@forgezero/agent 0.1.137 → 0.1.139

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.137";
+var VERSION3 = "0.1.139";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/attended-platform-bootstrap.d.ts

@@ -12,8 +12,14 @@ export interface AttendedPlatformBootstrapResult {
 export interface AttendedPlatformBootstrapDependencies {
     cloudflare?: typeof runAttendedCloudflareBootstrap;
     fleet?: typeof applyOperatorPlatformFleetBootstrap;
+    validateInvite?: typeof validatePlatformInvitation;
     finalize?: typeof finalizeCloudflareBootstrapAcceptance;
 }
+export declare function validatePlatformInvitation(args: {
+    apiOrigin: string;
+    inviteUrl: string;
+    fetcher?: typeof fetch;
+}): Promise<void>;
 /**
  * The sole attended genesis composition boundary. All non-secret coordinates
  * are checked before the first Cloudflare or SSH mutation. Secret values exist

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.137";
+var VERSION = "0.1.139";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -2958,6 +2958,7 @@ var runProvisionOperation = async (operation) => {
     rmSync4(key, { force: true });
     if (result.exitCode !== 0)
       return result;
+    chmodSync2("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };

package/dist/community-rehearsal-host.js

@@ -475,6 +475,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });

package/dist/definition.js

@@ -475,6 +475,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });

package/dist/deploy-file.js

@@ -475,6 +475,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });

package/dist/fz-agent.js

@@ -5471,6 +5471,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync2("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });
@@ -9683,7 +9684,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.137";
+var VERSION2 = "0.1.139";
 
 // src/ssh-bootstrap.ts
 function deriveMetalAdmissionProvisioning(lscpu) {
@@ -15432,7 +15433,17 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const slots = join10(normalized.root, "slots");
   mkdirSync14(slots, { recursive: true, mode: 493 });
   const slotFile = join10(slots, ".active");
-  const previousSlot = existsSync19(slotFile) ? readFileSync14(slotFile, "utf8").trim() : undefined;
+  let previousSlot = existsSync19(slotFile) ? readFileSync14(slotFile, "utf8").trim() : undefined;
+  if (previousSlot !== "blue" && previousSlot !== "green") {
+    previousSlot = undefined;
+    for (const candidate of ["blue", "green"]) {
+      const active = await exec(["/usr/bin/systemctl", "is-active", "--quiet", `forgezero@${candidate}.service`]);
+      if (active.exitCode === 0) {
+        previousSlot = candidate;
+        break;
+      }
+    }
+  }
   const target2 = previousSlot === "blue" ? "green" : "blue";
   const port = target2 === "blue" ? normalized.bluePort : normalized.greenPort;
   const targetLink = join10(slots, target2);
@@ -15465,6 +15476,8 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const stopTarget = async () => {
     await exec(["/usr/bin/systemctl", "stop", service]);
     replaceLink(targetLink, previousTarget);
+    if (previousSlot)
+      await exec(["/usr/bin/systemctl", "start", `forgezero@${previousSlot}.service`]);
   };
   if (!healthy) {
     await stopTarget();
@@ -16916,6 +16929,7 @@ var runProvisionOperation = async (operation) => {
     rmSync11(key, { force: true });
     if (result.exitCode !== 0)
       return result;
+    chmodSync18("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };

package/dist/fz.js

@@ -6007,7 +6007,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.137";
+var VERSION2 = "0.1.139";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -7875,6 +7875,7 @@ var runProvisionOperation = async (operation) => {
     rmSync3(key, { force: true });
     if (result.exitCode !== 0)
       return result;
+    chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };
@@ -18401,6 +18402,35 @@ var invitationFrom = (fleet, master) => {
   } catch {}
   throw new Error("platform bootstrap completed without the initial custodian invitation");
 };
+async function validatePlatformInvitation(args) {
+  let invite;
+  let api;
+  try {
+    invite = new URL(args.inviteUrl);
+    api = new URL(args.apiOrigin);
+  } catch {
+    throw new Error("platform bootstrap produced malformed public invitation coordinates");
+  }
+  const token = invite.searchParams.get("token") ?? "";
+  if (invite.protocol !== "https:" || api.protocol !== "https:" || !/^plt_[a-f0-9]{48}$/.test(token)) {
+    throw new Error("platform bootstrap produced malformed public invitation coordinates");
+  }
+  const endpoint2 = new URL(`/api/onboarding/invite/${encodeURIComponent(token)}`, api);
+  let response;
+  try {
+    response = await (args.fetcher ?? fetch)(endpoint2, {
+      headers: { accept: "application/json" },
+      cache: "no-store",
+      signal: AbortSignal.timeout(15000)
+    });
+  } catch {
+    throw new Error("platform bootstrap invitation could not be verified through public ingress");
+  }
+  const body = await response.json().catch(() => null);
+  if (!response.ok || body?.ok !== true || body.kind !== "platform-bootstrap" || body.claimable !== true) {
+    throw new Error("platform bootstrap invitation is not claimable; the environment was repaired from existing state instead of clean genesis");
+  }
+}
 async function applyAttendedPlatformBootstrap(fleetRequest, cloudflareRequest, acceptancePath, secrets, dependencies = {}) {
   if (cloudflareRequest.mode !== "apply")
     throw new Error("attended platform bootstrap requires Cloudflare apply mode");
@@ -18425,6 +18455,10 @@ async function applyAttendedPlatformBootstrap(fleetRequest, cloudflareRequest, a
   if (!fleet.ok)
     return { kind: "forgezero-attended-platform-bootstrap", ok: false, edge, fleet };
   const inviteUrl = invitationFrom(fleet, fleetCoordinates.nodes[0].computeReference);
+  await (dependencies.validateInvite ?? validatePlatformInvitation)({
+    apiOrigin: fleetCoordinates.apiOrigin,
+    inviteUrl
+  });
   const acceptance = await (dependencies.finalize ?? finalizeCloudflareBootstrapAcceptance)({
     checkpointPath: edge.checkpointFile,
     acceptancePath

