@fased/fased 0.1.19 → 0.1.21

package/dist/{onboarding-C8AUR3x1.js → onboarding-DjXH2-ro.js}

@@ -1,12 +1,12 @@
 import { Cu as formatCliCommand, Fn as ensureActiveMemoryPluginAllowlisted, Gu as resolveDefaultAgentId, Qt as readConfigFileSnapshot, Wu as resolveAgentWorkspaceDir, br as collectConfigServiceEnvVars, ma as ensureAuthProfileStore, tn as writeConfigFile } from "./env-C77feXxI.js";
 import { H as theme, x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
-import { A as waitForGatewayReachable, C as printWizardHeader, E as resolveControlUiLinks, Ha as CONTROL_UI_BOOT_CHECK_PATH, O as summarizeExistingConfig, S as openUrl, T as randomToken, Wa as normalizeControlUiBasePath, bo as enableTailscaleServe, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, g as formatControlUiSshHint, h as ensureWorkspaceAndSessions, k as validateGatewayPasswordInput, m as detectBrowserOpenSupport, to as runFederationAutoConnectOnce, v as handleOnboardingRepair, w as probeGatewayReachable, x as normalizeGatewayTokenInput, xo as findTailscaleBinary, yo as enableTailscaleFunnel } from "./model-catalog-DHRVUWBf.js";
+import { A as waitForGatewayReachable, C as printWizardHeader, E as resolveControlUiLinks, Ha as CONTROL_UI_BOOT_CHECK_PATH, O as summarizeExistingConfig, S as openUrl, T as randomToken, Wa as normalizeControlUiBasePath, bo as enableTailscaleServe, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, g as formatControlUiSshHint, h as ensureWorkspaceAndSessions, k as validateGatewayPasswordInput, m as detectBrowserOpenSupport, to as runFederationAutoConnectOnce, v as handleOnboardingRepair, w as probeGatewayReachable, x as normalizeGatewayTokenInput, xo as findTailscaleBinary, yo as enableTailscaleFunnel } from "./model-catalog-BQ5G4eK6.js";
 import { A as defaultRuntime, Ct as resolveStateDir, E as redactSensitiveText, gt as resolveGatewayPort, j as restoreTerminalState } from "./entry.js";
 import { n as redactSensitiveUrlLikeString } from "./redact-sensitive-url-BW03TVj8.js";
-import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet--7Yu2hFw.js";
+import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-B87UVKiT.js";
 import { i as resolveLocalSignerRunAsUser, n as resolveLocalSignerBackendSocketPath, o as resolveLocalSignerSocketPath, r as resolveLocalSignerMaterialRootDir, t as ensureWalletStateDir } from "./wallet-runtime-config-TjiNNY9x.js";
 import { a as readWalletProviderRegistry, l as setDefaultWallet, n as checkNamedWalletDeletionSafety, p as upsertNamedWallet, r as deleteNamedWallet, s as resolveWalletUserRole, u as setNamedWalletRole } from "./wallet-provider-registry-CFNtQ2ZR.js";
-import { C as walletSetupCommand, k as readWalletStatusSnapshot, t as collectWalletSignerDoctorReport } from "./wallet-C95r3fvu.js";
+import { C as walletSetupCommand, k as readWalletStatusSnapshot, t as collectWalletSignerDoctorReport } from "./wallet-CJdBRqTq.js";
 import { c as loadPersistedFederationToken, i as resolveFederationBaseUrl, o as resolveFederationHandle, t as DEFAULT_FEDERATION_BASE_URL } from "./runtime-DXHXAPJA.js";
 import { t as readManagedFederationTokenSummary } from "./federation-8sW60I4p.js";
 import { or as clearDeviceAuthStore } from "./call-B9EvxMq6.js";
@@ -16,14 +16,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-B8OPQXFR.js";
 import { t as resolveGatewayService } from "./service-2JBjv-ge.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-COK5O0cM.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-BKbsAV5a.js";
-import { s as waitForHostedDashboardBrowserPath } from "./health-CD-e8iEW.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-CRcRJvDg.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-CHAO6E_x.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-D88X6kcK.js";
+import { s as waitForHostedDashboardBrowserPath } from "./health-Db548DTY.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DbTYwdGn.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-D5YuCYf7.js";
 import { n as logConfigUpdated } from "./logging-DZ32I_SP.js";
-import { n as setupChannels } from "./onboard-channels-fJXaj04M.js";
+import { n as setupChannels } from "./onboard-channels-CDr6F5Rc.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-DRZciWMZ.js";
-import { t as runTui } from "./tui-Cvc1YA_t.js";
+import { t as runTui } from "./tui-BpbyDMEE.js";
 import { spawn, spawnSync } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
@@ -168,7 +168,7 @@ function isHostedSecurityCapableSession(explicitFlag = false) {
 		const sudoersPath = path.join("/etc/sudoers.d", `fased-host-maintenance-${currentUser}`);
 		if (fs.existsSync(sudoersPath)) return true;
 	}
-	return canRunHostedMaintenanceCommand("sudo -n tailscale status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n ufw status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n firewall-cmd --state >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl is-active --quiet firewalld >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
+	return canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailscale-status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailnet-ssh-ingress >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance firewall-baseline >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
 }
 
