@fased/fased 0.1.61 → 0.1.64

package/dist/cli/update-cli/update-command.js

@@ -23,6 +23,7 @@ import "../../daemon-cli.js";
 import { installCompletion } from "../completion-cli.js";
 import { readPackageName, readPackageVersion } from "../../infra/package-json.js";
 import { finalizeUpdateTransaction, rollbackUpdateTransaction, runGatewayUpdate } from "../../infra/update-runner.js";
+import { activateLocalSourceSigner, commitLocalSourcePairedUpdate, isLocalSourceSignerConfigured, markLocalSourceAppActive, markLocalSourceGatewayVerified, prepareLocalSourcePairedUpdate, readLocalSourcePairedUpdateJournal, recoverLocalSourcePairedUpdate, rollbackLocalSourcePairedUpdate, verifyLocalSourceSigner } from "../../infra/local-source-paired-update.js";
 import { checkShellCompletionStatus, ensureCompletionCacheExists } from "../../commands/doctor-completion.js";
 import { runPostUpdateDoctorRepair } from "../../commands/doctor-update.js";
 import { doctorCommand } from "../../commands/doctor.js";
@@ -755,6 +756,7 @@ async function updateCommand(opts) {
 	const updateInstallKind = switchToGit ? "git" : switchToPackage ? "package" : installKind;
 	const defaultChannel = updateInstallKind === "git" ? DEFAULT_GIT_CHANNEL : DEFAULT_PACKAGE_CHANNEL;
 	const channel = requestedChannel ?? storedChannel ?? defaultChannel;
+	const sourceSignerConfigured = installKind === "git" && await isLocalSourceSignerConfigured(process.env);
 	const explicitTag = normalizeTag(opts.tag);
 	let tag = explicitTag ?? channelToNpmTag(channel);
 	let installTag = tag;
@@ -808,6 +810,9 @@ async function updateCommand(opts) {
 		actions.push("Run plugin update sync after core update");
 		actions.push("Refresh shell completion cache (if needed)");
 		actions.push(shouldRestart ? "Restart gateway service and run doctor checks" : "Skip restart (because --no-restart is set)");
+		if (sourceSignerConfigured) {
+			actions.push("Snapshot the built source runtime, activate the exact version-matched native signer, and commit both only after Gateway and signer health");
+		}
 		const notes = [];
 		if (opts.tag && updateInstallKind === "git") {
 			notes.push("--tag applies to npm installs only; git updates ignore it.");
@@ -836,6 +841,21 @@ async function updateCommand(opts) {
 		}, Boolean(opts.json));
 		return;
 	}
+	if (sourceSignerConfigured && switchToPackage) {
+		defaultRuntime.error("A source checkout with a Local signer cannot switch install modes inside one update transaction. Omit --channel to perform a tagged source update, or use the verified installer migration procedure.");
+		defaultRuntime.exit(1);
+		return;
+	}
+	if (sourceSignerConfigured && channel === "dev") {
+		defaultRuntime.error("A Local signer can pair only with an exact tagged stable/beta source release; untagged dev commits fail closed.");
+		defaultRuntime.exit(1);
+		return;
+	}
+	if (sourceSignerConfigured && !shouldRestart) {
+		defaultRuntime.error("A source checkout with a Local signer requires Gateway restart and exact health verification; --no-restart is not allowed.");
+		defaultRuntime.exit(1);
+		return;
+	}
 	if (downgradeRisk && !opts.yes) {
 		if (!process.stdin.isTTY || opts.json) {
 			defaultRuntime.error(["Downgrade confirmation required.", "Downgrading can break configuration. Re-run in a TTY to confirm."].join("\n"));
@@ -1010,6 +1030,136 @@ async function updateCommand(opts) {
 			}
 		} catch {}
 	}
+	if (sourceSignerConfigured && !serviceLoaded) {
+		try {
+			await refreshGatewayServiceEnv({
+				root,
+				jsonMode: Boolean(opts.json)
+			});
+			serviceLoaded = await serviceTarget.service.isLoaded({ env: process.env });
+			if (!serviceLoaded) {
+				throw new Error("the Local Gateway service is still not loaded");
+			}
+			if (serviceTarget.scope === "platform") {
+				restartScriptPath = await prepareRestartScript(process.env);
+			}
+		} catch (error) {
+			stop();
+			defaultRuntime.error(`A paired source app/signer update requires a managed Local Gateway service: ${String(error)}. Run ${formatCliCommand("fased gateway install --force")}, then retry.`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
+	const gatewayPort = resolveGatewayPort(configSnapshot.valid ? configSnapshot.config : undefined);
