@nosana/node 1.1.62-rc → 1.1.64-rc

package/dist/src/NodeManager/provider/containerOrchestration/labels.js

@@ -0,0 +1,12 @@
+/**
+ * Labels the node stamps on the containers it runs, so they can be found
+ * again through the runtime instead of by name.
+ */
+export const JOB_LABEL = 'com.nosana.job';
+export const OP_LABEL = 'com.nosana.op';
+export const OP_INDEX_LABEL = 'com.nosana.opIndex';
+export const SERVICE_LABEL = 'com.nosana.service';
+/** Job and operation ids become container names and label values. */
+export function isSafeIdentifier(value) {
+    return /^[A-Za-z0-9._:-]+$/.test(value);
+}

package/dist/src/NodeManager/provider/containerOrchestration/podman/index.js

@@ -59,20 +59,25 @@ export class PodmanContainerOrchestration extends DockerContainerOrchestration {
                 });
                 if (create.status === 201) {
                     const createResult = await create.json();
-                    const start = await this.libPodAPICall(`/containers/${createResult.Id}/start`, {
-                        method: 'POST',
-                    });
-                    if (start.status === 204) {
-                        const container = this.docker.getContainer(createResult.Id);
-                        return container;
+                    const container = this.docker.getContainer(createResult.Id);
+                    try {
+                        if (args.beforeStart)
+                            await args.beforeStart(container);
+                        const start = await this.libPodAPICall(`/containers/${createResult.Id}/start`, {
+                            method: 'POST',
+                        });
+                        if (start.status !== 204) {
+                            const message = (await start.json()).message;
+                            throw new Error('Cannot start container: ' + message);
+                        }
                     }
-                    else {
-                        const message = (await start.json()).message;
+                    catch (error) {
                         // A created container holds its name whether it ran or not, and
                         // nothing else can take that name until it is gone.
                         await this.stopAndDeleteContainer(createResult.Id);
-                        throw new Error('Cannot start container: ' + message);
+                        throw error;
                     }
+                    return container;
                 }
                 error = await create.json();
                 if (error.message !== `${image}: image not known`)

package/dist/src/NodeManager/provider/containerOrchestration/podman/utils/createPodmanRunOptions.d.ts

@@ -7,6 +7,12 @@ import type { RunContainerArgs } from '../../interface.js';
  * @returns
  */
 export declare function createPodmanRunOptions(image: string, args: RunContainerArgs, gpuOption: string): {
+    resource_limits?: {
+        pids: {
+            limit: number;
+        };
+    } | undefined;
+    cap_drop?: string[] | undefined;
     hostadd: string[];
     netns: {
         nsmode: string;
@@ -32,12 +38,25 @@ export declare function createPodmanRunOptions(image: string, args: RunContainer
     image: string;
     name: string | undefined;
     command: string[] | undefined;
+    labels: Record<string, string> | undefined;
     volumes: {
         dest: string;
         name: string;
         Options: string[];
     }[] | undefined;
+    mounts: {
+        type: string;
+        source: string;
+        destination: string;
+        options: string[];
+    }[] | undefined;
 } | {
+    resource_limits?: {
+        pids: {
+            limit: number;
+        };
+    } | undefined;
+    cap_drop?: string[] | undefined;
     hostadd: string[];
     netns: {
         nsmode: string;
@@ -64,12 +83,25 @@ export declare function createPodmanRunOptions(image: string, args: RunContainer
     image: string;
     name: string | undefined;
     command: string[] | undefined;
+    labels: Record<string, string> | undefined;
     volumes: {
         dest: string;
         name: string;
         Options: string[];
     }[] | undefined;
+    mounts: {
+        type: string;
+        source: string;
+        destination: string;
+        options: string[];
+    }[] | undefined;
 } | {
+    resource_limits?: {
+        pids: {
+            limit: number;
+        };
+    } | undefined;
+    cap_drop?: string[] | undefined;
     hostadd: string[];
     netns: {
         nsmode: string;
@@ -95,9 +127,16 @@ export declare function createPodmanRunOptions(image: string, args: RunContainer
     image: string;
     name: string | undefined;
     command: string[] | undefined;
+    labels: Record<string, string> | undefined;
     volumes: {
         dest: string;
         name: string;
         Options: string[];
     }[] | undefined;
+    mounts: {
+        type: string;
+        source: string;
+        destination: string;
+        options: string[];
+    }[] | undefined;
 };

package/dist/src/NodeManager/provider/containerOrchestration/podman/utils/createPodmanRunOptions.js

