9c13cc1 · cab139e · 50ff478 · 94047e5 · 742fa77
@@ -90,7 +90,7 @@
for a tunnel and a forge that sleeps.
| `follow_mode` | `{ repo, … }`: choose how a spawned forge follows its parent, `tell-me` or `take-updates`; its `forge` repository's admin only | yes |
| `following` | where a fork stands against what it follows, and what the crew is doing about it |  |
| `forge_proposals` | `{ repo }`: what this forge proposed to its parent, newest first; `reachable` is false if the parent did not answer |  |
| `forges` | an admin's list of the forges sent from here: name, address, whom for, apps, claimed or not, last activity |  |
| `forges` | an admin's list of the forges sent from here: name, address, whom for, apps, claimed or not, last activity, whether each public address answers |  |
| `forks` | `{ repo }`: `{ parent, forks: [{ repo, ahead, behind, updatedAt }] }`, the forks the caller may see (as `/:owner/:name/forks` lists them), each with its commits ahead of and behind this one; `null` when git cannot say |  |
| `front_page` | `{ pinned?, hidden?, weights?, dryRun? }`: the front page as a stranger sees it, ranked, with numbers; a site admin sets what is pinned (first public one featured), hidden, and what counts (weights of forks, ships, use, fresh, 0 to 10) | yes |
| `health` | how this forge is: the version and commit it runs, draining or not, the rollout and its incidents |  |
@@ -14,3 +14,5 @@
trails a palette row.
  `src/web/style/content.ts` (`.finder .palette-item .cat`).
- `.flow-row` — a §5 `.row` link on the flow panel (`flow-panel.ts`: idle pulls and the "and K more" row) with a 44px
  minimum height, so it is a touch target on a 360px phone. Styled in `src/web/style/components.ts` (list rows).
The proofs under a forge on `/forges` (#7959) are `row()` `children`, one per public address; the row's trail badge says "reachable" or "not reachable", so the state is a word and not only a colour. No new class.
@@ -0,0 +1,32 @@
# "Running" is proven from outside
A child forge's process being up inside its cell says nothing about whether a
visitor reaches it. The parent asks the way a visitor does (#7959).
- **What is asked.** The child's home (`<child>--<parent>/api/v1/forge`, which
  must answer its own JSON `claimed`) and each public app
  (`<app>--<child>--<parent>/`, which must carry the `x-forge-app: <slug>` header
  the proxy writes on everything it carries back). A status alone proves
  nothing: the platform's wildcard standby page answers 200 for a mistyped
  `<app>--<child>.<apex>`.
- **Where it shows.** A failing child reads **Running, not reachable: deal-clock
  answered 404, not by the app** on `/forges` (with every address and its
  result under the row), in the terminal's Forges screen, in the MCP `forges`
  tool (`reach`), and in the result of `POST /api/v1/forges` / MCP `spawn`
  (`reach`, right after the child is made).
- **Alarm.** A new child is re-proved every 3 seconds for 3 minutes; if it never
  answers, `forge.child_unreachable` goes on the outbox and the notifier pages
  the owner (the `unreachable` flow alarm). Every 5 minutes the parent
  re-proves every finished child (a failure is confirmed once before it is
  believed); a change pages once, and `forge.child_reachable` ends it.
- **State** is `<data>/reach/<child>.json`, derived and rebuilt by the next pass.
- **Websockets** to a child's home or apps reach its cell: `forwardSocket`
  (`src/spawn/cell.ts`) opens the cell's side first, then answers the visitor.
- Tests: `test/spawn-reach.test.ts`, `test/spawn-reach-door.test.ts`,
  `test/spawn-cell-socket.test.ts`, and the real-cell `test/spawn-cell-e2e.test.ts`
  (skipped, and says so, where bwrap and socat are missing).
- **In the terminal:** open the palette (ctrl-k), "Forges you sent". A forge that
  is not reachable reads *Running, not reachable: …*, and under it one line per
  public address with its result (`NOT REACHABLE deal--kid--host/: answered 404, not by the app`).
- **Slugs are the forge's rule.** A child writes its own database, so a slug that
  is not `[a-z0-9-]` (`evil.example#`, `u@host`) is dropped before any address is built.
@@ -1097,6 +1097,9 @@
export async function proxyApp(
  }
  const out = new Headers(response.headers);
  for (const name of HOP_BY_HOP) out.delete(name);
  // Which app answered: a probe from outside (`spawn/reach.ts`) tells this
  // from a platform's standby page, which answers 200 for any name.
  out.set("x-forge-app", target.app.slug);
  // An agent reading a public app's page learns where to report a problem
  // without the app having to say so.
  if (isHtml(out))
@@ -1282,13 +1285,13 @@
const WS_IDLE_SECONDS = 120;
 * that merely says `Upgrade: websocket` is an ordinary request, and is
 * fetched as one with the hop-by-hop headers stripped, as it always was.
 */
const isWebSocketHandshake = (request: Request): boolean =>
export const isWebSocketHandshake = (request: Request): boolean =>
  request.method === "GET" &&
  request.headers.get("upgrade")?.toLowerCase() === "websocket" &&
  request.headers.has("sec-websocket-key");
/** The subprotocols a handshake offers, in the order it offers them. */
const offeredProtocols = (request: Request): string[] =>
export const offeredProtocols = (request: Request): string[] =>
  (request.headers.get("sec-websocket-protocol") ?? "")
    .split(",")
    .map((s) => s.trim())
@@ -1347,7 +1350,7 @@
async function proxyWebSocket(
 * sentence for the "not running" page: the app was not listening, or it
 * answered the handshake with something other than a socket.
 */
function connectUpstream(
export function connectUpstream(
  url: URL,
  headers: Record<string, string>,
  protocols: string[],
@@ -159,6 +159,8 @@
export function classifiedAudience(kind: string): EventAudience | undefined {
    kind.startsWith("backup.") ||
    // The weekly model review's changes and results are the owner's (`actions/model_review.ts`).
    kind.startsWith("crew.model_") ||
    // A child forge answering no one at its public address is the owner's to hear (`spawn/reach.ts`).
    kind.startsWith("forge.child_") ||
    // A clog is the whole forge's flow, the owner's to hear (`flow/clog_tick.ts`).
    kind.startsWith("clog.") ||
    // What the throughput keeper did to lift a brake is the owner's too (`flow/keeper.ts`).
@@ -41,6 +41,7 @@
import { health } from "../http/health.ts";
import { forgeVitals } from "../actions/health.ts";
import { RECOVERED, drainIncident, nextPage, observe, recoveredLine, type Watch } from "./incidents.ts";
import { firedAlarms, type FiredAlarm } from "../flow/alarms.ts";
import { reachAlarms } from "../spawn/reach.ts";
import { loadClog } from "../flow/clog_tick.ts";
import { forgeCeiling } from "../flow/ceiling.ts";
import { askLinesFor } from "../web/studio/asks.ts";
@@ -257,7 +258,7 @@
export function alarmLines(
  fired?: readonly FiredAlarm[],
): { id: string; line: string; items: readonly string[]; link: string }[] {
  if (!user.isAdmin || user.kind !== "user") return [];
  const alarms = fired ?? firedAlarms(app.db, new Date(now), { ceilingUsd: forgeCeiling(app.config) });
  const alarms = fired ?? [...firedAlarms(app.db, new Date(now), { ceilingUsd: forgeCeiling(app.config) }), ...reachAlarms(app)];
  return alarms.map((a) => {
    const id = `alarm:${a.key}@${a.since}`;
    return { id, line: a.says, items: [id], link: a.href };
@@ -17,7 +17,7 @@
import { redMainAlarm } from "./alarm_red_main.ts";
import { alarmStuck } from "./alarm_stuck.ts";
export interface FiredAlarm {
  readonly key: "landing_stopped" | "red_main" | "stuck" | "idle_crew" | "no_release";
  readonly key: "landing_stopped" | "red_main" | "stuck" | "idle_crew" | "no_release" | "unreachable";
  readonly says: string;
  readonly since: string;
  /** A same-origin path to the item the alarm names. */
@@ -3,7 +3,7 @@
import { good, bad, type Tool } from "../shared.ts";
export const tool: Tool = {
  name: "forges",
  doc: "an admin's list of the forges sent from here: name, address, whom for, apps, claimed or not, last activity",
  doc: "an admin's list of the forges sent from here: name, address, whom for, apps, claimed or not, last activity, whether each public address answers",
  description:
    "Forges sent from here (admin): name, address, apps, claimed, spendTodayUsd, ceilingUsd.",
  inputSchema: { type: "object", properties: {} },
@@ -66,10 +66,12 @@
export const tool: Tool = {
    const made = door.body["dryRun"] === false;
    const { claimUrl, ...rest } = door.body;
    const reveal = args["reveal"] === true && typeof claimUrl === "string";
    const reach = door.body["reach"] as { ok?: boolean; says?: string } | undefined;
    const reached = reach?.ok === false ? ` ${reach.says}` : "";
    return good({
      says: !made
        ? "This is the plan; nothing was made. Send dryRun: false to spawn."
