fix(gl): make doctor diagnose the node the git transport will use

crates/git-remote-gitlawb/src/main.rs

@@ -25,6 +25,7 @@
 use anyhow::{bail, Context, Result};
 use gitlawb_core::http_sig::sign_request;
 use gitlawb_core::identity::Keypair;
+use gitlawb_core::{resolve_transport_node, DEFAULT_LOCAL_NODE};
 use std::io::{self, BufRead, Read, Write};
 
 fn main() -> Result<()> {
@@ -63,9 +64,9 @@ fn main() -> Result<()> {
 
     let (_, short_owner, repo_name) = parse_gitlawb_url(url)?;
 
-    // v0.1: default to localhost. Override with GITLAWB_NODE env var.
-    let node_base =
-        std::env::var("GITLAWB_NODE").unwrap_or_else(|_| "http://127.0.0.1:7545".to_string());
+    // v0.1: default to localhost. Override with GITLAWB_NODE env var. Shared with
+    // `gl doctor` so the diagnostic reports the URL this actually resolves.
+    let node_base = node_base_from_env();
     let repo_base = format!("{}/{}/{}", node_base, short_owner, repo_name);
     tracing::debug!("repo_base: {repo_base}");
 
@@ -78,6 +79,12 @@ fn main() -> Result<()> {
     run_helper(&repo_base, keypair.as_ref())
 }
 
+/// The node base URL this helper will contact, resolved through the same function
+/// `gl doctor` reports on so the diagnostic cannot describe a different node.
+fn node_base_from_env() -> String {
+    resolve_transport_node(std::env::var("GITLAWB_NODE").ok().as_deref())
+}
+
 // ── CLI argument handling ──────────────────────────────────────────────────────
 
 /// How the binary was invoked, derived from its CLI arguments.
@@ -123,7 +130,7 @@ fn help_text() -> String {
          \x20   git clone gitlawb://did:key:z6Mk.../<repo>\n\
          \n\
          ENVIRONMENT:\n\
-         \x20   GITLAWB_NODE   Node base URL (default: http://127.0.0.1:7545)\n\
+         \x20   GITLAWB_NODE   Node base URL (default: {DEFAULT_LOCAL_NODE})\n\
          \x20   GITLAWB_KEY    Identity PEM path for signed fetch/push (default: ~/.gitlawb/identity.pem)\n\
          \x20   GITLAWB_LOG    Log filter (default: warn)\n\
          \n\
@@ -2014,9 +2021,21 @@ mod tests {
         assert!(help.contains("--version"));
         assert!(help.contains("--help"));
         assert!(help.contains("GITLAWB_NODE"));
+        // The advertised default must be the value the helper actually resolves.
+        assert!(help.contains(DEFAULT_LOCAL_NODE));
         assert!(help.ends_with('\n'));
     }
 
+    /// The helper's own resolution must stay the shared one; a site walking back to
+    /// a private literal is exactly the drift the shared function exists to stop.
+    #[test]
+    fn node_base_matches_the_shared_resolver() {
+        // No env manipulation: assert the call site delegates, for the default case.
+        let expected = resolve_transport_node(std::env::var("GITLAWB_NODE").ok().as_deref());
+        assert_eq!(node_base_from_env(), expected);
+        assert_eq!(resolve_transport_node(None), DEFAULT_LOCAL_NODE);
+    }
+
     // ── #117 multi-round fetch negotiation ───────────────────────────────────
 
     /// Encode a git pkt-line: 4-byte hex length (incl. the 4 bytes) + data.

crates/gitlawb-core/src/lib.rs

@@ -17,5 +17,50 @@ pub mod sanitize;
 pub mod scan_token;
 pub mod ucan;
 
