nullgate 1.1.1__tar.gz → 1.2.1__tar.gz

{nullgate-1.1.1/src/nullgate.egg-info → nullgate-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nullgate
-Version: 1.1.1
+Version: 1.2.1
 Summary: Disposable SSH gateway into confined directory workspaces
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -14,11 +14,37 @@ Dynamic: license-file
 
 Disposable SSH gateway into confined directory workspaces for remote containers, ephemeral developer boxes, CI nodes, and cloud instances.
 
+## Quick start
+
+Run Nullgate directly from PyPI without installing it first:
+
+```bash
+# Share the current directory over the default Upterm provider
+uvx nullgate start
+
+# Share a specific workspace
+uvx nullgate start /workspace
+
+# Compact form: workspace, SSH port, srv.us slot, provider
+uvx nullgate start /workspace 8022 1 -t srvus
+```
+
+Then check the endpoint and print the SSH connection setup:
+
+```bash
+uvx nullgate status
+uvx nullgate connect
+```
+
+Nullgate uses authorized SSH keys by default. Upterm needs a key in
+`~/.ssh/authorized_keys`; use `--public-access` only for an intentionally public
+temporary endpoint.
+
 ## Features
 
 - **Ingress Transports**: Publish endpoints via Upterm WebSocket relays (default), srv.us reverse tunnels, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
 - **Confinement**: SFTP and SCP workloads are restricted to the designated workspace root; parent traversals and out-of-root symlinks are blocked.
-- **Host file visibility**: Relative transfer paths begin in the workspace root while absolute paths address host locations, matching shell behavior; add `--confine-sftp` for strict workspace-only transfers.
+- **Host file visibility**: Relative transfer paths begin in the workspace root while absolute paths address host locations, matching shell behavior; add `--restrict-file-transfer` for strict workspace-only transfers.
 - **Direct Shell Access**: Authenticated PTY sessions run interactively under the local user credentials.
 - **Synthetic UID Resilience**: Runs seamlessly in container environments missing user records in `/etc/passwd`.
 - **Persistent Key Identities**: Host keys and identity seeds persist across restarts rather than being silently regenerated.
@@ -44,77 +70,82 @@ pip install nullgate
 
 ## Usage
 
-### Open
+### Start
 
 Launch the gateway service and ingress transport in the background:
 
 ```bash
 # Default Upterm transport on port 4822 sharing current directory
-nullgate open
+nullgate start
 
 # Custom path, port, and slot
-nullgate open /workspace --port 4822 --slot 1
+nullgate start /workspace --ssh-port 4822 --tunnel-slot 1
+
+# The same values in compact positional form
+nullgate start /workspace 4822 1
 
 # Select specific transport provider
-nullgate open . --transport upterm
-nullgate open . --transport srvus
-nullgate open . --transport cloudflare --endpoint https://relay.example.com
-nullgate open . --transport cloudflared --hostname workspace.example.com --token "$TUNNEL_TOKEN"
+nullgate start . --provider upterm
+nullgate start . --provider srvus
+nullgate start . --provider cloudflare --relay-url https://relay.example.com
+nullgate start . --provider cloudflared --public-hostname workspace.example.com --cloudflare-token "$TUNNEL_TOKEN"
 ```
 
 Options:
-- `--transport`: Ingress provider (`upterm`, `srvus`, `cloudflare`, `cloudflared`). Defaults to `upterm`.
-- `--endpoint`: WebSocket or relay endpoint URL (used with `upterm` or `cloudflare`).
-- `--hostname`: Public ingress hostname for `cloudflared`.
-- `--token`: Argo tunnel authentication credential (or set via `NULLGATE_CLOUDFLARED_TOKEN`).
-- `--accept`: Skip credential checks and admit any client connection.
-- `--no-accept`: Restore authentication when saved settings previously enabled unrestricted access.
-- `--allow-tcp-forwarding`: Enable SSH TCP tunneling (`ssh -L`).
-- `--no-allow-tcp-forwarding`: Disable forwarding when it was enabled in saved settings.
-- `--confine-sftp`: Confine SFTP and SCP transfers to the workspace root.
-- `--no-confine-sftp`: Restore host-visible transfers when confinement was saved.
-
-### Inspect
+- `-p`, `--ssh-port`: Local SSH server port.
+- `-s`, `--tunnel-slot`: srv.us tunnel slot.
+- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `upterm`.
+- `-e`, `--relay-url`: WebSocket relay URL used with `upterm` or `cloudflare`.
+- `-H`, `--public-hostname`: Public hostname used with `cloudflared`.
+- `--cloudflare-token`: Cloudflare tunnel credential, or set `NULLGATE_CLOUDFLARED_TOKEN`.
+- `--public-access`: Allow connections without credentials. This is unsafe on public endpoints.
+- `--no-public-access`: Require authentication.
+- `--tcp-forwarding`: Enable SSH TCP tunneling (`ssh -L`).
+- `--no-tcp-forwarding`: Disable SSH TCP tunneling.
+- `--restrict-file-transfer`: Keep SFTP and SCP inside the workspace.
+- `--no-restrict-file-transfer`: Allow host-visible file transfers.
+
+### Status
 
