@fased/fased 0.1.9 → 0.1.11

package/dist/{onboarding-CowfhJUD.js → onboarding-Cxkh1WwH.js}

@@ -1,7 +1,7 @@
 import { _ as resolveStateDir, n as DEFAULT_GATEWAY_PORT, u as resolveGatewayPort } from "./paths-C9FmTW1x.js";
 import { S as resolveUserPath, U as theme } from "./agent-paths-BySKyq9I.js";
 import { Ga as ensureAuthProfileStore, Mn as writeConfigFile, Zr as collectConfigServiceEnvVars, d as resolveDefaultAgentId, dd as formatCliCommand, fr as ensureActiveMemoryPluginAllowlisted, kn as readConfigFileSnapshot, u as resolveAgentWorkspaceDir } from "./agent-scope-CLn_Ws3B.js";
-import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-C3PsVpeQ.js";
+import { Bt as detectBrowserOpenSupport, Ht as formatControlUiSshHint, Jt as openUrl, Lt as DEFAULT_WORKSPACE, Mo as runFederationAutoConnectOnce, Qo as findTailscaleBinary, Qt as resolveControlUiLinks, Rt as applyWizardMetadata, Vt as ensureWorkspaceAndSessions, Wt as handleOnboardingRepair, Xo as enableTailscaleFunnel, Xt as probeGatewayReachable, Yt as printWizardHeader, Zo as enableTailscaleServe, Zt as randomToken, en as summarizeExistingConfig, nn as waitForGatewayReachable, qt as normalizeGatewayTokenInput, tn as validateGatewayPasswordInput, xo as normalizeControlUiBasePath, yo as CONTROL_UI_BOOT_CHECK_PATH } from "./reply-CBhrmRrH.js";
 import { d as defaultRuntime, f as restoreTerminalState, s as redactSensitiveText } from "./errors-Dx3S3Nrp.js";
 import { a as resolveSignerdBinaryPath, n as installSignerdBinary, o as restartLocalSocketSigner, r as migrateLocalSignerKeystoreToMaterialDir, t as configureWalletForOnboarding } from "./onboarding.wallet-B12p7GUZ.js";
 import { i as resolveLocalSignerRunAsUser, n as resolveLocalSignerBackendSocketPath, o as resolveLocalSignerSocketPath, r as resolveLocalSignerMaterialRootDir, t as ensureWalletStateDir } from "./wallet-runtime-config-BlRWvEER.js";
@@ -17,14 +17,14 @@ import { a as resolveHostedOnboardingGatewayStartupMode, i as resolveGatewayStar
 import { d as buildSystemdUnit, r as isSystemdUserServiceAvailable } from "./systemd-ZvgpcrfV.js";
 import { t as resolveGatewayService } from "./service-DbZp-Ejz.js";
 import { n as auditGatewayServiceConfig, t as SERVICE_AUDIT_CODES } from "./service-audit-B5uApPZ5.js";
-import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-CBSPFYQB.js";
-import { o as waitForHostedDashboardBrowserPath } from "./health-gyJixAyN.js";
-import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-CEeiz47B.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-FJDk83bS.js";
+import { a as promptRemoteGatewayConfig, n as getTailscaleMissingBinNoteLines, r as setupSkills, t as validateIPv4AddressInput, u as promptCustomApiConfig } from "./ipv4-DgQOUcwH.js";
+import { o as waitForHostedDashboardBrowserPath } from "./health-DQlfle1u.js";
+import { n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-DPEogMvC.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-CzCpmXZF.js";
 import { n as logConfigUpdated } from "./logging-C8GVa7dS.js";
-import { n as setupChannels } from "./onboard-channels-gHaSwzTd.js";
+import { n as setupChannels } from "./onboard-channels-Doc5AjLd.js";
 import { t as buildWorkspaceHookStatus } from "./hooks-status-CrTowaUt.js";
-import { t as runTui } from "./tui-B5xfA4bO.js";
+import { t as runTui } from "./tui-m7pkF_Gw.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -358,34 +358,61 @@ function buildOnboardingDashboardUrl(params) {
 	url.hash = hash ? `#${hash}` : "";
 	return url.toString();
 }
+function noteHeading$1(value) {
+	return theme.heading(value.toUpperCase());
+}
+function noteLabel(value) {
+	return theme.accentBright(value);
+}
+function noteInfo$1(value) {
+	return theme.info(value);
+}
+function noteSuccess$1(value) {
+	return theme.success(value);
+}
+function noteWarn$1(value) {
+	return theme.warn(value);
+}
+function noteMuted(value) {
+	return theme.muted(value);
+}
+function noteCommand$1(value) {
+	return theme.command(value);
+}
+function noteBullet$1(value) {
+	return `- ${value}`;
+}
+function formatFasedNetworkAutoConnectSummary(messages) {
+	return [noteHeading$1("Connection confirmed"), ...messages.map((message) => noteBullet$1(noteSuccess$1(message)))].join("\n");
+}
 function formatStrictRemoteAccessDetails(params) {
 	const sshTarget = params.tailscaleNodeName || params.tailscaleIpv4 || "(tailscale-node)";
 	const tailscaleIpv4 = params.tailscaleIpv4?.trim();
 	const hasIpFallback = Boolean(tailscaleIpv4 && tailscaleIpv4 !== sshTarget);
 	return [
-		"Use both access paths after hosted setup:",
+		noteInfo$1("Use both access paths after hosted setup:"),
 		"",
-		"1. WEB DASHBOARD",
-		"   Open this on your own computer after signing into the same Tailscale account:",
-		`   ${params.dashboardUrl}`,
+		noteHeading$1("1. Web dashboard"),
+		`   ${noteInfo$1("Open this on your own computer after signing into the same Tailscale account:")}`,
+		`   ${noteCommand$1(params.dashboardUrl)}`,
 		"",
-		"2. SSH TERMINAL",
-		"   Use this for CLI commands, updates, logs, and repairs over Tailscale:",
-		`   ssh ${params.tailscaleSshUser}@${sshTarget}`,
-		hasIpFallback ? `   If hostname DNS fails but Tailscale IP ping works, use: ssh ${params.tailscaleSshUser}@${tailscaleIpv4}` : void 0,
-		"   The app user shell opens in the Fased repo directory.",
+		noteHeading$1("2. SSH terminal"),
+		`   ${noteInfo$1("Use this for CLI commands, updates, logs, and repairs over Tailscale:")}`,
+		`   ${noteCommand$1(`ssh ${params.tailscaleSshUser}@${sshTarget}`)}`,
+		hasIpFallback ? `   ${noteWarn$1("If hostname DNS fails but Tailscale IP ping works, use:")} ${noteCommand$1(`ssh ${params.tailscaleSshUser}@${tailscaleIpv4}`)}` : void 0,
