@ornncompute/cli 1.0.97 → 1.0.107

package/README.md

@@ -457,3 +457,9 @@ request conflicts, and an expired incomplete request requires a new key.
 `ornn volumes refresh <volume>` reconciles recorded usage against stored files.
 The upload replay contract requires the matching gateway/orchestrator release;
 see [the service contract](../../services/orchestrator/README.md#file-upload-replay-and-usage).
+
+Staff can use `ornn admin ssh <node-id>` for certificate access on explicitly
+opted-in nodes. It requires an interactive staff login, creates a temporary
+local key, obtains a 15-minute certificate through the gateway and launches
+OpenSSH with normal host-key verification. Temporary files are removed when
+the command exits. Shared and per-node key access remain available.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.97",
+  "version": "1.0.107",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/admin-command-handlers.mjs

@@ -1,3 +1,4 @@
+import { adminSshHandlers } from "./admin-ssh.mjs";
 import { adminCapacityReservationHandlers } from "./admin-capacity-reservations.mjs";
 import { adminCreditHandlers } from "./admin-credits.mjs";
 import { adminEnrollmentHandlers } from "./admin-enrollment.mjs";
@@ -7,6 +8,7 @@ import { adminNodeSanitizeHandlers } from "./admin-node-sanitize.mjs";
 import { ADMIN_MUTATION_SAFETY, assertAdminMutationContext } from "./admin-mutations.mjs";
 
 const handlers = [
+  ...adminSshHandlers,
   ...adminCapacityReservationHandlers,
   ...adminCreditHandlers,
   ...adminEnrollmentHandlers,

package/src/admin-ssh.mjs

@@ -0,0 +1,113 @@
+import { spawn } from "node:child_process";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { constants, tmpdir } from "node:os";
+import { join } from "node:path";
+import { ADMIN_MUTATION_SAFETY } from "./admin-mutations.mjs";
+import { forwardSignals } from "./signals.mjs";
+
+function run(program, args, signal) {
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const child = spawn(program, args, { stdio: "inherit", signal });
+    child.once("error", (error) => {
+      // A cancelled key generator must finish exiting before we remove its files.
+      if (error.name !== "AbortError") reject(error);
+    });
+    child.once("close", (code, killed) =>
+      killed ? reject(new Error("SSH was interrupted.")) : resolve(code ?? 1)
+    );
+  });
+}
+
+export async function openAdminSsh({ input, fetch, execute, runtime }, { runProcess = run } = {}) {
+  // Read the existing node route; issuance returns only its own certificate.
+  const node = await fetch(`/nodes/${encodeURIComponent(input.node_id)}`, { method: "GET" });
+  const host = node.ip;
+  const port = node.port ?? 22;
+  if (
+    typeof host !== "string" ||
+    !/^[a-zA-Z0-9.:_-]+$/.test(host) ||
+    host.startsWith("-") ||
+    !Number.isInteger(port) ||
+    port < 1 ||
+    port > 65535
+  ) {
+    throw new Error("The node does not have a valid SSH address.");
+  }
+  const controller = new AbortController();
+  const signal = runtime.signal
+    ? AbortSignal.any([runtime.signal, controller.signal])
+    : controller.signal;
+  let interrupted;
+  let directory;
+  const removeSignals = forwardSignals(process, null, (received) => {
+    interrupted ??= received;
+    controller.abort();
+  });
+  try {
+    directory = await mkdtemp(join(tmpdir(), "ornn-ssh-"));
+    const key = join(directory, "identity");
+    const generated = await runProcess(
+      "ssh-keygen",
+      ["-q", "-t", "ed25519", "-N", "", "-C", "ornn-staff", "-f", key],
+      signal
+    );
+    if (generated !== 0) throw new Error("Could not generate the temporary SSH key.");
+    const public_key = (await readFile(`${key}.pub`, "utf8")).trim();
+    const issued = await execute(
+      { node_id: input.node_id, public_key },
+      { transport: (path, init) => fetch(path, { ...init, signal }) }
+    );
+    signal.throwIfAborted();
+    if (
+      typeof issued.certificate !== "string" ||
+      !issued.certificate.includes("-cert-v01@openssh.com ")
+    )
+      throw new Error("The issuer returned an invalid SSH certificate.");
+    await writeFile(`${key}-cert.pub`, `${issued.certificate}\n`, { mode: 0o600 });
+    const exitCode = await runProcess(
+      "ssh",
+      [
+        "-o",
+        "IdentitiesOnly=yes",
+        "-o",
+        `CertificateFile=${key}-cert.pub`,
+        "-i",
+        key,
+        "-p",
+        String(port),
+        "-l",
+        "admin",
+        host,
+      ],
+      signal
+    );
+    signal.throwIfAborted();
+    return { suppressResult: true, exitCode };
+  } catch (error) {
+    if (!interrupted) throw error;
+    return { suppressResult: true, exitCode: 128 + constants.signals[interrupted] };
+  } finally {
+    try {
+      if (directory) await rm(directory, { recursive: true, force: true });
+    } finally {
+      removeSignals();
+    }
+  }
+}
+
+export const adminSshHandlers = [
+  {
+    capabilityId: "node.ssh",
+    safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
+    parse(argv) {
+      if (
+        argv.length !== 1 ||
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(argv[0])
+      )
+        throw new Error("Usage: ornn admin ssh <node-id>");
+      return { input: { node_id: argv[0] } };
+    },
+    run: openAdminSsh,
+  },
+];

package/src/api-client.mjs

@@ -251,7 +251,10 @@ export function resolveInstallerBaseUrl({ env = process.env } = {}) {
 }
 
 function operatorProxyEndpoint(endpoint) {
-  return `/v1/staff${normalizeComputePath(endpoint)}`;
+  // Benchmark functions use their owner namespace; retain the existing staff
+  // envelope, including its admin-role and impersonation checks.
+  const path = normalizeComputePath(endpoint).replace(/^\/v1\/benchmark(?=\/|$)/, "");
+  return `/v1/staff${path}`;
 }
 
 // Staff path: CLI bearer → gateway /v1/orchestrator/ → the owning service.

package/vendor/api-client/commerce.js

@@ -216,6 +216,8 @@ function getReservationUsage(request, input, signal) {
   const query = new URLSearchParams({ from: input.from, to: input.to, bucket: input.bucket });
   if (input.organizationId)
     query.set("organizationId", input.organizationId);
+  if (input.groupBy)
+    query.set("groupBy", input.groupBy);
   return request(`${BASE2}/usage?${query}`, {
     method: "GET",
     ...signal ? { signal } : {}