@ornncompute/cli 0.1.2 → 0.1.4

package/README.md

@@ -1,8 +1,10 @@
 # Ornn CLI
 
-Command-line access for Ornn bare-metal compute workflows: find
-available capacity, buy or bid, manage reservations, activate SSH access,
-resell capacity, and open billing.
+Command-line access for Ornn compute workflows: browse Listings, buy capacity,
+bid in Exchange, manage GPU reservations, launch VM or Bare Metal machines,
+create Kubernetes or Slurm clusters, manage private networks and storage
+volumes, attach SSH keys, SSH into launched machines, watch machine health
+metrics, and view billing readouts.
 
 For the end-user install, browser-login, command, and troubleshooting guide, see
 the [`docs/cli.md`](../../docs/cli.md) guide.
@@ -26,40 +28,126 @@ static.
 ```bash
 ornn help [command]
 ornn login [--auth-base <url>] [--no-browser] [--timeout <seconds>]
+ornn update
 ornn whoami [--json]
 ornn status [--json]
-ornn availability list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]
-ornn availability show <listing-id> [--open] [--json]
+ornn listings list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]
+ornn listings show <listing-id> [--open] [--json]
 ornn buy <listing-id> [--no-open] [--json]
-ornn bid create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]
-ornn bid list [--json]
-ornn bid show <bid-id> [--open] [--json]
-ornn bid update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
-ornn bid withdraw <bid-id>
-ornn reservations list [--status <status>] [--json]
-ornn reservations show <reservation-id> [--open] [--json]
-ornn reservations checkout <reservation-id> [--no-open] [--json]
+ornn exchange create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]
+ornn exchange list [--json]
+ornn exchange show <bid-id> [--open] [--json]
+ornn exchange update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
+ornn exchange withdraw <bid-id>
+ornn gpus list [--status <status>] [--json]
+ornn gpus show <reservation-id> [--open] [--json]
+ornn gpus checkout <reservation-id> [--no-open] [--json]
+ornn nodes list [--json]
+ornn nodes show <node-id> [--json]
+ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]
+ornn nodes wait <node-or-reservation-id> [--timeout <seconds>] [--json]
+ornn nodes start <node-id> [--json]
+ornn nodes stop <node-id> [--json]
+ornn nodes teardown <node-id> [--json]
+ornn nodes revoke <node-id> [--json]
+ornn nodes ssh-command <node-or-reservation-id> [--json]
+ornn nodes keys attach <node-id> --key <path|id|label> [--json]
+ornn nodes keys list <node-id> [--json]
+ornn node health <node-id> [--json]
+ornn node diagnose <node-id> [--json]
+ornn node drain <node-id> [--reason <text>] [--json]
+ornn node restore <node-id> [--reason <text>] [--json]
+ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]
+ornn metrics nodes [--json]
+ornn metrics node <node-id> [--json]
+ornn metrics history <node-id> [--start <iso>] [--end <iso>] [--max-points <n>] [--json]
+ornn metrics watch <node-id> [--interval <seconds>] [--count <n>] [--timeout <seconds>] [--json]
+ornn clusters list [--json]
+ornn clusters reservations [--json]
+ornn clusters eligible-nodes <reservation-id> [--type kubernetes|slurm] [--network public|private] [--json]
+ornn clusters create <reservation-id> --type kubernetes|slurm [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--json]
+ornn clusters show <reservation-id> [--type kubernetes|slurm] [--json]
+ornn clusters wait <reservation-id> [--type kubernetes|slurm] [--timeout <seconds>] [--json]
+ornn clusters credentials <reservation-id> [--type kubernetes|slurm] [--json]
+ornn clusters kubeconfig <reservation-id> [--output <path>] [--json]
+ornn clusters ssh-command <reservation-id> [--identity-file <path>] [--user <name>] [--json]
+ornn clusters ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]
+ornn clusters add-node <reservation-id> --node <node-id> [--json]
+ornn clusters remove-node <reservation-id> --node <node-id> [--json]
+ornn clusters teardown <reservation-id> [--type kubernetes|slurm] [--json]
+ornn networks list [--json]
+ornn networks show <network-id> [--json]
+ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]
+ornn networks update <network-id> [--name <name>] [--description <text>] [--clear-description] [--json]
+ornn networks delete <network-id> [--json]
+ornn networks reservation <reservation-id> [--json]
+ornn networks attach <reservation-id> --network <network-id> [--json]
+ornn networks detach <reservation-id> [--json]
+ornn storage volumes list [--json]
+ornn storage volumes show <drive-id> [--json]
+ornn storage volumes create --name <name> [--source <drive-id>] [--json]
+ornn storage volumes refresh <drive-id> [--json]
+ornn storage volumes clear <drive-id> [--json]
+ornn storage volumes delete <drive-id> [--json]
+ornn storage deploy <drive-id> --reservation <reservation-id> [--mount-path <path>] [--read-only|--read-write] [--json]
+ornn storage deploy status --reservation <reservation-id> [--json]
+ornn storage buckets list [--json]
+ornn storage buckets show <drive-id> [--json]
+ornn storage buckets connect gcs|s3|r2 --bucket <bucket>|--url <url> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write] [--verify] [--json]
+ornn storage buckets update-credentials <drive-id> --access-key-id <id> --secret-access-key-file <path> [--json]
+ornn storage buckets verify <drive-id> [--json]
+ornn storage buckets disconnect <drive-id> [--json]
+ornn keys list [--json]
+ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json]
+ornn keys delete <key-id> [--json]
 ornn access show <reservation-id> [--json]
-ornn access activate <reservation-id> --ssh-key-id <id> [--username <name>] [--no-open] [--json]
+ornn access activate <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--no-open] [--json]
 ornn access push-keys <reservation-id> --ssh-key-id <id> [--json]
 ornn access keys list <reservation-id> [--json]
 ornn access keys add <reservation-id> --public-key <key> [--label <label>] [--json]
 ornn access keys add <reservation-id> --public-key-file <path> [--label <label>] [--json]
 ornn access keys push <reservation-id> --ssh-key-id <id> [--json]
 ornn access keys status <reservation-id> [--json]
-ornn resale browse [--json]
-ornn resale list <reservation-id> --ask-price <usd> [--no-open] [--json]
-ornn resale update <reservation-id> --ask-price <usd> [--no-open] [--json]
-ornn resale delist <reservation-id> [--no-open] [--json]
 ornn ssh-keys list [--json]
 ornn ssh-keys add --public-key <key> [--label <label>] [--json]
 ornn ssh-keys add --public-key-file <path> [--label <label>] [--json]
 ornn ssh-keys delete <key-id> [--json]
+ornn billing summary [--json]
+ornn billing invoices [--json]
+ornn billing showback --start <yyyy-mm-dd> --end <yyyy-mm-dd> [--json]
 ornn billing open [--no-open] [--json]
 ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]
 ornn logout
 ```
 
