@fased/fased 0.1.21 → 0.1.23

package/dist/{onboard-C6Z7OaQ8.js → onboard-BR6vBv2I.js}

@@ -1,6 +1,6 @@
 import { Ba as normalizeOptionalSecretInput, Cu as formatCliCommand, Ii as resolveApiKeyForProfile, Ji as resolveDefaultSecretProviderAlias, Oa as loadPluginManifestRegistry, Pr as normalizeProviderId, Qt as readConfigFileSnapshot, Va as normalizeSecretInput, _n as parseDurationMs, di as resolveEnvApiKey, fa as upsertAuthProfile, ka as assertSupportedRuntime, ki as resolveAuthProfileOrder, ma as ensureAuthProfileStore, tn as writeConfigFile } from "./env-C77feXxI.js";
 import { x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
-import { A as waitForGatewayReachable, E as resolveControlUiLinks, T as randomToken, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, h as ensureWorkspaceAndSessions, s as resolvePluginProviders, v as handleOnboardingRepair } from "./model-catalog-BQ5G4eK6.js";
+import { A as waitForGatewayReachable, E as resolveControlUiLinks, T as randomToken, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, h as ensureWorkspaceAndSessions, s as resolvePluginProviders, v as handleOnboardingRepair } from "./model-catalog-Iu_LUOVA.js";
 import { A as defaultRuntime, gt as resolveGatewayPort, j as restoreTerminalState } from "./entry.js";
 import { a as readWalletProviderRegistry, f as setWalletProvidersEnabled, t as WALLET_PROVIDER_IDS } from "./wallet-provider-registry-CFNtQ2ZR.js";
 import { or as clearDeviceAuthStore } from "./call-B9EvxMq6.js";
@@ -8,12 +8,12 @@ import { r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from
 import { a as resolveHostedOnboardingGatewayStartupMode, n as gatewayInstallErrorHint, t as buildGatewayInstallPlan } from "./daemon-install-helpers-BB0qUcut.js";
 import { r as isSystemdUserServiceAvailable } from "./systemd-B8OPQXFR.js";
 import { t as resolveGatewayService } from "./service-2JBjv-ge.js";
-import { d as resolveCustomProviderId, l as parseNonInteractiveCustomApiFlags, o as CustomApiError, s as applyCustomApiConfig } from "./ipv4-D88X6kcK.js";
-import { i as healthCommand } from "./health-Db548DTY.js";
-import { $ as applyLitellmConfig, At as validateAnthropicSetupToken, B as applyMistralConfig, Ct as setXaiApiKey, Dt as MINIMAX_HIGHSPEED_MODEL_ID, Et as MINIMAX_DEFAULT_MODEL_ID, F as applyMinimaxApiConfig, Ft as resolveManifestProviderAuthChoice, G as applyQwenCodingPlanConfig, H as applyMoonshotConfigCn, I as applyMinimaxApiConfigCn, J as applyTogetherConfig, K as applyQwenConfig, L as applyAuthProfileConfig$1, M as detectZaiEndpoint, Mt as normalizeSecretInputModeInput, N as applyGoogleGeminiModelDefault, P as applyOpencodeZenConfig, Pt as resolveManifestDeprecatedProviderAuthChoice, Q as applyZaiConfig, R as applyHuggingfaceConfig, St as setVolcengineApiKey, Tt as setZaiApiKey, U as applyOpenrouterConfig, V as applyMoonshotConfig, W as applyQianfanConfig, X as applyXaiConfig, Y as applyVeniceConfig, Z as applyXiaomiConfig, _t as setQwenCodingPlanApiKey, at as setGeminiApiKey, bt as setVeniceApiKey, c as applyDefaultModel, ct as setLitellmApiKey, d as resolveProviderMatch, dt as setMoonshotApiKey, et as applyCloudflareAiGatewayConfig, ft as setOpenaiApiKey, gt as setQwenApiKey, ht as setQianfanApiKey, i as applyOpenAIConfig, it as setCloudflareAiGatewayConfig, kt as buildTokenProfileId, l as mergeConfigPatch, lt as setMinimaxApiKey, m as applyPrimaryModel, mt as setOpenrouterApiKey, nt as setAnthropicApiKey, o as applyAuthProfileConfig, ot as setHuggingfaceApiKey, pt as setOpencodeZenApiKey, q as applySyntheticConfig, rt as setByteplusApiKey, s as buildApiKeyCredential, st as setKimiCodingApiKey, tt as applyVercelAiGatewayConfig, u as pickAuthMethod, ut as setMistralApiKey, vt as setSyntheticApiKey, wt as setXiaomiApiKey, xt as setVercelAiGatewayApiKey, yt as setTogetherApiKey, z as applyKimiCodeConfig } from "./auth-choice-DbTYwdGn.js";
