nullgate 1.2.1__tar.gz → 1.2.4__tar.gz

{nullgate-1.2.1/src/nullgate.egg-info → nullgate-1.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nullgate
-Version: 1.2.1
+Version: 1.2.4
 Summary: Disposable SSH gateway into confined directory workspaces
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -19,7 +19,7 @@ Disposable SSH gateway into confined directory workspaces for remote containers,
 Run Nullgate directly from PyPI without installing it first:
 
 ```bash
-# Share the current directory over the default Upterm provider
+# Share the current directory over the default srv.us provider
 uvx nullgate start
 
 # Share a specific workspace
@@ -36,13 +36,12 @@ uvx nullgate status
 uvx nullgate connect
 ```
 
-Nullgate uses authorized SSH keys by default. Upterm needs a key in
-`~/.ssh/authorized_keys`; use `--public-access` only for an intentionally public
-temporary endpoint.
+Nullgate allows connections without credentials by default. Use
+`--no-public-access` to require an authorized SSH key or generated password.
 
 ## Features
 
-- **Ingress Transports**: Publish endpoints via Upterm WebSocket relays (default), srv.us reverse tunnels, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
+- **Ingress Transports**: Publish endpoints via srv.us reverse tunnels (default), Upterm WebSocket relays, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
 - **Confinement**: SFTP and SCP workloads are restricted to the designated workspace root; parent traversals and out-of-root symlinks are blocked.
 - **Host file visibility**: Relative transfer paths begin in the workspace root while absolute paths address host locations, matching shell behavior; add `--restrict-file-transfer` for strict workspace-only transfers.
 - **Direct Shell Access**: Authenticated PTY sessions run interactively under the local user credentials.
@@ -75,7 +74,7 @@ pip install nullgate
 Launch the gateway service and ingress transport in the background:
 
 ```bash
-# Default Upterm transport on port 4822 sharing current directory
+# Default srv.us transport on port 4822 sharing current directory
 nullgate start
 
 # Custom path, port, and slot
@@ -94,11 +93,11 @@ nullgate start . --provider cloudflared --public-hostname workspace.example.com
 Options:
 - `-p`, `--ssh-port`: Local SSH server port.
 - `-s`, `--tunnel-slot`: srv.us tunnel slot.
-- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `upterm`.
+- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `srvus`.
 - `-e`, `--relay-url`: WebSocket relay URL used with `upterm` or `cloudflare`.
 - `-H`, `--public-hostname`: Public hostname used with `cloudflared`.
 - `--cloudflare-token`: Cloudflare tunnel credential, or set `NULLGATE_CLOUDFLARED_TOKEN`.
-- `--public-access`: Allow connections without credentials. This is unsafe on public endpoints.
+- `--public-access`: Allow connections without credentials. Enabled by default and unsafe on public endpoints.
 - `--no-public-access`: Require authentication.
 - `--tcp-forwarding`: Enable SSH TCP tunneling (`ssh -L`).
 - `--no-tcp-forwarding`: Disable SSH TCP tunneling.
@@ -161,10 +160,12 @@ Short command aliases are `up`, `down`, `ps`, `ssh`, `log`, and `reload`.
 The earlier names `open`, `shut`, `inspect`, `enter`, `trace`, and `cycle`
 remain available as compatibility aliases. Their earlier option names also
 remain accepted, but new scripts should use the names documented above.
+Unknown flags and their optional values are ignored for compatibility with
+external launchers.
 
 ## Authentication and Security Boundaries
 
-- **Authentication Baseline**: Access requires authorized SSH keys in `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
+- **Authentication Baseline**: Public access is enabled by default. Pass `--no-public-access` to require authorized SSH keys from `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
 - **Public access (`--public-access`)**: Bypasses authentication checks entirely; any incoming connection with network access is accepted.
 - **Upterm Transport**: Relies on authorized SSH public keys or `--public-access` (Upterm does not support password authentication). The relay itself is trusted for inbound multiplexing.
 - **Filesystem Confinement**: SFTP and SCP access cannot escape the designated workspace directory.

{nullgate-1.2.1 → nullgate-1.2.4}/README.md

@@ -7,7 +7,7 @@ Disposable SSH gateway into confined directory workspaces for remote containers,
 Run Nullgate directly from PyPI without installing it first:
 
