@ornncompute/cli 0.1.4 → 0.1.6

package/README.md

@@ -17,9 +17,10 @@ curl -fsSL https://compute.ornn.com/cli/install | sh
 
 The installer requires Node.js 20 or newer and npm. It installs `@ornncompute/cli`
 globally, exposes the `ornn` binary, adds the npm global bin directory to the
-user's shell profile when needed, and writes
-`ORNN_AUTH_BASE_URL` for the Ornn host that served the installer. The
-installer prints a short Ornn Compute welcome banner and login prompt; set
+user's shell profile when needed, and records the Ornn host that served it as
+`authBaseUrl` in `~/.config/ornn/config.json`, so `ornn login` reaches the right
+host from the shell that ran the installer. The
+installer prints a short Ornn Compute welcome banner and next steps; set
 `ORNN_INSTALL_BANNER=0` to skip it or `ORNN_INSTALL_ANIMATION=0` to keep it
 static.
 
@@ -35,28 +36,31 @@ ornn listings list [--gpu-type <type>] [--facility <name>] [--operator <name>] [
 ornn listings show <listing-id> [--open] [--json]
 ornn buy <listing-id> [--no-open] [--json]
 ornn exchange create <listing-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]
-ornn exchange list [--json]
+ornn exchange list [--limit <1-500>] [--cursor <last-id>] [--json]
 ornn exchange show <bid-id> [--open] [--json]
 ornn exchange update <bid-id> --gpu-count <n> --min-gpu-count <n> --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd>
 ornn exchange withdraw <bid-id>
-ornn gpus list [--status <status>] [--json]
+ornn gpus list [--status <status>] [--limit <1-500>] [--cursor <last-id>] [--json]
 ornn gpus show <reservation-id> [--open] [--json]
 ornn gpus checkout <reservation-id> [--no-open] [--json]
 ornn nodes list [--json]
 ornn nodes show <node-id> [--json]
 ornn nodes launch <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--json]
+ornn nodes switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]
 ornn nodes wait <node-or-reservation-id> [--timeout <seconds>] [--json]
-ornn nodes start <node-id> [--json]
-ornn nodes stop <node-id> [--json]
-ornn nodes teardown <node-id> [--json]
-ornn nodes revoke <node-id> [--json]
+ornn nodes reboot <node-id> [--json]
+ornn nodes hard-reset <node-id> [--json]
 ornn nodes ssh-command <node-or-reservation-id> [--json]
 ornn nodes keys attach <node-id> --key <path|id|label> [--json]
 ornn nodes keys list <node-id> [--json]
 ornn node health <node-id> [--json]
 ornn node diagnose <node-id> [--json]
-ornn node drain <node-id> [--reason <text>] [--json]
-ornn node restore <node-id> [--reason <text>] [--json]
+ornn node deenroll <node-id> [--reason <text>] [--keep-record] [--json]
+ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--ssh-user ubuntu|admin|ornn] [--json]
+ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--json]
+ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--source-user <user>]... [--preserve-user <user>]... [--json]
+ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--json]
+ornn fleet deploy <fleet-id> --tenant <contact-email> --user <email-or-id> [--commerce-reservation <id>] [--network public|private] [--json]
 ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]
 ornn metrics nodes [--json]
 ornn metrics node <node-id> [--json]
@@ -75,6 +79,16 @@ ornn clusters ssh <reservation-id> [--print] [--identity-file <path>] [--user <n
 ornn clusters add-node <reservation-id> --node <node-id> [--json]
 ornn clusters remove-node <reservation-id> --node <node-id> [--json]
 ornn clusters teardown <reservation-id> [--type kubernetes|slurm] [--json]
+ornn slurm launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]
+ornn slurm teardown <reservation-id> [--json]
+ornn slurm status <reservation-id> [--json]
+ornn slurm credentials <reservation-id> [--json]
+ornn slurm ssh <reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]
+ornn kubernetes launch <reservation-id> [--network public|private] [--node <node-id>] [--node-count <n>] [--wait] [--wait-timeout <seconds>] [--json]
+ornn kubernetes teardown <reservation-id> [--json]
+ornn kubernetes status <reservation-id> [--json]
+ornn kubernetes credentials <reservation-id> [--json]
+ornn kubernetes kubeconfig <reservation-id> [--output <path>] [--json]
 ornn networks list [--json]
 ornn networks show <network-id> [--json]
