@ornncompute/cli 1.0.137 → 1.0.139

package/README.md

@@ -210,9 +210,14 @@ node ID. Changing filters requires a new first-page request. Legacy raw owner
 cursors require the original `--before` value and filters.
 Metrics and logs use node-scoped staff gateway routes. Exported private keys
 include the final newline required by OpenSSH, both in files and with `--print`.
-`ornn admin nodes enroll` takes optional `--filter COMPARTMENT_IDS`
-(omit to run every compartment step); the retired `--mode` flag is gone. The
-gateway, not CLI metadata, authoritatively enforces the admin role.
+`ornn admin enrollment-tokens create` exports the configurable run
+`install_command` as a secret. Its file receipt separates `enrollment_run_id` from
+`token_metadata.id`, the credential ID used for revocation. Read its exact
+`created_at` with `enrollment-tokens list` before machine revocation; the run
+timestamp is not the credential generation. `ornn admin nodes enroll` creates and SSH-launches
+a configurable agent recovery run for the existing node. The former `--filter`
+and `--verbose` compartment options are removed; inspect the saved run for step
+progress. The gateway authoritatively enforces the admin role.
 `ornn admin nodes sanitize`, `sanitize-status`, and `sanitize-decide` drive one
 node's held sanitize job, sharing the capability with MCP
 `admin_node_sanitize_*` and Slack `node_sanitize_*`. `sanitize` needs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.137",
+  "version": "1.0.139",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/admin-enrollment.mjs

@@ -1,18 +1,11 @@
-import {
-  enrollmentTokensPath,
-  remoteRunPath,
-  listEnrollmentLogs,
-} from "../vendor/api-client/orchestrator.js";
 import { createHash } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
 
-import { CliApiError, resolveInstallerBaseUrl } from "./api-client.mjs";
-import { AtomicOutputExistsError, writeAtomicOutput } from "./atomic-output.mjs";
 import { ADMIN_MUTATION_SAFETY, AdminMutationError, runAdminMutation } from "./admin-mutations.mjs";
+import { CliApiError } from "./api-client.mjs";
+import { AtomicOutputExistsError, writeAtomicOutput } from "./atomic-output.mjs";
 
 const SECRET_OUTPUT = new Set(["tokens.create", "nodes.rotate-key"]);
-const ENROLLMENT_LOG_POLL_MS = 750;
-const ENROLLMENT_LOG_READ_TIMEOUT_MS = 5_000;
 
 const USAGE = {
   "tokens.create":
@@ -20,7 +13,7 @@ const USAGE = {
   "enrollment.token.revoke":
     "Usage: ornn admin enrollment-tokens revoke <token-id> [--expected-created-at TIME] [--idempotency-key KEY]",
   "nodes.enroll":
-    "Usage: ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose]",
+    "Usage: ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID --identity-file PATH --token-ttl SECONDS --replace-existing-management",
   "nodes.export-key":
     "Usage: ornn admin nodes export-key <node-id> (--print | --output PATH) [--overwrite]",
   "nodes.rotate-key":
@@ -167,22 +160,12 @@ function parseNodeEnroll(argv) {
   const { options, positionals } = parseOptions(
     argv,
     {
-      booleans: ["replace-existing-management", "verbose"],
+      booleans: ["replace-existing-management"],
       positionals: 1,
-      values: [
-        "facility",
-        "filter",
-        "host",
-        "identity-file",
-        "port",
-        "supplier",
-        "token-ttl",
-        "username",
-      ],
+      values: ["facility", "host", "identity-file", "port", "supplier", "token-ttl", "username"],
     },
     usage
   );
-  const filter = options.filter?.trim();
   if (!options["replace-existing-management"]) {
     throw new AdminMutationError(`${usage}\n--replace-existing-management is required.`, {
       field: "replace-existing-management",
@@ -194,7 +177,6 @@ function parseNodeEnroll(argv) {
       host: required(options, "host", usage),
       organization_id: uuid(required(options, "supplier", usage), "supplier"),
       facility_id: uuid(required(options, "facility", usage), "facility"),
-      ...(filter ? { filter } : {}),
       identity_file: required(options, "identity-file", usage),
       expires_in_seconds: boundedInteger(
         required(options, "token-ttl", usage),
@@ -205,7 +187,6 @@ function parseNodeEnroll(argv) {
       username: options.username?.trim() || "root",
       port: options.port ? boundedInteger(options.port, "port", 1, 65_535) : 22,
       replace_existing_management: true,
-      verbose: options.verbose === true,
     },
     mutation: {
       safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
@@ -246,17 +227,18 @@ function text(value, fallback = "") {
 
