@fased/fased 0.1.61 → 0.1.64

package/dist/infra/path-env.js

@@ -1,13 +1,13 @@
 import { isTruthyEnvValue } from "./env.js";
 import { resolveBrewPathDirs } from "./brew.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
 //#region src/infra/path-env.ts
 function isExecutable(filePath) {
 	try {
-		fs.accessSync(filePath, fs.constants.X_OK);
+		syncFs.accessSync(filePath, syncFs.constants.X_OK);
 		return true;
 	} catch {
 		return false;
@@ -15,7 +15,7 @@ function isExecutable(filePath) {
 }
 function isDirectory(dirPath) {
 	try {
-		return fs.statSync(dirPath).isDirectory();
+		return syncFs.statSync(dirPath).isDirectory();
 	} catch {
 		return false;
 	}

package/dist/infra/ports-lsof.js

@@ -1,11 +1,11 @@
-import fs from "node:fs";
-import fs$1 from "node:fs/promises";
+import syncFs from "node:fs";
+import fs from "node:fs/promises";
 
 //#region src/infra/ports-lsof.ts
 const LSOF_CANDIDATES = process.platform === "darwin" ? ["/usr/sbin/lsof", "/usr/bin/lsof"] : ["/usr/bin/lsof", "/usr/sbin/lsof"];
 async function canExecute(path) {
 	try {
-		await fs$1.access(path, fs.constants.X_OK);
+		await fs.access(path, syncFs.constants.X_OK);
 		return true;
 	} catch {
 		return false;
@@ -22,7 +22,7 @@ async function resolveLsofCommand() {
 function resolveLsofCommandSync() {
 	for (const candidate of LSOF_CANDIDATES) {
 		try {
-			fs.accessSync(candidate, fs.constants.X_OK);
+			syncFs.accessSync(candidate, syncFs.constants.X_OK);
 			return candidate;
 		} catch {}
 	}

package/dist/infra/provider-usage.auth.js

@@ -9,7 +9,7 @@ import { resolveAuthProfileOrder } from "../agents/auth-profiles/order.js";
 import "../agents/auth-profiles.js";
 import { getCustomProviderApiKey } from "../agents/model-auth.js";
 import { normalizeProviderId } from "../agents/model-selection.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -43,10 +43,10 @@ function resolveZaiApiKey() {
 	}
 	try {
 		const authPath = path.join(resolveRequiredHomeDir(process.env, os.homedir), ".pi", "agent", "auth.json");
-		if (!fs.existsSync(authPath)) {
+		if (!syncFs.existsSync(authPath)) {
 			return undefined;
 		}
-		const data = JSON.parse(fs.readFileSync(authPath, "utf-8"));
+		const data = JSON.parse(syncFs.readFileSync(authPath, "utf-8"));
 		return data["z-ai"]?.access || data.zai?.access;
 	} catch {
 		return undefined;

