@debugg-ai/debugg-ai-mcp 4.4.1 → 6.0.0

package/dist/handlers/triggerCrawlHandler.js

@@ -11,6 +11,7 @@
  * and reports back what happened.
  */
 import { config } from '../config/index.js';
+import { toUserFacingOutcome, noVerdictReason } from '../services/verdictAdapter.js';
 import { Logger } from '../utils/logger.js';
 import { handleExternalServiceError } from '../utils/errors.js';
 import { DebuggAIServerClient } from '../services/index.js';
@@ -85,14 +86,14 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
     try {
         // --- Tunnel: reuse existing or provision a fresh one ---
         if (ctx.isLocalhost) {
-            // Bead 1om: pre-flight local port probe BEFORE provision/ngrok/backend.
+            // Bead 1om: pre-flight local port probe BEFORE provision/tunnel/backend.
             const localPort = extractLocalhostPort(ctx.originalUrl);
             if (typeof localPort === 'number') {
                 const probe = await probeLocalPort(localPort);
                 if (!probe.reachable) {
                     const payload = {
                         error: 'LocalServerUnreachable',
-                        message: `No server listening on 127.0.0.1:${localPort}. Start your dev server on that port before running trigger_crawl. Probe result: ${probe.code} (${probe.detail ?? 'no detail'}).`,
+                        message: `No server listening on 127.0.0.1:${localPort}.`,
                         detail: { port: localPort, probeCode: probe.code, probeDetail: probe.detail, elapsedMs: probe.elapsedMs },
                     };
                     logger.warn(`Pre-flight port probe failed for ${ctx.originalUrl}: ${probe.code} in ${probe.elapsedMs}ms`);
@@ -119,9 +120,7 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
                     catch (provisionError) {
                         const msg = provisionError instanceof Error ? provisionError.message : String(provisionError);
                         const diag = provisionError instanceof TunnelProvisionError ? ` ${provisionError.diagnosticSuffix()}` : '';
-                        throw new Error(`Failed to provision tunnel for ${ctx.originalUrl}. ` +
-                            `The remote browser needs a secure tunnel to reach your local dev server. ` +
-                            `(Detail: ${msg})${diag}`);
+                        throw new Error(`Failed to provision tunnel for ${ctx.originalUrl}: ${msg}${diag}`);
                     }
                     provision = tunnel;
                     ctx = await ensureTunnel(ctx, tunnel.tunnelKey, tunnel.tunnelId, tunnel.keyId, () => client.tunnels.revoke(tunnel), tunnel);
@@ -151,15 +150,15 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
                     if (!health.healthy) {
                         const payload = {
                             error: 'TunnelTrafficBlocked',
-                            message: `Tunnel was established but traffic isn't reaching the dev server. ${health.detail ?? ''} Common causes: dev server binds to 0.0.0.0 or ::1 but not 127.0.0.1; dev server crashed; firewall.`,
+                            message: `Tunnel established; a request through it to 127.0.0.1:${extractLocalhostPort(ctx.originalUrl)} failed: ${health.detail ?? health.code}.`,
                             detail: {
                                 code: health.code,
                                 status: health.status,
-                                ngrokErrorCode: health.ngrokErrorCode,
+                                tunnelErrorCode: health.tunnelErrorCode,
                                 elapsedMs: health.elapsedMs,
                             },
                         };
-                        logger.warn(`Tunnel health probe failed for ${ctx.targetUrl}: ${health.code} ${health.ngrokErrorCode ?? ''} in ${health.elapsedMs}ms`);
+                        logger.warn(`Tunnel health probe failed for ${ctx.targetUrl}: ${health.code} ${health.tunnelErrorCode ?? ''} in ${health.elapsedMs}ms`);
                         // Evict ONLY on a code proving the endpoint is gone; every other failure
                         // keeps the tunnel we are already paying for, because a teardown+
                         // re-provision costs two billed hours and this probe cannot tell a dead
@@ -186,9 +185,7 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
             return client.workflows.findTemplateBySlug(templateSlug);
         });
         if (!templateUuid) {
-            throw new Error(`Crawl Workflow Template not found (slug "${templateSlug}"). ` +
-                `Ensure the backend has that template seeded and accessible ` +
-                `(GET /api/v1/workflows/?slug=${templateSlug}).`);
+            throw new Error(`Crawl workflow template not found (slug "${templateSlug}").`);
         }
         // --- Build contextData + env ---
         const contextData = {
@@ -293,13 +290,29 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
             targetUrl: ctx.originalUrl,
