@fased/fased 0.1.21 → 0.1.23

package/dist/{onboarding-DjXH2-ro.js → onboarding-DGAQeYgr.js}

@@ -1,6 +1,6 @@
 import { Cu as formatCliCommand, Fn as ensureActiveMemoryPluginAllowlisted, Gu as resolveDefaultAgentId, Qt as readConfigFileSnapshot, Wu as resolveAgentWorkspaceDir, br as collectConfigServiceEnvVars, ma as ensureAuthProfileStore, tn as writeConfigFile } from "./env-C77feXxI.js";
 import { H as theme, x as resolveUserPath } from "./agent-paths-BI1hx-tF.js";
-import { A as waitForGatewayReachable, C as printWizardHeader, E as resolveControlUiLinks, Ha as CONTROL_UI_BOOT_CHECK_PATH, O as summarizeExistingConfig, S as openUrl, T as randomToken, Wa as normalizeControlUiBasePath, bo as enableTailscaleServe, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, g as formatControlUiSshHint, h as ensureWorkspaceAndSessions, k as validateGatewayPasswordInput, m as detectBrowserOpenSupport, to as runFederationAutoConnectOnce, v as handleOnboardingRepair, w as probeGatewayReachable, x as normalizeGatewayTokenInput, xo as findTailscaleBinary, yo as enableTailscaleFunnel } from "./model-catalog-BQ5G4eK6.js";
+import { A as waitForGatewayReachable, C as printWizardHeader, E as resolveControlUiLinks, Ha as CONTROL_UI_BOOT_CHECK_PATH, O as summarizeExistingConfig, S as openUrl, T as randomToken, Wa as normalizeControlUiBasePath, bo as enableTailscaleServe, d as DEFAULT_WORKSPACE, f as applyWizardMetadata, g as formatControlUiSshHint, h as ensureWorkspaceAndSessions, k as validateGatewayPasswordInput, m as detectBrowserOpenSupport, to as runFederationAutoConnectOnce, v as handleOnboardingRepair, w as probeGatewayReachable, x as normalizeGatewayTokenInput, xo as findTailscaleBinary, yo as enableTailscaleFunnel } from "./model-catalog-Iu_LUOVA.js";
 import { A as defaultRuntime, Ct as resolveStateDir, E as redactSensitiveText, gt as resolveGatewayPort, j as restoreTerminalState } from "./entry.js";
 import { n as redactSensitiveUrlLikeString } from "./redact-sensitive-url-BW03TVj8.js";
 import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-B87UVKiT.js";
@@ -16,14 +16,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-B8OPQXFR.js";
 import { t as resolveGatewayService } from "./service-2JBjv-ge.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-COK5O0cM.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-D88X6kcK.js";
-import { s as waitForHostedDashboardBrowserPath } from "./health-Db548DTY.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DbTYwdGn.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-D5YuCYf7.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-h9TrAq_w.js";
+import { s as waitForHostedDashboardBrowserPath } from "./health-CghndVpq.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-ioJ3htvR.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-Cigxs_6f.js";
 import { n as logConfigUpdated } from "./logging-DZ32I_SP.js";
-import { n as setupChannels } from "./onboard-channels-CDr6F5Rc.js";
+import { n as setupChannels } from "./onboard-channels-C1UyGFfb.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-DRZciWMZ.js";
-import { t as runTui } from "./tui-BpbyDMEE.js";
+import { t as runTui } from "./tui-ARPlmctm.js";
 import { spawn, spawnSync } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
@@ -31,6 +31,7 @@ import fs from "node:fs";
 import fs$1 from "node:fs/promises";
 import { Writable } from "node:stream";
 import net from "node:net";
+import { Buffer as Buffer$1 } from "node:buffer";
 
