@fased/fased 0.1.10 → 0.1.12

package/dist/{node-cli-Cqh8buCU.js → node-cli-LfnYXPVk.js}

@@ -2,7 +2,7 @@ import { _ as resolveStateDir, d as resolveIsNixMode } from "./paths-C9FmTW1x.js
 import { U as theme, V as colorize } from "./agent-paths-BySKyq9I.js";
 import { Dn as loadConfig, Du as sanitizeHostExecEnv, Nl as sameFileIdentity, Ou as sanitizeSystemRunEnvOverrides, bl as VERSION, dd as formatCliCommand, i as resolveAgentConfig, mf as GATEWAY_CLIENT_NAMES, pf as GATEWAY_CLIENT_MODES, yr as analyzeArgvCommand } from "./agent-scope-CLn_Ws3B.js";
 import "./commands-registry-DfzoWf4b.js";
-import { Hi as startBrowserControlServiceFromConfig, Ki as resolveBrowserConfig, Na as getMachineDisplayName, Vi as createBrowserControlContext, zi as createBrowserRouteDispatcher } from "./reply-DQfPM5ia.js";
+import { Hi as startBrowserControlServiceFromConfig, Ki as resolveBrowserConfig, Na as getMachineDisplayName, Vi as createBrowserControlContext, zi as createBrowserRouteDispatcher } from "./reply-BBDR--RC.js";
 import { d as defaultRuntime } from "./errors-Dx3S3Nrp.js";
 import "./send-DI5jsj-s.js";
 import "./send-Dg2_aoK-.js";
@@ -38,7 +38,7 @@ import "./ssrf-Blf4NrHS.js";
 import "./outbound-attachment-BHTb_aF7.js";
 import "./fetch-BJWQWfdf.js";
 import "./delivery-queue-9lp1uujZ.js";
-import "./deps-CBapZnsi.js";
+import "./deps-CmbKRFX-.js";
 import "./memory-e9aOXNx1.js";
 import "./memory-search-B8y2GTeB.js";
 import "./manager-DI2w66Ae.js";

