@fased/fased 0.1.18 → 0.1.20

package/dist/{onboarding-D4OTdWQp.js → onboarding-CBlXOasA.js}

@@ -1,7 +1,7 @@
 import { _ as resolveStateDir, u as resolveGatewayPort } from "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, U as theme } from "./agent-paths-DmOVZE7g.js";
 import { Ga as ensureAuthProfileStore, Mn as writeConfigFile, Zr as collectConfigServiceEnvVars, d as resolveDefaultAgentId, dd as formatCliCommand, fr as ensureActiveMemoryPluginAllowlisted, kn as readConfigFileSnapshot, u as resolveAgentWorkspaceDir } from "./agent-scope-DHrLr5OF.js";
-import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-C-KlztgC.js";
+import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-B034LmuD.js";
 import { d as defaultRuntime, f as restoreTerminalState, s as redactSensitiveText } from "./errors-Dx3S3Nrp.js";
 import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-CQG8MiG_.js";
 import { i as resolveLocalSignerRunAsUser, n as resolveLocalSignerBackendSocketPath, o as resolveLocalSignerSocketPath, r as resolveLocalSignerMaterialRootDir, t as ensureWalletStateDir } from "./wallet-runtime-config-BlRWvEER.js";
@@ -17,14 +17,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-CmxDYXvt.js";
 import { t as resolveGatewayService } from "./service-Bsg622jp.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-BRLbvcxT.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-oR6PCFkE.js";
-import { o as waitForHostedDashboardBrowserPath } from "./health-DkKBhl0x.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DSs5l1Mv.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-Dhl403zz.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-B42xQEbV.js";
+import { o as waitForHostedDashboardBrowserPath } from "./health-kF4U3o3b.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DRyuJ7OL.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-EOHB6Adp.js";
 import { n as logConfigUpdated } from "./logging-Dv2wthF_.js";
-import { n as setupChannels } from "./onboard-channels-Di1MifgF.js";
+import { n as setupChannels } from "./onboard-channels-ZnUGKi2j.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-BielXMUB.js";
-import { t as runTui } from "./tui-BTgZ8oh1.js";
+import { t as runTui } from "./tui-CF9NTWgo.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -169,7 +169,7 @@ function isHostedSecurityCapableSession(explicitFlag = false) {
 		const sudoersPath = path.join("/etc/sudoers.d", `fased-host-maintenance-${currentUser}`);
 		if (fs.existsSync(sudoersPath)) return true;
 	}
-	return canRunHostedMaintenanceCommand("sudo -n tailscale status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n ufw status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n firewall-cmd --state >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl is-active --quiet firewalld >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
+	return canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailscale-status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailnet-ssh-ingress >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance firewall-baseline >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
 }
 
 //#endregion
@@ -547,16 +547,18 @@ async function installRootServiceMaintenanceAccess(params) {
 	const sudoers = [
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl start --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl enable --now ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName} *`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service --no-pager`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} *`
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service -p ActiveState --value`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl cat ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 120 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 120 --no-pager`
 	].join("\n");
 	return await runShell([
 		`echo '${Buffer.from(`${sudoers}\n`, "utf8").toString("base64")}' | base64 -d | sudo -n tee '${sudoersPath}' >/dev/null`,
@@ -1358,7 +1360,7 @@ async function finalizeOnboardingWizard(options) {
 	const systemdAvailable = process.platform === "linux" ? await isSystemdUserServiceAvailable() : true;
 	if (process.platform === "linux" && !systemdAvailable && !strictVps && flow !== "quickstart") await prompter.note("Systemd user services are unavailable. Skipping lingering checks and user-service install.", "Systemd");
 	if (process.platform === "linux" && systemdAvailable && strictVps) {} else if (process.platform === "linux" && systemdAvailable) {
-		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-9E60sw1j.js").then((n) => n.r);
+		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-BTw_D-6k.js").then((n) => n.r);
 		await ensureSystemdUserLingerInteractive({
 			runtime,
 			prompter: {
@@ -2463,7 +2465,7 @@ async function finalizeOnboardingWizard(options) {
 			fallbackHint: !strictVps ? controlUiOpenHint : void 0
 		}), "Dashboard ready");
 	}
-	await prompter.outro(strictVps ? "Setup complete. Use HOSTED ACCESS above: Web UI, SSH, or fallback tunnel." : controlUiOpened ? "Setup complete. Next: Agent > Models, then Chat." : "Setup complete. Use the dashboard link above, then use Agent > Models and Chat.");
+	if (!strictVps) await prompter.outro(controlUiOpened ? "Setup complete. Next: Agent > Models, then Chat." : "Setup complete. Use the dashboard link above, then use Agent > Models and Chat.");
 	return { launchedTui };
 }
 
