@lythos/cold-pool 0.17.11 → 0.18.0

package/README.md

@@ -15,10 +15,10 @@ deck / curator / arena consume it instead of running `git clone` themselves.
 
 ```bash
 # Scan cold pool for unreferenced repos
-bunx @lythos/cold-pool@0.17.11 prune [--yes] [--dry-run]
+bunx @lythos/cold-pool@0.18.0 prune [--yes] [--dry-run]
 
 # Validate lock file against cold pool
-bunx @lythos/cold-pool@0.17.11 validate [--lock ./skill-deck.lock]
+bunx @lythos/cold-pool@0.18.0 validate [--lock ./skill-deck.lock]
 ```
 
 ## Architecture

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lythos/cold-pool",
-  "version": "0.17.11",
+  "version": "0.18.0",
   "description": "Cold pool service layer — dedicated resource holder for skill repositories with intent/plan/execute primitives. Single owner of git side-effects; consumed by deck/curator/arena.",
   "keywords": [
     "ai-agent",
@@ -42,7 +42,7 @@
   },
   "homepage": "https://github.com/lythos-labs/lythoskill/tree/main/packages/lythoskill-cold-pool#readme",
   "dependencies": {
-    "@lythos/infra": "^0.17.11",
+    "@lythos/infra": "^0.18.0",
     "simple-git": "^3.36.0"
   },
   "engines": {

package/src/git-io.ts

@@ -15,7 +15,7 @@ import { dirname, resolve } from 'node:path'
 export type GitExec = typeof execFileSync
 
 /** Read LYTHOS_SOCKS_PROXY env var and return git-config args if present. */
-function socksProxyArgs(): string[] {
+export function socksProxyArgs(): string[] {
   const proxy = process.env.LYTHOS_SOCKS_PROXY?.trim()
   if (!proxy) return []
   const url = proxy.startsWith('socks5://') ? proxy : `socks5://${proxy}`

package/src/mirror.test.ts

@@ -50,78 +50,168 @@ describe('probeConnectivity', () => {
     }
   }
 
-  // ── Tracer Bullet ──
-  it('direct reachable → returns direct path', async () => {
-    mockFetch(
-      new Map([
-        ['https://example.com/skill', new Response(null, { status: 200 })],
-      ]),
-    )
+  /** execFileSync fake: per-URL git ls-remote success/failure; curl never succeeds. */
+  function mockGitExec(okUrls: string[] = []) {
+    const calls: Array<{ file: string; args: string[] }> = []
+    const exec = (file: unknown, args: unknown) => {
+      const a = (args as string[]).map(String)
+      calls.push({ file: String(file), args: a })
+      if (String(file) === 'git') {
+        const url = a[a.length - 1]!
+        if (okUrls.includes(url)) return ''
+        throw new Error(`git ls-remote failed for ${url}`)
+      }
+      throw new Error('curl failed')
+    }
+    return { exec: exec as any, calls }
+  }
+
+  /** execFileSync fake where git can never answer (e.g. binary missing). */
+  function gitUnavailable() {
+    return (() => {
+      throw new Error('spawnSync git ENOENT')
+    }) as any
+  }
+
+  const DIRECT = 'https://example.com/skill'
+  const MIRROR = 'https://my-mirror.example.com'
+  const MIRROR_URL = `${MIRROR}/${DIRECT}`
+  const infoRefs = (u: string) => `${u}/info/refs?service=git-upload-pack`
+
+  // ── Tier 1: git-verified ──────────────────────────────────────────
 
-    const result = await probeConnectivity('https://example.com/skill')
+  it('direct ls-remote ok → git-verified direct, fetch never called', async () => {
+    const { exec } = mockGitExec([DIRECT])
+    mockFetch(new Map([[infoRefs(DIRECT), new Response(null, { status: 200 })]]))
+
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: exec })
 
     expect(result).toMatchObject({
       path: 'direct',
-      url: 'https://example.com/skill',
+      url: DIRECT,
       latencyMs: expect.any(Number),
+      confidence: 'git-verified',
     })
+    expect(fetchCalls.length).toBe(0)
   })
 
