# VM101 scripting environment — current contract

VM101 runs OpenWrt. The default remote interpreter is `/bin/sh` (BusyBox ash), not Bash. Target scripts must use POSIX-compatible shell and must preflight every external command they actually invoke.

## Confirmed additional packages and commands

The VM has coreutils plus `base64`, `install`, `nl`, `readlink`, `realpath`, `sort`, `stat`, `timeout`, diffutils, curl, CA certificates and Git. Confirmed networking/runtime commands include `ip`, `nft`, `uci`, `ubus`, `ifstatus`, `ifup`, `ifdown`, `ping`, `wget`, `curl` and `amneziawg`.

A command being present does not imply that unrelated GNU options are available. Avoid GNU-only `find`, `sed`, `tar`, `date`, `cp` or `grep` extensions unless the exact option is checked.

Do not assume the presence of Bash, Python, jq, rsync, flock, socat, netcat, unzip or zip on VM101.

## VPN and services

Use `amneziawg` as the authoritative runtime tool for vpn1..vpn5. Do not use ordinary `wg` as the primary source. VM101 has no systemd; service operations use `/etc/init.d/<service>`, and logs use `logread`.

Read-only inspection must not perform `ifup`, `ifdown`, UCI writes, route/rule mutations, nft changes, network reloads or service restarts.

## File installation

GNU `install` is available but is still checked in the current STEP preflight. Critical files should be written to a temporary path, syntax/hash checked, and atomically moved into place.

## Machine Git

- Git dir: `/root/.vm101-source.git`
- Work tree: `/`
- Branch: `main`
- Baseline commit before R15B2: `66a24ee69f186d27cab4ae73169fab6fab636d56`
- Baseline tree: `6b16f8192262116a7a1ff77c333184e548446be7`
- Baseline managed count: `32`

Safe diagnostics use tracked-only diff/status. Never run `git status --untracked-files=all` with `WORK_TREE=/`.

## Transport

The supported route is VM130 -> `pve-mgts` -> root@10.71.100.2. Complex remote operations are standalone POSIX shell files passed as exact bytes to `sh -s`. Binary transfer uses tar/gzip streams; binary data is never placed in shell variables.

Complex JSON processing, exact HTTPS Git clone, archive/model generation, publication and HTTP verification belong on VM130.