@fased/fased 0.1.17 → 0.1.19

package/dist/{onboard-CTW2Nw9r.js → onboard-lbl9C2gj.js}

@@ -1,6 +1,6 @@
 import { Ba as normalizeOptionalSecretInput, Cu as formatCliCommand, Ii as resolveApiKeyForProfile, Ji as resolveDefaultSecretProviderAlias, Oa as loadPluginManifestRegistry, Pr as normalizeProviderId, Qt as readConfigFileSnapshot, Va as normalizeSecretInput, _n as parseDurationMs, di as resolveEnvApiKey, fa as upsertAuthProfile, ka as assertSupportedRuntime, ki as resolveAuthProfileOrder, ma as ensureAuthProfileStore, tn as writeConfigFile } from "./env-C77feXxI.js";
 import { x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
-import { A as waitForGatewayReachable, E as resolveControlUiLinks, T as randomToken, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, h as ensureWorkspaceAndSessions, s as resolvePluginProviders, v as handleOnboardingRepair } from "./model-catalog-B3hPEPfU.js";
+import { A as waitForGatewayReachable, E as resolveControlUiLinks, T as randomToken, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, h as ensureWorkspaceAndSessions, s as resolvePluginProviders, v as handleOnboardingRepair } from "./model-catalog-DHRVUWBf.js";
 import { A as defaultRuntime, gt as resolveGatewayPort, j as restoreTerminalState } from "./entry.js";
 import { a as readWalletProviderRegistry, f as setWalletProvidersEnabled, t as WALLET_PROVIDER_IDS } from "./wallet-provider-registry-CFNtQ2ZR.js";
 import { or as clearDeviceAuthStore } from "./call-B9EvxMq6.js";
@@ -8,15 +8,15 @@ import { r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from
 import { a as resolveHostedOnboardingGatewayStartupMode, n as gatewayInstallErrorHint, t as buildGatewayInstallPlan } from "./daemon-install-helpers-BB0qUcut.js";
 import { r as isSystemdUserServiceAvailable } from "./systemd-B8OPQXFR.js";
 import { t as resolveGatewayService } from "./service-2JBjv-ge.js";
-import { d as resolveCustomProviderId, l as parseNonInteractiveCustomApiFlags, o as CustomApiError, s as applyCustomApiConfig } from "./ipv4-DT7rmgG8.js";
-import { i as healthCommand } from "./health-CdW7K4YP.js";
-import { $ as applyLitellmConfig, At as validateAnthropicSetupToken, B as applyMistralConfig, Ct as setXaiApiKey, Dt as MINIMAX_HIGHSPEED_MODEL_ID, Et as MINIMAX_DEFAULT_MODEL_ID, F as applyMinimaxApiConfig, Ft as resolveManifestProviderAuthChoice, G as applyQwenCodingPlanConfig, H as applyMoonshotConfigCn, I as applyMinimaxApiConfigCn, J as applyTogetherConfig, K as applyQwenConfig, L as applyAuthProfileConfig$1, M as detectZaiEndpoint, Mt as normalizeSecretInputModeInput, N as applyGoogleGeminiModelDefault, P as applyOpencodeZenConfig, Pt as resolveManifestDeprecatedProviderAuthChoice, Q as applyZaiConfig, R as applyHuggingfaceConfig, St as setVolcengineApiKey, Tt as setZaiApiKey, U as applyOpenrouterConfig, V as applyMoonshotConfig, W as applyQianfanConfig, X as applyXaiConfig, Y as applyVeniceConfig, Z as applyXiaomiConfig, _t as setQwenCodingPlanApiKey, at as setGeminiApiKey, bt as setVeniceApiKey, c as applyDefaultModel, ct as setLitellmApiKey, d as resolveProviderMatch, dt as setMoonshotApiKey, et as applyCloudflareAiGatewayConfig, ft as setOpenaiApiKey, gt as setQwenApiKey, ht as setQianfanApiKey, i as applyOpenAIConfig, it as setCloudflareAiGatewayConfig, kt as buildTokenProfileId, l as mergeConfigPatch, lt as setMinimaxApiKey, m as applyPrimaryModel, mt as setOpenrouterApiKey, nt as setAnthropicApiKey, o as applyAuthProfileConfig, ot as setHuggingfaceApiKey, pt as setOpencodeZenApiKey, q as applySyntheticConfig, rt as setByteplusApiKey, s as buildApiKeyCredential, st as setKimiCodingApiKey, tt as applyVercelAiGatewayConfig, u as pickAuthMethod, ut as setMistralApiKey, vt as setSyntheticApiKey, wt as setXiaomiApiKey, xt as setVercelAiGatewayApiKey, yt as setTogetherApiKey, z as applyKimiCodeConfig } from "./auth-choice-CN9gyA5O.js";
-import { a as normalizeLegacyOnboardAuthChoice, i as isDeprecatedAuthChoice, r as resolveOnboardProviderAuthFlags } from "./auth-choice-prompt-DvnUYnyW.js";
+import { d as resolveCustomProviderId, l as parseNonInteractiveCustomApiFlags, o as CustomApiError, s as applyCustomApiConfig } from "./ipv4-BKbsAV5a.js";
+import { i as healthCommand } from "./health-CD-e8iEW.js";
+import { $ as applyLitellmConfig, At as validateAnthropicSetupToken, B as applyMistralConfig, Ct as setXaiApiKey, Dt as MINIMAX_HIGHSPEED_MODEL_ID, Et as MINIMAX_DEFAULT_MODEL_ID, F as applyMinimaxApiConfig, Ft as resolveManifestProviderAuthChoice, G as applyQwenCodingPlanConfig, H as applyMoonshotConfigCn, I as applyMinimaxApiConfigCn, J as applyTogetherConfig, K as applyQwenConfig, L as applyAuthProfileConfig$1, M as detectZaiEndpoint, Mt as normalizeSecretInputModeInput, N as applyGoogleGeminiModelDefault, P as applyOpencodeZenConfig, Pt as resolveManifestDeprecatedProviderAuthChoice, Q as applyZaiConfig, R as applyHuggingfaceConfig, St as setVolcengineApiKey, Tt as setZaiApiKey, U as applyOpenrouterConfig, V as applyMoonshotConfig, W as applyQianfanConfig, X as applyXaiConfig, Y as applyVeniceConfig, Z as applyXiaomiConfig, _t as setQwenCodingPlanApiKey, at as setGeminiApiKey, bt as setVeniceApiKey, c as applyDefaultModel, ct as setLitellmApiKey, d as resolveProviderMatch, dt as setMoonshotApiKey, et as applyCloudflareAiGatewayConfig, ft as setOpenaiApiKey, gt as setQwenApiKey, ht as setQianfanApiKey, i as applyOpenAIConfig, it as setCloudflareAiGatewayConfig, kt as buildTokenProfileId, l as mergeConfigPatch, lt as setMinimaxApiKey, m as applyPrimaryModel, mt as setOpenrouterApiKey, nt as setAnthropicApiKey, o as applyAuthProfileConfig, ot as setHuggingfaceApiKey, pt as setOpencodeZenApiKey, q as applySyntheticConfig, rt as setByteplusApiKey, s as buildApiKeyCredential, st as setKimiCodingApiKey, tt as applyVercelAiGatewayConfig, u as pickAuthMethod, ut as setMistralApiKey, vt as setSyntheticApiKey, wt as setXiaomiApiKey, xt as setVercelAiGatewayApiKey, yt as setTogetherApiKey, z as applyKimiCodeConfig } from "./auth-choice-CRcRJvDg.js";
+import { a as normalizeLegacyOnboardAuthChoice, i as isDeprecatedAuthChoice, r as resolveOnboardProviderAuthFlags } from "./auth-choice-prompt-CHAO6E_x.js";
 import { n as logConfigUpdated } from "./logging-DZ32I_SP.js";
-import { a as applyRecommendedInternalHooks, i as isHostedSecurityCapableSession, n as applyHostingSecurity, o as applyOnboardingLocalWorkspaceConfig, r as configureFederationForOnboarding, t as runOnboardingWizard } from "./onboarding-DeTMPDGg.js";
+import { a as applyRecommendedInternalHooks, i as isHostedSecurityCapableSession, n as applyHostingSecurity, o as applyOnboardingLocalWorkspaceConfig, r as configureFederationForOnboarding, t as runOnboardingWizard } from "./onboarding-C8AUR3x1.js";
 import { t as WizardCancelledError } from "./prompts-DdS4bZNt.js";
-import { t as createClackPrompter } from "./clack-prompter-D2fuSvy3.js";
-import { n as ensureSystemdUserLingerNonInteractive } from "./systemd-linger-BYFLOJbt.js";
+import { t as createClackPrompter } from "./clack-prompter-DhFjwbXA.js";
+import { n as ensureSystemdUserLingerNonInteractive } from "./systemd-linger-BlmGMvvA.js";
 import { t as formatHealthCheckFailure } from "./health-format-DEsFwYbP.js";
 
