@fased/fased 0.1.20 → 0.1.23

package/dist/{onboarding-CBlXOasA.js → onboarding-BL3becPO.js}

@@ -1,13 +1,13 @@
 import { _ as resolveStateDir, u as resolveGatewayPort } from "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, U as theme } from "./agent-paths-DmOVZE7g.js";
 import { Ga as ensureAuthProfileStore, Mn as writeConfigFile, Zr as collectConfigServiceEnvVars, d as resolveDefaultAgentId, dd as formatCliCommand, fr as ensureActiveMemoryPluginAllowlisted, kn as readConfigFileSnapshot, u as resolveAgentWorkspaceDir } from "./agent-scope-DHrLr5OF.js";
-import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-B034LmuD.js";
+import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-C6zXCUnw.js";
 import { d as defaultRuntime, f as restoreTerminalState, s as redactSensitiveText } from "./errors-Dx3S3Nrp.js";
-import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-CQG8MiG_.js";
+import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-BFJRJg77.js";
 import { i as resolveLocalSignerRunAsUser, n as resolveLocalSignerBackendSocketPath, o as resolveLocalSignerSocketPath, r as resolveLocalSignerMaterialRootDir, t as ensureWalletStateDir } from "./wallet-runtime-config-BlRWvEER.js";
 import { a as readWalletProviderRegistry, l as setDefaultWallet, n as checkNamedWalletDeletionSafety, p as upsertNamedWallet, r as deleteNamedWallet, s as resolveWalletUserRole, u as setNamedWalletRole } from "./wallet-provider-registry-ax0NJo0F.js";
 import { n as redactSensitiveUrlLikeString } from "./redact-sensitive-url-B0RJQqO7.js";
-import { C as walletSetupCommand, k as readWalletStatusSnapshot, t as collectWalletSignerDoctorReport } from "./wallet-BguV7zPF.js";
+import { C as walletSetupCommand, k as readWalletStatusSnapshot, t as collectWalletSignerDoctorReport } from "./wallet-DZA0r3pV.js";
 import { c as loadPersistedFederationToken, i as resolveFederationBaseUrl, o as resolveFederationHandle, t as DEFAULT_FEDERATION_BASE_URL } from "./runtime-bsvPuEXH.js";
 import { t as readManagedFederationTokenSummary } from "./federation-BrNm7xtG.js";
 import { or as clearDeviceAuthStore } from "./call-DDALpDwS.js";
@@ -17,14 +17,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-CmxDYXvt.js";
 import { t as resolveGatewayService } from "./service-Bsg622jp.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-BRLbvcxT.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-B42xQEbV.js";
-import { o as waitForHostedDashboardBrowserPath } from "./health-kF4U3o3b.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DRyuJ7OL.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-EOHB6Adp.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-Cb1Ofo1o.js";
+import { o as waitForHostedDashboardBrowserPath } from "./health-GSYUFoyr.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-BTahePAl.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-Db0yW_LH.js";
 import { n as logConfigUpdated } from "./logging-Dv2wthF_.js";
-import { n as setupChannels } from "./onboard-channels-ZnUGKi2j.js";
+import { n as setupChannels } from "./onboard-channels-B3tCPpRS.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-BielXMUB.js";
-import { t as runTui } from "./tui-CF9NTWgo.js";
+import { t as runTui } from "./tui-D6_aw9hu.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -32,6 +32,7 @@ import fs$1 from "node:fs/promises";
 import { spawn, spawnSync } from "node:child_process";
 import { Writable } from "node:stream";
 import net from "node:net";
+import { Buffer as Buffer$1 } from "node:buffer";
 
 //#region src/commands/onboard-config.ts
 const ONBOARDING_DEFAULT_DM_SCOPE = "per-channel-peer";
@@ -1664,7 +1665,7 @@ async function finalizeOnboardingWizard(options) {
 	if (process.platform === "linux") {
 		const localSignerSync = resolveLocalSignerSyncForFinalize({ strictVps });
 		if (localSignerSync.sync) try {
-			const { syncLocalSocketSignerFromConfig } = await import("./onboarding.wallet-CQG8MiG_.js").then((n) => n.i);
+			const { syncLocalSocketSignerFromConfig } = await import("./onboarding.wallet-BFJRJg77.js").then((n) => n.i);
 			await syncLocalSocketSignerFromConfig({
 				config: nextConfig,
 				env: process.env,
@@ -3001,9 +3002,10 @@ function formatLocalDeviceTailnetRequirementNote() {
 		""
 	].join("\n");
 }
-function formatTailnetSshVerificationNote(target) {
+function formatTailnetSshVerificationNote(target, method = "ssh-key") {
 	const pingTargets = [target.host, target.ipv4 && target.ipv4 !== target.host ? target.ipv4 : void 0].filter((value) => Boolean(value));
 	const sshTargets = pingTargets;
+	const sshCommands = method === "tailscale-ssh" ? sshTargets.map((host) => `tailscale ssh ${target.user}@${host}`) : sshTargets.map((host) => `ssh ${target.user}@${host}`);
 	return [
 		noteStep(1, "Check visibility"),
 		"Run on your own computer:",
@@ -3016,32 +3018,150 @@ function formatTailnetSshVerificationNote(target) {
 		"",
 		noteStep(2, "SSH into VPS"),
 		"Run one command:",
-		...noteCommands(sshTargets.map((host) => `ssh ${target.user}@${host}`)),
+		...method === "tailscale-ssh" ? ["No app SSH key was found on this VPS.", "Use Tailscale SSH from your own Tailscale-connected computer:"] : [],
+		...noteCommands(sshCommands),
 		`Continue only after SSH opens in ${target.repoDir}.`,
 		"",
 		noteHeading("Fallback"),
-		noteWarn("If hostname lookup fails, keep the other VPN off and use the `100.x.x.x` command.")