-import { a as normalizeLegacyOnboardAuthChoice, i as isDeprecatedAuthChoice, r as resolveOnboardProviderAuthFlags } from "./auth-choice-prompt-D5YuCYf7.js";
+import { d as resolveCustomProviderId, l as parseNonInteractiveCustomApiFlags, o as CustomApiError, s as applyCustomApiConfig } from "./ipv4-h9TrAq_w.js";
+import { i as healthCommand } from "./health-CghndVpq.js";
+import { $ as applyLitellmConfig, At as validateAnthropicSetupToken, B as applyMistralConfig, Ct as setXaiApiKey, Dt as MINIMAX_HIGHSPEED_MODEL_ID, Et as MINIMAX_DEFAULT_MODEL_ID, F as applyMinimaxApiConfig, Ft as resolveManifestProviderAuthChoice, G as applyQwenCodingPlanConfig, H as applyMoonshotConfigCn, I as applyMinimaxApiConfigCn, J as applyTogetherConfig, K as applyQwenConfig, L as applyAuthProfileConfig$1, M as detectZaiEndpoint, Mt as normalizeSecretInputModeInput, N as applyGoogleGeminiModelDefault, P as applyOpencodeZenConfig, Pt as resolveManifestDeprecatedProviderAuthChoice, Q as applyZaiConfig, R as applyHuggingfaceConfig, St as setVolcengineApiKey, Tt as setZaiApiKey, U as applyOpenrouterConfig, V as applyMoonshotConfig, W as applyQianfanConfig, X as applyXaiConfig, Y as applyVeniceConfig, Z as applyXiaomiConfig, _t as setQwenCodingPlanApiKey, at as setGeminiApiKey, bt as setVeniceApiKey, c as applyDefaultModel, ct as setLitellmApiKey, d as resolveProviderMatch, dt as setMoonshotApiKey, et as applyCloudflareAiGatewayConfig, ft as setOpenaiApiKey, gt as setQwenApiKey, ht as setQianfanApiKey, i as applyOpenAIConfig, it as setCloudflareAiGatewayConfig, kt as buildTokenProfileId, l as mergeConfigPatch, lt as setMinimaxApiKey, m as applyPrimaryModel, mt as setOpenrouterApiKey, nt as setAnthropicApiKey, o as applyAuthProfileConfig, ot as setHuggingfaceApiKey, pt as setOpencodeZenApiKey, q as applySyntheticConfig, rt as setByteplusApiKey, s as buildApiKeyCredential, st as setKimiCodingApiKey, tt as applyVercelAiGatewayConfig, u as pickAuthMethod, ut as setMistralApiKey, vt as setSyntheticApiKey, wt as setXiaomiApiKey, xt as setVercelAiGatewayApiKey, yt as setTogetherApiKey, z as applyKimiCodeConfig } from "./auth-choice-ioJ3htvR.js";
+import { a as normalizeLegacyOnboardAuthChoice, i as isDeprecatedAuthChoice, r as resolveOnboardProviderAuthFlags } from "./auth-choice-prompt-Cigxs_6f.js";
 import { n as logConfigUpdated } from "./logging-DZ32I_SP.js";
-import { a as applyRecommendedInternalHooks, i as isHostedSecurityCapableSession, n as applyHostingSecurity, o as applyOnboardingLocalWorkspaceConfig, r as configureFederationForOnboarding, t as runOnboardingWizard } from "./onboarding-DjXH2-ro.js";
+import { a as applyRecommendedInternalHooks, i as isHostedSecurityCapableSession, n as applyHostingSecurity, o as applyOnboardingLocalWorkspaceConfig, r as configureFederationForOnboarding, t as runOnboardingWizard } from "./onboarding-DGAQeYgr.js";
 import { t as WizardCancelledError } from "./prompts-DdS4bZNt.js";
 import { t as createClackPrompter } from "./clack-prompter-DhFjwbXA.js";
 import { n as ensureSystemdUserLingerNonInteractive } from "./systemd-linger-BlmGMvvA.js";