package/dist/{onboard-BD0MOrv7.js → onboard-CjinvB7q.js}

@@ -1,7 +1,7 @@
 import { u as resolveGatewayPort } from "./paths-C9FmTW1x.js";
 import { S as resolveUserPath } from "./agent-paths-BySKyq9I.js";
 import { Ga as ensureAuthProfileStore, Hi as resolveEnvApiKey, Jn as parseDurationMs, Mn as writeConfigFile, Ta as resolveDefaultSecretProviderAlias, Ua as upsertAuthProfile, ao as loadPluginManifestRegistry, bo as normalizeSecretInput, dd as formatCliCommand, di as normalizeProviderId, kn as readConfigFileSnapshot, oa as resolveAuthProfileOrder, oo as assertSupportedRuntime, pa as resolveApiKeyForProfile, yo as normalizeOptionalSecretInput } from "./agent-scope-CLn_Ws3B.js";
-import { Lt as DEFAULT_WORKSPACE, Mt as resolvePluginProviders, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Zt as randomToken, nn as waitForGatewayReachable } from "./reply-DQfPM5ia.js";
+import { Lt as DEFAULT_WORKSPACE, Mt as resolvePluginProviders, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Zt as randomToken, nn as waitForGatewayReachable } from "./reply-BBDR--RC.js";
 import { d as defaultRuntime, f as restoreTerminalState } from "./errors-Dx3S3Nrp.js";
 import { a as readWalletProviderRegistry, f as setWalletProvidersEnabled, t as WALLET_PROVIDER_IDS } from "./wallet-provider-registry-ax0NJo0F.js";
 import { or as clearDeviceAuthStore } from "./call-s6DNIELo.js";
@@ -9,12 +9,12 @@ import { r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from
 import { a as resolveHostedOnboardingGatewayStartupMode, n as gatewayInstallErrorHint, t as buildGatewayInstallPlan } from "./daemon-install-helpers-CG_Lmgua.js";
 import { r as isSystemdUserServiceAvailable } from "./systemd-ZvgpcrfV.js";
 import { t as resolveGatewayService } from "./service-DbZp-Ejz.js";
-import { d as resolveCustomProviderId, l as parseNonInteractiveCustomApiFlags, o as CustomApiError, s as applyCustomApiConfig } from "./ipv4-P47TSJIK.js";
-import { i as healthCommand } from "./health-DTTfLYjl.js";
-import { $ as applyLitellmConfig, At as validateAnthropicSetupToken, B as applyMistralConfig, Ct as setXaiApiKey, Dt as MINIMAX_HIGHSPEED_MODEL_ID, Et as MINIMAX_DEFAULT_MODEL_ID, F as applyMinimaxApiConfig, Ft as resolveManifestProviderAuthChoice, G as applyQwenCodingPlanConfig, H as applyMoonshotConfigCn, I as applyMinimaxApiConfigCn, J as applyTogetherConfig, K as applyQwenConfig, L as applyAuthProfileConfig$1, M as detectZaiEndpoint, Mt as normalizeSecretInputModeInput, N as applyGoogleGeminiModelDefault, P as applyOpencodeZenConfig, Pt as resolveManifestDeprecatedProviderAuthChoice, Q as applyZaiConfig, R as applyHuggingfaceConfig, St as setVolcengineApiKey, Tt as setZaiApiKey, U as applyOpenrouterConfig, V as applyMoonshotConfig, W as applyQianfanConfig, X as applyXaiConfig, Y as applyVeniceConfig, Z as applyXiaomiConfig, _t as setQwenCodingPlanApiKey, at as setGeminiApiKey, bt as setVeniceApiKey, c as applyDefaultModel, ct as setLitellmApiKey, d as resolveProviderMatch, dt as setMoonshotApiKey, et as applyCloudflareAiGatewayConfig, ft as setOpenaiApiKey, gt as setQwenApiKey, ht as setQianfanApiKey, i as applyOpenAIConfig, it as setCloudflareAiGatewayConfig, kt as buildTokenProfileId, l as mergeConfigPatch, lt as setMinimaxApiKey, m as applyPrimaryModel, mt as setOpenrouterApiKey, nt as setAnthropicApiKey, o as applyAuthProfileConfig, ot as setHuggingfaceApiKey, pt as setOpencodeZenApiKey, q as applySyntheticConfig, rt as setByteplusApiKey, s as buildApiKeyCredential, st as setKimiCodingApiKey, tt as applyVercelAiGatewayConfig, u as pickAuthMethod, ut as setMistralApiKey, vt as setSyntheticApiKey, wt as setXiaomiApiKey, xt as setVercelAiGatewayApiKey, yt as setTogetherApiKey, z as applyKimiCodeConfig } from "./auth-choice-DbEAsUsi.js";
-import { a as normalizeLegacyOnboardAuthChoice, i as isDeprecatedAuthChoice, r as resolveOnboardProviderAuthFlags } from "./auth-choice-prompt-DMlwK9kF.js";
+import { d as resolveCustomProviderId, l as parseNonInteractiveCustomApiFlags, o as CustomApiError, s as applyCustomApiConfig } from "./ipv4-C3GrgewJ.js";
+import { i as healthCommand } from "./health-D4RxkHwO.js";
+import { $ as applyLitellmConfig, At as validateAnthropicSetupToken, B as applyMistralConfig, Ct as setXaiApiKey, Dt as MINIMAX_HIGHSPEED_MODEL_ID, Et as MINIMAX_DEFAULT_MODEL_ID, F as applyMinimaxApiConfig, Ft as resolveManifestProviderAuthChoice, G as applyQwenCodingPlanConfig, H as applyMoonshotConfigCn, I as applyMinimaxApiConfigCn, J as applyTogetherConfig, K as applyQwenConfig, L as applyAuthProfileConfig$1, M as detectZaiEndpoint, Mt as normalizeSecretInputModeInput, N as applyGoogleGeminiModelDefault, P as applyOpencodeZenConfig, Pt as resolveManifestDeprecatedProviderAuthChoice, Q as applyZaiConfig, R as applyHuggingfaceConfig, St as setVolcengineApiKey, Tt as setZaiApiKey, U as applyOpenrouterConfig, V as applyMoonshotConfig, W as applyQianfanConfig, X as applyXaiConfig, Y as applyVeniceConfig, Z as applyXiaomiConfig, _t as setQwenCodingPlanApiKey, at as setGeminiApiKey, bt as setVeniceApiKey, c as applyDefaultModel, ct as setLitellmApiKey, d as resolveProviderMatch, dt as setMoonshotApiKey, et as applyCloudflareAiGatewayConfig, ft as setOpenaiApiKey, gt as setQwenApiKey, ht as setQianfanApiKey, i as applyOpenAIConfig, it as setCloudflareAiGatewayConfig, kt as buildTokenProfileId, l as mergeConfigPatch, lt as setMinimaxApiKey, m as applyPrimaryModel, mt as setOpenrouterApiKey, nt as setAnthropicApiKey, o as applyAuthProfileConfig, ot as setHuggingfaceApiKey, pt as setOpencodeZenApiKey, q as applySyntheticConfig, rt as setByteplusApiKey, s as buildApiKeyCredential, st as setKimiCodingApiKey, tt as applyVercelAiGatewayConfig, u as pickAuthMethod, ut as setMistralApiKey, vt as setSyntheticApiKey, wt as setXiaomiApiKey, xt as setVercelAiGatewayApiKey, yt as setTogetherApiKey, z as applyKimiCodeConfig } from "./auth-choice-yoUpVms3.js";
+import { a as normalizeLegacyOnboardAuthChoice, i as isDeprecatedAuthChoice, r as resolveOnboardProviderAuthFlags } from "./auth-choice-prompt-B7PJvTVu.js";
 import { n as logConfigUpdated } from "./logging-C8GVa7dS.js";
-import { a as applyRecommendedInternalHooks, i as isHostedSecurityCapableSession, n as applyHostingSecurity, o as applyOnboardingLocalWorkspaceConfig, r as configureFederationForOnboarding, t as runOnboardingWizard } from "./onboarding-BC-5Pv9o.js";
+import { a as applyRecommendedInternalHooks, i as isHostedSecurityCapableSession, n as applyHostingSecurity, o as applyOnboardingLocalWorkspaceConfig, r as configureFederationForOnboarding, t as runOnboardingWizard } from "./onboarding-CYRCJeTz.js";
 import { t as WizardCancelledError } from "./prompts-CbbpEiEO.js";
 import { t as createClackPrompter } from "./clack-prompter-Bpbu54xa.js";
 import { n as ensureSystemdUserLingerNonInteractive } from "./systemd-linger-S605QEIC.js";

