@fased/fased 0.1.62 → 0.1.64

package/dist/wizard/onboarding.js

@@ -7,10 +7,11 @@ import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
 import { readConfigFileSnapshot, writeConfigFile } from "../config/io.js";
 import "../config/config.js";
 import "../agents/auth-profiles.js";
-import { ensureWalletStateDir, resolveLocalSignerBackendSocketPath, resolveLocalSignerMaterialRootDir, resolveLocalSignerRunAsUser, resolveLocalSignerSocketPath } from "../wallet/wallet-runtime-config.js";
+import { ensureWalletStateDir, resolveLocalSignerControlSocketPath, resolveLocalSignerMaterialRootDir, resolveLocalSignerSocketPath } from "../wallet/wallet-runtime-config.js";
 import { checkNamedWalletDeletionSafety, deleteNamedWallet, readWalletProviderRegistry, resolveWalletUserRole, setDefaultWallet, setNamedWalletRole, upsertNamedWallet } from "../wallet/wallet-provider-registry.js";
 import { DEFAULT_WORKSPACE, applyWizardMetadata, ensureWorkspaceAndSessions, handleOnboardingRepair, printWizardHeader, probeGatewayReachable, summarizeExistingConfig } from "../commands/onboard-helpers.js";
-import { configureWalletForOnboarding, installSignerdBinary, migrateLocalSignerKeystoreToMaterialDir, resolveSignerdBinaryPath, restartLocalSocketSigner } from "./onboarding.wallet.js";
+import { configureSignerOwnedWalletNetwork } from "../wallet/signer-network-admin.js";
+import { configureWalletForOnboarding, installSignerdBinary, resolveSignerdBinaryPath, restartLocalSocketSigner } from "./onboarding.wallet.js";
 import { collectWalletSignerDoctorReport, walletSetupCommand } from "../commands/wallet.js";
 import { promptAuthChoiceGrouped } from "../commands/auth-choice-prompt.js";
 import { applyPrimaryModel, resolveAuthenticatedDefaultModel } from "../commands/model-picker.js";
@@ -25,6 +26,7 @@ import { promptCustomApiConfig } from "../commands/onboard-custom.js";
 import { setupInternalHooks } from "../commands/onboard-hooks.js";
 import { promptRemoteGatewayConfig } from "../commands/onboard-remote.js";
 import { setupSkills } from "../commands/onboard-skills.js";
+import { lockSignerOwnedWalletForArchive } from "../wallet/local-socket-signer-archive.js";
 import { isHostedSecurityCapableSession } from "./host-security-capability.js";
 import { noteBullet, noteCommand, noteHeading, noteLabel, noteStep, noteSuccess, noteWarn } from "./onboarding-note-format.js";
 import { configureFederationForOnboarding } from "./onboarding.federation.js";
@@ -93,20 +95,9 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		}
 		return "FASED_WALLET_SOLANA_RPC_URL";
 	};
-	const keystoreEnvKeyFor = (_chain, walletId) => {
+	const fallbackRpcEnvKeyFor = (walletId) => {
 		const suffix = walletIdEnvSuffix(walletId);
-		if (suffix) {
-			return `FASED_WALLET_SOLANA_KEYSTORE_PATH__${suffix}`;
-		}
-		return "FASED_WALLET_SOLANA_KEYSTORE_PATH";
-	};
-	const defaultKeystorePathFor = (_chain, walletId) => {
-		const normalized = String(walletId ?? "").trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
-		const walletDir = ensureWalletStateDir(process.env).rootDir;
-		if (!normalized || normalized === "default") {
-			return path.join(walletDir, "keystore-solana.v1.enc");
-		}
-		return path.join(walletDir, `keystore-solana-${normalized}.v1.enc`);
+		return suffix ? `FASED_WALLET_SOLANA_WRITE_RPC_FALLBACK_URL__${suffix}` : "FASED_WALLET_SOLANA_WRITE_RPC_FALLBACK_URL";
 	};
 	const setConfigEnvVar = (cfg, key, value) => {
 		const vars = { ...cfg.env?.vars };
@@ -124,29 +115,26 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		};
 	};
 	const applyHostedLocalSignerDefaults = (cfg) => {
-		const signerUser = String(process.env.FASED_SIGNER_USER ?? "fased-signer").trim();
-		if (!signerUser) {
-			return cfg;
-		}
-		const appHome = String(process.env.HOME ?? "/home/app").trim() || "/home/app";
-		const signerHome = `/home/${signerUser}`;
-		const defaults = {
-			FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER: signerUser,
-			FASED_WALLET_SIGNER_STATE_DIR: `${signerHome}/.fased/wallet`,
-			FASED_WALLET_LOCAL_SIGNER_SOCKET: `${appHome}/.fased/wallet/local-signer.sock`,
-			FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET: `${signerHome}/.fased/wallet/local-signer.sock`,
-			FASED_WALLET_LOCAL_SIGNER_BIN: `${signerHome}/.fased/bin/fased-signerd`
-		};
+		const appSocket = "/run/fased-signerd/app.sock";
+		const signerOwnedKeys = [
+			"FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET",
