@forgezero/agent 0.1.92 → 0.1.95

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.92";
+var VERSION3 = "0.1.95";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.d.ts

@@ -192,6 +192,13 @@ export declare function validateBootstrapConfig(value: BootstrapConfig): Bootstr
 export declare function planBootstrap(input: BootstrapConfig, initialized?: boolean): BootstrapPlan;
 export declare function bootstrapIdentityDigest(config: BootstrapConfig): string;
 export declare const legacyBootstrapIdentityDigest: (config: BootstrapConfig) => string;
+/**
+ * Exact, reviewed identity migrations for an already-installed platform host.
+ * This is deliberately not a generic "stored coordinates match" escape hatch:
+ * only the development collector transition from the retired external OTLP
+ * placeholder to the supervised loopback sink is accepted.
+ */
+export declare function approvedPlatformRepairIdentityDigests(config: PlatformBootstrapConfig): readonly string[];
 /** Exact prior-release identities accepted only while generation one is still unenrolled. */
 export declare function interruptedPlatformReleaseIdentityDigests(config: PlatformBootstrapConfig, releaseEvidence: {
     revision: string;

package/dist/bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.92";
+var VERSION = "0.1.95";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3642,7 +3642,8 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   host.write(CONFIG, rendered.config, 420);
   host.write(UNIT, rendered.unit, 420);
   await checked2(host, ["/usr/bin/systemctl", "daemon-reload"]);
-  await checked2(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "enable", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "restart", FORGEZERO_OTEL_COLLECTOR_UNIT]);
   let ready = false;
   for (let attempt = 0;attempt < 100; attempt += 1) {
     const probe = await host.exec([
@@ -4289,6 +4290,14 @@ function bootstrapIdentityDigest(config) {
   return createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
 }
 var legacyBootstrapIdentityDigest = (config) => createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config, true))).digest("hex");
+function approvedPlatformRepairIdentityDigests(config) {
+  if (config.environment !== "development" || config.telemetryEndpoint !== LOCAL_DEBUG_OTEL_EXPORT || config.runtime.environment.agentOtlpEndpoint !== "http://127.0.0.1:4318")
+    return [];
+  const previous = structuredClone(config);
+  previous.telemetryEndpoint = "https://otel.forgezero.net";
+  previous.runtime.environment.agentOtlpEndpoint = "https://otel.forgezero.net";
+  return [bootstrapIdentityDigest(previous), legacyBootstrapIdentityDigest(previous)];
+}
 function interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest) {
   if (!config.runtime.environment.initialInventory)
     return [];
@@ -4609,10 +4618,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (installed) {
     const exactIdentity = installed.kind === config.kind && installed.identityDigest === bootstrapIdentityDigest(config);
     const boundedReleaseResume = config.kind === "platform" && !host.exists("/var/lib/forgezero/enrolment.json") && host.exists(BOOTSTRAP_RELEASE_EVIDENCE) && storedPlatformCoordinatesMatch(installed, config);
-    if (!exactIdentity && !boundedReleaseResume) {
+    const approvedIdentityMigration = config.kind === "platform" && storedPlatformCoordinatesMatch(installed, config) && approvedPlatformRepairIdentityDigests(config).includes(installed.identityDigest);
+    if (!exactIdentity && !boundedReleaseResume && !approvedIdentityMigration) {
       throw new Error("bootstrap repair coordinates do not match the installed host identity");
     }
-    allowInterruptedReleaseRebind = !exactIdentity && boundedReleaseResume;
+    allowInterruptedReleaseRebind = !exactIdentity && (boundedReleaseResume || approvedIdentityMigration);
   }
   const platformPrivate = config.kind === "platform" ? (() => {
     if (!secrets)
@@ -5218,6 +5228,7 @@ export {
   interruptedPlatformReleaseIdentityDigests,
   bootstrapStatus,
   bootstrapIdentityDigest,
+  approvedPlatformRepairIdentityDigests,
   applyBootstrap,
   PLATFORM_BOOTSTRAP_PROFILES,
   BOOTSTRAP_STATE_PATH

package/dist/fz-agent.js

@@ -9496,7 +9496,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.92";
+var VERSION2 = "0.1.95";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4810,7 +4810,8 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 }
 