+	const gatewayConfig = configSnapshot.valid ? configSnapshot.config.gateway : undefined;
+	const tlsRuntime = await loadGatewayTlsRuntime(gatewayConfig?.tls);
+	const restartRpc = {
+		url: `${tlsRuntime.enabled ? "wss" : "ws"}://127.0.0.1:${gatewayPort}`,
+		token: gatewayConfig?.auth?.token,
+		password: gatewayConfig?.auth?.password,
+		tlsFingerprint: tlsRuntime.enabled ? tlsRuntime.fingerprintSha256 : undefined,
+		timeoutMs: 1500
+	};
+	const restoreSourcePairAfterFailure = async (journal) => {
+		await rollbackLocalSourcePairedUpdate({
+			journal,
+			timeoutMs: timeoutMs ?? 20 * 6e4,
+			env: process.env
+		});
+		if (!serviceLoaded) {
+			return true;
+		}
+		const rollbackRestartScript = serviceTarget.scope === "platform" ? await prepareRestartScript(process.env) : null;
+		const restored = await maybeRestartService({
+			shouldRestart: true,
+			result: {
+				status: "ok",
+				mode: "git",
+				root: journal.sourceRoot,
+				after: { version: journal.previous.version },
+				steps: [],
+				durationMs: 0
+			},
+			opts,
+			refreshServiceEnv: true,
+			gatewayPort,
+			restartScriptPath: rollbackRestartScript,
+			serviceTarget,
+			serviceLoaded,
+			expectedVersion: journal.previous.version,
+			rpc: restartRpc
+		});
+		return restored.healthy;
+	};
+	let interruptedSourcePair = null;
+	if (installKind === "git") {
+		try {
+			interruptedSourcePair = await readLocalSourcePairedUpdateJournal(process.env);
+		} catch (error) {
+			stop();
+			defaultRuntime.error(`Local source transaction journal is invalid: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
+	if (interruptedSourcePair) {
+		try {
+			const recovery = await recoverLocalSourcePairedUpdate({
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+			if (recovery === "rolled-back" && serviceLoaded) {
+				const restored = await maybeRestartService({
+					shouldRestart: true,
+					result: {
+						status: "ok",
+						mode: "git",
+						root: interruptedSourcePair.sourceRoot,
+						after: { version: interruptedSourcePair.previous.version },
+						steps: [],
+						durationMs: 0
+					},
+					opts,
+					refreshServiceEnv: true,
+					gatewayPort,
+					restartScriptPath,
+					serviceTarget,
+					serviceLoaded,
+					expectedVersion: interruptedSourcePair.previous.version,
+					rpc: restartRpc
+				});
+				if (!restored.healthy) {
+					throw new Error("the previous Gateway did not become healthy after source recovery");
+				}
+				if (serviceTarget.scope === "platform") {
+					restartScriptPath = await prepareRestartScript(process.env);
+				}
+			}
+			if (!opts.json) {
+				defaultRuntime.log(theme.muted(recovery === "committed" ? "Completed the previously verified Local source app/signer commit." : "Recovered the interrupted Local source app/signer transaction."));
+			}
+		} catch (error) {
+			stop();
+			defaultRuntime.error(`Local source app/signer recovery failed: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
+	let sourcePair = null;
+	if (sourceSignerConfigured) {
+		try {
+			sourcePair = await prepareLocalSourcePairedUpdate({
+				sourceRoot: root,
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+		} catch (error) {
+			stop();
+			defaultRuntime.error(`Could not prepare Local source rollback: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
 	const result = switchToPackage ? await runPackageInstallUpdate({
 		root,
 		installKind,
@@ -1030,6 +1180,55 @@ async function updateCommand(opts) {
 		opts,
 		stop
 	});
+	if (sourcePair && result.status === "ok") {
+		try {
+			if (!result.after?.sha || !result.after.version) {
+				throw new Error("source update did not report an exact target Git SHA and version");
+			}
+			sourcePair = await markLocalSourceAppActive({
+				journal: sourcePair,
+				targetSha: result.after.sha,
+				targetVersion: result.after.version,
+				env: process.env
+			});
+			sourcePair = await activateLocalSourceSigner({
+				journal: sourcePair,
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+		} catch (error) {
+			try {
+				await rollbackLocalSourcePairedUpdate({
+					journal: sourcePair,
+					timeoutMs: timeoutMs ?? 20 * 6e4,
+					env: process.env
+				});
+			} catch (rollbackError) {
+				stop();
