@ornncompute/cli 1.0.25 → 1.0.35

package/src/admin-shell.mjs

@@ -1,7 +1,9 @@
 import { adminCommandHandler } from "./admin-command-handlers.mjs";
+import { shellSingleQuote } from "./identity-file.mjs";
 
 const DEFAULT_PAGE_LIMIT = 50;
 const MAX_PAGE_LIMIT = 500;
+const LOG_CURSOR_PREFIX = "ornn-admin-logs-v1.";
 
 export class AdminUsageError extends Error {
   constructor(message, { code = "usage_error", field } = {}) {
@@ -88,7 +90,7 @@ export function resolveAdminRequest(catalog, roots, argv) {
     );
   }
 
-  if (argv.length === 1) {
+  if (argv.length === 1 || (argv.length === 2 && ["--help", "-h"].includes(argv[1]))) {
     const root = roots.find((candidate) => candidate.name === argv[0]);
     if (root) return { kind: "root", command: `admin ${root.name}`, root: root.name };
   }
@@ -168,7 +170,7 @@ function parseAdminInput(capability, argv) {
   const limit = positiveInteger(options.limit, "limit", MAX_PAGE_LIMIT) ?? DEFAULT_PAGE_LIMIT;
   const input = {};
   if (nodeCommand) input.node_id = positionals[0];
-  if (options.operator) input.operator = options.operator;
+  if (options.supplier) input.organization_id = options.supplier;
   if (options.facility) input.facility_id = options.facility;
   if (options.status) input.status = options.status;
   if (options.email) input.email = options.email;
@@ -186,20 +188,100 @@ function parseAdminInput(capability, argv) {
   const count = positiveInteger(options.count, "count", 500);
   if (count !== undefined) input.count = count;
 
+  if (command === "admin nodes logs") return parseLogPage(input);
+
+  const ownerPagination = ["facilities.list", "nodes.list"].includes(capability.id);
+  if (ownerPagination) {
+    input.limit = limit;
+    if (options.cursor) input.cursor = options.cursor;
+  }
+
   return {
     input,
     pagination: {
       cursor: options.cursor,
-      limit: command === "admin nodes logs" ? (count ?? 200) : limit,
+      limit,
+      ownerPagination,
+    },
+  };
+}
+
+function invalidLogCursor(message) {
+  throw new AdminUsageError(message, { code: "invalid_cursor", field: "cursor" });
+}
+
+function parseLogPage(input) {
+  let offset = 0;
+  if (input.cursor?.startsWith(LOG_CURSOR_PREFIX)) {
+    let saved;
+    try {
+      saved = JSON.parse(
+        Buffer.from(input.cursor.slice(LOG_CURSOR_PREFIX.length), "base64url").toString("utf8")
+      );
+    } catch {
+      invalidLogCursor("The log cursor is invalid; restart from the first page.");
+    }
+    if (
+      !saved ||
+      typeof saved !== "object" ||
+      saved.node_id !== input.node_id ||
+      !["kernel", "serial"].includes(saved.stream) ||
+      typeof saved.before !== "string" ||
+      !Number.isFinite(Date.parse(saved.before)) ||
+      !Number.isInteger(saved.count) ||
+      saved.count < 1 ||
+      saved.count > 500 ||
+      !Number.isSafeInteger(saved.offset) ||
+      saved.offset < 0 ||
+      !(
+        saved.ownerCursor === null ||
+        (typeof saved.ownerCursor === "string" && saved.ownerCursor.length > 0)
+      )
+    )
+      invalidLogCursor("The log cursor is invalid or belongs to a different node.");
+    for (const field of ["stream", "before", "count"]) {
+      if (input[field] !== undefined && input[field] !== saved[field]) {
+        invalidLogCursor(
+          `The log cursor has a different ${field}; restart from the first page to change filters.`
+        );
+      }
+      input[field] = saved[field];
+    }
+    input.cursor = saved.ownerCursor ?? undefined;
+    offset = saved.offset;
+  } else if (input.cursor && !input.before) {
+    invalidLogCursor(
+      "A legacy log cursor requires the original --before value; otherwise restart from the first page."
+    );
+  }
+  input.before ??= new Date().toISOString();
+  input.stream ??= "kernel";
+  input.count ??= 200;
+  if (!Number.isFinite(Date.parse(input.before))) {
+    throw new AdminUsageError("--before must be a valid timestamp.", { field: "before" });
+  }
+  return {
+    input,
+    pagination: {
+      limit: input.count,
+      logQuery: {
+        node_id: input.node_id,
+        before: input.before,
+        stream: input.stream,
+        count: input.count,
+      },
+      ownerCursor: input.cursor ?? null,
+      offset,
     },
   };
 }
 
