@fased/fased 0.1.59 → 0.1.61

package/CHANGELOG.md

@@ -4,6 +4,17 @@ This changelog starts with the public Fased Agent release line. Required
 third-party and copied-code notices are kept in [LICENSE](./LICENSE) and
 [THIRD_PARTY_NOTICES.md](./THIRD_PARTY_NOTICES.md).
 
+## 0.1.61
+
+- Harden local Docker deployments with loopback-only published ports, dropped
+  Linux capabilities, `no-new-privileges`, protected environment files, and
+  explicit rejection of container-engine socket mounts.
+- Validate release images as a non-root user and block images containing
+  embedded secrets or fixable critical vulnerabilities.
+- Publish immutable multi-architecture GHCR images only from version tags with
+  SBOM and provenance metadata; keep full Docker Gateway support local-only and
+  use the maintained non-Docker installer for VPS hosting.
+
 ## 0.1.36
 
 - Ship verified hosted release artifacts for fast VPS installs and updates

package/dist/brand.js

@@ -2,7 +2,7 @@
 const FASED_BRAND_NAME = "Fased";
 const FASED_AGENT_NAME = "Fased Agent";
 const FASED_CONTROL_NAME = "Fased Control";
-const FASED_PRODUCT_VERSION = "0.1.59";
+const FASED_PRODUCT_VERSION = "0.1.61";
 const FASED_DISPLAY_VERSION = `v${FASED_PRODUCT_VERSION}`;
 function formatFasedDisplayLine() {
 	return `${FASED_AGENT_NAME} ${FASED_DISPLAY_VERSION}`;

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.59",
-  "commit": "52ee044888a4c31c2e7ee6958d86a61a1afdd081",
-  "builtAt": "2026-07-13T20:07:25.934Z"
+  "version": "0.1.61",
+  "commit": "9c5161dc77c8d1187b6c1b331e75e2ba2739c8de",
+  "builtAt": "2026-07-16T03:44:07.899Z"
 }

package/dist/canvas-host/a2ui/.bundle.hash

@@ -1 +1 @@
-03f1c6c4f9975b6d14e5cf7e79d871c44fab07eb079c05ec45b191f8eab384cd
+60714e546d2da1a49c9fa0b5056cd78ea12d11c87762da4ecef155ffb7ac8735

package/dist/cli/daemon-cli/install.js

@@ -9,6 +9,7 @@ import { resolveGatewayService } from "../../daemon/service.js";
 import { resolveGatewayAuth } from "../../gateway/auth.js";
 import { buildGatewayInstallPlan } from "../../commands/daemon-install-helpers.js";
 import { DEFAULT_GATEWAY_DAEMON_RUNTIME, isGatewayDaemonRuntime } from "../../commands/daemon-runtime.js";
+import { ensureManagedRuntimeBootstrap } from "../../infra/managed-runtime-bootstrap.js";
 import { buildDaemonServiceSnapshot, createDaemonActionContext } from "./response.js";
 import { parsePort } from "../shared/parse-port.js";
 import "./shared.js";
@@ -46,6 +47,15 @@ async function runDaemonInstall(opts) {
 		fail("--system is supported on Linux VPS Hosting installs only.");
 		return;
 	}
+	try {
+		await ensureManagedRuntimeBootstrap({
+			profile: systemInstall ? "hosting" : "local",
+			env: process.env
+		});
+	} catch (err) {
+		fail(`Managed updater bootstrap failed: ${String(err)}`);
+		return;
+	}
 	let loaded = false;
 	try {
 		loaded = await service.isLoaded({ env: process.env });

