@fased/fased 0.1.18 → 0.1.20

package/dist/{onboard-search-CLhDai7x.js → onboard-search-BIltnW27.js}

@@ -2,7 +2,7 @@ import "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, i as CONFIG_DIR, m as isRecord } from "./agent-paths-DmOVZE7g.js";
 import { Co as coerceSecretRef, mo as resolveFasedAgentPackageRootSync, wl as installPluginFromNpmSpec } from "./agent-scope-DHrLr5OF.js";
 import "./commands-registry-BRvZQ1jh.js";
-import "./reply-C-KlztgC.js";
+import "./reply-B034LmuD.js";
 import "./errors-Dx3S3Nrp.js";
 import "./send-C5_fB8YQ.js";
 import "./send-jxmRy65D.js";
@@ -37,7 +37,7 @@ import "./ssrf-Blf4NrHS.js";
 import "./outbound-attachment-CsXJwFsg.js";
 import "./fetch-CnCPOuq7.js";
 import "./delivery-queue-DKRjVFlq.js";
-import "./deps-DXHMO1Yj.js";
+import "./deps-BKAIBkcE.js";
 import "./memory-DDpj0IVA.js";
 import "./memory-search-BwYkW6_V.js";
 import "./manager-BmONwMiP.js";
@@ -74,14 +74,14 @@ import "./progress-DZRfIFVb.js";
 import "./replies-Do40G8fO.js";
 import "./skills-remote-BghdrdFV.js";
 import "./skill-commands-QW8zKXC_.js";
-import "./prompt-style-Wxki8rmI.js";
+import "./prompt-style-CWAacuMq.js";
 import "./pairing-labels-D2yOKhoV.js";
 import { t as enablePluginInConfig } from "./enable-D3_YPNIT.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-DDbnXe4x.js";
-import "./status-DNSq7M4m.js";
+import "./status-CdI_oSZ4.js";
 import "./update-Dew6hqdf.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-DkQi8XHs.js";
-import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-JauoxBKh.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-Bbry4K-O.js";
+import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-E9CDTKMh.js";
 import fs from "node:fs";
 import path from "node:path";
 

package/dist/{onboard-search-WWi4blgc.js → onboard-search-HgNX3hct.js}

@@ -2,7 +2,7 @@ import { $c as installPluginFromNpmSpec, Wa as coerceSecretRef, pd as resolveFas
 import { i as CONFIG_DIR, p as isRecord, x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
 import "./send-D7X0_iFp.js";
 import "./send-BFEd4vCM.js";
-import "./model-catalog--SvucuO6.js";
+import "./model-catalog-ex4Cpln_.js";
 import "./github-copilot-token-A9DiaCB0.js";
 import "./reply-prefix-TUhpEtvr.js";
 import "./memory-2keYbXkc.js";
@@ -44,7 +44,7 @@ import "./send-C-su1wPZ.js";
 import "./outbound-attachment-Bh4FmcYg.js";
 import "./fetch-BVvWzHT_.js";
 import "./delivery-queue-55Cityuq.js";
-import "./deps-5vuaH16V.js";
+import "./deps-BWo3ls9h.js";
 import "./frontmatter-D2UNJikU.js";
 import "./skills-Dis31awJ.js";
 import "./skills-remote-CIAB0AXm.js";
@@ -71,14 +71,14 @@ import "./cli-utils-XevKf-tr.js";
 import "./help-format-B2DRdx98.js";
 import "./progress-DkVYFLij.js";
 import "./replies-FXlmpJVO.js";
-import "./prompt-style-DxKPs6E0.js";
+import "./prompt-style-Rmj3c-Ir.js";
 import "./pairing-labels-BCM1S2e_.js";
 import { t as enablePluginInConfig } from "./enable-C4xB2A3x.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-Cha8QIzO.js";
-import "./status-Cbvyhx9d.js";
+import "./status-CqIzNbBd.js";
 import "./update-D4rhRm3D.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-BtrqlzIp.js";
-import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-Dr2M7_ZH.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-BiNcSCVf.js";
+import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-BQw2Sxko.js";
 import path from "node:path";
 import fs from "node:fs";
 

package/dist/{onboarding-DsCvgeVW.js → onboarding-Bgx1tJnU.js}

@@ -1,6 +1,6 @@
 import { Cu as formatCliCommand, Fn as ensureActiveMemoryPluginAllowlisted, Gu as resolveDefaultAgentId, Qt as readConfigFileSnapshot, Wu as resolveAgentWorkspaceDir, br as collectConfigServiceEnvVars, ma as ensureAuthProfileStore, tn as writeConfigFile } from "./env-C77feXxI.js";
 import { H as theme, x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
