@forgezero/agent 0.1.135 → 0.1.137

package/dist/fz-agent.js

@@ -2,8 +2,8 @@
 // @bun
 
 // src/index.ts
-import { randomBytes as randomBytes7 } from "crypto";
-import { readFileSync as readFileSync20, writeFileSync as writeFileSync18, existsSync as existsSync23, mkdirSync as mkdirSync18, chmodSync as chmodSync19, lstatSync as lstatSync10, statfsSync as statfsSync3 } from "fs";
+import { randomBytes as randomBytes8 } from "crypto";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync18, existsSync as existsSync23, mkdirSync as mkdirSync18, chmodSync as chmodSync20, lstatSync as lstatSync10, statfsSync as statfsSync3 } from "fs";
 import { cpus as cpus3, totalmem as totalmem3 } from "os";
 import { dirname as dirname16, join as join12 } from "path";
 
@@ -7218,11 +7218,13 @@ function compileDeployment(sourceValue) {
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
       const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
-      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "diskEncryption", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
       integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
       integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
       integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
       integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      if (provisionedResources.diskEncryption !== undefined && !["none", "luks2"].includes(String(provisionedResources.diskEncryption)))
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.diskEncryption`, "must be none or luks2.");
       integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
       integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
       if (typeof provisionedResources.confidential !== "boolean")
@@ -9681,7 +9683,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.135";
+var VERSION2 = "0.1.137";
 
 // src/ssh-bootstrap.ts
 function deriveMetalAdmissionProvisioning(lscpu) {
@@ -10491,12 +10493,13 @@ function startMetalAdmissionPull(options) {
 }
 
 // src/metal-helper-socket.ts
-import { chmodSync as chmodSync8, existsSync as existsSync8, unlinkSync as unlinkSync6 } from "fs";
+import { chmodSync as chmodSync9, existsSync as existsSync8, unlinkSync as unlinkSync6 } from "fs";
 import { connect as connect2, createServer as createServer3 } from "net";
 
