runwork 0.9.4 → 0.10.0

package/dist/git/preflight.js

@@ -0,0 +1,50 @@
+import { execFileSync } from 'child_process';
+/**
+ * Probe whether `git` is callable from this process. We use `execFileSync`
+ * (not `which`/`where.exe`) so the check follows the exact PATH lookup any
+ * subsequent git invocation will use -- that way we never report "found"
+ * when the real call would fail with ENOENT, and vice versa.
+ */
+export function probeGit() {
+    try {
+        const out = execFileSync('git', ['--version'], { stdio: ['ignore', 'pipe', 'pipe'] });
+        return { installed: true, version: out.toString('utf-8').trim() };
+    }
+    catch (err) {
+        return { installed: false, error: err };
+    }
+}
+/**
+ * Build a beginner-friendly message explaining how to recover from a missing
+ * git binary. Includes a Windows-specific hint because the most common
+ * scenario there is "winget install Git.Git just succeeded but this shell's
+ * PATH was cached at launch" -- restarting the shell fixes it without a
+ * second install attempt.
+ */
+export function buildMissingGitMessage(commandName) {
+    const lines = [
+        `Git is required to run \`runwork ${commandName}\`, but it was not found on PATH.`,
+        '',
+        'Install Git, then re-run this command:',
+        '  - macOS:   brew install git    (or: xcode-select --install)',
+        '  - Windows: winget install --id Git.Git -e',
+        '  - Linux:   sudo apt-get install -y git    (or your distro\'s equivalent)',
+    ];
+    if (process.platform === 'win32') {
+        lines.push('', 'If you just installed Git, this shell\'s PATH was cached when it opened', 'and does not yet include Git. Close this PowerShell / Command Prompt', 'window, open a fresh one, and re-run the command.');
+    }
+    lines.push('', 'Verify the install with: git --version');
+    return lines.join('\n');
+}
+/**
+ * Convenience wrapper for command entry points: probe git, and if it's
+ * missing, print the beginner-friendly message and exit with code 1.
+ * Returns void on success so callers can early-return on failure.
+ */
+export function requireGit(commandName) {
+    const probe = probeGit();
+    if (probe.installed)
+        return;
+    console.error(buildMissingGitMessage(commandName));
+    process.exit(1);
+}

package/dist/git/sync.js

@@ -147,7 +147,9 @@ export function syncWithRemote(cwd) {
     }
     let pushed = false;
     try {
-        execFileSync('git', ['push', 'runwork', 'main'], { cwd, stdio: 'pipe' });
+        // `HEAD:main` so the push works regardless of local branch name
+        // (older Git defaults to `master`, some users keep custom defaults).
+        execFileSync('git', ['push', 'runwork', 'HEAD:main'], { cwd, stdio: 'pipe' });
         pushed = true;
     }
     catch {

package/dist/health/__tests__/cli-distribution-checks.test.js

@@ -1,12 +1,29 @@
 /**
  * Tests for the first-party distribution checks added to runwork doctor.
  *
- * These checks rely on fetch() to hit https://runwork.ai/cli/latest.json.
- * We stub globalThis.fetch to redirect those calls to a local HTTP server
- * so the suite has no outbound network dependency.
+ * These checks rely on `httpFetch` (our node:https-backed fetch wrapper) to
+ * hit https://runwork.ai/cli/latest.json. We mock the wrapper to redirect
+ * those calls to a local HTTP server so the suite has no outbound network
+ * dependency. We still exercise the real wrapper end to end -- only the
+ * URL is rewritten -- so this remains an integration test of the network
+ * code path.
  */
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import { createServer } from 'node:http';
+let currentRedirectBase = null;
+vi.mock('../../utils/http.js', async () => {
+    const actual = await vi.importActual('../../utils/http.js');
+    return {
+        ...actual,
+        httpFetch: (url, init) => {
+            if (currentRedirectBase && url.startsWith('https://runwork.ai')) {
+                const redirected = url.replace('https://runwork.ai', currentRedirectBase);
+                return actual.httpFetch(redirected, init);
+            }
+            return actual.httpFetch(url, init);
+        },
+    };
+});
 import { checkCliVersion, checkCliArtifactReachable, checkCliInstallLocation, } from '../checks.js';
 function startServer() {
     return new Promise((resolvePromise) => {
@@ -56,33 +73,14 @@ function startServer() {
         });
     });
 }
-/**
- * Redirect fetch calls to https://runwork.ai/... at the real test server.
- * Returns a restore function.
- */
-function redirectFetch(baseUrl) {
-    const realFetch = globalThis.fetch;
-    globalThis.fetch = ((input, init) => {
-        const href = typeof input === 'string' ? input : input.toString();
-        if (href.startsWith('https://runwork.ai')) {
-            const redirected = href.replace('https://runwork.ai', baseUrl);
-            return realFetch(redirected, init);
-        }
-        return realFetch(input, init);
-    });
-    return () => {
-        globalThis.fetch = realFetch;
-    };
-}
 describe('checkCliVersion (runwork.ai backed)', () => {
     let server;
-    let restoreFetch;
     beforeEach(async () => {
         server = await startServer();
-        restoreFetch = redirectFetch(server.url);
+        currentRedirectBase = server.url;
     });
     afterEach(async () => {
-        restoreFetch();
+        currentRedirectBase = null;
         await server.stop();
     });
     it('skips with an explicit unreachable message when the manifest 404s', async () => {
@@ -117,13 +115,12 @@ describe('checkCliVersion (runwork.ai backed)', () => {
 });
 describe('checkCliArtifactReachable', () => {
     let server;
-    let restoreFetch;
     beforeEach(async () => {
         server = await startServer();
-        restoreFetch = redirectFetch(server.url);
+        currentRedirectBase = server.url;
     });
     afterEach(async () => {
-        restoreFetch();
+        currentRedirectBase = null;
         await server.stop();
     });
     function platformKey() {