-  // ── Vertical Slice 2 ──
-  it('direct fails, user mirror ok → returns mirror path', async () => {
-    process.env.LYTHOS_GH_MIRROR = 'https://my-mirror.example.com'
-    mockFetch(
-      new Map([
-        ['https://example.com/skill', new Response(null, { status: 500 })],
-        ['https://my-mirror.example.com/https://example.com/skill', new Response(null, { status: 200 })],
-      ]),
-    )
+  it('direct ls-remote fails, mirror ls-remote ok → git-verified mirror', async () => {
+    process.env.LYTHOS_GH_MIRROR = MIRROR
+    const { exec } = mockGitExec([MIRROR_URL])
+    mockFetch(new Map())
 
-    const result = await probeConnectivity('https://example.com/skill')
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: exec })
 
     expect(result).toMatchObject({
       path: 'mirror',
-      url: 'https://my-mirror.example.com/https://example.com/skill',
-      latencyMs: expect.any(Number),
+      url: MIRROR_URL,
+      confidence: 'git-verified',
     })
+    // direct failure recorded for diagnostics
+    expect(result?.failures?.some((f) => f.url === DIRECT)).toBe(true)
   })
 
-  // ── Vertical Slice 3 ──
-  it('all paths fail → returns undefined', async () => {
-    mockFetch(new Map())
+  it('HEAD-blocking mirror is NOT rejected when ls-remote succeeds (the K3 false negative)', async () => {
+    // ghfast.top-style mirror: rejects HEAD/GET on bare URL with 403, but
+    // serves git smart-HTTP fine — ls-remote (clone's handshake) succeeds.
+    process.env.LYTHOS_GH_MIRROR = MIRROR
+    const { exec } = mockGitExec([MIRROR_URL])
+    globalThis.fetch = async () => new Response(null, { status: 403 })
 
-    const result = await probeConnectivity('https://example.com/skill')
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: exec })
 
-    expect(result).toBeUndefined()
+    expect(result).toBeDefined()
+    expect(result?.path).toBe('mirror')
+    expect(result?.confidence).toBe('git-verified')
+    expect(result?.authRequired).toBeUndefined()
   })
 
-  // ── Vertical Slice 4 ──
-  it('404 is treated as reachable (server alive)', async () => {
-    mockFetch(
-      new Map([
-        ['https://example.com/skill', new Response(null, { status: 404 })],
-      ]),
-    )
+  it('LYTHOS_SOCKS_PROXY set → ls-remote injects -c http.proxy flags (same as clone)', async () => {
+    process.env.LYTHOS_SOCKS_PROXY = '127.0.0.1:1080'
+    const { exec, calls } = mockGitExec([DIRECT])
+
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: exec })
+
+    expect(result?.confidence).toBe('git-verified')
+    const gitCall = calls.find((c) => c.file === 'git')!
+    expect(gitCall.args).toContain('http.proxy=socks5://127.0.0.1:1080')
+    expect(gitCall.args).toContain('https.proxy=socks5://127.0.0.1:1080')
+  })
+
+  // ── Tier 2: http-signal (git cannot answer) ──────────────────────
+
+  it('git unavailable, GET info/refs 200 → http-signal direct', async () => {
+    mockFetch(new Map([[infoRefs(DIRECT), new Response(null, { status: 200 })]]))
+
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: gitUnavailable() })
+
+    expect(result).toMatchObject({
+      path: 'direct',
+      url: DIRECT,
+      confidence: 'http-signal',
+    })
+    expect(fetchCalls.length).toBe(1)
+    expect(fetchCalls[0].url).toBe(infoRefs(DIRECT))
+    expect(fetchCalls[0].options.method).toBe('GET')
+  })
+
+  it('403 on GET info/refs → reachable with authRequired (not "blocked")', async () => {
+    mockFetch(new Map([[infoRefs(DIRECT), new Response(null, { status: 403 })]]))
+
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: gitUnavailable() })
+
+    expect(result).toMatchObject({ path: 'direct', confidence: 'http-signal', authRequired: true })
+  })
 
