@getdial/cli 0.32.0 → 0.33.1

package/dist/cli.js

@@ -29,6 +29,11 @@ import { runMcp } from "./commands/mcp.js";
 import { runUpdate } from "./commands/update.js";
 import { runUninstall } from "./commands/uninstall.js";
 import { maybeAutoUpdate } from "./lib/update.js";
+import { isSandbox, SANDBOX_DISABLED_COMMANDS, sandboxDisabledMessage } from "./lib/sandbox.js";
+// Sandbox mode (ephemeral agent container behind the OneCLI proxy): hide and
+// disable machine-lifecycle / onboarding commands, and let requests go out
+// keyless so the proxy injects auth. Computed once (memoized in lib/sandbox).
+const sandbox = isSandbox();
 const program = new Command();
 program
     .name("dial")
@@ -50,46 +55,50 @@ program
     .description("Show account billing: balance, plan, per-number mode, recent activity. GET /api/v1/billing.")
     .option("--json", "machine-readable output")
     .action(async (opts) => process.exit(await runBilling({ json: !!opts.json })));
-program
-    .command("signup <email>")
-    .description("Request an email OTP for the given address.")
-    .option("--force", "overwrite any pending signup")
-    .option("--json", "machine-readable output")
-    .action(async (email, opts) => process.exit(await runSignup(email, { force: !!opts.force, json: !!opts.json })));
-program
-    .command("onboard")
-    .description("Verify the OTP and finish onboarding.")
-    .option("--verification-id <id>", "explicit verification id (falls back to local pending signup)")
-    .option("--code <code>", "6-digit OTP from your email (omit if already signed in — the command just installs the --agent skill and skips verification)")
-    .option("--inbound-instruction <text>", "system prompt for inbound calls to your auto-provisioned number (required for a new account; ignored when signing in)")
-    .option("--agent <name>", "install the Dial skill into the named agent's config dir. One of: claude-code, cursor, codex, opencode, pi, openclaw, nanoclaw, hermes. Repeatable.", (v, prev = []) => [...prev, v], [])
-    .option("--json", "machine-readable output")
-    .action(async (opts) => process.exit(await runOnboard({
-    verificationId: opts.verificationId,
-    code: opts.code,
-    inboundInstruction: opts.inboundInstruction,
-    agents: opts.agent,
-    json: !!opts.json,
-})));
-const listen = program
-    .command("listen")
-    .description("Run the listen worker (used by launchd/systemd).")
-    .action(async () => process.exit(await runListen()));
-listen
-    .command("install")
-    .description("Install the listen daemon (launchd or systemd user unit).")
-    .option("--json", "machine-readable output")
-    .action(async (opts) => process.exit(await runListenInstall({ json: !!opts.json })));
-listen
-    .command("uninstall")
-    .description("Stop and remove the listen daemon.")
-    .option("--json", "machine-readable output")
-    .action(async (opts) => process.exit(await runListenUninstall({ json: !!opts.json })));
-listen
-    .command("status")
-    .description("Report listen daemon state and last events.")
-    .option("--json", "machine-readable output")
-    .action(async (opts) => process.exit(await runListenStatus({ json: !!opts.json })));
+if (!sandbox)
+    program
+        .command("signup <email>")
+        .description("Request an email OTP for the given address.")
+        .option("--force", "overwrite any pending signup")
+        .option("--json", "machine-readable output")
+        .action(async (email, opts) => process.exit(await runSignup(email, { force: !!opts.force, json: !!opts.json })));
+if (!sandbox)
+    program
+        .command("onboard")
+        .description("Verify the OTP and finish onboarding.")
+        .option("--verification-id <id>", "explicit verification id (falls back to local pending signup)")
+        .option("--code <code>", "6-digit OTP from your email (omit if already signed in — the command just installs the --agent skill and skips verification)")
+        .option("--inbound-instruction <text>", "system prompt for inbound calls to your auto-provisioned number (required for a new account; ignored when signing in)")
+        .option("--agent <name>", "install the Dial skill into the named agent's config dir. One of: claude-code, cursor, codex, opencode, pi, openclaw, nanoclaw, hermes. Repeatable.", (v, prev = []) => [...prev, v], [])
+        .option("--json", "machine-readable output")
+        .action(async (opts) => process.exit(await runOnboard({
+        verificationId: opts.verificationId,
+        code: opts.code,
+        inboundInstruction: opts.inboundInstruction,
+        agents: opts.agent,
+        json: !!opts.json,
+    })));
+if (!sandbox) {
+    const listen = program
+        .command("listen")
+        .description("Run the listen worker (used by launchd/systemd).")
+        .action(async () => process.exit(await runListen()));
+    listen
+        .command("install")
+        .description("Install the listen daemon (launchd or systemd user unit).")
+        .option("--json", "machine-readable output")
+        .action(async (opts) => process.exit(await runListenInstall({ json: !!opts.json })));
+    listen
+        .command("uninstall")
+        .description("Stop and remove the listen daemon.")
+        .option("--json", "machine-readable output")
+        .action(async (opts) => process.exit(await runListenUninstall({ json: !!opts.json })));
+    listen
+        .command("status")
+        .description("Report listen daemon state and last events.")
+        .option("--json", "machine-readable output")
+        .action(async (opts) => process.exit(await runListenStatus({ json: !!opts.json })));
+}
 const number = program
     .command("number")
     .description("Manage your Dial phone numbers.");
@@ -305,52 +314,54 @@ call
     .description("Fetch a single call by id. GET /api/v1/calls/<id>.")
     .option("--json", "machine-readable output")
     .action(async (callId, opts) => process.exit(await runCallGet({ callId, json: !!opts.json })));
-const localTarget = program
-    .command("local-target")
-    .description("Register local fan-out targets the listen daemon delivers events to.")
-    .enablePositionalOptions();
-const localTargetAdd = localTarget
-    .command("add")
-    .description("Register a new local fan-out target (url or cmd).")
-    .enablePositionalOptions();
-localTargetAdd
-    .command("url <url>")
-    .description("Register a loopback HTTP endpoint. The daemon POSTs each event JSON to <url>.")
-    .option("--secret <value>", "HMAC-SHA256 key. The daemon signs each request body and sends the hex digest.")
