@fased/fased 0.1.61 → 0.1.64

package/dist/commands/doctor-workspace.js

@@ -1,6 +1,6 @@
 import { shortenHomePath } from "../utils.js";
 import { DEFAULT_AGENTS_FILENAME } from "../agents/workspace.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/commands/doctor-workspace.ts
@@ -16,13 +16,13 @@ async function shouldSuggestMemorySystem(workspaceDir) {
 	const memoryPaths = [path.join(workspaceDir, "MEMORY.md"), path.join(workspaceDir, "memory.md")];
 	for (const memoryPath of memoryPaths) {
 		try {
-			await fs.promises.access(memoryPath);
+			await syncFs.promises.access(memoryPath);
 			return false;
 		} catch {}
 	}
 	const agentsPath = path.join(workspaceDir, DEFAULT_AGENTS_FILENAME);
 	try {
-		const content = await fs.promises.readFile(agentsPath, "utf-8");
+		const content = await syncFs.promises.readFile(agentsPath, "utf-8");
 		if (/memory\.md/i.test(content)) {
 			return false;
 		}

package/dist/commands/doctor.js

@@ -37,7 +37,7 @@ import { maybeRepairUiProtocolFreshness } from "./doctor-ui.js";
 import { maybeOfferUpdateBeforeDoctor } from "./doctor-update.js";
 import { MEMORY_SYSTEM_PROMPT, shouldSuggestMemorySystem } from "./doctor-workspace.js";
 import { noteWorkspaceStatus } from "./doctor-workspace-status.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import { intro, outro } from "@clack/prompts";
 
 //#region src/commands/doctor.ts
@@ -83,7 +83,7 @@ async function doctorCommand(runtime = defaultRuntime, options = {}) {
 			`Fix: run ${formatCliCommand("fased configure")} and set Gateway mode (local/remote).`,
 			`Or set directly: ${formatCliCommand("fased config set gateway.mode local")}`
 		];
-		if (!fs.existsSync(configPath)) {
+		if (!syncFs.existsSync(configPath)) {
 			lines.push(`Missing config: run ${formatCliCommand("fased setup")} first.`);
 		}
 		note$1(lines.join("\n"), "Gateway");
@@ -233,7 +233,7 @@ async function doctorCommand(runtime = defaultRuntime, options = {}) {
 		await writeConfigFile(cfg);
 		logConfigUpdated(runtime);
 		const backupPath = `${CONFIG_PATH}.bak`;
-		if (fs.existsSync(backupPath)) {
+		if (syncFs.existsSync(backupPath)) {
 			runtime.log(`Backup: ${shortenHomePath(backupPath)}`);
 		}
 	} else if (configResult.hasPendingChanges) {

package/dist/commands/managed-up.js

@@ -2,7 +2,7 @@ import { defaultRuntime } from "../runtime.js";
 import { readManagedFederationTokenSummary } from "../managed/federation.js";
 import { readManagedReservationSummaries } from "../managed/tunnel.js";
 import { fileURLToPath } from "node:url";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
 
@@ -44,7 +44,7 @@ function resolveManagedScriptPath() {
 		candidates.push(cwdCandidate);
 	}
 	for (const candidate of candidates) {
-		if (fs.existsSync(candidate)) {
+		if (syncFs.existsSync(candidate)) {
 			return candidate;
 		}
 	}

