@fased/fased 0.1.19 → 0.1.21

package/dist/{onboard-channels-BREKCcFf.js → onboard-channels-C4gBvkYQ.js}

@@ -1,6 +1,6 @@
 import { _ as normalizeE164, i as CONFIG_DIR, v as pathExists } from "./agent-paths-DmOVZE7g.js";
 import { $l as runCommandWithTimeout, B as listChatChannels, Bd as listDiscordAccountIds, Dd as listSlackAccountIds, F as createSubsystemLogger, Fd as resolveSignalAccount, Hd as resolveDefaultDiscordAccountId, Hu as resolveDefaultWhatsAppAccountId, Id as listIMessageAccountIds, L as formatChannelPrimerLine, Ld as resolveDefaultIMessageAccountId, Mu as getChannelPlugin, Nd as listSignalAccountIds, Nu as listChannelPlugins, Od as resolveDefaultSlackAccountId, Pd as resolveDefaultSignalAccountId, R as formatChannelSelectionLine, Rd as resolveIMessageAccount, Ud as resolveDiscordAccount, Vu as listWhatsAppAccountIds, Wu as resolveWhatsAppAuthDir, _d as resolveDefaultTelegramAccountId, d as resolveDefaultAgentId, dd as formatCliCommand, gd as listTelegramAccountIds, kd as resolveSlackAccount, ld as stripAnsi, mo as resolveFasedAgentPackageRootSync, ou as extractArchive, u as resolveAgentWorkspaceDir, vd as resolveTelegramAccount, wl as installPluginFromNpmSpec } from "./agent-scope-DHrLr5OF.js";
-import { Ft as resolveSlackUserAllowlist, It as resolveSlackChannelAllowlist, Nt as loadFasedAgentPlugins, la as createPluginLoaderLogger, mn as resolveDiscordChannelAllowlist, pn as resolveDiscordUserAllowlist, zt as detectBinary } from "./reply-BRoR6TOO.js";
+import { Ft as resolveSlackUserAllowlist, It as resolveSlackChannelAllowlist, Nt as loadFasedAgentPlugins, la as createPluginLoaderLogger, mn as resolveDiscordChannelAllowlist, pn as resolveDiscordUserAllowlist, zt as detectBinary } from "./reply-701mJB_S.js";
 import { h as normalizeAccountId, m as DEFAULT_ACCOUNT_ID } from "./session-key-LmCHAJTQ.js";
 import { dt as normalizeDiscordSlug } from "./send-jxmRy65D.js";
 import { i as isBlockedHostnameOrIp } from "./ssrf-Blf4NrHS.js";
@@ -12,7 +12,7 @@ import { t as resolveBrewExecutable } from "./brew-C52GeCeh.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-BvDnvwsE.js";
 import { t as enablePluginInConfig } from "./enable-D3_YPNIT.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-DDbnXe4x.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-DKOezW7h.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-D2VlrxY8.js";
 import { t as fetchTelegramChatId } from "./api-DLdLLQm_.js";
 import fs, { createWriteStream, readFileSync } from "node:fs";
 import os from "node:os";

package/dist/{onboard-channels-fJXaj04M.js → onboard-channels-CDr6F5Rc.js}

@@ -1,7 +1,7 @@
 import { $c as installPluginFromNpmSpec, $d as resolveDiscordAccount, $l as listWhatsAppAccountIds, Au as resolveTelegramAccount, Cu as formatCliCommand, Gd as resolveSignalAccount, Gl as listChannelPlugins, Gu as resolveDefaultAgentId, Jd as resolveIMessageAccount, Kd as listIMessageAccountIds, Ld as listSlackAccountIds, Ou as listTelegramAccountIds, Qd as resolveDefaultDiscordAccountId, Rd as resolveDefaultSlackAccountId, Ud as listSignalAccountIds, Wd as resolveDefaultSignalAccountId, Wl as getChannelPlugin, Wu as resolveAgentWorkspaceDir, Xd as listDiscordAccountIds, a as createSubsystemLogger, c as formatChannelSelectionLine, eu as resolveDefaultWhatsAppAccountId, ku as resolveDefaultTelegramAccountId, md as runCommandWithTimeout, nu as resolveWhatsAppAuthDir, pd as resolveFasedAgentPackageRootSync, qd as resolveDefaultIMessageAccountId, s as formatChannelPrimerLine, u as listChatChannels, xl as extractArchive, xu as stripAnsi, zd as resolveSlackAccount } from "./env-C77feXxI.js";
