@forgezero/agent 0.1.124 → 0.1.128

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.124";
+var VERSION3 = "0.1.128";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.d.ts

@@ -123,7 +123,9 @@ export interface EnrolledComputeBootstrapSecrets {
 }
 export type BootstrapSecrets = PlatformBootstrapSecrets | EnrolledComputeBootstrapSecrets;
 export declare function validateEnrolledComputeBootstrapSecrets(config: EnrolledComputeActivationConfig, input: unknown): EnrolledComputeBootstrapSecrets;
-export declare function validatePlatformBootstrapSecrets(config: PlatformBootstrapConfig, input: unknown): PlatformBootstrapSecrets;
+export declare function validatePlatformBootstrapSecrets(config: PlatformBootstrapConfig, input: unknown, options?: {
+    allowStoredCloudflareCredentials?: boolean;
+}): PlatformBootstrapSecrets;
 export interface BootstrapStep {
     id: string;
     label: string;

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.124";
+var VERSION = "0.1.128";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3805,7 +3805,7 @@ function validateEnrolledComputeBootstrapSecrets(config, input) {
     ...cloudflareConfigured ? validateCloudflareBootstrapSecretPair(source) : {}
   };
 }
-function validatePlatformBootstrapSecrets(config, input) {
+function validatePlatformBootstrapSecrets(config, input, options = {}) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error("bootstrap credential input must be an object");
   const source = input;
@@ -3833,7 +3833,8 @@ function validatePlatformBootstrapSecrets(config, input) {
     throw new Error("backup credential is malformed");
   }
   const cloudflareConfigured = Boolean(config.cloudflareHandoff || config.runtime.environment.cloudflare);
-  if (cloudflareConfigured !== Boolean(cloudflareTunnelToken && cloudflareApiToken)) {
+  const cloudflareCredentialsSupplied = Boolean(cloudflareTunnelToken || cloudflareApiToken);
+  if (!cloudflareConfigured && cloudflareCredentialsSupplied || cloudflareConfigured && !cloudflareCredentialsSupplied && !options.allowStoredCloudflareCredentials || Boolean(cloudflareTunnelToken) !== Boolean(cloudflareApiToken)) {
     throw new Error("Cloudflare configuration requires attended CF_TUNNEL_TOKEN and CF_API_TOKEN together");
   }
   if (cloudflareTunnelToken)
@@ -4759,7 +4760,9 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   const platformPrivate = config.kind === "platform" ? (() => {
     if (!secrets)
       throw new Error("platform apply requires attended credentials on stdin");
-    const checked4 = validatePlatformBootstrapSecrets(config, secrets);
+    const checked4 = validatePlatformBootstrapSecrets(config, secrets, {
+      allowStoredCloudflareCredentials: Boolean(installed?.cloudflare && config.cloudflareHandoff && !cloudflare)
+    });
     return {
       root: checked4.clusterBootstrapCode,
       email: checked4.emailSecret,

package/dist/community-rehearsal-host.d.ts

@@ -9,6 +9,8 @@ export declare const COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
 export declare const COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
 export declare const COMMUNITY_REHEARSAL_API_PORT = 18787;
 export declare const COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
+export declare const COMMUNITY_REHEARSAL_EGRESS_TABLE = "forgezero_agent_egress";
+export declare const COMMUNITY_REHEARSAL_EGRESS_CHAIN = "output";
 export interface CommunityRehearsalNode {
     name: string;
     address: string;
@@ -48,6 +50,11 @@ export type CommunityHostOperation = {
     path: typeof COMMUNITY_DATABASE_ROOT | typeof COMMUNITY_REHEARSAL_ROOT | typeof COMMUNITY_CREDENTIAL_PARENT;
 } | {
     kind: 'clear-firewall';
+} | {
+    kind: 'prepare-egress';
+    addresses: readonly string[];
+} | {
+    kind: 'clear-egress';
 } | {
     kind: 'write';
     path: string;
@@ -75,5 +82,7 @@ export declare function planCommunityRehearsalPrepare(request: Extract<Community
 /** Remove only the dedicated rehearsal units, credentials, release and data. */
 export declare function planCommunityRehearsalCleanup(): CommunityHostOperation[];
 export declare function communityRehearsalFirewallRuleNumbers(status: string): number[];
+export declare function communityRehearsalEgressRuleHandles(ruleset: string): number[];
+export declare function communityRehearsalEgressRuleArguments(uid: string, addresses: readonly string[]): readonly (readonly string[])[];
 /** Execute only the dedicated four-node rehearsal operation selected by a typed request. */
 export declare function runCommunityRehearsalHost(request: CommunityRehearsalHostRequest): Promise<Record<string, unknown>>;