-    .option("--signature-header <name>", "HTTP header for the HMAC signature (defaults to X-Dial-Signature; only used with --secret)")
-    .option("--bearer <token>", "static bearer token, sent as `Authorization: Bearer <token>`")
-    .option("--timeout <seconds>", "per-attempt timeout (default 5)", (v) => parseInt(v, 10))
-    .option("--json", "machine-readable output")
-    .action(async (url, opts) => process.exit(await runLocalTargetAddUrl({
-    url,
-    secret: opts.secret,
-    signatureHeader: opts.signatureHeader,
-    bearer: opts.bearer,
-    timeoutSeconds: opts.timeout,
-    json: !!opts.json,
-})));
-localTargetAdd
-    .command("cmd <path> [args...]")
-    .description("Register an executable. The daemon spawns it per event with the event JSON as the final positional argument.")
-    .option("--timeout <seconds>", "per-attempt timeout (default 5)", (v) => parseInt(v, 10))
-    .option("--json", "machine-readable output")
-    .passThroughOptions(true)
-    .action(async (path, args, opts) => process.exit(await runLocalTargetAddCmd({
-    path,
-    args: args ?? [],
-    timeoutSeconds: opts.timeout,
-    json: !!opts.json,
-})));
-localTarget
-    .command("remove <id>")
-    .description("Unregister a target by id (URL for url targets, path for cmd targets).")
-    .option("--json", "machine-readable output")
-    .action(async (id, opts) => process.exit(await runLocalTargetRemove({ id, json: !!opts.json })));
-localTarget
-    .command("list")
-    .description("List the local targets currently registered for fan-out.")
-    .option("--json", "machine-readable output")
-    .action(async (opts) => process.exit(await runLocalTargetList({ json: !!opts.json })));
+if (!sandbox) {
+    const localTarget = program
+        .command("local-target")
+        .description("Register local fan-out targets the listen daemon delivers events to.")
+        .enablePositionalOptions();
+    const localTargetAdd = localTarget
+        .command("add")
+        .description("Register a new local fan-out target (url or cmd).")
+        .enablePositionalOptions();
+    localTargetAdd
+        .command("url <url>")
+        .description("Register a loopback HTTP endpoint. The daemon POSTs each event JSON to <url>.")
+        .option("--secret <value>", "HMAC-SHA256 key. The daemon signs each request body and sends the hex digest.")
+        .option("--signature-header <name>", "HTTP header for the HMAC signature (defaults to X-Dial-Signature; only used with --secret)")
+        .option("--bearer <token>", "static bearer token, sent as `Authorization: Bearer <token>`")
+        .option("--timeout <seconds>", "per-attempt timeout (default 5)", (v) => parseInt(v, 10))
+        .option("--json", "machine-readable output")
+        .action(async (url, opts) => process.exit(await runLocalTargetAddUrl({
+        url,
+        secret: opts.secret,
+        signatureHeader: opts.signatureHeader,
+        bearer: opts.bearer,
+        timeoutSeconds: opts.timeout,
+        json: !!opts.json,
+    })));
+    localTargetAdd
+        .command("cmd <path> [args...]")
+        .description("Register an executable. The daemon spawns it per event with the event JSON as the final positional argument.")
+        .option("--timeout <seconds>", "per-attempt timeout (default 5)", (v) => parseInt(v, 10))
+        .option("--json", "machine-readable output")
+        .passThroughOptions(true)
+        .action(async (path, args, opts) => process.exit(await runLocalTargetAddCmd({
+        path,
+        args: args ?? [],
+        timeoutSeconds: opts.timeout,
+        json: !!opts.json,
+    })));
+    localTarget
+        .command("remove <id>")
+        .description("Unregister a target by id (URL for url targets, path for cmd targets).")
+        .option("--json", "machine-readable output")
+        .action(async (id, opts) => process.exit(await runLocalTargetRemove({ id, json: !!opts.json })));
+    localTarget
+        .command("list")
+        .description("List the local targets currently registered for fan-out.")
+        .option("--json", "machine-readable output")
+        .action(async (opts) => process.exit(await runLocalTargetList({ json: !!opts.json })));
+}
 program
     .command("wait-for <event-type>")
     .description("Wait for the next matching event in the listen log (e.g. call.ended, message.received).")
@@ -365,20 +376,34 @@ program
     timeoutSeconds: opts.timeout,
     json: !!opts.json,
 })));
-program
-    .command("mcp")
-    .description("Run a local stdio MCP server exposing Dial as agent tools (reuses your saved API key).")
-    .action(async () => process.exit(await runMcp()));
-program
-    .command("update")
-    .description("Update the CLI to the latest published version (global npm installs).")
-    .option("--json", "machine-readable output")
-    .action(async (opts) => process.exit(await runUpdate({ json: !!opts.json })));
-program
-    .command("uninstall")
-    .description("Remove the listen daemon, agent skills, and all local Dial state, then print how to remove the package.")
-    .option("--json", "machine-readable output")
-    .action(async (opts) => process.exit(await runUninstall({ json: !!opts.json })));
+if (!sandbox)
+    program
+        .command("mcp")
+        .description("Run a local stdio MCP server exposing Dial as agent tools (reuses your saved API key).")
+        .action(async () => process.exit(await runMcp()));
+if (!sandbox)
+    program
+        .command("update")
+        .description("Update the CLI to the latest published version (global npm installs).")
+        .option("--json", "machine-readable output")
+        .action(async (opts) => process.exit(await runUpdate({ json: !!opts.json })));
+if (!sandbox)
+    program
+        .command("uninstall")
+        .description("Remove the listen daemon, agent skills, and all local Dial state, then print how to remove the package.")
+        .option("--json", "machine-readable output")
+        .action(async (opts) => process.exit(await runUninstall({ json: !!opts.json })));
+// In sandbox mode the commands above are never registered, so invoking one
+// would otherwise surface commander's generic "unknown command". Intercept the
+// disabled verb first and print a message that names sandbox mode + the escape
+// hatches, so the agent isn't left guessing.
+if (sandbox) {
+    const invoked = process.argv.slice(2).find((a) => !a.startsWith("-"));
+    if (invoked && SANDBOX_DISABLED_COMMANDS.includes(invoked)) {
+        console.error(sandboxDisabledMessage(invoked));
+        process.exit(2);
+    }
+}
 program.parseAsync(process.argv).catch((err) => {
     console.error(err instanceof Error ? err.message : String(err));
     process.exit(2);

