@w3devx/zr-agent 0.0.0-stage → 0.1.0-rc.2

package/README.md

@@ -1,3 +1,33 @@
-# Temporary Holding Version
+# @w3devx/zr-agent
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Installer for **zr-agent**, the zyber runner node agent. The package version is the agent version: it downloads exactly that release
+from [W3DevTech/zr-agent-releases](https://github.com/W3DevTech/zr-agent-releases), verifies it, installs it and registers the node.
+
+```sh
+sudo npx @w3devx/zr-agent@<version> install --join zrj_... --url https://control-plane.example [--name NAME] [--no-start]
+```
+
+`<version>` is the fleet version shown in the dashboard's Add node dialog. Run it as root on a Linux x64 or arm64 host with Docker and systemd.
+
+What `install` does:
+
+1. Downloads `zr-agent-linux-<arch>`, `SHA256SUMS` and `SHA256SUMS.minisig` for `v<version>`.
+2. Verifies `SHA256SUMS` against the minisign public key pinned in this package (key id `A7504FCF5B75D562`; Ed25519 over the BLAKE2b-512
+   prehash, key id and trusted-comment signature all checked, and the trusted comment must be `zr-agent v<version>`), then the binary's SHA-256.
+   Nothing is written until both pass.
+3. Installs to `/opt/zr-agent/versions/<version>/zr-agent`, points `/opt/zr-agent/current` at it (the previous version is kept for rollback,
+   older ones are removed), stamps it `.verified` and links `/usr/local/bin/zr-agent`. It also copies the binary to
+   `/opt/zr-agent/zr-agent-launcher`, outside `versions/`.
+4. Writes `/etc/systemd/system/zr-agent.service`, which runs `zr-agent-launcher launcher`: the launcher starts `current/zr-agent`, restarts it
+   after a self-upgrade and flips `current` back if a new release does not say hello within 60 s.
+5. With `--join` and `--url`: runs `zr-agent register` (the token goes through the environment, never argv or logs), then
+   `systemctl enable` and `restart zr-agent`. Without `--join` on an unconfigured host it stops after step 4 and tells you what to run.
+
+Flags: `--join`, `--url`, `--name`, `--force` (register again), `--no-start`, `--version` (override). The token and URL are also read from
+`ZR_AGENT_JOIN_TOKEN` and `ZR_AGENT_URL`.
+
+No Node? Use the `install.sh` attached to the release instead; it does the same with `curl`, `sha256sum` and `minisign`
+(it fetches a pinned minisign build if none is installed).
+
+Source: `npm/zr-agent` in ashutoshpw/zyber-sh-manager. Releases are built, signed and published by `.github/workflows/zr-agent-release.yml`
+(npm trusted publishing; no provenance attestation while the source repo is private).

package/dist/cli.js

@@ -0,0 +1,538 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/main.ts
+import { existsSync } from "node:fs";
+// package.json
+var package_default = {
+  name: "@w3devx/zr-agent",
+  version: "0.1.0-rc.2",
+  type: "module",
+  description: "Installer for zr-agent, the zyber runner node agent: downloads the exact release, verifies its minisign signature and checksum, installs it under /opt/zr-agent and writes the systemd unit.",
+  bin: {
+    "zr-agent": "dist/cli.js"
+  },
+  files: [
+    "dist",
+    "README.md"
+  ],
+  engines: {
+    node: ">=20"
+  },
+  os: [
+    "linux"
+  ],
+  cpu: [
+    "x64",
+    "arm64"
+  ],
+  license: "UNLICENSED",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/ashutoshpw/zyber-sh-manager.git",
+    directory: "npm/zr-agent"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "bun build src/main.ts --target node --outfile dist/cli.js && chmod +x dist/cli.js",
+    test: "bun test"
+  }
+};
+
+// src/install.ts
+import { chmod, mkdir, readdir, readlink, rename, rm, symlink, writeFile, lstat } from "node:fs/promises";
+import { dirname, join } from "node:path";
+
+// ../../dashboard/packages/agent-protocol/src/release.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// ../../dashboard/packages/agent-protocol/src/minisign.ts
