nullgate 1.2.5__tar.gz → 1.2.6__tar.gz

{nullgate-1.2.5/src/nullgate.egg-info → nullgate-1.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nullgate
-Version: 1.2.5
+Version: 1.2.6
 Summary: Disposable SSH gateway into confined directory workspaces
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -110,6 +110,8 @@ Options:
 - `--no-restrict-file-transfer`: Allow host-visible file transfers.
 - `--foreground`: Stay in the foreground and supervise gateway and transport instead of exiting after readiness. The parent handles SIGINT and SIGTERM and stops both children, exiting nonzero with recent log tails if either child dies.
 - `--json`: Emit machine-readable JSON on stdout (the only stdout in JSON mode). `start --foreground --json` prints one readiness object, flushes it, then supervises.
+- `--replace-stale`: Replace tracked gateway and transport processes when they are not healthy. Healthy srv.us sessions are reused.
+- `--rendezvous-url URL`: After srv.us passes its public SSH-over-TLS check, POST a minimal readiness document. Defaults to `NULLGATE_RENDEZVOUS_URL` and is saved for `restart`; the URL is never printed.
 
 A fresh `start` uses documented defaults and the current directory when no
 workspace is given; only `restart` reuses saved workspace, provider, port,
@@ -210,6 +212,7 @@ Unknown flags fail normally; only the hidden external-launcher flags
 | `NULLGATE_TUNNEL_PORT` | Port for srv.us ingress (default: `22`) |
 | `NULLGATE_CLOUDFLARED_TOKEN` | Credential token for `cloudflared` tunnels |
 | `NULLGATE_CONFINE_SFTP` | Set to `1` to confine SFTP and SCP transfers to the workspace root |
+| `NULLGATE_RENDEZVOUS_URL` | HTTP endpoint for publishing successful srv.us readiness; may contain a secret token and is never printed |
 | `NULLGATE_VERSION` | Install a specific published version instead of the stable release; accepts `1.0.1` or `v1.0.1` |
 | `NULLGATE_DIST_URL` | Override the public release channel used by `install.sh` |
 | `NULLGATE_INSTALL_URL` | Override the installer URL used by `nullgate upgrade` |
@@ -222,7 +225,7 @@ Unknown flags fail normally; only the hidden external-launcher flags
   secure mode without authorized keys fails immediately instead of hanging.
 - Readiness is decisive: `start` returns success only after the gateway
   listens, the transport stays alive, and (for srv.us) a hostname is
-  announced. On timeout or failure both processes are stopped, recent
+  announced and serves an SSH banner over certificate-validated TLS. On timeout or failure both processes are stopped, recent
   transport logs go to stderr, and the exit code is nonzero.
 - `start --foreground` keeps the parent alive supervising both children,
   handles SIGINT/SIGTERM by stopping them, and exits nonzero with recent log tails if
@@ -230,7 +233,7 @@ Unknown flags fail normally; only the hidden external-launcher flags
 - `start`, `status`, and `connect` accept `--json` for machine-readable
   output. JSON is the only stdout in JSON mode and carries the operational
   fields agents need: version, provider, running state and PIDs, port,
-  workspace, URL, host, user, proxy command, auth mode, TCP forwarding, and
+  workspace, URL, host, user, proxy command, public health, auth mode, TCP forwarding, and
   file-transfer mode. `--json` is the stable agent contract; human output may
   change. `start --foreground --json` prints one readiness object,
   flushes it, then supervises.

{nullgate-1.2.5 → nullgate-1.2.6}/README.md

@@ -98,6 +98,8 @@ Options:
 - `--no-restrict-file-transfer`: Allow host-visible file transfers.
 - `--foreground`: Stay in the foreground and supervise gateway and transport instead of exiting after readiness. The parent handles SIGINT and SIGTERM and stops both children, exiting nonzero with recent log tails if either child dies.
 - `--json`: Emit machine-readable JSON on stdout (the only stdout in JSON mode). `start --foreground --json` prints one readiness object, flushes it, then supervises.
+- `--replace-stale`: Replace tracked gateway and transport processes when they are not healthy. Healthy srv.us sessions are reused.
+- `--rendezvous-url URL`: After srv.us passes its public SSH-over-TLS check, POST a minimal readiness document. Defaults to `NULLGATE_RENDEZVOUS_URL` and is saved for `restart`; the URL is never printed.
 