package/dist/commands/doctor.js

@@ -3,6 +3,17 @@ function humanRender(r) {
     const lines = [];
     lines.push(`dial ${r.cli.version}  (node ${r.cli.node})`);
     lines.push(`backend:     ${r.backend.url}  ${r.backend.reachable ? `reachable${r.backend.latencyMs != null ? ` (${r.backend.latencyMs}ms)` : ""}` : "UNREACHABLE"}`);
+    if (r.sandbox) {
+        // Sandbox: no local key — the gateway injects credentials. Don't say "not
+        // signed in" (misleading) or surface pending-otp/listen (all disabled here).
+        lines.push(`mode:        sandbox (credentials injected by the gateway)`);
+        lines.push(`auth:        ${r.auth.keyValid ? "credential connected via the gateway" : "no valid Dial credential connected in the vault"}`);
+        lines.push("");
+        lines.push(r.nextStep === "ready"
+            ? "next: ready"
+            : "next: connect the Dial credential in your gateway/vault (this agent has none)");
+        return lines.join("\n");
+    }
     if (r.auth.signedIn) {
         lines.push(`auth:        signed in as ${r.auth.email} (account ${r.auth.accountId}, key sk_live_***${r.auth.apiKeyFingerprint})${r.auth.keyValid === false ? "  [key rejected by backend]" : ""}`);
     }