 // src/metal-provision.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash7, randomBytes as randomBytes6 } from "crypto";
 import {
+  chmodSync as chmodSync8,
   existsSync as existsSync7,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync6,
@@ -10560,6 +10563,10 @@ function guestUnit(spec) {
     `ExecStopPost=-/usr/sbin/ip link del ${spec.tap}`
   ].join(`
 `) : "";
+  const encryptedDisk = spec.diskEncryption ? `LoadCredentialEncrypted=${spec.diskEncryption.credentialName}:${spec.diskEncryption.credentialPath}
+ExecStartPre=/usr/sbin/cryptsetup open --type luks2 --key-file %d/${spec.diskEncryption.credentialName} ${spec.diskEncryption.source} ${spec.diskEncryption.mapper}
+ExecStopPost=-/usr/sbin/cryptsetup close ${spec.diskEncryption.mapper}
+` : "";
   return `[Unit]
 Description=ForgeZero guest ${spec.name}
 Documentation=https://www.forgezero.net
@@ -10569,7 +10576,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 Slice=forgezero-guests.slice
-${tapSetup}
+${encryptedDisk}${tapSetup}
 ExecStart=${argv2}
 Restart=always
 RestartSec=5
@@ -10699,6 +10706,7 @@ var macForAddress = (address) => {
   }
   return `52:54:00:f0:${octets[2].toString(16).padStart(2, "0")}:${octets[3].toString(16).padStart(2, "0")}`;
 };
+var shouldCloseGuestMapper = (openedHere, active) => openedHere && active;
 function validateMetalProfile(profile) {
   if (!SAFE_NAME.test(profile.volumeGroup))
     throw new MetalProvisionError("invalid volume group");
@@ -10860,6 +10868,8 @@ function guestBootstrapOperations(profile, attested = Boolean(profile.confidenti
   validateMetalProfile(profile);
   const agentBun = "/usr/local/lib/forgezero/bun";
   return [
+    ["/usr/sbin/swapoff", "--all"],
+    ["/usr/bin/systemctl", "mask", "--now", "swap.target"],
     ...attested ? [
       ["/usr/sbin/modprobe", "sev-guest"],
       ["/usr/bin/test", "-c", "/dev/sev-guest"]
@@ -10936,6 +10946,7 @@ ${access.sshPublicKeys.map((key) => `      - ${JSON.stringify(key)}`).join(`
   return {
     userData: `#cloud-config
 package_update: true
+swap: { size: 0 }
 ${users}disable_root: true
 # Git is part of the deployment transport, not a tenant-selected prerequisite:
 # every dynamically claimed repository must be cloneable on a clean image.
@@ -10968,7 +10979,8 @@ var checked2 = async (exec, argv2) => {
 async function provisionMetalGuest(profile, claim, exec) {
   validateMetalProfile(profile);
   assertSupportedGuestImage(claim.spec.imageKey, claim.spec.confidential);
-  if (!claim.computeKey || !claim.spec.reference || !SAFE_NAME.test(claim.spec.imageKey) || claim.spec.guestName !== undefined && !SAFE_NAME.test(claim.spec.guestName) || claim.spec.cpuPoolKey !== undefined && !SAFE_NAME.test(claim.spec.cpuPoolKey) || !Number.isInteger(claim.spec.physicalCores) || claim.spec.physicalCores < 1 || claim.spec.physicalCores > 256 || !Number.isInteger(claim.spec.vcpu) || claim.spec.vcpu < 1 || claim.spec.vcpu > 512 || !Number.isInteger(claim.spec.memoryGib) || claim.spec.memoryGib < 1 || claim.spec.memoryGib > 8192 || !Number.isInteger(claim.spec.diskGib) || claim.spec.diskGib < 8 || claim.spec.diskGib > 65536 || !Number.isInteger(claim.spec.egressGuaranteedMbps) || claim.spec.egressGuaranteedMbps < 0 || !Number.isInteger(claim.spec.egressBurstMbps) || claim.spec.egressBurstMbps < claim.spec.egressGuaranteedMbps)
+  const diskEncryption = claim.spec.diskEncryption ?? "none";
+  if (!claim.computeKey || !claim.spec.reference || !SAFE_NAME.test(claim.spec.imageKey) || claim.spec.guestName !== undefined && !SAFE_NAME.test(claim.spec.guestName) || claim.spec.cpuPoolKey !== undefined && !SAFE_NAME.test(claim.spec.cpuPoolKey) || !Number.isInteger(claim.spec.physicalCores) || claim.spec.physicalCores < 1 || claim.spec.physicalCores > 256 || !Number.isInteger(claim.spec.vcpu) || claim.spec.vcpu < 1 || claim.spec.vcpu > 512 || !Number.isInteger(claim.spec.memoryGib) || claim.spec.memoryGib < 1 || claim.spec.memoryGib > 8192 || !Number.isInteger(claim.spec.diskGib) || claim.spec.diskGib < 8 || claim.spec.diskGib > 65536 || !["none", "luks2"].includes(diskEncryption) || !Number.isInteger(claim.spec.egressGuaranteedMbps) || claim.spec.egressGuaranteedMbps < 0 || !Number.isInteger(claim.spec.egressBurstMbps) || claim.spec.egressBurstMbps < claim.spec.egressGuaranteedMbps)
     throw new MetalProvisionError("invalid compute claim");
   const image = profile.images[claim.spec.imageKey];
   if (!image || !isAbsolute3(image.path) || !SHA256.test(image.sha256)) {
@@ -10997,6 +11009,9 @@ async function provisionMetalGuest(profile, claim, exec) {
   const prior = manifests.find((row2) => row2.computeKey === claim.computeKey);
   if (prior && prior.reference !== claim.spec.reference)
     throw new MetalProvisionError("compute identity conflicts with host inventory");
+  if (prior && (prior.diskEncryption ?? "none") !== diskEncryption) {
+    throw new MetalProvisionError("an allocated guest disk encryption mode is immutable");
+  }
   const address = requestedAddress(profile, claim, manifests);
   const cpuPool = allocateCpuPool(profile, claim, manifests);
   const manifest = prior ?? {
@@ -11008,6 +11023,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     cpuPoolKey: cpuPool.key,
     allowedCpus: cpuPool.cpus,
     allowedMemoryNodes: cpuPool.memoryNodes,
+    diskEncryption,
     phase: "allocating"
   };
   const save = () => writeFileSync6(manifestPath, `${JSON.stringify(manifest, null, 2)}
@@ -11017,8 +11033,72 @@ async function provisionMetalGuest(profile, claim, exec) {
   const exists = (await exec(["lvs", "--noheadings", lv])).exitCode === 0;