package/dist/{onboard-D8EOxPOn.js → onboard-C-fjU4uC.js}

@@ -1,7 +1,7 @@
 import { u as resolveGatewayPort } from "./paths-C9FmTW1x.js";
 import { S as resolveUserPath } from "./agent-paths-DmOVZE7g.js";
 import { Ga as ensureAuthProfileStore, Hi as resolveEnvApiKey, Jn as parseDurationMs, Mn as writeConfigFile, Ta as resolveDefaultSecretProviderAlias, Ua as upsertAuthProfile, ao as loadPluginManifestRegistry, bo as normalizeSecretInput, dd as formatCliCommand, di as normalizeProviderId, kn as readConfigFileSnapshot, oa as resolveAuthProfileOrder, oo as assertSupportedRuntime, pa as resolveApiKeyForProfile, yo as normalizeOptionalSecretInput } from "./agent-scope-DHrLr5OF.js";
-import { Lt as DEFAULT_WORKSPACE, Mt as resolvePluginProviders, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Zt as randomToken, nn as waitForGatewayReachable } from "./reply-701mJB_S.js";
+import { Lt as DEFAULT_WORKSPACE, Mt as resolvePluginProviders, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Zt as randomToken, nn as waitForGatewayReachable } from "./reply-C6zXCUnw.js";
 import { d as defaultRuntime, f as restoreTerminalState } from "./errors-Dx3S3Nrp.js";
 import { a as readWalletProviderRegistry, f as setWalletProvidersEnabled, t as WALLET_PROVIDER_IDS } from "./wallet-provider-registry-ax0NJo0F.js";
 import { or as clearDeviceAuthStore } from "./call-DDALpDwS.js";
@@ -9,12 +9,12 @@ import { r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from
 import { a as resolveHostedOnboardingGatewayStartupMode, n as gatewayInstallErrorHint, t as buildGatewayInstallPlan } from "./daemon-install-helpers-xM3QqMXu.js";
 import { r as isSystemdUserServiceAvailable } from "./systemd-CmxDYXvt.js";
 import { t as resolveGatewayService } from "./service-Bsg622jp.js";
-import { d as resolveCustomProviderId, l as parseNonInteractiveCustomApiFlags, o as CustomApiError, s as applyCustomApiConfig } from "./ipv4-Bh1H98-c.js";
-import { i as healthCommand } from "./health-C-AsEUPg.js";
-import { $ as applyLitellmConfig, At as validateAnthropicSetupToken, B as applyMistralConfig, Ct as setXaiApiKey, Dt as MINIMAX_HIGHSPEED_MODEL_ID, Et as MINIMAX_DEFAULT_MODEL_ID, F as applyMinimaxApiConfig, Ft as resolveManifestProviderAuthChoice, G as applyQwenCodingPlanConfig, H as applyMoonshotConfigCn, I as applyMinimaxApiConfigCn, J as applyTogetherConfig, K as applyQwenConfig, L as applyAuthProfileConfig$1, M as detectZaiEndpoint, Mt as normalizeSecretInputModeInput, N as applyGoogleGeminiModelDefault, P as applyOpencodeZenConfig, Pt as resolveManifestDeprecatedProviderAuthChoice, Q as applyZaiConfig, R as applyHuggingfaceConfig, St as setVolcengineApiKey, Tt as setZaiApiKey, U as applyOpenrouterConfig, V as applyMoonshotConfig, W as applyQianfanConfig, X as applyXaiConfig, Y as applyVeniceConfig, Z as applyXiaomiConfig, _t as setQwenCodingPlanApiKey, at as setGeminiApiKey, bt as setVeniceApiKey, c as applyDefaultModel, ct as setLitellmApiKey, d as resolveProviderMatch, dt as setMoonshotApiKey, et as applyCloudflareAiGatewayConfig, ft as setOpenaiApiKey, gt as setQwenApiKey, ht as setQianfanApiKey, i as applyOpenAIConfig, it as setCloudflareAiGatewayConfig, kt as buildTokenProfileId, l as mergeConfigPatch, lt as setMinimaxApiKey, m as applyPrimaryModel, mt as setOpenrouterApiKey, nt as setAnthropicApiKey, o as applyAuthProfileConfig, ot as setHuggingfaceApiKey, pt as setOpencodeZenApiKey, q as applySyntheticConfig, rt as setByteplusApiKey, s as buildApiKeyCredential, st as setKimiCodingApiKey, tt as applyVercelAiGatewayConfig, u as pickAuthMethod, ut as setMistralApiKey, vt as setSyntheticApiKey, wt as setXiaomiApiKey, xt as setVercelAiGatewayApiKey, yt as setTogetherApiKey, z as applyKimiCodeConfig } from "./auth-choice-D9LWnNpF.js";
-import { a as normalizeLegacyOnboardAuthChoice, i as isDeprecatedAuthChoice, r as resolveOnboardProviderAuthFlags } from "./auth-choice-prompt-DFyVEU7J.js";
+import { d as resolveCustomProviderId, l as parseNonInteractiveCustomApiFlags, o as CustomApiError, s as applyCustomApiConfig } from "./ipv4-Cb1Ofo1o.js";
+import { i as healthCommand } from "./health-GSYUFoyr.js";
+import { $ as applyLitellmConfig, At as validateAnthropicSetupToken, B as applyMistralConfig, Ct as setXaiApiKey, Dt as MINIMAX_HIGHSPEED_MODEL_ID, Et as MINIMAX_DEFAULT_MODEL_ID, F as applyMinimaxApiConfig, Ft as resolveManifestProviderAuthChoice, G as applyQwenCodingPlanConfig, H as applyMoonshotConfigCn, I as applyMinimaxApiConfigCn, J as applyTogetherConfig, K as applyQwenConfig, L as applyAuthProfileConfig$1, M as detectZaiEndpoint, Mt as normalizeSecretInputModeInput, N as applyGoogleGeminiModelDefault, P as applyOpencodeZenConfig, Pt as resolveManifestDeprecatedProviderAuthChoice, Q as applyZaiConfig, R as applyHuggingfaceConfig, St as setVolcengineApiKey, Tt as setZaiApiKey, U as applyOpenrouterConfig, V as applyMoonshotConfig, W as applyQianfanConfig, X as applyXaiConfig, Y as applyVeniceConfig, Z as applyXiaomiConfig, _t as setQwenCodingPlanApiKey, at as setGeminiApiKey, bt as setVeniceApiKey, c as applyDefaultModel, ct as setLitellmApiKey, d as resolveProviderMatch, dt as setMoonshotApiKey, et as applyCloudflareAiGatewayConfig, ft as setOpenaiApiKey, gt as setQwenApiKey, ht as setQianfanApiKey, i as applyOpenAIConfig, it as setCloudflareAiGatewayConfig, kt as buildTokenProfileId, l as mergeConfigPatch, lt as setMinimaxApiKey, m as applyPrimaryModel, mt as setOpenrouterApiKey, nt as setAnthropicApiKey, o as applyAuthProfileConfig, ot as setHuggingfaceApiKey, pt as setOpencodeZenApiKey, q as applySyntheticConfig, rt as setByteplusApiKey, s as buildApiKeyCredential, st as setKimiCodingApiKey, tt as applyVercelAiGatewayConfig, u as pickAuthMethod, ut as setMistralApiKey, vt as setSyntheticApiKey, wt as setXiaomiApiKey, xt as setVercelAiGatewayApiKey, yt as setTogetherApiKey, z as applyKimiCodeConfig } from "./auth-choice-BTahePAl.js";
+import { a as normalizeLegacyOnboardAuthChoice, i as isDeprecatedAuthChoice, r as resolveOnboardProviderAuthFlags } from "./auth-choice-prompt-Db0yW_LH.js";
 import { n as logConfigUpdated } from "./logging-Dv2wthF_.js";
-import { a as applyRecommendedInternalHooks, i as isHostedSecurityCapableSession, n as applyHostingSecurity, o as applyOnboardingLocalWorkspaceConfig, r as configureFederationForOnboarding, t as runOnboardingWizard } from "./onboarding-CIjqOjDq.js";
+import { a as applyRecommendedInternalHooks, i as isHostedSecurityCapableSession, n as applyHostingSecurity, o as applyOnboardingLocalWorkspaceConfig, r as configureFederationForOnboarding, t as runOnboardingWizard } from "./onboarding-BL3becPO.js";
 import { t as WizardCancelledError } from "./prompts-CbbpEiEO.js";
 import { t as createClackPrompter } from "./clack-prompter-Q_PN4iLX.js";
 import { n as ensureSystemdUserLingerNonInteractive } from "./systemd-linger-BTw_D-6k.js";

