@ornncompute/cli 0.2.2 → 0.2.4

package/README.md

@@ -44,6 +44,7 @@ ornn whoami [--json]
 ornn status [--json]
 ornn listings list [--gpu-type <type>] [--facility <name>] [--operator <name>] [--json]
 ornn listings show <listing-id> [--open] [--json]
+ornn listings create [--gpu-type <type>] [--node-count <n>] [--yes] [--json]
 ornn buy <listing-id> [--no-open] [--json]
 ornn exchange create <listing-id> --node-count <n> [--min-node-count <n>] --start-date <yyyy-mm-dd> --end-date <yyyy-mm-dd> --price <usd> [--no-open] [--json]
 ornn exchange list [--limit <1-500>] [--cursor <last-id>] [--json]
@@ -74,11 +75,11 @@ ornn node diagnose <node-id> [--json]
 ornn node list [--operator <id-or-slug>] [--facility <id>] [--json]
 ornn node reboot <node-id> [--json]
 ornn node hard-reset <node-id> [--json]
-ornn node off-grid <node-id> [--json]
-ornn node on-grid <node-id> [--json]
-ornn node terminate <node-id> [--reason <text>] [--force] [--json]
+ornn node off-grid <node-id> [--reason <text>] [--yes] [--json]
+ornn node on-grid <node-id> [--yes] [--json]
+ornn node exec <node-id> --command <shell> --timeout-seconds <n> [--yes] [--json]
+ornn node terminate <node-id> [--reason <text>] [--force] [--yes] [--json]
 ornn node admin-key <node-id> [--generate] [--json]
-ornn node deenroll <node-id> [--reason <text>] [--keep-record] [--json]
 ornn reservations commerce list --tenant <email-or-id> [--listing <listing-id>] [--json]
 ornn reservations commerce create --tenant <email> --listing <listing-id> [--node-count <n>] [--node <node-id>] [--start-at <timestamp>] [--end-at <timestamp>] [--price-per-gpu-hour <rate>] [--json]
 ornn reservations deploy <node-id> --target-tenant <id> --commerce-reservation <id> [--target-user <id>] [--network public|private] [--json]
@@ -243,23 +244,21 @@ path.
 - `ornn node hard-reset <node-id>` wipes tenant storage/users and reboots, then
   re-pushes the tenant's keys on reconnect. The tenant keeps ownership of the
   host.
-- `ornn node off-grid <node-id> [--reason <text>]` queues the agentless handoff
-  that removes Ornn agent management from the still-powered-on host.
-- `ornn node on-grid <node-id>` re-enrolls an off-grid host (SSH in with the
-  stored admin key and re-run the installer) to restore Ornn management.
-- `ornn node terminate <node-id> [--reason <text>] [--force]` best-effort cleans
-  the host, removes the Ornn agent, and hard-deletes the node record from the
-  platform. It does not return the host to a tenant.
+- `ornn node off-grid <node-id> [--reason <text>] [--yes]` takes a node off-grid
+  (remove Ornn agent management, leave the host powered on). Asks y/N unless `--yes`.
+- `ornn node on-grid <node-id> [--yes]` re-enrolls an off-grid host: orchestrator
+  SSHs with the stored admin key and re-runs the installer. Asks y/N unless `--yes`.
+- `ornn node exec <node-id> --command <shell> --timeout-seconds <n> [--yes]` runs
+  one unrestricted command over orchestrator SSH with the stored admin key. Not
+  an interactive shell (`ornn ssh`). Asks y/N unless `--yes`.
+- `ornn node terminate <node-id> [--reason <text>] [--force] [--yes]` best-effort
+  cleans the host, removes the Ornn agent, and hard-deletes the node record.
+  It does not return the host to a tenant. Asks y/N unless `--yes`. There is no
+  `deenroll` verb; use terminate.
 - `ornn node admin-key <node-id> [--generate]` prints the Ornn admin SSH keypair
   for the node (including the private key) so an operator can SSH into the host.
   `--generate` always mints a new pair, stores it, and installs the public key
   on the live host. Treat the output as a secret.
-- `ornn node deenroll <node-id>` gracefully terminates the enrollment (revokes
-  the node claim, retires any listing, and queues the node-agent self-uninstall
-  packet) while retaining the node row as a `deenrolled` audit record. The
-  legacy `--keep-record` flag remains accepted but is now a no-op. Pass
-  `--reason <text>` to annotate the audit log. The command is idempotent, and
-  termination is forced by default so an unreachable node does not block drain.
 
 The operator resource commands share the same reviewer auth:
 
@@ -268,9 +267,10 @@ The operator resource commands share the same reviewer auth:
   filtered to one operator.
 - `ornn tokens list` lists enrollment tokens.
 - `ornn tokens create --operator <id> [--facility <id>]
-[--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>]` mints an
-  enrollment token and prints a ready-to-run `curl … | sudo bash` install
-  command.
+[--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--host <ip>]
+[--identity-file <path>] [--yes]` mints an enrollment token and prints a
+  `curl … | sudo bash` install command. With `--host` and `--identity-file`,
+  orchestrator SSHs and runs that curl (same as Bulk Enroll). Asks y/N unless `--yes`.
 - `ornn tokens revoke <token-id>` revokes an enrollment token.
 
 Staff Commerce reservations are listing-backed, not fleet-backed:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/catalog-dispatch.mjs

@@ -2,7 +2,13 @@ import { readFileSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { stdin as defaultStdin, stdout as defaultStdout } from "node:process";
 
-import { cliRequest, loadRequiredSession, operatorRequest, resolveApiBaseUrl } from "./api-client.mjs";
+import {
+  cliRequest,
+  loadRequiredSession,
+  operatorRequest,
+  resolveApiBaseUrl,
+  resolveInstallerBaseUrl,
+} from "./api-client.mjs";
 
 async function collectSse(url, headers, durationMs, maxEvents, fetchImpl) {
   const controller = new AbortController();
@@ -260,29 +266,6 @@ export async function usersQueryCommand(args, context) {
   return 0;
 }
 
