@sunilaleti/hx 1.0.0 → 1.1.1

package/CHANGELOG.md

@@ -28,6 +28,40 @@ the project follows [semantic versioning](https://semver.org/).
 
 ---
 
+## [1.1.1] - 2026-10-31
+
+### Fixed
+
+- HTTPS failed on macOS for every host - OpenRouter, ChatGPT, Tavily, npm - with "unable to get
+  local issuer certificate". HX verified against the OS trust store alone, and on macOS Node reads
+  only the certificates trusted by hand there, not the system roots. HX now trusts Node's own
+  roots and the OS store together, so a corporate CA in the keychain still works.
+- A certificate HX will not accept is reported with what to do about it - add the CA to the
+  system trust store or set `HX_CA_BUNDLE` - instead of Node's advice to restart it with
+  `--use-system-ca`, and is not retried: another attempt meets the same certificate.
+
+---
+
+## [1.1.0] - 2026-10-31
+
+### Added
+
+- HX updates itself, as Claude Code does. About once a day a session checks npm for a newer
+  release, installs it in the background with `npm install --global`, and says to restart.
+  `hx update` (or `hx upgrade`) updates now. Turn the background update off with
+  `"autoUpdates": false` in settings or `HX_DISABLE_AUTOUPDATER=1`. Only an npm install updates
+  itself; `hx -p` never does.
+  1.0.0 has no updater: install 1.1.0 once with `npm install --global @sunilaleti/hx@latest`, and
+  it keeps itself current from there.
+
+### Changed
+
+- CI runs the suite twice instead of four times - Linux and macOS, both on Node 24 - and
+  publishes with the npm that ships with Node 24. Node 22, the oldest HX supports, is checked
+  by installing the package on it and running `hx --version`.
+
+---
+
 ## [1.0.0] - 2026-10-31
 
 ### Changed
@@ -1103,7 +1137,9 @@ First release, published to PyPI as [`hx-cli`](https://pypi.org/project/hx-cli/)
 - `/configure` and `hx auth` for the OpenRouter key, `hx upgrade` for
   self-update, and `install.sh` bootstrapping uv with a pinned Python.
 
-[Unreleased]: https://github.com/aletisunil/hx/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/aletisunil/hx/compare/v1.1.1...HEAD
+[1.1.1]: https://github.com/aletisunil/hx/compare/v1.1.0...v1.1.1
+[1.1.0]: https://github.com/aletisunil/hx/compare/v1.0.0...v1.1.0
 [1.0.0]: https://github.com/aletisunil/hx/compare/v0.3.0-beta.1...v1.0.0
 [0.3.0-beta.1]: https://github.com/aletisunil/hx/compare/v0.2.20...v0.3.0-beta.1
 [0.2.20]: https://github.com/aletisunil/hx/compare/v0.2.19...v0.2.20

package/README.md

@@ -16,8 +16,13 @@ npm install --global @sunilaleti/hx
 ```
 
 HX runs on [Node.js](https://nodejs.org/) 22.15 or newer, on macOS and Linux.
-Run the same command again to update. Then run `hx`: the first time, it opens
-with the HX logo and says to type `/login`.
+Then run `hx`: the first time, it opens with the HX logo and says to type
+`/login`.
+
+HX keeps itself up to date, as Claude Code does. About once a day, a session
+checks npm for a newer release, installs it in the background, and says to
+restart. Run `hx update` to update now. To turn the background update off, set
+`"autoUpdates": false` in `~/.hx/settings.json`, or `HX_DISABLE_AUTOUPDATER=1`.
 
 Or let the install script check your Node.js version and run that command:
 
@@ -288,9 +293,9 @@ number.
 Credits are *not* in the status bar's cost, which prices tokens: `/cost`
 under-reports a session that searched.
 
-**Behind a TLS-inspecting proxy.** HX verifies certificates against the
-operating system's trust store, so a corporate CA the machine already trusts
-needs no setup. When the CA lives only in a file, name it:
+**Behind a TLS-inspecting proxy.** HX verifies certificates against Node's own
+roots and the operating system's trust store together, so a corporate CA the
+machine already trusts needs no setup. When the CA lives only in a file, name it:
 