 //#region src/commands/onboard-interactive.ts

package/dist/{onboard-search-L1prKL6U.js → onboard-search-C6A1sfph.js}

@@ -2,7 +2,7 @@ import { $c as installPluginFromNpmSpec, Wa as coerceSecretRef, pd as resolveFas
 import { i as CONFIG_DIR, p as isRecord, x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
 import "./send-D7X0_iFp.js";
 import "./send-BFEd4vCM.js";
-import "./model-catalog-B3hPEPfU.js";
+import "./model-catalog-DHRVUWBf.js";
 import "./github-copilot-token-A9DiaCB0.js";
 import "./reply-prefix-TUhpEtvr.js";
 import "./memory-2keYbXkc.js";
@@ -44,7 +44,7 @@ import "./send-C-su1wPZ.js";
 import "./outbound-attachment-Bh4FmcYg.js";
 import "./fetch-BVvWzHT_.js";
 import "./delivery-queue-55Cityuq.js";
-import "./deps-fM7SZdlB.js";
+import "./deps-BoCGz3bU.js";
 import "./frontmatter-D2UNJikU.js";
 import "./skills-Dis31awJ.js";
 import "./skills-remote-CIAB0AXm.js";
@@ -71,14 +71,14 @@ import "./cli-utils-XevKf-tr.js";
 import "./help-format-B2DRdx98.js";
 import "./progress-DkVYFLij.js";
 import "./replies-FXlmpJVO.js";
-import "./prompt-style-DxKPs6E0.js";
+import "./prompt-style-Rmj3c-Ir.js";
 import "./pairing-labels-BCM1S2e_.js";
 import { t as enablePluginInConfig } from "./enable-C4xB2A3x.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-Cha8QIzO.js";
-import "./status-CZGCfZGF.js";
+import "./status-DhGsqqOx.js";
 import "./update-D4rhRm3D.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-B9_sK7Lg.js";
-import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-CNjTAhI3.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-DE4kux0k.js";
+import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-BC_EmT37.js";
 import path from "node:path";
 import fs from "node:fs";
 

