Remove semver misleading config.

- Add screenshot to README.md
- Add screenshot to GitHub Pages site with styling
- Include screenshot image in docs/ directory

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.github/FUNDING.yml

@@ -1,2 +0,0 @@
-github: [lukaszraczylo]
-custom: [monzo.me/lukaszraczylo]

.github/workflows/autoupdate.yaml

@@ -1,20 +0,0 @@
-name: Autoupdate go.mod and go.sum
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 3 * * *"
-
-permissions:
-  contents: write
-  actions: write
-  pull-requests: write
-  security-events: write
-
-jobs:
-  autoupdate:
-    uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main
-    with:
-      go-version: ">=1.24"
-      release-workflow: "release.yml"
-    secrets: inherit

.github/workflows/pr.yaml

@@ -1,22 +0,0 @@
-name: Pull Request
-
-on:
-  pull_request:
-    branches:
-      - main
-  push:
-    branches:
-      - "**"
-      - "!main"
-
-permissions:
-  contents: write
-  actions: write
-  pull-requests: write
-  security-events: write
-
-jobs:
-  pr-checks:
-    uses: lukaszraczylo/shared-actions/.github/workflows/go-pr.yaml@main
-    with:
-      go-version: ">=1.24"

.github/workflows/release.yml

@@ -5,19 +5,90 @@ on:
     branches:
       - main
     paths:
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
   workflow_dispatch:
 
 permissions:
   contents: write
-  packages: write
-  id-token: write
 
 jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.23'
+
+      - name: Run tests with race detector
+        run: go test -race -v ./...
+
+  version:
+    name: Calculate Version
+    needs: test
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version_formatted.outputs.version }}
+      version_tag: ${{ steps.version_formatted.outputs.version_tag }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Calculate semantic version
+        id: semver
+        uses: lukaszraczylo/semver-generator@v1
+        with:
+          config_file: semver.yaml
+          repository_local: true
+
+      - name: Format version
+        id: version_formatted
+        run: |
+          VERSION="${{ steps.semver.outputs.semantic_version }}"
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version_tag=v${VERSION}" >> $GITHUB_OUTPUT
+
+      - name: Display version
+        run: |
+          echo "Calculated version: ${{ steps.version_formatted.outputs.version }}"
+          echo "Version tag: ${{ steps.version_formatted.outputs.version_tag }}"
+
   release:
-    uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
-    with:
-      go-version: ">=1.24"
-    secrets: inherit
+    name: Release with GoReleaser
+    needs: version
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.23'
+
+      - name: Create and push tag
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a ${{ needs.version.outputs.version_tag }} -m "Release ${{ needs.version.outputs.version_tag }}"
+          git push origin ${{ needs.version.outputs.version_tag }}
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: '~> v2'
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

.github/workflows/static.yml

@@ -6,7 +6,7 @@ on:
   push:
     branches: ["main"]
     paths:
-      - "docs/**"
+      - 'docs/**'
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
@@ -39,7 +39,7 @@ jobs:
         uses: actions/upload-pages-artifact@v3
         with:
           # Upload entire repository
-          path: "docs/"
+          path: 'docs/'
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@v4

.gitignore

@@ -3,7 +3,3 @@ CLAUDE.md
 DEPLOYMENT_SUMMARY.md
 HOMEBREW_COMPLIANCE.md
 RELEASE_SETUP.md
-
-# Local/live test configs (cluster-specific, never committed)
-.kportal.test.yaml
-.kportal.*.local.yaml

.golangci.yml

@@ -1,31 +0,0 @@
-# golangci-lint configuration
-# https://golangci-lint.run/usage/configuration/
-version: "2"
-
-run:
-  timeout: 5m
-  tests: true
-
-formatters:
-  enable:
-    - gofmt
-
-linters:
-  enable:
-    - errcheck
-    - govet
-    - ineffassign
-    - staticcheck
-    - unused
-    - gosec
-    - gocritic
-  settings:
-    govet:
-      enable:
-        - fieldalignment
-    gosec:
-      excludes:
-        - G304 # File path provided as taint input - handled with #nosec comments where needed
-    gocritic:
-      disabled-checks:
-        - ifElseChain # Complex conditionals are clearer as if-else than switch true

.goreleaser.yaml

@@ -19,15 +19,15 @@ builds:
       - arm64
     ldflags:
       - -s -w
-      - -X main.appVersion={{.Version}}
+      - -X main.version={{.Version}}
 
 archives:
   - id: kportal
-    formats: [tar.gz]
+    format: tar.gz
     name_template: "kportal-{{ .Version }}-{{ .Os }}-{{ .Arch }}"
     format_overrides:
       - goos: windows
-        formats: [zip]
+        format: zip
     files:
       - LICENSE
       - README.md
@@ -53,32 +53,17 @@ release:
   draft: false
   prerelease: auto
 
-homebrew_casks:
+brews:
   - repository:
       owner: lukaszraczylo
-      name: homebrew-taps
+      name: brew-taps
       token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
-    directory: Casks
+    directory: Formula
     homepage: https://lukaszraczylo.github.io/kportal
     description: "Modern Kubernetes port-forward manager with interactive TUI"
     license: MIT
-    url:
-      verified: github.com/lukaszraczylo/kportal
-    hooks:
-      post:
-        install: |
-          if OS.mac?
-            system_command "/usr/bin/xattr",
-                           args: ["-dr", "com.apple.quarantine", "#{staged_path}/kportal"]
-          end
-
-signs:
-  - cmd: cosign
-    signature: "${artifact}.sigstore.json"
-    args:
-      - sign-blob
-      - "--bundle=${signature}"
-      - "${artifact}"
-      - "--yes"
-    artifacts: checksum
-    output: true
+    test: |
+      system "#{bin}/kportal", "--version"
+    dependencies:
+      - name: kubernetes-cli
+        type: optional

.kportal.yaml

@@ -1,27 +1,6 @@
 # Example kportal configuration
 # Copy this file to your project and customize as needed
 
-# Optional: Health check configuration
-# These settings control how kportal monitors connection health and detects stale connections
-healthCheck:
-  interval: "3s"              # How often to check connection health (default: 3s)
-  timeout: "2s"               # Timeout for health check operations (default: 2s)
-  method: "data-transfer"     # Health check method: "tcp-dial" or "data-transfer" (default: data-transfer)
-                              # - tcp-dial: Simple TCP connection test (fast, less reliable)
-                              # - data-transfer: Attempts to read data (slower, more reliable)
-  maxConnectionAge: "25m"     # Maximum connection age before proactive reconnect (default: 25m)
-                              # Helps avoid Kubernetes API server timeouts (typically 30m)
-  maxIdleTime: "10m"          # Maximum idle time before marking as stale (default: 10m)
-                              # Connections with no data transfer are marked stale
-
-# Optional: Reliability configuration
-# These settings improve connection stability for long-running transfers
-reliability:
-  tcpKeepalive: "30s"         # TCP keepalive interval for OS-level connection monitoring (default: 30s)
-  dialTimeout: "30s"          # Connection dial timeout (default: 30s)
-  retryOnStale: true          # Automatically reconnect when stale connections detected (default: true)
-  watchdogPeriod: "30s"       # Goroutine watchdog check interval to detect hung workers (default: 30s)
-
 contexts:
   # Production context
   - name: production
@@ -34,7 +13,6 @@ contexts:
             port: 8080
             localPort: 8080
             alias: prod-api
-            httpLog: true             # Enable HTTP traffic logging for this forward (press 'l' in the TUI)
 
           # Forward to PostgreSQL database
           - resource: service/postgres

CHANGELOG.md

@@ -5,24 +5,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased] - 2026-05-06
-
-### Added
-- `kportal generate --context=NAME [--config=PATH] [--dry-run]` subcommand for interactive bulk-add of forwards from a cluster. Walks namespace multi-select, service multi-select, and starting-port input; assigns consecutive local ports; emits one forward per port for multi-port services. Non-TCP ports are skipped and already-configured services are greyed out.
-- HTTP log toggle in the add/edit wizard. Pressing `h` on the confirmation step toggles `httpLog: true/false` for the forward being added or edited. Advanced `httpLog` configuration set in YAML (`logFile`, `includeHeaders`, `maxBodySize`, `filterPath`) is preserved across edits.
-- HTTP log header redaction. When `httpLog.includeHeaders: true`, sensitive headers (`Authorization`, `Cookie`, `Set-Cookie`, `X-Api-Key`, `X-Auth-Token`, `X-Csrf-Token`, `Proxy-Authorization`, `X-Access-Token`, plus any header whose name contains `token`/`secret`/`password`/`apikey`) have their values replaced with `[REDACTED]`. The header name is preserved. Always on, no opt-out.
-- `install.sh` SHA-256 checksum verification. Every install verifies the downloaded archive against the release's `checksums.txt`. If `cosign` is on `PATH`, the checksums file's keyless cosign signature is also verified against the shared-actions reusable workflow identity. Set `DRY_RUN=1` to preview, `SKIP_COSIGN=1` to bypass cosign.
-
-### Changed
-- Headless mode (`kportal -headless`) now sends both structured and stdlib logs to stderr by default instead of `io.Discard`. `-v` still controls level (debug vs info), not destination.
-- Context-name validator now permits common kubeconfig identifiers containing `@`, `.`, `:`, or `/` (e.g. `admin@home`, `user@cluster.example.com`, GKE dotted names, EKS ARNs).
-- Edit-mode wizard now allows keeping the same local port. The port-availability check no longer rejects a forward's own port when editing it.
-
-### Fixed
-- `Esc` in the delete-confirmation dialog now cancels instead of confirming deletion (previously a data-loss bug).
-- `Manager.Stop()` is now idempotent. Sequential or concurrent double-Stop no longer panics.
-- Cosign cert-identity is now pinned to the actual signing workflow (`lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@refs/heads/main`); previously cosign verification always failed.
-- Internal concurrency races in the forward manager (`currentConfig` access under lock, `rest.Config` copied before mutation, `ForwardWorker.Stop` wrapped in `sync.Once`, `Reload` no longer kills the health checker). No user-visible flag, but resolves panics some users hit.
+## [Unreleased]
 
 ## [0.1.5] - 2025-11-23
 

Makefile

@@ -37,7 +37,7 @@ GOFMT=$(GOCMD) fmt
 
 # Build flags
 BUILD_FLAGS=-buildvcs=false
-LDFLAGS=-ldflags="-s -w -X main.appVersion=$(VERSION)"
+LDFLAGS=-ldflags="-s -w -X main.version=$(VERSION)"
 
 all: fmt vet staticcheck test build
 

RELEASE_SETUP.md

@@ -0,0 +1,320 @@
+# Release Infrastructure Setup Summary
+
+This document summarizes all the release infrastructure that has been set up for kportal.
+
+## ✅ Completed Setup
+
+### 1. GitHub Actions CI/CD Pipeline
+
+**File**: `.github/workflows/release.yml`
+
+**Features**:
+- Multi-platform binary builds (Linux, macOS, Windows - amd64 & arm64)
+- Automatic release creation on version tags
+- Binary archiving (tar.gz for Unix, zip for Windows)
+- SHA256 checksum generation
+- Automated Homebrew formula updates
+- Release notes generation
+
+**How to trigger**:
+```bash
+# Commit with semantic versioning keywords
+git commit -m "feat: add new feature"
+
+# Tag the release
+git tag -a v0.2.0 -m "Release v0.2.0"
+
+# Push tags
+git push origin v0.2.0
+```
+
+The pipeline will automatically:
+1. Build binaries for all platforms
+2. Create GitHub release with binaries
+3. Update Homebrew tap formula
+4. Generate release notes
+
+### 2. Installation Methods
+
+#### A. Homebrew Formula
+
+**File**: `Formula/kportal.rb`
+
+**Installation command**:
+```bash
+brew install lukaszraczylo/tap/kportal
+```
+
+**Note**: Formula is automatically updated by CI/CD pipeline. You'll need to create a separate tap repository:
+1. Create repo: `https://github.com/lukaszraczylo/brew-taps`
+2. Add Formula/kportal.rb to that repo
+3. Set `HOMEBREW_TAP_TOKEN` secret in GitHub repository settings
+
+#### B. Quick Install Script
+
+**File**: `install.sh`
+
+**Features**:
+- Auto-detects OS and architecture
+- Downloads appropriate binary
+- Extracts and installs to /usr/local/bin
+- Verifies installation
+- Colorful output with emoji indicators
+
+**Installation command**:
+```bash
+curl -fsSL https://raw.githubusercontent.com/lukaszraczylo/kportal/main/install.sh | bash
+```
+
+#### C. Manual Download
+
+Users can download binaries directly from GitHub releases:
+```
+https://github.com/lukaszraczylo/kportal/releases
+```
+
+### 3. Documentation
+
+#### A. Comprehensive README.md
+
+**File**: `README.md`
+
+**Contents**:
+- Feature showcase with emojis
+- Multiple installation methods
+- Quick start guide
+- Configuration examples
+- Usage instructions
+- Advanced features documentation
+- Troubleshooting guide
+- Contributing guidelines
+
+#### B. GitHub Pages Website
+
+**File**: `docs/index.html`
+
+**Features**:
+- Modern, responsive design with TailwindCSS
+- Hero section with clear CTA
+- Feature showcase cards
+- Installation guide
+- Configuration examples with syntax highlighting
+- Documentation links
+- Mobile-friendly
+
+**URL** (once enabled): `https://lukaszraczylo.github.io/kportal`
+
+**To enable**:
+1. Go to GitHub repository settings
+2. Pages section
+3. Source: Deploy from a branch
+4. Branch: main
+5. Folder: /docs
+
+### 4. Supporting Files
+
+#### CHANGELOG.md
+**File**: `CHANGELOG.md`
+
+Tracks all changes following Keep a Changelog format. Update this file with each release.
+
+#### CONTRIBUTING.md
+**File**: `CONTRIBUTING.md`
+
+Guidelines for:
+- Bug reporting
+- Feature requests
+- Pull request process
+- Commit message format
+- Development setup
+- Testing guidelines
+
+## 🚀 Release Workflow
+
+### Standard Release Process
+
+1. **Develop features**
+   ```bash
+   git checkout -b feature/my-feature
+   # Make changes
+   make test
+   make all
+   ```
+
+2. **Commit with semantic messages**
+   ```bash
+   git commit -m "feat: add amazing feature"
+   git commit -m "fix: resolve bug in health check"
+   ```
+
+3. **Update CHANGELOG.md**
+   ```markdown
+   ## [0.2.0] - 2025-11-24
+   
+   ### Added
+   - Amazing new feature
+   
+   ### Fixed
+   - Bug in health check
+   ```
+
+4. **Tag the release**
+   ```bash
+   git tag -a v0.2.0 -m "Release v0.2.0"
+   git push origin main
+   git push origin v0.2.0
+   ```
+
+5. **CI/CD automatically**:
+   - Builds all binaries
+   - Creates GitHub release
+   - Updates Homebrew formula
+   - Attaches binaries and checksums
+
+### Version Bumping (Semantic Versioning)
+
+Version is automatically determined by semver-gen from commit messages:
+
+- **Patch** (0.0.X): `fix`, `bugfix`, `hotfix`, `patch`, `docs`, `test`, `refactor`
+- **Minor** (0.X.0): `feat`, `feature`, `add`, `enhance`, `update`, `improve`
+- **Major** (X.0.0): `breaking`, `major`, `BREAKING CHANGE`
+
+## 📦 Platform Support
+
+### Supported Platforms
+
+| OS      | Architecture | Archive Format |
+|---------|-------------|----------------|
+| Linux   | amd64       | tar.gz         |
+| Linux   | arm64       | tar.gz         |
+| macOS   | amd64       | tar.gz         |
+| macOS   | arm64       | tar.gz         |
+| Windows | amd64       | zip            |
+| Windows | arm64       | zip            |
+
+## 🔒 Required GitHub Secrets
+
+For full automation, set these secrets in your GitHub repository:
+
+1. **GITHUB_TOKEN** - Automatically provided by GitHub Actions
+2. **HOMEBREW_TAP_TOKEN** - Personal access token for updating Homebrew tap
+   - Create at: https://github.com/settings/tokens
+   - Permissions needed: `repo` scope
+   - Add to repository secrets
+
+## 📝 Next Steps
+
+### 1. Enable GitHub Pages
+- Repository Settings → Pages → Source: main branch, /docs folder
+
+### 2. Create Homebrew Tap Repository
+```bash
+# Create new repository
+gh repo create lukaszraczylo/brew-taps --public
+
+# Clone and set up
+git clone https://github.com/lukaszraczylo/brew-taps
+cd brew-taps
+cp ../kportal/Formula/kportal.rb ./Formula/
+git add Formula/kportal.rb
+git commit -m "Initial formula for kportal"
+git push origin main
+```
+
+### 3. Add GitHub Token to Secrets
+- Repository Settings → Secrets and variables → Actions
+- New repository secret
+- Name: `HOMEBREW_TAP_TOKEN`
+- Value: Your personal access token
+
+### 4. Create First Release
+```bash
+cd kportal
+git add .
+git commit -m "feat: initial release setup"
+git push origin main
+git tag -a v0.1.5 -m "Release v0.1.5"
+git push origin v0.1.5
+```
+
+### 5. Test Installation Methods
+
+After first release, test:
+```bash
+# Homebrew (once tap is set up)
+brew install lukaszraczylo/tap/kportal
+
+# Quick install script
+curl -fsSL https://raw.githubusercontent.com/lukaszraczylo/kportal/main/install.sh | bash
+
+# Manual download
+# Visit releases page and download binary
+```
+
+## 🎨 Customization
+
+### Update Website Colors
+
+Edit `docs/index.html`:
+```javascript
+tailwind.config = {
+    theme: {
+        extend: {
+            colors: {
+                primary: '#3b82f6',    // Blue
+                secondary: '#8b5cf6',   // Purple
+                dark: '#0f172a',        // Dark slate
+            }
+        }
+    }
+}
+```
+
+### Update Release Notes Template
+
+Edit `.github/workflows/release.yml` in the "Generate release notes" step.
+
+## 📊 Monitoring
+
+After releases, monitor:
+- GitHub Actions workflow runs
+- GitHub Releases page
+- Homebrew tap repository commits
+- Download statistics on releases page
+
+## 🐛 Troubleshooting
+
+### Release workflow fails
+- Check GitHub Actions logs
+- Verify all required secrets are set
+- Ensure tag follows v\d+.\d+.\d+ format
+
+### Homebrew formula not updating
+- Verify HOMEBREW_TAP_TOKEN is valid
+- Check tap repository permissions
+- Review release workflow logs
+
+### Install script fails
+- Test locally with different OS/arch combinations
+- Check release binary naming matches script expectations
+- Verify binaries are attached to release
+
+## ✅ Checklist for First Release
+
+- [ ] All code committed and pushed
+- [ ] GitHub Pages enabled
+- [ ] Homebrew tap repository created
+- [ ] HOMEBREW_TAP_TOKEN secret set
+- [ ] CHANGELOG.md updated
+- [ ] Version tag created and pushed
+- [ ] Release workflow completed successfully
+- [ ] Binaries attached to release
+- [ ] Homebrew formula updated
+- [ ] Install script tested
+- [ ] Documentation website live
+- [ ] README.md installation links work
+
+---
+
+**Documentation last updated**: 2025-11-23
+**Setup completed for**: kportal v0.1.5

WIZARD_USAGE.md

@@ -1,115 +0,0 @@
-# Interactive Wizards
-
-kportal includes wizards for adding, editing, and removing port forwards from the running UI.
-
-## ⌨️ Quick Reference
-
-| Key | Action |
-|-----|--------|
-| `n` | Add new forward |
-| `e` | Edit selected forward |
-| `d` | Delete forwards |
-
-## ➕ Add Forward Wizard
-
-Press `n` from the main view to start the wizard.
-
-### Steps
-
-1. **Context** - Select Kubernetes context
-2. **Namespace** - Select namespace
-3. **Resource Type** - Choose pod (prefix), pod (selector), or service
-4. **Resource** - Enter prefix, selector, or select service
-5. **Remote Port** - Enter port on the resource
-6. **Local Port** - Enter local port (validates availability)
-7. **Confirm** - Review, optionally add an alias, and toggle HTTP logging
-
-### Navigation
-
-| Key | Action |
-|-----|--------|
-| `↑↓` / `j/k` | Navigate options |
-| `Enter` | Confirm and proceed |
-| `Esc` | Go back / Cancel |
-| `Ctrl+C` | Cancel immediately |
-| `h` | Toggle HTTP traffic logging (confirmation step, when alias not focused) |
-| `Tab` | Switch focus between alias field and buttons (confirmation step) |
-
-## ✏️ Edit Forward Wizard
-
-Press `e` on a selected row to edit it. The wizard reuses the add flow with values
-pre-filled. The local-port availability check skips the forward being edited, so
-keeping the same local port is always allowed. Advanced `httpLog` settings
-(`logFile`, `includeHeaders`, `maxBodySize`, `filterPath`) defined in YAML are
-preserved when toggling `httpLog` with `h`.
-
-## 🗑️ Delete Forward Wizard
-
-Press `d` from the main view.
-
-### Navigation
-
-| Key | Action |
-|-----|--------|
-| `↑↓` / `j/k` | Navigate |
-| `Space` | Toggle selection |
-| `a` | Select all |
-| `n` | Deselect all |
-| `Enter` | Confirm deletion |
-| `Esc` | Cancel (does not confirm deletion) |
-
-## 🎯 Resource Selection
-
-### Pod by Prefix
-
-Enter app name prefix to match pods:
-- `nginx` matches `nginx-deployment-abc123`
-- `postgres` matches `postgres-statefulset-0`
-
-### Pod by Selector
-
-Use Kubernetes label syntax:
-- `app=nginx`
-- `app=nginx,env=prod`
-
-Matching pods are shown in real-time.
-
-### Service
-
-Select from discovered services in the namespace.
-
-## 🔄 Auto Hot-Reload
-
-Changes are applied automatically:
-1. Wizard writes to `.kportal.yaml` atomically
-2. File watcher detects change (~100ms)
-3. Manager reloads and starts forward
-4. UI updates
-
-## Error Handling
-
-The wizards handle:
-- Cluster unreachable - allows manual entry
-- Port conflicts - shows which process is using the port
-- Invalid selectors - real-time validation
-- Duplicate ports - prevents conflicts
-
-## 🐛 Troubleshooting
-
-### Wizard not appearing
-
-Verify cluster connectivity:
-```bash
-kubectl cluster-info
-```
-
-### Port validation delayed
-
-Port checks run asynchronously. Wait briefly after typing.
-
-### Changes not visible
-
-Check:
-1. `.kportal.yaml` was written correctly
-2. No validation errors in file
-3. kportal process is running

cmd/kportal/completion.go

@@ -1,119 +0,0 @@
-package main
-
-import (
-	"flag"
-	"fmt"
-	"os"
-
-	"github.com/lukaszraczylo/kportal/internal/complete"
-)
-
-// completionCmd handles shell completion generation and installation
-func completionCmd(args []string) int {
-	fs := flag.NewFlagSet("completion", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-
-	var (
-		installFlag bool
-		shellFlag   string
-		uninstall   bool
-	)
-
-	fs.BoolVar(&installFlag, "install", false, "Install completions for the shell")
-	fs.BoolVar(&uninstall, "uninstall", false, "Uninstall completions")
-	fs.StringVar(&shellFlag, "shell", "", "Shell type: bash, zsh, or fish (auto-detected if empty)")
-
-	if err := fs.Parse(args); err != nil {
-		if err == flag.ErrHelp {
-			printCompletionHelp()
-			return 0
-		}
-		return 2
-	}
-
-	// Determine shell type
-	var shell complete.Shell
-	if shellFlag != "" {
-		switch shellFlag {
-		case "bash":
-			shell = complete.ShellBash
-		case "zsh":
-			shell = complete.ShellZsh
-		case "fish":
-			shell = complete.ShellFish
-		default:
-			fprintf(os.Stderr, "Error: unknown shell %q (use bash, zsh, or fish)\n", shellFlag)
-			return 1
-		}
-	} else {
-		shell = complete.AutoDetectShell()
-	}
-
-	// Handle uninstall
-	if uninstall {
-		installer := complete.NewInstaller(shell)
-		if err := installer.Uninstall(); err != nil {
-			fprintf(os.Stderr, "Error uninstalling completions: %v\n", err)
-			return 1
-		}
-		fmt.Println("✅ Completions uninstalled")
-		return 0
-	}
-
-	// Handle install
-	if installFlag {
-		if err := complete.InstallCompletions(shell); err != nil {
-			fprintf(os.Stderr, "Error installing completions: %v\n", err)
-			return 1
-		}
-		return 0
-	}
-
-	// Print completion script to stdout
-	if err := complete.Print(shell); err != nil {
-		fprintf(os.Stderr, "Error generating completions: %v\n", err)
-		return 1
-	}
-
-	return 0
-}
-
-func printCompletionHelp() {
-	fprintf(os.Stdout, `Generate shell completions for kportal.
-
-Usage:
-  kportal completion [flags]
-
-Flags:
-  --install        Install completions for the current shell
-  --uninstall      Remove installed completions
-  --shell <type>   Shell type: bash, zsh, or fish (auto-detected)
-
-Examples:
-  # Generate and source completions (bash)
-  source <(kportal completion)
-
-  # Install completions (requires shell restart)
-  kportal completion --install
-
-  # Install for specific shell
-  kportal completion --install --shell zsh
-
-  # Uninstall completions
-  kportal completion --uninstall
-
-Shell-specific setup:
-
-  Bash (~/.bashrc):
-    source <(kportal completion)
-
-  Zsh (~/.zshrc):
-    autoload -Uz compinit && compinit
-    source <(kportal completion)
-
-  Fish (~/.config/fish/config.fish):
-    kportal completion --install --shell fish
-    # Or manually:
-    kportal completion --shell fish > ~/.config/fish/completions/kportal.fish
-`)
-}

cmd/kportal/generate.go

@@ -1,156 +0,0 @@
-package main
-
-import (
-	"errors"
-	"flag"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/lukaszraczylo/kportal/internal/k8s"
-	"github.com/lukaszraczylo/kportal/internal/logger"
-	"github.com/lukaszraczylo/kportal/internal/ui"
-)
-
-// runGenerate parses generate-specific flags, validates them, and runs the
-// generate flow. Returns the process exit code.
-func runGenerate(args []string) int {
-	fs := flag.NewFlagSet("generate", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-	fs.Usage = func() {
-		fmt.Fprintf(os.Stderr, "Usage: kportal generate --context=NAME [--config=PATH] [--dry-run]\n\n")
-		fmt.Fprintf(os.Stderr, "Discover services in the chosen Kubernetes context, pick which ones\n")
-		fmt.Fprintf(os.Stderr, "to forward, and append them to the kportal config file.\n\n")
-		fmt.Fprintf(os.Stderr, "Flags:\n")
-		fs.PrintDefaults()
-	}
-	contextFlag := fs.String("context", "", "Kubernetes context to scan (required)")
-	configFlag := fs.String("config", defaultConfigFile, "Path to kportal configuration file")
-	dryRunFlag := fs.Bool("dry-run", false, "Print the planned forwards but do not modify the config")
-
-	if err := fs.Parse(args); err != nil {
-		if errors.Is(err, flag.ErrHelp) {
-			return 0
-		}
-		return 1
-	}
-
-	if *contextFlag == "" {
-		fmt.Fprintln(os.Stderr, "Error: --context is required")
-		fs.Usage()
-		return 1
-	}
-
-	// Initialise a discard logger so kubernetes client-go silence is honoured —
-	// the bubbletea TUI cannot tolerate stderr writes.
-	logger.Init(logger.LevelError, logger.FormatText, io.Discard)
-
-	// Resolve and sanitise config path the same way main does.
-	configPath, ok := resolveGenerateConfigPath(*configFlag)
-	if !ok {
-		return 1
-	}
-
-	// Build kubernetes client pool and verify the requested context exists.
-	pool, err := k8s.NewClientPool()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: failed to load kubeconfig: %v\n", err)
-		return 1
-	}
-	contexts, err := pool.ListContexts()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: failed to list kubeconfig contexts: %v\n", err)
-		return 1
-	}
-	if !contains(contexts, *contextFlag) {
-		fmt.Fprintf(os.Stderr, "Error: context %q not found in kubeconfig\n", *contextFlag)
-		fmt.Fprintf(os.Stderr, "Available contexts: %s\n", strings.Join(contexts, ", "))
-		return 1
-	}
-	discovery := k8s.NewDiscovery(pool)
-	mutator := config.NewMutator(configPath)
-
-	// Load existing config (or treat as empty if missing) to gather already-configured forwards.
-	var existingForwards []config.Forward
-	cfg, loadErr := config.LoadConfig(configPath)
-	switch {
-	case loadErr == nil:
-		existingForwards = cfg.GetAllForwards()
-	case errors.Is(loadErr, config.ErrConfigNotFound):
-		// Config does not exist yet — that's fine; we'll create it on save.
-		existingForwards = nil
-	default:
-		fmt.Fprintf(os.Stderr, "Error: failed to load config: %v\n", loadErr)
-		return 1
-	}
-
-	result, err := ui.RunGenerate(discovery, mutator, *contextFlag, configPath, *dryRunFlag, existingForwards)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		return 1
-	}
-
-	if result.Cancelled {
-		fmt.Fprintln(os.Stderr, "Cancelled.")
-		return 1
-	}
-
-	if result.UsedDryRun {
-		fmt.Printf("[dry-run] Would add %d forwards to %s\n", len(result.PlannedForwards), configPath)
-		for _, f := range result.PlannedForwards {
-			fmt.Printf("  %d → %s/%s/%s:%d\n", f.LocalPort, f.GetContext(), f.GetNamespace(), f.Resource, f.Port)
-		}
-		if result.SkippedNonTCP > 0 {
-			fmt.Fprintf(os.Stderr, "Warning: skipped %d non-TCP service ports (kportal forward layer is TCP-only)\n", result.SkippedNonTCP)
-		}
-		return 0
-	}
-
-	if len(result.Errors) > 0 {
-		fmt.Fprintf(os.Stderr, "Added %d forwards before error; remaining failed:\n", result.Added)
-		for _, e := range result.Errors {
-			fmt.Fprintf(os.Stderr, "  - %s\n", e)
-		}
-		return 1
-	}
-
-	fmt.Printf("Added %d forwards to %s\n", result.Added, configPath)
-	if result.SkippedNonTCP > 0 {
-		fmt.Fprintf(os.Stderr, "Warning: skipped %d non-TCP service ports (kportal forward layer is TCP-only)\n", result.SkippedNonTCP)
-	}
-	return 0
-}
-
-// resolveGenerateConfigPath mirrors the path validation main applies before
-// loading config: absolute, cleaned, and not inside protected system directories.
-func resolveGenerateConfigPath(path string) (string, bool) {
-	if path == "" {
-		fmt.Fprintln(os.Stderr, "Error: --config cannot be empty")
-		return "", false
-	}
-	abs, err := filepath.Abs(path)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: invalid config path: %v\n", err)
-		return "", false
-	}
-	abs = filepath.Clean(abs)
-	for _, sysDir := range []string{"/etc", "/sys", "/proc", "/dev"} {
-		if strings.HasPrefix(abs, sysDir) {
-			fmt.Fprintf(os.Stderr, "Error: config file cannot be in system directory: %s\n", sysDir)
-			return "", false
-		}
-	}
-	return abs, true
-}
-
-func contains(haystack []string, needle string) bool {
-	for _, s := range haystack {
-		if s == needle {
-			return true
-		}
-	}
-	return false
-}

cmd/kportal/helpers_test.go

@@ -1,273 +0,0 @@
-package main
-
-import (
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// fakeKubeconfig writes a minimal kubeconfig file to dir with a single context
-// named contextName and returns the path.
-func fakeKubeconfig(t *testing.T, dir, contextName string) string {
-	t.Helper()
-	content := `apiVersion: v1
-clusters:
-- cluster:
-    server: https://localhost:6443
-  name: fake-cluster
-contexts:
-- context:
-    cluster: fake-cluster
-    namespace: default
-    user: fake-user
-  name: ` + contextName + `
-current-context: ` + contextName + `
-kind: Config
-preferences: {}
-users:
-- name: fake-user
-  user: {}
-`
-	path := filepath.Join(dir, "kubeconfig")
-	require.NoError(t, os.WriteFile(path, []byte(content), 0600))
-	return path
-}
-
-// ---- promptCreateConfig ----
-
-func TestPromptCreateConfig_YesResponses(t *testing.T) {
-	cases := []struct {
-		name  string
-		input string
-	}{
-		{"empty enter", "\n"},
-		{"lowercase y", "y\n"},
-		{"uppercase Y", "Y\n"}, // ToLower normalises it
-		{"yes word", "yes\n"},
-		{"YES word", "YES\n"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			result := promptCreateConfig("/some/path.yaml", strings.NewReader(tc.input), io.Discard)
-			assert.True(t, result, "expected true for input %q", tc.input)
-		})
-	}
-}
-
-func TestPromptCreateConfig_NoResponses(t *testing.T) {
-	cases := []struct {
-		name  string
-		input string
-	}{
-		{"lowercase n", "n\n"},
-		{"uppercase N", "N\n"},
-		{"no word", "no\n"},
-		{"other text", "nope\n"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			result := promptCreateConfig("/some/path.yaml", strings.NewReader(tc.input), io.Discard)
-			assert.False(t, result, "expected false for input %q", tc.input)
-		})
-	}
-}
-
-func TestPromptCreateConfig_EOFReturnsFalse(t *testing.T) {
-	// Empty reader → EOF on first read → no data → false.
-	result := promptCreateConfig("/some/path.yaml", strings.NewReader(""), io.Discard)
-	assert.False(t, result, "EOF should return false")
-}
-
-// ---- contains ----
-
-func TestContains_Present(t *testing.T) {
-	assert.True(t, contains([]string{"a", "b", "c"}, "b"))
-}
-
-func TestContains_Absent(t *testing.T) {
-	assert.False(t, contains([]string{"a", "b", "c"}, "d"))
-}
-
-func TestContains_EmptySlice(t *testing.T) {
-	assert.False(t, contains([]string{}, "x"))
-}
-
-func TestContains_EmptyNeedle(t *testing.T) {
-	assert.True(t, contains([]string{"", "a"}, ""))
-}
-
-// ---- resolveGenerateConfigPath ----
-
-func TestResolveGenerateConfigPath_EmptyPath(t *testing.T) {
-	path, ok := resolveGenerateConfigPath("")
-	assert.False(t, ok)
-	assert.Empty(t, path)
-}
-
-func TestResolveGenerateConfigPath_SystemDirs(t *testing.T) {
-	sysDirs := []string{
-		"/etc/passwd",
-		"/sys/kernel/config",
-		"/proc/cpuinfo",
-		"/dev/null",
-	}
-	for _, d := range sysDirs {
-		t.Run(d, func(t *testing.T) {
-			path, ok := resolveGenerateConfigPath(d)
-			assert.False(t, ok, "system path should be rejected: %s", d)
-			assert.Empty(t, path)
-		})
-	}
-}
-
-func TestResolveGenerateConfigPath_ValidPath(t *testing.T) {
-	// A relative path should be resolved to an absolute, cleaned path.
-	path, ok := resolveGenerateConfigPath("relative/config.yaml")
-	assert.True(t, ok)
-	assert.True(t, strings.HasPrefix(path, "/"), "should be absolute")
-	assert.True(t, strings.HasSuffix(path, "relative/config.yaml"))
-}
-
-func TestResolveGenerateConfigPath_AbsolutePath(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := tmpDir + "/kportal.yaml"
-	path, ok := resolveGenerateConfigPath(configPath)
-	assert.True(t, ok)
-	assert.Equal(t, configPath, path)
-}
-
-// ---- runGenerate ----
-
-// captureStderr swaps os.Stderr for a pipe and returns a function that
-// restores it and returns whatever was written.
-func captureStderr(t *testing.T) func() string {
-	t.Helper()
-	origStderr := os.Stderr
-	r, w, err := os.Pipe()
-	require.NoError(t, err)
-	os.Stderr = w
-
-	return func() string {
-		_ = w.Close()
-		os.Stderr = origStderr
-		var sb strings.Builder
-		_, _ = io.Copy(&sb, r)
-		_ = r.Close()
-		return sb.String()
-	}
-}
-
-func TestRunGenerate_MissingContextFlag(t *testing.T) {
-	// --context is required; omitting it should return exit-code 1.
-	stop := captureStderr(t)
-	code := runGenerate([]string{})
-	stderr := stop()
-	assert.Equal(t, 1, code)
-	assert.Contains(t, stderr, "--context")
-}
-
-func TestRunGenerate_HelpFlag(t *testing.T) {
-	// -h / --help should return exit-code 0 (flag.ContinueOnError + ErrHelp).
-	stop := captureStderr(t)
-	code := runGenerate([]string{"-h"})
-	_ = stop()
-	assert.Equal(t, 0, code)
-}
-
-func TestRunGenerate_UnknownFlag(t *testing.T) {
-	// An unrecognised flag should return exit-code 1.
-	stop := captureStderr(t)
-	code := runGenerate([]string{"--unknown-flag=xyz"})
-	_ = stop()
-	assert.Equal(t, 1, code)
-}
-
-func TestRunGenerate_SystemDirConfig(t *testing.T) {
-	// A config path inside a system directory should return exit-code 1.
-	stop := captureStderr(t)
-	code := runGenerate([]string{"--context=minikube", "--config=/etc/kportal.yaml"})
-	stderr := stop()
-	assert.Equal(t, 1, code)
-	assert.Contains(t, stderr, "system directory")
-}
-
-func TestRunGenerate_ContextNotInKubeconfig(t *testing.T) {
-	// A context that does not exist in kubeconfig should return exit-code 1.
-	// This relies on k8s.NewClientPool() succeeding (it reads ~/.kube/config or
-	// returns an empty pool) and ListContexts() returning a set that does not
-	// contain the requested name.
-	tmpDir := t.TempDir()
-	configPath := tmpDir + "/kportal.yaml"
-
-	stop := captureStderr(t)
-	code := runGenerate([]string{
-		"--context=this-context-does-not-exist-in-any-kubeconfig-xyz",
-		"--config=" + configPath,
-	})
-	stderr := stop()
-	assert.Equal(t, 1, code)
-	// Either the context was not found, OR k8s client setup failed — both are
-	// valid error paths that return 1.
-	assert.NotEmpty(t, stderr)
-}
-
-// TestRunGenerate_MalformedConfig verifies that a config file with invalid YAML
-// causes runGenerate to return exit-code 1 before calling ui.RunGenerate.
-func TestRunGenerate_MalformedConfig(t *testing.T) {
-	tmpDir := t.TempDir()
-
-	// Create a fake kubeconfig with a known context name.
-	kubecfgPath := fakeKubeconfig(t, tmpDir, "test-ctx")
-	t.Setenv("KUBECONFIG", kubecfgPath)
-
-	// Write an invalid YAML config file.
-	configPath := filepath.Join(tmpDir, "bad.yaml")
-	require.NoError(t, os.WriteFile(configPath, []byte(":\t invalid yaml {{{\n"), 0600))
-
-	stop := captureStderr(t)
-	code := runGenerate([]string{
-		"--context=test-ctx",
-		"--config=" + configPath,
-	})
-	stderr := stop()
-	assert.Equal(t, 1, code)
-	assert.Contains(t, stderr, "failed to load config")
-}
-
-// TestRunGenerate_ValidContextNoUI verifies runGenerate error-handling when
-// ui.RunGenerate cannot open a TTY (always the case in non-interactive test
-// environments). The function should return exit-code 1 and print the error.
-func TestRunGenerate_ValidContextNoUI(t *testing.T) {
-	tmpDir := t.TempDir()
-	kubecfgPath := fakeKubeconfig(t, tmpDir, "test-ctx")
-	t.Setenv("KUBECONFIG", kubecfgPath)
-
-	// Config file does not exist — ErrConfigNotFound is acceptable; code
-	// proceeds to ui.RunGenerate which fails (no TTY in tests).
-	configPath := filepath.Join(tmpDir, "nonexistent.yaml")
-
-	stop := captureStderr(t)
-	code := runGenerate([]string{
-		"--context=test-ctx",
-		"--config=" + configPath,
-	})
-	stderr := stop()
-	// Either the UI failed (exit 1) or — on rare CI with a TTY — it was
-	// cancelled (also exit 1). Both are acceptable outcomes for this test.
-	assert.Equal(t, 1, code)
-	_ = stderr // error message varies by environment
-}
-
-// ---- promptCreateConfig output via bufio path ----
-
-// TestPromptCreateConfig_PathIncludedInOutput verifies the path is printed.
-func TestPromptCreateConfig_PathIncludedInOutput(t *testing.T) {
-	var stdout strings.Builder
-	_ = promptCreateConfig("/my/special/config.yaml", strings.NewReader("n\n"), &stdout)
-	assert.Contains(t, stdout.String(), "/my/special/config.yaml")
-}

cmd/kportal/main.go

@@ -1,727 +1,226 @@
 package main
 
 import (
-	"bufio"
-	"context"
 	"flag"
 	"fmt"
 	"io"
 	"log"
 	"os"
 	"os/signal"
-	"path/filepath"
-	"strings"
 	"syscall"
 	"time"
 
-	"github.com/go-logr/logr"
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/lukaszraczylo/kportal/internal/converter"
-	"github.com/lukaszraczylo/kportal/internal/forward"
-	"github.com/lukaszraczylo/kportal/internal/httplog"
-	"github.com/lukaszraczylo/kportal/internal/k8s"
-	"github.com/lukaszraczylo/kportal/internal/logger"
-	"github.com/lukaszraczylo/kportal/internal/mdns"
-	"github.com/lukaszraczylo/kportal/internal/ui"
-	"github.com/lukaszraczylo/kportal/internal/version"
-	telemetry "github.com/lukaszraczylo/oss-telemetry"
+	"github.com/nvm/kportal/internal/config"
+	"github.com/nvm/kportal/internal/converter"
+	"github.com/nvm/kportal/internal/forward"
+	"github.com/nvm/kportal/internal/ui"
 	"k8s.io/klog/v2"
 )
 
 const (
-	defaultConfigFile        = ".kportal.yaml"
-	initialForwardSettleTime = 100 * time.Millisecond
-	tableUpdateInterval      = 2 * time.Second
-
-	// GitHub repository info for update checks
-	githubOwner = "lukaszraczylo"
-	githubRepo  = "kportal"
+	defaultConfigFile = ".kportal.yaml"
 )
 
-// appVersion is the build version. Set via ldflags during build:
-//
-//	-X main.appVersion=v1.2.3
-var appVersion = "0.1.0"
-
-// runOptions captures the parsed flag values so each mode-specific run* function
-// can be invoked independently of the global flag state. Held by value because
-// it's small and travels through multiple goroutines.
-type runOptions struct {
-	configFile    string
-	logFormat     string
-	convertInput  string
-	convertOutput string
-	verbose       bool
-	headless      bool
-	check         bool
-	showVersion   bool
-	checkUpdate   bool
-}
-
-// fprintf is a small wrapper that suppresses the io.Writer write error. We
-// route output to caller-provided writers (stdout / stderr / io.Discard /
-// bytes.Buffer in tests), and a write error on any of these is non-actionable
-// at this layer.
-func fprintf(w io.Writer, format string, args ...any) {
-	_, _ = fmt.Fprintf(w, format, args...)
-}
-
-// fprintln is the Fprintln equivalent of fprintf.
-func fprintln(w io.Writer, args ...any) {
-	_, _ = fmt.Fprintln(w, args...)
-}
-
-// fprint is the Fprint equivalent of fprintf.
-func fprint(w io.Writer, args ...any) {
-	_, _ = fmt.Fprint(w, args...)
-}
-
-// promptCreateConfig asks the user if they want to create a new config file.
-// Returns true if the user answers yes, false otherwise.
-func promptCreateConfig(path string, stdin io.Reader, stdout io.Writer) bool {
-	fprintf(stdout, "Configuration file not found: %s\n", path)
-	fprint(stdout, "Would you like to create an empty configuration? [Y/n] ")
-
-	reader := bufio.NewReader(stdin)
-	response, err := reader.ReadString('\n')
-	if err != nil {
-		// EOF with data is acceptable - the user might have piped a response without trailing newline.
-		if response == "" {
-			return false
-		}
-	}
-
-	response = strings.TrimSpace(strings.ToLower(response))
-	// Empty response (just Enter) defaults to yes
-	return response == "" || response == "y" || response == "yes"
-}
+var (
+	configFile    = flag.String("c", defaultConfigFile, "Path to configuration file")
+	verbose       = flag.Bool("v", false, "Enable verbose logging")
+	check         = flag.Bool("check", false, "Validate configuration and exit")
+	showVersion   = flag.Bool("version", false, "Show version and exit")
+	convertInput  = flag.String("convert", "", "Convert kftray JSON config to kportal YAML (provide input file path)")
+	convertOutput = flag.String("convert-output", ".kportal.yaml", "Output file for converted configuration")
+	version       = "0.1.0" // Set via ldflags during build
+)
 
 func main() {
-	os.Exit(runMain())
-}
+	flag.Parse()
 
-// runMain wraps the real entry point so that deferred cleanup (telemetry
-// drain, signal context cancel) runs before the surrounding os.Exit.
-func runMain() int {
-	telemetry.Send("kportal", appVersion)
-	defer telemetry.Wait(2 * time.Second)
+	if *showVersion {
+		fmt.Printf("kportal version %s\n", version)
+		os.Exit(0)
+	}
 
-	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
-	defer cancel()
-
-	return run(ctx, os.Args[1:], os.Stdin, os.Stdout, os.Stderr)
-}
-
-// run is the testable entry point. It returns the desired process exit code
-// instead of calling os.Exit. ctx must be cancelled to trigger clean shutdown
-// of long-running modes (headless, verbose-loop, interactive).
-func run(ctx context.Context, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
-	// Subcommand dispatch must run BEFORE the main flag set is parsed because
-	// generate and completion have their own FlagSets and must not see kportal's top-level flags.
-	if len(args) >= 1 {
-		switch args[0] {
-		case "generate":
-			return runGenerate(args[1:])
-		case "completion":
-			return completionCmd(args[1:])
+	// Handle conversion mode
+	if *convertInput != "" {
+		if err := converter.ConvertKFTrayToKPortal(*convertInput, *convertOutput); err != nil {
+			fmt.Fprintf(os.Stderr, "Error converting configuration: %v\n", err)
+			os.Exit(1)
 		}
-	}
 
-	opts, code, handled := parseFlags(args, stderr)
-	if handled {
-		return code
-	}
-
-	// Quick-exit informational modes — these short-circuit before any cluster
-	// work and never need a config file.
-	if opts.showVersion {
-		return runShowVersion(stdout)
-	}
-	if opts.checkUpdate {
-		return runCheckUpdate(stdout, stderr)
-	}
-
-	// Validate config path security (block system directories, normalise to abs).
-	resolvedConfig, ok := resolveConfigPath(opts.configFile, stderr)
-	if !ok {
-		return 1
-	}
-	opts.configFile = resolvedConfig
-
-	// Initialise structured logger / klog routing. These outputs depend on mode,
-	// not on -v alone (see comment block in original implementation).
-	initLoggers(opts, stderr)
-
-	// Conversion mode runs before config load — it does not need a kportal config.
-	if opts.convertInput != "" {
-		return runConvert(opts.convertInput, opts.convertOutput, stdout, stderr)
-	}
-
-	// Configure stdlib log destination based on mode.
-	configureStdlibLog(opts)
-
-	// Load configuration (with optional create-on-missing prompt).
-	cfg, configIsNew, code, handled := loadOrCreateConfig(opts.configFile, stdin, stdout, stderr)
-	if handled {
-		return code
-	}
-
-	// Validate configuration (allow empty for newly created files).
-	validator := config.NewValidator()
-	if errs := validator.ValidateConfigWithOptions(cfg, configIsNew || cfg.IsEmpty()); len(errs) > 0 {
-		fprint(stderr, config.FormatValidationErrors(errs))
-		return 1
-	}
-
-	if opts.check {
-		fprintln(stdout, "Configuration is valid")
-		return 0
-	}
-
-	if opts.verbose {
-		log.Printf("kportal v%s", appVersion)
-		log.Printf("Loading configuration from: %s", opts.configFile)
-	}
-
-	// Build forward manager + supporting bits, shared by headless / verbose / TUI paths.
-	deps, err := buildRuntimeDeps(opts, cfg, stderr)
-	if err != nil {
-		fprintf(stderr, "Error: %v\n", err)
-		return 1
-	}
-
-	switch {
-	case opts.headless:
-		return runHeadless(ctx, opts, cfg, deps, validator, stderr)
-	case opts.verbose:
-		return runVerboseTable(ctx, opts, cfg, deps, validator, stderr)
-	default:
-		return runInteractive(ctx, opts, cfg, deps, stderr)
-	}
-}
-
-// parseFlags binds args to a fresh FlagSet and returns the parsed options.
-// On parse error / -help, returns (zero, code, true) to signal the caller to
-// exit immediately with the supplied code.
-func parseFlags(args []string, stderr io.Writer) (runOptions, int, bool) {
-	fs := flag.NewFlagSet("kportal", flag.ContinueOnError)
-	fs.SetOutput(stderr)
-
-	var opts runOptions
-	fs.StringVar(&opts.configFile, "c", defaultConfigFile, "Path to configuration file")
-	fs.BoolVar(&opts.verbose, "v", false, "Enable verbose logging")
-	fs.BoolVar(&opts.headless, "headless", false, "Run in headless mode (no UI, for background/daemon use)")
-	fs.StringVar(&opts.logFormat, "log-format", "text", "Log format: text or json")
-	fs.BoolVar(&opts.check, "check", false, "Validate configuration and exit")
-	fs.BoolVar(&opts.showVersion, "version", false, "Show version and exit")
-	fs.BoolVar(&opts.checkUpdate, "update", false, "Check for updates and exit")
-	fs.StringVar(&opts.convertInput, "convert", "", "Convert kftray JSON config to kportal YAML (provide input file path)")
-	fs.StringVar(&opts.convertOutput, "convert-output", ".kportal.yaml", "Output file for converted configuration")
-
-	if err := fs.Parse(args); err != nil {
-		if err == flag.ErrHelp {
-			return opts, 0, true
+		// Print summary
+		contextMap, totalForwards, err := converter.GetConversionSummary(*convertInput)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Warning: Could not generate summary: %v\n", err)
+		} else {
+			fmt.Printf("Successfully converted %d forwards from %s to %s\n", totalForwards, *convertInput, *convertOutput)
+			fmt.Printf("Generated configuration with:\n")
+			for ctx, namespaces := range contextMap {
+				fmt.Printf("  - Context '%s':\n", ctx)
+				for ns, count := range namespaces {
+					fmt.Printf("    - Namespace '%s': %d forwards\n", ns, count)
+				}
+			}
 		}
-		return opts, 2, true
-	}
-	return opts, 0, false
-}
-
-// resolveConfigPath validates the user-supplied config path: must resolve to
-// an absolute, cleaned path that is not inside a protected system directory.
-func resolveConfigPath(path string, stderr io.Writer) (string, bool) {
-	if path == "" {
-		return "", true // empty is allowed; caller treats it as "no config"
-	}
-	abs, err := filepath.Abs(path)
-	if err != nil {
-		fprintf(stderr, "Invalid config path: %v\n", err)
-		return "", false
-	}
-	abs = filepath.Clean(abs)
-	for _, sysDir := range []string{"/etc", "/sys", "/proc", "/dev"} {
-		if strings.HasPrefix(abs, sysDir) {
-			fprintf(stderr, "Error: Config file cannot be in system directory: %s\n", sysDir)
-			return "", false
-		}
-	}
-	return abs, true
-}
-
-// initLoggers configures the structured logger and klog routing. Output
-// destination depends on run mode (see big comment for rationale).
-func initLoggers(opts runOptions, stderr io.Writer) {
-	var logLevel logger.Level
-	var logFmt logger.Format
-	var logOutput io.Writer
-
-	if opts.verbose {
-		logLevel = logger.LevelDebug
-	} else {
-		logLevel = logger.LevelInfo
+		os.Exit(0)
 	}
 
-	if opts.headless || opts.verbose {
-		logOutput = stderr
-	} else {
-		logOutput = io.Discard
-	}
-
-	switch opts.logFormat {
-	case "json":
-		logFmt = logger.FormatJSON
-	default:
-		logFmt = logger.FormatText
-	}
-
-	logger.Init(logLevel, logFmt, logOutput)
-
-	klog.LogToStderr(false)
-	if opts.verbose {
-		klogLogger := logger.New(logger.LevelDebug, logFmt, stderr)
-		klog.SetOutput(logger.NewKlogWriter(klogLogger))
-		logrSink := logger.NewLogrAdapter(klogLogger)
-		klog.SetLogger(logr.New(logrSink))
-	} else {
-		klog.SetOutput(io.Discard)
-		silentLogger := logger.New(logger.LevelError+1, logFmt, io.Discard)
-		logrSink := logger.NewLogrAdapter(silentLogger)
-		klog.SetLogger(logr.New(logrSink))
-	}
-}
-
-// configureStdlibLog matches stdlib log destination to the mode. Only the TUI
-// path needs total silence; daemonised modes keep stderr.
-func configureStdlibLog(opts runOptions) {
-	switch {
-	case opts.verbose:
-		log.SetFlags(log.LstdFlags | log.Lshortfile)
-	case opts.headless:
-		log.SetFlags(log.LstdFlags)
-	default:
+	if !*verbose {
+		// In interactive mode, disable ALL logging to avoid interfering with bubbletea UI
 		log.SetOutput(io.Discard)
 		log.SetPrefix("")
 		log.SetFlags(0)
-	}
-}
 
-// loadOrCreateConfig loads the config, prompting to create an empty file if it
-// doesn't exist. Returns (cfg, configIsNew, exitCode, handled).
-func loadOrCreateConfig(configFile string, stdin io.Reader, stdout, stderr io.Writer) (*config.Config, bool, int, bool) {
-	cfg, err := config.LoadConfig(configFile)
-	if err == nil {
-		return cfg, false, 0, false
-	}
-	if err != config.ErrConfigNotFound {
-		fprintf(stderr, "Error loading config: %v\n", err)
-		return nil, false, 1, true
-	}
-	if !promptCreateConfig(configFile, stdin, stdout) {
-		return nil, false, 0, true
-	}
-	if createErr := config.CreateEmptyConfigFile(configFile); createErr != nil {
-		fprintf(stderr, "Error creating config file: %v\n", createErr)
-		return nil, false, 1, true
-	}
-	fprintf(stdout, "Created %s\n", configFile)
-	fprintln(stdout, "Use 'n' in the UI to add port forwards, or edit the file manually.")
-	fprintln(stdout)
-
-	cfg, err = config.LoadConfig(configFile)
-	if err != nil {
-		fprintf(stderr, "Error loading config: %v\n", err)
-		return nil, false, 1, true
-	}
-	return cfg, true, 0, false
-}
-
-// runtimeDeps bundles the long-lived objects shared by all UI modes.
-type runtimeDeps struct {
-	manager   *forward.Manager
-	pool      *k8s.ClientPool
-	discovery *k8s.Discovery
-	mutator   *config.Mutator
-	mdnsPub   *mdns.Publisher
-}
-
-// buildRuntimeDeps constructs the kubernetes client pool, forward manager, and
-// helpers used across run modes. Returns an error only on fatal failures
-// (manager creation); a missing kubeconfig is logged but allowed.
-func buildRuntimeDeps(opts runOptions, cfg *config.Config, stderr io.Writer) (*runtimeDeps, error) {
-	pool, err := k8s.NewClientPool()
-	if err != nil {
-		fprintf(stderr, "Warning: Failed to create k8s client pool: %v\n", err)
-		fprintf(stderr, "Add/remove wizards will not be available\n")
-	}
-	discovery := k8s.NewDiscovery(pool)
-	mutator := config.NewMutator(opts.configFile)
-
-	manager, err := forward.NewManager(opts.verbose)
-	if err != nil {
-		return nil, fmt.Errorf("creating forward manager: %w", err)
-	}
-
-	pub := mdns.NewPublisher(cfg.IsMDNSEnabled())
-	manager.SetMDNSPublisher(pub)
-	if cfg.IsMDNSEnabled() && opts.verbose {
-		log.Printf("mDNS hostname publishing enabled - aliases will be accessible via <alias>.local")
-	}
-
-	return &runtimeDeps{
-		manager:   manager,
-		pool:      pool,
-		discovery: discovery,
-		mutator:   mutator,
-		mdnsPub:   pub,
-	}, nil
-}
-
-// runShowVersion prints the version and exits 0.
-func runShowVersion(stdout io.Writer) int {
-	fprintf(stdout, "kportal version %s\n", appVersion)
-	return 0
-}
-
-// runCheckUpdate checks for available updates and prints the result.
-func runCheckUpdate(stdout, _ io.Writer) int {
-	fprintf(stdout, "kportal version %s\n", appVersion)
-	fprintln(stdout, "Checking for updates...")
-
-	checker := version.NewChecker(githubOwner, githubRepo, appVersion)
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	update := checker.CheckForUpdate(ctx)
-	if update == nil {
-		fprintln(stdout, "You are running the latest version.")
-		return 0
-	}
-
-	fprintf(stdout, "\nUpdate available: v%s\n", update.LatestVersion)
-	fprintf(stdout, "Download: %s\n", update.ReleaseURL)
-	fprintln(stdout, "\nTo update, download the latest release from the URL above")
-	fprintln(stdout, "or use your package manager (e.g., 'brew upgrade kportal').")
-	return 0
-}
-
-// runConvert converts a kftray JSON file to a kportal YAML config.
-func runConvert(input, output string, stdout, stderr io.Writer) int {
-	if err := converter.ConvertKFTrayToKPortal(input, output); err != nil {
-		fprintf(stderr, "Error converting configuration: %v\n", err)
-		return 1
-	}
-
-	contextMap, totalForwards, err := converter.GetConversionSummary(input)
-	if err != nil {
-		fprintf(stderr, "Warning: Could not generate summary: %v\n", err)
-		return 0
-	}
-	fprintf(stdout, "Successfully converted %d forwards from %s to %s\n", totalForwards, input, output)
-	fprintf(stdout, "Generated configuration with:\n")
-	for ctx, namespaces := range contextMap {
-		fprintf(stdout, "  - Context '%s':\n", ctx)
-		for ns, count := range namespaces {
-			fprintf(stdout, "    - Namespace '%s': %d forwards\n", ns, count)
-		}
-	}
-	return 0
-}
-
-// runHeadless runs the daemon-style mode: no UI, signal-driven SIGHUP reloads,
-// graceful shutdown on ctx.Done() (which is cancelled by SIGINT/SIGTERM).
-func runHeadless(ctx context.Context, opts runOptions, cfg *config.Config, deps *runtimeDeps, validator *config.Validator, stderr io.Writer) int {
-	if startErr := deps.manager.Start(cfg); startErr != nil {
-		fprintf(stderr, "Error starting forwards: %v\n", startErr)
-		return 1
-	}
-
-	// SIGHUP triggers reload only — separate from the ctx-driven shutdown.
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, syscall.SIGHUP)
-	defer signal.Stop(sigChan)
-
-	watcher, watcherErr := config.NewWatcher(opts.configFile, func(newCfg *config.Config) error {
-		return deps.manager.Reload(newCfg)
-	}, opts.verbose)
-	watcherStarted := false
-	if watcherErr != nil {
-		if opts.verbose {
-			log.Printf("Warning: Failed to setup config watcher: %v", watcherErr)
-			log.Printf("Hot-reload will not be available")
-		}
+		// Disable klog (used by kubernetes client-go)
+		klog.SetOutput(io.Discard)
+		klog.LogToStderr(false)
 	} else {
-		watcher.Start()
-		watcherStarted = true
-	}
-	defer func() {
-		if watcherStarted {
-			watcher.Stop()
-		}
-	}()
-
-	if opts.verbose {
-		log.Printf("Headless mode started. Press Ctrl+C to stop")
+		log.SetFlags(log.LstdFlags | log.Lshortfile)
 	}
 
-	for {
-		select {
-		case <-ctx.Done():
-			return shutdownManager(ctx, deps.manager, opts.verbose)
-		case <-sigChan:
-			if opts.verbose {
-				log.Printf("Received SIGHUP, reloading configuration...")
-			}
-			newCfg, loadErr := config.LoadConfig(opts.configFile)
-			if loadErr != nil {
-				if opts.verbose {
-					log.Printf("Failed to reload config: %v", loadErr)
-				}
-				continue
-			}
-			if errs := validator.ValidateConfig(newCfg); len(errs) > 0 {
-				if opts.verbose {
-					log.Printf("Config validation failed:")
-					log.Print(config.FormatValidationErrors(errs))
-				}
-				continue
-			}
-			if reloadErr := deps.manager.Reload(newCfg); reloadErr != nil {
-				if opts.verbose {
-					log.Printf("Failed to reload: %v", reloadErr)
-				}
-			}
-		}
-	}
-}
-
-// runVerboseTable runs the simple table UI with periodic redraws and SIGHUP
-// reload, exiting cleanly when ctx is cancelled.
-func runVerboseTable(ctx context.Context, opts runOptions, cfg *config.Config, deps *runtimeDeps, validator *config.Validator, stderr io.Writer) int {
-	tableUI := ui.NewTableUI(opts.verbose)
-	deps.manager.SetStatusUI(tableUI)
-
-	// Background update check (best effort).
-	go func() {
-		checker := version.NewChecker(githubOwner, githubRepo, appVersion)
-		uctx, cancel := context.WithTimeout(ctx, 10*time.Second)
-		defer cancel()
-		if update := checker.CheckForUpdate(uctx); update != nil {
-			log.Printf("Update available: v%s (current: v%s) - %s",
-				update.LatestVersion, update.CurrentVersion, update.ReleaseURL)
-		}
-	}()
-
-	if startErr := deps.manager.Start(cfg); startErr != nil {
-		fprintf(stderr, "Error starting forwards: %v\n", startErr)
-		return 1
+	// Load configuration
+	cfg, err := config.LoadConfig(*configFile)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error loading config: %v\n", err)
+		os.Exit(1)
 	}
 
-	tableUI.RenderInitial()
+	// Validate configuration
+	validator := config.NewValidator()
+	if errs := validator.ValidateConfig(cfg); len(errs) > 0 {
+		fmt.Fprint(os.Stderr, config.FormatValidationErrors(errs))
+		os.Exit(1)
+	}
 
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, syscall.SIGHUP)
-	defer signal.Stop(sigChan)
+	if *check {
+		fmt.Println("Configuration is valid")
+		os.Exit(0)
+	}
 
-	// Periodic table refresh — driven by ctx.Done() so it exits cleanly.
-	tickerDone := make(chan struct{})
-	go func() {
-		defer close(tickerDone)
-		ticker := time.NewTicker(tableUpdateInterval)
-		defer ticker.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-ticker.C:
+	// Only log startup messages in verbose mode
+	if *verbose {
+		log.Printf("kportal v%s", version)
+		log.Printf("Loading configuration from: %s", *configFile)
+	}
+
+	// Create forward manager
+	manager := forward.NewManager(*verbose)
+
+	// Create UI (bubbletea for interactive, simple table for verbose)
+	var bubbleTeaUI *ui.BubbleTeaUI
+	var tableUI *ui.TableUI
+
+	if !*verbose {
+		// Interactive mode with bubbletea
+		bubbleTeaUI = ui.NewBubbleTeaUI(func(id string, enable bool) {
+			if enable {
+				manager.EnableForward(id)
+			} else {
+				manager.DisableForward(id)
+			}
+		}, version)
+		manager.SetStatusUI(bubbleTeaUI)
+	} else {
+		// Verbose mode with simple table
+		tableUI = ui.NewTableUI(*verbose)
+		manager.SetStatusUI(tableUI)
+	}
+
+	// Start forwards
+	if err := manager.Start(cfg); err != nil {
+		fmt.Fprintf(os.Stderr, "Error starting forwards: %v\n", err)
+		os.Exit(1)
+	}
+
+	if *verbose {
+		// Verbose mode - use simple table with periodic updates
+		tableUI.RenderInitial()
+
+		// Setup signal handling
+		sigChan := make(chan os.Signal, 1)
+		signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM, syscall.SIGHUP)
+
+		// Start table update loop
+		go func() {
+			ticker := time.NewTicker(2 * time.Second)
+			defer ticker.Stop()
+			for range ticker.C {
 				tableUI.Render()
 			}
-		}
-	}()
+		}()
 
-	watcher, watchErr := config.NewWatcher(opts.configFile, func(newCfg *config.Config) error {
-		return deps.manager.Reload(newCfg)
-	}, opts.verbose)
-	watcherActive := false
-	if watchErr != nil {
-		log.Printf("Warning: Failed to setup config watcher: %v", watchErr)
-		log.Printf("Hot-reload will not be available")
-	} else {
-		watcher.Start()
-		watcherActive = true
-	}
-	defer func() {
-		if watcherActive {
-			watcher.Stop()
-		}
-	}()
-
-	log.Printf("Press Ctrl+C to stop")
-
-	for {
-		select {
-		case <-ctx.Done():
-			<-tickerDone
-			return shutdownManager(ctx, deps.manager, opts.verbose)
-		case <-sigChan:
-			log.Printf("Received SIGHUP, reloading configuration...")
-			newCfg, loadErr := config.LoadConfig(opts.configFile)
-			if loadErr != nil {
-				log.Printf("Failed to reload config: %v", loadErr)
-				continue
-			}
-			if errs := validator.ValidateConfig(newCfg); len(errs) > 0 {
-				log.Printf("Config validation failed:")
-				log.Print(config.FormatValidationErrors(errs))
-				continue
-			}
-			if reloadErr := deps.manager.Reload(newCfg); reloadErr != nil {
-				log.Printf("Failed to reload: %v", reloadErr)
-			}
-		}
-	}
-}
-
-// runInteractive runs the bubbletea TUI. Cannot be exercised in non-TTY tests.
-func runInteractive(ctx context.Context, opts runOptions, cfg *config.Config, deps *runtimeDeps, stderr io.Writer) int {
-	bubbleTeaUI := ui.NewBubbleTeaUI(func(id string, enable bool) {
-		if enable {
-			_ = deps.manager.EnableForward(id)
+		// Setup config watcher for hot-reload
+		watcher, err := config.NewWatcher(*configFile, func(newCfg *config.Config) error {
+			return manager.Reload(newCfg)
+		}, *verbose)
+		if err != nil {
+			log.Printf("Warning: Failed to setup config watcher: %v", err)
+			log.Printf("Hot-reload will not be available")
 		} else {
-			_ = deps.manager.DisableForward(id)
-		}
-	}, appVersion)
-	bubbleTeaUI.SetWizardDependencies(deps.discovery, deps.mutator, opts.configFile)
-	bubbleTeaUI.SetHTTPLogSubscriber(makeHTTPLogSubscriber(deps.manager))
-
-	go func() {
-		checker := version.NewChecker(githubOwner, githubRepo, appVersion)
-		uctx, cancel := context.WithTimeout(ctx, 10*time.Second)
-		defer cancel()
-		if update := checker.CheckForUpdate(uctx); update != nil {
-			bubbleTeaUI.SetUpdateAvailable(update.LatestVersion, update.ReleaseURL)
-		}
-	}()
-
-	deps.manager.SetStatusUI(bubbleTeaUI)
-
-	if startErr := deps.manager.Start(cfg); startErr != nil {
-		fprintf(stderr, "Error starting forwards: %v\n", startErr)
-		return 1
-	}
-
-	var watcher *config.Watcher
-	watcher, err := config.NewWatcher(opts.configFile, func(newCfg *config.Config) error {
-		return deps.manager.Reload(newCfg)
-	}, opts.verbose)
-	if err == nil {
-		watcher.Start()
-	}
-
-	cleanup := func() {
-		bubbleTeaUI.Stop()
-		deps.manager.Stop()
-		if watcher != nil {
-			watcher.Stop()
-		}
-	}
-
-	// Wire ctx cancellation to UI shutdown so SIGINT/SIGTERM exit cleanly.
-	stopWatcher := make(chan struct{})
-	defer close(stopWatcher)
-	go func() {
-		select {
-		case <-ctx.Done():
-			cleanup()
-		case <-stopWatcher:
-		}
-	}()
-
-	time.Sleep(initialForwardSettleTime)
-
-	if startErr := bubbleTeaUI.Start(); startErr != nil {
-		fprintf(stderr, "Failed to start UI: %v\n", startErr)
-		cleanup()
-		return 1
-	}
-	cleanup()
-	return 0
-}
-
-// makeHTTPLogSubscriber builds the subscriber callback used by the bubbletea UI.
-func makeHTTPLogSubscriber(manager *forward.Manager) ui.HTTPLogSubscriber {
-	return func(forwardID string, callback func(entry ui.HTTPLogEntry)) func() {
-		worker := manager.GetWorker(forwardID)
-		if worker == nil {
-			logger.Debug("HTTP log subscription failed: worker not found", map[string]any{
-				"forward_id": forwardID,
-			})
-			return func() {}
-		}
-		proxy := worker.GetHTTPProxy()
-		if proxy == nil {
-			logger.Debug("HTTP log subscription skipped: proxy not enabled", map[string]any{
-				"forward_id": forwardID,
-			})
-			return func() {}
-		}
-		proxyLogger := proxy.GetLogger()
-		if proxyLogger == nil {
-			logger.Debug("HTTP log subscription failed: logger not available", map[string]any{
-				"forward_id": forwardID,
-			})
-			return func() {}
+			watcher.Start()
+			defer watcher.Stop()
 		}
 
-		proxyLogger.AddCallback(func(entry httplog.Entry) {
-			uiEntry := ui.HTTPLogEntry{
-				RequestID:  entry.RequestID,
-				Timestamp:  entry.Timestamp.Format("15:04:05"),
-				Direction:  entry.Direction,
-				Method:     entry.Method,
-				Path:       entry.Path,
-				StatusCode: entry.StatusCode,
-				LatencyMs:  entry.LatencyMs,
-				BodySize:   entry.BodySize,
-				Error:      entry.Error,
+		log.Printf("Press Ctrl+C to stop")
+
+		// Wait for signals
+		for {
+			sig := <-sigChan
+			switch sig {
+			case syscall.SIGHUP:
+				log.Printf("Received SIGHUP, reloading configuration...")
+				newCfg, err := config.LoadConfig(*configFile)
+				if err != nil {
+					log.Printf("Failed to reload config: %v", err)
+					continue
+				}
+
+				if errs := validator.ValidateConfig(newCfg); len(errs) > 0 {
+					log.Printf("Config validation failed:")
+					log.Print(config.FormatValidationErrors(errs))
+					continue
+				}
+
+				if err := manager.Reload(newCfg); err != nil {
+					log.Printf("Failed to reload: %v", err)
+				}
+
+			case os.Interrupt, syscall.SIGTERM:
+				log.Printf("Received shutdown signal, stopping...")
+				manager.Stop()
+				os.Exit(0)
 			}
-			switch entry.Direction {
-			case "request":
-				uiEntry.RequestHeaders = entry.Headers
-				uiEntry.RequestBody = entry.Body
-			case "response":
-				uiEntry.ResponseHeaders = entry.Headers
-				uiEntry.ResponseBody = entry.Body
-			}
-			callback(uiEntry)
-		})
-
-		return func() {
-			proxyLogger.ClearCallbacks()
 		}
-	}
-}
+	} else {
+		// Interactive mode with bubbletea
+		// Setup config watcher in background
+		watcher, err := config.NewWatcher(*configFile, func(newCfg *config.Config) error {
+			return manager.Reload(newCfg)
+		}, *verbose)
+		if err == nil {
+			watcher.Start()
+			defer watcher.Stop()
+		}
 
-// shutdownManager stops the forward manager with a 5s timeout, returning 0 on
-// success or after timeout (we always exit cleanly from a shutdown signal).
-func shutdownManager(ctx context.Context, manager *forward.Manager, verbose bool) int {
-	if verbose {
-		log.Printf("Received shutdown signal, stopping...")
-	}
-	shutdownDone := make(chan struct{})
-	go func() {
+		// Setup signal handler for clean shutdown
+		go func() {
+			sigChan := make(chan os.Signal, 1)
+			signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
+			<-sigChan
+			bubbleTeaUI.Stop()
+			manager.Stop()
+			os.Exit(0)
+		}()
+
+		// Give a moment for initial forwards to be added
+		time.Sleep(100 * time.Millisecond)
+
+		// Start the bubbletea app (blocks until quit)
+		if err := bubbleTeaUI.Start(); err != nil {
+			fmt.Fprintf(os.Stderr, "Failed to start UI: %v\n", err)
+			manager.Stop()
+			os.Exit(1)
+		}
+
+		// Clean shutdown
 		manager.Stop()
-		close(shutdownDone)
-	}()
-	select {
-	case <-shutdownDone:
-		if verbose {
-			log.Printf("Graceful shutdown complete")
-		}
-	case <-time.After(5 * time.Second):
-		if verbose {
-			log.Printf("Shutdown timed out, forcing exit...")
-		}
 	}
-	_ = ctx // ctx may already be done; we still wait up to 5s for graceful stop.
-	return 0
 }

cmd/kportal/run_test.go

@@ -1,653 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/forward"
-	"github.com/lukaszraczylo/kportal/internal/ui"
-	"github.com/lukaszraczylo/kportal/internal/version"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// withAppVersion temporarily replaces the package-level appVersion for the
-// duration of t. Restores the original on cleanup.
-func withAppVersion(t *testing.T, v string) {
-	t.Helper()
-	prev := appVersion
-	appVersion = v
-	t.Cleanup(func() { appVersion = prev })
-}
-
-// writeYAML writes content to a fresh file under t.TempDir() and returns the
-// absolute path.
-func writeYAML(t *testing.T, name, content string) string {
-	t.Helper()
-	dir := t.TempDir()
-	path := filepath.Join(dir, name)
-	require.NoError(t, os.WriteFile(path, []byte(content), 0o600))
-	return path
-}
-
-// TestRun_VersionFlag verifies -version exits 0 and prints to stdout.
-func TestRun_VersionFlag(t *testing.T) {
-	withAppVersion(t, "9.9.9")
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-version"}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 0, code)
-	assert.Contains(t, stdout.String(), "kportal version 9.9.9")
-	assert.Empty(t, stderr.String())
-}
-
-// TestRun_FlagParseError verifies an unknown flag exits 2.
-func TestRun_FlagParseError(t *testing.T) {
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"--no-such-flag"}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 2, code)
-}
-
-// TestRun_HelpFlag verifies -h exits 0 (flag.ContinueOnError + ErrHelp).
-func TestRun_HelpFlag(t *testing.T) {
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-h"}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 0, code)
-}
-
-// TestRun_GenerateSubcommand_DispatchedEarly verifies the generate subcommand
-// is dispatched before flag parsing (so its --context flag is not rejected).
-func TestRun_GenerateSubcommand_DispatchedEarly(t *testing.T) {
-	// Capture stderr at the os level because runGenerate writes to os.Stderr.
-	stop := captureStderr(t)
-	code := run(context.Background(), []string{"generate"}, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{})
-	stderrOut := stop()
-	assert.Equal(t, 1, code)
-	assert.Contains(t, stderrOut, "--context")
-}
-
-// TestRun_ConfigInSystemDirectory verifies a config inside /etc is rejected.
-func TestRun_ConfigInSystemDirectory(t *testing.T) {
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-c", "/etc/kportal.yaml"}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 1, code)
-	assert.Contains(t, stderr.String(), "system directory")
-}
-
-// TestRun_CheckValidConfig verifies -check on a valid empty config exits 0.
-func TestRun_CheckValidConfig(t *testing.T) {
-	cfgPath := writeYAML(t, "v.yaml", "contexts: []\n")
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-check", "-c", cfgPath}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 0, code)
-	assert.Contains(t, stdout.String(), "Configuration is valid")
-}
-
-// TestRun_CheckMissingConfig_DeclinePrompt verifies that a missing config with
-// declined prompt (EOF stdin) exits 0 — original behaviour.
-func TestRun_CheckMissingConfig_DeclinePrompt(t *testing.T) {
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "missing.yaml")
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-check", "-c", cfgPath}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 0, code)
-	// Prompt was emitted to stdout.
-	assert.Contains(t, stdout.String(), "Configuration file not found")
-}
-
-// TestRun_CheckMissingConfig_AcceptCreates verifies that accepting the prompt
-// creates an empty config and validates it.
-func TestRun_CheckMissingConfig_AcceptCreates(t *testing.T) {
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "new.yaml")
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-check", "-c", cfgPath}, strings.NewReader("y\n"), &stdout, &stderr)
-	assert.Equal(t, 0, code)
-	assert.FileExists(t, cfgPath)
-	assert.Contains(t, stdout.String(), "Configuration is valid")
-}
-
-// TestRun_CheckMalformedYAML verifies an unparseable config exits 1.
-func TestRun_CheckMalformedYAML(t *testing.T) {
-	cfgPath := writeYAML(t, "bad.yaml", ":\t {{{ invalid\n")
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-check", "-c", cfgPath}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 1, code)
-	assert.NotEmpty(t, stderr.String())
-}
-
-// TestRun_CheckInvalidConfigContent verifies validation errors exit 1.
-func TestRun_CheckInvalidConfigContent(t *testing.T) {
-	// Forward without required fields — validator will reject.
-	bad := `contexts:
-  - name: test
-    namespaces:
-      - name: default
-        forwards:
-          - localPort: 8080
-            port: 0
-            resource: ""
-`
-	cfgPath := writeYAML(t, "bad.yaml", bad)
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-check", "-c", cfgPath}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 1, code)
-	// Validator output is on stderr.
-	assert.NotEmpty(t, stderr.String())
-}
-
-// TestRun_ConvertFlag_HappyPath verifies -convert produces a YAML file from a
-// minimal kftray JSON input.
-func TestRun_ConvertFlag_HappyPath(t *testing.T) {
-	dir := t.TempDir()
-	in := filepath.Join(dir, "kftray.json")
-	out := filepath.Join(dir, "out.yaml")
-
-	// Minimal kftray JSON input (exact field names from internal/converter/kftray.go).
-	kftrayJSON := `[
-  {
-    "alias": "myservice",
-    "context": "test-ctx",
-    "kubeconfig": "default",
-    "local_address": "127.0.0.1",
-    "local_port": 8080,
-    "remote_port": 80,
-    "namespace": "default",
-    "protocol": "tcp",
-    "service": "myservice",
-    "workload_type": "service"
-  }
-]`
-	require.NoError(t, os.WriteFile(in, []byte(kftrayJSON), 0o600))
-
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-convert", in, "-convert-output", out}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 0, code, "stderr: %s", stderr.String())
-	assert.FileExists(t, out)
-	assert.Contains(t, stdout.String(), "Successfully converted")
-}
-
-// TestRun_ConvertFlag_MissingInput verifies an unreadable input exits 1.
-func TestRun_ConvertFlag_MissingInput(t *testing.T) {
-	dir := t.TempDir()
-	out := filepath.Join(dir, "out.yaml")
-
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-convert", "/nonexistent/input.json", "-convert-output", out}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 1, code)
-	assert.Contains(t, stderr.String(), "Error converting")
-}
-
-// TestRun_HeadlessShortLived verifies headless mode exits cleanly when ctx is
-// cancelled. Should complete in well under 5s (the shutdown timeout).
-func TestRun_HeadlessShortLived(t *testing.T) {
-	cfgPath := writeYAML(t, "v.yaml", "contexts: []\n")
-
-	ctx, cancel := context.WithCancel(context.Background())
-	// Cancel almost immediately — manager.Start has nothing to do for empty config.
-	go func() {
-		time.Sleep(50 * time.Millisecond)
-		cancel()
-	}()
-
-	var stdout, stderr bytes.Buffer
-	done := make(chan int, 1)
-	go func() {
-		done <- run(ctx, []string{"-headless", "-c", cfgPath}, strings.NewReader(""), &stdout, &stderr)
-	}()
-
-	select {
-	case code := <-done:
-		assert.Equal(t, 0, code)
-	case <-time.After(8 * time.Second):
-		cancel()
-		t.Fatal("headless mode did not exit within 8 seconds of ctx cancellation")
-	}
-}
-
-// TestRun_HeadlessVerbose exercises the verbose-headless code path. Same
-// ctx-cancellation contract; logs go to stderr buffer.
-func TestRun_HeadlessVerbose(t *testing.T) {
-	cfgPath := writeYAML(t, "v.yaml", "contexts: []\n")
-
-	ctx, cancel := context.WithCancel(context.Background())
-	go func() {
-		time.Sleep(50 * time.Millisecond)
-		cancel()
-	}()
-
-	var stdout, stderr bytes.Buffer
-	done := make(chan int, 1)
-	go func() {
-		done <- run(ctx, []string{"-headless", "-v", "-c", cfgPath}, strings.NewReader(""), &stdout, &stderr)
-	}()
-
-	select {
-	case code := <-done:
-		assert.Equal(t, 0, code)
-	case <-time.After(8 * time.Second):
-		cancel()
-		t.Fatal("headless verbose did not exit within 8s")
-	}
-}
-
-// TestRun_VerboseTable exercises the verbose (non-headless) table-UI path. It
-// still requires a real terminal-like loop, but the manager runs without any
-// real forwards (empty config), so it shuts down cleanly when ctx cancels.
-func TestRun_VerboseTable(t *testing.T) {
-	cfgPath := writeYAML(t, "v.yaml", "contexts: []\n")
-
-	ctx, cancel := context.WithCancel(context.Background())
-	go func() {
-		time.Sleep(80 * time.Millisecond)
-		cancel()
-	}()
-
-	var stdout, stderr bytes.Buffer
-	done := make(chan int, 1)
-	go func() {
-		// Verbose without -headless picks the runVerboseTable path.
-		done <- run(ctx, []string{"-v", "-c", cfgPath}, strings.NewReader(""), &stdout, &stderr)
-	}()
-
-	select {
-	case code := <-done:
-		assert.Equal(t, 0, code)
-	case <-time.After(8 * time.Second):
-		cancel()
-		t.Fatal("verbose table did not exit within 8s of ctx cancellation")
-	}
-}
-
-// TestRun_HeadlessSIGHUPReload exercises the SIGHUP-driven reload branch in
-// runHeadless. Sends SIGHUP twice (once with a malformed reload to hit the
-// load-error path, once with valid content), then cancels ctx.
-func TestRun_HeadlessSIGHUPReload(t *testing.T) {
-	cfgPath := writeYAML(t, "v.yaml", "contexts: []\n")
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	var stdout, stderr bytes.Buffer
-	done := make(chan int, 1)
-	go func() {
-		done <- run(ctx, []string{"-headless", "-v", "-c", cfgPath}, strings.NewReader(""), &stdout, &stderr)
-	}()
-
-	// Wait for the headless loop to be running before sending SIGHUP.
-	time.Sleep(150 * time.Millisecond)
-
-	// Trigger reload — config is still valid → success path.
-	require.NoError(t, syscall.Kill(syscall.Getpid(), syscall.SIGHUP))
-	time.Sleep(80 * time.Millisecond)
-
-	// Now corrupt the config and SIGHUP again — exercise load-error branch.
-	require.NoError(t, os.WriteFile(cfgPath, []byte(":\t {{{ broken\n"), 0o600))
-	require.NoError(t, syscall.Kill(syscall.Getpid(), syscall.SIGHUP))
-	time.Sleep(80 * time.Millisecond)
-
-	cancel()
-
-	select {
-	case code := <-done:
-		assert.Equal(t, 0, code)
-	case <-time.After(8 * time.Second):
-		t.Fatal("headless SIGHUP test did not exit within 8s")
-	}
-}
-
-// TestRun_VerboseTable_SIGHUPReload exercises the SIGHUP reload branch in the
-// verbose-table loop.
-func TestRun_VerboseTable_SIGHUPReload(t *testing.T) {
-	cfgPath := writeYAML(t, "v.yaml", "contexts: []\n")
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	var stdout, stderr bytes.Buffer
-	done := make(chan int, 1)
-	go func() {
-		done <- run(ctx, []string{"-v", "-c", cfgPath}, strings.NewReader(""), &stdout, &stderr)
-	}()
-
-	time.Sleep(150 * time.Millisecond)
-
-	// Send SIGHUP — valid config still in place, exercises reload-success branch.
-	require.NoError(t, syscall.Kill(syscall.Getpid(), syscall.SIGHUP))
-	time.Sleep(80 * time.Millisecond)
-
-	// Corrupt + SIGHUP — exercises load-error branch.
-	require.NoError(t, os.WriteFile(cfgPath, []byte(":\t {{{ broken"), 0o600))
-	require.NoError(t, syscall.Kill(syscall.Getpid(), syscall.SIGHUP))
-	time.Sleep(80 * time.Millisecond)
-
-	cancel()
-	select {
-	case code := <-done:
-		assert.Equal(t, 0, code)
-	case <-time.After(8 * time.Second):
-		t.Fatal("verbose-table SIGHUP test did not exit within 8s")
-	}
-}
-
-// TestRun_UpdateFlag exercises the -update path. Best-effort: real network
-// call is allowed because CheckForUpdate fails silently.
-func TestRun_UpdateFlag(t *testing.T) {
-	withAppVersion(t, "0.0.0")
-	var stdout, stderr bytes.Buffer
-	code := run(context.Background(), []string{"-update"}, strings.NewReader(""), &stdout, &stderr)
-	assert.Equal(t, 0, code)
-	assert.Contains(t, stdout.String(), "Checking for updates")
-}
-
-// TestRun_HeadlessJSONLogFormat covers the json branch of initLoggers.
-func TestRun_HeadlessJSONLogFormat(t *testing.T) {
-	cfgPath := writeYAML(t, "v.yaml", "contexts: []\n")
-
-	ctx, cancel := context.WithCancel(context.Background())
-	go func() {
-		time.Sleep(50 * time.Millisecond)
-		cancel()
-	}()
-
-	var stdout, stderr bytes.Buffer
-	done := make(chan int, 1)
-	go func() {
-		done <- run(ctx, []string{"-headless", "-log-format", "json", "-c", cfgPath}, strings.NewReader(""), &stdout, &stderr)
-	}()
-
-	select {
-	case code := <-done:
-		assert.Equal(t, 0, code)
-	case <-time.After(8 * time.Second):
-		cancel()
-		t.Fatal("headless json did not exit within 8s")
-	}
-}
-
-// ---- runShowVersion ----
-
-func TestRunShowVersion(t *testing.T) {
-	withAppVersion(t, "1.2.3")
-	var stdout bytes.Buffer
-	code := runShowVersion(&stdout)
-	assert.Equal(t, 0, code)
-	assert.Equal(t, "kportal version 1.2.3\n", stdout.String())
-}
-
-// ---- runCheckUpdate (via httptest + custom checker plumbing) ----
-
-// TestRunCheckUpdate_LatestRelease verifies the function happy-path output.
-// We can't easily inject the checker into runCheckUpdate, so this test makes
-// a real network call (or fails silently on no-network) — both are acceptable
-// because CheckForUpdate is documented to fail silently.
-func TestRunCheckUpdate_PrintsHeader(t *testing.T) {
-	withAppVersion(t, "0.0.0")
-	var stdout, stderr bytes.Buffer
-	code := runCheckUpdate(&stdout, &stderr)
-	assert.Equal(t, 0, code)
-	assert.Contains(t, stdout.String(), "kportal version 0.0.0")
-	assert.Contains(t, stdout.String(), "Checking for updates")
-}
-
-// TestVersion_Checker_RoundTrip exercises the same NewChecker call site that
-// runCheckUpdate uses. Mirrors the rewriteTransport pattern from internal/version.
-func TestVersion_Checker_RoundTripWithMockServer(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		_ = json.NewEncoder(w).Encode(map[string]string{
-			"tag_name": "v99.99.99",
-			"html_url": "https://example.com/release",
-			"name":     "Mocked",
-		})
-	}))
-	defer srv.Close()
-
-	// Build a checker that points at the test server using the same approach
-	// as internal/version/checker_http_test.go.
-	c := version.NewChecker(githubOwner, githubRepo, "0.0.1")
-	require.NotNil(t, c)
-}
-
-// ---- runConvert ----
-
-func TestRunConvert_HappyPath(t *testing.T) {
-	dir := t.TempDir()
-	in := filepath.Join(dir, "k.json")
-	out := filepath.Join(dir, "k.yaml")
-
-	require.NoError(t, os.WriteFile(in, []byte(`[
-  {
-    "alias": "svc",
-    "context": "ctx",
-    "kubeconfig": "default",
-    "local_address": "127.0.0.1",
-    "local_port": 8080,
-    "remote_port": 80,
-    "namespace": "default",
-    "protocol": "tcp",
-    "service": "svc",
-    "workload_type": "service"
-  }
-]`), 0o600))
-
-	var stdout, stderr bytes.Buffer
-	code := runConvert(in, out, &stdout, &stderr)
-	assert.Equal(t, 0, code)
-	assert.Contains(t, stdout.String(), "Successfully converted")
-	assert.FileExists(t, out)
-}
-
-func TestRunConvert_MissingInput(t *testing.T) {
-	dir := t.TempDir()
-	out := filepath.Join(dir, "k.yaml")
-	var stdout, stderr bytes.Buffer
-	code := runConvert("/no/such/file.json", out, &stdout, &stderr)
-	assert.Equal(t, 1, code)
-	assert.Contains(t, stderr.String(), "Error converting")
-}
-
-// ---- makeHTTPLogSubscriber ----
-
-// TestMakeHTTPLogSubscriber_WorkerNotFound verifies the no-op cleanup path is
-// returned when the worker doesn't exist (most common path in tests, since we
-// never start any forwards).
-func TestMakeHTTPLogSubscriber_WorkerNotFound(t *testing.T) {
-	mgr, err := forward.NewManager(false)
-	require.NoError(t, err)
-
-	sub := makeHTTPLogSubscriber(mgr)
-	require.NotNil(t, sub)
-
-	cleanup := sub("nonexistent-id", func(_ ui.HTTPLogEntry) {})
-	// cleanup must be a non-nil no-op function; calling it must not panic.
-	require.NotNil(t, cleanup)
-	cleanup()
-}
-
-// ---- buildRuntimeDeps ----
-
-func TestBuildRuntimeDeps_Success(t *testing.T) {
-	cfgPath := writeYAML(t, "v.yaml", "contexts: []\n")
-	cfg, isNew, code, handled := loadOrCreateConfig(cfgPath, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{})
-	require.False(t, handled)
-	require.Equal(t, 0, code)
-	require.False(t, isNew)
-	require.NotNil(t, cfg)
-
-	opts := runOptions{configFile: cfgPath, verbose: false}
-	var stderr bytes.Buffer
-	deps, err := buildRuntimeDeps(opts, cfg, &stderr)
-	require.NoError(t, err)
-	require.NotNil(t, deps)
-	require.NotNil(t, deps.manager)
-	require.NotNil(t, deps.discovery)
-	require.NotNil(t, deps.mutator)
-}
-
-func TestBuildRuntimeDeps_VerboseMDNS(t *testing.T) {
-	// mDNS-enabled config exercises the verbose log line in buildRuntimeDeps.
-	cfgPath := writeYAML(t, "m.yaml", "mdns:\n  enabled: true\ncontexts: []\n")
-	cfg, _, _, _ := loadOrCreateConfig(cfgPath, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{})
-	require.NotNil(t, cfg)
-
-	opts := runOptions{configFile: cfgPath, verbose: true}
-	var stderr bytes.Buffer
-	deps, err := buildRuntimeDeps(opts, cfg, &stderr)
-	require.NoError(t, err)
-	require.NotNil(t, deps)
-}
-
-// ---- resolveConfigPath ----
-
-func TestResolveConfigPath_Empty(t *testing.T) {
-	var stderr bytes.Buffer
-	path, ok := resolveConfigPath("", &stderr)
-	assert.True(t, ok)
-	assert.Empty(t, path)
-}
-
-func TestResolveConfigPath_SystemDirs(t *testing.T) {
-	cases := []string{"/etc/foo.yaml", "/sys/x", "/proc/y", "/dev/z"}
-	for _, p := range cases {
-		t.Run(p, func(t *testing.T) {
-			var stderr bytes.Buffer
-			path, ok := resolveConfigPath(p, &stderr)
-			assert.False(t, ok)
-			assert.Empty(t, path)
-			assert.Contains(t, stderr.String(), "system directory")
-		})
-	}
-}
-
-func TestResolveConfigPath_RelativeBecomesAbsolute(t *testing.T) {
-	var stderr bytes.Buffer
-	path, ok := resolveConfigPath("relative.yaml", &stderr)
-	assert.True(t, ok)
-	assert.True(t, filepath.IsAbs(path))
-}
-
-// ---- parseFlags ----
-
-func TestParseFlags_Defaults(t *testing.T) {
-	var stderr bytes.Buffer
-	opts, code, handled := parseFlags(nil, &stderr)
-	assert.False(t, handled)
-	assert.Equal(t, 0, code)
-	assert.Equal(t, defaultConfigFile, opts.configFile)
-	assert.False(t, opts.verbose)
-	assert.False(t, opts.headless)
-	assert.Equal(t, "text", opts.logFormat)
-}
-
-func TestParseFlags_AllSet(t *testing.T) {
-	var stderr bytes.Buffer
-	args := []string{"-c", "/tmp/x.yaml", "-v", "-headless", "-log-format", "json", "-check", "-version", "-update", "-convert", "in.json", "-convert-output", "out.yaml"}
-	opts, code, handled := parseFlags(args, &stderr)
-	assert.False(t, handled)
-	assert.Equal(t, 0, code)
-	assert.Equal(t, "/tmp/x.yaml", opts.configFile)
-	assert.True(t, opts.verbose)
-	assert.True(t, opts.headless)
-	assert.Equal(t, "json", opts.logFormat)
-	assert.True(t, opts.check)
-	assert.True(t, opts.showVersion)
-	assert.True(t, opts.checkUpdate)
-	assert.Equal(t, "in.json", opts.convertInput)
-	assert.Equal(t, "out.yaml", opts.convertOutput)
-}
-
-func TestParseFlags_HelpReturnsExit0(t *testing.T) {
-	var stderr bytes.Buffer
-	_, code, handled := parseFlags([]string{"-h"}, &stderr)
-	assert.True(t, handled)
-	assert.Equal(t, 0, code)
-}
-
-func TestParseFlags_UnknownFlagReturnsExit2(t *testing.T) {
-	var stderr bytes.Buffer
-	_, code, handled := parseFlags([]string{"-unknown"}, &stderr)
-	assert.True(t, handled)
-	assert.Equal(t, 2, code)
-}
-
-// ---- initLoggers / configureStdlibLog ----
-
-func TestInitLoggers_AllModes(t *testing.T) {
-	cases := []runOptions{
-		{verbose: false, headless: false, logFormat: "text"},
-		{verbose: true, headless: false, logFormat: "json"},
-		{verbose: false, headless: true, logFormat: "text"},
-		{verbose: true, headless: true, logFormat: "json"},
-		{verbose: false, headless: false, logFormat: "weirdFormat"}, // hits default branch
-	}
-	for _, opts := range cases {
-		t.Run("", func(t *testing.T) {
-			// Should not panic; we don't assert on logger state because it's a
-			// global singleton.
-			var stderr bytes.Buffer
-			initLoggers(opts, &stderr)
-		})
-	}
-}
-
-func TestConfigureStdlibLog_AllModes(t *testing.T) {
-	cases := []runOptions{
-		{verbose: true},
-		{headless: true},
-		{}, // default
-	}
-	for _, opts := range cases {
-		t.Run("", func(t *testing.T) {
-			configureStdlibLog(opts) // mutates stdlib log; just ensure no panic
-		})
-	}
-}
-
-// ---- loadOrCreateConfig ----
-
-func TestLoadOrCreateConfig_ExistingValid(t *testing.T) {
-	cfgPath := writeYAML(t, "v.yaml", "contexts: []\n")
-	cfg, isNew, code, handled := loadOrCreateConfig(cfgPath, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{})
-	assert.False(t, handled)
-	assert.Equal(t, 0, code)
-	assert.False(t, isNew)
-	require.NotNil(t, cfg)
-}
-
-func TestLoadOrCreateConfig_MalformedReturnsError(t *testing.T) {
-	cfgPath := writeYAML(t, "bad.yaml", ":\t {{{ invalid\n")
-	var stderr bytes.Buffer
-	_, _, code, handled := loadOrCreateConfig(cfgPath, strings.NewReader(""), &bytes.Buffer{}, &stderr)
-	assert.True(t, handled)
-	assert.Equal(t, 1, code)
-	assert.Contains(t, stderr.String(), "Error loading config")
-}
-
-func TestLoadOrCreateConfig_NotFound_DeclinePrompt(t *testing.T) {
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "nope.yaml")
-	cfg, isNew, code, handled := loadOrCreateConfig(cfgPath, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{})
-	assert.True(t, handled)
-	assert.Equal(t, 0, code)
-	assert.False(t, isNew)
-	assert.Nil(t, cfg)
-}
-
-func TestLoadOrCreateConfig_NotFound_AcceptCreates(t *testing.T) {
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "create.yaml")
-	cfg, isNew, code, handled := loadOrCreateConfig(cfgPath, strings.NewReader("y\n"), &bytes.Buffer{}, &bytes.Buffer{})
-	assert.False(t, handled)
-	assert.Equal(t, 0, code)
-	assert.True(t, isNew)
-	require.NotNil(t, cfg)
-	assert.FileExists(t, cfgPath)
-}

docs/CNAME

@@ -1 +0,0 @@
-kportal.raczylo.com

docs/kportal-logo-dark.svg

@@ -1,132 +0,0 @@
-<svg width="310" height="150" viewBox="0 0 310 150" xmlns="http://www.w3.org/2000/svg" id="darkLogo">
-                <defs>
-                    <!-- Simple turbulence for portal edges -->
-                    <filter id="portalTurbulence" x="-50%" y="-50%" width="200%" height="200%">
-                        <feTurbulence type="fractalNoise" baseFrequency="0.02 0.03" numOctaves="2" result="turbulence" seed="5">
-                            <animate attributeName="seed" values="5;10;5" dur="8s" repeatCount="indefinite"/>
-                        </feTurbulence>
-                        <feDisplacementMap in2="turbulence" in="SourceGraphic" scale="2" xChannelSelector="R" yChannelSelector="G"/>
-                    </filter>
-
-                    <!-- Blue glow -->
-                    <filter id="blueGlow" x="-50%" y="-50%" width="200%" height="200%">
-                        <feGaussianBlur stdDeviation="5" result="coloredBlur"/>
-                        <feMerge>
-                            <feMergeNode in="coloredBlur"/>
-                            <feMergeNode in="SourceGraphic"/>
-                        </feMerge>
-                    </filter>
-
-                    <!-- Orange glow -->
-                    <filter id="orangeGlow" x="-50%" y="-50%" width="200%" height="200%">
-                        <feGaussianBlur stdDeviation="5" result="coloredBlur"/>
-                        <feMerge>
-                            <feMergeNode in="coloredBlur"/>
-                            <feMergeNode in="SourceGraphic"/>
-                        </feMerge>
-                    </filter>
-
-                    <!-- Text glow -->
-                    <filter id="textGlow" x="-20%" y="-20%" width="140%" height="140%">
-                        <feGaussianBlur stdDeviation="1" result="coloredBlur"/>
-                        <feMerge>
-                            <feMergeNode in="coloredBlur"/>
-                            <feMergeNode in="SourceGraphic"/>
-                        </feMerge>
-                    </filter>
-
-                    <!-- Gradients -->
-                    <radialGradient id="bluePortal" cx="50%" cy="50%">
-                        <stop offset="0%" style="stop-color:#000814;stop-opacity:0.9"/>
-                        <stop offset="20%" style="stop-color:#001845;stop-opacity:0.8"/>
-                        <stop offset="50%" style="stop-color:#0077B6;stop-opacity:0.95"/>
-                        <stop offset="80%" style="stop-color:#00B4D8;stop-opacity:1"/>
-                        <stop offset="100%" style="stop-color:#90E0EF;stop-opacity:1"/>
-                    </radialGradient>
-
-                    <radialGradient id="orangePortal" cx="50%" cy="50%">
-                        <stop offset="0%" style="stop-color:#1A0E00;stop-opacity:0.9"/>
-                        <stop offset="20%" style="stop-color:#3D2314;stop-opacity:0.8"/>
-                        <stop offset="50%" style="stop-color:#F77F00;stop-opacity:0.95"/>
-                        <stop offset="80%" style="stop-color:#FCBF49;stop-opacity:1"/>
-                        <stop offset="100%" style="stop-color:#FFD6A5;stop-opacity:1"/>
-                    </radialGradient>
-                </defs>
-
-                <!-- Blue Portal (LEFT) -->
-                <g id="bluePortalGroup">
-                    <!-- Outer rings -->
-                    <ellipse cx="50" cy="75" rx="35" ry="50" fill="none" stroke="#90E0EF" stroke-width="0.5" opacity="0.2"/>
-                    <ellipse cx="50" cy="75" rx="30" ry="44" fill="none" stroke="#00B4D8" stroke-width="1" opacity="0.3"/>
-
-                    <!-- Main portal -->
-                    <ellipse cx="50" cy="75" rx="26" ry="40" fill="url(#bluePortal)" filter="url(#blueGlow)" opacity="0.95"/>
-
-                    <!-- Inner energy rings -->
-                    <ellipse cx="50" cy="75" rx="20" ry="32" fill="none" stroke="#00B4D8" stroke-width="2" opacity="0.7">
-                        <animate attributeName="rx" values="20;18;20" dur="3s" repeatCount="indefinite"/>
-                        <animate attributeName="ry" values="32;30;32" dur="3s" repeatCount="indefinite"/>
-                    </ellipse>
-                    <ellipse cx="50" cy="75" rx="14" ry="24" fill="none" stroke="#90E0EF" stroke-width="1.5" opacity="0.5">
-                        <animate attributeName="rx" values="14;16;14" dur="2.5s" repeatCount="indefinite"/>
-                        <animate attributeName="ry" values="24;26;24" dur="2.5s" repeatCount="indefinite"/>
-                    </ellipse>
-
-                    <!-- Portal core -->
-                    <ellipse cx="50" cy="75" rx="7" ry="12" fill="#000814" opacity="0.95"/>
-                </g>
-
-                <!-- Text: "kportal" -->
-                <!-- Orange K -->
-                <text x="76" y="90" font-family="'Helvetica Neue', Arial, sans-serif" font-size="52" font-weight="300" fill="#FCBF49" filter="url(#textGlow)">
-                    k
-                    <animate attributeName="x" values="76;79;76" dur="4s" repeatCount="indefinite"/>
-                </text>
-
-                <!-- White "porta" -->
-                <text x="105" y="90" font-family="'Helvetica Neue', Arial, sans-serif" font-size="52" font-weight="300" fill="white" filter="url(#textGlow)">
-                    porta
-                </text>
-
-                <!-- Blue L -->
-                <text x="220" y="90" font-family="'Helvetica Neue', Arial, sans-serif" font-size="52" font-weight="300" fill="#00B4D8" filter="url(#textGlow)">
-                    l
-                    <animate attributeName="x" values="220;223;220" dur="4s" repeatCount="indefinite"/>
-                </text>
-
-                <!-- Orange Portal (RIGHT) at x=260 -->
-                <g id="orangePortalGroup">
-                    <!-- Outer rings -->
-                    <ellipse cx="260" cy="75" rx="35" ry="50" fill="none" stroke="#FFD6A5" stroke-width="0.5" opacity="0.2"/>
-                    <ellipse cx="260" cy="75" rx="30" ry="44" fill="none" stroke="#FCBF49" stroke-width="1" opacity="0.3"/>
-
-                    <!-- Main portal -->
-                    <ellipse cx="260" cy="75" rx="26" ry="40" fill="url(#orangePortal)" filter="url(#orangeGlow)" opacity="0.95"/>
-
-                    <!-- Inner energy rings -->
-                    <ellipse cx="260" cy="75" rx="20" ry="32" fill="none" stroke="#FCBF49" stroke-width="2" opacity="0.7">
-                        <animate attributeName="rx" values="20;18;20" dur="3s" repeatCount="indefinite"/>
-                        <animate attributeName="ry" values="32;30;32" dur="3s" repeatCount="indefinite"/>
-                    </ellipse>
-                    <ellipse cx="260" cy="75" rx="14" ry="24" fill="none" stroke="#FFD6A5" stroke-width="1.5" opacity="0.5">
-                        <animate attributeName="rx" values="14;16;14" dur="2.5s" repeatCount="indefinite"/>
-                        <animate attributeName="ry" values="24;26;24" dur="2.5s" repeatCount="indefinite"/>
-                    </ellipse>
-
-                    <!-- Portal core -->
-                    <ellipse cx="260" cy="75" rx="7" ry="12" fill="#1A0E00" opacity="0.95"/>
-                </g>
-
-                <!-- Energy connection between portals -->
-                <path d="M 76 75 Q 180 70 222 75" stroke="url(#energyGradient)" stroke-width="0.5" fill="none" opacity="0.3">
-                    <animate attributeName="opacity" values="0.1;0.3;0.1" dur="4s" repeatCount="indefinite"/>
-                </path>
-
-                <defs>
-                    <linearGradient id="energyGradient" x1="0%" y1="0%" x2="100%" y2="0%">
-                        <stop offset="0%" style="stop-color:#00B4D8;stop-opacity:1"/>
-                        <stop offset="50%" style="stop-color:#667eea;stop-opacity:1"/>
-                        <stop offset="100%" style="stop-color:#FCBF49;stop-opacity:1"/>
-                    </linearGradient>
-                </defs>
-            </svg>

docs/kportal-logo-light.svg

@@ -1,128 +0,0 @@
-<svg width="310" height="150" viewBox="0 0 310 150" xmlns="http://www.w3.org/2000/svg" id="lightLogo">
-                <defs>
-                    <!-- Simple turbulence for portal edges -->
-                    <filter id="portalTurbulenceLight" x="-50%" y="-50%" width="200%" height="200%">
-                        <feTurbulence type="fractalNoise" baseFrequency="0.02 0.03" numOctaves="2" result="turbulence" seed="5">
-                            <animate attributeName="seed" values="5;10;5" dur="8s" repeatCount="indefinite"/>
-                        </feTurbulence>
-                        <feDisplacementMap in2="turbulence" in="SourceGraphic" scale="2" xChannelSelector="R" yChannelSelector="G"/>
-                    </filter>
-
-                    <!-- Blue glow for light background -->
-                    <filter id="blueGlowLight" x="-50%" y="-50%" width="200%" height="200%">
-                        <feGaussianBlur stdDeviation="4" result="coloredBlur"/>
-                        <feMerge>
-                            <feMergeNode in="coloredBlur"/>
-                            <feMergeNode in="SourceGraphic"/>
-                        </feMerge>
-                    </filter>
-
-                    <!-- Orange glow for light background -->
-                    <filter id="orangeGlowLight" x="-50%" y="-50%" width="200%" height="200%">
-                        <feGaussianBlur stdDeviation="4" result="coloredBlur"/>
-                        <feMerge>
-                            <feMergeNode in="coloredBlur"/>
-                            <feMergeNode in="SourceGraphic"/>
-                        </feMerge>
-                    </filter>
-
-                    <!-- Text shadow for light background -->
-                    <filter id="textShadowLight" x="-20%" y="-20%" width="140%" height="140%">
-                        <feDropShadow dx="0" dy="1" stdDeviation="0.5" flood-opacity="0.15"/>
-                    </filter>
-
-                    <!-- Enhanced gradients for light background -->
-                    <radialGradient id="bluePortalLight" cx="50%" cy="50%">
-                        <stop offset="0%" style="stop-color:#001529;stop-opacity:1"/>
-                        <stop offset="20%" style="stop-color:#002766;stop-opacity:0.95"/>
-                        <stop offset="50%" style="stop-color:#0066CC;stop-opacity:0.98"/>
-                        <stop offset="80%" style="stop-color:#0099FF;stop-opacity:1"/>
-                        <stop offset="100%" style="stop-color:#66CCFF;stop-opacity:1"/>
-                    </radialGradient>
-
-                    <radialGradient id="orangePortalLight" cx="50%" cy="50%">
-                        <stop offset="0%" style="stop-color:#2E1A00;stop-opacity:1"/>
-                        <stop offset="20%" style="stop-color:#5C3317;stop-opacity:0.95"/>
-                        <stop offset="50%" style="stop-color:#E66100;stop-opacity:0.98"/>
-                        <stop offset="80%" style="stop-color:#FF9933;stop-opacity:1"/>
-                        <stop offset="100%" style="stop-color:#FFBB66;stop-opacity:1"/>
-                    </radialGradient>
-                </defs>
-
-                <!-- Blue Portal (LEFT) -->
-                <g id="bluePortalGroupLight">
-                    <!-- Outer rings -->
-                    <ellipse cx="50" cy="75" rx="35" ry="50" fill="none" stroke="#0099FF" stroke-width="0.8" opacity="0.3"/>
-                    <ellipse cx="50" cy="75" rx="30" ry="44" fill="none" stroke="#0066CC" stroke-width="1.2" opacity="0.4"/>
-
-                    <!-- Main portal -->
-                    <ellipse cx="50" cy="75" rx="26" ry="40" fill="url(#bluePortalLight)" filter="url(#blueGlowLight)" opacity="1"/>
-
-                    <!-- Inner energy rings -->
-                    <ellipse cx="50" cy="75" rx="20" ry="32" fill="none" stroke="#0099FF" stroke-width="2" opacity="0.8">
-                        <animate attributeName="rx" values="20;18;20" dur="3s" repeatCount="indefinite"/>
-                        <animate attributeName="ry" values="32;30;32" dur="3s" repeatCount="indefinite"/>
-                    </ellipse>
-                    <ellipse cx="50" cy="75" rx="14" ry="24" fill="none" stroke="#66CCFF" stroke-width="1.5" opacity="0.6">
-                        <animate attributeName="rx" values="14;16;14" dur="2.5s" repeatCount="indefinite"/>
-                        <animate attributeName="ry" values="24;26;24" dur="2.5s" repeatCount="indefinite"/>
-                    </ellipse>
-
-                    <!-- Portal core -->
-                    <ellipse cx="50" cy="75" rx="7" ry="12" fill="#001529" opacity="1"/>
-                </g>
-
-                <!-- Text: "kportal" with dark colors for light background -->
-                <!-- Orange K -->
-                <text x="76" y="90" font-family="'Helvetica Neue', Arial, sans-serif" font-size="52" font-weight="400" fill="#E66100" filter="url(#textShadowLight)">
-                    k
-                    <animate attributeName="x" values="76;79;76" dur="4s" repeatCount="indefinite"/>
-                </text>
-
-                <!-- Dark "porta" for light background -->
-                <text x="105" y="90" font-family="'Helvetica Neue', Arial, sans-serif" font-size="52" font-weight="400" fill="#2C3E50" filter="url(#textShadowLight)">
-                    porta
-                </text>
-
-                <!-- Blue L -->
-                <text x="220" y="90" font-family="'Helvetica Neue', Arial, sans-serif" font-size="52" font-weight="400" fill="#0066CC" filter="url(#textShadowLight)">
-                    l
-                    <animate attributeName="x" values="220;223;220" dur="4s" repeatCount="indefinite"/>
-                </text>
-
-                <!-- Orange Portal (RIGHT) at x=260 -->
-                <g id="orangePortalGroupLight">
-                    <!-- Outer rings -->
-                    <ellipse cx="260" cy="75" rx="35" ry="50" fill="none" stroke="#FFBB66" stroke-width="0.8" opacity="0.3"/>
-                    <ellipse cx="260" cy="75" rx="30" ry="44" fill="none" stroke="#FF9933" stroke-width="1.2" opacity="0.4"/>
-
-                    <!-- Main portal -->
-                    <ellipse cx="260" cy="75" rx="26" ry="40" fill="url(#orangePortalLight)" filter="url(#orangeGlowLight)" opacity="1"/>
-
-                    <!-- Inner energy rings -->
-                    <ellipse cx="260" cy="75" rx="20" ry="32" fill="none" stroke="#FF9933" stroke-width="2" opacity="0.8">
-                        <animate attributeName="rx" values="20;18;20" dur="3s" repeatCount="indefinite"/>
-                        <animate attributeName="ry" values="32;30;32" dur="3s" repeatCount="indefinite"/>
-                    </ellipse>
-                    <ellipse cx="260" cy="75" rx="14" ry="24" fill="none" stroke="#FFBB66" stroke-width="1.5" opacity="0.6">
-                        <animate attributeName="rx" values="14;16;14" dur="2.5s" repeatCount="indefinite"/>
-                        <animate attributeName="ry" values="24;26;24" dur="2.5s" repeatCount="indefinite"/>
-                    </ellipse>
-
-                    <!-- Portal core -->
-                    <ellipse cx="260" cy="75" rx="7" ry="12" fill="#2E1A00" opacity="1"/>
-                </g>
-
-                <!-- Energy connection between portals -->
-                <path d="M 76 75 Q 180 70 222 75" stroke="url(#energyGradientLight)" stroke-width="0.7" fill="none" opacity="0.4">
-                    <animate attributeName="opacity" values="0.2;0.4;0.2" dur="4s" repeatCount="indefinite"/>
-                </path>
-
-                <defs>
-                    <linearGradient id="energyGradientLight" x1="0%" y1="0%" x2="100%" y2="0%">
-                        <stop offset="0%" style="stop-color:#0066CC;stop-opacity:1"/>
-                        <stop offset="50%" style="stop-color:#8B7CC6;stop-opacity:1"/>
-                        <stop offset="100%" style="stop-color:#E66100;stop-opacity:1"/>
-                    </linearGradient>
-                </defs>
-            </svg>

go.mod

@@ -1,90 +1,84 @@
-module github.com/lukaszraczylo/kportal
+module github.com/nvm/kportal
 
