `default, set with \`${getCliName()} organizations use\``;
+  return `default from ${displayPath(path ?? getSettingsPath())}`;
 }
 async function withOrganization(flag, run) {
   let organization;
@@ -9746,7 +9789,7 @@ async function runLogin(args, log = console.log, choose = defaultChooser(), erro
 var loginCommand = defineCommand({
   meta: {
     name: "login",
-    description: "Sign in and store a device access token for this CLI."
+    description: "Sign in and store a device access token for this machine (~/.config/ghostdock/credentials.json)."
   },
   args: {
     wait: {
@@ -9805,15 +9848,10 @@ import { hostname as hostname2 } from "node:os";
 import { createPrivateKey, createPublicKey, generateKeyPairSync } from "node:crypto";
 import { existsSync } from "node:fs";
 import { chmod as chmod2, mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir } from "node:os";
 import { dirname as dirname3, join as join3 } from "node:path";
 var INTERFACE = "gdock";
 function networkDir() {
-  const override = process.env.GHOSTDOCK_NETWORK_DIR?.trim();
-  if (override)
-    return override;
-  const base = process.env.XDG_CONFIG_HOME?.trim() || join3(homedir(), ".config");
-  return join3(base, "ghostdock", "network");
+  return join3(getConfigDir(), "network");
 }
 function configPath(dir = networkDir()) {
   return join3(dir, `${INTERFACE}.conf`);
@@ -9824,6 +9862,10 @@ function keyPath(dir) {
 function statePath(dir) {
   return join3(dir, "device.json");
 }
+function isProvider(value) {
+  const provider = value;
+  return typeof provider?.id === "string" && typeof provider.name === "string";
+}
 var X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
 function keyPairFromPrivate(privateKey) {
   const raw = Buffer.from(privateKey, "base64");
@@ -9859,7 +9901,8 @@ async function readDeviceState(dir = networkDir()) {
       return {
         baseUrl: parsed.baseUrl,
         deviceId: parsed.deviceId,
-        address: typeof parsed.address === "string" ? parsed.address : ""
+        address: typeof parsed.address === "string" ? parsed.address : "",
+        gatewayProvider: isProvider(parsed.gatewayProvider) ? { id: parsed.gatewayProvider.id, name: parsed.gatewayProvider.name } : null
       };
     }
   } catch {}
@@ -9879,7 +9922,14 @@ function detectDnsMode(platform = process.platform, exists = existsSync) {
 }
 function renderConfig(input) {
   const { device, network, gateway } = input.registered;
-  const zones = [network.zones.canonical, network.zones.short];
+  const zones = [network.zone, ...network.netZone ? [network.netZone] : []];
+  for (const zone of zones) {
+    if (!isDnsZone(zone))
+      throw new Error(`The server sent a zone that is not a DNS name: ${zone}`);
+  }
+  if (!isIPv6Address(network.gatewayAddress)) {
+    throw new Error(`The server sent a gateway that is not an IPv6 address: ${network.gatewayAddress}`);
+  }
   const lines = [
     "# Written by `ghostdock network connect`. Run it again rather than editing this file.",
     "[Interface]",
@@ -9888,15 +9938,26 @@ function renderConfig(input) {
     `MTU = ${network.mtu}`
   ];
   if (input.dns === "macos-resolver") {
-    const files = zones.map((zone) => `/etc/resolver/${zone}`);
-    lines.push(`PostUp = mkdir -p /etc/resolver && ${files.map((file) => `printf 'nameserver ${network.gatewayAddress}\\n' > ${file}`).join(" && ")}`, `PostDown = rm -f ${files.join(" ")}`);
+    for (const zone of zones) {
+      const file = `/etc/resolver/${zone}`;
+      lines.push(`PostUp = mkdir -p /etc/resolver && printf 'nameserver ${network.gatewayAddress}\\n' > ${file}`, `PostDown = rm -f ${file}`);
+    }
   } else if (input.dns === "resolved") {
-    lines.push(`PostUp = resolvectl dns %i ${network.gatewayAddress} && resolvectl domain %i ${zones.map((zone) => `'~${zone}'`).join(" ")}`);
