nullgate 1.2.6__tar.gz → 1.2.7__tar.gz

{nullgate-1.2.6/src/nullgate.egg-info → nullgate-1.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nullgate
-Version: 1.2.6
+Version: 1.2.7
 Summary: Disposable SSH gateway into confined directory workspaces
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

nullgate-1.2.7/src/nullgate/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.2.7"

{nullgate-1.2.6 → nullgate-1.2.7}/src/nullgate/ingress.py

@@ -2,9 +2,11 @@
 """srv.us reverse tunnel for the Nullgate srvus transport.
 
 Holds one AsyncSSH connection to srv.us with a remote port forward pointing back
-at the local SSH server. AsyncSSH is already required by the server, so speaking
-SSH in-process here removes the OpenSSH client and ssh-keygen from the host's
-requirements; the tunnel then works on stripped images that ship neither.
+at the local SSH server, reconnecting with backoff whenever the server drops it
+(srv.us documents wrapping the tunnel in a reconnect loop). AsyncSSH is already
+required by the server, so speaking SSH in-process here removes the OpenSSH
+client and ssh-keygen from the host's requirements; the tunnel then works on
+stripped images that ship neither.
 
 Launch with asyncssh available, e.g.:
   python -m nullgate.ingress --local-port 4822 --slot 1
@@ -30,6 +32,9 @@ from nullgate.account import current_username, ensure_username_environment
 
 IDENTITY_SEED_ENV = "NULLGATE_IDENTITY_SEED"
 
+RECONNECT_MIN = 1.0
+RECONNECT_MAX = 30.0
+
 
 class TunnelClient(asyncssh.SSHClient):
     """Surface srv.us protocol messages in the tunnel log.
@@ -96,37 +101,19 @@ async def pump(reader: asyncssh.SSHReader, writer) -> None:
         writer.flush()
 
 
-async def run(
-    host: str,
-    port: int,
+async def serve_connection(
+    connection: asyncssh.SSHClientConnection,
     local_host: str,
     local_port: int,
     slot: int,
-    key: Path,
-    username: str,
-) -> int:
-    ensure_username_environment(username)
-    ensure_key(key)
-
-    stopped = asyncio.Event()
-    loop = asyncio.get_running_loop()
-    for signum in (signal.SIGINT, signal.SIGTERM):
-        with contextlib.suppress(NotImplementedError):
-            loop.add_signal_handler(signum, stopped.set)
-
-    # known_hosts=None matches the connection commands this project prints: the
-    # ingress is disposable and only carries bytes, so it is not authenticated.
-    connection = await asyncssh.connect(
-        host,
-        port=port,
-        username=username,
-        client_keys=[str(key)],
-        known_hosts=None,
-        client_factory=TunnelClient,
-        keepalive_interval=30,
-        keepalive_count_max=3,
-    )
+    stopped: asyncio.Event,
+) -> bool:
+    """Hold one tunnel connection until it closes or a stop is requested.
 
+    Opens the session channel and the remote port forward, then waits. Returns
+    True when ``stopped`` was set (clean shutdown), False when the server
+    dropped the connection and the caller should reconnect.
+    """
     process = None
     listener = None
     tasks: list[asyncio.Task] = []
@@ -156,9 +143,9 @@ async def run(
         tasks.extend((closed, requested))
         await asyncio.wait((closed, requested), return_when=asyncio.FIRST_COMPLETED)
         if requested.done():
-            return 0
+            return True
         print("nullgate-ingress: connection closed by the server", flush=True)
-        return 1
+        return False
     finally:
         if listener is not None:
             listener.close()
@@ -172,6 +159,74 @@ async def run(
             await asyncio.gather(*tasks, return_exceptions=True)
 