        : `Spawned ${String(door.body["name"])} at ${String(door.body["url"])}. ${reveal ? LINK_REVEALED : LINK_KEPT}`,
        : `Spawned ${String(door.body["name"])} at ${String(door.body["url"])}. ${reveal ? LINK_REVEALED : LINK_KEPT}${reached}`,
      ...rest,
      ...(reveal ? { claimUrl } : {}),
    });
@@ -564,13 +564,14 @@
import { holdAppHost } from "../apps/holding.ts";
import {
  appWebSocket,
  type AppSocket,
  isWebSocketHandshake,
  proxyApp,
  resolveAppHost,
} from "../apps/proxy.ts";
import { stopCellChildren } from "../spawn/cell.ts";
import { portInsteadOfSocket, tcpAddress } from "../git/hook-address.ts";
import { answerFromCell, closeHostedChildren, resolveHostedChild, resolveHostedChildApp } from "../spawn/host.ts";
import { answerFromCell, closeHostedChildren, resolveHostedChild, resolveHostedChildApp, socketToCell } from "../spawn/host.ts";
import { getVerifiedDomain } from "../core/domains.ts";
// ---- auth ----
@@ -2349,9 +2350,13 @@
export async function serve(app: App): Promise<Servers> {
      // A hosted child's app (`<app>--<child>--<parentHost>`) is the child's
      // own runtime's, as the parent's apps are the parent's.
      // A child in its own cell answers through this one door, for its pages and its apps.
      const fromCell = async (name?: string): Promise<Response> => {
      const fromCell = async (name?: string): Promise<Response | undefined> => {
        // The child sees only this forge's relay, so it is told who the client is.
        notePeer(request, server.requestIP(request)?.address, trust);
        if (isWebSocketHandshake(request)) {
          const socket = await socketToCell(app, request, server, name);
          return socket === undefined ? undefined : securityFloor(socket);
        }
        armClose(request, () => server.timeout(request, 1));
        const response = await answered(app, request, () => answerFromCell(app, request, name));
        counted(app, request, response, started);
@@ -23,6 +23,7 @@
import { bootHostedChildren } from "./spawn/host.ts";
import { firstBoot } from "./spawn/first-boot.ts";
import { startHeartbeat } from "./spawn/heartbeat.ts";
import { startUpstreamWatch } from "./spawn/upstream.ts";
import { startReachWatch } from "./spawn/reach.ts";
import { pruneSessions } from "./core/sessions.ts";
import { runDelivery } from "./core/webhooks.ts";
import { isHookName, runHookClient } from "./git/hooks.ts";
@@ -483,6 +484,8 @@
await firstBoot(app);
const heartbeatTimer = startHeartbeat(app);
// ...and looks upstream once an hour (spawn/upstream.ts).
const upstreamTimer = startUpstreamWatch(app);
// ...and this forge asks every child's public addresses what a visitor would get, every few minutes (spawn/reach.ts).
const reachTimer = startReachWatch(app);
// Prompts from Instagram (docs/APPS.md): once a day, for each repository
// that connected an account, the top comment on its latest Reel is told to
// the crew. A minute's clock; nothing leaves the box until a source exists.
@@ -749,6 +752,7 @@
function drain(signal: NodeJS.Signals): Promise<unknown> {
  clearInterval(deliveryTimer);
  clearInterval(heartbeatTimer);
  clearInterval(upstreamTimer);
  clearInterval(reachTimer);
  clearInterval(syncTimer);
  clearInterval(staleTimer);
  clearInterval(followTimer);
@@ -11,6 +11,7 @@
import { dirname, join } from "node:path";
import { clientAddress } from "../http/peer.ts";
import type { App } from "../app.ts";
import { connectUpstream, offeredProtocols, type AppSocket } from "../apps/proxy.ts";
import { cellsAvailable, killTree, openCell, type Cell, type CellSpec, type Limits } from "../apps/contain.ts";
import { childEnv, freePort } from "../apps/process.ts";
import { childDirOf } from "../actions/spawn.ts";
@@ -312,3 +313,37 @@
export async function forward(
    return new Response("this forge is not answering", { status: 502 });
  }
}
/**
 * Carry a websocket handshake to the child's loopback port: the child's side
 * is opened first, and only then is the visitor's answered, as `proxyApp`
 * does for an app (`apps/proxy.ts`). Frames then go through `appWebSocket`,
 * the forge's one pump. `undefined` means the request became a socket.
 */
export async function forwardSocket(
  child: Pick<CellChild, "port">,
  request: Request,
  server: Bun.Server<AppSocket>,
  db: AppSocket["db"],
  clientHeader?: string,
): Promise<Response | undefined> {
  const at = new URL(request.url);
  const headers: Record<string, string> = {};
  const named = clientHeader?.toLowerCase();
  for (const [k, v] of request.headers) {
    // The client writes its own handshake; the visitor's key, version and extensions end here.
    if (!HOP.has(k) && !WHO.has(k) && k !== named && !k.startsWith("sec-websocket-")) headers[k] = v;
  }
  headers["x-forwarded-for"] = clientAddress(request);
  const url = new URL(`ws://127.0.0.1:${child.port}${at.pathname}${at.search}`);
  const opened = await connectUpstream(url, headers, offeredProtocols(request));
  if (!opened.ok) return new Response("this forge is not answering", { status: 502 });
  const upstream = opened.value;
  const upgraded = server.upgrade(request, {
    data: { upstream, userId: undefined, db, port: child.port },
    ...(upstream.protocol === "" ? {} : { headers: { "sec-websocket-protocol": upstream.protocol } }),
  });
  if (upgraded) return undefined;
  upstream.close(1000);
  return new Response("bad websocket handshake", { status: 400 });
}
@@ -17,6 +17,7 @@
import type { ChildAppsSummary } from "./child-apps.ts";
import { hostedChildApps } from "./host.ts";
import { hasAdmin, spawnedOrg } from "./claim.ts";
import { lastHeard, type Beat } from "./heartbeat.ts";
import { reachOf, reachWords, type ChildReach } from "./reach.ts";
import type { Size } from "./sizes.ts";
import { forgeUse, type ForgeUse } from "./usage.ts";
@@ -39,6 +40,8 @@
export interface ClientRow {
  readonly lastActivityAt: string | null;
  /** The apps this parent runs for the child; null when it runs none here. */
  readonly running: ChildAppsSummary | null;
  /** What a visitor got from its public addresses when last asked (`spawn/reach.ts`); null before it was. */
  readonly reach: ChildReach | null;
  /** Why this forge needs its owner now; null when it does not. */
  readonly attention: Attention | null;
  /** Dollars the child's crew spent today, from its last heartbeat; null when it has not said. */
@@ -202,6 +205,7 @@
export async function clientRows(app: App): Promise<ClientRow[]> {
      claimed: states[i]?.claimed ?? null,
      lastActivityAt: states[i]?.lastActivityAt ?? null,
      running: hostedChildApps(app, c.name) ?? null,
      reach: reachOf(app, c.name) ?? null,
      spendTodayUsd: beats[i]?.beat.spendTodayUsd ?? null,
      ceilingUsd: beats[i]?.beat.ceilingUsd ?? null,
      size: c.size,
@@ -236,6 +240,7 @@
export function attentionOf(r: ClientRow, now: number): Attention | null {
  const last = r.lastActivityAt === null ? NaN : Date.parse(r.lastActivityAt);
  if (r.claimed === null || (!Number.isNaN(last) && now - last > SILENT_MS)) return "silent";
  if (r.running !== null && r.running.notRunning.length > 0) return "down";
  if (r.reach !== null && !r.reach.ok) return "down";
  const sent = r.sentAt === null ? NaN : Date.parse(r.sentAt);
  if (r.claimed === false && !Number.isNaN(sent) && now - sent > UNCLAIMED_MS) return "unclaimed";
  return null;
@@ -270,6 +275,8 @@
export function claimState(r: ClientRow): keyof typeof CLAIM_WORDS {
/** "3 apps running", or which one is not and why; null when none are run here. */
export function runningWords(r: ClientRow): string | null {
  const unreachable = reachWords(r.reach);
  if (unreachable !== null) return unreachable;
  const a = r.running;
  if (a === null || a.total === 0) return null;
  const word = `${a.running} ${a.running === 1 ? "app" : "apps"} running`;
@@ -7,6 +7,7 @@
 */
import { startWatch, probeOf, type Probe } from "./live.ts";
import { firstProof, reachWords, settleChild } from "./reach.ts";
import { reissueClaim, spawnForge, type SpawnError } from "../actions/spawn.ts";
import type { App } from "../app.ts";
import { maxChildren } from "../core/capacity.ts";
@@ -314,11 +315,25 @@
export async function spawnDoor(
    void bootHostedChild(ctx.app, made.value.name);
    startWatch(ctx.app, { name: made.value.name, startedAt, probe: (probes.get(ctx.app) ?? probeOf)(made.value.url) });
  }
  // Proven from outside before it is called done: the child's home and each
  // app's public address, each with what came back. What does not answer yet
  // is kept proving behind this answer, and is an alarm if it never does.
  const proved = made.value.existed ? undefined : await firstProof(ctx.app, made.value.name);
  if (proved !== undefined) void settleChild(ctx.app, made.value.name);
  return {
    status: made.value.existed ? 200 : 201,
    body: {
      dryRun: false,
      ...made.value,
      ...(proved === undefined
        ? {}
        : {
            reach: {
              ok: proved.ok,
              says: proved.ok ? "Every public address answered." : `${reachWords(proved)}. Still checking; the owner is alarmed if it does not come up in 3 minutes.`,
              proofs: proved.proofs,
            },
          }),
      ...(typeof modelKey === "string" ? { keyNote: KEY_BUDGET_NOTE } : {}),
    },
  };
@@ -8,7 +8,7 @@
import { childDirOf } from "../actions/spawn.ts";
import { createApp, type App } from "../app.ts";
import { appsRuntime, type AppsRuntime } from "../apps/runtime.ts";
import { resolveAppHost, type AppTarget } from "../apps/proxy.ts";
import { resolveAppHost, type AppSocket, type AppTarget } from "../apps/proxy.ts";
import { childAppsSummary, startChildApps, stopChildApps } from "./child-apps.ts";
import { childHost } from "./door.ts";
import { firstBoot } from "./first-boot.ts";
@@ -22,7 +22,7 @@
import {
  type PlacementKind,
} from "./placement.ts";
import { DEFAULT_SIZE, isSize, type Size } from "./sizes.ts";
import { cellChildren, forward, type CellChild } from "./cell.ts";
import { cellChildren, forward, forwardSocket, type CellChild } from "./cell.ts";
import { cellsAvailable } from "../apps/contain.ts";
import { readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
import { join } from "node:path";
@@ -292,3 +292,23 @@
export async function answerFromCell(parent: App, request: Request, named?: stri
  void settleCell(parent, ledger);
  return new Response("this forge is starting", { status: 503, headers: { "retry-after": "5", "cache-control": "no-store" } });
}
/**
 * A websocket handshake for a child in its own cell (its home or one of its
 * apps): carried to the cell like any request. `undefined` means it became a
 * socket; while the cell is not up the answer is 503, as for a page.