package/dist/infra/restart.js

@@ -151,44 +151,75 @@ function deferGatewayRestartUntilIdle(opts) {
 	const pollMs = Math.max(10, Math.floor(pollMsRaw));
 	const maxWaitMsRaw = opts.maxWaitMs ?? DEFAULT_DEFERRAL_MAX_WAIT_MS;
 	const maxWaitMs = Math.max(pollMs, Math.floor(maxWaitMsRaw));
-	let pending;
+	let pendingPoll = null;
+	let pending = false;
+	const handle = {
+		cancel: () => {
+			if (!pending || !pendingPoll) {
+				return false;
+			}
+			clearInterval(pendingPoll);
+			pendingPoll = null;
+			pending = false;
+			return true;
+		},
+		isPending: () => pending
+	};
+	let pendingCount;
 	try {
-		pending = opts.getPendingCount();
+		pendingCount = opts.getPendingCount();
 	} catch (err) {
 		opts.hooks?.onCheckError?.(err);
 		emitGatewayRestart();
-		return;
+		return handle;
 	}
-	if (pending <= 0) {
+	if (pendingCount <= 0) {
 		opts.hooks?.onReady?.();
 		emitGatewayRestart();
-		return;
+		return handle;
 	}
-	opts.hooks?.onDeferring?.(pending);
+	opts.hooks?.onDeferring?.(pendingCount);
 	const startedAt = Date.now();
-	const poll = setInterval(() => {
+	pending = true;
+	pendingPoll = setInterval(() => {
 		let current;
 		try {
 			current = opts.getPendingCount();
 		} catch (err) {
-			clearInterval(poll);
+			if (!pending) {
+				return;
+			}
+			pending = false;
+			if (pendingPoll) {
+				clearInterval(pendingPoll);
+				pendingPoll = null;
+			}
 			opts.hooks?.onCheckError?.(err);
 			emitGatewayRestart();
 			return;
 		}
 		if (current <= 0) {
-			clearInterval(poll);
+			pending = false;
+			if (pendingPoll) {
+				clearInterval(pendingPoll);
+				pendingPoll = null;
+			}
 			opts.hooks?.onReady?.();
 			emitGatewayRestart();
 			return;
 		}
 		const elapsedMs = Date.now() - startedAt;
 		if (elapsedMs >= maxWaitMs) {
-			clearInterval(poll);
+			pending = false;
+			if (pendingPoll) {
+				clearInterval(pendingPoll);
+				pendingPoll = null;
+			}
 			opts.hooks?.onTimeout?.(current, elapsedMs);
 			emitGatewayRestart();
 		}
 	}, pollMs);
+	return handle;
 }
 function formatSpawnDetail(result) {
 	const clean = (value) => {

package/dist/infra/safe-open-sync.js

@@ -1,5 +1,5 @@
 import { sameFileIdentity as sameFileIdentity$1 } from "./file-identity.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 
 //#region src/infra/safe-open-sync.ts
 function isExpectedPathError(error) {
@@ -10,7 +10,7 @@ function sameFileIdentity(left, right) {
 	return sameFileIdentity$1(left, right);
 }
 function openVerifiedFileSync(params) {
-	const ioFs = params.ioFs ?? fs;
+	const ioFs = params.ioFs ?? syncFs;
 	const openReadFlags = ioFs.constants.O_RDONLY | (typeof ioFs.constants.O_NOFOLLOW === "number" ? ioFs.constants.O_NOFOLLOW : 0);
 	let fd = null;
 	try {

package/dist/infra/session-cost-usage.js

@@ -4,7 +4,7 @@ import { stripInboundMetadata } from "../auto-reply/reply/strip-inbound-meta.js"
 import { stripEnvelope, stripMessageIdHints } from "../shared/chat-envelope.js";
 import { normalizeUsage } from "../agents/usage.js";
 import { estimateUsageCost, resolveModelCostConfig } from "../utils/usage-format.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import readline from "node:readline";
 