@@ -2747,6 +2749,8 @@ const LOW_MEMORY_SWAP_THRESHOLD_MB = 2304;
 const LOW_MEMORY_HOSTING_SWAP_GB = 4;
 const HOSTING_SWAP_GB = 2;
 const TAILSCALE_INTERACTIVE_TIMEOUT_MS = 120 * 1e3;
+const TAILSCALE_LOGIN_URL_RE = /https:\/\/login\.tailscale\.com\/a\/[A-Za-z0-9_-]+/i;
+const HOST_MAINTENANCE_HELPER = "/usr/local/sbin/fased-host-maintenance";
 function detectTotalMemoryMb() {
 	if (process.platform === "linux") try {
 		const match = fs.readFileSync("/proc/meminfo", "utf8").match(/^MemTotal:\s+(\d+)\s+kB/m);
@@ -2779,29 +2783,67 @@ function run(command, logPath) {
 		detail: detail || `${command} (exit=${proc.status ?? "unknown"})`
 	};
 }
-function runInteractive(command, logPath, options) {
-	if (logPath) appendHostSecurityLog(logPath, command, "interactive command started; output shown in terminal");
-	const proc = spawnSync("bash", ["-lc", command], {
-		stdio: [
+async function runInteractive(command, logPath, options) {
+	if (logPath) appendHostSecurityLog(logPath, command, "interactive command started; output captured for framed wizard display");
+	return await new Promise((resolve) => {
+		const proc = spawn("bash", ["-lc", command], { stdio: [
 			"ignore",
-			"inherit",
-			"inherit"
-		],
-		timeout: options?.timeoutMs,
-		killSignal: "SIGINT"
+			"pipe",
+			"pipe"
+		] });
+		let output = "";
+		let loginUrlShown = false;
+		let timedOut = false;
+		let noteQueue = Promise.resolve();
+		const timer = options?.timeoutMs && options.timeoutMs > 0 ? setTimeout(() => {
+			timedOut = true;
+			proc.kill("SIGINT");
+		}, options.timeoutMs) : null;
+		const maybeShowLoginUrl = (chunk) => {
+			output += chunk;
+			if (loginUrlShown) return;
+			const loginUrl = output.match(TAILSCALE_LOGIN_URL_RE)?.[0];
+			if (!loginUrl) return;
+			loginUrlShown = true;
+			if (options?.prompter) {
+				const message = [
+					noteHeading("Open login URL"),
+					"Open this URL in your local browser:",
+					...noteCommands([loginUrl]),
+					"Return here after approving this VPS."
+				].join("\n");
+				noteQueue = noteQueue.then(() => options.prompter?.note(message, options.noteTitle ?? "Tailscale login URL"));
+			}
+		};
+		proc.stdout?.on("data", (chunk) => {
+			maybeShowLoginUrl(String(chunk));
+		});
+		proc.stderr?.on("data", (chunk) => {
+			maybeShowLoginUrl(String(chunk));
+		});
+		proc.on("error", (error) => {
+			output += `\n${error instanceof Error ? error.message : String(error)}`;
+		});
+		proc.on("close", (code) => {
+			if (timer) clearTimeout(timer);
+			const detail = timedOut ? `${command} timed out after ${Math.round((options?.timeoutMs ?? 0) / 1e3)}s\n${output}`.trim() : `${command} (exit=${code ?? "unknown"})\n${output}`.trim();
+			if (logPath) appendHostSecurityLog(logPath, command, detail);
+			noteQueue.then(() => {
+				if (code === 0) {
+					resolve({
+						ok: true,
+						detail
+					});
+					return;
+				}
+				resolve({
+					ok: false,
+					detail,
+					timedOut
+				});
+			});
+		});
 	});
-	const timedOut = proc.error?.code === "ETIMEDOUT";
-	const detail = timedOut ? `${command} timed out after ${Math.round((options?.timeoutMs ?? 0) / 1e3)}s` : `${command} (exit=${proc.status ?? "unknown"})`;
-	if (logPath) appendHostSecurityLog(logPath, command, detail);
-	if (proc.status === 0) return {
-		ok: true,
-		detail
-	};
-	return {
-		ok: false,
-		detail,
-		timedOut
-	};
 }
 function buildTailscaleLoginWaitCommand(command) {
 	return [
@@ -2809,7 +2851,7 @@ function buildTailscaleLoginWaitCommand(command) {
 		`bash -lc ${shellQuote(command)} &`,
 		"ts_pid=$!",
 		"for _ in $(seq 1 55); do",
-		"  if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`  if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"    kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    wait \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    exit 0",
@@ -2822,15 +2864,19 @@ function buildTailscaleLoginWaitCommand(command) {
 		"done",
 		"kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"wait \"$ts_pid\" >/dev/null 2>&1 || true",
-		"if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"  exit 0",
 		"fi",
 		"exit 124"
 	].join("\n");
 }
-function runInteractiveTailscaleLogin(command, logPath) {
-	if (logPath) appendHostSecurityLog(logPath, command, "interactive Tailscale login started; output shown in terminal");
-	const result = runInteractive(buildTailscaleLoginWaitCommand(command), void 0, { timeoutMs: TAILSCALE_INTERACTIVE_TIMEOUT_MS });
+async function runInteractiveTailscaleLogin(command, logPath, prompter) {
+	if (logPath) appendHostSecurityLog(logPath, command, "interactive Tailscale login started; login URL shown in framed wizard note");
+	const result = await runInteractive(buildTailscaleLoginWaitCommand(command), void 0, {
+		timeoutMs: TAILSCALE_INTERACTIVE_TIMEOUT_MS,
+		prompter,
+		noteTitle: "Tailscale login URL"
+	});
 	if (logPath) appendHostSecurityLog(logPath, "tailscale login result", result.ok ? "tailnet IP appeared or tailscale up completed" : result.detail ?? "tailscale login failed");
 	if (result.ok) return {
 		ok: true,
@@ -2871,21 +2917,29 @@ function tailscaleTimedOutButReady(result, logPath, runner = run) {
 function shellQuote(value) {
 	return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function hostMaintenanceCommand(action) {
+	return `sudo -n ${HOST_MAINTENANCE_HELPER} ${action}`;
+}