+import { createHash, createPublicKey, verify } from "node:crypto";
+var ZR_AGENT_MINISIGN_PUBLIC_KEY = "RWRi1XVbz09Qp5TTZ0iefap1wtuBahGfzIp5j4z5KDXfM0bn05ImR3zc";
+var KEY_ID_BYTES = 8;
+var PUBLIC_KEY_BYTES = 32;
+var SIGNATURE_BYTES = 64;
+var TRUSTED_COMMENT_PREFIX = "trusted comment:";
+var UNTRUSTED_COMMENT_PREFIX = "untrusted comment:";
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+function keyIdToHex(keyId) {
+  return Buffer.from(keyId).reverse().toString("hex").toUpperCase();
+}
+function b64(s) {
+  const t = s.trim();
+  if (t.length === 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(t))
+    return null;
+  return Buffer.from(t, "base64");
+}
+function lines(text) {
+  return text.split(/\r?\n/);
+}
+function parseMinisignPublicKey(text) {
+  const rows = lines(text).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(UNTRUSTED_COMMENT_PREFIX));
+  if (rows.length !== 1)
+    return null;
+  const raw = b64(rows[0]);
+  if (!raw || raw.length !== 2 + KEY_ID_BYTES + PUBLIC_KEY_BYTES)
+    return null;
+  if (raw[0] !== 69 || raw[1] !== 100)
+    return null;
+  const keyId = new Uint8Array(raw.subarray(2, 2 + KEY_ID_BYTES));
+  return { keyId, keyIdHex: keyIdToHex(keyId), publicKey: new Uint8Array(raw.subarray(2 + KEY_ID_BYTES)) };
+}
+function parseMinisignSignature(text) {
+  const rows = lines(text);
+  while (rows.length > 0 && rows[rows.length - 1].trim() === "")
+    rows.pop();
+  if (rows.length !== 4)
+    return null;
+  if (!rows[0].startsWith(UNTRUSTED_COMMENT_PREFIX))
+    return null;
+  const sigLine = b64(rows[1]);
+  if (!sigLine || sigLine.length !== 2 + KEY_ID_BYTES + SIGNATURE_BYTES)
+    return null;
+  const alg = sigLine.subarray(0, 2).toString("latin1");
+  if (alg !== "ED" && alg !== "Ed")
+    return null;
+  if (!rows[2].startsWith(TRUSTED_COMMENT_PREFIX))
+    return null;
+  const trustedComment = rows[2].slice(TRUSTED_COMMENT_PREFIX.length).replace(/^ /, "");
+  const global = b64(rows[3]);
+  if (!global || global.length !== SIGNATURE_BYTES)
+    return null;
+  return {
+    algorithm: alg,
+    keyId: new Uint8Array(sigLine.subarray(2, 2 + KEY_ID_BYTES)),
+    signature: new Uint8Array(sigLine.subarray(2 + KEY_ID_BYTES)),
+    trustedComment,
+    globalSignature: new Uint8Array(global)
+  };
+}
+function ed25519Verify(publicKey, message, signature) {
+  try {
+    const key = createPublicKey({ key: Buffer.concat([ED25519_SPKI_PREFIX, publicKey]), format: "der", type: "spki" });
+    return verify(null, message, key, signature);
+  } catch {
+    return false;
+  }
+}
+function sameBytes(a, b) {
+  return a.length === b.length && Buffer.from(a).equals(Buffer.from(b));
+}
+function verifyMinisign(input) {
+  const key = parseMinisignPublicKey(input.publicKey);
+  if (!key)
+    return { ok: false, reason: "malformed public key" };
+  const sig = parseMinisignSignature(input.signature);
+  if (!sig)
+    return { ok: false, reason: "malformed signature file" };
+  if (!sameBytes(sig.keyId, key.keyId)) {
+    return { ok: false, reason: `signature key id ${keyIdToHex(sig.keyId)} does not match the pinned key ${key.keyIdHex}` };
+  }
+  const signed = sig.algorithm === "ED" ? new Uint8Array(createHash("blake2b512").update(input.message).digest()) : input.message;
+  if (!ed25519Verify(key.publicKey, signed, sig.signature))
+    return { ok: false, reason: "signature does not match the message" };
+  const globalMessage = Buffer.concat([sig.signature, Buffer.from(sig.trustedComment, "utf8")]);
+  if (!ed25519Verify(key.publicKey, globalMessage, sig.globalSignature)) {
+    return { ok: false, reason: "trusted comment signature does not match" };
+  }
+  return { ok: true, trustedComment: sig.trustedComment, keyIdHex: key.keyIdHex, algorithm: sig.algorithm };
+}
+
+// ../../dashboard/packages/agent-protocol/src/release.ts
+var RELEASES_REPO = "W3DevTech/zr-agent-releases";
