make Fleet Node enrollment one command

[ankitgoswami]

Reviewable diff: +84/-8 across 5 files (excludes generated, test, and story files).

Summary

Fleet Node enrollment is now a single copy/paste command: sudo fleetnode-enroll --server-url=.... The packaged helper owns the service-account, state-directory, and systemd details, so operators no longer need the verbose internal command or a separate service-start step.

Stack: #990 Make Fleet Node startup readiness explicit → #991 Complete the Fleet Node installer lifecycle → #992 Qualify Fleet Node release artifacts → #989 (this PR). This diff is relative to #992. The upstream PRs establish the service-readiness, transactional installer, and clean-host qualification contracts that this helper extends; broader release/distribution work remains outside this PR.

How it works

The release artifact includes fleetnode-enroll, and the installer places a managed copy at /usr/local/bin/fleetnode-enroll. The operator UI builds the server URL exactly as before, but now displays the short helper command. The helper runs the installed Fleet Node binary as the fleetnode service account with /var/lib/fleetnode as its state directory, then enables and starts fleet-node.service only after enrollment succeeds.

Installer upgrades treat the helper like the binary and unit: an existing managed copy is backed up and restored if installation fails, while an unrelated file at the global path is rejected rather than overwritten. Uninstall and purge remove the managed helper.

Diagrams

flowchart LR
    A["Operator copies sudo fleetnode-enroll command"] --> B["Managed helper in /usr/local/bin"]
    B --> C["Fleet Node runs as fleetnode user"]
    C --> D["Enrollment state is written to /var/lib/fleetnode"]
    D --> E["systemd enables and starts fleet-node.service"]

Loading

Areas of the code involved

Area / package / file	What changed	Why it matters for review
deployment-files/fleetnode/fleetnode-enroll	Adds the operator-facing enrollment entry point	Confirm privilege boundaries, argument forwarding, and start-after-success ordering
deployment-files/fleetnode/install-fleet-node.sh	Installs, validates, rolls back, and removes the helper	Confirm upgrades remain transactional and do not overwrite unmanaged files
.github/workflows/	Packages the helper and syntax-checks it in deployment CI	Confirms every published Fleet Node artifact contains the command shown by the UI
client/.../Nodes/enrollNodeCommand.ts	Produces the concise command while retaining existing URL and HTTP transport rules	Confirm UI output matches the installed package contract
Installer, qualification, and client tests	Cover install/upgrade/removal behavior and exact UI output	Prevents packaging and operator guidance from drifting apart

Key technical decisions & trade-offs

• Install a dedicated fleetnode-enroll helper instead of placing the raw fleetnode binary on PATH; this keeps the full CLI privilege model explicit while making the supported enrollment workflow concise.
• Keep the helper root-owned and switch only the enrollment process to the fleetnode account; systemd enablement still has the privilege it requires.
• Start the service only after successful enrollment; a canceled or failed enrollment leaves lifecycle state unchanged.
• Reject an unrelated /usr/local/bin/fleetnode-enroll instead of overwriting it, trading automatic replacement for safe host ownership boundaries.

Testing & validation

• bash deployment-files/fleetnode/tests/test-install-fleetnode.sh
• bash -n for the helper, installer, installer tests, and package qualification script
• vitest --run for enrollNodeCommand.test.ts and EnrollNodeModal.test.tsx: 13 tests passed
• Client ESLint passed with zero warnings; targeted Prettier check passed
• Workflow YAML parsed successfully; git diff --check passed
• Not manually exercised against a live Fleet server; clean-host package qualification verifies installation and non-mutating helper help, while CI performs the architecture-specific artifact checks

[Copilot]

🟡 Changes recommended

The systemd enablement command in the UI (enable --now) appears inconsistent with the repo’s Fleet Node installer output, and should be reconciled to avoid operator-facing drift.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the ProtoFleet “Enroll a node” UI to present a single copy/paste Fleet Node enrollment command that uses the packaged install paths and then enables the systemd unit after successful enrollment.

Changes:

• Build an enrollment command that runs the installed /opt/fleetnode/fleetnode as the fleetnode service user with --state-dir /var/lib/fleetnode.
• Chain enrollment and systemd enablement into one command (... enroll ... && sudo systemctl ...).
• Update modal + unit tests to assert the new command output.

File summaries

File	Description
client/src/protoFleet/features/settings/components/Nodes/enrollNodeCommand.ts	Builds the new packaged enrollment + systemd lifecycle command.
client/src/protoFleet/features/settings/components/Nodes/enrollNodeCommand.test.ts	Updates expectations for the command builder across HTTP/HTTPS and loopback/LAN cases.
client/src/protoFleet/features/settings/components/Nodes/EnrollNodeModal.test.tsx	Updates modal rendering test to expect the new command text.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb5893d321

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[github-actions]

🔐 Codex Security Review

Note: This is an automated security-focused code review generated by Codex.
It should be used as a supplementary check alongside human review.
False positives are possible - use your judgment.

Scope summary

• Reviewed pull request diff only (efca3081f21b4c22f362b624c2542904cb2a4598...2c1716b266b50f9d64694f8d507a3f5864ec1ee3, exact PR three-dot diff)
• Model: gpt-5.6-sol

💡 Click "edited" above to see previous reviews for this PR.

---

Review Summary

Overall Risk: HIGH

Findings

[HIGH] Automated review incomplete

• Category: Other
• Description: The automated review produced no usable result for efca3081f21b4c22f362b624c2542904cb2a4598...2c1716b266b50f9d64694f8d507a3f5864ec1ee3 (workflow run 33903507923; reason: codex-job-timeout, elapsed: unknown, budget: 9 minutes).
• Impact: The pull request has not received complete automated security, correctness, and reliability analysis.
• Recommendation: Require human review before merging. Do not treat this result as approval-free or low risk.

Notes

Human review is required because the bounded automated review was incomplete.

---

_{Generated by Codex Security Review |
Triggered by: @ankitgoswami |
Review workflow run}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8c374f167b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 11a1cda59b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2c1716b266

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".