@dashai/cli 0.24.0 → 0.25.0

package/README.md

@@ -20,7 +20,7 @@ Or run via `npx` without installing globally:
 npx @dashai/cli login
 ```
 
-Requires Node 20+.
+Requires Node 20.18.1 or newer.
 
 ## Commands
 

package/dist/bin.js

@@ -112,6 +112,12 @@ function resolveApiUrl() {
   if (cfg?.apiUrl) return cfg.apiUrl.replace(/\/+$/, "");
   return DEFAULT_API_URL;
 }
+function resolveExplicitApiUrl() {
+  const fromEnv = process.env.DASHWISE_API_URL?.trim();
+  if (fromEnv) return fromEnv.replace(/\/+$/, "");
+  const cfg = safeReadConfig();
+  return cfg?.apiUrl ? cfg.apiUrl.replace(/\/+$/, "") : null;
+}
 function readSavedToken() {
   const cfg = safeReadConfig();
   return cfg?.token ?? null;
@@ -1634,7 +1640,7 @@ var init_simple = __esm({
             typescript: "^5.5.0"
           },
           engines: {
-            node: "22.x"
+            node: "22.x || 24.x"
           }
         },
         "node_modules/@dashai/sdk": {
@@ -2679,7 +2685,7 @@ var init_custom = __esm({
             typescript: "^5.5.0"
           },
           engines: {
-            node: "22.x"
+            node: "22.x || 24.x"
           }
         },
         "node_modules/@alloc/quick-lru": {
@@ -10017,9 +10023,10 @@ function packageJson(opts) {
       version: "0.0.1",
       private: true,
       type: "module",
-      engines: { node: "22.x" },
+      engines: { node: NODE_ENGINES },
       scripts: {
-        dev: "dashwise module dev",
+        dev: "dashwise dev",
+        "dev:watch": "dashwise module dev",
         "dev:next": "next dev",
         "dashwise:generate": "dashwise module generate",
         typecheck: "tsc --noEmit",
@@ -10235,7 +10242,7 @@ function appPageTsx(opts) {
           Module slug: <code>${escapeHtml(opts.slug)}</code>
         </p>
         <p style={{ marginTop: 24, color: '#64748b', fontSize: 14 }}>
-          Run <code>dashwise module dev</code> to start the watch loop.
+          Run <code>npm run dev</code> to start the app and the watch loop.
           <br />
           Edit <code>module.json</code> to add tables; regenerated types
           land in <code>@dashai/generated</code>.
@@ -10269,7 +10276,7 @@ debugger to Next), use the legacy two-terminal flow:
 
 \`\`\`bash
 dashwise module generate    # produces node_modules/@dashai/generated/
-dashwise module dev         # watch module.json + auto-regenerate
+npm run dev:watch           # watch module.json + auto-regenerate
 npm run dev:next            # plain Next.js dev server (in another terminal)
 \`\`\`
 
@@ -10314,7 +10321,7 @@ debugger to Next), use the legacy two-terminal flow:
 
 \`\`\`bash
 dashwise module generate    # produces node_modules/@dashai/generated/
-dashwise module dev         # watch + regen on module.json save (terminal 1)
+npm run dev:watch           # watch + regen on module.json save (terminal 1)
 npm run dev:next            # next dev on :3000                  (terminal 2)
 \`\`\`
 
@@ -11119,9 +11126,10 @@ function packageJsonCustom(opts) {
       version: "0.0.1",
       private: true,
       type: "module",
-      engines: { node: "22.x" },
+      engines: { node: NODE_ENGINES },
       scripts: {
-        dev: "dashwise module dev",
+        dev: "dashwise dev",
+        "dev:watch": "dashwise module dev",
         "dev:next": "next dev",
         "dashwise:generate": "dashwise module generate",
         typecheck: "tsc --noEmit",
@@ -12208,7 +12216,7 @@ in this Dashwise module. Read this before making changes.
 
 Every table declares exactly one primary field (the row's name everywhere in Dashwise).
 
-${opts.cloudReady === false ? "" : cloudAgentInstructions()}
+${opts.cloudReady === false ? "" : cloudAgentInstructions() + "\n" + claudeCloudNote(opts.apiUrl)}
 ## What this module is
 
 A Dashwise ${isCustom ? "**custom Next.js** module (full app runtime, machine-class)" : "**hand-authored simple** module (isolate runtime)"} authored against \`@dashai/sdk\`.