+			"FASED_WALLET_LOCAL_SIGNER_CONTROL_SOCKET",
+			"FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER",
+			"FASED_WALLET_LOCAL_SIGNER_BIN",
+			"FASED_WALLET_SIGNER_STATE_DIR",
+			"FASED_WALLET_LOCAL_SIGNER_STATE_DB",
+			"FASED_WALLET_LOCAL_SIGNER_MASTER_KEY",
+			"FASED_WALLET_PASSPHRASE_FILE",
+			"FASED_WALLET_WEBAUTHN_RP_ID",
+			"FASED_WALLET_WEBAUTHN_ORIGINS"
+		];
 		let next = cfg;
-		for (const [key, value] of Object.entries(defaults)) {
-			const existing = String(process.env[key] ?? cfg.env?.vars?.[key] ?? "").trim();
-			if (existing) {
-				process.env[key] = existing;
-				continue;
-			}
-			process.env[key] = value;
-			next = setConfigEnvVar(next, key, value);
+		for (const key of signerOwnedKeys) {
+			delete process.env[key];
+			next = setConfigEnvVar(next, key, undefined);
 		}
+		process.env.FASED_WALLET_LOCAL_SIGNER_SOCKET = appSocket;
+		next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_SOCKET", appSocket);
 		return next;
 	};
 	const syncLocalSignerRuntimeEnvIntoConfig = (cfg) => {
@@ -157,14 +145,8 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		const signerSocketPath = resolveLocalSignerSocketPath(process.env);
 		process.env.FASED_WALLET_LOCAL_SIGNER_SOCKET = signerSocketPath;
 		next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_SOCKET", signerSocketPath);
-		const backendSocketPath = resolveLocalSignerBackendSocketPath(process.env);
-		if (backendSocketPath !== signerSocketPath) {
-			process.env.FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET = backendSocketPath;
-			next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET", backendSocketPath);
-		} else {
-			delete process.env.FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET;
-			next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET", undefined);
-		}
+		delete process.env.FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET;
+		next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET", undefined);
 		const signerStateDir = resolveLocalSignerMaterialRootDir(process.env);
 		if (signerStateDir !== ensureWalletStateDir(process.env).rootDir) {
 			process.env.FASED_WALLET_SIGNER_STATE_DIR = signerStateDir;
@@ -173,14 +155,8 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 			delete process.env.FASED_WALLET_SIGNER_STATE_DIR;
 			next = setConfigEnvVar(next, "FASED_WALLET_SIGNER_STATE_DIR", undefined);
 		}
-		const signerRunAsUser = resolveLocalSignerRunAsUser(process.env);
-		if (signerRunAsUser) {
-			process.env.FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER = signerRunAsUser;
-			next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER", signerRunAsUser);
-		} else {
-			delete process.env.FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER;
-			next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER", undefined);
-		}
+		delete process.env.FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER;
+		next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER", undefined);
 		const signerBinPath = String(process.env.FASED_WALLET_LOCAL_SIGNER_BIN ?? "").trim();
 		if (signerBinPath) {
 			next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_BIN", signerBinPath);
@@ -191,24 +167,21 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		return next;
 	};
 	const jupiterApiKeyEnvKey = "FASED_JUPITER_API_KEY";
-	const jupiterTriggerApiBaseUrlEnvKey = "FASED_JUPITER_TRIGGER_API_BASE_URL";
-	const readJupiterLimitOrderApiKey = () => String(process.env[jupiterApiKeyEnvKey] ?? nextConfig.env?.vars?.[jupiterApiKeyEnvKey] ?? process.env.JUPITER_API_KEY ?? nextConfig.env?.vars?.JUPITER_API_KEY ?? "").trim();
-	const readJupiterTriggerApiBaseUrl = () => String(process.env[jupiterTriggerApiBaseUrlEnvKey] ?? nextConfig.env?.vars?.[jupiterTriggerApiBaseUrlEnvKey] ?? "").trim();
-	const promptAndStoreJupiterLimitOrders = async () => {
-		const existingKey = readJupiterLimitOrderApiKey();
+	const legacyJupiterTriggerApiBaseUrlEnvKey = "FASED_JUPITER_TRIGGER_API_BASE_URL";
+	const readJupiterSwapApiKey = () => String(process.env[jupiterApiKeyEnvKey] ?? nextConfig.env?.vars?.[jupiterApiKeyEnvKey] ?? process.env.JUPITER_API_KEY ?? nextConfig.env?.vars?.JUPITER_API_KEY ?? "").trim();
+	const promptAndStoreJupiterSwapApi = async () => {
+		const existingKey = readJupiterSwapApiKey();
 		const enable = await prompter.confirm({
-			message: existingKey ? "Keep Jupiter wallet-action support enabled?" : "Enable Jupiter support for policy-gated Agent wallet actions?",
