@fased/fased 0.1.19 → 0.1.20

package/dist/{onboarding-C8AUR3x1.js → onboarding-Bgx1tJnU.js}

@@ -1,6 +1,6 @@
 import { Cu as formatCliCommand, Fn as ensureActiveMemoryPluginAllowlisted, Gu as resolveDefaultAgentId, Qt as readConfigFileSnapshot, Wu as resolveAgentWorkspaceDir, br as collectConfigServiceEnvVars, ma as ensureAuthProfileStore, tn as writeConfigFile } from "./env-C77feXxI.js";
 import { H as theme, x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
-import { A as waitForGatewayReachable, C as printWizardHeader, E as resolveControlUiLinks, Ha as CONTROL_UI_BOOT_CHECK_PATH, O as summarizeExistingConfig, S as openUrl, T as randomToken, Wa as normalizeControlUiBasePath, bo as enableTailscaleServe, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, g as formatControlUiSshHint, h as ensureWorkspaceAndSessions, k as validateGatewayPasswordInput, m as detectBrowserOpenSupport, to as runFederationAutoConnectOnce, v as handleOnboardingRepair, w as probeGatewayReachable, x as normalizeGatewayTokenInput, xo as findTailscaleBinary, yo as enableTailscaleFunnel } from "./model-catalog-DHRVUWBf.js";
+import { A as waitForGatewayReachable, C as printWizardHeader, E as resolveControlUiLinks, Ha as CONTROL_UI_BOOT_CHECK_PATH, O as summarizeExistingConfig, S as openUrl, T as randomToken, Wa as normalizeControlUiBasePath, bo as enableTailscaleServe, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, g as formatControlUiSshHint, h as ensureWorkspaceAndSessions, k as validateGatewayPasswordInput, m as detectBrowserOpenSupport, to as runFederationAutoConnectOnce, v as handleOnboardingRepair, w as probeGatewayReachable, x as normalizeGatewayTokenInput, xo as findTailscaleBinary, yo as enableTailscaleFunnel } from "./model-catalog-ex4Cpln_.js";
 import { A as defaultRuntime, Ct as resolveStateDir, E as redactSensitiveText, gt as resolveGatewayPort, j as restoreTerminalState } from "./entry.js";
 import { n as redactSensitiveUrlLikeString } from "./redact-sensitive-url-BW03TVj8.js";
 import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet--7Yu2hFw.js";
@@ -16,14 +16,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-B8OPQXFR.js";
 import { t as resolveGatewayService } from "./service-2JBjv-ge.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-COK5O0cM.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-BKbsAV5a.js";
-import { s as waitForHostedDashboardBrowserPath } from "./health-CD-e8iEW.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-CRcRJvDg.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-CHAO6E_x.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-DSDJ9Fn2.js";
+import { s as waitForHostedDashboardBrowserPath } from "./health-DW5NMpNI.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-D8Q1fQwa.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-Bs_OE3ai.js";
 import { n as logConfigUpdated } from "./logging-DZ32I_SP.js";
-import { n as setupChannels } from "./onboard-channels-fJXaj04M.js";
+import { n as setupChannels } from "./onboard-channels-CDXretWe.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-DRZciWMZ.js";
-import { t as runTui } from "./tui-Cvc1YA_t.js";
+import { t as runTui } from "./tui-CLXEsHbW.js";
 import { spawn, spawnSync } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
@@ -168,7 +168,7 @@ function isHostedSecurityCapableSession(explicitFlag = false) {
 		const sudoersPath = path.join("/etc/sudoers.d", `fased-host-maintenance-${currentUser}`);
 		if (fs.existsSync(sudoersPath)) return true;
 	}
-	return canRunHostedMaintenanceCommand("sudo -n tailscale status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n ufw status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n firewall-cmd --state >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl is-active --quiet firewalld >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
+	return canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailscale-status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailnet-ssh-ingress >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance firewall-baseline >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
 }
 
 //#endregion
@@ -546,16 +546,18 @@ async function installRootServiceMaintenanceAccess(params) {
 	const sudoers = [
