@catalyst-cloud/cli 0.16.23 → 0.16.25

package/dist/onboard-runner.js

@@ -20,19 +20,21 @@ import { onboardStateRoot, } from "./onboard.js";
 /** The Compose project name the vendored file declares. */
 export const RUNNER_PROJECT = "catalyst-host";
 export const RUNNER_SESSION_NETWORK = "catalyst-session-v1";
-/** Catalyst's approved host release, generation 2 (hr-a19f7b0859a98147-9a96426c93e32173-63a9b20c3be3dc3e):
- * runner, supervisor and watchdog all built from catalyst-cloud 2ec4a551. A machine set up from these
+/** Catalyst's approved host release, generation 48 (hr-598fd0ef2675bfd8-69310962e37ad7f2-2d264b793edb843e):
+ * the runner built from catalyst-cloud caf921a4, the supervisor and watchdog from a4165555, the
+ * first supervisor that serves several teams (CTC-4455). A machine set up from these
  * pins then follows newer approved releases itself (`catalyst runner update`, CTC-4646).
  * Explicit environment values override these pins; a saved runner image is preserved. */
 export const RUNNER_HOST_IMAGES = {
-    supervisor: "ghcr.io/coalesce-labs/catalyst-supervisor@sha256:9a96426c93e32173a67e849aa5a462e9f5466b872e4117f9a8a7df1972b2a136",
-    watchdog: "ghcr.io/coalesce-labs/catalyst-deadline-watchdog@sha256:63a9b20c3be3dc3ea328d77aa68dece942a40be46cb3126d9a7868e082828feb",
-    runner: "ghcr.io/coalesce-labs/catalyst-runner@sha256:a19f7b0859a9814740935f7aadd8fe5c5c9c5974f9a5956a057b983ada16ea01",
+    supervisor: "ghcr.io/coalesce-labs/catalyst-supervisor@sha256:69310962e37ad7f21ccab5c131b0734f106a6b0cc9fb163cb5d8917c9d7a2fc1",
+    watchdog: "ghcr.io/coalesce-labs/catalyst-deadline-watchdog@sha256:2d264b793edb843e47b4c5a86fa6133dd2bd0b5ecdc0b7e997368893de074b28",
+    runner: "ghcr.io/coalesce-labs/catalyst-runner@sha256:598fd0ef2675bfd8e0665f70ef4ed8bf30706fba25fa2c39fc0df0801512a423",
 };
 export const IMAGE_REF = /^[a-z0-9][a-z0-9._:/-]{0,255}@sha256:[0-9a-f]{64}$/;
 const HOST_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/;
 const JOIN_TOKEN = /^[A-Za-z0-9._~+/=-]{16,1024}$/;
-const ENROLLMENTS = "/api/v1/hosts/enrollments";
+const HOSTS = "/api/v1/hosts";
+const ENROLLMENTS = `${HOSTS}/enrollments`;
 const JOIN_TOKENS = "/api/v1/hosts/join-tokens";
 const CAPACITY = "/api/v1/me/runner-capacity";
 const RUNNER_UID = "10001:10001";
@@ -549,6 +551,7 @@ export function dockerRunnerEngine(deps = {}) {
         },
     };
 }
+const serves = (host, teamKey) => host.teams.includes(teamKey);
 const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
     ? value
     : null;
@@ -565,6 +568,8 @@ function parseHosts(body) {
             typeof host.hostId !== "string" ||
             typeof host.hostName !== "string" ||
             typeof host.team !== "string" ||
+            (host.teams !== undefined &&
+                (!Array.isArray(host.teams) || !host.teams.every((team) => typeof team === "string"))) ||
             !(host.revokedAtMs === null || typeof host.revokedAtMs === "number") ||
             (host.capability !== null &&
                 (!capability ||
@@ -578,6 +583,9 @@ function parseHosts(body) {
             hostId: host.hostId,
             hostName: host.hostName,
             team: host.team,
+            teams: Array.isArray(host.teams) && host.teams.includes(host.team)
+                ? host.teams
+                : [host.team],
             revoked: host.revokedAtMs !== null,
             capacity: capability ? capability.runtimeLive
                 ? capability.placeableCapacity
@@ -755,8 +763,8 @@ export function onboardRunnerAdapter(input = {}) {
         const teamKey = teamId ? await liveTeamKey(ctx, teamId, signal ?? new AbortController().signal) : null;
         if (!teamId || !teamKey)
             return waiting("runner_context_unverified", selected);
-        if (credential && !isUnenrolled(credential) && credential.team !== teamKey)
-            return waiting("runner_enrolled_for_other_team", selected);
+        // An installation enrolled for another team serves this one too once setup adds it (CTC-4455).
