akashcli 4.5.2__tar.gz → 4.5.4__tar.gz

{akashcli-4.5.2 → akashcli-4.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: akashcli
-Version: 4.5.2
+Version: 4.5.4
 Summary: Akash CLI — secure remote shell relay, file vault, and device management
 License: MIT
 Keywords: akash,cli,relay,remote-shell,vault
@@ -12,6 +12,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 Requires-Dist: httpx
+Requires-Dist: certifi
 Requires-Dist: typer
 Requires-Dist: cryptography
 Requires-Dist: pydantic

akashcli-4.5.4/akashcli/_net.py

@@ -0,0 +1,177 @@
+"""
+_net.py — Network helpers for akashcli.
+
+On Android/Termux the system DNS daemon (netd) may cache stale IP records
+for the server long after they have changed.  curl uses Android's native
+networking APIs and sees fresh records; Python's socket.getaddrinfo() goes
+through netd and gets the old IP, causing all connections to time out.
+
+This module provides:
+  • doh_resolve(host)   — resolve a hostname via Google DoH using curl subprocess
+  • patch_dns(host)     — globally patch socket.create_connection for one host
+  • ws_connect(url)     — websockets.sync.client.connect() with DoH pre-resolution
+  • ssl_context()       — SSLContext using certifi CA bundle
+
+All functions are safe to call on non-Android systems (they simply do nothing
+extra).
+"""
+
+from __future__ import annotations
+
+import json as _json
+import shutil as _sh
+import socket as _socket
+import ssl as _ssl
+import subprocess as _sp
+from typing import Optional
+from urllib.parse import urlparse as _urlparse
+
+# ── per-host DoH cache (lives for the process lifetime) ──────────────────────
+_DOH_CACHE: dict[str, str] = {}
+
+
+def doh_resolve(host: str) -> Optional[str]:
+    """
+    Resolve *host* via DNS-over-HTTPS (Google) using a curl subprocess.
+    Returns the first A-record IP string, or None on any failure.
+
+    Uses curl because it goes through Android's native networking stack and
+    therefore sees up-to-date DNS records, unlike Python's socket.getaddrinfo
+    which may hit Android's netd stale cache.
+    """
+    if host in _DOH_CACHE:
+        return _DOH_CACHE[host]
+
+    curl = _sh.which("curl")
+    if not curl:
+        return None
+    try:
+        r = _sp.run(
+            [curl, "-sk", "--max-time", "8",
+             f"https://dns.google/resolve?name={host}&type=A"],
+            capture_output=True, timeout=10,
+        )
+        data = _json.loads(r.stdout)
+        answers = [a["data"] for a in data.get("Answer", [])
+                   if a.get("type") == 1]   # type 1 == A record
+        if answers:
+            _DOH_CACHE[host] = answers[0]
+            return answers[0]
+    except Exception:
+        pass
+    return None
+
+
+def ssl_context() -> _ssl.SSLContext:
+    """Return an SSLContext backed by certifi's CA bundle (if installed)."""
+    try:
+        import certifi as _cf
+        return _ssl.create_default_context(cafile=_cf.where())
+    except ImportError:
+        return _ssl.create_default_context()
+
+
+def make_socket(host: str, port: int, timeout: int = 15) -> _socket.socket:
+    """
+    Open a TCP socket to host:port.
+    If DoH returns a different IP than what getaddrinfo would return, use the
+    DoH IP with the host as SNI (caller must wrap TLS themselves).
+    Falls back to normal getaddrinfo on any failure.
+    """
+    ip = doh_resolve(host)