@@ -145,7 +145,7 @@ const applyCostTotal = (totals, costTotal) => {
 	totals.totalCost += costTotal;
 };
 async function* readJsonlRecords(filePath) {
-	const fileStream = fs.createReadStream(filePath, { encoding: "utf-8" });
+	const fileStream = syncFs.createReadStream(filePath, { encoding: "utf-8" });
 	const rl = readline.createInterface({
 		input: fileStream,
 		crlfDelay: Infinity
@@ -225,10 +225,10 @@ async function loadCostUsageSummary(params) {
 	const dailyMap = new Map();
 	const totals = emptyTotals();
 	const sessionsDir = resolveSessionTranscriptsDirForAgent(params?.agentId);
-	const entries = await fs.promises.readdir(sessionsDir, { withFileTypes: true }).catch(() => []);
+	const entries = await syncFs.promises.readdir(sessionsDir, { withFileTypes: true }).catch(() => []);
 	const files = (await Promise.all(entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map(async (entry) => {
 		const filePath = path.join(sessionsDir, entry.name);
-		const stats = await fs.promises.stat(filePath).catch(() => null);
+		const stats = await syncFs.promises.stat(filePath).catch(() => null);
 		if (!stats) {
 			return null;
 		}
@@ -279,14 +279,14 @@ async function loadCostUsageSummary(params) {
 */
 async function discoverAllSessions(params) {
 	const sessionsDir = resolveSessionTranscriptsDirForAgent(params?.agentId);
-	const entries = await fs.promises.readdir(sessionsDir, { withFileTypes: true }).catch(() => []);
+	const entries = await syncFs.promises.readdir(sessionsDir, { withFileTypes: true }).catch(() => []);
 	const discovered = [];
 	for (const entry of entries) {
 		if (!entry.isFile() || !entry.name.endsWith(".jsonl")) {
 			continue;
 		}
 		const filePath = path.join(sessionsDir, entry.name);
-		const stats = await fs.promises.stat(filePath).catch(() => null);
+		const stats = await syncFs.promises.stat(filePath).catch(() => null);
 		if (!stats) {
 			continue;
 		}
@@ -330,7 +330,7 @@ async function discoverAllSessions(params) {
 }
 async function loadSessionCostSummary(params) {
 	const sessionFile = params.sessionFile ?? (params.sessionId ? resolveSessionFilePath(params.sessionId, params.sessionEntry, { agentId: params.agentId }) : undefined);
-	if (!sessionFile || !fs.existsSync(sessionFile)) {
+	if (!sessionFile || !syncFs.existsSync(sessionFile)) {
 		return null;
 	}
 	const totals = emptyTotals();
@@ -547,7 +547,7 @@ async function loadSessionCostSummary(params) {
 }
 async function loadSessionUsageTimeSeries(params) {
 	const sessionFile = params.sessionFile ?? (params.sessionId ? resolveSessionFilePath(params.sessionId, params.sessionEntry, { agentId: params.agentId }) : undefined);
-	if (!sessionFile || !fs.existsSync(sessionFile)) {
+	if (!sessionFile || !syncFs.existsSync(sessionFile)) {
 		return null;
 	}
 	const points = [];
@@ -635,7 +635,7 @@ async function loadSessionUsageTimeSeries(params) {
 }
 async function loadSessionLogs(params) {
 	const sessionFile = params.sessionFile ?? (params.sessionId ? resolveSessionFilePath(params.sessionId, params.sessionEntry, { agentId: params.agentId }) : undefined);
-	if (!sessionFile || !fs.existsSync(sessionFile)) {
+	if (!sessionFile || !syncFs.existsSync(sessionFile)) {
 		return null;
 	}
 	const logs = [];

package/dist/infra/shell-env.js

@@ -1,6 +1,6 @@
 import { sanitizeHostExecEnv } from "./host-env-security.js";
 import { isTruthyEnvValue } from "./env.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
@@ -34,7 +34,7 @@ function readEtcShells() {
 		return cachedEtcShells;
 	}
 	try {
-		const raw = fs.readFileSync("/etc/shells", "utf8");
+		const raw = syncFs.readFileSync("/etc/shells", "utf8");
 		const entries = raw.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && path.isAbsolute(line));
 		cachedEtcShells = new Set(entries);
 	} catch {

package/dist/infra/state-migrations.fs.js

@@ -1,27 +1,27 @@
-import fs from "node:fs";
+import syncFs from "node:fs";
 import JSON5 from "json5";
 
 //#region src/infra/state-migrations.fs.ts
 function safeReadDir(dir) {
 	try {
-		return fs.readdirSync(dir, { withFileTypes: true });
+		return syncFs.readdirSync(dir, { withFileTypes: true });
 	} catch {
 		return [];
 	}
 }
 function existsDir(dir) {
 	try {
-		return fs.existsSync(dir) && fs.statSync(dir).isDirectory();
+		return syncFs.existsSync(dir) && syncFs.statSync(dir).isDirectory();
 	} catch {
 		return false;
 	}
 }
 function ensureDir(dir) {
-	fs.mkdirSync(dir, { recursive: true });
+	syncFs.mkdirSync(dir, { recursive: true });
 }
 function fileExists(p) {
 	try {
-		return fs.existsSync(p) && fs.statSync(p).isFile();
+		return syncFs.existsSync(p) && syncFs.statSync(p).isFile();
 	} catch {
 		return false;
 	}
@@ -37,7 +37,7 @@ function isLegacyWhatsAppAuthFile(name) {
 }
 function readSessionStoreJson5(storePath) {
 	try {
-		const raw = fs.readFileSync(storePath, "utf-8");
+		const raw = syncFs.readFileSync(storePath, "utf-8");
 		const parsed = JSON5.parse(raw);
 		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
 			return {

