@fased/fased 0.1.61 → 0.1.64

package/dist/wallet/wallet-status.js

@@ -6,7 +6,6 @@ import { resolveWalletPolicyConfig } from "./wallet-policy.js";
 import { redactWalletDiagnosticText, walletDiagnosticErrorMessage, walletDiagnosticErrorString } from "./wallet-redaction.js";
 import { createWalletProviderAdapter, resolveWalletProviderId } from "./wallet-provider-resolver.js";
 import { readWalletApprovalAuthSnapshot } from "./wallet-approval-auth.js";
-import { readWalletCustodyStatus } from "./wallet-custody.js";
 
 //#region src/wallet/wallet-status.ts
 async function readWalletStatusSnapshot(params) {
@@ -27,13 +26,6 @@ async function readWalletStatusSnapshot(params) {
 	const statePaths = resolveWalletStatePaths(effectiveEnv);
 	const approvalAuth = readWalletApprovalAuthSnapshot(effectiveEnv, cfg);
 	const checkedAt = new Date().toISOString();
-	const custody = readWalletCustodyStatus({
-		wallet: resolved,
-		env: effectiveEnv,
-		cfg,
-		walletId: params?.walletId,
-		approvalHost: params?.approvalHost
-	});
 	let providerHealth = {
 		ok: false,
 		details: "provider health probe unavailable"
@@ -98,7 +90,6 @@ async function readWalletStatusSnapshot(params) {
 			}
 		},
 		approvalAuth,
-		custody,
 		addresses,
 		paths: {
 			rootDir: paths.rootDir,

package/dist/wallet/wallet-task-ledger.js

@@ -39,7 +39,9 @@ function normalizeAgentIdFromRequester(requestedBy) {
 function approvalStatusToTaskStatus(request) {
 	switch (request.status) {
 		case "pending": return "blocked";
+		case "executing":
 		case "approved": return "running";
+		case "unknown": return "blocked";
 		case "executed": return "succeeded";
 		case "failed": return "failed";
 		case "rejected": return "cancelled";
@@ -50,7 +52,9 @@ function approvalStatusToTaskStatus(request) {
 function approvalStatusToSummary(request) {
 	switch (request.status) {
 		case "pending": return { progressSummary: "Waiting for wallet approval." };
+		case "executing": return { progressSummary: "Wallet approval claimed; execution is in progress." };
 		case "approved": return { progressSummary: "Wallet approval accepted; broadcast is in progress." };
+		case "unknown": return { progressSummary: request.reason ?? "Wallet execution is unknown; reconcile it before any retry." };
 		case "executed": return { terminalSummary: request.result?.txHash ? `Wallet action executed: ${request.result.txHash}` : "Wallet action executed." };
 		case "failed": return {
 			terminalSummary: request.reason ?? request.result?.error ?? "Wallet action failed.",
@@ -62,6 +66,9 @@ function approvalStatusToSummary(request) {
 	}
 }
 function policyStepStatus(request) {
+	if (request.payload.actionKind === "signer_review" && request.payload.signerPolicyHash) {
+		return "succeeded";
+	}
 	if (!request.simulation) {
 		return "queued";
 	}
@@ -70,7 +77,9 @@ function policyStepStatus(request) {
 function approvalStepStatus(request) {
 	switch (request.status) {
 		case "pending": return "blocked";
+		case "executing":
 		case "approved":
+		case "unknown":
 		case "executed": return "succeeded";
 		case "rejected": return "cancelled";
 		case "expired": return "lost";
@@ -81,7 +90,9 @@ function approvalStepStatus(request) {
 function broadcastStepStatus(request) {
 	switch (request.status) {
 		case "pending": return "queued";
+		case "executing":
 		case "approved": return "running";
+		case "unknown": return "blocked";
 		case "executed": return "succeeded";
 		case "failed": return request.simulation && !request.simulation.ok ? "skipped" : "failed";
 		case "rejected":
@@ -94,7 +105,7 @@ function buildApprovalSteps(request) {
 	return [
 		{
 			id: "policy",
-			label: "Policy simulation",
+			label: request.payload.actionKind === "signer_review" ? "Signer policy binding" : "Policy simulation",
 			status: policyStepStatus(request),
 			updatedAt: request.simulation ? parseTime(request.createdAt) : undefined,
 			error: request.simulation?.checks.find((check) => check.status === "fail")?.detail
@@ -108,7 +119,7 @@ function buildApprovalSteps(request) {
 		},
 		{
 			id: "broadcast",
-			label: "Broadcast transaction",
+			label: request.payload.signerArtifactKind === "domain-separated-message" ? "Complete reviewed signature" : "Broadcast transaction",
 			status: broadcastStepStatus(request),
 			updatedAt: request.status === "executed" || request.status === "failed" ? decisionAt : undefined,
 			error: request.status === "failed" ? request.result?.error ?? request.reason : undefined
@@ -116,6 +127,9 @@ function buildApprovalSteps(request) {
 	];
 }
 function formatApprovalTaskTitle(request) {
+	if (request.payload.actionKind === "signer_review" && request.payload.memo?.trim()) {
+		return `Wallet approval: ${request.payload.memo.trim()}`;
+	}
 	const diff = request.approvalDiff ?? request.simulation?.diff;
 	const amount = diff?.amountDisplay || request.payload.amountDisplay || diff?.amount || request.payload.amount || "amount";
 	const token = diff?.token || request.payload.assetSymbol || request.payload.inputSymbol || request.payload.outputSymbol || diff?.mint || request.payload.program || request.payload.contract || request.payload.chain;