 //#region src/commands/onboard-config.ts
 const ONBOARDING_DEFAULT_DM_SCOPE = "per-channel-peer";
@@ -3000,9 +3001,10 @@ function formatLocalDeviceTailnetRequirementNote() {
 		""
 	].join("\n");
 }
-function formatTailnetSshVerificationNote(target) {
+function formatTailnetSshVerificationNote(target, method = "ssh-key") {
 	const pingTargets = [target.host, target.ipv4 && target.ipv4 !== target.host ? target.ipv4 : void 0].filter((value) => Boolean(value));
 	const sshTargets = pingTargets;
+	const sshCommands = method === "tailscale-ssh" ? sshTargets.map((host) => `tailscale ssh ${target.user}@${host}`) : sshTargets.map((host) => `ssh ${target.user}@${host}`);
 	return [
 		noteStep(1, "Check visibility"),
 		"Run on your own computer:",
@@ -3015,32 +3017,150 @@ function formatTailnetSshVerificationNote(target) {
 		"",
 		noteStep(2, "SSH into VPS"),
 		"Run one command:",
-		...noteCommands(sshTargets.map((host) => `ssh ${target.user}@${host}`)),
+		...method === "tailscale-ssh" ? ["No app SSH key was found on this VPS.", "Use Tailscale SSH from your own Tailscale-connected computer:"] : [],
+		...noteCommands(sshCommands),
 		`Continue only after SSH opens in ${target.repoDir}.`,
 		"",
 		noteHeading("Fallback"),
-		noteWarn("If hostname lookup fails, keep the other VPN off and use the `100.x.x.x` command.")
+		noteWarn(method === "tailscale-ssh" ? "If Tailscale SSH is unavailable in your tailnet, choose the SSH public key fallback." : "If hostname lookup fails, keep the other VPN off and use the `100.x.x.x` command.")
 	].join("\n");
 }
+function formatTailnetSshPublicKeyNote(target) {
+	return [
+		noteStep(1, "Find your public key"),
+		"Use this fallback only when Tailscale SSH is unavailable in your tailnet.",
+		"Do this on your own computer while this VPS installer stays open.",
+		...noteCommands(["cat ~/.ssh/id_ed25519.pub", "type $env:USERPROFILE\\.ssh\\id_ed25519.pub"]),
+		noteWarn("Paste a `.pub` key only. Never paste a private key."),
+		"",
+		noteStep(2, "Create one if needed"),
+		"Run this on your own computer, then paste the `.pub` line here:",
+		...noteCommands(["ssh-keygen -t ed25519 -C \"fased-vps\" -f ~/.ssh/id_ed25519"]),
+		"",
+		noteStep(3, "What Fased will do"),
+		`Install that public key for ${target.user} at /home/${target.user}/.ssh/authorized_keys.`,
+		"Then you will test regular SSH over Tailscale before root/password access is locked down."
+	].join("\n");
+}
+function normalizeSshPublicKeys(input) {
+	const acceptedTypes = new Set([
+		"ecdsa-sha2-nistp256",
+		"ecdsa-sha2-nistp384",
+		"ecdsa-sha2-nistp521",
+		"sk-ecdsa-sha2-nistp256@openssh.com",
+		"sk-ssh-ed25519@openssh.com",
+		"ssh-ed25519",
+		"ssh-rsa"
+	]);
+	const lines = input.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	if (lines.length === 0) return {
+		ok: false,
+		keys: [],
+		detail: "Paste one SSH public key line."
+	};
+	if (lines.some((line) => /^-{5}BEGIN\b/i.test(line) || /PRIVATE KEY/i.test(line))) return {
+		ok: false,
+		keys: [],
+		detail: "That looks like a private key. Paste the `.pub` key only."
+	};
+	const normalized = [];
+	for (const line of lines) {
+		const parts = line.split(/\s+/);
+		const keyType = parts[0] ?? "";
+		const keyBody = parts[1] ?? "";
+		if (!acceptedTypes.has(keyType) || !/^[A-Za-z0-9+/]+={0,3}$/.test(keyBody)) return {
+			ok: false,
+			keys: [],
+			detail: "Paste a valid OpenSSH public key, for example `ssh-ed25519 AAAA... user@computer`."
+		};
+		normalized.push(parts.join(" "));
+	}
+	return {
+		ok: true,
+		keys: Array.from(new Set(normalized))
+	};
+}
+function buildInstallTailnetSshAuthorizedKeysCommand(target, keys) {
+	const sshDir = `/home/${target.user}/.ssh`;
+	const authorizedKeys = `${sshDir}/authorized_keys`;
+	const encodedKeys = Buffer$1.from(`${keys.join("\n")}\n`, "utf8").toString("base64");
+	return [
+		"set -e",
+		"umask 077",
+		`mkdir -p ${shellQuote(sshDir)}`,
+		"tmp_keys=\"$(mktemp)\"",
+		"tmp_merged=\"$(mktemp)\"",
+		`printf '%s' ${shellQuote(encodedKeys)} | base64 -d > "$tmp_keys"`,
