@synap-core/cli 1.12.2 → 1.13.0

package/dist/lib/openclaw.js

@@ -0,0 +1,165 @@
+/**
+ * OpenClaw detection and configuration utilities.
+ * Reads/writes OpenClaw config without modifying unrelated settings.
+ */
+import { existsSync, readFileSync, statSync } from "fs";
+import { writeSecretFile } from "./atomic-file.js";
+import { homedir } from "os";
+import { join } from "path";
+import { execSync } from "child_process";
+const OPENCLAW_DIR = join(homedir(), ".openclaw");
+const OPENCLAW_CONFIG = join(OPENCLAW_DIR, "openclaw.json");
+const OPENCLAW_SKILLS = join(OPENCLAW_DIR, "skills");
+export function detectOpenClaw() {
+    // Detection priority:
+    //   1. Docker container (most reliable — actively running state)
+    //   2. Local install (openclaw binary in PATH + ~/.openclaw dir)
+    //
+    // Why Docker first: the presence of ~/.openclaw on the host doesn't prove
+    // OpenClaw is installed locally — it may be a stray directory, or the
+    // Synap deploy dir may live in the same home. A running Docker container
+    // is a much stronger signal.
+    // ── Path 1: Docker container ───────────────────────────────────────────
+    const dockerInfo = detectOpenClawDocker();
+    if (dockerInfo)
+        return dockerInfo;
+    // ── Path 2: Local install (npm -g or npx) ─────────────────────────────
+    // Require BOTH ~/.openclaw AND an `openclaw` binary in PATH.
+    // ~/.openclaw alone is not enough (could be a leftover dir).
+    let localBinaryVersion;
+    try {
+        const out = execSync("openclaw --version 2>/dev/null", {
+            encoding: "utf-8",
+            timeout: 5000,
+        }).trim();
+        const match = out.match(/\d+\.\d+\.\d+/);
+        if (match)
+            localBinaryVersion = match[0];
+    }
+    catch {
+        // binary not in PATH — not a local install
+    }
+    if (existsSync(OPENCLAW_DIR) && localBinaryVersion) {
+        const info = {
+            found: true,
+            runtime: "local",
+            configPath: OPENCLAW_CONFIG,
+            skillsDir: OPENCLAW_SKILLS,
+            version: localBinaryVersion,
+        };
+        // Config
+        if (existsSync(OPENCLAW_CONFIG)) {
+            try {
+                info.config = JSON.parse(readFileSync(OPENCLAW_CONFIG, "utf-8"));
+            }
+            catch { /* corrupted */ }
+        }
+        // Gateway
+        const port = info.config?.gateway?.port ?? 18789;
+        info.gatewayPort = port;
+        try {
+            execSync(`curl -sf http://127.0.0.1:${port}/health >/dev/null 2>&1`, { timeout: 3000 });
+            info.gatewayRunning = true;
+        }
+        catch {
+            info.gatewayRunning = false;
+        }
+        return info;
+    }
+    return { found: false };
+}
+function detectOpenClawDocker() {
+    // (a) Check for a running container with "openclaw" in the name/image
+    let containerName = null;
+    let version;
+    try {
+        const psOut = execSync("docker ps --format '{{.Names}}\\t{{.Image}}' 2>/dev/null", { encoding: "utf-8", timeout: 4000 });
+        for (const line of psOut.split("\n")) {
+            if (/openclaw/i.test(line)) {
+                containerName = line.split("\t")[0]?.trim() ?? null;
+                // Extract version from image tag e.g. openclaw:2026.3.31
+                const verMatch = line.match(/:(\d{4}\.\d+\.\d+)/);
+                if (verMatch)
+                    version = verMatch[1];
+                break;
+            }
+        }
+    }
+    catch { /* docker not available */ }
+    // (b) Gateway probe — works even if container name doesn't match pattern
+    let gatewayRunning = false;
+    try {
+        execSync("curl -sf http://127.0.0.1:18789/health >/dev/null 2>&1", { timeout: 3000 });
+        gatewayRunning = true;
+    }
+    catch { /* not responding */ }
+    // Need at least one signal to claim found
+    if (!containerName && !gatewayRunning)
+        return null;
+    return {
+        found: true,
+        runtime: "docker",
+        containerName: containerName ?? "openclaw",
+        version,
+        gatewayRunning,
+        gatewayPort: 18789,
+        // No local config/skillsDir — they live inside the container volume
+        configPath: undefined,
+        skillsDir: undefined,
+    };
+}
+export function readOpenClawConfig() {
+    if (!existsSync(OPENCLAW_CONFIG))
