dominds 1.25.19 → 1.26.1

package/README.md

@@ -253,6 +253,23 @@ Platform note:
 
 - Windows also registers `codex_inspect_and_patch_tools`; its `readonly_shell` tool runs through `cmd.exe`, so prefer allowlisted commands available in that shell/PATH, such as `rg`, `git`, `dir`, `type`, and `where`.
 
+### Local HTTPS Certificates
+
+Dominds always keeps an HTTP listener. When a valid certificate matching the current `--host` exists under `~/.dominds/certs/`, Dominds also starts HTTPS. Certificates match DNS/IP hostnames, not ports, so one certificate covers all Dominds WebUI ports on that host.
+
+```bash
+# Create a 10-year self-signed certificate for detected non-loopback LAN hosts
+dominds cert create
+
+# Add explicit SAN hosts; --host can be repeated
+dominds cert create --host 192.168.1.10 --host my-host.local
+
+# Inspect whether the detected LAN hosts can use an HTTPS certificate
+dominds cert status
+```
+
+`localhost`, `loopback`, `127.0.0.0/8`, `169.254.0.0/16`, `::1`, `fe80::/10`, `0.0.0.0`, and `::` are not certificate hosts. `0.0.0.0` / `::` only mean bind-all; certificate matching uses detected non-loopback LAN hosts. A bare `--port 5666` disables Dominds built-in HTTPS and assumes a front proxy handles HTTPS, while the default port behavior and `--port 5666+/-` may auto-enable built-in HTTPS when a matching certificate exists.
+
 ## Start from scratch
 
 Starting from scratch means: create an empty folder, run `dominds`, let Setup generate the minimal `.minds/team.yaml`, then use the shadow team manager (`@fuxi`) to design a real team for your product.

package/README.zh.md

@@ -192,6 +192,23 @@ dominds
 
 - Windows 也会注册 `codex_inspect_and_patch_tools`；其中 `readonly_shell` 通过 `cmd.exe` 执行，因此优先使用该 shell/PATH 中可用的白名单命令，例如 `rg`、`git`、`dir`、`type` 和 `where`。
 
+### 本地 HTTPS 证书
+
+Dominds 默认始终提供 HTTP 监听；当 `~/.dominds/certs/` 下存在匹配当前 `--host` 的有效证书时，会额外启用 HTTPS。证书按 DNS/IP 主机名匹配，不绑定端口，因此同一张证书可覆盖该主机上的所有 Dominds WebUI 端口。
+
+```bash
+# 自动为检测到的一个或多个非 loopback LAN 主机创建 10 年有效的自签名证书
+dominds cert create
+
+# 显式指定证书 SAN，可重复 --host
+dominds cert create --host 192.168.1.10 --host my-host.local
+
+# 查看检测到的 LAN 主机是否能匹配到证书
+dominds cert status
+```
+
+`localhost`、`loopback`、`127.0.0.0/8`、`169.254.0.0/16`、`::1`、`fe80::/10`、`0.0.0.0`、`::` 不会作为 HTTPS 证书主机；其中 `0.0.0.0` / `::` 仅表示绑定所有地址，匹配证书时会使用检测到的非 loopback LAN 主机。使用裸 `--port 5666` 启动时，Dominds 会认为 HTTPS 由前置代理负责，不启用内建 HTTPS；使用默认端口或 `--port 5666+/-` 时才会自动启用内建 HTTPS。
+
 ## 从零开始（空文件夹启动）
 
 若暂无模板或团队配置，可直接从空目录启动：

package/dist/apps/runtime.d.ts

@@ -1,3 +1,4 @@
+import type { DomindsKernelEndpoint } from '@longrun-ai/kernel/app-host-contract';
 import { type AppsHostClient } from '../apps-host/client';
 export type DynamicAppToolAvailabilityResult = Readonly<{
     status: 'ready';
@@ -36,8 +37,5 @@ export declare function resolveDynamicAppToolAvailabilityForMember(_params: {
 }): Promise<DynamicAppToolAvailabilityResult>;
 export declare function initAppsRuntime(params: {
     rtwsRootAbs: string;
-    kernel: Readonly<{
-        host: string;
-        port: number;
-    }>;
+    kernel: DomindsKernelEndpoint;
 }): Promise<void>;