-go 1.26.0
+go 1.24.2
 
 require (
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/fsnotify/fsnotify v1.10.1
-	github.com/go-logr/logr v1.4.3
-	github.com/grandcat/zeroconf v1.0.0
-	github.com/lukaszraczylo/oss-telemetry v0.2.3
+	github.com/fsnotify/fsnotify v1.9.0
 	github.com/stretchr/testify v1.11.1
+	golang.org/x/term v0.37.0
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.36.2
-	k8s.io/apimachinery v0.36.2
-	k8s.io/client-go v0.36.2
-	k8s.io/klog/v2 v2.140.0
+	k8s.io/api v0.34.2
+	k8s.io/apimachinery v0.34.2
+	k8s.io/client-go v0.34.2
+	k8s.io/klog/v2 v2.130.1
 )
 
 require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
-	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
-	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/x/ansi v0.11.7 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
+	github.com/charmbracelet/colorprofile v0.3.3 // indirect
+	github.com/charmbracelet/x/ansi v0.11.1 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.14 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
-	github.com/clipperhouse/displaywidth v0.11.0 // indirect
-	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/clipperhouse/displaywidth v0.6.0 // indirect
+	github.com/clipperhouse/stringish v0.1.1 // indirect
+	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
-	github.com/go-openapi/jsonpointer v0.23.1 // indirect
-	github.com/go-openapi/jsonreference v0.21.6 // indirect
-	github.com/go-openapi/swag v0.26.1 // indirect
-	github.com/go-openapi/swag/cmdutils v0.26.1 // indirect
-	github.com/go-openapi/swag/conv v0.26.1 // indirect
-	github.com/go-openapi/swag/fileutils v0.26.1 // indirect
-	github.com/go-openapi/swag/jsonname v0.26.1 // indirect
-	github.com/go-openapi/swag/jsonutils v0.26.1 // indirect
-	github.com/go-openapi/swag/loading v0.26.1 // indirect
-	github.com/go-openapi/swag/mangling v0.26.1 // indirect
-	github.com/go-openapi/swag/netutils v0.26.1 // indirect
-	github.com/go-openapi/swag/stringutils v0.26.1 // indirect
-	github.com/go-openapi/swag/typeutils v0.26.1 // indirect
-	github.com/go-openapi/swag/yamlutils v0.26.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v0.22.3 // indirect
+	github.com/go-openapi/jsonreference v0.21.3 // indirect
+	github.com/go-openapi/swag v0.25.3 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.3 // indirect
+	github.com/go-openapi/swag/conv v0.25.3 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.3 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.3 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.3 // indirect
+	github.com/go-openapi/swag/loading v0.25.3 // indirect
+	github.com/go-openapi/swag/mangling v0.25.3 // indirect
+	github.com/go-openapi/swag/netutils v0.25.3 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.3 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.3 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.3 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kr/text v0.2.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
-	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.24 // indirect
-	github.com/miekg/dns v1.1.72 // indirect
-	github.com/moby/spdystream v0.5.1 // indirect
+	github.com/mattn/go-runewidth v0.0.19 // indirect
+	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/term v0.44.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
-	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/oauth2 v0.33.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20260624041617-8f3fa4921821 // indirect
-	k8s.io/streaming v0.36.2 // indirect
-	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
+	k8s.io/kube-openapi v0.0.0-20251121143641-b6aabc6c6745 // indirect
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.1 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )

go.sum

@@ -2,109 +2,104 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
-github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
-github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
-github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
-github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
 github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
-github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
-github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
+github.com/charmbracelet/colorprofile v0.3.3 h1:DjJzJtLP6/NZ8p7Cgjno0CKGr7wwRJGxWUwh2IyhfAI=
+github.com/charmbracelet/colorprofile v0.3.3/go.mod h1:nB1FugsAbzq284eJcjfah2nhdSLppN2NqvfotkfRYP4=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI=
-github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ=
-github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
-github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
-github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a h1:G99klV19u0QnhiizODirwVksQB91TJKV/UaTnACcG30=
-github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
+github.com/charmbracelet/x/ansi v0.11.1 h1:iXAC8SyMQDJgtcz9Jnw+HU8WMEctHzoTAETIeA3JXMk=
+github.com/charmbracelet/x/ansi v0.11.1/go.mod h1:M49wjzpIujwPceJ+t5w3qh2i87+HRtHohgb5iTyepL0=
+github.com/charmbracelet/x/cellbuf v0.0.14 h1:iUEMryGyFTelKW3THW4+FfPgi4fkmKnnaLOXuc+/Kj4=
+github.com/charmbracelet/x/cellbuf v0.0.14/go.mod h1:P447lJl49ywBbil/KjCk2HexGh4tEY9LH0/1QrZZ9rA=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
 github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
-github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
-github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
-github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
-github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/clipperhouse/displaywidth v0.6.0 h1:k32vueaksef9WIKCNcoqRNyKbyvkvkysNYnAWz2fN4s=
+github.com/clipperhouse/displaywidth v0.6.0/go.mod h1:R+kHuzaYWFkTm7xoMmK1lFydbci4X2CicfbGstSGg0o=
+github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
+github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
+github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=
+github.com/clipperhouse/uax29/v2 v2.3.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
 github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
-github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
-github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
-github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
-github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=
-github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY=
-github.com/go-openapi/jsonreference v0.21.6 h1:NZ5nGfnaM1n4I43Xjm1e5/M2GjOwQwndQz22uhxwD+Y=
-github.com/go-openapi/jsonreference v0.21.6/go.mod h1:xzbgtQ3ZbWxvET3AxdzCJlJt6vkovbf+IfSPJjD0tUY=
-github.com/go-openapi/swag v0.26.1 h1:l5sVEyVpwj+DDYeZyo7wQI/Ebn/mKYIyGB/pFwAfGoQ=
-github.com/go-openapi/swag v0.26.1/go.mod h1:yNY38BbIVthxbkDtq1UHBCGasBqjakW3lCR6ANzdBEw=
-github.com/go-openapi/swag/cmdutils v0.26.1 h1:f2iE1ijYaJ3nuu5PaEMx3zpEhzhZFgivCJObWEObLIQ=
-github.com/go-openapi/swag/cmdutils v0.26.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
-github.com/go-openapi/swag/conv v0.26.1 h1:slr5FVkg9Wc3Y5zcwenD8Sd/PQ94b2I/QJI7N7KTBpg=
-github.com/go-openapi/swag/conv v0.26.1/go.mod h1:mvQXgPptZk9GTrFgGwWvT4q+dN+zQej9JfmGwnipz1A=
-github.com/go-openapi/swag/fileutils v0.26.1 h1:K1XCM2CGhfNsc6YDt6v7Q5+1e59rftYWdcu/isZhvFw=
-github.com/go-openapi/swag/fileutils v0.26.1/go.mod h1:mYUgxQAKX4ShS3qvvySx+/9yrlUnDhjiD1CalaQl8lQ=
-github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE=
-github.com/go-openapi/swag/jsonname v0.26.1/go.mod h1:OvdW6BoWoj33pTfi7x9vFrgmT+fk7aw0BRwvCE0YOuc=
-github.com/go-openapi/swag/jsonutils v0.26.1 h1:2hdBfFkHg+7Wrz2VsCbeyR6hzkRDs7AztnMR2u84yOY=
-github.com/go-openapi/swag/jsonutils v0.26.1/go.mod h1:U+RMJH3wa+6BRiphuRtIyI8fW9HPFqFQ4sHk2oRx0UQ=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.1 h1:1CD7NiLLb/TXl3tOnFYU4b+mNfb5rtgHkaA+q7RMYYQ=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.1/go.mod h1:ZWafc8nMdYzTE3uYY6W86f0n46+IF0g4uUyRhJw/kXc=
-github.com/go-openapi/swag/loading v0.26.1 h1:E9K4wqXeROlhjFQ13K9zMz6ojFGXIggGe+ad1odrK9w=
-github.com/go-openapi/swag/loading v0.26.1/go.mod h1:3qvRIlWzWdq1HvmldwmuJ2ohpcAryN6xVt2OTKd0/7E=
-github.com/go-openapi/swag/mangling v0.26.1 h1:gpYI4WuPKFJJVjV5cDLGlDVJhFIxYjQc7yN5eEb4CqM=
-github.com/go-openapi/swag/mangling v0.26.1/go.mod h1:POETDH01hqAdASXfw7ISEd9bCOE6xBHOt8NHmGZRmYM=
-github.com/go-openapi/swag/netutils v0.26.1 h1:BNctoc39WTAUMxyAs355fExOPzMZtPbZ0ZZ1Am2FR5M=
-github.com/go-openapi/swag/netutils v0.26.1/go.mod h1:y02vByhZhQPAVwOX+0KipXFZ/hUbk6G/Enhf5rGaOkQ=
-github.com/go-openapi/swag/stringutils v0.26.1 h1:f88uYyTso7TnHrKM/bUBsQ5e2wKf37cpgo6pvbzd9yU=
-github.com/go-openapi/swag/stringutils v0.26.1/go.mod h1:Sc6d3bU8fgk5AyZR8/8jEQ+Is/Ald+TD/IIggPN8UJk=
-github.com/go-openapi/swag/typeutils v0.26.1 h1:yg42FgMzRR6PVQ3M3qHz1s+Y6/P4HoJ3cBarXa3OVnU=
-github.com/go-openapi/swag/typeutils v0.26.1/go.mod h1:VfnV+oUtSP2vCSCn2aJgnr8OevUYemyIzzS1VOzS10o=
-github.com/go-openapi/swag/yamlutils v0.26.1 h1:0TSLK+lXs9vfIhAWzBeI/lOzEnIoot6WTCO1aAeWFTk=
-github.com/go-openapi/swag/yamlutils v0.26.1/go.mod h1:7W5b7PRX9MxwL7TjeG7H8HkyBGRsIDRObhyMWFgBI2M=
-github.com/go-openapi/testify/enable/yaml/v2 v2.5.1 h1:q9NtHwK4qHF7yZziBPvZyv7zWAIk8ok88Gh2mR6Jpc8=
-github.com/go-openapi/testify/enable/yaml/v2 v2.5.1/go.mod h1:JW0MXIotCYps/XsgJnG3a8Q7rE5xAiBwoOD5OfaIQBk=
-github.com/go-openapi/testify/v2 v2.5.1 h1:TMdhCaw8fUNraVSf3Omoob1dO/AzBfhtFAPW0an6sBo=
-github.com/go-openapi/testify/v2 v2.5.1/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/go-openapi/jsonpointer v0.22.3 h1:dKMwfV4fmt6Ah90zloTbUKWMD+0he+12XYAsPotrkn8=
+github.com/go-openapi/jsonpointer v0.22.3/go.mod h1:0lBbqeRsQ5lIanv3LHZBrmRGHLHcQoOXQnf88fHlGWo=
+github.com/go-openapi/jsonreference v0.21.3 h1:96Dn+MRPa0nYAR8DR1E03SblB5FJvh7W6krPI0Z7qMc=
+github.com/go-openapi/jsonreference v0.21.3/go.mod h1:RqkUP0MrLf37HqxZxrIAtTWW4ZJIK1VzduhXYBEeGc4=
+github.com/go-openapi/swag v0.25.3 h1:FAa5wJXyDtI7yUztKDfZxDrSx+8WTg31MfCQ9s3PV+s=
+github.com/go-openapi/swag v0.25.3/go.mod h1:tX9vI8Mj8Ny+uCEk39I1QADvIPI7lkndX4qCsEqhkS8=
+github.com/go-openapi/swag/cmdutils v0.25.3 h1:EIwGxN143JCThNHnqfqs85R8lJcJG06qjJRZp3VvjLI=
+github.com/go-openapi/swag/cmdutils v0.25.3/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
+github.com/go-openapi/swag/conv v0.25.3 h1:PcB18wwfba7MN5BVlBIV+VxvUUeC2kEuCEyJ2/t2X7E=
+github.com/go-openapi/swag/conv v0.25.3/go.mod h1:n4Ibfwhn8NJnPXNRhBO5Cqb9ez7alBR40JS4rbASUPU=
+github.com/go-openapi/swag/fileutils v0.25.3 h1:P52Uhd7GShkeU/a1cBOuqIcHMHBrA54Z2t5fLlE85SQ=
+github.com/go-openapi/swag/fileutils v0.25.3/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
+github.com/go-openapi/swag/jsonname v0.25.3 h1:U20VKDS74HiPaLV7UZkztpyVOw3JNVsit+w+gTXRj0A=
+github.com/go-openapi/swag/jsonname v0.25.3/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
+github.com/go-openapi/swag/jsonutils v0.25.3 h1:kV7wer79KXUM4Ea4tBdAVTU842Rg6tWstX3QbM4fGdw=
+github.com/go-openapi/swag/jsonutils v0.25.3/go.mod h1:ILcKqe4HC1VEZmJx51cVuZQ6MF8QvdfXsQfiaCs0z9o=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.3 h1:/i3E9hBujtXfHy91rjtwJ7Fgv5TuDHgnSrYjhFxwxOw=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.3/go.mod h1:8kYfCR2rHyOj25HVvxL5Nm8wkfzggddgjZm6RgjT8Ao=
+github.com/go-openapi/swag/loading v0.25.3 h1:Nn65Zlzf4854MY6Ft0JdNrtnHh2bdcS/tXckpSnOb2Y=
+github.com/go-openapi/swag/loading v0.25.3/go.mod h1:xajJ5P4Ang+cwM5gKFrHBgkEDWfLcsAKepIuzTmOb/c=
+github.com/go-openapi/swag/mangling v0.25.3 h1:rGIrEzXaYWuUW1MkFmG3pcH+EIA0/CoUkQnIyB6TUyo=
+github.com/go-openapi/swag/mangling v0.25.3/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
+github.com/go-openapi/swag/netutils v0.25.3 h1:XWXHZfL/65ABiv8rvGp9dtE0C6QHTYkCrNV77jTl358=
+github.com/go-openapi/swag/netutils v0.25.3/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
+github.com/go-openapi/swag/stringutils v0.25.3 h1:nAmWq1fUTWl/XiaEPwALjp/8BPZJun70iDHRNq/sH6w=
+github.com/go-openapi/swag/stringutils v0.25.3/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
+github.com/go-openapi/swag/typeutils v0.25.3 h1:2w4mEEo7DQt3V4veWMZw0yTPQibiL3ri2fdDV4t2TQc=
+github.com/go-openapi/swag/typeutils v0.25.3/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
+github.com/go-openapi/swag/yamlutils v0.25.3 h1:LKTJjCn/W1ZfMec0XDL4Vxh8kyAnv1orH5F2OREDUrg=
+github.com/go-openapi/swag/yamlutils v0.25.3/go.mod h1:Y7QN6Wc5DOBXK14/xeo1cQlq0EA0wvLoSv13gDQoCao=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
+github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
+github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
 github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
-github.com/grandcat/zeroconf v1.0.0 h1:uHhahLBKqwWBV6WZUDAT71044vwOTL+McW0mBJvo6kE=
-github.com/grandcat/zeroconf v1.0.0/go.mod h1:lTKmG1zh86XyCoUeIHSA4FJMBwCJiQmGfcP2PdzytEs=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
-github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/lukaszraczylo/oss-telemetry v0.2.3 h1:xoDtBqeZGmXj7IteiE1M5WMuzeoqag58qEleI0Cf2Ms=
-github.com/lukaszraczylo/oss-telemetry v0.2.3/go.mod h1:+Cn78qZo8rc3T9eZt0v3oICYRdd75wORtSidc8lNjDQ=
-github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
-github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
+github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
-github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
-github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/miekg/dns v1.1.27/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
-github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
-github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
-github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y=
-github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
+github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
+github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -119,11 +114,14 @@ github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
+github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
+github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
@@ -140,47 +138,57 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
-go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
-go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo=
+golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-golang.org/x/tools v0.0.0-20191216052735-49a3e744a425/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
-google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -190,25 +198,23 @@ gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.36.2 h1:TF6YDLIzKfccK7cq9YpTcGX8TJmEkHVRv78DM51fRYY=
-k8s.io/api v0.36.2/go.mod h1:F4LbMO4brjZYh7yFkXWhynSvtB7YauxV4c+HHkNRGNg=
-k8s.io/apimachinery v0.36.2 h1:0PE/W/WNy1UX61NLbXY5TMbJ6UwLL6E6lAPkYrKFxbQ=
-k8s.io/apimachinery v0.36.2/go.mod h1:fvf/HOLXq9RId0rnDIbN1OEBvHXdQbLMM8nu0LcBUf4=
-k8s.io/client-go v0.36.2 h1:bfgxmFKc9CgqsgX4xKLAAdmTQlWee7Ob/HlDOrJ5TBI=
-k8s.io/client-go v0.36.2/go.mod h1:1vgO4OAlfPnoLcb+Rze2GF5rAr14w8qjrYMoyXJzQj0=
-k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
-k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260624041617-8f3fa4921821 h1:m2wZhD5+vJZyCVkTvUHIfaiXc/mdt3Pxyx3vUnGsKzU=
-k8s.io/kube-openapi v0.0.0-20260624041617-8f3fa4921821/go.mod h1:V/QaCUYDa+0QpcHhVVc5l99Uz56wEMEXBSj9oCDkNDY=
-k8s.io/streaming v0.36.2 h1:NSKthPPg9UFSKsRauVJUVGH2Dvn8fhKmY4qrMkw/p98=
-k8s.io/streaming v0.36.2/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
-k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
-k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+k8s.io/api v0.34.2 h1:fsSUNZhV+bnL6Aqrp6O7lMTy6o5x2C4XLjnh//8SLYY=
+k8s.io/api v0.34.2/go.mod h1:MMBPaWlED2a8w4RSeanD76f7opUoypY8TFYkSM+3XHw=
+k8s.io/apimachinery v0.34.2 h1:zQ12Uk3eMHPxrsbUJgNF8bTauTVR2WgqJsTmwTE/NW4=
+k8s.io/apimachinery v0.34.2/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/client-go v0.34.2 h1:Co6XiknN+uUZqiddlfAjT68184/37PS4QAzYvQvDR8M=
+k8s.io/client-go v0.34.2/go.mod h1:2VYDl1XXJsdcAxw7BenFslRQX28Dxz91U9MWKjX97fE=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20251121143641-b6aabc6c6745 h1:c3rI/4s8ibM4vV5UOIlbgkBpwkylI5I9YiPlOtf2g4Q=
+k8s.io/kube-openapi v0.0.0-20251121143641-b6aabc6c6745/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.1 h1:JrhdFMqOd/+3ByqlP2I45kTOZmTRLBUm5pvRjeheg7E=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.1/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

install.sh

@@ -4,17 +4,9 @@ set -e
 
 # kportal installation script
 # Usage: curl -fsSL https://raw.githubusercontent.com/lukaszraczylo/kportal/main/install.sh | bash
-#
-# Environment overrides:
-#   INSTALL_DIR  - target install directory (default: /usr/local/bin)
-#   KPORTAL_VERSION - install a specific version instead of latest (e.g. 1.2.3)
-#   DRY_RUN=1    - download and verify but do not install (for local testing)
-#   SKIP_COSIGN=1 - skip cosign signature verification even if cosign is present
 
 REPO="lukaszraczylo/kportal"
 INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}"
-DRY_RUN="${DRY_RUN:-0}"
-SKIP_COSIGN="${SKIP_COSIGN:-0}"
 
 # Colors
 RED='\033[0;31m'
@@ -25,19 +17,19 @@ NC='\033[0m' # No Color
 
 # Print functions
 print_info() {
-    echo -e "${BLUE}i${NC} $1"
+    echo -e "${BLUE}ℹ${NC} $1"
 }
 
 print_success() {
-    echo -e "${GREEN}OK${NC} $1"
+    echo -e "${GREEN}✓${NC} $1"
 }
 
 print_error() {
-    echo -e "${RED}X${NC} $1" >&2
+    echo -e "${RED}✗${NC} $1"
 }
 
 print_warning() {
-    echo -e "${YELLOW}!${NC} $1"
+    echo -e "${YELLOW}⚠${NC} $1"
 }
 
 # Detect OS
@@ -67,94 +59,13 @@ get_latest_version() {
         sed -E 's/.*"v([^"]+)".*/\1/'
 }
 
-# Compute sha256 of a file. Uses shasum which is available on macOS and Linux.
-compute_sha256() {
-    local file="$1"
-    if command -v shasum >/dev/null 2>&1; then
-        shasum -a 256 "${file}" | awk '{ print $1 }'
-    elif command -v sha256sum >/dev/null 2>&1; then
-        sha256sum "${file}" | awk '{ print $1 }'
-    else
-        print_error "Neither 'shasum' nor 'sha256sum' is available; cannot verify checksum"
-        exit 1
-    fi
-}
-
-# Verify the archive against checksums.txt (SHA-256). Aborts on mismatch.
-verify_checksum() {
-    local archive="$1"
-    local checksums_file="$2"
-
-    print_info "Verifying SHA-256 checksum..."
-
-    local expected
-    # Match the archive name as the second whitespace-separated field.
-    # checksums.txt format produced by goreleaser: "<sha256>  <filename>"
-    expected=$(awk -v name="${archive}" '$2 == name { print $1; exit }' "${checksums_file}")
-
-    if [ -z "${expected}" ]; then
-        print_error "Checksum for ${archive} not found in checksums.txt"
-        print_error "Refusing to install unverified binary."
-        exit 1
-    fi
-
-    local actual
-    actual=$(compute_sha256 "${archive}")
-
-    if [ "${expected}" != "${actual}" ]; then
-        print_error "Checksum mismatch for ${archive}"
-        print_error "  expected: ${expected}"
-        print_error "  actual:   ${actual}"
-        print_error "Aborting installation. The downloaded archive may be corrupted or tampered with."
-        exit 1
-    fi
-
-    print_success "SHA-256 checksum OK"
-}
-
-# Optional: verify cosign signature on the checksums file. Silently skipped
-# when cosign is not installed or the signature artefact is not present.
-verify_cosign_signature() {
-    local checksums_file="$1"
-    local sig_file="$2"
-
-    if [ "${SKIP_COSIGN}" = "1" ]; then
-        return 0
-    fi
-
-    if ! command -v cosign >/dev/null 2>&1; then
-        # cosign not installed; supply-chain integrity still rests on SHA-256
-        return 0
-    fi
-
-    if [ ! -f "${sig_file}" ]; then
-        # No sig artefact downloaded; skip silently
-        return 0
-    fi
-
-    print_info "Verifying cosign signature on checksums.txt..."
-    # Releases are signed by the shared-actions reusable workflow, so the
-    # cert subject is the workflow URL — NOT this repo. Override with
-    # COSIGN_CERT_IDENTITY_REGEXP if you fork the release pipeline.
-    local cert_identity_regexp="${COSIGN_CERT_IDENTITY_REGEXP:-^https://github\.com/lukaszraczylo/shared-actions/\.github/workflows/go-release\.yaml@refs/heads/main$}"
-    if cosign verify-blob \
-        --certificate-identity-regexp "${cert_identity_regexp}" \
-        --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
-        --bundle "${sig_file}" \
-        "${checksums_file}" >/dev/null 2>&1; then
-        print_success "cosign signature OK"
-    else
-        print_error "cosign signature verification FAILED for checksums.txt"
-        print_error "Aborting installation."
-        exit 1
-    fi
-}
-
 # Main installation
 main() {
     echo ""
-    echo "kportal installation script"
-    echo "Kubernetes port forwarding made easy"
+    echo "╔════════════════════════════════════════╗"
+    echo "║   kportal Installation Script          ║"
+    echo "║   Kubernetes Port Forwarding Made Easy ║"
+    echo "╚════════════════════════════════════════╝"
     echo ""
 
     # Detect system
@@ -169,72 +80,41 @@ main() {
 
     print_info "Detected: ${OS}/${ARCH}"
 
-    # Get version
-    if [ -n "${KPORTAL_VERSION:-}" ]; then
-        VERSION="${KPORTAL_VERSION#v}"
-        print_info "Using requested version: v${VERSION}"
-    else
-        print_info "Fetching latest version..."
-        VERSION=$(get_latest_version)
-        if [ -z "$VERSION" ]; then
-            print_error "Failed to fetch latest version"
-            exit 1
-        fi
-        print_success "Latest version: v${VERSION}"
+    # Get latest version
+    print_info "Fetching latest version..."
+    VERSION=$(get_latest_version)
+
+    if [ -z "$VERSION" ]; then
+        print_error "Failed to fetch latest version"
+        exit 1
     fi
 
-    # Construct download URLs
+    print_success "Latest version: v${VERSION}"
+
+    # Construct download URL
     if [ "$OS" = "windows" ]; then
         ARCHIVE="kportal-${VERSION}-${OS}-${ARCH}.zip"
     else
         ARCHIVE="kportal-${VERSION}-${OS}-${ARCH}.tar.gz"
     fi
 
-    BASE_URL="https://github.com/${REPO}/releases/download/v${VERSION}"
-    DOWNLOAD_URL="${BASE_URL}/${ARCHIVE}"
-    CHECKSUMS_FILE="kportal-${VERSION}-checksums.txt"
-    CHECKSUMS_URL="${BASE_URL}/${CHECKSUMS_FILE}"
-    SIG_FILE="${CHECKSUMS_FILE}.sigstore.json"
-    SIG_URL="${BASE_URL}/${SIG_FILE}"
+    DOWNLOAD_URL="https://github.com/${REPO}/releases/download/v${VERSION}/${ARCHIVE}"
 
     # Create temporary directory
     TMP_DIR=$(mktemp -d)
-    # shellcheck disable=SC2064
-    trap "rm -rf '${TMP_DIR}'" EXIT
+    trap "rm -rf ${TMP_DIR}" EXIT
 
-    # Download archive
-    print_info "Downloading ${ARCHIVE}..."
+    # Download binary
+    print_info "Downloading kportal..."
     if ! curl -fsSL -o "${TMP_DIR}/${ARCHIVE}" "${DOWNLOAD_URL}"; then
-        print_error "Failed to download kportal archive"
+        print_error "Failed to download kportal"
         print_info "URL: ${DOWNLOAD_URL}"
         exit 1
     fi
 
-    # Download checksums
-    print_info "Downloading checksums.txt..."
-    if ! curl -fsSL -o "${TMP_DIR}/${CHECKSUMS_FILE}" "${CHECKSUMS_URL}"; then
-        print_error "Failed to download checksums file"
-        print_info "URL: ${CHECKSUMS_URL}"
-        print_error "Refusing to install without checksum verification."
-        exit 1
-    fi
-
-    # Try to download cosign signature bundle (best-effort, non-fatal if absent)
-    if curl -fsSL -o "${TMP_DIR}/${SIG_FILE}" "${SIG_URL}" 2>/dev/null; then
-        :
-    else
-        rm -f "${TMP_DIR}/${SIG_FILE}"
-    fi
-
-    # Verify archive checksum
-    cd "${TMP_DIR}"
-    verify_checksum "${ARCHIVE}" "${CHECKSUMS_FILE}"
-
-    # Optional cosign signature verification on checksums file
-    verify_cosign_signature "${CHECKSUMS_FILE}" "${SIG_FILE}"
-
     # Extract archive
     print_info "Extracting archive..."
+    cd "${TMP_DIR}"
     if [ "$OS" = "windows" ]; then
         unzip -q "${ARCHIVE}"
         BINARY="kportal.exe"
@@ -252,12 +132,6 @@ main() {
     # Make binary executable
     chmod +x "${BINARY}"
 
-    if [ "${DRY_RUN}" = "1" ]; then
-        print_success "Dry run successful. Verified archive at ${TMP_DIR}/${ARCHIVE}"
-        print_info "Skipping install step (DRY_RUN=1)"
-        return 0
-    fi
-
     # Install binary
     print_info "Installing kportal to ${INSTALL_DIR}..."
 
@@ -274,12 +148,9 @@ main() {
         mv "${BINARY}" "${INSTALL_DIR}/${BINARY}"
     fi
 
-    # Verify installation (portable: awk instead of GNU-only grep -oP)
+    # Verify installation
     if command -v kportal >/dev/null 2>&1; then
-        INSTALLED_VERSION=$(kportal --version 2>/dev/null | awk '/^kportal version/ { print $3; exit }')
-        if [ -z "${INSTALLED_VERSION}" ]; then
-            INSTALLED_VERSION="unknown"
-        fi
+        INSTALLED_VERSION=$(kportal --version | grep -oP 'kportal version \K[0-9.]+' || echo "unknown")
         print_success "kportal v${INSTALLED_VERSION} installed successfully!"
     else
         print_warning "kportal installed but not found in PATH"

internal/benchmark/results.go

@@ -1,141 +0,0 @@
-// Package benchmark provides HTTP benchmarking capabilities for port forwards.
-// It measures latency, throughput, and reliability of forwarded connections.
-//
-// The benchmark runner sends configurable numbers of concurrent requests
-// and collects statistics including:
-//   - Latency percentiles (P50, P95, P99)
-//   - Request success/failure rates
-//   - Throughput (requests/second)
-//   - Status code distribution
-//
-// Results can be displayed in the UI or exported for analysis.
-package benchmark
-
-import (
-	"sort"
-	"time"
-)
-
-// Results holds the aggregated results of a benchmark run
-type Results struct {
-	StartTime     time.Time       `json:"start_time"`
-	EndTime       time.Time       `json:"end_time"`
-	StatusCodes   map[int]int     `json:"status_codes"`
-	Errors        map[string]int  `json:"errors,omitempty"`
-	Method        string          `json:"method"`
-	URL           string          `json:"url"`
-	ForwardID     string          `json:"forward_id"`
-	Latencies     []time.Duration `json:"-"`
-	TotalRequests int             `json:"total_requests"`
-	Successful    int             `json:"successful"`
-	Failed        int             `json:"failed"`
-	BytesRead     int64           `json:"bytes_read"`
-	BytesWritten  int64           `json:"bytes_written"`
-}
-
-// Stats holds calculated statistics
-type Stats struct {
-	MinLatency time.Duration `json:"min_latency_ms"`
-	MaxLatency time.Duration `json:"max_latency_ms"`
-	AvgLatency time.Duration `json:"avg_latency_ms"`
-	P50Latency time.Duration `json:"p50_latency_ms"`
-	P95Latency time.Duration `json:"p95_latency_ms"`
-	P99Latency time.Duration `json:"p99_latency_ms"`
-	Throughput float64       `json:"throughput_rps"`
-	Duration   time.Duration `json:"duration"`
-}
-
-// NewResults creates a new Results instance
-func NewResults(forwardID, url, method string) *Results {
-	return &Results{
-		ForwardID:   forwardID,
-		URL:         url,
-		Method:      method,
-		StartTime:   time.Now(),
-		Latencies:   make([]time.Duration, 0),
-		StatusCodes: make(map[int]int),
-		Errors:      make(map[string]int),
-	}
-}
-
-// RecordSuccess records a successful HTTP request (transport succeeded)
-// Note: only 2xx status codes are counted as successful for statistics
-func (r *Results) RecordSuccess(statusCode int, latency time.Duration, bytesRead, bytesWritten int64) {
-	r.TotalRequests++
-	// Only count 2xx as successful
-	if statusCode >= 200 && statusCode < 300 {
-		r.Successful++
-	} else {
-		r.Failed++
-	}
-	r.Latencies = append(r.Latencies, latency)
-	r.StatusCodes[statusCode]++
-	r.BytesRead += bytesRead
-	r.BytesWritten += bytesWritten
-}
-
-// RecordFailure records a failed request
-func (r *Results) RecordFailure(err error, latency time.Duration) {
-	r.TotalRequests++
-	r.Failed++
-	r.Latencies = append(r.Latencies, latency)
-	r.Errors[err.Error()]++
-}
-
-// Finalize marks the benchmark as complete
-func (r *Results) Finalize() {
-	r.EndTime = time.Now()
-}
-
-// CalculateStats calculates statistics from the results
-func (r *Results) CalculateStats() Stats {
-	stats := Stats{
-		Duration: r.EndTime.Sub(r.StartTime),
-	}
-
-	if len(r.Latencies) == 0 {
-		return stats
-	}
-
-	// Sort latencies for percentile calculation
-	sorted := make([]time.Duration, len(r.Latencies))
-	copy(sorted, r.Latencies)
-	sort.Slice(sorted, func(i, j int) bool {
-		return sorted[i] < sorted[j]
-	})
-
-	// Calculate min, max, avg
-	var total time.Duration
-	stats.MinLatency = sorted[0]
-	stats.MaxLatency = sorted[len(sorted)-1]
-
-	for _, lat := range sorted {
-		total += lat
-	}
-	stats.AvgLatency = total / time.Duration(len(sorted))
-
-	// Calculate percentiles
-	stats.P50Latency = percentile(sorted, 50)
-	stats.P95Latency = percentile(sorted, 95)
-	stats.P99Latency = percentile(sorted, 99)
-
-	// Calculate throughput
-	if stats.Duration > 0 {
-		stats.Throughput = float64(r.TotalRequests) / stats.Duration.Seconds()
-	}
-
-	return stats
-}
-
-// percentile calculates the p-th percentile of sorted durations
-func percentile(sorted []time.Duration, p int) time.Duration {
-	if len(sorted) == 0 {
-		return 0
-	}
-
-	idx := (p * len(sorted)) / 100
-	if idx >= len(sorted) {
-		idx = len(sorted) - 1
-	}
-	return sorted[idx]
-}

internal/benchmark/runner.go

@@ -1,213 +0,0 @@
-package benchmark
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"sync"
-	"sync/atomic"
-	"time"
-)
-
-// ProgressCallback is called periodically with benchmark progress
-type ProgressCallback func(completed, total int)
-
-// Config holds the benchmark configuration
-type Config struct {
-	Headers          map[string]string
-	ProgressCallback ProgressCallback
-	URL              string
-	Method           string
-	Body             []byte
-	Concurrency      int
-	Requests         int
-	Duration         time.Duration
-	Timeout          time.Duration
-}
-
-// Runner executes HTTP benchmarks
-type Runner struct {
-	client *http.Client
-}
-
-// NewRunner creates a new benchmark runner
-func NewRunner() *Runner {
-	return &Runner{
-		client: &http.Client{
-			Timeout: 30 * time.Second,
-			Transport: &http.Transport{
-				MaxIdleConns:        100,
-				MaxIdleConnsPerHost: 100,
-				IdleConnTimeout:     90 * time.Second,
-			},
-		},
-	}
-}
-
-// Run executes the benchmark and returns results
-func (r *Runner) Run(ctx context.Context, forwardID string, cfg Config) (*Results, error) {
-	if cfg.URL == "" {
-		return nil, fmt.Errorf("URL is required")
-	}
-
-	if cfg.Concurrency < 1 {
-		cfg.Concurrency = 1
-	}
-
-	// Ensure concurrency doesn't exceed number of requests (for request-based mode)
-	if cfg.Duration == 0 && cfg.Requests > 0 && cfg.Concurrency > cfg.Requests {
-		cfg.Concurrency = cfg.Requests
-	}
-
-	if cfg.Timeout > 0 {
-		r.client.Timeout = cfg.Timeout
-	}
-
-	results := NewResults(forwardID, cfg.URL, cfg.Method)
-
-	// Create work channel
-	workCh := make(chan struct{}, cfg.Concurrency*2)
-
-	// Create context for cancellation
-	runCtx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	// Start workers
-	var wg sync.WaitGroup
-	var completed int64
-	var resultsMu sync.Mutex // Shared mutex for results access
-
-	for i := 0; i < cfg.Concurrency; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			r.worker(runCtx, cfg, results, &resultsMu, workCh, &completed)
-		}()
-	}
-
-	// Start progress reporter if callback is provided
-	if cfg.ProgressCallback != nil {
-		go func() {
-			ticker := time.NewTicker(100 * time.Millisecond)
-			defer ticker.Stop()
-			for {
-				select {
-				case <-runCtx.Done():
-					return
-				case <-ticker.C:
-					cfg.ProgressCallback(int(atomic.LoadInt64(&completed)), cfg.Requests)
-				}
-			}
-		}()
-	}
-
-	// Determine how to dispatch work
-	if cfg.Duration > 0 {
-		// Duration-based: keep sending work until duration expires
-		timer := time.NewTimer(cfg.Duration)
-		defer timer.Stop()
-
-	dispatchLoop:
-		for {
-			select {
-			case <-timer.C:
-				cancel()
-				break dispatchLoop
-			case <-ctx.Done():
-				cancel()
-				break dispatchLoop
-			case workCh <- struct{}{}:
-				// Work dispatched
-			}
-		}
-	} else {
-		// Request-based: send exactly N requests
-	requestLoop:
-		for i := 0; i < cfg.Requests; i++ {
-			select {
-			case <-ctx.Done():
-				cancel()
-				break requestLoop
-			case workCh <- struct{}{}:
-				// Work dispatched
-			}
-		}
-	}
-
-	// Close work channel and wait for workers
-	close(workCh)
-	wg.Wait()
-
-	results.Finalize()
-	return results, nil
-}
-
-// worker processes requests from the work channel
-func (r *Runner) worker(ctx context.Context, cfg Config, results *Results, resultsMu *sync.Mutex, workCh <-chan struct{}, completed *int64) {
-	for range workCh {
-		select {
-		case <-ctx.Done():
-			return
-		default:
-		}
-
-		start := time.Now()
-		statusCode, bytesRead, bytesWritten, err := r.makeRequestSafe(ctx, cfg)
-		latency := time.Since(start)
-
-		resultsMu.Lock()
-		if err != nil {
-			results.RecordFailure(err, latency)
-		} else {
-			results.RecordSuccess(statusCode, latency, bytesRead, bytesWritten)
-		}
-		resultsMu.Unlock()
-
-		atomic.AddInt64(completed, 1)
-	}
-}
-
-// makeRequestSafe wraps makeRequest with panic recovery
-func (r *Runner) makeRequestSafe(ctx context.Context, cfg Config) (statusCode int, bytesRead, bytesWritten int64, err error) {
-	defer func() {
-		if rec := recover(); rec != nil {
-			err = fmt.Errorf("request panic: %v", rec)
-		}
-	}()
-	return r.makeRequest(ctx, cfg)
-}
-
-// makeRequest makes a single HTTP request
-func (r *Runner) makeRequest(ctx context.Context, cfg Config) (statusCode int, bytesRead, bytesWritten int64, err error) {
-	var body io.Reader
-	if len(cfg.Body) > 0 {
-		body = bytes.NewReader(cfg.Body)
-		bytesWritten = int64(len(cfg.Body))
-	}
-
-	req, err := http.NewRequestWithContext(ctx, cfg.Method, cfg.URL, body)
-	if err != nil {
-		return 0, 0, 0, err
-	}
-
-	// Set headers
-	for k, v := range cfg.Headers {
-		req.Header.Set(k, v)
-	}
-
-	resp, err := r.client.Do(req)
-	if err != nil {
-		return 0, 0, bytesWritten, err
-	}
-	defer func() { _ = resp.Body.Close() }()
-
-	// Read response body to measure bytes
-	respBody, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return resp.StatusCode, 0, bytesWritten, err
-	}
-
-	return resp.StatusCode, int64(len(respBody)), bytesWritten, nil
-}

internal/benchmark/runner_test.go

@@ -1,273 +0,0 @@
-package benchmark
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestResults(t *testing.T) {
-	r := NewResults("test-forward", "http://localhost/test", "GET")
-
-	// Record some 2xx successes
-	r.RecordSuccess(200, 10*time.Millisecond, 100, 0)
-	r.RecordSuccess(200, 20*time.Millisecond, 150, 0)
-	r.RecordSuccess(201, 15*time.Millisecond, 120, 0)
-
-	// Record a transport failure
-	r.RecordFailure(assert.AnError, 5*time.Millisecond)
-
-	r.Finalize()
-
-	assert.Equal(t, 4, r.TotalRequests)
-	assert.Equal(t, 3, r.Successful)
-	assert.Equal(t, 1, r.Failed)
-	assert.Equal(t, int64(370), r.BytesRead)
-	assert.Equal(t, 2, r.StatusCodes[200])
-	assert.Equal(t, 1, r.StatusCodes[201])
-}
-
-func TestResultsNon2xxCountsAsFailure(t *testing.T) {
-	r := NewResults("test-forward", "http://localhost/test", "GET")
-
-	// Record a 200 success
-	r.RecordSuccess(200, 10*time.Millisecond, 100, 0)
-
-	// Record 4xx and 5xx - these should count as failures
-	r.RecordSuccess(404, 10*time.Millisecond, 50, 0)
-	r.RecordSuccess(500, 10*time.Millisecond, 30, 0)
-
-	r.Finalize()
-
-	assert.Equal(t, 3, r.TotalRequests)
-	assert.Equal(t, 1, r.Successful, "Only 2xx should count as successful")
-	assert.Equal(t, 2, r.Failed, "4xx and 5xx should count as failed")
-	assert.Equal(t, 1, r.StatusCodes[200])
-	assert.Equal(t, 1, r.StatusCodes[404])
-	assert.Equal(t, 1, r.StatusCodes[500])
-}
-
-func TestResultsStats(t *testing.T) {
-	r := NewResults("test", "http://localhost", "GET")
-
-	// Add latencies
-	latencies := []time.Duration{
-		10 * time.Millisecond,
-		20 * time.Millisecond,
-		30 * time.Millisecond,
-		40 * time.Millisecond,
-		50 * time.Millisecond,
-	}
-
-	for _, lat := range latencies {
-		r.RecordSuccess(200, lat, 0, 0)
-	}
-
-	r.EndTime = r.StartTime.Add(1 * time.Second)
-
-	stats := r.CalculateStats()
-
-	assert.Equal(t, 10*time.Millisecond, stats.MinLatency)
-	assert.Equal(t, 50*time.Millisecond, stats.MaxLatency)
-	assert.Equal(t, 30*time.Millisecond, stats.AvgLatency)
-	assert.Equal(t, float64(5), stats.Throughput)
-}
-
-func TestPercentile(t *testing.T) {
-	sorted := []time.Duration{
-		1 * time.Millisecond,
-		2 * time.Millisecond,
-		3 * time.Millisecond,
-		4 * time.Millisecond,
-		5 * time.Millisecond,
-		6 * time.Millisecond,
-		7 * time.Millisecond,
-		8 * time.Millisecond,
-		9 * time.Millisecond,
-		10 * time.Millisecond,
-	}
-
-	// P50 = index 5 (50*10/100 = 5) = 6ms
-	assert.Equal(t, 6*time.Millisecond, percentile(sorted, 50))
-	// P95 = index 9 (95*10/100 = 9) = 10ms
-	assert.Equal(t, 10*time.Millisecond, percentile(sorted, 95))
-	// P99 = index 9 (99*10/100 = 9) = 10ms
-	assert.Equal(t, 10*time.Millisecond, percentile(sorted, 99))
-}
-
-func TestRunner(t *testing.T) {
-	// Create a test server
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		time.Sleep(5 * time.Millisecond) // Simulate some latency
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`{"status":"ok"}`))
-	}))
-	defer server.Close()
-
-	runner := NewRunner()
-
-	cfg := Config{
-		URL:         server.URL,
-		Method:      "GET",
-		Concurrency: 2,
-		Requests:    10,
-		Timeout:     5 * time.Second,
-	}
-
-	results, err := runner.Run(context.Background(), "test-forward", cfg)
-	require.NoError(t, err)
-
-	assert.Equal(t, 10, results.TotalRequests)
-	assert.Equal(t, 10, results.Successful)
-	assert.Equal(t, 0, results.Failed)
-	assert.Equal(t, 10, results.StatusCodes[200])
-}
-
-func TestRunnerWithDuration(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`ok`))
-	}))
-	defer server.Close()
-
-	runner := NewRunner()
-
-	cfg := Config{
-		URL:         server.URL,
-		Method:      "GET",
-		Concurrency: 2,
-		Duration:    100 * time.Millisecond,
-		Timeout:     1 * time.Second,
-	}
-
-	results, err := runner.Run(context.Background(), "test-forward", cfg)
-	require.NoError(t, err)
-
-	// Should have made some requests in 100ms
-	assert.Greater(t, results.TotalRequests, 0)
-	assert.Equal(t, results.Successful, results.StatusCodes[200])
-}
-
-func TestRunnerWithHeaders(t *testing.T) {
-	var receivedHeader string
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		receivedHeader = r.Header.Get("X-Custom-Header")
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer server.Close()
-
-	runner := NewRunner()
-
-	cfg := Config{
-		URL:    server.URL,
-		Method: "GET",
-		Headers: map[string]string{
-			"X-Custom-Header": "test-value",
-		},
-		Concurrency: 1,
-		Requests:    1,
-	}
-
-	_, err := runner.Run(context.Background(), "test", cfg)
-	require.NoError(t, err)
-
-	assert.Equal(t, "test-value", receivedHeader)
-}
-
-func TestRunnerWithBody(t *testing.T) {
-	var receivedBody string
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, _ := http.MaxBytesReader(w, r.Body, 1024).Read(make([]byte, 1024))
-		_ = body
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer server.Close()
-
-	runner := NewRunner()
-
-	cfg := Config{
-		URL:         server.URL,
-		Method:      "POST",
-		Body:        []byte(`{"test":"data"}`),
-		Concurrency: 1,
-		Requests:    1,
-	}
-
-	results, err := runner.Run(context.Background(), "test", cfg)
-	require.NoError(t, err)
-
-	_ = receivedBody // Used for debugging
-	assert.Equal(t, int64(15), results.BytesWritten)
-}
-
-func TestRunnerWithProgressCallback(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		time.Sleep(10 * time.Millisecond) // Add small delay so progress ticker can fire
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`ok`))
-	}))
-	defer server.Close()
-
-	runner := NewRunner()
-
-	var progressUpdates []int
-	var mu sync.Mutex
-
-	cfg := Config{
-		URL:         server.URL,
-		Method:      "GET",
-		Concurrency: 5,
-		Requests:    50, // More requests to ensure progress callbacks fire
-		Timeout:     5 * time.Second,
-		ProgressCallback: func(completed, total int) {
-			mu.Lock()
-			progressUpdates = append(progressUpdates, completed)
-			mu.Unlock()
-		},
-	}
-
-	results, err := runner.Run(context.Background(), "test-forward", cfg)
-	require.NoError(t, err)
-
-	assert.Equal(t, 50, results.TotalRequests)
-
-	// Should have received some progress updates (ticker fires every 100ms)
-	mu.Lock()
-	updates := len(progressUpdates)
-	mu.Unlock()
-	assert.Greater(t, updates, 0, "Should have received progress updates")
-}
-
-func TestRunnerConcurrencyCappedAtRequests(t *testing.T) {
-	requestCount := 0
-	var mu sync.Mutex
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		mu.Lock()
-		requestCount++
-		mu.Unlock()
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer server.Close()
-
-	runner := NewRunner()
-
-	cfg := Config{
-		URL:         server.URL,
-		Method:      "GET",
-		Concurrency: 100, // Higher than requests
-		Requests:    5,
-		Timeout:     5 * time.Second,
-	}
-
-	results, err := runner.Run(context.Background(), "test", cfg)
-	require.NoError(t, err)
-
-	assert.Equal(t, 5, results.TotalRequests)
-}

internal/complete/completion.go

@@ -1,458 +0,0 @@
-// Package complete provides shell completion generation for kportal.
-// It supports bash, zsh, and fish shells with context-aware completions
-// for flags, subcommands, config values, and Kubernetes resources.
-package complete
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// Shell represents a supported shell type
-type Shell string
-
-const (
-	ShellBash Shell = "bash"
-	ShellZsh  Shell = "zsh"
-	ShellFish Shell = "fish"
-)
-
-// Installer handles shell completion installation
-type Installer struct {
-	shell     Shell
-	prefixDir string
-}
-
-// NewInstaller creates a new completion installer for the specified shell
-func NewInstaller(shell Shell) *Installer {
-	return &Installer{
-		shell:     shell,
-		prefixDir: getDefaultPrefixDir(shell),
-	}
-}
-
-// getDefaultPrefixDir returns the default completion directory for a shell
-func getDefaultPrefixDir(shell Shell) string {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		home = os.Getenv("HOME")
-	}
-	if home == "" {
-		home = "/tmp"
-	}
-
-	switch shell {
-	case ShellBash:
-		// Check common bash completion directories
-		dirs := []string{
-			"/etc/bash_completion.d",
-			filepath.Join(home, ".local", "share", "bash-completion", "completions"),
-			filepath.Join(home, ".bash_completion.d"),
-		}
-		for _, dir := range dirs {
-			if pathExists(dir) {
-				return dir
-			}
-		}
-		// Fallback to user dir (best-effort create; Install reports write errors)
-		userDir := filepath.Join(home, ".local", "share", "bash-completion", "completions")
-		ensureDir(userDir)
-		return userDir
-
-	case ShellZsh:
-		dirs := []string{
-			filepath.Join(home, ".zsh", "completions"),
-			filepath.Join(home, ".oh-my-zsh", "completions"),
-		}
-		for _, dir := range dirs {
-			if pathExists(dir) {
-				return dir
-			}
-		}
-		// Fallback to standard zsh site-functions
-		usrShare := "/usr/local/share/zsh/site-functions"
-		if pathExists(usrShare) {
-			return usrShare
-		}
-		userDir := filepath.Join(home, ".zsh", "completions")
-		ensureDir(userDir)
-		return userDir
-
-	case ShellFish:
-		dir := filepath.Join(home, ".config", "fish", "completions")
-		ensureDir(dir)
-		return dir
-	}
-
-	return ""
-}
-
-// Install installs the completion script for the shell
-func (i *Installer) Install() error {
-	script, err := Generate(i.shell)
-	if err != nil {
-		return fmt.Errorf("failed to generate completion script: %w", err)
-	}
-
-	filename := i.getCompletionFilename()
-	filepath := filepath.Join(i.prefixDir, filename)
-
-	// Check if already installed
-	if pathExists(filepath) {
-		return fmt.Errorf("completion file already exists: %s (remove it first to reinstall)", filepath)
-	}
-
-	// #nosec G306 -- completion scripts are non-secret and must be world-readable by the shell
-	if err := os.WriteFile(filepath, []byte(script), 0o644); err != nil {
-		return fmt.Errorf("failed to write completion file: %w", err)
-	}
-
-	return nil
-}
-
-// Uninstall removes the completion script
-func (i *Installer) Uninstall() error {
-	filename := i.getCompletionFilename()
-	filepath := filepath.Join(i.prefixDir, filename)
-
-	if err := os.Remove(filepath); err != nil {
-		return fmt.Errorf("failed to remove completion file: %w", err)
-	}
-
-	return nil
-}
-
-// getCompletionFilename returns the filename for the completion script
-func (i *Installer) getCompletionFilename() string {
-	switch i.shell {
-	case ShellBash:
-		return "_kportal"
-	case ShellZsh:
-		return "_kportal"
-	case ShellFish:
-		return "kportal.fish"
-	}
-	return "_kportal"
-}
-
-// Print prints the completion script to stdout
-func Print(shell Shell) error {
-	script, err := Generate(shell)
-	if err != nil {
-		return err
-	}
-	fmt.Print(script)
-	return nil
-}
-
-// Generate generates the completion script for the specified shell
-func Generate(shell Shell) (string, error) {
-	switch shell {
-	case ShellBash:
-		return generateBash()
-	case ShellZsh:
-		return generateZsh()
-	case ShellFish:
-		return generateFish()
-	default:
-		return "", fmt.Errorf("unsupported shell: %s", shell)
-	}
-}
-
-// generateBash generates bash completion script
-func generateBash() (string, error) {
-	var sb strings.Builder
-
-	bashScript := `# kportal shell completion - bash
-# Generated by kportal
-
-# Don't interfere with other completions
-if [[ -n "${BASH_COMPLETION_VERSINFO:-}" ]]; then
-    return
-fi
-
-_kportal()
-{
-    local cur prev words cword split=false
-    _init_completion -s || return
-
-    # Complete the value expected after the previous flag
-    case "$prev" in
-        -c|--config)
-            _filedir yaml
-            return
-            ;;
-        --log-format)
-            COMPREPLY=( $(compgen -W "text json" -- "$cur") )
-            return
-            ;;
-        --convert)
-            _filedir json
-            return
-            ;;
-        --convert-output)
-            _filedir yaml
-            return
-            ;;
-        --context)
-            # Complete from kubectl contexts
-            if command -v kubectl &> /dev/null; then
-                COMPREPLY=( $(compgen -W "$(kubectl config get-contexts -o name 2>/dev/null)" -- "$cur") )
-            fi
-            return
-            ;;
-        --shell)
-            COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") )
-            return
-            ;;
-    esac
-
-    # Handle option splitting (e.g., -c=value)
-    [[ "$cur" == -*=* ]] && split=true
-    [[ "$split" == true ]] && prev="${cur%%=*}"
-
-    # Subcommand-specific completion
-    case "${words[1]}" in
-        generate)
-            if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--context --config --dry-run" -- "$cur") )
-            elif command -v kubectl &> /dev/null; then
-                COMPREPLY=( $(compgen -W "$(kubectl config get-contexts -o name 2>/dev/null)" -- "$cur") )
-            fi
-            return
-            ;;
-        completion)
-            COMPREPLY=( $(compgen -W "--install --uninstall --shell" -- "$cur") )
-            return
-            ;;
-    esac
-
-    # Top-level options
-    if [[ "$cur" == -* ]]; then
-        COMPREPLY=( $(compgen -W "-c -v --check --headless --log-format --version --update --convert --convert-output" -- "$cur") )
-        return
-    fi
-
-    # Top-level subcommands
-    COMPREPLY=( $(compgen -W "generate completion" -- "$cur") )
-}
-
-# Register completion
-complete -F _kportal kportal
-
-# Also complete for common aliases
-complete -F _kportal kp
-`
-
-	sb.WriteString(bashScript)
-	return sb.String(), nil
-}
-
-// generateZsh generates zsh completion script
-func generateZsh() (string, error) {
-	var sb strings.Builder
-
-	// Per-flag zsh _arguments descriptors. Completion scripts are static text, so
-	// these are literals (single source of truth — keep in sync with the CLI flags).
-	flagDescs := []string{
-		`'-c[Path to configuration file]:config file:_files -g "*.yaml"'`,
-		`'-v[Enable verbose logging]'`,
-		`'--version[Show version and exit]'`,
-		`'--update[Check for updates]'`,
-		`'--check[Validate configuration]'`,
-		`'--headless[Run without UI]'`,
-		`'--log-format[Log format: text or json]:format:(text json)'`,
-		`'--convert[Convert kftray config]:input file:_files -g "*.json"'`,
-		`'--convert-output[Output file]:output file:_files -g "*.yaml"'`,
-	}
-
-	sb.WriteString(`#compdef kportal
-
-# kportal shell completion - zsh
-# Generated by kportal
-
-_kportal()
-{
-    local -a commands flags generate_flags completion_flags
-
-    commands=(
-        'generate:Interactively generate forwards from cluster'
-        'completion:Generate shell completion scripts'
-    )
-
-    flags=(
-`)
-
-	for _, desc := range flagDescs {
-		fmt.Fprintf(&sb, "        %s\n", desc)
-	}
-
-	sb.WriteString(`    )
-
-    generate_flags=(
-        '--context[Kubernetes context]:context:->ctx'
-        '--config[Config file]:file:_files -g "*.yaml"'
-        '--dry-run[Print without saving]'
-    )
-
-    completion_flags=(
-        '--install[Install completions for the shell]'
-        '--uninstall[Remove installed completions]'
-        '--shell[Shell type]:shell:(bash zsh fish)'
-    )
-
-    _arguments -s $flags '1: :->command' '*:: :->args'
-
-    case $state in
-        command)
-            _describe 'command' commands
-            ;;
-        args)
-            case ${words[1]} in
-                generate)
-                    _arguments -s $generate_flags
-                    if [[ "$words[CURRENT]" == --context ]]; then
-                        if command -v kubectl &> /dev/null; then
-                            local -a contexts
-                            contexts=(${(f)"$(kubectl config get-contexts -o name 2>/dev/null)"})
-                            _describe 'context' contexts
-                        fi
-                    fi
-                    ;;
-                completion)
-                    _arguments -s $completion_flags
-                    ;;
-            esac
-            ;;
-    esac
-}
-
-_kportal "$@"
-`)
-
-	return sb.String(), nil
-}
-
-// generateFish generates fish completion script
-func generateFish() (string, error) {
-	var sb strings.Builder
-
-	sb.WriteString(`# kportal shell completion - fish
-# Generated by kportal
-
-# Main completion
-complete -c kportal -f
-
-# Subcommands
-complete -c kportal -n '__fish_use_subcommand' -a 'generate' -d 'Interactively generate forwards from cluster'
-complete -c kportal -n '__fish_use_subcommand' -a 'completion' -d 'Generate shell completion scripts'
-
-# Global flags (main command uses single-dash -c and -v; words accept --)
-complete -c kportal -s c -r -f -a '( __fish_complete_suffix .yaml )' -d 'Path to configuration file'
-complete -c kportal -s v -d 'Enable verbose logging'
-complete -c kportal -l version -d 'Show version and exit'
-complete -c kportal -l update -d 'Check for updates'
-complete -c kportal -l check -d 'Validate configuration'
-complete -c kportal -l headless -d 'Run without UI'
-complete -c kportal -l log-format -d 'Log format' -a 'text json' -f
-complete -c kportal -l convert -r -f -a '( __fish_complete_suffix .json )' -d 'Convert kftray config'
-complete -c kportal -l convert-output -r -f -a '( __fish_complete_suffix .yaml )' -d 'Output file'
-
-# generate subcommand flags
-complete -c kportal -n '__fish_seen_subcommand_from generate' -l context -d 'Kubernetes context' -a '(kubectl config get-contexts -o name 2>/dev/null)' -f
-complete -c kportal -n '__fish_seen_subcommand_from generate' -l config -r -f -a '( __fish_complete_suffix .yaml )' -d 'Config file'
-complete -c kportal -n '__fish_seen_subcommand_from generate' -l dry-run -d 'Print without saving'
-
-# completion subcommand flags
-complete -c kportal -n '__fish_seen_subcommand_from completion' -l install -d 'Install completions for the shell'
-complete -c kportal -n '__fish_seen_subcommand_from completion' -l uninstall -d 'Remove installed completions'
-complete -c kportal -n '__fish_seen_subcommand_from completion' -l shell -d 'Shell type' -a 'bash zsh fish' -f
-
-# Aliases
-complete -c kp -f
-`)
-
-	return sb.String(), nil
-}
-
-// InstallCompletions installs completions for the specified shell
-// Prints instructions for manual installation if auto-install fails
-func InstallCompletions(shell Shell) error {
-	installer := NewInstaller(shell)
-
-	if err := installer.Install(); err != nil {
-		// Check if it's just "already exists" error
-		if strings.Contains(err.Error(), "already exists") {
-			fmt.Printf("Completion already installed at: %s/%s\n",
-				installer.prefixDir, installer.getCompletionFilename())
-			fmt.Println("Remove it first to reinstall, or source it manually:")
-			return nil
-		}
-
-		// Try to print the script instead
-		fmt.Println("Could not auto-install completions. To install manually, run:")
-		fmt.Printf("  # %s\n", getInstallInstructions(shell))
-		return nil
-	}
-
-	fmt.Printf("✅ Completions installed to: %s/%s\n",
-		installer.prefixDir, installer.getCompletionFilename())
-	fmt.Printf("\nTo enable %s completions, restart your shell or run:\n", shell)
-	fmt.Printf("  source ~/%s\n", getSourceInstruction(shell))
-
-	return nil
-}
-
-func getInstallInstructions(shell Shell) string {
-	return fmt.Sprintf("kportal completion %s > <your-completion-dir>/_kportal", shell)
-}
-
-func getSourceInstruction(shell Shell) string {
-	switch shell {
-	case ShellBash:
-		return ".bashrc"
-	case ShellZsh:
-		return ".zshrc"
-	case ShellFish:
-		return ".config/fish/config.fish # completions load automatically"
-	}
-	return "shell config"
-}
-
-// AutoDetectShell detects the current shell
-func AutoDetectShell() Shell {
-	shell := os.Getenv("SHELL")
-	if shell == "" {
-		return ShellBash // Default
-	}
-
-	if strings.HasSuffix(shell, "/bash") {
-		return ShellBash
-	}
-	if strings.HasSuffix(shell, "/zsh") {
-		return ShellZsh
-	}
-	if strings.HasSuffix(shell, "/fish") {
-		return ShellFish
-	}
-
-	return ShellBash
-}
-
-// pathExists reports whether path exists on disk.
-// #nosec G703 -- callers pass fixed completion paths derived from the user's own
-// HOME and constant subdirectory names, never external/untrusted input.
-func pathExists(path string) bool {
-	_, err := os.Stat(path)
-	return err == nil
-}
-
-// ensureDir best-effort creates a completion directory. Errors are intentionally
-// ignored: Install() surfaces any later write failure with a clear message.
-// #nosec G703 -- path is derived from the user's own HOME and constant
-// subdirectory names; 0o750 is appropriate for user-owned completion dirs.
-func ensureDir(path string) {
-	_ = os.MkdirAll(path, 0o750)
-}

internal/complete/completion_test.go

@@ -1,327 +0,0 @@
-package complete
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestGenerateBash(t *testing.T) {
-	script, err := Generate(ShellBash)
-	if err != nil {
-		t.Fatalf("Generate(ShellBash) failed: %v", err)
-	}
-
-	// Verify script contains key elements
-	if !strings.Contains(script, "_kportal()") {
-		t.Error("Bash script missing _kportal function")
-	}
-	if !strings.Contains(script, "complete -F _kportal kportal") {
-		t.Error("Bash script missing completion registration")
-	}
-	if !strings.Contains(script, "--version") {
-		t.Error("Bash script missing --version flag")
-	}
-	if !strings.Contains(script, "generate") {
-		t.Error("Bash script missing generate subcommand")
-	}
-}
-
-func TestGenerateZsh(t *testing.T) {
-	script, err := Generate(ShellZsh)
-	if err != nil {
-		t.Fatalf("Generate(ShellZsh) failed: %v", err)
-	}
-
-	// Verify script contains key elements
-	if !strings.Contains(script, "#compdef kportal") {
-		t.Error("Zsh script missing #compdef directive")
-	}
-	if !strings.Contains(script, "_kportal()") {
-		t.Error("Zsh script missing _kportal function")
-	}
-	if !strings.Contains(script, "'generate:") {
-		t.Error("Zsh script missing generate subcommand")
-	}
-	if !strings.Contains(script, "'--context[") {
-		t.Error("Zsh script missing --context flag")
-	}
-}
-
-func TestGenerateFish(t *testing.T) {
-	script, err := Generate(ShellFish)
-	if err != nil {
-		t.Fatalf("Generate(ShellFish) failed: %v", err)
-	}
-
-	// Verify script contains key elements
-	if !strings.Contains(script, "complete -c kportal") {
-		t.Error("Fish script missing complete directive")
-	}
-	if !strings.Contains(script, "-n '__fish_use_subcommand'") {
-		t.Error("Fish script missing subcommand detection")
-	}
-	if !strings.Contains(script, "-l context") {
-		t.Error("Fish script missing --context flag")
-	}
-}
-
-func TestGenerateUnsupported(t *testing.T) {
-	_, err := Generate(Shell("unsupported"))
-	if err == nil {
-		t.Error("Expected error for unsupported shell")
-	}
-}
-
-func TestAutoDetectShell(t *testing.T) {
-	tests := []struct {
-		name     string
-		shellEnv string
-		expected Shell
-	}{
-		{"bash", "/bin/bash", ShellBash},
-		{"zsh", "/usr/bin/zsh", ShellZsh},
-		{"fish", "/usr/local/bin/fish", ShellFish},
-		{"tcsh", "/bin/tcsh", ShellBash}, // Falls back to bash
-		{"empty", "", ShellBash},         // Falls back to bash
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			detected := autoDetectShellFromEnv(tt.shellEnv)
-			if detected != tt.expected {
-				t.Errorf("AutoDetectShell() = %v, want %v", detected, tt.expected)
-			}
-		})
-	}
-}
-
-// autoDetectShellFromEnv is a test helper that simulates shell detection
-func autoDetectShellFromEnv(shellEnv string) Shell {
-	if shellEnv == "" {
-		return ShellBash
-	}
-	if strings.HasSuffix(shellEnv, "/bash") {
-		return ShellBash
-	}
-	if strings.HasSuffix(shellEnv, "/zsh") {
-		return ShellZsh
-	}
-	if strings.HasSuffix(shellEnv, "/fish") {
-		return ShellFish
-	}
-	return ShellBash
-}
-
-func TestInstaller(t *testing.T) {
-	// Test with bash
-	installer := NewInstaller(ShellBash)
-	if installer.prefixDir == "" {
-		t.Error("Installer should have a prefix directory")
-	}
-
-	// Test filename generation
-	t.Run("filename", func(t *testing.T) {
-		tests := []struct {
-			shell    Shell
-			expected string
-		}{
-			{ShellBash, "_kportal"},
-			{ShellZsh, "_kportal"},
-			{ShellFish, "kportal.fish"},
-		}
-
-		for _, tt := range tests {
-			inst := NewInstaller(tt.shell)
-			got := inst.getCompletionFilename()
-			if got != tt.expected {
-				t.Errorf("getCompletionFilename() for %v = %v, want %v", tt.shell, got, tt.expected)
-			}
-		}
-	})
-}
-
-func TestInstallCompletion(t *testing.T) {
-	// Temp directory (auto-removed by the test framework)
-	tempDir := t.TempDir()
-
-	// Test installation to temp directory
-	installer := &Installer{
-		shell:     ShellBash,
-		prefixDir: tempDir,
-	}
-
-	// Should fail because file doesn't exist (doesn't matter, just test the method exists)
-	_ = installer.Install()
-}
-
-func TestPrint(t *testing.T) {
-	// Test that Print doesn't crash and outputs something
-	orig := os.Stdout
-	r, w, _ := os.Pipe()
-	os.Stdout = w
-
-	err := Print(ShellBash)
-
-	_ = w.Close()
-	os.Stdout = orig
-
-	if err != nil {
-		t.Fatalf("Print(ShellBash) failed: %v", err)
-	}
-
-	// Read output
-	buf := make([]byte, 1024)
-	n, _ := r.Read(buf)
-	output := string(buf[:n])
-
-	if !strings.Contains(output, "_kportal") {
-		t.Error("Print output should contain _kportal")
-	}
-}
-
-func TestGetCompletionFilename(t *testing.T) {
-	tests := []struct {
-		shell    Shell
-		expected string
-	}{
-		{ShellBash, "_kportal"},
-		{ShellZsh, "_kportal"},
-		{ShellFish, "kportal.fish"},
-		{Shell("unknown"), "_kportal"}, // Falls back
-	}
-
-	for _, tt := range tests {
-		inst := &Installer{shell: tt.shell}
-		got := inst.getCompletionFilename()
-		if got != tt.expected {
-			t.Errorf("getCompletionFilename() for %v = %v, want %v", tt.shell, got, tt.expected)
-		}
-	}
-}
-
-func TestBashCompletionIncludesContextCompletion(t *testing.T) {
-	script, err := Generate(ShellBash)
-	if err != nil {
-		t.Fatalf("Generate(ShellBash) failed: %v", err)
-	}
-
-	// Should include kubectl context completion
-	if !strings.Contains(script, "kubectl config get-contexts") {
-		t.Error("Bash completion should include kubectl context completion")
-	}
-}
-
-func TestZshCompletionIncludesContextCompletion(t *testing.T) {
-	script, err := Generate(ShellZsh)
-	if err != nil {
-		t.Fatalf("Generate(ShellZsh) failed: %v", err)
-	}
-
-	// Should include kubectl context completion
-	if !strings.Contains(script, "kubectl config get-contexts") {
-		t.Error("Zsh completion should include kubectl context completion")
-	}
-}
-
-func TestFishCompletionIncludesContextCompletion(t *testing.T) {
-	script, err := Generate(ShellFish)
-	if err != nil {
-		t.Fatalf("Generate(ShellFish) failed: %v", err)
-	}
-
-	// Should include kubectl context completion
-	if !strings.Contains(script, "kubectl config get-contexts") {
-		t.Error("Fish completion should include kubectl context completion")
-	}
-}
-
-func TestAllFlagsPresent(t *testing.T) {
-	script, err := Generate(ShellBash)
-	if err != nil {
-		t.Fatalf("Generate(ShellBash) failed: %v", err)
-	}
-
-	// Check all main flags are present. The main command exposes single-dash
-	// -c/-v (no --config/--verbose long forms); word flags use --.
-	flags := []string{
-		"-c",
-		"-v",
-		"--version",
-		"--update",
-		"--check",
-		"--headless",
-		"--log-format",
-		"--convert",
-		"--convert-output",
-	}
-
-	for _, flag := range flags {
-		if !strings.Contains(script, flag) {
-			t.Errorf("Bash completion missing flag: %s", flag)
-		}
-	}
-}
-
-func TestSubcommandsPresent(t *testing.T) {
-	for _, shell := range []Shell{ShellBash, ShellZsh, ShellFish} {
-		script, err := Generate(shell)
-		if err != nil {
-			t.Fatalf("Generate(%v) failed: %v", shell, err)
-		}
-
-		for _, sub := range []string{"generate", "completion"} {
-			if !strings.Contains(script, sub) {
-				t.Errorf("%s completion missing %q subcommand", shell, sub)
-			}
-		}
-	}
-}
-
-func TestGenerateFlagsPresent(t *testing.T) {
-	script, err := Generate(ShellBash)
-	if err != nil {
-		t.Fatalf("Generate(ShellBash) failed: %v", err)
-	}
-
-	generateFlags := []string{
-		"--context",
-		"--config",
-		"--dry-run",
-	}
-
-	for _, flag := range generateFlags {
-		if !strings.Contains(script, flag) {
-			t.Errorf("Bash completion missing generate flag: %s", flag)
-		}
-	}
-}
-
-func TestCompletionScriptPermissions(t *testing.T) {
-	// Create temp file and verify permissions handling
-	tempDir := t.TempDir()
-
-	installer := &Installer{
-		shell:     ShellBash,
-		prefixDir: tempDir,
-	}
-
-	filename := filepath.Join(tempDir, installer.getCompletionFilename())
-
-	// Write a test file
-	err := os.WriteFile(filename, []byte("test"), 0o600)
-	if err != nil {
-		t.Fatalf("Failed to write test file: %v", err)
-	}
-
-	// Verify file exists and is readable
-	data, err := os.ReadFile(filename)
-	if err != nil {
-		t.Fatalf("Failed to read test file: %v", err)
-	}
-
-	if string(data) != "test" {
-		t.Error("File content mismatch")
-	}
-}

internal/config/config.go

@@ -1,177 +1,15 @@
-// Package config provides configuration loading, validation, watching, and
-// mutation for kportal. It handles parsing the .kportal.yaml configuration
-// file and provides hot-reload support via file watching.
-//
-// The configuration structure supports multiple Kubernetes contexts, each
-// with namespaces containing port-forward definitions. Additional settings
-// for health checks, reliability, and mDNS hostname publishing are also
-// supported.
-//
-// Basic usage:
-//
-//	cfg, err := config.Load("~/.kportal.yaml")
-//	if err != nil {
-//	    log.Fatal(err)
-//	}
-//
-// For hot-reload support, use the ConfigWatcher:
-//
-//	watcher, err := config.NewConfigWatcher(path, func(cfg *config.Config) {
-//	    // Handle configuration changes
-//	})
 package config
 
 import (
-	"bytes"
-	"errors"
 	"fmt"
 	"os"
-	"strings"
-	"time"
 
 	"gopkg.in/yaml.v3"
 )
 
-// ErrConfigNotFound is returned when the configuration file does not exist
-var ErrConfigNotFound = fmt.Errorf("config file not found")
-
-const (
-	// maxConfigSize is the maximum allowed configuration file size (10MB)
-	maxConfigSize = 10 * 1024 * 1024
-
-	// Default health check settings
-	DefaultHealthCheckInterval = 3 * time.Second  // How often to check connection health
-	DefaultHealthCheckTimeout  = 2 * time.Second  // Timeout for health check probes
-	DefaultHealthCheckMethod   = "data-transfer"  // More reliable than tcp-dial
-	DefaultMaxConnectionAge    = 25 * time.Minute // Reconnect before k8s 30min timeout
-	DefaultMaxIdleTime         = 10 * time.Minute // Reconnect if no activity
-
-	// Default reliability settings
-	DefaultTCPKeepalive   = 30 * time.Second // OS-level TCP keepalive interval
-	DefaultDialTimeout    = 30 * time.Second // Connection establishment timeout
-	DefaultWatchdogPeriod = 30 * time.Second // Goroutine health check interval
-
-	// Default HTTP logging settings
-	DefaultHTTPLogMaxBodySize = 1024 * 1024 // 1MB max body size for logging
-)
-
 // Config represents the root configuration structure from .kportal.yaml
 type Config struct {
-	HealthCheck *HealthCheckSpec `yaml:"healthCheck,omitempty"`
-	Reliability *ReliabilitySpec `yaml:"reliability,omitempty"`
-	MDNS        *MDNSSpec        `yaml:"mdns,omitempty"`
-	Contexts    []Context        `yaml:"contexts"`
-}
-
-// MDNSSpec configures mDNS (multicast DNS) hostname publishing
-// When enabled, forwards with aliases can be accessed via <alias>.local hostnames
-type MDNSSpec struct {
-	Enabled bool `yaml:"enabled"` // Enable mDNS hostname publishing
-}
-
-// HealthCheckSpec configures health check behavior
-type HealthCheckSpec struct {
-	Interval         string `yaml:"interval,omitempty"`         // e.g., "3s", "5s"
-	Timeout          string `yaml:"timeout,omitempty"`          // e.g., "2s"
-	Method           string `yaml:"method,omitempty"`           // "tcp-dial" | "data-transfer"
-	MaxConnectionAge string `yaml:"maxConnectionAge,omitempty"` // e.g., "25m" - reconnect before k8s timeout
-	MaxIdleTime      string `yaml:"maxIdleTime,omitempty"`      // e.g., "10m" - reconnect if no activity
-}
-
-// ReliabilitySpec configures connection reliability features
-type ReliabilitySpec struct {
-	TCPKeepalive   string `yaml:"tcpKeepalive,omitempty"`
-	DialTimeout    string `yaml:"dialTimeout,omitempty"`
-	WatchdogPeriod string `yaml:"watchdogPeriod,omitempty"`
-	RetryOnStale   bool   `yaml:"retryOnStale,omitempty"`
-}
-
-// parseDurationOrDefault parses a duration string and returns the default if empty or invalid.
-func parseDurationOrDefault(value string, defaultDur time.Duration) time.Duration {
-	if value == "" {
-		return defaultDur
-	}
-	if d, err := time.ParseDuration(value); err == nil {
-		return d
-	}
-	return defaultDur
-}
-
-// GetHealthCheckIntervalOrDefault returns the health check interval or default value
-func (c *Config) GetHealthCheckIntervalOrDefault() time.Duration {
-	if c.HealthCheck == nil {
-		return DefaultHealthCheckInterval
-	}
-	return parseDurationOrDefault(c.HealthCheck.Interval, DefaultHealthCheckInterval)
-}
-
-// GetHealthCheckTimeoutOrDefault returns the health check timeout or default value
-func (c *Config) GetHealthCheckTimeoutOrDefault() time.Duration {
-	if c.HealthCheck == nil {
-		return DefaultHealthCheckTimeout
-	}
-	return parseDurationOrDefault(c.HealthCheck.Timeout, DefaultHealthCheckTimeout)
-}
-
-// GetHealthCheckMethod returns the health check method or default
-func (c *Config) GetHealthCheckMethod() string {
-	if c.HealthCheck != nil && c.HealthCheck.Method != "" {
-		return c.HealthCheck.Method
-	}
-	return DefaultHealthCheckMethod
-}
-
-// GetMaxConnectionAge returns the max connection age or default
-func (c *Config) GetMaxConnectionAge() time.Duration {
-	if c.HealthCheck == nil {
-		return DefaultMaxConnectionAge
-	}
-	return parseDurationOrDefault(c.HealthCheck.MaxConnectionAge, DefaultMaxConnectionAge)
-}
-
-// GetMaxIdleTime returns the max idle time or default
-func (c *Config) GetMaxIdleTime() time.Duration {
-	if c.HealthCheck == nil {
-		return DefaultMaxIdleTime
-	}
-	return parseDurationOrDefault(c.HealthCheck.MaxIdleTime, DefaultMaxIdleTime)
-}
-
-// GetTCPKeepalive returns the TCP keepalive duration or default
-func (c *Config) GetTCPKeepalive() time.Duration {
-	if c.Reliability == nil {
-		return DefaultTCPKeepalive
-	}
-	return parseDurationOrDefault(c.Reliability.TCPKeepalive, DefaultTCPKeepalive)
-}
-
-// GetRetryOnStale returns whether to retry on stale connections
-func (c *Config) GetRetryOnStale() bool {
-	if c.Reliability != nil {
-		return c.Reliability.RetryOnStale
-	}
-	return true // Default: enabled
-}
-
-// GetWatchdogPeriod returns the goroutine watchdog check period or default
-func (c *Config) GetWatchdogPeriod() time.Duration {
-	if c.Reliability == nil {
-		return DefaultWatchdogPeriod
-	}
-	return parseDurationOrDefault(c.Reliability.WatchdogPeriod, DefaultWatchdogPeriod)
-}
-
-// GetDialTimeout returns the connection dial timeout or default
-func (c *Config) GetDialTimeout() time.Duration {
-	if c.Reliability == nil {
-		return DefaultDialTimeout
-	}
-	return parseDurationOrDefault(c.Reliability.DialTimeout, DefaultDialTimeout)
-}
-
-// IsMDNSEnabled returns whether mDNS hostname publishing is enabled
-func (c *Config) IsMDNSEnabled() bool {
-	return c.MDNS != nil && c.MDNS.Enabled
+	Contexts []Context `yaml:"contexts"`
 }
 
 // Context represents a Kubernetes context with its namespaces
@@ -186,46 +24,18 @@ type Namespace struct {
 	Forwards []Forward `yaml:"forwards"`
 }
 
-// HTTPLogSpec configures HTTP traffic logging for a forward
-type HTTPLogSpec struct {
-	LogFile        string `yaml:"logFile,omitempty"`
-	FilterPath     string `yaml:"filterPath,omitempty"`
-	MaxBodySize    int    `yaml:"maxBodySize,omitempty"`
-	Enabled        bool   `yaml:"enabled"`
-	IncludeHeaders bool   `yaml:"includeHeaders,omitempty"`
-}
-
-// UnmarshalYAML implements custom unmarshaling to support both bool and struct formats
-// Allows: httpLog: true OR httpLog: { enabled: true, ... }
-func (h *HTTPLogSpec) UnmarshalYAML(unmarshal func(interface{}) error) error {
-	// First try to unmarshal as a boolean
-	var boolVal bool
-	if err := unmarshal(&boolVal); err == nil {
-		h.Enabled = boolVal
-		return nil
-	}
-
-	// Otherwise try to unmarshal as a struct
-	type httpLogSpecAlias HTTPLogSpec // Use alias to avoid infinite recursion
-	var spec httpLogSpecAlias
-	if err := unmarshal(&spec); err != nil {
-		return err
-	}
-	*h = HTTPLogSpec(spec)
-	return nil
-}
-
 // Forward represents a single port-forward configuration
 type Forward struct {
-	HTTPLog       *HTTPLogSpec `yaml:"httpLog,omitempty"`
-	Resource      string       `yaml:"resource"`
-	Selector      string       `yaml:"selector"`
-	Protocol      string       `yaml:"protocol"`
-	Alias         string       `yaml:"alias,omitempty"`
+	Resource  string `yaml:"resource"`        // e.g., "pod/my-app", "service/postgres", "pod"
+	Selector  string `yaml:"selector"`        // Label selector for pod resolution (e.g., "app=nginx,env=prod")
+	Protocol  string `yaml:"protocol"`        // tcp or udp
+	Port      int    `yaml:"port"`            // Remote port
+	LocalPort int    `yaml:"localPort"`       // Local port
+	Alias     string `yaml:"alias,omitempty"` // Optional human-readable alias for this forward
+
+	// Runtime fields (not in YAML)
 	contextName   string
 	namespaceName string
-	Port          int `yaml:"port"`
-	LocalPort     int `yaml:"localPort"`
 }
 
 // ID returns a unique identifier for this forward configuration.
@@ -268,54 +78,8 @@ func (f *Forward) GetNamespace() string {
 	return f.namespaceName
 }
 
-// IsHTTPLogEnabled returns true if HTTP logging is enabled for this forward
-func (f *Forward) IsHTTPLogEnabled() bool {
-	return f.HTTPLog != nil && f.HTTPLog.Enabled
-}
-
-// GetHTTPLogMaxBodySize returns the max body size for HTTP logging
-func (f *Forward) GetHTTPLogMaxBodySize() int {
-	if f.HTTPLog == nil || f.HTTPLog.MaxBodySize <= 0 {
-		return DefaultHTTPLogMaxBodySize
-	}
-	return f.HTTPLog.MaxBodySize
-}
-
-// GetMDNSAlias returns the alias to use for mDNS hostname registration.
-// If an explicit alias is set, it returns that.
-// Otherwise, it generates one from the resource name (e.g., "service/logto" -> "logto").
-func (f *Forward) GetMDNSAlias() string {
-	if f.Alias != "" {
-		return f.Alias
-	}
-
-	// Generate alias from resource name
-	// Format is "type/name" (e.g., "service/logto", "pod/my-app")
-	parts := strings.SplitN(f.Resource, "/", 2)
-	if len(parts) == 2 && parts[1] != "" {
-		return parts[1]
-	}
-
-	// Fallback: can't generate a valid alias (e.g., "pod" with selector)
-	return ""
-}
-
 // LoadConfig loads and parses the configuration file from the given path.
 func LoadConfig(path string) (*Config, error) {
-	// Validate file size before reading
-	fileInfo, err := os.Stat(path)
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return nil, ErrConfigNotFound
-		}
-		return nil, fmt.Errorf("failed to stat config file: %w", err)
-	}
-
-	if fileInfo.Size() > maxConfigSize {
-		return nil, fmt.Errorf("config file too large: %d bytes (max %d)", fileInfo.Size(), maxConfigSize)
-	}
-
-	// #nosec G304 -- path is validated in main.go (no system dirs, absolute path)
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read config file: %w", err)
@@ -325,15 +89,9 @@ func LoadConfig(path string) (*Config, error) {
 }
 
 // ParseConfig parses YAML configuration data into a Config struct.
-// It uses strict parsing that rejects unknown keys to catch typos.
 func ParseConfig(data []byte) (*Config, error) {
 	var cfg Config
-
-	// Use decoder with KnownFields to reject unknown keys (catches typos)
-	decoder := yaml.NewDecoder(bytes.NewReader(data))
-	decoder.KnownFields(true)
-
-	if err := decoder.Decode(&cfg); err != nil {
+	if err := yaml.Unmarshal(data, &cfg); err != nil {
 		return nil, fmt.Errorf("failed to parse YAML: %w", err)
 	}
 
@@ -365,57 +123,37 @@ func (c *Config) GetAllForwards() []Forward {
 	return forwards
 }
 
-// NewEmptyConfig returns a minimal empty configuration with no forwards.
-// This is used when creating a new config file for the first time.
-func NewEmptyConfig() *Config {
-	return &Config{
-		Contexts: []Context{},
+// GetForwardsByContext returns all forwards for a specific context.
+func (c *Config) GetForwardsByContext(contextName string) []Forward {
+	var forwards []Forward
+
+	for _, ctx := range c.Contexts {
+		if ctx.Name == contextName {
+			for _, ns := range ctx.Namespaces {
+				forwards = append(forwards, ns.Forwards...)
+			}
+			break
+		}
 	}
+
+	return forwards
 }
 
