@forgezero/agent 0.1.130 → 0.1.132

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.130";
+var VERSION3 = "0.1.132";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.130";
+var VERSION = "0.1.132";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/fz-agent.js

@@ -9640,7 +9640,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.130";
+var VERSION2 = "0.1.132";
 
 // src/ssh-bootstrap.ts
 function deriveMetalAdmissionProvisioning(lscpu) {
@@ -10834,9 +10834,13 @@ function guestBootstrapOperations(profile, attested = Boolean(profile.confidenti
       "/run/forgezero-bun.zip"
     ],
     ["/usr/bin/sha256sum", "--check", "/etc/forgezero/bun.sha256"],
-    ["/usr/bin/unzip", "-q", "/run/forgezero-bun.zip", "-d", "/run/forgezero-bun"],
+    ["/usr/bin/busybox", "unzip", "-o", "-q", "/run/forgezero-bun.zip", "-d", "/run/forgezero-bun"],
     ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/runtime", agentBun],
-    ["/usr/bin/install", "-m", "0755", "/run/forgezero-bun/bun-linux-x64/bun", "/usr/local/lib/forgezero/runtime/bun"],
+    ["/usr/bin/rm", "-f", "--", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/cp", "--", "/run/forgezero-bun/bun-linux-x64/bun", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/chown", "root:root", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/chmod", "0755", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/mv", "-f", "--", "/usr/local/lib/forgezero/runtime/bun.forgezero-next", "/usr/local/lib/forgezero/runtime/bun"],
     ["/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun"],
     [
       "/usr/bin/env",
@@ -10894,7 +10898,7 @@ package_update: true
 ${users}disable_root: true
 # Git is part of the deployment transport, not a tenant-selected prerequisite:
 # every dynamically claimed repository must be cloneable on a clean image.
-packages: [curl, ca-certificates, openssl, openssh-client, git, unzip${claim.spec.confidential ? ", python3" : ""}]
+packages: [curl, ca-certificates, openssl, openssh-client, git, busybox-static${claim.spec.confidential ? ", python3" : ""}]
 write_files:
 ${enrolmentFiles}${attestationFile}${bunChecksum}runcmd:
 ${bootstrap.map((argv2) => `  - ${JSON.stringify(argv2)}`).join(`