+		`{ cat ${shellQuote(authorizedKeys)} 2>/dev/null || true; cat "$tmp_keys"; } | awk 'NF { print }' | sort -u > "$tmp_merged"`,
+		`install -m 600 "$tmp_merged" ${shellQuote(authorizedKeys)}`,
+		`chmod 700 ${shellQuote(sshDir)}`,
+		`chmod 600 ${shellQuote(authorizedKeys)}`,
+		"rm -f \"$tmp_keys\" \"$tmp_merged\""
+	].join("\n");
+}
+async function ensureTailnetSshAuthorizedKeys(params) {
+	const { target, logPath, runtime, prompter, runner } = params;
+	const authorizedKeys = `/home/${target.user}/.ssh/authorized_keys`;
+	if (runner(`test -s ${shellQuote(authorizedKeys)}`, logPath).ok) return true;
+	await prompter.note(formatTailnetSshPublicKeyNote(target), "SSH key fallback");
+	const parsed = normalizeSshPublicKeys(await prompter.text({
+		message: `Paste the SSH public key to install for ${target.user}`,
+		placeholder: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@computer",
+		validate: (value) => {
+			const parsed = normalizeSshPublicKeys(value);
+			return parsed.ok ? void 0 : parsed.detail;
+		}
+	}));
+	if (!parsed.ok) {
+		runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+		runtime.error(parsed.detail);
+		runtime.error(`Host hardening log: ${logPath}`);
+		runtime.exit(1);
+		return false;
+	}
+	const installResult = runner(buildInstallTailnetSshAuthorizedKeysCommand(target, parsed.keys), logPath);
+	if (!installResult.ok) {
+		runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+		runtime.error(`Could not install SSH public key for ${target.user}: ${authorizedKeys}`);
+		runtime.error(installResult.detail ?? "unknown SSH key install error");
+		runtime.error(`Host hardening log: ${logPath}`);
+		runtime.exit(1);
+		return false;
+	}
+	if (!runner(`test -s ${shellQuote(authorizedKeys)}`, logPath).ok) {
+		runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+		runtime.error(`SSH public key was not written for ${target.user}: ${authorizedKeys}`);
+		runtime.error(`Host hardening log: ${logPath}`);
+		runtime.exit(1);
+		return false;
+	}
+	appendHostSecurityLog(logPath, "tailnet ssh public key installed", `installed ${parsed.keys.length} public key(s) for ${target.user}: ${authorizedKeys}`);
+	return true;
+}
 function verifyTailnetSshServerPrerequisites(params) {
 	const runner = params.runner ?? run;
 	const target = params.target;
 	const checks = [];
 	const failures = [];
+	let method = "tailscale-ssh";
 	if (runner(`test -d ${shellQuote(target.repoDir)}`, params.logPath).ok) checks.push(`repo directory ready: ${target.repoDir}`);
 	else failures.push(`missing app repo directory: ${target.repoDir}`);
 	const authorizedKeys = `/home/${target.user}/.ssh/authorized_keys`;
-	if (runner(`test -s ${shellQuote(authorizedKeys)}`, params.logPath).ok) checks.push(`SSH keys ready: ${authorizedKeys}`);
-	else failures.push(`missing SSH public keys for ${target.user}: ${authorizedKeys}. The root bootstrap should copy your current authorized_keys; if you used password-only SSH, add a public key before hosting lock-down.`);
-	if (runner("systemctl is-active --quiet ssh || systemctl is-active --quiet sshd || sudo -n systemctl is-active --quiet ssh || sudo -n systemctl is-active --quiet sshd", params.logPath).ok) checks.push("OS SSH service active");
-	else failures.push("OS SSH service is not active");
+	if (runner(`test -s ${shellQuote(authorizedKeys)}`, params.logPath).ok) {
+		method = "ssh-key";
+		checks.push(`SSH keys ready: ${authorizedKeys}`);
+		if (runner("systemctl is-active --quiet ssh || systemctl is-active --quiet sshd || sudo -n systemctl is-active --quiet ssh || sudo -n systemctl is-active --quiet sshd", params.logPath).ok) checks.push("OS SSH service active");
+		else failures.push("OS SSH service is not active");
+	} else checks.push(`no app SSH keys at ${authorizedKeys}; using Tailscale SSH`);
 	if (failures.length > 0) return {
 		ok: false,
-		detail: failures.join("\n")
+		detail: failures.join("\n"),
+		method
 	};
 	return {
 		ok: true,
-		detail: checks.join("\n")
+		detail: checks.join("\n"),
+		method
 	};
 }
 function ensureTailnetSshIngressForVerification(params) {
