@cotal-ai/cli 0.153.1 → 0.154.0

package/dist/commands/status.js

@@ -2,7 +2,7 @@ import { accessSync, constants, existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { CotalEndpoint, agentFilePath, dialerFor, EpEnvelopeError, formatAge, isReachable, mintCreds, mintLifecycleUid, resolveService, realDirNoSymlink, invokeRepairingSplit, standaloneConnectOpts, newIdentity, idFromCreds, principalKey, DEV_OWNER, unansweredRequest, resolveAuthProvider, personaDir, presenceText, } from "@cotal-ai/core";
-import { stoppedLoopbackListener, accountInventory, assessMaintenanceClaim, authDir, isCommandFailure, readMaintenanceJournal, recordsElsewhereError, recordsElsewhereText, restoreRolledBackRuns, targetErrorSpace, brokerAddressForDisplay, canonicalRoot, CLI_USER_ACTOR, codeSpan, CommandFailure, deliveryCredsKey, DELIVERY_PIDFILE, extensionsDir, findCotalRoot, folderSpaceOverSelection, meshesForRoot, resolveReadsLiveness, stoppedStack, unsettledStackOperation, withdrawOperationNote, hasUserAuthState, homeCotalDir, cachedPreferences, loadLaunchPersonaFile, resolvePreference, isMeshRegistryError, isWorkspaceTargetError, jsonFlag, loadManagerInstanceIdentity, loadSoleSpaceAuth, localProcessPath, localProcessVisible, MANAGER_PIDFILE, oneLine, PREFERENCE_KEYS, parsePid, plainFlag, preflightTarget, presentationOf, principalFromBearer, probeLiveness, probeWebReadiness, readCurrent, readMeshRegistry, readPidfile, preparedRecordSkipped, readPreparedSpaces, readRenewalRecord, renderWorkspaceError, resolveMeshTarget, serverFlag, spaceFlag, userAuthStateDir, WEB_PIDFILE, WEB_READINESS_HEADER, workspaceSecretStore, writeResult, workspaceErrorParts, preferencesPath, preferencesFolderWarning, cotalDirLink, movedProject, spaceStreamsAbsent, spaceStreamsExpected, resolveControlTarget, } from "@cotal-ai/workspace";
+import { stoppedLoopbackListener, accountInventory, assessMaintenanceClaim, authDir, isCommandFailure, readMaintenanceJournal, recordsElsewhereError, recordsElsewhereText, restoreRolledBackRuns, targetErrorSpace, brokerAddressForDisplay, brokerCheck, canonicalRoot, CLI_USER_ACTOR, codeSpan, CommandFailure, deliveryCredsKey, DELIVERY_PIDFILE, extensionsDir, findCotalRoot, folderSpaceOverSelection, meshesForRoot, resolveReadsLiveness, stoppedStack, unsettledStackOperation, withdrawOperationNote, hasUserAuthState, homeCotalDir, cachedPreferences, loadLaunchPersonaFile, resolvePreference, isMeshRegistryError, isWorkspaceTargetError, jsonFlag, loadManagerInstanceIdentity, loadSoleSpaceAuth, localProcessPath, localProcessVisible, MANAGER_PIDFILE, oneLine, PREFERENCE_KEYS, parsePid, plainFlag, preflightTarget, presentationOf, principalFromBearer, probeLiveness, probeWebReadiness, readCurrent, readMeshRegistry, readPidfile, preparedRecordSkipped, readPreparedSpaces, readRenewalRecord, renderWorkspaceError, resolveMeshTarget, serverFlag, spaceFlag, userAuthStateDir, WEB_PIDFILE, WEB_READINESS_HEADER, workspaceSecretStore, writeResult, workspaceErrorParts, preferencesPath, preferencesFolderWarning, cotalDirLink, movedProject, spaceStreamsAbsent, spaceStreamsExpected, resolveControlTarget, } from "@cotal-ai/workspace";
 import { localProcessSurface } from "../ext-loader.js";
 import { cliVersion, cliProvenance, readExtensionVersions } from "../lib/version.js";
 import { agentSkillsSkew } from "../lib/agent-skills.js";
@@ -162,10 +162,11 @@ export async function status(args) {
     // THE RESPONDER AXIS (#1576), read ONCE and threaded into the rows that would otherwise claim
     // health they never checked. It is read before the folder section because that section renders
     // the delivery process row, and a live pid means nothing without it.
