@forgezero/agent 0.1.77 → 0.1.79

package/dist/agent-heartbeat.js

@@ -750,7 +750,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.77";
+var VERSION3 = "0.1.79";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1416,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.77";
+var VERSION = "0.1.79";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/community-rehearsal-host.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/definition.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/deploy-file.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/fz-agent.js

@@ -5114,16 +5114,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha2562, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync2(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync2(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });
@@ -9193,7 +9215,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.77";
+var VERSION2 = "0.1.79";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -16401,16 +16423,21 @@ async function readBoundedStdin(maxBytes) {
   }
   if (process.stdin.isTTY)
     throw new Error("stdin request pipe is required");
-  const chunks = [];
-  let bytes = 0;
-  for await (const value of process.stdin) {
-    const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
-    bytes += chunk.byteLength;
-    if (bytes > maxBytes)
-      throw new Error(`stdin request exceeds ${maxBytes} bytes`);
-    chunks.push(chunk);
-  }
-  return Buffer.concat(chunks, bytes).toString("utf8");
+  const reader = Bun.spawn(["/usr/bin/head", "-c", String(maxBytes + 1)], {
+    stdin: "inherit",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(reader.stdout).arrayBuffer(),
+    new Response(reader.stderr).text(),
+    reader.exited
+  ]);
+  if (exitCode !== 0)
+    throw new Error(`stdin reader failed (${exitCode}): ${stderr.trim()}`);
+  if (stdout.byteLength > maxBytes)
+    throw new Error(`stdin request exceeds ${maxBytes} bytes`);
+  return Buffer.from(stdout).toString("utf8");
 }
 
 // src/index.ts

package/dist/fz.js

@@ -4837,7 +4837,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.77";
+var VERSION2 = "0.1.79";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.77";
+var VERSION = "0.1.79";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-helper-socket.js

@@ -305,16 +305,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/metal-provision.js

@@ -305,16 +305,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/operator-bootstrap.js

@@ -1416,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.77";
+var VERSION = "0.1.79";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-bootstrap-runtime.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/platform-fleet-verification.js

@@ -843,16 +843,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync3(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync3(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync3(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync3(destination, { force: true });
@@ -2498,7 +2520,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.77";
+var VERSION3 = "0.1.79";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/platform-genesis.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/provision.js

@@ -843,16 +843,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync3(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync3(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync3(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync3(destination, { force: true });
@@ -2498,7 +2520,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.77";
+var VERSION3 = "0.1.79";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/software-helper.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/software.d.ts

@@ -57,6 +57,7 @@ export declare const OS_CATALOG: readonly OsCatalogEntry[];
 export declare const SOFTWARE_CATALOG: readonly SoftwareCatalogEntry[];
 export declare const softwareSpawnFailure: (cause: unknown, argv: readonly string[]) => SoftwareCommandResult | undefined;
 export declare const runSoftwareCommand: (argv: readonly string[], env?: Record<string, string>) => Promise<SoftwareCommandResult>;
+export declare const softwareDownloadCommand: (url: string, destination: string, maximumBytes: number) => readonly string[];
 /** Closed, fixed-argv privileged strategy executor. No repository value becomes a command. */
 export declare function executeSoftwareOperation(operation: SoftwareOperation): Promise<SoftwareCommandResult>;
 export declare function observeSoftwareHost(osRelease?: string, architecture?: NodeJS.Architecture): SoftwareObservation;

package/dist/software.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });
@@ -518,6 +540,7 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
 export {
   validateSoftwareRequirements,
   softwareSpawnFailure,
+  softwareDownloadCommand,
   runSoftwareCommand,
   observeSoftwareHost,
   executeSoftwareOperation,

package/dist/stdin.d.ts

@@ -1,6 +1,8 @@
 /**
  * Read one bounded request from stdin without using a synchronous `/dev/stdin`
- * read. Bun can busy-loop on a synchronous read when stdin is an SSH pipe;
- * async iteration observes pipe backpressure and EOF correctly.
+ * read. Bun can busy-loop while reading fd 0 from an SSH channel, both through
+ * synchronous fs calls and its JavaScript stream adapters. A fixed native
+ * `head` process owns that descriptor and returns at most limit + 1 bytes, so
+ * Bun handles only an already-bounded child stdout stream.
  */
 export declare function readBoundedStdin(maxBytes: number): Promise<string>;

package/dist/ubuntu.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.77";
+export declare const VERSION = "0.1.79";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.77",
+  "version": "0.1.79",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",