@ricsam/r5dctl 0.0.73 → 0.0.74

package/README.md

@@ -109,8 +109,18 @@ r5dctl k8s usage
 r5dctl k8s usage --namespace default --workload api --container server
 r5dctl k8s usage --window 7d
 r5dctl k8s usage --workload default/api --window 7d --json
+r5dctl vcluster trusted-workflow add --repo owner/repository --workflow .github/workflows/deploy.yml
+r5dctl vcluster trusted-workflow list
+r5dctl vcluster trusted-workflow remove <workflow-id>
 ```
 
+Trusted workflows authenticate Kubernetes through the dedicated
+`ricsam/r5d-cluster-auth` GitHub Action. They do not run or authenticate
+`r5dctl` inside GitHub Actions, and no R5D secret needs to be stored in the
+repository. Trust applies to that workflow path on every Git ref and grants
+cluster-admin, so protect workflow changes and do not invoke it for untrusted
+pull requests.
+
 `session start` creates an ordinary agent-mode chat on an explicitly selected existing worktree, or creates a named worktree from an explicit `worktree:<branch>` source. It requires project, worker, model, and prompt and never infers them from the current shell. Starts and prompts return after durable enqueue while execution continues asynchronously. Task specialization belongs in the prompt; there are no predefined debug, explore, research, or test agents. `session stop` returns as soon as the agent run is stopped; the stopped worktree's workspace publication finishes asynchronously behind the response, and `merge` republishes at its own boundary before reading the worktree.
 
 Add `-f`/`--follow`/`--watch` to `session start` to attach after enqueue, or to `conversation` to print the current transcript and follow new output. Assistant text is written to stdout and lifecycle/tool progress to stderr; `--tools` includes tool calls and results. With global `--json`, follow mode emits one JSON event per line. Ctrl-C only detaches and never stops the session. The CLI reconnects transiently interrupted event streams and resynchronizes committed conversation revisions without repeating assistant text.

package/dist/cjs/cli.cjs

@@ -149,6 +149,9 @@ const PS_HELP_TEXT = [
 const K8S_HELP_TEXT = [
   "Usage:",
   "  r5dctl k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
+  "  r5dctl vcluster trusted-workflow add --repo <owner/repository> --workflow <.github/workflows/file.yml>",
+  "  r5dctl vcluster trusted-workflow list",
+  "  r5dctl vcluster trusted-workflow remove <workflow-id>",
   "",
   "Show current and rolling CPU and memory usage for managed-vCluster workload containers.",
   ""
@@ -305,6 +308,17 @@ const SHARED_HELP_ENTRIES = [
     usage: "k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
     description: "Show current and rolling CPU and memory usage for managed-vCluster workload containers."
   },
+  {
+    section: "kubernetes",
+    usage: "vcluster trusted-workflow add --repo <owner/repository> --workflow <.github/workflows/file.yml>",
+    description: "Trust an exact GitHub Actions workflow path to authenticate kubectl against your managed vCluster."
+  },
+  { section: "kubernetes", usage: "vcluster trusted-workflow list", description: "List trusted GitHub Actions workflows." },
+  {
+    section: "kubernetes",
+    usage: "vcluster trusted-workflow remove <workflow-id>",
+    description: "Revoke a trusted GitHub Actions workflow and its outstanding credentials."
