@ornncompute/cli 0.1.5 → 0.1.6

package/README.md

@@ -56,9 +56,9 @@ ornn nodes keys list <node-id> [--json]
 ornn node health <node-id> [--json]
 ornn node diagnose <node-id> [--json]
 ornn node deenroll <node-id> [--reason <text>] [--keep-record] [--json]
-ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--ssh-user ubuntu|admin|ornn] [--json]
-ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--json]
-ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--json]
+ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--ssh-user ubuntu|admin|ornn] [--json]
+ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--json]
+ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--source-user <user>]... [--preserve-user <user>]... [--json]
 ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--json]
 ornn fleet deploy <fleet-id> --tenant <contact-email> --user <email-or-id> [--commerce-reservation <id>] [--network public|private] [--json]
 ornn ssh <node-or-reservation-id> [--print] [--identity-file <path>] [--user <name>] [--json]
@@ -212,11 +212,17 @@ Fleet handoff is an ordered, Compute-backed workflow:
   not trust a key first presented during cleanup.
 - `fleet clean ... --dry-run` tries `ubuntu`, `admin`, then `ornn`, records each
   host's hardware identity and exact deletion plan, and prints one fleet plan
-  hash. Re-running with `--confirm-clean <plan-hash>` removes the approved tenant
+  hash. Repeat `--source-user` for Linux accounts owned by the departing tenant
+  (including an explicitly reviewed orphaned `/home/<user>` directory) and
+  `--preserve-user` for reviewed host accounts. Package/service-owned
+  accounts are protected automatically; any other account stops planning for
+  explicit review. Re-running with `--confirm-clean <plan-hash>` and the same
+  account flags removes the approved tenant
   users, keys, containers/images/volumes/networks/build cache, workload paths,
-  mounts, services, and logs; locks preserved-account passwords, enforces
-  key-only SSH, trims supported filesystems, pins the preserved management
-  account to the supplied key, and stores per-node proof in Compute. A failed
+  mounts, services, and tenant-scoped logs. Apply refuses plans with running
+  containers, locks the management/root passwords, enforces key-only SSH, trims
+  supported filesystems, preserves existing root and management keys and host
+  logs, and stores per-node proof in Compute. A failed
   cleanup can be dry-run again with the same fleet ID; only failed members are
   replanned. Residual GPU
   consumers or tenant/platform listeners fail verification instead of being

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -130,9 +130,9 @@ Usage:
   ornn tokens list [--json]
   ornn tokens create --operator <id> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--force] [--json]
   ornn tokens revoke <token-id> [--json]
-  ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--ssh-user ubuntu|admin|ornn] [--json]
-  ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--json]
-  ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--json]
+  ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--ssh-user ubuntu|admin|ornn] [--json]
+  ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--json]
+  ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--source-user <user>]... [--preserve-user <user>]... [--json]
   ornn fleet enroll <fleet-id> --identity-file <path> [--confirm-takeover <ip[,ip...]>] [--json]
   ornn fleet deploy <fleet-id> --tenant <email> --user <email-or-id> [--commerce-reservation <id>] [--network public|private] [--json]
   ornn reservations withdraw <reservation-id> [--json]
@@ -2193,6 +2193,18 @@ const FLEET_DEFAULT_TIMEOUT_SECONDS = 600;
 const FLEET_RESULT_ERROR_MAX_LENGTH = 4000;
 const FLEET_MANAGEMENT_USERS = ["ubuntu", "admin", "ornn"];
 
+function fleetAccountOptions(value, optionName) {
+  if (!optionProvided(value)) return [];
+  const values = Array.isArray(value) ? value : [value];
+  const normalized = values.map((entry) => String(entry || "").trim());
+  for (const user of normalized) {
+    if (!/^[a-z_][a-z0-9_-]{0,30}\$?$/i.test(user)) {
+      throw new Error(`${optionName} must be a valid Linux account name.`);
+    }
+  }
+  return [...new Set(normalized)].sort();
+}
+
 async function fleet(args, context) {
   const [subcommand, ...rest] = args;
   if (subcommand === "clean") {
@@ -2209,7 +2221,7 @@ async function fleet(args, context) {
 
