@veris-ai/daytona 0.3.0 → 0.3.1

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export type { EgressMode, NetworkParams, NetworkPlan } from './network';
 export { buildNetwork, vendorHosts, twinHosts, directTwinHosts, dataPlaneHosts } from './network';
 export type { ServiceInfo as VerisServiceInfo, RouteEntry, TwinSandbox } from './control-plane';
 export { ControlPlane } from './control-plane';
-export { CA_CERT_PATH, SYSTEM_BUNDLE, VERIS_BUNDLE, VERIS_CA_FILE, NODE_TRUST_FLAG, BUNDLED_CA_FILES, BUNDLED_CA_PATCH_SCRIPT, nodeOptionsWithTrust, vendoredTrustEnv, trustPrelude, } from './trust';
+export { CA_CERT_PATH, SYSTEM_BUNDLE, VERIS_BUNDLE, VERIS_CA_FILE, NODE_TRUST_FLAG, NODE_PROXY_PRELOAD, NODE_PROXY_FLAG, BUNDLED_CA_FILES, BUNDLED_CA_PATCH_SCRIPT, nodeOptionsWithTrust, nodeOptionsWithProxy, verisNodeOptions, nodeProxyPreloadScript, vendoredTrustEnv, trustPrelude, } from './trust';
 export { gatewayIps, gatewayProxyUrl, patchBundledCas } from './gateway';
 export { DEFAULT_API_BASE, profilePath, resolveVerisCredentials, requireVerisCredentials, missingKeyMessage, } from './profile';
 export type { VerisCredentials, ResolveOpts, ProfileFile } from './profile';

package/dist/index.js

@@ -524,9 +524,38 @@ function bundledCaPatchScript() {
 }
 var NODE_TRUST_FLAG = "--use-openssl-ca";
 function nodeOptionsWithTrust(existing) {
+  return appendFlag(existing, NODE_TRUST_FLAG);
+}
+var NODE_PROXY_PRELOAD = "/tmp/veris-node-proxy.cjs";
+var NODE_PROXY_FLAG = `--require ${NODE_PROXY_PRELOAD}`;
+function nodeProxyPreloadScript() {
+  return [
+    `// Preloaded by @veris-ai/daytona through NODE_OPTIONS=--require.`,
+    `// Gives every http(s).Agent the proxy environment, which Node applies only`,
+    `// to its global agents under NODE_USE_ENV_PROXY=1. An SDK that builds its own`,
+    `// Agent would otherwise dial the vendor directly, which this sandbox cannot.`,
+    `for (const mod of [require("http"), require("https")]) {`,
+    `  const Base = mod.Agent`,
+    `  mod.Agent = class Agent extends Base {`,
+    `    constructor(options) {`,
+    `      super({ proxyEnv: process.env, ...(options || {}) })`,
+    `    }`,
+    `  }`,
+    `}`,
+    ``
+  ].join("\n");
+}
+function nodeOptionsWithProxy(existing) {
+  return appendFlag(existing, NODE_PROXY_FLAG);
+}
+function verisNodeOptions(existing, opts = {}) {
+  const withProxy = nodeOptionsWithProxy(existing);
+  return opts.trust === false ? withProxy : nodeOptionsWithTrust(withProxy);
+}
+function appendFlag(existing, flag) {
   const base = (existing ?? "").trim();
-  if (base.split(/\s+/).includes(NODE_TRUST_FLAG)) return base;
-  return base ? `${base} ${NODE_TRUST_FLAG}` : NODE_TRUST_FLAG;
+  if (base === flag || base.startsWith(`${flag} `) || base.endsWith(` ${flag}`) || base.includes(` ${flag} `)) return base;
+  return base ? `${base} ${flag}` : flag;
 }
 var CA_INSTALL_CMD = [
   "update-ca-certificates",
@@ -599,6 +628,7 @@ function assertProxyUrl(raw) {
 async function installCa(sandbox, caPem) {
   await sandbox.fs.uploadFile(Buffer.from(caPem, "utf8"), VERIS_CA_FILE);
   await sandbox.fs.uploadFile(Buffer.from(bundledCaPatchScript(), "utf8"), BUNDLED_CA_PATCH_SCRIPT);
+  await installNodeProxyPreload(sandbox);
   const script = [
     `chmod 0644 ${VERIS_CA_FILE}`,
     // Public roots first so they keep working; ours appended. `cat` of a
@@ -624,6 +654,9 @@ async function installCa(sandbox, caPem) {
     );
   }
 }
+async function installNodeProxyPreload(sandbox) {
+  await sandbox.fs.uploadFile(Buffer.from(nodeProxyPreloadScript(), "utf8"), NODE_PROXY_PRELOAD);
+}
 async function patchBundledCas(sandbox) {
   const r = await sh(sandbox, `sh ${BUNDLED_CA_PATCH_SCRIPT}`, 180).catch((e) => ({ exitCode: 1, result: String(e) }));
   return (r.result ?? "").split("\n").filter((line) => line.startsWith(BUNDLED_CA_PATCHED_MARKER)).map((line) => line.slice(BUNDLED_CA_PATCHED_MARKER.length).trim()).filter(Boolean);
@@ -916,7 +949,7 @@ function requireVerisCredentials(opts = {}) {
 }
 
