@forgezero/agent 0.1.129 → 0.1.130

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.129";
+var VERSION3 = "0.1.130";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.129";
+var VERSION = "0.1.130";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4664,6 +4664,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     installed = parseStoredState(host.read(STATE_PATH));
   let bootstrapManifest;
   let releaseEvidence;
+  let redundantBootstrapBundle = false;
   if (config.kind === "platform") {
     const staged = host.exists(config.bootstrapBundle.bundleFile) || host.exists(config.bootstrapBundle.manifestFile);
     if (staged && !(host.exists(config.bootstrapBundle.bundleFile) && host.exists(config.bootstrapBundle.manifestFile))) {
@@ -4684,8 +4685,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
         throw new Error("bootstrap release evidence is malformed");
       releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
-      if (evidence.revision !== reviewed.revision || evidence.sha256 !== reviewed.sha256 || evidence.branch !== reviewed.branch)
+      if (evidence.revision !== reviewed.revision || evidence.branch !== reviewed.branch) {
         bootstrapManifest = reviewed;
+      } else {
+        redundantBootstrapBundle = true;
+      }
     } else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
       let evidence;
       try {
@@ -4962,6 +4966,46 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await checked3(host, ["nginx", "-t"], "nginx configuration");
     await checked3(host, ["systemctl", "daemon-reload"], "systemd reload");
     await checked3(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    if (alreadyEnrolled && !bootstrapManifest) {
+      const healthCommand = [
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "10",
+        `http://127.0.0.1:${runtime.environment.publicApiPort}${runtime.healthPath}`
+      ];
+      const health = await host.exec(healthCommand);
+      if (health.exitCode !== 0) {
+        const activeSlotFile = `${runtime.slotsDirectory}/.active`;
+        if (!host.exists(activeSlotFile))
+          throw new Error("enrolled platform active API slot evidence is missing");
+        const activeSlot = host.read(activeSlotFile).trim();
+        if (activeSlot !== "blue" && activeSlot !== "green") {
+          throw new Error("enrolled platform active API slot evidence is malformed");
+        }
+        await checked3(host, ["systemctl", "start", `forgezero@${activeSlot}.service`], "active API slot repair");
+        let ready = false;
+        let lastHealthOutput = "";
+        for (let attempt = 0;attempt < 30; attempt += 1) {
+          const repairedHealth = await host.exec(healthCommand);
+          if (repairedHealth.exitCode === 0) {
+            ready = true;
+            break;
+          }
+          lastHealthOutput = repairedHealth.output.trim();
+          if (attempt < 29)
+            await (host.sleep?.(1000) ?? Bun.sleep(1000));
+        }
+        if (!ready)
+          throw new Error(`repaired API health failed: ${lastHealthOutput || "readiness deadline exceeded"}`);
+      }
+      if (redundantBootstrapBundle) {
+        host.remove(config.bootstrapBundle.bundleFile);
+        host.remove(config.bootstrapBundle.manifestFile);
+      }
+    }
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {

package/dist/fz-agent.js

@@ -9640,7 +9640,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.129";
+var VERSION2 = "0.1.130";
 
 // src/ssh-bootstrap.ts
 function deriveMetalAdmissionProvisioning(lscpu) {

package/dist/fz.js

@@ -5788,7 +5788,7 @@ var VaultRuntimeClientError, json = (value) => ({ method: "POST", body: JSON.str
   } catch {
     return;
   }
-}, VERSION = "0.1.26";
+}, VERSION = "0.1.27";
 var init_dist = __esm(() => {
   init_vault_runtime();
   init_identity();
@@ -6007,7 +6007,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.129";
+var VERSION2 = "0.1.130";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -15284,6 +15284,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     installed = parseStoredState(host.read(STATE_PATH));
   let bootstrapManifest;
   let releaseEvidence;
+  let redundantBootstrapBundle = false;
   if (config.kind === "platform") {
     const staged = host.exists(config.bootstrapBundle.bundleFile) || host.exists(config.bootstrapBundle.manifestFile);
     if (staged && !(host.exists(config.bootstrapBundle.bundleFile) && host.exists(config.bootstrapBundle.manifestFile))) {
@@ -15304,8 +15305,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
         throw new Error("bootstrap release evidence is malformed");
       releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
-      if (evidence.revision !== reviewed.revision || evidence.sha256 !== reviewed.sha256 || evidence.branch !== reviewed.branch)
+      if (evidence.revision !== reviewed.revision || evidence.branch !== reviewed.branch) {
         bootstrapManifest = reviewed;
+      } else {
+        redundantBootstrapBundle = true;
+      }
     } else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
       let evidence;
       try {
@@ -15582,6 +15586,46 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await checked3(host, ["nginx", "-t"], "nginx configuration");
     await checked3(host, ["systemctl", "daemon-reload"], "systemd reload");
     await checked3(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    if (alreadyEnrolled && !bootstrapManifest) {
+      const healthCommand = [
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "10",
+        `http://127.0.0.1:${runtime.environment.publicApiPort}${runtime.healthPath}`
+      ];
+      const health = await host.exec(healthCommand);
+      if (health.exitCode !== 0) {
+        const activeSlotFile = `${runtime.slotsDirectory}/.active`;
+        if (!host.exists(activeSlotFile))
+          throw new Error("enrolled platform active API slot evidence is missing");
+        const activeSlot = host.read(activeSlotFile).trim();
+        if (activeSlot !== "blue" && activeSlot !== "green") {
+          throw new Error("enrolled platform active API slot evidence is malformed");
+        }
+        await checked3(host, ["systemctl", "start", `forgezero@${activeSlot}.service`], "active API slot repair");
+        let ready = false;
+        let lastHealthOutput = "";
+        for (let attempt = 0;attempt < 30; attempt += 1) {
+          const repairedHealth = await host.exec(healthCommand);
+          if (repairedHealth.exitCode === 0) {
+            ready = true;
+            break;
+          }
+          lastHealthOutput = repairedHealth.output.trim();
+          if (attempt < 29)
+            await (host.sleep?.(1000) ?? Bun.sleep(1000));
+        }
+        if (!ready)
+          throw new Error(`repaired API health failed: ${lastHealthOutput || "readiness deadline exceeded"}`);
+      }
+      if (redundantBootstrapBundle) {
+        host.remove(config.bootstrapBundle.bundleFile);
+        host.remove(config.bootstrapBundle.manifestFile);
+      }
+    }
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {
@@ -18174,7 +18218,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
 ` : undefined, mode === "apply");
     return { plan, output };
   } finally {
-    if (knownHosts) {
+    if (knownHosts && mode !== "status") {
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/rm", "-rf", "--", REMOTE_STAGE, remoteTemp], "remote bootstrap cleanup", true).catch(() => {
         return;
       });