package/dist/commands/model-picker.js

@@ -1,4 +1,8 @@
 import { resolveAgentModelPrimaryValue } from "../config/model-input.js";
+import { DEFAULT_MODEL, DEFAULT_PROVIDER } from "../agents/defaults.js";
+import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
+import { listProfilesForProvider } from "../agents/auth-profiles/profiles.js";
+import "../agents/auth-profiles.js";
 import { CLOUDFLARE_AI_GATEWAY_MODEL_REFS } from "../providers/cloudflare-ai-gateway-shared.js";
 import { HUGGINGFACE_MODEL_REFS } from "../providers/huggingface-models.js";
 import { OPENCODE_ZEN_MODEL_REFS } from "../providers/opencode-zen-shared.js";
@@ -7,10 +11,6 @@ import { VENICE_MODEL_REFS } from "../providers/venice-models.js";
 import { VERCEL_AI_GATEWAY_MODEL_REFS } from "../providers/vercel-ai-gateway-models.js";
 import { LITELLM_MODEL_REFS } from "../providers/litellm-models.js";
 import { BYTEPLUS_CODING_MODEL_REFS, BYTEPLUS_MODEL_REFS, COPILOT_PROXY_MODEL_REFS, GITHUB_COPILOT_MODEL_REFS, GOOGLE_API_MODEL_REFS, GOOGLE_GEMINI_CLI_MODEL_REFS, MISTRAL_MODEL_REFS, OPENAI_API_MODEL_REFS, OPENAI_SIGN_IN_MODEL_REFS, OPENROUTER_MODEL_REFS, QIANFAN_MODEL_REFS, SYNTHETIC_MODEL_REFS, VOLCENGINE_CODING_MODEL_REFS, VOLCENGINE_MODEL_REFS, XAI_MODEL_REFS, XIAOMI_MODEL_REFS, ZAI_MODEL_REFS, isStandardProviderCatalogEntry, isStandardProviderModelRef } from "../providers/registry.js";
-import { DEFAULT_MODEL, DEFAULT_PROVIDER } from "../agents/defaults.js";
-import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
-import { listProfilesForProvider } from "../agents/auth-profiles/profiles.js";
-import "../agents/auth-profiles.js";
 import { getCustomProviderApiKey, resolveEnvApiKey } from "../agents/model-auth.js";
 import { buildAllowedModelSet, buildModelAliasIndex, modelKey, normalizeProviderId, resolveConfiguredModelRef } from "../agents/model-selection.js";
 import { formatModelFeatureList } from "../agents/model-metadata.js";
@@ -284,8 +284,8 @@ async function promptDefaultModel(params) {
 			defaultProvider: DEFAULT_PROVIDER,
 			store: ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false })
 		}) : null;
-		if (scoped && (scoped.allowedCatalog.length > 0 || scoped.usableCatalog.length > 0)) {
-			models = scoped.allowedCatalog.length > 0 ? scoped.allowedCatalog : scoped.usableCatalog;
+		if (scoped) {
+			models = scoped.allowAny ? scoped.usableCatalog : scoped.allowedCatalog;
 		} else {
 			const { allowedCatalog } = buildAllowedModelSet({
 				cfg,

package/dist/commands/models/auth.js

@@ -1,10 +1,10 @@
 import { resolveDefaultAgentWorkspaceDir } from "../../agents/workspace.js";
 import { resolveAgentDir, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../../agents/agent-scope.js";
-import { ANTHROPIC_PROVIDER_MANIFEST } from "../../providers/registry.js";
 import { formatCliCommand } from "../../cli/command-format.js";
 import { upsertAuthProfile } from "../../agents/auth-profiles/profiles.js";
 import { parseDurationMs } from "../../cli/parse-duration.js";
 import "../../agents/auth-profiles.js";
+import { ANTHROPIC_PROVIDER_MANIFEST } from "../../providers/registry.js";
 import { normalizeProviderId } from "../../agents/model-selection.js";
 import { stylePromptHint, stylePromptMessage } from "../../terminal/prompt-style.js";
 import { openUrl } from "../onboard-helpers.js";

package/dist/commands/onboard-auth.config-gateways.js

@@ -1,6 +1,6 @@
 import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, CLOUDFLARE_AI_GATEWAY_MODEL_CATALOG, buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl } from "../providers/cloudflare-ai-gateway-shared.js";
-import { VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/vercel-ai-gateway-models.js";
 import "../agents/cloudflare-ai-gateway.js";
+import { VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/vercel-ai-gateway-models.js";
 import { applyAgentDefaultModelPrimary, applyProviderConfigWithDefaultModels } from "./onboard-auth.config-shared.js";
 import "./onboard-auth.credentials.js";
 

