@autifyhq/aximo-cli 0.3.0 → 0.4.0

package/README.md

@@ -73,6 +73,7 @@ Run `aximo <command> --help` for detailed usage. `aximo schema [command.path]` r
 | `aximo session get`          | Get session status                                   |
 | `aximo session save-as-case` | Save a finished session as a reusable test case      |
 | `aximo case create`          | Create a test case                                   |
+| `aximo case delete`          | Delete a test case                                   |
 | `aximo plan create`          | Create a test plan                                   |
 | `aximo plan add-case`        | Add a case to a plan                                 |
 | `aximo plan remove-case`     | Remove a case from a plan                            |
@@ -140,13 +141,15 @@ aximo case create --project-id <id> --scenario <text> \
   [--format gherkin|markdown|plain_text] [--start-url <url>] \
   [--directory-id <id>] [--json '<body>'] [--dry-run]
 
+aximo case delete <caseId> [--dry-run]
+
 aximo session save-as-case <sessionId> \
   [--title <t>] [--type web|mobile|desktop] \
   [--scenario <text>] [--format gherkin|markdown|plain_text] \
   [--json '<body>'] [--dry-run]
 ```
 
-`case create` returns a `caseId` you can run with `aximo trigger case run`. `session save-as-case` persists a finished session (terminal status, not yet linked to a case) as a reusable case, carrying over its scenario and run config. Cases created either way have API access enabled by default, so they are triggerable immediately.
+`case create` returns a `caseId` you can run with `aximo trigger case run`. `session save-as-case` persists a finished session (terminal status, not yet linked to a case) as a reusable case, carrying over its scenario and run config. Cases created either way have API access enabled by default, so they are triggerable immediately. `case delete` permanently removes a case: it is dropped from any plans it belongs to, and past run sessions are kept but detached.
 
 ### Test plans
 
@@ -247,6 +250,33 @@ aximo device connect     # start the agent; keep the terminal open while tests r
 
 Your device shows up in the Aximo UI under **Settings → Devices** with status `online` while connected. In the session form, pick your device as the execution target; Aximo routes the agent's actions through the tunnel to your machine.
 
+### Self-hosted servers (self-signed / custom CA)
+
+On-prem Aximo servers often present a self-signed certificate (a private "Aximo CA"). BYOD has **two** TLS clients: the Node CLI (API calls) and the embedded Python desktop agent (the `wss://…/devices/tunnel` relay). They trust a custom CA differently, so configure both:
+
+```bash
+# 1. Save the server's CA on this machine (or copy aximo-ca.pem from your admin).
+openssl s_client -connect YOUR_SERVER:8443 -showcerts </dev/null 2>/dev/null \
+  | awk '/BEGIN CERTIFICATE/{i++} i==2{print} /END CERTIFICATE/{if(i==2) exit}' > ~/aximo-ca.pem
+
+# 2. Point the CLI (Node) at it. Used for API calls AND auto-forwarded to the agent.
+export NODE_EXTRA_CA_CERTS="$HOME/aximo-ca.pem"
+
+aximo device connect
+```
+
+With `NODE_EXTRA_CA_CERTS` set, `device connect` automatically builds a combined trust store (the embedded Python's `certifi` roots **plus** your CA) and points the agent at it via `SSL_CERT_FILE`, so the relay connection verifies without extra steps.
+
+To override the agent's trust store explicitly, set `SSL_CERT_FILE` yourself. It must include public roots **and** your CA — `SSL_CERT_FILE` replaces the entire store, so your CA alone would break any other TLS the agent does (browser launch, uploads):
+
+```bash
+PYBIN="$HOME/.aximo/python/bin/python3"
+cat "$($PYBIN -m certifi)" ~/aximo-ca.pem > ~/.aximo/agent-ca-bundle.pem
+export SSL_CERT_FILE="$HOME/.aximo/agent-ca-bundle.pem"
+```
+
+Persist whichever variables you use in your shell profile. Public-CA servers (e.g. `aximo.autify.com`) need none of this.
+
 ### Managing devices
 
 ```bash
@@ -382,7 +412,7 @@ claude mcp add aximo -- aximo mcp
 
 VS Code (Copilot agent mode) uses the same entry under a `servers` key in `.vscode/mcp.json`.
 
