@fased/fased 0.1.60 → 0.1.62

package/dist/wizard/onboarding.js

@@ -32,7 +32,7 @@ import { finalizeOnboardingWizard } from "./onboarding.finalize.js";
 import { configureGatewayForOnboarding } from "./onboarding.gateway-config.js";
 import { applyHostingSecurity } from "./onboarding.host-security.js";
 import { normalizeHostedWalletPaths } from "./wallet-path-migration.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 
@@ -446,16 +446,10 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 	};
 	const readAgentWalletSummary = () => readAgentDefaultWallet().walletId ? readAgentDefaultWallet() : readRoleWallet("agent");
 	const goModernEnough = () => {
-		const probe = spawnSync("bash", ["-lc", "if [ -n \"${FASED_GO_BIN:-}\" ] && [ -x \"$FASED_GO_BIN\" ]; then GOCMD=\"$FASED_GO_BIN\"; " + "elif [ -x /usr/local/go/bin/go ]; then GOCMD=/usr/local/go/bin/go; " + "elif command -v go >/dev/null 2>&1; then GOCMD=$(command -v go); " + "else exit 1; fi; " + "v=$($GOCMD version 2>/dev/null | awk '{print $3}' | sed 's/^go//'); " + "maj=$(echo \"$v\" | cut -d. -f1); min=$(echo \"$v\" | cut -d. -f2); " + "([ \"${maj:-0}\" -gt 1 ] || ([ \"${maj:-0}\" -eq 1 ] && [ \"${min:-0}\" -ge 21 ]))"], { stdio: "ignore" });
+		const probe = spawnSync("bash", ["-lc", "if [ -n \"${FASED_GO_BIN:-}\" ] && [ -x \"$FASED_GO_BIN\" ]; then GOCMD=\"$FASED_GO_BIN\"; " + "elif [ -x /usr/local/go/bin/go ]; then GOCMD=/usr/local/go/bin/go; " + "elif command -v go >/dev/null 2>&1; then GOCMD=$(command -v go); " + "else exit 1; fi; " + "v=$($GOCMD version 2>/dev/null | awk '{print $3}' | sed 's/^go//'); " + "maj=$(echo \"$v\" | cut -d. -f1); min=$(echo \"$v\" | cut -d. -f2); patch=$(echo \"$v\" | cut -d. -f3 | sed \"s/[^0-9].*$//\"); " + "([ \"${maj:-0}\" -gt 1 ] || ([ \"${maj:-0}\" -eq 1 ] && ([ \"${min:-0}\" -gt 25 ] || ([ \"${min:-0}\" -eq 25 ] && [ \"${patch:-0}\" -ge 7 ]))))"], { stdio: "ignore" });
 		return probe.status === 0;
 	};
 	const shellQuote = (value) => `'${value.replaceAll("'", `'"'"'`)}'`;
-	const hasExplicitSignerAssetSource = () => {
-		const baseUrl = String(process.env.FASED_LOCAL_SIGNER_BASE_URL ?? "").trim();
-		const version = String(process.env.FASED_LOCAL_SIGNER_VERSION ?? "").trim();
-		const latestTag = String(process.env.FASED_LOCAL_SIGNER_LATEST_TAG ?? "").trim();
-		return Boolean(baseUrl && !baseUrl.includes("github.com/fased-ai/fased/releases/download") || version && version !== "latest" || latestTag && latestTag !== "latest");
-	};
 	const runShell = async (command) => {
 		await new Promise((resolve, reject) => {
 			const proc = spawn("bash", ["-lc", command], {
@@ -490,11 +484,11 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		if (process.platform !== "linux" || !hasCommand("curl") || !hasCommand("tar")) {
 			return "unavailable";
 		}
-		const goVersion = String(process.env.FASED_GO_VERSION ?? "1.23.6").trim() || "1.23.6";
+		const goVersion = String(process.env.FASED_GO_VERSION ?? "1.25.7").trim() || "1.25.7";
 		const stateRoot = String(process.env.FASED_STATE_DIR ?? "").trim() || path.join(String(process.env.HOME ?? "").trim() || process.cwd(), ".fased");
 		const installRoot = path.join(stateRoot, "toolchains", `go${goVersion}`);
 		const goBin = path.join(installRoot, "bin", "go");
-		if (fs.existsSync(goBin)) {
+		if (syncFs.existsSync(goBin)) {
 			process.env.FASED_GO_BIN = goBin;
 			return goModernEnough() ? "installed" : "unavailable";
 		}
@@ -527,7 +521,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		if (String(process.env.FASED_FORCE_NATIVE_SIGNER_BUILD ?? "").trim() === "1") {
 			return false;
 		}
-		return fs.existsSync(resolveSignerdBinaryPath(process.env));
+		return syncFs.existsSync(resolveSignerdBinaryPath(process.env));
 	};
 	const maybeInstallGoForOnboarding = async () => {
 		if (goModernEnough()) {