 function safeTokenMetadata(payload) {
   return {
-    id: text(payload?.id) || null,
+    id: text(payload?.credential_id) || null,
     organization_id: text(payload?.organization_id) || null,
-    status: text(payload?.status, "active"),
-    expires_at: text(payload?.expires_at) || null,
-    created_at: text(payload?.created_at) || null,
+    status: "active",
+    expires_at: text(payload?.credential_expires_at) || null,
+    // The run's creation time is not the credential's generation identity.
+    created_at: null,
   };
 }
 
 function secretMaterial(capabilityId, payload) {
   if (capabilityId === "tokens.create") {
-    return text(payload?.token) || text(payload?.plaintext);
+    return text(payload?.install_command);
   }
   const key = payload?.private_key;
   if (typeof key !== "string" || !key.length) return "";
@@ -302,7 +284,7 @@ async function exportSecret({ capabilityId, input, options, payload, stdout }) {
   }
   const metadata =
     capabilityId === "tokens.create"
-      ? { token_metadata: safeTokenMetadata(payload) }
+      ? { enrollment_run_id: text(payload?.id) || null, token_metadata: safeTokenMetadata(payload) }
       : { node_key: keyMetadata(input, payload) };
   if (options.print) {
     stdout.write(material);
@@ -341,7 +323,7 @@ async function exportSecret({ capabilityId, input, options, payload, stdout }) {
 function reviewFor(capabilityId, input, prepared) {
   if (capabilityId === "tokens.create") {
     return {
-      title: "Create enrollment token",
+      title: "Create enrollment command",
       fields: [
         { label: "Supplier", value: input.organization_id },
         { label: "Expires in", value: `${input.expires_in_seconds} seconds` },
@@ -374,7 +356,6 @@ function reviewFor(capabilityId, input, prepared) {
         { label: "SSH target", value: `${input.username}@${input.host}:${input.port}` },
         { label: "Supplier", value: input.organization_id },
         { label: "Facility", value: input.facility_id },
-        ...(input.filter ? [{ label: "Compartment filter", value: input.filter }] : []),
         { label: "Token lifetime", value: `${input.expires_in_seconds} seconds` },
       ],
       consequence:
@@ -403,7 +384,6 @@ async function enrollmentIdentityInput(input) {
     }
     return {
       ...input,
-      installer_base: resolveInstallerBaseUrl({ env: input.env }) ?? undefined,
       private_key: privateKey,
     };
   } catch (error) {
@@ -415,129 +395,6 @@ async function enrollmentIdentityInput(input) {
   }
 }
 