package/dist/community-rehearsal-host.js

@@ -577,6 +577,8 @@ var COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
 var COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
 var COMMUNITY_REHEARSAL_API_PORT = 18787;
 var COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
+var COMMUNITY_REHEARSAL_EGRESS_TABLE = "forgezero_agent_egress";
+var COMMUNITY_REHEARSAL_EGRESS_CHAIN = "output";
 var RELEASE = /^[a-f0-9]{64}$/;
 var SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
 async function ensureCommunityRehearsalArango(execute = executeSoftwareOperation) {
@@ -740,6 +742,7 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-community-api.service"], accepted: [0, 5] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-rehearsal-db.service"], accepted: [0, 5] },
     { kind: "clear-firewall" },
+    { kind: "prepare-egress", addresses: topology.map(({ address }) => address) },
     ...topology.map(({ address }) => ({
       kind: "exec",
       argv: [
@@ -802,6 +805,7 @@ function planCommunityRehearsalCleanup() {
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
     { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "clear-egress" },
     { kind: "clear-firewall" },
     { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
@@ -824,6 +828,10 @@ async function applyOperations(operations) {
       rmSync2(operation.path, { recursive: true, force: true });
     else if (operation.kind === "clear-firewall")
       await clearCommunityRehearsalFirewall();
+    else if (operation.kind === "prepare-egress")
+      await prepareCommunityRehearsalEgress(operation.addresses);
+    else if (operation.kind === "clear-egress")
+      await clearCommunityRehearsalEgress();
     else if (operation.kind === "write") {
       mkdirSync2(dirname2(operation.path), { recursive: true });
       writeFileSync2(operation.path, operation.content, { mode: operation.mode });
@@ -854,6 +862,49 @@ function communityRehearsalFirewallRuleNumbers(status) {
     return match ? [Number(match[1])] : [];
   }).filter((number) => Number.isSafeInteger(number) && number > 0).sort((left, right) => right - left);
 }
+function communityRehearsalEgressRuleHandles(ruleset) {
+  return ruleset.split(/\r?\n/).flatMap((line) => {
+    if (!line.includes(`comment "${COMMUNITY_REHEARSAL_FIREWALL_COMMENT}"`))
+      return [];
+    const match = line.match(/# handle (\d+)\s*$/);
+    return match ? [Number(match[1])] : [];
+  }).filter((number) => Number.isSafeInteger(number) && number > 0).sort((left, right) => right - left);
+}
+function communityRehearsalEgressRuleArguments(uid, addresses) {
+  if (!/^\d+$/.test(uid) || addresses.some((address) => isIP(address) !== 4) || new Set(addresses).size !== addresses.length) {
+    throw new Error("rehearsal egress arguments require one uid and unique IPv4 addresses");
+  }
+  return addresses.flatMap((address) => [
+    [
+      "meta",
+      "skuid",
+      uid,
+      "ct",
+      "state",
+      "established,related",
+      "ip",
+      "daddr",
+      address,
+      "accept",
+      "comment",
+      COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+    ],
+    [
+      "meta",
+      "skuid",
+      uid,
+      "ip",
+      "daddr",
+      address,
+      "tcp",
+      "dport",
+      String(COMMUNITY_REHEARSAL_COORDINATOR_PORT),
+      "accept",
+      "comment",
