@forgezero/agent 0.1.16 → 0.1.17

package/dist/deployment-runner.d.ts

@@ -13,11 +13,12 @@ export declare function startDeploymentRunner(options: {
     root: string;
     home: string;
     socketPath?: string;
-    /** systemd socket activation passes the agent-owned listener as fd 3. */
-    listenFd?: number;
+    /** Bind closed, then let the service manager transfer access to the Agent. */
+    socketMode?: number;
     exec?: (input: CommandInput, home: string) => Promise<CommandResult>;
 }): {
     server: Server;
+    ready: Promise<void>;
     stop(): Promise<void>;
 };
 export declare function requestDeploymentCommand(input: CommandInput, socketPath?: string): Promise<CommandResult>;

package/dist/deployment-runner.js

@@ -103,7 +103,7 @@ function startDeploymentRunner(options) {
   const root = resolve(options.root);
   const home = resolve(options.home);
   const socketPath = options.socketPath ?? DEFAULT_DEPLOYMENT_RUNNER_SOCKET;
-  if (options.listenFd === undefined && existsSync(socketPath))
+  if (existsSync(socketPath))
     unlinkSync(socketPath);
   const active = new Set;
   const server = createServer((socket) => {
@@ -145,12 +145,17 @@ function startDeploymentRunner(options) {
     });
     socket.on("error", () => socket.destroy());
   });
-  if (options.listenFd !== undefined)
-    server.listen({ fd: options.listenFd });
-  else
-    server.listen(socketPath, () => chmodSync(socketPath, 432));
+  const ready = new Promise((resolveReady, rejectReady) => {
+    server.once("error", rejectReady);
+    server.listen(socketPath, () => {
+      chmodSync(socketPath, options.socketMode ?? 432);
+      server.off("error", rejectReady);
+      resolveReady();
+    });
+  });
   return {
     server,
+    ready,
     async stop() {
       await new Promise((resolveStop) => server.close(() => resolveStop()));
       await Promise.all(active);

package/dist/fz-agent.js

@@ -1495,38 +1495,29 @@ var DEPLOYMENT_RUNNER_USER = "forgezero-runner";
 var DEPLOYMENT_GROUP = "forgezero-deploy";
 var VAULT_GROUP = "forgezero-vault";
 var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
-function deploymentRunnerSocketUnit(agentUser) {
-  return `[Unit]
-Description=ForgeZero private project-command socket
-
-[Socket]
-ListenStream=${DEPLOYMENT_RUNNER_SOCKET}
-SocketUser=${agentUser}
-SocketGroup=${agentUser}
-SocketMode=0600
-DirectoryMode=0710
-RemoveOnStop=true
-
-[Install]
-WantedBy=sockets.target
-`;
-}
 function deploymentRunnerUnit(options) {
   const bin = options.binPath ?? "fz-agent";
   const root = options.deployRoot ?? "/opt/forgezero";
+  const agentUser = options.user ?? "forgezero-agent";
   return `[Unit]
 Description=ForgeZero credential-free project command runner
 Documentation=https://www.forgezero.net/docs/agent
-After=forgezero-deploy-runner.socket
-Requires=forgezero-deploy-runner.socket
 