-    const result = await probeConnectivity('https://example.com/skill')
+  it('401 on GET info/refs → reachable with authRequired', async () => {
+    mockFetch(new Map([[infoRefs(DIRECT), new Response(null, { status: 401 })]]))
+
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: gitUnavailable() })
+
+    expect(result?.authRequired).toBe(true)
+  })
+
+  it('404 on GET info/refs → reachable (host alive), no authRequired', async () => {
+    mockFetch(new Map([[infoRefs(DIRECT), new Response(null, { status: 404 })]]))
+
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: gitUnavailable() })
 
     expect(result?.path).toBe('direct')
+    expect(result?.authRequired).toBeUndefined()
   })
 
-  // ── Vertical Slice 5: Racing behavior ──
-  it('probes race concurrently, not sequentially', async () => {
-    process.env.LYTHOS_GH_MIRROR = 'https://my-mirror.example.com'
+  it('git unavailable, direct HTTP fails, mirror HTTP ok → http-signal mirror', async () => {
+    process.env.LYTHOS_GH_MIRROR = MIRROR
+    mockFetch(new Map([[infoRefs(MIRROR_URL), new Response(null, { status: 200 })]]))
+
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: gitUnavailable() })
+
+    expect(result).toMatchObject({ path: 'mirror', url: MIRROR_URL, confidence: 'http-signal' })
+  })
+
+  // ── Both tiers fail everywhere → undefined ───────────────────────
+
+  it('undefined only when both tiers fail on all URLs', async () => {
+    process.env.LYTHOS_GH_MIRROR = MIRROR
+    mockFetch(new Map()) // every fetch → ENOTFOUND
+
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: gitUnavailable() })
+
+    expect(result).toBeUndefined()
+  })
+
+  // ── Tier-2 racing behavior ───────────────────────────────────────
+
+  it('tier-2 HTTP probes race concurrently, not sequentially', async () => {
+    process.env.LYTHOS_GH_MIRROR = MIRROR
     const start = performance.now()
 
     mockFetch(
-      new Map([
-        ['https://example.com/skill', new Response(null, { status: 500 })],
-        ['https://my-mirror.example.com/https://example.com/skill', new Response(null, { status: 200 })],
-      ]),
+      new Map([[infoRefs(MIRROR_URL), new Response(null, { status: 200 })]]),
       50, // each mock fetch takes 50ms
     )
 
-    const result = await probeConnectivity('https://example.com/skill')
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: gitUnavailable() })
 
     const elapsed = performance.now() - start
 
@@ -130,23 +220,7 @@ describe('probeConnectivity', () => {
     expect(elapsed).toBeLessThan(150)
   })
 
-  // ── Vertical Slice 6: No user mirror set → only probes direct ──
-  it('without user mirror, only probes direct', async () => {
-    mockFetch(
-      new Map([
-        ['https://example.com/skill', new Response(null, { status: 200 })],
-      ]),
-    )
-
-    const result = await probeConnectivity('https://example.com/skill')
-
-    expect(result?.path).toBe('direct')
-    expect(fetchCalls.length).toBe(1)
-    expect(fetchCalls[0].url).toBe('https://example.com/skill')
-  })
-
-  // ── Vertical Slice 7: Timeout honored ──
-  it('timeout aborts slow probes', async () => {
+  it('timeout aborts slow tier-2 probes', async () => {
     globalThis.fetch = async (_input, init?) => {
       return new Promise((_, reject) => {
         const timer = setTimeout(
@@ -161,83 +235,96 @@ describe('probeConnectivity', () => {
     }
 
     const start = performance.now()
-    const result = await probeConnectivity('https://example.com/skill', 100)
+    const result = await probeConnectivity(DIRECT, 100, { execFileSync: gitUnavailable() })
     const elapsed = performance.now() - start
 
     expect(result).toBeUndefined()
     expect(elapsed).toBeLessThan(500) // 100ms timeout + overhead
   })
 