@@ -3074,8 +3194,9 @@ function hasExplicitTailnetSshConfirmation(env = process.env) {
 }
 function failTailnetSshConfirmation(params) {
 	const { runtime, logPath, target } = params;
+	const commandPrefix = params.method === "tailscale-ssh" ? "tailscale ssh" : "ssh";
 	runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
-	runtime.error(`Confirm SSH over Tailscale first: ssh ${target.user}@${target.host}`);
+	runtime.error(`Confirm SSH over Tailscale first: ${commandPrefix} ${target.user}@${target.host}`);
 	runtime.error(`Expected app repo directory after login: ${target.repoDir}`);
 	runtime.error(`Host hardening log: ${logPath}`);
 	runtime.exit(1);
@@ -3094,10 +3215,16 @@ async function confirmTailnetSshBeforeLockdown(params) {
 		return true;
 	}
 	if (!prompter || opts.nonInteractive === true) {
+		const serverPrereqs = verifyTailnetSshServerPrerequisites({
+			target,
+			logPath,
+			runner
+		});
 		failTailnetSshConfirmation({
 			runtime,
 			logPath,
-			target
+			target,
+			method: serverPrereqs.method
 		});
 		return false;
 	}
@@ -3115,20 +3242,22 @@ async function confirmTailnetSshBeforeLockdown(params) {
 			return false;
 		}
 		appendHostSecurityLog(logPath, "tailnet ssh server prerequisites", serverPrereqs.detail);
-		const ingress = ensureTailnetSshIngressForVerification({
-			logPath,
-			runner
-		});
-		if (!ingress.ok) {
-			runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
-			runtime.error("Could not prepare the tailnet-only SSH firewall rule required for verification.");
-			runtime.error(ingress.detail ?? "unknown firewall error");
-			runtime.error(`Host hardening log: ${logPath}`);
-			runtime.exit(1);
-			return false;
-		}
-		appendHostSecurityLog(logPath, "tailnet ssh ingress prepared for verification", ingress.detail);
-		await prompter.note(formatTailnetSshVerificationNote(target), "Verify SSH over Tailscale");
+		if (serverPrereqs.method === "ssh-key") {
+			const ingress = ensureTailnetSshIngressForVerification({
+				logPath,
+				runner
+			});
+			if (!ingress.ok) {
+				runtime.error("Hosting setup stopped before SSH/firewall lock-down.");
+				runtime.error("Could not prepare the tailnet-only SSH firewall rule required for verification.");
+				runtime.error(ingress.detail ?? "unknown firewall error");
+				runtime.error(`Host hardening log: ${logPath}`);
+				runtime.exit(1);
+				return false;
+			}
+			appendHostSecurityLog(logPath, "tailnet ssh ingress prepared for verification", ingress.detail);
+		} else appendHostSecurityLog(logPath, "tailnet ssh verification mode", "using Tailscale SSH because app authorized_keys is empty");
+		await prompter.note(formatTailnetSshVerificationNote(target, serverPrereqs.method), "Verify SSH over Tailscale");
 		if (!await prompter.confirm({
 			message: "Did tailscale ping find this VPS from your own computer?",
 			initialValue: false
@@ -3140,7 +3269,8 @@ async function confirmTailnetSshBeforeLockdown(params) {
 				failTailnetSshConfirmation({
 					runtime,
 					logPath,
-					target
+					target,
+					method: serverPrereqs.method
 				});
 				return false;
 			}
@@ -3163,13 +3293,29 @@ async function confirmTailnetSshBeforeLockdown(params) {
 			continue;
 		}
 		if (!await prompter.confirm({
-			message: `Did SSH over Tailscale connect as ${target.user} and open ${target.repoDir}?`,
+			message: serverPrereqs.method === "tailscale-ssh" ? `Did Tailscale SSH connect as ${target.user} and open ${target.repoDir}?` : `Did SSH over Tailscale connect as ${target.user} and open ${target.repoDir}?`,
 			initialValue: false
 		})) {
+			if (serverPrereqs.method === "tailscale-ssh") {
+				if (await prompter.confirm({
+					message: "Use SSH public key fallback instead?",
+					initialValue: false
+				})) {
+					if (!await ensureTailnetSshAuthorizedKeys({
+						target,
+						logPath,
+						runtime,
+						prompter,
+						runner
+					})) return false;
+					continue;
+				}
+			}
 			failTailnetSshConfirmation({
 				runtime,
 				logPath,
-				target
+				target,
+				method: serverPrereqs.method
 			});
 			return false;
 		}

