@fased/fased 0.1.66 → 0.1.68

package/dist/wallet/local-socket-signer-protocol.js

@@ -292,6 +292,16 @@ const LocalSocketSignerSatLookupBindingV2Schema = Type.Object({
 		Type.Literal("unknown")
 	]))
 }, { additionalProperties: false });
+const LocalSocketSignerNetworkSummaryV2Schema = Type.Object({
+	walletId: Type.String({
+		minLength: 1,
+		maxLength: 64
+	}),
+	configured: Type.Boolean(),
+	version: Type.Integer({ minimum: 0 }),
+	hash: Type.Optional(Type.String({ pattern: "^hmac-sha256:[0-9a-f]{64}$" })),
+	ready: Type.Boolean()
+}, { additionalProperties: false });
 const LocalSocketSignerRequestSchema = Type.Union([
 	Type.Object({ op: Type.Literal("health") }, { additionalProperties: false }),
 	Type.Object({ op: Type.Literal("v2.capabilities") }, { additionalProperties: false }),
@@ -303,6 +313,21 @@ const LocalSocketSignerRequestSchema = Type.Union([
 		op: Type.Literal("v2.policy.get"),
 		walletId: Type.String()
 	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.network.get"),
+		walletId: Type.String()
+	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.network.bootstrap"),
+		walletId: Type.String(),
+		request: Type.Object({
+			expectedVersion: Type.Integer({ minimum: 0 }),
+			primaryRpcUrl: Type.String({
+				minLength: 1,
+				maxLength: 2048
+			})
+		}, { additionalProperties: false })
+	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.policy.put"),
 		walletId: Type.String(),
@@ -665,6 +690,8 @@ function validateLocalSocketSignerResult(op, result) {
 		case "health":
 		case "v2.capabilities": return Value.Check(LocalSocketSignerHealthResultSchema, result);
 		case "v2.jupiter.trigger.history": return Value.Check(LocalSocketSignerJupiterTriggerHistoryV2Schema, result);
+		case "v2.network.get":
+		case "v2.network.bootstrap": return Value.Check(LocalSocketSignerNetworkSummaryV2Schema, result);
 		case "v2.policy.get":
 		case "v2.policy.put":
 		case "v2.policy.tighten": return Value.Check(LocalSocketSignerPolicyV2Schema, result);

package/dist/wallet/providers/local-socket-signer-adapter.js

@@ -14,6 +14,8 @@ const REQUIRED_PROTOCOL_V2_FEATURES = SIGNER_PROTOCOL_V2_REQUIRED_CLIENT_FEATURE
 const SIGNER_SOCKET_TIMEOUT_MS = {
 	health: 2e3,
 	"v2.capabilities": 2e3,
+	"v2.network.get": 15e3,
+	"v2.network.bootstrap": 3e4,
 	"v2.jupiter.trigger.history": 3e4,
 	"v2.policy.get": 5e3,
 	"v2.policy.put": 5e3,
@@ -227,6 +229,12 @@ var LocalSocketSignerAdapter = class {
 				provider: this.id,
 				configured: true,
 				checkedAt: new Date().toISOString(),
+				...details.webAuthn ? { nativeSignerApproval: {
+					configured: details.webAuthn.configured,
+					ready: details.webAuthn.ready,
+					credentialCount: details.webAuthn.credentialCount,
+					credentialVersion: details.webAuthn.credentialVersion
+				} } : {},
 				details: [
 					details?.details ?? "",
 					...!details?.details ? [

package/dist/wallet/signer-network-admin.js

@@ -1,10 +1,7 @@
-import { resolveLocalSignerControlSocketPath } from "./wallet-runtime-config.js";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { resolveLocalSignerSocketPath } from "./wallet-runtime-config.js";
+import { configureSignerOwnedWalletPrimaryRpc } from "./local-socket-signer-lifecycle.js";
 