@@ -12745,15 +12753,145 @@ primary_region = "iad"
 `;
 }
 function cloudAgentInstructions() {
-  return `## Cloud workflow
+  return `## Default way of working
+
+These are defaults. When the person you work for says otherwise (in the chat,
+or in their own \`CLAUDE.md\` / \`AGENTS.md\`), follow them instead.
+
+- Assume the person is not a developer. Before and after each step, say in one
+  or two plain sentences what you are doing and why, for example "I'm saving
+  your changes so Dashwise can see them." When a term like branch or pull
+  request is unavoidable, explain it in a few words.
+- You handle git. Get the finished work onto the repository's default branch
+  (usually \`main\`) yourself, so the person, Dashwise and the next agent all
+  see the latest version. The person needs no git, branch or pull request
+  knowledge:
+  - Working locally on the person's computer: commit on the default branch and push it.
+  - Working in the cloud (Codex cloud, Claude Code on the web): if your tool
+    lets you push to the default branch or merge your own pull request, do it
+    once the checks pass. If it only lets you push a branch, push it and tell the
+    person in plain words that the changes are saved and that Release in
+    Dashwise includes them. Don't ask them to merge anything.
+- Never force-push and never rewrite the default branch's history.
+- The person only confirms Release and Take live in Dashwise. When the work is
+  pushed, tell them it is ready: in Dashwise open the module, click Release,
+  then Take live.
+
+## Cloud workflow
 
 - Read \`module.json\`, the task and \`spec.md\` first. Preserve module identity and permission checks.
-- Use Node 22 in the provider environment (\`.nvmrc\` / \`.node-version\`). From the repository root run \`bash scripts/cloud-setup.sh\`.
+- Use Node 22 or 24 (\`.nvmrc\` prefers 22; Codex's default 24 works too). From the repository root run \`bash scripts/cloud-setup.sh\`.
 - After edits run \`npm run typecheck\`, \`npm test\`, \`npm run build\`, then \`npm run smoke:production\`. Add behavior tests for your changes. A dev server does not prove production readiness.
 - Update \`spec.md\` for behavior changes and \`agent-log.md\` in the same commit. Read \`CLAUDE.md\` for SDK, authorization and UI conventions.
-- Work on one branch and push it. Report the pushed SHA and checks, including failures. No user merge is required for Dashwise to receive the branch.
-- Never print, persist or commit secrets. Repository code delivery needs no Dashwise token. Do not log in or access company data for setup or checks.
+- \`npm run smoke:production\` starts the built app on a local loopback port. If a cloud sandbox refuses that port, rerun the command with the network permission; never skip the check.
+- Report what you changed, the pushed SHA and the checks you ran, including failures, in plain words.
+- Never print, persist or commit secrets. Repository code delivery needs no Dashwise token. Do not log in or access company data for setup or checks; see "Dashwise login" for full development.
 - Never automatically release, publish, deploy or take an installation live. Release and Live require an explicit human action.
+- Even when the person says you may release, you can't do it for them: tell them in one sentence where to click (in Dashwise open the module, click Release, then Take live). Never ask for a \`dashwise login\` or a token just to release.
+
+## If you can't see the repository
+
+Connecting GitHub in the AI tool is not enough for a private repository. Tell
+the person, in plain words, to also install the tool's GitHub app on the GitHub
+organisation that owns this repository and give it access to this repository
+(an organisation owner may have to approve it), then start the task again:
+
+- Claude: the Claude GitHub app, https://github.com/apps/claude
+- Codex: the ChatGPT Codex Connector, https://github.com/apps/chatgpt-codex-connector
+
+## Dashwise login (only for full development)
+
+The checks (\`npm run typecheck\`, \`npm test\`, \`npm run build\`,
+\`npm run smoke:production\`) need no login. Full Dashwise development does:
+\`npm run dev\` (\`dashwise dev\`: the app plus the watcher), \`dashwise module
+generate\` and the schema commands. When the task needs them:
+
+- If \`dashwise\` is not installed, run \`npm install -g @dashai/cli@latest\`.
+- Ask the person once, in plain words, for example: "To run your module
+  against Dashwise I need to sign in as you. I'll show you a code and a link;
+  open the link and approve." Then run \`dashwise login --no-prompt\` and show
+  them the code and link it prints. The login acts with the person's own rights.