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.137";
+var VERSION = "0.1.139";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-helper-socket.js

@@ -619,6 +619,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });

package/dist/metal-provision.js

@@ -619,6 +619,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.137";
+var VERSION = "0.1.139";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -2958,6 +2958,7 @@ var runProvisionOperation = async (operation) => {
     rmSync4(key, { force: true });
     if (result.exitCode !== 0)
       return result;
+    chmodSync2("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };

package/dist/platform-bootstrap-runtime.js

@@ -475,6 +475,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });
@@ -1260,7 +1261,17 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const slots = join2(normalized.root, "slots");
   mkdirSync2(slots, { recursive: true, mode: 493 });
   const slotFile = join2(slots, ".active");
-  const previousSlot = existsSync2(slotFile) ? readFileSync2(slotFile, "utf8").trim() : undefined;
+  let previousSlot = existsSync2(slotFile) ? readFileSync2(slotFile, "utf8").trim() : undefined;
+  if (previousSlot !== "blue" && previousSlot !== "green") {
+    previousSlot = undefined;
+    for (const candidate of ["blue", "green"]) {
+      const active = await exec(["/usr/bin/systemctl", "is-active", "--quiet", `forgezero@${candidate}.service`]);
+      if (active.exitCode === 0) {
+        previousSlot = candidate;
+        break;
+      }
+    }
+  }
   const target = previousSlot === "blue" ? "green" : "blue";
   const port = target === "blue" ? normalized.bluePort : normalized.greenPort;
   const targetLink = join2(slots, target);
@@ -1293,6 +1304,8 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const stopTarget = async () => {
     await exec(["/usr/bin/systemctl", "stop", service]);
     replaceLink(targetLink, previousTarget);
+    if (previousSlot)
+      await exec(["/usr/bin/systemctl", "start", `forgezero@${previousSlot}.service`]);
   };
   if (!healthy) {
     await stopTarget();

package/dist/platform-fleet-verification.js

@@ -1318,6 +1318,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync4("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync3("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync3("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });
@@ -3049,7 +3050,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.137";
+var VERSION3 = "0.1.139";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4776,7 +4777,17 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const slots = join5(normalized.root, "slots");
   mkdirSync8(slots, { recursive: true, mode: 493 });
   const slotFile = join5(slots, ".active");
-  const previousSlot = existsSync8(slotFile) ? readFileSync6(slotFile, "utf8").trim() : undefined;
+  let previousSlot = existsSync8(slotFile) ? readFileSync6(slotFile, "utf8").trim() : undefined;
+  if (previousSlot !== "blue" && previousSlot !== "green") {
+    previousSlot = undefined;
+    for (const candidate of ["blue", "green"]) {
+      const active = await exec(["/usr/bin/systemctl", "is-active", "--quiet", `forgezero@${candidate}.service`]);
+      if (active.exitCode === 0) {
+        previousSlot = candidate;
+        break;
+      }
+    }
+  }
   const target = previousSlot === "blue" ? "green" : "blue";
   const port = target === "blue" ? normalized.bluePort : normalized.greenPort;
   const targetLink = join5(slots, target);
@@ -4809,6 +4820,8 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const stopTarget = async () => {
     await exec(["/usr/bin/systemctl", "stop", service]);
     replaceLink(targetLink, previousTarget);
+    if (previousSlot)
+      await exec(["/usr/bin/systemctl", "start", `forgezero@${previousSlot}.service`]);
   };
   if (!healthy) {
     await stopTarget();
@@ -5171,6 +5184,7 @@ var runProvisionOperation = async (operation) => {
     rmSync8(key, { force: true });
     if (result.exitCode !== 0)
       return result;
+    chmodSync7("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };

package/dist/platform-genesis.js

@@ -475,6 +475,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });

package/dist/provision.js

@@ -1318,6 +1318,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync4("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync3("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync3("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });
@@ -3049,7 +3050,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.137";
+var VERSION3 = "0.1.139";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/software-helper.js

@@ -475,6 +475,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });

package/dist/software.js

@@ -475,6 +475,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });

package/dist/ubuntu.js

@@ -475,6 +475,7 @@ async function executeSoftwareOperation(operation) {
       ]);
       if (dearmored.exitCode !== 0)
         return dearmored;
+      chmodSync("/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", 420);
       mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
       writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
 `, { mode: 420 });

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.137";
+export declare const VERSION = "0.1.139";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.137",
+  "version": "0.1.139",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",