+function hostMaintenanceCommandWithInput(action, input) {
+	return `printf '%s\\n' ${shellQuote(input)} | ${hostMaintenanceCommand(action)}`;
+}
 function isTailscaleLoggedIn(logPath, runner = run) {
-	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-status")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
 }
 function hasTailscaleIp(logPath, runner = run) {
-	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
 }
 function readTailscaleIp(logPath, runner = run) {
 	const probe = runner("tailscale ip -4", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale ip -4", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-ip4"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale ip -4", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return;
 	return sudoProbe.detail.match(/\b\d{1,3}(?:\.\d{1,3}){3}\b/)?.[0];
 }
 function readTailscaleSelf(logPath, runner = run) {
 	const probe = runner("tailscale status --json", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale status --json", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-status-json"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale status --json", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return { ipv4: readTailscaleIp(logPath, runner) };
 	try {
 		const parsed = JSON.parse(sudoProbe.detail);
@@ -2991,7 +3045,8 @@ function verifyTailnetSshServerPrerequisites(params) {
 	};
 }
 function ensureTailnetSshIngressForVerification(params) {
-	const result = (params.runner ?? run)([
+	const runner = params.runner ?? run;
+	const command = [
 		"if command -v ufw >/dev/null 2>&1; then",
 		"  if sudo -n ufw status | grep -qi '^Status: active'; then",
 		"    sudo -n ufw insert 1 allow in on tailscale0 to any port 22 proto tcp || sudo -n ufw allow in on tailscale0 to any port 22 proto tcp",
@@ -3002,7 +3057,9 @@ function ensureTailnetSshIngressForVerification(params) {
 		"  sudo -n firewall-cmd --permanent --zone=trusted --add-interface=tailscale0 >/dev/null 2>&1 || true",
 		"  sudo -n firewall-cmd --reload >/dev/null 2>&1 || true",
 		"fi"
-	].join("\n"), params.logPath);
+	].join("\n");
+	const helperResult = runner(hostMaintenanceCommand("tailnet-ssh-ingress"), params.logPath);
+	const result = helperResult.ok ? helperResult : runner(command, params.logPath);
 	if (!result.ok) return {
 		ok: false,
 		detail: result.detail ?? "could not prepare tailnet SSH firewall rule before verification"
@@ -3089,7 +3146,7 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				return false;
 			}
 			await prompter.note(formatTailscaleAccountBrowserLoginNote(), "Tailscale login");
-			const tsReset = interactiveRunner("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath);
+			const tsReset = await interactiveRunner(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			const acceptedTimedOutLogin = tailscaleTimedOutButReady(tsReset, logPath, runner);
 			if (!tsReset.ok && !acceptedTimedOutLogin || !hasTailscaleIp(logPath, runner)) {
 				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
@@ -3133,9 +3190,9 @@ function ensureTailscaleServe(port, logPath) {
 		ok: true,
 		detail: `tailscale serve --bg -> 127.0.0.1:${port}`
 	};
-	if (run(`sudo -n tailscale serve --bg http://127.0.0.1:${port}`, logPath).ok) return {
+	if (run(hostMaintenanceCommandWithInput("tailscale-serve", String(port)), logPath).ok) return {
 		ok: true,
-		detail: `sudo tailscale serve --bg -> 127.0.0.1:${port}`
+		detail: `host maintenance tailscale serve -> 127.0.0.1:${port}`
 	};
 	if (run(`tailscale serve https / http://127.0.0.1:${port}`, logPath).ok) return {
 		ok: true,
@@ -3159,7 +3216,7 @@ function isTailscaleServeReady(port) {
 		],
 		encoding: "utf8"
 	});
-	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", "sudo -n tailscale serve status"], {
+	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", hostMaintenanceCommand("tailscale-serve-status")], {
 		stdio: [
 			"ignore",
 			"pipe",
@@ -3192,6 +3249,7 @@ function packageInstallCommand(packages) {
 }
 function tailscaleInstallCommand() {
 	return [
+		`${hostMaintenanceCommand("tailscale-install-start")} && exit 0`,
 		"if command -v tailscale >/dev/null 2>&1; then",
 		"  :",
 		"elif command -v apt-get >/dev/null 2>&1; then",
@@ -3217,6 +3275,7 @@ function tailscaleInstallCommand() {
 }
 function firewallBaselineCommand() {
 	return [
+		`${hostMaintenanceCommand("firewall-baseline")} && exit 0`,
 		"if command -v ufw >/dev/null 2>&1 || command -v apt-get >/dev/null 2>&1; then",
 		"  command -v ufw >/dev/null 2>&1 || { " + packageInstallCommand(["ufw"]) + "; }",
 		"  sudo -n ufw default deny incoming",
@@ -3240,13 +3299,14 @@ function firewallBaselineCommand() {
 }
 function automaticUpdatesCommand() {
 	return [
+		`${hostMaintenanceCommand("automatic-updates")} && exit 0`,
 		"if command -v apt-get >/dev/null 2>&1; then",
 		"  " + packageInstallCommand(["unattended-upgrades"]),
 		"  sudo -n systemctl enable --now unattended-upgrades >/dev/null 2>&1 || true",
 		"  sudo -n systemctl enable --now apt-daily.timer apt-daily-upgrade.timer",
 		"elif command -v dnf >/dev/null 2>&1 || command -v dnf5 >/dev/null 2>&1; then",
 		"  (" + packageInstallCommand(["dnf5-plugin-automatic"]) + ") || (" + packageInstallCommand(["dnf-automatic"]) + ")",
-		"  sudo -n sed -i 's/^apply_updates[[:space:]]*=.*/apply_updates = yes/' /etc/dnf/automatic.conf >/dev/null 2>&1 || true",