+			message: existingKey ? "Keep Gateway Jupiter Swap API access enabled?" : "Enable Gateway Jupiter Swap API access? Trigger credentials remain signer-owned.",
 			initialValue: Boolean(existingKey)
 		});
 		if (!enable) {
 			nextConfig = setConfigEnvVar(nextConfig, jupiterApiKeyEnvKey, undefined);
-			nextConfig = setConfigEnvVar(nextConfig, jupiterTriggerApiBaseUrlEnvKey, undefined);
 			delete process.env[jupiterApiKeyEnvKey];
-			delete process.env[jupiterTriggerApiBaseUrlEnvKey];
-			await prompter.note("Jupiter wallet-action support disabled. Other approved wallet actions still use the normal wallet flow.", "Wallet actions");
+			await prompter.note("Gateway Jupiter Swap API access disabled. Native signer Trigger configuration is unchanged.", "Jupiter swaps");
 			return false;
 		}
-		const keyPrompt = existingKey ? "Jupiter API key (blank keeps current)" : "Jupiter API key";
+		const keyPrompt = existingKey ? "Jupiter Swap API key (blank keeps current)" : "Jupiter Swap API key";
 		const keyInput = (typeof prompter.secret === "function" ? await prompter.secret({
 			message: keyPrompt,
 			validate: (value) => value.trim() || existingKey ? undefined : "Jupiter API key is required"
@@ -218,21 +191,15 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		})).trim();
 		const effectiveKey = keyInput || existingKey;
 		if (!effectiveKey) {
-			throw new Error("Jupiter API key is required to enable Jupiter wallet-action support.");
+			throw new Error("Jupiter API key is required to enable Gateway swap crafting.");
 		}
 		nextConfig = setConfigEnvVar(nextConfig, jupiterApiKeyEnvKey, effectiveKey);
 		process.env[jupiterApiKeyEnvKey] = effectiveKey;
-		const existingBaseUrl = readJupiterTriggerApiBaseUrl();
-		if (existingBaseUrl) {
-			const baseUrlInput = (await prompter.text({
-				message: "Jupiter Trigger API base URL (blank keeps current)",
-				initialValue: existingBaseUrl
-			})).trim();
-			const effectiveBaseUrl = baseUrlInput || existingBaseUrl;
-			nextConfig = setConfigEnvVar(nextConfig, jupiterTriggerApiBaseUrlEnvKey, effectiveBaseUrl);
-			process.env[jupiterTriggerApiBaseUrlEnvKey] = effectiveBaseUrl;
-		}
-		await prompter.note(["Jupiter wallet-action support enabled for Agent wallet actions.", `${jupiterApiKeyEnvKey} is stored in local config env vars and is never printed in chat.`].join("\n"), "Wallet actions");
+		await prompter.note([
+			"Gateway Jupiter Swap API access enabled for Agent wallet swap crafting.",
+			`${jupiterApiKeyEnvKey} is stored in Gateway config for swaps only and is never printed in chat.`,
+			"Jupiter Trigger credentials and production routing stay inside fased-signerd."
+		].join("\n"), "Jupiter swaps");
 		return true;
 	};
 	const promptAndStoreWalletRpcUrl = async (params) => {
@@ -639,16 +606,25 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 	}
 	const interactiveHostProfileInitialValue = !hostSecurityCapable && requestedHostProfile === "hosting" ? "local" : requestedHostProfile || "local";
 	const explicitHostProfileRequested = requestedHostProfile !== undefined;
-	const hostedProfileUnavailableNote = ["This session cannot run hosting security setup.", `Rerun ${formatCliCommand("./install.sh")} from root on the VPS and choose a hosting profile there.`].join("\n");
+	const hostedProfileUnavailableNote = [
+		"This session cannot run hosting security setup.",
+		"Start from the provider root console with the exact tagged, attested Hosting command and --release vX.Y.Z.",
+		"Never run the app-owned checkout with sudo or as root."
+	].join("\n");
+	if (opts.mode !== "remote" && !requestedHostProfile) {
+		await prompter.note(["Local runs under your current OS account and does no VPS SSH/firewall hardening.", "Hosting uses the verified root bootstrap for an independent signer service, private Tailscale access and hosted SSH/firewall hardening."].join("\n"), "Setup map");
+	}
 	const hostProfile = opts.mode === "remote" ? "local" : requestedHostProfile ? requestedHostProfile : await (async () => {
 		const selected = await prompter.select({
 			message: "Host setup profile",
 			options: [{
 				value: "local",
-				label: "Local"
+				label: "Local",
+				hint: "Current machine and account; no VPS hardening."
 			}, {
 				value: "hosting",
-				label: "Hosting"
+				label: "Hosting",
+				hint: "Verified root bootstrap; Tailscale required."