package/dist/{onboard-channels-C4gBvkYQ.js → onboard-channels-B3tCPpRS.js}

@@ -1,6 +1,6 @@
 import { _ as normalizeE164, i as CONFIG_DIR, v as pathExists } from "./agent-paths-DmOVZE7g.js";
 import { $l as runCommandWithTimeout, B as listChatChannels, Bd as listDiscordAccountIds, Dd as listSlackAccountIds, F as createSubsystemLogger, Fd as resolveSignalAccount, Hd as resolveDefaultDiscordAccountId, Hu as resolveDefaultWhatsAppAccountId, Id as listIMessageAccountIds, L as formatChannelPrimerLine, Ld as resolveDefaultIMessageAccountId, Mu as getChannelPlugin, Nd as listSignalAccountIds, Nu as listChannelPlugins, Od as resolveDefaultSlackAccountId, Pd as resolveDefaultSignalAccountId, R as formatChannelSelectionLine, Rd as resolveIMessageAccount, Ud as resolveDiscordAccount, Vu as listWhatsAppAccountIds, Wu as resolveWhatsAppAuthDir, _d as resolveDefaultTelegramAccountId, d as resolveDefaultAgentId, dd as formatCliCommand, gd as listTelegramAccountIds, kd as resolveSlackAccount, ld as stripAnsi, mo as resolveFasedAgentPackageRootSync, ou as extractArchive, u as resolveAgentWorkspaceDir, vd as resolveTelegramAccount, wl as installPluginFromNpmSpec } from "./agent-scope-DHrLr5OF.js";
-import { Ft as resolveSlackUserAllowlist, It as resolveSlackChannelAllowlist, Nt as loadFasedAgentPlugins, la as createPluginLoaderLogger, mn as resolveDiscordChannelAllowlist, pn as resolveDiscordUserAllowlist, zt as detectBinary } from "./reply-701mJB_S.js";
+import { Ft as resolveSlackUserAllowlist, It as resolveSlackChannelAllowlist, Nt as loadFasedAgentPlugins, la as createPluginLoaderLogger, mn as resolveDiscordChannelAllowlist, pn as resolveDiscordUserAllowlist, zt as detectBinary } from "./reply-C6zXCUnw.js";
 import { h as normalizeAccountId, m as DEFAULT_ACCOUNT_ID } from "./session-key-LmCHAJTQ.js";
 import { dt as normalizeDiscordSlug } from "./send-jxmRy65D.js";
 import { i as isBlockedHostnameOrIp } from "./ssrf-Blf4NrHS.js";
@@ -12,7 +12,7 @@ import { t as resolveBrewExecutable } from "./brew-C52GeCeh.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-BvDnvwsE.js";
 import { t as enablePluginInConfig } from "./enable-D3_YPNIT.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-DDbnXe4x.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-D2VlrxY8.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-CBewhyXk.js";
 import { t as fetchTelegramChatId } from "./api-DLdLLQm_.js";
 import fs, { createWriteStream, readFileSync } from "node:fs";
 import os from "node:os";