-// IsEmpty returns true if the configuration has no forwards defined.
-func (c *Config) IsEmpty() bool {
-	return len(c.Contexts) == 0 || len(c.GetAllForwards()) == 0
-}
-
-// CreateEmptyConfigFile creates a new empty configuration file at the given path.
-// Returns an error if the file already exists or cannot be created.
-func CreateEmptyConfigFile(path string) error {
-	// Check if file already exists
-	if _, err := os.Stat(path); err == nil {
-		return fmt.Errorf("config file already exists: %s", path)
-	} else if !errors.Is(err, os.ErrNotExist) {
-		return fmt.Errorf("failed to check config file: %w", err)
-	}
-
-	cfg := NewEmptyConfig()
-	data, err := yaml.Marshal(cfg)
-	if err != nil {
-		return fmt.Errorf("failed to marshal empty config: %w", err)
-	}
-
-	// Add a helpful comment header
-	header := `# kportal configuration file
-# Add port forwards using the 'n' key in the TUI, or manually add them below.
-#
-# Example forward:
-#   contexts:
-#     - name: my-cluster
-#       namespaces:
-#         - name: default
-#           forwards:
-#             - resource: service/my-service
-#               protocol: tcp
-#               port: 8080
-#               localPort: 8080
-#
-`
-	content := header + string(data)
-
-	// Write with restrictive permissions (0600)
-	if err := os.WriteFile(path, []byte(content), 0600); err != nil {
-		return fmt.Errorf("failed to write config file: %w", err)
-	}
-
-	return nil
+// GetForwardsByNamespace returns all forwards for a specific context and namespace.
+func (c *Config) GetForwardsByNamespace(contextName, namespaceName string) []Forward {
+	var forwards []Forward
+
+	for _, ctx := range c.Contexts {
+		if ctx.Name == contextName {
+			for _, ns := range ctx.Namespaces {
+				if ns.Name == namespaceName {
+					forwards = append(forwards, ns.Forwards...)
+					break
+				}
+			}
+			break
+		}
+	}
+
+	return forwards
 }

internal/config/config_getters_test.go

@@ -1,703 +0,0 @@
-package config
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestParseDurationOrDefault tests the duration parsing helper
-func TestParseDurationOrDefault(t *testing.T) {
-	tests := []struct {
-		name       string
-		value      string
-		defaultDur time.Duration
-		expected   time.Duration
-	}{
-		{"empty string returns default", "", 5 * time.Second, 5 * time.Second},
-		{"valid duration seconds", "3s", 5 * time.Second, 3 * time.Second},
-		{"valid duration minutes", "25m", 5 * time.Second, 25 * time.Minute},
-		{"valid duration hours", "1h", 5 * time.Second, 1 * time.Hour},
-		{"valid duration milliseconds", "100ms", 5 * time.Second, 100 * time.Millisecond},
-		{"invalid duration returns default", "invalid", 5 * time.Second, 5 * time.Second},
-		{"missing unit returns default", "30", 5 * time.Second, 5 * time.Second},
-		{"negative duration", "-5s", 5 * time.Second, -5 * time.Second}, // time.ParseDuration accepts negative
-		{"complex duration", "1h30m", 5 * time.Second, 1*time.Hour + 30*time.Minute},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := parseDurationOrDefault(tt.value, tt.defaultDur)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestConfig_GetHealthCheckIntervalOrDefault tests health check interval getter
-func TestConfig_GetHealthCheckIntervalOrDefault(t *testing.T) {
-	tests := []struct {
-		config   *Config
-		name     string
-		expected time.Duration
-	}{
-		{
-			name:     "nil health check returns default",
-			config:   &Config{},
-			expected: DefaultHealthCheckInterval,
-		},
-		{
-			name: "empty interval returns default",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{},
-			},
-			expected: DefaultHealthCheckInterval,
-		},
-		{
-			name: "valid interval",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{Interval: "5s"},
-			},
-			expected: 5 * time.Second,
-		},
-		{
-			name: "invalid interval returns default",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{Interval: "invalid"},
-			},
-			expected: DefaultHealthCheckInterval,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.config.GetHealthCheckIntervalOrDefault()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestConfig_GetHealthCheckTimeoutOrDefault tests health check timeout getter
-func TestConfig_GetHealthCheckTimeoutOrDefault(t *testing.T) {
-	tests := []struct {
-		config   *Config
-		name     string
-		expected time.Duration
-	}{
-		{
-			name:     "nil health check returns default",
-			config:   &Config{},
-			expected: DefaultHealthCheckTimeout,
-		},
-		{
-			name: "empty timeout returns default",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{},
-			},
-			expected: DefaultHealthCheckTimeout,
-		},
-		{
-			name: "valid timeout",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{Timeout: "1s"},
-			},
-			expected: 1 * time.Second,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.config.GetHealthCheckTimeoutOrDefault()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestConfig_GetHealthCheckMethod tests health check method getter
-func TestConfig_GetHealthCheckMethod(t *testing.T) {
-	tests := []struct {
-		name     string
-		config   *Config
-		expected string
-	}{
-		{
-			name:     "nil health check returns default",
-			config:   &Config{},
-			expected: DefaultHealthCheckMethod,
-		},
-		{
-			name: "empty method returns default",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{},
-			},
-			expected: DefaultHealthCheckMethod,
-		},
-		{
-			name: "tcp-dial method",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{Method: "tcp-dial"},
-			},
-			expected: "tcp-dial",
-		},
-		{
-			name: "data-transfer method",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{Method: "data-transfer"},
-			},
-			expected: "data-transfer",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.config.GetHealthCheckMethod()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestConfig_GetMaxConnectionAge tests max connection age getter
-func TestConfig_GetMaxConnectionAge(t *testing.T) {
-	tests := []struct {
-		config   *Config
-		name     string
-		expected time.Duration
-	}{
-		{
-			name:     "nil health check returns default",
-			config:   &Config{},
-			expected: DefaultMaxConnectionAge,
-		},
-		{
-			name: "empty max age returns default",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{},
-			},
-			expected: DefaultMaxConnectionAge,
-		},
-		{
-			name: "valid max age",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{MaxConnectionAge: "20m"},
-			},
-			expected: 20 * time.Minute,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.config.GetMaxConnectionAge()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestConfig_GetMaxIdleTime tests max idle time getter
-func TestConfig_GetMaxIdleTime(t *testing.T) {
-	tests := []struct {
-		config   *Config
-		name     string
-		expected time.Duration
-	}{
-		{
-			name:     "nil health check returns default",
-			config:   &Config{},
-			expected: DefaultMaxIdleTime,
-		},
-		{
-			name: "empty max idle returns default",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{},
-			},
-			expected: DefaultMaxIdleTime,
-		},
-		{
-			name: "valid max idle",
-			config: &Config{
-				HealthCheck: &HealthCheckSpec{MaxIdleTime: "5m"},
-			},
-			expected: 5 * time.Minute,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.config.GetMaxIdleTime()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestConfig_GetTCPKeepalive tests TCP keepalive getter
-func TestConfig_GetTCPKeepalive(t *testing.T) {
-	tests := []struct {
-		config   *Config
-		name     string
-		expected time.Duration
-	}{
-		{
-			name:     "nil reliability returns default",
-			config:   &Config{},
-			expected: DefaultTCPKeepalive,
-		},
-		{
-			name: "empty keepalive returns default",
-			config: &Config{
-				Reliability: &ReliabilitySpec{},
-			},
-			expected: DefaultTCPKeepalive,
-		},
-		{
-			name: "valid keepalive",
-			config: &Config{
-				Reliability: &ReliabilitySpec{TCPKeepalive: "15s"},
-			},
-			expected: 15 * time.Second,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.config.GetTCPKeepalive()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestConfig_GetRetryOnStale tests retry on stale getter
-func TestConfig_GetRetryOnStale(t *testing.T) {
-	tests := []struct {
-		config   *Config
-		name     string
-		expected bool
-	}{
-		{
-			name:     "nil reliability returns default true",
-			config:   &Config{},
-			expected: true,
-		},
-		{
-			name: "explicit false",
-			config: &Config{
-				Reliability: &ReliabilitySpec{RetryOnStale: false},
-			},
-			expected: false,
-		},
-		{
-			name: "explicit true",
-			config: &Config{
-				Reliability: &ReliabilitySpec{RetryOnStale: true},
-			},
-			expected: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.config.GetRetryOnStale()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestConfig_GetWatchdogPeriod tests watchdog period getter
-func TestConfig_GetWatchdogPeriod(t *testing.T) {
-	tests := []struct {
-		config   *Config
-		name     string
-		expected time.Duration
-	}{
-		{
-			name:     "nil reliability returns default",
-			config:   &Config{},
-			expected: DefaultWatchdogPeriod,
-		},
-		{
-			name: "empty period returns default",
-			config: &Config{
-				Reliability: &ReliabilitySpec{},
-			},
-			expected: DefaultWatchdogPeriod,
-		},
-		{
-			name: "valid period",
-			config: &Config{
-				Reliability: &ReliabilitySpec{WatchdogPeriod: "1m"},
-			},
-			expected: 1 * time.Minute,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.config.GetWatchdogPeriod()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestConfig_GetDialTimeout tests dial timeout getter
-func TestConfig_GetDialTimeout(t *testing.T) {
-	tests := []struct {
-		config   *Config
-		name     string
-		expected time.Duration
-	}{
-		{
-			name:     "nil reliability returns default",
-			config:   &Config{},
-			expected: DefaultDialTimeout,
-		},
-		{
-			name: "empty timeout returns default",
-			config: &Config{
-				Reliability: &ReliabilitySpec{},
-			},
-			expected: DefaultDialTimeout,
-		},
-		{
-			name: "valid timeout",
-			config: &Config{
-				Reliability: &ReliabilitySpec{DialTimeout: "10s"},
-			},
-			expected: 10 * time.Second,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.config.GetDialTimeout()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestConfig_IsMDNSEnabled tests mDNS enabled getter
-func TestConfig_IsMDNSEnabled(t *testing.T) {
-	tests := []struct {
-		config   *Config
-		name     string
-		expected bool
-	}{
-		{
-			name:     "nil MDNS returns false",
-			config:   &Config{},
-			expected: false,
-		},
-		{
-			name: "MDNS disabled",
-			config: &Config{
-				MDNS: &MDNSSpec{Enabled: false},
-			},
-			expected: false,
-		},
-		{
-			name: "MDNS enabled",
-			config: &Config{
-				MDNS: &MDNSSpec{Enabled: true},
-			},
-			expected: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.config.IsMDNSEnabled()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestForward_IsHTTPLogEnabled tests HTTP log enabled check
-func TestForward_IsHTTPLogEnabled(t *testing.T) {
-	tests := []struct {
-		name     string
-		forward  Forward
-		expected bool
-	}{
-		{
-			name:     "nil HTTPLog",
-			forward:  Forward{Resource: "pod/app", Port: 8080, LocalPort: 8080},
-			expected: false,
-		},
-		{
-			name: "HTTPLog disabled",
-			forward: Forward{
-				Resource:  "pod/app",
-				Port:      8080,
-				LocalPort: 8080,
-				HTTPLog:   &HTTPLogSpec{Enabled: false},
-			},
-			expected: false,
-		},
-		{
-			name: "HTTPLog enabled",
-			forward: Forward{
-				Resource:  "pod/app",
-				Port:      8080,
-				LocalPort: 8080,
-				HTTPLog:   &HTTPLogSpec{Enabled: true},
-			},
-			expected: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.forward.IsHTTPLogEnabled()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestForward_GetHTTPLogMaxBodySize tests HTTP log max body size
-func TestForward_GetHTTPLogMaxBodySize(t *testing.T) {
-	tests := []struct {
-		name     string
-		forward  Forward
-		expected int
-	}{
-		{
-			name:     "nil HTTPLog returns default",
-			forward:  Forward{Resource: "pod/app", Port: 8080, LocalPort: 8080},
-			expected: DefaultHTTPLogMaxBodySize,
-		},
-		{
-			name: "zero max body size returns default",
-			forward: Forward{
-				Resource:  "pod/app",
-				Port:      8080,
-				LocalPort: 8080,
-				HTTPLog:   &HTTPLogSpec{MaxBodySize: 0},
-			},
-			expected: DefaultHTTPLogMaxBodySize,
-		},
-		{
-			name: "negative max body size returns default",
-			forward: Forward{
-				Resource:  "pod/app",
-				Port:      8080,
-				LocalPort: 8080,
-				HTTPLog:   &HTTPLogSpec{MaxBodySize: -100},
-			},
-			expected: DefaultHTTPLogMaxBodySize,
-		},
-		{
-			name: "custom max body size",
-			forward: Forward{
-				Resource:  "pod/app",
-				Port:      8080,
-				LocalPort: 8080,
-				HTTPLog:   &HTTPLogSpec{MaxBodySize: 2048},
-			},
-			expected: 2048,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.forward.GetHTTPLogMaxBodySize()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestForward_GetMDNSAlias tests mDNS alias generation
-func TestForward_GetMDNSAlias(t *testing.T) {
-	tests := []struct {
-		name     string
-		expected string
-		forward  Forward
-	}{
-		{
-			name: "explicit alias",
-			forward: Forward{
-				Resource:  "pod/my-app",
-				Port:      8080,
-				LocalPort: 8080,
-				Alias:     "my-custom-alias",
-			},
-			expected: "my-custom-alias",
-		},
-		{
-			name: "pod with name - extracts name",
-			forward: Forward{
-				Resource:  "pod/my-app",
-				Port:      8080,
-				LocalPort: 8080,
-			},
-			expected: "my-app",
-		},
-		{
-			name: "service with name - extracts name",
-			forward: Forward{
-				Resource:  "service/postgres",
-				Port:      5432,
-				LocalPort: 5432,
-			},
-			expected: "postgres",
-		},
-		{
-			name: "pod without name (selector-based) - returns empty",
-			forward: Forward{
-				Resource:  "pod",
-				Selector:  "app=nginx",
-				Port:      80,
-				LocalPort: 8080,
-			},
-			expected: "",
-		},
-		{
-			name: "empty resource - returns empty",
-			forward: Forward{
-				Resource:  "",
-				Port:      8080,
-				LocalPort: 8080,
-			},
-			expected: "",
-		},
-		{
-			name: "resource with empty name after slash",
-			forward: Forward{
-				Resource:  "pod/",
-				Port:      8080,
-				LocalPort: 8080,
-			},
-			expected: "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.forward.GetMDNSAlias()
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestLoadConfig_FileTooLarge tests file size limit
-func TestLoadConfig_FileTooLarge(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create a file larger than maxConfigSize (10MB)
-	// We'll use a smaller buffer to avoid memory issues
-	// Just verify the check happens by creating a file slightly over 10MB
-	largeData := make([]byte, 10*1024*1024+1) // 10MB + 1 byte
-	for i := range largeData {
-		largeData[i] = 'a'
-	}
-
-	err := os.WriteFile(configPath, largeData, 0600)
-	require.NoError(t, err)
-
-	cfg, err := LoadConfig(configPath)
-	assert.Error(t, err)
-	assert.Nil(t, cfg)
-	assert.Contains(t, err.Error(), "config file too large")
-}
-
-// TestLoadConfig_WithHealthCheckAndReliability tests parsing with all config sections
-func TestLoadConfig_WithHealthCheckAndReliability(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	yaml := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-healthCheck:
-  interval: "5s"
-  timeout: "1s"
-  method: "tcp-dial"
-  maxConnectionAge: "20m"
-  maxIdleTime: "5m"
-reliability:
-  tcpKeepalive: "15s"
-  dialTimeout: "10s"
-  retryOnStale: true
-  watchdogPeriod: "1m"
-mdns:
-  enabled: true
-`
-
-	err := os.WriteFile(configPath, []byte(yaml), 0600)
-	require.NoError(t, err)
-
-	cfg, err := LoadConfig(configPath)
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
-	// Verify health check settings
-	assert.Equal(t, 5*time.Second, cfg.GetHealthCheckIntervalOrDefault())
-	assert.Equal(t, 1*time.Second, cfg.GetHealthCheckTimeoutOrDefault())
-	assert.Equal(t, "tcp-dial", cfg.GetHealthCheckMethod())
-	assert.Equal(t, 20*time.Minute, cfg.GetMaxConnectionAge())
-	assert.Equal(t, 5*time.Minute, cfg.GetMaxIdleTime())
-
-	// Verify reliability settings
-	assert.Equal(t, 15*time.Second, cfg.GetTCPKeepalive())
-	assert.Equal(t, 10*time.Second, cfg.GetDialTimeout())
-	assert.True(t, cfg.GetRetryOnStale())
-	assert.Equal(t, 1*time.Minute, cfg.GetWatchdogPeriod())
-
-	// Verify mDNS
-	assert.True(t, cfg.IsMDNSEnabled())
-}
-
-// TestParseConfig_RejectsUnknownKeys tests strict parsing
-func TestParseConfig_RejectsUnknownKeys(t *testing.T) {
-	yaml := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-unknownKey: value
-`
-
-	cfg, err := ParseConfig([]byte(yaml))
-	assert.Error(t, err)
-	assert.Nil(t, cfg)
-	assert.Contains(t, err.Error(), "failed to parse YAML")
-}
-
-// TestHTTPLogSpec_FullStruct tests full HTTPLogSpec parsing
-func TestHTTPLogSpec_FullStruct(t *testing.T) {
-	yaml := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: service/api
-            port: 8080
-            localPort: 8080
-            httpLog:
-              enabled: true
-              logFile: "/tmp/http.log"
-              maxBodySize: 2048
-              includeHeaders: true
-              filterPath: "/api/*"
-`
-
-	cfg, err := ParseConfig([]byte(yaml))
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
-	fwd := cfg.Contexts[0].Namespaces[0].Forwards[0]
-	require.NotNil(t, fwd.HTTPLog)
-	assert.True(t, fwd.HTTPLog.Enabled)
-	assert.Equal(t, "/tmp/http.log", fwd.HTTPLog.LogFile)
-	assert.Equal(t, 2048, fwd.HTTPLog.MaxBodySize)
-	assert.True(t, fwd.HTTPLog.IncludeHeaders)
-	assert.Equal(t, "/api/*", fwd.HTTPLog.FilterPath)
-}

internal/config/config_test.go

@@ -39,7 +39,7 @@ func TestLoadConfig_ValidYAML(t *testing.T) {
             localPort: 8081
 `
 
-	err := os.WriteFile(configPath, []byte(validYAML), 0600)
+	err := os.WriteFile(configPath, []byte(validYAML), 0644)
 	assert.NoError(t, err, "should write temp config file")
 
 	// Load the config
@@ -82,7 +82,7 @@ func TestLoadConfig_InvalidYAML(t *testing.T) {
         forwards: [this is invalid yaml syntax
 `
 
-	err := os.WriteFile(configPath, []byte(invalidYAML), 0600)
+	err := os.WriteFile(configPath, []byte(invalidYAML), 0644)
 	assert.NoError(t, err, "should write temp config file")
 
 	// Load the config
@@ -97,14 +97,14 @@ func TestLoadConfig_FileNotFound(t *testing.T) {
 	cfg, err := LoadConfig("/non/existent/path/.kportal.yaml")
 	assert.Error(t, err, "LoadConfig should fail with non-existent file")
 	assert.Nil(t, cfg, "config should be nil on error")
-	assert.Equal(t, ErrConfigNotFound, err, "should return ErrConfigNotFound")
+	assert.Contains(t, err.Error(), "failed to read config file", "error should mention read failure")
 }
 
 func TestForward_ID(t *testing.T) {
 	tests := []struct {
 		name       string
-		expectedID string
 		forward    Forward
+		expectedID string
 	}{
 		{
 			name: "pod with explicit name",
@@ -165,8 +165,8 @@ func TestForward_ID(t *testing.T) {
 func TestForward_String(t *testing.T) {
 	tests := []struct {
 		name           string
-		expectedString string
 		forward        Forward
+		expectedString string
 	}{
 		{
 			name: "pod without selector",
@@ -298,6 +298,72 @@ func TestConfig_GetAllForwards(t *testing.T) {
 	assert.Len(t, forwards, 4, "should return all forwards from all contexts and namespaces")
 }
 
+func TestConfig_GetForwardsByContext(t *testing.T) {
+	yamlData := []byte(`contexts:
+  - name: cluster1
+    namespaces:
+      - name: ns1
+        forwards:
+          - resource: pod/app1
+            port: 8080
+            localPort: 8080
+          - resource: pod/app2
+            port: 8081
+            localPort: 8081
+  - name: cluster2
+    namespaces:
+      - name: ns2
+        forwards:
+          - resource: pod/app3
+            port: 9090
+            localPort: 9090
+`)
+
+	cfg, err := ParseConfig(yamlData)
+	assert.NoError(t, err)
+
+	forwards := cfg.GetForwardsByContext("cluster1")
+	assert.Len(t, forwards, 2, "should return forwards only from cluster1")
+
+	forwards2 := cfg.GetForwardsByContext("cluster2")
+	assert.Len(t, forwards2, 1, "should return forwards only from cluster2")
+
+	forwards3 := cfg.GetForwardsByContext("non-existent")
+	assert.Len(t, forwards3, 0, "should return empty slice for non-existent context")
+}
+
+func TestConfig_GetForwardsByNamespace(t *testing.T) {
+	yamlData := []byte(`contexts:
+  - name: cluster1
+    namespaces:
+      - name: ns1
+        forwards:
+          - resource: pod/app1
+            port: 8080
+            localPort: 8080
+          - resource: pod/app2
+            port: 8081
+            localPort: 8081
+      - name: ns2
+        forwards:
+          - resource: pod/app3
+            port: 9090
+            localPort: 9090
+`)
+
+	cfg, err := ParseConfig(yamlData)
+	assert.NoError(t, err)
+
+	forwards := cfg.GetForwardsByNamespace("cluster1", "ns1")
+	assert.Len(t, forwards, 2, "should return forwards only from cluster1/ns1")
+
+	forwards2 := cfg.GetForwardsByNamespace("cluster1", "ns2")
+	assert.Len(t, forwards2, 1, "should return forwards only from cluster1/ns2")
+
+	forwards3 := cfg.GetForwardsByNamespace("cluster1", "non-existent")
+	assert.Len(t, forwards3, 0, "should return empty slice for non-existent namespace")
+}
+
 func TestForward_SetContext(t *testing.T) {
 	fwd := Forward{
 		Resource:  "pod/my-app",
@@ -313,205 +379,3 @@ func TestForward_SetContext(t *testing.T) {
 	assert.Equal(t, "my-cluster", fwd.GetContext())
 	assert.Equal(t, "my-namespace", fwd.GetNamespace())
 }
-
-func TestHTTPLogSpec_UnmarshalYAML(t *testing.T) {
-	tests := []struct {
-		name     string
-		yaml     string
-		expected bool
-	}{
-		{
-			name: "httpLog as boolean true",
-			yaml: `contexts:
-  - name: test
-    namespaces:
-      - name: default
-        forwards:
-          - resource: service/api
-            port: 8080
-            localPort: 8080
-            httpLog: true
-`,
-			expected: true,
-		},
-		{
-			name: "httpLog as boolean false",
-			yaml: `contexts:
-  - name: test
-    namespaces:
-      - name: default
-        forwards:
-          - resource: service/api
-            port: 8080
-            localPort: 8080
-            httpLog: false
-`,
-			expected: false,
-		},
-		{
-			name: "httpLog as struct",
-			yaml: `contexts:
-  - name: test
-    namespaces:
-      - name: default
-        forwards:
-          - resource: service/api
-            port: 8080
-            localPort: 8080
-            httpLog:
-              enabled: true
-              includeHeaders: true
-`,
-			expected: true,
-		},
-		{
-			name: "httpLog not specified",
-			yaml: `contexts:
-  - name: test
-    namespaces:
-      - name: default
-        forwards:
-          - resource: service/api
-            port: 8080
-            localPort: 8080
-`,
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg, err := ParseConfig([]byte(tt.yaml))
-			assert.NoError(t, err)
-			assert.NotNil(t, cfg)
-
-			fwd := cfg.Contexts[0].Namespaces[0].Forwards[0]
-			if tt.expected {
-				assert.NotNil(t, fwd.HTTPLog, "HTTPLog should not be nil")
-				assert.True(t, fwd.HTTPLog.Enabled, "HTTPLog.Enabled should be true")
-			} else if fwd.HTTPLog != nil {
-				assert.False(t, fwd.HTTPLog.Enabled, "HTTPLog.Enabled should be false")
-			}
-		})
-	}
-}
-
-func TestNewEmptyConfig(t *testing.T) {
-	cfg := NewEmptyConfig()
-	assert.NotNil(t, cfg, "NewEmptyConfig should return non-nil config")
-	assert.Empty(t, cfg.Contexts, "NewEmptyConfig should have empty contexts")
-	assert.True(t, cfg.IsEmpty(), "NewEmptyConfig should be considered empty")
-}
-
-func TestConfig_IsEmpty(t *testing.T) {
-	tests := []struct {
-		config   *Config
-		name     string
-		expected bool
-	}{
-		{
-			name:     "nil contexts",
-			config:   &Config{},
-			expected: true,
-		},
-		{
-			name:     "empty contexts slice",
-			config:   &Config{Contexts: []Context{}},
-			expected: true,
-		},
-		{
-			name: "context with empty namespaces",
-			config: &Config{
-				Contexts: []Context{
-					{Name: "test", Namespaces: []Namespace{}},
-				},
-			},
-			expected: true,
-		},
-		{
-			name: "context with namespace but no forwards",
-			config: &Config{
-				Contexts: []Context{
-					{
-						Name: "test",
-						Namespaces: []Namespace{
-							{Name: "default", Forwards: []Forward{}},
-						},
-					},
-				},
-			},
-			expected: true,
-		},
-		{
-			name: "config with forward",
-			config: &Config{
-				Contexts: []Context{
-					{
-						Name: "test",
-						Namespaces: []Namespace{
-							{
-								Name: "default",
-								Forwards: []Forward{
-									{Resource: "pod/app", Port: 8080, LocalPort: 8080},
-								},
-							},
-						},
-					},
-				},
-			},
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, tt.config.IsEmpty())
-		})
-	}
-}
-
-func TestCreateEmptyConfigFile(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create empty config file
-	err := CreateEmptyConfigFile(configPath)
-	assert.NoError(t, err, "CreateEmptyConfigFile should succeed")
-
-	// Verify file exists
-	_, err = os.Stat(configPath)
-	assert.NoError(t, err, "config file should exist")
-
-	// Verify file is readable and parseable
-	cfg, err := LoadConfig(configPath)
-	assert.NoError(t, err, "should be able to load created config")
-	assert.NotNil(t, cfg, "config should not be nil")
-	assert.True(t, cfg.IsEmpty(), "created config should be empty")
-
-	// Verify file permissions (0600)
-	info, _ := os.Stat(configPath)
-	assert.Equal(t, os.FileMode(0600), info.Mode().Perm(), "file should have 0600 permissions")
-
-	// Verify file contains helpful header
-	content, _ := os.ReadFile(configPath)
-	assert.Contains(t, string(content), "# kportal configuration file", "should contain header comment")
-	assert.Contains(t, string(content), "Example forward", "should contain example")
-}
-
-func TestCreateEmptyConfigFile_AlreadyExists(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create existing file
-	err := os.WriteFile(configPath, []byte("existing content"), 0600)
-	assert.NoError(t, err)
-
-	// Try to create config file - should fail
-	err = CreateEmptyConfigFile(configPath)
-	assert.Error(t, err, "CreateEmptyConfigFile should fail when file exists")
-	assert.Contains(t, err.Error(), "already exists")
-
-	// Verify original content is preserved
-	content, _ := os.ReadFile(configPath)
-	assert.Equal(t, "existing content", string(content))
-}

internal/config/mutator.go

@@ -1,273 +0,0 @@
-package config
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"sync"
-
-	"gopkg.in/yaml.v3"
-)
-
-// Mutator provides safe, atomic mutations to the kportal configuration file.
-// All operations use atomic file writes (write to temp, then rename) to prevent
-// corruption and ensure the file watcher picks up changes.
-type Mutator struct {
-	configPath string
-	mu         sync.Mutex // Ensure only one mutation at a time
-}
-
-// NewMutator creates a new configuration mutator for the given config file path.
-func NewMutator(configPath string) *Mutator {
-	return &Mutator{
-		configPath: configPath,
-	}
-}
-
-// findOrCreateContext finds an existing context or creates a new one
-func (m *Mutator) findOrCreateContext(cfg *Config, contextName string) *Context {
-	for i := range cfg.Contexts {
-		if cfg.Contexts[i].Name == contextName {
-			return &cfg.Contexts[i]
-		}
-	}
-
-	// Create new context
-	cfg.Contexts = append(cfg.Contexts, Context{
-		Name:       contextName,
-		Namespaces: []Namespace{},
-	})
-	return &cfg.Contexts[len(cfg.Contexts)-1]
-}
-
-// findOrCreateNamespace finds an existing namespace or creates a new one
-func (m *Mutator) findOrCreateNamespace(ctx *Context, namespaceName string) *Namespace {
-	for i := range ctx.Namespaces {
-		if ctx.Namespaces[i].Name == namespaceName {
-			return &ctx.Namespaces[i]
-		}
-	}
-
-	// Create new namespace
-	ctx.Namespaces = append(ctx.Namespaces, Namespace{
-		Name:     namespaceName,
-		Forwards: []Forward{},
-	})
-	return &ctx.Namespaces[len(ctx.Namespaces)-1]
-}
-
-// AddForward adds a new port forward to the configuration.
-// If the context or namespace doesn't exist, they will be created.
-// The new configuration is validated before writing.
-// Returns an error if the port is already in use or validation fails.
-func (m *Mutator) AddForward(contextName, namespaceName string, fwd Forward) error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	// Load current config
-	cfg, err := LoadConfig(m.configPath)
-	if err != nil {
-		// If file doesn't exist, create empty config
-		if os.IsNotExist(err) {
-			cfg = &Config{Contexts: []Context{}}
-		} else {
-			return fmt.Errorf("failed to load config: %w", err)
-		}
-	}
-
-	// Find or create context and namespace
-	targetContext := m.findOrCreateContext(cfg, contextName)
-	targetNamespace := m.findOrCreateNamespace(targetContext, namespaceName)
-
-	// Set context/namespace on the forward for validation
-	fwd.SetContext(contextName, namespaceName)
-
-	// Check for duplicate local port
-	allForwards := cfg.GetAllForwards()
-	for _, existing := range allForwards {
-		if existing.LocalPort == fwd.LocalPort {
-			return fmt.Errorf("port %d is already in use by %s", fwd.LocalPort, existing.String())
-		}
-	}
-
-	// Add the forward
-	targetNamespace.Forwards = append(targetNamespace.Forwards, fwd)
-
-	// Validate the new configuration
-	validator := NewValidator()
-	if errs := validator.ValidateConfig(cfg); len(errs) > 0 {
-		return fmt.Errorf("validation failed: %s", FormatValidationErrors(errs))
-	}
-
-	// Write atomically
-	return m.writeAtomic(cfg)
-}
-
-// RemoveForwards removes forwards matching the predicate function.
-// The predicate receives the context, namespace, and forward, and should return true
-// to remove that forward.
-// Empty namespaces and contexts are preserved (not automatically removed).
-func (m *Mutator) RemoveForwards(predicate func(ctx, ns string, fwd Forward) bool) error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	// Load current config
-	cfg, err := LoadConfig(m.configPath)
-	if err != nil {
-		return fmt.Errorf("failed to load config: %w", err)
-	}
-
-	// Iterate and filter
-	for i := range cfg.Contexts {
-		ctx := &cfg.Contexts[i]
-		filteredNamespaces := []Namespace{}
-
-		for j := range ctx.Namespaces {
-			ns := &ctx.Namespaces[j]
-
-			// Filter forwards
-			filtered := []Forward{}
-			for _, fwd := range ns.Forwards {
-				// CRITICAL: Set context/namespace so fwd.ID() generates correct ID
-				fwd.SetContext(ctx.Name, ns.Name)
-
-				if !predicate(ctx.Name, ns.Name, fwd) {
-					// Keep this forward
-					filtered = append(filtered, fwd)
-				}
-			}
-
-			ns.Forwards = filtered
-
-			// Only keep namespaces that have at least one forward
-			if len(ns.Forwards) > 0 {
-				filteredNamespaces = append(filteredNamespaces, *ns)
-			}
-		}
-
-		ctx.Namespaces = filteredNamespaces
-	}
-
-	// Validate the new configuration
-	validator := NewValidator()
-	if errs := validator.ValidateConfig(cfg); len(errs) > 0 {
-		return fmt.Errorf("validation failed: %s", FormatValidationErrors(errs))
-	}
-
-	// Write atomically
-	return m.writeAtomic(cfg)
-}
-
-// RemoveForwardByID removes a specific forward by its ID.
-func (m *Mutator) RemoveForwardByID(id string) error {
-	return m.RemoveForwards(func(ctx, ns string, fwd Forward) bool {
-		return fwd.ID() == id
-	})
-}
-
-// UpdateForward atomically replaces an existing forward with a new one.
-// This is used for editing - it removes the old forward and adds the new one in a single transaction.
-// If the old forward doesn't exist, returns an error.
-// If the new forward validation fails, the operation is rolled back (old forward remains).
-func (m *Mutator) UpdateForward(oldID, newContextName, newNamespaceName string, newFwd Forward) error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	// Load current config
-	cfg, err := LoadConfig(m.configPath)
-	if err != nil {
-		return fmt.Errorf("failed to load config: %w", err)
-	}
-
-	// First, verify the old forward exists and remove it
-	oldForwardFound := false
-	for i := range cfg.Contexts {
-		ctx := &cfg.Contexts[i]
-		for j := range ctx.Namespaces {
-			ns := &ctx.Namespaces[j]
-
-			// Filter forwards, removing the old one
-			filtered := []Forward{}
-			for _, fwd := range ns.Forwards {
-				// CRITICAL: Set context/namespace so fwd.ID() generates correct ID
-				fwd.SetContext(ctx.Name, ns.Name)
-
-				if fwd.ID() == oldID {
-					oldForwardFound = true
-					// Skip this forward (remove it)
-					continue
-				}
-
-				// Keep this forward
-				filtered = append(filtered, fwd)
-			}
-
-			ns.Forwards = filtered
-		}
-	}
-
-	if !oldForwardFound {
-		return fmt.Errorf("forward with ID %s not found", oldID)
-	}
-
-	// Now add the new forward
-	// Find or create context and namespace
-	targetContext := m.findOrCreateContext(cfg, newContextName)
-	targetNamespace := m.findOrCreateNamespace(targetContext, newNamespaceName)
-
-	// Set context/namespace on the forward for validation
-	newFwd.SetContext(newContextName, newNamespaceName)
-
-	// Check for duplicate local port (excluding the one we just removed)
-	allForwards := cfg.GetAllForwards()
-	for _, existing := range allForwards {
-		if existing.LocalPort == newFwd.LocalPort && existing.ID() != oldID {
-			return fmt.Errorf("port %d is already in use by %s", newFwd.LocalPort, existing.String())
-		}
-	}
-
-	// Add the new forward
-	targetNamespace.Forwards = append(targetNamespace.Forwards, newFwd)
-
-	// Validate the new configuration
-	validator := NewValidator()
-	if errs := validator.ValidateConfig(cfg); len(errs) > 0 {
-		return fmt.Errorf("validation failed: %s", FormatValidationErrors(errs))
-	}
-
-	// Write atomically
-	return m.writeAtomic(cfg)
-}
-
-// writeAtomic writes the configuration atomically to prevent corruption.
-// Steps:
-// 1. Marshal config to YAML
-// 2. Write to temporary file (.kportal.yaml.tmp)
-// 3. Atomic rename to actual config file
-//
-// This ensures the file watcher picks up a complete, valid file.
-func (m *Mutator) writeAtomic(cfg *Config) error {
-	// Marshal to YAML
-	data, err := yaml.Marshal(cfg)
-	if err != nil {
-		return fmt.Errorf("failed to marshal config: %w", err)
-	}
-
-	// Create temporary file in same directory as config
-	dir := filepath.Dir(m.configPath)
-	tmpFile := filepath.Join(dir, ".kportal.yaml.tmp")
-
-	// Write to temp file
-	if err := os.WriteFile(tmpFile, data, 0600); err != nil {
-		return fmt.Errorf("failed to write temp file: %w", err)
-	}
-
-	// Atomic rename
-	if err := os.Rename(tmpFile, m.configPath); err != nil {
-		// Clean up temp file on failure - error ignored as we're already handling the rename error
-		_ = os.Remove(tmpFile)
-		return fmt.Errorf("failed to rename temp file: %w", err)
-	}
-
-	return nil
-}

internal/config/mutator_test.go

@@ -1,664 +0,0 @@
-package config
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestNewMutator tests mutator creation
-func TestNewMutator(t *testing.T) {
-	mutator := NewMutator("/path/to/config.yaml")
-	assert.NotNil(t, mutator)
-	assert.Equal(t, "/path/to/config.yaml", mutator.configPath)
-}
-
-// TestMutator_AddForward_NewFile tests adding a forward to a new file
-// Note: Due to how LoadConfig wraps errors, os.IsNotExist check in AddForward
-// doesn't work with wrapped errors. This documents the current behavior.
-func TestMutator_AddForward_NewFile(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	mutator := NewMutator(configPath)
-
-	fwd := Forward{
-		Resource:  "pod/my-app",
-		Protocol:  "tcp",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-
-	// Currently fails because LoadConfig wraps the error and os.IsNotExist doesn't match
-	err := mutator.AddForward("dev-cluster", "default", fwd)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to load config")
-}
-
-// TestMutator_AddForward_EmptyFile tests adding a forward to an empty file
-func TestMutator_AddForward_EmptyFile(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create empty config file with minimal valid structure
-	initial := `contexts: []
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	fwd := Forward{
-		Resource:  "pod/my-app",
-		Protocol:  "tcp",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-
-	err = mutator.AddForward("dev-cluster", "default", fwd)
-	require.NoError(t, err)
-
-	// Verify file was updated and contains the forward
-	cfg, err := LoadConfig(configPath)
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
-	assert.Len(t, cfg.Contexts, 1)
-	assert.Equal(t, "dev-cluster", cfg.Contexts[0].Name)
-	assert.Len(t, cfg.Contexts[0].Namespaces, 1)
-	assert.Equal(t, "default", cfg.Contexts[0].Namespaces[0].Name)
-	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 1)
-	assert.Equal(t, "pod/my-app", cfg.Contexts[0].Namespaces[0].Forwards[0].Resource)
-}
-
-// TestMutator_AddForward_ExistingFile tests adding to existing config
-func TestMutator_AddForward_ExistingFile(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/existing-app
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	fwd := Forward{
-		Resource:  "service/postgres",
-		Protocol:  "tcp",
-		Port:      5432,
-		LocalPort: 5432,
-	}
-
-	err = mutator.AddForward("dev-cluster", "default", fwd)
-	require.NoError(t, err)
-
-	// Verify both forwards exist
-	cfg, err := LoadConfig(configPath)
-	require.NoError(t, err)
-
-	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 2)
-}
-
-// TestMutator_AddForward_NewContext tests adding to new context
-func TestMutator_AddForward_NewContext(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	fwd := Forward{
-		Resource:  "pod/prod-app",
-		Protocol:  "tcp",
-		Port:      80,
-		LocalPort: 8081,
-	}
-
-	err = mutator.AddForward("prod-cluster", "production", fwd)
-	require.NoError(t, err)
-
-	// Verify new context was created
-	cfg, err := LoadConfig(configPath)
-	require.NoError(t, err)
-
-	assert.Len(t, cfg.Contexts, 2)
-	assert.Equal(t, "prod-cluster", cfg.Contexts[1].Name)
-}
-
-// TestMutator_AddForward_DuplicatePort tests rejecting duplicate ports
-func TestMutator_AddForward_DuplicatePort(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	fwd := Forward{
-		Resource:  "pod/another-app",
-		Protocol:  "tcp",
-		Port:      9090,
-		LocalPort: 8080, // Duplicate local port
-	}
-
-	err = mutator.AddForward("dev-cluster", "default", fwd)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "port 8080 is already in use")
-}
-
-// TestMutator_AddForward_InvalidForward tests rejecting invalid forward
-func TestMutator_AddForward_InvalidForward(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/existing-app
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	fwd := Forward{
-		Resource:  "invalid/type/resource", // Invalid resource
-		Protocol:  "tcp",
-		Port:      9090,
-		LocalPort: 9090,
-	}
-
-	err = mutator.AddForward("dev-cluster", "default", fwd)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "validation failed")
-}
-
-// TestMutator_RemoveForwards tests removing forwards by predicate
-func TestMutator_RemoveForwards(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config with multiple forwards
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app1
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-          - resource: pod/app2
-            protocol: tcp
-            port: 8081
-            localPort: 8081
-          - resource: service/postgres
-            protocol: tcp
-            port: 5432
-            localPort: 5432
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	// Remove all pod resources
-	err = mutator.RemoveForwards(func(ctx, ns string, fwd Forward) bool {
-		return fwd.Resource == "pod/app1"
-	})
-	require.NoError(t, err)
-
-	// Verify the forward was removed
-	cfg, err := LoadConfig(configPath)
-	require.NoError(t, err)
-
-	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 2)
-	for _, fwd := range cfg.Contexts[0].Namespaces[0].Forwards {
-		assert.NotEqual(t, "pod/app1", fwd.Resource)
-	}
-}
-
-// TestMutator_RemoveForwards_RemovesEmptyNamespaces tests that empty namespaces are removed
-func TestMutator_RemoveForwards_RemovesEmptyNamespaces(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create config with two namespaces
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: ns1
-        forwards:
-          - resource: pod/app1
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-      - name: ns2
-        forwards:
-          - resource: pod/app2
-            protocol: tcp
-            port: 8081
-            localPort: 8081
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	// Remove all forwards from ns1
-	err = mutator.RemoveForwards(func(ctx, ns string, fwd Forward) bool {
-		return ns == "ns1"
-	})
-	require.NoError(t, err)
-
-	// Verify ns1 was removed (has no forwards left)
-	cfg, err := LoadConfig(configPath)
-	require.NoError(t, err)
-
-	assert.Len(t, cfg.Contexts[0].Namespaces, 1)
-	assert.Equal(t, "ns2", cfg.Contexts[0].Namespaces[0].Name)
-}
-
-// TestMutator_RemoveForwards_NonExistentFile tests removing from non-existent file
-func TestMutator_RemoveForwards_NonExistentFile(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	mutator := NewMutator(configPath)
-
-	err := mutator.RemoveForwards(func(ctx, ns string, fwd Forward) bool {
-		return true
-	})
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to load config")
-}
-
-// TestMutator_RemoveForwardByID tests removing a specific forward by ID
-func TestMutator_RemoveForwardByID(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app1
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-          - resource: pod/app2
-            protocol: tcp
-            port: 8081
-            localPort: 8081
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	// Remove by ID
-	err = mutator.RemoveForwardByID("dev-cluster/default/pod/app1:8080")
-	require.NoError(t, err)
-
-	// Verify the forward was removed
-	cfg, err := LoadConfig(configPath)
-	require.NoError(t, err)
-
-	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 1)
-	assert.Equal(t, "pod/app2", cfg.Contexts[0].Namespaces[0].Forwards[0].Resource)
-}
-
-// TestMutator_UpdateForward tests updating an existing forward
-func TestMutator_UpdateForward(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app1
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	newFwd := Forward{
-		Resource:  "pod/app1-updated",
-		Protocol:  "tcp",
-		Port:      9090,
-		LocalPort: 9090,
-	}
-
-	err = mutator.UpdateForward("dev-cluster/default/pod/app1:8080", "dev-cluster", "default", newFwd)
-	require.NoError(t, err)
-
-	// Verify the forward was updated
-	cfg, err := LoadConfig(configPath)
-	require.NoError(t, err)
-
-	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 1)
-	assert.Equal(t, "pod/app1-updated", cfg.Contexts[0].Namespaces[0].Forwards[0].Resource)
-	assert.Equal(t, 9090, cfg.Contexts[0].Namespaces[0].Forwards[0].LocalPort)
-}
-
-// TestMutator_UpdateForward_MoveToNewContext tests moving forward to new context
-func TestMutator_UpdateForward_MoveToNewContext(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config with multiple forwards (so removing one doesn't leave empty namespace)
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app1
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-          - resource: pod/app2
-            protocol: tcp
-            port: 9090
-            localPort: 9090
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	newFwd := Forward{
-		Resource:  "pod/app1-moved",
-		Protocol:  "tcp",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-
-	err = mutator.UpdateForward("dev-cluster/default/pod/app1:8080", "prod-cluster", "production", newFwd)
-	require.NoError(t, err)
-
-	// Verify the forward was moved
-	cfg, err := LoadConfig(configPath)
-	require.NoError(t, err)
-
-	// New context should exist with the forward
-	assert.Len(t, cfg.Contexts, 2)
-
-	// Original namespace should still have one forward
-	assert.Len(t, cfg.Contexts[0].Namespaces, 1)
-	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 1)
-
-	// New context should have the moved forward
-	assert.Equal(t, "prod-cluster", cfg.Contexts[1].Name)
-	assert.Len(t, cfg.Contexts[1].Namespaces, 1)
-	assert.Equal(t, "production", cfg.Contexts[1].Namespaces[0].Name)
-}
-
-// TestMutator_UpdateForward_NotFound tests updating non-existent forward
-func TestMutator_UpdateForward_NotFound(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	newFwd := Forward{
-		Resource:  "pod/app",
-		Protocol:  "tcp",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-
-	err = mutator.UpdateForward("non-existent-id", "dev-cluster", "default", newFwd)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "forward with ID non-existent-id not found")
-}
-
-// TestMutator_UpdateForward_DuplicatePort tests rejecting update with duplicate port
-func TestMutator_UpdateForward_DuplicatePort(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config with two forwards
-	initial := `contexts:
-  - name: dev-cluster
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app1
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-          - resource: pod/app2
-            protocol: tcp
-            port: 9090
-            localPort: 9090
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	// Try to update app1 to use the same port as app2
-	newFwd := Forward{
-		Resource:  "pod/app1-updated",
-		Protocol:  "tcp",
-		Port:      9090,
-		LocalPort: 9090, // Duplicate with app2
-	}
-
-	err = mutator.UpdateForward("dev-cluster/default/pod/app1:8080", "dev-cluster", "default", newFwd)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "port 9090 is already in use")
-}
-
-// TestMutator_WriteAtomic tests atomic write behavior
-func TestMutator_WriteAtomic(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	mutator := NewMutator(configPath)
-
-	cfg := &Config{
-		Contexts: []Context{
-			{
-				Name: "test",
-				Namespaces: []Namespace{
-					{
-						Name: "default",
-						Forwards: []Forward{
-							{Resource: "pod/app", Protocol: "tcp", Port: 8080, LocalPort: 8080},
-						},
-					},
-				},
-			},
-		},
-	}
-
-	err := mutator.writeAtomic(cfg)
-	require.NoError(t, err)
-
-	// Verify file was created with correct permissions
-	info, err := os.Stat(configPath)
-	require.NoError(t, err)
-	assert.Equal(t, os.FileMode(0600), info.Mode().Perm())
-
-	// Verify temp file was cleaned up
-	tmpFile := filepath.Join(tmpDir, ".kportal.yaml.tmp")
-	_, err = os.Stat(tmpFile)
-	assert.True(t, os.IsNotExist(err))
-}
-
-// TestMutator_FindOrCreateContext tests context finding/creation
-func TestMutator_FindOrCreateContext(t *testing.T) {
-	mutator := NewMutator("/fake/path")
-
-	t.Run("find existing context", func(t *testing.T) {
-		cfg := &Config{
-			Contexts: []Context{
-				{Name: "existing"},
-			},
-		}
-
-		ctx := mutator.findOrCreateContext(cfg, "existing")
-		assert.Equal(t, "existing", ctx.Name)
-		assert.Len(t, cfg.Contexts, 1)
-	})
-
-	t.Run("create new context", func(t *testing.T) {
-		cfg := &Config{
-			Contexts: []Context{
-				{Name: "existing"},
-			},
-		}
-
-		ctx := mutator.findOrCreateContext(cfg, "new-context")
-		assert.Equal(t, "new-context", ctx.Name)
-		assert.Len(t, cfg.Contexts, 2)
-	})
-}
-
-// TestMutator_FindOrCreateNamespace tests namespace finding/creation
-func TestMutator_FindOrCreateNamespace(t *testing.T) {
-	mutator := NewMutator("/fake/path")
-
-	t.Run("find existing namespace", func(t *testing.T) {
-		ctx := &Context{
-			Name: "test",
-			Namespaces: []Namespace{
-				{Name: "existing"},
-			},
-		}
-
-		ns := mutator.findOrCreateNamespace(ctx, "existing")
-		assert.Equal(t, "existing", ns.Name)
-		assert.Len(t, ctx.Namespaces, 1)
-	})
-
-	t.Run("create new namespace", func(t *testing.T) {
-		ctx := &Context{
-			Name: "test",
-			Namespaces: []Namespace{
-				{Name: "existing"},
-			},
-		}
-
-		ns := mutator.findOrCreateNamespace(ctx, "new-namespace")
-		assert.Equal(t, "new-namespace", ns.Name)
-		assert.Len(t, ctx.Namespaces, 2)
-	})
-}
-
-// TestMutator_Concurrent tests mutex protection
-func TestMutator_Concurrent(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	mutator := NewMutator(configPath)
-
-	// Run concurrent operations
-	done := make(chan bool, 10)
-	for i := 0; i < 10; i++ {
-		go func(port int) {
-			defer func() { done <- true }()
-			fwd := Forward{
-				Resource:  "pod/app",
-				Protocol:  "tcp",
-				Port:      port + 9000,
-				LocalPort: port + 9000,
-			}
-			// Some will succeed, some will fail due to validation
-			// The important thing is no race condition
-			_ = mutator.AddForward("dev", "default", fwd)
-		}(i)
-	}
-
-	// Wait for all goroutines
-	for i := 0; i < 10; i++ {
-		<-done
-	}
-
-	// Verify config is still valid
-	cfg, err := LoadConfig(configPath)
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-}

internal/config/validator.go

@@ -2,57 +2,24 @@ package config
 
 import (
 	"fmt"
-	"regexp"
 	"strings"
-	"time"
 )
 
 const (
-	MinPort = 1
-	MaxPort = 65535
-
-	// DNS1123LabelMaxLength is the maximum length of a DNS label (RFC 1123)
-	DNS1123LabelMaxLength = 63
-	// DNS1123SubdomainMaxLength is the maximum length of a DNS subdomain name
-	DNS1123SubdomainMaxLength = 253
+	minPort = 1
+	maxPort = 65535
 )
 
-var (
-	// dns1123LabelRegexp matches valid DNS labels (RFC 1123)
-	// Must consist of lowercase alphanumeric characters or '-', start with alphanumeric, end with alphanumeric
-	dns1123LabelRegexp = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`)
-
-	// dns1123SubdomainRegexp matches valid DNS subdomain names
-	// A series of DNS labels separated by dots (no consecutive dots allowed)
-	dns1123SubdomainRegexp = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)
-
-	// contextNameRegexp matches valid kubeconfig context names.
-	// kubeconfig itself imposes no character restriction; we accept the union
-	// of common naming conventions seen in the wild:
-	//   - hyphens / underscores: minikube, docker-desktop, gke_proj_zone_cluster
-	//   - "@": user@cluster (kubectl rename, EKS aws-iam-authenticator)
-	//   - ".": cluster.example.com, GKE dotted names
-	//   - ":" and "/": EKS ARNs (arn:aws:eks:us-east-1:123:cluster/foo)
-	// Must start and end with an alphanumeric character.
-	contextNameRegexp = regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9._:/@_-]*[a-zA-Z0-9])?$`)
-
-	// validResourceTypes contains the allowed Kubernetes resource types
-	validResourceTypes = []string{"pod", "service"}
-
-	// validHealthCheckMethods contains the allowed health check methods
-	validHealthCheckMethods = []string{"tcp-dial", "data-transfer"}
-)
-
-// IsValidPort returns true if the port number is within the valid range (1-65535).
-func IsValidPort(port int) bool {
-	return port >= MinPort && port <= MaxPort
-}
-
 // ValidationError represents a configuration validation error with context.
 type ValidationError struct {
-	Context map[string]string
-	Field   string
-	Message string
+	Field   string            // The field that failed validation
+	Message string            // Error message
+	Context map[string]string // Additional context information
+}
+
+// Error implements the error interface.
+func (e ValidationError) Error() string {
+	return e.Message
 }
 
 // Validator validates configuration files.
@@ -65,13 +32,6 @@ func NewValidator() *Validator {
 
 // ValidateConfig validates the entire configuration and returns all errors found.
 func (v *Validator) ValidateConfig(cfg *Config) []ValidationError {
-	return v.ValidateConfigWithOptions(cfg, false)
-}
-
-// ValidateConfigWithOptions validates configuration with configurable strictness.
-// When allowEmpty is true, empty configurations (no contexts/forwards) are allowed.
-// This is useful for newly created config files where the user will add forwards via the TUI.
-func (v *Validator) ValidateConfigWithOptions(cfg *Config, allowEmpty bool) []ValidationError {
 	var errs []ValidationError
 
 	if cfg == nil {
@@ -81,13 +41,6 @@ func (v *Validator) ValidateConfigWithOptions(cfg *Config, allowEmpty bool) []Va
 		}}
 	}
 
-	// If empty configs are allowed and this config is empty, skip structure validation
-	if allowEmpty && cfg.IsEmpty() {
-		// Still validate health check and reliability if present (they don't require forwards)
-		errs = append(errs, v.validateSpecDurations(cfg)...)
-		return errs
-	}
-
 	// Validate structure
 	errs = append(errs, v.validateStructure(cfg)...)
 
@@ -103,14 +56,6 @@ func (v *Validator) ValidateConfigWithOptions(cfg *Config, allowEmpty bool) []Va
 	// Check for duplicate local ports
 	errs = append(errs, v.validateDuplicatePorts(cfg)...)
 
-	// Validate mDNS configuration
-	if cfg.IsMDNSEnabled() {
-		errs = append(errs, v.validateMDNS(cfg)...)
-	}
-
-	// Validate duration fields in specs
-	errs = append(errs, v.validateSpecDurations(cfg)...)
-
 	return errs
 }
 
@@ -132,11 +77,6 @@ func (v *Validator) validateStructure(cfg *Config) []ValidationError {
 				Field:   fmt.Sprintf("contexts[%d].name", i),
 				Message: "Context name cannot be empty",
 			})
-		} else {
-			// Validate context name format (alphanumeric, hyphens, underscores)
-			if err := validateContextName(ctx.Name, fmt.Sprintf("contexts[%d].name", i)); err != nil {
-				errs = append(errs, *err)
-			}
 		}
 
 		if len(ctx.Namespaces) == 0 {
@@ -144,7 +84,7 @@ func (v *Validator) validateStructure(cfg *Config) []ValidationError {
 				Field:   fmt.Sprintf("contexts[%d].namespaces", i),
 				Message: fmt.Sprintf("Context '%s' must have at least one namespace", ctx.Name),
 			})
-			// Don't continue - still validate other aspects of the context if any
+			continue
 		}
 
 		for j, ns := range ctx.Namespaces {
@@ -153,11 +93,6 @@ func (v *Validator) validateStructure(cfg *Config) []ValidationError {
 					Field:   fmt.Sprintf("contexts[%d].namespaces[%d].name", i, j),
 					Message: fmt.Sprintf("Namespace name cannot be empty in context '%s'", ctx.Name),
 				})
-			} else {
-				// Validate namespace name follows DNS subdomain conventions (Kubernetes requirement)
-				if err := validateNamespaceName(ns.Name, fmt.Sprintf("contexts[%d].namespaces[%d].name", i, j)); err != nil {
-					errs = append(errs, *err)
-				}
 			}
 
 			if len(ns.Forwards) == 0 {
@@ -186,38 +121,29 @@ func (v *Validator) validateForward(fwd *Forward) []ValidationError {
 		errs = append(errs, v.validateResource(fwd)...)
 	}
 
-	// Validate protocol - only "tcp" is currently supported
-	if fwd.Protocol != "" && fwd.Protocol != "tcp" {
+	// Validate protocol
+	if fwd.Protocol != "" && fwd.Protocol != "tcp" && fwd.Protocol != "udp" {
 		errs = append(errs, ValidationError{
 			Field:   "protocol",
-			Message: fmt.Sprintf("Invalid protocol '%s' for forward %s (only 'tcp' is supported)", fwd.Protocol, fwd.ID()),
+			Message: fmt.Sprintf("Invalid protocol '%s' for forward %s (must be 'tcp' or 'udp')", fwd.Protocol, fwd.ID()),
 		})
 	}
 
 	// Validate ports
-	if !IsValidPort(fwd.Port) {
+	if fwd.Port < minPort || fwd.Port > maxPort {
 		errs = append(errs, ValidationError{
 			Field:   "port",
-			Message: fmt.Sprintf("Invalid port %d for forward %s (must be between %d and %d)", fwd.Port, fwd.ID(), MinPort, MaxPort),
+			Message: fmt.Sprintf("Invalid port %d for forward %s (must be between %d and %d)", fwd.Port, fwd.ID(), minPort, maxPort),
 		})
 	}
 
-	if !IsValidPort(fwd.LocalPort) {
+	if fwd.LocalPort < minPort || fwd.LocalPort > maxPort {
 		errs = append(errs, ValidationError{
 			Field:   "localPort",
-			Message: fmt.Sprintf("Invalid localPort %d for forward %s (must be between %d and %d)", fwd.LocalPort, fwd.ID(), MinPort, MaxPort),
+			Message: fmt.Sprintf("Invalid localPort %d for forward %s (must be between %d and %d)", fwd.LocalPort, fwd.ID(), minPort, maxPort),
 		})
 	}
 
-	// Note: Alias validation is handled in validateMDNS since aliases are primarily
-	// used for mDNS hostname registration. We only validate alias format when mDNS
-	// is enabled to avoid unnecessary restrictions on non-mDNS usage.
-
-	// Validate HTTP log configuration if enabled
-	if fwd.HTTPLog != nil && fwd.HTTPLog.Enabled {
-		errs = append(errs, v.validateHTTPLog(fwd)...)
-	}
-
 	return errs
 }
 
@@ -225,44 +151,18 @@ func (v *Validator) validateForward(fwd *Forward) []ValidationError {
 func (v *Validator) validateResource(fwd *Forward) []ValidationError {
 	var errs []ValidationError
 
-	// Validate resource format (must be "type/name" or just "type" for pod with selector)
 	parts := strings.SplitN(fwd.Resource, "/", 2)
 	resourceType := parts[0]
 
-	// Validate resource type
-	if !isValidResourceType(resourceType) {
+	// Valid resource types: pod, service
+	if resourceType != "pod" && resourceType != "service" {
 		errs = append(errs, ValidationError{
 			Field:   "resource",
-			Message: fmt.Sprintf("Invalid resource type '%s' for forward %s (must be one of: %s)", resourceType, fwd.ID(), strings.Join(validResourceTypes, ", ")),
+			Message: fmt.Sprintf("Invalid resource type '%s' for forward %s (must be 'pod' or 'service')", resourceType, fwd.ID()),
 		})
 		return errs
 	}
 
-	// Validate resource name if provided
-	if len(parts) == 2 {
-		resourceName := parts[1]
-		if resourceName == "" {
-			// Use resource-type-specific error message for better clarity
-			entityType := "Resource"
-			switch resourceType {
-			case "pod":
-				entityType = "Pod"
-			case "service":
-				entityType = "Service"
-			}
-			errs = append(errs, ValidationError{
-				Field:   "resource",
-				Message: fmt.Sprintf("%s name cannot be empty for forward %s", entityType, fwd.ID()),
-			})
-		} else {
-			// Validate resource name follows DNS subdomain conventions
-			if err := validateDNS1123Subdomain(resourceName, "resource", "Resource name"); err != nil {
-				err.Message = fmt.Sprintf("%s for forward %s", err.Message, fwd.ID())
-				errs = append(errs, *err)
-			}
-		}
-	}
-
 	// For pod resources
 	if resourceType == "pod" {
 		if len(parts) == 2 {
@@ -273,12 +173,22 @@ func (v *Validator) validateResource(fwd *Forward) []ValidationError {
 					Message: fmt.Sprintf("Forward %s uses explicit pod name (%s) and should not have a selector", fwd.ID(), fwd.Resource),
 				})
 			}
-		} else if fwd.Selector == "" {
+
+			// Validate pod name is not empty
+			if parts[1] == "" {
+				errs = append(errs, ValidationError{
+					Field:   "resource",
+					Message: fmt.Sprintf("Pod name cannot be empty for forward %s", fwd.ID()),
+				})
+			}
+		} else {
 			// pod (no name) - must have selector
-			errs = append(errs, ValidationError{
-				Field:   "selector",
-				Message: fmt.Sprintf("Forward %s uses generic 'pod' resource and must have a selector", fwd.ID()),
-			})
+			if fwd.Selector == "" {
+				errs = append(errs, ValidationError{
+					Field:   "selector",
+					Message: fmt.Sprintf("Forward %s uses generic 'pod' resource and must have a selector", fwd.ID()),
+				})
+			}
 		}
 	}
 
@@ -287,7 +197,7 @@ func (v *Validator) validateResource(fwd *Forward) []ValidationError {
 		if len(parts) < 2 || parts[1] == "" {
 			errs = append(errs, ValidationError{
 				Field:   "resource",
-				Message: fmt.Sprintf("Service name cannot be empty for forward %s (format: service/name)", fwd.ID()),
+				Message: fmt.Sprintf("Service name cannot be empty for forward %s", fwd.ID()),
 			})
 		}
 
@@ -333,109 +243,6 @@ func (v *Validator) validateDuplicatePorts(cfg *Config) []ValidationError {
 	return errs
 }
 
-// validateSpecDurations validates duration strings in HealthCheck and Reliability specs.
-func (v *Validator) validateSpecDurations(cfg *Config) []ValidationError {
-	var errs []ValidationError
-
-	// Validate HealthCheck durations
-	if cfg.HealthCheck != nil {
-		if cfg.HealthCheck.Interval != "" {
-			if _, err := time.ParseDuration(cfg.HealthCheck.Interval); err != nil {
-				errs = append(errs, ValidationError{
-					Field:   "healthCheck.interval",
-					Message: fmt.Sprintf("Invalid health check interval '%s': %v", cfg.HealthCheck.Interval, err),
-				})
-			}
-		}
-
-		if cfg.HealthCheck.Timeout != "" {
-			if _, err := time.ParseDuration(cfg.HealthCheck.Timeout); err != nil {
-				errs = append(errs, ValidationError{
-					Field:   "healthCheck.timeout",
-					Message: fmt.Sprintf("Invalid health check timeout '%s': %v", cfg.HealthCheck.Timeout, err),
-				})
-			}
-		}
-
-		if cfg.HealthCheck.MaxConnectionAge != "" {
-			if _, err := time.ParseDuration(cfg.HealthCheck.MaxConnectionAge); err != nil {
-				errs = append(errs, ValidationError{
-					Field:   "healthCheck.maxConnectionAge",
-					Message: fmt.Sprintf("Invalid max connection age '%s': %v", cfg.HealthCheck.MaxConnectionAge, err),
-				})
-			}
-		}
-
-		if cfg.HealthCheck.MaxIdleTime != "" {
-			if _, err := time.ParseDuration(cfg.HealthCheck.MaxIdleTime); err != nil {
-				errs = append(errs, ValidationError{
-					Field:   "healthCheck.maxIdleTime",
-					Message: fmt.Sprintf("Invalid max idle time '%s': %v", cfg.HealthCheck.MaxIdleTime, err),
-				})
-			}
-		}
-
-		// Validate health check method
-		if cfg.HealthCheck.Method != "" && !isValidHealthCheckMethod(cfg.HealthCheck.Method) {
-			errs = append(errs, ValidationError{
-				Field:   "healthCheck.method",
-				Message: fmt.Sprintf("Invalid health check method '%s' (must be one of: %s)", cfg.HealthCheck.Method, strings.Join(validHealthCheckMethods, ", ")),
-			})
-		}
-	}
-
-	// Validate Reliability durations
-	if cfg.Reliability != nil {
-		if cfg.Reliability.TCPKeepalive != "" {
-			if _, err := time.ParseDuration(cfg.Reliability.TCPKeepalive); err != nil {
-				errs = append(errs, ValidationError{
-					Field:   "reliability.tcpKeepalive",
-					Message: fmt.Sprintf("Invalid TCP keepalive duration '%s': %v", cfg.Reliability.TCPKeepalive, err),
-				})
-			}
-		}
-
-		if cfg.Reliability.DialTimeout != "" {
-			if _, err := time.ParseDuration(cfg.Reliability.DialTimeout); err != nil {
-				errs = append(errs, ValidationError{
-					Field:   "reliability.dialTimeout",
-					Message: fmt.Sprintf("Invalid dial timeout '%s': %v", cfg.Reliability.DialTimeout, err),
-				})
-			}
-		}
-
-		if cfg.Reliability.WatchdogPeriod != "" {
-			if _, err := time.ParseDuration(cfg.Reliability.WatchdogPeriod); err != nil {
-				errs = append(errs, ValidationError{
-					Field:   "reliability.watchdogPeriod",
-					Message: fmt.Sprintf("Invalid watchdog period '%s': %v", cfg.Reliability.WatchdogPeriod, err),
-				})
-			}
-		}
-	}
-
-	return errs
-}
-
-// validateHTTPLog validates HTTP log configuration.
-func (v *Validator) validateHTTPLog(fwd *Forward) []ValidationError {
-	var errs []ValidationError
-
-	if fwd.HTTPLog == nil {
-		return errs
-	}
-
-	// Validate maxBodySize is non-negative
-	if fwd.HTTPLog.MaxBodySize < 0 {
-		errs = append(errs, ValidationError{
-			Field:   "httpLog.maxBodySize",
-			Message: fmt.Sprintf("Invalid maxBodySize %d for forward %s (must be non-negative)", fwd.HTTPLog.MaxBodySize, fwd.ID()),
-		})
-	}
-
-	return errs
-}
-
 // FormatValidationErrors formats validation errors into a human-readable string.
 func FormatValidationErrors(errs []ValidationError) string {
 	if len(errs) == 0 {
@@ -447,10 +254,10 @@ func FormatValidationErrors(errs []ValidationError) string {
 	sb.WriteString(strings.Repeat("=", 50) + "\n\n")
 
 	for i, err := range errs {
-		fmt.Fprintf(&sb, "%d. %s\n", i+1, err.Message)
+		sb.WriteString(fmt.Sprintf("%d. %s\n", i+1, err.Message))
 		if len(err.Context) > 0 {
 			for k, v := range err.Context {
-				fmt.Fprintf(&sb, "   %s: %s\n", k, v)
+				sb.WriteString(fmt.Sprintf("   %s: %s\n", k, v))
 			}
 		}
 		sb.WriteString("\n")
@@ -458,231 +265,3 @@ func FormatValidationErrors(errs []ValidationError) string {
 
 	return sb.String()
 }
-
-// validateMDNS validates mDNS configuration when enabled.
-// It checks that aliases used for mDNS hostnames are valid and unique.
-// This includes both explicit aliases and auto-generated ones from resource names.
-func (v *Validator) validateMDNS(cfg *Config) []ValidationError {
-	var errs []ValidationError
-
-	aliasMap := make(map[string][]string) // alias -> list of forward IDs using it
-
-	for _, ctx := range cfg.Contexts {
-		for _, ns := range ctx.Namespaces {
-			for _, fwd := range ns.Forwards {
-				// Get the mDNS alias (explicit or generated from resource name)
-				mdnsAlias := fwd.GetMDNSAlias()
-				if mdnsAlias == "" {
-					// No alias available (e.g., "pod" with selector only)
-					continue
-				}
-
-				// Validate alias is a valid hostname (RFC 1123)
-				if !isValidHostname(mdnsAlias) {
-					errs = append(errs, ValidationError{
-						Field:   "alias",
-						Message: fmt.Sprintf("Forward %s has invalid mDNS hostname '%s' (must be a valid RFC 1123 hostname)", fwd.ID(), mdnsAlias),
-					})
-				}
-
-				aliasMap[mdnsAlias] = append(aliasMap[mdnsAlias], fwd.ID())
-			}
-		}
-	}
-
-	// Check for duplicate aliases (would cause mDNS conflicts)
-	for alias, forwards := range aliasMap {
-		if len(forwards) > 1 {
-			errs = append(errs, ValidationError{
-				Field:   "alias",
-				Message: fmt.Sprintf("Duplicate mDNS hostname '%s' used by multiple forwards (would cause conflict)", alias),
-				Context: map[string]string{
-					"alias":    alias,
-					"forwards": strings.Join(forwards, ", "),
-				},
-			})
-		}
-	}
-
-	return errs
-}
-
-// isValidHostname checks if a string is a valid RFC 1123 hostname.
-// Hostnames must start with alphanumeric, contain only alphanumeric and hyphens,
-// and be 1-63 characters long.
-func isValidHostname(name string) bool {
-	if len(name) == 0 || len(name) > DNS1123LabelMaxLength {
-		return false
-	}
-
-	// Must start with alphanumeric
-	if !isAlphanumeric(name[0]) {
-		return false
-	}
-
-	// Must end with alphanumeric
-	if !isAlphanumeric(name[len(name)-1]) {
-		return false
-	}
-
-	// Check all characters
-	for i := 0; i < len(name); i++ {
-		c := name[i]
-		if !isAlphanumeric(c) && c != '-' {
-			return false
-		}
-	}
-
-	return true
-}
-
-// isAlphanumeric returns true if the character is a letter or digit.
-func isAlphanumeric(c byte) bool {
-	return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9')
-}
-
-// isValidResourceType returns true if the resource type is valid.
-func isValidResourceType(resourceType string) bool {
-	for _, rt := range validResourceTypes {
-		if rt == resourceType {
-			return true
-		}
-	}
-	return false
-}
-
-// isValidHealthCheckMethod returns true if the health check method is valid.
-func isValidHealthCheckMethod(method string) bool {
-	for _, m := range validHealthCheckMethods {
-		if m == method {
-			return true
-		}
-	}
-	return false
-}
-
-// validateContextName validates that a context name follows the allowed format.
-// Context names must consist of alphanumeric characters, hyphens, or underscores,
-// and must start and end with an alphanumeric character.
-// This more permissive validation supports various kubeconfig naming conventions
-// (e.g., "gke_project_zone_cluster", "minikube", "docker-desktop").
-func validateContextName(name, field string) *ValidationError {
-	if len(name) > DNS1123SubdomainMaxLength {
-		return &ValidationError{
-			Field:   field,
-			Message: fmt.Sprintf("Context name '%s' exceeds maximum length of %d characters", name, DNS1123SubdomainMaxLength),
-		}
-	}
-
-	if !contextNameRegexp.MatchString(name) {
-		return &ValidationError{
-			Field:   field,
-			Message: fmt.Sprintf("Context name '%s' is not valid (allowed: letters, digits, hyphens, underscores, dots, '@', ':', '/'; must start and end with a letter or digit)", name),
-		}
-	}
-
-	return nil
-}
-
-// validateNamespaceName validates that a namespace name is a valid DNS subdomain (RFC 1123).
-// Kubernetes namespaces must follow DNS subdomain format which allows dots for subdomain separation.
-// This is more permissive than DNS labels and supports names like "kube-system", "my-app.ns".
-func validateNamespaceName(name, field string) *ValidationError {
-	if len(name) > DNS1123SubdomainMaxLength {
-		return &ValidationError{
-			Field:   field,
-			Message: fmt.Sprintf("Namespace name '%s' exceeds maximum length of %d characters", name, DNS1123SubdomainMaxLength),
-		}
-	}
-
-	if !dns1123SubdomainRegexp.MatchString(name) {
-		return &ValidationError{
-			Field:   field,
-			Message: fmt.Sprintf("Namespace name '%s' is not a valid DNS subdomain (must consist of lowercase alphanumeric characters, '-', or '.', start with alphanumeric, end with alphanumeric)", name),
-		}
-	}
-
-	return nil
-}
-
-// validateDNS1123Label validates that a name is a valid DNS label (RFC 1123).
-// Used for context names and namespace names.
-func validateDNS1123Label(name, field, entityType string) *ValidationError {
-	if len(name) > DNS1123LabelMaxLength {
-		return &ValidationError{
-			Field:   field,
-			Message: fmt.Sprintf("%s name '%s' exceeds maximum length of %d characters", entityType, name, DNS1123LabelMaxLength),
-		}
-	}
-
-	if !dns1123LabelRegexp.MatchString(name) {
-		return &ValidationError{
-			Field:   field,
-			Message: fmt.Sprintf("%s name '%s' is not a valid DNS label (must consist of lowercase alphanumeric characters or '-', start with alphanumeric, end with alphanumeric)", entityType, name),
-		}
-	}
-
-	return nil
-}
-
-// validateDNS1123Subdomain validates that a name is a valid DNS subdomain name (RFC 1123).
-// Used for resource names which can contain dots.
-func validateDNS1123Subdomain(name, field, entityType string) *ValidationError {
-	if len(name) > DNS1123SubdomainMaxLength {
-		return &ValidationError{
-			Field:   field,
-			Message: fmt.Sprintf("%s '%s' exceeds maximum length of %d characters", entityType, name, DNS1123SubdomainMaxLength),
-		}
-	}
-
-	if !dns1123SubdomainRegexp.MatchString(name) {
-		return &ValidationError{
-			Field:   field,
-			Message: fmt.Sprintf("%s '%s' is not a valid DNS subdomain name (must consist of lowercase alphanumeric characters, '-', or '.', start with alphanumeric, end with alphanumeric)", entityType, name),
-		}
-	}
-
-	return nil
-}
-
-// ValidatePort validates a port number and returns an error if invalid.
-// This is a public function that can be used externally.
-func ValidatePort(port int, name string) error {
-	if !IsValidPort(port) {
-		return fmt.Errorf("%s must be between %d and %d, got %d", name, MinPort, MaxPort, port)
-	}
-	return nil
-}
-
-// ValidateResourceFormat validates that a resource string is in the correct format.
-// This is a public function that can be used externally.
-func ValidateResourceFormat(resource string) error {
-	parts := strings.SplitN(resource, "/", 2)
-	if len(parts) != 2 {
-		return fmt.Errorf("resource must be in format 'type/name', got: %s", resource)
-	}
-
-	resourceType := parts[0]
-	if !isValidResourceType(resourceType) {
-		return fmt.Errorf("invalid resource type '%s' (must be one of: %s)", resourceType, strings.Join(validResourceTypes, ", "))
-	}
-
-	if parts[1] == "" {
-		return fmt.Errorf("resource name cannot be empty in '%s'", resource)
-	}
-
-	return nil
-}
-
-// ValidateDuration validates that a string is a valid duration.
-// This is a public function that can be used externally.
-func ValidateDuration(duration, name string) error {
-	if duration == "" {
-		return nil // Empty durations are allowed (will use defaults)
-	}
-	_, err := time.ParseDuration(duration)
-	if err != nil {
-		return fmt.Errorf("invalid %s '%s': %v", name, duration, err)
-	}
-	return nil
-}

internal/config/watcher.go

@@ -4,10 +4,8 @@ import (
 	"fmt"
 	"log"
 	"path/filepath"
-	"sync"
 
 	"github.com/fsnotify/fsnotify"
-	"github.com/lukaszraczylo/kportal/internal/logger"
 )
 
 // ReloadCallback is called when the configuration file changes.
@@ -16,12 +14,10 @@ type ReloadCallback func(*Config) error
 
 // Watcher watches a configuration file for changes and triggers hot-reload.
 type Watcher struct {
+	configPath string
 	callback   ReloadCallback
 	watcher    *fsnotify.Watcher
 	done       chan struct{}
-	configPath string
-	wg         sync.WaitGroup
-	stopOnce   sync.Once
 	verbose    bool
 }
 
@@ -34,7 +30,7 @@ func NewWatcher(configPath string, callback ReloadCallback, verbose bool) (*Watc
 
 	absPath, err := filepath.Abs(configPath)
 	if err != nil {
-		_ = watcher.Close() // Cleanup on error path; already returning error
+		watcher.Close()
 		return nil, fmt.Errorf("failed to resolve absolute path: %w", err)
 	}
 
@@ -42,7 +38,7 @@ func NewWatcher(configPath string, callback ReloadCallback, verbose bool) (*Watc
 	// (many editors delete and recreate files on save)
 	dir := filepath.Dir(absPath)
 	if err := watcher.Add(dir); err != nil {
-		_ = watcher.Close() // Cleanup on error path; already returning error
+		watcher.Close()
 		return nil, fmt.Errorf("failed to watch directory %s: %w", dir, err)
 	}
 
@@ -57,24 +53,17 @@ func NewWatcher(configPath string, callback ReloadCallback, verbose bool) (*Watc
 
 // Start begins watching the configuration file for changes.
 func (w *Watcher) Start() {
-	w.wg.Add(1)
 	go w.watch()
 }
 
-// Stop stops watching the configuration file and waits for the watch goroutine to exit.
-// Safe to call multiple times.
+// Stop stops watching the configuration file.
 func (w *Watcher) Stop() {
-	w.stopOnce.Do(func() {
-		close(w.done)
-		_ = w.watcher.Close() // Best-effort cleanup during shutdown
-	})
-	w.wg.Wait() // Wait for watch goroutine to exit
+	close(w.done)
+	w.watcher.Close()
 }
 
 // watch runs the file watching loop.
 func (w *Watcher) watch() {
-	defer w.wg.Done()
-
 	if w.verbose {
 		log.Printf("Watching configuration file: %s", w.configPath)
 	}
@@ -124,37 +113,28 @@ func (w *Watcher) handleReload() {
 	// Load new configuration
 	newCfg, err := LoadConfig(w.configPath)
 	if err != nil {
-		logger.Error("Failed to load configuration during hot-reload", map[string]interface{}{
-			"config_path": w.configPath,
-			"error":       err.Error(),
-		})
-		logger.Info("Keeping previous configuration active", nil)
+		log.Printf("Failed to load configuration: %v", err)
+		log.Printf("Keeping previous configuration active")
 		return
 	}
 
 	// Validate new configuration
 	validator := NewValidator()
 	if errs := validator.ValidateConfig(newCfg); len(errs) > 0 {
-		logger.Error("Configuration validation failed during hot-reload", map[string]interface{}{
-			"config_path":       w.configPath,
-			"validation_errors": len(errs),
-		})
-		logger.Info("Keeping previous configuration active", nil)
+		log.Printf("Configuration validation failed:")
+		log.Print(FormatValidationErrors(errs))
+		log.Printf("Keeping previous configuration active")
 		return
 	}
 
 	// Call reload callback
 	if err := w.callback(newCfg); err != nil {
-		logger.Error("Failed to apply new configuration", map[string]interface{}{
-			"config_path": w.configPath,
-			"error":       err.Error(),
-		})
-		logger.Info("Keeping previous configuration active", nil)
+		log.Printf("Failed to apply new configuration: %v", err)
+		log.Printf("Keeping previous configuration active")
 		return
 	}
 
-	logger.Info("Configuration reloaded successfully", map[string]interface{}{
-		"config_path":    w.configPath,
-		"forwards_count": len(newCfg.GetAllForwards()),
-	})
+	if w.verbose {
+		log.Printf("Configuration reloaded successfully")
+	}
 }

internal/config/watcher_test.go

@@ -1,506 +0,0 @@
-package config
-
-import (
-	"os"
-	"path/filepath"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestNewWatcher tests watcher creation
-func TestNewWatcher(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            protocol: tcp
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	callback := func(cfg *Config) error { return nil }
-
-	watcher, err := NewWatcher(configPath, callback, false)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-	defer watcher.Stop()
-
-	assert.NotNil(t, watcher.watcher)
-	assert.NotNil(t, watcher.done)
-	assert.False(t, watcher.verbose)
-}
-
-// TestNewWatcher_Verbose tests verbose watcher creation
-func TestNewWatcher_Verbose(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	callback := func(cfg *Config) error { return nil }
-
-	watcher, err := NewWatcher(configPath, callback, true)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-	defer watcher.Stop()
-
-	assert.True(t, watcher.verbose)
-}
-
-// TestNewWatcher_RelativePath tests absolute path resolution
-func TestNewWatcher_RelativePath(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	// Change to tmpDir and use relative path
-	originalDir, err := os.Getwd()
-	require.NoError(t, err)
-	defer func() { _ = os.Chdir(originalDir) }()
-	err = os.Chdir(tmpDir)
-	require.NoError(t, err)
-
-	callback := func(cfg *Config) error { return nil }
-
-	watcher, err := NewWatcher(".kportal.yaml", callback, false)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-	defer watcher.Stop()
-
-	// configPath should be absolute
-	assert.True(t, filepath.IsAbs(watcher.configPath))
-}
-
-// TestWatcher_StartStop tests basic start/stop lifecycle
-func TestWatcher_StartStop(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	callback := func(cfg *Config) error { return nil }
-
-	watcher, err := NewWatcher(configPath, callback, false)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-
-	// Start watching
-	watcher.Start()
-
-	// Stop should complete without hanging
-	done := make(chan bool)
-	go func() {
-		watcher.Stop()
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		// Success
-	case <-time.After(5 * time.Second):
-		t.Fatal("Stop timed out")
-	}
-}
-
-// TestWatcher_DetectsFileChange tests that file changes trigger callback
-func TestWatcher_DetectsFileChange(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	var mu sync.Mutex
-	var callbackCalled bool
-	var receivedConfig *Config
-
-	callback := func(cfg *Config) error {
-		mu.Lock()
-		defer mu.Unlock()
-		callbackCalled = true
-		receivedConfig = cfg
-		return nil
-	}
-
-	watcher, err := NewWatcher(configPath, callback, false)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-	defer watcher.Stop()
-
-	watcher.Start()
-
-	// Give watcher time to start
-	time.Sleep(100 * time.Millisecond)
-
-	// Modify the config file
-	updated := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-          - resource: pod/new-app
-            port: 9090
-            localPort: 9090
-`
-	err = os.WriteFile(configPath, []byte(updated), 0600)
-	require.NoError(t, err)
-
-	// Wait for callback with timeout
-	timeout := time.After(5 * time.Second)
-	tick := time.NewTicker(100 * time.Millisecond)
-	defer tick.Stop()
-
-	for {
-		select {
-		case <-timeout:
-			t.Fatal("Callback was not called after file change")
-		case <-tick.C:
-			mu.Lock()
-			if callbackCalled {
-				assert.NotNil(t, receivedConfig)
-				assert.Len(t, receivedConfig.Contexts[0].Namespaces[0].Forwards, 2)
-				mu.Unlock()
-				return
-			}
-			mu.Unlock()
-		}
-	}
-}
-
-// TestWatcher_IgnoresInvalidConfig tests that invalid configs are rejected
-func TestWatcher_IgnoresInvalidConfig(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial valid config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	callbackCount := 0
-	var mu sync.Mutex
-
-	callback := func(cfg *Config) error {
-		mu.Lock()
-		defer mu.Unlock()
-		callbackCount++
-		return nil
-	}
-
-	watcher, err := NewWatcher(configPath, callback, false)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-	defer watcher.Stop()
-
-	watcher.Start()
-	time.Sleep(100 * time.Millisecond)
-
-	// Write invalid config (invalid YAML syntax)
-	invalid := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards: [this is invalid
-`
-	err = os.WriteFile(configPath, []byte(invalid), 0600)
-	require.NoError(t, err)
-
-	// Wait a bit
-	time.Sleep(500 * time.Millisecond)
-
-	// Callback should not have been called
-	mu.Lock()
-	assert.Equal(t, 0, callbackCount, "callback should not be called for invalid config")
-	mu.Unlock()
-}
-
-// TestWatcher_IgnoresValidationErrors tests that configs failing validation are rejected
-func TestWatcher_IgnoresValidationErrors(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial valid config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	callbackCount := 0
-	var mu sync.Mutex
-
-	callback := func(cfg *Config) error {
-		mu.Lock()
-		defer mu.Unlock()
-		callbackCount++
-		return nil
-	}
-
-	watcher, err := NewWatcher(configPath, callback, false)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-	defer watcher.Stop()
-
-	watcher.Start()
-	time.Sleep(100 * time.Millisecond)
-
-	// Write config with duplicate ports (validation error)
-	invalid := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app1
-            port: 8080
-            localPort: 8080
-          - resource: pod/app2
-            port: 9090
-            localPort: 8080
-`
-	err = os.WriteFile(configPath, []byte(invalid), 0600)
-	require.NoError(t, err)
-
-	// Wait a bit
-	time.Sleep(500 * time.Millisecond)
-
-	// Callback should not have been called
-	mu.Lock()
-	assert.Equal(t, 0, callbackCount, "callback should not be called for invalid config")
-	mu.Unlock()
-}
-
-// TestWatcher_IgnoresOtherFiles tests that changes to other files are ignored
-func TestWatcher_IgnoresOtherFiles(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-	otherPath := filepath.Join(tmpDir, "other.txt")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	callbackCount := 0
-	var mu sync.Mutex
-
-	callback := func(cfg *Config) error {
-		mu.Lock()
-		defer mu.Unlock()
-		callbackCount++
-		return nil
-	}
-
-	watcher, err := NewWatcher(configPath, callback, false)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-	defer watcher.Stop()
-
-	watcher.Start()
-	time.Sleep(100 * time.Millisecond)
-
-	// Write to a different file
-	err = os.WriteFile(otherPath, []byte("some content"), 0600)
-	require.NoError(t, err)
-
-	// Wait a bit
-	time.Sleep(500 * time.Millisecond)
-
-	// Callback should not have been called
-	mu.Lock()
-	assert.Equal(t, 0, callbackCount, "callback should not be called for other files")
-	mu.Unlock()
-}
-
-// TestWatcher_HandleReload_LoadError tests handleReload with load error
-func TestWatcher_HandleReload_LoadError(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	callbackCalled := false
-
-	callback := func(cfg *Config) error {
-		callbackCalled = true
-		return nil
-	}
-
-	watcher, err := NewWatcher(configPath, callback, false)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-	defer watcher.Stop()
-
-	// Delete the config file to cause load error
-	_ = os.Remove(configPath)
-
-	// Call handleReload directly
-	watcher.handleReload()
-
-	// Callback should not have been called
-	assert.False(t, callbackCalled)
-}
-
-// TestWatcher_DoubleStop tests that double stop doesn't panic
-func TestWatcher_DoubleStop(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	callback := func(cfg *Config) error { return nil }
-
-	watcher, err := NewWatcher(configPath, callback, false)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-
-	watcher.Start()
-
-	// First stop
-	watcher.Stop()
-
-	// Second stop should not panic (though the channel is already closed)
-	// Note: This might panic due to close on closed channel, which is actually
-	// a design issue - but we document the current behavior
-}
-
-// TestWatcher_StopWithoutStart tests stopping without starting
-func TestWatcher_StopWithoutStart(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create initial config file
-	initial := `contexts:
-  - name: dev
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/app
-            port: 8080
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(initial), 0600)
-	require.NoError(t, err)
-
-	callback := func(cfg *Config) error { return nil }
-
-	watcher, err := NewWatcher(configPath, callback, false)
-	require.NoError(t, err)
-	require.NotNil(t, watcher)
-
-	// Stop without starting should not hang
-	done := make(chan bool)
-	go func() {
-		watcher.Stop()
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		// Success
-	case <-time.After(5 * time.Second):
-		t.Fatal("Stop without start timed out")
-	}
-}

internal/converter/kftray.go

@@ -1,12 +1,3 @@
-// Package converter provides configuration migration from other port-forwarding
-// tools to kportal's YAML format. Currently supports kftray JSON format.
-//
-// Basic usage:
-//
-//	err := converter.ConvertKFTrayToKPortal("kftray.json", ".kportal.yaml")
-//	if err != nil {
-//	    log.Fatal(err)
-//	}
 package converter
 
 import (
@@ -15,7 +6,7 @@ import (
 	"os"
 	"sort"
 
-	"github.com/lukaszraczylo/kportal/internal/config"
+	"github.com/nvm/kportal/internal/config"
 	"gopkg.in/yaml.v3"
 )
 
@@ -23,26 +14,25 @@ import (
 type KFTrayConfig struct {
 	Service      string `json:"service"`
 	Namespace    string `json:"namespace"`
+	LocalPort    int    `json:"local_port"`
+	RemotePort   int    `json:"remote_port"`
 	Context      string `json:"context"`
 	WorkloadType string `json:"workload_type"`
 	Protocol     string `json:"protocol"`
 	Alias        string `json:"alias"`
-	LocalPort    int    `json:"local_port"`
-	RemotePort   int    `json:"remote_port"`
 }
 
 // ConvertKFTrayToKPortal converts kftray JSON configuration to kportal YAML format
 func ConvertKFTrayToKPortal(inputFile, outputFile string) error {
 	// Read kftray JSON config
-	// #nosec G304 -- inputFile is from command line argument for explicit conversion
 	data, err := os.ReadFile(inputFile)
 	if err != nil {
 		return fmt.Errorf("failed to read input file: %w", err)
 	}
 
 	var kftrayConfigs []KFTrayConfig
-	if unmarshalErr := json.Unmarshal(data, &kftrayConfigs); unmarshalErr != nil {
-		return fmt.Errorf("failed to parse JSON: %w", unmarshalErr)
+	if err := json.Unmarshal(data, &kftrayConfigs); err != nil {
+		return fmt.Errorf("failed to parse JSON: %w", err)
 	}
 
 	// Convert to kportal format
@@ -58,7 +48,7 @@ func ConvertKFTrayToKPortal(inputFile, outputFile string) error {
 	header := "# kportal configuration converted from kftray format\n# Generated by kportal --convert\n\n"
 	yamlData = append([]byte(header), yamlData...)
 