@@ -544,7 +538,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 			return false;
 		}
 		const installNow = await prompter.confirm({
-			message: "Go >=1.21 is required for native signer. Install/update Go now?",
+			message: "Go >=1.25.7 is required for a source-built native signer. Install/update Go now?",
 			initialValue: true
 		});
 		if (!installNow) {
@@ -552,7 +546,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		}
 		const progress = prompter.progress("Installing Go toolchain…");
 		try {
-			await runShell("arch=$(dpkg --print-architecture 2>/dev/null || uname -m); " + "case \"$arch\" in amd64|x86_64) goarch=amd64 ;; arm64|aarch64) goarch=arm64 ;; *) echo \"Unsupported arch: $arch\"; exit 1 ;; esac; " + "goversion=${FASED_GO_VERSION:-1.23.6}; " + "tmp=$(mktemp); " + "curl -fsSL \"https://go.dev/dl/go${goversion}.linux-${goarch}.tar.gz\" -o \"$tmp\"; " + "sudo rm -rf /usr/local/go; " + "sudo tar -C /usr/local -xzf \"$tmp\"; " + "rm -f \"$tmp\"; " + "sudo ln -sf /usr/local/go/bin/go /usr/local/bin/go");
+			await runShell("arch=$(dpkg --print-architecture 2>/dev/null || uname -m); " + "case \"$arch\" in amd64|x86_64) goarch=amd64 ;; arm64|aarch64) goarch=arm64 ;; *) echo \"Unsupported arch: $arch\"; exit 1 ;; esac; " + "goversion=${FASED_GO_VERSION:-1.25.7}; " + "tmp=$(mktemp); " + "curl -fsSL \"https://go.dev/dl/go${goversion}.linux-${goarch}.tar.gz\" -o \"$tmp\"; " + "sudo rm -rf /usr/local/go; " + "sudo tar -C /usr/local -xzf \"$tmp\"; " + "rm -f \"$tmp\"; " + "sudo ln -sf /usr/local/go/bin/go /usr/local/bin/go");
 			progress.stop("Go toolchain ready.");
 		} catch (error) {
 			progress.stop("Go toolchain install failed.");
@@ -560,15 +554,6 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		}
 		return goModernEnough();
 	};
-	const prepareLocalSignerForOnboarding = async (params) => {
-		if (fs.existsSync(params.binPath) || String(process.env.FASED_SKIP_NATIVE_SIGNER_BUILD ?? "").trim() === "1" || hasExplicitSignerAssetSource()) {
-			return;
-		}
-		if (goModernEnough()) {
-			return;
-		}
-		await installPrivateGoForOnboarding();
-	};
 	printWizardHeader(runtime);
 	await requireRiskAcknowledgement({
 		opts,
@@ -874,7 +859,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 				await prompter.note("Native signer already current.", "Native signer");
 			}
 		} else if (!await maybeInstallGoForOnboarding()) {
-			const detail = "Go >=1.21 is required for native signer build/install.";
+			const detail = "Go >=1.25.7 is required for a source-built native signer.";
 			if (hostingMode && !opts.allowInsecure) {
 				throw new Error(`${detail} Install Go and rerun onboarding, or unset FASED_BUILD_NATIVE_SIGNER_FROM_SOURCE.`);
 			}
@@ -895,7 +880,6 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		flow,
 		hostProfile,
 		nextConfig,
-		prepareLocalSigner: prepareLocalSignerForOnboarding,
 		prompter
 	});
 	nextConfig = syncLocalSignerRuntimeEnvIntoConfig(nextConfig);
@@ -1112,8 +1096,8 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 						const configuredPaths = keystoreKeys.map((key) => (nextConfig.env?.vars?.[key] ?? "").trim() || String(process.env[key] ?? "").trim()).filter(Boolean);
 						for (const file of new Set([...configuredPaths, ...defaultKeystorePaths])) {
 							try {
-								if (file && fs.existsSync(file)) {
-									fs.rmSync(file, { force: true });
+								if (file && syncFs.existsSync(file)) {
+									syncFs.rmSync(file, { force: true });
 								}
 							} catch {}
 						}
@@ -1157,7 +1141,6 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 						forceEnable: true,
 						hostProfile,
 						nextConfig,
-						prepareLocalSigner: prepareLocalSignerForOnboarding,
 						prompter
 					});
 					nextConfig = syncLocalSignerRuntimeEnvIntoConfig(nextConfig);