package/dist/{onboard-channels-CDr6F5Rc.js → onboard-channels-C1UyGFfb.js}

@@ -1,7 +1,7 @@
 import { $c as installPluginFromNpmSpec, $d as resolveDiscordAccount, $l as listWhatsAppAccountIds, Au as resolveTelegramAccount, Cu as formatCliCommand, Gd as resolveSignalAccount, Gl as listChannelPlugins, Gu as resolveDefaultAgentId, Jd as resolveIMessageAccount, Kd as listIMessageAccountIds, Ld as listSlackAccountIds, Ou as listTelegramAccountIds, Qd as resolveDefaultDiscordAccountId, Rd as resolveDefaultSlackAccountId, Ud as listSignalAccountIds, Wd as resolveDefaultSignalAccountId, Wl as getChannelPlugin, Wu as resolveAgentWorkspaceDir, Xd as listDiscordAccountIds, a as createSubsystemLogger, c as formatChannelSelectionLine, eu as resolveDefaultWhatsAppAccountId, ku as resolveDefaultTelegramAccountId, md as runCommandWithTimeout, nu as resolveWhatsAppAuthDir, pd as resolveFasedAgentPackageRootSync, qd as resolveDefaultIMessageAccountId, s as formatChannelPrimerLine, u as listChatChannels, xl as extractArchive, xu as stripAnsi, zd as resolveSlackAccount } from "./env-C77feXxI.js";
 import { _ as pathExists, g as normalizeE164, i as CONFIG_DIR } from "./agent-paths-BI1hx-tF.js";
 import { dt as normalizeDiscordSlug } from "./send-BFEd4vCM.js";
-import { Oi as createPluginLoaderLogger, Qt as resolveDiscordUserAllowlist, V as resolveDiscordChannelAllowlist, Zt as resolveSlackUserAllowlist, c as loadFasedAgentPlugins, p as detectBinary, u as resolveSlackChannelAllowlist } from "./model-catalog-BQ5G4eK6.js";
+import { Oi as createPluginLoaderLogger, Qt as resolveDiscordUserAllowlist, V as resolveDiscordChannelAllowlist, Zt as resolveSlackUserAllowlist, c as loadFasedAgentPlugins, p as detectBinary, u as resolveSlackChannelAllowlist } from "./model-catalog-Iu_LUOVA.js";
 import { J as DEFAULT_ACCOUNT_ID, Y as normalizeAccountId } from "./entry.js";
 import { i as isBlockedHostnameOrIp } from "./ssrf-CqV2hisj.js";
 import { d as listChannelPluginCatalogEntries, f as resolveChannelPluginExpectedPluginIds, l as formatChannelPluginCatalogSelectionHint, s as isChannelConfigured, u as formatChannelPluginCatalogStatusLine } from "./dangerous-name-matching-CFRKz8Uq.js";
@@ -12,7 +12,7 @@ import { t as loginWeb } from "./login-CuawnITW.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-BfdkoReO.js";
 import { t as enablePluginInConfig } from "./enable-C4xB2A3x.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-Cha8QIzO.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-C5O_poBp.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-CV1zHjpj.js";
 import { t as fetchTelegramChatId } from "./api-uvDKewCP.js";
 import { spawn } from "node:child_process";
 import os from "node:os";

package/dist/{onboard-search-BzpbxIgm.js → onboard-search-CjU6w3Sm.js}

@@ -2,7 +2,7 @@ import "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, i as CONFIG_DIR, m as isRecord } from "./agent-paths-DmOVZE7g.js";
 import { Co as coerceSecretRef, mo as resolveFasedAgentPackageRootSync, wl as installPluginFromNpmSpec } from "./agent-scope-DHrLr5OF.js";
 import "./commands-registry-BRvZQ1jh.js";
-import "./reply-701mJB_S.js";
+import "./reply-C6zXCUnw.js";
 import "./errors-Dx3S3Nrp.js";
 import "./send-C5_fB8YQ.js";
 import "./send-jxmRy65D.js";
@@ -37,7 +37,7 @@ import "./ssrf-Blf4NrHS.js";
 import "./outbound-attachment-CsXJwFsg.js";
 import "./fetch-CnCPOuq7.js";
 import "./delivery-queue-DKRjVFlq.js";
-import "./deps-RXAe1X5s.js";
+import "./deps-BVNeN6gT.js";
 import "./memory-DDpj0IVA.js";
 import "./memory-search-BwYkW6_V.js";
 import "./manager-BmONwMiP.js";
@@ -78,10 +78,10 @@ import "./prompt-style-CWAacuMq.js";
 import "./pairing-labels-D2yOKhoV.js";
 import { t as enablePluginInConfig } from "./enable-D3_YPNIT.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-DDbnXe4x.js";
-import "./status-D9As1GK-.js";
+import "./status-DVTZ42Xi.js";
 import "./update-Dew6hqdf.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-D2VlrxY8.js";
-import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-DcgcyEiV.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-CBewhyXk.js";
+import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-DCy32Tl0.js";
 import fs from "node:fs";
 import path from "node:path";
 

package/dist/{onboard-search-BDLus6nY.js → onboard-search-Ds5KeCF_.js}

@@ -2,7 +2,7 @@ import { $c as installPluginFromNpmSpec, Wa as coerceSecretRef, pd as resolveFas
 import { i as CONFIG_DIR, p as isRecord, x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
 import "./send-D7X0_iFp.js";
 import "./send-BFEd4vCM.js";
-import "./model-catalog-BQ5G4eK6.js";
+import "./model-catalog-Iu_LUOVA.js";
 import "./github-copilot-token-A9DiaCB0.js";
 import "./reply-prefix-TUhpEtvr.js";
 import "./memory-2keYbXkc.js";
@@ -44,7 +44,7 @@ import "./send-C-su1wPZ.js";
 import "./outbound-attachment-Bh4FmcYg.js";
 import "./fetch-BVvWzHT_.js";
 import "./delivery-queue-55Cityuq.js";
-import "./deps-DdP-Hmxc.js";
+import "./deps-Uo5boHSY.js";
 import "./frontmatter-D2UNJikU.js";
 import "./skills-Dis31awJ.js";
 import "./skills-remote-CIAB0AXm.js";
@@ -75,10 +75,10 @@ import "./prompt-style-Rmj3c-Ir.js";
 import "./pairing-labels-BCM1S2e_.js";
 import { t as enablePluginInConfig } from "./enable-C4xB2A3x.js";
 import { t as buildNpmResolutionInstallFields } from "./installs-Cha8QIzO.js";
-import "./status-DoLjTnlQ.js";
+import "./status-C1qehkux.js";
 import "./update-D4rhRm3D.js";
-import { o as finalizeInstalledPluginConfig } from "./lifecycle-C5O_poBp.js";
-import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-AAOfSU2b.js";
+import { o as finalizeInstalledPluginConfig } from "./lifecycle-CV1zHjpj.js";
+import { t as resolvePluginWebSearchProviders } from "./web-search-providers.runtime-BCjJQLBJ.js";
 import path from "node:path";
 import fs from "node:fs";
 

