@forgezero/agent 0.1.124 → 0.1.125

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.124";
+var VERSION3 = "0.1.125";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.124";
+var VERSION = "0.1.125";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/community-rehearsal-host.d.ts

@@ -9,6 +9,8 @@ export declare const COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
 export declare const COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
 export declare const COMMUNITY_REHEARSAL_API_PORT = 18787;
 export declare const COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
+export declare const COMMUNITY_REHEARSAL_EGRESS_TABLE = "forgezero_agent_egress";
+export declare const COMMUNITY_REHEARSAL_EGRESS_CHAIN = "output";
 export interface CommunityRehearsalNode {
     name: string;
     address: string;
@@ -48,6 +50,11 @@ export type CommunityHostOperation = {
     path: typeof COMMUNITY_DATABASE_ROOT | typeof COMMUNITY_REHEARSAL_ROOT | typeof COMMUNITY_CREDENTIAL_PARENT;
 } | {
     kind: 'clear-firewall';
+} | {
+    kind: 'prepare-egress';
+    addresses: readonly string[];
+} | {
+    kind: 'clear-egress';
 } | {
     kind: 'write';
     path: string;
@@ -75,5 +82,7 @@ export declare function planCommunityRehearsalPrepare(request: Extract<Community
 /** Remove only the dedicated rehearsal units, credentials, release and data. */
 export declare function planCommunityRehearsalCleanup(): CommunityHostOperation[];
 export declare function communityRehearsalFirewallRuleNumbers(status: string): number[];
+export declare function communityRehearsalEgressRuleHandles(ruleset: string): number[];
+export declare function communityRehearsalEgressRuleArguments(uid: string, addresses: readonly string[]): readonly (readonly string[])[];
 /** Execute only the dedicated four-node rehearsal operation selected by a typed request. */
 export declare function runCommunityRehearsalHost(request: CommunityRehearsalHostRequest): Promise<Record<string, unknown>>;