package/dist/infra/state-migrations.js

@@ -8,7 +8,7 @@ import { canonicalizeMainSessionAlias } from "../config/sessions/main-session.js
 import { saveSessionStore } from "../config/sessions/store.js";
 import "../config/sessions.js";
 import { ensureDir, existsDir, fileExists, isLegacyWhatsAppAuthFile, readSessionStoreJson5, safeReadDir } from "./state-migrations.fs.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -241,7 +241,7 @@ function removeDirIfEmpty(dir) {
 		return;
 	}
 	try {
-		fs.rmdirSync(dir);
+		syncFs.rmdirSync(dir);
 	} catch {}
 }
 function resetAutoMigrateLegacyStateForTest() {
@@ -255,7 +255,7 @@ function resetAutoMigrateLegacyStateDirForTest() {
 }
 function resolveSymlinkTarget(linkPath) {
 	try {
-		const target = fs.readlinkSync(linkPath);
+		const target = syncFs.readlinkSync(linkPath);
 		return path.resolve(path.dirname(linkPath), target);
 	} catch {
 		return null;
@@ -266,7 +266,7 @@ function formatStateDirMigration(legacyDir, targetDir) {
 }
 function isDirPath(filePath) {
 	try {
-		return fs.statSync(filePath).isDirectory();
+		return syncFs.statSync(filePath).isDirectory();
 	} catch {
 		return false;
 	}
@@ -274,7 +274,7 @@ function isDirPath(filePath) {
 function isLegacyTreeSymlinkMirror(currentDir, realTargetDir) {
 	let entries;
 	try {
-		entries = fs.readdirSync(currentDir, { withFileTypes: true });
+		entries = syncFs.readdirSync(currentDir, { withFileTypes: true });
 	} catch {
 		return false;
 	}
@@ -285,7 +285,7 @@ function isLegacyTreeSymlinkMirror(currentDir, realTargetDir) {
 		const entryPath = path.join(currentDir, entry.name);
 		let stat;
 		try {
-			stat = fs.lstatSync(entryPath);
+			stat = syncFs.lstatSync(entryPath);
 		} catch {
 			return false;
 		}
@@ -296,7 +296,7 @@ function isLegacyTreeSymlinkMirror(currentDir, realTargetDir) {
 			}
 			let resolvedRealTarget;
 			try {
-				resolvedRealTarget = fs.realpathSync(resolvedTarget);
+				resolvedRealTarget = syncFs.realpathSync(resolvedTarget);
 			} catch {
 				return false;
 			}
@@ -318,7 +318,7 @@ function isLegacyTreeSymlinkMirror(currentDir, realTargetDir) {
 function isLegacyDirSymlinkMirror(legacyDir, targetDir) {
 	let realTargetDir;
 	try {
-		realTargetDir = fs.realpathSync(targetDir);
+		realTargetDir = syncFs.realpathSync(targetDir);
 	} catch {
 		return false;
 	}
@@ -348,7 +348,7 @@ async function autoMigrateLegacyStateDir(params) {
 	const legacyDirs = resolveLegacyStateDirs(homedir);
 	let legacyDir = legacyDirs.find((dir) => {
 		try {
-			return fs.existsSync(dir);
+			return syncFs.existsSync(dir);
 		} catch {
 			return false;
 		}
@@ -357,7 +357,7 @@ async function autoMigrateLegacyStateDir(params) {
 	const changes = [];
 	let legacyStat = null;
 	try {
-		legacyStat = legacyDir ? fs.lstatSync(legacyDir) : null;
+		legacyStat = legacyDir ? syncFs.lstatSync(legacyDir) : null;
 	} catch {
 		legacyStat = null;
 	}
@@ -401,7 +401,7 @@ async function autoMigrateLegacyStateDir(params) {
 		if (legacyDirs.some((dir) => path.resolve(dir) === path.resolve(legacyTarget))) {
 			legacyDir = legacyTarget;
 			try {
-				legacyStat = fs.lstatSync(legacyDir);
+				legacyStat = syncFs.lstatSync(legacyDir);
 			} catch {
 				legacyStat = null;
 			}
@@ -464,7 +464,7 @@ async function autoMigrateLegacyStateDir(params) {
 		if (!legacyDir) {
 			throw new Error("Legacy state dir not found");
 		}
-		fs.renameSync(legacyDir, targetDir);
+		syncFs.renameSync(legacyDir, targetDir);
 	} catch (err) {
 		warnings.push(`Failed to move legacy state dir (${legacyDir ?? "unknown"} → ${targetDir}): ${String(err)}`);
 		return {
@@ -478,7 +478,7 @@ async function autoMigrateLegacyStateDir(params) {
 		if (!legacyDir) {
 			throw new Error("Legacy state dir not found");
 		}
-		fs.symlinkSync(targetDir, legacyDir, "dir");
