warpmetal 0.8.10 → 0.8.12

package/README.md

@@ -317,9 +317,10 @@ compatible external signer.
   Wallet key management and signing remain outside this package.
 - Destructive or state-changing commands require explicit confirmations and
   generate idempotency keys by default.
-- Runtime bootstrap credentials remain memory-only and are requested only after
-  the first host key has been pinned and strictly reverified. Signed supervisor
-  bundles are checksum- and signature-verified before OpenSSH uploads them.
+- Runtime bootstrap credentials remain memory-only. Manual installation asks
+  for one only after the first host key has been pinned and strictly reverified;
+  automatic reload bootstrap is rendered directly into provider-bound
+  cloud-init. Signed supervisor bundles are checksum- and signature-verified.
 - Each agent gets a distinct SSH key forced into exactly one sandbox. Token-free
   connection profiles pin the VPS host key and contain no owner credential or
   private-key material.
@@ -332,11 +333,30 @@ compatible external signer.
   external workspace, lifetime, and start time. The wait completes only when
   the observed digest and generation both match the accepted target.
 - Guarded reload powers the server off first. Runtime-enabled reload requires a
-  second acknowledgment, after which the CLI guides supervisor reinstall and
-  pinned connection-profile refresh. Only a locally recorded reload operation
-  that succeeds and reports an owner-host-key refresh opens one new managed
-  trust epoch; failed or ambiguous reloads retain the old pin and never permit
-  replacement. Erased workspaces are never described as recoverable.
+  second acknowledgment because all sandbox workspaces are erased. WarpMetal
+  places the approved signed Runtime bootstrap in reload cloud-init
+  automatically; wait for Runtime readiness, then refresh pinned sandbox
+  connection profiles. Only a locally recorded reload operation that succeeds
+  and reports an owner-host-key refresh opens one new managed trust epoch;
+  failed or ambiguous reloads retain the old pin and never permit replacement.
+  Erased workspaces are never described as recoverable.
+
+For a Runtime-enabled reload, no separate installation command is part of the
+successful path:
+
+```sh
+warpmetal server reload \
+  --server <serverId> --confirm ERASE --power-off-first \
+  --acknowledge-agent-runtime-reset --wait --json
+warpmetal runtime get --server <serverId> --wait --json
+warpmetal sandbox access refresh \
+  --server <serverId> --sandbox <sandboxId> --grant <grantId> \
+  --connection-file <profile-path> --confirm REFRESH --wait --json
+```
+
+The successful reload records a new operation-bound owner SSH trust epoch.
+Verify the replacement host key before using owner SSH; sandbox access remains
+strictly pinned through each refreshed connection profile.
 
 ## Agent Runtime example
 
@@ -386,10 +406,12 @@ ssh -t <alias> claude
 ssh <alias> claude -p '<task>'
 ssh -t <alias> agent
 ssh <alias> agent -p '<task>'
+ssh -t <alias> gemini
+ssh <alias> gemini -p '<task>'
 ```
 
-Install and authenticate Codex, Claude Code, or Cursor CLI inside the
-sandbox first. Provider credentials are sandbox-owned and remain in its
+Install and authenticate Codex, Claude Code, Cursor CLI, or Gemini CLI inside
+the sandbox first. Provider credentials are sandbox-owned and remain in its
 persistent home; WarpMetal does not install these tools, perform their login,
 or receive their credentials.
 
@@ -434,6 +456,14 @@ weaken sandbox forwarding controls to make the IDE connect. Use the supported
 [headless mode](https://cursor.com/docs/cli/headless) with
 `ssh <alias> agent -p '<task>'` instead.
 
+Use the official Gemini CLI [installation guide](https://geminicli.com/docs/get-started/installation/)
+before running `ssh -t <alias> gemini`, or use its documented
+[headless mode](https://geminicli.com/docs/cli/headless/) with
+`ssh <alias> gemini -p '<task>'`. Gemini's optional Docker or Podman sandbox is
+normally unavailable inside the WarpMetal sandbox because no host
+container-engine socket is exposed; run Gemini directly inside the existing
+outer sandbox and choose its approvals yourself.
+
 On the first install in a server trust epoch, JSON output includes
 `hostKeyTrust.state: "trusted_first_use"` and the safe Ed25519 fingerprint.
 Later installs report `"matched"`. First-use trust protects continuity after

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.8.10",
+  "version": "0.8.12",
   "description": "Agent-safe CLI and skill for purchasing, renewing, and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {

package/skills/warpmetal/SKILL.md

@@ -254,8 +254,8 @@ warpmetal server power \
 For a destructive reload, explain that every server-disk file is erased and
 obtain explicit approval. If Agent Runtime is enabled, also explain that every
 sandbox workspace is lost, desired sandboxes return as empty workspaces after
-reinstall, and pinned profiles must be refreshed. Then use only the guarded
-command:
+automatic Runtime setup, and pinned profiles must be refreshed. Then use only
+the guarded command:
 