-export async function nodesConsoleCommand(args, context) {
-  const { nodesConsoleCapability } = await loadCapabilities();
-  const [nodeId, ...rest] = args;
-  if (!nodeId) {
-    throw new Error("Usage: ornn nodes console <node-id> [--identity-file <path>] [--json]");
-  }
-  const options = context.parseCommandOptions(
-    rest,
-    { boolean: ["json"], value: ["identity-file"] },
-    "Usage: ornn nodes console <node-id> [--identity-file <path>] [--json]",
-  );
-  const result = await runCatalogCapability(
-    nodesConsoleCapability,
-    { node_id: nodeId, identity_file: options.identityFile },
-    {
-      ...context,
-      role: options.identityFile ? "user" : context.staff ? "reviewer" : "user",
-    },
-  );
-  context.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-  return 0;
-}
-
 export async function telemetryLatestCommand(args, context) {
   const { telemetryLatestCapability } = await loadCapabilities();
   const [nodeId, ...rest] = args;
@@ -372,3 +355,151 @@ export async function logsTailCommand(args, context) {
   context.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
   return 0;
 }
+
+export async function tokensListCommand(args, context) {
+  const { tokensListCapability } = await loadCapabilities();
+  context.parseCommandOptions(args, { boolean: ["json"] }, "Usage: ornn tokens list [--json]");
+  const result = await runCatalogCapability(tokensListCapability, {}, {
+    ...context,
+    staff: true,
+    role: "reviewer",
+  });
+  const rows = Array.isArray(result) ? result : (result?.tokens ?? []);
+  if (args.includes("--json")) {
+    context.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  } else if (!rows.length) {
+    context.stdout.write("No enrollment tokens found.\n");
+  } else {
+    for (const token of rows) {
+      context.stdout.write(
+        `${token?.id ?? "unknown"}  ${token?.status ?? ""}  operator=${token?.operator_id ?? ""}  expires=${token?.expires_at ?? ""}\n`,
+      );
+    }
+  }
+  return 0;
+}
+
+export async function tokensCreateCommand(input, context) {
+  const { tokensCreateCapability } = await loadCapabilities();
+  const preview = await runCatalogCapability(tokensCreateCapability, input, {
+    ...context,
+    confirmed: false,
+    staff: true,
+    role: "admin",
+  });
+  if (preview?.ok === false) {
+    throw new Error(preview.error ?? "token create failed");
+  }
+  const confirmed = await confirmCatalogMutation({
+    stdin: context.stdin,
+    stdout: context.stdout,
+    yes: input.yes === true,
+    label: input.host || input.hosts?.length ? "Mint token and SSH enroll these hosts?" : "Mint this enrollment token?",
+  });
+  if (!confirmed) {
+    context.stdout.write("Aborted.\n");
+    return 1;
+  }
+  const result = await runCatalogCapability(tokensCreateCapability, input, {
+    ...context,
+    confirmed: true,
+    staff: true,
+    role: "admin",
+  });
+  context.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  return 0;
+}
+
+async function runNodeLifecycle(capabilityName, input, context, label) {
+  const caps = await loadCapabilities();
+  const capability = caps[capabilityName];
+  const preview = await runCatalogCapability(capability, input, {
+    ...context,
+    confirmed: false,
+    staff: true,
+    role: "admin",
+  });
+  if (preview?.ok === false) {
+    throw new Error(preview.error ?? `${capabilityName} failed`);
+  }
+  const confirmed = await confirmCatalogMutation({
+    stdin: context.stdin,
+    stdout: context.stdout,
+    yes: input.yes === true,
+    label,
+  });
+  if (!confirmed) {
+    context.stdout.write("Aborted.\n");
+    return 1;
+  }
+  const result = await runCatalogCapability(capability, input, {
+    ...context,
+    confirmed: true,
+    staff: true,
+    role: "admin",
+  });
+  context.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  return 0;
+}
+
+export async function nodeOffGridCommand(args, context) {
+  const [nodeId, ...rest] = args;
+  if (!nodeId) throw new Error("Usage: ornn node off-grid <node-id> [--reason <text>] [--yes] [--json]");
+  const options = context.parseCommandOptions(
+    rest,
+    { boolean: ["json", "yes"], value: ["reason"] },
+    "Usage: ornn node off-grid <node-id> [--reason <text>] [--yes] [--json]",
+  );
+  return runNodeLifecycle(
+    "nodeOffGridCapability",
+    { node_id: nodeId, reason: options.reason, yes: options.yes === true },
+    context,
+    `Take node ${nodeId} off-grid?`,
+  );
+}
+
+export async function nodeOnGridCommand(args, context) {
+  const [nodeId, ...rest] = args;
+  if (!nodeId) throw new Error("Usage: ornn node on-grid <node-id> [--yes] [--json]");
+  const options = context.parseCommandOptions(rest, { boolean: ["json", "yes"] }, "Usage: ornn node on-grid <node-id> [--yes] [--json]");
+  return runNodeLifecycle("nodeOnGridCapability", { node_id: nodeId, yes: options.yes === true }, context, `Re-enroll node ${nodeId} on-grid?`);
+}
+
+export async function nodeExecCommand(args, context) {
+  const [nodeId, ...rest] = args;
+  if (!nodeId) {
+    throw new Error("Usage: ornn node exec <node-id> --command <shell> --timeout-seconds <n> [--yes] [--json]");
+  }
+  const options = context.parseCommandOptions(
+    rest,
+    { boolean: ["json", "yes"], value: ["command", "timeout-seconds"] },
+    "Usage: ornn node exec <node-id> --command <shell> --timeout-seconds <n> [--yes] [--json]",
+  );
+  const command = String(options.command ?? "").trim();
+  const timeoutSeconds = Number(options.timeoutSeconds);
+  if (!command || !Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) {
+    throw new Error("Usage: ornn node exec <node-id> --command <shell> --timeout-seconds <n> [--yes] [--json]");
+  }
+  return runNodeLifecycle(
+    "nodeExecCapability",
+    { node_id: nodeId, command, timeout_seconds: timeoutSeconds, yes: options.yes === true },
+    context,
+    `Run ${JSON.stringify(command)} on node ${nodeId} (${timeoutSeconds}s)?`,
+  );
+}
+
+export async function nodeTerminateCommand(args, context) {
+  const [nodeId, ...rest] = args;
+  if (!nodeId) throw new Error("Usage: ornn node terminate <node-id> [--reason <text>] [--force] [--yes] [--json]");
+  const options = context.parseCommandOptions(
+    rest,
+    { boolean: ["json", "yes", "force"], value: ["reason"] },
+    "Usage: ornn node terminate <node-id> [--reason <text>] [--force] [--yes] [--json]",
+  );
+  return runNodeLifecycle(
+    "nodeTerminateCapability",
+    { node_id: nodeId, reason: options.reason, force: options.force === true, yes: options.yes === true },
+    context,
+    `Terminate node ${nodeId}?`,
+  );
+}

