warpmetal 0.8.6 → 0.8.8

package/README.md

@@ -103,6 +103,19 @@ key does not encode a login username: use `root@<server-ip>` for an owner shell
 and `--ssh-user root` for runtime installation, not a distribution convention
 such as `ubuntu`.
 
+Starting in CLI 0.8.8, `runtime install --confirm INSTALL` establishes managed
+SSH host trust without requiring access to the VPS provider. For a server trust
+epoch with no pin, the CLI runs only a harmless `ssh true` using the exact owner
+key, trusts the first observed Ed25519 host key, stores it under the private
+WarpMetal state directory, and immediately reconnects with strict checking. It
+requests the Runtime bootstrap only after that strict replay succeeds. Every
+later SSH and SCP operation must match the same pin; a changed key is never
+silently accepted or overwritten.
+
+The private WarpMetal state directory is the local trust domain. Back it up
+with the owner key: deleting it also deletes the durable pin, so the next
+install is a new first-use decision rather than a verified continuation.
+
 Pass `--json` for structured, secret-redacted output. Use
 `WARPMETAL_API_URL` for an alternate API origin and `WARPMETAL_HOME` for an
 alternate state directory.
@@ -300,8 +313,9 @@ compatible external signer.
   Wallet key management and signing remain outside this package.
 - Destructive or state-changing commands require explicit confirmations and
   generate idempotency keys by default.
-- Runtime bootstrap credentials remain memory-only. Signed supervisor bundles
-  are checksum- and signature-verified before OpenSSH uploads them.
+- Runtime bootstrap credentials remain memory-only and are requested only after
+  the first host key has been pinned and strictly reverified. Signed supervisor
+  bundles are checksum- and signature-verified before OpenSSH uploads them.
 - Each agent gets a distinct SSH key forced into exactly one sandbox. Token-free
   connection profiles pin the VPS host key and contain no owner credential or
   private-key material.
@@ -315,10 +329,10 @@ compatible external signer.
   the observed digest and generation both match the accepted target.
 - Guarded reload powers the server off first. Runtime-enabled reload requires a
   second acknowledgment, after which the CLI guides supervisor reinstall and
-  pinned connection-profile refresh. Post-reload owner SSH host keys must be
-  independently verified because the provider may rotate or preserve them;
-  update `known_hosts` only when the verified key changed. Erased workspaces
-  are never described as recoverable.
+  pinned connection-profile refresh. Only a locally recorded reload operation
+  that succeeds and reports an owner-host-key refresh opens one new managed
+  trust epoch; failed or ambiguous reloads retain the old pin and never permit
+  replacement. Erased workspaces are never described as recoverable.
 
 ## Agent Runtime example
 
@@ -349,6 +363,43 @@ warpmetal sandbox access keygen \
   --json
 ```
 
+On the first install in a server trust epoch, JSON output includes
+`hostKeyTrust.state: "trusted_first_use"` and the safe Ed25519 fingerprint.
+Later installs report `"matched"`. First-use trust protects continuity after
+that observation, but it cannot detect an active attacker on the first
+connection. Provider-console host-key pre-enrollment remains an optional
+higher-assurance alternative when it is available.
+
+WarpMetal CLI v0.8.7 with Agent Runtime v0.1.25 or newer can enable the narrowly
+scoped AppArmor exception required by a verified workload that creates an inner
+Bubblewrap PID namespace and private `/proc`:
+
+```sh
+warpmetal runtime install \
+  --server <serverId> \
+  --ssh-user root \
+  --confirm INSTALL \
+  --nested-private-procfs enable \
+  --wait \
+  --json
+```
+
+This is an explicit host-scoped opt-in for nested-Bubblewrap hosts, not a
+requirement for ordinary VPS or Runtime workloads that use only the outer
+sandbox. The default `preserve` action leaves the current policy state
+unchanged. Use `disable` during an approved maintenance window to unload
+WarpMetal's policy and restore the pre-install file and loaded-policy state.
+Because Runtime sandboxes share one Unix owner, treat an enabled policy as
+available to every sandbox on that Runtime host whose process matches the
+signed, root-owned bwrap path; it is not a per-sandbox permission.
+
+Common inner-boundary designs are planning with an exact read-only checkout,
+coding with only one approved checkout and output directory writable, and QA
+with an exact candidate plus isolated test processes and scratch space. The
+boundary protects a persistent trusted runner from repository-controlled
+commands and sibling attempts. GitHub access, installing Codex or another AI
+CLI, and delegating to subagents do not by themselves require this capability.
+
 Installation gives pre-existing Docker containers exact liveness checks and
 tracks common container-runtime processes without collecting application
 configuration. The signed installer uses `crun` for its private rootless Podman

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.8.6",
+  "version": "0.8.8",
   "description": "Agent-safe CLI and skill for purchasing, renewing, and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
     "node": ">=20.0.0"
   },
   "scripts": {
-    "check": "node --check bin/warpmetal.js && node --check src/api.js && node --check src/args.js && node --check src/cli.js && node --check src/connection.js && node --check src/errors.js && node --check src/install-skill.js && node --check src/installer.js && node --check src/payment.js && node --check src/runtime.js && node --check src/ssh.js && node --check src/state.js && node --check src/version.js",
+    "check": "node --check bin/warpmetal.js && node --check src/api.js && node --check src/args.js && node --check src/cli.js && node --check src/connection.js && node --check src/errors.js && node --check src/host-trust.js && node --check src/install-skill.js && node --check src/installer.js && node --check src/payment.js && node --check src/runtime.js && node --check src/ssh.js && node --check src/state.js && node --check src/version.js",
     "plugin:check": "node --test test/plugin.test.js",
     "test": "node --test",
     "prepack": "npm run check && npm test"

package/skills/warpmetal/SKILL.md

@@ -266,11 +266,13 @@ warpmetal server reload \
 ```
 
 The CLI requires the recovery owner credential so it can keep polling after
-reload revokes SSH-derived access tokens. On success, reinstall Agent Runtime
-only after verifying the post-reload owner-facing SSH host-key fingerprint
-through a trusted provider or console channel. The provider may rotate or
-preserve the key; update `known_hosts` only when the verified key changed and
-never bypass a mismatch. Then wait for grants to become applied and refresh
+reload revokes SSH-derived access tokens. CLI 0.8.8 records a new SSH trust
+epoch only when that exact local reload operation succeeds and reports that the
+owner host key needs refresh. The next Runtime install may trust the first
+observed Ed25519 host key once in that epoch, then must reconnect strictly
+before requesting bootstrap. Failed or ambiguous reloads retain the prior pin;
+never bypass a mismatch or delete a pin to force a retry. A provider-console
+pre-seed is the optional higher-assurance path. Then wait for grants to become applied and refresh
 every connection profile with `sandbox access refresh --confirm REFRESH`
 before connecting. Do not fall back to raw API calls for deletion, networking,
 or another unsupported mutation.
@@ -283,6 +285,24 @@ sizes. Use `--runtime-file` to include sandbox intent in an unpaid order, or
 `warpmetal runtime enable` after the VPS is ready. Supervisor installation is
 separate and requires approval plus `--confirm INSTALL`.
 