   if (!exists)
     await checked2(exec, ["lvcreate", "-y", "-n", name, "-L", `${claim.spec.diskGib}G`, profile.volumeGroup]);
+  const encrypted = diskEncryption === "luks2";
+  const mapper = `fz-${createHash7("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const mappedDisk = `/dev/mapper/${mapper}`;
+  const credentialName = `guest-disk-${createHash7("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
+  const keyPath = `/run/forgezero/${credentialName}.key`;
+  let imageTarget = lv;
+  let mapperOpenedHere = false;
+  if (encrypted) {
+    mkdirSync5(dirname5(credentialPath), { recursive: true, mode: 448 });
+    mkdirSync5(dirname5(keyPath), { recursive: true, mode: 448 });
+    if (existsSync7(keyPath))
+      unlinkSync5(keyPath);
+    if (!existsSync7(credentialPath)) {
+      if (exists && (await exec(["cryptsetup", "isLuks", lv])).exitCode === 0) {
+        throw new MetalProvisionError("encrypted guest disk exists without its sealed unlock credential");
+      }
+      writeFileSync6(keyPath, randomBytes6(64), { mode: 384, flag: "wx" });
+      try {
+        await checked2(exec, ["systemd-creds", "encrypt", `--name=${credentialName}`, keyPath, credentialPath]);
+        chmodSync8(credentialPath, 384);
+      } catch (cause) {
+        if (existsSync7(credentialPath))
+          unlinkSync5(credentialPath);
+        throw cause;
+      }
+    } else {
+      await checked2(exec, ["systemd-creds", "decrypt", `--name=${credentialName}`, credentialPath, keyPath]);
+    }
+    try {
+      if ((await exec(["cryptsetup", "isLuks", lv])).exitCode !== 0) {
+        await checked2(exec, [
+          "cryptsetup",
+          "luksFormat",
+          "--batch-mode",
+          "--type",
+          "luks2",
+          "--cipher",
+          "aes-xts-plain64",
+          "--key-size",
+          "512",
+          "--key-file",
+          keyPath,
+          lv
+        ]);
+      }
+      if ((await exec(["cryptsetup", "status", mapper])).exitCode !== 0) {
+        await checked2(exec, ["cryptsetup", "open", "--type", "luks2", "--key-file", keyPath, lv, mapper]);
+        mapperOpenedHere = true;
+      }
+      imageTarget = mappedDisk;
+      if (manifest.phase === "allocating") {
+        await checked2(exec, ["qemu-img", "convert", "-O", "raw", image.path, imageTarget]);
+        manifest.phase = "image-ready";
+        save();
+      }
+    } finally {
+      if (existsSync7(keyPath))
+        unlinkSync5(keyPath);
+      if (shouldCloseGuestMapper(mapperOpenedHere, (await exec(["cryptsetup", "status", mapper])).exitCode === 0)) {
+        await checked2(exec, ["cryptsetup", "close", mapper]);
+      }
+    }
+  }
   if (manifest.phase === "allocating") {
-    await checked2(exec, ["qemu-img", "convert", "-O", "raw", image.path, lv]);
+    await checked2(exec, ["qemu-img", "convert", "-O", "raw", image.path, imageTarget]);
     manifest.phase = "image-ready";
     save();
   }
@@ -11042,7 +11122,8 @@ async function provisionMetalGuest(profile, claim, exec) {
     memoryGib: claim.spec.memoryGib,
     allowedCpus: manifest.allowedCpus,
     allowedMemoryNodes: manifest.allowedMemoryNodes,
-    disk: lv,
+    disk: encrypted ? mappedDisk : lv,
+    ...encrypted ? { diskEncryption: { source: lv, mapper, credentialName, credentialPath } } : {},
     seed,
     bridge: profile.bridge,
     mac: manifest.mac,
@@ -11100,6 +11181,7 @@ function legacyPlatformManifest(profile, claim, name) {
     cpuPoolKey: claim.spec.cpuPoolKey ?? "",
     allowedCpus: values.get("CPUSET") ?? "",
     allowedMemoryNodes: values.get("NUMA"),
+    diskEncryption: "none",
     phase: "running",
     disk,
     unit: `forgezero-guest@${name}.service`
@@ -11114,6 +11196,9 @@ async function removeMetalGuest(profile, claim, exec) {
   const service = `forgezero-guest@${name}.service`;
   const unitPath = join4(profile.unitDir, service);
   const lv = `/dev/${profile.volumeGroup}/${name}`;
+  const mapper = `fz-${createHash7("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const credentialName = `guest-disk-${createHash7("sha256").update(claim.computeKey).digest("hex").slice(0, 20)}`;
+  const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
   const manifest = existsSync7(manifestPath) ? JSON.parse(readFileSync6(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
   if (!manifest) {
     const seedBase = join4(profile.seedDir, name);
@@ -11148,9 +11233,14 @@ async function removeMetalGuest(profile, claim, exec) {
   else if ((await exec(["systemctl", "is-active", service])).exitCode === 0) {
     throw new MetalProvisionError("guest unit is active but its owned unit file is missing");
   }
+  const encrypted = (manifest.diskEncryption ?? "none") === "luks2";
+  if (encrypted && (await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+    throw new MetalProvisionError("guest disk mapping remained active after the guest stopped");
+  }
   if ((await exec(["lvs", "--noheadings", lv])).exitCode === 0)
     await checked2(exec, ["lvremove", "-fy", lv]);
   for (const path2 of [
+    ...encrypted ? [credentialPath] : [],
     unitPath,
     join4(profile.seedDir, `${name}-seed.iso`),
     join4(profile.seedDir, `${name}-user-data`),
@@ -11251,7 +11341,7 @@ function startMetalHelper(options) {
     });
     socket.on("error", () => socket.destroy());
   });
-  server.listen(socketPath, () => chmodSync8(socketPath, 432));
+  server.listen(socketPath, () => chmodSync9(socketPath, 432));
   return {
     server,
     async stop() {
@@ -11291,7 +11381,7 @@ function requestMetalProvision(claim, socketPath = DEFAULT_METAL_HELPER_SOCKET)
 }
 
