@bli-cockpit/cli 0.2.53 → 0.2.55

package/dist/commands/settings-render.js

@@ -98,6 +98,33 @@ export function renderTeamMembers(body) {
     }
     return lines;
 }
+/**
+ * BLI-3559: `cockpit team device list` — the same rows and the same summary
+ * sentence (`revoked_reason` / "Approved <date>" / "Waiting for approval")
+ * `GET /api/team/devices` computes, printed the way the web ambient page's
+ * device table shows them.
+ */
+export function renderDeviceList(body) {
+    const devices = list(body.devices);
+    if (devices.length === 0)
+        return [`${INDENT}no collector devices`];
+    return devices.map((device) => {
+        const name = text(device.device_name, text(device.device_id));
+        const state = text(device.trust_state, "unknown");
+        const owner = text(device.owner_label, "—");
+        const summary = text(device.summary, "");
+        return `${INDENT}${padEndDisplay(name, 24)} ${padEndDisplay(state, 10)} ${padEndDisplay(owner, 26)} ${summary}  [${text(device.device_id)}]`;
+    });
+}
+/** `cockpit team device revoke <id|name>` — one line naming what happened. */
+export function renderDeviceRevoked(body) {
+    const device = record(body.device);
+    const name = text(device.device_name, text(device.device_id, "device"));
+    const reason = text(device.revoked_reason, "");
+    return reason
+        ? `${INDENT}Revoked ${name}. Reason: ${reason}`
+        : `${INDENT}Revoked ${name}.`;
+}
 export function renderSwitches(body) {
     const switches = list(body.switches);
     if (switches.length === 0)

package/dist/commands/sync-followups.js

@@ -135,7 +135,11 @@ export async function runMemoryInstallAfterSync(command, io, dashboardUrl, optio
             dashboardUrl,
             dryRun: false,
             json: command.json,
-        }, io);
+        }, io, 
+        // Undefined on the real CLI (no io literal sets it); a test io can
+        // override the bin lookup so `bin_missing` is a fixture rather than a
+        // property of the machine the suite runs on (BLI-3630).
+        io.memoryInstallDeps);
         event = memoryInstallEvent(outcome);
     }
     catch (error) {

package/dist/commands/sync.js

@@ -168,10 +168,12 @@ async function runSyncWithHealthReceipt(command, io) {
         };
     }
     try {
-        const { exitCode, failureReasons, failureRecords, notice, sessionsObserved, sessionsOutsideRoot, } = await runSyncLocked(command, io);
+        const { exitCode, failureReasons, failureRecords, notice, sessionsObserved, sessionsOutsideRoot, sessionsNewThisTick, sessionsPendingUpload, } = await runSyncLocked(command, io);
         const counts = {
             sessionsObserved,
             sessionsOutsideRoot,
+            sessionsNewThisTick,
+            sessionsPendingUpload,
         };
         if (exitCode === 0) {
             // BLI-3551: an `ok` tick can still have something to say. `nothing_in_root`
@@ -226,6 +228,8 @@ function syncResult(run) {
         notice: run.notice,
         sessionsObserved: run.sessions_observed,
         sessionsOutsideRoot: run.sessions_outside_root,
+        sessionsNewThisTick: run.sessions_new_this_tick,
+        sessionsPendingUpload: run.sessions_pending_upload,
     };
 }
 /**

package/dist/commands/team-device-reasons.js

@@ -0,0 +1,16 @@
+/**
+ * BLI-3559: the same closed reason vocabulary the dashboard's
+ * `lib/settings/device-revoke-reasons.ts` publishes, kept in this package
+ * because a CLI workspace cannot import the dashboard's app code. Five
+ * entries; keep the two lists in sync by eye if either changes.
+ */
+export const TEAM_DEVICE_REVOKE_REASON_LABELS = [
+    "stale_test_pairing",
+    "machine_retired",
+    "person_left",
+    "re_pairing",
+    "other",
+];
+export function isTeamDeviceRevokeReasonLabel(value) {
+    return TEAM_DEVICE_REVOKE_REASON_LABELS.includes(value);
+}