 //#endregion
@@ -546,16 +546,18 @@ async function installRootServiceMaintenanceAccess(params) {
 	const sudoers = [
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl restart --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl start --no-block ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl enable --now ${safeServiceName}.service`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName} *`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl status ${safeServiceName}.service --no-pager`,
 		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName} *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service *`,
-		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} *`
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl is-active ${safeServiceName}`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl show ${safeServiceName}.service -p ActiveState --value`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/systemctl cat ${safeServiceName}.service`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName}.service -n 120 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 50 --no-pager`,
+		`${safeUser} ALL=(root) NOPASSWD: /usr/bin/journalctl -u ${safeServiceName} -n 120 --no-pager`
 	].join("\n");
 	return await runShell([
 		`echo '${Buffer.from(`${sudoers}\n`, "utf8").toString("base64")}' | base64 -d | sudo -n tee '${sudoersPath}' >/dev/null`,
@@ -1661,7 +1663,7 @@ async function finalizeOnboardingWizard(options) {
 	if (process.platform === "linux") {
 		const localSignerSync = resolveLocalSignerSyncForFinalize({ strictVps });
 		if (localSignerSync.sync) try {
-			const { syncLocalSocketSignerFromConfig } = await import("./onboarding.wallet--7Yu2hFw.js").then((n) => n.i);
+			const { syncLocalSocketSignerFromConfig } = await import("./onboarding.wallet-B87UVKiT.js").then((n) => n.i);
 			await syncLocalSocketSignerFromConfig({
 				config: nextConfig,
 				env: process.env,
@@ -2747,6 +2749,7 @@ const LOW_MEMORY_HOSTING_SWAP_GB = 4;
 const HOSTING_SWAP_GB = 2;
 const TAILSCALE_INTERACTIVE_TIMEOUT_MS = 120 * 1e3;
 const TAILSCALE_LOGIN_URL_RE = /https:\/\/login\.tailscale\.com\/a\/[A-Za-z0-9_-]+/i;
+const HOST_MAINTENANCE_HELPER = "/usr/local/sbin/fased-host-maintenance";
 function detectTotalMemoryMb() {
 	if (process.platform === "linux") try {
 		const match = fs.readFileSync("/proc/meminfo", "utf8").match(/^MemTotal:\s+(\d+)\s+kB/m);
@@ -2847,7 +2850,7 @@ function buildTailscaleLoginWaitCommand(command) {
 		`bash -lc ${shellQuote(command)} &`,
 		"ts_pid=$!",
 		"for _ in $(seq 1 55); do",
-		"  if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`  if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"    kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    wait \"$ts_pid\" >/dev/null 2>&1 || true",
 		"    exit 0",
@@ -2860,7 +2863,7 @@ function buildTailscaleLoginWaitCommand(command) {
 		"done",
 		"kill -INT \"$ts_pid\" >/dev/null 2>&1 || true",
 		"wait \"$ts_pid\" >/dev/null 2>&1 || true",
-		"if tailscale ip -4 >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then",
+		`if tailscale ip -4 >/dev/null 2>&1 || ${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1 || sudo -n tailscale ip -4 >/dev/null 2>&1; then`,
 		"  exit 0",
 		"fi",
 		"exit 124"
@@ -2913,21 +2916,29 @@ function tailscaleTimedOutButReady(result, logPath, runner = run) {
 function shellQuote(value) {
 	return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function hostMaintenanceCommand(action) {
+	return `sudo -n ${HOST_MAINTENANCE_HELPER} ${action}`;
+}
+function hostMaintenanceCommandWithInput(action, input) {
+	return `printf '%s\\n' ${shellQuote(input)} | ${hostMaintenanceCommand(action)}`;
+}
 function isTailscaleLoggedIn(logPath, runner = run) {
-	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale status >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-status")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale status >/dev/null 2>&1", logPath).ok;
 }
 function hasTailscaleIp(logPath, runner = run) {
-	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
+	return runner("tailscale ip -4 >/dev/null 2>&1", logPath).ok || runner(`${hostMaintenanceCommand("tailscale-ip4")} >/dev/null 2>&1`, logPath).ok || runner("sudo -n tailscale ip -4 >/dev/null 2>&1", logPath).ok;
 }
 function readTailscaleIp(logPath, runner = run) {
 	const probe = runner("tailscale ip -4", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale ip -4", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-ip4"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale ip -4", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return;
 	return sudoProbe.detail.match(/\b\d{1,3}(?:\.\d{1,3}){3}\b/)?.[0];
 }
 function readTailscaleSelf(logPath, runner = run) {
 	const probe = runner("tailscale status --json", logPath);
-	const sudoProbe = probe.ok ? probe : runner("sudo -n tailscale status --json", logPath);
+	const helperProbe = probe.ok ? probe : runner(hostMaintenanceCommand("tailscale-status-json"), logPath);
+	const sudoProbe = helperProbe.ok ? helperProbe : runner("sudo -n tailscale status --json", logPath);
 	if (!sudoProbe.ok || !sudoProbe.detail) return { ipv4: readTailscaleIp(logPath, runner) };
 	try {
 		const parsed = JSON.parse(sudoProbe.detail);
@@ -3033,7 +3044,8 @@ function verifyTailnetSshServerPrerequisites(params) {
 	};
 }
 function ensureTailnetSshIngressForVerification(params) {
-	const result = (params.runner ?? run)([
+	const runner = params.runner ?? run;
+	const command = [
 		"if command -v ufw >/dev/null 2>&1; then",
 		"  if sudo -n ufw status | grep -qi '^Status: active'; then",
 		"    sudo -n ufw insert 1 allow in on tailscale0 to any port 22 proto tcp || sudo -n ufw allow in on tailscale0 to any port 22 proto tcp",
@@ -3044,7 +3056,9 @@ function ensureTailnetSshIngressForVerification(params) {
 		"  sudo -n firewall-cmd --permanent --zone=trusted --add-interface=tailscale0 >/dev/null 2>&1 || true",
 		"  sudo -n firewall-cmd --reload >/dev/null 2>&1 || true",
 		"fi"
-	].join("\n"), params.logPath);
+	].join("\n");
+	const helperResult = runner(hostMaintenanceCommand("tailnet-ssh-ingress"), params.logPath);
+	const result = helperResult.ok ? helperResult : runner(command, params.logPath);
 	if (!result.ok) return {
 		ok: false,
 		detail: result.detail ?? "could not prepare tailnet SSH firewall rule before verification"
@@ -3131,7 +3145,7 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				return false;
 			}
 			await prompter.note(formatTailscaleAccountBrowserLoginNote(), "Tailscale login");
-			const tsReset = await interactiveRunner("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
+			const tsReset = await interactiveRunner(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			const acceptedTimedOutLogin = tailscaleTimedOutButReady(tsReset, logPath, runner);