+      COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+    ]
+  ]);
+}
 async function clearCommunityRehearsalFirewall() {
   const status = await exec(["/usr/sbin/ufw", "status", "numbered"]);
   if (status.exitCode !== 0)
@@ -865,6 +916,71 @@ async function clearCommunityRehearsalFirewall() {
     }
   }
 }
+var rehearsalEgressRules = async () => {
+  const result = await exec([
+    "/usr/sbin/nft",
+    "-a",
+    "list",
+    "chain",
+    "inet",
+    COMMUNITY_REHEARSAL_EGRESS_TABLE,
+    COMMUNITY_REHEARSAL_EGRESS_CHAIN
+  ]);
+  if (result.exitCode === 0)
+    return { exists: true, output: result.output };
+  if (/No such file or directory|does not exist/i.test(result.output))
+    return { exists: false, output: result.output };
+  throw new Error(`unable to inspect rehearsal egress rules: ${result.output.trim()}`);
+};
+async function clearCommunityRehearsalEgress() {
+  const listed = await rehearsalEgressRules();
+  if (!listed.exists)
+    return;
+  for (const handle of communityRehearsalEgressRuleHandles(listed.output)) {
+    const removed = await exec([
+      "/usr/sbin/nft",
+      "delete",
+      "rule",
+      "inet",
+      COMMUNITY_REHEARSAL_EGRESS_TABLE,
+      COMMUNITY_REHEARSAL_EGRESS_CHAIN,
+      "handle",
+      String(handle)
+    ]);
+    if (removed.exitCode !== 0) {
+      throw new Error(`unable to remove rehearsal egress rule ${handle}: ${removed.output.trim()}`);
+    }
+  }
+}
+async function prepareCommunityRehearsalEgress(addresses) {
+  await clearCommunityRehearsalEgress();
+  if (!(await rehearsalEgressRules()).exists)
+    return;
+  const identity = await exec(["/usr/bin/id", "-u", "forgezero"]);
+  const uid = identity.output.trim();
+  if (identity.exitCode !== 0 || !/^\d+$/.test(uid))
+    throw new Error("unable to resolve the forgezero service uid");
+  for (const rule of communityRehearsalEgressRuleArguments(uid, addresses)) {
+    const inserted = await exec([
+      "/usr/sbin/nft",
+      "insert",
+      "rule",
+      "inet",
+      COMMUNITY_REHEARSAL_EGRESS_TABLE,
+      COMMUNITY_REHEARSAL_EGRESS_CHAIN,
+      ...rule
+    ]);
+    if (inserted.exitCode !== 0) {
+      await clearCommunityRehearsalEgress();
+      throw new Error(`unable to install a rehearsal egress rule: ${inserted.output.trim()}`);
+    }
+  }
+  const installed = communityRehearsalEgressRuleHandles((await rehearsalEgressRules()).output);
+  if (installed.length !== addresses.length * 2) {
+    await clearCommunityRehearsalEgress();
+    throw new Error("rehearsal egress rule verification failed");
+  }
+}
 var responseFor = async (request) => {
   const node = request.topology.find((entry) => entry.name === request.node);
   const base = `http://${node.address}:${COMMUNITY_REHEARSAL_API_PORT}`;
@@ -953,10 +1069,14 @@ export {
   parseCommunityRehearsalHostRequest,
   ensureCommunityRehearsalArango,
   communityRehearsalFirewallRuleNumbers,
+  communityRehearsalEgressRuleHandles,
+  communityRehearsalEgressRuleArguments,
   COMMUNITY_REHEARSAL_VERSION,
   COMMUNITY_REHEARSAL_STARTER_PORT,
   COMMUNITY_REHEARSAL_ROOT,
   COMMUNITY_REHEARSAL_FIREWALL_COMMENT,
+  COMMUNITY_REHEARSAL_EGRESS_TABLE,
+  COMMUNITY_REHEARSAL_EGRESS_CHAIN,
   COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE,
   COMMUNITY_REHEARSAL_COORDINATOR_PORT,
   COMMUNITY_REHEARSAL_API_PORT,