 import { _ as pathExists, g as normalizeE164, i as CONFIG_DIR } from "./agent-paths-BI1hx-tF.js";
 import { dt as normalizeDiscordSlug } from "./send-BFEd4vCM.js";
-import { Oi as createPluginLoaderLogger, Qt as resolveDiscordUserAllowlist, V as resolveDiscordChannelAllowlist, Zt as resolveSlackUserAllowlist, c as loadFasedAgentPlugins, p as detectBinary, u as resolveSlackChannelAllowlist } from "./model-catalog-DHRVUWBf.js";
+import { Oi as createPluginLoaderLogger, Qt as resolveDiscordUserAllowlist, V as resolveDiscordChannelAllowlist, Zt as resolveSlackUserAllowlist, c as loadFasedAgentPlugins, p as detectBinary, u as resolveSlackChannelAllowlist } from "./model-catalog-BQ5G4eK6.js";
 import { J as DEFAULT_ACCOUNT_ID, Y as normalizeAccountId } from "./entry.js";
 import { i as isBlockedHostnameOrIp } from "./ssrf-CqV2hisj.js";
 import { d as listChannelPluginCatalogEntries, f as resolveChannelPluginExpectedPluginIds, l as formatChannelPluginCatalogSelectionHint, s as isChannelConfigured, u as formatChannelPluginCatalogStatusLine } from "./dangerous-name-matching-CFRKz8Uq.js";
@@ -12,7 +12,7 @@ import { t as loginWeb } from "./login-CuawnITW.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-BfdkoReO.js";
 import { t as enablePluginInConfig } from "./enable-C4xB2A3x.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-Cha8QIzO.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-DE4kux0k.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-C5O_poBp.js";
 import { t as fetchTelegramChatId } from "./api-uvDKewCP.js";
 import { spawn } from "node:child_process";
 import os from "node:os";

package/dist/{onboard-search-C6A1sfph.js → onboard-search-BDLus6nY.js}

@@ -2,7 +2,7 @@ import { $c as installPluginFromNpmSpec, Wa as coerceSecretRef, pd as resolveFas
 import { i as CONFIG_DIR, p as isRecord, x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
 import "./send-D7X0_iFp.js";
 import "./send-BFEd4vCM.js";
-import "./model-catalog-DHRVUWBf.js";
+import "./model-catalog-BQ5G4eK6.js";
 import "./github-copilot-token-A9DiaCB0.js";
 import "./reply-prefix-TUhpEtvr.js";
 import "./memory-2keYbXkc.js";
@@ -30,10 +30,10 @@ import "./dangerous-tools-CusV9bcr.js";
 import "./chrome-bxkNKPA7.js";
 import "./pairing-token-C2iKEhFc.js";
 import "./ws-DiFJ3zRB.js";
-import "./onboarding.wallet--7Yu2hFw.js";
+import "./onboarding.wallet-B87UVKiT.js";
 import "./wallet-runtime-config-TjiNNY9x.js";
 import "./wallet-provider-registry-CFNtQ2ZR.js";
-import "./wallet-C95r3fvu.js";
+import "./wallet-CJdBRqTq.js";
 import "./wallet-approval-auth-BaVTLG5r.js";
 import "./runtime-DXHXAPJA.js";
 import "./device-identity-ZHUQ6a8N.js";
@@ -44,7 +44,7 @@ import "./send-C-su1wPZ.js";
 import "./outbound-attachment-Bh4FmcYg.js";
 import "./fetch-BVvWzHT_.js";
 import "./delivery-queue-55Cityuq.js";
-import "./deps-BoCGz3bU.js";
+import "./deps-DdP-Hmxc.js";
 import "./frontmatter-D2UNJikU.js";
 import "./skills-Dis31awJ.js";
 import "./skills-remote-CIAB0AXm.js";
@@ -75,10 +75,10 @@ import "./prompt-style-Rmj3c-Ir.js";
 import "./pairing-labels-BCM1S2e_.js";
 import { t as enablePluginInConfig } from "./enable-C4xB2A3x.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-Cha8QIzO.js";
-import "./status-DhGsqqOx.js";
+import "./status-DoLjTnlQ.js";
 import "./update-D4rhRm3D.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-DE4kux0k.js";
-import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-BC_EmT37.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-C5O_poBp.js";
+import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-AAOfSU2b.js";
 import path from "node:path";
 import fs from "node:fs";
 

