syntaqxA cloud session's headless browser trusts the sandbox proxy with certificate checks on (#55): on flagon-io/session-lab #2 the session's Chromium refused every https page until it set ignore_https_errors, because Chromium reads its own NSS store (~/.pki/nssdb), not the system store that curl, git and the g1t CLI trust. The system prompt now gives BROWSER_TRUST to run once before a headless browser opens an https page: it installs certutil when missing, creates the NSS store, and adds every certificate of /etc/ssl/certs/ca-certificates.crt (the proxy's among them), again safely; and it says never to turn certificate checks off instead. The prompt is in the agent's config hash, so each workspace's agent is updated on its next session. The sessions guide says so. Checked: cargo test -p g1t-integrations (76); in debian:bookworm, headless Chromium refused a page served under a private CA the system store trusts, loaded it after the command, and the command ran a second time cleanly.960f565History