 //#region src/wallet/signer-network-admin.ts
-const NETWORK_ADMIN_TIMEOUT_MS = 3e4;
-const NETWORK_ADMIN_MAX_OUTPUT_BYTES = 256 * 1024;
 function canonicalSignerWalletId(raw) {
 	const normalized = raw.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 	return normalized || "default";
@@ -47,62 +44,7 @@ function parseSignerNetworkSummary(raw, expectedWalletId) {
 		ready: record.ready
 	};
 }
-function redactSignerNetworkError(raw, secrets) {
-	let value = raw;
-	for (const secret of secrets.filter(Boolean).toSorted((a, b) => b.length - a.length)) {
-		value = value.split(secret).join("[redacted-rpc-url]");
-	}
-	value = value.replace(/https?:\/\/[^\s"'<>]+/gi, "[redacted-rpc-url]");
-	value = value.replace(/\b(api[_-]?key|access[_-]?token|token|key)=([^\s&"']+)/gi, "$1=[redacted]");
-	return value.trim().slice(0, 2e3) || "signer network administration failed";
-}
-function signerAdminEnvironment(env) {
-	const out = {};
-	for (const key of [
-		"HOME",
-		"PATH",
-		"TMPDIR",
-		"LANG",
-		"LC_ALL",
-		"TZ"
-	]) {
-		const value = String(env[key] ?? "").trim();
-		if (value) {
-			out[key] = value;
-		}
-	}
-	return out;
-}
-function runSignerAdmin(params) {
-	const child = spawnSync(params.command, params.args, {
-		input: params.input,
-		env: params.env,
-		encoding: "utf8",
-		timeout: NETWORK_ADMIN_TIMEOUT_MS,
-		maxBuffer: NETWORK_ADMIN_MAX_OUTPUT_BYTES,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		]
-	});
-	if (child.error || child.status !== 0) {
-		const detail = [
-			child.stderr,
-			child.stdout,
-			child.error?.message
-		].filter((part) => typeof part === "string" && part.trim().length > 0).join("\n");
-		throw new Error(redactSignerNetworkError(detail, params.secrets));
-	}
-	return child.stdout;
-}
-function assertReadyNetworkSummary(summary, previousVersion) {
-	if (!summary.configured || !summary.ready || !summary.hash || summary.version !== previousVersion + 1) {
-		throw new Error("signer network update did not acknowledge the exact next ready version");
-	}
-	return summary;
-}
-function configureSignerOwnedWalletNetwork(params) {
+async function configureSignerOwnedWalletNetwork(params) {
 	const env = params.env ?? process.env;
 	const walletId = canonicalSignerWalletId(params.walletId);
 	const primaryRpcUrl = params.primaryRpcUrl.trim();
@@ -111,61 +53,14 @@ function configureSignerOwnedWalletNetwork(params) {
 	if (!primaryRpcUrl) {
 		throw new Error("signer-owned wallet network requires a primary RPC URL");
 	}
-	const secrets = [
-		primaryRpcUrl,
-		executionFallbackRpcUrl,
-		verificationRpcUrl
-	];
-	const hosting = String(env.FASED_HOST_PROFILE ?? "").trim().toLowerCase() === "hosting";
-	if (hosting) {
-		return {
-			walletId,
-			configured: false,
-			version: 0,
-			ready: false,
-			rootAdminRequired: true,
-			rootCommand: `/usr/local/sbin/fased-signer-network --wallet-id ${walletId} ` + "--network-file /root/fased-network.json"
-		};
+	if (executionFallbackRpcUrl || verificationRpcUrl) {
+		throw new Error("Normal wallet setup accepts one primary RPC. Configure an advanced execution fallback or explicit witness with the native signer admin network command.");
 	}
-	const signerBinPath = params.signerBinPath ?? (String(env.FASED_WALLET_LOCAL_SIGNER_BIN ?? "").trim() || path.join(String(env.HOME ?? ""), ".fased", "bin", "fased-signerd"));
-	const controlSocketPath = params.controlSocketPath ?? resolveLocalSignerControlSocketPath(env);
-	const adminEnv = signerAdminEnvironment(env);
-	const commonArgs = [
-		"--control-socket",
-		controlSocketPath,
-		"--wallet-id",
-		walletId
-	];
-	const current = parseSignerNetworkSummary(runSignerAdmin({
-		command: signerBinPath,
-		args: [
-			"admin",
-			"network",
-			"get",
-			...commonArgs
-		],
-		env: adminEnv,
-		secrets
-	}), walletId);
-	const input = `${JSON.stringify({
-		expectedVersion: current.version,
-		primaryRpcUrl,
-		...executionFallbackRpcUrl ? { executionFallbackRpcUrl } : {},
-		...verificationRpcUrl ? { verificationRpcUrl } : {}
-	})}\n`;
-	const updated = parseSignerNetworkSummary(runSignerAdmin({
-		command: signerBinPath,
-		args: [
-			"admin",
-			"network",
-			"put",
-			...commonArgs
-		],
-		input,
-		env: adminEnv,
-		secrets
-	}), walletId);
-	return assertReadyNetworkSummary(updated, current.version);
+	return configureSignerOwnedWalletPrimaryRpc({
+		socketPath: params.socketPath ?? resolveLocalSignerSocketPath(env),
+		walletId,
+		primaryRpcUrl
+	});
 }
 /**
 * Hosted policy changes are deliberately unavailable to the app process. New signer-owned
@@ -181,9 +76,7 @@ function applyHostedSignerOwnedWalletPolicy(params) {
 }
 const __testing = {
 	canonicalSignerWalletId,
-	parseSignerNetworkSummary,
-	redactSignerNetworkError,
-	signerAdminEnvironment
+	parseSignerNetworkSummary
 };
 