package/dist/{onboard-search-1iOn9oPJ.js → onboard-search-D-tM9Xrg.js}

@@ -2,7 +2,7 @@ import "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, i as CONFIG_DIR, m as isRecord } from "./agent-paths-DmOVZE7g.js";
 import { Co as coerceSecretRef, mo as resolveFasedAgentPackageRootSync, wl as installPluginFromNpmSpec } from "./agent-scope-DHrLr5OF.js";
 import "./commands-registry-BRvZQ1jh.js";
-import "./reply-jd1xrxXq.js";
+import "./reply-BRoR6TOO.js";
 import "./errors-Dx3S3Nrp.js";
 import "./send-C5_fB8YQ.js";
 import "./send-jxmRy65D.js";
@@ -37,7 +37,7 @@ import "./ssrf-Blf4NrHS.js";
 import "./outbound-attachment-CsXJwFsg.js";
 import "./fetch-CnCPOuq7.js";
 import "./delivery-queue-DKRjVFlq.js";
-import "./deps-BVX6nj7c.js";
+import "./deps-vuWHR8ix.js";
 import "./memory-DDpj0IVA.js";
 import "./memory-search-BwYkW6_V.js";
 import "./manager-BmONwMiP.js";
@@ -74,14 +74,14 @@ import "./progress-DZRfIFVb.js";
 import "./replies-Do40G8fO.js";
 import "./skills-remote-BghdrdFV.js";
 import "./skill-commands-QW8zKXC_.js";
-import "./prompt-style-Wxki8rmI.js";
+import "./prompt-style-CWAacuMq.js";
 import "./pairing-labels-D2yOKhoV.js";
 import { t as enablePluginInConfig } from "./enable-D3_YPNIT.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-DDbnXe4x.js";
-import "./status-BMkqIbDJ.js";
+import "./status-Cf-x3WJB.js";
 import "./update-Dew6hqdf.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-BR79mC_A.js";
-import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-i1RoCwml.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-DKOezW7h.js";
+import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-B09rLDoa.js";
 import fs from "node:fs";
 import path from "node:path";
 

package/dist/{onboarding-DiEiT_LB.js → onboarding-Bejkgd8a.js}

@@ -1,7 +1,7 @@
 import { _ as resolveStateDir, u as resolveGatewayPort } from "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, U as theme } from "./agent-paths-DmOVZE7g.js";
 import { Ga as ensureAuthProfileStore, Mn as writeConfigFile, Zr as collectConfigServiceEnvVars, d as resolveDefaultAgentId, dd as formatCliCommand, fr as ensureActiveMemoryPluginAllowlisted, kn as readConfigFileSnapshot, u as resolveAgentWorkspaceDir } from "./agent-scope-DHrLr5OF.js";
-import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-jd1xrxXq.js";
+import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-BRoR6TOO.js";
 import { d as defaultRuntime, f as restoreTerminalState, s as redactSensitiveText } from "./errors-Dx3S3Nrp.js";
 import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-CQG8MiG_.js";
 import { i as resolveLocalSignerRunAsUser, n as resolveLocalSignerBackendSocketPath, o as resolveLocalSignerSocketPath, r as resolveLocalSignerMaterialRootDir, t as ensureWalletStateDir } from "./wallet-runtime-config-BlRWvEER.js";
@@ -17,14 +17,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-CmxDYXvt.js";
 import { t as resolveGatewayService } from "./service-Bsg622jp.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-BRLbvcxT.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-6svR7SNz.js";
-import { o as waitForHostedDashboardBrowserPath } from "./health-Bn6vWkyn.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-wNIst3YG.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-Dsfpbz6G.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-Bxa3Ql2B.js";
+import { o as waitForHostedDashboardBrowserPath } from "./health-c7sJIXY9.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DCd_rmJr.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-BBY8vO5H.js";
 import { n as logConfigUpdated } from "./logging-Dv2wthF_.js";
-import { n as setupChannels } from "./onboard-channels-DKCvEt36.js";
+import { n as setupChannels } from "./onboard-channels-BREKCcFf.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-BielXMUB.js";
-import { t as runTui } from "./tui-D_G4_9GB.js";
+import { t as runTui } from "./tui-CIzUfHHB.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -1358,7 +1358,7 @@ async function finalizeOnboardingWizard(options) {
 	const systemdAvailable = process.platform === "linux" ? await isSystemdUserServiceAvailable() : true;
 	if (process.platform === "linux" && !systemdAvailable && !strictVps && flow !== "quickstart") await prompter.note("Systemd user services are unavailable. Skipping lingering checks and user-service install.", "Systemd");
 	if (process.platform === "linux" && systemdAvailable && strictVps) {} else if (process.platform === "linux" && systemdAvailable) {
-		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-9E60sw1j.js").then((n) => n.r);
+		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-BTw_D-6k.js").then((n) => n.r);
 		await ensureSystemdUserLingerInteractive({
 			runtime,
 			prompter: {
@@ -2463,7 +2463,7 @@ async function finalizeOnboardingWizard(options) {
 			fallbackHint: !strictVps ? controlUiOpenHint : void 0
 		}), "Dashboard ready");
 	}
-	await prompter.outro(strictVps ? "Setup complete. Use HOSTED ACCESS above: Web UI, SSH, or fallback tunnel." : controlUiOpened ? "Setup complete. Next: Agent > Models, then Chat." : "Setup complete. Use the dashboard link above, then use Agent > Models and Chat.");
+	if (!strictVps) await prompter.outro(controlUiOpened ? "Setup complete. Next: Agent > Models, then Chat." : "Setup complete. Use the dashboard link above, then use Agent > Models and Chat.");
 	return { launchedTui };
 }
 
