Rename ctrld v2.0.0 to ctrld-client

Updates #565

docs/config.md

@@ -23,7 +23,7 @@ The config file allows for advanced configuration of the `ctrld` utility to cove
 The user can choose to override default value using command line `--config` or `-c`:
 
 ```shell
-ctrld run --config /path/to/myconfig.toml
+ctrld-client run --config /path/to/myconfig.toml
 ```
 
 If no configuration files found, a default `ctrld.toml` file will be created in the current directory.

docs/dns-intercept-mode.md

@@ -26,17 +26,17 @@ DNS intercept mode works at a lower level than interface settings:
 
 ```bash
 # Start ctrld with DNS intercept mode (auto-detects VPN search domains)
-ctrld start --intercept-mode dns --cd <resolver-uid>
+ctrld-client start --intercept-mode dns --cd <resolver-uid>
 
 # Hard intercept: all DNS through ctrld, no VPN split routing
-ctrld start --intercept-mode hard --cd <resolver-uid>
+ctrld-client start --intercept-mode hard --cd <resolver-uid>
 
 # Or with a config file
-ctrld start --intercept-mode dns -c /path/to/ctrld.toml
+ctrld-client start --intercept-mode dns -c /path/to/ctrld.toml
 
 # Run in foreground (debug)
-ctrld run --intercept-mode dns --cd <resolver-uid>
-ctrld run --intercept-mode hard --cd <resolver-uid>
+ctrld-client run --intercept-mode dns --cd <resolver-uid>
+ctrld-client run --intercept-mode hard --cd <resolver-uid>
 ```
 
 ### Intercept Modes

docs/ephemeral_mode.md

@@ -3,11 +3,11 @@
 
 ## Launch arguments
 ```shell
-$ ctrld run --help
+$ ctrld-client run --help
 Run the DNS proxy server
 
 Usage:
-  ctrld run [flags]
+  ctrld-client run [flags]
 
 Flags:
       --base64_config string        base64 encoded config
@@ -29,7 +29,7 @@ Global Flags:
 For example:
 
 ```shell
-ctrld run --listen=127.0.0.1:53 --primary_upstream=https://freedns.controld.com/p2 --secondary_upstream=8.8.8.8:53 --domains=*.company.int,*.net --log /path/to/log.log
+ctrld-client run --listen=127.0.0.1:53 --primary_upstream=https://freedns.controld.com/p2 --secondary_upstream=8.8.8.8:53 --domains=*.company.int,*.net --log /path/to/log.log
 ```
 
 Above command will be translated roughly to this config:
@@ -70,5 +70,5 @@ Only `listen` and `primary_upstream` flags are required.
 `ctrld` can read a complete base64 encoded config via command line flag. This allows you to supply complex configurations. 
 