 A fresh `start` uses documented defaults and the current directory when no
 workspace is given; only `restart` reuses saved workspace, provider, port,
@@ -198,6 +200,7 @@ Unknown flags fail normally; only the hidden external-launcher flags
 | `NULLGATE_TUNNEL_PORT` | Port for srv.us ingress (default: `22`) |
 | `NULLGATE_CLOUDFLARED_TOKEN` | Credential token for `cloudflared` tunnels |
 | `NULLGATE_CONFINE_SFTP` | Set to `1` to confine SFTP and SCP transfers to the workspace root |
+| `NULLGATE_RENDEZVOUS_URL` | HTTP endpoint for publishing successful srv.us readiness; may contain a secret token and is never printed |
 | `NULLGATE_VERSION` | Install a specific published version instead of the stable release; accepts `1.0.1` or `v1.0.1` |
 | `NULLGATE_DIST_URL` | Override the public release channel used by `install.sh` |
 | `NULLGATE_INSTALL_URL` | Override the installer URL used by `nullgate upgrade` |
@@ -210,7 +213,7 @@ Unknown flags fail normally; only the hidden external-launcher flags
   secure mode without authorized keys fails immediately instead of hanging.
 - Readiness is decisive: `start` returns success only after the gateway
   listens, the transport stays alive, and (for srv.us) a hostname is
-  announced. On timeout or failure both processes are stopped, recent
+  announced and serves an SSH banner over certificate-validated TLS. On timeout or failure both processes are stopped, recent
   transport logs go to stderr, and the exit code is nonzero.
 - `start --foreground` keeps the parent alive supervising both children,
   handles SIGINT/SIGTERM by stopping them, and exits nonzero with recent log tails if
@@ -218,7 +221,7 @@ Unknown flags fail normally; only the hidden external-launcher flags
 - `start`, `status`, and `connect` accept `--json` for machine-readable
   output. JSON is the only stdout in JSON mode and carries the operational
   fields agents need: version, provider, running state and PIDs, port,
-  workspace, URL, host, user, proxy command, auth mode, TCP forwarding, and
+  workspace, URL, host, user, proxy command, public health, auth mode, TCP forwarding, and
   file-transfer mode. `--json` is the stable agent contract; human output may
   change. `start --foreground --json` prints one readiness object,
   flushes it, then supervises.

nullgate-1.2.6/src/nullgate/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.2.6"

{nullgate-1.2.5 → nullgate-1.2.6}/src/nullgate/commands.py

@@ -188,6 +188,17 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Emit machine-readable JSON on stdout.",
     )
+    start_parser.add_argument(
+        "--replace-stale",
+        action="store_true",
+        help="Replace tracked processes when they are not publicly healthy.",
+    )
+    start_parser.add_argument(
+        "--rendezvous-url",
+        metavar="URL",
+        default=None,
+        help="Publish srv.us readiness to an HTTP endpoint.",
+    )
     start_parser.add_argument(
         "--notte-api", dest="notte_api", action="store_true", help=argparse.SUPPRESS
     )

{nullgate-1.2.5 → nullgate-1.2.6}/src/nullgate/session.py

@@ -14,6 +14,8 @@ import signal
 import subprocess
 import sys
 import time
+import urllib.request
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
@@ -265,6 +267,9 @@ def _status_payload() -> dict[str, Any]:
     transport_running = st.is_running(transport_pid_file)
     provider = st.manifest_get("transport") or transports.DEFAULT_TRANSPORT
     target = transports.resolve_target(provider, state)
+    public_healthy = None
+    if provider == "srvus" and target is not None:
+        public_healthy = transports.probe_ssh_tls(target.host)
     port_text = st.manifest_get("port")
     try:
         port = int(port_text) if port_text else None
@@ -276,6 +281,7 @@ def _status_payload() -> dict[str, Any]:
         "version": _version(),
         "provider": provider,
         "running": bool(gateway_running and transport_running),
+        "public_healthy": public_healthy,
         "gateway": {"running": gateway_running, "pid": st.read_pid(gateway_pid_file)},
         "transport": {
             "running": transport_running,
@@ -297,7 +303,7 @@ def _show_status(args: Any = None) -> int:
     if getattr(args, "json", False):
         payload = _status_payload()
         print(json.dumps(payload, indent=2))
-        return 0 if payload["running"] else 1
+        return 0 if payload["running"] and payload["public_healthy"] is not False else 1
     state = st.state_dir()
     gateway_pid_file = state / "gateway.pid"
     transport_pid_file = state / "transport.pid"
@@ -306,14 +312,18 @@ def _show_status(args: Any = None) -> int:
     transport = st.manifest_get("transport") or transports.DEFAULT_TRANSPORT
     target = transports.resolve_target(transport, state)
     live = bool(gateway_running and transport_running)
+    public_healthy = None
+    if transport == "srvus" and target is not None:
+        public_healthy = transports.probe_ssh_tls(target.host)
+    usable = live and public_healthy is not False
     if not sys.stdout.isatty():
-        if target is not None and live:
+        if target is not None and usable:
             _print_compact_connection(state, target)
-        elif live:
+        elif live and public_healthy is not False:
             print("pending")
         else:
             print("stopped")
-        return 0 if live else 1
+        return 0 if usable else 1
     color = _colorizer()
 