+With CLI 0.8.8, that confirmation also authorizes managed trust on first use
+when the exact server trust epoch has no pin. The CLI performs only an owner-
+key-authenticated `ssh true`, pins the first observed Ed25519 key, immediately
+reconnects strictly, and requests bootstrap only afterward. Later connections
+must match. Explain that TOFU cannot detect an active attacker on the first
+connection; never use `ssh-keyscan`, accept a mismatch, or expose a generic pin
+reset.
+
+For any verified workload that creates an inner Bubblewrap PID namespace and
+private `/proc`, CLI 0.8.7 with Runtime 0.1.25 or newer may add
+`--nested-private-procfs enable` to the approved Runtime install. Planning with
+a read-only checkout, coding in one writable checkout, and independent QA are
+common uses. GitHub access, an AI CLI, or subagent delegation alone does not
+require it. Omission means `preserve`, which leaves policy state unchanged;
+`disable` is an explicit maintenance action. The exception is host-scoped
+rather than sandbox-scoped, so separate workloads onto different VPS hosts when
+they must not share it.
+
 Omitted lifetime means persistent. A temporary sandbox requires
 `--confirm TEMPORARY`, expires 15 minutes to 24 hours after first reaching
 running, and permanently deletes its workspace at expiry. Never describe a

package/skills/warpmetal/references/cli-reference.md

@@ -212,7 +212,9 @@ warpmetal runtime enable --server <serverId> [--idempotency-key <key>] --json
 warpmetal runtime get --server <serverId> [--wait] [--timeout-seconds <n>] --json
 warpmetal runtime install \
   --server <serverId> [--identity <owner-key>] --ssh-user root \
-  --confirm INSTALL [--wait] [--timeout-seconds <n>] --json
+  --confirm INSTALL \
+  [--nested-private-procfs <preserve|enable|disable>] \
+  [--wait] [--timeout-seconds <n>] --json
 
 warpmetal sandbox create \
   --server <serverId> --name <name> --size <small|medium|large|xlarge> \
@@ -230,6 +232,25 @@ warpmetal sandbox delete \
   --server <serverId> --sandbox <sandboxId> --confirm DELETE [--wait] --json
 ```
 
+CLI 0.8.8 manages owner-facing VPS host trust during `runtime install`. With no
+pin for the exact server trust epoch, the confirmed install performs one
+harmless owner-key-authenticated SSH connection, trusts the first observed
+Ed25519 host key, atomically pins it, and immediately reconnects strictly before
+requesting bootstrap. JSON reports `hostKeyTrust.state` as
+`trusted_first_use` or `matched` plus the safe fingerprint. Every later SSH and
+SCP operation is strict; changed keys, malformed pins, and failed or ambiguous
+reloads never replace trust. This TOFU step cannot detect an active attacker on
+the first connection. Provider-console pre-enrollment is optional and stronger.
+
+The nested-private-procfs action requires CLI 0.8.7 and Runtime 0.1.25 or
+newer. It defaults to `preserve`. `enable` is a host-level opt-in for any
+verified workload that creates an inner Bubblewrap PID namespace and private
+`/proc`; read-only planning, single-workspace coding, and independent QA are
+common examples. GitHub use, an AI CLI, or subagent delegation alone does not
+require it. `disable` unloads WarpMetal's policy and restores the recorded
+pre-enable state. It is not a per-sandbox capability because Runtime sandboxes
+share one Unix owner.
+
 See [runtime.md](runtime.md) for capacity, lifetime, cleanup, polling, and
 installation safety. Exit 8 means accepted or pending, never applied.
 

package/skills/warpmetal/references/runtime.md

@@ -58,15 +58,51 @@ warpmetal runtime install \
   --identity <owner-private-key-path> \
   --ssh-user root \
   --confirm INSTALL \
+  [--nested-private-procfs <preserve|enable|disable>] \
   --wait \
   --json
 warpmetal runtime get --server <serverId> --wait --json
 ```
 
 Ask before installation. Pass the owner key path without reading the file.
-The CLI holds the one-time bootstrap only in memory, verifies the signed
-artifact, uploads it through OpenSSH without a shell-enabled local spawn, and
-does not print or store the bootstrap.
+CLI 0.8.8 first validates that the public half matches the server's ordering-key
+fingerprint. When that server trust epoch has no pin, it runs only an owner-key-
+authenticated `ssh true`, trusts the first observed Ed25519 host key, publishes
+it atomically under the private WarpMetal state directory, and immediately
+reconnects strictly. Only then does the CLI request the one-time bootstrap. It
+holds that bootstrap only in memory, verifies the signed artifact, uploads it
+through OpenSSH without a shell-enabled local spawn, and does not print or store
+the bootstrap. Every later SSH/SCP operation uses the same strict pin; a
+mismatch never overwrites it.
+
+First-use trust provides continuity after the first observation but cannot
+detect an active attacker on that connection. Provider-console pre-enrollment
+is an optional higher-assurance alternative, not a requirement. Only a locally
+recorded successful reload that reports an owner-host-key refresh creates one
+new operation-bound trust epoch; failed or ambiguous reloads do not.
+
+`--nested-private-procfs` is supported by `warpmetal` CLI 0.8.7 with Agent
+Runtime 0.1.25 or newer. Its default is `preserve`, which makes no AppArmor
+policy change. Select `enable` only when this VPS is intentionally dedicated to
+a verified workload that creates an inner Bubblewrap PID namespace and private
+procfs. Ordinary VPS users and Runtime workloads that rely only on the outer
+sandbox do not need it. Select `disable` only during an approved maintenance
+action to unload WarpMetal's policy and restore the exact file and loaded-policy
+state that existed before enablement.
+
+Examples include a planner with an exact read-only checkout, a coder with only
+one approved checkout and output directory writable, and QA with an exact
+candidate plus isolated test processes and scratch space. This protects a
+persistent trusted runner from repository-controlled commands and sibling
+attempts. GitHub access, installing an AI CLI, and subagent delegation alone do
+not require nested private procfs.
+
+This setting is host-scoped, not sandbox-scoped. Runtime sandboxes share one
+Unix owner, so every sandbox on the host can use the exception only through the
+signed, root-owned, fixed bwrap path matched by the policy. Enabling it does not
+authorize arbitrary bwrap binaries or change the trust boundary for the
+Runtime image selected by WarpMetal's authenticated backend. Isolate workloads
+on separate VPS hosts if they must not share this host capability.
 