 ```sh
 export HX_CA_BUNDLE=/path/to/corp-ca.pem   # SSL_CERT_FILE and REQUESTS_CA_BUNDLE also work
@@ -349,6 +354,7 @@ hx auth login [provider]    # sign in (openrouter, openai-codex, devin, claude-c
 hx auth logout <provider>   # forget a stored credential
 hx docs [section]           # the manual; no argument lists its sections
 hx changelog [version]      # what shipped in each version
+hx update                   # install the newest release now (also: hx upgrade)
 ```
 
 Print mode is the scriptable one: stdout carries only the assistant's text, so
@@ -663,6 +669,7 @@ along with the `.hx/.gitignore` it added to hide it.
 {
   "theme": "dark",                    // dark | light | ansi, or a file in ~/.hx/themes
   "quiet_startup": false,             // skip the startup header
+  "autoUpdates": true,                // install new releases in the background, once a day
 
   "models": {
     "model": "anthropic/claude-sonnet-4.5",

package/dist/hx.js

@@ -534,10 +534,8 @@ function tlsAgentOptions() {
     const bundle = caBundle();
     let ca;
     if (bundle !== null) ca = certificates(readText(bundle));
-    else {
-      ca = tls.getCACertificates("system");
-      if (ca.length === 0) ca = tls.getCACertificates("default");
-    }
+    else
+      ca = [.../* @__PURE__ */ new Set([...tls.getCACertificates("default"), ...tls.getCACertificates("system")])];
     tlsOptions = { ca, ALPNProtocols: ["http/1.1"] };
   }
   return tlsOptions;
@@ -582,12 +580,10 @@ function withTlsHint(message2) {
   return `${rstrip(rstrip(message2), ".")}. ${hint2}`;
 }
 function describe(error) {
+  const certificate = certificateFailure(error);
+  if (certificate !== null) return certificate;
   for (const err of chain(error)) {
     const code2 = err.code ?? "";
-    if (VERIFY_CODES.has(code2)) {
-      const reason = flatten(err.message || "certificate verify failed");
-      return `TLS certificate verification failed (${reason}). ${tlsHint(reason)}`;
-    }
     if (code2.startsWith("ERR_SSL") || code2.startsWith("ERR_TLS")) {
       return `TLS handshake failed: ${flatten(err.message)}.`;
     }
@@ -599,6 +595,19 @@ function describe(error) {
   const failure2 = error;
   return withTlsHint(`${failure2?.name ?? "Error"}: ${flatten(String(failure2?.message ?? error))}`);
 }
+function certificateFailure(error) {
+  for (const err of chain(error)) {
+    if (!VERIFY_CODES.has(err.code ?? "")) continue;
+    const reason = flatten(
+      (err.message || "certificate verify failed").replace(
+        /;\s*if the root CA[\s\S]*$/,
+        ""
+      )
+    );
+    return `TLS certificate verification failed (${reason}). ${tlsHint(reason)}`;
+  }
+  return null;
+}
 function chain(error) {
   const seen = [];
   let current = error;
@@ -1725,11 +1734,17 @@ function streamEnd(stopReason, fields = {}) {
     planWindows: fields.planWindows ?? []
   };
 }
+function unreached(error) {
+  const certificate = certificateFailure(error);
+  if (certificate !== null) return new ProviderError(certificate);
+  return new ProviderError(error.message, { retryable: true });
+}
 var delta, ProviderError;
 var init_base = __esm({
   "src/providers/base.ts"() {
     "use strict";
     init_usage();
+    init_net();
     delta = (fields) => ({
       kind: "delta",
       ...fields
@@ -3288,7 +3303,7 @@ var init_openrouter = __esm({
           });
         } catch (error) {
           if (signal.aborted) throw error;
-          throw new ProviderError(error.message, { retryable: true });
+          throw unreached(error);
         }