     print(f"nullgate {_version()} \u00b7 {transport}")
@@ -321,11 +331,31 @@ def _show_status(args: Any = None) -> int:
     print(f"  gateway   {_proc_row(color, gateway_running, st.read_pid(gateway_pid_file))}")
     print(f"  transport {_proc_row(color, transport_running, st.read_pid(transport_pid_file))}")
     _print_auth_rows(color, state)
-    if target is not None:
+    if target is not None and public_healthy is not False:
         print()
         print("  connect   " + color.bold(f"ssh {target.user or current_username()}@{target.host}"))
         print("            " + color.dim("first time here: nullgate connect"))
-    return 0 if live else 1
+    return 0 if usable else 1
+
+
+def _publish_rendezvous(rendezvous_url: str, target: Any) -> None:
+    payload = {
+        "provider": "srvus",
+        "host": target.host,
+        "url": target.url,
+        "ssh_command": _fallback_ssh_command(target),
+        "healthy": True,
+        "updated_at": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
+    }
+    request = urllib.request.Request(
+        rendezvous_url,
+        data=json.dumps(payload, separators=(",", ":")).encode("utf-8"),
+        headers={"Content-Type": "application/json"},
+        method="POST",
+    )
+    with urllib.request.urlopen(request, timeout=3.0) as response:
+        if not 200 <= response.status < 300:
+            raise OSError(f"HTTP {response.status}")
 
 
 def _supervise_foreground(
@@ -394,6 +424,12 @@ def _launch(args: Any, saved: dict[str, Any]) -> int:
         or saved.get("token")
         or ""
     )
+    rendezvous_url = (
+        getattr(args, "rendezvous_url", None)
+        or os.environ.get("NULLGATE_RENDEZVOUS_URL")
+        or saved.get("rendezvous_url")
+        or ""
+    )
 
     root, port, slot = _resolve_launch_settings(args, saved)
     seed_file, identity_seed = _resolve_identity_seed(args, saved, transport)
@@ -403,10 +439,29 @@ def _launch(args: Any, saved: dict[str, Any]) -> int:
     gateway_log = state / "gateway.log"
     transport_log = state / "transport.log"
 
-    if st.is_running(gateway_pid_file):
-        die("Gateway service is already running")
-    if st.is_running(transport_pid_file):
-        die("Transport service is already running")
+    gateway_running = st.is_running(gateway_pid_file)
+    transport_running = st.is_running(transport_pid_file)
+    if gateway_running or transport_running:
+        current_provider = st.manifest_get("transport") or transports.DEFAULT_TRANSPORT
+        current_target = transports.resolve_target(current_provider, state)
+        publicly_healthy = True
+        if current_provider == "srvus":
+            publicly_healthy = bool(
+                current_target and transports.probe_ssh_tls(current_target.host)
+            )
+        if gateway_running and transport_running and publicly_healthy:
+            if getattr(args, "json", False):
+                print(json.dumps(_status_payload(), indent=2))
+            else:
+                _show_status()
+            return 0
+        if getattr(args, "replace_stale", False):
+            st.stop_one(transport_pid_file)
+            st.stop_one(gateway_pid_file)
+        elif gateway_running:
+            die("Gateway service is already running")
+        else:
+            die("Transport service is already running")
     for pid_file in (gateway_pid_file, transport_pid_file):
         if not pid_file.is_dir():
             pid_file.unlink(missing_ok=True)
@@ -523,6 +578,11 @@ def _launch(args: Any, saved: dict[str, Any]) -> int:
                 )
                 _tail_stderr(transport_log, 100)
                 return 1
+            if not transports.probe_ssh_tls(host):
+                st.stop_one(transport_pid_file)
+                st.stop_one(gateway_pid_file)
+                print("srv.us public endpoint failed its SSH-over-TLS probe.", file=sys.stderr)
+                return 1
         elif transport == "upterm":
             if not transports.wait_for_upterm_session(transport_pid_file, state / "upterm.json"):
                 st.stop_one(transport_pid_file)
@@ -544,6 +604,18 @@ def _launch(args: Any, saved: dict[str, Any]) -> int:
             _tail_stderr(gateway_log, 100)
             return 1
 