+		`   ${noteInfo$1("The app user shell opens in the Fased repo directory.")}`,
 		"",
-		"ADVANCED FALLBACK",
-		"   If the Tailscale web URL is unavailable, run this on your local computer and leave it open:",
-		`   ssh -N -L ${params.port}:127.0.0.1:${params.port} ${params.tailscaleSshUser}@${sshTarget}`,
-		hasIpFallback ? `   If a VPN blocks MagicDNS hostname lookup, use: ssh -N -L ${params.port}:127.0.0.1:${params.port} ${params.tailscaleSshUser}@${tailscaleIpv4}` : void 0,
-		"   Then open:",
-		`   ${params.tunnelUrl}`,
-		hasIpFallback ? "   Note: another VPN can break Tailscale MagicDNS while raw 100.x Tailscale IP access still works." : void 0,
+		noteHeading$1("Advanced fallback"),
+		`   ${noteInfo$1("If the Tailscale web URL is unavailable, run this on your local computer and leave it open:")}`,
+		`   ${noteCommand$1(`ssh -N -L ${params.port}:127.0.0.1:${params.port} ${params.tailscaleSshUser}@${sshTarget}`)}`,
+		hasIpFallback ? `   ${noteWarn$1("If a VPN blocks MagicDNS hostname lookup, use:")} ${noteCommand$1(`ssh -N -L ${params.port}:127.0.0.1:${params.port} ${params.tailscaleSshUser}@${tailscaleIpv4}`)}` : void 0,
+		`   ${noteInfo$1("Then open:")}`,
+		`   ${noteCommand$1(params.tunnelUrl)}`,
+		hasIpFallback ? `   ${noteWarn$1("Note: another VPN can break Tailscale MagicDNS while raw 100.x Tailscale IP access still works.")}` : void 0,
 		"",
-		"GATEWAY TOKEN BACKUP",
-		"   Only paste this if the browser asks for a token:",
-		`   ${params.gatewayToken || "(token not available)"}`
+		noteHeading$1("Gateway token backup"),
+		`   ${noteWarn$1("Only paste this if the browser asks for a token:")}`,
+		`   ${noteCommand$1(params.gatewayToken || "(token not available)")}`
 	].filter((line) => line !== void 0).join("\n");
 }
 function formatLocalDashboardReady(params) {
@@ -1670,11 +1697,12 @@ async function finalizeOnboardingWizard(options) {
 			}
 		}
 		if (strictVps) await prompter.note([
-			"Hosted runtime is private by default.",
+			noteHeading$1("Private access"),
+			noteInfo$1("Hosted runtime is private by default."),
 			"",
-			"Web dashboard: Tailscale HTTPS URL.",
-			"SSH terminal: ssh app@YOUR_VPS_TAILSCALE_NAME over Tailscale.",
-			"Public SSH and Gateway ports remain blocked."
+			`${noteLabel("Web dashboard:")} ${noteCommand$1("Tailscale HTTPS URL")}`,
+			`${noteLabel("SSH terminal:")} ${noteCommand$1("ssh app@YOUR_VPS_TAILSCALE_NAME")} ${noteInfo$1("over Tailscale")}`,
+			noteBullet$1(noteWarn$1("Public SSH and Gateway ports remain blocked."))
 		].join("\n"), "Hosting access");
 		if ((strictVps || expectedGatewayStartupMode === "managed-up") && !autoStartEnabled && !opts.allowInsecure) throw new Error(formatPersistentRuntimeServiceFailure({
 			strictVps,
@@ -2115,12 +2143,13 @@ async function finalizeOnboardingWizard(options) {
 				if (!warmup.ok) {
 					const detail = warmup.detail ?? "not reachable yet";
 					await prompter.note([
-						"The Tailscale HTTPS dashboard URL is still warming from this VPS.",
-						`Detail: ${detail}`,
+						noteHeading$1("Tailscale HTTPS"),
+						noteWarn$1("The Tailscale HTTPS dashboard URL is still warming from this VPS."),
+						`${noteMuted("Detail:")} ${noteInfo$1(detail)}`,
 						"",
-						"Setup will continue if the local Gateway listener is healthy.",
-						"Open the printed Tailscale URL from your own Tailscale-connected computer.",
-						"If another VPN breaks MagicDNS, turn it off or use the 100.x Tailscale IP fallback."
+						noteBullet$1(noteSuccess$1("Setup will continue if the local Gateway listener is healthy.")),
+						noteBullet$1(noteInfo$1("Open the printed Tailscale URL from your own Tailscale-connected computer.")),
+						noteBullet$1(noteWarn$1("If another VPN breaks MagicDNS, turn it off or use the 100.x Tailscale IP fallback."))
 					].join("\n"), "Dashboard warmup");
 					return;
 				}
@@ -2140,12 +2169,13 @@ async function finalizeOnboardingWizard(options) {
 					pollMs: 1500
 				});
 				if (!wsWarmup.ok) await prompter.note([
-					"The Tailscale dashboard page is reachable, but the browser Gateway connection is still warming.",
-					`Gateway URL: ${tailscaleGatewayWsUrl}`,
-					`Detail: ${"stage" in wsWarmup ? `${wsWarmup.stage}: ${wsWarmup.message}` : wsWarmup.detail ?? "websocket not reachable"}`,
+					noteHeading$1("Gateway connection"),
+					noteWarn$1("The Tailscale dashboard page is reachable, but the browser Gateway connection is still warming."),
+					`${noteLabel("Gateway URL:")} ${noteCommand$1(tailscaleGatewayWsUrl)}`,
+					`${noteMuted("Detail:")} ${noteInfo$1("stage" in wsWarmup ? `${wsWarmup.stage}: ${wsWarmup.message}` : wsWarmup.detail ?? "websocket not reachable")}`,
 					"",
-					"Setup will continue if the local Gateway listener is healthy.",
-					"Use the SSH tunnel fallback immediately, or open the Tailscale dashboard URL again shortly."
+					noteBullet$1(noteSuccess$1("Setup will continue if the local Gateway listener is healthy.")),
+					noteBullet$1(noteInfo$1("Use the SSH tunnel fallback immediately, or open the Tailscale dashboard URL again shortly."))
 				].join("\n"), "Dashboard warmup");
 				else hostedDashboardBrowserVerified = true;
 			});
@@ -2207,12 +2237,15 @@ async function finalizeOnboardingWizard(options) {
 	if (federation.enabled) {
 		let hostedFederationAutoConnectAttempted = false;
 		let hostedFederationAutoConnectReason = "";
+		const hostedFederationAutoConnectMessages = [];
 		if (strictVps && !readManagedFederationTokenSummary(onboardingEnv).exists) {
 			hostedFederationAutoConnectAttempted = true;
 			hostedFederationAutoConnectReason = (await runFederationAutoConnectOnce({
 				env: onboardingEnv,
 				log: {