package/dist/{onboard-Dz8z4vBi.js → onboard-DiAeyhSY.js}

@@ -1,6 +1,6 @@
 import { Ba as normalizeOptionalSecretInput, Cu as formatCliCommand, Ii as resolveApiKeyForProfile, Ji as resolveDefaultSecretProviderAlias, Oa as loadPluginManifestRegistry, Pr as normalizeProviderId, Qt as readConfigFileSnapshot, Va as normalizeSecretInput, _n as parseDurationMs, di as resolveEnvApiKey, fa as upsertAuthProfile, ka as assertSupportedRuntime, ki as resolveAuthProfileOrder, ma as ensureAuthProfileStore, tn as writeConfigFile } from "./env-Dlz8aQHP.js";
 import { x as resolveUserPath } from "./agent-paths-DUHGyU1s.js";
-import { A as waitForGatewayReachable, E as resolveControlUiLinks, T as randomToken, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, h as ensureWorkspaceAndSessions, s as resolvePluginProviders, v as handleOnboardingRepair } from "./model-catalog-B2mRe6cZ.js";
+import { A as waitForGatewayReachable, E as resolveControlUiLinks, T as randomToken, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, h as ensureWorkspaceAndSessions, s as resolvePluginProviders, v as handleOnboardingRepair } from "./model-catalog-CuBQyuRB.js";
 import { A as defaultRuntime, gt as resolveGatewayPort, j as restoreTerminalState } from "./entry.js";
 import { a as readWalletProviderRegistry, f as setWalletProvidersEnabled, t as WALLET_PROVIDER_IDS } from "./wallet-provider-registry-CFNtQ2ZR.js";
 import { or as clearDeviceAuthStore } from "./call-CjHZhgQk.js";
@@ -8,12 +8,12 @@ import { r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from
 import { a as resolveHostedOnboardingGatewayStartupMode, n as gatewayInstallErrorHint, t as buildGatewayInstallPlan } from "./daemon-install-helpers-CzpeF_Bc.js";
 import { r as isSystemdUserServiceAvailable } from "./systemd-7bMkfZjg.js";
 import { t as resolveGatewayService } from "./service-CnO5S7Pz.js";
-import { d as resolveCustomProviderId, l as parseNonInteractiveCustomApiFlags, o as CustomApiError, s as applyCustomApiConfig } from "./ipv4-Citn8Cno.js";
-import { i as healthCommand } from "./health-C_g99tp_.js";
-import { $ as applyLitellmConfig, At as validateAnthropicSetupToken, B as applyMistralConfig, Ct as setXaiApiKey, Dt as MINIMAX_HIGHSPEED_MODEL_ID, Et as MINIMAX_DEFAULT_MODEL_ID, F as applyMinimaxApiConfig, Ft as resolveManifestProviderAuthChoice, G as applyQwenCodingPlanConfig, H as applyMoonshotConfigCn, I as applyMinimaxApiConfigCn, J as applyTogetherConfig, K as applyQwenConfig, L as applyAuthProfileConfig$1, M as detectZaiEndpoint, Mt as normalizeSecretInputModeInput, N as applyGoogleGeminiModelDefault, P as applyOpencodeZenConfig, Pt as resolveManifestDeprecatedProviderAuthChoice, Q as applyZaiConfig, R as applyHuggingfaceConfig, St as setVolcengineApiKey, Tt as setZaiApiKey, U as applyOpenrouterConfig, V as applyMoonshotConfig, W as applyQianfanConfig, X as applyXaiConfig, Y as applyVeniceConfig, Z as applyXiaomiConfig, _t as setQwenCodingPlanApiKey, at as setGeminiApiKey, bt as setVeniceApiKey, c as applyDefaultModel, ct as setLitellmApiKey, d as resolveProviderMatch, dt as setMoonshotApiKey, et as applyCloudflareAiGatewayConfig, ft as setOpenaiApiKey, gt as setQwenApiKey, ht as setQianfanApiKey, i as applyOpenAIConfig, it as setCloudflareAiGatewayConfig, kt as buildTokenProfileId, l as mergeConfigPatch, lt as setMinimaxApiKey, m as applyPrimaryModel, mt as setOpenrouterApiKey, nt as setAnthropicApiKey, o as applyAuthProfileConfig, ot as setHuggingfaceApiKey, pt as setOpencodeZenApiKey, q as applySyntheticConfig, rt as setByteplusApiKey, s as buildApiKeyCredential, st as setKimiCodingApiKey, tt as applyVercelAiGatewayConfig, u as pickAuthMethod, ut as setMistralApiKey, vt as setSyntheticApiKey, wt as setXiaomiApiKey, xt as setVercelAiGatewayApiKey, yt as setTogetherApiKey, z as applyKimiCodeConfig } from "./auth-choice-DlcbJgp_.js";
-import { a as normalizeLegacyOnboardAuthChoice, i as isDeprecatedAuthChoice, r as resolveOnboardProviderAuthFlags } from "./auth-choice-prompt-CcOEzXoi.js";
+import { d as resolveCustomProviderId, l as parseNonInteractiveCustomApiFlags, o as CustomApiError, s as applyCustomApiConfig } from "./ipv4-mFIX9nv4.js";
+import { i as healthCommand } from "./health-Cd-khz-9.js";
+import { $ as applyLitellmConfig, At as validateAnthropicSetupToken, B as applyMistralConfig, Ct as setXaiApiKey, Dt as MINIMAX_HIGHSPEED_MODEL_ID, Et as MINIMAX_DEFAULT_MODEL_ID, F as applyMinimaxApiConfig, Ft as resolveManifestProviderAuthChoice, G as applyQwenCodingPlanConfig, H as applyMoonshotConfigCn, I as applyMinimaxApiConfigCn, J as applyTogetherConfig, K as applyQwenConfig, L as applyAuthProfileConfig$1, M as detectZaiEndpoint, Mt as normalizeSecretInputModeInput, N as applyGoogleGeminiModelDefault, P as applyOpencodeZenConfig, Pt as resolveManifestDeprecatedProviderAuthChoice, Q as applyZaiConfig, R as applyHuggingfaceConfig, St as setVolcengineApiKey, Tt as setZaiApiKey, U as applyOpenrouterConfig, V as applyMoonshotConfig, W as applyQianfanConfig, X as applyXaiConfig, Y as applyVeniceConfig, Z as applyXiaomiConfig, _t as setQwenCodingPlanApiKey, at as setGeminiApiKey, bt as setVeniceApiKey, c as applyDefaultModel, ct as setLitellmApiKey, d as resolveProviderMatch, dt as setMoonshotApiKey, et as applyCloudflareAiGatewayConfig, ft as setOpenaiApiKey, gt as setQwenApiKey, ht as setQianfanApiKey, i as applyOpenAIConfig, it as setCloudflareAiGatewayConfig, kt as buildTokenProfileId, l as mergeConfigPatch, lt as setMinimaxApiKey, m as applyPrimaryModel, mt as setOpenrouterApiKey, nt as setAnthropicApiKey, o as applyAuthProfileConfig, ot as setHuggingfaceApiKey, pt as setOpencodeZenApiKey, q as applySyntheticConfig, rt as setByteplusApiKey, s as buildApiKeyCredential, st as setKimiCodingApiKey, tt as applyVercelAiGatewayConfig, u as pickAuthMethod, ut as setMistralApiKey, vt as setSyntheticApiKey, wt as setXiaomiApiKey, xt as setVercelAiGatewayApiKey, yt as setTogetherApiKey, z as applyKimiCodeConfig } from "./auth-choice-BpV7vqnP.js";
+import { a as normalizeLegacyOnboardAuthChoice, i as isDeprecatedAuthChoice, r as resolveOnboardProviderAuthFlags } from "./auth-choice-prompt-BFm4XkAG.js";
 import { n as logConfigUpdated } from "./logging-B1pB3RkW.js";
-import { a as applyRecommendedInternalHooks, i as isHostedSecurityCapableSession, n as applyHostingSecurity, o as applyOnboardingLocalWorkspaceConfig, r as configureFederationForOnboarding, t as runOnboardingWizard } from "./onboarding-DgTB_zq7.js";
+import { a as applyRecommendedInternalHooks, i as isHostedSecurityCapableSession, n as applyHostingSecurity, o as applyOnboardingLocalWorkspaceConfig, r as configureFederationForOnboarding, t as runOnboardingWizard } from "./onboarding-Cy5d82Kg.js";
 import { t as WizardCancelledError } from "./prompts-DdS4bZNt.js";
 import { t as createClackPrompter } from "./clack-prompter-CZlDqO1z.js";
 import { n as ensureSystemdUserLingerNonInteractive } from "./systemd-linger-CAPmfIid.js";

