@forgezero/agent 0.1.39 → 0.1.40

package/dist/fz-agent.js

@@ -5814,31 +5814,86 @@ function deriveKeysFromSeed(seed) {
   const edPublic = ed25519.getPublicKey(edSecret);
   const mlKeys = ml_dsa65.keygen(mlSeed);
   mlSeed.fill(0);
-  return {
+  const result = {
     ed25519: { publicKey: b64(edPublic), secretKey: b64(edSecret) },
     mlDsa: { publicKey: b64(mlKeys.publicKey), secretKey: b64(mlKeys.secretKey) }
   };
+  edSecret.fill(0);
+  mlKeys.secretKey.fill(0);
+  return result;
 }
 var RESPONSE_KEY_HEADER = "x-fz-response-key";
+var REQUEST_SIGNATURE_SUITE = "ed25519+ml-dsa-65";
+var RESPONSE_SEALING_SUITE = "ml-kem-768+x25519/aes-256-gcm";
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var encodedLength = (bytes) => Math.ceil(bytes * 4 / 3);
+var length = (value, name) => {
+  if (!Number.isSafeInteger(value) || value <= 0)
+    throw new Error(`identity: ${name} length unavailable`);
+  return value;
+};
+var ED_PUBLIC_BYTES = length(ed25519.lengths.publicKey, "Ed25519 public key");
+var ED_SIGNATURE_BYTES = length(ed25519.lengths.signature, "Ed25519 signature");
+var ML_PUBLIC_BYTES = length(ml_dsa65.lengths.publicKey, "ML-DSA-65 public key");
+var ML_SIGNATURE_BYTES = length(ml_dsa65.lengths.signature, "ML-DSA-65 signature");
+var RESPONSE_PUBLIC_BYTES = length(ml_kem768_x25519.lengths.publicKey, "hybrid response public key");
+var RESPONSE_SECRET_BYTES = length(ml_kem768_x25519.lengths.secretKey, "hybrid response secret key");
+var RESPONSE_CIPHERTEXT_BYTES = length(ml_kem768_x25519.lengths.cipherText, "hybrid response ciphertext");
+function exactBytes(value, bytes) {
+  if (typeof value !== "string" || value.length !== encodedLength(bytes) || !BASE64URL.test(value))
+    return null;
+  try {
+    const decoded = un64(value);
+    return decoded.length === bytes && b64(decoded) === value ? decoded : null;
+  } catch {
+    return null;
+  }
+}
+function validIdentity(value) {
+  return typeof value === "string" && value.length >= 1 && value.length <= 128 && !/[^A-Za-z0-9_.:@/-]/.test(value) && !/[\0\r\n]/.test(value);
+}
+function validResponsePublicKey(value) {
+  return exactBytes(value, RESPONSE_PUBLIC_BYTES) !== null;
+}
 function generateResponseRecipient() {
   const pair = ml_kem768_x25519.keygen();
   return { publicKey: b64(pair.publicKey), secretKey: b64(pair.secretKey) };
 }
 var responseKey = (sharedSecret) => hkdf(sha256, sharedSecret, undefined, ENCODER.encode("forgezero/response/ml-kem-768+x25519/v1"), 32);
 async function openResponse(recipientSecretKey, requestBinding, envelope) {
-  if (envelope?.version !== 1)
+  if (!requestBinding || requestBinding.length > 16384 || /[\0\r\n]/.test(requestBinding)) {
+    throw new Error("response: malformed request binding");
+  }
+  if (envelope?.version !== 1 || envelope.suite !== RESPONSE_SEALING_SUITE) {
     throw new Error("response: unsupported sealed response");
-  const sharedSecret = ml_kem768_x25519.decapsulate(un64(envelope.kemCiphertext), un64(recipientSecretKey));
+  }
+  const kemCiphertext = exactBytes(envelope.kemCiphertext, RESPONSE_CIPHERTEXT_BYTES);
+  const nonce = exactBytes(envelope.nonce, 12);
+  if (!kemCiphertext || !nonce || typeof envelope.ciphertext !== "string" || envelope.ciphertext.length < encodedLength(16) || envelope.ciphertext.length > encodedLength(16 * 1024 * 1024) || !BASE64URL.test(envelope.ciphertext)) {
+    throw new Error("response: malformed sealed response");
+  }
+  let encodedCiphertext;
+  try {
+    encodedCiphertext = un64(envelope.ciphertext);
+  } catch {
+    throw new Error("response: malformed sealed response");
+  }
+  if (encodedCiphertext.length < 16 || encodedCiphertext.length > 16 * 1024 * 1024 || b64(encodedCiphertext) !== envelope.ciphertext) {