package/dist/fz.js

@@ -6007,7 +6007,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.130";
+var VERSION2 = "0.1.132";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -17925,6 +17925,20 @@ var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
     return false;
   throw new Error(`remote initialized-state probe failed${result.output ? `: ${result.output.trim()}` : ""}`);
 };
+var replaceRemoteFile = async (exec, request, knownHosts, source, destinationPath, mode, label, secret = false) => {
+  const staged = `${destinationPath}.forgezero-next`;
+  try {
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/rm", "-f", "--", staged], label, secret);
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/cp", "--", source, staged], label, secret);
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/chown", "root:root", staged], label, secret);
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/chmod", mode, staged], label, secret);
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/mv", "-f", "--", staged, destinationPath], label, secret);
+  } finally {
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/rm", "-f", "--", staged], label, true).catch(() => {
+      return;
+    });
+  }
+};
 async function operatorMetalClusterBootstrapCode(requestInput, options = {}) {
   const request = validateMetalRequestValue(requestInput, { validateMetalConfig: false });
   publicIdentity(request.target.identityPublicKeyFile);
@@ -18154,21 +18168,24 @@ async function installPackagedAgent(request, knownHosts, exec, directory, remote
       "--no-install-recommends",
       "ca-certificates",
       "curl",
-      "unzip"
+      "busybox-static"
     ], "remote bootstrap prerequisites");
     const archive = await verifiedBunArchive(directory, options.fetch ?? fetch);
     await copy(exec, request, knownHosts, archive, `${remoteTemp}/bun.zip`);
     const digest = await remote(exec, request, knownHosts, ["/usr/bin/sha256sum", `${remoteTemp}/bun.zip`], "remote Bun checksum");
     if (digest.split(/\s+/)[0] !== BUN_RELEASE_SHA256)
       throw new Error("remote Bun checksum mismatch");
-    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/unzip", "-q", `${remoteTemp}/bun.zip`, "-d", `${remoteTemp}/bun-release`], "remote Bun unpack");
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/busybox", "unzip", "-o", "-q", `${remoteTemp}/bun.zip`, "-d", `${remoteTemp}/bun-release`], "remote Bun unpack");
+    if (!await remoteRegularFileExists(exec, request, knownHosts, `${remoteTemp}/bun-release/bun-linux-x64/bun`)) {
+      throw new Error("remote Bun unpack did not produce the pinned executable");
+    }
     await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/runtime", "/usr/local/bin"], "remote Bun directory");
-    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0755", `${remoteTemp}/bun-release/bun-linux-x64/bun`, "/usr/local/lib/forgezero/runtime/bun"], "remote Bun install");
+    await replaceRemoteFile(exec, request, knownHosts, `${remoteTemp}/bun-release/bun-linux-x64/bun`, "/usr/local/lib/forgezero/runtime/bun", "0755", "remote Bun install");
     await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun"], "remote Bun link");
   }
   await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/agent", REMOTE_STAGE], "remote Agent directories");
   for (const [, name] of artifacts)
-    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0755", `${remoteTemp}/${name}`, `/usr/local/lib/forgezero/agent/${name}`], "remote Agent install");
+    await replaceRemoteFile(exec, request, knownHosts, `${remoteTemp}/${name}`, `/usr/local/lib/forgezero/agent/${name}`, "0755", "remote Agent install");
   await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/agent/fz.js", "/usr/local/bin/fz"], "remote fz link");
   await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/agent/fz-agent.js", "/usr/local/bin/fz-agent"], "remote fz-agent link");
 }
@@ -18202,9 +18219,9 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     for (const bundle of staged.bundleFiles)
       await copy(exec, request, knownHosts, bundle.source, `${remoteTemp}/${bundle.name}`, true);
     for (const name of ["platform-config.json", ...staged.files])
-      await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0600", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap handoff", true);
+      await replaceRemoteFile(exec, request, knownHosts, `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`, "0600", "remote bootstrap handoff", true);
     for (const { name } of staged.bundleFiles)
-      await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0644", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap bundle", true);
+      await replaceRemoteFile(exec, request, knownHosts, `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`, "0644", "remote bootstrap bundle", true);
     const command = [
       "/usr/bin/sudo",
       "-n",
@@ -18290,7 +18307,7 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
     for (const name of staged.files)
       await copy(exec, request, knownHosts, join11(directory, name), `${remoteTemp}/${name}`, true);
     for (const name of ["metal-config.json", ...staged.files])
-      await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0600", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote metal handoff", true);
+      await replaceRemoteFile(exec, request, knownHosts, `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`, "0600", "remote metal handoff", true);
     const initialized = await remoteRegularFileExists(exec, request, knownHosts, "/etc/forgezero/metal.initialized.json");
     const output = await remote(exec, request, knownHosts, [
       "/usr/bin/sudo",

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.130";
+var VERSION = "0.1.132";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-helper-socket.js