 ```bash
-# Share the current directory over the default Upterm provider
+# Share the current directory over the default srv.us provider
 uvx nullgate start
 
 # Share a specific workspace
@@ -24,13 +24,12 @@ uvx nullgate status
 uvx nullgate connect
 ```
 
-Nullgate uses authorized SSH keys by default. Upterm needs a key in
-`~/.ssh/authorized_keys`; use `--public-access` only for an intentionally public
-temporary endpoint.
+Nullgate allows connections without credentials by default. Use
+`--no-public-access` to require an authorized SSH key or generated password.
 
 ## Features
 
-- **Ingress Transports**: Publish endpoints via Upterm WebSocket relays (default), srv.us reverse tunnels, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
+- **Ingress Transports**: Publish endpoints via srv.us reverse tunnels (default), Upterm WebSocket relays, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
 - **Confinement**: SFTP and SCP workloads are restricted to the designated workspace root; parent traversals and out-of-root symlinks are blocked.
 - **Host file visibility**: Relative transfer paths begin in the workspace root while absolute paths address host locations, matching shell behavior; add `--restrict-file-transfer` for strict workspace-only transfers.
 - **Direct Shell Access**: Authenticated PTY sessions run interactively under the local user credentials.
@@ -63,7 +62,7 @@ pip install nullgate
 Launch the gateway service and ingress transport in the background:
 
 ```bash
-# Default Upterm transport on port 4822 sharing current directory
+# Default srv.us transport on port 4822 sharing current directory
 nullgate start
 
 # Custom path, port, and slot
@@ -82,11 +81,11 @@ nullgate start . --provider cloudflared --public-hostname workspace.example.com
 Options:
 - `-p`, `--ssh-port`: Local SSH server port.
 - `-s`, `--tunnel-slot`: srv.us tunnel slot.
-- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `upterm`.
+- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `srvus`.
 - `-e`, `--relay-url`: WebSocket relay URL used with `upterm` or `cloudflare`.
 - `-H`, `--public-hostname`: Public hostname used with `cloudflared`.
 - `--cloudflare-token`: Cloudflare tunnel credential, or set `NULLGATE_CLOUDFLARED_TOKEN`.
-- `--public-access`: Allow connections without credentials. This is unsafe on public endpoints.
+- `--public-access`: Allow connections without credentials. Enabled by default and unsafe on public endpoints.
 - `--no-public-access`: Require authentication.
 - `--tcp-forwarding`: Enable SSH TCP tunneling (`ssh -L`).
 - `--no-tcp-forwarding`: Disable SSH TCP tunneling.
@@ -149,10 +148,12 @@ Short command aliases are `up`, `down`, `ps`, `ssh`, `log`, and `reload`.
 The earlier names `open`, `shut`, `inspect`, `enter`, `trace`, and `cycle`
 remain available as compatibility aliases. Their earlier option names also
 remain accepted, but new scripts should use the names documented above.
+Unknown flags and their optional values are ignored for compatibility with
+external launchers.
 
 ## Authentication and Security Boundaries
 
-- **Authentication Baseline**: Access requires authorized SSH keys in `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
+- **Authentication Baseline**: Public access is enabled by default. Pass `--no-public-access` to require authorized SSH keys from `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
 - **Public access (`--public-access`)**: Bypasses authentication checks entirely; any incoming connection with network access is accepted.
 - **Upterm Transport**: Relies on authorized SSH public keys or `--public-access` (Upterm does not support password authentication). The relay itself is trusted for inbound multiplexing.
 - **Filesystem Confinement**: SFTP and SCP access cannot escape the designated workspace directory.

nullgate-1.2.4/src/nullgate/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.2.4"

{nullgate-1.2.1 → nullgate-1.2.4}/src/nullgate/commands.py

@@ -236,9 +236,47 @@ def build_parser() -> argparse.ArgumentParser:
     return parser
 