package/dist/web/accounts.js

@@ -5,7 +5,7 @@ import "../routing/session-key.js";
 import { resolveAccountEntry } from "../routing/account-lookup.js";
 import { createAccountListHelpers } from "../channels/plugins/account-helpers.js";
 import { hasWebCredsSync } from "./auth-store.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/web/accounts.ts
@@ -24,7 +24,7 @@ function listWhatsAppAuthDirs(cfg) {
 		}).authDir);
 	}
 	try {
-		const entries = fs.readdirSync(whatsappDir, { withFileTypes: true });
+		const entries = syncFs.readdirSync(whatsappDir, { withFileTypes: true });
 		for (const entry of entries) {
 			if (!entry.isDirectory()) {
 				continue;
@@ -48,7 +48,7 @@ function resolveLegacyAuthDir() {
 }
 function legacyAuthExists(authDir) {
 	try {
-		return fs.existsSync(path.join(authDir, "creds.json"));
+		return syncFs.existsSync(path.join(authDir, "creds.json"));
 	} catch {
 		return false;
 	}

package/dist/web/auth-store.js

@@ -4,10 +4,10 @@ import { info, success } from "../globals.js";
 import { defaultRuntime } from "../runtime.js";
 import { formatCliCommand } from "../cli/command-format.js";
 import "../logging.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import fs$1 from "node:fs/promises";
+import fs from "node:fs/promises";
 