+UI aliases are first-class in the CLI: `listings` maps to the older
+`availability` command, `exchange` maps to `bid`, and `gpus` maps to
+`reservations`. The older command names remain available for scripts.
+
+## Operator commands
+
+The `ornn node` commands are for Ornn operators and reviewers, not tenants. They
+strictly wrap the internal-reviewer-gated compute endpoints, so they do not use
+the tenant CLI login. Instead they talk to the compute service directly and
+authenticate with the shared reviewer secret:
+
+- `ornn node health <node-id>` shows launch readiness (ready/blocked plus
+  reasons), passive fault reasons, and the last validation status.
+- `ornn node diagnose <node-id>` queues an active health run for the node.
+- `ornn node drain <node-id>` / `ornn node restore <node-id>` take the node out
+  of and back into service. Both accept an optional `--reason`.
+
+Set these environment variables before running them:
+
+- `ORNN_COMPUTE_BASE_URL` — origin of the internal compute service (for example
+  `http://localhost:8000`). The review secret travels as a request header, so
+  in any non-local deployment this should be an `https://` origin.
+- `ORNN_INTERNAL_REVIEW_SECRET` — the reviewer secret, sent as the
+  `X-Internal-Review-Secret` header.
+
+If either is missing the command fails with a clear error before making any
+network request.
+
 Commands print concise human-readable output by default. Use `--json` on
 read/show/list commands and transaction handoffs when you need structured
 stdout for scripts. Errors and login/browser progress go to stderr.
@@ -72,3 +160,7 @@ the terminal keeps polling until the login is approved or expires.
 
