@forgezero/agent 0.1.78 → 0.1.80

package/dist/software-helper.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });
@@ -949,6 +971,7 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
 // src/deployment-connectivity.ts
 import { createHash as createHash2 } from "node:crypto";
 import { mkdirSync as mkdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { createConnection } from "node:net";
 import { dirname as dirname2 } from "node:path";
 
 // src/process-input.ts
@@ -1001,6 +1024,21 @@ var defaultHost = {
     const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
     return { exitCode, output: `${stdout}${stderr}` };
   },
+  probe: (address, port, timeoutMs) => new Promise((resolve) => {
+    const socket = createConnection({ host: address, port });
+    let settled = false;
+    const finish = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      socket.destroy();
+      resolve(value);
+    };
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => finish(true));
+    socket.once("timeout", () => finish(false));
+    socket.once("error", () => finish(false));
+  }),
   sleep: (ms) => Bun.sleep(ms)
 };
 function validate(request) {
@@ -1015,7 +1053,7 @@ function validate(request) {
   } else if (request.capabilities.public)
     throw new Error("unexpected public deployment capability");
   if (privateIntent?.mode === "cloudflare-warp") {
-    if (!NAME2.test(privateIntent.credential) || privateIntent.network.length < 1 || privateIntent.network.length > 128 || !request.capabilities.private || !UUID.test(request.capabilities.private.connectorId) || !TOKEN.test(request.capabilities.private.connectorToken)) {
+    if (!NAME2.test(privateIntent.credential) || privateIntent.network.length < 1 || privateIntent.network.length > 128 || !request.capabilities.private || !UUID.test(request.capabilities.private.connectorId) || !UUID.test(request.capabilities.private.siteRouteId) || !TOKEN.test(request.capabilities.private.connectorToken)) {
       throw new Error("private deployment connectivity is malformed");
     }
   } else if (request.capabilities.private)
@@ -1025,6 +1063,22 @@ async function applyDeploymentConnectivity(request, host = defaultHost) {
   validate(request);
   const id = idFor(request.key);
   const evidence = { key: request.key };
+  const topology = request.topology;
+  if (topology) {
+    const values = [topology.localRelayAddress, ...topology.localPeerAddresses, ...topology.remoteRelayAddresses];
+    const identities = [
+      topology.nodeIdentity,
+      ...topology.localPeerIdentities,
+      ...topology.remoteRelayIdentities,
+      ...topology.memberIdentities
+    ];
+    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => !/^(?:\d{1,3}\.){3}\d{1,3}$/.test(value)) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
+      throw new Error("deployment topology is malformed");
+    }
+    if (request.intent.private?.mode === "cloudflare-warp" !== (topology.transport === "cloudflare-warp")) {
+      throw new Error("deployment topology transport differs from private connectivity intent");
+    }
+  }
   if (request.intent.public?.mode === "cloudflare-tunnel") {
     const capability = request.capabilities.public;
     const credentialName = `FZ_TUNNEL_${id.toUpperCase()}`;
@@ -1062,6 +1116,12 @@ WantedBy=multi-user.target
     const capability = request.capabilities.private;
     const credentialPath = "/etc/forgezero/creds/CF_WARP_CONNECTOR_TOKEN.cred";
     const unit = "forgezero-deployment-mesh.service";
+    const forwarding = "/etc/sysctl.d/99-forgezero-mesh.conf";
+    host.write(forwarding, `net.ipv4.ip_forward = 1
+net.ipv6.conf.all.forwarding = 1
+net.ipv6.conf.all.accept_ra = 2
+`, 420);
+    await checked(host, ["/usr/sbin/sysctl", "-p", forwarding], "Mesh subnet forwarding");
     await host.seal("CF_WARP_CONNECTOR_TOKEN", credentialPath, capability.connectorToken);
     host.write(`/etc/systemd/system/${unit}`, `[Unit]
 Description=ForgeZero deployment Mesh/WARP connector
@@ -1096,6 +1156,95 @@ WantedBy=multi-user.target
     if (!evidence.private)
       throw new Error("WARP connector readiness failed");
   }
+  if (topology) {
+    const syncAddresses = topology.role === "relay" ? [...topology.localPeerAddresses, ...topology.remoteRelayAddresses] : [topology.localRelayAddress];
+    const topologyEpoch = `topology-${topology.generation.slice("sha256:".length, "sha256:".length + 48)}`;
+    host.write("/etc/forgezero/deployment-topology.env", [
+      `FZ_TOPOLOGY_NODE_IDENTITY=${topology.nodeIdentity}`,
+      `FZ_TOPOLOGY_PEER_ADDRESSES=${[...new Set(syncAddresses)].join(",")}`,
+      `FZ_TOPOLOGY_MEMBERS=${topology.memberIdentities.join(",")}`,
+      `FZ_TOPOLOGY_EPOCH=${topologyEpoch}`,
+      `FZ_TOPOLOGY_SITE=${topology.site}`,
+      `FZ_TOPOLOGY_ROLE=${topology.role}`,
+      `FZ_TOPOLOGY_TRANSPORT=${topology.transport}`,
+      ""
+    ].join(`
+`), 384);
+    const routeUnit = "forgezero-deployment-topology.service";
+    const routeUnitPath = `/etc/systemd/system/${routeUnit}`;
+    const routePairs = topology.role === "member" ? topology.remoteSiteCidrs.map((network) => ({ network, via: topology.localRelayAddress })) : topology.transport === "private-lan" ? topology.remoteSiteCidrs.map((network, index) => ({ network, via: topology.remoteRelayAddresses[index] })) : [];
+    for (const { via } of routePairs) {
+      await checked(host, ["/usr/sbin/ip", "route", "get", via], `private route gateway ${via}`);
+    }
+    await host.exec(["/usr/bin/systemctl", "disable", "--now", routeUnit]);
+    const forwarding = topology.role !== "member" && topology.remoteSiteCidrs.length > 0 ? `ExecStart=/usr/sbin/sysctl -w net.ipv4.ip_forward=1
+` : "";
+    const starts = routePairs.map(({ network, via }) => `ExecStart=/usr/sbin/ip route replace ${network} via ${via}`).join(`
+`);
+    const stops = routePairs.map(({ network, via }) => `ExecStop=-/usr/sbin/ip route del ${network} via ${via}`).join(`
+`);
+    const noOp = !forwarding && !starts ? `ExecStart=/usr/bin/true
+` : "";
+    host.write(routeUnitPath, `[Unit]
+Description=ForgeZero fenced deployment site routing
+After=network-online.target${topology.transport === "cloudflare-warp" ? " forgezero-deployment-mesh.service" : ""}
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+${forwarding}${noOp}${starts}${starts ? `
+` : ""}${stops}${stops ? `
+` : ""}
+[Install]
+WantedBy=multi-user.target
+`, 420);
+    for (const source of [...new Set([topology.siteCidr, ...topology.remoteSiteCidrs])]) {
+      for (const port of topology.routedTcpPorts) {
+        await checked(host, ["/usr/sbin/ufw", "allow", "from", source, "to", "any", "port", String(port), "proto", "tcp"], `private service ${source}:${port}`);
+      }
+    }
+    if (topology.role !== "member")
+      for (const remoteCidr of topology.remoteSiteCidrs) {
+        for (const port of topology.routedTcpPorts) {
+          await checked(host, [
+            "/usr/sbin/ufw",
+            "route",
+            "allow",
+            "proto",
+            "tcp",
+            "from",
+            topology.siteCidr,
+            "to",
+            remoteCidr,
+            "port",
+            String(port)
+          ], `private routed service ${topology.siteCidr}->${remoteCidr}:${port}`);
+        }
+      }
+    await checked(host, ["/usr/bin/systemctl", "daemon-reload"], "topology daemon reload");
+    await checked(host, ["/usr/bin/systemctl", "enable", "--now", routeUnit], "topology routes");
+    const probes = topology.role === "member" ? [topology.localRelayAddress] : topology.remoteRelayAddresses;
+    for (const address of [...new Set(probes)]) {
+      await checked(host, ["/usr/sbin/ip", "route", "get", address], `private route ${address}`);
+      let ready = false;
+      for (let attempt = 0;attempt < 10; attempt += 1) {
+        if (await host.probe(address, topology.healthPort, 2000)) {
+          ready = true;
+          break;
+        }
+        await host.sleep(1000);
+      }
+      if (!ready)
+        throw new Error(`private topology relay ${address}:${topology.healthPort} is unreachable`);
+    }
+    evidence.topology = {
+      site: topology.site,
+      siteCidr: topology.siteCidr,
+      role: topology.role,
+      probed: [...new Set(probes)]
+    };
+  }
   return evidence;
 }
 