+    if ip:
+        try:
+            return _socket.create_connection((ip, port), timeout=timeout)
+        except Exception:
+            pass
+    return _socket.create_connection((host, port), timeout=timeout)
+
+
+def ws_connect(url: str, **kwargs):
+    """
+    websockets.sync.client.connect() with DoH-resolved IP.
+    Pass open_timeout / close_timeout etc. as keyword arguments as normal.
+    The special kwarg _sock_timeout (int, default 15) controls the TCP connect
+    timeout before the WebSocket handshake.
+    """
+    import websockets.sync.client as _wsc
+
+    parsed  = _urlparse(url)
+    host    = parsed.hostname or ""
+    port    = parsed.port or (443 if parsed.scheme == "wss" else 80)
+    use_tls = parsed.scheme == "wss"
+
+    sock_timeout = kwargs.pop("_sock_timeout", 15)
+    sock = make_socket(host, port, timeout=sock_timeout)
+
+    if use_tls:
+        return _wsc.connect(url, sock=sock, ssl=ssl_context(), **kwargs)
+    return _wsc.connect(url, sock=sock, **kwargs)
+
+
+def http_post(url: str, *, timeout: int = 10, **kwargs) -> dict:
+    """
+    POST *url* and return the parsed JSON response dict.
+    Uses curl subprocess (bypasses Android stale DNS) and falls back to
+    urllib with a DoH-patched socket on failure.
+    """
+    parsed  = _urlparse(url)
+    host    = parsed.hostname or ""
+    real_ip = doh_resolve(host)
+
+    # ── 1. curl subprocess ────────────────────────────────────────────────────
+    curl = _sh.which("curl")
+    if curl:
+        cmd = [curl, "-sk", "--max-time", str(timeout), "-X", "POST"]
+        if real_ip:
+            cmd += ["--resolve", f"{host}:443:{real_ip}"]
+        cmd.append(url)
+        try:
+            r = _sp.run(cmd, capture_output=True, timeout=timeout + 5)
+            if r.returncode == 0 and r.stdout:
+                return _json.loads(r.stdout)
+        except Exception:
+            pass
+
+    # ── 2. urllib with monkey-patched socket ──────────────────────────────────
+    import urllib.request as _ur
+    from urllib.request import HTTPSHandler as _HH
+
+    ctx = ssl_context()
+
+    if real_ip:
+        _orig = _socket.create_connection
+        def _patched(addr, *a, **kw):
+            h, p = addr
+            return _orig((real_ip, p) if h == host else addr, *a, **kw)
+        _socket.create_connection = _patched
+
+    try:
+        opener = _ur.build_opener(_HH(context=ctx))
+        req    = _ur.Request(url, data=b"", method="POST")
+        with opener.open(req, timeout=timeout) as resp:
+            return _json.loads(resp.read())
+    finally:
+        if real_ip:
+            _socket.create_connection = _orig   # type: ignore[possibly-undefined]
+
+
+def patch_dns_globally(host: str) -> None:
+    """
+    Permanently patch socket.create_connection so that connections to *host*
+    use the DoH-resolved IP.  Safe to call multiple times.
+    Intended to be called once at CLI startup for the configured server host.
+    """
+    ip = doh_resolve(host)
+    if not ip:
+        return
+
+    _orig = getattr(_socket, "_akash_orig_create", _socket.create_connection)
+    _socket._akash_orig_create = _orig  # type: ignore[attr-defined]
+
+    def _patched(addr, *args, **kwargs):
+        h, p = addr
+        real = ip if h == host else None
+        return _orig((real or h, p), *args, **kwargs)
+
+    _socket.create_connection = _patched