 ornn networks create --name <name> [--cidr <cidr>] [--description <text>] [--json]
@@ -91,6 +105,8 @@ ornn storage volumes clear <drive-id> [--json]
 ornn storage volumes delete <drive-id> [--json]
 ornn storage deploy <drive-id> --reservation <reservation-id> [--mount-path <path>] [--read-only|--read-write] [--json]
 ornn storage deploy status --reservation <reservation-id> [--json]
+ornn storage unmount --reservation <reservation-id> [--json]
+ornn storage undeploy --reservation <reservation-id> [--json]
 ornn storage buckets list [--json]
 ornn storage buckets show <drive-id> [--json]
 ornn storage buckets connect gcs|s3|r2 --bucket <bucket>|--url <url> [--name <name>] [--prefix <prefix>] [--region <region>] [--account-id <id>|--endpoint-url <url>] [--access-key-id <id> --secret-access-key-file <path>] [--read-only|--read-write] [--verify] [--json]
@@ -102,6 +118,7 @@ ornn keys add [<public-key-file>] [--public-key <key>] [--label <label>] [--json
 ornn keys delete <key-id> [--json]
 ornn access show <reservation-id> [--json]
 ornn access activate <reservation-id> --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--network public|private] [--storage-load-drive-id <id>] [--storage-save-drive-id <id>] [--wait] [--no-open] [--json]
+ornn access switch <reservation-id> --network public|private --key <path|id|label> [--mode bare-metal|vm] [--username <name>] [--wait] [--json]
 ornn access push-keys <reservation-id> --ssh-key-id <id> [--json]
 ornn access keys list <reservation-id> [--json]
 ornn access keys add <reservation-id> --public-key <key> [--label <label>] [--json]
@@ -120,33 +137,141 @@ ornn api <get|post|patch|put|delete> <compute-path> [--data <json>] [--raw]
 ornn logout
 ```
 
+`ornn access keys add` is safe before or after launch. When the reservation has
+active VM or Bare Metal machines, adding the key automatically queues the
+current user's complete reservation key set on those machines. Use
+`ornn access keys push` to explicitly re-sync keys that are already attached.
+
+`ornn storage deploy status` prints reconciled object and byte progress once the
+managed transfer has reported progress. AWS S3 and external GCS sources use the
+managed transfer path. Cloudflare R2 support is coming soon.
+
 UI aliases are first-class in the CLI: `listings` maps to the older
 `availability` command, `exchange` maps to `bid`, and `gpus` maps to
 `reservations`. The older command names remain available for scripts.
+Bid and reservation list commands return a bounded page (500 rows by default);
+use `--limit` and `--cursor` to traverse older history. Pass the final row ID
+from one page as the next page's cursor. `show` and `checkout`
+use exact tenant-owned item lookups, so they are not limited to the current page.
 
 ## Operator commands
 
 The `ornn node` commands are for Ornn operators and reviewers, not tenants. They
-strictly wrap the internal-reviewer-gated compute endpoints, so they do not use
-the tenant CLI login. Instead they talk to the compute service directly and
-authenticate with the shared reviewer secret:
+wrap internal-reviewer-gated compute endpoints. Prefer `ornn login` as an
+internal-allowed staff user (`ORNN_AUTH_BASE_URL`); the CLI calls
+`/api/cli/operator/*` and the web server attaches the review secret — it never
+downloads to the laptop. Optionally set `ORNN_INTERNAL_REVIEW_SECRET` plus
+`ORNN_COMPUTE_BASE_URL` for direct compute access (CI / break-glass):
 
 - `ornn node health <node-id>` shows launch readiness (ready/blocked plus
   reasons), passive fault reasons, and the last validation status.
-- `ornn node diagnose <node-id>` queues an active health run for the node.
-- `ornn node drain <node-id>` / `ornn node restore <node-id>` take the node out
-  of and back into service. Both accept an optional `--reason`.
+- `ornn node diagnose <node-id>` queues a manual node validation test.
+- `ornn node list [--operator <id-or-slug>] [--facility <id>]` lists GPU nodes,
+  optionally filtered by operator and/or facility. A UUID operator is matched by
+  id; anything else is treated as the operator slug.
+- `ornn node reboot <node-id>` queues an OS reboot of the host backing the node
+  (storage and SSH keys preserved).