@@ -2747,6 +2747,7 @@ const LOW_MEMORY_SWAP_THRESHOLD_MB = 2304;
 const LOW_MEMORY_HOSTING_SWAP_GB = 4;
 const HOSTING_SWAP_GB = 2;
 const TAILSCALE_INTERACTIVE_TIMEOUT_MS = 120 * 1e3;
+const TAILSCALE_LOGIN_URL_RE = /https:\/\/login\.tailscale\.com\/a\/[A-Za-z0-9_-]+/i;
 function detectTotalMemoryMb() {
 	if (process.platform === "linux") try {
 		const match = fs.readFileSync("/proc/meminfo", "utf8").match(/^MemTotal:\s+(\d+)\s+kB/m);
@@ -2779,29 +2780,67 @@ function run(command, logPath) {
 		detail: detail || `${command} (exit=${proc.status ?? "unknown"})`
 	};
 }
-function runInteractive(command, logPath, options) {
-	if (logPath) appendHostSecurityLog(logPath, command, "interactive command started; output shown in terminal");
-	const proc = spawnSync("bash", ["-lc", command], {
-		stdio: [
+async function runInteractive(command, logPath, options) {
+	if (logPath) appendHostSecurityLog(logPath, command, "interactive command started; output captured for framed wizard display");
+	return await new Promise((resolve) => {
+		const proc = spawn("bash", ["-lc", command], { stdio: [
 			"ignore",
-			"inherit",
-			"inherit"
-		],
-		timeout: options?.timeoutMs,
-		killSignal: "SIGINT"
+			"pipe",
+			"pipe"
+		] });
+		let output = "";
+		let loginUrlShown = false;
+		let timedOut = false;
+		let noteQueue = Promise.resolve();
+		const timer = options?.timeoutMs && options.timeoutMs > 0 ? setTimeout(() => {
+			timedOut = true;
+			proc.kill("SIGINT");
+		}, options.timeoutMs) : null;
+		const maybeShowLoginUrl = (chunk) => {
+			output += chunk;
+			if (loginUrlShown) return;
+			const loginUrl = output.match(TAILSCALE_LOGIN_URL_RE)?.[0];
+			if (!loginUrl) return;
+			loginUrlShown = true;
+			if (options?.prompter) {
+				const message = [
+					noteHeading("Open login URL"),
+					"Open this URL in your local browser:",
+					...noteCommands([loginUrl]),
+					"Return here after approving this VPS."
+				].join("\n");
+				noteQueue = noteQueue.then(() => options.prompter?.note(message, options.noteTitle ?? "Tailscale login URL"));
+			}
+		};
+		proc.stdout?.on("data", (chunk) => {
+			maybeShowLoginUrl(String(chunk));
+		});
+		proc.stderr?.on("data", (chunk) => {
+			maybeShowLoginUrl(String(chunk));
+		});
+		proc.on("error", (error) => {
+			output += `\n${error instanceof Error ? error.message : String(error)}`;
+		});
+		proc.on("close", (code) => {
+			if (timer) clearTimeout(timer);
+			const detail = timedOut ? `${command} timed out after ${Math.round((options?.timeoutMs ?? 0) / 1e3)}s\n${output}`.trim() : `${command} (exit=${code ?? "unknown"})\n${output}`.trim();
+			if (logPath) appendHostSecurityLog(logPath, command, detail);
+			noteQueue.then(() => {
+				if (code === 0) {
+					resolve({
+						ok: true,
+						detail
+					});
+					return;
+				}
+				resolve({
+					ok: false,
+					detail,
+					timedOut
+				});
+			});
+		});
 	});
-	const timedOut = proc.error?.code === "ETIMEDOUT";
-	const detail = timedOut ? `${command} timed out after ${Math.round((options?.timeoutMs ?? 0) / 1e3)}s` : `${command} (exit=${proc.status ?? "unknown"})`;
-	if (logPath) appendHostSecurityLog(logPath, command, detail);
-	if (proc.status === 0) return {
-		ok: true,
-		detail
-	};
-	return {
-		ok: false,
-		detail,
-		timedOut
-	};
 }
 function buildTailscaleLoginWaitCommand(command) {
 	return [
@@ -2828,9 +2867,13 @@ function buildTailscaleLoginWaitCommand(command) {
 		"exit 124"
 	].join("\n");
 }
-function runInteractiveTailscaleLogin(command, logPath) {
-	if (logPath) appendHostSecurityLog(logPath, command, "interactive Tailscale login started; output shown in terminal");
-	const result = runInteractive(buildTailscaleLoginWaitCommand(command), void 0, { timeoutMs: TAILSCALE_INTERACTIVE_TIMEOUT_MS });
+async function runInteractiveTailscaleLogin(command, logPath, prompter) {
+	if (logPath) appendHostSecurityLog(logPath, command, "interactive Tailscale login started; login URL shown in framed wizard note");
+	const result = await runInteractive(buildTailscaleLoginWaitCommand(command), void 0, {
+		timeoutMs: TAILSCALE_INTERACTIVE_TIMEOUT_MS,
+		prompter,
+		noteTitle: "Tailscale login URL"
+	});
 	if (logPath) appendHostSecurityLog(logPath, "tailscale login result", result.ok ? "tailnet IP appeared or tailscale up completed" : result.detail ?? "tailscale login failed");
 	if (result.ok) return {
 		ok: true,
@@ -3089,7 +3132,7 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				return false;
 			}
 			await prompter.note(formatTailscaleAccountBrowserLoginNote(), "Tailscale login");
