@forgezero/agent 0.1.75 → 0.1.77

package/dist/agent-heartbeat.js

@@ -750,7 +750,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.75";
+var VERSION3 = "0.1.77";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1416,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.75";
+var VERSION = "0.1.77";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -1549,6 +1549,12 @@ var defaultHost2 = {
   now: Date.now
 };
 
+// src/process-input.ts
+async function writeAndCloseProcessInput(input, value) {
+  input.write(value);
+  await input.end();
+}
+
 // src/software-helper.ts
 var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
 var SOFTWARE_HELPER_GROUP = "forgezero-software";
@@ -2575,10 +2581,8 @@ var fixed = async (argv, stdin) => {
     stderr: "pipe",
     env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C", DEBIAN_FRONTEND: "noninteractive" }
   });
-  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(stdin);
-    child.stdin.end();
-  }
+  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number")
+    await writeAndCloseProcessInput(child.stdin, stdin);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
@@ -4874,8 +4878,7 @@ function localBootstrapHost() {
   const execute = async (argv, options = {}) => {
     const child = Bun.spawn([...argv], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
     if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-      child.stdin.write(options.stdin);
-      child.stdin.end();
+      await writeAndCloseProcessInput(child.stdin, options.stdin);
     }
     const [stdout, stderr, exitCode] = await Promise.all([
       new Response(child.stdout).text(),

package/dist/community-rehearsal-host.js

@@ -521,6 +521,14 @@ import { createHash as createHash2 } from "node:crypto";
 import { lstatSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { isIP } from "node:net";
 import { dirname as dirname2 } from "node:path";
+
+// src/process-input.ts
+async function writeAndCloseProcessInput(input, value) {
+  input.write(value);
+  await input.end();
+}
+
+// src/community-rehearsal-host.ts
 var COMMUNITY_REHEARSAL_VERSION = "3.11.14";
 var COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/community-cluster-api";
 var COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
@@ -722,10 +730,8 @@ function planCommunityRehearsalCleanup() {
 }
 async function exec(argv, stdin) {
   const child = Bun.spawn([...argv], { stdin: stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
-  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(stdin);
-    child.stdin.end();
-  }
+  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number")
+    await writeAndCloseProcessInput(child.stdin, stdin);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),

package/dist/deployment-connectivity.js

@@ -2,6 +2,14 @@
 import { createHash } from "node:crypto";
 import { mkdirSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
+
+// src/process-input.ts
+async function writeAndCloseProcessInput(input, value) {
+  input.write(value);
+  await input.end();
+}
+
+// src/deployment-connectivity.ts
 var TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
 var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i;
 var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -22,8 +30,7 @@ async function sealWithSystemd(name, path, value) {
     stderr: "pipe",
     env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" }
   });
-  child.stdin.write(value);
-  child.stdin.end();
+  await writeAndCloseProcessInput(child.stdin, value);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),

package/dist/fz-agent.js

@@ -9186,8 +9186,14 @@ import { tmpdir as tmpdir2 } from "os";
 import { join as join3 } from "path";
 import { fileURLToPath } from "url";
 