 // src/deployment-runner.ts
-import { chmodSync as chmodSync9, existsSync as existsSync9, realpathSync, unlinkSync as unlinkSync7 } from "fs";
+import { chmodSync as chmodSync10, existsSync as existsSync9, realpathSync, unlinkSync as unlinkSync7 } from "fs";
 import { isAbsolute as isAbsolute4, resolve, sep } from "path";
 import { connect as connect3, createServer as createServer4 } from "net";
 var DEFAULT_DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
@@ -11453,7 +11543,7 @@ function startDeploymentRunner(options) {
   const ready = new Promise((resolveReady, rejectReady) => {
     server.once("error", rejectReady);
     server.listen(socketPath, () => {
-      chmodSync9(socketPath, options.socketMode ?? 432);
+      chmodSync10(socketPath, options.socketMode ?? 432);
       server.off("error", rejectReady);
       resolveReady();
     });
@@ -11805,7 +11895,7 @@ async function closeServerWithin(server, timeoutMs) {
 }
 
 // src/lifecycle-helper.ts
-import { chmodSync as chmodSync10, existsSync as existsSync11, readFileSync as readFileSync7, unlinkSync as unlinkSync8 } from "fs";
+import { chmodSync as chmodSync11, existsSync as existsSync11, readFileSync as readFileSync7, unlinkSync as unlinkSync8 } from "fs";
 import { connect as connect4, createConnection, createServer as createServer5, isIP as isIP3 } from "net";
 var DEFAULT_LIFECYCLE_HELPER_SOCKET = "/run/forgezero-lifecycle/helper.sock";
 var MAX_REQUEST_BYTES4 = 16 * 1024;
@@ -11987,7 +12077,7 @@ function startLifecycleHelper(options) {
     });
     socket.on("error", () => socket.destroy());
   });
-  server.listen(socketPath, () => chmodSync10(socketPath, 432));
+  server.listen(socketPath, () => chmodSync11(socketPath, 432));
   return {
     server,
     async stop() {
@@ -12027,7 +12117,7 @@ function requestLifecycleAction(claim, socketPath = DEFAULT_LIFECYCLE_HELPER_SOC
 }
 