 // src/cli/index.ts
-import { existsSync as existsSync13, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync13, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, renameSync as renameSync10, rmSync as rmSync8, writeFileSync as writeFileSync13 } from "fs";
+import { randomBytes as randomBytes10 } from "crypto";
 import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join13, resolve as resolve12 } from "path";
 
 // src/process-input.ts
@@ -4840,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.92";
+var VERSION2 = "0.1.95";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -13868,7 +13869,8 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   host.write(CONFIG, rendered.config, 420);
   host.write(UNIT, rendered.unit, 420);
   await checked(host, ["/usr/bin/systemctl", "daemon-reload"]);
-  await checked(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked(host, ["/usr/bin/systemctl", "enable", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked(host, ["/usr/bin/systemctl", "restart", FORGEZERO_OTEL_COLLECTOR_UNIT]);
   let ready = false;
   for (let attempt = 0;attempt < 100; attempt += 1) {
     const probe = await host.exec([
@@ -14673,6 +14675,14 @@ function bootstrapIdentityDigest(config) {
   return createHash4("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
 }
 var legacyBootstrapIdentityDigest = (config) => createHash4("sha256").update(JSON.stringify(bootstrapIdentity(config, true))).digest("hex");
+function approvedPlatformRepairIdentityDigests(config) {
+  if (config.environment !== "development" || config.telemetryEndpoint !== LOCAL_DEBUG_OTEL_EXPORT || config.runtime.environment.agentOtlpEndpoint !== "http://127.0.0.1:4318")
+    return [];
+  const previous = structuredClone(config);
+  previous.telemetryEndpoint = "https://otel.forgezero.net";
+  previous.runtime.environment.agentOtlpEndpoint = "https://otel.forgezero.net";
+  return [bootstrapIdentityDigest(previous), legacyBootstrapIdentityDigest(previous)];
+}
 function interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest) {
   if (!config.runtime.environment.initialInventory)
     return [];
@@ -14993,10 +15003,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (installed) {
     const exactIdentity = installed.kind === config.kind && installed.identityDigest === bootstrapIdentityDigest(config);
     const boundedReleaseResume = config.kind === "platform" && !host.exists("/var/lib/forgezero/enrolment.json") && host.exists(BOOTSTRAP_RELEASE_EVIDENCE) && storedPlatformCoordinatesMatch(installed, config);
-    if (!exactIdentity && !boundedReleaseResume) {
+    const approvedIdentityMigration = config.kind === "platform" && storedPlatformCoordinatesMatch(installed, config) && approvedPlatformRepairIdentityDigests(config).includes(installed.identityDigest);
+    if (!exactIdentity && !boundedReleaseResume && !approvedIdentityMigration) {
       throw new Error("bootstrap repair coordinates do not match the installed host identity");
     }
-    allowInterruptedReleaseRebind = !exactIdentity && boundedReleaseResume;
+    allowInterruptedReleaseRebind = !exactIdentity && (boundedReleaseResume || approvedIdentityMigration);
   }
   const platformPrivate = config.kind === "platform" ? (() => {
     if (!secrets)
@@ -19440,6 +19451,17 @@ function writeMetalOperatorFiles(directory) {
   });
   return { metalConfig, remoteRequest };
 }
+function writeDerivedLaunchFile(path, write) {
+  const temporary = `${path}.next.${process.pid}.${randomBytes10(6).toString("hex")}`;
+  try {
+    write(temporary);
+    renameSync10(temporary, path);
+    return path;
+  } catch (cause) {
+    rmSync8(temporary, { force: true });
+    throw cause;
+  }
+}
 function writePlatformGenesisFleet(directory, preset) {
   const output = genesisOutputDirectory(directory);
   const metalRequestFile = preset?.metalRequestFile ?? bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
@@ -19462,7 +19484,8 @@ function writePlatformGenesisFleet(directory, preset) {
     cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
   }));
   const realtimeEnabled = preset ? true : bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