+// src/process-input.ts
+async function writeAndCloseProcessInput(input, value) {
+  input.write(value);
+  await input.end();
+}
+
 // src/version.ts
-var VERSION2 = "0.1.75";
+var VERSION2 = "0.1.77";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -9205,8 +9211,7 @@ var defaultExec = async (argv2, options = {}) => {
     env: { PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin", LANG: "C", LC_ALL: "C" }
   });
   if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(options.stdin);
-    child.stdin.end();
+    await writeAndCloseProcessInput(child.stdin, options.stdin);
   }
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
@@ -12854,8 +12859,7 @@ async function sealWithSystemd(name, path2, value) {
     stderr: "pipe",
     env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" }
   });
-  child.stdin.write(value);
-  child.stdin.end();
+  await writeAndCloseProcessInput(child.stdin, value);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
@@ -15383,10 +15387,8 @@ var fixed = async (argv2, stdin) => {
     stderr: "pipe",
     env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C", DEBIAN_FRONTEND: "noninteractive" }
   });
-  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(stdin);
-    child.stdin.end();
-  }
+  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number")
+    await writeAndCloseProcessInput(child.stdin, stdin);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
@@ -15901,8 +15903,7 @@ function localBootstrapHost() {
   const execute3 = async (argv2, options = {}) => {
     const child = Bun.spawn([...argv2], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
     if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-      child.stdin.write(options.stdin);
-      child.stdin.end();
+      await writeAndCloseProcessInput(child.stdin, options.stdin);
     }
     const [stdout, stderr, exitCode] = await Promise.all([
       new Response(child.stdout).text(),
@@ -16233,10 +16234,8 @@ function planCommunityRehearsalCleanup() {
 }
 async function exec(argv2, stdin) {
   const child = Bun.spawn([...argv2], { stdin: stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
-  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(stdin);
-    child.stdin.end();
-  }
+  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number")
+    await writeAndCloseProcessInput(child.stdin, stdin);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
@@ -16395,6 +16394,25 @@ async function runSupervisedApp(path2) {
   }
 }
 
+// src/stdin.ts
+async function readBoundedStdin(maxBytes) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+    throw new Error("stdin byte limit must be a positive safe integer");
+  }
+  if (process.stdin.isTTY)
+    throw new Error("stdin request pipe is required");
+  const chunks = [];
+  let bytes = 0;
+  for await (const value of process.stdin) {
+    const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
+    bytes += chunk.byteLength;
+    if (bytes > maxBytes)
+      throw new Error(`stdin request exceeds ${maxBytes} bytes`);
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks, bytes).toString("utf8");
+}
+
 // src/index.ts
 function agentCommandArgs(args, command3) {
   const index = args.indexOf(command3);
@@ -16893,7 +16911,7 @@ if (import.meta.main) {
     if (claimArg !== "-" && !claimArg.startsWith("/")) {
       throw new Error("metal-apply claim path must be absolute");
     }
-    const raw = readFileSync20(claimArg === "-" ? "/dev/stdin" : claimArg, "utf8");
+    const raw = claimArg === "-" ? await readBoundedStdin(32 * 1024) : readFileSync20(claimArg, "utf8");
     if (Buffer.byteLength(raw) > 32 * 1024)
       throw new Error("metal-apply claim exceeds 32 KiB");
     const claim = JSON.parse(raw);
@@ -16918,9 +16936,7 @@ if (import.meta.main) {
     if (commandArgs.length !== 1 || commandArgs[0] !== "--request=-") {
       throw new Error("community-rehearsal requires exactly --request=-");
     }
-    const raw = readFileSync20("/dev/stdin", "utf8");
-    if (Buffer.byteLength(raw) > 128 * 1024)
-      throw new Error("community rehearsal request exceeds 128 KiB");
+    const raw = await readBoundedStdin(128 * 1024);
     const request = parseCommunityRehearsalHostRequest(JSON.parse(raw));
     console.log(JSON.stringify(await runCommunityRehearsalHost(request)));
     process.exit(0);
@@ -16929,9 +16945,7 @@ if (import.meta.main) {
     if (args.length !== 1 || args[0] !== "--request=-") {
       throw new Error("metal-admission-proof requires exactly --request=-");
     }
-    const raw = readFileSync20("/dev/stdin", "utf8");
-    if (Buffer.byteLength(raw) > 32 * 1024)
-      throw new Error("metal admission proof request exceeds 32 KiB");
+    const raw = await readBoundedStdin(32 * 1024);
     const request = JSON.parse(raw);
     if (!/^[A-Za-z0-9_-]{1,64}$/.test(request.jobKey) || !/^[A-Za-z0-9_-]{1,64}$/.test(request.tenantKey) || !/^[A-Za-z0-9_-]{1,64}$/.test(request.projectKey) || !/^[a-z0-9][a-z0-9.-]{1,252}$/.test(request.hostname) || !/^[A-Za-z0-9_-]{32,128}$/.test(request.challenge) || !request.runnerNodeKey || !request.target?.host || !/^SHA256:[A-Za-z0-9+/]{43}$/.test(request.target.hostKeySha256)) {
       throw new Error("metal admission proof request is malformed");