 */
export async function socketToCell(
  parent: App,
  request: Request,
  server: Bun.Server<AppSocket>,
  named?: string,
): Promise<Response | undefined> {
  const name = named ?? parseHostedChildName(request.headers.get("host") ?? "", childHost(parent));
  const ledger = name === undefined ? undefined : readLedgerSync(parent, name);
  if (ledger === undefined || ledger.placement !== "cell") return new Response("not found", { status: 404 });
  const child = cellChildren(parent).get(ledger.bodyId);
  if (child !== undefined) return forwardSocket(child, request, server, parent.db, parent.config.clientIpHeader);
  void settleCell(parent, ledger);
  return new Response("this forge is starting", { status: 503, headers: { "retry-after": "5", "cache-control": "no-store" } });
}
@@ -0,0 +1,299 @@
/**
 * "Running" is proven from outside (#7959). A child forge's process being up
 * inside its cell says nothing about whether a visitor reaches it: Starck's
 * pages said "App · running" for days while every public address answered
 * 404. So the parent asks the way a visitor does — its own public address
 * for the child's home and for each app (`<app>--<child>--<parentHost>`) —
 * and keeps what came back, per URL, under `<data>/reach/<child>.json`.
 *
 * A probe asserts the *answer*, not the status: the platform's wildcard
 * standby page answers 200 for a mistyped `<app>--<child>.<apex>`, so a
 * 200 proves nothing. The child's home must answer its own `/api/v1/forge`
 * (a JSON `claimed`), and an app must carry the `x-forge-app: <slug>` the
 * proxy writes on everything it carries back.
 *
 * A child that stays unreachable raises an alarm: `forge.child_unreachable`
 * on the outbox and an `unreachable` flow alarm the notifier pages the
 * owner with (`crew/notify.ts`); `forge.child_reachable` ends it.
 */
import { Database } from "bun:sqlite";
import { mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
import { join } from "node:path";
import { childDirOf, listChildren, type Child } from "../actions/spawn.ts";
import type { App } from "../app.ts";
import { isSlug, slugFor } from "../core/apps.ts";
import type { FiredAlarm } from "../flow/alarms.ts";
import { childPublicUrl, parentOrigin } from "./placement.ts";
export const APP_HEADER = "x-forge-app";
const PROBE_MS = 3000;
/** How often the parent re-proves every child; the schedule is `startReachWatch`. */
export const REACH_EVERY_MS = 5 * 60_000;
/** A new child gets this long to come up before its failure is an alarm. */
export const SETTLE_MS = 3 * 60_000;
const SETTLE_POLL_MS = 3000;
/** A failing sweep is confirmed once more after this, so one dropped request pages nobody. */
const CONFIRM_MS = 5000;
const BATCH = 4;
/** One public address and what came back from it. */
export interface Proof {
  /** `home`, or the app's slug. */
  readonly label: string;
  readonly url: string;
  readonly ok: boolean;
  /** The HTTP status; null when nothing answered. */
  readonly status: number | null;
  /** One sentence: what was asked and what is wrong, or "answered". */
  readonly says: string;
}
export interface ChildReach {
  readonly name: string;
  /** When it was last proved, ISO. */
  readonly at: string;
  readonly ok: boolean;
  /** When it first failed in the run of failures it is in, ISO; null while it is reachable. */
  readonly since: string | null;
  /** Whether the owner has been told it is unreachable; false while a new child is still settling. */
  readonly alarmed: boolean;
  readonly proofs: readonly Proof[];
}
type FetchLike = (url: string, init?: RequestInit) => Promise<Response>;
interface Options {
  /** True where there is no public network to prove through (a test suite); an injected `fetch` still works. */
  readonly off?: boolean;
  readonly fetch?: FetchLike;
  readonly settleMs?: number;
  readonly pollMs?: number;
  readonly confirmMs?: number;
}
const options = new WeakMap<App, Options>();
/** Tests swap how public addresses are asked, and how long a settle waits. */
export function useReach(app: App, o: Options): void {
  options.set(app, o);
}
let fallback: Options = {};
/** What every app without its own `useReach` does; the test preload turns proving off. */
export function useReachByDefault(o: Options): void {
  fallback = o;
}
const optionsOf = (app: App): Options => options.get(app) ?? fallback;
const off = (app: App): boolean => optionsOf(app).fetch === undefined && optionsOf(app).off === true;
export const homeUrlOf = (child: Pick<Child, "url">): string => `${child.url}/api/v1/forge`;
/** An app of a child, at the address a visitor types: `<app>--<child>--<parentHost>`. */
export const appUrlOf = (app: App, child: Pick<Child, "name">, slug: string): string =>
  `${childPublicUrl(`${slug}--${child.name}`, parentOrigin(app.config))}/`;
/**
 * The slugs of a child's public apps: those it was given (the repositories
 * in the ledger, which a child makes apps of on its first boot) and any its
 * own database holds since (it sits in this forge's data directory, read-only).
 */
export function slugsOf(app: App, child: Child): string[] {
  const slugs = new Set(child.apps.map((ref) => slugFor(ref.split("/")[1] ?? ref)));
  try {
    const db = new Database(join(childDirOf(app, child.bodyId), "forge.db"), { readonly: true });
    try {
      // The child's database is the child's to write: a slug that is not the forge's slug rule
      // would steer this fetch to another host (`evil.example#`, `u@host`), so it is dropped.
      for (const r of db.query<{ slug: string }, []>("SELECT slug FROM app WHERE access = 'public'").all()) if (typeof r.slug === "string" && isSlug(r.slug)) slugs.add(r.slug);
    } finally {
      db.close();
    }
  } catch {
    // Not yet a database to read: the ledger's repositories are what is known.
  }
  return [...slugs].sort();
}
async function ask(fetcher: FetchLike, url: string): Promise<{ status: number; headers: Headers; body: string } | string> {
  try {
    const res = await fetcher(url, { redirect: "manual", signal: AbortSignal.timeout(PROBE_MS), headers: { accept: "*/*" } });
    const body = res.headers.get("content-type")?.includes("json") ? await res.text() : (await res.body?.cancel(), "");
    return { status: res.status, headers: res.headers, body: body.slice(0, 4096) };
  } catch (error) {
    return String(error instanceof Error ? error.message : error).slice(0, 120);
  }
}
/** The child's home answers as the forge it is. */
export async function proveHome(fetcher: FetchLike, child: Pick<Child, "url">): Promise<Proof> {
  const url = homeUrlOf(child);
  const got = await ask(fetcher, url);
  if (typeof got === "string") return { label: "home", url, ok: false, status: null, says: `no answer (${got})` };
  let claimed = false;
  try {
    claimed = typeof (JSON.parse(got.body) as { claimed?: unknown }).claimed === "boolean";
  } catch {
    claimed = false;
  }
  if (got.status === 200 && claimed) return { label: "home", url, ok: true, status: 200, says: "answered 200" };
  return { label: "home", url, ok: false, status: got.status, says: `answered ${got.status}, not by the forge` };
}
/** An app answers as itself: not a 5xx, and carrying the proxy's `x-forge-app` for this slug. */
export async function proveApp(fetcher: FetchLike, url: string, slug: string): Promise<Proof> {
  const got = await ask(fetcher, url);
  if (typeof got === "string") return { label: slug, url, ok: false, status: null, says: `no answer (${got})` };
  if (got.headers.get(APP_HEADER) !== slug)
    return { label: slug, url, ok: false, status: got.status, says: `answered ${got.status}, not by the app` };
  if (got.status >= 500) return { label: slug, url, ok: false, status: got.status, says: `the app answered ${got.status}` };
  return { label: slug, url, ok: true, status: got.status, says: `answered ${got.status}` };
}
/** Ask every public address of a child, as a visitor does. Nothing is kept. */
export async function proveChild(app: App, child: Child): Promise<ChildReach> {
  const fetcher = optionsOf(app).fetch ?? fetch;
  const proofs = await Promise.all([
    proveHome(fetcher, child),
    ...slugsOf(app, child).map((slug) => proveApp(fetcher, appUrlOf(app, child, slug), slug)),
  ]);
  return { name: child.name, at: new Date().toISOString(), ok: proofs.every((p) => p.ok), since: null, alarmed: false, proofs };
}
// ---- what was last proved ----
const dirOf = (app: App): string => join(app.config.dataDir, "reach");
/** What was last proved of a child; undefined before it was ever asked. */
export function reachOf(app: App, name: string): ChildReach | undefined {
  try {
    const raw = JSON.parse(readFileSync(join(dirOf(app), `${name}.json`), "utf8")) as ChildReach;
    return Array.isArray(raw.proofs) && typeof raw.ok === "boolean" ? raw : undefined;
  } catch {
    return undefined;
  }
}
function keep(app: App, reach: ChildReach): void {
  try {
    mkdirSync(dirOf(app), { recursive: true });
    const path = join(dirOf(app), `${reach.name}.json`);
    writeFileSync(`${path}.tmp`, JSON.stringify(reach));
    renameSync(`${path}.tmp`, path);
  } catch (error) {
    app.log.error("could not keep the reach", { name: reach.name, error: String(error) });
  }
}
/** The failing proofs in a sentence a person can read, or null when all are fine. */
export function reachWords(reach: ChildReach | null | undefined): string | null {
  if (reach === null || reach === undefined || reach.ok) return null;
  const bad = reach.proofs.filter((p) => !p.ok).map((p) => `${p.label} ${p.says}`);
  return `Running, not reachable: ${bad.join("; ")}`;
}
/**
 * Keep a proof, carrying `since` from the run of failures it continues, and
 * put the change on the outbox: unreachable once when the owner is first
 * told, reachable once when that ends. `alarm` is false while a new child
 * is still settling.