 function collectionKey(capability) {
   const [, root, leaf] = vnextCommand(capability);
-  if (root === "enrollment-tokens") return "enrollment_tokens";
   if (root === "nodes" && leaf === "logs") return "logs";
-  return ["facilities", "nodes", "operators", "reservations", "users"].includes(root) ? root : null;
+  if (!["list", "search"].includes(leaf)) return null;
+  if (root === "enrollment-tokens") return "enrollment_tokens";
+  return ["facilities", "nodes", "reservations", "suppliers", "users"].includes(root) ? root : null;
 }
 
 function isSensitiveAdminField(key) {
@@ -234,7 +316,16 @@ function sanitizeAdminValue(value) {
 function collectionRows(payload, key) {
   if (Array.isArray(payload)) return payload;
   if (!payload || typeof payload !== "object") return [];
-  for (const candidate of [key, "items", "results", "data", "entries", "events", "records"]) {
+  for (const candidate of [
+    key,
+    ...(key === "logs" ? ["lines"] : []),
+    "items",
+    "results",
+    "data",
+    "entries",
+    "events",
+    "records",
+  ]) {
     if (Array.isArray(payload[candidate])) return payload[candidate];
   }
   return [];
@@ -269,16 +360,44 @@ export function finalizeAdminResult(capability, payload, pagination) {
   const key = collectionKey(capability);
   if (!key) return { data: sanitizeAdminValue(payload), page: null };
   const rows = collectionRows(payload, key);
-  const offset = decodeCursor(command, pagination.cursor);
-  const selected = rows.slice(offset, offset + pagination.limit).map(sanitizeAdminValue);
+  const offset = pagination.ownerPagination
+    ? 0
+    : pagination.logQuery
+      ? pagination.offset
+      : decodeCursor(command, pagination.cursor);
+  const selected = (
+    pagination.ownerPagination ? rows : rows.slice(offset, offset + pagination.limit)
+  ).map(sanitizeAdminValue);
   const ownerNextCursor =
     payload && !Array.isArray(payload)
       ? (payload.next_cursor ?? payload.nextCursor ?? payload.page?.next_cursor ?? null)
       : null;
-  const nextCursor =
-    offset + selected.length < rows.length
+  let nextCursor =
+    !pagination.ownerPagination && offset + selected.length < rows.length
       ? encodeCursor(command, offset + selected.length)
       : (ownerNextCursor ?? null);
+  if (pagination.ownerPagination && nextCursor !== null && nextCursor === pagination.cursor) {
+    throw new AdminUsageError(
+      "The service repeated its pagination cursor; restart from the first page.",
+      {
+        code: "pagination_not_advancing",
+        field: "cursor",
+      }
+    );
+  }
+  if (pagination.logQuery && nextCursor !== null) {
+    const localPage = offset + selected.length < rows.length;
+    nextCursor =
+      LOG_CURSOR_PREFIX +
+      Buffer.from(
+        JSON.stringify({
+          ...pagination.logQuery,
+          ownerCursor: localPage ? pagination.ownerCursor : ownerNextCursor,
+          offset: localPage ? offset + selected.length : 0,
+        }),
+        "utf8"
+      ).toString("base64url");
+  }
   return {
     data: { [key]: selected },
     page: {
@@ -304,7 +423,7 @@ export function writeAdminHelpHuman(stdout, capability) {
   stdout.write(`Usage:\n  ${data.human}\n\nAutomation:\n  ${data.automation}\n`);
 }
 