-import { A as waitForGatewayReachable, C as printWizardHeader, E as resolveControlUiLinks, Ha as CONTROL_UI_BOOT_CHECK_PATH, O as summarizeExistingConfig, S as openUrl, T as randomToken, Wa as normalizeControlUiBasePath, bo as enableTailscaleServe, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, g as formatControlUiSshHint, h as ensureWorkspaceAndSessions, k as validateGatewayPasswordInput, m as detectBrowserOpenSupport, to as runFederationAutoConnectOnce, v as handleOnboardingRepair, w as probeGatewayReachable, x as normalizeGatewayTokenInput, xo as findTailscaleBinary, yo as enableTailscaleFunnel } from "./model-catalog--SvucuO6.js";
+import { A as waitForGatewayReachable, C as printWizardHeader, E as resolveControlUiLinks, Ha as CONTROL_UI_BOOT_CHECK_PATH, O as summarizeExistingConfig, S as openUrl, T as randomToken, Wa as normalizeControlUiBasePath, bo as enableTailscaleServe, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, g as formatControlUiSshHint, h as ensureWorkspaceAndSessions, k as validateGatewayPasswordInput, m as detectBrowserOpenSupport, to as runFederationAutoConnectOnce, v as handleOnboardingRepair, w as probeGatewayReachable, x as normalizeGatewayTokenInput, xo as findTailscaleBinary, yo as enableTailscaleFunnel } from "./model-catalog-ex4Cpln_.js";
 import { A as defaultRuntime, Ct as resolveStateDir, E as redactSensitiveText, gt as resolveGatewayPort, j as restoreTerminalState } from "./entry.js";
 import { n as redactSensitiveUrlLikeString } from "./redact-sensitive-url-BW03TVj8.js";
 import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet--7Yu2hFw.js";
@@ -16,14 +16,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-B8OPQXFR.js";
 import { t as resolveGatewayService } from "./service-2JBjv-ge.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-COK5O0cM.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-hmcj6CY1.js";
-import { s as waitForHostedDashboardBrowserPath } from "./health-CK5_7SB-.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DEux81xn.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-D8d4kRYT.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-DSDJ9Fn2.js";
+import { s as waitForHostedDashboardBrowserPath } from "./health-DW5NMpNI.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-D8Q1fQwa.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-Bs_OE3ai.js";
 import { n as logConfigUpdated } from "./logging-DZ32I_SP.js";
-import { n as setupChannels } from "./onboard-channels-CWZUEiko.js";
+import { n as setupChannels } from "./onboard-channels-CDXretWe.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-DRZciWMZ.js";
-import { t as runTui } from "./tui-DCimzH-j.js";
+import { t as runTui } from "./tui-CLXEsHbW.js";
 import { spawn, spawnSync } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
@@ -168,7 +168,7 @@ function isHostedSecurityCapableSession(explicitFlag = false) {
 		const sudoersPath = path.join("/etc/sudoers.d", `fased-host-maintenance-${currentUser}`);
 		if (fs.existsSync(sudoersPath)) return true;
 	}
-	return canRunHostedMaintenanceCommand("sudo -n tailscale status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n ufw status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n firewall-cmd --state >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl is-active --quiet firewalld >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
+	return canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailscale-status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailnet-ssh-ingress >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance firewall-baseline >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
 }
 
 //#endregion
@@ -546,16 +546,18 @@ async function installRootServiceMaintenanceAccess(params) {
 	const sudoers = [
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl start --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl enable --now ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName} *`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service --no-pager`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} *`