package/dist/{onboarding-CIjqOjDq.js → onboarding-BL3becPO.js}

@@ -1,7 +1,7 @@
 import { _ as resolveStateDir, u as resolveGatewayPort } from "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, U as theme } from "./agent-paths-DmOVZE7g.js";
 import { Ga as ensureAuthProfileStore, Mn as writeConfigFile, Zr as collectConfigServiceEnvVars, d as resolveDefaultAgentId, dd as formatCliCommand, fr as ensureActiveMemoryPluginAllowlisted, kn as readConfigFileSnapshot, u as resolveAgentWorkspaceDir } from "./agent-scope-DHrLr5OF.js";
-import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-701mJB_S.js";
+import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-C6zXCUnw.js";
 import { d as defaultRuntime, f as restoreTerminalState, s as redactSensitiveText } from "./errors-Dx3S3Nrp.js";
 import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-BFJRJg77.js";
 import { i as resolveLocalSignerRunAsUser, n as resolveLocalSignerBackendSocketPath, o as resolveLocalSignerSocketPath, r as resolveLocalSignerMaterialRootDir, t as ensureWalletStateDir } from "./wallet-runtime-config-BlRWvEER.js";
@@ -17,14 +17,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-CmxDYXvt.js";
 import { t as resolveGatewayService } from "./service-Bsg622jp.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-BRLbvcxT.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-Bh1H98-c.js";
-import { o as waitForHostedDashboardBrowserPath } from "./health-C-AsEUPg.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-D9LWnNpF.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-DFyVEU7J.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-Cb1Ofo1o.js";
+import { o as waitForHostedDashboardBrowserPath } from "./health-GSYUFoyr.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-BTahePAl.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-Db0yW_LH.js";
 import { n as logConfigUpdated } from "./logging-Dv2wthF_.js";
-import { n as setupChannels } from "./onboard-channels-C4gBvkYQ.js";
+import { n as setupChannels } from "./onboard-channels-B3tCPpRS.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-BielXMUB.js";
-import { t as runTui } from "./tui-D9armVLc.js";
+import { t as runTui } from "./tui-D6_aw9hu.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -32,6 +32,7 @@ import fs$1 from "node:fs/promises";
 import { spawn, spawnSync } from "node:child_process";
 import { Writable } from "node:stream";
 import net from "node:net";
+import { Buffer as Buffer$1 } from "node:buffer";
 
