@sunilaleti/hx 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -28,6 +28,20 @@ the project follows [semantic versioning](https://semver.org/).
 
 ---
 
+## [1.1.1] - 2026-10-31
+
+### Fixed
+
+- HTTPS failed on macOS for every host - OpenRouter, ChatGPT, Tavily, npm - with "unable to get
+  local issuer certificate". HX verified against the OS trust store alone, and on macOS Node reads
+  only the certificates trusted by hand there, not the system roots. HX now trusts Node's own
+  roots and the OS store together, so a corporate CA in the keychain still works.
+- A certificate HX will not accept is reported with what to do about it - add the CA to the
+  system trust store or set `HX_CA_BUNDLE` - instead of Node's advice to restart it with
+  `--use-system-ca`, and is not retried: another attempt meets the same certificate.
+
+---
+
 ## [1.1.0] - 2026-10-31
 
 ### Added
@@ -1123,7 +1137,8 @@ First release, published to PyPI as [`hx-cli`](https://pypi.org/project/hx-cli/)
 - `/configure` and `hx auth` for the OpenRouter key, `hx upgrade` for
   self-update, and `install.sh` bootstrapping uv with a pinned Python.
 
-[Unreleased]: https://github.com/aletisunil/hx/compare/v1.1.0...HEAD
+[Unreleased]: https://github.com/aletisunil/hx/compare/v1.1.1...HEAD
+[1.1.1]: https://github.com/aletisunil/hx/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/aletisunil/hx/compare/v1.0.0...v1.1.0
 [1.0.0]: https://github.com/aletisunil/hx/compare/v0.3.0-beta.1...v1.0.0
 [0.3.0-beta.1]: https://github.com/aletisunil/hx/compare/v0.2.20...v0.3.0-beta.1

package/README.md

@@ -293,9 +293,9 @@ number.
 Credits are *not* in the status bar's cost, which prices tokens: `/cost`
 under-reports a session that searched.
 
-**Behind a TLS-inspecting proxy.** HX verifies certificates against the
-operating system's trust store, so a corporate CA the machine already trusts
-needs no setup. When the CA lives only in a file, name it:
+**Behind a TLS-inspecting proxy.** HX verifies certificates against Node's own
+roots and the operating system's trust store together, so a corporate CA the
+machine already trusts needs no setup. When the CA lives only in a file, name it:
 
 ```sh
 export HX_CA_BUNDLE=/path/to/corp-ca.pem   # SSL_CERT_FILE and REQUESTS_CA_BUNDLE also work

package/dist/hx.js

@@ -534,10 +534,8 @@ function tlsAgentOptions() {
     const bundle = caBundle();
     let ca;
     if (bundle !== null) ca = certificates(readText(bundle));
-    else {
-      ca = tls.getCACertificates("system");
-      if (ca.length === 0) ca = tls.getCACertificates("default");
-    }
+    else
+      ca = [.../* @__PURE__ */ new Set([...tls.getCACertificates("default"), ...tls.getCACertificates("system")])];
     tlsOptions = { ca, ALPNProtocols: ["http/1.1"] };
   }
   return tlsOptions;
@@ -582,12 +580,10 @@ function withTlsHint(message2) {
   return `${rstrip(rstrip(message2), ".")}. ${hint2}`;
 }
 function describe(error) {
+  const certificate = certificateFailure(error);
+  if (certificate !== null) return certificate;
   for (const err of chain(error)) {
     const code2 = err.code ?? "";
-    if (VERIFY_CODES.has(code2)) {
-      const reason = flatten(err.message || "certificate verify failed");
-      return `TLS certificate verification failed (${reason}). ${tlsHint(reason)}`;
-    }
     if (code2.startsWith("ERR_SSL") || code2.startsWith("ERR_TLS")) {
       return `TLS handshake failed: ${flatten(err.message)}.`;
     }
@@ -599,6 +595,19 @@ function describe(error) {
   const failure2 = error;
   return withTlsHint(`${failure2?.name ?? "Error"}: ${flatten(String(failure2?.message ?? error))}`);
 }
+function certificateFailure(error) {
+  for (const err of chain(error)) {
+    if (!VERIFY_CODES.has(err.code ?? "")) continue;
+    const reason = flatten(
+      (err.message || "certificate verify failed").replace(
+        /;\s*if the root CA[\s\S]*$/,
+        ""
+      )
+    );
+    return `TLS certificate verification failed (${reason}). ${tlsHint(reason)}`;
+  }
+  return null;
+}
 function chain(error) {
   const seen = [];
   let current = error;
@@ -1725,11 +1734,17 @@ function streamEnd(stopReason, fields = {}) {
     planWindows: fields.planWindows ?? []
   };
 }
+function unreached(error) {
+  const certificate = certificateFailure(error);
+  if (certificate !== null) return new ProviderError(certificate);
+  return new ProviderError(error.message, { retryable: true });
+}
 var delta, ProviderError;
 var init_base = __esm({
   "src/providers/base.ts"() {
     "use strict";
     init_usage();
+    init_net();
     delta = (fields) => ({
       kind: "delta",
       ...fields
@@ -3288,7 +3303,7 @@ var init_openrouter = __esm({
           });
         } catch (error) {
           if (signal.aborted) throw error;
-          throw new ProviderError(error.message, { retryable: true });
+          throw unreached(error);
         }
         try {
           if (response.status >= 400) {
@@ -7190,7 +7205,7 @@ async function unaryCall(baseUrl, path, body, operation, timeout = 600, signal)
     [status3, payload] = await post(`${baseUrl}${path}`, body, UNARY_HEADERS, timeout, signal);
   } catch (error) {
     if (signal?.aborted) throw error;
-    throw new ProviderError(error.message, { retryable: true });
+    throw unreached(error);
   }
   if (status3 >= 400) throw httpError(operation, status3, payload);
   return payload;
@@ -7486,7 +7501,7 @@ var init_devin2 = __esm({
           });
         } catch (error) {
           if (signal.aborted) throw error;
-          throw new ProviderError(error.message, { retryable: true });
+          throw unreached(error);
         }
         try {
           if (response.status >= 400) {
@@ -67733,7 +67748,7 @@ init_net();
 init_py();
 
 // src/version.ts
-var VERSION = "1.1.0";
+var VERSION = "1.1.1";
 var PACKAGE = "@sunilaleti/hx";
 
 // src/providers/codex.ts
@@ -67805,7 +67820,7 @@ var CodexProvider = class {
       });
     } catch (error) {
       if (signal.aborted) throw error;
-      throw new ProviderError(error.message, { retryable: true });
+      throw unreached(error);
     }
     const windows = planWindows(response.headers);
     try {