 
+async def backoff(stopped: asyncio.Event, delay: float) -> None:
+    """Wait out a reconnect delay, returning early on a requested stop."""
+    with contextlib.suppress(asyncio.TimeoutError):
+        await asyncio.wait_for(stopped.wait(), timeout=delay)
+
+
+async def run(
+    host: str,
+    port: int,
+    local_host: str,
+    local_port: int,
+    slot: int,
+    key: Path,
+    username: str,
+) -> int:
+    ensure_username_environment(username)
+    ensure_key(key)
+
+    stopped = asyncio.Event()
+    loop = asyncio.get_running_loop()
+    for signum in (signal.SIGINT, signal.SIGTERM):
+        with contextlib.suppress(NotImplementedError):
+            loop.add_signal_handler(signum, stopped.set)
+
+    # Retry forever: srv.us documents wrapping the tunnel in a reconnect loop,
+    # and a disposable gateway must survive transient server-side flaps.
+    delay = RECONNECT_MIN
+    attempt = 0
+    while not stopped.is_set():
+        try:
+            # known_hosts=None matches the connection commands this project
+            # prints: the ingress is disposable and only carries bytes, so it
+            # is not authenticated.
+            connection = await asyncssh.connect(
+                host,
+                port=port,
+                username=username,
+                client_keys=[str(key)],
+                known_hosts=None,
+                client_factory=TunnelClient,
+                keepalive_interval=30,
+                keepalive_count_max=3,
+            )
+            if attempt:
+                print("nullgate-ingress: reconnected", flush=True)
+                attempt = 0
+                delay = RECONNECT_MIN
+            clean = await serve_connection(
+                connection, local_host, local_port, slot, stopped
+            )
+        except (OSError, asyncssh.Error) as error:
+            print(f"nullgate-ingress: {error}", flush=True)
+            clean = False
+        if clean:
+            return 0
+        attempt += 1
+        if stopped.is_set():
+            break
+        delay = min(delay, RECONNECT_MAX)
+        print(
+            f"nullgate-ingress: reconnecting in {delay:g}s (attempt {attempt})",
+            flush=True,
+        )
+        await backoff(stopped, delay)
+        delay *= 2
+    return 0
+
+
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--host", default="srv.us", help="tunnel host")

{nullgate-1.2.6 → nullgate-1.2.7}/src/nullgate/session.py

@@ -28,6 +28,14 @@ DEFAULT_SLOT = 1
 DISTRIBUTION_URL = "https://shadowdocks.github.io/nullgate-dist"
 INSTALLER_URL = f"{DISTRIBUTION_URL}/install.sh"
 
+_FRESH_SRVUS_TIMEOUT = 20.0
+_REUSE_SRVUS_TIMEOUT = 5.0
+_SRVUS_PROBE_INTERVAL = 1.0
+_TRANSPORT_RESTART_MAX = 3
+_TRANSPORT_RESTART_WINDOW = 30.0
+
+_UNSET: Any = object()
+
 
 def _version() -> str:
     try:
@@ -258,7 +266,7 @@ def _tail_file(path: Path, follow: bool) -> None:
             return
 
 
-def _status_payload() -> dict[str, Any]:
+def _status_payload(public_healthy: Any = _UNSET) -> dict[str, Any]:
     """Operational snapshot shared by start/status JSON output."""
     state = st.state_dir()
     gateway_pid_file = state / "gateway.pid"
@@ -267,9 +275,11 @@ def _status_payload() -> dict[str, Any]:
     transport_running = st.is_running(transport_pid_file)
     provider = st.manifest_get("transport") or transports.DEFAULT_TRANSPORT
     target = transports.resolve_target(provider, state)
-    public_healthy = None
     if provider == "srvus" and target is not None:
-        public_healthy = transports.probe_ssh_tls(target.host)
+        if public_healthy is _UNSET:
+            public_healthy = transports.probe_ssh_tls(target.host)
+    else:
+        public_healthy = None
     port_text = st.manifest_get("port")
     try:
         port = int(port_text) if port_text else None
@@ -299,9 +309,91 @@ def _status_payload() -> dict[str, Any]:
     }
 