 ```sh
 warpmetal server reload \
@@ -271,14 +271,18 @@ warpmetal server reload \
 The CLI requires the recovery owner credential so it can keep polling after
 reload revokes SSH-derived access tokens. CLI 0.8.8 records a new SSH trust
 epoch only when that exact local reload operation succeeds and reports that the
-owner host key needs refresh. The next Runtime install may trust the first
-observed Ed25519 host key once in that epoch, then must reconnect strictly
-before requesting bootstrap. Failed or ambiguous reloads retain the prior pin;
+owner host key needs refresh. Failed or ambiguous reloads retain the prior pin;
 never bypass a mismatch or delete a pin to force a retry. A provider-console
-pre-seed is the optional higher-assurance path. Then wait for grants to become applied and refresh
-every connection profile with `sandbox access refresh --confirm REFRESH`
-before connecting. Do not fall back to raw API calls for deletion, networking,
-or another unsupported mutation.
+pre-seed is the optional higher-assurance path.
+
+After a successful Runtime-enabled reload, WarpMetal performs signed Runtime
+setup automatically. Do not run a separate installation command. Wait with
+`warpmetal runtime get --server <serverId> --wait --json`, then wait for grants
+to become `applied` and refresh every connection profile with
+`sandbox access refresh --confirm REFRESH` before connecting. The successful
+operation created a new owner host-trust epoch, so verify the replacement host
+key before owner SSH. Do not fall back to raw API calls for deletion,
+networking, or another unsupported mutation.
 
 ## Use Agent Runtime
 
@@ -286,12 +290,13 @@ Agent Runtime is optional and shares one owner's VPS only among that owner's
 agents. Discover live `agentRuntime` capacity and OS support before choosing
 sizes. Use `--runtime-file` to include sandbox intent in an unpaid order, or
 `warpmetal runtime enable` after the VPS is ready. Supervisor installation is
-separate and requires approval plus `--confirm INSTALL`.
+separate and requires approval plus `--confirm INSTALL` for initial setup or
+explicit repair; Runtime-enabled OS reloads use automatic signed cloud-init.
 
 With CLI 0.8.8, that confirmation also authorizes managed trust on first use
 when the exact server trust epoch has no pin. The CLI performs only an owner-
 key-authenticated `ssh true`, pins the first observed Ed25519 key, immediately
-reconnects strictly, and requests bootstrap only afterward. Later connections
+reconnects strictly before requesting bootstrap. Later connections
 must match. Explain that TOFU cannot detect an active attacker on the first
 connection; never use `ssh-keyscan`, accept a mismatch, or expose a generic pin
 reset.
@@ -322,8 +327,10 @@ ssh <alias>
 
 The local alias preserves the forced gateway: it cannot open a host shell and
 does not relax forwarding denial. Provider authentication and credentials stay
-inside the sandbox. After an authenticated profile refresh, update the alias
-only with the explicit second confirmation:
+inside the sandbox. Install and authenticate Codex, Claude Code, Cursor CLI, or
+Gemini CLI inside the sandbox; use the entry points and compatibility guidance
+in [references/runtime.md](references/runtime.md). After an authenticated
+profile refresh, update the alias only with the explicit second confirmation:
 
 ```sh
 warpmetal sandbox access refresh \

package/skills/warpmetal/references/cli-reference.md

@@ -201,7 +201,18 @@ Reload requires the recovery owner credential rather than a short-lived
 SSH-derived token. `--power-off-first` authorizes shutdown and powered-off
 verification inside the same operation. When Agent Runtime is enabled,
 `--acknowledge-agent-runtime-reset` is required because workspaces are erased,
-the supervisor must be reinstalled, and connection profiles must be refreshed.
+the Runtime identity is replaced, empty sandboxes are reconciled automatically,
+and connection profiles must be refreshed. After a successful reload, wait for
+automatic setup before refreshing profiles:
+
+```sh
+warpmetal runtime get --server <serverId> --wait --json
+```
+
+The successful operation records a new owner SSH trust epoch. Verify the
+replacement host key before owner SSH. Manual Runtime installation remains an
+explicit repair path when automatic setup fails; it is not part of a
+successful reload.
 
 Use `--token-file` only for recovery when local state is unavailable. Prefer
 `WARPMETAL_OWNER_TOKEN` or `WARPMETAL_ACCESS_TOKEN` for a single command over a
@@ -277,7 +288,7 @@ returns the OpenSSH or remote exit status. `--connection-file` on grant
 creation requires `--wait`.
 `sandbox access refresh` atomically replaces a stale token-free profile with
 the currently applied grant and API-reported pinned host keys; use it after an
-OS reload and supervisor reinstall.
+OS reload once automatic Runtime reconciliation is ready.
 
 `sandbox access install-ssh` is local-only and requires CLI 0.8.10 or newer.
 It turns the reviewed profile and sandbox-private identity into a concrete
@@ -300,8 +311,14 @@ ssh -t <alias> claude
 ssh <alias> claude -p '<task>'
 ssh -t <alias> agent
 ssh <alias> agent -p '<task>'
+ssh -t <alias> gemini
+ssh <alias> gemini -p '<task>'
 ```
 