 			}],
 			initialValue: interactiveHostProfileInitialValue
 		});
@@ -787,6 +763,8 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 	}));
 	const workspaceDir = resolveUserPath(workspaceInput.trim() || DEFAULT_WORKSPACE);
 	let nextConfig = applyOnboardingLocalWorkspaceConfig(baseConfig, workspaceDir);
+	nextConfig = setConfigEnvVar(nextConfig, legacyJupiterTriggerApiBaseUrlEnvKey, undefined);
+	delete process.env[legacyJupiterTriggerApiBaseUrlEnvKey];
 	nextConfig = normalizeHostedWalletPaths(nextConfig, process.env);
 	const authChoice = opts.authChoice;
 	if (authChoice === "custom-api-key") {
@@ -846,6 +824,9 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 	const hostingMode = hostProfile === "hosting";
 	if (hostingMode) {
 		nextConfig = applyHostedLocalSignerDefaults(nextConfig);
+	} else if (!String(process.env.FASED_WALLET_WEBAUTHN_RP_ID ?? "").trim() && !String(process.env.FASED_WALLET_WEBAUTHN_ORIGINS ?? "").trim()) {
+		process.env.FASED_WALLET_WEBAUTHN_RP_ID = "localhost";
+		process.env.FASED_WALLET_WEBAUTHN_ORIGINS = `http://localhost:${settings.port}`;
 	}
 	const buildNativeSignerFromSource = String(process.env.FASED_BUILD_NATIVE_SIGNER_FROM_SOURCE ?? "").trim() === "1";
 	const skipNativeSignerBuild = String(process.env.FASED_SKIP_NATIVE_SIGNER_BUILD ?? "").trim() === "1";
@@ -882,7 +863,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		nextConfig,
 		prompter
 	});
-	nextConfig = syncLocalSignerRuntimeEnvIntoConfig(nextConfig);
+	nextConfig = hostingMode ? applyHostedLocalSignerDefaults(nextConfig) : syncLocalSignerRuntimeEnvIntoConfig(nextConfig);
 	let onboardingWalletSecurityFocus = null;
 	const offerHostedWalletSetup = hostingMode && flow === "quickstart" && nextConfig.wallet?.runtime?.enabled !== true;
 	if (nextConfig.wallet?.runtime?.enabled || offerHostedWalletSetup) {
@@ -906,9 +887,9 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 							label: "Manage wallet"
 						},
 						{
-							value: "limit-orders",
-							label: "Limit orders",
-							hint: readJupiterLimitOrderApiKey() ? "Jupiter key configured" : "Enable Jupiter Trigger limit orders for Agent wallets"
+							value: "jupiter-swaps",
+							label: "Jupiter swaps",
+							hint: readJupiterSwapApiKey() ? "Gateway swap key configured" : "Optional API key for Gateway swap crafting; Trigger is signer-owned"
 						},
 						{
 							value: "skip",
@@ -921,8 +902,8 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 				if (setupMode === "skip") {
 					break;
 				}
-				if (setupMode === "limit-orders") {
-					await promptAndStoreJupiterLimitOrders();
+				if (setupMode === "jupiter-swaps") {
+					await promptAndStoreJupiterSwapApi();
 					addAnotherWallet = await prompter.confirm({
 						message: "Run another wallet setup action?",
 						initialValue: false
@@ -931,7 +912,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 				}
 				if (setupMode === "manage-self-hosted") {
 					const registry = readWalletProviderRegistry(process.env);
-					const managedWallets = registry.wallets.filter((wallet) => wallet.providerId === "local-socket-signer" || wallet.providerId === "embedded-keystore" || wallet.metadata?.selfHosted === true);
+					const managedWallets = registry.wallets.filter((wallet) => wallet.providerId === "local-socket-signer" || wallet.metadata?.selfHosted === true && wallet.providerId !== "embedded-keystore");
 					if (managedWallets.length === 0) {
 						await prompter.note("No wallets are registered yet. Create or import one first.", "Wallet setup");
 						addAnotherWallet = await prompter.confirm({
@@ -960,8 +941,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 					const currentMiningWalletId = satMiningAttachment.walletId ?? "";
 					const currentBondWalletId = federationBondWalletId ?? "";
 					const configuredSolanaRpcUrl = (nextConfig.env?.vars?.[rpcEnvKeyFor("solana", walletId)] ?? "").trim() || String(process.env[rpcEnvKeyFor("solana", walletId)] ?? "").trim();
-					const configuredSolanaKeystore = (nextConfig.env?.vars?.[keystoreEnvKeyFor("solana", walletId)] ?? "").trim() || String(process.env[keystoreEnvKeyFor("solana", walletId)] ?? "").trim();
-					const supportsSolanaWallet = Boolean(targetWallet.addresses?.solana || configuredSolanaKeystore);
+					const supportsSolanaWallet = Boolean(targetWallet.addresses?.solana || targetWallet.providerId === "local-socket-signer");
 					const targetWalletPurpose = resolveWalletUserRole(targetWallet);
 					const manageAction = await prompter.select({
 						message: "Wallet action",
@@ -969,7 +949,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 							...supportsSolanaWallet ? [{
 								value: "configure-solana-rpc",
 								label: configuredSolanaRpcUrl ? "Update Solana RPC" : "Add Solana RPC",
-								hint: configuredSolanaRpcUrl ? configuredSolanaRpcUrl : "Restore the per-wallet Solana RPC used for balances, readiness, and SAT mining."