+        return null;
+    try {
+        return JSON.parse(readFileSync(OPENCLAW_CONFIG, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function writeOpenClawConfig(config) {
+    writeSecretFile(OPENCLAW_CONFIG, JSON.stringify(config, null, 2) + "\n");
+}
+export function getConfigPermissions() {
+    try {
+        const stat = statSync(OPENCLAW_DIR);
+        const mode = (stat.mode & 0o777).toString(8);
+        return { mode, safe: (stat.mode & 0o077) === 0 }; // safe = no group/world perms
+    }
+    catch (err) {
+        // ENOENT = dir doesn't exist (Docker runtime — config lives in container volume)
+        const code = err?.code;
+        if (code === "ENOENT")
+            return { mode: "N/A", safe: true };
+        return { mode: "???", safe: false };
+    }
+}
+/**
+ * Get a nested config value safely.
+ */
+export function getConfigValue(config, path) {
+    const parts = path.split(".");
+    let current = config;
+    for (const part of parts) {
+        if (current == null || typeof current !== "object")
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+/**
+ * Set a nested config value.
+ */
+export function setConfigValue(config, path, value) {
+    const parts = path.split(".");
+    let current = config;
+    for (let i = 0; i < parts.length - 1; i++) {
+        if (!(parts[i] in current) || typeof current[parts[i]] !== "object") {
+            current[parts[i]] = {};
+        }
+        current = current[parts[i]];
+    }
+    current[parts[parts.length - 1]] = value;
+}
+//# sourceMappingURL=openclaw.js.map

package/dist/lib/openclaw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw.js","sourceRoot":"","sources":["../../src/lib/openclaw.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAgBzC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAClD,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAErD,MAAM,UAAU,cAAc;IAC5B,sBAAsB;IACtB,iEAAiE;IACjE,iEAAiE;IACjE,EAAE;IACF,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,6BAA6B;IAE7B,0EAA0E;IAC1E,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAC1C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,yEAAyE;IACzE,6DAA6D;IAC7D,6DAA6D;IAC7D,IAAI,kBAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,gCAAgC,EAAE;YACrD,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACzC,IAAI,KAAK;YAAE,kBAAkB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IAED,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAiB;YACzB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,OAAO;YAChB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,eAAe;YAC1B,OAAO,EAAE,kBAAkB;SAC5B,CAAC;QAEF,SAAS;QACT,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC7B,CAAC;QAED,UAAU;QACV,MAAM,IAAI,GAAI,IAAI,CAAC,MAAoE,EAAE,OAAO,EAAE,IAAI,IAAI,KAAK,CAAC;QAChH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,QAAQ,CAAC,6BAA6B,IAAI,yBAAyB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,oBAAoB;IAC3B,sEAAsE;IACtE,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,OAA2B,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CACpB,0DAA0D,EAC1D,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CACrC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;gBACpD,yDAAyD;gBACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBAClD,IAAI,QAAQ;oBAAE,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACpC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAEtC,yEAAyE;IACzE,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,CAAC,wDAAwD,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAEhC,0CAA0C;IAC1C,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAEnD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,QAAQ;QACjB,aAAa,EAAE,aAAa,IAAI,UAAU;QAC1C,OAAO;QACP,cAAc;QACd,WAAW,EAAE,KAAK;QAClB,oEAAoE;QACpE,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA+B;IACjE,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,8BAA8B;IAClF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,iFAAiF;QACjF,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA+B,EAC/B,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,MAAM,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA+B,EAC/B,IAAY,EACZ,KAAc;IAEd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAA4B,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAC3C,CAAC"}

package/dist/lib/pod-moved.d.ts

@@ -0,0 +1,70 @@
+/**
+ * A pod that moved to a new address.