-  // ── Vertical Slice 8: SOCKS proxy routing ──
-  it('SOCKS proxy set, curl succeeds → returns direct path', async () => {
+  // ── Tier-2 SOCKS proxy routing (curl) ────────────────────────────
+
+  it('SOCKS proxy set, git unavailable, curl ok → http-signal direct via curl', async () => {
     process.env.LYTHOS_SOCKS_PROXY = '127.0.0.1:1080'
     const execCalls: Array<{ file: string; args: string[] }> = []
 
     const mockExec = (file: unknown, args: unknown) => {
-      execCalls.push({ file: String(file), args: args as string[] })
-      return ''
+      const a = (args as string[]).map(String)
+      execCalls.push({ file: String(file), args: a })
+      if (String(file) === 'curl') return '200'
+      throw new Error('spawnSync git ENOENT')
     }
-    const result = await probeConnectivity('https://example.com/skill', 3000, {
-      execFileSync: mockExec as any,
-    })
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: mockExec as any })
 
     expect(result).toMatchObject({
       path: 'direct',
-      url: 'https://example.com/skill',
+      url: DIRECT,
       latencyMs: expect.any(Number),
+      confidence: 'http-signal',
     })
-    expect(execCalls.length).toBe(1)
-    expect(execCalls[0].file).toBe('curl')
-    expect(execCalls[0].args).toContain('--proxy')
-    expect(execCalls[0].args).toContain('socks5://127.0.0.1:1080')
+    const curlCalls = execCalls.filter((c) => c.file === 'curl')
+    expect(curlCalls.length).toBe(1)
+    expect(curlCalls[0].args).toContain('--proxy')
+    expect(curlCalls[0].args).toContain('socks5://127.0.0.1:1080')
+    expect(curlCalls[0].args[curlCalls[0].args.length - 1]).toBe(infoRefs(DIRECT))
   })
 
-  // ── Vertical Slice 9: SOCKS proxy with socks5:// prefix ──
   it('SOCKS proxy already has socks5:// prefix → does not double-prefix', async () => {
     process.env.LYTHOS_SOCKS_PROXY = 'socks5://proxy.example.com:1080'
     const execCalls: Array<{ file: string; args: string[] }> = []
 
-    const mockExec2 = (file: unknown, args: unknown) => {
-      execCalls.push({ file: String(file), args: args as string[] })
-      return ''
+    const mockExec = (file: unknown, args: unknown) => {
+      const a = (args as string[]).map(String)
+      execCalls.push({ file: String(file), args: a })
+      if (String(file) === 'curl') return '200'
+      throw new Error('spawnSync git ENOENT')
+    }
+    await probeConnectivity(DIRECT, 3000, { execFileSync: mockExec as any })
+
+    const curlCall = execCalls.find((c) => c.file === 'curl')!
+    expect(curlCall.args).toContain('socks5://proxy.example.com:1080')
+    expect(curlCall.args).not.toContain('socks5://socks5://proxy.example.com:1080')
+  })
+
+  it('SOCKS curl gets 403 → http-signal direct with authRequired', async () => {
+    process.env.LYTHOS_SOCKS_PROXY = '127.0.0.1:1080'
+
+    const mockExec = (file: unknown) => {
+      if (String(file) === 'curl') return '403'
+      throw new Error('spawnSync git ENOENT')
     }
-    await probeConnectivity('https://example.com/skill', 3000, {
-      execFileSync: mockExec2 as any,
-    })
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: mockExec as any })
 
-    expect(execCalls[0].args).toContain('socks5://proxy.example.com:1080')
-    expect(execCalls[0].args).not.toContain('socks5://socks5://proxy.example.com:1080')
+    expect(result).toMatchObject({ path: 'direct', confidence: 'http-signal', authRequired: true })
   })
 