package/dist/software.d.ts

@@ -57,6 +57,7 @@ export declare const OS_CATALOG: readonly OsCatalogEntry[];
 export declare const SOFTWARE_CATALOG: readonly SoftwareCatalogEntry[];
 export declare const softwareSpawnFailure: (cause: unknown, argv: readonly string[]) => SoftwareCommandResult | undefined;
 export declare const runSoftwareCommand: (argv: readonly string[], env?: Record<string, string>) => Promise<SoftwareCommandResult>;
+export declare const softwareDownloadCommand: (url: string, destination: string, maximumBytes: number) => readonly string[];
 /** Closed, fixed-argv privileged strategy executor. No repository value becomes a command. */
 export declare function executeSoftwareOperation(operation: SoftwareOperation): Promise<SoftwareCommandResult>;
 export declare function observeSoftwareHost(osRelease?: string, architecture?: NodeJS.Architecture): SoftwareObservation;

package/dist/software.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });
@@ -518,6 +540,7 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
 export {
   validateSoftwareRequirements,
   softwareSpawnFailure,
+  softwareDownloadCommand,
   runSoftwareCommand,
   observeSoftwareHost,
   executeSoftwareOperation,

package/dist/ubuntu.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.78";
+export declare const VERSION = "0.1.80";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",
@@ -88,6 +88,10 @@
       "types": "./dist/deployment-targets.d.ts",
       "default": "./dist/deployment-targets.js"
     },
+    "./deployment-topology": {
+      "types": "./dist/deployment-topology.d.ts",
+      "default": "./dist/deployment-topology.js"
+    },
     "./deployment-connectivity": {
       "types": "./dist/deployment-connectivity.d.ts",
       "default": "./dist/deployment-connectivity.js"