package/dist/apps-host/client.d.ts

@@ -1,4 +1,4 @@
-import type { DomindsAppDynamicToolsetsContext, DomindsAppReminderOwnerApplyContext, DomindsAppReminderOwnerRenderContext, DomindsAppReminderOwnerUpdateContext, DomindsAppReminderRenderedMessage, DomindsAppRunControlContext, DomindsAppRunControlResult } from '@longrun-ai/kernel/app-host-contract';
+import type { DomindsAppDynamicToolsetsContext, DomindsAppReminderOwnerApplyContext, DomindsAppReminderOwnerRenderContext, DomindsAppReminderOwnerUpdateContext, DomindsAppReminderRenderedMessage, DomindsAppRunControlContext, DomindsAppRunControlResult, DomindsKernelEndpoint } from '@longrun-ai/kernel/app-host-contract';
 import type { DomindsAppHostReminderUpdateResult, DomindsAppHostToolResult, DomindsAppInstallJson, DomindsAppReminderApplyRequest, DomindsAppReminderApplyResult } from '@longrun-ai/kernel/app-json';
 import type { ToolArguments } from '../tool';
 import type { AppsHostMessageToKernel } from './ipc-types';
@@ -29,10 +29,7 @@ export type AppsHostReadyMessage = Extract<AppsHostMessageToKernel, {
 }>;
 export declare function startAppsHost(params: {
     rtwsRootAbs: string;
-    kernel: Readonly<{
-        host: string;
-        port: number;
-    }>;
+    kernel: DomindsKernelEndpoint;
     apps: ReadonlyArray<EnabledAppForHost>;
 }): Promise<Readonly<{
     client: AppsHostClient;

package/dist/apps-host/ipc-types.d.ts

@@ -1,14 +1,11 @@
-import type { DomindsAppReminderRenderedMessage, DomindsAppRunControlResult } from '@longrun-ai/kernel/app-host-contract';
+import type { DomindsAppReminderRenderedMessage, DomindsAppRunControlResult, DomindsKernelEndpoint } from '@longrun-ai/kernel/app-host-contract';
 import type { DomindsAppDialogReminderRequestBatch, DomindsAppHostReminderUpdateResult, DomindsAppInstallJson, DomindsAppReminderApplyRequest, DomindsAppReminderApplyResult, DomindsAppReminderState } from '@longrun-ai/kernel/app-json';
 import type { LanguageCode } from '@longrun-ai/kernel/types/language';
 import type { ToolArguments, ToolCallOutput } from '../tool';
 export type AppsHostKernelInitMessage = Readonly<{
     type: 'init';
     rtwsRootAbs: string;
-    kernel: Readonly<{
-        host: string;
-        port: number;
-    }>;
+    kernel: DomindsKernelEndpoint;
     apps: ReadonlyArray<Readonly<{
         appId: string;
         runtimePort: number | null;

package/dist/apps-host/ipc-types.js

@@ -126,9 +126,13 @@ function parseAppsHostMessageFromKernel(v) {
             throw new Error('Invalid init message: rtwsRootAbs required');
         if (!isRecord(kernel))
             throw new Error('Invalid init message: kernel must be object');
+        const scheme = kernel['scheme'];
         const host = asString(kernel['host']);
         const portRaw = kernel['port'];
         const port = typeof portRaw === 'number' && Number.isFinite(portRaw) ? Math.floor(portRaw) : null;
+        if (scheme !== 'http' && scheme !== 'https') {
+            throw new Error('Invalid init message: kernel.scheme must be http|https');
+        }
         if (!host)
             throw new Error('Invalid init message: kernel.host required');
         if (port === null || port < 0) {
@@ -157,7 +161,7 @@ function parseAppsHostMessageFromKernel(v) {
             }
             return { appId, runtimePort, installJson: installJson };
         });
-        return { type: 'init', rtwsRootAbs, kernel: { host, port }, apps: parsedApps };
+        return { type: 'init', rtwsRootAbs, kernel: { scheme, host, port }, apps: parsedApps };
     }
     if (type === 'tool_call') {
         const callId = asString(v['callId']);

package/dist/bootstrap/rtws-cli.d.ts

@@ -4,4 +4,5 @@ export type RtwsCliParseResult = Readonly<{
 }>;
 export declare function extractGlobalRtwsChdir(params: Readonly<{
     argv: ReadonlyArray<string>;
+    baseCwd?: string;
 }>): RtwsCliParseResult;