 Run `ornn --help` for the full command list and `ornn api` for the
 allowlisted compute API escape hatch.
+
+## Updating
+
+The CLI checks the npm registry for a newer version at most once per day and prints a one-line notice on stderr when one exists. Run `ornn update` to install it (the command detects npm, pnpm, yarn, or bun installs). The check is skipped in CI and non-interactive shells.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ornncompute/cli",
-  "version": "0.1.2",
-  "description": "Command-line interface for Ornn bare-metal compute workflows.",
+  "version": "0.1.4",
+  "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {
     "ornn": "bin/ornn.js"

package/src/api-client.mjs

@@ -1,4 +1,4 @@
-import { loadAuthSession } from "./auth-store.mjs";
+import { clearAuthSession, loadAuthSession } from "./auth-store.mjs";
 import { resolveAuthBaseUrl } from "./device-auth.mjs";
 
 export class CliApiError extends Error {
@@ -70,11 +70,80 @@ export async function cliRequest({
   if (raw) {
     const text = await response.text();
     if (!response.ok) {
+      await handleAuthExpiry({ env, response, hadToken: Boolean(authSession?.accessToken) });
       throw new CliApiError(text || response.statusText, { status: response.status });
     }
     return text;
   }
 
+  const text = await response.text();
+  if (!response.ok) {
+    // Clear a dead token before parsing, so a 401 with a non-JSON body
+    // (e.g. a gateway/WAF error page) still triggers the re-login flow.
+    await handleAuthExpiry({ env, response, hadToken: Boolean(authSession?.accessToken) });
+  }
+  const data = text ? parseJson(text, url.toString(), response) : null;
+  if (!response.ok) {
+    const detail = data?.detail ?? data?.error ?? response.statusText;
+    const message = detailMessage(detail) || response.statusText;
+    throw new CliApiError(`Ornn request failed: ${message}`, {
+      detail: data,
+      status: response.status,
+    });
+  }
+  return data;
+}
+
+export function resolveComputeBaseUrl({ env = process.env } = {}) {
+  const base = env.ORNN_COMPUTE_BASE_URL?.trim();
+  if (!base) {
+    throw new CliApiError(
+      "Set ORNN_COMPUTE_BASE_URL to the internal compute service origin to run operator commands.",
+    );
+  }
+  return base.replace(/\/+$/, "");
+}
+
+export function resolveInternalReviewSecret({ env = process.env } = {}) {
+  const secret = env.ORNN_INTERNAL_REVIEW_SECRET?.trim();
+  if (!secret) {
+    throw new CliApiError(
+      "Set ORNN_INTERNAL_REVIEW_SECRET to authenticate operator commands.",
+    );
+  }
+  return secret;
+}
+
+export async function operatorRequest({
+  body,
+  endpoint,
+  env = process.env,
+  fetchImpl = fetch,
+  method = "GET",
+} = {}) {
+  // Operator path: hit compute directly with the review secret (not the tenant /api/cli proxy).
+  const baseUrl = resolveComputeBaseUrl({ env });
+  const secret = resolveInternalReviewSecret({ env });
+  const url = new URL(endpoint, `${baseUrl}/`);
+  const headers = {
+    Accept: "application/json",
+    "X-Internal-Review-Secret": secret,
+  };
+
+  let requestBody;
+  if (body !== undefined) {
+    headers["Content-Type"] = "application/json";
+    requestBody = typeof body === "string" ? body : JSON.stringify(body);
+  }
+
+  let response;
+  try {
+    response = await fetchImpl(url, { body: requestBody, headers, method });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CliApiError(`Could not reach Ornn compute at ${baseUrl}: ${message}`);
+  }
+
   const text = await response.text();
   const data = text ? parseJson(text, url.toString(), response) : null;
   if (!response.ok) {
@@ -119,6 +188,16 @@ function parseJson(text, url, response) {
   }
 }
 
+async function handleAuthExpiry({ env, response, hadToken }) {
+  if (response.status !== 401 || !hadToken) {
+    return;
+  }
+  await clearAuthSession({ env });
+  throw new CliApiError("Your Ornn session has expired or was revoked. Run `ornn login` to sign in again.", {
+    status: 401,
+  });
+}
+
 function detailMessage(detail) {
   if (typeof detail === "string") {
     return detail;