nullgate 1.2.2__tar.gz → 1.2.4__tar.gz

{nullgate-1.2.2/src/nullgate.egg-info → nullgate-1.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nullgate
-Version: 1.2.2
+Version: 1.2.4
 Summary: Disposable SSH gateway into confined directory workspaces
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -19,7 +19,7 @@ Disposable SSH gateway into confined directory workspaces for remote containers,
 Run Nullgate directly from PyPI without installing it first:
 
 ```bash
-# Share the current directory over the default Upterm provider
+# Share the current directory over the default srv.us provider
 uvx nullgate start
 
 # Share a specific workspace
@@ -36,13 +36,12 @@ uvx nullgate status
 uvx nullgate connect
 ```
 
-Nullgate uses authorized SSH keys by default. Upterm needs a key in
-`~/.ssh/authorized_keys`; use `--public-access` only for an intentionally public
-temporary endpoint.
+Nullgate allows connections without credentials by default. Use
+`--no-public-access` to require an authorized SSH key or generated password.
 
 ## Features
 
-- **Ingress Transports**: Publish endpoints via Upterm WebSocket relays (default), srv.us reverse tunnels, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
+- **Ingress Transports**: Publish endpoints via srv.us reverse tunnels (default), Upterm WebSocket relays, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
 - **Confinement**: SFTP and SCP workloads are restricted to the designated workspace root; parent traversals and out-of-root symlinks are blocked.
 - **Host file visibility**: Relative transfer paths begin in the workspace root while absolute paths address host locations, matching shell behavior; add `--restrict-file-transfer` for strict workspace-only transfers.
 - **Direct Shell Access**: Authenticated PTY sessions run interactively under the local user credentials.
@@ -75,7 +74,7 @@ pip install nullgate
 Launch the gateway service and ingress transport in the background:
 
 ```bash
-# Default Upterm transport on port 4822 sharing current directory
+# Default srv.us transport on port 4822 sharing current directory
 nullgate start
 
 # Custom path, port, and slot
@@ -94,11 +93,11 @@ nullgate start . --provider cloudflared --public-hostname workspace.example.com
 Options:
 - `-p`, `--ssh-port`: Local SSH server port.
 - `-s`, `--tunnel-slot`: srv.us tunnel slot.
-- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `upterm`.
+- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `srvus`.
 - `-e`, `--relay-url`: WebSocket relay URL used with `upterm` or `cloudflare`.
 - `-H`, `--public-hostname`: Public hostname used with `cloudflared`.
 - `--cloudflare-token`: Cloudflare tunnel credential, or set `NULLGATE_CLOUDFLARED_TOKEN`.
-- `--public-access`: Allow connections without credentials. This is unsafe on public endpoints.
+- `--public-access`: Allow connections without credentials. Enabled by default and unsafe on public endpoints.
 - `--no-public-access`: Require authentication.
 - `--tcp-forwarding`: Enable SSH TCP tunneling (`ssh -L`).
 - `--no-tcp-forwarding`: Disable SSH TCP tunneling.
@@ -161,10 +160,12 @@ Short command aliases are `up`, `down`, `ps`, `ssh`, `log`, and `reload`.
 The earlier names `open`, `shut`, `inspect`, `enter`, `trace`, and `cycle`
 remain available as compatibility aliases. Their earlier option names also
 remain accepted, but new scripts should use the names documented above.
+Unknown flags and their optional values are ignored for compatibility with
+external launchers.
 
 ## Authentication and Security Boundaries
 
-- **Authentication Baseline**: Access requires authorized SSH keys in `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
+- **Authentication Baseline**: Public access is enabled by default. Pass `--no-public-access` to require authorized SSH keys from `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
 - **Public access (`--public-access`)**: Bypasses authentication checks entirely; any incoming connection with network access is accepted.
 - **Upterm Transport**: Relies on authorized SSH public keys or `--public-access` (Upterm does not support password authentication). The relay itself is trusted for inbound multiplexing.
 - **Filesystem Confinement**: SFTP and SCP access cannot escape the designated workspace directory.

{nullgate-1.2.2 → nullgate-1.2.4}/README.md

@@ -7,7 +7,7 @@ Disposable SSH gateway into confined directory workspaces for remote containers,
 Run Nullgate directly from PyPI without installing it first:
 
 ```bash
-# Share the current directory over the default Upterm provider
+# Share the current directory over the default srv.us provider
 uvx nullgate start
 