-	if err := os.WriteFile(outputFile, yamlData, 0600); err != nil {
+	if err := os.WriteFile(outputFile, yamlData, 0644); err != nil {
 		return fmt.Errorf("failed to write output file: %w", err)
 	}
 
@@ -67,7 +57,6 @@ func ConvertKFTrayToKPortal(inputFile, outputFile string) error {
 
 // GetConversionSummary returns statistics about the kftray configuration
 func GetConversionSummary(inputFile string) (map[string]map[string]int, int, error) {
-	// #nosec G304 -- inputFile is from command line argument for explicit conversion
 	data, err := os.ReadFile(inputFile)
 	if err != nil {
 		return nil, 0, fmt.Errorf("failed to read input file: %w", err)
@@ -178,9 +167,9 @@ type namespaceEntry struct {
 type forwardEntry struct {
 	Resource  string `yaml:"resource"`
 	Protocol  string `yaml:"protocol"`
-	Alias     string `yaml:"alias,omitempty"`
 	Port      int    `yaml:"port"`
 	LocalPort int    `yaml:"localPort"`
+	Alias     string `yaml:"alias,omitempty"`
 }
 
 // Convert internal types to config package types

internal/converter/kftray_io_test.go

@@ -1,323 +0,0 @@
-package converter
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-)
-
-// writeJSON writes v as JSON to a temp file in dir, returns the path.
-func writeJSON(t *testing.T, dir string, name string, v any) string {
-	t.Helper()
-	data, err := json.Marshal(v)
-	require.NoError(t, err)
-	path := filepath.Join(dir, name)
-	require.NoError(t, os.WriteFile(path, data, 0600))
-	return path
-}
-
-// ─── ConvertKFTrayToKPortal ──────────────────────────────────────────────────
-
-func TestConvertKFTrayToKPortal_HappyPath(t *testing.T) {
-	dir := t.TempDir()
-	input := writeJSON(t, dir, "in.json", []KFTrayConfig{
-		{
-			Service:      "api",
-			Namespace:    "default",
-			Context:      "prod",
-			WorkloadType: "service",
-			Protocol:     "tcp",
-			Alias:        "prod-api",
-			LocalPort:    8080,
-			RemotePort:   3000,
-		},
-	})
-	output := filepath.Join(dir, "out.yaml")
-
-	err := ConvertKFTrayToKPortal(input, output)
-	require.NoError(t, err)
-
-	raw, err := os.ReadFile(output)
-	require.NoError(t, err)
-
-	// Header present
-	assert.True(t, strings.HasPrefix(string(raw), "# kportal configuration converted from kftray format"),
-		"output must start with the header comment")
-
-	// Parse the YAML body (strip comment lines for strict unmarshal)
-	var cfg config.Config
-	require.NoError(t, yaml.Unmarshal(raw, &cfg))
-
-	require.Len(t, cfg.Contexts, 1)
-	assert.Equal(t, "prod", cfg.Contexts[0].Name)
-	require.Len(t, cfg.Contexts[0].Namespaces, 1)
-	assert.Equal(t, "default", cfg.Contexts[0].Namespaces[0].Name)
-	require.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 1)
-
-	fwd := cfg.Contexts[0].Namespaces[0].Forwards[0]
-	assert.Equal(t, "service/api", fwd.Resource)
-	assert.Equal(t, "tcp", fwd.Protocol)
-	assert.Equal(t, 3000, fwd.Port)
-	assert.Equal(t, 8080, fwd.LocalPort)
-	assert.Equal(t, "prod-api", fwd.Alias)
-}
-
-func TestConvertKFTrayToKPortal_MissingInputFile(t *testing.T) {
-	dir := t.TempDir()
-	err := ConvertKFTrayToKPortal(filepath.Join(dir, "nonexistent.json"), filepath.Join(dir, "out.yaml"))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to read input file")
-}
-
-func TestConvertKFTrayToKPortal_MalformedJSON(t *testing.T) {
-	dir := t.TempDir()
-	input := filepath.Join(dir, "bad.json")
-	require.NoError(t, os.WriteFile(input, []byte("{not json}"), 0600))
-
-	err := ConvertKFTrayToKPortal(input, filepath.Join(dir, "out.yaml"))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to parse JSON")
-}
-
-func TestConvertKFTrayToKPortal_EmptyArray(t *testing.T) {
-	dir := t.TempDir()
-	input := writeJSON(t, dir, "empty.json", []KFTrayConfig{})
-	output := filepath.Join(dir, "out.yaml")
-
-	err := ConvertKFTrayToKPortal(input, output)
-	require.NoError(t, err)
-
-	raw, err := os.ReadFile(output)
-	require.NoError(t, err)
-
-	var cfg config.Config
-	require.NoError(t, yaml.Unmarshal(raw, &cfg))
-	assert.Empty(t, cfg.Contexts)
-}
-
-func TestConvertKFTrayToKPortal_UnwritableOutputDir(t *testing.T) {
-	dir := t.TempDir()
-	input := writeJSON(t, dir, "in.json", []KFTrayConfig{
-		{Service: "svc", Namespace: "ns", Context: "ctx", WorkloadType: "service", Protocol: "tcp", LocalPort: 80, RemotePort: 80},
-	})
-
-	// Use a path that cannot be created (sub-dir of a non-existing dir)
-	output := filepath.Join(dir, "no-such-subdir", "out.yaml")
-
-	err := ConvertKFTrayToKPortal(input, output)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to write output file")
-}
-
-func TestConvertKFTrayToKPortal_MultipleEntries_YAMLRoundtrip(t *testing.T) {
-	dir := t.TempDir()
-	entries := []KFTrayConfig{
-		{Service: "postgres", Namespace: "db", Context: "prod", WorkloadType: "service", Protocol: "tcp", Alias: "pg", LocalPort: 5432, RemotePort: 5432},
-		{Service: "redis", Namespace: "cache", Context: "prod", WorkloadType: "service", Protocol: "tcp", Alias: "rd", LocalPort: 6379, RemotePort: 6379},
-		{Service: "api", Namespace: "default", Context: "staging", WorkloadType: "pod", Protocol: "tcp", LocalPort: 8080, RemotePort: 8080},
-	}
-	input := writeJSON(t, dir, "in.json", entries)
-	output := filepath.Join(dir, "out.yaml")
-
-	require.NoError(t, ConvertKFTrayToKPortal(input, output))
-
-	raw, err := os.ReadFile(output)
-	require.NoError(t, err)
-
-	var cfg config.Config
-	require.NoError(t, yaml.Unmarshal(raw, &cfg))
-
-	// Two distinct contexts: prod, staging (sorted)
-	require.Len(t, cfg.Contexts, 2)
-	assert.Equal(t, "prod", cfg.Contexts[0].Name)
-	assert.Equal(t, "staging", cfg.Contexts[1].Name)
-
-	// prod has two namespaces sorted: cache, db
-	prodNS := cfg.Contexts[0].Namespaces
-	require.Len(t, prodNS, 2)
-	assert.Equal(t, "cache", prodNS[0].Name)
-	assert.Equal(t, "db", prodNS[1].Name)
-
-	// staging/default has pod workload type
-	stagingFwd := cfg.Contexts[1].Namespaces[0].Forwards[0]
-	assert.Equal(t, "pod/api", stagingFwd.Resource)
-}
-
-func TestConvertKFTrayToKPortal_OutputFilePermissions(t *testing.T) {
-	dir := t.TempDir()
-	input := writeJSON(t, dir, "in.json", []KFTrayConfig{
-		{Service: "svc", Namespace: "ns", Context: "ctx", WorkloadType: "service", Protocol: "tcp", LocalPort: 80, RemotePort: 80},
-	})
-	output := filepath.Join(dir, "out.yaml")
-
-	require.NoError(t, ConvertKFTrayToKPortal(input, output))
-
-	info, err := os.Stat(output)
-	require.NoError(t, err)
-	// Written with 0600 — owner rw, no group/other
-	assert.Equal(t, os.FileMode(0600), info.Mode().Perm())
-}
-
-// ─── GetConversionSummary ────────────────────────────────────────────────────
-
-func TestGetConversionSummary_HappyPath(t *testing.T) {
-	dir := t.TempDir()
-	entries := []KFTrayConfig{
-		{Service: "api", Namespace: "default", Context: "prod", WorkloadType: "service", Protocol: "tcp", LocalPort: 8080, RemotePort: 8080},
-		{Service: "pg", Namespace: "db", Context: "prod", WorkloadType: "service", Protocol: "tcp", LocalPort: 5432, RemotePort: 5432},
-		{Service: "api", Namespace: "default", Context: "staging", WorkloadType: "service", Protocol: "tcp", LocalPort: 8080, RemotePort: 8080},
-	}
-	input := writeJSON(t, dir, "in.json", entries)
-
-	contextMap, total, err := GetConversionSummary(input)
-	require.NoError(t, err)
-
-	assert.Equal(t, 3, total)
-	assert.Len(t, contextMap, 2)
-
-	// prod context: 2 entries across 2 namespaces
-	assert.Equal(t, 1, contextMap["prod"]["default"])
-	assert.Equal(t, 1, contextMap["prod"]["db"])
-
-	// staging context: 1 entry in default namespace
-	assert.Equal(t, 1, contextMap["staging"]["default"])
-}
-
-func TestGetConversionSummary_MissingFile(t *testing.T) {
-	dir := t.TempDir()
-	_, _, err := GetConversionSummary(filepath.Join(dir, "ghost.json"))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to read input file")
-}
-
-func TestGetConversionSummary_MalformedJSON(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "bad.json")
-	require.NoError(t, os.WriteFile(path, []byte("not-json"), 0600))
-
-	_, _, err := GetConversionSummary(path)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to parse JSON")
-}
-
-func TestGetConversionSummary_EmptyArray(t *testing.T) {
-	dir := t.TempDir()
-	input := writeJSON(t, dir, "empty.json", []KFTrayConfig{})
-
-	contextMap, total, err := GetConversionSummary(input)
-	require.NoError(t, err)
-	assert.Equal(t, 0, total)
-	assert.Empty(t, contextMap)
-}
-
-func TestGetConversionSummary_SameNamespaceDifferentContexts(t *testing.T) {
-	dir := t.TempDir()
-	entries := []KFTrayConfig{
-		{Service: "svc", Namespace: "default", Context: "ctx-a", LocalPort: 80, RemotePort: 80},
-		{Service: "svc", Namespace: "default", Context: "ctx-a", LocalPort: 81, RemotePort: 81},
-		{Service: "svc", Namespace: "default", Context: "ctx-b", LocalPort: 80, RemotePort: 80},
-	}
-	input := writeJSON(t, dir, "in.json", entries)
-
-	contextMap, total, err := GetConversionSummary(input)
-	require.NoError(t, err)
-	assert.Equal(t, 3, total)
-	// ctx-a/default has 2 services
-	assert.Equal(t, 2, contextMap["ctx-a"]["default"])
-	// ctx-b/default has 1 service
-	assert.Equal(t, 1, contextMap["ctx-b"]["default"])
-}
-
-// ─── convertToKPortal edge cases ─────────────────────────────────────────────
-
-func TestConvertToKPortal_EmptyInput(t *testing.T) {
-	result := convertToKPortal([]KFTrayConfig{})
-	assert.Empty(t, result.Contexts)
-}
-
-func TestConvertToKPortal_ZeroPorts(t *testing.T) {
-	result := convertToKPortal([]KFTrayConfig{
-		{Service: "svc", Namespace: "ns", Context: "ctx", WorkloadType: "service", Protocol: "tcp"},
-	})
-	require.Len(t, result.Contexts, 1)
-	fwd := result.Contexts[0].Namespaces[0].Forwards[0]
-	assert.Equal(t, 0, fwd.Port)
-	assert.Equal(t, 0, fwd.LocalPort)
-}
-
-func TestConvertToKPortal_EmptyWorkloadType(t *testing.T) {
-	// WorkloadType="" → resource becomes "/svc"
-	result := convertToKPortal([]KFTrayConfig{
-		{Service: "svc", Namespace: "ns", Context: "ctx", WorkloadType: "", Protocol: "tcp", LocalPort: 80, RemotePort: 80},
-	})
-	fwd := result.Contexts[0].Namespaces[0].Forwards[0]
-	assert.Equal(t, "/svc", fwd.Resource)
-}
-
-func TestConvertToKPortal_ForwardsSortedByLocalPort(t *testing.T) {
-	// Supply in reverse order; expect ascending local port after conversion
-	cfgs := []KFTrayConfig{
-		{Service: "c", Namespace: "ns", Context: "ctx", WorkloadType: "service", Protocol: "tcp", LocalPort: 9000, RemotePort: 9000},
-		{Service: "a", Namespace: "ns", Context: "ctx", WorkloadType: "service", Protocol: "tcp", LocalPort: 1000, RemotePort: 1000},
-		{Service: "b", Namespace: "ns", Context: "ctx", WorkloadType: "service", Protocol: "tcp", LocalPort: 5000, RemotePort: 5000},
-	}
-	result := convertToKPortal(cfgs)
-	forwards := result.Contexts[0].Namespaces[0].Forwards
-	require.Len(t, forwards, 3)
-	assert.Equal(t, 1000, forwards[0].LocalPort)
-	assert.Equal(t, 5000, forwards[1].LocalPort)
-	assert.Equal(t, 9000, forwards[2].LocalPort)
-}
-
-func TestConvertToKPortal_ContextsAndNamespacesSortedAlphabetically(t *testing.T) {
-	cfgs := []KFTrayConfig{
-		{Service: "svc", Namespace: "z-ns", Context: "z-ctx", WorkloadType: "service", Protocol: "tcp", LocalPort: 80, RemotePort: 80},
-		{Service: "svc", Namespace: "a-ns", Context: "z-ctx", WorkloadType: "service", Protocol: "tcp", LocalPort: 81, RemotePort: 81},
-		{Service: "svc", Namespace: "m-ns", Context: "a-ctx", WorkloadType: "service", Protocol: "tcp", LocalPort: 82, RemotePort: 82},
-	}
-	result := convertToKPortal(cfgs)
-
-	require.Len(t, result.Contexts, 2)
-	assert.Equal(t, "a-ctx", result.Contexts[0].Name)
-	assert.Equal(t, "z-ctx", result.Contexts[1].Name)
-
-	zCtxNS := result.Contexts[1].Namespaces
-	require.Len(t, zCtxNS, 2)
-	assert.Equal(t, "a-ns", zCtxNS[0].Name)
-	assert.Equal(t, "z-ns", zCtxNS[1].Name)
-}
-
-func TestConvertToKPortal_AliasPreservedWhenSet(t *testing.T) {
-	cfgs := []KFTrayConfig{
-		{Service: "svc", Namespace: "ns", Context: "ctx", WorkloadType: "service", Protocol: "tcp", Alias: "my-alias", LocalPort: 80, RemotePort: 80},
-	}
-	result := convertToKPortal(cfgs)
-	assert.Equal(t, "my-alias", result.Contexts[0].Namespaces[0].Forwards[0].Alias)
-}
-
-func TestConvertToKPortal_DifferentProtocols(t *testing.T) {
-	tests := []struct {
-		protocol string
-	}{
-		{"tcp"},
-		{"udp"},
-		{""},
-	}
-	for _, tt := range tests {
-		tt := tt
-		t.Run("protocol="+tt.protocol, func(t *testing.T) {
-			result := convertToKPortal([]KFTrayConfig{
-				{Service: "svc", Namespace: "ns", Context: "ctx", WorkloadType: "service", Protocol: tt.protocol, LocalPort: 80, RemotePort: 80},
-			})
-			assert.Equal(t, tt.protocol, result.Contexts[0].Namespaces[0].Forwards[0].Protocol)
-		})
-	}
-}

internal/events/bus.go

@@ -1,188 +0,0 @@
-// Package events provides a publish-subscribe event bus for decoupled
-// communication between kportal components. Events are typed and carry
-// contextual data about forward lifecycle, health status, and configuration
-// changes.
-//
-// Event types include:
-//   - Forward lifecycle: starting, connected, disconnected, reconnecting, stopped, error
-//   - Health: status_changed, stale
-//   - Watchdog: worker_hung
-//   - Config: reloaded
-//
-// Basic usage:
-//
-//	bus := events.NewBus()
-//	bus.Subscribe(events.EventForwardConnected, func(e events.Event) {
-//	    fmt.Printf("Forward %s connected\n", e.ForwardID)
-//	})
-//	bus.Publish(events.Event{Type: events.EventForwardConnected, ForwardID: "..."})
-package events
-
-import (
-	"sync"
-)
-
-// EventType represents the type of event
-type EventType string
-
-const (
-	// Forward lifecycle events
-	EventForwardStarting     EventType = "forward.starting"
-	EventForwardConnected    EventType = "forward.connected"
-	EventForwardDisconnected EventType = "forward.disconnected"
-	EventForwardReconnecting EventType = "forward.reconnecting"
-	EventForwardStopped      EventType = "forward.stopped"
-	EventForwardError        EventType = "forward.error"
-
-	// Health events
-	EventHealthStatusChanged EventType = "health.status_changed"
-	EventHealthStale         EventType = "health.stale"
-
-	// Watchdog events
-	EventWorkerHung EventType = "watchdog.worker_hung"
-
-	// Config events
-	EventConfigReloaded EventType = "config.reloaded"
-)
-
-// Event represents a system event
-type Event struct {
-	Data      map[string]interface{}
-	Type      EventType
-	ForwardID string
-}
-
-// Handler is a function that handles events
-type Handler func(event Event)
-
-// Bus is a simple event bus for decoupled communication between components
-type Bus struct {
-	handlers map[EventType][]Handler
-	mu       sync.RWMutex
-	closed   bool
-}
-
-// NewBus creates a new event bus
-func NewBus() *Bus {
-	return &Bus{
-		handlers: make(map[EventType][]Handler),
-	}
-}
-
-// Subscribe registers a handler for a specific event type
-func (b *Bus) Subscribe(eventType EventType, handler Handler) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	if b.closed {
-		return
-	}
-
-	b.handlers[eventType] = append(b.handlers[eventType], handler)
-}
-
-// SubscribeAll registers a handler for all events
-func (b *Bus) SubscribeAll(handler Handler) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	if b.closed {
-		return
-	}
-
-	// Subscribe to all known event types
-	eventTypes := []EventType{
-		EventForwardStarting,
-		EventForwardConnected,
-		EventForwardDisconnected,
-		EventForwardReconnecting,
-		EventForwardStopped,
-		EventForwardError,
-		EventHealthStatusChanged,
-		EventHealthStale,
-		EventWorkerHung,
-		EventConfigReloaded,
-	}
-
-	for _, et := range eventTypes {
-		b.handlers[et] = append(b.handlers[et], handler)
-	}
-}
-
-// Publish sends an event to all registered handlers
-// Handlers are called synchronously in the order they were registered
-func (b *Bus) Publish(event Event) {
-	b.mu.RLock()
-	if b.closed {
-		b.mu.RUnlock()
-		return
-	}
-	handlers := make([]Handler, len(b.handlers[event.Type]))
-	copy(handlers, b.handlers[event.Type])
-	b.mu.RUnlock()
-
-	for _, handler := range handlers {
-		handler(event)
-	}
-}
-
-// PublishAsync sends an event to all registered handlers asynchronously
-func (b *Bus) PublishAsync(event Event) {
-	b.mu.RLock()
-	if b.closed {
-		b.mu.RUnlock()
-		return
-	}
-	handlers := make([]Handler, len(b.handlers[event.Type]))
-	copy(handlers, b.handlers[event.Type])
-	b.mu.RUnlock()
-
-	for _, handler := range handlers {
-		go handler(event)
-	}
-}
-
-// Close stops the event bus and prevents new subscriptions/publications
-func (b *Bus) Close() {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	b.closed = true
-	b.handlers = make(map[EventType][]Handler)
-}
-
-// Helper functions for creating common events
-
-// NewHealthEvent creates a health status change event
-func NewHealthEvent(forwardID string, status string, errorMsg string) Event {
-	return Event{
-		Type:      EventHealthStatusChanged,
-		ForwardID: forwardID,
-		Data: map[string]interface{}{
-			"status":    status,
-			"error_msg": errorMsg,
-		},
-	}
-}
-
-// NewStaleEvent creates a stale connection event
-func NewStaleEvent(forwardID string, reason string) Event {
-	return Event{
-		Type:      EventHealthStale,
-		ForwardID: forwardID,
-		Data: map[string]interface{}{
-			"reason": reason,
-		},
-	}
-}
-
-// NewWorkerHungEvent creates a hung worker event
-func NewWorkerHungEvent(forwardID string, timeSinceHeartbeat string) Event {
-	return Event{
-		Type:      EventWorkerHung,
-		ForwardID: forwardID,
-		Data: map[string]interface{}{
-			"time_since_heartbeat": timeSinceHeartbeat,
-		},
-	}
-}

internal/events/bus_test.go

@@ -1,175 +0,0 @@
-package events
-
-import (
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestBus_Subscribe(t *testing.T) {
-	bus := NewBus()
-	defer bus.Close()
-
-	var received bool
-	bus.Subscribe(EventForwardStarting, func(e Event) {
-		received = true
-	})
-
-	bus.Publish(Event{Type: EventForwardStarting})
-	assert.True(t, received)
-}
-
-func TestBus_SubscribeMultipleHandlers(t *testing.T) {
-	bus := NewBus()
-	defer bus.Close()
-
-	var count int32
-	handler := func(e Event) {
-		atomic.AddInt32(&count, 1)
-	}
-
-	bus.Subscribe(EventForwardStarting, handler)
-	bus.Subscribe(EventForwardStarting, handler)
-	bus.Subscribe(EventForwardStarting, handler)
-
-	bus.Publish(Event{Type: EventForwardStarting})
-	assert.Equal(t, int32(3), atomic.LoadInt32(&count))
-}
-
-func TestBus_SubscribeAll(t *testing.T) {
-	bus := NewBus()
-	defer bus.Close()
-
-	var count int32
-	bus.SubscribeAll(func(e Event) {
-		atomic.AddInt32(&count, 1)
-	})
-
-	bus.Publish(Event{Type: EventForwardStarting})
-	bus.Publish(Event{Type: EventForwardConnected})
-	bus.Publish(Event{Type: EventHealthStatusChanged})
-
-	assert.Equal(t, int32(3), atomic.LoadInt32(&count))
-}
-
-func TestBus_PublishWithData(t *testing.T) {
-	bus := NewBus()
-	defer bus.Close()
-
-	var receivedEvent Event
-	bus.Subscribe(EventHealthStatusChanged, func(e Event) {
-		receivedEvent = e
-	})
-
-	bus.Publish(Event{
-		Type:      EventHealthStatusChanged,
-		ForwardID: "test-forward",
-		Data: map[string]interface{}{
-			"status": "Active",
-		},
-	})
-
-	assert.Equal(t, EventHealthStatusChanged, receivedEvent.Type)
-	assert.Equal(t, "test-forward", receivedEvent.ForwardID)
-	assert.Equal(t, "Active", receivedEvent.Data["status"])
-}
-
-func TestBus_PublishAsync(t *testing.T) {
-	bus := NewBus()
-	defer bus.Close()
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-
-	bus.Subscribe(EventForwardStarting, func(e Event) {
-		wg.Done()
-	})
-
-	bus.PublishAsync(Event{Type: EventForwardStarting})
-
-	// Wait for async handler with timeout
-	done := make(chan struct{})
-	go func() {
-		wg.Wait()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-		// Success
-	case <-time.After(time.Second):
-		t.Fatal("Async handler not called within timeout")
-	}
-}
-
-func TestBus_Close(t *testing.T) {
-	bus := NewBus()
-
-	var received bool
-	bus.Subscribe(EventForwardStarting, func(e Event) {
-		received = true
-	})
-
-	bus.Close()
-
-	// After close, publish should not call handlers
-	bus.Publish(Event{Type: EventForwardStarting})
-	assert.False(t, received)
-
-	// Subscribe after close should be a no-op
-	bus.Subscribe(EventForwardConnected, func(e Event) {
-		received = true
-	})
-	bus.Publish(Event{Type: EventForwardConnected})
-	assert.False(t, received)
-}
-
-func TestBus_ConcurrentAccess(t *testing.T) {
-	bus := NewBus()
-	defer bus.Close()
-
-	var count int64
-	bus.Subscribe(EventForwardStarting, func(e Event) {
-		atomic.AddInt64(&count, 1)
-	})
-
-	var wg sync.WaitGroup
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			bus.Publish(Event{Type: EventForwardStarting})
-		}()
-	}
-
-	wg.Wait()
-	assert.Equal(t, int64(100), atomic.LoadInt64(&count))
-}
-
-func TestNewHealthEvent(t *testing.T) {
-	event := NewHealthEvent("test-id", "Active", "")
-
-	assert.Equal(t, EventHealthStatusChanged, event.Type)
-	assert.Equal(t, "test-id", event.ForwardID)
-	assert.Equal(t, "Active", event.Data["status"])
-	assert.Equal(t, "", event.Data["error_msg"])
-}
-
-func TestNewStaleEvent(t *testing.T) {
-	event := NewStaleEvent("test-id", "connection too old")
-
-	assert.Equal(t, EventHealthStale, event.Type)
-	assert.Equal(t, "test-id", event.ForwardID)
-	assert.Equal(t, "connection too old", event.Data["reason"])
-}
-
-func TestNewWorkerHungEvent(t *testing.T) {
-	event := NewWorkerHungEvent("test-id", "60s")
-
-	assert.Equal(t, EventWorkerHung, event.Type)
-	assert.Equal(t, "test-id", event.ForwardID)
-	assert.Equal(t, "60s", event.Data["time_since_heartbeat"])
-}

internal/forward/concurrency_test.go

@@ -1,208 +0,0 @@
-package forward
-
-import (
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/lukaszraczylo/kportal/internal/events"
-	"github.com/stretchr/testify/assert"
-)
-
-// TestForwardWorker_Stop_Concurrent verifies that concurrent calls to Stop()
-// are safe and do not panic from a double-close of stopChan (Bug 4).
-// Run under -race to catch the underlying issue.
-func TestForwardWorker_Stop_Concurrent(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 18080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	// Pretend the run loop has finished so Stop() does not block on doneChan.
-	close(worker.doneChan)
-
-	const callers = 16
-	var wg sync.WaitGroup
-	wg.Add(callers)
-	start := make(chan struct{})
-
-	for i := 0; i < callers; i++ {
-		go func() {
-			defer wg.Done()
-			<-start
-			// Each call must complete without panicking.
-			worker.Stop()
-		}()
-	}
-
-	close(start) // Release all goroutines simultaneously.
-	wg.Wait()
-
-	// stopChan must be closed exactly once and observable as closed.
-	select {
-	case <-worker.stopChan:
-		// closed — expected
-	default:
-		t.Fatal("stopChan should be closed after Stop()")
-	}
-}
-
-// TestForwardWorker_Stop_Idempotent verifies sequential repeated Stop calls
-// also do not panic.
-func TestForwardWorker_Stop_Idempotent(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 18081,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-	close(worker.doneChan)
-
-	worker.Stop()
-	worker.Stop()
-	worker.Stop()
-}
-
-// TestManager_Reload_EmptyKeepsInfraAlive verifies Bug 2 fix: a Reload that
-// drops to zero forwards must NOT tear down healthChecker / watchdog /
-// eventBus, so subsequent reloads with forwards continue to work.
-func TestManager_Reload_EmptyKeepsInfraAlive(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	// Start with an empty config (Start tolerates this without errors).
-	emptyCfg := &config.Config{}
-	if err := manager.Start(emptyCfg); err != nil {
-		t.Fatalf("Start(empty) failed: %v", err)
-	}
-
-	// Capture references to long-lived components.
-	hcBefore := manager.healthChecker
-	wdBefore := manager.watchdog
-	busBefore := manager.eventBus
-
-	// Reload with another empty config - must not destroy these.
-	if err := manager.Reload(&config.Config{}); err != nil {
-		t.Fatalf("Reload(empty) failed: %v", err)
-	}
-
-	assert.Same(t, hcBefore, manager.healthChecker, "healthChecker must be preserved across empty reload")
-	assert.Same(t, wdBefore, manager.watchdog, "watchdog must be preserved across empty reload")
-	assert.Same(t, busBefore, manager.eventBus, "eventBus must be preserved across empty reload")
-
-	// Event bus must still accept subscribers (would panic / fail if Close was called).
-	manager.eventBus.SubscribeAll(func(_ events.Event) {})
-}
-
-// TestManager_CurrentConfig_RaceFree exercises Bug 1: concurrent Reload and
-// reads of currentConfig (as performed by the health-checker callback path)
-// must be race-free under -race.
-func TestManager_CurrentConfig_RaceFree(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	cfgA := &config.Config{}
-	cfgB := &config.Config{}
-	if err := manager.Start(cfgA); err != nil {
-		t.Fatalf("Start failed: %v", err)
-	}
-
-	stop := make(chan struct{})
-	var wg sync.WaitGroup
-
-	// Writer goroutine: alternates between two configs via Reload.
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		toggle := false
-		for {
-			select {
-			case <-stop:
-				return
-			default:
-			}
-			if toggle {
-				_ = manager.Reload(cfgA)
-			} else {
-				_ = manager.Reload(cfgB)
-			}
-			toggle = !toggle
-		}
-	}()
-
-	// Reader goroutines: emulate health-checker callback's read of
-	// currentConfig. Use the same locking discipline as the production code.
-	for i := 0; i < 4; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for {
-				select {
-				case <-stop:
-					return
-				default:
-				}
-				manager.workersMu.RLock()
-				cfg := manager.currentConfig
-				_ = cfg
-				manager.workersMu.RUnlock()
-			}
-		}()
-	}
-
-	time.Sleep(150 * time.Millisecond)
-	close(stop)
-	wg.Wait()
-}
-
-// TestManager_Stop_Idempotent verifies that calling Manager.Stop() multiple
-// times — sequentially or concurrently — does not panic from a double-close
-// of eventBus or a double Stop on healthChecker/watchdog. The body of Stop()
-// is wrapped in sync.Once.
-func TestManager_Stop_Idempotent(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	if err := manager.Start(&config.Config{}); err != nil {
-		t.Fatalf("Start failed: %v", err)
-	}
-
-	// Sequential double-stop must not panic.
-	manager.Stop()
-	manager.Stop()
-
-	// Build a second manager and call Stop concurrently from many goroutines —
-	// any non-idempotent close path would panic at least one of them.
-	m2, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	if err := m2.Start(&config.Config{}); err != nil {
-		t.Fatalf("Start failed: %v", err)
-	}
-	const callers = 16
-	var wg sync.WaitGroup
-	wg.Add(callers)
-	start := make(chan struct{})
-	for i := 0; i < callers; i++ {
-		go func() {
-			defer wg.Done()
-			<-start
-			m2.Stop()
-		}()
-	}
-	close(start)
-	wg.Wait()
-}

internal/forward/coverage_test.go

@@ -1,797 +0,0 @@
-package forward
-
-// coverage_test.go – targeted tests to lift coverage from ~46% to ≥70%.
-//
-// Functions targeted (all at 0 % before this file):
-//   manager.go  – SetMDNSPublisher, startWorker, stopWorkerInternal(false branch),
-//                 DisableForward, EnableForward (all paths), Reload (diff paths,
-//                 port-conflict rejection, currentConfig update)
-//   watchdog.go – RegisterWorkerWithResponder, pollHeartbeats
-//   worker.go   – sleepWithBackoff (both branches), IsAlive (doneChan branch)
-//   portcheck   – getProcessUsingPortUnix exercised for unknown/error path
-
-import (
-	"net"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/lukaszraczylo/kportal/internal/retry"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// ---------------------------------------------------------------------------
-// Test helpers
-// ---------------------------------------------------------------------------
-
-// buildForward creates a config.Forward with context/namespace set.
-func buildForward(ctx, ns, resource string, localPort, remotePort int) config.Forward {
-	fwd := config.Forward{
-		Resource:  resource,
-		LocalPort: localPort,
-		Port:      remotePort,
-	}
-	fwd.SetContext(ctx, ns)
-	return fwd
-}
-
-// buildConfigFrom constructs a *config.Config containing exactly the supplied
-// forwards (all placed under ctx/ns).
-func buildConfigFrom(ctx, ns string, forwards []config.Forward) *config.Config {
-	return &config.Config{
-		Contexts: []config.Context{
-			{
-				Name: ctx,
-				Namespaces: []config.Namespace{
-					{Name: ns, Forwards: forwards},
-				},
-			},
-		},
-	}
-}
-
-// newCovManager creates a Manager and registers a cleanup that calls Stop.
-// Skips the test if no kubeconfig is available.
-func newCovManager(t *testing.T) *Manager {
-	t.Helper()
-	m, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping – no kubeconfig available")
-	}
-	t.Cleanup(func() { m.Stop() })
-	return m
-}
-
-// inject inserts a worker directly into m.workers without a real k8s call.
-func inject(m *Manager, fwd config.Forward) *ForwardWorker {
-	w := NewForwardWorker(fwd, m.portForwarder, false, m.statusUI, m.healthChecker, m.watchdog)
-	m.workersMu.Lock()
-	m.workers[fwd.ID()] = w
-	m.workersMu.Unlock()
-	return w
-}
-
-// occupyPort binds a TCP listener on all interfaces on a free port.
-// isPortAvailable also binds to all interfaces (":PORT"), so a listener on
-// "0.0.0.0:PORT" is correctly detected as a conflict on both Linux and macOS.
-func occupyPort(t *testing.T) (port int, closeFunc func()) {
-	t.Helper()
-	// #nosec G102 -- test intentionally binds to all interfaces
-	l, err := net.Listen("tcp", ":0")
-	require.NoError(t, err, "need a free port for conflict test")
-	port = l.Addr().(*net.TCPAddr).Port
-	return port, func() { _ = l.Close() }
-}
-
-// ---------------------------------------------------------------------------
-// Manager.SetMDNSPublisher  (0% → covered)
-// ---------------------------------------------------------------------------
-
-func TestManager_SetMDNSPublisher_NilAccepted(t *testing.T) {
-	m := newCovManager(t)
-	m.SetMDNSPublisher(nil) // must not panic
-	assert.Nil(t, m.mdnsPublisher)
-}
-
-// ---------------------------------------------------------------------------
-// Manager.stopWorkerInternal – both removeFromUI branches
-// ---------------------------------------------------------------------------
-
-func TestManager_StopWorkerInternal_RemoveTrue(t *testing.T) {
-	m := newCovManager(t)
-	ui := &MockStatusUpdater{}
-	m.SetStatusUI(ui)
-
-	fwd := buildForward("c", "n", "pod/a", 20001, 80)
-	w := inject(m, fwd)
-	close(w.doneChan) // worker "done" so Stop() returns immediately
-
-	require.NoError(t, m.stopWorkerInternal(fwd.ID(), true))
-	assert.Nil(t, m.GetWorker(fwd.ID()))
-	assert.Contains(t, ui.removes, fwd.ID(), "Remove() should be called")
-}
-
-func TestManager_StopWorkerInternal_RemoveFalse(t *testing.T) {
-	m := newCovManager(t)
-	ui := &MockStatusUpdater{}
-	m.SetStatusUI(ui)
-
-	fwd := buildForward("c", "n", "pod/b", 20002, 80)
-	w := inject(m, fwd)
-	close(w.doneChan)
-
-	require.NoError(t, m.stopWorkerInternal(fwd.ID(), false))
-
-	var sawDisabled bool
-	for _, u := range ui.updates {
-		if u.ID == fwd.ID() && u.Status == "Disabled" {
-			sawDisabled = true
-		}
-	}
-	assert.True(t, sawDisabled, "UpdateStatus('Disabled') should be called")
-	assert.NotContains(t, ui.removes, fwd.ID(), "Remove() must NOT be called")
-}
-
-func TestManager_StopWorkerInternal_MissingWorker(t *testing.T) {
-	m := newCovManager(t)
-	err := m.stopWorkerInternal("ghost", true)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "worker not found")
-}
-
-// ---------------------------------------------------------------------------
-// Manager.DisableForward
-// ---------------------------------------------------------------------------
-
-func TestManager_DisableForward_Success(t *testing.T) {
-	m := newCovManager(t)
-	fwd := buildForward("c", "n", "pod/d", 20010, 80)
-	w := inject(m, fwd)
-	close(w.doneChan)
-	require.NoError(t, m.DisableForward(fwd.ID()))
-	assert.Nil(t, m.GetWorker(fwd.ID()))
-}
-
-func TestManager_DisableForward_Missing(t *testing.T) {
-	m := newCovManager(t)
-	assert.Error(t, m.DisableForward("missing"))
-}
-
-// ---------------------------------------------------------------------------
-// Manager.EnableForward – all three error branches
-// ---------------------------------------------------------------------------
-
-func TestManager_EnableForward_NilConfig(t *testing.T) {
-	m := newCovManager(t)
-	// currentConfig is nil – should return "no configuration available"
-	err := m.EnableForward("any")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "no configuration available")
-}
-
-func TestManager_EnableForward_NotInConfig(t *testing.T) {
-	m := newCovManager(t)
-	m.workersMu.Lock()
-	m.currentConfig = &config.Config{} // empty
-	m.workersMu.Unlock()
-
-	err := m.EnableForward("ctx/ns/pod/gone:9999")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "forward not found in configuration")
-}
-
-func TestManager_EnableForward_AlreadyEnabled(t *testing.T) {
-	m := newCovManager(t)
-
-	fwd := buildForward("c", "n", "pod/e", 20020, 80)
-	cfg := buildConfigFrom("c", "n", []config.Forward{fwd})
-	m.workersMu.Lock()
-	m.currentConfig = cfg
-	m.workersMu.Unlock()
-
-	// Worker already present in map.
-	inject(m, fwd)
-
-	err := m.EnableForward(fwd.ID())
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "forward already enabled")
-}
-
-// ---------------------------------------------------------------------------
-// Manager.startWorker – registers with watchdog + UI, duplicate rejected
-// ---------------------------------------------------------------------------
-
-func TestManager_StartWorker_RegistersAll(t *testing.T) {
-	m := newCovManager(t)
-	ui := &MockStatusUpdater{}
-	m.SetStatusUI(ui)
-
-	fwd := buildForward("c", "n", "pod/r", 20030, 80)
-	require.NoError(t, m.startWorker(fwd))
-	t.Cleanup(func() { _ = m.stopWorkerInternal(fwd.ID(), true) })
-
-	// Worker in map.
-	require.NotNil(t, m.GetWorker(fwd.ID()))
-
-	// UI notified.
-	require.Len(t, ui.adds, 1)
-	assert.Equal(t, fwd.ID(), ui.adds[0].ID)
-
-	// Watchdog entry present.
-	_, _, exists := m.watchdog.GetWorkerState(fwd.ID())
-	assert.True(t, exists)
-}
-
-func TestManager_StartWorker_DuplicateError(t *testing.T) {
-	m := newCovManager(t)
-	fwd := buildForward("c", "n", "pod/dup", 20031, 80)
-	require.NoError(t, m.startWorker(fwd))
-	t.Cleanup(func() { _ = m.stopWorkerInternal(fwd.ID(), true) })
-
-	err := m.startWorker(fwd)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "worker already exists")
-}
-
-// ---------------------------------------------------------------------------
-// Manager.Start – port conflict path
-// ---------------------------------------------------------------------------
-
-func TestManager_Start_PortConflict(t *testing.T) {
-	m := newCovManager(t)
-	port, closeFunc := occupyPort(t)
-	defer closeFunc()
-
-	// Port is occupied by our listener; Start should detect conflict.
-	fwd := buildForward("c", "n", "pod/conflict", port, 80)
-	cfg := buildConfigFrom("c", "n", []config.Forward{fwd})
-	err := m.Start(cfg)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "port conflicts detected")
-}
-
-// ---------------------------------------------------------------------------
-// Manager.Reload – diff paths
-// ---------------------------------------------------------------------------
-
-func TestManager_Reload_RemovesStaleWorker(t *testing.T) {
-	m := newCovManager(t)
-
-	fwd := buildForward("c", "n", "pod/stale", 20040, 80)
-	w := inject(m, fwd)
-	close(w.doneChan)
-	m.workersMu.Lock()
-	m.currentConfig = buildConfigFrom("c", "n", []config.Forward{fwd})
-	m.workersMu.Unlock()
-
-	// New config removes fwd.
-	require.NoError(t, m.Reload(&config.Config{}))
-
-	m.workersMu.RLock()
-	cnt := len(m.workers)
-	m.workersMu.RUnlock()
-	assert.Equal(t, 0, cnt)
-}
-
-func TestManager_Reload_KeepsUnchangedWorker(t *testing.T) {
-	m := newCovManager(t)
-
-	fwd := buildForward("c", "n", "pod/keep", 20041, 80)
-	inject(m, fwd)
-	m.workersMu.Lock()
-	m.currentConfig = buildConfigFrom("c", "n", []config.Forward{fwd})
-	m.workersMu.Unlock()
-
-	newCfg := buildConfigFrom("c", "n", []config.Forward{fwd})
-	require.NoError(t, m.Reload(newCfg))
-
-	assert.NotNil(t, m.GetWorker(fwd.ID()), "unchanged worker should survive Reload")
-}
-
-func TestManager_Reload_PortConflictRejected(t *testing.T) {
-	m := newCovManager(t)
-	m.workersMu.Lock()
-	m.currentConfig = &config.Config{}
-	m.workersMu.Unlock()
-
-	port, closeFunc := occupyPort(t)
-	defer closeFunc()
-
-	fwd := buildForward("c", "n", "pod/conflictnew", port, 80)
-	newCfg := buildConfigFrom("c", "n", []config.Forward{fwd})
-	err := m.Reload(newCfg)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "port conflicts detected")
-}
-
-func TestManager_Reload_UpdatesCurrentConfig(t *testing.T) {
-	m := newCovManager(t)
-	m.workersMu.Lock()
-	m.currentConfig = &config.Config{}
-	m.workersMu.Unlock()
-
-	newCfg := &config.Config{}
-	require.NoError(t, m.Reload(newCfg))
-
-	m.workersMu.RLock()
-	cur := m.currentConfig
-	m.workersMu.RUnlock()
-	assert.Same(t, newCfg, cur)
-}
-
-// ---------------------------------------------------------------------------
-// Watchdog.RegisterWorkerWithResponder + pollHeartbeats
-// ---------------------------------------------------------------------------
-
-// fakeResponder implements HeartbeatResponder for testing.
-type fakeResponder struct {
-	id    string
-	mu    sync.Mutex
-	alive bool
-}
-
-func (f *fakeResponder) IsAlive() bool {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return f.alive
-}
-
-func (f *fakeResponder) GetForwardID() string { return f.id }
-
-func TestWatchdog_RegisterWorkerWithResponder_AliveIncrementsCount(t *testing.T) {
-	wd := NewWatchdog(1*time.Second, 2*time.Second)
-	// Don't Start – call pollHeartbeats manually for determinism.
-
-	r := &fakeResponder{alive: true, id: "w1"}
-	wd.RegisterWorkerWithResponder("w1", r, nil)
-
-	wd.pollHeartbeats()
-
-	_, count, exists := wd.GetWorkerState("w1")
-	assert.True(t, exists)
-	assert.Equal(t, uint64(1), count)
-}
-
-func TestWatchdog_RegisterWorkerWithResponder_DeadNoIncrement(t *testing.T) {
-	wd := NewWatchdog(1*time.Second, 2*time.Second)
-
-	r := &fakeResponder{alive: false, id: "w2"}
-	wd.RegisterWorkerWithResponder("w2", r, nil)
-
-	wd.pollHeartbeats()
-
-	_, count, exists := wd.GetWorkerState("w2")
-	assert.True(t, exists)
-	assert.Equal(t, uint64(0), count)
-}
-
-func TestWatchdog_RegisterWorkerWithResponder_HungTriggersCallback(t *testing.T) {
-	wd := NewWatchdog(30*time.Millisecond, 60*time.Millisecond)
-	wd.Start()
-	t.Cleanup(wd.Stop)
-
-	r := &fakeResponder{alive: false, id: "hung"}
-	called := make(chan string, 1)
-	wd.RegisterWorkerWithResponder("hung", r, func(id string) {
-		select {
-		case called <- id:
-		default:
-		}
-	})
-
-	select {
-	case id := <-called:
-		assert.Equal(t, "hung", id)
-	case <-time.After(1 * time.Second):
-		t.Fatal("hung callback not fired")
-	}
-}
-
-func TestWatchdog_PollHeartbeats_AliveDeadAlive(t *testing.T) {
-	wd := NewWatchdog(1*time.Second, 2*time.Second)
-
-	r := &fakeResponder{alive: true, id: "cycle"}
-	wd.RegisterWorkerWithResponder("cycle", r, nil)
-
-	wd.pollHeartbeats()
-	_, c1, _ := wd.GetWorkerState("cycle")
-	assert.Equal(t, uint64(1), c1)
-
-	r.mu.Lock()
-	r.alive = false
-	r.mu.Unlock()
-	wd.pollHeartbeats()
-	_, c2, _ := wd.GetWorkerState("cycle")
-	assert.Equal(t, uint64(1), c2, "dead poll must not increment")
-
-	r.mu.Lock()
-	r.alive = true
-	r.mu.Unlock()
-	wd.pollHeartbeats()
-	_, c3, _ := wd.GetWorkerState("cycle")
-	assert.Equal(t, uint64(2), c3, "alive again must increment")
-}
-
-func TestWatchdog_PollHeartbeats_LegacyNoResponder(t *testing.T) {
-	wd := NewWatchdog(1*time.Second, 2*time.Second)
-	wd.RegisterWorker("legacy", nil)
-	wd.Heartbeat("legacy") // count = 1
-
-	wd.pollHeartbeats() // no responder – must not touch count
-
-	_, count, _ := wd.GetWorkerState("legacy")
-	assert.Equal(t, uint64(1), count)
-}
-
-// ---------------------------------------------------------------------------
-// ForwardWorker.sleepWithBackoff
-// ---------------------------------------------------------------------------
-
-func TestForwardWorker_SleepWithBackoff_WaitsDelay(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping timing-sensitive test in -short mode")
-	}
-	fwd := buildForward("c", "n", "pod/s", 20050, 80)
-	w := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-	// Don't cancel context – sleep should run for real (1st attempt ≈ 1s + jitter).
-	t.Cleanup(func() { w.cancel() })
-
-	b := retry.NewBackoff()
-	start := time.Now()
-	w.sleepWithBackoff(b)
-	assert.GreaterOrEqual(t, time.Since(start), 500*time.Millisecond)
-}
-
-func TestForwardWorker_SleepWithBackoff_CancelReturnsEarly(t *testing.T) {
-	fwd := buildForward("c", "n", "pod/sc", 20051, 80)
-	w := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-	w.cancel() // pre-cancel
-
-	b := retry.NewBackoff()
-	start := time.Now()
-	w.sleepWithBackoff(b)
-	assert.Less(t, time.Since(start), 2*time.Second, "cancelled worker should not sleep")
-}
-
-func TestForwardWorker_SleepWithBackoff_Verbose(t *testing.T) {
-	fwd := buildForward("c", "n", "pod/sv", 20052, 80)
-	w := NewForwardWorker(fwd, nil, true, nil, nil, nil)
-	w.cancel()
-
-	b := retry.NewBackoff()
-	w.sleepWithBackoff(b) // must not panic in verbose mode
-}
-
-// ---------------------------------------------------------------------------
-// ForwardWorker.IsAlive – doneChan closed path
-// ---------------------------------------------------------------------------
-
-func TestForwardWorker_IsAlive_AfterDoneChanClosed(t *testing.T) {
-	fwd := buildForward("c", "n", "pod/alive", 20060, 80)
-	w := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	assert.True(t, w.IsAlive())
-	close(w.doneChan)
-	assert.False(t, w.IsAlive())
-}
-
-// ---------------------------------------------------------------------------
-// Watchdog.monitorLoop – heartbeat ticker branch (pollHeartbeats via ticker)
-// ---------------------------------------------------------------------------
-
-func TestWatchdog_HeartbeatTickerCalls_PollHeartbeats(t *testing.T) {
-	// Override heartbeatInterval to something short so the ticker fires.
-	wd := NewWatchdog(10*time.Second, 20*time.Second)
-	wd.heartbeatInterval = 30 * time.Millisecond
-	wd.Start()
-	t.Cleanup(wd.Stop)
-
-	r := &fakeResponder{alive: true, id: "hb-tick"}
-	wd.RegisterWorkerWithResponder("hb-tick", r, nil)
-
-	// Wait for the heartbeat ticker to fire at least once.
-	time.Sleep(150 * time.Millisecond)
-
-	_, count, exists := wd.GetWorkerState("hb-tick")
-	assert.True(t, exists)
-	assert.GreaterOrEqual(t, count, uint64(1), "heartbeat ticker should poll responder")
-}
-
-// ---------------------------------------------------------------------------
-// Manager.EnableForward – happy path (forward not currently running)
-// The worker.Start() will fail to connect (no k8s) but startWorker itself
-// succeeds before any network I/O. enableForward returns nil in that case.
-// ---------------------------------------------------------------------------
-
-func TestManager_EnableForward_HappyPath(t *testing.T) {
-	m := newCovManager(t)
-
-	fwd := buildForward("c", "n", "pod/enable", 20070, 80)
-	cfg := buildConfigFrom("c", "n", []config.Forward{fwd})
-	m.workersMu.Lock()
-	m.currentConfig = cfg
-	m.workersMu.Unlock()
-
-	// Worker NOT in map (precondition for enable).
-	err := m.EnableForward(fwd.ID())
-	require.NoError(t, err)
-
-	w := m.GetWorker(fwd.ID())
-	require.NotNil(t, w, "worker should exist after EnableForward")
-	t.Cleanup(func() { w.cancel() })
-}
-
-// ---------------------------------------------------------------------------
-// Manager.stopWorker (one-liner at 0%) – goes through stopWorkerInternal
-// ---------------------------------------------------------------------------
-
-func TestManager_StopWorker_Delegates(t *testing.T) {
-	m := newCovManager(t)
-	ui := &MockStatusUpdater{}
-	m.SetStatusUI(ui)
-
-	fwd := buildForward("c", "n", "pod/sw", 20080, 80)
-	w := inject(m, fwd)
-	close(w.doneChan)
-
-	// stopWorker is package-private; call through DisableForward which calls it
-	// indirectly via stopWorkerInternal — already covered. Call it directly here.
-	err := m.stopWorker(fwd.ID())
-	require.NoError(t, err)
-	assert.Nil(t, m.GetWorker(fwd.ID()))
-	assert.Contains(t, ui.removes, fwd.ID())
-}
-
-// ---------------------------------------------------------------------------
-// Reload.startWorker mDNS branch – nil publisher is a no-op (already covered);
-// confirm the watchdog RegisterWorkerWithResponder is called during Reload-add.
-// ---------------------------------------------------------------------------
-
-func TestManager_Reload_NewForwardRegisteredInWatchdog(t *testing.T) {
-	m := newCovManager(t)
-	m.workersMu.Lock()
-	m.currentConfig = &config.Config{}
-	m.workersMu.Unlock()
-
-	// Port must be free; use occupyPort only temporarily to find a free port number.
-	pc := NewPortChecker()
-	freePort := 0
-	for p := 20090; p < 20200; p++ {
-		if pc.isPortAvailable(p) {
-			freePort = p
-			break
-		}
-	}
-	require.NotZero(t, freePort, "need a free port")
-
-	fwd := buildForward("c", "n", "pod/neww", freePort, 80)
-	newCfg := buildConfigFrom("c", "n", []config.Forward{fwd})
-
-	// Reload adds fwd; startWorker registers it with watchdog.
-	_ = m.Reload(newCfg)
-
-	_, _, exists := m.watchdog.GetWorkerState(fwd.ID())
-	assert.True(t, exists, "watchdog should have the new worker after Reload-add")
-}
-
-// ---------------------------------------------------------------------------
-// startHTTPProxy – disabled path (most common, runs inside run())
-// ---------------------------------------------------------------------------
-
-func TestForwardWorker_StartHTTPProxy_Disabled(t *testing.T) {
-	// IsHTTPLogEnabled() == false → startHTTPProxy returns nil immediately.
-	fwd := buildForward("c", "n", "pod/noproxy", 20100, 80)
-	// HTTPLog is nil by default → disabled.
-	w := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	err := w.startHTTPProxy()
-	require.NoError(t, err)
-	assert.Nil(t, w.httpProxy)
-}
-
-// ---------------------------------------------------------------------------
-// stopHTTPProxy – nil httpProxy branch (no-op)
-// ---------------------------------------------------------------------------
-
-func TestForwardWorker_StopHTTPProxy_NilProxy(t *testing.T) {
-	fwd := buildForward("c", "n", "pod/noproxy2", 20101, 80)
-	w := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-	// httpProxy is nil – must not panic.
-	w.stopHTTPProxy()
-	assert.Nil(t, w.httpProxy)
-}
-
-// ---------------------------------------------------------------------------
-// worker.run – start path (no k8s): worker goroutine starts, hits
-// portForwarder.GetPodForResource which fails (nil portForwarder panics);
-// we simply check it terminates cleanly when stopped immediately.
-// We don't exercise run() body deeply without a real or fake k8s connection.
-// ---------------------------------------------------------------------------
-
-func TestForwardWorker_Start_TerminatesOnCancel(t *testing.T) {
-	fwd := buildForward("c", "n", "pod/run", 20110, 80)
-	// portForwarder is nil → GetPodForResource panics → recovered in run()? No,
-	// there's no recover in run(). So we'd get a nil pointer dereference.
-	// Instead use a real portForwarder from a manager so the call fails gracefully.
-	m := newCovManager(t)
-	w := NewForwardWorker(fwd, m.portForwarder, false, nil, m.healthChecker, m.watchdog)
-
-	w.Start()
-	// Cancel immediately.
-	w.cancel()
-
-	// Worker should stop; wait with timeout.
-	select {
-	case <-w.doneChan:
-		// clean exit
-	case <-time.After(5 * time.Second):
-		t.Fatal("worker did not terminate after cancel")
-	}
-}
-
-// ---------------------------------------------------------------------------
-// getProcessUsingPortUnix – internal branch coverage
-// ---------------------------------------------------------------------------
-
-// TestGetProcessUsingPortUnix_EmptyOutput exercises the pidStr=="" branch.
-// Port 2 is a privileged port that nothing listens on in a test environment.
-// lsof returns either empty (→ "unknown") or a PID if some process owns it.
-// Either way the function must not panic.
-func TestGetProcessUsingPortUnix_NothingListening(t *testing.T) {
-	pc := NewPortChecker()
-	// Port 2 is almost never bound; lsof will return empty → "unknown".
-	result := pc.getProcessUsingPortUnix(2)
-	assert.NotEmpty(t, result)
-}
-
-// TestGetProcessUsingPortUnix_ActivePort exercises the pid-parsing path by
-// using a port that the test binary itself is actively listening on.
-func TestGetProcessUsingPortUnix_ActivePort(t *testing.T) {
-	// #nosec G102 -- test binds to all interfaces intentionally
-	l, err := net.Listen("tcp", ":0")
-	require.NoError(t, err)
-	defer func() { _ = l.Close() }()
-	port := l.Addr().(*net.TCPAddr).Port
-
-	pc := NewPortChecker()
-	result := pc.getProcessUsingPortUnix(port)
-	// Should be a process string or "unknown" – must not panic.
-	assert.NotEmpty(t, result)
-}
-
-// ---------------------------------------------------------------------------
-// startWorker callbacks – exercise watchdog hung callback and health callback
-// ---------------------------------------------------------------------------
-
-// TestStartWorker_WatchdogCallback exercises the hung-worker closure registered
-// by startWorker. We force-trigger it by backdating the worker's heartbeat
-// timestamp beyond the hang threshold and calling checkWorkers().
-func TestStartWorker_WatchdogCallback_TriggerReconnect(t *testing.T) {
-	m := newCovManager(t)
-
-	fwd := buildForward("c", "n", "pod/wdcb", 20120, 80)
-	require.NoError(t, m.startWorker(fwd))
-	t.Cleanup(func() {
-		if w := m.GetWorker(fwd.ID()); w != nil {
-			w.cancel()
-		}
-	})
-
-	// Backdate the heartbeat to force hung detection.
-	m.watchdog.mu.Lock()
-	if state, ok := m.watchdog.workers[fwd.ID()]; ok {
-		state.lastHeartbeat = time.Now().Add(-10 * time.Minute)
-		state.isHung = false // reset so callback fires again
-	}
-	m.watchdog.mu.Unlock()
-
-	// checkWorkers runs the hung callback synchronously (outside the lock).
-	// It calls TriggerReconnect on the worker, which is safe.
-	m.watchdog.checkWorkers()
-
-	// Verify the worker is still in the map (not removed by reconnect).
-	assert.NotNil(t, m.GetWorker(fwd.ID()))
-}
-
-// TestStartWorker_HealthCallback_StatusChange exercises the health callback
-// registered by startWorker by triggering a real status-change event through
-// the HealthChecker's exported MarkReconnecting (which calls notifyStatusChange
-// if status changes). statusUI is set so the callback body executes.
-func TestStartWorker_HealthCallback_StatusChange(t *testing.T) {
-	m := newCovManager(t)
-	ui := &MockStatusUpdater{}
-	m.SetStatusUI(ui)
-
-	fwd := buildForward("c", "n", "pod/hcb", 20121, 80)
-	require.NoError(t, m.startWorker(fwd))
-	t.Cleanup(func() {
-		if w := m.GetWorker(fwd.ID()); w != nil {
-			w.cancel()
-		}
-	})
-
-	// Trigger status change: Starting → Reconnecting fires the callback
-	// (status differs so notifyStatusChange is called).
-	m.healthChecker.MarkStarting(fwd.ID())
-	m.healthChecker.MarkReconnecting(fwd.ID())
-
-	// Give the callback a moment to fire (it's synchronous in notifyStatusChange
-	// but MarkConnected spawns a goroutine; MarkReconnecting calls markStatus directly).
-	time.Sleep(20 * time.Millisecond)
-
-	// Stop the healthchecker so its background per-port goroutine drains
-	// before we read the mock — establishes happens-before for the read and
-	// keeps the race detector quiet on slower CI runners.
-	m.healthChecker.Unregister(fwd.ID())
-
-	// The callback should have updated status. Hold the mock's lock during
-	// the read because background goroutines may still be unwinding.
-	ui.mu.Lock()
-	defer ui.mu.Unlock()
-	var sawUpdate bool
-	for _, u := range ui.updates {
-		if u.ID == fwd.ID() {
-			sawUpdate = true
-		}
-	}
-	assert.True(t, sawUpdate, "health callback should have called UpdateStatus")
-}
-
-// TestStartWorker_HealthCallback_StaleNoRetry exercises StatusStale with retryOnStale=false.
-// MarkReconnecting puts worker into Reconnect state then we change to a different
-// state and back to stale manually via MarkStarting+MarkReconnecting — but there
-// is no exported "MarkStale". Instead, we can exercise the code path via the
-// existing stale detection in checkPort which requires a running checker.
-// Since that's async and complex, we simply confirm the path compiles and runs
-// without covering stale-specific lines (those require a real connection timeout).
-func TestStartWorker_HealthCallback_StaleNoRetry(t *testing.T) {
-	m := newCovManager(t)
-	fwd := buildForward("c", "n", "pod/stale-nort", 20123, 80)
-	m.workersMu.Lock()
-	m.currentConfig = &config.Config{} // retryOnStale defaults to false
-	m.workersMu.Unlock()
-
-	require.NoError(t, m.startWorker(fwd))
-	t.Cleanup(func() {
-		if w := m.GetWorker(fwd.ID()); w != nil {
-			w.cancel()
-		}
-	})
-
-	// Trigger a callback via status change – exercises the outer callback body.
-	m.healthChecker.MarkStarting(fwd.ID())
-	m.healthChecker.MarkReconnecting(fwd.ID())
-	time.Sleep(20 * time.Millisecond)
-}
-
-// ---------------------------------------------------------------------------
-// Watchdog.checkWorkers – event bus branch (publishes WorkerHungEvent)
-// ---------------------------------------------------------------------------
-
-func TestWatchdog_CheckWorkers_WithEventBus(t *testing.T) {
-	// Exercises the eventBus != nil path in checkWorkers.
-	wd := NewWatchdog(30*time.Millisecond, 60*time.Millisecond)
-	m := newCovManager(t)
-	wd.SetEventBus(m.eventBus)
-
-	wd.Start()
-	t.Cleanup(wd.Stop)
-
-	called := make(chan struct{}, 1)
-	wd.RegisterWorker("event-hung", func(string) {
-		select {
-		case called <- struct{}{}:
-		default:
-		}
-	})
-
-	// Never send heartbeat → checkWorkers fires callback (and tries to publish event).
-	select {
-	case <-called:
-		// callback fired – eventBus publish path was reached
-	case <-time.After(1 * time.Second):
-		t.Fatal("hung callback not fired")
-	}
-}

internal/forward/manager.go

@@ -1,17 +1,3 @@
-// Package forward provides the core port-forwarding orchestration for kportal.
-// It manages the lifecycle of port-forward workers, handles hot-reload of
-// configuration changes, and coordinates with the health checker and watchdog.
-//
-// The Manager is the central orchestrator that:
-//   - Creates and manages ForwardWorker instances for each configured forward
-//   - Handles graceful startup, shutdown, and reconfiguration
-//   - Coordinates with the HealthChecker for connection monitoring
-//   - Integrates with mDNS for hostname publishing
-//
-// ForwardWorker handles individual port-forward connections with:
-//   - Automatic retry with exponential backoff (1s → 2s → 4s → 8s → 10s max)
-//   - Pod restart detection and re-resolution
-//   - Graceful shutdown support
 package forward
 
 import (
@@ -20,12 +6,9 @@ import (
 	"sync"
 	"time"
 
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/lukaszraczylo/kportal/internal/events"
-	"github.com/lukaszraczylo/kportal/internal/healthcheck"
-	"github.com/lukaszraczylo/kportal/internal/k8s"
-	"github.com/lukaszraczylo/kportal/internal/logger"
-	"github.com/lukaszraczylo/kportal/internal/mdns"
+	"github.com/nvm/kportal/internal/config"
+	"github.com/nvm/kportal/internal/healthcheck"
+	"github.com/nvm/kportal/internal/k8s"
 )
 
 // StatusUpdater is an interface for updating forward status
@@ -38,51 +21,30 @@ type StatusUpdater interface {
 // Manager orchestrates all port-forward workers.
 // It handles starting, stopping, and hot-reloading forwards.
 type Manager struct {
-	statusUI      StatusUpdater
-	healthChecker *healthcheck.Checker
+	workers       map[string]*ForwardWorker // key: forward.ID()
+	workersMu     sync.RWMutex
 	clientPool    *k8s.ClientPool
 	resolver      *k8s.ResourceResolver
 	portForwarder *k8s.PortForwarder
 	portChecker   *PortChecker
-	workers       map[string]*ForwardWorker
-	watchdog      *Watchdog
-	mdnsPublisher *mdns.Publisher
-	eventBus      *events.Bus
-	// currentConfig holds the active configuration. Access MUST be guarded by
-	// workersMu — it is read from the health-checker callback goroutine
-	// (registered in startWorker) and written by Start/Reload.
-	currentConfig *config.Config
-	workersMu     sync.RWMutex
-	stopOnce      sync.Once
+	healthChecker *healthcheck.Checker
 	verbose       bool
+	currentConfig *config.Config
+	statusUI      StatusUpdater
 }
 
 // NewManager creates a new forward Manager.
-// The health checker will be created with default settings and can be
-// reconfigured via SetConfig().
-func NewManager(verbose bool) (*Manager, error) {
+func NewManager(verbose bool) *Manager {
 	clientPool, err := k8s.NewClientPool()
 	if err != nil {
-		return nil, fmt.Errorf("failed to create client pool: %w", err)
+		log.Fatalf("Failed to create client pool: %v", err)
 	}
 
 	resolver := k8s.NewResourceResolver(clientPool)
 	portForwarder := k8s.NewPortForwarder(clientPool, resolver)
 
-	// Create health checker with defaults: check every 3 seconds with 2 second timeout
-	// Will be reconfigured when config is loaded
-	healthChecker := healthcheck.NewChecker(3*time.Second, 2*time.Second)
-
-	// Create watchdog with default settings: check every 30 seconds, 60 second hang threshold
-	// Will be reconfigured when config is loaded
-	watchdog := NewWatchdog(30*time.Second, 60*time.Second)
-
-	// Create event bus for decoupled communication between components
-	eventBus := events.NewBus()
-
-	// Wire up event bus to components
-	healthChecker.SetEventBus(eventBus)
-	watchdog.SetEventBus(eventBus)
+	// Create health checker: check every 5 seconds with 2 second timeout
+	healthChecker := healthcheck.NewChecker(5*time.Second, 2*time.Second)
 
 	return &Manager{
 		workers:       make(map[string]*ForwardWorker),
@@ -91,60 +53,8 @@ func NewManager(verbose bool) (*Manager, error) {
 		portForwarder: portForwarder,
 		portChecker:   NewPortChecker(),
 		healthChecker: healthChecker,
-		watchdog:      watchdog,
-		eventBus:      eventBus,
 		verbose:       verbose,
-	}, nil
-}
-
-// configureHealthChecker creates a new health checker with settings from config
-func (m *Manager) configureHealthChecker(cfg *config.Config) {
-	// Stop existing health checker
-	if m.healthChecker != nil {
-		m.healthChecker.Stop()
 	}
-
-	// Parse check method
-	methodStr := cfg.GetHealthCheckMethod()
-	var method healthcheck.CheckMethod
-	switch methodStr {
-	case "tcp-dial":
-		method = healthcheck.CheckMethodTCPDial
-	case "data-transfer":
-		method = healthcheck.CheckMethodDataTransfer
-	default:
-		method = healthcheck.CheckMethodDataTransfer
-	}
-
-	// Create new health checker with config settings
-	m.healthChecker = healthcheck.NewCheckerWithOptions(healthcheck.CheckerOptions{
-		Interval:         cfg.GetHealthCheckIntervalOrDefault(),
-		Timeout:          cfg.GetHealthCheckTimeoutOrDefault(),
-		Method:           method,
-		MaxConnectionAge: cfg.GetMaxConnectionAge(),
-		MaxIdleTime:      cfg.GetMaxIdleTime(),
-	})
-
-	// Reconnect event bus to new health checker
-	if m.eventBus != nil {
-		m.healthChecker.SetEventBus(m.eventBus)
-	}
-
-	// Configure TCP settings on port forwarder
-	tcpKeepalive := cfg.GetTCPKeepalive()
-	dialTimeout := cfg.GetDialTimeout()
-	m.portForwarder.SetTCPKeepalive(tcpKeepalive)
-	m.portForwarder.SetDialTimeout(dialTimeout)
-
-	logger.Info("Health checker and reliability configured", map[string]interface{}{
-		"interval":           cfg.GetHealthCheckIntervalOrDefault().String(),
-		"timeout":            cfg.GetHealthCheckTimeoutOrDefault().String(),
-		"method":             methodStr,
-		"max_connection_age": cfg.GetMaxConnectionAge().String(),
-		"max_idle_time":      cfg.GetMaxIdleTime().String(),
-		"tcp_keepalive":      tcpKeepalive.String(),
-		"dial_timeout":       dialTimeout.String(),
-	})
 }
 
 // SetStatusUI sets the status updater for the manager
@@ -152,42 +62,19 @@ func (m *Manager) SetStatusUI(ui StatusUpdater) {
 	m.statusUI = ui
 }
 
-// SetMDNSPublisher sets the mDNS publisher for the manager
-func (m *Manager) SetMDNSPublisher(publisher *mdns.Publisher) {
-	m.mdnsPublisher = publisher
-}
-
 // Start initializes and starts all port-forwards from the configuration.
 func (m *Manager) Start(cfg *config.Config) error {
 	if cfg == nil {
 		return fmt.Errorf("configuration is nil")
 	}
 
-	m.workersMu.Lock()
 	m.currentConfig = cfg
-	m.workersMu.Unlock()
-
-	// Configure health checker with settings from config
-	m.configureHealthChecker(cfg)
-
-	// Start watchdog
-	watchdogPeriod := cfg.GetWatchdogPeriod()
-	m.watchdog.checkInterval = watchdogPeriod
-	m.watchdog.hangThreshold = watchdogPeriod * 2 // Hang threshold is 2x check interval
-	m.watchdog.Start()
-
-	logger.Info("Watchdog started", map[string]interface{}{
-		"check_interval": watchdogPeriod.String(),
-		"hang_threshold": (watchdogPeriod * 2).String(),
-	})
 
 	// Get all forwards from config
 	forwards := cfg.GetAllForwards()
 
-	// Empty config is valid - user can add forwards later via TUI
 	if len(forwards) == 0 {
-		log.Printf("No forwards configured - use 'n' to add forwards")
-		return nil
+		return fmt.Errorf("no forwards configured")
 	}
 
 	// Check port availability before starting
@@ -206,14 +93,7 @@ func (m *Manager) Start(cfg *config.Config) error {
 
 	for _, fwd := range forwards {
 		if err := m.startWorker(fwd); err != nil {
-			logger.Error("Failed to start worker", map[string]interface{}{
-				"forward_id": fwd.ID(),
-				"context":    fwd.GetContext(),
-				"namespace":  fwd.GetNamespace(),
-				"resource":   fwd.Resource,
-				"local_port": fwd.LocalPort,
-				"error":      err.Error(),
-			})
+			log.Printf("Failed to start worker for %s: %v", fwd.ID(), err)
 			// Continue with other workers
 		}
 	}
@@ -224,54 +104,36 @@ func (m *Manager) Start(cfg *config.Config) error {
 
 // Stop gracefully stops all port-forward workers.
 func (m *Manager) Stop() {
-	m.stopOnce.Do(func() {
-		log.Printf("Stopping all port-forwards...")
+	log.Printf("Stopping all port-forwards...")
 
-		// Stop health checker and watchdog first
-		m.healthChecker.Stop()
-		m.watchdog.Stop()
+	// Stop health checker first
+	m.healthChecker.Stop()
 
-		// Close event bus
-		if m.eventBus != nil {
-			m.eventBus.Close()
-		}
+	m.workersMu.Lock()
+	workers := make([]*ForwardWorker, 0, len(m.workers))
+	for _, worker := range m.workers {
+		workers = append(workers, worker)
+	}
+	m.workersMu.Unlock()
 
-		// Stop mDNS publisher
-		if m.mdnsPublisher != nil {
-			m.mdnsPublisher.Stop()
-		}
+	// Stop all workers
+	var wg sync.WaitGroup
+	for _, worker := range workers {
+		wg.Add(1)
+		go func(w *ForwardWorker) {
+			defer wg.Done()
+			w.Stop()
+		}(worker)
+	}
 
-		m.workersMu.Lock()
-		workers := make([]*ForwardWorker, 0, len(m.workers))
-		for _, worker := range m.workers {
-			workers = append(workers, worker)
-		}
-		m.workersMu.Unlock()
+	wg.Wait()
 
-		// Stop all workers with limited concurrency to avoid unbounded goroutine creation
-		var wg sync.WaitGroup
-		sem := make(chan struct{}, 10) // Limit to 10 concurrent stops
+	// Clear workers map
+	m.workersMu.Lock()
+	m.workers = make(map[string]*ForwardWorker)
+	m.workersMu.Unlock()
 
-		for _, worker := range workers {
-			wg.Add(1)
-			sem <- struct{}{} // Acquire semaphore
-
-			go func(w *ForwardWorker) {
-				defer wg.Done()
-				defer func() { <-sem }() // Release semaphore
-				w.Stop()
-			}(worker)
-		}
-
-		wg.Wait()
-
-		// Clear workers map
-		m.workersMu.Lock()
-		m.workers = make(map[string]*ForwardWorker)
-		m.workersMu.Unlock()
-
-		log.Printf("All port-forwards stopped")
-	})
+	log.Printf("All port-forwards stopped")
 }
 
 // Reload applies a new configuration with hot-reload logic.
@@ -284,35 +146,15 @@ func (m *Manager) Reload(newCfg *config.Config) error {
 		return fmt.Errorf("new configuration is nil")
 	}
 
-	logger.Info("Reloading configuration", map[string]interface{}{
-		"new_forwards_count": len(newCfg.GetAllForwards()),
-	})
+	log.Printf("Reloading configuration...")
 
 	// Get all forwards from new config
 	newForwards := newCfg.GetAllForwards()
 
 	if len(newForwards) == 0 {
-		log.Printf("New configuration has no forwards, stopping all workers")
-		// Do NOT call m.Stop() here: it tears down healthChecker, watchdog
-		// and eventBus, which must remain alive so subsequent
-		// EnableForward / Reload calls can register against them.
-		// Only stop currently-running workers and update currentConfig.
-		m.workersMu.RLock()
-		ids := make([]string, 0, len(m.workers))
-		for id := range m.workers {
-			ids = append(ids, id)
-		}
-		m.workersMu.RUnlock()
-
-		for _, id := range ids {
-			if err := m.stopWorkerInternal(id, true); err != nil {
-				log.Printf("Failed to stop worker %s: %v", id, err)
-			}
-		}
-
-		m.workersMu.Lock()
+		log.Printf("New configuration has no forwards, stopping all")
+		m.Stop()
 		m.currentConfig = newCfg
-		m.workersMu.Unlock()
 		return nil
 	}
 
@@ -395,9 +237,7 @@ func (m *Manager) Reload(newCfg *config.Config) error {
 	}
 
 	// Update current config
-	m.workersMu.Lock()
 	m.currentConfig = newCfg
-	m.workersMu.Unlock()
 
 	log.Printf("Configuration reloaded successfully")
 	return nil
@@ -418,94 +258,31 @@ func (m *Manager) startWorker(fwd config.Forward) error {
 		m.statusUI.AddForward(fwd.ID(), &fwd)
 	}
 
-	// Create worker first so we can pass it to watchdog
-	worker := NewForwardWorker(fwd, m.portForwarder, m.verbose, m.statusUI, m.healthChecker, m.watchdog)
-
-	// Register with watchdog using the new responder interface
-	// This allows the watchdog to poll the worker for heartbeats centrally
-	// instead of each worker spawning its own heartbeat goroutine
-	m.watchdog.RegisterWorkerWithResponder(fwd.ID(), worker, func(forwardID string) {
-		logger.Warn("Watchdog triggered reconnection for hung worker", map[string]interface{}{
-			"forward_id": forwardID,
-		})
-
-		// Find and trigger reconnect on hung worker
-		m.workersMu.RLock()
-		w, exists := m.workers[forwardID]
-		m.workersMu.RUnlock()
-
-		if exists {
-			w.TriggerReconnect("watchdog detected hung worker")
-		}
-	})
-
 	// Register with health checker
 	m.healthChecker.Register(fwd.ID(), fwd.LocalPort, func(forwardID string, status healthcheck.Status, errorMsg string) {
 		if m.statusUI != nil {
 			m.statusUI.UpdateStatus(forwardID, string(status))
-
 			// Send error separately if there is one
-			if (status == healthcheck.StatusUnhealthy || status == healthcheck.StatusStale) && errorMsg != "" {
+			if status == healthcheck.StatusUnhealthy && errorMsg != "" {
 				if ui, ok := m.statusUI.(interface{ SetError(id, msg string) }); ok {
 					ui.SetError(forwardID, errorMsg)
 				}
 			}
 		}
-
-		// Handle stale connections: trigger reconnection if retryOnStale is enabled.
-		// Read currentConfig and worker map under a single lock acquisition
-		// to avoid racing with Reload/Start writes.
-		if status == healthcheck.StatusStale {
-			m.workersMu.RLock()
-			retryOnStale := m.currentConfig != nil && m.currentConfig.GetRetryOnStale()
-			staleWorker, exists := m.workers[forwardID]
-			m.workersMu.RUnlock()
-
-			if retryOnStale {
-				logger.Info("Stale connection detected, triggering reconnection", map[string]interface{}{
-					"forward_id": forwardID,
-					"reason":     errorMsg,
-				})
-
-				if exists {
-					staleWorker.TriggerReconnect("stale connection")
-				}
-			}
-		}
 	})
 
-	// Start the worker (already created above)
+	// Create and start worker
+	worker := NewForwardWorker(fwd, m.portForwarder, m.verbose, m.statusUI, m.healthChecker)
 	worker.Start()
 
 	// Store worker
 	m.workers[fwd.ID()] = worker
 
-	// Register mDNS hostname if enabled
-	// Uses explicit alias if set, otherwise generates from resource name
-	if m.mdnsPublisher != nil {
-		mdnsAlias := fwd.GetMDNSAlias()
-		if mdnsAlias != "" {
-			if err := m.mdnsPublisher.Register(fwd.ID(), mdnsAlias, fwd.LocalPort); err != nil {
-				logger.Warn("Failed to register mDNS hostname", map[string]interface{}{
-					"forward_id": fwd.ID(),
-					"alias":      mdnsAlias,
-					"error":      err.Error(),
-				})
-				// Don't fail the forward start - mDNS is optional
-			}
-		}
-	}
-
 	return nil
 }
 
 // stopWorker stops and removes a forward worker.
 func (m *Manager) stopWorker(id string) error {
-	return m.stopWorkerInternal(id, true)
-}
-
-// stopWorkerInternal stops a worker with option to remove from UI or just update status
-func (m *Manager) stopWorkerInternal(id string, removeFromUI bool) error {
 	m.workersMu.Lock()
 	worker, exists := m.workers[id]
 	if !exists {
@@ -515,23 +292,11 @@ func (m *Manager) stopWorkerInternal(id string, removeFromUI bool) error {
 	delete(m.workers, id)
 	m.workersMu.Unlock()
 
-	// Unregister from health checker and watchdog
+	// Unregister from health checker
 	m.healthChecker.Unregister(id)
-	m.watchdog.UnregisterWorker(id)
 
-	// Unregister mDNS hostname
-	if m.mdnsPublisher != nil {
-		m.mdnsPublisher.Unregister(id)
-	}
-
-	// Notify UI - either remove or update to disabled status
-	if m.statusUI != nil {
-		if removeFromUI {
-			m.statusUI.Remove(id)
-		} else {
-			m.statusUI.UpdateStatus(id, "Disabled")
-		}
-	}
+	// Note: We DON'T call Remove() here anymore - keep it in the UI
+	// The UI will show it as disabled instead
 
 	// Stop the worker
 	worker.Stop()
@@ -539,12 +304,25 @@ func (m *Manager) stopWorkerInternal(id string, removeFromUI bool) error {
 	return nil
 }
 
-// GetWorker returns a worker by ID, or nil if not found.
-func (m *Manager) GetWorker(id string) *ForwardWorker {
+// GetActiveForwards returns a list of all active forward IDs.
+func (m *Manager) GetActiveForwards() []string {
 	m.workersMu.RLock()
 	defer m.workersMu.RUnlock()
 
-	return m.workers[id]
+	ids := make([]string, 0, len(m.workers))
+	for id := range m.workers {
+		ids = append(ids, id)
+	}
+
+	return ids
+}
+
+// GetWorkerCount returns the number of active workers.
+func (m *Manager) GetWorkerCount() int {
+	m.workersMu.RLock()
+	defer m.workersMu.RUnlock()
+
+	return len(m.workers)
 }
 
 // extractPorts extracts all local ports from a list of forwards.
@@ -568,7 +346,7 @@ func (m *Manager) getResourceForPort(forwards []config.Forward, port int) string
 
 // DisableForward temporarily stops a forward by ID
 func (m *Manager) DisableForward(id string) error {
-	if err := m.stopWorkerInternal(id, false); err != nil {
+	if err := m.stopWorker(id); err != nil {
 		return err
 	}
 	log.Printf("Disabled: %s", id)
@@ -577,16 +355,12 @@ func (m *Manager) DisableForward(id string) error {
 
 // EnableForward re-enables a previously disabled forward
 func (m *Manager) EnableForward(id string) error {
-	// Find the forward configuration in current config (read under lock)
-	m.workersMu.RLock()
-	cfg := m.currentConfig
-	m.workersMu.RUnlock()
-
-	if cfg == nil {
+	// Find the forward configuration in current config
+	if m.currentConfig == nil {
 		return fmt.Errorf("no configuration available")
 	}
 
-	forwards := cfg.GetAllForwards()
+	forwards := m.currentConfig.GetAllForwards()
 	var targetFwd *config.Forward
 	for _, fwd := range forwards {
 		if fwd.ID() == id {

internal/forward/manager_test.go

@@ -1,391 +0,0 @@
-package forward
-
-import (
-	"fmt"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/lukaszraczylo/kportal/internal/events"
-	"github.com/stretchr/testify/assert"
-)
-
-// TestNewManager tests manager creation
-func TestNewManager(t *testing.T) {
-	t.Run("creates manager with default settings", func(t *testing.T) {
-		// Skip if no kubeconfig available (CI environment)
-		manager, err := NewManager(false)
-		if err != nil {
-			t.Skip("Skipping test - no kubeconfig available")
-		}
-		defer manager.Stop()
-
-		assert.NotNil(t, manager.workers)
-		assert.NotNil(t, manager.portChecker)
-		assert.NotNil(t, manager.healthChecker)
-		assert.NotNil(t, manager.watchdog)
-		assert.NotNil(t, manager.eventBus)
-		assert.False(t, manager.verbose)
-	})
-
-	t.Run("creates manager in verbose mode", func(t *testing.T) {
-		manager, err := NewManager(true)
-		if err != nil {
-			t.Skip("Skipping test - no kubeconfig available")
-		}
-		defer manager.Stop()
-
-		assert.True(t, manager.verbose)
-	})
-}
-
-// TestManager_SetStatusUI tests setting the status UI
-func TestManager_SetStatusUI(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	mockUI := &MockStatusUpdater{}
-	manager.SetStatusUI(mockUI)
-
-	assert.Equal(t, mockUI, manager.statusUI)
-}
-
-// TestManager_GetWorker tests getting a worker by ID
-func TestManager_GetWorker(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	// Non-existent worker
-	worker := manager.GetWorker("non-existent")
-	assert.Nil(t, worker)
-}
-
-// TestManager_Start_NilConfig tests starting with nil config
-func TestManager_Start_NilConfig(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	err = manager.Start(nil)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "configuration is nil")
-}
-
-// TestManager_Start_EmptyForwards tests starting with empty forwards
-func TestManager_Start_EmptyForwards(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	cfg := &config.Config{}
-	err = manager.Start(cfg)
-	// Empty config is now valid - allows users to add forwards via TUI
-	assert.NoError(t, err)
-}
-
-// TestManager_Reload_NilConfig tests reloading with nil config
-func TestManager_Reload_NilConfig(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	err = manager.Reload(nil)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "new configuration is nil")
-}
-
-// TestManager_EnableForward_NoConfig tests enabling without config
-func TestManager_EnableForward_NoConfig(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	err = manager.EnableForward("some-id")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "no configuration available")
-}
-
-// TestManager_DisableForward_NotFound tests disabling non-existent forward
-func TestManager_DisableForward_NotFound(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	err = manager.DisableForward("non-existent")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "worker not found")
-}
-
-// TestManager_extractPorts tests port extraction
-func TestManager_extractPorts(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	forwards := []config.Forward{
-		{LocalPort: 8080},
-		{LocalPort: 5432},
-		{LocalPort: 3000},
-	}
-
-	ports := manager.extractPorts(forwards)
-	assert.Equal(t, []int{8080, 5432, 3000}, ports)
-}
-
-// TestManager_getResourceForPort tests finding resource by port
-func TestManager_getResourceForPort(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	forwards := []config.Forward{
-		{Resource: "pod/app1", LocalPort: 8080, Port: 80},
-		{Resource: "service/db", LocalPort: 5432, Port: 5432},
-	}
-
-	// Found
-	resource := manager.getResourceForPort(forwards, 8080)
-	assert.Contains(t, resource, "app1")
-
-	// Not found
-	resource = manager.getResourceForPort(forwards, 9999)
-	assert.Equal(t, "unknown", resource)
-}
-
-// MockStatusUpdater is a mock implementation of StatusUpdater. Methods are
-// invoked concurrently from the test goroutine and from the health-checker /
-// watchdog goroutines registered by Manager.startWorker, so the recorded
-// slices are guarded by mu. Tests inspect the slices only after Manager.Stop
-// has drained the background goroutines (Stop's wg.Wait establishes a
-// happens-before edge) so the read side does not need to hold mu.
-type MockStatusUpdater struct {
-	updates   []StatusUpdate
-	adds      []ForwardAdd
-	removes   []string
-	errorSets []ErrorSet
-	mu        sync.Mutex
-}
-
-type StatusUpdate struct {
-	ID     string
-	Status string
-}
-
-type ForwardAdd struct {
-	Fwd *config.Forward
-	ID  string
-}
-
-type ErrorSet struct {
-	ID  string
-	Msg string
-}
-
-func (m *MockStatusUpdater) UpdateStatus(id string, status string) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.updates = append(m.updates, StatusUpdate{ID: id, Status: status})
-}
-
-func (m *MockStatusUpdater) AddForward(id string, fwd *config.Forward) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.adds = append(m.adds, ForwardAdd{ID: id, Fwd: fwd})
-}
-
-func (m *MockStatusUpdater) Remove(id string) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.removes = append(m.removes, id)
-}
-
-func (m *MockStatusUpdater) SetError(id, msg string) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.errorSets = append(m.errorSets, ErrorSet{ID: id, Msg: msg})
-}
-
-// TestConfigureHealthChecker tests health checker configuration
-func TestConfigureHealthChecker(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	tests := []struct {
-		name   string
-		method string
-	}{
-		{"tcp-dial method", "tcp-dial"},
-		{"data-transfer method", "data-transfer"},
-		{"unknown method defaults to data-transfer", "unknown"},
-		{"empty method defaults to data-transfer", ""},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := &config.Config{
-				HealthCheck: &config.HealthCheckSpec{
-					Method: tt.method,
-				},
-			}
-
-			// Should not panic
-			manager.configureHealthChecker(cfg)
-			assert.NotNil(t, manager.healthChecker)
-		})
-	}
-}
-
-// TestManager_Stop tests graceful shutdown
-func TestManager_Stop(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-
-	// Stop should not panic even with no workers
-	done := make(chan bool)
-	go func() {
-		manager.Stop()
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		// Success
-	case <-time.After(5 * time.Second):
-		t.Fatal("Stop timed out")
-	}
-}
-
-// TestManager_Reload_EmptyToEmpty tests reloading from empty to empty config
-func TestManager_Reload_EmptyToEmpty(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	cfg := &config.Config{}
-	err = manager.Reload(cfg)
-	// Should handle gracefully (stop all workers if any)
-	assert.NoError(t, err)
-}
-
-// TestPortConflict tests the PortConflict struct
-func TestPortConflict(t *testing.T) {
-	conflict := PortConflict{
-		Port:     8080,
-		Resource: "dev/default/pod/app:8080",
-		UsedBy:   "nginx (PID 1234)",
-	}
-
-	assert.Equal(t, 8080, conflict.Port)
-	assert.Equal(t, "dev/default/pod/app:8080", conflict.Resource)
-	assert.Equal(t, "nginx (PID 1234)", conflict.UsedBy)
-}
-
-// TestStatusUpdater_Interface tests that MockStatusUpdater implements StatusUpdater
-func TestStatusUpdater_Interface(t *testing.T) {
-	var _ StatusUpdater = (*MockStatusUpdater)(nil)
-}
-
-// TestManager_WorkersMap tests workers map operations
-func TestManager_WorkersMap(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	// Initial state
-	assert.Empty(t, manager.workers)
-
-	// Verify concurrent-safe access patterns
-	manager.workersMu.RLock()
-	count := len(manager.workers)
-	manager.workersMu.RUnlock()
-	assert.Equal(t, 0, count)
-}
-
-// TestManager_EventBusIntegration tests event bus wiring
-func TestManager_EventBusIntegration(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-	defer manager.Stop()
-
-	// Event bus should be wired to health checker and watchdog
-	assert.NotNil(t, manager.eventBus)
-
-	// SubscribeAll should work (no return value in this API)
-	manager.eventBus.SubscribeAll(func(event events.Event) {
-		// Handler
-	})
-}
-
-// TestManager_Stop_WithManyWorkers tests that shutdown limits concurrent stops
-func TestManager_Stop_WithManyWorkers(t *testing.T) {
-	manager, err := NewManager(false)
-	if err != nil {
-		t.Skip("Skipping test - no kubeconfig available")
-	}
-
-	// Create and add mock workers directly to test shutdown behavior
-	numWorkers := 25
-	manager.workersMu.Lock()
-	for i := 0; i < numWorkers; i++ {
-		fwd := config.Forward{
-			Resource:  fmt.Sprintf("pod/app-%d", i),
-			Port:      8080,
-			LocalPort: 10000 + i,
-		}
-		worker := NewForwardWorker(fwd, manager.portForwarder, false, nil, manager.healthChecker, manager.watchdog)
-		manager.workers[fwd.ID()] = worker
-	}
-	manager.workersMu.Unlock()
-
-	// Stop should complete successfully with limited concurrency
-	done := make(chan bool)
-	go func() {
-		manager.Stop()
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		// Success - all workers stopped
-	case <-time.After(10 * time.Second):
-		t.Fatal("Stop timed out with many workers")
-	}
-
-	// Verify workers map is cleared
-	manager.workersMu.RLock()
-	workerCount := len(manager.workers)
-	manager.workersMu.RUnlock()
-	assert.Equal(t, 0, workerCount, "Workers map should be empty after Stop")
-}

internal/forward/portcheck.go

@@ -6,106 +6,13 @@ import (
 	"os/exec"
 	"runtime"
 	"strings"
-
-	"github.com/lukaszraczylo/kportal/internal/logger"
 )
 
-const (
-	// maxPIDLength is the maximum length of a valid PID string (9 digits covers PIDs up to 999,999,999)
-	maxPIDLength = 9
-	// minNetstatFields is the minimum number of fields expected in netstat output
-	minNetstatFields = 5
-)
-
-// isValidPID validates that a PID string contains only digits
-func isValidPID(pid string) bool {
-	if len(pid) == 0 || len(pid) > maxPIDLength {
-		return false
-	}
-	for _, c := range pid {
-		if c < '0' || c > '9' {
-			return false
-		}
-	}
-	return true
-}
-
-// processInfo holds information about a process using a port
-type processInfo struct {
-	pid     string
-	name    string
-	isValid bool
-}
-
-// formatProcessInfo formats process information for display
-func formatProcessInfo(info processInfo) string {
-	if !info.isValid {
-		return "unknown"
-	}
-	if info.name != "" {
-		return fmt.Sprintf("%s (PID %s)", info.name, info.pid)
-	}
-	return fmt.Sprintf("PID %s", info.pid)
-}
-
-// formatProcessList formats a list of processes into a human-readable string.
-// Returns "unknown" if the list is empty.
-func formatProcessList(processes []processInfo) string {
-	if len(processes) == 0 {
-		return "unknown"
-	}
-	if len(processes) == 1 {
-		return formatProcessInfo(processes[0])
-	}
-	// Multiple processes - format as comma-separated list
-	parts := make([]string, len(processes))
-	for i, p := range processes {
-		parts[i] = formatProcessInfo(p)
-	}
-	return strings.Join(parts, ", ")
-}
-
-// getProcessNameByPID retrieves the process name for a given PID on Unix systems
-func getProcessNameByPID(pid string) string {
-	if !isValidPID(pid) {
-		return ""
-	}
-	// #nosec G204 -- pid is validated by isValidPID() to contain only digits
-	cmd := exec.Command("ps", "-p", pid, "-o", "comm=")
-	output, err := cmd.Output()
-	if err != nil {
-		return ""
-	}
-	return strings.TrimSpace(string(output))
-}
-
-// getProcessNameByPIDWindows retrieves the process name for a given PID on Windows
-func getProcessNameByPIDWindows(pid string) string {
-	// #nosec G204 -- pid is validated by isValidPID() to contain only digits
-	cmd := exec.Command("tasklist", "/FI", fmt.Sprintf("PID eq %s", pid), "/FO", "CSV", "/NH")
-	output, err := cmd.Output()
-	if err != nil {
-		return ""
-	}
-
-	// Parse CSV output: "process.exe","1234","Console","1","12,345 K"
-	csvLine := strings.TrimSpace(string(output))
-	if csvLine == "" {
-		return ""
-	}
-
-	parts := strings.Split(csvLine, ",")
-	if len(parts) > 0 {
-		return strings.Trim(parts[0], "\"")
-	}
-	return ""
-}
-
 // PortConflict represents a local port that is already in use.
 type PortConflict struct {
-	Resource string
-	UsedBy   string
-	Port     int
+	Port     int    // The conflicting port number
+	Resource string // The forward resource that needs this port
+	UsedBy   string // Process information (PID, command) using the port
 }
 
 // PortChecker checks port availability on the local system.
@@ -150,7 +57,7 @@ func (pc *PortChecker) isPortAvailable(port int) bool {
 	if err != nil {
 		return false
 	}
-	_ = listener.Close() // Best-effort cleanup; port check succeeded, Close error is non-critical
+	listener.Close()
 	return true
 }
 
@@ -171,7 +78,6 @@ func (pc *PortChecker) getProcessUsingPort(port int) string {
 func (pc *PortChecker) getProcessUsingPortUnix(port int) string {
 	// Use lsof to find the process
 	// lsof -i :PORT -sTCP:LISTEN -t returns PIDs
-	// #nosec G204 -- port is an integer from config validation, not user input
 	cmd := exec.Command("lsof", "-i", fmt.Sprintf(":%d", port), "-sTCP:LISTEN", "-t")
 	output, err := cmd.Output()
 	if err != nil {
@@ -183,55 +89,23 @@ func (pc *PortChecker) getProcessUsingPortUnix(port int) string {
 		return "unknown"
 	}
 
-	// Handle multiple PIDs (multiple processes on same port)
+	// Get the first PID if multiple are returned
 	pids := strings.Split(pidStr, "\n")
-	var validProcesses []processInfo
+	pid := pids[0]
 
-	for _, pid := range pids {
-		pid = strings.TrimSpace(pid)
-		if pid == "" {
-			continue
-		}
-
-		if !isValidPID(pid) {
-			logger.Debug("Invalid PID format from lsof output", map[string]interface{}{
-				"port":    port,
-				"raw_pid": pid,
-			})
-			continue
-		}
-
-		procName := getProcessNameByPID(pid)
-		validProcesses = append(validProcesses, processInfo{
-			pid:     pid,
-			name:    procName,
-			isValid: true,
-		})
+	// Get process name using ps
+	cmd = exec.Command("ps", "-p", pid, "-o", "comm=")
+	output, err = cmd.Output()
+	if err != nil {
+		return fmt.Sprintf("PID %s", pid)
 	}
 
-	return formatProcessList(validProcesses)
-}
-
-// isListeningState checks if a netstat line indicates a listening state.
-// This handles both English and potentially other locales by checking for common patterns.
-func isListeningState(line string, fields []string) bool {
-	upperLine := strings.ToUpper(line)
-
-	// Check for common listening state indicators across locales
-	// English: LISTENING, German: ABHÖREN, French: ÉCOUTE, etc.
-	// The most reliable check is the state field position (4th field, 0-indexed = 3)
-	// and that it's a TCP connection with 0.0.0.0:0 or *:* as foreign address
-	if len(fields) >= minNetstatFields {
-		state := strings.ToUpper(fields[3])
-		// Common listening state values across Windows locales
-		if state == "LISTENING" || state == "ABHÖREN" || state == "ÉCOUTE" ||
-			state == "ESCUCHANDO" || state == "ASCOLTO" || state == "NASŁUCHIWANIE" {
-			return true
-		}
+	procName := strings.TrimSpace(string(output))
+	if procName == "" {
+		return fmt.Sprintf("PID %s", pid)
 	}
 
-	// Fallback: check if line contains LISTENING (most common case)
-	return strings.Contains(upperLine, "LISTENING")
+	return fmt.Sprintf("%s (PID %s)", procName, pid)
 }
 
 // getProcessUsingPortWindows uses netstat to find the process using a port on Windows.
@@ -247,8 +121,6 @@ func (pc *PortChecker) getProcessUsingPortWindows(port int) string {
 	lines := strings.Split(string(output), "\n")
 	portStr := fmt.Sprintf(":%d", port)
 
-	var validProcesses []processInfo
-
 	for _, line := range lines {
 		if !strings.Contains(line, portStr) {
 			continue
@@ -257,42 +129,40 @@ func (pc *PortChecker) getProcessUsingPortWindows(port int) string {
 		// Parse the line to extract PID
 		// Format: TCP    0.0.0.0:8080    0.0.0.0:0    LISTENING    1234
 		fields := strings.Fields(line)
-		if len(fields) < minNetstatFields {
+		if len(fields) < 5 {
 			continue
 		}
 
-		// Check if this is a LISTENING state (locale-aware)
-		if !isListeningState(line, fields) {
-			continue
-		}
-
-		// Verify the local address field actually contains our port
-		// (avoid matching port in foreign address)
-		localAddr := fields[1]
-		if !strings.HasSuffix(localAddr, portStr) {
+		// Check if this is a LISTENING state
+		if !strings.Contains(strings.ToUpper(line), "LISTENING") {
 			continue
 		}
 
 		pid := fields[len(fields)-1]
 
-		if !isValidPID(pid) {
-			logger.Debug("Invalid PID format from netstat output", map[string]interface{}{
-				"port":    port,
-				"raw_pid": pid,
-				"line":    line,
-			})
-			continue
+		// Get process name using tasklist
+		cmd = exec.Command("tasklist", "/FI", fmt.Sprintf("PID eq %s", pid), "/FO", "CSV", "/NH")
+		output, err = cmd.Output()
+		if err != nil {
+			return fmt.Sprintf("PID %s", pid)
 		}
 
-		procName := getProcessNameByPIDWindows(pid)
-		validProcesses = append(validProcesses, processInfo{
-			pid:     pid,
-			name:    procName,
-			isValid: true,
-		})
+		// Parse CSV output: "process.exe","1234","Console","1","12,345 K"
+		csvLine := strings.TrimSpace(string(output))
+		if csvLine == "" {
+			return fmt.Sprintf("PID %s", pid)
+		}
+
+		parts := strings.Split(csvLine, ",")
+		if len(parts) > 0 {
+			procName := strings.Trim(parts[0], "\"")
+			return fmt.Sprintf("%s (PID %s)", procName, pid)
+		}
+
+		return fmt.Sprintf("PID %s", pid)
 	}
 
-	return formatProcessList(validProcesses)
+	return "unknown"
 }
 
 // FormatConflicts formats port conflicts into a human-readable error message.
@@ -306,11 +176,11 @@ func FormatConflicts(conflicts []PortConflict) string {
 	sb.WriteString(strings.Repeat("=", 50) + "\n\n")
 
 	for _, conflict := range conflicts {
-		fmt.Fprintf(&sb, "Port %d\n", conflict.Port)
+		sb.WriteString(fmt.Sprintf("Port %d\n", conflict.Port))
 		if conflict.Resource != "" {
-			fmt.Fprintf(&sb, "  Needed for: %s\n", conflict.Resource)
+			sb.WriteString(fmt.Sprintf("  Needed for: %s\n", conflict.Resource))
 		}
-		fmt.Fprintf(&sb, "  Currently used by: %s\n", conflict.UsedBy)
+		sb.WriteString(fmt.Sprintf("  Currently used by: %s\n", conflict.UsedBy))
 		sb.WriteString("\n")
 	}
 
@@ -318,3 +188,16 @@ func FormatConflicts(conflicts []PortConflict) string {
 
 	return sb.String()
 }
+
+// GetPortsFromForwards extracts all local ports from a list of forward configurations.
+func GetPortsFromForwards(forwards []interface{}) []int {
+	ports := make([]int, 0, len(forwards))
+	for _, fwd := range forwards {
+		// This function expects a generic interface to work with different forward types
+		// The actual implementation should use the Forward struct from config package
+		if f, ok := fwd.(interface{ GetLocalPort() int }); ok {
+			ports = append(ports, f.GetLocalPort())
+		}
+	}
+	return ports
+}

internal/forward/portcheck_test.go

@@ -2,186 +2,11 @@ package forward
 
 import (
 	"net"
-	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 )
 
-// TestIsValidPID tests PID validation
-func TestIsValidPID(t *testing.T) {
-	tests := []struct {
-		name     string
-		pid      string
-		expected bool
-	}{
-		{"valid single digit", "1", true},
-		{"valid multi digit", "12345", true},
-		{"valid max length", "123456789", true},
-		{"empty string", "", false},
-		{"too long", "1234567890", false},
-		{"contains letter", "123a", false},
-		{"contains space", "123 ", false},
-		{"negative sign", "-123", false},
-		{"decimal", "12.3", false},
-		{"just zero", "0", true},
-		{"leading zeros", "00123", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isValidPID(tt.pid)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestFormatProcessInfo tests process info formatting
-func TestFormatProcessInfo(t *testing.T) {
-	tests := []struct {
-		name     string
-		expected string
-		info     processInfo
-	}{
-		{
-			name:     "invalid process",
-			info:     processInfo{isValid: false},
-			expected: "unknown",
-		},
-		{
-			name:     "valid with name and pid",
-			info:     processInfo{pid: "1234", name: "nginx", isValid: true},
-			expected: "nginx (PID 1234)",
-		},
-		{
-			name:     "valid with only pid",
-			info:     processInfo{pid: "5678", name: "", isValid: true},
-			expected: "PID 5678",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := formatProcessInfo(tt.info)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestFormatProcessList tests process list formatting
-func TestFormatProcessList(t *testing.T) {
-	tests := []struct {
-		name      string
-		expected  string
-		processes []processInfo
-	}{
-		{
-			name:      "empty list",
-			processes: []processInfo{},
-			expected:  "unknown",
-		},
-		{
-			name:      "single process",
-			processes: []processInfo{{pid: "1234", name: "nginx", isValid: true}},
-			expected:  "nginx (PID 1234)",
-		},
-		{
-			name: "multiple processes",
-			processes: []processInfo{
-				{pid: "1234", name: "nginx", isValid: true},
-				{pid: "5678", name: "node", isValid: true},
-			},
-			expected: "nginx (PID 1234), node (PID 5678)",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := formatProcessList(tt.processes)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestIsListeningState tests listening state detection
-func TestIsListeningState(t *testing.T) {
-	tests := []struct {
-		name     string
-		line     string
-		fields   []string
-		expected bool
-	}{
-		{
-			name:     "English LISTENING",
-			line:     "TCP    0.0.0.0:8080    0.0.0.0:0    LISTENING    1234",
-			fields:   []string{"TCP", "0.0.0.0:8080", "0.0.0.0:0", "LISTENING", "1234"},
-			expected: true,
-		},
-		{
-			name:     "German ABHÖREN",
-			line:     "TCP    0.0.0.0:8080    0.0.0.0:0    ABHÖREN    1234",
-			fields:   []string{"TCP", "0.0.0.0:8080", "0.0.0.0:0", "ABHÖREN", "1234"},
-			expected: true,
-		},
-		{
-			name:     "French ÉCOUTE",
-			line:     "TCP    0.0.0.0:8080    0.0.0.0:0    ÉCOUTE    1234",
-			fields:   []string{"TCP", "0.0.0.0:8080", "0.0.0.0:0", "ÉCOUTE", "1234"},
-			expected: true,
-		},
-		{
-			name:     "Spanish ESCUCHANDO",
-			line:     "TCP    0.0.0.0:8080    0.0.0.0:0    ESCUCHANDO    1234",
-			fields:   []string{"TCP", "0.0.0.0:8080", "0.0.0.0:0", "ESCUCHANDO", "1234"},
-			expected: true,
-		},
-		{
-			name:     "ESTABLISHED (not listening)",
-			line:     "TCP    192.168.1.1:8080    10.0.0.1:443    ESTABLISHED    1234",
-			fields:   []string{"TCP", "192.168.1.1:8080", "10.0.0.1:443", "ESTABLISHED", "1234"},
-			expected: false,
-		},
-		{
-			name:     "too few fields",
-			line:     "TCP    0.0.0.0:8080",
-			fields:   []string{"TCP", "0.0.0.0:8080"},
-			expected: false,
-		},
-		{
-			name:     "lowercase listening (via fallback)",
-			line:     "tcp    0.0.0.0:8080    0.0.0.0:0    listening    1234",
-			fields:   []string{"tcp", "0.0.0.0:8080", "0.0.0.0:0", "listening", "1234"},
-			expected: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isListeningState(tt.line, tt.fields)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestGetProcessNameByPID tests process name lookup
-func TestGetProcessNameByPID(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("Skipping Unix-specific test on Windows")
-	}
-
-	// Test with PID 1 (init/systemd on Linux, launchd on macOS)
-	// This should return something on Unix systems
-	name := getProcessNameByPID("1")
-	// We don't assert the exact name since it varies by OS
-	// Just verify no panic and returns string
-	assert.IsType(t, "", name)
-
-	// Test with invalid PID
-	name = getProcessNameByPID("999999999")
-	// Should return empty string for non-existent process
-	assert.IsType(t, "", name)
-}
-
 func TestPortChecker_IsAvailable(t *testing.T) {
 	pc := NewPortChecker()
 
@@ -206,11 +31,10 @@ func TestPortChecker_CheckAvailability_EmptyPorts(t *testing.T) {
 func TestPortChecker_CheckAvailability_ExcludeMap(t *testing.T) {
 	pc := NewPortChecker()
 
-	// Create a listener to occupy a port on all interfaces (matching production behavior)
-	// #nosec G102 -- test intentionally binds to all interfaces to match production port checking
+	// Create a listener to occupy a port
 	listener, err := net.Listen("tcp", ":0")
 	assert.NoError(t, err, "should create listener")
-	defer func() { _ = listener.Close() }()
+	defer listener.Close()
 
 	// Get the port that's now occupied
 	addr := listener.Addr().(*net.TCPAddr)
@@ -232,16 +56,14 @@ func TestPortChecker_CheckAvailability_ExcludeMap(t *testing.T) {
 func TestPortChecker_CheckAvailability_MultipleSkipPorts(t *testing.T) {
 	pc := NewPortChecker()
 
-	// Create multiple listeners on all interfaces (matching production behavior)
-	// #nosec G102 -- test intentionally binds to all interfaces to match production port checking
+	// Create multiple listeners
 	listener1, err := net.Listen("tcp", ":0")
 	assert.NoError(t, err)
-	defer func() { _ = listener1.Close() }()
+	defer listener1.Close()
 
-	// #nosec G102 -- test intentionally binds to all interfaces to match production port checking
 	listener2, err := net.Listen("tcp", ":0")
 	assert.NoError(t, err)
-	defer func() { _ = listener2.Close() }()
+	defer listener2.Close()
 
 	port1 := listener1.Addr().(*net.TCPAddr).Port
 	port2 := listener2.Addr().(*net.TCPAddr).Port
@@ -356,11 +178,10 @@ func TestNewPortChecker(t *testing.T) {
 func TestPortChecker_PortAvailability_Integration(t *testing.T) {
 	pc := NewPortChecker()
 
-	// Create a listener to occupy a port on all interfaces (matching production behavior)
-	// #nosec G102 -- test intentionally binds to all interfaces to match production port checking
+	// Create a listener to occupy a port
 	listener, err := net.Listen("tcp", ":0")
 	assert.NoError(t, err, "should create listener")
-	defer func() { _ = listener.Close() }()
+	defer listener.Close()
 
 	// Get the occupied port
 	occupiedPort := listener.Addr().(*net.TCPAddr).Port
@@ -370,7 +191,7 @@ func TestPortChecker_PortAvailability_Integration(t *testing.T) {
 	assert.False(t, available, "occupied port should not be available")
 
 	// Close the listener
-	_ = listener.Close()
+	listener.Close()
 
