@fased/fased 0.1.62 → 0.1.65

package/dist/commands/onboard-auth.credentials.js

@@ -1,14 +1,14 @@
 import { resolveStateDir } from "../config/paths.js";
-import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/cloudflare-ai-gateway-shared.js";
-import { HUGGINGFACE_DEFAULT_MODEL_REF } from "../providers/huggingface-models.js";
-import { TOGETHER_DEFAULT_MODEL_REF } from "../providers/together-models.js";
-import { VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/vercel-ai-gateway-models.js";
-import "../providers/registry.js";
 import { DEFAULT_SECRET_PROVIDER_ALIAS, coerceSecretRef } from "../config/types.secrets.js";
 import { normalizeSecretInput } from "../utils/normalize-secret-input.js";
 import { resolveFasedAgentAgentDir } from "../agents/agent-paths.js";
 import { upsertAuthProfile } from "../agents/auth-profiles/profiles.js";
 import "../agents/auth-profiles.js";
+import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/cloudflare-ai-gateway-shared.js";
+import { HUGGINGFACE_DEFAULT_MODEL_REF } from "../providers/huggingface-models.js";
+import { TOGETHER_DEFAULT_MODEL_REF } from "../providers/together-models.js";
+import { VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/vercel-ai-gateway-models.js";
+import "../providers/registry.js";
 import { PROVIDER_ENV_VARS } from "../secrets/provider-env-vars.js";
 import { MISTRAL_DEFAULT_MODEL_REF, XAI_DEFAULT_MODEL_REF } from "./onboard-auth.models.js";
 import syncFs from "node:fs";
@@ -71,6 +71,28 @@ function buildApiKeyCredential(provider, input, metadata, options) {
 		...metadata ? { metadata } : {}
 	};
 }
+function assertValidOAuthCredentialInput(provider, creds) {
+	if (typeof provider !== "string" || !provider.trim()) {
+		throw new Error("OAuth credential provider must be a non-empty string.");
+	}
+	if (!creds || typeof creds !== "object" || typeof creds.access !== "string" || !creds.access.trim() || typeof creds.refresh !== "string" || !creds.refresh.trim() || typeof creds.expires !== "number" || !Number.isFinite(creds.expires)) {
+		throw new Error("OAuth credentials must include valid access, refresh, and expiry fields.");
+	}
+	for (const field of [
+		"email",
+		"clientId",
+		"enterpriseUrl",
+		"projectId",
+		"accountId"
+	]) {
+		if (creds[field] !== undefined && typeof creds[field] !== "string") {
+			throw new Error(`OAuth credential ${field} must be a string when provided.`);
+		}
+	}
+	if (creds.availableModelIds !== undefined && (!Array.isArray(creds.availableModelIds) || !creds.availableModelIds.every((modelId) => typeof modelId === "string" && modelId.trim().length > 0))) {
+		throw new Error("OAuth credential availableModelIds must contain non-empty strings.");
+	}
+}
 /** Resolve real path, returning null if the target doesn't exist. */
 function safeRealpathSync(dir) {
 	try {
@@ -105,14 +127,16 @@ function resolveSiblingAgentDirs(primaryAgentDir) {
 	return result;
 }
 async function writeOAuthCredentials(provider, creds, agentDir, options) {
+	assertValidOAuthCredentialInput(provider, creds);
+	const canonicalProvider = provider.trim();
 	const email = typeof creds.email === "string" && creds.email.trim() ? creds.email.trim() : "default";
-	const profileId = `${provider}:${email}`;
+	const profileId = `${canonicalProvider}:${email}`;
 	const resolvedAgentDir = path.resolve(resolveAuthAgentDir(agentDir));
 	const targetAgentDirs = options?.syncSiblingAgents ? resolveSiblingAgentDirs(resolvedAgentDir) : [resolvedAgentDir];
 	const credential = {
+		...creds,
 		type: "oauth",
-		provider,
-		...creds
+		provider: canonicalProvider
 	};
 	upsertAuthProfile({
 		profileId,

package/dist/commands/onboard-non-interactive/local/wallet-config.js

@@ -1,3 +1,4 @@
+import { LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE, hasLegacyEmbeddedKeystoreMaterialHint } from "../../../wallet/legacy-embedded-keystore.js";
 import { WALLET_PROVIDER_IDS, readWalletProviderRegistry, setWalletProvidersEnabled } from "../../../wallet/wallet-provider-registry.js";
 
