subconscious-cli 6.3.0 → 7.0.0

package/bin/cli.js

@@ -35,6 +35,7 @@ import {
 } from './harness-manifest.js';
 import { headlessPromptIndex } from './headless-args.js';
 import { resolveModelCatalog } from './models.js';
+import { ensureSystemCa, refuseUnsupportedSystemCa } from './network.js';
 import {
   configCommand,
   DEFAULT_PROFILE,
@@ -44,6 +45,7 @@ import {
   printConfigHelp,
   RUNBOOK_DEFAULTS,
   resolvedModelSetting,
+  systemCaEnabledFor,
   updatePlatformUrlCommand,
   updateUrlCommand,
   validateProfileName,
@@ -58,6 +60,23 @@ function isHelpArg(arg) {
   return arg === 'help' || arg === '-h' || arg === '--help';
 }
 
+// Commands that never make a network request.
+const OFFLINE_COMMANDS = new Set([
+  '--help',
+  '-h',
+  'help',
+  'config',
+  'update-key',
+  'logout',
+  'setup',
+  'settings',
+  'cursor',
+]);
+
+function needsNetwork(args) {
+  return !OFFLINE_COMMANDS.has(args[0]) && !isHelpArg(args[1]);
+}
+
 function printHelp() {
   const agents = agentList()
     .map(
@@ -122,6 +141,9 @@ ${agents}
     ${c.dim}$${c.reset} subc codex headless "fix the failing test"
     ${c.dim}$${c.reset} subc -p staging codex
 
+  ${c.bold}Network${c.reset}
+    Behind a proxy or a TLS-inspecting firewall? Run ${c.cyan}subc login help${c.reset}.
+
   ${c.dim}Use subc <command> help for command-specific usage.${c.reset}
 `);
 }
@@ -136,6 +158,16 @@ Usage:
 Authenticate and save an API key to the selected profile.
 Opens a browser to a one-time login link. If the browser does not open, use the URL printed in the terminal.
 To sign in without a browser, copy an API key from the dashboard and run subc update-key <your-api-key>.
+
+Behind a proxy or firewall:
+  If login fails with ENOTFOUND, ECONNREFUSED or a timeout, the network may require a proxy.
+  Set HTTPS_PROXY=http://host:port (or http://user:pass@host:port) and retry.
+  NO_PROXY=host1,.example.com lists hosts to reach directly, not through the proxy.
+  If the error names a certificate (SELF_SIGNED_CERT_IN_CHAIN, UNABLE_TO_VERIFY_LEAF_SIGNATURE),
+  the proxy re-signs TLS traffic. Ask IT for its root certificate, then either:
+    export NODE_EXTRA_CA_CERTS=/path/to/corporate-root-ca.pem
+    or set SYSTEM_CA=on in the profile (subc config edit) to trust the OS certificate store. Needs Node 22.15 or newer.
+  If nothing works, subc update-key <your-api-key> saves a key without any network request.
 `,
   logout: `
 Usage:
@@ -369,6 +401,16 @@ async function main() {
     return;
   }
 
+  // Trust the OS certificate store before any request when the profile opts in.
+  // Node reads --use-system-ca at startup, so this re-execs once. Commands that
+  // make no request skip it, so help and config edit still work on old Node.
+  if (needsNetwork(args)) {
+    const profile = await loadProfile(profileName);
+    const systemCaEnabled = systemCaEnabledFor(profile);
+    if (refuseUnsupportedSystemCa(systemCaEnabled, profile.path)) return;
+    if (systemCaEnabled && (await ensureSystemCa())) return;
+  }
+
   const launchTui =
     !command &&
     process.stdin.isTTY === true &&

package/bin/feedback.js

@@ -12,6 +12,7 @@ import { createInterface } from 'node:readline/promises';
 import { getApiKey, getPlatformUrl } from './auth.js';
 import { imageContentType, readClipboardImage } from './clipboard-image.js';
 import { c } from './colors.js';
+import { proxyAwareFetch } from './network.js';
 import { DEFAULT_PROFILE } from './profiles.js';
 
 export const FEEDBACK_API_PATH = '/api/cli/feedback';
@@ -111,7 +112,7 @@ export async function submitFeedback(
   apiKey,
   platformUrl,
   payload,
-  fetchImpl = fetch,
+  fetchImpl = proxyAwareFetch,
 ) {
   const res = await fetchImpl(
     `${platformUrl.replace(/\/$/, '')}${FEEDBACK_API_PATH}`,

package/bin/models.js

@@ -7,6 +7,8 @@
  * when the gateway is offline or returns nothing usable.
  */
 
+import { proxyAwareFetch } from './network.js';
+
 const MODEL_ID_PATTERN = /^[-A-Za-z0-9._:/+]+$/;
 export const DEFAULT_MODEL_FETCH_TIMEOUT_MS = 3000;
 export const AVAILABLE_MODELS_PATH = '/v1/models/available';
@@ -72,7 +74,7 @@ export async function fetchGatewayModels({
   baseUrl,
   apiKey,
   path = PUBLIC_MODELS_PATH,
-  fetchImpl = globalThis.fetch,
+  fetchImpl = proxyAwareFetch,
   timeoutMs = DEFAULT_MODEL_FETCH_TIMEOUT_MS,
   signal,
 }) {
@@ -176,7 +178,7 @@ export async function resolveModelCatalog({
   selectedModel,
   fallbackModels = [],
   pinnedModels,
-  fetchImpl = globalThis.fetch,
+  fetchImpl = proxyAwareFetch,
   timeoutMs = DEFAULT_MODEL_FETCH_TIMEOUT_MS,
   signal,
 }) {