@fased/fased 0.1.66 → 0.1.68

package/extensions/diagnostics-otel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/diagnostics-otel",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent diagnostics OpenTelemetry exporter",
   "type": "module",
   "dependencies": {

package/extensions/fased-federation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/fased-federation",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "Fased federation adapter package scaffold (A2A + admission helpers)",
   "type": "module",

package/extensions/google-gemini-cli-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/google-gemini-cli-auth",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "FasedAgent Gemini CLI OAuth provider plugin",
   "type": "module",

package/extensions/imessage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/imessage",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "FasedAgent iMessage channel plugin",
   "type": "module",

package/extensions/irc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/irc",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent IRC channel plugin",
   "type": "module",
   "fased": {

package/extensions/line/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/line",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "FasedAgent LINE channel plugin",
   "type": "module",

package/extensions/llm-task/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/llm-task",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "FasedAgent JSON-only LLM task plugin",
   "type": "module",

package/extensions/lobster/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/lobster",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "Lobster workflow tool plugin (typed pipelines + resumable approvals)",
   "type": "module",
   "fased": {

package/extensions/matrix/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.68
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
+## 0.1.67
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
 ## 0.1.66
 
 ### Changes

package/extensions/matrix/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/matrix",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent Matrix channel plugin",
   "type": "module",
   "dependencies": {

package/extensions/mattermost/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/mattermost",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent Mattermost channel plugin",
   "type": "module",
   "fased": {

package/extensions/memory-core/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@fased/memory-core",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "FasedAgent core memory search plugin",
   "type": "module",
   "peerDependencies": {
-    "@fased/fased": "^0.1.66"
+    "@fased/fased": "^0.1.68"
   },
   "fased": {
     "extensions": [

package/extensions/memory-lancedb/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/memory-lancedb",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "FasedAgent LanceDB-backed long-term memory plugin with auto-recall/capture",
   "type": "module",

package/extensions/minimax-portal-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/minimax-portal-auth",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "FasedAgent MiniMax Portal OAuth provider plugin",
   "type": "module",

package/extensions/msteams/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.68
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
+## 0.1.67
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
 ## 0.1.66
 
 ### Changes

package/extensions/msteams/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/msteams",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent Microsoft Teams channel plugin",
   "type": "module",
   "dependencies": {

package/extensions/nextcloud-talk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/nextcloud-talk",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent Nextcloud Talk channel plugin",
   "type": "module",
   "fased": {

package/extensions/nostr/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.68
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
+## 0.1.67
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
 ## 0.1.66
 
 ### Changes

package/extensions/nostr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/nostr",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent Nostr channel plugin for NIP-04 encrypted DMs",
   "type": "module",
   "dependencies": {

package/extensions/open-prose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/open-prose",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "OpenProse VM skill pack plugin (slash command + telemetry).",
   "type": "module",

package/extensions/sat-mining/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/sat-mining",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "SAT mining plugin scaffold for FasedAgent",
   "type": "module",

package/extensions/signal/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/signal",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": true,
   "description": "FasedAgent Signal channel plugin",
   "type": "module",

package/extensions/synology-chat/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/synology-chat",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "Synology Chat channel plugin for FasedAgent",
   "type": "module",
   "dependencies": {

package/extensions/tlon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/tlon",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent Tlon/Urbit channel plugin",
   "type": "module",
   "dependencies": {

package/extensions/twitch/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.68
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
+## 0.1.67
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
 ## 0.1.66
 
 ### Changes

package/extensions/twitch/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/twitch",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent Twitch channel plugin",
   "type": "module",
   "dependencies": {

package/extensions/voice-call/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.68
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
+## 0.1.67
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
 ## 0.1.66
 
 ### Changes

package/extensions/voice-call/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/voice-call",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent voice-call plugin",
   "type": "module",
   "dependencies": {

package/extensions/zalo/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.68
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
+## 0.1.67
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
 ## 0.1.66
 
 ### Changes

package/extensions/zalo/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/zalo",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent Zalo channel plugin",
   "type": "module",
   "dependencies": {

package/extensions/zalouser/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.68
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
+## 0.1.67
+
+### Changes
+
+- Version alignment with core FasedAgent release numbers.
+
 ## 0.1.66
 
