gigadrive 2.10.1 → 2.12.0

package/README.md

@@ -36,6 +36,7 @@ gigadrive vm cp vm:<id>:/app/dist ./dist                        # and out
 gigadrive vm shell <id>                                         # interactive terminal
 gigadrive vm ls                                                 # running microVMs (--all includes stopped)
 gigadrive vm extend <id> 1h                                     # stop it one hour from now
+gigadrive vm network <id> --deny-egress                         # cut its internet while it runs
 gigadrive vm stop <id> && gigadrive vm rm <id>
 gigadrive vm images create py-ml --from python:3.13 --wait      # custom images (or --dockerfile ./Dockerfile)
 ```

package/dist/index.cjs

@@ -32,7 +32,7 @@ var import_effect31 = require("effect");
 // package.json
 var package_default = {
   name: "gigadrive",
-  version: "2.10.1",
+  version: "2.12.0",
   repository: {
     type: "git",
     url: "https://github.com/Gigadrive/sdk.git",
@@ -3072,7 +3072,7 @@ var describeMicroVm = (vm, now = Date.now()) => {
     `Image:       ${vm.image.name}`,
     `Size:        ${vm.vcpus} vCPU, ${formatMemory(vm.memoryMb)} memory, ${formatMemory(vm.diskMb)} disk`,
     `Region:      ${vm.region}`,
-    `Network:     ${vm.network.egress === "deny" ? "outbound traffic blocked" : vm.network.allow && vm.network.allow.length > 0 ? `only ${vm.network.allow.join(", ")} (and DNS)` : "internet access"}`,
+    `Network:     ${vm.network.egress === "deny" ? "outbound traffic blocked" : vm.network.allow && vm.network.allow.length > 0 ? `only ${vm.network.allow.join(", ")}` : "internet access"}`,
     `Previews:    ${vm.network.previews === "private" ? "private (preview token required)" : "public"}`,
     `Application: ${vm.applicationId}`,
     `Created:     ${vm.createdAt}`
@@ -3333,27 +3333,32 @@ var withClient = (run) => import_effect24.Effect.gen(function* () {
   return yield* import_effect24.Effect.tryPromise({ try: () => run(client), catch: toApiRequestError });
 });
 var signalOnInterrupt = (signal) => (command, exit) => import_effect24.Exit.isInterrupted(exit) ? import_effect24.Effect.tryPromise(() => command.kill(signal)).pipe(import_effect24.Effect.timeout("2 seconds"), import_effect24.Effect.ignore) : import_effect24.Effect.void;
-var createInput = (flags) => import_effect24.Effect.gen(function* () {
-  const env = yield* keyValues("--env", flags.env);
-  const metadata = yield* keyValues("--metadata", flags.metadata);
-  const timeoutMs = yield* import_effect24.Option.match(flags.timeout, {
-    onNone: () => import_effect24.Effect.succeed(void 0),
-    onSome: (text) => parseLifetime("--timeout", text)
-  });
-  if (flags.denyEgress && flags.allowEgress.length > 0) {
+var checkEgressFlags = (denyEgress, allowEgress) => import_effect24.Effect.gen(function* () {
+  if (denyEgress && allowEgress.length > 0) {
     return yield* new InvalidMicroVmOptionsError({
       message: "--allow-egress cannot be combined with --deny-egress."
     });
   }
-  if (flags.allowEgress.length > 32) {
-    return yield* new InvalidMicroVmOptionsError({ message: "--allow-egress takes at most 32 networks." });
+  if (allowEgress.length > 32) {
+    return yield* new InvalidMicroVmOptionsError({ message: "--allow-egress takes at most 32 entries." });
   }
-  const badNetwork = flags.allowEgress.find((network) => !/^\d{1,3}(\.\d{1,3}){3}\/\d{1,2}$/.test(network.trim()));
-  if (badNetwork !== void 0) {
+  const network = /^\d{1,3}(\.\d{1,3}){3}\/\d{1,2}$/;
+  const domain = /^(\*\.)?([a-z0-9-]+\.)+[a-z0-9-]*[a-z][a-z0-9-]*\.?$/i;
+  const badEntry = allowEgress.find((entry) => !network.test(entry.trim()) && !domain.test(entry.trim()));
+  if (badEntry !== void 0) {
     return yield* new InvalidMicroVmOptionsError({
-      message: `--allow-egress must be an IPv4 network such as 140.82.112.0/20 (got ${badNetwork}).`
+      message: `--allow-egress must be a domain name such as api.openai.com or *.github.com, or an IPv4 network such as 140.82.112.0/20 (got ${badEntry}).`
     });
   }
+});
+var createInput = (flags) => import_effect24.Effect.gen(function* () {
+  const env = yield* keyValues("--env", flags.env);
+  const metadata = yield* keyValues("--metadata", flags.metadata);
+  const timeoutMs = yield* import_effect24.Option.match(flags.timeout, {
+    onNone: () => import_effect24.Effect.succeed(void 0),
+    onSome: (text) => parseLifetime("--timeout", text)
+  });
+  yield* checkEgressFlags(flags.denyEgress, flags.allowEgress);
   const badPort = flags.ports.find((port) => !Number.isInteger(port) || port < 1 || port > 65535);
   if (badPort !== void 0) {
     return yield* new InvalidMicroVmOptionsError({ message: `--port must be between 1 and 65535 (got ${badPort}).` });
@@ -3369,6 +3374,8 @@ var createInput = (flags) => import_effect24.Effect.gen(function* () {
     ...import_effect24.Option.match(flags.memory, { onNone: () => ({}), onSome: (memoryMb) => ({ memoryMb }) }),
