Codex/byon network join

.agents/skills/brev-cli/SKILL.md

@@ -202,6 +202,34 @@ brev ls       --json | jq -r '.workspaces[].name'
 brev ls nodes --json | jq -r '.[] | select(.status=="Connected") | .name'
 ```
 
+### BYON Network and SSH
+
+For a machine you bring to Brev, network membership and SSH credentials are
+separate operations:
+
+```bash
+# Join only the organization's Brev/NetBird network.
+brev join
+
+# Optionally enable access for yourself, then grant a collaborator.
+brev enable-ssh
+brev grant-ssh
+
+# Explicitly revoke tracked SSH grants, then retire membership.
+brev disable-ssh
+brev leave
+```
+
+`brev register` and `brev deregister` are deprecated aliases for `join` and
+`leave`; they warn when executed. `enable-ssh` requires an existing join and
+can reconnect its tunnel, but never joins a network. Use `grant-ssh` and
+`revoke-ssh` for individual collaborators. `disable-ssh` best-effort revokes
+every backend-tracked SSH grant across the node, continuing after individual
+failures and revoking the invoking Brev user's own access last. It does not
+modify `authorized_keys`, close ports, stop `sshd`, end active sessions, or
+leave the network. `leave` removes membership without running that per-grant
+revocation flow or cleaning up local keys.
+
 ### Instance Management
 ```bash
 # List instances

