lager-cli 0.32.3__tar.gz → 0.32.5__tar.gz

{lager_cli-0.32.3/lager_cli.egg-info → lager_cli-0.32.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: lager-cli
-Version: 0.32.3
+Version: 0.32.5
 Summary: Lager CLI - Box and Docker connectivity
 Home-page: https://github.com/lagerdata/lager
 Author: Lager Data

{lager_cli-0.32.3 → lager_cli-0.32.5}/__init__.py

@@ -7,4 +7,4 @@ Lager CLI
 A Command Line Interface for Lager Data
 """
 
-__version__ = '0.32.3'
+__version__ = '0.32.5'

{lager_cli-0.32.3 → lager_cli-0.32.5}/battery/websocket_client.py

@@ -132,19 +132,36 @@ class BatteryWebSocketClient:
         Returns:
             True if connected successfully, False otherwise
         """
-        try:
-            from ..gateway_auth import auth_headers_for_url
-            self.sio.connect(
-                self.box_url,
-                namespaces=['/battery'],
-                wait_timeout=timeout,
-                headers=auth_headers_for_url(self.box_url)
-            )
-            return True
-        except Exception as e:
-            if self.on_error:
-                self.on_error(f"Could not connect to box at {self.box_url}: {str(e)}")
-            return False
+        from ..gateway_auth import (
+            auth_headers_for_url, plain_error_text, ws_handshake_recovery,
+        )
+        headers = auth_headers_for_url(self.box_url)
+        for attempt in (0, 1):
+            try:
+                self.sio.connect(
+                    self.box_url,
+                    namespaces=['/battery'],
+                    wait_timeout=timeout,
+                    headers=headers
+                )
+                return True
+            except Exception as e:
+                # The handshake exception hides the HTTP response, so probe
+                # the box over HTTP: a gated box's first contact records the
+                # mapping and hands back the token for one retry; a genuine
+                # denial becomes the actionable message.
+                retry_headers, denial = ws_handshake_recovery(self.box_url, headers)
+                if denial is not None:
+                    if self.on_error:
+                        self.on_error(plain_error_text(denial))
+                    return False
+                if attempt == 0 and retry_headers:
+                    headers = retry_headers
+                    continue
+                if self.on_error:
+                    self.on_error(f"Could not connect to box at {self.box_url}: {str(e)}")
+                return False
+        return False
 
     def start_monitoring(self) -> bool:
         """

{lager_cli-0.32.3 → lager_cli-0.32.5}/box_storage.py

@@ -583,43 +583,49 @@ def _gateway_kwargs(ip):
 
 def _resend_with_auth(prepared, headers):
     """Re-send an already-prepared request with extra headers merged in.
-    Returns the new response, or None if the resend itself failed."""
+    Returns the new response, or None if the resend itself failed.
+
+    Sent with ``stream=True`` so callers that stream the original request
+    (pip/python output) keep streaming on the retried response; non-streaming
+    callers read ``.json()``/``.text`` which consumes it identically."""
     import requests
     req = prepared.copy()
     for key, value in headers.items():
         req.headers[key] = value
     try:
-        return requests.Session().send(req, timeout=30, stream=False)
+        return requests.Session().send(req, timeout=30, stream=True)
     except requests.RequestException:
         return None
 
 
-def _check_gateway(resp, ip):
-    """Resolve a gateway response, returning the response the caller should use.
-
-    On a plain (un-gated) box this is a passthrough. On a gated box:
+def _resolve_gateway(resp, ip):
+    """Record-and-retry core shared by :func:`_check_gateway` and
+    :func:`check_gateway_status` — the single implementation of gateway
+    discovery. Returns ``(resp, denied)``:
 