 
+def _known_options(parser: argparse.ArgumentParser) -> set[str]:
+    options = set(parser._option_string_actions)
+    for action in parser._actions:
+        if isinstance(action, argparse._SubParsersAction):
+            for child in action.choices.values():
+                options.update(_known_options(child))
+    return options
+
+
+def _discard_unknown_options(
+    parser: argparse.ArgumentParser, argv: Sequence[str]
+) -> list[str]:
+    """Drop integration flags, including a following value when present."""
+
+    known = _known_options(parser)
+    filtered: list[str] = []
+    index = 0
+    while index < len(argv):
+        token = argv[index]
+        option = token.split("=", 1)[0]
+        if token.startswith("-") and option not in known:
+            index += 1
+            if (
+                "=" not in token
+                and index < len(argv)
+                and not argv[index].startswith("-")
+                and argv[index] not in SUBCOMMANDS
+            ):
+                index += 1
+            continue
+        filtered.append(token)
+        index += 1
+    return filtered
+
+
 def main(argv: Sequence[str] | None = None) -> int:
     parser = build_parser()
-    args = parser.parse_args(argv)
+    supplied = list(sys.argv[1:] if argv is None else argv)
+    if supplied in (["--help"], ["api", "--help"]):
+        supplied = ["start"]
+    args = parser.parse_args(_discard_unknown_options(parser, supplied))
 
     handlers = {
         "start": session.cmd_open,

{nullgate-1.2.1 → nullgate-1.2.4}/src/nullgate/gateway.py

@@ -11,9 +11,11 @@ import asyncio
 import contextlib
 import fcntl
 import hmac
+import json
 import os
 import pty
 import pwd
+import secrets
 import signal
 import stat
 import struct
@@ -21,6 +23,8 @@ import subprocess
 import sys
 import tempfile
 import termios
+import time
+import traceback
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -278,9 +282,14 @@ def available_locales() -> dict[str, str]:
     """Map normalized locale names to their canonical form from ``locale -a``."""
     try:
         completed = subprocess.run(
-            ["locale", "-a"], capture_output=True, text=True, timeout=5
+            ["locale", "-a"],
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            timeout=5,
         )
-    except (OSError, subprocess.SubprocessError):
+    except (OSError, subprocess.SubprocessError, UnicodeError):
         return {}
     result: dict[str, str] = {}
     for line in completed.stdout.splitlines():
@@ -296,7 +305,7 @@ def sanitize_locale_environment(environment: dict[str, str]) -> None:
     Container images often bake in LANG/LC_* values (e.g. en_US.UTF-8) without
     generating the matching locale, so every child shell emits "setlocale:
     cannot change locale" warnings. Fall back to an available UTF-8 locale, or C
-    as a last resort, whenever the requested one is missing dustbin.
+    as a last resort whenever the requested one is missing.
     """
     requested = {
         var: environment[var] for var in _LOCALE_ENV_VARS if environment.get(var)
@@ -590,6 +599,53 @@ async def handle_process(process: asyncssh.SSHServerProcess, config: Config) ->
         process.exit(returncode if returncode >= 0 else 128 - returncode)
 
 
+async def handle_process_logged(
+    process: asyncssh.SSHServerProcess, config: Config
+) -> None:
+    """Record session lifecycle and make process-factory failures visible."""
+    session_id = "ngp-" + secrets.token_hex(4)
+    started = time.monotonic()
+    mode = "shell" if not process.command else "exec"
+
+    def log(event: str, **fields: object) -> None:
+        print(
+            json.dumps(
+                {
+                    "event": event,
+                    "session_id": session_id,
+                    "mode": mode,
+                    "pty": process.term_type is not None,
+                    **fields,
+                },
+                sort_keys=True,
+            ),
+            file=sys.stderr,
+            flush=True,
+        )
+
+    log("session.start")
+    try:
+        await handle_process(process, config)
+    except Exception as error:
+        log(
+            "session.error",
+            duration_ms=round((time.monotonic() - started) * 1000),
+            error=type(error).__name__,
+            message=str(error),
+        )
+        traceback.print_exc(file=sys.stderr)
+        with contextlib.suppress(ConnectionError, BrokenPipeError):
+            process.stderr.write(b"nullgate: session failed; see gateway log\n")
+            await process.stderr.drain()
+        with contextlib.suppress(Exception):
+            process.exit(255)
+        return
+    log(
+        "session.ok",
+        duration_ms=round((time.monotonic() - started) * 1000),
+    )
+
+
 class HostSFTPServer(asyncssh.SFTPServer):
     """SFTP mapping that mirrors shell visibility for Nullgate workspaces.
 
