@forgezero/agent 0.1.122 → 0.1.124

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.122";
+var VERSION3 = "0.1.124";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.122";
+var VERSION = "0.1.124";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/community-rehearsal-host.d.ts

@@ -6,7 +6,9 @@ export declare const COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 export declare const COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
 export declare const COMMUNITY_REHEARSAL_STARTER_PORT = 18528;
 export declare const COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
+export declare const COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
 export declare const COMMUNITY_REHEARSAL_API_PORT = 18787;
+export declare const COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
 export interface CommunityRehearsalNode {
     name: string;
     address: string;
@@ -44,6 +46,8 @@ export type CommunityRehearsalHostRequest = {
 export type CommunityHostOperation = {
     kind: 'remove-tree';
     path: typeof COMMUNITY_DATABASE_ROOT | typeof COMMUNITY_REHEARSAL_ROOT | typeof COMMUNITY_CREDENTIAL_PARENT;
+} | {
+    kind: 'clear-firewall';
 } | {
     kind: 'write';
     path: string;
@@ -70,5 +74,6 @@ export declare function planCommunityRehearsalPrepare(request: Extract<Community
 }>): CommunityHostOperation[];
 /** Remove only the dedicated rehearsal units, credentials, release and data. */
 export declare function planCommunityRehearsalCleanup(): CommunityHostOperation[];
+export declare function communityRehearsalFirewallRuleNumbers(status: string): number[];
 /** Execute only the dedicated four-node rehearsal operation selected by a typed request. */
 export declare function runCommunityRehearsalHost(request: CommunityRehearsalHostRequest): Promise<Record<string, unknown>>;

