@opennous/cli 0.12.2 → 0.12.3

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @opennous/cli changelog
 
+## 0.12.3
+
+### Fixed: a plain message when the server's certificate isn't trusted
+
+Against a self-hosted install with Caddy's local certificate, the CLI used to crash with
+a Node stack trace (`UNABLE_TO_GET_ISSUER_CERT_LOCALLY`). It now says to point
+`NODE_EXTRA_CA_CERTS` at the root certificate and links the self-host guide (GET-1011).
+
+On Windows, where `api.localhost` doesn't resolve until the hosts file names it, it says which
+line to add (GET-1015).
+
 ## 0.10.1
 
 ### Changed — new default vault folder structure

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opennous/cli",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "description": "Nous CLI — set up Nous, connect it to your coding agent, and read the Context API from your terminal",
   "type": "module",
   "bin": {
@@ -13,6 +13,7 @@
   ],
   "scripts": {
     "dev": "node src/index.js",
+    "test": "node ../../scripts/run-tests.mjs",
     "start": "node src/index.js"
   },
   "keywords": [

package/src/certHint.js

@@ -0,0 +1,46 @@
+// A self-hosted Nous on a laptop serves https://api.localhost with Caddy's own local CA, which
+// Node does not trust. fetch then rejects with a bare "fetch failed" whose cause carries one of
+// these codes. Name the fix in one line instead of printing a stack trace (GET-1011).
+const UNTRUSTED_CERT_CODES = new Set([
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "UNABLE_TO_GET_ISSUER_CERT",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+]);
+
+export const CERT_DOCS_URL =
+  "https://github.com/NousC/opennous/blob/main/docs/self-host-bundled.md#trying-it-on-a-laptop";
+
+/** The cert code on an error or anywhere down its `cause` chain, else null. */
+export function untrustedCertCode(err) {
+  for (let e = err, depth = 0; e && depth < 5; e = e.cause, depth++) {
+    if (typeof e.code === "string" && UNTRUSTED_CERT_CODES.has(e.code)) return e.code;
+  }
+  return null;
+}
+
+/** The *.localhost name on a "not found" error down the cause chain, else null. */
+function unresolvedLocalhost(err) {
+  for (let e = err, depth = 0; e && depth < 5; e = e.cause, depth++) {
+    if (e.code === "ENOTFOUND" && /\.localhost$/i.test(e.hostname || "")) return e.hostname;
+  }
+  return null;
+}
+
+/** One line naming the fix for a laptop self-host the CLI can't reach (untrusted certificate, or a
+ *  *.localhost name Windows doesn't resolve), or null when the error is something else. */
+export function certHint(err) {
+  // Windows resolves only "localhost" itself; the subdomains need the hosts file (GET-1015).
+  const host = unresolvedLocalhost(err);
+  if (host) {
+    return `Couldn't connect: ${host} doesn't resolve on this machine (Windows only resolves "localhost" itself). ` +
+      `Add "127.0.0.1 api.localhost mcp.localhost" to your hosts file and run it again. ` +
+      `How: ${CERT_DOCS_URL}`;
+  }
+  const code = untrustedCertCode(err);
+  if (!code) return null;
+  return `Couldn't connect: this server's TLS certificate isn't trusted by Node (${code}). ` +
+    `Set NODE_EXTRA_CA_CERTS to your server's CA certificate (for a local self-host, Caddy's root.crt) and run it again. ` +
+    `How: ${CERT_DOCS_URL}`;
+}

package/src/index.js

@@ -12,6 +12,16 @@ import { homedir, hostname } from "os";
 import { join, resolve, dirname, relative, sep } from "path";
 import { createInterface } from "readline";
 import { spawn, spawnSync } from "child_process";
+import { certHint } from "./certHint.js";
+
+// An untrusted certificate (a local self-host behind Caddy's own CA) surfaces as a rejected
+// fetch somewhere in an async action. Print the one-line fix instead of a stack trace; anything
+// else still fails the way it always did.
+process.on("unhandledRejection", (err) => {
+  const hint = certHint(err);
+  if (hint) { console.error(hint); process.exit(1); }
+  throw err;
+});
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
@@ -32,7 +42,7 @@ async function fetchWhoami(apiUrl, key) {
     return await r.json();
   } catch { return null; }
 }
-// "Bennet Glinder · WindSeeker AI · admin · AE"
+// "Theo Bramwell · Fernpoint · admin · AE"
 function identityLine(who) {
   const y = who?.you || {};
   return [
@@ -114,11 +124,17 @@ function apiClient() {
         if (v !== undefined && v !== null) url.searchParams.set(k, String(v));
       }
     }
-    const res = await fetch(url.toString(), {
-      method,
-      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
-      body: body ? JSON.stringify(body) : undefined,
-    });
+    let res;
+    try {
+      res = await fetch(url.toString(), {
+        method,
+        headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+        body: body ? JSON.stringify(body) : undefined,
+      });
+    } catch (e) {
+      console.error(certHint(e) || `Couldn't reach ${apiUrl}: ${e.message}`);
+      process.exit(1);
+    }
     if (!res.ok) {
       const err = await res.json().catch(() => ({ message: res.statusText }));
       console.error(`Error: ${err.error || err.message}`);
@@ -245,7 +261,7 @@ async function browserLogin(url, opts = {}) {
     }
     start = await r.json();
   } catch (e) {
-    console.error(`Couldn't start: ${e.message}`);
+    console.error(certHint(e) || `Couldn't start: ${e.message}`);
     process.exit(1);
   }