 [Service]
-Type=simple
+Type=notify
+NotifyAccess=all
 User=${DEPLOYMENT_RUNNER_USER}
 Group=${DEPLOYMENT_GROUP}
 Environment=FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}
-Sockets=forgezero-deploy-runner.socket
+RuntimeDirectory=forgezero-deploy
+RuntimeDirectoryMode=0710
+ExecStartPre=+/usr/bin/install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0710 /run/forgezero-deploy
+ExecStartPre=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
 ExecStart=${bin} deploy-runner --root=${root} --home=${root}/runner-home
+ExecStartPost=+/usr/bin/chown ${agentUser}:${agentUser} ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chmod 0600 ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chown root:root /run/forgezero-deploy
+ExecStopPost=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
 Restart=always
 RestartSec=2
 UMask=0007
@@ -1797,7 +1788,10 @@ if [[ ! -s /etc/forgezero/git/deploy.pub ]]; then
 fi
 chmod 0400 /etc/forgezero/creds/git-deploy-key.cred
 systemctl daemon-reload
-systemctl enable --now forgezero-deploy-runner.socket forgezero-deploy-runner.service forgezero-agent.service
+systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true
+rm -f /etc/systemd/system/forgezero-deploy-runner.socket
+systemctl daemon-reload
+systemctl enable --now forgezero-deploy-runner.service forgezero-agent.service
 `;
 }
 function guestAgentUnit(profile, name, attested = Boolean(profile.confidential), pull = true) {
@@ -1891,8 +1885,7 @@ function cloudInit(profile, claim, manifest) {
   const enrolmentDropIn = guestEnrolmentDropIn();
   const cleanupScript = guestEnrolmentCleanupScript();
   const cleanupUnit = guestEnrolmentCleanupUnit();
-  const runnerSocketUnit = deploymentRunnerSocketUnit("forgezero-agent");
-  const runnerUnit = deploymentRunnerUnit({ binPath: "/usr/local/bin/fz-agent", deployRoot: "/opt/forgezero" });
+  const runnerUnit = deploymentRunnerUnit({ binPath: "/usr/local/bin/fz-agent", deployRoot: "/opt/forgezero", user: "forgezero-agent" });
   const access = claim.access;
   const users = access ? `users:
   - default
@@ -1914,7 +1907,7 @@ ${users}disable_root: true
 # every dynamically claimed repository must be cloneable on a clean image.
 packages: [curl, ca-certificates, openssl, openssh-client, git, unzip${claim.spec.confidential ? ", python3" : ""}]
 write_files:
-${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.socket", runnerSocketUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.service", runnerUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-agent.service", agentUnit, "0644")}runcmd:
+${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.service", runnerUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-agent.service", agentUnit, "0644")}runcmd:
   - [ bash, /usr/local/sbin/forgezero-guest-bootstrap ]
 ${enrolled ? `  - [ systemctl, enable, --now, forgezero-enrolment-cleanup.service ]
 ` : ""}
@@ -2350,7 +2343,7 @@ function startDeploymentRunner(options) {
   const root = resolve(options.root);
   const home = resolve(options.home);
   const socketPath = options.socketPath ?? DEFAULT_DEPLOYMENT_RUNNER_SOCKET;
-  if (options.listenFd === undefined && existsSync7(socketPath))
+  if (existsSync7(socketPath))
     unlinkSync6(socketPath);
   const active = new Set;
   const server = createServer4((socket) => {
@@ -2392,12 +2385,17 @@ function startDeploymentRunner(options) {
     });
     socket.on("error", () => socket.destroy());
   });
-  if (options.listenFd !== undefined)
-    server.listen({ fd: options.listenFd });
-  else
-    server.listen(socketPath, () => chmodSync6(socketPath, 432));
+  const ready = new Promise((resolveReady, rejectReady) => {
+    server.once("error", rejectReady);
+    server.listen(socketPath, () => {
+      chmodSync6(socketPath, options.socketMode ?? 432);
+      server.off("error", rejectReady);
+      resolveReady();
+    });
+  });
   return {
     server,
+    ready,
     async stop() {
       await new Promise((resolveStop) => server.close(() => resolveStop()));
       await Promise.all(active);
@@ -2713,7 +2711,7 @@ async function applyMetalIsolation(profile, exec = defaultExec) {
 }
 
 // src/version.ts
-var VERSION = "0.1.16";
+var VERSION = "0.1.17";
 