+/// Node URL the git transport falls back to when `GITLAWB_NODE` is unset.
+///
+/// `gl` defaults to the public node instead, so the two disagree on an install
+/// that never sets the variable.
+pub const DEFAULT_LOCAL_NODE: &str = "http://127.0.0.1:7545";
+
+/// The node `git clone` and `git push` will contact, given the raw `GITLAWB_NODE`
+/// value (`None` when the variable is absent).
+///
+/// `git-remote-gitlawb` calls this to pick its base URL and `gl doctor` calls it
+/// to report that URL, so a diagnostic cannot describe a node the transport will
+/// not use. A blank or whitespace-only value is not a configured node: treating
+/// it as one gave the helper an empty base and every clone URL a missing scheme
+/// and host.
+pub fn resolve_transport_node(env_value: Option<&str>) -> String {
+    match env_value.map(str::trim) {
+        Some(v) if !v.is_empty() => v.to_string(),
+        _ => DEFAULT_LOCAL_NODE.to_string(),
+    }
+}
+
 pub use error::Error;
 pub type Result<T> = std::result::Result<T, Error>;
+
+#[cfg(test)]
+mod transport_node_tests {
+    use super::*;
+
+    #[test]
+    fn absent_or_blank_resolves_to_the_local_default() {
+        for raw in [None, Some(""), Some("   "), Some("\t\n")] {
+            assert_eq!(resolve_transport_node(raw), DEFAULT_LOCAL_NODE, "{raw:?}");
+        }
+    }
+
+    #[test]
+    fn a_configured_value_wins_and_is_trimmed() {
+        assert_eq!(
+            resolve_transport_node(Some("https://n.example")),
+            "https://n.example"
+        );
+        assert_eq!(
+            resolve_transport_node(Some("  https://n.example  ")),
+            "https://n.example"
+        );
+    }
+}

crates/gl/src/doctor.rs

@@ -13,7 +13,9 @@ use anyhow::Result;
 use clap::Args;
 use std::path::PathBuf;
 
-use crate::http::NodeClient;
+use gitlawb_core::resolve_transport_node;
+
+use crate::http::{sanitize_node_msg, NodeClient};
 
 const PUBLIC_NODE: &str = "https://node.gitlawb.com";
 const GITHUB_API_BASE: &str = "https://api.github.com";
@@ -141,27 +143,51 @@ pub async fn run(args: DoctorArgs) -> Result<()> {
     }
 
     // ── 3. GITLAWB_NODE env var ───────────────────────────────────────────
-    match std::env::var("GITLAWB_NODE") {
-        // A loopback host is a legitimate setup (self-hosted node, dev
-        // harness) — the connectivity check below fails loudly if it is not
-        // actually reachable, so don't red-flag the configuration itself.
-        Ok(v) if is_loopback_url(&v) => {
-            checks.push(Check::pass(
-                "GITLAWB_NODE",
-                format!(
-                    "{v} (local node — intentional for self-hosting/dev; unset to target the public network)"
-                ),
-            ));
-        }
-        Ok(v) if !v.is_empty() => {
-            checks.push(Check::pass("GITLAWB_NODE", v.to_string()));
-        }
-        _ => {
-            checks.push(Check::fail(
-                "GITLAWB_NODE",
-                "not set — git-remote-gitlawb will fall back to http://127.0.0.1:7545",
-                "export GITLAWB_NODE=https://node.gitlawb.com",
-            ));
+    // The node `git clone` / `git push` will contact is not always the node `gl`
+    // contacts: `--node` defaults to the public node and an explicit flag outranks
+    // the environment, so the two diverge whenever the variable is unset, blank, or
+    // overridden. Probing only `gl`'s node is what let doctor greenlight an install
+    // whose transport was dead, so resolve the transport's node through the same
+    // function the helper uses and report on that one.
+    let env_node = std::env::var("GITLAWB_NODE").ok();
+    let transport_node = resolve_transport_node(env_node.as_deref());
+    let gl_node = sanitize_node_msg(&args.node);
+
+    if transport_node == args.node {
+        // gl and the transport agree, so one row covers both. A loopback host is a
+        // legitimate setup (self-hosted node, dev harness) and the connectivity
+        // check below fails loudly if it is not actually reachable, so don't
+        // red-flag the configuration itself.
+        let detail = if is_loopback_url(&transport_node) {
+            format!(
+                "{gl_node} (local node, intentional for self-hosting/dev; unset to target the public network)"
+            )
+        } else {
+            gl_node.clone()
+        };
+        checks.push(Check::pass("GITLAWB_NODE", detail));
+    } else {
+        let verdict = probe_transport(&transport_node).await;
+        let detail = format!(
+            "git push/clone will use {} ({}); gl targets {gl_node}",
+            sanitize_node_msg(&transport_node),
+            verdict.detail
+        );
+        // Single-quote the value: this line is printed under "Suggested fixes" for
+        // the user to paste into a shell, and the URL is caller-supplied.
+        let fix = format!("export GITLAWB_NODE='{gl_node}'");
+        // Tiering follows who chose the broken value. An unset variable on a stock
+        // install is advisory: `gl` works, only `git push`/`git clone` do not, and
+        // #357 requires that install to keep exiting 0. A variable the user set to
+        // something unusable is a real misconfiguration.
+        let env_was_set = env_node
+            .as_deref()
+            .map(str::trim)
+            .is_some_and(|v| !v.is_empty());
+        if verdict.usable || !env_was_set {
+            checks.push(Check::warn("GITLAWB_NODE", detail, fix));
+        } else {
+            checks.push(Check::fail("GITLAWB_NODE", detail, fix));
         }
     }
 
