Upgrade to SpacesOps v1.0.1 and fix v1.0.1:1 startup on StartOS.

Bump the image to spacesops/spacesops:v1.0.1, always inject NODE_EXTRA_CA_CERTS from sdk.getSslCertificate so the upstream entrypoint no longer crashes on unset _SCRIPT_DIR, and document the same-host HTTPS behavior in the README.

Co-authored-by: Cursor <cursoragent@cursor.com>

startos/main.ts

@@ -1,3 +1,4 @@
+import { mkdir, writeFile } from 'fs/promises'
 import { storeJson } from './fileModels/storeJson'
 import { i18n } from './i18n'
 import { sdk } from './sdk'
@@ -8,6 +9,10 @@ import {
   SPACED_RPC_URL,
   SPACED_WALLETLOAD_NAME,
   spacesDataDir,
+  startOsHostnameFromUrl,
+  nodeExtraCaCertContainerPath,
+  nodeExtraCaCertVolumeSubpath,
+  SPACES_PACKAGE_ID,
   uiPort,
 } from './utils'
 
@@ -106,6 +111,23 @@ export const main = sdk.setupMain(async ({ effects }) => {
   if (store.subsUser) env.SUBS_RPC_USER = store.subsUser
   if (store.subsPassword) env.SUBS_RPC_PASSWORD = store.subsPassword
 
+  // v1.0.1's entrypoint sources setup-spacesops-env.sh with set -u. That file
+  // exports NODE_EXTRA_CA_CERTS using ${_SCRIPT_DIR}, but _SCRIPT_DIR is set on
+  // a separate non-export line the entrypoint never evals — startup crashes
+  // unless NODE_EXTRA_CA_CERTS is already set. Fetch the StartOS root CA for
+  // outbound *.startos HTTPS (SUBS_URI host when configured, else Spaces).
+  const caHostname =
+    (store.subsUrl && startOsHostnameFromUrl(store.subsUrl)) ||
+    `${SPACES_PACKAGE_ID}.startos`
+  const certs = await sdk.getSslCertificate(effects, [caHostname]).const()
+  const [rootCa] = certs.slice(-1)
+  await mkdir(sdk.volumes.main.subpath('.startos'), { recursive: true })
+  await writeFile(
+    sdk.volumes.main.subpath(nodeExtraCaCertVolumeSubpath),
+    rootCa,
+  )
+  env.NODE_EXTRA_CA_CERTS = nodeExtraCaCertContainerPath
+
   return sdk.Daemons.of(effects).addDaemon('spacesops', {
     subcontainer: sub,
     exec: {

startos/manifest/index.ts

@@ -14,7 +14,7 @@ export const manifest = setupManifest({
   volumes: ['main'],
   images: {
     spacesops: {
-      source: { dockerTag: 'spacesops/spacesops:v1.0.0' },
+      source: { dockerTag: 'spacesops/spacesops:v1.0.1' },
       arch: ['x86_64', 'aarch64'],
     },
   },

startos/utils.ts

@@ -20,13 +20,34 @@ export const SPACES_PACKAGE_ID = 'spaces'
 export const SPACED_RPC_URL = 'http://spaces.startos:7225'
 export const SPACED_WALLETLOAD_NAME = 'main'
 
-// Admin Basic Auth is baked into the v1.0.0 image with NO env override. It
+// Admin Basic Auth is baked into the v1.0.1 image with NO env override. It
 // cannot be changed without rebuilding the image. Surfaced (with a warning)
 // via the "Show Admin Credentials" action.
 export const ADMIN_USER = 'admin'
 export const ADMIN_PASSWORD = 'Whatever!'
 