+								hint: configuredSolanaRpcUrl ? "Signer-owned RPC is configured; replace it without displaying credentials." : "Restore the per-wallet Solana RPC used for balances, readiness, and SAT mining."
 							}] : [],
 							...supportsSolanaWallet && currentBondWalletId === walletId ? [{
 								value: "detach-federation-bond",
@@ -981,9 +961,9 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 								hint: currentBondWalletId && currentBondWalletId !== walletId ? `Current bond Vault: ${currentBondWalletId}` : "Use this Vault wallet for longer-lived SAT bond authority."
 							}] : [],
 							{
-								value: "delete",
-								label: "Delete wallet",
-								hint: "Remove this wallet registration and local keystore mapping."
+								value: "archive",
+								label: "Archive/remove from Fased",
+								hint: "Disable signer use first, then remove this wallet registration."
 							},
 							{
 								value: "cancel",
@@ -1010,8 +990,27 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 							walletName: targetWallet.name,
 							currentValue: configuredSolanaRpcUrl
 						});
-						await restartLocalSocketSigner(ensureWalletStateDir(process.env).rootDir);
-						await prompter.note(`Updated Solana RPC for ${targetWallet.name} (${walletId}): ${effectiveSolanaRpcUrl}`, "Wallet setup");
+						let signerNetworkVersion;
+						let signerNetworkRootCommand;
+						if (targetWallet.providerId === "local-socket-signer") {
+							const effectiveEnv = {
+								...process.env,
+								...nextConfig.env?.vars,
+								FASED_HOST_PROFILE: hostProfile
+							};
+							const network = configureSignerOwnedWalletNetwork({
+								walletId,
+								primaryRpcUrl: effectiveSolanaRpcUrl,
+								fallbackRpcUrl: String(effectiveEnv[fallbackRpcEnvKeyFor(walletId)] ?? "").trim() || undefined,
+								env: effectiveEnv,
+								signerBinPath: hostProfile === "hosting" ? undefined : resolveSignerdBinaryPath(effectiveEnv)
+							});
+							signerNetworkVersion = network.version;
+							signerNetworkRootCommand = network.rootCommand;
+						} else {
+							await restartLocalSocketSigner(ensureWalletStateDir(process.env).rootDir);
+						}
+						await prompter.note([`Updated the app-side Solana RPC setting for ${targetWallet.name} (${walletId})${signerNetworkVersion ? `; signer network version ${signerNetworkVersion} is ready` : "."}`, ...signerNetworkRootCommand ? ["The hosted signer was not changed because the app has no root channel. Activate the RPC from a root-owned file:", signerNetworkRootCommand] : []].join("\n"), "Wallet setup");
 						addAnotherWallet = await prompter.confirm({
 							message: "Run another wallet setup action?",
 							initialValue: false
@@ -1063,51 +1062,62 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 						});
 						continue;
 					}
+					const archiveEnv = {
+						...process.env,
+						...nextConfig.env?.vars,
+						FASED_HOST_PROFILE: hostProfile
+					};
 					const deletionSafety = checkNamedWalletDeletionSafety({
 						walletId: targetWallet.id,
-						env: process.env
+						env: archiveEnv
 					});
 					if (!deletionSafety.ok) {
-						await prompter.note(deletionSafety.message, "Delete blocked");
+						await prompter.note(deletionSafety.message, "Archive blocked");
 						addAnotherWallet = await prompter.confirm({
 							message: "Run another wallet setup action?",
 							initialValue: false
 						});
 						continue;
 					}
-					const deleteWarnings = [
-						`This deletes the local wallet registration and local keystore files for ${targetWallet.name} (${targetWallet.id}).`,
-						"It does not transfer funds and it cannot recover funds if you did not save the seed/private key first.",
-						"Move funds out, save recovery material, and clear active Mining/Fased Network use before deleting."
+					const signerOwned = targetWallet.providerId === "local-socket-signer";
+					const archiveWarnings = [
+						`This removes the Fased registration for ${targetWallet.name} (${targetWallet.id}); it does not transfer funds or erase provider custody.`,
+						signerOwned ? "Before removal, Fased must durably replace the native signer policy with deny-all. The encrypted signer-owned key remains archived in signer storage for host-administrator recovery." : "The external provider or hardware wallet keeps its key; remove it there separately only if you intend to destroy that custody relationship.",
+						"Move funds out or verify your recovery procedure, and clear active Mining/Fased Network use before archiving."
