ollanet 0.6.23 → 0.7.0

package/dist/funnel.js

@@ -0,0 +1,195 @@
+/**
+ * Tailscale Funnel for `ollanet serve --funnel`.
+ *
+ * Shells out to the `tailscale` CLI (override with OLLANET_TAILSCALE_BIN; a
+ * .js/.mjs/.cjs path runs under node). Every call has a timeout, and the exec
+ * functions are injectable so tests never touch a real tailnet.
+ */
+import { spawn, spawnSync } from "node:child_process";
+export const FUNNEL_PORTS = [443, 8443, 10000];
+export const HTTPS_ADMIN_URL = "https://login.tailscale.com/admin/dns";
+export const FUNNEL_DOCS_URL = "https://tailscale.com/kb/1223/funnel";
+const ENABLE_URL_RE = /https:\/\/login\.tailscale\.com\/[^\s"'<>]+/;
+function tailscaleCommand() {
+    const bin = process.env.OLLANET_TAILSCALE_BIN?.trim() || "tailscale";
+    if (/\.(c|m)?js$/i.test(bin))
+        return { cmd: process.execPath, prefix: [bin] };
+    return { cmd: bin, prefix: [] };
+}
+export const defaultExec = (args, opts) => new Promise((resolve) => {
+    const { cmd, prefix } = tailscaleCommand();
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    const child = spawn(cmd, [...prefix, ...args], { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+    const finish = (r) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        resolve({ code: null, stdout, stderr, timedOut, missing: false, ...r });
+    };
+    const check = () => {
+        if (opts.until && opts.until.test(`${stdout}\n${stderr}`))
+            child.kill();
+    };
+    child.stdout.on("data", (d) => {
+        stdout += d;
+        check();
+    });
+    child.stderr.on("data", (d) => {
+        stderr += d;
+        check();
+    });
+    child.on("error", (err) => {
+        finish({ missing: err.code === "ENOENT", stderr: stderr || err.message });
+    });
+    child.on("close", (code) => finish({ code }));
+    const timer = setTimeout(() => {
+        timedOut = true;
+        child.kill();
+    }, opts.timeoutMs);
+});
+export const defaultExecSync = (args, opts) => {
+    const { cmd, prefix } = tailscaleCommand();
+    const r = spawnSync(cmd, [...prefix, ...args], {
+        encoding: "utf8",
+        timeout: opts.timeoutMs,
+        windowsHide: true,
+    });
+    const err = r.error;
+    return {
+        code: r.status,
+        stdout: r.stdout ?? "",
+        stderr: r.stderr ?? err?.message ?? "",
+        timedOut: err?.code === "ETIMEDOUT",
+        missing: err?.code === "ENOENT",
+    };
+};
+/** A Funnel setup problem with a message meant for the person at the terminal. */
+export class FunnelError extends Error {
+    enableUrl;
+    constructor(message, enableUrl) {
+        super(message);
+        this.enableUrl = enableUrl;
+    }
+}
+function firstLine(text) {
+    return text.split(/\r?\n/).find((l) => l.trim())?.trim() ?? "";
+}
+export function hasFunnelCap(self) {
+    const keys = [...Object.keys(self?.CapMap ?? {}), ...(self?.Capabilities ?? [])];
+    return keys.some((k) => {
+        const key = k.toLowerCase();
+        return key === "funnel" || key.startsWith("https://tailscale.com/cap/funnel");
+    });
+}
+/** `tailscale status --json`: installed, running, MagicDNS name, HTTPS certs, Funnel attr. */
+export async function preflight(exec = defaultExec) {
+    const r = await exec(["status", "--json"], { timeoutMs: 10_000 });
+    if (r.missing) {
+        throw new FunnelError("tailscale CLI not found. Install Tailscale (https://tailscale.com/download) or set OLLANET_TAILSCALE_BIN.");
+    }
+    if (r.timedOut)
+        throw new FunnelError("tailscale status --json timed out.");
+    let status;
+    try {
+        status = JSON.parse(r.stdout);
+    }
+    catch {
+        throw new FunnelError(`tailscale status --json failed${r.stderr ? `: ${firstLine(r.stderr)}` : ` (exit ${r.code})`}`);
+    }
+    if (status.BackendState !== "Running") {
+        throw new FunnelError(`Tailscale is not running (state: ${status.BackendState ?? "unknown"}). Run: tailscale up`);
+    }