+		"  sudo -n /usr/local/sbin/fased-host-maintenance enable-dnf-automatic >/dev/null 2>&1 || sudo -n sed -i 's/^apply_updates[[:space:]]*=.*/apply_updates = yes/' /etc/dnf/automatic.conf >/dev/null 2>&1 || true",
 		"  sudo -n systemctl enable --now dnf5-automatic.timer >/dev/null 2>&1 || sudo -n systemctl enable --now dnf-automatic.timer",
 		"elif command -v yum >/dev/null 2>&1; then",
 		"  (" + packageInstallCommand(["dnf-automatic"]) + ") || (" + packageInstallCommand(["yum-cron"]) + ")",
@@ -3257,6 +3317,9 @@ function automaticUpdatesCommand() {
 		"fi"
 	].join("\n");
 }
+function sshHardeningCommand() {
+	return hostMaintenanceCommand("harden-ssh");
+}
 function failOrContinue(params) {
 	const { opts, runtime, step, detail } = params;
 	const body = detail ? `${step}: ${detail}` : step;
@@ -3301,8 +3364,8 @@ async function applyHostingSecurity(params) {
 			validate: (value) => value.trim() ? void 0 : "Required"
 		})).trim();
 		else await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-		const resetCommand = tsAuthkey ? `sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset --authkey ${JSON.stringify(tsAuthkey)}` : "sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset";
-		const tsReset = tsAuthkey ? run(resetCommand, logPath) : runInteractiveTailscaleLogin(resetCommand, logPath);
+		const resetCommand = tsAuthkey ? hostMaintenanceCommandWithInput("tailscale-up-reset-authkey-ssh", tsAuthkey) : hostMaintenanceCommand("tailscale-up-reset-ssh");
+		const tsReset = tsAuthkey ? run(resetCommand, logPath) : await runInteractiveTailscaleLogin(resetCommand, logPath, prompter);
 		if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) return {
 			ok: false,
 			detail: tsReset.detail ?? "tailscale account switch failed"
@@ -3425,7 +3488,7 @@ async function applyHostingSecurity(params) {
 				logPath
 			};
 		}
-	} else if (hasCommand("systemctl")) run("sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true", logPath);
+	} else if (hasCommand("systemctl")) run(`${hostMaintenanceCommand("tailscale-install-start")} >/dev/null 2>&1 || sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true`, logPath);
 	if (prompter && opts.nonInteractive !== true) await prompter.note(formatLocalDeviceTailnetRequirementNote(), "Local device requirement");
 	let tsHealthy = isTailscaleLoggedIn(logPath);
 	if (tsHealthy && prompter && opts.nonInteractive !== true) {
@@ -3434,7 +3497,7 @@ async function applyHostingSecurity(params) {
 			initialValue: false
 		})) {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsReset = runInteractiveTailscaleLogin("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath);
+			const tsReset = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3477,7 +3540,7 @@ async function applyHostingSecurity(params) {
 			})).trim();
 		}
 		if (tsAuthkey) {
-			const tsUp = run(`sudo -n tailscale up --authkey ${JSON.stringify(tsAuthkey)} --ssh`, logPath);
+			const tsUp = run(hostMaintenanceCommandWithInput("tailscale-up-authkey-ssh", tsAuthkey), logPath);
 			if (!tsUp.ok) {
 				checks.push({
 					name: "tailscale",
@@ -3521,7 +3584,7 @@ async function applyHostingSecurity(params) {
 			};
 		} else {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsUp = runInteractiveTailscaleLogin("sudo -n tailscale up --ssh", logPath);
+			const tsUp = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-ssh"), logPath, prompter);
 			if (!tsUp.ok && !tailscaleTimedOutButReady(tsUp, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3576,7 +3639,7 @@ async function applyHostingSecurity(params) {
 		detail: "tailnet IP present; verifying app SSH before lock-down"
 	});
 	const operatorUser = run("id -u app >/dev/null 2>&1", logPath).ok ? "app" : process.env.SUDO_USER?.trim() || process.env.USER?.trim() || process.env.LOGNAME?.trim();
-	if (operatorUser) run(`sudo -n tailscale set --operator='${operatorUser}' >/dev/null 2>&1 || true`, logPath);
+	if (operatorUser) run(`${hostMaintenanceCommand("tailscale-set-operator-self")} >/dev/null 2>&1 || true`, logPath);
 	if (!await confirmTailnetSshBeforeLockdown({
 		opts,
 		runtime,
@@ -3648,7 +3711,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "default-deny public ingress with tailnet SSH/HTTPS access"
 	});
-	const sshRes = run("sudo -n sed -i 's/^#\\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config; sudo -n sed -i 's/^#\\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config; sudo -n systemctl restart ssh || sudo -n systemctl restart sshd", logPath);
+	const sshRes = run(sshHardeningCommand(), logPath);
 	if (!sshRes.ok) {
 		checks.push({
 			name: "ssh",
@@ -3673,7 +3736,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "password auth/root login disabled and ssh restarted"
 	});
-	const f2bRes = runHostSetupCommand(`${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban`);
+	const f2bRes = runHostSetupCommand(`${hostMaintenanceCommand("fail2ban-enable")} || (${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban)`);
 	if (!f2bRes.ok) {
 		checks.push({
 			name: "fail2ban",
@@ -3723,7 +3786,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "automatic security updates enabled"
 	});
-	runtime.log("Hosting host hardening complete.");
+	appendHostSecurityLog(logPath, "hosting host hardening complete", "enforced");
 	return {
 		profile,
 		checks,