 					];
 					if (currentMiningWalletId === targetWallet.id || targetWalletPurpose === "mining") {
-						deleteWarnings.push("For @wallet:mining, stop mining first; move SAT/SOL out; save recovery material; then delete and recreate the singleton Mining wallet.");
+						archiveWarnings.push("For @wallet:mining, stop mining first; move SAT/SOL out or verify recovery; then archive and re-register the singleton Mining wallet if needed.");
 					}
-					deleteWarnings.push("If balances cannot be checked from this terminal, treat the balance as unknown and verify it from the Wallet or Mining page first.", "Use repair for auth/session recovery only; wallet deletion is always per-wallet.");
-					await prompter.note(deleteWarnings.join("\n"), "Delete wallet");
+					archiveWarnings.push("If balances cannot be checked from this terminal, treat the balance as unknown and verify it from the Wallet or Mining page first.", "Use repair for auth/session recovery only; wallet archive is always per-wallet.");
+					await prompter.note(archiveWarnings.join("\n"), "Archive wallet");
 					const typedWalletId = await prompter.text({
-						message: `Type wallet id "${targetWallet.id}" to delete this wallet`,
+						message: `Type wallet id "${targetWallet.id}" to archive/remove this wallet from Fased`,
 						validate: (value) => value.trim() === targetWallet.id ? undefined : `Type ${targetWallet.id}`
 					});
 					if (typedWalletId.trim() === targetWallet.id) {
 						const walletId = targetWallet.id;
-						const keystoreKeys = [keystoreEnvKeyFor("solana", walletId)];
-						const defaultKeystorePaths = [defaultKeystorePathFor("solana", walletId)];
-						const configuredPaths = keystoreKeys.map((key) => (nextConfig.env?.vars?.[key] ?? "").trim() || String(process.env[key] ?? "").trim()).filter(Boolean);
-						for (const file of new Set([...configuredPaths, ...defaultKeystorePaths])) {
+						let archivedSignerPolicy;
+						if (signerOwned) {
 							try {
-								if (file && syncFs.existsSync(file)) {
-									syncFs.rmSync(file, { force: true });
-								}
-							} catch {}
-						}
-						for (const key of keystoreKeys) {
-							nextConfig = setConfigEnvVar(nextConfig, key, undefined);
-							delete process.env[key];
+								archivedSignerPolicy = await lockSignerOwnedWalletForArchive({
+									wallet: targetWallet,
+									socketPath: resolveLocalSignerSocketPath(archiveEnv)
+								});
+							} catch (error) {
+								await prompter.note([
+									"The native signer did not durably acknowledge deny-all, so no Fased registration or attachment was removed.",
+									`Detail: ${error instanceof Error ? error.message : String(error)}`,
+									"Repair the signer and retry the archive operation."
+								].join("\n"), "Archive blocked");
+								addAnotherWallet = await prompter.confirm({
+									message: "Run another wallet setup action?",
+									initialValue: false
+								});
+								continue;
+							}
 						}
 						for (const key of [rpcEnvKeyFor("solana", walletId)]) {
 							nextConfig = setConfigEnvVar(nextConfig, key, undefined);
-							delete process.env[key];
 						}
 						if (satMiningAttachment.walletId === walletId) {
 							satMiningAttachment = {};
@@ -1117,14 +1127,15 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 							federationBondWalletId = undefined;
 							nextConfig = clearFederationBondWallet(nextConfig);
 						}
+						await writeConfigFile(nextConfig);
 						deleteNamedWallet({
 							walletId,
-							env: process.env
+							env: archiveEnv
 						});
-						await restartLocalSocketSigner(ensureWalletStateDir(process.env).rootDir);
-						await prompter.note(`Deleted wallet ${targetWallet.name} (${walletId}) from onboarding-safe management.`, "Wallet setup");
+						delete process.env[rpcEnvKeyFor("solana", walletId)];
+						await prompter.note(archivedSignerPolicy ? `Archived ${targetWallet.name} (${walletId}) from Fased. Native signer wallet ${archivedSignerPolicy.walletId} remains encrypted and locked by deny-all policy version ${archivedSignerPolicy.version}.` : `Removed ${targetWallet.name} (${walletId}) from Fased. Its external custody was not erased.`, "Wallet setup");
 					} else {
-						await prompter.note("Wallet deletion cancelled.", "Wallet setup");
+						await prompter.note("Wallet archive cancelled.", "Wallet setup");
 					}
 					addAnotherWallet = await prompter.confirm({
 						message: "Run another wallet setup action?",
@@ -1188,21 +1199,39 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 						continue;
 					}
 				}
-				const mode = selfHostedAction === "create" ? "local-signer-create" : "local-signer-import";
+				const mode = "local-signer-create";
 				const walletIdentity = await resolveWalletIdentityForOnboarding({
 					flow,
 					purpose: walletPurpose
 				});
 				const walletName = walletIdentity.walletName;
