@forgezero/agent 0.1.136 → 0.1.138

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.136";
+var VERSION3 = "0.1.138";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/attended-platform-bootstrap.d.ts

@@ -12,8 +12,14 @@ export interface AttendedPlatformBootstrapResult {
 export interface AttendedPlatformBootstrapDependencies {
     cloudflare?: typeof runAttendedCloudflareBootstrap;
     fleet?: typeof applyOperatorPlatformFleetBootstrap;
+    validateInvite?: typeof validatePlatformInvitation;
     finalize?: typeof finalizeCloudflareBootstrapAcceptance;
 }
+export declare function validatePlatformInvitation(args: {
+    apiOrigin: string;
+    inviteUrl: string;
+    fetcher?: typeof fetch;
+}): Promise<void>;
 /**
  * The sole attended genesis composition boundary. All non-secret coordinates
  * are checked before the first Cloudflare or SSH mutation. Secret values exist

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.136";
+var VERSION = "0.1.138";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/fz-agent.js

@@ -9683,7 +9683,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.136";
+var VERSION2 = "0.1.138";
 
 // src/ssh-bootstrap.ts
 function deriveMetalAdmissionProvisioning(lscpu) {
@@ -10706,6 +10706,7 @@ var macForAddress = (address) => {
   }
   return `52:54:00:f0:${octets[2].toString(16).padStart(2, "0")}:${octets[3].toString(16).padStart(2, "0")}`;
 };
+var shouldCloseGuestMapper = (openedHere, active) => openedHere && active;
 function validateMetalProfile(profile) {
   if (!SAFE_NAME.test(profile.volumeGroup))
     throw new MetalProvisionError("invalid volume group");
@@ -11039,6 +11040,7 @@ async function provisionMetalGuest(profile, claim, exec) {
   const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
   const keyPath = `/run/forgezero/${credentialName}.key`;
   let imageTarget = lv;
+  let mapperOpenedHere = false;
   if (encrypted) {
     mkdirSync5(dirname5(credentialPath), { recursive: true, mode: 448 });
     mkdirSync5(dirname5(keyPath), { recursive: true, mode: 448 });
@@ -11079,6 +11081,7 @@ async function provisionMetalGuest(profile, claim, exec) {
       }
       if ((await exec(["cryptsetup", "status", mapper])).exitCode !== 0) {
         await checked2(exec, ["cryptsetup", "open", "--type", "luks2", "--key-file", keyPath, lv, mapper]);
+        mapperOpenedHere = true;
       }
       imageTarget = mappedDisk;
       if (manifest.phase === "allocating") {
@@ -11089,7 +11092,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     } finally {
       if (existsSync7(keyPath))
         unlinkSync5(keyPath);
-      if ((await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+      if (shouldCloseGuestMapper(mapperOpenedHere, (await exec(["cryptsetup", "status", mapper])).exitCode === 0)) {
         await checked2(exec, ["cryptsetup", "close", mapper]);
       }
     }
@@ -15429,7 +15432,17 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const slots = join10(normalized.root, "slots");
   mkdirSync14(slots, { recursive: true, mode: 493 });
   const slotFile = join10(slots, ".active");
-  const previousSlot = existsSync19(slotFile) ? readFileSync14(slotFile, "utf8").trim() : undefined;
+  let previousSlot = existsSync19(slotFile) ? readFileSync14(slotFile, "utf8").trim() : undefined;
+  if (previousSlot !== "blue" && previousSlot !== "green") {
+    previousSlot = undefined;
+    for (const candidate of ["blue", "green"]) {
+      const active = await exec(["/usr/bin/systemctl", "is-active", "--quiet", `forgezero@${candidate}.service`]);
+      if (active.exitCode === 0) {
+        previousSlot = candidate;
+        break;
+      }
+    }
+  }
   const target2 = previousSlot === "blue" ? "green" : "blue";
   const port = target2 === "blue" ? normalized.bluePort : normalized.greenPort;
   const targetLink = join10(slots, target2);
@@ -15462,6 +15475,8 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const stopTarget = async () => {
     await exec(["/usr/bin/systemctl", "stop", service]);
     replaceLink(targetLink, previousTarget);
+    if (previousSlot)
+      await exec(["/usr/bin/systemctl", "start", `forgezero@${previousSlot}.service`]);
   };
   if (!healthy) {
     await stopTarget();