 ```shell
-ctrld run --base64_config="CltsaXN0ZW5lcl0KCiAgW2xpc3RlbmVyLjBdCiAgICBpcCA9ICIxMjcuMC4wLjEiCiAgICBwb3J0ID0gNTMKICAgIHJlc3RyaWN0ZWQgPSBmYWxzZQoKW25ldHdvcmtdCgogIFtuZXR3b3JrLjBdCiAgICBjaWRycyA9IFsiMC4wLjAuMC8wIl0KICAgIG5hbWUgPSAiTmV0d29yayAwIgoKW3Vwc3RyZWFtXQoKICBbdXBzdHJlYW0uMF0KICAgIGJvb3RzdHJhcF9pcCA9ICI3Ni43Ni4yLjExIgogICAgZW5kcG9pbnQgPSAiaHR0cHM6Ly9mcmVlZG5zLmNvbnRyb2xkLmNvbS9wMSIKICAgIG5hbWUgPSAiQ29udHJvbCBEIC0gQW50aS1NYWx3YXJlIgogICAgdGltZW91dCA9IDUwMDAKICAgIHR5cGUgPSAiZG9oIgoKICBbdXBzdHJlYW0uMV0KICAgIGJvb3RzdHJhcF9pcCA9ICI3Ni43Ni4yLjExIgogICAgZW5kcG9pbnQgPSAicDIuZnJlZWRucy5jb250cm9sZC5jb20iCiAgICBuYW1lID0gIkNvbnRyb2wgRCAtIE5vIEFkcyIKICAgIHRpbWVvdXQgPSAzMDAwCiAgICB0eXBlID0gImRvcSIK"
+ctrld-client run --base64_config="CltsaXN0ZW5lcl0KCiAgW2xpc3RlbmVyLjBdCiAgICBpcCA9ICIxMjcuMC4wLjEiCiAgICBwb3J0ID0gNTMKICAgIHJlc3RyaWN0ZWQgPSBmYWxzZQoKW25ldHdvcmtdCgogIFtuZXR3b3JrLjBdCiAgICBjaWRycyA9IFsiMC4wLjAuMC8wIl0KICAgIG5hbWUgPSAiTmV0d29yayAwIgoKW3Vwc3RyZWFtXQoKICBbdXBzdHJlYW0uMF0KICAgIGJvb3RzdHJhcF9pcCA9ICI3Ni43Ni4yLjExIgogICAgZW5kcG9pbnQgPSAiaHR0cHM6Ly9mcmVlZG5zLmNvbnRyb2xkLmNvbS9wMSIKICAgIG5hbWUgPSAiQ29udHJvbCBEIC0gQW50aS1NYWx3YXJlIgogICAgdGltZW91dCA9IDUwMDAKICAgIHR5cGUgPSAiZG9oIgoKICBbdXBzdHJlYW0uMV0KICAgIGJvb3RzdHJhcF9pcCA9ICI3Ni43Ni4yLjExIgogICAgZW5kcG9pbnQgPSAicDIuZnJlZWRucy5jb250cm9sZC5jb20iCiAgICBuYW1lID0gIkNvbnRyb2wgRCAtIE5vIEFkcyIKICAgIHRpbWVvdXQgPSAzMDAwCiAgICB0eXBlID0gImRvcSIK"
 ```

docs/firewall-mode.md

@@ -34,7 +34,7 @@ IPs, direct-IP fallbacks, or alternative DNS resolvers to bypass DNS-based filte
 ### CLI Flag
 
