Declare CLI client port forwards in the config; make the control panel read-only - #102
Merged
Merged
Conversation
…l read-only The CLI client's port forwards are now `[[forwards]]` tables in the client config (label optional; local_port, remote_host, remote_port), validated at startup like the rest of the config (valid host and label, nonzero ports, unique local ports) and brought up with the client. There is no CLI flag. The per-instance forwards JSON store, the TUI add/edit/delete form and delete confirmation, and the on/off toggle are removed. The control channel now only serves status and connection-path snapshots — nothing about the client can be changed from `client control`. A forward whose listener fails to bind is still switched off by the client itself, with the reason shown next to its row. A `--quick` client reads no config, so it has no forwards. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
[[forwards]]tables in the client TOML config (labeloptional,local_port,remote_host,remote_port). They are validated at startup (labels, hosts, nonzero ports, unique local ports) and fixed for the session.forwards-<key>.jsonstore and the TUI add/edit/delete form are gone. The on/off toggle is gone too. The panel is read-only, so the client's on-disk identity is just the lock and the control socket.StatusandConnPathonly). The socket stays owner-only since snapshots describe the user's network. The panel runs as the same user and needs no elevated privilege.client.toml.example, README,docs/systemd.md(edit the config and restart to change forwards; the quick client has no forwards).No backward compatibility with the removed JSON store, per the repo rule.
Test plan
cargo clippy --workspace --all-targetscleanci/unix/ci.shpasses (25 + 154 tests)HOME: duplicatelocal_portrejected with a clear error; a valid config logs the loaded forwards and binds both listeners; only the lock file is written🤖 Generated with Claude Code