 //#region src/commands/onboard-config.ts
 const ONBOARDING_DEFAULT_DM_SCOPE = "per-channel-peer";
@@ -3001,9 +3002,10 @@ function formatLocalDeviceTailnetRequirementNote() {
 		""
 	].join("\n");
 }
-function formatTailnetSshVerificationNote(target) {
+function formatTailnetSshVerificationNote(target, method = "ssh-key") {
 	const pingTargets = [target.host, target.ipv4 && target.ipv4 !== target.host ? target.ipv4 : void 0].filter((value) => Boolean(value));
 	const sshTargets = pingTargets;
+	const sshCommands = method === "tailscale-ssh" ? sshTargets.map((host) => `tailscale ssh ${target.user}@${host}`) : sshTargets.map((host) => `ssh ${target.user}@${host}`);
 	return [
 		noteStep(1, "Check visibility"),
 		"Run on your own computer:",
@@ -3016,32 +3018,150 @@ function formatTailnetSshVerificationNote(target) {
 		"",
 		noteStep(2, "SSH into VPS"),
 		"Run one command:",
-		...noteCommands(sshTargets.map((host) => `ssh ${target.user}@${host}`)),
+		...method === "tailscale-ssh" ? ["No app SSH key was found on this VPS.", "Use Tailscale SSH from your own Tailscale-connected computer:"] : [],
+		...noteCommands(sshCommands),
 		`Continue only after SSH opens in ${target.repoDir}.`,
 		"",
 		noteHeading("Fallback"),
-		noteWarn("If hostname lookup fails, keep the other VPN off and use the `100.x.x.x` command.")
+		noteWarn(method === "tailscale-ssh" ? "If Tailscale SSH is unavailable in your tailnet, choose the SSH public key fallback." : "If hostname lookup fails, keep the other VPN off and use the `100.x.x.x` command.")
 	].join("\n");
 }
+function formatTailnetSshPublicKeyNote(target) {
+	return [
+		noteStep(1, "Find your public key"),
+		"Use this fallback only when Tailscale SSH is unavailable in your tailnet.",
+		"Do this on your own computer while this VPS installer stays open.",
+		...noteCommands(["cat ~/.ssh/id_ed25519.pub", "type $env:USERPROFILE\\.ssh\\id_ed25519.pub"]),
+		noteWarn("Paste a `.pub` key only. Never paste a private key."),
+		"",
+		noteStep(2, "Create one if needed"),
+		"Run this on your own computer, then paste the `.pub` line here:",
+		...noteCommands(["ssh-keygen -t ed25519 -C \"fased-vps\" -f ~/.ssh/id_ed25519"]),
+		"",
+		noteStep(3, "What Fased will do"),
+		`Install that public key for ${target.user} at /home/${target.user}/.ssh/authorized_keys.`,
+		"Then you will test regular SSH over Tailscale before root/password access is locked down."
+	].join("\n");
+}
+function normalizeSshPublicKeys(input) {
+	const acceptedTypes = new Set([
+		"ecdsa-sha2-nistp256",
+		"ecdsa-sha2-nistp384",
+		"ecdsa-sha2-nistp521",
+		"sk-ecdsa-sha2-nistp256@openssh.com",
+		"sk-ssh-ed25519@openssh.com",
+		"ssh-ed25519",
+		"ssh-rsa"
+	]);
+	const lines = input.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	if (lines.length === 0) return {
+		ok: false,
+		keys: [],
+		detail: "Paste one SSH public key line."
+	};
+	if (lines.some((line) => /^-{5}BEGIN\b/i.test(line) || /PRIVATE KEY/i.test(line))) return {
+		ok: false,
+		keys: [],
+		detail: "That looks like a private key. Paste the `.pub` key only."
+	};
+	const normalized = [];
+	for (const line of lines) {
+		const parts = line.split(/\s+/);
+		const keyType = parts[0] ?? "";
+		const keyBody = parts[1] ?? "";
+		if (!acceptedTypes.has(keyType) || !/^[A-Za-z0-9+/]+={0,3}$/.test(keyBody)) return {
+			ok: false,
+			keys: [],
+			detail: "Paste a valid OpenSSH public key, for example `ssh-ed25519 AAAA... user@computer`."
+		};
+		normalized.push(parts.join(" "));
+	}
+	return {
+		ok: true,
+		keys: Array.from(new Set(normalized))
+	};
+}
+function buildInstallTailnetSshAuthorizedKeysCommand(target, keys) {
+	const sshDir = `/home/${target.user}/.ssh`;
+	const authorizedKeys = `${sshDir}/authorized_keys`;
+	const encodedKeys = Buffer$1.from(`${keys.join("\n")}\n`, "utf8").toString("base64");
+	return [
+		"set -e",
+		"umask 077",
+		`mkdir -p ${shellQuote(sshDir)}`,
+		"tmp_keys=\"$(mktemp)\"",
+		"tmp_merged=\"$(mktemp)\"",
+		`printf '%s' ${shellQuote(encodedKeys)} | base64 -d > "$tmp_keys"`,
+		`{ cat ${shellQuote(authorizedKeys)} 2>/dev/null || true; cat "$tmp_keys"; } | awk 'NF { print }' | sort -u > "$tmp_merged"`,
+		`install -m 600 "$tmp_merged" ${shellQuote(authorizedKeys)}`,
+		`chmod 700 ${shellQuote(sshDir)}`,
+		`chmod 600 ${shellQuote(authorizedKeys)}`,
+		"rm -f \"$tmp_keys\" \"$tmp_merged\""
+	].join("\n");
+}
+async function ensureTailnetSshAuthorizedKeys(params) {
+	const { target, logPath, runtime, prompter, runner } = params;
+	const authorizedKeys = `/home/${target.user}/.ssh/authorized_keys`;
+	if (runner(`test -s ${shellQuote(authorizedKeys)}`, logPath).ok) return true;
+	await prompter.note(formatTailnetSshPublicKeyNote(target), "SSH key fallback");
+	const parsed = normalizeSshPublicKeys(await prompter.text({
+		message: `Paste the SSH public key to install for ${target.user}`,
+		placeholder: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@computer",
+		validate: (value) => {
+			const parsed = normalizeSshPublicKeys(value);
+			return parsed.ok ? void 0 : parsed.detail;
+		}
+	}));
+	if (!parsed.ok) {
+		runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+		runtime.error(parsed.detail);
+		runtime.error(`Host hardening log: ${logPath}`);
+		runtime.exit(1);
+		return false;
+	}
+	const installResult = runner(buildInstallTailnetSshAuthorizedKeysCommand(target, parsed.keys), logPath);
+	if (!installResult.ok) {
+		runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+		runtime.error(`Could not install SSH public key for ${target.user}: ${authorizedKeys}`);
+		runtime.error(installResult.detail ?? "unknown SSH key install error");
+		runtime.error(`Host hardening log: ${logPath}`);
+		runtime.exit(1);
+		return false;
+	}
+	if (!runner(`test -s ${shellQuote(authorizedKeys)}`, logPath).ok) {
+		runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+		runtime.error(`SSH public key was not written for ${target.user}: ${authorizedKeys}`);
+		runtime.error(`Host hardening log: ${logPath}`);
+		runtime.exit(1);
+		return false;
+	}