+var RELEASES_DOWNLOAD_BASE = `https://github.com/${RELEASES_REPO}/releases/download`;
+var SUMS_ASSET = "SHA256SUMS";
+var SUMS_SIGNATURE_ASSET = "SHA256SUMS.minisig";
+var VERSION_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+function isValidReleaseVersion(version) {
+  return typeof version === "string" && version.length <= 64 && VERSION_RE.test(version);
+}
+function releaseArch(nodeArch) {
+  if (nodeArch === "x64" || nodeArch === "x86_64" || nodeArch === "amd64")
+    return "x64";
+  if (nodeArch === "arm64" || nodeArch === "aarch64")
+    return "arm64";
+  return null;
+}
+function binaryAssetName(arch) {
+  return `zr-agent-linux-${arch}`;
+}
+function releaseTagFor(version) {
+  return `v${version}`;
+}
+function releaseAssetUrl(version, assetName, base = RELEASES_DOWNLOAD_BASE) {
+  if (!isValidReleaseVersion(version))
+    throw new Error(`releaseAssetUrl: invalid version "${version}"`);
+  return `${base.replace(/\/+$/, "")}/${releaseTagFor(version)}/${assetName}`;
+}
+function releaseTrustedComment(version) {
+  return `zr-agent v${version}`;
+}
+function sha256Hex(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+function parseSha256Sums(text) {
+  const out = new Map;
+  for (const raw of text.split(/\r?\n/)) {
+    if (raw.trim() === "")
+      continue;
+    const m = /^([0-9a-fA-F]{64}) [ *]([^\s/\\][^/\\]*)$/.exec(raw);
+    if (!m)
+      return null;
+    const name = m[2];
+    if (out.has(name))
+      return null;
+    out.set(name, m[1].toLowerCase());
+  }
+  return out;
+}
+function verifyReleaseSums(input) {
+  if (!isValidReleaseVersion(input.version))
+    return { ok: false, reason: `invalid version "${input.version}"` };
+  const sig = verifyMinisign({ message: input.sums, signature: input.signature, publicKey: input.publicKey ?? ZR_AGENT_MINISIGN_PUBLIC_KEY });
+  if (sig.ok === false)
+    return { ok: false, reason: `SHA256SUMS signature rejected: ${sig.reason}` };
+  const want = releaseTrustedComment(input.version);
+  if (sig.trustedComment !== want) {
+    return { ok: false, reason: `SHA256SUMS is signed for "${sig.trustedComment}", expected "${want}"` };
+  }
+  const table = parseSha256Sums(Buffer.from(input.sums).toString("utf8"));
+  if (!table)
+    return { ok: false, reason: "SHA256SUMS is malformed" };
+  return { ok: true, sums: table };
+}
+function verifyReleaseBinary(input) {
+  const sums = verifyReleaseSums(input);
+  if (sums.ok === false)
+    return sums;
+  const expected = sums.sums.get(input.assetName);
+  if (!expected)
+    return { ok: false, reason: `SHA256SUMS has no entry for ${input.assetName}` };
+  const actual = sha256Hex(input.bytes);
+  if (actual !== expected)
+    return { ok: false, reason: `checksum mismatch for ${input.assetName}: expected ${expected}, got ${actual}` };
+  return { ok: true, sha256: actual };
+}
+
+// src/systemd.ts
+var INSTALL_ROOT = "/opt/zr-agent";
+var UNIT_NAME = "zr-agent.service";
+var UNIT_PATH = `/etc/systemd/system/${UNIT_NAME}`;
+var CONFIG_PATH = "/etc/zr-agent/config.json";
+var BIN_LINK = "/usr/local/bin/zr-agent";
+var LAUNCHER_BIN = `${INSTALL_ROOT}/zr-agent-launcher`;
+var SYSTEMD_UNIT = `[Unit]
+Description=zr-agent (zyber runner node agent)
+Documentation=https://github.com/W3DevTech/zr-agent-releases
+After=network-online.target docker.service
+Wants=network-online.target docker.service
+
+[Service]
+Type=simple
+ExecStart=${LAUNCHER_BIN} launcher
+Restart=always
+RestartSec=3
+RuntimeDirectory=zr-agent
+RuntimeDirectoryPreserve=yes
+StateDirectory=zr-agent
+LimitNOFILE=1048576
+
+[Install]
+WantedBy=multi-user.target
+`;
+
+// src/install.ts
+class InstallError extends Error {
+}
+var BINARY_NAME = "zr-agent";
+async function exists(path) {
+  try {
+    await lstat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var defaultInstallDeps = {
+  fetchBytes: async (url) => {
+    const res = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(5 * 60000) });
+    if (!res.ok)