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl start --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl enable --now ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName} *`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service --no-pager`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} *`
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service -p ActiveState --value`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl cat ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 120 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 120 --no-pager`
 	].join("\n");
 	return await runShell([
 		`echo '${Buffer.from(`${sudoers}\n`, "utf8").toString("base64")}' | base64 -d | sudo -n tee '${sudoersPath}' >/dev/null`,
@@ -2747,6 +2749,7 @@ const LOW_MEMORY_HOSTING_SWAP_GB = 4;
 const HOSTING_SWAP_GB = 2;
 const TAILSCALE_INTERACTIVE_TIMEOUT_MS = 120 * 1e3;
 const TAILSCALE_LOGIN_URL_RE = /https:\/\/login\.tailscale\.com\/a\/[A-Za-z0-9_-]+/i;
+const HOST_MAINTENANCE_HELPER = "/usr/local/sbin/fased-host-maintenance";
 function detectTotalMemoryMb() {
 	if (process.platform === "linux") try {
 		const match = fs.readFileSync("/proc/meminfo", "utf8").match(/^MemTotal:\s+(\d+)\s+kB/m);
@@ -2847,7 +2850,7 @@ function buildTailscaleLoginWaitCommand(command) {
 		`bash -lc ${shellQuote(command)} &`,
 		"ts_pid=$!",
 		"for _ in $(seq 1 55); do",
-		"  if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`  if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"    kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    wait \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    exit 0",
@@ -2860,7 +2863,7 @@ function buildTailscaleLoginWaitCommand(command) {
 		"done",
 		"kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"wait \"$ts_pid\" >/dev/null 2>&1 || true",
-		"if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"  exit 0",
 		"fi",
 		"exit 124"
@@ -2913,21 +2916,29 @@ function tailscaleTimedOutButReady(result, logPath, runner = run) {
 function shellQuote(value) {
 	return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function hostMaintenanceCommand(action) {
+	return `sudo -n ${HOST_MAINTENANCE_HELPER} ${action}`;
+}
+function hostMaintenanceCommandWithInput(action, input) {
+	return `printf '%s\\n' ${shellQuote(input)} | ${hostMaintenanceCommand(action)}`;
+}
 function isTailscaleLoggedIn(logPath, runner = run) {
-	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-status")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
 }
 function hasTailscaleIp(logPath, runner = run) {
-	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
 }
 function readTailscaleIp(logPath, runner = run) {
 	const probe = runner("tailscale ip -4", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale ip -4", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-ip4"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale ip -4", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return;
 	return sudoProbe.detail.match(/\b\d{1,3}(?:\.\d{1,3}){3}\b/)?.[0];
 }
 function readTailscaleSelf(logPath, runner = run) {
 	const probe = runner("tailscale status --json", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale status --json", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-status-json"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale status --json", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return { ipv4: readTailscaleIp(logPath, runner) };
 	try {
 		const parsed = JSON.parse(sudoProbe.detail);
@@ -3033,7 +3044,8 @@ function verifyTailnetSshServerPrerequisites(params) {
 	};
 }
 function ensureTailnetSshIngressForVerification(params) {
-	const result = (params.runner ?? run)([
+	const runner = params.runner ?? run;
+	const command = [
 		"if command -v ufw >/dev/null 2>&1; then",
 		"  if sudo -n ufw status | grep -qi '^Status: active'; then",
 		"    sudo -n ufw insert 1 allow in on tailscale0 to any port 22 proto tcp || sudo -n ufw allow in on tailscale0 to any port 22 proto tcp",
@@ -3044,7 +3056,9 @@ function ensureTailnetSshIngressForVerification(params) {
 		"  sudo -n firewall-cmd --permanent --zone=trusted --add-interface=tailscale0 >/dev/null 2>&1 || true",
 		"  sudo -n firewall-cmd --reload >/dev/null 2>&1 || true",
 		"fi"
-	].join("\n"), params.logPath);
+	].join("\n");
+	const helperResult = runner(hostMaintenanceCommand("tailnet-ssh-ingress"), params.logPath);
+	const result = helperResult.ok ? helperResult : runner(command, params.logPath);