@@ -24,7 +24,7 @@ function parseRestartPolicy(restart_policy) {
  * @returns
  */
 export function createPodmanRunOptions(image, args, gpuOption) {
-    const { name, cmd, gpu, volumes, env, aliases, work_dir, entrypoint, restart_policy, runtime, } = args;
+    const { name, cmd, gpu, volumes, env, aliases, work_dir, entrypoint, restart_policy, labels, security, runtime, } = args;
     const devices = gpu
         ? gpuOption === 'all'
             ? [
@@ -41,13 +41,22 @@ export function createPodmanRunOptions(image, args, gpuOption) {
         image,
         name,
         command: cmd,
-        volumes: volumes?.map((v) => {
+        labels,
+        volumes: volumes?.filter((v) => v.type !== 'bind').map((v) => {
             return {
                 dest: v.dest,
                 name: v.name,
                 Options: v.readonly ? ['ro'] : [],
             };
         }),
+        mounts: volumes?.filter((v) => v.type === 'bind').map((v) => {
+            return {
+                type: 'bind',
+                source: v.name,
+                destination: v.dest,
+                options: v.readonly ? ['ro'] : [],
+            };
+        }),
         ...(entrypoint
             ? { entrypoint: ifStringCastToArray(entrypoint) }
             : undefined),
@@ -65,5 +74,10 @@ export function createPodmanRunOptions(image, args, gpuOption) {
         create_working_dir: true,
         cgroups_mode: 'enabled',
         work_dir,
+        ...(security?.capDrop ? { cap_drop: security.capDrop } : {}),
+        // libpod takes limits under resource_limits; a top-level key is ignored.
+        ...(security?.pidsLimit
+            ? { resource_limits: { pids: { limit: security.pidsLimit } } }
+            : {}),
     };
 }

package/dist/src/NodeManager/provider/sshSidecar.d.ts

@@ -0,0 +1,66 @@
+/// <reference types="node" />
+/// <reference types="node" />
+import type { JobDefinition } from '@nosana/sdk';
+import type { Container } from 'dockerode';
+import type { SshKeyGrant } from '../db/index.js';
+import type { RunContainerArgs } from './containerOrchestration/interface.js';
+/** Marks an operation's frpc sidecar that also runs sshgw. */
+export declare const SSH_SIDECAR_SERVICE = "ssh-sidecar";
+/** The only user name sshgw accepts; the hostname identifies the job. Shared with the client through @nosana/ssh. */
+export declare const SSH_SIDECAR_USER = "nosana";
+export declare const SSH_SIDECAR_KEYS_DIR = "/nosana-ssh";
+/** Runtime label filters that select the running SSH sidecars of a job. */
+export declare function sshSidecarFilters(jobId: string): string[];
+/**
+ * Turns an operation's frpc sidecar config into its SSH sidecar. sshgw runs
+ * next to frpc and needs the runtime socket to exec into the workload; the
+ * image's entrypoint publishes the SSH proxy from the job and operation, keeps
+ * frpc off the socket and exits when either process stops so the runtime
+ * restarts the pair. `prepare` seeds the host key and authorized keys between
+ * create and start, so sshgw never answers with a fresh identity or an empty
+ * key file.
+ */
+export declare function withSshSidecar(config: RunContainerArgs, sidecar: {
+    jobId: string;
+    opIndex: number;
+    /** Runtime name and the socket path as the daemon sees it on the host. */
+    runtime: {
+        name: string;
+        host: string;
+    };
+    prepare: (container: Container) => Promise<void>;
+}): RunContainerArgs;
+/**
+ * The keys a job definition grants at start: deduplicated by identity and
+ * dropped as a set if they break the shared limits. The SDK validator only
+ * lets `ssh.public_keys` through, so that is the only field read.
+ */
+export declare function extractSshPublicKeys(jobDefinition: Pick<JobDefinition, 'ssh'>): string[];
+/** An ed25519 host key as PKCS#8 PEM, which sshgw reads as it is. */
+export declare function generateSshHostKey(): string;
+/**
+ * Seeds a created, not yet started sidecar with the job's host key and its
+ * current authorized_keys, so sshgw finds both on its first start and never
+ * answers with a fresh identity or an empty key file.
+ */
+export declare function seedSshSidecar(container: Container, seed: {
+    hostKey: string;
+    keys: SshKeyGrant[];
+}): Promise<void>;
+/**
+ * Rewrites a sidecar's authorized_keys, whether the sidecar is running or
+ * still only created. sshgw re-reads the file on every attempt and enforces
+ * expiry-time itself, so no reload or timer is needed; a torn read can only
+ * hide a key for an instant, never add one.
+ */
+export declare function replaceSshAuthorizedKeys(container: Container, keys: SshKeyGrant[]): Promise<void>;
+/**
+ * Builds an in-memory POSIX ustar archive of small regular files. Used to
+ * ship the key files into the sidecar container via the runtime's putArchive
+ * endpoint without pulling in a tar dependency.
+ */
+export declare function createTar(files: Array<{
+    name: string;
+    content: Buffer;
+    mode: number;
+}>): Buffer;