             durationMs: finalExecution.durationMs ?? duration,
         };
-        const outcome = finalExecution.state?.outcome;
-        if (outcome !== undefined && outcome !== null)
-            responsePayload.outcome = outcome;
+        // Map onto the user-facing enum instead of relaying raw. This path never
+        // went through adaptVerdict, so it would otherwise emit whatever the
+        // backend sent — including retired non-answers like 'inconclusive'.
+        const rawOutcome = finalExecution.state?.outcome;
+        if (finalExecution.verdict?.skipped === true && !finalExecution.verdict.outcome) {
+            // platform-98fv.16: the run never attempted a test — no verdict, the
+            // backend's recorded reason verbatim. Never the raw run outcome.
+            responsePayload.outcome = null;
+            responsePayload.skipped = true;
+            const skipReason = finalExecution.verdict.reason;
+            if (typeof skipReason === 'string' && skipReason.trim() !== '')
+                responsePayload.skipReason = skipReason;
+        }
+        else if (rawOutcome !== undefined && rawOutcome !== null) {
+            responsePayload.outcome = toUserFacingOutcome(rawOutcome);
+            if (responsePayload.outcome === 'error' && !finalExecution.errorMessage) {
+                responsePayload.reason = noVerdictReason(rawOutcome);
+            }
+        }
         if (finalExecution.errorMessage)
             responsePayload.errorMessage = finalExecution.errorMessage;
-        if (finalExecution.errorInfo?.failedNodeId)
-            responsePayload.failedNode = finalExecution.errorInfo.failedNodeId;
+        if (finalExecution.errorInfo)
+            responsePayload.errorInfo = finalExecution.errorInfo;
         if (executeResponse.resolvedEnvironmentId)
             responsePayload.resolvedEnvironmentId = executeResponse.resolvedEnvironmentId;
         if (executeResponse.resolvedCredentialId)
@@ -310,34 +323,29 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
         if (finalExecution.browserSession) {
             responsePayload.browserSession = finalExecution.browserSession;
         }
-        // Extract crawl metrics from surfer.crawl node (absent in older graph shapes)
-        const crawlNode = nodes.find(n => n.nodeType === 'surfer.crawl');
-        if (crawlNode?.outputData) {
-            const d = crawlNode.outputData;
-            responsePayload.crawlSummary = {
-                pagesDiscovered: d.pagesDiscovered,
-                actionsExecuted: d.actionsExecuted,
-                stepsTaken: d.stepsTaken,
-                transitionsRecorded: d.transitionsRecorded,
-                knowledgeGraphStates: d.knowledgeGraphStates,
-                success: d.success,
-                ...(d.error ? { error: d.error } : {}),
-            };
-        }
-        // Extract KG import result from knowledge_graph.import node (absent in older graph shapes)
-        const kgNode = nodes.find(n => n.nodeType === 'knowledge_graph.import');
-        if (kgNode?.outputData) {
-            const d = kgNode.outputData;
-            responsePayload.knowledgeGraph = {
-                imported: !d.skipped,
-                skipped: d.skipped ?? false,
-                reason: d.reason ?? '',
-                edgesImported: d.edgesImported ?? 0,
-                statesImported: d.statesImported ?? 0,
-                knowledgeGraphId: d.knowledgeGraphId ?? '',
-                ...(Array.isArray(d.importErrors) && d.importErrors.length > 0 ? { importErrors: d.importErrors } : {}),
-            };
-        }
+        // Node output, relayed under the backend's own keys. Only the listed keys,
+        // and only when the node reported them: a missing count is absent, never a
+        // fabricated 0 / '' that reads as "the backend said zero".
+        const pick = (src, keys) => {
+            if (!src)
+                return undefined;
+            const out = {};
+            for (const k of keys)
+                if (src[k] !== undefined && src[k] !== null)
+                    out[k] = src[k];
+            return out;
+        };
+        const crawlSummary = pick(nodes.find(n => n.nodeType === 'surfer.crawl')?.outputData, [
+            'pagesDiscovered', 'actionsExecuted', 'stepsTaken', 'transitionsRecorded',
+            'knowledgeGraphStates', 'success', 'error',
+        ]);
+        if (crawlSummary)
+            responsePayload.crawlSummary = crawlSummary;
+        const knowledgeGraph = pick(nodes.find(n => n.nodeType === 'knowledge_graph.import')?.outputData, [
+            'skipped', 'reason', 'edgesImported', 'statesImported', 'knowledgeGraphId', 'importErrors',
+        ]);
+        if (knowledgeGraph)
+            responsePayload.knowledgeGraph = knowledgeGraph;
         logger.toolComplete('trigger_crawl', duration);
         // Bead 0bq: final progress is emitted INSIDE pollExecution's onUpdate when
         // terminal status is detected. Emitting it here would race the response