{akashcli-4.5.2 → akashcli-4.5.4}/akashcli/client.py

@@ -4,16 +4,20 @@ from typing import List, Optional
 from .models import UploadResult, FileInfo, UserInfo
 from .exceptions import *
 from .config import ConfigManager
+from ._net import patch_dns_globally as _patch_dns
 
 class AkashClient:
     def __init__(self, api_key: Optional[str] = None, api_url: Optional[str] = None):
         import os as _os
+        from urllib.parse import urlparse as _up
         config = ConfigManager.load()
         # Env vars override everything — useful when hardware-ID encryption differs across su sessions
         self.api_key = api_key or _os.getenv("AKASH_API_KEY") or config.get("api_key")
         self.base_url = (
             api_url or _os.getenv("AKASH_API_URL") or config.get("api_url", "https://jstore.2bd.net")
         ).rstrip("/")
+        # Patch socket DNS to bypass Android stale DNS cache
+        _patch_dns(_up(self.base_url).hostname or "")
 
         if not self.api_key:
             raise AuthenticationError("No API Key found. Run 'akash login' or set AKASH_API_KEY env var.")

{akashcli-4.5.2 → akashcli-4.5.4}/akashcli/exec.py

@@ -48,6 +48,7 @@ from pathlib import Path
 from typing import Optional
 
 import httpx
+from ._net import patch_dns_globally as _patch_dns, ws_connect as _ws_connect_net
 
 # ── Paths & constants ────────────────────────────────────────────────────────
 
@@ -241,6 +242,10 @@ def acquire_exec_token(api_key: str, base_url: str, controller: bool = False) ->
                        connect / run / shell).  Just authenticates as owner.
     controller=False — full challenge/sign/enroll flow (used by akash serve).
     """
+    # Patch socket DNS for this host — bypasses Android stale DNS cache
+    from urllib.parse import urlparse as _up
+    _patch_dns(_up(base_url).hostname or "")
+
     token = _load_cached_token(base_url)
     if token:
         return token
@@ -327,11 +332,11 @@ def kill_session(token: str, base_url: str, session_id: str) -> None:
 
 def run_command(token: str, base_url: str, command: str,
                 env: Optional[dict] = None) -> int:
-    import websockets.sync.client as _ws
+    
     ws_url = _build_ws_url(base_url, token)
     exit_code = 1
     try:
-        with _ws.connect(ws_url, open_timeout=15, close_timeout=10) as ws:
+        with _ws_connect_net(ws_url, open_timeout=15, close_timeout=10) as ws:
             ws.send(json.dumps({"type": "run", "command": command, "env": env or {}}))
             while True:
                 try:
@@ -367,7 +372,7 @@ def run_shell(token: str, base_url: str) -> int:
     Commands run in the same shell process — cd, export, and variables persist.
     Output streams live with ANSI colours passed through.
     """
-    import websockets.sync.client as _ws
+    
 
     _load_shell_history()
 
@@ -557,7 +562,7 @@ def _run_tui(command: str, token: str, base_url: str,
     """
     import select as _sel
     import signal
-    import websockets.sync.client as _ws
+    
 
     ws_url = _build_ws_url(base_url, token)
     rows, cols = _get_terminal_size()
@@ -586,7 +591,7 @@ def _run_tui(command: str, token: str, base_url: str,
     exit_code = 1
 
     try:
-        with _ws.connect(ws_url, open_timeout=15, close_timeout=10) as ws:
+        with _ws_connect_net(ws_url, open_timeout=15, close_timeout=10) as ws:
             # Send PTY handshake
             ws.send(json.dumps({
                 "type":       "pty_run",
@@ -702,7 +707,7 @@ def _exec_remote(command: str, token: str, base_url: str,
     first_output = True
 
     try:
-        with _ws.connect(ws_url, open_timeout=15, close_timeout=15) as ws:
+        with _ws_connect_net(ws_url, open_timeout=15, close_timeout=15) as ws:
             ws.send(json.dumps({
                 "type":       "run",
                 "command":    command,
@@ -754,9 +759,9 @@ def _exec_remote(command: str, token: str, base_url: str,
 def _fetch_cwd(token: str, base_url: str, session_id: Optional[str]) -> str:
     """Ask the server for the current working directory."""
     try:
-        import websockets.sync.client as _ws
+        
         ws_url = _build_ws_url(base_url, token)
-        with _ws.connect(ws_url, open_timeout=8, close_timeout=5) as ws:
+        with _ws_connect_net(ws_url, open_timeout=8, close_timeout=5) as ws:
             ws.send(json.dumps({
                 "type": "run", "command": "pwd",
                 "session_id": session_id, "track_cwd": True,
@@ -836,7 +841,7 @@ def _cmd_session(token: str, base_url: str, session_id: Optional[str],
 
 def _cmd_status(token: str, base_url: str, session_id: Optional[str]) -> int:
     # Run a compound command to fetch server stats
-    import websockets.sync.client as _ws
+    
     cmd = (
         r'printf "cwd=%s\npid=%s\nload=%s\nuptime=%s\nshell=%s\nuser=%s\nhostname=%s\n" '
         r'"$(pwd)" "$$" "$(cut -d" " -f1-3 /proc/loadavg 2>/dev/null || uptime | grep -oE "[0-9.]+, [0-9.]+, [0-9.]+")" '
@@ -846,7 +851,7 @@ def _cmd_status(token: str, base_url: str, session_id: Optional[str]) -> int:
     ws_url = _build_ws_url(base_url, token)
     output = b""
     try:
-        with _ws.connect(ws_url, open_timeout=8, close_timeout=5) as ws:
+        with _ws_connect_net(ws_url, open_timeout=8, close_timeout=5) as ws:
             ws.send(json.dumps({"type": "run", "command": cmd, "session_id": session_id}))
             while True:
                 raw = ws.recv()
@@ -883,12 +888,12 @@ def _cmd_status(token: str, base_url: str, session_id: Optional[str]) -> int:
 