-The server exposes 15 tools: 10 read-only ones for inspecting sessions and cases (`aximo_get_session_timeline` is the load-bearing one for Playwright export) plus 5 that author content (create cases and plans, save a session as a case). See the [MCP reference](./skills/aximo-cli/references/mcp.md) for per-client config paths, the full tool table, the Playwright export prompt, and a no-client smoke test.
+The server exposes 16 tools: 10 read-only ones for inspecting sessions and cases (`aximo_get_session_timeline` is the load-bearing one for Playwright export) plus 6 that author content (create and delete cases, create plans, save a session as a case). See the [MCP reference](./skills/aximo-cli/references/mcp.md) for per-client config paths, the full tool table, the Playwright export prompt, and a no-client smoke test.
 
 ## Agent Skills
 

package/dist/commands/case/case.test.js

@@ -1,6 +1,7 @@
 import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
 import { HttpResponse, http, server, TEST_BASE_URL } from "../../test-utils.js";
 import { runCaseCreate } from "./create.js";
+import { runCaseDelete } from "./delete.js";
 beforeAll(() => {
     process.env["AXIMO_API_KEY"] = "test-key";
     process.env["AXIMO_BASE_URL"] = TEST_BASE_URL;
@@ -84,3 +85,36 @@ describe("runCaseCreate", () => {
             expect(result.error.code).toBe("not_found");
     });
 });
+describe("runCaseDelete", () => {
+    it("DELETEs the case path and returns success", async () => {
+        let called = false;
+        server.use(http.delete(`${TEST_BASE_URL}/api/cases/c1`, () => {
+            called = true;
+            return HttpResponse.json({ success: true });
+        }));
+        const result = await runCaseDelete({ caseId: "c1" });
+        expect(result.ok).toBe(true);
+        expect(called).toBe(true);
+    });
+    it("rejects missing caseId", async () => {
+        const result = await runCaseDelete({});
+        expect(result.ok).toBe(false);
+        if (!result.ok)
+            expect(result.error.code).toBe("validation_error");
+    });
+    it("maps 404 to not_found", async () => {
+        server.use(http.delete(`${TEST_BASE_URL}/api/cases/c1`, () => HttpResponse.json({ error: "Test case not found" }, { status: 404 })));
+        const result = await runCaseDelete({ caseId: "c1" });
+        expect(result.ok).toBe(false);
+        if (!result.ok)
+            expect(result.error.code).toBe("not_found");
+    });
+    it("--dry-run returns a DELETE request without calling API", async () => {
+        const result = await runCaseDelete({ caseId: "c1", dryRun: true });
+        expect(result.ok).toBe(true);
+        if (result.ok && "dryRun" in result.data) {
+            expect(result.data.method).toBe("DELETE");
+            expect(result.data.url).toBe(`${TEST_BASE_URL}/api/cases/c1`);
+        }
+    });
+});

package/dist/commands/case/delete.d.ts

@@ -0,0 +1,20 @@
+import { type ClientDeps } from "../../client.js";
+import { type DryRunResult } from "../../mutate.js";
+import type { DeleteCaseResult, Envelope } from "../../types.js";
+export interface DeleteCaseOptions {
+    caseId?: unknown;
+    dryRun?: unknown;
+}
+export declare function runCaseDelete(options: DeleteCaseOptions, deps?: ClientDeps): Promise<Envelope<DeleteCaseResult | DryRunResult>>;
+declare const _default: import("citty").CommandDef<{
+    readonly caseId: {
+        readonly type: "positional";
+        readonly description: "Case ID";
+        readonly required: true;
+    };
+    readonly "dry-run": {
+        readonly type: "boolean";
+        readonly description: "Validate and show request without calling API";
+    };
+}>;
+export default _default;