package/dist/handlers/updateEnvironmentHandler.js

@@ -134,10 +134,10 @@ export async function updateEnvironmentHandler(input, _context) {
         if (warnings.length > 0)
             payload.credentialWarnings = warnings;
         if (input.authorizedCredentialHosts !== undefined) {
-            const hostsWarning = checkAuthorizedCredentialHostsEcho(input.authorizedCredentialHosts, environment?.authorizedCredentialHosts, 'update');
+            const hostsWarning = checkAuthorizedCredentialHostsEcho(input.authorizedCredentialHosts, environment?.authorizedCredentialHosts);
             if (hostsWarning) {
                 payload.authorizedCredentialHostsWarning = hostsWarning;
-                logger.warn(`update_environment: ${hostsWarning.message}`);
+                logger.warn(`update_environment: authorizedCredentialHosts not persisted`, hostsWarning);
             }
         }
         logger.toolComplete('update_environment', Date.now() - start);

package/dist/index.js

@@ -271,7 +271,7 @@ function safeLog(level, message, meta) {
  */
 async function gracefulShutdown(signal) {
     safeLog('info', `Received ${signal}, shutting down gracefully`);
-    const { tunnelManager } = await import('./services/ngrok/tunnelManager.js');
+    const { tunnelManager } = await import('./services/tunnel/tunnelManager.js');
     await tunnelManager.stopAllTunnels().catch((err) => safeLog('warn', 'stopAllTunnels failed during shutdown', { error: String(err) }));
     await Telemetry.shutdown();
     process.exit(0);