+      throw new InstallError(`download failed: ${url} -> HTTP ${res.status}`);
+    return new Uint8Array(await res.arrayBuffer());
+  },
+  exec: async (cmd, args, env) => {
+    const { spawn } = await import("node:child_process");
+    return await new Promise((resolve, reject) => {
+      const child = spawn(cmd, args, { stdio: "inherit", env: { ...process.env, ...env } });
+      child.on("error", reject);
+      child.on("close", (code) => resolve({ code: code ?? 1 }));
+    });
+  },
+  fileExists: exists,
+  log: (line) => console.log(line)
+};
+async function writeAtomic(path, data, mode) {
+  await mkdir(dirname(path), { recursive: true });
+  const tmp = `${path}.tmp-${process.pid}`;
+  await writeFile(tmp, data, { mode });
+  await chmod(tmp, mode);
+  await rename(tmp, path);
+}
+async function flipSymlink(link, target) {
+  const tmp = `${link}.tmp-${process.pid}`;
+  await rm(tmp, { force: true });
+  await symlink(target, tmp);
+  await rename(tmp, link);
+}
+async function currentVersion(link) {
+  try {
+    const target = await readlink(link);
+    const v = target.split("/").filter(Boolean).pop() ?? "";
+    return isValidReleaseVersion(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+async function pruneVersions(versionsDir, keep, log) {
+  let entries = [];
+  try {
+    entries = await readdir(versionsDir);
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (!isValidReleaseVersion(e) || keep.has(e))
+      continue;
+    await rm(join(versionsDir, e), { recursive: true, force: true });
+    log(`removed old version ${e}`);
+  }
+}
+async function installAgent(opts, depsIn = {}) {
+  const deps = { ...defaultInstallDeps, ...Object.fromEntries(Object.entries(depsIn).filter(([, v]) => v !== undefined)) };
+  const root = opts.root ?? "";
+  const start = opts.start ?? true;
+  if (!isValidReleaseVersion(opts.version))
+    throw new InstallError(`invalid version "${opts.version}"`);
+  const asset = binaryAssetName(opts.arch);
+  const dl = (name) => releaseAssetUrl(opts.version, name, opts.releasesBase);
+  deps.log(`downloading zr-agent ${opts.version} (${asset})`);
+  const [sums, sig, bin] = await Promise.all([
+    deps.fetchBytes(dl(SUMS_ASSET)),
+    deps.fetchBytes(dl(SUMS_SIGNATURE_ASSET)),
+    deps.fetchBytes(dl(asset))
+  ]);
+  const verdict = verifyReleaseBinary({
+    version: opts.version,
+    assetName: asset,
+    bytes: bin,
+    sums,
+    signature: Buffer.from(sig).toString("utf8"),
+    publicKey: opts.publicKey
+  });
+  if (!verdict.ok)
+    throw new InstallError(`refusing to install: ${verdict.reason}`);
+  deps.log(`verified signature and checksum (sha256 ${verdict.sha256.slice(0, 12)}...)`);
+  const base = join(root, INSTALL_ROOT);
+  const versionsDir = join(base, "versions");
+  const current = join(base, "current");
+  const previous = await currentVersion(current);
+  await writeAtomic(join(versionsDir, opts.version, BINARY_NAME), bin, 493);
+  await writeAtomic(join(versionsDir, opts.version, ".verified"), `${JSON.stringify({ version: opts.version, asset, sha256: verdict.sha256, bytes: bin.length, atMs: Date.now() })}
+`, 420);
+  await writeAtomic(join(root, LAUNCHER_BIN), bin, 493);
+  await rm(join(base, "upgrade-pending.json"), { force: true });
+  await flipSymlink(current, join("versions", opts.version));
+  deps.log(`installed ${join(INSTALL_ROOT, "versions", opts.version, BINARY_NAME)}`);
+  await mkdir(dirname(join(root, BIN_LINK)), { recursive: true });
+  await flipSymlink(join(root, BIN_LINK), join(INSTALL_ROOT, "current", BINARY_NAME));
+  await pruneVersions(versionsDir, new Set([opts.version, ...previous ? [previous] : []]), deps.log);
+  await writeAtomic(join(root, UNIT_PATH), SYSTEMD_UNIT, 420);
+  deps.log(`wrote ${UNIT_PATH}`);
+  const configPath = join(root, CONFIG_PATH);
+  const configured = await deps.fileExists(configPath);
+  const agent = join(current, BINARY_NAME);