package/dist/commands/case/delete.js

@@ -0,0 +1,39 @@
+import { defineCommand } from "citty";
+import { request } from "../../client.js";
+import { handleApiError } from "../../errors.js";
+import { dryRunEnvelope } from "../../mutate.js";
+import { formatSuccess, printResult, validationError } from "../../output.js";
+import { requireId } from "../../validate.js";
+export async function runCaseDelete(options, deps) {
+    let caseId;
+    try {
+        caseId = requireId("caseId", options.caseId);
+    }
+    catch (err) {
+        return validationError(err);
+    }
+    const path = `/api/cases/${encodeURIComponent(caseId)}`;
+    if (options.dryRun) {
+        return dryRunEnvelope("DELETE", path);
+    }
+    try {
+        const res = await request(path, { method: "DELETE" }, deps ?? {});
+        return formatSuccess(res);
+    }
+    catch (err) {
+        return handleApiError(err);
+    }
+}
+export default defineCommand({
+    meta: { name: "delete", description: "Delete a test case" },
+    args: {
+        caseId: { type: "positional", description: "Case ID", required: true },
+        "dry-run": { type: "boolean", description: "Validate and show request without calling API" },
+    },
+    async run({ args }) {
+        printResult(await runCaseDelete({
+            caseId: args.caseId,
+            dryRun: args["dry-run"],
+        }));
+    },
+});

package/dist/commands/case/index.js

@@ -3,5 +3,6 @@ export default defineCommand({
     meta: { name: "case", description: "Test case commands" },
     subCommands: {
         create: () => import("./create.js").then((m) => m.default),
+        delete: () => import("./delete.js").then((m) => m.default),
     },
 });

package/dist/commands/device/doctor.d.ts

@@ -16,6 +16,7 @@ export interface DoctorReport {
         info: number;
     };
 }
+export declare function relayProbeUrl(): string;
 export interface RunDoctorOptions {
     skipRelay?: boolean;
     skipApi?: boolean;

package/dist/commands/device/doctor.js

@@ -1,13 +1,13 @@
-import { defineCommand } from "citty";
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { platform } from "node:os";
+import { defineCommand } from "citty";
 import { WebSocket } from "ws";
 import { getBaseUrl, request } from "../../client.js";
-import { formatSuccess, printResult } from "../../output.js";
 import { loadConfig } from "../../config.js";
 import { readCachedManifest } from "../../desktop-server/agent-sync.js";
 import { installedPythonTag, PYTHON_RELEASE, PYTHON_VERSION } from "../../desktop-server/setup.js";
+import { formatSuccess, printResult } from "../../output.js";
 import { getAgentRequirementsPath, getAgentScriptPath, getDepsMarkerPath, getDeviceConfigPath, getEmbeddedPythonBinary, getPythonDir, getPythonMarkerPath, } from "./paths.js";
 function redactKey(value) {
     if (value.length <= 8)
@@ -249,12 +249,21 @@ async function checkAgentUpToDate(deps) {
 function relayUrlFromBase() {
     return `${getBaseUrl().replace(/^http/, "ws")}/devices/tunnel`;
 }
+// The relay is a Socket.IO / engine.io endpoint (websocket-only), which answers
+// only at <path>/?EIO=4&transport=websocket. A raw WebSocket to the bare path
+// 404s or hangs, so the old probe reported a false negative even when the relay
+// was healthy. Probe the engine.io upgrade directly — a successful open (HTTP
+// 101) means the relay is up; device auth is enforced later, after this opens.
+export function relayProbeUrl() {
+    return `${relayUrlFromBase()}/?EIO=4&transport=websocket`;
+}
 const RELAY_CHECK_NAME = "relay handshake";
 function checkRelayReachable() {
     return new Promise((resolve) => {
         const url = relayUrlFromBase();
+        const probeUrl = relayProbeUrl();
         let settled = false;
-        const ws = new WebSocket(url, { handshakeTimeout: 5_000 });
+        const ws = new WebSocket(probeUrl, { handshakeTimeout: 5_000 });
         const done = (check) => {
             if (settled)
                 return;
@@ -280,7 +289,7 @@ function checkRelayReachable() {
             done({
                 name: RELAY_CHECK_NAME,
                 status: "pass",
-                message: `WebSocket handshake to ${url} succeeded (device auth not verified)`,
+                message: `engine.io upgrade to ${probeUrl} succeeded (device auth not verified)`,
             });
         });
         ws.on("error", (err) => {

