nx_https_get_cli.nx

nx_https_get_cli.nx -- the OPERATOR/MCP-facing sovereign HTTPS fetch (replaces WebFetch + curl). nx_https_get <url> [connect-host:port] <url> fetched over OUR TLS 1.3 + Mozilla trust store; raw response (status+headers+body) to stdout. [connect-host:port] OPTIONAL connect override (curl --connect-to): open the TCP+TLS to THIS endpoint while keeping SNI + Host + cert-name = the URL's host. Lets us fetch our OWN vhosts straight from the sovereign edge (sites.elf 127.0.0.1:8443), bypassing the DSM nginx that also squats :443 for unclaimed SNIs (andelinwest.com internally hit DSM's self-signed cert). The tools daemon fork-execs this on a GREEN tool_allowlist.conf row, cap-gated to nx_https_get, and returns stdout as the tools/call result. Uses PRODUCTION entropy (nx_csprng_fill from /dev/urandom). license_tier: ORIGINAL