package/dist/commands/onboard-auth.credentials.js

@@ -1,17 +1,17 @@
 import { resolveStateDir } from "../config/paths.js";
-import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/cloudflare-ai-gateway-shared.js";
-import { HUGGINGFACE_DEFAULT_MODEL_REF } from "../providers/huggingface-models.js";
-import { TOGETHER_DEFAULT_MODEL_REF } from "../providers/together-models.js";
-import { VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/vercel-ai-gateway-models.js";
-import "../providers/registry.js";
 import { DEFAULT_SECRET_PROVIDER_ALIAS, coerceSecretRef } from "../config/types.secrets.js";
 import { normalizeSecretInput } from "../utils/normalize-secret-input.js";
 import { resolveFasedAgentAgentDir } from "../agents/agent-paths.js";
 import { upsertAuthProfile } from "../agents/auth-profiles/profiles.js";
 import "../agents/auth-profiles.js";
+import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/cloudflare-ai-gateway-shared.js";
+import { HUGGINGFACE_DEFAULT_MODEL_REF } from "../providers/huggingface-models.js";
+import { TOGETHER_DEFAULT_MODEL_REF } from "../providers/together-models.js";
+import { VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/vercel-ai-gateway-models.js";
+import "../providers/registry.js";
 import { PROVIDER_ENV_VARS } from "../secrets/provider-env-vars.js";
 import { MISTRAL_DEFAULT_MODEL_REF, XAI_DEFAULT_MODEL_REF } from "./onboard-auth.models.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/commands/onboard-auth.credentials.ts
@@ -71,10 +71,32 @@ function buildApiKeyCredential(provider, input, metadata, options) {
 		...metadata ? { metadata } : {}
 	};
 }
+function assertValidOAuthCredentialInput(provider, creds) {
+	if (typeof provider !== "string" || !provider.trim()) {
+		throw new Error("OAuth credential provider must be a non-empty string.");
+	}
+	if (!creds || typeof creds !== "object" || typeof creds.access !== "string" || !creds.access.trim() || typeof creds.refresh !== "string" || !creds.refresh.trim() || typeof creds.expires !== "number" || !Number.isFinite(creds.expires)) {
+		throw new Error("OAuth credentials must include valid access, refresh, and expiry fields.");
+	}
+	for (const field of [
+		"email",
+		"clientId",
+		"enterpriseUrl",
+		"projectId",
+		"accountId"
+	]) {
+		if (creds[field] !== undefined && typeof creds[field] !== "string") {
+			throw new Error(`OAuth credential ${field} must be a string when provided.`);
+		}
+	}
+	if (creds.availableModelIds !== undefined && (!Array.isArray(creds.availableModelIds) || !creds.availableModelIds.every((modelId) => typeof modelId === "string" && modelId.trim().length > 0))) {
+		throw new Error("OAuth credential availableModelIds must contain non-empty strings.");
+	}
+}
 /** Resolve real path, returning null if the target doesn't exist. */
 function safeRealpathSync(dir) {
 	try {
-		return fs.realpathSync(path.resolve(dir));
+		return syncFs.realpathSync(path.resolve(dir));
 	} catch {
 		return null;
 	}
@@ -87,7 +109,7 @@ function resolveSiblingAgentDirs(primaryAgentDir) {
 	const agentsRoot = looksLikeStandardLayout ? candidateAgentsRoot : path.join(resolveStateDir(), "agents");
 	const entries = (() => {
 		try {
-			return fs.readdirSync(agentsRoot, { withFileTypes: true });
+			return syncFs.readdirSync(agentsRoot, { withFileTypes: true });
 		} catch {
 			return [];
 		}
@@ -105,14 +127,16 @@ function resolveSiblingAgentDirs(primaryAgentDir) {
 	return result;
 }
 async function writeOAuthCredentials(provider, creds, agentDir, options) {
+	assertValidOAuthCredentialInput(provider, creds);
+	const canonicalProvider = provider.trim();
 	const email = typeof creds.email === "string" && creds.email.trim() ? creds.email.trim() : "default";
-	const profileId = `${provider}:${email}`;
+	const profileId = `${canonicalProvider}:${email}`;
 	const resolvedAgentDir = path.resolve(resolveAuthAgentDir(agentDir));
 	const targetAgentDirs = options?.syncSiblingAgents ? resolveSiblingAgentDirs(resolvedAgentDir) : [resolvedAgentDir];
 	const credential = {
+		...creds,
 		type: "oauth",
-		provider,
-		...creds
+		provider: canonicalProvider
 	};
 	upsertAuthProfile({
 		profileId,

package/dist/commands/onboard-non-interactive/local/wallet-config.js

@@ -1,3 +1,4 @@
+import { LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE, hasLegacyEmbeddedKeystoreMaterialHint } from "../../../wallet/legacy-embedded-keystore.js";
 import { WALLET_PROVIDER_IDS, readWalletProviderRegistry, setWalletProvidersEnabled } from "../../../wallet/wallet-provider-registry.js";
 