 
 def _cmd_env(token: str, base_url: str, session_id: Optional[str]) -> int:
-    import websockets.sync.client as _ws
+    
     ws_url = _build_ws_url(base_url, token)
     output = b""
     ec = 0
     try:
-        with _ws.connect(ws_url, open_timeout=8, close_timeout=5) as ws:
+        with _ws_connect_net(ws_url, open_timeout=8, close_timeout=5) as ws:
             ws.send(json.dumps({"type": "run", "command": "env | sort", "session_id": session_id}))
             while True:
                 raw = ws.recv()
@@ -917,12 +922,12 @@ def _cmd_export(kv: str, token: str, base_url: str, session_id: Optional[str]) -
     if not kv or "=" not in kv:
         _print_err("Usage: :export KEY=VALUE")
         return 1
-    import websockets.sync.client as _ws
+    
     ws_url = _build_ws_url(base_url, token)
     cmd = f"export {kv}"
     ec = 0
     try:
-        with _ws.connect(ws_url, open_timeout=8, close_timeout=5) as ws:
+        with _ws_connect_net(ws_url, open_timeout=8, close_timeout=5) as ws:
             ws.send(json.dumps({"type": "run", "command": cmd, "session_id": session_id}))
             while True:
                 raw = ws.recv()

{akashcli-4.5.2 → akashcli-4.5.4}/akashcli/relay.py

@@ -48,6 +48,16 @@ _SERVE_PID   = _AKASH_DIR / "serve.pid"
 _SERVE_LOG   = _AKASH_DIR / "serve.log"
 
 
+# ── Network helpers (bypass Android stale DNS) ────────────────────────────────
+from ._net import (
+    doh_resolve   as _doh_resolve,
+    make_socket   as _make_socket,
+    ssl_context   as _ssl_context,
+    ws_connect    as _ws_connect,
+    http_post     as _http_post,
+)
+
+
 # ── WS URL builder ────────────────────────────────────────────────────────────
 
 def _ws_base(http_url: str) -> str:
@@ -85,14 +95,12 @@ def serve(api_key: str, base_url: str, label: str, daemon: bool = False) -> None
     print(f"  {_G}◉{_RS}  akash serve  {_DM}label={label}{_RS}")
     print(f"  {_DM}connecting to relay…{_RS}")
 
-    import websockets.sync.client as _ws
-
     while True:   # reconnect loop
         try:
             token = acquire_exec_token(api_key, base_url)
             ws_url = _listen_url(base_url, token)
 
-            with _ws.connect(ws_url, open_timeout=15, close_timeout=5) as ws:
+            with _ws_connect(ws_url, open_timeout=15, close_timeout=5) as ws:
                 # Send listen handshake
                 ws.send(json.dumps({"type": "listen", "label": label}))
                 # Wait for server ack
@@ -295,13 +303,12 @@ def connect_run(api_key: str, base_url: str, command: str,
     Returns the remote exit code.
     """
     from .exec import acquire_exec_token
-    import websockets.sync.client as _ws
 
     token  = acquire_exec_token(api_key, base_url, controller=True)
     ws_url = _connect_url(base_url, token, target)
     exit_code = 1
 