package/src/cli.mjs

@@ -1,11 +1,6 @@
 import { spawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { createReadStream, createWriteStream, existsSync } from "node:fs";
+import { createReadStream, createWriteStream, existsSync, readFileSync } from "node:fs";
 import {
-  chmod,
-  mkdir,
-  mkdtemp,
-  open,
   readFile,
   rename,
   rm,
@@ -13,9 +8,8 @@ import {
   writeFile,
 } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { isIP } from "node:net";
-import { homedir, hostname, tmpdir } from "node:os";
-import { basename, dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 
@@ -46,10 +40,15 @@ import {
   listingsCreateCommand,
   logsLatestCommand,
   logsTailCommand,
-  nodesConsoleCommand,
+  nodeExecCommand,
+  nodeOffGridCommand,
+  nodeOnGridCommand,
+  nodeTerminateCommand,
   operatorListCommand,
   telemetryLatestCommand,
   telemetryTailCommand,
+  tokensCreateCommand,
+  tokensListCommand,
   usersQueryCommand,
 } from "./catalog-dispatch.mjs";
 import { maybeNotifyUpdate, updateCommand } from "./update.mjs";
@@ -138,7 +137,6 @@ Usage:
   ornn gpus checkout <gpu-id> [--no-open] [--json]
   ornn nodes list [--json]
   ornn nodes show <node-id> [--json]
-  ornn nodes console <node-id> [--identity-file <path>] [--json]
   ornn telemetry latest <node-id> [--span 15m] [--start <iso>] [--end <iso>] [--max-points <n>] [--json]
   ornn telemetry tail <node-id> [--duration <seconds>] [--json]
   ornn logs latest <node-id> [--stream kernel] [--count <n>] [--before <iso>] [--cursor <token>] [--json]
@@ -153,18 +151,18 @@ Usage:
   ornn nodes keys list <node-id> [--json]
   ornn node health <node-id> [--json]
   ornn node diagnose <node-id> [--json]
-  ornn node deenroll <node-id> [--reason <text>] [--keep-record] [--json]
   ornn node list [--operator <id-or-slug>] [--facility <id>] [--email <email>] [--json]
   ornn node reboot <node-id> [--json]
   ornn node hard-reset <node-id> [--json]
-  ornn node off-grid <node-id> [--reason <text>] [--json]
-  ornn node on-grid <node-id> [--json]
-  ornn node terminate <node-id> [--reason <text>] [--force] [--json]
+  ornn node off-grid <node-id> [--reason <text>] [--yes] [--json]
+  ornn node on-grid <node-id> [--yes] [--json]
+  ornn node exec <node-id> --command <shell> --timeout-seconds <n> [--yes] [--json]
+  ornn node terminate <node-id> [--reason <text>] [--force] [--yes] [--json]
   ornn node admin-key <node-id> [--generate] [--json]
   ornn operators list [--json]
   ornn facilities list [--operator <id-or-slug>] [--json]
   ornn tokens list [--json]
-  ornn tokens create --operator <id> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--force] [--json]
+  ornn tokens create --operator <id> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--host <ip>] [--identity-file <path>] [--yes] [--json]
   ornn tokens revoke <token-id> [--json]
   ornn reservations transfer <reservation-id> --target-tenant <id> [--target-user <id>] [--node <id>] [--strategy reject|park] [--confirm] [--json]
   ornn reservations commerce list --tenant <email-or-id> [--listing <listing-id>] [--json]
@@ -339,12 +337,12 @@ const HELP_TOPICS = new Set([
 const NODE_OP_SUBCOMMANDS = new Set([
   "health",
   "diagnose",
-  "deenroll",
   "list",
   "reboot",
   "hard-reset",
   "off-grid",
   "on-grid",
+  "exec",
   "terminate",
   "admin-key",
 ]);
@@ -540,11 +538,22 @@ async function dispatch(argv = [], io = {}) {
     }
 
     if (command === "node") {
-      return await nodeOps(args, { env, fetchImpl, stdout });
+      return await nodeOps(args, {
+        env,
+        fetchImpl,
+        parseCommandOptions,
+        stdin: io.stdin ?? process.stdin,
+        stdout,
+      });
     }
 
     if (OPERATOR_COMMANDS.has(command)) {
-      return await operatorResource(command, args, { env, fetchImpl, stdout });
+      return await operatorResource(command, args, {
+        env,
+        fetchImpl,
+        stdout,
+        stdin: io.stdin ?? process.stdin,
+      });
     }
 
     if (command === "nodes") {
@@ -855,15 +864,24 @@ function validateHelpInvocation(command, args) {
 
   if (command === "node") {
     const parsed = parseHelpArgs(args, {
-      booleanOptions: ["--json", "--keep-record", "--force"],
-      valueOptions: ["--reason", "--operator", "--facility", "--email", "--ssh-username", "--ssh-port"],
+      booleanOptions: ["--json", "--keep-record", "--force", "--yes"],
+      valueOptions: [
+        "--reason",
+        "--operator",
+        "--facility",
+        "--email",
+        "--ssh-username",
+        "--ssh-port",
+        "--command",
+        "--timeout-seconds",
+      ],
     });
     if (parsed.error) {
       return parsed.error;
     }
     const [subcommand, , ...extra] = parsed.positionals;
     if (!subcommand || !NODE_OP_SUBCOMMANDS.has(subcommand)) {
-      return "Usage: ornn node list|health|diagnose|reboot|hard-reset|off-grid|on-grid|terminate|admin-key|deenroll <node-id>";
+      return "Usage: ornn node list|health|diagnose|reboot|hard-reset|off-grid|on-grid|exec|terminate|admin-key <node-id>";
     }
     return extra.length ? nodeOpUsage(subcommand) : null;
   }
@@ -908,7 +926,7 @@ function validateHelpInvocation(command, args) {
       return !id ? null : "Usage: ornn nodes keys list|attach|push|status <node-id>";
     }
     if (subcommand === "console") {
-      return !id || nested || extra.length ? "Usage: ornn nodes console <node-id>" : null;
+      return "ornn nodes console is removed. Use `ornn ssh <node-id>` for an interactive session.";
     }
     if (["show", "wait", "reboot", "hard-reset", "ssh-command"].includes(subcommand)) {
       return nested || extra.length
@@ -920,7 +938,7 @@ function validateHelpInvocation(command, args) {
         ? `Usage: ornn nodes ${subcommand} <reservation-id> --key <path|id|label>`
         : null;
     }
-    return "Usage: ornn nodes list|show|console|launch|switch|wait|reboot|hard-reset|ssh-command|keys";
+    return "Usage: ornn nodes list|show|launch|switch|wait|reboot|hard-reset|ssh-command|keys";
   }
 
   if (command === "ssh") {
@@ -1338,8 +1356,8 @@ function validateHelpInvocation(command, args) {
     // Operator resource commands accept a small, permissive option set; the
     // handlers do the strict validation. Just surface parse errors here.
     const parsed = parseHelpArgs(args, {
-      booleanOptions: ["--json", "--confirm", "--force"],
-      valueOptions: ["--operator", "--facility", "--expires-in", "--mode", "--ip"],
+      booleanOptions: ["--json", "--confirm", "--force", "--yes"],
+      valueOptions: ["--operator", "--facility", "--expires-in", "--mode", "--ip", "--host", "--identity-file"],
     });
     return parsed.error || null;
   }
@@ -2085,7 +2103,7 @@ async function reservations(args, context) {
 // Operator-only surface (`ornn node`); distinct from tenant `ornn nodes`.
 async function nodeOps(args, context) {
   const usage =
-    "Usage: ornn node list|health|diagnose|reboot|hard-reset|off-grid|on-grid|terminate|admin-key|deenroll <node-id>";
+    "Usage: ornn node list|health|diagnose|reboot|hard-reset|off-grid|on-grid|exec|terminate|admin-key <node-id>";
   const [subcommand, id, ...rest] = args;
   if (!subcommand || !NODE_OP_SUBCOMMANDS.has(subcommand)) {
     throw new Error(usage);
@@ -2102,24 +2120,24 @@ async function nodeOps(args, context) {
     throw new Error(nodeOpUsage(subcommand));
   }
 
