warpmetal 0.8.11 → 0.8.12

package/README.md

@@ -317,9 +317,10 @@ compatible external signer.
   Wallet key management and signing remain outside this package.
 - Destructive or state-changing commands require explicit confirmations and
   generate idempotency keys by default.
-- Runtime bootstrap credentials remain memory-only and are requested only after
-  the first host key has been pinned and strictly reverified. Signed supervisor
-  bundles are checksum- and signature-verified before OpenSSH uploads them.
+- Runtime bootstrap credentials remain memory-only. Manual installation asks
+  for one only after the first host key has been pinned and strictly reverified;
+  automatic reload bootstrap is rendered directly into provider-bound
+  cloud-init. Signed supervisor bundles are checksum- and signature-verified.
 - Each agent gets a distinct SSH key forced into exactly one sandbox. Token-free
   connection profiles pin the VPS host key and contain no owner credential or
   private-key material.
@@ -332,11 +333,30 @@ compatible external signer.
   external workspace, lifetime, and start time. The wait completes only when
   the observed digest and generation both match the accepted target.
 - Guarded reload powers the server off first. Runtime-enabled reload requires a
-  second acknowledgment, after which the CLI guides supervisor reinstall and
-  pinned connection-profile refresh. Only a locally recorded reload operation
-  that succeeds and reports an owner-host-key refresh opens one new managed
-  trust epoch; failed or ambiguous reloads retain the old pin and never permit
-  replacement. Erased workspaces are never described as recoverable.
+  second acknowledgment because all sandbox workspaces are erased. WarpMetal
+  places the approved signed Runtime bootstrap in reload cloud-init
+  automatically; wait for Runtime readiness, then refresh pinned sandbox
+  connection profiles. Only a locally recorded reload operation that succeeds
+  and reports an owner-host-key refresh opens one new managed trust epoch;
+  failed or ambiguous reloads retain the old pin and never permit replacement.
+  Erased workspaces are never described as recoverable.
+
+For a Runtime-enabled reload, no separate installation command is part of the
+successful path:
+
+```sh
+warpmetal server reload \
+  --server <serverId> --confirm ERASE --power-off-first \
+  --acknowledge-agent-runtime-reset --wait --json
+warpmetal runtime get --server <serverId> --wait --json
+warpmetal sandbox access refresh \
+  --server <serverId> --sandbox <sandboxId> --grant <grantId> \
+  --connection-file <profile-path> --confirm REFRESH --wait --json
+```
+
+The successful reload records a new operation-bound owner SSH trust epoch.
+Verify the replacement host key before using owner SSH; sandbox access remains
+strictly pinned through each refreshed connection profile.
 
 ## Agent Runtime example
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.8.11",
+  "version": "0.8.12",
   "description": "Agent-safe CLI and skill for purchasing, renewing, and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {

package/skills/warpmetal/SKILL.md

@@ -254,8 +254,8 @@ warpmetal server power \
 For a destructive reload, explain that every server-disk file is erased and
 obtain explicit approval. If Agent Runtime is enabled, also explain that every
 sandbox workspace is lost, desired sandboxes return as empty workspaces after
-reinstall, and pinned profiles must be refreshed. Then use only the guarded
-command:
+automatic Runtime setup, and pinned profiles must be refreshed. Then use only
+the guarded command:
 
 ```sh
 warpmetal server reload \
@@ -271,14 +271,18 @@ warpmetal server reload \
 The CLI requires the recovery owner credential so it can keep polling after
 reload revokes SSH-derived access tokens. CLI 0.8.8 records a new SSH trust
 epoch only when that exact local reload operation succeeds and reports that the
-owner host key needs refresh. The next Runtime install may trust the first
-observed Ed25519 host key once in that epoch, then must reconnect strictly
-before requesting bootstrap. Failed or ambiguous reloads retain the prior pin;
+owner host key needs refresh. Failed or ambiguous reloads retain the prior pin;
 never bypass a mismatch or delete a pin to force a retry. A provider-console
-pre-seed is the optional higher-assurance path. Then wait for grants to become applied and refresh
-every connection profile with `sandbox access refresh --confirm REFRESH`
-before connecting. Do not fall back to raw API calls for deletion, networking,
-or another unsupported mutation.
+pre-seed is the optional higher-assurance path.
+
+After a successful Runtime-enabled reload, WarpMetal performs signed Runtime
+setup automatically. Do not run a separate installation command. Wait with
+`warpmetal runtime get --server <serverId> --wait --json`, then wait for grants
+to become `applied` and refresh every connection profile with
+`sandbox access refresh --confirm REFRESH` before connecting. The successful
+operation created a new owner host-trust epoch, so verify the replacement host
+key before owner SSH. Do not fall back to raw API calls for deletion,
+networking, or another unsupported mutation.
 
 ## Use Agent Runtime
 
@@ -286,12 +290,13 @@ Agent Runtime is optional and shares one owner's VPS only among that owner's
 agents. Discover live `agentRuntime` capacity and OS support before choosing
 sizes. Use `--runtime-file` to include sandbox intent in an unpaid order, or
 `warpmetal runtime enable` after the VPS is ready. Supervisor installation is
-separate and requires approval plus `--confirm INSTALL`.
+separate and requires approval plus `--confirm INSTALL` for initial setup or
+explicit repair; Runtime-enabled OS reloads use automatic signed cloud-init.
 
 With CLI 0.8.8, that confirmation also authorizes managed trust on first use
 when the exact server trust epoch has no pin. The CLI performs only an owner-
 key-authenticated `ssh true`, pins the first observed Ed25519 key, immediately
-reconnects strictly, and requests bootstrap only afterward. Later connections
+reconnects strictly before requesting bootstrap. Later connections
 must match. Explain that TOFU cannot detect an active attacker on the first
 connection; never use `ssh-keyscan`, accept a mismatch, or expose a generic pin
 reset.

package/skills/warpmetal/references/cli-reference.md

@@ -201,7 +201,18 @@ Reload requires the recovery owner credential rather than a short-lived
 SSH-derived token. `--power-off-first` authorizes shutdown and powered-off
 verification inside the same operation. When Agent Runtime is enabled,
 `--acknowledge-agent-runtime-reset` is required because workspaces are erased,
-the supervisor must be reinstalled, and connection profiles must be refreshed.
+the Runtime identity is replaced, empty sandboxes are reconciled automatically,
+and connection profiles must be refreshed. After a successful reload, wait for
+automatic setup before refreshing profiles:
+
+```sh
+warpmetal runtime get --server <serverId> --wait --json
+```
+
+The successful operation records a new owner SSH trust epoch. Verify the
+replacement host key before owner SSH. Manual Runtime installation remains an
+explicit repair path when automatic setup fails; it is not part of a
+successful reload.
 
 Use `--token-file` only for recovery when local state is unavailable. Prefer
 `WARPMETAL_OWNER_TOKEN` or `WARPMETAL_ACCESS_TOKEN` for a single command over a
@@ -277,7 +288,7 @@ returns the OpenSSH or remote exit status. `--connection-file` on grant
 creation requires `--wait`.
 `sandbox access refresh` atomically replaces a stale token-free profile with
 the currently applied grant and API-reported pinned host keys; use it after an
-OS reload and supervisor reinstall.
+OS reload once automatic Runtime reconciliation is ready.
 
 `sandbox access install-ssh` is local-only and requires CLI 0.8.10 or newer.
 It turns the reviewed profile and sandbox-private identity into a concrete

package/skills/warpmetal/references/runtime.md

@@ -208,11 +208,12 @@ The token-free profile is written only after the grant is `applied` and the
 API supplies verified VPS host keys. Do not print or open that profile in an
 agent conversation.
 
-After a destructive OS reload, reinstall the supervisor and wait for the
-retained active grant to become `applied`, then replace its stale pinned
-profile:
+After a successful destructive OS reload, the signed Runtime bootstrap runs
+automatically. Wait for Runtime readiness and for the retained active grant to
+become `applied`, then replace its stale pinned profile:
 