 	if (!result.ok) return {
 		ok: false,
 		detail: result.detail ?? "could not prepare tailnet SSH firewall rule before verification"
@@ -3131,7 +3145,7 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				return false;
 			}
 			await prompter.note(formatTailscaleAccountBrowserLoginNote(), "Tailscale login");
-			const tsReset = await interactiveRunner("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
+			const tsReset = await interactiveRunner(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			const acceptedTimedOutLogin = tailscaleTimedOutButReady(tsReset, logPath, runner);
 			if (!tsReset.ok && !acceptedTimedOutLogin || !hasTailscaleIp(logPath, runner)) {
 				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
@@ -3175,9 +3189,9 @@ function ensureTailscaleServe(port, logPath) {
 		ok: true,
 		detail: `tailscale serve --bg -> 127.0.0.1:${port}`
 	};
-	if (run(`sudo -n tailscale serve --bg http://127.0.0.1:${port}`, logPath).ok) return {
+	if (run(hostMaintenanceCommandWithInput("tailscale-serve", String(port)), logPath).ok) return {
 		ok: true,
-		detail: `sudo tailscale serve --bg -> 127.0.0.1:${port}`
+		detail: `host maintenance tailscale serve -> 127.0.0.1:${port}`
 	};
 	if (run(`tailscale serve https / http://127.0.0.1:${port}`, logPath).ok) return {
 		ok: true,
@@ -3201,7 +3215,7 @@ function isTailscaleServeReady(port) {
 		],
 		encoding: "utf8"
 	});
-	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", "sudo -n tailscale serve status"], {
+	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", hostMaintenanceCommand("tailscale-serve-status")], {
 		stdio: [
 			"ignore",
 			"pipe",
@@ -3234,6 +3248,7 @@ function packageInstallCommand(packages) {
 }
 function tailscaleInstallCommand() {
 	return [
+		`${hostMaintenanceCommand("tailscale-install-start")} && exit 0`,
 		"if command -v tailscale >/dev/null 2>&1; then",
 		"  :",
 		"elif command -v apt-get >/dev/null 2>&1; then",
@@ -3259,6 +3274,7 @@ function tailscaleInstallCommand() {
 }
 function firewallBaselineCommand() {
 	return [
+		`${hostMaintenanceCommand("firewall-baseline")} && exit 0`,
 		"if command -v ufw >/dev/null 2>&1 || command -v apt-get >/dev/null 2>&1; then",
 		"  command -v ufw >/dev/null 2>&1 || { " + packageInstallCommand(["ufw"]) + "; }",
 		"  sudo -n ufw default deny incoming",
@@ -3282,6 +3298,7 @@ function firewallBaselineCommand() {
 }
 function automaticUpdatesCommand() {
 	return [
+		`${hostMaintenanceCommand("automatic-updates")} && exit 0`,
 		"if command -v apt-get >/dev/null 2>&1; then",
 		"  " + packageInstallCommand(["unattended-upgrades"]),
 		"  sudo -n systemctl enable --now unattended-upgrades >/dev/null 2>&1 || true",
@@ -3300,15 +3317,7 @@ function automaticUpdatesCommand() {
 	].join("\n");
 }
 function sshHardeningCommand() {
-	return [
-		"if sudo -n /usr/local/sbin/fased-host-maintenance harden-ssh >/dev/null 2>&1; then",
-		"  :",
-		"else",
-		"  sudo -n sed -i 's/^#\\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config",
-		"  sudo -n sed -i 's/^#\\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config",
-		"  sudo -n systemctl restart ssh || sudo -n systemctl restart sshd",
-		"fi"
-	].join("\n");
+	return hostMaintenanceCommand("harden-ssh");
 }
 function failOrContinue(params) {
 	const { opts, runtime, step, detail } = params;
@@ -3354,7 +3363,7 @@ async function applyHostingSecurity(params) {
 			validate: (value) => value.trim() ? void 0 : "Required"
 		})).trim();
 		else await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-		const resetCommand = tsAuthkey ? `sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset --authkey ${JSON.stringify(tsAuthkey)}` : "sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset";
+		const resetCommand = tsAuthkey ? hostMaintenanceCommandWithInput("tailscale-up-reset-authkey-ssh", tsAuthkey) : hostMaintenanceCommand("tailscale-up-reset-ssh");
 		const tsReset = tsAuthkey ? run(resetCommand, logPath) : await runInteractiveTailscaleLogin(resetCommand, logPath, prompter);
 		if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) return {
 			ok: false,
@@ -3478,7 +3487,7 @@ async function applyHostingSecurity(params) {
 				logPath
 			};
 		}
-	} else if (hasCommand("systemctl")) run("sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true", logPath);