package/dist/{onboard-search-D-tM9Xrg.js → onboard-search-BzpbxIgm.js}

@@ -2,7 +2,7 @@ import "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, i as CONFIG_DIR, m as isRecord } from "./agent-paths-DmOVZE7g.js";
 import { Co as coerceSecretRef, mo as resolveFasedAgentPackageRootSync, wl as installPluginFromNpmSpec } from "./agent-scope-DHrLr5OF.js";
 import "./commands-registry-BRvZQ1jh.js";
-import "./reply-BRoR6TOO.js";
+import "./reply-701mJB_S.js";
 import "./errors-Dx3S3Nrp.js";
 import "./send-C5_fB8YQ.js";
 import "./send-jxmRy65D.js";
@@ -14,10 +14,10 @@ import "./chrome-mXtDMFyZ.js";
 import "./pairing-token-BFGorDQo.js";
 import "./ip-D_T5zbZS.js";
 import "./ws-cvQhrVP3.js";
-import "./onboarding.wallet-CQG8MiG_.js";
+import "./onboarding.wallet-BFJRJg77.js";
 import "./wallet-runtime-config-BlRWvEER.js";
 import "./wallet-provider-registry-ax0NJo0F.js";
-import "./wallet-BguV7zPF.js";
+import "./wallet-DZA0r3pV.js";
 import "./wallet-approval-auth-DT-vofLs.js";
 import "./reply-prefix-C2EEc3pc.js";
 import "./media-C5BIKO-v.js";
@@ -37,7 +37,7 @@ import "./ssrf-Blf4NrHS.js";
 import "./outbound-attachment-CsXJwFsg.js";
 import "./fetch-CnCPOuq7.js";
 import "./delivery-queue-DKRjVFlq.js";
-import "./deps-vuWHR8ix.js";
+import "./deps-RXAe1X5s.js";
 import "./memory-DDpj0IVA.js";
 import "./memory-search-BwYkW6_V.js";
 import "./manager-BmONwMiP.js";
@@ -78,10 +78,10 @@ import "./prompt-style-CWAacuMq.js";
 import "./pairing-labels-D2yOKhoV.js";
 import { t as enablePluginInConfig } from "./enable-D3_YPNIT.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-DDbnXe4x.js";
-import "./status-Cf-x3WJB.js";
+import "./status-D9As1GK-.js";
 import "./update-Dew6hqdf.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-DKOezW7h.js";
-import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-B09rLDoa.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-D2VlrxY8.js";
+import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-DcgcyEiV.js";
 import fs from "node:fs";
 import path from "node:path";
 

package/dist/{onboarding-Bejkgd8a.js → onboarding-CIjqOjDq.js}

@@ -1,13 +1,13 @@
 import { _ as resolveStateDir, u as resolveGatewayPort } from "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, U as theme } from "./agent-paths-DmOVZE7g.js";
 import { Ga as ensureAuthProfileStore, Mn as writeConfigFile, Zr as collectConfigServiceEnvVars, d as resolveDefaultAgentId, dd as formatCliCommand, fr as ensureActiveMemoryPluginAllowlisted, kn as readConfigFileSnapshot, u as resolveAgentWorkspaceDir } from "./agent-scope-DHrLr5OF.js";
-import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-BRoR6TOO.js";
+import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-701mJB_S.js";
 import { d as defaultRuntime, f as restoreTerminalState, s as redactSensitiveText } from "./errors-Dx3S3Nrp.js";
-import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-CQG8MiG_.js";
+import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-BFJRJg77.js";
 import { i as resolveLocalSignerRunAsUser, n as resolveLocalSignerBackendSocketPath, o as resolveLocalSignerSocketPath, r as resolveLocalSignerMaterialRootDir, t as ensureWalletStateDir } from "./wallet-runtime-config-BlRWvEER.js";
 import { a as readWalletProviderRegistry, l as setDefaultWallet, n as checkNamedWalletDeletionSafety, p as upsertNamedWallet, r as deleteNamedWallet, s as resolveWalletUserRole, u as setNamedWalletRole } from "./wallet-provider-registry-ax0NJo0F.js";
 import { n as redactSensitiveUrlLikeString } from "./redact-sensitive-url-B0RJQqO7.js";
-import { C as walletSetupCommand, k as readWalletStatusSnapshot, t as collectWalletSignerDoctorReport } from "./wallet-BguV7zPF.js";