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service -p ActiveState --value`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl cat ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 120 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 120 --no-pager`
 	].join("\n");
 	return await runShell([
 		`echo '${Buffer.from(`${sudoers}\n`, "utf8").toString("base64")}' | base64 -d | sudo -n tee '${sudoersPath}' >/dev/null`,
@@ -1357,7 +1359,7 @@ async function finalizeOnboardingWizard(options) {
 	const systemdAvailable = process.platform === "linux" ? await isSystemdUserServiceAvailable() : true;
 	if (process.platform === "linux" && !systemdAvailable && !strictVps && flow !== "quickstart") await prompter.note("Systemd user services are unavailable. Skipping lingering checks and user-service install.", "Systemd");
 	if (process.platform === "linux" && systemdAvailable && strictVps) {} else if (process.platform === "linux" && systemdAvailable) {
-		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-BYFLOJbt.js").then((n) => n.r);
+		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-BlmGMvvA.js").then((n) => n.r);
 		await ensureSystemdUserLingerInteractive({
 			runtime,
 			prompter: {
@@ -2462,7 +2464,7 @@ async function finalizeOnboardingWizard(options) {
 			fallbackHint: !strictVps ? controlUiOpenHint : void 0
 		}), "Dashboard ready");
 	}
-	await prompter.outro(strictVps ? "Setup complete. Use HOSTED ACCESS above: Web UI, SSH, or fallback tunnel." : controlUiOpened ? "Setup complete. Next: Agent > Models, then Chat." : "Setup complete. Use the dashboard link above, then use Agent > Models and Chat.");
+	if (!strictVps) await prompter.outro(controlUiOpened ? "Setup complete. Next: Agent > Models, then Chat." : "Setup complete. Use the dashboard link above, then use Agent > Models and Chat.");
 	return { launchedTui };
 }
 
@@ -2746,6 +2748,8 @@ const LOW_MEMORY_SWAP_THRESHOLD_MB = 2304;
 const LOW_MEMORY_HOSTING_SWAP_GB = 4;
 const HOSTING_SWAP_GB = 2;
 const TAILSCALE_INTERACTIVE_TIMEOUT_MS = 120 * 1e3;
+const TAILSCALE_LOGIN_URL_RE = /https:\/\/login\.tailscale\.com\/a\/[A-Za-z0-9_-]+/i;
+const HOST_MAINTENANCE_HELPER = "/usr/local/sbin/fased-host-maintenance";
 function detectTotalMemoryMb() {
 	if (process.platform === "linux") try {
 		const match = fs.readFileSync("/proc/meminfo", "utf8").match(/^MemTotal:\s+(\d+)\s+kB/m);
@@ -2778,29 +2782,67 @@ function run(command, logPath) {
 		detail: detail || `${command} (exit=${proc.status ?? "unknown"})`
 	};
 }
-function runInteractive(command, logPath, options) {
-	if (logPath) appendHostSecurityLog(logPath, command, "interactive command started; output shown in terminal");
-	const proc = spawnSync("bash", ["-lc", command], {
-		stdio: [
+async function runInteractive(command, logPath, options) {
+	if (logPath) appendHostSecurityLog(logPath, command, "interactive command started; output captured for framed wizard display");
+	return await new Promise((resolve) => {
+		const proc = spawn("bash", ["-lc", command], { stdio: [
 			"ignore",
-			"inherit",
-			"inherit"
-		],
-		timeout: options?.timeoutMs,
-		killSignal: "SIGINT"
+			"pipe",
+			"pipe"
+		] });
+		let output = "";
+		let loginUrlShown = false;
+		let timedOut = false;
+		let noteQueue = Promise.resolve();
+		const timer = options?.timeoutMs && options.timeoutMs > 0 ? setTimeout(() => {
+			timedOut = true;
+			proc.kill("SIGINT");
+		}, options.timeoutMs) : null;
+		const maybeShowLoginUrl = (chunk) => {
+			output += chunk;
+			if (loginUrlShown) return;
+			const loginUrl = output.match(TAILSCALE_LOGIN_URL_RE)?.[0];
+			if (!loginUrl) return;
+			loginUrlShown = true;
+			if (options?.prompter) {
+				const message = [
+					noteHeading("Open login URL"),
+					"Open this URL in your local browser:",
+					...noteCommands([loginUrl]),
+					"Return here after approving this VPS."