.agents/skills/brev-cli/reference/commands.md

@@ -497,6 +497,93 @@ Generate an invite link.
 brev invite
 ```
 
+## BYON Network and SSH Commands
+
+These commands apply to a machine brought into a Brev organization. Network
+membership and Brev-managed SSH credentials are separate.
+
+### Canonical workflows
+
+```bash
+# Join networking only. Then optionally enable your SSH access and grant a collaborator.
+brev join
+brev enable-ssh
+brev grant-ssh
+
+# Explicitly revoke tracked SSH grants before retiring network membership.
+brev disable-ssh
+brev leave
+```
+
+### brev join / brev register
+
+Join a device to the organization's Brev/NetBird network.
+
+```bash
+brev join [--name <device-name> --org <organization>] [--approve]
+```
+
+`join` establishes membership only: it does not enable SSH or allocate an SSH
+port. `register` is a deprecated alias that warns on execution. The old
+`--ssh-port` flag is no longer supported; migrate scripts to `brev join` and
+then `brev enable-ssh` on the joined machine.
+
+### brev enable-ssh
+
+Enable Brev-managed SSH for the invoking Brev user on the joined node.
+
+```bash
+brev enable-ssh
+```
+
+This requires an existing `join`. It confirms the existing Brev tunnel and can
+reconnect it when disconnected, but it does not add a node, select an
+organization, save a registration, or join a network.
+
+### brev grant-ssh / brev revoke-ssh
+
+Manage an individual collaborator's SSH access tuple on a node.
+
+```bash
+brev grant-ssh
+brev revoke-ssh
+```
+
+Use these commands for collaborator access rather than treating `enable-ssh`
+or `disable-ssh` as collaborator-management commands.
+
+### brev disable-ssh
+
+Revoke all backend-tracked Brev SSH grants from the joined node.
+
+```bash
+brev disable-ssh [--approve]
+```
+
+This node-wide operation makes a best-effort attempt to revoke each exact active
+backend access tuple. It continues after individual failures, reports an error
+when any tuple remains, and revokes the invoking Brev user's own access last. It
+does not inspect or modify local `authorized_keys` files. It leaves existing
+ports allocated, leaves `sshd` running, does not forcibly terminate active SSH
+sessions, and does not remove membership or the backend node.
+
+### brev leave / brev deregister
+
+Remove Brev network membership from the device.
+
+```bash
+brev leave [--approve]
+```
+
+`leave` removes the backend node, VPN route, and local registration. It does not
+run `disable-ssh`'s per-grant revocation flow or modify local `authorized_keys`
+files. Run `brev disable-ssh` first when explicit best-effort revocation of
+tracked grants is desired. `deregister` is a deprecated alias that warns on
+execution.
+
+`leave` continues to uninstall NetBird even if it was installed before Brev.
+Install-ownership tracking is a follow-up, so ensure that removal is intended.
+
 ## Configuration Commands
 
 ### brev login / brev logout

.gitignore

@@ -55,4 +55,8 @@ devworkspace/**
 test.txt
 test2.txt
 homebrew-brev
-flake-explorations
+flake-explorations
+
+# AI
+/docs/superpowers/plans/
+/docs/superpowers/specs/

CHANGELOG.md

@@ -10,3 +10,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 [WIP] Add tailscale vpn client embedded with Brev.
+
+- `brev join` for Brev/NetBird network membership, `brev leave` for membership teardown, and node-wide `brev disable-ssh`.
+
+### Changed
+
+- `brev join` no longer enables SSH. `brev enable-ssh` requires an existing joined membership and reconnects its tunnel when needed.
+- `brev disable-ssh` best-effort revokes all backend-tracked SSH grants, revokes the invoking user's own access last, and no longer sweeps local `authorized_keys` files.
+
+### Deprecated
+
+- `brev register` and `brev deregister` remain compatibility aliases for `join` and `leave`, and warn on stderr when executed.
+
+### Migration
+
+- Scripts using `--ssh-port` must run `brev join` followed by `brev enable-ssh`.

README.md

@@ -76,6 +76,8 @@ brev ls
 
 https://docs.nvidia.com/brev/latest/
 
+[Bring Your Own Node (BYON) network and SSH workflows](docs/BYON.md)
+
 ---
 
 ## AI Agent Integration

docs/BYON.md

@@ -0,0 +1,71 @@
+# Bring Your Own Node (BYON)
+
+Brev separates network membership from Brev-managed SSH credentials on a
+machine you bring to your organization.
+
+## Join networking only
+
+```bash
+brev join
+```
+
+`brev join` establishes this machine's Brev/NetBird organization membership.
+It does not enable SSH or create an SSH port. Use `brev register` only for
+compatibility with existing automation: it is a deprecated alias for `join` and
+prints a warning when executed.
+
+Scripts that used `--ssh-port` must migrate to two commands:
+
+```bash
+brev join
+brev enable-ssh
+```
+
+## Enable and grant SSH
+
+After joining, enable Brev-managed SSH for the invoking Brev user:
+
+```bash
+brev enable-ssh
+```
+
+`enable-ssh` requires a prior join. It confirms the existing Brev tunnel and
+can reconnect it when it is disconnected; it never joins a network or creates
+membership. It then enables the invoking user's access on the joined node.
+
+Grant and revoke collaborator access separately:
+
+```bash
+brev grant-ssh
+brev revoke-ssh
+```
+
+These commands manage individual collaborator access tuples. They are not part
+of `join`, `enable-ssh`, or the node-wide revocation command.
+
+## Retire Brev access and membership
+
+To explicitly revoke Brev-tracked SSH grants before leaving the network:
+
+```bash
+brev disable-ssh
+brev leave
+```
+
+`disable-ssh` is node-wide. It makes a best-effort attempt to revoke every
+backend-tracked Brev SSH access tuple, continuing after individual failures and
+revoking the invoking Brev user's own access last. It returns an error if any
+revocation fails so the remaining records can be retried. It does not inspect or
+modify local `authorized_keys` files. It leaves existing ports allocated, leaves
+`sshd` running, does not forcibly terminate active SSH sessions, and does not
+change network membership.
+
+`leave` removes the backend node, Brev VPN route, and local registration. It
+does not run the per-grant `disable-ssh` flow or modify local `authorized_keys`
+files. Run `disable-ssh` first when explicit best-effort revocation of tracked
+grants is desired. `brev deregister` is a deprecated alias for `leave` and warns
+when executed.
+
+`leave` preserves the existing behavior of uninstalling NetBird even when
+NetBird was installed before Brev. Tracking whether Brev owns that installation
+is a follow-up improvement, so use `leave` only when that removal is intended.

pkg/cmd/cmd.go

@@ -15,6 +15,7 @@ import (
 	"github.com/brevdev/brev-cli/pkg/cmd/copy"
 	"github.com/brevdev/brev-cli/pkg/cmd/delete"
 	"github.com/brevdev/brev-cli/pkg/cmd/deregister"
+	"github.com/brevdev/brev-cli/pkg/cmd/disablessh"
 	"github.com/brevdev/brev-cli/pkg/cmd/enablessh"
 	"github.com/brevdev/brev-cli/pkg/cmd/envvars"
 	"github.com/brevdev/brev-cli/pkg/cmd/exec"
@@ -316,10 +317,11 @@ func createCmdTree(cmd *cobra.Command, t *terminal.Terminal, loginCmdStore *stor
 	cmd.AddCommand(reset.NewCmdReset(t, loginCmdStore, noLoginCmdStore))
 	cmd.AddCommand(profile.NewCmdProfile(t, loginCmdStore, noLoginCmdStore))
 	cmd.AddCommand(refresh.NewCmdRefresh(t, loginCmdStore))
-	cmd.AddCommand(register.NewCmdRegister(t, externalNodeCmdStore))
-	cmd.AddCommand(deregister.NewCmdDeregister(t, externalNodeCmdStore))
+	cmd.AddCommand(register.NewCmdJoin(t, externalNodeCmdStore))
+	cmd.AddCommand(deregister.NewCmdLeave(t, externalNodeCmdStore))
 	cmd.AddCommand(upgrade.NewCmdUpgrade(t, noLoginCmdStore))
 	cmd.AddCommand(enablessh.NewCmdEnableSSH(t, externalNodeCmdStore))
+	cmd.AddCommand(disablessh.NewCmdDisableSSH(t, externalNodeCmdStore))
 	cmd.AddCommand(grantssh.NewCmdGrantSSH(t, externalNodeCmdStore))
 	cmd.AddCommand(revokessh.NewCmdRevokeSSH(t, externalNodeCmdStore))
 	cmd.AddCommand(runtasks.NewCmdRunTasks(t, noLoginCmdStore))