@forgezero/agent 0.1.136 → 0.1.137

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.136";
+var VERSION3 = "0.1.137";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.136";
+var VERSION = "0.1.137";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/fz-agent.js

@@ -9683,7 +9683,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.136";
+var VERSION2 = "0.1.137";
 
 // src/ssh-bootstrap.ts
 function deriveMetalAdmissionProvisioning(lscpu) {
@@ -10706,6 +10706,7 @@ var macForAddress = (address) => {
   }
   return `52:54:00:f0:${octets[2].toString(16).padStart(2, "0")}:${octets[3].toString(16).padStart(2, "0")}`;
 };
+var shouldCloseGuestMapper = (openedHere, active) => openedHere && active;
 function validateMetalProfile(profile) {
   if (!SAFE_NAME.test(profile.volumeGroup))
     throw new MetalProvisionError("invalid volume group");
@@ -11039,6 +11040,7 @@ async function provisionMetalGuest(profile, claim, exec) {
   const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
   const keyPath = `/run/forgezero/${credentialName}.key`;
   let imageTarget = lv;
+  let mapperOpenedHere = false;
   if (encrypted) {
     mkdirSync5(dirname5(credentialPath), { recursive: true, mode: 448 });
     mkdirSync5(dirname5(keyPath), { recursive: true, mode: 448 });
@@ -11079,6 +11081,7 @@ async function provisionMetalGuest(profile, claim, exec) {
       }
       if ((await exec(["cryptsetup", "status", mapper])).exitCode !== 0) {
         await checked2(exec, ["cryptsetup", "open", "--type", "luks2", "--key-file", keyPath, lv, mapper]);
+        mapperOpenedHere = true;
       }
       imageTarget = mappedDisk;
       if (manifest.phase === "allocating") {
@@ -11089,7 +11092,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     } finally {
       if (existsSync7(keyPath))
         unlinkSync5(keyPath);
-      if ((await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+      if (shouldCloseGuestMapper(mapperOpenedHere, (await exec(["cryptsetup", "status", mapper])).exitCode === 0)) {
         await checked2(exec, ["cryptsetup", "close", mapper]);
       }
     }

package/dist/fz.js

@@ -6007,7 +6007,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.136";
+var VERSION2 = "0.1.137";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.136";
+var VERSION = "0.1.137";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-helper-socket.js

@@ -833,6 +833,7 @@ var macForAddress = (address) => {
   }
   return `52:54:00:f0:${octets[2].toString(16).padStart(2, "0")}:${octets[3].toString(16).padStart(2, "0")}`;
 };
+var shouldCloseGuestMapper = (openedHere, active) => openedHere && active;
 function validateMetalProfile(profile) {
   if (!SAFE_NAME.test(profile.volumeGroup))
     throw new MetalProvisionError("invalid volume group");
@@ -1166,6 +1167,7 @@ async function provisionMetalGuest(profile, claim, exec) {
   const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
   const keyPath = `/run/forgezero/${credentialName}.key`;
   let imageTarget = lv;
+  let mapperOpenedHere = false;
   if (encrypted) {
     mkdirSync2(dirname2(credentialPath), { recursive: true, mode: 448 });
     mkdirSync2(dirname2(keyPath), { recursive: true, mode: 448 });
@@ -1206,6 +1208,7 @@ async function provisionMetalGuest(profile, claim, exec) {
       }
       if ((await exec(["cryptsetup", "status", mapper])).exitCode !== 0) {
         await checked(exec, ["cryptsetup", "open", "--type", "luks2", "--key-file", keyPath, lv, mapper]);
+        mapperOpenedHere = true;
       }
       imageTarget = mappedDisk;
       if (manifest.phase === "allocating") {
@@ -1216,7 +1219,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     } finally {
       if (existsSync2(keyPath))
         unlinkSync2(keyPath);
-      if ((await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+      if (shouldCloseGuestMapper(mapperOpenedHere, (await exec(["cryptsetup", "status", mapper])).exitCode === 0)) {
         await checked(exec, ["cryptsetup", "close", mapper]);
       }
     }

package/dist/metal-provision.d.ts

@@ -72,6 +72,8 @@ export declare const guestNameFor: (computeKey: string) => string;
 /** Linux interface names are capped at 15 bytes. */
 export declare const tapNameFor: (computeKey: string) => string;
 export declare const macForAddress: (address: string) => string;
+/** A reconciler may close only the transient mapper it opened itself. */
+export declare const shouldCloseGuestMapper: (openedHere: boolean, active: boolean) => boolean;
 export declare function validateMetalProfile(profile: MetalProvisionProfile): void;
 export declare function allocateAddress(profile: MetalProvisionProfile, computeKey: string, rows: GuestManifest[]): string;
 /** Stable tight-fit allocation of exact physical cores inside one NUMA-local pool. */

package/dist/metal-provision.js

@@ -833,6 +833,7 @@ var macForAddress = (address) => {
   }
   return `52:54:00:f0:${octets[2].toString(16).padStart(2, "0")}:${octets[3].toString(16).padStart(2, "0")}`;
 };
+var shouldCloseGuestMapper = (openedHere, active) => openedHere && active;
 function validateMetalProfile(profile) {
   if (!SAFE_NAME.test(profile.volumeGroup))
     throw new MetalProvisionError("invalid volume group");
@@ -1166,6 +1167,7 @@ async function provisionMetalGuest(profile, claim, exec) {
   const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
   const keyPath = `/run/forgezero/${credentialName}.key`;
   let imageTarget = lv;
+  let mapperOpenedHere = false;
   if (encrypted) {
     mkdirSync2(dirname2(credentialPath), { recursive: true, mode: 448 });
     mkdirSync2(dirname2(keyPath), { recursive: true, mode: 448 });
@@ -1206,6 +1208,7 @@ async function provisionMetalGuest(profile, claim, exec) {
       }
       if ((await exec(["cryptsetup", "status", mapper])).exitCode !== 0) {
         await checked(exec, ["cryptsetup", "open", "--type", "luks2", "--key-file", keyPath, lv, mapper]);
+        mapperOpenedHere = true;
       }
       imageTarget = mappedDisk;
       if (manifest.phase === "allocating") {
@@ -1216,7 +1219,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     } finally {
       if (existsSync2(keyPath))
         unlinkSync2(keyPath);
-      if ((await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+      if (shouldCloseGuestMapper(mapperOpenedHere, (await exec(["cryptsetup", "status", mapper])).exitCode === 0)) {
         await checked(exec, ["cryptsetup", "close", mapper]);
       }
     }
@@ -1388,6 +1391,7 @@ async function removeMetalGuest(profile, claim, exec) {
 export {
   validateMetalProfile,
   tapNameFor,
+  shouldCloseGuestMapper,
   removeMetalGuest,
   provisionMetalGuest,
   macForAddress,

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.136";
+var VERSION = "0.1.137";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-fleet-verification.js

@@ -3049,7 +3049,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.136";
+var VERSION3 = "0.1.137";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3049,7 +3049,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.136";
+var VERSION3 = "0.1.137";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.136";
+export declare const VERSION = "0.1.137";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.136",
+  "version": "0.1.137",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",