+    const dnsName = (status.Self?.DNSName ?? "").replace(/\.$/, "");
+    if (!dnsName) {
+        throw new FunnelError(`This device has no MagicDNS name. Turn on MagicDNS at ${HTTPS_ADMIN_URL}, then retry.`);
+    }
+    if (!Array.isArray(status.CertDomains) || status.CertDomains.length === 0) {
+        throw new FunnelError(`HTTPS certificates are off for your tailnet. Turn on "HTTPS Certificates" at ${HTTPS_ADMIN_URL}, then retry.`);
+    }
+    return { dnsName, funnelAllowed: hasFunnelCap(status.Self) };
+}
+export function funnelOnArgs(funnelPort, target) {
+    return ["funnel", "--bg", `--https=${funnelPort}`, target];
+}
+export function funnelOffArgs(funnelPort) {
+    return ["funnel", `--https=${funnelPort}`, "off"];
+}
+export function publicUrl(dnsName, funnelPort) {
+    return `https://${dnsName}${funnelPort === 443 ? "" : `:${funnelPort}`}/`;
+}
+/**
+ * What `tailscale funnel status --json` serves at https://<dns>:<port>/.
+ * Returns the proxy target, null when nothing is configured there, or
+ * undefined when the status could not be read.
+ */
+export async function currentHandler(exec, dnsName, funnelPort) {
+    const r = await exec(["funnel", "status", "--json"], { timeoutMs: 10_000 });
+    if (r.code !== 0)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(r.stdout || "{}");
+    }
+    catch {
+        return undefined;
+    }
+    const web = parsed.Web?.[`${dnsName}:${funnelPort}`];
+    const root = web?.Handlers?.["/"];
+    if (!web || !root)
+        return null;
+    return root.Proxy ?? root.Path ?? root.Text ?? "(non-proxy handler)";
+}
+function isOurTarget(handler, localPort) {
+    const m = /^(?:https?:\/\/)?(127\.0\.0\.1|localhost|\[::1\])?:?(\d+)\/?$/i.exec(handler.trim());
+    return !!m && Number(m[2]) === localPort;
+}
+export async function startFunnel(opts) {
+    const exec = opts.exec ?? defaultExec;
+    const execSync = opts.execSync ?? defaultExecSync;
+    if (!FUNNEL_PORTS.includes(opts.funnelPort)) {
+        throw new FunnelError(`--funnel-port must be one of ${FUNNEL_PORTS.join(", ")} (got ${opts.funnelPort}).`);
+    }
+    const pre = await preflight(exec);
+    const url = publicUrl(pre.dnsName, opts.funnelPort);
+    const existing = await currentHandler(exec, pre.dnsName, opts.funnelPort);
+    if (existing && isOurTarget(existing, opts.localPort)) {
+        return { publicUrl: url, added: false, stop: () => { } };
+    }
+    if (existing) {
+        throw new FunnelError(`${url} already serves ${existing}. ollanet will not replace it. ` +
+            `Pick another --funnel-port (${FUNNEL_PORTS.join(", ")}) or remove it with: tailscale funnel --https=${opts.funnelPort} off`);
+    }
+    const r = await exec(funnelOnArgs(opts.funnelPort, opts.target), {
+        timeoutMs: opts.timeoutMs ?? 30_000,
+        until: /To enable, visit|login\.tailscale\.com\/f\/funnel/i,
+    });
+    const output = `${r.stdout}\n${r.stderr}`;
+    const enableUrl = ENABLE_URL_RE.exec(output)?.[0];
+    if (enableUrl || (!pre.funnelAllowed && r.code !== 0)) {
+        throw new FunnelError(enableUrl
+            ? `Funnel is not enabled for this device. Approve it at ${enableUrl} , then run this again.`
+            : `Funnel is not enabled for this device. Add the "funnel" node attribute in your tailnet policy (${FUNNEL_DOCS_URL}), then run this again.`, enableUrl);
+    }
+    if (r.missing)
+        throw new FunnelError("tailscale CLI not found.");
+    if (r.code !== 0) {
+        throw new FunnelError(r.timedOut
+            ? "tailscale funnel did not finish in time. Check tailscale funnel status."
+            : `tailscale funnel failed: ${firstLine(r.stderr) || firstLine(r.stdout) || `exit ${r.code}`}`);
+    }
+    let stopped = false;
+    return {
+        publicUrl: url,
+        added: true,
+        stop: () => {
+            if (stopped)
+                return;
+            stopped = true;
+            execSync(funnelOffArgs(opts.funnelPort), { timeoutMs: 10_000 });
+        },
+    };
+}