+        if transport == "srvus" and rendezvous_url:
+            target = transports.resolve_target(transport, state)
+            try:
+                if target is None:
+                    raise OSError("missing srv.us target")
+                _publish_rendezvous(rendezvous_url, target)
+            except Exception:
+                st.stop_one(transport_pid_file)
+                st.stop_one(gateway_pid_file)
+                print("Rendezvous readiness publication failed.", file=sys.stderr)
+                return 1
+
         manifest: dict[str, Any] = {
             "transport": transport,
             "port": str(port),
@@ -572,6 +644,7 @@ def _launch(args: Any, saved: dict[str, Any]) -> int:
                 "endpoint": endpoint,
                 "token": token,
                 "identity_seed_file": seed_file,
+                "rendezvous_url": rendezvous_url,
                 "accept": "1" if accept else "0",
                 "allow_tcp_forwarding": "1" if allow_tcp_forwarding else "0",
                 "confine_sftp": "1" if confine_sftp else "0",
@@ -723,6 +796,8 @@ def cmd_cycle(args: Any = None) -> int:
             token=None,
             identity_seed=None,
             identity_seed_file=None,
+            rendezvous_url=None,
+            replace_stale=False,
             accept=None,
             allow_tcp_forwarding=None,
             confine_sftp=None,

{nullgate-1.2.5 → nullgate-1.2.6}/src/nullgate/transports.py

@@ -9,6 +9,8 @@ from __future__ import annotations
 import base64
 import os
 import shutil
+import socket
+import ssl
 import struct
 import subprocess
 import sys
@@ -30,6 +32,31 @@ _PKG_SRC = str(Path(__file__).resolve().parent.parent)
 _SEED_ENV = ingress.IDENTITY_SEED_ENV
 
 
+def probe_ssh_tls(
+    host: str,
+    port: int = 443,
+    timeout: float = 3.0,
+    *,
+    create_connection: Any = socket.create_connection,
+    ssl_context: ssl.SSLContext | None = None,
+) -> bool:
+    """Verify a certificate-valid TLS endpoint which serves an SSH banner."""
+    context = ssl_context or ssl.create_default_context()
+    try:
+        with create_connection((host, port), timeout=timeout) as raw:
+            raw.settimeout(timeout)
+            with context.wrap_socket(raw, server_hostname=host) as secured:
+                banner = b""
+                while len(banner) < 255 and b"\n" not in banner:
+                    chunk = secured.recv(255 - len(banner))
+                    if not chunk:
+                        break
+                    banner += chunk
+        return banner.startswith(b"SSH-")
+    except (OSError, ssl.SSLError, TimeoutError):
+        return False
+
+
 def _scrubbed_env() -> dict[str, str]:
     """Copy the parent environment without the identity seed.
 

{nullgate-1.2.5 → nullgate-1.2.6/src/nullgate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nullgate
-Version: 1.2.5
+Version: 1.2.6
 Summary: Disposable SSH gateway into confined directory workspaces
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -110,6 +110,8 @@ Options:
 - `--no-restrict-file-transfer`: Allow host-visible file transfers.
 - `--foreground`: Stay in the foreground and supervise gateway and transport instead of exiting after readiness. The parent handles SIGINT and SIGTERM and stops both children, exiting nonzero with recent log tails if either child dies.
 - `--json`: Emit machine-readable JSON on stdout (the only stdout in JSON mode). `start --foreground --json` prints one readiness object, flushes it, then supervises.
+- `--replace-stale`: Replace tracked gateway and transport processes when they are not healthy. Healthy srv.us sessions are reused.
+- `--rendezvous-url URL`: After srv.us passes its public SSH-over-TLS check, POST a minimal readiness document. Defaults to `NULLGATE_RENDEZVOUS_URL` and is saved for `restart`; the URL is never printed.
 