+		syncFs.symlinkSync(targetDir, legacyDir, "dir");
 		changes.push(formatStateDirMigration(legacyDir, targetDir));
 	} catch (err) {
 		try {
@@ -486,7 +486,7 @@ async function autoMigrateLegacyStateDir(params) {
 				if (!legacyDir) {
 					throw new Error("Legacy state dir not found", { cause: err });
 				}
-				fs.symlinkSync(targetDir, legacyDir, "junction");
+				syncFs.symlinkSync(targetDir, legacyDir, "junction");
 				changes.push(formatStateDirMigration(legacyDir, targetDir));
 			} else {
 				throw err;
@@ -496,7 +496,7 @@ async function autoMigrateLegacyStateDir(params) {
 				if (!legacyDir) {
 					throw new Error("Legacy state dir not found", { cause: fallbackErr });
 				}
-				fs.renameSync(targetDir, legacyDir);
+				syncFs.renameSync(targetDir, legacyDir);
 				warnings.push(`State dir migration rolled back (failed to link legacy path): ${String(fallbackErr)}`);
 				return {
 					migrated: false,
@@ -682,7 +682,7 @@ async function migrateLegacySessions(detected, now) {
 			continue;
 		}
 		try {
-			fs.renameSync(from, to);
+			syncFs.renameSync(from, to);
 			changes.push(`Moved ${entry.name} → agents/${detected.targetAgentId}/sessions`);
 		} catch (err) {
 			warnings.push(`Failed moving ${from}: ${String(err)}`);
@@ -691,7 +691,7 @@ async function migrateLegacySessions(detected, now) {
 	if (legacyParsed.ok) {
 		try {
 			if (fileExists(detected.sessions.legacyStorePath)) {
-				fs.rmSync(detected.sessions.legacyStorePath, { force: true });
+				syncFs.rmSync(detected.sessions.legacyStorePath, { force: true });
 			}
 		} catch {}
 	}
@@ -700,7 +700,7 @@ async function migrateLegacySessions(detected, now) {
 	if (legacyLeft.length > 0) {
 		const backupDir = `${detected.sessions.legacyDir}.legacy-${now()}`;
 		try {
-			fs.renameSync(detected.sessions.legacyDir, backupDir);
+			syncFs.renameSync(detected.sessions.legacyDir, backupDir);
 			warnings.push(`Left legacy sessions at ${backupDir}`);
 		} catch {}
 	}
@@ -723,11 +723,11 @@ async function migrateLegacyAgentDir(detected, now) {
 	for (const entry of entries) {
 		const from = path.join(detected.agentDir.legacyDir, entry.name);
 		const to = path.join(detected.agentDir.targetDir, entry.name);
-		if (fs.existsSync(to)) {
+		if (syncFs.existsSync(to)) {
 			continue;
 		}
 		try {
-			fs.renameSync(from, to);
+			syncFs.renameSync(from, to);
 			changes.push(`Moved agent file ${entry.name} → agents/${detected.targetAgentId}/agent`);
 		} catch (err) {
 			warnings.push(`Failed moving ${from}: ${String(err)}`);
@@ -737,7 +737,7 @@ async function migrateLegacyAgentDir(detected, now) {
 	if (!emptyDirOrMissing(detected.agentDir.legacyDir)) {
 		const backupDir = path.join(detected.stateDir, "agents", detected.targetAgentId, `agent.legacy-${now()}`);
 		try {
-			fs.renameSync(detected.agentDir.legacyDir, backupDir);
+			syncFs.renameSync(detected.agentDir.legacyDir, backupDir);
 			warnings.push(`Left legacy agent dir at ${backupDir}`);
 		} catch (err) {
 			warnings.push(`Failed relocating legacy agent dir: ${String(err)}`);
@@ -775,7 +775,7 @@ async function migrateLegacyWhatsAppAuth(detected) {
 			continue;
 		}
 		try {
-			fs.renameSync(from, to);
+			syncFs.renameSync(from, to);
 			changes.push(`Moved WhatsApp auth ${entry.name} → whatsapp/default`);
 		} catch (err) {
 			warnings.push(`Failed moving ${from}: ${String(err)}`);
@@ -799,7 +799,7 @@ async function migrateLegacyTelegramPairingAllowFrom(detected) {
 	const targetPath = detected.pairingAllowFrom.targetTelegramPath;
 	try {
 		ensureDir(path.dirname(targetPath));
-		fs.copyFileSync(legacyPath, targetPath);
+		syncFs.copyFileSync(legacyPath, targetPath);
 		changes.push(`Copied Telegram pairing allowFrom → ${targetPath}`);
 	} catch (err) {
 		warnings.push(`Failed migrating Telegram pairing allowFrom (${legacyPath}): ${String(err)}`);

