@iletai/nzb 1.1.2 → 1.1.3

package/dist/cli.js

@@ -1,8 +1,27 @@
 #!/usr/bin/env node
-import { readFileSync } from "fs";
+import { spawnSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 const __dirname = dirname(fileURLToPath(import.meta.url));
+// Auto-detect system CA bundle for corporate environments with TLS inspection.
+// NODE_EXTRA_CA_CERTS must be set BEFORE the Node.js process starts — setting it
+// at runtime via process.env does NOT work for Node.js 24's fetch() (undici).
+// When missing, we re-exec the current process with the env var set.
+if (!process.env.NODE_EXTRA_CA_CERTS && !process.env.__NZB_CA_INJECTED) {
+    const found = [
+        "/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu
+        "/etc/pki/tls/certs/ca-bundle.crt", // RHEL/CentOS/Fedora
+        "/etc/ssl/cert.pem", // macOS / Alpine
+    ].find((p) => existsSync(p));
+    if (found) {
+        const result = spawnSync(process.execPath, [...process.execArgv, ...process.argv.slice(1)], {
+            stdio: "inherit",
+            env: { ...process.env, NODE_EXTRA_CA_CERTS: found, __NZB_CA_INJECTED: "1" },
+        });
+        process.exit(result.status ?? 1);
+    }
+}
 function getVersion() {
     try {
         const pkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));

package/dist/daemon.js

@@ -1,5 +1,4 @@
 import { spawn } from "child_process";
-import { existsSync } from "fs";
 import { broadcastToSSE, startApiServer } from "./api/server.js";
 import { config } from "./config.js";
 import { getClient, stopClient } from "./copilot/client.js";
@@ -7,20 +6,9 @@ import { getWorkers, initOrchestrator, setMessageLogger, setProactiveNotify } fr
 import { closeDb, getDb } from "./store/db.js";
 import { createBot, sendProactiveMessage, startBot, stopBot } from "./telegram/bot.js";
 import { checkForUpdate } from "./update.js";
-// Auto-detect system CA bundle for corporate environments with TLS inspection.
-// NODE_EXTRA_CA_CERTS must be set before any TLS connection is made.
-// Users can override via NODE_EXTRA_CA_CERTS env var or NODE_EXTRA_CA_CERTS in ~/.nzb/.env.
-if (!process.env.NODE_EXTRA_CA_CERTS) {
-    const knownCaBundles = [
-        "/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu
-        "/etc/pki/tls/certs/ca-bundle.crt", // RHEL/CentOS/Fedora
-        "/etc/ssl/cert.pem", // macOS / Alpine
-    ];
-    const found = knownCaBundles.find((p) => existsSync(p));
-    if (found) {
-        process.env.NODE_EXTRA_CA_CERTS = found;
-        console.log(`[nzb] Auto-detected system CA bundle: ${found}`);
-    }
+// Log the active CA bundle (injected by cli.ts via re-exec).
+if (process.env.NODE_EXTRA_CA_CERTS) {
+    console.log(`[nzb] Using system CA bundle: ${process.env.NODE_EXTRA_CA_CERTS}`);
 }
 function truncate(text, max = 200) {
     const oneLine = text.replace(/\n/g, " ").trim();

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@iletai/nzb",
-	"version": "1.1.2",
+	"version": "1.1.3",
 	"description": "NZB — a personal AI assistant for developers, built on the GitHub Copilot SDK",
 	"bin": {
 		"nzb": "dist/cli.js"