From 226f0bdf72656d76876d3e0383a33edd446ae68d Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Thu, 21 May 2026 15:51:40 +0100
Subject: [PATCH] Report restricted hot-dev probes as unavailable

Render managed runtime status probes as unavailable instead of 000 when a restricted shell can see loopback listeners but cannot run local HTTP probes. Refs architecture post-RC canonicalization follow-up.
---
 scripts/hot-dev-bg.sh            | 11 +++++++++--
 scripts/tests/test-hot-dev-bg.sh |  3 +++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/scripts/hot-dev-bg.sh b/scripts/hot-dev-bg.sh
index 62f3062530..4cb189cb0f 100755
--- a/scripts/hot-dev-bg.sh
+++ b/scripts/hot-dev-bg.sh
@@ -755,10 +755,17 @@ status_bg() {
   proxy_health_url="${browser_url}/api/health"
   backend_health_url="http://127.0.0.1:${PULSE_DEV_API_PORT}/api/health"
 
-  local frontend_code proxy_code backend_code
+  local frontend_code proxy_code backend_code local_probe_unavailable
   frontend_code="$(http_status_code "${frontend_url}")"
   proxy_code="$(http_status_code "${proxy_health_url}")"
   backend_code="$(http_status_code "${backend_health_url}")"
+  local_probe_unavailable="false"
+  if process_inspection_restricted && [[ "${frontend_code}" == "000" && "${backend_code}" == "000" ]] && is_port_listening "${FRONTEND_DEV_PORT}" && is_port_listening "${PULSE_DEV_API_PORT}"; then
+    local_probe_unavailable="true"
+    frontend_code="unavailable"
+    proxy_code="unavailable"
+    backend_code="unavailable"
+  fi
   log "Browser entrypoint: ${browser_url}"
   if [[ -n "${lan_browser_url}" ]]; then
     log "LAN browser entrypoint: ${lan_browser_url}"
@@ -782,7 +789,7 @@ status_bg() {
 
   if http_status_ok "${frontend_code}" && http_status_ok "${proxy_code}" && http_status_ok "${backend_code}"; then
     log "Runtime summary: frontend shell, proxy, and backend are healthy. Use ${browser_url} in the browser."
-  elif process_inspection_restricted && [[ "${frontend_code}" == "000" && "${backend_code}" == "000" ]] && is_port_listening "${FRONTEND_DEV_PORT}" && is_port_listening "${PULSE_DEV_API_PORT}"; then
+  elif [[ "${local_probe_unavailable}" == "true" ]]; then
     log "Runtime summary: local HTTP probes are unavailable from this restricted shell, but frontend and backend listeners are present. Use ${browser_url} in the browser or rerun status outside the restricted shell."
   elif http_status_blocked "${frontend_code}" || http_status_blocked "${proxy_code}" || http_status_blocked "${backend_code}"; then
     log "Runtime summary: local HTTP probes are blocked by this shell. Use ${browser_url} in the browser or rerun status outside the restricted shell."
diff --git a/scripts/tests/test-hot-dev-bg.sh b/scripts/tests/test-hot-dev-bg.sh
index 3847c1ace4..a44aa6dab9 100755
--- a/scripts/tests/test-hot-dev-bg.sh
+++ b/scripts/tests/test-hot-dev-bg.sh
@@ -954,6 +954,9 @@ test_hot_dev_bg_status_degrades_ownership_when_process_inspection_is_restricted(
   )"
 
   assert_contains "restricted status keeps the managed runtime pid" "${output}" "[hot-dev-bg] Running (pid: 4242)"
+  assert_contains "restricted status renders frontend probe as unavailable" "${output}" "[hot-dev-bg] Frontend shell HTTP: unavailable"
+  assert_contains "restricted status renders proxy probe as unavailable" "${output}" "[hot-dev-bg] Frontend proxy /api/health: unavailable"
+  assert_contains "restricted status renders backend probe as unavailable" "${output}" "[hot-dev-bg] Backend /api/health: unavailable"
   assert_contains "restricted status marks listener ownership as unknown" "${output}" "[hot-dev-bg] Port 5173: unknown listener pid=14111"
   assert_not_contains "restricted status does not accuse split ownership" "${output}" "Detected split ownership"
   assert_contains "restricted status reports unavailable health probes without claiming a crash" "${output}" "local HTTP probes are unavailable from this restricted shell"