@@ -1235,7 +1218,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 				process.env[rpcKey] = effectiveRpcUrl;
 				try {
 					let moveToSignerDir = false;
-					if (isolatedTargetKeystorePath && fs.existsSync(isolatedTargetKeystorePath)) {
+					if (isolatedTargetKeystorePath && syncFs.existsSync(isolatedTargetKeystorePath)) {
 						moveToSignerDir = await prompter.confirm({
 							message: "Signer keystore already exists. Overwrite it?",
 							initialValue: false

package/dist/wizard/onboarding.wallet.js

@@ -1,3 +1,4 @@
+import { VERSION } from "../version.js";
 import { loadConfig } from "../config/io.js";
 import "../config/config.js";
 import { ensureWalletStateDir, resolveLocalSignerBackendSocketPath, resolveLocalSignerMaterialRootDir, resolveLocalSignerRunAsUser, resolveLocalSignerSidecarPaths, resolveLocalSignerSocketPath, resolveWalletRuntimeConfig } from "../wallet/wallet-runtime-config.js";
@@ -6,7 +7,7 @@ import { applyWalletPolicyConfig, resolveWalletRoleForId } from "../wallet/walle
 import { callLocalSocketSigner } from "../wallet/providers/local-socket-signer-adapter.js";
 import { resolveWalletProviderId } from "../wallet/wallet-provider-resolver.js";
 import { fileURLToPath } from "node:url";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import { execSync, spawn, spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
@@ -23,8 +24,8 @@ function resolveSignerdBinaryPath(env = process.env) {
 function resolveAppOwnedSignerdStagingPath(env = process.env) {
 	return path.join(env.HOME ?? "/root", ".fased/bin/fased-signerd");
 }
-const INSTALL_SCRIPT_RELPATHS = ["scripts/install-fased-signerd.sh", "../scripts/install-fased-signerd.sh"];
-const BUILD_SCRIPT_RELPATHS = ["scripts/build-fased-signerd.sh", "../scripts/build-fased-signerd.sh"];
+const INSTALL_SCRIPT_RELURLS = ["../../scripts/install-fased-signerd.sh", "../scripts/install-fased-signerd.sh"];
+const BUILD_SCRIPT_RELURLS = ["../../scripts/build-fased-signerd.sh", "../scripts/build-fased-signerd.sh"];
 const BROKER_CLI_RELPATHS = ["./index.js", "../../dist/index.js"];
 const DEFAULT_SIGNER_RELEASE_DOWNLOAD_BASE = "https://github.com/fased-ai/fased/releases/download";
 const SIGNER_MAINTENANCE_HELPER = "/usr/local/sbin/fased-signer-maintenance";
@@ -48,7 +49,7 @@ function runCommand(params) {
 }
 function isSignerdRunning(socketPath) {
 	try {
-		fs.statSync(socketPath);
+		syncFs.statSync(socketPath);
 		return true;
 	} catch {
 		return false;
@@ -77,7 +78,7 @@ async function sleep(ms) {
 }
 function readFileTail(filePath, maxLines = 20) {
 	try {
-		const text = fs.readFileSync(filePath, "utf8").trim();
+		const text = syncFs.readFileSync(filePath, "utf8").trim();
 		if (!text) {
 			return undefined;
 		}
@@ -157,19 +158,19 @@ async function readSignerdHealth(socketPath) {
 	}
 }
 function resolveInstallScript() {
-	for (const rel of INSTALL_SCRIPT_RELPATHS) {
-		const abs = path.resolve(rel);
-		if (fs.existsSync(abs)) {
-			return abs;
+	for (const rel of INSTALL_SCRIPT_RELURLS) {
+		const candidate = fileURLToPath(new URL(rel, import.meta.url));
+		if (syncFs.existsSync(candidate)) {
+			return candidate;
 		}
 	}
 	return null;
 }
 function resolveBuildScript() {
-	for (const rel of BUILD_SCRIPT_RELPATHS) {
-		const abs = path.resolve(rel);
-		if (fs.existsSync(abs)) {
-			return abs;
+	for (const rel of BUILD_SCRIPT_RELURLS) {
+		const candidate = fileURLToPath(new URL(rel, import.meta.url));
+		if (syncFs.existsSync(candidate)) {
+			return candidate;
 		}
 	}
 	return null;
@@ -177,7 +178,7 @@ function resolveBuildScript() {
 function resolveBrokerCliPath() {
 	for (const rel of BROKER_CLI_RELPATHS) {
 		const candidate = fileURLToPath(new URL(rel, import.meta.url));
-		if (fs.existsSync(candidate)) {
+		if (syncFs.existsSync(candidate)) {
 			return candidate;
 		}
 	}
@@ -190,17 +191,17 @@ function resolveLocalSignerdReleaseBaseUrl(installScriptPath) {