+				defaultRuntime.error(`Local source signer activation failed and rollback is incomplete: ${String(error)}; ${String(rollbackError)}`);
+				defaultRuntime.exit(1);
+				return;
+			}
+			stop();
+			defaultRuntime.error(`Local source update restored the previous app and signer: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	} else if (sourcePair) {
+		try {
+			await rollbackLocalSourcePairedUpdate({
+				journal: sourcePair,
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+		} catch (error) {
+			stop();
+			defaultRuntime.error(`Source update failed and exact rollback is incomplete: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+		sourcePair = null;
+	}
 	stop();
 	printResult(result, {
 		...opts,
@@ -1050,16 +1249,6 @@ async function updateCommand(opts) {
 		defaultRuntime.exit(0);
 		return;
 	}
-	const gatewayPort = resolveGatewayPort(configSnapshot.valid ? configSnapshot.config : undefined);
-	const gatewayConfig = configSnapshot.valid ? configSnapshot.config.gateway : undefined;
-	const tlsRuntime = await loadGatewayTlsRuntime(gatewayConfig?.tls);
-	const restartRpc = {
-		url: `${tlsRuntime.enabled ? "wss" : "ws"}://127.0.0.1:${gatewayPort}`,
-		token: gatewayConfig?.auth?.token,
-		password: gatewayConfig?.auth?.password,
-		tlsFingerprint: tlsRuntime.enabled ? tlsRuntime.fingerprintSha256 : undefined,
-		timeoutMs: 1500
-	};
 	const restartResult = await maybeRestartService({
 		shouldRestart,
 		result,
@@ -1073,7 +1262,19 @@ async function updateCommand(opts) {
 		rpc: restartRpc
 	});
 	if (!restartResult.healthy) {
-		if (result.transaction) {
+		if (sourcePair) {
+			if (!opts.json) {
+				defaultRuntime.log(theme.warn("Gateway verification failed; restoring the exact source app and signer."));
+			}
+			try {
+				const restored = await restoreSourcePairAfterFailure(sourcePair);
+				if (!restored) {
+					defaultRuntime.error("Previous source Gateway was restored, but it is not healthy.");
+				}
+			} catch (error) {
+				defaultRuntime.error(`Automatic source app/signer rollback failed: ${String(error)}`);
+			}
+		} else if (result.transaction) {
 			if (!opts.json) {
 				defaultRuntime.log(theme.warn("Gateway verification failed; restoring the previous runtime."));
 			}
@@ -1098,6 +1299,54 @@ async function updateCommand(opts) {
 		defaultRuntime.exit(1);
 		return;
 	}
+	if (sourcePair) {
+		try {
+			await verifyLocalSourceSigner({
+				journal: sourcePair,
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+		} catch (error) {
+			try {
+				const restored = await restoreSourcePairAfterFailure(sourcePair);
+				if (!restored) {
+					throw new Error("the previous source Gateway did not become healthy", { cause: error });
+				}
+			} catch (rollbackError) {
+				defaultRuntime.error(`Signer verification failed and exact source rollback is incomplete: ${String(error)}; ${String(rollbackError)}`);
+				defaultRuntime.exit(1);
+				return;
+			}
+			defaultRuntime.error(`Signer verification failed; restored the previous source app and signer: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+		try {
+			sourcePair = await markLocalSourceGatewayVerified(sourcePair, process.env);
+		} catch (error) {
+			try {
+				await restoreSourcePairAfterFailure(sourcePair);
+			} catch (rollbackError) {
+				defaultRuntime.error(`Could not record paired health and rollback is incomplete: ${String(error)}; ${String(rollbackError)}`);
+				defaultRuntime.exit(1);
+				return;
+			}
+			defaultRuntime.error(`Could not durably record paired health: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+		try {
+			await commitLocalSourcePairedUpdate({
+				journal: sourcePair,
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+		} catch (error) {
+			defaultRuntime.error(`The source Gateway and signer passed exact health, but commit cleanup is pending: ${String(error)}. Re-run fased update to finish forward recovery; do not downgrade manually.`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
 	const lifecycleTimings = [...restartResult.timings];
 	await measureUpdateStage(lifecycleTimings, "transaction cleanup", () => finalizeUpdateTransaction(result.transaction));
 	const pluginResult = await measureUpdateStage(lifecycleTimings, "plugin updates", () => updatePluginsAfterCoreUpdate({

