@ornncompute/cli 1.0.72 → 1.0.97

package/src/external-bucket-commands.mjs

@@ -5,6 +5,7 @@ import { CliApiError, computeEndpoint } from "./api-client.mjs";
 import { isRecoverableWaitFailure } from "./interaction-runtime.mjs";
 import {
   codeOf,
+  detailOf,
   fetchDrives,
   fetchDrivePage,
   idempotencyHeaders,
@@ -83,6 +84,26 @@ function verificationCode(source) {
   return typeof code === "string" && /^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(code) ? code : null;
 }
 
+const TRANSFER_ACCOUNT_PATTERN = /^[a-z][a-z0-9-]{4,28}[a-z0-9]@[a-z][a-z0-9-]{4,28}[a-z0-9]\.iam\.gserviceaccount\.com$/;
+
+function safeTransferAccount(value) {
+  return typeof value === "string" && TRANSFER_ACCOUNT_PATTERN.test(value) ? value : null;
+}
+
+function gcsGrantPresentation(safe) {
+  const account = safe.access.transfer_account;
+  if (safe.kind !== "gcs" || !account) return null;
+  const grant = (role) =>
+    `  gcloud storage buckets add-iam-policy-binding gs://${safe.location.bucket} --member=serviceAccount:${account} --role=${role}`;
+  return [
+    `Your organization's Ornn transfer account: ${account}`,
+    "Grant it read access to the bucket:",
+    grant("roles/storage.objectViewer"),
+    grant("roles/storage.legacyBucketReader"),
+    "Then deploy the volume to a reservation from the Ornn console.",
+  ];
+}
+
 function safeExternalBucket(drive, { forceUnverified = false } = {}) {
   const source = drive?.source ?? {};
   const kind = externalKind(drive);
@@ -110,6 +131,9 @@ function safeExternalBucket(drive, { forceUnverified = false } = {}) {
     access: {
       mode: source.read_only === false ? "read-write" : "read-only",
       credentials_configured: kind === "gcs" ? false : source.credentials_configured === true,
+      ...(kind === "gcs"
+        ? { transfer_account: safeTransferAccount(source.transfer_service_account) }
+        : {}),
     },
     verification: {
       phase,
@@ -402,7 +426,7 @@ function connectionEquivalent(drive, intent) {
   );
 }
 
-function requireMutationPreflight(input, runtime, { consent = false } = {}) {
+function requireMutationPreflight(input, runtime) {
   const noninteractive = runtime.interaction.machine || runtime.interaction.redirected;
   if (noninteractive && !String(input.idempotencyKey ?? "").trim()) {
     usage(
@@ -410,23 +434,6 @@ function requireMutationPreflight(input, runtime, { consent = false } = {}) {
       "idempotency-key"
     );
   }
-  if (noninteractive && consent && input.yes !== true) {
-    usage(
-      "Consent is required. Review the exact intent and supply --yes.",
-      "yes",
-      "consent_required"
-    );
-  }
-}
-
-async function reviewed(runtime, options) {
-  const accepted = await runtime.interaction.review(options);
-  if (accepted) return null;
-  return runtime.interaction.result({
-    data: null,
-    exitCode: 1,
-    outcome: { class: "ended", phase: "declined" },
-  });
 }
 
 const SAFE_EXTERNAL_ERRORS = {
@@ -465,13 +472,18 @@ function safeExternalError(error, fallback, { action, forcePartial = false } = {
   }
   const code = codeOf(error);
   const unavailable = error?.status === undefined || error?.status >= 500;
-  return new StorageCommandError(SAFE_EXTERNAL_ERRORS[code] ?? fallback, {
-    action,
-    code: code ?? (unavailable ? "service_unavailable" : "external_bucket_operation_failed"),
-    exitCode: forcePartial ? 4 : unavailable ? 6 : 1,
-    outcomeClass: forcePartial ? "partial" : unavailable ? "failed" : "failed",
-    retryable: forcePartial || unavailable,
-  });
+  const ownerMessage = detailOf(error)?.message;
+  return new StorageCommandError(
+    SAFE_EXTERNAL_ERRORS[code] ??
+      (typeof ownerMessage === "string" && ownerMessage.trim() ? ownerMessage : fallback),
+    {
+      action,
+      code: code ?? (unavailable ? "service_unavailable" : "external_bucket_operation_failed"),
+      exitCode: forcePartial ? 4 : unavailable ? 6 : 1,
+      outcomeClass: forcePartial ? "partial" : unavailable ? "failed" : "failed",
+      retryable: forcePartial || unavailable,
+    }
+  );
 }
 
 async function listBuckets(input, runtime) {
@@ -493,28 +505,11 @@ async function showBucket(input, runtime) {
 