 ```sh
+warpmetal runtime get --server <serverId> --wait --json
 warpmetal sandbox access refresh \
   --server <serverId> \
   --sandbox <sandboxId> \
@@ -225,7 +226,8 @@ warpmetal sandbox access refresh \
 
 The sandbox record is retained, but its old workspace is not; reconciliation
 creates a new empty workspace. Never bypass a host-key mismatch or reuse the
-pre-reload profile.
+pre-reload profile. Use manual Runtime installation only as an explicitly
+approved repair when the backend reports that automatic setup failed.
 
 ### Install a concrete OpenSSH alias
 

package/skills/warpmetal/references/safety.md

@@ -95,9 +95,10 @@ A reload requires both `confirm: "ERASE"` and `powerOffFirst: true`. Treat
 server, wait until it is powered off, and then erase and reinstall it inside
 one lifecycle operation. When Agent Runtime is enabled, also require
 `acknowledgeAgentRuntimeReset`: all sandbox workspaces are permanently erased,
-the supervisor identity is revoked, desired sandboxes are recreated empty
-after reinstall, and all pinned profiles require refresh. Use only the guarded
-CLI command and stop on `manual_review`. Reload invalidates the prior
+the supervisor identity is revoked, signed Runtime setup runs automatically,
+desired sandboxes are recreated empty, and all pinned profiles require refresh.
+Use only the guarded CLI command, wait for Runtime readiness, and stop on
+`manual_review`. Reload invalidates the prior
 owner-facing SSH host-key trust decision; the provider may rotate or preserve
 the key. CLI 0.8.8 opens one new managed trust epoch only after the exact local
 reload operation succeeds and reports that refresh is required. The first

package/src/cli.js

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
 import { basename, join, resolve } from "node:path";
 
 import {
@@ -147,6 +148,14 @@ SSH host trust (CLI 0.8.8+):
   active attacker on the first connection. Provider-console pre-enrollment is
   the optional higher-assurance alternative.
 
+Runtime-enabled reloads:
+  Reload still requires --acknowledge-agent-runtime-reset because every
+  sandbox workspace is erased. After a successful reload, Runtime setup is
+  automatic: use warpmetal runtime get --server <serverId> --wait --json,
+  then refresh every sandbox connection profile before reconnecting. The
+  successful operation also records a new owner SSH trust epoch; verify the
+  replacement host key before owner SSH.
+
 Sandbox SSH aliases:
   Refresh the authenticated connection profile before refreshing an existing
   alias:
@@ -1995,7 +2004,7 @@ async function applyReloadResult(
   await store.invalidateServerAccess(serverId);
   if (operation.result?.reloadImpact?.agentRuntimeAffected) {
     await store.saveRuntime(serverId, {
-      state: "needs_reinstall",
+      state: "pending_install",
       desiredRevision: undefined,
       appliedRevision: 0,
       lastSeenAt: null,
@@ -2103,8 +2112,8 @@ async function handleServerReload(client, store, options, context) {
       (operation?.state === "succeeded" &&
       operation.result?.reloadImpact?.ownerKnownHostsNeedRefresh
         ? operation.result?.reloadImpact?.agentRuntimeAffected
-          ? " The next Runtime install will establish the operation-bound owner SSH trust epoch, then reinstall Agent Runtime and refresh every sandbox connection profile."
-          : " The next Runtime install will establish the operation-bound owner SSH trust epoch before reconnecting."
+          ? " Agent Runtime setup is automatic. Wait for Agent Runtime to become ready, then refresh every sandbox connection profile. Verify the replacement host key before owner SSH."
+          : " Verify the replacement host key before owner SSH; the successful reload recorded a new operation-bound trust epoch."
         : operation?.state === "succeeded"
           ? " WarpMetal did not report a host-key refresh; the existing managed pin remains required."
           : ""),
@@ -2753,7 +2762,7 @@ async function handleAccessInstallSsh(options, context) {
     alias: stringOption(options, "alias", { required: true }),
     connectionFile: stringOption(options, "connection-file", { required: true }),
     identity: stringOption(options, "identity", { required: true }),
-    homeDirectory: context.env.HOME,
+    homeDirectory: context.env.HOME || context.env.USERPROFILE || homedir(),
     confirm: stringOption(options, "confirm"),
   });
   emit(
@@ -2768,7 +2777,7 @@ async function handleAccessInstallSsh(options, context) {
 async function handleAccessRemoveSsh(options, context) {
   const result = await removeSshAlias({
     alias: stringOption(options, "alias", { required: true }),
-    homeDirectory: context.env.HOME,
+    homeDirectory: context.env.HOME || context.env.USERPROFILE || homedir(),
     confirm: stringOption(options, "confirm", { required: true }),
   });
   emit(