 ### Changes

package/extensions/zalouser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/zalouser",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "FasedAgent Zalo Personal Account plugin via zca-cli",
   "type": "module",
   "dependencies": {

package/fased.mjs

@@ -2,7 +2,20 @@
 
 import module from "node:module";
 import { fileURLToPath } from "node:url";
-import { reexecWithSupportedNodeIfNeeded } from "./scripts/fased-launcher-runtime.mjs";
+
+if (process.platform === "win32") {
+  console.error(
+    [
+      "Native Windows is not a supported Fased runtime.",
+      "Install Ubuntu in WSL2, enable systemd, and run Fased inside the Ubuntu shell.",
+      "PowerShell is supported only for installing WSL2 or connecting to a remote Linux VPS.",
+      "Guide: https://docs.fased.ai/platforms/windows",
+    ].join("\n"),
+  );
+  process.exit(1);
+}
+
+const { reexecWithSupportedNodeIfNeeded } = await import("./scripts/fased-launcher-runtime.mjs");
 
 reexecWithSupportedNodeIfNeeded({ selfPath: fileURLToPath(import.meta.url) });
 

package/install.sh

@@ -37,15 +37,14 @@ fi
 
 if [[ "$install_entry_is_stream" -eq 1 && "$install_entry_hosting" -eq 1 ]]; then
   echo "Refusing streamed VPS Hosting execution." >&2
-  echo "Download and verify the exact tagged install.sh before execution:" >&2
-  echo "  https://docs.fased.ai/install/vps" >&2
+  echo "Download and verify an exact tagged release installer before running --hosting or --repair-hosting." >&2
   exit 1
 fi
 
-# A Hosting request always enters the attest-and-extract bootstrap unless it is
+# A Hosting file request enters the attest-and-extract bootstrap unless it is
 # the exact inner invocation carrying the root-owned verified bundle marker.
-# Streamed Hosting was rejected above; standalone Hosting must be downloaded
-# and verified before execution.
+# Streamed Hosting was rejected above; streamed execution reaches this block
+# only for the non-root Local bootstrap.
 if [[ "$install_entry_is_stream" -eq 1 || \
   ( "$install_entry_hosting" -eq 1 && -z "$install_entry_verified_bundle" ) ]]; then
   install_repo_url="${FASED_INSTALL_REPO:-https://github.com/fased-ai/fased.git}"
@@ -98,6 +97,10 @@ if [[ "$install_entry_is_stream" -eq 1 || \
     esac
   done
 
+  if [[ "$hosting_bootstrap" -eq 1 && "$hosting_repair_bootstrap" -eq 0 && -z "$hosting_release" ]]; then
+    hosting_release="latest"
+  fi
+
   bootstrap_as_root() {
     if [[ "$(id -u)" -eq 0 ]]; then
       "$@"
@@ -175,11 +178,10 @@ if [[ "$install_entry_is_stream" -eq 1 || \
       echo "Refusing a caller-supplied verified bundle marker." >&2
       exit 1
     fi
-    if [[ -z "$hosting_release" ]]; then
-      echo "VPS Hosting requires an explicit tagged release." >&2
-      echo "Pass --release vX.Y.Z (recommended) or --release latest." >&2
+    [[ -n "$hosting_release" ]] || {
+      echo "VPS Hosting release resolution failed before verification." >&2
       exit 1
-    fi
+    }
 