-// Optional-config defaults (see the "Configure Platform" action).
+// Where StartOS writes the StartOS root CA for outbound *.startos HTTPS (see
+// main.ts). Always injected as NODE_EXTRA_CA_CERTS — required on v1.0.1+ where
+// the image entrypoint's setup-spacesops-env.sh references _SCRIPT_DIR without
+// defining it under set -u.
+export const nodeExtraCaCertVolumeSubpath = '.startos/startos-root-ca.crt'
+export const nodeExtraCaCertContainerPath = `${dataDir}/.startos/startos-root-ca.crt`
+
+// Legacy aliases (same file path after rename).
+export const subsCaCertVolumeSubpath = nodeExtraCaCertVolumeSubpath
+export const subsCaCertContainerPath = nodeExtraCaCertContainerPath
+
+// Returns the hostname when url targets another StartOS service on this server
+// (e.g. https://spaces.startos:7777), otherwise null.
+export function startOsHostnameFromUrl(url: string): string | null {
+  try {
+    const hostname = new URL(url).hostname
+    return hostname.endsWith('.startos') ? hostname : null
+  } catch {
+    return null
+  }
+}
+
 export const DEFAULT_OPERATOR_RELAY = 'wss://relay.primal.net'
 export const DEFAULT_PLATFORM_MODE = 'prod'
 export const DEFAULT_COINGECKO_TOKEN_COINS = 'bitcoin'

startos/versions/index.ts

@@ -1,7 +1,8 @@
 import { VersionGraph } from '@start9labs/start-sdk'
-import { v_1_0_0_0 } from './v1.0.0.0'
+import { v_1_0_1_0 } from './v1.0.1.0'
+import { v_1_0_1_1 } from './v1.0.1.1'
 
 export const versionGraph = VersionGraph.of({
-  current: v_1_0_0_0,
-  other: [],
+  current: v_1_0_1_1,
+  other: [v_1_0_1_0],
 })

startos/versions/v1.0.0.0.ts

@@ -1,17 +0,0 @@
-import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
-
-export const v_1_0_0_0 = VersionInfo.of({
-  version: '1.0.0:0',
-  releaseNotes: {
-    en_US: `Initial StartOS package for SpacesOps (upstream v1.0.0).
-- Runs the SpacesOps web platform (Express + SQLite) from the prebuilt spacesops/spacesops:v1.0.0 image on x86_64 and aarch64.
-- Depends on the Spaces service and auto-connects to its spaced JSON-RPC at spaces.startos:7225 by reading the Spaces RPC credentials from the mounted Spaces volume.
-- Generates a Nostr operator keypair and a strong session secret on first install. "Show Operator Credentials" and "Import Operator Key" actions manage the keypair.
-- "Show Admin Credentials" surfaces the fixed, well-known admin login baked into the image, with a warning to keep the service private.
-- "Configure Platform" optionally sets the Nostr relay, theme mode, CoinGecko pricing, and SUBS backend.`,
-  },
-  migrations: {
-    up: async ({ effects }) => {},
-    down: IMPOSSIBLE,
-  },
-})

startos/versions/v1.0.1.0.ts

@@ -0,0 +1,14 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+export const v_1_0_1_0 = VersionInfo.of({
+  version: '1.0.1:0',
+  releaseNotes: {
+    en_US: `Upstream upgrade to SpacesOps v1.0.1.
+- Bumps the image to spacesops/spacesops:v1.0.1 on x86_64 and aarch64.
+- No StartOS-side configuration, action, or migration changes; existing operator keypair, session secret, and Configure-Platform settings are preserved.`,
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: IMPOSSIBLE,
+  },
+})

startos/versions/v1.0.1.1.ts

@@ -0,0 +1,13 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+export const v_1_0_1_1 = VersionInfo.of({
+  version: '1.0.1:1',
+  releaseNotes: {
+    en_US: `- Always sets NODE_EXTRA_CA_CERTS before the v1.0.1 image entrypoint runs, fetching the StartOS root CA via sdk.getSslCertificate (SUBS *.startos hostname when configured, otherwise spaces.startos). Fixes startup crash where setup-spacesops-env.sh references unset _SCRIPT_DIR under set -u.
+- Enables outbound HTTPS to same-host StartOS services from SpacesOps.`,
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: IMPOSSIBLE,
+  },
+})