package/dist/{onboard-channels-CPh2EJOi.js → onboard-channels-BOR7r6J2.js}

@@ -1,6 +1,6 @@
 import { _ as normalizeE164, i as CONFIG_DIR, v as pathExists } from "./agent-paths-BySKyq9I.js";
 import { $l as runCommandWithTimeout, B as listChatChannels, Bd as listDiscordAccountIds, Dd as listSlackAccountIds, F as createSubsystemLogger, Fd as resolveSignalAccount, Hd as resolveDefaultDiscordAccountId, Hu as resolveDefaultWhatsAppAccountId, Id as listIMessageAccountIds, L as formatChannelPrimerLine, Ld as resolveDefaultIMessageAccountId, Mu as getChannelPlugin, Nd as listSignalAccountIds, Nu as listChannelPlugins, Od as resolveDefaultSlackAccountId, Pd as resolveDefaultSignalAccountId, R as formatChannelSelectionLine, Rd as resolveIMessageAccount, Ud as resolveDiscordAccount, Vu as listWhatsAppAccountIds, Wu as resolveWhatsAppAuthDir, _d as resolveDefaultTelegramAccountId, d as resolveDefaultAgentId, dd as formatCliCommand, gd as listTelegramAccountIds, kd as resolveSlackAccount, ld as stripAnsi, mo as resolveFasedAgentPackageRootSync, ou as extractArchive, u as resolveAgentWorkspaceDir, vd as resolveTelegramAccount, wl as installPluginFromNpmSpec } from "./agent-scope-CLn_Ws3B.js";
-import { Ft as resolveSlackUserAllowlist, It as resolveSlackChannelAllowlist, Nt as loadFasedAgentPlugins, la as createPluginLoaderLogger, mn as resolveDiscordChannelAllowlist, pn as resolveDiscordUserAllowlist, zt as detectBinary } from "./reply-DQfPM5ia.js";
+import { Ft as resolveSlackUserAllowlist, It as resolveSlackChannelAllowlist, Nt as loadFasedAgentPlugins, la as createPluginLoaderLogger, mn as resolveDiscordChannelAllowlist, pn as resolveDiscordUserAllowlist, zt as detectBinary } from "./reply-BBDR--RC.js";
 import { h as normalizeAccountId, m as DEFAULT_ACCOUNT_ID } from "./session-key-LmCHAJTQ.js";
 import { dt as normalizeDiscordSlug } from "./send-Dg2_aoK-.js";
 import { i as isBlockedHostnameOrIp } from "./ssrf-Blf4NrHS.js";
@@ -12,7 +12,7 @@ import { t as resolveBrewExecutable } from "./brew-C52GeCeh.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-BvDnvwsE.js";
 import { t as enablePluginInConfig } from "./enable-DYrDatZX.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-BS-BIvab.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-Bgh3V8Jt.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-OLgxIVgL.js";
 import { t as fetchTelegramChatId } from "./api-DLdLLQm_.js";
 import fs, { createWriteStream, readFileSync } from "node:fs";
 import os from "node:os";