package/dist/cli/update-cli/update-command.js

@@ -15,6 +15,7 @@ import { DEFAULT_GIT_CHANNEL, DEFAULT_PACKAGE_CHANNEL, channelToNpmTag, normaliz
 import { cleanupGlobalRenameDirs, globalInstallArgs, resolveGlobalPackageRoot, resolveNodeModulesRootForPackageRoot } from "../../infra/update-global.js";
 import { checkUpdateStatus, compareSemverStrings, resolveNpmChannelTag } from "../../infra/update-check.js";
 import { probeGateway } from "../../gateway/probe.js";
+import { ensureManagedRuntimeBootstrap } from "../../infra/managed-runtime-bootstrap.js";
 import { runDaemonInstall } from "../daemon-cli/install.js";
 import { renderRestartDiagnostics, terminateStaleGatewayPids, waitForGatewayHealthyRestart } from "../daemon-cli/restart-health.js";
 import { runDaemonRestart } from "../daemon-cli/lifecycle.js";
@@ -202,7 +203,7 @@ async function refreshGatewayServiceEnv(params) {
 		args.push("--json");
 	}
 	const failures = [];
-	for (const candidate of resolveGatewayInstallEntrypointCandidates(params.result.root)) {
+	for (const candidate of resolveGatewayInstallEntrypointCandidates(params.root)) {
 		if (!await pathExists(candidate)) {
 			continue;
 		}
@@ -211,7 +212,7 @@ async function refreshGatewayServiceEnv(params) {
 			candidate,
 			...args
 		], {
-			cwd: params.result.root,
+			cwd: params.root,
 			timeoutMs: SERVICE_REFRESH_TIMEOUT_MS
 		});
 		if (res.code === 0) {
@@ -548,7 +549,7 @@ async function maybeRestartService(params) {
 			if (params.refreshServiceEnv) {
 				try {
 					const refresh = await measureUpdateStage(timings, "service environment refresh", () => refreshGatewayServiceEnv({
-						result: params.result,
+						root: params.result.root,
 						jsonMode: Boolean(params.opts.json)
 					}));
 					if (refresh.status === "daemon-install-fallback" && refresh.failures.length > 0 && !params.opts.json) {
@@ -698,6 +699,57 @@ async function updateCommand(opts) {
 		return;
 	}
 	const installKind = updateStatus.installKind;
+	if (installKind === "package" && !opts.dryRun && requestedChannel !== "dev") {
+		try {
+			const managed = await ensureManagedRuntimeBootstrap({
+				packageRoot: root,
+				env: process.env
+			});
+			if (managed.updaterPath) {
+				const managedArgs = [managed.updaterPath, "update"];
+				if (opts.json) {
+					managedArgs.push("--json");
+				}
+				if (opts.restart === false) {
+					managedArgs.push("--no-restart");
+				}
+				if (opts.channel) {
+					managedArgs.push("--channel", opts.channel);
+				}
+				if (opts.tag) {
+					managedArgs.push("--tag", opts.tag);
+				}
+				if (opts.timeout) {
+					managedArgs.push("--timeout", opts.timeout);
+				}
+				if (opts.yes) {
+					managedArgs.push("--yes");
+				}
+				if (opts.safeFallback) {
+					managedArgs.push("--safe-fallback");
+				}
+				const result = await runCommandWithTimeout([process.execPath, ...managedArgs], {
+					cwd: path.dirname(managed.updaterPath),
+					env: process.env,
+					timeoutMs: timeoutMs ?? 20 * 6e4
+				});
+				if (result.stdout) {
+					process.stdout.write(result.stdout);
+				}
+				if (result.stderr) {
+					process.stderr.write(result.stderr);
+				}
+				if (result.code !== 0) {
+					defaultRuntime.exit(result.code ?? 1);
+				}
+				return;
+			}
+		} catch (error) {
+			defaultRuntime.error(`Managed updater bootstrap failed: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
 	const switchToGit = requestedChannel === "dev" && installKind !== "git";
 	const switchToPackage = requestedChannel !== null && requestedChannel !== "dev" && installKind === "git";
 	const updateInstallKind = switchToGit ? "git" : switchToPackage ? "package" : installKind;
@@ -840,7 +892,9 @@ async function updateCommand(opts) {
 			}
 		}
 		const runningRuntime = await probeRunningGatewayRuntimeIdentity({ timeoutMs: 750 });
-		if (runningRuntime.reachable && runningRuntime.version !== currentVersion) {
+		const managedRuntimeSources = new Set(["managed-package", "packaged-runtime"]);
+		const gatewayRuntimeNeedsRepair = runningRuntime.reachable && (runningRuntime.version !== currentVersion || !managedRuntimeSources.has(runningRuntime.runtimeSource ?? ""));
+		if (gatewayRuntimeNeedsRepair) {
 			if (!shouldRestart) {
 				defaultRuntime.error(`Installed version is ${currentVersion}, but the running gateway reports ${runningRuntime.version ?? "an older runtime without identity"}. Re-run without --no-restart.`);
 				defaultRuntime.exit(1);
@@ -856,6 +910,18 @@ async function updateCommand(opts) {
 			if (!opts.json) {
 				defaultRuntime.log(theme.warn(`Installed files are current, but gateway runtime is ${runningRuntime.version ?? "legacy/unknown"}. Refreshing the managed service...`));
 			}
+			try {
+				await refreshGatewayServiceEnv({
+					root,
+					jsonMode: Boolean(opts.json)
+				});
+			} catch (error) {
+				const repairCommand = error instanceof GatewayServiceRefreshError ? error.repairCommand : `${formatCliCommand("fased gateway install --force")} && ${formatCliCommand("fased gateway restart")}`;
+				defaultRuntime.error(`Gateway service refresh failed: ${String(error)}`);
+				defaultRuntime.error(`Repair command: ${repairCommand}`);
+				defaultRuntime.exit(1);
+				return;
+			}
 			if (serviceTarget.scope === "system") {
 				await serviceTarget.service.restart({
 					env: process.env,
@@ -930,7 +996,7 @@ async function updateCommand(opts) {
 	const { progress, stop } = createUpdateProgress(showProgress);
 	const startedAt = Date.now();
 	let restartScriptPath = null;
-	let refreshGatewayServiceEnv = false;
+	let shouldRefreshGatewayServiceEnv = false;
 	let serviceLoaded = false;
 	const serviceTarget = await resolveUpdateGatewayServiceTarget();
 	if (shouldRestart) {
@@ -939,7 +1005,7 @@ async function updateCommand(opts) {
 			if (serviceLoaded) {
 				if (serviceTarget.scope === "platform") {
 					restartScriptPath = await prepareRestartScript(process.env);
-					refreshGatewayServiceEnv = true;
+					shouldRefreshGatewayServiceEnv = true;
 				}
 			}
 		} catch {}
@@ -998,7 +1064,7 @@ async function updateCommand(opts) {
 		shouldRestart,
 		result,
 		opts,
-		refreshServiceEnv: refreshGatewayServiceEnv,
+		refreshServiceEnv: shouldRefreshGatewayServiceEnv,
 		gatewayPort,
 		restartScriptPath,
 		serviceTarget,

package/dist/commands/daemon-install-helpers.js

@@ -42,7 +42,8 @@ async function buildGatewayInstallPlan(params) {
 		dev: devMode,
 		runtime: params.runtime,
 		nodePath,
-		startupMode
+		startupMode,
+		env: params.env
 	});
 	await emitNodeRuntimeWarning({
 		env: params.env,