 The signed installer is designed to preserve container workloads already
 running on a supported host. It selects `crun` for WarpMetal's private rootless
@@ -92,6 +128,16 @@ host automatically:
   unexpectedly; stop and review the host package logs;
 - `runtime_legacy_migration_required`: preview Podman state needs a separate,
   explicitly reviewed migration and was not reset.
+- `runtime_nested_private_procfs_architecture_unsupported`: the requested
+  coding-host policy is unsupported by this CPU architecture;
+- `runtime_apparmor_state_unverifiable`: the host's current AppArmor state
+  cannot be established safely;
+- `runtime_apparmor_policy_conflict`: an existing file or loaded-policy state
+  conflicts with WarpMetal's recorded transaction;
+- `runtime_apparmor_policy_rollback_failed`: the installer could not restore
+  the exact prior AppArmor state; stop and perform operator recovery.
+- `runtime_apparmor_policy_recovery_failed`: an interrupted prior policy
+  transaction could not be recovered; stop and perform operator recovery.
 
 There is no force bypass. If `runtime_reboot_required` is returned, schedule
 the reboot as a separate maintenance action and retry only after the host and

package/skills/warpmetal/references/safety.md

@@ -99,9 +99,18 @@ the supervisor identity is revoked, desired sandboxes are recreated empty
 after reinstall, and all pinned profiles require refresh. Use only the guarded
 CLI command and stop on `manual_review`. Reload invalidates the prior
 owner-facing SSH host-key trust decision; the provider may rotate or preserve
-the key. Verify the post-reload fingerprint through a trusted provider or
-console channel, change `known_hosts` only when the verified key changed, and
-never disable host-key checking.
+the key. CLI 0.8.8 opens one new managed trust epoch only after the exact local
+reload operation succeeds and reports that refresh is required. The first
+owner-key-authenticated connection may pin the observed Ed25519 key once, then
+all connections are strict. Failed or ambiguous reloads never advance trust.
+Never use `ssh-keyscan`, disable host-key checking, accept a mismatch, or delete
+a pin as a generic reset. Provider-console pre-enrollment remains the optional
+higher-assurance alternative; TOFU cannot detect an active attacker on the
+first connection.
+
+The private WarpMetal state directory is the local trust domain. Deleting it
+removes the durable pin and makes the next install a new first-use decision;
+never present that as continuity with the prior server identity.
 
 An order preparation is unpaid but consumes a limited prepared-order slot.
 Confirm the plan, hostname, OS, and public key before preparing it.

package/src/cli.js

@@ -12,6 +12,7 @@ import {
 import { WarpMetalClient } from "./api.js";
 import { connectionProfile, writeConnectionProfile } from "./connection.js";
 import { CliError, toErrorMessage } from "./errors.js";
+import { establishHostTrust } from "./host-trust.js";
 import { installSkill } from "./install-skill.js";
 import { installRuntime } from "./installer.js";
 import {
@@ -110,7 +111,7 @@ Usage:
   warpmetal operation get --operation <operationId> [--server <serverId>] [--wait]
   warpmetal runtime enable|get --server <serverId> [--wait]
   warpmetal runtime install --server <serverId> [--identity <owner-key>] --ssh-user <user>
-    --confirm INSTALL [--wait]
+    --confirm INSTALL [--nested-private-procfs <preserve|enable|disable>] [--wait]
   warpmetal sandbox create --server <serverId> --name <name> --size <size>
     [--lifetime temporary] [--expires-in-seconds <n>] [--confirm TEMPORARY] [--wait]
   warpmetal sandbox create --server <serverId> --file <batch.json> [--confirm TEMPORARY]
@@ -132,6 +133,26 @@ Global options:
   --help                 Show help
   --version              Show the CLI version
 