package/dist/help.js

@@ -13,6 +13,7 @@ const LOADERS = {
     bench: () => import("./bench.js"),
     alias: () => import("./alias.js"),
     mcp: () => import("./mcp.js"),
+    serve: () => import("./serve.js"),
 };
 const ALIASES = {
     "ls-servers": "scan",

package/dist/index.d.ts

@@ -8,7 +8,7 @@
  *   const { servers } = await scanNetwork({ lanScan: false });
  */
 export { scanNetwork } from "./scan.js";
-export type { ScanOptions, ScanPayload, ScannedServer, ScanFailure } from "./scan.js";
+export type { ScanOptions, ScanPayload, ScannedServer, ScanFailure, ScanFailureCode, } from "./scan.js";
 export { lastScan, lastScanPath, loadLastScan } from "./scan-store.js";
 export type { StoredScan } from "./scan-store.js";
 export { discoverHosts, foldLocalHosts, resolveHost, ollamaBaseUrl, shortName, ollamaPort, } from "./hosts.js";

package/dist/mcp.js

@@ -22,7 +22,7 @@ import { removeModel } from "./rm.js";
 import { lastScan } from "./scan-store.js";
 import { scanNetwork } from "./scan.js";
 import { showModel } from "./show.js";
-import { isHelpFlag, printHelp } from "./argv.js";
+import { isHelpFlag, isQuiet, printHelp } from "./argv.js";
 // Pin to the oldest widely-supported MCP revision. Clients may request a newer
 // date; we still answer with this — legal negotiation, max compatibility.
 const PROTOCOL_VERSION = "2024-11-05";
@@ -56,7 +56,7 @@ const TOOLS = [
         description: "Discover configured or selected Ollama hosts and list their models. " +
             "A responding host is reachable, not automatically trusted. " +
             "Optional LAN TCP scan is off unless lan=true (CLI --lan). " +
-            "all=true also probes offline Tailscale peers.",
+            "all=true also lists offline Tailscale peers as offline (they are not probed).",
         inputSchema: {
             type: "object",
             properties: {
@@ -66,7 +66,7 @@ const TOOLS = [
                 },
                 all: {
                     type: "boolean",
-                    description: "Also probe offline Tailscale peers (default false)",
+                    description: "Also list offline Tailscale peers, marked offline and not probed (default false)",
                 },
                 last: {
                     type: "boolean",
@@ -547,7 +547,9 @@ export async function main() {
         printHelp(helpText());
     }
     const version = await packageVersion();
-    console.error(`ollanet mcp ${version} (stdio) — tools: ${TOOLS.map((t) => t.name).join(", ")}`);
+    if (!isQuiet()) {
+        console.error(`ollanet mcp ${version} (stdio) — tools: ${TOOLS.map((t) => t.name).join(", ")}`);
+    }
     const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
     for await (const line of rl) {
         const trimmed = line.trim();

package/dist/prompt.d.ts

@@ -14,6 +14,14 @@
 import { type AppConfig, type GenerateSettings } from "./config.js";
 export declare function helpText(): string;
 export declare function readStdinIfPiped(): Promise<string>;
+/**
+ * `--stdin` / `-`: read stdin to EOF with no time limit, so slow producers
+ * (`slow-cmd | ollanet prompt host --stdin`) work. Waits for the writer to
+ * close the pipe (Ctrl+D / Ctrl+Z on a terminal).
+ */
+export declare function readStdinToEnd(): Promise<string>;
+/** Read the prompt from stdin: to EOF with --stdin, else the 100ms heuristic. */
+export declare function readPromptStdin(explicit: boolean): Promise<string>;
 export interface PromptRunOptions {
     machine?: string;
     model?: string;