 */
function record(app: App, proved: ChildReach, alarm: boolean): ChildReach {
  const before = reachOf(app, proved.name);
  const since = proved.ok ? null : (before?.ok === false ? before.since : null) ?? proved.at;
  const raise = alarm && !proved.ok && before?.alarmed !== true;
  const end = proved.ok && before?.alarmed === true;
  const reach: ChildReach = { ...proved, since, alarmed: proved.ok ? false : raise || before?.alarmed === true };
  keep(app, reach);
  if (raise) app.bus.append({ kind: "forge.child_unreachable", payload: { name: reach.name, says: reachWords(reach) ?? "", since } });
  else if (end) app.bus.append({ kind: "forge.child_reachable", payload: { name: reach.name } });
  return reach;
}
/**
 * Prove a child once and say what came back. A new child is the caller's
 * to settle (`settleChild`); a failure here is kept without an alarm.
 */
export async function firstProof(app: App, name: string): Promise<ChildReach | undefined> {
  if (off(app)) return undefined;
  const child = (await listChildren(app)).find((c) => c.name === name);
  if (child === undefined || !child.done) return undefined;
  return record(app, await proveChild(app, child), false);
}
/**
 * Keep proving a new child until all of it answers or `SETTLE_MS` passes;
 * if it never does, that is the alarm. Never throws.
 */
export async function settleChild(app: App, name: string): Promise<void> {
  if (off(app)) return;
  const o = optionsOf(app);
  const until = Date.now() + (o?.settleMs ?? SETTLE_MS);
  try {
    for (;;) {
      const child = (await listChildren(app)).find((c) => c.name === name);
      if (child === undefined || app.closing.signal.aborted) return;
      const proved = await proveChild(app, child);
      const last = Date.now() >= until;
      const reach = record(app, proved, last);
      if (reach.ok || last) return;
      await new Promise<void>((done) => {
        const t = setTimeout(done, o?.pollMs ?? SETTLE_POLL_MS);
        app.closing.signal.addEventListener("abort", () => (clearTimeout(t), done()), { once: true });
      });
    }
  } catch (error) {
    app.log.error("could not settle a new child's reach", { name, error: String(error) });
  }
}
/** One pass over every finished child: prove, confirm a failure once, keep, alarm on a change. */
export async function sweepReach(app: App): Promise<void> {
  if (off(app)) return;
  const confirmMs = optionsOf(app).confirmMs ?? CONFIRM_MS;
  const children = (await listChildren(app)).filter((c) => c.done);
  for (let i = 0; i < children.length; i += BATCH) {
    await Promise.all(
      children.slice(i, i + BATCH).map(async (child) => {
        try {
          let proved = await proveChild(app, child);
          if (!proved.ok) {
            await Bun.sleep(confirmMs);
            proved = await proveChild(app, child);
          }
          record(app, proved, true);
        } catch (error) {
          app.log.error("could not prove a child's reach", { name: child.name, error: String(error) });
        }
      }),
    );
  }
}
/** Re-prove every child on a schedule, the first pass soon after boot. Returns the timer to clear. */
export function startReachWatch(app: App, everyMs = REACH_EVERY_MS): ReturnType<typeof setInterval> {
  const first = setTimeout(() => void sweepReach(app), 30_000);
  const timer = setInterval(() => void sweepReach(app), everyMs);
  app.closing.signal.addEventListener("abort", () => clearTimeout(first), { once: true });
  return timer;
}
/** The children that are unreachable now, as flow alarms the notifier pages the owner with. */
export function reachAlarms(app: App): FiredAlarm[] {
  let files: string[] = [];
  try {
    files = readdirSync(dirOf(app));
  } catch {
    return [];
  }
  const out: FiredAlarm[] = [];
  for (const f of files.filter((f) => f.endsWith(".json")).sort()) {
    const reach = reachOf(app, f.slice(0, -".json".length));
    if (reach === undefined || reach.ok || !reach.alarmed || reach.since === null) continue;
    out.push({ key: "unreachable", says: `${reach.name} is ${reachWords(reach)?.toLowerCase() ?? "not reachable"}`, since: reach.since, href: "/forges" });
  }
  return out;
}
@@ -17,12 +17,18 @@
import { clientRows } from "../../spawn/clients.ts";
/** [name, "Not reporting · for Maria · Claimed · 3 apps running"] per row; an empty line when none. */
export function forgeLines(rows: readonly ClientRow[]): [string, string][] {
  if (rows.length === 0) return [["", "You have not sent a forge yet"]];
  return rows.map((r) => [
  return rows.flatMap((r): [string, string][] => [[
    r.name,
    [r.attention === null ? null : ATTENTION_WORDS[r.attention], r.for === null ? null : `for ${r.for}`, CLAIM_WORDS[claimState(r)], runningWords(r), r.nextStep.words, spendWords(r)?.words ?? null, useLine(r.size, r.use), r.lastHeartbeatAt === null ? "no heartbeat yet" : `heartbeat ${timeAgo(r.lastHeartbeatAt)}`]
      .filter((m): m is string => m !== null)
      .join(" · "),
  ]);
  ], ...addressLines(r)]);
}
/** Under a forge that is running, not reachable: each public address and what it answered (#7959), as /forges lists them. */
function addressLines(r: ClientRow): [string, string][] {
  if (r.reach === null || r.reach.ok) return [];
  return r.reach.proofs.map((p): [string, string] => ["", `  ${p.ok ? "reachable" : "NOT REACHABLE"} ${p.url.replace(/^https?:\/\//, "")}: ${p.says}`]);
}
/** The lines that fit in `room` rows; when some do not, the last row says how many. */
@@ -24,7 +24,8 @@
import { claimLinkBody } from "./new-forge.ts";
function runningNote(r: ClientRow): Html | null {
  const words = runningWords(r);
  if (words === null) return null;
  return html`<span data-apps="${r.running!.notRunning.length === 0 ? "up" : "down"}"
  const down = (r.running?.notRunning.length ?? 0) > 0 || r.reach?.ok === false;
  return html`<span data-apps="${down ? "down" : "up"}"
    >${words}</span
  >`;
}
@@ -58,6 +59,19 @@
function forgeRow(r: ClientRow): Html {
    title: html`<a href="${r.url}">${r.name}</a>`,
    meta: html`${meta.map((m, i) => html`${i > 0 ? " · " : ""}${m}`)}`,
    data: { forge: r.name, claimed: state },
    ...(r.reach === null
      ? {}
      : {
          // One row per public address; the word in the trail, not a colour, says which failed.
          children: r.reach.proofs.map((p) =>
            row({
              title: html`<a href="${p.url}">${p.url.replace(/^https?:\/\//, "")}</a>`,
              meta: html`${p.says}`,
              trail: badge(p.ok ? "reachable" : "not reachable", p.ok ? { tone: "success" as const } : { tone: "attn" as const }),
              data: { proof: p.ok ? "ok" : "failed" },
            }),
          ),
        }),
    trail: html`${r.attention === null
        ? null
        : html`<span data-attention="${r.attention}">${badge(ATTENTION_WORDS[r.attention], { tone: "attn" })}</span>`}${badge(CLAIM_WORDS[state], {
@@ -20,6 +20,7 @@
const row = (name: string, o: Partial<ClientRow> = {}): Omit<ClientRow, "attenti
  claimed: true,
  lastActivityAt: ago(1),
  running: null,
  reach: null,
  size: "small",
  use: { kind: "shared" },
  lastHeartbeatAt: null,
@@ -6,6 +6,7 @@
import { provideCpusForTest } from "../../src/core/capacity.ts";
import { provideMirrorOutboundForTest } from "../../src/origins/git-mirror.ts";
import { installCheapHash } from "./cheap-hash.ts";
import { useReachByDefault } from "../../src/spawn/reach.ts";
installCheapHash();
// Defaults sized from CPUs (#2549) read as on a 4-CPU pod — 4 shards, one
@@ -18,3 +19,6 @@
provideMirrorOutboundForTest({ allow: ["127.0.0.1", "::1"] });
// Loopback is reachable for origin discovery only in dev (#2993); the suite
// serves its fake forges from this machine.
process.env.FORGE_DEV = "1";
// A suite has no public network to prove a child through (`spawn/reach.ts`); a test of reach injects its own fetch.
useReachByDefault({ off: true });
@@ -0,0 +1,85 @@
/**
 * A real spawn, end to end (#7959), as `test/spawn-cell-e2e.test.ts` drives
 * it. Its own process, for the reason `real-child-forge.ts` is: a check sets
 * `FORGE_CELLS=off` for the forges its tests boot.