 			if (!tsReset.ok && !acceptedTimedOutLogin || !hasTailscaleIp(logPath, runner)) {
 				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
@@ -3175,9 +3189,9 @@ function ensureTailscaleServe(port, logPath) {
 		ok: true,
 		detail: `tailscale serve --bg -> 127.0.0.1:${port}`
 	};
-	if (run(`sudo -n tailscale serve --bg http://127.0.0.1:${port}`, logPath).ok) return {
+	if (run(hostMaintenanceCommandWithInput("tailscale-serve", String(port)), logPath).ok) return {
 		ok: true,
-		detail: `sudo tailscale serve --bg -> 127.0.0.1:${port}`
+		detail: `host maintenance tailscale serve -> 127.0.0.1:${port}`
 	};
 	if (run(`tailscale serve https / http://127.0.0.1:${port}`, logPath).ok) return {
 		ok: true,
@@ -3201,7 +3215,7 @@ function isTailscaleServeReady(port) {
 		],
 		encoding: "utf8"
 	});
-	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", "sudo -n tailscale serve status"], {
+	if ((probe.status ?? 1) !== 0) probe = spawnSync("bash", ["-lc", hostMaintenanceCommand("tailscale-serve-status")], {
 		stdio: [
 			"ignore",
 			"pipe",
@@ -3234,6 +3248,7 @@ function packageInstallCommand(packages) {
 }
 function tailscaleInstallCommand() {
 	return [
+		`${hostMaintenanceCommand("tailscale-install-start")} && exit 0`,
 		"if command -v tailscale >/dev/null 2>&1; then",
 		"  :",
 		"elif command -v apt-get >/dev/null 2>&1; then",
@@ -3259,6 +3274,7 @@ function tailscaleInstallCommand() {
 }
 function firewallBaselineCommand() {
 	return [
+		`${hostMaintenanceCommand("firewall-baseline")} && exit 0`,
 		"if command -v ufw >/dev/null 2>&1 || command -v apt-get >/dev/null 2>&1; then",
 		"  command -v ufw >/dev/null 2>&1 || { " + packageInstallCommand(["ufw"]) + "; }",
 		"  sudo -n ufw default deny incoming",
@@ -3282,6 +3298,7 @@ function firewallBaselineCommand() {
 }
 function automaticUpdatesCommand() {
 	return [
+		`${hostMaintenanceCommand("automatic-updates")} && exit 0`,
 		"if command -v apt-get >/dev/null 2>&1; then",
 		"  " + packageInstallCommand(["unattended-upgrades"]),
 		"  sudo -n systemctl enable --now unattended-upgrades >/dev/null 2>&1 || true",
@@ -3300,15 +3317,7 @@ function automaticUpdatesCommand() {
 	].join("\n");
 }
 function sshHardeningCommand() {
-	return [
-		"if sudo -n /usr/local/sbin/fased-host-maintenance harden-ssh >/dev/null 2>&1; then",
-		"  :",
-		"else",
-		"  sudo -n sed -i 's/^#\\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config",
-		"  sudo -n sed -i 's/^#\\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config",
-		"  sudo -n systemctl restart ssh || sudo -n systemctl restart sshd",
-		"fi"
-	].join("\n");
+	return hostMaintenanceCommand("harden-ssh");
 }
 function failOrContinue(params) {
 	const { opts, runtime, step, detail } = params;
@@ -3354,7 +3363,7 @@ async function applyHostingSecurity(params) {
 			validate: (value) => value.trim() ? void 0 : "Required"
 		})).trim();
 		else await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-		const resetCommand = tsAuthkey ? `sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset --authkey ${JSON.stringify(tsAuthkey)}` : "sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset";
+		const resetCommand = tsAuthkey ? hostMaintenanceCommandWithInput("tailscale-up-reset-authkey-ssh", tsAuthkey) : hostMaintenanceCommand("tailscale-up-reset-ssh");
 		const tsReset = tsAuthkey ? run(resetCommand, logPath) : await runInteractiveTailscaleLogin(resetCommand, logPath, prompter);
 		if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) return {
 			ok: false,
@@ -3478,7 +3487,7 @@ async function applyHostingSecurity(params) {
 				logPath
 			};
 		}
-	} else if (hasCommand("systemctl")) run("sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true", logPath);
+	} else if (hasCommand("systemctl")) run(`${hostMaintenanceCommand("tailscale-install-start")} >/dev/null 2>&1 || sudo -n systemctl enable --now tailscaled >/dev/null 2>&1 || true`, logPath);
 	if (prompter && opts.nonInteractive !== true) await prompter.note(formatLocalDeviceTailnetRequirementNote(), "Local device requirement");
 	let tsHealthy = isTailscaleLoggedIn(logPath);
 	if (tsHealthy && prompter && opts.nonInteractive !== true) {
@@ -3487,7 +3496,7 @@ async function applyHostingSecurity(params) {
 			initialValue: false
 		})) {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsReset = await runInteractiveTailscaleLogin("sudo -n tailscale logout && sudo -n tailscale up --ssh --accept-routes --reset", logPath, prompter);
+			const tsReset = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-reset-ssh"), logPath, prompter);
 			if (!tsReset.ok && !tailscaleTimedOutButReady(tsReset, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3530,7 +3539,7 @@ async function applyHostingSecurity(params) {
 			})).trim();
 		}
 		if (tsAuthkey) {
-			const tsUp = run(`sudo -n tailscale up --authkey ${JSON.stringify(tsAuthkey)} --ssh`, logPath);
+			const tsUp = run(hostMaintenanceCommandWithInput("tailscale-up-authkey-ssh", tsAuthkey), logPath);
 			if (!tsUp.ok) {
 				checks.push({
 					name: "tailscale",
@@ -3574,7 +3583,7 @@ async function applyHostingSecurity(params) {
 			};
 		} else {
 			if (prompter) await prompter.note(formatTailscaleBrowserLoginNote(), "Tailscale login");
-			const tsUp = await runInteractiveTailscaleLogin("sudo -n tailscale up --ssh", logPath, prompter);
+			const tsUp = await runInteractiveTailscaleLogin(hostMaintenanceCommand("tailscale-up-ssh"), logPath, prompter);
 			if (!tsUp.ok && !tailscaleTimedOutButReady(tsUp, logPath)) {
 				checks.push({
 					name: "tailscale",
@@ -3629,7 +3638,7 @@ async function applyHostingSecurity(params) {
 		detail: "tailnet IP present; verifying app SSH before lock-down"
 	});
 	const operatorUser = run("id -u app >/dev/null 2>&1", logPath).ok ? "app" : process.env.SUDO_USER?.trim() || process.env.USER?.trim() || process.env.LOGNAME?.trim();
-	if (operatorUser) run(`sudo -n tailscale set --operator='${operatorUser}' >/dev/null 2>&1 || true`, logPath);
+	if (operatorUser) run(`${hostMaintenanceCommand("tailscale-set-operator-self")} >/dev/null 2>&1 || true`, logPath);
 	if (!await confirmTailnetSshBeforeLockdown({
 		opts,
 		runtime,
@@ -3726,7 +3735,7 @@ async function applyHostingSecurity(params) {
 		ok: true,
 		detail: "password auth/root login disabled and ssh restarted"
 	});
-	const f2bRes = runHostSetupCommand(`${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban`);
+	const f2bRes = runHostSetupCommand(`${hostMaintenanceCommand("fail2ban-enable")} || (${packageInstallCommand(["fail2ban"])}\nsudo -n systemctl enable --now fail2ban)`);
 	if (!f2bRes.ok) {
 		checks.push({
 			name: "fail2ban",

