@wootsup/yt-builder-mcp 1.6.0 → 1.6.1

package/bin/yt-builder-mcp.js

@@ -25,15 +25,39 @@
  * YTB_MCP_TEST_MODE=1 forces the 'server' route so the smoke-test probe
  * always reaches `dist/index.js` even when run from a TTY.
  *
+ * RUNTIME CA SELF-HEAL (server branch only): corporate-CA trust used to depend
+ * ENTIRELY on `NODE_OPTIONS=--use-system-ca` being in the client config env
+ * before Node booted. When that value got clobbered (Glöckle v1.6) Node fell
+ * back to its bundled Mozilla CAs, could not build the corporate TLS-inspection
+ * chain, and `/mcp` hung for 30s. To stop depending on the config carrying the
+ * flag, the server SELF-HEALS: in the 'server' branch, BEFORE importing
+ * `dist/index.js`, if this Node supports `--use-system-ca` (≥ 22.15.0) AND the
+ * flag is not already active AND a loop-guard sentinel is not set, we re-exec
+ * the SAME bin with `node --use-system-ca …`, inherit stdio (so the MCP stdio
+ * JSON-RPC transport is byte-transparent — the parent is a thin passthrough),
+ * forward the child's exit code, and do NOT continue in the parent. The sentinel
+ * (set on the child env) + the already-active check PREVENT an infinite re-exec
+ * loop. The whole step is wrapped in try/catch: ANY failure falls through to a
+ * normal in-process start — a re-exec failure must NEVER break startup. The
+ * decision is the pure, unit-tested `decideCaReexec()`. The re-exec is SKIPPED
+ * under YTB_MCP_TEST_MODE=1 and never runs on the 'cli'/'hint' routes.
+ *
  * @license MIT
  */
 import { argv, stdin, stderr, exit } from 'node:process';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 
 import {
     decideInvocation,
     isKnownSubcommand,
     BARE_INVOCATION_HINT,
 } from '../dist/cli/invocation-decision.js';
+import {
+    decideCaReexec,
+    CA_REEXEC_SENTINEL,
+    USE_SYSTEM_CA_FLAG,
+} from '../dist/diagnostics/ca-reexec.js';
 
 const args = argv.slice(2);
 const subcommand = args[0];
@@ -67,6 +91,54 @@ if (action === 'cli') {
 } else {
     // 'server' — stdin is NOT a TTY (an AI client piping JSON-RPC → real
     // MCP stdio server) or YTB_MCP_TEST_MODE=1 forced this route.
+
+    // RUNTIME CA SELF-HEAL: re-exec with `--use-system-ca` when needed so
+    // corporate TLS-inspection trust no longer depends on the client config
+    // carrying NODE_OPTIONS. SKIPPED under test mode (the smoke test must reach
+    // dist/index.js without a fork). Defensive: ANY failure falls through to a
+    // normal in-process start — a re-exec failure must never break startup.
+    if (process.env.YTB_MCP_TEST_MODE !== '1') {
+        try {
+            const shouldReexec = decideCaReexec({
+                nodeVersion: process.version,
+                execArgv: process.execArgv,
+                nodeOptions: process.env.NODE_OPTIONS,
+                sentinel: process.env[CA_REEXEC_SENTINEL],
+            });
+            if (shouldReexec) {
+                const self = fileURLToPath(import.meta.url);
+                // stdio:'inherit' → the child owns the MCP stdio JSON-RPC
+                // transport directly; the parent is a transparent passthrough
+                // that just forwards the child's exit code.
+                const child = spawnSync(
+                    process.execPath,
+                    [USE_SYSTEM_CA_FLAG, self, ...args],
+                    {
+                        stdio: 'inherit',
+                        env: { ...process.env, [CA_REEXEC_SENTINEL]: '1' },
+                    },
+                );
+                if (child.error) {
+                    // Spawn itself failed (e.g. EACCES) — fall through to an
+                    // in-process start rather than exiting on a heal failure.
+                    stderr.write(
+                        `yt-builder-mcp: CA self-heal re-exec failed (${child.error.message}); ` +
+                            'starting in-process.\n',
+                    );
+                } else {
+                    // The child ran the server to completion; mirror its exit.
+                    // signal → 1 (no clean code), else the child's code (or 0).
+                    exit(child.signal ? 1 : (child.status ?? 0));
+                }
+            }
+        } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            stderr.write(
+                `yt-builder-mcp: CA self-heal skipped (${msg}); starting in-process.\n`,
+            );
+        }
+    }
+
     // `dist/index.js` branches on the env var: test-mode prints the tool
     // list to stderr and exits 0; otherwise it starts the stdio server.
     // Importing here does NOT itself force stdio mode.