 *
 * A parent with the real server makes a child forge in a real cell from one
 * app, then asks `<app>--<child>--<parent>` through that server until the
 * app's own body comes back. Nothing is faked: not the cell, not the child's
 * runtime, not the route. Printed: one JSON line of what was seen.
 */
import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createRepo } from "../../src/actions/repos.ts";
import { spawnForge } from "../../src/actions/spawn.ts";
import { createApp } from "../../src/app.ts";
import { cellsAvailable } from "../../src/apps/contain.ts";
import { createUser } from "../../src/core/users.ts";
import { repoDir } from "../../src/git/repos.ts";
import { commitFiles } from "../../src/git/write.ts";
import { serve } from "../../src/http/server.ts";
import { cellPlacement, stopCellChildren } from "../../src/spawn/cell.ts";
import { bootHostedChild } from "../../src/spawn/host.ts";
import { memoryBodies } from "../../src/spawn/placement.ts";
const cells = await cellsAvailable();
if (!cells.ok) {
  console.log(JSON.stringify({ skipped: cells.reason }));
  process.exit(0);
}
const BODY = "bakery says hi";
const dataDir = mkdtempSync(join(tmpdir(), "real-spawn-"));
mkdirSync(dataDir, { recursive: true });
const parent = createApp({ dataDir, url: "https://forge.test", port: 0 });
const servers = await serve(parent);
try {
  const alice = await createUser(parent.db, { origin: "seed", trusted: true, username: "alice", email: "[email protected]", isAdmin: true });
  if (!alice.ok) throw new Error("user");
  const repo = await createRepo(parent, alice.value, { name: "bakery", visibility: "public" });
  if (!repo.ok) throw new Error("repo");
  const committed = await commitFiles(repoDir(parent.reposRoot, "alice", "bakery"), {
    branch: "main",
    message: "bakery",
    files: [
      { path: "forge.json", content: JSON.stringify({ app: { run: "bun run index.ts", health: "/" } }) },
      { path: "index.ts", content: `Bun.serve({ port: Number(process.env.PORT), fetch() { return new Response(${JSON.stringify(BODY)}) } })\n` },
    ],
    author: { name: "a", email: "[email protected]" },
  });
  if (!committed.ok) throw new Error("commit");
  const made = await spawnForge(
    parent,
    alice.value,
    { name: "kid", org: "kids", apps: ["alice/bakery"], carryBriefs: false, carrySubscriptions: false },
    { catalog: [{ ref: "alice/bakery", readable: true, bytes: 10, forgeJsonBytes: 0 }], briefs: [], subscriptions: [] },
    {
      placement: cellPlacement(parent, memoryBodies(), () => 10),
      request: new Request("https://forge.test/x", { method: "POST", headers: { origin: "https://forge.test" } }),
      url: new URL("https://forge.test/x"),
    },
  );
  if (!made.ok) throw new Error(JSON.stringify(made.error));
  await bootHostedChild(parent, "kid");
  let status = 0;
  let body = "";
  let app: string | null = null;
  const until = Date.now() + 150_000;
  while (Date.now() < until) {
    const res = await fetch(`${servers.url}/`, { headers: { host: "bakery--kid--forge.test" }, redirect: "manual" }).catch(() => undefined);
    if (res !== undefined) {
      status = res.status;
      body = await res.text();
      app = res.headers.get("x-forge-app");
      if (status === 200 && app === "bakery") break;
    }
    await Bun.sleep(1000);
  }
  console.log(JSON.stringify({ placement: made.value.placement, status, body: body.slice(0, 200), app }));
} finally {
  servers.stop();
  await stopCellChildren(parent);
  parent.close();
  rmSync(dataDir, { recursive: true, force: true });
}
@@ -0,0 +1,33 @@
/**
 * A real spawn, end to end (#7959): a child forge in a real cell, from an
 * app, then `<app>--<child>--<parent>` through the real server answers with
 * the app's own body. `spawn-cell-app-hosts.test.ts` fakes the cell; this
 * does not. It runs where bwrap and socat are (as `spawn-cell.test.ts`'s
 * real child does) and says it skipped where they are not.
 */
import { expect, test } from "bun:test";
import { join } from "node:path";
import { portInsteadOfSocket } from "../src/git/hook-address.ts";
import { missing } from "./helpers/tools.ts";
const cellTools = process.platform === "linux" && !portInsteadOfSocket() && !missing("bwrap", "socat");
test.skipIf(!cellTools)("a child forge spawned into a cell serves its app at <app>--<child>--<parent>", async () => {
  const env: Record<string, string> = {};
  for (const [k, v] of Object.entries(process.env)) if (v !== undefined && k !== "FORGE_CELLS") env[k] = v;
  const proc = Bun.spawn([process.execPath, join(import.meta.dir, "helpers", "real-spawn-e2e.ts")], { env, stdout: "pipe", stderr: "pipe" });
  const [out, errText] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited]);
  const line = out.trim().split("\n").pop() ?? "";
  let seen: Record<string, unknown>;
  try {
    seen = JSON.parse(line) as Record<string, unknown>;
  } catch {
    throw new Error(`the spawn run printed no result: ${out.slice(-800)} ${errText.slice(-800)}`);
  }
  if (typeof seen["skipped"] === "string") {
    console.log(`SKIPPING: this host refuses a cell inside the test (${seen["skipped"]}), so no child was spawned into one`);
    return;
  }
  expect(seen["placement"]).toBe("cell");
  expect(seen).toMatchObject({ status: 200, app: "bakery", body: "bakery says hi" });
}, 200_000);
@@ -0,0 +1,106 @@
/**
 * A websocket reaches an app in a child's cell (#7959): `forward` is a fetch,
 * which cannot carry an upgrade, so a handshake for the child's home or one
 * of its apps is opened to the cell first and answered second, as `proxyApp`
 * does for an app of this forge.
 */
import { afterAll, beforeAll, expect, test } from "bun:test";
import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { cellChildren } from "../src/spawn/cell.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
let parent: App;
let servers: Servers;
let cell: ReturnType<typeof Bun.serve>;
const seen: { host: string | null; forwarded: string | null; protocols: string | null; path: string }[] = [];
beforeAll(async () => {
  const dataDir = mkdtempSync(join(tmpdir(), "cell-socket-"));
  parent = createApp({ dataDir, url: "https://forge.test", port: 0 });
  mkdirSync(join(dataDir, "spawn"), { recursive: true });
  writeFileSync(join(dataDir, "spawn", "kid.json"), JSON.stringify({ name: "kid", bodyId: "cell-k", done: true, placement: "cell", size: "small" }));
  writeFileSync(join(dataDir, "spawn", "down.json"), JSON.stringify({ name: "down", bodyId: "cell-d", done: true, placement: "cell", size: "small" }));
  cell = Bun.serve({
    port: 0,
    fetch(request, server) {
      const url = new URL(request.url);
      if (url.pathname === "/ws") {
        seen.push({
          host: request.headers.get("host"),
          forwarded: request.headers.get("x-forwarded-for"),
          protocols: request.headers.get("sec-websocket-protocol"),
          path: url.pathname + url.search,
        });
        if (server.upgrade(request, { data: null, headers: { "sec-websocket-protocol": "chat" } })) return undefined;
      }
      return new Response("plain", { status: 404 });
    },
    websocket: {
      open: (ws) => void ws.send("hello from the cell"),
      message: (ws, m) => void ws.send(`echo ${String(m)}`),
    },
  });
  const port = cell.port;
  (cellChildren(parent) as { get: unknown }).get = (id: string) => (id === "cell-k" ? { port } : undefined);
  servers = await serve(parent);
});
afterAll(() => {
  servers.stop();
  void cell.stop(true);
  parent.close();
});
const open = (host: string, path = "/ws?x=1", protocols: string[] = ["chat"]) =>
  new Promise<{ socket: WebSocket; frames: string[]; closed: Promise<number> } | string>((resolve) => {
    const socket = new WebSocket(`${servers.url.replace("http", "ws")}${path}`, { protocols, headers: { host } } as never);
    const frames: string[] = [];
    const closed = new Promise<number>((done) => socket.addEventListener("close", (e) => done(e.code)));
    socket.addEventListener("message", (e) => frames.push(String(e.data)));
    socket.addEventListener("open", () => resolve({ socket, frames, closed }), { once: true });
    socket.addEventListener("close", () => resolve("refused"), { once: true });
  });
const until = async (ok: () => boolean) => {
  for (let i = 0; i < 100 && !ok(); i++) await Bun.sleep(20);
};
test("an app's socket in a cell: frames go both ways, with the app's own Host and path", async () => {
  const opened = await open("deal--kid--forge.test");
  if (typeof opened === "string") throw new Error("the socket did not open");
  await until(() => opened.frames.length > 0);
  expect(opened.frames[0]).toBe("hello from the cell");
  expect(opened.socket.protocol).toBe("chat");
  opened.socket.send("ping");
  await until(() => opened.frames.length > 1);
  expect(opened.frames[1]).toBe("echo ping");
  opened.socket.close(1000);
  await opened.closed;
  const last = seen.at(-1)!;
  expect(last.host).toBe("deal--kid--forge.test");
  expect(last.path).toBe("/ws?x=1");
  expect(last.protocols).toBe("chat");
});
test("the child's own host carries a socket too, and the cell hears the address the forge resolved", async () => {
  const opened = await open("kid--forge.test");
  if (typeof opened === "string") throw new Error("the socket did not open");
  await until(() => opened.frames.length > 0);
  expect(opened.frames[0]).toBe("hello from the cell");
  expect(seen.at(-1)!.host).toBe("kid--forge.test");
  expect(seen.at(-1)!.forwarded).not.toBeNull();
  opened.socket.close(1000);
  await opened.closed;
});
test("a path the cell does not upgrade is a refusal, and a cell that is not up is not a socket", async () => {
  expect(await open("deal--kid--forge.test", "/nope")).toBe("refused");
  expect(await open("deal--down--forge.test")).toBe("refused");
  expect(await open("deal--nobody--forge.test")).toBe("refused");
});
@@ -130,6 +130,8 @@
describe("a hosted child's apps run in the parent", () => {
  test("<app>--<child>--<parent> answers from the child's app, on the child's own data", async () => {
    const res = await ask("bakery--maria--forge.test");
    expect(res.status).toBe(200);
    // Says which app answered, so a probe from outside tells it from a platform's standby page (spawn/reach.ts).