 Display operational status, running PIDs, connection URLs, and security settings:
 
 ```bash
-nullgate inspect
+nullgate status
 ```
 
-### Enter
+### Connect
 
 Print client connection strings and OpenSSH client configuration directives:
 
 ```bash
-nullgate enter
+nullgate connect
 ```
 
-### Trace
+### Logs
 
 Stream or print daemon logs:
 
 ```bash
-nullgate trace
-nullgate trace -f
-nullgate trace gateway
-nullgate trace transport
+nullgate logs
+nullgate logs -f
+nullgate logs gateway
+nullgate logs transport
 ```
 
-### Shut
+### Stop
 
 Terminate running gateway and transport background processes:
 
 ```bash
-nullgate shut
+nullgate stop
 ```
 
-### Cycle
+### Restart
 
 Restart daemon instances reusing active or saved workspace settings:
 
 ```bash
-nullgate cycle
+nullgate restart
 ```
 
 ### Upgrade
@@ -126,13 +157,18 @@ nullgate upgrade
 nullgate upgrade --version 1.0.1
 ```
 
+Short command aliases are `up`, `down`, `ps`, `ssh`, `log`, and `reload`.
+The earlier names `open`, `shut`, `inspect`, `enter`, `trace`, and `cycle`
+remain available as compatibility aliases. Their earlier option names also
+remain accepted, but new scripts should use the names documented above.
+
 ## Authentication and Security Boundaries
 
 - **Authentication Baseline**: Access requires authorized SSH keys in `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
-- **Unrestricted Mode (`--accept`)**: Bypasses authentication checks entirely; any incoming connection with network access is accepted.
-- **Upterm Transport**: Relies on authorized SSH public keys or `--accept` (Upterm does not support password authentication). The relay itself is trusted for inbound multiplexing.
+- **Public access (`--public-access`)**: Bypasses authentication checks entirely; any incoming connection with network access is accepted.
+- **Upterm Transport**: Relies on authorized SSH public keys or `--public-access` (Upterm does not support password authentication). The relay itself is trusted for inbound multiplexing.
 - **Filesystem Confinement**: SFTP and SCP access cannot escape the designated workspace directory.
-- **Host Transfer Mode (default)**: Relative SFTP and SCP paths begin in the workspace directory, while absolute paths refer to host filesystem locations subject to OS user permissions. Pass `--confine-sftp` to limit transfers to the workspace namespace and reject symlink escapes.
+- **Host Transfer Mode (default)**: Relative SFTP and SCP paths begin in the workspace directory, while absolute paths refer to host filesystem locations subject to OS user permissions. Pass `--restrict-file-transfer` to limit transfers to the workspace namespace and reject symlink escapes.
 - **Interactive Shell Privileges**: Command and terminal sessions execute with the permissions of the host account rather than inside an OS chroot.
 - **State Storage**: Daemon PIDs and logs are maintained in `gateway.pid`, `transport.pid`, `gateway.log`, and `transport.log`, with session records kept in `manifest.json` and `settings.json`.
 
@@ -140,7 +176,7 @@ nullgate upgrade --version 1.0.1
 
 | Variable | Description |
 |---|---|
-| `NULLGATE_PASSWORD` | Gateway-process credential; normally managed internally by `nullgate open` |
+| `NULLGATE_PASSWORD` | Gateway-process credential; normally managed internally by `nullgate start` |
 | `NULLGATE_STATE_DIR` | Directory holding runtime state and logs (defaults to `~/.local/state/nullgate`) |
 | `NULLGATE_IDENTITY_SEED` | Seed value used for deterministic Ed25519 key derivation |
 | `NULLGATE_TUNNEL_HOST` | Host address for srv.us ingress (default: `srv.us`) |

{nullgate-1.1.1 → nullgate-1.2.1}/README.md

@@ -2,11 +2,37 @@
 
 Disposable SSH gateway into confined directory workspaces for remote containers, ephemeral developer boxes, CI nodes, and cloud instances.
 
+## Quick start
+
+Run Nullgate directly from PyPI without installing it first:
+
+```bash
+# Share the current directory over the default Upterm provider
+uvx nullgate start
+
+# Share a specific workspace
+uvx nullgate start /workspace
+
+# Compact form: workspace, SSH port, srv.us slot, provider
+uvx nullgate start /workspace 8022 1 -t srvus
+```
+
+Then check the endpoint and print the SSH connection setup:
+
+```bash
+uvx nullgate status
+uvx nullgate connect
+```
+
+Nullgate uses authorized SSH keys by default. Upterm needs a key in
+`~/.ssh/authorized_keys`; use `--public-access` only for an intentionally public
+temporary endpoint.
+
 ## Features
 
 - **Ingress Transports**: Publish endpoints via Upterm WebSocket relays (default), srv.us reverse tunnels, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
 - **Confinement**: SFTP and SCP workloads are restricted to the designated workspace root; parent traversals and out-of-root symlinks are blocked.
-- **Host file visibility**: Relative transfer paths begin in the workspace root while absolute paths address host locations, matching shell behavior; add `--confine-sftp` for strict workspace-only transfers.
+- **Host file visibility**: Relative transfer paths begin in the workspace root while absolute paths address host locations, matching shell behavior; add `--restrict-file-transfer` for strict workspace-only transfers.
 - **Direct Shell Access**: Authenticated PTY sessions run interactively under the local user credentials.
 - **Synthetic UID Resilience**: Runs seamlessly in container environments missing user records in `/etc/passwd`.
 - **Persistent Key Identities**: Host keys and identity seeds persist across restarts rather than being silently regenerated.
@@ -32,77 +58,82 @@ pip install nullgate
 
 ## Usage
 
-### Open
+### Start
 
 Launch the gateway service and ingress transport in the background:
 