package/dist/{openresponses-http-CFQL8cSe.js → openresponses-http-5S3xc2MZ.js}

@@ -2,7 +2,7 @@ import { Ui as logWarn, wa as defaultRuntime } from "./agent-scope-Cb1u7HE7.js";
 import "./github-copilot-token-DYrFvncE.js";
 import "./send-vR6HwT94.js";
 import "./send-BQMxv218.js";
-import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-IQzv6URS.js";
+import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-Bnuo5tPq.js";
 import "./diagnostic-D6XQAXl4.js";
 import "./diagnostic-session-state-CexmAKza.js";
 import "./send-Da1hCe1A.js";

package/dist/{openresponses-http-qcMe4CnQ.js → openresponses-http-BBNbIRzc.js}

@@ -2,14 +2,14 @@ import { Sa as defaultRuntime, Vi as logWarn } from "./agent-scope-DUKEZjqM.js";
 import "./github-copilot-token-CNsqwfnE.js";
 import "./send-CFSRf7De.js";
 import "./send-gtmn6YeH.js";
-import { B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as sendJson, et as emitAgentEvent, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, tt as onAgentEvent, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-BS0sTNPV.js";
+import { B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as sendJson, et as emitAgentEvent, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, tt as onAgentEvent, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-CeuBUTjd.js";
 import "./reply-prefix-Bitnsmpd.js";
 import "./diagnostic-_BiQ6GgD.js";
 import "./diagnostic-session-state-CL_QxyRg.js";
 import "./send-C3B8eaL_.js";
 import "./media-B1OiuFFn.js";
 import "./pi-model-discovery-DsJSYjlQ.js";
-import "./paths-DuymR5Rg.js";
+import "./paths-Bzz-O3FX.js";
 import "./ssrf-9SwDSKOO.js";
 import "./path-alias-guards-B_y00xGw.js";
 import "./fs-safe-SqvX3xVH.js";