package/dist/bootstrap/rtws-cli.js

@@ -36,13 +36,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractGlobalRtwsChdir = extractGlobalRtwsChdir;
 const path = __importStar(require("path"));
 function extractGlobalRtwsChdir(params) {
+    const baseCwd = params.baseCwd ?? process.cwd();
     let chdir;
     const out = [];
-    const readAbsoluteChdir = (argName, value) => {
-        if (!path.isAbsolute(value)) {
-            throw new Error(`${argName} requires an absolute directory path: ${value}`);
-        }
-        return value;
+    const readChdir = (argName, value) => {
+        if (value.trim() === '')
+            throw new Error(`${argName} requires a directory argument`);
+        return path.resolve(baseCwd, value);
     };
     for (let i = 0; i < params.argv.length; i++) {
         const arg = params.argv[i];
@@ -55,7 +55,7 @@ function extractGlobalRtwsChdir(params) {
             if (typeof next !== 'string' || next.length === 0 || next === '--') {
                 throw new Error(`${arg} requires a directory argument`);
             }
-            chdir = readAbsoluteChdir(arg, next);
+            chdir = readChdir(arg, next);
             i++;
             continue;
         }
@@ -63,14 +63,14 @@ function extractGlobalRtwsChdir(params) {
             const value = arg.slice('--cwd='.length);
             if (value.length === 0)
                 throw new Error(`--cwd requires a directory argument`);
-            chdir = readAbsoluteChdir('--cwd', value);
+            chdir = readChdir('--cwd', value);
             continue;
         }
         if (arg.startsWith('--chdir=')) {
             const value = arg.slice('--chdir='.length);
             if (value.length === 0)
                 throw new Error(`--chdir requires a directory argument`);
-            chdir = readAbsoluteChdir('--chdir', value);
+            chdir = readChdir('--chdir', value);
             continue;
         }
         out.push(arg);

package/dist/cli/cert.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export declare function main(args?: readonly string[], runtimeOptions?: Readonly<{
+    certsDirAbs?: string;
+}>): Promise<void>;