+- `ornn node hard-reset <node-id>` wipes tenant storage/users and reboots, then
+  re-pushes the tenant's keys on reconnect. The tenant keeps ownership of the
+  host.
+- `ornn node off-grid <node-id> [--reason <text>]` queues the agentless handoff
+  that removes Ornn agent management from the still-powered-on host.
+- `ornn node on-grid <node-id>` re-enrolls an off-grid host (SSH in with the
+  stored admin key and re-run the installer) to restore Ornn management.
+- `ornn node terminate <node-id> [--reason <text>] [--force]` best-effort cleans
+  the host, removes the Ornn agent, and hard-deletes the node record from the
+  platform. It does not return the host to a tenant.
+- `ornn node admin-key <node-id>` prints the Ornn admin SSH keypair for the node
+  (including the private key) so an operator can SSH into the host. Treat the
+  output as a secret.
+- `ornn node deenroll <node-id>` removes a node from the environment: it first
+  gracefully terminates the enrollment (revokes the node claim, retires any
+  listing, and queues the node-agent self-uninstall packet), then dereferences
+  (hard-deletes) the `gpu_nodes` record so nothing lingers. Pass `--keep-record`
+  to stop after termination and leave the row in a `deenrolled` state, or
+  `--reason <text>` to annotate the audit log. The command is idempotent: an
+  already-removed node reports success. Terminate is forced by default so a
+  dead/unreachable node does not block on workload drain.
+
+The operator resource commands share the same reviewer auth:
+
+- `ornn operators list` lists enrolled operators.
+- `ornn facilities list [--operator <id-or-slug>]` lists facilities, optionally
+  filtered to one operator.
+- `ornn tokens list` lists enrollment tokens.
+- `ornn tokens create --operator <id> [--facility <id>]
+  [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>]` mints an
+  enrollment token and prints a ready-to-run `curl … | sudo bash` install
+  command.
+- `ornn tokens revoke <token-id>` revokes an enrollment token.
+
+Fleet handoff is an ordered, Compute-backed workflow:
+
+- Before first contact, independently verify each host key and add it to the
+  operator's SSH `known_hosts`; fleet SSH uses strict host-key checking and will
+  not trust a key first presented during cleanup.
+- `fleet clean ... --dry-run` tries `ubuntu`, `admin`, then `ornn`, records each
+  host's hardware identity and exact deletion plan, and prints one fleet plan
+  hash. Repeat `--source-user` for Linux accounts owned by the departing tenant
+  (including an explicitly reviewed orphaned `/home/<user>` directory) and
+  `--preserve-user` for reviewed host accounts. Package/service-owned
+  accounts are protected automatically; any other account stops planning for
+  explicit review. Re-running with `--confirm-clean <plan-hash>` and the same
+  account flags removes the approved tenant
+  users, keys, containers/images/volumes/networks/build cache, workload paths,
+  mounts, services, and tenant-scoped logs. Apply refuses plans with running
+  containers, locks the management/root passwords, enforces key-only SSH, trims
+  supported filesystems, preserves existing root and management keys and host
+  logs, and stores per-node proof in Compute. A failed
+  cleanup can be dry-run again with the same fleet ID; only failed members are
+  replanned. Residual GPU
+  consumers or tenant/platform listeners fail verification instead of being
+  silently accepted.
+- `fleet enroll <fleet-id>` refuses nodes without successful cleanup proof,
+  issues and revokes one cleanup-bound token per host, installs the agent,
+  assigns the IB island, verifies the same management account still has
+  key-based SSH and passwordless sudo, and records the resulting GPU node IDs
+  in Compute. Generic enrollment tokens retain the legacy enrollment sanitizer.
+- `fleet deploy <fleet-id> --tenant <contact-email> --user <email-or-id>
+  [--commerce-reservation <id>]` validates the exact tenant/user and, when
+  supplied, the Commerce reservation. It succeeds only after every selected
+  user's SSH key is installed on every running node and passwordless sudo is
+  reported ready.
+
+Compute Postgres is authoritative; the mode-0600 files under
+`~/.config/ornn/fleets/` are only a secret-free cache. Cleanup proves “no
+observable residue under the verification scope,” not certified physical-media
+erasure. Root is never the preserved management account. `--confirm-takeover`
+names only fleet IPs whose existing node claims may be replaced. The IB-island
+is a locality label, not cluster creation. Test scheduling remains a separate
+control-plane policy.
