@nosana/node 1.1.63-rc → 1.1.64-rc

package/README.md

@@ -80,7 +80,6 @@ Options:
   --provider <provider>     provider used to run the job (choices: "docker", "podman", default: "podman")
   -w, --wallet <wallet>     path to wallet private key (default: "~/.nosana/nosana_key.json")
   --docker, --podman <URI>  Podman/Docker connection URI (default: "~/.nosana/podman/podman.sock")
-  --managed-podman          Run jobs in a podman container the node creates over the docker socket given with --docker, and recreates when its GPU mounts go stale
   -h, --help                display help for command
 ```
 

package/dist/.env

@@ -1,8 +1,6 @@
 BACKEND_SOLANA_ADDRESS=7rFPFnxjXHC2sfDy3qrDa9pEb4j49oivMuV7e8sYDPmB
-FRPC_CONTAINER_IMAGE=registry.hub.docker.com/nosana/frpc:v1.0.44
-FRP_SERVER_IMAGE=registry.hub.docker.com/nosana/frpc:v1.0.44
-PODMAN_CONTAINER_IMAGE=docker.io/nosana/podman:v1.1.2
+FRP_SERVER_IMAGE=registry.hub.docker.com/nosana/frpc:v1.0.45
 FRP_SERVER_PORT=7000
 MIN_DISK_SPACE=25
 SIGN_MESSAGE="Hello Nosana Node!"
-API_PORT=8123
+API_PORT=8123

package/dist/.env.dev

@@ -1,4 +1,4 @@
 HOST_MANAGER_BASE_URL=https://host-manager.k8s.dev.nos.ci
 EXPLORER_URL=https://devnet.nosana.io
 FRP_SERVER_ADDRESS=node.k8s.dev.nos.ci
-MIN_DISK_SPACE=20
+MIN_DISK_SPACE=20

package/dist/.env.prd

@@ -1,3 +1,3 @@
 HOST_MANAGER_BASE_URL=https://host-manager.k8s.prd.nos.ci
 EXPLORER_URL=https://explore.nosana.com
-FRP_SERVER_ADDRESS=node.k8s.prd.nos.ci
+FRP_SERVER_ADDRESS=node.k8s.prd.nos.ci

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nosana/node",
-    "version": "1.1.63-rc",
+    "version": "1.1.64-rc",
     "description": "",
     "bin": {
         "nosana-node": "./dist/src/index.js"
@@ -15,7 +15,7 @@
         "generate": "npm run generate:host-manager",
         "generate:host-manager": "openapi-typescript https://host-manager.k8s.dev.nos.ci/swagger/json -o ./src/NodeManager/clients/hostManager/schema.d.ts",
         "test": "APP_ENV=development DOCKER_CERT_PATH= vitest run",
-        "ci:test": "APP_ENV=development DOCKER_CERT_PATH= vitest run --coverage --reporter=junit --outputFile=./test-report.xml",
+        "ci:test": "APP_ENV=development DOCKER_CERT_PATH= vitest run --coverage --reporter=verbose --reporter=junit --outputFile.junit=./test-report.xml",
         "test:watch": "APP_ENV=development DOCKER_CERT_PATH= vitest",
         "test:coverage": "APP_ENV=development DOCKER_CERT_PATH= vitest run --coverage",
         "publish:next": "npm run build && npm publish --tag=next --access public",
@@ -74,6 +74,7 @@
         "@inquirer/prompts": "^4.3.0",
         "@nosana/ipfs": "^2.2.6",
         "@nosana/sdk": "^0.4.87",
+        "@nosana/ssh": "^2.13.1",
         "@solana/web3.js": "^1.78.0",
         "bn.js": "^5.2.1",
         "chalk": "^5.3.0",

package/dist/src/NodeManager/configs/NodeConfigs.d.ts

@@ -3,6 +3,7 @@ export declare class NodeConfigs {
     constructor(options: {
         [key: string]: any;
     });
+    getNetwork(): 'devnet' | 'mainnet';
     loadVariablesToEnv(): void;
 }
 export declare class NodeConfigsSingleton {

package/dist/src/NodeManager/configs/NodeConfigs.js

@@ -5,8 +5,11 @@ export class NodeConfigs {
     constructor(options) {
         this.options = options;
     }
+    getNetwork() {
+        return this.options.network ?? 'mainnet';
+    }
     loadVariablesToEnv() {
-        const network = this.options.network ? this.options.network : 'mainnet';
+        const network = this.getNetwork();
         const env = network === 'mainnet' ? 'prd' : 'dev';
         const modulePath = dirname(fileURLToPath(import.meta.url));
         // Load .env.${env} first (higher priority)

package/dist/src/NodeManager/configs/configs.d.ts

@@ -9,9 +9,6 @@ export type configType = {
         containerImage: string;
         nodeInternalHostName: string;
     };
-    podman: {
