@fased/fased 0.1.64 → 0.1.66

package/CHANGELOG.md

@@ -4,6 +4,39 @@ This changelog starts with the public Fased Agent release line. Required
 third-party and copied-code notices are kept in [LICENSE](./LICENSE) and
 [THIRD_PARTY_NOTICES.md](./THIRD_PARTY_NOTICES.md).
 
+## 0.1.66
+
+- Keep normal wallet onboarding to wallet role plus one primary Solana RPC,
+  infer the supported cluster from its genesis hash, and reserve an optional
+  second full execution RPC for advanced failover.
+- Separate signer execution RPCs from the verification-only public witness;
+  pin same-genesis configuration and confine public agreement to sensitive
+  address lookup-table account bytes and slots.
+- Complete signer-owned typed lookup-table lifecycle, durable forward/reverse
+  bindings and mutation leases, exact-byte replay, effect reconciliation,
+  collision recovery, stale-reservation fencing, and cleanup recovery.
+- Make the short Hosting installer bootstrap an exact immutable release before
+  privileged execution, preserve the root signer-control boundary, and retain
+  the advanced manually attested installation path.
+- Show unpaid keeper bounty in the live Mining current-cycle card and preserve
+  it across refresh and reconciliation.
+
+## 0.1.65
+
+- Add rent-aware SAT settlement accounting, durable submission serialization
+  and reconciliation, keeper-bounty debt visibility, and operator status in the
+  Mining UI and CLI surfaces.
+- Add signer-owned typed address lookup-table create, extend, deactivate, close,
+  and lookup-backed distribution operations with Mining-role, program, action,
+  and rent policy gates; all lookup-table operations remain disabled by default.
+- Require byte-identical lookup-table account state from at least two distinct
+  configured RPC origins before compiling numeric v0 indexes, and fail closed
+  for one provider, duplicate origins, or disagreement.
+- Use independent lifecycle slot reads and the conservative lower slot for
+  lookup-table activation, deactivation, and close checks.
+- Preserve explicit lookup-table enablement through managed updates and document
+  policy activation, rent recovery, keeper reconciliation, and rollback.
+
 ## 0.1.64
 
 - Make protocol-v2 `fased-signerd` authoritative for native key creation,

package/README.md

@@ -119,8 +119,8 @@ Before you start the VPS installer, shut down local VPNs such as Mullvad,
 Proton VPN, NordVPN, corporate VPN clients, and browser/device VPN apps. Other
 VPNs can override Tailscale DNS, firewall rules, or `100.x` routing. Re-enable
 them only after Tailscale SSH and the dashboard work.
-The full OS-specific commands are kept in the tabbed
-[VPS Hosting install docs](https://docs.fased.ai/install#vps-hosting-install).
+The full access and recovery steps are in the
+[VPS Hosting guide](https://docs.fased.ai/install/vps).
 
 Other private-access systems are custom deployments. The standard hosted
 installer does not configure or verify WireGuard, Headscale, ZeroTier, bastion
@@ -138,11 +138,17 @@ First SSH into the fresh VPS using the login your VPS provider gives you, often
 ssh root@YOUR_PUBLIC_VPS_IP
 ```
 
-Then follow the [pre-execution verified VPS bootstrap](https://docs.fased.ai/install/vps#3-install-fased-and-connect-through-tailscale).
-It downloads the exact tagged `install.sh` release asset and its attestation
-bundle, verifies repository/tag/workflow/GitHub-runner provenance with
-`gh attestation verify`, and only then runs the script as root. Do not pipe a
-moving or unverified script directly into a root shell.
+Then run the one-command Hosting bootstrap:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/fased-ai/fased/main/install.sh \
+  | bash -s -- --hosting
+```
+
+It selects the stable release and verifies the tagged Hosting artifacts before
+privileged Fased installation. The
+[VPS Hosting guide](https://docs.fased.ai/install/vps#advanced-verify-the-bootstrap-first)
+also keeps an advanced procedure for verifying `install.sh` before it runs.
 
 The Fased installer bootstraps the attested hosted runtime itself. A fresh VPS
 does not need `git clone`; the installer installs the supported system tools and
@@ -464,8 +470,9 @@ curl -fsSL https://raw.githubusercontent.com/fased-ai/fased/main/install.sh | ba
 ```
 