 ```bash
 # Default Upterm transport on port 4822 sharing current directory
-nullgate open
+nullgate start
 
 # Custom path, port, and slot
-nullgate open /workspace --port 4822 --slot 1
+nullgate start /workspace --ssh-port 4822 --tunnel-slot 1
+
+# The same values in compact positional form
+nullgate start /workspace 4822 1
 
 # Select specific transport provider
-nullgate open . --transport upterm
-nullgate open . --transport srvus
-nullgate open . --transport cloudflare --endpoint https://relay.example.com
-nullgate open . --transport cloudflared --hostname workspace.example.com --token "$TUNNEL_TOKEN"
+nullgate start . --provider upterm
+nullgate start . --provider srvus
+nullgate start . --provider cloudflare --relay-url https://relay.example.com
+nullgate start . --provider cloudflared --public-hostname workspace.example.com --cloudflare-token "$TUNNEL_TOKEN"
 ```
 
 Options:
-- `--transport`: Ingress provider (`upterm`, `srvus`, `cloudflare`, `cloudflared`). Defaults to `upterm`.
-- `--endpoint`: WebSocket or relay endpoint URL (used with `upterm` or `cloudflare`).
-- `--hostname`: Public ingress hostname for `cloudflared`.
-- `--token`: Argo tunnel authentication credential (or set via `NULLGATE_CLOUDFLARED_TOKEN`).
-- `--accept`: Skip credential checks and admit any client connection.
-- `--no-accept`: Restore authentication when saved settings previously enabled unrestricted access.
-- `--allow-tcp-forwarding`: Enable SSH TCP tunneling (`ssh -L`).
-- `--no-allow-tcp-forwarding`: Disable forwarding when it was enabled in saved settings.
-- `--confine-sftp`: Confine SFTP and SCP transfers to the workspace root.
-- `--no-confine-sftp`: Restore host-visible transfers when confinement was saved.
-
-### Inspect
+- `-p`, `--ssh-port`: Local SSH server port.
+- `-s`, `--tunnel-slot`: srv.us tunnel slot.
+- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `upterm`.
+- `-e`, `--relay-url`: WebSocket relay URL used with `upterm` or `cloudflare`.
+- `-H`, `--public-hostname`: Public hostname used with `cloudflared`.
+- `--cloudflare-token`: Cloudflare tunnel credential, or set `NULLGATE_CLOUDFLARED_TOKEN`.
+- `--public-access`: Allow connections without credentials. This is unsafe on public endpoints.
+- `--no-public-access`: Require authentication.
+- `--tcp-forwarding`: Enable SSH TCP tunneling (`ssh -L`).
+- `--no-tcp-forwarding`: Disable SSH TCP tunneling.
+- `--restrict-file-transfer`: Keep SFTP and SCP inside the workspace.
+- `--no-restrict-file-transfer`: Allow host-visible file transfers.
+
+### Status
 
 Display operational status, running PIDs, connection URLs, and security settings:
 