-  // ── Vertical Slice 10: SOCKS proxy fails → no automatic unproxied fallback ──
-  it('SOCKS proxy fails → no automatic unproxied fallback', async () => {
+  it('SOCKS proxy fails (git + curl) → no automatic unproxied fallback', async () => {
     process.env.LYTHOS_SOCKS_PROXY = '127.0.0.1:1080'
 
-    const result = await probeConnectivity('https://example.com/skill', 3000, {
-      execFileSync: () => {
+    const result = await probeConnectivity(DIRECT, 3000, {
+      execFileSync: (() => {
         throw new Error('curl failed')
-      },
+      }) as any,
       fetch: async () => new Response(null, { status: 200 }),
     })
 
-    // Design choice: when SOCKS proxy is configured but curl fails, the direct
-    // probe fails. No automatic fallback to unproxied fetch — the user
-    // explicitly chose to route traffic through the proxy, so we honor that
-    // choice rather than silently bypassing it.
+    // Design choice: when SOCKS proxy is configured but both git and curl
+    // fail, the direct probe fails. No automatic fallback to unproxied
+    // fetch — the user explicitly chose to route traffic through the
+    // proxy, so we honor that choice rather than silently bypassing it.
     expect(result).toBeUndefined()
   })
 
-  // ── Vertical Slice 11: SOCKS proxy only affects direct, mirror still works ──
-  it('SOCKS proxy fails but mirror succeeds', async () => {
+  it('SOCKS proxy fails but mirror succeeds → mirror; only one curl call', async () => {
     process.env.LYTHOS_SOCKS_PROXY = '127.0.0.1:1080'
-    process.env.LYTHOS_GH_MIRROR = 'https://my-mirror.example.com'
+    process.env.LYTHOS_GH_MIRROR = MIRROR
     const execCalls: Array<{ file: string; args: string[] }> = []
 
-    const result = await probeConnectivity('https://example.com/skill', 3000, {
-      execFileSync: (file, args) => {
-        execCalls.push({ file: String(file), args: args as string[] })
-        throw new Error('curl failed')
-      },
+    const result = await probeConnectivity(DIRECT, 3000, {
+      execFileSync: ((file: unknown, args: unknown) => {
+        execCalls.push({ file: String(file), args: (args as string[]).map(String) })
+        throw new Error('proxy unreachable')
+      }) as any,
       fetch: async (input) => {
         const url = String(input)
         if (url.includes('my-mirror')) {
@@ -249,7 +336,7 @@ describe('probeConnectivity', () => {
 
     // SOCKS proxy is only used for direct probes; mirror probes use native fetch
     expect(result?.path).toBe('mirror')
-    expect(execCalls.length).toBe(1) // only one curl call for direct probe
+    expect(execCalls.filter((c) => c.file === 'curl').length).toBe(1)
   })
 
   // ── Backward compat: legacy env var name still works ──
@@ -265,12 +352,11 @@ describe('probeConnectivity', () => {
 
     mockFetch(
       new Map([
-        ['https://example.com/skill', new Response(null, { status: 500 })],
-        ['https://legacy-mirror.example.com/https://example.com/skill', new Response(null, { status: 200 })],
+        [infoRefs(`https://legacy-mirror.example.com/${DIRECT}`), new Response(null, { status: 200 })],
       ]),
     )
 