    expect(res.headers.get("x-forge-app")).toBe("bakery");
    const data = await res.text();
    // The child's directory, never the parent's or another child's.
    expect(data.startsWith(join(childDir, "apps"))).toBe(true);
@@ -0,0 +1,122 @@
/**
 * A new forge is proven before it is called done (#7959): the spawn result
 * lists the child's home and each app's public address with what came back,
 * through the API and the MCP, and what never answers is an alarm.
 */
import { afterAll, beforeAll, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { createRepo } from "../src/actions/repos.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, getUserByName } from "../src/core/users.ts";
import { alarmLines } from "../src/crew/notify.ts";
import { listEvents } from "../src/core/events.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { ok } from "../src/kernel/result.ts";
import { useChildFetch } from "../src/spawn/clients.ts";
import { usePlacement, useProbe } from "../src/spawn/door.ts";
import { reachAlarms, reachOf, useReach } from "../src/spawn/reach.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
let dataDir = "";
let app: App;
let servers: Servers;
let token = "";
/** What the public network answers: the child's home, but a standby page for its app. */
const answers = new Map<string, () => Response>();
let n = 0;
const spawn = (name: string) =>
  fetch(`${servers.url}/api/v1/forges`, {
    method: "POST",
    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
    body: JSON.stringify({ name, apps: ["alice/notes"], dryRun: false }),
  });
beforeAll(async () => {
  dataDir = await mkdtemp(join(tmpdir(), "forge-reach-door-"));
  app = createApp({ dataDir, url: "https://forge.test", port: 0 });
  servers = await serve(app);
  const a = await createUser(app.db, { origin: "seed", trusted: true, username: "alice", email: "[email protected]", password: "a-good-passphrase", adminIfFirst: true });
  if (!a.ok) throw new Error("user");
  token = createToken(app.db, a.value.id, "rw", "rw").token;
  const repo = await createRepo(app, a.value, { name: "notes" });
  if (!repo.ok) throw new Error("repo");
  useProbe(app, () => async () => true);
  usePlacement(app, {
    place: async (plan) => ok({ url: `https://${plan.name}--forge.test`, bodyId: `fake-${++n}` }),
    retire: async () => ok(),
  });
  useChildFetch(app, async () => Response.json({ claimed: false }));
  useReach(app, {
    settleMs: 0,
    pollMs: 1,
    confirmMs: 0,
    fetch: async (url) => (answers.get(url) ?? (() => new Response("<h1>standby</h1>", { status: 200 })))(),
  });
}, 30_000);
afterAll(async () => {
  servers.stop();
  app.close();
  await rm(dataDir, { recursive: true, force: true });
});
test("the spawn result lists each address with its result; a standby page is a failure, not green", async () => {
  answers.set("https://kid--forge.test/api/v1/forge", () => Response.json({ claimed: false }));
  const res = await spawn("kid");
  expect(res.status).toBe(201);
  const made = (await res.json()) as any;
  expect(made.reach.ok).toBe(false);
  expect(made.reach.says).toContain("Running, not reachable: notes answered 200, not by the app");
  expect(made.reach.proofs).toEqual([
    { label: "home", url: "https://kid--forge.test/api/v1/forge", ok: true, status: 200, says: "answered 200" },
    { label: "notes", url: "https://notes--kid--forge.test/", ok: false, status: 200, says: "answered 200, not by the app" },
  ]);
  // The never-answering app is the alarm, once its time to come up is over.
  for (let i = 0; i < 100 && reachAlarms(app).length === 0; i++) await Bun.sleep(20);
  expect(reachAlarms(app).map((a) => a.key)).toEqual(["unreachable"]);
  expect(listEvents(app.db, { kind: "forge.child_unreachable", limit: 5 })).toHaveLength(1);
  expect(reachOf(app, "kid")?.alarmed).toBe(true);
});
test("/forges lists the same results, and the MCP spawn says it", async () => {
  const list = await fetch(`${servers.url}/api/v1/forges`, { headers: { authorization: `Bearer ${token}` } });
  expect(list.status).toBe(200);
  answers.set("https://lamp--forge.test/api/v1/forge", () => Response.json({ claimed: false }));
  const res = await fetch(`${servers.url}/mcp`, {
    method: "POST",
    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "spawn", arguments: { name: "lamp", apps: ["alice/notes"], dryRun: false } } }),
  });
  const text = ((await res.json()) as any).result.content[0].text as string;
  expect(text).toContain("Running, not reachable");
  const forges = await fetch(`${servers.url}/mcp`, {
    method: "POST",
    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
    body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/call", params: { name: "forges", arguments: {} } }),
  });
  const body = JSON.parse(((await forges.json()) as any).result.content[0].text) as { forges: { name: string; reach: { ok: boolean } }[] };
  expect(body.forges.find((f) => f.name === "kid")?.reach.ok).toBe(false);
});
test("/forges says Running, not reachable with each address and its result", async () => {
  const page = await fetch(`${servers.url}/forges`, { headers: { authorization: `Bearer ${token}` } });
  expect(page.status).toBe(200);
  const html = await page.text();
  expect(html).toContain("Running, not reachable: notes answered 200, not by the app");
  expect(html).toContain('data-proof="failed"');
  expect(html).toContain("notes--kid--forge.test/");
  expect(html).toContain('data-proof="ok"');
});
test("the owner is paged: the notifier's alarm lines carry the unreachable child", async () => {
  const admin = getUserByName(app.db, "alice")!;
  const lines = alarmLines(app, admin);
  expect(lines.map((l) => l.line)).toContainEqual(expect.stringContaining("kid is running, not reachable"));
  expect(lines.find((l) => l.line.startsWith("kid"))?.link).toBe("/forges");
});
@@ -0,0 +1,146 @@
/**
 * "Running" is proven from outside (#7959): the parent asks a child's public
 * addresses as a visitor does, asserts the answer is the child's and the
 * app's own (a platform's standby page answers 200 for any name), keeps what
 * came back, and alarms once on a change.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { listEvents } from "../src/core/events.ts";
import { clientRows, runningWords, useChildFetch } from "../src/spawn/clients.ts";
import { Database } from "bun:sqlite";
import { childDirOf } from "../src/actions/spawn.ts";
import { appUrlOf, slugsOf, proveApp, proveHome, reachAlarms, reachOf, reachWords, sweepReach, useReach } from "../src/spawn/reach.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
const standby = () => new Response("<h1>This site is on standby</h1>", { status: 200, headers: { "content-type": "text/html" } });
describe("a probe asserts the answer, not the status", () => {
  test("the platform's standby page is a 200 and is not the child", async () => {
    expect(standby().status).toBe(200);
    const home = await proveHome(async () => standby(), { url: "https://kid--forge.test" });
    expect(home).toMatchObject({ ok: false, status: 200, says: "answered 200, not by the forge" });
  });
  test("the child's home is its own /api/v1/forge", async () => {
    const seen: string[] = [];
    const home = await proveHome(async (url) => (seen.push(url), Response.json({ claimed: false })), { url: "https://kid--forge.test" });
    expect(seen).toEqual(["https://kid--forge.test/api/v1/forge"]);
    expect(home.ok).toBe(true);
  });
  test("an app is the one that carries its own slug; a 200 without it is not it", async () => {
    const own = await proveApp(async () => new Response("hi", { headers: { "x-forge-app": "deal" } }), "https://deal--kid--forge.test/", "deal");
    expect(own).toMatchObject({ ok: true, status: 200 });
    const other = await proveApp(async () => standby(), "https://deal--kid--forge.test/", "deal");
    expect(other).toMatchObject({ ok: false, status: 200, says: "answered 200, not by the app" });
    const wrong = await proveApp(async () => new Response("x", { headers: { "x-forge-app": "other" } }), "https://deal--kid--forge.test/", "deal");
    expect(wrong.ok).toBe(false);
  });
  test("the status is kept: a 404 from the platform, a 500 from the app, no answer at all", async () => {
    const miss = await proveApp(async () => new Response("not found", { status: 404 }), "https://a--k--f.test/", "a");
    expect(miss).toMatchObject({ ok: false, status: 404, says: "answered 404, not by the app" });
    const broke = await proveApp(async () => new Response("x", { status: 502, headers: { "x-forge-app": "a" } }), "https://a--k--f.test/", "a");
    expect(broke).toMatchObject({ ok: false, status: 502, says: "the app answered 502" });
    const none = await proveApp(async () => Promise.reject(new Error("connection refused")), "https://a--k--f.test/", "a");
    expect(none).toMatchObject({ ok: false, status: null });
    expect(none.says).toContain("no answer");
  });
});
describe("a forge watches its children's addresses", () => {
  let dir = "";
  let parent: App;
  /** What each public address answers right now; absent is "no answer". */
  const world = new Map<string, () => Response>();
  const asked: string[] = [];
  const events = (kind: string) => listEvents(parent.db, { kind, limit: 20 });
  beforeAll(() => {
    dir = mkdtempSync(join(tmpdir(), "forge-reach-"));
    parent = createApp({ dataDir: dir, url: "https://forge.test", port: 0 });
    mkdirSync(join(dir, "spawn"), { recursive: true });
    writeFileSync(
      join(dir, "spawn", "kid.json"),
      JSON.stringify({ name: "kid", bodyId: "cell-k", done: true, placement: "hosted", size: "small", apps: ["alice/deal-clock"], createdAt: "2026-11-01T00:00:00.000Z" }),
    );
    useChildFetch(parent, async () => Response.json({ claimed: true, lastActivityAt: new Date().toISOString() }));
    useReach(parent, {
      confirmMs: 0,
      fetch: async (url) => {
        asked.push(url);
        const answer = world.get(url);
        if (answer === undefined) throw new Error("ENOTFOUND");
        return answer();
      },
    });
  });
  afterAll(() => parent.close());
  test("the app's address is <app>--<child>--<parentHost>", () => {
    expect(appUrlOf(parent, { name: "kid" }, "deal-clock")).toBe("https://deal-clock--kid--forge.test/");
  });
  test("a child whose addresses answer with standby pages is running, not reachable: kept, alarmed once, listed", async () => {
    world.set("https://kid--forge.test/api/v1/forge", () => Response.json({ claimed: true }));
    world.set("https://deal-clock--kid--forge.test/", () => new Response("not found", { status: 404 }));
    await sweepReach(parent);
    await sweepReach(parent);
    const reach = reachOf(parent, "kid")!;
    expect(reach.ok).toBe(false);
    expect(reach.proofs.map((p) => [p.label, p.ok, p.status])).toEqual([["home", true, 200], ["deal-clock", false, 404]]);
    expect(reachWords(reach)).toBe("Running, not reachable: deal-clock answered 404, not by the app");
    // One page for the standing failure, not one per sweep.