-  if (subcommand === "deenroll") {
-    return await nodeDeenroll(id, rest, context);
-  }
-
   if (subcommand === "reboot" || subcommand === "hard-reset") {
     return await nodeRebootOp(subcommand, id, rest, context);
   }
 
   if (subcommand === "off-grid") {
-    return await nodeOffGridOp(id, rest, context);
+    return await nodeOffGridCommand([id, ...rest], context);
   }
 
   if (subcommand === "on-grid") {
-    return await nodeOnGridOp(id, rest, context);
+    return await nodeOnGridCommand([id, ...rest], context);
+  }
+
+  if (subcommand === "exec") {
+    return await nodeExecCommand([id, ...rest], context);
   }
 
   if (subcommand === "terminate") {
-    return await nodeTerminateOp(id, rest, context);
+    return await nodeTerminateCommand([id, ...rest], context);
   }
 
   if (subcommand === "admin-key") {
@@ -2164,20 +2182,20 @@ async function nodeOps(args, context) {
 }
 
 function nodeOpUsage(subcommand) {
-  if (subcommand === "deenroll") {
-    return "Usage: ornn node deenroll <node-id> [--reason <text>] [--keep-record] [--json]";
-  }
   if (subcommand === "list") {
     return "Usage: ornn node list [--operator <id-or-slug>] [--facility <id>] [--email <email>] [--json]";
   }
   if (subcommand === "off-grid") {
-    return "Usage: ornn node off-grid <node-id> [--reason <text>] [--json]";
+    return "Usage: ornn node off-grid <node-id> [--reason <text>] [--yes] [--json]";
   }
   if (subcommand === "on-grid") {
-    return "Usage: ornn node on-grid <node-id> [--json]";
+    return "Usage: ornn node on-grid <node-id> [--yes] [--json]";
+  }
+  if (subcommand === "exec") {
+    return "Usage: ornn node exec <node-id> --command <shell> --timeout-seconds <n> [--yes] [--json]";
   }
   if (subcommand === "terminate") {
-    return "Usage: ornn node terminate <node-id> [--reason <text>] [--force] [--json]";
+    return "Usage: ornn node terminate <node-id> [--reason <text>] [--force] [--yes] [--json]";
   }
   if (subcommand === "admin-key") {
     return "Usage: ornn node admin-key <node-id> [--generate] [--json]";
@@ -2260,98 +2278,6 @@ async function nodeRebootOp(subcommand, id, rest, context) {
   return 0;
 }
 
-// Take a node off-grid: queue the agentless handoff that removes Ornn agent
-// management from the still-powered-on host.
-async function nodeOffGridOp(id, rest, context) {
-  const options = parseCommandOptions(
-    rest,
-    { boolean: ["json"], value: ["reason"] },
-    nodeOpUsage("off-grid")
-  );
-  const reason = optionalStringOption(options.reason);
-  const result = await operatorRequest({
-    body: {
-      request_id: `cli-off-grid:${id}:${Date.now()}`,
-      ...(reason ? { reason } : {}),
-    },
-    endpoint: `/enrollment/nodes/${encodeURIComponent(id)}/agentless-handoff`,
-    env: context.env,
-    fetchImpl: context.fetchImpl,
-    method: "POST",
-  });
-  if (options.json) {
-    writeJson(context.stdout, result);
-  } else {
-    context.stdout.write(`Off-grid handoff queued for node ${id}.\n`);
-    writeOptionalStatusLine(context.stdout, "Status", result?.status);
-    writeOptionalStatusLine(context.stdout, "Request", result?.packet_request_id);
-  }
-  return 0;
-}
-
-// Bring an off-grid node back on-grid: SSH in with the stored admin key and
-// re-run the installer to restore Ornn agent management.
-async function nodeOnGridOp(id, rest, context) {
-  const options = parseCommandOptions(
-    rest,
-    { boolean: ["json"], value: ["ssh-username", "ssh-port"] },
-    nodeOpUsage("on-grid")
-  );
-  const body = {};
-  const sshUsername = optionalStringOption(options.sshUsername);
-  const sshPort = optionalStringOption(options.sshPort);
-  if (sshUsername) {
-    body.ssh_username = sshUsername;
-  }
-  if (sshPort) {
-    body.ssh_port = Number.parseInt(sshPort, 10);
-  }
-  const result = await operatorRequest({
-    body,
-    endpoint: `/enrollment/nodes/${encodeURIComponent(id)}/agentless-handoff/on-grid`,
-    env: context.env,
-    fetchImpl: context.fetchImpl,
-    method: "POST",
-  });
-  if (options.json) {
-    writeJson(context.stdout, result);
-  } else {
-    context.stdout.write(`On-grid restore queued for node ${id}.\n`);
-    writeOptionalStatusLine(context.stdout, "Status", result?.status);
-  }
-  return 0;
-}
-
-// Terminate a node: best-effort clean the host, remove the Ornn agent, and
-// hard-delete the node record from the platform. Does NOT return it to a tenant.
-async function nodeTerminateOp(id, rest, context) {
-  const options = parseCommandOptions(
-    rest,
-    { boolean: ["json", "force"], value: ["reason"] },
-    nodeOpUsage("terminate")
-  );
-  const reason = optionalStringOption(options.reason) || "cli-terminate";
-  const result = await operatorRequest({
-    body: {
-      request_id: `cli-terminate:${id}:${Date.now()}`,
-      reason,
-      force: options.force === true,
-    },
-    endpoint: `/enrollment/nodes/${encodeURIComponent(id)}/terminate`,
-    env: context.env,
-    fetchImpl: context.fetchImpl,
-    method: "POST",
-  });
-  if (options.json) {
-    writeJson(context.stdout, result);
-  } else {
-    context.stdout.write(`Termination queued for node ${id}.\n`);
-    writeOptionalStatusLine(context.stdout, "Status", result?.status);
-    writeOptionalStatusLine(context.stdout, "Request", result?.packet_request_id);
-  }
-  return 0;
-}
-
 // Fetch the Ornn admin SSH keypair for a node, including the private key, so an
 // operator can SSH into the host directly. Prints the private key; handle it as
 // a secret.
@@ -2539,39 +2465,21 @@ async function tokensCommand(args, context) {
   const usage = "Usage: ornn tokens list|create|revoke ...";
   const [subcommand, ...rest] = args;
   if (subcommand === "list" || subcommand === undefined) {
-    const options = parseCommandOptions(
-      rest,
-      { boolean: ["json"] },
-      "Usage: ornn tokens list [--json]"
-    );
-    const tokens = await operatorRequest({
-      endpoint: "/enrollment/tokens",
-      env: context.env,
-      fetchImpl: context.fetchImpl,
+    return await tokensListCommand(rest, {
+      ...context,
+      parseCommandOptions,
+      stdin: context.stdin,
     });
-    const rows = Array.isArray(tokens) ? tokens : [];
-    if (options.json) {
-      writeJson(context.stdout, rows);
-    } else if (!rows.length) {
-      context.stdout.write("No enrollment tokens found.\n");
-    } else {
-      for (const token of rows) {
-        context.stdout.write(
-          `${token?.id ?? "unknown"}  ${token?.status ?? ""}  operator=${token?.operator_id ?? ""}  expires=${token?.expires_at ?? ""}\n`
-        );
-      }
-    }
-    return 0;
   }
 