package/dist/diagnostics/ca-reexec.d.ts

@@ -0,0 +1,41 @@
+/** Env var name the parent stamps on the re-exec'd child to break the loop. */
+export declare const CA_REEXEC_SENTINEL = "YTB_MCP_CA_REEXEC";
+/** The Node flag we re-exec with — adds the OS trust store, never disables TLS. */
+export declare const USE_SYSTEM_CA_FLAG = "--use-system-ca";
+/**
+ * Is `--use-system-ca` already active for THIS process — either passed on the
+ * command line (surfaces in `process.execArgv`) or carried in `NODE_OPTIONS`?
+ *
+ * Both inputs are matched as whitespace-delimited tokens so a longer flag that
+ * merely CONTAINS the substring (none exists today, but defensively) cannot
+ * produce a false positive. `execArgv` entries are already individual tokens;
+ * `NODE_OPTIONS` is a single space-separated string, so it is split first.
+ *
+ * @param execArgv     `process.execArgv` (Node-level flags, one per element).
+ * @param nodeOptions  the `NODE_OPTIONS` env value (or undefined when unset).
+ */
+export declare function isSystemCaActive(execArgv: readonly string[], nodeOptions: string | undefined): boolean;
+/** Inputs to {@link decideCaReexec} — every signal is passed in (no globals). */
+export interface CaReexecInputs {
+    /** `process.version`, e.g. "v22.17.0". */
+    readonly nodeVersion: string;
+    /** `process.execArgv` — Node flags this process was launched with. */
+    readonly execArgv: readonly string[];
+    /** The `NODE_OPTIONS` env value, or undefined when unset. */
+    readonly nodeOptions: string | undefined;
+    /** The loop-guard sentinel env value ({@link CA_REEXEC_SENTINEL}), or undefined. */
+    readonly sentinel: string | undefined;
+}
+/**
+ * Should the server bin re-exec itself WITH `--use-system-ca`?
+ *
+ * Returns `true` iff ALL hold:
+ *   1. this Node can read the OS trust store ({@link supportsSystemCa}: ≥ 22.15.0),
+ *   2. `--use-system-ca` is NOT already active ({@link isSystemCaActive}),
+ *   3. the loop-guard sentinel is NOT set.
+ *
+ * Any of: Node too old, flag already active, or sentinel set → `false`
+ * (proceed in-process). Pure: depends only on its arguments.
+ */
+export declare function decideCaReexec(inputs: CaReexecInputs): boolean;
+//# sourceMappingURL=ca-reexec.d.ts.map

package/dist/diagnostics/ca-reexec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca-reexec.d.ts","sourceRoot":"","sources":["../../src/diagnostics/ca-reexec.ts"],"names":[],"mappings":"AAoCA,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAEtD,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAaT;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAe9D"}

package/dist/diagnostics/ca-reexec.js

@@ -0,0 +1,91 @@
+// packages/mcp/src/diagnostics/ca-reexec.ts
+/**
+ * Pure decision core for the runtime `--use-system-ca` SELF-HEAL re-exec in
+ * `bin/yt-builder-mcp.js` (server branch only).
+ *
+ * THE PROBLEM IT SOLVES — env-clobber regression (Glöckle v1.6, 2026-06):
+ * corporate-CA trust depended ENTIRELY on `NODE_OPTIONS=--use-system-ca` being
+ * present in the MCP client config env BEFORE Node booted. On the Glöckle
+ * install that value got wiped, so Node fell back to its bundled Mozilla CA set,
+ * could not build the corporate TLS-inspection chain, and the `/mcp` handshake
+ * hung for 30s. `mergeServerEnv` (clients/index.ts) is correct; the robust fix
+ * is to STOP depending on the config carrying the flag and have the SERVER
+ * self-heal at launch by re-exec'ing itself WITH `--use-system-ca`.
+ *
+ * WHY `--use-system-ca` IS SAFE TO APPLY UNCONDITIONALLY (on a supporting Node):
+ * the flag only ADDS the OS trust store (Windows CryptoAPI / macOS Keychain) to
+ * Node's bundled Mozilla CAs. It never DISABLES TLS verification. For a
+ * non-corporate user it is a harmless superset; for a corporate user it is the
+ * whole fix.
+ *
+ * THE LOOP-GUARD (critical): a re-exec that itself re-execs is an infinite fork
+ * bomb. {@link decideCaReexec} returns `false` whenever the flag is ALREADY
+ * active (in `process.execArgv` OR the `NODE_OPTIONS` env) OR a sentinel env var
+ * (set by the parent on the child it spawns) is present. The shim sets the
+ * sentinel on the child, so the child's own `decideCaReexec` returns `false` and
+ * proceeds in-process.
+ *
+ * The bin shim is a thin, un-typed JS file; the decision logic lives here, in a
+ * typed + unit-tested module, exactly like `cli/invocation-decision.ts`.
+ *
+ * @license MIT
+ */
+import { supportsSystemCa } from './ca-trust.js';
+/** Env var name the parent stamps on the re-exec'd child to break the loop. */
+export const CA_REEXEC_SENTINEL = 'YTB_MCP_CA_REEXEC';
+/** The Node flag we re-exec with — adds the OS trust store, never disables TLS. */
+export const USE_SYSTEM_CA_FLAG = '--use-system-ca';
+/**
+ * Is `--use-system-ca` already active for THIS process — either passed on the
+ * command line (surfaces in `process.execArgv`) or carried in `NODE_OPTIONS`?
+ *
+ * Both inputs are matched as whitespace-delimited tokens so a longer flag that
+ * merely CONTAINS the substring (none exists today, but defensively) cannot
+ * produce a false positive. `execArgv` entries are already individual tokens;
+ * `NODE_OPTIONS` is a single space-separated string, so it is split first.
+ *
+ * @param execArgv     `process.execArgv` (Node-level flags, one per element).
+ * @param nodeOptions  the `NODE_OPTIONS` env value (or undefined when unset).
+ */
+export function isSystemCaActive(execArgv, nodeOptions) {
+    if (execArgv.includes(USE_SYSTEM_CA_FLAG)) {
+        return true;
+    }
+    if (typeof nodeOptions === 'string') {
+        // NODE_OPTIONS is a space-separated flag list; tokenise before matching
+        // so we compare whole flags, never a substring of one.
+        const tokens = nodeOptions.split(/\s+/).filter((t) => t.length > 0);
+        if (tokens.includes(USE_SYSTEM_CA_FLAG)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Should the server bin re-exec itself WITH `--use-system-ca`?
+ *
+ * Returns `true` iff ALL hold:
+ *   1. this Node can read the OS trust store ({@link supportsSystemCa}: ≥ 22.15.0),
+ *   2. `--use-system-ca` is NOT already active ({@link isSystemCaActive}),
+ *   3. the loop-guard sentinel is NOT set.
+ *
+ * Any of: Node too old, flag already active, or sentinel set → `false`
+ * (proceed in-process). Pure: depends only on its arguments.
+ */
+export function decideCaReexec(inputs) {
+    const { nodeVersion, execArgv, nodeOptions, sentinel } = inputs;
+    // Loop-guard: a child we already re-exec'd carries the sentinel. Never re-exec it.
+    if (sentinel !== undefined && sentinel !== '') {
+        return false;
+    }
+    // Node too old to read the OS trust store — re-exec would be a no-op flag.
+    if (!supportsSystemCa(nodeVersion)) {
+        return false;
+    }
+    // Already running with the flag (execArgv or NODE_OPTIONS) — nothing to heal.
+    if (isSystemCaActive(execArgv, nodeOptions)) {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=ca-reexec.js.map

