replicas-cli 0.2.517 → 0.2.519

package/dist/index.mjs

@@ -8203,7 +8203,8 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/egress.ts
-var EGRESS_CIPHER = "aes-256-gcm";
+var EGRESS_CIPHER = "2022-blake3-aes-256-gcm";
+var EGRESS_KEY_BYTES = 32;
 var EGRESS_SHADOWSOCKS_MODE = "tcp_and_udp";
 var EGRESS_SHADOWSOCKS_VERSION = "1.24.0";
 var EGRESS_SHADOWSOCKS_SHA256 = "0d84f5f350ec99396867d718f146fc3810975b2a7cd06192f158d96bdef460e7";
@@ -8221,24 +8222,44 @@ var EGRESS_DIRECT_ROUTES = [
   "169.254.0.0/16",
   "100.64.0.0/10"
 ];
+var EGRESS_NEW_CONN_RATE = 100;
+var EGRESS_NEW_CONN_BURST = 200;
+var EGRESS_UDP_RATE = 500;
+var EGRESS_UDP_BURST = 1e3;
+var EGRESS_OUT_CONN_RATE = 1e3;
+var EGRESS_OUT_CONN_BURST = 2e3;
 var EGRESS_SHELL_CONFIG = [
   `EGRESS_PORT_RANGE_START=${EGRESS_PORT_RANGE_START}`,
   `EGRESS_PORT_RANGE_END=${EGRESS_PORT_RANGE_END}`,
   `EGRESS_SHADOWSOCKS_VERSION=${EGRESS_SHADOWSOCKS_VERSION}`,
   `EGRESS_SHADOWSOCKS_SHA256=${EGRESS_SHADOWSOCKS_SHA256}`,
   `EGRESS_CIPHER=${EGRESS_CIPHER}`,
+  `EGRESS_KEY_BYTES=${EGRESS_KEY_BYTES}`,
   `EGRESS_MODE=${EGRESS_SHADOWSOCKS_MODE}`,
   `EGRESS_EXIT_IP_ENDPOINTS="${EGRESS_EXIT_IP_ENDPOINTS.join(" ")}"`,
-  `EGRESS_DIRECT_ROUTES="${EGRESS_DIRECT_ROUTES.join(" ")}"`
+  `EGRESS_DIRECT_ROUTES="${EGRESS_DIRECT_ROUTES.join(" ")}"`,
+  `EGRESS_NEW_CONN_RATE=${EGRESS_NEW_CONN_RATE}`,
+  `EGRESS_NEW_CONN_BURST=${EGRESS_NEW_CONN_BURST}`,
+  `EGRESS_UDP_RATE=${EGRESS_UDP_RATE}`,
+  `EGRESS_UDP_BURST=${EGRESS_UDP_BURST}`,
+  `EGRESS_OUT_CONN_RATE=${EGRESS_OUT_CONN_RATE}`,
+  `EGRESS_OUT_CONN_BURST=${EGRESS_OUT_CONN_BURST}`
 ].join("\n");
 var EGRESS_TUNNEL_SERVICE = "replicas-egress.service";
 var EGRESS_TUNNEL_INTERFACE = "rpxtun0";
 var EGRESS_DNS_SERVERS = ["1.1.1.1", "8.8.8.8"];
 var EGRESS_PATHS = {
-  CONFIG_DIR: "/etc/replicas/egress",
-  /** Root-only (0600). Holds the customer's proxy password — never baked into the image. */
-  CONFIG_FILE: "/etc/replicas/egress/config.json",
-  RESOLV_BACKUP: "/etc/replicas/egress/resolv.conf.orig",
+  /**
+   * Under /run, which is tmpfs. The key therefore never touches disk and cannot
+   * be carried into a filesystem snapshot or a paused sandbox's disk image. It
+   * does not survive a reboot either, which is correct: the monolith rewrites
+   * it on every resume, so a revoked credential cannot come back with the
+   * workspace.
+   */
+  CONFIG_DIR: "/run/replicas-egress",
+  CONFIG_FILE: "/run/replicas-egress/config.json",
+  /** Persistent: this records the workspace's original resolver so the tunnel can put it back, and must outlive a reboot. */
+  RESOLV_BACKUP: "/var/lib/replicas-egress-resolv.conf.orig",
   UNIT_FILE: `/etc/systemd/system/${EGRESS_TUNNEL_SERVICE}`,
   UP_SCRIPT: "/usr/local/lib/replicas-egress-up",
   DOWN_SCRIPT: "/usr/local/lib/replicas-egress-down"
@@ -9890,7 +9911,7 @@ function formatTurnElapsed(ms) {
 }
 
 // ../shared/src/cli-version.ts
-var CLI_VERSION = "0.2.517";
+var CLI_VERSION = "0.2.519";
 
 // ../shared/src/version.ts
 function compareVersions(v1, v2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.2.517",
+  "version": "0.2.519",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.mjs",
   "bin": {