   if (subcommand === "create") {
     const createUsage =
-      "Usage: ornn tokens create --operator <id-or-slug> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--force] [--json]";
+      "Usage: ornn tokens create --operator <id-or-slug> [--facility <id>] [--expires-in <seconds>] [--mode bare-metal|vm] [--ip <addr>] [--host <ip>] [--identity-file <path>] [--yes] [--json]";
     const options = parseCommandOptions(
       rest,
       {
-        boolean: ["json", "force"],
-        value: ["operator", "facility", "expires-in", "mode", "ip"],
+        boolean: ["json", "force", "yes"],
+        value: ["operator", "facility", "expires-in", "mode", "ip", "host", "identity-file"],
       },
       createUsage
     );
@@ -2580,44 +2488,33 @@ async function tokensCommand(args, context) {
       throw new Error(createUsage);
     }
     const operatorId = await resolveOperatorId(operatorFilter, context);
-    const body = { operator_id: operatorId };
-    const facility = optionalStringOption(options.facility);
-    const expiresIn = optionalStringOption(options.expiresIn);
-    if (facility) {
-      body.facility_id = facility;
+    const identityFile = optionalStringOption(options.identityFile);
+    let privateKey;
+    if (identityFile) {
+      privateKey = readFileSync(identityFile, "utf8");
     }
-    if (expiresIn) {
-      body.expires_in_seconds = Number.parseInt(expiresIn, 10);
-    }
-    const token = await operatorRequest({
-      body,
-      endpoint: "/enrollment/tokens",
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    const installCommand = buildEnrollmentInstallCommand({
-      env: context.env,
-      token: token?.token,
-      mode: optionalStringOption(options.mode),
-      ip: optionalStringOption(options.ip),
-      force: options.force === true,
-    });
-    if (options.json) {
-      writeJson(context.stdout, { ...token, install_command: installCommand });
-    } else {
-      context.stdout.write(`Enrollment token created: ${token?.id ?? "unknown"}\n`);
-      writeOptionalStatusLine(context.stdout, "Token", token?.token);
-      writeOptionalStatusLine(context.stdout, "Expires", token?.expires_at);
-      if (installCommand) {
-        context.stdout.write(`Install command:\n${installCommand}\n`);
-      } else {
-        context.stdout.write(
-          "Install command unavailable: set ORNN_INSTALLER_URL to the origin serving /enrollment/install.\n"
-        );
-      }
-    }
-    return 0;
+    return await tokensCreateCommand(
+      {
+        operator_id: operatorId,
+        ...(optionalStringOption(options.facility)
+          ? { facility_id: optionalStringOption(options.facility) }
+          : {}),
+        ...(optionalStringOption(options.expiresIn)
+          ? { expires_in_seconds: Number.parseInt(optionalStringOption(options.expiresIn), 10) }
+          : {}),
+        ...(optionalStringOption(options.mode) ? { node_mode: optionalStringOption(options.mode) } : {}),
+        ...(optionalStringOption(options.ip) ? { ip: optionalStringOption(options.ip) } : {}),
+        ...(optionalStringOption(options.host) ? { host: optionalStringOption(options.host) } : {}),
+        ...(privateKey ? { private_key: privateKey } : {}),
+        installer_base: resolveInstallerBaseUrl({ env: context.env }) ?? undefined,
+        yes: options.yes === true || options.force === true,
+      },
+      {
+        ...context,
+        parseCommandOptions,
+        stdin: context.stdin ?? process.stdin,
+      },
+    );
   }
 
   if (subcommand === "revoke") {
@@ -2644,78 +2541,6 @@ async function tokensCommand(args, context) {
   throw new Error(usage);
 }
 
-// Mirrors apps/web/lib/operator-enrollment.ts and the MCP token tool.
-function buildEnrollmentInstallCommand({ env = process.env, token, mode, ip, force = false } = {}) {
-  if (!token) {
-    return null;
-  }
-  const base = resolveInstallerBaseUrl({ env });
-  if (!base) {
-    return null;
-  }
-  const url = new URL(`${base.replace(/\/+$/, "")}/enrollment/install`);
-  url.searchParams.set("token", token);
-  if (mode) {
-    url.searchParams.set("node_mode", mode);
-  }
-  if (ip) {
-    url.searchParams.set("ip", ip);
-  }
-  if (force) {
-    url.searchParams.set("force", "true");
-  }
-  return `curl -fsSL '${url.toString().replace(/'/g, "'\\''")}' | sudo bash`;
-}
-
-// De-enroll a node by gracefully terminating its enrollment. The audit row is
-// intentionally retained; --keep-record remains accepted for script compatibility.
-async function nodeDeenroll(id, rest, context) {
-  const options = parseCommandOptions(
-    rest,
-    { boolean: ["json", "keep-record", "force"], value: ["reason"] },
-    nodeOpUsage("deenroll")
-  );
-  const reason = optionalStringOption(options.reason) || "cli-deenroll";
-  // Dead/unreachable test nodes can't drain workloads, so default to force.
-  const force = options.force !== false;
-  const result = { node_id: id, terminated: false, record_retained: true };
-
-  try {
-    const terminate = await operatorRequest({
-      body: {
-        request_id: `cli-deenroll:${id}:${Date.now()}`,
-        reason,
-        force,
-      },
-      endpoint: `/enrollment/nodes/${encodeURIComponent(id)}/terminate`,
-      env: context.env,
-      fetchImpl: context.fetchImpl,
-      method: "POST",
-    });
-    result.terminated = true;
-    result.terminate = terminate;
-  } catch (error) {
-    // Already-terminated / unknown node is a success for an idempotent teardown.
-    if (!(error instanceof CliApiError) || error.status !== 404) {
-      throw error;
-    }
-    result.already_gone = true;
-  }
-
-  if (options.json) {
-    writeJson(context.stdout, result);
-  } else {
-    if (result.already_gone && !result.terminated) {
-      context.stdout.write(`Node ${id} already de-enrolled (nothing to remove).\n`);
-    } else {
-      context.stdout.write(`Node ${id} de-enrolled.\n`);
-      writeOptionalStatusLine(context.stdout, "Terminated", result.terminated ? "yes" : "skipped");
-      writeOptionalStatusLine(context.stdout, "Record retained", "yes");
-    }
-  }
-  return 0;
-}
-
 function writeNodeHealth(stdout, node) {
   stdout.write(`${node?.id ?? "unknown"}\n`);
   stdout.write(`Status: ${node?.status || "unknown"}\n`);
@@ -2768,8 +2593,8 @@ async function nodes(args, context) {
     return 0;
   }
 