package/dist/cli/windows-argv.js

@@ -1,4 +1,4 @@
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/cli/windows-argv.ts
@@ -33,7 +33,7 @@ function normalizeWindowsArgv(argv) {
 			return false;
 		}
 		const lower = normalized.toLowerCase();
-		return lower === execPathLower || path.basename(lower) === execBase || lower.endsWith("\\node.exe") || lower.endsWith("/node.exe") || lower.includes("node.exe") || path.basename(lower) === "node.exe" && fs.existsSync(normalized);
+		return lower === execPathLower || path.basename(lower) === execBase || lower.endsWith("\\node.exe") || lower.endsWith("/node.exe") || lower.includes("node.exe") || path.basename(lower) === "node.exe" && syncFs.existsSync(normalized);
 	};
 	const next = [...argv];
 	for (let i = 1; i <= 3 && i < next.length;) {

package/dist/commands/auth-choice.apply.api-providers.js

@@ -1,11 +1,11 @@
+import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
+import { resolveAuthProfileOrder } from "../agents/auth-profiles/order.js";
+import "../agents/auth-profiles.js";
 import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/cloudflare-ai-gateway-shared.js";
 import { SYNTHETIC_DEFAULT_MODEL_REF } from "../providers/synthetic-models.js";
 import { TOGETHER_DEFAULT_MODEL_REF } from "../providers/together-models.js";
 import { VENICE_DEFAULT_MODEL_REF } from "../providers/venice-models.js";
 import { VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/vercel-ai-gateway-models.js";
-import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
-import { resolveAuthProfileOrder } from "../agents/auth-profiles/order.js";
-import "../agents/auth-profiles.js";
 import { CHUTES_DEFAULT_MODEL_REF } from "../agents/chutes-models.js";
 import { QWEN_CODING_PLAN_DEFAULT_MODEL_REF, QWEN_DEFAULT_MODEL_REF } from "../agents/models-config.providers.js";
 import { normalizeApiKeyInput, validateApiKeyInput } from "./auth-choice.api-key.js";