 A fresh `start` uses documented defaults and the current directory when no
 workspace is given; only `restart` reuses saved workspace, provider, port,
@@ -210,6 +212,7 @@ Unknown flags fail normally; only the hidden external-launcher flags
 | `NULLGATE_TUNNEL_PORT` | Port for srv.us ingress (default: `22`) |
 | `NULLGATE_CLOUDFLARED_TOKEN` | Credential token for `cloudflared` tunnels |
 | `NULLGATE_CONFINE_SFTP` | Set to `1` to confine SFTP and SCP transfers to the workspace root |
+| `NULLGATE_RENDEZVOUS_URL` | HTTP endpoint for publishing successful srv.us readiness; may contain a secret token and is never printed |
 | `NULLGATE_VERSION` | Install a specific published version instead of the stable release; accepts `1.0.1` or `v1.0.1` |
 | `NULLGATE_DIST_URL` | Override the public release channel used by `install.sh` |
 | `NULLGATE_INSTALL_URL` | Override the installer URL used by `nullgate upgrade` |
@@ -222,7 +225,7 @@ Unknown flags fail normally; only the hidden external-launcher flags
   secure mode without authorized keys fails immediately instead of hanging.
 - Readiness is decisive: `start` returns success only after the gateway
   listens, the transport stays alive, and (for srv.us) a hostname is
-  announced. On timeout or failure both processes are stopped, recent
+  announced and serves an SSH banner over certificate-validated TLS. On timeout or failure both processes are stopped, recent
   transport logs go to stderr, and the exit code is nonzero.
 - `start --foreground` keeps the parent alive supervising both children,
   handles SIGINT/SIGTERM by stopping them, and exits nonzero with recent log tails if
@@ -230,7 +233,7 @@ Unknown flags fail normally; only the hidden external-launcher flags
 - `start`, `status`, and `connect` accept `--json` for machine-readable
   output. JSON is the only stdout in JSON mode and carries the operational
   fields agents need: version, provider, running state and PIDs, port,
-  workspace, URL, host, user, proxy command, auth mode, TCP forwarding, and
+  workspace, URL, host, user, proxy command, public health, auth mode, TCP forwarding, and
   file-transfer mode. `--json` is the stable agent contract; human output may
   change. `start --foreground --json` prints one readiness object,
   flushes it, then supervises.

{nullgate-1.2.5 → nullgate-1.2.6}/tests/test_commands.py

@@ -156,6 +156,11 @@ def state_dir(state_base):
 
 
 class CLILifecycleTests(unittest.TestCase):
+    def setUp(self):
+        probe = mock.patch.object(session.transports, "probe_ssh_tls", return_value=True)
+        probe.start()
+        self.addCleanup(probe.stop)
+
     def test_redesigned_defaults_and_boolean_overrides(self):
         parser = commands.build_parser()
         defaults = parser.parse_args(["start"])
@@ -171,6 +176,14 @@ class CLILifecycleTests(unittest.TestCase):
         self.assertIsNone(defaults.confine_sftp)
         self.assertIsNone(defaults.identity_seed_file)
         self.assertIsNone(defaults.identity_seed)
+        self.assertFalse(defaults.replace_stale)
+        self.assertIsNone(defaults.rendezvous_url)
+
+        recovery = parser.parse_args(
+            ["start", "--replace-stale", "--rendezvous-url", "https://hook.example/token"]
+        )
+        self.assertTrue(recovery.replace_stale)
+        self.assertEqual(recovery.rendezvous_url, "https://hook.example/token")
 
         seeded = parser.parse_args(["start", "--identity-seed-file", "/run/seed.txt"])
         self.assertEqual(seeded.identity_seed_file, "/run/seed.txt")
@@ -2089,6 +2102,171 @@ class CLILifecycleTests(unittest.TestCase):
             code, out, _ = run_cli_tty(["inspect"], env=env)
             self.assertNotIn("  url ", out)
 
