add active host diagnostics endpoint

[hiroTamada]

Summary

Adds GET /diagnostics that synchronously probes:

• DNS — external resolution of kernel.sh via the host's stub resolver
• Egress TCP — outbound TCP/443 to 1.1.1.1 (no DNS dependency)
• Disk — free bytes on the data dir, fails below a 5 GiB threshold

Each check returns {name, ok, duration_ms, error?, detail?}. The top-level ok is true iff all checks pass.

Why

Push-based OTEL metrics silently fail when a host is partially unreachable, so the control plane has no signal for network or DNS breakage. This endpoint is designed to be polled from a control-plane scheduled workflow so the inability to even reach the host becomes its own observable signal — and per-check breakdowns localize the failure (DNS vs network vs disk).

The companion control-plane workflow lives in a separate kernel-kernel PR.

Test plan

• Unit tests for probeDisk (success and missing path)
• Unit test that runDiagnosticChecks returns all three named checks
• Manual smoke against a staging hypeman host
• Verify the kernel-kernel HypemanMonitorScheduledWorkflow consumes the response shape correctly

Notes

• /diagnostics requires bearer auth like the other authenticated endpoints
• Probes run in parallel with a 3s per-probe timeout
• 200 is returned regardless of probe outcomes; consumers inspect the body

🤖 Generated with Claude Code

[github-actions]

✱ Stainless preview builds

This PR will update the hypeman SDKs with the following commit message.

feat: add active host diagnostics endpoint

Edit this comment to update it. It will appear in the SDK's changelogs.

✅ hypeman-go studio · code · diff

Your SDK build had at least one new note diagnostic, which is a regression from the base state.
generate ✅ → build ⏭️ (prev: build ✅) → lint ✅ → test ✅

go get github.com/stainless-sdks/hypeman-go@e802b9de8009c14b84e2cf25e12adb5e606e165e

New diagnostics (1 note)

💡 Endpoint/NotConfigured: Skipped endpoint because it's not in your Stainless config: `get /diagnostics`

✅ hypeman-typescript studio · code · diff

Your SDK build had at least one new note diagnostic, which is a regression from the base state.
generate ✅ → build ⏭️ (prev: build ✅) → lint ⏭️ (prev: lint ✅) → test ✅

New diagnostics (1 note)

💡 Endpoint/NotConfigured: Skipped endpoint because it's not in your Stainless config: `get /diagnostics`

✅ hypeman-openapi studio · code · diff

Your SDK build had at least one new note diagnostic, which is a regression from the base state.
generate ✅

New diagnostics (1 note)

💡 Endpoint/NotConfigured: Skipped endpoint because it's not in your Stainless config: `get /diagnostics`

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-04-27 18:21:53 UTC