-        containerImage: string;
-    };
     api: {
         port: number;
     };

package/dist/src/NodeManager/configs/configs.js

@@ -1,7 +1,7 @@
 import { NodeConfigsSingleton } from './NodeConfigs.js';
 import { loadConfigurationValue } from '../utils/utils.js';
 export const configs = (options) => {
-    NodeConfigsSingleton.getInstance(options);
+    const nodeConfigs = NodeConfigsSingleton.getInstance(options);
     return {
         isNodeRun: options?.isNodeRun,
         hostManagerBaseUrl: loadConfigurationValue('HOST_MANAGER_BASE_URL'),
@@ -13,13 +13,10 @@ export const configs = (options) => {
             containerImage: loadConfigurationValue('FRP_SERVER_IMAGE'),
             nodeInternalHostName: loadConfigurationValue('FRP_NODE_INTERNAL_HOSTNAME', "nosana-node"),
         },
-        podman: {
-            containerImage: loadConfigurationValue('PODMAN_CONTAINER_IMAGE'),
-        },
         api: {
             port: parseInt(loadConfigurationValue('API_PORT')),
         },
         minDiskSpace: parseInt(loadConfigurationValue('MIN_DISK_SPACE')),
-        network: options?.network ?? 'mainnet',
+        network: options?.network ?? nodeConfigs.getNetwork(),
     };
 };

package/dist/src/NodeManager/db/index.d.ts

@@ -1,7 +1,14 @@
 import { LowSync } from 'lowdb/lib';
 import { Flow } from '@nosana/sdk';
 import { CudaCheckSuccessResponse } from '../types/index.js';
+export type SshKeyGrant = {
+    sshPublicKey: string;
+    expiresAt?: string;
+};
 export type NodeDb = {
+    sshKeyGrants?: Record<string, SshKeyGrant[]>;
+    /** One SSH host key (PKCS#8 PEM) per job, shared by all of its sidecars. */
+    sshHostKeys?: Record<string, string>;
     flows: {
         [key: string]: Flow;
     };
@@ -40,6 +47,22 @@ export type ResourceHistory = {
     usage: number;
     required: boolean;
     isPrivate?: boolean;
+    /**
+     * The project a resource is scoped to when it must not be shared freely
+     * across projects. Absent on shared, public resources.
+     *
+     * For a volume it is set once the resource is mounted writable (`allowWrite`)
+     * or fetched from an auth-gated remote: a writable mount can leave the job's
+     * own bytes behind, and an auth-gated resource is private to the credentials
+     * that fetched it, so the volume is keyed by project and never reused by
+     * another — a different project falls through to a clean copy of its own.
+     *
+     * For a private image it is the project the image was last pulled for. The
+     * daemon holds one copy per image reference, so this gates reuse rather than
+     * separating storage: a job from a different project must re-authenticate
+     * (forcing a pull) before it may reuse the cached copy.
+     */
+    project?: string;
 };
 export type VolumeResource = ResourceHistory & {
     volume: string;

package/dist/src/NodeManager/index.js

@@ -64,7 +64,7 @@ export default class NodeManager {
          * collect the diagnostics the podman container leaves in the shared
          * directory, which has no other route off the node
          */
-        reportPodmanDiagnostics(this.configLocation, (event) => this.node.podmanEvent(event));
+        reportPodmanDiagnostics(this.configLocation);
         /**
          * start
          *
@@ -109,7 +109,10 @@ export default class NodeManager {
          * request a market to join from the host manager,
          * we can pass a requested market or let the host manager recommend us one
          */
-        const market = await this.node.requestMarket(marketArg);
+        let market;
+        if (!marketArg) {
+            market = await this.node.requestMarket();
+        }
         /**
          * healthcheck
          *
@@ -129,7 +132,9 @@ export default class NodeManager {
          *
          * this sets up everything need, downloads needed resources ...