package/dist/infra/tmp-fased-dir.js

@@ -1,18 +1,18 @@
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
 //#region src/infra/tmp-fased-dir.ts
 const POSIX_FASED_TMP_DIR = "/tmp/fased";
-const TMP_DIR_ACCESS_MODE = fs.constants.W_OK | fs.constants.X_OK;
+const TMP_DIR_ACCESS_MODE = syncFs.constants.W_OK | syncFs.constants.X_OK;
 function isNodeErrorWithCode(err, code) {
 	return typeof err === "object" && err !== null && "code" in err && err.code === code;
 }
 function resolvePreferredFasedAgentTmpDir(options = {}) {
-	const accessSync = options.accessSync ?? fs.accessSync;
-	const chmodSync = options.chmodSync ?? fs.chmodSync;
-	const lstatSync = options.lstatSync ?? fs.lstatSync;
-	const mkdirSync = options.mkdirSync ?? fs.mkdirSync;
+	const accessSync = options.accessSync ?? syncFs.accessSync;
+	const chmodSync = options.chmodSync ?? syncFs.chmodSync;
+	const lstatSync = options.lstatSync ?? syncFs.lstatSync;
+	const mkdirSync = options.mkdirSync ?? syncFs.mkdirSync;
 	const warn = options.warn ?? ((message) => console.warn(message));
 	const getuid = options.getuid ?? (() => {
 		try {