-    with _ws.connect(ws_url, open_timeout=15, close_timeout=10) as ws:
+    with _ws_connect(ws_url, open_timeout=15, close_timeout=10) as ws:
         # Wait for tunnel confirmation
         ack = json.loads(ws.recv())
         if ack.get("type") == "error":
@@ -345,7 +352,6 @@ def connect_shell(api_key: str, base_url: str,
     Returns the remote exit code.
     """
     from .exec import acquire_exec_token, _get_terminal_size
-    import websockets.sync.client as _ws
     import select as _sel, signal
 
     token  = acquire_exec_token(api_key, base_url, controller=True)
@@ -376,7 +382,7 @@ def connect_shell(api_key: str, base_url: str,
     exit_code = 1
 
     try:
-        with _ws.connect(ws_url, open_timeout=15, close_timeout=10) as ws:
+        with _ws_connect(ws_url, open_timeout=15, close_timeout=10) as ws:
             # Wait for tunnel open
             ack = json.loads(ws.recv())
             if ack.get("type") == "error":
@@ -558,26 +564,9 @@ def guest_serve(base_url: str) -> None:
     Security: every incoming connection shows the guest IP + fingerprint
     and asks the host to approve before the shell is bridged.
     """
-    import websockets.sync.client as _ws
-
-    # 1. Get a pairing code — try httpx first, fall back to urllib (system certs)
-    def _post_code(url: str) -> dict:
-        try:
-            import httpx as _hx
-            r = _hx.post(url, timeout=10)
-            r.raise_for_status()
-            return r.json()
-        except Exception:
-            pass
-        # urllib fallback — uses system CA bundle, works on Android/Termux
-        import urllib.request as _ur, urllib.error as _ue
-        req = _ur.Request(url, data=b"", method="POST")
-        with _ur.urlopen(req, timeout=10) as resp:
-            import json as _j
-            return _j.loads(resp.read())
-
+    # 1. Get a pairing code using DoH-aware HTTP POST (bypasses Android stale DNS)
     try:
-        data = _post_code(_guest_code_url(base_url))
+        data = _http_post(_guest_code_url(base_url))
         code = data["code"]
         ttl  = data.get("expires_in", 600)
     except Exception as e:
@@ -600,7 +589,7 @@ def guest_serve(base_url: str) -> None:
     while True:
         try:
             ws_url = _guest_host_url(base_url, code)
-            with _ws.connect(ws_url, open_timeout=15, close_timeout=5) as ws:
+            with _ws_connect(ws_url, open_timeout=15, close_timeout=5) as ws:
                 ack = json.loads(ws.recv())
                 if ack.get("type") == "error":
                     print(f"  {_R}✗{_RS}  {ack.get('message')}", file=sys.stderr)
@@ -671,7 +660,6 @@ def guest_connect_shell(base_url: str, code: str) -> int:
     then opens a full PTY shell if approved.
     Returns the remote exit code.
     """
-    import websockets.sync.client as _ws
     import select as _sel, signal
 
     code = code.strip().upper()
@@ -702,7 +690,7 @@ def guest_connect_shell(base_url: str, code: str) -> int:
 
     exit_code = 1
     try:
-        with _ws.connect(ws_url, open_timeout=15, close_timeout=10) as ws:
+        with _ws_connect(ws_url, open_timeout=15, close_timeout=10) as ws:
             # First frame: could be error, waiting_approval, or connected
             first = json.loads(ws.recv())
             ftype = first.get("type")

{akashcli-4.5.2 → akashcli-4.5.4}/akashcli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: akashcli
-Version: 4.5.2
+Version: 4.5.4
 Summary: Akash CLI — secure remote shell relay, file vault, and device management
 License: MIT
 Keywords: akash,cli,relay,remote-shell,vault
@@ -12,6 +12,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 Requires-Dist: httpx
+Requires-Dist: certifi
 Requires-Dist: typer
 Requires-Dist: cryptography
 Requires-Dist: pydantic

{akashcli-4.5.2 → akashcli-4.5.4}/akashcli.egg-info/SOURCES.txt

@@ -1,6 +1,7 @@
 README.md
 pyproject.toml
 akashcli/__init__.py
+akashcli/_net.py
 akashcli/auth.py
 akashcli/cli.py
 akashcli/client.py

{akashcli-4.5.2 → akashcli-4.5.4}/akashcli.egg-info/requires.txt

@@ -1,4 +1,5 @@
 httpx
+certifi
 typer
 cryptography
 pydantic

{akashcli-4.5.2 → akashcli-4.5.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "akashcli"
-version = "4.5.2"
+version = "4.5.4"
 description = "Akash CLI — secure remote shell relay, file vault, and device management"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -15,6 +15,7 @@ classifiers = [
 ]
 dependencies = [
     "httpx",
+    "certifi",
     "typer",
     "cryptography",
     "pydantic",