akashcli 4.5.0__tar.gz → 4.5.1__tar.gz

{akashcli-4.5.0 → akashcli-4.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: akashcli
-Version: 4.5.0
+Version: 4.5.1
 Summary: Akash CLI — secure remote shell relay, file vault, and device management
 License: MIT
 Keywords: akash,cli,relay,remote-shell,vault

{akashcli-4.5.0 → akashcli-4.5.1}/akashcli/relay.py

@@ -554,6 +554,9 @@ def guest_serve(base_url: str) -> None:
     Host a shell session with no API key.
     Requests a pairing code from the server, prints it, then waits for
     someone to connect with: akash shell --code <CODE>
+
+    Security: every incoming connection shows the guest IP + fingerprint
+    and asks the host to approve before the shell is bridged.
     """
     import httpx
     import websockets.sync.client as _ws
@@ -571,15 +574,15 @@ def guest_serve(base_url: str) -> None:
     print()
     print(f"  {_G}◉{_RS}  guest relay ready")
     print()
-    print(f"  Your pairing code:  {_C}{_Y}{code}{_RS}")
+    print(f"  {_DM}Pairing code:{_RS}  {_C}{code}{_RS}")
     print()
-    print(f"  {_DM}On another machine, run:{_RS}")
-    print(f"    {_C}akash shell --code {code}{_RS}")
+    print(f"  {_DM}On another machine:{_RS}  {_C}akash shell --code {code}{_RS}")
     print()
     print(f"  {_DM}Code expires in {ttl // 60} min  ·  Ctrl-C to stop{_RS}")
+    print(f"  {_DM}You will be asked to approve each connection before it gets shell access.{_RS}")
     print()
 
-    # 2. Connect to host endpoint and serve shell frames
+    # 2. Connect to host endpoint — handle knock/allow/deny then serve shell
     while True:
         try:
             ws_url = _guest_host_url(base_url, code)
@@ -588,20 +591,70 @@ def guest_serve(base_url: str) -> None:
                 if ack.get("type") == "error":
                     print(f"  {_R}✗{_RS}  {ack.get('message')}", file=sys.stderr)
                     return
-                print(f"  {_DM}waiting for connection…{_RS}")
-                _run_relay_device(ws, f"guest:{code}")
-                print(f"\n  {_DM}session ended — waiting for next connection…{_RS}\n")
+
+                print(f"  {_DM}waiting for connection…{_RS}", flush=True)
+
+                # Wait for either a knock (someone wants in) or a ping
+                while True:
+                    try:
+                        raw = ws.recv(timeout=35)
+                    except Exception:
+                        # Timeout or disconnect — break to reconnect loop
+                        break
+                    frame = json.loads(raw)
+                    ftype = frame.get("type")
+
+                    if ftype == "ping":
+                        ws.send(json.dumps({"type": "pong"}))
+                        continue
+
+                    if ftype == "knock":
+                        guest_ip  = frame.get("ip", "unknown")
+                        fp        = frame.get("fingerprint", "????????")
+                        print()
+                        print(f"  {_Y}⚡{_RS}  Incoming connection request")
+                        print(f"  {_DM}From:{_RS}         {_C}{guest_ip}{_RS}")
+                        print(f"  {_DM}Fingerprint:{_RS}  {_C}{fp}{_RS}")
+                        print()
+
+                        # Prompt host — default is N (deny)
+                        try:
+                            sys.stdout.write(f"  Allow? [y/N]: ")
+                            sys.stdout.flush()
+                            answer = sys.stdin.readline().strip().lower()
+                        except (EOFError, KeyboardInterrupt):
+                            answer = "n"
+
+                        if answer == "y":
+                            ws.send(json.dumps({"type": "allow"}))
+                            print(f"  {_G}✓{_RS}  connection allowed — starting shell…")
+                            print()
+                            # Now serve shell frames
+                            _run_relay_device(ws, f"guest:{code}")
+                            print(f"\n  {_DM}session ended — waiting for next connection…{_RS}\n")
+                        else:
+                            ws.send(json.dumps({"type": "deny"}))
+                            print(f"  {_R}✗{_RS}  connection denied")
+                            print()
+                            # Loop back — still waiting on same code
+                        continue
+
+                    # Any other frame — ignore and keep waiting
+                    continue
+
         except KeyboardInterrupt:
             print(f"\n  {_DM}guest serve stopped{_RS}")
             break
         except Exception as exc:
-            print(f"  {_Y}!{_RS}  relay disconnected ({exc}) — reconnecting…")
+            print(f"  {_Y}!{_RS}  relay disconnected ({exc}) — reconnecting in 3s…")
             time.sleep(3)
 
 
 def guest_connect_shell(base_url: str, code: str) -> int:
     """
     Connect to a guest host by pairing code — no API key needed.
+    Handles the approval handshake: shows a spinner while the host decides,
+    then opens a full PTY shell if approved.
     Returns the remote exit code.
     """
     import websockets.sync.client as _ws
@@ -636,10 +689,42 @@ def guest_connect_shell(base_url: str, code: str) -> int:
     exit_code = 1
     try:
         with _ws.connect(ws_url, open_timeout=15, close_timeout=10) as ws:
-            ack = json.loads(ws.recv())
-            if ack.get("type") == "error":
+            # First frame: could be error, waiting_approval, or connected
+            first = json.loads(ws.recv())
+            ftype = first.get("type")
+
+            if ftype == "error":
                 _restore()
-                raise RuntimeError(ack.get("message", "relay error"))
+                raise RuntimeError(first.get("message", "relay error"))
+
+            if ftype == "waiting_approval":
+                fp = first.get("fingerprint", "")
+                _restore()   # restore terminal so we can print cleanly
+                print(f"  {_Y}…{_RS}  waiting for host to approve this connection…")
+                if fp:
+                    print(f"  {_DM}Your fingerprint:  {_C}{fp}{_RS}")
+                print(f"  {_DM}(host has 30 seconds to respond){_RS}")
+                print()
+                # Wait for next frame: connected or denied
+                try:
+                    second = json.loads(ws.recv(timeout=35))
+                except Exception:
+                    raise RuntimeError("Timed out waiting for host approval.")
+                if second.get("type") == "denied":
+                    raise RuntimeError("Host declined the connection.")
+                if second.get("type") != "connected":
+                    raise RuntimeError(second.get("message", "unexpected response from host"))
+                # Re-enter raw mode for the PTY session
+                try:
+                    import tty as _tty2, termios as _term2
+                    _old_settings = _term2.tcgetattr(_stdin_fd)
+                    _tty2.setraw(_stdin_fd)
+                    _raw_ok = True
+                except Exception:
+                    pass
+            elif ftype != "connected":
+                _restore()
+                raise RuntimeError(first.get("message", "unexpected server response"))
 
             ws.send(json.dumps({
                 "type": "pty_run",

{akashcli-4.5.0 → akashcli-4.5.1}/akashcli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: akashcli
-Version: 4.5.0
+Version: 4.5.1
 Summary: Akash CLI — secure remote shell relay, file vault, and device management
 License: MIT
 Keywords: akash,cli,relay,remote-shell,vault

{akashcli-4.5.0 → akashcli-4.5.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "akashcli"
-version = "4.5.0"
+version = "4.5.1"
 description = "Akash CLI — secure remote shell relay, file vault, and device management"
 readme = "README.md"
 requires-python = ">=3.9"