 	const arch = process.arch === "arm64" ? "arm64" : "amd64";
 	const assetPath = path.join(releaseDir, `fased-signerd-${platform}-${arch}`);
 	const checksumsPath = path.join(releaseDir, "fased-signerd-checksums.txt");
-	if (!fs.existsSync(assetPath) || !fs.existsSync(checksumsPath)) {
+	if (!syncFs.existsSync(assetPath) || !syncFs.existsSync(checksumsPath)) {
 		return null;
 	}
 	return `file://${releaseDir}`;
 }
 function resolveGoBinary(env = process.env) {
 	const explicit = String(env.FASED_GO_BIN ?? "").trim();
-	if (explicit && fs.existsSync(explicit)) {
+	if (explicit && syncFs.existsSync(explicit)) {
 		return explicit;
 	}
-	if (fs.existsSync("/usr/local/go/bin/go")) {
+	if (syncFs.existsSync("/usr/local/go/bin/go")) {
 		return "/usr/local/go/bin/go";
 	}
 	const child = spawnSync("bash", ["-lc", "command -v go || true"], {
@@ -227,13 +228,14 @@ function isGoModernEnough(goBin) {
 	if (child.status !== 0) {
 		return false;
 	}
-	const match = String(child.stdout ?? "").match(/\bgo(\d+)\.(\d+)(?:\.\d+)?\b/);
+	const match = String(child.stdout ?? "").match(/\bgo(\d+)\.(\d+)(?:\.(\d+))?\b/);
 	if (!match) {
 		return false;
 	}
 	const major = Number(match[1]);
 	const minor = Number(match[2]);
-	return major > 1 || major === 1 && minor >= 21;
+	const patch = Number(match[3] ?? 0);
+	return major > 1 || major === 1 && (minor > 25 || minor === 25 && patch >= 7);
 }
 function hasExplicitSignerdAssetSource(env = process.env) {
 	const baseUrl = String(env.FASED_LOCAL_SIGNER_BASE_URL ?? "").trim();
@@ -271,7 +273,7 @@ function runScriptOrThrow(params) {
 function copySignerdBinaryToTarget(params) {
 	const sourcePath = path.resolve(params.sourcePath);
 	const targetPath = path.resolve(params.targetPath);
-	if (!fs.existsSync(sourcePath)) {
+	if (!syncFs.existsSync(sourcePath)) {
 		throw new Error(`fased-signerd build completed but binary was not found at ${sourcePath}.`);
 	}
 	if (params.runAsUser) {
@@ -295,9 +297,9 @@ function copySignerdBinaryToTarget(params) {
 		}
 		return;
 	}
-	fs.mkdirSync(path.dirname(targetPath), { recursive: true });
-	fs.copyFileSync(sourcePath, targetPath);
-	fs.chmodSync(targetPath, 493);
+	syncFs.mkdirSync(path.dirname(targetPath), { recursive: true });
+	syncFs.copyFileSync(sourcePath, targetPath);
+	syncFs.chmodSync(targetPath, 493);
 }
 function buildSignerdBinaryFromSource(binPath) {
 	if (String(process.env.FASED_SKIP_NATIVE_SIGNER_BUILD ?? "").trim() === "1") {
@@ -326,34 +328,53 @@ function buildSignerdBinaryFromSource(binPath) {
 	});
 	return true;
 }
-function installSignerdBinaryFromExplicitAsset(binPath) {
-	if (!hasExplicitSignerdAssetSource(process.env)) {
-		return false;
+function resolveSignerdAssetInstallEnv(installScript) {
+	const env = { ...process.env };
+	if (hasExplicitSignerdAssetSource(env)) {
+		return env;
+	}
+	const localReleaseBaseUrl = resolveLocalSignerdReleaseBaseUrl(installScript);
+	if (localReleaseBaseUrl) {
+		env.FASED_LOCAL_SIGNER_BASE_URL = localReleaseBaseUrl;
+		env.FASED_LOCAL_SIGNER_VERSION = "";
+		env.FASED_LOCAL_SIGNER_LATEST_TAG = "";
+		return env;
+	}
+	const normalizedVersion = VERSION.trim().replace(/^v/, "");
+	if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(normalizedVersion)) {
+		throw new Error(`Cannot resolve a versioned fased-signerd asset for Fased ${VERSION}.`);
+	}
+	env.FASED_LOCAL_SIGNER_BASE_URL = DEFAULT_SIGNER_RELEASE_DOWNLOAD_BASE;
+	env.FASED_LOCAL_SIGNER_VERSION = `v${normalizedVersion}`;
+	env.FASED_LOCAL_SIGNER_LATEST_TAG = "";
+	return env;
+}
+function installSignerdBinaryFromAsset(binPath) {
+	if (process.platform === "win32") {
+		throw new Error("The local socket signer requires Unix sockets. On Windows, install and run Fased inside WSL2.");
+	}
+	if (process.platform !== "linux" && process.platform !== "darwin") {