 //#region src/commands/onboard-non-interactive/local/wallet-config.ts
@@ -79,11 +80,10 @@ function parseWalletRuntime(raw) {
 }
 function parseWalletProviderId(raw) {
 	switch ((raw ?? "").trim()) {
-		case "embedded-keystore":
 		case "local-socket-signer":
 		case "alchemy":
 		case "turnkey":
-		case "privy": return raw;
+		case "wallet-standard": return raw;
 		default: return null;
 	}
 }
@@ -103,7 +103,10 @@ function hasConfiguredWalletMaterial(registry) {
 const LOCAL_SIGNER_ENV_KEYS = [
 	"FASED_WALLET_LOCAL_SIGNER_SOCKET",
 	"FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET",
+	"FASED_WALLET_LOCAL_SIGNER_CONTROL_SOCKET",
 	"FASED_WALLET_SIGNER_STATE_DIR",
+	"FASED_WALLET_LOCAL_SIGNER_STATE_DB",
+	"FASED_WALLET_LOCAL_SIGNER_MASTER_KEY",
 	"FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER",
 	"FASED_WALLET_LOCAL_SIGNER_BIN",
 	"FASED_WALLET_PASSPHRASE_FILE"
@@ -140,31 +143,14 @@ function setConfigEnvVar(config, key, value) {
 	};
 }
 function applyHostedLocalSignerDefaults(base) {
-	const signerUser = String(process.env.FASED_SIGNER_USER ?? "fased-signer").trim();
-	if (!signerUser) {
-		return base;
-	}
-	const appHome = String(process.env.HOME ?? "/home/app").trim() || "/home/app";
-	const signerHome = `/home/${signerUser}`;
-	const defaults = {
-		FASED_WALLET_LOCAL_SIGNER_SOCKET: `${appHome}/.fased/wallet/local-signer.sock`,
-		FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET: `${signerHome}/.fased/wallet/local-signer.sock`,
-		FASED_WALLET_SIGNER_STATE_DIR: `${signerHome}/.fased/wallet`,
-		FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER: signerUser,
-		FASED_WALLET_LOCAL_SIGNER_BIN: `${signerHome}/.fased/bin/fased-signerd`,
-		FASED_WALLET_PASSPHRASE_FILE: `${signerHome}/.fased/wallet/passphrase`
-	};
+	const appSocket = "/run/fased-signerd/app.sock";
 	let next = base;
-	for (const [key, value] of Object.entries(defaults)) {
-		const existing = String(process.env[key] ?? base.env?.vars?.[key] ?? "").trim();
-		if (existing) {
-			process.env[key] = existing;
-			next = setConfigEnvVar(next, key, existing);
-			continue;
-		}
-		process.env[key] = value;
-		next = setConfigEnvVar(next, key, value);
+	for (const key of LOCAL_SIGNER_ENV_KEYS) {
+		delete process.env[key];
+		next = setConfigEnvVar(next, key, undefined);
 	}
+	process.env.FASED_WALLET_LOCAL_SIGNER_SOCKET = appSocket;
+	next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_SOCKET", appSocket);
 	return next;
 }
 function applyNonInteractiveWalletConfig(params) {
@@ -172,6 +158,21 @@ function applyNonInteractiveWalletConfig(params) {
 	const current = nextConfig.wallet?.runtime;
 	const managedMode = isManagedGatewayMode(opts);
 	const registry = readWalletProviderRegistry(process.env);
+	const requestedLegacyProvider = String(opts.walletDefaultProvider ?? "").trim() === "embedded-keystore" || typeof opts.walletProviders === "string" && opts.walletProviders.split(",").some((entry) => entry.trim() === "embedded-keystore");
+	if (requestedLegacyProvider || nextConfig.wallet?.provider?.id === "embedded-keystore" || registry.providers["embedded-keystore"]?.enabled || registry.wallets.some((wallet) => wallet.providerId === "embedded-keystore") || hasLegacyEmbeddedKeystoreMaterialHint({
+		...process.env,
+		...nextConfig.env?.vars
+	})) {
+		runtime.error(LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE);
+		runtime.exit(1);
+		return nextConfig;
+	}
+	const requestedPrivyProvider = String(opts.walletDefaultProvider ?? "").trim() === "privy" || typeof opts.walletProviders === "string" && opts.walletProviders.split(",").some((entry) => entry.trim() === "privy");
+	if (requestedPrivyProvider || nextConfig.wallet?.provider?.id === "privy" || registry.wallets.some((wallet) => wallet.providerId === "privy")) {
+		runtime.error("Privy wallet creation and signing are unavailable; use the Go signer, Turnkey, or Wallet Standard.");
+		runtime.exit(1);
+		return nextConfig;
+	}
 	const configuredWalletMaterial = hasConfiguredWalletMaterial(registry);
 	const enabled = opts.walletEnabled ?? (current?.enabled === false ? false : Boolean(current?.enabled && configuredWalletMaterial));
 	if (!enabled) {
@@ -196,7 +197,7 @@ function applyNonInteractiveWalletConfig(params) {
 	}
 	const existingEnabledProviders = WALLET_PROVIDER_IDS.filter((providerId) => registry.providers[providerId]?.enabled);
 	const defaultProviderFromConfig = parseWalletProviderId(nextConfig.wallet?.provider?.id);
-	const defaultProvider = defaultProviderFromOption ?? (defaultProviderFromConfig === "embedded-keystore" ? "local-socket-signer" : defaultProviderFromConfig) ?? providersFromOption?.[0] ?? "local-socket-signer";
+	const defaultProvider = defaultProviderFromOption ?? defaultProviderFromConfig ?? providersFromOption?.[0] ?? "local-socket-signer";
 	const enabledProviders = providersFromOption ? [...providersFromOption] : existingEnabledProviders.length > 0 ? [...existingEnabledProviders] : [defaultProvider];
 	if (!enabledProviders.includes(defaultProvider)) {
 		enabledProviders.unshift(defaultProvider);
@@ -234,7 +235,7 @@ function applyNonInteractiveWalletConfig(params) {
 	const authMode = current?.auth?.mode === "jwt-bootstrap" || current?.auth?.mode === "static-token-compat" ? current.auth.mode : selfHostEnabled && runtimeSource === "external-docker" ? "jwt-bootstrap" : "static-token-compat";
 	const authBootstrapUrl = current?.auth?.bootstrapUrl?.trim() || undefined;
 	const sourceRef = current?.source?.ref?.trim() || undefined;
-	const directSigning = opts.walletDirectSigning ?? current?.policy?.directSigning ?? managedMode;
+	const directSigning = opts.walletDirectSigning ?? current?.policy?.directSigning ?? false;
 	const toolAccessMode = parseToolAccessMode(opts.walletToolAccessMode) ?? current?.toolAccess?.mode ?? "owner-only";
 	if (!toolAccessMode) {
 		runtime.error("Invalid --wallet-tool-access-mode (use owner-only|allowlist|all).");