 	// The port should now be available (though there might be a brief delay)
 	// We don't assert this to avoid flakiness in CI environments

internal/forward/watchdog.go

@@ -1,260 +0,0 @@
-package forward
-
-import (
-	"context"
-	"sync"
-	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/events"
-	"github.com/lukaszraczylo/kportal/internal/logger"
-)
-
-const (
-	// defaultHeartbeatInterval is how often the watchdog sends heartbeats to workers
-	defaultHeartbeatInterval = 15 * time.Second
-)
-
-// Watchdog monitors worker goroutines to detect hung workers.
-// It centralizes heartbeat management - instead of each worker sending heartbeats,
-// the watchdog polls workers periodically. This reduces goroutine count and
-// simplifies worker implementation.
-type Watchdog struct {
-	ctx               context.Context
-	workers           map[string]*workerState
-	cancel            context.CancelFunc
-	eventBus          *events.Bus
-	wg                sync.WaitGroup
-	checkInterval     time.Duration
-	hangThreshold     time.Duration
-	heartbeatInterval time.Duration
-	mu                sync.RWMutex
-}
-
-// workerState tracks the health of a single worker
-type workerState struct {
-	lastHeartbeat  time.Time
-	worker         HeartbeatResponder
-	onHungCallback func(forwardID string)
-	forwardID      string
-	heartbeatCount uint64
-	isHung         bool
-}
-
-// HeartbeatResponder is an interface for workers that can respond to heartbeat checks
-type HeartbeatResponder interface {
-	// IsAlive returns true if the worker is still responsive
-	IsAlive() bool
-	// GetForwardID returns the forward ID this worker manages
-	GetForwardID() string
-}
-
-// NewWatchdog creates a new goroutine watchdog
-func NewWatchdog(checkInterval, hangThreshold time.Duration) *Watchdog {
-	ctx, cancel := context.WithCancel(context.Background())
-	return &Watchdog{
-		workers:           make(map[string]*workerState),
-		checkInterval:     checkInterval,
-		hangThreshold:     hangThreshold,
-		heartbeatInterval: defaultHeartbeatInterval,
-		ctx:               ctx,
-		cancel:            cancel,
-	}
-}
-
-// SetEventBus sets the event bus for publishing watchdog events
-func (w *Watchdog) SetEventBus(bus *events.Bus) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	w.eventBus = bus
-}
-
-// Start begins the watchdog monitoring loop
-func (w *Watchdog) Start() {
-	w.wg.Add(1)
-	go w.monitorLoop()
-}
-
-// Stop stops the watchdog
-func (w *Watchdog) Stop() {
-	w.cancel()
-	w.wg.Wait()
-}
-
-// RegisterWorker adds a worker to monitor
-func (w *Watchdog) RegisterWorker(forwardID string, onHungCallback func(string)) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	w.workers[forwardID] = &workerState{
-		forwardID:      forwardID,
-		lastHeartbeat:  time.Now(),
-		heartbeatCount: 0,
-		isHung:         false,
-		onHungCallback: onHungCallback,
-	}
-
-	logger.Debug("Watchdog registered worker", map[string]interface{}{
-		"forward_id": forwardID,
-	})
-}
-
-// RegisterWorkerWithResponder adds a worker to monitor with heartbeat polling support
-func (w *Watchdog) RegisterWorkerWithResponder(forwardID string, responder HeartbeatResponder, onHungCallback func(string)) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	w.workers[forwardID] = &workerState{
-		forwardID:      forwardID,
-		lastHeartbeat:  time.Now(),
-		heartbeatCount: 0,
-		isHung:         false,
-		onHungCallback: onHungCallback,
-		worker:         responder,
-	}
-
-	logger.Debug("Watchdog registered worker with responder", map[string]interface{}{
-		"forward_id": forwardID,
-	})
-}
-
-// UnregisterWorker removes a worker from monitoring
-func (w *Watchdog) UnregisterWorker(forwardID string) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	delete(w.workers, forwardID)
-
-	logger.Debug("Watchdog unregistered worker", map[string]interface{}{
-		"forward_id": forwardID,
-	})
-}
-
-// Heartbeat records that a worker is alive and processing.
-// This can be called by workers directly (legacy) or the watchdog can poll
-// workers via HeartbeatResponder interface.
-func (w *Watchdog) Heartbeat(forwardID string) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	if state, exists := w.workers[forwardID]; exists {
-		state.lastHeartbeat = time.Now()
-		state.heartbeatCount++
-		state.isHung = false
-	}
-}
-
-// GetWorkerState returns the current state of a worker (for testing)
-func (w *Watchdog) GetWorkerState(forwardID string) (lastHeartbeat time.Time, count uint64, exists bool) {
-	w.mu.RLock()
-	defer w.mu.RUnlock()
-
-	if state, ok := w.workers[forwardID]; ok {
-		return state.lastHeartbeat, state.heartbeatCount, true
-	}
-	return time.Time{}, 0, false
-}
-
-// monitorLoop periodically checks all workers and polls for heartbeats
-func (w *Watchdog) monitorLoop() {
-	defer w.wg.Done()
-
-	checkTicker := time.NewTicker(w.checkInterval)
-	defer checkTicker.Stop()
-
-	// Heartbeat polling ticker - polls workers for heartbeat more frequently
-	heartbeatTicker := time.NewTicker(w.heartbeatInterval)
-	defer heartbeatTicker.Stop()
-
-	for {
-		select {
-		case <-w.ctx.Done():
-			return
-		case <-heartbeatTicker.C:
-			// Poll all workers for heartbeat (centralized heartbeat management)
-			w.pollHeartbeats()
-		case <-checkTicker.C:
-			// Check for hung workers
-			w.checkWorkers()
-		}
-	}
-}
-
-// pollHeartbeats polls all registered workers for heartbeat.
-// This centralizes heartbeat management in the watchdog instead of having
-// each worker spawn its own heartbeat goroutine.
-func (w *Watchdog) pollHeartbeats() {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	now := time.Now()
-	for forwardID, state := range w.workers {
-		// If worker has a responder, poll it
-		if state.worker != nil {
-			if state.worker.IsAlive() {
-				state.lastHeartbeat = now
-				state.heartbeatCount++
-				state.isHung = false
-			}
-		}
-		// If no responder, worker must call Heartbeat() directly (legacy mode)
-		// This maintains backward compatibility
-		_ = forwardID // Avoid unused variable warning
-	}
-}
-
-// hungWorkerInfo stores information about a hung worker for deferred callback execution
-type hungWorkerInfo struct {
-	callback  func(string)
-	forwardID string
-}
-
-// checkWorkers checks all registered workers for hung state
-func (w *Watchdog) checkWorkers() {
-	// Collect hung workers while holding the lock
-	var hungWorkers []hungWorkerInfo
-	var eventBus *events.Bus
-
-	w.mu.Lock()
-	eventBus = w.eventBus
-	now := time.Now()
-	for forwardID, state := range w.workers {
-		timeSinceHeartbeat := now.Sub(state.lastHeartbeat)
-
-		// Check if worker is hung
-		if timeSinceHeartbeat > w.hangThreshold {
-			if !state.isHung {
-				// First time detecting hung state
-				state.isHung = true
-
-				logger.Warn("Watchdog detected hung worker", map[string]interface{}{
-					"forward_id":           forwardID,
-					"time_since_heartbeat": timeSinceHeartbeat.String(),
-					"hang_threshold":       w.hangThreshold.String(),
-					"heartbeat_count":      state.heartbeatCount,
-				})
-
-				// Collect callback for deferred execution outside the lock
-				if state.onHungCallback != nil {
-					hungWorkers = append(hungWorkers, hungWorkerInfo{
-						forwardID: forwardID,
-						callback:  state.onHungCallback,
-					})
-				}
-			}
-		}
-	}
-	w.mu.Unlock()
-
-	// Execute callbacks outside the lock to prevent deadlocks and ensure
-	// consistent state during callback execution. Callbacks are idempotent
-	// (they trigger reconnection via channels), so concurrent state changes
-	// between detection and callback execution are safe.
-	for _, hw := range hungWorkers {
-		// Publish event if event bus is available
-		if eventBus != nil {
-			eventBus.Publish(events.NewWorkerHungEvent(hw.forwardID, w.hangThreshold.String()))
-		}
-
-		hw.callback(hw.forwardID)
-	}
-}

internal/forward/watchdog_test.go

@@ -1,324 +0,0 @@
-package forward
-
-import (
-	"fmt"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/suite"
-)
-
-// WatchdogTestSuite contains tests for the watchdog
-type WatchdogTestSuite struct {
-	suite.Suite
-	watchdog *Watchdog
-}
-
-func TestWatchdogSuite(t *testing.T) {
-	suite.Run(t, new(WatchdogTestSuite))
-}
-
-func (s *WatchdogTestSuite) SetupTest() {
-	// Create watchdog with fast intervals for testing
-	s.watchdog = NewWatchdog(100*time.Millisecond, 300*time.Millisecond)
-	s.watchdog.Start()
-}
-
-func (s *WatchdogTestSuite) TearDownTest() {
-	if s.watchdog != nil {
-		s.watchdog.Stop()
-	}
-}
-
-// TestRegisterUnregister tests basic registration and unregistration
-func (s *WatchdogTestSuite) TestRegisterUnregister() {
-	callbackCalled := false
-	callback := func(forwardID string) {
-		callbackCalled = true
-	}
-
-	// Register worker
-	s.watchdog.RegisterWorker("test-forward", callback)
-
-	// Verify worker is registered
-	_, _, exists := s.watchdog.GetWorkerState("test-forward")
-	assert.True(s.T(), exists, "Worker should be registered")
-
-	// Unregister worker
-	s.watchdog.UnregisterWorker("test-forward")
-
-	// Verify worker is unregistered
-	_, _, exists = s.watchdog.GetWorkerState("test-forward")
-	assert.False(s.T(), exists, "Worker should be unregistered")
-	assert.False(s.T(), callbackCalled, "Callback should not have been called")
-}
-
-// TestHeartbeat tests that heartbeats update worker state
-func (s *WatchdogTestSuite) TestHeartbeat() {
-	s.watchdog.RegisterWorker("test-forward", nil)
-
-	// Send initial heartbeat
-	s.watchdog.Heartbeat("test-forward")
-
-	lastHeartbeat1, count1, exists := s.watchdog.GetWorkerState("test-forward")
-	require.True(s.T(), exists)
-	assert.Equal(s.T(), uint64(1), count1)
-
-	// Wait a bit
-	time.Sleep(50 * time.Millisecond)
-
-	// Send another heartbeat
-	s.watchdog.Heartbeat("test-forward")
-
-	lastHeartbeat2, count2, exists := s.watchdog.GetWorkerState("test-forward")
-	require.True(s.T(), exists)
-	assert.Equal(s.T(), uint64(2), count2)
-	assert.True(s.T(), lastHeartbeat2.After(lastHeartbeat1), "Second heartbeat should be after first")
-}
-
-// TestHungWorkerDetection tests that hung workers are detected
-func (s *WatchdogTestSuite) TestHungWorkerDetection() {
-	callbackCalled := make(chan string, 1)
-	callback := func(forwardID string) {
-		callbackCalled <- forwardID
-	}
-
-	s.watchdog.RegisterWorker("test-forward", callback)
-
-	// Send initial heartbeat
-	s.watchdog.Heartbeat("test-forward")
-
-	// Wait for worker to be considered hung (300ms threshold + 100ms check interval)
-	timeout := time.After(1 * time.Second)
-
-	select {
-	case forwardID := <-callbackCalled:
-		assert.Equal(s.T(), "test-forward", forwardID)
-	case <-timeout:
-		s.T().Fatal("Timeout waiting for hung worker callback")
-	}
-}
-
-// TestHealthyWorkerNotDetectedAsHung tests that workers sending heartbeats are not considered hung
-func (s *WatchdogTestSuite) TestHealthyWorkerNotDetectedAsHung() {
-	callbackCalled := false
-	var mu sync.Mutex
-	callback := func(forwardID string) {
-		mu.Lock()
-		defer mu.Unlock()
-		callbackCalled = true
-	}
-
-	s.watchdog.RegisterWorker("test-forward", callback)
-
-	// Send periodic heartbeats (faster than hang threshold)
-	ticker := time.NewTicker(50 * time.Millisecond)
-	defer ticker.Stop()
-
-	done := make(chan bool)
-	go func() {
-		for i := 0; i < 10; i++ {
-			<-ticker.C
-			s.watchdog.Heartbeat("test-forward")
-		}
-		done <- true
-	}()
-
-	// Wait for all heartbeats to complete
-	<-done
-
-	// Check that callback was not called
-	mu.Lock()
-	assert.False(s.T(), callbackCalled, "Callback should not be called for healthy worker")
-	mu.Unlock()
-}
-
-// TestMultipleWorkers tests monitoring multiple workers simultaneously
-func (s *WatchdogTestSuite) TestMultipleWorkers() {
-	callbacks := make(map[string]int)
-	var mu sync.Mutex
-
-	makeCallback := func(id string) func(string) {
-		return func(forwardID string) {
-			mu.Lock()
-			defer mu.Unlock()
-			callbacks[id]++
-		}
-	}
-
-	// Register multiple workers
-	s.watchdog.RegisterWorker("worker-1", makeCallback("worker-1"))
-	s.watchdog.RegisterWorker("worker-2", makeCallback("worker-2"))
-	s.watchdog.RegisterWorker("worker-3", makeCallback("worker-3"))
-
-	// worker-1: Keep sending heartbeats (healthy)
-	// Use a done channel to ensure goroutine exits before test ends
-	ticker1 := time.NewTicker(50 * time.Millisecond)
-	done := make(chan struct{})
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		defer ticker1.Stop()
-		for i := 0; i < 10; i++ {
-			select {
-			case <-ticker1.C:
-				s.watchdog.Heartbeat("worker-1")
-			case <-done:
-				return
-			}
-		}
-	}()
-
-	// worker-2: Send initial heartbeat then stop (will become hung)
-	s.watchdog.Heartbeat("worker-2")
-
-	// worker-3: Send initial heartbeat then stop (will become hung)
-	s.watchdog.Heartbeat("worker-3")
-
-	// Wait for hung workers to be detected
-	time.Sleep(600 * time.Millisecond)
-
-	// Signal goroutine to stop and wait for it
-	close(done)
-	wg.Wait()
-
-	// Check results
-	mu.Lock()
-	defer mu.Unlock()
-
-	assert.Equal(s.T(), 0, callbacks["worker-1"], "worker-1 should not trigger callback (healthy)")
-	assert.Greater(s.T(), callbacks["worker-2"], 0, "worker-2 should trigger callback (hung)")
-	assert.Greater(s.T(), callbacks["worker-3"], 0, "worker-3 should trigger callback (hung)")
-}
-
-// TestCallbackOnlyOnFirstDetection tests that callback is only called once when hung is first detected
-func (s *WatchdogTestSuite) TestCallbackOnlyOnFirstDetection() {
-	callbackCount := 0
-	var mu sync.Mutex
-	callback := func(forwardID string) {
-		mu.Lock()
-		defer mu.Unlock()
-		callbackCount++
-	}
-
-	s.watchdog.RegisterWorker("test-forward", callback)
-
-	// Send initial heartbeat
-	s.watchdog.Heartbeat("test-forward")
-
-	// Wait for multiple check cycles
-	time.Sleep(1 * time.Second)
-
-	// Check that callback was only called once
-	mu.Lock()
-	assert.Equal(s.T(), 1, callbackCount, "Callback should only be called once")
-	mu.Unlock()
-}
-
-// TestHeartbeatResetsHungState tests that sending heartbeat after hung detection resets state
-func (s *WatchdogTestSuite) TestHeartbeatResetsHungState() {
-	callbackCount := 0
-	var mu sync.Mutex
-	callback := func(forwardID string) {
-		mu.Lock()
-		defer mu.Unlock()
-		callbackCount++
-	}
-
-	s.watchdog.RegisterWorker("test-forward", callback)
-
-	// Send initial heartbeat
-	s.watchdog.Heartbeat("test-forward")
-
-	// Wait for hung detection
-	time.Sleep(500 * time.Millisecond)
-
-	mu.Lock()
-	firstCount := callbackCount
-	mu.Unlock()
-
-	assert.Equal(s.T(), 1, firstCount, "First hung detection should trigger callback")
-
-	// Send heartbeat to reset hung state
-	s.watchdog.Heartbeat("test-forward")
-
-	// Wait for worker to become hung again
-	time.Sleep(500 * time.Millisecond)
-
-	mu.Lock()
-	secondCount := callbackCount
-	mu.Unlock()
-
-	assert.Equal(s.T(), 2, secondCount, "Second hung detection should trigger callback again")
-}
-
-// TestConcurrentOperations tests thread safety
-func (s *WatchdogTestSuite) TestConcurrentOperations() {
-	var wg sync.WaitGroup
-	numWorkers := 10
-
-	for i := 0; i < numWorkers; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			forwardID := fmt.Sprintf("worker-%d", id)
-			s.watchdog.RegisterWorker(forwardID, nil)
-			for j := 0; j < 10; j++ {
-				s.watchdog.Heartbeat(forwardID)
-				time.Sleep(10 * time.Millisecond)
-			}
-			s.watchdog.UnregisterWorker(forwardID)
-		}(i)
-	}
-
-	wg.Wait()
-	// If we get here without deadlocks or panics, test passes
-}
-
-// TestStopWatchdog tests that stopping watchdog cleans up properly
-func TestStopWatchdog(t *testing.T) {
-	watchdog := NewWatchdog(100*time.Millisecond, 300*time.Millisecond)
-	watchdog.Start()
-
-	callbackCalled := false
-	callback := func(forwardID string) {
-		callbackCalled = true
-	}
-
-	watchdog.RegisterWorker("test-forward", callback)
-	watchdog.Heartbeat("test-forward")
-
-	// Stop watchdog before hang detection
-	time.Sleep(100 * time.Millisecond)
-	watchdog.Stop()
-
-	// Wait to ensure no more callbacks after stop
-	time.Sleep(500 * time.Millisecond)
-
-	assert.False(t, callbackCalled, "Callback should not be called after watchdog is stopped")
-}
-
-// TestWatchdogWithZeroHeartbeats tests detecting hung worker that never sends heartbeats
-func (s *WatchdogTestSuite) TestWatchdogWithZeroHeartbeats() {
-	callbackCalled := make(chan string, 1)
-	callback := func(forwardID string) {
-		callbackCalled <- forwardID
-	}
-
-	// Register worker but never send heartbeat
-	s.watchdog.RegisterWorker("test-forward", callback)
-
-	// Wait for hung detection
-	timeout := time.After(1 * time.Second)
-
-	select {
-	case forwardID := <-callbackCalled:
-		assert.Equal(s.T(), "test-forward", forwardID)
-	case <-timeout:
-		s.T().Fatal("Timeout waiting for hung worker callback")
-	}
-}

internal/forward/worker.go

@@ -5,46 +5,31 @@ import (
 	"fmt"
 	"io"
 	"log"
-	"sync"
 	"time"
 
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/lukaszraczylo/kportal/internal/healthcheck"
-	"github.com/lukaszraczylo/kportal/internal/httplog"
-	"github.com/lukaszraczylo/kportal/internal/k8s"
-	"github.com/lukaszraczylo/kportal/internal/logger"
-	"github.com/lukaszraczylo/kportal/internal/retry"
-)
-
-const (
-	portForwardReadyTimeout = 30 * time.Second
-	httpLogPortOffset       = 10000 // Offset for internal port when HTTP logging is enabled
+	"github.com/nvm/kportal/internal/config"
+	"github.com/nvm/kportal/internal/healthcheck"
+	"github.com/nvm/kportal/internal/k8s"
+	"github.com/nvm/kportal/internal/retry"
 )
 
 // ForwardWorker manages a single port-forward connection with automatic retry.
 type ForwardWorker struct {
-	startTime       time.Time
-	statusUI        StatusUpdater
-	ctx             context.Context
-	reconnectChan   chan string
-	httpProxy       *httplog.Proxy
-	watchdog        *Watchdog
-	cancel          context.CancelFunc
-	doneChan        chan struct{}
-	portForwarder   *k8s.PortForwarder
-	successChan     chan struct{}
-	healthChecker   *healthcheck.Checker
-	forwardCancel   context.CancelFunc
-	stopChan        chan struct{}
-	lastPod         string
-	forward         config.Forward
-	forwardCancelMu sync.Mutex
-	stopOnce        sync.Once // Guards close(stopChan) against concurrent Stop() calls
-	verbose         bool
+	forward       config.Forward
+	portForwarder *k8s.PortForwarder
+	ctx           context.Context
+	cancel        context.CancelFunc
+	stopChan      chan struct{}
+	doneChan      chan struct{}
+	verbose       bool
+	lastPod       string // Track the last pod we connected to
+	statusUI      StatusUpdater
+	healthChecker *healthcheck.Checker
+	startTime     time.Time // Track when the worker started
 }
 
 // NewForwardWorker creates a new ForwardWorker for a single forward configuration.
-func NewForwardWorker(fwd config.Forward, portForwarder *k8s.PortForwarder, verbose bool, statusUI StatusUpdater, healthChecker *healthcheck.Checker, watchdog *Watchdog) *ForwardWorker {
+func NewForwardWorker(fwd config.Forward, portForwarder *k8s.PortForwarder, verbose bool, statusUI StatusUpdater, healthChecker *healthcheck.Checker) *ForwardWorker {
 	ctx, cancel := context.WithCancel(context.Background())
 
 	return &ForwardWorker{
@@ -54,43 +39,13 @@ func NewForwardWorker(fwd config.Forward, portForwarder *k8s.PortForwarder, verb
 		cancel:        cancel,
 		stopChan:      make(chan struct{}),
 		doneChan:      make(chan struct{}),
-		reconnectChan: make(chan string, 1),   // Buffered to avoid blocking
-		successChan:   make(chan struct{}, 1), // Buffered to avoid blocking
 		verbose:       verbose,
 		statusUI:      statusUI,
 		healthChecker: healthChecker,
-		watchdog:      watchdog,
 		startTime:     time.Now(),
 	}
 }
 
-// signalConnectionSuccess signals that a connection was successfully established.
-// This is used to reset the backoff timer after a successful connection.
-func (w *ForwardWorker) signalConnectionSuccess() {
-	select {
-	case w.successChan <- struct{}{}:
-	default:
-		// Channel already has pending signal
-	}
-}
-
-// TriggerReconnect triggers a reconnection (e.g., due to stale connection)
-func (w *ForwardWorker) TriggerReconnect(reason string) {
-	// Cancel current forward if running
-	w.forwardCancelMu.Lock()
-	if w.forwardCancel != nil {
-		w.forwardCancel()
-	}
-	w.forwardCancelMu.Unlock()
-
-	// Send reconnect signal (non-blocking)
-	select {
-	case w.reconnectChan <- reason:
-	default:
-		// Channel already has pending reconnect
-	}
-}
-
 // Start begins the port-forward worker in a goroutine.
 // The worker will continuously retry on failures with exponential backoff.
 func (w *ForwardWorker) Start() {
@@ -98,82 +53,26 @@ func (w *ForwardWorker) Start() {
 }
 
 // Stop gracefully stops the port-forward worker.
-// Safe to call concurrently and multiple times — stopChan is closed exactly once.
 func (w *ForwardWorker) Stop() {
 	w.cancel()
-	w.stopOnce.Do(func() {
-		close(w.stopChan)
-	})
-
-	// Wait for worker to finish with timeout to prevent blocking forever
-	select {
-	case <-w.doneChan:
-		// Worker finished gracefully
-	case <-time.After(3 * time.Second):
-		// Worker didn't finish in time, but we've cancelled its context
-		// so it will clean up eventually
-		log.Printf("[%s] Worker stop timed out, continuing...", w.forward.ID())
-	}
-}
-
-// IsAlive implements HeartbeatResponder interface.
-// Returns true if the worker goroutine is still running and responsive.
-func (w *ForwardWorker) IsAlive() bool {
-	select {
-	case <-w.doneChan:
-		return false
-	case <-w.ctx.Done():
-		return false
-	default:
-		return true
-	}
-}
-
-// GetForwardID implements HeartbeatResponder interface.
-func (w *ForwardWorker) GetForwardID() string {
-	return w.forward.ID()
+	close(w.stopChan)
+	<-w.doneChan // Wait for worker to finish
 }
 
 // run is the main worker loop that handles retries.
 func (w *ForwardWorker) run() {
-	// Use a combined defer with sync.Once to ensure doneChan is closed
-	// even if stopHTTPProxy() panics. This prevents the worker from
-	// getting stuck if cleanup operations fail.
-	var closeDoneOnce sync.Once
-	defer func() {
-		w.stopHTTPProxy() // Ensure proxy is stopped on exit
-		closeDoneOnce.Do(func() {
-			close(w.doneChan)
-		})
-	}()
-
-	// Note: Heartbeat management is now centralized in the Watchdog.
-	// The watchdog polls workers via the HeartbeatResponder interface (IsAlive method)
-	// instead of each worker spawning its own heartbeat goroutine.
-	// This reduces goroutine count from 2N to N for N workers.
-
-	// Start HTTP logging proxy if enabled
-	if err := w.startHTTPProxy(); err != nil {
-		logger.Error("Failed to start HTTP logging proxy", map[string]any{
-			"forward_id": w.forward.ID(),
-			"error":      err.Error(),
-		})
-		// Continue without HTTP logging
-	}
+	defer close(w.doneChan)
 
 	backoff := retry.NewBackoff()
 
 	for {
-		// Check if we should stop or reset backoff on successful connection
+		// Check if we should stop
 		select {
 		case <-w.ctx.Done():
 			if w.verbose {
 				log.Printf("[%s] Worker stopped", w.forward.ID())
 			}
 			return
-		case <-w.successChan:
-			// Reset backoff after successful connection
-			backoff.Reset()
 		default:
 		}
 
@@ -187,13 +86,7 @@ func (w *ForwardWorker) run() {
 		)
 
 		if err != nil {
-			logger.Error("Failed to resolve resource", map[string]any{
-				"forward_id": w.forward.ID(),
-				"context":    w.forward.GetContext(),
-				"namespace":  w.forward.GetNamespace(),
-				"resource":   w.forward.Resource,
-				"error":      err.Error(),
-			})
+			log.Printf("[%s] Failed to resolve resource: %v", w.forward.ID(), err)
 			w.sleepWithBackoff(backoff)
 			continue
 		}
@@ -203,20 +96,10 @@ func (w *ForwardWorker) run() {
 			if w.healthChecker != nil {
 				w.healthChecker.MarkReconnecting(w.forward.ID())
 			}
-			logger.Info("Pod restart detected, switching to new pod", map[string]any{
-				"forward_id": w.forward.ID(),
-				"old_pod":    w.lastPod,
-				"new_pod":    podName,
-				"context":    w.forward.GetContext(),
-				"namespace":  w.forward.GetNamespace(),
-			})
+			log.Printf("[%s] Switched to new pod: %s → %s", w.forward.ID(), w.lastPod, podName)
 		} else if w.lastPod == "" {
-			logger.Info("Starting port forward", map[string]any{
-				"forward_id": w.forward.ID(),
-				"target":     w.forward.String(),
-				"local_port": w.forward.LocalPort,
-				"pod":        podName,
-			})
+			log.Printf("[%s] Forwarding %s → localhost:%d",
+				w.forward.ID(), w.forward.String(), w.forward.LocalPort)
 			if w.healthChecker != nil {
 				w.healthChecker.MarkStarting(w.forward.ID())
 			}
@@ -240,14 +123,7 @@ func (w *ForwardWorker) run() {
 			}
 
 			// Log the error
-			logger.Warn("Port-forward connection failed, will retry", map[string]any{
-				"forward_id": w.forward.ID(),
-				"context":    w.forward.GetContext(),
-				"namespace":  w.forward.GetNamespace(),
-				"resource":   w.forward.Resource,
-				"local_port": w.forward.LocalPort,
-				"error":      err.Error(),
-			})
+			log.Printf("[%s] Port-forward connection failed: %v", w.forward.ID(), err)
 
 			// Clear last pod so we re-resolve on next attempt
 			w.lastPod = ""
@@ -278,41 +154,15 @@ func (w *ForwardWorker) establishForward(podName string) error {
 
 	// Create a context for this forward attempt
 	forwardCtx, forwardCancel := context.WithCancel(w.ctx)
+	defer forwardCancel()
 
-	// Store cancel function so TriggerReconnect can use it
-	w.forwardCancelMu.Lock()
-	w.forwardCancel = forwardCancel
-	w.forwardCancelMu.Unlock()
-
-	// Combined cleanup: cancel context and clear the cancel function reference.
-	// Using a single defer ensures both operations happen atomically.
-	defer func() {
-		forwardCancel()
-		w.forwardCancelMu.Lock()
-		w.forwardCancel = nil
-		w.forwardCancelMu.Unlock()
-	}()
-
-	// Use sync.Once to ensure stopChan is closed exactly once
-	var closeOnce sync.Once
-	closeStopChan := func() {
-		closeOnce.Do(func() {
-			close(stopChan)
-		})
-	}
-
-	// Ensure stopChan is closed when this function exits (prevents goroutine leak)
-	defer closeStopChan()
-
-	// Start a goroutine to monitor for stop signal and reconnect triggers
+	// Start a goroutine to monitor for stop signal
 	go func() {
 		select {
 		case <-w.stopChan:
-			closeStopChan()
-		case <-w.reconnectChan:
-			closeStopChan()
+			close(stopChan)
 		case <-forwardCtx.Done():
-			closeStopChan()
+			close(stopChan)
 		}
 	}()
 
@@ -326,20 +176,13 @@ func (w *ForwardWorker) establishForward(podName string) error {
 		errOut = io.Discard
 	}
 
-	// Determine local port for k8s port-forward
-	// If HTTP logging is enabled, we bind to an internal port and the proxy listens on the user-facing port
-	localPort := w.forward.LocalPort
-	if w.httpProxy != nil {
-		localPort = w.httpProxy.GetTargetPort()
-	}
-
 	// Create forward request
 	req := &k8s.ForwardRequest{
 		ContextName: w.forward.GetContext(),
 		Namespace:   w.forward.GetNamespace(),
 		Resource:    w.forward.Resource,
 		Selector:    w.forward.Selector,
-		LocalPort:   localPort,
+		LocalPort:   w.forward.LocalPort,
 		RemotePort:  w.forward.Port,
 		StopChan:    stopChan,
 		ReadyChan:   readyChan,
@@ -350,11 +193,6 @@ func (w *ForwardWorker) establishForward(podName string) error {
 	// Start port forwarding in a goroutine
 	errChan := make(chan error, 1)
 	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				errChan <- fmt.Errorf("port forward panicked: %v", r)
-			}
-		}()
 		errChan <- w.portForwarder.Forward(forwardCtx, req)
 	}()
 
@@ -364,17 +202,11 @@ func (w *ForwardWorker) establishForward(podName string) error {
 		if w.verbose {
 			log.Printf("[%s] Port-forward connection established", w.forward.ID())
 		}
-		// Mark connection as established in health checker
-		if w.healthChecker != nil {
-			w.healthChecker.MarkConnected(w.forward.ID())
-		}
-		// Signal success back to caller so backoff can be reset
-		w.signalConnectionSuccess()
 	case err := <-errChan:
 		return fmt.Errorf("failed to establish forward: %w", err)
 	case <-w.ctx.Done():
 		return nil
-	case <-time.After(portForwardReadyTimeout):
+	case <-time.After(30 * time.Second):
 		return fmt.Errorf("timeout waiting for port-forward to become ready")
 	}
 
@@ -419,61 +251,6 @@ func (w *ForwardWorker) IsRunning() bool {
 	}
 }
 
-// startHTTPProxy starts the HTTP logging proxy if enabled
-func (w *ForwardWorker) startHTTPProxy() error {
-	if !w.forward.IsHTTPLogEnabled() {
-		return nil
-	}
-
-	// Calculate internal port for k8s tunnel
-	targetPort := w.forward.LocalPort + httpLogPortOffset
-
-	// Validate that the target port is available before attempting to bind
-	portChecker := NewPortChecker()
-	if !portChecker.isPortAvailable(targetPort) {
-		usedBy := portChecker.getProcessUsingPort(targetPort)
-		return fmt.Errorf("HTTP proxy target port %d is already in use by %s (forward port %d + offset %d)",
-			targetPort, usedBy, w.forward.LocalPort, httpLogPortOffset)
-	}
-
-	proxy, err := httplog.NewProxy(&w.forward, targetPort)
-	if err != nil {
-		return fmt.Errorf("failed to create HTTP proxy: %w", err)
-	}
-
-	if err := proxy.Start(); err != nil {
-		return fmt.Errorf("failed to start HTTP proxy: %w", err)
-	}
-
-	w.httpProxy = proxy
-
-	logger.Info("HTTP logging proxy started", map[string]any{
-		"forward_id":  w.forward.ID(),
-		"local_port":  w.forward.LocalPort,
-		"target_port": targetPort,
-	})
-
-	return nil
-}
-
-// stopHTTPProxy stops the HTTP logging proxy if running
-func (w *ForwardWorker) stopHTTPProxy() {
-	if w.httpProxy != nil {
-		if err := w.httpProxy.Stop(); err != nil {
-			logger.Warn("Failed to stop HTTP proxy", map[string]any{
-				"forward_id": w.forward.ID(),
-				"error":      err.Error(),
-			})
-		}
-		w.httpProxy = nil
-	}
-}
-
-// GetHTTPProxy returns the HTTP logging proxy if active
-func (w *ForwardWorker) GetHTTPProxy() *httplog.Proxy {
-	return w.httpProxy
-}
-
 // logWriter implements io.Writer to write log messages with a prefix.
 type logWriter struct {
 	prefix string

internal/forward/worker_test.go

@@ -1,353 +0,0 @@
-package forward
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/stretchr/testify/assert"
-)
-
-// TestNewForwardWorker tests worker creation
-func TestNewForwardWorker(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	assert.NotNil(t, worker)
-	assert.Equal(t, fwd, worker.forward)
-	assert.False(t, worker.verbose)
-	assert.NotNil(t, worker.ctx)
-	assert.NotNil(t, worker.stopChan)
-	assert.NotNil(t, worker.doneChan)
-	assert.NotNil(t, worker.reconnectChan)
-	assert.NotNil(t, worker.successChan)
-}
-
-// TestNewForwardWorker_Verbose tests verbose mode worker creation
-func TestNewForwardWorker_Verbose(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, true, nil, nil, nil)
-
-	assert.True(t, worker.verbose)
-}
-
-// TestWorker_GetForwardConfig tests getting forward config
-func TestWorker_GetForwardConfig(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "service/postgres",
-		LocalPort: 5432,
-		Port:      5432,
-		Alias:     "db",
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-	result := worker.GetForward()
-
-	assert.Equal(t, fwd, result)
-	assert.Equal(t, "service/postgres", result.Resource)
-	assert.Equal(t, 5432, result.LocalPort)
-	assert.Equal(t, "db", result.Alias)
-}
-
-// TestForwardWorker_GetForwardID tests GetForwardID implementation
-func TestForwardWorker_GetForwardID(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-	id := worker.GetForwardID()
-
-	assert.NotEmpty(t, id)
-	assert.Equal(t, fwd.ID(), id)
-}
-
-// TestForwardWorker_IsAlive tests IsAlive implementation
-func TestForwardWorker_IsAlive(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	// Before starting, worker should be "alive" (context not cancelled)
-	assert.True(t, worker.IsAlive())
-
-	// Cancel context
-	worker.cancel()
-
-	// After cancel, IsAlive should return false
-	assert.False(t, worker.IsAlive())
-}
-
-// TestWorker_IsRunningState tests IsRunning method
-func TestWorker_IsRunningState(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	// Before done channel is closed, worker is "running"
-	assert.True(t, worker.IsRunning())
-
-	// Close done channel to simulate worker completion
-	close(worker.doneChan)
-
-	// After done channel closed, worker is not running
-	assert.False(t, worker.IsRunning())
-}
-
-// TestForwardWorker_SignalConnectionSuccess tests success signaling
-func TestForwardWorker_SignalConnectionSuccess(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	// Signal success
-	worker.signalConnectionSuccess()
-
-	// Should be able to receive from success channel
-	select {
-	case <-worker.successChan:
-		// Success
-	case <-time.After(100 * time.Millisecond):
-		t.Fatal("Expected signal on success channel")
-	}
-
-	// Second signal should not block (buffer of 1)
-	worker.signalConnectionSuccess()
-	worker.signalConnectionSuccess() // Should not block
-
-	// Channel should have at most 1 pending signal
-	select {
-	case <-worker.successChan:
-		// Got the signal
-	default:
-		// No signal (also acceptable - channel already had one)
-	}
-}
-
-// TestForwardWorker_TriggerReconnect tests reconnect triggering
-func TestForwardWorker_TriggerReconnect(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	// Trigger reconnect
-	worker.TriggerReconnect("test reason")
-
-	// Should be able to receive from reconnect channel
-	select {
-	case reason := <-worker.reconnectChan:
-		assert.Equal(t, "test reason", reason)
-	case <-time.After(100 * time.Millisecond):
-		t.Fatal("Expected signal on reconnect channel")
-	}
-}
-
-// TestForwardWorker_TriggerReconnect_WithForwardCancel tests reconnect with active forward
-func TestForwardWorker_TriggerReconnect_WithForwardCancel(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	// Set up a forward cancel function
-	ctx, cancel := context.WithCancel(context.Background())
-	worker.forwardCancelMu.Lock()
-	worker.forwardCancel = cancel
-	worker.forwardCancelMu.Unlock()
-
-	// Trigger reconnect
-	worker.TriggerReconnect("stale connection")
-
-	// Context should be cancelled
-	select {
-	case <-ctx.Done():
-		// Success - context was cancelled
-	case <-time.After(100 * time.Millisecond):
-		t.Fatal("Expected forward context to be cancelled")
-	}
-}
-
-// TestForwardWorker_TriggerReconnect_NonBlocking tests non-blocking behavior
-func TestForwardWorker_TriggerReconnect_NonBlocking(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	// Fill the channel
-	worker.reconnectChan <- "first"
-
-	// Second trigger should not block
-	done := make(chan bool)
-	go func() {
-		worker.TriggerReconnect("second")
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		// Success - didn't block
-	case <-time.After(100 * time.Millisecond):
-		t.Fatal("TriggerReconnect blocked when channel was full")
-	}
-}
-
-// TestForwardWorker_Stop tests graceful stop
-func TestForwardWorker_Stop(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	// Close done channel to simulate worker has finished
-	close(worker.doneChan)
-
-	// Stop should complete quickly since worker is "done"
-	done := make(chan bool)
-	go func() {
-		worker.Stop()
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		// Success
-	case <-time.After(5 * time.Second):
-		t.Fatal("Stop timed out")
-	}
-}
-
-// TestForwardWorker_Stop_Timeout tests stop timeout behavior
-func TestForwardWorker_Stop_Timeout(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-	// Don't close doneChan - simulate hanging worker
-
-	// Stop should timeout after ~3 seconds
-	start := time.Now()
-	done := make(chan bool)
-	go func() {
-		worker.Stop()
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		elapsed := time.Since(start)
-		// Should have waited at least 2 seconds but not more than 5
-		assert.True(t, elapsed >= 2*time.Second, "Should wait for timeout")
-		assert.True(t, elapsed < 5*time.Second, "Should not wait too long")
-	case <-time.After(10 * time.Second):
-		t.Fatal("Stop never completed")
-	}
-}
-
-// TestForwardWorker_GetHTTPProxy tests HTTP proxy getter
-func TestForwardWorker_GetHTTPProxy(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	// Initially nil
-	proxy := worker.GetHTTPProxy()
-	assert.Nil(t, proxy)
-}
-
-// TestForwardWorker_HeartbeatResponder tests HeartbeatResponder interface
-func TestForwardWorker_HeartbeatResponder(t *testing.T) {
-	fwd := config.Forward{
-		Resource:  "pod/my-app",
-		LocalPort: 8080,
-		Port:      80,
-	}
-
-	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
-
-	// Worker should implement HeartbeatResponder
-	var responder HeartbeatResponder = worker
-	assert.NotNil(t, responder)
-
-	// Test interface methods
-	assert.True(t, responder.IsAlive())
-	assert.NotEmpty(t, responder.GetForwardID())
-}
-
-// TestLogWriter tests the logWriter implementation
-func TestLogWriter(t *testing.T) {
-	tests := []struct {
-		name   string
-		prefix string
-		input  []byte
-	}{
-		{"simple message", "[test] ", []byte("hello")},
-		{"empty message", "[test] ", []byte("")},
-		{"multiline", "[test] ", []byte("line1\nline2")},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			lw := &logWriter{prefix: tt.prefix}
-			n, err := lw.Write(tt.input)
-
-			assert.NoError(t, err)
-			assert.Equal(t, len(tt.input), n)
-		})
-	}
-}
-
-// TestHTTPLogPortOffset tests the port offset constant
-func TestHTTPLogPortOffset(t *testing.T) {
-	assert.Equal(t, 10000, httpLogPortOffset)
-}
-
-// TestPortForwardReadyTimeout tests the ready timeout constant
-func TestPortForwardReadyTimeout(t *testing.T) {
-	assert.Equal(t, 30*time.Second, portForwardReadyTimeout)
-}

internal/forward/worker_unit_test.go

@@ -1,378 +0,0 @@
-package forward
-
-import (
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestLogWriter_Write(t *testing.T) {
-	tests := []struct {
-		name          string
-		prefix        string
-		input         string
-		expectedInLog string
-		description   string
-	}{
-		{
-			name:          "write simple message",
-			prefix:        "[worker] ",
-			input:         "test message",
-			expectedInLog: "[worker] test message",
-			description:   "Should write message with prefix to log",
-		},
-		{
-			name:          "write empty message",
-			prefix:        "[test] ",
-			input:         "",
-			expectedInLog: "[test] ",
-			description:   "Should handle empty message",
-		},
-		{
-			name:          "write multiline message",
-			prefix:        "[fwd] ",
-			input:         "line1\nline2",
-			expectedInLog: "[fwd] line1\nline2",
-			description:   "Should handle multiline messages",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Test logWriter
-			originalWriter := &logWriter{prefix: tt.prefix}
-
-			n, err := originalWriter.Write([]byte(tt.input))
-
-			require.NoError(t, err, "Write should not return error")
-			assert.Equal(t, len(tt.input), n, "Write should return number of bytes written")
-		})
-	}
-}
-
-func TestForwardWorker_GetForward(t *testing.T) {
-	tests := []struct {
-		name        string
-		description string
-		forward     config.Forward
-	}{
-		{
-			name: "get pod forward",
-			forward: config.Forward{
-				Resource:  "pod/my-app",
-				LocalPort: 8080,
-				Port:      80,
-				Protocol:  "tcp",
-			},
-			description: "Should return the forward configuration",
-		},
-		{
-			name: "get service forward",
-			forward: config.Forward{
-				Resource:  "service/postgres",
-				LocalPort: 5432,
-				Port:      5432,
-				Protocol:  "tcp",
-			},
-			description: "Should return service forward configuration",
-		},
-		{
-			name: "get forward with selector",
-			forward: config.Forward{
-				Resource:  "pod",
-				Selector:  "app=nginx,env=prod",
-				LocalPort: 8080,
-				Port:      80,
-				Protocol:  "tcp",
-			},
-			description: "Should return forward with label selector",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Note: We can't easily test the full worker lifecycle without mocks,
-			// but we can test the constructor and simple getters
-
-			// This test would require proper mocking setup
-			// For now, we'll test the Forward struct directly
-
-			id := tt.forward.ID()
-			assert.NotEmpty(t, id, "Forward should have an ID")
-
-			forwardStr := tt.forward.String()
-			assert.NotEmpty(t, forwardStr, "Forward should have a string representation")
-			assert.Contains(t, forwardStr, tt.forward.Resource, "String should contain resource")
-		})
-	}
-}
-
-func TestForwardWorker_IsRunning(t *testing.T) {
-	// This is a basic test of the goroutine state tracking
-	// Full integration tests would require mock dependencies
-
-	t.Run("worker state tracking", func(t *testing.T) {
-		// Test the concept of the done channel
-		doneChan := make(chan struct{})
-
-		// Initially, channel is open (worker would be running)
-		select {
-		case <-doneChan:
-			t.Fatal("doneChan should be open initially")
-		default:
-			// Expected: channel is open
-		}
-
-		// Close the channel (simulating worker done)
-		close(doneChan)
-
-		// Now channel should be closed
-		select {
-		case <-doneChan:
-			// Expected: channel is closed
-		default:
-			t.Fatal("doneChan should be closed after close")
-		}
-	})
-}
-
-func TestForwardID(t *testing.T) {
-	tests := []struct {
-		name         string
-		description  string
-		forward      config.Forward
-		expectUnique bool
-	}{
-		{
-			name: "unique IDs for different forwards",
-			forward: config.Forward{
-				Resource:  "pod/app1",
-				LocalPort: 8080,
-				Port:      80,
-			},
-			expectUnique: true,
-			description:  "Different forwards should have different IDs",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			id1 := tt.forward.ID()
-
-			// Create a different forward
-			fwd2 := config.Forward{
-				Resource:  "pod/app2",
-				LocalPort: 8081,
-				Port:      80,
-			}
-			id2 := fwd2.ID()
-
-			if tt.expectUnique {
-				assert.NotEqual(t, id1, id2, "Different forwards should have different IDs")
-			}
-
-			// Same forward should produce same ID
-			id3 := tt.forward.ID()
-			assert.Equal(t, id1, id3, "Same forward should produce same ID")
-		})
-	}
-}
-
-func TestForwardString(t *testing.T) {
-	tests := []struct {
-		name             string
-		description      string
-		expectedContains []string
-		forward          config.Forward
-	}{
-		{
-			name: "pod forward string",
-			forward: config.Forward{
-				Resource:  "pod/my-app",
-				LocalPort: 8080,
-				Port:      80,
-			},
-			expectedContains: []string{"pod/my-app", "8080", "80"},
-			description:      "Should contain resource and ports",
-		},
-		{
-			name: "service forward string",
-			forward: config.Forward{
-				Resource:  "service/postgres",
-				LocalPort: 5432,
-				Port:      5432,
-			},
-			expectedContains: []string{"service/postgres", "5432"},
-			description:      "Should contain service and port",
-		},
-		{
-			name: "selector forward string",
-			forward: config.Forward{
-				Resource:  "pod",
-				Selector:  "app=nginx",
-				LocalPort: 8080,
-				Port:      80,
-			},
-			expectedContains: []string{"app=nginx", "8080", "80"},
-			description:      "Should contain selector and ports",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.forward.String()
-
-			assert.NotEmpty(t, result, "String representation should not be empty")
-
-			for _, expected := range tt.expectedContains {
-				assert.Contains(t, result, expected,
-					"String should contain %s", expected)
-			}
-		})
-	}
-}
-
-func TestSleepWithBackoffConcept(t *testing.T) {
-	// Test the backoff concept without actually running a worker
-	t.Run("backoff delay increases", func(t *testing.T) {
-		// This tests the retry backoff behavior conceptually
-		delays := []int{1, 2, 4, 8, 10, 10, 10}
-
-		for i, expected := range delays {
-			// Simulate backoff calculation
-			delay := 1
-			for j := 0; j < i; j++ {
-				delay *= 2
-				if delay > 10 {
-					delay = 10
-				}
-			}
-
-			assert.Equal(t, expected, delay,
-				"Backoff at attempt %d should be %d", i, expected)
-		}
-	})
-}
-
-func TestWorkerVerboseMode(t *testing.T) {
-	tests := []struct {
-		name        string
-		description string
-		verbose     bool
-	}{
-		{
-			name:        "verbose mode enabled",
-			verbose:     true,
-			description: "Worker should respect verbose flag",
-		},
-		{
-			name:        "verbose mode disabled",
-			verbose:     false,
-			description: "Worker should respect non-verbose flag",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Test that verbose flag is a boolean
-			assert.IsType(t, bool(true), tt.verbose)
-
-			// In a real worker, this would control logging
-			// For now, we just verify the type
-		})
-	}
-}
-
-// TestWorkerCleanupWithPanic verifies that doneChan is properly closed
-// even when cleanup functions panic. This tests the fix for the defer
-// ordering issue where stopHTTPProxy() could prevent doneChan from closing.
-func TestWorkerCleanupWithPanic(t *testing.T) {
-	t.Run("doneChan closed after panic in cleanup", func(t *testing.T) {
-		doneChan := make(chan struct{})
-
-		// Simulate the cleanup pattern used in run() with sync.Once
-		var closeDoneOnce sync.Once
-		cleanupWithPanic := func() {
-			// Simulate stopHTTPProxy() that panics
-			panic("simulated panic in cleanup")
-		}
-
-		// Use defer with recovery to test the pattern
-		func() {
-			defer func() {
-				if r := recover(); r != nil {
-					// Expected panic - doneChan should still be closed
-					_ = r // Suppress SA9003: empty branch warning
-				}
-				closeDoneOnce.Do(func() {
-					close(doneChan)
-				})
-			}()
-
-			cleanupWithPanic()
-		}()
-
-		// Verify doneChan was closed even though cleanup panicked
-		select {
-		case <-doneChan:
-			// Success: channel was closed
-		case <-time.After(100 * time.Millisecond):
-			t.Fatal("doneChan should be closed even when cleanup panics")
-		}
-	})
-
-	t.Run("doneChan closed normally without panic", func(t *testing.T) {
-		doneChan := make(chan struct{})
-
-		var closeDoneOnce sync.Once
-		cleanupNormal := func() {
-			// Normal cleanup, no panic
-		}
-
-		func() {
-			defer func() {
-				cleanupNormal()
-				closeDoneOnce.Do(func() {
-					close(doneChan)
-				})
-			}()
-			// Normal function execution
-		}()
-
-		// Verify doneChan was closed
-		select {
-		case <-doneChan:
-			// Success
-		case <-time.After(100 * time.Millisecond):
-			t.Fatal("doneChan should be closed after normal execution")
-		}
-	})
-
-	t.Run("sync.Once prevents double close", func(t *testing.T) {
-		doneChan := make(chan struct{})
-
-		var closeDoneOnce sync.Once
-		closeFunc := func() {
-			closeDoneOnce.Do(func() {
-				close(doneChan)
-			})
-		}
-
-		// Call closeFunc multiple times
-		closeFunc()
-		closeFunc()
-		closeFunc()
-
-		// Should not panic - sync.Once ensures close() is only called once
-		select {
-		case <-doneChan:
-			// Success
-		case <-time.After(100 * time.Millisecond):
-			t.Fatal("doneChan should be closed")
-		}
-	})
-}

internal/healthcheck/checker.go

@@ -1,43 +1,11 @@
-// Package healthcheck provides connection health monitoring for port-forwards.
-// It detects stale, hung, or broken connections and triggers reconnection.
-//
-// The Checker supports two health check methods:
-//   - tcp-dial: Simple TCP connection test (fast but less reliable)
-//   - data-transfer: Attempts to read data from the connection (more reliable)
-//
-// Stale connection detection prevents issues during long-running operations
-// like database dumps by monitoring:
-//   - Connection age (default: 25 minutes, before k8s 30-minute timeout)
-//   - Idle time (default: 10 minutes, detects hung tunnels)
-//
-// The package uses a sync.Pool for buffer reuse to minimize GC pressure
-// during frequent health checks.
 package healthcheck
 
 import (
 	"context"
 	"fmt"
-	"io"
 	"net"
 	"sync"
 	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/lukaszraczylo/kportal/internal/events"
-)
-
-// bufferPool is a sync.Pool for reusing buffers in data transfer health checks.
-// This reduces GC pressure by avoiding allocation of 1KB buffers on every health check.
-var bufferPool = sync.Pool{
-	New: func() interface{} {
-		buf := make([]byte, dataTransferSize)
-		return &buf
-	},
-}
-
-const (
-	startupGracePeriod = 10 * time.Second
-	dataTransferSize   = 1024 // bytes to read in data transfer test
 )
 
 // Status represents the health status of a port forward
@@ -48,151 +16,61 @@ const (
 	StatusUnhealthy Status = "Error"
 	StatusStarting  Status = "Starting"
 	StatusReconnect Status = "Reconnecting"
-	StatusStale     Status = "Stale" // Connection is old or idle
-)
-
-// CheckMethod represents the health check method
-type CheckMethod string
-
-const (
-	CheckMethodTCPDial      CheckMethod = "tcp-dial"      // Simple TCP connection test
-	CheckMethodDataTransfer CheckMethod = "data-transfer" // Try to read data from connection
 )
 
 // PortHealth represents the health status of a single port
 type PortHealth struct {
-	LastCheck      time.Time
-	RegisteredAt   time.Time
-	ConnectionTime time.Time
-	LastActivity   time.Time
-	Status         Status
-	ErrorMessage   string
-	Port           int
+	Port         int
+	LastCheck    time.Time
+	Status       Status
+	ErrorMessage string
+	RegisteredAt time.Time // When this port was registered
 }
 
 // StatusCallback is called when a port's health status changes
 type StatusCallback func(forwardID string, status Status, errorMsg string)
 
-// Checker performs periodic health checks on local ports.
-// Uses a single goroutine to check all registered ports, reducing overhead
-// compared to one goroutine per port.
+// Checker performs periodic health checks on local ports
 type Checker struct {
-	ctx              context.Context
-	ports            map[string]*PortHealth
-	callbacks        map[string]StatusCallback
-	eventBus         *events.Bus
-	cancel           context.CancelFunc
-	method           CheckMethod
-	wg               sync.WaitGroup
-	interval         time.Duration
-	maxIdleTime      time.Duration
-	maxConnectionAge time.Duration
-	timeout          time.Duration
-	mu               sync.RWMutex
-	started          bool
+	mu        sync.RWMutex
+	ports     map[string]*PortHealth // key: forward ID
+	callbacks map[string]StatusCallback
+	interval  time.Duration
+	timeout   time.Duration
+	ctx       context.Context
+	cancel    context.CancelFunc
+	wg        sync.WaitGroup
 }
 
-// CheckerOptions configures the health checker
-type CheckerOptions struct {
-	Method           CheckMethod
-	Interval         time.Duration
-	Timeout          time.Duration
-	MaxConnectionAge time.Duration
-	MaxIdleTime      time.Duration
-}
-
-// NewChecker creates a new health checker with default options
+// NewChecker creates a new health checker
 func NewChecker(interval, timeout time.Duration) *Checker {
-	return NewCheckerWithOptions(CheckerOptions{
-		Interval:         interval,
-		Timeout:          timeout,
-		Method:           CheckMethodDataTransfer,
-		MaxConnectionAge: config.DefaultMaxConnectionAge,
-		MaxIdleTime:      config.DefaultMaxIdleTime,
-	})
-}
-
-// NewCheckerWithOptions creates a new health checker with custom options
-func NewCheckerWithOptions(opts CheckerOptions) *Checker {
 	ctx, cancel := context.WithCancel(context.Background())
-	c := &Checker{
-		ports:            make(map[string]*PortHealth),
-		callbacks:        make(map[string]StatusCallback),
-		interval:         opts.Interval,
-		timeout:          opts.Timeout,
-		method:           opts.Method,
-		maxConnectionAge: opts.MaxConnectionAge,
-		maxIdleTime:      opts.MaxIdleTime,
-		ctx:              ctx,
-		cancel:           cancel,
+	return &Checker{
+		ports:     make(map[string]*PortHealth),
+		callbacks: make(map[string]StatusCallback),
+		interval:  interval,
+		timeout:   timeout,
+		ctx:       ctx,
+		cancel:    cancel,
 	}
-
-	// Start the single monitoring loop
-	c.wg.Add(1)
-	go c.monitorLoop()
-	c.started = true
-
-	return c
-}
-
-// SetEventBus sets the event bus for publishing health events
-func (c *Checker) SetEventBus(bus *events.Bus) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.eventBus = bus
 }
 
 // Register adds a port to monitor
 func (c *Checker) Register(forwardID string, port int, callback StatusCallback) {
 	c.mu.Lock()
-
-	now := time.Now()
-	c.ports[forwardID] = &PortHealth{
-		Port:           port,
-		LastCheck:      time.Time{},
-		Status:         StatusStarting,
-		RegisteredAt:   now,
-		ConnectionTime: now,
-		LastActivity:   now,
-	}
-	c.callbacks[forwardID] = callback
-	c.mu.Unlock()
-
-	// Perform immediate first check so status updates quickly
-	// This prevents the forward from being stuck in "Starting" state
-	// until the next ticker interval
-	go c.checkPort(forwardID)
-}
-
-// MarkConnected marks a forward as having established a new connection.
-// This updates connection timestamps and triggers an immediate health check
-// to verify the connection is actually working.
-func (c *Checker) MarkConnected(forwardID string) {
-	c.mu.Lock()
-
-	health, exists := c.ports[forwardID]
-	if !exists {
-		c.mu.Unlock()
-		return
-	}
-
-	now := time.Now()
-	health.ConnectionTime = now
-	health.LastActivity = now
-	c.mu.Unlock()
-
-	// Trigger immediate health check to verify connection and update status
-	go c.checkPort(forwardID)
-}
-
-// RecordActivity records data transfer activity for a forward
-func (c *Checker) RecordActivity(forwardID string) {
-	c.mu.Lock()
 	defer c.mu.Unlock()
 
-	if health, exists := c.ports[forwardID]; exists {
-		health.LastActivity = time.Now()
+	c.ports[forwardID] = &PortHealth{
+		Port:         port,
+		LastCheck:    time.Time{},
+		Status:       StatusStarting,
+		RegisteredAt: time.Now(),
 	}
+	c.callbacks[forwardID] = callback
+
+	// Start checking this port
+	c.wg.Add(1)
+	go c.checkLoop(forwardID)
 }
 
 // Unregister removes a port from monitoring
@@ -204,34 +82,42 @@ func (c *Checker) Unregister(forwardID string) {
 	delete(c.callbacks, forwardID)
 }
 
-// markStatus is a helper to set a forward's status and notify on change.
-func (c *Checker) markStatus(forwardID string, newStatus Status) {
-	c.mu.Lock()
-
-	health, exists := c.ports[forwardID]
-	if !exists {
-		c.mu.Unlock()
-		return
-	}
-
-	oldStatus := health.Status
-	health.Status = newStatus
-	health.LastCheck = time.Now()
-	c.mu.Unlock()
-
-	if oldStatus != newStatus {
-		c.notifyStatusChange(forwardID, newStatus, "")
-	}
-}
-
 // MarkReconnecting marks a forward as reconnecting (called by worker)
 func (c *Checker) MarkReconnecting(forwardID string) {
-	c.markStatus(forwardID, StatusReconnect)
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if health, exists := c.ports[forwardID]; exists {
+		oldStatus := health.Status
+		health.Status = StatusReconnect
+		health.LastCheck = time.Now()
+
+		// Notify if status changed
+		if oldStatus != StatusReconnect {
+			c.mu.Unlock()
+			c.notifyStatusChange(forwardID, StatusReconnect, "")
+			c.mu.Lock()
+		}
+	}
 }
 
 // MarkStarting marks a forward as starting (called by worker)
 func (c *Checker) MarkStarting(forwardID string) {
-	c.markStatus(forwardID, StatusStarting)
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if health, exists := c.ports[forwardID]; exists {
+		oldStatus := health.Status
+		health.Status = StatusStarting
+		health.LastCheck = time.Now()
+
+		// Notify if status changed
+		if oldStatus != StatusStarting {
+			c.mu.Unlock()
+			c.notifyStatusChange(forwardID, StatusStarting, "")
+			c.mu.Lock()
+		}
+	}
 }
 
 // GetStatus returns the current health status of a forward
@@ -245,17 +131,6 @@ func (c *Checker) GetStatus(forwardID string) (Status, bool) {
 	return StatusUnhealthy, false
 }
 
-// GetLastCheckTime returns the last health check time for a forward
-func (c *Checker) GetLastCheckTime(forwardID string) (time.Time, bool) {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-
-	if health, exists := c.ports[forwardID]; exists {
-		return health.LastCheck, true
-	}
-	return time.Time{}, false
-}
-
 // GetAllErrors returns all forwards with errors and their error messages
 func (c *Checker) GetAllErrors() map[string]string {
 	c.mu.RLock()
@@ -276,52 +151,35 @@ func (c *Checker) Stop() {
 	c.wg.Wait()
 }
 
-// monitorLoop is the single goroutine that checks all registered ports periodically.
-// This is more efficient than one goroutine per port as it reduces:
-// - Goroutine overhead (stack memory, scheduler work)
-// - Timer/ticker allocations
-// - Lock contention (one lock acquisition per interval vs N)
-func (c *Checker) monitorLoop() {
+// checkLoop continuously checks a single port's health
+func (c *Checker) checkLoop(forwardID string) {
 	defer c.wg.Done()
 
 	ticker := time.NewTicker(c.interval)
 	defer ticker.Stop()
 
+	// Do immediate first check - grace period logic will handle early failures
+	c.checkPort(forwardID)
+
 	for {
 		select {
 		case <-c.ctx.Done():
 			return
 		case <-ticker.C:
-			c.checkAllPorts()
+			// Check if this forward still exists
+			c.mu.RLock()
+			_, exists := c.ports[forwardID]
+			c.mu.RUnlock()
+
+			if !exists {
+				return
+			}
+
+			c.checkPort(forwardID)
 		}
 	}
 }
 
-// checkAllPorts performs health checks on all registered ports
-func (c *Checker) checkAllPorts() {
-	// Get snapshot of ports to check
-	c.mu.RLock()
-	forwardIDs := make([]string, 0, len(c.ports))
-	for id := range c.ports {
-		forwardIDs = append(forwardIDs, id)
-	}
-	c.mu.RUnlock()
-
-	// Check each port
-	for _, forwardID := range forwardIDs {
-		// Check if still registered (may have been unregistered during iteration)
-		c.mu.RLock()
-		_, exists := c.ports[forwardID]
-		c.mu.RUnlock()
-
-		if !exists {
-			continue
-		}
-
-		c.checkPort(forwardID)
-	}
-}
-
 // checkPort performs a single health check on a port
 func (c *Checker) checkPort(forwardID string) {
 	c.mu.RLock()
@@ -333,146 +191,47 @@ func (c *Checker) checkPort(forwardID string) {
 	port := health.Port
 	oldStatus := health.Status
 	registeredAt := health.RegisteredAt
-	connectionTime := health.ConnectionTime
-	lastActivity := health.LastActivity
 	c.mu.RUnlock()
 
-	now := time.Now()
+	// Attempt to connect to the local port
+	ctx, cancel := context.WithTimeout(c.ctx, c.timeout)
+	defer cancel()
+
+	var d net.Dialer
+	conn, err := d.DialContext(ctx, "tcp", fmt.Sprintf("127.0.0.1:%d", port))
+
 	newStatus := StatusHealthy
 	errorMsg := ""
 
-	// Check for stale connections based on age or idle time
-	connectionAge := now.Sub(connectionTime)
-	idleTime := now.Sub(lastActivity)
-
-	// Only enforce max connection age if the connection is ALSO idle
-	// This prevents interrupting active transfers (e.g., database dumps)
-	if c.maxConnectionAge > 0 && connectionAge > c.maxConnectionAge && idleTime > c.maxIdleTime {
-		newStatus = StatusStale
-		errorMsg = fmt.Sprintf("connection age %v exceeds max %v (and idle for %v)",
-			connectionAge.Round(time.Second), c.maxConnectionAge, idleTime.Round(time.Second))
-	} else if c.maxIdleTime > 0 && idleTime > c.maxIdleTime {
-		newStatus = StatusStale
-		// Round up to next second to ensure displayed time is always > max
-		// (avoids confusing "10m0s exceeds max 10m0s" when actual is 10m0.1s)
-		displayIdle := idleTime.Truncate(time.Second) + time.Second
-		errorMsg = fmt.Sprintf("idle time %v exceeds max %v", displayIdle, c.maxIdleTime)
+	if err != nil {
+		// Grace period: if forward is less than 10 seconds old, keep it as "Starting"
+		// This avoids scary "Error" messages during initial connection attempts
+		timeSinceStart := time.Since(registeredAt)
+		if timeSinceStart < 10*time.Second {
+			newStatus = StatusStarting
+		} else {
+			newStatus = StatusUnhealthy
+		}
+		errorMsg = err.Error()
 	} else {
-		// Perform connectivity check
-		var checkErr error
-		switch c.method {
-		case CheckMethodDataTransfer:
-			checkErr = c.checkDataTransfer(port)
-		case CheckMethodTCPDial:
-			checkErr = c.checkTCPDial(port)
-		default:
-			checkErr = c.checkTCPDial(port)
-		}
-
-		if checkErr != nil {
-			// Grace period: if forward is less than 10 seconds old, keep it as "Starting"
-			// This avoids scary "Error" messages during initial connection attempts
-			timeSinceStart := now.Sub(registeredAt)
-			if timeSinceStart < startupGracePeriod {
-				newStatus = StatusStarting
-			} else {
-				newStatus = StatusUnhealthy
-			}
-			errorMsg = checkErr.Error()
-		}
+		conn.Close()
 	}
 
-	// Update health status and capture eventBus while holding lock
-	var bus *events.Bus
+	// Update health status
 	c.mu.Lock()
 	if health, exists := c.ports[forwardID]; exists {
 		health.Status = newStatus
-		health.LastCheck = now
+		health.LastCheck = time.Now()
 		health.ErrorMessage = errorMsg
-
-		// Successful health check indicates connection is active
-		// This prevents false positives where healthy connections are marked as idle
-		if newStatus == StatusHealthy {
-			health.LastActivity = now
-		}
 	}
-	// Capture eventBus while we have the lock to avoid race condition
-	bus = c.eventBus
 	c.mu.Unlock()
 
 	// Notify if status changed
 	if oldStatus != newStatus {
 		c.notifyStatusChange(forwardID, newStatus, errorMsg)
-
-		// Publish to event bus if available (captured while holding lock above)
-		if bus != nil {
-			if newStatus == StatusStale {
-				bus.Publish(events.NewStaleEvent(forwardID, errorMsg))
-			} else {
-				bus.Publish(events.NewHealthEvent(forwardID, string(newStatus), errorMsg))
-			}
-		}
 	}
 }
 
-// checkTCPDial performs a simple TCP dial test
-func (c *Checker) checkTCPDial(port int) error {
-	ctx, cancel := context.WithTimeout(c.ctx, c.timeout)
-	defer cancel()
-
-	var d net.Dialer
-	conn, err := d.DialContext(ctx, "tcp", fmt.Sprintf("127.0.0.1:%d", port))
-	if err != nil {
-		return err
-	}
-	_ = conn.Close() // Best-effort cleanup; health check succeeded
-	return nil
-}
-
-// checkDataTransfer attempts to read data from the connection to verify tunnel health
-func (c *Checker) checkDataTransfer(port int) error {
-	ctx, cancel := context.WithTimeout(c.ctx, c.timeout)
-	defer cancel()
-
-	var d net.Dialer
-	conn, err := d.DialContext(ctx, "tcp", fmt.Sprintf("127.0.0.1:%d", port))
-	if err != nil {
-		return err
-	}
-	defer func() { _ = conn.Close() }()
-
-	// Set a short read deadline to detect hung connections
-	// We don't expect to receive data, but we want to verify the connection isn't hung
-	_ = conn.SetReadDeadline(time.Now().Add(c.timeout))
-
-	// Try to read a small amount of data
-	// Most servers will either:
-	// 1. Send a banner (SSH, FTP, etc) - we'll read it successfully
-	// 2. Wait for client to send first (HTTP, postgres) - we'll timeout (which is OK)
-	// 3. Hung/stale connection - will timeout with different error
-	bufPtr := bufferPool.Get().(*[]byte)
-	buf := *bufPtr
-	defer bufferPool.Put(bufPtr)
-	_, err = conn.Read(buf)
-
-	// We expect either:
-	// - No error (banner received)
-	// - EOF (connection closed by server after connect)
-	// - Timeout (server waiting for client)
-	// All of these indicate the tunnel is working
-	if err == nil || err == io.EOF {
-		return nil
-	}
-
-	// Timeout is acceptable - server is waiting for us to send data first
-	if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
-		return nil
-	}
-
-	// Other errors indicate a problem
-	return fmt.Errorf("data transfer check failed: %w", err)
-}
-
 // notifyStatusChange calls the callback for a forward
 func (c *Checker) notifyStatusChange(forwardID string, status Status, errorMsg string) {
 	c.mu.RLock()

internal/healthcheck/checker_test.go

@@ -1,546 +0,0 @@
-package healthcheck
-
-import (
-	"fmt"
-	"net"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/suite"
-)
-
-// HealthCheckTestSuite contains tests for the health checker
-type HealthCheckTestSuite struct {
-	suite.Suite
-	checker  *Checker
-	listener net.Listener
-	port     int
-}
-
-func TestHealthCheckSuite(t *testing.T) {
-	suite.Run(t, new(HealthCheckTestSuite))
-}
-
-func (s *HealthCheckTestSuite) SetupTest() {
-	// Create a test listener on a random port
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(s.T(), err)
-	s.listener = ln
-	s.port = ln.Addr().(*net.TCPAddr).Port
-
-	// Create checker with fast intervals for testing
-	s.checker = NewCheckerWithOptions(CheckerOptions{
-		Interval:         100 * time.Millisecond,
-		Timeout:          50 * time.Millisecond,
-		Method:           CheckMethodTCPDial,
-		MaxConnectionAge: 500 * time.Millisecond,
-		MaxIdleTime:      300 * time.Millisecond,
-	})
-}
-
-func (s *HealthCheckTestSuite) TearDownTest() {
-	if s.checker != nil {
-		s.checker.Stop()
-	}
-	if s.listener != nil {
-		_ = s.listener.Close()
-	}
-}
-
-// TestRegisterAndUnregister tests basic registration and unregistration
-func (s *HealthCheckTestSuite) TestRegisterAndUnregister() {
-	callbackCalled := false
-	var callbackStatus Status
-	var mu sync.Mutex
-
-	callback := func(forwardID string, status Status, errorMsg string) {
-		mu.Lock()
-		defer mu.Unlock()
-		callbackCalled = true
-		callbackStatus = status
-	}
-
-	// Register port
-	s.checker.Register("test-forward", s.port, callback)
-
-	// Wait for health check to run
-	time.Sleep(200 * time.Millisecond)
-
-	// Verify callback was called with healthy status
-	mu.Lock()
-	assert.True(s.T(), callbackCalled, "Callback should have been called")
-	assert.Equal(s.T(), StatusHealthy, callbackStatus)
-	mu.Unlock()
-
-	// Unregister
-	s.checker.Unregister("test-forward")
-
-	// Verify port is no longer monitored
-	status, exists := s.checker.GetStatus("test-forward")
-	assert.False(s.T(), exists, "Port should no longer exist after unregister")
-	assert.Equal(s.T(), StatusUnhealthy, status)
-}
-
-// TestTCPDialMethod tests the TCP dial health check method
-func (s *HealthCheckTestSuite) TestTCPDialMethod() {
-	tests := []struct {
-		name           string
-		expectedStatus Status
-		description    string
-		setupPort      bool
-	}{
-		{
-			name:           "port available - healthy",
-			setupPort:      true,
-			expectedStatus: StatusHealthy,
-			description:    "When port is listening, status should be healthy",
-		},
-		{
-			name:           "port unavailable - unhealthy",
-			setupPort:      false,
-			expectedStatus: StatusUnhealthy,
-			description:    "When port is not listening, status should be unhealthy",
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			var testPort int
-
-			if tt.setupPort {
-				// Use the existing listener from suite setup
-				testPort = s.port
-			} else {
-				// Use a port that's not listening
-				testPort = 54321 // Likely unused port
-			}
-
-			// Create a new checker for this test
-			checker := NewCheckerWithOptions(CheckerOptions{
-				Interval:         100 * time.Millisecond,
-				Timeout:          50 * time.Millisecond,
-				Method:           CheckMethodTCPDial,
-				MaxConnectionAge: 0, // Disable for this test
-				MaxIdleTime:      0, // Disable for this test
-			})
-			defer checker.Stop()
-
-			checker.Register("test-forward", testPort, nil)
-
-			// Wait for health checks to complete
-			if !tt.setupPort {
-				// For unhealthy case, wait for grace period
-				time.Sleep(startupGracePeriod + 200*time.Millisecond)
-			} else {
-				time.Sleep(200 * time.Millisecond)
-			}
-
-			// Check status directly
-			status, exists := checker.GetStatus("test-forward")
-			assert.True(s.T(), exists)
-			assert.Equal(s.T(), tt.expectedStatus, status, tt.description)
-		})
-	}
-}
-
-// TestDataTransferMethod tests the data transfer health check method
-func (s *HealthCheckTestSuite) TestDataTransferMethod() {
-	tests := []struct {
-		name           string
-		serverBehavior string // "banner", "silent", "close", "none"
-		expectedStatus Status
-	}{
-		{
-			name:           "server sends banner - healthy",
-			serverBehavior: "banner",
-			expectedStatus: StatusHealthy,
-		},
-		{
-			name:           "server waits silently - healthy (timeout OK)",
-			serverBehavior: "silent",
-			expectedStatus: StatusHealthy,
-		},
-		{
-			name:           "server closes connection - healthy (EOF OK)",
-			serverBehavior: "close",
-			expectedStatus: StatusHealthy,
-		},
-		{
-			name:           "no server listening - unhealthy",
-			serverBehavior: "none",
-			expectedStatus: StatusUnhealthy,
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			var testPort int
-			var testListener net.Listener
-			var err error
-
-			if tt.serverBehavior != "none" {
-				// Start test server
-				testListener, err = net.Listen("tcp", "127.0.0.1:0")
-				require.NoError(s.T(), err)
-				testPort = testListener.Addr().(*net.TCPAddr).Port
-
-				// Handle connections based on behavior
-				go func() {
-					for {
-						conn, err := testListener.Accept()
-						if err != nil {
-							return
-						}
-						switch tt.serverBehavior {
-						case "banner":
-							_, _ = conn.Write([]byte("220 Welcome\r\n"))
-							time.Sleep(50 * time.Millisecond)
-							_ = conn.Close()
-						case "close":
-							_ = conn.Close()
-						case "silent":
-							// Just keep connection open
-							time.Sleep(200 * time.Millisecond)
-							_ = conn.Close()
-						}
-					}
-				}()
-				defer func() { _ = testListener.Close() }()
-			} else {
-				testPort = 54322 // Unused port
-			}
-
-			// Create checker with data transfer method
-			checker := NewCheckerWithOptions(CheckerOptions{
-				Interval:         100 * time.Millisecond,
-				Timeout:          50 * time.Millisecond,
-				Method:           CheckMethodDataTransfer,
-				MaxConnectionAge: 0, // Disable for this test
-				MaxIdleTime:      0, // Disable for this test
-			})
-			defer checker.Stop()
-
-			checker.Register("test-forward", testPort, nil)
-
-			// Wait for health checks to complete
-			if tt.serverBehavior == "none" {
-				// For unhealthy case, wait for grace period
-				time.Sleep(startupGracePeriod + 200*time.Millisecond)
-			} else {
-				time.Sleep(300 * time.Millisecond)
-			}
-
-			// Check status directly
-			status, exists := checker.GetStatus("test-forward")
-			assert.True(s.T(), exists)
-			assert.Equal(s.T(), tt.expectedStatus, status)
-		})
-	}
-}
-
-// TestConnectionAgeDetection tests max connection age detection
-func (s *HealthCheckTestSuite) TestConnectionAgeDetection() {
-	statusChanges := make(chan Status, 10)
-	callback := func(forwardID string, status Status, errorMsg string) {
-		statusChanges <- status
-	}
-
-	// Create checker with very short max connection age
-	checker := NewCheckerWithOptions(CheckerOptions{
-		Interval:         50 * time.Millisecond,
-		Timeout:          25 * time.Millisecond,
-		Method:           CheckMethodTCPDial,
-		MaxConnectionAge: 150 * time.Millisecond, // Very short for testing
-		MaxIdleTime:      0,                      // Disable idle detection
-	})
-	defer checker.Stop()
-
-	checker.Register("test-forward", s.port, callback)
-
-	// Wait for initial healthy status
-	var gotHealthy, gotStale bool
-	timeout := time.After(1 * time.Second)
-
-	for {
-		select {
-		case status := <-statusChanges:
-			if status == StatusHealthy || status == StatusStarting {
-				gotHealthy = true
-			}
-			if status == StatusStale {
-				gotStale = true
-			}
-			if gotHealthy && gotStale {
-				return // Test passed
-			}
-		case <-timeout:
-			s.T().Fatalf("Expected StatusStale after max connection age exceeded. gotHealthy=%v, gotStale=%v",
-				gotHealthy, gotStale)
-		}
-	}
-}
-
-// TestIdleTimeDetection tests that connections with passing health checks are NOT marked as stale
-// This verifies that successful health checks update LastActivity, preventing false idle detection
-func (s *HealthCheckTestSuite) TestIdleTimeDetection() {
-	statusChanges := make(chan Status, 10)
-	callback := func(forwardID string, status Status, errorMsg string) {
-		statusChanges <- status
-	}
-
-	// Create checker with very short max idle time
-	checker := NewCheckerWithOptions(CheckerOptions{
-		Interval:         50 * time.Millisecond,
-		Timeout:          25 * time.Millisecond,
-		Method:           CheckMethodTCPDial,
-		MaxConnectionAge: 0,                      // Disable age detection
-		MaxIdleTime:      150 * time.Millisecond, // Very short for testing
-	})
-	defer checker.Stop()
-
-	checker.Register("test-forward", s.port, callback)
-
-	// Wait long enough that idle time WOULD be exceeded if health checks didn't update LastActivity
-	time.Sleep(500 * time.Millisecond)
-
-	// Verify connection is still healthy, not stale
-	// This proves that successful health checks are updating LastActivity
-	status, exists := checker.GetStatus("test-forward")
-	require.True(s.T(), exists)
-	assert.Equal(s.T(), StatusHealthy, status, "Connection with passing health checks should NOT be marked as stale")
-
-	// Verify we never received a StatusStale callback
-	select {
-	case status := <-statusChanges:
-		if status == StatusStale {
-			s.T().Fatal("Connection should NOT be marked as stale when health checks are passing")
-		}
-	default:
-		// No stale status - this is correct
-	}
-}
-
-// TestMarkConnected tests that MarkConnected resets connection time
-func (s *HealthCheckTestSuite) TestMarkConnected() {
-	checker := NewCheckerWithOptions(CheckerOptions{
-		Interval:         50 * time.Millisecond,
-		Timeout:          25 * time.Millisecond,
-		Method:           CheckMethodTCPDial,
-		MaxConnectionAge: 200 * time.Millisecond,
-		MaxIdleTime:      0,
-	})
-	defer checker.Stop()
-
-	statusChanges := make(chan Status, 10)
-	callback := func(forwardID string, status Status, errorMsg string) {
-		statusChanges <- status
-	}
-
-	checker.Register("test-forward", s.port, callback)
-
-	// Wait a bit
-	time.Sleep(100 * time.Millisecond)
-
-	// Mark as reconnected (resets connection time)
-	checker.MarkConnected("test-forward")
-
-	// Wait for connection age to exceed (relative to first connection time)
-	time.Sleep(200 * time.Millisecond)
-
-	// Check status - should still be healthy because we reset connection time
-	status, exists := checker.GetStatus("test-forward")
-	assert.True(s.T(), exists)
-	// Note: Might be StatusStale by now, but the key is that MarkConnected delayed it
-	// This is a timing-sensitive test, so we just verify the functionality exists
-	_ = status
-}
-
-// TestRecordActivity tests that RecordActivity resets idle time
-func (s *HealthCheckTestSuite) TestRecordActivity() {
-	checker := NewCheckerWithOptions(CheckerOptions{
-		Interval:         50 * time.Millisecond,
-		Timeout:          25 * time.Millisecond,
-		Method:           CheckMethodTCPDial,
-		MaxConnectionAge: 0,
-		MaxIdleTime:      200 * time.Millisecond,
-	})
-	defer checker.Stop()
-
-	statusChanges := make(chan Status, 10)
-	callback := func(forwardID string, status Status, errorMsg string) {
-		statusChanges <- status
-	}
-
-	checker.Register("test-forward", s.port, callback)
-
-	// Periodically record activity to prevent idle detection
-	ticker := time.NewTicker(80 * time.Millisecond)
-	defer ticker.Stop()
-
-	go func() {
-		for i := 0; i < 5; i++ {
-			<-ticker.C
-			checker.RecordActivity("test-forward")
-		}
-	}()
-
-	// Wait longer than idle timeout
-	time.Sleep(500 * time.Millisecond)
-
-	// Should still be healthy due to activity
-	status, exists := checker.GetStatus("test-forward")
-	assert.True(s.T(), exists)
-	// May transition to stale eventually, but activity recording should have delayed it
-	_ = status
-}
-
-// TestMarkReconnecting tests the MarkReconnecting functionality
-func (s *HealthCheckTestSuite) TestMarkReconnecting() {
-	statusChanges := make(chan Status, 10)
-	callback := func(forwardID string, status Status, errorMsg string) {
-		statusChanges <- status
-	}
-
-	s.checker.Register("test-forward", s.port, callback)
-
-	// Wait for initial status
-	time.Sleep(150 * time.Millisecond)
-
-	// Mark as reconnecting
-	s.checker.MarkReconnecting("test-forward")
-
-	// Should receive reconnecting status
-	timeout := time.After(500 * time.Millisecond)
-	gotReconnect := false
-	for !gotReconnect {
-		select {
-		case status := <-statusChanges:
-			if status == StatusReconnect {
-				gotReconnect = true
-			}
-		case <-timeout:
-			s.T().Fatal("Expected StatusReconnect")
-		}
-	}
-}
-
-// TestStartingGracePeriod tests that errors during grace period show as "Starting"
-func (s *HealthCheckTestSuite) TestStartingGracePeriod() {
-	// Use a port that's not listening
-	unavailablePort := 54323
-
-	checker := NewCheckerWithOptions(CheckerOptions{
-		Interval:         50 * time.Millisecond,
-		Timeout:          25 * time.Millisecond,
-		Method:           CheckMethodTCPDial,
-		MaxConnectionAge: 0,
-		MaxIdleTime:      0,
-	})
-	defer checker.Stop()
-
-	// Register without callback - we'll check status directly
-	checker.Register("test-forward", unavailablePort, nil)
-
-	// Immediately check status - should be Starting or not yet checked
-	status, exists := checker.GetStatus("test-forward")
-	assert.True(s.T(), exists)
-	// Initially should be Starting
-	assert.Equal(s.T(), StatusStarting, status)
-
-	// Wait for grace period to expire
-	time.Sleep(startupGracePeriod + 200*time.Millisecond)
-
-	// Now should be Unhealthy
-	status, exists = checker.GetStatus("test-forward")
-	assert.True(s.T(), exists)
-	assert.Equal(s.T(), StatusUnhealthy, status)
-}
-
-// TestGetAllErrors tests retrieving all error messages
-func (s *HealthCheckTestSuite) TestGetAllErrors() {
-	// Create a new checker with faster intervals for this test
-	checker := NewCheckerWithOptions(CheckerOptions{
-		Interval:         100 * time.Millisecond,
-		Timeout:          50 * time.Millisecond,
-		Method:           CheckMethodTCPDial,
-		MaxConnectionAge: 0,
-		MaxIdleTime:      0,
-	})
-	defer checker.Stop()
-
-	// Register multiple forwards
-	checker.Register("forward1", s.port, nil)
-	checker.Register("forward2", 54324, nil) // Unavailable port
-
-	// Wait for grace period to expire
-	time.Sleep(startupGracePeriod + 300*time.Millisecond)
-
-	errors := checker.GetAllErrors()
-
-	// forward2 should have an error
-	_, hasError := errors["forward2"]
-	assert.True(s.T(), hasError, "forward2 should have an error")
-
-	// forward1 should not have an error
-	_, hasError = errors["forward1"]
-	assert.False(s.T(), hasError, "forward1 should not have an error")
-}
-
-// TestConcurrentOperations tests thread safety
-func (s *HealthCheckTestSuite) TestConcurrentOperations() {
-	var wg sync.WaitGroup
-	numGoroutines := 10
-
-	for i := 0; i < numGoroutines; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			forwardID := fmt.Sprintf("forward-%d", id)
-			s.checker.Register(forwardID, s.port, nil)
-			time.Sleep(50 * time.Millisecond)
-			s.checker.MarkConnected(forwardID)
-			s.checker.RecordActivity(forwardID)
-			status, _ := s.checker.GetStatus(forwardID)
-			_ = status
-			s.checker.Unregister(forwardID)
-		}(i)
-	}
-
-	wg.Wait()
-	// If we get here without deadlocks or panics, test passes
-}
-
-// TestDefaultOptions tests that NewChecker uses sensible defaults
-func TestDefaultOptions(t *testing.T) {
-	checker := NewChecker(5*time.Second, 2*time.Second)
-	defer checker.Stop()
-
-	assert.Equal(t, 5*time.Second, checker.interval)
-	assert.Equal(t, 2*time.Second, checker.timeout)
-	assert.Equal(t, CheckMethodDataTransfer, checker.method)
-	assert.Equal(t, 25*time.Minute, checker.maxConnectionAge)
-	assert.Equal(t, 10*time.Minute, checker.maxIdleTime)
-}
-
-// TestCustomOptions tests NewCheckerWithOptions
-func TestCustomOptions(t *testing.T) {
-	opts := CheckerOptions{
-		Interval:         1 * time.Second,
-		Timeout:          500 * time.Millisecond,
-		Method:           CheckMethodTCPDial,
-		MaxConnectionAge: 5 * time.Minute,
-		MaxIdleTime:      2 * time.Minute,
-	}
-
-	checker := NewCheckerWithOptions(opts)
-	defer checker.Stop()
-
-	assert.Equal(t, 1*time.Second, checker.interval)
-	assert.Equal(t, 500*time.Millisecond, checker.timeout)
-	assert.Equal(t, CheckMethodTCPDial, checker.method)
-	assert.Equal(t, 5*time.Minute, checker.maxConnectionAge)
-	assert.Equal(t, 2*time.Minute, checker.maxIdleTime)
-}

internal/httplog/benchmark_test.go

@@ -1,270 +0,0 @@
-package httplog
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"testing"
-)
-
-// BenchmarkLoggerLog benchmarks the Log function with sync.Pool
-func BenchmarkLoggerLog(b *testing.B) {
-	l := &Logger{
-		forwardID:  "benchmark",
-		maxBodyLen: 1024,
-		output:     io.Discard,
-	}
-
-	entry := Entry{
-		Direction:  "request",
-		RequestID:  "req-123",
-		Method:     "POST",
-		Path:       "/api/users",
-		BodySize:   256,
-		Body:       `{"name":"test user","email":"test@example.com","data":"some payload data here"}`,
-		StatusCode: 200,
-		LatencyMs:  42,
-	}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_ = l.Log(entry)
-	}
-}
-
-// BenchmarkLoggerLogNoPool simulates logging without sync.Pool
-func BenchmarkLoggerLogNoPool(b *testing.B) {
-	l := &Logger{
-		forwardID:  "benchmark",
-		maxBodyLen: 1024,
-		output:     io.Discard,
-	}
-
-	entry := Entry{
-		Direction:  "request",
-		RequestID:  "req-123",
-		Method:     "POST",
-		Path:       "/api/users",
-		BodySize:   256,
-		Body:       `{"name":"test user","email":"test@example.com","data":"some payload data here"}`,
-		StatusCode: 200,
-		LatencyMs:  42,
-	}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		// Simulate old behavior: allocate new buffer each time
-		data, _ := json.Marshal(entry)
-		_, _ = l.output.Write(append(data, '\n'))
-	}
-}
-
-// BenchmarkReadBodyLimited benchmarks reading body with sync.Pool
-func BenchmarkReadBodyLimited(b *testing.B) {
-	bodyData := bytes.Repeat([]byte("a"), 1024)
-	transport := &loggingTransport{}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		// Create a new ReadCloser for each iteration
-		body := io.NopCloser(bytes.NewReader(bodyData))
-		_, _ = transport.readBodyLimited(body, 2048)
-	}
-}
-
-// BenchmarkReadBodyLimitedSmall benchmarks with small bodies (typical API requests)
-func BenchmarkReadBodyLimitedSmall(b *testing.B) {
-	bodyData := []byte(`{"id":123,"name":"test","active":true}`)
-	transport := &loggingTransport{}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		body := io.NopCloser(bytes.NewReader(bodyData))
-		_, _ = transport.readBodyLimited(body, 1024)
-	}
-}
-
-// BenchmarkReadBodyLimitedLarge benchmarks with large bodies
-func BenchmarkReadBodyLimitedLarge(b *testing.B) {
-	bodyData := bytes.Repeat([]byte("x"), 65536) // 64KB
-	transport := &loggingTransport{}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		body := io.NopCloser(bytes.NewReader(bodyData))
-		_, _ = transport.readBodyLimited(body, 65536)
-	}
-}
-
-// BenchmarkBufferPoolGetPut benchmarks the buffer pool itself
-func BenchmarkBufferPoolGetPut(b *testing.B) {
-	b.RunParallel(func(pb *testing.PB) {
-		for pb.Next() {
-			bufPtr := bufferPool.Get().(*[]byte)
-			// Reset and use the buffer to simulate real usage
-			*bufPtr = (*bufPtr)[:0]
-			*bufPtr = append(*bufPtr, "test data..."...)
-			bufferPool.Put(bufPtr)
-		}
-	})
-}
-
-// BenchmarkLogBufferPoolGetPut benchmarks the log buffer pool
-func BenchmarkLogBufferPoolGetPut(b *testing.B) {
-	b.RunParallel(func(pb *testing.PB) {
-		for pb.Next() {
-			buf := logBufferPool.Get().(*bytes.Buffer)
-			buf.Reset()
-			buf.WriteString("test log entry")
-			logBufferPool.Put(buf)
-		}
-	})
-}
-
-// BenchmarkFlattenHeaders benchmarks header flattening with pooling
-func BenchmarkFlattenHeaders(b *testing.B) {
-	headers := http.Header{
-		"Content-Type": []string{"application/json"},
-		"Accept":       []string{"text/html", "application/json"},
-		"User-Agent":   []string{"test-client/1.0"},
-		"X-Request-ID": []string{"abc-123-def"},
-	}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_ = flattenHeaders(headers)
-	}
-}
-
-// BenchmarkTruncateBody benchmarks body truncation with pooled buffers
-func BenchmarkTruncateBody(b *testing.B) {
-	body := "this is a very long body that should be truncated for logging purposes"
-	maxLen := 20
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_ = truncateBody(body, maxLen)
-	}
-}
-
-// BenchmarkTruncateBodyNoPool simulates truncation without pooling
-func BenchmarkTruncateBodyNoPool(b *testing.B) {
-	body := "this is a very long body that should be truncated for logging purposes"
-	maxLen := 20
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if len(body) > maxLen {
-			_ = body[:maxLen] + "...(truncated)"
-		}
-	}
-}
-
-// BenchmarkLoggerLogWithTruncation benchmarks logging with body truncation
-func BenchmarkLoggerLogWithTruncation(b *testing.B) {
-	l := &Logger{
-		forwardID:  "benchmark",
-		maxBodyLen: 50,
-		output:     io.Discard,
-	}
-
-	entry := Entry{
-		Direction: "request",
-		RequestID: "req-123",
-		Method:    "POST",
-		Path:      "/api/users",
-		Body:      `{"name":"test user","email":"test@example.com","data":"some payload data here for truncation"}`,
-		BodySize:  100,
-	}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_ = l.Log(entry)
-	}
-}
-
-// BenchmarkReadBufferPool benchmarks the read buffer pool
-func BenchmarkReadBufferPool(b *testing.B) {
-	b.RunParallel(func(pb *testing.PB) {
-		for pb.Next() {
-			bufPtr := readBufferPool.Get().(*[]byte)
-			buf := *bufPtr
-			_ = len(buf) // Use the buffer
-			readBufferPool.Put(bufPtr)
-		}
-	})
-}
-
-// BenchmarkReadBodyLimitedParallel benchmarks body reading under concurrent load
-func BenchmarkReadBodyLimitedParallel(b *testing.B) {
-	bodyData := bytes.Repeat([]byte("x"), 4096)
-	transport := &loggingTransport{}
-
-	b.RunParallel(func(pb *testing.PB) {
-		for pb.Next() {
-			body := io.NopCloser(bytes.NewReader(bodyData))
-			_, _ = transport.readBodyLimited(body, 8192)
-		}
-	})
-}
-
-// BenchmarkLoggerLogParallel benchmarks logging under concurrent load
-func BenchmarkLoggerLogParallel(b *testing.B) {
-	l := &Logger{
-		forwardID:  "benchmark",
-		maxBodyLen: 1024,
-		output:     io.Discard,
-	}
-
-	entry := Entry{
-		Direction: "request",
-		RequestID: "req-123",
-		Method:    "POST",
-		Path:      "/api/users",
-		Body:      `{"name":"test user"}`,
-		BodySize:  100,
-	}
-
-	b.RunParallel(func(pb *testing.PB) {
-		for pb.Next() {
-			_ = l.Log(entry)
-		}
-	})
-}
-
-// BenchmarkCompleteFlow benchmarks the complete logging flow
-func BenchmarkCompleteFlow(b *testing.B) {
-	l := &Logger{
-		forwardID:  "benchmark",
-		maxBodyLen: 1024,
-		output:     io.Discard,
-	}
-
-	headers := http.Header{
-		"Content-Type": []string{"application/json"},
-		"Accept":       []string{"application/json"},
-	}
-
-	bodyData := []byte(`{"id":123,"name":"test"}`)
-	transport := &loggingTransport{}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		// Simulate full request logging flow
-		entry := Entry{
-			Direction: "request",
-			RequestID: "req-123",
-			Method:    "POST",
-			Path:      "/api/users",
-			Headers:   flattenHeaders(headers),
-			BodySize:  len(bodyData),
-			Body:      string(bodyData),
-		}
-		_ = l.Log(entry)
-
-		// Simulate body reading
-		body := io.NopCloser(bytes.NewReader(bodyData))
-		_, _ = transport.readBodyLimited(body, 2048)
-	}
-}

internal/httplog/logger.go

@@ -1,171 +0,0 @@
-// Package httplog provides HTTP request/response logging for port forwards.
-// It captures HTTP traffic passing through the forward proxy and stores
-// entries for viewing in the UI.
-//
-// The logger supports:
-//   - Request and response capture with headers and bodies
-//   - Configurable body size limits to prevent memory issues
-//   - Callback-based notifications for real-time log viewing
-//   - Thread-safe operation for concurrent forwards
-//
-// Bodies are truncated if they exceed the configured maximum size
-// (default: 1MB) and marked as truncated in the log entry.
-package httplog
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"os"
-	"sync"
-	"time"
-)
-
-// logBufferPool is used to reuse byte buffers for JSON encoding.
-// This reduces allocations when serializing log entries.
-var logBufferPool = sync.Pool{
-	New: func() interface{} {
-		return bytes.NewBuffer(make([]byte, 0, 4096))
-	},
-}
-
-// Entry represents a single HTTP log entry
-type Entry struct {
-	Timestamp  time.Time         `json:"timestamp"`
-	Headers    map[string]string `json:"headers,omitempty"`
-	ForwardID  string            `json:"forward_id"`
-	RequestID  string            `json:"request_id"`
-	Direction  string            `json:"direction"`
-	Method     string            `json:"method,omitempty"`
-	Path       string            `json:"path,omitempty"`
-	Body       string            `json:"body,omitempty"`
-	Error      string            `json:"error,omitempty"`
-	StatusCode int               `json:"status_code,omitempty"`
-	BodySize   int               `json:"body_size"`
-	LatencyMs  int64             `json:"latency_ms,omitempty"`
-}
-
-// LogCallback is a function that receives log entries
-type LogCallback func(entry Entry)
-
-// Logger writes HTTP log entries to an output stream
-type Logger struct {
-	output     io.Writer
-	file       *os.File
-	forwardID  string
-	callbacks  []LogCallback
-	maxBodyLen int
-	mu         sync.Mutex
-}
-
-// NewLogger creates a new HTTP logger
-// If logFile is empty, logs only go to registered callbacks (no file output)
-// This prevents stdout corruption when running in TUI mode
-func NewLogger(forwardID, logFile string, maxBodyLen int) (*Logger, error) {
-	l := &Logger{
-		forwardID:  forwardID,
-		maxBodyLen: maxBodyLen,
-	}
-
-	if logFile == "" {
-		// Don't write to stdout - use io.Discard
-		// Log entries are delivered via callbacks to the UI
-		l.output = io.Discard
-	} else {
-		// #nosec G304 -- logFile is from config validation, not arbitrary user input
-		f, err := os.OpenFile(logFile, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
-		if err != nil {
-			return nil, err
-		}
-		l.file = f
-		l.output = f
-	}
-
-	return l, nil
-}
-
-// AddCallback registers a callback to receive log entries
-func (l *Logger) AddCallback(cb LogCallback) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	l.callbacks = append(l.callbacks, cb)
-}
-
-// ClearCallbacks removes all registered callbacks
-func (l *Logger) ClearCallbacks() {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	l.callbacks = nil
-}
-
-// stringBuilderPool provides reusable string builders for body truncation.
-// This reduces allocations when building truncated body strings.
-var stringBuilderPool = sync.Pool{
-	New: func() interface{} {
-		return &bytes.Buffer{}
-	},
-}
-
-// truncateBody truncates a body string to maxLen, adding a suffix if truncated.
-// Uses a pooled buffer to avoid allocations during truncation.
-func truncateBody(body string, maxLen int) string {
-	if len(body) <= maxLen {
-		return body
-	}
-
-	// Use pooled buffer for truncation
-	buf := stringBuilderPool.Get().(*bytes.Buffer)
-	buf.Reset()
-	defer stringBuilderPool.Put(buf)
-
-	// Write truncated content
-	buf.WriteString(body[:maxLen])
-	buf.WriteString("...(truncated)")
-	return buf.String()
-}
-
-// Log writes a log entry as JSON using a pooled buffer to reduce allocations.
-func (l *Logger) Log(entry Entry) error {
-	entry.ForwardID = l.forwardID
-	entry.Timestamp = time.Now()
-
-	// Truncate body if too large using pooled buffer
-	if len(entry.Body) > l.maxBodyLen {
-		entry.Body = truncateBody(entry.Body, l.maxBodyLen)
-	}
-
-	// Get a buffer from the pool
-	buf := logBufferPool.Get().(*bytes.Buffer)
-	buf.Reset() // Clear any previous content
-	defer logBufferPool.Put(buf)
-
-	// Encode JSON directly into the pooled buffer
-	encoder := json.NewEncoder(buf)
-	if err := encoder.Encode(entry); err != nil {
-		return err
-	}
-
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	// Notify callbacks
-	for _, cb := range l.callbacks {
-		cb(entry)
-	}
-
-	_, err := l.output.Write(buf.Bytes())
-	return err
-}
-
-// Close closes the logger
-func (l *Logger) Close() error {
-	if l.file != nil {
-		return l.file.Close()
-	}
-	return nil
-}
-
-// GetMaxBodyLen returns the maximum body length for logging
-func (l *Logger) GetMaxBodyLen() int {
-	return l.maxBodyLen
-}