 ```bash
-nullgate inspect
+nullgate status
 ```
 
-### Enter
+### Connect
 
 Print client connection strings and OpenSSH client configuration directives:
 
 ```bash
-nullgate enter
+nullgate connect
 ```
 
-### Trace
+### Logs
 
 Stream or print daemon logs:
 
 ```bash
-nullgate trace
-nullgate trace -f
-nullgate trace gateway
-nullgate trace transport
+nullgate logs
+nullgate logs -f
+nullgate logs gateway
+nullgate logs transport
 ```
 
-### Shut
+### Stop
 
 Terminate running gateway and transport background processes:
 
 ```bash
-nullgate shut
+nullgate stop
 ```
 
-### Cycle
+### Restart
 
 Restart daemon instances reusing active or saved workspace settings:
 
 ```bash
-nullgate cycle
+nullgate restart
 ```
 
 ### Upgrade
@@ -114,13 +145,18 @@ nullgate upgrade
 nullgate upgrade --version 1.0.1
 ```
 
+Short command aliases are `up`, `down`, `ps`, `ssh`, `log`, and `reload`.
+The earlier names `open`, `shut`, `inspect`, `enter`, `trace`, and `cycle`
+remain available as compatibility aliases. Their earlier option names also
+remain accepted, but new scripts should use the names documented above.
+
 ## Authentication and Security Boundaries
 
 - **Authentication Baseline**: Access requires authorized SSH keys in `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
-- **Unrestricted Mode (`--accept`)**: Bypasses authentication checks entirely; any incoming connection with network access is accepted.
-- **Upterm Transport**: Relies on authorized SSH public keys or `--accept` (Upterm does not support password authentication). The relay itself is trusted for inbound multiplexing.
+- **Public access (`--public-access`)**: Bypasses authentication checks entirely; any incoming connection with network access is accepted.
+- **Upterm Transport**: Relies on authorized SSH public keys or `--public-access` (Upterm does not support password authentication). The relay itself is trusted for inbound multiplexing.
 - **Filesystem Confinement**: SFTP and SCP access cannot escape the designated workspace directory.
-- **Host Transfer Mode (default)**: Relative SFTP and SCP paths begin in the workspace directory, while absolute paths refer to host filesystem locations subject to OS user permissions. Pass `--confine-sftp` to limit transfers to the workspace namespace and reject symlink escapes.
+- **Host Transfer Mode (default)**: Relative SFTP and SCP paths begin in the workspace directory, while absolute paths refer to host filesystem locations subject to OS user permissions. Pass `--restrict-file-transfer` to limit transfers to the workspace namespace and reject symlink escapes.
 - **Interactive Shell Privileges**: Command and terminal sessions execute with the permissions of the host account rather than inside an OS chroot.
 - **State Storage**: Daemon PIDs and logs are maintained in `gateway.pid`, `transport.pid`, `gateway.log`, and `transport.log`, with session records kept in `manifest.json` and `settings.json`.
 