+Nested private procfs (CLI 0.8.7+, Runtime 0.1.25+):
+  preserve               Default; do not inspect or change AppArmor policy state
+  enable                 Enable the exact-path Bubblewrap policy on an amd64 host
+  disable                Remove it and restore the recorded pre-enable policy state
+
+Use enable once per dedicated Runtime host when a verified workload creates an
+inner Bubblewrap PID namespace and private /proc. Planning, coding, and QA are
+common examples. GitHub access, an AI CLI, and subagent delegation alone do not
+require it. The capability is host-scoped, not per-sandbox.
+
+SSH host trust (CLI 0.8.8+):
+  runtime install authenticates with the exact owner key and trusts the first
+  observed Ed25519 host key once for that server trust epoch. It pins the key
+  before requesting a Runtime bootstrap, immediately reconnects strictly, and
+  requires that same pin thereafter. A changed key is never accepted or
+  overwritten. A successful recorded server reload may create one new trust
+  epoch; failed or ambiguous reloads do not. First-use trust cannot detect an
+  active attacker on the first connection. Provider-console pre-enrollment is
+  the optional higher-assurance alternative.
+
 Credential environment variables:
   WARPMETAL_OWNER_TOKEN  Recovery/bootstrap credential for one explicit command
   WARPMETAL_ACCESS_TOKEN Short-lived SSH-derived credential for one explicit command
@@ -1929,6 +1950,7 @@ async function applyReloadResult(
   operation,
   pendingIdentityId,
 ) {
+  await store.applyReloadHostTrust(serverId, operation);
   if (operation?.state !== "succeeded") return;
   if (pendingIdentityId) {
     await store.bindIdentity(pendingIdentityId, undefined, serverId);
@@ -2042,10 +2064,12 @@ async function handleServerReload(client, store, options, context) {
     context.json,
     `Reload operation ${operationId}: ${operation?.state}.` +
       (operation?.state === "succeeded" &&
-      operation.result?.reloadImpact?.agentRuntimeAffected
-        ? " Verify and refresh the owner SSH host key, reinstall Agent Runtime, then refresh every sandbox connection profile."
+      operation.result?.reloadImpact?.ownerKnownHostsNeedRefresh
+        ? operation.result?.reloadImpact?.agentRuntimeAffected
+          ? " The next Runtime install will establish the operation-bound owner SSH trust epoch, then reinstall Agent Runtime and refresh every sandbox connection profile."
+          : " The next Runtime install will establish the operation-bound owner SSH trust epoch before reconnecting."
         : operation?.state === "succeeded"
-          ? " Verify and refresh the owner SSH host key before reconnecting."
+          ? " WarpMetal did not report a host-key refresh; the existing managed pin remains required."
           : ""),
   );
   if (operation?.state === "manual_review") return 6;
@@ -2140,6 +2164,14 @@ async function handleRuntimeInstall(client, store, options, context) {
     stringOption(options, "identity"),
   );
   const sshUser = stringOption(options, "ssh-user", { required: true });
+  const nestedPrivateProcfs =
+    stringOption(options, "nested-private-procfs") || "preserve";
+  if (!["preserve", "enable", "disable"].includes(nestedPrivateProcfs)) {
+    throw new CliError(
+      "--nested-private-procfs must be preserve, enable, or disable.",
+      { exitCode: 2 },
+    );
+  }
   if (stringOption(options, "confirm", { required: true }) !== "INSTALL") {
     throw new CliError(
       "Confirm supervisor installation with --confirm INSTALL.",
@@ -2152,6 +2184,20 @@ async function handleRuntimeInstall(client, store, options, context) {
     serverId,
     identity,
   );
+  const server = (await client.getServer(serverId, issued.accessToken)).data
+    ?.task;
+  const trustEpoch = await store.hostTrustEpoch(serverId);
+  const hostKeyTrust = await establishHostTrust({
+    stateDirectory: store.directory,
+    serverId,
+    trustEpoch,
+    server,
+    identityPath: identity,
+    sshUser,
+    reinspectServer: async () =>
+      (await client.getServer(serverId, issued.accessToken)).data?.task,
+    spawnImpl: context.spawnImpl,
+  });
   const key =
     stringOption(options, "idempotency-key") ||
     idempotencyKey("runtime-bootstrap");
@@ -2166,10 +2212,19 @@ async function handleRuntimeInstall(client, store, options, context) {
     token: issued.accessToken,
     identity,
     sshUser,
+    knownHostsFile: hostKeyTrust.knownHostsFile,
+    trustedPublicIp: hostKeyTrust.publicIp,
     bootstrap: bootstrap.data,
+    nestedPrivateProcfs,
     fetchImpl: context.fetchImpl,
     spawnImpl: context.spawnImpl,
   });
+  safe.hostKeyTrust = {
+    state: hostKeyTrust.state,
+    algorithm: hostKeyTrust.algorithm,
+    fingerprint: hostKeyTrust.fingerprint,
+    trustEpoch: hostKeyTrust.trustEpoch,
+  };
   let runtimeResult;
   if (booleanOption(options, "wait")) {
     runtimeResult = await pollRuntime(
@@ -2185,7 +2240,7 @@ async function handleRuntimeInstall(client, store, options, context) {
     context.stdout,
     safe,
     context.json,
-    `Installed Agent Runtime ${safe.supervisorVersion} on ${serverId}${safe.runtime ? `: ${safe.runtime.state}` : "."}`,
+    `Installed Agent Runtime ${safe.supervisorVersion} on ${serverId}${safe.runtime ? `: ${safe.runtime.state}` : "."} SSH host key ${safe.hostKeyTrust.state === "trusted_first_use" ? "trusted on first use" : "matched"} (${safe.hostKeyTrust.fingerprint}).`,
   );
   return safe.runtime?.state === "degraded" ? 5 : 0;
 }
@@ -2975,6 +3030,7 @@ async function dispatch(positionals, options, passthrough, context) {
         "identity",
         "ssh-user",
         "confirm",
+        "nested-private-procfs",
         "idempotency-key",
         "wait",
         "timeout-seconds",