package/dist/diagnostics/ca-reexec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca-reexec.js","sourceRoot":"","sources":["../../src/diagnostics/ca-reexec.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC5B,QAA2B,EAC3B,WAA+B;IAE/B,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAClC,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAcD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,MAAsB;IACjD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAChE,mFAAmF;IACnF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,2EAA2E;IAC3E,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,8EAA8E;IAC9E,IAAI,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/diagnostics/ca-trust.d.ts

@@ -5,6 +5,17 @@
  * same walker + code set as {@link diagnoseNetworkError}.
  */
 export declare function isCaTrustError(err: unknown): boolean;
+/**
+ * True when `err` (or anything in its `.cause` / `AggregateError.errors`
+ * chain) carries a connection/handshake timeout code — the OPAQUE form a
+ * corporate TLS-inspection proxy takes when the cert chain can't be built and
+ * the handshake hangs instead of failing with a clean CA-trust code. Pure;
+ * reuses the same walker + canonical {@link TIMEOUT_CODES} set as
+ * {@link diagnoseNetworkError} (no duplicate classifier). The wizard uses this
+ * to attempt the OS-trust-store (`--use-system-ca`) recovery on a timeout —
+ * safe because `--use-system-ca` only ADDS the OS store and never disables TLS.
+ */
+export declare function isTimeoutError(err: unknown): boolean;
 /** Node version that first reads the OS trust store via `--use-system-ca`. */
 export declare const SYSTEM_CA_NODE_FLOOR: readonly [number, number, number];
 /**

package/dist/diagnostics/ca-trust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ca-trust.d.ts","sourceRoot":"","sources":["../../src/diagnostics/ca-trust.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEpD;AAED,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAe,CAAC;AAQnF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,GAAE,MAAwB,GAAG,OAAO,CAS/E"}
+{"version":3,"file":"ca-trust.d.ts","sourceRoot":"","sources":["../../src/diagnostics/ca-trust.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEpD;AAED,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAe,CAAC;AAQnF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,GAAE,MAAwB,GAAG,OAAO,CAS/E"}

package/dist/diagnostics/ca-trust.js

@@ -15,7 +15,7 @@
  * 22.15.0. Below that floor, a corporate CA must be supplied as a `.pem`
  * via NODE_EXTRA_CA_CERTS. Neither path ever disables TLS verification.
  */
-import { CA_TRUST_CODES, collectCodes } from './diagnose-network-error.js';
+import { CA_TRUST_CODES, collectCodes, TIMEOUT_CODES } from './diagnose-network-error.js';
 /**
  * True when `err` (or anything in its `.cause` / `AggregateError.errors`
  * chain) carries a TLS chain-of-trust failure code — the signature of a
@@ -25,6 +25,19 @@ import { CA_TRUST_CODES, collectCodes } from './diagnose-network-error.js';
 export function isCaTrustError(err) {
     return collectCodes(err).some((c) => CA_TRUST_CODES.has(c));
 }
+/**
+ * True when `err` (or anything in its `.cause` / `AggregateError.errors`
+ * chain) carries a connection/handshake timeout code — the OPAQUE form a
+ * corporate TLS-inspection proxy takes when the cert chain can't be built and
+ * the handshake hangs instead of failing with a clean CA-trust code. Pure;
+ * reuses the same walker + canonical {@link TIMEOUT_CODES} set as
+ * {@link diagnoseNetworkError} (no duplicate classifier). The wizard uses this
+ * to attempt the OS-trust-store (`--use-system-ca`) recovery on a timeout —
+ * safe because `--use-system-ca` only ADDS the OS store and never disables TLS.
+ */
+export function isTimeoutError(err) {
+    return collectCodes(err).some((c) => TIMEOUT_CODES.has(c));
+}
 /** Node version that first reads the OS trust store via `--use-system-ca`. */
 export const SYSTEM_CA_NODE_FLOOR = [22, 15, 0];
 function parseNodeVersion(v) {

package/dist/diagnostics/ca-trust.js.map

@@ -1 +1 @@
-{"version":3,"file":"ca-trust.js","sourceRoot":"","sources":["../../src/diagnostics/ca-trust.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAsC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnF,SAAS,gBAAgB,CAAC,CAAS;IAC/B,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAsB,OAAO,CAAC,OAAO;IAClE,MAAM,CAAC,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,oBAAoB,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,6BAA6B;AAC9C,CAAC"}
+{"version":3,"file":"ca-trust.js","sourceRoot":"","sources":["../../src/diagnostics/ca-trust.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAsC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnF,SAAS,gBAAgB,CAAC,CAAS;IAC/B,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAsB,OAAO,CAAC,OAAO;IAClE,MAAM,CAAC,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,oBAAoB,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,6BAA6B;AAC9C,CAAC"}