package/dist/cli/cert.js

@@ -0,0 +1,247 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.main = main;
+const auth_1 = require("../server/auth");
+const certificates_1 = require("../server/certificates");
+function printHelp() {
+    console.log(`
+Dominds certificate tools
+
+Usage:
+  dominds cert create [--host <host>] [--days <days>] [--force]
+  dominds cert status [--host <host>] [--port <port>] [--origin]
+
+Options:
+  --host <host>      Host name or IP address (default: detected non-loopback LAN hosts)
+  --days <days>      Certificate validity in days (default: ${certificates_1.DEFAULT_SELF_SIGNED_CERT_DAYS})
+  --force            Overwrite existing generated files
+  --port <port>      Port for status --origin output
+  --origin           Print only the effective origin, using https when a matching cert exists
+  --help             Show this help message
+
+Certificates live in ~/.dominds/certs/. A WebUI server automatically enables HTTPS when it finds
+a certificate/key pair that matches the bind host or, for 0.0.0.0/::, a detected non-loopback LAN host.
+`);
+}
+async function main(args = process.argv.slice(2), runtimeOptions = {}) {
+    const first = args[0];
+    if (first === undefined || first === '--help' || first === '-h') {
+        printHelp();
+        return;
+    }
+    const action = parseAction(first);
+    if (action === null) {
+        console.error(`Error: Unknown cert subcommand '${first}'`);
+        printHelp();
+        process.exit(1);
+    }
+    const options = parseOptions(args.slice(1), action);
+    if (options.kind === 'error') {
+        console.error(`Error: ${options.message}`);
+        printHelp();
+        process.exit(1);
+    }
+    if (action === 'create') {
+        const created = await (0, certificates_1.createSelfSignedCertificate)({
+            host: options.host,
+            altHosts: options.altHosts,
+            days: options.days,
+            force: options.force,
+            certsDirAbs: runtimeOptions.certsDirAbs,
+        });
+        console.log(`Created self-signed certificate for ${created.host}`);
+        console.log(`  hosts: ${created.hosts.join(', ')}`);
+        console.log(`  cert: ${created.certPath}`);
+        console.log(`  key:  ${created.keyPath}`);
+        console.log(`  meta: ${created.metadataPath}`);
+        console.log(`  days: ${created.days}`);
+        return;
+    }
+    if (options.origin) {
+        if (options.port === undefined) {
+            console.error('Error: cert status --origin requires --port <port>');
+            process.exit(1);
+        }
+        const lookup = await withConsoleInfoOnStderr(async () => (0, certificates_1.findAutoHttpsCertificateForHost)({
+            host: options.host ?? '::',
+            certsDirAbs: runtimeOptions.certsDirAbs,
+        }));
+        console.log((0, auth_1.formatServerOrigin)({
+            scheme: lookup.kind === 'found' ? 'https' : 'http',
+            host: lookup.kind === 'found' ? lookup.certificate.matchedHost : lookup.endpoint.urlHost,
+            port: options.port,
+        }));
+        return;
+    }
+    const lookup = await (0, certificates_1.findAutoHttpsCertificateForHost)({
+        host: options.host ?? '::',
+        certsDirAbs: runtimeOptions.certsDirAbs,
+    });
+    for (const diagnostic of lookup.diagnostics) {
+        console.warn(`warning: ${diagnostic.message}`);
+    }
+    if (lookup.kind === 'found') {
+        console.log(`HTTPS certificate: found`);
+        console.log(`  cert: ${lookup.certificate.certPath}`);
+        console.log(`  key:  ${lookup.certificate.keyPath}`);
+        console.log(`  matchedHost: ${lookup.certificate.matchedHost}`);
+        console.log(`  validTo: ${lookup.certificate.validTo.toISOString()}`);
+    }
+    else {
+        console.log(`HTTPS certificate: not found`);
+        console.log(`  certsDir: ${lookup.certsDirAbs}`);
+    }
+}
+function parseAction(value) {
+    switch (value) {
+        case 'create':
+            return 'create';
+        case 'status':
+            return 'status';
+        default:
+            return null;
+    }
+}
+function parseOptions(args, action) {
+    let host;
+    let days;
+    const altHosts = [];
+    let force = false;
+    let port;
+    let origin = false;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === '--host') {
+            const next = args[i + 1];
+            if (next === undefined || next === '') {
+                return { kind: 'error', message: '--host requires a value' };
+            }
+            const hostResult = addHostOption({ action, host, altHosts, value: next });
+            if (hostResult.kind === 'error')
+                return hostResult;
+            host = hostResult.host;
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith('--host=')) {
+            const value = arg.slice('--host='.length);
+            if (value === '')
+                return { kind: 'error', message: '--host requires a value' };
+            const hostResult = addHostOption({ action, host, altHosts, value });
+            if (hostResult.kind === 'error')
+                return hostResult;
+            host = hostResult.host;
+            continue;
+        }
+        if (arg === '--days') {
+            if (action !== 'create') {
+                return { kind: 'error', message: '--days is only valid for cert create' };
+            }
+            const next = args[i + 1];
+            const parsed = next === undefined ? null : parseInteger(next);
+            if (parsed === null)
+                return { kind: 'error', message: '--days requires an integer' };
+            days = parsed;
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith('--days=')) {
+            if (action !== 'create') {
+                return { kind: 'error', message: '--days is only valid for cert create' };
+            }
+            const parsed = parseInteger(arg.slice('--days='.length));
+            if (parsed === null)
+                return { kind: 'error', message: '--days requires an integer' };
+            days = parsed;
+            continue;
+        }
+        if (arg === '--port') {
+            if (action !== 'status') {
+                return { kind: 'error', message: '--port is only valid for cert status' };
+            }
+            const next = args[i + 1];
+            const parsed = next === undefined ? null : parseInteger(next);
+            if (parsed === null || parsed < 1 || parsed > 65535) {
+                return { kind: 'error', message: '--port requires a valid TCP port' };
+            }
+            port = parsed;
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith('--port=')) {
+            if (action !== 'status') {
+                return { kind: 'error', message: '--port is only valid for cert status' };
+            }
+            const parsed = parseInteger(arg.slice('--port='.length));
+            if (parsed === null || parsed < 1 || parsed > 65535) {
+                return { kind: 'error', message: '--port requires a valid TCP port' };
+            }
+            port = parsed;
+            continue;
+        }
+        if (arg === '--force') {
+            if (action !== 'create') {
+                return { kind: 'error', message: '--force is only valid for cert create' };
+            }
+            force = true;
+            continue;
+        }
+        if (arg === '--origin') {
+            if (action !== 'status') {
+                return { kind: 'error', message: '--origin is only valid for cert status' };
+            }
+            origin = true;
+            continue;
+        }
+        if (arg === '--help' || arg === '-h') {
+            printHelp();
+            process.exit(0);
+        }
+        if (!arg.startsWith('-') && host === undefined && action === 'create') {
+            host = arg;
+            continue;
+        }
+        return { kind: 'error', message: `Unknown option '${arg}'` };
+    }
+    return { kind: 'ok', host, days, altHosts, force, port, origin };
+}
+function addHostOption(params) {
+    if (params.host === undefined) {
+        return { kind: 'ok', host: params.value };
+    }
+    if (params.action !== 'create') {
+        return { kind: 'error', message: '--host can only be repeated for cert create' };
+    }
+    params.altHosts.push(params.value);
+    return { kind: 'ok', host: params.host };
+}
+function parseInteger(raw) {
+    if (!/^[0-9]+$/.test(raw))
+        return null;
+    const parsed = Number(raw);
+    return Number.isSafeInteger(parsed) ? parsed : null;
+}
+async function withConsoleInfoOnStderr(fn) {
+    const originalInfo = console.info;
+    const originalDebug = console.debug;
+    console.info = (...args) => {
+        console.error(...args);
+    };
+    console.debug = (...args) => {
+        console.error(...args);
+    };
+    try {
+        return await fn();
+    }
+    finally {
+        console.info = originalInfo;
+        console.debug = originalDebug;
+    }
+}
+if (require.main === module) {
+    main().catch((error) => {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    });
+}