package/dist/lib/api.js

@@ -1,6 +1,16 @@
-import { request, fetch as undiciFetch, FormData as UndiciFormData } from "undici";
+import { request, fetch as undiciFetch, FormData as UndiciFormData, setGlobalDispatcher, EnvHttpProxyAgent } from "undici";
 import { logger } from "./log.js";
 import { VERSION } from "./version.js";
+// Route this package's undici requests through HTTP(S)_PROXY when one is set.
+// The `undici` npm package keeps its OWN global dispatcher, which — unlike
+// Node's built-in fetch (wired by NODE_USE_ENV_PROXY) — ignores the proxy env
+// vars. In a proxied environment (e.g. the NanoClaw agent sandbox, where the
+// OneCLI gateway sits on HTTPS_PROXY and injects the Authorization header for
+// api.getdial.ai) our `request()`/`fetch()` calls would otherwise bypass the
+// gateway entirely and go out UNAUTHENTICATED → 401. Opt in explicitly.
+if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy) {
+    setGlobalDispatcher(new EnvHttpProxyAgent());
+}
 // The bundled undici only multipart-encodes its own FormData class (realm
 // check) — Node's global FormData would be coerced to a text/plain string.
 export { UndiciFormData as ApiFormData };

package/dist/lib/ops/account.js

@@ -4,11 +4,36 @@ import { supervisorStatus, lastEventAtFromLog, supervisorAvailability } from "..
 import { paths } from "../paths.js";
 import { VERSION } from "../version.js";
 import { installSkill, isSupportedAgent, SUPPORTED_AGENTS } from "../skill-install.js";
+import { isSandbox } from "../sandbox.js";
 import { DialError } from "./errors.js";
 const OTP_EXPIRY_MS = 10 * 60 * 1000;
 const PENDING_FRESH_MS = 10 * 60 * 1000;
 export async function accountStatus() {
     const ping = await pingBackend();
+    if (isSandbox()) {
+        // No local auth file in a sandbox — the gateway injects the credential.
+        // Probe keyless (the proxy adds the Authorization header) to report whether
+        // the credential is actually connected in the vault. Never suggest
+        // signup/onboard/listen here — those are disabled in a sandbox.
+        const probe = await apiGet("/api/v1/account");
+        const connected = probe.ok;
+        return {
+            cli: { version: VERSION, node: process.versions.node },
+            backend: { url: baseUrl(), reachable: ping.reachable, latencyMs: ping.latencyMs },
+            auth: {
+                signedIn: connected,
+                email: null,
+                accountId: null,
+                apiKeyPresent: connected,
+                apiKeyFingerprint: null,
+                keyValid: connected,
+            },
+            pendingOtp: { verificationId: null, ageSeconds: null, expired: null },
+            listen: { installed: false, running: false, lastEventAt: null },
+            sandbox: true,
+            nextStep: connected ? "ready" : "connect_credential",
+        };
+    }
     const auth = readAuth();
     const pending = readPendingSignup();
     let keyValid = null;
@@ -61,6 +86,7 @@ export async function accountStatus() {
             expired: pendingExpired,
         },
         listen: listenState,
+        sandbox: false,
         nextStep,
     };
 }

