@botiverse/testbed-cli 0.6.0 → 0.7.0

package/lib/main.mjs

@@ -67,6 +67,24 @@ export const USAGE = `testbed — cloud phones + the acceptance testbed in the R
   testbed bed llm diagnostic --correlation ID
                                          provider LLM authority preflight / diagnostic (exe.dev integrations)
 
+  testbed pve facts --purpose P          macOS VM (PVE VM130) bridge facts: guest agent, os, baseline revision
+  testbed pve acquire --purpose P [--ttl SEC] [--request-id ID]
+                                         lease the macOS VM (one active lease; ttl 60..3600, default 3600)
+  testbed pve status <lease-id> --epoch N --purpose P
+                                         the adapter's own lease state (independent readback)
+  testbed pve renew <lease-id> --epoch N --purpose P [--ttl SEC] [--request-id ID]
+  testbed pve exec <lease-id> --epoch N --purpose P --argv JSON [--timeout SEC]
+  testbed pve put <lease-id> --epoch N --purpose P --path /remote/file --file LOCAL [--timeout SEC]
+                                         file of at most 15,722,496 bytes (just under 15 MiB; the adapter caps the whole request at 20 MiB)
+  testbed pve get <lease-id> --epoch N --purpose P --path /remote/file [--out LOCAL] [--timeout SEC]
+  testbed pve reboot <lease-id> --epoch N --purpose P [--request-id ID]
+  testbed pve rollback <lease-id> --epoch N --purpose P [--request-id ID]
+                                         restore the baseline snapshot (everything after it is discarded)
+  testbed pve release <lease-id> --epoch N --purpose P [--request-id ID]
+                                         end the lease; the adapter ALSO rolls back to baseline
+  testbed pve reap --purpose P [--request-id ID]
+                                         reclaim expired leases
+
   testbed skill                          print the agent skill (SKILL.md)
   testbed skill --install [-a AGENT...] [--global]
                                          install for any runtime via "npx skills add" (Claude Code, Codex, Cursor, Gemini, OpenCode, ...)
@@ -268,7 +286,7 @@ export async function main(argv, opts) {
         const num = (flag, text) => (text === undefined ? undefined : Number(text));
         const reqId = () => takeFlag(args, "request-id") ?? `testbed-cli-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
         const bedLine = (b) => `bed ${b.id} — ${b.state}${b.provider_bed_id ? ` (${b.provider} ${b.provider_bed_id})` : ""}${b.expires_at ? `, expires ${new Date(b.expires_at).toISOString().slice(0, 16)}` : ""}`;
-        const opLine = (d, verb) => out(`${verb} ${d.bed?.id ?? d.bed_id ?? ""}: ${d.outcome?.outcome ?? d.operation?.state ?? (d.ok ? "ok" : "failed")}${d.error?.code ? ` (${d.error.code})` : ""}${d.idempotent ? " [idempotent]" : ""}`);
+        const opLine = (d, verb) => out(`${verb} ${d.bed?.id ?? d.bed_id ?? d.outcome?.bed ?? ""}: ${d.outcome?.outcome ?? d.operation?.state ?? (d.ok ? "ok" : "failed")}${d.error?.code ? ` (${d.error.code})` : ""}${d.idempotent ? " [idempotent]" : ""}`);
         switch (sub) {
           case "provision": {
             const ttl = takeFlag(args, "ttl"); const template = takeFlag(args, "template"); const spec = parseJson("spec", takeFlag(args, "spec"));
@@ -430,6 +448,98 @@ export async function main(argv, opts) {
             throw new Error("usage: testbed bed provision|list|get|cleanup|residue|recover|reconcile|round|report|retention|template|collab|exec|diagnose|llm …");
         }
       }
+      case "pve": {
+        // macOS VM lease on Proxmox (VM130) through the Worker's pve-macos
+        // routes (task #42, replaces PR #114). Same rule as beds: CLI only,
+        // nothing in the manifest. The Worker signs every adapter call with
+        // its own credential; the agent never sees the bridge, its token or
+        // a host command. `--purpose` is explicit on every call because the
+        // provider gate is purpose-based (quarantine accepts exactly one).
+        const sub = args.shift();
+        const base = "/pve-macos";
+        const parseJson = (flag, text) => {
+          if (text === undefined) return undefined;
+          try { return JSON.parse(text); } catch { throw new Error(`--${flag} must be valid JSON`); }
+        };
+        const num = (flag, text) => (text === undefined ? undefined : Number(text));
+        const reqId = () => takeFlag(args, "request-id") ?? `testbed-cli-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+        const purpose = () => { const p = takeFlag(args, "purpose"); if (!p) throw new Error(`usage: testbed pve ${sub} … --purpose P (required; the provider gate is purpose-based)`); return p; };
+        const leaseRef = (usage) => {
+          const id = args[0]; const epoch = takeFlag(args, "epoch");
+          if (!id || epoch === undefined) throw new Error(usage);
+          args.shift();
+          return { lease_id: id, epoch: Number(epoch) };
+        };
+        const leaseLine = (l) => (l ? `lease ${l.lease_id} epoch ${l.epoch} — ${l.state}${l.resource_id ? ` on ${l.resource_id}` : ""}${l.expires_at ? `, expires ${l.expires_at}` : ""}` : "");
+        const q = (obj) => "?" + Object.entries(obj).filter(([, v]) => v !== undefined).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`).join("&");
+        switch (sub) {
+          case "facts": {