+    - Non-gateway responses (no discovery header) pass through untouched
+      with ``denied=False`` — plain boxes are never affected.
     - First contact — we sent no token (the box→auth-server link is only
       learned from this very 401's discovery header) but we already hold a
       session for that server: record the mapping, attach the token, and
-      retry the request once. The caller gets the authenticated response and
-      never sees the round trip. A plain box never receives the token,
-      because only a gateway sends the discovery header.
-    - Genuine denials (revoked session, no access grant, auth server down)
-      raise the actionable `lager login` / "ask your admin" error as before.
-
-    Callers should adopt the return value: ``resp = _check_gateway(resp, ip)``.
+      retry the request once. On success the retried, authenticated response
+      is returned with ``denied=False``. A plain box never receives the
+      token, because only a gateway sends the discovery header.
+    - Anything else is a genuine denial: the mapping is still recorded (so
+      the next attempt authenticates) and ``denied=True`` tells the caller
+      to handle ``resp`` as a gateway denial.
     """
     from .gateway_auth import (
-        DISCOVERY_HEADER, handle_gateway_denial,
-        record_box_auth_server, auth_headers_for_box,
+        DISCOVERY_HEADER, record_box_auth_server, auth_headers_for_box,
     )
-    if not (resp.status_code in (401, 403, 503) and DISCOVERY_HEADER in resp.headers):
-        return resp
+    # getattr: tolerate response-shaped fakes without a headers attribute.
+    resp_headers = getattr(resp, 'headers', None) or {}
+    if not (resp.status_code in (401, 403, 503) and DISCOVERY_HEADER in resp_headers):
+        return resp, False
 
+    record_box_auth_server(ip, resp_headers[DISCOVERY_HEADER])
     sent_auth = 'Authorization' in getattr(resp.request, 'headers', {})
     if resp.status_code == 401 and not sent_auth:
-        record_box_auth_server(ip, resp.headers[DISCOVERY_HEADER])
         headers = auth_headers_for_box(ip)
         if headers:
             retried = _resend_with_auth(resp.request, headers)
@@ -627,13 +633,47 @@ def _check_gateway(resp, ip):
                 gated = (retried.status_code in (401, 403, 503)
                          and DISCOVERY_HEADER in retried.headers)
                 if not gated:
-                    return retried      # transparently authenticated
-                resp = retried          # still refused — report on the retry
+                    return retried, False   # transparently authenticated
+                resp = retried              # still refused — report on the retry
+
+    return resp, True
+
+
+def _check_gateway(resp, ip):
+    """Resolve a gateway response, returning the response the caller should use.
+
+    On a plain (un-gated) box this is a passthrough. On a gated box the
+    first contact is retried transparently (see :func:`_resolve_gateway`);
+    genuine denials (revoked session, no access grant, auth server down)
+    raise the actionable `lager login` / "ask your admin" error as before.
 
-    handle_gateway_denial(resp, ip)     # raises the actionable error
+    Callers should adopt the return value: ``resp = _check_gateway(resp, ip)``.
+    """
+    from .gateway_auth import handle_gateway_denial
+    resp, denied = _resolve_gateway(resp, ip)
+    if denied:
+        handle_gateway_denial(resp, ip)     # raises the actionable error
     return resp
 
 
+def check_gateway_status(resp, ip):
+    """Non-raising variant of :func:`_check_gateway` for fan-out and
+    fail-open callers (`lager boxes`, health polls) that must not abort on a
+    single box's denial.
+
+    Performs the same record-and-retry as ``_check_gateway``. Returns
+    ``(resp, label)``: ``label`` is None when the caller should simply use
+    ``resp`` (plain box, or the retry authenticated transparently), else a
+    short user-facing verdict — 'sign-in required', 'session rejected',
+    'no access', or 'auth server down'.
+    """
+    from .gateway_auth import denial_label
+    resp, denied = _resolve_gateway(resp, ip)
+    if not denied:
+        return resp, None
+    return resp, denial_label(resp)
+
+
 def _lock_url(ip, suffix=''):
     # Lock state is shared box-wide; both the :5000 and :9000 servers expose
     # it via lager.lock_state. The CLI talks to :9000 (the primary HTTP API).
@@ -807,6 +847,9 @@ def release_box_lock(ip, holder, *, quiet=True):
             )
         return False
 
+    # Non-raising gateway check (this function promises never to raise);
+    # a denial falls through to the failure warning below.
+    resp, _gate_verdict = check_gateway_status(resp, ip)
     if resp.status_code == 200:
         return True
     if not quiet:
@@ -848,6 +891,9 @@ def heartbeat_box_lock(ip, holder, *, quiet=True):
                 fg='yellow', err=True,
             )
         return False
+    # Non-raising gateway check; a denial reads as a failed heartbeat, which
+    # callers already treat as "carry on" (server TTL is authoritative).
+    resp, _gate_verdict = check_gateway_status(resp, ip)
     return resp.status_code == 200
 