+    throw new Error("response: malformed sealed response");
+  }
+  const sharedSecret = ml_kem768_x25519.decapsulate(kemCiphertext, exactBytes(recipientSecretKey, RESPONSE_SECRET_BYTES) ?? (() => {
+    throw new Error("response: malformed recipient secret key");
+  })());
   const rawKey = responseKey(sharedSecret);
   sharedSecret.fill(0);
   const key = await crypto.subtle.importKey("raw", new Uint8Array(rawKey), "AES-GCM", false, ["decrypt"]);
   rawKey.fill(0);
   const decrypted = new Uint8Array(await crypto.subtle.decrypt({
     name: "AES-GCM",
-    iv: new Uint8Array(un64(envelope.nonce)),
+    iv: new Uint8Array(nonce),
     additionalData: new Uint8Array(ENCODER.encode(requestBinding)),
     tagLength: 128
-  }, key, new Uint8Array(un64(envelope.ciphertext))));
+  }, key, new Uint8Array(encodedCiphertext)));
   try {
     return JSON.parse(new TextDecoder().decode(decrypted));
   } finally {
@@ -5846,6 +5901,8 @@ async function openResponse(recipientSecretKey, requestBinding, envelope) {
   }
 }
 var SIGNATURE_FIELDS = (envelope) => ({
+  version: envelope.version,
+  suite: envelope.suite,
   timestamp: envelope.timestamp,
   nonce: envelope.nonce,
   edSignature: envelope.edSignature,
@@ -5855,9 +5912,15 @@ function encodeSignatureHeader(envelope) {
   return b64(ENCODER.encode(JSON.stringify(SIGNATURE_FIELDS(envelope))));
 }
 function canonicalString(args) {
+  if (!validIdentity(args.identity) || !/^[A-Za-z][A-Za-z0-9-]{0,31}$/.test(args.method) || /[\0\r\n]/.test(args.path) || /[\0\r\n]/.test(args.query) || !exactBytes(args.nonce, 16) || args.responseKey !== undefined && !validResponsePublicKey(args.responseKey)) {
+    throw new Error("identity: malformed canonical request");
+  }
   const body = typeof args.body === "string" ? ENCODER.encode(args.body) : args.body;
   const digest = Array.from(sha256(body), (byte) => byte.toString(16).padStart(2, "0")).join("");
   const fields = [
+    "forgezero/request-signature/v1",
+    REQUEST_SIGNATURE_SUITE,
+    args.identity,
     args.method.toUpperCase(),
     args.path,
     args.query ?? "",
@@ -5865,16 +5928,17 @@ function canonicalString(args) {
     args.nonce,
     digest
   ];
-  if (args.responseKey)
-    fields.push(args.responseKey);
+  fields.push(args.responseKey ?? "-");
   return fields.join(`
 `);
 }
 function signRequest(keys, nodeKey, args) {
   const timestamp = Math.floor(Date.now() / 1000);
   const nonce = b64(randomBytes6(16));
-  const message = ENCODER.encode(canonicalString({ ...args, query: args.query ?? "", timestamp, nonce }));
+  const message = ENCODER.encode(canonicalString({ ...args, identity: nodeKey, query: args.query ?? "", timestamp, nonce }));
   return {
+    version: 1,
+    suite: REQUEST_SIGNATURE_SUITE,
     nodeKey,
     timestamp,
     nonce,
@@ -6664,8 +6728,8 @@ var UBUNTU_2604_X64 = [
   },
   {
     requirement: { id: "arangodb", version: "3.11.14" },
-    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14'`,
-    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install`
+    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14' && ` + `! systemctl is-active --quiet arangodb3.service && ` + `! systemctl is-enabled --quiet arangodb3.service`,
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install; ` + `systemctl disable --now arangodb3.service`
   },
   {
     requirement: { id: "cloudflared", version: "2026.7.3" },
@@ -10271,6 +10335,8 @@ var checked4 = async (run, input, label) => {
   return result;
 };
 async function validateReleaseDirectory(directory, release, run) {
+  chmodSync10(directory, 493);
+  chmodSync10(join5(directory, "dist"), 493);
   const manifest = JSON.parse(readFileSync7(join5(directory, "package.json"), "utf8"));