 Use the VPS Hosting profile only on the server that will run Fased all the time,
-and use the [pre-execution verified tagged bootstrap](https://docs.fased.ai/install/vps#3-install-fased-and-connect-through-tailscale)
-before executing root code.
+using the one-command bootstrap in the
+[VPS Hosting guide](https://docs.fased.ai/install/vps). Manual pre-execution
+attestation verification remains available there for advanced operators.
 
 The commands below are for contributors working from the source checkout. Do
 not use plain `npm install` to install Fased from source.

package/config/signer-policies/README.md

@@ -36,7 +36,16 @@ with `fased-signer-policy`; installation and update never widen it automatically
   forces generic SOL/SAT transfers through reviewed authorization for a Mining
   wallet; it never treats them as autonomous mining actions. Exact SAT codecs
   that genuinely use associated-token-account instructions retain that program
-  grant.
+  grant. The starter deliberately omits the four typed `satLookup` lifecycle
+  operations for large distribution pages. Opting in requires both
+  `FASED_SAT_ENABLE_ALT_V0=1` and owner-approved exact create, extend,
+  deactivate, and close grants for the Address Lookup Table program. Create and
+  extend each reserve `25000000` lamports, so the native SOL per-transaction cap
+  must be at least that amount and the daily cap must cover every create/extend
+  chunk the operator intends to run. The signer network must also contain
+  reachable primary and fallback RPC URLs on two distinct origins. ALT account
+  bytes must agree exactly across both origins; one origin, duplicate origins,
+  or any disagreement fails closed.
 - Vault operations always require signer-owned reviewed authorization. The
   starter omits Jupiter and Trigger permissions. Treat both as preview in this
   release: do not add them to a production policy until an exact generated

package/config/signer-protocol-v2.json

@@ -5,6 +5,7 @@
     "solana.nativeTransfer",
     "solana.splTransferChecked",
     "solana.satAction",
+    "solana.satLookupTable",
     "solana.vaultBondAction",
     "federation.bondChallenge",
     "solana.jupiter.swap",
@@ -31,6 +32,7 @@
     "typedA2aRefundMemos",
     "idempotentAssociatedTokenCreation",
     "typedSATActions",
+    "typedSATAddressLookupTables",
     "typedVaultBondActions",
     "domainSeparatedFederationBondChallenges",
     "federationBondChallengeWrapperV2",

package/dist/acp/client.js

@@ -2,7 +2,7 @@ import { isKnownCoreToolId } from "../agents/tool-catalog.js";
 import { DANGEROUS_ACP_TOOLS } from "../security/dangerous-tools.js";
 import { ensureFasedAgentCliOnPath } from "../infra/path-env.js";
 import { fileURLToPath } from "node:url";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
@@ -269,7 +269,7 @@ function resolveSelfEntryPath() {
 	try {
 		const here = fileURLToPath(import.meta.url);
 		const candidate = path.resolve(path.dirname(here), "..", "entry.js");
-		if (syncFs.existsSync(candidate)) {
+		if (fs.existsSync(candidate)) {
 			return candidate;
 		}
 	} catch {}

package/dist/acp/secret-file.js

@@ -1,5 +1,5 @@
 import { resolveUserPath } from "../utils.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 
 //#region src/acp/secret-file.ts
 function readSecretFromFile(filePath, label) {
@@ -9,7 +9,7 @@ function readSecretFromFile(filePath, label) {
 	}
 	let raw = "";
 	try {
-		raw = syncFs.readFileSync(resolvedPath, "utf8");
+		raw = fs.readFileSync(resolvedPath, "utf8");
 	} catch (err) {
 		throw new Error(`Failed to read ${label} file at ${resolvedPath}: ${String(err)}`, { cause: err });
 	}