package/dist/commands/device/doctor.test.js

@@ -1,9 +1,9 @@
-import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { server, http, HttpResponse, TEST_BASE_URL } from "../../test-utils.js";
-import { runDeviceDoctor } from "./doctor.js";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { HttpResponse, http, server, TEST_BASE_URL } from "../../test-utils.js";
+import { relayProbeUrl, runDeviceDoctor } from "./doctor.js";
 let tempHome;
 beforeAll(() => {
     tempHome = mkdtempSync(join(tmpdir(), "aximo-doctor-"));
@@ -87,3 +87,9 @@ describe("runDeviceDoctor", () => {
         expect(findCheck(result.data.checks, "agent files")?.status).toBe("warn");
     });
 });
+describe("relayProbeUrl", () => {
+    it("targets the engine.io websocket endpoint, not the bare relay path", () => {
+        const wsBase = TEST_BASE_URL.replace(/^http/, "ws");
+        expect(relayProbeUrl()).toBe(`${wsBase}/devices/tunnel/?EIO=4&transport=websocket`);
+    });
+});

package/dist/commands/device/paths.d.ts

@@ -5,6 +5,7 @@ export declare function getPythonMarkerPath(): string;
 export declare function getDepsMarkerPath(): string;
 export declare function getCacheDir(): string;
 export declare function getRemoteLogPath(): string;
+export declare function getAgentCaBundlePath(): string;
 export declare function getAgentDir(): string;
 export declare function getAgentScriptPath(): string;
 export declare function getAgentRequirementsPath(): string;

package/dist/commands/device/paths.js

@@ -21,6 +21,9 @@ export function getCacheDir() {
 export function getRemoteLogPath() {
     return join(getAximoDir(), "remote.log");
 }
+export function getAgentCaBundlePath() {
+    return join(getAximoDir(), "agent-ca-bundle.pem");
+}
 export function getAgentDir() {
     return join(getAximoDir(), "agent");
 }

package/dist/commands/mcp/server.test.js

@@ -24,7 +24,7 @@ async function connect() {
     };
 }
 describe("createMcpServer wiring", () => {
-    it("exposes all 15 tools through tools/list with valid JSON Schema", async () => {
+    it("exposes all 16 tools through tools/list with valid JSON Schema", async () => {
         const { client, cleanup } = await connect();
         try {
             const { tools } = await client.listTools();
@@ -40,6 +40,7 @@ describe("createMcpServer wiring", () => {
                 "aximo_list_projects",
                 "aximo_list_sessions",
                 "aximo_create_case",
+                "aximo_delete_case",
                 "aximo_create_plan",
                 "aximo_add_case_to_plan",
                 "aximo_remove_case_from_plan",

package/dist/commands/mcp/tools.js

@@ -212,6 +212,17 @@ export function defineTools(deps = {}) {
                 return await request("/api/cases", { method: "POST", body: input }, deps);
             }),
         },
+        {
+            name: "aximo_delete_case",
+            title: "Delete test case",
+            description: "Permanently delete a test case. It is removed from any plans it belongs to; past run sessions are kept but detached. This cannot be undone.",
+            inputSchema: {
+                caseId: z.string().uuid(),
+            },
+            handler: async ({ caseId }) => call(async () => {
+                return await request(`/api/cases/${encodeURIComponent(caseId)}`, { method: "DELETE" }, deps);
+            }),
+        },
         {
             name: "aximo_create_plan",
             title: "Create test plan",