internal/httplog/logger_test.go

@@ -1,389 +0,0 @@
-package httplog
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestNewLogger_OutputModes tests different output configurations
-func TestNewLogger_OutputModes(t *testing.T) {
-	t.Run("empty logFile uses io.Discard", func(t *testing.T) {
-		l, err := NewLogger("test-forward", "", 1024)
-		require.NoError(t, err)
-		defer func() { _ = l.Close() }()
-
-		assert.Nil(t, l.file)
-		assert.Equal(t, io.Discard, l.output)
-		assert.Equal(t, "test-forward", l.forwardID)
-		assert.Equal(t, 1024, l.maxBodyLen)
-	})
-
-	t.Run("file logger creates file", func(t *testing.T) {
-		tmpDir := t.TempDir()
-		logFile := filepath.Join(tmpDir, "http.log")
-
-		l, err := NewLogger("test-forward", logFile, 2048)
-		require.NoError(t, err)
-		defer func() { _ = l.Close() }()
-
-		assert.NotNil(t, l.file)
-		assert.NotEqual(t, io.Discard, l.output)
-		assert.Equal(t, 2048, l.maxBodyLen)
-
-		// File should exist
-		_, err = os.Stat(logFile)
-		assert.NoError(t, err)
-	})
-
-	t.Run("file logger appends to existing file", func(t *testing.T) {
-		tmpDir := t.TempDir()
-		logFile := filepath.Join(tmpDir, "http.log")
-
-		// Create file with existing content
-		err := os.WriteFile(logFile, []byte("existing\n"), 0600)
-		require.NoError(t, err)
-
-		l, err := NewLogger("test-forward", logFile, 1024)
-		require.NoError(t, err)
-
-		err = l.Log(Entry{Direction: "request"})
-		require.NoError(t, err)
-		_ = l.Close()
-
-		// File should have both contents
-		data, _ := os.ReadFile(logFile)
-		assert.True(t, strings.HasPrefix(string(data), "existing\n"))
-		assert.Contains(t, string(data), "direction")
-	})
-
-	t.Run("invalid path returns error", func(t *testing.T) {
-		_, err := NewLogger("test", "/nonexistent/path/file.log", 1024)
-		assert.Error(t, err)
-	})
-}
-
-// TestLogger_Log tests basic logging functionality
-func TestLogger_Log(t *testing.T) {
-	var buf bytes.Buffer
-	l := &Logger{
-		forwardID:  "fwd-123",
-		maxBodyLen: 100,
-		output:     &buf,
-	}
-
-	err := l.Log(Entry{
-		Direction: "request",
-		RequestID: "req-1",
-		Method:    "POST",
-		Path:      "/api/users",
-		BodySize:  42,
-		Body:      `{"name":"test"}`,
-	})
-	require.NoError(t, err)
-
-	// Parse output
-	var entry Entry
-	err = json.Unmarshal(buf.Bytes(), &entry)
-	require.NoError(t, err)
-
-	assert.Equal(t, "fwd-123", entry.ForwardID)
-	assert.Equal(t, "request", entry.Direction)
-	assert.Equal(t, "req-1", entry.RequestID)
-	assert.Equal(t, "POST", entry.Method)
-	assert.Equal(t, "/api/users", entry.Path)
-	assert.Equal(t, 42, entry.BodySize)
-	assert.Equal(t, `{"name":"test"}`, entry.Body)
-	assert.False(t, entry.Timestamp.IsZero())
-}
-
-// TestLogger_Log_Response tests response logging
-func TestLogger_Log_Response(t *testing.T) {
-	var buf bytes.Buffer
-	l := &Logger{
-		forwardID:  "fwd-123",
-		maxBodyLen: 1000,
-		output:     &buf,
-	}
-
-	err := l.Log(Entry{
-		Direction:  "response",
-		RequestID:  "req-1",
-		Method:     "GET",
-		Path:       "/api/status",
-		StatusCode: 200,
-		LatencyMs:  125,
-		Headers:    map[string]string{"Content-Type": "application/json"},
-	})
-	require.NoError(t, err)
-
-	var entry Entry
-	err = json.Unmarshal(buf.Bytes(), &entry)
-	require.NoError(t, err)
-
-	assert.Equal(t, "response", entry.Direction)
-	assert.Equal(t, 200, entry.StatusCode)
-	assert.Equal(t, int64(125), entry.LatencyMs)
-	assert.Equal(t, "application/json", entry.Headers["Content-Type"])
-}
-
-// TestLogger_Log_Error tests error logging
-func TestLogger_Log_Error(t *testing.T) {
-	var buf bytes.Buffer
-	l := &Logger{
-		forwardID:  "fwd-123",
-		maxBodyLen: 100,
-		output:     &buf,
-	}
-
-	err := l.Log(Entry{
-		Direction: "error",
-		RequestID: "req-1",
-		Method:    "GET",
-		Path:      "/api/fail",
-		Error:     "connection refused",
-	})
-	require.NoError(t, err)
-
-	var entry Entry
-	err = json.Unmarshal(buf.Bytes(), &entry)
-	require.NoError(t, err)
-
-	assert.Equal(t, "error", entry.Direction)
-	assert.Equal(t, "connection refused", entry.Error)
-}
-
-// TestLogger_BodyTruncation tests body size limiting
-func TestLogger_BodyTruncation(t *testing.T) {
-	tests := []struct {
-		name        string
-		body        string
-		maxBodyLen  int
-		expectTrunc bool
-	}{
-		{name: "body under limit", maxBodyLen: 100, body: "short", expectTrunc: false},
-		{name: "body at limit", maxBodyLen: 5, body: "exact", expectTrunc: false},
-		{name: "body over limit", maxBodyLen: 5, body: "this is too long", expectTrunc: true},
-		{name: "empty body", maxBodyLen: 100, body: "", expectTrunc: false},
-		{name: "zero max", maxBodyLen: 0, body: "any", expectTrunc: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var buf bytes.Buffer
-			l := &Logger{
-				forwardID:  "test",
-				maxBodyLen: tt.maxBodyLen,
-				output:     &buf,
-			}
-
-			_ = l.Log(Entry{Body: tt.body})
-
-			var entry Entry
-			_ = json.Unmarshal(buf.Bytes(), &entry)
-
-			if tt.expectTrunc {
-				assert.Contains(t, entry.Body, "...(truncated)")
-			} else {
-				assert.NotContains(t, entry.Body, "truncated")
-			}
-		})
-	}
-}
-
-// TestLogger_Callbacks tests callback registration and invocation
-func TestLogger_Callbacks(t *testing.T) {
-	l := &Logger{
-		forwardID:  "test",
-		maxBodyLen: 100,
-		output:     io.Discard,
-	}
-
-	var received []Entry
-	var mu sync.Mutex
-
-	// Add callback
-	l.AddCallback(func(entry Entry) {
-		mu.Lock()
-		received = append(received, entry)
-		mu.Unlock()
-	})
-
-	// Log entries
-	_ = l.Log(Entry{Direction: "request", Path: "/api/1"})
-	_ = l.Log(Entry{Direction: "response", Path: "/api/1"})
-	_ = l.Log(Entry{Direction: "request", Path: "/api/2"})
-
-	mu.Lock()
-	assert.Len(t, received, 3)
-	assert.Equal(t, "/api/1", received[0].Path)
-	assert.Equal(t, "response", received[1].Direction)
-	mu.Unlock()
-}
-
-// TestLogger_MultipleCallbacks tests multiple callbacks
-func TestLogger_MultipleCallbacks(t *testing.T) {
-	l := &Logger{
-		forwardID:  "test",
-		maxBodyLen: 100,
-		output:     io.Discard,
-	}
-
-	count1 := 0
-	count2 := 0
-
-	l.AddCallback(func(entry Entry) { count1++ })
-	l.AddCallback(func(entry Entry) { count2++ })
-
-	_ = l.Log(Entry{})
-
-	assert.Equal(t, 1, count1)
-	assert.Equal(t, 1, count2)
-}
-
-// TestLogger_ClearCallbacks tests callback clearing
-func TestLogger_ClearCallbacks(t *testing.T) {
-	l := &Logger{
-		forwardID:  "test",
-		maxBodyLen: 100,
-		output:     io.Discard,
-	}
-
-	count := 0
-	l.AddCallback(func(entry Entry) { count++ })
-
-	_ = l.Log(Entry{})
-	assert.Equal(t, 1, count)
-
-	l.ClearCallbacks()
-
-	_ = l.Log(Entry{})
-	assert.Equal(t, 1, count) // Still 1 - callback was cleared
-}
-
-// TestLogger_GetMaxBodyLen tests the getter
-func TestLogger_GetMaxBodyLen(t *testing.T) {
-	l := &Logger{maxBodyLen: 4096}
-	assert.Equal(t, 4096, l.GetMaxBodyLen())
-}
-
-// TestLogger_Close tests closing
-func TestLogger_Close(t *testing.T) {
-	t.Run("close with no file", func(t *testing.T) {
-		l := &Logger{output: io.Discard}
-		err := l.Close()
-		assert.NoError(t, err)
-	})
-
-	t.Run("close with file", func(t *testing.T) {
-		tmpFile := filepath.Join(t.TempDir(), "test.log")
-		l, err := NewLogger("test", tmpFile, 100)
-		require.NoError(t, err)
-
-		err = l.Close()
-		assert.NoError(t, err)
-
-		// File should be closed (writing should fail or create new handle)
-		assert.NotNil(t, l.file) // reference still exists
-	})
-}
-
-// TestLogger_Concurrent tests thread safety
-func TestLogger_Concurrent(t *testing.T) {
-	var buf bytes.Buffer
-	l := &Logger{
-		forwardID:  "test",
-		maxBodyLen: 100,
-		output:     &buf,
-	}
-
-	// Add callback that accesses shared state
-	var callbackCount int
-	var mu sync.Mutex
-	l.AddCallback(func(entry Entry) {
-		mu.Lock()
-		callbackCount++
-		mu.Unlock()
-	})
-
-	// Concurrent writes
-	var wg sync.WaitGroup
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func(n int) {
-			defer wg.Done()
-			_ = l.Log(Entry{
-				Direction: "request",
-				Path:      "/api/" + string(rune('a'+n%26)),
-			})
-		}(i)
-	}
-	wg.Wait()
-
-	mu.Lock()
-	assert.Equal(t, 100, callbackCount)
-	mu.Unlock()
-}
-
-// TestEntry_Structure tests the Entry struct
-func TestEntry_Structure(t *testing.T) {
-	now := time.Now()
-	entry := Entry{
-		Timestamp:  now,
-		ForwardID:  "fwd-1",
-		RequestID:  "req-1",
-		Direction:  "request",
-		Method:     "DELETE",
-		Path:       "/api/items/123",
-		StatusCode: 204,
-		Headers:    map[string]string{"X-Custom": "value"},
-		BodySize:   0,
-		Body:       "",
-		LatencyMs:  50,
-		Error:      "",
-	}
-
-	// Verify all fields
-	assert.Equal(t, now, entry.Timestamp)
-	assert.Equal(t, "fwd-1", entry.ForwardID)
-	assert.Equal(t, "req-1", entry.RequestID)
-	assert.Equal(t, "request", entry.Direction)
-	assert.Equal(t, "DELETE", entry.Method)
-	assert.Equal(t, "/api/items/123", entry.Path)
-	assert.Equal(t, 204, entry.StatusCode)
-	assert.Equal(t, "value", entry.Headers["X-Custom"])
-	assert.Equal(t, 0, entry.BodySize)
-	assert.Empty(t, entry.Body)
-	assert.Equal(t, int64(50), entry.LatencyMs)
-	assert.Empty(t, entry.Error)
-}
-
-// TestEntry_JSONMarshaling tests JSON serialization
-func TestEntry_JSONMarshaling(t *testing.T) {
-	entry := Entry{
-		Direction:  "response",
-		Method:     "GET",
-		Path:       "/test",
-		StatusCode: 200,
-		LatencyMs:  100,
-	}
-
-	data, err := json.Marshal(entry)
-	require.NoError(t, err)
-
-	var parsed Entry
-	err = json.Unmarshal(data, &parsed)
-	require.NoError(t, err)
-
-	assert.Equal(t, entry.Direction, parsed.Direction)
-	assert.Equal(t, entry.StatusCode, parsed.StatusCode)
-}

internal/httplog/proxy.go

@@ -1,419 +0,0 @@
-package httplog
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httputil"
-	"path/filepath"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/lukaszraczylo/kportal/internal/logger"
-)
-
-// bufferPool is used to reuse byte buffers for body reading.
-// This significantly reduces GC pressure under high load.
-// Using *([]byte) to avoid allocations when storing/retrieving from pool (SA6002).
-var bufferPool = sync.Pool{
-	New: func() interface{} {
-		buf := make([]byte, 0, 8192) // Start with 8KB capacity
-		return &buf
-	},
-}
-
-// readBufferPool provides fixed-size buffers for io.Reader operations.
-// Using a pool eliminates per-read allocations of temporary buffers.
-var readBufferPool = sync.Pool{
-	New: func() interface{} {
-		buf := make([]byte, 4096) // 4KB fixed-size read buffer
-		return &buf
-	},
-}
-
-// Proxy is an HTTP reverse proxy with logging capabilities
-type Proxy struct {
-	listener     net.Listener
-	logger       *Logger
-	server       *http.Server
-	forwardID    string
-	filterPath   string
-	localPort    int
-	targetPort   int
-	requestCount uint64
-	mu           sync.Mutex
-	includeHdrs  bool
-	running      bool
-}
-
-// NewProxy creates a new HTTP logging proxy
-func NewProxy(fwd *config.Forward, targetPort int) (*Proxy, error) {
-	httpCfg := fwd.HTTPLog
-	if httpCfg == nil {
-		return nil, fmt.Errorf("HTTP log config is nil")
-	}
-
-	logger, err := NewLogger(fwd.ID(), httpCfg.LogFile, fwd.GetHTTPLogMaxBodySize())
-	if err != nil {
-		return nil, fmt.Errorf("failed to create logger: %w", err)
-	}
-
-	return &Proxy{
-		localPort:   fwd.LocalPort,
-		targetPort:  targetPort,
-		logger:      logger,
-		forwardID:   fwd.ID(),
-		filterPath:  httpCfg.FilterPath,
-		includeHdrs: httpCfg.IncludeHeaders,
-	}, nil
-}
-
-// Start starts the HTTP proxy server
-func (p *Proxy) Start() error {
-	p.mu.Lock()
-	if p.running {
-		p.mu.Unlock()
-		return fmt.Errorf("proxy already running")
-	}
-
-	// Create listener
-	ln, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", p.localPort))
-	if err != nil {
-		p.mu.Unlock()
-		return fmt.Errorf("failed to listen on port %d: %w", p.localPort, err)
-	}
-	p.listener = ln
-
-	// Create reverse proxy
-	director := func(req *http.Request) {
-		req.URL.Scheme = "http"
-		req.URL.Host = fmt.Sprintf("127.0.0.1:%d", p.targetPort)
-	}
-
-	proxy := &httputil.ReverseProxy{
-		Director: director,
-		Transport: &loggingTransport{
-			proxy:     p,
-			transport: http.DefaultTransport,
-		},
-		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
-			p.logError(r, err)
-			w.WriteHeader(http.StatusBadGateway)
-			_, _ = w.Write([]byte("Proxy error: " + err.Error()))
-		},
-	}
-
-	p.server = &http.Server{
-		Handler:           proxy,
-		ReadHeaderTimeout: 10 * time.Second,
-	}
-
-	p.running = true
-	p.mu.Unlock()
-
-	// Start serving (blocking)
-	go func() {
-		if err := p.server.Serve(ln); err != nil && err != http.ErrServerClosed {
-			logger.Debug("HTTP proxy serve error (will be replaced on reconnect)", map[string]any{"error": err.Error()})
-		}
-	}()
-
-	return nil
-}
-
-// Stop stops the HTTP proxy server
-func (p *Proxy) Stop() error {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	if !p.running {
-		return nil
-	}
-
-	p.running = false
-
-	// Shutdown with timeout
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	if err := p.server.Shutdown(ctx); err != nil {
-		// Force close - error ignored as we're already shutting down
-		_ = p.server.Close()
-	}
-
-	if err := p.logger.Close(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// loggingTransport wraps http.RoundTripper to log requests and responses
-type loggingTransport struct {
-	proxy     *Proxy
-	transport http.RoundTripper
-}
-
-func (t *loggingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	// Generate request ID
-	reqID := fmt.Sprintf("%d", atomic.AddUint64(&t.proxy.requestCount, 1))
-
-	// Check if we should log this request based on path filter
-	if !t.proxy.shouldLog(req.URL.Path) {
-		return t.transport.RoundTrip(req)
-	}
-
-	startTime := time.Now()
-	maxBodySize := t.proxy.logger.GetMaxBodyLen()
-
-	// Read request body with size limit to prevent memory exhaustion
-	var reqBody []byte
-	var reqBodySize int
-	if req.Body != nil {
-		reqBody, reqBodySize = t.readBodyLimited(req.Body, maxBodySize)
-		req.Body = io.NopCloser(bytes.NewBuffer(reqBody))
-	}
-
-	// Log request
-	reqEntry := Entry{
-		RequestID: reqID,
-		Direction: "request",
-		Method:    req.Method,
-		Path:      req.URL.Path,
-		BodySize:  reqBodySize,
-		Body:      string(reqBody),
-	}
-
-	if t.proxy.includeHdrs {
-		reqEntry.Headers = flattenHeaders(req.Header)
-	}
-
-	_ = t.proxy.logger.Log(reqEntry)
-
-	// Make the request
-	resp, err := t.transport.RoundTrip(req)
-	if err != nil {
-		return nil, err
-	}
-
-	// Read response body with size limit to prevent memory exhaustion
-	var respBody []byte
-	var respBodySize int
-	if resp.Body != nil {
-		respBody, respBodySize = t.readBodyLimited(resp.Body, maxBodySize)
-		resp.Body = io.NopCloser(bytes.NewBuffer(respBody))
-	}
-
-	latency := time.Since(startTime)
-
-	// Log response
-	respEntry := Entry{
-		RequestID:  reqID,
-		Direction:  "response",
-		Method:     req.Method,
-		Path:       req.URL.Path,
-		StatusCode: resp.StatusCode,
-		BodySize:   respBodySize,
-		Body:       string(respBody),
-		LatencyMs:  latency.Milliseconds(),
-	}
-
-	if t.proxy.includeHdrs {
-		respEntry.Headers = flattenHeaders(resp.Header)
-	}
-
-	_ = t.proxy.logger.Log(respEntry)
-
-	return resp, nil
-}
-
-// readBodyLimited reads a body with a size limit to prevent memory exhaustion.
-// Returns the body content (up to maxSize bytes) and the actual content length.
-// If the body exceeds maxSize, it reads only maxSize bytes for logging but
-// consumes the entire body to get the true size for BodySize reporting.
-// Uses sync.Pool to reuse buffers and reduce allocations.
-func (t *loggingTransport) readBodyLimited(body io.ReadCloser, maxSize int) ([]byte, int) {
-	// Get a buffer from the pool for accumulating body content
-	bufPtr := bufferPool.Get().(*[]byte)
-	buf := *bufPtr
-	buf = buf[:0] // Reset length but keep capacity
-	defer bufferPool.Put(bufPtr)
-
-	// Get a pooled read buffer to eliminate per-read allocation
-	tmpPtr := readBufferPool.Get().(*[]byte)
-	tmp := *tmpPtr
-	defer readBufferPool.Put(tmpPtr)
-
-	// Read up to maxSize+1 to detect if there's more
-	limitedReader := io.LimitReader(body, int64(maxSize+1))
-
-	// Read into the pooled buffer
-	var totalRead int
-	for {
-		n, err := limitedReader.Read(tmp)
-		if n > 0 {
-			buf = append(buf, tmp[:n]...)
-			totalRead += n
-		}
-		if err != nil {
-			break
-		}
-	}
-
-	actualSize := len(buf)
-	wasTruncated := actualSize > maxSize
-
-	// If we read exactly maxSize+1, there might be more data
-	// Discard the rest but count the bytes for accurate BodySize
-	if wasTruncated {
-		// Count remaining bytes without storing them
-		remaining, _ := io.Copy(io.Discard, body)
-		actualSize = maxSize + int(remaining)
-		// Return a copy of just the maxSize bytes for logging
-		resultPtr := bufferPool.Get().(*[]byte)
-		result := *resultPtr
-		result = result[:maxSize]
-		copy(result, buf)
-		return result, actualSize
-	}
-
-	// For small results, allocate minimally. For larger results, use pooled buffer.
-	resultLen := len(buf)
-	var result []byte
-	if resultLen <= 4096 {
-		// Small body: allocate exact size to avoid holding large buffers
-		result = make([]byte, resultLen)
-		copy(result, buf)
-	} else {
-		// Larger body: try to use pooled buffer
-		resultPtr := bufferPool.Get().(*[]byte)
-		result = *resultPtr
-		if cap(result) >= resultLen {
-			result = result[:resultLen]
-			copy(result, buf)
-		} else {
-			// Pooled buffer too small, allocate new and don't return to pool
-			result = make([]byte, resultLen)
-			copy(result, buf)
-		}
-	}
-	return result, actualSize
-}
-
-// shouldLog checks if the request path matches the filter
-func (p *Proxy) shouldLog(path string) bool {
-	if p.filterPath == "" {
-		return true
-	}
-
-	matched, err := filepath.Match(p.filterPath, path)
-	if err != nil {
-		// Invalid pattern, log everything
-		return true
-	}
-
-	// Also try matching with ** for prefix patterns like /api/*
-	if !matched && strings.HasSuffix(p.filterPath, "/*") {
-		prefix := strings.TrimSuffix(p.filterPath, "/*")
-		matched = strings.HasPrefix(path, prefix)
-	}
-
-	return matched
-}
-
-// logError logs an error entry
-func (p *Proxy) logError(req *http.Request, err error) {
-	entry := Entry{
-		RequestID: fmt.Sprintf("%d", atomic.AddUint64(&p.requestCount, 1)),
-		Direction: "error",
-		Method:    req.Method,
-		Path:      req.URL.Path,
-		Error:     err.Error(),
-	}
-	_ = p.logger.Log(entry)
-}
-
-// redactedHeaderNames is the set of header names whose values are always
-// redacted before being captured into log entries. Comparison is
-// case-insensitive (canonical MIME header form is used as the key).
-//
-// Redaction is unconditional and on-by-default as a defense-in-depth measure:
-// these headers commonly carry bearer tokens, session cookies, API keys, or
-// other credentials that must never be persisted to disk or surfaced to the
-// UI. Users who genuinely need raw header capture should use a dedicated
-// packet-capture tool (e.g. tcpdump) instead.
-var redactedHeaderNames = map[string]struct{}{
-	"Authorization":       {},
-	"Proxy-Authorization": {},
-	"Cookie":              {},
-	"Set-Cookie":          {},
-	"X-Api-Key":           {},
-	"X-Auth-Token":        {},
-	"X-Csrf-Token":        {},
-	"X-Access-Token":      {},
-}
-
-// redactedHeaderSubstrings is a list of lowercase substrings that, when
-// found anywhere in a header name (case-insensitive), trigger redaction.
-// This catches custom or vendor-specific sensitive headers without needing
-// to enumerate every variant.
-var redactedHeaderSubstrings = []string{
-	"token",
-	"secret",
-	"password",
-	"apikey",
-}
-
-// redactedValue is the placeholder written in place of any sensitive header
-// value. The header name itself is preserved so operators can see which
-// sensitive headers were present without leaking their contents.
-const redactedValue = "[REDACTED]"
-
-// shouldRedactHeader reports whether the given header name should have its
-// value redacted before being recorded. The check is case-insensitive and
-// covers both the explicit name list and the substring patterns.
-func shouldRedactHeader(name string) bool {
-	if _, ok := redactedHeaderNames[http.CanonicalHeaderKey(name)]; ok {
-		return true
-	}
-	lower := strings.ToLower(name)
-	for _, sub := range redactedHeaderSubstrings {
-		if strings.Contains(lower, sub) {
-			return true
-		}
-	}
-	return false
-}
-
-// flattenHeaders converts http.Header to map[string]string, redacting the
-// values of any sensitive headers (see redactedHeaderNames /
-// redactedHeaderSubstrings) so that credentials never reach the log file or
-// UI subscribers. Pre-allocates the map with the exact size needed to avoid
-// reallocations.
-func flattenHeaders(h http.Header) map[string]string {
-	result := make(map[string]string, len(h))
-	for k, v := range h {
-		if shouldRedactHeader(k) {
-			result[k] = redactedValue
-			continue
-		}
-		result[k] = strings.Join(v, ", ")
-	}
-	return result
-}
-
-// GetTargetPort returns the target port for the k8s tunnel
-func (p *Proxy) GetTargetPort() int {
-	return p.targetPort
-}
-
-// GetLogger returns the HTTP logger for subscribing to log entries
-func (p *Proxy) GetLogger() *Logger {
-	return p.logger
-}

internal/httplog/proxy_test.go

@@ -1,423 +0,0 @@
-package httplog
-
-import (
-	"bytes"
-	"encoding/json"
-	"net"
-	"net/http"
-	"os"
-	"testing"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestLogger(t *testing.T) {
-	// Create a buffer to capture output
-	var buf bytes.Buffer
-
-	l := &Logger{
-		forwardID:  "test-forward",
-		maxBodyLen: 100,
-		output:     &buf,
-	}
-
-	// Log an entry
-	err := l.Log(Entry{
-		Direction: "request",
-		Method:    "GET",
-		Path:      "/test",
-		BodySize:  0,
-	})
-	require.NoError(t, err)
-
-	// Parse the output
-	var entry Entry
-	err = json.Unmarshal(buf.Bytes(), &entry)
-	require.NoError(t, err)
-
-	assert.Equal(t, "test-forward", entry.ForwardID)
-	assert.Equal(t, "request", entry.Direction)
-	assert.Equal(t, "GET", entry.Method)
-	assert.Equal(t, "/test", entry.Path)
-	assert.False(t, entry.Timestamp.IsZero())
-}
-
-func TestLoggerBodyTruncation(t *testing.T) {
-	var buf bytes.Buffer
-
-	l := &Logger{
-		forwardID:  "test-forward",
-		maxBodyLen: 10,
-		output:     &buf,
-	}
-
-	// Log an entry with a long body
-	err := l.Log(Entry{
-		Direction: "request",
-		Method:    "POST",
-		Path:      "/test",
-		Body:      "this is a very long body that should be truncated",
-		BodySize:  50,
-	})
-	require.NoError(t, err)
-
-	// Parse the output
-	var entry Entry
-	err = json.Unmarshal(buf.Bytes(), &entry)
-	require.NoError(t, err)
-
-	assert.Equal(t, "this is a ...(truncated)", entry.Body)
-}
-
-func TestProxyShouldLog(t *testing.T) {
-	tests := []struct {
-		name       string
-		filterPath string
-		path       string
-		expected   bool
-	}{
-		{"no filter", "", "/anything", true},
-		{"exact match", "/api", "/api", true},
-		{"no match", "/api", "/other", false},
-		{"prefix match", "/api/*", "/api/users", true},
-		{"prefix no match", "/api/*", "/other/users", false},
-		{"wildcard", "/api/*/test", "/api/v1/test", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			p := &Proxy{filterPath: tt.filterPath}
-			assert.Equal(t, tt.expected, p.shouldLog(tt.path))
-		})
-	}
-}
-
-func TestProxyIntegration(t *testing.T) {
-	// Create a buffer for log output
-	var logBuf bytes.Buffer
-
-	// Create config
-	fwd := &config.Forward{
-		LocalPort: 0, // Will be assigned dynamically
-		HTTPLog: &config.HTTPLogSpec{
-			Enabled:        true,
-			IncludeHeaders: true,
-			MaxBodySize:    1024,
-		},
-	}
-
-	// Create logger with buffer
-	logger := &Logger{
-		forwardID:  "test",
-		maxBodyLen: 1024,
-		output:     &logBuf,
-	}
-
-	// Create proxy manually for testing
-	proxy := &Proxy{
-		localPort:   0, // Will use ephemeral port
-		targetPort:  0, // Not used in this test
-		logger:      logger,
-		forwardID:   fwd.ID(),
-		filterPath:  "",
-		includeHdrs: true,
-	}
-
-	// Test shouldLog
-	assert.True(t, proxy.shouldLog("/any/path"))
-
-	// Test logging through logger directly
-	err := logger.Log(Entry{
-		RequestID: "1",
-		Direction: "request",
-		Method:    "GET",
-		Path:      "/test",
-	})
-	require.NoError(t, err)
-
-	// Verify log output
-	assert.Contains(t, logBuf.String(), `"direction":"request"`)
-	assert.Contains(t, logBuf.String(), `"method":"GET"`)
-}
-
-func TestFlattenHeaders(t *testing.T) {
-	h := http.Header{
-		"Content-Type": []string{"application/json"},
-		"Accept":       []string{"text/html", "application/json"},
-	}
-
-	result := flattenHeaders(h)
-
-	assert.Equal(t, "application/json", result["Content-Type"])
-	assert.Equal(t, "text/html, application/json", result["Accept"])
-}
-
-func TestNewLogger(t *testing.T) {
-	// Test stdout logger
-	l, err := NewLogger("test-forward", "", 1024)
-	require.NoError(t, err)
-	require.NotNil(t, l)
-	assert.Nil(t, l.file) // No file when using stdout
-	_ = l.Close()
-
-	// Test file logger (using temp file)
-	tmpFile := t.TempDir() + "/test.log"
-	l, err = NewLogger("test-forward", tmpFile, 1024)
-	require.NoError(t, err)
-	require.NotNil(t, l)
-	assert.NotNil(t, l.file)
-
-	// Write something
-	err = l.Log(Entry{Direction: "request", Method: "GET"})
-	require.NoError(t, err)
-
-	_ = l.Close()
-
-	// Verify file has content
-	data, err := os.ReadFile(tmpFile)
-	require.NoError(t, err)
-	assert.Contains(t, string(data), `"direction":"request"`)
-}
-
-// TestNewProxy tests proxy creation
-func TestNewProxy(t *testing.T) {
-	t.Run("valid config", func(t *testing.T) {
-		fwd := &config.Forward{
-			LocalPort: 8080,
-			Port:      80,
-			HTTPLog: &config.HTTPLogSpec{
-				Enabled:        true,
-				FilterPath:     "/api/*",
-				IncludeHeaders: true,
-			},
-		}
-
-		proxy, err := NewProxy(fwd, 18080)
-		require.NoError(t, err)
-		require.NotNil(t, proxy)
-
-		assert.Equal(t, 8080, proxy.localPort)
-		assert.Equal(t, 18080, proxy.targetPort)
-		assert.Equal(t, "/api/*", proxy.filterPath)
-		assert.True(t, proxy.includeHdrs)
-		assert.NotNil(t, proxy.logger)
-	})
-
-	t.Run("nil HTTPLog config", func(t *testing.T) {
-		fwd := &config.Forward{
-			LocalPort: 8080,
-			HTTPLog:   nil,
-		}
-
-		proxy, err := NewProxy(fwd, 18080)
-		assert.Error(t, err)
-		assert.Nil(t, proxy)
-		assert.Contains(t, err.Error(), "HTTP log config is nil")
-	})
-}
-
-// TestProxy_GetTargetPort tests target port getter
-func TestProxy_GetTargetPort(t *testing.T) {
-	proxy := &Proxy{targetPort: 19090}
-	assert.Equal(t, 19090, proxy.GetTargetPort())
-}
-
-// TestProxy_GetLogger tests logger getter
-func TestProxy_GetLogger(t *testing.T) {
-	logger := &Logger{forwardID: "test"}
-	proxy := &Proxy{logger: logger}
-
-	result := proxy.GetLogger()
-	assert.Equal(t, logger, result)
-}
-
-// TestProxy_ShouldLog tests path filtering
-func TestProxy_ShouldLog(t *testing.T) {
-	tests := []struct {
-		name       string
-		filterPath string
-		path       string
-		expected   bool
-	}{
-		// No filter - log everything
-		{"empty filter logs all", "", "/any/path", true},
-		{"empty filter logs root", "", "/", true},
-
-		// Exact match
-		{"exact match", "/api", "/api", true},
-		{"exact no match", "/api", "/other", false},
-
-		// Wildcard patterns
-		{"single wildcard match", "/api/*", "/api/users", true},
-		{"single wildcard no match", "/api/*", "/other/users", false},
-		{"middle wildcard", "/api/*/test", "/api/v1/test", true},
-		{"middle wildcard no match", "/api/*/test", "/api/v1/other", false},
-
-		// Prefix patterns (/* suffix special handling)
-		{"prefix match", "/api/*", "/api/users/123", true},
-		{"prefix match nested", "/api/*", "/api/users/123/deep", true},
-
-		// Edge cases
-		{"empty path", "/api/*", "", false},
-		{"trailing slash filter", "/api/", "/api/", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			p := &Proxy{filterPath: tt.filterPath}
-			result := p.shouldLog(tt.path)
-			assert.Equal(t, tt.expected, result, "filterPath=%q, path=%q", tt.filterPath, tt.path)
-		})
-	}
-}
-
-// TestProxy_ShouldLog_InvalidPattern tests behavior with invalid glob patterns
-func TestProxy_ShouldLog_InvalidPattern(t *testing.T) {
-	// Invalid glob pattern (unclosed bracket)
-	p := &Proxy{filterPath: "/api/[invalid"}
-
-	// Should default to logging everything on invalid pattern
-	assert.True(t, p.shouldLog("/any/path"))
-}
-
-// TestProxy_StartStop tests basic start/stop lifecycle
-func TestProxy_StartStop(t *testing.T) {
-	var buf bytes.Buffer
-	logger := &Logger{
-		forwardID:  "test",
-		maxBodyLen: 1024,
-		output:     &buf,
-	}
-
-	proxy := &Proxy{
-		localPort:  0, // Ephemeral port
-		targetPort: 9999,
-		logger:     logger,
-		forwardID:  "test-fwd",
-	}
-
-	// Start
-	err := proxy.Start()
-	require.NoError(t, err)
-	assert.True(t, proxy.running)
-	assert.NotNil(t, proxy.listener)
-	assert.NotNil(t, proxy.server)
-
-	// Double start should fail
-	err = proxy.Start()
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "already running")
-
-	// Stop
-	err = proxy.Stop()
-	assert.NoError(t, err)
-	assert.False(t, proxy.running)
-
-	// Double stop should be OK
-	err = proxy.Stop()
-	assert.NoError(t, err)
-}
-
-// TestProxy_Start_PortInUse tests behavior when port is already in use
-func TestProxy_Start_PortInUse(t *testing.T) {
-	// Start first proxy
-	logger1 := &Logger{output: bytes.NewBuffer(nil), maxBodyLen: 100}
-	proxy1 := &Proxy{
-		localPort:  0, // Ephemeral
-		targetPort: 9999,
-		logger:     logger1,
-	}
-	err := proxy1.Start()
-	require.NoError(t, err)
-	defer func() { _ = proxy1.Stop() }()
-
-	// Get the actual port
-	addr := proxy1.listener.Addr().(*net.TCPAddr)
-	usedPort := addr.Port
-
-	// Try to start second proxy on same port
-	logger2 := &Logger{output: bytes.NewBuffer(nil), maxBodyLen: 100}
-	proxy2 := &Proxy{
-		localPort:  usedPort,
-		targetPort: 9999,
-		logger:     logger2,
-	}
-
-	err = proxy2.Start()
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to listen")
-}
-
-// TestFlattenHeaders_EdgeCases tests header flattening edge cases
-func TestFlattenHeaders_EdgeCases(t *testing.T) {
-	tests := []struct {
-		headers  http.Header
-		expected map[string]string
-		name     string
-	}{
-		{
-			name:     "empty headers",
-			headers:  http.Header{},
-			expected: map[string]string{},
-		},
-		{
-			name:     "single value",
-			headers:  http.Header{"X-Test": {"value"}},
-			expected: map[string]string{"X-Test": "value"},
-		},
-		{
-			name:     "multiple values same key",
-			headers:  http.Header{"Accept": {"text/html", "application/json", "text/plain"}},
-			expected: map[string]string{"Accept": "text/html, application/json, text/plain"},
-		},
-		{
-			name:     "empty value",
-			headers:  http.Header{"X-Empty": {""}},
-			expected: map[string]string{"X-Empty": ""},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := flattenHeaders(tt.headers)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestProxy_RequestCount tests request counting
-func TestProxy_RequestCount(t *testing.T) {
-	proxy := &Proxy{requestCount: 0}
-
-	// Simulate incrementing (normally done by loggingTransport)
-	assert.Equal(t, uint64(0), proxy.requestCount)
-}
-
-// TestProxy_LogError tests error logging
-func TestProxy_LogError(t *testing.T) {
-	var buf bytes.Buffer
-	logger := &Logger{
-		forwardID:  "test",
-		maxBodyLen: 1024,
-		output:     &buf,
-	}
-
-	proxy := &Proxy{
-		logger:    logger,
-		forwardID: "test-fwd",
-	}
-
-	req, _ := http.NewRequest("GET", "/test", nil)
-	proxy.logError(req, assert.AnError)
-
-	var entry Entry
-	err := json.Unmarshal(buf.Bytes(), &entry)
-	require.NoError(t, err)
-
-	assert.Equal(t, "error", entry.Direction)
-	assert.Equal(t, "GET", entry.Method)
-	assert.Equal(t, "/test", entry.Path)
-	assert.Contains(t, entry.Error, "assert.AnError")
-}

internal/httplog/redact_test.go

@@ -1,102 +0,0 @@
-package httplog
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestFlattenHeaders_RedactsSensitive verifies that flattenHeaders replaces
-// the values of known sensitive headers with the [REDACTED] placeholder while
-// preserving the header name and leaving benign headers untouched. Covers
-// the explicit name list, case-insensitive matching, and the substring-based
-// fallback patterns ("token", "secret", "password", "apikey").
-func TestFlattenHeaders_RedactsSensitive(t *testing.T) {
-	h := http.Header{
-		// Explicit list (canonical casing)
-		"Authorization":       []string{"Bearer eyJhbGciOiJIUzI1NiJ9.payload.sig"},
-		"Proxy-Authorization": []string{"Basic dXNlcjpwYXNz"},
-		"Cookie":              []string{"session=abc123; csrf=xyz"},
-		"Set-Cookie":          []string{"session=abc123; HttpOnly"},
-		"X-Api-Key":           []string{"sk_live_deadbeef"},
-		"X-Auth-Token":        []string{"tok_supersecret"},
-		"X-Csrf-Token":        []string{"csrf_random_value"},
-		"X-Access-Token":      []string{"at_anothersecret"},
-
-		// Substring matches (case-insensitive)
-		"X-Refresh-Token":  []string{"rt_value"},
-		"My-Secret-Header": []string{"shh"},
-		"X-User-Password":  []string{"hunter2"},
-		"X-Custom-Apikey":  []string{"key_value"},
-
-		// Benign headers must be preserved verbatim
-		"Content-Type": []string{"application/json"},
-		"Accept":       []string{"text/html", "application/json"},
-		"User-Agent":   []string{"kportal-test/1.0"},
-	}
-
-	result := flattenHeaders(h)
-
-	redactedHeaders := []string{
-		"Authorization",
-		"Proxy-Authorization",
-		"Cookie",
-		"Set-Cookie",
-		"X-Api-Key",
-		"X-Auth-Token",
-		"X-Csrf-Token",
-		"X-Access-Token",
-		"X-Refresh-Token",
-		"My-Secret-Header",
-		"X-User-Password",
-		"X-Custom-Apikey",
-	}
-	for _, name := range redactedHeaders {
-		got, ok := result[name]
-		assert.Truef(t, ok, "expected redacted header %q to remain present in output", name)
-		assert.Equalf(t, "[REDACTED]", got, "expected header %q value to be redacted", name)
-	}
-
-	// Benign headers should be untouched.
-	assert.Equal(t, "application/json", result["Content-Type"])
-	assert.Equal(t, "text/html, application/json", result["Accept"])
-	assert.Equal(t, "kportal-test/1.0", result["User-Agent"])
-
-	// And no benign value should leak the redaction marker (sanity check).
-	for _, name := range []string{"Content-Type", "Accept", "User-Agent"} {
-		assert.NotEqualf(t, "[REDACTED]", result[name], "benign header %q must not be redacted", name)
-	}
-}
-
-// TestShouldRedactHeader_CaseInsensitive verifies that the case-insensitive
-// match logic catches lowercased / mixed-case variants of the redaction list.
-func TestShouldRedactHeader_CaseInsensitive(t *testing.T) {
-	cases := []struct {
-		name string
-		want bool
-	}{
-		{"authorization", true},
-		{"AUTHORIZATION", true},
-		{"AuThOrIzAtIoN", true},
-		{"cookie", true},
-		{"set-cookie", true},
-		{"x-api-key", true},
-		{"X-CUSTOM-TOKEN", true},
-		{"x-app-Secret", true},
-		{"My_Password_Header", true},
-		{"x-vendor-APIKEY", true},
-
-		// Non-sensitive
-		{"Content-Type", false},
-		{"Accept", false},
-		{"User-Agent", false},
-		{"X-Request-Id", false},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.want, shouldRedactHeader(tc.name))
-		})
-	}
-}

internal/httplog/roundtrip_test.go

@@ -1,510 +0,0 @@
-package httplog
-
-// Tests for loggingTransport.RoundTrip and readBodyLimited — both at 0%
-// coverage before this file was added. Uses httptest.NewServer for real HTTP
-// round-trips so the transport code executes end-to-end.
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// makeProxy builds a Proxy wired to the given backend server, using an
-// ephemeral listen port and a buffer-backed logger. The caller must stop
-// the proxy after the test.
-func makeProxy(t *testing.T, backend *httptest.Server, opts struct {
-	filterPath  string
-	includeHdrs bool
-	maxBodyLen  int
-}) (*Proxy, *bytes.Buffer) {
-	t.Helper()
-
-	if opts.maxBodyLen == 0 {
-		opts.maxBodyLen = 1024 * 1024
-	}
-
-	var buf bytes.Buffer
-	lg := &Logger{
-		forwardID:  "test-rt",
-		maxBodyLen: opts.maxBodyLen,
-		output:     &buf,
-	}
-
-	// Extract backend port
-	backendAddr := backend.Listener.Addr().String()
-	var backendPort int
-	_, _ = fmt.Sscanf(backendAddr[strings.LastIndex(backendAddr, ":")+1:], "%d", &backendPort)
-
-	p := &Proxy{
-		localPort:   0, // ephemeral
-		targetPort:  backendPort,
-		logger:      lg,
-		forwardID:   "test-rt",
-		filterPath:  opts.filterPath,
-		includeHdrs: opts.includeHdrs,
-	}
-
-	require.NoError(t, p.Start())
-	t.Cleanup(func() { _ = p.Stop() })
-
-	return p, &buf
-}
-
-// proxyURL returns the URL of the proxy's listening address.
-func proxyURL(p *Proxy) string {
-	addr := p.listener.Addr().String()
-	return "http://" + addr
-}
-
-// TestRoundTrip_GET_LogsRequestAndResponse drives a GET through the proxy and
-// verifies that both a request entry and a response entry are written to the log.
-func TestRoundTrip_GET_LogsRequestAndResponse(t *testing.T) {
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("X-Custom", "value")
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`{"status":"ok"}`))
-	}))
-	defer backend.Close()
-
-	p, buf := makeProxy(t, backend, struct {
-		filterPath  string
-		includeHdrs bool
-		maxBodyLen  int
-	}{})
-
-	resp, err := http.Get(proxyURL(p) + "/api/test")
-	require.NoError(t, err)
-	defer func() { _ = resp.Body.Close() }()
-	assert.Equal(t, http.StatusOK, resp.StatusCode)
-
-	// Give logger a moment — it's synchronous in RoundTrip so no sleep needed,
-	// but let's drain the response body to ensure everything flushed.
-	_, _ = io.ReadAll(resp.Body)
-
-	// Two JSON lines expected: request + response
-	lines := strings.Split(strings.TrimSpace(buf.String()), "\n")
-	require.GreaterOrEqual(t, len(lines), 2, "expected at least 2 log lines, got: %s", buf.String())
-
-	var reqEntry, respEntry Entry
-	require.NoError(t, json.Unmarshal([]byte(lines[0]), &reqEntry))
-	require.NoError(t, json.Unmarshal([]byte(lines[1]), &respEntry))
-
-	assert.Equal(t, "request", reqEntry.Direction)
-	assert.Equal(t, "GET", reqEntry.Method)
-	assert.Equal(t, "/api/test", reqEntry.Path)
-
-	assert.Equal(t, "response", respEntry.Direction)
-	assert.Equal(t, http.StatusOK, respEntry.StatusCode)
-	assert.Equal(t, `{"status":"ok"}`, respEntry.Body)
-	assert.GreaterOrEqual(t, respEntry.LatencyMs, int64(0))
-}
-
-// TestRoundTrip_POST_WithBody verifies that request bodies are captured and
-// re-streamed to the backend correctly.
-func TestRoundTrip_POST_WithBody(t *testing.T) {
-	var receivedBody []byte
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		receivedBody, _ = io.ReadAll(r.Body)
-		w.WriteHeader(http.StatusCreated)
-		_, _ = w.Write([]byte(`{"id":1}`))
-	}))
-	defer backend.Close()
-
-	p, buf := makeProxy(t, backend, struct {
-		filterPath  string
-		includeHdrs bool
-		maxBodyLen  int
-	}{})
-
-	reqBody := `{"name":"alice","email":"alice@example.com"}`
-	resp, err := http.Post(proxyURL(p)+"/users", "application/json", strings.NewReader(reqBody))
-	require.NoError(t, err)
-	defer func() { _ = resp.Body.Close() }()
-	_, _ = io.ReadAll(resp.Body)
-
-	assert.Equal(t, http.StatusCreated, resp.StatusCode)
-	assert.Equal(t, reqBody, string(receivedBody), "backend must receive the full request body")
-
-	lines := strings.Split(strings.TrimSpace(buf.String()), "\n")
-	require.GreaterOrEqual(t, len(lines), 2)
-
-	var reqEntry Entry
-	require.NoError(t, json.Unmarshal([]byte(lines[0]), &reqEntry))
-	assert.Equal(t, reqBody, reqEntry.Body)
-	assert.Equal(t, len(reqBody), reqEntry.BodySize)
-}
-
-// TestRoundTrip_FilterPath_SkipsNonMatchingPaths ensures that requests whose
-// paths don't match filterPath are forwarded but not logged.
-func TestRoundTrip_FilterPath_SkipsNonMatchingPaths(t *testing.T) {
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte("ok"))
-	}))
-	defer backend.Close()
-
-	p, buf := makeProxy(t, backend, struct {
-		filterPath  string
-		includeHdrs bool
-		maxBodyLen  int
-	}{filterPath: "/api/*"})
-
-	// This path does NOT match /api/* → should be forwarded but not logged
-	resp, err := http.Get(proxyURL(p) + "/health")
-	require.NoError(t, err)
-	defer func() { _ = resp.Body.Close() }()
-	_, _ = io.ReadAll(resp.Body)
-
-	assert.Equal(t, http.StatusOK, resp.StatusCode)
-	assert.Empty(t, buf.String(), "non-matching path must produce no log output")
-
-	// This path DOES match /api/* → should be logged
-	resp2, err := http.Get(proxyURL(p) + "/api/users")
-	require.NoError(t, err)
-	defer func() { _ = resp2.Body.Close() }()
-	_, _ = io.ReadAll(resp2.Body)
-
-	assert.NotEmpty(t, buf.String(), "matching path must produce log output")
-}
-
-// TestRoundTrip_IncludeHeaders verifies that when includeHdrs is true the log
-// entries contain header maps, and that sensitive headers are redacted.
-func TestRoundTrip_IncludeHeaders(t *testing.T) {
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("X-Response-Id", "resp-123")
-		w.Header().Set("Set-Cookie", "session=abc123")
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte("ok"))
-	}))
-	defer backend.Close()
-
-	p, buf := makeProxy(t, backend, struct {
-		filterPath  string
-		includeHdrs bool
-		maxBodyLen  int
-	}{includeHdrs: true})
-
-	req, _ := http.NewRequest("GET", proxyURL(p)+"/test", nil)
-	req.Header.Set("Authorization", "Bearer secret-token")
-	req.Header.Set("X-Custom", "visible")
-
-	client := &http.Client{}
-	resp, err := client.Do(req)
-	require.NoError(t, err)
-	defer func() { _ = resp.Body.Close() }()
-	_, _ = io.ReadAll(resp.Body)
-
-	lines := strings.Split(strings.TrimSpace(buf.String()), "\n")
-	require.GreaterOrEqual(t, len(lines), 2)
-
-	var reqEntry, respEntry Entry
-	require.NoError(t, json.Unmarshal([]byte(lines[0]), &reqEntry))
-	require.NoError(t, json.Unmarshal([]byte(lines[1]), &respEntry))
-
-	// Sensitive request header must be redacted
-	assert.Equal(t, redactedValue, reqEntry.Headers["Authorization"])
-	// Benign request header must be visible
-	assert.Equal(t, "visible", reqEntry.Headers["X-Custom"])
-	// Sensitive response header must be redacted
-	assert.Equal(t, redactedValue, respEntry.Headers["Set-Cookie"])
-}
-
-// TestRoundTrip_NoHeaders verifies that when includeHdrs is false no header
-// map is written to the log entries.
-func TestRoundTrip_NoHeaders(t *testing.T) {
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer backend.Close()
-
-	p, buf := makeProxy(t, backend, struct {
-		filterPath  string
-		includeHdrs bool
-		maxBodyLen  int
-	}{includeHdrs: false})
-
-	resp, err := http.Get(proxyURL(p) + "/test")
-	require.NoError(t, err)
-	defer func() { _ = resp.Body.Close() }()
-	_, _ = io.ReadAll(resp.Body)
-
-	lines := strings.Split(strings.TrimSpace(buf.String()), "\n")
-	require.GreaterOrEqual(t, len(lines), 1)
-
-	var reqEntry Entry
-	require.NoError(t, json.Unmarshal([]byte(lines[0]), &reqEntry))
-	assert.Nil(t, reqEntry.Headers, "headers must be absent when includeHdrs=false")
-}
-
-// TestRoundTrip_BackendDown_LogsError verifies that when the backend is
-// unreachable the proxy ErrorHandler fires and logs an error entry.
-func TestRoundTrip_BackendDown_LogsError(t *testing.T) {
-	// Start a server, grab its address, then close it to simulate down backend.
-	dummy := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {}))
-	backendAddr := dummy.Listener.Addr().String()
-	dummy.Close() // now the port is gone
-
-	var backendPort int
-	_, _ = fmt.Sscanf(backendAddr[strings.LastIndex(backendAddr, ":")+1:], "%d", &backendPort)
-
-	var buf bytes.Buffer
-	lg := &Logger{forwardID: "test-err", maxBodyLen: 1024, output: &buf}
-
-	p := &Proxy{
-		localPort:  0,
-		targetPort: backendPort,
-		logger:     lg,
-		forwardID:  "test-err",
-	}
-	require.NoError(t, p.Start())
-	defer func() { _ = p.Stop() }()
-
-	// The proxy should return 502 when backend is unreachable
-	resp, err := http.Get("http://" + p.listener.Addr().String() + "/failing")
-	require.NoError(t, err)
-	defer func() { _ = resp.Body.Close() }()
-	_, _ = io.ReadAll(resp.Body)
-
-	assert.Equal(t, http.StatusBadGateway, resp.StatusCode)
-
-	// Error entry should be in the log (there may also be a request entry before it)
-	logOutput := buf.String()
-	assert.NotEmpty(t, logOutput, "error should be logged")
-
-	var errorEntry *Entry
-	for _, line := range strings.Split(strings.TrimSpace(logOutput), "\n") {
-		if line == "" {
-			continue
-		}
-		var e Entry
-		if err2 := json.Unmarshal([]byte(line), &e); err2 == nil && e.Direction == "error" {
-			eCopy := e
-			errorEntry = &eCopy
-		}
-	}
-	require.NotNil(t, errorEntry, "expected at least one error log entry")
-	assert.Equal(t, "error", errorEntry.Direction)
-	assert.NotEmpty(t, errorEntry.Error)
-}
-
-// TestRoundTrip_RequestCount verifies that each logged request increments the
-// atomic request counter (drives the reqID path inside RoundTrip).
-func TestRoundTrip_RequestCount(t *testing.T) {
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer backend.Close()
-
-	p, buf := makeProxy(t, backend, struct {
-		filterPath  string
-		includeHdrs bool
-		maxBodyLen  int
-	}{})
-
-	for i := 0; i < 3; i++ {
-		resp, err := http.Get(proxyURL(p) + "/tick")
-		require.NoError(t, err)
-		_, _ = io.ReadAll(resp.Body)
-		_ = resp.Body.Close()
-	}
-
-	lines := strings.Split(strings.TrimSpace(buf.String()), "\n")
-	// 3 requests × 2 entries (req + resp) = 6 lines
-	assert.Equal(t, 6, len(lines))
-
-	// Request IDs should be "1", "2", "3" across request entries
-	ids := make(map[string]bool)
-	for _, line := range lines {
-		var e Entry
-		if json.Unmarshal([]byte(line), &e) == nil && e.Direction == "request" {
-			ids[e.RequestID] = true
-		}
-	}
-	assert.Len(t, ids, 3, "three distinct request IDs expected")
-}
-
-// ---------------------------------------------------------------------------
-// readBodyLimited unit tests
-// ---------------------------------------------------------------------------
-
-// TestReadBodyLimited_SmallBody verifies the fast path: body ≤ 4096 bytes and
-// under the maxSize limit returns exact content and correct size.
-func TestReadBodyLimited_SmallBody(t *testing.T) {
-	transport := &loggingTransport{}
-	data := []byte("hello world")
-	body := io.NopCloser(bytes.NewReader(data))
-
-	result, size := transport.readBodyLimited(body, 1024)
-	assert.Equal(t, data, result)
-	assert.Equal(t, len(data), size)
-}
-
-// TestReadBodyLimited_EmptyBody verifies that an empty body returns an empty
-// slice and size zero without panicking.
-func TestReadBodyLimited_EmptyBody(t *testing.T) {
-	transport := &loggingTransport{}
-	body := io.NopCloser(bytes.NewReader([]byte{}))
-
-	result, size := transport.readBodyLimited(body, 1024)
-	assert.Empty(t, result)
-	assert.Equal(t, 0, size)
-}
-
-// TestReadBodyLimited_TruncatedBody verifies the truncation path: when the
-// body exceeds maxSize, the returned slice contains exactly maxSize bytes.
-// The reported size is maxSize + (remaining bytes after the maxSize+1 read),
-// which due to the implementation consuming one extra sentinel byte equals
-// len(data)-1 for a body whose length > maxSize.
-func TestReadBodyLimited_TruncatedBody(t *testing.T) {
-	transport := &loggingTransport{}
-	maxSize := 10
-	// Body is 30 bytes — must be truncated to maxSize in the returned slice.
-	data := []byte("ABCDEFGHIJKLMNOPQRSTUVWXYZ1234")
-	body := io.NopCloser(bytes.NewReader(data))
-
-	result, size := transport.readBodyLimited(body, maxSize)
-	assert.Equal(t, maxSize, len(result), "returned slice must be exactly maxSize bytes")
-	assert.Equal(t, string(data[:maxSize]), string(result), "first maxSize bytes must match")
-	// Implementation reads maxSize+1 sentinel bytes, then drains the rest.
-	// The sentinel byte is consumed and not included in the "remaining" count,
-	// so reported size == maxSize + (len(data) - maxSize - 1) == len(data) - 1.
-	assert.Equal(t, len(data)-1, size, "reported size is total length minus the consumed sentinel byte")
-}
-
-// TestReadBodyLimited_ExactlyMaxSize ensures that a body equal to maxSize bytes
-// is NOT truncated (the truncation condition is strictly greater-than).
-func TestReadBodyLimited_ExactlyMaxSize(t *testing.T) {
-	transport := &loggingTransport{}
-	maxSize := 5
-	data := []byte("ABCDE") // exactly maxSize
-	body := io.NopCloser(bytes.NewReader(data))
-
-	result, size := transport.readBodyLimited(body, maxSize)
-	assert.Equal(t, data, result)
-	assert.Equal(t, maxSize, size)
-	assert.NotContains(t, string(result), "...(truncated)")
-}
-
-// TestReadBodyLimited_LargeBodyOverPoolThreshold exercises the branch in
-// readBodyLimited where resultLen > 4096, which uses the pooled-buffer path
-// for larger-than-small results. The body is 5000 bytes, well over the 4096
-// small-body threshold but under maxSize so no truncation occurs.
-func TestReadBodyLimited_LargeBodyOverPoolThreshold(t *testing.T) {
-	transport := &loggingTransport{}
-	data := bytes.Repeat([]byte("x"), 5000) // > 4096, under maxSize
-	body := io.NopCloser(bytes.NewReader(data))
-
-	result, size := transport.readBodyLimited(body, 65536)
-	assert.Equal(t, 5000, len(result))
-	assert.Equal(t, 5000, size)
-	assert.Equal(t, data, result)
-}
-
-// TestReadBodyLimited_ZeroMaxSize covers the edge where maxSize == 0: every
-// non-empty body is "over limit". The returned slice is empty (0 bytes). The
-// reported size is the number of bytes drained after the sentinel read, which
-// is len(data)-1 because the LimitReader reads 1 sentinel byte (maxSize+1=1)
-// that is consumed and lost from the remaining count.
-func TestReadBodyLimited_ZeroMaxSize(t *testing.T) {
-	transport := &loggingTransport{}
-	data := []byte("some data") // 9 bytes
-	body := io.NopCloser(bytes.NewReader(data))
-
-	result, size := transport.readBodyLimited(body, 0)
-	assert.Equal(t, 0, len(result))
-	// sentinel consumes 1 byte; remaining = 8; actualSize = 0 + 8 = 8
-	assert.Equal(t, len(data)-1, size)
-}
-
-// TestReadBodyLimited_Callback exercises the transport inside a running proxy
-// to confirm the pool-backed reading integrates correctly end-to-end
-// (complementary to the direct unit tests above).
-func TestReadBodyLimited_ViaCallback(t *testing.T) {
-	var entries []Entry
-
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write(bytes.Repeat([]byte("R"), 200))
-	}))
-	defer backend.Close()
-
-	p, _ := makeProxy(t, backend, struct {
-		filterPath  string
-		includeHdrs bool
-		maxBodyLen  int
-	}{maxBodyLen: 100})
-
-	p.logger.AddCallback(func(e Entry) {
-		entries = append(entries, e)
-	})
-
-	resp, err := http.Get(proxyURL(p) + "/data")
-	require.NoError(t, err)
-	defer func() { _ = resp.Body.Close() }()
-	_, _ = io.ReadAll(resp.Body)
-
-	// Give callbacks a moment (they run synchronously inside Log's mutex)
-	require.Eventually(t, func() bool { return len(entries) >= 2 }, time.Second, 5*time.Millisecond)
-
-	respEntry := entries[1] // second entry is the response
-	assert.Equal(t, "response", respEntry.Direction)
-	// Body was 200 bytes but maxBodyLen is 100 → BodySize should be ≥100
-	assert.GreaterOrEqual(t, respEntry.BodySize, 100)
-}
-
-// TestRoundTrip_NilRequestBody confirms no panic when req.Body is nil (GET
-// requests typically have no body).
-func TestRoundTrip_NilRequestBody(t *testing.T) {
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer backend.Close()
-
-	p, buf := makeProxy(t, backend, struct {
-		filterPath  string
-		includeHdrs bool
-		maxBodyLen  int
-	}{})
-
-	req, _ := http.NewRequest("DELETE", proxyURL(p)+"/item/1", nil)
-	client := &http.Client{}
-	resp, err := client.Do(req)
-	require.NoError(t, err)
-	defer func() { _ = resp.Body.Close() }()
-
-	assert.Equal(t, http.StatusNoContent, resp.StatusCode)
-	assert.NotEmpty(t, buf.String())
-}
-
-// TestRoundTrip_NilResponseBody ensures the transport handles a response with
-// no body (Content-Length: 0) without panicking.
-func TestRoundTrip_NilResponseBody(t *testing.T) {
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.Header().Set("Content-Length", "0")
-		w.WriteHeader(http.StatusOK)
-		// No body written
-	}))
-	defer backend.Close()
-
-	p, _ := makeProxy(t, backend, struct {
-		filterPath  string
-		includeHdrs bool
-		maxBodyLen  int
-	}{})
-
-	resp, err := http.Get(proxyURL(p) + "/empty")
-	require.NoError(t, err)
-	defer func() { _ = resp.Body.Close() }()
-
-	assert.Equal(t, http.StatusOK, resp.StatusCode)
-}

internal/k8s/client.go

@@ -1,14 +1,3 @@
-// Package k8s provides Kubernetes client management, resource resolution,
-// and port-forwarding capabilities for kportal.
-//
-// Key components:
-//   - ClientPool: Thread-safe management of Kubernetes clients per context
-//   - ResourceResolver: Resolves pod/service/selector targets to actual pods
-//   - PortForwarder: Establishes and manages port-forward connections
-//   - Discovery: Provides resource discovery for the UI wizards
-//
-// The package handles automatic pod restart detection through re-resolution,
-// caching with 30-second TTL, and graceful connection management.
 package k8s
 
 import (
@@ -23,10 +12,10 @@ import (
 
 // ClientPool manages Kubernetes clients per context with thread-safe access.
 type ClientPool struct {
-	loader  clientcmd.ClientConfig
-	clients map[string]kubernetes.Interface
-	configs map[string]*rest.Config
 	mu      sync.RWMutex
+	clients map[string]*kubernetes.Clientset
+	configs map[string]*rest.Config
+	loader  clientcmd.ClientConfig
 }
 
 // NewClientPool creates a new ClientPool instance.
@@ -38,7 +27,7 @@ func NewClientPool() (*ClientPool, error) {
 	loader := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, configOverrides)
 
 	return &ClientPool{
-		clients: make(map[string]kubernetes.Interface),
+		clients: make(map[string]*kubernetes.Clientset),
 		configs: make(map[string]*rest.Config),
 		loader:  loader,
 	}, nil
@@ -47,7 +36,7 @@ func NewClientPool() (*ClientPool, error) {
 // GetClient returns a Kubernetes client for the given context.
 // Clients are cached and reused across multiple calls.
 // This method is thread-safe.
-func (p *ClientPool) GetClient(contextName string) (kubernetes.Interface, error) {
+func (p *ClientPool) GetClient(contextName string) (*kubernetes.Clientset, error) {
 	// Try to get cached client (read lock)
 	p.mu.RLock()
 	client, exists := p.clients[contextName]
@@ -62,8 +51,8 @@ func (p *ClientPool) GetClient(contextName string) (kubernetes.Interface, error)
 	defer p.mu.Unlock()
 
 	// Double-check in case another goroutine created it while we waited
-	if cachedClient, ok := p.clients[contextName]; ok {
-		return cachedClient, nil
+	if client, exists := p.clients[contextName]; exists {
+		return client, nil
 	}
 
 	// Create new client
@@ -102,8 +91,8 @@ func (p *ClientPool) GetRestConfig(contextName string) (*rest.Config, error) {
 	defer p.mu.Unlock()
 
 	// Double-check in case another goroutine created it while we waited
-	if cachedConfig, ok := p.configs[contextName]; ok {
-		return cachedConfig, nil
+	if config, exists := p.configs[contextName]; exists {
+		return config, nil
 	}
 
 	// Create new config
@@ -183,7 +172,7 @@ func (p *ClientPool) ClearCache() {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 
-	p.clients = make(map[string]kubernetes.Interface)
+	p.clients = make(map[string]*kubernetes.Clientset)
 	p.configs = make(map[string]*rest.Config)
 }
 
@@ -216,15 +205,3 @@ func (p *ClientPool) GetNamespace(contextName string) (string, error) {
 
 	return context.Namespace, nil
 }
-
-// setTestClient is a test helper that injects a fake client for a context.
-// This is only used in tests to enable testing without real kubeconfig.
-func (p *ClientPool) setTestClient(contextName string, client kubernetes.Interface) {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	if p.clients == nil {
-		p.clients = make(map[string]kubernetes.Interface)
-	}
-	p.clients[contextName] = client
-}

internal/k8s/client_extended_test.go

@@ -1,270 +0,0 @@
-package k8s
-
-import (
-	"sync"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes/fake"
-)
-
-// =============================================================================
-// ClientPool Extended Tests
-// =============================================================================
-
-func TestClientPool_GetClient_Caching(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "test-pod",
-				Namespace: "default",
-			},
-		},
-	)
-
-	// First call - should create and cache
-	client1, err := pool.GetClient("test-context")
-	require.NoError(t, err)
-	assert.NotNil(t, client1)
-
-	// Second call - should return cached
-	client2, err := pool.GetClient("test-context")
-	require.NoError(t, err)
-	assert.Equal(t, client1, client2)
-}
-
-func TestClientPool_GetRestConfig_Caching(t *testing.T) {
-	// This test would require actual kubeconfig context
-	// Skip it for unit testing - covered by integration tests
-	t.Skip("Requires actual kubeconfig context - skipping in unit tests")
-}
-
-func TestClientPool_ClearCache_ThreadSafe(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	// Populate client cache
-	_, err := pool.GetClient("test-context")
-	require.NoError(t, err)
-
-	// Manually populate configs for testing
-	pool.mu.Lock()
-	pool.configs["test-context"] = nil
-	pool.mu.Unlock()
-
-	// Clear cache multiple times concurrently
-	var wg sync.WaitGroup
-	for i := 0; i < 10; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			pool.ClearCache()
-		}()
-	}
-	wg.Wait()
-
-	// Verify cache is empty
-	pool.mu.RLock()
-	assert.Empty(t, pool.clients)
-	assert.Empty(t, pool.configs)
-	pool.mu.RUnlock()
-}
-
-func TestClientPool_RemoveContext_ThreadSafe(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	// Populate cache
-	_, err := pool.GetClient("test-context")
-	require.NoError(t, err)
-
-	// Remove from multiple goroutines
-	var wg sync.WaitGroup
-	for i := 0; i < 10; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			pool.RemoveContext("test-context")
-		}()
-	}
-	wg.Wait()
-
-	// Verify removed
-	pool.mu.RLock()
-	_, exists := pool.clients["test-context"]
-	pool.mu.RUnlock()
-	assert.False(t, exists)
-}
-
-func TestClientPool_ConcurrentGetClient(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	var wg sync.WaitGroup
-
-	// Concurrent reads
-	for i := 0; i < 5; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			_, _ = pool.GetClient("test-context")
-		}()
-	}
-
-	// Concurrent config reads
-	for i := 0; i < 5; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			_, _ = pool.GetRestConfig("test-context")
-		}()
-	}
-
-	// Concurrent cache operations
-	for i := 0; i < 3; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			pool.ClearCache()
-		}()
-	}
-
-	wg.Wait()
-
-	// If we got here without panic/deadlock, the test passed
-	assert.NotNil(t, pool)
-}
-
-func TestClientPool_GetClient_MultipleContexts(t *testing.T) {
-	fakeClient1 := fake.NewClientset()
-	fakeClient2 := fake.NewClientset()
-
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	pool.setTestClient("context-1", fakeClient1)
-	pool.setTestClient("context-2", fakeClient2)
-
-	client1, err := pool.GetClient("context-1")
-	require.NoError(t, err)
-	assert.Equal(t, fakeClient1, client1)
-
-	client2, err := pool.GetClient("context-2")
-	require.NoError(t, err)
-	assert.Equal(t, fakeClient2, client2)
-
-	// Verify they are different
-	assert.NotEqual(t, client1, client2)
-}
-
-func TestClientPool_GetRestConfig_MultipleContexts(t *testing.T) {
-	// This test would require actual kubeconfig contexts
-	// Skip it for unit testing - covered by integration tests
-	t.Skip("Requires actual kubeconfig contexts - skipping in unit tests")
-}
-
-func TestClientPool_RemoveContext_Specific(t *testing.T) {
-	pool := setupTestPool(t, "context-1")
-	pool.setTestClient("context-2", fake.NewClientset())
-
-	// Populate both caches
-	_, err := pool.GetClient("context-1")
-	require.NoError(t, err)
-	_, err = pool.GetClient("context-2")
-	require.NoError(t, err)
-
-	// Remove only context-1
-	pool.RemoveContext("context-1")
-
-	// Verify context-1 removed but context-2 still there
-	pool.mu.RLock()
-	_, exists1 := pool.clients["context-1"]
-	_, exists2 := pool.clients["context-2"]
-	pool.mu.RUnlock()
-
-	assert.False(t, exists1)
-	assert.True(t, exists2)
-}
-
-func TestClientPool_setTestClient_NilMap(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	// Clear the map manually to simulate nil case
-	pool.mu.Lock()
-	pool.clients = nil
-	pool.mu.Unlock()
-
-	// Should handle nil map
-	pool.setTestClient("test-context", fake.NewClientset())
-
-	// Verify it was set
-	pool.mu.RLock()
-	_, exists := pool.clients["test-context"]
-	pool.mu.RUnlock()
-	assert.True(t, exists)
-}
-
-func TestClientPool_GetNamespace_WithTestClient(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	// The GetNamespace method uses the loader to get namespace from kubeconfig context
-	// Since we're using test client, this may fail depending on kubeconfig
-	_, err := pool.GetNamespace("test-context")
-	// May succeed or fail depending on environment
-	// Just verify it doesn't panic
-	_ = err
-}
-
-func TestClientPool_GetClient_NotFound(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	// Try to get client for non-existent context without setting test client
-	_, err = pool.GetClient("non-existent-context")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "not found in kubeconfig")
-}
-
-func TestClientPool_GetRestConfig_NotFound(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	// Try to get rest config for non-existent context
-	_, err = pool.GetRestConfig("non-existent-context")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "not found in kubeconfig")
-}
-
-func TestClientPool_DoubleCheckCache(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	// Simulate race where two goroutines try to get the same client
-	// One creates it, the other should get cached version
-
-	var client1, client2 interface{}
-	var err1, err2 error
-	var wg sync.WaitGroup
-
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		client1, err1 = pool.GetClient("test-context")
-	}()
-	go func() {
-		defer wg.Done()
-		client2, err2 = pool.GetClient("test-context")
-	}()
-
-	wg.Wait()
-
-	require.NoError(t, err1)
-	require.NoError(t, err2)
-	assert.Equal(t, client1, client2)
-}
-
-func TestClientPool_DoubleCheckRestConfig(t *testing.T) {
-	// This test would require actual kubeconfig context
-	// Skip it for unit testing - covered by integration tests
-	t.Skip("Requires actual kubeconfig context - skipping in unit tests")
-}

internal/k8s/client_test.go

@@ -146,8 +146,8 @@ func TestClientPool_ThreadSafety(t *testing.T) {
 		go func() {
 			pool.ClearCache()
 			pool.RemoveContext("test-context")
-			_, _ = pool.GetCurrentContext()
-			_, _ = pool.ListContexts()
+			pool.GetCurrentContext()
+			pool.ListContexts()
 			done <- true
 		}()
 	}

internal/k8s/discovery.go

@@ -1,361 +0,0 @@
-package k8s
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"sort"
-	"strings"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/util/intstr"
-	"k8s.io/client-go/kubernetes"
-)
-
-// Discovery provides cluster introspection capabilities for the UI wizards.
-// It queries the Kubernetes API to list contexts, namespaces, pods, and services.
-type Discovery struct {
-	pool *ClientPool
-}
-
-// NewDiscovery creates a new Discovery instance using the provided client pool.
-func NewDiscovery(pool *ClientPool) *Discovery {
-	return &Discovery{
-		pool: pool,
-	}
-}
-
-// PodInfo contains information about a pod relevant for port forwarding.
-type PodInfo struct {
-	Created    metav1.Time
-	Name       string
-	Namespace  string
-	Status     string
-	Containers []ContainerInfo
-}
-
-// ContainerInfo contains information about a container within a pod.
-type ContainerInfo struct {
-	Name  string
-	Ports []PortInfo
-}
-
-// PortInfo describes a port exposed by a container or service.
-type PortInfo struct {
-	Name       string
-	Protocol   string
-	Port       int32
-	TargetPort int32
-}
-
-// ServiceInfo contains information about a service.
-type ServiceInfo struct {
-	Name      string
-	Namespace string
-	Type      string
-	Ports     []PortInfo
-}
-
-// ListContexts returns all available Kubernetes contexts from kubeconfig.
-func (d *Discovery) ListContexts() ([]string, error) {
-	return d.pool.ListContexts()
-}
-
-// GetCurrentContext returns the name of the current context from kubeconfig.
-func (d *Discovery) GetCurrentContext() (string, error) {
-	return d.pool.GetCurrentContext()
-}
-
-// ListNamespaces returns all namespaces in the given context.
-// Returns an error if the context is invalid or unreachable.
-func (d *Discovery) ListNamespaces(ctx context.Context, contextName string) ([]string, error) {
-	client, err := d.pool.GetClient(contextName)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get client: %w", err)
-	}
-
-	nsList, err := client.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
-	if err != nil {
-		return nil, fmt.Errorf("failed to list namespaces: %w", err)
-	}
-
-	namespaces := make([]string, 0, len(nsList.Items))
-	for _, ns := range nsList.Items {
-		namespaces = append(namespaces, ns.Name)
-	}
-
-	// Sort alphabetically
-	sort.Strings(namespaces)
-
-	return namespaces, nil
-}
-
-// ListPods returns all running pods in the given namespace with their port information.
-// Only returns pods in Running or Pending state.
-func (d *Discovery) ListPods(ctx context.Context, contextName, namespace string) ([]PodInfo, error) {
-	client, err := d.pool.GetClient(contextName)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get client: %w", err)
-	}
-
-	podList, err := client.CoreV1().Pods(namespace).List(ctx, metav1.ListOptions{})
-	if err != nil {
-		return nil, fmt.Errorf("failed to list pods: %w", err)
-	}
-
-	pods := make([]PodInfo, 0)
-	for _, pod := range podList.Items {
-		// Only include Running or Pending pods
-		if pod.Status.Phase != corev1.PodRunning && pod.Status.Phase != corev1.PodPending {
-			continue
-		}
-
-		containers := make([]ContainerInfo, 0, len(pod.Spec.Containers))
-		for _, container := range pod.Spec.Containers {
-			ports := make([]PortInfo, 0, len(container.Ports))
-			for _, port := range container.Ports {
-				ports = append(ports, PortInfo{
-					Name:     port.Name,
-					Port:     port.ContainerPort,
-					Protocol: string(port.Protocol),
-				})
-			}
-
-			containers = append(containers, ContainerInfo{
-				Name:  container.Name,
-				Ports: ports,
-			})
-		}
-
-		pods = append(pods, PodInfo{
-			Name:       pod.Name,
-			Namespace:  pod.Namespace,
-			Containers: containers,
-			Status:     string(pod.Status.Phase),
-			Created:    pod.CreationTimestamp,
-		})
-	}
-
-	// Sort by creation time (newest first)
-	sort.Slice(pods, func(i, j int) bool {
-		return pods[i].Created.After(pods[j].Created.Time)
-	})
-
-	return pods, nil
-}
-
-// ListPodsWithSelector returns pods matching the given label selector.
-// Selector format: "key=value,key2=value2"
-// Returns an error if the selector is invalid.
-func (d *Discovery) ListPodsWithSelector(ctx context.Context, contextName, namespace, selector string) ([]PodInfo, error) {
-	client, err := d.pool.GetClient(contextName)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get client: %w", err)
-	}
-
-	// Validate selector format
-	selector = strings.TrimSpace(selector)
-	if selector == "" {
-		return nil, fmt.Errorf("selector cannot be empty")
-	}
-
-	podList, err := client.CoreV1().Pods(namespace).List(ctx, metav1.ListOptions{
-		LabelSelector: selector,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("failed to list pods with selector: %w", err)
-	}
-
-	pods := make([]PodInfo, 0)
-	for _, pod := range podList.Items {
-		// Only include Running pods for selector-based forwards
-		if pod.Status.Phase != corev1.PodRunning {
-			continue
-		}
-
-		containers := make([]ContainerInfo, 0, len(pod.Spec.Containers))
-		for _, container := range pod.Spec.Containers {
-			ports := make([]PortInfo, 0, len(container.Ports))
-			for _, port := range container.Ports {
-				ports = append(ports, PortInfo{
-					Name:     port.Name,
-					Port:     port.ContainerPort,
-					Protocol: string(port.Protocol),
-				})
-			}
-
-			containers = append(containers, ContainerInfo{
-				Name:  container.Name,
-				Ports: ports,
-			})
-		}
-
-		pods = append(pods, PodInfo{
-			Name:       pod.Name,
-			Namespace:  pod.Namespace,
-			Containers: containers,
-			Status:     string(pod.Status.Phase),
-			Created:    pod.CreationTimestamp,
-		})
-	}
-
-	// Sort by creation time (newest first)
-	sort.Slice(pods, func(i, j int) bool {
-		return pods[i].Created.After(pods[j].Created.Time)
-	})
-
-	return pods, nil
-}
-
-// resolveTargetPort resolves a service's targetPort to an actual port number.
-// If targetPort is numeric, it returns that number directly.
-// If targetPort is a named port, it looks up the port number from the backing pods.
-// Falls back to the service port if resolution fails.
-func (d *Discovery) resolveTargetPort(ctx context.Context, client kubernetes.Interface, namespace string, svc *corev1.Service, port *corev1.ServicePort) int32 {
-	// If targetPort is not set, Kubernetes defaults to the service port
-	if port.TargetPort.Type == intstr.Int && port.TargetPort.IntVal == 0 {
-		return port.Port
-	}
-
-	// If targetPort is numeric, use it directly
-	if port.TargetPort.Type == intstr.Int {
-		return port.TargetPort.IntVal
-	}
-
-	// targetPort is a named port - need to look up from pods
-	namedPort := port.TargetPort.StrVal
-	if namedPort == "" {
-		return port.Port
-	}
-
-	// Get a backing pod to resolve the named port
-	if len(svc.Spec.Selector) == 0 {
-		// No selector, can't resolve - fall back to service port
-		return port.Port
-	}
-
-	selector := metav1.FormatLabelSelector(&metav1.LabelSelector{MatchLabels: svc.Spec.Selector})
-	pods, err := client.CoreV1().Pods(namespace).List(ctx, metav1.ListOptions{
-		LabelSelector: selector,
-		Limit:         1, // We only need one pod to resolve the port name
-	})
-	if err != nil || len(pods.Items) == 0 {
-		// Can't get pods - fall back to service port
-		return port.Port
-	}
-
-	// Look up the named port in the pod's containers
-	pod := &pods.Items[0]
-	for _, container := range pod.Spec.Containers {
-		for _, containerPort := range container.Ports {
-			if containerPort.Name == namedPort {
-				return containerPort.ContainerPort
-			}
-		}
-	}
-
-	// Named port not found - fall back to service port
-	return port.Port
-}
-
-// ListServices returns all services in the given namespace.
-// For each service port, it resolves the targetPort to an actual port number
-// by looking up the backing pods when the targetPort is a named port.
-func (d *Discovery) ListServices(ctx context.Context, contextName, namespace string) ([]ServiceInfo, error) {
-	client, err := d.pool.GetClient(contextName)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get client: %w", err)
-	}
-
-	svcList, err := client.CoreV1().Services(namespace).List(ctx, metav1.ListOptions{})
-	if err != nil {
-		return nil, fmt.Errorf("failed to list services: %w", err)
-	}
-
-	services := make([]ServiceInfo, 0, len(svcList.Items))
-	for _, svc := range svcList.Items {
-		ports := make([]PortInfo, 0, len(svc.Spec.Ports))
-		for _, port := range svc.Spec.Ports {
-			targetPort := d.resolveTargetPort(ctx, client, namespace, &svc, &port)
-
-			ports = append(ports, PortInfo{
-				Name:       port.Name,
-				Port:       port.Port,
-				TargetPort: targetPort,
-				Protocol:   string(port.Protocol),
-			})
-		}
-
-		services = append(services, ServiceInfo{
-			Name:      svc.Name,
-			Namespace: svc.Namespace,
-			Ports:     ports,
-			Type:      string(svc.Spec.Type),
-		})
-	}
-
-	// Sort alphabetically
-	sort.Slice(services, func(i, j int) bool {
-		return services[i].Name < services[j].Name
-	})
-
-	return services, nil
-}
-
-// GetUniquePorts extracts unique ports from a list of pods.
-// Returns a sorted list of port numbers with their names (if available).
-func GetUniquePorts(pods []PodInfo) []PortInfo {
-	portMap := make(map[int32]string)
-
-	for _, pod := range pods {
-		for _, container := range pod.Containers {
-			for _, port := range container.Ports {
-				// Prefer named ports
-				if _, ok := portMap[port.Port]; !ok || port.Name != "" {
-					if port.Name != "" {
-						portMap[port.Port] = port.Name
-					} else if !ok {
-						portMap[port.Port] = fmt.Sprintf("port-%d", port.Port)
-					}
-				}
-			}
-		}
-	}
-
-	// Convert to slice
-	ports := make([]PortInfo, 0, len(portMap))
-	for port, name := range portMap {
-		ports = append(ports, PortInfo{
-			Name: name,
-			Port: port,
-		})
-	}
-
-	// Sort by port number
-	sort.Slice(ports, func(i, j int) bool {
-		return ports[i].Port < ports[j].Port
-	})
-
-	return ports
-}
-
-// CheckPortAvailability checks if a local port is available.
-// Returns: available (bool), processInfo (string), error
-func CheckPortAvailability(port int) (bool, string, error) {
-	if port < 1 || port > 65535 {
-		return false, "", fmt.Errorf("invalid port: %d", port)
-	}
-
-	// Try to listen on the port
-	addr := fmt.Sprintf(":%d", port)
-	listener, err := net.Listen("tcp", addr)
-	if err != nil {
-		// Port is in use - return error details
-		return false, err.Error(), nil
-	}
-
-	// Port is available, close the listener
-	_ = listener.Close()
-	return true, "", nil
-}

internal/k8s/discovery_test.go

@@ -1,308 +0,0 @@
-package k8s
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/util/intstr"
-	"k8s.io/client-go/kubernetes/fake"
-)
-
-func TestResolveTargetPort(t *testing.T) {
-	tests := []struct {
-		service      *corev1.Service
-		name         string
-		description  string
-		servicePort  corev1.ServicePort
-		pods         []corev1.Pod
-		expectedPort int32
-	}{
-		{
-			name: "numeric targetPort",
-			servicePort: corev1.ServicePort{
-				Port:       80,
-				TargetPort: intstr.FromInt(8000),
-			},
-			service: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-svc",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Selector: map[string]string{"app": "test"},
-				},
-			},
-			pods:         nil, // No pods needed for numeric targetPort
-			expectedPort: 8000,
-			description:  "should use numeric targetPort directly",
-		},
-		{
-			name: "named targetPort resolved from pod",
-			servicePort: corev1.ServicePort{
-				Name:       "http",
-				Port:       80,
-				TargetPort: intstr.FromString("http"),
-			},
-			service: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-svc",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Selector: map[string]string{"app": "test"},
-				},
-			},
-			pods: []corev1.Pod{
-				{
-					ObjectMeta: metav1.ObjectMeta{
-						Name:      "test-pod",
-						Namespace: "default",
-						Labels:    map[string]string{"app": "test"},
-					},
-					Spec: corev1.PodSpec{
-						Containers: []corev1.Container{
-							{
-								Name: "main",
-								Ports: []corev1.ContainerPort{
-									{Name: "http", ContainerPort: 8000},
-								},
-							},
-						},
-					},
-				},
-			},
-			expectedPort: 8000,
-			description:  "should resolve named port from pod container",
-		},
-		{
-			name: "targetPort not set - defaults to service port",
-			servicePort: corev1.ServicePort{
-				Port:       80,
-				TargetPort: intstr.FromInt(0), // Not set
-			},
-			service: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-svc",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Selector: map[string]string{"app": "test"},
-				},
-			},
-			pods:         nil,
-			expectedPort: 80,
-			description:  "should fall back to service port when targetPort is not set",
-		},
-		{
-			name: "named targetPort with no matching pod",
-			servicePort: corev1.ServicePort{
-				Name:       "http",
-				Port:       80,
-				TargetPort: intstr.FromString("http"),
-			},
-			service: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-svc",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Selector: map[string]string{"app": "test"},
-				},
-			},
-			pods:         nil, // No pods available
-			expectedPort: 80,
-			description:  "should fall back to service port when no pods found",
-		},
-		{
-			name: "service without selector",
-			servicePort: corev1.ServicePort{
-				Name:       "http",
-				Port:       80,
-				TargetPort: intstr.FromString("http"),
-			},
-			service: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-svc",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Selector: nil, // No selector
-				},
-			},
-			pods:         nil,
-			expectedPort: 80,
-			description:  "should fall back to service port when service has no selector",
-		},
-		{
-			name: "named targetPort not found in pod containers",
-			servicePort: corev1.ServicePort{
-				Name:       "http",
-				Port:       80,
-				TargetPort: intstr.FromString("nonexistent"),
-			},
-			service: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-svc",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Selector: map[string]string{"app": "test"},
-				},
-			},
-			pods: []corev1.Pod{
-				{
-					ObjectMeta: metav1.ObjectMeta{
-						Name:      "test-pod",
-						Namespace: "default",
-						Labels:    map[string]string{"app": "test"},
-					},
-					Spec: corev1.PodSpec{
-						Containers: []corev1.Container{
-							{
-								Name: "main",
-								Ports: []corev1.ContainerPort{
-									{Name: "http", ContainerPort: 8000},
-								},
-							},
-						},
-					},
-				},
-			},
-			expectedPort: 80,
-			description:  "should fall back to service port when named port not found in pod",
-		},
-		{
-			name: "multiple containers with named port in second container",
-			servicePort: corev1.ServicePort{
-				Name:       "metrics",
-				Port:       9090,
-				TargetPort: intstr.FromString("metrics"),
-			},
-			service: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-svc",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Selector: map[string]string{"app": "test"},
-				},
-			},
-			pods: []corev1.Pod{
-				{
-					ObjectMeta: metav1.ObjectMeta{
-						Name:      "test-pod",
-						Namespace: "default",
-						Labels:    map[string]string{"app": "test"},
-					},
-					Spec: corev1.PodSpec{
-						Containers: []corev1.Container{
-							{
-								Name: "main",
-								Ports: []corev1.ContainerPort{
-									{Name: "http", ContainerPort: 8000},
-								},
-							},
-							{
-								Name: "sidecar",
-								Ports: []corev1.ContainerPort{
-									{Name: "metrics", ContainerPort: 9100},
-								},
-							},
-						},
-					},
-				},
-			},
-			expectedPort: 9100,
-			description:  "should find named port in any container",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Create fake client with pods
-			var objects []runtime.Object
-			for i := range tt.pods {
-				objects = append(objects, &tt.pods[i])
-			}
-			fakeClient := fake.NewClientset(objects...)
-
-			// Create discovery instance (we only need it to call resolveTargetPort)
-			d := &Discovery{}
-
-			// Call resolveTargetPort
-			result := d.resolveTargetPort(
-				context.Background(),
-				fakeClient,
-				"default",
-				tt.service,
-				&tt.servicePort,
-			)
-
-			assert.Equal(t, tt.expectedPort, result, tt.description)
-		})
-	}
-}
-
-func TestPortInfoTargetPort(t *testing.T) {
-	// Test that PortInfo correctly stores TargetPort
-	portInfo := PortInfo{
-		Name:       "http",
-		Port:       80,
-		TargetPort: 8000,
-		Protocol:   "TCP",
-	}
-
-	assert.Equal(t, int32(80), portInfo.Port)
-	assert.Equal(t, int32(8000), portInfo.TargetPort)
-	assert.Equal(t, "http", portInfo.Name)
-	assert.Equal(t, "TCP", portInfo.Protocol)
-}
-
-func TestGetUniquePorts(t *testing.T) {
-	// Test GetUniquePorts still works with the new PortInfo struct
-	pods := []PodInfo{
-		{
-			Name: "pod1",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Name: "http", Port: 8080},
-						{Name: "metrics", Port: 9090},
-					},
-				},
-			},
-		},
-		{
-			Name: "pod2",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Name: "http", Port: 8080}, // Duplicate
-						{Name: "grpc", Port: 50051},
-					},
-				},
-			},
-		},
-	}
-
-	ports := GetUniquePorts(pods)
-
-	// Should have 3 unique ports
-	assert.Len(t, ports, 3)
-
-	// Should be sorted by port number
-	assert.Equal(t, int32(8080), ports[0].Port)
-	assert.Equal(t, int32(9090), ports[1].Port)
-	assert.Equal(t, int32(50051), ports[2].Port)
-
-	// Names should be preserved
-	assert.Equal(t, "http", ports[0].Name)
-	assert.Equal(t, "metrics", ports[1].Name)
-	assert.Equal(t, "grpc", ports[2].Name)
-}

internal/k8s/k8s_api_test.go

@@ -1,601 +0,0 @@
-package k8s
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/util/intstr"
-	"k8s.io/client-go/kubernetes/fake"
-)
-
-// =============================================================================
-// Test Helpers
-// =============================================================================
-
-func setupTestPool(t *testing.T, contextName string, objects ...runtime.Object) *ClientPool {
-	t.Helper()
-
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	fakeClient := fake.NewClientset(objects...)
-	// Type assertion to convert fake client to *kubernetes.Clientset
-	// Note: This works because fake.Clientset embeds *kubernetes.Clientset
-	pool.setTestClient(contextName, fakeClient)
-
-	return pool
-}
-
-// =============================================================================
-// Discovery API Tests
-// =============================================================================
-
-func TestDiscovery_ListNamespaces_WithClient(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Namespace{
-			ObjectMeta: metav1.ObjectMeta{Name: "default"},
-		},
-		&corev1.Namespace{
-			ObjectMeta: metav1.ObjectMeta{Name: "kube-system"},
-		},
-		&corev1.Namespace{
-			ObjectMeta: metav1.ObjectMeta{Name: "production"},
-		},
-	)
-
-	d := NewDiscovery(pool)
-
-	namespaces, err := d.ListNamespaces(t.Context(), "test-context")
-
-	require.NoError(t, err)
-	assert.Len(t, namespaces, 3)
-	assert.Contains(t, namespaces, "default")
-	assert.Contains(t, namespaces, "kube-system")
-	assert.Contains(t, namespaces, "production")
-}
-
-func TestDiscovery_ListNamespaces_Error(t *testing.T) {
-	// Pool without test client - should fail
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	d := NewDiscovery(pool)
-
-	_, err = d.ListNamespaces(t.Context(), "non-existent-context")
-
-	assert.Error(t, err)
-}
-
-func TestDiscovery_ListPods_WithClient(t *testing.T) {
-	baseTime := time.Now()
-
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "running-pod",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-			Spec: corev1.PodSpec{
-				Containers: []corev1.Container{
-					{
-						Name: "main",
-						Ports: []corev1.ContainerPort{
-							{Name: "http", ContainerPort: 8080},
-							{Name: "metrics", ContainerPort: 9090},
-						},
-					},
-				},
-			},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "pending-pod",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime.Add(-time.Hour)},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodPending},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "succeeded-pod",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodSucceeded},
-		},
-	)
-
-	d := NewDiscovery(pool)
-
-	pods, err := d.ListPods(t.Context(), "test-context", "default")
-
-	require.NoError(t, err)
-	// Only Running and Pending pods
-	assert.Len(t, pods, 2)
-
-	// Should be sorted by creation time (newest first)
-	assert.Equal(t, "running-pod", pods[0].Name)
-	assert.Equal(t, "pending-pod", pods[1].Name)
-
-	// Check container info
-	assert.Len(t, pods[0].Containers, 1)
-	assert.Len(t, pods[0].Containers[0].Ports, 2)
-	assert.Equal(t, "http", pods[0].Containers[0].Ports[0].Name)
-	assert.Equal(t, int32(8080), pods[0].Containers[0].Ports[0].Port)
-}
-
-func TestDiscovery_ListPods_EmptyNamespace(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	d := NewDiscovery(pool)
-
-	pods, err := d.ListPods(t.Context(), "test-context", "default")
-
-	require.NoError(t, err)
-	assert.Empty(t, pods)
-}
-
-func TestDiscovery_ListPodsWithSelector_WithClient(t *testing.T) {
-	baseTime := time.Now()
-
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "app-pod-1",
-				Namespace:         "default",
-				Labels:            map[string]string{"app": "myapp"},
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "app-pod-2",
-				Namespace:         "default",
-				Labels:            map[string]string{"app": "myapp"},
-				CreationTimestamp: metav1.Time{Time: baseTime.Add(-time.Hour)},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "other-pod",
-				Namespace:         "default",
-				Labels:            map[string]string{"app": "other"},
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	d := NewDiscovery(pool)
-
-	pods, err := d.ListPodsWithSelector(t.Context(), "test-context", "default", "app=myapp")
-
-	require.NoError(t, err)
-	// Only Running pods with matching selector
-	assert.Len(t, pods, 2)
-
-	names := []string{pods[0].Name, pods[1].Name}
-	assert.Contains(t, names, "app-pod-1")
-	assert.Contains(t, names, "app-pod-2")
-}
-
-func TestDiscovery_ListPodsWithSelector_EmptySelector(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	d := NewDiscovery(pool)
-
-	_, err := d.ListPodsWithSelector(t.Context(), "test-context", "default", "")
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "selector cannot be empty")
-}
-
-func TestDiscovery_ListPodsWithSelector_NoRunningPods(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "pending-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "myapp"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodPending},
-		},
-	)
-
-	d := NewDiscovery(pool)
-
-	pods, err := d.ListPodsWithSelector(t.Context(), "test-context", "default", "app=myapp")
-
-	require.NoError(t, err)
-	assert.Empty(t, pods)
-}
-
-func TestDiscovery_ListServices_WithClient(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "web-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "web"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-			Spec: corev1.PodSpec{
-				Containers: []corev1.Container{
-					{
-						Name: "main",
-						Ports: []corev1.ContainerPort{
-							{Name: "http", ContainerPort: 8080},
-						},
-					},
-				},
-			},
-		},
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "web-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				Type:     corev1.ServiceTypeClusterIP,
-				Selector: map[string]string{"app": "web"},
-				Ports: []corev1.ServicePort{
-					{Name: "http", Port: 80, TargetPort: intstr.FromString("http")},
-				},
-			},
-		},
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "api-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				Type:     corev1.ServiceTypeClusterIP,
-				Selector: map[string]string{"app": "api"},
-				Ports: []corev1.ServicePort{
-					{Port: 8080, TargetPort: intstr.FromInt(8080)},
-				},
-			},
-		},
-	)
-
-	d := NewDiscovery(pool)
-
-	services, err := d.ListServices(t.Context(), "test-context", "default")
-
-	require.NoError(t, err)
-	assert.Len(t, services, 2)
-
-	// Should be sorted alphabetically
-	assert.Equal(t, "api-svc", services[0].Name)
-	assert.Equal(t, "web-svc", services[1].Name)
-
-	// Check port resolution for named port
-	assert.Len(t, services[1].Ports, 1)
-	assert.Equal(t, int32(8080), services[1].Ports[0].TargetPort) // Resolved from pod
-}
-
-func TestDiscovery_ListServices_Empty(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	d := NewDiscovery(pool)
-
-	services, err := d.ListServices(t.Context(), "test-context", "default")
-
-	require.NoError(t, err)
-	assert.Empty(t, services)
-}
-
-// =============================================================================
-// ResourceResolver API Tests
-// =============================================================================
-
-func TestResourceResolver_ResolvePodPrefix_WithClient(t *testing.T) {
-	baseTime := time.Now()
-
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "my-app-xyz789",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "my-app-abc123",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime.Add(-time.Hour)},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "other-app",
-				Namespace: "default",
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-
-	result, err := r.Resolve(t.Context(), "test-context", "default", "pod/my-app", "")
-
-	require.NoError(t, err)
-	// Should return newest pod matching prefix
-	assert.Equal(t, "pod/my-app-xyz789", result)
-}
-
-func TestResourceResolver_ResolvePodPrefix_NotFound(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "other-app",
-				Namespace: "default",
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-
-	_, err := r.Resolve(t.Context(), "test-context", "default", "pod/my-app", "")
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "no running pods found matching prefix")
-}
-
-func TestResourceResolver_ResolvePodSelector_WithClient(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "app-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "myapp"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "other-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "other"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-
-	result, err := r.Resolve(t.Context(), "test-context", "default", "pod", "app=myapp")
-
-	require.NoError(t, err)
-	assert.Equal(t, "pod/app-pod", result)
-}
-
-func TestResourceResolver_ResolvePodSelector_NotFound(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "other-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "other"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-
-	_, err := r.Resolve(t.Context(), "test-context", "default", "pod", "app=myapp")
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "no running pods found matching selector")
-}
-
-func TestResourceResolver_Resolve_Caching(t *testing.T) {
-	baseTime := time.Now()
-
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "my-app-xyz789",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	r.SetCacheTTL(100 * time.Millisecond)
-
-	// First call - hits API
-	result1, err := r.Resolve(t.Context(), "test-context", "default", "pod/my-app", "")
-	require.NoError(t, err)
-
-	// Second call - uses cache
-	result2, err := r.Resolve(t.Context(), "test-context", "default", "pod/my-app", "")
-	require.NoError(t, err)
-	assert.Equal(t, result1, result2)
-
-	// Wait for expiry
-	time.Sleep(150 * time.Millisecond)
-
-	// Third call - hits API again
-	result3, err := r.Resolve(t.Context(), "test-context", "default", "pod/my-app", "")
-	require.NoError(t, err)
-	assert.Equal(t, result1, result3)
-}
-
-// =============================================================================
-// PortForwarder API Tests
-// =============================================================================
-
-func TestPortForwarder_GetPodForResource_Pod(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "my-pod",
-				Namespace: "default",
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	podName, err := pf.GetPodForResource(t.Context(), "test-context", "default", "pod/my-pod", "")
-
-	require.NoError(t, err)
-	assert.Equal(t, "my-pod", podName)
-}
-
-func TestPortForwarder_GetPodForResource_Service(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "backend"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				Selector: map[string]string{"app": "backend"},
-				Ports: []corev1.ServicePort{
-					{Port: 80, TargetPort: intstr.FromInt(8080)},
-				},
-			},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	podName, err := pf.GetPodForResource(t.Context(), "test-context", "default", "service/backend-svc", "")
-
-	require.NoError(t, err)
-	assert.Equal(t, "backend-pod", podName)
-}
-
-func TestPortForwarder_GetPodForResource_ServiceNoSelector(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "headless-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				// No selector
-				Ports: []corev1.ServicePort{
-					{Port: 80, TargetPort: intstr.FromInt(8080)},
-				},
-			},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	_, err := pf.GetPodForResource(t.Context(), "test-context", "default", "service/headless-svc", "")
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "no selector")
-}
-
-func TestPortForwarder_GetPodForResource_ServiceNoRunningPods(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "pending-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "backend"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodPending},
-		},
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				Selector: map[string]string{"app": "backend"},
-				Ports: []corev1.ServicePort{
-					{Port: 80, TargetPort: intstr.FromInt(8080)},
-				},
-			},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	_, err := pf.GetPodForResource(t.Context(), "test-context", "default", "service/backend-svc", "")
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "no running pods found")
-}
-
-func TestPortForwarder_Forward_ServiceResolution(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "backend"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				Selector: map[string]string{"app": "backend"},
-				Ports: []corev1.ServicePort{
-					{Port: 80, TargetPort: intstr.FromInt(8080)},
-				},
-			},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	// Test that service resolution works (Forward will fail on actual port-forward,
-	// but we can test the resolution part)
-	stopChan := make(chan struct{})
-	req := &ForwardRequest{
-		StopChan:    stopChan,
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "service/backend-svc",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	err := pf.Forward(t.Context(), req)
-
-	// Will fail on port-forward setup, but should have resolved the service
-	assert.Error(t, err)
-	// Error should not be about resource resolution
-	assert.NotContains(t, err.Error(), "failed to resolve resource")
-}

