@forgezero/agent 0.1.12 → 0.1.14

package/dist/fz-agent.js

@@ -1732,12 +1732,13 @@ function guestBootstrapScript(profile, attested = Boolean(profile.confidential),
   const agentBun = "/usr/local/lib/forgezero/bun";
   const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
 # healthy and encrypted while attestation is silently impossible. Install and
-# load the exact running-kernel module before the agent is allowed to start.
-DEBIAN_FRONTEND=noninteractive apt-get install -y linux-image-generic "linux-modules-extra-$(uname -r)"
+# load the driver shipped by the one pinned image before the agent starts. Do
+# not ask an evolving apt repository for an exact old kernel package: the image
+# can keep booting after Canonical removes that package from the mirror.
+if [[ ! -c /dev/sev-guest ]]; then modprobe sev-guest; fi
+test -c /dev/sev-guest
 printf 'sev-guest
 ' >/etc/modules-load.d/sev-guest.conf
-modprobe sev-guest
-test -c /dev/sev-guest
 ` : "";
   return `#!/usr/bin/env bash
 set -Eeuo pipefail
@@ -1926,7 +1927,7 @@ ethernets:
   primary:
     match: { name: "en*" }
     addresses: [ ${manifest.address}/24 ]
-    gateway4: ${profile.gateway}
+    routes: [ { to: default, via: ${profile.gateway} } ]
     nameservers: { addresses: [${(profile.nameservers ?? ["1.1.1.1", "9.9.9.9"]).join(", ")}] }
 `
   };
@@ -2045,15 +2046,48 @@ async function provisionMetalGuest(profile, claim, exec) {
   save();
   return { guestAddress: address };
 }
+function legacyPlatformManifest(profile, claim, name) {
+  if (claim.bootstrap?.kind !== "platform-genesis" || claim.computeKey !== `platform:${name}` || claim.spec.reference !== `platform:${name}` || claim.spec.guestAddress === undefined)
+    return;
+  const legacyDir = profile.legacyStateDir ?? "/etc/forgezero/guests";
+  const legacyPath = join2(legacyDir, `${name}.conf`);
+  if (!existsSync5(legacyPath))
+    return;
+  const values = new Map;
+  for (const line of readFileSync3(legacyPath, "utf8").split(/\r?\n/)) {
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = /^([A-Z][A-Z0-9_]*)=([^\s'"`$;|&<>]+)$/.exec(line);
+    if (!match)
+      throw new MetalProvisionError("legacy guest inventory contains unsafe syntax");
+    values.set(match[1], match[2]);
+  }
+  const disk = `/dev/${profile.volumeGroup}/${name}`;
+  if (values.get("NAME") !== name || values.get("DISK") !== disk || values.get("IP") !== claim.spec.guestAddress)
+    throw new MetalProvisionError("legacy guest inventory does not match the platform claim");
+  return {
+    computeKey: claim.computeKey,
+    reference: claim.spec.reference,
+    name,
+    address: claim.spec.guestAddress,
+    mac: values.get("MAC") ?? "",
+    cpuPoolKey: claim.spec.cpuPoolKey ?? "",
+    allowedCpus: values.get("CPUSET") ?? "",
+    allowedMemoryNodes: values.get("NUMA"),
+    phase: "running",
+    disk,
+    unit: `forgezero-guest@${name}.service`
+  };
+}
 async function removeMetalGuest(profile, claim, exec) {
   validateMetalProfile(profile);
   if (claim.action !== "delete")
     throw new MetalProvisionError("create claim cannot remove a guest");
   const name = claim.spec.guestName ?? guestNameFor(claim.computeKey);
   const manifestPath = join2(profile.stateDir, `${name}.json`);
-  if (!existsSync5(manifestPath))
+  const manifest = existsSync5(manifestPath) ? JSON.parse(readFileSync3(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
+  if (!manifest)
     return {};
-  const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
   const currentIdentity = manifest.computeKey === claim.computeKey && manifest.reference === claim.spec.reference && manifest.name === name;
   const legacyPlatformIdentity = claim.bootstrap?.kind === "platform-genesis" && claim.computeKey === `platform:${name}` && claim.spec.reference === `platform:${name}` && manifest.name === name && manifest.disk === `/dev/${profile.volumeGroup}/${name}` && manifest.address === claim.spec.guestAddress && (manifest.unit === `fz-guest@${name}.service` || manifest.unit === `forgezero-guest@${name}.service`);
   if (!currentIdentity && !legacyPlatformIdentity) {
@@ -2082,7 +2116,7 @@ async function removeMetalGuest(profile, claim, exec) {
     if (existsSync5(path))
       unlinkSync4(path);
   if (legacyPlatformIdentity) {
-    const legacyConfig = `/etc/forgezero/guests/${name}.conf`;
+    const legacyConfig = join2(profile.legacyStateDir ?? "/etc/forgezero/guests", `${name}.conf`);
     const legacyDropIn = join2(profile.unitDir, `${service}.d`);
     if (existsSync5(legacyConfig))
       unlinkSync4(legacyConfig);
@@ -2679,7 +2713,7 @@ async function applyMetalIsolation(profile, exec = defaultExec) {
 }
 