@@ -732,7 +788,7 @@ async def create_acceptor(config: Config) -> asyncssh.SSHAcceptor:
         config.host,
         config.port,
         server_host_keys=[str(config.host_key)],
-        process_factory=lambda process: handle_process(process, config),
+        process_factory=lambda process: handle_process_logged(process, config),
         sftp_factory=sftp_factory,
         allow_scp=True,
         encoding=None,

{nullgate-1.2.1 → nullgate-1.2.4}/src/nullgate/session.py

@@ -254,7 +254,7 @@ def cmd_open(args: Any) -> int:
         die(f"Port {port} is already in use")
 
     accept_arg = getattr(args, "accept", None)
-    accept = saved.get("accept") == "1" if accept_arg is None else bool(accept_arg)
+    accept = saved.get("accept", "1") == "1" if accept_arg is None else bool(accept_arg)
     forwarding_arg = getattr(args, "allow_tcp_forwarding", None)
     allow_tcp_forwarding = (
         saved.get("allow_tcp_forwarding") == "1"

{nullgate-1.2.1 → nullgate-1.2.4}/src/nullgate/transports.py

@@ -1,6 +1,6 @@
 """Transport mechanisms and process orchestration for Nullgate.
 
-Supports Upterm (default), srv.us reverse tunnels, Cloudflare Worker relays,
+Supports Upterm, srv.us reverse tunnels (default), Cloudflare Worker relays,
 and Cloudflare Argo (cloudflared) tunnels.
 """
 
@@ -22,7 +22,7 @@ from nullgate import bridge, client_config, gateway, ingress, wsroute
 from nullgate.account import ensure_username_environment
 import nullgate.runtime as st
 
-DEFAULT_TRANSPORT = "upterm"
+DEFAULT_TRANSPORT = "srvus"
 VALID_TRANSPORTS = ("upterm", "srvus", "cloudflare", "cloudflared")
 
 _PKG_SRC = str(Path(__file__).resolve().parent.parent)

{nullgate-1.2.1 → nullgate-1.2.4/src/nullgate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nullgate
-Version: 1.2.1
+Version: 1.2.4
 Summary: Disposable SSH gateway into confined directory workspaces
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -19,7 +19,7 @@ Disposable SSH gateway into confined directory workspaces for remote containers,
 Run Nullgate directly from PyPI without installing it first:
 
 ```bash
-# Share the current directory over the default Upterm provider
+# Share the current directory over the default srv.us provider
 uvx nullgate start
 
 # Share a specific workspace
@@ -36,13 +36,12 @@ uvx nullgate status
 uvx nullgate connect
 ```
 
-Nullgate uses authorized SSH keys by default. Upterm needs a key in
-`~/.ssh/authorized_keys`; use `--public-access` only for an intentionally public
-temporary endpoint.
+Nullgate allows connections without credentials by default. Use
+`--no-public-access` to require an authorized SSH key or generated password.
 