+	} else if (hasCommand("systemctl")) run(`${hostMaintenanceCommand("tailscale-install-start")} >/dev/null 2>&1 || sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true`, logPath);
 	if (prompter && opts.nonInteractive !== true) await prompter.note(formatLocalDeviceTailnetRequirementNote(), "Local device requirement");
 	let tsHealthy = isTailscaleLoggedIn(logPath);
 	if (tsHealthy && prompter && opts.nonInteractive !== true) {
@@ -3487,7 +3496,7 @@ async function applyHostingSecurity(params) {
 			initialValue: false
 		})) {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsReset = await runInteractiveTailscaleLogin("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
+			const tsReset = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3530,7 +3539,7 @@ async function applyHostingSecurity(params) {
 			})).trim();
 		}
 		if (tsAuthkey) {
-			const tsUp = run(`sudo -n tailscale up --authkey ${JSON.stringify(tsAuthkey)} --ssh`, logPath);
+			const tsUp = run(hostMaintenanceCommandWithInput("tailscale-up-authkey-ssh", tsAuthkey), logPath);
 			if (!tsUp.ok) {
 				checks.push({
 					name: "tailscale",
@@ -3574,7 +3583,7 @@ async function applyHostingSecurity(params) {
 			};
 		} else {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsUp = await runInteractiveTailscaleLogin("sudo -n tailscale up --ssh", logPath, prompter);
+			const tsUp = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-ssh"), logPath, prompter);
 			if (!tsUp.ok && !tailscaleTimedOutButReady(tsUp, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3629,7 +3638,7 @@ async function applyHostingSecurity(params) {
 		detail: "tailnet IP present; verifying app SSH before lock-down"
 	});
 	const operatorUser = run("id -u app >/dev/null 2>&1", logPath).ok ? "app" : process.env.SUDO_USER?.trim() || process.env.USER?.trim() || process.env.LOGNAME?.trim();
-	if (operatorUser) run(`sudo -n tailscale set --operator='${operatorUser}' >/dev/null 2>&1 || true`, logPath);
+	if (operatorUser) run(`${hostMaintenanceCommand("tailscale-set-operator-self")} >/dev/null 2>&1 || true`, logPath);
 	if (!await confirmTailnetSshBeforeLockdown({
 		opts,
 		runtime,
@@ -3726,7 +3735,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "password auth/root login disabled and ssh restarted"
 	});
-	const f2bRes = runHostSetupCommand(`${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban`);
+	const f2bRes = runHostSetupCommand(`${hostMaintenanceCommand("fail2ban-enable")} || (${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban)`);
 	if (!f2bRes.ok) {
 		checks.push({
 			name: "fail2ban",

package/dist/{onboarding-Bejkgd8a.js → onboarding-CBlXOasA.js}

@@ -1,7 +1,7 @@
 import { _ as resolveStateDir, u as resolveGatewayPort } from "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, U as theme } from "./agent-paths-DmOVZE7g.js";
 import { Ga as ensureAuthProfileStore, Mn as writeConfigFile, Zr as collectConfigServiceEnvVars, d as resolveDefaultAgentId, dd as formatCliCommand, fr as ensureActiveMemoryPluginAllowlisted, kn as readConfigFileSnapshot, u as resolveAgentWorkspaceDir } from "./agent-scope-DHrLr5OF.js";
-import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-BRoR6TOO.js";
+import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-B034LmuD.js";
 import { d as defaultRuntime, f as restoreTerminalState, s as redactSensitiveText } from "./errors-Dx3S3Nrp.js";
 import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-CQG8MiG_.js";
 import { i as resolveLocalSignerRunAsUser, n as resolveLocalSignerBackendSocketPath, o as resolveLocalSignerSocketPath, r as resolveLocalSignerMaterialRootDir, t as ensureWalletStateDir } from "./wallet-runtime-config-BlRWvEER.js";
@@ -17,14 +17,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-CmxDYXvt.js";
 import { t as resolveGatewayService } from "./service-Bsg622jp.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-BRLbvcxT.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-Bxa3Ql2B.js";
-import { o as waitForHostedDashboardBrowserPath } from "./health-c7sJIXY9.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DCd_rmJr.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-BBY8vO5H.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-B42xQEbV.js";
+import { o as waitForHostedDashboardBrowserPath } from "./health-kF4U3o3b.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DRyuJ7OL.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-EOHB6Adp.js";