 

{lager_cli-0.32.3 → lager_cli-0.32.5}/commands/box/boxes.py

@@ -47,6 +47,7 @@ def _list_boxes_live(port=9000, timeout=5):
 
     results = []
     failed_count = 0
+    auth_failed_count = 0
     needs_update_count = 0
     newer_count = 0
 
@@ -67,8 +68,14 @@ def _list_boxes_live(port=9000, timeout=5):
         busy_info = ''
         try:
             from ...gateway_auth import auth_headers_for_box
+            from ...box_storage import check_gateway_status
             lock_resp = requests.get(f'http://{ip}:{port}/lock', timeout=3,
                                      headers={'Cache-Control': 'no-cache', **auth_headers_for_box(ip)})
+            # Non-raising gateway check: one gated box must not abort the
+            # whole table. On first contact this records the box→auth-server
+            # mapping and retries with the stored token, so the /status call
+            # below authenticates normally (no second round trip).
+            lock_resp, _ = check_gateway_status(lock_resp, ip)
             if lock_resp.status_code == 200:
                 lock_data = lock_resp.json()
                 if lock_data.get('locked'):
@@ -81,12 +88,18 @@ def _list_boxes_live(port=9000, timeout=5):
             # It predates the newer capability fields, so even older box images
             # answer it — unlike a brand-new endpoint would.
             from ...gateway_auth import auth_headers_for_box
+            from ...box_storage import check_gateway_status
             url = f'http://{ip}:{port}/status'
             headers = {'Cache-Control': 'no-cache', 'Pragma': 'no-cache',
                        **auth_headers_for_box(ip)}
             response = requests.get(url, timeout=timeout, headers=headers)
+            response, gate_verdict = check_gateway_status(response, ip)
 
-            if response.status_code == 200:
+            if gate_verdict:
+                results.append((name, ip, user, '-', gate_verdict, locked_by, busy_info))
+                auth_failed_count += 1
+
+            elif response.status_code == 200:
                 try:
                     data = response.json()
                     box_version = data.get('version') or data.get('box_version')
@@ -205,6 +218,18 @@ def _list_boxes_live(port=9000, timeout=5):
     if failed_count > 0:
         box_word = 'box' if failed_count == 1 else 'boxes'
         click.secho(f'{failed_count} {box_word} could not be reached', fg='red')
+    if auth_failed_count > 0:
+        from ...gateway_auth import auth_server_for_box
+        box_word = 'box needs' if auth_failed_count == 1 else 'boxes need'
+        click.secho(f'{auth_failed_count} {box_word} sign-in or an access grant', fg='red')
+        # The denial recorded each box's auth server, so we can say exactly
+        # where to sign in. Usually one server covers the whole fleet.
+        signin_urls = sorted({
+            url for r in results if r[4] in ('sign-in required', 'session rejected')
+            for url in [auth_server_for_box(r[1])] if url
+        })
+        for url in signin_urls:
+            click.secho(f'  Sign in with: lager login {url}', fg='red')
 
     root_locked = [r[0] for r in results if r[5] == 'root']
     if root_locked:

{lager_cli-0.32.3 → lager_cli-0.32.5}/commands/box/config.py

@@ -1627,8 +1627,15 @@ def _box_api_responding(box_ip: str, *, timeout: float = 2.0) -> bool:
     poll cheaply."""
     try:
         from ...gateway_auth import auth_headers_for_box
+        from ...box_storage import check_gateway_status
         r = requests.get(f"http://{box_ip}:{_BOX_API_PORT}/hello", timeout=timeout,
                          headers=auth_headers_for_box(box_ip))
+        # Non-raising gateway check: first contact with a gated box records
+        # the mapping and retries with the stored token so the probe sees the
+        # real /hello. A genuine denial reads as not-responding (False) —
+        # this probe sits inside the apply/restart poll loop, which must not
+        # abort mid-restart; the flow's own requests surface auth errors.
+        r, _gate_verdict = check_gateway_status(r, box_ip)
         return r.status_code == 200
     except Exception:
         return False