+ *
+ * Hosted pods move from `{name}.synap.live` to `{name}.pod.synap.live`
+ * (Control Plane "tenant domains v2"). For 90 days the old name answers every
+ * request with a redirect to the new one. The CLI NEVER follows a redirect to
+ * another host for an API call: the request carries the pod key, and a
+ * redirect is something any server on the old name can send. Instead:
+ *
+ *   1. every pod call goes through `podFetch`, which refuses a cross-host
+ *      redirect with `PodMovedError` (one line: what happened, what to run);
+ *   2. `synap doctor` asks the Control Plane where the pod lives now —
+ *      `POST {cp}/pods/handshake {targetUrl: <old url>}` answers
+ *      `410 {code: "POD_MOVED", podId, podUrl, consoleUrl}` for a moved pod
+ *      (CP `src/routes/pods.ts`, `src/lib/pod-handshake-problem.ts`) —
+ *      and `synap doctor --fix` rewrites the saved profile through the one
+ *      door for a URL change (`synap pods update`).
+ *
+ * The new address comes ONLY from the Control Plane, never from the redirect.
+ */
+/** What to run when a pod has moved. */
+export declare const POD_MOVED_HINT = "Run: synap doctor --fix   (it finds the new address and updates your settings)";
+/** The one line a command prints when its pod has moved. */
+export declare function podMovedMessage(podUrl: string): string;
+export declare class PodMovedError extends Error {
+    /** The address the CLI holds (origin). */
+    readonly podUrl: string;
+    /** Where the old address redirected — informational only, never used. */
+    readonly redirectedTo: string;
+    constructor(podUrl: string, redirectedTo: string);
+}
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/**
+ * `fetch` for calls to a pod: redirects within the same host are followed (at
+ * most 5), a redirect to another host throws `PodMovedError`. Network errors
+ * propagate unchanged, so callers keep their own transport classification.
+ */
+export declare function podFetch(url: string, init?: RequestInit, fetchImpl?: FetchLike): Promise<Response>;
+/** What the Control Plane says about a pod address. */
+export type PodMoveAnswer = {
+    kind: "moved";
+    podUrl: string;
+    consoleUrl?: string;
+    podId?: string;
+}
+/** The CP knows this address as the pod's own (or knows nothing to move). */
+ | {
+    kind: "not-moved";
+    code?: string;
+}
+/** No Control Plane sign-in on this computer, or it expired. */
+ | {
+    kind: "signed-out";
+}
+/** The CP could not be asked, or answered something unreadable. */
+ | {
+    kind: "unknown";
+    reason: string;
+};
+/**
+ * Ask the Control Plane where a pod lives now. Needs the CP sign-in from
+ * `synap login` (a bearer token); without one the answer is `signed-out`.
+ */
+export declare function askControlPlaneWherePodIs(params: {
+    podUrl: string;
+    cpUrl: string;
+    cpToken: string | undefined;
+    fetchImpl?: FetchLike;
+}): Promise<PodMoveAnswer>;
+export {};

package/dist/lib/pod-moved.js

@@ -0,0 +1,146 @@
+/**
+ * A pod that moved to a new address.