+	appendHostSecurityLog(logPath, "tailnet ssh public key installed", `installed ${parsed.keys.length} public key(s) for ${target.user}: ${authorizedKeys}`);
+	return true;
+}
 function verifyTailnetSshServerPrerequisites(params) {
 	const runner = params.runner ?? run;
 	const target = params.target;
 	const checks = [];
 	const failures = [];
+	let method = "tailscale-ssh";
 	if (runner(`test -d ${shellQuote(target.repoDir)}`, params.logPath).ok) checks.push(`repo directory ready: ${target.repoDir}`);
 	else failures.push(`missing app repo directory: ${target.repoDir}`);
 	const authorizedKeys = `/home/${target.user}/.ssh/authorized_keys`;
-	if (runner(`test -s ${shellQuote(authorizedKeys)}`, params.logPath).ok) checks.push(`SSH keys ready: ${authorizedKeys}`);
-	else failures.push(`missing SSH public keys for ${target.user}: ${authorizedKeys}. The root bootstrap should copy your current authorized_keys; if you used password-only SSH, add a public key before hosting lock-down.`);
-	if (runner("systemctl is-active --quiet ssh || systemctl is-active --quiet sshd || sudo -n systemctl is-active --quiet ssh || sudo -n systemctl is-active --quiet sshd", params.logPath).ok) checks.push("OS SSH service active");
-	else failures.push("OS SSH service is not active");
+	if (runner(`test -s ${shellQuote(authorizedKeys)}`, params.logPath).ok) {
+		method = "ssh-key";
+		checks.push(`SSH keys ready: ${authorizedKeys}`);
+		if (runner("systemctl is-active --quiet ssh || systemctl is-active --quiet sshd || sudo -n systemctl is-active --quiet ssh || sudo -n systemctl is-active --quiet sshd", params.logPath).ok) checks.push("OS SSH service active");
+		else failures.push("OS SSH service is not active");
+	} else checks.push(`no app SSH keys at ${authorizedKeys}; using Tailscale SSH`);
 	if (failures.length > 0) return {
 		ok: false,
-		detail: failures.join("\n")
+		detail: failures.join("\n"),
+		method
 	};
 	return {
 		ok: true,
-		detail: checks.join("\n")
+		detail: checks.join("\n"),
+		method
 	};
 }
 function ensureTailnetSshIngressForVerification(params) {
@@ -3075,8 +3195,9 @@ function hasExplicitTailnetSshConfirmation(env = process.env) {
 }
 function failTailnetSshConfirmation(params) {
 	const { runtime, logPath, target } = params;
+	const commandPrefix = params.method === "tailscale-ssh" ? "tailscale ssh" : "ssh";
 	runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
-	runtime.error(`Confirm SSH over Tailscale first: ssh ${target.user}@${target.host}`);
+	runtime.error(`Confirm SSH over Tailscale first: ${commandPrefix} ${target.user}@${target.host}`);
 	runtime.error(`Expected app repo directory after login: ${target.repoDir}`);
 	runtime.error(`Host hardening log: ${logPath}`);
 	runtime.exit(1);
@@ -3095,10 +3216,16 @@ async function confirmTailnetSshBeforeLockdown(params) {
 		return true;
 	}
 	if (!prompter || opts.nonInteractive === true) {
+		const serverPrereqs = verifyTailnetSshServerPrerequisites({
+			target,
+			logPath,
+			runner
+		});
 		failTailnetSshConfirmation({
 			runtime,
 			logPath,
-			target
+			target,
+			method: serverPrereqs.method
 		});
 		return false;
 	}
@@ -3116,20 +3243,22 @@ async function confirmTailnetSshBeforeLockdown(params) {
 			return false;
 		}
 		appendHostSecurityLog(logPath, "tailnet ssh server prerequisites", serverPrereqs.detail);
-		const ingress = ensureTailnetSshIngressForVerification({
-			logPath,
-			runner
-		});
-		if (!ingress.ok) {
-			runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
-			runtime.error("Could not prepare the tailnet-only SSH firewall rule required for verification.");
-			runtime.error(ingress.detail ?? "unknown firewall error");
-			runtime.error(`Host hardening log: ${logPath}`);
-			runtime.exit(1);
-			return false;
-		}
-		appendHostSecurityLog(logPath, "tailnet ssh ingress prepared for verification", ingress.detail);
-		await prompter.note(formatTailnetSshVerificationNote(target), "Verify SSH over Tailscale");
+		if (serverPrereqs.method === "ssh-key") {
+			const ingress = ensureTailnetSshIngressForVerification({
+				logPath,
+				runner
+			});
+			if (!ingress.ok) {
+				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+				runtime.error("Could not prepare the tailnet-only SSH firewall rule required for verification.");
+				runtime.error(ingress.detail ?? "unknown firewall error");
+				runtime.error(`Host hardening log: ${logPath}`);
+				runtime.exit(1);
+				return false;
+			}
+			appendHostSecurityLog(logPath, "tailnet ssh ingress prepared for verification", ingress.detail);
+		} else appendHostSecurityLog(logPath, "tailnet ssh verification mode", "using Tailscale SSH because app authorized_keys is empty");
+		await prompter.note(formatTailnetSshVerificationNote(target, serverPrereqs.method), "Verify SSH over Tailscale");
 		if (!await prompter.confirm({
 			message: "Did tailscale ping find this VPS from your own computer?",
 			initialValue: false
@@ -3141,7 +3270,8 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				failTailnetSshConfirmation({
 					runtime,
 					logPath,
-					target
+					target,
+					method: serverPrereqs.method
 				});
 				return false;
 			}
@@ -3164,13 +3294,29 @@ async function confirmTailnetSshBeforeLockdown(params) {
 			continue;
 		}
 		if (!await prompter.confirm({
-			message: `Did SSH over Tailscale connect as ${target.user} and open ${target.repoDir}?`,
+			message: serverPrereqs.method === "tailscale-ssh" ? `Did Tailscale SSH connect as ${target.user} and open ${target.repoDir}?` : `Did SSH over Tailscale connect as ${target.user} and open ${target.repoDir}?`,
 			initialValue: false
 		})) {
+			if (serverPrereqs.method === "tailscale-ssh") {
+				if (await prompter.confirm({
+					message: "Use SSH public key fallback instead?",
+					initialValue: false
+				})) {
+					if (!await ensureTailnetSshAuthorizedKeys({
+						target,
+						logPath,
+						runtime,
+						prompter,
+						runner
+					})) return false;
+					continue;
+				}
+			}
 			failTailnetSshConfirmation({
 				runtime,
 				logPath,
-				target
+				target,
+				method: serverPrereqs.method
 			});
 			return false;
 		}