+    def test_replace_stale_reuses_healthy_srvus_session(self):
+        args = commands.build_parser().parse_args(["start", "--replace-stale"])
+        target = transports.Target(
+            "healthy.srv.us", "proxy", "*.srv.us", "https://healthy.srv.us/"
+        )
+        with mock.patch.object(session.st, "setup_state", return_value=Path("/state")), mock.patch.object(
+            session.st, "is_running", return_value=True
+        ), mock.patch.object(session.st, "manifest_get", return_value="srvus"), mock.patch.object(
+            session.transports, "resolve_target", return_value=target
+        ), mock.patch.object(session, "_show_status", return_value=0) as show, mock.patch.object(
+            session.transports, "launch_gateway"
+        ) as launch:
+            self.assertEqual(session._launch(args, {}), 0)
+        show.assert_called_once_with()
+        launch.assert_not_called()
+
+    def test_replace_stale_stops_unhealthy_session_and_relaunches(self):
+        args = commands.build_parser().parse_args(
+            [
+                "start",
+                ".",
+                "--replace-stale",
+                "--public-access",
+                "--rendezvous-url",
+                "https://hook.example/token",
+            ]
+        )
+        target = transports.Target(
+            "dead.srv.us", "proxy", "*.srv.us", "https://dead.srv.us/"
+        )
+        stopped = []
+        stored = {}
+        with tempfile.TemporaryDirectory() as temp:
+            state = Path(temp)
+            for name in ("gateway.pid", "transport.pid"):
+                (state / name).write_text("")
+            with mock.patch.object(session.st, "setup_state", return_value=state), mock.patch.object(
+                session.st, "is_running", side_effect=[True, True, True, True, True, True]
+            ), mock.patch.object(session.st, "manifest_get", return_value="srvus"), mock.patch.object(
+                session.transports, "resolve_target", return_value=target
+            ), mock.patch.object(
+                session.transports, "probe_ssh_tls", side_effect=[False, True]
+            ), mock.patch.object(
+                session.st, "stop_one", side_effect=lambda path: stopped.append(Path(path).name)
+            ), mock.patch.object(
+                session.st, "port_open", side_effect=[False, True]
+            ), mock.patch.object(session.st, "write_pid", return_value=True), mock.patch.object(
+                session.st, "get_or_create_session", return_value="session"
+            ), mock.patch.object(
+                session.transports, "launch_gateway", return_value=mock.Mock(pid=11)
+            ) as gateway, mock.patch.object(
+                session.transports, "launch_transport", return_value=mock.Mock(pid=22)
+            ), mock.patch.object(
+                session.transports, "wait_for_srvus_host", return_value="new.srv.us"
+            ), mock.patch.object(session.st, "write_manifest"), mock.patch.object(
+                session.st, "write_settings", side_effect=lambda settings: stored.update(settings)
+            ), mock.patch.object(
+                session, "_publish_rendezvous"
+            ), mock.patch.object(session, "_show_status", return_value=0), mock.patch.object(
+                session.time, "sleep"
+            ):
+                self.assertEqual(session._launch(args, {}), 0)
+        self.assertEqual(stopped[:2], ["transport.pid", "gateway.pid"])
+        gateway.assert_called_once()
+        self.assertEqual(stored["rendezvous_url"], "https://hook.example/token")
+
+    def test_status_marks_live_srvus_processes_publicly_dead(self):
+        target = transports.Target(
+            "dead.srv.us", "proxy", "*.srv.us", "https://dead.srv.us/"
+        )
+        with mock.patch.object(session.st, "setup_state"), mock.patch.object(
+            session.st, "state_dir", return_value=Path("/state")
+        ), mock.patch.object(session.st, "is_running", return_value=True), mock.patch.object(
+            session.st, "manifest_get", side_effect=lambda key: "srvus" if key == "transport" else ""
+        ), mock.patch.object(session.st, "read_settings", return_value={}), mock.patch.object(
+            session.transports, "resolve_target", return_value=target
+        ), mock.patch.object(session.transports, "probe_ssh_tls", return_value=False):
+            code, out, err = run_cli(["status"])
+            self.assertEqual(code, 1)