    expect(events("forge.child_unreachable")).toHaveLength(1);
    const [alarm] = reachAlarms(parent);
    expect(alarm).toMatchObject({ key: "unreachable", href: "/forges", since: reach.since! });
    expect(alarm!.says).toContain("kid is running, not reachable");
    const [row] = await clientRows(parent);
    expect(row!.reach?.ok).toBe(false);
    expect(row!.attention).toBe("down");
    expect(runningWords(row!)).toBe("Running, not reachable: deal-clock answered 404, not by the app");
  });
  test("when it answers again the alarm ends, once", async () => {
    world.set("https://deal-clock--kid--forge.test/", () => new Response("deal", { headers: { "x-forge-app": "deal-clock" } }));
    await sweepReach(parent);
    await sweepReach(parent);
    expect(reachOf(parent, "kid")).toMatchObject({ ok: true, since: null, alarmed: false });
    expect(reachAlarms(parent)).toEqual([]);
    expect(events("forge.child_reachable")).toHaveLength(1);
    const [row] = await clientRows(parent);
    expect(row!.attention).not.toBe("down");
  });
  test("one dropped request pages nobody: a failure is confirmed before it is believed", async () => {
    const before = events("forge.child_unreachable").length;
    let calls = 0;
    world.set("https://kid--forge.test/api/v1/forge", () => (++calls === 1 ? new Response("oops", { status: 502 }) : Response.json({ claimed: true })));
    await sweepReach(parent);
    expect(calls).toBe(2);
    expect(reachOf(parent, "kid")?.ok).toBe(true);
    expect(events("forge.child_unreachable")).toHaveLength(before);
  });
  test("a slug a child writes that is not the forge's slug rule is never asked", async () => {
    const child = { name: "kid", bodyId: "cell-k", done: true, placement: "hosted", size: "small", apps: ["alice/deal-clock"], createdAt: "" } as never;
    mkdirSync(childDirOf(parent, "cell-k"), { recursive: true });
    const db = new Database(join(childDirOf(parent, "cell-k"), "forge.db"));
    db.run("CREATE TABLE app (slug TEXT, access TEXT)");
    for (const slug of ["evil.example#", "u@host", "a/b", "UP", "ok-app"]) db.run("INSERT INTO app VALUES (?, 'public')", [slug]);
    db.close();
    expect(slugsOf(parent, child)).toEqual(["deal-clock", "ok-app"]);
    asked.length = 0;
    await sweepReach(parent);
    expect(asked.filter((u) => /evil|@|%|#|\/\/[^/]*\/[^/]/.test(u.replace(/^https:\/\//, "")) && !u.endsWith("/api/v1/forge"))).toEqual([]);
    expect(asked.every((u) => new URL(u).hostname.endsWith("--kid--forge.test") || u === "https://kid--forge.test/api/v1/forge")).toBe(true);
  });
});
@@ -25,6 +25,7 @@
const row = (over: Partial<ClientRow>): ClientRow => ({
  claimed: false,
  lastActivityAt: null,
  running: null,
  reach: null,
  attention: null,
  spendTodayUsd: null,
  ceilingUsd: null,
@@ -100,6 +101,22 @@
describe("forges you sent in the terminal", () => {
    }
  });
  test("a forge running, not reachable says so, with each address and its result", () => {
    const reach = {
      name: "maria", at: "2026-11-02T00:00:00.000Z", ok: false, since: "2026-11-02T00:00:00.000Z", alarmed: true,
      proofs: [
        { label: "home", url: "https://maria--forge.test/api/v1/forge", ok: true, status: 200, says: "answered 200" },
        { label: "deal", url: "https://deal--maria--forge.test/", ok: false, status: 404, says: "answered 404, not by the app" },
      ],
    };
    const lines = forgeLines([row({ reach })]);
    expect(lines[0]![1]).toContain("Running, not reachable: deal answered 404, not by the app");
    expect(lines.slice(1).map(([, t]) => t.trim())).toEqual([
      "reachable maria--forge.test/api/v1/forge: answered 200",
      "NOT REACHABLE deal--maria--forge.test/: answered 404, not by the app",
    ]);
  });
  test("a row carries the crew's spend today, and says when the ceiling is reached", () => {
    expect(forgeLines([row({ spendTodayUsd: 10, ceilingUsd: 10 })])[0]![1]).toContain("ceiling reached");
    expect(forgeLines([row({ spendTodayUsd: 3.2, ceilingUsd: 10 })])[0]![1]).toContain("$3.20 of $10 today");
		@@ -90,7 +90,7 @@ for a tunnel and a forge that sleeps.
90	90	\| `follow_mode` \| `{ repo, … }`: choose how a spawned forge follows its parent, `tell-me` or `take-updates`; its `forge` repository's admin only \| yes \|
91	91	\| `following` \| where a fork stands against what it follows, and what the crew is doing about it \| \|
92	92	\| `forge_proposals` \| `{ repo }`: what this forge proposed to its parent, newest first; `reachable` is false if the parent did not answer \| \|
93		\| `forges` \| an admin's list of the forges sent from here: name, address, whom for, apps, claimed or not, last activity \| \|
	93	\| `forges` \| an admin's list of the forges sent from here: name, address, whom for, apps, claimed or not, last activity, whether each public address answers \| \|
94	94	\| `forks` \| `{ repo }`: `{ parent, forks: [{ repo, ahead, behind, updatedAt }] }`, the forks the caller may see (as `/:owner/:name/forks` lists them), each with its commits ahead of and behind this one; `null` when git cannot say \| \|
95	95	\| `front_page` \| `{ pinned?, hidden?, weights?, dryRun? }`: the front page as a stranger sees it, ranked, with numbers; a site admin sets what is pinned (first public one featured), hidden, and what counts (weights of forks, ships, use, fresh, 0 to 10) \| yes \|
96	96	\| `health` \| how this forge is: the version and commit it runs, draining or not, the rollout and its incidents \| \|
		@@ -14,3 +14,5 @@ trails a palette row.
14	14	`src/web/style/content.ts` (`.finder .palette-item .cat`).
15	15	- `.flow-row` — a §5 `.row` link on the flow panel (`flow-panel.ts`: idle pulls and the "and K more" row) with a 44px
16	16	minimum height, so it is a touch target on a 360px phone. Styled in `src/web/style/components.ts` (list rows).
	17
	18	The proofs under a forge on `/forges` (#7959) are `row()` `children`, one per public address; the row's trail badge says "reachable" or "not reachable", so the state is a word and not only a colour. No new class.
		@@ -0,0 +1,32 @@
	1	# "Running" is proven from outside
	2
	3	A child forge's process being up inside its cell says nothing about whether a
	4	visitor reaches it. The parent asks the way a visitor does (#7959).
	5
	6	- What is asked. The child's home (`<child>--<parent>/api/v1/forge`, which
	7	must answer its own JSON `claimed`) and each public app
	8	(`<app>--<child>--<parent>/`, which must carry the `x-forge-app: <slug>` header
	9	the proxy writes on everything it carries back). A status alone proves
	10	nothing: the platform's wildcard standby page answers 200 for a mistyped
	11	`<app>--<child>.<apex>`.