package/dist/{openresponses-http-C9x0SEG6.js → openresponses-http-Bcy1YyQY.js}

@@ -2,7 +2,7 @@ import { bd as logWarn } from "./env-C77feXxI.js";
 import "./agent-paths-BI1hx-tF.js";
 import "./send-D7X0_iFp.js";
 import "./send-BFEd4vCM.js";
-import { Ai as buildAgentMessageFromConversationEntries, Ii as resolveAssistantStreamDeltaText, Li as agentCommand, _a as resolveAgentIdForRequest, an as DEFAULT_INPUT_IMAGE_MAX_BYTES, ba as setSseHeaders, cn as DEFAULT_INPUT_TIMEOUT_MS, dn as normalizeMimeList, fn as resolveInputFileLimits, ia as emitAgentEvent, ki as handleGatewayPostJsonEndpoint, ln as extractFileContentFromSource, oa as onAgentEvent, on as DEFAULT_INPUT_IMAGE_MIMES, sn as DEFAULT_INPUT_MAX_REDIRECTS, un as extractImageContentFromSource, va as resolveSessionKey, xa as writeDone, ya as sendJson } from "./model-catalog-BQ5G4eK6.js";
+import { Ai as buildAgentMessageFromConversationEntries, Ii as resolveAssistantStreamDeltaText, Li as agentCommand, _a as resolveAgentIdForRequest, an as DEFAULT_INPUT_IMAGE_MAX_BYTES, ba as setSseHeaders, cn as DEFAULT_INPUT_TIMEOUT_MS, dn as normalizeMimeList, fn as resolveInputFileLimits, ia as emitAgentEvent, ki as handleGatewayPostJsonEndpoint, ln as extractFileContentFromSource, oa as onAgentEvent, on as DEFAULT_INPUT_IMAGE_MIMES, sn as DEFAULT_INPUT_MAX_REDIRECTS, un as extractImageContentFromSource, va as resolveSessionKey, xa as writeDone, ya as sendJson } from "./model-catalog-Iu_LUOVA.js";
 import "./github-copilot-token-A9DiaCB0.js";
 import { A as defaultRuntime } from "./entry.js";
 import "./reply-prefix-TUhpEtvr.js";
@@ -45,7 +45,7 @@ import "./send-C-su1wPZ.js";
 import "./outbound-attachment-Bh4FmcYg.js";
 import "./fetch-BVvWzHT_.js";
 import "./delivery-queue-55Cityuq.js";
-import { t as createDefaultDeps } from "./deps-DdP-Hmxc.js";
+import { t as createDefaultDeps } from "./deps-Uo5boHSY.js";
 import "./frontmatter-D2UNJikU.js";
 import "./skills-Dis31awJ.js";
 import "./skills-remote-CIAB0AXm.js";