package/src/host-trust.js

@@ -0,0 +1,524 @@
+import { createHash, randomUUID } from "node:crypto";
+import { spawn as nodeSpawn } from "node:child_process";
+import {
+  chmod,
+  link,
+  lstat,
+  mkdir,
+  open,
+  readFile,
+  rm,
+  unlink,
+} from "node:fs/promises";
+import { isIP } from "node:net";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+
+import { CliError } from "./errors.js";
+import { readSshPublicKey, sshFingerprint } from "./ssh.js";
+
+const SERVER_ID = /^srv_[A-Za-z0-9_-]{8,60}$/;
+const TRUST_EPOCH = /^(?:initial|reload-[A-Za-z0-9_-]{8,128})$/;
+
+function currentUid() {
+  return typeof process.getuid === "function" ? process.getuid() : undefined;
+}
+
+function exactMode(metadata) {
+  return metadata.mode & 0o777;
+}
+
+async function requirePrivateDirectory(path) {
+  const metadata = await lstat(path);
+  const uid = currentUid();
+  if (
+    !metadata.isDirectory() ||
+    metadata.isSymbolicLink() ||
+    (process.platform !== "win32" && exactMode(metadata) !== 0o700) ||
+    (uid !== undefined && metadata.uid !== uid)
+  ) {
+    throw new CliError("The managed SSH trust directory is not private.", {
+      exitCode: 4,
+      code: "host_trust_directory_unsafe",
+    });
+  }
+}
+
+async function ensurePrivateDirectory(path) {
+  let created = false;
+  try {
+    await mkdir(path, { mode: 0o700 });
+    created = true;
+  } catch (error) {
+    if (error?.code !== "EEXIST") throw error;
+  }
+  if (created && process.platform !== "win32") await chmod(path, 0o700);
+  await requirePrivateDirectory(path);
+  if (created) await syncPath(dirname(path));
+}
+
+async function syncPath(path) {
+  const handle = await open(path, "r");
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
+async function requirePrivateFile(path, label) {
+  const metadata = await lstat(path);
+  const uid = currentUid();
+  if (
+    !metadata.isFile() ||
+    metadata.isSymbolicLink() ||
+    metadata.nlink !== 1 ||
+    (process.platform !== "win32" && exactMode(metadata) !== 0o600) ||
+    (uid !== undefined && metadata.uid !== uid)
+  ) {
+    throw new CliError(`${label} is not an owner-only regular file.`, {
+      exitCode: 4,
+      code: "host_trust_file_unsafe",
+    });
+  }
+}
+
+async function requireIdentity(identityPath, expectedFingerprint) {
+  const identity = resolve(identityPath);
+  await requirePrivateFile(identity, "The SSH identity");
+  const publicPath = `${identity}.pub`;
+  const publicMetadata = await lstat(publicPath);
+  const uid = currentUid();
+  if (
+    !publicMetadata.isFile() ||
+    publicMetadata.isSymbolicLink() ||
+    publicMetadata.nlink !== 1 ||
+    (uid !== undefined && publicMetadata.uid !== uid)
+  ) {
+    throw new CliError("The SSH public identity is not a safe regular file.", {
+      exitCode: 4,
+      code: "host_trust_identity_unsafe",
+    });
+  }
+  const fingerprint = sshFingerprint(await readSshPublicKey(publicPath));
+  if (fingerprint !== expectedFingerprint) {
+    throw new CliError(
+      "The local SSH identity does not match the server owner key.",
+      { exitCode: 4, code: "host_trust_identity_mismatch" },
+    );
+  }
+  return { identity, fingerprint };
+}
+
+export function hostTrustPaths(stateDirectory, serverId, trustEpoch = "initial") {
+  if (!SERVER_ID.test(serverId)) {
+    throw new CliError("The server ID is invalid.", { exitCode: 2 });
+  }
+  if (!TRUST_EPOCH.test(trustEpoch)) {
+    throw new CliError("The SSH host-trust epoch is invalid.", {
+      exitCode: 4,
+      code: "host_trust_epoch_invalid",
+    });
+  }
+  const stateRoot = resolve(stateDirectory);
+  const sshDirectory = join(stateRoot, "ssh");
+  const knownHostsDirectory = join(sshDirectory, "known-hosts");
+  const serverDirectory = join(knownHostsDirectory, serverId);
+  return {
+    stateRoot,
+    sshDirectory,
+    knownHostsDirectory,
+    serverDirectory,
+    knownHostsFile: join(serverDirectory, `${trustEpoch}.known_hosts`),
+  };
+}
+
+async function ensureTrustDirectories(paths) {
+  await requirePrivateDirectory(paths.stateRoot);
+  await ensurePrivateDirectory(paths.sshDirectory);
+  await ensurePrivateDirectory(paths.knownHostsDirectory);
+  await ensurePrivateDirectory(paths.serverDirectory);
+}
+
+function decodeEd25519(material) {
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(material)) return undefined;
+  const decoded = Buffer.from(material, "base64");
+  if (decoded.toString("base64") !== material) return undefined;
+  if (decoded.length !== 51 || decoded.readUInt32BE(0) !== 11) return undefined;
+  if (decoded.subarray(4, 15).toString("utf8") !== "ssh-ed25519") {
+    return undefined;
+  }
+  if (decoded.readUInt32BE(15) !== 32) return undefined;
+  return decoded;
+}
+
+export function validateKnownHosts(content, publicIp, sshPort = 22) {
+  if (isIP(publicIp) !== 4) {
+    throw new CliError("The server returned an invalid public IP.", {
+      exitCode: 3,
+      code: "host_trust_ip_invalid",
+    });
+  }
+  if (!Number.isInteger(sshPort) || sshPort < 1 || sshPort > 65_535) {
+    throw new CliError("The SSH port is invalid.", { exitCode: 2 });
+  }
+  const expectedHost =
+    sshPort === 22 ? publicIp : `[${publicIp}]:${sshPort}`;
+  const lines = String(content).split(/\r?\n/).filter(Boolean);
+  const match = /^([^ ]+) (ssh-ed25519) ([A-Za-z0-9+/]+={0,2})$/.exec(
+    lines[0] || "",
+  );
+  const decoded = match && decodeEd25519(match[3]);
+  if (lines.length !== 1 || !match || match[1] !== expectedHost || !decoded) {
+    throw new CliError("The observed SSH host key is not a canonical Ed25519 pin.", {
+      exitCode: 4,
+      code: "host_trust_pin_invalid",
+    });
+  }
+  return {
+    content: `${match[1]} ${match[2]} ${match[3]}\n`,
+    algorithm: match[2],
+    fingerprint: `SHA256:${createHash("sha256")
+      .update(decoded)
+      .digest("base64")
+      .replace(/=+$/, "")}`,
+  };
+}
+
+export function strictSshOptions(identityPath, knownHostsFile) {
+  if (!isAbsolute(knownHostsFile)) {
+    throw new CliError("The managed SSH host pin path is invalid.", {
+      exitCode: 4,
+      code: "host_trust_path_invalid",
+    });
+  }
+  return [
+    "-F",
+    "/dev/null",
+    "-i",
+    resolve(identityPath),
+    "-o",
+    "IdentitiesOnly=yes",
+    "-o",
+    "IdentityAgent=none",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "ConnectTimeout=10",
+    "-o",
+    "ConnectionAttempts=1",
+    "-o",
+    "ServerAliveInterval=5",
+    "-o",
+    "ServerAliveCountMax=1",
+    "-o",
+    "PubkeyAuthentication=yes",
+    "-o",
+    "PreferredAuthentications=publickey",
+    "-o",
+    "PasswordAuthentication=no",
+    "-o",
+    "KbdInteractiveAuthentication=no",
+    "-o",
+    "ChallengeResponseAuthentication=no",
+    "-o",
+    "GSSAPIAuthentication=no",
+    "-o",
+    "StrictHostKeyChecking=yes",
+    "-o",
+    `UserKnownHostsFile=${knownHostsFile}`,
+    "-o",
+    "GlobalKnownHostsFile=/dev/null",
+    "-o",
+    "HashKnownHosts=no",
+    "-o",
+    "UpdateHostKeys=no",
+    "-o",
+    "VerifyHostKeyDNS=no",
+    "-o",
+    "HostKeyAlgorithms=ssh-ed25519",
+    "-o",
+    "ForwardAgent=no",
+    "-o",
+    "ForwardX11=no",
+    "-o",
+    "ClearAllForwardings=yes",
+    "-o",
+    "PermitLocalCommand=no",
+    "-o",
+    "ProxyCommand=none",
+    "-o",
+    "RequestTTY=no",
+  ];
+}
+
+function firstUseSshOptions(identityPath, candidatePath) {
+  const args = strictSshOptions(identityPath, candidatePath);
+  const index = args.indexOf("StrictHostKeyChecking=yes");
+  args[index] = "StrictHostKeyChecking=accept-new";
+  return args;
+}
+
+async function spawnSsh(
+  args,
+  spawnImpl,
+  errorMessage,
+  diagnosticDirectory,
+  publicIp,
+  sshPort,
+) {
+  const diagnosticPath = join(
+    diagnosticDirectory,
+    `.ssh-auth.${process.pid}.${randomUUID()}.log`,