package/dist/health/checks.js

@@ -6,6 +6,7 @@ import { VERSION } from '../generated/version.js';
 import { getCredentials } from '../auth/store.js';
 import { ApiClient } from '../api/client.js';
 import { detectAgents, getAdapterBySlug } from '../agents/detect.js';
+import { httpFetch } from '../utils/http.js';
 // First-party distribution endpoints. Defaults match the plan, can be
 // overridden via RUNWORK_DOWNLOAD_BASE_URL for staging or debugging.
 const BASE_URL = process.env.RUNWORK_DOWNLOAD_BASE_URL || 'https://runwork.ai';
@@ -23,7 +24,7 @@ function detectPlatform() {
 }
 async function fetchReleaseManifest() {
     try {
-        const response = await fetch(LATEST_JSON_URL, { cache: 'no-store' });
+        const response = await httpFetch(LATEST_JSON_URL, { cache: 'no-store' });
         if (!response.ok)
             return null;
         return await response.json();
@@ -123,7 +124,7 @@ export async function checkCliArtifactReachable() {
     }
     const artifactUrl = `${BASE_URL}${entry.path}`;
     try {
-        const response = await fetch(artifactUrl, { method: 'HEAD' });
+        const response = await httpFetch(artifactUrl, { method: 'HEAD' });
         if (!response.ok) {
             return {
                 name: 'cli-artifact',

package/dist/index.js

@@ -1,4 +1,5 @@
 import { Command } from 'commander';
+import { formatError } from './utils/format-error.js';
 import { loginCommand } from './commands/login.js';
 import { initCommand } from './commands/init.js';
 import { cloneCommand } from './commands/clone.js';
@@ -30,6 +31,20 @@ import { handleGitCredentialRequest } from './git/credentials.js';
 import { VERSION } from './generated/version.js';
 import { shouldOutputJson, jsonOut } from './utils/output.js';
 import { buildHelpJson, buildCommandHelpJson } from './utils/help-json.js';
+// Surface escaped errors and rejections instead of letting the process exit
+// silently. Without these handlers, an unhandled rejection inside a Commander
+// async action vanishes on the bun-compiled Windows binary -- the user sees
+// only the last `console.log` we managed to flush before the runtime tore
+// the program down. Both handlers are deliberately strict (exit 1) so the
+// failure is visible in CI / wrappers like the desktop app.
+process.on('unhandledRejection', (reason) => {
+    console.error(`Unhandled rejection: ${formatError(reason)}`);
+    process.exit(1);
+});
+process.on('uncaughtException', (err) => {
+    console.error(`Uncaught exception: ${formatError(err)}`);
+    process.exit(1);
+});
 const program = new Command();
 program
     .name('runwork')
@@ -115,4 +130,20 @@ if (!hasCommand && !isHelpOrVersion && args.length === 0) {
         process.exit(0);
     }
 }
-program.parse();
+// IMPORTANT: use parseAsync, not parse. Many of our actions are async and
+// the bun-compiled Windows binary will exit before pending promises resolve
+// when we don't await the returned promise -- that manifests as a silent
+// abort partway through `runwork clone`, `dev`, etc. with no error output.
+//
+// Call with NO arguments so Commander reads `process.argv` itself with its
+// `'auto'` detection. Passing `process.argv` explicitly defaults to the
+// `'node'` parse mode and strips the wrong elements when this is run as a
+// bun-compiled standalone binary (where there is no separate "script" argv
+// slot), making every command silently fail to match.
+try {
+    await program.parseAsync();
+}
+catch (err) {
+    console.error(formatError(err));
+    process.exit(1);
+}

