supbuddy 3.1.1 → 3.1.2

package/dist/daemon/worker.cjs

@@ -28948,12 +28948,11 @@ function parseKeychainSha1Fingerprints(securityOutput) {
 async function getCurrentCaddyRootSha1() {
   const caPath = await getCaddyCAPath();
   if (!caPath) return null;
-  const pem = await fs.readFile(caPath, "utf-8");
-  const { X509Certificate } = await __vitePreload(async () => {
-    const { X509Certificate: X509Certificate2 } = await import("crypto");
-    return { X509Certificate: X509Certificate2 };
-  }, false ? __VITE_PRELOAD__ : void 0);
-  return new X509Certificate(pem).fingerprint.replaceAll(":", "").toUpperCase();
+  try {
+    return await sha1OfPem(await fs.readFile(caPath, "utf-8"));
+  } catch {
+    return null;
+  }
 }
 function buildDarwinCaInstallCommand(caPath, staleFingerprints) {
   return [
@@ -28976,6 +28975,12 @@ async function installCaddyCA(elevate = defaultElevate$1) {
     if (platform === "darwin") {
       const existing = await readSystemKeychainCaddyFingerprints();
       const current = await getCurrentCaddyRootSha1();
+      if (!current) {
+        return {
+          success: false,
+          error: `Could not read the current CA root at ${caPath}, so Supbuddy cannot tell which keychain certificates are stale. Nothing was changed. Restart the proxy to regenerate the root, then try again.`
+        };
+      }
       const stale = existing.filter((fp) => fp !== current);
       if (stale.length === 0 && await isCurrentRootTrustedDarwin(caPath, current, existing)) {
         return { success: true, message: "CA already trusted — nothing to do." };
@@ -30028,7 +30033,10 @@ function getEnablePortForwardingCommand(_httpPort, _httpsPort, _lanSharing, _cur
       `cp "${tmpPfConfPath}" /etc/pf.conf`
     );
   }
-  cmds.push("{ pfctl -e 2>/dev/null || true; }", "pfctl -f /etc/pf.conf");
+  cmds.push(
+    "{ pfctl -e 2>/dev/null || true; }",
+    buildPfLoadCommand({ restoreBackupOnFailure: !!tmpPfConfPath })
+  );
   return cmds.join(" && ");
 }
 function getDisablePortForwardingCommand() {
@@ -30045,6 +30053,14 @@ if [ -f /etc/pf.conf ]; then
 fi
   `.trim();
 }
+function buildPfLoadCommand(opts) {
+  const pfConf = opts.pfConfPath ?? "/etc/pf.conf";
+  const backup = opts.backupPath ?? "/etc/pf.conf.supbuddy-backup";
+  const pfctl = opts.pfctl ?? "pfctl";
+  const load2 = `${pfctl} -f "${pfConf}"`;
+  if (!opts.restoreBackupOnFailure) return load2;
+  return `{ ${load2} || { [ -f "${backup}" ] && cp "${backup}" "${pfConf}" && ${load2}; false; }; }`;
+}
 function getDefaultExportFromCjs(x) {
   return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x["default"] : x;
 }
@@ -50896,23 +50912,16 @@ async function requestPrivilegedBatch(command, prompt, tmpFiles = []) {
 }
 let guiProxyAutoStartDone = false;
 let lastPrivilegedError = null;
+const TRANSIENT_PRIVILEGED_FAILURE = /TTY|ASKPASS|detached/i;
 function shouldRetryPrivilegedSetup(proxyState, privilegedError) {
   if (!proxyState.needsPrivilegedRepair) return false;
-  return /TTY|ASKPASS/i.test(privilegedError || "");
+  return TRANSIENT_PRIVILEGED_FAILURE.test(privilegedError || "");
 }
 function isPfRulesetRejection(err, stderr) {
   const status = err?.status;
   if (status == null || status === 0 || status === 127) return false;
   return stderr.trim().length > 0;
 }
-function buildPfLoadCommand(opts) {
-  const pfConf = opts.pfConfPath ?? "/etc/pf.conf";
-  const backup = opts.backupPath ?? "/etc/pf.conf.supbuddy-backup";
-  const pfctl = opts.pfctl ?? "pfctl";
-  const load2 = `${pfctl} -f "${pfConf}"`;
-  if (!opts.restoreBackupOnFailure) return load2;
-  return `{ ${load2} || { [ -f "${backup}" ] && cp "${backup}" "${pfConf}" && ${load2}; false; }; }`;
-}
 async function maybeAutoStartProxyForGui() {
   if (guiProxyAutoStartDone) return;
   const store2 = useStore.getState();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supbuddy",
-  "version": "3.1.1",
+  "version": "3.1.2",
   "description": "Run multiple Supabase projects at once on custom local domains with HTTPS. A headless CLI and daemon (proxy, DNS, Supabase/Compose lifecycle, MCP) for macOS and Linux.",
   "keywords": [
     "supabase",