package/dist/commands/mcp/tools.test.js

@@ -32,6 +32,7 @@ describe("defineTools", () => {
             "aximo_list_cases",
             "aximo_get_case",
             "aximo_create_case",
+            "aximo_delete_case",
             "aximo_create_plan",
             "aximo_add_case_to_plan",
             "aximo_remove_case_from_plan",
@@ -255,6 +256,17 @@ describe("write tools", () => {
         expect(parsePayload(result)).toEqual({ success: true });
         expect(method).toBe("DELETE");
     });
+    it("aximo_delete_case DELETEs the case path", async () => {
+        let method = null;
+        server.use(http.delete(`${TEST_BASE_URL}/api/cases/c1`, ({ request: req }) => {
+            method = req.method;
+            return HttpResponse.json({ success: true });
+        }));
+        const tool = byName(defineTools(), "aximo_delete_case");
+        const result = await tool.handler({ caseId: "c1" });
+        expect(parsePayload(result)).toEqual({ success: true });
+        expect(method).toBe("DELETE");
+    });
     it("aximo_save_session_as_case POSTs to the save-as-case path without the id in the body", async () => {
         let body;
         server.use(http.post(`${TEST_BASE_URL}/api/sessions/s1/save-as-case`, async ({ request: req }) => {

package/dist/desktop-server/setup-tls.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/desktop-server/setup-tls.test.js

@@ -0,0 +1,83 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { resolveAgentSslCertFile, writeCertBundle } from "./setup.js";
+let tempDir;
+const savedEnv = {};
+beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "aximo-tls-"));
+    for (const key of ["SSL_CERT_FILE", "NODE_EXTRA_CA_CERTS", "AXIMO_HOME"]) {
+        savedEnv[key] = process.env[key];
+        delete process.env[key];
+    }
+    process.env["AXIMO_HOME"] = tempDir;
+});
+afterEach(() => {
+    for (const [key, value] of Object.entries(savedEnv)) {
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
+    rmSync(tempDir, { recursive: true, force: true });
+    vi.doUnmock("node:child_process");
+    vi.resetModules();
+});
+describe("writeCertBundle", () => {
+    it("concatenates certifi roots and the custom CA into one bundle", () => {
+        const certifi = join(tempDir, "certifi.pem");
+        const customCa = join(tempDir, "ca.pem");
+        const out = join(tempDir, "bundle.pem");
+        writeFileSync(certifi, "-----CERTIFI ROOT-----\n");
+        writeFileSync(customCa, "-----AXIMO CA-----\n");
+        writeCertBundle(out, certifi, customCa);
+        const result = readFileSync(out, "utf-8");
+        expect(result).toContain("-----CERTIFI ROOT-----");
+        expect(result).toContain("-----AXIMO CA-----");
+        // certifi first, custom CA second, single trailing newline
+        expect(result).toBe("-----CERTIFI ROOT-----\n-----AXIMO CA-----\n");
+    });
+});
+describe("resolveAgentSslCertFile", () => {
+    it("respects an explicit SSL_CERT_FILE override", () => {
+        process.env["SSL_CERT_FILE"] = "/custom/bundle.pem";
+        process.env["NODE_EXTRA_CA_CERTS"] = join(tempDir, "ca.pem");
+        writeFileSync(join(tempDir, "ca.pem"), "ca");
+        expect(resolveAgentSslCertFile("/no/python")).toBe("/custom/bundle.pem");
+    });
+    it("returns undefined when no custom CA is configured (public-CA servers)", () => {
+        expect(resolveAgentSslCertFile("/no/python")).toBeUndefined();
+    });
+    it("returns undefined when NODE_EXTRA_CA_CERTS points at a missing file", () => {
+        process.env["NODE_EXTRA_CA_CERTS"] = join(tempDir, "does-not-exist.pem");
+        expect(resolveAgentSslCertFile("/no/python")).toBeUndefined();
+    });
+    it("degrades gracefully (no throw) when the embedded certifi store can't be located", () => {
+        process.env["NODE_EXTRA_CA_CERTS"] = join(tempDir, "ca.pem");
+        writeFileSync(join(tempDir, "ca.pem"), "-----AXIMO CA-----\n");
+        const errSpy = vi.spyOn(console, "error").mockImplementation(() => { });
+        // A non-existent python makes `python -m certifi` fail, so no bundle is built.
+        expect(resolveAgentSslCertFile(join(tempDir, "no-such-python"))).toBeUndefined();
+        expect(errSpy).toHaveBeenCalled();
+        errSpy.mockRestore();
+    });
+    it("builds and returns the certifi+CA bundle when a custom CA and certifi store are present", async () => {
+        const certifiPath = join(tempDir, "certifi.pem");
+        const customCaPath = join(tempDir, "ca.pem");
+        writeFileSync(certifiPath, "-----CERTIFI ROOT-----\n");
+        writeFileSync(customCaPath, "-----AXIMO CA-----\n");
+        process.env["NODE_EXTRA_CA_CERTS"] = customCaPath;
+        // Stub `python -m certifi` so it resolves to the fixture certifi store above.
+        vi.resetModules();
+        vi.doMock("node:child_process", () => ({
+            spawn: vi.fn(),
+            spawnSync: vi.fn(() => ({ status: 0, stdout: `${certifiPath}\n` })),
+        }));
+        const { resolveAgentSslCertFile: resolve } = await import("./setup.js");
+        const bundlePath = resolve("/fake/python");
+        expect(bundlePath).toBe(join(tempDir, "agent-ca-bundle.pem"));
+        // The bundle is the certifi roots followed by the custom CA, in that order.
+        expect(readFileSync(bundlePath, "utf-8")).toBe("-----CERTIFI ROOT-----\n-----AXIMO CA-----\n");
+    });
+});

