@ornncompute/cli 0.2.16 → 0.2.18

package/README.md

@@ -271,12 +271,15 @@ path.
 
 The operator resource commands share the same reviewer auth:
 
-- `ornn operators list` lists enrolled operators.
+- `ornn operator list [--json]` lists operators from the capabilities
+  catalog (staff). Distinct from `ornn operators list`.
+- `ornn operators list` lists enrolled provisioning operators
+  (`GET /provisioning/operators`).
 - `ornn facilities list [--operator <id-or-slug>]` lists facilities, optionally
   filtered to one operator.
 - `ornn tokens list` lists enrollment tokens.
 - `ornn tokens create --operator <id> [--facility <id>]
-[--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--host <ip>]
+[--expires-in <seconds>] [--ip <addr>] [--host <ip>]
 [--identity-file <path>] [--yes]` mints an enrollment token and prints a
   `curl … | sudo bash` install command. With `--host` and `--identity-file`,
   orchestrator SSHs and runs that curl (same as Bulk Enroll). Asks y/N unless `--yes`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "0.2.16",
+  "version": "0.2.18",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -165,7 +165,7 @@ Usage:
   ornn operators list [--json]
   ornn facilities list [--operator <id-or-slug>] [--json]
   ornn tokens list [--json]
-  ornn tokens create --operator <id> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--host <ip>] [--identity-file <path>] [--yes] [--json]
+  ornn tokens create --operator <id> [--facility <id>] [--expires-in <seconds>] [--ip <addr>] [--host <ip>] [--identity-file <path>] [--yes] [--json]
   ornn tokens revoke <token-id> [--json]
   ornn reservations transfer <reservation-id> --target-tenant <id> [--target-user <id>] [--node <id>] [--strategy reject|park] [--confirm] [--json]
   ornn reservations commerce list --tenant <email-or-id> [--listing <listing-id>] [--json]
@@ -2467,12 +2467,12 @@ async function tokensCommand(args, context) {
 
   if (subcommand === "create") {
     const createUsage =
-      "Usage: ornn tokens create --operator <id-or-slug> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--host <ip>] [--identity-file <path>] [--yes] [--json]";
+      "Usage: ornn tokens create --operator <id-or-slug> [--facility <id>] [--expires-in <seconds>] [--ip <addr>] [--host <ip>] [--identity-file <path>] [--yes] [--json]";
     const options = parseCommandOptions(
       rest,
       {
         boolean: ["json", "force", "yes"],
-        value: ["operator", "facility", "expires-in", "mode", "ip", "host", "identity-file"],
+        value: ["operator", "facility", "expires-in", "ip", "host", "identity-file"],
       },
       createUsage
     );
@@ -2495,7 +2495,6 @@ async function tokensCommand(args, context) {
         ...(optionalStringOption(options.expiresIn)
           ? { expires_in_seconds: Number.parseInt(optionalStringOption(options.expiresIn), 10) }
           : {}),
-        ...(optionalStringOption(options.mode) ? { node_mode: optionalStringOption(options.mode) } : {}),
         ...(optionalStringOption(options.ip) ? { ip: optionalStringOption(options.ip) } : {}),
         ...(optionalStringOption(options.host) ? { host: optionalStringOption(options.host) } : {}),
         ...(privateKey ? { private_key: privateKey } : {}),

package/src/update.mjs

@@ -125,7 +125,7 @@ export function detectInstallContext(binPath, env = process.env) {
   if (isNpmGlobalInstall(lower, env)) {
     return { kind: "npm", binPath: resolved };
   }
-  if (isProjectInstall(resolved, lower)) {
+  if (isProjectInstall(resolved)) {
     return { kind: "project", binPath: resolved };
   }
   if (has(".bun") || isUnderDir(lower, env.BUN_INSTALL)) {
@@ -140,14 +140,15 @@ export function detectInstallContext(binPath, env = process.env) {
   return { kind: "npm", binPath: resolved };
 }
 
-function isProjectInstall(resolvedPath, lower) {
+function isProjectInstall(resolvedPath) {
   // Global layouts have no package.json above node_modules; projects do.
-  const index = lower.indexOf("/node_modules/");
-  if (index < 0) {
+  const parts = resolvedPath.replaceAll("\\", "/").split("/");
+  const index = parts.findIndex((segment) => segment.toLowerCase() === "node_modules");
+  if (index <= 0) {
     return false;
   }
   try {
-    return existsSync(join(resolvedPath.slice(0, index), "package.json"));
+    return existsSync(join(parts.slice(0, index).join("/"), "package.json"));
   } catch {
     return false;
   }
@@ -212,9 +213,13 @@ function stableInstallRoot(binPath) {
   try {
     resolved = realpathSync(binPath);
   } catch {}
-  const normalized = resolved.replaceAll("\\", "/");
-  const markerIndex = normalized.toLowerCase().indexOf("/node_modules/");
-  return markerIndex > 0 ? normalized.slice(0, markerIndex) : null;
+  const parts = resolved.replaceAll("\\", "/").split("/");
+  const index = parts.findIndex((segment) => segment.toLowerCase() === "node_modules");
+  if (index <= 0) {
+    return null;
+  }
+  const prefix = parts.slice(0, index).join("/");
+  return prefix.length > 0 ? prefix : null;
 }
 
 function pathIdentity(path) {

package/vendor/capabilities/capabilities/staff-access.js

@@ -200,7 +200,21 @@ export const sshKeyAddCapability = defineStaffMcpCapability({
         // (gateway `add_reservation_key`), which this tool previously bypassed by
         // posting `public_key` into a body that only reads `sshKeyId`/`userId`.
         let sshKeyId = parsed.sshKeyId;
-        if (!sshKeyId) {
+        if (sshKeyId) {
+            // Commerce stores the id as a soft key without checking authorization,
+            // so gate it here the way gateway `add_reservation_key` does.
+            const listed = (await ctx.fetch(`/v1/organizations/${seg(parsed.tenantId)}/ssh-keys`, {
+                method: "GET",
+            }));
+            const key = (listed.ssh_keys ?? []).find((candidate) => candidate.id === sshKeyId);
+            if (!key) {
+                throw new Error("SSH key not found.");
+            }
+            if (key.status !== "active" || key.revoked_at) {
+                throw new Error("SSH key is not active.");
+            }
+        }
+        else {
             const registered = (await ctx.fetch(`/v1/organizations/${seg(parsed.tenantId)}/ssh-keys`, {
                 method: "POST",
                 body: { public_key: parsed.publicKey, ...mapBody(parsed, { label: "label" }) },