package/dist/prompt.js

@@ -17,7 +17,7 @@ import { configPath, defaultModelForHost, loadConfig, lookupAlias, machineSettin
 import { envInt, findDiscoveredHost, ollamaBaseUrl, resolveHost, shortName, } from "./hosts.js";
 import { ollamaChat } from "./ollama-chat.js";
 import { assemblePrompt, readPromptFile } from "./prompt-input.js";
-import { consumeSettingsFlag, failUsage, isHelpFlag, printHelp, takeFlag, takeValue } from "./argv.js";
+import { consumeSettingsFlag, failUsage, isHelpFlag, isQuiet, printHelp, takeFlag, takeValue, } from "./argv.js";
 import { listTargets, resolveTarget } from "./target.js";
 /** Prompt/chat HTTP timeout (ms). 0 = no timeout. Separate from scan's OLLAMA_TIMEOUT_MS. */
 function promptTimeoutMs() {
@@ -28,6 +28,7 @@ export function helpText() {
   ollanet prompt <machine> [model] <prompt...>
   ollanet prompt --chat <hash> <prompt...>
   ollanet prompt <machine> --chat <hash> <prompt...>
+  <command> | ollanet prompt <machine> [model] --stdin
 
 Examples:
   ollanet prompt localhost "Explain MagicDNS"
@@ -62,8 +63,12 @@ Options:
   --think                Enable model thinking (qwen3 etc.); streams to stderr
   --no-think             Disable thinking (default) so tokens go to the reply
   --file <path>          Prompt from a .txt or .md file (joins argv / stdin)
+  --stdin, -             Wait for stdin to close and use it (no 100ms cutoff;
+                         for slow producers). Without it, piped stdin is used
+                         only if data arrives within 100ms.
   --no-stream            Wait for the full response
-  --json                 Emit final response JSON (implies --no-stream)`;
+  --json                 Emit final response JSON (implies --no-stream)
+  -q, --quiet            Reply only; no host line, chat id, or stats on stderr`;
 }
 function usage() {
     failUsage(helpText());
@@ -138,6 +143,7 @@ function parseArgs(argv) {
     let stream = true;
     let json = false;
     let save = true;
+    let stdin = false;
     const settings = {};
     const positional = [];
     while (args.length > 0) {
@@ -146,6 +152,10 @@ function parseArgs(argv) {
             continue;
         if (isHelpFlag(arg))
             printHelp(helpText());
+        if (arg === "--stdin" || arg === "-") {
+            stdin = true;
+            continue;
+        }
         if (arg === "--no-stream") {
             stream = false;
             continue;
@@ -212,7 +222,7 @@ function parseArgs(argv) {
     }
     // Continue (--chat): all positionals are the prompt. Optional machine override
     // via --machine, or a leading discovered-host name peeled in main().
-    return { machine, model, promptParts, file, stream, json, save, chatId, settings };
+    return { machine, model, promptParts, file, stream, json, save, stdin, chatId, settings };
 }
 export async function readStdinIfPiped() {
     if (stdinStream.isTTY)
@@ -247,12 +257,29 @@ export async function readStdinIfPiped() {
         stdinStream.destroy();
         return "";
     }
+    return readStdinToEnd();
+}
+/**
+ * `--stdin` / `-`: read stdin to EOF with no time limit, so slow producers
+ * (`slow-cmd | ollanet prompt host --stdin`) work. Waits for the writer to
+ * close the pipe (Ctrl+D / Ctrl+Z on a terminal).
+ */
+export async function readStdinToEnd() {
     const chunks = [];
     for await (const chunk of stdinStream) {
         chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
     }
     return Buffer.concat(chunks).toString("utf8").trim();
 }
+/** Read the prompt from stdin: to EOF with --stdin, else the 100ms heuristic. */
+export async function readPromptStdin(explicit) {
+    if (!explicit)
+        return readStdinIfPiped();
+    const text = await readStdinToEnd();
+    if (!text)
+        throw new Error("--stdin was given but stdin was empty.");
+    return text;
+}
 async function generateTopic(opts) {
     const fallback = topicFromPrompt(opts.prompt);
     try {
@@ -417,7 +444,15 @@ export async function main() {
     const parsed = parseArgs(process.argv.slice(2));
     const { stream, json, save } = parsed;
     let promptParts = parsed.promptParts;
-    const fromStdin = await readStdinIfPiped();
+    let fromStdin;
+    try {
+        fromStdin = await readPromptStdin(parsed.stdin);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exitCode = 1;
+        return;
+    }
     let fromFile = "";
     if (parsed.file) {
         try {
@@ -478,7 +513,7 @@ export async function main() {
             settings: parsed.settings,
             writeStdout: !json,
             stream: json ? false : stream,
-            quiet: json,
+            quiet: json || isQuiet(),
             config,
         });
         if (json) {
@@ -499,7 +534,7 @@ export async function main() {
                 : "",
             chunk.total_duration ? formatDuration(Number(chunk.total_duration)) : "",
         ].filter(Boolean);
-        if (stats.length > 0) {
+        if (stats.length > 0 && !isQuiet()) {
             console.error(`(${stats.join(" · ")})`);
         }
     }