@@ -128,7 +164,7 @@ nullgate upgrade --version 1.0.1
 
 | Variable | Description |
 |---|---|
-| `NULLGATE_PASSWORD` | Gateway-process credential; normally managed internally by `nullgate open` |
+| `NULLGATE_PASSWORD` | Gateway-process credential; normally managed internally by `nullgate start` |
 | `NULLGATE_STATE_DIR` | Directory holding runtime state and logs (defaults to `~/.local/state/nullgate`) |
 | `NULLGATE_IDENTITY_SEED` | Seed value used for deterministic Ed25519 key derivation |
 | `NULLGATE_TUNNEL_HOST` | Host address for srv.us ingress (default: `srv.us`) |

nullgate-1.2.1/src/nullgate/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.2.1"

nullgate-1.2.1/src/nullgate/commands.py

@@ -0,0 +1,275 @@
+"""Command-line parser and entry point dispatch for Nullgate."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from typing import Sequence
+
+from nullgate import session, transports
+
+SUBCOMMANDS = (
+    "start",
+    "up",
+    "stop",
+    "down",
+    "status",
+    "ps",
+    "connect",
+    "ssh",
+    "logs",
+    "log",
+    "restart",
+    "reload",
+    "upgrade",
+    "open",
+    "shut",
+    "inspect",
+    "enter",
+    "trace",
+    "cycle",
+)
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="nullgate",
+        description="Disposable SSH gateway into confined directory workspaces.",
+    )
+    parser.add_argument(
+        "-V",
+        "--version",
+        action="version",
+        version=f"nullgate {session._version()}",
+    )
+    sub = parser.add_subparsers(dest="command", required=True, metavar="command")
+
+    start_parser = sub.add_parser(
+        "start",
+        aliases=["up", "open"],
+        description="Start SSH access to a workspace.",
+        help="Start SSH access to a workspace (aliases: up, open).",
+    )
+    start_parser.add_argument(
+        "workspace",
+        nargs="?",
+        help="Directory to make available (default: current directory).",
+    )
+    start_parser.add_argument(
+        "port_arg",
+        nargs="?",
+        type=int,
+        help="Local SSH server port (shorthand positional).",
+    )
+    start_parser.add_argument(
+        "slot_arg",
+        nargs="?",
+        type=int,
+        help="srv.us tunnel slot (shorthand positional).",
+    )
+    start_parser.add_argument(
+        "-p",
+        "--ssh-port",
+        dest="port",
+        type=int,
+        default=None,
+        help=f"Local SSH server port (default: {session.DEFAULT_PORT}).",
+    )
+    start_parser.add_argument("--port", dest="port", type=int, help=argparse.SUPPRESS)
+    start_parser.add_argument(
+        "-s",
+        "--tunnel-slot",
+        dest="slot",
+        type=int,
+        default=None,
+        help=f"srv.us tunnel slot (default: {session.DEFAULT_SLOT}).",
+    )
+    start_parser.add_argument("--slot", dest="slot", type=int, help=argparse.SUPPRESS)
+    start_parser.add_argument(
+        "-t",
+        "--provider",
+        dest="transport",
+        choices=transports.VALID_TRANSPORTS,
+        default=None,
+        help=f"Public connection provider (default: {transports.DEFAULT_TRANSPORT}).",
+    )
+    start_parser.add_argument(
+        "--transport",
+        dest="transport",
+        choices=transports.VALID_TRANSPORTS,
+        help=argparse.SUPPRESS,
+    )
+    start_parser.add_argument(
+        "--public-access",
+        dest="accept",
+        action=argparse.BooleanOptionalAction,
+        default=None,
+        help="Allow connections without SSH credentials (unsafe on public endpoints).",
+    )
+    start_parser.add_argument(
+        "--accept",
+        dest="accept",
+        action=argparse.BooleanOptionalAction,
+        default=None,
+        help=argparse.SUPPRESS,
+    )
+    start_parser.add_argument(
+        "--tcp-forwarding",
+        dest="allow_tcp_forwarding",
+        action=argparse.BooleanOptionalAction,
+        default=None,
+        help="Allow SSH port forwarding.",
+    )
+    start_parser.add_argument(
+        "--allow-tcp-forwarding",
+        dest="allow_tcp_forwarding",
+        action=argparse.BooleanOptionalAction,
+        default=None,
+        help=argparse.SUPPRESS,
+    )
+    start_parser.add_argument(
+        "--restrict-file-transfer",
+        dest="confine_sftp",