+		throw new Error(`No fased-signerd release asset is available for ${process.platform}.`);
 	}
 	const script = resolveInstallScript();
 	if (!script) {
-		throw new Error(`install-fased-signerd.sh not found. Cannot install fased-signerd.\n` + `Expected at one of: ${INSTALL_SCRIPT_RELPATHS.join(", ")}\n` + `Install Go >= 1.21, or provide FASED_WALLET_LOCAL_SIGNER_BIN.`);
+		return false;
 	}
 	const runAsUser = resolveLocalSignerRunAsUser(process.env);
 	const stagingPath = resolveAppOwnedSignerdStagingPath(process.env);
 	const installDir = path.dirname(runAsUser ? stagingPath : binPath);
-	const localReleaseBaseUrl = resolveLocalSignerdReleaseBaseUrl(script);
-	const installCmd = [
-		`FASED_LOCAL_SIGNER_BIN_DIR="${installDir}"`,
-		...localReleaseBaseUrl ? [`FASED_LOCAL_SIGNER_BASE_URL="${localReleaseBaseUrl}"`, "FASED_LOCAL_SIGNER_LATEST_TAG=\"\""] : [],
-		`bash "${script}"`
-	].join(" ");
 	const verboseInstall = String(process.env.FASED_INSTALL_VERBOSE ?? "").trim() === "1" || String(process.env.FASED_ONBOARD_VERBOSE ?? "").trim() === "1";
-	try {
-		execSync(installCmd, { stdio: verboseInstall ? "inherit" : "pipe" });
-	} catch (err) {
-		const stderr = err && typeof err === "object" && "stderr" in err ? String(err.stderr ?? "").trim() : "";
-		const stdout = err && typeof err === "object" && "stdout" in err ? String(err.stdout ?? "").trim() : "";
-		const detail = (stderr || stdout).split("\n").slice(-12).join("\n");
-		throw new Error(detail || "fased-signerd install failed", { cause: err });
-	}
+	runScriptOrThrow({
+		script,
+		env: {
+			...resolveSignerdAssetInstallEnv(script),
+			FASED_LOCAL_SIGNER_BIN_DIR: installDir
+		},
+		verbose: verboseInstall,
+		fallbackError: "fased-signerd asset install failed"
+	});
 	const installedPath = runAsUser ? stagingPath : binPath;
-	if (!fs.existsSync(installedPath)) {
+	if (!syncFs.existsSync(installedPath)) {
 		throw new Error(`fased-signerd install script ran but binary not found at ${binPath}.\n` + `Check install script output above for errors.`);
 	}
 	if (runAsUser && installedPath !== binPath) {
@@ -376,25 +397,44 @@ function installSignerdBinaryFromExplicitAsset(binPath) {
 			});
 		}
 	}
-	if (!fs.existsSync(binPath)) {
+	if (!syncFs.existsSync(binPath)) {
 		throw new Error(`fased-signerd install script completed but target binary not found at ${binPath}.\n` + `Check install script output above for errors.`);
 	}
 	return true;
 }
 function installSignerdBinary(binPath) {
-	if (buildSignerdBinaryFromSource(binPath)) {
-		return;
+	const forceSourceBuild = String(process.env.FASED_BUILD_NATIVE_SIGNER_FROM_SOURCE ?? "").trim() === "1";
+	if (forceSourceBuild) {
+		if (buildSignerdBinaryFromSource(binPath)) {
+			return;
+		}
+		throw new Error("FASED_BUILD_NATIVE_SIGNER_FROM_SOURCE=1 requires a source checkout and Go >= 1.25.7.");
 	}
-	if (installSignerdBinaryFromExplicitAsset(binPath)) {
-		return;
+	let assetError;
+	try {
+		if (installSignerdBinaryFromAsset(binPath)) {
+			return;
+		}
+	} catch (error) {
+		assetError = error;
 	}
+	let sourceError;
+	try {
+		if (buildSignerdBinaryFromSource(binPath)) {
+			return;
+		}
+	} catch (error) {
+		sourceError = error;
+	}
+	const assetDetail = assetError instanceof Error ? assetError.message : undefined;
+	const sourceDetail = sourceError instanceof Error ? sourceError.message : undefined;
 	throw new Error([
-		"fased-signerd is required only after you choose the local signer wallet path.",
-		"Install Go >= 1.21 and rerun wallet setup so Fased can build the signer locally.",
-		"Alternatively set FASED_WALLET_LOCAL_SIGNER_BIN to an existing signer binary,",
-		"or set FASED_LOCAL_SIGNER_VERSION/FASED_LOCAL_SIGNER_BASE_URL to an explicit signer asset.",
-		"Normal dashboard, Gateway, and Fased Network startup do not require fased-signerd."