 
-def _show_status(args: Any = None) -> int:
+def _reuse_conflict(
+    args: Any,
+    transport: str,
+    root: Path,
+    port: int,
+    slot: int,
+    hostname: str,
+    endpoint: str,
+    current_provider: str,
+) -> str | None:
+    """Return a reason when explicit launch options differ from the live session."""
+    if getattr(args, "transport", None) is not None and transport != current_provider:
+        return (
+            f"Running {current_provider} session differs from requested {transport}; "
+            "stop it first"
+        )
+    if getattr(args, "workspace", None) not in (None, ""):
+        current_root = st.manifest_get("sftp_root") or st.read_settings().get("root", "")
+        if current_root and str(root) != current_root:
+            return (
+                f"Running session workspace {current_root} differs from requested {root}; "
+                "stop it first"
+            )
+    if getattr(args, "port", None) is not None or getattr(args, "port_arg", None) is not None:
+        current_port = st.manifest_get("port")
+        if current_port and str(port) != str(current_port):
+            return (
+                f"Running session port {current_port} differs from requested {port}; "
+                "stop it first"
+            )
+    if getattr(args, "slot", None) is not None or getattr(args, "slot_arg", None) is not None:
+        current_slot = st.read_settings().get("slot", "")
+        if current_slot and str(slot) != str(current_slot):
+            return (
+                f"Running session slot {current_slot} differs from requested {slot}; "
+                "stop it first"
+            )
+    if getattr(args, "hostname", None):
+        current_hostname = st.manifest_get("hostname") or st.read_settings().get(
+            "hostname", ""
+        )
+        if current_hostname and hostname != current_hostname:
+            return "Running session hostname differs from requested hostname; stop it first"
+    if getattr(args, "endpoint", None):
+        current_endpoint = st.manifest_get("endpoint") or st.read_settings().get(
+            "endpoint", ""
+        )
+        if current_endpoint and endpoint != current_endpoint:
+            return "Running session endpoint differs from requested endpoint; stop it first"
+    accept_arg = getattr(args, "accept", None)
+    if accept_arg is not None:
+        current_accept = st.manifest_get("accept")
+        wanted = "1" if bool(accept_arg) else "0"
+        if current_accept and wanted != current_accept:
+            return "Running session auth mode differs from requested mode; stop it first"
+    forwarding_arg = getattr(args, "allow_tcp_forwarding", None)
+    if forwarding_arg is not None:
+        current_forward = st.manifest_get("allow_tcp_forwarding")
+        wanted = "1" if bool(forwarding_arg) else "0"
+        if current_forward and wanted != current_forward:
+            return "Running session forwarding differs from requested mode; stop it first"
+    confine_arg = getattr(args, "confine_sftp", None)
+    if confine_arg is not None:
+        current_confine = st.manifest_get("confine_sftp") or st.read_settings().get(
+            "confine_sftp", ""
+        )
+        wanted = "1" if bool(confine_arg) else "0"
+        if current_confine and wanted != current_confine:
+            return "Running session file-transfer differs from requested mode; stop it first"
+    return None
+
+
+def _public_row(color: _Color, public_healthy: bool | None) -> str | None:
+    if public_healthy is None:
+        return None
+    if public_healthy:
+        return "  public    " + color.green("healthy")
+    return "  public    " + color.red(
+        "unhealthy"
+    ) + color.dim(" (route announced but TLS/SSH probe failed; retry or use --replace-stale)")
+
+
+def _show_status(args: Any = None, public_healthy: Any = _UNSET) -> int:
     if getattr(args, "json", False):
-        payload = _status_payload()
+        payload = _status_payload(public_healthy)
         print(json.dumps(payload, indent=2))
         return 0 if payload["running"] and payload["public_healthy"] is not False else 1
     state = st.state_dir()
@@ -312,9 +404,12 @@ def _show_status(args: Any = None) -> int:
     transport = st.manifest_get("transport") or transports.DEFAULT_TRANSPORT
     target = transports.resolve_target(transport, state)
     live = bool(gateway_running and transport_running)
-    public_healthy = None
-    if transport == "srvus" and target is not None:
-        public_healthy = transports.probe_ssh_tls(target.host)
+    if public_healthy is _UNSET:
+        public_healthy = (
+            transports.probe_ssh_tls(target.host)
+            if transport == "srvus" and target is not None
+            else None
+        )
     usable = live and public_healthy is not False
     if not sys.stdout.isatty():
         if target is not None and usable:
@@ -330,6 +425,9 @@ def _show_status(args: Any = None) -> int:
     print()
     print(f"  gateway   {_proc_row(color, gateway_running, st.read_pid(gateway_pid_file))}")
     print(f"  transport {_proc_row(color, transport_running, st.read_pid(transport_pid_file))}")
+    row = _public_row(color, public_healthy)
+    if row is not None:
+        print(row)
     _print_auth_rows(color, state)
     if target is not None and public_healthy is not False:
         print()
@@ -358,6 +456,110 @@ def _publish_rendezvous(rendezvous_url: str, target: Any) -> None:
             raise OSError(f"HTTP {response.status}")
 