+        const otherTeamHost = credential && !isUnenrolled(credential) && credential.team !== teamKey ? credential.hostId : undefined;
         const runnerSupport = await verifyRunnerRoutes(ctx, journal, [{ method: "GET", path: "/api/v1/agent/runner-admission" }], signal);
         if ("reason" in runnerSupport && runnerSupport.reason !== "cloud_capability_unavailable")
             return waiting(runnerSupport.reason, selected);
@@ -773,7 +781,8 @@ export function onboardRunnerAdapter(input = {}) {
             return waiting("runner_native_egress_setup_required", selected);
         return { account, baseUrl: normalizeBaseUrl(cfg.baseUrl), teamKey, teamId, cloud, dir, info, images,
             ...(installation && installation !== "missing" ? { installedName: installation.hostName,
-                installedSupervisorImage: installation.supervisorImage } : {}) };
+                installedSupervisorImage: installation.supervisorImage } : {}),
+            ...(otherTeamHost ? { otherTeamHost } : {}) };
     }
     async function desiredEnv(p, ctx, joinToken) {
         const saved = readEnvFile(join(p.dir, ".env")) ?? {};
@@ -857,6 +866,58 @@ export function onboardRunnerAdapter(input = {}) {
             return waiting(signal?.aborted ? "interrupted" : "runner_join_token_unavailable", selected);
         }
     }
+    /**
+     * CTC-4455: adds the selected team to this machine's enrollment. The cloud refuses until the
+     * machine's supervisor advertises that it serves a set of teams. Before setup starts the new
+     * supervisor that refusal is `deferred`; after, it is retried for as long as setup waits for the
+     * supervisor. An older cloud without the route answers 404, and setup refuses as it used to.
+     */
+    async function addTeam(ctx, p, hostId, retry, signal) {
+        const evidence = { ...selected, hostId };
+        const cfg = loadConfig(ctx.home);
+        const expiry = cfg?.auth ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime() : 0;
+        const bearer = cfg?.key ||
+            (cfg?.auth && Number.isFinite(expiry) && expiry > 30_000 ? cfg.auth.accessToken : undefined);
+        if (!bearer)
+            return waiting("runner_login_refresh_required", evidence);
+        for (let attempt = 1;; attempt++) {
+            let status;
+            let body;
+            try {
+                const response = await ctx.fetch(`${p.baseUrl}${HOSTS}/${encodeURIComponent(hostId)}/teams?account=${encodeURIComponent(p.account)}`, {
+                    method: "POST",
+                    redirect: "error",
+                    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(30_000)]) : AbortSignal.timeout(30_000),
+                    headers: {
+                        authorization: `Bearer ${bearer}`,
+                        "content-type": "application/json",
+                        accept: "application/json",
+                    },
+                    body: JSON.stringify({ version: 1, team: p.teamKey }),
+                });
+                status = response.status;
+                body = object(await response.json().catch(() => null));
+            }
+            catch {
+                return waiting(signal?.aborted ? "interrupted" : "runner_team_add_failed", evidence);
+            }
+            if (status === 200 && body?.ok === true && Array.isArray(body.teams) && body.teams.includes(p.teamKey))
+                return true;
+            if (status === 404 && body?.error !== "unknown_host")
+                return waiting("runner_enrolled_for_other_team", evidence);
+            if (status === 401 || status === 403)
+                return waiting("runner_identity_unverified", evidence);
+            if (body?.error === "team_limit")
+                return waiting("runner_team_limit", evidence);
+            if (body?.error !== "supervisor_outdated")
+                return waiting("runner_team_add_failed", evidence);
+            if (!retry)
+                return "deferred";
+            if (attempt >= Math.max(1, Math.ceil(waitMs / pollMs)) || signal?.aborted)
+                return waiting("runner_supervisor_outdated", evidence);
+            await sleep(pollMs);
+        }
+    }
     function orgKeyFromFile(ctx) {
         const path = ctx.env.CATALYST_RUNNER_ORG_KEY_FILE;
         if (!path)
@@ -887,13 +948,13 @@ export function onboardRunnerAdapter(input = {}) {
             if (p.info.vm && persistedCustody(p.dir, saved) !== "installed")
                 return mayAct && !afterAct ? { state: "pending" } : waiting(mayAct ? "runner_thoughts_custody_unavailable" : "runner_needs_runner_flag", { ...selected, hostName: name });
             let enrolled = null;
-            const live = (hosts) => hosts?.find((host) => host.hostId === enrolled?.hostId && host.team === p.teamKey && !host.revoked);
+            const live = (hosts) => hosts?.find((host) => host.hostId === enrolled?.hostId && serves(host, p.teamKey) && !host.revoked);
             let hosts = await listHosts(ctx, p, signal);
             if (!hosts)
                 return waiting("runner_enrollment_unavailable", selected);
             const existingCredential = await engine.enrollment(p.dir, signal);
             if ((!existingCredential || isUnenrolled(existingCredential)) &&
-                hosts.some((host) => host.hostName === name && !host.revoked && host.team !== p.teamKey))
+                hosts.some((host) => host.hostName === name && !host.revoked && !serves(host, p.teamKey)))
                 return waiting("runner_enrolled_for_other_team", {
                     ...selected,
                     hostName: name,
@@ -902,8 +963,11 @@ export function onboardRunnerAdapter(input = {}) {
                 !isUnenrolled(existingCredential) &&
                 hosts.some((host) => host.hostId === existingCredential.hostId &&
                     !host.revoked &&
-                    host.team !== p.teamKey))
-                return waiting("runner_enrolled_for_other_team", { ...selected, hostName: name });
+                    !serves(host, p.teamKey)))
+                // CTC-4455: setup's act adds the selected team to a runner enrolled for another one.