package/dist/commands/onboard-non-interactive/local.js

@@ -73,7 +73,11 @@ async function runNonInteractiveOnboardingLocal(params) {
 		return;
 	}
 	if (opts.hostProfile === "hosting" && !hostSecurityCapable && opts.hostMaintenanceSession !== true) {
-		runtime.error(["Hosted non-interactive onboarding requires a root-started installer session.", `Re-run ${formatCliCommand("./install.sh")} from root and select a hosting profile there, or use the explicit hosted installer flags from root.`].join("\n"));
+		runtime.error([
+			"Hosted non-interactive onboarding requires a root-started installer session.",
+			"Start from the provider root console with the exact tagged, attested Hosting command and --release vX.Y.Z.",
+			"Never run the app-owned checkout with sudo or as root."
+		].join("\n"));
 		runtime.exit(1);
 		return;
 	}

package/dist/commands/onboarding/plugin-install.js

@@ -7,7 +7,7 @@ import { loadFasedAgentPlugins } from "../../plugins/loader.js";
 import { createPluginLoaderLogger } from "../../plugins/logger.js";
 import { finalizeInstalledPluginConfig } from "../../plugins/lifecycle.js";
 import { resolveChannelPluginExpectedPluginIds } from "../../channels/plugins/catalog.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/commands/onboarding/plugin-install.ts
@@ -29,7 +29,7 @@ function resolveLocalPath(entry, workspaceDir) {
 		candidates.add(path.resolve(packageRoot, raw));
 	}
 	for (const candidate of candidates) {
-		if (fs.existsSync(candidate)) {
+		if (syncFs.existsSync(candidate)) {
 			return candidate;
 		}
 	}