-					info: (message) => runtime.log(message),
+					info: (message) => {
+						hostedFederationAutoConnectMessages.push(message);
+					},
 					warn: (message) => {
 						hostedFederationAutoConnectReason = message;
 					},
@@ -2231,12 +2264,13 @@ async function finalizeOnboardingWizard(options) {
 			reservations: readManagedReservationSummaries(onboardingEnv)
 		};
 		if (fedToken.exists && !persistedFederationToken) persistedFederationToken = await loadPersistedFederationToken(onboardingEnv).catch(() => null);
+		if (strictVps && hostedFederationAutoConnectAttempted && hostedFederationAutoConnectMessages.length > 0) await prompter.note(formatFasedNetworkAutoConnectSummary(hostedFederationAutoConnectMessages), "Fased Network");
 		if (strictVps && hostedFederationAutoConnectAttempted && !fedToken.exists) await prompter.note([
-			"Fased Network silent join did not finish.",
-			hostedFederationAutoConnectReason ? `Reason: ${hostedFederationAutoConnectReason}` : "Reason: token was not issued before final readiness.",
-			reservations.length > 0 ? `Reservation: ${reservations[0]?.slug}` : void 0,
-			"Dashboard and SSH are ready over Tailscale.",
-			"Inspect details: `fased managed up --json`"
+			noteWarn$1("Fased Network silent join did not finish."),
+			hostedFederationAutoConnectReason ? `${noteMuted("Reason:")} ${noteInfo$1(hostedFederationAutoConnectReason)}` : `${noteMuted("Reason:")} ${noteInfo$1("token was not issued before final readiness.")}`,
+			reservations.length > 0 ? `${noteMuted("Reservation:")} ${noteCommand$1(reservations[0]?.slug ?? "")}` : void 0,
+			noteSuccess$1("Dashboard and SSH are ready over Tailscale."),
+			`${noteMuted("Inspect details:")} ${noteCommand$1("fased managed up --json")}`
 		].filter(Boolean).join("\n"), "Fased Network");
 	}
 	const operatorReadiness = describeOperatorReadinessChecklist({
@@ -2282,16 +2316,17 @@ async function finalizeOnboardingWizard(options) {
 					detail: finalGateway.detail ?? "final gateway recheck timed out"
 				};
 				await prompter.note([
-					serviceActive ? "The hosted Gateway service is active, but the dashboard is still warming." : "The hosted browser dashboard passed its full check earlier.",
-					`Detail: ${finalGateway.detail ?? "gateway not reachable yet"}`,
+					noteHeading$1("Service active"),
+					serviceActive ? noteWarn$1("The hosted Gateway service is active, but the dashboard is still warming.") : noteInfo$1("The hosted browser dashboard passed its full check earlier."),
+					`${noteMuted("Detail:")} ${noteInfo$1(finalGateway.detail ?? "gateway not reachable yet")}`,
 					"",
-					"Setup will finish and leave the Gateway service running.",
-					"Open the printed Tailscale dashboard URL again in a few minutes.",
-					"If MagicDNS is slow or another VPN is active, use the 100.x Tailscale IP fallback.",
+					noteBullet$1(noteSuccess$1("Setup will finish and leave the Gateway service running.")),
+					noteBullet$1(noteInfo$1("Open the printed Tailscale dashboard URL again in a few minutes.")),
+					noteBullet$1(noteWarn$1("If MagicDNS is slow or another VPN is active, use the 100.x Tailscale IP fallback.")),
 					"",
-					"Check from the app terminal:",
-					"fased status",
-					"fased dashboard --no-open"
+					noteHeading$1("Check from the app terminal"),
+					noteCommand$1("fased status"),
+					noteCommand$1("fased dashboard --no-open")
 				].join("\n"), "Dashboard warmup");
 				return;
 			}
@@ -3251,9 +3286,9 @@ async function applyHostingSecurity(params) {
 			detail: "post-bootstrap hosted maintenance session; skipping host hardening bootstrap"
 		};
 		let tsAuthkey = opts.tsAuthkey?.trim() ?? "";
-		if (!tsAuthkey) if (await prompter.confirm({
-			message: "Use a Tailscale auth key instead of browser login? (advanced)",
-			initialValue: false
+		if (!tsAuthkey) if (!await prompter.confirm({
+			message: "Use browser login for Tailscale? (recommended)",
+			initialValue: true
 		})) tsAuthkey = (typeof prompter.secret === "function" ? await prompter.secret({
 			message: "Paste Tailscale auth key (tskey-auth-...)",
 			validate: (value) => value.trim() ? void 0 : "Required"
@@ -3426,9 +3461,9 @@ async function applyHostingSecurity(params) {
 	if (!tsHealthy) {
 		let tsAuthkey = opts.tsAuthkey?.trim() ?? "";
 		if (!tsAuthkey && opts.nonInteractive !== true && prompter) {
-			if (await prompter.confirm({
-				message: "Use a Tailscale auth key instead of browser login? (advanced)",
-				initialValue: false
+			if (!await prompter.confirm({
+				message: "Use browser login for Tailscale? (recommended)",
+				initialValue: true
 			})) tsAuthkey = (typeof prompter.secret === "function" ? await prompter.secret({
 				message: "Paste Tailscale auth key (tskey-auth-...)",
 				validate: (value) => value.trim() ? void 0 : "Required"
@@ -5187,9 +5222,11 @@ async function runOnboardingWizard(opts, runtime = defaultRuntime, prompter) {
 	};
 	if (hostSecurity.profile === "hosting" && hostSecurity.checks.length > 0) {
 		const lines = [
-			"Hosting security checklist:",
-			...hostSecurity.checks.map((check) => `${check.ok ? "✓" : "✗"} ${check.name}: ${check.detail}`),
-			hostSecurity.logPath ? `Detailed host hardening log: ${hostSecurity.logPath}` : void 0
+			theme.heading("HOSTING SECURITY CHECKLIST"),
+			"",
+			...hostSecurity.checks.map((check) => `${check.ok ? theme.success("✓") : theme.error("✗")} ${theme.accentBright(check.name)}: ${check.ok ? theme.info(check.detail) : theme.error(check.detail)}`),
+			"",
+			hostSecurity.logPath ? `${theme.muted("Detailed host hardening log:")} ${theme.command(hostSecurity.logPath)}` : void 0
 		];
 		await prompter.note(lines.filter(Boolean).join("\n"), "Host security");
 	}