package/dist/community-rehearsal-host.js

@@ -577,6 +577,8 @@ var COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
 var COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
 var COMMUNITY_REHEARSAL_API_PORT = 18787;
 var COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
+var COMMUNITY_REHEARSAL_EGRESS_TABLE = "forgezero_agent_egress";
+var COMMUNITY_REHEARSAL_EGRESS_CHAIN = "output";
 var RELEASE = /^[a-f0-9]{64}$/;
 var SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
 async function ensureCommunityRehearsalArango(execute = executeSoftwareOperation) {
@@ -740,6 +742,7 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-community-api.service"], accepted: [0, 5] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-rehearsal-db.service"], accepted: [0, 5] },
     { kind: "clear-firewall" },
+    { kind: "prepare-egress", addresses: topology.map(({ address }) => address) },
     ...topology.map(({ address }) => ({
       kind: "exec",
       argv: [
@@ -802,6 +805,7 @@ function planCommunityRehearsalCleanup() {
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
     { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "clear-egress" },
     { kind: "clear-firewall" },
     { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
@@ -824,6 +828,10 @@ async function applyOperations(operations) {
       rmSync2(operation.path, { recursive: true, force: true });
     else if (operation.kind === "clear-firewall")
       await clearCommunityRehearsalFirewall();
+    else if (operation.kind === "prepare-egress")
+      await prepareCommunityRehearsalEgress(operation.addresses);
+    else if (operation.kind === "clear-egress")
+      await clearCommunityRehearsalEgress();
     else if (operation.kind === "write") {
       mkdirSync2(dirname2(operation.path), { recursive: true });
       writeFileSync2(operation.path, operation.content, { mode: operation.mode });
@@ -854,6 +862,49 @@ function communityRehearsalFirewallRuleNumbers(status) {
     return match ? [Number(match[1])] : [];
   }).filter((number) => Number.isSafeInteger(number) && number > 0).sort((left, right) => right - left);
 }
+function communityRehearsalEgressRuleHandles(ruleset) {
+  return ruleset.split(/\r?\n/).flatMap((line) => {
+    if (!line.includes(`comment "${COMMUNITY_REHEARSAL_FIREWALL_COMMENT}"`))
+      return [];
+    const match = line.match(/# handle (\d+)\s*$/);
+    return match ? [Number(match[1])] : [];
+  }).filter((number) => Number.isSafeInteger(number) && number > 0).sort((left, right) => right - left);
+}
+function communityRehearsalEgressRuleArguments(uid, addresses) {
+  if (!/^\d+$/.test(uid) || addresses.some((address) => isIP(address) !== 4) || new Set(addresses).size !== addresses.length) {
+    throw new Error("rehearsal egress arguments require one uid and unique IPv4 addresses");
+  }
+  return addresses.flatMap((address) => [
+    [
+      "meta",
+      "skuid",
+      uid,
+      "ct",
+      "state",
+      "established,related",
+      "ip",
+      "daddr",
+      address,
+      "accept",
+      "comment",
+      COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+    ],
+    [
+      "meta",
+      "skuid",
+      uid,
+      "ip",
+      "daddr",
+      address,
+      "tcp",
+      "dport",
+      String(COMMUNITY_REHEARSAL_COORDINATOR_PORT),
+      "accept",
+      "comment",