+		noteWarn(method === "tailscale-ssh" ? "If Tailscale SSH is unavailable in your tailnet, choose the SSH public key fallback." : "If hostname lookup fails, keep the other VPN off and use the `100.x.x.x` command.")
 	].join("\n");
 }
+function formatTailnetSshPublicKeyNote(target) {
+	return [
+		noteStep(1, "Find your public key"),
+		"Use this fallback only when Tailscale SSH is unavailable in your tailnet.",
+		"Do this on your own computer while this VPS installer stays open.",
+		...noteCommands(["cat ~/.ssh/id_ed25519.pub", "type $env:USERPROFILE\\.ssh\\id_ed25519.pub"]),
+		noteWarn("Paste a `.pub` key only. Never paste a private key."),
+		"",
+		noteStep(2, "Create one if needed"),
+		"Run this on your own computer, then paste the `.pub` line here:",
+		...noteCommands(["ssh-keygen -t ed25519 -C \"fased-vps\" -f ~/.ssh/id_ed25519"]),
+		"",
+		noteStep(3, "What Fased will do"),
+		`Install that public key for ${target.user} at /home/${target.user}/.ssh/authorized_keys.`,
+		"Then you will test regular SSH over Tailscale before root/password access is locked down."
+	].join("\n");
+}
+function normalizeSshPublicKeys(input) {
+	const acceptedTypes = new Set([
+		"ecdsa-sha2-nistp256",
+		"ecdsa-sha2-nistp384",
+		"ecdsa-sha2-nistp521",
+		"sk-ecdsa-sha2-nistp256@openssh.com",
+		"sk-ssh-ed25519@openssh.com",
+		"ssh-ed25519",
+		"ssh-rsa"
+	]);
+	const lines = input.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	if (lines.length === 0) return {
+		ok: false,
+		keys: [],
+		detail: "Paste one SSH public key line."
+	};
+	if (lines.some((line) => /^-{5}BEGIN\b/i.test(line) || /PRIVATE KEY/i.test(line))) return {
+		ok: false,
+		keys: [],
+		detail: "That looks like a private key. Paste the `.pub` key only."
+	};
+	const normalized = [];
+	for (const line of lines) {
+		const parts = line.split(/\s+/);
+		const keyType = parts[0] ?? "";
+		const keyBody = parts[1] ?? "";
+		if (!acceptedTypes.has(keyType) || !/^[A-Za-z0-9+/]+={0,3}$/.test(keyBody)) return {
+			ok: false,
+			keys: [],
+			detail: "Paste a valid OpenSSH public key, for example `ssh-ed25519 AAAA... user@computer`."