@@ -319,6 +345,63 @@ pub async fn run(args: DoctorArgs) -> Result<()> {
     Ok(())
 }
 
+/// Outcome of probing the node the git transport will use.
+struct TransportVerdict {
+    /// True only when the endpoint identified itself as a gitlawb node. A bare 200
+    /// is not enough: any local service answering on that port would otherwise be
+    /// reported as a working transport, which is the false green this check exists
+    /// to catch.
+    usable: bool,
+    detail: String,
+}
+
+/// Probe `url` and describe what is actually there.
+///
+/// Deliberately not `NodeClient`: this call must not follow the user's proxy
+/// (a proxy swallows a loopback probe and reports a running local node as dead)
+/// and must not inherit the 30s request timeout, which stalls every stock
+/// `gl doctor` run behind a hung listener.
+async fn probe_transport(url: &str) -> TransportVerdict {
+    let client = match reqwest::Client::builder()
+        .no_proxy()
+        .timeout(std::time::Duration::from_secs(3))
+        .build()
+    {
+        Ok(c) => c,
+        Err(e) => {
+            return TransportVerdict {
+                usable: false,
+                detail: format!("probe failed: {}", sanitize_node_msg(&e.to_string())),
+            }
+        }
+    };
+    let target = format!("{}/", url.trim_end_matches('/'));
+    match client.get(&target).send().await {
+        Ok(resp) if resp.status().is_success() => {
+            let info = resp.json::<serde_json::Value>().await.unwrap_or_default();
+            if info["did"].as_str().is_some() {
+                TransportVerdict {
+                    usable: true,
+                    detail: "reachable".to_string(),
+                }
+            } else {
+                TransportVerdict {
+                    usable: false,
+                    detail: "something is listening but it is not a gitlawb node".to_string(),
+                }
+            }
+        }
+        Ok(resp) => TransportVerdict {
+            usable: false,
+            detail: format!("returned HTTP {}", resp.status()),
+        },
+        Err(e) => TransportVerdict {
+            usable: false,
+            detail: format!("unreachable: {}", sanitize_node_msg(&e.to_string())),
+        },
+    }
+}
+
 /// Check if a binary name exists anywhere on PATH.
 /// True when the rc file contains a real `unalias` command naming `gl` —
 /// not a comment, and not a longer word like `unalias global`. Ordering