@ornncompute/cli 0.2.16 → 0.2.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "0.2.16",
+  "version": "0.2.17",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/update.mjs

@@ -125,7 +125,7 @@ export function detectInstallContext(binPath, env = process.env) {
   if (isNpmGlobalInstall(lower, env)) {
     return { kind: "npm", binPath: resolved };
   }
-  if (isProjectInstall(resolved, lower)) {
+  if (isProjectInstall(resolved)) {
     return { kind: "project", binPath: resolved };
   }
   if (has(".bun") || isUnderDir(lower, env.BUN_INSTALL)) {
@@ -140,14 +140,15 @@ export function detectInstallContext(binPath, env = process.env) {
   return { kind: "npm", binPath: resolved };
 }
 
-function isProjectInstall(resolvedPath, lower) {
+function isProjectInstall(resolvedPath) {
   // Global layouts have no package.json above node_modules; projects do.
-  const index = lower.indexOf("/node_modules/");
-  if (index < 0) {
+  const parts = resolvedPath.replaceAll("\\", "/").split("/");
+  const index = parts.findIndex((segment) => segment.toLowerCase() === "node_modules");
+  if (index <= 0) {
     return false;
   }
   try {
-    return existsSync(join(resolvedPath.slice(0, index), "package.json"));
+    return existsSync(join(parts.slice(0, index).join("/"), "package.json"));
   } catch {
     return false;
   }
@@ -212,9 +213,13 @@ function stableInstallRoot(binPath) {
   try {
     resolved = realpathSync(binPath);
   } catch {}
-  const normalized = resolved.replaceAll("\\", "/");
-  const markerIndex = normalized.toLowerCase().indexOf("/node_modules/");
-  return markerIndex > 0 ? normalized.slice(0, markerIndex) : null;
+  const parts = resolved.replaceAll("\\", "/").split("/");
+  const index = parts.findIndex((segment) => segment.toLowerCase() === "node_modules");
+  if (index <= 0) {
+    return null;
+  }
+  const prefix = parts.slice(0, index).join("/");
+  return prefix.length > 0 ? prefix : null;
 }
 
 function pathIdentity(path) {

package/vendor/capabilities/capabilities/staff-access.js

@@ -200,7 +200,21 @@ export const sshKeyAddCapability = defineStaffMcpCapability({
         // (gateway `add_reservation_key`), which this tool previously bypassed by
         // posting `public_key` into a body that only reads `sshKeyId`/`userId`.
         let sshKeyId = parsed.sshKeyId;
-        if (!sshKeyId) {
+        if (sshKeyId) {
+            // Commerce stores the id as a soft key without checking authorization,
+            // so gate it here the way gateway `add_reservation_key` does.
+            const listed = (await ctx.fetch(`/v1/organizations/${seg(parsed.tenantId)}/ssh-keys`, {
+                method: "GET",
+            }));
+            const key = (listed.ssh_keys ?? []).find((candidate) => candidate.id === sshKeyId);
+            if (!key) {
+                throw new Error("SSH key not found.");
+            }
+            if (key.status !== "active" || key.revoked_at) {
+                throw new Error("SSH key is not active.");
+            }
+        }
+        else {
             const registered = (await ctx.fetch(`/v1/organizations/${seg(parsed.tenantId)}/ssh-keys`, {
                 method: "POST",
                 body: { public_key: parsed.publicKey, ...mapBody(parsed, { label: "label" }) },