@@ -975,9 +975,13 @@ function guestBootstrapOperations(profile, attested = Boolean(profile.confidenti
       "/run/forgezero-bun.zip"
     ],
     ["/usr/bin/sha256sum", "--check", "/etc/forgezero/bun.sha256"],
-    ["/usr/bin/unzip", "-q", "/run/forgezero-bun.zip", "-d", "/run/forgezero-bun"],
+    ["/usr/bin/busybox", "unzip", "-o", "-q", "/run/forgezero-bun.zip", "-d", "/run/forgezero-bun"],
     ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/runtime", agentBun],
-    ["/usr/bin/install", "-m", "0755", "/run/forgezero-bun/bun-linux-x64/bun", "/usr/local/lib/forgezero/runtime/bun"],
+    ["/usr/bin/rm", "-f", "--", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/cp", "--", "/run/forgezero-bun/bun-linux-x64/bun", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/chown", "root:root", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/chmod", "0755", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/mv", "-f", "--", "/usr/local/lib/forgezero/runtime/bun.forgezero-next", "/usr/local/lib/forgezero/runtime/bun"],
     ["/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun"],
     [
       "/usr/bin/env",
@@ -1035,7 +1039,7 @@ package_update: true
 ${users}disable_root: true
 # Git is part of the deployment transport, not a tenant-selected prerequisite:
 # every dynamically claimed repository must be cloneable on a clean image.
-packages: [curl, ca-certificates, openssl, openssh-client, git, unzip${claim.spec.confidential ? ", python3" : ""}]
+packages: [curl, ca-certificates, openssl, openssh-client, git, busybox-static${claim.spec.confidential ? ", python3" : ""}]
 write_files:
 ${enrolmentFiles}${attestationFile}${bunChecksum}runcmd:
 ${bootstrap.map((argv) => `  - ${JSON.stringify(argv)}`).join(`

package/dist/metal-provision.js

@@ -975,9 +975,13 @@ function guestBootstrapOperations(profile, attested = Boolean(profile.confidenti
       "/run/forgezero-bun.zip"
     ],
     ["/usr/bin/sha256sum", "--check", "/etc/forgezero/bun.sha256"],
-    ["/usr/bin/unzip", "-q", "/run/forgezero-bun.zip", "-d", "/run/forgezero-bun"],
+    ["/usr/bin/busybox", "unzip", "-o", "-q", "/run/forgezero-bun.zip", "-d", "/run/forgezero-bun"],
     ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/runtime", agentBun],
-    ["/usr/bin/install", "-m", "0755", "/run/forgezero-bun/bun-linux-x64/bun", "/usr/local/lib/forgezero/runtime/bun"],
+    ["/usr/bin/rm", "-f", "--", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/cp", "--", "/run/forgezero-bun/bun-linux-x64/bun", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/chown", "root:root", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/chmod", "0755", "/usr/local/lib/forgezero/runtime/bun.forgezero-next"],
+    ["/usr/bin/mv", "-f", "--", "/usr/local/lib/forgezero/runtime/bun.forgezero-next", "/usr/local/lib/forgezero/runtime/bun"],
     ["/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun"],
     [
       "/usr/bin/env",
@@ -1035,7 +1039,7 @@ package_update: true
 ${users}disable_root: true
 # Git is part of the deployment transport, not a tenant-selected prerequisite:
 # every dynamically claimed repository must be cloneable on a clean image.
-packages: [curl, ca-certificates, openssl, openssh-client, git, unzip${claim.spec.confidential ? ", python3" : ""}]
+packages: [curl, ca-certificates, openssl, openssh-client, git, busybox-static${claim.spec.confidential ? ", python3" : ""}]
 write_files:
 ${enrolmentFiles}${attestationFile}${bunChecksum}runcmd:
 ${bootstrap.map((argv) => `  - ${JSON.stringify(argv)}`).join(`