package/dist/{onboard-channels-DUa2qkms.js → onboard-channels-CEv6tCJQ.js}

@@ -1,7 +1,7 @@
 import { $c as installPluginFromNpmSpec, $d as resolveDiscordAccount, $l as listWhatsAppAccountIds, Au as resolveTelegramAccount, Cu as formatCliCommand, Gd as resolveSignalAccount, Gl as listChannelPlugins, Gu as resolveDefaultAgentId, Jd as resolveIMessageAccount, Kd as listIMessageAccountIds, Ld as listSlackAccountIds, Ou as listTelegramAccountIds, Qd as resolveDefaultDiscordAccountId, Rd as resolveDefaultSlackAccountId, Ud as listSignalAccountIds, Wd as resolveDefaultSignalAccountId, Wl as getChannelPlugin, Wu as resolveAgentWorkspaceDir, Xd as listDiscordAccountIds, a as createSubsystemLogger, c as formatChannelSelectionLine, eu as resolveDefaultWhatsAppAccountId, ku as resolveDefaultTelegramAccountId, md as runCommandWithTimeout, nu as resolveWhatsAppAuthDir, pd as resolveFasedAgentPackageRootSync, qd as resolveDefaultIMessageAccountId, s as formatChannelPrimerLine, u as listChatChannels, xl as extractArchive, xu as stripAnsi, zd as resolveSlackAccount } from "./env-Dlz8aQHP.js";
 import { _ as pathExists, g as normalizeE164, i as CONFIG_DIR } from "./agent-paths-DUHGyU1s.js";
 import { dt as normalizeDiscordSlug } from "./send-CWM2yWF6.js";
-import { Oi as createPluginLoaderLogger, Qt as resolveDiscordUserAllowlist, V as resolveDiscordChannelAllowlist, Zt as resolveSlackUserAllowlist, c as loadFasedAgentPlugins, p as detectBinary, u as resolveSlackChannelAllowlist } from "./model-catalog-B2mRe6cZ.js";
+import { Oi as createPluginLoaderLogger, Qt as resolveDiscordUserAllowlist, V as resolveDiscordChannelAllowlist, Zt as resolveSlackUserAllowlist, c as loadFasedAgentPlugins, p as detectBinary, u as resolveSlackChannelAllowlist } from "./model-catalog-CuBQyuRB.js";
 import { J as DEFAULT_ACCOUNT_ID, Y as normalizeAccountId } from "./entry.js";
 import { i as isBlockedHostnameOrIp } from "./ssrf-CqV2hisj.js";
 import { d as listChannelPluginCatalogEntries, f as resolveChannelPluginExpectedPluginIds, l as formatChannelPluginCatalogSelectionHint, s as isChannelConfigured, u as formatChannelPluginCatalogStatusLine } from "./dangerous-name-matching-ob0tR02Y.js";
@@ -12,7 +12,7 @@ import { t as loginWeb } from "./login-tqTj2mT5.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-BfdkoReO.js";
 import { t as enablePluginInConfig } from "./enable-C7xTf-9S.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-PYgg3AvN.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-B4RibYD4.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-C4k_XIAn.js";
 import { t as fetchTelegramChatId } from "./api-uvDKewCP.js";
 import { spawn } from "node:child_process";
 import os from "node:os";

package/dist/{onboard-search-BnHMgV2k.js → onboard-search-B3wBacDO.js}

@@ -2,7 +2,7 @@ import { $c as installPluginFromNpmSpec, Wa as coerceSecretRef, pd as resolveFas
 import { i as CONFIG_DIR, p as isRecord, x as resolveUserPath } from "./agent-paths-DUHGyU1s.js";
 import "./send-Ditv1VfR.js";
 import "./send-CWM2yWF6.js";
-import "./model-catalog-B2mRe6cZ.js";
+import "./model-catalog-CuBQyuRB.js";
 import "./github-copilot-token-A9DiaCB0.js";
 import "./reply-prefix-CCp0C8w4.js";
 import "./memory-BpNgGSAl.js";
@@ -44,7 +44,7 @@ import "./send-Dlj2DghK.js";
 import "./outbound-attachment-D2ImFzcm.js";
 import "./fetch-BqA-KBI4.js";
 import "./delivery-queue-CMGPhIoF.js";
-import "./deps-4rCQ5SBd.js";
+import "./deps-CZ5BtLba.js";
 import "./frontmatter-DTw-J9er.js";
 import "./skills-CzDvK09q.js";
 import "./skills-remote-CM9uNuu4.js";
@@ -75,10 +75,10 @@ import "./prompt-style-CWdNyu_Q.js";
 import "./pairing-labels-DBt_OA8C.js";
 import { t as enablePluginInConfig } from "./enable-C7xTf-9S.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-PYgg3AvN.js";
-import "./status-jb8w0SwX.js";
+import "./status-DP-ZmLoI.js";
 import "./update-C_BnpDpE.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-B4RibYD4.js";
-import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-TGCiBzhv.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-C4k_XIAn.js";
+import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-B6bTk9-Z.js";
 import path from "node:path";
 import fs from "node:fs";
 

package/dist/{onboard-search-CqiDzWQw.js → onboard-search-DE_DRU35.js}

@@ -2,7 +2,7 @@ import "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, i as CONFIG_DIR, m as isRecord } from "./agent-paths-BySKyq9I.js";
 import { Co as coerceSecretRef, mo as resolveFasedAgentPackageRootSync, wl as installPluginFromNpmSpec } from "./agent-scope-CLn_Ws3B.js";
 import "./commands-registry-DfzoWf4b.js";
-import "./reply-DQfPM5ia.js";
+import "./reply-BBDR--RC.js";
 import "./errors-Dx3S3Nrp.js";
 import "./send-DI5jsj-s.js";
 import "./send-Dg2_aoK-.js";
@@ -37,7 +37,7 @@ import "./ssrf-Blf4NrHS.js";
 import "./outbound-attachment-BHTb_aF7.js";
 import "./fetch-BJWQWfdf.js";
 import "./delivery-queue-9lp1uujZ.js";
-import "./deps-CBapZnsi.js";
+import "./deps-CmbKRFX-.js";
 import "./memory-e9aOXNx1.js";
 import "./memory-search-B8y2GTeB.js";
 import "./manager-DI2w66Ae.js";
@@ -78,10 +78,10 @@ import "./prompt-style-Db5iJoaI.js";
 import "./pairing-labels-sAC1Ty3_.js";
 import { t as enablePluginInConfig } from "./enable-DYrDatZX.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-BS-BIvab.js";
-import "./status-CTveTSuF.js";
+import "./status-B-5uZdap.js";
 import "./update-fKz5UGr6.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-Bgh3V8Jt.js";
-import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-gM-8LIxg.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-OLgxIVgL.js";
+import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-tUcnQoHZ.js";
 import fs from "node:fs";
 import path from "node:path";
 