+                return mayAct && !afterAct
+                    ? { state: "pending" }
+                    : waiting(mayAct ? "runner_team_not_added" : "runner_needs_runner_flag", { ...selected, hostName: name });
             const running = await engine.composeRunning(p.dir, signal);
             let composeMatches = false;
             try {
@@ -931,13 +995,11 @@ export function onboardRunnerAdapter(input = {}) {
                     return waiting("runner_enrollment_unavailable", hostEvidence);
                 if (enrolled && (enrolled.tenant !== p.account || enrolled.enrollmentKind !== "self_hosted"))
                     return waiting("runner_identity_unverified", hostEvidence);
-                if (enrolled && enrolled.team !== p.teamKey)
-                    return waiting("runner_enrolled_for_other_team", hostEvidence);
                 if (enrolled) {
                     const exact = hosts.find((host) => host.hostId === enrolled.hostId);
                     if (exact?.revoked)
                         return waiting("runner_enrollment_revoked", { ...hostEvidence, hostId: enrolled.hostId });
-                    if (!exact || exact.team !== p.teamKey)
+                    if (!exact || !serves(exact, p.teamKey))
                         return waiting("runner_enrollment_unverified", hostEvidence);
                 }
                 const host = live(hosts);
@@ -986,6 +1048,23 @@ export function onboardRunnerAdapter(input = {}) {
                 return p;
             if (!mayAct)
                 return waiting("runner_needs_runner_flag", selected);
+            // Settle a team the installed runner does not serve before anything on this machine changes.
+            let addTeamTo = null;
+            if (p.otherTeamHost) {
+                const hosts = await listHosts(ctx, p, signal);
+                if (!hosts)
+                    return waiting("runner_enrollment_unavailable", selected);
+                const exact = hosts.find((host) => host.hostId === p.otherTeamHost && !host.revoked);
+                if (!exact)
+                    return waiting("runner_enrolled_for_other_team", selected);
+                if (!serves(exact, p.teamKey)) {
+                    const added = await addTeam(ctx, p, exact.hostId, false, signal);
+                    if (added === "deferred")
+                        addTeamTo = exact.hostId;
+                    else if (added !== true)
+                        return added;
+                }
+            }
             let replacingContainers = false;
             try {
                 mkdirSync(p.dir, { recursive: true, mode: 0o700 });
@@ -1104,20 +1183,25 @@ export function onboardRunnerAdapter(input = {}) {
             if (!hosts)
                 return waiting("runner_enrollment_unavailable", selected);
             if (!enrolled &&
-                hosts.some((host) => host.hostName === name && !host.revoked && host.team !== p.teamKey))
+                hosts.some((host) => host.hostName === name && !host.revoked && !serves(host, p.teamKey)))
                 return waiting("runner_enrolled_for_other_team", { ...selected, hostName: name });
             if (enrolled && (enrolled.tenant !== p.account || enrolled.enrollmentKind !== "self_hosted"))
                 return waiting("runner_identity_unverified", { ...selected, hostName: name });
-            if (enrolled && enrolled.team !== p.teamKey)
-                return waiting("runner_enrolled_for_other_team", { ...selected, hostName: name });
             if (hasCredential && !isUnenrolled(credential)) {
                 if (!enrolled)
                     return waiting("runner_credential_unverified", { ...selected, hostName: name });
                 const exact = hosts.find((host) => host.hostId === enrolled.hostId);
                 if (exact?.revoked)
                     return waiting("runner_enrollment_revoked", { ...selected, hostName: name, hostId: enrolled.hostId });
-                if (!exact || exact.team !== p.teamKey)
+                if (!exact)
                     return waiting("runner_enrollment_unverified", { ...selected, hostName: name });
+                if (!serves(exact, p.teamKey) && addTeamTo === null) {
+                    const added = await addTeam(ctx, p, exact.hostId, false, signal);
+                    if (added === "deferred")
+                        addTeamTo = exact.hostId;
+                    else if (added !== true)
+                        return added;
+                }
             }
             // A lost volume also lost the secret that redeemed the old token. Mint a new token and match
             // the new host id from the supervisor's credential, never an old advertisement with this name.