-  if (subcommand === "console" && id) {
-    return await nodesConsoleCommand([id, nested, ...rest].filter(Boolean), context);
+  if (subcommand === "console") {
+    throw new Error("ornn nodes console is removed. Use `ornn ssh <node-id>` for an interactive session.");
   }
 
   if (subcommand === "show" && id) {
@@ -8690,12 +8515,6 @@ function validateMinNodeCount(minNodeCount, nodeCount) {
   }
 }
 
-function validateMinGpuCount(minGpuCount, gpuCount) {
-  if (minGpuCount > gpuCount) {
-    throw new Error("--min-gpu-count must be less than or equal to --gpu-count.");
-  }
-}
-
 function arrayOption(value) {
   if (value === undefined || value === null || value === "") {
     return [];

package/vendor/capabilities/capabilities/fleet.d.ts

@@ -1,5 +1,8 @@
 export declare const listOperatorsCapability: import("../capability.ts").Capability<unknown, unknown>;
 export declare const listFacilitiesCapability: import("../capability.ts").Capability<unknown, unknown>;
 export declare const listNodesCapability: import("../capability.ts").Capability<unknown, unknown>;
-export declare const nodesConsoleCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeOffGridCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeOnGridCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeExecCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const nodeTerminateCapability: import("../capability.ts").Capability<unknown, unknown>;
 export declare const fleetCapabilities: import("../capability.ts").Capability<unknown, unknown>[];

package/vendor/capabilities/capabilities/fleet.js

@@ -22,12 +22,23 @@ const nodesInput = z.object({
     status: z.string().optional(),
     email: z.string().optional(),
 });
-const consoleInput = z.object({
+const nodeLifecycleInput = z.object({
     node_id: z.string().min(1),
     nodeId: z.string().optional(),
-    identity_file: z.string().optional(),
-    commands: z.array(z.string()).optional(),
+    reason: z.string().optional(),
+    force: z.boolean().optional(),
 });
+const nodeExecInput = z.object({
+    node_id: z.string().min(1),
+    nodeId: z.string().optional(),
+    command: z.string().min(1),
+    timeout_seconds: z.number().int().positive(),
+    timeoutSeconds: z.number().int().positive().optional(),
+    yes: z.boolean().optional(),
+});
+function nodeIdOf(input) {
+    return (input.node_id || input.nodeId || "").trim();
+}
 export const listOperatorsCapability = defineCapability({
     id: "operator.list",
     domain: "fleet",
@@ -104,44 +115,131 @@ export const listNodesCapability = defineCapability({
         }), { method: "GET" });
     },
 });
-export const nodesConsoleCapability = defineCapability({
-    id: "nodes.console",
+export const nodeOffGridCapability = defineCapability({
+    id: "node.off-grid",
     domain: "fleet",
-    roles: ["user", "reviewer", "admin"],
-    description: "Run an allowlisted host snapshot (ps -ef, nvidia-smi) on one node. Pass the orchestrator node UUID, never a hostname. Users must target a reserved node and pass identity_file (local PEM, same as ornn ssh --identity-file). Reviewers and admins may target any enrolled node; the orchestrator loads the stored admin SSH key. Slack staff never pass a key.",
-    mutation: "read",
-    http: { method: "POST", path: "/internal/nodes/{id}/console" },
+    roles: ["admin"],
+    description: "Admin-only. Take a node off-grid (remove Ornn agent management, leave the host powered on). CLI asks y/N. Slack waits for a human confirm. MCP requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/nodes/{id}/off-grid" },
     slack: {
         parameters: {
             type: "object",
             properties: {
-                node_id: { type: "string", description: "Node UUID from nodes.list, not a hostname." },
-                commands: {
-                    type: "array",
-                    items: { type: "string", enum: ["ps", "ps -ef", "nvidia-smi", "nvidia-smi -L"] },
-                    description: "Optional allowlisted commands. Default is ps and nvidia-smi.",
+                node_id: { type: "string", description: "Node UUID from nodes.list." },
+                reason: { type: "string" },
+            },
+            required: ["node_id"],
+        },
+    },
+    input: nodeLifecycleInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeLifecycleInput.parse(input);
+        const id = nodeIdOf(parsed);
+        const body = { ...(parsed.reason ? { reason: parsed.reason } : {}) };
+        if (!ctx.confirmed) {
+            return { ok: true, action: "node.off-grid", payload: { node_id: id, ...body } };
+        }
+        return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/off-grid`, {
+            method: "POST",
+            body,
+        });
+    },
+});
+export const nodeOnGridCapability = defineCapability({
+    id: "node.on-grid",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Admin-only. Re-enroll an off-grid node: orchestrator SSHs with the stored admin key and runs the installer with restore_node_id. No caller key. CLI asks y/N. Slack waits for a human confirm. MCP requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/nodes/{id}/on-grid" },
+    slack: {
+        parameters: {
+            type: "object",
+            properties: {
+                node_id: { type: "string", description: "Off-grid node UUID from nodes.list." },
+            },
+            required: ["node_id"],
+        },
+    },
+    input: nodeLifecycleInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeLifecycleInput.parse(input);
+        const id = nodeIdOf(parsed);
+        if (!ctx.confirmed) {
+            return { ok: true, action: "node.on-grid", payload: { node_id: id } };
+        }
+        return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/on-grid`, {
+            method: "POST",
+            body: {},
+        });
+    },
+});
+export const nodeExecCapability = defineCapability({
+    id: "node.exec",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Admin-only. Run one unrestricted command on an enrolled node over orchestrator SSH with the stored admin key. Always pass timeout_seconds. Not an interactive shell. CLI asks y/N. Slack waits for a human confirm. MCP requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/remote" },
+    slack: {
+        parameters: {
+            type: "object",
+            properties: {
+                node_id: { type: "string", description: "Enrolled node UUID from nodes.list." },
+                command: { type: "string", description: "Exact shell command to run. No allowlist." },
+                timeout_seconds: {
+                    type: "integer",
+                    description: "Seconds to wait before killing the SSH command. Required. 1-900.",
                 },
             },
+            required: ["node_id", "command", "timeout_seconds"],
+        },
+    },
+    input: nodeExecInput,
+    execute: async (ctx, input) => {
+        const parsed = nodeExecInput.parse(input);
+        const id = nodeIdOf(parsed);
+        const timeoutSeconds = parsed.timeout_seconds ?? parsed.timeoutSeconds;
+        const payload = { node_id: id, command: parsed.command, timeout_seconds: timeoutSeconds };
+        if (!ctx.confirmed) {
+            return { ok: true, action: "node.exec", payload };
+        }
+        return ctx.fetch("/internal/remote", { method: "POST", body: payload });
+    },
+});
+export const nodeTerminateCapability = defineCapability({
+    id: "node.terminate",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Admin-only. Terminate a node record (best-effort clean + delete). Off-grid nodes need force: true. There is no deenroll verb. CLI asks y/N. Slack waits for a human confirm. MCP requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/nodes/{id}/terminate" },
+    slack: {
+        parameters: {
+            type: "object",
+            properties: {
+                node_id: { type: "string", description: "Node UUID from nodes.list." },
+                reason: { type: "string" },
+                force: { type: "boolean", description: "Required to delete an off-grid node." },
+            },
             required: ["node_id"],
         },
     },
-    input: consoleInput,
+    input: nodeLifecycleInput,
     execute: async (ctx, input) => {
-        const parsed = consoleInput.parse(input);
-        const id = (parsed.node_id || parsed.nodeId || "").trim();
-        if (ctx.role === "user") {
-            const identity = parsed.identity_file?.trim();
-            if (!identity) {
-                return { error: "identity_file_required", detail: "Users must pass identity_file." };
-            }
-            return ctx.fetch(`/nodes/${encodeURIComponent(id)}/console`, {
-                method: "POST",
-                body: { identity_file: identity, commands: parsed.commands },
-            });
+        const parsed = nodeLifecycleInput.parse(input);
+        const id = nodeIdOf(parsed);
+        const body = {
+            ...(parsed.reason ? { reason: parsed.reason } : {}),
+            ...(parsed.force !== undefined ? { force: parsed.force } : {}),
+        };
+        if (!ctx.confirmed) {
+            return { ok: true, action: "node.terminate", payload: { node_id: id, ...body } };
         }
-        return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/console`, {
+        return ctx.fetch(`/internal/nodes/${encodeURIComponent(id)}/terminate`, {
             method: "POST",
-            body: { commands: parsed.commands },
+            body,
         });
     },
 });
@@ -149,5 +247,8 @@ export const fleetCapabilities = [
     listOperatorsCapability,
     listFacilitiesCapability,
     listNodesCapability,
-    nodesConsoleCapability,
+    nodeOffGridCapability,
+    nodeOnGridCapability,
+    nodeExecCapability,
+    nodeTerminateCapability,
 ];