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.129";
+var VERSION = "0.1.130";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.129";
+var VERSION = "0.1.130";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4664,6 +4664,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     installed = parseStoredState(host.read(STATE_PATH));
   let bootstrapManifest;
   let releaseEvidence;
+  let redundantBootstrapBundle = false;
   if (config.kind === "platform") {
     const staged = host.exists(config.bootstrapBundle.bundleFile) || host.exists(config.bootstrapBundle.manifestFile);
     if (staged && !(host.exists(config.bootstrapBundle.bundleFile) && host.exists(config.bootstrapBundle.manifestFile))) {
@@ -4684,8 +4685,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
         throw new Error("bootstrap release evidence is malformed");
       releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
-      if (evidence.revision !== reviewed.revision || evidence.sha256 !== reviewed.sha256 || evidence.branch !== reviewed.branch)
+      if (evidence.revision !== reviewed.revision || evidence.branch !== reviewed.branch) {
         bootstrapManifest = reviewed;
+      } else {
+        redundantBootstrapBundle = true;
+      }
     } else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
       let evidence;
       try {
@@ -4962,6 +4966,46 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await checked3(host, ["nginx", "-t"], "nginx configuration");
     await checked3(host, ["systemctl", "daemon-reload"], "systemd reload");
     await checked3(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    if (alreadyEnrolled && !bootstrapManifest) {
+      const healthCommand = [
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "10",
+        `http://127.0.0.1:${runtime.environment.publicApiPort}${runtime.healthPath}`
+      ];
+      const health = await host.exec(healthCommand);
+      if (health.exitCode !== 0) {
+        const activeSlotFile = `${runtime.slotsDirectory}/.active`;
+        if (!host.exists(activeSlotFile))
+          throw new Error("enrolled platform active API slot evidence is missing");
+        const activeSlot = host.read(activeSlotFile).trim();
+        if (activeSlot !== "blue" && activeSlot !== "green") {
+          throw new Error("enrolled platform active API slot evidence is malformed");
+        }
+        await checked3(host, ["systemctl", "start", `forgezero@${activeSlot}.service`], "active API slot repair");
+        let ready = false;
+        let lastHealthOutput = "";
+        for (let attempt = 0;attempt < 30; attempt += 1) {
+          const repairedHealth = await host.exec(healthCommand);
+          if (repairedHealth.exitCode === 0) {
+            ready = true;
+            break;
+          }
+          lastHealthOutput = repairedHealth.output.trim();
+          if (attempt < 29)
+            await (host.sleep?.(1000) ?? Bun.sleep(1000));
+        }
+        if (!ready)
+          throw new Error(`repaired API health failed: ${lastHealthOutput || "readiness deadline exceeded"}`);
+      }
+      if (redundantBootstrapBundle) {
+        host.remove(config.bootstrapBundle.bundleFile);
+        host.remove(config.bootstrapBundle.manifestFile);
+      }
+    }
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {
@@ -7353,7 +7397,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
 ` : undefined, mode === "apply");
     return { plan, output };
   } finally {
-    if (knownHosts) {
+    if (knownHosts && mode !== "status") {
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/rm", "-rf", "--", REMOTE_STAGE, remoteTemp], "remote bootstrap cleanup", true).catch(() => {
         return;
       });

package/dist/platform-fleet-verification.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.129";
+var VERSION3 = "0.1.130";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.129";
+var VERSION3 = "0.1.130";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.129";
+export declare const VERSION = "0.1.130";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.129",
+  "version": "0.1.130",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",
@@ -16,8 +16,8 @@
     "@noble/post-quantum": "^0.6.1"
   },
   "dependencies": {
-    "@forgezero/runtime": "0.1.20",
-    "@forgezero/vault": "0.1.26",
+    "@forgezero/runtime": "0.1.21",
+    "@forgezero/vault": "0.1.27",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "@noble/post-quantum": "0.6.1",