package/dist/commands/dashboard-link.js

@@ -4,7 +4,7 @@ import { parseDurationMs } from "../cli/parse-duration.js";
 import { readConfigFileSnapshot } from "../config/io.js";
 import "../config/config.js";
 import { CONTROL_UI_LOGIN_DEFAULT_GRANT_TTL_MS, createLoginGrant, normalizePublicHost } from "../gateway/control-ui-login.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/commands/dashboard-link.ts
@@ -12,10 +12,10 @@ const AGENT_DOMAIN_SUFFIX = ".agents.fased.app";
 function readStateGatewayToken(env = process.env) {
 	try {
 		const filePath = path.join(resolveStateDir(env), "gateway-secret");
-		if (!fs.existsSync(filePath)) {
+		if (!syncFs.existsSync(filePath)) {
 			return "";
 		}
-		return fs.readFileSync(filePath, "utf8").trim();
+		return syncFs.readFileSync(filePath, "utf8").trim();
 	} catch {
 		return "";
 	}

package/dist/commands/doctor-config-flow.js

@@ -14,12 +14,12 @@ import "../config/config.js";
 import { listTelegramAccountIds, resolveTelegramAccount } from "../telegram/accounts.js";
 import "../channels/registry.js";
 import { readChannelAllowFromStore } from "../pairing/pairing-store.js";
-import { readWalletApprovalAuthSnapshot } from "../wallet/wallet-approval-auth.js";
 import { listInterpreterLikeSafeBins, resolveMergedSafeBinProfileFixtures } from "../infra/exec-safe-bin-runtime-policy.js";
 import { applyPluginAutoEnable } from "../config/plugin-auto-enable.js";
 import { isNumericTelegramUserId, normalizeTelegramAllowFromEntry } from "../channels/telegram/allow-from.js";
 import { collectProviderDangerousNameMatchingScopes } from "../config/dangerous-name-matching.js";
 import { isDiscordMutableAllowEntry, isGoogleChatMutableAllowEntry, isIrcMutableAllowEntry, isMSTeamsMutableAllowEntry, isMattermostMutableAllowEntry, isSlackMutableAllowEntry } from "../security/mutable-allowlist-detectors.js";
+import { readWalletApprovalAuthSnapshot } from "../wallet/wallet-approval-auth.js";
 import { fetchTelegramChatId } from "../channels/telegram/api.js";
 import { note } from "../terminal/note.js";
 import { normalizeLegacyConfigValues } from "./doctor-legacy-config.js";

package/dist/commands/doctor-install.js

@@ -1,5 +1,5 @@
 import { note } from "../terminal/note.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/commands/doctor-install.ts
@@ -8,7 +8,7 @@ function noteSourceInstallIssues(root) {
 		return;
 	}
 	const workspaceMarker = path.join(root, "pnpm-workspace.yaml");
-	if (!fs.existsSync(workspaceMarker)) {
+	if (!syncFs.existsSync(workspaceMarker)) {
 		return;
 	}
 	const warnings = [];
@@ -16,13 +16,13 @@ function noteSourceInstallIssues(root) {
 	const pnpmStore = path.join(nodeModules, ".pnpm");
 	const tsxBin = path.join(nodeModules, ".bin", "tsx");
 	const srcEntry = path.join(root, "src", "entry.ts");
-	if (fs.existsSync(nodeModules) && !fs.existsSync(pnpmStore)) {
+	if (syncFs.existsSync(nodeModules) && !syncFs.existsSync(pnpmStore)) {
 		warnings.push("- node_modules was not installed by pnpm (missing node_modules/.pnpm). Run: pnpm install");
 	}
-	if (fs.existsSync(path.join(root, "package-lock.json"))) {
+	if (syncFs.existsSync(path.join(root, "package-lock.json"))) {
 		warnings.push("- package-lock.json present in a pnpm workspace. If you ran npm install, remove it and reinstall with pnpm.");
 	}
-	if (fs.existsSync(srcEntry) && !fs.existsSync(tsxBin)) {
+	if (syncFs.existsSync(srcEntry) && !syncFs.existsSync(tsxBin)) {
 		warnings.push("- tsx binary is missing for source runs. Run: pnpm install");
 	}
 	if (warnings.length > 0) {