package/dist/fz.js

@@ -6007,7 +6007,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.136";
+var VERSION2 = "0.1.138";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -18401,6 +18401,35 @@ var invitationFrom = (fleet, master) => {
   } catch {}
   throw new Error("platform bootstrap completed without the initial custodian invitation");
 };
+async function validatePlatformInvitation(args) {
+  let invite;
+  let api;
+  try {
+    invite = new URL(args.inviteUrl);
+    api = new URL(args.apiOrigin);
+  } catch {
+    throw new Error("platform bootstrap produced malformed public invitation coordinates");
+  }
+  const token = invite.searchParams.get("token") ?? "";
+  if (invite.protocol !== "https:" || api.protocol !== "https:" || !/^plt_[a-f0-9]{48}$/.test(token)) {
+    throw new Error("platform bootstrap produced malformed public invitation coordinates");
+  }
+  const endpoint2 = new URL(`/api/onboarding/invite/${encodeURIComponent(token)}`, api);
+  let response;
+  try {
+    response = await (args.fetcher ?? fetch)(endpoint2, {
+      headers: { accept: "application/json" },
+      cache: "no-store",
+      signal: AbortSignal.timeout(15000)
+    });
+  } catch {
+    throw new Error("platform bootstrap invitation could not be verified through public ingress");
+  }
+  const body = await response.json().catch(() => null);
+  if (!response.ok || body?.ok !== true || body.kind !== "platform-bootstrap" || body.claimable !== true) {
+    throw new Error("platform bootstrap invitation is not claimable; the environment was repaired from existing state instead of clean genesis");
+  }
+}
 async function applyAttendedPlatformBootstrap(fleetRequest, cloudflareRequest, acceptancePath, secrets, dependencies = {}) {
   if (cloudflareRequest.mode !== "apply")
     throw new Error("attended platform bootstrap requires Cloudflare apply mode");
@@ -18425,6 +18454,10 @@ async function applyAttendedPlatformBootstrap(fleetRequest, cloudflareRequest, a
   if (!fleet.ok)
     return { kind: "forgezero-attended-platform-bootstrap", ok: false, edge, fleet };
   const inviteUrl = invitationFrom(fleet, fleetCoordinates.nodes[0].computeReference);
+  await (dependencies.validateInvite ?? validatePlatformInvitation)({
+    apiOrigin: fleetCoordinates.apiOrigin,
+    inviteUrl
+  });
   const acceptance = await (dependencies.finalize ?? finalizeCloudflareBootstrapAcceptance)({
     checkpointPath: edge.checkpointFile,
     acceptancePath

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.136";
+var VERSION = "0.1.138";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-helper-socket.js

@@ -833,6 +833,7 @@ var macForAddress = (address) => {
   }
   return `52:54:00:f0:${octets[2].toString(16).padStart(2, "0")}:${octets[3].toString(16).padStart(2, "0")}`;
 };
+var shouldCloseGuestMapper = (openedHere, active) => openedHere && active;
 function validateMetalProfile(profile) {
   if (!SAFE_NAME.test(profile.volumeGroup))
     throw new MetalProvisionError("invalid volume group");
@@ -1166,6 +1167,7 @@ async function provisionMetalGuest(profile, claim, exec) {
   const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
   const keyPath = `/run/forgezero/${credentialName}.key`;
   let imageTarget = lv;
+  let mapperOpenedHere = false;
   if (encrypted) {
     mkdirSync2(dirname2(credentialPath), { recursive: true, mode: 448 });
     mkdirSync2(dirname2(keyPath), { recursive: true, mode: 448 });
@@ -1206,6 +1208,7 @@ async function provisionMetalGuest(profile, claim, exec) {
       }
       if ((await exec(["cryptsetup", "status", mapper])).exitCode !== 0) {
         await checked(exec, ["cryptsetup", "open", "--type", "luks2", "--key-file", keyPath, lv, mapper]);
+        mapperOpenedHere = true;
       }
       imageTarget = mappedDisk;
       if (manifest.phase === "allocating") {
@@ -1216,7 +1219,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     } finally {
       if (existsSync2(keyPath))
         unlinkSync2(keyPath);
-      if ((await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+      if (shouldCloseGuestMapper(mapperOpenedHere, (await exec(["cryptsetup", "status", mapper])).exitCode === 0)) {
         await checked(exec, ["cryptsetup", "close", mapper]);
       }
     }

package/dist/metal-provision.d.ts

@@ -72,6 +72,8 @@ export declare const guestNameFor: (computeKey: string) => string;
 /** Linux interface names are capped at 15 bytes. */
 export declare const tapNameFor: (computeKey: string) => string;
 export declare const macForAddress: (address: string) => string;
+/** A reconciler may close only the transient mapper it opened itself. */
+export declare const shouldCloseGuestMapper: (openedHere: boolean, active: boolean) => boolean;
 export declare function validateMetalProfile(profile: MetalProvisionProfile): void;
 export declare function allocateAddress(profile: MetalProvisionProfile, computeKey: string, rows: GuestManifest[]): string;
 /** Stable tight-fit allocation of exact physical cores inside one NUMA-local pool. */