          */
-        await this.node.setup(market);
+        if (market) {
+            await this.node.setup(market);
+        }
         /**
          * this variable was added to know when the node has gone past the setup/checks stages
          * and is now starting job work and queueing,
@@ -154,7 +159,7 @@ export default class NodeManager {
              *
              * Enter the queue to wait for a job since we have no pending jobs.
              */
-            await this.node.queue(market.address.toString());
+            await this.node.queue(market ? market.address.toString() : marketArg);
         }
         /**
          *

package/dist/src/NodeManager/monitoring/reportPodmanDiagnostics.d.ts

@@ -1,8 +1,7 @@
 /**
  * Forward the events the podman container leaves in the directory the two
  * share. That container has no route to the host manager of its own, so its
- * event log is the only sign of whether the CDI watcher ever fired. Each
- * event also goes to `onEvent`, for the node to act on.
+ * event log is the only sign of whether the CDI watcher ever fired.
  *
  * Nothing here may throw: this is diagnostics, and the node's uncaught handler
  * would turn a failure to read a log file into the node stopping. Watching can
@@ -10,4 +9,4 @@
  * and a watch already established still reports errors of its own if the
  * directory it covers is removed.
  */
-export declare function reportPodmanDiagnostics(configLocation: string, onEvent?: (event: string) => void): void;
+export declare function reportPodmanDiagnostics(configLocation: string): void;

package/dist/src/NodeManager/monitoring/reportPodmanDiagnostics.js

@@ -10,8 +10,7 @@ const MAX_CATCH_UP = 1024 * 1024;
 /**
  * Forward the events the podman container leaves in the directory the two
  * share. That container has no route to the host manager of its own, so its
- * event log is the only sign of whether the CDI watcher ever fired. Each
- * event also goes to `onEvent`, for the node to act on.
+ * event log is the only sign of whether the CDI watcher ever fired.
  *
  * Nothing here may throw: this is diagnostics, and the node's uncaught handler
  * would turn a failure to read a log file into the node stopping. Watching can
@@ -19,7 +18,7 @@ const MAX_CATCH_UP = 1024 * 1024;
  * and a watch already established still reports errors of its own if the
  * directory it covers is removed.
  */
-export function reportPodmanDiagnostics(configLocation, onEvent) {
+export function reportPodmanDiagnostics(configLocation) {
     if (!configLocation)
         return;
     const log = path.join(configLocation.replace(/^~/, os.homedir()), CDI_EVENTS);
@@ -76,15 +75,12 @@ export function reportPodmanDiagnostics(configLocation, onEvent) {
             partial = lines.pop() ?? '';
             lines
                 .filter(Boolean)
-                .forEach((event) => {
-                void reportError({
-                    error_type: 'cdiEvent',
-                    error_name: 'Event',
-                    error_message: event,
-                    error_stack: '',
-                });
-                onEvent?.(event);
-            });
+                .forEach((event) => void reportError({
+                error_type: 'cdiEvent',
+                error_name: 'Event',
+                error_message: event,
+                error_stack: '',
+            }));
         }
         finally {
             fs.closeSync(fd);

package/dist/src/NodeManager/node/Node.d.ts

@@ -15,7 +15,6 @@ export declare class BasicNode {
     private resourceManager;
     private provider;
     private containerOrchestration;
-    private podmanManager?;
     private exiting;
     private sdk;
     constructor(options: {
@@ -28,8 +27,6 @@ export declare class BasicNode {
     isApiActive(): Promise<boolean>;
     node(): string;
     getSystemEnvironment(): string;
-    /** An event line the podman container's CDI watcher logged. */
-    podmanEvent(event: string): void;
     stop(): Promise<void>;
     clean(): Promise<void>;
     start(): Promise<void>;

package/dist/src/NodeManager/node/Node.js