+            self.assertEqual(out.strip(), "stopped")
+            code, out, err = run_cli(["status", "--json"])
+            self.assertEqual(code, 1)
+            self.assertFalse(json.loads(out)["public_healthy"])
+
+    def test_rendezvous_payload_is_minimal_and_contains_no_secrets(self):
+        target = transports.Target(
+            "ready.srv.us", "openssl proxy", "*.srv.us", "https://ready.srv.us/"
+        )
+        response = mock.MagicMock()
+        response.__enter__.return_value.status = 204
+        with mock.patch.object(session.urllib.request, "urlopen", return_value=response) as open_url:
+            session._publish_rendezvous("https://hook.example/private-token", target)
+        request = open_url.call_args.args[0]
+        payload = json.loads(request.data)
+        self.assertEqual(
+            set(payload),
+            {"provider", "host", "url", "ssh_command", "healthy", "updated_at"},
+        )
+        self.assertEqual(payload["host"], "ready.srv.us")
+        self.assertTrue(payload["healthy"])
+        serialized = json.dumps(payload)
+        self.assertNotIn("private-token", serialized)
+        self.assertNotIn("password", serialized.lower())
+
+    def test_rendezvous_failure_stops_new_children(self):
+        args = commands.build_parser().parse_args(
+            ["start", ".", "--public-access", "--rendezvous-url", "https://hook.example/token"]
+        )
+        target = transports.Target(
+            "ready.srv.us", "proxy", "*.srv.us", "https://ready.srv.us/"
+        )
+        stopped = []
+        with tempfile.TemporaryDirectory() as temp:
+            state = Path(temp)
+            with mock.patch.object(session.st, "setup_state", return_value=state), mock.patch.object(
+                session.st, "is_running", side_effect=[False, False, True, True, True, True]
+            ), mock.patch.object(session.st, "port_open", side_effect=[False, True]), mock.patch.object(
+                session.st, "write_pid", return_value=True
+            ), mock.patch.object(session.st, "get_or_create_session", return_value="session"), mock.patch.object(
+                session.transports, "launch_gateway", return_value=mock.Mock(pid=11)
+            ), mock.patch.object(
+                session.transports, "launch_transport", return_value=mock.Mock(pid=22)
+            ), mock.patch.object(
+                session.transports, "wait_for_srvus_host", return_value="ready.srv.us"
+            ), mock.patch.object(
+                session.transports, "resolve_target", return_value=target
+            ), mock.patch.object(
+                session, "_publish_rendezvous", side_effect=OSError("delivery failed")
+            ), mock.patch.object(
+                session.st, "stop_one", side_effect=lambda path: stopped.append(Path(path).name)
+            ), mock.patch.object(session.time, "sleep"):
+                code = session._launch(args, {})
+        self.assertEqual(code, 1)
+        self.assertIn("transport.pid", stopped)
+        self.assertIn("gateway.pid", stopped)
+
+
+class TransportProbeTests(unittest.TestCase):
+    def test_tls_probe_uses_sni_verification_context_and_requires_ssh_banner(self):
+        raw = mock.MagicMock()
+        raw.__enter__.return_value = raw
+        secured = mock.MagicMock()
+        secured.__enter__.return_value = secured
+        secured.recv.side_effect = [b"SSH-2.0-nullgate\r\n"]
+        context = mock.MagicMock(spec=__import__("ssl").SSLContext)
+        context.wrap_socket.return_value = secured
+        connect = mock.MagicMock(return_value=raw)
+        self.assertTrue(
+            transports.probe_ssh_tls(
+                "public.srv.us",
+                port=8443,
+                timeout=1.25,
+                create_connection=connect,
+                ssl_context=context,
+            )
+        )
+        connect.assert_called_once_with(("public.srv.us", 8443), timeout=1.25)
+        context.wrap_socket.assert_called_once_with(raw, server_hostname="public.srv.us")
+        secured.recv.side_effect = [b"HTTP/1.1 200 OK\r\n"]
+        self.assertFalse(
+            transports.probe_ssh_tls(
+                "public.srv.us", create_connection=connect, ssl_context=context
+            )
+        )
+
 
 class ClientConfigTests(unittest.TestCase):
     def test_client_config_print_and_idempotent_write(self):

nullgate-1.2.5/src/nullgate/__init__.py

@@ -1 +0,0 @@
-__version__ = "1.2.5"