{lager_cli-0.32.3 → lager_cli-0.32.5}/commands/box/diagnose.py

@@ -30,6 +30,7 @@ import click
 import requests
 
 from ...box_storage import resolve_and_validate_box_with_name
+from ...errors import LagerError
 
 
 # Net-role choices for --type. Mirrors the role strings produced by
@@ -51,8 +52,10 @@ def _fetch_net_info(
     that — otherwise the returned role wins."""
     try:
         from ...gateway_auth import auth_headers_for_box
+        from ...box_storage import _check_gateway
         r = requests.get(f'http://{box_ip}:9000/nets/list', timeout=5,
                          headers=auth_headers_for_box(box_ip))
+        r = _check_gateway(r, box_ip)
         r.raise_for_status()
         nets = r.json()
         # Older box images wrap the list: {"nets": [...]}. Unwrap so the
@@ -72,6 +75,10 @@ def _fetch_net_info(
             f'Check network/Tailscale connectivity, then `lager hello --box {display_name}`.',
             fg='red'), err=True)
         return None, None
+    except LagerError:
+        # A gateway denial from _check_gateway is already actionable — let it
+        # render as-is rather than collapsing into the generic message below.
+        raise
     except Exception as e:
         click.echo(click.style(f'Could not fetch net list from box: {e}', fg='red'), err=True)
         return None, None

{lager_cli-0.32.3 → lager_cli-0.32.5}/commands/box/lock.py

@@ -35,6 +35,7 @@ def lock(ctx, box, lock_user):
         # lock immune to the new heartbeat-driven auto-reap that ephemeral
         # `lager python` locks participate in.
         from ...gateway_auth import auth_headers_for_box
+        from ...box_storage import _check_gateway
         resp = requests.post(
             f'http://{ip}:9000/lock',
             headers=auth_headers_for_box(ip),
@@ -45,6 +46,7 @@ def lock(ctx, box, lock_user):
             },
             timeout=5,
         )
+        resp = _check_gateway(resp, ip)
     except requests.exceptions.RequestException as e:
         click.secho(f"Error: Could not reach box '{display_name}': {e}", fg='red', err=True)
         ctx.exit(1)
@@ -80,12 +82,17 @@ def unlock(ctx, box, force):
 
     try:
         from ...gateway_auth import auth_headers_for_box
+        from ...box_storage import _check_gateway
         resp = requests.post(
             f'http://{ip}:9000/unlock',
             headers=auth_headers_for_box(ip),
             json={'user': user, 'force': force},
             timeout=5,
         )
+        # Gateway denials raise here with the actionable sign-in error; the
+        # 403 branch below keeps meaning "locked by another user" only (a
+        # plain box's application 403 has no discovery header).
+        resp = _check_gateway(resp, ip)
     except requests.exceptions.RequestException as e:
         click.secho(f"Error: Could not reach box '{display_name}': {e}", fg='red', err=True)
         ctx.exit(1)

{lager_cli-0.32.3 → lager_cli-0.32.5}/commands/communication/uart.py

@@ -100,8 +100,12 @@ def _run_query_instruments(ctx: click.Context, box_ip: str) -> list[dict]:
     """
     try:
         from ...gateway_auth import auth_headers_for_box
+        from ...box_storage import _check_gateway
         resp = requests.get(f'http://{box_ip}:9000/instruments/list', timeout=15,
                             headers=auth_headers_for_box(box_ip))
+        # A gateway denial raises the actionable LagerError (not caught
+        # below): an auth problem must not be reported as "no instruments".
+        resp = _check_gateway(resp, box_ip)
         if resp.status_code == 200:
             data = resp.json()
             if isinstance(data, list):

{lager_cli-0.32.3 → lager_cli-0.32.5}/commands/communication/websocket_client.py

@@ -260,23 +260,37 @@ class UARTWebSocketClient:
             self._setup_terminal()
 