+				].join("\n");
+				noteQueue = noteQueue.then(() => options.prompter?.note(message, options.noteTitle ?? "Tailscale login URL"));
+			}
+		};
+		proc.stdout?.on("data", (chunk) => {
+			maybeShowLoginUrl(String(chunk));
+		});
+		proc.stderr?.on("data", (chunk) => {
+			maybeShowLoginUrl(String(chunk));
+		});
+		proc.on("error", (error) => {
+			output += `\n${error instanceof Error ? error.message : String(error)}`;
+		});
+		proc.on("close", (code) => {
+			if (timer) clearTimeout(timer);
+			const detail = timedOut ? `${command} timed out after ${Math.round((options?.timeoutMs ?? 0) / 1e3)}s\n${output}`.trim() : `${command} (exit=${code ?? "unknown"})\n${output}`.trim();
+			if (logPath) appendHostSecurityLog(logPath, command, detail);
+			noteQueue.then(() => {
+				if (code === 0) {
+					resolve({
+						ok: true,
+						detail
+					});
+					return;
+				}
+				resolve({
+					ok: false,
+					detail,
+					timedOut
+				});
+			});
+		});
 	});
-	const timedOut = proc.error?.code === "ETIMEDOUT";
-	const detail = timedOut ? `${command} timed out after ${Math.round((options?.timeoutMs ?? 0) / 1e3)}s` : `${command} (exit=${proc.status ?? "unknown"})`;
-	if (logPath) appendHostSecurityLog(logPath, command, detail);
-	if (proc.status === 0) return {
-		ok: true,
-		detail
-	};
-	return {
-		ok: false,
-		detail,
-		timedOut
-	};
 }
 function buildTailscaleLoginWaitCommand(command) {
 	return [
@@ -2808,7 +2850,7 @@ function buildTailscaleLoginWaitCommand(command) {
 		`bash -lc ${shellQuote(command)} &`,
 		"ts_pid=$!",
 		"for _ in $(seq 1 55); do",
-		"  if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`  if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"    kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    wait \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    exit 0",
@@ -2821,15 +2863,19 @@ function buildTailscaleLoginWaitCommand(command) {
 		"done",
 		"kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"wait \"$ts_pid\" >/dev/null 2>&1 || true",
-		"if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"  exit 0",
 		"fi",
 		"exit 124"
 	].join("\n");
 }
-function runInteractiveTailscaleLogin(command, logPath) {
-	if (logPath) appendHostSecurityLog(logPath, command, "interactive Tailscale login started; output shown in terminal");
-	const result = runInteractive(buildTailscaleLoginWaitCommand(command), void 0, { timeoutMs: TAILSCALE_INTERACTIVE_TIMEOUT_MS });
+async function runInteractiveTailscaleLogin(command, logPath, prompter) {
+	if (logPath) appendHostSecurityLog(logPath, command, "interactive Tailscale login started; login URL shown in framed wizard note");
+	const result = await runInteractive(buildTailscaleLoginWaitCommand(command), void 0, {
+		timeoutMs: TAILSCALE_INTERACTIVE_TIMEOUT_MS,
+		prompter,
+		noteTitle: "Tailscale login URL"
+	});
 	if (logPath) appendHostSecurityLog(logPath, "tailscale login result", result.ok ? "tailnet IP appeared or tailscale up completed" : result.detail ?? "tailscale login failed");
 	if (result.ok) return {
 		ok: true,
@@ -2870,21 +2916,29 @@ function tailscaleTimedOutButReady(result, logPath, runner = run) {
 function shellQuote(value) {
 	return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function hostMaintenanceCommand(action) {
+	return `sudo -n ${HOST_MAINTENANCE_HELPER} ${action}`;
+}
+function hostMaintenanceCommandWithInput(action, input) {
+	return `printf '%s\\n' ${shellQuote(input)} | ${hostMaintenanceCommand(action)}`;
+}