+
+Reservation lifecycle verbs also run under the operator surface:
+
+- `ornn reservations withdraw <reservation-id>` withdraws a reservation's
+  acceptance, returning the node(s) to tenant inventory.
+- `ornn reservations transfer <reservation-id> --target-tenant <id>
+  [--target-user <id>] [--node <id>] [--strategy reject|park] [--confirm]`
+  transfers a reservation to another tenant.
+- `ornn reservations deploy <node-id> --target-tenant <id> [--target-user <id>]
+  [--network public|private]` deploys a node into a tenant's inventory.
 
-Set these environment variables before running them:
+The tenant `ornn reservations list|show|checkout` verbs still use the tenant CLI
+login and `/api/cli` proxy; `withdraw|transfer|deploy` use the operator path
+above (staff session proxy or optional review secret).
 
-- `ORNN_COMPUTE_BASE_URL` — origin of the internal compute service (for example
-  `http://localhost:8000`). The review secret travels as a request header, so
-  in any non-local deployment this should be an `https://` origin.
-- `ORNN_INTERNAL_REVIEW_SECRET` — the reviewer secret, sent as the
-  `X-Internal-Review-Secret` header.
+Staff happy path:
 
-If either is missing the command fails with a clear error before making any
-network request.
+- `ORNN_AUTH_BASE_URL` — web/auth origin
+- `ornn login` as a user allowed by `INTERNAL_ALLOWED_*` on that environment
+
+Optional direct compute override:
+
+- `ORNN_COMPUTE_BASE_URL` — compute origin (for example `http://localhost:8000`)
+- `ORNN_INTERNAL_REVIEW_SECRET` — reviewer secret (`X-Internal-Review-Secret`)
+
+Without a staff login session or the review-secret pair, operator commands fail
+with a clear error before making a network request.
 
 Commands print concise human-readable output by default. Use `--json` on
 read/show/list commands and transaction handoffs when you need structured
@@ -161,6 +286,19 @@ the terminal keeps polling until the login is approved or expires.
 Run `ornn --help` for the full command list and `ornn api` for the
 allowlisted compute API escape hatch.
 
+WireGuard client configs use the current tenant-scoped `/nodes` routes:
+
+```bash
+ornn api get /nodes/reservations/<reservation-id>/vpn/peers --raw
+ornn api post /nodes/reservations/<reservation-id>/vpn/peers \
+  --data '{"public_key":"<wireguard-public-key>","label":"Laptop"}' --raw
+ornn api delete /nodes/reservations/<reservation-id>/vpn/peers/<peer-id> --raw
+```
+
+The legacy `/standalone-vms/*` prefix is not exposed through the CLI proxy.
+Deleting a peer is the supported way to replace its key; switching a node
+between Public and Private VPN preserves the peer.
+
 ## Updating
 
 The CLI checks the npm registry for a newer version at most once per day and prints a one-line notice on stderr when one exists. Run `ornn update` to install it (the command detects npm, pnpm, yarn, or bun installs). The check is skipped in CI and non-interactive shells.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/api-client.mjs

@@ -1,4 +1,4 @@
-import { clearAuthSession, loadAuthSession } from "./auth-store.mjs";
+import { clearAuthSession, configuredAuthBaseUrl, loadAuthSession } from "./auth-store.mjs";
 import { resolveAuthBaseUrl } from "./device-auth.mjs";
 
 export class CliApiError extends Error {
@@ -11,13 +11,22 @@ export class CliApiError extends Error {
 }
 
 export function resolveApiBaseUrl({ env = process.env, explicit, session } = {}) {
-  return (
-    explicit?.trim() ||
-    env.ORNN_API_BASE_URL?.trim() ||
-    env.ORNN_AUTH_BASE_URL?.trim() ||
-    session?.authBaseUrl?.trim() ||
-    resolveAuthBaseUrl({ env })
-  ).replace(/\/+$/, "");
+  // Prefer the first configured source; do not fall through when it strips empty.
