@forgezero/agent 0.1.39 → 0.1.41

package/dist/agent-heartbeat.js

@@ -93,6 +93,8 @@ var checked = async (run, input, label) => {
   return result;
 };
 async function validateReleaseDirectory(directory, release, run) {
+  chmodSync(directory, 493);
+  chmodSync(join(directory, "dist"), 493);
   const manifest = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
   if (manifest.name !== release.package || manifest.version !== release.version) {
     throw new Error("agent update manifest does not match the selected release");
@@ -143,19 +145,19 @@ async function stageAgentRelease(releaseInput, options) {
     if (!timingSafeEqual(actual, expected))
       throw new Error("agent update integrity mismatch");
     writeFileSync(archive, bytes, { mode: 384, flag: "wx" });
-    await checked(run, {
-      command: "/usr/bin/tar",
-      args: [
-        "-xzf",
-        archive,
-        "-C",
-        unpacked,
-        "--strip-components=1",
-        "package/package.json",
-        "package/dist/fz-agent.js",
-        "package/dist/fz.js"
-      ]
-    }, "agent update extraction");
+    for (const [member, relative] of [
+      ["package/package.json", "package.json"],
+      ["package/dist/fz-agent.js", "dist/fz-agent.js"],
+      ["package/dist/fz.js", "dist/fz.js"]
+    ]) {
+      const extracted = await checked(run, {
+        command: "/usr/bin/tar",
+        args: ["-xOzf", archive, member]
+      }, `agent update extraction of ${member}`);
+      const destination = join(unpacked, relative);
+      mkdirSync(dirname(destination), { recursive: true, mode: 448 });
+      writeFileSync(destination, extracted.output, { mode: 384, flag: "wx" });
+    }
     await validateReleaseDirectory(unpacked, release, run);
     if (!existsSync(finalDirectory)) {
       renameSync(unpacked, finalDirectory);
@@ -744,7 +746,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.39";
+var VERSION3 = "0.1.41";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/agent-update-helper.js

@@ -93,6 +93,8 @@ var checked = async (run, input, label) => {
   return result;
 };
 async function validateReleaseDirectory(directory, release, run) {
+  chmodSync(directory, 493);
+  chmodSync(join(directory, "dist"), 493);
   const manifest = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
   if (manifest.name !== release.package || manifest.version !== release.version) {
     throw new Error("agent update manifest does not match the selected release");
@@ -143,19 +145,19 @@ async function stageAgentRelease(releaseInput, options) {
     if (!timingSafeEqual(actual, expected))
       throw new Error("agent update integrity mismatch");
     writeFileSync(archive, bytes, { mode: 384, flag: "wx" });
-    await checked(run, {
-      command: "/usr/bin/tar",
-      args: [
-        "-xzf",
-        archive,
-        "-C",
-        unpacked,
-        "--strip-components=1",
-        "package/package.json",
-        "package/dist/fz-agent.js",
-        "package/dist/fz.js"
-      ]
-    }, "agent update extraction");
+    for (const [member, relative] of [
+      ["package/package.json", "package.json"],
+      ["package/dist/fz-agent.js", "dist/fz-agent.js"],
+      ["package/dist/fz.js", "dist/fz.js"]
+    ]) {
+      const extracted = await checked(run, {
+        command: "/usr/bin/tar",
+        args: ["-xOzf", archive, member]
+      }, `agent update extraction of ${member}`);
+      const destination = join(unpacked, relative);
+      mkdirSync(dirname(destination), { recursive: true, mode: 448 });
+      writeFileSync(destination, extracted.output, { mode: 384, flag: "wx" });
+    }
     await validateReleaseDirectory(unpacked, release, run);
     if (!existsSync(finalDirectory)) {
       renameSync(unpacked, finalDirectory);

package/dist/agent-update.js

@@ -93,6 +93,8 @@ var checked = async (run, input, label) => {
   return result;
 };
 async function validateReleaseDirectory(directory, release, run) {
+  chmodSync(directory, 493);
+  chmodSync(join(directory, "dist"), 493);
   const manifest = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
   if (manifest.name !== release.package || manifest.version !== release.version) {
     throw new Error("agent update manifest does not match the selected release");
@@ -143,19 +145,19 @@ async function stageAgentRelease(releaseInput, options) {
     if (!timingSafeEqual(actual, expected))
       throw new Error("agent update integrity mismatch");
     writeFileSync(archive, bytes, { mode: 384, flag: "wx" });
-    await checked(run, {
-      command: "/usr/bin/tar",
-      args: [
-        "-xzf",
-        archive,
-        "-C",
-        unpacked,
-        "--strip-components=1",
-        "package/package.json",
-        "package/dist/fz-agent.js",
-        "package/dist/fz.js"
-      ]
-    }, "agent update extraction");
+    for (const [member, relative] of [
+      ["package/package.json", "package.json"],
+      ["package/dist/fz-agent.js", "dist/fz-agent.js"],
+      ["package/dist/fz.js", "dist/fz.js"]
+    ]) {
+      const extracted = await checked(run, {
+        command: "/usr/bin/tar",
+        args: ["-xOzf", archive, member]
+      }, `agent update extraction of ${member}`);
+      const destination = join(unpacked, relative);
+      mkdirSync(dirname(destination), { recursive: true, mode: 448 });
+      writeFileSync(destination, extracted.output, { mode: 384, flag: "wx" });
+    }
     await validateReleaseDirectory(unpacked, release, run);
     if (!existsSync(finalDirectory)) {
       renameSync(unpacked, finalDirectory);

package/dist/bootstrap.d.ts

@@ -19,6 +19,12 @@ export interface PlatformBootstrapConfig {
     branch: string;
     deployRoot?: string;
     telemetryEndpoint: string;
+    /**
+     * Pipeline secret name -> encrypted systemd credential source. The Agent asks
+     * its project Vault replica first and uses only the same-name entry here while
+     * that replica is unavailable or has not received the secret yet.
+     */
+    deploymentCredentials?: Record<string, string>;
     database: {
         role: DatabaseBootstrapRole;
         /** Genesis master/joiners are Agency members; elastic joiners normally use `none`. */
@@ -69,6 +75,8 @@ export interface TenantBootstrapConfig {
     realm: string;
     nodeHostname: string;
     telemetryEndpoint: string;
+    /** Same Vault-first, same-name systemd fallback contract as platform deploys. */
+    deploymentCredentials?: Record<string, string>;
     enrolTokenFile: string;
     repository?: string;
     branch?: string;
@@ -76,6 +84,11 @@ export interface TenantBootstrapConfig {
     deployRoot?: string;
     software?: SoftwareRequirement[];
     installCloudflared?: boolean;
+    /** Optional node-specific attended Tunnel/KV handoff, identical to platform hosts. */
+    cloudflareHandoff?: {
+        handoffFile: string;
+        nodeName: string;
+    };
     /** Local-only runner authority. The API receives only the resulting node scope. */
     bootstrapRunner?: {
         sshPrivateKeyFile: string;