+    const domains = zones.map((zone) => `'~${zone}'`).join(" ");
+    lines.push(`PostUp = resolvectl dns %i ${network.gatewayAddress} && resolvectl domain %i ${domains}`);
   }
   lines.push("", "[Peer]", `PublicKey = ${gateway.publicKey}`, `Endpoint = ${gateway.endpoint}`, `AllowedIPs = ${network.platformPrefix}`, "PersistentKeepalive = 25", "");
   return lines.join(`
 `);
 }
+var DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function isDnsZone(zone) {
+  const labels = zone.split(".");
+  return zone.length <= 253 && labels.length >= 2 && labels.every((label) => DNS_LABEL.test(label));
+}
+function isIPv6Address(text) {
+  return /^[0-9a-f:]{2,39}$/.test(text) && text.includes(":");
+}
 async function writeConfig(contents, path = configPath()) {
   await mkdir3(dirname3(path), { recursive: true, mode: 448 });
   await writeFile3(path, contents, { mode: 384 });
@@ -9935,28 +9996,36 @@ function defaultDeps() {
 function message(err) {
   return err instanceof Error ? err.message : String(err);
 }
+function connectCommandFor(provider) {
+  const ref = provider.connectRef;
+  const arg = /^[A-Za-z0-9._-]+$/.test(ref) ? ref : JSON.stringify(ref);
+  return `${getCliName()} network connect ${arg}`;
+}
 async function wgQuick(deps, verb) {
   const args = ["wg-quick", verb, configPath(deps.dir)];
   deps.notice(`Running: sudo ${args.join(" ")}`);
   return deps.run("sudo", args);
 }
-async function runNetworkConnect(args, deps = defaultDeps()) {
+async function runNetworkConnect(args = {}, deps = defaultDeps()) {
   if (!deps.has("wg-quick")) {
     deps.error(`wg-quick is not installed. ${installHint()}`);
     return 1;
   }
   let registered;
   let privateKey;
+  const previous = await readDeviceState(deps.dir);
   try {
+    const organization = await requireOrganizationRef(args.org, deps.notice);
+    const provider = args.provider?.trim();
     const key = await loadOrCreateKey(deps.dir);
     privateKey = key.privateKey;
-    const found = await findOrganizationRef(args.org);
     registered = await deps.request("/api/v1/network/devices", {
       method: "POST",
       body: JSON.stringify({
         publicKey: key.publicKey,
         name: hostname2().slice(0, 64) || "device",
-        ...found ? { shortNameOrganization: found.ref } : {}
+        organization,
+        ...provider ? { provider } : {}
       })
     });
   } catch (err) {
@@ -9964,9 +10033,22 @@ async function runNetworkConnect(args, deps = defaultDeps()) {
     return 1;
   }
   const dns = detectDnsMode();
-  await writeConfig(renderConfig({ privateKey, registered, dns }), configPath(deps.dir));
-  await writeDeviceState({ baseUrl: getBaseUrl(), deviceId: registered.device.id, address: registered.device.address }, deps.dir);
-  if (deps.up()) {
+  let config;
+  try {
+    config = renderConfig({ privateKey, registered, dns });
+  } catch (err) {
+    deps.error(message(err));
+    return 1;
+  }
+  await writeConfig(config, configPath(deps.dir));
+  await writeDeviceState({
+    baseUrl: getBaseUrl(),
+    deviceId: registered.device.id,
+    address: registered.device.address,
+    gatewayProvider: registered.provider
+  }, deps.dir);
+  const wasUp = deps.up();
+  if (wasUp) {
     const down = await wgQuick(deps, "down");
     if (down !== 0) {
       deps.error(`Could not take the old tunnel down (wg-quick exited ${down}).`);
@@ -9978,10 +10060,16 @@ async function runNetworkConnect(args, deps = defaultDeps()) {
     deps.error(`wg-quick exited ${code}. The config is in ${configPath(deps.dir)}.`);
     return 1;
   }
-  const { device, network } = registered;
-  printResult({ device, network, interface: INTERFACE, dns }, () => [
-    eventLine("done", `Connected. This machine is ${device.address} in the private network.`),
