Upgrade to SpacesOps v1.0.1 and fix v1.0.1:1 startup on StartOS.

Bump the image to spacesops/spacesops:v1.0.1, always inject NODE_EXTRA_CA_CERTS from sdk.getSslCertificate so the upstream entrypoint no longer crashes on unset _SCRIPT_DIR, and document the same-host HTTPS behavior in the README.

Co-authored-by: Cursor <cursoragent@cursor.com>

startos/main.ts

@@ -1,3 +1,4 @@
+import { mkdir, writeFile } from 'fs/promises'
 import { storeJson } from './fileModels/storeJson'
 import { i18n } from './i18n'
 import { sdk } from './sdk'
@@ -8,6 +9,10 @@ import {
   SPACED_RPC_URL,
   SPACED_WALLETLOAD_NAME,
   spacesDataDir,
+  startOsHostnameFromUrl,
+  nodeExtraCaCertContainerPath,
+  nodeExtraCaCertVolumeSubpath,
+  SPACES_PACKAGE_ID,
   uiPort,
 } from './utils'
 
@@ -106,6 +111,23 @@ export const main = sdk.setupMain(async ({ effects }) => {
   if (store.subsUser) env.SUBS_RPC_USER = store.subsUser
   if (store.subsPassword) env.SUBS_RPC_PASSWORD = store.subsPassword
 
+  // v1.0.1's entrypoint sources setup-spacesops-env.sh with set -u. That file
+  // exports NODE_EXTRA_CA_CERTS using ${_SCRIPT_DIR}, but _SCRIPT_DIR is set on
+  // a separate non-export line the entrypoint never evals — startup crashes
+  // unless NODE_EXTRA_CA_CERTS is already set. Fetch the StartOS root CA for
+  // outbound *.startos HTTPS (SUBS_URI host when configured, else Spaces).
+  const caHostname =
+    (store.subsUrl && startOsHostnameFromUrl(store.subsUrl)) ||
+    `${SPACES_PACKAGE_ID}.startos`
+  const certs = await sdk.getSslCertificate(effects, [caHostname]).const()
+  const [rootCa] = certs.slice(-1)
+  await mkdir(sdk.volumes.main.subpath('.startos'), { recursive: true })
+  await writeFile(
+    sdk.volumes.main.subpath(nodeExtraCaCertVolumeSubpath),
+    rootCa,
+  )
+  env.NODE_EXTRA_CA_CERTS = nodeExtraCaCertContainerPath
+
   return sdk.Daemons.of(effects).addDaemon('spacesops', {
     subcontainer: sub,
     exec: {