@getdial/cli 0.33.0 → 0.33.1

package/dist/commands/doctor.js

@@ -3,6 +3,17 @@ function humanRender(r) {
     const lines = [];
     lines.push(`dial ${r.cli.version}  (node ${r.cli.node})`);
     lines.push(`backend:     ${r.backend.url}  ${r.backend.reachable ? `reachable${r.backend.latencyMs != null ? ` (${r.backend.latencyMs}ms)` : ""}` : "UNREACHABLE"}`);
+    if (r.sandbox) {
+        // Sandbox: no local key — the gateway injects credentials. Don't say "not
+        // signed in" (misleading) or surface pending-otp/listen (all disabled here).
+        lines.push(`mode:        sandbox (credentials injected by the gateway)`);
+        lines.push(`auth:        ${r.auth.keyValid ? "credential connected via the gateway" : "no valid Dial credential connected in the vault"}`);
+        lines.push("");
+        lines.push(r.nextStep === "ready"
+            ? "next: ready"
+            : "next: connect the Dial credential in your gateway/vault (this agent has none)");
+        return lines.join("\n");
+    }
     if (r.auth.signedIn) {
         lines.push(`auth:        signed in as ${r.auth.email} (account ${r.auth.accountId}, key sk_live_***${r.auth.apiKeyFingerprint})${r.auth.keyValid === false ? "  [key rejected by backend]" : ""}`);
     }

package/dist/lib/api.js

@@ -1,6 +1,16 @@
-import { request, fetch as undiciFetch, FormData as UndiciFormData } from "undici";
+import { request, fetch as undiciFetch, FormData as UndiciFormData, setGlobalDispatcher, EnvHttpProxyAgent } from "undici";
 import { logger } from "./log.js";
 import { VERSION } from "./version.js";
+// Route this package's undici requests through HTTP(S)_PROXY when one is set.
+// The `undici` npm package keeps its OWN global dispatcher, which — unlike
+// Node's built-in fetch (wired by NODE_USE_ENV_PROXY) — ignores the proxy env
+// vars. In a proxied environment (e.g. the NanoClaw agent sandbox, where the
+// OneCLI gateway sits on HTTPS_PROXY and injects the Authorization header for
+// api.getdial.ai) our `request()`/`fetch()` calls would otherwise bypass the
+// gateway entirely and go out UNAUTHENTICATED → 401. Opt in explicitly.
+if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy) {
+    setGlobalDispatcher(new EnvHttpProxyAgent());
+}
 // The bundled undici only multipart-encodes its own FormData class (realm
 // check) — Node's global FormData would be coerced to a text/plain string.
 export { UndiciFormData as ApiFormData };

package/dist/lib/ops/account.js

@@ -4,11 +4,36 @@ import { supervisorStatus, lastEventAtFromLog, supervisorAvailability } from "..
 import { paths } from "../paths.js";
 import { VERSION } from "../version.js";
 import { installSkill, isSupportedAgent, SUPPORTED_AGENTS } from "../skill-install.js";
+import { isSandbox } from "../sandbox.js";
 import { DialError } from "./errors.js";
 const OTP_EXPIRY_MS = 10 * 60 * 1000;
 const PENDING_FRESH_MS = 10 * 60 * 1000;
 export async function accountStatus() {
     const ping = await pingBackend();
+    if (isSandbox()) {
+        // No local auth file in a sandbox — the gateway injects the credential.
+        // Probe keyless (the proxy adds the Authorization header) to report whether
+        // the credential is actually connected in the vault. Never suggest
+        // signup/onboard/listen here — those are disabled in a sandbox.
+        const probe = await apiGet("/api/v1/account");
+        const connected = probe.ok;
+        return {
+            cli: { version: VERSION, node: process.versions.node },
+            backend: { url: baseUrl(), reachable: ping.reachable, latencyMs: ping.latencyMs },
+            auth: {
+                signedIn: connected,
+                email: null,
+                accountId: null,
+                apiKeyPresent: connected,
+                apiKeyFingerprint: null,
+                keyValid: connected,
+            },
+            pendingOtp: { verificationId: null, ageSeconds: null, expired: null },
+            listen: { installed: false, running: false, lastEventAt: null },
+            sandbox: true,
+            nextStep: connected ? "ready" : "connect_credential",
+        };
+    }
     const auth = readAuth();
     const pending = readPendingSignup();
     let keyValid = null;
@@ -61,6 +86,7 @@ export async function accountStatus() {
             expired: pendingExpired,
         },
         listen: listenState,
+        sandbox: false,
         nextStep,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getdial/cli",
-  "version": "0.33.0",
+  "version": "0.33.1",
   "description": "Dial CLI — install, sign up, and run the local listen service.",
   "license": "MIT",
   "repository": {