+Install and authenticate Codex, Claude Code, Cursor CLI, or Gemini CLI inside
+the sandbox first. WarpMetal does not install, authenticate, configure, or
+receive credentials for those tools.
+
 [Codex Desktop](https://learn.chatgpt.com/docs/remote-connections) reads
 the concrete alias from `~/.ssh/config` and starts Codex through the sandbox
 login shell, so Codex must be installed and on that login-shell `PATH`. The
@@ -310,6 +327,13 @@ not compatible with this boundary. Keep forwarding denied and use the
 [Cursor CLI](https://cursor.com/docs/cli/overview) interactive or
 [headless](https://cursor.com/docs/cli/headless) commands shown above.
 
+Install Gemini CLI from its official [installation guide](https://geminicli.com/docs/get-started/installation/)
+and use its documented [headless mode](https://geminicli.com/docs/cli/headless/)
+for `gemini -p`. Gemini's optional Docker or Podman sandbox is normally
+unavailable inside the WarpMetal sandbox because no host container-engine
+socket is exposed; run Gemini directly inside the existing outer sandbox and
+choose its approvals yourself.
+
 ## Skill installation and state
 
 ```sh

package/skills/warpmetal/references/runtime.md

@@ -208,11 +208,12 @@ The token-free profile is written only after the grant is `applied` and the
 API supplies verified VPS host keys. Do not print or open that profile in an
 agent conversation.
 
-After a destructive OS reload, reinstall the supervisor and wait for the
-retained active grant to become `applied`, then replace its stale pinned
-profile:
+After a successful destructive OS reload, the signed Runtime bootstrap runs
+automatically. Wait for Runtime readiness and for the retained active grant to
+become `applied`, then replace its stale pinned profile:
 
 ```sh
+warpmetal runtime get --server <serverId> --wait --json
 warpmetal sandbox access refresh \
   --server <serverId> \
   --sandbox <sandboxId> \
@@ -225,7 +226,8 @@ warpmetal sandbox access refresh \
 
 The sandbox record is retained, but its old workspace is not; reconciliation
 creates a new empty workspace. Never bypass a host-key mismatch or reuse the
-pre-reload profile.
+pre-reload profile. Use manual Runtime installation only as an explicitly
+approved repair when the backend reports that automatic setup failed.
 
 ### Install a concrete OpenSSH alias
 
@@ -294,11 +296,14 @@ ssh -t <alias> claude
 ssh <alias> claude -p '<task>'
 ssh -t <alias> agent
 ssh <alias> agent -p '<task>'
+ssh -t <alias> gemini
+ssh <alias> gemini -p '<task>'
 ```
 
-Provider authentication and credentials are sandbox-owned and persist only in
-the sandbox home. WarpMetal does not install, authenticate, configure, or
-receive credentials for Codex, Claude Code, or Cursor CLI.
+Install and authenticate Codex, Claude Code, Cursor CLI, or Gemini CLI inside
+the sandbox first. Provider authentication and credentials are sandbox-owned
+and persist only in the sandbox home. WarpMetal does not install, authenticate,
+configure, or receive credentials for those tools.
 
 [Codex Desktop](https://learn.chatgpt.com/docs/remote-connections)
 discovers a concrete alias through `~/.ssh/config`, requires ordinary
@@ -314,6 +319,14 @@ restricted alias. Do not relax forwarding controls. Use the official
 [headless mode](https://cursor.com/docs/cli/headless) with
 `ssh <alias> agent -p '<task>'` instead.
 
+Follow Gemini CLI's official [installation guide](https://geminicli.com/docs/get-started/installation/),
+then use `ssh -t <alias> gemini` interactively or its documented
+[headless mode](https://geminicli.com/docs/cli/headless/) with
+`ssh <alias> gemini -p '<task>'`. Gemini's optional Docker or Podman sandbox is
+normally unavailable inside the WarpMetal sandbox because no host
+container-engine socket is exposed; run Gemini directly inside the existing
+outer sandbox and choose its approvals yourself.
+
 Connect without an owner management credential:
 