 // src/index.ts
 function loadOrCreateSeed(path) {
@@ -2901,8 +2899,14 @@ if (import.meta.main) {
       root: `${root2.replace(/\/$/, "")}/releases`,
       home,
       socketPath: process.env.FZ_DEPLOY_RUNNER_SOCKET ?? DEFAULT_DEPLOYMENT_RUNNER_SOCKET,
-      listenFd: Number(process.env.LISTEN_PID) === process.pid && Number(process.env.LISTEN_FDS) > 0 ? 3 : undefined
+      socketMode: process.env.NOTIFY_SOCKET ? 0 : 432
     });
+    await runner.ready;
+    if (process.env.NOTIFY_SOCKET) {
+      const notification = Bun.spawnSync(["/usr/bin/systemd-notify", "--ready"]);
+      if (notification.exitCode !== 0)
+        throw new Error("could not notify systemd that the deployment runner is ready");
+    }
     console.log(`[deploy-runner] listening on ${process.env.FZ_DEPLOY_RUNNER_SOCKET ?? DEFAULT_DEPLOYMENT_RUNNER_SOCKET}`);
     let stopping = false;
     const stop = async () => {

package/dist/fz.js

@@ -150,7 +150,6 @@ var DEPLOYMENT_RUNNER_USER = "forgezero-runner";
 var DEPLOYMENT_GROUP = "forgezero-deploy";
 var VAULT_GROUP = "forgezero-vault";
 var DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
-var DEPLOYMENT_RUNNER_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.socket";
 var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 var ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 function agentEnrolmentUnit(options) {
@@ -197,38 +196,29 @@ LimitCORE=0
 WantedBy=multi-user.target
 `;
 }
-function deploymentRunnerSocketUnit(agentUser) {
-  return `[Unit]
-Description=ForgeZero private project-command socket
-
-[Socket]
-ListenStream=${DEPLOYMENT_RUNNER_SOCKET}
-SocketUser=${agentUser}
-SocketGroup=${agentUser}
-SocketMode=0600
-DirectoryMode=0710
-RemoveOnStop=true
-
-[Install]
-WantedBy=sockets.target
-`;
-}
 function deploymentRunnerUnit(options) {
   const bin = options.binPath ?? "fz-agent";
   const root = options.deployRoot ?? "/opt/forgezero";
+  const agentUser = options.user ?? "forgezero-agent";
   return `[Unit]
 Description=ForgeZero credential-free project command runner
 Documentation=https://www.forgezero.net/docs/agent
-After=forgezero-deploy-runner.socket
-Requires=forgezero-deploy-runner.socket
 
 [Service]
-Type=simple
+Type=notify
+NotifyAccess=all
 User=${DEPLOYMENT_RUNNER_USER}
 Group=${DEPLOYMENT_GROUP}
 Environment=FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}
-Sockets=forgezero-deploy-runner.socket
+RuntimeDirectory=forgezero-deploy
+RuntimeDirectoryMode=0710
+ExecStartPre=+/usr/bin/install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0710 /run/forgezero-deploy
+ExecStartPre=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
 ExecStart=${bin} deploy-runner --root=${root} --home=${root}/runner-home
+ExecStartPost=+/usr/bin/chown ${agentUser}:${agentUser} ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chmod 0600 ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chown root:root /run/forgezero-deploy
+ExecStopPost=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
 Restart=always
 RestartSec=2
 UMask=0007
@@ -406,7 +396,6 @@ function planProvision(options) {
     unit: agentUnit({ ...options, mode }),
     auxiliaryUnits: [
       ...deploymentEnabled ? [
-        { path: DEPLOYMENT_RUNNER_SOCKET_UNIT_PATH, unit: deploymentRunnerSocketUnit(user) },
         { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) }
       ] : [],
       ...enrolmentEnabled ? [
@@ -473,10 +462,14 @@ function planProvision(options) {
         command: `install -d -o root -g root -m 0755 ${deployRoot} && ` + `install -d -o root -g ${DEPLOYMENT_GROUP} -m 3770 ${deployRoot}/releases && ` + `install -d -o ${user} -g ${user} -m 0750 ${deployRoot}/cache && ` + `install -d -o ${user} -g ${user} -m 0700 ${deployRoot}/agent-home && ` + `install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0700 ${deployRoot}/runner-home ${deployRoot}/runner-home/cache`
       }] : [],
       { label: "reload units", command: "systemctl daemon-reload" },
+      ...deploymentEnabled ? [{
+        label: "remove unsupported deployment socket activation",
+        command: "systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true; rm -f /etc/systemd/system/forgezero-deploy-runner.socket; systemctl daemon-reload"
+      }] : [],
       {
         label: "enable and start",
         command: `systemctl enable --now ${[
-          ...deploymentEnabled ? ["forgezero-deploy-runner.socket", "forgezero-deploy-runner.service"] : [],
+          ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
           ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
           "forgezero-agent.service"
         ].join(" ")}`
@@ -781,7 +774,7 @@ async function resolveIdentity(selector, socketPath) {
 }
 