-    const result = await probeConnectivity('https://example.com/skill')
+    const result = await probeConnectivity(DIRECT, 3000, { execFileSync: gitUnavailable() })
 
     console.warn = originalWarn
 

package/src/mirror.ts

@@ -14,6 +14,7 @@
  */
 
 import { execFileSync } from 'node:child_process'
+import { socksProxyArgs } from './git-io.js'
 
 export function getMirror(): string | undefined {
   let v = process.env.LYTHOS_GH_MIRROR?.trim()
@@ -52,6 +53,15 @@ export interface ProbeResult {
   path: 'direct' | 'mirror'
   url: string
   latencyMs: number
+  /**
+   * Evidence tier. 'git-verified' = `git ls-remote` succeeded — the exact
+   * handshake a clone performs, on the same network stack. 'http-signal' =
+   * only an HTTP response was observed (fallback tier when git cannot
+   * answer); weaker evidence, so callers should treat it as advisory.
+   */
+  confidence: 'git-verified' | 'http-signal'
+  /** Set when the HTTP tier got 401/403 — host reachable, credentials likely required. */
+  authRequired?: boolean
 }
 
 export interface ProbeFailure {
@@ -64,42 +74,88 @@ export interface ProbeDeps {
   execFileSync?: typeof execFileSync
 }
 
+/** Short, single-line reason from an exec/fetch error (stderr first line wins). */
+function errReason(err: unknown): string {
+  const stderr = (err as { stderr?: { toString: () => string } })?.stderr?.toString().trim()
+  if (stderr) return stderr.split('\n')[0]!
+  return err instanceof Error ? err.message : String(err)
+}
+
 /**
- * Quick connectivity probe: race direct + user mirror (if set) concurrently.
- * Uses short timeout (default 3s) to fail fast instead of waiting for
- * the full git clone / fetch timeout.
+ * Tiered connectivity probe: direct first, user mirror (if set) alongside.
  *
- * When LYTHOS_SOCKS_PROXY is set, direct probes route through the SOCKS
- * proxy via curl (Bun fetch does not support socks5://).
+ * Tier 1 — `git ls-remote --heads <url>`: the same first handshake a clone
+ * performs, on the same network stack — it inherits the user's git config
+ * (http.proxy, url.insteadOf, http.sslVerify, credentials) and gets the same
+ * LYTHOS_SOCKS_PROXY `-c` flags that git-io's clone/pull inject. This is the
+ * only tier with real predictive power for clone success.
  *
- * Returns the first success, or undefined with failures recorded.
+ * Tier 2 (fallback when no ls-remote succeeds — e.g. git binary missing) —
+ * HTTP `GET <url>/info/refs?service=git-upload-pack`, the request a clone
+ * actually sends first (NOT a bare-URL HEAD, which git smart-HTTP reverse
+ * proxies like ghfast.top reject with 403/405). Any HTTP response proves the
+ * host is reachable (as opposed to DNS/TLS failure); 401/403 is classified
+ * as auth-required, not "blocked". The direct tier keeps the
+ * LYTHOS_SOCKS_PROXY curl route — Bun fetch cannot speak socks5://, and
+ * git ls-remote already inherits git proxy config, so SOCKS-via-curl is
+ * only an HTTP-tier concern.
+ *
+ * Returns the first success with per-URL failures recorded, or undefined
+ * only when BOTH tiers fail on ALL URLs.
  */
 export async function probeConnectivity(
   url: string,
   timeoutMs = 3000,
   deps?: ProbeDeps,
 ): Promise<ProbeResult & { failures?: ProbeFailure[] } | undefined> {
-  const start = performance.now()
   const failures: ProbeFailure[] = []
   const _fetch = deps?.fetch ?? globalThis.fetch
   const _exec = deps?.execFileSync ?? execFileSync
+  const targets: Array<{ targetUrl: string; pathLabel: 'direct' | 'mirror' }> = [
+    { targetUrl: url, pathLabel: 'direct' },
+    ...mirrorUrls(url).map((m) => ({ targetUrl: m, pathLabel: 'mirror' as const })),
+  ]
+
+  // ── Tier 1: git ls-remote (ground truth) ───────────────────────────
+  // execFileSync is synchronous, so tier-1 probes run sequentially — the
+  // per-probe timeout bounds each attempt.
+  for (const { targetUrl, pathLabel } of targets) {
+    const t0 = performance.now()
+    try {
+      _exec('git', [...socksProxyArgs(), 'ls-remote', '--heads', targetUrl], {
+        encoding: 'utf-8',
+        timeout: timeoutMs,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      })
+      return {
+        path: pathLabel,
+        url: targetUrl,
+        latencyMs: Math.round(performance.now() - t0),
+        confidence: 'git-verified',
+        failures,
+      }
+    } catch (err) {
+      failures.push({ url: targetUrl, reason: errReason(err) })
+    }
+  }
 