+  const candidates = [
+    [explicit, "API base URL"],
+    [env.ORNN_API_BASE_URL, "ORNN_API_BASE_URL"],
+    [env.ORNN_AUTH_BASE_URL, "ORNN_AUTH_BASE_URL"],
+    [session?.authBaseUrl, "session authBaseUrl"],
+  ];
+  for (const [value, sourceName] of candidates) {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+      continue;
+    }
+    return requireValidBaseUrl(trimmed, sourceName);
+  }
+
+  return requireValidBaseUrl(resolveAuthBaseUrl({ env }), "API base URL");
 }
 
 export async function loadRequiredSession({ env = process.env } = {}) {
@@ -101,32 +110,111 @@ export function resolveComputeBaseUrl({ env = process.env } = {}) {
       "Set ORNN_COMPUTE_BASE_URL to the internal compute service origin to run operator commands.",
     );
   }
-  return base.replace(/\/+$/, "");
+  return requireValidBaseUrl(base, "ORNN_COMPUTE_BASE_URL");
+}
+
+/**
+ * Origin used in `curl …/enrollment/install` one-liners.
+ *
+ * Prefer an explicit compute/installer URL. When staff use the web operator
+ * proxy (no local review secret), derive compute from the auth/web origin:
+ *   - `https://<slug>.fabric.ornn.com` → `https://<slug>-api.fabric.ornn.com`
+ *   - `https://compute.ornn.com` → `https://api-compute.ornn.com`
+ *   - `http://localhost:3000` → `http://localhost:8000`
+ */
+export function resolveInstallerBaseUrl({ env = process.env, session } = {}) {
+  const explicit =
+    env.ORNN_INSTALLER_URL?.trim() ||
+    env.ORNN_COMPUTE_BASE_URL?.trim() ||
+    env.NEXT_PUBLIC_INSTALLER_URL?.trim();
+  if (explicit) {
+    return requireValidBaseUrl(explicit, "installer base URL");
+  }
+
+  // The session records where the caller actually logged in, so it outranks the
+  // installed default.
+  const authCandidates = [
+    env.ORNN_AUTH_BASE_URL,
+    env.ORNN_API_BASE_URL,
+    session?.authBaseUrl,
+    configuredAuthBaseUrl(env),
+  ];
+  for (const candidate of authCandidates) {
+    const trimmed = candidate?.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const authOrigin = requireValidBaseUrl(trimmed, "ORNN_AUTH_BASE_URL");
+    return deriveInstallerOriginFromAuth(authOrigin);
+  }
+  return null;
+}
+
+function deriveInstallerOriginFromAuth(authOrigin) {
+  const url = new URL(authOrigin);
+  if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
+    url.port = "8000";
+    url.protocol = "http:";
+    return url.origin;
+  }
+  const fabricMatch = url.hostname.match(/^([a-z0-9-]+)\.fabric\.ornn\.com$/i);
+  if (fabricMatch && !fabricMatch[1].endsWith("-api")) {
+    url.hostname = `${fabricMatch[1]}-api.fabric.ornn.com`;
+    return url.origin;
+  }
+  if (url.hostname === "compute.ornn.com") {
+    url.hostname = "api-compute.ornn.com";
+    return url.origin;
+  }
+  return url.origin;
 }
 
 export function resolveInternalReviewSecret({ env = process.env } = {}) {
   const secret = env.ORNN_INTERNAL_REVIEW_SECRET?.trim();
   if (!secret) {
     throw new CliApiError(
-      "Set ORNN_INTERNAL_REVIEW_SECRET to authenticate operator commands.",
+      "Set ORNN_INTERNAL_REVIEW_SECRET to authenticate operator commands, or run `ornn login` as Ornn staff.",
     );
   }
   return secret;
 }
 
-export async function operatorRequest({
+function operatorProxyEndpoint(endpoint) {
+  return `/api/cli/operator${normalizeComputePath(endpoint)}`;
+}
+
+async function operatorRequestViaStaffSession({
+  body,
+  endpoint,
+  env = process.env,
+  fetchImpl = fetch,
+  method = "GET",
+} = {}) {
+  // Staff path: CLI bearer → web /api/cli/operator → compute with server-side review secret.
+  return cliRequest({
+    body,
+    endpoint: operatorProxyEndpoint(endpoint),
+    env,
+    fetchImpl,
+    method,
+    authRequired: true,
+  });
+}
+
+async function operatorRequestViaReviewSecret({
   body,
   endpoint,
   env = process.env,
   fetchImpl = fetch,
   method = "GET",
 } = {}) {
-  // Operator path: hit compute directly with the review secret (not the tenant /api/cli proxy).