package/dist/{openresponses-http-eMouHu_v.js → openresponses-http-DIR_t4i1.js}

@@ -1,39 +1,39 @@
-import { Ui as logWarn, wa as defaultRuntime } from "./agent-scope-Cb1u7HE7.js";
-import "./github-copilot-token-DYrFvncE.js";
-import "./send-vR6HwT94.js";
-import "./send-BQMxv218.js";
-import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-Pkm2p81t.js";
-import "./diagnostic-D6XQAXl4.js";
+import { Ui as logWarn, wa as defaultRuntime } from "./agent-scope-DwKyukUg.js";
+import "./github-copilot-token-eyrRGmGp.js";
+import "./send-CABrQiXU.js";
+import "./send-CUYy-rA3.js";
+import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-qk5CdQmR.js";
+import "./diagnostic-B4NKiC20.js";
 import "./diagnostic-session-state-CexmAKza.js";
-import "./send-Da1hCe1A.js";
-import "./media-DUBmlR9u.js";
-import "./pi-model-discovery-DYwyxntg.js";
-import "./paths-BGX-IMoI.js";
+import "./send-lQXOUIaW.js";
+import "./media-DZj8v0oe.js";
+import "./pi-model-discovery-CfcnLOyX.js";
+import "./paths-57KGLbK2.js";
 import "./ssrf-DYsl9qoS.js";
-import "./reply-prefix-DwrVxkMY.js";
-import "./path-alias-guards--dquYHnR.js";
-import "./fs-safe-DcQcXS6I.js";
-import "./skill-commands-BP6zVlmg.js";
-import "./chunk-Cj87uJLo.js";
-import "./markdown-tables-CBLut_ie.js";
-import "./send-BsajjIj8.js";
-import "./fetch-guard-B3bzvmt4.js";
-import "./outbound-attachment-CZV6JZkx.js";
-import "./fetch-BKzFOgku.js";
-import "./memory-search-tdsFhtIi.js";
-import "./manager-C05ypUW3.js";
-import "./query-expansion-f4DE13gJ.js";
-import "./target-errors-CR_hozUt.js";
+import "./reply-prefix-CG0zciBg.js";
+import "./path-alias-guards-BgsM3Cb3.js";
+import "./fs-safe-CwUdejUJ.js";
+import "./skill-commands-CCjZMCdx.js";
+import "./chunk-DfA5CGzI.js";
+import "./markdown-tables-DFtTedxN.js";
+import "./send-iIy3frXq.js";
+import "./fetch-guard-DqpQMLwE.js";
+import "./outbound-attachment-NKTzAe-U.js";
+import "./fetch-BH7uURYM.js";
+import "./memory-search-BxRjHrXP.js";
+import "./manager-Cxjfnksb.js";
+import "./query-expansion-JhTilyB1.js";
+import "./target-errors-9BsSMzQY.js";
 import "./render-BRr7caFG.js";
-import "./commands-registry-Du1VUNqv.js";
-import "./config-eval-BVvNsPGB.js";
-import "./send-kLcLFjb8.js";
-import "./resolve-route-B4dOoe-E.js";
-import "./channel-activity-DY_GHJwO.js";
-import "./tables-DMwrn7NN.js";
+import "./commands-registry-ShBrc7Zz.js";
+import "./config-eval-B5XXAbrm.js";
+import "./send-DE1no-h6.js";
+import "./resolve-route-DZkIcri6.js";
+import "./channel-activity-D17GYsMz.js";
+import "./tables-H4kq3TrS.js";
 import "./proxy-DkRPPIHD.js";
 import "./config-CtKjZZ4x.js";
-import "./replies-Bn06Bh1x.js";
+import "./replies-afs2sQ1G.js";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 

package/dist/{openresponses-http-DU9S_V_8.js → openresponses-http-DxsL0uBk.js}

@@ -2,7 +2,7 @@ import { Sa as defaultRuntime, Vi as logWarn } from "./agent-scope-DUKEZjqM.js";
 import "./github-copilot-token-CNsqwfnE.js";
 import "./send-CFSRf7De.js";
 import "./send-gtmn6YeH.js";
-import { B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as sendJson, et as emitAgentEvent, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, tt as onAgentEvent, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-DPElH0OZ.js";
+import { B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as sendJson, et as emitAgentEvent, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, tt as onAgentEvent, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-CZAiurHo.js";
 import "./reply-prefix-Bitnsmpd.js";
 import "./diagnostic-_BiQ6GgD.js";
 import "./diagnostic-session-state-CL_QxyRg.js";