-			const tsReset = interactiveRunner("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath);
+			const tsReset = await interactiveRunner("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
 			const acceptedTimedOutLogin = tailscaleTimedOutButReady(tsReset, logPath, runner);
 			if (!tsReset.ok && !acceptedTimedOutLogin || !hasTailscaleIp(logPath, runner)) {
 				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
@@ -3246,7 +3289,7 @@ function automaticUpdatesCommand() {
 		"  sudo -n systemctl enable --now apt-daily.timer apt-daily-upgrade.timer",
 		"elif command -v dnf >/dev/null 2>&1 || command -v dnf5 >/dev/null 2>&1; then",
 		"  (" + packageInstallCommand(["dnf5-plugin-automatic"]) + ") || (" + packageInstallCommand(["dnf-automatic"]) + ")",
-		"  sudo -n sed -i 's/^apply_updates[[:space:]]*=.*/apply_updates = yes/' /etc/dnf/automatic.conf >/dev/null 2>&1 || true",
+		"  sudo -n /usr/local/sbin/fased-host-maintenance enable-dnf-automatic >/dev/null 2>&1 || sudo -n sed -i 's/^apply_updates[[:space:]]*=.*/apply_updates = yes/' /etc/dnf/automatic.conf >/dev/null 2>&1 || true",
 		"  sudo -n systemctl enable --now dnf5-automatic.timer >/dev/null 2>&1 || sudo -n systemctl enable --now dnf-automatic.timer",
 		"elif command -v yum >/dev/null 2>&1; then",
 		"  (" + packageInstallCommand(["dnf-automatic"]) + ") || (" + packageInstallCommand(["yum-cron"]) + ")",
@@ -3257,6 +3300,17 @@ function automaticUpdatesCommand() {
 		"fi"
 	].join("\n");
 }
+function sshHardeningCommand() {
+	return [
+		"if sudo -n /usr/local/sbin/fased-host-maintenance harden-ssh >/dev/null 2>&1; then",
+		"  :",
+		"else",
+		"  sudo -n sed -i 's/^#\\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config",
+		"  sudo -n sed -i 's/^#\\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config",
+		"  sudo -n systemctl restart ssh || sudo -n systemctl restart sshd",
+		"fi"
+	].join("\n");
+}
 function failOrContinue(params) {
 	const { opts, runtime, step, detail } = params;
 	const body = detail ? `${step}: ${detail}` : step;
@@ -3302,7 +3356,7 @@ async function applyHostingSecurity(params) {
 		})).trim();
 		else await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
 		const resetCommand = tsAuthkey ? `sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset --authkey ${JSON.stringify(tsAuthkey)}` : "sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset";
-		const tsReset = tsAuthkey ? run(resetCommand, logPath) : runInteractiveTailscaleLogin(resetCommand, logPath);
+		const tsReset = tsAuthkey ? run(resetCommand, logPath) : await runInteractiveTailscaleLogin(resetCommand, logPath, prompter);
 		if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) return {
 			ok: false,
 			detail: tsReset.detail ?? "tailscale account switch failed"
@@ -3434,7 +3488,7 @@ async function applyHostingSecurity(params) {
 			initialValue: false
 		})) {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsReset = runInteractiveTailscaleLogin("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath);
+			const tsReset = await runInteractiveTailscaleLogin("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
 			if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3521,7 +3575,7 @@ async function applyHostingSecurity(params) {
 			};
 		} else {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsUp = runInteractiveTailscaleLogin("sudo -n tailscale up --ssh", logPath);
+			const tsUp = await runInteractiveTailscaleLogin("sudo -n tailscale up --ssh", logPath, prompter);
 			if (!tsUp.ok && !tailscaleTimedOutButReady(tsUp, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3648,7 +3702,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "default-deny public ingress with tailnet SSH/HTTPS access"
 	});
-	const sshRes = run("sudo -n sed -i 's/^#\\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config; sudo -n sed -i 's/^#\\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config; sudo -n systemctl restart ssh || sudo -n systemctl restart sshd", logPath);
+	const sshRes = run(sshHardeningCommand(), logPath);
 	if (!sshRes.ok) {
 		checks.push({
 			name: "ssh",
@@ -3723,7 +3777,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "automatic security updates enabled"
 	});
-	runtime.log("Hosting host hardening complete.");
+	appendHostSecurityLog(logPath, "hosting host hardening complete", "enforced");
 	return {
 		profile,
 		checks,
@@ -4215,7 +4269,6 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		await installPrivateGoForOnboarding();
 	};
 	printWizardHeader(runtime);
-	await prompter.intro("FASED Setup");
 	await requireRiskAcknowledgement({
 		opts,
 		prompter