+      COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+    ]
+  ]);
+}
 async function clearCommunityRehearsalFirewall() {
   const status = await exec(["/usr/sbin/ufw", "status", "numbered"]);
   if (status.exitCode !== 0)
@@ -865,6 +916,71 @@ async function clearCommunityRehearsalFirewall() {
     }
   }
 }
+var rehearsalEgressRules = async () => {
+  const result = await exec([
+    "/usr/sbin/nft",
+    "-a",
+    "list",
+    "chain",
+    "inet",
+    COMMUNITY_REHEARSAL_EGRESS_TABLE,
+    COMMUNITY_REHEARSAL_EGRESS_CHAIN
+  ]);
+  if (result.exitCode === 0)
+    return { exists: true, output: result.output };
+  if (/No such file or directory|does not exist/i.test(result.output))
+    return { exists: false, output: result.output };
+  throw new Error(`unable to inspect rehearsal egress rules: ${result.output.trim()}`);
+};
+async function clearCommunityRehearsalEgress() {
+  const listed = await rehearsalEgressRules();
+  if (!listed.exists)
+    return;
+  for (const handle of communityRehearsalEgressRuleHandles(listed.output)) {
+    const removed = await exec([
+      "/usr/sbin/nft",
+      "delete",
+      "rule",
+      "inet",
+      COMMUNITY_REHEARSAL_EGRESS_TABLE,
+      COMMUNITY_REHEARSAL_EGRESS_CHAIN,
+      "handle",
+      String(handle)
+    ]);
+    if (removed.exitCode !== 0) {
+      throw new Error(`unable to remove rehearsal egress rule ${handle}: ${removed.output.trim()}`);
+    }
+  }
+}
+async function prepareCommunityRehearsalEgress(addresses) {
+  await clearCommunityRehearsalEgress();
+  if (!(await rehearsalEgressRules()).exists)
+    return;
+  const identity = await exec(["/usr/bin/id", "-u", "forgezero"]);
+  const uid = identity.output.trim();
+  if (identity.exitCode !== 0 || !/^\d+$/.test(uid))
+    throw new Error("unable to resolve the forgezero service uid");
+  for (const rule of communityRehearsalEgressRuleArguments(uid, addresses)) {
+    const inserted = await exec([
+      "/usr/sbin/nft",
+      "insert",
+      "rule",
+      "inet",
+      COMMUNITY_REHEARSAL_EGRESS_TABLE,
+      COMMUNITY_REHEARSAL_EGRESS_CHAIN,
+      ...rule
+    ]);
+    if (inserted.exitCode !== 0) {
+      await clearCommunityRehearsalEgress();
+      throw new Error(`unable to install a rehearsal egress rule: ${inserted.output.trim()}`);
+    }
+  }
+  const installed = communityRehearsalEgressRuleHandles((await rehearsalEgressRules()).output);
+  if (installed.length !== addresses.length * 2) {
+    await clearCommunityRehearsalEgress();
+    throw new Error("rehearsal egress rule verification failed");
+  }
+}
 var responseFor = async (request) => {
   const node = request.topology.find((entry) => entry.name === request.node);
   const base = `http://${node.address}:${COMMUNITY_REHEARSAL_API_PORT}`;
@@ -953,10 +1069,14 @@ export {
   parseCommunityRehearsalHostRequest,
   ensureCommunityRehearsalArango,
   communityRehearsalFirewallRuleNumbers,
+  communityRehearsalEgressRuleHandles,
+  communityRehearsalEgressRuleArguments,
   COMMUNITY_REHEARSAL_VERSION,
   COMMUNITY_REHEARSAL_STARTER_PORT,
   COMMUNITY_REHEARSAL_ROOT,
   COMMUNITY_REHEARSAL_FIREWALL_COMMENT,
+  COMMUNITY_REHEARSAL_EGRESS_TABLE,
+  COMMUNITY_REHEARSAL_EGRESS_CHAIN,
   COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE,
   COMMUNITY_REHEARSAL_COORDINATOR_PORT,
   COMMUNITY_REHEARSAL_API_PORT,