 import { n as logConfigUpdated } from "./logging-Dv2wthF_.js";
-import { n as setupChannels } from "./onboard-channels-BREKCcFf.js";
+import { n as setupChannels } from "./onboard-channels-ZnUGKi2j.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-BielXMUB.js";
-import { t as runTui } from "./tui-CIzUfHHB.js";
+import { t as runTui } from "./tui-CF9NTWgo.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -169,7 +169,7 @@ function isHostedSecurityCapableSession(explicitFlag = false) {
 		const sudoersPath = path.join("/etc/sudoers.d", `fased-host-maintenance-${currentUser}`);
 		if (fs.existsSync(sudoersPath)) return true;
 	}
-	return canRunHostedMaintenanceCommand("sudo -n tailscale status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n ufw status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n firewall-cmd --state >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl is-active --quiet firewalld >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
+	return canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailscale-status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailnet-ssh-ingress >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance firewall-baseline >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
 }
 
 //#endregion
@@ -547,16 +547,18 @@ async function installRootServiceMaintenanceAccess(params) {
 	const sudoers = [
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl start --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl enable --now ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName} *`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service --no-pager`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} *`
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service -p ActiveState --value`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl cat ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 120 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 120 --no-pager`
 	].join("\n");
 	return await runShell([
 		`echo '${Buffer.from(`${sudoers}\n`, "utf8").toString("base64")}' | base64 -d | sudo -n tee '${sudoersPath}' >/dev/null`,
@@ -2748,6 +2750,7 @@ const LOW_MEMORY_HOSTING_SWAP_GB = 4;
 const HOSTING_SWAP_GB = 2;
 const TAILSCALE_INTERACTIVE_TIMEOUT_MS = 120 * 1e3;
 const TAILSCALE_LOGIN_URL_RE = /https:\/\/login\.tailscale\.com\/a\/[A-Za-z0-9_-]+/i;
+const HOST_MAINTENANCE_HELPER = "/usr/local/sbin/fased-host-maintenance";
 function detectTotalMemoryMb() {
 	if (process.platform === "linux") try {
 		const match = fs.readFileSync("/proc/meminfo", "utf8").match(/^MemTotal:\s+(\d+)\s+kB/m);
@@ -2848,7 +2851,7 @@ function buildTailscaleLoginWaitCommand(command) {
 		`bash -lc ${shellQuote(command)} &`,
 		"ts_pid=$!",
 		"for _ in $(seq 1 55); do",
-		"  if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`  if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"    kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    wait \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    exit 0",
@@ -2861,7 +2864,7 @@ function buildTailscaleLoginWaitCommand(command) {
 		"done",
 		"kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"wait \"$ts_pid\" >/dev/null 2>&1 || true",
-		"if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"  exit 0",
 		"fi",
 		"exit 124"
@@ -2914,21 +2917,29 @@ function tailscaleTimedOutButReady(result, logPath, runner = run) {
 function shellQuote(value) {
 	return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function hostMaintenanceCommand(action) {
+	return `sudo -n ${HOST_MAINTENANCE_HELPER} ${action}`;
+}
+function hostMaintenanceCommandWithInput(action, input) {
+	return `printf '%s\\n' ${shellQuote(input)} | ${hostMaintenanceCommand(action)}`;
+}
 function isTailscaleLoggedIn(logPath, runner = run) {
-	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-status")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
 }
 function hasTailscaleIp(logPath, runner = run) {
-	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
 }
 function readTailscaleIp(logPath, runner = run) {
 	const probe = runner("tailscale ip -4", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale ip -4", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-ip4"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale ip -4", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return;
