@ornncompute/cli 1.0.134 → 1.0.135

package/README.md

@@ -478,5 +478,6 @@ see [the service contract](../../services/orchestrator/README.md#file-upload-rep
 Staff can use `ornn admin ssh <node-id>` for certificate access on nodes that trust
 the environment's SSH CA. It requires an interactive staff login, creates a temporary
 local key, obtains a 15-minute certificate through the gateway and launches
-OpenSSH with normal host-key verification. Temporary files are removed when
-the command exits. Shared and per-node key access remain available.
+OpenSSH with normal host-key verification. Nodes configured for the staff SSH
+relay connect through Orchestrator automatically. Temporary files are removed
+when the command exits.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.134",
+  "version": "1.0.135",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {
@@ -44,7 +44,8 @@
   },
   "dependencies": {
     "picocolors": "^1.1.1",
-    "zod": "^4.6.7",
-    "update-notifier": "7.3.1"
+    "update-notifier": "7.3.1",
+    "ws": "8.22.1",
+    "zod": "^4.6.7"
   }
 }

package/src/admin-ssh-relay.mjs

@@ -0,0 +1,49 @@
+import { once } from "node:events";
+import { createServer } from "node:net";
+import WebSocket, { createWebSocketStream } from "ws";
+import { loadRequiredSession, resolveApiBaseUrl, userCredentialHeaders } from "./api-client.mjs";
+
+export async function openSshRelay(nodeId, { env, signal }) {
+  const session = await loadRequiredSession({ env });
+  const url = new URL(
+    `/v1/orchestrator/nodes/${encodeURIComponent(nodeId)}/ssh-relay`,
+    resolveApiBaseUrl({ env, session })
+  );
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  signal.throwIfAborted();
+  const ws = new WebSocket(url, {
+    headers: userCredentialHeaders(session),
+    handshakeTimeout: 12_000,
+    maxPayload: 128 * 1024,
+  });
+  const stream = createWebSocketStream(ws);
+  let client;
+  const server = createServer((socket) => {
+    if (client || stream.destroyed) {
+      socket.destroy();
+      return;
+    }
+    client = socket;
+    server.close();
+    socket.on("error", close);
+    socket.on("close", close);
+    socket.pipe(stream).pipe(socket);
+  });
+  function close() {
+    if (server.listening) server.close();
+    client?.destroy();
+    stream.destroy();
+  }
+  stream.on("error", close);
+  stream.on("close", close);
+  try {
+    await once(ws, "open", { signal });
+    server.listen({ port: 0, host: "127.0.0.1", signal });
+    await once(server, "listening", { signal });
+    if (stream.destroyed) throw new Error("The SSH relay closed before connecting.");
+    return { port: server.address().port, close };
+  } catch (error) {
+    close();
+    throw new Error(`Could not open the SSH relay. ${error.message}`, { cause: error });
+  }
+}

package/src/admin-ssh.mjs

@@ -4,6 +4,7 @@ import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { constants, tmpdir } from "node:os";
 import { join } from "node:path";
 import { ADMIN_MUTATION_SAFETY } from "./admin-mutations.mjs";
+import { openSshRelay } from "./admin-ssh-relay.mjs";
 import { forwardSignals } from "./signals.mjs";
 
 function run(program, args, signal) {
@@ -20,7 +21,10 @@ function run(program, args, signal) {
   });
 }
 
-export async function openAdminSsh({ input, fetch, execute, runtime }, { runProcess = run } = {}) {
+export async function openAdminSsh(
+  { input, fetch, execute, runtime },
+  { runProcess = run, openRelay = openSshRelay } = {}
+) {
   // Read the existing node route; issuance returns only its own certificate.
   const node = await orchestrator.getNode(fetch, input.node_id);
   const host = node.ip;
@@ -41,6 +45,7 @@ export async function openAdminSsh({ input, fetch, execute, runtime }, { runProc
     : controller.signal;
   let interrupted;
   let directory;
+  let relay;
   const removeSignals = forwardSignals(process, null, (received) => {
     interrupted ??= received;
     controller.abort();
@@ -66,6 +71,21 @@ export async function openAdminSsh({ input, fetch, execute, runtime }, { runProc
     )
       throw new Error("The issuer returned an invalid SSH certificate.");
     await writeFile(`${key}-cert.pub`, `${issued.certificate}\n`, { mode: 0o600 });
+    if (node.ssh_relay_configured === true) {
+      relay = await openRelay(input.node_id, { env: runtime.env, signal });
+    }
+    const relayOptions = relay
+      ? [
+          "-o",
+          "HostName=127.0.0.1",
+          "-o",
+          `HostKeyAlias=${port === 22 ? host : `[${host}]:${port}`}`,
+          "-o",
+          "ProxyCommand=none",
+          "-o",
+          "ControlPath=none",
+        ]
+      : [];
     const exitCode = await runProcess(
       "ssh",
       [
@@ -76,7 +96,8 @@ export async function openAdminSsh({ input, fetch, execute, runtime }, { runProc
         "-i",
         key,
         "-p",
-        String(port),
+        String(relay?.port ?? port),
+        ...relayOptions,
         "-l",
         "admin",
         host,
@@ -90,6 +111,7 @@ export async function openAdminSsh({ input, fetch, execute, runtime }, { runProc
     return { suppressResult: true, exitCode: 128 + constants.signals[interrupted] };
   } finally {
     try {
+      relay?.close();
       if (directory) await rm(directory, { recursive: true, force: true });
     } finally {
       removeSignals();