 // src/warp-config.ts
-import { chmodSync as chmodSync11, mkdirSync as mkdirSync7, renameSync as renameSync6, symlinkSync as symlinkSync3, unlinkSync as unlinkSync9, writeFileSync as writeFileSync8 } from "fs";
+import { chmodSync as chmodSync12, mkdirSync as mkdirSync7, renameSync as renameSync6, symlinkSync as symlinkSync3, unlinkSync as unlinkSync9, writeFileSync as writeFileSync8 } from "fs";
 var xml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 function renderWarpMdm(options) {
   if (!/^[a-z0-9][a-z0-9-]{0,62}$/i.test(options.organization))
@@ -12052,7 +12142,7 @@ function materializeWarpMdm(options) {
   mkdirSync7(servicePath.replace(/\/[^/]+$/, ""), { recursive: true, mode: 448 });
   const next = `${runtimePath}.next`;
   writeFileSync8(next, renderWarpMdm(options), { mode: 384 });
-  chmodSync11(next, 384);
+  chmodSync12(next, 384);
   renameSync6(next, runtimePath);
   try {
     unlinkSync9(servicePath);
@@ -12110,7 +12200,7 @@ async function configureMeshConnector(input) {
 // src/agent-update.ts
 import { createHash as createHash8, timingSafeEqual, randomUUID as randomUUID2 } from "crypto";
 import {
-  chmodSync as chmodSync12,
+  chmodSync as chmodSync13,
   closeSync as closeSync2,
   existsSync as existsSync12,
   fsyncSync,
@@ -12204,8 +12294,8 @@ var checked4 = async (run2, input, label) => {
   return result;
 };
 async function validateReleaseDirectory(directory, release, run2) {
-  chmodSync12(directory, 493);
-  chmodSync12(join7(directory, "dist"), 493);
+  chmodSync13(directory, 493);
+  chmodSync13(join7(directory, "dist"), 493);
   const manifest = JSON.parse(readFileSync9(join7(directory, "package.json"), "utf8"));
   if (manifest.name !== release.package || manifest.version !== release.version) {
     throw new Error("agent update manifest does not match the selected release");
@@ -12218,7 +12308,7 @@ async function validateReleaseDirectory(directory, release, run2) {
 `)) {
       throw new Error("agent update artifact is not a self-contained Bun executable");
     }
-    chmodSync12(binary, 493);
+    chmodSync13(binary, 493);
   }
   const version = (await checked4(run2, { command: agent, args: ["--version"] }, "agent update smoke test")).output.trim();
   if (version !== release.version)
@@ -12337,7 +12427,7 @@ function clearAgentCandidate(root = DEFAULT_AGENT_RELEASE_ROOT) {
 // src/agent-update-helper.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import {
-  chmodSync as chmodSync14,
+  chmodSync as chmodSync15,
   closeSync as closeSync3,
   existsSync as existsSync14,
   fsyncSync as fsyncSync2,
@@ -12354,7 +12444,7 @@ import { dirname as dirname8, join as join8, resolve as resolve3 } from "path";
 
 // src/agent-handover.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { chmodSync as chmodSync13, existsSync as existsSync13, renameSync as renameSync8, rmSync as rmSync6, symlinkSync as symlinkSync5, unlinkSync as unlinkSync10 } from "fs";
+import { chmodSync as chmodSync14, existsSync as existsSync13, renameSync as renameSync8, rmSync as rmSync6, symlinkSync as symlinkSync5, unlinkSync as unlinkSync10 } from "fs";
 import { basename as basename2, dirname as dirname7 } from "path";
 import { connect as connect5, createServer as createServer6 } from "net";
 var DEFAULT_AGENT_CANDIDATE_READY_SOCKET = "/run/forgezero/candidate-ready.sock";
@@ -12375,7 +12465,7 @@ function startAgentCandidateReady(ready, socketPath = DEFAULT_AGENT_CANDIDATE_RE
     unlinkSync10(socketPath);
   const server = createServer6((socket) => socket.end(`${JSON.stringify(ready)}
 `));
-  server.listen(socketPath, () => chmodSync13(socketPath, 432));
+  server.listen(socketPath, () => chmodSync14(socketPath, 432));
   return server;
 }
 function probeAgentCandidate(expected, socketPath = DEFAULT_AGENT_CANDIDATE_READY_SOCKET, timeoutMs = 5000) {
@@ -12928,7 +13018,7 @@ function startAgentUpdateHelper(options = {}) {
     });
     socket.on("error", () => socket.destroy());
   });
-  server.listen(socketPath, () => chmodSync14(socketPath, 432));
+  server.listen(socketPath, () => chmodSync15(socketPath, 432));
   return server;
 }
 function requestAgentUpdate(request, socketPath = DEFAULT_AGENT_UPDATE_SOCKET, timeoutMs = 90000) {
@@ -13145,7 +13235,7 @@ function startAgentHeartbeat(options) {
 }
 