 // src/version.ts
-var VERSION = "0.1.16";
+var VERSION = "0.1.17";
 
 // src/cli/index.ts
 var DEFAULT_MODE = THRESHOLD_MODES[0].id;

package/dist/metal-helper-socket.js

@@ -183,7 +183,6 @@ var DEPLOYMENT_RUNNER_USER = "forgezero-runner";
 var DEPLOYMENT_GROUP = "forgezero-deploy";
 var VAULT_GROUP = "forgezero-vault";
 var DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
-var DEPLOYMENT_RUNNER_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.socket";
 var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 var ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 function agentEnrolmentUnit(options) {
@@ -230,38 +229,29 @@ LimitCORE=0
 WantedBy=multi-user.target
 `;
 }
-function deploymentRunnerSocketUnit(agentUser) {
-  return `[Unit]
-Description=ForgeZero private project-command socket
-
-[Socket]
-ListenStream=${DEPLOYMENT_RUNNER_SOCKET}
-SocketUser=${agentUser}
-SocketGroup=${agentUser}
-SocketMode=0600
-DirectoryMode=0710
-RemoveOnStop=true
-
-[Install]
-WantedBy=sockets.target
-`;
-}
 function deploymentRunnerUnit(options) {
   const bin = options.binPath ?? "fz-agent";
   const root = options.deployRoot ?? "/opt/forgezero";
+  const agentUser = options.user ?? "forgezero-agent";
   return `[Unit]
 Description=ForgeZero credential-free project command runner
 Documentation=https://www.forgezero.net/docs/agent
-After=forgezero-deploy-runner.socket
-Requires=forgezero-deploy-runner.socket
 