package/dist/{openresponses-http-BBydvP41.js → openresponses-http-BL1pUdQf.js}

@@ -2,7 +2,7 @@ import { bd as logWarn } from "./env-Dlz8aQHP.js";
 import "./agent-paths-DUHGyU1s.js";
 import "./send-Ditv1VfR.js";
 import "./send-CWM2yWF6.js";
-import { Ai as buildAgentMessageFromConversationEntries, Ii as resolveAssistantStreamDeltaText, Li as agentCommand, _a as resolveAgentIdForRequest, an as DEFAULT_INPUT_IMAGE_MAX_BYTES, ba as setSseHeaders, cn as DEFAULT_INPUT_TIMEOUT_MS, dn as normalizeMimeList, fn as resolveInputFileLimits, ia as emitAgentEvent, ki as handleGatewayPostJsonEndpoint, ln as extractFileContentFromSource, oa as onAgentEvent, on as DEFAULT_INPUT_IMAGE_MIMES, sn as DEFAULT_INPUT_MAX_REDIRECTS, un as extractImageContentFromSource, va as resolveSessionKey, xa as writeDone, ya as sendJson } from "./model-catalog-DfLJlqO8.js";
+import { Ai as buildAgentMessageFromConversationEntries, Ii as resolveAssistantStreamDeltaText, Li as agentCommand, _a as resolveAgentIdForRequest, an as DEFAULT_INPUT_IMAGE_MAX_BYTES, ba as setSseHeaders, cn as DEFAULT_INPUT_TIMEOUT_MS, dn as normalizeMimeList, fn as resolveInputFileLimits, ia as emitAgentEvent, ki as handleGatewayPostJsonEndpoint, ln as extractFileContentFromSource, oa as onAgentEvent, on as DEFAULT_INPUT_IMAGE_MIMES, sn as DEFAULT_INPUT_MAX_REDIRECTS, un as extractImageContentFromSource, va as resolveSessionKey, xa as writeDone, ya as sendJson } from "./model-catalog-D4rEoh5e.js";
 import "./github-copilot-token-A9DiaCB0.js";
 import { A as defaultRuntime } from "./entry.js";
 import "./reply-prefix-CCp0C8w4.js";
@@ -45,7 +45,7 @@ import "./send-Dlj2DghK.js";
 import "./outbound-attachment-D2ImFzcm.js";
 import "./fetch-BqA-KBI4.js";
 import "./delivery-queue-CMGPhIoF.js";
-import { t as createDefaultDeps } from "./deps-D9aJvXyD.js";
+import { t as createDefaultDeps } from "./deps-5PYELVCT.js";
 import "./frontmatter-DTw-J9er.js";
 import "./skills-CzDvK09q.js";
 import "./skills-remote-CM9uNuu4.js";