 //#endregion

package/dist/wallet/signer-protocol-v2.generated.js

@@ -38,6 +38,9 @@ const SIGNER_PROTOCOL_V2 = {
 		"signerOwnedSuccessorRotation",
 		"permanentRetiredWalletPolicies",
 		"signerOwnedRPC",
+		"applicationNetworkBootstrap",
+		"signerOwnedEncryptedRecovery",
+		"signerOwnedRawExport",
 		"typedSolanaTransactions",
 		"typedA2aPaymentMemos",
 		"typedA2aRefundMemos",
@@ -75,6 +78,7 @@ const SIGNER_PROTOCOL_V2_REQUIRED_CLIENT_FEATURES = [
 	"ambiguousBroadcastReconciliation",
 	"signerOwnedKeys",
 	"signerOwnedRPC",
+	"applicationNetworkBootstrap",
 	"typedSolanaTransactions",
 	"typedA2aPaymentMemos",
 	"typedA2aRefundMemos",

package/dist/wallet/solana-assets.js

@@ -1,3 +1,4 @@
+import { fetchPinnedSolanaRpcRead } from "./solana-rpc-read-fetch.js";
 import { PublicKey } from "@solana/web3.js";
 
 //#region src/wallet/solana-assets.ts
@@ -427,10 +428,11 @@ function formatTokenAmount(raw, decimals) {
 	}
 }
 async function fetchSolanaRpc(rpcUrl, method, params) {
+	let release;
 	try {
-		const response = await fetch(rpcUrl, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
+		const guarded = await fetchPinnedSolanaRpcRead({
+			rpcUrl,
+			timeoutMs: 1e4,
 			body: JSON.stringify({
 				jsonrpc: "2.0",
 				id: 1,
@@ -438,6 +440,8 @@ async function fetchSolanaRpc(rpcUrl, method, params) {
 				params
 			})
 		});
+		release = guarded.release;
+		const response = guarded.response;
 		if (!response.ok) {
 			recordSolanaAssetRpcMethod(method, "failure");
 			return null;
@@ -452,6 +456,8 @@ async function fetchSolanaRpc(rpcUrl, method, params) {
 	} catch {
 		recordSolanaAssetRpcMethod(method, "failure");
 		return null;
+	} finally {
+		await release?.();
 	}
 }
 async function fetchSolanaMetadataFromMintViaRpc(params) {