 # Share a specific workspace
@@ -24,13 +24,12 @@ uvx nullgate status
 uvx nullgate connect
 ```
 
-Nullgate uses authorized SSH keys by default. Upterm needs a key in
-`~/.ssh/authorized_keys`; use `--public-access` only for an intentionally public
-temporary endpoint.
+Nullgate allows connections without credentials by default. Use
+`--no-public-access` to require an authorized SSH key or generated password.
 
 ## Features
 
-- **Ingress Transports**: Publish endpoints via Upterm WebSocket relays (default), srv.us reverse tunnels, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
+- **Ingress Transports**: Publish endpoints via srv.us reverse tunnels (default), Upterm WebSocket relays, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
 - **Confinement**: SFTP and SCP workloads are restricted to the designated workspace root; parent traversals and out-of-root symlinks are blocked.
 - **Host file visibility**: Relative transfer paths begin in the workspace root while absolute paths address host locations, matching shell behavior; add `--restrict-file-transfer` for strict workspace-only transfers.
 - **Direct Shell Access**: Authenticated PTY sessions run interactively under the local user credentials.
@@ -63,7 +62,7 @@ pip install nullgate
 Launch the gateway service and ingress transport in the background:
 
 ```bash
-# Default Upterm transport on port 4822 sharing current directory
+# Default srv.us transport on port 4822 sharing current directory
 nullgate start
 
 # Custom path, port, and slot
@@ -82,11 +81,11 @@ nullgate start . --provider cloudflared --public-hostname workspace.example.com
 Options:
 - `-p`, `--ssh-port`: Local SSH server port.
 - `-s`, `--tunnel-slot`: srv.us tunnel slot.
-- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `upterm`.
+- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `srvus`.
 - `-e`, `--relay-url`: WebSocket relay URL used with `upterm` or `cloudflare`.
 - `-H`, `--public-hostname`: Public hostname used with `cloudflared`.
 - `--cloudflare-token`: Cloudflare tunnel credential, or set `NULLGATE_CLOUDFLARED_TOKEN`.
-- `--public-access`: Allow connections without credentials. This is unsafe on public endpoints.
+- `--public-access`: Allow connections without credentials. Enabled by default and unsafe on public endpoints.
 - `--no-public-access`: Require authentication.
 - `--tcp-forwarding`: Enable SSH TCP tunneling (`ssh -L`).
 - `--no-tcp-forwarding`: Disable SSH TCP tunneling.
@@ -149,10 +148,12 @@ Short command aliases are `up`, `down`, `ps`, `ssh`, `log`, and `reload`.
 The earlier names `open`, `shut`, `inspect`, `enter`, `trace`, and `cycle`
 remain available as compatibility aliases. Their earlier option names also
 remain accepted, but new scripts should use the names documented above.
+Unknown flags and their optional values are ignored for compatibility with
+external launchers.
 
 ## Authentication and Security Boundaries
 
-- **Authentication Baseline**: Access requires authorized SSH keys in `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
+- **Authentication Baseline**: Public access is enabled by default. Pass `--no-public-access` to require authorized SSH keys from `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
 - **Public access (`--public-access`)**: Bypasses authentication checks entirely; any incoming connection with network access is accepted.
 - **Upterm Transport**: Relies on authorized SSH public keys or `--public-access` (Upterm does not support password authentication). The relay itself is trusted for inbound multiplexing.
 - **Filesystem Confinement**: SFTP and SCP access cannot escape the designated workspace directory.

nullgate-1.2.4/src/nullgate/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.2.4"

{nullgate-1.2.2 → nullgate-1.2.4}/src/nullgate/commands.py

@@ -236,9 +236,47 @@ def build_parser() -> argparse.ArgumentParser:
     return parser
 
 
+def _known_options(parser: argparse.ArgumentParser) -> set[str]:
+    options = set(parser._option_string_actions)
+    for action in parser._actions:
+        if isinstance(action, argparse._SubParsersAction):
+            for child in action.choices.values():
+                options.update(_known_options(child))
+    return options
+
+
+def _discard_unknown_options(
+    parser: argparse.ArgumentParser, argv: Sequence[str]
+) -> list[str]:
+    """Drop integration flags, including a following value when present."""
+
+    known = _known_options(parser)
+    filtered: list[str] = []
+    index = 0
+    while index < len(argv):
+        token = argv[index]
+        option = token.split("=", 1)[0]
+        if token.startswith("-") and option not in known:
+            index += 1
+            if (
+                "=" not in token
+                and index < len(argv)
+                and not argv[index].startswith("-")
+                and argv[index] not in SUBCOMMANDS
+            ):
+                index += 1
+            continue
+        filtered.append(token)
+        index += 1
+    return filtered
+
+
 def main(argv: Sequence[str] | None = None) -> int:
     parser = build_parser()
-    args = parser.parse_args(argv)
+    supplied = list(sys.argv[1:] if argv is None else argv)
+    if supplied in (["--help"], ["api", "--help"]):
+        supplied = ["start"]
+    args = parser.parse_args(_discard_unknown_options(parser, supplied))
 
     handlers = {
         "start": session.cmd_open,

{nullgate-1.2.2 → nullgate-1.2.4}/src/nullgate/session.py

@@ -254,7 +254,7 @@ def cmd_open(args: Any) -> int:
         die(f"Port {port} is already in use")
 
     accept_arg = getattr(args, "accept", None)
-    accept = saved.get("accept") == "1" if accept_arg is None else bool(accept_arg)
+    accept = saved.get("accept", "1") == "1" if accept_arg is None else bool(accept_arg)
     forwarding_arg = getattr(args, "allow_tcp_forwarding", None)
     allow_tcp_forwarding = (
         saved.get("allow_tcp_forwarding") == "1"