package/dist/{onboarding.wallet--7Yu2hFw.js → onboarding.wallet-B87UVKiT.js}

@@ -3237,6 +3237,7 @@ const INSTALL_SCRIPT_RELPATHS = ["scripts/install-fased-signerd.sh", "../scripts
 const BUILD_SCRIPT_RELPATHS = ["scripts/build-fased-signerd.sh", "../scripts/build-fased-signerd.sh"];
 const BROKER_CLI_RELPATHS = ["./index.js", "../../dist/index.js"];
 const DEFAULT_SIGNER_RELEASE_DOWNLOAD_BASE = "https://github.com/fased-ai/fased/releases/download";
+const SIGNER_MAINTENANCE_HELPER = "/usr/local/sbin/fased-signer-maintenance";
 const SIGNER_ISOLATION_HELPER = "/usr/local/sbin/fased-signer-isolation";
 function runCommand(params) {
 	const child = spawnSync(params.command, params.args, {
@@ -3768,17 +3769,15 @@ function resolveCurrentUnixUser() {
 	}
 }
 function runSignerIsolationHelper(runAsUser, args, opts) {
-	if (!fs.existsSync(SIGNER_ISOLATION_HELPER)) return;
+	const helperArgs = signerMaintenanceHelperArgs(runAsUser, args);
+	if (!helperArgs) return;
 	try {
 		return runCommand({
 			command: "sudo",
 			args: [
 				"-n",
 				"-E",
-				SIGNER_ISOLATION_HELPER,
-				resolveCurrentUnixUser(),
-				runAsUser,
-				...args
+				...helperArgs
 			],
 			capture: opts?.capture
 		});
@@ -3788,15 +3787,13 @@ function runSignerIsolationHelper(runAsUser, args, opts) {
 	}
 }
 function startSignerIsolationHelperBackground(runAsUser, args, logPath, env = process.env) {
-	if (!fs.existsSync(SIGNER_ISOLATION_HELPER)) return false;
+	const helperArgs = signerMaintenanceHelperArgs(runAsUser, args);
+	if (!helperArgs) return false;
 	const out = fs.openSync(logPath, "a", 384);
 	spawn("sudo", [
 		"-n",
 		"-E",
-		SIGNER_ISOLATION_HELPER,
-		resolveCurrentUnixUser(),
-		runAsUser,
-		...args
+		...helperArgs
 	], {
 		detached: true,
 		stdio: [
@@ -3811,6 +3808,15 @@ function startSignerIsolationHelperBackground(runAsUser, args, logPath, env = pr
 	}).unref();
 	return true;
 }
+function signerMaintenanceHelperArgs(runAsUser, args) {
+	if (fs.existsSync(SIGNER_MAINTENANCE_HELPER)) return [SIGNER_MAINTENANCE_HELPER, ...args];
+	if (fs.existsSync(SIGNER_ISOLATION_HELPER)) return [
+		SIGNER_ISOLATION_HELPER,
+		resolveCurrentUnixUser(),
+		runAsUser,
+		...args
+	];
+}
 function ensureIsolatedSignerPaths(materialDir, backendSocketPath, appSocketPath, runAsUser) {
 	if (runSignerIsolationHelper(runAsUser, [
 		"prepare",