package/dist/services/caddy/caddyProxy.js

@@ -83,8 +83,9 @@ export function isDockerEnv() {
 // @radically-straightforward/caddy is a dependency (package.json's "caddy"
 // field pins the exact version — see its postinstall) that downloads Caddy
 // from the project's own GitHub releases and drops it at
-// node_modules/.bin/caddy(.exe). Same pattern this repo already uses for the
-// ngrok binary (the "ngrok" npm package's own postinstall). Pinned rather
+// node_modules/.bin/caddy(.exe). It is now the ONLY binary this package pulls
+// down at install time — the ngrok package, whose postinstall fetched the ngrok
+// agent the same way, is gone. Pinned rather
 // than "latest" deliberately: a real config incompatibility with a Caddy
 // version (--adapter json rejected by 2.11.3) was found and fixed during
 // development of this file — "latest" silently shipping a breaking change
@@ -273,7 +274,7 @@ export function buildPatchBody(target, inDocker) {
         upstreams: [{ dial }],
     };
     if (isHttpsLocal) {
-        // Local self-signed certs — doesn't touch the public leg's real ngrok TLS.
+        // Local self-signed certs — doesn't touch the public leg's real TLS.
         body.transport = { protocol: 'http', tls: { insecure_skip_verify: true } };
     }
     return body;
@@ -370,7 +371,7 @@ export class CaddyProxyManager {
             }
             // Network-level failure against a previously-healthy admin port —
             // the process is presumed dead. Exactly one respawn-and-retry, then
-            // propagate uncaught — no loop (matches ngrokAgentSession.ts's
+            // propagate uncaught — no loop (matches the transport's
             // onTerminated philosophy: lazy, bounded, next-call-triggered).
             logger.warn(`Caddy admin API unreachable on port ${adminPort} — assuming process died, respawning once: ${err}`);
             this.markDead();
@@ -520,7 +521,7 @@ export class CaddyProxyManager {
      * successfully-bound proxy port (if any); attempt 2 falls back to a fresh
      * one. `CaddyPortReclaimError` means BOTH attempts failed — Caddy is fully
      * down. `onPortChanged` fires on the "succeeded but moved" case, which is
-     * the signal TunnelManager needs to evict the now-orphaned ngrok tunnel.
+     * the signal TunnelManager needs to evict the now-orphaned tunnel.
      */
     async doStart() {
         sweepOrphanedConfigs(this.configDir);
@@ -593,7 +594,7 @@ export class CaddyProxyManager {
         }
     }
     /** Restart policy: lazy, bounded, next-call-triggered — no background
-     *  watchdog (matches ngrokAgentSession.ts's onTerminated philosophy). This
+     *  watchdog (matches the transport's onDead philosophy). This
      *  handler only marks state as dead; it never itself triggers a respawn. */
     installExitHandler(child) {
         child.once('exit', (code, signal) => {