@@ -14,7 +14,6 @@ import { ExpiryHandler } from './expiry/expiryHandler.js';
 import { GridHandler } from './grid/gridHandler.js';
 import { ResourceManager } from './resource/resourceManager.js';
 import { selectContainerOrchestrationProvider } from '../provider/containerOrchestration/selectContainerOrchestration.js';
-import { DockerContainerOrchestration } from '../provider/containerOrchestration/docker/index.js';
 import { RegisterHandler } from './register/index.js';
 import { BalanceHandler } from './balance/balanceHandler.js';
 import { abortControllerSelector, nodeAbortControllerSelector, } from './abort/abortControllerSelector.js';
@@ -22,7 +21,6 @@ import { pollForRun } from './utils/poll.js';
 import { configs } from '../configs/configs.js';
 import { TaskManagerRegistry } from './task/TaskManagerRegistry.js';
 import { StopReasons } from './task/TaskManager.js';
-import { isStaleCdiEvent, PodmanManager, } from '../provider/podmanManager/PodmanManager.js';
 export class BasicNode {
     constructor(options) {
         this.exiting = false;
@@ -30,17 +28,8 @@ export class BasicNode {
         const db = new DB(options.config).db;
         this.repository = new NodeRepository(db);
         this.containerOrchestration = selectContainerOrchestrationProvider(options.provider, options.podman, options.gpu, options.trustedExecutionRuntime);
-        if (options.managedPodman) {
-            this.podmanManager = new PodmanManager(new DockerContainerOrchestration(options.dockerSocket, options.gpu), options.config, this.containerOrchestration);
-        }
         this.resourceManager = new ResourceManager(this.containerOrchestration, this.repository);
         this.provider = new Provider(this.containerOrchestration, this.repository, this.resourceManager);
-        if (this.podmanManager) {
-            this.provider.gpuRuntime = this.podmanManager;
-            // the API proxy runs in docker beside the node, where replacing podman
-            // cannot reach it
-            this.provider.apiOrchestration = this.podmanManager.hostDocker;
-        }
         this.apiHandler = new ApiHandler(this.sdk, this.repository, this.provider, options.port);
         this.balanceHandler = new BalanceHandler(this.sdk);
         this.gridHandler = new GridHandler(this.sdk, this.repository);
@@ -57,13 +46,6 @@ export class BasicNode {
         await this.registerHandler.register();
     }
     async healthcheck() {
-        /**
-         * the podman container, when this node owns it: recreated between jobs,
-         * so a driver the host replaced since is injected afresh. Nothing of the
-         * node's runs inside it at this point, and the image and resource caches
-         * live on volumes that survive it.
-         */
-        await this.podmanManager?.recreate('between jobs');
         /**
          * run health check,
          */
@@ -94,11 +76,6 @@ export class BasicNode {
     getSystemEnvironment() {
         return this.repository.getNodeInfo().system_environment;
     }
-    /** An event line the podman container's CDI watcher logged. */
-    podmanEvent(event) {
-        if (isStaleCdiEvent(event))
-            this.podmanManager?.markStale(event);
-    }
     async stop() {
         await this.marketHandler.stop();
         await this.runHandler.stop();
@@ -121,11 +98,6 @@ export class BasicNode {
         if (await this.balanceHandler.balance()) {
             await this.balanceHandler.check(true);
         }
-        /**
-         * the podman container, when this node owns it: brought up if it is not
-         * running, and recreated if its GPU mounts went stale since the last job
-         */
-        await this.podmanManager?.ensure();
         /**
          * get an instance to the container
          */
@@ -147,10 +119,6 @@ export class BasicNode {
             try {
                 let resolvedStatus = StopReasons.COMPLETED;
                 const periodicHealthcheck = async () => {
-                    // Leaves the queue, so the healthcheck that follows recreates podman
-                    // before the node takes a job it cannot run.