-	].join("\n"));
+		`Automatic fased-signerd installation failed for ${process.platform}/${process.arch}.`,
+		`Fased ${VERSION} normally downloads its matching prebuilt signer and verifies its SHA-256 checksum; Go is not required.`,
+		assetDetail ? `Asset install: ${assetDetail}` : "The packaged signer installer was not found.",
+		sourceDetail ? `Source fallback: ${sourceDetail}` : undefined,
+		"Retry after checking GitHub release access, or set FASED_WALLET_LOCAL_SIGNER_BIN to a trusted existing binary."
+	].filter((line) => Boolean(line)).join("\n"));
 }
 function hasScopedWalletEnvValue(env, prefix) {
 	return Object.entries(env).some(([key, value]) => key.startsWith(`${prefix}__`) && typeof value === "string" && value.trim().length > 0);
@@ -434,7 +474,7 @@ function inferScopedSignerKeystoreEnv(materialDir, env) {
 			const solanaKey = `FASED_WALLET_SOLANA_KEYSTORE_PATH__${envSuffix}`;
 			if (!String(env[solanaKey] ?? "").trim()) {
 				const candidate = path.join(materialDir, `keystore-solana-${fileSuffix}.v1.enc`);
-				if (fs.existsSync(candidate)) {
+				if (syncFs.existsSync(candidate)) {
 					inferred[solanaKey] = candidate;
 				}
 			}
@@ -469,7 +509,7 @@ function resolveLocalSignerPassphraseSource(materialDir, env) {
 	const candidates = [configuredFile ? path.resolve(configuredFile) : "", path.join(materialDir, "passphrase")].filter(Boolean);
 	for (const candidate of candidates) {
 		try {
-			const value = fs.readFileSync(candidate, "utf8").trim();
+			const value = syncFs.readFileSync(candidate, "utf8").trim();
 			if (value) {
 				return {
 					kind: "file",
@@ -636,11 +676,11 @@ function writeLocalSignerEnvFile(params) {
 		...cfg.env?.vars
 	};
 	const signerEnvPath = path.resolve(ensureWalletStateDir(mergedEnv).rootDir, "signer.env");
-	fs.mkdirSync(path.dirname(signerEnvPath), {
+	syncFs.mkdirSync(path.dirname(signerEnvPath), {
 		recursive: true,
 		mode: 448
 	});
-	fs.writeFileSync(signerEnvPath, renderLocalSignerEnvFile({
+	syncFs.writeFileSync(signerEnvPath, renderLocalSignerEnvFile({
 		config: cfg,
 		env: mergedEnv
 	}), {
@@ -648,7 +688,7 @@ function writeLocalSignerEnvFile(params) {
 		mode: 384
 	});
 	try {
-		fs.chmodSync(signerEnvPath, 384);
+		syncFs.chmodSync(signerEnvPath, 384);
 	} catch {}
 	return signerEnvPath;
 }
@@ -690,7 +730,7 @@ function startSignerIsolationHelperBackground(runAsUser, args, logPath, env = pr
 	if (!helperArgs) {
 		return false;
 	}
-	const out = fs.openSync(logPath, "a", 384);
+	const out = syncFs.openSync(logPath, "a", 384);
 	const child = spawn("sudo", [
 		"-n",
 		"-E",
@@ -711,10 +751,10 @@ function startSignerIsolationHelperBackground(runAsUser, args, logPath, env = pr
 	return true;
 }
 function signerMaintenanceHelperArgs(runAsUser, args) {
-	if (fs.existsSync(SIGNER_MAINTENANCE_HELPER)) {
+	if (syncFs.existsSync(SIGNER_MAINTENANCE_HELPER)) {
 		return [SIGNER_MAINTENANCE_HELPER, ...args];
 	}
-	if (fs.existsSync(SIGNER_ISOLATION_HELPER)) {
+	if (syncFs.existsSync(SIGNER_ISOLATION_HELPER)) {
 		return [
 			SIGNER_ISOLATION_HELPER,
 			resolveCurrentUnixUser(),
@@ -769,16 +809,16 @@ function ensureLocalSignerPassphrase() {
 		const generated = existing.kind === "value" ? existing.value : randomBytes(24).toString("base64url");
 		const stagingDir = ensureWalletStateDir(process.env).rootDir;
 		const stagingPath = path.join(stagingDir, `.local-signer-passphrase-${process.pid}-${Date.now()}`);
-		fs.mkdirSync(path.dirname(stagingPath), {
+		syncFs.mkdirSync(path.dirname(stagingPath), {
 			recursive: true,
 			mode: 448
 		});
-		fs.writeFileSync(stagingPath, `${generated}\n`, {
+		syncFs.writeFileSync(stagingPath, `${generated}\n`, {
 			encoding: "utf8",
 			mode: 384
 		});
 		try {
-			fs.chmodSync(stagingPath, 384);
+			syncFs.chmodSync(stagingPath, 384);