package/dist/metal-provision.js

@@ -833,6 +833,7 @@ var macForAddress = (address) => {
   }
   return `52:54:00:f0:${octets[2].toString(16).padStart(2, "0")}:${octets[3].toString(16).padStart(2, "0")}`;
 };
+var shouldCloseGuestMapper = (openedHere, active) => openedHere && active;
 function validateMetalProfile(profile) {
   if (!SAFE_NAME.test(profile.volumeGroup))
     throw new MetalProvisionError("invalid volume group");
@@ -1166,6 +1167,7 @@ async function provisionMetalGuest(profile, claim, exec) {
   const credentialPath = `/etc/forgezero/creds/${credentialName}.cred`;
   const keyPath = `/run/forgezero/${credentialName}.key`;
   let imageTarget = lv;
+  let mapperOpenedHere = false;
   if (encrypted) {
     mkdirSync2(dirname2(credentialPath), { recursive: true, mode: 448 });
     mkdirSync2(dirname2(keyPath), { recursive: true, mode: 448 });
@@ -1206,6 +1208,7 @@ async function provisionMetalGuest(profile, claim, exec) {
       }
       if ((await exec(["cryptsetup", "status", mapper])).exitCode !== 0) {
         await checked(exec, ["cryptsetup", "open", "--type", "luks2", "--key-file", keyPath, lv, mapper]);
+        mapperOpenedHere = true;
       }
       imageTarget = mappedDisk;
       if (manifest.phase === "allocating") {
@@ -1216,7 +1219,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     } finally {
       if (existsSync2(keyPath))
         unlinkSync2(keyPath);
-      if ((await exec(["cryptsetup", "status", mapper])).exitCode === 0) {
+      if (shouldCloseGuestMapper(mapperOpenedHere, (await exec(["cryptsetup", "status", mapper])).exitCode === 0)) {
         await checked(exec, ["cryptsetup", "close", mapper]);
       }
     }
@@ -1388,6 +1391,7 @@ async function removeMetalGuest(profile, claim, exec) {
 export {
   validateMetalProfile,
   tapNameFor,
+  shouldCloseGuestMapper,
   removeMetalGuest,
   provisionMetalGuest,
   macForAddress,

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.136";
+var VERSION = "0.1.138";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-bootstrap-runtime.js

@@ -1260,7 +1260,17 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const slots = join2(normalized.root, "slots");
   mkdirSync2(slots, { recursive: true, mode: 493 });
   const slotFile = join2(slots, ".active");
-  const previousSlot = existsSync2(slotFile) ? readFileSync2(slotFile, "utf8").trim() : undefined;
+  let previousSlot = existsSync2(slotFile) ? readFileSync2(slotFile, "utf8").trim() : undefined;
+  if (previousSlot !== "blue" && previousSlot !== "green") {
+    previousSlot = undefined;
+    for (const candidate of ["blue", "green"]) {
+      const active = await exec(["/usr/bin/systemctl", "is-active", "--quiet", `forgezero@${candidate}.service`]);
+      if (active.exitCode === 0) {
+        previousSlot = candidate;
+        break;
+      }
+    }
+  }
   const target = previousSlot === "blue" ? "green" : "blue";
   const port = target === "blue" ? normalized.bluePort : normalized.greenPort;
   const targetLink = join2(slots, target);
@@ -1293,6 +1303,8 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const stopTarget = async () => {
     await exec(["/usr/bin/systemctl", "stop", service]);
     replaceLink(targetLink, previousTarget);
+    if (previousSlot)
+      await exec(["/usr/bin/systemctl", "start", `forgezero@${previousSlot}.service`]);
   };
   if (!healthy) {
     await stopTarget();

package/dist/platform-fleet-verification.js

@@ -3049,7 +3049,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.136";
+var VERSION3 = "0.1.138";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4776,7 +4776,17 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const slots = join5(normalized.root, "slots");
   mkdirSync8(slots, { recursive: true, mode: 493 });
   const slotFile = join5(slots, ".active");
-  const previousSlot = existsSync8(slotFile) ? readFileSync6(slotFile, "utf8").trim() : undefined;
+  let previousSlot = existsSync8(slotFile) ? readFileSync6(slotFile, "utf8").trim() : undefined;
+  if (previousSlot !== "blue" && previousSlot !== "green") {
+    previousSlot = undefined;
+    for (const candidate of ["blue", "green"]) {
+      const active = await exec(["/usr/bin/systemctl", "is-active", "--quiet", `forgezero@${candidate}.service`]);
+      if (active.exitCode === 0) {
+        previousSlot = candidate;
+        break;
+      }
+    }
+  }
   const target = previousSlot === "blue" ? "green" : "blue";
   const port = target === "blue" ? normalized.bluePort : normalized.greenPort;
   const targetLink = join5(slots, target);
@@ -4809,6 +4819,8 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const stopTarget = async () => {
     await exec(["/usr/bin/systemctl", "stop", service]);
     replaceLink(targetLink, previousTarget);
+    if (previousSlot)
+      await exec(["/usr/bin/systemctl", "start", `forgezero@${previousSlot}.service`]);
   };
   if (!healthy) {
     await stopTarget();

package/dist/provision.js

@@ -3049,7 +3049,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.136";
+var VERSION3 = "0.1.138";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.136";
+export declare const VERSION = "0.1.138";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.136",
+  "version": "0.1.138",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",