package/vendor/capabilities/capabilities/tokens.d.ts

@@ -0,0 +1,11 @@
+export declare function buildEnrollmentInstallCommand(options: {
+    token: string;
+    base?: string;
+    nodeMode?: string;
+    ip?: string;
+    restoreNodeId?: string;
+    force?: boolean;
+}): string;
+export declare const tokensListCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const tokensCreateCapability: import("../capability.ts").Capability<unknown, unknown>;
+export declare const tokenCapabilities: import("../capability.ts").Capability<unknown, unknown>[];

package/vendor/capabilities/capabilities/tokens.js

@@ -0,0 +1,155 @@
+import { z } from "zod";
+import { defineCapability } from "../capability.js";
+const optionalText = z.string().nullish();
+const tokenCreateInput = z.object({
+    operator_id: z.string().min(1),
+    operatorId: optionalText,
+    facility_id: optionalText,
+    facilityId: optionalText,
+    expires_in_seconds: z.number().int().positive().nullish(),
+    expiresInSeconds: z.number().int().positive().nullish(),
+    node_mode: z.enum(["bare-metal", "virtual-machine", "vm"]).nullish(),
+    nodeMode: z.enum(["bare-metal", "virtual-machine", "vm"]).nullish(),
+    ip: optionalText,
+    installer_base: optionalText,
+    host: optionalText,
+    hosts: z.array(z.string()).nullish(),
+    username: optionalText,
+    port: z.number().int().min(1).max(65535).nullish(),
+    private_key: optionalText,
+    privateKey: optionalText,
+    yes: z.boolean().optional(),
+});
+const emptyInput = z.object({});
+export function buildEnrollmentInstallCommand(options) {
+    const base = (options.base ?? "https://api.ornn.com/v1/orchestrator").replace(/\/+$/, "");
+    const params = [`token=${encodeURIComponent(options.token)}`];
+    if (options.nodeMode) {
+        const mode = options.nodeMode === "vm" ? "virtual-machine" : options.nodeMode;
+        params.push(`node_mode=${encodeURIComponent(mode)}`);
+    }
+    if (options.ip)
+        params.push(`ip=${encodeURIComponent(options.ip)}`);
+    if (options.restoreNodeId)
+        params.push(`restore_node_id=${encodeURIComponent(options.restoreNodeId)}`);
+    if (options.force)
+        params.push("force=true");
+    const href = `${base}/enrollment/install?${params.join("&")}`;
+    return `curl -fsSL '${href.replace(/'/g, "'\\''")}' | sudo bash`;
+}
+function tokenString(row, keys) {
+    for (const key of keys) {
+        const value = row[key];
+        if (typeof value === "string" && value.trim())
+            return value.trim();
+    }
+    return undefined;
+}
+export const tokensListCapability = defineCapability({
+    id: "tokens.list",
+    domain: "fleet",
+    roles: ["reviewer", "admin"],
+    description: "List issued enrollment tokens (id, operator, status, expiry). Does not return plaintext secrets.",
+    mutation: "read",
+    http: { method: "GET", path: "/internal/enrollment-tokens" },
+    slack: { parameters: { type: "object", properties: {} } },
+    input: emptyInput,
+    execute: async (ctx) => ctx.fetch("/internal/enrollment-tokens", { method: "GET" }),
+});
+export const tokensCreateCapability = defineCapability({
+    id: "tokens.create",
+    domain: "fleet",
+    roles: ["admin"],
+    description: "Admin-only. Mint an enrollment token. Without a host this returns the curl installer. With host + private_key, orchestrator SSHs and runs that curl (same as Bulk Enroll). Never invent a command. CLI asks y/N. Slack waits for a human confirm. MCP requires confirm: true.",
+    mutation: "preview-confirm",
+    http: { method: "POST", path: "/internal/enrollment-tokens" },
+    slack: {
+        parameters: {
+            type: "object",
+            properties: {
+                operator_id: { type: "string", description: "Commerce operator UUID from operator.list." },
+                facility_id: { type: "string", description: "Optional facility UUID." },
+                expires_in_seconds: { type: "integer", description: "Token TTL in seconds." },
+                node_mode: { type: "string", enum: ["bare-metal", "virtual-machine"] },
+                ip: { type: "string", description: "Optional IP stamped into the installer URL." },
+                host: { type: "string", description: "SSH host/IP to enroll now." },
+                hosts: {
+                    type: "array",
+                    items: { type: "string" },
+                    description: "Optional extra SSH hosts to enroll with the same key.",
+                },
+                username: { type: "string", description: "SSH user. Default admin." },
+                port: { type: "integer", description: "SSH port. Default 22." },
+                private_key: { type: "string", description: "PEM private key. Required to enroll over SSH." },
+            },
+            required: ["operator_id"],
+        },
+    },
+    input: tokenCreateInput,
+    execute: async (ctx, input) => {
+        const parsed = tokenCreateInput.parse(input);
+        const operatorId = (parsed.operator_id || parsed.operatorId || "").trim();
+        const hosts = [
+            ...(parsed.host?.trim() ? [parsed.host.trim()] : []),
+            ...(parsed.hosts ?? []).map((host) => host.trim()).filter(Boolean),
+        ];
+        const privateKey = parsed.private_key?.trim() || parsed.privateKey?.trim() || "";
+        const nodeMode = parsed.node_mode ?? parsed.nodeMode;
+        const payload = {
+            operator_id: operatorId,
+            facility_id: parsed.facility_id ?? parsed.facilityId,
+            expires_in_seconds: parsed.expires_in_seconds ?? parsed.expiresInSeconds,
+            node_mode: nodeMode,
+            ip: parsed.ip,
+            hosts,
+            username: parsed.username?.trim() || "admin",
+            port: parsed.port ?? 22,
+            remote: hosts.length > 0 && privateKey.length > 0,
+        };
+        if (!ctx.confirmed) {
+            return { ok: true, action: "tokens.create", payload: { ...payload, private_key: privateKey ? "[redacted]" : "" } };
+        }
+        const minted = (await ctx.fetch("/internal/enrollment-tokens", {
+            method: "POST",
+            body: {
+                operator_id: operatorId,
+                ...(payload.facility_id ? { facility_id: payload.facility_id } : {}),
+                ...(payload.expires_in_seconds ? { expires_in_seconds: payload.expires_in_seconds } : {}),
+            },
+        }));
+        const token = tokenString(minted, ["token", "plaintext"]) ?? "";
+        const installCommand = token
+            ? buildEnrollmentInstallCommand({
+                token,
+                base: parsed.installer_base ?? undefined,
+                nodeMode: nodeMode ?? undefined,
+                ip: parsed.ip ?? undefined,
+                force: payload.remote,
+            })
+            : null;
+        if (!payload.remote || !installCommand) {
+            return { ...minted, install_command: installCommand };
+        }
+        const results = [];
+        for (const host of hosts) {
+            results.push(await ctx.fetch("/internal/remote", {
+                method: "POST",
+                body: {
+                    host,
+                    username: payload.username,
+                    port: payload.port,
+                    private_key: privateKey,
+                    command: installCommand,
+                    timeout_seconds: 600,
+                },
+            }));
+        }
+        return {
+            id: minted.id,
+            operator_id: minted.operator_id ?? operatorId,
+            expires_at: minted.expires_at,
+            hosts: results,
+        };
+    },
+});
+export const tokenCapabilities = [tokensListCapability, tokensCreateCapability];