         try {
           if (response.status >= 400) {
@@ -6351,7 +6366,8 @@ function buildSettings(data, cwd) {
     tui: { enterWhileBusy: busyRaw, fullscreen: truthy(tui.fullscreen ?? false) },
     tools: { hashline: truthy(pick(tools, "hashline", true)) },
     theme: pick(data, "theme", "dark"),
-    quietStartup: truthy(pick(data, "quietStartup", pick(data, "quiet_startup", false)))
+    quietStartup: truthy(pick(data, "quietStartup", pick(data, "quiet_startup", false))),
+    autoUpdates: truthy(pick(data, "autoUpdates", pick(data, "auto_updates", true)))
   };
 }
 function iterate(value) {
@@ -7189,7 +7205,7 @@ async function unaryCall(baseUrl, path, body, operation, timeout = 600, signal)
     [status3, payload] = await post(`${baseUrl}${path}`, body, UNARY_HEADERS, timeout, signal);
   } catch (error) {
     if (signal?.aborted) throw error;
-    throw new ProviderError(error.message, { retryable: true });
+    throw unreached(error);
   }
   if (status3 >= 400) throw httpError(operation, status3, payload);
   return payload;
@@ -7485,7 +7501,7 @@ var init_devin2 = __esm({
           });
         } catch (error) {
           if (signal.aborted) throw error;
-          throw new ProviderError(error.message, { retryable: true });
+          throw unreached(error);
         }
         try {
           if (response.status >= 400) {
@@ -67732,7 +67748,8 @@ init_net();
 init_py();
 
 // src/version.ts
-var VERSION = "1.0.0";
+var VERSION = "1.1.1";
+var PACKAGE = "@sunilaleti/hx";
 
 // src/providers/codex.ts
 init_base();
@@ -67803,7 +67820,7 @@ var CodexProvider = class {
       });
     } catch (error) {
       if (signal.aborted) throw error;
-      throw new ProviderError(error.message, { retryable: true });
+      throw unreached(error);
     }
     const windows = planWindows(response.headers);
     try {
@@ -75807,11 +75824,11 @@ var LANGUAGES = {
   ".go": GO,
   ".rs": RUST
 };
-var PACKAGE = "@vscode/tree-sitter-wasm";
+var PACKAGE2 = "@vscode/tree-sitter-wasm";
 var load = createRequire(import.meta.url);
 function packageDir() {
   try {
-    return dirname(load.resolve(PACKAGE));
+    return dirname(load.resolve(PACKAGE2));
   } catch {
     return null;
   }
@@ -75825,9 +75842,9 @@ function parserFor(grammar) {
     parser = (async () => {
       const directory = packageDir();
       if (directory === null)
-        throw new ToolError(`tree-sitter is not installed: npm install -g ${PACKAGE}`);
+        throw new ToolError(`tree-sitter is not installed: npm install -g ${PACKAGE2}`);
       runtime ??= (async () => {
-        const module = load(PACKAGE);
+        const module = load(PACKAGE2);
         await module.Parser.init({ locateFile: (file) => join(directory, file) });
         return module;
       })();
@@ -89678,6 +89695,17 @@ var HXSession = class {
     this.refreshStatus();
     if (this.loop.session.activeMessages().length) this.replayTranscript();
     if (this.extra.signIn) this.showSignIn(this.extra.signIn);
+    void this.extra.update?.then((outcome2) => {
+      if (outcome2 === null) return;
+      const level = outcome2.ok ? "success" : "warning";
+      if (this.view.transcript.blocks.length) {
+        this.notice(outcome2.message, level);
+        return;
+      }
+      this.view.transcript.add(new Spacer(1));
+      this.view.transcript.add(new Notice(outcome2.message, level));
+      this.runner.requestRender();
+    });
     if (this.loop.permissions !== null)
       this.loop.permissions.asker = (request2) => this.askPermission(request2);