package/dist/services/index.js

@@ -1,3 +1,4 @@
+import { toUserFacingOutcome } from './verdictAdapter.js';
 import { createWorkflowsService } from "./workflows.js";
 import { createTunnelsService } from "./tunnels.js";
 import { AxiosTransport } from "../utils/axiosTransport.js";
@@ -298,7 +299,8 @@ export class DebuggAIServerClient {
         if (!this.tx)
             throw new Error('Client not initialized — call init() first');
         const response = await this.tx.delete(`api/v1/environments/${envUuid}/sessions/`, { params: filters });
-        return { invalidated: response?.invalidated ?? 0 };
+        // absent → null: a count the backend did not report is not a reported 0
+        return { invalidated: response?.invalidated ?? null };
     }
     /**
      * Fetch a single environment by UUID. Throws AxiosError with status 404 if not found.
@@ -473,15 +475,6 @@ export class DebuggAIServerClient {
             isActive: c.isActive,
         };
     }
-    /**
-     * Revoke an ngrok API key by its key ID.
-     * Call this after workflow execution completes to clean up the short-lived key.
-     */
-    async revokeNgrokKey(ngrokKeyId) {
-        if (!this.tx)
-            throw new Error('Client not initialized — call init() first');
-        await this.tx.post('api/v1/ngrok/revoke/', { ngrokKeyId });
-    }
     // ── E2E Suite Management ──────────────────────────────────────────────────
     async createTestSuite(input) {
         if (!this.tx)
@@ -509,8 +502,8 @@ export class DebuggAIServerClient {
                 uuid: s.uuid,
                 name: s.name,
                 description: s.description ?? null,
-                runStatus: s.runStatus ?? s.run_status ?? 'NEVER_RUN',
-                testsCount: s.testsCount ?? s.tests_count ?? 0,
+                runStatus: s.runStatus ?? s.run_status ?? null,
+                testsCount: s.testsCount ?? s.tests_count ?? null,
                 passRate: s.passRate ?? s.pass_rate ?? null,
                 lastRunAt: s.lastRunAt ?? s.last_run_at ?? null,
             })),
@@ -545,7 +538,7 @@ export class DebuggAIServerClient {
             agentTaskDescription: t.agentTaskDescription ?? t.agent_task_description ?? '',
             suite: t.suite ?? input.suiteUuid,
             project: t.project ?? input.projectUuid,
-            runCount: t.runCount ?? t.run_count ?? 0,
+            runCount: t.runCount ?? t.run_count ?? null,
         };
     }
     async updateTestCase(testUuid, patch) {
@@ -581,7 +574,7 @@ export class DebuggAIServerClient {
         const s = await this.tx.post(`api/v1/test-suites/${suiteUuid}/run/`, body);
         return {
             suiteUuid,
-            runStatus: s?.runStatus ?? s?.run_status ?? 'PENDING',
+            runStatus: s?.runStatus ?? s?.run_status ?? null,
             testsTriggered: (s?.tests ?? []).length,
         };
     }
@@ -593,7 +586,7 @@ export class DebuggAIServerClient {
         return {
             uuid: s.uuid,
             name: s.name,
-            runStatus: s.runStatus ?? s.run_status ?? 'NEVER_RUN',
+            runStatus: s.runStatus ?? s.run_status ?? null,
             testsCount: tests.length,
             passRate: s.passRate ?? s.pass_rate ?? null,
             lastRunAt: s.lastRunAt ?? s.last_run_at ?? null,
@@ -603,14 +596,18 @@ export class DebuggAIServerClient {
                 return {
                     uuid: t.uuid,
                     name: t.name,
-                    runCount: t.runCount ?? t.run_count ?? 0,
-                    passedRunsCount: t.passedRunsCount ?? t.passed_runs_count ?? 0,
-                    failedRunsCount: t.failedRunsCount ?? t.failed_runs_count ?? 0,
+                    runCount: t.runCount ?? t.run_count ?? null,
+                    passedRunsCount: t.passedRunsCount ?? t.passed_runs_count ?? null,
+                    failedRunsCount: t.failedRunsCount ?? t.failed_runs_count ?? null,
                     passRate: t.passRate ?? t.pass_rate ?? null,
                     lastRun: lastRun ? {
                         uuid: lastRun.uuid,
                         status: lastRun.status,
-                        outcome: lastRun.outcome,
+                        // the user-facing verdict allowlist, same as every other surface;
+                        // a run with no outcome yet keeps its null
+                        outcome: typeof lastRun.outcome === 'string' && lastRun.outcome.trim() !== ''
+                            ? toUserFacingOutcome(lastRun.outcome)
+                            : lastRun.outcome ?? null,
                         executionTime: lastRun.executionTime ?? lastRun.execution_time ?? null,
                         timestamp: lastRun.timestamp,
                     } : null,
@@ -623,8 +620,8 @@ export class DebuggAIServerClient {
             uuid: s.uuid,
             name: s.name,
             description: s.description ?? null,
-            runStatus: s.runStatus ?? s.run_status ?? 'NEVER_RUN',
-            testsCount: s.testsCount ?? s.tests_count ?? 0,
+            runStatus: s.runStatus ?? s.run_status ?? null,
+            testsCount: s.testsCount ?? s.tests_count ?? null,
         };
     }
 }

