@pipod/cli 0.1.13 → 0.1.14

package/man/pipod-config.5

@@ -1,4 +1,4 @@
-.TH "PIPOD\-CONFIG" "5" "October 2026" "0.1.13"
+.TH "PIPOD\-CONFIG" "5" "October 2026" "0.1.14"
 .SH "NAME"
 \fBpipod-config\fR \- pi pod configuration files
 .SH SYNOPSIS
@@ -20,6 +20,18 @@ file and \fBpipod settings <layer> set <key> <value>\fP changes one key on the s
 .P
 A key of the wrong type fails the command that reads it, naming the key\. An unknown key is
 ignored with a warning\.
+.SH SESSION PROXIES
+.P
+Session WebSockets honor \fBWSS_PROXY\fP (\fBWS_PROXY\fP for plain WebSockets), generic
+\fBALL_PROXY\fP settings, and then fall back to \fBHTTPS_PROXY\fP (\fBHTTP_PROXY\fP for plain
+WebSockets)\. Lowercase names take precedence over uppercase names; npm proxy
+settings follow \fBproxy\-from\-env\fP conventions\. \fBNO_PROXY\fP supports hostnames,
+domain suffixes, optional ports, and \fB*\fP for direct connections\.
+.P
+Proxy URLs must use HTTP or HTTPS\. Session connections use CONNECT tunnels and
+retain TLS certificate verification for both the proxy and the destination\.
+These variables apply to initial attachment and reconnection, without requiring
+\fBNODE_USE_ENV_PROXY\fP\|\. With no matching proxy setting, sessions connect directly\.
 .SH POD KEYS
 .P
 These travel to the server and decide what a pod gets\. The defaults are the built\-in layer's\.

package/man/pipod-config.5.md

@@ -20,6 +20,19 @@ file and `pipod settings <layer> set <key> <value>` changes one key on the serve
 A key of the wrong type fails the command that reads it, naming the key. An unknown key is
 ignored with a warning.
 
+## SESSION PROXIES
+
+Session WebSockets honor `WSS_PROXY` (`WS_PROXY` for plain WebSockets), generic
+`ALL_PROXY` settings, and then fall back to `HTTPS_PROXY` (`HTTP_PROXY` for plain
+WebSockets). Lowercase names take precedence over uppercase names; npm proxy
+settings follow `proxy-from-env` conventions. `NO_PROXY` supports hostnames,
+domain suffixes, optional ports, and `*` for direct connections.
+
+Proxy URLs must use HTTP or HTTPS. Session connections use CONNECT tunnels and
+retain TLS certificate verification for both the proxy and the destination.
+These variables apply to initial attachment and reconnection, without requiring
+`NODE_USE_ENV_PROXY`. With no matching proxy setting, sessions connect directly.
+
 ## POD KEYS
 
 These travel to the server and decide what a pod gets. The defaults are the built-in layer's.

package/man/pipod.1

@@ -1,4 +1,4 @@
-.TH "PIPOD" "1" "October 2026" "0.1.13"
+.TH "PIPOD" "1" "October 2026" "0.1.14"
 .SH "NAME"
 \fBpipod\fR \- run pi coding\-agent sessions in server\-managed pods
 .SH SYNOPSIS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pipod/cli",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Run pi coding-agent sessions in server-managed pods",
   "type": "module",
   "license": "AGPL-3.0-only",
@@ -34,7 +34,7 @@
     "build:man": "marked-man --no-breaks man/pipod.1.md -o man/pipod.1 && marked-man --no-breaks man/pipod-config.5.md -o man/pipod-config.5",
     "typecheck": "tsc --noEmit",
     "lint": "node --import tsx scripts/check-runtime-surface.ts",
-    "test:integration": "node --import tsx --test --test-concurrency=1 test/integration/account-cli.test.ts test/integration/account-login-me-http.test.ts test/integration/billing-cli.test.ts test/integration/capacity-wait-http.test.ts test/integration/cli-main.test.ts test/integration/local-extensions.test.ts test/integration/nested-pods.test.ts test/integration/oidc-security.test.ts test/integration/secrets-cli.test.ts test/integration/workspace-seeding.test.ts test/integration/workstation-wake-http.test.ts",
+    "test:integration": "node --import tsx --test --test-concurrency=1 test/integration/account-cli.test.ts test/integration/account-login-me-http.test.ts test/integration/billing-cli.test.ts test/integration/capacity-wait-http.test.ts test/integration/cli-main.test.ts test/integration/local-extensions.test.ts test/integration/nested-pods.test.ts test/integration/oidc-security.test.ts test/integration/secrets-cli.test.ts test/integration/session-websocket-proxy.test.ts test/integration/workspace-seeding.test.ts test/integration/workstation-wake-http.test.ts",
     "check": "npm run lint && npm run typecheck",
     "prepublishOnly": "npm run build"
   },
@@ -42,11 +42,14 @@
     "@earendil-works/pi-coding-agent": "1.0.2",
     "@earendil-works/pi-tui": "1.0.2",
     "cron-parser": "^5.10.0",
+    "https-proxy-agent": "^9.1.0",
     "jose": "^5.10.0",
+    "proxy-from-env": "^1.1.0",
     "ws": "^8.22.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
+    "@types/proxy-from-env": "^1.0.4",
     "@types/ws": "^8.18.1",
     "marked-man": "^2.1.1",
     "tsup": "^8.3.5",