             # Connect to WebSocket
-            try:
-                from ...gateway_auth import auth_headers_for_url
-                self.sio.connect(
-                    self.box_url,
-                    namespaces=['/uart'],
-                    wait_timeout=10,
-                    headers=auth_headers_for_url(self.box_url)
-                )
-            except Exception as e:
-                # Preserve the return-code contract (don't sys.exit / .die here):
-                # the caller relies on the return value and the finally-block
-                # terminal restore below.
-                from ...errors import connection_error
-                from urllib.parse import urlparse
-                host = urlparse(self.box_url).hostname or self.box_url
-                connection_error(e, host=host).show()
-                return 1
+            from ...gateway_auth import auth_headers_for_url, ws_handshake_recovery
+            headers = auth_headers_for_url(self.box_url)
+            for attempt in (0, 1):
+                try:
+                    self.sio.connect(
+                        self.box_url,
+                        namespaces=['/uart'],
+                        wait_timeout=10,
+                        headers=headers
+                    )
+                    break
+                except Exception as e:
+                    # The handshake exception hides the HTTP response, so
+                    # probe the box over HTTP: a gated box's first contact
+                    # records the mapping and hands back the token for one
+                    # retry; a genuine denial shows the actionable error.
+                    # Preserve the return-code contract (don't sys.exit /
+                    # .die here): the caller relies on the return value and
+                    # the finally-block terminal restore below.
+                    retry_headers, denial = ws_handshake_recovery(self.box_url, headers)
+                    if denial is not None:
+                        denial.show()
+                        return 1
+                    if attempt == 0 and retry_headers:
+                        headers = retry_headers
+                        continue
+                    from ...errors import connection_error
+                    from urllib.parse import urlparse
+                    host = urlparse(self.box_url).hostname or self.box_url
+                    connection_error(e, host=host).show()
+                    return 1
 
             # Start UART session
             self.sio.emit('start_uart', {

{lager_cli-0.32.3 → lager_cli-0.32.5}/commands/development/debug/service_client.py

@@ -44,6 +44,17 @@ class DebugServiceClient:
             'User-Agent': 'lager-cli/1.0',
         })
 
+        if not ssh_tunnel:
+            # Direct connection may cross an authenticating gateway: attach
+            # the bearer token when this box is known to be gated, and turn
+            # gateway denials into actionable errors instead of raw 401s.
+            # No-op for plain boxes (the hook only fires on the discovery
+            # header, and no token is sent to an unknown box). Tunneled
+            # connections terminate at 127.0.0.1 and never see the gateway.
+            from ....gateway_auth import auth_headers_for_box, gateway_response_hook
+            self.session.headers.update(auth_headers_for_box(box_host))
+            self.session.hooks['response'] = [gateway_response_hook(box_host)]
+
     def health_check(self) -> Dict[str, Any]:
         """Check if service is healthy."""
         response = self.session.get(f'{self.base_url}/health', timeout=5)

{lager_cli-0.32.3 → lager_cli-0.32.5}/commands/utility/uninstall.py

@@ -603,7 +603,7 @@ def uninstall(ctx, box, ip, user, keep_config, keep_docker_images, remove_all, y
     click.echo("  - Docker containers (lager, pigpio)")
     click.echo("  - Docker network (lagernet)")
     if not keep_docker_images:
-        click.echo("  - Docker images (ALL unused images on the box, not only lager's)")
+        click.echo("  - Docker images (the lager image and dangling layers only)")
     click.echo("  - ~/box directory")
     if not keep_config:
         click.echo("  - /etc/lager directory (saved nets)")
@@ -707,10 +707,15 @@ def uninstall(ctx, box, ip, user, keep_config, keep_docker_images, remove_all, y
         run_ssh("docker network rm lagernet 2>/dev/null", "Removing lagernet network", allow_fail=True)
         click.echo()
 