package/dist/agents/agent-scope.js

@@ -6,7 +6,7 @@ import { parseAgentSessionKey } from "../sessions/session-key-utils.js";
 import { DEFAULT_AGENT_ID, normalizeAgentId, resolveAgentIdFromSessionKey } from "../routing/session-key.js";
 import { resolveEffectiveAgentSkillFilter } from "./skills/agent-filter.js";
 import { resolveDefaultAgentWorkspaceDir } from "./workspace.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/agent-scope.ts
@@ -245,7 +245,7 @@ function normalizePathForComparison(input) {
 	const resolved = path.resolve(stripNullBytes(resolveUserPath(input)));
 	let normalized = resolved;
 	try {
-		normalized = syncFs.realpathSync.native(resolved);
+		normalized = fs.realpathSync.native(resolved);
 	} catch {}
 	if (process.platform === "win32") {
 		return normalized.toLowerCase();

package/dist/agents/apply-patch.js

@@ -3,9 +3,9 @@ import { PATH_ALIAS_POLICIES } from "../infra/path-alias-guards.js";
 import { writeFileWithinRoot } from "../infra/fs-safe.js";
 import { applyUpdateHunk } from "./apply-patch-update.js";
 import { assertSandboxPath, resolveSandboxInputPath } from "./sandbox-paths.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
-import fs from "node:fs/promises";
+import fs$1 from "node:fs/promises";
 import { Type } from "@sinclair/typebox";
 
 //#region src/agents/apply-patch.ts
@@ -159,7 +159,7 @@ function resolvePatchFileOps(options) {
 	return {
 		readFile: async (filePath) => {
 			if (!workspaceOnly) {
-				return await fs.readFile(filePath, "utf8");
+				return await fs$1.readFile(filePath, "utf8");
 			}
 			const opened = await openBoundaryFile({
 				absolutePath: filePath,
@@ -168,14 +168,14 @@ function resolvePatchFileOps(options) {
 			});
 			assertBoundaryRead(opened, filePath);
 			try {
-				return syncFs.readFileSync(opened.fd, "utf8");
+				return fs.readFileSync(opened.fd, "utf8");
 			} finally {
-				syncFs.closeSync(opened.fd);
+				fs.closeSync(opened.fd);
 			}
 		},
 		writeFile: async (filePath, content) => {
 			if (!workspaceOnly) {
-				await fs.writeFile(filePath, content, "utf8");
+				await fs$1.writeFile(filePath, content, "utf8");
 				return;
 			}
 			const relative = toRelativeWorkspacePath(options.cwd, filePath);
@@ -186,8 +186,8 @@ function resolvePatchFileOps(options) {
 				encoding: "utf8"
 			});
 		},
-		remove: (filePath) => fs.rm(filePath),
-		mkdirp: (dir) => fs.mkdir(dir, { recursive: true }).then(() => {})
+		remove: (filePath) => fs$1.rm(filePath),
+		mkdirp: (dir) => fs$1.mkdir(dir, { recursive: true }).then(() => {})
 	};
 }
 async function ensureDir(filePath, ops) {

package/dist/agents/auth-profiles/paths.js

@@ -2,7 +2,7 @@ import { resolveUserPath } from "../../utils.js";
 import { saveJsonFile } from "../../infra/json-file.js";
 import { AUTH_PROFILE_FILENAME, AUTH_STORE_VERSION, LEGACY_AUTH_FILENAME } from "./constants.js";
 import { resolveFasedAgentAgentDir } from "../agent-paths.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/auth-profiles/paths.ts
@@ -19,7 +19,7 @@ function resolveAuthStorePathForDisplay(agentDir) {
 	return pathname.startsWith("~") ? pathname : resolveUserPath(pathname);
 }
 function ensureAuthStoreFile(pathname) {
-	if (syncFs.existsSync(pathname)) {
+	if (fs.existsSync(pathname)) {
 		return;
 	}
 	const payload = {