package/dist/{onboarding.wallet-CQG8MiG_.js → onboarding.wallet-BFJRJg77.js}

@@ -3238,6 +3238,7 @@ const INSTALL_SCRIPT_RELPATHS = ["scripts/install-fased-signerd.sh", "../scripts
 const BUILD_SCRIPT_RELPATHS = ["scripts/build-fased-signerd.sh", "../scripts/build-fased-signerd.sh"];
 const BROKER_CLI_RELPATHS = ["./index.js", "../../dist/index.js"];
 const DEFAULT_SIGNER_RELEASE_DOWNLOAD_BASE = "https://github.com/fased-ai/fased/releases/download";
+const SIGNER_MAINTENANCE_HELPER = "/usr/local/sbin/fased-signer-maintenance";
 const SIGNER_ISOLATION_HELPER = "/usr/local/sbin/fased-signer-isolation";
 function runCommand(params) {
 	const child = spawnSync(params.command, params.args, {
@@ -3769,17 +3770,15 @@ function resolveCurrentUnixUser() {
 	}
 }
 function runSignerIsolationHelper(runAsUser, args, opts) {
-	if (!fs.existsSync(SIGNER_ISOLATION_HELPER)) return;
+	const helperArgs = signerMaintenanceHelperArgs(runAsUser, args);
+	if (!helperArgs) return;
 	try {
 		return runCommand({
 			command: "sudo",
 			args: [
 				"-n",
 				"-E",
-				SIGNER_ISOLATION_HELPER,
-				resolveCurrentUnixUser(),
-				runAsUser,
-				...args
+				...helperArgs
 			],
 			capture: opts?.capture
 		});
@@ -3789,15 +3788,13 @@ function runSignerIsolationHelper(runAsUser, args, opts) {
 	}
 }
 function startSignerIsolationHelperBackground(runAsUser, args, logPath, env = process.env) {
-	if (!fs.existsSync(SIGNER_ISOLATION_HELPER)) return false;
+	const helperArgs = signerMaintenanceHelperArgs(runAsUser, args);
+	if (!helperArgs) return false;
 	const out = fs.openSync(logPath, "a", 384);
 	spawn("sudo", [
 		"-n",
 		"-E",
-		SIGNER_ISOLATION_HELPER,
-		resolveCurrentUnixUser(),
-		runAsUser,
-		...args
+		...helperArgs
 	], {
 		detached: true,
 		stdio: [
@@ -3812,6 +3809,15 @@ function startSignerIsolationHelperBackground(runAsUser, args, logPath, env = pr
 	}).unref();
 	return true;
 }
+function signerMaintenanceHelperArgs(runAsUser, args) {
+	if (fs.existsSync(SIGNER_MAINTENANCE_HELPER)) return [SIGNER_MAINTENANCE_HELPER, ...args];
+	if (fs.existsSync(SIGNER_ISOLATION_HELPER)) return [
+		SIGNER_ISOLATION_HELPER,
+		resolveCurrentUnixUser(),
+		runAsUser,
+		...args
+	];
+}
 function ensureIsolatedSignerPaths(materialDir, backendSocketPath, appSocketPath, runAsUser) {
 	if (runSignerIsolationHelper(runAsUser, [
 		"prepare",

package/dist/{openresponses-http-BYKqYqIr.js → openresponses-http-BA2nkk7t.js}

@@ -1,6 +1,6 @@
 import "./github-copilot-token-Dy7Y_jbI.js";
 import { la as logWarn, qo as defaultRuntime } from "./paths-OUJyk-5R.js";
-import { B as extractImageContentFromSource, F as DEFAULT_INPUT_IMAGE_MAX_BYTES, H as resolveInputFileLimits, I as DEFAULT_INPUT_IMAGE_MIMES, L as DEFAULT_INPUT_MAX_REDIRECTS, R as DEFAULT_INPUT_TIMEOUT_MS, V as normalizeMimeList, X as emitAgentEvent, Z as onAgentEvent, a as agentCommand, at as sendJson, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, z as extractFileContentFromSource } from "./auth-D6aXaEgt.js";
+import { B as extractImageContentFromSource, F as DEFAULT_INPUT_IMAGE_MAX_BYTES, H as resolveInputFileLimits, I as DEFAULT_INPUT_IMAGE_MIMES, L as DEFAULT_INPUT_MAX_REDIRECTS, R as DEFAULT_INPUT_TIMEOUT_MS, V as normalizeMimeList, X as emitAgentEvent, Z as onAgentEvent, a as agentCommand, at as sendJson, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, z as extractFileContentFromSource } from "./auth-7Dkf1_CI.js";
 import "./send-D96gGRQz.js";
 import "./send-BFoI9HuU.js";
 import "./skill-commands-DvoCSQnx.js";