+import { C as walletSetupCommand, k as readWalletStatusSnapshot, t as collectWalletSignerDoctorReport } from "./wallet-DZA0r3pV.js";
 import { c as loadPersistedFederationToken, i as resolveFederationBaseUrl, o as resolveFederationHandle, t as DEFAULT_FEDERATION_BASE_URL } from "./runtime-bsvPuEXH.js";
 import { t as readManagedFederationTokenSummary } from "./federation-BrNm7xtG.js";
 import { or as clearDeviceAuthStore } from "./call-DDALpDwS.js";
@@ -17,14 +17,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-CmxDYXvt.js";
 import { t as resolveGatewayService } from "./service-Bsg622jp.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-BRLbvcxT.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-Bxa3Ql2B.js";
-import { o as waitForHostedDashboardBrowserPath } from "./health-c7sJIXY9.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DCd_rmJr.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-BBY8vO5H.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-Bh1H98-c.js";
+import { o as waitForHostedDashboardBrowserPath } from "./health-C-AsEUPg.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-D9LWnNpF.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-DFyVEU7J.js";
 import { n as logConfigUpdated } from "./logging-Dv2wthF_.js";
-import { n as setupChannels } from "./onboard-channels-BREKCcFf.js";
+import { n as setupChannels } from "./onboard-channels-C4gBvkYQ.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-BielXMUB.js";
-import { t as runTui } from "./tui-CIzUfHHB.js";
+import { t as runTui } from "./tui-D9armVLc.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -169,7 +169,7 @@ function isHostedSecurityCapableSession(explicitFlag = false) {
 		const sudoersPath = path.join("/etc/sudoers.d", `fased-host-maintenance-${currentUser}`);
 		if (fs.existsSync(sudoersPath)) return true;
 	}
-	return canRunHostedMaintenanceCommand("sudo -n tailscale status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n ufw status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n firewall-cmd --state >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl is-active --quiet firewalld >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
+	return canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailscale-status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailnet-ssh-ingress >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance firewall-baseline >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
 }
 
 //#endregion
@@ -547,16 +547,18 @@ async function installRootServiceMaintenanceAccess(params) {
 	const sudoers = [
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl start --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl enable --now ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName} *`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service --no-pager`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} *`
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service -p ActiveState --value`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl cat ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 120 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 120 --no-pager`
 	].join("\n");
 	return await runShell([
 		`echo '${Buffer.from(`${sudoers}\n`, "utf8").toString("base64")}' | base64 -d | sudo -n tee '${sudoersPath}' >/dev/null`,
@@ -1662,7 +1664,7 @@ async function finalizeOnboardingWizard(options) {
 	if (process.platform === "linux") {
 		const localSignerSync = resolveLocalSignerSyncForFinalize({ strictVps });
 		if (localSignerSync.sync) try {