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.130";
+var VERSION = "0.1.132";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -7041,6 +7041,20 @@ var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
     return false;
   throw new Error(`remote initialized-state probe failed${result.output ? `: ${result.output.trim()}` : ""}`);
 };
+var replaceRemoteFile = async (exec, request, knownHosts, source, destinationPath, mode, label, secret = false) => {
+  const staged = `${destinationPath}.forgezero-next`;
+  try {
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/rm", "-f", "--", staged], label, secret);
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/cp", "--", source, staged], label, secret);
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/chown", "root:root", staged], label, secret);
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/chmod", mode, staged], label, secret);
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/mv", "-f", "--", staged, destinationPath], label, secret);
+  } finally {
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/rm", "-f", "--", staged], label, true).catch(() => {
+      return;
+    });
+  }
+};
 async function operatorMetalClusterBootstrapCode(requestInput, options = {}) {
   const request = validateMetalRequestValue(requestInput, { validateMetalConfig: false });
   publicIdentity(request.target.identityPublicKeyFile);
@@ -7333,21 +7347,24 @@ async function installPackagedAgent(request, knownHosts, exec, directory, remote
       "--no-install-recommends",
       "ca-certificates",
       "curl",
-      "unzip"
+      "busybox-static"
     ], "remote bootstrap prerequisites");
     const archive = await verifiedBunArchive(directory, options.fetch ?? fetch);
     await copy(exec, request, knownHosts, archive, `${remoteTemp}/bun.zip`);
     const digest = await remote(exec, request, knownHosts, ["/usr/bin/sha256sum", `${remoteTemp}/bun.zip`], "remote Bun checksum");
     if (digest.split(/\s+/)[0] !== BUN_RELEASE_SHA256)
       throw new Error("remote Bun checksum mismatch");
-    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/unzip", "-q", `${remoteTemp}/bun.zip`, "-d", `${remoteTemp}/bun-release`], "remote Bun unpack");
+    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/busybox", "unzip", "-o", "-q", `${remoteTemp}/bun.zip`, "-d", `${remoteTemp}/bun-release`], "remote Bun unpack");
+    if (!await remoteRegularFileExists(exec, request, knownHosts, `${remoteTemp}/bun-release/bun-linux-x64/bun`)) {
+      throw new Error("remote Bun unpack did not produce the pinned executable");
+    }
     await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/runtime", "/usr/local/bin"], "remote Bun directory");
-    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0755", `${remoteTemp}/bun-release/bun-linux-x64/bun`, "/usr/local/lib/forgezero/runtime/bun"], "remote Bun install");
+    await replaceRemoteFile(exec, request, knownHosts, `${remoteTemp}/bun-release/bun-linux-x64/bun`, "/usr/local/lib/forgezero/runtime/bun", "0755", "remote Bun install");
     await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun"], "remote Bun link");
   }
   await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/agent", REMOTE_STAGE], "remote Agent directories");
   for (const [, name] of artifacts)
-    await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0755", `${remoteTemp}/${name}`, `/usr/local/lib/forgezero/agent/${name}`], "remote Agent install");
+    await replaceRemoteFile(exec, request, knownHosts, `${remoteTemp}/${name}`, `/usr/local/lib/forgezero/agent/${name}`, "0755", "remote Agent install");
   await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/agent/fz.js", "/usr/local/bin/fz"], "remote fz link");
   await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/agent/fz-agent.js", "/usr/local/bin/fz-agent"], "remote fz-agent link");
 }
@@ -7381,9 +7398,9 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     for (const bundle of staged.bundleFiles)
       await copy(exec, request, knownHosts, bundle.source, `${remoteTemp}/${bundle.name}`, true);
     for (const name of ["platform-config.json", ...staged.files])
-      await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0600", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap handoff", true);
+      await replaceRemoteFile(exec, request, knownHosts, `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`, "0600", "remote bootstrap handoff", true);
     for (const { name } of staged.bundleFiles)
-      await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0644", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap bundle", true);
+      await replaceRemoteFile(exec, request, knownHosts, `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`, "0644", "remote bootstrap bundle", true);
     const command = [
       "/usr/bin/sudo",
       "-n",
@@ -7501,7 +7518,7 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
     for (const name of staged.files)
       await copy(exec, request, knownHosts, join6(directory, name), `${remoteTemp}/${name}`, true);
     for (const name of ["metal-config.json", ...staged.files])
-      await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0600", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote metal handoff", true);
+      await replaceRemoteFile(exec, request, knownHosts, `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`, "0600", "remote metal handoff", true);
     const initialized = await remoteRegularFileExists(exec, request, knownHosts, "/etc/forgezero/metal.initialized.json");
     const output = await remote(exec, request, knownHosts, [
       "/usr/bin/sudo",

package/dist/platform-fleet-verification.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.130";
+var VERSION3 = "0.1.132";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.130";
+var VERSION3 = "0.1.132";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.130";
+export declare const VERSION = "0.1.132";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.130",
+  "version": "0.1.132",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",