package/dist/fz.js

@@ -4810,9 +4810,17 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 }
 
 // src/cli/index.ts
-init_dist();
 import { existsSync as existsSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync13 } from "fs";
 import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join12, resolve as resolve11 } from "path";
+
+// src/process-input.ts
+async function writeAndCloseProcessInput(input, value) {
+  input.write(value);
+  await input.end();
+}
+
+// src/cli/index.ts
+init_dist();
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { hostname } from "os";
 
@@ -4829,7 +4837,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.75";
+var VERSION2 = "0.1.77";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -6386,10 +6394,8 @@ var fixed = async (argv2, stdin) => {
     stderr: "pipe",
     env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C", DEBIAN_FRONTEND: "noninteractive" }
   });
-  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(stdin);
-    child.stdin.end();
-  }
+  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number")
+    await writeAndCloseProcessInput(child.stdin, stdin);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
@@ -15077,8 +15083,7 @@ function localBootstrapHost() {
   const execute = async (argv2, options = {}) => {
     const child = Bun.spawn([...argv2], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
     if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-      child.stdin.write(options.stdin);
-      child.stdin.end();
+      await writeAndCloseProcessInput(child.stdin, options.stdin);
     }
     const [stdout, stderr, exitCode] = await Promise.all([
       new Response(child.stdout).text(),
@@ -16818,8 +16823,7 @@ var defaultExec3 = async (argv2, options = {}) => {
     }
   });
   if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(options.stdin);
-    child.stdin.end();
+    await writeAndCloseProcessInput(child.stdin, options.stdin);
   }
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
@@ -18283,9 +18287,8 @@ async function cmdAgent(options, args) {
         mkdirSync13(dirname14(enrolTokenCredentialPath), { recursive: true, mode: 448 });
         const sealing = Bun.spawn(["systemd-creds", "encrypt", "--name=enrol-token", "-", enrolTokenCredentialPath], { stdin: "pipe", stdout: "ignore", stderr: "pipe" });
         if (sealing.stdin && typeof sealing.stdin !== "number") {
-          sealing.stdin.write(`${token}
+          await writeAndCloseProcessInput(sealing.stdin, `${token}
 `);
-          sealing.stdin.end();
         }
         const error = await new Response(sealing.stderr).text();
         if (await sealing.exited !== 0)

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.75";
+var VERSION = "0.1.77";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1416,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.75";
+var VERSION = "0.1.77";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -1549,6 +1549,12 @@ var defaultHost2 = {
   now: Date.now
 };
 
+// src/process-input.ts
+async function writeAndCloseProcessInput(input, value) {
+  input.write(value);
+  await input.end();
+}
+
 // src/software-helper.ts
 var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
 var SOFTWARE_HELPER_GROUP = "forgezero-software";
@@ -2575,10 +2581,8 @@ var fixed = async (argv, stdin) => {
     stderr: "pipe",
     env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C", DEBIAN_FRONTEND: "noninteractive" }
   });
-  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(stdin);
-    child.stdin.end();
-  }
+  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number")
+    await writeAndCloseProcessInput(child.stdin, stdin);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
@@ -4874,8 +4878,7 @@ function localBootstrapHost() {
   const execute = async (argv, options = {}) => {
     const child = Bun.spawn([...argv], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
     if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-      child.stdin.write(options.stdin);
-      child.stdin.end();
+      await writeAndCloseProcessInput(child.stdin, options.stdin);
     }
     const [stdout, stderr, exitCode] = await Promise.all([
       new Response(child.stdout).text(),
@@ -6351,8 +6354,7 @@ var defaultExec3 = async (argv, options = {}) => {
     }
   });
   if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(options.stdin);
-    child.stdin.end();
+    await writeAndCloseProcessInput(child.stdin, options.stdin);
   }
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),