-			const { syncLocalSocketSignerFromConfig } = await import("./onboarding.wallet-CQG8MiG_.js").then((n) => n.i);
+			const { syncLocalSocketSignerFromConfig } = await import("./onboarding.wallet-BFJRJg77.js").then((n) => n.i);
 			await syncLocalSocketSignerFromConfig({
 				config: nextConfig,
 				env: process.env,
@@ -2748,6 +2750,7 @@ const LOW_MEMORY_HOSTING_SWAP_GB = 4;
 const HOSTING_SWAP_GB = 2;
 const TAILSCALE_INTERACTIVE_TIMEOUT_MS = 120 * 1e3;
 const TAILSCALE_LOGIN_URL_RE = /https:\/\/login\.tailscale\.com\/a\/[A-Za-z0-9_-]+/i;
+const HOST_MAINTENANCE_HELPER = "/usr/local/sbin/fased-host-maintenance";
 function detectTotalMemoryMb() {
 	if (process.platform === "linux") try {
 		const match = fs.readFileSync("/proc/meminfo", "utf8").match(/^MemTotal:\s+(\d+)\s+kB/m);
@@ -2848,7 +2851,7 @@ function buildTailscaleLoginWaitCommand(command) {
 		`bash -lc ${shellQuote(command)} &`,
 		"ts_pid=$!",
 		"for _ in $(seq 1 55); do",
-		"  if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`  if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"    kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    wait \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    exit 0",
@@ -2861,7 +2864,7 @@ function buildTailscaleLoginWaitCommand(command) {
 		"done",
 		"kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"wait \"$ts_pid\" >/dev/null 2>&1 || true",
-		"if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"  exit 0",
 		"fi",
 		"exit 124"
@@ -2914,21 +2917,29 @@ function tailscaleTimedOutButReady(result, logPath, runner = run) {
 function shellQuote(value) {
 	return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function hostMaintenanceCommand(action) {
+	return `sudo -n ${HOST_MAINTENANCE_HELPER} ${action}`;
+}
+function hostMaintenanceCommandWithInput(action, input) {
+	return `printf '%s\\n' ${shellQuote(input)} | ${hostMaintenanceCommand(action)}`;
+}
 function isTailscaleLoggedIn(logPath, runner = run) {
-	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-status")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
 }
 function hasTailscaleIp(logPath, runner = run) {
-	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
 }
 function readTailscaleIp(logPath, runner = run) {
 	const probe = runner("tailscale ip -4", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale ip -4", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-ip4"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale ip -4", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return;
 	return sudoProbe.detail.match(/\b\d{1,3}(?:\.\d{1,3}){3}\b/)?.[0];
 }
 function readTailscaleSelf(logPath, runner = run) {
 	const probe = runner("tailscale status --json", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale status --json", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-status-json"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale status --json", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return { ipv4: readTailscaleIp(logPath, runner) };
 	try {
 		const parsed = JSON.parse(sudoProbe.detail);
@@ -3034,7 +3045,8 @@ function verifyTailnetSshServerPrerequisites(params) {
 	};
 }
 function ensureTailnetSshIngressForVerification(params) {
-	const result = (params.runner ?? run)([
+	const runner = params.runner ?? run;
+	const command = [
 		"if command -v ufw >/dev/null 2>&1; then",
 		"  if sudo -n ufw status | grep -qi '^Status: active'; then",
 		"    sudo -n ufw insert 1 allow in on tailscale0 to any port 22 proto tcp || sudo -n ufw allow in on tailscale0 to any port 22 proto tcp",
@@ -3045,7 +3057,9 @@ function ensureTailnetSshIngressForVerification(params) {