 async function fleetClean(args, context) {
   const usage =
-    "Usage: ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--ssh-user ubuntu|admin|ornn] OR ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run OR ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash>";
+    "Usage: ornn fleet clean <ip>... --operator <id-or-slug> --ib-island <name> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... [--ssh-user ubuntu|admin|ornn] OR ornn fleet clean <failed-fleet-id> --identity-file <path> --dry-run [--source-user <user>]... [--preserve-user <user>]... OR ornn fleet clean <fleet-id> --identity-file <path> --confirm-clean <plan-hash> [--source-user <user>]... [--preserve-user <user>]...";
   const { options, positionals } = parseOptions(args, {
     boolean: ["dry-run", "json"],
     value: [
@@ -2217,6 +2229,8 @@ async function fleetClean(args, context) {
       "ib-island",
       "identity-file",
       "confirm-clean",
+      "source-user",
+      "preserve-user",
       "ssh-user",
       "ssh-port",
       "parallel",
@@ -2240,6 +2254,12 @@ async function fleetClean(args, context) {
   const timeoutSeconds = optionProvided(options.timeout)
     ? positiveIntegerOption(options.timeout, "--timeout")
     : FLEET_DEFAULT_TIMEOUT_SECONDS;
+  const sourceUsers = fleetAccountOptions(options.sourceUser, "--source-user");
+  const preserveUsers = fleetAccountOptions(options.preserveUser, "--preserve-user");
+  const accountOverlap = sourceUsers.filter((user) => preserveUsers.includes(user));
+  if (accountOverlap.length) {
+    throw new Error(`Users cannot be both source and preserved: ${accountOverlap.join(", ")}.`);
+  }
   const confirmHash = optionalStringOption(options.confirmClean);
   if (confirmHash) {
     if (positionals.length !== 1 || options.dryRun || options.operator || options.ibIsland) {
@@ -2250,7 +2270,11 @@ async function fleetClean(args, context) {
     }
     const fleetId = positionals[0];
     const approved = await operatorRequest({
-      body: { plan_hash: confirmHash },
+      body: {
+        plan_hash: confirmHash,
+        source_users: sourceUsers,
+        preserve_users: preserveUsers,
+      },
       endpoint: `/internal/fleets/${encodeURIComponent(fleetId)}/cleanup/approve`,
       env: context.env,
       fetchImpl: context.fetchImpl,
@@ -2415,21 +2439,22 @@ async function fleetClean(args, context) {
           requestedUser: requestedUser || node.ssh_user || null,
           timeoutSeconds: Math.min(timeoutSeconds, 30),
         });
+        const accountArguments = [
+          ...sourceUsers.map((user) => `--source-user ${shellQuote(user)}`),
+          ...preserveUsers.map((user) => `--preserve-user ${shellQuote(user)}`),
+        ].join(" ");
         const result = await runFleetSshCapture({
           context,
           identityFile,
           ip: node.ip_address,
           port: sshPort,
-          remoteCommand: `sudo -n python3 - plan --management-ip ${node.ip_address} --management-user ${sshUser} --management-public-key-b64 ${managementPublicKeyB64}`,
+          remoteCommand: `sudo -n python3 - plan --management-ip ${node.ip_address} --management-user ${sshUser} --management-public-key-b64 ${managementPublicKeyB64}${accountArguments ? ` ${accountArguments}` : ""}`,
           stdin: runner.script,
           timeoutSeconds,
           user: sshUser,
         });
-        if (result.exitCode !== 0) {
-          throw new Error(result.stderr || "Cleanup plan failed.");
-        }
         const payload = fleetCleanupJson(result.stdout);
-        if (!payload.plan || !payload.plan_hash) {
+        if (result.exitCode !== 0 || !payload.plan || !payload.plan_hash) {
           throw new Error(payload.error || result.stderr || "Cleanup plan failed.");
         }
         return {
@@ -2484,6 +2509,10 @@ async function fleetClean(args, context) {
         `${planningError} Fleet ${fleetRecord.id} was marked failed, but its local manifest could not be saved: ${fleetResultError(manifestError)}`,
       );
     }
+    if (options.json) {
+      writeJson(context.stdout, { error: planningError, fleet: failedFleet });
+      return 1;
+    }
     throw new Error(`${planningError} Fleet ${fleetRecord.id} was marked failed.`);
   }
   await saveFleetManifest(recorded.fleet, context.env);
@@ -2499,7 +2528,7 @@ async function fleetClean(args, context) {
     }
     context.stdout.write(`Cleanup plan: ${recorded.plan_hash}\n`);
     context.stdout.write(
-      `Approve exactly this plan with: ornn fleet clean ${fleetRecord.id} --identity-file ${shellQuote(identityFile)} --confirm-clean ${recorded.plan_hash}\n`
+      `Approve exactly this plan with: ornn fleet clean ${fleetRecord.id} --identity-file ${shellQuote(identityFile)} --confirm-clean ${recorded.plan_hash}${sourceUsers.map((user) => ` --source-user ${shellQuote(user)}`).join("")}${preserveUsers.map((user) => ` --preserve-user ${shellQuote(user)}`).join("")}\n`
     );
   }
   return 0;