package/dist/lib/ops/auth.js

@@ -1,16 +1,29 @@
 import { readAuth } from "../state.js";
+import { isSandbox } from "../sandbox.js";
 import { DialError } from "./errors.js";
-/** Resolve the saved auth or throw a `not_signed_in` DialError. */
-export function requireAuth() {
+/**
+ * Resolve the saved auth, or `undefined` when running keyless.
+ *
+ * - Signed in (auth file present): returns the saved {@link Auth}.
+ * - Sandbox mode with no saved auth: returns `undefined`. The container has no
+ *   API key — a transparent HTTPS proxy (OneCLI) injects the real credential at
+ *   the network boundary, so callers pass `auth?.apiKey` (undefined) and
+ *   `lib/api.ts` attaches no `Authorization` header. Account-derived state
+ *   (e.g. a default from-number) is likewise absent and must be supplied
+ *   explicitly via --from-number(-id).
+ * - Not signed in and not sandboxed: throws `not_signed_in`.
+ */
+export function maybeAuth() {
     const auth = readAuth();
-    if (!auth) {
-        throw new DialError("not_signed_in", "Not signed in. Run `dial signup` and `dial onboard` first.");
-    }
-    return auth;
+    if (auth)
+        return auth;
+    if (isSandbox())
+        return undefined;
+    throw new DialError("not_signed_in", "Not signed in. Run `dial signup` and `dial onboard` first.");
 }
 /** Resolve the from-number id: explicit override, else the account default, else throw. */
 export function requireFromNumberId(auth, override) {
-    const id = override ?? auth.phoneNumberId;
+    const id = override ?? auth?.phoneNumberId;
     if (!id) {
         throw new DialError("no_from_number", "No default phoneNumberId in auth. Pass --from-number-id <id>.");
     }
@@ -21,7 +34,7 @@ export function requireFromNumberId(auth, override) {
  * override, else the saved default number id (an id is a valid ref), else throw.
  */
 export function requireFromNumber(auth, override) {
-    const ref = override ?? auth.phoneNumberId;
+    const ref = override ?? auth?.phoneNumberId;
     if (!ref) {
         throw new DialError("no_from_number", "No default phoneNumberId in auth. Pass --from-number <id|E.164|nickname>.");
     }

package/dist/lib/ops/billing.js

@@ -1,9 +1,9 @@
 import { apiGet } from "../api.js";
-import { requireAuth } from "./auth.js";
+import { maybeAuth } from "./auth.js";
 import { DialError } from "./errors.js";
 export async function getBilling() {
-    const auth = requireAuth();
-    const res = await apiGet("/api/v1/billing", auth.apiKey);
+    const auth = maybeAuth();
+    const res = await apiGet("/api/v1/billing", auth?.apiKey);
     if (!res.ok)
         throw new DialError("billing_failed", res.error, res.status);
     return res.data;

package/dist/lib/ops/calls.js

@@ -1,8 +1,8 @@
 import { apiGet, apiPost } from "../api.js";
-import { requireAuth, resolveFromSelector } from "./auth.js";
+import { maybeAuth, resolveFromSelector } from "./auth.js";
 import { DialError } from "./errors.js";
 export async function placeCall(opts) {
-    const auth = requireAuth();
+    const auth = maybeAuth();
     const from = resolveFromSelector(auth, opts);
     const res = await apiPost("/api/v1/calls", {
         to: opts.to,
@@ -13,13 +13,13 @@ export async function placeCall(opts) {
         ...(opts.voiceGender ? { voiceGender: opts.voiceGender } : {}),
         ...(opts.transferTo ? { transferTo: opts.transferTo } : {}),
         ...(opts.maxCallDurationSeconds !== undefined ? { maxCallDurationSeconds: opts.maxCallDurationSeconds } : {}),
-    }, auth.apiKey, opts.idempotencyKey ? { "idempotency-key": opts.idempotencyKey } : undefined);
+    }, auth?.apiKey, opts.idempotencyKey ? { "idempotency-key": opts.idempotencyKey } : undefined);
     if (!res.ok)
         throw new DialError("call_failed", res.error, res.status);
     return res.data.call;
 }
 export async function listCalls(opts) {
-    const auth = requireAuth();
+    const auth = maybeAuth();
     const params = new URLSearchParams();
     if (opts.numberId)
         params.set("numberId", opts.numberId);
@@ -28,14 +28,14 @@ export async function listCalls(opts) {
     if (opts.since)
         params.set("since", opts.since);
     const qs = params.toString();
-    const res = await apiGet(qs ? `/api/v1/calls?${qs}` : "/api/v1/calls", auth.apiKey);
+    const res = await apiGet(qs ? `/api/v1/calls?${qs}` : "/api/v1/calls", auth?.apiKey);
     if (!res.ok)
         throw new DialError("list_failed", res.error, res.status);
     return res.data.calls ?? [];
 }
 export async function getCall(callId) {
-    const auth = requireAuth();
-    const res = await apiGet(`/api/v1/calls/${encodeURIComponent(callId)}`, auth.apiKey);
+    const auth = maybeAuth();
+    const res = await apiGet(`/api/v1/calls/${encodeURIComponent(callId)}`, auth?.apiKey);
     if (!res.ok)
         throw new DialError(res.status === 404 ? "not_found" : "get_failed", res.error, res.status);
     return res.data.call;