 		"  sudo -n firewall-cmd --permanent --zone=trusted --add-interface=tailscale0 >/dev/null 2>&1 || true",
 		"  sudo -n firewall-cmd --reload >/dev/null 2>&1 || true",
 		"fi"
-	].join("\n"), params.logPath);
+	].join("\n");
+	const helperResult = runner(hostMaintenanceCommand("tailnet-ssh-ingress"), params.logPath);
+	const result = helperResult.ok ? helperResult : runner(command, params.logPath);
 	if (!result.ok) return {
 		ok: false,
 		detail: result.detail ?? "could not prepare tailnet SSH firewall rule before verification"
@@ -3132,7 +3146,7 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				return false;
 			}
 			await prompter.note(formatTailscaleAccountBrowserLoginNote(), "Tailscale login");
-			const tsReset = await interactiveRunner("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
+			const tsReset = await interactiveRunner(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			const acceptedTimedOutLogin = tailscaleTimedOutButReady(tsReset, logPath, runner);
 			if (!tsReset.ok && !acceptedTimedOutLogin || !hasTailscaleIp(logPath, runner)) {
 				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
@@ -3176,9 +3190,9 @@ function ensureTailscaleServe(port, logPath) {
 		ok: true,
 		detail: `tailscale serve --bg -> 127.0.0.1:${port}`
 	};
-	if (run(`sudo -n tailscale serve --bg http://127.0.0.1:${port}`, logPath).ok) return {
+	if (run(hostMaintenanceCommandWithInput("tailscale-serve", String(port)), logPath).ok) return {
 		ok: true,
-		detail: `sudo tailscale serve --bg -> 127.0.0.1:${port}`
+		detail: `host maintenance tailscale serve -> 127.0.0.1:${port}`
 	};
 	if (run(`tailscale serve https / http://127.0.0.1:${port}`, logPath).ok) return {
 		ok: true,
@@ -3202,7 +3216,7 @@ function isTailscaleServeReady(port) {
 		],
 		encoding: "utf8"
 	});
-	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", "sudo -n tailscale serve status"], {
+	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", hostMaintenanceCommand("tailscale-serve-status")], {
 		stdio: [
 			"ignore",
 			"pipe",
@@ -3235,6 +3249,7 @@ function packageInstallCommand(packages) {
 }
 function tailscaleInstallCommand() {
 	return [
+		`${hostMaintenanceCommand("tailscale-install-start")} && exit 0`,
 		"if command -v tailscale >/dev/null 2>&1; then",
 		"  :",
 		"elif command -v apt-get >/dev/null 2>&1; then",
@@ -3260,6 +3275,7 @@ function tailscaleInstallCommand() {
 }
 function firewallBaselineCommand() {
 	return [
+		`${hostMaintenanceCommand("firewall-baseline")} && exit 0`,
 		"if command -v ufw >/dev/null 2>&1 || command -v apt-get >/dev/null 2>&1; then",
 		"  command -v ufw >/dev/null 2>&1 || { " + packageInstallCommand(["ufw"]) + "; }",
 		"  sudo -n ufw default deny incoming",
@@ -3283,6 +3299,7 @@ function firewallBaselineCommand() {
 }
 function automaticUpdatesCommand() {
 	return [
+		`${hostMaintenanceCommand("automatic-updates")} && exit 0`,
 		"if command -v apt-get >/dev/null 2>&1; then",
 		"  " + packageInstallCommand(["unattended-upgrades"]),
 		"  sudo -n systemctl enable --now unattended-upgrades >/dev/null 2>&1 || true",
@@ -3301,15 +3318,7 @@ function automaticUpdatesCommand() {
 	].join("\n");
 }
 function sshHardeningCommand() {
-	return [
-		"if sudo -n /usr/local/sbin/fased-host-maintenance harden-ssh >/dev/null 2>&1; then",
-		"  :",
-		"else",
-		"  sudo -n sed -i 's/^#\\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config",
-		"  sudo -n sed -i 's/^#\\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config",
-		"  sudo -n systemctl restart ssh || sudo -n systemctl restart sshd",
-		"fi"
-	].join("\n");
+	return hostMaintenanceCommand("harden-ssh");
 }
 function failOrContinue(params) {