package/dist/{openresponses-http-DNXaz2VR.js → openresponses-http-C9x0SEG6.js}

@@ -2,7 +2,7 @@ import { bd as logWarn } from "./env-C77feXxI.js";
 import "./agent-paths-BI1hx-tF.js";
 import "./send-D7X0_iFp.js";
 import "./send-BFEd4vCM.js";
-import { Ai as buildAgentMessageFromConversationEntries, Ii as resolveAssistantStreamDeltaText, Li as agentCommand, _a as resolveAgentIdForRequest, an as DEFAULT_INPUT_IMAGE_MAX_BYTES, ba as setSseHeaders, cn as DEFAULT_INPUT_TIMEOUT_MS, dn as normalizeMimeList, fn as resolveInputFileLimits, ia as emitAgentEvent, ki as handleGatewayPostJsonEndpoint, ln as extractFileContentFromSource, oa as onAgentEvent, on as DEFAULT_INPUT_IMAGE_MIMES, sn as DEFAULT_INPUT_MAX_REDIRECTS, un as extractImageContentFromSource, va as resolveSessionKey, xa as writeDone, ya as sendJson } from "./model-catalog-DHRVUWBf.js";
+import { Ai as buildAgentMessageFromConversationEntries, Ii as resolveAssistantStreamDeltaText, Li as agentCommand, _a as resolveAgentIdForRequest, an as DEFAULT_INPUT_IMAGE_MAX_BYTES, ba as setSseHeaders, cn as DEFAULT_INPUT_TIMEOUT_MS, dn as normalizeMimeList, fn as resolveInputFileLimits, ia as emitAgentEvent, ki as handleGatewayPostJsonEndpoint, ln as extractFileContentFromSource, oa as onAgentEvent, on as DEFAULT_INPUT_IMAGE_MIMES, sn as DEFAULT_INPUT_MAX_REDIRECTS, un as extractImageContentFromSource, va as resolveSessionKey, xa as writeDone, ya as sendJson } from "./model-catalog-BQ5G4eK6.js";
 import "./github-copilot-token-A9DiaCB0.js";
 import { A as defaultRuntime } from "./entry.js";
 import "./reply-prefix-TUhpEtvr.js";
@@ -31,10 +31,10 @@ import "./dangerous-tools-CusV9bcr.js";
 import "./chrome-bxkNKPA7.js";
 import "./pairing-token-C2iKEhFc.js";
 import "./ws-DiFJ3zRB.js";
-import "./onboarding.wallet--7Yu2hFw.js";
+import "./onboarding.wallet-B87UVKiT.js";
 import "./wallet-runtime-config-TjiNNY9x.js";
 import "./wallet-provider-registry-CFNtQ2ZR.js";
-import "./wallet-C95r3fvu.js";
+import "./wallet-CJdBRqTq.js";
 import "./wallet-approval-auth-BaVTLG5r.js";
 import "./runtime-DXHXAPJA.js";
 import "./device-identity-ZHUQ6a8N.js";
@@ -45,7 +45,7 @@ import "./send-C-su1wPZ.js";
 import "./outbound-attachment-Bh4FmcYg.js";
 import "./fetch-BVvWzHT_.js";
 import "./delivery-queue-55Cityuq.js";
-import { t as createDefaultDeps } from "./deps-BoCGz3bU.js";
+import { t as createDefaultDeps } from "./deps-DdP-Hmxc.js";
 import "./frontmatter-D2UNJikU.js";
 import "./skills-Dis31awJ.js";
 import "./skills-remote-CIAB0AXm.js";

package/dist/{openresponses-http-CyP-RUzR.js → openresponses-http-DU9S_V_8.js}

@@ -2,7 +2,7 @@ import { Sa as defaultRuntime, Vi as logWarn } from "./agent-scope-DUKEZjqM.js";
 import "./github-copilot-token-CNsqwfnE.js";
 import "./send-CFSRf7De.js";
 import "./send-gtmn6YeH.js";
-import { B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as sendJson, et as emitAgentEvent, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, tt as onAgentEvent, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-G-VYb-eT.js";
+import { B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as sendJson, et as emitAgentEvent, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, tt as onAgentEvent, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-DPElH0OZ.js";
 import "./reply-prefix-Bitnsmpd.js";
 import "./diagnostic-_BiQ6GgD.js";
 import "./diagnostic-session-state-CL_QxyRg.js";