 // src/version.ts
-var VERSION = "0.1.12";
+var VERSION = "0.1.14";
 
 // src/index.ts
 function loadOrCreateSeed(path) {

package/dist/fz.js

@@ -781,7 +781,7 @@ async function resolveIdentity(selector, socketPath) {
 }
 
 // src/version.ts
-var VERSION = "0.1.12";
+var VERSION = "0.1.14";
 
 // src/cli/index.ts
 var DEFAULT_MODE = THRESHOLD_MODES[0].id;

package/dist/metal-helper-socket.js

@@ -728,12 +728,13 @@ function guestBootstrapScript(profile, attested = Boolean(profile.confidential),
   const agentBun = "/usr/local/lib/forgezero/bun";
   const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
 # healthy and encrypted while attestation is silently impossible. Install and
-# load the exact running-kernel module before the agent is allowed to start.
-DEBIAN_FRONTEND=noninteractive apt-get install -y linux-image-generic "linux-modules-extra-$(uname -r)"
+# load the driver shipped by the one pinned image before the agent starts. Do
+# not ask an evolving apt repository for an exact old kernel package: the image
+# can keep booting after Canonical removes that package from the mirror.
+if [[ ! -c /dev/sev-guest ]]; then modprobe sev-guest; fi
+test -c /dev/sev-guest
 printf 'sev-guest
 ' >/etc/modules-load.d/sev-guest.conf
-modprobe sev-guest
-test -c /dev/sev-guest
 ` : "";
   return `#!/usr/bin/env bash
 set -Eeuo pipefail
@@ -922,7 +923,7 @@ ethernets:
   primary:
     match: { name: "en*" }
     addresses: [ ${manifest.address}/24 ]
-    gateway4: ${profile.gateway}
+    routes: [ { to: default, via: ${profile.gateway} } ]
     nameservers: { addresses: [${(profile.nameservers ?? ["1.1.1.1", "9.9.9.9"]).join(", ")}] }
 `
   };
@@ -1041,15 +1042,48 @@ async function provisionMetalGuest(profile, claim, exec) {
   save();
   return { guestAddress: address };
 }
+function legacyPlatformManifest(profile, claim, name) {
+  if (claim.bootstrap?.kind !== "platform-genesis" || claim.computeKey !== `platform:${name}` || claim.spec.reference !== `platform:${name}` || claim.spec.guestAddress === undefined)
+    return;
+  const legacyDir = profile.legacyStateDir ?? "/etc/forgezero/guests";
+  const legacyPath = join(legacyDir, `${name}.conf`);
+  if (!existsSync(legacyPath))
+    return;
+  const values = new Map;
+  for (const line of readFileSync(legacyPath, "utf8").split(/\r?\n/)) {
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = /^([A-Z][A-Z0-9_]*)=([^\s'"`$;|&<>]+)$/.exec(line);
+    if (!match)
+      throw new MetalProvisionError("legacy guest inventory contains unsafe syntax");
+    values.set(match[1], match[2]);
+  }
+  const disk = `/dev/${profile.volumeGroup}/${name}`;
+  if (values.get("NAME") !== name || values.get("DISK") !== disk || values.get("IP") !== claim.spec.guestAddress)
+    throw new MetalProvisionError("legacy guest inventory does not match the platform claim");
+  return {
+    computeKey: claim.computeKey,
+    reference: claim.spec.reference,
+    name,
+    address: claim.spec.guestAddress,
+    mac: values.get("MAC") ?? "",
+    cpuPoolKey: claim.spec.cpuPoolKey ?? "",
+    allowedCpus: values.get("CPUSET") ?? "",
+    allowedMemoryNodes: values.get("NUMA"),
+    phase: "running",
+    disk,
+    unit: `forgezero-guest@${name}.service`
+  };
+}
 async function removeMetalGuest(profile, claim, exec) {
   validateMetalProfile(profile);
   if (claim.action !== "delete")
     throw new MetalProvisionError("create claim cannot remove a guest");
   const name = claim.spec.guestName ?? guestNameFor(claim.computeKey);
   const manifestPath = join(profile.stateDir, `${name}.json`);
-  if (!existsSync(manifestPath))
+  const manifest = existsSync(manifestPath) ? JSON.parse(readFileSync(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
+  if (!manifest)
     return {};
-  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
   const currentIdentity = manifest.computeKey === claim.computeKey && manifest.reference === claim.spec.reference && manifest.name === name;
   const legacyPlatformIdentity = claim.bootstrap?.kind === "platform-genesis" && claim.computeKey === `platform:${name}` && claim.spec.reference === `platform:${name}` && manifest.name === name && manifest.disk === `/dev/${profile.volumeGroup}/${name}` && manifest.address === claim.spec.guestAddress && (manifest.unit === `fz-guest@${name}.service` || manifest.unit === `forgezero-guest@${name}.service`);
   if (!currentIdentity && !legacyPlatformIdentity) {
@@ -1078,7 +1112,7 @@ async function removeMetalGuest(profile, claim, exec) {
     if (existsSync(path))
       unlinkSync(path);
   if (legacyPlatformIdentity) {
-    const legacyConfig = `/etc/forgezero/guests/${name}.conf`;
+    const legacyConfig = join(profile.legacyStateDir ?? "/etc/forgezero/guests", `${name}.conf`);
     const legacyDropIn = join(profile.unitDir, `${service}.d`);
     if (existsSync(legacyConfig))
       unlinkSync(legacyConfig);