package/dist/utils/__tests__/format-error.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/__tests__/format-error.test.js

@@ -0,0 +1,43 @@
+import { describe, it, expect } from 'vitest';
+import { formatError } from '../format-error.js';
+describe('formatError', () => {
+    it('handles plain Error objects', () => {
+        expect(formatError(new Error('boom'))).toBe('boom');
+    });
+    it('returns "unknown error" for null/undefined', () => {
+        expect(formatError(null)).toBe('unknown error');
+        expect(formatError(undefined)).toBe('unknown error');
+    });
+    it('extracts stderr buffer from execFileSync-style errors', () => {
+        const err = Object.assign(new Error('Command failed: git fetch'), {
+            stderr: Buffer.from('fatal: could not read Username\n'),
+        });
+        expect(formatError(err)).toContain('fatal: could not read Username');
+    });
+    it('extracts stderr string when not a buffer', () => {
+        const err = Object.assign(new Error('Command failed'), {
+            stderr: '  fatal: bad ref  ',
+        });
+        expect(formatError(err)).toContain('fatal: bad ref');
+    });
+    it('falls back to stdout when stderr is empty', () => {
+        const err = Object.assign(new Error('Command failed'), {
+            stderr: '',
+            stdout: Buffer.from('CONFLICT (content): merge conflict in foo'),
+        });
+        expect(formatError(err)).toContain('CONFLICT');
+    });
+    it('prefixes with errno code when available', () => {
+        const err = Object.assign(new Error('spawn git ENOENT'), {
+            code: 'ENOENT',
+            stderr: 'spawn git ENOENT',
+        });
+        const out = formatError(err);
+        expect(out).toMatch(/^ENOENT:/);
+        expect(out).toContain('spawn git ENOENT');
+    });
+    it('coerces non-Error values to strings', () => {
+        expect(formatError('a plain string')).toBe('a plain string');
+        expect(formatError(42)).toBe('42');
+    });
+});

package/dist/utils/__tests__/http.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/__tests__/http.test.js