package/dist/platform-fleet-verification.js

@@ -1628,6 +1628,14 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
 import { createHash as createHash3 } from "node:crypto";
 import { mkdirSync as mkdirSync4, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
+
+// src/process-input.ts
+async function writeAndCloseProcessInput(input, value) {
+  input.write(value);
+  await input.end();
+}
+
+// src/deployment-connectivity.ts
 var TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
 var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i;
 var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -1648,8 +1656,7 @@ async function sealWithSystemd(name, path2, value) {
     stderr: "pipe",
     env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" }
   });
-  child.stdin.write(value);
-  child.stdin.end();
+  await writeAndCloseProcessInput(child.stdin, value);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
@@ -2491,7 +2498,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.75";
+var VERSION3 = "0.1.77";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4247,10 +4254,8 @@ var fixed = async (argv2, stdin) => {
     stderr: "pipe",
     env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C", DEBIAN_FRONTEND: "noninteractive" }
   });
-  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(stdin);
-    child.stdin.end();
-  }
+  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number")
+    await writeAndCloseProcessInput(child.stdin, stdin);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
@@ -4828,8 +4833,7 @@ function localBootstrapHost() {
   const execute = async (argv2, options = {}) => {
     const child = Bun.spawn([...argv2], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
     if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-      child.stdin.write(options.stdin);
-      child.stdin.end();
+      await writeAndCloseProcessInput(child.stdin, options.stdin);
     }
     const [stdout, stderr, exitCode] = await Promise.all([
       new Response(child.stdout).text(),

package/dist/process-input.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Flush and close a Bun child-process input pipe before awaiting the child.
+ *
+ * Bun's FileSink.end() is asynchronous. Leaving its promise unobserved can
+ * keep the write half open after the payload has arrived, so a remote process
+ * that reads until EOF never advances.
+ */
+export declare function writeAndCloseProcessInput(input: {
+    write(value: string | Uint8Array): unknown;
+    end(): unknown;
+}, value: string | Uint8Array): Promise<void>;

package/dist/provision.js

@@ -1628,6 +1628,14 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
 import { createHash as createHash3 } from "node:crypto";
 import { mkdirSync as mkdirSync4, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
+
+// src/process-input.ts
+async function writeAndCloseProcessInput(input, value) {
+  input.write(value);
+  await input.end();
+}
+
+// src/deployment-connectivity.ts
 var TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
 var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i;
 var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -1648,8 +1656,7 @@ async function sealWithSystemd(name, path2, value) {
     stderr: "pipe",
     env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" }
   });
-  child.stdin.write(value);
-  child.stdin.end();
+  await writeAndCloseProcessInput(child.stdin, value);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
@@ -2491,7 +2498,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.75";
+var VERSION3 = "0.1.77";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/software-helper.js

@@ -950,6 +950,14 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
 import { createHash as createHash2 } from "node:crypto";
 import { mkdirSync as mkdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
+
+// src/process-input.ts
+async function writeAndCloseProcessInput(input, value) {
+  input.write(value);
+  await input.end();
+}
+
+// src/deployment-connectivity.ts
 var TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
 var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i;
 var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -970,8 +978,7 @@ async function sealWithSystemd(name, path2, value) {
     stderr: "pipe",
     env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" }
   });
-  child.stdin.write(value);
-  child.stdin.end();
+  await writeAndCloseProcessInput(child.stdin, value);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),

package/dist/stdin.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Read one bounded request from stdin without using a synchronous `/dev/stdin`
+ * read. Bun can busy-loop on a synchronous read when stdin is an SSH pipe;
+ * async iteration observes pipe backpressure and EOF correctly.
+ */
+export declare function readBoundedStdin(maxBytes: number): Promise<string>;

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.75";
+export declare const VERSION = "0.1.77";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.75",
+  "version": "0.1.77",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",