@lythos/cold-pool 0.13.2 → 0.13.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lythos/cold-pool",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Cold pool service layer — dedicated resource holder for skill repositories with intent/plan/execute primitives. Single owner of git side-effects; consumed by deck/curator/arena.",
   "keywords": [
     "ai-agent",
@@ -42,7 +42,7 @@
   },
   "homepage": "https://github.com/lythos-labs/lythoskill/tree/main/packages/lythoskill-cold-pool#readme",
   "dependencies": {
-    "@lythos/infra": "^0.13.2",
+    "@lythos/infra": "^0.13.3",
     "simple-git": "^3.36.0"
   },
   "engines": {

package/src/cold-pool.ts

@@ -137,9 +137,8 @@ export class ColdPool {
         const sub = join(dir, d.name)
         if (existsSync(join(sub, 'SKILL.md'))) {
           push(sub)
-        } else {
-          walk(sub, push)
         }
+        walk(sub, push)
       }
     }
 

package/src/mirror.test.ts

@@ -4,12 +4,15 @@ import { probeConnectivity } from './mirror.js'
 describe('probeConnectivity', () => {
   let originalFetch: typeof fetch
   let originalEnv: string | undefined
+  let originalSocks: string | undefined
   let fetchCalls: Array<{ url: string; options: RequestInit }>
 
   beforeEach(() => {
     originalFetch = globalThis.fetch
     originalEnv = process.env.LYTHOSKILL_GH_MIRROR
+    originalSocks = process.env.LYTHOS_SOCKS_PROXY
     delete process.env.LYTHOSKILL_GH_MIRROR
+    delete process.env.LYTHOS_SOCKS_PROXY
     fetchCalls = []
   })
 
@@ -20,6 +23,11 @@ describe('probeConnectivity', () => {
     } else {
       delete process.env.LYTHOSKILL_GH_MIRROR
     }
+    if (originalSocks !== undefined) {
+      process.env.LYTHOS_SOCKS_PROXY = originalSocks
+    } else {
+      delete process.env.LYTHOS_SOCKS_PROXY
+    }
   })
 
   function mockFetch(
@@ -157,4 +165,86 @@ describe('probeConnectivity', () => {
     expect(result).toBeUndefined()
     expect(elapsed).toBeLessThan(500) // 100ms timeout + overhead
   })
+
+  // ── Vertical Slice 8: SOCKS proxy routing ──
+  test('SOCKS proxy set, curl succeeds → returns direct path', async () => {
+    process.env.LYTHOS_SOCKS_PROXY = '127.0.0.1:1080'
+    const execCalls: Array<{ file: string; args: string[] }> = []
+
+    const mockExec = (file: unknown, args: unknown) => {
+      execCalls.push({ file: String(file), args: args as string[] })
+      return ''
+    }
+    const result = await probeConnectivity('https://example.com/skill', 3000, {
+      execFileSync: mockExec as any,
+    })
+
+    expect(result).toMatchObject({
+      path: 'direct',
+      url: 'https://example.com/skill',
+      latencyMs: expect.any(Number),
+    })
+    expect(execCalls.length).toBe(1)
+    expect(execCalls[0].file).toBe('curl')
+    expect(execCalls[0].args).toContain('--proxy')
+    expect(execCalls[0].args).toContain('socks5://127.0.0.1:1080')
+  })
+
+  // ── Vertical Slice 9: SOCKS proxy with socks5:// prefix ──
+  test('SOCKS proxy already has socks5:// prefix → does not double-prefix', async () => {
+    process.env.LYTHOS_SOCKS_PROXY = 'socks5://proxy.example.com:1080'
+    const execCalls: Array<{ file: string; args: string[] }> = []
+
+    const mockExec2 = (file: unknown, args: unknown) => {
+      execCalls.push({ file: String(file), args: args as string[] })
+      return ''
+    }
+    await probeConnectivity('https://example.com/skill', 3000, {
+      execFileSync: mockExec2 as any,
+    })
+
+    expect(execCalls[0].args).toContain('socks5://proxy.example.com:1080')
+    expect(execCalls[0].args).not.toContain('socks5://socks5://proxy.example.com:1080')
+  })
+
+  // ── Vertical Slice 10: SOCKS proxy fails, direct via fetch succeeds ──
+  test('SOCKS proxy fails, fetch fallback succeeds', async () => {
+    process.env.LYTHOS_SOCKS_PROXY = '127.0.0.1:1080'
+
+    const result = await probeConnectivity('https://example.com/skill', 3000, {
+      execFileSync: () => {
+        throw new Error('curl failed')
+      },
+      fetch: async () => new Response(null, { status: 200 }),
+    })
+
+    // When SOCKS proxy is configured but curl fails, the direct probe fails.
+    // No automatic fallback to unproxied fetch — user explicitly chose proxy.
+    expect(result).toBeUndefined()
+  })
+
+  // ── Vertical Slice 11: SOCKS proxy only affects direct, mirror still works ──
+  test('SOCKS proxy fails but mirror succeeds', async () => {
+    process.env.LYTHOS_SOCKS_PROXY = '127.0.0.1:1080'
+    process.env.LYTHOSKILL_GH_MIRROR = 'https://my-mirror.example.com'
+    const execCalls: Array<{ file: string; args: string[] }> = []
+
+    const result = await probeConnectivity('https://example.com/skill', 3000, {
+      execFileSync: (file, args) => {
+        execCalls.push({ file: String(file), args: args as string[] })
+        throw new Error('curl failed')
+      },
+      fetch: async (input) => {
+        const url = String(input)
+        if (url.includes('my-mirror')) {
+          return new Response(null, { status: 200 })
+        }
+        throw new Error('ENOTFOUND')
+      },
+    })
+
+    // SOCKS proxy is only used for direct probes; mirror probes use native fetch
+    expect(result?.path).toBe('mirror')
+    expect(execCalls.length).toBe(1) // only one curl call for direct probe
+  })
 })