 [Service]
-Type=simple
+Type=notify
+NotifyAccess=all
 User=${DEPLOYMENT_RUNNER_USER}
 Group=${DEPLOYMENT_GROUP}
 Environment=FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}
-Sockets=forgezero-deploy-runner.socket
+RuntimeDirectory=forgezero-deploy
+RuntimeDirectoryMode=0710
+ExecStartPre=+/usr/bin/install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0710 /run/forgezero-deploy
+ExecStartPre=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
 ExecStart=${bin} deploy-runner --root=${root} --home=${root}/runner-home
+ExecStartPost=+/usr/bin/chown ${agentUser}:${agentUser} ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chmod 0600 ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chown root:root /run/forgezero-deploy
+ExecStopPost=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
 Restart=always
 RestartSec=2
 UMask=0007
@@ -439,7 +429,6 @@ function planProvision(options) {
     unit: agentUnit({ ...options, mode }),
     auxiliaryUnits: [
       ...deploymentEnabled ? [
-        { path: DEPLOYMENT_RUNNER_SOCKET_UNIT_PATH, unit: deploymentRunnerSocketUnit(user) },
         { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) }
       ] : [],
       ...enrolmentEnabled ? [
@@ -506,10 +495,14 @@ function planProvision(options) {
         command: `install -d -o root -g root -m 0755 ${deployRoot} && ` + `install -d -o root -g ${DEPLOYMENT_GROUP} -m 3770 ${deployRoot}/releases && ` + `install -d -o ${user} -g ${user} -m 0750 ${deployRoot}/cache && ` + `install -d -o ${user} -g ${user} -m 0700 ${deployRoot}/agent-home && ` + `install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0700 ${deployRoot}/runner-home ${deployRoot}/runner-home/cache`
       }] : [],
       { label: "reload units", command: "systemctl daemon-reload" },
+      ...deploymentEnabled ? [{
+        label: "remove unsupported deployment socket activation",
+        command: "systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true; rm -f /etc/systemd/system/forgezero-deploy-runner.socket; systemctl daemon-reload"
+      }] : [],
       {
         label: "enable and start",
         command: `systemctl enable --now ${[
-          ...deploymentEnabled ? ["forgezero-deploy-runner.socket", "forgezero-deploy-runner.service"] : [],
+          ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
           ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
           "forgezero-agent.service"
         ].join(" ")}`
@@ -793,7 +786,10 @@ if [[ ! -s /etc/forgezero/git/deploy.pub ]]; then
 fi
 chmod 0400 /etc/forgezero/creds/git-deploy-key.cred
 systemctl daemon-reload
-systemctl enable --now forgezero-deploy-runner.socket forgezero-deploy-runner.service forgezero-agent.service
+systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true
+rm -f /etc/systemd/system/forgezero-deploy-runner.socket
+systemctl daemon-reload
+systemctl enable --now forgezero-deploy-runner.service forgezero-agent.service
 `;
 }
 function guestAgentUnit(profile, name, attested = Boolean(profile.confidential), pull = true) {
@@ -887,8 +883,7 @@ function cloudInit(profile, claim, manifest) {
   const enrolmentDropIn = guestEnrolmentDropIn();
   const cleanupScript = guestEnrolmentCleanupScript();
   const cleanupUnit = guestEnrolmentCleanupUnit();
-  const runnerSocketUnit = deploymentRunnerSocketUnit("forgezero-agent");
-  const runnerUnit = deploymentRunnerUnit({ binPath: "/usr/local/bin/fz-agent", deployRoot: "/opt/forgezero" });
+  const runnerUnit = deploymentRunnerUnit({ binPath: "/usr/local/bin/fz-agent", deployRoot: "/opt/forgezero", user: "forgezero-agent" });
   const access = claim.access;
   const users = access ? `users:
   - default
@@ -910,7 +905,7 @@ ${users}disable_root: true
 # every dynamically claimed repository must be cloneable on a clean image.
 packages: [curl, ca-certificates, openssl, openssh-client, git, unzip${claim.spec.confidential ? ", python3" : ""}]
 write_files:
-${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.socket", runnerSocketUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.service", runnerUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-agent.service", agentUnit2, "0644")}runcmd:
+${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.service", runnerUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-agent.service", agentUnit2, "0644")}runcmd:
   - [ bash, /usr/local/sbin/forgezero-guest-bootstrap ]
 ${enrolled ? `  - [ systemctl, enable, --now, forgezero-enrolment-cleanup.service ]
 ` : ""}