 
+def _restart_transport(transport_pid_file: Path, state: Path) -> None:
+    """Relaunch the transport child from persisted settings.
+
+    Re-derives the spawn exactly as ``_launch`` does: same transport type,
+    port, slot, persisted session id, and identity seed, so a restarted srv.us
+    ingress keeps the same key-derived hostname.
+    """
+    saved = st.read_settings()
+    transport = saved.get("transport") or transports.DEFAULT_TRANSPORT
+    _, port, slot = _resolve_launch_settings(None, saved)
+    _, identity_seed = _resolve_identity_seed(None, saved, transport)
+    accept = st.manifest_get("accept") == "1"
+    proc = transports.launch_transport(
+        transport=transport,
+        port=port,
+        slot=slot,
+        session=st.get_or_create_session(),
+        state=state,
+        endpoint=saved.get("endpoint") or "",
+        hostname=saved.get("hostname") or "",
+        token=saved.get("token") or "",
+        accept=accept,
+        identity_seed=identity_seed if transport == "srvus" else "",
+    )
+    if not st.write_pid(transport_pid_file, proc.pid):
+        st.kill_untracked(proc.pid)
+        raise SystemExit("Unable to track transport process")
+
+
+def _restart_gateway(gateway_pid_file: Path, state: Path) -> None:
+    """Relaunch the gateway child from persisted settings.
+
+    Re-derives the spawn exactly as ``_launch`` does: same transport, root,
+    port, password (or accept mode), forwarding, and SFTP confinement, so the
+    replacement gateway serves the same workspace on the same port.
+    """
+    saved = st.read_settings()
+    transport = saved.get("transport") or transports.DEFAULT_TRANSPORT
+    root, port, _ = _resolve_launch_settings(None, saved)
+    accept = st.manifest_get("accept") == "1"
+    password = _generated_password(state)
+    allow_tcp_forwarding = st.manifest_get("allow_tcp_forwarding") == "1"
+    confine = st.manifest_get("confine_sftp") or st.read_settings().get("confine_sftp", "")
+    proc = transports.launch_gateway(
+        transport=transport,
+        root=root,
+        port=port,
+        password=password,
+        accept=accept,
+        allow_tcp_forwarding=allow_tcp_forwarding,
+        confine_sftp=confine == "1",
+        state=state,
+    )
+    if not st.write_pid(gateway_pid_file, proc.pid):
+        st.kill_untracked(proc.pid)
+        raise SystemExit("Unable to track gateway process")
+
+
+def _supervise_tick(
+    gateway_pid_file: Path,
+    transport_pid_file: Path,
+    gateway_log: Path,
+    transport_log: Path,
+    restarts: dict[str, list[float]],
+) -> str:
+    """One supervision poll; relaunch a dead child when bounded.
+
+    Mutates ``restarts[child]`` with the restart timestamps within
+    ``_TRANSPORT_RESTART_WINDOW`` and returns "none", "relaunched", or "exit"
+    (restart budget exceeded; the caller reports and leaves).
+    """
+    child = None
+    if not st.is_running(gateway_pid_file):
+        pid_file, child = gateway_pid_file, "gateway"
+    elif not st.is_running(transport_pid_file):
+        pid_file, child = transport_pid_file, "transport"
+    if child is None:
+        return "none"
+    pid_file.unlink(missing_ok=True)
+    recent = [
+        stamp
+        for stamp in restarts[child]
+        if time.monotonic() - stamp < _TRANSPORT_RESTART_WINDOW
+    ]
+    if len(recent) + 1 >= _TRANSPORT_RESTART_MAX:
+        return "exit"
+    recent.append(time.monotonic())
+    restarts[child] = recent
+    print(
+        f"nullgate-supervisor: {child} exited; relaunching (restart {len(recent)})",
+        flush=True,
+    )
+    try:
+        if child == "gateway":
+            _restart_gateway(gateway_pid_file, gateway_pid_file.parent)
+        else:
+            _restart_transport(transport_pid_file, transport_pid_file.parent)
+    except SystemExit as error:
+        print(error, file=sys.stderr)
+        return "exit"
+    print(f"nullgate-supervisor: {child} relaunched", flush=True)
+    return "relaunched"
+
+
 def _supervise_foreground(
     gateway_pid_file: Path,
     transport_pid_file: Path,
@@ -366,8 +568,11 @@ def _supervise_foreground(
 ) -> int:
     """Keep the parent alive supervising both children.
 