+		};
+		normalized.push(parts.join(" "));
+	}
+	return {
+		ok: true,
+		keys: Array.from(new Set(normalized))
+	};
+}
+function buildInstallTailnetSshAuthorizedKeysCommand(target, keys) {
+	const sshDir = `/home/${target.user}/.ssh`;
+	const authorizedKeys = `${sshDir}/authorized_keys`;
+	const encodedKeys = Buffer$1.from(`${keys.join("\n")}\n`, "utf8").toString("base64");
+	return [
+		"set -e",
+		"umask 077",
+		`mkdir -p ${shellQuote(sshDir)}`,
+		"tmp_keys=\"$(mktemp)\"",
+		"tmp_merged=\"$(mktemp)\"",
+		`printf '%s' ${shellQuote(encodedKeys)} | base64 -d > "$tmp_keys"`,
+		`{ cat ${shellQuote(authorizedKeys)} 2>/dev/null || true; cat "$tmp_keys"; } | awk 'NF { print }' | sort -u > "$tmp_merged"`,
+		`install -m 600 "$tmp_merged" ${shellQuote(authorizedKeys)}`,
+		`chmod 700 ${shellQuote(sshDir)}`,
+		`chmod 600 ${shellQuote(authorizedKeys)}`,
+		"rm -f \"$tmp_keys\" \"$tmp_merged\""
+	].join("\n");
+}
+async function ensureTailnetSshAuthorizedKeys(params) {
+	const { target, logPath, runtime, prompter, runner } = params;
+	const authorizedKeys = `/home/${target.user}/.ssh/authorized_keys`;
+	if (runner(`test -s ${shellQuote(authorizedKeys)}`, logPath).ok) return true;
+	await prompter.note(formatTailnetSshPublicKeyNote(target), "SSH key fallback");
+	const parsed = normalizeSshPublicKeys(await prompter.text({
+		message: `Paste the SSH public key to install for ${target.user}`,
+		placeholder: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@computer",
+		validate: (value) => {
+			const parsed = normalizeSshPublicKeys(value);
+			return parsed.ok ? void 0 : parsed.detail;
+		}
+	}));
+	if (!parsed.ok) {
+		runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+		runtime.error(parsed.detail);
+		runtime.error(`Host hardening log: ${logPath}`);
+		runtime.exit(1);
+		return false;
+	}
+	const installResult = runner(buildInstallTailnetSshAuthorizedKeysCommand(target, parsed.keys), logPath);
+	if (!installResult.ok) {
+		runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+		runtime.error(`Could not install SSH public key for ${target.user}: ${authorizedKeys}`);
+		runtime.error(installResult.detail ?? "unknown SSH key install error");
+		runtime.error(`Host hardening log: ${logPath}`);
+		runtime.exit(1);
+		return false;
+	}
+	if (!runner(`test -s ${shellQuote(authorizedKeys)}`, logPath).ok) {
+		runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+		runtime.error(`SSH public key was not written for ${target.user}: ${authorizedKeys}`);
+		runtime.error(`Host hardening log: ${logPath}`);
+		runtime.exit(1);
+		return false;
+	}
+	appendHostSecurityLog(logPath, "tailnet ssh public key installed", `installed ${parsed.keys.length} public key(s) for ${target.user}: ${authorizedKeys}`);
+	return true;
+}
 function verifyTailnetSshServerPrerequisites(params) {
 	const runner = params.runner ?? run;
 	const target = params.target;
 	const checks = [];
 	const failures = [];
+	let method = "tailscale-ssh";
 	if (runner(`test -d ${shellQuote(target.repoDir)}`, params.logPath).ok) checks.push(`repo directory ready: ${target.repoDir}`);
 	else failures.push(`missing app repo directory: ${target.repoDir}`);
 	const authorizedKeys = `/home/${target.user}/.ssh/authorized_keys`;
-	if (runner(`test -s ${shellQuote(authorizedKeys)}`, params.logPath).ok) checks.push(`SSH keys ready: ${authorizedKeys}`);
-	else failures.push(`missing SSH public keys for ${target.user}: ${authorizedKeys}. The root bootstrap should copy your current authorized_keys; if you used password-only SSH, add a public key before hosting lock-down.`);
-	if (runner("systemctl is-active --quiet ssh || systemctl is-active --quiet sshd || sudo -n systemctl is-active --quiet ssh || sudo -n systemctl is-active --quiet sshd", params.logPath).ok) checks.push("OS SSH service active");
-	else failures.push("OS SSH service is not active");
+	if (runner(`test -s ${shellQuote(authorizedKeys)}`, params.logPath).ok) {
+		method = "ssh-key";
+		checks.push(`SSH keys ready: ${authorizedKeys}`);
+		if (runner("systemctl is-active --quiet ssh || systemctl is-active --quiet sshd || sudo -n systemctl is-active --quiet ssh || sudo -n systemctl is-active --quiet sshd", params.logPath).ok) checks.push("OS SSH service active");
+		else failures.push("OS SSH service is not active");
+	} else checks.push(`no app SSH keys at ${authorizedKeys}; using Tailscale SSH`);