package/dist/agents/auth-profiles/store.js

@@ -6,7 +6,7 @@ import { withFileLock } from "../../plugin-sdk/file-lock.js";
 import "../../infra/file-lock.js";
 import { syncExternalCliCredentials } from "./external-cli-sync.js";
 import { ensureAuthStoreFile, resolveAuthStorePath, resolveLegacyAuthStorePath } from "./paths.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 
 //#region src/agents/auth-profiles/store.ts
 const AUTH_PROFILE_TYPES = new Set([
@@ -404,11 +404,11 @@ function readJsonFileForAuthRuntime(params) {
 	if (!params.strict) {
 		return loadJsonFile(params.pathname);
 	}
-	if (!syncFs.existsSync(params.pathname)) {
+	if (!fs.existsSync(params.pathname)) {
 		return undefined;
 	}
 	try {
-		return JSON.parse(syncFs.readFileSync(params.pathname, "utf8"));
+		return JSON.parse(fs.readFileSync(params.pathname, "utf8"));
 	} catch {
 		throw new Error(`${params.label} is unreadable or contains invalid JSON.`);
 	}
@@ -596,7 +596,7 @@ function loadAuthProfileStoreForAgent(agentDir, options) {
 	if (shouldWrite && legacy !== null) {
 		const legacyPath = resolveLegacyAuthStorePath(agentDir);
 		try {
-			syncFs.unlinkSync(legacyPath);
+			fs.unlinkSync(legacyPath);
 		} catch (err) {
 			if (err?.code !== "ENOENT") {
 				log.warn("failed to delete legacy auth.json after migration", {

package/dist/agents/bash-tools.shared.js

@@ -3,7 +3,7 @@ import { assertSandboxPath } from "./sandbox-paths.js";
 import { existsSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
-import fs from "node:fs/promises";
+import fs$1 from "node:fs/promises";
 
 //#region src/agents/bash-tools.shared.ts
 const CHUNK_LIMIT = 8 * 1024;
@@ -67,7 +67,7 @@ async function resolveSandboxWorkdir(params) {
 			cwd: process.cwd(),
 			root: params.sandbox.workspaceDir
 		});
-		const stats = await fs.stat(resolved.resolved);
+		const stats = await fs$1.stat(resolved.resolved);
 		if (!stats.isDirectory()) {
 			throw new Error("workdir is not a directory");
 		}

package/dist/agents/cli-credentials.js

@@ -1,7 +1,7 @@
 import { resolveUserPath } from "../utils.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { loadJsonFile, saveJsonFile } from "../infra/json-file.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 import { execFileSync, execSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -61,7 +61,7 @@ function resolveCodexHomePath() {
 	const configured = process.env.CODEX_HOME;
 	const home = configured ? resolveUserPath(configured) : resolveUserPath("~/.codex");
 	try {
-		return syncFs.realpathSync.native(home);
+		return fs.realpathSync.native(home);
 	} catch {
 		return home;
 	}
@@ -264,7 +264,7 @@ function writeClaudeCliKeychainCredentials(newCredentials, options) {
 }
 function writeClaudeCliFileCredentials(newCredentials, options) {
 	const credPath = resolveClaudeCliCredentialsPath(options?.homeDir);
-	if (!syncFs.existsSync(credPath)) {
+	if (!fs.existsSync(credPath)) {
 		return false;
 	}
 	try {
@@ -331,7 +331,7 @@ function readCodexCliCredentials(options) {
 	}
 	let expires;
 	try {
-		const stat = syncFs.statSync(authPath);
+		const stat = fs.statSync(authPath);
 		expires = stat.mtimeMs + 60 * 60 * 1e3;
 	} catch {
 		expires = Date.now() + 60 * 60 * 1e3;