   if (manifest.name !== release.package || manifest.version !== release.version) {
     throw new Error("agent update manifest does not match the selected release");
@@ -10321,19 +10387,19 @@ async function stageAgentRelease(releaseInput, options) {
     if (!timingSafeEqual(actual, expected))
       throw new Error("agent update integrity mismatch");
     writeFileSync7(archive, bytes, { mode: 384, flag: "wx" });
-    await checked4(run, {
-      command: "/usr/bin/tar",
-      args: [
-        "-xzf",
-        archive,
-        "-C",
-        unpacked,
-        "--strip-components=1",
-        "package/package.json",
-        "package/dist/fz-agent.js",
-        "package/dist/fz.js"
-      ]
-    }, "agent update extraction");
+    for (const [member, relative] of [
+      ["package/package.json", "package.json"],
+      ["package/dist/fz-agent.js", "dist/fz-agent.js"],
+      ["package/dist/fz.js", "dist/fz.js"]
+    ]) {
+      const extracted = await checked4(run, {
+        command: "/usr/bin/tar",
+        args: ["-xOzf", archive, member]
+      }, `agent update extraction of ${member}`);
+      const destination = join5(unpacked, relative);
+      mkdirSync6(dirname4(destination), { recursive: true, mode: 448 });
+      writeFileSync7(destination, extracted.output, { mode: 384, flag: "wx" });
+    }
     await validateReleaseDirectory(unpacked, release, run);
     if (!existsSync10(finalDirectory)) {
       renameSync4(unpacked, finalDirectory);
@@ -10852,7 +10918,7 @@ function requestAgentUpdate(request, socketPath = DEFAULT_AGENT_UPDATE_SOCKET, t
 import { readFileSync as readFileSync9 } from "fs";
 
 // src/version.ts
-var VERSION3 = "0.1.39";
+var VERSION3 = "0.1.40";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");
@@ -11506,21 +11572,21 @@ async function boundedResponseJson(response) {
     return null;
   const reader = response.body.getReader();
   const chunks = [];
-  let length = 0;
+  let length2 = 0;
   while (true) {
     const next = await reader.read();
     if (next.done)
       break;
-    length += next.value.byteLength;
-    if (length > AGENT_OTLP_MAX_RESPONSE_BYTES) {
+    length2 += next.value.byteLength;
+    if (length2 > AGENT_OTLP_MAX_RESPONSE_BYTES) {
       await reader.cancel();
       throw new PermanentExportError;
     }
     chunks.push(next.value);
   }
-  if (length === 0)
+  if (length2 === 0)
     return null;
-  const bytes = new Uint8Array(length);
+  const bytes = new Uint8Array(length2);
   let offset = 0;
   for (const chunk of chunks) {
     bytes.set(chunk, offset);
@@ -11961,6 +12027,56 @@ class AgentTelemetryRuntime {
   }
 }
 
+// src/credential-schema.ts
+var AGENT_CREDENTIAL_LOCATIONS = [
+  "operator",
+  "metal",
+  "platform-compute",
+  "tenant-compute"
+];
+var AGENT_CREDENTIAL_POLICY = {
+  operator: { vault: false, systemdFallback: false, attendedFile: true },
+  metal: { vault: false, systemdFallback: true, attendedFile: false },
+  "platform-compute": { vault: true, systemdFallback: true, attendedFile: false },
+  "tenant-compute": { vault: true, systemdFallback: true, attendedFile: false }
+};
+var CREDENTIAL_NAME = /^[A-Z_][A-Z0-9_]*$/;
+var SCOPE_PART2 = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+function deploymentCredentialSchema(input) {
+  if (!SCOPE_PART2.test(input.projectKey) || !SCOPE_PART2.test(input.environmentKey)) {
+    throw new Error("agent: deployment credential scope is malformed");
+  }
+  const systemd = [...new Set(input.systemdCredentials ?? [])].sort();
+  for (const name of systemd) {
+    if (!CREDENTIAL_NAME.test(name)) {
+      throw new Error(`agent: invalid pipeline credential name ${name}.`);