 function isTailscaleLoggedIn(logPath, runner = run) {
-	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-status")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
 }
 function hasTailscaleIp(logPath, runner = run) {
-	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
 }
 function readTailscaleIp(logPath, runner = run) {
 	const probe = runner("tailscale ip -4", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale ip -4", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-ip4"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale ip -4", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return;
 	return sudoProbe.detail.match(/\b\d{1,3}(?:\.\d{1,3}){3}\b/)?.[0];
 }
 function readTailscaleSelf(logPath, runner = run) {
 	const probe = runner("tailscale status --json", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale status --json", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-status-json"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale status --json", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return { ipv4: readTailscaleIp(logPath, runner) };
 	try {
 		const parsed = JSON.parse(sudoProbe.detail);
@@ -2990,7 +3044,8 @@ function verifyTailnetSshServerPrerequisites(params) {
 	};
 }
 function ensureTailnetSshIngressForVerification(params) {
-	const result = (params.runner ?? run)([
+	const runner = params.runner ?? run;
+	const command = [
 		"if command -v ufw >/dev/null 2>&1; then",
 		"  if sudo -n ufw status | grep -qi '^Status: active'; then",
 		"    sudo -n ufw insert 1 allow in on tailscale0 to any port 22 proto tcp || sudo -n ufw allow in on tailscale0 to any port 22 proto tcp",
@@ -3001,7 +3056,9 @@ function ensureTailnetSshIngressForVerification(params) {
 		"  sudo -n firewall-cmd --permanent --zone=trusted --add-interface=tailscale0 >/dev/null 2>&1 || true",
 		"  sudo -n firewall-cmd --reload >/dev/null 2>&1 || true",
 		"fi"
-	].join("\n"), params.logPath);
+	].join("\n");
+	const helperResult = runner(hostMaintenanceCommand("tailnet-ssh-ingress"), params.logPath);
+	const result = helperResult.ok ? helperResult : runner(command, params.logPath);
 	if (!result.ok) return {
 		ok: false,
 		detail: result.detail ?? "could not prepare tailnet SSH firewall rule before verification"
@@ -3088,7 +3145,7 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				return false;
 			}
 			await prompter.note(formatTailscaleAccountBrowserLoginNote(), "Tailscale login");
-			const tsReset = interactiveRunner("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath);
+			const tsReset = await interactiveRunner(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			const acceptedTimedOutLogin = tailscaleTimedOutButReady(tsReset, logPath, runner);
 			if (!tsReset.ok && !acceptedTimedOutLogin || !hasTailscaleIp(logPath, runner)) {
 				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
@@ -3132,9 +3189,9 @@ function ensureTailscaleServe(port, logPath) {
 		ok: true,
 		detail: `tailscale serve --bg -> 127.0.0.1:${port}`
 	};
-	if (run(`sudo -n tailscale serve --bg http://127.0.0.1:${port}`, logPath).ok) return {
+	if (run(hostMaintenanceCommandWithInput("tailscale-serve", String(port)), logPath).ok) return {
 		ok: true,
-		detail: `sudo tailscale serve --bg -> 127.0.0.1:${port}`
+		detail: `host maintenance tailscale serve -> 127.0.0.1:${port}`
 	};
 	if (run(`tailscale serve https / http://127.0.0.1:${port}`, logPath).ok) return {
 		ok: true,
@@ -3158,7 +3215,7 @@ function isTailscaleServeReady(port) {
 		],
 		encoding: "utf8"
 	});