 ```sh

package/skills/warpmetal/references/safety.md

@@ -95,9 +95,10 @@ A reload requires both `confirm: "ERASE"` and `powerOffFirst: true`. Treat
 server, wait until it is powered off, and then erase and reinstall it inside
 one lifecycle operation. When Agent Runtime is enabled, also require
 `acknowledgeAgentRuntimeReset`: all sandbox workspaces are permanently erased,
-the supervisor identity is revoked, desired sandboxes are recreated empty
-after reinstall, and all pinned profiles require refresh. Use only the guarded
-CLI command and stop on `manual_review`. Reload invalidates the prior
+the supervisor identity is revoked, signed Runtime setup runs automatically,
+desired sandboxes are recreated empty, and all pinned profiles require refresh.
+Use only the guarded CLI command, wait for Runtime readiness, and stop on
+`manual_review`. Reload invalidates the prior
 owner-facing SSH host-key trust decision; the provider may rotate or preserve
 the key. CLI 0.8.8 opens one new managed trust epoch only after the exact local
 reload operation succeeds and reports that refresh is required. The first

package/src/cli.js

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
 import { basename, join, resolve } from "node:path";
 
 import {
@@ -147,6 +148,14 @@ SSH host trust (CLI 0.8.8+):
   active attacker on the first connection. Provider-console pre-enrollment is
   the optional higher-assurance alternative.
 
+Runtime-enabled reloads:
+  Reload still requires --acknowledge-agent-runtime-reset because every
+  sandbox workspace is erased. After a successful reload, Runtime setup is
+  automatic: use warpmetal runtime get --server <serverId> --wait --json,
+  then refresh every sandbox connection profile before reconnecting. The
+  successful operation also records a new owner SSH trust epoch; verify the
+  replacement host key before owner SSH.
+
 Sandbox SSH aliases:
   Refresh the authenticated connection profile before refreshing an existing
   alias:
@@ -165,6 +174,12 @@ Sandbox SSH aliases:
     ssh <alias> claude -p "<prompt>"
     ssh -t <alias> agent
     ssh <alias> agent -p "<prompt>"
+    ssh -t <alias> gemini
+    ssh <alias> gemini -p "<prompt>"
+
+  Install and authenticate Codex, Claude Code, Cursor CLI, or Gemini CLI inside
+  the sandbox first. WarpMetal does not install, authenticate, configure, or
+  receive credentials for those tools.
 
   Codex Desktop discovers the concrete alias through ~/.ssh/config and opens
   the sandbox login shell, so Codex must be available on the login-shell PATH.
@@ -172,10 +187,17 @@ Sandbox SSH aliases:
   a host shell, and do not relax isolation: ClearAllForwardings yes keeps all
   forwarding disabled.
 
+  Gemini's optional Docker or Podman sandbox is normally unavailable inside
+  the WarpMetal sandbox because no host container-engine socket is exposed;
+  run Gemini directly inside the existing outer sandbox and choose its
+  approvals yourself.
+
   Compatibility references:
     https://learn.chatgpt.com/docs/remote-connections
     https://cursor.com/docs/cli/overview
     https://cursor.com/docs/cli/headless
+    https://geminicli.com/docs/get-started/installation/
+    https://geminicli.com/docs/cli/headless/
 