-function enrollmentRuns(payload) {
-  if (!payload || typeof payload !== "object") return [];
-  if (Array.isArray(payload.logs)) return payload.logs;
-  return Array.isArray(payload.runs) ? payload.runs : [];
-}
-
-function redactEnrollmentText(value, secrets) {
-  let text = typeof value === "string" ? value : String(value ?? "");
-  for (const secret of secrets) {
-    if (!secret) continue;
-    text = text.replaceAll(secret, "[redacted]");
-    text = text.replaceAll(encodeURIComponent(secret), "[redacted]");
-  }
-  return text;
-}
-
-function freshEnrollmentLogLines(payload, tokenId, secrets, seen) {
-  const session = enrollmentRuns(payload).find((candidate) => candidate?.token_id === tokenId);
-  if (!session || typeof session !== "object") return [];
-  const compartments = Array.isArray(session.compartments) ? session.compartments : [];
-  const total = Number.isInteger(session.progress_total)
-    ? session.progress_total
-    : compartments.length;
-  const lines = [];
-  for (const [index, compartment] of compartments.entries()) {
-    if (!compartment || typeof compartment !== "object") continue;
-    const id = String(compartment.id ?? index);
-    const numericId = Number(id);
-    const current = Number.isInteger(numericId) ? numericId + 1 : session.progress_index;
-    const title =
-      typeof compartment.title === "string" && compartment.title ? compartment.title : `Step ${id}`;
-    const state = typeof compartment.state === "string" ? compartment.state : "";
-    const stateKey = `${id}:state:${state}`;
-    if (state && !seen.has(stateKey)) {
-      seen.add(stateKey);
-      lines.push(`[enroll ${current}/${total}] ${title}: ${state}`);
-    }
-    const output = Array.isArray(compartment.output) ? compartment.output : [];
-    for (const [outputIndex, entry] of output.entries()) {
-      const stream =
-        entry && typeof entry === "object" && typeof entry.stream === "string"
-          ? entry.stream
-          : "stdout";
-      const seq =
-        entry && typeof entry === "object" && Number.isInteger(entry.seq) ? entry.seq : outputIndex;
-      const key = `${id}:output:${seq}:${stream}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      const raw = entry && typeof entry === "object" ? entry.text : entry;
-      const text = redactEnrollmentText(raw, secrets);
-      if (text) lines.push(`  ${stream === "stderr" ? "[stderr] " : ""}${text}`);
-    }
-  }
-  return lines;
-}
-
-function enrollmentProgressTransport(fetch, runtime, privateKey) {
-  let tokenId = "";
-  const secrets = [privateKey];
-  const seen = new Set();
-  const request = (path, init = {}) =>
-    fetch(
-      path,
-      init.signal === undefined && runtime.signal ? { ...init, signal: runtime.signal } : init
-    );
-
-  return async (path, init = {}) => {
-    if (path === enrollmentTokensPath) {
-      const minted = await request(path, init);
-      if (minted && typeof minted === "object") {
-        tokenId = typeof minted.id === "string" ? minted.id : "";
-        const token =
-          typeof minted.token === "string"
-            ? minted.token
-            : typeof minted.plaintext === "string"
-              ? minted.plaintext
-              : "";
-        if (token) secrets.push(token);
-      }
-      return minted;
-    }
-    if (path !== remoteRunPath || !tokenId) return request(path, init);
-
-    const remote = request(path, init).then(
-      (value) => ({ ok: true, value }),
-      (error) => ({ error, ok: false })
-    );
-    let stopped = false;
-    let timer;
-    let currentPoll = Promise.resolve();
-    const poll = async () => {
-      try {
-        const payload = await listEnrollmentLogs(
-          fetch,
-          {},
-          AbortSignal.timeout(ENROLLMENT_LOG_READ_TIMEOUT_MS)
-        );
-        const lines = freshEnrollmentLogLines(payload, tokenId, secrets, seen);
-        for (const line of lines) runtime.stderr.write(`${line}\n`);
-      } catch {
-        // Progress is best-effort; the authoritative remote request still determines success.
-      }
-    };
-    const schedule = () => {
-      timer = setTimeout(() => {
-        currentPoll = poll().finally(() => {
-          if (!stopped) schedule();
-        });
-      }, ENROLLMENT_LOG_POLL_MS);
-    };
-
-    await poll();
-    schedule();
-    const result = await remote;
-    stopped = true;
-    clearTimeout(timer);
-    await currentPoll;
-    await poll();
-    if (!result.ok) throw result.error;
-    return result.value;
-  };
-}
-
 function assertSecretOutputContext(input, runtime) {
   if (input.export?.print && runtime.formatProvided) {
     throw new AdminMutationError("--print cannot be combined with --format.", {
@@ -626,11 +483,7 @@ async function runEnrollmentMutation({ capability, execute, fetch, input, mutati
         capabilityId === "nodes.enroll"
           ? await enrollmentIdentityInput({ ...value, env: runtime.env })
           : value;
-      const transport =
-        capabilityId === "nodes.enroll" && executionInput.verbose
-          ? enrollmentProgressTransport(fetch, runtime, executionInput.private_key)
-          : undefined;
-      return execute(executionInput, { confirmed: true, transport });
+      return execute(executionInput, { confirmed: true });
     },
   });
 

package/src/catalog-shell.mjs

@@ -814,7 +814,7 @@ function assertCustomerResultSafe(value, ownOrganizationId) {
 }
 
 function parseCapabilityInput(capability, rawInput) {
-  const parsed = capability.input.safeParse(rawInput);
+  const parsed = (capability.cli?.input ?? capability.input).safeParse(rawInput);
   if (parsed.success) return parsed.data;
   const issue = parsed.error.issues[0];
   if (issue?.path?.[0] === "$positionals") {
@@ -992,7 +992,7 @@ async function executeCapability(
   let ownOrganizationId;
   let data;
   try {
-    data = await capability.execute(
+    data = await (capability.cli?.execute ?? capability.execute)(
       {
         actor: "",
         confirmed,

package/src/external-bucket-commands.mjs

@@ -1,5 +1,6 @@
 import * as storageApi from "../vendor/api-client/orchestrator.js";
 import * as gatewayApi from "../vendor/api-client/gateway.js";
+import { bucketShowCapability, bucketDisconnectCapability } from "../vendor/capabilities/cli.js";
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 
@@ -479,7 +480,11 @@ async function listBuckets(input, runtime) {
 
 async function showBucket(input, runtime) {
   const [reference] = positions(input, 1, "ornn external-buckets show <external-bucket>");
-  const bucket = resolveExternalBucket(await fetchDrives(runtime), reference);
+  const source = resolveExternalBucket(await fetchDrives(runtime), reference);
+  const bucket = await bucketShowCapability.execute(
+    { actor: "", role: "user", fetch: runtime.fetch },
+    { driveId: source.id }
+  );
   return runtime.interaction.result({ data: { external_bucket: safeExternalBucket(bucket) } });
 }
 