-export function writeAdminResultHuman(stdout, command, result) {
+export function writeAdminResultHuman(stdout, command, result, input = {}) {
   const key = result.page ? Object.keys(result.data)[0] : null;
   if (!key) {
     stdout.write(`${JSON.stringify(result.data, null, 2)}\n`);
@@ -317,6 +436,21 @@ export function writeAdminResultHuman(stdout, command, result) {
     for (const row of rows) stdout.write(`${JSON.stringify(row)}\n`);
   }
   if (result.page.next_cursor) {
-    stdout.write(`Next: ornn ${command} --cursor ${result.page.next_cursor}\n`);
+    const target = command === "admin nodes logs" ? ` ${shellSingleQuote(input.node_id)}` : "";
+    const filters = [
+      ["supplier", input.organization_id],
+      ["facility", input.facility_id],
+      ["status", input.status],
+      ["email", input.email],
+      ["organization", input.organization],
+      ["name", input.name],
+      ["limit", input.limit],
+    ]
+      .filter(([, value]) => value !== undefined)
+      .map(([name, value]) => ` --${name} ${shellSingleQuote(String(value))}`)
+      .join("");
+    stdout.write(
+      `Next: ornn ${command}${target} --cursor ${shellSingleQuote(result.page.next_cursor)}${filters}\n`
+    );
   }
 }

package/src/catalog-shell.mjs

@@ -36,7 +36,7 @@ import {
   executeExternalBucketCommand,
   writeExternalBucketResultHuman,
 } from "./external-bucket-commands.mjs";
-import { executeEvidenceCommand } from "./evidence-commands.mjs";
+import { executeEvidenceCommand, supplierOwnedRecord } from "./evidence-commands.mjs";
 import {
   executeKubernetesClusterCommand,
   kubernetesConnectModeHandler,
@@ -753,11 +753,8 @@ const CUSTOMER_FORBIDDEN_FIELDS = {
   clientSecret: true,
   payment_secret: true,
   paymentSecret: true,
-  operator: true,
-  operatorId: true,
-  operatorName: true,
-  operator_id: true,
-  operator_name: true,
+  organizationName: true,
+  organization_name: true,
   internal_owner: true,
   internalOwner: true,
   payment_intent_client_secret: true,
@@ -771,12 +768,12 @@ const CUSTOMER_FORBIDDEN_FIELDS = {
   payment_provider: true,
   paymentProvider: true,
   provider: true,
-  site_operator: true,
-  siteOperator: true,
-  site_operator_id: true,
-  site_operator_name: true,
-  siteOperatorId: true,
-  siteOperatorName: true,
+  site_supplier: true,
+  siteSupplier: true,
+  site_supplier_id: true,
+  site_supplier_name: true,
+  siteSupplierId: true,
+  siteSupplierName: true,
   reconciliation: true,
   reconciliation_status: true,
   reconciliationStatus: true,
@@ -789,22 +786,34 @@ const CUSTOMER_FORBIDDEN_FIELDS = {
   supplier_name: true,
   supplierId: true,
   supplierName: true,
+  supplier_organization_id: true,
+  supplier_organization_name: true,
+  supplierOrganizationId: true,
+  supplierOrganizationName: true,
 };
+const SUPPLIER_OWNER_FIELDS = { organizationId: true, organization_id: true };
 
-function assertCustomerResultSafe(value) {
+// The caller's own organization on a listing it relisted is not supplier identity.
+function assertCustomerResultSafe(value, ownOrganizationId) {
   if (Array.isArray(value)) {
-    for (const item of value) assertCustomerResultSafe(item);
+    for (const item of value) assertCustomerResultSafe(item, ownOrganizationId);
     return;
   }
   if (!value || typeof value !== "object") return;
+  const ownedBySupplier = supplierOwnedRecord(value);
   for (const [key, child] of Object.entries(value)) {
-    if (CUSTOMER_FORBIDDEN_FIELDS[key] === true) {
+    if (
+      CUSTOMER_FORBIDDEN_FIELDS[key] === true ||
+      (ownedBySupplier &&
+        SUPPLIER_OWNER_FIELDS[key] === true &&
+        !(ownOrganizationId && child === ownOrganizationId))
+    ) {
       throw new VnextContractError(
         "The gateway returned an unexpected response shape.",
         "customer_result_unsafe"
       );
     }
-    assertCustomerResultSafe(child);
+    assertCustomerResultSafe(child, ownOrganizationId);
   }
 }
 