@@ -1184,6 +1268,14 @@ export function onboardRunnerAdapter(input = {}) {
             if (!up.ok)
                 return { state: "failed", reason: "runner_compose_failed", evidence: { ...selected,
                         project: RUNNER_PROJECT, ...(up.error ? { composeError: up.error } : {}) } };
+            // The supervisor just started can serve a set of teams; the cloud accepts the team once it says so.
+            if (addTeamTo) {
+                const added = await addTeam(ctx, p, addTeamTo, true, signal);
+                if (added === "deferred")
+                    return waiting("runner_supervisor_outdated", selected);
+                if (added !== true)
+                    return added;
+            }
             acted = true;
             if (input.autoUpdate) {
                 try {

package/dist/prompt.js

@@ -1,10 +1,23 @@
-// prompt.ts — the one interactive read in the CLI: asking for the personal key on a terminal without
-// echoing it. The streams are parameters so the tests can drive it without a real TTY.
+// prompt.ts — the CLI's interactive reads: asking for the personal key on a terminal without
+// echoing it, and one [y/N] question. The streams are parameters so the tests can drive it without a real TTY.
 import { createInterface } from "node:readline";
+import { createInterface as createPromiseInterface } from "node:readline/promises";
 /** True when there is a terminal to prompt on. Both ends matter: the question needs somewhere to go. */
 export function stdinIsTty() {
     return Boolean(process.stdin.isTTY && process.stdout.isTTY);
 }
+/** Ask a `[y/N]` question on stderr and read the answer. False without a terminal, and for anything but y/yes. */
+export async function confirmYesNo(question) {
+    if (!stdinIsTty())
+        return false;
+    const prompt = createPromiseInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return /^(y|yes)$/i.test((await prompt.question(question)).trim());
+    }
+    finally {
+        prompt.close();
+    }
+}
 /**
  * Read one line without echoing it. Everything readline would write after the question itself goes
  * to a muted stream, so the key never reaches the screen or a scrollback buffer; the caller still

package/dist/runner-command.js

@@ -3,7 +3,8 @@ import { flagBool, flagString, positionals } from "./args.js";
 import { UsageError } from "./errors.js";
 import { autoUpdateStatus, disableAutoUpdate, enableAutoUpdate, scheduledPath, } from "./runner-auto-update.js";
 import { dockerRunnerUpdateEngine, readReleaseState, runnerDir, runRunnerUpdate, updateResultLines, } from "./runner-update.js";
-const USAGE = "catalyst runner update [--check] [--dir <runner directory>] | runner auto-update [status|on|off]";
+import { dockerFleetUpdateEngine, runFleetUpdate } from "./runner-update-fleet.js";
+const USAGE = "catalyst runner update [--check] [--dir <runner directory>] [--fleet] | runner auto-update [status|on|off]";
 function schedulerDeps(ctx, deps) {
     const cli = deps.scheduler?.cli ?? resolve(process.argv[1] ?? "catalyst");
     return {
@@ -47,8 +48,12 @@ export async function cmdRunner(args, ctx, deps = {}) {
     if (action === "update" && parts.length === 1) {
         const check = flagBool(args, "check");
         const auto = flagBool(args, "auto");
-        const engine = deps.engine ?? dockerRunnerUpdateEngine({ env: ctx.env });
-        const result = await runRunnerUpdate(engine, { dir: dir(), check });
+        const fleet = flagBool(args, "fleet");
+        if (fleet && dirFlag === undefined)
+            throw new UsageError("--fleet needs --dir, the directory that holds compose.json");
+        const result = fleet
+            ? await runFleetUpdate(deps.fleetEngine ?? dockerFleetUpdateEngine({ env: ctx.env }), { dir: dir(), check })
+            : await runRunnerUpdate(deps.engine ?? dockerRunnerUpdateEngine({ env: ctx.env }), { dir: dir(), check });
         if (args.json)
             ctx.stdout(JSON.stringify(result));
         else if (auto)