+            const d = await api("GET", `${base}/facts${q({ purpose: purpose() })}`);
+            emit(d, () => out(`${d.resource_id ?? "vm"}: ${d.os ?? "?"} ${d.arch ?? ""} guest_agent=${d.guest_agent ?? "?"} baseline=${d.baseline_revision ?? "?"}${d.boot_id ? ` boot=${d.boot_id}` : ""}`));
+            return exit(0);
+          }
+          case "acquire": {
+            const ttl = takeFlag(args, "ttl");
+            const body = { purpose: purpose(), ttl_seconds: num("ttl", ttl), request_id: reqId() };
+            const d = await api("POST", `${base}/acquire`, body);
+            emit(d, () => out(leaseLine(d.lease ?? d)));
+            return exit(0);
+          }
+          case "status": {
+            const ref = leaseRef("usage: testbed pve status <lease-id> --epoch N --purpose P");
+            const d = await api("GET", `${base}/lease-status${q({ lease_id: ref.lease_id, epoch: ref.epoch, purpose: purpose() })}`);
+            emit(d, () => out(leaseLine(d.lease ?? d)));
+            return exit(0);
+          }
+          case "renew": {
+            const ref = leaseRef("usage: testbed pve renew <lease-id> --epoch N --purpose P [--ttl SEC]");
+            const ttl = takeFlag(args, "ttl");
+            const d = await api("POST", `${base}/renew`, { purpose: purpose(), ...ref, ttl_seconds: num("ttl", ttl), request_id: reqId() });
+            emit(d, () => out(leaseLine(d.lease ?? d)));
+            return exit(0);
+          }
+          case "exec": {
+            const ref = leaseRef("usage: testbed pve exec <lease-id> --epoch N --purpose P --argv JSON [--timeout SEC]");
+            const argv = parseJson("argv", takeFlag(args, "argv")); const timeout = takeFlag(args, "timeout");
+            if (!Array.isArray(argv) || argv.length === 0) throw new Error("--argv must be a non-empty JSON array of strings");
+            const d = await api("POST", `${base}/exec`, { purpose: purpose(), ...ref, argv, timeout_seconds: num("timeout", timeout), request_id: reqId() });
+            emit(d, () => { if (d.stdout) out(d.stdout.replace(/\n$/, "")); if (d.stderr) err(d.stderr.replace(/\n$/, "")); out(`exit ${d.exit_code}${d.timed_out ? " (timed out)" : ""}`); });
+            return exit(typeof d.exit_code === "number" && d.exit_code !== 0 ? 1 : 0);
+          }
+          case "put": {
+            const ref = leaseRef("usage: testbed pve put <lease-id> --epoch N --purpose P --path /remote/file --file LOCAL [--timeout SEC]");
+            const remote = takeFlag(args, "path"); const file = takeFlag(args, "file"); const timeout = takeFlag(args, "timeout");
+            if (!remote || !file) throw new Error("usage: testbed pve put <lease-id> --epoch N --purpose P --path /remote/file --file LOCAL");
+            const data = readFileSync(file);
+            const d = await api("POST", `${base}/put`, { purpose: purpose(), ...ref, path: remote, data_base64: data.toString("base64"), timeout_seconds: num("timeout", timeout), request_id: reqId() });
+            emit(d, () => out(`put ${remote}: ${data.length} bytes${d.sha256 ? ` sha256=${d.sha256}` : ""}`));
+            return exit(0);
+          }
+          case "get": {
+            const ref = leaseRef("usage: testbed pve get <lease-id> --epoch N --purpose P --path /remote/file [--out LOCAL] [--timeout SEC]");
+            const remote = takeFlag(args, "path"); const outFile = takeFlag(args, "out"); const timeout = takeFlag(args, "timeout");
+            if (!remote) throw new Error("usage: testbed pve get <lease-id> --epoch N --purpose P --path /remote/file [--out LOCAL]");
+            const d = await api("POST", `${base}/get`, { purpose: purpose(), ...ref, path: remote, timeout_seconds: num("timeout", timeout), request_id: reqId() });
+            const bytes = Buffer.from(d.data ?? "", "base64");
+            if (outFile) { writeFileSync(outFile, bytes); emit(d, () => out(`get ${remote}: ${bytes.length} bytes → ${outFile}${d.sha256 ? ` sha256=${d.sha256}` : ""}`)); }
+            else emit(d, () => out(bytes.toString("utf8")));
+            return exit(0);
+          }
+          case "reboot": case "rollback": case "release": {
+            const ref = leaseRef(`usage: testbed pve ${sub} <lease-id> --epoch N --purpose P`);
+            const d = await api("POST", `${base}/${sub}`, { purpose: purpose(), ...ref, request_id: reqId() });
+            emit(d, () => out(`${sub} ${ref.lease_id} epoch ${ref.epoch}: ${d.ok === false ? "failed" : "ok"}${d.lease?.state ? ` (${d.lease.state})` : ""}`));
+            return exit(d.ok === false ? 1 : 0);
+          }
+          case "reap": {
+            const d = await api("POST", `${base}/reap-expired`, { purpose: purpose(), request_id: reqId() });
+            emit(d, () => out(`reap-expired: ${d.reaped ?? d.count ?? "ok"}`));
+            return exit(0);
+          }
+          default:
+            throw new Error("usage: testbed pve facts|acquire|status|renew|exec|put|get|reboot|rollback|release|reap …");
+        }
+      }
       case "verify": {
         const sub = args.shift();
         const vs = (id) => `/verify-sessions/${encodeURIComponent(id)}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botiverse/testbed-cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "CLI for testbed \u2014 cloud phones and the acceptance testbed in the Raft release loop",
   "license": "MIT",
   "type": "module",