package/dist/metal-provision.d.ts

@@ -24,6 +24,8 @@ export interface MetalProvisionProfile {
     stateDir: string;
     seedDir: string;
     unitDir: string;
+    /** One-time compatibility source for pre-Agent platform guests. */
+    legacyStateDir?: string;
     apiUrl: string;
     images: Record<string, MetalImage>;
     /** Explicit host-observed pools. No pool means no dynamic guest authority. */
@@ -81,5 +83,4 @@ export declare function cloudInit(profile: MetalProvisionProfile, claim: CreateR
 };
 /** The only root operation the metal agent may request. */
 export declare function provisionMetalGuest(profile: MetalProvisionProfile, claim: CreateRemoteProvisionClaim, exec: MetalExec): Promise<ProvisionResult>;
-/** Idempotently remove every host-owned artifact before capacity is returned. */
 export declare function removeMetalGuest(profile: MetalProvisionProfile, claim: RemoteProvisionClaim, exec: MetalExec): Promise<ProvisionResult>;

package/dist/metal-provision.js

@@ -728,12 +728,13 @@ function guestBootstrapScript(profile, attested = Boolean(profile.confidential),
   const agentBun = "/usr/local/lib/forgezero/bun";
   const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
 # healthy and encrypted while attestation is silently impossible. Install and
-# load the exact running-kernel module before the agent is allowed to start.
-DEBIAN_FRONTEND=noninteractive apt-get install -y linux-image-generic "linux-modules-extra-$(uname -r)"
+# load the driver shipped by the one pinned image before the agent starts. Do
+# not ask an evolving apt repository for an exact old kernel package: the image
+# can keep booting after Canonical removes that package from the mirror.
+if [[ ! -c /dev/sev-guest ]]; then modprobe sev-guest; fi
+test -c /dev/sev-guest
 printf 'sev-guest
 ' >/etc/modules-load.d/sev-guest.conf
-modprobe sev-guest
-test -c /dev/sev-guest
 ` : "";
   return `#!/usr/bin/env bash
 set -Eeuo pipefail
@@ -922,7 +923,7 @@ ethernets:
   primary:
     match: { name: "en*" }
     addresses: [ ${manifest.address}/24 ]
-    gateway4: ${profile.gateway}
+    routes: [ { to: default, via: ${profile.gateway} } ]
     nameservers: { addresses: [${(profile.nameservers ?? ["1.1.1.1", "9.9.9.9"]).join(", ")}] }
 `
   };
@@ -1041,15 +1042,48 @@ async function provisionMetalGuest(profile, claim, exec) {
   save();
   return { guestAddress: address };
 }
+function legacyPlatformManifest(profile, claim, name) {
+  if (claim.bootstrap?.kind !== "platform-genesis" || claim.computeKey !== `platform:${name}` || claim.spec.reference !== `platform:${name}` || claim.spec.guestAddress === undefined)
+    return;
+  const legacyDir = profile.legacyStateDir ?? "/etc/forgezero/guests";
+  const legacyPath = join(legacyDir, `${name}.conf`);
+  if (!existsSync(legacyPath))
+    return;
+  const values = new Map;
+  for (const line of readFileSync(legacyPath, "utf8").split(/\r?\n/)) {
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = /^([A-Z][A-Z0-9_]*)=([^\s'"`$;|&<>]+)$/.exec(line);
+    if (!match)
+      throw new MetalProvisionError("legacy guest inventory contains unsafe syntax");