package/dist/{openresponses-http-DVyWivMq.js → openresponses-http-BTpFUwym.js}

@@ -1,6 +1,6 @@
 import "./github-copilot-token-Dy7Y_jbI.js";
 import { la as logWarn, qo as defaultRuntime } from "./paths-OUJyk-5R.js";
-import { B as extractImageContentFromSource, F as DEFAULT_INPUT_IMAGE_MAX_BYTES, H as resolveInputFileLimits, I as DEFAULT_INPUT_IMAGE_MIMES, L as DEFAULT_INPUT_MAX_REDIRECTS, R as DEFAULT_INPUT_TIMEOUT_MS, V as normalizeMimeList, X as emitAgentEvent, Z as onAgentEvent, a as agentCommand, at as sendJson, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, z as extractFileContentFromSource } from "./auth-DtTjcdsn.js";
+import { B as extractImageContentFromSource, F as DEFAULT_INPUT_IMAGE_MAX_BYTES, H as resolveInputFileLimits, I as DEFAULT_INPUT_IMAGE_MIMES, L as DEFAULT_INPUT_MAX_REDIRECTS, R as DEFAULT_INPUT_TIMEOUT_MS, V as normalizeMimeList, X as emitAgentEvent, Z as onAgentEvent, a as agentCommand, at as sendJson, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, z as extractFileContentFromSource } from "./auth-BbQxXxtt.js";
 import "./send-D96gGRQz.js";
 import "./send-BFoI9HuU.js";
 import "./skill-commands-DvoCSQnx.js";

package/dist/{openresponses-http-D6Ttjnvd.js → openresponses-http-COAxhJal.js}

@@ -2,7 +2,7 @@ import { bd as logWarn } from "./env-C77feXxI.js";
 import "./agent-paths-BI1hx-tF.js";
 import "./send-D7X0_iFp.js";
 import "./send-BFEd4vCM.js";
-import { Ai as buildAgentMessageFromConversationEntries, Ii as resolveAssistantStreamDeltaText, Li as agentCommand, _a as resolveAgentIdForRequest, an as DEFAULT_INPUT_IMAGE_MAX_BYTES, ba as setSseHeaders, cn as DEFAULT_INPUT_TIMEOUT_MS, dn as normalizeMimeList, fn as resolveInputFileLimits, ia as emitAgentEvent, ki as handleGatewayPostJsonEndpoint, ln as extractFileContentFromSource, oa as onAgentEvent, on as DEFAULT_INPUT_IMAGE_MIMES, sn as DEFAULT_INPUT_MAX_REDIRECTS, un as extractImageContentFromSource, va as resolveSessionKey, xa as writeDone, ya as sendJson } from "./model-catalog--SvucuO6.js";
+import { Ai as buildAgentMessageFromConversationEntries, Ii as resolveAssistantStreamDeltaText, Li as agentCommand, _a as resolveAgentIdForRequest, an as DEFAULT_INPUT_IMAGE_MAX_BYTES, ba as setSseHeaders, cn as DEFAULT_INPUT_TIMEOUT_MS, dn as normalizeMimeList, fn as resolveInputFileLimits, ia as emitAgentEvent, ki as handleGatewayPostJsonEndpoint, ln as extractFileContentFromSource, oa as onAgentEvent, on as DEFAULT_INPUT_IMAGE_MIMES, sn as DEFAULT_INPUT_MAX_REDIRECTS, un as extractImageContentFromSource, va as resolveSessionKey, xa as writeDone, ya as sendJson } from "./model-catalog-ex4Cpln_.js";
 import "./github-copilot-token-A9DiaCB0.js";
 import { A as defaultRuntime } from "./entry.js";
 import "./reply-prefix-TUhpEtvr.js";
@@ -45,7 +45,7 @@ import "./send-C-su1wPZ.js";
 import "./outbound-attachment-Bh4FmcYg.js";
 import "./fetch-BVvWzHT_.js";
 import "./delivery-queue-55Cityuq.js";
-import { t as createDefaultDeps } from "./deps-5vuaH16V.js";
+import { t as createDefaultDeps } from "./deps-BWo3ls9h.js";
 import "./frontmatter-D2UNJikU.js";
 import "./skills-Dis31awJ.js";
 import "./skills-remote-CIAB0AXm.js";
@@ -72,7 +72,7 @@ import "./cli-utils-XevKf-tr.js";
 import "./help-format-B2DRdx98.js";
 import "./progress-DkVYFLij.js";
 import "./replies-FXlmpJVO.js";
-import "./prompt-style-DxKPs6E0.js";
+import "./prompt-style-Rmj3c-Ir.js";
 import "./pairing-labels-BCM1S2e_.js";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";