package/skills/testbed/SKILL.md

@@ -86,6 +86,22 @@ testbed bed cleanup <bed-id>                                  # destroy; then `b
 ```
 Rules: always `cleanup` what you `provision` (TTL is a backstop, not a plan); `residue` is the proof, not the destroy call; `--request-id` makes provision/round/exec/collab idempotent on retry; reports, retention and templates exist for evidence handling and are documented in `testbed bed --help`.
 
+## macOS VM (PVE VM130 lease)
+
+One macOS VM on Proxmox, leased through the testbed; the Worker signs every adapter call with its own credential, so you never see the bridge, its token or a host command. Everything is `testbed pve …`; the manifest advertises nothing for it. `--purpose` is required on every call: while the provider is in quarantine the only accepted value is `task-9-universal-lease-v0.1-acceptance`.
+
+```bash
+P=task-9-universal-lease-v0.1-acceptance
+testbed pve facts --purpose $P                                  # guest agent, os, baseline revision
+testbed pve acquire --purpose $P --ttl 3600                     # → lease id + epoch (one active lease)
+testbed pve status <lease-id> --epoch N --purpose $P            # the adapter's own view, not the Worker's
+testbed pve exec <lease-id> --epoch N --purpose $P --argv '["uname","-a"]'
+testbed pve put <lease-id> --epoch N --purpose $P --path /tmp/x --file ./x
+testbed pve get <lease-id> --epoch N --purpose $P --path /tmp/x --out ./x.back
+testbed pve release <lease-id> --epoch N --purpose $P           # ends the lease AND rolls back to baseline
+```
+Rules: `put` carries at most 15,722,496 bytes per file (just under 15 MiB: the adapter caps the whole request, data base64-encoded plus metadata, at 20 MiB; the Worker refuses larger requests with 413 before sending). TTL is 60..3600 s. `release` and `rollback` restore the baseline snapshot, so anything written after it is gone — copy out what you need first. Wrong owner/epoch/expired are typed refusals from the adapter, relayed verbatim. `--request-id` makes acquire/renew/exec/put/reboot/rollback/release idempotent on retry.
+
 ## Errors
 
 - `401` → `testbed login` (agent) or check `TESTBED_TOKEN` (human/CI).