-        # Remove Docker images (unless --keep-docker-images)
+        # Remove Docker images (unless --keep-docker-images). Scoped to the
+        # lager image plus dangling layers: 'prune -af' would also delete
+        # images belonging to any OTHER stopped container on the box (a
+        # management agent, a user's own services) — infrastructure this
+        # command cannot restore.
         click.secho("[Step 2/5] Cleaning Docker...", fg='cyan')
         if not keep_docker_images:
-            run_ssh("docker image prune -af 2>/dev/null", "Removing Docker images", allow_fail=True)
+            run_ssh("docker rmi -f lager 2>/dev/null", "Removing lager image", allow_fail=True)
+            run_ssh("docker image prune -f 2>/dev/null", "Removing dangling images", allow_fail=True)
             run_ssh("docker builder prune -af 2>/dev/null", "Clearing Docker build cache", allow_fail=True)
         else:
             click.echo("  Skipping Docker image removal (--keep-docker-images)")

{lager_cli-0.32.3 → lager_cli-0.32.5}/commands/utility/update.py

@@ -74,8 +74,15 @@ def wait_for_box_ready(box_ip, *, timeout_s=60, initial_delay_s=2):
         for port in sorted(pending):
             try:
                 from ...gateway_auth import auth_headers_for_box
+                from ...box_storage import check_gateway_status
                 r = requests.get(f'http://{box_ip}:{port}/health', timeout=3,
                                  headers=auth_headers_for_box(box_ip))
+                # Non-raising gateway check: first contact with a gated box
+                # records the mapping and retries with the stored token so a
+                # healthy gated box reads as ready. A denial reads as
+                # not-ready and falls to the timeout path rather than
+                # aborting the update's readiness poll.
+                r, _gate_verdict = check_gateway_status(r, box_ip)
                 if r.status_code == 200:
                     pending.discard(port)
             except requests.exceptions.RequestException:

{lager_cli-0.32.3 → lager_cli-0.32.5}/context/session.py

@@ -358,8 +358,10 @@ class DirectIPSession:
 
         try:
             from ..gateway_auth import auth_headers_for_box
+            from ..box_storage import _check_gateway
             response = requests.post(url, json=payload, timeout=5,
                                      headers=auth_headers_for_box(self.ip_address))
+            response = _check_gateway(response, self.ip_address)
             return response
         except requests.exceptions.RequestException as e:
             # Return a mock response with error
@@ -479,12 +481,19 @@ class DirectIPSession:
         url = f'http://{self.ip_address}:5001/run/pip'
 
         try:
+            from ..gateway_auth import auth_headers_for_box
+            from ..box_storage import _check_gateway
             response = requests.post(
                 url,
                 json={'args': args},
                 stream=True,
-                timeout=600  # 10 minute timeout for pip operations
+                timeout=600,  # 10 minute timeout for pip operations
+                headers=auth_headers_for_box(self.ip_address),
             )
+            # Gateway discovery/denial handling; on a gated box's first
+            # contact the request is retried with the stored token so the
+            # caller streams the real pip output.
+            response = _check_gateway(response, self.ip_address)
 
             # Check for HTTP errors
             if response.status_code != 200:

{lager_cli-0.32.3 → lager_cli-0.32.5}/core/version_skew.py

@@ -61,8 +61,17 @@ def check_and_warn(box_ip: str, box_name: str | None = None) -> None:
         # it's the same endpoint `lager box hello` uses. 1.5s timeout
         # keeps the latency penalty bounded if the box is briefly slow.
         from ..gateway_auth import auth_headers_for_box
+        from ..box_storage import check_gateway_status
         r = requests.get(f'http://{box_ip}:9000/status', timeout=1.5,
                          headers=auth_headers_for_box(box_ip))
+        # Non-raising gateway check: on first contact with a gated box this
+        # records the mapping and retries with the stored token; a genuine
+        # denial just skips the warning (this module is fail-open — the
+        # command's own request will surface the actionable auth error).
+        r, gate_verdict = check_gateway_status(r, box_ip)
+        if gate_verdict:
+            logger.debug('version-skew check: gateway denied (%s)', gate_verdict)
+            return
         if r.status_code == 404:
             # The :9000 server answered but has no /status route — the box
             # image predates the :9000 API surface this CLI requires. That is