-	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", "sudo -n tailscale serve status"], {
+	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", hostMaintenanceCommand("tailscale-serve-status")], {
 		stdio: [
 			"ignore",
 			"pipe",
@@ -3191,6 +3248,7 @@ function packageInstallCommand(packages) {
 }
 function tailscaleInstallCommand() {
 	return [
+		`${hostMaintenanceCommand("tailscale-install-start")} && exit 0`,
 		"if command -v tailscale >/dev/null 2>&1; then",
 		"  :",
 		"elif command -v apt-get >/dev/null 2>&1; then",
@@ -3216,6 +3274,7 @@ function tailscaleInstallCommand() {
 }
 function firewallBaselineCommand() {
 	return [
+		`${hostMaintenanceCommand("firewall-baseline")} && exit 0`,
 		"if command -v ufw >/dev/null 2>&1 || command -v apt-get >/dev/null 2>&1; then",
 		"  command -v ufw >/dev/null 2>&1 || { " + packageInstallCommand(["ufw"]) + "; }",
 		"  sudo -n ufw default deny incoming",
@@ -3239,13 +3298,14 @@ function firewallBaselineCommand() {
 }
 function automaticUpdatesCommand() {
 	return [
+		`${hostMaintenanceCommand("automatic-updates")} && exit 0`,
 		"if command -v apt-get >/dev/null 2>&1; then",
 		"  " + packageInstallCommand(["unattended-upgrades"]),
 		"  sudo -n systemctl enable --now unattended-upgrades >/dev/null 2>&1 || true",
 		"  sudo -n systemctl enable --now apt-daily.timer apt-daily-upgrade.timer",
 		"elif command -v dnf >/dev/null 2>&1 || command -v dnf5 >/dev/null 2>&1; then",
 		"  (" + packageInstallCommand(["dnf5-plugin-automatic"]) + ") || (" + packageInstallCommand(["dnf-automatic"]) + ")",
-		"  sudo -n sed -i 's/^apply_updates[[:space:]]*=.*/apply_updates = yes/' /etc/dnf/automatic.conf >/dev/null 2>&1 || true",
+		"  sudo -n /usr/local/sbin/fased-host-maintenance enable-dnf-automatic >/dev/null 2>&1 || sudo -n sed -i 's/^apply_updates[[:space:]]*=.*/apply_updates = yes/' /etc/dnf/automatic.conf >/dev/null 2>&1 || true",
 		"  sudo -n systemctl enable --now dnf5-automatic.timer >/dev/null 2>&1 || sudo -n systemctl enable --now dnf-automatic.timer",
 		"elif command -v yum >/dev/null 2>&1; then",
 		"  (" + packageInstallCommand(["dnf-automatic"]) + ") || (" + packageInstallCommand(["yum-cron"]) + ")",
@@ -3256,6 +3316,9 @@ function automaticUpdatesCommand() {
 		"fi"
 	].join("\n");
 }
+function sshHardeningCommand() {
+	return hostMaintenanceCommand("harden-ssh");
+}
 function failOrContinue(params) {
 	const { opts, runtime, step, detail } = params;
 	const body = detail ? `${step}: ${detail}` : step;
@@ -3300,8 +3363,8 @@ async function applyHostingSecurity(params) {
 			validate: (value) => value.trim() ? void 0 : "Required"
 		})).trim();
 		else await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-		const resetCommand = tsAuthkey ? `sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset --authkey ${JSON.stringify(tsAuthkey)}` : "sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset";
-		const tsReset = tsAuthkey ? run(resetCommand, logPath) : runInteractiveTailscaleLogin(resetCommand, logPath);
+		const resetCommand = tsAuthkey ? hostMaintenanceCommandWithInput("tailscale-up-reset-authkey-ssh", tsAuthkey) : hostMaintenanceCommand("tailscale-up-reset-ssh");
+		const tsReset = tsAuthkey ? run(resetCommand, logPath) : await runInteractiveTailscaleLogin(resetCommand, logPath, prompter);
 		if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) return {
 			ok: false,
 			detail: tsReset.detail ?? "tailscale account switch failed"
@@ -3424,7 +3487,7 @@ async function applyHostingSecurity(params) {