package/dist/lib/ops/events.js

@@ -3,7 +3,7 @@ import { supervisorStatus } from "../supervisor/index.js";
 import { parseFieldArg, parseRegexArg } from "../event-filter.js";
 import { currentSize, findLatestMatch, tailUntilMatch } from "../log-tail.js";
 import { apiPost } from "../api.js";
-import { requireAuth } from "./auth.js";
+import { maybeAuth } from "./auth.js";
 import { DialError } from "./errors.js";
 const PER_POLL_SECONDS = 30;
 /**
@@ -34,7 +34,7 @@ async function waitFromLog(spec, opts) {
     return { source: null, timedOut: true, event: null, line: null };
 }
 async function waitFromApi(spec, opts) {
-    const auth = requireAuth();
+    const auth = maybeAuth();
     const filters = {};
     for (const f of spec.fields)
         filters[f.name] = f.value;
@@ -50,7 +50,7 @@ async function waitFromApi(spec, opts) {
             filters: Object.keys(filters).length > 0 ? filters : undefined,
             regexFilters: Object.keys(regexFilters).length > 0 ? regexFilters : undefined,
             timeout,
-        }, auth.apiKey);
+        }, auth?.apiKey);
         if (res.ok && res.data?.event) {
             return { source: "api", timedOut: false, event: res.data.event, line: JSON.stringify(res.data.event) };
         }

package/dist/lib/ops/listen.js

@@ -1,10 +1,10 @@
 import { readFileSync } from "node:fs";
 import { installSupervised, uninstallSupervised, supervisorStatus, supervisorAvailability, lastEventAtFromLog, resolveListenCommand, } from "../supervisor/index.js";
 import { paths } from "../paths.js";
-import { requireAuth } from "./auth.js";
+import { maybeAuth } from "./auth.js";
 import { DialError } from "./errors.js";
 export function listenInstall() {
-    requireAuth();
+    maybeAuth();
     const supervisor = supervisorAvailability();
     if (!supervisor.available) {
         throw new DialError("supervisor_unavailable", supervisor.reason);

package/dist/lib/ops/messages.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { basename, extname } from "node:path";
 import { apiGet, apiPost, apiPostMultipart, ApiFormData } from "../api.js";
-import { requireAuth, resolveFromSelector } from "./auth.js";
+import { maybeAuth, resolveFromSelector } from "./auth.js";
 import { DialError } from "./errors.js";
 export const MAX_MEDIA_ITEMS = 10;
 // File extensions the API accepts for uploads, mapped to their MIME type
@@ -45,7 +45,7 @@ function readMediaFile(path) {
     return { data, contentType, name: basename(path) };
 }
 export async function sendMessage(opts) {
-    const auth = requireAuth();
+    const auth = maybeAuth();
     const from = resolveFromSelector(auth, opts);
     const media = opts.media ?? [];
     if (media.length > MAX_MEDIA_ITEMS) {
@@ -64,7 +64,7 @@ export async function sendMessage(opts) {
             ...from,
             ...(media.length ? { mediaUrls: media } : {}),
             ...(opts.forceAudioFile ? { forceAudioFile: true } : {}),
-        }, auth.apiKey);
+        }, auth?.apiKey);
     }
     else {
         const form = new ApiFormData();
@@ -84,14 +84,14 @@ export async function sendMessage(opts) {
                 form.append("media", new Blob([new Uint8Array(file.data)], { type: file.contentType }), file.name);
             }
         }
-        res = await apiPostMultipart("/api/v1/messages", form, auth.apiKey);
+        res = await apiPostMultipart("/api/v1/messages", form, auth?.apiKey);
     }
     if (!res.ok)
         throw new DialError("send_failed", res.error, res.status);
     return res.data.message;
 }
 export async function listMessages(opts) {
-    const auth = requireAuth();
+    const auth = maybeAuth();
     const params = new URLSearchParams();
     if (opts.numberId)
         params.set("numberId", opts.numberId);
@@ -100,13 +100,13 @@ export async function listMessages(opts) {
     if (opts.since)
         params.set("since", opts.since);
     const qs = params.toString();
-    const res = await apiGet(qs ? `/api/v1/messages?${qs}` : "/api/v1/messages", auth.apiKey);
+    const res = await apiGet(qs ? `/api/v1/messages?${qs}` : "/api/v1/messages", auth?.apiKey);
     if (!res.ok)
         throw new DialError("list_failed", res.error, res.status);
     return res.data.messages ?? [];
 }
 export async function replyToMessage(opts) {
-    const auth = requireAuth();
+    const auth = maybeAuth();
     // No `to`/`fromNumberId`: the server derives both from the target message —
     // the reply stays in the conversation the target is part of.
     const payload = {};
@@ -114,7 +114,7 @@ export async function replyToMessage(opts) {
         payload.body = opts.body;
     if (opts.reaction !== undefined)
         payload.reaction = opts.reaction;
-    const res = await apiPost(`/api/v1/messages/${encodeURIComponent(opts.messageId)}/reply`, payload, auth.apiKey);
+    const res = await apiPost(`/api/v1/messages/${encodeURIComponent(opts.messageId)}/reply`, payload, auth?.apiKey);
     if (!res.ok)
         throw new DialError("reply_failed", res.error, res.status);
     return res.data.message;

