@forgezero/agent 0.1.88 → 0.1.89

package/dist/host-maintenance.js

@@ -2,7 +2,7 @@
 // src/host-maintenance.ts
 import { lstatSync, readFileSync } from "fs";
 var ROOT = "/opt/forgezero";
-var SLOT_FILE = `${ROOT}/.forge-slot`;
+var SLOT_FILE = `${ROOT}/slots/.active`;
 var SHARED_ENV = `${ROOT}/shared/.env`;
 var JWT = "/etc/forgezero/creds/arangodb-jwt.cred";
 var FZ = "/usr/local/bin/fz";

package/dist/index.d.ts

@@ -170,6 +170,13 @@ export type InitialVaultReplicaStatus = {
  * is available again.
  */
 export declare function initializeVaultReplica(cache: Pick<SecretCache, 'load'>): Promise<InitialVaultReplicaStatus>;
+/** Keep the local signed/control plane alive while remote attestation retries. */
+export declare function attemptInitialAttestation<T>(attempt: () => Promise<T>, onDeferred: (cause: unknown) => void): Promise<{
+    verified: true;
+    result: T;
+} | {
+    verified: false;
+}>;
 /**
  * Bring the agent up.
  *

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.88";
+var VERSION = "0.1.89";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-helper-socket.js

@@ -495,7 +495,12 @@ async function executeSoftwareOperation(operation) {
     }
     if (software === "nginx") {
       const binary = await run(["/usr/sbin/nginx", "-v"]);
-      return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
+      if (binary.exitCode !== 0)
+        return binary;
+      if (!existsSync("/usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so")) {
+        return { exitCode: 1, output: "Nginx response-header suppression module is unavailable" };
+      }
+      return run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]);
     }
     if (software === "arangodb") {
       const binary = await run(["/usr/sbin/arangod", "--version"]);
@@ -527,7 +532,7 @@ async function executeSoftwareOperation(operation) {
   }
   if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client" || software === "git") {
     const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
-    const installed = await aptInstall(packageName);
+    const installed = software === "nginx" ? await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]) : await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
       return installed;
     if (software === "docker") {

package/dist/metal-provision.js

@@ -495,7 +495,12 @@ async function executeSoftwareOperation(operation) {
     }
     if (software === "nginx") {
       const binary = await run(["/usr/sbin/nginx", "-v"]);
-      return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
+      if (binary.exitCode !== 0)
+        return binary;
+      if (!existsSync("/usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so")) {
+        return { exitCode: 1, output: "Nginx response-header suppression module is unavailable" };
+      }
+      return run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]);
     }
     if (software === "arangodb") {
       const binary = await run(["/usr/sbin/arangod", "--version"]);
@@ -527,7 +532,7 @@ async function executeSoftwareOperation(operation) {
   }
   if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client" || software === "git") {
     const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
-    const installed = await aptInstall(packageName);
+    const installed = software === "nginx" ? await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]) : await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
       return installed;
     if (software === "docker") {

package/dist/operator-bootstrap.d.ts

@@ -117,6 +117,9 @@ export type OperatorCommand = (argv: readonly string[], options?: {
     secret?: boolean;
     safeStdout?: boolean;
 }) => Promise<OperatorCommandResult>;
+export declare const operatorPackagedFzCliPath: () => string;
+export declare const operatorPackagedAgentPath: () => string;
+export declare const operatorPackagedGitSshPath: () => string;
 export interface OperatorPlatformBootstrapOptions {
     exec?: OperatorCommand;
     fetch?: typeof fetch;
@@ -143,6 +146,15 @@ export declare function planOperatorPlatformBootstrap(request: OperatorPlatformB
 /** Exact non-secret coordinates derived from the same reviewed files bootstrap applies. */
 export declare function operatorPlatformFleetCoordinates(fleet: OperatorPlatformBootstrapFleetRequest): OperatorPlatformFleetCoordinates;
 export declare function planOperatorPlatformFleetBootstrap(fleet: OperatorPlatformBootstrapFleetRequest, mode: OperatorPlatformBootstrapMode): OperatorPlatformBootstrapFleetPlan;
+/** Keep typed failure text while proving no attended value can be returned. */
+export declare function redactOperatorSecretDiagnostic(stderr: string, stdin?: string): string;
+/**
+ * Create or reopen the one shared genesis credential on the reviewed Metal
+ * host. The operator laptop is transport only: the value exists in local RAM
+ * long enough to cross the already pinned SSH sessions, while the only durable
+ * copy is encrypted by Metal's systemd host key.
+ */
+export declare function operatorMetalClusterBootstrapCode(requestInput: OperatorMetalBootstrapRequest, options?: OperatorPlatformBootstrapOptions): Promise<string>;
 export declare function collectOperatorGuestHostKeys(request: OperatorMetalBootstrapRequest, options?: OperatorPlatformBootstrapOptions, includeRehearsal?: boolean): Promise<OperatorGuestHostKeyEvidence>;
 export interface OperatorGuestTransport {
     run(nodeName: string, argv: readonly string[], options?: {