     const events = this.consumeEvents();
@@ -90680,6 +90708,145 @@ async function runSession(loop, bus, settings, extra = {}) {
   return session.relaunch;
 }
 
+// src/update.ts
+init_json();
+init_net();
+init_pathlib();
+init_paths();
+init_py();
+import { spawn as spawn10 } from "node:child_process";
+import { mkdirSync as mkdirSync15, openSync as openSync10, readFileSync as readFileSync10, realpathSync as realpathSync3, writeFileSync as writeFileSync12 } from "node:fs";
+init_which();
+var RELEASES_URL2 = `https://registry.npmjs.org/-/package/${PACKAGE}/dist-tags`;
+var RELEASES_ENV2 = "HX_RELEASES_URL";
+var DISABLE_ENV = "HX_DISABLE_AUTOUPDATER";
+var RELEASES_TIMEOUT2 = 5;
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var stateFile = () => join(userHome(), "update.json");
+async function latestRelease(signal) {
+  const url = strip(process.env[RELEASES_ENV2] ?? "") || RELEASES_URL2;
+  try {
+    const response = await request(url, {
+      timeout: RELEASES_TIMEOUT2,
+      ...signal ? { signal } : {}
+    });
+    try {
+      if (response.status < 200 || response.status >= 300) return null;
+      const tags = await response.json();
+      const latest = typeof tags === "object" && tags !== null ? tags.latest : null;
+      return typeof latest === "string" && RELEASE2.test(latest) ? latest : null;
+    } finally {
+      response.close();
+    }
+  } catch {
+    return null;
+  }
+}
+var RELEASE2 = /^\d+\.\d+\.\d+$/;
+function compareReleases(a, b) {
+  const left = a.split(".").map(Number);
+  const right = b.split(".").map(Number);
+  for (let index = 0; index < 3; index++) {
+    const difference = (left[index] ?? 0) - (right[index] ?? 0);
+    if (difference) return difference;
+  }
+  return 0;
+}
+function notAnNpmInstall() {
+  const script = process.argv[1] ?? "";
+  let real2;
+  try {
+    real2 = realpathSync3(script);
+  } catch {
+    return script;
+  }
+  return real2.includes(`/node_modules/${PACKAGE}/`) ? null : parent(parent(real2));
+}
+function npm() {
+  return which("npm") ?? join(parent(process.execPath), "npm");
+}
+var INSTALL_COMMAND = `npm install --global ${PACKAGE}`;
+function runNpm(version, background) {
+  const args = ["install", "--global", `${PACKAGE}@${version}`];
+  let stdio = "inherit";
+  if (background) {
+    mkdirSync15(logsDir(), { recursive: true });
+    const log = openSync10(join(logsDir(), "update.log"), "a");
+    stdio = ["ignore", log, log];
+  }
+  return new Promise((resolve2) => {
+    const child = spawn10(npm(), args, { stdio, detached: background });
+    child.once("error", () => resolve2(null));
+    child.once("exit", (code2, signal) => resolve2(code2 ?? (signal ? 1 : 0)));
+    if (background) child.unref();
+  });
+}
+async function runUpdate(print2) {
+  const elsewhere2 = notAnNpmInstall();
+  if (elsewhere2 !== null) {
+    print2(
+      `hx is running from ${elsewhere2}, not from an npm install, so it cannot update itself. Update a checkout with git pull and npm run build, or install the release: ${INSTALL_COMMAND}`,
+      process.stderr
+    );
+    return 1;
+  }
+  const latest = await latestRelease();
+  if (latest === null) {
+    print2("Could not reach the npm registry to check for a newer hx.", process.stderr);
+    return 1;
+  }
+  if (compareReleases(latest, VERSION) <= 0) {
+    print2(`hx ${VERSION} is up to date.`);
+    return 0;
+  }
+  print2(`Updating hx ${VERSION} to ${latest}...`);
+  const status3 = await runNpm(latest, false);
+  if (status3 === null) {
+    print2(