package/dist/{onboarding-BC-5Pv9o.js → onboarding-CYRCJeTz.js}

@@ -1,7 +1,7 @@
 import { _ as resolveStateDir, n as DEFAULT_GATEWAY_PORT, u as resolveGatewayPort } from "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, U as theme } from "./agent-paths-BySKyq9I.js";
 import { Ga as ensureAuthProfileStore, Mn as writeConfigFile, Zr as collectConfigServiceEnvVars, d as resolveDefaultAgentId, dd as formatCliCommand, fr as ensureActiveMemoryPluginAllowlisted, kn as readConfigFileSnapshot, u as resolveAgentWorkspaceDir } from "./agent-scope-CLn_Ws3B.js";
-import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-DQfPM5ia.js";
+import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-BBDR--RC.js";
 import { d as defaultRuntime, f as restoreTerminalState, s as redactSensitiveText } from "./errors-Dx3S3Nrp.js";
 import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-B12p7GUZ.js";
 import { i as resolveLocalSignerRunAsUser, n as resolveLocalSignerBackendSocketPath, o as resolveLocalSignerSocketPath, r as resolveLocalSignerMaterialRootDir, t as ensureWalletStateDir } from "./wallet-runtime-config-BlRWvEER.js";
@@ -17,14 +17,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-ZvgpcrfV.js";
 import { t as resolveGatewayService } from "./service-DbZp-Ejz.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-B5uApPZ5.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-P47TSJIK.js";
-import { o as waitForHostedDashboardBrowserPath } from "./health-DTTfLYjl.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DbEAsUsi.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-DMlwK9kF.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-C3GrgewJ.js";
+import { o as waitForHostedDashboardBrowserPath } from "./health-D4RxkHwO.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-yoUpVms3.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-B7PJvTVu.js";
 import { n as logConfigUpdated } from "./logging-C8GVa7dS.js";
-import { n as setupChannels } from "./onboard-channels-CPh2EJOi.js";
+import { n as setupChannels } from "./onboard-channels-BOR7r6J2.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-CrTowaUt.js";
-import { t as runTui } from "./tui-lmdDZi6Y.js";
+import { t as runTui } from "./tui-DX2hKjKi.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -358,34 +358,61 @@ function buildOnboardingDashboardUrl(params) {
 	url.hash = hash ? `#${hash}` : "";
 	return url.toString();
 }
+function noteHeading$1(value) {
+	return theme.heading(value.toUpperCase());
+}
+function noteLabel(value) {
+	return theme.accentBright(value);
+}
+function noteInfo$1(value) {
+	return theme.info(value);
+}
+function noteSuccess$1(value) {
+	return theme.success(value);
+}
+function noteWarn$1(value) {
+	return theme.warn(value);
+}
+function noteMuted(value) {
+	return theme.muted(value);
+}
+function noteCommand$1(value) {
+	return theme.command(value);
+}
+function noteBullet$1(value) {
+	return `- ${value}`;
+}
+function formatFasedNetworkAutoConnectSummary(messages) {
+	return [noteHeading$1("Connection confirmed"), ...messages.map((message) => noteBullet$1(noteSuccess$1(message)))].join("\n");
+}
 function formatStrictRemoteAccessDetails(params) {
 	const sshTarget = params.tailscaleNodeName || params.tailscaleIpv4 || "(tailscale-node)";
 	const tailscaleIpv4 = params.tailscaleIpv4?.trim();
 	const hasIpFallback = Boolean(tailscaleIpv4 && tailscaleIpv4 !== sshTarget);
 	return [
-		"Use both access paths after hosted setup:",
+		noteInfo$1("Use both access paths after hosted setup:"),
 		"",
-		"1. WEB DASHBOARD",
-		"   Open this on your own computer after signing into the same Tailscale account:",
-		`   ${params.dashboardUrl}`,
+		noteHeading$1("1. Web dashboard"),
+		`   ${noteInfo$1("Open this on your own computer after signing into the same Tailscale account:")}`,
+		`   ${noteCommand$1(params.dashboardUrl)}`,
 		"",
-		"2. SSH TERMINAL",
-		"   Use this for CLI commands, updates, logs, and repairs over Tailscale:",
-		`   ssh ${params.tailscaleSshUser}@${sshTarget}`,
-		hasIpFallback ? `   If hostname DNS fails but Tailscale IP ping works, use: ssh ${params.tailscaleSshUser}@${tailscaleIpv4}` : void 0,
-		"   The app user shell opens in the Fased repo directory.",
+		noteHeading$1("2. SSH terminal"),
+		`   ${noteInfo$1("Use this for CLI commands, updates, logs, and repairs over Tailscale:")}`,
+		`   ${noteCommand$1(`ssh ${params.tailscaleSshUser}@${sshTarget}`)}`,
+		hasIpFallback ? `   ${noteWarn$1("If hostname DNS fails but Tailscale IP ping works, use:")} ${noteCommand$1(`ssh ${params.tailscaleSshUser}@${tailscaleIpv4}`)}` : void 0,
+		`   ${noteInfo$1("The app user shell opens in the Fased repo directory.")}`,
 		"",
-		"ADVANCED FALLBACK",
-		"   If the Tailscale web URL is unavailable, run this on your local computer and leave it open:",
-		`   ssh -N -L ${params.port}:127.0.0.1:${params.port} ${params.tailscaleSshUser}@${sshTarget}`,
-		hasIpFallback ? `   If a VPN blocks MagicDNS hostname lookup, use: ssh -N -L ${params.port}:127.0.0.1:${params.port} ${params.tailscaleSshUser}@${tailscaleIpv4}` : void 0,
-		"   Then open:",
-		`   ${params.tunnelUrl}`,
-		hasIpFallback ? "   Note: another VPN can break Tailscale MagicDNS while raw 100.x Tailscale IP access still works." : void 0,
+		noteHeading$1("Advanced fallback"),