+ *
+ * Hosted pods move from `{name}.synap.live` to `{name}.pod.synap.live`
+ * (Control Plane "tenant domains v2"). For 90 days the old name answers every
+ * request with a redirect to the new one. The CLI NEVER follows a redirect to
+ * another host for an API call: the request carries the pod key, and a
+ * redirect is something any server on the old name can send. Instead:
+ *
+ *   1. every pod call goes through `podFetch`, which refuses a cross-host
+ *      redirect with `PodMovedError` (one line: what happened, what to run);
+ *   2. `synap doctor` asks the Control Plane where the pod lives now —
+ *      `POST {cp}/pods/handshake {targetUrl: <old url>}` answers
+ *      `410 {code: "POD_MOVED", podId, podUrl, consoleUrl}` for a moved pod
+ *      (CP `src/routes/pods.ts`, `src/lib/pod-handshake-problem.ts`) —
+ *      and `synap doctor --fix` rewrites the saved profile through the one
+ *      door for a URL change (`synap pods update`).
+ *
+ * The new address comes ONLY from the Control Plane, never from the redirect.
+ */
+/** What to run when a pod has moved. */
+export const POD_MOVED_HINT = "Run: synap doctor --fix   (it finds the new address and updates your settings)";
+/** The one line a command prints when its pod has moved. */
+export function podMovedMessage(podUrl) {
+    return `The pod at ${podUrl} has a new address. Run: synap doctor --fix`;
+}
+export class PodMovedError extends Error {
+    /** The address the CLI holds (origin). */
+    podUrl;
+    /** Where the old address redirected — informational only, never used. */
+    redirectedTo;
+    constructor(podUrl, redirectedTo) {
+        super(podMovedMessage(podUrl));
+        this.name = "PodMovedError";
+        this.podUrl = podUrl;
+        this.redirectedTo = redirectedTo;
+    }
+}
+const MAX_SAME_HOST_HOPS = 5;
+function isRedirect(status) {
+    return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+/**
+ * A redirect the CLI may follow: the same origin, or the same host upgraded
+ * from http to https (default ports). Anything else is another host.
+ */
+function isSameHost(from, to) {
+    if (from.origin === to.origin)
+        return true;
+    return (from.protocol === "http:" &&
+        to.protocol === "https:" &&
+        from.hostname === to.hostname &&
+        from.port === "" &&
+        to.port === "");
+}
+/**
+ * `fetch` for calls to a pod: redirects within the same host are followed (at
+ * most 5), a redirect to another host throws `PodMovedError`. Network errors
+ * propagate unchanged, so callers keep their own transport classification.
+ */
+export async function podFetch(url, init = {}, fetchImpl = fetch) {
+    const start = new URL(url);
+    let current = start;
+    let currentInit = init;
+    for (let hop = 0;; hop++) {
+        const res = await fetchImpl(current.toString(), { ...currentInit, redirect: "manual" });
+        if (!isRedirect(res.status))
+            return res;
+        const location = res.headers.get("location");
+        if (!location)
+            return res;
+        let next;
+        try {
+            next = new URL(location, current);
+        }
+        catch {
+            return res;
+        }
+        if (!isSameHost(start, next)) {
+            throw new PodMovedError(start.origin, next.origin);
+        }
+        if (hop >= MAX_SAME_HOST_HOPS)
+            return res;
+        if (res.status === 303 && (currentInit.method ?? "GET").toUpperCase() !== "GET") {
+            const { body: _body, ...rest } = currentInit;
+            currentInit = { ...rest, method: "GET" };
+        }
+        current = next;
+    }
+}
+/**
+ * Ask the Control Plane where a pod lives now. Needs the CP sign-in from
+ * `synap login` (a bearer token); without one the answer is `signed-out`.
+ */
+export async function askControlPlaneWherePodIs(params) {
+    if (!params.cpToken)
+        return { kind: "signed-out" };
+    const fetchImpl = params.fetchImpl ?? fetch;
+    let res;
+    try {
+        res = await fetchImpl(`${params.cpUrl.replace(/\/+$/, "")}/pods/handshake`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${params.cpToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ targetUrl: params.podUrl }),
+            redirect: "manual",
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch (err) {
+        return { kind: "unknown", reason: err instanceof Error ? err.message : String(err) };
+    }
+    if (res.status === 401)
+        return { kind: "signed-out" };
+    const body = (await res.json().catch(() => null));
+    if (res.status === 410 && body?.code === "POD_MOVED") {
+        const podUrl = typeof body.podUrl === "string" ? safeHttpsOrigin(body.podUrl) : null;
+        if (!podUrl)
+            return { kind: "unknown", reason: "the Control Plane named no usable new address" };
+        return {
+            kind: "moved",
+            podUrl,
+            ...(typeof body.consoleUrl === "string" ? { consoleUrl: body.consoleUrl } : {}),
+            ...(typeof body.podId === "string" ? { podId: body.podId } : {}),
+        };
+    }
+    if (res.ok || res.status === 403 || res.status === 409) {
+        return { kind: "not-moved", ...(typeof body?.code === "string" ? { code: body.code } : {}) };
+    }
+    return { kind: "unknown", reason: `the Control Plane answered ${res.status}` };
+}
+/** An https origin, or null. A new pod address is never plain http. */
+function safeHttpsOrigin(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:" || url.username || url.password)
+            return null;
+        return url.origin;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=pod-moved.js.map

package/dist/lib/pod-moved.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pod-moved.js","sourceRoot":"","sources":["../../src/lib/pod-moved.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,gFAAgF,CAAC;AAE/G,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,cAAc,MAAM,6CAA6C,CAAC;AAC3E,CAAC;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,0CAA0C;IACjC,MAAM,CAAS;IACxB,yEAAyE;IAChE,YAAY,CAAS;IAE9B,YAAY,MAAc,EAAE,YAAoB;QAC9C,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,IAAS,EAAE,EAAO;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,CACL,IAAI,CAAC,QAAQ,KAAK,OAAO;QACzB,EAAE,CAAC,QAAQ,KAAK,QAAQ;QACxB,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ;QAC7B,IAAI,CAAC,IAAI,KAAK,EAAE;QAChB,EAAE,CAAC,IAAI,KAAK,EAAE,CACf,CAAC;AACJ,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,OAAoB,EAAE,EACtB,YAAuB,KAAK;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAgB,IAAI,CAAC;IACpC,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,OAAO,GAAG,CAAC;QAC1B,IAAI,IAAS,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,GAAG,IAAI,kBAAkB;YAAE,OAAO,GAAG,CAAC;QAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YAChF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,WAAW,CAAC;YAC7C,WAAW,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;AACH,CAAC;AAYD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAK/C;IACC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IAC5C,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,CAAC,OAAO,EAAE;gBACzC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAClD,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAKxC,CAAC;IACT,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;QACjG,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM;YACN,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,8BAA8B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;AACjF,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3E,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/pod-reach.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Why a pod probe failed, told apart: the network between this machine and the
+ * pod (egress proxy, DNS, firewall, TLS) versus the pod itself answering badly.
+ *
+ * `checkPodHealth` used to fold every failure into `healthy: false`, so `synap
+ * init` behind an egress proxy that answers 403 to CONNECT printed a pod-side
+ * checklist ("is the container running?") for a pod that was never contacted.
+ * This is the one place that taxonomy lives for the probe.
+ */
+export type ReachKind = 
+/** An egress proxy refused the CONNECT tunnel — the pod was never contacted. */
+"proxy"
+/** DNS, refused, reset, unroutable, timeout, TLS — no HTTP answer from anything. */
+ | "network"
+/** The pod host answered, but not with a healthy /health. */
+ | "pod";
+export interface ReachFailure {
+    kind: ReachKind;
+    /** The underlying error, one line: status / error code / message. */
+    detail: string;
+    /** Env variable whose proxy this process used, with credentials stripped. */
+    proxy?: {
+        env: string;
+        url: string;
+    };
+}
+/** The env proxy that applies to `podUrl`, credentials removed. Honors NO_PROXY. */
+export declare function proxyInUse(podUrl: string, env?: NodeJS.ProcessEnv): {
+    env: string;
+    url: string;
+} | undefined;
+/** Classify a fetch that threw (no HTTP answer from the pod). */
+export declare function classifyFetchError(err: unknown, podUrl: string, env?: NodeJS.ProcessEnv): ReachFailure;
+/** Classify a /health that answered with a non-2xx status. */
+export declare function classifyHttpStatus(status: number, podUrl: string, env?: NodeJS.ProcessEnv): ReachFailure;
+/** The lines `synap init` / `synap doctor` print under "not reachable", by cause. */
+export declare function reachChecklist(f: ReachFailure | undefined): string[];
+/** The one-line headline: names the underlying error, not just "not reachable". */
+export declare function unreachableMessage(podUrl: string, failure?: ReachFailure): string;

package/dist/lib/pod-reach.js

@@ -0,0 +1,117 @@
+/**
+ * Why a pod probe failed, told apart: the network between this machine and the
+ * pod (egress proxy, DNS, firewall, TLS) versus the pod itself answering badly.
+ *
+ * `checkPodHealth` used to fold every failure into `healthy: false`, so `synap
+ * init` behind an egress proxy that answers 403 to CONNECT printed a pod-side
+ * checklist ("is the container running?") for a pod that was never contacted.
+ * This is the one place that taxonomy lives for the probe.
+ */
+const PROXY_ENV = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy", "ALL_PROXY", "all_proxy"];
+/** The env proxy that applies to `podUrl`, credentials removed. Honors NO_PROXY. */
+export function proxyInUse(podUrl, env = process.env) {
+    let target;
+    try {
+        target = new URL(podUrl);
+    }
+    catch {
+        return undefined;
+    }
+    const noProxy = (env.NO_PROXY ?? env.no_proxy ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+    const bypass = noProxy.some((p) => p === "*" ||
+        target.hostname === p.replace(/^\./, "") ||
+        target.hostname.endsWith(p.startsWith(".") ? p : `.${p}`));
+    if (bypass)
+        return undefined;
+    const order = target.protocol === "https:" ? PROXY_ENV : [...PROXY_ENV.slice(2, 4), ...PROXY_ENV.slice(0, 2), ...PROXY_ENV.slice(4)];
+    for (const name of order) {
+        const raw = env[name];
+        if (!raw)
+            continue;
+        try {
+            const u = new URL(raw);
+            u.username = "";
+            u.password = "";
+            return { env: name, url: u.origin };
+        }
+        catch {
+            return { env: name, url: "(unparseable)" };
+        }
+    }
+    return undefined;
+}
+function codeOf(err) {
+    const cause = err?.cause;
+    for (const e of [cause, err]) {
+        const c = e?.code;
+        if (typeof c === "string")
+            return c;
+    }
+    return "";
+}
+/** Classify a fetch that threw (no HTTP answer from the pod). */
+export function classifyFetchError(err, podUrl, env = process.env) {
+    const proxy = proxyInUse(podUrl, env);
+    const cause = err?.cause;
+    const message = [cause?.message, err instanceof Error ? err.message : String(err)].filter(Boolean)[0] ?? "unknown error";
+    const code = codeOf(err);
+    // undici's ProxyAgent: "Proxy response (403) !== 200 when HTTP Tunneling";
+    // Node's env-proxy support surfaces "Tunnel ... 403" / ERR_PROXY_TUNNEL.
+    const tunnel = /proxy response \((\d{3})\)|tunnel.*?(\d{3})|ERR_PROXY_TUNNEL/i.exec(`${code} ${message}`);
+    if (tunnel || code === "UND_ERR_PRX_TLS" || code === "ERR_PROXY_TUNNEL") {
+        const status = tunnel?.[1] ?? tunnel?.[2];
+        return {
+            kind: "proxy",
+            detail: status ? `the egress proxy refused the tunnel (HTTP ${status} to CONNECT)` : `the egress proxy refused the tunnel (${message})`,
+            proxy,
+        };
+    }
+    const name = err instanceof Error ? err.name : "";
+    const label = code || (name === "TimeoutError" || name === "AbortError" ? "TIMEOUT" : message);
+    return {
+        kind: "network",
+        detail: `${label}${label === message ? "" : `: ${message}`}`,
+        proxy,
+    };
+}
+/** Classify a /health that answered with a non-2xx status. */
+export function classifyHttpStatus(status, podUrl, env = process.env) {
+    return { kind: "pod", detail: `/health answered HTTP ${status}`, proxy: proxyInUse(podUrl, env) };
+}
+/** The lines `synap init` / `synap doctor` print under "not reachable", by cause. */
+export function reachChecklist(f) {
+    const proxyLine = f?.proxy ? [`Proxy in use: ${f.proxy.url} (from ${f.proxy.env})`] : [];
+    if (f?.kind === "proxy") {
+        return [
+            ...proxyLine,
+            "Your network's egress proxy blocked the connection. The pod was not contacted.",
+            "- Ask the proxy's owner to allow CONNECT to the pod host (port 443).",
+            "- Or bypass the proxy for it: export NO_PROXY=<pod-host>",
+        ];
+    }
+    if (f?.kind === "network") {
+        return [
+            ...proxyLine,
+            "This machine could not reach the pod host. The pod itself may be fine.",
+            "- Is the pod URL correct? (scheme + host + port)",
+            "- Are you online, on the right network/VPN, behind a firewall or proxy?",
+            "- Can you open the URL in a browser from this machine?",
+        ];
+    }
+    return [
+        ...proxyLine,
+        "- Is the pod URL correct? (scheme + host + port)",
+        "- Is the pod container running? On the server: ./synap health",
+        "- Is there a firewall or reverse proxy in the way?",
+        "- For localhost setups, did you start the stack? ./synap start",
+    ];
+}
+/** The one-line headline: names the underlying error, not just "not reachable". */
+export function unreachableMessage(podUrl, failure) {
+    if (!failure)
+        return `Pod at ${podUrl} is not reachable.`;
+    return failure.kind === "pod"
+        ? `Pod at ${podUrl} is not healthy: ${failure.detail}.`
+        : `Could not reach ${podUrl}: ${failure.detail}.`;
+}
+//# sourceMappingURL=pod-reach.js.map

package/dist/lib/pod-reach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pod-reach.js","sourceRoot":"","sources":["../../src/lib/pod-reach.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkBH,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAEvG,oFAAoF;AACpF,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,GAAG;QACT,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAC5D,CAAC;IACF,IAAI,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrI,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;YAChB,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,KAAK,GAAI,GAAkC,EAAE,KAAK,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAI,CAA2C,EAAE,IAAI,CAAC;QAC7D,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACnG,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAI,GAA+C,EAAE,KAAK,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;IACzH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,MAAM,GAAG,+DAA+D,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;IAC1G,IAAI,MAAM,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,6CAA6C,MAAM,cAAc,CAAC,CAAC,CAAC,wCAAwC,OAAO,GAAG;YACvI,KAAK;SACN,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/F,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,GAAG,KAAK,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,EAAE;QAC5D,KAAK;KACN,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACrG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,CAA2B;IACxD,MAAM,SAAS,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;YACL,GAAG,SAAS;YACZ,gFAAgF;YAChF,sEAAsE;YACtE,0DAA0D;SAC3D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,GAAG,SAAS;YACZ,wEAAwE;YACxE,kDAAkD;YAClD,yEAAyE;YACzE,wDAAwD;SACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,SAAS;QACZ,kDAAkD;QAClD,+DAA+D;QAC/D,oDAAoD;QACpD,gEAAgE;KACjE,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAAsB;IACvE,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,MAAM,oBAAoB,CAAC;IAC1D,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK;QAC3B,CAAC,CAAC,UAAU,MAAM,oBAAoB,OAAO,CAAC,MAAM,GAAG;QACvD,CAAC,CAAC,mBAAmB,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;AACtD,CAAC"}

package/dist/lib/pod-reach.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/pod-reach.test.js

@@ -0,0 +1,67 @@
+import { describe, expect, it, vi, afterEach } from "vitest";
+import { checkPodHealth } from "./pod.js";
+import { classifyFetchError, proxyInUse, reachChecklist, unreachableMessage } from "./pod-reach.js";
+const POD = "https://pod.example.com";
+/** What undici throws when the proxy answers CONNECT with 403. */
+function proxy403() {
+    const err = new TypeError("fetch failed");
+    err.cause = Object.assign(new Error("Proxy response (403) !== 200 when HTTP Tunneling"), {
+        code: "UND_ERR_PRX_TUNNEL",
+    });
+    return err;
+}
+function refused() {
+    const err = new TypeError("fetch failed");
+    err.cause = Object.assign(new Error("connect ECONNREFUSED 127.0.0.1:443"), { code: "ECONNREFUSED" });
+    return err;
+}
+afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.unstubAllEnvs();
+});
+describe("classifyFetchError", () => {
+    it("a proxy 403 on CONNECT is a proxy failure naming the status and the env proxy used", () => {
+        const f = classifyFetchError(proxy403(), POD, { HTTPS_PROXY: "http://user:secret@egress.corp:3128" });
+        expect(f.kind).toBe("proxy");
+        expect(f.detail).toContain("403");
+        expect(f.proxy).toEqual({ env: "HTTPS_PROXY", url: "http://egress.corp:3128" });
+        expect(JSON.stringify(f)).not.toContain("secret");
+    });
+    it("ECONNREFUSED is a network failure that names the code", () => {
+        const f = classifyFetchError(refused(), POD, {});
+        expect(f.kind).toBe("network");
+        expect(f.detail).toContain("ECONNREFUSED");
+        expect(f.proxy).toBeUndefined();
+    });
+    it("NO_PROXY bypass means no proxy is reported", () => {
+        expect(proxyInUse(POD, { HTTPS_PROXY: "http://egress:3128", NO_PROXY: ".example.com" })).toBeUndefined();
+    });
+});
+describe("checkPodHealth carries the cause", () => {
+    it("proxy 403: not healthy, failure.kind proxy", async () => {
+        vi.stubGlobal("fetch", vi.fn().mockRejectedValue(proxy403()));
+        const h = await checkPodHealth(POD);
+        expect(h.healthy).toBe(false);
+        expect(h.failure?.kind).toBe("proxy");
+    });
+    it("pod answering 503: failure.kind pod", async () => {
+        vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response("down", { status: 503 })));
+        const h = await checkPodHealth(POD);
+        expect(h.failure).toMatchObject({ kind: "pod", detail: "/health answered HTTP 503" });
+    });
+});
+describe("init message and checklist branch on the cause", () => {
+    it("proxy failure: headline has the status; checklist is not the pod-container list", () => {
+        const f = classifyFetchError(proxy403(), POD, { HTTPS_PROXY: "http://egress.corp:3128" });
+        expect(unreachableMessage(POD, f)).toContain("403");
+        const list = reachChecklist(f).join("\n");
+        expect(list).toContain("HTTPS_PROXY");
+        expect(list).toContain("NO_PROXY");
+        expect(list).not.toContain("container running");
+    });
+    it("pod failure keeps the pod-side checklist", () => {
+        const list = reachChecklist({ kind: "pod", detail: "/health answered HTTP 503" }).join("\n");
+        expect(list).toContain("container running");
+    });
+});
+//# sourceMappingURL=pod-reach.test.js.map

package/dist/lib/pod-reach.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pod-reach.test.js","sourceRoot":"","sources":["../../src/lib/pod-reach.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpG,MAAM,GAAG,GAAG,yBAAyB,CAAC;AAEtC,kEAAkE;AAClE,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC;IACzC,GAA2B,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,EAAE;QAChH,IAAI,EAAE,oBAAoB;KAC3B,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC;IACzC,GAA2B,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9H,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;IACtB,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACtG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3G,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}