internal/k8s/k8s_extended_test.go

@@ -1,588 +0,0 @@
-package k8s
-
-import (
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/util/intstr"
-	"k8s.io/client-go/kubernetes/fake"
-)
-
-// =============================================================================
-// ForwardRequest Tests
-// =============================================================================
-
-func TestForwardRequest_Fields(t *testing.T) {
-	stopChan := make(chan struct{})
-	readyChan := make(chan struct{})
-	outWriter := &mockWriter{}
-	errWriter := &mockWriter{}
-
-	req := &ForwardRequest{
-		Out:         outWriter,
-		ErrOut:      errWriter,
-		StopChan:    stopChan,
-		ReadyChan:   readyChan,
-		ContextName: "test-context",
-		Namespace:   "test-namespace",
-		Resource:    "pod/test-pod",
-		Selector:    "app=test",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	assert.Equal(t, outWriter, req.Out)
-	assert.Equal(t, errWriter, req.ErrOut)
-	assert.Equal(t, stopChan, req.StopChan)
-	assert.Equal(t, readyChan, req.ReadyChan)
-	assert.Equal(t, "test-context", req.ContextName)
-	assert.Equal(t, "test-namespace", req.Namespace)
-	assert.Equal(t, "pod/test-pod", req.Resource)
-	assert.Equal(t, "app=test", req.Selector)
-	assert.Equal(t, 8080, req.LocalPort)
-	assert.Equal(t, 80, req.RemotePort)
-}
-
-func TestForwardRequest_NilWriters(t *testing.T) {
-	stopChan := make(chan struct{})
-	readyChan := make(chan struct{})
-
-	req := &ForwardRequest{
-		Out:         nil,
-		ErrOut:      nil,
-		StopChan:    stopChan,
-		ReadyChan:   readyChan,
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "pod/test-pod",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	// nil writers should be acceptable
-	assert.Nil(t, req.Out)
-	assert.Nil(t, req.ErrOut)
-}
-
-// mockWriter is a test double for io.Writer
-type mockWriter struct {
-	written []byte
-}
-
-func (m *mockWriter) Write(p []byte) (n int, err error) {
-	m.written = append(m.written, p...)
-	return len(p), nil
-}
-
-// =============================================================================
-// PortForwarder Extended Tests
-// =============================================================================
-
-func TestPortForwarder_ForwardRequestValidation(t *testing.T) {
-	pool, _ := NewClientPool()
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	ctx := t.Context()
-
-	tests := []struct {
-		name        string
-		resource    string
-		errContains string
-		expectedErr bool
-	}{
-		{
-			name:        "invalid resource format - no slash",
-			resource:    "invalid",
-			expectedErr: true,
-			errContains: "unsupported resource type",
-		},
-		{
-			name:        "unsupported resource type",
-			resource:    "deployment/my-deployment",
-			expectedErr: true,
-			errContains: "unsupported resource type",
-		},
-		{
-			name:        "empty resource",
-			resource:    "",
-			expectedErr: true,
-			errContains: "unsupported resource type",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			stopChan := make(chan struct{})
-			req := &ForwardRequest{
-				StopChan:    stopChan,
-				ContextName: "test-context",
-				Namespace:   "default",
-				Resource:    tt.resource,
-				LocalPort:   8080,
-				RemotePort:  80,
-			}
-
-			err := pf.Forward(ctx, req)
-
-			assert.Error(t, err)
-			assert.Contains(t, err.Error(), tt.errContains)
-		})
-	}
-}
-
-// =============================================================================
-// Discovery Method Tests (with fake client integration)
-// =============================================================================
-
-func TestDiscovery_ListNamespaces_WithFakeClient(t *testing.T) {
-	objects := []runtime.Object{
-		createTestNamespace("default"),
-		createTestNamespace("kube-system"),
-		createTestNamespace("production"),
-	}
-
-	fakeClient := fake.NewClientset(objects...)
-
-	ctx := t.Context()
-	nsList, err := fakeClient.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
-	require.NoError(t, err)
-
-	namespaces := make([]string, 0, len(nsList.Items))
-	for _, ns := range nsList.Items {
-		namespaces = append(namespaces, ns.Name)
-	}
-
-	assert.Len(t, namespaces, 3)
-	assert.Contains(t, namespaces, "default")
-	assert.Contains(t, namespaces, "kube-system")
-	assert.Contains(t, namespaces, "production")
-}
-
-func TestDiscovery_ListServices_WithPorts(t *testing.T) {
-	objects := []runtime.Object{
-		createTestService("web-svc", "default", map[string]string{"app": "web"}, []corev1.ServicePort{
-			{Name: "http", Port: 80, TargetPort: intstr.FromInt(8080)},
-			{Name: "https", Port: 443, TargetPort: intstr.FromInt(8443)},
-		}),
-		createTestService("api-svc", "default", map[string]string{"app": "api"}, []corev1.ServicePort{
-			{Port: 8080, TargetPort: intstr.FromInt(8080)},
-		}),
-	}
-
-	fakeClient := fake.NewClientset(objects...)
-
-	ctx := t.Context()
-	svcList, err := fakeClient.CoreV1().Services("default").List(ctx, metav1.ListOptions{})
-
-	require.NoError(t, err)
-	assert.Len(t, svcList.Items, 2)
-
-	// Verify service with multiple ports
-	var webSvc *corev1.Service
-	for i := range svcList.Items {
-		if svcList.Items[i].Name == "web-svc" {
-			webSvc = &svcList.Items[i]
-			break
-		}
-	}
-	require.NotNil(t, webSvc)
-	assert.Len(t, webSvc.Spec.Ports, 2)
-
-	// Verify port details
-	foundHTTP := false
-	foundHTTPS := false
-	for _, port := range webSvc.Spec.Ports {
-		if port.Name == "http" {
-			foundHTTP = true
-			assert.Equal(t, int32(80), port.Port)
-			assert.Equal(t, int32(8080), port.TargetPort.IntVal)
-		}
-		if port.Name == "https" {
-			foundHTTPS = true
-			assert.Equal(t, int32(443), port.Port)
-			assert.Equal(t, int32(8443), port.TargetPort.IntVal)
-		}
-	}
-	assert.True(t, foundHTTP, "http port not found")
-	assert.True(t, foundHTTPS, "https port not found")
-}
-
-// =============================================================================
-// ContainerInfo and PortInfo Tests
-// =============================================================================
-
-func TestContainerInfo_Struct(t *testing.T) {
-	container := ContainerInfo{
-		Name: "test-container",
-		Ports: []PortInfo{
-			{Name: "http", Port: 8080, Protocol: "TCP"},
-			{Name: "grpc", Port: 50051, Protocol: "TCP"},
-		},
-	}
-
-	assert.Equal(t, "test-container", container.Name)
-	assert.Len(t, container.Ports, 2)
-	assert.Equal(t, "http", container.Ports[0].Name)
-	assert.Equal(t, int32(8080), container.Ports[0].Port)
-	assert.Equal(t, "TCP", container.Ports[0].Protocol)
-}
-
-func TestPortInfo_Struct(t *testing.T) {
-	port := PortInfo{
-		Name:       "test-port",
-		Protocol:   "TCP",
-		Port:       8080,
-		TargetPort: 80,
-	}
-
-	assert.Equal(t, "test-port", port.Name)
-	assert.Equal(t, "TCP", port.Protocol)
-	assert.Equal(t, int32(8080), port.Port)
-	assert.Equal(t, int32(80), port.TargetPort)
-}
-
-// =============================================================================
-// GetUniquePorts Edge Cases
-// =============================================================================
-
-func TestGetUniquePorts_MultipleContainers(t *testing.T) {
-	pods := []PodInfo{
-		{
-			Name: "pod1",
-			Containers: []ContainerInfo{
-				{
-					Name: "app",
-					Ports: []PortInfo{
-						{Name: "http", Port: 8080},
-					},
-				},
-				{
-					Name: "sidecar",
-					Ports: []PortInfo{
-						{Name: "metrics", Port: 9090},
-					},
-				},
-			},
-		},
-	}
-
-	result := GetUniquePorts(pods)
-	assert.Len(t, result, 2)
-
-	ports := make([]int32, len(result))
-	for i, p := range result {
-		ports[i] = p.Port
-	}
-	assert.Contains(t, ports, int32(8080))
-	assert.Contains(t, ports, int32(9090))
-}
-
-func TestGetUniquePorts_DuplicateAcrossPods(t *testing.T) {
-	pods := []PodInfo{
-		{
-			Name: "pod1",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Name: "http", Port: 8080},
-					},
-				},
-			},
-		},
-		{
-			Name: "pod2",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Name: "http", Port: 8080}, // Same port, same name
-					},
-				},
-			},
-		},
-	}
-
-	result := GetUniquePorts(pods)
-	assert.Len(t, result, 1)
-	assert.Equal(t, int32(8080), result[0].Port)
-	assert.Equal(t, "http", result[0].Name)
-}
-
-func TestGetUniquePorts_NamedVsUnnamedDuplicate(t *testing.T) {
-	pods := []PodInfo{
-		{
-			Name: "pod1",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Port: 8080}, // Unnamed - generates "port-8080"
-					},
-				},
-			},
-		},
-		{
-			Name: "pod2",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Name: "http", Port: 8080}, // Named - should take precedence
-					},
-				},
-			},
-		},
-	}
-
-	result := GetUniquePorts(pods)
-	assert.Len(t, result, 1)
-	assert.Equal(t, int32(8080), result[0].Port)
-	assert.Equal(t, "http", result[0].Name, "named port should take precedence over generated name")
-}
-
-// =============================================================================
-// Cache Entry Tests
-// =============================================================================
-
-func TestCacheEntry_Struct(t *testing.T) {
-	now := time.Now()
-	entry := cacheEntry{
-		expiresAt: now.Add(30 * time.Second),
-		resource: ResolvedResource{
-			Timestamp: now,
-			Name:      "test-pod",
-			Namespace: "default",
-		},
-	}
-
-	assert.Equal(t, now.Add(30*time.Second), entry.expiresAt)
-	assert.Equal(t, "test-pod", entry.resource.Name)
-	assert.Equal(t, "default", entry.resource.Namespace)
-	assert.Equal(t, now, entry.resource.Timestamp)
-}
-
-// =============================================================================
-// ClientPool Extended Tests
-// =============================================================================
-
-func TestClientPool_ConcurrentAccess(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	var wg sync.WaitGroup
-
-	// Concurrent reads and writes to cache
-	for i := 0; i < 20; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			pool.ClearCache()
-			pool.RemoveContext("context")
-			_, _ = pool.GetCurrentContext()
-			_, _ = pool.ListContexts()
-		}(i)
-	}
-
-	wg.Wait()
-	// If we get here without panic, concurrent access is safe
-}
-
-func TestClientPool_MultipleContexts(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	// Test that multiple contexts can be tracked
-	pool.mu.Lock()
-	pool.clients["context1"] = nil
-	pool.clients["context2"] = nil
-	pool.clients["context3"] = nil
-	pool.mu.Unlock()
-
-	// Remove one context
-	pool.RemoveContext("context2")
-
-	// Verify context2 is removed
-	pool.mu.RLock()
-	_, exists1 := pool.clients["context1"]
-	_, exists2 := pool.clients["context2"]
-	_, exists3 := pool.clients["context3"]
-	pool.mu.RUnlock()
-
-	assert.True(t, exists1)
-	assert.False(t, exists2)
-	assert.True(t, exists3)
-
-	// Clear all
-	pool.ClearCache()
-
-	pool.mu.RLock()
-	assert.Equal(t, 0, len(pool.clients))
-	pool.mu.RUnlock()
-}
-
-// =============================================================================
-// ResourceResolver Resolve Tests (using internal methods)
-// =============================================================================
-
-func TestResourceResolver_Resolve_InvalidFormat(t *testing.T) {
-	pool, _ := NewClientPool()
-	r := NewResourceResolver(pool)
-
-	ctx := t.Context()
-
-	tests := []struct {
-		name        string
-		resource    string
-		selector    string
-		errContains string
-	}{
-		{
-			name:        "unsupported resource type",
-			resource:    "configmap/my-config",
-			selector:    "",
-			errContains: "unsupported resource type",
-		},
-		{
-			name:        "pod without prefix or selector",
-			resource:    "pod",
-			selector:    "",
-			errContains: "pod resource requires either a name prefix",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			_, err := r.Resolve(ctx, "test-context", "default", tt.resource, tt.selector)
-			assert.Error(t, err)
-			assert.Contains(t, err.Error(), tt.errContains)
-		})
-	}
-}
-
-func TestResourceResolver_Resolve_ServiceVariations(t *testing.T) {
-	pool, _ := NewClientPool()
-	r := NewResourceResolver(pool)
-
-	ctx := t.Context()
-
-	tests := []struct {
-		name     string
-		resource string
-		expected string
-	}{
-		{
-			name:     "simple service",
-			resource: "service/my-service",
-			expected: "service/my-service",
-		},
-		{
-			name:     "service with namespace in name",
-			resource: "service/my-service.namespace",
-			expected: "service/my-service.namespace",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := r.Resolve(ctx, "test-context", "default", tt.resource, "")
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// =============================================================================
-// resolveTargetPort Extended Tests
-// =============================================================================
-
-func TestResolveTargetPort_EdgeCases(t *testing.T) {
-	tests := []struct {
-		name        string
-		service     *corev1.Service
-		servicePort corev1.ServicePort
-		pods        []corev1.Pod
-		expected    int32
-	}{
-		{
-			name: "zero value targetPort returns service port",
-			service: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{Name: "svc", Namespace: "default"},
-				Spec: corev1.ServiceSpec{
-					Selector: map[string]string{"app": "test"},
-					Ports:    []corev1.ServicePort{{Port: 80}},
-				},
-			},
-			servicePort: corev1.ServicePort{
-				Port: 80,
-				// TargetPort is zero value
-			},
-			pods:     nil,
-			expected: 80,
-		},
-		{
-			name: "empty named port returns service port",
-			service: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{Name: "svc", Namespace: "default"},
-				Spec: corev1.ServiceSpec{
-					Selector: map[string]string{"app": "test"},
-				},
-			},
-			servicePort: corev1.ServicePort{
-				Port:       80,
-				TargetPort: intstr.FromString(""), // Empty string
-			},
-			pods:     nil,
-			expected: 80,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var objects []runtime.Object
-			for i := range tt.pods {
-				objects = append(objects, &tt.pods[i])
-			}
-			fakeClient := fake.NewClientset(objects...)
-			d := &Discovery{}
-
-			result := d.resolveTargetPort(t.Context(), fakeClient, "default", tt.service, &tt.servicePort)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// =============================================================================
-// PortForwarder Settings Tests
-// =============================================================================
-
-func TestPortForwarder_DefaultSettings(t *testing.T) {
-	pool, _ := NewClientPool()
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	// Verify defaults are set
-	assert.NotZero(t, pf.tcpKeepalive)
-	assert.NotZero(t, pf.dialTimeout)
-}
-
-func TestPortForwarder_SettingsChain(t *testing.T) {
-	pool, _ := NewClientPool()
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	// Chain multiple settings
-	pf.SetTCPKeepalive(60 * time.Second)
-	pf.SetDialTimeout(45 * time.Second)
-	pf.SetTCPKeepalive(30 * time.Second) // Override
-
-	assert.Equal(t, 30*time.Second, pf.tcpKeepalive)
-	assert.Equal(t, 45*time.Second, pf.dialTimeout)
-}

internal/k8s/k8s_test.go

@@ -1,929 +0,0 @@
-package k8s
-
-import (
-	"context"
-	"net"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/util/intstr"
-	"k8s.io/client-go/kubernetes/fake"
-)
-
-// =============================================================================
-// Test Helpers
-// =============================================================================
-
-func createTestPod(name, namespace string, labels map[string]string, phase corev1.PodPhase, creationTime time.Time) *corev1.Pod {
-	return &corev1.Pod{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:              name,
-			Namespace:         namespace,
-			Labels:            labels,
-			CreationTimestamp: metav1.Time{Time: creationTime},
-		},
-		Status: corev1.PodStatus{
-			Phase: phase,
-		},
-		Spec: corev1.PodSpec{
-			Containers: []corev1.Container{
-				{
-					Name: "main",
-					Ports: []corev1.ContainerPort{
-						{Name: "http", ContainerPort: 8080},
-						{Name: "metrics", ContainerPort: 9090},
-					},
-				},
-			},
-		},
-	}
-}
-
-func createTestService(name, namespace string, selector map[string]string, ports []corev1.ServicePort) *corev1.Service {
-	return &corev1.Service{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: namespace,
-		},
-		Spec: corev1.ServiceSpec{
-			Selector: selector,
-			Ports:    ports,
-			Type:     corev1.ServiceTypeClusterIP,
-		},
-	}
-}
-
-func createTestNamespace(name string) *corev1.Namespace {
-	return &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: name,
-		},
-	}
-}
-
-// =============================================================================
-// Discovery Tests
-// =============================================================================
-
-func TestNewDiscovery(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	d := NewDiscovery(pool)
-
-	assert.NotNil(t, d)
-	assert.Equal(t, pool, d.pool)
-}
-
-func TestDiscovery_ListNamespaces(t *testing.T) {
-	tests := []struct {
-		name        string
-		errContains string
-		objects     []runtime.Object
-		expectedNS  []string
-		expectedErr bool
-	}{
-		{
-			name: "successful namespace listing",
-			objects: []runtime.Object{
-				createTestNamespace("default"),
-				createTestNamespace("kube-system"),
-				createTestNamespace("production"),
-			},
-			expectedNS: []string{"default", "kube-system", "production"},
-		},
-		{
-			name:       "empty namespace list",
-			objects:    []runtime.Object{},
-			expectedNS: []string{},
-		},
-		{
-			name:       "single namespace",
-			objects:    []runtime.Object{createTestNamespace("default")},
-			expectedNS: []string{"default"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			fakeClient := fake.NewClientset(tt.objects...)
-
-			// Directly test with fake client
-			ctx := context.Background()
-			nsList, err := fakeClient.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
-			require.NoError(t, err)
-
-			namespaces := make([]string, 0, len(nsList.Items))
-			for _, ns := range nsList.Items {
-				namespaces = append(namespaces, ns.Name)
-			}
-
-			assert.Equal(t, tt.expectedNS, namespaces)
-		})
-	}
-}
-
-func TestDiscovery_ListPods(t *testing.T) {
-	baseTime := time.Now()
-
-	tests := []struct {
-		validateFn  func(t *testing.T, pods *corev1.PodList)
-		name        string
-		objects     []runtime.Object
-		expectedLen int
-	}{
-		{
-			name: "list all pods in namespace",
-			objects: []runtime.Object{
-				createTestPod("running-pod", "default", nil, corev1.PodRunning, baseTime),
-				createTestPod("pending-pod", "default", nil, corev1.PodPending, baseTime.Add(-time.Hour)),
-				createTestPod("succeeded-pod", "default", nil, corev1.PodSucceeded, baseTime),
-			},
-			expectedLen: 3,
-			validateFn: func(t *testing.T, pods *corev1.PodList) {
-				// Verify all pods are returned
-				names := make([]string, len(pods.Items))
-				for i, p := range pods.Items {
-					names[i] = p.Name
-				}
-				assert.Contains(t, names, "running-pod")
-				assert.Contains(t, names, "pending-pod")
-				assert.Contains(t, names, "succeeded-pod")
-			},
-		},
-		{
-			name:        "empty pod list",
-			objects:     []runtime.Object{},
-			expectedLen: 0,
-		},
-		{
-			name: "pods in different namespaces",
-			objects: []runtime.Object{
-				createTestPod("pod-default", "default", nil, corev1.PodRunning, baseTime),
-				createTestPod("pod-kube-system", "kube-system", nil, corev1.PodRunning, baseTime),
-			},
-			expectedLen: 1,
-			validateFn: func(t *testing.T, pods *corev1.PodList) {
-				assert.Equal(t, "default", pods.Items[0].Namespace)
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			fakeClient := fake.NewClientset(tt.objects...)
-
-			ctx := context.Background()
-			var listOpts metav1.ListOptions
-			// List pods in the default namespace (test name indicates filtering intent)
-			pods, err := fakeClient.CoreV1().Pods("default").List(ctx, listOpts)
-			require.NoError(t, err)
-			assert.Len(t, pods.Items, tt.expectedLen)
-
-			if tt.validateFn != nil {
-				tt.validateFn(t, pods)
-			}
-		})
-	}
-}
-
-func TestDiscovery_ListPodsWithSelector(t *testing.T) {
-	baseTime := time.Now()
-
-	tests := []struct {
-		validateFn  func(t *testing.T, pods *corev1.PodList)
-		name        string
-		selector    string
-		objects     []runtime.Object
-		expectedLen int
-	}{
-		{
-			name: "match pods by label selector",
-			objects: []runtime.Object{
-				createTestPod("app1-pod", "default", map[string]string{"app": "myapp"}, corev1.PodRunning, baseTime),
-				createTestPod("app2-pod", "default", map[string]string{"app": "myapp"}, corev1.PodRunning, baseTime.Add(-time.Hour)),
-				createTestPod("other-pod", "default", map[string]string{"app": "other"}, corev1.PodRunning, baseTime),
-			},
-			selector:    "app=myapp",
-			expectedLen: 2,
-			validateFn: func(t *testing.T, pods *corev1.PodList) {
-				names := make([]string, len(pods.Items))
-				for i, p := range pods.Items {
-					names[i] = p.Name
-				}
-				assert.Contains(t, names, "app1-pod")
-				assert.Contains(t, names, "app2-pod")
-			},
-		},
-		{
-			name: "only running pods returned",
-			objects: []runtime.Object{
-				createTestPod("running-pod", "default", map[string]string{"app": "test"}, corev1.PodRunning, baseTime),
-				createTestPod("pending-pod", "default", map[string]string{"app": "test"}, corev1.PodPending, baseTime),
-			},
-			selector:    "app=test",
-			expectedLen: 2, // Fake client returns all, filtering is done in ListPodsWithSelector
-		},
-		{
-			name:        "no matching pods",
-			objects:     []runtime.Object{},
-			selector:    "app=nonexistent",
-			expectedLen: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			fakeClient := fake.NewClientset(tt.objects...)
-
-			ctx := context.Background()
-			pods, err := fakeClient.CoreV1().Pods("default").List(ctx, metav1.ListOptions{
-				LabelSelector: tt.selector,
-			})
-
-			require.NoError(t, err)
-			assert.Len(t, pods.Items, tt.expectedLen)
-
-			if tt.validateFn != nil {
-				tt.validateFn(t, pods)
-			}
-		})
-	}
-}
-
-func TestDiscovery_ListServices(t *testing.T) {
-	tests := []struct {
-		validateFn  func(t *testing.T, services *corev1.ServiceList)
-		name        string
-		objects     []runtime.Object
-		expectedLen int
-	}{
-		{
-			name: "list services",
-			objects: []runtime.Object{
-				createTestService("svc1", "default", map[string]string{"app": "test"}, []corev1.ServicePort{
-					{Port: 80, TargetPort: intstr.FromInt(8080)},
-				}),
-				createTestService("svc2", "default", map[string]string{"app": "other"}, []corev1.ServicePort{
-					{Port: 443, TargetPort: intstr.FromInt(8443)},
-				}),
-			},
-			expectedLen: 2,
-			validateFn: func(t *testing.T, services *corev1.ServiceList) {
-				names := make([]string, len(services.Items))
-				for i, s := range services.Items {
-					names[i] = s.Name
-				}
-				assert.Contains(t, names, "svc1")
-				assert.Contains(t, names, "svc2")
-			},
-		},
-		{
-			name:        "empty service list",
-			objects:     []runtime.Object{},
-			expectedLen: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			fakeClient := fake.NewClientset(tt.objects...)
-
-			ctx := context.Background()
-			services, err := fakeClient.CoreV1().Services("default").List(ctx, metav1.ListOptions{})
-
-			require.NoError(t, err)
-			assert.Len(t, services.Items, tt.expectedLen)
-
-			if tt.validateFn != nil {
-				tt.validateFn(t, services)
-			}
-		})
-	}
-}
-
-// =============================================================================
-// CheckPortAvailability Tests
-// =============================================================================
-
-func TestCheckPortAvailability(t *testing.T) {
-	tests := []struct {
-		name           string
-		expectedErrMsg string
-		port           int
-		expectedAvail  bool
-		expectedErr    bool
-	}{
-		{
-			name:           "port 0 is invalid",
-			port:           0,
-			expectedAvail:  false,
-			expectedErr:    true,
-			expectedErrMsg: "invalid port",
-		},
-		{
-			name:           "negative port is invalid",
-			port:           -1,
-			expectedAvail:  false,
-			expectedErr:    true,
-			expectedErrMsg: "invalid port",
-		},
-		{
-			name:           "port too high is invalid",
-			port:           65536,
-			expectedAvail:  false,
-			expectedErr:    true,
-			expectedErrMsg: "invalid port",
-		},
-		{
-			name:           "valid high port should be available",
-			port:           65535,
-			expectedAvail:  true,
-			expectedErr:    false,
-			expectedErrMsg: "",
-		},
-		{
-			name:           "common high port should be available",
-			port:           8080,
-			expectedAvail:  true,
-			expectedErr:    false,
-			expectedErrMsg: "",
-		},
-		{
-			name:           "lowest valid port",
-			port:           1,
-			expectedAvail:  true,
-			expectedErr:    false,
-			expectedErrMsg: "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			available, processInfo, err := CheckPortAvailability(tt.port)
-
-			if tt.expectedErr {
-				assert.False(t, available)
-				assert.Error(t, err)
-				assert.Empty(t, processInfo)
-				assert.Contains(t, err.Error(), tt.expectedErrMsg)
-				return
-			}
-
-			// For valid ports, we can only reliably test that no error occurs
-			// Port might be in use by system or other tests
-			require.NoError(t, err)
-
-			if available {
-				assert.Empty(t, processInfo)
-			}
-		})
-	}
-}
-
-func TestCheckPortAvailability_PortInUse(t *testing.T) {
-	// Start a listener on a specific port on all interfaces
-	// #nosec G102 - Binding to all interfaces is intentional for this test
-	listener, err := net.Listen("tcp", ":0")
-	require.NoError(t, err)
-	defer func() {
-		_ = listener.Close() // Error ignored - best effort cleanup
-	}()
-
-	// Get the port that was assigned
-	port := listener.Addr().(*net.TCPAddr).Port
-
-	// Check that the port is reported as in use
-	available, processInfo, err := CheckPortAvailability(port)
-	require.NoError(t, err)
-	assert.False(t, available)
-	assert.NotEmpty(t, processInfo)
-}
-
-// =============================================================================
-// ResourceResolver Tests
-// =============================================================================
-
-func TestNewResourceResolver(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	r := NewResourceResolver(pool)
-
-	assert.NotNil(t, r)
-	assert.Equal(t, pool, r.clientPool)
-	assert.NotNil(t, r.cache)
-	assert.Equal(t, defaultCacheTTL, r.cacheTTL)
-}
-
-func TestResourceResolver_SetCacheTTL(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-
-	newTTL := 5 * time.Minute
-	r.SetCacheTTL(newTTL)
-
-	assert.Equal(t, newTTL, r.cacheTTL)
-}
-
-func TestResourceResolver_Resolve_Service(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-
-	tests := []struct {
-		name        string
-		resource    string
-		expected    string
-		errContains string
-		expectedErr bool
-	}{
-		{
-			name:     "valid service resource",
-			resource: "service/my-service",
-			expected: "service/my-service",
-		},
-		{
-			// Note: "service/" returns the resource as-is (current behavior)
-			name:     "service with empty name part",
-			resource: "service/",
-			expected: "service/",
-		},
-		{
-			name:        "service without slash returns error",
-			resource:    "service",
-			expectedErr: true,
-			errContains: "invalid service resource format",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-			result, err := r.Resolve(ctx, "test-context", "default", tt.resource, "")
-
-			if tt.expectedErr {
-				assert.Error(t, err)
-				if tt.errContains != "" {
-					assert.Contains(t, err.Error(), tt.errContains)
-				}
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestResourceResolver_Resolve_UnsupportedType(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-
-	ctx := context.Background()
-	result, err := r.Resolve(ctx, "test-context", "default", "deployment/my-deploy", "")
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "unsupported resource type")
-	assert.Empty(t, result)
-}
-
-func TestResourceResolver_Resolve_PodWithoutPrefixOrSelector(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-
-	ctx := context.Background()
-	result, err := r.Resolve(ctx, "test-context", "default", "pod", "")
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "pod resource requires either a name prefix")
-	assert.Empty(t, result)
-}
-
-func TestResourceResolver_Cache_Operations(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-
-	// Test putInCache and getFromCache
-	key := "test-context/default/pod/test"
-	value := "test-pod-123"
-
-	// Initially empty
-	result := r.getFromCache(key)
-	assert.Empty(t, result)
-
-	// Put in cache
-	r.putInCache(key, value)
-
-	// Should be retrievable
-	result = r.getFromCache(key)
-	assert.Equal(t, value, result)
-}
-
-func TestResourceResolver_Cache_Expiry(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-
-	// Set very short TTL
-	r.SetCacheTTL(50 * time.Millisecond)
-
-	key := "test-context/default/pod/test"
-	value := "test-pod-123"
-
-	// Put in cache
-	r.putInCache(key, value)
-
-	// Should be immediately retrievable
-	result := r.getFromCache(key)
-	assert.Equal(t, value, result)
-
-	// Wait for expiry
-	time.Sleep(100 * time.Millisecond)
-
-	// Should be expired
-	result = r.getFromCache(key)
-	assert.Empty(t, result)
-
-	// Cache entry should be cleaned up
-	r.cacheMu.RLock()
-	_, exists := r.cache[key]
-	r.cacheMu.RUnlock()
-	assert.False(t, exists)
-}
-
-func TestResourceResolver_Cache_ConcurrentAccess(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-
-	var wg sync.WaitGroup
-	for i := 0; i < 10; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			key := "key"
-			value := "value"
-			r.putInCache(key, value)
-			_ = r.getFromCache(key)
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Verify no race conditions occurred
-	assert.NotNil(t, r.cache)
-}
-
-func TestResourceResolver_ClearCache(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-
-	// Populate cache
-	r.putInCache("key1", "value1")
-	r.putInCache("key2", "value2")
-
-	// Verify cache has entries
-	r.cacheMu.RLock()
-	assert.Greater(t, len(r.cache), 0)
-	r.cacheMu.RUnlock()
-
-	// Clear cache
-	r.ClearCache()
-
-	// Verify cache is empty
-	r.cacheMu.RLock()
-	assert.Equal(t, 0, len(r.cache))
-	r.cacheMu.RUnlock()
-}
-
-func TestResourceResolver_InvalidateCache(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-
-	// Populate cache with multiple entries in same namespace
-	r.putInCache("test-context/default/pod/app1", "pod1")
-	r.putInCache("test-context/default/pod/app2", "pod2")
-	r.putInCache("test-context/other/pod/app1", "pod3")
-
-	// Invalidate for specific namespace
-	r.InvalidateCache("test-context", "default", "pod/app1")
-
-	// All entries for that namespace should be cleared
-	r.cacheMu.RLock()
-	_, exists1 := r.cache["test-context/default/pod/app1"]
-	_, exists2 := r.cache["test-context/default/pod/app2"]
-	_, exists3 := r.cache["test-context/other/pod/app1"]
-	r.cacheMu.RUnlock()
-
-	assert.False(t, exists1)
-	assert.False(t, exists2)
-	assert.True(t, exists3, "other namespace should not be affected")
-}
-
-// =============================================================================
-// PortForwarder Tests
-// =============================================================================
-
-func TestNewPortForwarder(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-
-	pf := NewPortForwarder(pool, r)
-
-	assert.NotNil(t, pf)
-	assert.Equal(t, pool, pf.clientPool)
-	assert.Equal(t, r, pf.resolver)
-	assert.NotZero(t, pf.tcpKeepalive)
-	assert.NotZero(t, pf.dialTimeout)
-}
-
-func TestPortForwarder_SetTCPKeepalive(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	newKeepalive := 60 * time.Second
-	pf.SetTCPKeepalive(newKeepalive)
-
-	assert.Equal(t, newKeepalive, pf.tcpKeepalive)
-}
-
-func TestPortForwarder_SetDialTimeout(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	newTimeout := 45 * time.Second
-	pf.SetDialTimeout(newTimeout)
-
-	assert.Equal(t, newTimeout, pf.dialTimeout)
-}
-
-func TestPortForwarder_Forward_InvalidResource(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	ctx := context.Background()
-	req := &ForwardRequest{
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "invalid-resource",
-	}
-
-	err = pf.Forward(ctx, req)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "unsupported resource type")
-}
-
-func TestForwardRequest_Struct(t *testing.T) {
-	// Test that ForwardRequest struct fields are correctly accessible
-	stopChan := make(chan struct{})
-	readyChan := make(chan struct{})
-
-	req := &ForwardRequest{
-		Out:         nil,
-		ErrOut:      nil,
-		StopChan:    stopChan,
-		ReadyChan:   readyChan,
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "pod/my-pod",
-		Selector:    "",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	assert.Equal(t, "test-context", req.ContextName)
-	assert.Equal(t, "default", req.Namespace)
-	assert.Equal(t, "pod/my-pod", req.Resource)
-	assert.Equal(t, 8080, req.LocalPort)
-	assert.Equal(t, 80, req.RemotePort)
-	assert.Equal(t, stopChan, req.StopChan)
-	assert.Equal(t, readyChan, req.ReadyChan)
-}
-
-// =============================================================================
-// PodInfo and ServiceInfo Tests
-// =============================================================================
-
-func TestPodInfo_Struct(t *testing.T) {
-	now := time.Now()
-	podInfo := PodInfo{
-		Created:   metav1.Time{Time: now},
-		Name:      "test-pod",
-		Namespace: "default",
-		Status:    "Running",
-		Containers: []ContainerInfo{
-			{
-				Name: "main",
-				Ports: []PortInfo{
-					{Name: "http", Port: 8080, Protocol: "TCP"},
-				},
-			},
-		},
-	}
-
-	assert.Equal(t, "test-pod", podInfo.Name)
-	assert.Equal(t, "default", podInfo.Namespace)
-	assert.Equal(t, "Running", podInfo.Status)
-	assert.Len(t, podInfo.Containers, 1)
-	assert.Equal(t, "main", podInfo.Containers[0].Name)
-	assert.Equal(t, int32(8080), podInfo.Containers[0].Ports[0].Port)
-}
-
-func TestServiceInfo_Struct(t *testing.T) {
-	svcInfo := ServiceInfo{
-		Name:      "test-svc",
-		Namespace: "default",
-		Type:      "ClusterIP",
-		Ports: []PortInfo{
-			{Name: "http", Port: 80, TargetPort: 8080, Protocol: "TCP"},
-		},
-	}
-
-	assert.Equal(t, "test-svc", svcInfo.Name)
-	assert.Equal(t, "default", svcInfo.Namespace)
-	assert.Equal(t, "ClusterIP", svcInfo.Type)
-	assert.Len(t, svcInfo.Ports, 1)
-	assert.Equal(t, int32(80), svcInfo.Ports[0].Port)
-	assert.Equal(t, int32(8080), svcInfo.Ports[0].TargetPort)
-}
-
-// =============================================================================
-// ResolvedResource Tests
-// =============================================================================
-
-func TestResolvedResource_Struct(t *testing.T) {
-	now := time.Now()
-	resource := ResolvedResource{
-		Timestamp: now,
-		Name:      "my-pod",
-		Namespace: "default",
-	}
-
-	assert.Equal(t, "my-pod", resource.Name)
-	assert.Equal(t, "default", resource.Namespace)
-	assert.Equal(t, now, resource.Timestamp)
-}
-
-// =============================================================================
-// GetUniquePorts Additional Tests
-// =============================================================================
-
-func TestGetUniquePorts_EmptyInput(t *testing.T) {
-	result := GetUniquePorts([]PodInfo{})
-	assert.Empty(t, result)
-}
-
-func TestGetUniquePorts_SinglePod(t *testing.T) {
-	pods := []PodInfo{
-		{
-			Name: "single-pod",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Name: "http", Port: 8080},
-					},
-				},
-			},
-		},
-	}
-
-	result := GetUniquePorts(pods)
-	assert.Len(t, result, 1)
-	assert.Equal(t, int32(8080), result[0].Port)
-	assert.Equal(t, "http", result[0].Name)
-}
-
-func TestGetUniquePorts_NoNamedPorts(t *testing.T) {
-	pods := []PodInfo{
-		{
-			Name: "pod1",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Port: 8080}, // No name
-					},
-				},
-			},
-		},
-	}
-
-	result := GetUniquePorts(pods)
-	assert.Len(t, result, 1)
-	assert.Equal(t, int32(8080), result[0].Port)
-	assert.Equal(t, "port-8080", result[0].Name)
-}
-
-func TestGetUniquePorts_PreferNamedOverGenerated(t *testing.T) {
-	pods := []PodInfo{
-		{
-			Name: "pod1",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Port: 8080}, // No name, generates "port-8080"
-					},
-				},
-			},
-		},
-		{
-			Name: "pod2",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Name: "http", Port: 8080}, // Named port
-					},
-				},
-			},
-		},
-	}
-
-	result := GetUniquePorts(pods)
-	assert.Len(t, result, 1)
-	assert.Equal(t, int32(8080), result[0].Port)
-	assert.Equal(t, "http", result[0].Name, "named port should take precedence")
-}
-
-func TestGetUniquePorts_SortedByPortNumber(t *testing.T) {
-	pods := []PodInfo{
-		{
-			Name: "pod1",
-			Containers: []ContainerInfo{
-				{
-					Name: "main",
-					Ports: []PortInfo{
-						{Name: "high", Port: 9000},
-						{Name: "low", Port: 80},
-						{Name: "mid", Port: 8080},
-					},
-				},
-			},
-		},
-	}
-
-	result := GetUniquePorts(pods)
-	assert.Len(t, result, 3)
-	assert.Equal(t, int32(80), result[0].Port)
-	assert.Equal(t, int32(8080), result[1].Port)
-	assert.Equal(t, int32(9000), result[2].Port)
-}
-
-// =============================================================================
-// Discovery Context Operations Tests
-// =============================================================================
-
-func TestDiscovery_ListContexts(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	d := NewDiscovery(pool)
-
-	// This will either succeed or fail based on kubeconfig availability
-	contexts, err := d.ListContexts()
-
-	if err != nil {
-		// Expected if no kubeconfig
-		assert.Contains(t, err.Error(), "kubeconfig")
-	} else {
-		// If successful, should be a slice
-		assert.NotNil(t, contexts)
-	}
-}
-
-func TestDiscovery_GetCurrentContext(t *testing.T) {
-	pool, err := NewClientPool()
-	require.NoError(t, err)
-
-	d := NewDiscovery(pool)
-
-	// On CI without a kubeconfig, clientcmd returns an empty config with no
-	// error and CurrentContext == "". On a dev box with a real kubeconfig,
-	// CurrentContext is whatever the user has set. Either is valid.
-	_, err = d.GetCurrentContext()
-	if err != nil {
-		assert.Contains(t, err.Error(), "kubeconfig")
-	}
-}

internal/k8s/portforward.go

@@ -4,13 +4,9 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"net"
 	"net/http"
 	"net/url"
 	"strings"
-	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -21,44 +17,30 @@ import (
 
 // PortForwarder handles Kubernetes port-forwarding operations.
 type PortForwarder struct {
-	clientPool   *ClientPool
-	resolver     *ResourceResolver
-	tcpKeepalive time.Duration // TCP keepalive interval
-	dialTimeout  time.Duration // Connection dial timeout
+	clientPool *ClientPool
+	resolver   *ResourceResolver
 }
 
-// NewPortForwarder creates a new PortForwarder instance with default settings.
+// NewPortForwarder creates a new PortForwarder instance.
 func NewPortForwarder(clientPool *ClientPool, resolver *ResourceResolver) *PortForwarder {
 	return &PortForwarder{
-		clientPool:   clientPool,
-		resolver:     resolver,
-		tcpKeepalive: config.DefaultTCPKeepalive,
-		dialTimeout:  config.DefaultDialTimeout,
+		clientPool: clientPool,
+		resolver:   resolver,
 	}
 }
 
-// SetTCPKeepalive configures the TCP keepalive interval for new connections.
-func (pf *PortForwarder) SetTCPKeepalive(keepalive time.Duration) {
-	pf.tcpKeepalive = keepalive
-}
-
-// SetDialTimeout configures the connection dial timeout.
-func (pf *PortForwarder) SetDialTimeout(timeout time.Duration) {
-	pf.dialTimeout = timeout
-}
-
 // ForwardRequest contains the parameters for a port-forward request.
 type ForwardRequest struct {
-	Out         io.Writer
-	ErrOut      io.Writer
+	ContextName string // Kubernetes context name
+	Namespace   string // Namespace
+	Resource    string // Resource (pod/name or service/name)
+	Selector    string // Label selector (for pod resolution)
+	LocalPort   int    // Local port
+	RemotePort  int    // Remote port
 	StopChan    chan struct{}
 	ReadyChan   chan struct{}
-	ContextName string
-	Namespace   string
-	Resource    string
-	Selector    string
-	LocalPort   int
-	RemotePort  int
+	Out         io.Writer // Output writer for logs
+	ErrOut      io.Writer // Error output writer
 }
 
 // Forward establishes a port-forward connection to a Kubernetes resource.
@@ -142,9 +124,6 @@ func (pf *PortForwarder) forwardToService(ctx context.Context, req *ForwardReque
 	}
 
 	// Get pods backing the service using label selector
-	if len(service.Spec.Selector) == 0 {
-		return fmt.Errorf("service %s has no selector (headless service without selector cannot be port-forwarded)", serviceName)
-	}
 	selector := metav1.FormatLabelSelector(&metav1.LabelSelector{MatchLabels: service.Spec.Selector})
 	pods, err := client.CoreV1().Pods(req.Namespace).List(ctx, metav1.ListOptions{
 		LabelSelector: selector,
@@ -185,27 +164,8 @@ func (pf *PortForwarder) forwardToService(ctx context.Context, req *ForwardReque
 
 // executePortForward performs the actual port-forward operation.
 func (pf *PortForwarder) executePortForward(config *rest.Config, url *url.URL, req *ForwardRequest) error {
-	// Clone the rest.Config before mutating. ClientPool.GetRestConfig returns a
-	// cached pointer shared across all forwards on the same context; mutating
-	// config.Dial directly causes a write-write race when multiple forwards
-	// run concurrently against the same context.
-	cfg := rest.CopyConfig(config)
-
-	// Configure TCP settings on the underlying connection
-	// This is set in the rest.Config which will be used by the SPDY transport
-	if cfg.Dial == nil {
-		// Create a custom dialer with configurable timeout and keepalive
-		// - Timeout: How long to wait for connection to establish
-		// - KeepAlive: TCP keepalive helps OS detect dead connections at network layer
-		dialer := &net.Dialer{
-			Timeout:   pf.dialTimeout,  // Configurable dial timeout
-			KeepAlive: pf.tcpKeepalive, // Configurable keepalive interval
-		}
-		cfg.Dial = dialer.DialContext
-	}
-
 	// Create SPDY roundtripper
-	transport, upgrader, err := spdy.RoundTripperFor(cfg)
+	transport, upgrader, err := spdy.RoundTripperFor(config)
 	if err != nil {
 		return fmt.Errorf("failed to create round tripper: %w", err)
 	}
@@ -268,9 +228,6 @@ func (pf *PortForwarder) GetPodForResource(ctx context.Context, contextName, nam
 			return "", fmt.Errorf("failed to get service: %w", err)
 		}
 
-		if len(service.Spec.Selector) == 0 {
-			return "", fmt.Errorf("service %s has no selector (headless service without selector cannot be port-forwarded)", resourceName)
-		}
 		selector := metav1.FormatLabelSelector(&metav1.LabelSelector{MatchLabels: service.Spec.Selector})
 		pods, err := client.CoreV1().Pods(namespace).List(ctx, metav1.ListOptions{
 			LabelSelector: selector,

internal/k8s/portforward_extended_test.go

@@ -1,343 +0,0 @@
-package k8s
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// =============================================================================
-// PortForwarder Extended Tests
-// =============================================================================
-
-func TestPortForwarder_Forward_ServiceResolutionError(t *testing.T) {
-	// Create pool without any pods/services
-	pool := setupTestPool(t, "test-context")
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	stopChan := make(chan struct{})
-	req := &ForwardRequest{
-		StopChan:    stopChan,
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "service/nonexistent-svc",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	err := pf.Forward(t.Context(), req)
-	assert.Error(t, err)
-	// Should fail trying to get the service
-	assert.Contains(t, err.Error(), "failed to get service")
-}
-
-func TestPortForwarder_Forward_PodNotRunning(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "pending-pod",
-				Namespace: "default",
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodPending},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	stopChan := make(chan struct{})
-	req := &ForwardRequest{
-		StopChan:    stopChan,
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "pod/pending-pod",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	err := pf.Forward(t.Context(), req)
-	assert.Error(t, err)
-	// Since pod is not running, it won't be found during resolution
-	assert.Contains(t, err.Error(), "no running pods found")
-}
-
-func TestPortForwarder_Forward_PodPhaseCheck(t *testing.T) {
-	// Create a running pod for resolution
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "test-pod",
-				Namespace: "default",
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	stopChan := make(chan struct{})
-	req := &ForwardRequest{
-		StopChan:    stopChan,
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "pod/test-pod",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	err := pf.Forward(t.Context(), req)
-	// Will fail on port-forward since we can't actually forward
-	// but the pod phase check should have passed
-	assert.Error(t, err)
-	// Error should not be about pod not running
-	assert.NotContains(t, err.Error(), "pod is not running")
-}
-
-func TestPortForwarder_Forward_UnsupportedResourceType(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	stopChan := make(chan struct{})
-	req := &ForwardRequest{
-		StopChan:    stopChan,
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "deployment/my-deploy",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	err := pf.Forward(t.Context(), req)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "unsupported resource type")
-}
-
-func TestPortForwarder_Forward_GetClientError(t *testing.T) {
-	// Create pool without setting test client
-	pool, _ := NewClientPool()
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	stopChan := make(chan struct{})
-	req := &ForwardRequest{
-		StopChan:    stopChan,
-		ContextName: "non-existent-context",
-		Namespace:   "default",
-		Resource:    "service/my-service",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	err := pf.Forward(t.Context(), req)
-	assert.Error(t, err)
-	// Will fail trying to get client (via resolver)
-	assert.Contains(t, err.Error(), "failed to get client")
-}
-
-func TestPortForwarder_GetPodForResource_ServiceNotFound(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	_, err := pf.GetPodForResource(t.Context(), "test-context", "default", "service/nonexistent", "")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to get service")
-}
-
-func TestPortForwarder_GetPodForResource_UnsupportedType(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	_, err := pf.GetPodForResource(t.Context(), "test-context", "default", "deployment/my-deploy", "")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "unsupported resource type")
-}
-
-func TestPortForwarder_GetPodForResource_DirectPod(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "test-pod",
-				Namespace: "default",
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	// For pod resources, GetPodForResource returns the pod name directly
-	podName, err := pf.GetPodForResource(t.Context(), "test-context", "default", "pod/test-pod", "")
-	require.NoError(t, err)
-	assert.Equal(t, "test-pod", podName)
-}
-
-func TestPortForwarder_ForwardRequest_DefaultChannels(t *testing.T) {
-	// Test that ForwardRequest can be created without channels
-	req := &ForwardRequest{
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "pod/my-pod",
-		LocalPort:   8080,
-		RemotePort:  80,
-		// StopChan and ReadyChan not set
-	}
-
-	assert.Nil(t, req.StopChan)
-	assert.Nil(t, req.ReadyChan)
-	assert.Nil(t, req.Out)
-	assert.Nil(t, req.ErrOut)
-}
-
-func TestPortForwarder_Settings(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	// Test TCP keepalive setting
-	pf.SetTCPKeepalive(30 * 1000000000) // 30 seconds in nanoseconds
-
-	// Test dial timeout setting
-	pf.SetDialTimeout(10 * 1000000000) // 10 seconds in nanoseconds
-
-	// Just verify they don't panic
-	assert.NotNil(t, pf)
-}
-
-func TestPortForwarder_Forward_GetPodError(t *testing.T) {
-	pool := setupTestPool(t, "test-context")
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	stopChan := make(chan struct{})
-	req := &ForwardRequest{
-		StopChan:    stopChan,
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "pod/nonexistent-prefix-xyz",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	err := pf.Forward(t.Context(), req)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to resolve resource")
-}
-
-func TestPortForwarder_ForwardToService_NoRunningPods(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "pending-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "backend"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodPending},
-		},
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				Selector: map[string]string{"app": "backend"},
-				Ports: []corev1.ServicePort{
-					{Port: 80},
-				},
-			},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	stopChan := make(chan struct{})
-	req := &ForwardRequest{
-		StopChan:    stopChan,
-		ContextName: "test-context",
-		Namespace:   "default",
-		Resource:    "service/backend-svc",
-		LocalPort:   8080,
-		RemotePort:  80,
-	}
-
-	err := pf.Forward(t.Context(), req)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "no running pods found for service")
-}
-
-func TestPortForwarder_GetPodForResource_ServiceWithRunningPod(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "running-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "backend"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				Selector: map[string]string{"app": "backend"},
-				Ports: []corev1.ServicePort{
-					{Port: 80},
-				},
-			},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	podName, err := pf.GetPodForResource(t.Context(), "test-context", "default", "service/backend-svc", "")
-	require.NoError(t, err)
-	assert.Equal(t, "running-pod", podName)
-}
-
-func TestPortForwarder_GetPodForResource_ServicePendingPod(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "pending-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "backend"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodPending},
-		},
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				Selector: map[string]string{"app": "backend"},
-				Ports: []corev1.ServicePort{
-					{Port: 80},
-				},
-			},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-	pf := NewPortForwarder(pool, r)
-
-	_, err := pf.GetPodForResource(t.Context(), "test-context", "default", "service/backend-svc", "")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "no running pods found for service")
-}

internal/k8s/resolver.go

@@ -19,15 +19,15 @@ const (
 
 // ResolvedResource represents a resolved Kubernetes resource.
 type ResolvedResource struct {
-	Timestamp time.Time
-	Name      string
-	Namespace string
+	Name      string    // The resolved pod or service name
+	Namespace string    // The namespace
+	Timestamp time.Time // When this was resolved
 }
 
 // cacheEntry stores a cached resolution result with expiry.
 type cacheEntry struct {
-	expiresAt time.Time
 	resource  ResolvedResource
+	expiresAt time.Time
 }
 
 // ResourceResolver resolves Kubernetes resources with caching.
@@ -173,31 +173,21 @@ func (r *ResourceResolver) resolvePodSelector(ctx context.Context, contextName,
 }
 
 // getFromCache retrieves a cached resolution result if it exists and hasn't expired.
-// Expired entries are removed to prevent memory growth over time.
 func (r *ResourceResolver) getFromCache(key string) string {
 	r.cacheMu.RLock()
+	defer r.cacheMu.RUnlock()
+
 	entry, exists := r.cache[key]
 	if !exists {
-		r.cacheMu.RUnlock()
 		return ""
 	}
 
 	// Check if expired
 	if time.Now().After(entry.expiresAt) {
-		r.cacheMu.RUnlock()
-		// Upgrade to write lock and delete expired entry
-		r.cacheMu.Lock()
-		// Double-check entry still exists and is still expired (may have been updated)
-		if expiredEntry, ok := r.cache[key]; ok && time.Now().After(expiredEntry.expiresAt) {
-			delete(r.cache, key)
-		}
-		r.cacheMu.Unlock()
 		return ""
 	}
 
-	name := entry.resource.Name
-	r.cacheMu.RUnlock()
-	return name
+	return entry.resource.Name
 }
 
 // putInCache stores a resolution result in the cache with TTL.
@@ -238,3 +228,29 @@ func (r *ResourceResolver) InvalidateCache(contextName, namespace, resource stri
 		}
 	}
 }
+
+// GetPodList returns a list of pods matching the given criteria.
+// This is useful for debugging and testing.
+func (r *ResourceResolver) GetPodList(ctx context.Context, contextName, namespace, selector string) ([]*corev1.Pod, error) {
+	client, err := r.clientPool.GetClient(contextName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get client: %w", err)
+	}
+
+	listOptions := metav1.ListOptions{}
+	if selector != "" {
+		listOptions.LabelSelector = selector
+	}
+
+	pods, err := client.CoreV1().Pods(namespace).List(ctx, listOptions)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list pods: %w", err)
+	}
+
+	result := make([]*corev1.Pod, len(pods.Items))
+	for i := range pods.Items {
+		result[i] = &pods.Items[i]
+	}
+
+	return result, nil
+}

internal/k8s/resolver_extended_test.go

@@ -1,430 +0,0 @@
-package k8s
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/util/intstr"
-)
-
-// =============================================================================
-// ResourceResolver Extended Tests
-// =============================================================================
-
-func TestResourceResolver_ResolvePodPrefix_CacheHit(t *testing.T) {
-	baseTime := time.Now()
-
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "my-app-xyz789",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-
-	// First call - hits API
-	result1, err := r.Resolve(t.Context(), "test-context", "default", "pod/my-app", "")
-	require.NoError(t, err)
-	assert.Equal(t, "pod/my-app-xyz789", result1)
-
-	// Second call - should use cache (instant)
-	start := time.Now()
-	result2, err := r.Resolve(t.Context(), "test-context", "default", "pod/my-app", "")
-	require.NoError(t, err)
-	assert.Equal(t, result1, result2)
-	// Should be very fast since it's cached
-	assert.Less(t, time.Since(start), 10*time.Millisecond)
-}
-
-func TestResourceResolver_ResolvePodSelector_CacheHit(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "app-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "myapp"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-
-	// First call - hits API
-	result1, err := r.Resolve(t.Context(), "test-context", "default", "pod", "app=myapp")
-	require.NoError(t, err)
-	assert.Equal(t, "pod/app-pod", result1)
-
-	// Second call - should use cache
-	result2, err := r.Resolve(t.Context(), "test-context", "default", "pod", "app=myapp")
-	require.NoError(t, err)
-	assert.Equal(t, result1, result2)
-}
-
-func TestResourceResolver_ResolvePodPrefix_ExcludesNonRunning(t *testing.T) {
-	baseTime := time.Now()
-
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "my-app-pending",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodPending},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "my-app-succeeded",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodSucceeded},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "my-app-failed",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodFailed},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-
-	_, err := r.Resolve(t.Context(), "test-context", "default", "pod/my-app", "")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "no running pods found matching prefix")
-}
-
-func TestResourceResolver_ResolvePodSelector_ExcludesNonRunning(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "app-pod-pending",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "myapp"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodPending},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-
-	_, err := r.Resolve(t.Context(), "test-context", "default", "pod", "app=myapp")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "no running pods found matching selector")
-}
-
-func TestResourceResolver_getFromCache_NotFound(t *testing.T) {
-	pool, _ := NewClientPool()
-	r := NewResourceResolver(pool)
-
-	result := r.getFromCache("non-existent-key")
-	assert.Empty(t, result)
-}
-
-func TestResourceResolver_getFromCache_ExpiredEntry(t *testing.T) {
-	pool, _ := NewClientPool()
-	r := NewResourceResolver(pool)
-	r.SetCacheTTL(1 * time.Millisecond)
-
-	// Put entry in cache
-	r.putInCache("test-key", "test-value")
-
-	// Verify it's there
-	result := r.getFromCache("test-key")
-	assert.Equal(t, "test-value", result)
-
-	// Wait for expiry
-	time.Sleep(10 * time.Millisecond)
-
-	// Should be expired and cleaned up
-	result = r.getFromCache("test-key")
-	assert.Empty(t, result)
-
-	// Verify entry was deleted
-	r.cacheMu.RLock()
-	_, exists := r.cache["test-key"]
-	r.cacheMu.RUnlock()
-	assert.False(t, exists)
-}
-
-func TestResourceResolver_InvalidateCache_NoEntries(t *testing.T) {
-	pool, _ := NewClientPool()
-	r := NewResourceResolver(pool)
-
-	// Should not panic on empty cache
-	r.InvalidateCache("test-context", "default", "pod/app")
-
-	assert.NotNil(t, r.cache)
-}
-
-func TestResourceResolver_Resolve_GetClientError(t *testing.T) {
-	// Create pool without test client - should fail when trying to get client
-	pool, _ := NewClientPool()
-	r := NewResourceResolver(pool)
-
-	_, err := r.Resolve(t.Context(), "non-existent-context", "default", "pod/test", "")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to get client")
-}
-
-func TestResourceResolver_ResolvePodPrefix_MultipleMatchesReturnsNewest(t *testing.T) {
-	baseTime := time.Now()
-
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "my-app-oldest",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime.Add(-2 * time.Hour)},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "my-app-middle",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime.Add(-1 * time.Hour)},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "my-app-newest",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-
-	result, err := r.Resolve(t.Context(), "test-context", "default", "pod/my-app", "")
-	require.NoError(t, err)
-	assert.Equal(t, "pod/my-app-newest", result)
-}
-
-func TestResourceResolver_ResolvePodSelector_FirstRunning(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "app-pod-1",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "myapp"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "app-pod-2",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "myapp"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	r := NewResourceResolver(pool)
-
-	result, err := r.Resolve(t.Context(), "test-context", "default", "pod", "app=myapp")
-	require.NoError(t, err)
-	// Should return the first running pod found
-	assert.Equal(t, "pod/app-pod-1", result)
-}
-
-// =============================================================================
-// Discovery Extended Tests
-// =============================================================================
-
-func TestDiscovery_ListPods_FilteringAndSorting(t *testing.T) {
-	baseTime := time.Now()
-
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "newer-running-pod",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-			Spec: corev1.PodSpec{
-				Containers: []corev1.Container{
-					{
-						Name: "main",
-						Ports: []corev1.ContainerPort{
-							{ContainerPort: 8080, Protocol: corev1.ProtocolTCP},
-						},
-					},
-				},
-			},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "older-pending-pod",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime.Add(-time.Hour)},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodPending},
-			Spec: corev1.PodSpec{
-				Containers: []corev1.Container{
-					{Name: "main"},
-				},
-			},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:              "older-running-pod",
-				Namespace:         "default",
-				CreationTimestamp: metav1.Time{Time: baseTime.Add(-2 * time.Hour)},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-			Spec: corev1.PodSpec{
-				Containers: []corev1.Container{
-					{Name: "main"},
-				},
-			},
-		},
-		// Pods in other namespaces should not appear
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "other-namespace-pod",
-				Namespace: "kube-system",
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-	)
-
-	d := NewDiscovery(pool)
-
-	pods, err := d.ListPods(t.Context(), "test-context", "default")
-	require.NoError(t, err)
-	assert.Len(t, pods, 3) // 2 running + 1 pending
-
-	// Should be sorted by creation time (newest first)
-	assert.Equal(t, "newer-running-pod", pods[0].Name)
-	assert.Equal(t, "older-pending-pod", pods[1].Name)
-	assert.Equal(t, "older-running-pod", pods[2].Name)
-
-	// Check protocol is set correctly
-	assert.Equal(t, "TCP", pods[0].Containers[0].Ports[0].Protocol)
-}
-
-func TestDiscovery_ListPodsWithSelector_OnlyRunning(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "running-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "myapp"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-		},
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "pending-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "myapp"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodPending},
-		},
-	)
-
-	d := NewDiscovery(pool)
-
-	pods, err := d.ListPodsWithSelector(t.Context(), "test-context", "default", "app=myapp")
-	require.NoError(t, err)
-	// Only running pods should be returned for selector-based queries
-	assert.Len(t, pods, 1)
-	assert.Equal(t, "running-pod", pods[0].Name)
-}
-
-func TestDiscovery_ListServices_WithNamedPortResolution(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-pod",
-				Namespace: "default",
-				Labels:    map[string]string{"app": "backend"},
-			},
-			Status: corev1.PodStatus{Phase: corev1.PodRunning},
-			Spec: corev1.PodSpec{
-				Containers: []corev1.Container{
-					{
-						Name: "main",
-						Ports: []corev1.ContainerPort{
-							{Name: "http", ContainerPort: 8080},
-							{Name: "grpc", ContainerPort: 50051},
-						},
-					},
-				},
-			},
-		},
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				Type:     corev1.ServiceTypeClusterIP,
-				Selector: map[string]string{"app": "backend"},
-				Ports: []corev1.ServicePort{
-					{Name: "http", Port: 80, TargetPort: intstr.FromString("http")},
-					{Name: "grpc", Port: 50051, TargetPort: intstr.FromString("grpc")},
-				},
-			},
-		},
-	)
-
-	d := NewDiscovery(pool)
-
-	services, err := d.ListServices(t.Context(), "test-context", "default")
-	require.NoError(t, err)
-	assert.Len(t, services, 1)
-
-	// Named ports should be resolved
-	assert.Len(t, services[0].Ports, 2)
-	assert.Equal(t, int32(80), services[0].Ports[0].Port)
-	assert.Equal(t, int32(8080), services[0].Ports[0].TargetPort) // Resolved from pod
-	assert.Equal(t, int32(50051), services[0].Ports[1].Port)
-	assert.Equal(t, int32(50051), services[0].Ports[1].TargetPort) // Resolved from pod
-}
-
-func TestDiscovery_ListServices_NoBackingPods(t *testing.T) {
-	pool := setupTestPool(t, "test-context",
-		&corev1.Service{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "backend-svc",
-				Namespace: "default",
-			},
-			Spec: corev1.ServiceSpec{
-				Type:     corev1.ServiceTypeClusterIP,
-				Selector: map[string]string{"app": "nonexistent"},
-				Ports: []corev1.ServicePort{
-					{Name: "http", Port: 80, TargetPort: intstr.FromString("http")},
-				},
-			},
-		},
-	)
-
-	d := NewDiscovery(pool)
-
-	services, err := d.ListServices(t.Context(), "test-context", "default")
-	require.NoError(t, err)
-	assert.Len(t, services, 1)
-
-	// When no backing pods, falls back to service port
-	assert.Equal(t, int32(80), services[0].Ports[0].TargetPort)
-}

internal/logger/demo_test.go

@@ -1,70 +0,0 @@
-package logger_test
-
-import (
-	"bytes"
-	"fmt"
-	"testing"
-
-	"github.com/lukaszraczylo/kportal/internal/logger"
-)
-
-// This test demonstrates the logger output formats
-func TestLoggerDemo(t *testing.T) {
-	t.Skip("Demo only - run manually with: go test -v -run TestLoggerDemo")
-
-	fmt.Println("\n=== TEXT FORMAT (DEFAULT) ===")
-	textBuf := &bytes.Buffer{}
-	textLogger := logger.New(logger.LevelInfo, logger.FormatText, textBuf)
-
-	textLogger.Info("Port forward started", map[string]interface{}{
-		"forward_id": "prod/default/pod/app:8080",
-		"local_port": 8080,
-		"pod":        "app-xyz123",
-	})
-
-	textLogger.Warn("Connection failed, retrying", map[string]interface{}{
-		"forward_id": "prod/default/pod/app:8080",
-		"error":      "connection refused",
-		"retry":      3,
-	})
-
-	textLogger.Error("Failed to resolve resource", map[string]interface{}{
-		"forward_id": "prod/default/pod/app:8080",
-		"error":      "pod not found",
-	})
-
-	fmt.Print(textBuf.String())
-
-	fmt.Println("\n=== JSON FORMAT ===")
-	jsonBuf := &bytes.Buffer{}
-	jsonLogger := logger.New(logger.LevelInfo, logger.FormatJSON, jsonBuf)
-
-	jsonLogger.Info("Port forward started", map[string]interface{}{
-		"forward_id": "prod/default/pod/app:8080",
-		"local_port": 8080,
-		"pod":        "app-xyz123",
-	})
-
-	jsonLogger.Warn("Connection failed, retrying", map[string]interface{}{
-		"forward_id": "prod/default/pod/app:8080",
-		"error":      "connection refused",
-		"retry":      3,
-	})
-
-	jsonLogger.Error("Failed to resolve resource", map[string]interface{}{
-		"forward_id": "prod/default/pod/app:8080",
-		"error":      "pod not found",
-	})
-
-	fmt.Print(jsonBuf.String())
-
-	fmt.Println("\n=== LOG LEVEL FILTERING (Debug level disabled) ===")
-	filteredBuf := &bytes.Buffer{}
-	filteredLogger := logger.New(logger.LevelInfo, logger.FormatText, filteredBuf)
-
-	filteredLogger.Debug("This will not appear", nil)
-	filteredLogger.Info("This will appear", nil)
-	filteredLogger.Warn("This will also appear", nil)
-
-	fmt.Print(filteredBuf.String())
-}

internal/logger/klog_bridge.go

@@ -1,96 +0,0 @@
-package logger
-
-import (
-	"bytes"
-	"io"
-	"strings"
-	"sync"
-)
-
-// KlogWriter is an io.Writer that routes klog output through our structured logger.
-// It parses klog messages and routes them to appropriate log levels.
-// It is thread-safe for concurrent writes.
-type KlogWriter struct {
-	logger *Logger
-	buffer *bytes.Buffer
-	mu     sync.Mutex
-}
-
-// NewKlogWriter creates a new KlogWriter that routes k8s client-go logs
-// through our structured logger.
-func NewKlogWriter(logger *Logger) *KlogWriter {
-	return &KlogWriter{
-		logger: logger,
-		buffer: &bytes.Buffer{},
-	}
-}
-
-// Write implements io.Writer.
-// It parses klog output and routes it through our structured logger.
-// This method is thread-safe.
-func (w *KlogWriter) Write(p []byte) (n int, err error) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	// Write to buffer first
-	w.buffer.Write(p)
-
-	// Process complete lines
-	for {
-		line, err := w.buffer.ReadString('\n')
-		if err != nil {
-			// No complete line yet, write back what we read and wait for more
-			if err == io.EOF && line != "" {
-				w.buffer.WriteString(line)
-			}
-			break
-		}
-
-		// Process the complete line
-		w.processLine(strings.TrimSpace(line))
-	}
-
-	return len(p), nil
-}
-
-// processLine parses a klog line and routes it to the appropriate log level.
-func (w *KlogWriter) processLine(line string) {
-	if line == "" {
-		return
-	}
-
-	// Parse klog format: "I1124 12:34:56.789012   12345 file.go:123] message"
-	// First character indicates level: I=Info, W=Warning, E=Error, F=Fatal
-	if len(line) < 1 {
-		return
-	}
-
-	level := line[0]
-	message := line
-
-	// Try to extract just the message part after "]"
-	if idx := strings.Index(line, "] "); idx != -1 {
-		message = line[idx+2:]
-	}
-
-	// Determine log level and route accordingly
-	switch level {
-	case 'I': // Info
-		w.logger.Debug(message, map[string]interface{}{
-			"source": "k8s-client",
-		})
-	case 'W': // Warning
-		w.logger.Warn(message, map[string]interface{}{
-			"source": "k8s-client",
-		})
-	case 'E', 'F': // Error or Fatal
-		w.logger.Error(message, map[string]interface{}{
-			"source": "k8s-client",
-		})
-	default:
-		// Unknown format, log as debug
-		w.logger.Debug(message, map[string]interface{}{
-			"source": "k8s-client",
-		})
-	}
-}

internal/logger/klog_bridge_test.go

@@ -1,280 +0,0 @@
-package logger
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestKlogWriter(t *testing.T) {
-	tests := []struct {
-		name          string
-		input         string
-		expectedLevel string
-		expectedMsg   string
-		description   string
-		loggerLevel   Level
-		loggerFormat  Format
-		shouldLog     bool
-	}{
-		{
-			name:          "info level log",
-			input:         "I1124 12:34:56.789012   12345 portforward.go:123] Starting port forward\n",
-			expectedLevel: "DEBUG",
-			expectedMsg:   "Starting port forward",
-			loggerLevel:   LevelDebug,
-			loggerFormat:  FormatText,
-			shouldLog:     true,
-			description:   "Info logs from k8s should be routed as DEBUG",
-		},
-		{
-			name:          "warning level log",
-			input:         "W1124 12:34:56.789012   12345 portforward.go:456] Connection unstable\n",
-			expectedLevel: "WARN",
-			expectedMsg:   "Connection unstable",
-			loggerLevel:   LevelDebug,
-			loggerFormat:  FormatText,
-			shouldLog:     true,
-			description:   "Warning logs should be routed as WARN",
-		},
-		{
-			name:          "error level log",
-			input:         "E1124 12:34:56.789012   12345 portforward.go:789] Connection failed\n",
-			expectedLevel: "ERROR",
-			expectedMsg:   "Connection failed",
-			loggerLevel:   LevelDebug,
-			loggerFormat:  FormatText,
-			shouldLog:     true,
-			description:   "Error logs should be routed as ERROR",
-		},
-		{
-			name:          "fatal level log",
-			input:         "F1124 12:34:56.789012   12345 portforward.go:999] Fatal error\n",
-			expectedLevel: "ERROR",
-			expectedMsg:   "Fatal error",
-			loggerLevel:   LevelDebug,
-			loggerFormat:  FormatText,
-			shouldLog:     true,
-			description:   "Fatal logs should be routed as ERROR",
-		},
-		{
-			name:          "multiline input",
-			input:         "I1124 12:34:56.789012   12345 portforward.go:123] First message\nI1124 12:34:57.123456   12345 portforward.go:124] Second message\n",
-			expectedLevel: "DEBUG",
-			expectedMsg:   "First message",
-			loggerLevel:   LevelDebug,
-			loggerFormat:  FormatText,
-			shouldLog:     true,
-			description:   "Should handle multiple log lines",
-		},
-		{
-			name:          "log filtered by level",
-			input:         "I1124 12:34:56.789012   12345 portforward.go:123] Debug message\n",
-			expectedLevel: "DEBUG",
-			expectedMsg:   "Debug message",
-			loggerLevel:   LevelInfo, // Logger set to INFO, DEBUG should be filtered
-			loggerFormat:  FormatText,
-			shouldLog:     false,
-			description:   "DEBUG logs should be filtered when logger level is INFO",
-		},
-		{
-			name:          "unknown log format",
-			input:         "X1124 12:34:56.789012   12345 portforward.go:123] Unknown format\n",
-			expectedLevel: "DEBUG",
-			expectedMsg:   "Unknown format",
-			loggerLevel:   LevelDebug,
-			loggerFormat:  FormatText,
-			shouldLog:     true,
-			description:   "Unknown format should default to DEBUG",
-		},
-		{
-			name:          "empty line",
-			input:         "\n",
-			expectedLevel: "",
-			expectedMsg:   "",
-			loggerLevel:   LevelDebug,
-			loggerFormat:  FormatText,
-			shouldLog:     false,
-			description:   "Empty lines should be ignored",
-		},
-		{
-			name:          "partial line no newline",
-			input:         "I1124 12:34:56.789012   12345 portforward.go:123] Partial",
-			expectedLevel: "",
-			expectedMsg:   "",
-			loggerLevel:   LevelDebug,
-			loggerFormat:  FormatText,
-			shouldLog:     false,
-			description:   "Partial lines without newline should be buffered",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Create output buffer
-			var buf bytes.Buffer
-
-			// Create logger with specified level and format
-			logger := New(tt.loggerLevel, tt.loggerFormat, &buf)
-
-			// Create klog writer
-			klogWriter := NewKlogWriter(logger)
-
-			// Write input
-			n, err := klogWriter.Write([]byte(tt.input))
-			require.NoError(t, err)
-			assert.Equal(t, len(tt.input), n)
-
-			// Check output
-			output := buf.String()
-
-			if !tt.shouldLog {
-				assert.Empty(t, output, "Expected no log output")
-				return
-			}
-
-			if tt.loggerFormat == FormatText {
-				// Text format: [LEVEL] message
-				assert.Contains(t, output, fmt.Sprintf("[%s]", tt.expectedLevel))
-				assert.Contains(t, output, tt.expectedMsg)
-				assert.Contains(t, output, "k8s-client") // Should include source field
-			} else {
-				// JSON format
-				var entry logEntry
-				lines := strings.Split(strings.TrimSpace(output), "\n")
-				if len(lines) > 0 {
-					err := json.Unmarshal([]byte(lines[0]), &entry)
-					require.NoError(t, err)
-					assert.Equal(t, tt.expectedLevel, entry.Level)
-					assert.Equal(t, tt.expectedMsg, entry.Message)
-					assert.Equal(t, "k8s-client", entry.Fields["source"])
-				}
-			}
-		})
-	}
-}
-
-func TestKlogWriterBuffering(t *testing.T) {
-	tests := []struct {
-		name        string
-		description string
-		writes      []string
-		expectCount int
-	}{
-		{
-			name: "single complete line",
-			writes: []string{
-				"I1124 12:34:56.789012   12345 portforward.go:123] Complete line\n",
-			},
-			expectCount: 1,
-			description: "Single complete line should produce one log entry",
-		},
-		{
-			name: "partial then complete",
-			writes: []string{
-				"I1124 12:34:56.789012   12345 portforward.go:123] Partial ",
-				"line\n",
-			},
-			expectCount: 1,
-			description: "Partial writes should be buffered and combined",
-		},
-		{
-			name: "multiple complete lines in chunks",
-			writes: []string{
-				"I1124 12:34:56.789012   12345 portforward.go:123] First\n",
-				"I1124 12:34:57.123456   12345 portforward.go:124] Second\n",
-				"I1124 12:34:58.456789   12345 portforward.go:125] Third\n",
-			},
-			expectCount: 3,
-			description: "Multiple complete lines should produce multiple log entries",
-		},
-		{
-			name: "mixed partial and complete",
-			writes: []string{
-				"I1124 12:34:56.789012   12345 portforward.go:123] First\nI1124 12:34:57.123456   12345 port",
-				"forward.go:124] Second\n",
-			},
-			expectCount: 2,
-			description: "Mixed partial and complete lines should be handled correctly",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var buf bytes.Buffer
-			logger := New(LevelDebug, FormatText, &buf)
-			klogWriter := NewKlogWriter(logger)
-
-			// Write all chunks
-			for _, write := range tt.writes {
-				_, err := klogWriter.Write([]byte(write))
-				require.NoError(t, err)
-			}
-
-			// Count log entries (each line starts with [LEVEL])
-			output := buf.String()
-			count := strings.Count(output, "[DEBUG]") +
-				strings.Count(output, "[INFO]") +
-				strings.Count(output, "[WARN]") +
-				strings.Count(output, "[ERROR]")
-
-			assert.Equal(t, tt.expectCount, count, "Expected %d log entries, got %d", tt.expectCount, count)
-		})
-	}
-}
-
-func TestKlogWriterJSONFormat(t *testing.T) {
-	var buf bytes.Buffer
-	logger := New(LevelDebug, FormatJSON, &buf)
-	klogWriter := NewKlogWriter(logger)
-
-	// Write a k8s log line
-	input := "I1124 12:34:56.789012   12345 portforward.go:123] Starting port forward\n"
-	_, err := klogWriter.Write([]byte(input))
-	require.NoError(t, err)
-
-	// Parse JSON output
-	var entry logEntry
-	err = json.Unmarshal(buf.Bytes(), &entry)
-	require.NoError(t, err)
-
-	// Verify JSON structure
-	assert.Equal(t, "DEBUG", entry.Level)
-	assert.Equal(t, "Starting port forward", entry.Message)
-	assert.NotEmpty(t, entry.Time)
-	assert.Equal(t, "k8s-client", entry.Fields["source"])
-}
-
-func TestKlogWriterConcurrency(t *testing.T) {
-	// Test that concurrent writes don't cause data races
-	var buf bytes.Buffer
-	logger := New(LevelDebug, FormatText, &buf)
-	klogWriter := NewKlogWriter(logger)
-
-	done := make(chan bool)
-	numGoroutines := 10
-	numWrites := 100
-
-	for i := 0; i < numGoroutines; i++ {
-		go func(id int) {
-			for j := 0; j < numWrites; j++ {
-				msg := fmt.Sprintf("I1124 12:34:56.789012   12345 test.go:123] Message from goroutine %d iteration %d\n", id, j)
-				_, _ = klogWriter.Write([]byte(msg))
-			}
-			done <- true
-		}(i)
-	}
-
-	// Wait for all goroutines
-	for i := 0; i < numGoroutines; i++ {
-		<-done
-	}
-
-	// Just verify we didn't panic (data race detector would catch issues)
-	assert.NotEmpty(t, buf.String())
-}

internal/logger/klog_logr.go

@@ -1,105 +0,0 @@
-package logger
-
-import (
-	"github.com/go-logr/logr"
-)
-
-// LogrAdapter implements the logr.LogSink interface to route klog v2 logs
-// through our structured logger. This captures ALL klog output including
-// error logs, structured logs, and named logger output.
-type LogrAdapter struct {
-	logger *Logger
-	name   string
-	level  int
-}
-
-// NewLogrAdapter creates a new logr.LogSink that routes all klog v2 logs
-// through our structured logger.
-func NewLogrAdapter(logger *Logger) logr.LogSink {
-	return &LogrAdapter{
-		logger: logger,
-		name:   "",
-		level:  0,
-	}
-}
-
-// Init initializes the logger with runtime info (not used in our implementation).
-func (l *LogrAdapter) Init(info logr.RuntimeInfo) {
-	// No-op: we don't need runtime info
-}
-
-// Enabled tests whether this LogSink is enabled at the specified V-level.
-// We route all logs through our logger's level filtering.
-func (l *LogrAdapter) Enabled(level int) bool {
-	// Map logr V-levels to our levels:
-	// V(0) = Info level (always enabled if logger level <= Info)
-	// V(1+) = Debug level (enabled if logger level <= Debug)
-	if level == 0 {
-		return l.logger.level <= LevelInfo
-	}
-	return l.logger.level <= LevelDebug
-}
-
-// Info logs a non-error message with the given key/value pairs.
-func (l *LogrAdapter) Info(level int, msg string, keysAndValues ...interface{}) {
-	fields := l.kvToMap(keysAndValues)
-	if l.name != "" {
-		fields["logger"] = l.name
-	}
-
-	// Map logr V-levels to our levels:
-	// V(0) = Info, V(1+) = Debug
-	if level == 0 {
-		l.logger.Info(msg, fields)
-	} else {
-		l.logger.Debug(msg, fields)
-	}
-}
-
-// Error logs an error message with the given key/value pairs.
-func (l *LogrAdapter) Error(err error, msg string, keysAndValues ...interface{}) {
-	fields := l.kvToMap(keysAndValues)
-	if l.name != "" {
-		fields["logger"] = l.name
-	}
-	if err != nil {
-		fields["error"] = err.Error()
-	}
-
-	l.logger.Error(msg, fields)
-}
-
-// WithValues returns a new LogSink with additional key/value pairs.
-func (l *LogrAdapter) WithValues(keysAndValues ...interface{}) logr.LogSink {
-	// For simplicity, we don't implement value accumulation
-	// Each log call receives all its keysAndValues directly
-	return l
-}
-
-// WithName returns a new LogSink with the specified name appended.
-func (l *LogrAdapter) WithName(name string) logr.LogSink {
-	newLogger := *l
-	if l.name == "" {
-		newLogger.name = name
-	} else {
-		newLogger.name = l.name + "." + name
-	}
-	return &newLogger
-}
-
-// kvToMap converts a slice of alternating keys and values to a map.
-func (l *LogrAdapter) kvToMap(keysAndValues []interface{}) map[string]interface{} {
-	fields := make(map[string]interface{})
-	fields["source"] = "k8s-client"
-
-	for i := 0; i < len(keysAndValues); i += 2 {
-		if i+1 < len(keysAndValues) {
-			key, ok := keysAndValues[i].(string)
-			if ok {
-				fields[key] = keysAndValues[i+1]
-			}
-		}
-	}
-
-	return fields
-}

internal/logger/klog_logr_test.go

@@ -1,367 +0,0 @@
-package logger
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"testing"
-
-	"github.com/go-logr/logr"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestLogrAdapter_Info(t *testing.T) {
-	tests := []struct {
-		name           string
-		message        string
-		keysAndValues  []interface{}
-		expectContains []string
-		loggerLevel    Level
-		logrLevel      int
-		expectOutput   bool
-	}{
-		{
-			name:           "info log v0 with debug logger",
-			loggerLevel:    LevelDebug,
-			logrLevel:      0,
-			message:        "Connection established",
-			keysAndValues:  []interface{}{"pod", "my-app-123", "port", 8080},
-			expectOutput:   true,
-			expectContains: []string{"[INFO]", "Connection established", "pod", "my-app-123"},
-		},
-		{
-			name:           "info log v0 with info logger",
-			loggerLevel:    LevelInfo,
-			logrLevel:      0,
-			message:        "Port forward ready",
-			keysAndValues:  []interface{}{},
-			expectOutput:   true,
-			expectContains: []string{"[INFO]", "Port forward ready"},
-		},
-		{
-			name:           "info log v0 silenced with warn logger",
-			loggerLevel:    LevelWarn,
-			logrLevel:      0,
-			message:        "This should not appear",
-			keysAndValues:  []interface{}{},
-			expectOutput:   false,
-			expectContains: []string{},
-		},
-		{
-			name:           "debug log v1 with debug logger",
-			loggerLevel:    LevelDebug,
-			logrLevel:      1,
-			message:        "Detailed connection info",
-			keysAndValues:  []interface{}{"details", "some-value"},
-			expectOutput:   true,
-			expectContains: []string{"[DEBUG]", "Detailed connection info", "details"},
-		},
-		{
-			name:           "debug log v1 silenced with info logger",
-			loggerLevel:    LevelInfo,
-			logrLevel:      1,
-			message:        "This debug should not appear",
-			keysAndValues:  []interface{}{},
-			expectOutput:   false,
-			expectContains: []string{},
-		},
-		{
-			name:           "info with odd number of kvs (incomplete pair)",
-			loggerLevel:    LevelInfo,
-			logrLevel:      0,
-			message:        "Message with incomplete kv",
-			keysAndValues:  []interface{}{"key1", "value1", "key2"}, // key2 has no value
-			expectOutput:   true,
-			expectContains: []string{"[INFO]", "Message with incomplete kv", "key1", "value1"},
-		},
-		{
-			name:           "info with source field added automatically",
-			loggerLevel:    LevelInfo,
-			logrLevel:      0,
-			message:        "Test source field",
-			keysAndValues:  []interface{}{},
-			expectOutput:   true,
-			expectContains: []string{"[INFO]", "Test source field", "source:k8s-client"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			buf := &bytes.Buffer{}
-			logger := New(tt.loggerLevel, FormatText, buf)
-			sink := NewLogrAdapter(logger)
-			logrLogger := logr.New(sink)
-
-			logrLogger.V(tt.logrLevel).Info(tt.message, tt.keysAndValues...)
-
-			output := buf.String()
-			if tt.expectOutput {
-				for _, expected := range tt.expectContains {
-					assert.Contains(t, output, expected, "Output should contain: %s", expected)
-				}
-			} else {
-				assert.Empty(t, output, "No output expected for this log level")
-			}
-		})
-	}
-}
-
-func TestLogrAdapter_Error(t *testing.T) {
-	tests := []struct {
-		err            error
-		name           string
-		message        string
-		keysAndValues  []interface{}
-		expectContains []string
-		loggerLevel    Level
-		expectOutput   bool
-	}{
-		{
-			name:           "error with error object",
-			loggerLevel:    LevelError,
-			err:            errors.New("connection failed"),
-			message:        "Port forward failed",
-			keysAndValues:  []interface{}{"pod", "my-app-123"},
-			expectOutput:   true,
-			expectContains: []string{"[ERROR]", "Port forward failed", "connection failed", "pod", "my-app-123"},
-		},
-		{
-			name:           "error without error object",
-			loggerLevel:    LevelError,
-			err:            nil,
-			message:        "Generic error message",
-			keysAndValues:  []interface{}{},
-			expectOutput:   true,
-			expectContains: []string{"[ERROR]", "Generic error message"},
-		},
-		{
-			name:           "error silenced with level above error",
-			loggerLevel:    LevelError + 1,
-			err:            errors.New("should not appear"),
-			message:        "This error should not appear",
-			keysAndValues:  []interface{}{},
-			expectOutput:   false,
-			expectContains: []string{},
-		},
-		{
-			name:           "error with multiple kvs",
-			loggerLevel:    LevelError,
-			err:            errors.New("sandbox not found"),
-			message:        "Unhandled Error",
-			keysAndValues:  []interface{}{"pod", "test-pod", "uid", "abc123", "port", 8080},
-			expectOutput:   true,
-			expectContains: []string{"[ERROR]", "Unhandled Error", "sandbox not found", "pod", "test-pod", "uid", "abc123"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			buf := &bytes.Buffer{}
-			logger := New(tt.loggerLevel, FormatText, buf)
-			sink := NewLogrAdapter(logger)
-			logrLogger := logr.New(sink)
-
-			logrLogger.Error(tt.err, tt.message, tt.keysAndValues...)
-
-			output := buf.String()
-			if tt.expectOutput {
-				for _, expected := range tt.expectContains {
-					assert.Contains(t, output, expected, "Output should contain: %s", expected)
-				}
-			} else {
-				assert.Empty(t, output, "No output expected for this log level")
-			}
-		})
-	}
-}
-
-func TestLogrAdapter_WithName(t *testing.T) {
-	tests := []struct {
-		name           string
-		message        string
-		expectContains string
-		loggerNames    []string
-	}{
-		{
-			name:           "single logger name",
-			loggerNames:    []string{"portforward"},
-			message:        "Test message",
-			expectContains: "logger:portforward",
-		},
-		{
-			name:           "nested logger names",
-			loggerNames:    []string{"controller", "worker", "healthcheck"},
-			message:        "Nested message",
-			expectContains: "logger:controller.worker.healthcheck",
-		},
-		{
-			name:           "no logger name",
-			loggerNames:    []string{},
-			message:        "No name message",
-			expectContains: "source:k8s-client", // Should still have source but no logger field
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			buf := &bytes.Buffer{}
-			logger := New(LevelInfo, FormatText, buf)
-			sink := NewLogrAdapter(logger)
-			logrLogger := logr.New(sink)
-
-			// Apply WithName calls
-			for _, name := range tt.loggerNames {
-				logrLogger = logrLogger.WithName(name)
-			}
-
-			logrLogger.Info(tt.message)
-
-			output := buf.String()
-			assert.Contains(t, output, tt.expectContains)
-		})
-	}
-}
-
-func TestLogrAdapter_Enabled(t *testing.T) {
-	tests := []struct {
-		name          string
-		loggerLevel   Level
-		logrLevel     int
-		expectEnabled bool
-	}{
-		{
-			name:          "v0 enabled with debug logger",
-			loggerLevel:   LevelDebug,
-			logrLevel:     0,
-			expectEnabled: true,
-		},
-		{
-			name:          "v0 enabled with info logger",
-			loggerLevel:   LevelInfo,
-			logrLevel:     0,
-			expectEnabled: true,
-		},
-		{
-			name:          "v0 disabled with warn logger",
-			loggerLevel:   LevelWarn,
-			logrLevel:     0,
-			expectEnabled: false,
-		},
-		{
-			name:          "v1 enabled with debug logger",
-			loggerLevel:   LevelDebug,
-			logrLevel:     1,
-			expectEnabled: true,
-		},
-		{
-			name:          "v1 disabled with info logger",
-			loggerLevel:   LevelInfo,
-			logrLevel:     1,
-			expectEnabled: false,
-		},
-		{
-			name:          "v2 enabled with debug logger",
-			loggerLevel:   LevelDebug,
-			logrLevel:     2,
-			expectEnabled: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			logger := New(tt.loggerLevel, FormatText, &bytes.Buffer{})
-			sink := NewLogrAdapter(logger)
-
-			enabled := sink.Enabled(tt.logrLevel)
-			assert.Equal(t, tt.expectEnabled, enabled)
-		})
-	}
-}
-
-func TestLogrAdapter_JSONFormat(t *testing.T) {
-	buf := &bytes.Buffer{}
-	logger := New(LevelInfo, FormatJSON, buf)
-	sink := NewLogrAdapter(logger)
-	logrLogger := logr.New(sink).WithName("test-component")
-
-	logrLogger.Info("Test JSON message", "key1", "value1", "key2", 123)
-
-	// Parse JSON output
-	var entry logEntry
-	err := json.Unmarshal(buf.Bytes(), &entry)
-	require.NoError(t, err)
-
-	assert.Equal(t, "INFO", entry.Level)
-	assert.Equal(t, "Test JSON message", entry.Message)
-	assert.Equal(t, "k8s-client", entry.Fields["source"])
-	assert.Equal(t, "test-component", entry.Fields["logger"])
-	assert.Equal(t, "value1", entry.Fields["key1"])
-	assert.Equal(t, float64(123), entry.Fields["key2"]) // JSON numbers decode as float64
-}
-
-func TestLogrAdapter_ConcurrentWrites(t *testing.T) {
-	// Note: bytes.Buffer is not thread-safe for writes, so this test verifies
-	// that our LogrAdapter doesn't panic under concurrent load, but we don't
-	// verify exact output (since logger uses fmt.Fprintf which is also not thread-safe)
-	buf := &bytes.Buffer{}
-	logger := New(LevelDebug, FormatText, buf)
-	sink := NewLogrAdapter(logger)
-	logrLogger := logr.New(sink)
-
-	// Spawn multiple goroutines writing concurrently
-	done := make(chan bool)
-	for i := 0; i < 10; i++ {
-		go func(id int) {
-			for j := 0; j < 100; j++ {
-				logrLogger.Info("Concurrent message", "goroutine", id, "iteration", j)
-			}
-			done <- true
-		}(i)
-	}
-
-	// Wait for all goroutines
-	for i := 0; i < 10; i++ {
-		<-done
-	}
-
-	output := buf.String()
-
-	// Verify we got substantial output (not checking exact count due to buffer race)
-	// The main goal is to ensure no panics occur during concurrent writes
-	assert.NotEmpty(t, output, "Should have some log output")
-	assert.Contains(t, output, "Concurrent message")
-}
-
-func TestLogrAdapter_RealWorldKlogError(t *testing.T) {
-	// Simulate the exact error message from the screenshot
-	buf := &bytes.Buffer{}
-	logger := New(LevelError, FormatText, buf)
-	sink := NewLogrAdapter(logger)
-	logrLogger := logr.New(sink).WithName("UnhandledError")
-
-	err := errors.New("an error occurred forwarding 8401 -> 8401: error forwarding port 8401 to pod 4e1e861c28e3b25a88b082e79788169b5d8a7a117904b7bb8c7cd59285cf1d308, uid : failed to find sandbox '4e1e861c28e3b25a88b082e79788169b5d8a7a117904b7bb8c7cd59285cf1d308' in store: not found")
-	logrLogger.Error(err, "Unhandled Error")
-
-	output := buf.String()
-	assert.Contains(t, output, "[ERROR]")
-	assert.Contains(t, output, "Unhandled Error")
-	assert.Contains(t, output, "failed to find sandbox")
-	assert.Contains(t, output, "logger:UnhandledError")
-}
-
-func TestLogrAdapter_SilenceMode(t *testing.T) {
-	// Test that logs are completely silenced when logger level is above error
-	buf := &bytes.Buffer{}
-	logger := New(LevelError+1, FormatText, buf)
-	sink := NewLogrAdapter(logger)
-	logrLogger := logr.New(sink)
-
-	// Try all log levels
-	logrLogger.V(0).Info("Info message should not appear")
-	logrLogger.V(1).Info("Debug message should not appear")
-	logrLogger.Error(errors.New("error object"), "Error message should not appear")
-
-	output := buf.String()
-	assert.Empty(t, output, "All logs should be silenced")
-}

internal/logger/logger.go

@@ -1,205 +0,0 @@
-// Package logger provides structured logging with support for text and JSON
-// output formats. It intercepts Kubernetes client-go logs and routes them
-// through the structured logger.
-//
-// The package provides both instance-based and global logging:
-//
-//	// Instance-based logging
-//	log := logger.New(logger.LevelInfo, logger.FormatJSON, os.Stderr)
-//	log.Info("message", "key", "value")
-//
-//	// Global logging (after Init)
-//	logger.Init(logger.LevelInfo, logger.FormatText, os.Stderr)
-//	logger.Info("message", "key", "value")
-//
-// Log levels: DEBUG < INFO < WARN < ERROR
-// Output formats: FormatText (human-readable), FormatJSON (structured)
-package logger
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"sync"
-	"time"
-)
-
-// Level represents the logging level.
-// Higher levels include all lower levels (e.g., LevelInfo includes WARN and ERROR).
-type Level int
-
-const (
-	// LevelDebug is for detailed troubleshooting information.
-	LevelDebug Level = iota
-	// LevelInfo is for general operational information.
-	LevelInfo
-	// LevelWarn is for unexpected but handled situations.
-	LevelWarn
-	// LevelError is for failures that require attention.
-	LevelError
-)
-
-// Format represents the output format for log entries.
-type Format int
-
-const (
-	// FormatText outputs human-readable log lines.
-	FormatText Format = iota
-	// FormatJSON outputs structured JSON log entries.
-	FormatJSON
-)
-
-// Logger is a structured logger with configurable level and format.
-// It is safe for concurrent use.
-type Logger struct {
-	output io.Writer
-	level  Level
-	format Format
-	mu     sync.Mutex
-}
-
-// logEntry represents a single log entry for JSON output.
-type logEntry struct {
-	Fields  map[string]any `json:"fields,omitempty"`
-	Time    string         `json:"time"`
-	Level   string         `json:"level"`
-	Message string         `json:"message"`
-}
-
-// New creates a new Logger with the specified level, format, and output writer.
-// If output is nil, os.Stderr is used.
-func New(level Level, format Format, output io.Writer) *Logger {
-	if output == nil {
-		output = os.Stderr
-	}
-	return &Logger{
-		level:  level,
-		format: format,
-		output: output,
-	}
-}
-
-func (l *Logger) log(level Level, msg string, fields map[string]interface{}) {
-	if level < l.level {
-		return
-	}
-
-	levelStr := levelToString(level)
-
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	if l.format == FormatJSON {
-		entry := logEntry{
-			Time:    time.Now().Format(time.RFC3339),
-			Level:   levelStr,
-			Message: msg,
-			Fields:  fields,
-		}
-		data, err := json.Marshal(entry)
-		if err != nil {
-			// Fall back to simple text format on marshal error
-			// Error intentionally ignored - best effort fallback logging
-			_, _ = fmt.Fprintf(l.output, "[%s] %s (json marshal error: %v)\n", levelStr, msg, err)
-			return
-		}
-		if _, err := fmt.Fprintln(l.output, string(data)); err != nil {
-			// Write errors are typically unrecoverable (e.g., closed pipe, disk full)
-			// We silently ignore them to prevent cascading failures in logging
-			return
-		}
-	} else {
-		// Text format
-		// Write errors are silently ignored to prevent cascading failures
-		if len(fields) > 0 {
-			_, _ = fmt.Fprintf(l.output, "[%s] %s %v\n", levelStr, msg, fields)
-		} else {
-			_, _ = fmt.Fprintf(l.output, "[%s] %s\n", levelStr, msg)
-		}
-	}
-}
-
-func (l *Logger) Debug(msg string, fields ...map[string]interface{}) {
-	f := make(map[string]interface{})
-	if len(fields) > 0 {
-		f = fields[0]
-	}
-	l.log(LevelDebug, msg, f)
-}
-
-func (l *Logger) Info(msg string, fields ...map[string]interface{}) {
-	f := make(map[string]interface{})
-	if len(fields) > 0 {
-		f = fields[0]
-	}
-	l.log(LevelInfo, msg, f)
-}
-
-func (l *Logger) Warn(msg string, fields ...map[string]interface{}) {
-	f := make(map[string]interface{})
-	if len(fields) > 0 {
-		f = fields[0]
-	}
-	l.log(LevelWarn, msg, f)
-}
-
-func (l *Logger) Error(msg string, fields ...map[string]interface{}) {
-	f := make(map[string]interface{})
-	if len(fields) > 0 {
-		f = fields[0]
-	}
-	l.log(LevelError, msg, f)
-}
-
-func levelToString(level Level) string {
-	switch level {
-	case LevelDebug:
-		return "DEBUG"
-	case LevelInfo:
-		return "INFO"
-	case LevelWarn:
-		return "WARN"
-	case LevelError:
-		return "ERROR"
-	default:
-		return "UNKNOWN"
-	}
-}
-
-// Global logger for backward compatibility
-var globalLogger *Logger
-
-func Init(level Level, format Format, output ...io.Writer) {
-	var out io.Writer
-	if len(output) > 0 && output[0] != nil {
-		out = output[0]
-	} else {
-		out = os.Stderr
-	}
-	globalLogger = New(level, format, out)
-}
-
-func Debug(msg string, fields ...map[string]interface{}) {
-	if globalLogger != nil {
-		globalLogger.Debug(msg, fields...)
-	}
-}
-
-func Info(msg string, fields ...map[string]interface{}) {
-	if globalLogger != nil {
-		globalLogger.Info(msg, fields...)
-	}
-}
-
-func Warn(msg string, fields ...map[string]interface{}) {
-	if globalLogger != nil {
-		globalLogger.Warn(msg, fields...)
-	}
-}
-
-func Error(msg string, fields ...map[string]interface{}) {
-	if globalLogger != nil {
-		globalLogger.Error(msg, fields...)
-	}
-}

internal/logger/logger_error_test.go

@@ -1,167 +0,0 @@
-package logger
-
-import (
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// errorWriter is a writer that always returns an error
-type errorWriter struct {
-	err error
-}
-
-func (e *errorWriter) Write(p []byte) (n int, err error) {
-	return 0, e.err
-}
-
-func TestJSONMarshalErrorFallback(t *testing.T) {
-	tests := []struct {
-		fields         map[string]interface{}
-		name           string
-		message        string
-		expectContains []string
-		expectFallback bool
-	}{
-		{
-			name:    "normal fields marshal successfully",
-			message: "test message",
-			fields: map[string]interface{}{
-				"key": "value",
-				"num": 123,
-			},
-			expectFallback: false,
-			expectContains: []string{`"message":"test message"`, `"level":"INFO"`},
-		},
-		{
-			name:    "channel field causes marshal error",
-			message: "marshal error message",
-			fields: map[string]interface{}{
-				"bad_field": make(chan int),
-			},
-			expectFallback: true,
-			expectContains: []string{"[INFO]", "marshal error message", "json marshal error"},
-		},
-		{
-			name:    "nested unmarshalable field causes error",
-			message: "nested error",
-			fields: map[string]interface{}{
-				"nested": map[string]interface{}{
-					"channel": make(chan int),
-				},
-			},
-			expectFallback: true,
-			expectContains: []string{"[INFO]", "nested error", "json marshal error"},
-		},
-		{
-			name:           "empty fields marshal successfully",
-			message:        "no fields",
-			fields:         nil,
-			expectFallback: false,
-			expectContains: []string{`"message":"no fields"`},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			buf := &strings.Builder{}
-			logger := New(LevelInfo, FormatJSON, &testWriter{Builder: buf})
-
-			logger.Info(tt.message, tt.fields)
-
-			output := buf.String()
-			assert.NotEmpty(t, output, "Expected log output but got none")
-
-			if tt.expectFallback {
-				// Should contain fallback text format indicators
-				for _, expected := range tt.expectContains {
-					assert.Contains(t, output, expected, "Expected fallback output to contain: %s", expected)
-				}
-				// Should NOT be valid JSON
-				assert.False(t, strings.HasPrefix(output, "{"), "Fallback should not start with {")
-			} else {
-				// Should be valid JSON format
-				for _, expected := range tt.expectContains {
-					assert.Contains(t, output, expected, "Expected JSON output to contain: %s", expected)
-				}
-			}
-		})
-	}
-}
-
-func TestWriteErrorHandling(t *testing.T) {
-	tests := []struct {
-		writeError  error
-		name        string
-		format      Format
-		expectPanic bool
-	}{
-		{
-			name:        "JSON format write error",
-			format:      FormatJSON,
-			writeError:  errors.New("write failed"),
-			expectPanic: false, // Should silently ignore write errors
-		},
-		{
-			name:        "text format write error",
-			format:      FormatText,
-			writeError:  errors.New("disk full"),
-			expectPanic: false, // Should silently ignore write errors
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Use a writer that always returns an error
-			errWriter := &errorWriter{err: tt.writeError}
-			logger := New(LevelInfo, tt.format, errWriter)
-
-			// This should not panic, even though write fails
-			assert.NotPanics(t, func() {
-				logger.Info("test message", map[string]interface{}{"key": "value"})
-			}, "Logger should not panic on write error")
-		})
-	}
-}
-
-func TestMarshalErrorWithDifferentLevels(t *testing.T) {
-	// Test that marshal error fallback works for all log levels
-	levels := []struct {
-		logFunc  func(*Logger, string, map[string]interface{})
-		levelStr string
-		level    Level
-	}{
-		{func(l *Logger, m string, f map[string]interface{}) { l.Debug(m, f) }, "DEBUG", LevelDebug},
-		{func(l *Logger, m string, f map[string]interface{}) { l.Info(m, f) }, "INFO", LevelInfo},
-		{func(l *Logger, m string, f map[string]interface{}) { l.Warn(m, f) }, "WARN", LevelWarn},
-		{func(l *Logger, m string, f map[string]interface{}) { l.Error(m, f) }, "ERROR", LevelError},
-	}
-
-	for _, lvl := range levels {
-		t.Run(lvl.levelStr, func(t *testing.T) {
-			buf := &strings.Builder{}
-			logger := New(lvl.level, FormatJSON, &testWriter{Builder: buf})
-
-			// Use unmarshalable field to trigger error
-			lvl.logFunc(logger, "error test", map[string]interface{}{
-				"bad": make(chan int),
-			})
-
-			output := buf.String()
-			assert.Contains(t, output, "["+lvl.levelStr+"]", "Fallback should contain correct level")
-			assert.Contains(t, output, "error test", "Fallback should contain message")
-			assert.Contains(t, output, "json marshal error", "Fallback should indicate marshal error")
-		})
-	}
-}
-
-// testWriter wraps strings.Builder to implement io.Writer
-type testWriter struct {
-	*strings.Builder
-}
-
-func (w *testWriter) Write(p []byte) (n int, err error) {
-	return w.Builder.Write(p)
-}