-                    if (this.podmanManager?.isStale())
-                        return false;
                     const { status, error } = await this.containerOrchestration.healthy();
                     if (!status) {
                         return false;

package/dist/src/NodeManager/node/api/ApiHandler.js

@@ -6,8 +6,8 @@ import { configs } from '../../configs/configs.js';
 import { sleep } from '../../utils/utils.js';
 import { stateStreaming } from '../../monitoring/streaming/StateStreamer.js';
 import { applyLoggingProxyToClass } from '../../monitoring/proxy/loggingProxy.js';
-import { verifyJobOwnerSignatureMiddleware, verifyWSJobOwnerSignatureMiddleware, verifyWSNodeOrJobOwnerSignatureMiddleware, } from './middlewares/index.js';
-import { getNodeInfoRoute, getJobResultsRoute, getServiceUrlRoute, postJobDefinitionRoute, postServiceStopRoute, wssLogRoute, wssStatusRoute, getCurrentGroupStatusHandler, getGroupStatusHandler, getOperationsStatusHandler, getOperationStatusHandler, restartGroupOperationHandler, restartOperationHandler, stopGroupOperationHandler, stopOperationHandler, wssTaskManagerLogRoute, getJobDefinitionRoute, getJobInfoRoute, getJobStatsRoute, getJobStatsStreamRoute, } from './routes/index.js';
+import { verifyJobOwnerSignatureMiddleware, verifyWSJobOwnerSignatureMiddleware, } from './middlewares/index.js';
+import { getNodeInfoRoute, getJobResultsRoute, getServiceUrlRoute, postJobDefinitionRoute, postServiceStopRoute, wssLogRoute, wssStatusRoute, wssTerminalRoute, getCurrentGroupStatusHandler, getGroupStatusHandler, getOperationsStatusHandler, getOperationStatusHandler, restartGroupOperationHandler, restartOperationHandler, stopGroupOperationHandler, stopOperationHandler, wssTaskManagerLogRoute, getJobDefinitionRoute, getJobInfoRoute, getJobStatsRoute, getJobStatsStreamRoute, postSshAuthorizeRoute, getSshKeysRoute, deleteSshKeyRoute, } from './routes/index.js';
 import { requestExit } from '../../../exitCodes.js';
 import { NodeAlreadyActiveError } from '../../errors/NodeAlreadyActiveError.js';
 import { reportError } from '../../monitoring/reportError.js';
@@ -91,7 +91,13 @@ export class ApiHandler {
         });
         this.wss.on('connection', (ws) => {
             let keepAliveInterval;
+            let terminalActive = false;
             ws.on('message', async (message) => {
+                // Once a terminal session has taken over the socket, the terminal
+                // route owns all subsequent frames (stdin/resize), so skip the generic
+                // JSON dispatch for them.
+                if (terminalActive)
+                    return;
                 try {
                     const { path, header, body } = JSON.parse(message.toString());
                     keepAliveInterval = setInterval(() => {
@@ -105,7 +111,11 @@ export class ApiHandler {
                             await verifyWSJobOwnerSignatureMiddleware(ws, header, body, wssTaskManagerLogRoute);
                             break;
                         case '/status':
-                            await verifyWSNodeOrJobOwnerSignatureMiddleware(ws, header, body, wssStatusRoute);
+                            await verifyWSJobOwnerSignatureMiddleware(ws, header, body, wssStatusRoute);
+                            break;
+                        case '/terminal':
+                            terminalActive = true;
+                            await wssTerminalRoute(ws, this.provider, this.address, body);
                             break;
                         default:
                             ws.close(3003, 'Invalid Path');
@@ -206,6 +216,9 @@ export class ApiHandler {
         });
         this.api.use(express.json());
         this.api.use('/job/:jobId/*', verifyJobOwnerSignatureMiddleware);
+        this.api.post('/job/:jobId/ssh/authorize', postSshAuthorizeRoute);
+        this.api.get('/job/:jobId/ssh/keys', getSshKeysRoute);
+        this.api.delete('/job/:jobId/ssh/keys', deleteSshKeyRoute);
         // GET Routes
         this.api.get('/node/info', getNodeInfoRoute);
         this.api.get('/', (_, res) => res.send(this.address));