 //#region src/web/auth-store.ts
 const DEFAULT_WEB_AUTH_ACCOUNT_ID = "default";
@@ -65,7 +65,7 @@ function readAuthStoreLidReverseMapping(lid, opts) {
 	for (const dir of dirs) {
 		const mappingPath = path.join(dir, mappingFilename);
 		try {
-			const data = fs.readFileSync(mappingPath, "utf8");
+			const data = syncFs.readFileSync(mappingPath, "utf8");
 			const phone = JSON.parse(data);
 			if (phone !== null && phone !== undefined) {
 				return normalizeAuthStoreE164(String(phone));
@@ -97,7 +97,7 @@ function resolveWebCredsBackupPath(authDir) {
 }
 function hasWebCredsSync(authDir) {
 	try {
-		const stats = fs.statSync(resolveWebCredsPath(authDir));
+		const stats = syncFs.statSync(resolveWebCredsPath(authDir));
 		return stats.isFile() && stats.size > 1;
 	} catch {
 		return false;
@@ -105,14 +105,14 @@ function hasWebCredsSync(authDir) {
 }
 function readCredsJsonRaw(filePath) {
 	try {
-		if (!fs.existsSync(filePath)) {
+		if (!syncFs.existsSync(filePath)) {
 			return null;
 		}
-		const stats = fs.statSync(filePath);
+		const stats = syncFs.statSync(filePath);
 		if (!stats.isFile() || stats.size <= 1) {
 			return null;
 		}
-		return fs.readFileSync(filePath, "utf-8");
+		return syncFs.readFileSync(filePath, "utf-8");
 	} catch {
 		return null;
 	}
@@ -132,9 +132,9 @@ function maybeRestoreCredsFromBackup(authDir) {
 			return;
 		}
 		JSON.parse(backupRaw);
-		fs.copyFileSync(backupPath, credsPath);
+		syncFs.copyFileSync(backupPath, credsPath);
 		try {
-			fs.chmodSync(credsPath, 384);
+			syncFs.chmodSync(credsPath, 384);
 		} catch {}
 		logger.warn({ credsPath }, "restored corrupted WhatsApp creds.json from backup");
 	} catch {}
@@ -144,16 +144,16 @@ async function webAuthExists(authDir = resolveDefaultWebAuthDir()) {
 	maybeRestoreCredsFromBackup(resolvedAuthDir);
 	const credsPath = resolveWebCredsPath(resolvedAuthDir);
 	try {
-		await fs$1.access(resolvedAuthDir);
+		await fs.access(resolvedAuthDir);
 	} catch {
 		return false;
 	}
 	try {
-		const stats = await fs$1.stat(credsPath);
+		const stats = await fs.stat(credsPath);
 		if (!stats.isFile() || stats.size <= 1) {
 			return false;
 		}
-		const raw = await fs$1.readFile(credsPath, "utf-8");
+		const raw = await fs.readFile(credsPath, "utf-8");
 		JSON.parse(raw);
 		return true;
 	} catch {
@@ -161,7 +161,7 @@ async function webAuthExists(authDir = resolveDefaultWebAuthDir()) {
 	}
 }
 async function clearLegacyBaileysAuthState(authDir) {
-	const entries = await fs$1.readdir(authDir, { withFileTypes: true });
+	const entries = await fs.readdir(authDir, { withFileTypes: true });
 	const shouldDelete = (name) => {
 		if (name === "oauth.json") {
 			return false;
@@ -181,7 +181,7 @@ async function clearLegacyBaileysAuthState(authDir) {
 		if (!shouldDelete(entry.name)) {
 			return;
 		}
-		await fs$1.rm(path.join(authDir, entry.name), { force: true });
+		await fs.rm(path.join(authDir, entry.name), { force: true });
 	}));
 }
 async function logoutWeb(params) {
@@ -195,7 +195,7 @@ async function logoutWeb(params) {
 	if (params.isLegacyAuthDir) {
 		await clearLegacyBaileysAuthState(resolvedAuthDir);
 	} else {
-		await fs$1.rm(resolvedAuthDir, {
+		await fs.rm(resolvedAuthDir, {
 			recursive: true,
 			force: true
 		});
@@ -206,13 +206,13 @@ async function logoutWeb(params) {
 function readWebSelfId(authDir = resolveDefaultWebAuthDir()) {
 	try {
 		const credsPath = resolveWebCredsPath(resolveAuthStoreUserPath(authDir));
-		if (!fs.existsSync(credsPath)) {
+		if (!syncFs.existsSync(credsPath)) {
 			return {
 				e164: null,
 				jid: null
 			};
 		}
-		const raw = fs.readFileSync(credsPath, "utf-8");
+		const raw = syncFs.readFileSync(credsPath, "utf-8");
 		const parsed = JSON.parse(raw);
 		const jid = parsed?.me?.id ?? null;
 		const e164 = jid ? jidToE164ForAuthStore(jid, { authDir }) : null;
@@ -233,7 +233,7 @@ function readWebSelfId(authDir = resolveDefaultWebAuthDir()) {
 */
 function getWebAuthAgeMs(authDir = resolveDefaultWebAuthDir()) {
 	try {
-		const stats = fs.statSync(resolveWebCredsPath(resolveAuthStoreUserPath(authDir)));
+		const stats = syncFs.statSync(resolveWebCredsPath(resolveAuthStoreUserPath(authDir)));
 		return Date.now() - stats.mtimeMs;
 	} catch {
 		return null;

package/dist/web/auto-reply/heartbeat-runner.js

@@ -16,9 +16,9 @@ import { emitHeartbeatEvent, resolveIndicatorType } from "../../infra/heartbeat-
 import { resolveHeartbeatVisibility } from "../../infra/heartbeat-visibility.js";
 import { getReplyFromConfig } from "../../auto-reply/reply/get-reply.js";
 import "../../auto-reply/reply.js";
-import { resolveWhatsAppHeartbeatRecipients } from "../../channels/plugins/whatsapp-heartbeat.js";
 import { formatError } from "../session.js";
 import { sendMessageWhatsApp } from "../outbound.js";
+import { resolveWhatsAppHeartbeatRecipients } from "../../channels/plugins/whatsapp-heartbeat.js";
 import { newConnectionId } from "../reconnect.js";
 import { whatsappHeartbeatLog } from "./loggers.js";
 import { getSessionSnapshot } from "./session-snapshot.js";

package/dist/web/auto-reply/monitor.js

@@ -18,11 +18,11 @@ import { formatDurationPrecise } from "../../infra/format-time/format-duration.j
 import { registerUnhandledRejectionHandler } from "../../infra/unhandled-rejections.js";
 import { getReplyFromConfig } from "../../auto-reply/reply/get-reply.js";
 import "../../auto-reply/reply.js";
-import { DEFAULT_WEB_MEDIA_BYTES } from "./constants.js";
+import { waitForever } from "../../cli/wait.js";
 import { formatError } from "../session.js";
+import { DEFAULT_WEB_MEDIA_BYTES } from "./constants.js";
 import { newConnectionId, resolveHeartbeatSeconds, resolveReconnectPolicy } from "../reconnect.js";
 import { whatsappHeartbeatLog, whatsappLog } from "./loggers.js";
-import { waitForever } from "../../cli/wait.js";
 import { monitorWebInbox } from "../inbound/monitor.js";
 import "../inbound.js";
 import { buildMentionConfig } from "./mentions.js";

