fix(template): a health check path is optional, and draft and info show it

[CarmenDou]

What

A template's health check path is optional, as the platform has allowed since InsForge/instacloud-platform#600. The CLI still refused a web service without one, so a template the platform accepts was refused locally.

• insta template deploy <dir> and the GitHub URL mode accept a web service without a healthcheck. A given path is checked with the platform's own grammar, so //host is refused locally as the platform refuses it.
• insta template draft and insta template info print each web service's health check: health check /healthz, or no health check. A worker or a managed service prints nothing about it. --json is unchanged.

How

• src/template-manifest.ts: the "web services must declare a healthcheck path" rule is gone. HEALTHCHECK_RE mirrors the platform's (src/provisioning/templateManifest.ts, same constant). A declared empty or null path is still refused locally, as the platform refuses it. A worker with any path gets only the worker refusal.
• src/commands/template-author.ts and src/commands/template.ts: the health check on a web service's line.

Verify

• npm run typecheck and npm test: 102 files, 2112 tests.
• Tests: a web service without a path is accepted. //evil.example, http://x/y, an empty and a null path are refused. A worker with /healthz, //x, health, an empty or a null path yields exactly one problem, the worker refusal. The draft and info lines for a web service with and without a path, a worker and a managed service.

Design note (insta-cloud superproject, branch spec/community-templates): template health check alignment. Companion PRs: the oss lint and daemon, the insta skill, and a platform fix for empty settings.

🤖 Generated with Claude Code

---

Summary by cubic

Makes a web service's health check path optional in local template validation, matching the platform's behavior since InsForge/instacloud-platform#600.

The CLI no longer refuses a web service without a healthcheck path, and a given path is checked against the platform's own grammar, so //host is refused locally just as the platform refuses it. Empty, null, or non-string paths stay refused, and a worker with any health check gets only the worker refusal, not a second path error.

insta template draft and insta template info now print each web service's health check—health check /healthz or no health check—while workers and managed services print nothing about it. --json output is unchanged.

^{Written for commit 524ab67. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 5 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[jwfing]

Summary

The implementation correctly makes web health checks optional, validates declared paths, and exposes health-check status in human-readable draft/info output.

Requirements context

I assessed the change against the PR description and the validator’s documented contract to mirror platform validation (src/template-manifest.ts:1-6). The linked platform PR and superproject design note were not present or accessible from this checkout. No command or flag changes require a CLI-reference update.

Findings

Critical

(none)

Suggestion

(none)

Information

• Software engineering / functionality: The validator distinguishes omission from invalid declared values, applies the stated path grammar, and prevents duplicate errors for workers (src/template-manifest.ts:154-164). Regression tests cover omitted, valid, relative, protocol-relative, empty, non-string, and worker values (test/template.test.ts:230-267).
• Human-readable draft and info rendering is restricted to web services and covers paths, absent values, legacy missing fields, workers, and managed services (src/commands/template-author.ts:96-110, src/commands/template.ts:110-121, test/template-author.test.ts:193-211, test/template.test.ts:469-489). Existing JSON pass-through behavior remains covered (test/template-author.test.ts:187-191).
• Security: No new authorization, secret, SQL, shell, or dependency surface is introduced. The stricter grammar rejects protocol-relative URLs, schemes, backslashes, spaces, fragments, and control characters (src/template-manifest.ts:68-69, src/template-manifest.ts:160-164).
• Performance: No performance-relevant concern; the change adds one bounded regular-expression check per declared health check and constant work per rendered service (src/template-manifest.ts:160-164, src/commands/template.ts:110-121).

Verdict

Approved under the supplied rubric: zero Critical findings. git diff --check passes; tests and typecheck could not be executed locally because this checkout has no installed vitest or tsc dependencies.

[jwfing]

LGTM - approved.