package/dist/community-rehearsal-host.js

@@ -574,7 +574,9 @@ var COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 var COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
 var COMMUNITY_REHEARSAL_STARTER_PORT = 18528;
 var COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
+var COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
 var COMMUNITY_REHEARSAL_API_PORT = 18787;
+var COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
 var RELEASE = /^[a-f0-9]{64}$/;
 var SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
 async function ensureCommunityRehearsalArango(execute = executeSoftwareOperation) {
@@ -703,10 +705,10 @@ User=forgezero
 Group=forgezero
 WorkingDirectory=${COMMUNITY_REHEARSAL_ROOT}/current
 LoadCredentialEncrypted=arangodb-jwt:${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred
-Environment=HOST=127.0.0.1
+Environment=HOST=${node.address}
 Environment=PORT=${COMMUNITY_REHEARSAL_API_PORT}
 Environment=NODE_NAME=${node.name}
-Environment=ARANGO_URL=http://127.0.0.1:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}
+Environment=ARANGO_URL=http://${node.address}:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}
 Environment=ARANGO_URLS=${urls}
 Environment=ARANGO_READ_PREFERRED_URLS=${readPreferred}
 Environment=ARANGO_READ_PREFERRED_FALLBACK=error
@@ -737,6 +739,41 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "exec", argv: ["/usr/sbin/arangod", "--version"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-community-api.service"], accepted: [0, 5] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-rehearsal-db.service"], accepted: [0, 5] },
+    { kind: "clear-firewall" },
+    ...topology.map(({ address }) => ({
+      kind: "exec",
+      argv: [
+        "/usr/sbin/ufw",
+        "allow",
+        "from",
+        address,
+        "to",
+        "any",
+        "port",
+        COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE,
+        "proto",
+        "tcp",
+        "comment",
+        COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+      ]
+    })),
+    ...topology.map(({ address }) => ({
+      kind: "exec",
+      argv: [
+        "/usr/sbin/ufw",
+        "allow",
+        "from",
+        address,
+        "to",
+        "any",
+        "port",
+        String(COMMUNITY_REHEARSAL_API_PORT),
+        "proto",
+        "tcp",
+        "comment",
+        COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+      ]
+    })),
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "exec", argv: ["/usr/bin/install", "-d", "-m", "0700", "-o", "root", "-g", "root", COMMUNITY_CREDENTIAL_ROOT] },
     { kind: "exec", argv: ["/usr/bin/install", "-d", "-m", "0700", "-o", "arangodb", "-g", "arangodb", COMMUNITY_DATABASE_ROOT] },
@@ -765,6 +802,7 @@ function planCommunityRehearsalCleanup() {
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
     { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "clear-firewall" },
     { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
   ];
@@ -784,6 +822,8 @@ async function applyOperations(operations) {
   for (const operation of operations) {
     if (operation.kind === "remove-tree")
       rmSync2(operation.path, { recursive: true, force: true });
+    else if (operation.kind === "clear-firewall")
+      await clearCommunityRehearsalFirewall();
     else if (operation.kind === "write") {
       mkdirSync2(dirname2(operation.path), { recursive: true });
       writeFileSync2(operation.path, operation.content, { mode: operation.mode });
@@ -806,8 +846,28 @@ async function applyOperations(operations) {
     }
   }
 }
+function communityRehearsalFirewallRuleNumbers(status) {
+  return status.split(/\r?\n/).flatMap((line) => {
+    if (!line.includes(`# ${COMMUNITY_REHEARSAL_FIREWALL_COMMENT}`))
+      return [];
+    const match = line.match(/^\[\s*(\d+)\]/);
+    return match ? [Number(match[1])] : [];
+  }).filter((number) => Number.isSafeInteger(number) && number > 0).sort((left, right) => right - left);
+}
+async function clearCommunityRehearsalFirewall() {
+  const status = await exec(["/usr/sbin/ufw", "status", "numbered"]);
+  if (status.exitCode !== 0)
+    throw new Error(`unable to inspect rehearsal firewall rules: ${status.output.trim()}`);
+  for (const number of communityRehearsalFirewallRuleNumbers(status.output)) {
+    const removed = await exec(["/usr/sbin/ufw", "--force", "delete", String(number)]);
+    if (removed.exitCode !== 0) {
+      throw new Error(`unable to remove rehearsal firewall rule ${number}: ${removed.output.trim()}`);
+    }
+  }
+}
 var responseFor = async (request) => {
-  const base = `http://127.0.0.1:${COMMUNITY_REHEARSAL_API_PORT}`;
+  const node = request.topology.find((entry) => entry.name === request.node);
+  const base = `http://${node.address}:${COMMUNITY_REHEARSAL_API_PORT}`;
   if (request.operation === "health")
     return fetch(`${base}/health`, { signal: AbortSignal.timeout(15000) });
   if (request.operation === "init")
@@ -869,7 +929,7 @@ async function runCommunityRehearsalHost(request) {
   }
   if (request.action === "database-ready" || request.action === "starter-ready" || request.action === "api-ready") {
     const starter = topology.find((entry) => entry.starter);
-    const url = request.action === "database-ready" ? `http://127.0.0.1:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}/_api/version` : request.action === "starter-ready" ? `http://${starter.address}:${COMMUNITY_REHEARSAL_STARTER_PORT}/version` : `http://127.0.0.1:${COMMUNITY_REHEARSAL_API_PORT}/health`;
+    const url = request.action === "database-ready" ? `http://${node.address}:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}/_api/version` : request.action === "starter-ready" ? `http://${starter.address}:${COMMUNITY_REHEARSAL_STARTER_PORT}/version` : `http://${node.address}:${COMMUNITY_REHEARSAL_API_PORT}/health`;
     const response2 = await fetch(url, { signal: AbortSignal.timeout(2000) }).catch(() => {
       return;
     });
@@ -892,9 +952,12 @@ export {
   planCommunityRehearsalCleanup,
   parseCommunityRehearsalHostRequest,
   ensureCommunityRehearsalArango,
+  communityRehearsalFirewallRuleNumbers,
   COMMUNITY_REHEARSAL_VERSION,
   COMMUNITY_REHEARSAL_STARTER_PORT,
   COMMUNITY_REHEARSAL_ROOT,
+  COMMUNITY_REHEARSAL_FIREWALL_COMMENT,
+  COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE,
   COMMUNITY_REHEARSAL_COORDINATOR_PORT,
   COMMUNITY_REHEARSAL_API_PORT,
   COMMUNITY_DATABASE_ROOT,