+      `npm is not installed, so hx cannot update itself. See https://nodejs.org/`,
+      process.stderr
+    );
+    return 1;
+  }
+  if (status3 !== 0) {
+    print2(`npm could not install ${PACKAGE}@${latest} (exit ${status3}).`, process.stderr);
+    return 1;
+  }
+  print2(`Updated hx to ${latest}.`);
+  return 0;
+}
+function lastChecked() {
+  try {
+    const state = JSON.parse(readFileSync10(stateFile(), "utf8"));
+    const at = typeof state === "object" && state !== null ? state.checkedAt : 0;
+    return typeof at === "number" ? at : 0;
+  } catch {
+    return 0;
+  }
+}
+async function autoUpdate(enabled, signal) {
+  const disabled = strip(process.env[DISABLE_ENV] ?? "").toLowerCase();
+  if (!enabled || ["1", "true", "yes"].includes(disabled)) return null;
+  if (notAnNpmInstall() !== null) return null;
+  const now3 = Date.now();
+  if (now3 - lastChecked() < CHECK_INTERVAL_MS) return null;
+  try {
+    writeFileSync12(stateFile(), `${dumps({ checkedAt: now3 })}
+`);
+  } catch {
+    return null;
+  }
+  const latest = await latestRelease(signal);
+  if (signal.aborted || latest === null || compareReleases(latest, VERSION) <= 0) return null;
+  const status3 = await runNpm(latest, true);
+  if (status3 === 0) return { message: `Updated hx to ${latest}. Restart hx to use it.`, ok: true };
+  const why = status3 === null ? "npm could not be started" : `npm exited ${status3}`;
+  return {
+    message: `Could not update hx to ${latest}: ${why}. Run hx update to see why.`,
+    ok: false
+  };
+}
+
 // src/cli.ts
 var USAGE = `hx - an agent harness for the terminal
 
@@ -90695,6 +90862,7 @@ Usage:
   hx auth [set|clear]       Show or change the OpenRouter API key
   hx docs [SECTION|--all]   Print the manual, or one section of it
   hx changelog [VERSION]    Print what shipped in each version
+  hx update                 Update hx to the newest release
   hx --version              Show version
   hx --help                 Show this message
 
@@ -90758,6 +90926,9 @@ ${USAGE}`, process.stderr);
       return runMcpCommand(parsed.rest);
     case "trace":
       return runTraceCommand(parsed);
+    case "update":
+    case "upgrade":
+      return runUpdate(print);
     default:
       return runTuiCommand(parsed);
   }
@@ -90816,7 +90987,7 @@ function parseArgs(args) {
   }
   if (positional.length) {
     const [head4, ...tail3] = positional;
-    if (["resume", "prompt", "trace", "mcp", "auth"].includes(head4)) {
+    if (["resume", "prompt", "trace", "mcp", "auth", "update", "upgrade"].includes(head4)) {
       parsed.command = head4;
       parsed.rest = tail3;
       if (head4 === "resume" && tail3.length) parsed.sessionId = tail3[0];
@@ -91505,7 +91676,9 @@ async function runTuiCommand(parsed) {
   if (moved) runtime2.notices.push(moved);
   const signIn2 = runtime2.provider instanceof DeferredProvider ? signInHint(runtime2.loop.model, runtime2.auth) : null;
   let relaunch = null;
+  const sessionOver = new AbortController();
   try {
+    const update = autoUpdate(runtime2.settings.autoUpdates, sessionOver.signal);
     await runtime2.connectMcp();
     await runtime2.refreshModelsIfStale();
     relaunch = await runSession(runtime2.loop, runtime2.bus, runtime2.settings, {
@@ -91519,9 +91692,11 @@ async function runTuiCommand(parsed) {
       notices: runtime2.notices,
       checkpoints: runtime2.checkpoints,
       renameLeft,
-      signIn: signIn2
+      signIn: signIn2,
+      update
     });
   } finally {
+    sessionOver.abort();
     runtime2.bus.close();
     await runtime2.aclose();
   }