package/vendor/capabilities/catalog.js

@@ -1,5 +1,6 @@
 import { kubernetesCapabilities, slurmCapabilities } from "./capabilities/clusters.js";
 import { fleetCapabilities } from "./capabilities/fleet.js";
+import { tokenCapabilities } from "./capabilities/tokens.js";
 import { identityCapabilities } from "./capabilities/identity.js";
 import { listingCapabilities } from "./capabilities/listings.js";
 import { observabilityCapabilities } from "./capabilities/observability.js";
@@ -9,6 +10,7 @@ export const catalog = [
     ...identityCapabilities,
     ...listingCapabilities,
     ...fleetCapabilities,
+    ...tokenCapabilities,
     ...userCapabilities,
     ...observabilityCapabilities,
     ...slurmCapabilities,

package/vendor/capabilities/index.d.ts

@@ -1,7 +1,8 @@
 export { byCliCommand, byMcpName, bySlackName, defineCapability, forRole, slackStaffVisible, visibleToClient, type Capability, type CapabilityBindings, type CapabilityContext, type CapabilitySpec, type JsonSchema, type CapabilityTransport, type Domain, type HttpSpec, type Mutation, } from "./capability.ts";
 export { namesFromId } from "./names.ts";
 export { catalog } from "./catalog.ts";
-export { fleetCapabilities, listFacilitiesCapability, listNodesCapability, listOperatorsCapability, nodesConsoleCapability, } from "./capabilities/fleet.ts";
+export { fleetCapabilities, listFacilitiesCapability, listNodesCapability, listOperatorsCapability, nodeExecCapability, nodeOffGridCapability, nodeOnGridCapability, nodeTerminateCapability, } from "./capabilities/fleet.ts";
+export { buildEnrollmentInstallCommand, tokenCapabilities, tokensCreateCapability, tokensListCapability, } from "./capabilities/tokens.ts";
 export { identityCapabilities, statusCapability, whoamiCapability } from "./capabilities/identity.ts";
 export { createListingCapability, listingCreateInput, listCatalogTermsCapability, listingCapabilities, listListingsCapability, proposeListingCapability, } from "./capabilities/listings.ts";
 export { userCapabilities, usersQueryCapability } from "./capabilities/users.ts";

package/vendor/capabilities/index.js

@@ -1,7 +1,8 @@
 export { byCliCommand, byMcpName, bySlackName, defineCapability, forRole, slackStaffVisible, visibleToClient, } from "./capability.js";
 export { namesFromId } from "./names.js";
 export { catalog } from "./catalog.js";
-export { fleetCapabilities, listFacilitiesCapability, listNodesCapability, listOperatorsCapability, nodesConsoleCapability, } from "./capabilities/fleet.js";
+export { fleetCapabilities, listFacilitiesCapability, listNodesCapability, listOperatorsCapability, nodeExecCapability, nodeOffGridCapability, nodeOnGridCapability, nodeTerminateCapability, } from "./capabilities/fleet.js";
+export { buildEnrollmentInstallCommand, tokenCapabilities, tokensCreateCapability, tokensListCapability, } from "./capabilities/tokens.js";
 export { identityCapabilities, statusCapability, whoamiCapability } from "./capabilities/identity.js";
 export { createListingCapability, listingCreateInput, listCatalogTermsCapability, listingCapabilities, listListingsCapability, proposeListingCapability, } from "./capabilities/listings.js";
 export { userCapabilities, usersQueryCapability } from "./capabilities/users.js";

package/vendor/capabilities/names.js

@@ -1,6 +1,6 @@
 /** Shared wire names derived from `Capability.id`. */
 export function namesFromId(id) {
-    const wire = id.replaceAll(".", "_");
+    const wire = id.replaceAll(".", "_").replaceAll("-", "_");
     const cli = id === "identity.whoami" ? ["whoami"] : id === "identity.status" ? ["status"] : id.split(".");
     return { mcp: wire, slack: wire, cli };
 }