@@ -824,6 +833,28 @@ function parseCapabilityInput(capability, rawInput) {
   });
 }
 
+// Commerce's market routes and Markets serve every caller on one path and
+// decide from the session what it may do; a staff session is an admin there.
+const ROLE_AWARE_PREFIXES = ["/commerce/listings", "/commerce/reservations", "/commerce/fees", "/v1/markets"];
+
+function isRoleAwarePath(path) {
+  const pathname = String(path).split("?")[0];
+  return ROLE_AWARE_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
+
+function adminFetch(io, path, init = {}) {
+  const request = {
+    endpoint: path,
+    env: io.env,
+    fetchImpl: io.fetchImpl,
+    method: init.method ?? "GET",
+    ...(init.body !== undefined ? { body: init.body } : {}),
+    ...(init.headers !== undefined ? { headers: init.headers } : {}),
+    ...((init.signal ?? io.signal) !== undefined ? { signal: init.signal ?? io.signal } : {}),
+  };
+  return isRoleAwarePath(path) ? cliRequest(request) : operatorRequest(request);
+}
+
 async function customerCapabilityFetch(io, path, init = {}, sessionSnapshot) {
   const authRequired = path !== "/v1/cli/status";
   const session = sessionSnapshot?.current;
@@ -976,24 +1007,13 @@ async function executeCapability(
             });
           }
           if (audience === "admin") {
-            const search = new URL(path, "https://cli.invalid").search;
+            // Shared observability capabilities use their owner namespace;
+            // the CLI reaches those same node-scoped routes through staff auth.
             const endpoint =
-              capability.id === "telemetry.latest"
-                ? `/telemetry/latest${search}`
-                : capability.id === "logs.latest"
-                  ? `/logs/latest${search}`
-                  : path;
-            return operatorRequest({
-              endpoint,
-              env: io.env,
-              fetchImpl: io.fetchImpl,
-              method: init.method ?? "GET",
-              ...(init.body !== undefined ? { body: init.body } : {}),
-              ...(init.headers !== undefined ? { headers: init.headers } : {}),
-              ...((init.signal ?? io.signal) !== undefined
-                ? { signal: init.signal ?? io.signal }
-                : {}),
-            });
+              capability.id === "telemetry.latest" || capability.id === "logs.latest"
+                ? path.replace(/^\/v1\/observability\//, "/")
+                : path;
+            return adminFetch(io, endpoint, init);
           }
           return customerCapabilityFetch(io, path, init, authSnapshot);
         },
@@ -1016,7 +1036,9 @@ async function executeCapability(
   } finally {
     interaction?.close();
   }
-  if (audience === "customer") assertCustomerResultSafe(data);
+  if (audience === "customer") {
+    assertCustomerResultSafe(data, authSnapshot?.current?.selectedOrganizationId);
+  }
   if (audience === "admin" || sessionCommand || isInteractionExecution(data)) return data;
   return {
     action: null,
@@ -1174,16 +1196,7 @@ export async function runCatalogCli(argv, io, { version }) {
           input,
           role,
         });
-      const fetch = (path, init = {}) =>
-        operatorRequest({
-          endpoint: path,
-          env: io.env,
-          fetchImpl: io.fetchImpl,
-          method: init.method ?? "GET",
-          ...(init.body !== undefined ? { body: init.body } : {}),
-          ...(init.headers !== undefined ? { headers: init.headers } : {}),
-          ...(init.signal !== undefined ? { signal: init.signal } : {}),
-        });
+      const fetch = (path, init = {}) => adminFetch({ ...io, signal: undefined }, path, init);
       const execution = adminRequest.handler
         ? await adminRequest.handler.run({
             capability: adminRequest.capability,
@@ -1228,7 +1241,7 @@ export async function runCatalogCli(argv, io, { version }) {
         resume: execution.resume ?? null,
       };
       if (machine) writeMachine(stdout, format, envelope);
-      else writeAdminResultHuman(stdout, adminRequest.command, result);
+      else writeAdminResultHuman(stdout, adminRequest.command, result, adminRequest.input);
       return {
         exitCode: execution.exitCode ?? CLI_EXIT_STATUS.success,
         suppressUpdateNotification:

package/src/device-auth.mjs

@@ -3,7 +3,7 @@ import { spawn } from "node:child_process";
 import { configuredAuthBaseUrl } from "./auth-store.mjs";
 import { readUntilDeadline, waitForDelay } from "./wait-runtime.mjs";
 
