warpmetal 0.2.1 → 0.2.3

package/README.md

@@ -65,6 +65,9 @@ alternate state directory.
   permissions where the platform supports POSIX modes.
 - The CLI passes an SSH private-key path directly to `ssh-keygen`; it never
   reads the private key.
+- WarpMetal applies key-only OpenSSH configuration on initial provisioning and
+  every OS reload. Password and keyboard-interactive login are disabled; never
+  request, store, or expect a VPS login password.
 - The CLI accepts an externally produced x402 `PAYMENT-SIGNATURE` from a file.
   Wallet key management and signing remain outside this package.
 - Destructive or state-changing commands require explicit confirmations and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Agent-safe CLI and skill for purchasing and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {

package/skills/warpmetal/SKILL.md

@@ -26,6 +26,11 @@ Never read, print, summarize, upload, or commit the WarpMetal state file. Never
 read an SSH private-key file. Pass its path only to a command designed to use
 it. Never request or handle a wallet seed phrase or private key.
 
+WarpMetal provisions and reloads servers with key-only OpenSSH access. Password
+and keyboard-interactive login are disabled, including for root. Never request,
+store, invent, or expect a VPS login password; use the submitted public key and
+its matching private-key path.
+
 ## Discover before acting
 
 Run:
@@ -88,6 +93,11 @@ Poll a prepared or paid order with:
 warpmetal order status --task <taskId> --wait --json
 ```
 
+After initial provisioning and every OS reload, WarpMetal reapplies the same
+key-only policy: `PasswordAuthentication no`,
+`KbdInteractiveAuthentication no`, `PermitRootLogin prohibit-password`, and
+`AuthenticationMethods publickey`.
+
 For routine management, prove possession of the installed SSH key without
 reading it:
 
@@ -110,7 +120,11 @@ warpmetal server power \
 
 Do not fall back to raw API calls for reload, deletion, networking, renewal,
 or another unsupported mutation. Explain that the installed CLI version does
-not yet expose that guarded operation.
+not yet expose that guarded operation. The public reload contract requires
+both `confirm: "ERASE"` and `powerOffFirst: true`; the latter authorizes the
+same lifecycle operation to shut down the server and wait for provider power
+off before erasing it. This contract knowledge is not permission to bypass the
+CLI restriction.
 
 ## Use Agent Runtime
 

package/skills/warpmetal/references/cli-reference.md

@@ -75,6 +75,11 @@ warpmetal operation get \
   --json
 ```
 
+This CLI version does not expose reload. The public reload API requires both
+`confirm: "ERASE"` and `powerOffFirst: true`, with shutdown, powered-off
+verification, and reload handled by one lifecycle operation. Do not call that
+endpoint with raw HTTP; wait for a guarded CLI command.
+
 Use `--token-file` only for recovery when local state is unavailable. Prefer
 `WARPMETAL_OWNER_TOKEN` or `WARPMETAL_ACCESS_TOKEN` for a single command over a
 shell argument, because command-line arguments can be recorded in history and

package/skills/warpmetal/references/safety.md

@@ -25,6 +25,10 @@
 - Never read or transmit an SSH private key. Pass only its filesystem path to
   `warpmetal server login`, `warpmetal runtime install`,
   `warpmetal sandbox connect`, or `ssh-keygen`.
+- WarpMetal disables VPS password and keyboard-interactive SSH login after
+  initial provisioning and every OS reload. Never request, store, invent, or
+  expect a VPS login password; use the submitted public key and matching
+  private-key path.
 - Never place the owner SSH key, owner token, management access token, runtime
   bootstrap, supervisor node token, or state file inside a sandbox.
 - Give each agent a distinct sandbox-specific SSH key and grant. Never reuse
@@ -47,6 +51,12 @@ Obtain explicit user approval immediately before:
 - revoking a sandbox access grant; and
 - any destructive reload, sandbox deletion, or replacement-key operation.
 
+A reload requires both `confirm: "ERASE"` and `powerOffFirst: true`. Treat
+`powerOffFirst` as explicit authorization for WarpMetal to shut down the
+server, wait until it is powered off, and then erase and reinstall it inside
+one lifecycle operation. Do not reconstruct this flow with raw HTTP while the
+installed CLI lacks a guarded reload command.
+
 An order preparation is unpaid but consumes a limited prepared-order slot.
 Confirm the plan, hostname, OS, and public key before preparing it.