+- Keep the login outside the repository. In the cloud, run CLI commands with
+  \`XDG_CONFIG_HOME=/tmp/dashwise-config\` so the saved login lands in
+  \`/tmp\`, never in the checkout.
+- Never write a token into a script, a file in the repository, a commit, an
+  environment setup script or snapshot, or a log.
+- In the cloud, run CLI commands with \`NODE_USE_ENV_PROXY=1\` so the CLI
+  uses the environment's network proxy (newer CLI versions do this on their own).
+- A cloud environment forgets the login when it restarts; ask again only when
+  a command reports that the login is missing.
+`;
+}
+function companyApiHost(apiUrl) {
+  if (!apiUrl) return null;
+  try {
+    const host = new URL(apiUrl).host;
+    return host in HOSTED_API_HOSTS ? host : null;
+  } catch {
+    return null;
+  }
+}
+function apiHostLine(apiUrl) {
+  const host = companyApiHost(apiUrl);
+  return host ? `\`${host}\` (this company's Dashwise API; the company uses Dashwise at ${HOSTED_API_HOSTS[host]})` : "the company's Dashwise API host: `api.dashwise.net` if the person opens Dashwise at app.dashwise.net, `api.dashwise.dev` if at app.dashwise.dev. If you can't tell, ask them which address they use";
+}
+function codexEnvironmentInstructions(apiUrl) {
+  const host = companyApiHost(apiUrl);
+  const apiUrlValue = host ? `https://${host}` : "https://<the company API host above>";
+  return `## Codex cloud environment
+
+When the person asks you to set up the Codex cloud environment for this
+repository, use exactly these settings. Show each one to the person and say in
+one sentence what it is for.
+
+| Setting | Value |
+|---|---|
+| Node.js | 22 or 24 (24 is Codex's default and works; \`.nvmrc\` prefers 22) |
+| Setup script | \`if [ -f scripts/cloud-setup.sh ]; then bash scripts/cloud-setup.sh; else echo "No Dashwise template yet, setup skipped"; fi\` |
+| Agent internet access | On: keep the "package managers" preset and add only the company's Dashwise API host (below) |
+| Environment variables | \`DASHWISE_API_URL=${apiUrlValue}\`, \`NODE_USE_ENV_PROXY=1\` |
+| Secrets | none |
+
+Set the network access before you start the setup, so the first run can
+already install packages. The preset covers npm and GitHub; the one added
+domain is:
+
+- ${apiHostLine(apiUrl)}
+
+The module and the CLI talk to the company's Dashwise API. Do not add other
+Dashwise hosts. If the environment offers no preset, allow exactly
+${CLOUD_ALLOWED_HOSTS.map((h) => `\`${h}\``).join(", ")} plus that host.
+
+The setup script checks Node 22 or 24 and installs the exact dependencies with
+\`npm ci\`. The guard lets a first run pass while the repository holds only a
+README.
+
+Never add secrets: no \`dwk_\` module key, no \`dwc_\` CLI token and no password,
+and never put a \`dashwise login\` into the setup script. Delivering code needs
+none of them; for full development see "Dashwise login".
+
+To check the environment, run \`npm run typecheck\`, \`npm test\`,
+\`npm run build\` and \`npm run smoke:production\`. If one fails because of a
+setting, fix the setting; otherwise report the failure in plain words.
+
+If the repository has no \`package.json\` yet (only a README), skip these
+checks: the setup script already skipped installing, and the first task adds
+the template. Tell the person the settings are ready.
+
+When the checks pass, or were skipped for a README-only repository, tell the
+person: "The environment works. Click Publish to save it for your next tasks."
+Publishing is their click.
+`;
+}
+function claudeCloudNote(apiUrl) {
+  const host = companyApiHost(apiUrl);
+  return `## Claude cloud
+
+Claude Code on the web has no environment setup chat. It reads this repository
+and \`CLAUDE.md\`, and \`.claude/settings.json\` runs \`scripts/cloud-setup.sh\`
+when a cloud session starts. Node 22 or 24 both work. If
+the environment has a network setting, allow the same domains as for Codex:
+${CLOUD_ALLOWED_HOSTS.map((h) => `\`${h}\``).join(", ")} and ${host ? `\`${host}\`` : "the company's Dashwise API host (`api.dashwise.net` for app.dashwise.net, `api.dashwise.dev` for app.dashwise.dev)"}. No secrets.