package/dist/{openresponses-http-BdrytBTu.js → openresponses-http-o273A5SH.js}

@@ -2,7 +2,7 @@ import "./paths-C9FmTW1x.js";
 import "./agent-paths-DmOVZE7g.js";
 import { au as logWarn } from "./agent-scope-DHrLr5OF.js";
 import "./commands-registry-BRvZQ1jh.js";
-import { Er as onAgentEvent, G as DEFAULT_INPUT_TIMEOUT_MS, H as DEFAULT_INPUT_IMAGE_MAX_BYTES, J as normalizeMimeList, Ja as sendJson, K as extractFileContentFromSource, Ka as resolveAgentIdForRequest, U as DEFAULT_INPUT_IMAGE_MIMES, W as DEFAULT_INPUT_MAX_REDIRECTS, Xa as writeDone, Y as resolveInputFileLimits, Ya as setSseHeaders, ft as handleGatewayPostJsonEndpoint, ht as agentCommand, mt as resolveAssistantStreamDeltaText, pt as buildAgentMessageFromConversationEntries, q as extractImageContentFromSource, qa as resolveSessionKey, wr as emitAgentEvent } from "./reply-C-KlztgC.js";
+import { Er as onAgentEvent, G as DEFAULT_INPUT_TIMEOUT_MS, H as DEFAULT_INPUT_IMAGE_MAX_BYTES, J as normalizeMimeList, Ja as sendJson, K as extractFileContentFromSource, Ka as resolveAgentIdForRequest, U as DEFAULT_INPUT_IMAGE_MIMES, W as DEFAULT_INPUT_MAX_REDIRECTS, Xa as writeDone, Y as resolveInputFileLimits, Ya as setSseHeaders, ft as handleGatewayPostJsonEndpoint, ht as agentCommand, mt as resolveAssistantStreamDeltaText, pt as buildAgentMessageFromConversationEntries, q as extractImageContentFromSource, qa as resolveSessionKey, wr as emitAgentEvent } from "./reply-B034LmuD.js";
 import { d as defaultRuntime } from "./errors-Dx3S3Nrp.js";
 import "./send-C5_fB8YQ.js";
 import "./send-jxmRy65D.js";
@@ -37,7 +37,7 @@ import "./ssrf-Blf4NrHS.js";
 import "./outbound-attachment-CsXJwFsg.js";
 import "./fetch-CnCPOuq7.js";
 import "./delivery-queue-DKRjVFlq.js";
-import { t as createDefaultDeps } from "./deps-DXHMO1Yj.js";
+import { t as createDefaultDeps } from "./deps-BKAIBkcE.js";
 import "./memory-DDpj0IVA.js";
 import "./memory-search-BwYkW6_V.js";
 import "./manager-BmONwMiP.js";
@@ -74,7 +74,7 @@ import "./progress-DZRfIFVb.js";
 import "./replies-Do40G8fO.js";
 import "./skills-remote-BghdrdFV.js";
 import "./skill-commands-QW8zKXC_.js";
-import "./prompt-style-Wxki8rmI.js";
+import "./prompt-style-CWAacuMq.js";
 import "./pairing-labels-D2yOKhoV.js";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";

package/dist/{parent-default-help-ClCr80XR.js → parent-default-help-BwE33-U1.js}

@@ -1,6 +1,6 @@
 import { Gl as listChannelPlugins, Vf as CHAT_CHANNEL_ORDER, t as isTruthyEnvValue } from "./env-C77feXxI.js";
 import { d as listChannelPluginCatalogEntries } from "./dangerous-name-matching-CFRKz8Uq.js";
-import { t as ensurePluginRegistryLoaded } from "./plugin-registry-C6ytAnfA.js";
+import { t as ensurePluginRegistryLoaded } from "./plugin-registry-DjTXh-9g.js";
 
 //#region src/cli/channel-options.ts
 function dedupe(values) {

package/dist/{parent-default-help-D_UWzDsy.js → parent-default-help-DzWAx_GB.js}

@@ -1,6 +1,6 @@
 import { Cd as isTruthyEnvValue, Nu as listChannelPlugins, jf as CHAT_CHANNEL_ORDER } from "./agent-scope-DHrLr5OF.js";
 import { c as listChannelPluginCatalogEntries } from "./dangerous-name-matching-CnyEIiOk.js";
-import { t as ensurePluginRegistryLoaded } from "./plugin-registry-DfiokqgQ.js";
+import { t as ensurePluginRegistryLoaded } from "./plugin-registry-D2IeEq2N.js";
 