 // src/software-helper.ts
-import { chmodSync as chmodSync15, existsSync as existsSync18, mkdirSync as mkdirSync13, unlinkSync as unlinkSync12 } from "fs";
+import { chmodSync as chmodSync16, existsSync as existsSync18, mkdirSync as mkdirSync13, unlinkSync as unlinkSync12 } from "fs";
 import { connect as connect7, createServer as createServer8 } from "net";
 import { dirname as dirname12 } from "path";
 
@@ -14133,7 +14223,7 @@ function startSoftwareHelper(options = {}) {
     });
     socket.on("error", () => socket.destroy());
   });
-  server.listen(socketPath, () => chmodSync15(socketPath, 432));
+  server.listen(socketPath, () => chmodSync16(socketPath, 432));
   return server;
 }
 function requestContainer(op, request, socketPath, timeoutMs) {
@@ -15218,7 +15308,7 @@ var METAL_SYSTEMD_CREDENTIALS = {
 
 // src/platform-bootstrap-runtime.ts
 import {
-  chmodSync as chmodSync16,
+  chmodSync as chmodSync17,
   chownSync,
   copyFileSync as copyFileSync2,
   existsSync as existsSync19,
@@ -15317,7 +15407,7 @@ var secureRelease = (path2, uid, gid) => {
     if (metadata.isSymbolicLink())
       return;
     chownSync(current2, uid, gid);
-    chmodSync16(current2, metadata.isDirectory() ? 365 : 292);
+    chmodSync17(current2, metadata.isDirectory() ? 365 : 292);
     if (metadata.isDirectory())
       for (const name of readdirSync4(current2))
         visit(join10(current2, name));
@@ -15558,7 +15648,7 @@ import { lstatSync as lstatSync7 } from "fs";
 
 // src/bootstrap.ts
 import {
-  chmodSync as chmodSync18,
+  chmodSync as chmodSync19,
   existsSync as existsSync22,
   lstatSync as lstatSync6,
   mkdirSync as mkdirSync16,
@@ -16559,9 +16649,9 @@ function planProvision(options) {
 }
 