package/dist/commands/doctor-legacy-config.js

@@ -329,25 +329,14 @@ function normalizeLegacyConfigValues(cfg) {
 	normalizeProvider("discord");
 	const rawWalletProviderId = String(cfg.wallet?.provider?.id ?? "").trim();
 	const allowedProviderIds = new Set([
-		"embedded-keystore",
 		"local-socket-signer",
 		"alchemy",
 		"turnkey",
+		"wallet-standard",
 		"privy"
 	]);
 	if (rawWalletProviderId && !allowedProviderIds.has(rawWalletProviderId)) {
-		const mappedProviderId = "embedded-keystore";
-		next = {
-			...next,
-			wallet: {
-				...next.wallet,
-				provider: {
-					...next.wallet?.provider,
-					id: mappedProviderId
-				}
-			}
-		};
-		changes.push("Normalized unsupported wallet.provider.id to embedded-keystore.");
+		changes.push(`Wallet provider ${rawWalletProviderId} is unsupported and was left unchanged for explicit operator repair.`);
 	}
 	const legacyAckReaction = cfg.messages?.ackReaction?.trim();
 	const hasWhatsAppConfig = cfg.channels?.whatsapp !== undefined;

package/dist/commands/doctor-memory-search.js

@@ -5,7 +5,7 @@ import { resolveApiKeyForProvider } from "../agents/model-auth.js";
 import { resolveMemoryBackendConfig } from "../memory/backend-config.js";
 import { resolveMemorySearchConfig } from "../agents/memory-search.js";
 import { note } from "../terminal/note.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 
 //#region src/commands/doctor-memory-search.ts
 /**
@@ -126,7 +126,7 @@ function hasLocalEmbeddings(local) {
 	}
 	const resolved = resolveUserPath(modelPath);
 	try {
-		return fs.statSync(resolved).isFile();
+		return syncFs.statSync(resolved).isFile();
 	} catch {
 		return false;
 	}

package/dist/commands/doctor-platform-notes.js

@@ -1,6 +1,6 @@
 import { shortenHomePath } from "../utils.js";
 import { note } from "../terminal/note.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
@@ -17,7 +17,7 @@ async function noteMacLaunchAgentOverrides() {
 	}
 	const home = resolveHomeDir();
 	const markerCandidates = [path.join(home, ".fased", "disable-launchagent")];
-	const markerPath = markerCandidates.find((candidate) => fs.existsSync(candidate));
+	const markerPath = markerCandidates.find((candidate) => syncFs.existsSync(candidate));
 	if (!markerPath) {
 		return;
 	}

package/dist/commands/doctor-sandbox.js

@@ -3,7 +3,7 @@ import { DEFAULT_SANDBOX_BROWSER_IMAGE, DEFAULT_SANDBOX_COMMON_IMAGE, DEFAULT_SA
 import { resolveSandboxScope } from "../agents/sandbox/config.js";
 import "../agents/sandbox.js";
 import { note } from "../terminal/note.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/commands/doctor-sandbox.ts
@@ -18,7 +18,7 @@ function resolveSandboxScript(scriptRel) {
 	}
 	for (const root of candidates) {
 		const scriptPath = path.join(root, scriptRel);
-		if (fs.existsSync(scriptPath)) {
+		if (syncFs.existsSync(scriptPath)) {
 			return {
 				scriptPath,
 				cwd: root

