ever-works-node 0.2.5 → 0.2.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -0
- package/cli.js +3048 -181
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -52,6 +52,7 @@ ever-works-node status
|
|
|
52
52
|
ever-works-node capabilities
|
|
53
53
|
ever-works-node doctor [--workspace-root <dir>] [--max-age <days>] [--max-count <n>] [--offline] [--json]
|
|
54
54
|
ever-works-node gc [--workspace-root <dir>] [--max-age <days>] [--max-count <n>] [--dry-run] [--offline]
|
|
55
|
+
ever-works-node policy [--allow-skip-permissions on|off] [--allow-shell-commands on|off] [--restricted-mode on|off]
|
|
55
56
|
```
|
|
56
57
|
|
|
57
58
|
- **`enroll`** consumes a one-time token from the platform's Fleet page (`POST /api/fleet/enroll`)
|
|
@@ -70,6 +71,13 @@ ever-works-node gc [--workspace-root <dir>] [--max-age <days>] [--max-count <n>]
|
|
|
70
71
|
(`POST /api/fleet/pause`, so the scheduler stops offering work) _and_ records the intent locally,
|
|
71
72
|
so a service restart comes back paused. A paused node keeps heartbeating: a drained machine that
|
|
72
73
|
vanishes from Fleet is indistinguishable from a dead one.
|
|
74
|
+
- **`policy`** shows or changes this machine's **local execution policy** — what a platform job may
|
|
75
|
+
make the PC do, decided here and never by the platform. Both switches are **off** by default:
|
|
76
|
+
`--allow-skip-permissions` (run the model CLI with its permission checks off) and
|
|
77
|
+
`--allow-shell-commands` (run a job's setup, command steps and acceptance checks, and lease
|
|
78
|
+
`acceptance-checks` jobs — repository code, after a model step possibly code the model wrote).
|
|
79
|
+
`--restricted-mode` (default **on**) adds Claude Code's `--restricted` when supported. A job that
|
|
80
|
+
needs a switch that is off is refused before anything is provisioned, naming the switch. Restart the service after a change. See the fleet session trust model, control 18.
|
|
73
81
|
- **`unenroll`** retires the machine — `POST /api/fleet/unenroll` deletes the registration, then the
|
|
74
82
|
local credential is erased. The local erase happens **even if the API call fails**: a
|
|
75
83
|
decommissioned laptop holding a live fleet secret is the worse outcome.
|