package/dist/wallet/solana-rpc-read-fetch.js

@@ -0,0 +1,65 @@
+import { closeDispatcher, createPinnedDispatcher, resolvePinnedHostnameWithPolicy } from "../infra/net/ssrf.js";
+
+//#region src/wallet/solana-rpc-read-fetch.ts
+function normalizeRpcHostname(hostname) {
+	const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
+	return normalized.startsWith("[") && normalized.endsWith("]") ? normalized.slice(1, -1) : normalized;
+}
+function isLoopbackRpcHostname(hostname) {
+	const normalized = normalizeRpcHostname(hostname);
+	return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::1" || /^127(?:\.\d{1,3}){3}$/.test(normalized);
+}
+function isLoopbackRpcAddress(address) {
+	const normalized = normalizeRpcHostname(address);
+	return normalized === "::1" || normalized === "0:0:0:0:0:0:0:1" || /^127(?:\.\d{1,3}){3}$/.test(normalized) || /^::ffff:127(?:\.\d{1,3}){3}$/.test(normalized);
+}
+async function resolveWithTimeout(hostname, policy, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([resolvePinnedHostnameWithPolicy(hostname, { policy }), new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(new Error("stored Solana RPC hostname resolution timed out")), Math.max(250, timeoutMs));
+			timer.unref?.();
+		})]);
+	} finally {
+		if (timer) {
+			clearTimeout(timer);
+		}
+	}
+}
+async function fetchPinnedSolanaRpcRead(params) {
+	const parsed = new URL(params.rpcUrl);
+	const hostname = normalizeRpcHostname(parsed.hostname);
+	const loopback = isLoopbackRpcHostname(hostname);
+	if (!hostname || parsed.username || parsed.password || parsed.hash || parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback)) {
+		throw new Error("stored Solana RPC URL is not safe for Gateway reads");
+	}
+	const policy = {
+		hostnameAllowlist: [hostname],
+		...loopback ? { allowPrivateNetwork: true } : {}
+	};
+	const pinned = await resolveWithTimeout(hostname, policy, params.timeoutMs);
+	if (loopback && !pinned.addresses.every(isLoopbackRpcAddress)) {
+		throw new Error("stored Local Solana RPC hostname did not resolve only to loopback addresses");
+	}
+	const dispatcher = createPinnedDispatcher(pinned);
+	try {
+		const response = await fetch(parsed.toString(), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: params.body,
+			redirect: "error",
+			signal: AbortSignal.timeout(Math.max(250, params.timeoutMs)),
+			dispatcher
+		});
+		return {
+			response,
+			release: async () => closeDispatcher(dispatcher)
+		};
+	} catch (error) {
+		await closeDispatcher(dispatcher);
+		throw error;
+	}
+}
+
+//#endregion
+export { fetchPinnedSolanaRpcRead };

package/dist/wallet/wallet-status.js

@@ -28,6 +28,9 @@ async function readWalletStatusSnapshot(params) {
 	const checkedAt = new Date().toISOString();
 	let providerHealth = {
 		ok: false,
+		provider: providerId,
+		configured: false,
+		checkedAt,
 		details: "provider health probe unavailable"
 	};
 	let addresses;
@@ -53,6 +56,9 @@ async function readWalletStatusSnapshot(params) {
 	} catch (err) {
 		providerHealth = {
 			ok: false,
+			provider: providerId,
+			configured: false,
+			checkedAt,
 			details: walletDiagnosticErrorString(err)
 		};
 	}
@@ -90,6 +96,7 @@ async function readWalletStatusSnapshot(params) {
 			}
 		},
 		approvalAuth,
+		...providerHealth.nativeSignerApproval ? { nativeSignerApproval: providerHealth.nativeSignerApproval } : {},
 		addresses,
 		paths: {
 			rootDir: paths.rootDir,