package/dist/metal-provision.js

@@ -183,7 +183,6 @@ var DEPLOYMENT_RUNNER_USER = "forgezero-runner";
 var DEPLOYMENT_GROUP = "forgezero-deploy";
 var VAULT_GROUP = "forgezero-vault";
 var DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
-var DEPLOYMENT_RUNNER_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.socket";
 var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 var ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 function agentEnrolmentUnit(options) {
@@ -230,38 +229,29 @@ LimitCORE=0
 WantedBy=multi-user.target
 `;
 }
-function deploymentRunnerSocketUnit(agentUser) {
-  return `[Unit]
-Description=ForgeZero private project-command socket
-
-[Socket]
-ListenStream=${DEPLOYMENT_RUNNER_SOCKET}
-SocketUser=${agentUser}
-SocketGroup=${agentUser}
-SocketMode=0600
-DirectoryMode=0710
-RemoveOnStop=true
-
-[Install]
-WantedBy=sockets.target
-`;
-}
 function deploymentRunnerUnit(options) {
   const bin = options.binPath ?? "fz-agent";
   const root = options.deployRoot ?? "/opt/forgezero";
+  const agentUser = options.user ?? "forgezero-agent";
   return `[Unit]
 Description=ForgeZero credential-free project command runner
 Documentation=https://www.forgezero.net/docs/agent
-After=forgezero-deploy-runner.socket
-Requires=forgezero-deploy-runner.socket
 
 [Service]
-Type=simple
+Type=notify
+NotifyAccess=all
 User=${DEPLOYMENT_RUNNER_USER}
 Group=${DEPLOYMENT_GROUP}
 Environment=FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}
-Sockets=forgezero-deploy-runner.socket
+RuntimeDirectory=forgezero-deploy
+RuntimeDirectoryMode=0710
+ExecStartPre=+/usr/bin/install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0710 /run/forgezero-deploy
+ExecStartPre=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
 ExecStart=${bin} deploy-runner --root=${root} --home=${root}/runner-home
+ExecStartPost=+/usr/bin/chown ${agentUser}:${agentUser} ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chmod 0600 ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chown root:root /run/forgezero-deploy
+ExecStopPost=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
 Restart=always
 RestartSec=2
 UMask=0007
@@ -439,7 +429,6 @@ function planProvision(options) {
     unit: agentUnit({ ...options, mode }),
     auxiliaryUnits: [
       ...deploymentEnabled ? [
-        { path: DEPLOYMENT_RUNNER_SOCKET_UNIT_PATH, unit: deploymentRunnerSocketUnit(user) },
         { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) }
       ] : [],
       ...enrolmentEnabled ? [
@@ -506,10 +495,14 @@ function planProvision(options) {
         command: `install -d -o root -g root -m 0755 ${deployRoot} && ` + `install -d -o root -g ${DEPLOYMENT_GROUP} -m 3770 ${deployRoot}/releases && ` + `install -d -o ${user} -g ${user} -m 0750 ${deployRoot}/cache && ` + `install -d -o ${user} -g ${user} -m 0700 ${deployRoot}/agent-home && ` + `install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0700 ${deployRoot}/runner-home ${deployRoot}/runner-home/cache`
       }] : [],
       { label: "reload units", command: "systemctl daemon-reload" },
+      ...deploymentEnabled ? [{
+        label: "remove unsupported deployment socket activation",
+        command: "systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true; rm -f /etc/systemd/system/forgezero-deploy-runner.socket; systemctl daemon-reload"
+      }] : [],
       {
         label: "enable and start",
         command: `systemctl enable --now ${[
-          ...deploymentEnabled ? ["forgezero-deploy-runner.socket", "forgezero-deploy-runner.service"] : [],
+          ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
           ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
           "forgezero-agent.service"
         ].join(" ")}`
@@ -793,7 +786,10 @@ if [[ ! -s /etc/forgezero/git/deploy.pub ]]; then
 fi
 chmod 0400 /etc/forgezero/creds/git-deploy-key.cred
 systemctl daemon-reload
-systemctl enable --now forgezero-deploy-runner.socket forgezero-deploy-runner.service forgezero-agent.service
+systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true
+rm -f /etc/systemd/system/forgezero-deploy-runner.socket
+systemctl daemon-reload
+systemctl enable --now forgezero-deploy-runner.service forgezero-agent.service
 `;
 }
 function guestAgentUnit(profile, name, attested = Boolean(profile.confidential), pull = true) {
@@ -887,8 +883,7 @@ function cloudInit(profile, claim, manifest) {
   const enrolmentDropIn = guestEnrolmentDropIn();
   const cleanupScript = guestEnrolmentCleanupScript();
   const cleanupUnit = guestEnrolmentCleanupUnit();
-  const runnerSocketUnit = deploymentRunnerSocketUnit("forgezero-agent");
-  const runnerUnit = deploymentRunnerUnit({ binPath: "/usr/local/bin/fz-agent", deployRoot: "/opt/forgezero" });
+  const runnerUnit = deploymentRunnerUnit({ binPath: "/usr/local/bin/fz-agent", deployRoot: "/opt/forgezero", user: "forgezero-agent" });
   const access = claim.access;
   const users = access ? `users:
   - default
@@ -910,7 +905,7 @@ ${users}disable_root: true
 # every dynamically claimed repository must be cloneable on a clean image.
 packages: [curl, ca-certificates, openssl, openssh-client, git, unzip${claim.spec.confidential ? ", python3" : ""}]
 write_files:
-${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.socket", runnerSocketUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.service", runnerUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-agent.service", agentUnit2, "0644")}runcmd:
+${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.service", runnerUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-agent.service", agentUnit2, "0644")}runcmd:
   - [ bash, /usr/local/sbin/forgezero-guest-bootstrap ]
 ${enrolled ? `  - [ systemctl, enable, --now, forgezero-enrolment-cleanup.service ]
 ` : ""}