package/dist/infra/update-runner.js

@@ -47,6 +47,78 @@ const DEFAULT_PACKAGE_NAME = "@fased/fased";
 const LEGACY_PACKAGE_NAME = "fased";
 const CORE_PACKAGE_NAMES = new Set([LEGACY_PACKAGE_NAME, DEFAULT_PACKAGE_NAME]);
 const DEV_PREFLIGHT_LINT_OPT_IN_ENV = "FASED_UPDATE_PREFLIGHT_LINT";
+const SOURCE_RELEASE_REPOSITORY = "fased-ai/fased";
+const SOURCE_RELEASE_WORKFLOW = "fased-ai/fased/.github/workflows/hosted-runtime-release.yml";
+async function verifyAttestedSourceRelease(params) {
+	const startedAt = Date.now();
+	const version = params.tag.replace(/^v/u, "");
+	const command = `verify attested source ${params.tag} at ${params.tagCommit}`;
+	const cwd = process.cwd();
+	const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "fased-source-attestation-"));
+	try {
+		const base = (params.baseUrl?.trim().replace(/\/+$/u, "") || "https://github.com/fased-ai/fased/releases/download") + `/${params.tag}`;
+		const manifestPath = path.join(tempRoot, "fased-hosted-release-v2.json");
+		const bundlePath = `${manifestPath}.attestation.json`;
+		for (const [name, destination] of [["fased-hosted-release-v2.json", manifestPath], ["fased-hosted-release-v2.json.attestation.json", bundlePath]]) {
+			const response = await params.fetchImpl(`${base}/${name}`, { redirect: "follow" });
+			if (!response.ok) {
+				throw new Error(`release identity asset ${name} is unavailable (${response.status})`);
+			}
+			await fs.writeFile(destination, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+		}
+		const verification = await params.runCommand([
+			"gh",
+			"attestation",
+			"verify",
+			manifestPath,
+			"--repo",
+			SOURCE_RELEASE_REPOSITORY,
+			"--bundle",
+			bundlePath,
+			"--signer-workflow",
+			SOURCE_RELEASE_WORKFLOW,
+			"--source-ref",
+			`refs/tags/${params.tag}`,
+			"--deny-self-hosted-runners"
+		], {
+			cwd: tempRoot,
+			timeoutMs: params.timeoutMs,
+			env: {
+				...process.env,
+				GH_PROMPT_DISABLED: "1"
+			}
+		});
+		if (verification.code !== 0) {
+			throw new Error(verification.stderr.trim() || "GitHub attestation verification failed");
+		}
+		const manifest = JSON.parse(await fs.readFile(manifestPath, "utf8"));
+		if (manifest.schemaVersion !== 2 || manifest.release?.version !== version || manifest.release?.tag !== params.tag || manifest.release?.commit !== params.tagCommit || !/^[a-f0-9]{40}$/u.test(String(manifest.release?.commit ?? "")) || manifest.signer?.release?.version !== version || manifest.signer?.release?.commit !== params.tagCommit || manifest.signer?.release?.development !== false) {
+			throw new Error("attested release does not bind the exact source tag, commit, and signer");
+		}
+		return {
+			name: "source release attestation",
+			command,
+			cwd,
+			durationMs: Date.now() - startedAt,
+			exitCode: 0,
+			stdoutTail: `${params.tag} -> ${params.tagCommit}`
+		};
+	} catch (error) {
+		return {
+			name: "source release attestation",
+			command,
+			cwd,
+			durationMs: Date.now() - startedAt,
+			exitCode: 1,
+			stderrTail: String(error)
+		};
+	} finally {
+		await fs.rm(tempRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+}
 function normalizeDir(value) {
 	if (!value) {
 		return null;
@@ -1472,6 +1544,30 @@ async function runGatewayUpdate(opts = {}) {
 					durationMs: Date.now() - startedAt
 				};
 			}
+			const tagCommitStep = await runStep(step(`git rev-parse ${tag}^{commit}`, [
+				"git",
+				"-C",
+				gitRoot,
+				"rev-parse",
+				`${tag}^{commit}`
+			], gitRoot));
+			steps.push(tagCommitStep);
+			const tagCommit = tagCommitStep.stdoutTail?.trim() ?? "";
+			if (tagCommitStep.exitCode !== 0 || !/^[a-f0-9]{40}$/u.test(tagCommit)) {
+				return buildGitErrorResult("release-tag-identity-failed");
+			}
+			const attestationStep = await verifyAttestedSourceRelease({
+				tag,
+				tagCommit,
+				timeoutMs,
+				runCommand,
+				fetchImpl: opts.hostedReleaseFetch ?? fetch,
+				baseUrl: opts.hostedReleaseBaseUrl
+			});
+			steps.push(attestationStep);
+			if (attestationStep.exitCode !== 0) {
+				return buildGitErrorResult("source-release-attestation-failed");
+			}
 			const failure = await runGitCheckoutOrFail(`git checkout ${tag}`, [
 				"git",
 				"-C",

package/dist/infra/widearea-dns.js

@@ -1,5 +1,5 @@
 import { CONFIG_DIR, ensureDir } from "../utils.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -126,7 +126,7 @@ async function writeWideAreaGatewayZone(opts) {
 	await ensureDir(path.dirname(zonePath));
 	const existing = (() => {
 		try {
-			return fs.readFileSync(zonePath, "utf-8");
+			return syncFs.readFileSync(zonePath, "utf-8");
 		} catch {
 			return null;
 		}
@@ -149,7 +149,7 @@ async function writeWideAreaGatewayZone(opts) {
 		...opts,
 		serial
 	});
-	fs.writeFileSync(zonePath, next, "utf-8");
+	syncFs.writeFileSync(zonePath, next, "utf-8");
 	return {
 		zonePath,
 		changed: true