package/dist/pull.js

@@ -9,7 +9,7 @@
 import { expandMachineModel, loadConfig } from "./config.js";
 import { envInt, ollamaBaseUrl, shortName } from "./hosts.js";
 import { ollamaPull } from "./ollama-chat.js";
-import { failUsage, isHelpFlag, printHelp, takeFlag } from "./argv.js";
+import { failUsage, isHelpFlag, isQuiet, printHelp, takeFlag } from "./argv.js";
 import { resolveTarget } from "./target.js";
 /** Pull HTTP timeout (ms). 0 = none. Large models can take hours. */
 function pullTimeoutMs() {
@@ -36,7 +36,8 @@ Options:
   --model <name>     Model to pull (e.g. gemma3:12b)
   --insecure         Allow HTTP / self-signed model registries
   --no-stream        Wait for a single final response (no progress chunks)
-  --json             Emit result JSON on stdout`;
+  --json             Emit result JSON on stdout
+  -q, --quiet        Result line only; no progress or next-step hint on stderr`;
 }
 function usage() {
     failUsage(helpText());
@@ -189,7 +190,7 @@ export async function main() {
         insecure: parsed.insecure,
         stream: parsed.stream,
         writeStdout: true,
-        quiet: false,
+        quiet: isQuiet(),
         config,
     });
     if (parsed.json) {
@@ -197,5 +198,6 @@ export async function main() {
         return;
     }
     process.stdout.write(`pulled ${result.model} on ${result.machine}\n`);
-    process.stderr.write(`${result.next.hint}\n${result.next.site}\n`);
+    if (!isQuiet())
+        process.stderr.write(`${result.next.hint}\n${result.next.site}\n`);
 }

package/dist/scan.d.ts

@@ -4,7 +4,16 @@
  * Usage: ollanet scan [--lan] [--json] [--all] [--last]
  */
 import { type AppConfig } from "./config.js";
+/**
+ * Turn a failed /api/tags probe into a short reason. Node's fetch reports
+ * socket errors as a bare "fetch failed" with the real code on `cause`.
+ */
+export declare function describeProbeError(err: unknown, timeoutMs: number): {
+    error: string;
+    code: ScanFailureCode;
+};
 export interface ScanOptions {
+    /** List offline Tailscale peers as `offline` failures (they are not probed). */
     includeOffline?: boolean;
     /** TCP-scan local /24s for Ollama (port 11434 by default). Off unless set. */
     lanScan?: boolean;
@@ -41,10 +50,21 @@ export interface ScannedServer {
         tuned: boolean;
     }>;
 }
+/**
+ * Why a host did not answer as Ollama. `offline` = Tailscale peer marked
+ * offline (not probed); `http` / `not-ollama` = something answered, but not
+ * an Ollama API; `error` = anything else (see `error` text).
+ */
+export type ScanFailureCode = "timeout" | "refused" | "reset" | "unreachable" | "dns" | "http" | "not-ollama" | "offline" | "error";
 export interface ScanFailure {
     name: string;
     ip: string;
+    /** Human-readable reason, e.g. "timeout after 2500ms", "connection refused (ECONNREFUSED)". */
     error: string;
+    /** Port probed (added in 0.7.0; absent in older saved scans). */
+    port?: number;
+    /** Short machine-readable reason (added in 0.7.0; absent in older saved scans). */
+    code?: ScanFailureCode;
 }
 export interface ScanPayload {
     network: string;