@@ -0,0 +1,381 @@
+import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
+import { createServer } from 'node:http';
+import { gzipSync, deflateSync, brotliCompressSync } from 'node:zlib';
+import { spawnSync } from 'node:child_process';
+import { httpFetch, __setTransportForTests } from '../http.js';
+let server;
+let port;
+const calls = [];
+function startServer() {
+    return new Promise((resolve) => {
+        server = createServer(async (req, res) => {
+            const chunks = [];
+            for await (const chunk of req)
+                chunks.push(chunk);
+            const body = Buffer.concat(chunks).toString('utf-8');
+            calls.push({ url: req.url || '', method: req.method || '', headers: req.headers, body });
+            const url = req.url || '/';
+            // Simple endpoints exercised by the test cases below.
+            if (url === '/json') {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ hello: 'world' }));
+                return;
+            }
+            if (url === '/text') {
+                res.writeHead(200, { 'content-type': 'text/plain' });
+                res.end('plain body');
+                return;
+            }
+            if (url === '/binary') {
+                res.writeHead(200, { 'content-type': 'application/octet-stream' });
+                res.end(Buffer.from([1, 2, 3, 4, 5]));
+                return;
+            }
+            if (url === '/echo-headers') {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ headers: req.headers, method: req.method }));
+                return;
+            }
+            if (url === '/echo-body') {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ body, contentType: req.headers['content-type'] }));
+                return;
+            }
+            if (url === '/status/404') {
+                res.writeHead(404, { 'content-type': 'text/plain' });
+                res.end('not found');
+                return;
+            }
+            if (url === '/status/500') {
+                res.writeHead(500, { 'content-type': 'text/plain' });
+                res.end('boom');
+                return;
+            }
+            if (url === '/redirect/302') {
+                res.writeHead(302, { location: '/json' });
+                res.end();
+                return;
+            }
+            if (url === '/redirect/303-post') {
+                res.writeHead(303, { location: '/echo-headers' });
+                res.end();
+                return;
+            }
+            if (url === '/redirect/307') {
+                res.writeHead(307, { location: '/echo-body' });
+                res.end();
+                return;
+            }
+            if (url === '/redirect/loop') {
+                res.writeHead(302, { location: '/redirect/loop' });
+                res.end();
+                return;
+            }
+            if (url === '/gzip') {
+                res.writeHead(200, { 'content-type': 'text/plain', 'content-encoding': 'gzip' });
+                res.end(gzipSync(Buffer.from('compressed-gzip-body')));
+                return;
+            }
+            if (url === '/deflate') {
+                res.writeHead(200, { 'content-type': 'text/plain', 'content-encoding': 'deflate' });
+                res.end(deflateSync(Buffer.from('compressed-deflate-body')));
+                return;
+            }
+            if (url === '/brotli') {
+                res.writeHead(200, { 'content-type': 'text/plain', 'content-encoding': 'br' });
+                res.end(brotliCompressSync(Buffer.from('compressed-brotli-body')));
+                return;
+            }
+            if (url === '/head') {
+                res.writeHead(200, { 'content-type': 'text/plain', 'x-marker': 'present' });
+                res.end();
+                return;
+            }
+            res.writeHead(404);
+            res.end();
+        });
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (typeof addr === 'object' && addr && 'port' in addr) {
+                port = addr.port;
+            }
+            resolve();
+        });
+    });
+}
+beforeAll(async () => { await startServer(); });
+afterAll(() => new Promise((resolve) => server.close(() => resolve())));
+function url(path) { return `http://127.0.0.1:${port}${path}`; }
+describe('httpFetch — basic Response surface', () => {
+    it('parses JSON responses', async () => {
+        const res = await httpFetch(url('/json'));
+        expect(res.ok).toBe(true);
+        expect(res.status).toBe(200);
+        expect(res.headers.get('content-type')).toContain('application/json');
+        expect(await res.json()).toEqual({ hello: 'world' });
+    });
+    it('reads text responses', async () => {
+        const res = await httpFetch(url('/text'));
+        expect(res.ok).toBe(true);
+        expect(await res.text()).toBe('plain body');
+    });
+    it('reads binary responses as ArrayBuffer with the exact byte content', async () => {
+        const res = await httpFetch(url('/binary'));
+        const ab = await res.arrayBuffer();
+        expect(new Uint8Array(ab)).toEqual(new Uint8Array([1, 2, 3, 4, 5]));
+    });
+    it('returns ok=false for 4xx without throwing', async () => {
+        const res = await httpFetch(url('/status/404'));
+        expect(res.ok).toBe(false);
+        expect(res.status).toBe(404);
+        expect(await res.text()).toBe('not found');
+    });