package/dist/provision.d.ts

@@ -110,7 +110,6 @@ export declare const DEPLOYMENT_RUNNER_USER = "forgezero-runner";
 export declare const DEPLOYMENT_GROUP = "forgezero-deploy";
 export declare const VAULT_GROUP = "forgezero-vault";
 export declare const DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
-export declare const DEPLOYMENT_RUNNER_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.socket";
 export declare const DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 export declare const ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 /**
@@ -121,8 +120,7 @@ export declare const ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-
  * the oneshot skip; a failed exchange keeps the encrypted token for a retry.
  */
 export declare function agentEnrolmentUnit(options: UnitOptions): string;
-export declare function deploymentRunnerSocketUnit(agentUser: string): string;
-export declare function deploymentRunnerUnit(options: Pick<UnitOptions, 'binPath' | 'deployRoot'>): string;
+export declare function deploymentRunnerUnit(options: Pick<UnitOptions, 'binPath' | 'deployRoot' | 'user'>): string;
 /**
  * A systemd unit for the agent.
  *

package/dist/provision.js

@@ -43,7 +43,6 @@ var DEPLOYMENT_RUNNER_USER = "forgezero-runner";
 var DEPLOYMENT_GROUP = "forgezero-deploy";
 var VAULT_GROUP = "forgezero-vault";
 var DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
-var DEPLOYMENT_RUNNER_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.socket";
 var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 var ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 function agentEnrolmentUnit(options) {
@@ -90,38 +89,29 @@ LimitCORE=0
 WantedBy=multi-user.target
 `;
 }
-function deploymentRunnerSocketUnit(agentUser) {
-  return `[Unit]
-Description=ForgeZero private project-command socket
-
-[Socket]
-ListenStream=${DEPLOYMENT_RUNNER_SOCKET}
-SocketUser=${agentUser}
-SocketGroup=${agentUser}
-SocketMode=0600
-DirectoryMode=0710
-RemoveOnStop=true
-
-[Install]
-WantedBy=sockets.target
-`;
-}
 function deploymentRunnerUnit(options) {
   const bin = options.binPath ?? "fz-agent";
   const root = options.deployRoot ?? "/opt/forgezero";
+  const agentUser = options.user ?? "forgezero-agent";
   return `[Unit]
 Description=ForgeZero credential-free project command runner
 Documentation=https://www.forgezero.net/docs/agent
-After=forgezero-deploy-runner.socket
-Requires=forgezero-deploy-runner.socket
 