 async function connectBucket(input, runtime) {
   const intent = await connectionIntent(input);
-  requireMutationPreflight(input, runtime, { consent: true });
+  requireMutationPreflight(input, runtime);
   const fingerprint =
     intent.accessKeyId && intent.secretAccessKey
       ? credentialFingerprint(intent.accessKeyId, intent.secretAccessKey)
       : null;
-  const declined = await reviewed(runtime, {
-    title: "Connect external bucket",
-    terms: [
-      { label: "Kind", value: providerName(intent.kind) },
-      { label: "Name", value: intent.name },
-      { label: "Bucket", value: intent.bucket },
-      { label: "Prefix", value: intent.prefix ?? "(bucket root)" },
-      { label: "Access", value: intent.readOnly ? "read-only" : "read-write" },
-      {
-        label: "Credentials",
-        value: fingerprint ? `fingerprint ${fingerprint.slice(0, 12)}` : "ambient GCS access",
-      },
-      { label: "Verification", value: "separate command required" },
-    ],
-    prompt: "Connect this external bucket?",
-  });
-  if (declined) return declined;
 
   const rows = await fetchDrives(runtime);
   const sameName = bucketRows(rows).filter(
@@ -544,13 +539,20 @@ async function connectBucket(input, runtime) {
         class: safe.verification.phase === "failed" ? "failed" : "ready",
         phase: "replayed",
       },
-      presentation: {
-        lines: [
-          `External bucket connection replayed: ${safe.name} (${safe.id})`,
-          "Connection and verification are separate operations.",
-        ],
-        next: `ornn external-buckets verify ${safe.id}`,
-      },
+      presentation: gcsGrantPresentation(safe)
+        ? {
+            lines: [
+              `External bucket connection replayed: ${safe.name} (${safe.id})`,
+              ...gcsGrantPresentation(safe),
+            ],
+          }
+        : {
+            lines: [
+              `External bucket connection replayed: ${safe.name} (${safe.id})`,
+              "Connection and verification are separate operations.",
+            ],
+            next: `ornn external-buckets verify ${safe.id}`,
+          },
     });
   }
 
@@ -581,13 +583,20 @@ async function connectBucket(input, runtime) {
   return runtime.interaction.result({
     data: { external_bucket: safe, replayed: false, verification_required: true },
     outcome: { class: "ready", phase: "connected" },
-    presentation: {
-      lines: [
-        `External bucket connected: ${safe.name} (${safe.id})`,
-        "Connection recorded; access has not been verified.",
-      ],
-      next: `ornn external-buckets verify ${safe.id}`,
-    },
+    presentation: gcsGrantPresentation(safe)
+      ? {
+          lines: [
+            `External bucket connected: ${safe.name} (${safe.id})`,
+            ...gcsGrantPresentation(safe),
+          ],
+        }
+      : {
+          lines: [
+            `External bucket connected: ${safe.name} (${safe.id})`,
+            "Connection recorded; access has not been verified.",
+          ],
+          next: `ornn external-buckets verify ${safe.id}`,
+        },
   });
 }
 
@@ -644,7 +653,7 @@ async function updateCredentials(input, runtime) {
   );
   const accessKeyId = requiredText(input.accessKeyId, "--access-key-id", "access-key-id");
   const secret = await readCredentialFile(input.secretAccessKeyFile);
-  requireMutationPreflight(input, runtime, { consent: true });
+  requireMutationPreflight(input, runtime);
   const fingerprint = credentialFingerprint(accessKeyId, secret);
   const source = resolveExternalBucket(await fetchDrives(runtime), reference);
   const kind = externalKind(source);
@@ -655,17 +664,6 @@ async function updateCredentials(input, runtime) {
     );
   }
   const id = safeIdentifier(source.id);
-  const declined = await reviewed(runtime, {
-    title: "Update external bucket credentials",
-    terms: [
-      { label: "External bucket", value: `${safeName(source.name)} (${id})` },
-      { label: "Kind", value: providerName(kind) },
-      { label: "Credential fingerprint", value: fingerprint.slice(0, 12) },
-      { label: "Verification", value: "must be run again" },
-    ],
-    prompt: "Replace these credentials?",
-  });
-  if (declined) return declined;
   let updated;
   try {
     updated = await runtime.fetch(
@@ -698,20 +696,9 @@ async function updateCredentials(input, runtime) {
 
 async function disconnectBucket(input, runtime) {
   const [reference] = positions(input, 1, "ornn external-buckets disconnect <external-bucket>");
-  requireMutationPreflight(input, runtime, { consent: true });
+  requireMutationPreflight(input, runtime);
   const source = resolveExternalBucket(await fetchDrives(runtime), reference);
   const safe = safeExternalBucket(source);
-  const declined = await reviewed(runtime, {
-    title: "Disconnect external bucket",
-    terms: [
-      { label: "External bucket", value: `${safe.name} (${safe.id})` },
-      { label: "Kind", value: providerName(safe.kind) },
-      { label: "Source writeback", value: "disabled" },
-      { label: "Consequence", value: "source access is removed after all mounts are detached" },
-    ],
-    prompt: "Disconnect this external bucket?",
-  });
-  if (declined) return declined;
   const attachedReservations = activeMountReservations(source);
   if (attachedReservations.length > 0) {
     throw new StorageCommandError(
@@ -1159,7 +1146,7 @@ async function importBucket(input, runtime) {
     usage("Noninteractive --wait requires --timeout <duration>.", "timeout");
   }
   const timeoutMs = parseTimeout(input.timeout);
-  requireMutationPreflight(input, runtime, { consent: true });
+  requireMutationPreflight(input, runtime);
 