     ...import_effect24.Option.match(flags.disk, { onNone: () => ({}), onSome: (diskMb) => ({ diskMb }) }),
     ...timeoutMs !== void 0 ? { timeoutMs } : {},
+    ...flags.pauseOnTimeout ? { onTimeout: "pause" } : {},
+    ...flags.autoResume ? { autoResume: true } : {},
     ...flags.ports.length > 0 ? { ports: [...flags.ports] } : {},
     ...env ? { env } : {},
     ...metadata ? { metadata } : {},
@@ -3376,7 +3383,7 @@ var createInput = (flags) => import_effect24.Effect.gen(function* () {
       network: {
         egress: flags.denyEgress ? "deny" : "allow",
         ...flags.privatePreviews ? { previews: "private" } : {},
-        ...flags.allowEgress.length > 0 ? { allow: [...flags.allowEgress] } : {}
+        ...flags.allowEgress.length > 0 ? { allow: flags.allowEgress.map((entry) => entry.trim()) } : {}
       }
     } : {},
     ...import_effect24.Option.match(flags.region, { onNone: () => ({}), onSome: (region) => ({ region }) })
@@ -3444,10 +3451,18 @@ var createCommand = import_cli12.Command.make(
     ),
     allowEgress: import_cli12.Options.text("allow-egress").pipe(
       import_cli12.Options.withDescription(
-        "Only reach this public IPv4 network, such as 140.82.112.0/20, besides DNS (repeatable, up to 32)"
+        "Only reach this domain name (api.openai.com, *.github.com for every subdomain) or public IPv4 network (140.82.112.0/20) (repeatable, up to 32)"
       ),
       import_cli12.Options.repeated
     ),
+    pauseOnTimeout: import_cli12.Options.boolean("pause-on-timeout").pipe(
+      import_cli12.Options.withDescription("Pause the microVM when its timeout ends instead of stopping it")
+    ),
+    autoResume: import_cli12.Options.boolean("auto-resume").pipe(
+      import_cli12.Options.withDescription(
+        "Resume the paused microVM when a command, file call or public preview request reaches it"
+      )
+    ),
     region: import_cli12.Options.text("region").pipe(import_cli12.Options.withDescription("Region to place the microVM in"), import_cli12.Options.optional),
     json: jsonOption2
   },
@@ -3764,6 +3779,46 @@ var extendCommand = import_cli12.Command.make(
   },
   ({ microvmId, duration }) => extendMicroVm(microvmId, duration).pipe(import_effect24.Effect.asVoid, reportErrors2("extend the microVM"))
 ).pipe(import_cli12.Command.withDescription("Set how long a microVM keeps running, counted from now"));
+var updateMicroVmNetwork = (microvmId, flags) => import_effect24.Effect.gen(function* () {
+  const chosen = [flags.denyEgress, flags.allowEgress.length > 0, flags.allowAllEgress].filter(Boolean).length;
+  if (chosen !== 1) {
+    return yield* new InvalidMicroVmOptionsError({
+      message: "Pass exactly one of --deny-egress, --allow-egress or --allow-all-egress."
+    });
+  }
+  yield* checkEgressFlags(flags.denyEgress, flags.allowEgress);
+  const apiClient = yield* ApiClientService;
+  const vm = yield* apiClient.request(
+    (client) => client.microvms.updateNetwork(
+      microvmId,
+      flags.denyEgress ? { egress: "deny" } : flags.allowEgress.length > 0 ? { egress: "allow", allow: flags.allowEgress.map((entry) => entry.trim()) } : { egress: "allow" }
+    )
+  );
+  const reach = vm.network.egress === "deny" ? "no outbound traffic" : vm.network.allow ? vm.network.allow.join(", ") : "the whole internet";
+  yield* import_effect24.Console.log(`${vm.id} now reaches ${reach}.`);
+  return vm;
+});
+var networkCommand = import_cli12.Command.make(
+  "network",
+  {
+    microvmId: microvmIdArg,
+    denyEgress: import_cli12.Options.boolean("deny-egress").pipe(import_cli12.Options.withDescription("Block all outbound network traffic")),
+    allowEgress: import_cli12.Options.text("allow-egress").pipe(
+      import_cli12.Options.withDescription(
+        "Only reach this domain name (api.openai.com, *.github.com for every subdomain) or public IPv4 network (140.82.112.0/20) (repeatable, up to 32)"
+      ),
+      import_cli12.Options.repeated
+    ),
+    allowAllEgress: import_cli12.Options.boolean("allow-all-egress").pipe(
+      import_cli12.Options.withDescription("Reach the whole internet again (private networks stay blocked)")
+    )
+  },
+  ({ microvmId, ...flags }) => updateMicroVmNetwork(microvmId, flags).pipe(import_effect24.Effect.asVoid, reportErrors2("update the microVM network"))
+).pipe(
+  import_cli12.Command.withDescription(
+    "Change what a running or paused microVM may reach; connections the new rules no longer allow are closed"
+  )
+);
 var imagesListCommand = import_cli12.Command.make(
   "ls",
   { app: appOption6, json: jsonOption2 },
@@ -3870,6 +3925,7 @@ var SUBCOMMANDS = [
   stopCommand,
   removeCommand2,
   extendCommand,
+  networkCommand,
   imagesCommand
 ];
 var microvmsCommand = import_cli12.Command.make("microvms", {}, () => import_effect24.Effect.void).pipe(