package/dist/web/session.js

@@ -7,7 +7,7 @@ import { redactSensitiveText } from "../logging/redact.js";
 import "../logging.js";
 import { WA_WEB_AUTH_DIR, getWebAuthAgeMs, logWebSelfId, logoutWeb, maybeRestoreCredsFromBackup, pickWebChannel, readCredsJsonRaw, readWebSelfId, resolveDefaultWebAuthDir, resolveWebCredsBackupPath, resolveWebCredsPath, webAuthExists } from "./auth-store.js";
 import { redactSensitiveUrlLikeString } from "../shared/net/redact-sensitive-url.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import { randomUUID } from "node:crypto";
 import { DisconnectReason, fetchLatestBaileysVersion, makeCacheableSignalKeyStore, makeWASocket, useMultiFileAuthState } from "@whiskeysockets/baileys";
 import qrcode from "qrcode-terminal";
@@ -27,9 +27,9 @@ async function safeSaveCreds(authDir, saveCreds, logger) {
 		if (raw) {
 			try {
 				JSON.parse(raw);
-				fs.copyFileSync(credsPath, backupPath);
+				syncFs.copyFileSync(credsPath, backupPath);
 				try {
-					fs.chmodSync(backupPath, 384);
+					syncFs.chmodSync(backupPath, 384);
 				} catch {}
 			} catch {}
 		}
@@ -37,7 +37,7 @@ async function safeSaveCreds(authDir, saveCreds, logger) {
 	try {
 		await Promise.resolve(saveCreds());
 		try {
-			fs.chmodSync(resolveWebCredsPath(authDir), 384);
+			syncFs.chmodSync(resolveWebCredsPath(authDir), 384);
 		} catch {}
 	} catch (err) {
 		logger.warn({ error: formatError(err) }, "failed saving WhatsApp creds");

package/dist/wizard/host-security-capability.js

@@ -1,35 +1,26 @@
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
+import syncFs from "node:fs";
 
 //#region src/wizard/host-security-capability.ts
-function currentUserName() {
-	return process.env.USER?.trim() || process.env.LOGNAME?.trim() || process.env.SUDO_USER?.trim() || os.userInfo().username;
-}
-function canRunHostedMaintenanceCommand(command) {
-	const probe = spawnSync("bash", ["-lc", command], { stdio: "ignore" });
-	return probe.status === 0;
+const HOSTING_PREREQUISITES = "/etc/fased/hosting-prerequisites";
+function hasRootPreparedHostingMarker() {
+	try {
+		const stat = syncFs.lstatSync(HOSTING_PREREQUISITES);
+		if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== 0 || stat.nlink !== 1 || (stat.mode & 18) !== 0 || stat.size <= 0 || stat.size > 4096) {
+			return false;
+		}
+		const content = syncFs.readFileSync(HOSTING_PREREQUISITES, "utf8");
+		return /^schemaVersion=2$/m.test(content) && /^release=\d+\.\d+\.\d+$/m.test(content) && /^gatewayPort=18789$/m.test(content) && /^tailscaleDns=[a-z0-9.-]+$/m.test(content) && /^tailnetSshConfirmed=true$/m.test(content) && /^tailscaleServeReady=true$/m.test(content) && /^firewallReady=true$/m.test(content) && /^sshHardened=true$/m.test(content) && /^fail2banReady=true$/m.test(content) && /^automaticUpdatesReady=true$/m.test(content) && /^signerReady=true$/m.test(content) && /^appSudoDisabled=true$/m.test(content) && /^preparedBy=root$/m.test(content);
+	} catch {
+		return false;
+	}
 }
 function isHostedSecurityCapableSession(explicitFlag = false) {
-	if (explicitFlag) {
-		return true;
-	}
 	if (typeof process.getuid === "function" && process.getuid() === 0) {
 		return true;
 	}
-	if (process.platform !== "linux") {
-		return false;
-	}
-	const currentUser = currentUserName();
-	if (currentUser) {
-		const sudoersPath = path.join("/etc/sudoers.d", `fased-host-maintenance-${currentUser}`);
-		if (fs.existsSync(sudoersPath)) {
-			return true;
-		}
-	}
-	return canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailscale-status >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance tailnet-ssh-ingress >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n /usr/local/sbin/fased-host-maintenance firewall-baseline >/dev/null 2>&1") || canRunHostedMaintenanceCommand("sudo -n systemctl status fased-gateway.service >/dev/null 2>&1");
+	return process.platform === "linux" && explicitFlag && process.env.FASED_HOST_ROOT_PREPARED?.trim() === "1" && hasRootPreparedHostingMarker();
 }
+const __testing = { hasRootPreparedHostingMarker };
 
 //#endregion
 export { isHostedSecurityCapableSession };