package/dist/desktop-server/setup.d.ts

@@ -15,5 +15,22 @@ interface RemoteOptions {
     deviceToken: string;
     deviceName: string;
 }
+/** Path to the embedded interpreter's certifi CA store, or undefined if unavailable. */
+export declare function embeddedCertifiPath(pythonPath: string): string | undefined;
+/** Write a combined trust store (certifi roots followed by the custom CA) to outPath. */
+export declare function writeCertBundle(outPath: string, certifiPath: string, customCaPath: string): void;
+/**
+ * Resolve the SSL_CERT_FILE for the Python desktop agent.
+ *
+ * The Node CLI trusts a custom CA (e.g. an on-prem self-signed server) via
+ * NODE_EXTRA_CA_CERTS, but Python ignores that variable, so the agent's wss://
+ * relay connection would fail verification. Mirror the trust by building a
+ * bundle of the embedded interpreter's certifi roots PLUS the custom CA and
+ * pointing SSL_CERT_FILE at it. SSL_CERT_FILE replaces the whole trust store, so
+ * the bundle must contain both — the custom CA alone would break every other TLS
+ * the agent does. No-op when no custom CA is configured (public-CA servers
+ * already verify via certifi).
+ */
+export declare function resolveAgentSslCertFile(pythonPath: string): string | undefined;
 export declare function startDesktopRemote(pythonPath: string, scriptPath: string, options: RemoteOptions): ChildProcess;
 export {};