+  if (opts.join) {
+    if (!opts.url)
+      throw new InstallError("--url <control plane URL> is required with --join");
+    const args = ["register"];
+    if (opts.name)
+      args.push("--name", opts.name);
+    if (opts.forceRegister)
+      args.push("--force");
+    if (root)
+      args.push("--config", configPath);
+    const r = await deps.exec(agent, args, { ZR_AGENT_JOIN_TOKEN: opts.join, ZR_AGENT_URL: opts.url });
+    if (r.code !== 0)
+      throw new InstallError(`zr-agent register failed (exit ${r.code}); the binary is installed, fix the problem and run: zr-agent register --join <token> --url <url>`);
+  } else if (!configured) {
+    deps.log(`not registered yet: run "zr-agent register --join <zrj_ token> --url <control plane URL>" then "systemctl enable --now ${UNIT_NAME}"`);
+    if (start)
+      deps.log("skipping service start (no config)");
+    return;
+  }
+  if (!start) {
+    deps.log(`start it with: systemctl enable --now ${UNIT_NAME}`);
+    return;
+  }
+  for (const args of [["daemon-reload"], ["enable", UNIT_NAME], ["restart", UNIT_NAME]]) {
+    const r = await deps.exec("systemctl", args, {});
+    if (r.code !== 0)
+      throw new InstallError(`systemctl ${args.join(" ")} failed (exit ${r.code})`);
+  }
+  deps.log(`zr-agent ${opts.version} is running (journalctl -u ${UNIT_NAME} -f)`);
+}
+
+// ../../dashboard/packages/agent-protocol/src/constants.ts
+var MAX_FRAME_BYTES = 4 * 1024 * 1024;
+var JOIN_TOKEN_TTL_MS = 15 * 60000;
+var JOIN_TOKEN_PREFIX = "zrj_";
+var JOIN_TOKEN_BYTES = 32;
+
+// ../../dashboard/packages/agent-protocol/src/crypto.ts
+var TOKEN_BODY_LEN = Math.ceil(JOIN_TOKEN_BYTES * 4 / 3);
+var TOKEN_RE = new RegExp(`^${JOIN_TOKEN_PREFIX}[A-Za-z0-9_-]{${TOKEN_BODY_LEN}}$`);
+function isJoinTokenFormat(token) {
+  return typeof token === "string" && TOKEN_RE.test(token);
+}
+
+// src/cli.ts
+var USAGE = `@w3devx/zr-agent <version>
+
+Usage:
+  npx @w3devx/zr-agent@<version> install --join <zrj_token> --url <control plane URL> [--name <name>] [--no-start]
+
+Downloads zr-agent <version> (this package's own version), verifies the minisign signature and SHA-256 checksum,
+installs it to /opt/zr-agent/versions/<version>/, points /opt/zr-agent/current at it, writes the zr-agent systemd unit,
+registers the node and starts the service. Run it as root (sudo).
+
+Flags (the token and URL are also read from ZR_AGENT_JOIN_TOKEN and ZR_AGENT_URL):
+  --join <token>   join token from the dashboard's Add node dialog
+  --url <url>      control plane URL
+  --name <name>    node name (default: hostname)
+  --force          register again even if /etc/zr-agent/config.json exists
+  --no-start       install the files and unit only
+  --version <v>    install a different release than this package's version
+`;
+var VALUE_FLAGS = new Set(["join", "url", "name", "version", "root", "releases-base"]);
+var BOOL_FLAGS = new Set(["force", "no-start", "help"]);
+function parseCliArgs(argv) {
+  const flags = {};
+  let command = null;
+  for (let i = 0;i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "-h") {
+      flags.help = true;
+      continue;
+    }
+    if (!a.startsWith("--")) {
+      if (command !== null)
+        return { command, flags, error: `unexpected argument "${a}"` };
+      command = a;
+      continue;
+    }
+    const eq = a.indexOf("=");
+    const name = eq === -1 ? a.slice(2) : a.slice(2, eq);
+    if (BOOL_FLAGS.has(name)) {
+      if (eq !== -1)
+        return { command, flags, error: `--${name} takes no value` };
+      flags[name] = true;
+    } else if (VALUE_FLAGS.has(name)) {
+      const value = eq !== -1 ? a.slice(eq + 1) : argv[++i];
+      if (value === undefined || value === "" || eq === -1 && value.startsWith("--"))
+        return { command, flags, error: `--${name} needs a value` };
+      flags[name] = value;
+    } else {
+      return { command, flags, error: `unknown flag --${name}` };
