@forgezero/agent 0.1.78 → 0.1.79

package/dist/agent-heartbeat.js

@@ -750,7 +750,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.78";
+var VERSION3 = "0.1.79";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1416,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.78";
+var VERSION = "0.1.79";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/community-rehearsal-host.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/definition.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/deploy-file.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/fz-agent.js

@@ -5114,16 +5114,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha2562, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync2(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync2(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });
@@ -9193,7 +9215,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.78";
+var VERSION2 = "0.1.79";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4837,7 +4837,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.78";
+var VERSION2 = "0.1.79";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.78";
+var VERSION = "0.1.79";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-helper-socket.js

@@ -305,16 +305,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/metal-provision.js

@@ -305,16 +305,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/operator-bootstrap.js

@@ -1416,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.78";
+var VERSION = "0.1.79";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-bootstrap-runtime.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/platform-fleet-verification.js

@@ -843,16 +843,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync3(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync3(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync3(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync3(destination, { force: true });
@@ -2498,7 +2520,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.78";
+var VERSION3 = "0.1.79";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/platform-genesis.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/provision.js

@@ -843,16 +843,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync3(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync3(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync3(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync3(destination, { force: true });
@@ -2498,7 +2520,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.78";
+var VERSION3 = "0.1.79";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/software-helper.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/software.d.ts

@@ -57,6 +57,7 @@ export declare const OS_CATALOG: readonly OsCatalogEntry[];
 export declare const SOFTWARE_CATALOG: readonly SoftwareCatalogEntry[];
 export declare const softwareSpawnFailure: (cause: unknown, argv: readonly string[]) => SoftwareCommandResult | undefined;
 export declare const runSoftwareCommand: (argv: readonly string[], env?: Record<string, string>) => Promise<SoftwareCommandResult>;
+export declare const softwareDownloadCommand: (url: string, destination: string, maximumBytes: number) => readonly string[];
 /** Closed, fixed-argv privileged strategy executor. No repository value becomes a command. */
 export declare function executeSoftwareOperation(operation: SoftwareOperation): Promise<SoftwareCommandResult>;
 export declare function observeSoftwareHost(osRelease?: string, architecture?: NodeJS.Architecture): SoftwareObservation;

package/dist/software.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });
@@ -518,6 +540,7 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
 export {
   validateSoftwareRequirements,
   softwareSpawnFailure,
+  softwareDownloadCommand,
   runSoftwareCommand,
   observeSoftwareHost,
   executeSoftwareOperation,

package/dist/ubuntu.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.78";
+export declare const VERSION = "0.1.79";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.78",
+  "version": "0.1.79",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",