 	return sudoProbe.detail.match(/\b\d{1,3}(?:\.\d{1,3}){3}\b/)?.[0];
 }
 function readTailscaleSelf(logPath, runner = run) {
 	const probe = runner("tailscale status --json", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale status --json", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-status-json"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale status --json", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return { ipv4: readTailscaleIp(logPath, runner) };
 	try {
 		const parsed = JSON.parse(sudoProbe.detail);
@@ -3034,7 +3045,8 @@ function verifyTailnetSshServerPrerequisites(params) {
 	};
 }
 function ensureTailnetSshIngressForVerification(params) {
-	const result = (params.runner ?? run)([
+	const runner = params.runner ?? run;
+	const command = [
 		"if command -v ufw >/dev/null 2>&1; then",
 		"  if sudo -n ufw status | grep -qi '^Status: active'; then",
 		"    sudo -n ufw insert 1 allow in on tailscale0 to any port 22 proto tcp || sudo -n ufw allow in on tailscale0 to any port 22 proto tcp",
@@ -3045,7 +3057,9 @@ function ensureTailnetSshIngressForVerification(params) {
 		"  sudo -n firewall-cmd --permanent --zone=trusted --add-interface=tailscale0 >/dev/null 2>&1 || true",
 		"  sudo -n firewall-cmd --reload >/dev/null 2>&1 || true",
 		"fi"
-	].join("\n"), params.logPath);
+	].join("\n");
+	const helperResult = runner(hostMaintenanceCommand("tailnet-ssh-ingress"), params.logPath);
+	const result = helperResult.ok ? helperResult : runner(command, params.logPath);
 	if (!result.ok) return {
 		ok: false,
 		detail: result.detail ?? "could not prepare tailnet SSH firewall rule before verification"
@@ -3132,7 +3146,7 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				return false;
 			}
 			await prompter.note(formatTailscaleAccountBrowserLoginNote(), "Tailscale login");
-			const tsReset = await interactiveRunner("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
+			const tsReset = await interactiveRunner(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			const acceptedTimedOutLogin = tailscaleTimedOutButReady(tsReset, logPath, runner);
 			if (!tsReset.ok && !acceptedTimedOutLogin || !hasTailscaleIp(logPath, runner)) {
 				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
@@ -3176,9 +3190,9 @@ function ensureTailscaleServe(port, logPath) {
 		ok: true,
 		detail: `tailscale serve --bg -> 127.0.0.1:${port}`
 	};
-	if (run(`sudo -n tailscale serve --bg http://127.0.0.1:${port}`, logPath).ok) return {
+	if (run(hostMaintenanceCommandWithInput("tailscale-serve", String(port)), logPath).ok) return {
 		ok: true,
-		detail: `sudo tailscale serve --bg -> 127.0.0.1:${port}`
+		detail: `host maintenance tailscale serve -> 127.0.0.1:${port}`
 	};
 	if (run(`tailscale serve https / http://127.0.0.1:${port}`, logPath).ok) return {
 		ok: true,
@@ -3202,7 +3216,7 @@ function isTailscaleServeReady(port) {
 		],
 		encoding: "utf8"
 	});
-	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", "sudo -n tailscale serve status"], {
+	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", hostMaintenanceCommand("tailscale-serve-status")], {
 		stdio: [
 			"ignore",
 			"pipe",
@@ -3235,6 +3249,7 @@ function packageInstallCommand(packages) {
 }
 function tailscaleInstallCommand() {
 	return [
+		`${hostMaintenanceCommand("tailscale-install-start")} && exit 0`,
 		"if command -v tailscale >/dev/null 2>&1; then",
 		"  :",
 		"elif command -v apt-get >/dev/null 2>&1; then",
@@ -3260,6 +3275,7 @@ function tailscaleInstallCommand() {
 }
 function firewallBaselineCommand() {
 	return [
+		`${hostMaintenanceCommand("firewall-baseline")} && exit 0`,
 		"if command -v ufw >/dev/null 2>&1 || command -v apt-get >/dev/null 2>&1; then",
 		"  command -v ufw >/dev/null 2>&1 || { " + packageInstallCommand(["ufw"]) + "; }",
 		"  sudo -n ufw default deny incoming",
@@ -3283,6 +3299,7 @@ function firewallBaselineCommand() {
 }
 function automaticUpdatesCommand() {
 	return [
+		`${hostMaintenanceCommand("automatic-updates")} && exit 0`,
 		"if command -v apt-get >/dev/null 2>&1; then",
 		"  " + packageInstallCommand(["unattended-upgrades"]),
 		"  sudo -n systemctl enable --now unattended-upgrades >/dev/null 2>&1 || true",
@@ -3301,15 +3318,7 @@ function automaticUpdatesCommand() {
 	].join("\n");
 }