package/dist/src/NodeManager/node/api/middlewares/index.d.ts

@@ -1,4 +1,2 @@
 export * from './rest/verifyJobOwnerSignatureMiddleware.js';
 export * from './ws/verifyWSJobOwnerSignatureMiddleware.js';
-export * from './ws/verifyWSNodeOrJobOwnerSignatureMiddleware.js';
-export * from './ws/verifyWSMiddleware.js';

package/dist/src/NodeManager/node/api/middlewares/index.js

@@ -2,5 +2,3 @@
 export * from './rest/verifyJobOwnerSignatureMiddleware.js';
 // WEBSOCKET MIDDLEWARE
 export * from './ws/verifyWSJobOwnerSignatureMiddleware.js';
-export * from './ws/verifyWSNodeOrJobOwnerSignatureMiddleware.js';
-export * from './ws/verifyWSMiddleware.js';

package/dist/src/NodeManager/node/api/middlewares/rest/verifyJobOwnerSignatureMiddleware.js

@@ -17,6 +17,7 @@ export async function verifyJobOwnerSignatureMiddleware(req, res, next) {
             key: 'authorization',
             expiry: job.timeout,
             publicKey: new PublicKey(job.project),
+            expected_message: jobId,
         })) {
             return res.status(401).send('Unauthorized Request');
         }

package/dist/src/NodeManager/node/api/middlewares/ws/verifyWSJobOwnerSignatureMiddleware.js

@@ -16,6 +16,7 @@ export async function verifyWSJobOwnerSignatureMiddleware(ws, headers, body, nex
         try {
             if (sdk.authorization.validate(headers, {
                 publicKey: new PublicKey(job.project),
+                expected_message: jobId,
             })) {
                 await nextFunction(ws, headers, body);
             }

package/dist/src/NodeManager/node/api/routes/get/node-info.js

@@ -11,13 +11,15 @@ export function getNodeInfoRoute(req, res) {
             ...info,
             gpus: {
                 ...info.gpus,
-                devices: info.gpus.devices.map(({ index, name, uuid, memory, network_architecture }) => ({
-                    index,
-                    name,
-                    uuid,
-                    memory,
-                    network_architecture,
-                })),
+                devices: info.gpus.devices
+                    ? info.gpus.devices.map(({ index, name, uuid, memory, network_architecture }) => ({
+                        index,
+                        name,
+                        uuid,
+                        memory,
+                        network_architecture,
+                    }))
+                    : [],
             },
             network: networkRedacted,
         },

package/dist/src/NodeManager/node/api/routes/post/index.d.ts

@@ -1,3 +1,4 @@
 export * from './job-definition.js';
 export * from './service-stop.js';
 export * from './job-operation-actions.js';
+export * from './ssh-authorize.js';

package/dist/src/NodeManager/node/api/routes/post/index.js

@@ -1,3 +1,4 @@
 export * from './job-definition.js';
 export * from './service-stop.js';
 export * from './job-operation-actions.js';
+export * from './ssh-authorize.js';

package/dist/src/NodeManager/node/api/routes/post/ssh-authorize.d.ts

@@ -0,0 +1,17 @@
+import { Response } from 'express';
+import { NodeAPIRequest } from '../../types/index.js';
+export type SshAuthorizationRequestBody = {
+    sshPublicKey: string;
+    expiresAt?: string;
+};
+export declare function postSshAuthorizeRoute(req: NodeAPIRequest<{
+    jobId: string;
+}, SshAuthorizationRequestBody>, res: Response): Promise<void>;
+export declare function getSshKeysRoute(req: NodeAPIRequest<{
+    jobId: string;
+}>, res: Response): Promise<void>;
+export declare function deleteSshKeyRoute(req: NodeAPIRequest<{
+    jobId: string;
+}, {
+    sshPublicKey: string;
+}>, res: Response): Promise<void>;

package/dist/src/NodeManager/node/api/routes/post/ssh-authorize.js

@@ -0,0 +1,53 @@
+import { SSH_SIDECAR_USER } from '../../../../provider/sshSidecar.js';
+import { isActiveSshFlow, SshAccessError, validateSshKey, validateSshExpiry, } from '../../../../provider/SshAccessManager.js';
+/**
+ * The job owner's signature has already been checked by the shared
+ * verifyJobOwnerSignatureMiddleware; this only maps the SSH operation onto
+ * an active flow and onto HTTP statuses.