 // src/version.ts
-var SDK_VERSION = true ? "0.3.0" : "0.0.0-dev";
+var SDK_VERSION = true ? "0.3.1" : "0.0.0-dev";
 
 // src/daytona.ts
 var LABEL = {
@@ -994,9 +1027,12 @@ var Daytona = class extends BaseDaytona {
       const verisManaged = {
         ...v.installCa !== false ? sanitizeTrustEnv(void 0) : {},
         // Node reads none of the variables above once Daytona has overwritten
-        // them; the flag makes it read OpenSSL's store, which the CA install
-        // fills. Appended, not replaced: a caller's own NODE_OPTIONS keep working.
-        ...v.installCa !== false ? { NODE_OPTIONS: nodeOptionsWithTrust(rest.envVars?.NODE_OPTIONS) } : {},
+        // them; the trust flag makes it read OpenSSL's store, which the CA
+        // install fills. The preload gives every http(s).Agent the proxy
+        // environment, which NODE_USE_ENV_PROXY below reaches only for the
+        // global ones. Appended, not replaced: a caller's own NODE_OPTIONS keep
+        // working.
+        NODE_OPTIONS: verisNodeOptions(rest.envVars?.NODE_OPTIONS, { trust: v.installCa !== false }),
         // Node ignores HTTPS_PROXY unless told to, and Daytona blocks anything
         // that dials out directly — so without this every plain `https.get`
         // and `fetch` in Node 24+ dies with ECONNRESET instead of reaching
@@ -1039,7 +1075,8 @@ var Daytona = class extends BaseDaytona {
       });
     }
     try {
-      await installCa(sandbox, credential.ca_pem);
+      if (v.installCa !== false) await installCa(sandbox, credential.ca_pem);
+      else await installNodeProxyPreload(sandbox);
       await probeCanary(sandbox, credential.canary_host, twin.id);
     } catch (err) {
       await sandbox.delete().catch(() => {
@@ -1300,6 +1337,8 @@ export {
   DELETE_SANDBOXES,
   Daytona,
   MissingCredentialsError,
+  NODE_PROXY_FLAG,
+  NODE_PROXY_PRELOAD,
   NODE_TRUST_FLAG,
   ReceiptIntegrityError,
   SDK_VERSION,
@@ -1328,7 +1367,9 @@ export {
   isPermissionDenied,
   isVerisSandbox,
   missingKeyMessage,
+  nodeOptionsWithProxy,
   nodeOptionsWithTrust,
+  nodeProxyPreloadScript,
   patchBundledCas,
   profilePath,
   requireVerisCredentials,
@@ -1339,6 +1380,7 @@ export {
   twinHosts,
   vendorHosts,
   vendoredTrustEnv,
+  verisNodeOptions,
   verisOwnsTwin,
   verisTwinId
 };