@forgezero/agent 0.1.53 → 0.1.56

package/dist/deploy-file.js

@@ -4,6 +4,7 @@ import {
   accessSync,
   chmodSync,
   copyFileSync,
+  existsSync,
   mkdtempSync,
   mkdirSync,
   readFileSync,
@@ -24,6 +25,7 @@ var OS_CATALOG = [
 ];
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -33,6 +35,7 @@ var SOFTWARE_CATALOG = [
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-26.04" } },
   { requirement: { id: "nginx", version: "ubuntu-26.04" } },
   { requirement: { id: "arangodb", version: "3.11.14" } },
   { requirement: { id: "cloudflared", version: "2026.7.3" } },
@@ -41,6 +44,15 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "openssh-client", version: "ubuntu-26.04" } }
 ];
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
+var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
+  "data-root": "/var/lib/docker",
+  "storage-driver": "overlay2",
+  "live-restore": true,
+  "log-driver": "local",
+  "log-opts": { "max-size": "10m", "max-file": "3" }
+}, null, 2)}
+`;
 var softwareSpawnFailure = (cause, argv) => cause.code === "ENOENT" ? { exitCode: 127, output: `executable is absent: ${argv[0]}` } : undefined;
 var runSoftwareCommand = async (argv, env = {}) => {
   let child;
@@ -83,6 +95,15 @@ async function executeSoftwareOperation(operation) {
   if (operation.kind === "check") {
     if (software === "bun")
       return run(["/usr/local/bin/bun", "--version"]).then((r) => ({ ...r, exitCode: successful(r, /^1\.3\.14\s*$/m) ? 0 : 1 }));
+    if (software === "docker") {
+      const binary = await run(["/usr/bin/docker", "--version"]);
+      if (!successful(binary, /Docker version/))
+        return { ...binary, exitCode: 1 };
+      if (!existsSync(DOCKER_DAEMON_PATH) || readFileSync(DOCKER_DAEMON_PATH, "utf8") !== DOCKER_DAEMON_CONFIG)
+        return { exitCode: 1, output: "Docker daemon policy is absent or differs from the reviewed ForgeZero policy" };
+      const active = await run(["/usr/bin/systemctl", "is-active", "--quiet", "docker.service"]);
+      return active.exitCode === 0 ? { exitCode: 0, output: binary.output } : active;
+    }
     if (software === "nginx") {
       const binary = await run(["/usr/sbin/nginx", "-v"]);
       return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
@@ -115,11 +136,22 @@ async function executeSoftwareOperation(operation) {
       return { exitCode: 1, output: cause instanceof Error ? cause.message : String(cause) };
     }
   }
-  if (software === "nginx" || software === "ufw" || software === "openssh-client") {
-    const installed = await aptInstall(software === "openssh-client" ? "openssh-client" : software);
-    if (installed.exitCode !== 0 || software !== "nginx")
+  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client") {
+    const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
+    const installed = await aptInstall(packageName);
+    if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
       return installed;
-    return run(["/usr/bin/systemctl", "enable", "--now", "nginx.service"]);
+    if (software === "docker") {
+      mkdirSync("/etc/docker", { recursive: true, mode: 493 });
+      if (existsSync(DOCKER_DAEMON_PATH) && readFileSync(DOCKER_DAEMON_PATH, "utf8") !== DOCKER_DAEMON_CONFIG) {
+        return { exitCode: 2, output: "refusing to overwrite an existing Docker daemon configuration that differs from the reviewed ForgeZero policy" };
+      }
+      if (!existsSync(DOCKER_DAEMON_PATH))
+        writeFileSync(DOCKER_DAEMON_PATH, DOCKER_DAEMON_CONFIG, { mode: 420, flag: "wx" });
+      const enabled = await run(["/usr/bin/systemctl", "enable", "docker.service"]);
+      return enabled.exitCode === 0 ? run(["/usr/bin/systemctl", "restart", "docker.service"]) : enabled;
+    }
+    return run(["/usr/bin/systemctl", "enable", "--now", `${software}.service`]);
   }
   const directory = mkdtempSync(join(tmpdir(), "forgezero-software-"));
   try {
@@ -204,7 +236,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };
@@ -678,7 +710,7 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
 