	12	- Where it shows. A failing child reads **Running, not reachable: deal-clock
	13	answered 404, not by the app** on `/forges` (with every address and its
	14	result under the row), in the terminal's Forges screen, in the MCP `forges`
	15	tool (`reach`), and in the result of `POST /api/v1/forges` / MCP `spawn`
	16	(`reach`, right after the child is made).
	17	- Alarm. A new child is re-proved every 3 seconds for 3 minutes; if it never
	18	answers, `forge.child_unreachable` goes on the outbox and the notifier pages
	19	the owner (the `unreachable` flow alarm). Every 5 minutes the parent
	20	re-proves every finished child (a failure is confirmed once before it is
	21	believed); a change pages once, and `forge.child_reachable` ends it.
	22	- State is `<data>/reach/<child>.json`, derived and rebuilt by the next pass.
	23	- Websockets to a child's home or apps reach its cell: `forwardSocket`
	24	(`src/spawn/cell.ts`) opens the cell's side first, then answers the visitor.
	25	- Tests: `test/spawn-reach.test.ts`, `test/spawn-reach-door.test.ts`,
	26	`test/spawn-cell-socket.test.ts`, and the real-cell `test/spawn-cell-e2e.test.ts`
	27	(skipped, and says so, where bwrap and socat are missing).
	28	- In the terminal: open the palette (ctrl-k), "Forges you sent". A forge that
	29	is not reachable reads Running, not reachable: …, and under it one line per
	30	public address with its result (`NOT REACHABLE deal--kid--host/: answered 404, not by the app`).
	31	- Slugs are the forge's rule. A child writes its own database, so a slug that
	32	is not `[a-z0-9-]` (`evil.example#`, `u@host`) is dropped before any address is built.
		@@ -1097,6 +1097,9 @@ export async function proxyApp(
1097	1097	}
1098	1098	const out = new Headers(response.headers);
1099	1099	for (const name of HOP_BY_HOP) out.delete(name);
	1100	// Which app answered: a probe from outside (`spawn/reach.ts`) tells this
	1101	// from a platform's standby page, which answers 200 for any name.
	1102	out.set("x-forge-app", target.app.slug);
1100	1103	// An agent reading a public app's page learns where to report a problem
1101	1104	// without the app having to say so.
1102	1105	if (isHtml(out))
		@@ -1282,13 +1285,13 @@ const WS_IDLE_SECONDS = 120;
1282	1285	* that merely says `Upgrade: websocket` is an ordinary request, and is
1283	1286	* fetched as one with the hop-by-hop headers stripped, as it always was.
1284	1287	*/
1285		const isWebSocketHandshake = (request: Request): boolean =>
	1288	export const isWebSocketHandshake = (request: Request): boolean =>
1286	1289	request.method === "GET" &&
1287	1290	request.headers.get("upgrade")?.toLowerCase() === "websocket" &&
1288	1291	request.headers.has("sec-websocket-key");
1289	1292
1290	1293	/** The subprotocols a handshake offers, in the order it offers them. */
1291		const offeredProtocols = (request: Request): string[] =>
	1294	export const offeredProtocols = (request: Request): string[] =>
1292	1295	(request.headers.get("sec-websocket-protocol") ?? "")
1293	1296	.split(",")
1294	1297	.map((s) => s.trim())
		@@ -1347,7 +1350,7 @@ async function proxyWebSocket(
1347	1350	* sentence for the "not running" page: the app was not listening, or it
1348	1351	* answered the handshake with something other than a socket.
1349	1352	*/
1350		function connectUpstream(
	1353	export function connectUpstream(
1351	1354	url: URL,
1352	1355	headers: Record<string, string>,
1353	1356	protocols: string[],
		@@ -159,6 +159,8 @@ export function classifiedAudience(kind: string): EventAudience \| undefined {
159	159	kind.startsWith("backup.") \|\|
160	160	// The weekly model review's changes and results are the owner's (`actions/model_review.ts`).
161	161	kind.startsWith("crew.model_") \|\|
	162	// A child forge answering no one at its public address is the owner's to hear (`spawn/reach.ts`).
	163	kind.startsWith("forge.child_") \|\|
162	164	// A clog is the whole forge's flow, the owner's to hear (`flow/clog_tick.ts`).
163	165	kind.startsWith("clog.") \|\|
164	166	// What the throughput keeper did to lift a brake is the owner's too (`flow/keeper.ts`).
		@@ -41,6 +41,7 @@ import { health } from "../http/health.ts";
41	41	import { forgeVitals } from "../actions/health.ts";
42	42	import { RECOVERED, drainIncident, nextPage, observe, recoveredLine, type Watch } from "./incidents.ts";
43	43	import { firedAlarms, type FiredAlarm } from "../flow/alarms.ts";
	44	import { reachAlarms } from "../spawn/reach.ts";
44	45	import { loadClog } from "../flow/clog_tick.ts";
45	46	import { forgeCeiling } from "../flow/ceiling.ts";
46	47	import { askLinesFor } from "../web/studio/asks.ts";
		@@ -257,7 +258,7 @@ export function alarmLines(
257	258	fired?: readonly FiredAlarm[],
258	259	): { id: string; line: string; items: readonly string[]; link: string }[] {
259	260	if (!user.isAdmin \|\| user.kind !== "user") return [];
260		const alarms = fired ?? firedAlarms(app.db, new Date(now), { ceilingUsd: forgeCeiling(app.config) });
	261	const alarms = fired ?? [...firedAlarms(app.db, new Date(now), { ceilingUsd: forgeCeiling(app.config) }), ...reachAlarms(app)];
261	262	return alarms.map((a) => {
262	263	const id = `alarm:${a.key}@${a.since}`;
263	264	return { id, line: a.says, items: [id], link: a.href };
		@@ -17,7 +17,7 @@ import { redMainAlarm } from "./alarm_red_main.ts";
17	17	import { alarmStuck } from "./alarm_stuck.ts";
18	18
19	19	export interface FiredAlarm {
20		readonly key: "landing_stopped" \| "red_main" \| "stuck" \| "idle_crew" \| "no_release";
	20	readonly key: "landing_stopped" \| "red_main" \| "stuck" \| "idle_crew" \| "no_release" \| "unreachable";
21	21	readonly says: string;
22	22	readonly since: string;
23	23	/** A same-origin path to the item the alarm names. */
		@@ -3,7 +3,7 @@ import { good, bad, type Tool } from "../shared.ts";
3	3
4	4	export const tool: Tool = {
5	5	name: "forges",
6		doc: "an admin's list of the forges sent from here: name, address, whom for, apps, claimed or not, last activity",
	6	doc: "an admin's list of the forges sent from here: name, address, whom for, apps, claimed or not, last activity, whether each public address answers",
7	7	description:
8	8	"Forges sent from here (admin): name, address, apps, claimed, spendTodayUsd, ceilingUsd.",
9	9	inputSchema: { type: "object", properties: {} },
		@@ -66,10 +66,12 @@ export const tool: Tool = {
66	66	const made = door.body["dryRun"] === false;
67	67	const { claimUrl, ...rest } = door.body;
68	68	const reveal = args["reveal"] === true && typeof claimUrl === "string";
	69	const reach = door.body["reach"] as { ok?: boolean; says?: string } \| undefined;
	70	const reached = reach?.ok === false ? ` ${reach.says}` : "";
69	71	return good({
70	72	says: !made
71	73	? "This is the plan; nothing was made. Send dryRun: false to spawn."
72		: `Spawned ${String(door.body["name"])} at ${String(door.body["url"])}. ${reveal ? LINK_REVEALED : LINK_KEPT}`,
	74	: `Spawned ${String(door.body["name"])} at ${String(door.body["url"])}. ${reveal ? LINK_REVEALED : LINK_KEPT}${reached}`,
73	75	...rest,
74	76	...(reveal ? { claimUrl } : {}),
75	77	});
		@@ -564,13 +564,14 @@ import { holdAppHost } from "../apps/holding.ts";
564	564	import {
565	565	appWebSocket,
566	566	type AppSocket,
	567	isWebSocketHandshake,
567	568	proxyApp,
568	569	resolveAppHost,
569	570	} from "../apps/proxy.ts";
570	571
571	572	import { stopCellChildren } from "../spawn/cell.ts";
572	573	import { portInsteadOfSocket, tcpAddress } from "../git/hook-address.ts";
573		import { answerFromCell, closeHostedChildren, resolveHostedChild, resolveHostedChildApp } from "../spawn/host.ts";
	574	import { answerFromCell, closeHostedChildren, resolveHostedChild, resolveHostedChildApp, socketToCell } from "../spawn/host.ts";
574	575	import { getVerifiedDomain } from "../core/domains.ts";
575	576
576	577	// ---- auth ----
		@@ -2349,9 +2350,13 @@ export async function serve(app: App): Promise<Servers> {
2349	2350	// A hosted child's app (`<app>--<child>--<parentHost>`) is the child's
2350	2351	// own runtime's, as the parent's apps are the parent's.
2351	2352	// A child in its own cell answers through this one door, for its pages and its apps.
2352		const fromCell = async (name?: string): Promise<Response> => {
	2353	const fromCell = async (name?: string): Promise<Response \| undefined> => {
2353	2354	// The child sees only this forge's relay, so it is told who the client is.
2354	2355	notePeer(request, server.requestIP(request)?.address, trust);
	2356	if (isWebSocketHandshake(request)) {
	2357	const socket = await socketToCell(app, request, server, name);
	2358	return socket === undefined ? undefined : securityFloor(socket);
	2359	}
2355	2360	armClose(request, () => server.timeout(request, 1));
2356	2361	const response = await answered(app, request, () => answerFromCell(app, request, name));
2357	2362	counted(app, request, response, started);