package/dist/services/tunnel/debuggTransport.js

@@ -3,7 +3,7 @@
  *
  * One websocket per tunnel to the relayUrl a provision response supplies,
  * speaking the wire protocol in services/tunnel/protocol/ (spec: bead
- * debugg_ai_mcp-xkoh.1.2). It replaces the `ngrok` package, which downloads and
+ * debugg_ai_mcp-xkoh.1.2). It replaced the `ngrok` package, which downloaded and
  * spawns a native agent; `ws` is the only new dependency and is pure JS.
  *
  * This file owns exactly four things — the socket, the reconnect policy, the
@@ -324,7 +324,7 @@ class DebuggTransport {
         });
         socket.on('error', () => {
             if (!established) {
-                // The ERR_NGROK_8012 analogue: the tunnel is fine, the app refused.
+                // The tunnel is fine; the app refused the connection.
                 // The server renders DEBUGG_TUNNEL_UPSTREAM_REFUSED from this code and
                 // tunnelDisposition keeps the tunnel.
                 stream.reset(ErrorCode.UPSTREAM_UNREACHABLE);
@@ -359,9 +359,9 @@ function terminal(message) {
 function handshakeFailureError(state, status, supported, retryable) {
     switch (status) {
         case 401:
-            // The word "authtoken" is load-bearing: TunnelManager matches it to
-            // render its "invalid auth token" message, the same one an ngrok auth
-            // failure produces.
+            // The word "authtoken" is load-bearing: TunnelManager's connect ladder
+            // matches it to stop retrying and render its "invalid auth token"
+            // message.
             return terminal('the debugg tunnel server rejected the authtoken (HTTP 401) — the tunnel key is invalid, ' +
                 'expired or revoked. A new one is provisioned on the next call.');
         case 400:
@@ -379,10 +379,10 @@ function handshakeFailureError(state, status, supported, retryable) {
     }
 }
 /**
- * A connection-level failure reaching the relay. This is the one place where
- * the debugg transport can be WORSE than ngrok for a user — ngrok's agent
- * honours HTTPS_PROXY and this client does not — so the message says plainly
- * what has to be allowed instead of reading as a generic tunnel error.
+ * A connection-level failure reaching the relay. This client does NOT honour
+ * HTTPS_PROXY (the retired ngrok agent did, which is the one capability lost
+ * in the cutover — design §5 "open gap"), so the message says plainly what has
+ * to be allowed instead of reading as a generic tunnel error.
  */
 function egressError(state, detail, code) {
     const relayHost = hostOf(state.relayUrl);

package/dist/services/tunnel/protocol/constants.js

@@ -163,14 +163,14 @@ export const HandshakeError = Object.freeze({
 });
 // ── Server error markers (server emits, client parses) ───────────────────────
 export const TunnelErrorMarker = Object.freeze({
-    /** No client connected — the ERR_NGROK_3200 analogue. */
+    /** No client connected — 404, matching what the retired ngrok edge served. */
     OFFLINE: 'DEBUGG_TUNNEL_OFFLINE',
     /** Unknown or revoked tunnel id. */
     UNKNOWN: 'DEBUGG_TUNNEL_UNKNOWN',
-    /** The client could not dial the local app — the ERR_NGROK_8012 analogue. */
+    /** The client could not dial the local app — 502. */
     UPSTREAM_REFUSED: 'DEBUGG_TUNNEL_UPSTREAM_REFUSED',
 });
-/** HTTP status each marker is served with, chosen to match the ngrok codes they replace. */
+/** HTTP status each marker is served with, chosen to match the codes they replaced. */
 export const MARKER_HTTP_STATUS = Object.freeze({
     [TunnelErrorMarker.OFFLINE]: 404,
     [TunnelErrorMarker.UNKNOWN]: 404,

package/dist/services/tunnel/transport.js

@@ -1,15 +1,34 @@
 /**
- * TunnelTransport — the one step of tunnel creation that differs between ngrok
- * and the debugg tunnel server.
+ * TunnelTransport — the boundary between tunnel LIFECYCLE (tunnelManager.ts:
+ * who owns a tunnel, when it is reused, when it is torn down) and tunnel
+ * TRANSPORT (debuggTransport.ts: the websocket mux that actually carries
+ * bytes).
  *
- * STUB (bead debugg_ai_mcp-xkoh.5.3, phase 2.1). Types and signatures only; the
- * implementations arrive in phase 4.1 (debugg_ai_mcp-xkoh.5.7).
+ * This started life as a two-implementation seam so the ngrok client and the
+ * debugg client could run side by side through the rollout. ngrok is gone and
+ * there is exactly one implementation now, but the interface is KEPT and the
+ * two-implementation machinery around it is not — see the note below.
+ *
+ * WHY KEEP AN INTERFACE WITH ONE IMPLEMENTATION: it is the injection point
+ * (`tunnelManager.transport`) every tunnel-lifecycle test drives, in the same
+ * spirit as `caddyFactory`. Without it, testing eviction, the retry ladder or
+ * the idle timer means standing up a real websocket against a real relay.
+ * It also keeps debuggTransport's ~600 lines of framing, flow control and
+ * reconnect out of TunnelManager, which is the reason the file boundary is
+ * worth having regardless of how many implementations exist.
+ *
+ * WHAT WAS REMOVED WITH ngrok, because it was ceremony the moment the second
+ * implementation went away:
+ *   - `TunnelTransportKind` and the `Record<kind, TunnelTransport>` registry —
+ *     a map with one key, keyed by a union with one member.
+ *   - `prepare()`, `resetAfterFailedAttempt()` and `onAllTunnelsStopped()` —
+ *     three optional hooks that existed ONLY for the ngrok agent process
+ *     (pre-warm, agent reset between retries, module reset when the agent may
+ *     have exited). debugg has no out-of-process agent, so every one of them
+ *     was a no-op on the only surviving implementation.
  *
  * Everything above this seam is unchanged: handlers, utils/tunnelContext.ts,
- * the per-session Caddy instance, PortLock, URL rewriting, the retry ladder,
- * the idle timer and the session keying all behave exactly as they do today
- * (docs/debugg-tunnel-server-design-2026-09-19.md §5). TunnelManager picks an
- * implementation from the provision response and calls it where it calls
- * ngrok.connect() today.
+ * the per-session Caddy instance, PortLock, URL rewriting, the retry ladder and
+ * the idle timer (docs/debugg-tunnel-server-design-2026-09-19.md §5).
  */
 export {};