package/dist/{openresponses-http-D42SXipZ.js → openresponses-http-CzuT0O2I.js}

@@ -1,39 +1,39 @@
-import { Ui as logWarn, wa as defaultRuntime } from "./agent-scope-DVw8mi_i.js";
-import "./github-copilot-token-DYrFvncE.js";
-import "./send-6RE7ZD_B.js";
-import "./send-DD6K3WP6.js";
-import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-BqhMzKsb.js";
-import "./diagnostic-DWKSfm_q.js";
+import { Ui as logWarn, wa as defaultRuntime } from "./agent-scope-T2X-I1lP.js";
+import "./github-copilot-token-eyrRGmGp.js";
+import "./send-M0lHXvC5.js";
+import "./send-D63evlEI.js";
+import { $ as emitAgentEvent, B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as setSseHeaders, et as onAgentEvent, i as resolveAssistantStreamDeltaText, it as sendJson, n as handleGatewayPostJsonEndpoint, nt as resolveAgentIdForRequest, ot as writeDone, r as buildAgentMessageFromConversationEntries, rt as resolveSessionKey, tt as createDefaultDeps, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-D2PqvAO_.js";
+import "./diagnostic-PXNTTbiu.js";
 import "./diagnostic-session-state-CexmAKza.js";
-import "./send-BVmNzYrR.js";
-import "./media-D4nEnyX9.js";
-import "./pi-model-discovery-DpUv4v_r.js";
-import "./paths-0bvQb_LS.js";
+import "./send-B8seeqjd.js";
+import "./media-KeWZMCmf.js";
+import "./pi-model-discovery-B1-QPAbn.js";
+import "./paths-C2qpRqKS.js";
 import "./ssrf-DYsl9qoS.js";
-import "./reply-prefix-CteprwTK.js";
-import "./path-alias-guards-BgsaoH-B.js";
-import "./fs-safe--dkmYAev.js";
-import "./skill-commands-_zLgADck.js";
-import "./chunk-BFGwq8HC.js";
-import "./markdown-tables-7kI-7mng.js";
-import "./send-BAtDZt7a.js";
-import "./fetch-guard-Ztzfiio9.js";
-import "./outbound-attachment-BnC5ITTB.js";
-import "./fetch-DyKd0D6V.js";
-import "./memory-search-Z2b0d-jA.js";
-import "./manager-XJq9ONvb.js";
-import "./query-expansion-LNmYRPvI.js";
-import "./target-errors-DrHV8jza.js";
+import "./reply-prefix-BM90m-1s.js";
+import "./path-alias-guards-BVcGMct5.js";
+import "./fs-safe-CkRcL-Cg.js";
+import "./skill-commands-D_QLBtje.js";
+import "./chunk-Q3WlKwcl.js";
+import "./markdown-tables-QOHpjP76.js";
+import "./send-CAqldeiP.js";
+import "./fetch-guard-B-XqKRhJ.js";
+import "./outbound-attachment-DO7UVxZm.js";
+import "./fetch-D6yXePhv.js";
+import "./memory-search-BVlFBMLd.js";
+import "./manager-O_PUm8xA.js";
+import "./query-expansion-BW1RomSn.js";
+import "./target-errors-B-8Jf9OT.js";
 import "./render-BRr7caFG.js";
-import "./commands-registry-C7qLmjBS.js";
-import "./config-eval-CG37crOn.js";
-import "./send-BG45zdAY.js";
-import "./resolve-route-Twc4mQV7.js";
-import "./channel-activity-D2IwnDWk.js";
-import "./tables-Dtfop_e5.js";
+import "./commands-registry-CwvSkARW.js";
+import "./config-eval-BMGRKCyr.js";
+import "./send-BPleg3km.js";
+import "./resolve-route-DyTOJJs4.js";
+import "./channel-activity-C0DEUhUn.js";
+import "./tables-Cif1OeQ1.js";
 import "./proxy-DkRPPIHD.js";
 import "./config-CtKjZZ4x.js";
-import "./replies-D0__mn7d.js";
+import "./replies-lgWzXlwM.js";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 

package/dist/{openresponses-http-C66CR36w.js → openresponses-http-DCHdi7mF.js}

@@ -2,7 +2,7 @@ import "./paths-C9FmTW1x.js";
 import "./agent-paths-BySKyq9I.js";
 import { au as logWarn } from "./agent-scope-CLn_Ws3B.js";
 import "./commands-registry-DfzoWf4b.js";
-import { Er as onAgentEvent, G as DEFAULT_INPUT_TIMEOUT_MS, H as DEFAULT_INPUT_IMAGE_MAX_BYTES, J as normalizeMimeList, Ja as sendJson, K as extractFileContentFromSource, Ka as resolveAgentIdForRequest, U as DEFAULT_INPUT_IMAGE_MIMES, W as DEFAULT_INPUT_MAX_REDIRECTS, Xa as writeDone, Y as resolveInputFileLimits, Ya as setSseHeaders, ft as handleGatewayPostJsonEndpoint, ht as agentCommand, mt as resolveAssistantStreamDeltaText, pt as buildAgentMessageFromConversationEntries, q as extractImageContentFromSource, qa as resolveSessionKey, wr as emitAgentEvent } from "./reply-C3PsVpeQ.js";
+import { Er as onAgentEvent, G as DEFAULT_INPUT_TIMEOUT_MS, H as DEFAULT_INPUT_IMAGE_MAX_BYTES, J as normalizeMimeList, Ja as sendJson, K as extractFileContentFromSource, Ka as resolveAgentIdForRequest, U as DEFAULT_INPUT_IMAGE_MIMES, W as DEFAULT_INPUT_MAX_REDIRECTS, Xa as writeDone, Y as resolveInputFileLimits, Ya as setSseHeaders, ft as handleGatewayPostJsonEndpoint, ht as agentCommand, mt as resolveAssistantStreamDeltaText, pt as buildAgentMessageFromConversationEntries, q as extractImageContentFromSource, qa as resolveSessionKey, wr as emitAgentEvent } from "./reply-CBhrmRrH.js";
 import { d as defaultRuntime } from "./errors-Dx3S3Nrp.js";
 import "./send-DI5jsj-s.js";
 import "./send-Dg2_aoK-.js";
@@ -37,7 +37,7 @@ import "./ssrf-Blf4NrHS.js";
 import "./outbound-attachment-BHTb_aF7.js";
 import "./fetch-BJWQWfdf.js";
 import "./delivery-queue-9lp1uujZ.js";
-import { t as createDefaultDeps } from "./deps-ddWLkZAO.js";
+import { t as createDefaultDeps } from "./deps-7Xjk7uTn.js";
 import "./memory-e9aOXNx1.js";
 import "./memory-search-B8y2GTeB.js";
 import "./manager-DI2w66Ae.js";