+  },
   {
     section: "processes",
     usage: "ps list [--worker <label>]",
@@ -2642,6 +2656,40 @@ async function executeR5dctlCommand(client, json, args) {
     write(report, renderK8sUsageReport(report));
     return;
   }
+  if (first === "vcluster" && second === "trusted-workflow") {
+    const subcommand = requireValue(args[2], "Missing trusted-workflow command");
+    if (subcommand === "add") {
+      const parsed = parseCommandOperands(args.slice(3), /* @__PURE__ */ new Set(["--repo", "--workflow"]), /* @__PURE__ */ new Map(), "trusted-workflow add");
+      if (parsed.positionals.length > 0) throw new Error(`Unexpected trusted-workflow add value: ${parsed.positionals[0]}`);
+      const workflow = await client.k8s.trustedWorkflows.add({
+        repository: requireValue(parsed.values.get("--repo"), "--repo <owner/repository> is required"),
+        workflowPath: requireValue(parsed.values.get("--workflow"), "--workflow <path> is required")
+      });
+      write(workflow, "Trusted GitHub workflow configured successfully.\n");
+      return;
+    }
+    if (subcommand === "list") {
+      if (args.length > 3) throw new Error(`Unexpected trusted-workflow list value: ${args[3]}`);
+      const workflows = await client.k8s.trustedWorkflows.list();
+      write(
+        workflows,
+        workflows.length === 0 ? "No trusted GitHub workflows.\n" : `${workflows.map(
+          (workflow) => `${workflow.id}  ${workflow.repository}  ${workflow.workflowPath}  ${workflow.revokedAt ? "revoked" : "active"}`
+        ).join("\n")}
+`
+      );
+      return;
+    }
+    if (subcommand === "remove") {
+      const workflowId = requireValue(args[3], "Missing trusted workflow id");
+      if (args.length > 4) throw new Error(`Unexpected trusted-workflow remove value: ${args[4]}`);
+      const result = await client.k8s.trustedWorkflows.revoke(workflowId);
+      if (!result.success) throw new Error("Trusted GitHub workflow was not found or was already revoked");
+      write(result, "Trusted GitHub workflow revoked.\n");
+      return;
+    }
+    throw new Error(`Unknown trusted-workflow command: ${subcommand}`);
+  }
   if (first === "ps" && second === "list") {
     const processes = await client.processes.list(parsePsListArgs(args.slice(2)));
     write(processes, renderProcessList(processes));
@@ -3011,12 +3059,23 @@ function resolveCommandExecution(options, rest) {
   }
   if (command === "k8s") {
     const subcommand = commandArgs[0];
-    if (subcommand !== "usage") throw new Error(`Unknown k8s command: ${subcommand ?? ""}`.trim());
     if (options.project || options.branch || options.session) {
-      throw new Error("Project, branch, and session scopes are not supported for `k8s usage`");
+      throw new Error("Project, branch, and session scopes are not supported for `k8s`");
+    }
+    if (subcommand === "usage") {
+      parseK8sUsageArgs(commandArgs.slice(1));
+      return { kind: "plugin", pluginArgs: ["k8s", "usage", ...commandArgs.slice(1)] };
+    }
+    throw new Error(`Unknown k8s command: ${subcommand ?? ""}`.trim());
+  }
+  if (command === "vcluster") {
+    if (options.project || options.branch || options.session) {
+      throw new Error("Project, branch, and session scopes are not supported for `vcluster`");
+    }
+    if (commandArgs[0] !== "trusted-workflow") {
+      throw new Error(`Unknown vcluster command: ${commandArgs[0] ?? ""}`.trim());
     }
-    parseK8sUsageArgs(commandArgs.slice(1));
-    return { kind: "plugin", pluginArgs: ["k8s", "usage", ...commandArgs.slice(1)] };
+    return { kind: "plugin", pluginArgs: ["vcluster", "trusted-workflow", ...commandArgs.slice(1)] };
   }
   if (command === "get") {
     const target = commandArgs[0];

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.73",
+  "version": "0.0.74",
   "type": "commonjs"
 }

package/dist/mjs/cli.mjs

@@ -63,6 +63,9 @@ const PS_HELP_TEXT = [
 const K8S_HELP_TEXT = [
   "Usage:",
   "  r5dctl k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
+  "  r5dctl vcluster trusted-workflow add --repo <owner/repository> --workflow <.github/workflows/file.yml>",
+  "  r5dctl vcluster trusted-workflow list",
+  "  r5dctl vcluster trusted-workflow remove <workflow-id>",
   "",
   "Show current and rolling CPU and memory usage for managed-vCluster workload containers.",
   ""
@@ -219,6 +222,17 @@ const SHARED_HELP_ENTRIES = [
     usage: "k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
     description: "Show current and rolling CPU and memory usage for managed-vCluster workload containers."
   },
+  {
+    section: "kubernetes",
+    usage: "vcluster trusted-workflow add --repo <owner/repository> --workflow <.github/workflows/file.yml>",
+    description: "Trust an exact GitHub Actions workflow path to authenticate kubectl against your managed vCluster."
+  },
+  { section: "kubernetes", usage: "vcluster trusted-workflow list", description: "List trusted GitHub Actions workflows." },
+  {
+    section: "kubernetes",
+    usage: "vcluster trusted-workflow remove <workflow-id>",
+    description: "Revoke a trusted GitHub Actions workflow and its outstanding credentials."