package/dist/diagnostics/diagnose-network-error.d.ts

@@ -22,6 +22,17 @@ export interface NetworkDiagnosis {
  * definition of "this is a TLS-inspection CA problem" in the package.
  */
 export declare const CA_TRUST_CODES: ReadonlySet<string>;
+/**
+ * Connection/handshake timeout signatures.
+ *
+ * Exported so the wizard's timeout-detection path (`isTimeoutError`) classifies
+ * an outbound failure against the SAME canonical set — there is exactly one
+ * definition of "this connection timed out" in the package. A TLS-inspecting
+ * corporate proxy whose root CA can't be built can manifest as one of these
+ * opaque timeouts (the handshake hangs) rather than a clean CA-trust code, which
+ * is why the wizard now attempts `--use-system-ca` on a timeout too.
+ */
+export declare const TIMEOUT_CODES: ReadonlySet<string>;
 /**
  * Walk `err`, its `.cause` chain, and any `AggregateError.errors`, collecting
  * every `.code` string. A Node global-fetch failure (`TypeError: fetch failed`)

package/dist/diagnostics/diagnose-network-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diagnose-network-error.d.ts","sourceRoot":"","sources":["../../src/diagnostics/diagnose-network-error.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAO7C,CAAC;AAmCH;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAa9D;AAOD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,GAAG,EAAE,OAAO,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,GACrC,gBAAgB,GAAG,IAAI,CAqFzB"}
+{"version":3,"file":"diagnose-network-error.d.ts","sourceRoot":"","sources":["../../src/diagnostics/diagnose-network-error.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAO7C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAK5C,CAAC;AA4BH;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAa9D;AAOD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,GAAG,EAAE,OAAO,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,GACrC,gBAAgB,GAAG,IAAI,CA2FzB"}

package/dist/diagnostics/diagnose-network-error.js

@@ -14,7 +14,17 @@ export const CA_TRUST_CODES = new Set([
     'SELF_SIGNED_CERT',
     'CERT_UNTRUSTED',
 ]);
-const TIMEOUT_CODES = new Set([
+/**
+ * Connection/handshake timeout signatures.
+ *
+ * Exported so the wizard's timeout-detection path (`isTimeoutError`) classifies
+ * an outbound failure against the SAME canonical set — there is exactly one
+ * definition of "this connection timed out" in the package. A TLS-inspecting
+ * corporate proxy whose root CA can't be built can manifest as one of these
+ * opaque timeouts (the handshake hangs) rather than a clean CA-trust code, which
+ * is why the wizard now attempts `--use-system-ca` on a timeout too.
+ */
+export const TIMEOUT_CODES = new Set([
     'UND_ERR_CONNECT_TIMEOUT',
     'ETIMEDOUT',
     'UND_ERR_HEADERS_TIMEOUT',
@@ -133,16 +143,21 @@ export function diagnoseNetworkError(err, env = process.env) {
     }
     const timeoutCode = has(TIMEOUT_CODES);
     if (timeoutCode !== null) {
+        // A TLS-inspecting corporate CA can hang the handshake into an opaque
+        // timeout (not a clean cert code), so the CA path is named alongside the
+        // proxy/VPN guidance — setup now retries with --use-system-ca on a
+        // timeout automatically; if it still fails, pin the corporate root CA.
+        const caHint = ' If your network uses TLS inspection / a self-signed corporate CA, setup now retries with --use-system-ca automatically (Node ≥ 22.15); if it still fails, re-run setup with `--ca <corp-root-ca.pem>`. Never disable TLS verification.';
         return proxy !== null
             ? {
                 code: timeoutCode,
                 summary: `The connection through the proxy (${proxy}) timed out.`,
-                fix: `Confirm HTTPS_PROXY=${proxy} can reach the site, and set NO_PROXY for internal hosts. Run \`… doctor\`.`,
+                fix: `Confirm HTTPS_PROXY=${proxy} can reach the site, and set NO_PROXY for internal hosts. Run \`… doctor\`.${caHint}`,
             }
             : {
                 code: timeoutCode,
                 summary: 'The connection timed out.',
-                fix: 'The site may be internal (VPN needed) or require a proxy (set HTTPS_PROXY). Run `npx -y @wootsup/yt-builder-mcp doctor` to diagnose.',
+                fix: `The site may be internal (VPN needed) or require a proxy (set HTTPS_PROXY). Run \`npx -y @wootsup/yt-builder-mcp doctor\` to diagnose.${caHint}`,
             };
     }
     const dnsCode = has(DNS_CODES);