package/dist/{openresponses-http-CdO4hFg_.js → openresponses-http-DQ3c6n1-.js}

@@ -2,7 +2,7 @@ import { Sa as defaultRuntime, Vi as logWarn } from "./agent-scope-VtywltNx.js";
 import "./github-copilot-token-CNsqwfnE.js";
 import "./send-BIYMEcFp.js";
 import "./send-vYtmO4dA.js";
-import { B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as sendJson, et as emitAgentEvent, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, tt as onAgentEvent, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-DLEbV2ey.js";
+import { B as DEFAULT_INPUT_IMAGE_MIMES, G as normalizeMimeList, H as DEFAULT_INPUT_TIMEOUT_MS, K as resolveInputFileLimits, U as extractFileContentFromSource, V as DEFAULT_INPUT_MAX_REDIRECTS, W as extractImageContentFromSource, a as agentCommand, at as sendJson, et as emitAgentEvent, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, tt as onAgentEvent, z as DEFAULT_INPUT_IMAGE_MAX_BYTES } from "./pi-embedded-Bqi9f0et.js";
 import "./reply-prefix-bCs4xRE_.js";
 import "./diagnostic-BkUPEf9c.js";
 import "./diagnostic-session-state-CL_QxyRg.js";

package/dist/{openresponses-http-One5KNo8.js → openresponses-http-MJ14c-46.js}

@@ -1,6 +1,6 @@
 import "./github-copilot-token-Dy7Y_jbI.js";
 import { la as logWarn, qo as defaultRuntime } from "./paths-tN5PnNK1.js";
-import { B as extractImageContentFromSource, F as DEFAULT_INPUT_IMAGE_MAX_BYTES, H as resolveInputFileLimits, I as DEFAULT_INPUT_IMAGE_MIMES, L as DEFAULT_INPUT_MAX_REDIRECTS, R as DEFAULT_INPUT_TIMEOUT_MS, V as normalizeMimeList, X as emitAgentEvent, Z as onAgentEvent, a as agentCommand, at as sendJson, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, z as extractFileContentFromSource } from "./auth-DIBzLQ-S.js";
+import { B as extractImageContentFromSource, F as DEFAULT_INPUT_IMAGE_MAX_BYTES, H as resolveInputFileLimits, I as DEFAULT_INPUT_IMAGE_MIMES, L as DEFAULT_INPUT_MAX_REDIRECTS, R as DEFAULT_INPUT_TIMEOUT_MS, V as normalizeMimeList, X as emitAgentEvent, Z as onAgentEvent, a as agentCommand, at as sendJson, i as resolveAssistantStreamDeltaText, it as resolveSessionKey, n as handleGatewayPostJsonEndpoint, nt as createDefaultDeps, ot as setSseHeaders, r as buildAgentMessageFromConversationEntries, rt as resolveAgentIdForRequest, st as writeDone, z as extractFileContentFromSource } from "./auth-CmR3RRfx.js";
 import "./send-DwNxlwDd.js";
 import "./send-TMsshhGX.js";
 import "./skill-commands-Bp7DhFz2.js";

package/dist/{outbound-attachment-BnC5ITTB.js → outbound-attachment-DO7UVxZm.js}

@@ -1,5 +1,5 @@
-import { ds as resolveConfigDir } from "./agent-scope-DVw8mi_i.js";
-import { _ as extensionForMime, g as detectMime, n as loadWebMedia } from "./media-D4nEnyX9.js";
+import { ds as resolveConfigDir } from "./agent-scope-T2X-I1lP.js";
+import { _ as extensionForMime, g as detectMime, n as loadWebMedia } from "./media-KeWZMCmf.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import crypto from "node:crypto";

package/dist/{outbound-vYt3OL7q.js → outbound-nrqaUQPn.js}

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { Gt as loadConfig, Ms as getChildLogger, as as escapeRegExp, k as createSubsystemLogger, ys as toWhatsappJid } from "./agent-scope-DVw8mi_i.js";
+import { Gt as loadConfig, Ms as getChildLogger, as as escapeRegExp, k as createSubsystemLogger, ys as toWhatsappJid } from "./agent-scope-T2X-I1lP.js";
 import { n as generateSecureUuid } from "./secure-random-CSsVRTTy.js";
 import { t as redactIdentifier } from "./redact-identifier-Cy6Tnhkn.js";
-import { n as loadWebMedia } from "./media-D4nEnyX9.js";
-import { n as resolveMarkdownTableMode } from "./markdown-tables-7kI-7mng.js";
+import { n as loadWebMedia } from "./media-KeWZMCmf.js";
+import { n as resolveMarkdownTableMode } from "./markdown-tables-QOHpjP76.js";
 import { n as normalizePollInput } from "./polls-CYTwXmA1.js";
-import { t as convertMarkdownTables } from "./tables-Dtfop_e5.js";
-import { n as requireActiveWebListener } from "./active-listener-BC05EmaA.js";
-import { n as formatError } from "./session-CHL2ptKy.js";
+import { t as convertMarkdownTables } from "./tables-Cif1OeQ1.js";
+import { n as requireActiveWebListener } from "./active-listener-CNrLAfOg.js";
+import { n as formatError } from "./session-Cvg_ryor.js";
 