+  );
+  const diagnosticHandle = await open(diagnosticPath, "wx", 0o600);
+  await diagnosticHandle.close();
+  let result;
+  try {
+    try {
+      result = await new Promise((resolvePromise, reject) => {
+        const child = spawnImpl("ssh", ["-v", "-E", diagnosticPath, ...args], {
+          shell: false,
+          stdio: ["ignore", "ignore", "ignore"],
+        });
+        child.once("error", reject);
+        child.once("close", (status) => resolvePromise({ status }));
+      });
+    } catch (error) {
+      if (error?.code === "ENOENT") {
+        throw new CliError("OpenSSH is required to establish VPS host trust.", {
+          exitCode: 2,
+          code: "host_trust_ssh_unavailable",
+        });
+      }
+      throw error;
+    }
+    if (result.status !== 0) {
+      throw new CliError(errorMessage, {
+        exitCode: 4,
+        code: "host_trust_authentication_failed",
+      });
+    }
+    await requirePrivateFile(diagnosticPath, "The private OpenSSH diagnostic");
+    const diagnostic = await readFile(diagnosticPath, "utf8");
+    const authenticationResults = diagnostic
+      .split(/\r?\n/)
+      .filter((line) => /^Authenticated to .* using "[^"]+"\.$/.test(line));
+    const expectedResult = `Authenticated to ${publicIp} ([${publicIp}]:${sshPort}) using "publickey".`;
+    if (
+      authenticationResults.length !== 1 ||
+      authenticationResults[0] !== expectedResult
+    ) {
+      throw new CliError(
+        "SSH did not prove authentication with the exact owner public key. No runtime bootstrap was requested.",
+        { exitCode: 4, code: "host_trust_authentication_method_invalid" },
+      );
+    }
+  } finally {
+    await rm(diagnosticPath, { force: true });
+  }
+}
+
+async function strictProbe({
+  identity,
+  publicIp,
+  sshPort,
+  sshUser,
+  knownHostsFile,
+  spawnImpl,
+}) {
+  await spawnSsh(
+    [
+      ...strictSshOptions(identity, knownHostsFile),
+      ...(sshPort === 22 ? [] : ["-p", String(sshPort)]),
+      `${sshUser}@${publicIp}`,
+      "true",
+    ],
+    spawnImpl,
+    "The VPS host key or owner SSH authentication did not match the managed pin.",
+    dirname(knownHostsFile),
+    publicIp,
+    sshPort,
+  );
+}
+
+async function publishCandidate(
+  candidatePath,
+  knownHostsFile,
+  expectedContent,
+  publicIp,
+  sshPort,
+) {
+  await syncPath(candidatePath);
+  try {
+    await link(candidatePath, knownHostsFile);
+    await unlink(candidatePath);
+  } catch (error) {
+    if (error?.code !== "EEXIST") throw error;
+    const existing = validateKnownHosts(
+      await readFile(knownHostsFile, "utf8"),
+      publicIp,
+      sshPort,
+    );
+    if (existing.content !== expectedContent) {
+      throw new CliError("The VPS host key changed during first-use pinning.", {
+        exitCode: 4,
+        code: "host_trust_race_mismatch",
+      });
+    }
+    await unlink(candidatePath);
+  }
+  await requirePrivateFile(knownHostsFile, "The managed SSH host pin");
+  await syncPath(knownHostsFile);
+  await syncPath(resolve(knownHostsFile, ".."));
+}
+
+export async function establishHostTrust({
+  stateDirectory,
+  serverId,
+  trustEpoch = "initial",
+  server,
+  identityPath,
+  sshUser,
+  sshPort = 22,
+  reinspectServer,
+  spawnImpl = nodeSpawn,
+}) {
+  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(sshUser)) {
+    throw new CliError("--ssh-user is invalid.", { exitCode: 2 });
+  }
+  if (!server || isIP(server.publicIp) !== 4) {
+    throw new CliError("The server returned an invalid public IP.", {
+      exitCode: 3,
+    });
+  }
+  if (!Number.isInteger(sshPort) || sshPort < 1 || sshPort > 65_535) {
+    throw new CliError("The SSH port is invalid.", { exitCode: 2 });
+  }
+  const activeCancellation =
+    ["cancellation_pending", "cancelled"].includes(server.state) &&
+    Number.isFinite(Date.parse(server.termEndsAt || "")) &&
+    Date.parse(server.termEndsAt) > Date.now();
+  if (
+    server.serverId !== serverId ||
+    (server.state !== "ready" && !activeCancellation)
+  ) {
+    throw new CliError(
+      "The VPS must be ready and bound to this server before SSH host trust is established.",
+      { exitCode: 5, code: "host_trust_server_unavailable" },
+    );
+  }
+  if (typeof server.sshFingerprint !== "string") {
+    throw new CliError("The server did not return its owner-key fingerprint.", {
+      exitCode: 3,
+    });
+  }
+  const { identity } = await requireIdentity(
+    identityPath,
+    server.sshFingerprint,
+  );
+  const paths = hostTrustPaths(stateDirectory, serverId, trustEpoch);
+  await ensureTrustDirectories(paths);
+
+  try {
+    await requirePrivateFile(paths.knownHostsFile, "The managed SSH host pin");
+    const pin = validateKnownHosts(
+      await readFile(paths.knownHostsFile, "utf8"),
+      server.publicIp,
+      sshPort,
+    );
+    await strictProbe({
+      identity,
+      publicIp: server.publicIp,
+      sshPort,
+      sshUser,
+      knownHostsFile: paths.knownHostsFile,
+      spawnImpl,
+    });
+    return {
+      state: "matched",
+      algorithm: pin.algorithm,
+      fingerprint: pin.fingerprint,
+      knownHostsFile: paths.knownHostsFile,
+      publicIp: server.publicIp,
+      trustEpoch,
+    };
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+
+  if (typeof reinspectServer !== "function") {
+    throw new CliError(
+      "A fresh server inspection is required before first-use SSH trust can be published.",
+      { exitCode: 4, code: "host_trust_reinspection_required" },
+    );
+  }
+
+  const candidatePath = join(
+    paths.serverDirectory,
+    `.${trustEpoch}.${process.pid}.${randomUUID()}.candidate`,
+  );
+  const handle = await open(candidatePath, "wx", 0o600);
+  await handle.close();
+  try {
+    await spawnSsh(
+      [
+        ...firstUseSshOptions(identity, candidatePath),
+        ...(sshPort === 22 ? [] : ["-p", String(sshPort)]),
+        `${sshUser}@${server.publicIp}`,
+        "true",
+      ],
+      spawnImpl,
+      "Could not authenticate the first SSH connection to the exact VPS. No runtime bootstrap was requested.",
+      paths.serverDirectory,
+      server.publicIp,
+      sshPort,
+    );
+    await requirePrivateFile(candidatePath, "The observed SSH host-key candidate");
+    const pin = validateKnownHosts(
+      await readFile(candidatePath, "utf8"),
+      server.publicIp,
+      sshPort,
+    );
+    const refreshedServer = await reinspectServer();
+    const refreshedCancellation =
+      ["cancellation_pending", "cancelled"].includes(refreshedServer?.state) &&
+      Number.isFinite(Date.parse(refreshedServer?.termEndsAt || "")) &&
+      Date.parse(refreshedServer.termEndsAt) > Date.now();
+    if (
+      refreshedServer?.serverId !== serverId ||
+      (refreshedServer.state !== "ready" && !refreshedCancellation) ||
+      refreshedServer.publicIp !== server.publicIp ||
+      refreshedServer.sshFingerprint !== server.sshFingerprint
+    ) {
+      throw new CliError(
+        "The server identity changed while first-use SSH trust was being established. No host pin or runtime bootstrap was created.",
+        { exitCode: 4, code: "host_trust_server_changed" },
+      );
+    }
+    await publishCandidate(
+      candidatePath,
+      paths.knownHostsFile,
+      pin.content,
+      server.publicIp,
+      sshPort,
+    );
+    await strictProbe({
+      identity,
+      publicIp: server.publicIp,
+      sshPort,
+      sshUser,
+      knownHostsFile: paths.knownHostsFile,
+      spawnImpl,
+    });
+    return {
+      state: "trusted_first_use",
+      algorithm: pin.algorithm,
+      fingerprint: pin.fingerprint,
+      knownHostsFile: paths.knownHostsFile,
+      publicIp: server.publicIp,
+      trustEpoch,
+    };
+  } finally {
+    await rm(candidatePath, { force: true });
+  }
+}