{lager_cli-0.32.3 → lager_cli-0.32.5}/core/ws_diagnose.py

@@ -37,9 +37,26 @@ def make_ws_failure_message(box_ip: str, original_error: str | Exception = '') -
         # /health is a cheap, always-present endpoint on box_http_server
         # (port 9000). 2s timeout matches the worst case of a healthy box
         # under temporary load.
-        from ..gateway_auth import auth_headers_for_box
+        from ..gateway_auth import auth_headers_for_box, auth_server_for_box
+        from ..box_storage import check_gateway_status
         r = requests.get(f'http://{box_ip}:9000/health', timeout=2.0,
                          headers=auth_headers_for_box(box_ip))
+        # Non-raising gateway check (this helper promises never to raise):
+        # first contact with a gated box records the mapping and retries with
+        # the stored token; a genuine denial becomes the actionable message.
+        r, gate_verdict = check_gateway_status(r, box_ip)
+        if gate_verdict:
+            url = auth_server_for_box(box_ip) or 'your auth server'
+            if gate_verdict in ('sign-in required', 'session rejected'):
+                action = f'sign in with `lager login {url}` and retry.'
+            elif gate_verdict == 'no access':
+                action = 'ask an org admin to grant you access to this box.'
+            else:  # auth server down
+                action = 'its auth server is unreachable — try again shortly.'
+            return (
+                f'{base}{detail}.\n'
+                f'Action: the box refused the connection ({gate_verdict}) — {action}'
+            )
         if r.status_code == 200:
             return (
                 f'{base}{detail}.\n'

{lager_cli-0.32.3 → lager_cli-0.32.5}/deployment/scripts/setup_and_deploy_box.sh

@@ -1339,33 +1339,37 @@ print_info "Ensuring Docker service is enabled (for auto-start on boot)..."
 ssh $SSH_OPTS "${BOX_USER}@${BOX_IP}" "sudo systemctl enable docker >/dev/null 2>&1 || true"
 print_success "Docker service enabled"
 
-print_info "Stopping and removing all existing containers..."
-# Update restart policy first to prevent auto-restart, then force remove all containers
+print_info "Stopping and removing lager containers..."
+# Scoped to the containers this deployment owns (lager, pigpio, and the
+# legacy controller). A box may run third-party containers alongside lager
+# — a management agent, a user's own services — and removing containers we
+# did not create takes down infrastructure this script cannot restore.
+# Update restart policy first to prevent auto-restart, then force remove.
 ssh $SSH_OPTS "${BOX_USER}@${BOX_IP}" "
-    # Disable auto-restart on all containers first
-    docker update --restart=no \$(docker ps -aq) 2>/dev/null || true
-    # Stop all running containers
-    docker stop \$(docker ps -q) 2>/dev/null || true
-    # Remove all containers (running and stopped)
-    docker rm -f \$(docker ps -aq) 2>/dev/null || true
-    # Prune any leftover containers
-    docker container prune -f 2>/dev/null || true
+    for c in lager pigpio controller; do
+        docker update --restart=no \$c 2>/dev/null || true
+        docker stop \$c 2>/dev/null || true
+        docker rm -f \$c 2>/dev/null || true
+    done
     # Wait a moment for Docker to clean up
     sleep 2
 " 2>/dev/null || true
-print_success "All containers cleaned up"
+print_success "Lager containers cleaned up"
 
-print_info "Cleaning up Docker images and build cache to free disk space..."
+print_info "Cleaning up Docker build cache and dangling images..."
 echo ""
+# Dangling-only (no -a): 'prune -af' would also delete images belonging to
+# third-party containers stopped at this moment, which cannot be re-pulled
+# by this script.
 ssh $SSH_OPTS "${BOX_USER}@${BOX_IP}" "
-    echo 'Removing unused Docker images...'
-    docker image prune -af 2>/dev/null || true
+    echo 'Removing dangling Docker images...'
+    docker image prune -f 2>/dev/null || true
     echo 'Removing Docker build cache...'
     docker builder prune -af 2>/dev/null || true
     echo 'Cleanup complete'
 " 2>/dev/null || true
 echo ""
-print_success "Docker images and build cache cleaned up"
+print_success "Docker build cache and dangling images cleaned up"
 
 print_info "Checking available disk space..."
 ssh $SSH_OPTS "${BOX_USER}@${BOX_IP}" "df -h / | tail -n 1 | awk '{print \"Available: \" \$4 \" (\" \$5 \" used)\"}'" 2>/dev/null || true