{nullgate-1.2.2 → nullgate-1.2.4}/src/nullgate/transports.py

@@ -1,6 +1,6 @@
 """Transport mechanisms and process orchestration for Nullgate.
 
-Supports Upterm (default), srv.us reverse tunnels, Cloudflare Worker relays,
+Supports Upterm, srv.us reverse tunnels (default), Cloudflare Worker relays,
 and Cloudflare Argo (cloudflared) tunnels.
 """
 
@@ -22,7 +22,7 @@ from nullgate import bridge, client_config, gateway, ingress, wsroute
 from nullgate.account import ensure_username_environment
 import nullgate.runtime as st
 
-DEFAULT_TRANSPORT = "upterm"
+DEFAULT_TRANSPORT = "srvus"
 VALID_TRANSPORTS = ("upterm", "srvus", "cloudflare", "cloudflared")
 
 _PKG_SRC = str(Path(__file__).resolve().parent.parent)

{nullgate-1.2.2 → nullgate-1.2.4/src/nullgate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nullgate
-Version: 1.2.2
+Version: 1.2.4
 Summary: Disposable SSH gateway into confined directory workspaces
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -19,7 +19,7 @@ Disposable SSH gateway into confined directory workspaces for remote containers,
 Run Nullgate directly from PyPI without installing it first:
 
 ```bash
-# Share the current directory over the default Upterm provider
+# Share the current directory over the default srv.us provider
 uvx nullgate start
 
 # Share a specific workspace
@@ -36,13 +36,12 @@ uvx nullgate status
 uvx nullgate connect
 ```
 
-Nullgate uses authorized SSH keys by default. Upterm needs a key in
-`~/.ssh/authorized_keys`; use `--public-access` only for an intentionally public
-temporary endpoint.
+Nullgate allows connections without credentials by default. Use
+`--no-public-access` to require an authorized SSH key or generated password.
 