package/src/installer.js

@@ -5,14 +5,15 @@ import {
   verify as verifySignature,
 } from "node:crypto";
 import { spawn as nodeSpawn } from "node:child_process";
-import { access, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 
 import { CliError } from "./errors.js";
+import { strictSshOptions } from "./host-trust.js";
 
 const MAX_ARTIFACT_BYTES = 256 * 1024 * 1024;
-const REQUIRED_FILES = [
+const BASE_REQUIRED_FILES = [
   "install.sh",
   "warpmetal-agentctl",
   "warpmetal-sandbox-gateway",
@@ -24,6 +25,26 @@ const REQUIRED_FILES = [
   "warpmetal-sandbox.conf",
 ];
 
+const NESTED_PRIVATE_PROCFS_FILES = [
+  "nested-private-procfs-oracle.sh",
+  "warpmetal-agent-runtime-bwrap",
+  "warpmetal-apparmor-policy.sh",
+  "warpmetal-policy-metadata",
+];
+
+function supportsNestedPrivateProcfs(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(version);
+  if (!match) return false;
+  const [, major, minor, patch] = match.map(Number);
+  return major > 0 || minor > 1 || (minor === 1 && patch >= 25);
+}
+
+function requiredFiles(version) {
+  return supportsNestedPrivateProcfs(version)
+    ? [...BASE_REQUIRED_FILES, ...NESTED_PRIVATE_PROCFS_FILES]
+    : BASE_REQUIRED_FILES;
+}
+
 const INSTALLER_ERROR_MESSAGES = new Map([
   [
     "runtime_install_lock_unavailable",
@@ -77,12 +98,75 @@ const INSTALLER_ERROR_MESSAGES = new Map([
     "runtime_legacy_migration_required",
     "Existing preview Agent Runtime state requires a separately reviewed migration; it was not reset.",
   ],
+  [
+    "runtime_nested_private_procfs_architecture_unsupported",
+    "Nested private procfs is unavailable on this host architecture.",
+  ],
+  [
+    "runtime_nested_private_procfs_mode_invalid",
+    "The Agent Runtime installer rejected the nested-private-procfs action.",
+  ],
+  [
+    "runtime_apparmor_policy_bundle_invalid",
+    "The signed Runtime bundle does not contain a valid nested-private-procfs policy set.",
+  ],
+  [
+    "runtime_apparmor_state_unverifiable",
+    "The server's AppArmor state could not be verified safely.",
+  ],
+  [
+    "runtime_apparmor_policy_unsupported",
+    "The server cannot safely enable the nested-private-procfs AppArmor policy.",
+  ],
+  [
+    "runtime_apparmor_policy_backup_failed",
+    "The existing AppArmor policy state could not be preserved exactly.",
+  ],
+  [
+    "runtime_apparmor_policy_conflict",
+    "The server has a conflicting nested-private-procfs AppArmor policy state.",
+  ],
+  [
+    "runtime_apparmor_policy_parse_failed",
+    "The signed nested-private-procfs AppArmor policy did not pass host validation.",
+  ],
+  [
+    "runtime_apparmor_policy_install_failed",
+    "The nested-private-procfs AppArmor policy could not be installed safely.",
+  ],
+  [
+    "runtime_apparmor_policy_load_failed",
+    "The nested-private-procfs AppArmor policy could not be loaded and verified.",
+  ],
+  [
+    "runtime_apparmor_policy_disable_failed",
+    "The nested-private-procfs AppArmor policy could not be disabled and restored safely.",
+  ],
+  [
+    "runtime_apparmor_policy_rollback_failed",
+    "The AppArmor policy transaction could not restore its prior state; operator recovery is required.",
+  ],
+  [
+    "runtime_apparmor_policy_recovery_failed",
+    "A prior interrupted AppArmor policy transaction could not be recovered; operator recovery is required.",
+  ],
 ]);
 
+const RECOVERY_ERROR_PRIORITY = [
+  "runtime_apparmor_policy_rollback_failed",
+  "runtime_apparmor_policy_recovery_failed",
+];
+
 function mappedInstallerError(result) {
   const lines = `${result.stderr}\n${result.stdout}`
     .split(/\r?\n/)
     .map((line) => line.trim());
+  for (const code of RECOVERY_ERROR_PRIORITY) {
+    if (lines.includes(code)) {
+      const message = INSTALLER_ERROR_MESSAGES.get(code);
+      return { code, message: `${message} (${code})` };
+    }
+  }
   for (const [code, message] of INSTALLER_ERROR_MESSAGES) {
     if (lines.includes(code)) return { code, message: `${message} (${code})` };
   }
@@ -240,7 +324,7 @@ async function spawnChecked(
   return result;
 }
 