-const DEFAULT_AUTH_BASE_URL = "http://localhost:3000";
+const DEFAULT_AUTH_BASE_URL = "https://compute.ornn.com";
 const DEFAULT_POLL_INTERVAL_SECONDS = 2;
 const DEFAULT_TIMEOUT_SECONDS = 600;
 

package/src/evidence-commands.mjs

@@ -1,3 +1,4 @@
+import { gpuLabeler } from "./gpu-catalog.mjs";
 import { clusterFactLabel, reservationFactsForCluster } from "./kubernetes-commands.mjs";
 import { listOwnedActiveMachines, resolveMachineReference } from "./machine-reference.mjs";
 import { machineReachability } from "./vm-commands.mjs";
@@ -21,7 +22,7 @@ const SAFE_METRICS = new Set([
 ]);
 const TERMINAL_MACHINE_STATES = new Set(["deleted", "ended", "released", "terminated"]);
 const UNSAFE_LOG_MESSAGE = [
-  /\b(?:operator(?:name|id|_name|_id)?|provider(?:name|id|_name|_id)?|site_operator|supplier(?:name|id|_name|_id)?)\s*[:=]/i,
+  /\b(?:provider(?:name|id|_name|_id)?|site_supplier|supplier(?:name|id|_name|_id|_organization_id|_organization_name)?|organization_?name)\s*[:=]/i,
   /\b(?:authorization|api[_ -]?key|access[_ -]?token|refresh[_ -]?token|password|secret|private[_ -]?key)\s*[:=]/i,
   /-----BEGIN [A-Z ]*PRIVATE KEY-----/i,
   /\/(?:internal|v1\/(?:orchestrator|observability|cli\/operator))(?:\/|\b)/i,
@@ -30,9 +31,7 @@ const UNSAFE_LOG_MESSAGE = [
 const UNSAFE_KEYS = new Set([
   "authorization",
   "clientsecret",
-  "operator",
-  "operatorid",
-  "operatorname",
+  "organizationname",
   "password",
   "paymentsecret",
   "privatekey",
@@ -40,14 +39,16 @@ const UNSAFE_KEYS = new Set([
   "providerid",
   "providername",
   "refreshtoken",
-  "siteoperator",
-  "siteoperatorid",
-  "siteoperatorname",
+  "sitesupplier",
+  "sitesupplierid",
+  "sitesuppliername",
   "staffactivity",
   "stripeclientsecret",
   "supplier",
   "supplierid",
   "suppliername",
+  "supplierorganizationid",
+  "supplierorganizationname",
   "token",
 ]);
 const STABLE_SOURCE_CODES = new Set([
@@ -73,13 +74,25 @@ function normalizedKey(value) {
     .toLowerCase();
 }
 
+// A node, listing, or facility's organization is its supplier; a reservation's
+// or drive's is the buyer, which the caller may see.
+export function supplierOwnedRecord(value) {
+  const keys = new Set(Object.keys(record(value)).map(normalizedKey));
+  if (keys.has("driveid")) return false;
+  if (keys.has("nodeid")) return true;
+  if (keys.has("reservationid")) return false;
+  return keys.has("listingid") || keys.has("facilityid");
+}
+
 function containsUnsafeFields(value) {
   if (Array.isArray(value)) return value.some(containsUnsafeFields);
   if (!value || typeof value !== "object") return false;
+  const ownedBySupplier = supplierOwnedRecord(value);
   return Object.entries(value).some(([key, child]) => {
     const normalized = normalizedKey(key);
     return (
       UNSAFE_KEYS.has(normalized) ||
+      (ownedBySupplier && normalized === "organizationid") ||
       normalized.includes("secret") ||
       normalized.includes("token") ||
       normalized.includes("password") ||
@@ -416,7 +429,7 @@ async function clusters(fetch, interaction) {
     );
 }
 