-    Returns 128+signum when SIGINT/SIGTERM arrives (after stopping both
-    children), or 1 with recent log tails on stderr when a child dies.
+    A dead transport is relaunched in place (the gateway holds the served
+    root); restarts are bounded so a crash-looping transport surfaces its log
+    and exits instead of hot-looping. Returns 128+signum when SIGINT/SIGTERM
+    arrives (after stopping both children), or 1 with recent log tails on
+    stderr when the gateway dies or the transport keeps dying.
     """
     stop_signum: list[int] = []
 
@@ -380,21 +585,44 @@ def _supervise_foreground(
             previous[signum] = signal.signal(signum, _handle)
         except (OSError, ValueError):
             continue
+    restarts: dict[str, list[float]] = {"gateway": [], "transport": []}
     try:
+        gateway_seen_dead = False
         while True:
             if stop_signum:
                 st.stop_one(transport_pid_file)
                 st.stop_one(gateway_pid_file)
                 return 128 + stop_signum[0]
-            if not st.is_running(gateway_pid_file) or not st.is_running(
-                transport_pid_file
-            ):
+            if gateway_seen_dead or not st.is_running(gateway_pid_file):
+                gateway_seen_dead = True
                 print("A supervised process exited. Recent logs:", file=sys.stderr)
                 _tail_stderr(transport_log, 100)
                 _tail_stderr(gateway_log, 100)
                 st.stop_one(transport_pid_file)
                 st.stop_one(gateway_pid_file)
                 return 1
+            action = _supervise_tick(
+                gateway_pid_file,
+                transport_pid_file,
+                gateway_log,
+                transport_log,
+                restarts,
+            )
+            if action == "exit":
+                if not st.is_running(transport_pid_file):
+                    print(
+                        "Transport service keeps dying. Recent logs:",
+                        file=sys.stderr,
+                    )
+                    _tail_stderr(transport_log, 100)
+                    st.stop_one(gateway_pid_file)
+                else:
+                    print("A supervised process exited. Recent logs:", file=sys.stderr)
+                    _tail_stderr(transport_log, 100)
+                    _tail_stderr(gateway_log, 100)
+                    st.stop_one(transport_pid_file)
+                    st.stop_one(gateway_pid_file)
+                return 1
             time.sleep(0.5)
     finally:
         for signum, handler in previous.items():
@@ -444,16 +672,50 @@ def _launch(args: Any, saved: dict[str, Any]) -> int:
     if gateway_running or transport_running:
         current_provider = st.manifest_get("transport") or transports.DEFAULT_TRANSPORT
         current_target = transports.resolve_target(current_provider, state)
-        publicly_healthy = True
         if current_provider == "srvus":
-            publicly_healthy = bool(
-                current_target and transports.probe_ssh_tls(current_target.host)
+            current_host = current_target.host if current_target is not None else ""
+            if current_host:
+                publicly_healthy: bool | None = transports.wait_for_ssh_tls(
+                    current_host,
+                    timeout=_REUSE_SRVUS_TIMEOUT,
+                    interval=_SRVUS_PROBE_INTERVAL,
+                )
+            else:
+                publicly_healthy = False
+        else:
+            publicly_healthy = None
+        live = bool(gateway_running and transport_running)
+        if live and publicly_healthy is not False:
+            conflict = _reuse_conflict(
+                args,
+                transport,
+                root,
+                port,
+                slot,
+                hostname,
+                endpoint,
+                current_provider,
             )
-        if gateway_running and transport_running and publicly_healthy:
+            if conflict is not None:
+                die(conflict)
+            if not getattr(args, "replace_stale", False):
+                if gateway_running:
+                    die("Gateway service is already running")
+                die("Transport service is already running")
+            if current_provider == "srvus" and rendezvous_url and current_target is not None:
+                try:
+                    _publish_rendezvous(rendezvous_url, current_target)
+                except Exception:
+                    print(
+                        "Rendezvous readiness publication failed. Recent logs:",
+                        file=sys.stderr,
+                    )
+                    _tail_stderr(state / "transport.log", 100)
+                    return 1
             if getattr(args, "json", False):
-                print(json.dumps(_status_payload(), indent=2))
+                print(json.dumps(_status_payload(publicly_healthy), indent=2))
             else:
-                _show_status()
+                _show_status(args, publicly_healthy)
             return 0
         if getattr(args, "replace_stale", False):
             st.stop_one(transport_pid_file)
@@ -578,10 +840,19 @@ def _launch(args: Any, saved: dict[str, Any]) -> int:
                 )
                 _tail_stderr(transport_log, 100)
                 return 1
-            if not transports.probe_ssh_tls(host):
+            if not transports.wait_for_ssh_tls(
+                host,
+                timeout=_FRESH_SRVUS_TIMEOUT,
+                interval=_SRVUS_PROBE_INTERVAL,
+            ):
                 st.stop_one(transport_pid_file)
                 st.stop_one(gateway_pid_file)
-                print("srv.us public endpoint failed its SSH-over-TLS probe.", file=sys.stderr)
+                print(
+                    "srv.us public endpoint failed its SSH-over-TLS probe. "
+                    "Recent logs:",
+                    file=sys.stderr,
+                )
+                _tail_stderr(transport_log, 100)
                 return 1
         elif transport == "upterm":
             if not transports.wait_for_upterm_session(transport_pid_file, state / "upterm.json"):
@@ -613,7 +884,8 @@ def _launch(args: Any, saved: dict[str, Any]) -> int:
             except Exception:
                 st.stop_one(transport_pid_file)
                 st.stop_one(gateway_pid_file)
-                print("Rendezvous readiness publication failed.", file=sys.stderr)
+                print("Rendezvous readiness publication failed. Recent logs:", file=sys.stderr)
+                _tail_stderr(transport_log, 100)
                 return 1
 