+		`   ${noteInfo$1("If the Tailscale web URL is unavailable, run this on your local computer and leave it open:")}`,
+		`   ${noteCommand$1(`ssh -N -L ${params.port}:127.0.0.1:${params.port} ${params.tailscaleSshUser}@${sshTarget}`)}`,
+		hasIpFallback ? `   ${noteWarn$1("If a VPN blocks MagicDNS hostname lookup, use:")} ${noteCommand$1(`ssh -N -L ${params.port}:127.0.0.1:${params.port} ${params.tailscaleSshUser}@${tailscaleIpv4}`)}` : void 0,
+		`   ${noteInfo$1("Then open:")}`,
+		`   ${noteCommand$1(params.tunnelUrl)}`,
+		hasIpFallback ? `   ${noteWarn$1("Note: another VPN can break Tailscale MagicDNS while raw 100.x Tailscale IP access still works.")}` : void 0,
 		"",
-		"GATEWAY TOKEN BACKUP",
-		"   Only paste this if the browser asks for a token:",
-		`   ${params.gatewayToken || "(token not available)"}`
+		noteHeading$1("Gateway token backup"),
+		`   ${noteWarn$1("Only paste this if the browser asks for a token:")}`,
+		`   ${noteCommand$1(params.gatewayToken || "(token not available)")}`
 	].filter((line) => line !== void 0).join("\n");
 }
 function formatLocalDashboardReady(params) {
@@ -1670,11 +1697,12 @@ async function finalizeOnboardingWizard(options) {
 			}
 		}
 		if (strictVps) await prompter.note([
-			"Hosted runtime is private by default.",
+			noteHeading$1("Private access"),
+			noteInfo$1("Hosted runtime is private by default."),
 			"",
-			"Web dashboard: Tailscale HTTPS URL.",
-			"SSH terminal: ssh app@YOUR_VPS_TAILSCALE_NAME over Tailscale.",
-			"Public SSH and Gateway ports remain blocked."
+			`${noteLabel("Web dashboard:")} ${noteCommand$1("Tailscale HTTPS URL")}`,
+			`${noteLabel("SSH terminal:")} ${noteCommand$1("ssh app@YOUR_VPS_TAILSCALE_NAME")} ${noteInfo$1("over Tailscale")}`,
+			noteBullet$1(noteWarn$1("Public SSH and Gateway ports remain blocked."))
 		].join("\n"), "Hosting access");
 		if ((strictVps || expectedGatewayStartupMode === "managed-up") && !autoStartEnabled && !opts.allowInsecure) throw new Error(formatPersistentRuntimeServiceFailure({
 			strictVps,
@@ -2115,12 +2143,13 @@ async function finalizeOnboardingWizard(options) {
 				if (!warmup.ok) {
 					const detail = warmup.detail ?? "not reachable yet";
 					await prompter.note([
-						"The Tailscale HTTPS dashboard URL is still warming from this VPS.",
-						`Detail: ${detail}`,
+						noteHeading$1("Tailscale HTTPS"),
+						noteWarn$1("The Tailscale HTTPS dashboard URL is still warming from this VPS."),
+						`${noteMuted("Detail:")} ${noteInfo$1(detail)}`,
 						"",
-						"Setup will continue if the local Gateway listener is healthy.",
-						"Open the printed Tailscale URL from your own Tailscale-connected computer.",
-						"If another VPN breaks MagicDNS, turn it off or use the 100.x Tailscale IP fallback."
+						noteBullet$1(noteSuccess$1("Setup will continue if the local Gateway listener is healthy.")),
+						noteBullet$1(noteInfo$1("Open the printed Tailscale URL from your own Tailscale-connected computer.")),
+						noteBullet$1(noteWarn$1("If another VPN breaks MagicDNS, turn it off or use the 100.x Tailscale IP fallback."))
 					].join("\n"), "Dashboard warmup");
 					return;
 				}
@@ -2140,12 +2169,13 @@ async function finalizeOnboardingWizard(options) {
 					pollMs: 1500
 				});
 				if (!wsWarmup.ok) await prompter.note([
-					"The Tailscale dashboard page is reachable, but the browser Gateway connection is still warming.",
-					`Gateway URL: ${tailscaleGatewayWsUrl}`,
-					`Detail: ${"stage" in wsWarmup ? `${wsWarmup.stage}: ${wsWarmup.message}` : wsWarmup.detail ?? "websocket not reachable"}`,
+					noteHeading$1("Gateway connection"),
+					noteWarn$1("The Tailscale dashboard page is reachable, but the browser Gateway connection is still warming."),
+					`${noteLabel("Gateway URL:")} ${noteCommand$1(tailscaleGatewayWsUrl)}`,
+					`${noteMuted("Detail:")} ${noteInfo$1("stage" in wsWarmup ? `${wsWarmup.stage}: ${wsWarmup.message}` : wsWarmup.detail ?? "websocket not reachable")}`,
 					"",
-					"Setup will continue if the local Gateway listener is healthy.",
-					"Use the SSH tunnel fallback immediately, or open the Tailscale dashboard URL again shortly."
+					noteBullet$1(noteSuccess$1("Setup will continue if the local Gateway listener is healthy.")),
+					noteBullet$1(noteInfo$1("Use the SSH tunnel fallback immediately, or open the Tailscale dashboard URL again shortly."))
 				].join("\n"), "Dashboard warmup");
 				else hostedDashboardBrowserVerified = true;
 			});
@@ -2207,12 +2237,15 @@ async function finalizeOnboardingWizard(options) {
 	if (federation.enabled) {
 		let hostedFederationAutoConnectAttempted = false;
 		let hostedFederationAutoConnectReason = "";
+		const hostedFederationAutoConnectMessages = [];
 		if (strictVps && !readManagedFederationTokenSummary(onboardingEnv).exists) {
 			hostedFederationAutoConnectAttempted = true;
 			hostedFederationAutoConnectReason = (await runFederationAutoConnectOnce({
 				env: onboardingEnv,
 				log: {
-					info: (message) => runtime.log(message),
+					info: (message) => {
+						hostedFederationAutoConnectMessages.push(message);
+					},
 					warn: (message) => {
 						hostedFederationAutoConnectReason = message;
 					},
@@ -2231,12 +2264,13 @@ async function finalizeOnboardingWizard(options) {
 			reservations: readManagedReservationSummaries(onboardingEnv)