package/dist/{onboarding-DeTMPDGg.js → onboarding-C8AUR3x1.js}

@@ -1,6 +1,6 @@
 import { Cu as formatCliCommand, Fn as ensureActiveMemoryPluginAllowlisted, Gu as resolveDefaultAgentId, Qt as readConfigFileSnapshot, Wu as resolveAgentWorkspaceDir, br as collectConfigServiceEnvVars, ma as ensureAuthProfileStore, tn as writeConfigFile } from "./env-C77feXxI.js";
 import { H as theme, x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
-import { A as waitForGatewayReachable, C as printWizardHeader, E as resolveControlUiLinks, Ha as CONTROL_UI_BOOT_CHECK_PATH, O as summarizeExistingConfig, S as openUrl, T as randomToken, Wa as normalizeControlUiBasePath, bo as enableTailscaleServe, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, g as formatControlUiSshHint, h as ensureWorkspaceAndSessions, k as validateGatewayPasswordInput, m as detectBrowserOpenSupport, to as runFederationAutoConnectOnce, v as handleOnboardingRepair, w as probeGatewayReachable, x as normalizeGatewayTokenInput, xo as findTailscaleBinary, yo as enableTailscaleFunnel } from "./model-catalog-B3hPEPfU.js";
+import { A as waitForGatewayReachable, C as printWizardHeader, E as resolveControlUiLinks, Ha as CONTROL_UI_BOOT_CHECK_PATH, O as summarizeExistingConfig, S as openUrl, T as randomToken, Wa as normalizeControlUiBasePath, bo as enableTailscaleServe, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, g as formatControlUiSshHint, h as ensureWorkspaceAndSessions, k as validateGatewayPasswordInput, m as detectBrowserOpenSupport, to as runFederationAutoConnectOnce, v as handleOnboardingRepair, w as probeGatewayReachable, x as normalizeGatewayTokenInput, xo as findTailscaleBinary, yo as enableTailscaleFunnel } from "./model-catalog-DHRVUWBf.js";
 import { A as defaultRuntime, Ct as resolveStateDir, E as redactSensitiveText, gt as resolveGatewayPort, j as restoreTerminalState } from "./entry.js";
 import { n as redactSensitiveUrlLikeString } from "./redact-sensitive-url-BW03TVj8.js";
 import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet--7Yu2hFw.js";
@@ -16,14 +16,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-B8OPQXFR.js";
 import { t as resolveGatewayService } from "./service-2JBjv-ge.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-COK5O0cM.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-DT7rmgG8.js";
-import { s as waitForHostedDashboardBrowserPath } from "./health-CdW7K4YP.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-CN9gyA5O.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-DvnUYnyW.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-BKbsAV5a.js";
+import { s as waitForHostedDashboardBrowserPath } from "./health-CD-e8iEW.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-CRcRJvDg.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-CHAO6E_x.js";
 import { n as logConfigUpdated } from "./logging-DZ32I_SP.js";
-import { n as setupChannels } from "./onboard-channels-EXJRjGSu.js";
+import { n as setupChannels } from "./onboard-channels-fJXaj04M.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-DRZciWMZ.js";
-import { t as runTui } from "./tui-El8PxPJw.js";
+import { t as runTui } from "./tui-Cvc1YA_t.js";
 import { spawn, spawnSync } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
@@ -1357,7 +1357,7 @@ async function finalizeOnboardingWizard(options) {
 	const systemdAvailable = process.platform === "linux" ? await isSystemdUserServiceAvailable() : true;
 	if (process.platform === "linux" && !systemdAvailable && !strictVps && flow !== "quickstart") await prompter.note("Systemd user services are unavailable. Skipping lingering checks and user-service install.", "Systemd");
 	if (process.platform === "linux" && systemdAvailable && strictVps) {} else if (process.platform === "linux" && systemdAvailable) {
-		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-BYFLOJbt.js").then((n) => n.r);
+		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-BlmGMvvA.js").then((n) => n.r);
 		await ensureSystemdUserLingerInteractive({
 			runtime,
 			prompter: {
@@ -2462,7 +2462,7 @@ async function finalizeOnboardingWizard(options) {
 			fallbackHint: !strictVps ? controlUiOpenHint : void 0
 		}), "Dashboard ready");
 	}
-	await prompter.outro(strictVps ? "Setup complete. Use HOSTED ACCESS above: Web UI, SSH, or fallback tunnel." : controlUiOpened ? "Setup complete. Next: Agent > Models, then Chat." : "Setup complete. Use the dashboard link above, then use Agent > Models and Chat.");
+	if (!strictVps) await prompter.outro(controlUiOpened ? "Setup complete. Next: Agent > Models, then Chat." : "Setup complete. Use the dashboard link above, then use Agent > Models and Chat.");
 	return { launchedTui };
 }
 