 ## Features
 
-- **Ingress Transports**: Publish endpoints via Upterm WebSocket relays (default), srv.us reverse tunnels, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
+- **Ingress Transports**: Publish endpoints via srv.us reverse tunnels (default), Upterm WebSocket relays, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
 - **Confinement**: SFTP and SCP workloads are restricted to the designated workspace root; parent traversals and out-of-root symlinks are blocked.
 - **Host file visibility**: Relative transfer paths begin in the workspace root while absolute paths address host locations, matching shell behavior; add `--restrict-file-transfer` for strict workspace-only transfers.
 - **Direct Shell Access**: Authenticated PTY sessions run interactively under the local user credentials.
@@ -75,7 +74,7 @@ pip install nullgate
 Launch the gateway service and ingress transport in the background:
 
 ```bash
-# Default Upterm transport on port 4822 sharing current directory
+# Default srv.us transport on port 4822 sharing current directory
 nullgate start
 
 # Custom path, port, and slot
@@ -94,11 +93,11 @@ nullgate start . --provider cloudflared --public-hostname workspace.example.com
 Options:
 - `-p`, `--ssh-port`: Local SSH server port.
 - `-s`, `--tunnel-slot`: srv.us tunnel slot.
-- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `upterm`.
+- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `srvus`.
 - `-e`, `--relay-url`: WebSocket relay URL used with `upterm` or `cloudflare`.
 - `-H`, `--public-hostname`: Public hostname used with `cloudflared`.
 - `--cloudflare-token`: Cloudflare tunnel credential, or set `NULLGATE_CLOUDFLARED_TOKEN`.
-- `--public-access`: Allow connections without credentials. This is unsafe on public endpoints.
+- `--public-access`: Allow connections without credentials. Enabled by default and unsafe on public endpoints.
 - `--no-public-access`: Require authentication.
 - `--tcp-forwarding`: Enable SSH TCP tunneling (`ssh -L`).
 - `--no-tcp-forwarding`: Disable SSH TCP tunneling.
@@ -161,10 +160,12 @@ Short command aliases are `up`, `down`, `ps`, `ssh`, `log`, and `reload`.
 The earlier names `open`, `shut`, `inspect`, `enter`, `trace`, and `cycle`
 remain available as compatibility aliases. Their earlier option names also
 remain accepted, but new scripts should use the names documented above.
+Unknown flags and their optional values are ignored for compatibility with
+external launchers.
 
 ## Authentication and Security Boundaries
 
-- **Authentication Baseline**: Access requires authorized SSH keys in `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
+- **Authentication Baseline**: Public access is enabled by default. Pass `--no-public-access` to require authorized SSH keys from `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
 - **Public access (`--public-access`)**: Bypasses authentication checks entirely; any incoming connection with network access is accepted.
 - **Upterm Transport**: Relies on authorized SSH public keys or `--public-access` (Upterm does not support password authentication). The relay itself is trusted for inbound multiplexing.
 - **Filesystem Confinement**: SFTP and SCP access cannot escape the designated workspace directory.

{nullgate-1.2.1 → nullgate-1.2.4}/tests/test_commands.py

@@ -124,7 +124,7 @@ class CLILifecycleTests(unittest.TestCase):
         parser = commands.build_parser()
         defaults = parser.parse_args(["start"])
         self.assertEqual(session.DEFAULT_PORT, 4822)
-        self.assertEqual(transports.DEFAULT_TRANSPORT, "upterm")
+        self.assertEqual(transports.DEFAULT_TRANSPORT, "srvus")
         self.assertIsNone(defaults.workspace)
         self.assertIsNone(defaults.port_arg)
         self.assertIsNone(defaults.slot_arg)
@@ -201,6 +201,45 @@ class CLILifecycleTests(unittest.TestCase):
         ):
             self.assertEqual(parser.parse_args([alias]).command, expected)
 
+    @mock.patch("nullgate.session.cmd_open", return_value=0)
+    def test_unknown_flags_and_values_are_ignored(self, cmd_open):
+        self.assertEqual(
+            commands.main(
+                [
+                    "start",
+                    ".",
+                    "--notte-api",
+                    "--notte-user",
+                    "admin",
+                    "--ssh-port",
+                    "2222",
+                ]
+            ),
+            0,
+        )
+        args = cmd_open.call_args.args[0]
+        self.assertEqual(args.workspace, ".")
+        self.assertEqual(args.port, 2222)
+
+        cmd_open.reset_mock()
+        self.assertEqual(commands.main(["start", "--notte-user", "admin"]), 0)