-function sshBase(identity, sshUser, host) {
+function sshBase(identity, sshUser, host, knownHostsFile) {
   if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(sshUser)) {
     throw new CliError("--ssh-user is invalid.", { exitCode: 2 });
   }
@@ -250,16 +334,7 @@ function sshBase(identity, sshUser, host) {
     });
   }
   return [
-    "-i",
-    resolve(identity),
-    "-o",
-    "IdentitiesOnly=yes",
-    "-o",
-    "StrictHostKeyChecking=yes",
-    "-o",
-    "ForwardAgent=no",
-    "-o",
-    "ClearAllForwardings=yes",
+    ...strictSshOptions(resolve(identity), knownHostsFile),
     `${sshUser}@${host}`,
   ];
 }
@@ -270,7 +345,10 @@ export async function installRuntime({
   token,
   identity,
   sshUser,
+  knownHostsFile,
+  trustedPublicIp,
   bootstrap,
+  nestedPrivateProcfs = "preserve",
   fetchImpl = globalThis.fetch,
   spawnImpl = nodeSpawn,
 }) {
@@ -283,7 +361,27 @@ export async function installRuntime({
       exitCode: 5,
     });
   }
+  if (server.publicIp !== trustedPublicIp) {
+    throw new CliError(
+      "The server public IP changed after SSH host-key trust was established.",
+      { exitCode: 4, code: "host_trust_ip_changed" },
+    );
+  }
   const metadata = validateArtifact(bootstrap?.artifact);
+  if (!new Set(["preserve", "enable", "disable"]).has(nestedPrivateProcfs)) {
+    throw new CliError("The nested private procfs action is invalid.", {
+      exitCode: 2,
+    });
+  }
+  if (
+    nestedPrivateProcfs !== "preserve" &&
+    !supportsNestedPrivateProcfs(metadata.version)
+  ) {
+    throw new CliError(
+      `Agent Runtime ${metadata.version} does not support nested private procfs actions.`,
+      { exitCode: 4 },
+    );
+  }
   const bootstrapToken = bootstrap?.bootstrapToken;
   if (
     typeof bootstrapToken !== "string" ||
@@ -302,7 +400,7 @@ export async function installRuntime({
   const remoteID = randomUUID().replaceAll("-", "");
   const remoteArchive = `/tmp/warpmetal-runtime-${remoteID}.tar.gz`;
   const remoteBundle = `/tmp/warpmetal-runtime-${remoteID}`;
-  const ssh = sshBase(identity, sshUser, server.publicIp);
+  const ssh = sshBase(identity, sshUser, server.publicIp, knownHostsFile);
   let remoteTouched = false;
   let operationFailed = false;
   try {
@@ -316,16 +414,26 @@ export async function installRuntime({
         spawnImpl,
       },
     );
-    for (const file of REQUIRED_FILES) await access(join(extractPath, file));
-    const unexpected = (await readdir(extractPath)).filter(
-      (name) => !REQUIRED_FILES.includes(name),
-    );
-    if (unexpected.length > 0) {
+    const expectedFiles = requiredFiles(metadata.version);
+    const actualFiles = await readdir(extractPath);
+    const exactNames =
+      actualFiles.length === expectedFiles.length &&
+      expectedFiles.every((name) => actualFiles.includes(name));
+    if (!exactNames) {
       throw new CliError(
-        "The signed runtime bundle contains unsupported files.",
+        "The signed runtime bundle files do not match this CLI version.",
         { exitCode: 4 },
       );
     }
+    for (const file of expectedFiles) {
+      const metadata = await lstat(join(extractPath, file));
+      if (!metadata.isFile() || metadata.isSymbolicLink()) {
+        throw new CliError(
+          "The signed runtime bundle files do not match this CLI version.",
+          { exitCode: 4 },
+        );
+      }
+    }
     remoteTouched = true;
     await spawnChecked(
       "scp",
@@ -351,19 +459,23 @@ export async function installRuntime({
       ],
       { spawnImpl },
     );
+    const installerArguments = [
+      ...ssh,
+      "sudo",
+      `${remoteBundle}/install.sh`,
+      "--api",
+      client.baseUrl,
+      "--server",
+      serverId,
+      "--bundle",
+      remoteBundle,
+    ];
+    if (nestedPrivateProcfs !== "preserve") {
+      installerArguments.push("--nested-private-procfs", nestedPrivateProcfs);
+    }
     await spawnChecked(
       "ssh",
-      [
-        ...ssh,
-        "sudo",
-        `${remoteBundle}/install.sh`,
-        "--api",
-        client.baseUrl,
-        "--server",
-        serverId,
-        "--bundle",
-        remoteBundle,
-      ],
+      installerArguments,
       {
         stdin: `${bootstrapToken}\n`,
         spawnImpl,
@@ -378,7 +490,12 @@ export async function installRuntime({
         spawnImpl,
       },
     );
-    return { serverId, supervisorVersion: metadata.version, installed: true };
+    return {
+      serverId,
+      supervisorVersion: metadata.version,
+      installed: true,
+      nestedPrivateProcfsAction: nestedPrivateProcfs,
+    };
   } catch (error) {
     operationFailed = true;
     throw error;

package/src/state.js

@@ -5,7 +5,7 @@ import { dirname, isAbsolute, join, resolve } from "node:path";
 
 import { CliError } from "./errors.js";
 
-const STATE_VERSION = 3;
+const STATE_VERSION = 4;
 const WALLET_PAYMENT_STATE_FIELDS = [
   "walletPaymentAttemptId",
   "walletBuyerPaymentIdentifier",
@@ -160,6 +160,19 @@ function migrateState(value) {
       renewals: {},
     };
   }
+  if (
+    value?.version === 3 &&
+    value.orders &&
+    value.servers &&
+    value.operations &&
+    value.runtimes &&
+    value.sandboxes &&
+    value.accessGrants &&
+    value.identities &&
+    value.renewals
+  ) {
+    return { ...value, version: STATE_VERSION };
+  }
   return value;
 }
 
@@ -597,6 +610,46 @@ export class StateStore {
         ...metadata,
         createdAt: new Date().toISOString(),
       };
+      if (kind === "reload") {
+        const server = state.servers[serverId] || { serverId };
+        server.pendingHostTrustReloadOperationId = operationId;
+        state.servers[serverId] = server;
+      }
+    });
+  }
+
+  async hostTrustEpoch(serverId) {
+    return (await this.server(serverId))?.hostTrustEpoch || "initial";
+  }
+
+  async applyReloadHostTrust(serverId, operation) {
+    const operationId = operation?.id;
+    if (
+      typeof operationId !== "string" ||
+      !["succeeded", "failed", "manual_review"].includes(operation?.state)
+    ) {
+      return;
+    }
+    await this.update((state) => {
+      const saved = state.operations[operationId];
+      const server = state.servers[serverId];
+      if (
+        !saved ||
+        saved.serverId !== serverId ||
+        saved.kind !== "reload" ||
+        !server ||
+        server.pendingHostTrustReloadOperationId !== operationId
+      ) {
+        return;
+      }
+      if (
+        operation.state === "succeeded" &&
+        operation.result?.reloadImpact?.ownerKnownHostsNeedRefresh === true
+      ) {
+        server.hostTrustEpoch = `reload-${operationId}`;
+        server.hostTrustReloadOperationId = operationId;
+      }
+      delete server.pendingHostTrustReloadOperationId;
     });
   }