 [Service]
-Type=simple
+Type=notify
+NotifyAccess=all
 User=${DEPLOYMENT_RUNNER_USER}
 Group=${DEPLOYMENT_GROUP}
 Environment=FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}
-Sockets=forgezero-deploy-runner.socket
+RuntimeDirectory=forgezero-deploy
+RuntimeDirectoryMode=0710
+ExecStartPre=+/usr/bin/install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0710 /run/forgezero-deploy
+ExecStartPre=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
 ExecStart=${bin} deploy-runner --root=${root} --home=${root}/runner-home
+ExecStartPost=+/usr/bin/chown ${agentUser}:${agentUser} ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chmod 0600 ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chown root:root /run/forgezero-deploy
+ExecStopPost=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
 Restart=always
 RestartSec=2
 UMask=0007
@@ -299,7 +289,6 @@ function planProvision(options) {
     unit: agentUnit({ ...options, mode }),
     auxiliaryUnits: [
       ...deploymentEnabled ? [
-        { path: DEPLOYMENT_RUNNER_SOCKET_UNIT_PATH, unit: deploymentRunnerSocketUnit(user) },
         { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) }
       ] : [],
       ...enrolmentEnabled ? [
@@ -366,10 +355,14 @@ function planProvision(options) {
         command: `install -d -o root -g root -m 0755 ${deployRoot} && ` + `install -d -o root -g ${DEPLOYMENT_GROUP} -m 3770 ${deployRoot}/releases && ` + `install -d -o ${user} -g ${user} -m 0750 ${deployRoot}/cache && ` + `install -d -o ${user} -g ${user} -m 0700 ${deployRoot}/agent-home && ` + `install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0700 ${deployRoot}/runner-home ${deployRoot}/runner-home/cache`
       }] : [],
       { label: "reload units", command: "systemctl daemon-reload" },
+      ...deploymentEnabled ? [{
+        label: "remove unsupported deployment socket activation",
+        command: "systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true; rm -f /etc/systemd/system/forgezero-deploy-runner.socket; systemctl daemon-reload"
+      }] : [],
       {
         label: "enable and start",
         command: `systemctl enable --now ${[
-          ...deploymentEnabled ? ["forgezero-deploy-runner.socket", "forgezero-deploy-runner.service"] : [],
+          ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
           ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
           "forgezero-agent.service"
         ].join(" ")}`
@@ -396,7 +389,6 @@ export {
   planProvision,
   modeFor,
   deploymentRunnerUnit,
-  deploymentRunnerSocketUnit,
   atLeast,
   agentUnit,
   agentEnrolmentUnit,
@@ -405,7 +397,6 @@ export {
   ENROLMENT_UNIT_PATH,
   DEPLOYMENT_RUNNER_USER,
   DEPLOYMENT_RUNNER_UNIT_PATH,
-  DEPLOYMENT_RUNNER_SOCKET_UNIT_PATH,
   DEPLOYMENT_RUNNER_SOCKET,
   DEPLOYMENT_GROUP,
   CAPABILITY_CHECKS

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.16";
+export declare const VERSION = "0.1.17";

package/package.json

@@ -1,7 +1,7 @@
 {
 	"//": "Publishing happens from an operator's machine, not CI \u2014 CLAUDE.md records that the absence of CI is deliberate. npm's `provenance` attests a tarball was built by a recognised CI provider from a named commit, so it cannot be produced here: it was set, and the first publish failed with `Automatic provenance generation not supported for provider: null`. A setting that can never be satisfied is worse than none, because it reads as a guarantee nobody is getting. Restore it the day this publishes from CI, and not before.",
 	"name": "@forgezero/agent",
-	"version": "0.1.16",
+	"version": "0.1.17",
 	"type": "module",
 	"scripts": {
 		"check": "tsc --noEmit",