@forgezero/agent 0.1.64 → 0.1.65

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.64";
+var VERSION3 = "0.1.65";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.js

@@ -1396,7 +1396,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.64";
+var VERSION = "0.1.65";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/cli/agent-install.d.ts

@@ -84,6 +84,15 @@ export interface InstallOptions {
     nodeHostname?: string;
     telemetryEndpoint?: string;
 }
+export type GitIdentityInstallOptions = Pick<InstallOptions, 'gitCredentialPath' | 'gitPublicKeyPath' | 'generateGitIdentity'>;
+/**
+ * Resolve the optional compatibility Git identity from the explicit install
+ * environment. An ordinary Agent install must not load a credential merely
+ * because the CLI knows its conventional pathname: systemd treats every
+ * LoadCredentialEncrypted entry as required and refuses to start when that
+ * file does not exist.
+ */
+export declare function resolveGitIdentityInstallOptions(environment: Readonly<Record<string, string | undefined>>): GitIdentityInstallOptions;
 export declare function planInstall(options: InstallOptions): ProvisionPlan;
 /** Execute the same ordered plan the control plane executes over SSH. */
 export declare function applyPlan(plan: ProvisionPlan, run: (operation: CapabilityOperation | ProvisionOperation) => Promise<{

package/dist/fz-agent.js

@@ -8566,7 +8566,7 @@ function assertSupportedGuestImage(imageKey) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.64";
+var VERSION2 = "0.1.65";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4829,7 +4829,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.64";
+var VERSION2 = "0.1.65";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -6596,6 +6596,16 @@ async function localRunner(operation) {
 `, exitCode: 1 };
   }
 }
+function resolveGitIdentityInstallOptions(environment) {
+  const generateGitIdentity = environment.FZ_GENERATE_GIT_DEPLOY_KEY === "true";
+  const explicitCredential = environment.FZ_GIT_CREDENTIAL_PATH?.trim() || undefined;
+  const explicitPublicKey = environment.FZ_GIT_PUBLIC_KEY_PATH?.trim() || undefined;
+  return {
+    gitCredentialPath: explicitCredential ?? (generateGitIdentity ? "/etc/forgezero/creds/git-deploy-key.cred" : undefined),
+    gitPublicKeyPath: explicitPublicKey ?? (generateGitIdentity ? "/etc/forgezero/git/deploy.pub" : undefined),
+    generateGitIdentity
+  };
+}
 function planInstall(options) {
   const { capabilities, ...unit } = options;
   return planProvision({ ...unit, mode: modeFor(capabilities) });
@@ -17456,16 +17466,13 @@ async function cmdAgent(options, args) {
   }
   const enrolTokenCredentialPath = "/etc/forgezero/creds/enrol-token.cred";
   const enrolStatePath = "/var/lib/forgezero/enrolment.json";
-  const gitCredentialPath = process.env.FZ_GIT_CREDENTIAL_PATH ?? "/etc/forgezero/creds/git-deploy-key.cred";
-  const gitPublicKeyPath = process.env.FZ_GIT_PUBLIC_KEY_PATH ?? "/etc/forgezero/git/deploy.pub";
+  const gitIdentity = resolveGitIdentityInstallOptions(process.env);
   const plan = planInstall({
     capabilities: await readCapabilities(localRunner),
     socketPath: process.env.FZ_SOCKET_PATH ?? DEFAULT_SOCKET,
     seedPath: process.env.FZ_SEED_PATH ?? "/var/lib/forgezero/node.seed",
     seedCredentialPath: process.env.FZ_SEED_CREDENTIAL_PATH,
-    gitCredentialPath,
-    gitPublicKeyPath,
-    generateGitIdentity: process.env.FZ_GENERATE_GIT_DEPLOY_KEY === "true",
+    ...gitIdentity,
     controlSocketPath: process.env.FZ_CONTROL_SOCKET,
     repository: process.env.FZ_DEPLOY_REPO,
     branch: process.env.FZ_DEPLOY_BRANCH,
@@ -17550,11 +17557,11 @@ async function cmdAgent(options, args) {
     for (const step3 of transcript)
       out.ok(step3.label);
     out.ok("Agent service and socket verified");
-    if (existsSync12(gitPublicKeyPath)) {
+    if (gitIdentity.gitPublicKeyPath && existsSync12(gitIdentity.gitPublicKeyPath)) {
       out.line();
       out.line("  Compatibility SSH deploy public key:");
       out.line();
-      out.line(`  ${readFileSync15(gitPublicKeyPath, "utf8").trim()}`);
+      out.line(`  ${readFileSync15(gitIdentity.gitPublicKeyPath, "utf8").trim()}`);
       out.line();
     }
     return 0;

package/dist/metal-bootstrap.js

@@ -292,7 +292,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.64";
+var VERSION = "0.1.65";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1396,7 +1396,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.64";
+var VERSION = "0.1.65";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-fleet-verification.js

@@ -2088,7 +2088,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.64";
+var VERSION3 = "0.1.65";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -2088,7 +2088,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.64";
+var VERSION3 = "0.1.65";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.64";
+export declare const VERSION = "0.1.65";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",