package/dist/{openresponses-http-NFMdHWOs.js → openresponses-http-IVnQ_wz0.js}

@@ -2,7 +2,7 @@ import "./paths-C9FmTW1x.js";
 import "./agent-paths-DmOVZE7g.js";
 import { au as logWarn } from "./agent-scope-DHrLr5OF.js";
 import "./commands-registry-BRvZQ1jh.js";
-import { Er as onAgentEvent, G as DEFAULT_INPUT_TIMEOUT_MS, H as DEFAULT_INPUT_IMAGE_MAX_BYTES, J as normalizeMimeList, Ja as sendJson, K as extractFileContentFromSource, Ka as resolveAgentIdForRequest, U as DEFAULT_INPUT_IMAGE_MIMES, W as DEFAULT_INPUT_MAX_REDIRECTS, Xa as writeDone, Y as resolveInputFileLimits, Ya as setSseHeaders, ft as handleGatewayPostJsonEndpoint, ht as agentCommand, mt as resolveAssistantStreamDeltaText, pt as buildAgentMessageFromConversationEntries, q as extractImageContentFromSource, qa as resolveSessionKey, wr as emitAgentEvent } from "./reply-701mJB_S.js";
+import { Er as onAgentEvent, G as DEFAULT_INPUT_TIMEOUT_MS, H as DEFAULT_INPUT_IMAGE_MAX_BYTES, J as normalizeMimeList, Ja as sendJson, K as extractFileContentFromSource, Ka as resolveAgentIdForRequest, U as DEFAULT_INPUT_IMAGE_MIMES, W as DEFAULT_INPUT_MAX_REDIRECTS, Xa as writeDone, Y as resolveInputFileLimits, Ya as setSseHeaders, ft as handleGatewayPostJsonEndpoint, ht as agentCommand, mt as resolveAssistantStreamDeltaText, pt as buildAgentMessageFromConversationEntries, q as extractImageContentFromSource, qa as resolveSessionKey, wr as emitAgentEvent } from "./reply-C6zXCUnw.js";
 import { d as defaultRuntime } from "./errors-Dx3S3Nrp.js";
 import "./send-C5_fB8YQ.js";
 import "./send-jxmRy65D.js";
@@ -37,7 +37,7 @@ import "./ssrf-Blf4NrHS.js";
 import "./outbound-attachment-CsXJwFsg.js";
 import "./fetch-CnCPOuq7.js";
 import "./delivery-queue-DKRjVFlq.js";
-import { t as createDefaultDeps } from "./deps-RXAe1X5s.js";
+import { t as createDefaultDeps } from "./deps-BVNeN6gT.js";
 import "./memory-DDpj0IVA.js";
 import "./memory-search-BwYkW6_V.js";
 import "./manager-BmONwMiP.js";

package/dist/{openresponses-http-BA2nkk7t.js → openresponses-http-Qb_KOtcX.js}

@@ -1,6 +1,6 @@
 import "./github-copilot-token-Dy7Y_jbI.js";
 import { la as logWarn, qo as defaultRuntime } from "./paths-OUJyk-5R.js";
-import { B as extractImageContentFromSource, F as DEFAULT_INPUT_IMAGE_MAX_BYTES, H as resolveInputFileLimits, I as DEFAULT_INPUT_IMAGE_MIMES, L as DEFAULT_INPUT_MAX_REDIRECTS, R as DEFAULT_INPUT_TIMEOUT_MS, V as normalizeMimeList, X as emitAgentEvent, Z as onAgentEvent, a as agentCommand, at as sendJson, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, z as extractFileContentFromSource } from "./auth-7Dkf1_CI.js";
+import { B as extractImageContentFromSource, F as DEFAULT_INPUT_IMAGE_MAX_BYTES, H as resolveInputFileLimits, I as DEFAULT_INPUT_IMAGE_MIMES, L as DEFAULT_INPUT_MAX_REDIRECTS, R as DEFAULT_INPUT_TIMEOUT_MS, V as normalizeMimeList, X as emitAgentEvent, Z as onAgentEvent, a as agentCommand, at as sendJson, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, z as extractFileContentFromSource } from "./auth-C4Rs_Ca4.js";
 import "./send-D96gGRQz.js";
 import "./send-BFoI9HuU.js";
 import "./skill-commands-DvoCSQnx.js";