 				const walletId = walletIdentity.walletId || undefined;
-				const keystoreKey = keystoreEnvKeyFor(chain, walletId);
-				const currentKeystoreValue = (nextConfig.env?.vars?.[keystoreKey] ?? "").trim() || String(process.env[keystoreKey] ?? "").trim();
-				const isolatedSignerRunAsUser = resolveLocalSignerRunAsUser(process.env);
-				const stagingKeystorePath = defaultKeystorePathFor(chain, walletId);
-				const effectiveKeystorePath = isolatedSignerRunAsUser ? stagingKeystorePath : currentKeystoreValue || stagingKeystorePath;
-				const isolatedTargetKeystorePath = isolatedSignerRunAsUser ? path.join(resolveLocalSignerMaterialRootDir(process.env), path.basename(stagingKeystorePath)) : undefined;
-				nextConfig = setConfigEnvVar(nextConfig, keystoreKey, effectiveKeystorePath);
-				process.env[keystoreKey] = effectiveKeystorePath;
+				if (selfHostedAction === "import") {
+					const effectiveWalletId = walletId ?? walletPurpose;
+					const hosting = hostProfile === "hosting";
+					const signerBin = hosting ? "/opt/fased/signer/fased-signerd" : resolveSignerdBinaryPath();
+					const controlSocket = hosting ? "/run/fased-signerd/control.sock" : resolveLocalSignerControlSocketPath(process.env);
+					const signerImportCommand = [
+						shellQuote(signerBin),
+						"admin wallet import",
+						`--control-socket ${shellQuote(controlSocket)}`,
+						`--wallet-id ${shellQuote(effectiveWalletId)}`,
+						`--locked-role ${shellQuote(walletPurpose)}`,
+						`< ${shellQuote("/absolute/path/to/solana-keypair.json")}`
+					].join(" ");
+					const command = hosting ? `/usr/sbin/runuser -u fased-signer -- /usr/bin/env HOME=/var/lib/fased-signerd ${signerImportCommand}` : signerImportCommand;
+					await prompter.note([
+						"The normal Gateway and Node wizard paths do not accept plaintext wallet keys. Local same-user isolation is not a hard compromise boundary; Hosting isolates the signer account.",
+						hosting ? "Open the VPS provider root console and run this root-administrator command. Do not run it from the app shell and do not grant app sudo:" : "Run this from an authenticated terminal on the signer host:",
+						command,
+						"Then rerun wallet setup and choose Manage wallet to register/verify the returned public address."
+					].join("\n"), "Native signer import");
+					addAnotherWallet = await prompter.confirm({
+						message: "Run another wallet setup action?",
+						initialValue: false
+					});
+					continue;
+				}
 				const rpcKey = rpcEnvKeyFor(chain, walletId);
 				const currentRpcValue = (nextConfig.env?.vars?.[rpcKey] ?? "").trim() || String(process.env[rpcKey] ?? "").trim();
 				const rpcUrlInput = (await prompter.text({
@@ -1217,37 +1246,15 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 				nextConfig = setConfigEnvVar(nextConfig, rpcKey, effectiveRpcUrl);
 				process.env[rpcKey] = effectiveRpcUrl;
 				try {
-					let moveToSignerDir = false;
-					if (isolatedTargetKeystorePath && syncFs.existsSync(isolatedTargetKeystorePath)) {
-						moveToSignerDir = await prompter.confirm({
-							message: "Signer keystore already exists. Overwrite it?",
-							initialValue: false
-						});
-						if (!moveToSignerDir) {
-							throw new Error(`Keystore already exists: ${isolatedTargetKeystorePath}`);
-						}
-					}
-					const prevSignerStateDir = process.env.FASED_WALLET_SIGNER_STATE_DIR;
-					const prevPassphraseFile = process.env.FASED_WALLET_PASSPHRASE_FILE;
 					if (mode === "local-signer-create") {
-						const showPrivateKeyOnce = await prompter.confirm({
-							message: "Show generated private key once for offline backup?",
-							initialValue: false
-						});
-						const confirmPrivateKeyPrint = showPrivateKeyOnce ? "SHOW PRIVATE KEY" : undefined;
 						try {
-							if (isolatedSignerRunAsUser) {
-								delete process.env.FASED_WALLET_SIGNER_STATE_DIR;
-								delete process.env.FASED_WALLET_PASSPHRASE_FILE;
-							}
 							await walletSetupCommand(runtime, {
 								mode,
 								chain,
 								walletId,
 								walletName,
 								rpcUrl: effectiveRpcUrl,
-								showPrivateKeyOnce,
-								confirmPrivateKeyPrint,
+								force: true,
 								noDoctor: true,
 								noSignerHints: true,
 								nonInteractive: true
@@ -1262,15 +1269,12 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 								if (!overwrite) {
 									throw err;
 								}
-								moveToSignerDir = true;
 								await walletSetupCommand(runtime, {
 									mode,
 									chain,
 									walletId,
 									walletName,
 									rpcUrl: effectiveRpcUrl,
-									showPrivateKeyOnce,
-									confirmPrivateKeyPrint,
 									force: true,
 									noDoctor: true,
 									noSignerHints: true,
@@ -1279,68 +1283,18 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 							} else {
 								throw err;
 							}
-						} finally {
-							if (isolatedSignerRunAsUser) {
-								if (prevSignerStateDir == null) {