package/dist/{openresponses-http-C8H-a3KL.js → openresponses-http-NFMdHWOs.js}

@@ -2,7 +2,7 @@ import "./paths-C9FmTW1x.js";
 import "./agent-paths-DmOVZE7g.js";
 import { au as logWarn } from "./agent-scope-DHrLr5OF.js";
 import "./commands-registry-BRvZQ1jh.js";
-import { Er as onAgentEvent, G as DEFAULT_INPUT_TIMEOUT_MS, H as DEFAULT_INPUT_IMAGE_MAX_BYTES, J as normalizeMimeList, Ja as sendJson, K as extractFileContentFromSource, Ka as resolveAgentIdForRequest, U as DEFAULT_INPUT_IMAGE_MIMES, W as DEFAULT_INPUT_MAX_REDIRECTS, Xa as writeDone, Y as resolveInputFileLimits, Ya as setSseHeaders, ft as handleGatewayPostJsonEndpoint, ht as agentCommand, mt as resolveAssistantStreamDeltaText, pt as buildAgentMessageFromConversationEntries, q as extractImageContentFromSource, qa as resolveSessionKey, wr as emitAgentEvent } from "./reply-BRoR6TOO.js";
+import { Er as onAgentEvent, G as DEFAULT_INPUT_TIMEOUT_MS, H as DEFAULT_INPUT_IMAGE_MAX_BYTES, J as normalizeMimeList, Ja as sendJson, K as extractFileContentFromSource, Ka as resolveAgentIdForRequest, U as DEFAULT_INPUT_IMAGE_MIMES, W as DEFAULT_INPUT_MAX_REDIRECTS, Xa as writeDone, Y as resolveInputFileLimits, Ya as setSseHeaders, ft as handleGatewayPostJsonEndpoint, ht as agentCommand, mt as resolveAssistantStreamDeltaText, pt as buildAgentMessageFromConversationEntries, q as extractImageContentFromSource, qa as resolveSessionKey, wr as emitAgentEvent } from "./reply-701mJB_S.js";
 import { d as defaultRuntime } from "./errors-Dx3S3Nrp.js";
 import "./send-C5_fB8YQ.js";
 import "./send-jxmRy65D.js";
@@ -14,10 +14,10 @@ import "./chrome-mXtDMFyZ.js";
 import "./pairing-token-BFGorDQo.js";
 import "./ip-D_T5zbZS.js";
 import "./ws-cvQhrVP3.js";
-import "./onboarding.wallet-CQG8MiG_.js";
+import "./onboarding.wallet-BFJRJg77.js";
 import "./wallet-runtime-config-BlRWvEER.js";
 import "./wallet-provider-registry-ax0NJo0F.js";
-import "./wallet-BguV7zPF.js";
+import "./wallet-DZA0r3pV.js";
 import "./wallet-approval-auth-DT-vofLs.js";
 import "./reply-prefix-C2EEc3pc.js";
 import "./media-C5BIKO-v.js";
@@ -37,7 +37,7 @@ import "./ssrf-Blf4NrHS.js";
 import "./outbound-attachment-CsXJwFsg.js";
 import "./fetch-CnCPOuq7.js";
 import "./delivery-queue-DKRjVFlq.js";
-import { t as createDefaultDeps } from "./deps-vuWHR8ix.js";
+import { t as createDefaultDeps } from "./deps-RXAe1X5s.js";
 import "./memory-DDpj0IVA.js";
 import "./memory-search-BwYkW6_V.js";
 import "./manager-BmONwMiP.js";

package/dist/{openresponses-http-BR0xNXbf.js → openresponses-http-eMouHu_v.js}

@@ -2,7 +2,7 @@ import { Ui as logWarn, wa as defaultRuntime } from "./agent-scope-Cb1u7HE7.js";
 import "./github-copilot-token-DYrFvncE.js";
 import "./send-vR6HwT94.js";
 import "./send-BQMxv218.js";
-import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-Dtw2m41q.js";
+import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-Pkm2p81t.js";
 import "./diagnostic-D6XQAXl4.js";
 import "./diagnostic-session-state-CexmAKza.js";
 import "./send-Da1hCe1A.js";

package/dist/{parent-default-help-B57KLY1o.js → parent-default-help-k4GD2-UF.js}

@@ -1,6 +1,6 @@
 import { Cd as isTruthyEnvValue, Nu as listChannelPlugins, jf as CHAT_CHANNEL_ORDER } from "./agent-scope-DHrLr5OF.js";
 import { c as listChannelPluginCatalogEntries } from "./dangerous-name-matching-CnyEIiOk.js";
-import { t as ensurePluginRegistryLoaded } from "./plugin-registry-C5c96kNk.js";
+import { t as ensurePluginRegistryLoaded } from "./plugin-registry-DfO1RfZv.js";
 
 //#region src/cli/channel-options.ts
 function dedupe(values) {

package/dist/{parent-default-help-B9-EyEJR.js → parent-default-help-zu6kW9Un.js}

@@ -1,6 +1,6 @@
 import { Gl as listChannelPlugins, Vf as CHAT_CHANNEL_ORDER, t as isTruthyEnvValue } from "./env-C77feXxI.js";
 import { d as listChannelPluginCatalogEntries } from "./dangerous-name-matching-CFRKz8Uq.js";
-import { t as ensurePluginRegistryLoaded } from "./plugin-registry-Dr7BDkEc.js";
+import { t as ensurePluginRegistryLoaded } from "./plugin-registry-DEewJtHt.js";
 