+    it('returns ok=false for 5xx without throwing', async () => {
+        const res = await httpFetch(url('/status/500'));
+        expect(res.ok).toBe(false);
+        expect(res.status).toBe(500);
+    });
+});
+describe('httpFetch — request shape', () => {
+    it('passes through plain object headers, lowercased per HTTP convention', async () => {
+        const res = await httpFetch(url('/echo-headers'), {
+            headers: { 'X-Custom-Foo': 'bar', Authorization: 'Bearer abc' },
+        });
+        const data = await res.json();
+        expect(data.method).toBe('GET');
+        expect(data.headers['x-custom-foo']).toBe('bar');
+        expect(data.headers['authorization']).toBe('Bearer abc');
+    });
+    it('passes through Headers instance', async () => {
+        const headers = new Headers();
+        headers.set('X-One', 'a');
+        headers.set('X-Two', 'b');
+        const res = await httpFetch(url('/echo-headers'), { headers });
+        const data = await res.json();
+        expect(data.headers['x-one']).toBe('a');
+        expect(data.headers['x-two']).toBe('b');
+    });
+    it('uppercases lowercase methods', async () => {
+        const res = await httpFetch(url('/echo-headers'), { method: 'post', body: '' });
+        const data = await res.json();
+        expect(data.method).toBe('POST');
+    });
+    it('sends string body and content-length', async () => {
+        const res = await httpFetch(url('/echo-body'), {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ a: 1 }),
+        });
+        const data = await res.json();
+        expect(data.body).toBe('{"a":1}');
+        expect(data.contentType).toBe('application/json');
+    });
+    it('sends Buffer body', async () => {
+        const res = await httpFetch(url('/echo-body'), {
+            method: 'PUT',
+            body: Buffer.from('raw-buffer'),
+        });
+        const data = await res.json();
+        expect(data.body).toBe('raw-buffer');
+    });
+    it('sends Uint8Array body with offset', async () => {
+        const backing = new Uint8Array([0, 0, 65, 66, 67, 0]);
+        const view = backing.subarray(2, 5); // "ABC"
+        const res = await httpFetch(url('/echo-body'), { method: 'POST', body: view });
+        const data = await res.json();
+        expect(data.body).toBe('ABC');
+    });
+    it('sends ArrayBuffer body', async () => {
+        const ab = new TextEncoder().encode('via-arraybuffer').buffer;
+        const res = await httpFetch(url('/echo-body'), { method: 'POST', body: ab });
+        const data = await res.json();
+        expect(data.body).toBe('via-arraybuffer');
+    });
+    it('drops body on bodyless GET/HEAD methods (matches fetch behavior)', async () => {
+        const res = await httpFetch(url('/echo-body'), {
+            method: 'GET',
+            // GET requests with bodies are non-conformant; fetch silently drops the body.
+            body: 'should-not-be-sent',
+        });
+        const data = await res.json();
+        expect(data.body).toBe('');
+    });
+});
+describe('httpFetch — redirects', () => {
+    it('follows a 302 to the final URL', async () => {
+        const res = await httpFetch(url('/redirect/302'));
+        expect(res.status).toBe(200);
+        expect(res.url.endsWith('/json')).toBe(true);
+        expect(await res.json()).toEqual({ hello: 'world' });
+    });
+    it('downgrades POST to GET on 303 (matches fetch semantics)', async () => {
+        const res = await httpFetch(url('/redirect/303-post'), {
+            method: 'POST',
+            body: 'ignored-after-303',
+        });
+        const data = await res.json();
+        expect(data.method).toBe('GET');
+    });
+    it('preserves method and body on 307', async () => {
+        const res = await httpFetch(url('/redirect/307'), {
+            method: 'POST',
+            body: 'preserved-on-307',
+        });
+        const data = await res.json();
+        expect(data.body).toBe('preserved-on-307');
+    });
+    it('rejects after exceeding the redirect limit', async () => {
+        // The endpoint redirects to itself; after MAX_REDIRECTS we stop following
+        // and return the redirect response itself rather than crash.
+        const res = await httpFetch(url('/redirect/loop'));
+        expect(res.status).toBe(302);
+    });
+});
+describe('httpFetch — content decoding', () => {
+    it('advertises gzip/deflate/br by default', async () => {
+        await httpFetch(url('/echo-headers'));
+        const last = calls[calls.length - 1];
+        expect(last.headers['accept-encoding']).toBe('gzip, deflate, br');
+    });
+    it('decompresses gzip responses transparently', async () => {
+        const res = await httpFetch(url('/gzip'));
+        expect(await res.text()).toBe('compressed-gzip-body');
+    });
+    it('decompresses brotli responses transparently', async () => {
+        const res = await httpFetch(url('/brotli'));
+        expect(await res.text()).toBe('compressed-brotli-body');
+    });
+    it('decompresses deflate responses transparently', async () => {
+        const res = await httpFetch(url('/deflate'));
+        expect(await res.text()).toBe('compressed-deflate-body');
+    });
+});
+describe('httpFetch — HEAD requests', () => {
+    it('returns headers and an empty body', async () => {
+        const res = await httpFetch(url('/head'), { method: 'HEAD' });
+        expect(res.status).toBe(200);