+    values.set(match[1], match[2]);
+  }
+  const disk = `/dev/${profile.volumeGroup}/${name}`;
+  if (values.get("NAME") !== name || values.get("DISK") !== disk || values.get("IP") !== claim.spec.guestAddress)
+    throw new MetalProvisionError("legacy guest inventory does not match the platform claim");
+  return {
+    computeKey: claim.computeKey,
+    reference: claim.spec.reference,
+    name,
+    address: claim.spec.guestAddress,
+    mac: values.get("MAC") ?? "",
+    cpuPoolKey: claim.spec.cpuPoolKey ?? "",
+    allowedCpus: values.get("CPUSET") ?? "",
+    allowedMemoryNodes: values.get("NUMA"),
+    phase: "running",
+    disk,
+    unit: `forgezero-guest@${name}.service`
+  };
+}
 async function removeMetalGuest(profile, claim, exec) {
   validateMetalProfile(profile);
   if (claim.action !== "delete")
     throw new MetalProvisionError("create claim cannot remove a guest");
   const name = claim.spec.guestName ?? guestNameFor(claim.computeKey);
   const manifestPath = join(profile.stateDir, `${name}.json`);
-  if (!existsSync(manifestPath))
+  const manifest = existsSync(manifestPath) ? JSON.parse(readFileSync(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
+  if (!manifest)
     return {};
-  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
   const currentIdentity = manifest.computeKey === claim.computeKey && manifest.reference === claim.spec.reference && manifest.name === name;
   const legacyPlatformIdentity = claim.bootstrap?.kind === "platform-genesis" && claim.computeKey === `platform:${name}` && claim.spec.reference === `platform:${name}` && manifest.name === name && manifest.disk === `/dev/${profile.volumeGroup}/${name}` && manifest.address === claim.spec.guestAddress && (manifest.unit === `fz-guest@${name}.service` || manifest.unit === `forgezero-guest@${name}.service`);
   if (!currentIdentity && !legacyPlatformIdentity) {
@@ -1078,7 +1112,7 @@ async function removeMetalGuest(profile, claim, exec) {
     if (existsSync(path))
       unlinkSync(path);
   if (legacyPlatformIdentity) {
-    const legacyConfig = `/etc/forgezero/guests/${name}.conf`;
+    const legacyConfig = join(profile.legacyStateDir ?? "/etc/forgezero/guests", `${name}.conf`);
     const legacyDropIn = join(profile.unitDir, `${service}.d`);
     if (existsSync(legacyConfig))
       unlinkSync(legacyConfig);

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.12";
+export declare const VERSION = "0.1.14";

package/package.json

@@ -1,7 +1,7 @@
 {
 	"//": "Publishing happens from an operator's machine, not CI \u2014 CLAUDE.md records that the absence of CI is deliberate. npm's `provenance` attests a tarball was built by a recognised CI provider from a named commit, so it cannot be produced here: it was set, and the first publish failed with `Automatic provenance generation not supported for provider: null`. A setting that can never be satisfied is worse than none, because it reads as a guarantee nobody is getting. Restore it the day this publishes from CI, and not before.",
 	"name": "@forgezero/agent",
-	"version": "0.1.12",
+	"version": "0.1.14",
 	"type": "module",
 	"scripts": {
 		"check": "tsc --noEmit",