@forgezero/agent 0.1.88 → 0.1.89

package/dist/platform-bootstrap-runtime.d.ts

@@ -175,6 +175,7 @@ export interface PlatformActivationCommandResult {
     output: string;
 }
 export type PlatformActivationExec = (argv: readonly string[]) => Promise<PlatformActivationCommandResult>;
+export declare const assertReleaseLinksContained: (path: string) => void;
 /** Agent-native blue/green activation with health and nginx rollback. */
 export declare function activatePlatformRelease(config: PlatformActivationConfig, requestedRelease: string, options?: {
     exec?: PlatformActivationExec;

package/dist/platform-bootstrap-runtime.js

@@ -355,7 +355,12 @@ async function executeSoftwareOperation(operation) {
     }
     if (software === "nginx") {
       const binary = await run(["/usr/sbin/nginx", "-v"]);
-      return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
+      if (binary.exitCode !== 0)
+        return binary;
+      if (!existsSync("/usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so")) {
+        return { exitCode: 1, output: "Nginx response-header suppression module is unavailable" };
+      }
+      return run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]);
     }
     if (software === "arangodb") {
       const binary = await run(["/usr/sbin/arangod", "--version"]);
@@ -387,7 +392,7 @@ async function executeSoftwareOperation(operation) {
   }
   if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client" || software === "git") {
     const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
-    const installed = await aptInstall(packageName);
+    const installed = software === "nginx" ? await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]) : await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
       return installed;
     if (software === "docker") {
@@ -1050,12 +1055,26 @@ map $limit_conn_status $forgezero_retry_after { default ''; REJECTED 1; REJECTED
 server {
   listen 127.0.0.1:${input.publicPort};
   server_name _;
+  server_tokens off;
+  more_clear_headers Server X-Powered-By;
   limit_conn forgezero_admission ${concurrencyLimit};
   limit_conn_status 503;
   add_header Retry-After $forgezero_retry_after always;
-  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
-  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
-  location / { return 404; }
+  error_page 400 403 404 405 408 413 414 429 500 502 503 504 = @transport_failure;
+  location @transport_failure { internal; return 444; }
+  location / {
+    proxy_pass http://forgezero;
+    proxy_http_version 1.1;
+    proxy_intercept_errors off;
+    proxy_hide_header Server;
+    proxy_hide_header X-Powered-By;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $forgezero_connection;
+    proxy_read_timeout 3600s;
+  }
 }
 `
   };
@@ -1128,11 +1147,29 @@ var replaceLink = (path2, target) => {
   symlinkSync2(target, pending);
   renameSync2(pending, path2);
 };
+var assertReleaseLinksContained = (path2) => {
+  const root = realpathSync(path2);
+  const visit = (current2) => {
+    const metadata = lstatSync(current2);
+    if (metadata.isSymbolicLink()) {
+      const target = realpathSync(current2);
+      if (target !== root && !target.startsWith(`${root}/`)) {
+        throw new Error("release contains a symbolic link outside its immutable root");
+      }
+      return;
+    }
+    if (metadata.isDirectory())
+      for (const name of readdirSync(current2))
+        visit(join2(current2, name));
+  };
+  visit(root);
+};
 var secureRelease = (path2, uid, gid) => {
+  assertReleaseLinksContained(path2);
   const visit = (current2) => {
     const metadata = lstatSync(current2);
     if (metadata.isSymbolicLink())
-      throw new Error("release contains a symbolic link");
+      return;
     chownSync(current2, uid, gid);
     chmodSync2(current2, metadata.isDirectory() ? 365 : 292);
     if (metadata.isDirectory())
@@ -1158,7 +1195,7 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const sleep = options.sleep ?? Bun.sleep;
   const slots = join2(normalized.root, "slots");
   mkdirSync2(slots, { recursive: true, mode: 493 });
-  const slotFile = join2(normalized.root, ".forge-slot");
+  const slotFile = join2(slots, ".active");
   const previousSlot = existsSync2(slotFile) ? readFileSync2(slotFile, "utf8").trim() : undefined;
   const target = previousSlot === "blue" ? "green" : "blue";
   const port = target === "blue" ? normalized.bluePort : normalized.greenPort;
@@ -1208,6 +1245,7 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const test = await exec(["/usr/sbin/nginx", "-t"]);
   const reload = test.exitCode === 0 ? await exec(["/usr/sbin/nginx", "-s", "reload"]) : test;
   if (reload.exitCode !== 0) {
+    const refusal = (reload.output || test.output).trim().slice(0, 2000);
     if (existsSync2(backup))
       renameSync2(backup, upstream);
     else
@@ -1215,7 +1253,7 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
     await exec(["/usr/sbin/nginx", "-t"]);
     await exec(["/usr/sbin/nginx", "-s", "reload"]);
     await stopTarget();
-    throw new Error("nginx refused the promoted upstream");
+    throw new Error(`nginx refused the promoted upstream${refusal ? `: ${refusal}` : ""}`);
   }
   rmSync2(backup, { force: true });
   writeFileSync2(slotFile, `${target}
@@ -1276,5 +1314,6 @@ export {
   platformApiCredentialSpecs,
   planPlatformActivation,
   planLocalOtlpProof,
+  assertReleaseLinksContained,
   activatePlatformRelease
 };