package/dist/diagnostics/diagnose-network-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnose-network-error.js","sourceRoot":"","sources":["../../src/diagnostics/diagnose-network-error.ts"],"names":[],"mappings":"AAAA,yDAAyD;AAmBzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACvD,2BAA2B;IAC3B,6BAA6B;IAC7B,iCAAiC;IACjC,mCAAmC;IACnC,kBAAkB;IAClB,gBAAgB;CACnB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IAC/C,yBAAyB;IACzB,WAAW;IACX,yBAAyB;IACzB,sBAAsB;CACzB,CAAC,CAAC;AAEH,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3E,MAAM,MAAM,GACR,qHAAqH;IACrH,uHAAuH;IACvH,uHAAuH;IACvH,2FAA2F,CAAC;AAEhG,2DAA2D;AAC3D,SAAS,MAAM,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACjE,MAAM,CAAC,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,CAAC,GAAI,KAA6B,CAAC,MAAM,CAAC;QAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,OAAO,IAAI,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAE,GAA0B,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9F,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;QAClB,MAAM,IAAI,GAAI,GAA2B,CAAC,MAAM,CAAC;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,8DAA8D;AAC9D,SAAS,eAAe,CAAC,GAAsB;IAC3C,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAChC,GAAY,EACZ,MAAyB,OAAO,CAAC,GAAG;IAEpC,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO;YACH,IAAI,EAAE,QAAQ,MAAM,EAAE;YACtB,OAAO,EAAE,4CAA4C,MAAM,IAAI;YAC/D,GAAG,EAAE,gHAAgH;SACxH,CAAC;IACN,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO;YACH,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,4CAA4C;YACrD,GAAG,EAAE,uHAAuH;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QACnC,OAAO;YACH,IAAI,EAAE,QAAQ,MAAM,EAAE;YACtB,OAAO,EAAE,0CAA0C,MAAM,IAAI;YAC7D,GAAG,EAAE,uHAAuH;SAC/H,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,GAAwB,EAAiB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAE/F,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO;YACH,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,6HAA6H;YACtI,GAAG,EAAE,MAAM;SACd,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,OAAO;YACH,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,yDAAyD;YAClE,GAAG,EAAE,qGAAqG;SAC7G,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,KAAK,IAAI;YACjB,CAAC,CAAC;gBACI,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yBAAyB,KAAK,2BAA2B;gBAClE,GAAG,EAAE,sBAAsB,KAAK,qFAAqF;aACxH;YACH,CAAC,CAAC;gBACI,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yCAAyC;gBAClD,GAAG,EAAE,uFAAuF;aAC/F,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,KAAK,KAAK,IAAI;YACjB,CAAC,CAAC;gBACI,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,qCAAqC,KAAK,cAAc;gBACjE,GAAG,EAAE,uBAAuB,KAAK,6EAA6E;aACjH;YACH,CAAC,CAAC;gBACI,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,2BAA2B;gBACpC,GAAG,EAAE,sIAAsI;aAC9I,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACH,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,sCAAsC;YAC/C,GAAG,EAAE,qGAAqG;SAC7G,CAAC;IACN,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC"}
+{"version":3,"file":"diagnose-network-error.js","sourceRoot":"","sources":["../../src/diagnostics/diagnose-network-error.ts"],"names":[],"mappings":"AAAA,yDAAyD;AAmBzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACvD,2BAA2B;IAC3B,6BAA6B;IAC7B,iCAAiC;IACjC,mCAAmC;IACnC,kBAAkB;IAClB,gBAAgB;CACnB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACtD,yBAAyB;IACzB,WAAW;IACX,yBAAyB;IACzB,sBAAsB;CACzB,CAAC,CAAC;AAEH,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3E,MAAM,MAAM,GACR,qHAAqH;IACrH,uHAAuH;IACvH,uHAAuH;IACvH,2FAA2F,CAAC;AAEhG,2DAA2D;AAC3D,SAAS,MAAM,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACjE,MAAM,CAAC,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,CAAC,GAAI,KAA6B,CAAC,MAAM,CAAC;QAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,OAAO,IAAI,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAE,GAA0B,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9F,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;QAClB,MAAM,IAAI,GAAI,GAA2B,CAAC,MAAM,CAAC;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,8DAA8D;AAC9D,SAAS,eAAe,CAAC,GAAsB;IAC3C,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAChC,GAAY,EACZ,MAAyB,OAAO,CAAC,GAAG;IAEpC,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO;YACH,IAAI,EAAE,QAAQ,MAAM,EAAE;YACtB,OAAO,EAAE,4CAA4C,MAAM,IAAI;YAC/D,GAAG,EAAE,gHAAgH;SACxH,CAAC;IACN,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO;YACH,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,4CAA4C;YACrD,GAAG,EAAE,uHAAuH;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QACnC,OAAO;YACH,IAAI,EAAE,QAAQ,MAAM,EAAE;YACtB,OAAO,EAAE,0CAA0C,MAAM,IAAI;YAC7D,GAAG,EAAE,uHAAuH;SAC/H,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,GAAwB,EAAiB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAE/F,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO;YACH,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,6HAA6H;YACtI,GAAG,EAAE,MAAM;SACd,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,OAAO;YACH,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,yDAAyD;YAClE,GAAG,EAAE,qGAAqG;SAC7G,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,KAAK,IAAI;YACjB,CAAC,CAAC;gBACI,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yBAAyB,KAAK,2BAA2B;gBAClE,GAAG,EAAE,sBAAsB,KAAK,qFAAqF;aACxH;YACH,CAAC,CAAC;gBACI,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yCAAyC;gBAClD,GAAG,EAAE,uFAAuF;aAC/F,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACvB,sEAAsE;QACtE,yEAAyE;QACzE,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,MAAM,GACR,yOAAyO,CAAC;QAC9O,OAAO,KAAK,KAAK,IAAI;YACjB,CAAC,CAAC;gBACI,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,qCAAqC,KAAK,cAAc;gBACjE,GAAG,EAAE,uBAAuB,KAAK,8EAA8E,MAAM,EAAE;aAC1H;YACH,CAAC,CAAC;gBACI,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,2BAA2B;gBACpC,GAAG,EAAE,yIAAyI,MAAM,EAAE;aACzJ,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACH,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,sCAAsC;YAC/C,GAAG,EAAE,qGAAqG;SAC7G,CAAC;IACN,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/setup-wizard-handshake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-wizard-handshake.d.ts","sourceRoot":"","sources":["../src/setup-wizard-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EACR,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACtB,MAAM,yBAAyB,CAAC;AAgCjC,wBAAsB,kBAAkB,CACpC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,OAAO,KAAK,EACxB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,iBAAiB,CAAC,CAe5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,OAAO,KAAK,EACxB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC,CA4B9B;AAED,wBAAsB,gBAAgB,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,OAAO,KAAK,EACxB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED,0GAA0G;AAC1G,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,wBAAsB,gBAAgB,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,eAAe,CAAC,CAgB1B"}
+{"version":3,"file":"setup-wizard-handshake.d.ts","sourceRoot":"","sources":["../src/setup-wizard-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EACR,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACtB,MAAM,yBAAyB,CAAC;AAgCjC,wBAAsB,kBAAkB,CACpC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,OAAO,KAAK,EACxB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,iBAAiB,CAAC,CAuB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,OAAO,KAAK,EACxB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC,CA4B9B;AAED,wBAAsB,gBAAgB,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,OAAO,KAAK,EACxB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,eAAe,CAAC,CAkB1B;AAED,0GAA0G;AAC1G,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,wBAAsB,gBAAgB,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,eAAe,CAAC,CAgB1B"}