     install_hosting_bootstrap_tools() {
       [[ "$auto_install" -eq 1 ]] || return 0
@@ -4241,7 +4243,8 @@ ensure_host_boundary_accounts() {
   rm -f \
     "/etc/sudoers.d/fased-install-${target_user}" \
     "/etc/sudoers.d/fased-host-maintenance-${target_user}" \
-    "/etc/sudoers.d/fased-gateway-${target_user}-maintenance"
+    "/etc/sudoers.d/fased-gateway-${target_user}-maintenance" \
+    "/etc/sudoers.d/fased-signer-wallet-import-${target_user}"
   if need_cmd sudo && runuser -u "$target_user" -- sudo -n true >/dev/null 2>&1; then
     echo "Hosting security boundary cannot use an app account with passwordless sudo: $target_user" >&2
     echo "Remove custom sudoers access for this dedicated account, then rerun the exact tagged repair from the provider root console." >&2
@@ -4289,6 +4292,7 @@ install_host_signer_and_updater_services() {
   install -m 0755 -o root -g root "$FASED_DIR/scripts/fased-signer-enroll-hosting.sh" /usr/local/sbin/fased-signer-enroll
   install -m 0755 -o root -g root "$FASED_DIR/scripts/fased-signer-policy-hosting.sh" /usr/local/sbin/fased-signer-policy
   install -m 0755 -o root -g root "$FASED_DIR/scripts/fased-signer-network-hosting.sh" /usr/local/sbin/fased-signer-network
+  install -m 0755 -o root -g root "$FASED_DIR/scripts/fased-signer-wallet-import-hosting.sh" /usr/local/sbin/fased-signer-wallet-import
   install -m 0644 -o root -g root "$FASED_DIR/config/signer-policies/README.md" /usr/local/share/fased/signer-policies/README.md
   install -m 0644 -o root -g root "$FASED_DIR/config/signer-policies/agent.json.template" /usr/local/share/fased/signer-policies/agent.json.template
   install -m 0644 -o root -g root "$FASED_DIR/config/signer-policies/mining.json.template" /usr/local/share/fased/signer-policies/mining.json.template
@@ -4358,6 +4362,7 @@ EOF
   sync -f /usr/local/sbin/fased-signer-enroll
   sync -f /usr/local/sbin/fased-signer-policy
   sync -f /usr/local/sbin/fased-signer-network
+  sync -f /usr/local/sbin/fased-signer-wallet-import
   sync -f /usr/local/share/fased/signer-policies/README.md
   sync -f /usr/local/share/fased/signer-policies/agent.json.template
   sync -f /usr/local/share/fased/signer-policies/mining.json.template
@@ -4631,6 +4636,7 @@ assert_verified_hosting_root_source() {
     scripts/fased-host-updaterctl.mjs \
     scripts/fased-signer-enroll-hosting.sh \
     scripts/fased-signer-network-hosting.sh \
+    scripts/fased-signer-wallet-import-hosting.sh \
     scripts/fased-signer-policy-hosting.sh; do
     local asset_path="$canonical_source/$privileged_asset"
     [[ -f "$asset_path" && ! -L "$asset_path" ]] || {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fased/fased",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "Fased Agent self-hosted AI gateway with channels, tools, plugins, and operator modules",
   "keywords": [
     "ai-agent",
@@ -46,6 +46,7 @@
     "scripts/fased-host-updaterctl.mjs",
     "scripts/fased-signer-enroll-hosting.sh",
     "scripts/fased-signer-network-hosting.sh",
+    "scripts/fased-signer-wallet-import-hosting.sh",
     "scripts/fased-signer-owner-policy.mjs",
     "scripts/fased-signer-policy-hosting.sh",
     "scripts/fased-signer-policy-local.sh",
@@ -81,6 +82,10 @@
     "!extensions/runtime-openai/",
     "!extensions/runtime-speech/"
   ],
+  "os": [
+    "linux",
+    "darwin"
+  ],
   "type": "module",
   "main": "dist/index.js",
   "exports": {

package/scripts/fased-managed-updater.mjs

@@ -291,7 +291,9 @@ async function downloadToFile(url, destination, timeoutMs) {
     cache: "no-store",
   });
   if (!response.ok || !response.body) {
-    throw new Error(`Download failed (${response.status}): ${url}`);
+    const error = new Error(`Download failed (${response.status}): ${url}`);
+    error.statusCode = response.status;
+    throw error;
   }
   await fsp.mkdir(path.dirname(destination), { recursive: true });
   await pipeline(
@@ -3372,7 +3374,7 @@ async function updateManagedRuntime(options) {
     try {
       let unifiedRelease = null;
       let unifiedReleasePath = null;
-      if (existingManifest.profile === "hosting") {
+      try {
         unifiedReleasePath = path.join(temporaryRoot, "fased-hosted-release-v2.json");
         await measureStage(timings, "unified release manifest", async () => {
           await downloadToFile(
@@ -3387,6 +3389,12 @@ async function updateManagedRuntime(options) {
             await readHostedReleaseManifestV2(unifiedReleasePath, { version: targetVersion })
           ).manifest;
         });
+      } catch (error) {
+        if (existingManifest.profile === "hosting" || error?.statusCode !== 404) {
+          throw error;
+        }
+        unifiedReleasePath = null;
+        unifiedRelease = null;
       }
       const appArtifact = unifiedRelease?.application?.linux?.[arch]?.artifact;
       const assetName =