package/dist/lib/ops/numbers.js

@@ -1,15 +1,15 @@
 import { apiGet, apiPost, apiPatch } from "../api.js";
-import { requireAuth } from "./auth.js";
+import { maybeAuth } from "./auth.js";
 import { DialError } from "./errors.js";
 export async function listNumbers() {
-    const auth = requireAuth();
-    const res = await apiGet("/api/v1/numbers", auth.apiKey);
+    const auth = maybeAuth();
+    const res = await apiGet("/api/v1/numbers", auth?.apiKey);
     if (!res.ok)
         throw new DialError("list_failed", res.error, res.status);
-    return { numbers: res.data.numbers ?? [], defaultNumberId: auth.phoneNumberId ?? null };
+    return { numbers: res.data.numbers ?? [], defaultNumberId: auth?.phoneNumberId ?? null };
 }
 export async function purchaseNumber(opts) {
-    const auth = requireAuth();
+    const auth = maybeAuth();
     const body = {
         inboundInstruction: opts.inboundInstruction,
         explicitProgrammaticConsent: opts.explicitProgrammaticConsent,
@@ -23,7 +23,7 @@ export async function purchaseNumber(opts) {
         body.capabilities = ["sms", "call", "imessage"];
     else if (opts.areaCode)
         body.areaCode = opts.areaCode;
-    const res = await apiPost("/api/v1/numbers", body, auth.apiKey);
+    const res = await apiPost("/api/v1/numbers", body, auth?.apiKey);
     if (!res.ok)
         throw new DialError("purchase_failed", res.error, res.status);
     return res.data.number;
@@ -44,10 +44,10 @@ export async function setNumberProperties(opts) {
     if (Object.keys(body).length === 0) {
         throw new DialError("bad_request", "Provide at least one property to update (inboundInstruction, inboundVoiceGender, inboundLanguage, nickname, or maxCallDurationSeconds).");
     }
-    const auth = requireAuth();
+    const auth = maybeAuth();
     // The REST API keys numbers by id; the CLI/tool takes the E.164 number for ergonomics,
     // so resolve it to its id first.
-    const list = await apiGet("/api/v1/numbers", auth.apiKey);
+    const list = await apiGet("/api/v1/numbers", auth?.apiKey);
     if (!list.ok)
         throw new DialError("list_failed", list.error, list.status);
     const match = list.data.numbers.find((n) => n.number === opts.number);
@@ -55,7 +55,7 @@ export async function setNumberProperties(opts) {
         const known = list.data.numbers.map((n) => n.number).join(", ") || "(none)";
         throw new DialError("number_not_found", `No phone number ${opts.number} on your account. Yours: ${known}.`);
     }
-    const res = await apiPatch(`/api/v1/numbers/${match.id}`, body, auth.apiKey);
+    const res = await apiPatch(`/api/v1/numbers/${match.id}`, body, auth?.apiKey);
     if (!res.ok)
         throw new DialError("update_failed", res.error, res.status);
     return res.data.number;

package/dist/lib/ops/typing.js

@@ -1,5 +1,5 @@
 import { apiPost } from "../api.js";
-import { requireAuth, requireFromNumber } from "./auth.js";
+import { maybeAuth, requireFromNumber } from "./auth.js";
 import { DialError } from "./errors.js";
 /**
  * Show or clear a typing indicator (POST /api/v1/typing). iMessage numbers
@@ -7,9 +7,9 @@ import { DialError } from "./errors.js";
  * no-ops, so calling this unconditionally is safe.
  */
 export async function setTyping(opts) {
-    const auth = requireAuth();
+    const auth = maybeAuth();
     const fromNumber = requireFromNumber(auth, opts.fromNumber);
-    const res = await apiPost("/api/v1/typing", { toNumber: opts.toNumber, value: opts.value, fromNumber }, auth.apiKey);
+    const res = await apiPost("/api/v1/typing", { toNumber: opts.toNumber, value: opts.value, fromNumber }, auth?.apiKey);
     if (!res.ok)
         throw new DialError("typing_failed", res.error, res.status);
     return res.data;