package/dist/desktop-server/setup.js

@@ -5,7 +5,7 @@ import { arch as osArch, platform } from "node:os";
 import { join } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import { getAximoDir, getCacheDir, getDepsMarkerPath, getEmbeddedPythonBinary, getPythonDir, getPythonMarkerPath, getRemoteLogPath, } from "../commands/device/paths.js";
+import { getAgentCaBundlePath, getAximoDir, getCacheDir, getDepsMarkerPath, getEmbeddedPythonBinary, getPythonDir, getPythonMarkerPath, getRemoteLogPath, } from "../commands/device/paths.js";
 import { ensureAgent } from "./agent-sync.js";
 export const PYTHON_RELEASE = "20260414";
 export const PYTHON_VERSION = "3.12.13";
@@ -174,7 +174,58 @@ export async function ensurePythonReady(deps) {
         agentChanged: agent.changed,
     };
 }
+/** Path to the embedded interpreter's certifi CA store, or undefined if unavailable. */
+export function embeddedCertifiPath(pythonPath) {
+    const result = spawnSync(pythonPath, ["-m", "certifi"], { encoding: "utf-8" });
+    if (result.status !== 0)
+        return undefined;
+    const path = (result.stdout ?? "").trim();
+    return path && existsSync(path) ? path : undefined;
+}
+/** Write a combined trust store (certifi roots followed by the custom CA) to outPath. */
+export function writeCertBundle(outPath, certifiPath, customCaPath) {
+    const certifi = readFileSync(certifiPath, "utf-8");
+    const customCa = readFileSync(customCaPath, "utf-8");
+    writeFileSync(outPath, `${certifi.trimEnd()}\n${customCa.trimEnd()}\n`, { mode: 0o644 });
+}
+/**
+ * Resolve the SSL_CERT_FILE for the Python desktop agent.
+ *
+ * The Node CLI trusts a custom CA (e.g. an on-prem self-signed server) via
+ * NODE_EXTRA_CA_CERTS, but Python ignores that variable, so the agent's wss://
+ * relay connection would fail verification. Mirror the trust by building a
+ * bundle of the embedded interpreter's certifi roots PLUS the custom CA and
+ * pointing SSL_CERT_FILE at it. SSL_CERT_FILE replaces the whole trust store, so
+ * the bundle must contain both — the custom CA alone would break every other TLS
+ * the agent does. No-op when no custom CA is configured (public-CA servers
+ * already verify via certifi).
+ */
+export function resolveAgentSslCertFile(pythonPath) {
+    // Respect an explicit override — the user may already point Python at a bundle.
+    if (process.env["SSL_CERT_FILE"])
+        return process.env["SSL_CERT_FILE"];
+    const customCa = process.env["NODE_EXTRA_CA_CERTS"];
+    if (!customCa || !existsSync(customCa))
+        return undefined;
+    const certifiPath = embeddedCertifiPath(pythonPath);
+    if (!certifiPath) {
+        console.error("[remote] NODE_EXTRA_CA_CERTS is set but the embedded Python's certifi store " +
+            "could not be located; the desktop agent may fail TLS verification against a " +
+            "custom-CA server. Set SSL_CERT_FILE to a certifi+CA bundle to override.");
+        return undefined;
+    }
+    try {
+        const bundlePath = getAgentCaBundlePath();
+        writeCertBundle(bundlePath, certifiPath, customCa);
+        return bundlePath;
+    }
+    catch (err) {
+        console.error(`[remote] Failed to build the agent CA bundle: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+}
 export function startDesktopRemote(pythonPath, scriptPath, options) {
+    const sslCertFile = resolveAgentSslCertFile(pythonPath);
     const child = spawn(pythonPath, [scriptPath], {
         env: {
             ...process.env,
@@ -183,6 +234,7 @@ export function startDesktopRemote(pythonPath, scriptPath, options) {
             RELAY_URL: options.relayUrl,
             DEVICE_TOKEN: options.deviceToken,
             DEVICE_NAME: options.deviceName,
+            ...(sslCertFile ? { SSL_CERT_FILE: sslCertFile } : {}),
         },
         stdio: "pipe",
     });

package/dist/types.d.ts

@@ -133,6 +133,9 @@ export interface CreateCaseResult {
     success: boolean;
     caseId: string;
 }
+export interface DeleteCaseResult {
+    success: boolean;
+}
 export interface CreatePlanInput {
     projectId: string;
     title: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autifyhq/aximo-cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Autify Aximo Command Line Interface (CLI)",
   "keywords": [
     "autify",