package/dist/scan.js

@@ -4,7 +4,7 @@
  * Usage: ollanet scan [--lan] [--json] [--all] [--last]
  */
 import { configFromPartial, loadConfig } from "./config.js";
-import { discoverHosts, envInt, ollamaPort, shortName, } from "./hosts.js";
+import { discoverHosts, envInt, ollamaBaseUrl, ollamaPort, shortName, } from "./hosts.js";
 import { lastScanPath, loadLastScan, saveLastScan } from "./scan-store.js";
 import { looksTuned } from "./tuned.js";
 import { isHelpFlag, printHelp } from "./argv.js";
@@ -27,7 +27,7 @@ function formatBytes(bytes) {
     return `${value.toFixed(unit === 0 ? 0 : 1)} ${units[unit]}`;
 }
 async function fetchModels(host) {
-    const url = `http://${host.ip.includes(":") ? `[${host.ip}]` : host.ip}:${host.port}/api/tags`;
+    const url = `${ollamaBaseUrl(host)}/api/tags`;
     const timeoutMs = scanTimeoutMs();
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -37,9 +37,17 @@ async function fetchModels(host) {
             headers: { Accept: "application/json" },
         });
         if (!res.ok) {
-            throw new Error(`HTTP ${res.status} ${res.statusText}`);
+            throw new ProbeError(res.status === 404
+                ? "HTTP 404, no /api/tags (not Ollama?)"
+                : `HTTP ${res.status} ${res.statusText}`.trim(), "http");
+        }
+        let body;
+        try {
+            body = (await res.json());
+        }
+        catch {
+            throw new ProbeError("non-JSON reply (not Ollama?)", "not-ollama");
         }
-        const body = (await res.json());
         return { models: body.models ?? [], url };
     }
     finally {
@@ -61,21 +69,91 @@ async function mapPool(items, concurrency, worker) {
     return results;
 }
 async function scanHost(host) {
-    const url = `http://${host.ip}:${host.port}/api/tags`;
+    const url = `${ollamaBaseUrl(host)}/api/tags`;
     if (!host.online && !host.isSelf && host.source === "tailscale") {
-        return { host, ok: false, models: [], error: "offline", url };
+        return { host, ok: false, models: [], error: "offline", code: "offline", url };
     }
     try {
         const { models } = await fetchModels(host);
         return { host, ok: true, models, url };
     }
     catch (err) {
-        const name = err instanceof Error ? err.name : "";
-        const message = err instanceof Error ? err.message : String(err);
-        const error = name === "AbortError" || message.toLowerCase().includes("abort")
-            ? `timeout after ${scanTimeoutMs()}ms`
-            : message;
-        return { host, ok: false, models: [], error, url };
+        const { error, code } = describeProbeError(err, scanTimeoutMs());
+        return { host, ok: false, models: [], error, code, url };
+    }
+}
+/** Probe failure with a short reason code (see {@link ScanFailureCode}). */
+class ProbeError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+    }
+}
+const SOCKET_CODES = {
+    ECONNREFUSED: { code: "refused", label: "connection refused" },
+    ECONNRESET: { code: "reset", label: "connection reset" },
+    UND_ERR_SOCKET: { code: "reset", label: "connection closed" },
+    EHOSTUNREACH: { code: "unreachable", label: "host unreachable" },
+    ENETUNREACH: { code: "unreachable", label: "network unreachable" },
+    EHOSTDOWN: { code: "unreachable", label: "host down" },
+    ENOTFOUND: { code: "dns", label: "DNS lookup failed" },
+    EAI_AGAIN: { code: "dns", label: "DNS lookup failed" },
+    ETIMEDOUT: { code: "timeout", label: "connect timed out" },
+    UND_ERR_CONNECT_TIMEOUT: { code: "timeout", label: "connect timed out" },
+};
+/**
+ * Turn a failed /api/tags probe into a short reason. Node's fetch reports
+ * socket errors as a bare "fetch failed" with the real code on `cause`.
+ */
+export function describeProbeError(err, timeoutMs) {
+    if (err instanceof ProbeError)
+        return { error: err.message, code: err.code };
+    const name = err instanceof Error ? err.name : "";
+    const message = err instanceof Error ? err.message : String(err);
+    if (name === "AbortError" || name === "TimeoutError" || message.toLowerCase().includes("abort")) {
+        return { error: `timeout after ${timeoutMs}ms`, code: "timeout" };