 function sshHardeningCommand() {
-	return [
-		"if sudo -n /usr/local/sbin/fased-host-maintenance harden-ssh >/dev/null 2>&1; then",
-		"  :",
-		"else",
-		"  sudo -n sed -i 's/^#\\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config",
-		"  sudo -n sed -i 's/^#\\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config",
-		"  sudo -n systemctl restart ssh || sudo -n systemctl restart sshd",
-		"fi"
-	].join("\n");
+	return hostMaintenanceCommand("harden-ssh");
 }
 function failOrContinue(params) {
 	const { opts, runtime, step, detail } = params;
@@ -3355,7 +3364,7 @@ async function applyHostingSecurity(params) {
 			validate: (value) => value.trim() ? void 0 : "Required"
 		})).trim();
 		else await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-		const resetCommand = tsAuthkey ? `sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset --authkey ${JSON.stringify(tsAuthkey)}` : "sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset";
+		const resetCommand = tsAuthkey ? hostMaintenanceCommandWithInput("tailscale-up-reset-authkey-ssh", tsAuthkey) : hostMaintenanceCommand("tailscale-up-reset-ssh");
 		const tsReset = tsAuthkey ? run(resetCommand, logPath) : await runInteractiveTailscaleLogin(resetCommand, logPath, prompter);
 		if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) return {
 			ok: false,
@@ -3479,7 +3488,7 @@ async function applyHostingSecurity(params) {
 				logPath
 			};
 		}
-	} else if (hasCommand("systemctl")) run("sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true", logPath);
+	} else if (hasCommand("systemctl")) run(`${hostMaintenanceCommand("tailscale-install-start")} >/dev/null 2>&1 || sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true`, logPath);
 	if (prompter && opts.nonInteractive !== true) await prompter.note(formatLocalDeviceTailnetRequirementNote(), "Local device requirement");
 	let tsHealthy = isTailscaleLoggedIn(logPath);
 	if (tsHealthy && prompter && opts.nonInteractive !== true) {
@@ -3488,7 +3497,7 @@ async function applyHostingSecurity(params) {
 			initialValue: false
 		})) {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsReset = await runInteractiveTailscaleLogin("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
+			const tsReset = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3531,7 +3540,7 @@ async function applyHostingSecurity(params) {
 			})).trim();
 		}
 		if (tsAuthkey) {
-			const tsUp = run(`sudo -n tailscale up --authkey ${JSON.stringify(tsAuthkey)} --ssh`, logPath);
+			const tsUp = run(hostMaintenanceCommandWithInput("tailscale-up-authkey-ssh", tsAuthkey), logPath);
 			if (!tsUp.ok) {
 				checks.push({
 					name: "tailscale",
@@ -3575,7 +3584,7 @@ async function applyHostingSecurity(params) {
 			};
 		} else {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsUp = await runInteractiveTailscaleLogin("sudo -n tailscale up --ssh", logPath, prompter);
+			const tsUp = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-ssh"), logPath, prompter);
 			if (!tsUp.ok && !tailscaleTimedOutButReady(tsUp, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3630,7 +3639,7 @@ async function applyHostingSecurity(params) {
 		detail: "tailnet IP present; verifying app SSH before lock-down"
 	});
 	const operatorUser = run("id -u app >/dev/null 2>&1", logPath).ok ? "app" : process.env.SUDO_USER?.trim() || process.env.USER?.trim() || process.env.LOGNAME?.trim();
-	if (operatorUser) run(`sudo -n tailscale set --operator='${operatorUser}' >/dev/null 2>&1 || true`, logPath);
+	if (operatorUser) run(`${hostMaintenanceCommand("tailscale-set-operator-self")} >/dev/null 2>&1 || true`, logPath);
 	if (!await confirmTailnetSshBeforeLockdown({
 		opts,
 		runtime,
@@ -3727,7 +3736,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "password auth/root login disabled and ssh restarted"
 	});
-	const f2bRes = runHostSetupCommand(`${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban`);
+	const f2bRes = runHostSetupCommand(`${hostMaintenanceCommand("fail2ban-enable")} || (${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban)`);
 	if (!f2bRes.ok) {
 		checks.push({
 			name: "fail2ban",

package/dist/{openresponses-http-BR0xNXbf.js → openresponses-http-5S3xc2MZ.js}

@@ -2,7 +2,7 @@ import { Ui as logWarn, wa as defaultRuntime } from "./agent-scope-Cb1u7HE7.js";
 import "./github-copilot-token-DYrFvncE.js";