-    const responder = await readResponderAxis(selected);
+    const preflight = selected.ok && selected.target.mode !== "user" ? await preflightTarget(selected.target) : undefined;
+    const responder = await readResponderAxis(selected, preflight);
     const folder = blocked ? unreadFolder(root, blocked) : await readFolder(root, selected, values, responder.state, gaps, hints);
-    const meshes = await readMeshes(cwd, selected, Boolean(values.all), gaps, offline);
-    const target = await readSelected(selected, responder, folder, gaps, hints);
+    const meshes = await readMeshes(cwd, selected, Boolean(values.all), gaps, offline, preflight);
+    const target = await readSelected(selected, responder, folder, gaps, hints, preflight);
     // The note under the heading sends here for this folder's own stack cut off with no recorded
     // outcome under another selection. A blocked one is named with its block under `This folder's
     // space` and its step first in Next, so that note is left out here, with its --json warning. One
@@ -476,7 +477,7 @@ async function expectedDeliveryHolder(target) {
  *
  *  `leased` says whether the read found a delivery lease record. An open mesh runs no delivery
  *  daemon, so there a missing lease is the normal state rather than an unbound responder. */
-async function readResponderAxis(selected) {
+async function readResponderAxis(selected, preflight) {
     let leased = false;
     if (!selected.ok)
         return { state: "unknown", leased };
@@ -484,8 +485,7 @@ async function readResponderAxis(selected) {
     if (target.mode === "user")
         return { state: "unknown", leased };
     try {
-        const preflight = await preflightTarget(target);
-        if (!preflight.ok)
+        if (!preflight?.ok)
             return { state: "unknown", leased };
         const id = newIdentity();
         const creds = target.auth ? await mintCreds(target.auth, id, "observer") : undefined;
@@ -929,7 +929,7 @@ function deliveryDetail(live, responder) {
  *  with its own recorded TLS requirement. A bare TCP/INFO probe would green-light a plaintext broker
  *  that has substituted for a TLS-required mesh — the FAIL1 attack — so a list that only asks "is
  *  anything listening" cannot report on the one property the record claims. */
-async function readMeshes(cwd, selected, all, gaps, offline) {
+async function readMeshes(cwd, selected, all, gaps, offline, preflight) {
     // A registry file that cannot be read is named, and the readable records are still listed and
     // checked. Only an absent directory or pointer is an empty registry or no current mesh.
     const unreadable = [];
@@ -971,6 +971,18 @@ async function readMeshes(cwd, selected, all, gaps, offline) {
     const chosen = selected.ok ? selected.target : undefined;
     // A `--server` that names another address is the only broker dialed for the selected space.
     const checked = (m) => all || (m.space === chosen?.space && m.server === chosen.server);
+    const check = async (m) => {
+        if (!checked(m))
+            return "not-checked";
+        if (preflight && m.space === chosen?.space && m.server === chosen.server) {
+            if (preflight.ok)
+                return "reachable";
+            if (preflight.kind === "slow-link" || preflight.kind === "broker-stopped" || preflight.kind === "unreachable")
+                return preflight.kind;
+            return preflight.kind === "tls-trust" || preflight.kind === "tls-unsupported" ? "unreachable" : "reachable";
+        }
+        return brokerCheck(m.server, m.tlsRequired);
+    };
     const items = await Promise.all(entries.map(async (m) => ({
         space: m.space,
         server: displayStatusBroker(m.server, m.space, gaps),
@@ -981,7 +993,7 @@ async function readMeshes(cwd, selected, all, gaps, offline) {
         eventsRequired: m.policy?.events === "required",
         modeChecked: m.unchecked !== true,
         current: m.space === current,
-        check: checked(m) ? ((await isReachable(m.server, m.tlsRequired ? { tls: true } : {})) ? "reachable" : "unreachable") : "not-checked",
+        check: await check(m),
         catalog: m.origin === "catalog" ? { name: m.catalogName && m.catalogName !== m.space ? m.catalogName : null, fetchedAt: m.catalogFetchedAt ?? null, error: m.catalogError ?? null } : null,
     })));
     // The prepared spaces folder, or a record in it, that cannot be read is named the same way.
@@ -1053,7 +1065,7 @@ function rootStoreProblem(root) {
         return undefined;
     }
 }
-async function readSelected(selected, responder, folder, gaps, hints) {
+async function readSelected(selected, responder, folder, gaps, hints, preflight) {
     const cmd = displayCmd();
     if (!selected.ok) {
         const e = selected.error;
@@ -1184,7 +1196,8 @@ async function readSelected(selected, responder, folder, gaps, hints) {
         hints.push(moved.remedy);
         return { resolved: false, code: "moved-folder", message: moved.message };
     }
-    const preflight = await preflightTarget(target);
+    if (preflight === undefined)
+        throw new Error("status: selected non-user target has no preflight observation");
     if (!preflight.ok) {
         // A `--server` address that is not the one recorded for the space says nothing about whether its
         // stack runs, so Next names that address as the refusal of other commands does. A stopped stack
@@ -1409,7 +1422,7 @@ function folderSection(f, selected) {
     return { title: "This Folder", blocks: [{ kind: "fields", rows }] };
 }
 function meshesSections(m) {
-    const check = { reachable: cell("reachable", "ok"), unreachable: cell("down", "failed"), "not-checked": cell("not checked", "hint") };
+    const check = { reachable: cell("reachable", "ok"), unreachable: cell("down", "failed"), "slow-link": cell("not answering", "failed"), "broker-stopped": cell("broker process is stopped", "failed"), "not-checked": cell("not checked", "hint") };
     const blocks = [];
     if (!m.items.length && !m.unreadable.length)
         blocks.push({ kind: "lines", lines: [cell("none", "hint")] });
@@ -1618,7 +1631,7 @@ function connectionCell(s) {
         return stateCell("reachable", "ok");
     const states = {
         unreachable: "unreachable",
-        "slow-link": "connection timed out",
+        "slow-link": "not answering",
         "broker-stopped": `broker process ${s.brokerPid} is stopped`,
         "tls-trust": "TLS could not be verified",
         "tls-unsupported": "listener does not offer required TLS",
@@ -1655,7 +1668,7 @@ function spaceStateCell(r, entry) {
         return connectionCell(r.selected);
     if (entry.check === "not-checked")
         return "";
-    return stateCell(entry.check === "reachable" ? "reachable" : "unreachable", entry.check === "reachable" ? "ok" : "failed");
+    return stateCell(entry.check === "slow-link" ? "not answering" : entry.check === "broker-stopped" ? "broker process is stopped" : entry.check, entry.check === "reachable" ? "ok" : "failed");
 }
 /**
  * The spaces this machine knows: the selected one first with its connection state, then one line