Add jalth init to bootstrap a Cloudflare Zero Trust mesh. Provisions WARP MDM, Access groups and identity providers, the SSH certificate authority, a D1 database, and deploys the Registry Worker in one interactive flow (#12, #23)
Add jalth join <registry-url> to enroll a device into an existing mesh. Supports SSO login in a browser and headless --auth-key enrollment for cloud VMs and CI runners (#12, #23)
Add jalth ssh <device> to SSH into any mesh device over its CGNAT IP using short-lived Cloudflare Access certificates. No SSH keys to distribute, no authorized_keys files to curate. Extra SSH args pass through after -- (#23)
Add jalth ssh enable and jalth ssh disable to set up or tear down Zero Trust SSH on the current device. Installs an sshd drop-in with TrustedUserCAKeys, registers an Access infrastructure app, and reloads sshd. Idempotent — safe to re-run (#23)
Add jalth ssh allow <email> and jalth ssh revoke <email> to manage per-device SSH allow-lists after initial enable. Device owners edit their own; admins and operators edit any device (#23)
Add jalth ssh list to see the resolved Access policy for a device, with the owner called out explicitly (#23)
Add jalth auth-key create <name> to mint auth keys for headless device enrollment. Single-use or --reusable, configurable expiry via --expires-in <duration> (default 90d). Raw key is returned once — capture it immediately (#23)
Add jalth auth-key list and jalth auth-key revoke <name> to manage existing keys. Revocation is a soft delete — blocks new enrollments but does not deauthorize already-enrolled devices (#23)
Add jalth status for a mesh overview — device list with connection status, SSH enablement with the registered UNIX user, and associated services (#23)
Add jalth upgrade --worker-only to redeploy the Registry Worker using the bundle embedded in the current CLI. The Worker redeploys itself; no Cloudflare API token is needed on the local device (#23)
Every mesh-touching command now preflights /api with a 2s timeout and warns when the CLI’s embedded Worker version differs from the deployed one, with guidance on how to sync (#23)
Ship as a standalone compiled binary for macOS (arm64, x64) and Linux (arm64, x64). No Node.js, Bun, or package manager required on the target machine. Distributed via GitHub Releases with SHA-256 checksums (#23)
Patch Changes
Default SSH policy is owner-only: a freshly enabled SSH target only permits the device owner’s Cloudflare Access identity. Widen at enable time with --allow <email> (repeatable) or --allow-team, or afterwards with jalth ssh allow. The previous design routed all SSH through a mesh-wide group, which Cloudflare’s infrastructure apps reject (#23)
On cloud VMs that register root as the SSH user (Hetzner, DO, EC2, Linode, etc.), the sshd drop-in sets PermitRootLogin prohibit-password so cert-based root login works. Workstation installs that register a named user keep PermitRootLogin no (#23)
sudo jalth ssh enable on a workstation now prefers SUDO_USER over the effective root when registering the allowed UNIX account, so the target is set to the invoking user’s name instead of root (#23)