+        expect(res.headers.get('x-marker')).toBe('present');
+        expect(await res.text()).toBe('');
+    });
+});
+describe('httpFetch — errors', () => {
+    it('rejects on connection failure', async () => {
+        // 127.0.0.1:1 is virtually guaranteed to refuse connections.
+        await expect(httpFetch('http://127.0.0.1:1/')).rejects.toThrow();
+    });
+    it('rejects on unsupported protocols', async () => {
+        await expect(httpFetch('ftp://example.com/')).rejects.toThrow(/Unsupported protocol/);
+    });
+});
+// ────────────────────────────────────────────────────────────────────────
+// curl-transport tests
+//
+// `curl` is the opt-in escape hatch (`RUNWORK_HTTP_TRANSPORT=curl`). It
+// shells out to the system `curl` so HTTP runs in a subprocess, immune to
+// any future runtime regression. These tests force the curl path via the
+// test-only override so the break-glass path stays exercised in CI even
+// though the default transport is `node:https`. Skipped when curl is
+// missing on the host.
+// ────────────────────────────────────────────────────────────────────────
+const curlAvailable = (() => {
+    try {
+        const r = spawnSync('curl', ['--version'], { encoding: 'utf-8' });
+        return r.status === 0;
+    }
+    catch {
+        return false;
+    }
+})();
+describe.skipIf(!curlAvailable)('httpFetch — curl transport (opt-in via env var)', () => {
+    beforeAll(() => { __setTransportForTests('curl'); });
+    afterAll(() => { __setTransportForTests('auto'); });
+    it('parses JSON responses through curl', async () => {
+        const res = await httpFetch(url('/json'));
+        expect(res.ok).toBe(true);
+        expect(res.status).toBe(200);
+        expect(await res.json()).toEqual({ hello: 'world' });
+    });
+    it('reads binary responses with exact byte content', async () => {
+        const res = await httpFetch(url('/binary'));
+        const ab = await res.arrayBuffer();
+        expect(new Uint8Array(ab)).toEqual(new Uint8Array([1, 2, 3, 4, 5]));
+    });
+    it('returns ok=false for 4xx without throwing', async () => {
+        const res = await httpFetch(url('/status/404'));
+        expect(res.ok).toBe(false);
+        expect(res.status).toBe(404);
+        expect(await res.text()).toBe('not found');
+    });
+    it('follows 302 redirects to the final URL', async () => {
+        const res = await httpFetch(url('/redirect/302'));
+        expect(res.status).toBe(200);
+        expect(res.url.endsWith('/json')).toBe(true);
+        expect(await res.json()).toEqual({ hello: 'world' });
+    });
+    it('downgrades POST to GET on 303 (matches fetch semantics)', async () => {
+        const res = await httpFetch(url('/redirect/303-post'), {
+            method: 'POST',
+            body: 'ignored-after-303',
+        });
+        const data = await res.json();
+        expect(data.method).toBe('GET');
+    });
+    it('preserves method and body on 307', async () => {
+        const res = await httpFetch(url('/redirect/307'), {
+            method: 'POST',
+            body: 'preserved-on-307',
+        });
+        const data = await res.json();
+        expect(data.body).toBe('preserved-on-307');
+    });
+    it('passes plain object headers through', async () => {
+        const res = await httpFetch(url('/echo-headers'), {
+            headers: { 'X-Custom': 'curl-roundtrip', Authorization: 'Bearer abc' },
+        });
+        const data = await res.json();
+        expect(data.headers['x-custom']).toBe('curl-roundtrip');
+        expect(data.headers['authorization']).toBe('Bearer abc');
+    });
+    it('sends string body and content-type', async () => {
+        const res = await httpFetch(url('/echo-body'), {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ a: 1 }),
+        });
+        const data = await res.json();
+        expect(data.body).toBe('{"a":1}');
+        expect(data.contentType).toBe('application/json');
+    });
+    it('sends binary Uint8Array body with offset', async () => {
+        const backing = new Uint8Array([0, 0, 65, 66, 67, 0]);
+        const view = backing.subarray(2, 5); // "ABC"
+        const res = await httpFetch(url('/echo-body'), { method: 'POST', body: view });
+        const data = await res.json();
+        expect(data.body).toBe('ABC');
+    });
+    it('returns headers and an empty body for HEAD', async () => {
+        const res = await httpFetch(url('/head'), { method: 'HEAD' });
+        expect(res.status).toBe(200);
+        expect(res.headers.get('x-marker')).toBe('present');
+        expect(await res.text()).toBe('');
+    });
+    it('warns and returns raw bytes on unexpected gzip', async () => {
+        const stderr = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        try {
+            const res = await httpFetch(url('/gzip'));
+            expect(res.ok).toBe(true);
+            const ab = await res.arrayBuffer();
+            expect(ab.byteLength).toBeGreaterThan(0);
+            expect(stderr).toHaveBeenCalledWith(expect.stringMatching(/Content-Encoding: gzip/));
+        }
+        finally {
+            stderr.mockRestore();
+        }
+    });
+    it('rejects on connection failure', async () => {
+        await expect(httpFetch('http://127.0.0.1:1/')).rejects.toThrow();
+    });
+    it('rejects on unsupported protocols', async () => {
+        await expect(httpFetch('ftp://example.com/')).rejects.toThrow(/Unsupported protocol/);
+    });
+});