@@ -2746,6 +2746,7 @@ const LOW_MEMORY_SWAP_THRESHOLD_MB = 2304;
 const LOW_MEMORY_HOSTING_SWAP_GB = 4;
 const HOSTING_SWAP_GB = 2;
 const TAILSCALE_INTERACTIVE_TIMEOUT_MS = 120 * 1e3;
+const TAILSCALE_LOGIN_URL_RE = /https:\/\/login\.tailscale\.com\/a\/[A-Za-z0-9_-]+/i;
 function detectTotalMemoryMb() {
 	if (process.platform === "linux") try {
 		const match = fs.readFileSync("/proc/meminfo", "utf8").match(/^MemTotal:\s+(\d+)\s+kB/m);
@@ -2778,29 +2779,67 @@ function run(command, logPath) {
 		detail: detail || `${command} (exit=${proc.status ?? "unknown"})`
 	};
 }
-function runInteractive(command, logPath, options) {
-	if (logPath) appendHostSecurityLog(logPath, command, "interactive command started; output shown in terminal");
-	const proc = spawnSync("bash", ["-lc", command], {
-		stdio: [
+async function runInteractive(command, logPath, options) {
+	if (logPath) appendHostSecurityLog(logPath, command, "interactive command started; output captured for framed wizard display");
+	return await new Promise((resolve) => {
+		const proc = spawn("bash", ["-lc", command], { stdio: [
 			"ignore",
-			"inherit",
-			"inherit"
-		],
-		timeout: options?.timeoutMs,
-		killSignal: "SIGINT"
+			"pipe",
+			"pipe"
+		] });
+		let output = "";
+		let loginUrlShown = false;
+		let timedOut = false;
+		let noteQueue = Promise.resolve();
+		const timer = options?.timeoutMs && options.timeoutMs > 0 ? setTimeout(() => {
+			timedOut = true;
+			proc.kill("SIGINT");
+		}, options.timeoutMs) : null;
+		const maybeShowLoginUrl = (chunk) => {
+			output += chunk;
+			if (loginUrlShown) return;
+			const loginUrl = output.match(TAILSCALE_LOGIN_URL_RE)?.[0];
+			if (!loginUrl) return;
+			loginUrlShown = true;
+			if (options?.prompter) {
+				const message = [
+					noteHeading("Open login URL"),
+					"Open this URL in your local browser:",
+					...noteCommands([loginUrl]),
+					"Return here after approving this VPS."
+				].join("\n");
+				noteQueue = noteQueue.then(() => options.prompter?.note(message, options.noteTitle ?? "Tailscale login URL"));
+			}
+		};
+		proc.stdout?.on("data", (chunk) => {
+			maybeShowLoginUrl(String(chunk));
+		});
+		proc.stderr?.on("data", (chunk) => {
+			maybeShowLoginUrl(String(chunk));
+		});
+		proc.on("error", (error) => {
+			output += `\n${error instanceof Error ? error.message : String(error)}`;
+		});
+		proc.on("close", (code) => {
+			if (timer) clearTimeout(timer);
+			const detail = timedOut ? `${command} timed out after ${Math.round((options?.timeoutMs ?? 0) / 1e3)}s\n${output}`.trim() : `${command} (exit=${code ?? "unknown"})\n${output}`.trim();
+			if (logPath) appendHostSecurityLog(logPath, command, detail);
+			noteQueue.then(() => {
+				if (code === 0) {
+					resolve({
+						ok: true,
+						detail
+					});
+					return;
+				}
+				resolve({
+					ok: false,
+					detail,
+					timedOut
+				});
+			});
+		});
 	});
-	const timedOut = proc.error?.code === "ETIMEDOUT";
-	const detail = timedOut ? `${command} timed out after ${Math.round((options?.timeoutMs ?? 0) / 1e3)}s` : `${command} (exit=${proc.status ?? "unknown"})`;
-	if (logPath) appendHostSecurityLog(logPath, command, detail);
-	if (proc.status === 0) return {
-		ok: true,
-		detail
-	};
-	return {
-		ok: false,
-		detail,
-		timedOut
-	};
 }
 function buildTailscaleLoginWaitCommand(command) {
 	return [
@@ -2827,9 +2866,13 @@ function buildTailscaleLoginWaitCommand(command) {
 		"exit 124"
 	].join("\n");
 }
-function runInteractiveTailscaleLogin(command, logPath) {
-	if (logPath) appendHostSecurityLog(logPath, command, "interactive Tailscale login started; output shown in terminal");
-	const result = runInteractive(buildTailscaleLoginWaitCommand(command), void 0, { timeoutMs: TAILSCALE_INTERACTIVE_TIMEOUT_MS });
+async function runInteractiveTailscaleLogin(command, logPath, prompter) {
+	if (logPath) appendHostSecurityLog(logPath, command, "interactive Tailscale login started; login URL shown in framed wizard note");
+	const result = await runInteractive(buildTailscaleLoginWaitCommand(command), void 0, {
+		timeoutMs: TAILSCALE_INTERACTIVE_TIMEOUT_MS,
+		prompter,
+		noteTitle: "Tailscale login URL"
+	});
 	if (logPath) appendHostSecurityLog(logPath, "tailscale login result", result.ok ? "tailnet IP appeared or tailscale up completed" : result.detail ?? "tailscale login failed");
 	if (result.ok) return {
 		ok: true,
@@ -3088,7 +3131,7 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				return false;
 			}
 			await prompter.note(formatTailscaleAccountBrowserLoginNote(), "Tailscale login");
-			const tsReset = interactiveRunner("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath);
+			const tsReset = await interactiveRunner("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
 			const acceptedTimedOutLogin = tailscaleTimedOutButReady(tsReset, logPath, runner);
 			if (!tsReset.ok && !acceptedTimedOutLogin || !hasTailscaleIp(logPath, runner)) {
 				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