package/dist/services/{ngrok → tunnel}/tunnelFaultInjection.js

@@ -6,27 +6,27 @@
  *   - DEBUGG_TUNNEL_FAULT_MODE env var explicitly set
  *
  * Modes (comma-separated, parseable by parseFaultMode):
- *   fail-connect-N:<count>      — fail the first <count> ngrok.connect() attempts
+ *   fail-connect-N:<count>      — fail the first <count> transport connect() attempts
  *   empty-url-N:<count>         — return empty URL from first <count> connect() attempts
  *   delay-connect:<ms>          — sleep <ms> before each connect() call
- *   inspector-unreachable:1     — the local ngrok agent inspector observes nothing
- *                                 (bead lc62: proves reconciliation is add-only, i.e.
- *                                 a blind inspector cannot cost a re-provision)
- *   inspector-adopt:<port>      — the inspector reports one synthetic live tunnel on
- *                                 <port>, exercising re-adoption end to end without
- *                                 provisioning a real, billable tunnel
  *
  * Examples:
  *   DEBUGG_TUNNEL_FAULT_MODE=fail-connect-N:2
  *   DEBUGG_TUNNEL_FAULT_MODE=delay-connect:2000,fail-connect-N:1
- *   DEBUGG_TUNNEL_FAULT_MODE=inspector-adopt:3000
+ *
+ * Two further modes — `inspector-unreachable` and `inspector-adopt` — went
+ * away with the ngrok agent inspector they drove. Both existed to exercise
+ * re-adoption of a tunnel already registered with the local ngrok agent, a
+ * mechanism that the per-session-tunnel cutover retired ("no sharing, ever")
+ * and that the debugg transport has no equivalent of: it owns its own socket
+ * and there is no out-of-process agent holding tunnels to discover.
  */
 export function parseFaultMode(raw) {
     if (!raw)
         return null;
     const mode = {};
     for (const token of raw.split(',').map((s) => s.trim()).filter(Boolean)) {
-        const m = token.match(/^(fail-connect-N|empty-url-N|delay-connect|inspector-unreachable|inspector-adopt):(\d+)$/);
+        const m = token.match(/^(fail-connect-N|empty-url-N|delay-connect):(\d+)$/);
         if (!m)
             continue;
         const [, name, valStr] = m;
@@ -37,12 +37,6 @@ export function parseFaultMode(raw) {
             mode.emptyUrlN = val;
         else if (name === 'delay-connect')
             mode.delayConnectMs = val;
-        // Value-less switch, but kept in the `name:<digits>` grammar so one regex
-        // covers every mode. Any non-zero value turns it on.
-        else if (name === 'inspector-unreachable')
-            mode.inspectorUnreachable = val !== 0;
-        else if (name === 'inspector-adopt')
-            mode.inspectorAdoptPort = val;
     }
     return Object.keys(mode).length > 0 ? mode : null;
 }