package/dist/src/NodeManager/provider/sshSidecar.js

@@ -0,0 +1,176 @@
+import { Readable } from 'stream';
+import { generateKeyPairSync } from 'crypto';
+import { JOB_LABEL, OP_INDEX_LABEL, SERVICE_LABEL, } from './containerOrchestration/labels.js';
+import { getSshKeyIdentity, isValidSshPublicKey, MAX_SSH_PUBLIC_KEYS, MAX_SSH_PUBLIC_KEYS_BYTES, SSH_USERNAME, } from '@nosana/ssh';
+/** Marks an operation's frpc sidecar that also runs sshgw. */
+export const SSH_SIDECAR_SERVICE = 'ssh-sidecar';
+/** The only user name sshgw accepts; the hostname identifies the job. Shared with the client through @nosana/ssh. */
+export const SSH_SIDECAR_USER = SSH_USERNAME;
+export const SSH_SIDECAR_KEYS_DIR = '/nosana-ssh';
+const SSH_SIDECAR_KEYS_FILE = 'authorized_keys';
+const SSH_SIDECAR_HOST_KEY_FILE = 'host_key';
+const SSH_AUTHORIZED_KEY_OPTIONS = 'restrict,pty';
+/** Runtime label filters that select the running SSH sidecars of a job. */
+export function sshSidecarFilters(jobId) {
+    return [`${JOB_LABEL}=${jobId}`, `${SERVICE_LABEL}=${SSH_SIDECAR_SERVICE}`];
+}
+/**
+ * Turns an operation's frpc sidecar config into its SSH sidecar. sshgw runs
+ * next to frpc and needs the runtime socket to exec into the workload; the
+ * image's entrypoint publishes the SSH proxy from the job and operation, keeps
+ * frpc off the socket and exits when either process stops so the runtime
+ * restarts the pair. `prepare` seeds the host key and authorized keys between
+ * create and start, so sshgw never answers with a fresh identity or an empty
+ * key file.
+ */
+export function withSshSidecar(config, sidecar) {
+    const socketDest = sidecar.runtime.name === 'podman'
+        ? '/run/podman/podman.sock'
+        : '/var/run/docker.sock';
+    return {
+        ...config,
+        restart_policy: 'on-failure',
+        env: {
+            ...config.env,
+            SSH_GATEWAY_ENABLED: '1',
+            SSHGW_JOB_ID: sidecar.jobId,
+            SSHGW_OP_INDEX: sidecar.opIndex.toString(),
+            DOCKER_HOST: `unix://${socketDest}`,
+        },
+        volumes: [
+            ...(config.volumes ?? []),
+            {
+                type: 'bind',
+                name: sidecar.runtime.host,
+                dest: socketDest,
+                readonly: true,
+            },
+        ],
+        labels: {
+            ...config.labels,
+            [JOB_LABEL]: sidecar.jobId,
+            [OP_INDEX_LABEL]: sidecar.opIndex.toString(),
+            [SERVICE_LABEL]: SSH_SIDECAR_SERVICE,
+        },
+        security: {
+            capDrop: ['AUDIT_WRITE', 'MKNOD', 'NET_RAW'],
+            pidsLimit: 128,
+        },
+        beforeStart: sidecar.prepare,
+    };
+}
+/**
+ * The keys a job definition grants at start: deduplicated by identity and
+ * dropped as a set if they break the shared limits. The SDK validator only
+ * lets `ssh.public_keys` through, so that is the only field read.
+ */
+export function extractSshPublicKeys(jobDefinition) {
+    const byIdentity = new Map();
+    for (const value of jobDefinition.ssh?.public_keys ?? []) {
+        const key = typeof value === 'string' ? value.trim() : '';
+        if (!isValidSshPublicKey(key))
+            continue;
+        const identity = getSshKeyIdentity(key);
+        if (!byIdentity.has(identity))
+            byIdentity.set(identity, key);
+    }
+    const keys = [...byIdentity.values()];
+    const totalBytes = keys.reduce((sum, key) => sum + Buffer.byteLength(key), 0);
+    if (keys.length > MAX_SSH_PUBLIC_KEYS ||
+        totalBytes > MAX_SSH_PUBLIC_KEYS_BYTES) {
+        return [];
+    }
+    return keys;
+}
+/** An ed25519 host key as PKCS#8 PEM, which sshgw reads as it is. */
+export function generateSshHostKey() {