-									delete process.env.FASED_WALLET_SIGNER_STATE_DIR;
-								} else {
-									process.env.FASED_WALLET_SIGNER_STATE_DIR = prevSignerStateDir;
-								}
-								if (prevPassphraseFile == null) {
-									delete process.env.FASED_WALLET_PASSPHRASE_FILE;
-								} else {
-									process.env.FASED_WALLET_PASSPHRASE_FILE = prevPassphraseFile;
-								}
-							}
 						}
-					} else {
-						const keyInput = typeof prompter.secret === "function" ? await prompter.secret({
-							message: "Solana private key (base58/json/base64/hex)",
-							validate: (value) => value.trim() ? undefined : "Required"
-						}) : await prompter.text({
-							message: "Solana private key (base58/json/base64/hex)",
-							validate: (value) => value.trim() ? undefined : "Required"
-						});
-						try {
-							if (isolatedSignerRunAsUser) {
-								delete process.env.FASED_WALLET_SIGNER_STATE_DIR;
-								delete process.env.FASED_WALLET_PASSPHRASE_FILE;
-							}
-							await walletSetupCommand(runtime, {
-								mode: "local-signer-import",
-								chain,
-								walletId,
-								walletName,
-								privateKey: keyInput.trim(),
-								rpcUrl: effectiveRpcUrl,
-								noDoctor: true,
-								noSignerHints: true,
-								nonInteractive: true
-							});
-						} finally {
-							if (isolatedSignerRunAsUser) {
-								if (prevSignerStateDir == null) {
-									delete process.env.FASED_WALLET_SIGNER_STATE_DIR;
-								} else {
-									process.env.FASED_WALLET_SIGNER_STATE_DIR = prevSignerStateDir;
-								}
-								if (prevPassphraseFile == null) {
-									delete process.env.FASED_WALLET_PASSPHRASE_FILE;
-								} else {
-									process.env.FASED_WALLET_PASSPHRASE_FILE = prevPassphraseFile;
-								}
-							}
+						if (hostProfile === "hosting") {
+							const nativeWalletId = (walletId ?? walletPurpose).trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+							await prompter.note([
+								"The wallet key was created inside the root-managed signer with deny-all policy.",
+								"The Gateway has no sudo or root control socket, so RPC activation is a separate host-administrator step.",
+								"From a provider/root console, copy the installed network template to a root-owned mode-0600 file, set the exact RPC URLs, then run:",
+								`/usr/local/sbin/fased-signer-network --wallet-id ${nativeWalletId} --network-file /root/fased-network.json`,
+								"Signing stays disabled until network activation, owner enrollment, and an explicit positive-cap policy all succeed."
+							].join("\n"), "Hosted wallet owner handoff");
 						}
 					}
-					let configuredKeystorePath = effectiveKeystorePath;
-					if (isolatedSignerRunAsUser) {
-						configuredKeystorePath = migrateLocalSignerKeystoreToMaterialDir({
-							keystorePath: effectiveKeystorePath,
-							force: moveToSignerDir
-						});
-						nextConfig = setConfigEnvVar(nextConfig, keystoreKey, configuredKeystorePath);
-						process.env[keystoreKey] = configuredKeystorePath;
-					}
 					walletCeremonyEvents.push({
 						mode,
 						chain,
@@ -1390,9 +1344,9 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 						});
 					}
 					if (walletId) {
-						onboardingWalletSecurityFocus = walletPurpose === "mining" ? null : {
+						onboardingWalletSecurityFocus = {
 							walletId,
-							role: isAgentWallet ? "agent" : "vault"
+							role: walletPurpose
 						};
 					}
 					if (chain === "solana" && walletId) {
@@ -1421,7 +1375,8 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 								await prompter.note([
 									noteHeading("Mining wallet"),
 									noteBullet(`${walletName} (${walletId})`),
-									noteBullet("Open Mining after onboarding to fund and start workers.")
+									noteBullet("Receive-only until the signer network and an owner-reviewed Mining policy are acknowledged."),
+									noteBullet("Open Wallet > Policy after onboarding; fund and start workers only after it reports acknowledged.")
 								].join("\n"), "Mining");
 							} else if (currentMiningWalletId && currentMiningWalletId !== walletId) {
 								await prompter.note([noteHeading("Mining wallet"), noteBullet(`Keeping existing: ${currentMiningWalletId}`)].join("\n"), "Mining");
@@ -1470,7 +1425,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 						walletId: federationBondWalletId,
 						walletName: readWalletProviderRegistry(process.env).wallets.find((wallet) => wallet.id === federationBondWalletId)?.name
 					}) : "not assigned"}`),
-					noteBullet(`Jupiter wallet actions: ${readJupiterLimitOrderApiKey() ? "configured" : "not configured"}`)
+					noteBullet(`Gateway Jupiter swaps: ${readJupiterSwapApiKey() ? "configured" : "not configured"}; Trigger: signer-owned configuration`)
 				];
 				const rpcKeys = Array.from(new Set(walletCeremonyEvents.map((evt) => evt.rpcEnvKey).filter((key) => Boolean(key))));
 				if (rpcKeys.length > 0) {