package/dist/{outbound-BF3W1nJQ.js → outbound-BtgGTj4E.js}

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { Gt as loadConfig, Ms as getChildLogger, as as escapeRegExp, k as createSubsystemLogger, ys as toWhatsappJid } from "./agent-scope-Cb1u7HE7.js";
+import { Gt as loadConfig, Ms as getChildLogger, as as escapeRegExp, k as createSubsystemLogger, ys as toWhatsappJid } from "./agent-scope-DwKyukUg.js";
 import { n as generateSecureUuid } from "./secure-random-CSsVRTTy.js";
 import { t as redactIdentifier } from "./redact-identifier-Cy6Tnhkn.js";
-import { n as loadWebMedia } from "./media-DUBmlR9u.js";
-import { n as resolveMarkdownTableMode } from "./markdown-tables-CBLut_ie.js";
+import { n as loadWebMedia } from "./media-DZj8v0oe.js";
+import { n as resolveMarkdownTableMode } from "./markdown-tables-DFtTedxN.js";
 import { n as normalizePollInput } from "./polls-CYTwXmA1.js";
-import { t as convertMarkdownTables } from "./tables-DMwrn7NN.js";
-import { n as requireActiveWebListener } from "./active-listener-B_AAz_Nv.js";
-import { n as formatError } from "./session-ZMAktQw4.js";
+import { t as convertMarkdownTables } from "./tables-H4kq3TrS.js";
+import { n as requireActiveWebListener } from "./active-listener-CILIY2ox.js";
+import { n as formatError } from "./session-TK9Idt8g.js";
 
 //#region src/markdown/whatsapp.ts
 /**

package/dist/{outbound-attachment-CZV6JZkx.js → outbound-attachment-NKTzAe-U.js}

@@ -1,5 +1,5 @@
-import { ds as resolveConfigDir } from "./agent-scope-Cb1u7HE7.js";
-import { _ as extensionForMime, g as detectMime, n as loadWebMedia } from "./media-DUBmlR9u.js";
+import { ds as resolveConfigDir } from "./agent-scope-DwKyukUg.js";
+import { _ as extensionForMime, g as detectMime, n as loadWebMedia } from "./media-DZj8v0oe.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import crypto from "node:crypto";

package/dist/{parent-default-help-zu6kW9Un.js → parent-default-help-BJGqN88G.js}

@@ -1,6 +1,6 @@
 import { Gl as listChannelPlugins, Vf as CHAT_CHANNEL_ORDER, t as isTruthyEnvValue } from "./env-C77feXxI.js";
 import { d as listChannelPluginCatalogEntries } from "./dangerous-name-matching-CFRKz8Uq.js";
-import { t as ensurePluginRegistryLoaded } from "./plugin-registry-DEewJtHt.js";
+import { t as ensurePluginRegistryLoaded } from "./plugin-registry-Bw0a_OGC.js";
 
 //#region src/cli/channel-options.ts
 function dedupe(values) {

package/dist/{parent-default-help-k4GD2-UF.js → parent-default-help-XXsayZks.js}

@@ -1,6 +1,6 @@
 import { Cd as isTruthyEnvValue, Nu as listChannelPlugins, jf as CHAT_CHANNEL_ORDER } from "./agent-scope-DHrLr5OF.js";
 import { c as listChannelPluginCatalogEntries } from "./dangerous-name-matching-CnyEIiOk.js";
-import { t as ensurePluginRegistryLoaded } from "./plugin-registry-DfO1RfZv.js";
+import { t as ensurePluginRegistryLoaded } from "./plugin-registry-Dqk6vxYj.js";
 
 //#region src/cli/channel-options.ts
 function dedupe(values) {

package/dist/{path-alias-guards--dquYHnR.js → path-alias-guards-BgsM3Cb3.js}

@@ -1,4 +1,4 @@
-import { Di as BOUNDARY_PATH_ALIAS_POLICIES, Oi as resolveBoundaryPath, Wi as isNotFoundPathError } from "./agent-scope-Cb1u7HE7.js";
+import { Di as BOUNDARY_PATH_ALIAS_POLICIES, Oi as resolveBoundaryPath, Wi as isNotFoundPathError } from "./agent-scope-DwKyukUg.js";
 import fs from "node:fs/promises";
 import os from "node:os";