package/dist/web/login-qr.js

@@ -5,8 +5,8 @@ import { loadConfig } from "../config/io.js";
 import "../config/config.js";
 import { logoutWeb, readWebSelfId, webAuthExists } from "./auth-store.js";
 import { resolveWhatsAppAccount } from "./accounts.js";
-import { createWaSocket, formatError, getStatusCode, waitForWaConnection } from "./session.js";
 import { renderQrPngBase64 } from "./qr-image.js";
+import { createWaSocket, formatError, getStatusCode, waitForWaConnection } from "./session.js";
 import { randomUUID } from "node:crypto";
 import { DisconnectReason } from "@whiskeysockets/baileys";
 

package/dist/wizard/onboarding.js

@@ -7,12 +7,13 @@ import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
 import { readConfigFileSnapshot, writeConfigFile } from "../config/io.js";
 import "../config/config.js";
 import "../agents/auth-profiles.js";
-import { ensureWalletStateDir, resolveLocalSignerControlSocketPath, resolveLocalSignerMaterialRootDir, resolveLocalSignerSocketPath } from "../wallet/wallet-runtime-config.js";
+import { ensureWalletStateDir, resolveLocalSignerMaterialRootDir, resolveLocalSignerSocketPath } from "../wallet/wallet-runtime-config.js";
 import { checkNamedWalletDeletionSafety, deleteNamedWallet, readWalletProviderRegistry, resolveWalletUserRole, setDefaultWallet, setNamedWalletRole, upsertNamedWallet } from "../wallet/wallet-provider-registry.js";
 import { DEFAULT_WORKSPACE, applyWizardMetadata, ensureWorkspaceAndSessions, handleOnboardingRepair, printWizardHeader, probeGatewayReachable, summarizeExistingConfig } from "../commands/onboard-helpers.js";
 import { configureSignerOwnedWalletNetwork } from "../wallet/signer-network-admin.js";
 import { configureWalletForOnboarding, installSignerdBinary, resolveSignerdBinaryPath, restartLocalSocketSigner } from "./onboarding.wallet.js";
-import { collectWalletSignerDoctorReport, walletSetupCommand } from "../commands/wallet.js";
+import { collectWalletSignerDoctorReport, walletRecoveryExportCommand, walletSetupCommand } from "../commands/wallet.js";
+import { lockSignerOwnedWalletForArchive } from "../wallet/local-socket-signer-archive.js";
 import { promptAuthChoiceGrouped } from "../commands/auth-choice-prompt.js";
 import { applyPrimaryModel, resolveAuthenticatedDefaultModel } from "../commands/model-picker.js";
 import { logConfigUpdated } from "../config/logging.js";
@@ -26,7 +27,6 @@ import { promptCustomApiConfig } from "../commands/onboard-custom.js";
 import { setupInternalHooks } from "../commands/onboard-hooks.js";
 import { promptRemoteGatewayConfig } from "../commands/onboard-remote.js";
 import { setupSkills } from "../commands/onboard-skills.js";
-import { lockSignerOwnedWalletForArchive } from "../wallet/local-socket-signer-archive.js";
 import { discoverSolanaNetworkFromRpc } from "../wallet/solana-network-discovery.js";
 import { isHostedSecurityCapableSession } from "./host-security-capability.js";
 import { noteBullet, noteCommand, noteHeading, noteLabel, noteStep, noteSuccess, noteWarn } from "./onboarding-note-format.js";
@@ -96,10 +96,6 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		}
 		return "FASED_WALLET_SOLANA_RPC_URL";
 	};
-	const executionFallbackRpcEnvKeyFor = (walletId) => {
-		const suffix = walletIdEnvSuffix(walletId);
-		return suffix ? `FASED_WALLET_SOLANA_EXECUTION_FALLBACK_RPC_URL__${suffix}` : "FASED_WALLET_SOLANA_EXECUTION_FALLBACK_RPC_URL";
-	};
 	const setConfigEnvVar = (cfg, key, value) => {
 		const vars = { ...cfg.env?.vars };
 		if (value == null || value === "") {
@@ -219,15 +215,6 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 		process.env[rpcKey] = effectiveRpcUrl;
 		return effectiveRpcUrl;
 	};
-	const firstNonEmptyEnvValue = (...values) => {
-		for (const value of values) {
-			const normalized = String(value ?? "").trim();
-			if (normalized) {
-				return normalized;
-			}
-		}
-		return undefined;
-	};
 	const readSatMiningConfig = (cfg) => {
 		const config = cfg.plugins?.entries?.["sat-mining"]?.config;