+    }
+  }
+  return {
+    version: 1,
+    location: input.realm === "platform" ? "platform-compute" : "tenant-compute",
+    projectKey: input.projectKey,
+    environmentKey: input.environmentKey,
+    credentials: systemd.map((name) => ({
+      name,
+      vaultCacheKey: projectVaultCacheKey({ environment: input.environmentKey, name }),
+      systemdCredential: name
+    }))
+  };
+}
+function credentialBinding(schema, name) {
+  if (!CREDENTIAL_NAME.test(name))
+    throw new Error(`agent: invalid pipeline credential name ${name}.`);
+  const declared = schema.credentials.find((entry) => entry.name === name);
+  return declared ?? {
+    name,
+    vaultCacheKey: projectVaultCacheKey({ environment: schema.environmentKey, name })
+  };
+}
+var METAL_SYSTEMD_CREDENTIALS = {
+  identity: "metal-agent-seed"
+};
+
 // src/index.ts
 function loadOrCreateSeed(path) {
   if (existsSync13(path)) {
@@ -12036,6 +12152,31 @@ function createSystemdDeploymentSecrets(names, directory = process.env.CREDENTIA
     }
   };
 }
+function createDeploymentSecretResolver(schema, primary, fallback) {
+  if (!primary)
+    return fallback;
+  return {
+    async get(name) {
+      const binding = credentialBinding(schema, name);
+      try {
+        return await primary.get(binding.vaultCacheKey);
+      } catch (cause) {
+        if (binding.systemdCredential && fallback?.has(binding.systemdCredential)) {
+          return fallback.get(binding.systemdCredential);
+        }
+        throw cause;
+      }
+    }
+  };
+}
+async function initializeVaultReplica(cache) {
+  try {
+    const result = await cache.load();
+    return result.failed.length === 0 ? { state: "ready", loaded: result.loaded, failed: result.failed } : { state: "partial", loaded: result.loaded, failed: result.failed };
+  } catch {
+    return { state: "unavailable", loaded: 0, failed: [] };
+  }
+}
 function runAgent(config = {}) {
   const seed = config.seed ?? configuredAgentSeed({
     credential: config.seedCredential,
@@ -12043,6 +12184,7 @@ function runAgent(config = {}) {
     allowFileSeed: config.allowFileSeed
   });
   const keys = deriveKeysFromSeed(seed);
+  seed.fill(0);
   const nodeKey = config.nodeKey ?? keys.ed25519.publicKey;
   const options = {
     socketPath: config.socketPath ?? DEFAULT_SOCKET_PATH,
@@ -12110,6 +12252,7 @@ if (import.meta.main) {
       allowFileSeed
     });
     const keys2 = deriveKeysFromSeed(seed);
+    seed.fill(0);
     console.log(JSON.stringify({
       nodeKey: keys2.ed25519.publicKey,
       publicKeys: { ed25519: keys2.ed25519.publicKey, mlDsa: keys2.mlDsa.publicKey }
@@ -12128,6 +12271,7 @@ if (import.meta.main) {
       allowFileSeed
     });
     const keys2 = deriveKeysFromSeed(seed);
+    seed.fill(0);
     const nodeKey2 = process.env.FZ_NODE_KEY ?? keys2.ed25519.publicKey;
     const binding2 = await enrolGuestIdentity({
       apiUrl: process.env.FZ_API,
@@ -12358,6 +12502,7 @@ if (import.meta.main) {
       allowFileSeed
     });
     const keys2 = deriveKeysFromSeed(seed);
+    seed.fill(0);
     const nodeKey2 = process.env.FZ_NODE_KEY ?? keys2.ed25519.publicKey;
     const pull = startProvisioningPull({
       apiUrl: process.env.FZ_API,
@@ -12496,23 +12641,26 @@ if (import.meta.main) {
     }));
     console.log(`[agent] initial SEV-SNP attestation verified ${result.measurement.slice(0, 16)}\u2026`);
   }
-  if (binding?.realm === "tenant" && nodeApiUrl) {
+  if (binding && nodeApiUrl) {
     secretCache = createNodeVaultCache({
       apiUrl: nodeApiUrl,
       nodeKey,
       keys,
       projectKey: binding.projectKey
     });
-    const loaded = await telemetry.observe("vault.sync", () => secretCache.load(), (result) => result.failed.length > 0 ? "failed" : "success");