-    `    Names: <sandbox>.<org>.${network.zones.canonical}` + (device.shortNameOrganizationId ? `, and <sandbox>.${network.zones.short}` : ""),
+  const { device, network, provider } = registered;
+  const switched = wasUp && previous?.gatewayProvider && previous.gatewayProvider.id !== provider.id ? previous.gatewayProvider : null;
+  printResult({ device, network, provider, interface: INTERFACE, dns }, () => [
+    eventLine("done", `Connected through ${provider.name}. This machine is ${device.address} in the private network.`),
+    ...switched ? [
+      `    Replaced the connection through ${switched.name}: its sandboxes are out of reach now.`
+    ] : [],
+    `    Reachable: the sandboxes on ${provider.name}. One provider at a time.`,
+    `    Names: <sandbox>.<org>.${network.zone}`,
+    ...network.netZone ? [`    In a browser: https://<sandbox>--<org>.${network.netZone}:<port>`] : [],
     ...dns === "none" ? [
       "    No split DNS on this machine (no systemd-resolved): use the addresses from",
       `    \`${getCliName()} network ls\`.`
@@ -10003,44 +10091,89 @@ async function runNetworkDisconnect(deps = defaultDeps()) {
   printResult({ connected: false }, () => [eventLine("done", "Disconnected.")], deps.log);
   return 0;
 }
-async function runNetworkStatus(deps = defaultDeps()) {
+async function readConnection(deps) {
   const state = await readDeviceState(deps.dir);
-  const connected = deps.up();
-  let device = null;
-  if (state) {
-    try {
-      const { devices } = await deps.request("/api/v1/network/devices");
-      device = devices.find((d) => d.id === state.deviceId) ?? null;
-    } catch (err) {
-      deps.notice(`Could not ask the app about this device: ${message(err)}`);
-    }
+  const up = deps.up();
+  if (!state)
+    return { state, up, device: null, asked: true, provider: null };
+  try {
+    const { devices } = await deps.request("/api/v1/network/devices");
+    const device = devices.find((d) => d.id === state.deviceId) ?? null;
+    return {
+      state,
+      up,
+      device,
+      asked: true,
+      provider: up ? device?.gatewayProvider ?? null : null
+    };
+  } catch (err) {
+    deps.notice(`Could not ask the app about this device: ${message(err)}`);
+    return { state, up, device: null, asked: false, provider: up ? state.gatewayProvider : null };
   }
-  printResult({ connected, device }, () => {
+}
+async function runNetworkStatus(deps = defaultDeps()) {
+  const { state, up, device, asked, provider } = await readConnection(deps);
+  printResult({ connected: up, device, provider }, () => {
     if (!state) {
       return [eventLine("item", `Not set up. Run \`${getCliName()} network connect\`.`)];
     }
+    const through = provider ? ` through ${provider.name}` : "";
     const lines = [
-      eventLine("item", `${connected ? "Connected" : "Not connected"}: ${state.address}`)
+      eventLine("item", `${up ? `Connected${through}` : "Not connected"}: ${state.address}`)
     ];
-    if (!device) {
-      lines.push(`    The app no longer knows this device (removed, expired or logged out). Run \`${getCliName()} network connect\`.`);
-    } else {
+    if (device) {
       lines.push(`    Device ${device.name}, valid until ${device.expiresAt.slice(0, 10)}.`);
+      if (!device.gatewayProvider) {
+        lines.push(`    Its provider is gone, so no gateway serves it. Run \`${getCliName()} network connect\`.`);
+      }
+    } else if (asked) {
+      lines.push(`    The app no longer knows this device (removed, expired or logged out). Run \`${getCliName()} network connect\`.`);
     }
+    if (provider)
+      lines.push(`    Reachable: the sandboxes on ${provider.name}.`);
     return lines;
   }, deps.log);