         manifest: dict[str, Any] = {
@@ -657,12 +929,13 @@ def _launch(args: Any, saved: dict[str, Any]) -> int:
 
     json_mode = bool(getattr(args, "json", False))
     foreground = bool(getattr(args, "foreground", False))
+    established: bool | None = True if transport == "srvus" else None
     if foreground:
         if json_mode:
-            print(json.dumps(_status_payload(), indent=2))
+            print(json.dumps(_status_payload(established), indent=2))
             sys.stdout.flush()
         else:
-            _show_status()
+            _show_status(args, established)
         try:
             return _supervise_foreground(
                 gateway_pid_file, transport_pid_file, gateway_log, transport_log
@@ -671,10 +944,21 @@ def _launch(args: Any, saved: dict[str, Any]) -> int:
             st.stop_one(transport_pid_file)
             st.stop_one(gateway_pid_file)
             raise
+    supervisor_pid_file = state / "supervisor.pid"
+    supervisor_proc = transports._spawn(
+        [sys.executable, "-m", "nullgate.supervisor"],
+        transports._scrubbed_env(),
+        state / "supervisor.log",
+    )
+    if not st.write_pid(supervisor_pid_file, supervisor_proc.pid):
+        st.kill_untracked(supervisor_proc.pid)
+        die("Unable to track supervisor process")
     if json_mode:
-        print(json.dumps(_status_payload(), indent=2))
+        print(json.dumps(_status_payload(established), indent=2))
     else:
-        _show_status()
+        if sys.stdout.isatty():
+            print("Supervisor active: gateway and transport are kept alive in the background.")
+        _show_status(args, established)
     return 0
 
 
@@ -688,6 +972,7 @@ def cmd_shut(args: Any = None) -> int:
     del args
     st.setup_state()
     state = st.state_dir()
+    st.stop_one(state / "supervisor.pid")
     st.stop_one(state / "transport.pid")
     st.stop_one(state / "gateway.pid")
     (state / "manifest.json").unlink(missing_ok=True)
@@ -705,9 +990,17 @@ def cmd_enter(args: Any = None) -> int:
     state = st.state_dir()
     transport = st.manifest_get("transport") or transports.DEFAULT_TRANSPORT
     target = transports.resolve_target(transport, state)
+    public_healthy = None
+    if transport == "srvus" and target is not None:
+        public_healthy = transports.probe_ssh_tls(target.host)
     if getattr(args, "json", False):
-        payload = _status_payload()
-        if target is None:
+        payload = _status_payload(public_healthy)
+        if target is None or public_healthy is False:
+            note = (
+                "No publicly healthy route; check `nullgate status`."
+                if public_healthy is False
+                else "No published address yet; check `nullgate status`."
+            )
             payload.update(
                 {
                     "url": None,
@@ -719,10 +1012,7 @@ def cmd_enter(args: Any = None) -> int:
                 }
             )
             print(json.dumps(payload, indent=2))
-            print(
-                "No published address yet; check `nullgate status`.",
-                file=sys.stderr,
-            )
+            print(note, file=sys.stderr)
             return 1
         payload.update(
             {
@@ -734,6 +1024,8 @@ def cmd_enter(args: Any = None) -> int:
         return 0
     if target is None:
         die("No published address yet; check `nullgate status`.")
+    if public_healthy is False:
+        die("No publicly healthy route; check `nullgate status`.")
     if not sys.stdout.isatty():
         _print_compact_connection(state, target)
         return 0