package/dist/agents/docs-path.js

@@ -1,5 +1,5 @@
 import { resolveFasedAgentPackageRoot } from "../infra/fased-root.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/docs-path.ts
@@ -7,7 +7,7 @@ async function resolveFasedAgentDocsPath(params) {
 	const workspaceDir = params.workspaceDir?.trim();
 	if (workspaceDir) {
 		const workspaceDocs = path.join(workspaceDir, "docs");
-		if (syncFs.existsSync(workspaceDocs)) {
+		if (fs.existsSync(workspaceDocs)) {
 			return workspaceDocs;
 		}
 	}
@@ -20,7 +20,7 @@ async function resolveFasedAgentDocsPath(params) {
 		return null;
 	}
 	const packageDocs = path.join(packageRoot, "docs");
-	return syncFs.existsSync(packageDocs) ? packageDocs : null;
+	return fs.existsSync(packageDocs) ? packageDocs : null;
 }
 
 //#endregion

package/dist/agents/embedded-pi-mcp.js

@@ -1,6 +1,6 @@
 import { STATE_DIR } from "../config/paths.js";
 import { isRecord, resolveUserPath } from "../utils.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/embedded-pi-mcp.ts
@@ -66,10 +66,10 @@ function readBundleMcpFile(params) {
 	if (relative.startsWith("..") || path.isAbsolute(relative)) {
 		return {};
 	}
-	if (!syncFs.existsSync(filePath)) {
+	if (!fs.existsSync(filePath)) {
 		return {};
 	}
-	const raw = JSON.parse(syncFs.readFileSync(filePath, "utf-8"));
+	const raw = JSON.parse(fs.readFileSync(filePath, "utf-8"));
 	const servers = extractMcpServerMap(raw);
 	const baseDir = path.dirname(filePath);
 	return Object.fromEntries(Object.entries(servers).map(([serverName, server]) => [serverName, absolutizeBundleMcpServer({
@@ -99,7 +99,7 @@ function loadEnabledBundleMcpConfig(params) {
 			cfg: params.cfg,
 			pluginId
 		})) {
-			if (!syncFs.existsSync(rootDir)) {
+			if (!fs.existsSync(rootDir)) {
 				continue;
 			}
 			for (const fileName of BUNDLE_MCP_FILENAMES) {

package/dist/agents/identity-avatar.js

@@ -3,7 +3,7 @@ import { resolveAgentWorkspaceDir } from "./agent-scope.js";
 import { AVATAR_MAX_BYTES, isAvatarDataUrl, isAvatarHttpUrl, isPathWithinRoot, isSupportedLocalAvatarExtension } from "../shared/avatar-policy.js";
 import { resolveAgentIdentity } from "./identity.js";
 import { loadAgentIdentityFromWorkspace } from "./identity-file.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/identity-avatar.ts
@@ -28,7 +28,7 @@ function resolveAvatarSource(cfg, agentId, opts) {
 }
 function resolveExistingPath(value) {
 	try {
-		return syncFs.realpathSync(value);
+		return fs.realpathSync(value);
 	} catch {
 		return path.resolve(value);
 	}
@@ -51,7 +51,7 @@ function resolveLocalAvatarPath(params) {
 		};
 	}
 	try {
-		const stat = syncFs.statSync(realPath);
+		const stat = fs.statSync(realPath);
 		if (!stat.isFile()) {
 			return {
 				ok: false,

package/dist/agents/identity-file.js

@@ -1,5 +1,5 @@
 import { DEFAULT_IDENTITY_FILENAME } from "./workspace.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/identity-file.ts
@@ -67,7 +67,7 @@ function identityHasValues(identity) {
 }
 function loadIdentityFromFile(identityPath) {
 	try {
-		const content = syncFs.readFileSync(identityPath, "utf-8");
+		const content = fs.readFileSync(identityPath, "utf-8");
 		const parsed = parseIdentityMarkdown(content);
 		if (!identityHasValues(parsed)) {
 			return null;