-    if (loaded.failed.length > 0) {
-      throw new Error(`agent: failed to load ${loaded.failed.length} assigned vault entries`);
-    }
+    const initialVault = await telemetry.observe("vault.sync", () => initializeVaultReplica(secretCache), (result) => result.state === "ready" ? "success" : "failed");
     running.setVault(secretCache, binding.projectKey);
     vaultSync = startNodeVaultSync(secretCache, {
       telemetry,
       onEvent: (event, detail) => console.log(`[agent] vault ${event}${detail ? ` ${JSON.stringify(detail)}` : ""}`)
     });
-    console.log(`[agent] in-memory vault loaded for every environment in project ${binding.projectKey}`);
+    if (initialVault.state === "ready") {
+      console.log(`[agent] in-memory vault loaded for every environment in project ${binding.projectKey}`);
+    } else if (initialVault.state === "partial") {
+      console.error(`[agent] vault replica partial (${initialVault.loaded} loaded, ${initialVault.failed.length} unavailable); ` + "explicit same-name systemd deployment fallbacks remain available");
+    } else {
+      console.error("[agent] vault replica unavailable; authenticated refresh remains active and only explicit " + "same-name systemd deployment fallbacks are available");
+    }
   }
   const attestationLoop = attestationSource && nodeApiUrl ? startNodeAttestation({
     apiUrl: nodeApiUrl,
@@ -12557,17 +12705,14 @@ if (import.meta.main) {
   if (bootstrapPull)
     console.log("[agent] PQ-authenticated delegated SSH bootstrap claims enabled");
   const systemdDeploymentSecrets = createSystemdDeploymentSecrets(process.env.FZ_DEPLOY_SYSTEMD_SECRETS);
-  const deploymentSecrets = secretCache ? {
-    async get(name) {
-      try {
-        return await secretCache.get(name);
-      } catch (cause) {
-        if (systemdDeploymentSecrets?.has(name))
-          return systemdDeploymentSecrets.get(name);
-        throw cause;
-      }
-    }
-  } : systemdDeploymentSecrets;
+  const deploymentCredentialNames = (process.env.FZ_DEPLOY_SYSTEMD_SECRETS ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+  const deploymentSchema = binding ? deploymentCredentialSchema({
+    realm: binding.realm,
+    projectKey: binding.projectKey,
+    environmentKey: binding.environmentKey,
+    systemdCredentials: deploymentCredentialNames
+  }) : undefined;
+  const deploymentSecrets = deploymentSchema ? createDeploymentSecretResolver(deploymentSchema, secretCache, systemdDeploymentSecrets) : systemdDeploymentSecrets;
   const repository = process.env.FZ_DEPLOY_REPO;
   const branch = process.env.FZ_DEPLOY_BRANCH;
   const profile = process.env.FZ_DEPLOY_PROFILE;
@@ -12835,6 +12980,7 @@ export {
   loadOrCreateSeed,
   loadLifecycleProfile,
   loadGuestBinding,
+  initializeVaultReplica,
   heartbeatAgentOnce,
   handleRequest,
   handleApplicationRequest,
@@ -12843,10 +12989,13 @@ export {
   executeLifecycleAction,
   ensureSoftwareRequirements,
   enrolGuestIdentity,
+  deploymentCredentialSchema,
+  credentialBinding,
   createSystemdDeploymentSecrets,
   createSnpAttestationSource,
   createSecretCache,
   createNodeVaultCache,
+  createDeploymentSecretResolver,
   createDeploymentManager,
   createAgentTelemetry,
   configuredAgentSeed,
@@ -12868,6 +13017,7 @@ export {
   SOFTWARE_HELPER_GROUP,
   SOFTWARE_CATALOG,
   OS_CATALOG,
+  METAL_SYSTEMD_CREDENTIALS,
   MAX_AGENT_TARBALL_BYTES,
   DeploymentError,
   DEFAULT_SOFTWARE_HELPER_SOCKET,
@@ -12891,5 +13041,7 @@ export {
   AGENT_TELEMETRY_OUTCOMES,
   AGENT_TELEMETRY_OPERATIONS,
   AGENT_TELEMETRY_EVENTS,
-  AGENT_EGRESS_TABLE
+  AGENT_EGRESS_TABLE,
+  AGENT_CREDENTIAL_POLICY,
+  AGENT_CREDENTIAL_LOCATIONS
 };