 Credential environment variables:
   WARPMETAL_OWNER_TOKEN  Recovery/bootstrap credential for one explicit command
@@ -1982,7 +2004,7 @@ async function applyReloadResult(
   await store.invalidateServerAccess(serverId);
   if (operation.result?.reloadImpact?.agentRuntimeAffected) {
     await store.saveRuntime(serverId, {
-      state: "needs_reinstall",
+      state: "pending_install",
       desiredRevision: undefined,
       appliedRevision: 0,
       lastSeenAt: null,
@@ -2090,8 +2112,8 @@ async function handleServerReload(client, store, options, context) {
       (operation?.state === "succeeded" &&
       operation.result?.reloadImpact?.ownerKnownHostsNeedRefresh
         ? operation.result?.reloadImpact?.agentRuntimeAffected
-          ? " The next Runtime install will establish the operation-bound owner SSH trust epoch, then reinstall Agent Runtime and refresh every sandbox connection profile."
-          : " The next Runtime install will establish the operation-bound owner SSH trust epoch before reconnecting."
+          ? " Agent Runtime setup is automatic. Wait for Agent Runtime to become ready, then refresh every sandbox connection profile. Verify the replacement host key before owner SSH."
+          : " Verify the replacement host key before owner SSH; the successful reload recorded a new operation-bound trust epoch."
         : operation?.state === "succeeded"
           ? " WarpMetal did not report a host-key refresh; the existing managed pin remains required."
           : ""),
@@ -2740,7 +2762,7 @@ async function handleAccessInstallSsh(options, context) {
     alias: stringOption(options, "alias", { required: true }),
     connectionFile: stringOption(options, "connection-file", { required: true }),
     identity: stringOption(options, "identity", { required: true }),
-    homeDirectory: context.env.HOME,
+    homeDirectory: context.env.HOME || context.env.USERPROFILE || homedir(),
     confirm: stringOption(options, "confirm"),
   });
   emit(
@@ -2755,7 +2777,7 @@ async function handleAccessInstallSsh(options, context) {
 async function handleAccessRemoveSsh(options, context) {
   const result = await removeSshAlias({
     alias: stringOption(options, "alias", { required: true }),
-    homeDirectory: context.env.HOME,
+    homeDirectory: context.env.HOME || context.env.USERPROFILE || homedir(),
     confirm: stringOption(options, "confirm", { required: true }),
   });
   emit(

package/src/ssh-alias.js

@@ -10,7 +10,7 @@ import {
   rmdir,
   unlink,
 } from "node:fs/promises";
-import { isAbsolute, join, parse, resolve } from "node:path";
+import { isAbsolute, join, parse, posix, resolve, win32 } from "node:path";
 import { randomUUID } from "node:crypto";
 
 import {
@@ -21,7 +21,8 @@ import {
 import { CliError } from "./errors.js";
 
 const ALIAS_PATTERN = /^(?=.{1,63}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-const UNSAFE_PATH = /[\0\r\n\t%"'`$!&;<>|*?()[\]{}\\#]/;
+const POSIX_UNSAFE_PATH = /[\0\r\n\t%"'`$!&;<>|*?()[\]{}\\#]/;
+const WINDOWS_UNSAFE_PATH = /[\0\r\n\t%"'`$!&;<>|*?()[\]{}#]/;
 const MANAGED_HEADER = "# Managed by WarpMetal. Do not edit.";
 
 function invalid(message) {
@@ -37,17 +38,18 @@ export function validateSshAlias(value) {
   return value;
 }
 
-function validateAbsolutePath(value, label) {
-  if (
-    typeof value !== "string" ||
-    !isAbsolute(value) ||
-    resolve(value) !== value ||
-    value === parse(value).root ||
-    UNSAFE_PATH.test(value)
-  ) {
+export function validateAbsolutePath(value, label, platform = process.platform) {
+  const path = platform === "win32" ? win32 : posix;
+  if (typeof value !== "string" || !path.isAbsolute(value)) {
     invalid(`${label} must be an absolute path without unsafe interpolation characters.`);
   }
-  return value;
+  const resolved = path.resolve(value);
+  const unsafePath =
+    platform === "win32" ? WINDOWS_UNSAFE_PATH : POSIX_UNSAFE_PATH;
+  if (resolved === path.parse(resolved).root || unsafePath.test(resolved)) {
+    invalid(`${label} must be an absolute path without unsafe interpolation characters.`);
+  }
+  return resolved;
 }
 
 function requireOwner(metadata, label) {
@@ -420,12 +422,19 @@ async function syncDirectory(path) {
     handle = await open(path, "r");
     await handle.sync();
   } catch (error) {
-    if (!["EINVAL", "ENOTSUP", "EISDIR"].includes(error?.code)) throw error;
+    if (!isIgnorableDirectorySyncError(error)) throw error;
   } finally {
     await handle?.close().catch(() => {});
   }
 }
 
+export function isIgnorableDirectorySyncError(error, platform = process.platform) {
+  return (
+    ["EINVAL", "ENOTSUP", "EISDIR"].includes(error?.code) ||
+    (platform === "win32" && ["EPERM", "EACCES"].includes(error?.code))
+  );
+}
+
 async function commitStaged(staged) {
   try {
     for (const item of staged) {