package/scripts/fased-signer-wallet-import-hosting.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+umask 077
+PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+export PATH
+
+if [[ "${EUID}" != "0" ]]; then
+  echo "Hosted signer wallet import requires the VPS provider root console." >&2
+  exit 1
+fi
+
+wallet_id=""
+locked_role=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --wallet-id)
+      [[ $# -ge 2 ]] || { echo "missing --wallet-id value" >&2; exit 64; }
+      wallet_id="$2"
+      shift 2
+      ;;
+    --locked-role)
+      [[ $# -ge 2 ]] || { echo "missing --locked-role value" >&2; exit 64; }
+      locked_role="$2"
+      shift 2
+      ;;
+    *)
+      echo "unsupported hosted wallet-import argument" >&2
+      exit 64
+      ;;
+  esac
+done
+
+[[ "$wallet_id" =~ ^[a-z0-9_]{1,64}$ ]] || {
+  echo "wallet id must already be normalized lowercase letters, numbers, or underscores" >&2
+  exit 64
+}
+case "$locked_role" in
+  agent|mining|vault) ;;
+  *) echo "locked role must be agent, mining, or vault" >&2; exit 64 ;;
+esac
+
+signer_bin="/opt/fased/signer/fased-signerd"
+control_socket="/run/fased-signerd/control.sock"
+runuser_bin="/usr/sbin/runuser"
+env_bin="/usr/bin/env"
+stat_bin="/usr/bin/stat"
+signer_user="fased-signer"
+
+for executable in "$signer_bin" "$runuser_bin" "$env_bin" "$stat_bin"; do
+  [[ -f "$executable" && -x "$executable" && ! -L "$executable" ]] || {
+    echo "required hosted signer executable is missing or unsafe" >&2
+    exit 1
+  }
+  read -r owner mode <<<"$($stat_bin -Lc '%u %a' "$executable")"
+  [[ "$owner" == "0" && $((8#$mode & 8#22)) -eq 0 ]] || {
+    echo "required hosted signer executable is not root-owned and non-writable" >&2
+    exit 1
+  }
+done
+
+[[ -S "$control_socket" && ! -L "$control_socket" ]] || {
+  echo "hosted signer control socket is unavailable" >&2
+  exit 1
+}
+
+# The root-console caller supplies only a new wallet id, an immutable role, and
+# one keypair on stdin. The signer creates a deny-all policy and refuses
+# replacement. The app/Gateway account has no sudo rule for this helper.
+exec "$runuser_bin" -u "$signer_user" -- \
+  "$env_bin" -i \
+  HOME=/var/lib/fased-signerd \
+  LANG=C.UTF-8 \
+  PATH=/usr/bin:/bin:/usr/sbin:/sbin \
+  "$signer_bin" admin wallet import \
+  --control-socket "$control_socket" \
+  --wallet-id "$wallet_id" \
+  --locked-role "$locked_role"

package/scripts/install-managed-runtime.mjs

@@ -220,15 +220,15 @@ export async function installManagedRuntime(params, dependencyOverrides = {}) {
     ...dependencyOverrides,
   };
   const paths = resolveManagedRuntimePaths(params);
+  const profile = normalizeManagedProfile(params.profile);
   const existingManifest = readManagedInstallManifest(paths.manifestPath);
   const version = await assertManagedRuntime(params.packageRoot);
   const metadata = await readHostedRuntimeMetadata(params.packageRoot);
-  const hostedRelease = await readHostedReleaseBinding(params.packageRoot, metadata, version);
-  if (
-    normalizeManagedProfile(params.profile) === "hosting" &&
-    params.hostTransactionId &&
-    !hostedRelease
-  ) {
+  const hostedRelease =
+    profile === "hosting"
+      ? await readHostedReleaseBinding(params.packageRoot, metadata, version)
+      : null;
+  if (profile === "hosting" && params.hostTransactionId && !hostedRelease) {
     throw new Error(
       "Maintained Hosting requires an attested unified app and signer release manifest.",
     );
@@ -399,7 +399,10 @@ export async function rollbackManagedRuntime(params) {
   const previousVersion = await assertManagedRuntime(previousRoot);
   const currentVersion = await readPackageVersion(currentRoot);
   const metadata = await readHostedRuntimeMetadata(previousRoot);
-  const hostedRelease = await readHostedReleaseBinding(previousRoot, metadata, previousVersion);
+  const hostedRelease =
+    normalizeManagedProfile(manifest.profile) === "hosting"
+      ? await readHostedReleaseBinding(previousRoot, metadata, previousVersion)
+      : null;
 
   await atomicSymlink(currentRoot, paths.previousLink);
   await atomicSymlink(previousRoot, paths.currentLink);