package/dist/agents/openai-codex-app-server.js

@@ -1,6 +1,6 @@
 import { resolveFasedAgentPackageRootSync } from "../infra/fased-root.js";
 import { resolvePluginInstallDir } from "../plugins/install.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
@@ -60,17 +60,17 @@ function resolveOpenAICodexExecutable() {
 	const explicitlyConfigured = process.env.FASED_CODEX_BIN?.trim();
 	for (const candidate of codexExecutableCandidates()) {
 		try {
-			if (!syncFs.statSync(candidate).isFile()) {
+			if (!fs.statSync(candidate).isFile()) {
 				continue;
 			}
 			if (explicitlyConfigured && candidate === explicitlyConfigured) {
 				return candidate;
 			}
-			const resolved = syncFs.realpathSync(candidate);
+			const resolved = fs.realpathSync(candidate);
 			let current = path.dirname(resolved);
 			for (let depth = 0; depth < 6; depth += 1) {
 				try {
-					const parsed = JSON.parse(syncFs.readFileSync(path.join(current, "package.json"), "utf8"));
+					const parsed = JSON.parse(fs.readFileSync(path.join(current, "package.json"), "utf8"));
 					if (parsed.name === "@openai/codex") {
 						if (parsed.version === OPENAI_CODEX_APP_SERVER_VERSION) {
 							return candidate;
@@ -90,7 +90,7 @@ function resolveOpenAICodexExecutable() {
 }
 function managedCodexHome() {
 	const directory = path.join(stateDir(), "runtime", "openai-codex");
-	syncFs.mkdirSync(directory, {
+	fs.mkdirSync(directory, {
 		recursive: true,
 		mode: 448
 	});

package/dist/agents/pi-embedded-subscribe.raw-stream.js

@@ -1,6 +1,6 @@
 import { resolveStateDir } from "../config/paths.js";
 import { isTruthyEnvValue } from "../infra/env.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/pi-embedded-subscribe.raw-stream.ts
@@ -14,11 +14,11 @@ function appendRawStream(payload) {
 	if (!rawStreamReady) {
 		rawStreamReady = true;
 		try {
-			syncFs.mkdirSync(path.dirname(RAW_STREAM_PATH), { recursive: true });
+			fs.mkdirSync(path.dirname(RAW_STREAM_PATH), { recursive: true });
 		} catch {}
 	}
 	try {
-		void syncFs.promises.appendFile(RAW_STREAM_PATH, `${JSON.stringify(payload)}\n`);
+		void fs.promises.appendFile(RAW_STREAM_PATH, `${JSON.stringify(payload)}\n`);
 	} catch {}
 }
 

package/dist/agents/pi-extensions/compaction-safeguard.js

@@ -3,7 +3,7 @@ import { getCompactionSafeguardRuntime } from "./compaction-safeguard-runtime.js
 import { extractSections } from "../../auto-reply/reply/post-compaction-context.js";
 import { BASE_CHUNK_RATIO, MIN_CHUNK_RATIO, SAFETY_MARGIN, SUMMARIZATION_OVERHEAD_TOKENS, computeAdaptiveChunkRatio, estimateMessagesTokens, isOversizedForSummary, pruneHistoryForContextShare, resolveContextWindowTokens, summarizeInStages } from "../compaction.js";
 import { collectTextContentBlocks } from "../content-blocks.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/pi-extensions/compaction-safeguard.ts
@@ -122,10 +122,10 @@ async function readWorkspaceContextForSummary() {
 	const workspaceDir = process.cwd();
 	const agentsPath = path.join(workspaceDir, "AGENTS.md");
 	try {
-		if (!syncFs.existsSync(agentsPath)) {
+		if (!fs.existsSync(agentsPath)) {
 			return "";
 		}
-		const content = await syncFs.promises.readFile(agentsPath, "utf-8");
+		const content = await fs.promises.readFile(agentsPath, "utf-8");
 		const sections = extractSections(content, ["Session Startup", "Red Lines"]);
 		if (sections.length === 0) {
 			return "";

package/dist/agents/pi-model-discovery.js

@@ -1,7 +1,7 @@
 import { ensureAuthProfileStore } from "./auth-profiles/store.js";
 import "./auth-profiles.js";
 import { resolvePiCredentialMapFromStore } from "./pi-auth-credentials.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 import * as PiCodingAgent from "@mariozechner/pi-coding-agent";
 