 		if (!config || typeof config !== "object" || Array.isArray(config)) {
@@ -991,28 +978,23 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 							currentValue: configuredSolanaRpcUrl
 						});
 						let signerNetworkVersion;
-						let signerNetworkRootCommand;
 						if (targetWallet.providerId === "local-socket-signer") {
 							const effectiveEnv = {
 								...process.env,
 								...nextConfig.env?.vars,
 								FASED_HOST_PROFILE: hostProfile
 							};
-							const walletSuffix = walletIdEnvSuffix(walletId);
-							const legacyExecutionFallbackKey = walletSuffix ? `FASED_WALLET_SOLANA_WRITE_RPC_FALLBACK_URL__${walletSuffix}` : "FASED_WALLET_SOLANA_WRITE_RPC_FALLBACK_URL";
-							const network = configureSignerOwnedWalletNetwork({
+							const network = await configureSignerOwnedWalletNetwork({
 								walletId,
 								primaryRpcUrl: effectiveSolanaRpcUrl,
-								executionFallbackRpcUrl: firstNonEmptyEnvValue(effectiveEnv[executionFallbackRpcEnvKeyFor(walletId)], effectiveEnv[legacyExecutionFallbackKey]),
 								env: effectiveEnv,
-								signerBinPath: hostProfile === "hosting" ? undefined : resolveSignerdBinaryPath(effectiveEnv)
+								socketPath: resolveLocalSignerSocketPath(effectiveEnv)
 							});
 							signerNetworkVersion = network.version;
-							signerNetworkRootCommand = network.rootCommand;
 						} else {
 							await restartLocalSocketSigner(ensureWalletStateDir(process.env).rootDir);
 						}
-						await prompter.note([`Updated the app-side Solana RPC setting for ${targetWallet.name} (${walletId})${signerNetworkVersion ? `; signer network version ${signerNetworkVersion} is ready` : "."}`, ...signerNetworkRootCommand ? ["The hosted signer was not changed because the app has no root channel. Activate the RPC from a root-owned file:", signerNetworkRootCommand] : []].join("\n"), "Wallet setup");
+						await prompter.note([`Updated the app-side Solana RPC setting for ${targetWallet.name} (${walletId})${signerNetworkVersion ? `; signer network version ${signerNetworkVersion} is ready` : "."}`].join("\n"), "Wallet setup");
 						addAnotherWallet = await prompter.confirm({
 							message: "Run another wallet setup action?",
 							initialValue: false
@@ -1160,8 +1142,8 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 				}
 				attemptedSelfHostedSetupThisRun = true;
 				const chain = "solana";
-				const walletPurpose = flow === "quickstart" && !snapshot.exists ? "agent" : await prompter.select({
-					message: "Wallet purpose",
+				const walletPurpose = await prompter.select({
+					message: "Wallet role (required)",
 					options: [
 						{
 							value: "agent",
@@ -1175,9 +1157,11 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 							value: "vault",
 							label: "Vault"
 						}
-					],
-					initialValue: "agent"
+					]
 				});
+				if (walletPurpose !== "agent" && walletPurpose !== "mining" && walletPurpose !== "vault") {
+					throw new Error("Wallet role selection is required; Agent is never selected silently.");
+				}
 				const selfHostedAction = await prompter.select({
 					message: "Wallet action",
 					options: [{
@@ -1193,7 +1177,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 					const existingMiningWalletId = satMiningAttachment.walletId ?? "";
 					const existingMiningWallet = readWalletProviderRegistry(process.env).wallets.find((wallet) => wallet.id === "mining");
 					if (existingMiningWalletId || existingMiningWallet) {
-						await prompter.note([`Mining wallet already exists: ${existingMiningWalletId || "mining"}.`, "Delete that Mining wallet from onboarding first if you want to replace it."].join("\n"), "Mining");
+						await prompter.note([`Mining wallet already exists: ${existingMiningWalletId || "mining"}.`, "Open it to continue, or use the reviewed Replace/Archive flow after mining is stopped, rewards and capital are settled, and backup/readiness checks pass."].join("\n"), "Mining");