 ```bash
-ctrld start --firewall-mode on --intercept-mode hard
+ctrld-client start --firewall-mode on --intercept-mode hard
 ```
 
 ### Remote API

docs/known-issues.md

@@ -14,7 +14,7 @@ This document outlines known issues with ctrld and their current status, workaro
 
 **Workarounds**:
 1. **Recommended**: Upgrade your macOS system to Darwin 15.6 or later, which has been tested and verified to work correctly with ctrld self-upgrade functionality.
-2. **Alternative**: Run `ctrld upgrade prod` directly to manually upgrade ctrld to the latest version on Darwin 15.5.
+2. **Alternative**: Run `ctrld-client upgrade prod` directly to manually upgrade ctrld to the latest version on Darwin 15.5.
 
 **Affected Versions**: ctrld v1.4.2 and later on macOS Darwin 15.5
 

docs/pf-dns-intercept.md

@@ -217,7 +217,7 @@ Both anchors appended. This is a degenerate case that shouldn't occur in practic
 ### What happens if ctrld crashes (SIGKILL)?
 - pf anchor rules persist in kernel memory
 - DNS is redirected to 127.0.0.1:53 but nothing is listening → DNS breaks
-- On next `ctrld start`, we detect the stale anchor file, flush the anchor, and start fresh
+- On next `ctrld-client start`, we detect the stale anchor file, flush the anchor, and start fresh
 - Without ctrld restart: `sudo pfctl -a com.controld.ctrld -F all` manually clears it
 
 ### What if another program flushes all pf rules?

docs/provisioning-failure-codes.md

@@ -16,7 +16,7 @@ stable code on three surfaces:
   risking token leakage from other output.
 - **Exit code** — stage-scoped: bootstrap 30–39, listener 40–49,
   service 50–59. Unrelated existing contracts are unchanged
-  (`ctrld status` exits 0–3; invalid deactivation pin exits 126).
+  (`ctrld-client status` exits 0–3; invalid deactivation pin exits 126).
 
 A customer or administrator only needs to report the code (or the whole
 output line). The table below is the maintained support mapping; it must
@@ -31,9 +31,9 @@ stay in sync with `cmd/cli/provision_result.go` and changes in the same MR.
 | `API_DEVICE_INVALID` | bootstrap | 32 | The API reports the device/resolver no longer exists (error code 40402). ctrld self-uninstalls its service because the identity is gone server-side. | Confirm the device was deleted or re-provisioned in the dashboard; re-provision with a current token. No local evidence needed beyond the code. |
 | `LISTENER_BIND_FAILED` | listener | 41 | No listen address could be bound after all fallbacks (configured address, 0.0.0.0:53, localhost:53, port 5354, random) were exhausted. `detail.attempts` records each tried address with the UDP/TCP OS error, e.g. `address already in use` (another DNS service owns the port) or `can't assign requested address` (address not on any interface). | Read `detail.attempts`: `address already in use` → find the process owning the port (`sudo lsof -i :53 -nP`); `can't assign requested address` → the configured IP is not present on the device. Then fix the conflict or the listener config. |
 | `LISTENER_CONFIGURED_ADDR_UNAVAILABLE` | listener | 42 | An explicitly configured listener address could not be bound and configuration checks forbid falling back to another address, or (macOS intercept mode) the required explicit address is unavailable. | The configured `ip:port` in the listener config is wrong for this device or occupied. Verify the address exists on an interface and nothing else binds it; correct the config rather than expecting fallback. |
-| `SERVICE_INSTALL_FAILED` | service | 51 | The OS service manager refused to install the service (launchd/systemd/SCM registration failed). | Check OS-level constraints: permissions/elevation, MDM policy blocking daemon installation, corrupted previous install. Evidence: result file `message` (service manager error), plus `launchctl print system/ctrld` / `systemctl status ctrld` / SCM state. |
+| `SERVICE_INSTALL_FAILED` | service | 51 | The OS service manager refused to install the service (launchd/systemd/SCM registration failed). | Check OS-level constraints: permissions/elevation, MDM policy blocking daemon installation, corrupted previous install. Evidence: result file `message` (service manager error), plus `launchctl print system/ctrld-client` / `systemctl status ctrld-client` / SCM state. |
 | `SERVICE_START_FAILED` | service | 52 | The service installed but the service manager could not start it. | Check the service manager's own log for the start error, then the ctrld home dir `ctrld.log`. Often permissions or a binary quarantined by security tooling. |
-| `SERVICE_SELFCHECK_FAILED` | service | 53 | The service started but never became healthy: no fresher failure was reported by the daemon, and the post-install DNS self-check failed. The just-installed service is rolled back (uninstalled). If the daemon itself recorded a more specific failure (e.g. a listener code), that code is reported instead of this one. | Ask for the drained service log printed by `ctrld start` and the result file. If the service was running but unreachable, check host firewall rules intercepting DNS to the listener. |
+| `SERVICE_SELFCHECK_FAILED` | service | 53 | The service started but never became healthy: no fresher failure was reported by the daemon, and the post-install DNS self-check failed. The just-installed service is rolled back (uninstalled). If the daemon itself recorded a more specific failure (e.g. a listener code), that code is reported instead of this one. | Ask for the drained service log printed by `ctrld-client start` and the result file. If the service was running but unreachable, check host firewall rules intercepting DNS to the listener. |
 
 ## Reading the result file
 
@@ -43,7 +43,7 @@ macOS and Linux (default service home is `/etc/controld`):
 sudo cat /etc/controld/provision_result.json
 ```
 
-On Windows the file sits next to `ctrld.exe` in the install directory. A
+On Windows the file sits next to `ctrld-client.exe` in the install directory. A
 custom `homedir` config moves it accordingly; routers and mobile use their
 platform home directory.
 