 //#region src/markdown/whatsapp.ts
 /**

package/dist/{parent-default-help-82dOtJ5b.js → parent-default-help-BKBeFc1_.js}

@@ -1,6 +1,6 @@
 import { Gl as listChannelPlugins, Vf as CHAT_CHANNEL_ORDER, t as isTruthyEnvValue } from "./env-Dlz8aQHP.js";
 import { d as listChannelPluginCatalogEntries } from "./dangerous-name-matching-ob0tR02Y.js";
-import { t as ensurePluginRegistryLoaded } from "./plugin-registry-DgnprUWu.js";
+import { t as ensurePluginRegistryLoaded } from "./plugin-registry-VukRFBIJ.js";
 
 //#region src/cli/channel-options.ts
 function dedupe(values) {

package/dist/{parent-default-help-iR__S_d8.js → parent-default-help-BRMZI4YX.js}

@@ -1,6 +1,6 @@
 import { Cd as isTruthyEnvValue, Nu as listChannelPlugins, jf as CHAT_CHANNEL_ORDER } from "./agent-scope-CLn_Ws3B.js";
 import { c as listChannelPluginCatalogEntries } from "./dangerous-name-matching-B2YH8EDF.js";
-import { t as ensurePluginRegistryLoaded } from "./plugin-registry-DgLnDYKc.js";
+import { t as ensurePluginRegistryLoaded } from "./plugin-registry-CmfUTKxt.js";
 
 //#region src/cli/channel-options.ts
 function dedupe(values) {

package/dist/{path-alias-guards-BgsaoH-B.js → path-alias-guards-BVcGMct5.js}

@@ -1,4 +1,4 @@
-import { Di as BOUNDARY_PATH_ALIAS_POLICIES, Oi as resolveBoundaryPath, Wi as isNotFoundPathError } from "./agent-scope-DVw8mi_i.js";
+import { Di as BOUNDARY_PATH_ALIAS_POLICIES, Oi as resolveBoundaryPath, Wi as isNotFoundPathError } from "./agent-scope-T2X-I1lP.js";
 import fs from "node:fs/promises";
 import os from "node:os";
 

package/dist/{paths-0bvQb_LS.js → paths-C2qpRqKS.js}

@@ -1,15 +1,15 @@
-import { Fs as resolvePreferredFasedAgentTmpDir, Gi as isPathInside, Gt as loadConfig, Ni as isErrno, Wi as isNotFoundPathError, es as CONFIG_DIR, k as createSubsystemLogger } from "./agent-scope-DVw8mi_i.js";
+import { Fs as resolvePreferredFasedAgentTmpDir, Gi as isPathInside, Gt as loadConfig, Ni as isErrno, Wi as isNotFoundPathError, es as CONFIG_DIR, k as createSubsystemLogger } from "./agent-scope-T2X-I1lP.js";
 import { a as resolvePinnedHostnameWithPolicy, c as isLoopbackIpAddress, l as normalizeIpAddress, s as isIpInCidr } from "./ssrf-DYsl9qoS.js";
-import { n as openFileWithinRoot, t as SafeOpenError } from "./fs-safe--dkmYAev.js";
+import { n as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-CkRcL-Cg.js";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import fs$1 from "node:fs";
+import syncFs from "node:fs";
 import { createHmac } from "node:crypto";
 import { execFileSync, spawn } from "node:child_process";
 import { createServer } from "node:http";
 import net from "node:net";
-import WebSocket, { WebSocketServer } from "ws";
+import WebSocket$1, { WebSocketServer } from "ws";
 import { Buffer as Buffer$1 } from "node:buffer";
 