package/dist/lib/sandbox.js

@@ -0,0 +1,94 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { paths } from "./paths.js";
+import { supervisorAvailability } from "./supervisor/index.js";
+/**
+ * "Sandbox mode" is the Dial CLI running inside an ephemeral agent container
+ * (e.g. NanoClaw) where:
+ *   - there is no saved auth file / raw API key — a transparent HTTPS proxy
+ *     (OneCLI) injects the real `Authorization` header for api.getdial.ai, so
+ *     the CLI must send requests keyless and let the proxy add auth;
+ *   - there is no service supervisor (no launchd / no `systemd --user`), so
+ *     machine-lifecycle commands (`listen`, `update`, `uninstall`, …) are
+ *     meaningless and only confuse the agent;
+ *   - onboarding/signup/mcp make no sense — the container is pre-provisioned.
+ *
+ * Detection precedence (see {@link computeSandbox}):
+ *   1. Explicit override via DIAL_SANDBOX ("1"/"true" → on, "0"/"false" → off).
+ *   2. Inference: no supervisor AND HTTPS_PROXY set AND no `.not-sandbox`
+ *      sentinel in the Dial data dir.
+ *
+ * The result is memoized: computed once per process.
+ */
+/** Commands (and their subcommands) disabled in sandbox mode. */
+export const SANDBOX_DISABLED_COMMANDS = [
+    "listen",
+    "signup",
+    "onboard",
+    "local-target",
+    "mcp",
+    "update",
+    "uninstall",
+];
+/** Absolute path of the opt-out sentinel file: `<dialDataDir>/.not-sandbox`. */
+export function sentinelPath() {
+    return join(paths().dataDir, ".not-sandbox");
+}
+/** Parse the DIAL_SANDBOX override. Returns undefined for unset/unrecognized values. */
+function parseOverride(raw) {
+    if (raw === undefined)
+        return undefined;
+    const v = raw.trim().toLowerCase();
+    if (v === "1" || v === "true")
+        return true;
+    if (v === "0" || v === "false")
+        return false;
+    return undefined;
+}
+/** existsSync for the sentinel, treating any filesystem error as "absent". */
+function sentinelExists() {
+    try {
+        return existsSync(sentinelPath());
+    }
+    catch {
+        return false;
+    }
+}
+/** Pure computation of sandbox state from the current env/filesystem. Not memoized. */
+export function computeSandbox() {
+    const override = parseOverride(process.env.DIAL_SANDBOX);
+    if (override === true)
+        return { sandbox: true, reason: "forced on via DIAL_SANDBOX" };
+    if (override === false)
+        return { sandbox: false, reason: "forced off via DIAL_SANDBOX" };
+    if (supervisorAvailability().available) {
+        return { sandbox: false, reason: "service supervisor available" };
+    }
+    const httpsProxy = (process.env.HTTPS_PROXY ?? "").trim();
+    if (!httpsProxy)
+        return { sandbox: false, reason: "HTTPS_PROXY not set" };
+    if (sentinelExists())
+        return { sandbox: false, reason: `${sentinelPath()} sentinel present` };
+    return { sandbox: true, reason: "inferred: HTTPS_PROXY set + no service supervisor" };
+}
+let cached;
+/** Memoized sandbox state (computed once per process). */
+export function sandboxState() {
+    if (cached === undefined)
+        cached = computeSandbox();
+    return cached;
+}
+/** Whether the CLI is running in sandbox mode. Memoized. */
+export function isSandbox() {
+    return sandboxState().sandbox;
+}
+/** The message shown when a disabled command is invoked in sandbox mode. */
+export function sandboxDisabledMessage(command) {
+    const { reason } = sandboxState();
+    return (`'dial ${command}' is disabled in sandbox mode (${reason}). ` +
+        `To run it here, set DIAL_SANDBOX=0 or create ${sentinelPath()}.`);
+}
+/** Reset the memoized state. Test-only — the CLI never mutates it at runtime. */
+export function resetSandboxCacheForTests() {
+    cached = undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getdial/cli",
-  "version": "0.32.0",
+  "version": "0.33.1",
   "description": "Dial CLI — install, sign up, and run the local listen service.",
   "license": "MIT",
   "repository": {