+    }
+    const cause = err instanceof Error ? err.cause : undefined;
+    const sysCode = [cause, err]
+        .map((e) => (e && typeof e === "object" && "code" in e ? String(e.code) : ""))
+        .find(Boolean);
+    const known = sysCode ? SOCKET_CODES[sysCode] : undefined;
+    if (known && sysCode)
+        return { error: `${known.label} (${sysCode})`, code: known.code };
+    const causeMessage = cause instanceof Error ? cause.message : "";
+    const detail = causeMessage && causeMessage !== message ? `${message}: ${causeMessage}` : message;
+    return { error: sysCode ? `${detail} (${sysCode})` : detail, code: "error" };
+}
+function failureLabel(f, port) {
+    const ip = f.ip.includes(":") ? `[${f.ip}]` : f.ip;
+    const addr = f.port != null && f.port !== port ? `${ip}:${f.port}` : f.ip;
+    return f.name && f.name !== f.ip ? `${f.name} (${addr})` : addr;
+}
+/**
+ * Compact "who didn't answer" block. Offline Tailscale peers (only listed with
+ * --all, never probed) collapse to a count; the rest show name, address, reason.
+ */
+function printFailures(payload) {
+    const failures = payload.failures ?? [];
+    const offline = failures.filter((f) => f.error === "offline");
+    const probed = failures.filter((f) => f.error !== "offline");
+    const limit = 5;
+    if (probed.length === 1) {
+        const f = probed[0];
+        console.log(`No answer from 1 host: ${failureLabel(f, payload.port)}, ${f.error}`);
+    }
+    else if (probed.length > 1) {
+        console.log(`No answer from ${probed.length} hosts:`);
+        for (const f of probed.slice(0, limit)) {
+            console.log(`  - ${failureLabel(f, payload.port)}: ${f.error}`);
+        }
+        if (probed.length > limit) {
+            console.log(`  … ${probed.length - limit} more (ollanet scan --json lists all)`);
+        }
+    }
+    if (offline.length > 0) {
+        console.log(`Offline Tailscale peers (not probed): ${offline.length}`);
     }
 }
 function printPayload(payload, cached) {
@@ -93,12 +171,9 @@ function printPayload(payload, cached) {
     if (payload.servers.length === 0) {
         console.log("No Ollama servers found.");
         console.log("Tip: add hosts to config.json, set OLLANET_HOSTS, pass --lan, or prompt an IP directly.");
-        const interesting = (payload.failures ?? []).filter((f) => f.error !== "offline");
-        if (interesting.length > 0) {
-            console.log("\nNon-timeout failures (first few):");
-            for (const f of interesting.slice(0, 5)) {
-                console.log(`  - ${f.name} (${f.ip}): ${f.error}`);
-            }
+        if ((payload.failures ?? []).length > 0) {
+            console.log("");
+            printFailures(payload);
         }
         return;
     }
@@ -126,6 +201,7 @@ function printPayload(payload, cached) {
         console.log("");
     }
     console.log(`Found ${payload.servers.length} Ollama server(s) with ${payload.servers.reduce((n, s) => n + s.models.length, 0)} model entrie(s).`);
+    printFailures(payload);
 }
 function toPayload(results, networkLabel, sources) {
     return {
@@ -144,7 +220,7 @@ function toPayload(results, networkLabel, sources) {
             os: r.host.os,
             source: r.host.source,
             self: r.host.isSelf,
-            endpoint: `http://${r.host.ip}:${r.host.port}`,
+            endpoint: ollamaBaseUrl(r.host),
             models: r.models.map((m) => ({
                 name: m.name,
                 size: m.size,
@@ -161,6 +237,8 @@ function toPayload(results, networkLabel, sources) {
             name: shortName(r.host),
             ip: r.host.ip,
             error: r.error ?? "unknown",
+            port: r.host.port,
+            code: r.code ?? "error",
         })),
     };
 }
@@ -202,7 +280,7 @@ models. --lan is an opt-in TCP sweep of local /24s on port 11434.
 
 Options:
   --json     Machine-readable output
-  --all      Also probe offline Tailscale peers
+  --all      Also list offline Tailscale peers (marked offline, not probed)
   --lan      TCP-scan local LAN CIDRs for open Ollama ports
   --last     Reprint the last saved scan (no network)
   --cached   Same as --last`;