-function resourceChoice(resource) {
+function resourceChoice(resource, gpuLabel) {
   if (resource.kind === "machine") {
     return {
       label: `VM/Bare Metal · ${resource.machine.hostname ?? "Unnamed machine"} · ${resource.machine.lifecycle.class}`,
@@ -424,7 +437,7 @@ function resourceChoice(resource) {
     };
   }
   return {
-    label: clusterFactLabel(resource.cluster, resource.reservation_facts),
+    label: clusterFactLabel(resource.cluster, resource.reservation_facts, gpuLabel),
     value: `cluster:${resource.cluster.id}`,
   };
 }
@@ -519,9 +532,10 @@ async function resolveResource(command, input, fetch, interaction) {
       };
     })
   );
-  const choices = enriched.map(resourceChoice);
+  const gpuLabel = await gpuLabeler(fetch);
+  const choices = enriched.map((resource) => resourceChoice(resource, gpuLabel));
   const selected = await interaction.ask({ label: "Resource", choices });
-  const match = enriched.find((resource) => resourceChoice(resource).value === selected);
+  const match = enriched.find((resource) => resourceChoice(resource, gpuLabel).value === selected);
   if (!match)
     interaction.usage("Choose one exact machine or cluster.", { code: "resource_ambiguous" });
   return match;

package/src/gpu-catalog.mjs

@@ -0,0 +1,21 @@
+import { gpuDisplay, HARDWARE_CATALOG_PATH, parseHardwareCatalog } from "../vendor/capabilities/cli.js";
+
+const catalogs = new WeakMap();
+
+/**
+ * Renders GPU slugs by their catalog display name, reading the catalog once
+ * per fetch. An unreadable catalog renders GPUs as unknown instead of
+ * failing the command.
+ */
+export async function gpuLabeler(fetch, path = HARDWARE_CATALOG_PATH) {
+  let terms = catalogs.get(fetch);
+  if (!terms) {
+    terms = Promise.resolve()
+      .then(() => fetch(path, { method: "GET" }))
+      .then((payload) => parseHardwareCatalog(payload).terms)
+      .catch(() => []);
+    catalogs.set(fetch, terms);
+  }
+  const resolved = await terms;
+  return (slug) => gpuDisplay(resolved, slug);
+}

package/src/identity-file.mjs

@@ -0,0 +1,28 @@
+import { stat as statDefault } from "node:fs/promises";
+
+/** Quote one argument for a POSIX `sh` copy-paste command. */
+export function shellSingleQuote(value) {
+  return `'${String(value).replaceAll("'", "'\"'\"'")}'`;
+}
+
+/**
+ * OpenSSH refuses a private key that other users can read. Report that before
+ * handing the terminal to ssh so the fix is a single chmod. Windows file modes
+ * are not POSIX permissions, so the check only runs on POSIX systems; a
+ * missing file is left for ssh to report.
+ */
+export async function identityFilePermissionProblem(
+  path,
+  { platform = process.platform, stat = statDefault } = {}
+) {
+  if (!path || platform === "win32") return null;
+  let info;
+  try {
+    info = await stat(path);
+  } catch {
+    return null;
+  }
+  if ((info.mode & 0o077) === 0) return null;
+  const mode = (info.mode & 0o777).toString(8).padStart(3, "0");
+  return `SSH private key ${path} can be read by other users (mode ${mode}). Restrict it with: chmod 600 -- ${shellSingleQuote(path)}`;
+}