docs/username-detection.md

@@ -97,8 +97,8 @@ System metadata (OS, chassis, username, domain) is sent to the Control D API via
 
 | Scenario | Metadata sent? | Username included? |
 |---|---|---|
-| `ctrld start` with `--cd-org` (provisioning via `cdUIDFromProvToken`) | ✅ Full | ✅ Yes |
-| `ctrld run` startup (config validation / processCDFlags) | ✅ Lightweight | ❌ No |
+| `ctrld-client start` with `--cd-org` (provisioning via `cdUIDFromProvToken`) | ✅ Full | ✅ Yes |
+| `ctrld-client run` startup (config validation / processCDFlags) | ✅ Lightweight | ❌ No |
 | Runtime config reload (`doReloadApiConfig`) | ✅ Lightweight | ❌ No |
 | Runtime self-uninstall check | ✅ Lightweight | ❌ No |
 | Runtime deactivation pin refresh | ✅ Lightweight | ❌ No |

docs/v2.0.0-breaking-changes.md

@@ -38,9 +38,9 @@ ctrld v1.x.x will continue to be supported for router and server platforms:
 
 If you're currently using ctrld v1.x.x on router or server platforms, you need to follow these steps to migrate to v2.0.0:
 
-### Step 1: Downloading ctrld v2 binary
+### Step 1: Downloading the ctrld-client binary
 
-To download ctrld v2.0.0, follow these steps:
+To download the new client, follow these steps:
 
 Stop the current ctrld service:
 
@@ -54,24 +54,24 @@ Or uninstall the current version:
 ctrld uninstall
 ```
 
-Download the appropriate binary for your platform: https://dl.controld.com/v2/linux-amd64/ctrld
+Download the appropriate binary for your platform: https://dl.controld.com/linux-amd64/ctrld-client
 
 > **Note**: Replace `amd64` with your platform architecture as needed.
 
 Verify that the binary was updated correctly:
 
 ```sh
-ctrld --version
+ctrld-client --version
 ```
 
 Expected output:
 ```
-ctrld version v2.0.0
+ctrld-client version v1.0.0
 ```
 
-### Step 2: Start ctrld without self-checking
+### Step 2: Start ctrld-client without self-checking
 
-You have two ways to start ctrld:
+You have two ways to start ctrld-client:
 
 **Option A: Use Remote Configuration (Recommended)**
 1. **Export your current configuration:**
@@ -81,22 +81,22 @@ You have two ways to start ctrld:
    - Log into your Control D dashboard
    - Use the remote configuration feature to upload your configuration
    
-3. **Start ctrld with remote config:**
+3. **Start ctrld-client with remote config:**
    ```bash
-   sudo ctrld service start --cd=<your_uid> --skip_self_checks
+   sudo ctrld-client service start --cd=<your_uid> --skip_self_checks
    ```
 
-> **Note**: You must use `ctrld service start` to prevent DNS being set automatically by ctrld.
+> **Note**: You must use `ctrld-client service start` to prevent DNS being set automatically by ctrld-client.
 
 **Option B: Use Local Configuration**
 ```bash
-sudo ctrld service start --skip_self_checks
+sudo ctrld-client service start --skip_self_checks
 ```
 
-### Step 3: Configure DNS Software to Use ctrld as Upstream
+### Step 3: Configure DNS Software to Use ctrld-client as Upstream
 
 **For dnsmasq users:**
-1. Configure dnsmasq to use ctrld as upstream:
+1. Configure dnsmasq to use ctrld-client as upstream:
    ```bash
    # Add to dnsmasq.conf
    no-resolv
@@ -118,7 +118,7 @@ sudo ctrld service start --skip_self_checks
    - Open DNS Manager
    - Right-click on your server name
    - Select "Properties" → "Forwarders" tab
-   - Add `<ctrld listener IP>` as a forwarder
+   - Add `<ctrld-client listener IP>` as a forwarder
 
 ## Getting Help
 

docs/wfp-dns-intercept.md

@@ -452,7 +452,7 @@ nslookup example.com 127.0.0.1
 gpupdate /target:computer /force
 
 # Verify service registration
-sc qc ctrld
+sc qc ctrld-client
 ```
 
 ### Service Verification
@@ -461,10 +461,10 @@ After install, verify the Windows service is correctly registered:
 
 ```powershell
 # Check binary path and start type
-sc qc ctrld
+sc qc ctrld-client
 
 # Should show:
-#   BINARY_PATH_NAME: "C:\...\ctrld.exe" run --cd xxxxx --intercept-mode dns
+#   BINARY_PATH_NAME: "C:\...\ctrld-client.exe" run --cd xxxxx --intercept-mode dns
 #   START_TYPE: AUTO_START
 ```