   return 0;
 }
+function unreachableNote(sandbox, connected) {
+  if (!sandbox.provider.privateNetwork) {
+    return `not reachable: ${sandbox.provider.name} has no private network yet`;
+  }
+  if (connected?.id === sandbox.provider.id)
+    return null;
+  return `not reachable: on ${sandbox.provider.name} → ${connectCommandFor(sandbox.provider)}`;
+}
 async function runNetworkLs(args, deps = defaultDeps()) {
   try {
     const organization = await requireOrganizationRef(args.org, deps.notice);
     const listed = await deps.request(`/api/v1/network/organizations/${encodeURIComponent(organization)}/sandboxes`);
-    printResult(listed, () => {
+    const connected = (await readConnection(deps)).provider;
+    const sandboxes = listed.sandboxes.map((sandbox) => ({
+      ...sandbox,
+      reachable: unreachableNote(sandbox, connected) === null
+    }));
+    printResult({ ...listed, connectedProvider: connected, sandboxes }, () => {
       if (listed.sandboxes.length === 0) {
         return [eventLine("item", `No sandboxes in ${listed.organization.slug}.`)];
       }
       const width = Math.max(...listed.sandboxes.map((s) => s.name.length));
-      return listed.sandboxes.map((s) => `  ${s.name.padEnd(width)}  ${s.address.padEnd(28)}  ${s.canonicalName}  ${s.status}`);
+      const canonicalWidth = Math.max(...listed.sandboxes.map((s) => s.canonicalName.length));
+      const httpsWidth = Math.max(...listed.sandboxes.map((s) => (s.httpsName?.length ?? 0) + 8));
+      const lines = [
+        connected ? eventLine("item", `Connected through ${connected.name}.`) : eventLine("item", `Not connected: nothing is reachable. Run \`${getCliName()} network connect [provider]\`.`)
+      ];
+      for (const s of listed.sandboxes) {
+        const note = unreachableNote(s, connected);
+        lines.push([
+          `  ${s.name.padEnd(width)}`,
+          s.address.padEnd(28),
+          s.canonicalName.padEnd(canonicalWidth),
+          ...s.httpsName ? [`https://${s.httpsName}`.padEnd(httpsWidth)] : [],
+          s.status,
+          ...note ? [`(${note})`] : []
+        ].join("  "));
+      }
+      return lines;
     }, deps.log);
     return 0;
   } catch (err) {
@@ -10048,28 +10181,6 @@ async function runNetworkLs(args, deps = defaultDeps()) {
     return 1;
   }
 }
-async function runNetworkUse(args, deps = defaultDeps()) {
-  const state = await readDeviceState(deps.dir);
-  if (!state) {
-    deps.error(`Not set up. Run \`${getCliName()} network connect\` first.`);
-    return 1;
-  }
-  const organization = args.clear ? null : args.org?.trim();
-  if (organization === undefined || organization === "") {
-    deps.error("Pass an organization id or slug, or --clear.");
-    return 1;
-  }
-  try {
-    const device = await deps.request(`/api/v1/network/devices/${encodeURIComponent(state.deviceId)}/short-name-organization`, { method: "PUT", body: JSON.stringify({ organization }) });
-    printResult(device, () => [
-      eventLine("done", organization === null ? "Short names are off for this machine." : `Short names (<sandbox>.gdock.internal) now resolve in ${organization}.`)
-    ], deps.log);
-    return 0;
-  } catch (err) {
-    deps.error(message(err));
-    return 1;
-  }
-}
 async function runNetworkDevices(deps = defaultDeps()) {
   try {
     const { devices } = await deps.request("/api/v1/network/devices");
@@ -10096,11 +10207,18 @@ async function runNetworkDevicesRemove(args, deps = defaultDeps()) {
 var connectCommand = defineCommand({
   meta: {
     name: "connect",
-    description: "Put this machine into the private network: WireGuard and split DNS. Asks for sudo once."
+    description: "Put this machine into the private network through one provider: WireGuard and split DNS. Asks for sudo once."
