fix(host): explain the channel service's 401 like the directory's

.lane/memory/apps/host/src/http.ts/01M4Z4C2JDB2YZ2JBTW2WPT34T-service-error-bodies-reach-t.md

@@ -4,8 +4,9 @@ anchor: function refusal
 created: 2026-10-15T06:35:39Z
 norm: '1'
 sig: 78f3b0d364527f79
-body_hash: c9ba4b0665155aa0
-raw_hash: 579f783033937f07
+body_hash: 58340303b3254b16
+raw_hash: 95b03b2c5b254c98
+vouched: 2026-10-21T21:58:19Z
 lines: 11-20
 ---
 

.lane/memory/apps/host/src/http.ts/01M5G7HY7DJTK2JSQ9EE9QW7M7-only-team-services-answers-m.md

@@ -0,0 +1,12 @@
+---
+id: 01M5G7HY7DJTK2JSQ9EE9QW7M7
+anchor: function refusal
+created: 2026-10-21T21:58:23Z
+norm: '1'
+sig: 78f3b0d364527f79
+body_hash: 58340303b3254b16
+raw_hash: 95b03b2c5b254c98
+lines: 13-23
+---
+
+only team services' answers may go through refusal: a 401 is explained as the team's ACE_SECRET or tailnet being refused

apps/host/src/client.ts

@@ -76,20 +76,6 @@ export async function serviceAuth(secret: string): Promise<Record<string, string
 	return { authorization: `Bearer ${await credential(secret, domain)}` };
 }
 
-/** Why a team service refused this host, naming both tailnets when they differ. */
-export async function rejection(response: Response, service: string): Promise<string> {
-	await response.body?.cancel();
-	const served = response.headers.get("ace-tailnet");
-	const domain = await tailnet.domain();
-	if (!served) {
-		return `${service} names no tailnet: it predates tailnet-scoped services or lacks its TAILNET setting. Check its URL against your team's current services.`;
-	}
-	if (domain && served !== domain) {
-		return `${service} serves the ${served} tailnet, but this Mac is on ${domain}. Switch tailnets, or use services deployed for this one.`;
-	}
-	return `${service} rejected this host's ACE_SECRET. Ask whoever set it up for the team's secret.`;
-}
-
 export async function hostedSocket(base: string, path: string): Promise<WebSocket> {
 	const socket = new WebSocket(`${base.replace(/^http/, "ws")}${path}`, {
 		headers: await hostedAuth(),

apps/host/src/compute.ts

@@ -8,7 +8,7 @@ import { realpathSync } from "node:fs";
 import type { ModelRef } from "@ace/channel/protocol";
 
 import * as catalog from "./catalog";
-import { hostedAuth, rejection } from "./client";
+import { hostedAuth } from "./client";
 import { project as repoOf } from "./github";
 import { refusal } from "./http";
 import { project } from "./manage";
@@ -30,7 +30,6 @@ async function call<T>(url: string, init: RequestInit = {}): Promise<T> {
 			cause: error,
 		});
 	}
-	if (response.status === 401) throw new Error(await rejection(response, "Cloud compute"));
 	if (!response.ok) throw new Error(await refusal(response, "Cloud compute"));
 	return await response.json() as T;
 }

apps/host/src/directory.ts

@@ -8,8 +8,8 @@ import { join } from "node:path";
 import type { Lifecycle, Share } from "@ace/directory/protocol";
 
 import * as catalog from "./catalog";
-import { hostedAuth, rejection, serviceAuth } from "./client";
-import { refusal } from "./http";
+import { hostedAuth, serviceAuth } from "./client";
+import { refusal, rejection } from "./http";
 import { failure, log } from "./log";
 import type { Listing } from "./protocol";
 

apps/host/src/http.ts

@@ -1,14 +1,17 @@
 import { log } from "./log";
+import * as tailnet from "./tailnet";
 
 /** Longer bodies are pages, not messages a service wrote for people. */
 const SHORT = 200;
 
 /**
  * One line for a service's failed answer: the status, plus the service's own message when it wrote
  * a short plain-text or JSON one. Error pages from whatever fronts the service (a Cloudflare
- * exception page, a proxy) go to the host log instead, so the app never shows raw HTML.
+ * exception page, a proxy) go to the host log instead, so the app never shows raw HTML. Every
+ * caller is a team service, so a 401 says why the team's credential was refused.
  */
 export async function refusal(response: Response, service: string): Promise<string> {
+	if (response.status === 401) return rejection(response, service);
 	const body = await response.text().catch(() => "");
 	log("warn", "http.refused", { url: response.url, status: response.status, body });
 	const text = said(response.headers.get("content-type") || "", body);
@@ -30,3 +33,17 @@ function said(type: string, body: string): string {
 	}
 	return text.length <= SHORT && !/[\r\n]/.test(text) ? text : "";
 }
+
+/** Why a team service refused this host, naming both tailnets when they differ. */
+export async function rejection(response: Response, service: string): Promise<string> {
+	await response.body?.cancel();
+	const served = response.headers.get("ace-tailnet");
+	const domain = await tailnet.domain();
+	if (!served) {
+		return `${service} names no tailnet: it predates tailnet-scoped services or lacks its TAILNET setting. Check its URL against your team's current services.`;
+	}
+	if (domain && served !== domain) {
+		return `${service} serves the ${served} tailnet, but this Mac is on ${domain}. Switch tailnets, or use services deployed for this one.`;
+	}
+	return `${service} rejected this host's ACE_SECRET. Ask whoever set it up for the team's secret.`;
+}