package/dist/cli/create.d.ts

@@ -8,7 +8,7 @@
  *
  * Notes:
  * - Template can be a short name (resolved via DOMINDS_TEMPLATE_BASE) or a git URL.
- * - rtws directory is `process.cwd()`. Use 'dominds -C <abs-dir> create ...' to create under another base dir.
+ * - rtws directory is `process.cwd()`. Use 'dominds -C <dir> create ...' to create under another base dir.
  */
 declare function main(argv?: readonly string[]): Promise<void>;
 export { main };

package/dist/cli/create.js

@@ -9,7 +9,7 @@
  *
  * Notes:
  * - Template can be a short name (resolved via DOMINDS_TEMPLATE_BASE) or a git URL.
- * - rtws directory is `process.cwd()`. Use 'dominds -C <abs-dir> create ...' to create under another base dir.
+ * - rtws directory is `process.cwd()`. Use 'dominds -C <dir> create ...' to create under another base dir.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;

package/dist/cli/read.js

@@ -59,7 +59,7 @@ function printUsage() {
     console.log('`--audit` runs prompt audit via hidden teammate @fuxi using default LLM config (skips when unavailable), and also includes static toolset checks (registry vs `.minds/mcp.yaml` declarations).');
     console.log('When <member-id> is omitted, reads all visible team members.');
     console.log('');
-    console.log("Note: rtws (runtime workspace) directory is `process.cwd()`. Use 'dominds -C <abs-dir> read' to run in another rtws.");
+    console.log("Note: rtws (runtime workspace) directory is `process.cwd()`. Use 'dominds -C <dir> read' to run in another rtws.");
     console.log('');
     console.log('Examples:');
     console.log('  dominds read                    # Read all team members');

package/dist/cli/tui.js

@@ -76,7 +76,7 @@ function showHelp() {
     console.log('');
     console.log('Start or continue a dialog with an AI team member using a Taskdoc.');
     console.log('');
-    console.log("Note: rtws (runtime workspace) directory is `process.cwd()`. Use 'dominds -C <abs-dir> tui ...' to run in another rtws.");
+    console.log("Note: rtws (runtime workspace) directory is `process.cwd()`. Use 'dominds -C <dir> tui ...' to run in another rtws.");
     console.log('');
     console.log('Arguments:');
     console.log('  <taskdoc-path>    Path to Taskdoc (required for dialog)');

package/dist/cli/webui.d.ts

@@ -9,7 +9,7 @@
  *   -p, --port <port>    Port to listen on. Bare port is strict; suffix + tries higher ports; suffix - tries lower ports.
  *   -h, --host <host>    Host to bind to (default: localhost)
  *   --nobrowser          Do not open a browser (opt-out)
- *   -h, --help           Show help
+ *   --help               Show help
  */
 declare function main(args?: readonly string[]): Promise<void>;
 export { main };