package/dist/fz-agent.js

@@ -9640,7 +9640,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.122";
+var VERSION2 = "0.1.124";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -17122,7 +17122,9 @@ var COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 var COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
 var COMMUNITY_REHEARSAL_STARTER_PORT = 18528;
 var COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
+var COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
 var COMMUNITY_REHEARSAL_API_PORT = 18787;
+var COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
 var RELEASE = /^[a-f0-9]{64}$/;
 var SAFE_NAME2 = /^[a-z][a-z0-9-]{0,62}$/;
 async function ensureCommunityRehearsalArango(execute3 = executeSoftwareOperation) {
@@ -17251,10 +17253,10 @@ User=forgezero
 Group=forgezero
 WorkingDirectory=${COMMUNITY_REHEARSAL_ROOT}/current
 LoadCredentialEncrypted=arangodb-jwt:${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred
-Environment=HOST=127.0.0.1
+Environment=HOST=${node.address}
 Environment=PORT=${COMMUNITY_REHEARSAL_API_PORT}
 Environment=NODE_NAME=${node.name}
-Environment=ARANGO_URL=http://127.0.0.1:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}
+Environment=ARANGO_URL=http://${node.address}:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}
 Environment=ARANGO_URLS=${urls}
 Environment=ARANGO_READ_PREFERRED_URLS=${readPreferred}
 Environment=ARANGO_READ_PREFERRED_FALLBACK=error
@@ -17285,6 +17287,41 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "exec", argv: ["/usr/sbin/arangod", "--version"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-community-api.service"], accepted: [0, 5] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-rehearsal-db.service"], accepted: [0, 5] },
+    { kind: "clear-firewall" },
+    ...topology.map(({ address }) => ({
+      kind: "exec",
+      argv: [
+        "/usr/sbin/ufw",
+        "allow",
+        "from",
+        address,
+        "to",
+        "any",
+        "port",
+        COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE,
+        "proto",
+        "tcp",
+        "comment",
+        COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+      ]
+    })),
+    ...topology.map(({ address }) => ({
+      kind: "exec",
+      argv: [
+        "/usr/sbin/ufw",
+        "allow",
+        "from",
+        address,
+        "to",
+        "any",
+        "port",
+        String(COMMUNITY_REHEARSAL_API_PORT),
+        "proto",
+        "tcp",
+        "comment",
+        COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+      ]
+    })),
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "exec", argv: ["/usr/bin/install", "-d", "-m", "0700", "-o", "root", "-g", "root", COMMUNITY_CREDENTIAL_ROOT] },
     { kind: "exec", argv: ["/usr/bin/install", "-d", "-m", "0700", "-o", "arangodb", "-g", "arangodb", COMMUNITY_DATABASE_ROOT] },
@@ -17313,6 +17350,7 @@ function planCommunityRehearsalCleanup() {
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
     { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "clear-firewall" },
     { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
   ];
@@ -17332,6 +17370,8 @@ async function applyOperations(operations) {
   for (const operation of operations) {
     if (operation.kind === "remove-tree")
       rmSync13(operation.path, { recursive: true, force: true });
+    else if (operation.kind === "clear-firewall")
+      await clearCommunityRehearsalFirewall();
     else if (operation.kind === "write") {
       mkdirSync17(dirname15(operation.path), { recursive: true });
       writeFileSync17(operation.path, operation.content, { mode: operation.mode });
@@ -17354,8 +17394,28 @@ async function applyOperations(operations) {
     }
   }
 }
+function communityRehearsalFirewallRuleNumbers(status) {
+  return status.split(/\r?\n/).flatMap((line) => {
+    if (!line.includes(`# ${COMMUNITY_REHEARSAL_FIREWALL_COMMENT}`))
+      return [];
+    const match = line.match(/^\[\s*(\d+)\]/);
+    return match ? [Number(match[1])] : [];
+  }).filter((number2) => Number.isSafeInteger(number2) && number2 > 0).sort((left, right) => right - left);
+}
+async function clearCommunityRehearsalFirewall() {
+  const status = await exec(["/usr/sbin/ufw", "status", "numbered"]);
+  if (status.exitCode !== 0)
+    throw new Error(`unable to inspect rehearsal firewall rules: ${status.output.trim()}`);
+  for (const number2 of communityRehearsalFirewallRuleNumbers(status.output)) {
+    const removed = await exec(["/usr/sbin/ufw", "--force", "delete", String(number2)]);
+    if (removed.exitCode !== 0) {
+      throw new Error(`unable to remove rehearsal firewall rule ${number2}: ${removed.output.trim()}`);
+    }
+  }
+}
 var responseFor = async (request) => {
-  const base = `http://127.0.0.1:${COMMUNITY_REHEARSAL_API_PORT}`;
+  const node = request.topology.find((entry) => entry.name === request.node);
+  const base = `http://${node.address}:${COMMUNITY_REHEARSAL_API_PORT}`;
   if (request.operation === "health")
     return fetch(`${base}/health`, { signal: AbortSignal.timeout(15000) });
   if (request.operation === "init")
@@ -17417,7 +17477,7 @@ async function runCommunityRehearsalHost(request) {
   }
   if (request.action === "database-ready" || request.action === "starter-ready" || request.action === "api-ready") {
     const starter = topology.find((entry) => entry.starter);
-    const url = request.action === "database-ready" ? `http://127.0.0.1:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}/_api/version` : request.action === "starter-ready" ? `http://${starter.address}:${COMMUNITY_REHEARSAL_STARTER_PORT}/version` : `http://127.0.0.1:${COMMUNITY_REHEARSAL_API_PORT}/health`;
+    const url = request.action === "database-ready" ? `http://${node.address}:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}/_api/version` : request.action === "starter-ready" ? `http://${starter.address}:${COMMUNITY_REHEARSAL_STARTER_PORT}/version` : `http://${node.address}:${COMMUNITY_REHEARSAL_API_PORT}/health`;
     const response2 = await fetch(url, { signal: AbortSignal.timeout(2000) }).catch(() => {
       return;
     });

package/dist/fz.js

@@ -4844,7 +4844,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.122";
+var VERSION2 = "0.1.124";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.122";
+var VERSION = "0.1.124";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.122";
+var VERSION = "0.1.124";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-fleet-verification.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.122";
+var VERSION3 = "0.1.124";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.122";
+var VERSION3 = "0.1.124";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.122";
+export declare const VERSION = "0.1.124";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.122",
+  "version": "0.1.124",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",