 import "./send-vR6HwT94.js";
 import "./send-BQMxv218.js";
-import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-Dtw2m41q.js";
+import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-Bnuo5tPq.js";
 import "./diagnostic-D6XQAXl4.js";
 import "./diagnostic-session-state-CexmAKza.js";
 import "./send-Da1hCe1A.js";

package/dist/{openresponses-http-CyP-RUzR.js → openresponses-http-BBNbIRzc.js}

@@ -2,7 +2,7 @@ import { Sa as defaultRuntime, Vi as logWarn } from "./agent-scope-DUKEZjqM.js";
 import "./github-copilot-token-CNsqwfnE.js";
 import "./send-CFSRf7De.js";
 import "./send-gtmn6YeH.js";
-import { B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as sendJson, et as emitAgentEvent, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, tt as onAgentEvent, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-G-VYb-eT.js";
+import { B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as sendJson, et as emitAgentEvent, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, tt as onAgentEvent, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-CeuBUTjd.js";
 import "./reply-prefix-Bitnsmpd.js";
 import "./diagnostic-_BiQ6GgD.js";
 import "./diagnostic-session-state-CL_QxyRg.js";

package/dist/{openresponses-http-BYKqYqIr.js → openresponses-http-BTpFUwym.js}

@@ -1,6 +1,6 @@
 import "./github-copilot-token-Dy7Y_jbI.js";
 import { la as logWarn, qo as defaultRuntime } from "./paths-OUJyk-5R.js";
-import { B as extractImageContentFromSource, F as DEFAULT_INPUT_IMAGE_MAX_BYTES, H as resolveInputFileLimits, I as DEFAULT_INPUT_IMAGE_MIMES, L as DEFAULT_INPUT_MAX_REDIRECTS, R as DEFAULT_INPUT_TIMEOUT_MS, V as normalizeMimeList, X as emitAgentEvent, Z as onAgentEvent, a as agentCommand, at as sendJson, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, z as extractFileContentFromSource } from "./auth-D6aXaEgt.js";
+import { B as extractImageContentFromSource, F as DEFAULT_INPUT_IMAGE_MAX_BYTES, H as resolveInputFileLimits, I as DEFAULT_INPUT_IMAGE_MIMES, L as DEFAULT_INPUT_MAX_REDIRECTS, R as DEFAULT_INPUT_TIMEOUT_MS, V as normalizeMimeList, X as emitAgentEvent, Z as onAgentEvent, a as agentCommand, at as sendJson, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, z as extractFileContentFromSource } from "./auth-BbQxXxtt.js";
 import "./send-D96gGRQz.js";
 import "./send-BFoI9HuU.js";
 import "./skill-commands-DvoCSQnx.js";

package/dist/{openresponses-http-DNXaz2VR.js → openresponses-http-COAxhJal.js}

@@ -2,7 +2,7 @@ import { bd as logWarn } from "./env-C77feXxI.js";
 import "./agent-paths-BI1hx-tF.js";
 import "./send-D7X0_iFp.js";
 import "./send-BFEd4vCM.js";
-import { Ai as buildAgentMessageFromConversationEntries, Ii as resolveAssistantStreamDeltaText, Li as agentCommand, _a as resolveAgentIdForRequest, an as DEFAULT_INPUT_IMAGE_MAX_BYTES, ba as setSseHeaders, cn as DEFAULT_INPUT_TIMEOUT_MS, dn as normalizeMimeList, fn as resolveInputFileLimits, ia as emitAgentEvent, ki as handleGatewayPostJsonEndpoint, ln as extractFileContentFromSource, oa as onAgentEvent, on as DEFAULT_INPUT_IMAGE_MIMES, sn as DEFAULT_INPUT_MAX_REDIRECTS, un as extractImageContentFromSource, va as resolveSessionKey, xa as writeDone, ya as sendJson } from "./model-catalog-DHRVUWBf.js";
+import { Ai as buildAgentMessageFromConversationEntries, Ii as resolveAssistantStreamDeltaText, Li as agentCommand, _a as resolveAgentIdForRequest, an as DEFAULT_INPUT_IMAGE_MAX_BYTES, ba as setSseHeaders, cn as DEFAULT_INPUT_TIMEOUT_MS, dn as normalizeMimeList, fn as resolveInputFileLimits, ia as emitAgentEvent, ki as handleGatewayPostJsonEndpoint, ln as extractFileContentFromSource, oa as onAgentEvent, on as DEFAULT_INPUT_IMAGE_MIMES, sn as DEFAULT_INPUT_MAX_REDIRECTS, un as extractImageContentFromSource, va as resolveSessionKey, xa as writeDone, ya as sendJson } from "./model-catalog-ex4Cpln_.js";
 import "./github-copilot-token-A9DiaCB0.js";
 import { A as defaultRuntime } from "./entry.js";
 import "./reply-prefix-TUhpEtvr.js";
@@ -45,7 +45,7 @@ import "./send-C-su1wPZ.js";
 import "./outbound-attachment-Bh4FmcYg.js";
 import "./fetch-BVvWzHT_.js";
 import "./delivery-queue-55Cityuq.js";
-import { t as createDefaultDeps } from "./deps-BoCGz3bU.js";
+import { t as createDefaultDeps } from "./deps-BWo3ls9h.js";
 import "./frontmatter-D2UNJikU.js";
 import "./skills-Dis31awJ.js";
 import "./skills-remote-CIAB0AXm.js";