   const source = resolveExternalBucket(await fetchDrives(runtime), reference);
   const bucket = safeExternalBucket(source);
@@ -1229,18 +1216,6 @@ async function importBucket(input, runtime) {
       : null;
   const replayed = attachment !== null;
   if (!attachment) {
-    const declined = await reviewed(runtime, {
-      title: "Import external bucket",
-      terms: [
-        { label: "Source", value: `${providerName(bucket.kind)} ${bucket.location.bucket}` },
-        { label: "Working volume", value: `${bucket.name} (${bucket.id})` },
-        { label: "Reservation", value: reservationId },
-        { label: "Isolation", value: "one Ornn-managed working copy" },
-        { label: "Source writeback", value: "disabled" },
-      ],
-      prompt: "Create this managed working copy?",
-    });
-    if (declined) return declined;
     try {
       const payload = await runtime.fetch(
         computeEndpoint(
@@ -1350,7 +1325,9 @@ export function writeExternalBucketResultHuman(stdout, stderr, capabilityId, exe
     }
     for (const bucket of rows) {
       stdout.write(
-        `${bucket.name}  ${bucket.kind}  ${bucket.verification.phase}  ${bucket.access.mode}  ${bucket.id}\n`
+        bucket.kind === "gcs"
+          ? `${bucket.name}  ${bucket.kind}  ${bucket.access.mode}  ${bucket.id}\n`
+          : `${bucket.name}  ${bucket.kind}  ${bucket.verification.phase}  ${bucket.access.mode}  ${bucket.id}\n`
       );
     }
     if (execution.page?.next_cursor) {
@@ -1368,7 +1345,10 @@ export function writeExternalBucketResultHuman(stdout, stderr, capabilityId, exe
     stdout.write(`Bucket: ${bucket.location.bucket}\n`);
     if (bucket.location.prefix) stdout.write(`Prefix: ${bucket.location.prefix}\n`);
     stdout.write(`Access: ${bucket.access.mode}\n`);
-    stdout.write(`Verification: ${bucket.verification.phase}\n`);
+    if (bucket.access.transfer_account) {
+      stdout.write(`Transfer account: ${bucket.access.transfer_account}\n`);
+    }
+    if (bucket.kind !== "gcs") stdout.write(`Verification: ${bucket.verification.phase}\n`);
   }
   for (const error of execution.errors ?? []) stderr.write(`${error.message}\n`);
 }

package/src/interaction-runtime.mjs

@@ -4,7 +4,9 @@ import { createInterface } from "node:readline/promises";
 import { resolveAuthBaseUrl } from "./device-auth.mjs";
 
 const BOOLEAN_OPTIONS = new Set([
+  "acknowledge-retained-os",
   "all-nodes",
+  "data-drives-sanitized",
   "erase-local-data",
   "force",
   "follow",
@@ -17,8 +19,8 @@ const BOOLEAN_OPTIONS = new Set([
   "read-only",
   "read-write",
   "recursive",
+  "tenant-access-revoked",
   "wait",
-  "yes",
 ]);
 
 const OPTIONAL_VALUE_OPTIONS = new Set(["resume"]);
@@ -230,42 +232,8 @@ export function createInteractionRuntime({
     return answer;
   }
 
-  async function review({ prompt = "Continue?", requireLive = false, terms, title }) {
-    if (machine) {
-      if (!requireLive && options.yes === true) return true;
-      usage(
-        requireLive
-          ? "This operation is supported only in an eligible interactive terminal."
-          : "Consent is required. Review the terms and supply --yes to continue.",
-        {
-          code: requireLive ? "unsupported_in_machine_mode" : "consent_required",
-          ...(!requireLive ? { field: "yes" } : {}),
-        }
-      );
-    }
-    if (requireLive && !eligibleHuman) {
-      usage("This operation is supported only in an eligible interactive terminal.", {
-        code: "unsupported_in_machine_mode",
-      });
-    }
-    stderr.write(`${title}\n`);
-    for (const term of terms) stderr.write(`  ${term.label}: ${term.value}\n`);
-
-    if (!requireLive && options.yes === true) return true;
-    if (!eligibleHuman) {
-      usage("Consent is required. Review the terms and supply --yes to continue.", {
-        code: "consent_required",
-        field: "yes",
-      });
-    }
-    let answer;
-    try {
-      answer = await readline().question(`${prompt} [y/N] `);
-    } catch (caught) {
-      if (caught?.code === "ERR_USE_AFTER_CLOSE") return false;
-      throw caught;
-    }
-    return /^(y|yes)$/i.test(String(answer ?? "").trim());
+  async function review() {
+    return true;
   }
 
   function webUrl(path) {