Add a gateway command (hidden) with status and stop

[pjbgf]

qubesome gateway status reports the configured image, policy path and subnet, holder and gateway liveness, readiness, and allocated addresses. qubesome gateway stop ends the gateway and leaves the session holder up, so the next launch starts a fresh one.

Hidden because qubesome manages the gateway itself; this is the operator's job of replacing a running one, which until now meant killing a pid out of a JSON state file by hand.

Reports honest unknowns rather than blanks: no config loaded, no gateway configured, an unresolvable policy path and a mismatched subnet each print a reason.

[Copilot]

🟡 Changes recommended

Unresolved review findings must be addressed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds hidden gateway status and gateway stop commands for inspecting and replacing the session gateway while preserving its holder.

Changes:

• Reports gateway configuration, liveness, readiness, and allocated addresses.
• Stops the gateway process without stopping the session holder.
• Adds focused tests and registers the CLI commands.

File summaries

File	Description
internal/gateway/stop.go	Gateway shutdown logic.
internal/gateway/stop_test.go	Stop behavior and locking tests.
internal/gateway/status.go	Gateway status inspection and rendering.
internal/gateway/status_test.go	Status reporting tests.
cmd/cli/root.go	Registers the hidden gateway command.
cmd/cli/gateway.go	Defines the status and stop subcommands.

Review details

Suppressed comments (1)

cmd/cli/gateway.go:62

• profileConfigOrDefault("") only selects an active config when exactly one profile is active; with multiple active profiles it falls back to the user-level config. Because the gateway is session-wide and may have been started from any active profile, this can make status report an unrelated image, policy, or subnet (or claim the config is unknown) for the running gateway. Resolve the session's gateway configuration explicitly or report the ambiguity instead of using this fallback.

			status := g.Inspect(session.Current(), profileConfigOrDefault(""), g.StatusReady)

• Files reviewed: 6/6 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Unresolved gateway lifecycle, process-identity, locking, and configuration-reporting issues remain.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (6)

cmd/cli/gateway.go:62

• profileConfigOrDefault("") only returns a loaded config when it has at least one profile (root.go:126 and root.go:135). A valid config containing only a gateway block is therefore reported here as ConfigProblem: no qubesome config was loaded, so gateway status cannot report the configured image, policy, or subnet for gateway-only configurations. Load the status config without requiring a profile, or use a dedicated config-selection path for this command.

			status := g.Inspect(session.Current(), profileConfigOrDefault(""), g.StatusReady)

cmd/cli/gateway.go:62

• profileConfigOrDefault("") cannot preserve the invalid gateway config needed for this report: config() calls types.LoadConfig, which rejects a GatewayConfig.ConfigPath that leaves RootDir and returns nil. After an operator edits a running gateway's policy to ../gateway.yml, this command therefore prints no qubesome config was loaded instead of the promised unresolvable-policy reason. Load this command's config in a mode that retains the gateway block, or otherwise surface the validation error.

			status := g.Inspect(session.Current(), profileConfigOrDefault(""), g.StatusReady)

internal/gateway/status.go:141

• This PolicyProblem branch is unreachable from the CLI for the invalid paths it is meant to explain: config() calls types.LoadConfig, whose validation rejects GatewayConfig.ConfigPath errors, then returns nil. gateway status consequently prints no qubesome config was loaded instead of the promised policy-path reason. Preserve enough of the decoded config to inspect/report this validation error, or make status use a loader that does not discard it.

	policy, err := cfg.Gateway.ConfigPath(cfg.RootDir)
	if err != nil {
		st.PolicyProblem = err.Error()

internal/gateway/status.go:172

• Allocate serializes its read and write of this JSON file with the gateway lock, but status reads it without that lock. Because writeAlloc uses a truncating os.WriteFile, status can observe an empty or partial document during a normal allocation and report a spurious parse error. Read the allocation record under the same lock or change the writer to an atomic replacement.

	a, err := readAllocFile(g.AllocPath)

internal/gateway/stop.go:81

• Removing the state file and releasing the lock does not wait for the gateway's existing reap goroutine. In the persistent profile host, that goroutine waits for the old bwrap and then unconditionally removes this same path; a next launch can write a fresh gateway state before it runs, after which the old reaper deletes the new record. Status will report the replacement as stopped and later launches can start duplicates. The reaper must remove the file only if it still belongs to the process it waited for, or stopping must coordinate with that reaper.

	if err := os.Remove(g.StatePath); err != nil && !errors.Is(err, os.ErrNotExist) {
		return st.PID, fmt.Errorf("failed to remove the gateway state %q: %w", g.StatePath, err)
	}

internal/gateway/stop.go:47

• The start-time check is not atomic with this signal. The recorded process can exit after sandbox.Alive returns, its PID can be reused, and this numeric Kill can then terminate an unrelated process even though the stale-record check passed. Use an identity-preserving mechanism such as a pidfd (and handle the not-running case) rather than relying on the earlier PID/start-time read.

	if !sandbox.Alive(g.StatePath) {

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite