@monster-orange/den 0.2.4 → 0.2.5

package/src/shared/environment-manager/default-workspace.ts

@@ -14,63 +14,127 @@ import {
   writeWorkspacesFile,
 } from "./workspaces.js";
 import { readCatalog, writeCatalog } from "./catalog.js";
-import { readDenConfig, requireGithubOrg } from "../den-config.js";
-import type { WorkspaceServiceEntry } from "../types/index.js";
-
-const DEFAULT_BRANCH = "main";
+import {
+  readWorkspaceBlueprints,
+  requireGithubOrg,
+  type ResolvedWorkspaceBlueprint,
+} from "../den-config.js";
+import type {
+  ServiceCatalog,
+  WorkspaceConfig,
+  WorkspaceServiceEntry,
+  WorkspacesFile,
+} from "../types/index.js";
 
-export function defaultWorkspaceRepos(): string[] {
-  return readDenConfig().defaults?.workspace?.repos ?? [];
+/** The single-workspace blueprint (`defaults.workspace`), or null. */
+function singleBlueprint(): ResolvedWorkspaceBlueprint | null {
+  const bps = readWorkspaceBlueprints();
+  return bps.shape === "single" ? bps.workspaces[0] : null;
 }
 
-function defaultBranch(): string {
-  return readDenConfig().defaults?.workspace?.branch ?? DEFAULT_BRANCH;
+/** True when the distribution uses `defaults.workspaces` (named workspaces). */
+export function isMultiBlueprint(): boolean {
+  return readWorkspaceBlueprints().shape === "multi";
 }
 
-function org(): string {
-  return requireGithubOrg();
+/** The workspaces a fresh setup would seed, each with at least one repo. */
+export function blueprintWorkspaces(): ResolvedWorkspaceBlueprint[] {
+  return readWorkspaceBlueprints().workspaces.filter((b) => b.repos.length > 0);
 }
 
-/** True on a fresh clone: a blueprint exists but the `default` workspace is empty. */
-export function defaultWorkspaceNeedsSeeding(): boolean {
-  if (defaultWorkspaceRepos().length === 0) return false;
-  const def = readWorkspacesFile().workspaces["default"];
-  return !def || Object.keys(def.services ?? {}).length === 0;
+/** `defaults.workspace.repos` — the single blueprint's repos (empty for the multi shape). */
+export function defaultWorkspaceRepos(): string[] {
+  return singleBlueprint()?.repos ?? [];
 }
 
-/** Whether the `default` workspace already has services (so seeding would reset it). */
-export function defaultWorkspaceHasServices(): boolean {
-  const def = readWorkspacesFile().workspaces["default"];
-  return !!def && Object.keys(def.services ?? {}).length > 0;
+function org(): string {
+  return requireGithubOrg();
 }
 
-/**
- * Seed (or reset) the `default` workspace from the blueprint — every repo as a
- * bare, first-class managed entry on `branch` — and ensure the catalog has
- * clone URLs (`<org>/<repo>`, only filled where missing). Returns the seeded repos.
- */
-export function seedDefaultWorkspace(): string[] {
-  const repos = defaultWorkspaceRepos();
-  const branch = defaultBranch();
+function blueprintServices(
+  bp: ResolvedWorkspaceBlueprint,
+  repos: string[] = bp.repos,
+): Record<string, WorkspaceServiceEntry> {
   // Team default for systems a fresh workspace should NOT auto-start (e.g.
   // billing-api's `make up` opens an interactive Stripe tab). Personal after
   // seeding — toggled per system in the web ⋮ menu.
-  const autostartOff = new Set(
-    readDenConfig().defaults?.workspace?.autostart_off ?? [],
-  );
+  const autostartOff = new Set(bp.autostartOff);
   const services: Record<string, WorkspaceServiceEntry> = {};
   for (const repo of repos) {
     services[repo] = {
       mode: "managed",
-      branch,
+      branch: bp.branch,
       ...(autostartOff.has(repo) ? { autostart: false } : {}),
     };
   }
+  return services;
+}
+
+function fillCatalog(
+  repos: string[],
+  catalog: ServiceCatalog = readCatalog(),
+): void {
+  const o = org();
+  for (const repo of repos) {
+    if (!catalog[repo]?.gh) catalog[repo] = { gh: `${o}/${repo}` };
+  }
+  writeCatalog(catalog);
+}
+
+/**
+ * A genuine fresh setup: no workspace but `default` exists, `default` holds no
+ * services, and no blueprint was ever applied to it (`seeded_repos` unset —
+ * seeding, top-up and a declined offer all record it). An emptied `default`,
+ * or one next to other workspaces, is the user's deliberate state.
+ */
+export function isFreshWorkspaceSetup(
+  file: WorkspacesFile = readWorkspacesFile(),
+): boolean {
+  const names = Object.keys(file.workspaces);
+  if (names.some((n) => n !== "default")) return false;
+  const def = file.workspaces["default"];
+  if (!def) return true;
+  return (
+    Object.keys(def.services ?? {}).length === 0 &&
+    def.seeded_repos === undefined
+  );
+}
+
+/** True on a genuine fresh setup with a non-empty blueprint (single or multi). */
+export function defaultWorkspaceNeedsSeeding(): boolean {
+  if (blueprintWorkspaces().length === 0) return false;
+  return isFreshWorkspaceSetup();
+}
+
+/** Whether a workspace the blueprint seeds already has services (so seeding would reset it). */
+export function defaultWorkspaceHasServices(): boolean {
+  const file = readWorkspacesFile();
+  const names = isMultiBlueprint()
+    ? blueprintWorkspaces().map((b) => b.name)
+    : ["default"];
+  return names.some(
+    (n) => Object.keys(file.workspaces[n]?.services ?? {}).length > 0,
+  );
+}
+
+/**
+ * Seed (or reset) the `default` workspace from the blueprint — every repo as a
+ * bare, first-class managed entry on `branch` — and ensure the catalog has
+ * clone URLs (`<org>/<repo>`, only filled where missing). Returns the seeded
+ * repos. With the multi blueprint (`defaults.workspaces`), seeds every named
+ * workspace instead (see seedBlueprintWorkspaces).
+ */
+export function seedDefaultWorkspace(): string[] {
+  if (isMultiBlueprint())
+    return seedBlueprintWorkspaces().flatMap((w) => w.repos);
+  const bp = singleBlueprint();
+  if (!bp) return [];
+  const repos = bp.repos;
 
   const file = readWorkspacesFile();
   file.workspaces.default = {
     ...(file.workspaces.default ?? {}),
-    services,
+    services: blueprintServices(bp),
     seeded_repos: [...repos],
   };
   if (!file.active?.length) {
@@ -78,27 +142,44 @@ export function seedDefaultWorkspace(): string[] {
     file.focus = "default";
   }
   writeWorkspacesFile(file);
-
-  const catalog = readCatalog();
-  const o = org();
-  for (const repo of repos) {
-    if (!catalog[repo]?.gh) catalog[repo] = { gh: `${o}/${repo}` };
-  }
-  writeCatalog(catalog);
-
+  fillCatalog(repos);
   return repos;
 }
 
 /**
- * Converge an EXISTING `default` workspace on the blueprint. Seeding is
- * one-shot, so a workspace seeded before a repo joined
- * `defaults.workspace.repos` (tasks-api, say) would never gain it on its own.
- * Adds each missing blueprint repo exactly as seeding would (bare
- * managed entry on `branch`, team autostart default, catalog clone URL
- * where absent) and returns the added names. No-op — and no file writes —
- * when already converged, or when the `default` workspace is empty/missing:
- * that state belongs to the seeding/declined flow, not top-up.
+ * Create (or reset) each workspace `defaults.workspaces` names with its repos,
+ * activate them all, and focus the one marked `focus: true` (else the first).
+ * Workspaces the blueprint does not name are left as they are. Returns what
+ * was seeded, in blueprint order.
  */
+export function seedBlueprintWorkspaces(): { name: string; repos: string[] }[] {
+  const bps = blueprintWorkspaces();
+  if (bps.length === 0) return [];
+  const file = readWorkspacesFile();
+  for (const bp of bps) {
+    const prev: WorkspaceConfig | undefined = file.workspaces[bp.name];
+    file.workspaces[bp.name] = {
+      ...(prev ?? {}),
+      services: blueprintServices(bp),
+      seeded_repos: [...bp.repos],
+    };
+  }
+  const names = bps.map((b) => b.name);
+  // The untouched placeholder `default` of a fresh file is not the user's:
+  // only the blueprint's workspaces are active.
+  const kept = (file.active ?? []).filter(
+    (n) =>
+      names.includes(n) ||
+      n !== "default" ||
+      Object.keys(file.workspaces[n]?.services ?? {}).length > 0,
+  );
+  file.active = [...names, ...kept.filter((n) => !names.includes(n))];
+  file.focus = (bps.find((b) => b.focus) ?? bps[0]).name;
+  writeWorkspacesFile(file);
+  fillCatalog([...new Set(bps.flatMap((b) => b.repos))]);
+  return bps.map((b) => ({ name: b.name, repos: [...b.repos] }));
+}
+
 /**
  * Converge an EXISTING `default` workspace on the blueprint. Seeding is
  * one-shot, so a workspace seeded before a repo joined
@@ -106,74 +187,88 @@ export function seedDefaultWorkspace(): string[] {
  *
  * Converges on blueprint DELTAS, not set difference: only repos that JOINED
  * the blueprint since it was last applied (`seeded_repos`) are candidates, so
- * a standard repo the user removed from the workspace stays removed. Presence
- * is checked at REPO level (workspace keys may be `repo/subsystem`
- * addresses), so a repo held as subsystem entries never gains a duplicate
- * bare entry. Added repos get exactly what seeding writes: bare
- * managed entry on `branch`, team autostart default, catalog clone
- * URL where absent. Returns the added names.
+ * a standard repo the user removed from the workspace stays removed. A
+ * candidate is skipped when any workspace already holds it, checked at REPO
+ * level (workspace keys may be `repo/subsystem` addresses). Added repos get
+ * exactly what seeding writes: bare managed entry on `branch`, team
+ * autostart default, catalog clone URL where absent. Returns the added names.
  *
- * No-op — and no file writes once converged — when the blueprint is empty or
- * the `default` workspace is empty/missing (that state belongs to the
- * seeding/declined flow). Workspaces from before `seeded_repos` existed
- * treat the whole blueprint as new once — the migration cannot distinguish
- * "removed" from "seeded before the repo joined"; afterwards removals stick.
+ * Never runs once the user has other workspaces: `default` is then one
+ * workspace among theirs, and repos they moved out must stay out. Also a
+ * no-op (no file writes once converged) for the multi blueprint, an empty
+ * blueprint, or an empty/missing `default` (that state belongs to the
+ * seeding flow). Workspaces from before `seeded_repos` existed treat the
+ * whole blueprint as new once; afterwards removals stick.
  */
 export function topUpDefaultWorkspace(): string[] {
-  const repos = defaultWorkspaceRepos();
-  if (repos.length === 0) return [];
+  const bp = singleBlueprint();
+  if (!bp || bp.repos.length === 0) return [];
+  const repos = bp.repos;
 
   const file = readWorkspacesFile();
+  if (Object.keys(file.workspaces).some((n) => n !== "default")) return [];
   const def = file.workspaces["default"];
   if (!def || Object.keys(def.services ?? {}).length === 0) return [];
 
   const applied = new Set(def.seeded_repos ?? []);
   const catalog = readCatalog();
   const present = new Set(
-    Object.keys(def.services).map((k) => parseAddress(k, catalog).repoName),
-  );
-  const branch = defaultBranch();
-  const autostartOff = new Set(
-    readDenConfig().defaults?.workspace?.autostart_off ?? [],
+    Object.values(file.workspaces).flatMap((ws) =>
+      Object.keys(ws.services ?? {}).map(
+        (k) => parseAddress(k, catalog).repoName,
+      ),
+    ),
   );
 
-  const added: string[] = [];
-  for (const repo of repos) {
-    if (applied.has(repo) || present.has(repo)) continue;
-    def.services[repo] = {
-      mode: "managed",
-      branch,
-      ...(autostartOff.has(repo) ? { autostart: false } : {}),
-    };
-    added.push(repo);
-  }
+  const missing = repos.filter((r) => !applied.has(r) && !present.has(r));
+  Object.assign(def.services, blueprintServices(bp, missing));
 
   const blueprintChanged =
     def.seeded_repos?.length !== repos.length ||
     repos.some((r, i) => def.seeded_repos?.[i] !== r);
-  if (added.length === 0 && !blueprintChanged) return [];
+  if (missing.length === 0 && !blueprintChanged) return [];
 
   def.seeded_repos = [...repos];
   writeWorkspacesFile(file);
+  if (missing.length > 0) fillCatalog(missing, catalog);
+  return missing;
+}
 
-  if (added.length > 0) {
-    const o = org();
-    for (const repo of added) {
-      if (!catalog[repo]?.gh) catalog[repo] = { gh: `${o}/${repo}` };
-    }
-    writeCatalog(catalog);
+/**
+ * Record that the user removed `repoName` from workspace `wsName`, so top-up
+ * never re-adds it. Only the `default` workspace is topped up, and only a
+ * blueprint repo could come back; `seeded_repos` already covers repos the
+ * blueprint applied. This closes the gap for a `default` from before
+ * `seeded_repos` existed, which top-up would otherwise migrate by re-adding
+ * the whole blueprint. Mutates `file` in place; the caller writes it.
+ */
+export function recordRemovedFromWorkspace(
+  file: WorkspacesFile,
+  wsName: string,
+  repoName: string,
+): void {
+  if (wsName !== "default") return;
+  const def = file.workspaces["default"];
+  if (!def) return;
+  let blueprint: string[] = [];
+  try {
+    blueprint = defaultWorkspaceRepos();
+  } catch {
+    return; // a malformed blueprint is reported where seeding reads it
   }
-
-  return added;
+  if (!blueprint.includes(repoName)) return;
+  const seeded = def.seeded_repos ?? [];
+  if (!seeded.includes(repoName)) def.seeded_repos = [...seeded, repoName];
 }
 
 /**
- * Persist an empty `default` workspace so the one-time auto-seed prompt isn't
- * asked again after the user declines it.
+ * Persist an empty `default` workspace, with an empty `seeded_repos`, so the
+ * one-time auto-seed prompt isn't asked again after the user declines it.
  */
 export function markDefaultWorkspaceDeclined(): void {
   const file = readWorkspacesFile();
   file.workspaces.default = file.workspaces.default ?? { services: {} };
+  file.workspaces.default.seeded_repos ??= [];
   if (!file.active?.length) {
     file.active = ["default"];
     file.focus = "default";

package/src/shared/environment-manager/health.ts

@@ -9,8 +9,13 @@ import { hasRuntime, repoKind } from "../repo-kind.js";
 import * as https from "https";
 import * as tls from "tls";
 import { readEdgeConfig } from "../edge/config.js";
-import { composeHealthCmd } from "../stacks/manifest-commands.js";
+import {
+  composeHealth,
+  composeHealthTarget,
+  type ComposeHealthTarget,
+} from "../stacks/compose-health.js";
 import * as fs from "fs";
+import * as os from "os";
 import * as path from "path";
 import * as dns from "dns";
 import { spawn } from "child_process";
@@ -38,7 +43,15 @@ import type { Environment } from "../types/index.js";
 
 import { product } from "../product.js";
 export interface PingResult {
-  ok: boolean;
+  /**
+   * true: the check answered healthy. false: it COMPLETED and failed. null:
+   * it did not complete or could not tell (no answer within its budget, its
+   * process could not start, or it reported its state unknown). Only false
+   * is down.
+   */
+  ok: boolean | null;
+  /** With ok null: the check gave no answer within its budget. */
+  pending?: boolean;
   status?: number;
   error?: string;
 }
@@ -50,7 +63,12 @@ export interface ServiceHealthResult {
   repoPath: string;
   mode: "dev-managed" | "managed";
   branch: string | null;
-  health: "ok" | "error" | "unknown";
+  /**
+   * "pending": a check ran but gave no verdict (no answer in time, or it
+   * could not tell). Unlike "unknown" (no check configured) it is not a
+   * reason to proceed; unlike "error" it is not down.
+   */
+  health: "ok" | "error" | "unknown" | "pending";
   healthDetail?: string;
   /** Where the service runs for the env checked (R13). */
   runs?: Placement["runs"];
@@ -409,40 +427,185 @@ export async function pingShell(
   cmd: string,
   extraEnv: Record<string, string> = {},
   cwd?: string,
+  opts: {
+    /** The answer budget (default CLI_SPAWN_TIMEOUT_MS). */
+    timeoutMs?: number;
+  } = {},
 ): Promise<PingResult> {
+  // Bounded concurrency: a health cycle starts every check at once, and a
+  // distribution's shell checks are processes. Queued checks start their
+  // budget when they start, not while they wait.
+  const release = await shellSlots.acquire();
+  try {
+    return await runShellCheck(cmd, extraEnv, cwd, opts);
+  } finally {
+    release();
+  }
+}
+
+/** A counting semaphore. */
+class Slots {
+  private free: number;
+  private waiting: (() => void)[] = [];
+  constructor(readonly size: number) {
+    this.free = size;
+  }
+  async acquire(): Promise<() => void> {
+    if (this.free > 0) this.free--;
+    else await new Promise<void>((r) => this.waiting.push(r));
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      const next = this.waiting.shift();
+      if (next) next();
+      else this.free++;
+    };
+  }
+}
+
+/** Shell checks running at once: max(2, cpus/2). */
+export const SHELL_CHECK_CONCURRENCY = Math.max(
+  2,
+  Math.floor(os.cpus().length / 2),
+);
+const shellSlots = new Slots(SHELL_CHECK_CONCURRENCY);
+
+function runShellCheck(
+  cmd: string,
+  extraEnv: Record<string, string>,
+  cwd: string | undefined,
+  opts: { timeoutMs?: number },
+): Promise<PingResult> {
+  const budget = opts.timeoutMs ?? CLI_SPAWN_TIMEOUT_MS;
   return new Promise((resolve) => {
     let settled = false;
     const settle = (r: PingResult): void => {
       if (settled) return;
       settled = true;
+      clearTimeout(timer);
       clearTimeout(guard);
       resolve(r);
     };
-    const proc = spawn(cmd, [], {
-      shell: true,
-      timeout: CLI_SPAWN_TIMEOUT_MS,
-      env: { ...process.env, ...extraEnv },
-      cwd,
-      // Output is never read: piped stdio would block a chatty script once the
-      // 64KB buffer fills, and 'close' would wait on grandchildren holding the
-      // pipes open. Nothing consumes it — don't create it.
-      stdio: "ignore",
+    // A check that has not answered is not a failed check: past the budget
+    // it is pending (ok null), never down. Under load a CLI-based check
+    // (`<cli> stack health`, a full tsx start) can need longer than the
+    // budget on a cold poll, and calling that "down" painted healthy stacks
+    // red until the next poll.
+    const noAnswer = (): PingResult => ({
+      ok: null,
+      pending: true,
+      error: `no answer within ${Math.round(budget / 1000)}s`,
     });
+    let proc: ReturnType<typeof spawn>;
+    try {
+      proc = spawn(cmd, [], {
+        shell: true,
+        env: { ...process.env, ...extraEnv },
+        cwd,
+        // Output is never read: piped stdio would block a chatty script once
+        // the 64KB buffer fills, and 'close' would wait on grandchildren
+        // holding the pipes open. Nothing consumes it — don't create it.
+        stdio: "ignore",
+      });
+    } catch (err) {
+      resolve({ ok: null, error: (err as Error).message });
+      return;
+    }
+    const timer = setTimeout(() => {
+      settle(noAnswer());
+      proc.kill("SIGTERM");
+    }, budget);
     // 'exit', NOT 'close': close waits for stdio to drain, which a killed
     // shell's surviving grandchildren can hold open forever — one wedged
     // health check then hangs every /api/health poll for good. The guard
-    // timer backstops even a spawn timeout that never fires.
-    const guard = setTimeout(
-      () => settle({ ok: false, error: "health check timed out" }),
-      CLI_SPAWN_TIMEOUT_MS + 1_000,
-    );
-    proc.on("exit", (code) =>
-      settle(code === 0 ? { ok: true } : { ok: false, error: `exit ${code}` }),
-    );
-    proc.on("error", (err) => settle({ ok: false, error: err.message }));
+    // timer backstops even a kill that never lands.
+    const guard = setTimeout(() => settle(noAnswer()), budget + 1_000);
+    proc.on("exit", (code, signal) => {
+      if (code === 0) return settle({ ok: true });
+      // Killed (by the budget above, or from outside): it never answered.
+      if (code === null)
+        return settle({ ...noAnswer(), error: `killed (${signal})` });
+      settle({ ok: false, error: `exit ${code}` });
+    });
+    // The check could not be started (e.g. EAGAIN under load): no verdict.
+    proc.on("error", (err) => settle({ ok: null, error: err.message }));
   });
 }
 
+// ── Timeouts: pending first, down when repeated ─────────────────────────────
+// A check that gets no answer within its budget (an HTTP timeout, a shell
+// check past CLI_SPAWN_TIMEOUT_MS) has not completed: one such cycle is
+// pending, not down. A cold first probe on a loaded machine (cold docker, a
+// tsx-started `stack health`, cold TLS) can miss the budget while the service
+// is fine, and reporting that as down painted healthy repos red until the
+// next poll. Two consecutive timeouts are down: a hung service still shows.
+// The web health row counts cycles (TimeoutStreaks); a one-shot caller
+// (`<cli> status`, checkServiceHealth) re-probes once at once instead, so
+// both say the same thing about the same service.
+
+/** Whether a ping got no answer within its budget. */
+export function timedOut(r: PingResult): boolean {
+  return r.pending === true || (r.ok === false && r.error === "timeout");
+}
+
+/** A timeout's verdict: pending on its first cycle, down on a repeat. */
+function timeoutVerdict(r: PingResult, repeated: boolean): PingResult {
+  const error = r.error ?? "timeout";
+  return repeated
+    ? { ok: false, error: `${error} (twice in a row)` }
+    : { ok: null, pending: true, error };
+}
+
+/** Consecutive timed-out cycles per check, for a caller that polls. */
+export class TimeoutStreaks {
+  private streak = new Map<string, number>();
+  /** `r` as this cycle's verdict for check `key`. */
+  judge(key: string, r: PingResult): PingResult {
+    if (!timedOut(r)) {
+      this.streak.delete(key);
+      return r;
+    }
+    const n = (this.streak.get(key) ?? 0) + 1;
+    this.streak.set(key, n);
+    return timeoutVerdict(r, n >= 2);
+  }
+}
+
+/** Probe once; on a timeout, probe again at once: down only if it times out twice. */
+export async function pingTwiceOnTimeout(
+  probe: () => Promise<PingResult>,
+): Promise<PingResult> {
+  const first = await probe();
+  if (!timedOut(first)) return first;
+  const second = await probe();
+  return timedOut(second) ? timeoutVerdict(second, true) : second;
+}
+
+/**
+ * Run a shell health check. Den's own compose check (the `<cli> stack
+ * health` command it generates, `compose.cmd`) is answered in-process from
+ * the shared docker listing: no CLI process per check. Any other command
+ * (a distribution's own) runs as a shell command.
+ */
+export async function pingShellCheck(
+  cmd: string,
+  extraEnv: Record<string, string>,
+  cwd: string | undefined,
+  compose: ComposeHealthTarget | null,
+): Promise<PingResult> {
+  if (!compose || cmd !== compose.cmd) return pingShell(cmd, extraEnv, cwd);
+  const v = await composeHealth(compose);
+  if (v.ok === true) return { ok: true };
+  if (v.ok === false) return { ok: false, error: v.detail };
+  return { ok: null, error: v.detail, ...(v.pending ? { pending: true } : {}) };
+}
+
+/** A ping result as a ServiceHealthResult health state. */
+export function healthState(r: PingResult): ServiceHealthResult["health"] {
+  return r.ok === true ? "ok" : r.ok === false ? "error" : "pending";
+}
+
 // ── Per-service health check ──────────────────────────────────────────────────
 
 /**
@@ -480,9 +643,9 @@ export async function checkServiceHealth(
     };
   }
 
-  const composeHealth =
+  const compose =
     env === "local"
-      ? composeHealthCmd(
+      ? composeHealthTarget(
           manifest,
           resolved.subsystem,
           resolved.repoName,
@@ -493,7 +656,7 @@ export async function checkServiceHealth(
     manifest,
     resolved.subsystem,
     env,
-    composeHealth,
+    compose?.cmd ?? null,
   );
   const placed: Pick<ServiceHealthResult, "runs" | "target"> = {
     runs: plan.placement.runs,
@@ -544,21 +707,22 @@ export async function checkServiceHealth(
     };
   }
 
-  const result =
+  const result = await pingTwiceOnTimeout(() =>
     healthCfg.type === "shell"
-      ? await pingShell(healthCfg.cmd, {}, resolved.repoPath)
-      : await pingHttp(
+      ? pingShellCheck(healthCfg.cmd, {}, resolved.repoPath, compose)
+      : pingHttp(
           healthCfg.url,
           env === "local" && plan.placement.runs !== "remote"
             ? HEALTH_CHECK_TIMEOUT_MS
             : HOSTED_HEALTH_CHECK_TIMEOUT_MS,
           plan.expect,
-        );
+        ),
+  );
 
   return {
     ...base,
     ...placed,
-    health: result.ok ? "ok" : "error",
+    health: healthState(result),
     healthDetail:
       result.error ??
       (!result.ok && result.status !== undefined