 				logPath
 			};
 		}
-	} else if (hasCommand("systemctl")) run("sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true", logPath);
+	} else if (hasCommand("systemctl")) run(`${hostMaintenanceCommand("tailscale-install-start")} >/dev/null 2>&1 || sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true`, logPath);
 	if (prompter && opts.nonInteractive !== true) await prompter.note(formatLocalDeviceTailnetRequirementNote(), "Local device requirement");
 	let tsHealthy = isTailscaleLoggedIn(logPath);
 	if (tsHealthy && prompter && opts.nonInteractive !== true) {
@@ -3433,7 +3496,7 @@ async function applyHostingSecurity(params) {
 			initialValue: false
 		})) {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsReset = runInteractiveTailscaleLogin("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath);
+			const tsReset = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3476,7 +3539,7 @@ async function applyHostingSecurity(params) {
 			})).trim();
 		}
 		if (tsAuthkey) {
-			const tsUp = run(`sudo -n tailscale up --authkey ${JSON.stringify(tsAuthkey)} --ssh`, logPath);
+			const tsUp = run(hostMaintenanceCommandWithInput("tailscale-up-authkey-ssh", tsAuthkey), logPath);
 			if (!tsUp.ok) {
 				checks.push({
 					name: "tailscale",
@@ -3520,7 +3583,7 @@ async function applyHostingSecurity(params) {
 			};
 		} else {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsUp = runInteractiveTailscaleLogin("sudo -n tailscale up --ssh", logPath);
+			const tsUp = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-ssh"), logPath, prompter);
 			if (!tsUp.ok && !tailscaleTimedOutButReady(tsUp, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3575,7 +3638,7 @@ async function applyHostingSecurity(params) {
 		detail: "tailnet IP present; verifying app SSH before lock-down"
 	});
 	const operatorUser = run("id -u app >/dev/null 2>&1", logPath).ok ? "app" : process.env.SUDO_USER?.trim() || process.env.USER?.trim() || process.env.LOGNAME?.trim();
-	if (operatorUser) run(`sudo -n tailscale set --operator='${operatorUser}' >/dev/null 2>&1 || true`, logPath);
+	if (operatorUser) run(`${hostMaintenanceCommand("tailscale-set-operator-self")} >/dev/null 2>&1 || true`, logPath);
 	if (!await confirmTailnetSshBeforeLockdown({
 		opts,
 		runtime,
@@ -3647,7 +3710,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "default-deny public ingress with tailnet SSH/HTTPS access"
 	});
-	const sshRes = run("sudo -n sed -i 's/^#\\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config; sudo -n sed -i 's/^#\\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config; sudo -n systemctl restart ssh || sudo -n systemctl restart sshd", logPath);
+	const sshRes = run(sshHardeningCommand(), logPath);
 	if (!sshRes.ok) {
 		checks.push({
 			name: "ssh",
@@ -3672,7 +3735,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "password auth/root login disabled and ssh restarted"
 	});
-	const f2bRes = runHostSetupCommand(`${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban`);
+	const f2bRes = runHostSetupCommand(`${hostMaintenanceCommand("fail2ban-enable")} || (${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban)`);
 	if (!f2bRes.ok) {
 		checks.push({
 			name: "fail2ban",
@@ -3722,7 +3785,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "automatic security updates enabled"
 	});
-	runtime.log("Hosting host hardening complete.");
+	appendHostSecurityLog(logPath, "hosting host hardening complete", "enforced");
 	return {
 		profile,
 		checks,