+  // Break-glass / CI: hit compute directly with the review secret.
   const baseUrl = resolveComputeBaseUrl({ env });
   const secret = resolveInternalReviewSecret({ env });
   const url = new URL(endpoint, `${baseUrl}/`);
   const headers = {
     Accept: "application/json",
+    "X-Internal-Actor": env.ORNN_INTERNAL_ACTOR?.trim() || "break-glass-cli",
     "X-Internal-Review-Secret": secret,
   };
 
@@ -157,6 +245,32 @@ export async function operatorRequest({
   return data;
 }
 
+export async function operatorRequest({
+  body,
+  endpoint,
+  env = process.env,
+  fetchImpl = fetch,
+  method = "GET",
+} = {}) {
+  // Prefer an explicit review secret (CI / break-glass). Otherwise use a staff
+  // `ornn login` session through the web operator proxy — the secret never
+  // leaves the server.
+  if (env.ORNN_INTERNAL_REVIEW_SECRET?.trim()) {
+    return operatorRequestViaReviewSecret({ body, endpoint, env, fetchImpl, method });
+  }
+
+  const session = await loadAuthSession({ env });
+  if (session?.accessToken) {
+    return operatorRequestViaStaffSession({ body, endpoint, env, fetchImpl, method });
+  }
+
+  throw new CliApiError(
+    "Operator commands need Ornn staff auth: run `ornn login` as an internal user " +
+      "(ORNN_AUTH_BASE_URL), or set ORNN_INTERNAL_REVIEW_SECRET (+ ORNN_COMPUTE_BASE_URL) for direct compute access.",
+    { status: 401 },
+  );
+}
+
 export function computeEndpoint(path) {
   const normalized = normalizeComputePath(path);
   return `/api/cli/compute${normalized}`;
@@ -173,6 +287,28 @@ export function normalizeComputePath(path) {
   return trimmed;
 }
 
+function requireValidBaseUrl(raw, sourceName) {
+  const stripped = raw.replace(/\/+$/, "");
+  if (!stripped) {
+    throw new CliApiError(
+      `${sourceName} must be a valid origin (got empty value after removing trailing slashes).`,
+    );
+  }
+  let parsed;
+  try {
+    parsed = new URL(stripped);
+  } catch {
+    throw new CliApiError(`${sourceName} must be a valid origin (got ${JSON.stringify(raw)}).`);
+  }
+  // Path/search/hash are dropped when composing absolute endpoints against this base.
+  if (parsed.pathname !== "/" || parsed.search || parsed.hash) {
+    throw new CliApiError(
+      `${sourceName} must be a valid origin with no path (got ${JSON.stringify(raw)}).`,
+    );
+  }
+  return stripped;
+}
+
 function parseJson(text, url, response) {
   try {
     return JSON.parse(text);

package/src/auth-store.mjs

@@ -1,9 +1,12 @@
+import { readFileSync } from "node:fs";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { homedir } from "node:os";
 
 const APP_DIR = "ornn";
 const AUTH_FILE = "auth.json";
+const CONFIG_FILE = "config.json";
+const FLEETS_DIR = "fleets";
 
 export function getAuthConfigDir(env = process.env) {
   if (env.ORNN_CONFIG_HOME?.trim()) {
@@ -21,6 +24,24 @@ export function getAuthConfigPath(env = process.env) {
   return join(getAuthConfigDir(env), AUTH_FILE);
 }
 
+export function getCliConfigPath(env = process.env) {
+  return join(getAuthConfigDir(env), CONFIG_FILE);
+}
+
+export function getFleetConfigDir(env = process.env) {
+  return join(getAuthConfigDir(env), FLEETS_DIR);
+}
+
+// Read synchronously so callers resolving a base URL stay synchronous.
+export function configuredAuthBaseUrl(env = process.env) {
+  try {
+    const value = JSON.parse(readFileSync(getCliConfigPath(env), "utf8"))?.authBaseUrl;
+    return typeof value === "string" ? value.trim() : "";
+  } catch {
+    return "";
+  }
+}
+
 export async function loadAuthSession({ env = process.env } = {}) {
   const path = getAuthConfigPath(env);