+    return generateKeyPairSync('ed25519').privateKey.export({
+        type: 'pkcs8',
+        format: 'pem',
+    });
+}
+/**
+ * Seeds a created, not yet started sidecar with the job's host key and its
+ * current authorized_keys, so sshgw finds both on its first start and never
+ * answers with a fresh identity or an empty key file.
+ */
+export async function seedSshSidecar(container, seed) {
+    await container.putArchive(Readable.from(createTar([
+        {
+            name: SSH_SIDECAR_HOST_KEY_FILE,
+            content: Buffer.from(seed.hostKey, 'utf8'),
+            mode: 0o600,
+        },
+        {
+            name: SSH_SIDECAR_KEYS_FILE,
+            content: formatAuthorizedKeys(seed.keys),
+            mode: 0o600,
+        },
+    ])), { path: SSH_SIDECAR_KEYS_DIR });
+}
+/**
+ * Rewrites a sidecar's authorized_keys, whether the sidecar is running or
+ * still only created. sshgw re-reads the file on every attempt and enforces
+ * expiry-time itself, so no reload or timer is needed; a torn read can only
+ * hide a key for an instant, never add one.
+ */
+export async function replaceSshAuthorizedKeys(container, keys) {
+    await container.putArchive(Readable.from(createTar([
+        {
+            name: SSH_SIDECAR_KEYS_FILE,
+            content: formatAuthorizedKeys(keys),
+            mode: 0o600,
+        },
+    ])), { path: SSH_SIDECAR_KEYS_DIR });
+}
+function formatAuthorizedKeys(keys) {
+    const lines = keys.map(({ sshPublicKey, expiresAt }) => {
+        if (!isValidSshPublicKey(sshPublicKey))
+            throw new Error('Invalid SSH public key');
+        const expiry = expiresAt === undefined
+            ? ''
+            : `,expiry-time="${new Date(expiresAt)
+                .toISOString()
+                .slice(0, 19)
+                .replace(/[-:T]/g, '')}Z"`;
+        return `${SSH_AUTHORIZED_KEY_OPTIONS}${expiry} ${sshPublicKey}`;
+    });
+    return Buffer.from(lines.length ? `${lines.join('\n')}\n` : '', 'utf8');
+}
+/**
+ * Builds an in-memory POSIX ustar archive of small regular files. Used to
+ * ship the key files into the sidecar container via the runtime's putArchive
+ * endpoint without pulling in a tar dependency.
+ */
+export function createTar(files) {
+    // Two zero-filled 512-byte blocks mark the end of the archive.
+    const trailer = Buffer.alloc(1024, 0);
+    return Buffer.concat([...files.map(tarEntry), trailer]);
+}
+function tarEntry({ name, content, mode, }) {
+    const header = Buffer.alloc(512, 0);
+    const writeOctal = (value, offset, length) => {
+        // length includes the trailing NUL terminator.
+        const str = value.toString(8).padStart(length - 1, '0');
+        header.write(`${str}\0`, offset, length, 'ascii');
+    };
+    header.write(name, 0, 100, 'utf8'); // name
+    writeOctal(mode & 0o7777, 100, 8); // mode
+    writeOctal(0, 108, 8); // uid
+    writeOctal(0, 116, 8); // gid
+    writeOctal(content.length, 124, 12); // size
+    writeOctal(Math.floor(Date.now() / 1000), 136, 12); // mtime
+    header.write('        ', 148, 8, 'ascii'); // checksum placeholder (8 spaces)
+    header.write('0', 156, 1, 'ascii'); // typeflag: normal file
+    header.write('ustar', 257, 5, 'ascii'); // magic
+    header.write('00', 263, 2, 'ascii'); // version
+    let checksum = 0;
+    for (let i = 0; i < 512; i++)
+        checksum += header[i];
+    // 6 octal digits, NUL, space.
+    header.write(`${checksum.toString(8).padStart(6, '0')}\0 `, 148, 8, 'ascii');
+    const paddedContentLength = Math.ceil(content.length / 512) * 512;
+    const body = Buffer.alloc(paddedContentLength, 0);
+    content.copy(body);
+    return Buffer.concat([header, body]);
+}