 `;
 }
 function agentsMd(opts) {
@@ -12761,7 +12899,7 @@ function agentsMd(opts) {
 
 Every table declares exactly one primary field (the row's name everywhere in Dashwise).
 
-` + cloudAgentInstructions();
+` + cloudAgentInstructions() + "\n" + codexEnvironmentInstructions(opts.apiUrl) + "\n" + claudeCloudNote(opts.apiUrl);
 }
 function nodeVersion() {
   return "22\n";
@@ -12783,9 +12921,12 @@ fi
 repo_root="$(cd -- "$(dirname -- "\${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 fail() { printf 'cloud-setup: %s\\n' "$1" >&2; exit 1; }
-command -v node >/dev/null 2>&1 || fail 'Node 22 is required. Select Node 22 in your cloud environment, then retry.'
-[[ "$(node -p 'process.versions.node.split(".")[0]')" == "22" ]] || fail 'Node 22 is required. Select Node 22 in your cloud environment, then retry. A subshell-only runtime change will not persist into agent commands.'
-command -v npm >/dev/null 2>&1 || fail 'npm is required with Node 22.'
+command -v node >/dev/null 2>&1 || fail 'Node 22 or 24 is required. Select Node 22 or 24 in your cloud environment, then retry.'
+case "$(node -p 'process.versions.node.split(".")[0]')" in
+  22|24) ;;
+  *) fail 'Node 22 or 24 is required. Select Node 22 or 24 in your cloud environment, then retry. A subshell-only runtime change will not persist into agent commands.' ;;
+esac
+command -v npm >/dev/null 2>&1 || fail 'npm is required with Node 22 or 24.'
 [[ -f package-lock.json && -f package.json ]] || fail 'Missing package.json or committed package-lock.json. Run this from a complete repository checkout.'
 
 # Only the Claude startup/resume path reuses an unchanged install. Explicit
@@ -12793,15 +12934,21 @@ command -v npm >/dev/null 2>&1 || fail 'npm is required with Node 22.'
 stamp="$(node --input-type=module -e 'import {createHash} from "node:crypto"; import {readFileSync} from "node:fs"; const hash=createHash("sha256"); for (const path of ["package.json", "package-lock.json", "scripts/cloud-setup.sh"]) hash.update(readFileSync(path)); hash.update(process.version); hash.update(process.platform); hash.update(process.arch); process.stdout.write(hash.digest("hex"));')"
 stamp_file="node_modules/.dashwise-cloud-setup"
 if [[ "\${1:-}" == "--claude" && -f "$stamp_file" && "$(cat "$stamp_file")" == "$stamp" && -x node_modules/.bin/next && -x node_modules/.bin/tsc && -f node_modules/@dashai/sdk/package.json ]]; then
-  printf 'cloud-setup: dependencies already match Node 22 and the lockfile.\\n'
+  printf 'cloud-setup: dependencies already match this Node version and the lockfile.\\n'
   exit 0
 fi
 # Keep install output out of session logs: third-party lifecycle scripts may
 # echo environment variables. npm's own detailed logs stay in its local cache.
 rm -f "$stamp_file"
-npm ci --include=dev --no-audit --no-fund > /dev/null 2>&1 || fail 'npm ci failed. Check the committed lockfile, Node 22 and network access to registry.npmjs.org. Review npm logs privately; never paste credentials.'
+# Some sandboxes mount HOME read-only; npm then cannot write its cache.
+npm_cache="\${npm_config_cache:-\${HOME:-}/.npm}"
+if ! { mkdir -p "$npm_cache" 2>/dev/null && [[ -w "$npm_cache" ]]; }; then
+  export npm_config_cache="\${TMPDIR:-/tmp}/npm-cache"
+  printf 'cloud-setup: %s is not writable, using %s for the npm cache.\\n' "$npm_cache" "$npm_config_cache"
+fi
+npm ci --include=dev --no-audit --no-fund > /dev/null 2>&1 || fail 'npm ci failed. Check the committed lockfile, Node 22 or 24 and network access to registry.npmjs.org. Review npm logs privately; never paste credentials.'
 printf '%s' "$stamp" > "$stamp_file"
-printf 'cloud-setup: dependencies installed with Node 22.\\n'
+printf 'cloud-setup: dependencies installed with Node %s.\\n' "$(node -p 'process.versions.node')"
 `;
 }
 function claudeSettingsJson() {
@@ -12957,7 +13104,7 @@ function cloudReadme() {
   return `
 ## Cloud builders
 
-Use Node 22 (the root runtime pins) and run \`bash scripts/cloud-setup.sh\`.
