@forgezero/agent 0.1.155 → 0.1.157

package/dist/agent-heartbeat.js

@@ -948,7 +948,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.155";
+var VERSION3 = "0.1.157";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.155";
+var VERSION = "0.1.157";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/fz-agent.js

@@ -11485,7 +11485,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.155";
+var VERSION2 = "0.1.157";
 
 // src/ssh-bootstrap.ts
 function deriveMetalAdmissionProvisioning(lscpu) {
@@ -11680,7 +11680,7 @@ var verifiedBunArchive = async (directory) => {
   writeFileSync5(archive, bytes, { mode: 384, flag: "wx" });
   return archive;
 };
-var remote = (exec, ssh, destination, code, argv2, secret = false, stdin) => checked(exec, ["ssh", ...ssh, destination, "--", ...argv2], code, { secret, ...stdin !== undefined ? { stdin } : {} });
+var remote = (exec, ssh, destination, code, argv2, secret = false, stdin) => checked(exec, ["ssh", ...ssh, destination, ...argv2], code, { secret, ...stdin !== undefined ? { stdin } : {} });
 async function executeSshBootstrap(claim, options) {
   validateClaim(claim);
   if (!options.sshKeyPath.startsWith("/") || /[\r\n]/.test(options.sshKeyPath))
@@ -11724,7 +11724,7 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
     claim.target.hostKeySha256 = observedHost.fingerprint;
     const knownHosts = observedHost.path;
     const ssh = sshOptions(claim, pinned, knownHosts, sshKeyPath);
-    remoteDirectory = await checkedSshOpen(exec, ["ssh", ...ssh, target(claim, pinned), "--", "mktemp", "-d", "/tmp/forgezero-bootstrap.XXXXXXXX"]);
+    remoteDirectory = await checkedSshOpen(exec, ["ssh", ...ssh, target(claim, pinned), "mktemp", "-d", "/tmp/forgezero-bootstrap.XXXXXXXX"]);
     if (!/^\/tmp\/forgezero-bootstrap\.[A-Za-z0-9]{8}$/.test(remoteDirectory))
       throw new SshBootstrapError("REMOTE_PATH_INVALID");
     const destination = target(claim, pinned);
@@ -11914,7 +11914,6 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
           "ssh",
           ...sshOptions(claim, pinned, knownHosts, sshKeyPath),
           target(claim, pinned),
-          "--",
           "sudo",
           "-n",
           "rm",
@@ -12075,7 +12074,7 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
     const ssh = sshOptions(claim, pinned, knownHosts, sshKeyPath);
     const destination = target(claim, pinned);
     await progress("opening-ssh");
-    remoteDirectory = await checkedSshOpen(exec, ["ssh", ...ssh, destination, "--", "mktemp", "-d", "/tmp/forgezero-metal-admission.XXXXXXXX"]);
+    remoteDirectory = await checkedSshOpen(exec, ["ssh", ...ssh, destination, "mktemp", "-d", "/tmp/forgezero-metal-admission.XXXXXXXX"]);
     if (!/^\/tmp\/forgezero-metal-admission\.[A-Za-z0-9]{8}$/.test(remoteDirectory))
       throw new SshBootstrapError("REMOTE_PATH_INVALID");
     await progress("installing-managed-key");
@@ -12198,7 +12197,6 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
       "ssh",
       ...ssh,
       destination,
-      "--",
       "/usr/bin/sudo",
       "-n",
       "/usr/bin/systemd-run",
@@ -12231,7 +12229,6 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
           "ssh",
           ...sshOptions(claim, pinned, knownHosts, sshKeyPath),
           target(claim, pinned),
-          "--",
           "sudo",
           "-n",
           "rm",
@@ -17333,6 +17330,9 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
     }
   };
   const previousHeldSeed = previousSlot ? await meshProbe(previousSlot === "blue" ? normalized.bluePort : normalized.greenPort, "resident") : false;
+  if (previousSlot && !previousHeldSeed) {
+    throw new Error("active slot has no resident Vault seed; unlock custody before promotion");
+  }
   const targetLink = join10(slots, target2);
   let previousTarget;
   try {

package/dist/fz.js

@@ -7126,7 +7126,7 @@ var VaultRuntimeClientError, json = (value) => ({ method: "POST", body: JSON.str
   } catch {
     return;
   }
-}, VERSION = "0.1.27";
+}, VERSION = "0.1.28";
 var init_dist = __esm(() => {
   init_vault_runtime();
   init_identity();
@@ -7345,7 +7345,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.155";
+var VERSION2 = "0.1.157";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.155";
+var VERSION = "0.1.157";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.155";
+var VERSION = "0.1.157";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-bootstrap-runtime.js

@@ -1287,6 +1287,9 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
     }
   };
   const previousHeldSeed = previousSlot ? await meshProbe(previousSlot === "blue" ? normalized.bluePort : normalized.greenPort, "resident") : false;
+  if (previousSlot && !previousHeldSeed) {
+    throw new Error("active slot has no resident Vault seed; unlock custody before promotion");
+  }
   const targetLink = join2(slots, target);
   let previousTarget;
   try {

package/dist/platform-fleet-verification.js

@@ -3081,7 +3081,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.155";
+var VERSION3 = "0.1.157";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4835,6 +4835,9 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
     }
   };
   const previousHeldSeed = previousSlot ? await meshProbe(previousSlot === "blue" ? normalized.bluePort : normalized.greenPort, "resident") : false;
+  if (previousSlot && !previousHeldSeed) {
+    throw new Error("active slot has no resident Vault seed; unlock custody before promotion");
+  }
   const targetLink = join5(slots, target);
   let previousTarget;
   try {

package/dist/provision.js

@@ -3081,7 +3081,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.155";
+var VERSION3 = "0.1.157";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.155";
+export declare const VERSION = "0.1.157";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.155",
+  "version": "0.1.157",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",
@@ -16,8 +16,8 @@
     "@noble/post-quantum": "^0.6.1"
   },
   "dependencies": {
-    "@forgezero/runtime": "0.1.21",
-    "@forgezero/vault": "0.1.27",
+    "@forgezero/runtime": "0.1.22",
+    "@forgezero/vault": "0.1.28",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "@noble/post-quantum": "0.6.1",