+ */
+async function handleSshRequest(req, res, action) {
+    try {
+        const jobId = req.params.jobId;
+        const flow = req.repository?.getFlow(jobId);
+        if (!flow || !isActiveSshFlow(flow))
+            throw new SshAccessError('Could not find active job', 404);
+        if (!req.provider)
+            throw new SshAccessError('SSH provider is not available', 503);
+        const result = await action(jobId);
+        res
+            .status(result.status ?? 200)
+            .json({ job: jobId, sshUser: SSH_SIDECAR_USER, ...result.body });
+    }
+    catch (error) {
+        res.status(error instanceof SshAccessError ? error.status : 502).json({
+            error: error instanceof SshAccessError
+                ? error.message
+                : 'Could not apply SSH access on the node',
+        });
+    }
+}
+export async function postSshAuthorizeRoute(req, res) {
+    return handleSshRequest(req, res, async (jobId) => {
+        const sshPublicKey = validateSshKey(req.body?.sshPublicKey);
+        const expiresAt = validateSshExpiry(req.body?.expiresAt);
+        await req.provider.authorizeSshKeyForJob(jobId, sshPublicKey, expiresAt);
+        return {
+            status: 201,
+            body: {
+                authorized: true,
+                ...(expiresAt === undefined ? {} : { expiresAt }),
+            },
+        };
+    });
+}
+export async function getSshKeysRoute(req, res) {
+    return handleSshRequest(req, res, async (jobId) => ({
+        body: { keys: await req.provider.listSshKeysForJob(jobId) },
+    }));
+}
+export async function deleteSshKeyRoute(req, res) {
+    return handleSshRequest(req, res, async (jobId) => {
+        await req.provider.revokeSshKeyForJob(jobId, validateSshKey(req.body?.sshPublicKey));
+        return { body: { revoked: true } };
+    });
+}

package/dist/src/NodeManager/node/api/routes/wss/index.d.ts

@@ -1,2 +1,4 @@
 export * from './log.js';
 export * from './status.js';
+export * from './terminal/terminal.js';
+export * from './terminal/terminalAuthorization.js';

package/dist/src/NodeManager/node/api/routes/wss/index.js

@@ -1,2 +1,4 @@
 export * from './log.js';
 export * from './status.js';
+export * from './terminal/terminal.js';
+export * from './terminal/terminalAuthorization.js';

package/dist/src/NodeManager/node/api/routes/wss/log.js

@@ -1,4 +1,5 @@
 import WebSocket from 'ws';
+import { sleep } from '@nosana/sdk';
 import { logStreaming } from '../../../../monitoring/streaming/LogStreamer.js';
 import { getSDK } from '../../../../sdk/index.js';
 import { TaskManagerRegistry } from '../../../task/TaskManagerRegistry.js';
@@ -19,7 +20,7 @@ export async function wssTaskManagerLogRoute(ws, _, { jobAddress, group, opId, t
     // definition and registering its TaskManager. Keep the authenticated socket
     // open during that short startup window instead of forcing clients to race it.
     while (!task && Date.now() < deadline && ws.readyState === WebSocket.OPEN) {
-        await new Promise((resolve) => setTimeout(resolve, 250));
+        await sleep(0.25);
         task = registry.get(jobAddress);
     }
     if (!task)

package/dist/src/NodeManager/node/api/routes/wss/terminal/terminal.d.ts

@@ -0,0 +1,21 @@
+import WebSocket from 'ws';
+import { PublicKey } from '@solana/web3.js';
+import { Provider } from '../../../../../provider/Provider.js';
+import { TerminalAuthorizationRequest } from './terminalAuthorization.js';
+export type TerminalWSBody = TerminalAuthorizationRequest & {
+    jobAddress: string;
+    cols?: number;
+    rows?: number;
+};
+/**
+ * Validates a wallet-signed terminal grant and bridges an interactive PTY exec
+ * session in the job container to the websocket.
+ *
+ * Wire protocol after the (already validated) handshake frame:
+ *  - client -> node : JSON text frames
+ *      { "type": "stdin",  "data": "<string>" }
+ *      { "type": "resize", "cols": <n>, "rows": <n> }
+ *  - node -> client : binary frames carry raw stdout/stderr bytes
+ *      JSON text frame { "type": "exit",  "code": <n> } on shell exit
+ */
+export declare function wssTerminalRoute(ws: WebSocket, provider: Provider, nodeAddress: PublicKey, body: TerminalWSBody): Promise<void>;