 						addAnotherWallet = await prompter.confirm({
 							message: "Run another wallet setup action?",
 							initialValue: false
@@ -1201,39 +1185,31 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 						continue;
 					}
 				}
-				const mode = "local-signer-create";
+				const mode = selfHostedAction === "import" ? "local-signer-import" : "local-signer-create";
 				const walletIdentity = await resolveWalletIdentityForOnboarding({
 					flow,
 					purpose: walletPurpose
 				});
 				const walletName = walletIdentity.walletName;
 				const walletId = walletIdentity.walletId || undefined;
-				if (selfHostedAction === "import") {
-					const effectiveWalletId = walletId ?? walletPurpose;
-					const hosting = hostProfile === "hosting";
-					const signerBin = hosting ? "/opt/fased/signer/fased-signerd" : resolveSignerdBinaryPath();
-					const controlSocket = hosting ? "/run/fased-signerd/control.sock" : resolveLocalSignerControlSocketPath(process.env);
-					const signerImportCommand = [
-						shellQuote(signerBin),
-						"admin wallet import",
-						`--control-socket ${shellQuote(controlSocket)}`,
-						`--wallet-id ${shellQuote(effectiveWalletId)}`,
-						`--locked-role ${shellQuote(walletPurpose)}`,
-						`< ${shellQuote("/absolute/path/to/solana-keypair.json")}`
-					].join(" ");
-					const command = hosting ? `/usr/sbin/runuser -u fased-signer -- /usr/bin/env HOME=/var/lib/fased-signerd ${signerImportCommand}` : signerImportCommand;
+				if (selfHostedAction === "import" && hostProfile === "hosting") {
+					const signerWalletId = (walletId ?? walletPurpose).trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 					await prompter.note([
-						"The normal Gateway and Node wizard paths do not accept plaintext wallet keys. Local same-user isolation is not a hard compromise boundary; Hosting isolates the signer account.",
-						hosting ? "Open the VPS provider root console and run this root-administrator command. Do not run it from the app shell and do not grant app sudo:" : "Run this from an authenticated terminal on the signer host:",
-						command,
-						"Then rerun wallet setup and choose Manage wallet to register/verify the returned public address."
-					].join("\n"), "Native signer import");
+						"Hosting keeps plaintext wallet keys outside the app/Gateway OS account.",
+						"From the VPS provider root console, place the Solana keypair in /root/wallet.json with mode 600, then run:",
+						`/usr/local/sbin/fased-signer-wallet-import --wallet-id ${shellQuote(signerWalletId)} --locked-role ${shellQuote(walletPurpose)} < /root/wallet.json`,
+						"Return to the app account, rerun onboarding, and choose Create with the same role and wallet ID. The signer reuses only that exact existing deny-all wallet, then activates the one RPC and registers it."
+					].join("\n"), "Signer-owned Hosting import");
 					addAnotherWallet = await prompter.confirm({
 						message: "Run another wallet setup action?",
 						initialValue: false
 					});
 					continue;
 				}
+				const importFile = selfHostedAction === "import" ? (await prompter.text({
+					message: "Absolute path to owner-only Solana keypair JSON",
+					validate: (value) => value.trim().startsWith("/") ? undefined : "Enter an absolute path and run chmod 600 on the file first"
+				})).trim() : undefined;
 				const rpcKey = rpcEnvKeyFor(chain, walletId);
 				const currentRpcValue = (nextConfig.env?.vars?.[rpcKey] ?? "").trim() || String(process.env[rpcKey] ?? "").trim();
 				const rpcUrlInput = (await prompter.text({
@@ -1245,8 +1221,6 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 				if (!effectiveRpcUrl) {
 					throw new Error(`${chain.toUpperCase()} RPC URL is required for wallets.`);
 				}
-				nextConfig = setConfigEnvVar(nextConfig, rpcKey, effectiveRpcUrl);
-				process.env[rpcKey] = effectiveRpcUrl;
 				try {
 					if (mode === "local-signer-create") {
 						try {
@@ -1256,6 +1230,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 								walletId,