 //#region src/cli/channel-options.ts
 function dedupe(values) {

package/dist/{pi-embedded-G-VYb-eT.js → pi-embedded-DPElH0OZ.js}

@@ -19121,7 +19121,7 @@ function createOutboundSendDepsFromCliSource(deps) {
 function createDefaultDeps() {
 	return {
 		sendMessageWhatsApp: async (...args) => {
-			const { sendMessageWhatsApp } = await import("./web-l7WkPuq4.js");
+			const { sendMessageWhatsApp } = await import("./web-778GrijN.js");
 			return await sendMessageWhatsApp(...args);
 		},
 		sendMessageTelegram: async (...args) => {
@@ -91767,7 +91767,7 @@ async function preflightDiscordMessage(params) {
 	let preflightTranscript;
 	const hasAudioAttachment = message.attachments?.some((att) => att.contentType?.startsWith("audio/"));
 	if (!isDirectMessage && shouldRequireMention && hasAudioAttachment && !baseText && mentionRegexes.length > 0) try {
-		const { transcribeFirstAudio } = await import("./audio-preflight-CtOWrCYT.js");
+		const { transcribeFirstAudio } = await import("./audio-preflight-QMOvUkXH.js");
 		const audioPaths = message.attachments?.filter((att) => att.contentType?.startsWith("audio/")).map((att) => att.url) ?? [];
 		if (audioPaths.length > 0) preflightTranscript = await transcribeFirstAudio({
 			ctx: {
@@ -99064,7 +99064,7 @@ async function waitForTransportReady(params) {
 
 //#endregion
 //#region src/brand.ts
-const FASED_PRODUCT_VERSION = "0.1.19";
+const FASED_PRODUCT_VERSION = "0.1.21";
 const FASED_DISPLAY_VERSION = `v${FASED_PRODUCT_VERSION}`;
 
 //#endregion
@@ -108687,7 +108687,7 @@ const buildTelegramMessageContext = async ({ primaryCtx, allMedia, replyMedia =
 	const hasAudio = allMedia.some((media) => media.contentType?.startsWith("audio/"));
 	let preflightTranscript;
 	if (isGroup && requireMention && hasAudio && !hasUserText && mentionRegexes.length > 0) try {
-		const { transcribeFirstAudio } = await import("./audio-preflight-CtOWrCYT.js");
+		const { transcribeFirstAudio } = await import("./audio-preflight-QMOvUkXH.js");
 		preflightTranscript = await transcribeFirstAudio({
 			ctx: {
 				MediaPaths: allMedia.length > 0 ? allMedia.map((m) => m.path) : void 0,
@@ -111313,7 +111313,7 @@ function loadWebLoginQr() {
 	return webLoginQrPromise;
 }
 function loadWebChannel() {
-	webChannelPromise ??= import("./web-l7WkPuq4.js");
+	webChannelPromise ??= import("./web-778GrijN.js");
 	return webChannelPromise;
 }
 function loadWhatsAppActions() {

package/dist/{pi-embedded-Dtw2m41q.js → pi-embedded-Pkm2p81t.js}

@@ -19122,7 +19122,7 @@ function createOutboundSendDepsFromCliSource(deps) {
 function createDefaultDeps() {
 	return {
 		sendMessageWhatsApp: async (...args) => {
-			const { sendMessageWhatsApp } = await import("./web-CoSbILfi.js");
+			const { sendMessageWhatsApp } = await import("./web-D-SMykKz.js");
 			return await sendMessageWhatsApp(...args);
 		},
 		sendMessageTelegram: async (...args) => {
@@ -91758,7 +91758,7 @@ async function preflightDiscordMessage(params) {
 	let preflightTranscript;
 	const hasAudioAttachment = message.attachments?.some((att) => att.contentType?.startsWith("audio/"));
 	if (!isDirectMessage && shouldRequireMention && hasAudioAttachment && !baseText && mentionRegexes.length > 0) try {
-		const { transcribeFirstAudio } = await import("./audio-preflight-CKsWKtOL.js");
+		const { transcribeFirstAudio } = await import("./audio-preflight-DGoGnRdo.js");
 		const audioPaths = message.attachments?.filter((att) => att.contentType?.startsWith("audio/")).map((att) => att.url) ?? [];
 		if (audioPaths.length > 0) preflightTranscript = await transcribeFirstAudio({
 			ctx: {
@@ -99055,7 +99055,7 @@ async function waitForTransportReady(params) {
 
 //#endregion
 //#region src/brand.ts
-const FASED_PRODUCT_VERSION = "0.1.19";
+const FASED_PRODUCT_VERSION = "0.1.21";
 const FASED_DISPLAY_VERSION = `v${FASED_PRODUCT_VERSION}`;
 
 //#endregion
@@ -108678,7 +108678,7 @@ const buildTelegramMessageContext = async ({ primaryCtx, allMedia, replyMedia =
 	const hasAudio = allMedia.some((media) => media.contentType?.startsWith("audio/"));
 	let preflightTranscript;
 	if (isGroup && requireMention && hasAudio && !hasUserText && mentionRegexes.length > 0) try {
-		const { transcribeFirstAudio } = await import("./audio-preflight-CKsWKtOL.js");
+		const { transcribeFirstAudio } = await import("./audio-preflight-DGoGnRdo.js");
 		preflightTranscript = await transcribeFirstAudio({
 			ctx: {
 				MediaPaths: allMedia.length > 0 ? allMedia.map((m) => m.path) : void 0,
@@ -111304,7 +111304,7 @@ function loadWebLoginQr() {
 	return webLoginQrPromise;
 }
 function loadWebChannel() {
-	webChannelPromise ??= import("./web-CoSbILfi.js");
+	webChannelPromise ??= import("./web-D-SMykKz.js");
 	return webChannelPromise;
 }
 function loadWhatsAppActions() {