package/dist/src/NodeManager/provider/webTerminal.d.ts

@@ -0,0 +1,24 @@
+/// <reference types="node" />
+import type { Duplex } from 'stream';
+import type { ContainerOrchestrationInterface } from './containerOrchestration/interface.js';
+export type TerminalSession = {
+    stream: Duplex;
+    resize: (size: {
+        cols?: number;
+        rows?: number;
+    }) => Promise<void>;
+    inspectExitCode: () => Promise<number | null>;
+    close: () => void;
+};
+/**
+ * Finds the single running container that belongs to a job (optionally scoped
+ * to a specific operation) and opens an interactive PTY exec session into it.
+ *
+ * Mirrors the selection sshgw performs in the sidecar, but runs in-process
+ * over the node's own runtime socket.
+ */
+export declare function createJobTerminalExec(orchestration: ContainerOrchestrationInterface, jobId: string, options?: {
+    op?: string;
+    cols?: number;
+    rows?: number;
+}): Promise<TerminalSession>;

package/dist/src/NodeManager/provider/webTerminal.js

@@ -0,0 +1,98 @@
+import { JOB_LABEL, OP_LABEL, isSafeIdentifier, } from './containerOrchestration/labels.js';
+const DEFAULT_TERMINAL_COLS = 80;
+const DEFAULT_TERMINAL_ROWS = 24;
+const MAX_TERMINAL_DIMENSION = 1000;
+/**
+ * Finds the single running container that belongs to a job (optionally scoped
+ * to a specific operation) and opens an interactive PTY exec session into it.
+ *
+ * Mirrors the selection sshgw performs in the sidecar, but runs in-process
+ * over the node's own runtime socket.
+ */
+export async function createJobTerminalExec(orchestration, jobId, options = {}) {
+    assertSafeSelector(jobId, 'job id');
+    if (options.op !== undefined) {
+        assertSafeSelector(options.op, 'operation selector');
+    }
+    const container = await findJobContainer(orchestration, jobId, options.op);
+    const exec = await container.exec({
+        AttachStdin: true,
+        AttachStdout: true,
+        AttachStderr: true,
+        Tty: true,
+        // Pick bash when it is available, otherwise fall back to a POSIX shell.
+        Cmd: [
+            '/bin/sh',
+            '-c',
+            'if command -v bash >/dev/null 2>&1; then exec bash; else exec sh; fi',
+        ],
+    });
+    const stream = (await exec.start({
+        hijack: true,
+        stdin: true,
+        Tty: true,
+    }));
+    const resize = async ({ cols, rows }) => {
+        await exec
+            .resize({
+            h: clampDimension(rows, DEFAULT_TERMINAL_ROWS),
+            w: clampDimension(cols, DEFAULT_TERMINAL_COLS),
+        })
+            .catch(() => undefined);
+    };
+    await resize(options);
+    return {
+        stream,
+        resize,
+        inspectExitCode: () => inspectExitCode(exec),
+        close: () => {
+            try {
+                stream.destroy();
+            }
+            catch {
+                // best effort
+            }
+        },
+    };
+}
+async function findJobContainer(orchestration, jobId, op) {
+    // Requiring the operation label keeps the job's SSH sidecars, which carry
+    // the job label too, out of the selection.