package/dist/commands/sessions-cleanup.js

@@ -7,7 +7,7 @@ import { capEntryCount, loadSessionStore, pruneStaleEntries, resolveMaintenanceC
 import "../config/sessions.js";
 import { resolveSessionStoreTargets } from "./session-store-targets.js";
 import { SESSION_AGE_PAD, SESSION_KEY_PAD, SESSION_MODEL_PAD, formatSessionAgeCell, formatSessionFlagsCell, formatSessionKeyCell, formatSessionModelCell, resolveSessionDisplayDefaults, resolveSessionDisplayModel, toSessionDisplayRows } from "./sessions-table.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 
 //#region src/commands/sessions-cleanup.ts
 const ACTION_PAD = 12;
@@ -65,7 +65,7 @@ function pruneMissingTranscriptEntries(params) {
 			continue;
 		}
 		const transcriptPath = resolveSessionFilePath(entry.sessionId, entry, sessionPathOpts);
-		if (!fs.existsSync(transcriptPath)) {
+		if (!syncFs.existsSync(transcriptPath)) {
 			delete params.store[key];
 			removed += 1;
 			params.onPruned?.(key);

package/dist/commands/signal-install.js

@@ -5,7 +5,7 @@ import { resolveBrewExecutable } from "../infra/brew.js";
 import { createWriteStream } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import fs$1 from "node:fs/promises";
+import fs from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
 import { request } from "node:https";
 
@@ -79,7 +79,7 @@ async function findSignalCliBinary(root) {
 		if (depth > 3) {
 			return;
 		}
-		const entries = await fs$1.readdir(dir, { withFileTypes: true }).catch(() => []);
+		const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
 		for (const entry of entries) {
 			const full = path.join(dir, entry.name);
 			if (entry.isDirectory()) {
@@ -103,7 +103,7 @@ async function resolveBrewSignalCliPath(brewExe) {
 			const prefix = result.stdout.trim();
 			const candidate = path.join(prefix, "bin", "signal-cli");
 			try {
-				await fs$1.access(candidate);
+				await fs.access(candidate);
 				return candidate;
 			} catch {
 				return findSignalCliBinary(prefix);
@@ -172,12 +172,12 @@ async function installSignalCliFromRelease(runtime) {
 			error: "No compatible release asset found for this platform."
 		};
 	}
-	const tmpDir = await fs$1.mkdtemp(path.join(os.tmpdir(), "fased-signal-"));
+	const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "fased-signal-"));
 	const archivePath = path.join(tmpDir, asset.name);
 	runtime.log(`Downloading signal-cli ${version} (${asset.name})…`);
 	await downloadToFile(asset.browser_download_url, archivePath);
 	const installRoot = path.join(CONFIG_DIR, "tools", "signal-cli", version);
-	await fs$1.mkdir(installRoot, { recursive: true });
+	await fs.mkdir(installRoot, { recursive: true });
 	if (!looksLikeArchive(asset.name.toLowerCase())) {
 		return {
 			ok: false,
@@ -200,7 +200,7 @@ async function installSignalCliFromRelease(runtime) {
 			error: `signal-cli binary not found after extracting ${asset.name}`
 		};
 	}
-	await fs$1.chmod(cliPath, 493).catch(() => {});
+	await fs.chmod(cliPath, 493).catch(() => {});
 	return {
 		ok: true,
 		cliPath,

package/dist/commands/status-all/channels.js

@@ -4,7 +4,7 @@ import { formatTimeAgo } from "../../infra/format-time/format-relative.js";
 import { resolveChannelDefaultAccountId } from "../../channels/plugins/helpers.js";
 import { buildChannelAccountSnapshot, formatChannelAllowFrom } from "../../channels/account-summary.js";
 import "./format.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 
 //#region src/commands/status-all/channels.ts
 const asRecord = (value) => value && typeof value === "object" ? value : {};
@@ -27,7 +27,7 @@ function existsSyncMaybe(p) {
 		return null;
 	}
 	try {
-		return fs.existsSync(path);
+		return syncFs.existsSync(path);
 	} catch {
 		return null;
 	}