+  },
+  args: {
+    provider: {
+      type: "positional",
+      required: false,
+      description: "Sandbox provider name or id. Omit for the organization's default provider (else the platform default). Only its sandboxes are reachable; connecting through another replaces the connection."
+    },
+    org: orgArg
   },
-  args: { org: orgArg },
   async run({ args }) {
-    process.exitCode = await runNetworkConnect({ org: args.org });
+    process.exitCode = await runNetworkConnect({ provider: args.provider, org: args.org });
   }
 });
 var disconnectCommand = defineCommand({
@@ -10110,7 +10228,10 @@ var disconnectCommand = defineCommand({
   }
 });
 var statusCommand = defineCommand({
-  meta: { name: "status", description: "Whether this machine is connected, and as which device." },
+  meta: {
+    name: "status",
+    description: "Whether this machine is connected, through which provider, and as which device."
+  },
   async run() {
     process.exitCode = await runNetworkStatus();
   }
@@ -10118,26 +10239,13 @@ var statusCommand = defineCommand({
 var lsCommand = defineCommand({
   meta: {
     name: "ls",
-    description: "Sandboxes of an organization with their private addresses and names."
+    description: "Sandboxes of an organization with their private addresses and names, and which are reachable through the current connection."
   },
   args: { org: orgArg },
   async run({ args }) {
     process.exitCode = await runNetworkLs({ org: args.org });
   }
 });
-var useCommand = defineCommand({
-  meta: {
-    name: "use",
-    description: "Choose the organization <sandbox>.gdock.internal names resolve in on this machine."
-  },
-  args: {
-    org: { type: "positional", description: "Organization id or slug.", required: false },
-    clear: { type: "boolean", description: "Turn short names off.", default: false }
-  },
-  async run({ args }) {
-    process.exitCode = await runNetworkUse({ org: args.org, clear: args.clear });
-  }
-});
 var devicesRemoveCommand = defineCommand({
   meta: { name: "remove", description: "Remove one of your devices from the private network." },
   args: {
@@ -10166,7 +10274,6 @@ var networkCommand = defineCommand({
     disconnect: disconnectCommand,
     status: statusCommand,
     ls: lsCommand,
-    use: useCommand,
     devices: devicesCommand
   }
 });
@@ -10195,26 +10302,30 @@ async function runOrganizationsUse(args, log = console.log, error = printError)
   settings.defaultOrganization = { id: organization.id, slug: organization.slug };
   await writeSettings(settings);
   log(eventLine("done", `Default organization: ${organization.name} (${organization.slug ?? organization.id}).`));
-  log(`    Stored in ${getSettingsPath()}. --org and GHOSTDOCK_ORG still take precedence.`);
+  log(`    Stored in ${displayPath(getSettingsPath())}. --org and GHOSTDOCK_ORG still take precedence.`);
   return 0;
 }
 async function runOrganizationsCurrent(args, log = console.log) {
   const found = await findOrganizationRef(args.org);
   if (args.json) {
-    log(JSON.stringify(found ? { organization: found.ref, source: found.source } : null, null, 2));
+    log(JSON.stringify(found ? {
+      organization: found.ref,
+      source: found.source,
+      ...found.path && { path: found.path }
+    } : null, null, 2));
     return 0;
   }
   if (!found) {
     log(eventLine("item", `No organization set. Pass --org, set GHOSTDOCK_ORG, or run \`${getCliName()} organizations use <org>\`.`));
     return 0;
   }
-  log(eventLine("item", `${found.label} (${describeSource(found.source)})`));
+  log(eventLine("item", `${found.label} (${describeSource(found)})`));
   return 0;
 }
 var organizationsUseCommand = defineCommand({
   meta: {
     name: "use",
-    description: "Set the default organization for commands run in this directory."
+    description: "Set the default organization for commands run without --org (in every directory)."
   },
   args: {
     org: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ghostdock",
   "description": "Ghostdock CLI — device login and agent tool invocation from the command line",
-  "version": "0.0.9",
+  "version": "0.0.11",
   "type": "module",
   "bin": {
     "ghostdock": "dist/index.js",