+    const containers = await orchestration.getContainersByLabels([
+        `${JOB_LABEL}=${jobId}`,
+        op ? `${OP_LABEL}=${op}` : OP_LABEL,
+    ]);
+    if (containers.length === 0) {
+        throw new Error(`No running container found for job ${jobId}`);
+    }
+    if (containers.length > 1) {
+        throw new Error(`Multiple running containers found for job ${jobId}; specify an operation`);
+    }
+    return containers[0];
+}
+async function inspectExitCode(exec) {
+    try {
+        const info = await exec.inspect();
+        if (info.Running)
+            return null;
+        return typeof info.ExitCode === 'number' ? info.ExitCode : null;
+    }
+    catch {
+        return null;
+    }
+}
+function clampDimension(value, fallback) {
+    if (!Number.isFinite(value) || value === undefined)
+        return fallback;
+    const rounded = Math.floor(value);
+    if (rounded < 1)
+        return 1;
+    if (rounded > MAX_TERMINAL_DIMENSION)
+        return MAX_TERMINAL_DIMENSION;
+    return rounded;
+}
+function assertSafeSelector(value, what) {
+    if (!isSafeIdentifier(value)) {
+        throw new Error(`Invalid ${what} for terminal access: ${value}`);
+    }
+}

package/dist/src/NodeManager/repository/NodeRepository.d.ts

@@ -1,6 +1,6 @@
 import type { LowSync } from 'lowdb';
 import type { Flow, OpState, FlowState } from '@nosana/sdk';
-import type { NodeDb, ResourceHistory, VolumeResource } from '../db/index.js';
+import type { NodeDb, ResourceHistory, SshKeyGrant, VolumeResource } from '../db/index.js';
 export declare class NodeRepository {
     private db;
     constructor(db: LowSync<NodeDb>);
@@ -15,6 +15,10 @@ export declare class NodeRepository {
      * depends on this.
      */
     private persist;
+    getSshKeyGrants(id: string): SshKeyGrant[] | undefined;
+    setSshKeyGrants(id: string, keys: SshKeyGrant[]): void;
+    getSshHostKey(id: string): string | undefined;
+    setSshHostKey(id: string, privateKeyPem: string): void;
     getFlow(id: string): Flow;
     getFlows(): {
         [key: string]: Flow;

package/dist/src/NodeManager/repository/NodeRepository.js

@@ -66,6 +66,22 @@ export class NodeRepository {
             });
         }
     }
+    getSshKeyGrants(id) {
+        return this.db.data.sshKeyGrants?.[id];
+    }
+    setSshKeyGrants(id, keys) {
+        this.db.data.sshKeyGrants ??= {};
+        this.db.data.sshKeyGrants[id] = keys.map((key) => ({ ...key }));
+        this.persist();
+    }
+    getSshHostKey(id) {
+        return this.db.data.sshHostKeys?.[id];
+    }
+    setSshHostKey(id, privateKeyPem) {
+        this.db.data.sshHostKeys ??= {};
+        this.db.data.sshHostKeys[id] = privateKeyPem;
+        this.persist();
+    }
     getFlow(id) {
         return this.db.data.flows[id];
     }
@@ -78,6 +94,10 @@ export class NodeRepository {
     }
     deleteflow(id) {
         delete this.db.data.flows[id];
+        if (this.db.data.sshKeyGrants)
+            delete this.db.data.sshKeyGrants[id];
+        if (this.db.data.sshHostKeys)
+            delete this.db.data.sshHostKeys[id];
         this.persist();
     }
     addOpstate(id, opstate) {