 								walletName,
 								rpcUrl: effectiveRpcUrl,
+								role: walletPurpose,
 								force: true,
 								noDoctor: true,
 								noSignerHints: true,
@@ -1277,6 +1252,7 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 									walletId,
 									walletName,
 									rpcUrl: effectiveRpcUrl,
+									role: walletPurpose,
 									force: true,
 									noDoctor: true,
 									noSignerHints: true,
@@ -1286,17 +1262,22 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 								throw err;
 							}
 						}
-						if (hostProfile === "hosting") {
-							const nativeWalletId = (walletId ?? walletPurpose).trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-							await prompter.note([
-								"The wallet key was created inside the root-managed signer with deny-all policy.",
-								"The Gateway has no sudo or root control socket, so RPC activation is a separate host-administrator step.",
-								"From a provider/root console, copy the installed network template to a root-owned mode-0600 file, set the exact RPC URLs, then run:",
-								`/usr/local/sbin/fased-signer-network --wallet-id ${nativeWalletId} --network-file /root/fased-network.json`,
-								"Signing stays disabled until network activation, owner enrollment, and an explicit positive-cap policy all succeed."
-							].join("\n"), "Hosted wallet owner handoff");
-						}
+					} else {
+						await walletSetupCommand(runtime, {
+							mode,
+							chain,
+							walletId,
+							walletName,
+							role: walletPurpose,
+							rpcUrl: effectiveRpcUrl,
+							importFile,
+							noDoctor: true,
+							noSignerHints: true,
+							nonInteractive: true
+						});
 					}
+					nextConfig = setConfigEnvVar(nextConfig, rpcKey, effectiveRpcUrl);
+					process.env[rpcKey] = effectiveRpcUrl;
 					walletCeremonyEvents.push({
 						mode,
 						chain,
@@ -1307,6 +1288,25 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 						ok: true
 					});
 					createdOrImportedSelfHostedWalletThisRun = true;
+					if (hostProfile !== "hosting") {
+						const exportRecovery = await prompter.confirm({
+							message: "Create an encrypted recovery package now?",
+							initialValue: true
+						});
+						if (exportRecovery) {
+							const defaultRecoveryPath = path.join(process.env.HOME || process.cwd(), `fased-${walletId ?? walletPurpose}-recovery.json`);
+							const recoveryOutput = (await prompter.text({
+								message: "New encrypted recovery package path",
+								initialValue: defaultRecoveryPath,
+								validate: (value) => path.isAbsolute(value.trim()) ? undefined : "Enter an absolute path for a new file"
+							})).trim();
+							await walletRecoveryExportCommand(runtime, {
+								walletId: walletId ?? walletPurpose,
+								output: recoveryOutput
+							});
+							await prompter.note([`Encrypted recovery package: ${recoveryOutput}`, "Keep the recovery password separately. The file contains ciphertext, wallet id, role, public address, and format metadata; it never contains plaintext key material."].join("\n"), "Wallet recovery");
+						}
+					}
 					const agentDefaultBefore = readAgentDefaultWallet();
 					const existingWallet = readWalletProviderRegistry(process.env).wallets.find((entry) => entry.id === walletId);
 					upsertNamedWallet({

package/extensions/acpx/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/acpx",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent ACP runtime backend via acpx",
   "type": "module",
   "dependencies": {

package/extensions/bluebubbles/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/bluebubbles",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent BlueBubbles channel plugin",
   "type": "module",
   "fased": {

package/extensions/copilot-proxy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/copilot-proxy",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "FasedAgent Copilot Proxy provider plugin",
   "type": "module",