 // src/cli/agent-install.ts
-import { randomBytes as randomBytes6 } from "crypto";
+import { randomBytes as randomBytes7 } from "crypto";
 import {
-  chmodSync as chmodSync17,
+  chmodSync as chmodSync18,
   copyFileSync as copyFileSync3,
   existsSync as existsSync21,
   lstatSync as lstatSync5,
@@ -16652,12 +16742,12 @@ var runProvisionOperation = async (operation) => {
     mkdirSync15(`${release}/dist`, { recursive: true, mode: 493 });
     mkdirSync15(dirname13(operation.binary), { recursive: true, mode: 493 });
     copyFileSync3(operation.source, `${release}/dist/fz-agent.js`);
-    chmodSync17(`${release}/dist/fz-agent.js`, 493);
+    chmodSync18(`${release}/dist/fz-agent.js`, 493);
     const gitSshSource = `${dirname13(operation.source)}/fz-git-ssh.js`;
     if (!existsSync21(gitSshSource))
       return { stdout: "packaged fz-git-ssh.js is missing", exitCode: 1 };
     copyFileSync3(gitSshSource, `${release}/dist/fz-git-ssh.js`);
-    chmodSync17(`${release}/dist/fz-git-ssh.js`, 493);
+    chmodSync18(`${release}/dist/fz-git-ssh.js`, 493);
     const pending = "/opt/forgezero/agent/current.next";
     rmSync11(pending, { force: true });
     symlinkSync7(`versions/${operation.version}`, pending);
@@ -16672,10 +16762,10 @@ var runProvisionOperation = async (operation) => {
   if (operation.kind === "ensure-seed") {
     if (existsSync21(operation.credential) && lstatSync5(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    const seed = randomBytes6(32).toString("base64url");
+    const seed = randomBytes7(32).toString("base64url");
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
     if (result.exitCode === 0)
-      chmodSync17(operation.credential, 256);
+      chmodSync18(operation.credential, 256);
     return result;
   }
   if (operation.kind === "ensure-git-identity") {
@@ -16691,7 +16781,7 @@ var runProvisionOperation = async (operation) => {
         result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=git-deploy-key", key, operation.credential]);
         if (result.exitCode !== 0)
           return result;
-        chmodSync17(operation.credential, 256);
+        chmodSync18(operation.credential, 256);
       }
       if (!existsSync21(operation.publicKey) || lstatSync5(operation.publicKey).size < 1) {
         if (!existsSync21(key)) {
@@ -16725,7 +16815,7 @@ var runProvisionOperation = async (operation) => {
             return { stdout: "bootstrap SSH private-key source is missing or unsafe", exitCode: 1 };
           }
           copyFileSync3(operation.source, key);
-          chmodSync17(key, 384);
+          chmodSync18(key, 384);
         } else {
           result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-bootstrap-runner", "-f", key]);
           if (result.exitCode !== 0)
@@ -16738,14 +16828,14 @@ var runProvisionOperation = async (operation) => {
         result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=bootstrap-ssh-key", key, operation.credential]);
         if (result.exitCode !== 0)
           return result;
-        chmodSync17(operation.credential, 256);
+        chmodSync18(operation.credential, 256);
       }
       if (!existsSync21(operation.publicKey) || lstatSync5(operation.publicKey).size < 1) {
         if (!existsSync21(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=bootstrap-ssh-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
-          chmodSync17(key, 384);
+          chmodSync18(key, 384);
         }
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
         const publicKey = normalizeEd25519PublicKey(derived.stdout);
@@ -16755,7 +16845,7 @@ var runProvisionOperation = async (operation) => {
         mkdirSync15(dirname13(operation.publicKey), { recursive: true, mode: 493 });
         writeFileSync15(operation.publicKey, `${publicKey} forgezero-bootstrap-runner
 `, { mode: 292 });
-        chmodSync17(operation.publicKey, 292);
+        chmodSync18(operation.publicKey, 292);
       }
       if (operation.source)
         rmSync11(operation.source, { force: true });
@@ -16772,7 +16862,7 @@ var runProvisionOperation = async (operation) => {
       return { stdout: "enrolment source is missing", exitCode: 1 };
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=enrol-token", operation.source, operation.credential]);
     if (result.exitCode === 0) {
-      chmodSync17(operation.credential, 256);
+      chmodSync18(operation.credential, 256);
       rmSync11(operation.source, { force: true });
     }
     return result;
@@ -17158,7 +17248,7 @@ function localBootstrapHost() {
       mkdirSync16(dirname14(path2), { recursive: true, mode: 493 });
       const temporary = `${path2}.next.${process.pid}`;
       writeFileSync16(temporary, content, { mode });
-      chmodSync18(temporary, mode);
+      chmodSync19(temporary, mode);
       renameSync15(temporary, path2);
     },
     mkdir: (path2, mode) => mkdirSync16(path2, { recursive: true, mode }),
@@ -18034,9 +18124,9 @@ function loadOrCreateSeed(path2) {
     return seed2;
   }
   mkdirSync18(dirname16(path2), { recursive: true });
-  const seed = new Uint8Array(randomBytes7(32));
+  const seed = new Uint8Array(randomBytes8(32));
   writeFileSync18(path2, Buffer.from(seed).toString("base64url"), { mode: 384 });
-  chmodSync19(path2, 384);
+  chmodSync20(path2, 384);
   return seed;
 }
 var DEFAULT_SOCKET_PATH = DEFAULT_SOCKET;