package/dist/setup-wizard-handshake.js

@@ -7,7 +7,7 @@
  * @license MIT
  */
 import { RestClient } from './client.js';
-import { isCaTrustError } from './diagnostics/ca-trust.js';
+import { isCaTrustError, isTimeoutError } from './diagnostics/ca-trust.js';
 import { diagnoseNetworkError } from './diagnostics/diagnose-network-error.js';
 // Placeholder Bearer used only for the unauthenticated /health probe;
 // constructed dynamically so the secret-grep-gate doesn't flag the
@@ -51,8 +51,16 @@ export async function defaultProbeHealth(wpUrl, fetchImpl, extraHeaders) {
     }
     catch (e) {
         // Classify the raw error BEFORE stringifying so the wizard can offer
-        // the corporate-CA prompt (G-D #6) on a TLS chain-of-trust failure.
-        return { ok: false, error: describeProbeError(e), ...(isCaTrustError(e) ? { caTrust: true } : {}) };
+        // the corporate-CA prompt (G-D #6) on a TLS chain-of-trust failure, OR
+        // auto-attempt --use-system-ca on an opaque timeout (a TLS-inspecting
+        // proxy whose CA chain can't be built often hangs into a 30s timeout
+        // rather than a clean cert code).
+        return {
+            ok: false,
+            error: describeProbeError(e),
+            ...(isCaTrustError(e) ? { caTrust: true } : {}),
+            ...(isTimeoutError(e) ? { timeout: true } : {}),
+        };
     }
 }
 /**
@@ -106,7 +114,12 @@ export async function defaultProbeAuth(wpUrl, bearer, fetchImpl, extraHeaders) {
         return { ok: true };
     }
     catch (e) {
-        return { ok: false, error: describeProbeError(e), ...(isCaTrustError(e) ? { caTrust: true } : {}) };
+        return {
+            ok: false,
+            error: describeProbeError(e),
+            ...(isCaTrustError(e) ? { caTrust: true } : {}),
+            ...(isTimeoutError(e) ? { timeout: true } : {}),
+        };
     }
 }
 /** Extract `major.minor` from a semver-like string (`0.1.0-alpha.1` → `0.1`); `''` on malformed input. */

package/dist/setup-wizard-handshake.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-wizard-handshake.js","sourceRoot":"","sources":["../src/setup-wizard-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAQ/E,sEAAsE;AACtE,mEAAmE;AACnE,uCAAuC;AACvC,MAAM,8BAA8B,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,CAAU;IAClC,MAAM,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,YAAgD;IAChE,OAAO,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACtC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,CAAC;IACtE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACxD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,KAAa,EACb,SAAwB,EACxB,YAAqC;IAErC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,8BAA8B;YAC3C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,OAAO,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,qEAAqE;QACrE,oEAAoE;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxG,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,KAAa,EACb,SAAwB,EACxB,YAAqC;IAErC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,8BAA8B;YAC3C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6DAA6D,OAAO,IAAI,SAAS,GAAG,EAAE,CAAC;QACtH,CAAC;QACD,MAAM,MAAM,GAAwB;YAChC,EAAE,EAAE,IAAI;YACR,OAAO;YACP,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,GAAG,CAAC,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,KAAa,EACb,MAAc,EACd,SAAwB,EACxB,YAAqC;IAErC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,MAAM;YACnB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxG,CAAC;AACL,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,UAAU,CAAC,OAAe;IACtC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,KAAa,EACb,MAAc,EACd,cAAsB,EACtB,YAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,qBAAqB,EAAE,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;IAC7E,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IACpF,MAAM,KAAK,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QAClD,OAAO;YACH,GAAG,QAAQ;YACX,OAAO,EAAE,gBAAgB,cAAc,KAAK,KAAK,iBAAiB,MAAM,CAAC,aAAa,KAAK,KAAK,iFAAiF;SACpL,CAAC;IACN,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC"}
+{"version":3,"file":"setup-wizard-handshake.js","sourceRoot":"","sources":["../src/setup-wizard-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAQ/E,sEAAsE;AACtE,mEAAmE;AACnE,uCAAuC;AACvC,MAAM,8BAA8B,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,CAAU;IAClC,MAAM,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,YAAgD;IAChE,OAAO,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACtC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,CAAC;IACtE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACxD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,KAAa,EACb,SAAwB,EACxB,YAAqC;IAErC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,8BAA8B;YAC3C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,OAAO,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,kCAAkC;QAClC,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;YAC5B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACN,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,KAAa,EACb,SAAwB,EACxB,YAAqC;IAErC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,8BAA8B;YAC3C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6DAA6D,OAAO,IAAI,SAAS,GAAG,EAAE,CAAC;QACtH,CAAC;QACD,MAAM,MAAM,GAAwB;YAChC,EAAE,EAAE,IAAI;YACR,OAAO;YACP,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,GAAG,CAAC,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,KAAa,EACb,MAAc,EACd,SAAwB,EACxB,YAAqC;IAErC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,MAAM;YACnB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;YAC5B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACN,CAAC;AACL,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,UAAU,CAAC,OAAe;IACtC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,KAAa,EACb,MAAc,EACd,cAAsB,EACtB,YAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,qBAAqB,EAAE,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;IAC7E,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IACpF,MAAM,KAAK,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QAClD,OAAO;YACH,GAAG,QAAQ;YACX,OAAO,EAAE,gBAAgB,cAAc,KAAK,KAAK,iBAAiB,MAAM,CAAC,aAAa,KAAK,KAAK,iFAAiF;SACpL,CAAC;IACN,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/setup-wizard-types.d.ts