-  const cloudflareConfig = writeBootstrapConfig(join13(output, "cloudflare.json"), createCloudflareBootstrapDiscoveryCommandConfig({
+  const cloudflareConfigPath = join13(output, "cloudflare.json");
+  const cloudflareConfigValue = createCloudflareBootstrapDiscoveryCommandConfig({
     checkpointPath,
     discovery: {
       zoneName: preset?.profile.zoneName ?? bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net"),
@@ -19479,7 +19502,8 @@ function writePlatformGenesisFleet(directory, preset) {
       service: "http://127.0.0.1:3000",
       tunnelName: preset ? guest.name : bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
     }))
-  }));
+  });
+  const cloudflareConfig = preset ? writeDerivedLaunchFile(cloudflareConfigPath, (path) => writeBootstrapConfig(path, cloudflareConfigValue)) : writeBootstrapConfig(cloudflareConfigPath, cloudflareConfigValue);
   const cloudflareAcceptance = join13(output, "cloudflare-acceptance.json");
   const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region, preset ? {
     source: "bootstrap-bundle",
@@ -19488,13 +19512,17 @@ function writePlatformGenesisFleet(directory, preset) {
     bundleSha256: preset.bundle.manifest.sha256
   } : undefined).map((config) => {
     const path = `${output}/${config.computeReference}-platform.json`;
-    writeBootstrapConfig(path, config);
+    if (preset)
+      writeDerivedLaunchFile(path, (temporary) => writeBootstrapConfig(temporary, config));
+    else
+      writeBootstrapConfig(path, config);
     return path;
   });
   const requests = configs.map((platformConfigFile, index) => {
     const guest = fleet[index];
     const host = guestHostKeys.nodes.find(({ name }) => name === guest.name);
-    return writeOperatorPlatformBootstrapRequest(join13(output, `${guest.name}-remote.json`), {
+    const path = join13(output, `${guest.name}-remote.json`);
+    const request = {
       kind: "platform-remote",
       platformConfigFile,
       target: {
@@ -19513,9 +19541,12 @@ function writePlatformGenesisFleet(directory, preset) {
           hostKeySha256: metalRequest.target.hostKeySha256
         }
       }
-    });
+    };
+    return preset ? writeDerivedLaunchFile(path, (temporary) => writeOperatorPlatformBootstrapRequest(temporary, request)) : writeOperatorPlatformBootstrapRequest(path, request);
   });
-  const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join13(output, "platform-fleet-remote.json"), requests, { configFile: cloudflareConfig, acceptanceFile: cloudflareAcceptance });
+  const fleetPath = join13(output, "platform-fleet-remote.json");
+  const writeFleet = (path) => writeOperatorPlatformBootstrapFleetRequest(path, requests, { configFile: cloudflareConfig, acceptanceFile: cloudflareAcceptance });
+  const fleetRequest = preset ? writeDerivedLaunchFile(fleetPath, writeFleet) : writeFleet(fleetPath);
   return { configs, requests, fleetRequest, cloudflareConfig, cloudflareAcceptance };
 }
 function selectedForgeZeroLaunchEnvironment(value) {
@@ -19777,8 +19808,7 @@ async function cmdBootstrap(options, args) {
       }
       const outputDirectory = options.outputPath ?? join13(homedir2(), ".forgezero-secure", environment, "genesis");
       const environmentInput = options.bootstrapSecretsEnvFile ? readPlatformLaunchEnvironment(options.bootstrapSecretsEnvFile) : undefined;
-      const existingFleetPath = join13(outputDirectory, "platform-fleet-remote.json");
-      const fleet = existsSync13(existingFleetPath) ? readOperatorPlatformBootstrapFleetRequest(existingFleetPath) : readOperatorPlatformBootstrapFleetRequest((await prepareForgeZeroPlatformLaunch(environment, outputDirectory, options.projectRoot, environmentInput?.owner)).fleetRequest);
+      const fleet = readOperatorPlatformBootstrapFleetRequest((await prepareForgeZeroPlatformLaunch(environment, outputDirectory, options.projectRoot, environmentInput?.owner)).fleetRequest);
       if (planOperatorPlatformFleetBootstrap(fleet, "apply").environment !== environment) {
         throw new Error("existing platform fleet does not match the selected launch profile");
       }