+    }
+  }
+  return { command, flags, error: null };
+}
+var str = (v) => typeof v === "string" ? v : undefined;
+async function runCli(argv, deps) {
+  const p = parseCliArgs(argv);
+  if (p.error) {
+    deps.err(`zr-agent: ${p.error}`);
+    deps.err(USAGE);
+    return 2;
+  }
+  if (p.flags.help || p.command === null || p.command === "help") {
+    deps.out(USAGE);
+    return p.command === null && !p.flags.help ? 2 : 0;
+  }
+  if (p.command === "version") {
+    deps.out(deps.packageVersion);
+    return 0;
+  }
+  if (p.command !== "install") {
+    deps.err(`zr-agent: unknown command "${p.command}" (this package only installs; after install use the zr-agent binary: zr-agent status)`);
+    return 2;
+  }
+  if (deps.platform !== "linux") {
+    deps.err(`zr-agent install: linux only (this is ${deps.platform})`);
+    return 1;
+  }
+  const arch = releaseArch(deps.arch);
+  if (!arch) {
+    deps.err(`zr-agent install: no build for CPU architecture "${deps.arch}" (x64 and arm64 only)`);
+    return 1;
+  }
+  const version = str(p.flags.version) ?? deps.packageVersion;
+  if (!isValidReleaseVersion(version) || version === "0.0.0") {
+    deps.err(`zr-agent install: "${version}" is not a released version; pass --version <x.y.z> or use npx @w3devx/zr-agent@<x.y.z>`);
+    return 2;
+  }
+  const root = str(p.flags.root) ?? "";
+  if (root === "" && deps.uid !== 0) {
+    deps.err("zr-agent install: must run as root (try: sudo npx @w3devx/zr-agent@" + version + " install ...)");
+    return 1;
+  }
+  const start = p.flags["no-start"] !== true;
+  if (start && root === "" && !deps.hasSystemd()) {
+    deps.err("zr-agent install: systemd not found; pass --no-start to install the files only");
+    return 1;
+  }
+  const join2 = str(p.flags.join) ?? deps.env.ZR_AGENT_JOIN_TOKEN?.trim();
+  const url = str(p.flags.url) ?? deps.env.ZR_AGENT_URL?.trim();
+  if (join2 !== undefined && join2 !== "" && !isJoinTokenFormat(join2)) {
+    deps.err("zr-agent install: the join token is malformed (expected zrj_ followed by 43 base64url characters)");
+    return 2;
+  }
+  if (join2 && !url) {
+    deps.err("zr-agent install: --url <control plane URL> is required with --join");
+    return 2;
+  }
+  try {
+    await deps.install({
+      version,
+      arch,
+      root,
+      join: join2 || undefined,
+      url,
+      name: str(p.flags.name),
+      forceRegister: p.flags.force === true,
+      start,
+      releasesBase: str(p.flags["releases-base"])
+    }, { fetchBytes: deps.fetchBytes, exec: deps.exec, fileExists: deps.fileExists, log: deps.log ?? deps.out });
+  } catch (e) {
+    deps.err(`zr-agent install: ${e instanceof InstallError ? e.message : e instanceof Error ? e.message : String(e)}`);
+    return 1;
+  }
+  return 0;
+}
+
+// src/main.ts
+var code = await runCli(process.argv.slice(2), {
+  packageVersion: package_default.version,
+  platform: process.platform,
+  arch: process.arch,
+  uid: typeof process.geteuid === "function" ? process.geteuid() : null,
+  env: process.env,
+  out: (line) => console.log(line),
+  err: (line) => console.error(line),
+  hasSystemd: () => existsSync("/run/systemd/system"),
+  install: installAgent
+});
+process.exitCode = code;

package/package.json

@@ -1,6 +1,36 @@
 {
   "name": "@w3devx/zr-agent",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-rc.2",
+  "type": "module",
+  "description": "Installer for zr-agent, the zyber runner node agent: downloads the exact release, verifies its minisign signature and checksum, installs it under /opt/zr-agent and writes the systemd unit.",
+  "bin": {
+    "zr-agent": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ashutoshpw/zyber-sh-manager.git",
+    "directory": "npm/zr-agent"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "bun build src/main.ts --target node --outfile dist/cli.js && chmod +x dist/cli.js",
+    "test": "bun test"
+  }
+}