@@ -115,12 +115,25 @@ export interface HealthProbeResult {
      * {@link isCaTrustError}; absent/false means "not a CA problem".
      */
     readonly caTrust?: boolean;
+    /**
+     * True when the failure was a connection/handshake TIMEOUT (e.g.
+     * `UND_ERR_CONNECT_TIMEOUT` / `ETIMEDOUT`). A TLS-inspecting corporate
+     * proxy whose root CA can't be built often manifests as an opaque 30s
+     * timeout rather than a clean CA-trust code, so the wizard attempts the
+     * OS-trust-store (`--use-system-ca`) recovery on a timeout too (on Node ≥
+     * 22.15). Set by the probe via {@link isTimeoutError}; absent/false means
+     * "not a timeout". May coincide with — but is independent of —
+     * {@link caTrust}.
+     */
+    readonly timeout?: boolean;
 }
 export interface AuthProbeResult {
     readonly ok: boolean;
     readonly error?: string;
     /** See {@link HealthProbeResult.caTrust}. */
     readonly caTrust?: boolean;
+    /** See {@link HealthProbeResult.timeout}. */
+    readonly timeout?: boolean;
 }
 /**
  * The user's answer to the wizard's corporate-CA prompt (G-D #6).

package/dist/setup-wizard-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-wizard-types.d.ts","sourceRoot":"","sources":["../src/setup-wizard-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACR,cAAc,EACd,eAAe,EAClB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,aAAa;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0BAA0B;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,qCAAqC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IACzB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GACpB;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACvB,8DAA8D;IAC9D,MAAM,EAAE,CAAC,KAAK,EAAE;QACZ,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;KACvC,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACpC,mCAAmC;IACnC,aAAa,EAAE,MAAM,SAAS,cAAc,EAAE,CAAC;IAC/C,mDAAmD;IACnD,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChE,qDAAqD;IACrD,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACvE,sDAAsD;IACtD,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,uDAAuD;IACvD,WAAW,EAAE,CACT,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,eAAe,KACtB,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B;8DAC0D;IAC1D,SAAS,EAAE,CACP,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,KACrB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9F;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;KACnC,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IACtF,mDAAmD;IACnD,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D"}
+{"version":3,"file":"setup-wizard-types.d.ts","sourceRoot":"","sources":["../src/setup-wizard-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACR,cAAc,EACd,eAAe,EAClB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,aAAa;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0BAA0B;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,qCAAqC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IACzB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GACpB;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACvB,8DAA8D;IAC9D,MAAM,EAAE,CAAC,KAAK,EAAE;QACZ,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;KACvC,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACpC,mCAAmC;IACnC,aAAa,EAAE,MAAM,SAAS,cAAc,EAAE,CAAC;IAC/C,mDAAmD;IACnD,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChE,qDAAqD;IACrD,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACvE,sDAAsD;IACtD,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,uDAAuD;IACvD,WAAW,EAAE,CACT,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,eAAe,KACtB,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B;8DAC0D;IAC1D,SAAS,EAAE,CACP,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,KACrB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9F;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;KACnC,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IACtF,mDAAmD;IACnD,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D"}

package/dist/setup-wizard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-wizard.d.ts","sourceRoot":"","sources":["../src/setup-wizard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAcH,OAAO,KAAK,EACR,eAAe,EACf,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,WAAW,EACd,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7E,YAAY,EACR,eAAe,EACf,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,WAAW,GACd,CAAC;AAsBF;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAC3B,IAAI,GAAE,UAAgC,GACvC,OAAO,CAAC,MAAM,CAAC,CAwUjB"}
+{"version":3,"file":"setup-wizard.d.ts","sourceRoot":"","sources":["../src/setup-wizard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAcH,OAAO,KAAK,EACR,eAAe,EACf,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,WAAW,EACd,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7E,YAAY,EACR,eAAe,EACf,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,WAAW,GACd,CAAC;AAqCF;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAC3B,IAAI,GAAE,UAAgC,GACvC,OAAO,CAAC,MAAM,CAAC,CAsYjB"}