package/dist/cli/webui.js

@@ -10,7 +10,7 @@
  *   -p, --port <port>    Port to listen on. Bare port is strict; suffix + tries higher ports; suffix - tries lower ports.
  *   -h, --host <host>    Host to bind to (default: localhost)
  *   --nobrowser          Do not open a browser (opt-out)
- *   -h, --help           Show help
+ *   --help               Show help
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.main = main;
@@ -22,6 +22,14 @@ const server_1 = require("../server");
 const auth_1 = require("../server/auth");
 const port_selection_1 = require("../server/port-selection");
 const log = (0, log_1.createLogger)('webui');
+function formatWebSocketEndpoint(params) {
+    const httpOrigin = (0, auth_1.formatServerOrigin)({
+        scheme: params.scheme === 'ws' ? 'http' : 'https',
+        host: params.host,
+        port: params.port,
+    });
+    return `${params.scheme}${httpOrigin.slice(httpOrigin.indexOf(':'))}/ws`;
+}
 function printHelp() {
     console.log(`
 WebUI Server for dominds
@@ -30,7 +38,7 @@ Usage:
   dominds webui [options]
 
 Note:
-  rtws (runtime workspace) directory is \`process.cwd()\`. Use 'dominds -C <abs-dir> webui' to run in another rtws.
+  rtws (runtime workspace) directory is \`process.cwd()\`. Use 'dominds -C <dir> webui' to run in another rtws.
 
 Options:
   -p, --port <port>    Port to listen on. Bare port is strict; suffix + tries higher ports; suffix - tries lower ports.
@@ -145,12 +153,34 @@ async function main(args = process.argv.slice(2)) {
         });
         const httpServer = started.httpServer;
         const auth = started.auth;
-        const baseUrl = `http://${started.host}:${started.port}`;
+        const baseUrl = (0, auth_1.formatServerOrigin)({
+            scheme: 'http',
+            host: started.urlHost,
+            port: started.port,
+        });
         log.info(`WebUI ready: ${baseUrl}`);
-        log.debug(`WebSocket endpoint: ws://${started.host}:${started.port}/ws`);
+        log.debug(`WebSocket endpoint: ${formatWebSocketEndpoint({
+            scheme: 'ws',
+            host: started.urlHost,
+            port: started.port,
+        })}`);
+        if (started.httpsPort !== undefined && started.httpsUrlHost !== undefined) {
+            const httpsBaseUrl = (0, auth_1.formatServerOrigin)({
+                scheme: 'https',
+                host: started.httpsUrlHost,
+                port: started.httpsPort,
+            });
+            log.info(`HTTPS WebUI ready: ${httpsBaseUrl}`);
+            log.debug(`HTTPS WebSocket endpoint: ${formatWebSocketEndpoint({
+                scheme: 'wss',
+                host: started.httpsUrlHost,
+                port: started.httpsPort,
+            })}`);
+        }
         if (auth.kind === 'enabled') {
             const autoAuthUrl = (0, auth_1.formatAutoAuthUrl)({
-                host: started.host,
+                scheme: 'http',
+                host: started.urlHost,
                 port: started.port,
                 authKey: auth.key,
             });

package/dist/cli-runner.d.ts

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+/**
+ * Business CLI runner for dominds
+ *
+ * Usage:
+ *   dominds [subcommand] [options]
+ *
+ * Subcommands:
+ *   webui    - Start WebUI server (default)
+ *   tui      - Start Text User Interface
+ *   run      - Run task dialog (alias for tui)
+ *   read     - Read team configuration
+ *   man      - Render toolset manual to stdout
+ *   manual   - Alias for man
+ *   validate_team_def - Validate explicit team toolset declarations
+ *   cert     - Create and inspect local HTTPS certificates
+ *   create   - Create a new runtime workspace (rtws) from a template
+ *   install  - Install a Dominds App into this rtws
+ *   doctor   - Diagnose Dominds App state in this rtws
+ *   enable   - Enable an installed Dominds App in this rtws
+ *   disable  - Disable an installed Dominds App in this rtws
+ *   uninstall- Uninstall a Dominds App from this rtws
+ *   update   - Update installed Dominds App(s)
+ *   new      - Alias for create
+ *   help     - Show help
+ *
+ * This file is launched by the top-level dominds supervisor.
+ */
+import './tools/builtins';
+export declare function configureEnvProxySupport(): void;
+export declare function main(argv?: readonly string[]): Promise<void>;