+Use Node 22 (the root runtime pins; 24 also works) and run \`bash scripts/cloud-setup.sh\`.
 Commit \`package-lock.json\` after any dependency change; setup uses \`npm ci\`.
 Checks: \`npm run typecheck\`, \`npm test\`, \`npm run build\`, \`npm run smoke:production\`.
 The smoke command starts the built server, probes anonymous API denial and stops
@@ -12966,33 +13113,49 @@ The example uses \`lib/items.ts\` directly against the SDK, so a fresh checkout
 can build without authenticated code generation. Keep it aligned with the
 example table, or replace it when you author your schema.
 
-Codex: select Node 22 in the provider environment and use
-\`bash scripts/cloud-setup.sh\` as setup/maintenance. GitHub authorization and
-the cloud environment are configured in the provider; these repo files do
-not create an environment or authorize your account.
+Codex: \`AGENTS.md\` \u2192 "Codex cloud environment" lists the exact settings
+(Node 22 or 24, setup script, network, \`DASHWISE_API_URL\`, no secrets);
+Codex's environment setup chat can follow it, then you click Publish. GitHub
+authorization is configured in the provider: install the ChatGPT Codex
+Connector on your GitHub organisation so Codex can see a private repository.
 
 Claude Code web: \`.claude/settings.json\` ships a cloud-only SessionStart
 hook for startup/resume. It calls \`bash "$CLAUDE_PROJECT_DIR"/scripts/cloud-setup.sh --claude\`;
 local sessions skip installation and unchanged cloud installs reuse dependencies.
-Select Node 22 in the environment; do not rely on a setup subshell changing the
+Select Node 22 or 24 in the environment; do not rely on a setup subshell changing the
 runtime of later agent commands. The same script can be used in the environment
 setup field. Allow \`registry.npmjs.org\` for installs (Claude's Trusted list).
 The [official hook recipe](https://code.claude.com/docs/en/cloud-environments#install-dependencies-with-a-sessionstart-hook)
 explains startup and cache behavior.
 
-Read \`AGENTS.md\` / \`CLAUDE.md\`, work on one branch and push. Release and Live
-remain human actions. No Dashwise token is needed for repository code delivery.
+Read \`AGENTS.md\` / \`CLAUDE.md\`. By default agents get the work onto the
+default branch themselves and explain each step in plain words; Release in
+Dashwise includes work an agent could only push to a branch. Release and Live
+remain human actions. No Dashwise token is needed for
+repository code delivery.
 `;
 }
-var DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX;
+var NODE_ENGINES, DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX, CLOUD_ALLOWED_HOSTS, HOSTED_API_HOSTS;
 var init_scaffold = __esm({
   "src/lib/scaffold.ts"() {
     init_sdk_version();
     init_simple();
     init_custom();
+    NODE_ENGINES = "22.x || 24.x";
     DEPLOY_TARGETS = ["railway", "vercel", "fly"];
     SCAFFOLD_DEFAULT_API_URL = "http://localhost:3000";
     MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
+    CLOUD_ALLOWED_HOSTS = [
+      "registry.npmjs.org",
+      "github.com",
+      "api.github.com",
+      "raw.githubusercontent.com",
+      "codeload.github.com"
+    ];
+    HOSTED_API_HOSTS = {
+      "api.dashwise.dev": "app.dashwise.dev",
+      "api.dashwise.net": "app.dashwise.net"
+    };
   }
 });
 function isFreshCloneEntry(name) {
@@ -13070,7 +13233,7 @@ function canAdoptCloudFiles(dir, templatePackage) {
     if (lock.lockfileVersion !== 2 && lock.lockfileVersion !== 3 || !root) {
       return false;
     }
-    if (pkg.engines?.node !== "22.x" || !pkg.scripts || !expected.scripts) {
+    if (pkg.engines?.node !== "22.x" && pkg.engines?.node !== expected.engines?.node || !pkg.scripts || !expected.scripts) {
       return false;
     }