 		} catch {}
 		let passphrasePath = path.join(materialDir, "passphrase");
 		try {
@@ -808,7 +848,7 @@ function ensureLocalSignerPassphrase() {
 			process.env.FASED_WALLET_PASSPHRASE = generated;
 		} catch (err) {
 			try {
-				fs.rmSync(stagingPath, { force: true });
+				syncFs.rmSync(stagingPath, { force: true });
 			} catch {}
 			const detail = err instanceof Error ? err.message : String(err);
 			if (!detail.includes("passphrase already exists")) {
@@ -826,16 +866,16 @@ function ensureLocalSignerPassphrase() {
 	}
 	const generated = randomBytes(24).toString("base64url");
 	const passphraseFile = path.join(materialDir, "passphrase");
-	fs.mkdirSync(path.dirname(passphraseFile), {
+	syncFs.mkdirSync(path.dirname(passphraseFile), {
 		recursive: true,
 		mode: 448
 	});
-	fs.writeFileSync(passphraseFile, `${generated}\n`, {
+	syncFs.writeFileSync(passphraseFile, `${generated}\n`, {
 		encoding: "utf8",
 		mode: 384
 	});
 	try {
-		fs.chmodSync(passphraseFile, 384);
+		syncFs.chmodSync(passphraseFile, 384);
 	} catch {}
 	process.env.FASED_WALLET_PASSPHRASE_FILE = passphraseFile;
 	delete process.env.FASED_WALLET_PASSPHRASE;
@@ -887,8 +927,8 @@ function startSignerdBackground(binPath, socketPath, materialDir, env = process.
 			throw new Error(`failed to launch isolated signer as ${runAsUser}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 		}
 	}
-	const out = fs.openSync(logPath, "a", 384);
-	const err = fs.openSync(logPath, "a", 384);
+	const out = syncFs.openSync(logPath, "a", 384);
+	const err = syncFs.openSync(logPath, "a", 384);
 	const child = spawn(binPath, [
 		"-socket",
 		socketPath,
@@ -964,7 +1004,7 @@ function stopProcessBySocket(socketPath, runAsUser) {
 	}
 	for (const candidatePidPath of pidPaths) {
 		try {
-			const pid = Number.parseInt(fs.readFileSync(candidatePidPath, "utf8").trim(), 10);
+			const pid = Number.parseInt(syncFs.readFileSync(candidatePidPath, "utf8").trim(), 10);
 			if (Number.isFinite(pid) && pid > 0) {
 				try {
 					const command = readProcessCommand(pid);
@@ -975,16 +1015,16 @@ function stopProcessBySocket(socketPath, runAsUser) {
 			}
 		} catch {}
 		try {
-			fs.unlinkSync(candidatePidPath);
+			syncFs.unlinkSync(candidatePidPath);
 		} catch {}
 	}
 	try {
-		fs.unlinkSync(socketPath);
+		syncFs.unlinkSync(socketPath);
 	} catch {}
 }
 function readProcessCommand(pid) {
 	try {
-		const cmdline = fs.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\0", " ").trim();
+		const cmdline = syncFs.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\0", " ").trim();
 		if (cmdline) {
 			return cmdline;
 		}
@@ -1050,8 +1090,8 @@ function startSignerBrokerBackground(appSocketPath, backendSocketPath, materialD
 			throw new Error(`failed to launch isolated signer broker as ${runAsUser}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 		}
 	}
-	const out = fs.openSync(logPath, "a", 384);
-	const err = fs.openSync(logPath, "a", 384);
+	const out = syncFs.openSync(logPath, "a", 384);
+	const err = syncFs.openSync(logPath, "a", 384);
 	const child = spawn(process.execPath, [
 		brokerCli,
 		"wallet",
@@ -1087,7 +1127,7 @@ async function restartLocalSocketSigner(walletDir, env = process.env) {
 	const binPath = resolveSignerdBinaryPath(env);
 	const materialDir = resolveLocalSignerMaterialRootDir(env);
 	const runAsUser = resolveLocalSignerRunAsUser(env);
-	if (!fs.existsSync(binPath)) {
+	if (!syncFs.existsSync(binPath)) {
 		return;
 	}
 	stopProcessBySocket(socketPath, runAsUser);
@@ -1130,7 +1170,7 @@ async function syncLocalSocketSignerFromConfig(params) {
 		env: mergedEnv
 	});
 	const binPath = resolveSignerdBinaryPath(mergedEnv);
-	if (!fs.existsSync(binPath)) {
+	if (!syncFs.existsSync(binPath)) {
 		installSignerdBinary(binPath);