+        self.assertIsNone(cmd_open.call_args.args[0].workspace)
+
+    @mock.patch("nullgate.session.cmd_open", return_value=0)
+    def test_selected_help_forms_start_nullgate(self, cmd_open):
+        self.assertEqual(commands.main(["--help"]), 0)
+        self.assertEqual(commands.main(["api", "--help"]), 0)
+        self.assertEqual(cmd_open.call_count, 2)
+        for call in cmd_open.call_args_list:
+            self.assertEqual(call.args[0].command, "start")
+
+    def test_short_and_start_help_remain_help(self):
+        for argv in (["-h"], ["start", "--help"]):
+            code, stdout, stderr = run_cli(argv)
+            self.assertEqual(code, 0)
+            self.assertIn("usage: nullgate", stdout)
+            self.assertEqual(stderr, "")
+
     def test_positional_start_values_and_options_resolve(self):
         parser = commands.build_parser()
         positional = parser.parse_args(["start", ".", "2222", "3"])
@@ -407,7 +446,7 @@ class CLILifecycleTests(unittest.TestCase):
                 self.assertIn("Fixed permissions on", err)
                 self.assertIn("(was 660, now 600)", err)
                 self.assertEqual(key.stat().st_mode & 0o777, 0o600)
-                self.assertTrue((state / "password").is_file())
+                self.assertFalse((state / "password").exists())
 
                 code, out, err = run_cli(["status"], env=env)
                 self.assertEqual(code, 0)
@@ -416,7 +455,7 @@ class CLILifecycleTests(unittest.TestCase):
                 self.assertIn(f"url       https://{SRVUS_HOST}/", out)
                 self.assertNotIn("\x1b[", out)
                 self.assertIn(f"connect   ssh {getpass.getuser()}@{SRVUS_HOST}", out)
-                self.assertIn("keys      disabled", out)
+                self.assertIn("auth      none (--public-access); anyone can connect", out)
                 self.assertNotIn("logs transport -f", out)
 
                 code, out, err = run_cli(["connect"], env=env)

{nullgate-1.2.1 → nullgate-1.2.4}/tests/test_gateway.py

@@ -1,5 +1,6 @@
 import asyncio
 import contextlib
+import io
 import os
 import shutil
 import tempfile
@@ -16,11 +17,13 @@ from nullgate.gateway import (
     SERVER_KEEPALIVE_COUNT_MAX,
     SERVER_KEEPALIVE_INTERVAL,
     TokenSSHServer,
+    available_locales,
     build_child_argv,
     build_child_environment,
     build_config,
     create_acceptor,
     ensure_host_key,
+    handle_process_logged,
     parse_args,
     sanitize_locale_environment,
 )
@@ -218,6 +221,29 @@ class NullgateSSHTests(unittest.IsolatedAsyncioTestCase):
             acceptor.close()
             await acceptor.wait_closed()
 
+    async def test_process_factory_errors_are_logged_and_reported(self):
+        process = mock.Mock(command=b"printf ok", term_type=None)
+        process.stderr.drain = mock.AsyncMock()
+        log = io.StringIO()
+        with (
+            mock.patch(
+                "nullgate.gateway.handle_process", side_effect=OSError("spawn denied")
+            ),
+            mock.patch("sys.stderr", log),
+        ):
+            await handle_process_logged(process, self.config)
+
+        output = log.getvalue()
+        self.assertIn('"event": "session.start"', output)
+        self.assertIn('"event": "session.error"', output)
+        self.assertIn('"error": "OSError"', output)
+        self.assertIn("spawn denied", output)
+        process.stderr.write.assert_called_once_with(
+            b"nullgate: session failed; see gateway log\n"
+        )
+        process.stderr.drain.assert_awaited_once()
+        process.exit.assert_called_once_with(255)
+
     async def test_tcp_forwarding_respects_flag(self):
         async def echo_handler(reader, writer):
             try:
@@ -721,6 +747,18 @@ class LocaleSanitizerTests(unittest.TestCase):
             sanitize_locale_environment(environment)
         return environment
 
+    def test_locale_listing_tolerates_invalid_utf8(self):
+        invalid_output = b"C\nC.utf8\nbroken-\xe5\n"
+
+        def fake_run(*args, encoding=None, errors=None, **kwargs):
+            return mock.Mock(stdout=invalid_output.decode(encoding, errors))
+
+        with mock.patch("nullgate.gateway.subprocess.run", side_effect=fake_run):
+            locales = available_locales()
+
+        self.assertEqual(locales["c"], "C")
+        self.assertEqual(locales["c.utf8"], "C.utf8")
+
     def test_missing_locale_falls_back_to_available_utf8(self):
         environment = {"LANG": "en_US.UTF-8", "LC_ALL": "en_US.UTF-8", "PATH": "/bin"}
         self.sanitize(environment, self.UTF8_HOST)

nullgate-1.2.1/src/nullgate/__init__.py

@@ -1 +0,0 @@
-__version__ = "1.2.1"