package/src/mirror.ts

@@ -10,6 +10,8 @@
  * that can return tampered skill files (see ADR-202605130...).
  */
 
+import { execFileSync } from 'node:child_process'
+
 export function getMirror(): string | undefined {
   const v = process.env.LYTHOSKILL_GH_MIRROR?.trim()
   if (!v) return undefined
@@ -47,19 +49,30 @@ export interface ProbeFailure {
   reason: string
 }
 
+export interface ProbeDeps {
+  fetch?: typeof globalThis.fetch
+  execFileSync?: typeof execFileSync
+}
+
 /**
  * Quick connectivity probe: race direct + user mirror (if set) concurrently.
  * Uses short timeout (default 3s) to fail fast instead of waiting for
  * the full git clone / fetch timeout.
  *
+ * When LYTHOS_SOCKS_PROXY is set, direct probes route through the SOCKS
+ * proxy via curl (Bun fetch does not support socks5://).
+ *
  * Returns the first success, or undefined with failures recorded.
  */
 export async function probeConnectivity(
   url: string,
   timeoutMs = 3000,
+  deps?: ProbeDeps,
 ): Promise<ProbeResult & { failures?: ProbeFailure[] } | undefined> {
   const start = performance.now()
   const failures: ProbeFailure[] = []
+  const _fetch = deps?.fetch ?? globalThis.fetch
+  const _exec = deps?.execFileSync ?? execFileSync
 
   async function tryFetch(
     targetUrl: string,
@@ -67,7 +80,32 @@ export async function probeConnectivity(
   ): Promise<ProbeResult | undefined> {
     const t0 = performance.now()
     try {
-      const res = await fetch(targetUrl, {
+      // Route direct probes through SOCKS proxy when configured
+      if (pathLabel === 'direct') {
+        const socksProxy = process.env.LYTHOS_SOCKS_PROXY?.trim()
+        if (socksProxy) {
+          const proxyUrl = socksProxy.startsWith('socks5://') ? socksProxy : `socks5://${socksProxy}`
+          _exec(
+            'curl',
+            [
+              '--silent',
+              '--head',
+              '--location',
+              '--proxy',
+              proxyUrl,
+              '--connect-timeout',
+              String(Math.ceil(timeoutMs / 1000)),
+              '--max-time',
+              String(Math.ceil(timeoutMs / 1000)),
+              targetUrl,
+            ],
+            { encoding: 'utf-8', timeout: timeoutMs + 500 },
+          )
+          return { path: pathLabel, url: targetUrl, latencyMs: Math.round(performance.now() - t0) }
+        }
+      }
+
+      const res = await _fetch(targetUrl, {
         method: 'HEAD',
         signal: AbortSignal.timeout(timeoutMs),
         redirect: 'follow',