package/src/kubernetes-commands.mjs

@@ -7,7 +7,8 @@ import {
 } from "./atomic-output.mjs";
 import { isRecoverableWaitFailure } from "./interaction-runtime.mjs";
 import { waitForGoal as waitForReadGoal } from "./wait-runtime.mjs";
-import { reservationChoiceLabel } from "./machine-reference.mjs";
+import { gpuLabeler } from "./gpu-catalog.mjs";
+import { reservationLabeler } from "./machine-reference.mjs";
 import { keyInputShapePreflight, keyPlanFromInput, materializeKey } from "./vm-commands.mjs";
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -822,12 +823,13 @@ async function resolveLaunchReservation(context, runtime, input, accessMode) {
   if (active.length === 1) {
     return fetchReservation(context.fetch, runtime, text(record(active[0]).id), accessMode);
   }
+  const reservationLabel = await reservationLabeler(context.fetch);
   const selected = await runtime.ask({
     label: "Capacity reservation",
     choices: active.flatMap((value) => {
       const reservation = record(value);
       const id = text(reservation.id);
-      return id ? [{ label: reservationChoiceLabel(reservation), value: id }] : [];
+      return id ? [{ label: reservationLabel(reservation), value: id }] : [];
     }),
   });
   if (!selected)
@@ -1915,9 +1917,10 @@ export async function reservationFactsForCluster(fetch, runtime, cluster) {
   return projectReservationFacts(payload, cluster.reservation_id, runtime);
 }
 
-export function clusterFactLabel(cluster, reservation) {
+export function clusterFactLabel(cluster, reservation, gpuLabel) {
   const location = reservation.facility ?? reservation.region ?? "location unknown";
-  const hardware = reservation.hardware ?? cluster.gpu_type ?? "hardware unknown";
+  const gpu = reservation.hardware ?? cluster.gpu_type;
+  const hardware = gpu ? gpuLabel(gpu) : "hardware unknown";
   const nodeCount =
     integer(cluster.membership_count) ??
     integer(cluster.node_count) ??
@@ -1937,11 +1940,13 @@ export async function clusterModeConnectCandidates(state, accessMode) {
   const available = (await clusters)
     .filter((cluster) => cluster.access_mode === accessMode && cluster.lifecycle.class !== "ended")
     .map((cluster) => requireValidCluster(runtime, cluster));
+  const gpuLabel = await gpuLabeler(context.fetch);
   return Promise.all(
     available.map(async (cluster) => ({
       label: clusterFactLabel(
         cluster,
-        await reservationFactsForCluster(context.fetch, runtime, cluster)
+        await reservationFactsForCluster(context.fetch, runtime, cluster),
+        gpuLabel
       ),
       reference: cluster.id,
     }))
@@ -1984,10 +1989,11 @@ export async function resolveClusterModeConnectTarget(state, accessMode) {
       selected = available[0];
     } else {
       const choices = [];
+      const gpuLabel = await gpuLabeler(context.fetch);
       for (const cluster of available) {
         const reservation = await reservationFactsForCluster(context.fetch, runtime, cluster);
         choices.push({
-          label: clusterFactLabel(cluster, reservation),
+          label: clusterFactLabel(cluster, reservation, gpuLabel),
           value: cluster.id,
         });
       }

package/src/machine-reference.mjs

@@ -1,3 +1,5 @@
+import { gpuLabeler } from "./gpu-catalog.mjs";
+
 const CANONICAL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const PAGE_SIZE = 500;
 const MAX_RESERVATION_PAGES = 20;
@@ -59,9 +61,10 @@ function reservationModeLabel(value) {
   }
 }
 
-export function reservationChoiceLabel(value) {
+export function reservationChoiceLabel(value, gpuLabel) {
   const reservation = record(value);
-  const hardware = text(reservation.gpu_type) ?? text(reservation.hardware) ?? "GPU capacity";
+  const gpu = text(reservation.gpu_type);
+  const hardware = gpu ? gpuLabel(gpu) : (text(reservation.hardware) ?? "GPU capacity");
   const quantity = Number(reservation.node_count ?? reservation.machine_count ?? 1);
   const machines = Number.isInteger(quantity) && quantity > 0 ? quantity : 1;
   const location =
@@ -83,6 +86,11 @@ export function reservationChoiceLabel(value) {
     .join(" · ");
 }
 
+export async function reservationLabeler(fetch) {
+  const gpuLabel = await gpuLabeler(fetch);
+  return (reservation) => reservationChoiceLabel(reservation, gpuLabel);
+}
+
 function isActiveDirectReservation(value) {
   const source = record(value);
   const status = (text(source.status) ?? text(source.state) ?? "").toLowerCase();