 //#region src/commands/onboard-non-interactive/local/wallet-config.ts
@@ -79,11 +80,10 @@ function parseWalletRuntime(raw) {
 }
 function parseWalletProviderId(raw) {
 	switch ((raw ?? "").trim()) {
-		case "embedded-keystore":
 		case "local-socket-signer":
 		case "alchemy":
 		case "turnkey":
-		case "privy": return raw;
+		case "wallet-standard": return raw;
 		default: return null;
 	}
 }
@@ -103,7 +103,10 @@ function hasConfiguredWalletMaterial(registry) {
 const LOCAL_SIGNER_ENV_KEYS = [
 	"FASED_WALLET_LOCAL_SIGNER_SOCKET",
 	"FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET",
+	"FASED_WALLET_LOCAL_SIGNER_CONTROL_SOCKET",
 	"FASED_WALLET_SIGNER_STATE_DIR",
+	"FASED_WALLET_LOCAL_SIGNER_STATE_DB",
+	"FASED_WALLET_LOCAL_SIGNER_MASTER_KEY",
 	"FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER",
 	"FASED_WALLET_LOCAL_SIGNER_BIN",
 	"FASED_WALLET_PASSPHRASE_FILE"
@@ -140,31 +143,14 @@ function setConfigEnvVar(config, key, value) {
 	};
 }
 function applyHostedLocalSignerDefaults(base) {
-	const signerUser = String(process.env.FASED_SIGNER_USER ?? "fased-signer").trim();
-	if (!signerUser) {
-		return base;
-	}
-	const appHome = String(process.env.HOME ?? "/home/app").trim() || "/home/app";
-	const signerHome = `/home/${signerUser}`;
-	const defaults = {
-		FASED_WALLET_LOCAL_SIGNER_SOCKET: `${appHome}/.fased/wallet/local-signer.sock`,
-		FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET: `${signerHome}/.fased/wallet/local-signer.sock`,
-		FASED_WALLET_SIGNER_STATE_DIR: `${signerHome}/.fased/wallet`,
-		FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER: signerUser,
-		FASED_WALLET_LOCAL_SIGNER_BIN: `${signerHome}/.fased/bin/fased-signerd`,
-		FASED_WALLET_PASSPHRASE_FILE: `${signerHome}/.fased/wallet/passphrase`
-	};
+	const appSocket = "/run/fased-signerd/app.sock";
 	let next = base;
-	for (const [key, value] of Object.entries(defaults)) {
-		const existing = String(process.env[key] ?? base.env?.vars?.[key] ?? "").trim();
-		if (existing) {
-			process.env[key] = existing;
-			next = setConfigEnvVar(next, key, existing);
-			continue;
-		}
-		process.env[key] = value;
-		next = setConfigEnvVar(next, key, value);
+	for (const key of LOCAL_SIGNER_ENV_KEYS) {
+		delete process.env[key];
+		next = setConfigEnvVar(next, key, undefined);
 	}
+	process.env.FASED_WALLET_LOCAL_SIGNER_SOCKET = appSocket;
+	next = setConfigEnvVar(next, "FASED_WALLET_LOCAL_SIGNER_SOCKET", appSocket);
 	return next;
 }
 function applyNonInteractiveWalletConfig(params) {
@@ -172,6 +158,21 @@ function applyNonInteractiveWalletConfig(params) {
 	const current = nextConfig.wallet?.runtime;
 	const managedMode = isManagedGatewayMode(opts);
 	const registry = readWalletProviderRegistry(process.env);
+	const requestedLegacyProvider = String(opts.walletDefaultProvider ?? "").trim() === "embedded-keystore" || typeof opts.walletProviders === "string" && opts.walletProviders.split(",").some((entry) => entry.trim() === "embedded-keystore");
+	if (requestedLegacyProvider || nextConfig.wallet?.provider?.id === "embedded-keystore" || registry.providers["embedded-keystore"]?.enabled || registry.wallets.some((wallet) => wallet.providerId === "embedded-keystore") || hasLegacyEmbeddedKeystoreMaterialHint({
+		...process.env,
+		...nextConfig.env?.vars
+	})) {
+		runtime.error(LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE);
+		runtime.exit(1);