 // src/deploy-file.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { basename, join as join2 } from "node:path";
 var DEPLOY_FILE = ".fz/deploy.json";
 var DEPLOY_TODO_PREFIX = "ForgeZero pipeline TODO:";
@@ -699,17 +731,17 @@ var safeName = (value) => {
 };
 function packageHints(root) {
   const packagePath = join2(root, "package.json");
-  if (!existsSync(packagePath))
-    return { bun: existsSync(join2(root, "bun.lock")) };
+  if (!existsSync2(packagePath))
+    return { bun: existsSync2(join2(root, "bun.lock")) };
   try {
     const manifest = JSON.parse(readFileSync2(packagePath, "utf8"));
     return {
       name: typeof manifest.name === "string" ? manifest.name : undefined,
       build: typeof manifest.scripts?.build === "string" ? ["bun", "run", "build"] : undefined,
-      bun: existsSync(join2(root, "bun.lock")) || existsSync(join2(root, "bun.lockb"))
+      bun: existsSync2(join2(root, "bun.lock")) || existsSync2(join2(root, "bun.lockb"))
     };
   } catch {
-    return { bun: existsSync(join2(root, "bun.lock")) };
+    return { bun: existsSync2(join2(root, "bun.lock")) };
   }
 }
 var blocker = (instruction) => ["fz-agent", "pipeline-todo", `${DEPLOY_TODO_PREFIX} ${instruction}`];
@@ -746,7 +778,7 @@ function defaultDeployFile(root, options = {}) {
 }
 function inspectDeployFile(root, options = {}) {
   const path2 = join2(root, DEPLOY_FILE);
-  if (!existsSync(path2))
+  if (!existsSync2(path2))
     throw new Error(`${DEPLOY_FILE} does not exist; run \`fz deploy init\`.`);
   const raw = JSON.parse(readFileSync2(path2, "utf8"));
   const definition = parseDeployDefinition(raw, options);
@@ -772,7 +804,7 @@ function inspectDeployFile(root, options = {}) {
 }
 function initializeDeployFile(root, options = {}) {
   const path2 = join2(root, DEPLOY_FILE);
-  if (existsSync(path2) && !options.force) {
+  if (existsSync2(path2) && !options.force) {
     throw new Error(`${DEPLOY_FILE} already exists; use --force only when replacing it deliberately.`);
   }
   const raw = defaultDeployFile(root, options);

package/dist/deploy-plan-runner.d.ts

@@ -0,0 +1,65 @@
+import type { Condition, JsonObject, JsonValue } from './deploy';
+import { type DeploymentPlan, type PlannedStage, type PlannedStep } from './deploy-plan';
+export type PlanStepStatus = 'pending' | 'running' | 'succeeded' | 'failed' | 'skipped' | 'compensated' | 'manual-intervention';
+export type ActionFailureKind = 'network' | 'timeout' | 'provider-unavailable' | 'rate-limited' | 'conflict' | 'refused' | 'failed';
+export declare class DeploymentActionError extends Error {
+    readonly kind: ActionFailureKind;
+    constructor(kind: ActionFailureKind, message: string);
+}
+export interface ActionExecutionResult {
+    outputs?: JsonObject;
+    changed?: boolean;
+    evidence?: JsonObject;
+}
+export interface ActionContext {
+    plan: DeploymentPlan;
+    workflow: string;
+    stage: PlannedStage;
+    step: PlannedStep;
+    inputs: Readonly<Record<string, JsonValue>>;
+    resolved: JsonObject;
+    attempt: number;
+    signal: AbortSignal;
+}
+export type ActionHandler = (context: ActionContext) => Promise<ActionExecutionResult>;
+export interface StepExecutionRecord {
+    id: string;
+    stage: string;
+    action: string;
+    status: PlanStepStatus;
+    attempts: number;
+    startedAtTs?: number;
+    finishedAtTs?: number;
+    outputs: JsonObject;
+    changed: boolean;
+    error?: {
+        kind: ActionFailureKind;
+        message: string;
+    };
+    evidence?: JsonObject;
+}
+export interface PlanRunResult {
+    workflow: string;
+    ok: boolean;
+    status: 'succeeded' | 'failed' | 'manual-intervention';
+    steps: readonly StepExecutionRecord[];
+}
+interface EvaluationState {
+    inputs: Readonly<Record<string, JsonValue>>;
+    steps: Map<string, StepExecutionRecord>;
+    plan: DeploymentPlan;
+}
+export declare function evaluateCondition(value: Condition, state: EvaluationState): boolean;
+export interface RunDeploymentPlanOptions {
+    plan: DeploymentPlan | unknown;
+    workflow: string;
+    inputs?: Readonly<Record<string, JsonValue>>;
+    actions: Readonly<Record<string, ActionHandler>>;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    lock?: <T>(group: string, limit: number, run: () => Promise<T>) => Promise<T>;
+    /** Control-plane placement filter; false records a deterministic skip. */
+    shouldRun?: (step: PlannedStep) => boolean;
+}
+export declare function runDeploymentPlan(options: RunDeploymentPlanOptions): Promise<PlanRunResult>;
+export {};