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.92";
+var VERSION = "0.1.95";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
@@ -499,7 +499,8 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   host.write(CONFIG, rendered.config, 420);
   host.write(UNIT, rendered.unit, 420);
   await checked2(host, ["/usr/bin/systemctl", "daemon-reload"]);
-  await checked2(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "enable", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "restart", FORGEZERO_OTEL_COLLECTOR_UNIT]);
   let ready = false;
   for (let attempt = 0;attempt < 100; attempt += 1) {
     const probe = await host.exec([

package/dist/operator-bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.92";
+var VERSION = "0.1.95";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3642,7 +3642,8 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   host.write(CONFIG, rendered.config, 420);
   host.write(UNIT, rendered.unit, 420);
   await checked2(host, ["/usr/bin/systemctl", "daemon-reload"]);
-  await checked2(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "enable", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "restart", FORGEZERO_OTEL_COLLECTOR_UNIT]);
   let ready = false;
   for (let attempt = 0;attempt < 100; attempt += 1) {
     const probe = await host.exec([
@@ -4289,6 +4290,14 @@ function bootstrapIdentityDigest(config) {
   return createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
 }
 var legacyBootstrapIdentityDigest = (config) => createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config, true))).digest("hex");
+function approvedPlatformRepairIdentityDigests(config) {
+  if (config.environment !== "development" || config.telemetryEndpoint !== LOCAL_DEBUG_OTEL_EXPORT || config.runtime.environment.agentOtlpEndpoint !== "http://127.0.0.1:4318")
+    return [];
+  const previous = structuredClone(config);
+  previous.telemetryEndpoint = "https://otel.forgezero.net";
+  previous.runtime.environment.agentOtlpEndpoint = "https://otel.forgezero.net";
+  return [bootstrapIdentityDigest(previous), legacyBootstrapIdentityDigest(previous)];
+}
 function interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest) {
   if (!config.runtime.environment.initialInventory)
     return [];
@@ -4609,10 +4618,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (installed) {
     const exactIdentity = installed.kind === config.kind && installed.identityDigest === bootstrapIdentityDigest(config);
     const boundedReleaseResume = config.kind === "platform" && !host.exists("/var/lib/forgezero/enrolment.json") && host.exists(BOOTSTRAP_RELEASE_EVIDENCE) && storedPlatformCoordinatesMatch(installed, config);
-    if (!exactIdentity && !boundedReleaseResume) {
+    const approvedIdentityMigration = config.kind === "platform" && storedPlatformCoordinatesMatch(installed, config) && approvedPlatformRepairIdentityDigests(config).includes(installed.identityDigest);
+    if (!exactIdentity && !boundedReleaseResume && !approvedIdentityMigration) {
       throw new Error("bootstrap repair coordinates do not match the installed host identity");
     }
-    allowInterruptedReleaseRebind = !exactIdentity && boundedReleaseResume;
+    allowInterruptedReleaseRebind = !exactIdentity && (boundedReleaseResume || approvedIdentityMigration);
   }
   const platformPrivate = config.kind === "platform" ? (() => {
     if (!secrets)

package/dist/platform-fleet-verification.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.92";
+var VERSION3 = "0.1.95";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.92";
+var VERSION3 = "0.1.95";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.92";
+export declare const VERSION = "0.1.95";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.92",
+  "version": "0.1.95",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",