@@ -3245,7 +3288,7 @@ function automaticUpdatesCommand() {
 		"  sudo -n systemctl enable --now apt-daily.timer apt-daily-upgrade.timer",
 		"elif command -v dnf >/dev/null 2>&1 || command -v dnf5 >/dev/null 2>&1; then",
 		"  (" + packageInstallCommand(["dnf5-plugin-automatic"]) + ") || (" + packageInstallCommand(["dnf-automatic"]) + ")",
-		"  sudo -n sed -i 's/^apply_updates[[:space:]]*=.*/apply_updates = yes/' /etc/dnf/automatic.conf >/dev/null 2>&1 || true",
+		"  sudo -n /usr/local/sbin/fased-host-maintenance enable-dnf-automatic >/dev/null 2>&1 || sudo -n sed -i 's/^apply_updates[[:space:]]*=.*/apply_updates = yes/' /etc/dnf/automatic.conf >/dev/null 2>&1 || true",
 		"  sudo -n systemctl enable --now dnf5-automatic.timer >/dev/null 2>&1 || sudo -n systemctl enable --now dnf-automatic.timer",
 		"elif command -v yum >/dev/null 2>&1; then",
 		"  (" + packageInstallCommand(["dnf-automatic"]) + ") || (" + packageInstallCommand(["yum-cron"]) + ")",
@@ -3256,6 +3299,17 @@ function automaticUpdatesCommand() {
 		"fi"
 	].join("\n");
 }
+function sshHardeningCommand() {
+	return [
+		"if sudo -n /usr/local/sbin/fased-host-maintenance harden-ssh >/dev/null 2>&1; then",
+		"  :",
+		"else",
+		"  sudo -n sed -i 's/^#\\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config",
+		"  sudo -n sed -i 's/^#\\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config",
+		"  sudo -n systemctl restart ssh || sudo -n systemctl restart sshd",
+		"fi"
+	].join("\n");
+}
 function failOrContinue(params) {
 	const { opts, runtime, step, detail } = params;
 	const body = detail ? `${step}: ${detail}` : step;
@@ -3301,7 +3355,7 @@ async function applyHostingSecurity(params) {
 		})).trim();
 		else await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
 		const resetCommand = tsAuthkey ? `sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset --authkey ${JSON.stringify(tsAuthkey)}` : "sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset";
-		const tsReset = tsAuthkey ? run(resetCommand, logPath) : runInteractiveTailscaleLogin(resetCommand, logPath);
+		const tsReset = tsAuthkey ? run(resetCommand, logPath) : await runInteractiveTailscaleLogin(resetCommand, logPath, prompter);
 		if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) return {
 			ok: false,
 			detail: tsReset.detail ?? "tailscale account switch failed"
@@ -3433,7 +3487,7 @@ async function applyHostingSecurity(params) {
 			initialValue: false
 		})) {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsReset = runInteractiveTailscaleLogin("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath);
+			const tsReset = await runInteractiveTailscaleLogin("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
 			if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3520,7 +3574,7 @@ async function applyHostingSecurity(params) {
 			};
 		} else {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsUp = runInteractiveTailscaleLogin("sudo -n tailscale up --ssh", logPath);
+			const tsUp = await runInteractiveTailscaleLogin("sudo -n tailscale up --ssh", logPath, prompter);
 			if (!tsUp.ok && !tailscaleTimedOutButReady(tsUp, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3647,7 +3701,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "default-deny public ingress with tailnet SSH/HTTPS access"
 	});
-	const sshRes = run("sudo -n sed -i 's/^#\\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config; sudo -n sed -i 's/^#\\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config; sudo -n systemctl restart ssh || sudo -n systemctl restart sshd", logPath);
+	const sshRes = run(sshHardeningCommand(), logPath);
 	if (!sshRes.ok) {
 		checks.push({
 			name: "ssh",
@@ -3722,7 +3776,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "automatic security updates enabled"
 	});
-	runtime.log("Hosting host hardening complete.");
+	appendHostSecurityLog(logPath, "hosting host hardening complete", "enforced");
 	return {
 		profile,
 		checks,
@@ -4214,7 +4268,6 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		await installPrivateGoForOnboarding();
 	};
 	printWizardHeader(runtime);
-	await prompter.intro("FASED Setup");
 	await requireRiskAcknowledgement({
 		opts,
 		prompter

package/dist/{openresponses-http-BY6b2lDC.js → openresponses-http-BR0xNXbf.js}

@@ -2,13 +2,13 @@ import { Ui as logWarn, wa as defaultRuntime } from "./agent-scope-Cb1u7HE7.js";
 import "./github-copilot-token-DYrFvncE.js";
 import "./send-vR6HwT94.js";
 import "./send-BQMxv218.js";
-import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-BZv4Mjvw.js";
+import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-Dtw2m41q.js";
 import "./diagnostic-D6XQAXl4.js";
 import "./diagnostic-session-state-CexmAKza.js";
 import "./send-Da1hCe1A.js";
 import "./media-DUBmlR9u.js";
 import "./pi-model-discovery-DYwyxntg.js";
-import "./paths-D2Fac7_V.js";
+import "./paths-BGX-IMoI.js";
 import "./ssrf-DYsl9qoS.js";
 import "./reply-prefix-DwrVxkMY.js";
 import "./path-alias-guards--dquYHnR.js";