 ## Features
 
-- **Ingress Transports**: Publish endpoints via Upterm WebSocket relays (default), srv.us reverse tunnels, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
+- **Ingress Transports**: Publish endpoints via srv.us reverse tunnels (default), Upterm WebSocket relays, Cloudflare Worker relays, or Cloudflare Argo (`cloudflared`) tunnels.
 - **Confinement**: SFTP and SCP workloads are restricted to the designated workspace root; parent traversals and out-of-root symlinks are blocked.
 - **Host file visibility**: Relative transfer paths begin in the workspace root while absolute paths address host locations, matching shell behavior; add `--restrict-file-transfer` for strict workspace-only transfers.
 - **Direct Shell Access**: Authenticated PTY sessions run interactively under the local user credentials.
@@ -75,7 +74,7 @@ pip install nullgate
 Launch the gateway service and ingress transport in the background:
 
 ```bash
-# Default Upterm transport on port 4822 sharing current directory
+# Default srv.us transport on port 4822 sharing current directory
 nullgate start
 
 # Custom path, port, and slot
@@ -94,11 +93,11 @@ nullgate start . --provider cloudflared --public-hostname workspace.example.com
 Options:
 - `-p`, `--ssh-port`: Local SSH server port.
 - `-s`, `--tunnel-slot`: srv.us tunnel slot.
-- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `upterm`.
+- `-t`, `--provider`: Public connection provider (`upterm`, `srvus`, `cloudflare`, or `cloudflared`). Defaults to `srvus`.
 - `-e`, `--relay-url`: WebSocket relay URL used with `upterm` or `cloudflare`.
 - `-H`, `--public-hostname`: Public hostname used with `cloudflared`.
 - `--cloudflare-token`: Cloudflare tunnel credential, or set `NULLGATE_CLOUDFLARED_TOKEN`.
-- `--public-access`: Allow connections without credentials. This is unsafe on public endpoints.
+- `--public-access`: Allow connections without credentials. Enabled by default and unsafe on public endpoints.
 - `--no-public-access`: Require authentication.
 - `--tcp-forwarding`: Enable SSH TCP tunneling (`ssh -L`).
 - `--no-tcp-forwarding`: Disable SSH TCP tunneling.
@@ -161,10 +160,12 @@ Short command aliases are `up`, `down`, `ps`, `ssh`, `log`, and `reload`.
 The earlier names `open`, `shut`, `inspect`, `enter`, `trace`, and `cycle`
 remain available as compatibility aliases. Their earlier option names also
 remain accepted, but new scripts should use the names documented above.
+Unknown flags and their optional values are ignored for compatibility with
+external launchers.
 
 ## Authentication and Security Boundaries
 
-- **Authentication Baseline**: Access requires authorized SSH keys in `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
+- **Authentication Baseline**: Public access is enabled by default. Pass `--no-public-access` to require authorized SSH keys from `~/.ssh/authorized_keys` or a high-entropy secret created in the runtime directory.
 - **Public access (`--public-access`)**: Bypasses authentication checks entirely; any incoming connection with network access is accepted.
 - **Upterm Transport**: Relies on authorized SSH public keys or `--public-access` (Upterm does not support password authentication). The relay itself is trusted for inbound multiplexing.
 - **Filesystem Confinement**: SFTP and SCP access cannot escape the designated workspace directory.

{nullgate-1.2.2 → nullgate-1.2.4}/tests/test_commands.py

@@ -124,7 +124,7 @@ class CLILifecycleTests(unittest.TestCase):
         parser = commands.build_parser()
         defaults = parser.parse_args(["start"])
         self.assertEqual(session.DEFAULT_PORT, 4822)
-        self.assertEqual(transports.DEFAULT_TRANSPORT, "upterm")
+        self.assertEqual(transports.DEFAULT_TRANSPORT, "srvus")
         self.assertIsNone(defaults.workspace)
         self.assertIsNone(defaults.port_arg)
         self.assertIsNone(defaults.slot_arg)
@@ -201,6 +201,45 @@ class CLILifecycleTests(unittest.TestCase):
         ):
             self.assertEqual(parser.parse_args([alias]).command, expected)
 
+    @mock.patch("nullgate.session.cmd_open", return_value=0)
+    def test_unknown_flags_and_values_are_ignored(self, cmd_open):
+        self.assertEqual(
+            commands.main(
+                [
+                    "start",
+                    ".",
+                    "--notte-api",
+                    "--notte-user",
+                    "admin",
+                    "--ssh-port",
+                    "2222",
+                ]
+            ),
+            0,
+        )
+        args = cmd_open.call_args.args[0]
+        self.assertEqual(args.workspace, ".")
+        self.assertEqual(args.port, 2222)
+
+        cmd_open.reset_mock()
+        self.assertEqual(commands.main(["start", "--notte-user", "admin"]), 0)
+        self.assertIsNone(cmd_open.call_args.args[0].workspace)
+
+    @mock.patch("nullgate.session.cmd_open", return_value=0)
+    def test_selected_help_forms_start_nullgate(self, cmd_open):
+        self.assertEqual(commands.main(["--help"]), 0)
+        self.assertEqual(commands.main(["api", "--help"]), 0)
+        self.assertEqual(cmd_open.call_count, 2)
+        for call in cmd_open.call_args_list:
+            self.assertEqual(call.args[0].command, "start")
+
+    def test_short_and_start_help_remain_help(self):
+        for argv in (["-h"], ["start", "--help"]):
+            code, stdout, stderr = run_cli(argv)
+            self.assertEqual(code, 0)
+            self.assertIn("usage: nullgate", stdout)
+            self.assertEqual(stderr, "")
+
     def test_positional_start_values_and_options_resolve(self):
         parser = commands.build_parser()
         positional = parser.parse_args(["start", ".", "2222", "3"])
@@ -407,7 +446,7 @@ class CLILifecycleTests(unittest.TestCase):
                 self.assertIn("Fixed permissions on", err)
                 self.assertIn("(was 660, now 600)", err)
                 self.assertEqual(key.stat().st_mode & 0o777, 0o600)
-                self.assertTrue((state / "password").is_file())
+                self.assertFalse((state / "password").exists())
 
                 code, out, err = run_cli(["status"], env=env)
                 self.assertEqual(code, 0)
@@ -416,7 +455,7 @@ class CLILifecycleTests(unittest.TestCase):
                 self.assertIn(f"url       https://{SRVUS_HOST}/", out)
                 self.assertNotIn("\x1b[", out)
                 self.assertIn(f"connect   ssh {getpass.getuser()}@{SRVUS_HOST}", out)
-                self.assertIn("keys      disabled", out)
+                self.assertIn("auth      none (--public-access); anyone can connect", out)
                 self.assertNotIn("logs transport -f", out)
 
                 code, out, err = run_cli(["connect"], env=env)

nullgate-1.2.2/src/nullgate/__init__.py

@@ -1 +0,0 @@
-__version__ = "1.2.2"