@@ -692,11 +697,20 @@ async function disconnectBucket(input, runtime) {
     );
   }
   try {
-    await storageApi.deleteDrive(
-      runtime.fetch,
-      safe.id,
-      {},
-      { headers: idempotencyHeaders(input) }
+    await bucketDisconnectCapability.execute(
+      {
+        actor: "",
+        role: "user",
+        confirmed: true,
+        fetch: (path, init) =>
+          runtime.fetch(path, {
+            ...init,
+            ...(init?.method === "DELETE"
+              ? { headers: { ...init.headers, ...idempotencyHeaders(input) } }
+              : {}),
+          }),
+      },
+      { driveId: safe.id }
     );
   } catch (error) {
     throw safeExternalError(error, "The external bucket could not be disconnected safely.");

package/src/storage-commands.mjs

@@ -1,4 +1,5 @@
 import * as storageApi from "../vendor/api-client/orchestrator.js";
+import { bucketListCapability, volumeFilesListCapability } from "../vendor/capabilities/cli.js";
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { stat } from "node:fs/promises";
@@ -292,11 +293,14 @@ export async function fetchDrivePage(runtime, { limit = 25, cursor, scope = "all
     usage("--limit must be an integer from 1 through 100.", "limit");
   }
   try {
-    const payload = await storageApi.listDrives(runtime.fetch, {
-      limit: Number(limit),
-      scope,
-      ...(cursor ? { cursor } : {}),
-    });
+    const input = { limit: Number(limit), ...(cursor ? { cursor } : {}) };
+    const payload =
+      scope === "external"
+        ? await bucketListCapability.execute(
+            { actor: "", role: "user", fetch: runtime.fetch },
+            input
+          )
+        : await storageApi.listDrives(runtime.fetch, { ...input, scope });
     return { drives: volumeRows(payload), next_cursor: payload?.next_cursor ?? null };
   } catch (error) {
     throw safeStorageError(error, "Volumes could not be loaded safely.");
@@ -552,33 +556,21 @@ function shellQuote(value) {
 }
 
 async function fetchFileRows(runtime, drive, prefix) {
-  const folder = prefix.includes("/") ? prefix.slice(0, prefix.lastIndexOf("/")) : "";
   const entries = [];
-  let cursor = 0;
-  while (cursor !== null) {
-    let page;
-    try {
-      page = await storageApi.listDriveContents(runtime.fetch, String(drive.id), {
-        recursive: true,
-        ...(folder ? { path: folder } : {}),
-        ...(cursor ? { cursor } : {}),
-      });
-    } catch (error) {
-      throw safeStorageError(error, "Volume files could not be listed safely.");
-    }
-    entries.push(...(Array.isArray(page?.entries) ? page.entries : []));
-    const next = page?.next_cursor;
-    cursor = Number.isInteger(next) || (typeof next === "string" && next) ? next : null;
-  }
-  return entries
-    .filter((entry) => entry?.kind === "file")
-    .map(safeFile)
-    .filter((entry) => entry.path && entry.path.startsWith(prefix))
-    .sort(
-      (left, right) =>
-        (Date.parse(right.updated_at ?? "") || 0) - (Date.parse(left.updated_at ?? "") || 0) ||
-        left.path.localeCompare(right.path)
+  try {
+    const files = await volumeFilesListCapability.execute(
+      { actor: "", role: "user", fetch: runtime.fetch },
+      { driveId: drive.id, prefix }
     );
+    for await (const entry of files) entries.push(safeFile(entry));
+  } catch (error) {
+    throw safeStorageError(error, "Volume files could not be listed safely.");
+  }
+  return entries.sort(
+    (left, right) =>
+      (Date.parse(right.updated_at ?? "") || 0) - (Date.parse(left.updated_at ?? "") || 0) ||
+      left.path.localeCompare(right.path)
+  );
 }
 
 async function listFiles(input, runtime) {