@@ -25,12 +25,12 @@ function scrubLegacyStaticAuthJsonEntries(pathname) {
 	if (process.env.FASED_AUTH_STORE_READONLY === "1") {
 		return;
 	}
-	if (!syncFs.existsSync(pathname)) {
+	if (!fs.existsSync(pathname)) {
 		return;
 	}
 	let parsed;
 	try {
-		parsed = JSON.parse(syncFs.readFileSync(pathname, "utf8"));
+		parsed = JSON.parse(fs.readFileSync(pathname, "utf8"));
 	} catch {
 		return;
 	}
@@ -52,11 +52,11 @@ function scrubLegacyStaticAuthJsonEntries(pathname) {
 		return;
 	}
 	if (Object.keys(parsed).length === 0) {
-		syncFs.rmSync(pathname, { force: true });
+		fs.rmSync(pathname, { force: true });
 		return;
 	}
-	syncFs.writeFileSync(pathname, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
-	syncFs.chmodSync(pathname, 384);
+	fs.writeFileSync(pathname, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
+	fs.chmodSync(pathname, 384);
 }
 function createAuthStorage(AuthStorageLike, path, creds) {
 	const withInMemory = AuthStorageLike;

package/dist/agents/pi-project-settings.js

@@ -1,6 +1,6 @@
 import { applyMergePatch } from "../config/merge-patch.js";
 import { applyPiCompactionSettingsFromConfig } from "./pi-settings.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 import path from "node:path";
 import { SettingsManager } from "@mariozechner/pi-coding-agent";
 
@@ -28,7 +28,7 @@ function buildEmbeddedPiSettingsSnapshot(params) {
 }
 function readJsonFile(filePath) {
 	try {
-		const raw = syncFs.readFileSync(filePath, "utf8");
+		const raw = fs.readFileSync(filePath, "utf8");
 		const parsed = JSON.parse(raw);
 		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
 	} catch {
@@ -49,7 +49,7 @@ function loadEnabledBundlePiSettingsSnapshot(params) {
 			const servers = mcp.mcpServers && typeof mcp.mcpServers === "object" && !Array.isArray(mcp.mcpServers) ? mcp.mcpServers : undefined;
 			if (servers) {
 				const resolvedServers = {};
-				const resolvedRoot = syncFs.realpathSync.native?.(pluginRoot) ?? syncFs.realpathSync(pluginRoot);
+				const resolvedRoot = fs.realpathSync.native?.(pluginRoot) ?? fs.realpathSync(pluginRoot);
 				for (const [name, server] of Object.entries(servers)) {
 					if (!server || typeof server !== "object" || Array.isArray(server)) {
 						resolvedServers[name] = server;

package/dist/agents/sandbox/fs-bridge.js

@@ -3,7 +3,7 @@ import { PATH_ALIAS_POLICIES } from "../../infra/path-alias-guards.js";
 import { execDockerRaw } from "./docker.js";
 import { isPathInsideContainerRoot, normalizeContainerPath } from "./path-utils.js";
 import { buildSandboxFsMounts, resolveSandboxFsPathWithMounts } from "./fs-paths.js";
-import syncFs from "node:fs";
+import fs from "node:fs";
 
 //#region src/agents/sandbox/fs-bridge.ts
 function createSandboxFsBridge(params) {
@@ -160,7 +160,7 @@ var SandboxFsBridgeImpl = class {
 				throw guarded.error instanceof Error ? guarded.error : new Error(`Sandbox boundary checks failed; cannot ${options.action}: ${target.containerPath}`);
 			}
 		} else {
-			syncFs.closeSync(guarded.fd);
+			fs.closeSync(guarded.fd);
 		}
 		const canonicalContainerPath = await this.resolveCanonicalContainerPath({
 			containerPath: target.containerPath,