jalth 0.9.0

Minor Changes

• Add jalth ssh add-user <unix-user> and jalth ssh remove-user <unix-user> to manage which UNIX login accounts a mesh device accepts over SSH, with an optional --device <name> to target another device (same ownership/operator rules as jalth ssh allow). Previously a device’s SSH login users were fixed at jalth ssh enable time to the single account that ran it — there was no way to register a second login user (e.g. root plus deploy) short of disabling and re-enabling. jalth ssh --user <unix-user> can now connect as any registered account. The UNIX account must already exist on the target device — these commands manage the Cloudflare Access allow-list only, not local accounts — and remove-user refuses to drop the last remaining user (use jalth ssh disable to turn SSH off entirely). (#369)

Patch Changes

• Fix jalth join --auth-key hanging for five minutes and failing with WARP did not connect within 300s on a freshly-installed device. Headless enrollment now re-issues warp-cli connect (throttled) while the daemon is up but not yet connected, so it recovers when the first connect lands before the MDM service-token auto-enroll has registered the device — previously the flow only watched status and waited out the full timeout, leaving you to run warp-cli connect by hand. The same self-healing reconnect now also backs the WARP reconnect steps in jalth doctor --fix. (#368)

• jalth join now stops with an Already joined mesh "<team>" as "<device>" error when this device is already enrolled, instead of re-prompting for the device name and re-running WARP enrollment from scratch (rewriting the MDM profile and restarting the daemon on an already-connected device). Run jalth status to inspect, or jalth leave before re-joining. A headless auth-key join that failed partway through still resumes from its saved checkpoint as before. (#368)

• Fix macOS devices silently de-enrolling from the mesh after a reboot. jalth init/jalth join now write the WARP managed-config to /Library/Application Support/Cloudflare/mdm.xml instead of /Library/Managed Preferences/com.cloudflare.warp.plist. The old directory is owned by macOS and reclaims any file not backed by a configuration profile on reboot, which dropped the organization pin and invalidated the WARP registration — WARP came back on the consumer onboarding screen and warp-cli status reported “Registration Missing due to: Account Mismatch”. The new path is a plain directory that persists across reboots. macOS devices enrolled before this release should re-enroll (jalth leave then jalth join) to move onto the persistent path. (#371)

• jalth serve no longer aborts with cloudflared service is not healthy after setup. enabled=true, running=false when the tunnel daemon is merely slow to finish starting. The post-setup health check now polls for the service to reach a running state (launchd state = running / systemd active) instead of sampling once immediately after restarting it — so a healthy service that takes a few seconds to come up (cloudflared runs a connectivity precheck at startup) is no longer reported as failed. A genuinely broken service still fails once the retries are exhausted, with the same diagnostic snapshot. (#368)

• Fix the SSH cert-denied hint suggesting jalth ssh allow <your-email> --device-name <device>. The allow subcommand’s flag is --device, so copy-pasting the suggested command failed with an unknown-option error; the hint now prints the correct --device flag. (#368)

• jalth status now confirms reachability with a quick ICMP ping for any device whose Cloudflare DEX heartbeat doesn’t report it as connected, and shows it as connected when it answers. Previously an idle or recently-slept device that was still routable showed as offline, because DEX fleet-status (a ~2-minute telemetry heartbeat read over a 15-minute window) hadn’t recorded it — even though jalth ping could reach it. The probe is additive: a DEX-connected device is never downgraded on a failed ping, and this device isn’t probed (ICMP can’t hairpin to your own mesh IP), so it keeps its DEX status. The confirmation runs on every jalth status, including --output json, and adds up to ~2s when one or more devices need confirming. (#368)

• jalth status now prints a Registry: line showing the active Worker endpoint the CLI is talking to, directly under the Mesh: header. When the mesh is on its permanent workers.dev URL (no custom domain attached, or detached via jalth domain remove), the line is annotated (workers.dev fallback) so you can tell at a glance whether a custom domain is live. (#368)

• jalth up now re-syncs this device’s live WARP enrollment (CGNAT IP + registration ID) to the registry instead of sending a bare heartbeat. After an out-of-band re-enrollment — a reboot, a manual WARP login, or a managed-config reload — WARP can come back with a new CGNAT IP and registration the registry doesn’t know about, leaving peers routing to a dead address; jalth up now detects and self-heals that without a full jalth leave/jalth join. A fully de-enrolled device (no WARP registration at all) still needs jalth join. (#371)

• Updated dependencies [0259046]:

  • @jalth/contracts@0.9.0