package/dist/commands/team.js

@@ -1,6 +1,7 @@
 /**
- * `cockpit team` — who is on the team, and the two things an admin does to it
- * (BLI-3461, decision D3: invite and role change ship in the PUBLIC build).
+ * `cockpit team` — who is on the team, and the things an admin does to it
+ * (BLI-3461, decision D3: invite and role change ship in the PUBLIC build;
+ * BLI-3559 adds `device list` / `device revoke`).
  *
  * Same shape as the rest of the CLI-parity surface: this file owns terminal
  * input and output, the dashboard owns every decision. The roster union, the
@@ -8,12 +9,16 @@
  * server-side, so a stale CLI can be wrong about wording and never about
  * permission.
  *
- * `team invite` and `team role` change what a person can do, so both are
- * deliberate: the role change asks before it acts unless `--yes` is passed, and
- * a headless run without `--yes` is refused by name rather than assumed.
+ * `team invite`, `team role` and `team device revoke` change what a person
+ * can do (or end a machine's session outright), so all three are deliberate:
+ * each asks before it acts unless `--yes` is passed, and a headless run
+ * without `--yes` is refused by name rather than assumed. `device revoke`
+ * additionally names the device it is about to revoke BEFORE asking — the
+ * same "name it, then confirm" shape `dispatchCodingTask` uses (BLI-2981) —
+ * because a revoke is irreversible for that token.
  */
 import { writeLine } from "./cli-io.js";
-import { renderTeamMembers } from "./settings-render.js";
+import { renderDeviceList, renderDeviceRevoked, renderTeamMembers } from "./settings-render.js";
 import { confirmDestructive } from "./settings.js";
 import { asRecord, callTower, openTower, writeCommandFailure, } from "./tower-command.js";
 export async function runTeam(command, io) {
@@ -22,7 +27,11 @@ export async function runTeam(command, io) {
         return showMembers(command, tower, io);
     if (command.action === "invite")
         return invite(command, tower, io);
-    return changeRole(command, tower, io);
+    if (command.action === "role")
+        return changeRole(command, tower, io);
+    if (command.action === "device-list")
+        return deviceList(command, tower, io);
+    return deviceRevoke(command, tower, io);
 }
 async function showMembers(command, tower, io) {
     const result = await callTower(tower, { path: "/api/team/members", label: "team members" });
@@ -108,4 +117,75 @@ async function changeRole(command, tower, io) {
     }
     writeLine(io.stdout, `${String(body.user_id ?? command.targetUserId)} is now ${String(body.role)}.`);
     return 0;
+}
+function devicesOf(body) {
+    return Array.isArray(body.devices) ? body.devices : [];
+}
+/** Exact device_id, or an unambiguous case-insensitive device_name match. */
+function findDevice(devices, ref) {
+    const needle = ref.trim();
+    if (!needle)
+        return null;
+    const byId = devices.find((d) => d.device_id === needle);
+    if (byId)
+        return byId;
+    const lowerNeedle = needle.toLowerCase();
+    const byName = devices.filter((d) => String(d.device_name ?? "").toLowerCase() === lowerNeedle);
+    return byName.length === 1 ? (byName[0] ?? null) : null;
+}
+async function deviceList(command, tower, io) {
+    const result = await callTower(tower, { path: "/api/team/devices", label: "team device list" });
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    for (const line of renderDeviceList(body))
+        writeLine(io.stdout, line);
+    return 0;
+}
+/**
+ * `cockpit team device revoke <id|name> --reason <label> [--note "<text>"]`
+ *
+ * Names the device it is about to revoke BEFORE asking for confirmation — the
+ * same order `dispatchCodingTask`'s approval uses — and only then sends the
+ * revoke. A revoke is irreversible for that token, so the confirmation is
+ * real: `--yes` or a person at a keyboard, nothing else (`confirmDestructive`).
+ */
+async function deviceRevoke(command, tower, io) {
+    const listed = await callTower(tower, { path: "/api/team/devices", label: "team device revoke lookup" });
+    if (!listed.ok)
+        return writeCommandFailure(io, command.json, listed);
+    const devices = devicesOf(asRecord(listed.body));
+    const device = findDevice(devices, command.deviceRef ?? "");
+    if (!device) {
+        return writeCommandFailure(io, command.json, {
+            reason: "device_not_found",
+            detail: `No device matches "${String(command.deviceRef)}". Run "cockpit team device list" to see ids and names.`,
+        });
+    }
+    const confirmed = await confirmDestructive(command, io, `Revoke ${String(device.device_name ?? device.device_id)} (${device.device_id})? This cannot be undone. [Y/n] `, "team device revoke");
+    if (!confirmed.ok)
+        return writeCommandFailure(io, command.json, confirmed);
+    const result = await callTower(tower, {
+        path: `/api/ambient/devices/${encodeURIComponent(device.device_id)}/revoke`,
+        method: "POST",
+        label: "team device revoke",
+        body: { reason_label: command.reasonLabel, reason_note: command.reasonNote },
+    });
+    writeLine(io.stderr, `[team cli] device revoke ${JSON.stringify({
+        reason_label: command.reasonLabel,
+        outcome: result.ok ? "revoked" : result.reason,
+    })}`);
+    if (!result.ok)
+        return writeCommandFailure(io, command.json, result);
+    const body = asRecord(result.body);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, ...body }));
+        return 0;
+    }
+    writeLine(io.stdout, renderDeviceRevoked(body));
+    return 0;
 }