package/src/ssh-alias.js

@@ -10,7 +10,7 @@ import {
   rmdir,
   unlink,
 } from "node:fs/promises";
-import { isAbsolute, join, parse, resolve } from "node:path";
+import { isAbsolute, join, parse, posix, resolve, win32 } from "node:path";
 import { randomUUID } from "node:crypto";
 
 import {
@@ -21,7 +21,8 @@ import {
 import { CliError } from "./errors.js";
 
 const ALIAS_PATTERN = /^(?=.{1,63}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-const UNSAFE_PATH = /[\0\r\n\t%"'`$!&;<>|*?()[\]{}\\#]/;
+const POSIX_UNSAFE_PATH = /[\0\r\n\t%"'`$!&;<>|*?()[\]{}\\#]/;
+const WINDOWS_UNSAFE_PATH = /[\0\r\n\t%"'`$!&;<>|*?()[\]{}#]/;
 const MANAGED_HEADER = "# Managed by WarpMetal. Do not edit.";
 
 function invalid(message) {
@@ -37,17 +38,18 @@ export function validateSshAlias(value) {
   return value;
 }
 
-function validateAbsolutePath(value, label) {
-  if (
-    typeof value !== "string" ||
-    !isAbsolute(value) ||
-    resolve(value) !== value ||
-    value === parse(value).root ||
-    UNSAFE_PATH.test(value)
-  ) {
+export function validateAbsolutePath(value, label, platform = process.platform) {
+  const path = platform === "win32" ? win32 : posix;
+  if (typeof value !== "string" || !path.isAbsolute(value)) {
     invalid(`${label} must be an absolute path without unsafe interpolation characters.`);
   }
-  return value;
+  const resolved = path.resolve(value);
+  const unsafePath =
+    platform === "win32" ? WINDOWS_UNSAFE_PATH : POSIX_UNSAFE_PATH;
+  if (resolved === path.parse(resolved).root || unsafePath.test(resolved)) {
+    invalid(`${label} must be an absolute path without unsafe interpolation characters.`);
+  }
+  return resolved;
 }
 
 function requireOwner(metadata, label) {
@@ -420,12 +422,19 @@ async function syncDirectory(path) {
     handle = await open(path, "r");
     await handle.sync();
   } catch (error) {
-    if (!["EINVAL", "ENOTSUP", "EISDIR"].includes(error?.code)) throw error;
+    if (!isIgnorableDirectorySyncError(error)) throw error;
   } finally {
     await handle?.close().catch(() => {});
   }
 }
 
+export function isIgnorableDirectorySyncError(error, platform = process.platform) {
+  return (
+    ["EINVAL", "ENOTSUP", "EISDIR"].includes(error?.code) ||
+    (platform === "win32" && ["EPERM", "EACCES"].includes(error?.code))
+  );
+}
+
 async function commitStaged(staged) {
   try {
     for (const item of staged) {