package/dist/commands/doctor-state-integrity.js

@@ -11,28 +11,28 @@ import { loadSessionStore } from "../config/sessions/store.js";
 import { ensureSessionTranscriptHeader } from "../config/sessions/transcript.js";
 import "../config/sessions.js";
 import { note } from "../terminal/note.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
 //#region src/commands/doctor-state-integrity.ts
 function existsDir(dir) {
 	try {
-		return fs.existsSync(dir) && fs.statSync(dir).isDirectory();
+		return syncFs.existsSync(dir) && syncFs.statSync(dir).isDirectory();
 	} catch {
 		return false;
 	}
 }
 function existsFile(filePath) {
 	try {
-		return fs.existsSync(filePath) && fs.statSync(filePath).isFile();
+		return syncFs.existsSync(filePath) && syncFs.statSync(filePath).isFile();
 	} catch {
 		return false;
 	}
 }
 function canWriteDir(dir) {
 	try {
-		fs.accessSync(dir, fs.constants.W_OK);
+		syncFs.accessSync(dir, syncFs.constants.W_OK);
 		return true;
 	} catch {
 		return false;
@@ -40,7 +40,7 @@ function canWriteDir(dir) {
 }
 function ensureDir(dir) {
 	try {
-		fs.mkdirSync(dir, { recursive: true });
+		syncFs.mkdirSync(dir, { recursive: true });
 		return { ok: true };
 	} catch (err) {
 		return {
@@ -53,7 +53,7 @@ function dirPermissionHint(dir) {
 	const uid = typeof process.getuid === "function" ? process.getuid() : null;
 	const gid = typeof process.getgid === "function" ? process.getgid() : null;
 	try {
-		const stat = fs.statSync(dir);
+		const stat = syncFs.statSync(dir);
 		if (uid !== null && stat.uid !== uid) {
 			return `Owner mismatch (uid ${stat.uid}). Run: sudo chown -R $USER "${dir}"`;
 		}
@@ -71,7 +71,7 @@ function addUserRwx(mode) {
 }
 function countJsonlLines(filePath) {
 	try {
-		const raw = fs.readFileSync(filePath, "utf-8");
+		const raw = syncFs.readFileSync(filePath, "utf-8");
 		if (!raw) {
 			return 0;
 		}
@@ -96,7 +96,7 @@ function findOtherStateDirs(stateDir) {
 	for (const root of roots) {
 		let entries = [];
 		try {
-			entries = fs.readdirSync(root, { withFileTypes: true });
+			entries = syncFs.readdirSync(root, { withFileTypes: true });
 		} catch {
 			continue;
 		}
@@ -226,9 +226,9 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 		});
 		if (repair) {
 			try {
-				const stat = fs.statSync(stateDir);
+				const stat = syncFs.statSync(stateDir);
 				const target = addUserRwx(stat.mode);
-				fs.chmodSync(stateDir, target);
+				syncFs.chmodSync(stateDir, target);
 				changes.push(`- Repaired permissions on ${displayStateDir}`);
 			} catch (err) {
 				warnings.push(`- Failed to repair ${displayStateDir}: ${String(err)}`);
@@ -237,10 +237,10 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 	}
 	if (stateDirExists && process.platform !== "win32") {
 		try {
-			const dirLstat = fs.lstatSync(stateDir);
+			const dirLstat = syncFs.lstatSync(stateDir);
 			const isDirSymlink = dirLstat.isSymbolicLink();
-			const stat = isDirSymlink ? fs.statSync(stateDir) : dirLstat;
-			const resolvedDir = isDirSymlink ? fs.realpathSync(stateDir) : stateDir;
+			const stat = isDirSymlink ? syncFs.statSync(stateDir) : dirLstat;
+			const resolvedDir = isDirSymlink ? syncFs.realpathSync(stateDir) : stateDir;
 			const isImmutableStore = resolvedDir.startsWith("/nix/store/");
 			if (!isImmutableStore && (stat.mode & 63) !== 0) {
 				warnings.push(`- State directory permissions are too open (${displayStateDir}). Recommend chmod 700.`);