 	if (failures.length > 0) return {
 		ok: false,
-		detail: failures.join("\n")
+		detail: failures.join("\n"),
+		method
 	};
 	return {
 		ok: true,
-		detail: checks.join("\n")
+		detail: checks.join("\n"),
+		method
 	};
 }
 function ensureTailnetSshIngressForVerification(params) {
@@ -3075,8 +3195,9 @@ function hasExplicitTailnetSshConfirmation(env = process.env) {
 }
 function failTailnetSshConfirmation(params) {
 	const { runtime, logPath, target } = params;
+	const commandPrefix = params.method === "tailscale-ssh" ? "tailscale ssh" : "ssh";
 	runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
-	runtime.error(`Confirm SSH over Tailscale first: ssh ${target.user}@${target.host}`);
+	runtime.error(`Confirm SSH over Tailscale first: ${commandPrefix} ${target.user}@${target.host}`);
 	runtime.error(`Expected app repo directory after login: ${target.repoDir}`);
 	runtime.error(`Host hardening log: ${logPath}`);
 	runtime.exit(1);
@@ -3095,10 +3216,16 @@ async function confirmTailnetSshBeforeLockdown(params) {
 		return true;
 	}
 	if (!prompter || opts.nonInteractive === true) {
+		const serverPrereqs = verifyTailnetSshServerPrerequisites({
+			target,
+			logPath,
+			runner
+		});
 		failTailnetSshConfirmation({
 			runtime,
 			logPath,
-			target
+			target,
+			method: serverPrereqs.method
 		});
 		return false;
 	}
@@ -3116,20 +3243,22 @@ async function confirmTailnetSshBeforeLockdown(params) {
 			return false;
 		}
 		appendHostSecurityLog(logPath, "tailnet ssh server prerequisites", serverPrereqs.detail);
-		const ingress = ensureTailnetSshIngressForVerification({
-			logPath,
-			runner
-		});
-		if (!ingress.ok) {
-			runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
-			runtime.error("Could not prepare the tailnet-only SSH firewall rule required for verification.");
-			runtime.error(ingress.detail ?? "unknown firewall error");
-			runtime.error(`Host hardening log: ${logPath}`);
-			runtime.exit(1);
-			return false;
-		}
-		appendHostSecurityLog(logPath, "tailnet ssh ingress prepared for verification", ingress.detail);
-		await prompter.note(formatTailnetSshVerificationNote(target), "Verify SSH over Tailscale");
+		if (serverPrereqs.method === "ssh-key") {
+			const ingress = ensureTailnetSshIngressForVerification({
+				logPath,
+				runner
+			});
+			if (!ingress.ok) {
+				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+				runtime.error("Could not prepare the tailnet-only SSH firewall rule required for verification.");
+				runtime.error(ingress.detail ?? "unknown firewall error");
+				runtime.error(`Host hardening log: ${logPath}`);
+				runtime.exit(1);
+				return false;
+			}
+			appendHostSecurityLog(logPath, "tailnet ssh ingress prepared for verification", ingress.detail);
+		} else appendHostSecurityLog(logPath, "tailnet ssh verification mode", "using Tailscale SSH because app authorized_keys is empty");
+		await prompter.note(formatTailnetSshVerificationNote(target, serverPrereqs.method), "Verify SSH over Tailscale");
 		if (!await prompter.confirm({
 			message: "Did tailscale ping find this VPS from your own computer?",
 			initialValue: false
@@ -3141,7 +3270,8 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				failTailnetSshConfirmation({
 					runtime,
 					logPath,
-					target
+					target,
+					method: serverPrereqs.method
 				});
 				return false;
 			}
@@ -3164,13 +3294,29 @@ async function confirmTailnetSshBeforeLockdown(params) {
 			continue;
 		}
 		if (!await prompter.confirm({
-			message: `Did SSH over Tailscale connect as ${target.user} and open ${target.repoDir}?`,
+			message: serverPrereqs.method === "tailscale-ssh" ? `Did Tailscale SSH connect as ${target.user} and open ${target.repoDir}?` : `Did SSH over Tailscale connect as ${target.user} and open ${target.repoDir}?`,
 			initialValue: false
 		})) {
+			if (serverPrereqs.method === "tailscale-ssh") {
+				if (await prompter.confirm({
+					message: "Use SSH public key fallback instead?",
+					initialValue: false
+				})) {
+					if (!await ensureTailnetSshAuthorizedKeys({
+						target,
+						logPath,
+						runtime,
+						prompter,
+						runner
+					})) return false;
+					continue;
+				}
+			}
 			failTailnetSshConfirmation({
 				runtime,
 				logPath,
-				target
+				target,
+				method: serverPrereqs.method
 			});
 			return false;
 		}