+  },
   {
     section: "processes",
     usage: "ps list [--worker <label>]",
@@ -2556,6 +2570,40 @@ async function executeR5dctlCommand(client, json, args) {
     write(report, renderK8sUsageReport(report));
     return;
   }
+  if (first === "vcluster" && second === "trusted-workflow") {
+    const subcommand = requireValue(args[2], "Missing trusted-workflow command");
+    if (subcommand === "add") {
+      const parsed = parseCommandOperands(args.slice(3), /* @__PURE__ */ new Set(["--repo", "--workflow"]), /* @__PURE__ */ new Map(), "trusted-workflow add");
+      if (parsed.positionals.length > 0) throw new Error(`Unexpected trusted-workflow add value: ${parsed.positionals[0]}`);
+      const workflow = await client.k8s.trustedWorkflows.add({
+        repository: requireValue(parsed.values.get("--repo"), "--repo <owner/repository> is required"),
+        workflowPath: requireValue(parsed.values.get("--workflow"), "--workflow <path> is required")
+      });
+      write(workflow, "Trusted GitHub workflow configured successfully.\n");
+      return;
+    }
+    if (subcommand === "list") {
+      if (args.length > 3) throw new Error(`Unexpected trusted-workflow list value: ${args[3]}`);
+      const workflows = await client.k8s.trustedWorkflows.list();
+      write(
+        workflows,
+        workflows.length === 0 ? "No trusted GitHub workflows.\n" : `${workflows.map(
+          (workflow) => `${workflow.id}  ${workflow.repository}  ${workflow.workflowPath}  ${workflow.revokedAt ? "revoked" : "active"}`
+        ).join("\n")}
+`
+      );
+      return;
+    }
+    if (subcommand === "remove") {
+      const workflowId = requireValue(args[3], "Missing trusted workflow id");
+      if (args.length > 4) throw new Error(`Unexpected trusted-workflow remove value: ${args[4]}`);
+      const result = await client.k8s.trustedWorkflows.revoke(workflowId);
+      if (!result.success) throw new Error("Trusted GitHub workflow was not found or was already revoked");
+      write(result, "Trusted GitHub workflow revoked.\n");
+      return;
+    }
+    throw new Error(`Unknown trusted-workflow command: ${subcommand}`);
+  }
   if (first === "ps" && second === "list") {
     const processes = await client.processes.list(parsePsListArgs(args.slice(2)));
     write(processes, renderProcessList(processes));
@@ -2925,12 +2973,23 @@ function resolveCommandExecution(options, rest) {
   }
   if (command === "k8s") {
     const subcommand = commandArgs[0];
-    if (subcommand !== "usage") throw new Error(`Unknown k8s command: ${subcommand ?? ""}`.trim());
     if (options.project || options.branch || options.session) {
-      throw new Error("Project, branch, and session scopes are not supported for `k8s usage`");
+      throw new Error("Project, branch, and session scopes are not supported for `k8s`");
+    }
+    if (subcommand === "usage") {
+      parseK8sUsageArgs(commandArgs.slice(1));
+      return { kind: "plugin", pluginArgs: ["k8s", "usage", ...commandArgs.slice(1)] };
+    }
+    throw new Error(`Unknown k8s command: ${subcommand ?? ""}`.trim());
+  }
+  if (command === "vcluster") {
+    if (options.project || options.branch || options.session) {
+      throw new Error("Project, branch, and session scopes are not supported for `vcluster`");
+    }
+    if (commandArgs[0] !== "trusted-workflow") {
+      throw new Error(`Unknown vcluster command: ${commandArgs[0] ?? ""}`.trim());
     }
-    parseK8sUsageArgs(commandArgs.slice(1));
-    return { kind: "plugin", pluginArgs: ["k8s", "usage", ...commandArgs.slice(1)] };
+    return { kind: "plugin", pluginArgs: ["vcluster", "trusted-workflow", ...commandArgs.slice(1)] };
   }
   if (command === "get") {
     const target = commandArgs[0];

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.73",
+  "version": "0.0.74",
   "type": "module"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.73",
+  "version": "0.0.74",
   "type": "module",
   "main": "./dist/cjs/cli.cjs",
   "module": "./dist/mjs/cli.mjs",
@@ -26,7 +26,7 @@
     "r5dctl": "dist/cjs/main.cjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.73",
+    "@ricsam/r5d-api": "^0.0.74",
     "dotenv": "^17",
     "qrcode": "^1.5.4",
     "ws": "^8.18.3"