+		return nextConfig;
+	}
+	const requestedPrivyProvider = String(opts.walletDefaultProvider ?? "").trim() === "privy" || typeof opts.walletProviders === "string" && opts.walletProviders.split(",").some((entry) => entry.trim() === "privy");
+	if (requestedPrivyProvider || nextConfig.wallet?.provider?.id === "privy" || registry.wallets.some((wallet) => wallet.providerId === "privy")) {
+		runtime.error("Privy wallet creation and signing are unavailable; use the Go signer, Turnkey, or Wallet Standard.");
+		runtime.exit(1);
+		return nextConfig;
+	}
 	const configuredWalletMaterial = hasConfiguredWalletMaterial(registry);
 	const enabled = opts.walletEnabled ?? (current?.enabled === false ? false : Boolean(current?.enabled && configuredWalletMaterial));
 	if (!enabled) {
@@ -196,7 +197,7 @@ function applyNonInteractiveWalletConfig(params) {
 	}
 	const existingEnabledProviders = WALLET_PROVIDER_IDS.filter((providerId) => registry.providers[providerId]?.enabled);
 	const defaultProviderFromConfig = parseWalletProviderId(nextConfig.wallet?.provider?.id);
-	const defaultProvider = defaultProviderFromOption ?? (defaultProviderFromConfig === "embedded-keystore" ? "local-socket-signer" : defaultProviderFromConfig) ?? providersFromOption?.[0] ?? "local-socket-signer";
+	const defaultProvider = defaultProviderFromOption ?? defaultProviderFromConfig ?? providersFromOption?.[0] ?? "local-socket-signer";
 	const enabledProviders = providersFromOption ? [...providersFromOption] : existingEnabledProviders.length > 0 ? [...existingEnabledProviders] : [defaultProvider];
 	if (!enabledProviders.includes(defaultProvider)) {
 		enabledProviders.unshift(defaultProvider);
@@ -234,7 +235,7 @@ function applyNonInteractiveWalletConfig(params) {
 	const authMode = current?.auth?.mode === "jwt-bootstrap" || current?.auth?.mode === "static-token-compat" ? current.auth.mode : selfHostEnabled && runtimeSource === "external-docker" ? "jwt-bootstrap" : "static-token-compat";
 	const authBootstrapUrl = current?.auth?.bootstrapUrl?.trim() || undefined;
 	const sourceRef = current?.source?.ref?.trim() || undefined;
-	const directSigning = opts.walletDirectSigning ?? current?.policy?.directSigning ?? managedMode;
+	const directSigning = opts.walletDirectSigning ?? current?.policy?.directSigning ?? false;
 	const toolAccessMode = parseToolAccessMode(opts.walletToolAccessMode) ?? current?.toolAccess?.mode ?? "owner-only";
 	if (!toolAccessMode) {
 		runtime.error("Invalid --wallet-tool-access-mode (use owner-only|allowlist|all).");

package/dist/commands/onboard-non-interactive/local.js

@@ -73,7 +73,11 @@ async function runNonInteractiveOnboardingLocal(params) {
 		return;
 	}
 	if (opts.hostProfile === "hosting" && !hostSecurityCapable && opts.hostMaintenanceSession !== true) {
-		runtime.error(["Hosted non-interactive onboarding requires a root-started installer session.", `Re-run ${formatCliCommand("./install.sh")} from root and select a hosting profile there, or use the explicit hosted installer flags from root.`].join("\n"));
+		runtime.error([
+			"Hosted non-interactive onboarding requires a root-started installer session.",
+			"Start from the provider root console with the exact tagged, attested Hosting command and --release vX.Y.Z.",
+			"Never run the app-owned checkout with sudo or as root."
+		].join("\n"));
 		runtime.exit(1);
 		return;
 	}