package/dist/fz-agent.js

@@ -9640,7 +9640,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.124";
+var VERSION2 = "0.1.125";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -17125,6 +17125,8 @@ var COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
 var COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
 var COMMUNITY_REHEARSAL_API_PORT = 18787;
 var COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
+var COMMUNITY_REHEARSAL_EGRESS_TABLE = "forgezero_agent_egress";
+var COMMUNITY_REHEARSAL_EGRESS_CHAIN = "output";
 var RELEASE = /^[a-f0-9]{64}$/;
 var SAFE_NAME2 = /^[a-z][a-z0-9-]{0,62}$/;
 async function ensureCommunityRehearsalArango(execute3 = executeSoftwareOperation) {
@@ -17288,6 +17290,7 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-community-api.service"], accepted: [0, 5] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-rehearsal-db.service"], accepted: [0, 5] },
     { kind: "clear-firewall" },
+    { kind: "prepare-egress", addresses: topology.map(({ address }) => address) },
     ...topology.map(({ address }) => ({
       kind: "exec",
       argv: [
@@ -17350,6 +17353,7 @@ function planCommunityRehearsalCleanup() {
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
     { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "clear-egress" },
     { kind: "clear-firewall" },
     { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
@@ -17372,6 +17376,10 @@ async function applyOperations(operations) {
       rmSync13(operation.path, { recursive: true, force: true });
     else if (operation.kind === "clear-firewall")
       await clearCommunityRehearsalFirewall();
+    else if (operation.kind === "prepare-egress")
+      await prepareCommunityRehearsalEgress(operation.addresses);
+    else if (operation.kind === "clear-egress")
+      await clearCommunityRehearsalEgress();
     else if (operation.kind === "write") {
       mkdirSync17(dirname15(operation.path), { recursive: true });
       writeFileSync17(operation.path, operation.content, { mode: operation.mode });
@@ -17402,6 +17410,49 @@ function communityRehearsalFirewallRuleNumbers(status) {
     return match ? [Number(match[1])] : [];
   }).filter((number2) => Number.isSafeInteger(number2) && number2 > 0).sort((left, right) => right - left);
 }
+function communityRehearsalEgressRuleHandles(ruleset) {
+  return ruleset.split(/\r?\n/).flatMap((line) => {
+    if (!line.includes(`comment "${COMMUNITY_REHEARSAL_FIREWALL_COMMENT}"`))
+      return [];
+    const match = line.match(/# handle (\d+)\s*$/);
+    return match ? [Number(match[1])] : [];
+  }).filter((number2) => Number.isSafeInteger(number2) && number2 > 0).sort((left, right) => right - left);
+}
+function communityRehearsalEgressRuleArguments(uid, addresses) {
+  if (!/^\d+$/.test(uid) || addresses.some((address) => isIP6(address) !== 4) || new Set(addresses).size !== addresses.length) {
+    throw new Error("rehearsal egress arguments require one uid and unique IPv4 addresses");
+  }
+  return addresses.flatMap((address) => [
+    [
+      "meta",
+      "skuid",
+      uid,
+      "ct",
+      "state",
+      "established,related",
+      "ip",
+      "daddr",
+      address,
+      "accept",
+      "comment",
+      COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+    ],
+    [
+      "meta",
+      "skuid",
+      uid,
+      "ip",
+      "daddr",
+      address,
+      "tcp",
+      "dport",
+      String(COMMUNITY_REHEARSAL_COORDINATOR_PORT),
+      "accept",
+      "comment",
+      COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+    ]
+  ]);
+}
 async function clearCommunityRehearsalFirewall() {
   const status = await exec(["/usr/sbin/ufw", "status", "numbered"]);
   if (status.exitCode !== 0)
@@ -17413,6 +17464,71 @@ async function clearCommunityRehearsalFirewall() {
     }
   }
 }
+var rehearsalEgressRules = async () => {
+  const result = await exec([
+    "/usr/sbin/nft",
+    "-a",
+    "list",
+    "chain",
+    "inet",
+    COMMUNITY_REHEARSAL_EGRESS_TABLE,
+    COMMUNITY_REHEARSAL_EGRESS_CHAIN
+  ]);
+  if (result.exitCode === 0)
+    return { exists: true, output: result.output };
+  if (/No such file or directory|does not exist/i.test(result.output))
+    return { exists: false, output: result.output };
+  throw new Error(`unable to inspect rehearsal egress rules: ${result.output.trim()}`);
+};
+async function clearCommunityRehearsalEgress() {
+  const listed = await rehearsalEgressRules();
+  if (!listed.exists)
+    return;
+  for (const handle of communityRehearsalEgressRuleHandles(listed.output)) {
+    const removed = await exec([
+      "/usr/sbin/nft",
+      "delete",
+      "rule",
+      "inet",
+      COMMUNITY_REHEARSAL_EGRESS_TABLE,
+      COMMUNITY_REHEARSAL_EGRESS_CHAIN,
+      "handle",
+      String(handle)
+    ]);
+    if (removed.exitCode !== 0) {
+      throw new Error(`unable to remove rehearsal egress rule ${handle}: ${removed.output.trim()}`);
+    }
+  }
+}
+async function prepareCommunityRehearsalEgress(addresses) {
+  await clearCommunityRehearsalEgress();
+  if (!(await rehearsalEgressRules()).exists)
+    return;
+  const identity = await exec(["/usr/bin/id", "-u", "forgezero"]);
+  const uid = identity.output.trim();
+  if (identity.exitCode !== 0 || !/^\d+$/.test(uid))
+    throw new Error("unable to resolve the forgezero service uid");
+  for (const rule of communityRehearsalEgressRuleArguments(uid, addresses)) {
+    const inserted = await exec([
+      "/usr/sbin/nft",
+      "insert",
+      "rule",
+      "inet",
+      COMMUNITY_REHEARSAL_EGRESS_TABLE,
+      COMMUNITY_REHEARSAL_EGRESS_CHAIN,
+      ...rule
+    ]);
+    if (inserted.exitCode !== 0) {
+      await clearCommunityRehearsalEgress();
+      throw new Error(`unable to install a rehearsal egress rule: ${inserted.output.trim()}`);
+    }
+  }
+  const installed = communityRehearsalEgressRuleHandles((await rehearsalEgressRules()).output);
+  if (installed.length !== addresses.length * 2) {
+    await clearCommunityRehearsalEgress();
+    throw new Error("rehearsal egress rule verification failed");
+  }
+}
 var responseFor = async (request) => {
   const node = request.topology.find((entry) => entry.name === request.node);
   const base = `http://${node.address}:${COMMUNITY_REHEARSAL_API_PORT}`;

package/dist/fz.js

@@ -4844,7 +4844,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.124";
+var VERSION2 = "0.1.125";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.124";
+var VERSION = "0.1.125";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.124";
+var VERSION = "0.1.125";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-fleet-verification.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.124";
+var VERSION3 = "0.1.125";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.124";
+var VERSION3 = "0.1.125";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.124";
+export declare const VERSION = "0.1.125";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.124",
+  "version": "0.1.125",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",