package/npm-shrinkwrap.json

@@ -1,18 +1,19 @@
 {
   "name": "@nosana/node",
-  "version": "1.1.62-rc",
+  "version": "1.1.64-rc",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@nosana/node",
-      "version": "1.1.62-rc",
+      "version": "1.1.64-rc",
       "license": "ISC",
       "dependencies": {
         "@coral-xyz/anchor": "^0.28.1-beta.1",
         "@inquirer/prompts": "^4.3.0",
         "@nosana/ipfs": "^2.2.6",
         "@nosana/sdk": "^0.4.87",
+        "@nosana/ssh": "^2.13.1",
         "@solana/web3.js": "^1.78.0",
         "bn.js": "^5.2.1",
         "chalk": "^5.3.0",
@@ -1865,6 +1866,31 @@
         "typescript": ">=4.8.0 <5.8.0"
       }
     },
+    "node_modules/@nosana/ssh": {
+      "version": "2.13.1",
+      "resolved": "https://registry.npmjs.org/@nosana/ssh/-/ssh-2.13.1.tgz",
+      "integrity": "sha512-rxLcFt+GJ51plZcMnH31v8EN9iPzeKuG3CAQIztDjgZNfAuLsp5uq5udOf94ImL+Bxoe7qPzQgUi1t6sVXLAxA==",
+      "license": "MIT",
+      "dependencies": {
+        "@nosana/types": "2.13.0",
+        "tweetnacl": "^1.0.3"
+      },
+      "engines": {
+        "node": ">=20.18.0"
+      }
+    },
+    "node_modules/@nosana/types": {
+      "version": "2.13.0",
+      "resolved": "https://registry.npmjs.org/@nosana/types/-/types-2.13.0.tgz",
+      "integrity": "sha512-5lHB+9wpjHoZZunbzLl211QJFI8dmcM7XmUoGXnQLSszqiJS4QlC5VBOuztLRJEdNi3r8P/5pdGzZ5gsDUTNqA==",
+      "license": "MIT",
+      "dependencies": {
+        "typia": "^10.0.2"
+      },
+      "engines": {
+        "node": ">=20.18.0"
+      }
+    },
     "node_modules/@redocly/ajv": {
       "version": "8.11.0",
       "resolved": "https://registry.npmjs.org/@redocly/ajv/-/ajv-8.11.0.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nosana/node",
-  "version": "1.1.62-rc",
+  "version": "1.1.64-rc",
   "description": "",
   "bin": {
     "nosana-node": "./dist/src/index.js"
@@ -15,7 +15,7 @@
     "generate": "npm run generate:host-manager",
     "generate:host-manager": "openapi-typescript https://host-manager.k8s.dev.nos.ci/swagger/json -o ./src/NodeManager/clients/hostManager/schema.d.ts",
     "test": "APP_ENV=development DOCKER_CERT_PATH= vitest run",
-    "ci:test": "APP_ENV=development DOCKER_CERT_PATH= vitest run --coverage --reporter=junit --outputFile=./test-report.xml",
+    "ci:test": "APP_ENV=development DOCKER_CERT_PATH= vitest run --coverage --reporter=verbose --reporter=junit --outputFile.junit=./test-report.xml",
     "test:watch": "APP_ENV=development DOCKER_CERT_PATH= vitest",
     "test:coverage": "APP_ENV=development DOCKER_CERT_PATH= vitest run --coverage",
     "publish:next": "npm run build && npm publish --tag=next --access public",
@@ -74,6 +74,7 @@
     "@inquirer/prompts": "^4.3.0",
     "@nosana/ipfs": "^2.2.6",
     "@nosana/sdk": "^0.4.87",
+    "@nosana/ssh": "^2.13.1",
     "@solana/web3.js": "^1.78.0",
     "bn.js": "^5.2.1",
     "chalk": "^5.3.0",

package/dist/src/NodeManager/node/api/middlewares/ws/verifyWSMiddleware.d.ts

@@ -1,3 +0,0 @@
-import WebSocket from 'ws';
-import { WSBody } from '../../types/index.js';
-export declare function verifyWSMiddleware(ws: WebSocket, headers: string, body: WSBody, nextFunction: (ws: WebSocket, headers: string, body: WSBody) => void): Promise<void>;