+        action=argparse.BooleanOptionalAction,
+        default=None,
+        help="Keep SFTP and SCP transfers inside the workspace.",
+    )
+    start_parser.add_argument(
+        "--confine-sftp",
+        dest="confine_sftp",
+        action=argparse.BooleanOptionalAction,
+        default=None,
+        help=argparse.SUPPRESS,
+    )
+    start_parser.add_argument(
+        "-e",
+        "--relay-url",
+        dest="endpoint",
+        help="WebSocket relay URL (for upterm or cloudflare providers).",
+    )
+    start_parser.add_argument("--endpoint", dest="endpoint", help=argparse.SUPPRESS)
+    start_parser.add_argument(
+        "-H",
+        "--public-hostname",
+        dest="hostname",
+        help="Public hostname (for the cloudflared provider).",
+    )
+    start_parser.add_argument("--hostname", dest="hostname", help=argparse.SUPPRESS)
+    start_parser.add_argument(
+        "--cloudflare-token",
+        dest="token",
+        help="Cloudflare tunnel token (for the cloudflared provider).",
+    )
+    start_parser.add_argument("--token", dest="token", help=argparse.SUPPRESS)
+
+    sub.add_parser(
+        "stop",
+        aliases=["down", "shut"],
+        description="Stop SSH access and its connection provider.",
+        help="Stop SSH access (aliases: down, shut).",
+    )
+
+    sub.add_parser(
+        "status",
+        aliases=["ps", "inspect"],
+        description="Show service health, connection details, and security settings.",
+        help="Show current status (aliases: ps, inspect).",
+    )
+
+    sub.add_parser(
+        "connect",
+        aliases=["ssh", "enter"],
+        description="Show how to connect with SSH.",
+        help="Show SSH connection instructions (aliases: ssh, enter).",
+    )
+
+    logs_parser = sub.add_parser(
+        "logs",
+        aliases=["log", "trace"],
+        description="View or follow service logs.",
+        help="View or follow service logs (aliases: log, trace).",
+    )
+    logs_parser.add_argument(
+        "target",
+        nargs="?",
+        default="all",
+        choices=["all", "gateway", "transport"],
+        help="Target log stream to inspect (default all).",
+    )
+    logs_parser.add_argument(
+        "-f",
+        "--follow",
+        dest="f",
+        action="store_true",
+        help="Follow log stream output continuously.",
+    )
+
+    sub.add_parser(
+        "restart",
+        aliases=["reload", "cycle"],
+        description="Restart SSH access using the saved settings.",
+        help="Restart using saved settings (aliases: reload, cycle).",
+    )
+
+    upgrade_parser = sub.add_parser(
+        "upgrade",
+        description="Fetch and install latest Nullgate release.",
+        help="Fetch and install latest Nullgate release.",
+    )
+    upgrade_parser.add_argument(
+        "--version",
+        help="Install a specific published version instead of the latest stable release.",
+    )
+
+    proxy_parser = sub.add_parser(
+        "proxy",
+        description=argparse.SUPPRESS,
+    )
+    proxy_parser.add_argument("url")
+
+    upterm_proxy = sub.add_parser(
+        "upterm-proxy",
+        description=argparse.SUPPRESS,
+    )
+    upterm_proxy.add_argument("url")
+
+    return parser
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+
+    handlers = {
+        "start": session.cmd_open,
+        "up": session.cmd_open,
+        "open": session.cmd_open,
+        "stop": session.cmd_shut,
+        "down": session.cmd_shut,
+        "shut": session.cmd_shut,
+        "status": session.cmd_inspect,
+        "ps": session.cmd_inspect,
+        "inspect": session.cmd_inspect,
+        "connect": session.cmd_enter,
+        "ssh": session.cmd_enter,
+        "enter": session.cmd_enter,
+        "logs": session.cmd_trace,
+        "log": session.cmd_trace,
+        "trace": session.cmd_trace,
+        "restart": session.cmd_cycle,
+        "reload": session.cmd_cycle,
+        "cycle": session.cmd_cycle,
+        "upgrade": session.cmd_upgrade,
+        "proxy": transports.cmd_proxy,
+        "upterm-proxy": transports.cmd_upterm_proxy,
+    }
+
+    handler = handlers.get(args.command)
+    if handler is None:
+        parser.print_help(sys.stderr)
+        return 2
+    return handler(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())