 //#region src/cli/channel-options.ts
 function dedupe(values) {

package/dist/{paths-DuymR5Rg.js → paths-Bzz-O3FX.js}

@@ -9,7 +9,7 @@ import { createHmac } from "node:crypto";
 import { execFileSync, spawn } from "node:child_process";
 import { createServer } from "node:http";
 import net from "node:net";
-import WebSocket, { WebSocketServer } from "ws";
+import WebSocket$1, { WebSocketServer } from "ws";
 import { Buffer as Buffer$1 } from "node:buffer";
 
 //#region src/browser/constants.ts
@@ -270,7 +270,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 		let extensionWs = null;
 		const cdpClients = /* @__PURE__ */ new Set();
 		const connectedTargets = /* @__PURE__ */ new Map();
-		const extensionConnected = () => extensionWs?.readyState === WebSocket.OPEN;
+		const extensionConnected = () => extensionWs?.readyState === WebSocket$1.OPEN;
 		let extensionDisconnectCleanupTimer = null;
 		const extensionReconnectWaiters = /* @__PURE__ */ new Set();
 		const flushExtensionReconnectWaiters = (connected) => {
@@ -321,7 +321,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 		let nextExtensionId = 1;
 		const sendToExtension = async (payload) => {
 			const ws = extensionWs;
-			if (!ws || ws.readyState !== WebSocket.OPEN) throw new Error("Chrome extension not connected");
+			if (!ws || ws.readyState !== WebSocket$1.OPEN) throw new Error("Chrome extension not connected");
 			ws.send(JSON.stringify(payload));
 			return await new Promise((resolve, reject) => {
 				const timer = setTimeout(() => {
@@ -338,12 +338,12 @@ async function ensureChromeExtensionRelayServer(opts) {
 		const broadcastToCdpClients = (evt) => {
 			const msg = JSON.stringify(evt);
 			for (const ws of cdpClients) {
-				if (ws.readyState !== WebSocket.OPEN) continue;
+				if (ws.readyState !== WebSocket$1.OPEN) continue;
 				ws.send(msg);
 			}
 		};
 		const sendResponseToCdp = (ws, res) => {
-			if (ws.readyState !== WebSocket.OPEN) return;
+			if (ws.readyState !== WebSocket$1.OPEN) return;
 			ws.send(JSON.stringify(res));
 		};
 		const ensureTargetEventsForClient = (ws, mode) => {
@@ -553,7 +553,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 					rejectUpgrade(socket, 401, "Unauthorized");
 					return;
 				}
-				if (extensionWs && extensionWs.readyState !== WebSocket.OPEN) {
+				if (extensionWs && extensionWs.readyState !== WebSocket$1.OPEN) {
 					try {
 						extensionWs.terminate();
 					} catch {}
@@ -590,7 +590,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 			clearExtensionDisconnectCleanupTimer();
 			flushExtensionReconnectWaiters(true);
 			const ping = setInterval(() => {
-				if (ws.readyState !== WebSocket.OPEN) return;
+				if (ws.readyState !== WebSocket$1.OPEN) return;
 				ws.send(JSON.stringify({ method: "ping" }));
 			}, 5e3);
 			ws.on("message", (data) => {
@@ -932,7 +932,7 @@ async function fetchOk(url, timeoutMs = 1500, init) {
 }
 async function withCdpSocket(wsUrl, fn, opts) {
 	const headers = getHeadersWithAuth(wsUrl, opts?.headers ?? {});
-	const ws = new WebSocket(wsUrl, {
+	const ws = new WebSocket$1(wsUrl, {
 		handshakeTimeout: typeof opts?.handshakeTimeoutMs === "number" && Number.isFinite(opts.handshakeTimeoutMs) ? Math.max(1, Math.floor(opts.handshakeTimeoutMs)) : 5e3,
 		...Object.keys(headers).length ? { headers } : {}
 	});
@@ -1858,7 +1858,7 @@ async function getChromeWebSocketUrl(cdpUrl, timeoutMs = 500) {
 async function canOpenWebSocket(wsUrl, timeoutMs = 800) {
 	return await new Promise((resolve) => {
 		const headers = getHeadersWithAuth(wsUrl);
-		const ws = new WebSocket(wsUrl, {
+		const ws = new WebSocket$1(wsUrl, {
 			handshakeTimeout: timeoutMs,
 			...Object.keys(headers).length ? { headers } : {}
 		});