 	}
 	if (params?.restart === false) {
@@ -1159,7 +1199,7 @@ function migrateLocalSignerKeystoreToMaterialDir(params) {
 		return targetPath;
 	}
 	ensureIsolatedSignerPaths(materialDir, resolveLocalSignerBackendSocketPath(process.env), resolveLocalSignerSocketPath(process.env), runAsUser);
-	if (fs.existsSync(targetPath) && !params.force) {
+	if (syncFs.existsSync(targetPath) && !params.force) {
 		throw new Error(`Keystore already exists: ${targetPath}`);
 	}
 	if (runSignerIsolationHelper(runAsUser, [
@@ -1257,7 +1297,7 @@ function hasConfiguredWalletMaterial(params) {
 	}
 	try {
 		const walletDir = ensureWalletStateDir(mergedEnv).rootDir;
-		return fs.readdirSync(walletDir).some((entry) => /^keystore-solana(?:-[A-Za-z0-9_-]+)?\.v1\.enc$/.test(entry) || /^keystore-evm(?:-[A-Za-z0-9_-]+)?\.v1\.enc$/.test(entry));
+		return syncFs.readdirSync(walletDir).some((entry) => /^keystore-solana(?:-[A-Za-z0-9_-]+)?\.v1\.enc$/.test(entry) || /^keystore-evm(?:-[A-Za-z0-9_-]+)?\.v1\.enc$/.test(entry));
 	} catch {
 		return false;
 	}
@@ -1356,13 +1396,20 @@ async function configureWalletForOnboarding(params) {
 		const binPath = resolveSignerdBinaryPath(process.env);
 		const runAsUser = resolveLocalSignerRunAsUser(process.env);
 		ensureLocalSignerPassphrase();
-		if (!fs.existsSync(binPath)) {
+		if (!syncFs.existsSync(binPath)) {
+			const signerInstallProgress = quietSignerNotes ? prompter.progress("Installing local wallet signer…") : undefined;
 			if (!quietSignerNotes) {
-				await prompter.note([`fased-signerd not found at: ${binPath}`, "Building fased-signerd locally when Go is available, or using an explicitly configured signer asset."].join("\n"), "Local socket signer");
+				await prompter.note([`fased-signerd not found at: ${binPath}`, `Downloading the checksum-verified signer for Fased ${VERSION}. Go is not required for a normal install.`].join("\n"), "Local socket signer");
 			}
-			await params.prepareLocalSigner?.({ binPath });
-			if (!fs.existsSync(binPath)) {
-				installSignerdBinary(binPath);
+			try {
+				await params.prepareLocalSigner?.({ binPath });
+				if (!syncFs.existsSync(binPath)) {
+					installSignerdBinary(binPath);
+				}
+				signerInstallProgress?.stop("Local wallet signer installed.");
+			} catch (error) {
+				signerInstallProgress?.stop("Local wallet signer installation failed.");
+				throw error;
 			}
 			if (!quietSignerNotes) {
 				await prompter.note(`fased-signerd installed at: ${binPath}`, "Local socket signer");

package/extensions/acpx/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/acpx",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "description": "FasedAgent ACP runtime backend via acpx",
   "type": "module",
   "dependencies": {

package/extensions/bluebubbles/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/bluebubbles",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "description": "FasedAgent BlueBubbles channel plugin",
   "type": "module",
   "fased": {

package/extensions/copilot-proxy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/copilot-proxy",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "private": true,
   "description": "FasedAgent Copilot Proxy provider plugin",
   "type": "module",

package/extensions/diagnostics-otel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/diagnostics-otel",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "description": "FasedAgent diagnostics OpenTelemetry exporter",
   "type": "module",
   "dependencies": {

package/extensions/fased-federation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/fased-federation",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "private": true,
   "description": "Fased federation adapter package scaffold (A2A + admission helpers)",
   "type": "module",