package/dist/setup-wizard.js

@@ -40,6 +40,19 @@ const SERVER_KEY = 'yt-builder-mcp';
  */
 const SYSTEM_CA_DEFERRED_MESSAGE = '✅ Configured to use the OS trust store (--use-system-ca) — this takes effect when ' +
     "your AI client next launches the server. The current setup process can't validate it in-process.";
+/**
+ * Honest outcome when the health probe failed with an opaque TIMEOUT and we
+ * auto-attempted the OS-trust-store recovery (a TLS-inspecting corporate proxy
+ * whose CA chain can't be built hangs into a 30s timeout rather than a clean
+ * cert error). Like {@link SYSTEM_CA_DEFERRED_MESSAGE}, system mode can't be
+ * validated in-process — but a timeout is ALSO ambiguous (it can be a genuine
+ * proxy/VPN reachability problem), so we keep the proxy/VPN guidance visible:
+ * if the next launch still fails, the cause was reachability, not the CA.
+ */
+const TIMEOUT_SYSTEM_CA_DEFERRED_MESSAGE = '✅ The connection timed out — a TLS-inspecting corporate proxy can hang the handshake this way, so the ' +
+    'server was configured to use the OS trust store (--use-system-ca), validated when your AI client next ' +
+    'launches the server. If it still fails after restart, the timeout was a reachability problem instead: ' +
+    'the site may be internal (VPN needed) or require a proxy (set HTTPS_PROXY). Never disables TLS verification.';
 /**
  * Run the interactive setup wizard. Returns a process exit-code so the
  * outer dispatcher can `process.exit(rc)` cleanly.
@@ -166,6 +179,67 @@ export async function runWizard(deps = DEFAULT_WIZARD_DEPS) {
                 }
             }
         }
+        // Timeout → OS-trust-store auto-bake (Glöckle corporate-CA timeout gap).
+        // A TLS-inspecting corporate proxy whose root CA chain can't be built
+        // often hangs the handshake into an OPAQUE 30s timeout rather than a
+        // clean cert code — so `health.caTrust` is false and the CA prompt above
+        // never fires, leaving the operator to set NODE_OPTIONS=--use-system-ca
+        // by hand. When the probe failed with a TIMEOUT, this Node can read the
+        // OS trust store (Node ≥ 22.15), and NO CA was chosen yet, attempt the
+        // SAME system-CA recovery the caTrust branch does: bake caMode:'system'
+        // and RE-PROBE. `--use-system-ca` only ADDS the OS store (never disables
+        // TLS), so attempting it on a timeout is safe even if the timeout turns
+        // out to be a genuine proxy/VPN issue — the re-probe just fails again and
+        // the proxy/VPN guidance is still shown. Like the caTrust branch, system
+        // mode can't validate in-process, so a still-failing re-probe defers
+        // validation to next launch (the written config is correct) rather than
+        // discarding it; the ambiguity (CA vs reachability) is surfaced honestly.
+        const caChosenSoFar = caChoice.caCertPath !== undefined || caChoice.caMode !== undefined;
+        if (!health.ok && health.timeout === true && !caChosenSoFar && supportsSystemCa(nodeVersion)) {
+            log.warn(`The connection timed out — attempting the OS trust store (--use-system-ca) in case a corporate TLS-inspection proxy is hanging the TLS handshake: ${health.error ?? 'timeout'}`);
+            caChoice = { caMode: 'system' };
+            const reSpinner = spinner();
+            reSpinner.start('Re-checking the connection with --use-system-ca applied…');
+            if (deps.applyAndReProbe !== undefined) {
+                const re = await deps.applyAndReProbe({
+                    wpUrl: answers.wpUrl,
+                    bearer: answers.bearer,
+                    choice: { choice: 'system' },
+                });
+                health = re.health;
+                auth = re.auth;
+            }
+            else {
+                health = await deps.probeHealth(answers.wpUrl);
+                auth = await deps.probeAuth(answers.wpUrl, answers.bearer);
+            }
+            if (health.ok) {
+                reSpinner.stop('✅ connected — OS trust store resolved the timeout.');
+            }
+            else {
+                // System mode can't validate in-process (the OS store is only
+                // read when Node restarts WITH the flag). Defer validation to the
+                // next launch instead of discarding the (now correct) config —
+                // but keep the proxy/VPN guidance visible for the ambiguous case.
+                systemCaDeferred = true;
+                reSpinner.stop('OS trust store configured (--use-system-ca).');
+                logFn(TIMEOUT_SYSTEM_CA_DEFERRED_MESSAGE);
+            }
+        }
+        else if (!health.ok && health.timeout === true && !caChosenSoFar && !supportsSystemCa(nodeVersion)) {
+            // Below the system-CA floor we cannot write a flag the target Node
+            // would reject. Warn to supply a .pem instead (the only CA option on
+            // an old Node), then fall through to the generic continue decision.
+            // Route through BOTH the clack UI and the logFn sink so the warning is
+            // capturable in non-TTY / test contexts (mirrors the P0.1 below-floor
+            // branch). Intentionally does NOT name the OS-trust-store flag (the
+            // whole point is that it's unavailable on this Node).
+            const warnPem = `The connection timed out and this Node (${nodeVersion}) is below 22.15, so the OS trust store cannot be read. ` +
+                'If a corporate TLS-inspection proxy is the cause, re-run setup with `--ca <path-to-corp-root-ca.pem>` ' +
+                '(export your corporate root CA to a .pem). Otherwise the site may need a VPN/proxy. Never disable TLS verification.';
+            log.warn(warnPem);
+            logFn(warnPem);
+        }
         // If the connection is still down after the (optional) CA step, fall
         // through to the generic continue-anyway decision — UNLESS system-CA was
         // configured, where validation is deferred to next launch and the (false-