@rogatio/cli 6.21.1 → 6.21.2

package/README.md

@@ -42,7 +42,7 @@ rogatio <command> [options]
 | `rogatio import requestly <export.json>` | Migrate a Requestly export into `.rogatio.json`. `--out <path>` chooses the file (default `.rogatio.json`); `--merge` appends onto an existing project; `--json` prints the report. |
 | `rogatio test [path] [url...]` | Run offline dry-run tests. Any filename is accepted; the default is `.rogatio.json` in the current directory. |
 | `rogatio ai <setup\|ls\|show\|delete\|test>` | AI provider configuration. `setup` interactive; `ls` list; `show` redacted; `delete` remove; `test` connection. |
-| `rogatio runtime <install\|uninstall\|verify>` | Register the native-messaging host with `install` and trust the device-local CA in one **transactional** call; it needs elevated privileges (Linux `sudo`, macOS keychain authorization, Windows Administrator) and rolls back with exit `1` and `trust unsupported: <reasons>` when a capability or elevation is missing. Release users never pass `--extension-id`. That flag is only for development (a local unpacked build without the release key) and for forks. `uninstall` removes the host manifest, the device-local CA files, and the CA trust installation (idempotent). `verify` reports whether manifest, `runtime-host` wrapper, allowed origins, and CA trust are all valid, and fails when `allowed_origins` omits the release ID. Release users never pass `--extension-id` on verify either. |
+| `rogatio runtime <install\|uninstall\|verify>` | Register the native-messaging host with `install` and trust the device-local CA in one **transactional** call; it needs elevated privileges (Linux `sudo`, macOS keychain authorization, Windows Administrator) and rolls back with exit `1` and `trust unsupported: <reasons>` when a capability or elevation is missing. Release users never pass `--extension-id`. That flag is only for development (a local unpacked build without the release key) and for forks. `uninstall` removes the host manifest, the device-local CA files, and the CA trust installation (idempotent). If the trust-store refresh fails, it exits `1` and does not print `runtime uninstall complete`. `verify` reports whether manifest, `runtime-host` wrapper, allowed origins, and CA trust are all valid, and fails when `allowed_origins` omits the release ID. Release users never pass `--extension-id` on verify either. |
 | `rogatio runtime host [path]` | Run the consolidated native-messaging host for the project (pair/authorize/body transforms and mock responses over stdio). Normally launched by the browser; run manually only for debugging. `--root <dir>` overrides the confined mock file root. When omitted, a saved device-local root for that project file is used, otherwise the project directory. A stdin project that contains a file mock requires `--root`. |
 
 `rogatio edit` includes **Run checks**. It calls `POST /e/<session>/api/doctor` (session path, loopback Origin, and `X-CSRF-Token`) and shows editor checks plus the same report as `rogatio doctor` for the open file. A provider configured after the page opened is picked up on the next `rogatio edit`.

package/dist/node/index.js

@@ -2306,7 +2306,7 @@ import { lstat as lstat3, mkdtemp, open as open4, rm as rm2 } from "node:fs/prom
 import { tmpdir } from "node:os";
 import { join as join3 } from "node:path";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants5, mkdirSync, unlinkSync } from "node:fs";
+import { accessSync as accessSync2, constants as constants5, mkdirSync } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 import { join as posixJoin2 } from "node:path/posix";
 import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
@@ -23706,9 +23706,10 @@ var linuxAdapter = {
     throw new TrustError("trust.internal", reason, [reason]);
   },
   async caTrustRemover() {
-    try {
-      unlinkSync(DEBIAN_CERT);
-    } catch {
+    if (caBackend() === "debian") {
+      await sudoOrThrow(["rm", "-f", DEBIAN_CERT]);
+      await sudoOrThrow(["update-ca-certificates"]);
+      return;
     }
     if (!toolOnPath("update-ca-trust")) return;
     const present = P11_CERTS.filter((path2) => exists(path2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.21.1",
+  "version": "6.21.2",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",