 		};
 		if (fedToken.exists && !persistedFederationToken) persistedFederationToken = await loadPersistedFederationToken(onboardingEnv).catch(() => null);
+		if (strictVps && hostedFederationAutoConnectAttempted && hostedFederationAutoConnectMessages.length > 0) await prompter.note(formatFasedNetworkAutoConnectSummary(hostedFederationAutoConnectMessages), "Fased Network");
 		if (strictVps && hostedFederationAutoConnectAttempted && !fedToken.exists) await prompter.note([
-			"Fased Network silent join did not finish.",
-			hostedFederationAutoConnectReason ? `Reason: ${hostedFederationAutoConnectReason}` : "Reason: token was not issued before final readiness.",
-			reservations.length > 0 ? `Reservation: ${reservations[0]?.slug}` : void 0,
-			"Dashboard and SSH are ready over Tailscale.",
-			"Inspect details: `fased managed up --json`"
+			noteWarn$1("Fased Network silent join did not finish."),
+			hostedFederationAutoConnectReason ? `${noteMuted("Reason:")} ${noteInfo$1(hostedFederationAutoConnectReason)}` : `${noteMuted("Reason:")} ${noteInfo$1("token was not issued before final readiness.")}`,
+			reservations.length > 0 ? `${noteMuted("Reservation:")} ${noteCommand$1(reservations[0]?.slug ?? "")}` : void 0,
+			noteSuccess$1("Dashboard and SSH are ready over Tailscale."),
+			`${noteMuted("Inspect details:")} ${noteCommand$1("fased managed up --json")}`
 		].filter(Boolean).join("\n"), "Fased Network");
 	}
 	const operatorReadiness = describeOperatorReadinessChecklist({
@@ -2282,16 +2316,17 @@ async function finalizeOnboardingWizard(options) {
 					detail: finalGateway.detail ?? "final gateway recheck timed out"
 				};
 				await prompter.note([
-					serviceActive ? "The hosted Gateway service is active, but the dashboard is still warming." : "The hosted browser dashboard passed its full check earlier.",
-					`Detail: ${finalGateway.detail ?? "gateway not reachable yet"}`,
+					noteHeading$1("Service active"),
+					serviceActive ? noteWarn$1("The hosted Gateway service is active, but the dashboard is still warming.") : noteInfo$1("The hosted browser dashboard passed its full check earlier."),
+					`${noteMuted("Detail:")} ${noteInfo$1(finalGateway.detail ?? "gateway not reachable yet")}`,
 					"",
-					"Setup will finish and leave the Gateway service running.",
-					"Open the printed Tailscale dashboard URL again in a few minutes.",
-					"If MagicDNS is slow or another VPN is active, use the 100.x Tailscale IP fallback.",
+					noteBullet$1(noteSuccess$1("Setup will finish and leave the Gateway service running.")),
+					noteBullet$1(noteInfo$1("Open the printed Tailscale dashboard URL again in a few minutes.")),
+					noteBullet$1(noteWarn$1("If MagicDNS is slow or another VPN is active, use the 100.x Tailscale IP fallback.")),
 					"",
-					"Check from the app terminal:",
-					"fased status",
-					"fased dashboard --no-open"
+					noteHeading$1("Check from the app terminal"),
+					noteCommand$1("fased status"),
+					noteCommand$1("fased dashboard --no-open")
 				].join("\n"), "Dashboard warmup");
 				return;
 			}
@@ -3251,9 +3286,9 @@ async function applyHostingSecurity(params) {
 			detail: "post-bootstrap hosted maintenance session; skipping host hardening bootstrap"
 		};
 		let tsAuthkey = opts.tsAuthkey?.trim() ?? "";
-		if (!tsAuthkey) if (await prompter.confirm({
-			message: "Use a Tailscale auth key instead of browser login? (advanced)",
-			initialValue: false
+		if (!tsAuthkey) if (!await prompter.confirm({
+			message: "Use browser login for Tailscale? (recommended)",
+			initialValue: true
 		})) tsAuthkey = (typeof prompter.secret === "function" ? await prompter.secret({
 			message: "Paste Tailscale auth key (tskey-auth-...)",
 			validate: (value) => value.trim() ? void 0 : "Required"
@@ -3426,9 +3461,9 @@ async function applyHostingSecurity(params) {
 	if (!tsHealthy) {
 		let tsAuthkey = opts.tsAuthkey?.trim() ?? "";
 		if (!tsAuthkey && opts.nonInteractive !== true && prompter) {
-			if (await prompter.confirm({
-				message: "Use a Tailscale auth key instead of browser login? (advanced)",
-				initialValue: false
+			if (!await prompter.confirm({
+				message: "Use browser login for Tailscale? (recommended)",
+				initialValue: true
 			})) tsAuthkey = (typeof prompter.secret === "function" ? await prompter.secret({
 				message: "Paste Tailscale auth key (tskey-auth-...)",
 				validate: (value) => value.trim() ? void 0 : "Required"
@@ -5187,9 +5222,11 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 	};
 	if (hostSecurity.profile === "hosting" && hostSecurity.checks.length > 0) {
 		const lines = [
-			"Hosting security checklist:",
-			...hostSecurity.checks.map((check) => `${check.ok ? "✓" : "✗"} ${check.name}: ${check.detail}`),
-			hostSecurity.logPath ? `Detailed host hardening log: ${hostSecurity.logPath}` : void 0
+			theme.heading("HOSTING SECURITY CHECKLIST"),
+			"",
+			...hostSecurity.checks.map((check) => `${check.ok ? theme.success("✓") : theme.error("✗")} ${theme.accentBright(check.name)}: ${check.ok ? theme.info(check.detail) : theme.error(check.detail)}`),
+			"",
+			hostSecurity.logPath ? `${theme.muted("Detailed host hardening log:")} ${theme.command(hostSecurity.logPath)}` : void 0
 		];
 		await prompter.note(lines.filter(Boolean).join("\n"), "Host security");
 	}