@@ -249,7 +249,7 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 					initialValue: true
 				});
 				if (tighten) {
-					fs.chmodSync(stateDir, 448);
+					syncFs.chmodSync(stateDir, 448);
 					changes.push(`- Tightened permissions on ${displayStateDir} to 700`);
 				}
 			}
@@ -259,10 +259,10 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 	}
 	if (configPath && existsFile(configPath) && process.platform !== "win32") {
 		try {
-			const configLstat = fs.lstatSync(configPath);
+			const configLstat = syncFs.lstatSync(configPath);
 			const isSymlink = configLstat.isSymbolicLink();
-			const stat = isSymlink ? fs.statSync(configPath) : configLstat;
-			const resolvedConfig = isSymlink ? fs.realpathSync(configPath) : configPath;
+			const stat = isSymlink ? syncFs.statSync(configPath) : configLstat;
+			const resolvedConfig = isSymlink ? syncFs.realpathSync(configPath) : configPath;
 			const isImmutableConfig = resolvedConfig.startsWith("/nix/store/");
 			if (!isImmutableConfig && (stat.mode & 63) !== 0) {
 				warnings.push(`- Config file is group/world readable (${displayConfigPath ?? configPath}). Recommend chmod 600.`);
@@ -271,7 +271,7 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 					initialValue: true
 				});
 				if (tighten) {
-					fs.chmodSync(configPath, 384);
+					syncFs.chmodSync(configPath, 384);
 					changes.push(`- Tightened permissions on ${displayConfigPath ?? configPath} to 600`);
 				}
 			}
@@ -330,9 +330,9 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 				});
 				if (repair) {
 					try {
-						const stat = fs.statSync(dir);
+						const stat = syncFs.statSync(dir);
 						const target = addUserRwx(stat.mode);
-						fs.chmodSync(dir, target);
+						syncFs.chmodSync(dir, target);
 						changes.push(`- Repaired permissions on ${label}: ${displayDir}`);
 					} catch (err) {
 						warnings.push(`- Failed to repair ${displayDir}: ${String(err)}`);
@@ -432,7 +432,7 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 				referencedTranscriptPaths.add(path.resolve(resolveSessionFilePath(entry.sessionId, entry, sessionPathOpts)));
 			} catch {}
 		}
-		const sessionDirEntries = fs.readdirSync(sessionsDir, { withFileTypes: true });
+		const sessionDirEntries = syncFs.readdirSync(sessionsDir, { withFileTypes: true });
 		const orphanTranscriptPaths = sessionDirEntries.filter((entry) => entry.isFile() && isPrimarySessionTranscriptFileName(entry.name)).map((entry) => path.resolve(path.join(sessionsDir, entry.name))).filter((filePath) => !referencedTranscriptPaths.has(filePath));
 		if (orphanTranscriptPaths.length > 0) {
 			warnings.push(`- Found ${orphanTranscriptPaths.length} orphan transcript file(s) in ${displaySessionsDir}. They are not referenced by sessions.json and can consume disk over time.`);
@@ -446,7 +446,7 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 				for (const orphanPath of orphanTranscriptPaths) {
 					const archivedPath = `${orphanPath}.deleted.${archivedAt}`;
 					try {
-						fs.renameSync(orphanPath, archivedPath);
+						syncFs.renameSync(orphanPath, archivedPath);
 						archived += 1;
 					} catch (err) {
 						warnings.push(`- Failed to archive orphan transcript ${shortenHomePath(orphanPath)}: ${String(err)}`);
@@ -470,7 +470,7 @@ function noteWorkspaceBackupTip(workspaceDir) {
 		return;
 	}
 	const gitMarker = path.join(workspaceDir, ".git");
-	if (fs.existsSync(gitMarker)) {
+	if (syncFs.existsSync(gitMarker)) {
 		return;
 	}
 	note([