     for (const script of ["typecheck", "test", "build", "start", "smoke:production"]) {
@@ -13173,12 +13336,14 @@ async function moduleInitCommand(slugArg, options) {
   const templatePackage = (kind === "custom" ? packageJsonCustom : packageJson)({
     slug});
   const cloudReady = writeMode === "all" || canAdoptCloudFiles(dir, templatePackage);
+  const companyApiUrl = resolveExplicitApiUrl();
   const scaffoldOpts = {
     cloudReady,
     slug,
     name,
     kind,
-    ...options.git !== void 0 ? { repositoryUrl: options.git } : {}
+    ...options.git !== void 0 ? { repositoryUrl: options.git } : {},
+    ...companyApiUrl !== null ? { apiUrl: companyApiUrl } : {}
   };
   const scaffoldApiUrl = resolveApiUrl();
   const files = [
@@ -13376,7 +13541,7 @@ async function moduleInitCommand(slugArg, options) {
 
   ${dim("   (or, for the two-terminal flow:")}
   ${dim("     dashwise module generate")}              ${dim("# materialize typed wrappers")}
-  ${dim("     dashwise module dev")}                   ${dim("# watch + auto-regenerate")}
+  ${dim("     npm run dev:watch")}                     ${dim("# watch + auto-regenerate")}
   ${dim("     npm run dev:next                        # next dev on :3000)")}
 ${devInstall ? `
   ${dim(`Dev installation id=${devInstall.installation.id}; API key expires ${devInstall.api_key_expires_at}.`)}
@@ -14721,6 +14886,26 @@ var init_set_type = __esm({
   }
 });
 
+// src/lib/env-proxy.ts
+var PROXY_VARS = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
+function hasProxyEnv(env = process.env) {
+  return PROXY_VARS.some((name) => Boolean(env[name]?.trim()));
+}
+async function installEnvProxy(env = process.env) {
+  if (!hasProxyEnv(env)) return false;
+  const undici = await import('undici');
+  undici.setGlobalDispatcher(new undici.EnvHttpProxyAgent());
+  Object.assign(globalThis, {
+    fetch: undici.fetch,
+    FormData: undici.FormData,
+    Headers: undici.Headers,
+    Request: undici.Request,
+    Response: undici.Response
+  });
+  env.NODE_USE_ENV_PROXY ??= "1";
+  return true;
+}
+
 // src/lib/excess-args.ts
 init_output();
 var SMART_DASH_RE = /^[‒–—―−]/;
@@ -15128,7 +15313,7 @@ init_api_client();
 init_config();
 init_output();
 init_sdk_version();
-var MIN_NODE_MAJOR = 20;
+var MIN_NODE = [20, 18, 1];
 var CLOUD_FILES = [
   "scripts/cloud-setup.sh",
   ".claude/settings.json",
@@ -15348,13 +15533,20 @@ function unreachable(apiUrl) {
   };
 }
 function nodeCheck(version) {
-  const major = Number.parseInt(version.replace(/^v/, ""), 10);
-  return Number.isFinite(major) && major >= MIN_NODE_MAJOR ? { id: "node", label: "Node", status: "ok", detail: version } : {
+  const parts = version.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10));
+  let supported = parts.length === 3 && parts.every(Number.isFinite);
+  for (let i = 0; supported && i < 3; i++) {
+    if (parts[i] !== MIN_NODE[i]) {
+      supported = parts[i] > MIN_NODE[i];
+      break;
+    }
+  }
+  return supported ? { id: "node", label: "Node", status: "ok", detail: version } : {
     id: "node",
     label: "Node",
     status: "fail",
     detail: `${version} is too old`,
-    fix: `Install Node ${MIN_NODE_MAJOR} or newer (the template pins Node 22).`
+    fix: `Install Node ${MIN_NODE.join(".")} or newer (the template pins Node 22).`
   };
 }
 async function versionCheck(id, label, installed, latest, fix) {
@@ -25000,7 +25192,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.24.0";
+  return "0.25.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);
@@ -25016,6 +25208,7 @@ function collectRepeated(value, previous) {
 // src/bin.ts
 (async () => {
   try {
+    await installEnvProxy();
     await program.parseAsync(process.argv);
   } catch (err) {
     if (err instanceof ExcessArgumentsError) {