 	const { opts, runtime, step, detail } = params;
@@ -3355,7 +3364,7 @@ async function applyHostingSecurity(params) {
 			validate: (value) => value.trim() ? void 0 : "Required"
 		})).trim();
 		else await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-		const resetCommand = tsAuthkey ? `sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset --authkey ${JSON.stringify(tsAuthkey)}` : "sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset";
+		const resetCommand = tsAuthkey ? hostMaintenanceCommandWithInput("tailscale-up-reset-authkey-ssh", tsAuthkey) : hostMaintenanceCommand("tailscale-up-reset-ssh");
 		const tsReset = tsAuthkey ? run(resetCommand, logPath) : await runInteractiveTailscaleLogin(resetCommand, logPath, prompter);
 		if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) return {
 			ok: false,
@@ -3479,7 +3488,7 @@ async function applyHostingSecurity(params) {
 				logPath
 			};
 		}
-	} else if (hasCommand("systemctl")) run("sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true", logPath);
+	} else if (hasCommand("systemctl")) run(`${hostMaintenanceCommand("tailscale-install-start")} >/dev/null 2>&1 || sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true`, logPath);
 	if (prompter && opts.nonInteractive !== true) await prompter.note(formatLocalDeviceTailnetRequirementNote(), "Local device requirement");
 	let tsHealthy = isTailscaleLoggedIn(logPath);
 	if (tsHealthy && prompter && opts.nonInteractive !== true) {
@@ -3488,7 +3497,7 @@ async function applyHostingSecurity(params) {
 			initialValue: false
 		})) {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsReset = await runInteractiveTailscaleLogin("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
+			const tsReset = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3531,7 +3540,7 @@ async function applyHostingSecurity(params) {
 			})).trim();
 		}
 		if (tsAuthkey) {
-			const tsUp = run(`sudo -n tailscale up --authkey ${JSON.stringify(tsAuthkey)} --ssh`, logPath);
+			const tsUp = run(hostMaintenanceCommandWithInput("tailscale-up-authkey-ssh", tsAuthkey), logPath);
 			if (!tsUp.ok) {
 				checks.push({
 					name: "tailscale",
@@ -3575,7 +3584,7 @@ async function applyHostingSecurity(params) {
 			};
 		} else {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsUp = await runInteractiveTailscaleLogin("sudo -n tailscale up --ssh", logPath, prompter);
+			const tsUp = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-ssh"), logPath, prompter);
 			if (!tsUp.ok && !tailscaleTimedOutButReady(tsUp, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3630,7 +3639,7 @@ async function applyHostingSecurity(params) {
 		detail: "tailnet IP present; verifying app SSH before lock-down"
 	});
 	const operatorUser = run("id -u app >/dev/null 2>&1", logPath).ok ? "app" : process.env.SUDO_USER?.trim() || process.env.USER?.trim() || process.env.LOGNAME?.trim();
-	if (operatorUser) run(`sudo -n tailscale set --operator='${operatorUser}' >/dev/null 2>&1 || true`, logPath);
+	if (operatorUser) run(`${hostMaintenanceCommand("tailscale-set-operator-self")} >/dev/null 2>&1 || true`, logPath);
 	if (!await confirmTailnetSshBeforeLockdown({
 		opts,
 		runtime,
@@ -3727,7 +3736,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "password auth/root login disabled and ssh restarted"
 	});
-	const f2bRes = runHostSetupCommand(`${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban`);
+	const f2bRes = runHostSetupCommand(`${hostMaintenanceCommand("fail2ban-enable")} || (${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban)`);
 	if (!f2bRes.ok) {
 		checks.push({
 			name: "fail2ban",