 //#region src/browser/constants.ts
@@ -270,7 +270,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 		let extensionWs = null;
 		const cdpClients = /* @__PURE__ */ new Set();
 		const connectedTargets = /* @__PURE__ */ new Map();
-		const extensionConnected = () => extensionWs?.readyState === WebSocket.OPEN;
+		const extensionConnected = () => extensionWs?.readyState === WebSocket$1.OPEN;
 		let extensionDisconnectCleanupTimer = null;
 		const extensionReconnectWaiters = /* @__PURE__ */ new Set();
 		const flushExtensionReconnectWaiters = (connected) => {
@@ -321,7 +321,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 		let nextExtensionId = 1;
 		const sendToExtension = async (payload) => {
 			const ws = extensionWs;
-			if (!ws || ws.readyState !== WebSocket.OPEN) throw new Error("Chrome extension not connected");
+			if (!ws || ws.readyState !== WebSocket$1.OPEN) throw new Error("Chrome extension not connected");
 			ws.send(JSON.stringify(payload));
 			return await new Promise((resolve, reject) => {
 				const timer = setTimeout(() => {
@@ -338,12 +338,12 @@ async function ensureChromeExtensionRelayServer(opts) {
 		const broadcastToCdpClients = (evt) => {
 			const msg = JSON.stringify(evt);
 			for (const ws of cdpClients) {
-				if (ws.readyState !== WebSocket.OPEN) continue;
+				if (ws.readyState !== WebSocket$1.OPEN) continue;
 				ws.send(msg);
 			}
 		};
 		const sendResponseToCdp = (ws, res) => {
-			if (ws.readyState !== WebSocket.OPEN) return;
+			if (ws.readyState !== WebSocket$1.OPEN) return;
 			ws.send(JSON.stringify(res));
 		};
 		const ensureTargetEventsForClient = (ws, mode) => {
@@ -553,7 +553,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 					rejectUpgrade(socket, 401, "Unauthorized");
 					return;
 				}
-				if (extensionWs && extensionWs.readyState !== WebSocket.OPEN) {
+				if (extensionWs && extensionWs.readyState !== WebSocket$1.OPEN) {
 					try {
 						extensionWs.terminate();
 					} catch {}
@@ -590,7 +590,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 			clearExtensionDisconnectCleanupTimer();
 			flushExtensionReconnectWaiters(true);
 			const ping = setInterval(() => {
-				if (ws.readyState !== WebSocket.OPEN) return;
+				if (ws.readyState !== WebSocket$1.OPEN) return;
 				ws.send(JSON.stringify({ method: "ping" }));
 			}, 5e3);
 			ws.on("message", (data) => {
@@ -932,7 +932,7 @@ async function fetchOk(url, timeoutMs = 1500, init) {
 }
 async function withCdpSocket(wsUrl, fn, opts) {
 	const headers = getHeadersWithAuth(wsUrl, opts?.headers ?? {});
-	const ws = new WebSocket(wsUrl, {
+	const ws = new WebSocket$1(wsUrl, {
 		handshakeTimeout: typeof opts?.handshakeTimeoutMs === "number" && Number.isFinite(opts.handshakeTimeoutMs) ? Math.max(1, Math.floor(opts.handshakeTimeoutMs)) : 5e3,
 		...Object.keys(headers).length ? { headers } : {}
 	});
@@ -1140,7 +1140,7 @@ async function snapshotAria(opts) {
 const LSOF_CANDIDATES = process.platform === "darwin" ? ["/usr/sbin/lsof", "/usr/bin/lsof"] : ["/usr/bin/lsof", "/usr/sbin/lsof"];
 function resolveLsofCommandSync() {
 	for (const candidate of LSOF_CANDIDATES) try {
-		fs$1.accessSync(candidate, fs$1.constants.X_OK);
+		syncFs.accessSync(candidate, syncFs.constants.X_OK);
 		return candidate;
 	} catch {}
 	return "lsof";
@@ -1255,7 +1255,7 @@ const CHROMIUM_EXE_NAMES = new Set([
 ]);
 function exists$1(filePath) {
 	try {
-		return fs$1.existsSync(filePath);
+		return syncFs.existsSync(filePath);
 	} catch {
 		return false;
 	}
@@ -1398,7 +1398,7 @@ function findDesktopFilePath(desktopId) {
 }
 function readDesktopExecLine(desktopPath) {
 	try {
-		const lines = fs$1.readFileSync(desktopPath, "utf8").split(/\r?\n/);
+		const lines = syncFs.readFileSync(desktopPath, "utf8").split(/\r?\n/);
 		for (const line of lines) if (line.startsWith("Exec=")) return line.slice(5).trim();
 	} catch {}
 	return null;
@@ -1658,8 +1658,8 @@ function decoratedMarkerPath(userDataDir) {
 }
 function safeReadJson(filePath) {
 	try {
-		if (!fs$1.existsSync(filePath)) return null;
-		const raw = fs$1.readFileSync(filePath, "utf-8");
+		if (!syncFs.existsSync(filePath)) return null;
+		const raw = syncFs.readFileSync(filePath, "utf-8");
 		const parsed = JSON.parse(raw);
 		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
 		return parsed;
@@ -1668,8 +1668,8 @@ function safeReadJson(filePath) {
 	}
 }
 function safeWriteJson(filePath, data) {
-	fs$1.mkdirSync(path.dirname(filePath), { recursive: true });
-	fs$1.writeFileSync(filePath, JSON.stringify(data, null, 2));
+	syncFs.mkdirSync(path.dirname(filePath), { recursive: true });
+	syncFs.writeFileSync(filePath, JSON.stringify(data, null, 2));
 }
 function setDeep(obj, keys, value) {
 	let node = obj;
@@ -1796,7 +1796,7 @@ function decorateFasedAgentProfile(userDataDir, opts) {
 	}
 	safeWriteJson(preferencesPath, prefs);
 	try {
-		fs$1.writeFileSync(decoratedMarkerPath(userDataDir), `${Date.now()}\n`, "utf-8");
+		syncFs.writeFileSync(decoratedMarkerPath(userDataDir), `${Date.now()}\n`, "utf-8");
 	} catch {}
 }
 function ensureProfileCleanExit(userDataDir) {
@@ -1812,7 +1812,7 @@ function ensureProfileCleanExit(userDataDir) {
 const log = createSubsystemLogger("browser").child("chrome");
 function exists(filePath) {
 	try {
-		return fs$1.existsSync(filePath);
+		return syncFs.existsSync(filePath);
 	} catch {
 		return false;
 	}
@@ -1858,7 +1858,7 @@ async function getChromeWebSocketUrl(cdpUrl, timeoutMs = 500) {
 async function canOpenWebSocket(wsUrl, timeoutMs = 800) {
 	return await new Promise((resolve) => {
 		const headers = getHeadersWithAuth(wsUrl);
-		const ws = new WebSocket(wsUrl, {
+		const ws = new WebSocket$1(wsUrl, {
 			handshakeTimeout: timeoutMs,
 			...Object.keys(headers).length ? { headers } : {}
 		});
@@ -1892,7 +1892,7 @@ async function launchFasedAgentChrome(resolved, profile) {
 	const exe = resolveBrowserExecutable(resolved);
 	if (!exe) throw new Error("No supported browser found (Chrome/Brave/Edge/Chromium on macOS, Linux, or Windows).");
 	const userDataDir = resolveFasedAgentUserDataDir(profile.name);
-	fs$1.mkdirSync(userDataDir, { recursive: true });
+	syncFs.mkdirSync(userDataDir, { recursive: true });
 	const needsDecorate = !isProfileDecorated(userDataDir, profile.name, (profile.color ?? DEFAULT_FASED_BROWSER_COLOR).toUpperCase());
 	const spawnOnce = () => {
 		const args = [