-  async function tryFetch(
+  // ── Tier 2: HTTP signal (degraded path when git cannot answer) ─────
+  async function tryHttp(
     targetUrl: string,
     pathLabel: 'direct' | 'mirror',
   ): Promise<ProbeResult | undefined> {
     const t0 = performance.now()
+    const probeUrl = `${targetUrl.replace(/\/+$/, '')}/info/refs?service=git-upload-pack`
     try {
       // Route direct probes through SOCKS proxy when configured
       if (pathLabel === 'direct') {
         const socksProxy = process.env.LYTHOS_SOCKS_PROXY?.trim()
         if (socksProxy) {
           const proxyUrl = socksProxy.startsWith('socks5://') ? socksProxy : `socks5://${socksProxy}`
-          _exec(
+          const out = _exec(
             'curl',
             [
               '--silent',
-              '--head',
               '--location',
               '--proxy',
               proxyUrl,
@@ -107,38 +163,48 @@ export async function probeConnectivity(
               String(Math.ceil(timeoutMs / 1000)),
               '--max-time',
               String(Math.ceil(timeoutMs / 1000)),
-              targetUrl,
+              '--output',
+              '/dev/null',
+              '--write-out',
+              '%{http_code}',
+              probeUrl,
             ],
             { encoding: 'utf-8', timeout: timeoutMs + 500 },
           )
-          return { path: pathLabel, url: targetUrl, latencyMs: Math.round(performance.now() - t0) }
+          const code = Number(String(out).trim())
+          return {
+            path: pathLabel,
+            url: targetUrl,
+            latencyMs: Math.round(performance.now() - t0),
+            confidence: 'http-signal',
+            authRequired: code === 401 || code === 403 || undefined,
+          }
         }
       }
 
-      const res = await _fetch(targetUrl, {
-        method: 'HEAD',
+      const res = await _fetch(probeUrl, {
+        method: 'GET',
         signal: AbortSignal.timeout(timeoutMs),
         redirect: 'follow',
       })
-      if (res.ok || res.status === 404) {
-        // 404 means server reachable, resource may not exist
-        return { path: pathLabel, url: targetUrl, latencyMs: Math.round(performance.now() - t0) }
+      // Any HTTP response means the host is reachable — even a 4xx/5xx
+      // (a 4xx only says this URL/method is not accepted, unlike a
+      // DNS/TLS failure which means the host cannot be reached at all).
+      return {
+        path: pathLabel,
+        url: targetUrl,
+        latencyMs: Math.round(performance.now() - t0),
+        confidence: 'http-signal',
+        authRequired: res.status === 401 || res.status === 403 || undefined,
       }
-      failures.push({ url: targetUrl, reason: `HTTP ${res.status}` })
     } catch (err) {
-      failures.push({
-        url: targetUrl,
-        reason: err instanceof Error ? err.message : String(err),
-      })
+      failures.push({ url: targetUrl, reason: errReason(err) })
     }
     return undefined
   }
 
-  // Build all probe promises (direct + mirrors) and race for first success
-  const probes = [tryFetch(url, 'direct')]
-  for (const mirrorUrl of mirrorUrls(url)) {
-    probes.push(tryFetch(mirrorUrl, 'mirror'))
-  }
+  // Race direct + mirrors concurrently; first success wins
+  const probes = targets.map((t) => tryHttp(t.targetUrl, t.pathLabel))
 
   let result: ProbeResult | undefined
   let pending = probes.length