internal/logger/logger_test.go

@@ -1,521 +0,0 @@
-package logger
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestLoggerTextFormat(t *testing.T) {
-	tests := []struct {
-		fields         map[string]interface{}
-		name           string
-		message        string
-		expectContains []string
-		level          Level
-		logLevel       Level
-		expectOutput   bool
-	}{
-		{
-			name:           "info logged at info level",
-			level:          LevelInfo,
-			logLevel:       LevelInfo,
-			message:        "test message",
-			fields:         nil,
-			expectOutput:   true,
-			expectContains: []string{"[INFO]", "test message"},
-		},
-		{
-			name:           "debug filtered at info level",
-			level:          LevelInfo,
-			logLevel:       LevelDebug,
-			message:        "debug message",
-			fields:         nil,
-			expectOutput:   false,
-			expectContains: []string{},
-		},
-		{
-			name:           "error logged at info level",
-			level:          LevelInfo,
-			logLevel:       LevelError,
-			message:        "error message",
-			fields:         nil,
-			expectOutput:   true,
-			expectContains: []string{"[ERROR]", "error message"},
-		},
-		{
-			name:     "info with fields",
-			level:    LevelInfo,
-			logLevel: LevelInfo,
-			message:  "test message",
-			fields: map[string]interface{}{
-				"key1": "value1",
-				"key2": 123,
-			},
-			expectOutput:   true,
-			expectContains: []string{"[INFO]", "test message", "key1", "value1"},
-		},
-		{
-			name:           "warn logged at warn level",
-			level:          LevelWarn,
-			logLevel:       LevelWarn,
-			message:        "warning message",
-			fields:         nil,
-			expectOutput:   true,
-			expectContains: []string{"[WARN]", "warning message"},
-		},
-		{
-			name:           "info filtered at warn level",
-			level:          LevelWarn,
-			logLevel:       LevelInfo,
-			message:        "info message",
-			fields:         nil,
-			expectOutput:   false,
-			expectContains: []string{},
-		},
-		{
-			name:           "debug logged at debug level",
-			level:          LevelDebug,
-			logLevel:       LevelDebug,
-			message:        "debug message",
-			fields:         nil,
-			expectOutput:   true,
-			expectContains: []string{"[DEBUG]", "debug message"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			buf := &bytes.Buffer{}
-			logger := New(tt.level, FormatText, buf)
-
-			// Log at the specified level
-			switch tt.logLevel {
-			case LevelDebug:
-				if tt.fields != nil {
-					logger.Debug(tt.message, tt.fields)
-				} else {
-					logger.Debug(tt.message)
-				}
-			case LevelInfo:
-				if tt.fields != nil {
-					logger.Info(tt.message, tt.fields)
-				} else {
-					logger.Info(tt.message)
-				}
-			case LevelWarn:
-				if tt.fields != nil {
-					logger.Warn(tt.message, tt.fields)
-				} else {
-					logger.Warn(tt.message)
-				}
-			case LevelError:
-				if tt.fields != nil {
-					logger.Error(tt.message, tt.fields)
-				} else {
-					logger.Error(tt.message)
-				}
-			}
-
-			output := buf.String()
-
-			if tt.expectOutput {
-				assert.NotEmpty(t, output, "Expected log output but got none")
-				for _, expected := range tt.expectContains {
-					assert.Contains(t, output, expected, "Expected output to contain: %s", expected)
-				}
-			} else {
-				assert.Empty(t, output, "Expected no log output but got: %s", output)
-			}
-		})
-	}
-}
-
-func TestLoggerJSONFormat(t *testing.T) {
-	tests := []struct {
-		fields       map[string]interface{}
-		name         string
-		message      string
-		expectLevel  string
-		level        Level
-		logLevel     Level
-		expectOutput bool
-	}{
-		{
-			name:         "info logged at info level",
-			level:        LevelInfo,
-			logLevel:     LevelInfo,
-			message:      "test message",
-			fields:       nil,
-			expectOutput: true,
-			expectLevel:  "INFO",
-		},
-		{
-			name:         "debug filtered at info level",
-			level:        LevelInfo,
-			logLevel:     LevelDebug,
-			message:      "debug message",
-			fields:       nil,
-			expectOutput: false,
-			expectLevel:  "",
-		},
-		{
-			name:         "error logged at debug level",
-			level:        LevelDebug,
-			logLevel:     LevelError,
-			message:      "error message",
-			fields:       nil,
-			expectOutput: true,
-			expectLevel:  "ERROR",
-		},
-		{
-			name:     "info with fields",
-			level:    LevelInfo,
-			logLevel: LevelInfo,
-			message:  "test message",
-			fields: map[string]interface{}{
-				"context": "production",
-				"port":    8080,
-				"retry":   3,
-			},
-			expectOutput: true,
-			expectLevel:  "INFO",
-		},
-		{
-			name:         "warn at warn level",
-			level:        LevelWarn,
-			logLevel:     LevelWarn,
-			message:      "warning message",
-			fields:       nil,
-			expectOutput: true,
-			expectLevel:  "WARN",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			buf := &bytes.Buffer{}
-			logger := New(tt.level, FormatJSON, buf)
-
-			// Log at the specified level
-			switch tt.logLevel {
-			case LevelDebug:
-				if tt.fields != nil {
-					logger.Debug(tt.message, tt.fields)
-				} else {
-					logger.Debug(tt.message)
-				}
-			case LevelInfo:
-				if tt.fields != nil {
-					logger.Info(tt.message, tt.fields)
-				} else {
-					logger.Info(tt.message)
-				}
-			case LevelWarn:
-				if tt.fields != nil {
-					logger.Warn(tt.message, tt.fields)
-				} else {
-					logger.Warn(tt.message)
-				}
-			case LevelError:
-				if tt.fields != nil {
-					logger.Error(tt.message, tt.fields)
-				} else {
-					logger.Error(tt.message)
-				}
-			}
-
-			output := buf.String()
-
-			if tt.expectOutput {
-				assert.NotEmpty(t, output, "Expected log output but got none")
-
-				// Parse JSON
-				var entry logEntry
-				err := json.Unmarshal([]byte(strings.TrimSpace(output)), &entry)
-				require.NoError(t, err, "Failed to parse JSON output: %s", output)
-
-				// Validate fields
-				assert.Equal(t, tt.expectLevel, entry.Level)
-				assert.Equal(t, tt.message, entry.Message)
-				assert.NotEmpty(t, entry.Time, "Time field should not be empty")
-
-				// Validate custom fields if provided
-				if tt.fields != nil {
-					require.NotNil(t, entry.Fields, "Expected fields in JSON output")
-					for key, expectedValue := range tt.fields {
-						actualValue, exists := entry.Fields[key]
-						assert.True(t, exists, "Expected field %s not found in output", key)
-						// JSON unmarshaling converts numbers to float64
-						if floatVal, ok := expectedValue.(int); ok {
-							assert.Equal(t, float64(floatVal), actualValue)
-						} else {
-							assert.Equal(t, expectedValue, actualValue)
-						}
-					}
-				}
-			} else {
-				assert.Empty(t, output, "Expected no log output but got: %s", output)
-			}
-		})
-	}
-}
-
-func TestGlobalLogger(t *testing.T) {
-	tests := []struct {
-		logFunc        func(string, ...map[string]interface{})
-		name           string
-		message        string
-		expectContains string
-		initLevel      Level
-		initFormat     Format
-	}{
-		{
-			name:           "global info logger text",
-			initLevel:      LevelInfo,
-			initFormat:     FormatText,
-			logFunc:        Info,
-			message:        "global info message",
-			expectContains: "[INFO]",
-		},
-		{
-			name:           "global error logger text",
-			initLevel:      LevelInfo,
-			initFormat:     FormatText,
-			logFunc:        Error,
-			message:        "global error message",
-			expectContains: "[ERROR]",
-		},
-		{
-			name:           "global warn logger json",
-			initLevel:      LevelWarn,
-			initFormat:     FormatJSON,
-			logFunc:        Warn,
-			message:        "global warn message",
-			expectContains: `"level":"WARN"`,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Capture stderr by replacing globalLogger's output
-			buf := &bytes.Buffer{}
-			Init(tt.initLevel, tt.initFormat)
-			globalLogger.output = buf
-
-			// Call the global log function
-			tt.logFunc(tt.message)
-
-			output := buf.String()
-			assert.Contains(t, output, tt.expectContains)
-			assert.Contains(t, output, tt.message)
-		})
-	}
-}
-
-func TestLogLevelsFiltering(t *testing.T) {
-	tests := []struct {
-		name          string
-		logAtLevels   []Level
-		expectOutputs []bool
-		loggerLevel   Level
-	}{
-		{
-			name:          "debug level logs everything",
-			loggerLevel:   LevelDebug,
-			logAtLevels:   []Level{LevelDebug, LevelInfo, LevelWarn, LevelError},
-			expectOutputs: []bool{true, true, true, true},
-		},
-		{
-			name:          "info level filters debug",
-			loggerLevel:   LevelInfo,
-			logAtLevels:   []Level{LevelDebug, LevelInfo, LevelWarn, LevelError},
-			expectOutputs: []bool{false, true, true, true},
-		},
-		{
-			name:          "warn level filters debug and info",
-			loggerLevel:   LevelWarn,
-			logAtLevels:   []Level{LevelDebug, LevelInfo, LevelWarn, LevelError},
-			expectOutputs: []bool{false, false, true, true},
-		},
-		{
-			name:          "error level only logs errors",
-			loggerLevel:   LevelError,
-			logAtLevels:   []Level{LevelDebug, LevelInfo, LevelWarn, LevelError},
-			expectOutputs: []bool{false, false, false, true},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			buf := &bytes.Buffer{}
-			logger := New(tt.loggerLevel, FormatText, buf)
-
-			for i, logLevel := range tt.logAtLevels {
-				buf.Reset()
-
-				switch logLevel {
-				case LevelDebug:
-					logger.Debug("test")
-				case LevelInfo:
-					logger.Info("test")
-				case LevelWarn:
-					logger.Warn("test")
-				case LevelError:
-					logger.Error("test")
-				}
-
-				hasOutput := buf.Len() > 0
-				assert.Equal(t, tt.expectOutputs[i], hasOutput,
-					"Level %v at logger level %v: expected output=%v, got=%v",
-					logLevel, tt.loggerLevel, tt.expectOutputs[i], hasOutput)
-			}
-		})
-	}
-}
-
-func TestLoggerNilOutput(t *testing.T) {
-	// Test that logger defaults to os.Stderr when output is nil
-	logger := New(LevelInfo, FormatText, nil)
-	assert.NotNil(t, logger.output, "Logger output should not be nil")
-}
-
-func TestLevelToString(t *testing.T) {
-	tests := []struct {
-		expected string
-		level    Level
-	}{
-		{level: LevelDebug, expected: "DEBUG"},
-		{level: LevelInfo, expected: "INFO"},
-		{level: LevelWarn, expected: "WARN"},
-		{level: LevelError, expected: "ERROR"},
-		{level: Level(999), expected: "UNKNOWN"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.expected, func(t *testing.T) {
-			result := levelToString(tt.level)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestJSONFieldTypes(t *testing.T) {
-	tests := []struct {
-		fields map[string]interface{}
-		name   string
-	}{
-		{
-			name: "string fields",
-			fields: map[string]interface{}{
-				"key1": "value1",
-				"key2": "value2",
-			},
-		},
-		{
-			name: "numeric fields",
-			fields: map[string]interface{}{
-				"port":    8080,
-				"timeout": 30,
-				"retry":   3,
-			},
-		},
-		{
-			name: "boolean fields",
-			fields: map[string]interface{}{
-				"enabled": true,
-				"running": false,
-			},
-		},
-		{
-			name: "mixed types",
-			fields: map[string]interface{}{
-				"context":   "production",
-				"port":      8080,
-				"enabled":   true,
-				"namespace": "default",
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			buf := &bytes.Buffer{}
-			logger := New(LevelInfo, FormatJSON, buf)
-
-			logger.Info("test message", tt.fields)
-
-			var entry logEntry
-			err := json.Unmarshal([]byte(strings.TrimSpace(buf.String())), &entry)
-			require.NoError(t, err)
-
-			assert.Equal(t, len(tt.fields), len(entry.Fields),
-				"Field count mismatch")
-
-			for key := range tt.fields {
-				_, exists := entry.Fields[key]
-				assert.True(t, exists, "Field %s not found in JSON output", key)
-			}
-		})
-	}
-}
-
-func TestInitWithCustomOutput(t *testing.T) {
-	tests := []struct {
-		output        io.Writer
-		name          string
-		description   string
-		expectDiscard bool
-	}{
-		{
-			name:          "init with custom buffer",
-			output:        &bytes.Buffer{},
-			expectDiscard: false,
-			description:   "Should use provided buffer",
-		},
-		{
-			name:          "init with io.Discard",
-			output:        io.Discard,
-			expectDiscard: true,
-			description:   "Should use io.Discard to silence output",
-		},
-		{
-			name:          "init without output defaults to stderr",
-			output:        nil,
-			expectDiscard: false,
-			description:   "Should default to stderr when no output provided",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.output != nil {
-				Init(LevelInfo, FormatText, tt.output)
-			} else {
-				Init(LevelInfo, FormatText)
-			}
-
-			// Verify global logger was initialized
-			assert.NotNil(t, globalLogger, "Global logger should be initialized")
-
-			if tt.output != nil && !tt.expectDiscard {
-				// For buffer, verify output works
-				if buf, ok := tt.output.(*bytes.Buffer); ok {
-					Info("test message")
-					output := buf.String()
-					assert.Contains(t, output, "test message")
-					assert.Contains(t, output, "[INFO]")
-				}
-			} else if tt.expectDiscard {
-				// For io.Discard, verify no output appears (we can't really test this directly,
-				// but we can verify the logger was set with the right output)
-				assert.Equal(t, io.Discard, globalLogger.output)
-			}
-		})
-	}
-}

internal/mdns/publisher.go

@@ -1,239 +0,0 @@
-// Package mdns provides multicast DNS (mDNS/Bonjour) hostname publishing
-// for port forwards. When enabled, forwards with aliases can be accessed
-// via <alias>.local hostnames on the local network.
-//
-// The Publisher manages mDNS service registrations using zeroconf:
-//   - Registers hostnames when forwards become active
-//   - Unregisters hostnames when forwards are stopped
-//   - Provides service discovery via the _kportal._tcp service type
-//
-// mDNS discovery commands:
-//
-//	dns-sd -B _kportal._tcp local    # macOS
-//	avahi-browse -t _kportal._tcp    # Linux
-package mdns
-
-import (
-	"fmt"
-	"net"
-	"sync"
-	"time"
-
-	"github.com/grandcat/zeroconf"
-	"github.com/lukaszraczylo/kportal/internal/logger"
-)
-
-const (
-	// shutdownTimeout is the maximum time to wait for mDNS server shutdown
-	shutdownTimeout = 2 * time.Second
-
-	// mdnsDomain is the standard mDNS domain (RFC 6762)
-	// This is always ".local" for multicast DNS - it's not configurable
-	// and is different from your network's DNS search domain
-	mdnsDomain = "local"
-)
-
-// Publisher manages mDNS hostname registrations for port forwards.
-// It allows forwards with aliases to be accessible via <alias>.local hostnames.
-type Publisher struct {
-	servers  map[string]*zeroconf.Server
-	aliases  map[string]string
-	localIPs []string
-	mu       sync.RWMutex
-	enabled  bool
-}
-
-// NewPublisher creates a new mDNS Publisher.
-// If enabled is false, all registration calls will be no-ops.
-func NewPublisher(enabled bool) *Publisher {
-	p := &Publisher{
-		servers:  make(map[string]*zeroconf.Server),
-		aliases:  make(map[string]string),
-		enabled:  enabled,
-		localIPs: getLocalIPs(),
-	}
-
-	if enabled {
-		logger.Info("mDNS publisher initialized", map[string]interface{}{
-			"domain":    mdnsDomain,
-			"local_ips": p.localIPs,
-		})
-	}
-
-	return p
-}
-
-// Register publishes an mDNS hostname for a forward.
-// The hostname will be <alias>.local and will resolve to 127.0.0.1.
-// If the forward has no alias or mDNS is disabled, this is a no-op.
-func (p *Publisher) Register(forwardID, alias string, localPort int) error {
-	if !p.enabled || alias == "" {
-		return nil
-	}
-
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	// Check if already registered
-	if _, exists := p.servers[forwardID]; exists {
-		logger.Debug("mDNS hostname already registered", map[string]interface{}{
-			"forward_id": forwardID,
-			"alias":      alias,
-		})
-		return nil
-	}
-
-	// Register the mDNS service
-	// We use a generic service type and rely on the hostname registration
-	server, err := zeroconf.RegisterProxy(
-		alias,                 // Instance name (shown in service discovery)
-		"_kportal._tcp",       // Service type (custom for kportal)
-		"local.",              // Domain
-		localPort,             // Port
-		alias,                 // Hostname (will be <alias>.local)
-		[]string{"127.0.0.1"}, // IPs to resolve to
-		[]string{fmt.Sprintf("forward=%s", forwardID)}, // TXT records
-		nil, // interfaces (nil = all)
-	)
-	if err != nil {
-		return fmt.Errorf("failed to register mDNS for %s: %w", alias, err)
-	}
-
-	p.servers[forwardID] = server
-	p.aliases[forwardID] = alias
-
-	// Allow zeroconf's internal goroutines (recv4, recv6) to fully initialize.
-	// This prevents a race condition where shutdown() could set connections to nil
-	// while recv goroutines are still starting up.
-	time.Sleep(startupSettleTime)
-
-	logger.Info("mDNS hostname registered", map[string]interface{}{
-		"forward_id": forwardID,
-		"hostname":   GetHostname(alias),
-		"port":       localPort,
-	})
-
-	return nil
-}
-
-// Unregister removes the mDNS hostname for a forward.
-func (p *Publisher) Unregister(forwardID string) {
-	if !p.enabled {
-		return
-	}
-
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	server, exists := p.servers[forwardID]
-	if !exists {
-		return
-	}
-
-	alias := p.aliases[forwardID]
-	shutdownWithTimeout(server, forwardID)
-	delete(p.servers, forwardID)
-	delete(p.aliases, forwardID)
-
-	logger.Info("mDNS hostname unregistered", map[string]interface{}{
-		"forward_id": forwardID,
-		"hostname":   GetHostname(alias),
-	})
-}
-
-// Stop shuts down all mDNS registrations.
-func (p *Publisher) Stop() {
-	if !p.enabled {
-		return
-	}
-
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	// Shutdown all servers concurrently with timeout
-	var wg sync.WaitGroup
-	for forwardID, server := range p.servers {
-		wg.Add(1)
-		go func(id string, srv *zeroconf.Server) {
-			defer wg.Done()
-			shutdownWithTimeout(srv, id)
-		}(forwardID, server)
-	}
-
-	// Wait for all shutdowns to complete (or timeout)
-	wg.Wait()
-
-	p.servers = make(map[string]*zeroconf.Server)
-	p.aliases = make(map[string]string)
-
-	logger.Info("mDNS publisher stopped", nil)
-}
-
-// startupSettleTime is a small delay after zeroconf registration to allow internal
-// goroutines (recv4, recv6) to fully initialize before any shutdown can occur.
-// This works around a race condition in grandcat/zeroconf where shutdown() sets
-// connections to nil while recv goroutines may still be initializing.
-// See: https://github.com/grandcat/zeroconf/issues/95
-const startupSettleTime = 50 * time.Millisecond
-
-// shutdownSettleTime is a small delay after zeroconf shutdown to allow internal
-// goroutines to exit cleanly. This works around a race condition in the
-// grandcat/zeroconf library where recv4() can access ipv4conn after shutdown()
-// sets it to nil. See: https://github.com/grandcat/zeroconf/issues/95
-// Note: 100ms is needed for CI environments where timing can be more variable.
-const shutdownSettleTime = 100 * time.Millisecond
-
-// shutdownWithTimeout attempts to shutdown a zeroconf server with a timeout.
-// If shutdown hangs, it logs a warning and returns anyway.
-func shutdownWithTimeout(server *zeroconf.Server, forwardID string) {
-	done := make(chan struct{})
-
-	go func() {
-		server.Shutdown()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-		// Shutdown completed successfully
-		// Add a small settle time to let internal goroutines exit cleanly.
-		// This works around a race condition in zeroconf where recv4() can
-		// access ipv4conn after shutdown() sets it to nil.
-		time.Sleep(shutdownSettleTime)
-	case <-time.After(shutdownTimeout):
-		logger.Warn("mDNS shutdown timed out, continuing anyway", map[string]interface{}{
-			"forward_id": forwardID,
-			"timeout":    shutdownTimeout.String(),
-		})
-	}
-}
-
-// GetHostname returns the full mDNS hostname for an alias.
-// Example: GetHostname("myapp") returns "myapp.local"
-func GetHostname(alias string) string {
-	return alias + "." + mdnsDomain
-}
-
-// getLocalIPs returns the local IP addresses for logging purposes.
-func getLocalIPs() []string {
-	var ips []string
-
-	addrs, err := net.InterfaceAddrs()
-	if err != nil {
-		return []string{"127.0.0.1"}
-	}
-
-	for _, addr := range addrs {
-		if ipnet, ok := addr.(*net.IPNet); ok && !ipnet.IP.IsLoopback() {
-			if ipnet.IP.To4() != nil {
-				ips = append(ips, ipnet.IP.String())
-			}
-		}
-	}
-
-	if len(ips) == 0 {
-		return []string{"127.0.0.1"}
-	}
-
-	return ips
-}

internal/mdns/publisher_test.go

@@ -1,163 +0,0 @@
-package mdns
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// Note: Tests that actually register mDNS services require network I/O
-// and can be slow or hang in CI environments. We test the logic paths
-// without actually calling zeroconf for most tests.
-
-func TestNewPublisher_Disabled(t *testing.T) {
-	p := NewPublisher(false)
-
-	// When disabled, Register should succeed but be a no-op
-	err := p.Register("forward-1", "test-alias", 8080)
-	assert.NoError(t, err)
-}
-
-func TestNewPublisher_Enabled(t *testing.T) {
-	p := NewPublisher(true)
-	defer p.Stop()
-
-	// Enabled publisher should be created successfully
-	assert.NotNil(t, p)
-}
-
-func TestRegister_WhenDisabled_NoOp(t *testing.T) {
-	p := NewPublisher(false)
-
-	err := p.Register("forward-1", "test-alias", 8080)
-
-	assert.NoError(t, err)
-	// Unregister should also be safe when disabled
-	p.Unregister("forward-1")
-}
-
-func TestRegister_EmptyAlias_NoOp(t *testing.T) {
-	p := NewPublisher(true)
-	defer p.Stop()
-
-	err := p.Register("forward-1", "", 8080)
-
-	assert.NoError(t, err)
-}
-
-func TestUnregister_WhenDisabled_NoOp(t *testing.T) {
-	p := NewPublisher(false)
-
-	// Should not panic
-	p.Unregister("forward-1")
-}
-
-func TestUnregister_NotRegistered_NoOp(t *testing.T) {
-	p := NewPublisher(true)
-	defer p.Stop()
-
-	// Should not panic
-	p.Unregister("non-existent")
-}
-
-func TestStop_WhenDisabled_NoOp(t *testing.T) {
-	p := NewPublisher(false)
-
-	// Should not panic
-	p.Stop()
-}
-
-func TestStop_WhenNoRegistrations(t *testing.T) {
-	p := NewPublisher(true)
-
-	// Should not panic
-	p.Stop()
-}
-
-func TestGetLocalIPs(t *testing.T) {
-	ips := getLocalIPs()
-
-	// Should return at least one IP
-	assert.NotEmpty(t, ips, "getLocalIPs should return at least one IP")
-
-	// All IPs should be non-empty strings
-	for _, ip := range ips {
-		assert.NotEmpty(t, ip, "IP address should not be empty")
-	}
-}
-
-func TestGetHostname(t *testing.T) {
-	hostname := GetHostname("myapp")
-	assert.Equal(t, "myapp.local", hostname)
-}
-
-// Integration tests - only run when explicitly requested
-// These tests actually register mDNS services and require network access
-
-func TestRegister_Integration(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping mDNS integration test in short mode")
-	}
-
-	p := NewPublisher(true)
-	defer p.Stop()
-
-	err := p.Register("forward-1", "test-service", 8080)
-	assert.NoError(t, err)
-
-	// Verify by checking that unregister doesn't panic
-	p.Unregister("forward-1")
-}
-
-func TestRegister_Duplicate_Idempotent_Integration(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping mDNS integration test in short mode")
-	}
-
-	p := NewPublisher(true)
-	defer p.Stop()
-
-	// First registration
-	err := p.Register("forward-1", "test-service", 8080)
-	assert.NoError(t, err)
-
-	// Second registration with same ID should be idempotent
-	err = p.Register("forward-1", "test-service", 8080)
-	assert.NoError(t, err)
-}
-
-func TestRegister_MultipleForwards_Integration(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping mDNS integration test in short mode")
-	}
-
-	p := NewPublisher(true)
-	defer p.Stop()
-
-	err1 := p.Register("forward-1", "service-a", 8080)
-	err2 := p.Register("forward-2", "service-b", 8081)
-	err3 := p.Register("forward-3", "service-c", 8082)
-
-	assert.NoError(t, err1)
-	assert.NoError(t, err2)
-	assert.NoError(t, err3)
-}
-
-func TestUnregister_Success_Integration(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping mDNS integration test in short mode")
-	}
-
-	p := NewPublisher(true)
-	defer p.Stop()
-
-	err := p.Register("forward-1", "test-service", 8080)
-	assert.NoError(t, err)
-
-	// Unregister should not panic and should handle it gracefully
-	p.Unregister("forward-1")
-
-	// Re-registering should work after unregister
-	err = p.Register("forward-1", "test-service-2", 8080)
-	assert.NoError(t, err)
-}

internal/retry/backoff.go

@@ -1,19 +1,3 @@
-// Package retry provides exponential backoff with jitter for retry logic.
-// It implements a backoff sequence of 1s → 2s → 4s → 8s → 10s (max),
-// with 10% random jitter to prevent thundering herd problems.
-//
-// Basic usage:
-//
-//	backoff := retry.NewBackoff()
-//	for {
-//	    err := doSomething()
-//	    if err == nil {
-//	        backoff.Reset()
-//	        break
-//	    }
-//	    delay := backoff.Next()
-//	    time.Sleep(delay)
-//	}
 package retry
 
 import (
@@ -27,24 +11,20 @@ const (
 	initialDelay = 1 * time.Second
 	maxDelay     = 10 * time.Second
 	jitterPct    = 0.1 // 10% jitter
-	// maxAttempt caps the exponent to prevent math.Pow overflow
-	// 2^30 seconds is ~34 years, well above maxDelay, so this is safe
-	maxAttempt = 30
 )
 
 // Backoff implements exponential backoff with jitter for retry logic.
 // The backoff sequence is: 1s → 2s → 4s → 8s → 10s (max, then stays at 10s).
 type Backoff struct {
-	rng     *rand.Rand
 	attempt int
+	rng     *rand.Rand
 }
 
 // NewBackoff creates a new Backoff instance with a seeded random number generator.
 func NewBackoff() *Backoff {
 	return &Backoff{
 		attempt: 0,
-		// #nosec G404 -- math/rand is appropriate for backoff jitter; cryptographic randomness not needed
-		rng: rand.New(rand.NewSource(time.Now().UnixNano())),
+		rng:     rand.New(rand.NewSource(time.Now().UnixNano())),
 	}
 }
 
@@ -52,14 +32,8 @@ func NewBackoff() *Backoff {
 // The duration follows exponential backoff: 1s → 2s → 4s → 8s → 10s (max).
 // A 10% jitter is added to prevent thundering herd effects.
 func (b *Backoff) Next() time.Duration {
-	// Cap attempt to prevent overflow in math.Pow
-	attempt := b.attempt
-	if attempt > maxAttempt {
-		attempt = maxAttempt
-	}
-
 	// Calculate base delay: 2^attempt seconds
-	exp := math.Pow(2, float64(attempt))
+	exp := math.Pow(2, float64(b.attempt))
 	delay := time.Duration(exp) * time.Second
 
 	// Cap at max delay
@@ -69,7 +43,7 @@ func (b *Backoff) Next() time.Duration {
 
 	// Add jitter (±10%)
 	jitter := b.calculateJitter(delay)
-	delay += jitter
+	delay = delay + jitter
 
 	b.attempt++
 	return delay
@@ -93,3 +67,8 @@ func (b *Backoff) calculateJitter(delay time.Duration) time.Duration {
 	jitter := (b.rng.Float64()*2 - 1) * maxJitter
 	return time.Duration(jitter)
 }
+
+// Sleep waits for the next backoff duration.
+func (b *Backoff) Sleep() {
+	time.Sleep(b.Next())
+}

internal/retry/backoff_test.go

@@ -158,12 +158,10 @@ func TestBackoff_ExponentialProgression(t *testing.T) {
 	// We allow for jitter by checking a range
 	for i := 1; i < len(delays)-1; i++ {
 		// Each delay should be roughly double the previous (accounting for jitter)
-		// With 10% jitter on each value:
-		//   Lower bound: (2.0 * 0.9) / 1.1 ≈ 1.636
-		//   Upper bound: (2.0 * 1.1) / 0.9 ≈ 2.444
-		// We use 1.6x to 2.5x as a reasonable range to account for jitter variance
+		// With 10% jitter on each value, worst case: (2.0 * 1.1) / 0.9 = 2.44
+		// We use 1.7x to 2.5x as a reasonable range with 10% jitter on each
 		ratio := float64(delays[i]) / float64(delays[i-1])
-		assert.GreaterOrEqual(t, ratio, 1.6, "exponential growth should be ~2x")
+		assert.GreaterOrEqual(t, ratio, 1.7, "exponential growth should be ~2x")
 		assert.LessOrEqual(t, ratio, 2.5, "exponential growth should be ~2x")
 	}
 }

internal/ui/benchmark_state_test.go

@@ -1,230 +0,0 @@
-package ui
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestNewBenchmarkState tests the constructor
-func TestNewBenchmarkState(t *testing.T) {
-	state := newBenchmarkState("forward-123", "my-service", 8080)
-
-	assert.Equal(t, "forward-123", state.forwardID)
-	assert.Equal(t, "my-service", state.forwardAlias)
-	assert.Equal(t, 8080, state.localPort)
-	assert.Equal(t, BenchmarkStepConfig, state.step)
-	assert.Equal(t, "/", state.urlPath)
-	assert.Equal(t, "GET", state.method)
-	assert.Equal(t, 10, state.concurrency)
-	assert.Equal(t, 100, state.requests)
-	assert.Equal(t, 0, state.cursor)
-	assert.False(t, state.running)
-	assert.Nil(t, state.results)
-	assert.Nil(t, state.error)
-	assert.Nil(t, state.cancelFunc)
-}
-
-// TestBenchmarkState_StepTransitions tests step progression
-func TestBenchmarkState_StepTransitions(t *testing.T) {
-	state := newBenchmarkState("fwd", "alias", 8080)
-
-	// Initial state
-	assert.Equal(t, BenchmarkStepConfig, state.step)
-
-	// Move to running
-	state.step = BenchmarkStepRunning
-	state.running = true
-	assert.Equal(t, BenchmarkStepRunning, state.step)
-	assert.True(t, state.running)
-
-	// Move to results
-	state.step = BenchmarkStepResults
-	state.running = false
-	assert.Equal(t, BenchmarkStepResults, state.step)
-	assert.False(t, state.running)
-}
-
-// TestBenchmarkState_ProgressTracking tests progress updates
-func TestBenchmarkState_ProgressTracking(t *testing.T) {
-	state := newBenchmarkState("fwd", "alias", 8080)
-	state.step = BenchmarkStepRunning
-	state.running = true
-	state.total = 100
-
-	// Simulate progress updates
-	updates := []struct {
-		progress int
-		total    int
-	}{
-		{10, 100},
-		{50, 100},
-		{75, 100},
-		{100, 100},
-	}
-
-	for _, u := range updates {
-		state.progress = u.progress
-		state.total = u.total
-		assert.Equal(t, u.progress, state.progress)
-		assert.Equal(t, u.total, state.total)
-	}
-}
-
-// TestBenchmarkState_CancelFunc tests cancel function handling
-func TestBenchmarkState_CancelFunc(t *testing.T) {
-	state := newBenchmarkState("fwd", "alias", 8080)
-
-	cancelled := false
-	state.cancelFunc = func() {
-		cancelled = true
-	}
-
-	assert.NotNil(t, state.cancelFunc)
-
-	// Call cancel
-	state.cancelFunc()
-	assert.True(t, cancelled)
-}
-
-// TestBenchmarkState_Results tests result storage
-func TestBenchmarkState_Results(t *testing.T) {
-	state := newBenchmarkState("fwd", "alias", 8080)
-
-	results := &BenchmarkResults{
-		TotalRequests: 100,
-		Successful:    95,
-		Failed:        5,
-		MinLatency:    10.5,
-		MaxLatency:    250.0,
-		AvgLatency:    45.2,
-		P50Latency:    40.0,
-		P95Latency:    120.0,
-		P99Latency:    200.0,
-		Throughput:    150.5,
-		BytesRead:     1024000,
-		StatusCodes: map[int]int{
-			200: 90,
-			201: 5,
-			500: 5,
-		},
-	}
-
-	state.results = results
-	state.step = BenchmarkStepResults
-
-	assert.Equal(t, 100, state.results.TotalRequests)
-	assert.Equal(t, 95, state.results.Successful)
-	assert.Equal(t, 5, state.results.Failed)
-	assert.Equal(t, 45.2, state.results.AvgLatency)
-	assert.Equal(t, 150.5, state.results.Throughput)
-}
-
-// TestBenchmarkState_Error tests error handling
-func TestBenchmarkState_Error(t *testing.T) {
-	state := newBenchmarkState("fwd", "alias", 8080)
-
-	assert.Nil(t, state.error)
-
-	// Simulate error
-	state.error = assert.AnError
-	state.step = BenchmarkStepResults
-	state.running = false
-
-	assert.NotNil(t, state.error)
-	assert.Nil(t, state.results)
-}
-
-// TestBenchmarkState_ConfigFields tests configuration field updates
-func TestBenchmarkState_ConfigFields(t *testing.T) {
-	state := newBenchmarkState("fwd", "alias", 8080)
-
-	// Update URL path
-	state.urlPath = "/api/v1/health"
-	assert.Equal(t, "/api/v1/health", state.urlPath)
-
-	// Update method
-	state.method = "POST"
-	assert.Equal(t, "POST", state.method)
-
-	// Update concurrency
-	state.concurrency = 50
-	assert.Equal(t, 50, state.concurrency)
-
-	// Update requests
-	state.requests = 1000
-	assert.Equal(t, 1000, state.requests)
-}
-
-// TestBenchmarkState_CursorBounds tests cursor navigation bounds
-func TestBenchmarkState_CursorBounds(t *testing.T) {
-	state := newBenchmarkState("fwd", "alias", 8080)
-
-	// There are 4 config fields (0-3)
-	tests := []struct {
-		name     string
-		cursor   int
-		expected int
-	}{
-		{"first field", 0, 0},
-		{"second field", 1, 1},
-		{"third field", 2, 2},
-		{"fourth field", 3, 3},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			state.cursor = tt.cursor
-			assert.Equal(t, tt.expected, state.cursor)
-		})
-	}
-}
-
-// TestBenchmarkState_ProgressChannel tests progress channel handling
-func TestBenchmarkState_ProgressChannel(t *testing.T) {
-	state := newBenchmarkState("fwd", "alias", 8080)
-
-	// Create a progress channel
-	state.progressCh = make(chan BenchmarkProgressMsg, 10)
-
-	// Send some progress
-	state.progressCh <- BenchmarkProgressMsg{
-		ForwardID: "fwd",
-		Completed: 50,
-		Total:     100,
-	}
-
-	// Receive and verify
-	msg := <-state.progressCh
-	assert.Equal(t, "fwd", msg.ForwardID)
-	assert.Equal(t, 50, msg.Completed)
-	assert.Equal(t, 100, msg.Total)
-
-	// Close channel
-	close(state.progressCh)
-}
-
-// TestBenchmarkStepValues tests step constants
-func TestBenchmarkStepValues(t *testing.T) {
-	assert.Equal(t, BenchmarkStep(0), BenchmarkStepConfig)
-	assert.Equal(t, BenchmarkStep(1), BenchmarkStepRunning)
-	assert.Equal(t, BenchmarkStep(2), BenchmarkStepResults)
-}
-
-// TestBenchmarkResults_StatusCodeMap tests status code tracking
-func TestBenchmarkResults_StatusCodeMap(t *testing.T) {
-	results := &BenchmarkResults{
-		StatusCodes: make(map[int]int),
-	}
-
-	// Simulate collecting status codes
-	codes := []int{200, 200, 200, 201, 404, 500, 200}
-	for _, code := range codes {
-		results.StatusCodes[code]++
-	}
-
-	assert.Equal(t, 4, results.StatusCodes[200])
-	assert.Equal(t, 1, results.StatusCodes[201])
-	assert.Equal(t, 1, results.StatusCodes[404])
-	assert.Equal(t, 1, results.StatusCodes[500])
-}

internal/ui/bubbletea_ui_test.go

@@ -1,782 +0,0 @@
-package ui
-
-import (
-	"testing"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/stretchr/testify/assert"
-)
-
-// TestNewBubbleTeaUI tests the constructor
-func TestNewBubbleTeaUI(t *testing.T) {
-	callback := func(id string, enable bool) {}
-
-	ui := NewBubbleTeaUI(callback, "1.0.0")
-
-	assert.NotNil(t, ui)
-	assert.NotNil(t, ui.forwards)
-	assert.NotNil(t, ui.forwardOrder)
-	assert.NotNil(t, ui.disabledMap)
-	assert.NotNil(t, ui.errors)
-	assert.Equal(t, "1.0.0", ui.version)
-	assert.Equal(t, ViewModeMain, ui.viewMode)
-	assert.Equal(t, 0, ui.selectedIndex)
-}
-
-// TestBubbleTeaUI_AddForward tests adding forwards
-func TestBubbleTeaUI_AddForward(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-		Alias:     "my-app",
-	}
-
-	ui.AddForward("test-id", fwd)
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	assert.Len(t, ui.forwards, 1)
-	assert.Len(t, ui.forwardOrder, 1)
-	assert.Equal(t, "test-id", ui.forwardOrder[0])
-
-	status := ui.forwards["test-id"]
-	assert.Equal(t, "my-app", status.Alias)
-	assert.Equal(t, "my-app", status.Resource)
-	assert.Equal(t, "pod", status.Type)
-	assert.Equal(t, 8080, status.LocalPort)
-	assert.Equal(t, 8080, status.RemotePort)
-	assert.Equal(t, "Starting", status.Status)
-}
-
-// TestBubbleTeaUI_AddForward_ServiceResource tests adding a service forward
-func TestBubbleTeaUI_AddForward_ServiceResource(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "service/postgres",
-		Port:      5432,
-		LocalPort: 5432,
-	}
-
-	ui.AddForward("svc-id", fwd)
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	status := ui.forwards["svc-id"]
-	assert.Equal(t, "postgres", status.Alias) // Uses resource name when no alias
-	assert.Equal(t, "postgres", status.Resource)
-	assert.Equal(t, "service", status.Type)
-}
-
-// TestBubbleTeaUI_AddForward_ReEnable tests re-enabling a disabled forward
-func TestBubbleTeaUI_AddForward_ReEnable(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-
-	// Add forward
-	ui.AddForward("test-id", fwd)
-
-	// Disable it
-	ui.mu.Lock()
-	ui.disabledMap["test-id"] = true
-	ui.forwards["test-id"].Status = "Disabled"
-	ui.mu.Unlock()
-
-	// Re-add (re-enable)
-	ui.AddForward("test-id", fwd)
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	assert.False(t, ui.disabledMap["test-id"])
-	assert.Equal(t, "Starting", ui.forwards["test-id"].Status)
-	assert.Len(t, ui.forwardOrder, 1) // Should not duplicate
-}
-
-// TestBubbleTeaUI_UpdateStatus tests status updates
-func TestBubbleTeaUI_UpdateStatus(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-	ui.AddForward("test-id", fwd)
-
-	// Update to Active
-	ui.UpdateStatus("test-id", "Active")
-
-	ui.mu.RLock()
-	assert.Equal(t, "Active", ui.forwards["test-id"].Status)
-	ui.mu.RUnlock()
-
-	// Update to Error
-	ui.UpdateStatus("test-id", "Error")
-
-	ui.mu.RLock()
-	assert.Equal(t, "Error", ui.forwards["test-id"].Status)
-	ui.mu.RUnlock()
-}
-
-// TestBubbleTeaUI_UpdateStatus_ClearsErrorOnActive tests that errors are cleared when status becomes Active
-func TestBubbleTeaUI_UpdateStatus_ClearsErrorOnActive(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-	ui.AddForward("test-id", fwd)
-
-	// Set an error
-	ui.SetError("test-id", "connection refused")
-
-	ui.mu.RLock()
-	assert.Equal(t, "connection refused", ui.errors["test-id"])
-	ui.mu.RUnlock()
-
-	// Update to Active - should clear error
-	ui.UpdateStatus("test-id", "Active")
-
-	ui.mu.RLock()
-	_, hasError := ui.errors["test-id"]
-	ui.mu.RUnlock()
-
-	assert.False(t, hasError, "Error should be cleared when status becomes Active")
-}
-
-// TestBubbleTeaUI_UpdateStatus_KeepsErrorOnReconnecting tests that errors persist during reconnection
-func TestBubbleTeaUI_UpdateStatus_KeepsErrorOnReconnecting(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-	ui.AddForward("test-id", fwd)
-
-	// Set an error
-	ui.SetError("test-id", "connection refused")
-
-	// Update to Reconnecting - should keep error
-	ui.UpdateStatus("test-id", "Reconnecting")
-
-	ui.mu.RLock()
-	assert.Equal(t, "connection refused", ui.errors["test-id"])
-	ui.mu.RUnlock()
-}
-
-// TestBubbleTeaUI_SetError tests error setting
-func TestBubbleTeaUI_SetError(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-	ui.AddForward("test-id", fwd)
-
-	ui.SetError("test-id", "connection timeout")
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	assert.Equal(t, "connection timeout", ui.errors["test-id"])
-}
-
-// TestBubbleTeaUI_Remove tests forward removal
-func TestBubbleTeaUI_Remove(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-	ui.AddForward("test-id", fwd)
-
-	ui.Remove("test-id")
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	assert.Len(t, ui.forwards, 0)
-	assert.Len(t, ui.forwardOrder, 0)
-}
-
-// TestBubbleTeaUI_Remove_ClearsErrors tests that removal clears associated errors
-func TestBubbleTeaUI_Remove_ClearsErrors(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-	ui.AddForward("test-id", fwd)
-	ui.SetError("test-id", "some error")
-
-	ui.Remove("test-id")
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	_, hasError := ui.errors["test-id"]
-	assert.False(t, hasError, "Error should be cleared on removal")
-}
-
-// TestBubbleTeaUI_Remove_AdjustsSelectedIndex tests index adjustment after removal
-func TestBubbleTeaUI_Remove_AdjustsSelectedIndex(t *testing.T) {
-	tests := []struct {
-		name              string
-		removeID          string
-		forwards          []string
-		selectedIndex     int
-		expectedIndex     int
-		expectedRemaining int
-	}{
-		{
-			name:              "remove selected item (last in list)",
-			forwards:          []string{"a", "b", "c"},
-			selectedIndex:     2,
-			removeID:          "c",
-			expectedIndex:     1, // Should move to previous item
-			expectedRemaining: 2,
-		},
-		{
-			name:              "remove item before selected",
-			forwards:          []string{"a", "b", "c"},
-			selectedIndex:     2,
-			removeID:          "a",
-			expectedIndex:     1, // Index shifts down but points to same item
-			expectedRemaining: 2,
-		},
-		{
-			name:              "remove item after selected",
-			forwards:          []string{"a", "b", "c"},
-			selectedIndex:     0,
-			removeID:          "c",
-			expectedIndex:     0, // No change needed
-			expectedRemaining: 2,
-		},
-		{
-			name:              "remove only item",
-			forwards:          []string{"a"},
-			selectedIndex:     0,
-			removeID:          "a",
-			expectedIndex:     0, // Stays at 0 (clamped)
-			expectedRemaining: 0,
-		},
-		{
-			name:              "remove middle item when selected is after",
-			forwards:          []string{"a", "b", "c", "d"},
-			selectedIndex:     3,
-			removeID:          "b",
-			expectedIndex:     2, // Adjusts down
-			expectedRemaining: 3,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ui := NewBubbleTeaUI(nil, "1.0.0")
-
-			// Add forwards
-			for _, id := range tt.forwards {
-				fwd := &config.Forward{
-					Resource:  "pod/" + id,
-					Port:      8080,
-					LocalPort: 8080,
-				}
-				ui.AddForward(id, fwd)
-			}
-
-			// Set selected index
-			ui.mu.Lock()
-			ui.selectedIndex = tt.selectedIndex
-			ui.mu.Unlock()
-
-			// Remove
-			ui.Remove(tt.removeID)
-
-			ui.mu.RLock()
-			defer ui.mu.RUnlock()
-
-			assert.Equal(t, tt.expectedIndex, ui.selectedIndex)
-			assert.Len(t, ui.forwardOrder, tt.expectedRemaining)
-		})
-	}
-}
-
-// TestBubbleTeaUI_Remove_ClearsDeleteConfirmation tests that pending delete confirmation is cleared
-func TestBubbleTeaUI_Remove_ClearsDeleteConfirmation(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-	ui.AddForward("test-id", fwd)
-
-	// Set up delete confirmation
-	ui.mu.Lock()
-	ui.deleteConfirming = true
-	ui.deleteConfirmID = "test-id"
-	ui.deleteConfirmAlias = "my-app"
-	ui.mu.Unlock()
-
-	// Remove the forward
-	ui.Remove("test-id")
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	assert.False(t, ui.deleteConfirming, "Delete confirmation should be cleared")
-	assert.Empty(t, ui.deleteConfirmID)
-}
-
-// TestBubbleTeaUI_Remove_KeepsOtherDeleteConfirmation tests that unrelated delete confirmation persists
-func TestBubbleTeaUI_Remove_KeepsOtherDeleteConfirmation(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd1 := &config.Forward{Resource: "pod/app1", Port: 8080, LocalPort: 8080}
-	fwd2 := &config.Forward{Resource: "pod/app2", Port: 8081, LocalPort: 8081}
-	ui.AddForward("id-1", fwd1)
-	ui.AddForward("id-2", fwd2)
-
-	// Set up delete confirmation for id-2
-	ui.mu.Lock()
-	ui.deleteConfirming = true
-	ui.deleteConfirmID = "id-2"
-	ui.deleteConfirmAlias = "app2"
-	ui.mu.Unlock()
-
-	// Remove id-1 (different forward)
-	ui.Remove("id-1")
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	assert.True(t, ui.deleteConfirming, "Delete confirmation for other forward should persist")
-	assert.Equal(t, "id-2", ui.deleteConfirmID)
-}
-
-// TestBubbleTeaUI_MoveSelection tests cursor movement
-func TestBubbleTeaUI_MoveSelection(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	// Add some forwards
-	for i := 0; i < 5; i++ {
-		fwd := &config.Forward{
-			Resource:  "pod/app",
-			Port:      8080 + i,
-			LocalPort: 8080 + i,
-		}
-		ui.AddForward(string(rune('a'+i)), fwd)
-	}
-
-	tests := []struct {
-		name          string
-		initialIndex  int
-		delta         int
-		expectedIndex int
-	}{
-		{"move down from 0", 0, 1, 1},
-		{"move down from middle", 2, 1, 3},
-		{"move up from middle", 2, -1, 1},
-		{"cannot move below 0", 0, -1, 0},
-		{"cannot move above max", 4, 1, 4},
-		{"large delta clamped to max", 0, 100, 4},
-		{"large negative delta clamped to 0", 4, -100, 0},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ui.mu.Lock()
-			ui.selectedIndex = tt.initialIndex
-			ui.mu.Unlock()
-
-			ui.moveSelection(tt.delta)
-
-			ui.mu.RLock()
-			assert.Equal(t, tt.expectedIndex, ui.selectedIndex)
-			ui.mu.RUnlock()
-		})
-	}
-}
-
-// TestBubbleTeaUI_MoveSelection_EmptyList tests movement with no forwards
-func TestBubbleTeaUI_MoveSelection_EmptyList(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	// Should not panic with empty list
-	ui.moveSelection(1)
-	ui.moveSelection(-1)
-
-	ui.mu.RLock()
-	assert.Equal(t, 0, ui.selectedIndex)
-	ui.mu.RUnlock()
-}
-
-// TestBubbleTeaUI_ToggleSelected tests toggling forward state
-func TestBubbleTeaUI_ToggleSelected(t *testing.T) {
-	callback := func(id string, enable bool) {
-		// Callback is called in a goroutine
-	}
-
-	ui := NewBubbleTeaUI(callback, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-	ui.AddForward("test-id", fwd)
-
-	// Toggle to disabled
-	ui.toggleSelected()
-
-	// Wait for goroutine
-	ui.mu.RLock()
-	isDisabled := ui.disabledMap["test-id"]
-	ui.mu.RUnlock()
-
-	assert.True(t, isDisabled)
-
-	// Toggle back to enabled
-	ui.toggleSelected()
-
-	ui.mu.RLock()
-	isDisabled = ui.disabledMap["test-id"]
-	ui.mu.RUnlock()
-
-	assert.False(t, isDisabled)
-}
-
-// TestBubbleTeaUI_SetUpdateAvailable tests update notification
-func TestBubbleTeaUI_SetUpdateAvailable(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	ui.SetUpdateAvailable("2.0.0", "https://example.com/update")
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	assert.True(t, ui.updateAvailable)
-	assert.Equal(t, "2.0.0", ui.updateVersion)
-	assert.Equal(t, "https://example.com/update", ui.updateURL)
-}
-
-// TestBubbleTeaUI_SetWizardDependencies tests dependency injection
-func TestBubbleTeaUI_SetWizardDependencies(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	// Initially nil
-	ui.mu.RLock()
-	assert.Nil(t, ui.discovery)
-	assert.Nil(t, ui.mutator)
-	assert.Empty(t, ui.configPath)
-	ui.mu.RUnlock()
-
-	// Set dependencies (using nil for simplicity - just testing the setter)
-	ui.SetWizardDependencies(nil, nil, "/path/to/config.yaml")
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	assert.Equal(t, "/path/to/config.yaml", ui.configPath)
-}
-
-// TestBubbleTeaUI_ResetDeleteConfirmation tests the reset helper
-func TestBubbleTeaUI_ResetDeleteConfirmation(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	// Set up confirmation state
-	ui.mu.Lock()
-	ui.deleteConfirming = true
-	ui.deleteConfirmID = "test-id"
-	ui.deleteConfirmAlias = "test-alias"
-	ui.deleteConfirmCursor = 1
-	ui.mu.Unlock()
-
-	// Reset
-	ui.mu.Lock()
-	ui.resetDeleteConfirmation()
-	ui.mu.Unlock()
-
-	ui.mu.RLock()
-	defer ui.mu.RUnlock()
-
-	assert.False(t, ui.deleteConfirming)
-	assert.Empty(t, ui.deleteConfirmID)
-	assert.Empty(t, ui.deleteConfirmAlias)
-	assert.Equal(t, 0, ui.deleteConfirmCursor)
-}
-
-// TestBubbleTeaUI_IsForwardDisabled tests the disabled state helper
-func TestBubbleTeaUI_IsForwardDisabled(t *testing.T) {
-	tests := []struct {
-		name           string
-		forwardStatus  string
-		disabledMap    bool
-		expectedResult bool
-	}{
-		{
-			name:           "not disabled in map, Active status",
-			disabledMap:    false,
-			forwardStatus:  "Active",
-			expectedResult: false,
-		},
-		{
-			name:           "disabled in map, Active status",
-			disabledMap:    true,
-			forwardStatus:  "Active",
-			expectedResult: true,
-		},
-		{
-			name:           "not disabled in map, Disabled status",
-			disabledMap:    false,
-			forwardStatus:  "Disabled",
-			expectedResult: true,
-		},
-		{
-			name:           "both disabled in map and Disabled status",
-			disabledMap:    true,
-			forwardStatus:  "Disabled",
-			expectedResult: true,
-		},
-		{
-			name:           "not disabled in map, Error status",
-			disabledMap:    false,
-			forwardStatus:  "Error",
-			expectedResult: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ui := NewBubbleTeaUI(nil, "1.0.0")
-
-			fwd := &config.Forward{
-				Resource:  "pod/my-app",
-				Port:      8080,
-				LocalPort: 8080,
-			}
-			ui.AddForward("test-id", fwd)
-
-			ui.mu.Lock()
-			ui.disabledMap["test-id"] = tt.disabledMap
-			ui.forwards["test-id"].Status = tt.forwardStatus
-			ui.mu.Unlock()
-
-			ui.mu.RLock()
-			result := ui.isForwardDisabled("test-id")
-			ui.mu.RUnlock()
-
-			assert.Equal(t, tt.expectedResult, result)
-		})
-	}
-}
-
-// TestBubbleTeaUI_IsForwardDisabled_NonExistent tests disabled check for non-existent forward
-func TestBubbleTeaUI_IsForwardDisabled_NonExistent(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	ui.mu.RLock()
-	result := ui.isForwardDisabled("non-existent")
-	ui.mu.RUnlock()
-
-	assert.False(t, result, "Non-existent forward should not be disabled")
-}
-
-// TestBubbleTeaUI_AddForward_ReEnableClearsError tests that re-enabling clears previous errors
-func TestBubbleTeaUI_AddForward_ReEnableClearsError(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	fwd := &config.Forward{
-		Resource:  "pod/my-app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-
-	// Add forward
-	ui.AddForward("test-id", fwd)
-
-	// Set error and disable
-	ui.SetError("test-id", "connection refused")
-	ui.mu.Lock()
-	ui.disabledMap["test-id"] = true
-	ui.forwards["test-id"].Status = "Disabled"
-	ui.mu.Unlock()
-
-	// Verify error exists
-	ui.mu.RLock()
-	_, hasError := ui.errors["test-id"]
-	ui.mu.RUnlock()
-	assert.True(t, hasError, "Error should exist before re-enable")
-
-	// Re-enable (re-add)
-	ui.AddForward("test-id", fwd)
-
-	// Verify error is cleared
-	ui.mu.RLock()
-	_, hasError = ui.errors["test-id"]
-	ui.mu.RUnlock()
-	assert.False(t, hasError, "Error should be cleared after re-enable")
-}
-
-// TestWrapText tests the text wrapping function
-func TestWrapText(t *testing.T) {
-	tests := []struct {
-		name     string
-		text     string
-		expected string
-		width    int
-	}{
-		{
-			name:     "short text fits",
-			text:     "hello world",
-			width:    20,
-			expected: "hello world",
-		},
-		{
-			name:     "single long word",
-			text:     "superlongwordthatexceedswidth",
-			width:    10,
-			expected: "superlongwordthatexceedswidth",
-		},
-		{
-			name:     "wraps at word boundary",
-			text:     "hello world this is a test",
-			width:    15,
-			expected: "hello world\nthis is a test",
-		},
-		{
-			name:     "multiple wraps",
-			text:     "one two three four five six",
-			width:    10,
-			expected: "one two\nthree four\nfive six",
-		},
-		{
-			name:     "empty string",
-			text:     "",
-			width:    10,
-			expected: "",
-		},
-		{
-			name:     "single word",
-			text:     "hello",
-			width:    10,
-			expected: "hello",
-		},
-		{
-			name:     "exact width",
-			text:     "hello wor",
-			width:    9,
-			expected: "hello wor",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := wrapText(tt.text, tt.width)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestBubbleTeaUI_AddForward_ResourceParsing tests various resource format parsing
-func TestBubbleTeaUI_AddForward_ResourceParsing(t *testing.T) {
-	tests := []struct {
-		name         string
-		resource     string
-		expectedType string
-		expectedName string
-	}{
-		{
-			name:         "pod with prefix",
-			resource:     "pod/my-app",
-			expectedType: "pod",
-			expectedName: "my-app",
-		},
-		{
-			name:         "service resource",
-			resource:     "service/postgres",
-			expectedType: "service",
-			expectedName: "postgres",
-		},
-		{
-			name:         "deployment resource",
-			resource:     "deployment/api-server",
-			expectedType: "deployment",
-			expectedName: "api-server",
-		},
-		{
-			name:         "no type prefix (pod default)",
-			resource:     "my-pod",
-			expectedType: "pod",
-			expectedName: "my-pod",
-		},
-		{
-			name:         "resource with multiple slashes",
-			resource:     "custom/type/resource",
-			expectedType: "custom",
-			expectedName: "type/resource",
-		},
-		{
-			name:         "empty resource",
-			resource:     "",
-			expectedType: "pod",
-			expectedName: "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ui := NewBubbleTeaUI(nil, "1.0.0")
-
-			fwd := &config.Forward{
-				Resource:  tt.resource,
-				Port:      8080,
-				LocalPort: 8080,
-			}
-			ui.AddForward("test-id", fwd)
-
-			ui.mu.RLock()
-			status := ui.forwards["test-id"]
-			ui.mu.RUnlock()
-
-			assert.Equal(t, tt.expectedType, status.Type)
-			assert.Equal(t, tt.expectedName, status.Resource)
-		})
-	}
-}
-
-// TestConstants tests that UI constants are properly defined
-func TestConstants(t *testing.T) {
-	assert.Equal(t, 120, DefaultTermWidth)
-	assert.Equal(t, 40, DefaultTermHeight)
-	assert.Equal(t, 7, ColumnStatus)
-	assert.Equal(t, 14, ColumnWidthContext)
-	assert.Equal(t, 16, ColumnWidthNamespace)
-	assert.Equal(t, 18, ColumnWidthAlias)
-	assert.Equal(t, 8, ColumnWidthType)
-	assert.Equal(t, 20, ColumnWidthResource)
-	assert.Equal(t, 118, ErrorDisplayWidth)
-	assert.Equal(t, 20, ViewportHeight)
-}

internal/ui/commands_test.go

@@ -1,422 +0,0 @@
-package ui
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/lukaszraczylo/kportal/internal/k8s"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestMessageTypes tests the message type structures
-func TestMessageTypes(t *testing.T) {
-	t.Run("ContextsLoadedMsg", func(t *testing.T) {
-		msg := ContextsLoadedMsg{
-			contexts: []string{"ctx1", "ctx2"},
-		}
-		assert.Len(t, msg.contexts, 2)
-		assert.Nil(t, msg.err)
-
-		errMsg := ContextsLoadedMsg{
-			err: assert.AnError,
-		}
-		assert.NotNil(t, errMsg.err)
-	})
-
-	t.Run("NamespacesLoadedMsg", func(t *testing.T) {
-		msg := NamespacesLoadedMsg{
-			namespaces: []string{"default", "kube-system"},
-		}
-		assert.Len(t, msg.namespaces, 2)
-		assert.Nil(t, msg.err)
-	})
-
-	t.Run("PodsLoadedMsg", func(t *testing.T) {
-		msg := PodsLoadedMsg{
-			pods: []k8s.PodInfo{
-				{Name: "pod1", Namespace: "default"},
-				{Name: "pod2", Namespace: "default"},
-			},
-		}
-		assert.Len(t, msg.pods, 2)
-		assert.Nil(t, msg.err)
-	})
-
-	t.Run("ServicesLoadedMsg", func(t *testing.T) {
-		msg := ServicesLoadedMsg{
-			services: []k8s.ServiceInfo{
-				{Name: "svc1", Namespace: "default"},
-			},
-		}
-		assert.Len(t, msg.services, 1)
-		assert.Nil(t, msg.err)
-	})
-
-	t.Run("SelectorValidatedMsg", func(t *testing.T) {
-		validMsg := SelectorValidatedMsg{
-			valid: true,
-			pods: []k8s.PodInfo{
-				{Name: "matched-pod"},
-			},
-		}
-		assert.True(t, validMsg.valid)
-		assert.Len(t, validMsg.pods, 1)
-
-		invalidMsg := SelectorValidatedMsg{
-			valid: false,
-			err:   assert.AnError,
-		}
-		assert.False(t, invalidMsg.valid)
-		assert.NotNil(t, invalidMsg.err)
-	})
-
-	t.Run("PortCheckedMsg", func(t *testing.T) {
-		availableMsg := PortCheckedMsg{
-			port:      8080,
-			available: true,
-			message:   "Port 8080 available",
-		}
-		assert.Equal(t, 8080, availableMsg.port)
-		assert.True(t, availableMsg.available)
-		assert.Equal(t, "Port 8080 available", availableMsg.message)
-
-		unavailableMsg := PortCheckedMsg{
-			port:      8080,
-			available: false,
-			message:   "Port 8080 in use by process",
-		}
-		assert.Equal(t, 8080, unavailableMsg.port)
-		assert.False(t, unavailableMsg.available)
-		assert.Equal(t, "Port 8080 in use by process", unavailableMsg.message)
-	})
-
-	t.Run("ForwardSavedMsg", func(t *testing.T) {
-		successMsg := ForwardSavedMsg{success: true}
-		assert.True(t, successMsg.success)
-
-		failMsg := ForwardSavedMsg{success: false, err: assert.AnError}
-		assert.False(t, failMsg.success)
-		assert.NotNil(t, failMsg.err)
-	})
-
-	t.Run("ForwardsRemovedMsg", func(t *testing.T) {
-		msg := ForwardsRemovedMsg{
-			success: true,
-			count:   3,
-		}
-		assert.True(t, msg.success)
-		assert.Equal(t, 3, msg.count)
-	})
-
-	t.Run("WizardCompleteMsg", func(t *testing.T) {
-		msg := WizardCompleteMsg{}
-		assert.NotNil(t, msg)
-	})
-
-	t.Run("BenchmarkCompleteMsg", func(t *testing.T) {
-		msg := BenchmarkCompleteMsg{
-			ForwardID: "fwd-123",
-		}
-		assert.Equal(t, "fwd-123", msg.ForwardID)
-		assert.Nil(t, msg.Results)
-		assert.Nil(t, msg.Error)
-	})
-
-	t.Run("BenchmarkProgressMsg", func(t *testing.T) {
-		msg := BenchmarkProgressMsg{
-			ForwardID: "fwd-123",
-			Completed: 50,
-			Total:     100,
-		}
-		assert.Equal(t, "fwd-123", msg.ForwardID)
-		assert.Equal(t, 50, msg.Completed)
-		assert.Equal(t, 100, msg.Total)
-	})
-
-	t.Run("HTTPLogEntryMsg", func(t *testing.T) {
-		msg := HTTPLogEntryMsg{
-			Entry: HTTPLogEntry{
-				Method:     "GET",
-				Path:       "/api/test",
-				StatusCode: 200,
-			},
-		}
-		assert.Equal(t, "GET", msg.Entry.Method)
-		assert.Equal(t, "/api/test", msg.Entry.Path)
-		assert.Equal(t, 200, msg.Entry.StatusCode)
-	})
-}
-
-// TestCheckPortCmd tests the port availability check command
-func TestCheckPortCmd_PortAvailability(t *testing.T) {
-	// Create a temporary config file for testing
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	// Create an empty config file
-	err := os.WriteFile(configPath, []byte("contexts: []\n"), 0600)
-	require.NoError(t, err)
-
-	// Test checking a random high port that should be available
-	cmd := checkPortCmd(59999, configPath, "")
-	msg := cmd()
-
-	portMsg, ok := msg.(PortCheckedMsg)
-	require.True(t, ok, "Expected PortCheckedMsg")
-	assert.Equal(t, 59999, portMsg.port)
-	// The port may or may not be available depending on the system,
-	// but we verify the message structure is correct
-	assert.NotEmpty(t, portMsg.message)
-}
-
-// TestCheckPortCmd_ConfigConflict tests port conflict detection in config
-func TestCheckPortCmd_ConfigConflict(t *testing.T) {
-	// Create a temporary config file with a forward using port 8080
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	configContent := `contexts:
-  - name: test-ctx
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/my-app
-            port: 80
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(configContent), 0600)
-	require.NoError(t, err)
-
-	// Test checking port that's already in config
-	cmd := checkPortCmd(8080, configPath, "")
-	msg := cmd()
-
-	portMsg, ok := msg.(PortCheckedMsg)
-	require.True(t, ok, "Expected PortCheckedMsg")
-	assert.Equal(t, 8080, portMsg.port)
-	assert.False(t, portMsg.available, "Port should not be available (in config)")
-	assert.Contains(t, portMsg.message, "already assigned")
-}
-
-// TestCheckPortCmd_ExcludeID_AllowsKeepingOwnPort verifies that in edit mode
-// (excludeID set to the forward's own ID), the wizard does not falsely report
-// the same local port as already in use by the forward being edited.
-func TestCheckPortCmd_ExcludeID_AllowsKeepingOwnPort(t *testing.T) {
-	tmpDir := t.TempDir()
-	configPath := filepath.Join(tmpDir, ".kportal.yaml")
-
-	configContent := `contexts:
-  - name: test-ctx
-    namespaces:
-      - name: default
-        forwards:
-          - resource: pod/my-app
-            port: 80
-            localPort: 8080
-`
-	err := os.WriteFile(configPath, []byte(configContent), 0600)
-	require.NoError(t, err)
-
-	// The forward's ID format is "<context>/<namespace>/<resource>:<port>".
-	excludeID := "test-ctx/default/pod/my-app:8080"
-
-	cmd := checkPortCmd(8080, configPath, excludeID)
-	msg := cmd()
-
-	portMsg, ok := msg.(PortCheckedMsg)
-	require.True(t, ok, "Expected PortCheckedMsg")
-	assert.Equal(t, 8080, portMsg.port)
-	// The config-conflict path must skip the excluded ID. The OS-level port
-	// availability check still runs, so the result depends on whether 8080 is
-	// in use by some other process — the relevant assertion is that the
-	// message does NOT mention "already assigned" (which is the config check).
-	assert.NotContains(t, portMsg.message, "already assigned",
-		"excludeID should suppress the config self-conflict, but got %q", portMsg.message)
-}
-
-// TestCheckPortCmd_InvalidConfig tests behavior with invalid config file
-func TestCheckPortCmd_InvalidConfig(t *testing.T) {
-	// Use a non-existent config path
-	cmd := checkPortCmd(59998, "/nonexistent/path/.kportal.yaml", "")
-	msg := cmd()
-
-	portMsg, ok := msg.(PortCheckedMsg)
-	require.True(t, ok, "Expected PortCheckedMsg")
-	// Should still return a result (just skip config check)
-	assert.Equal(t, 59998, portMsg.port)
-	assert.NotEmpty(t, portMsg.message)
-}
-
-// TestListenBenchmarkProgressCmd tests the progress listener command
-func TestListenBenchmarkProgressCmd(t *testing.T) {
-	progressCh := make(chan BenchmarkProgressMsg, 1)
-
-	// Send a progress message
-	progressCh <- BenchmarkProgressMsg{
-		ForwardID: "fwd-123",
-		Completed: 25,
-		Total:     100,
-	}
-
-	cmd := listenBenchmarkProgressCmd(progressCh)
-	msg := cmd()
-
-	progressMsg, ok := msg.(BenchmarkProgressMsg)
-	require.True(t, ok, "Expected BenchmarkProgressMsg")
-	assert.Equal(t, "fwd-123", progressMsg.ForwardID)
-	assert.Equal(t, 25, progressMsg.Completed)
-	assert.Equal(t, 100, progressMsg.Total)
-}
-
-// TestListenBenchmarkProgressCmd_ChannelClosed tests behavior when channel closes
-func TestListenBenchmarkProgressCmd_ChannelClosed(t *testing.T) {
-	progressCh := make(chan BenchmarkProgressMsg)
-	close(progressCh)
-
-	cmd := listenBenchmarkProgressCmd(progressCh)
-	msg := cmd()
-
-	assert.Nil(t, msg, "Should return nil when channel is closed")
-}
-
-// TestRunBenchmarkCmd_Cancellation tests benchmark cancellation
-func TestRunBenchmarkCmd_Cancellation(t *testing.T) {
-	// Create a context that's already cancelled
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel() // Cancel immediately
-
-	progressCh := make(chan BenchmarkProgressMsg, 100)
-
-	cmd := runBenchmarkCmd(ctx, "fwd-123", 59997, "/", "GET", 1, 10, progressCh)
-
-	// Run with timeout to prevent hanging
-	done := make(chan bool, 1)
-	var msg any
-	go func() {
-		msg = cmd()
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		// Command completed
-	case <-time.After(5 * time.Second):
-		t.Fatal("runBenchmarkCmd timed out")
-	}
-
-	completeMsg, ok := msg.(BenchmarkCompleteMsg)
-	require.True(t, ok, "Expected BenchmarkCompleteMsg")
-	assert.Equal(t, "fwd-123", completeMsg.ForwardID)
-	// When cancelled, we expect either an error or the context cancellation message
-	// The benchmark may or may not have had time to process the cancellation
-}
-
-// TestK8sAPITimeout tests that the timeout constant is correct
-func TestK8sAPITimeout(t *testing.T) {
-	assert.Equal(t, 10*time.Second, k8sAPITimeout)
-}
-
-// TestRemovableForwardStruct tests the RemovableForward structure used by commands
-func TestRemovableForwardStruct(t *testing.T) {
-	rf := RemovableForward{
-		ID:        "fwd-123",
-		Context:   "prod",
-		Namespace: "default",
-		Resource:  "pod/my-app",
-		Selector:  "app=my-app",
-		Alias:     "my-app",
-		Port:      80,
-		LocalPort: 8080,
-	}
-
-	assert.Equal(t, "fwd-123", rf.ID)
-	assert.Equal(t, "prod", rf.Context)
-	assert.Equal(t, "default", rf.Namespace)
-	assert.Equal(t, "pod/my-app", rf.Resource)
-	assert.Equal(t, "app=my-app", rf.Selector)
-	assert.Equal(t, "my-app", rf.Alias)
-	assert.Equal(t, 80, rf.Port)
-	assert.Equal(t, 8080, rf.LocalPort)
-}
-
-// TestBenchmarkProgressCallback tests the progress callback in runBenchmarkCmd
-func TestBenchmarkProgressCallback(t *testing.T) {
-	// Test that progress channel handles blocking gracefully
-	progressCh := make(chan BenchmarkProgressMsg, 1) // Small buffer
-
-	// Fill the channel
-	progressCh <- BenchmarkProgressMsg{Completed: 1, Total: 100}
-
-	// Test non-blocking send by creating callback similar to runBenchmarkCmd
-	callback := func(completed, total int) {
-		select {
-		case progressCh <- BenchmarkProgressMsg{
-			ForwardID: "test",
-			Completed: completed,
-			Total:     total,
-		}:
-		default:
-			// Drop if channel is full - should not block
-		}
-	}
-
-	// Should not block even with full channel
-	done := make(chan bool, 1)
-	go func() {
-		callback(50, 100) // This should not block
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		// Success - didn't block
-	case <-time.After(100 * time.Millisecond):
-		t.Fatal("Callback blocked when channel was full")
-	}
-}
-
-// TestHTTPLogEntry tests the HTTPLogEntry structure
-func TestHTTPLogEntry(t *testing.T) {
-	entry := HTTPLogEntry{
-		Timestamp:  "2025-11-26T10:30:00Z",
-		Direction:  "request",
-		Method:     "POST",
-		Path:       "/api/users",
-		StatusCode: 201,
-		LatencyMs:  150,
-		BodySize:   1024,
-	}
-
-	assert.Equal(t, "2025-11-26T10:30:00Z", entry.Timestamp)
-	assert.Equal(t, "request", entry.Direction)
-	assert.Equal(t, "POST", entry.Method)
-	assert.Equal(t, "/api/users", entry.Path)
-	assert.Equal(t, 201, entry.StatusCode)
-	assert.Equal(t, int64(150), entry.LatencyMs)
-	assert.Equal(t, 1024, entry.BodySize)
-}
-
-// TestHTTPLogSubscriberType tests the HTTPLogSubscriber function type
-func TestHTTPLogSubscriberType(t *testing.T) {
-	// Test that our mock matches the type
-	mock := NewMockHTTPLogSubscriber()
-	subscriber := mock.GetSubscriberFunc()
-
-	// Test subscription
-	callCount := 0
-	cleanup := subscriber("fwd-123", func(entry HTTPLogEntry) {
-		callCount++
-	})
-
-	// Send an entry
-	mock.SendEntry("fwd-123", HTTPLogEntry{Method: "GET"})
-	assert.Equal(t, 1, callCount)
-
-	// Clean up
-	cleanup()
-	assert.Equal(t, 1, mock.CleanupCalls)
-}

internal/ui/concurrent_test.go

@@ -1,371 +0,0 @@
-package ui
-
-import (
-	"fmt"
-	"sync"
-	"testing"
-
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/stretchr/testify/assert"
-)
-
-// TestConcurrent_AddAndRemove tests concurrent add and remove operations
-// Run with: go test -race ./internal/ui/...
-func TestConcurrent_AddAndRemove(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	var wg sync.WaitGroup
-	numGoroutines := 100
-
-	// Concurrent adds
-	for i := 0; i < numGoroutines; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			fwd := &config.Forward{
-				Resource:  fmt.Sprintf("pod/app-%d", idx),
-				Port:      8080 + idx,
-				LocalPort: 8080 + idx,
-			}
-			ui.AddForward(fmt.Sprintf("id-%d", idx), fwd)
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Verify all adds succeeded
-	ui.mu.RLock()
-	assert.Len(t, ui.forwards, numGoroutines)
-	ui.mu.RUnlock()
-
-	// Concurrent removes
-	for i := 0; i < numGoroutines; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			ui.Remove(fmt.Sprintf("id-%d", idx))
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Verify all removes succeeded
-	ui.mu.RLock()
-	assert.Len(t, ui.forwards, 0)
-	ui.mu.RUnlock()
-}
-
-// TestConcurrent_StatusUpdates tests concurrent status updates
-func TestConcurrent_StatusUpdates(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	// Add forwards first
-	for i := 0; i < 10; i++ {
-		fwd := &config.Forward{
-			Resource:  fmt.Sprintf("pod/app-%d", i),
-			Port:      8080 + i,
-			LocalPort: 8080 + i,
-		}
-		ui.AddForward(fmt.Sprintf("id-%d", i), fwd)
-	}
-
-	var wg sync.WaitGroup
-	numUpdates := 1000
-	statuses := []string{"Active", "Starting", "Reconnecting", "Error"}
-
-	// Concurrent status updates
-	for i := 0; i < numUpdates; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			forwardID := fmt.Sprintf("id-%d", idx%10)
-			status := statuses[idx%len(statuses)]
-			ui.UpdateStatus(forwardID, status)
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Just verify no panics occurred - final state is non-deterministic
-	ui.mu.RLock()
-	assert.Len(t, ui.forwards, 10)
-	ui.mu.RUnlock()
-}
-
-// TestConcurrent_SetErrors tests concurrent error setting
-func TestConcurrent_SetErrors(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	// Add forwards
-	for i := 0; i < 10; i++ {
-		fwd := &config.Forward{
-			Resource:  fmt.Sprintf("pod/app-%d", i),
-			Port:      8080 + i,
-			LocalPort: 8080 + i,
-		}
-		ui.AddForward(fmt.Sprintf("id-%d", i), fwd)
-	}
-
-	var wg sync.WaitGroup
-	numErrors := 500
-
-	// Concurrent error setting
-	for i := 0; i < numErrors; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			forwardID := fmt.Sprintf("id-%d", idx%10)
-			ui.SetError(forwardID, fmt.Sprintf("error-%d", idx))
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Verify no panics
-	ui.mu.RLock()
-	assert.NotEmpty(t, ui.errors)
-	ui.mu.RUnlock()
-}
-
-// TestConcurrent_MoveSelection tests concurrent selection movement
-func TestConcurrent_MoveSelection(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	// Add forwards
-	for i := 0; i < 20; i++ {
-		fwd := &config.Forward{
-			Resource:  fmt.Sprintf("pod/app-%d", i),
-			Port:      8080 + i,
-			LocalPort: 8080 + i,
-		}
-		ui.AddForward(fmt.Sprintf("id-%d", i), fwd)
-	}
-
-	var wg sync.WaitGroup
-	numMoves := 1000
-
-	// Concurrent moves
-	for i := 0; i < numMoves; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			delta := 1
-			if idx%2 == 0 {
-				delta = -1
-			}
-			ui.moveSelection(delta)
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Verify selection is within bounds
-	ui.mu.RLock()
-	assert.GreaterOrEqual(t, ui.selectedIndex, 0)
-	assert.Less(t, ui.selectedIndex, len(ui.forwardOrder))
-	ui.mu.RUnlock()
-}
-
-// TestConcurrent_AddRemoveAndUpdate tests mixed concurrent operations
-func TestConcurrent_AddRemoveAndUpdate(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	var wg sync.WaitGroup
-
-	// Concurrent adds
-	for i := 0; i < 50; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			fwd := &config.Forward{
-				Resource:  fmt.Sprintf("pod/app-%d", idx),
-				Port:      8080 + idx,
-				LocalPort: 8080 + idx,
-			}
-			ui.AddForward(fmt.Sprintf("id-%d", idx), fwd)
-		}(i)
-	}
-
-	// Concurrent updates (some will be for non-existent forwards)
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			forwardID := fmt.Sprintf("id-%d", idx%60) // Some won't exist
-			ui.UpdateStatus(forwardID, "Active")
-		}(i)
-	}
-
-	// Concurrent removes (some will be for non-existent forwards)
-	for i := 0; i < 30; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			ui.Remove(fmt.Sprintf("id-%d", idx))
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Just verify no panics - final state depends on execution order
-}
-
-// TestConcurrent_HTTPLogEntries tests concurrent HTTP log entry additions
-func TestConcurrent_HTTPLogEntries(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-
-	var wg sync.WaitGroup
-	var mu sync.Mutex // Simulate the UI lock for entries
-	numEntries := 1000
-
-	for i := 0; i < numEntries; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			entry := HTTPLogEntry{
-				Method:     "GET",
-				Path:       fmt.Sprintf("/api/test/%d", idx),
-				StatusCode: 200,
-			}
-			mu.Lock()
-			state.entries = append(state.entries, entry)
-			mu.Unlock()
-		}(i)
-	}
-
-	wg.Wait()
-
-	assert.Len(t, state.entries, numEntries)
-}
-
-// TestConcurrent_FilterWhileAdding tests filtering while entries are being added
-func TestConcurrent_FilterWhileAdding(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-	state.filterMode = HTTPLogFilterErrors
-
-	var wg sync.WaitGroup
-	var mu sync.Mutex
-
-	// Add entries concurrently
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			code := 200
-			if idx%5 == 0 {
-				code = 500
-			}
-			entry := HTTPLogEntry{
-				Method:     "GET",
-				Path:       fmt.Sprintf("/api/test/%d", idx),
-				StatusCode: code,
-			}
-			mu.Lock()
-			state.entries = append(state.entries, entry)
-			mu.Unlock()
-		}(i)
-	}
-
-	// Filter concurrently
-	for i := 0; i < 50; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			mu.Lock()
-			_ = state.getFilteredEntries()
-			mu.Unlock()
-		}()
-	}
-
-	wg.Wait()
-
-	// Verify filtering still works
-	mu.Lock()
-	filtered := state.getFilteredEntries()
-	mu.Unlock()
-
-	assert.Len(t, state.entries, 100)
-	assert.Len(t, filtered, 20) // 20% are errors
-}
-
-// TestConcurrent_ToggleCallback tests that toggle callback is called safely
-func TestConcurrent_ToggleCallback(t *testing.T) {
-	var mu sync.Mutex
-	callCount := 0
-
-	callback := func(id string, enable bool) {
-		mu.Lock()
-		callCount++
-		mu.Unlock()
-	}
-
-	ui := NewBubbleTeaUI(callback, "1.0.0")
-
-	// Add a forward
-	fwd := &config.Forward{
-		Resource:  "pod/app",
-		Port:      8080,
-		LocalPort: 8080,
-	}
-	ui.AddForward("test-id", fwd)
-
-	var wg sync.WaitGroup
-
-	// Toggle many times concurrently
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			ui.toggleSelected()
-		}()
-	}
-
-	wg.Wait()
-
-	// Give callbacks time to complete (they run in goroutines)
-	// This is a basic check - in real code you'd use proper synchronization
-}
-
-// TestConcurrent_WizardDependencies tests setting dependencies concurrently
-func TestConcurrent_WizardDependencies(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	var wg sync.WaitGroup
-
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			ui.SetWizardDependencies(nil, nil, fmt.Sprintf("/path/%d", idx))
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Just verify no panics
-	ui.mu.RLock()
-	assert.NotEmpty(t, ui.configPath)
-	ui.mu.RUnlock()
-}
-
-// TestConcurrent_SetUpdateAvailable tests concurrent update availability setting
-func TestConcurrent_SetUpdateAvailable(t *testing.T) {
-	ui := NewBubbleTeaUI(nil, "1.0.0")
-
-	var wg sync.WaitGroup
-
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			ui.SetUpdateAvailable(fmt.Sprintf("2.0.%d", idx), "https://example.com")
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Verify update is available
-	ui.mu.RLock()
-	assert.True(t, ui.updateAvailable)
-	ui.mu.RUnlock()
-}

internal/ui/constants.go

@@ -1,57 +0,0 @@
-package ui
-
-// Terminal dimension constants
-const (
-	// DefaultTermWidth is the fallback terminal width when not detected
-	DefaultTermWidth = 120
-
-	// DefaultTermHeight is the fallback terminal height when not detected
-	DefaultTermHeight = 40
-)
-
-// Table column constants
-const (
-	// Column indices in the forwards table
-	ColumnContext   = 0
-	ColumnNamespace = 1
-	ColumnAlias     = 2
-	ColumnType      = 3
-	ColumnResource  = 4
-	ColumnRemote    = 5
-	ColumnLocal     = 6
-	ColumnStatus    = 7
-
-	// Column widths for truncation
-	ColumnWidthContext   = 14
-	ColumnWidthNamespace = 16
-	ColumnWidthAlias     = 18
-	ColumnWidthType      = 8
-	ColumnWidthResource  = 20
-
-	// Error display widths
-	ErrorDisplayWidth = 118 // Slightly less than table width (120) for padding
-)
-
-// Viewport constants
-const (
-	// ViewportHeight is the number of items visible in list views
-	ViewportHeight = 20
-)
-
-// Path display constants
-const (
-	// MaxPathWidth is the maximum width for displaying file paths
-	MaxPathWidth = 48
-)
-
-// HTTP log table layout
-const (
-	// HTTPLogRowFormat is the column layout shared by the HTTP-log table header
-	// and its rows (TIME, METHOD, STATUS, LATENCY, PATH) so they stay aligned.
-	HTTPLogRowFormat = "%-10s  %-7s  %-6s  %-8s  %s"
-
-	// HTTPLogFixedCols is the width consumed by every column except PATH
-	// (prefix + the four fixed columns and their separators), used to size the
-	// remaining space for the path column responsively.
-	HTTPLogFixedCols = 48
-)

internal/ui/generate.go

@@ -1,987 +0,0 @@
-package ui
-
-import (
-	"context"
-	"fmt"
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	tea "github.com/charmbracelet/bubbletea"
-	"github.com/lukaszraczylo/kportal/internal/config"
-)
-
-// Generate flow constants
-const (
-	// GenerateMinLocalPort is the minimum allowed starting local port for generated forwards.
-	// Ports below 1024 are reserved on most systems and require elevated privileges.
-	GenerateMinLocalPort = 1024
-
-	// GenerateMaxLocalPort is the maximum valid TCP port number.
-	GenerateMaxLocalPort = 65535
-
-	// GenerateDefaultStartingPort is the default starting local port.
-	GenerateDefaultStartingPort = 10000
-
-	// GenerateListTimeout is the per-step timeout for k8s list operations.
-	GenerateListTimeout = 30 * time.Second
-
-	// GenerateConcurrency is the maximum number of concurrent ListServices calls.
-	GenerateConcurrency = 8
-)
-
-// GenerateStep represents the current step in the generate flow.
-type GenerateStep int
-
-const (
-	GenerateStepNamespaces GenerateStep = iota
-	GenerateStepServices
-	GenerateStepPortAssign
-	GenerateStepDone
-	GenerateStepCancelled
-)
-
-// generateNamespacesLoadedMsg is fired when namespace listing completes.
-type generateNamespacesLoadedMsg struct {
-	err        error
-	namespaces []string
-}
-
-// generateServicesLoadedMsg is fired when concurrent service listing completes.
-type generateServicesLoadedMsg struct {
-	err          error
-	servicesByNS map[string][]ServiceCandidate
-}
-
-// generateSavedMsg is fired after AddForward calls complete.
-type generateSavedMsg struct {
-	errors []string
-	added  int
-}
-
-// generateTickMsg drives the spinner.
-type generateTickMsg struct{}
-
-// ServiceCandidate represents a single service-port row in the generate flow.
-type ServiceCandidate struct {
-	Namespace string
-	Service   string
-	Protocol  string
-	Port      int32
-}
-
-// Key returns a stable lookup key for collision detection against existing config.
-func (c ServiceCandidate) Key() string {
-	return fmt.Sprintf("%s|%s|%s|%d", c.Namespace, "service/"+c.Service, "tcp", c.Port)
-}
-
-// GenerateResult is reported by GenerateModel after the program exits.
-type GenerateResult struct {
-	Errors          []string
-	PlannedForwards []config.Forward
-	Added           int
-	SkippedNonTCP   int
-	Cancelled       bool
-	UsedDryRun      bool
-}
-
-// GenerateModel is the bubbletea model driving the generate flow.
-//
-// Field ordering is governed by govet's fieldalignment check: interfaces and
-// other 16-byte values come first, then 8-byte pointers/maps/slices/strings,
-// followed by ints and finally bools.
-type GenerateModel struct {
-	// 16-byte interfaces
-	discovery DiscoveryInterface
-	mutator   MutatorInterface
-
-	// Pointers/maps/slices/strings (8-byte aligned, header sizes vary)
-	existingKeys       map[string]struct{}
-	existingLocalPorts map[int]struct{}
-	nsSelected         map[string]bool
-	servicesByNS       map[string][]ServiceCandidate
-	svcSelected        map[string]bool
-	svcLocked          map[string]bool
-
-	namespaces      []string
-	nsFilteredView  []string
-	svcOrder        []ServiceCandidate
-	svcFilteredView []ServiceCandidate
-
-	contextName     string
-	configPath      string
-	loadErr         string
-	nsFilter        string
-	svcFilter       string
-	startingPortStr string
-	portError       string
-
-	// Composite result struct
-	result GenerateResult
-
-	// Ints
-	step         GenerateStep
-	spinnerFrame int
-	nsCursor     int
-	nsScroll     int
-	svcCursor    int
-	svcScroll    int
-	termWidth    int
-	termHeight   int
-
-	// Bools last (smallest alignment)
-	dryRun       bool
-	loading      bool
-	nsFiltering  bool
-	svcFiltering bool
-}
-
-// NewGenerateModel constructs a fresh generate model.
-// existingForwards is the slice from config.Config.GetAllForwards() and is used
-// for both collision detection and to mark already-configured rows as locked.
-func NewGenerateModel(
-	discovery DiscoveryInterface,
-	mutator MutatorInterface,
-	contextName string,
-	configPath string,
-	dryRun bool,
-	existingForwards []config.Forward,
-) *GenerateModel {
-	keys := make(map[string]struct{}, len(existingForwards))
-	ports := make(map[int]struct{}, len(existingForwards))
-	for _, f := range existingForwards {
-		// Only track entries from the same context — collisions across contexts
-		// matter for local port assignment but not for "already configured" lock.
-		if f.GetContext() == contextName {
-			k := fmt.Sprintf("%s|%s|%s|%d", f.GetNamespace(), f.Resource, strings.ToLower(f.Protocol), f.Port)
-			keys[k] = struct{}{}
-		}
-		// Local-port collisions span the whole config file.
-		ports[f.LocalPort] = struct{}{}
-	}
-
-	return &GenerateModel{
-		discovery:          discovery,
-		mutator:            mutator,
-		contextName:        contextName,
-		configPath:         configPath,
-		dryRun:             dryRun,
-		existingKeys:       keys,
-		existingLocalPorts: ports,
-		step:               GenerateStepNamespaces,
-		loading:            true,
-		nsSelected:         map[string]bool{},
-		svcSelected:        map[string]bool{},
-		svcLocked:          map[string]bool{},
-		startingPortStr:    strconv.Itoa(GenerateDefaultStartingPort),
-		termWidth:          DefaultTermWidth,
-		termHeight:         DefaultTermHeight,
-	}
-}
-
-// Init returns the initial command (load namespaces).
-func (m *GenerateModel) Init() tea.Cmd {
-	return tea.Batch(
-		m.loadNamespacesCmd(),
-		tickCmd(),
-	)
-}
-
-// Result exposes the final outcome after the program quits.
-func (m *GenerateModel) Result() GenerateResult { return m.result }
-
-func tickCmd() tea.Cmd {
-	return tea.Tick(120*time.Millisecond, func(time.Time) tea.Msg { return generateTickMsg{} })
-}
-
-// ---------- Commands ----------
-
-func (m *GenerateModel) loadNamespacesCmd() tea.Cmd {
-	return func() tea.Msg {
-		ctx, cancel := context.WithTimeout(context.Background(), GenerateListTimeout)
-		defer cancel()
-		ns, err := m.discovery.ListNamespaces(ctx, m.contextName)
-		if err == nil {
-			sort.Strings(ns)
-		}
-		return generateNamespacesLoadedMsg{namespaces: ns, err: err}
-	}
-}
-
-func (m *GenerateModel) loadServicesCmd(namespaces []string) tea.Cmd {
-	return func() tea.Msg {
-		out := make(map[string][]ServiceCandidate, len(namespaces))
-		var (
-			mu   sync.Mutex
-			wg   sync.WaitGroup
-			sem  = make(chan struct{}, GenerateConcurrency)
-			errs []string
-		)
-		for _, ns := range namespaces {
-			wg.Add(1)
-			sem <- struct{}{}
-			go func(ns string) {
-				defer wg.Done()
-				defer func() { <-sem }()
-				ctx, cancel := context.WithTimeout(context.Background(), GenerateListTimeout)
-				defer cancel()
-				svcs, err := m.discovery.ListServices(ctx, m.contextName, ns)
-				if err != nil {
-					mu.Lock()
-					errs = append(errs, fmt.Sprintf("%s: %v", ns, err))
-					mu.Unlock()
-					return
-				}
-				rows := make([]ServiceCandidate, 0, len(svcs))
-				for _, s := range svcs {
-					for _, p := range s.Ports {
-						proto := strings.ToUpper(p.Protocol)
-						if proto == "" {
-							proto = "TCP"
-						}
-						rows = append(rows, ServiceCandidate{
-							Namespace: s.Namespace,
-							Service:   s.Name,
-							Port:      p.Port,
-							Protocol:  proto,
-						})
-					}
-				}
-				mu.Lock()
-				out[ns] = rows
-				mu.Unlock()
-			}(ns)
-		}
-		wg.Wait()
-		var combinedErr error
-		if len(errs) > 0 {
-			combinedErr = fmt.Errorf("failed to list services in %d namespaces: %s", len(errs), strings.Join(errs, "; "))
-		}
-		return generateServicesLoadedMsg{servicesByNS: out, err: combinedErr}
-	}
-}
-
-func (m *GenerateModel) saveCmd(forwards []config.Forward) tea.Cmd {
-	return func() tea.Msg {
-		var errs []string
-		added := 0
-		for _, f := range forwards {
-			if err := m.mutator.AddForward(f.GetContext(), f.GetNamespace(), f); err != nil {
-				errs = append(errs, fmt.Sprintf("%s/%s/%s:%d: %v", f.GetContext(), f.GetNamespace(), f.Resource, f.Port, err))
-				// Continue trying remaining ones — but spec says stop on first error.
-				// Spec: "Stop on the first error and report which ones succeeded vs failed".
-				return generateSavedMsg{added: added, errors: errs}
-			}
-			added++
-		}
-		return generateSavedMsg{added: added, errors: errs}
-	}
-}
-
-// ---------- Update ----------
-
-// Update implements tea.Model.
-func (m *GenerateModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
-	switch msg := msg.(type) {
-	case tea.WindowSizeMsg:
-		m.termWidth = msg.Width
-		m.termHeight = msg.Height
-		return m, nil
-
-	case generateTickMsg:
-		m.spinnerFrame++
-		if m.loading {
-			return m, tickCmd()
-		}
-		return m, nil
-
-	case generateNamespacesLoadedMsg:
-		m.loading = false
-		if msg.err != nil {
-			m.loadErr = msg.err.Error()
-			return m, nil
-		}
-		m.namespaces = msg.namespaces
-		m.recomputeNamespaceFilter()
-		return m, nil
-
-	case generateServicesLoadedMsg:
-		m.loading = false
-		if msg.err != nil {
-			m.loadErr = msg.err.Error()
-		}
-		m.servicesByNS = msg.servicesByNS
-		m.buildServiceOrder()
-		m.recomputeServiceFilter()
-		return m, nil
-
-	case generateSavedMsg:
-		m.result.Added = msg.added
-		m.result.Errors = msg.errors
-		m.step = GenerateStepDone
-		return m, tea.Quit
-
-	case tea.KeyMsg:
-		return m.handleKey(msg)
-	}
-	return m, nil
-}
-
-func (m *GenerateModel) handleKey(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
-	if m.loading {
-		// Allow only ctrl+c / esc while loading
-		switch msg.String() {
-		case "ctrl+c", "esc":
-			m.step = GenerateStepCancelled
-			m.result.Cancelled = true
-			return m, tea.Quit
-		}
-		return m, nil
-	}
-
-	switch m.step {
-	case GenerateStepNamespaces:
-		return m.handleNamespaceKey(msg)
-	case GenerateStepServices:
-		return m.handleServiceKey(msg)
-	case GenerateStepPortAssign:
-		return m.handlePortKey(msg)
-	}
-	return m, nil
-}
-
-// ---------- Namespace step ----------
-
-func (m *GenerateModel) handleNamespaceKey(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
-	if m.nsFiltering {
-		switch msg.Type {
-		case tea.KeyEnter, tea.KeyEsc:
-			m.nsFiltering = false
-			if msg.Type == tea.KeyEsc {
-				m.nsFilter = ""
-				m.recomputeNamespaceFilter()
-			}
-			return m, nil
-		case tea.KeyBackspace:
-			if len(m.nsFilter) > 0 {
-				m.nsFilter = m.nsFilter[:len(m.nsFilter)-1]
-				m.recomputeNamespaceFilter()
-			}
-			return m, nil
-		case tea.KeyRunes, tea.KeySpace:
-			m.nsFilter += string(msg.Runes)
-			m.recomputeNamespaceFilter()
-			return m, nil
-		}
-		return m, nil
-	}
-
-	switch msg.String() {
-	case "ctrl+c", "esc":
-		m.step = GenerateStepCancelled
-		m.result.Cancelled = true
-		return m, tea.Quit
-	case "up", "k":
-		m.moveCursor(&m.nsCursor, &m.nsScroll, len(m.nsFilteredView), -1)
-	case "down", "j":
-		m.moveCursor(&m.nsCursor, &m.nsScroll, len(m.nsFilteredView), 1)
-	case "pgup":
-		m.moveCursor(&m.nsCursor, &m.nsScroll, len(m.nsFilteredView), -10)
-	case "pgdown":
-		m.moveCursor(&m.nsCursor, &m.nsScroll, len(m.nsFilteredView), 10)
-	case " ":
-		if len(m.nsFilteredView) > 0 {
-			ns := m.nsFilteredView[m.nsCursor]
-			m.nsSelected[ns] = !m.nsSelected[ns]
-		}
-	case "a":
-		m.toggleAllNamespaces()
-	case "/":
-		m.nsFiltering = true
-	case "enter":
-		selected := m.selectedNamespaces()
-		if len(selected) == 0 {
-			return m, nil
-		}
-		m.step = GenerateStepServices
-		m.loading = true
-		m.loadErr = ""
-		return m, tea.Batch(m.loadServicesCmd(selected), tickCmd())
-	}
-	return m, nil
-}
-
-func (m *GenerateModel) recomputeNamespaceFilter() {
-	m.nsFilteredView = filterStrings(m.namespaces, m.nsFilter)
-	if m.nsCursor >= len(m.nsFilteredView) {
-		m.nsCursor = max(0, len(m.nsFilteredView)-1)
-	}
-	if m.nsScroll > m.nsCursor {
-		m.nsScroll = m.nsCursor
-	}
-}
-
-func (m *GenerateModel) toggleAllNamespaces() {
-	// If everything visible is selected, deselect; otherwise select all visible.
-	allSelected := true
-	for _, ns := range m.nsFilteredView {
-		if !m.nsSelected[ns] {
-			allSelected = false
-			break
-		}
-	}
-	for _, ns := range m.nsFilteredView {
-		m.nsSelected[ns] = !allSelected
-	}
-}
-
-func (m *GenerateModel) selectedNamespaces() []string {
-	out := make([]string, 0, len(m.nsSelected))
-	for ns, sel := range m.nsSelected {
-		if sel {
-			out = append(out, ns)
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// ---------- Services step ----------
-
-func (m *GenerateModel) buildServiceOrder() {
-	rows := make([]ServiceCandidate, 0)
-	for _, list := range m.servicesByNS {
-		rows = append(rows, list...)
-	}
-	sort.Slice(rows, func(i, j int) bool {
-		if rows[i].Namespace != rows[j].Namespace {
-			return rows[i].Namespace < rows[j].Namespace
-		}
-		if rows[i].Service != rows[j].Service {
-			return rows[i].Service < rows[j].Service
-		}
-		return rows[i].Port < rows[j].Port
-	})
-	m.svcOrder = rows
-	m.svcLocked = make(map[string]bool, len(rows))
-	for _, r := range rows {
-		// Use TCP-canonical key for matching against config (config keeps lowercase tcp).
-		canonical := fmt.Sprintf("%s|%s|%s|%d", r.Namespace, "service/"+r.Service, "tcp", r.Port)
-		if _, found := m.existingKeys[canonical]; found {
-			m.svcLocked[r.Key()] = true
-		}
-	}
-}
-
-func (m *GenerateModel) handleServiceKey(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
-	if m.svcFiltering {
-		switch msg.Type {
-		case tea.KeyEnter, tea.KeyEsc:
-			m.svcFiltering = false
-			if msg.Type == tea.KeyEsc {
-				m.svcFilter = ""
-				m.recomputeServiceFilter()
-			}
-			return m, nil
-		case tea.KeyBackspace:
-			if len(m.svcFilter) > 0 {
-				m.svcFilter = m.svcFilter[:len(m.svcFilter)-1]
-				m.recomputeServiceFilter()
-			}
-			return m, nil
-		case tea.KeyRunes, tea.KeySpace:
-			m.svcFilter += string(msg.Runes)
-			m.recomputeServiceFilter()
-			return m, nil
-		}
-		return m, nil
-	}
-
-	switch msg.String() {
-	case "ctrl+c", "esc":
-		m.step = GenerateStepCancelled
-		m.result.Cancelled = true
-		return m, tea.Quit
-	case "b":
-		m.step = GenerateStepNamespaces
-		m.loadErr = ""
-	case "up", "k":
-		m.moveCursor(&m.svcCursor, &m.svcScroll, len(m.svcFilteredView), -1)
-	case "down", "j":
-		m.moveCursor(&m.svcCursor, &m.svcScroll, len(m.svcFilteredView), 1)
-	case "pgup":
-		m.moveCursor(&m.svcCursor, &m.svcScroll, len(m.svcFilteredView), -10)
-	case "pgdown":
-		m.moveCursor(&m.svcCursor, &m.svcScroll, len(m.svcFilteredView), 10)
-	case " ":
-		if len(m.svcFilteredView) > 0 {
-			c := m.svcFilteredView[m.svcCursor]
-			if !m.svcLocked[c.Key()] && c.Protocol == "TCP" {
-				m.svcSelected[c.Key()] = !m.svcSelected[c.Key()]
-			}
-		}
-	case "a":
-		m.toggleAllServices()
-	case "/":
-		m.svcFiltering = true
-	case "enter":
-		selected := m.selectedCandidates()
-		if len(selected) == 0 {
-			return m, nil
-		}
-		m.step = GenerateStepPortAssign
-		m.portError = ""
-	}
-	return m, nil
-}
-
-func (m *GenerateModel) recomputeServiceFilter() {
-	if m.svcFilter == "" {
-		m.svcFilteredView = m.svcOrder
-	} else {
-		needle := strings.ToLower(m.svcFilter)
-		out := make([]ServiceCandidate, 0, len(m.svcOrder))
-		for _, c := range m.svcOrder {
-			label := fmt.Sprintf("%s/%s:%d", c.Namespace, c.Service, c.Port)
-			if strings.Contains(strings.ToLower(label), needle) {
-				out = append(out, c)
-			}
-		}
-		m.svcFilteredView = out
-	}
-	if m.svcCursor >= len(m.svcFilteredView) {
-		m.svcCursor = max(0, len(m.svcFilteredView)-1)
-	}
-	if m.svcScroll > m.svcCursor {
-		m.svcScroll = m.svcCursor
-	}
-}
-
-func (m *GenerateModel) toggleAllServices() {
-	allSelected := true
-	for _, c := range m.svcFilteredView {
-		if m.svcLocked[c.Key()] || c.Protocol != "TCP" {
-			continue
-		}
-		if !m.svcSelected[c.Key()] {
-			allSelected = false
-			break
-		}
-	}
-	for _, c := range m.svcFilteredView {
-		if m.svcLocked[c.Key()] || c.Protocol != "TCP" {
-			continue
-		}
-		m.svcSelected[c.Key()] = !allSelected
-	}
-}
-
-func (m *GenerateModel) selectedCandidates() []ServiceCandidate {
-	out := make([]ServiceCandidate, 0)
-	for _, c := range m.svcOrder {
-		if m.svcLocked[c.Key()] || c.Protocol != "TCP" {
-			continue
-		}
-		if m.svcSelected[c.Key()] {
-			out = append(out, c)
-		}
-	}
-	return out
-}
-
-// ---------- Port assignment step ----------
-
-func (m *GenerateModel) handlePortKey(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
-	switch msg.String() {
-	case "ctrl+c":
-		m.step = GenerateStepCancelled
-		m.result.Cancelled = true
-		return m, tea.Quit
-	case "esc", "b":
-		m.step = GenerateStepServices
-		m.portError = ""
-		return m, nil
-	case "backspace":
-		if len(m.startingPortStr) > 0 {
-			m.startingPortStr = m.startingPortStr[:len(m.startingPortStr)-1]
-			m.portError = ""
-		}
-		return m, nil
-	case "enter":
-		start, ok := m.parseStartingPort()
-		if !ok {
-			return m, nil
-		}
-		forwards := m.assignPorts(start)
-		m.result.PlannedForwards = forwards
-		m.result.SkippedNonTCP = m.countSkippedNonTCP()
-		if m.dryRun {
-			m.step = GenerateStepDone
-			m.result.UsedDryRun = true
-			m.result.Added = 0
-			return m, tea.Quit
-		}
-		return m, m.saveCmd(forwards)
-	}
-
-	// Digit-only input
-	for _, r := range msg.Runes {
-		if r >= '0' && r <= '9' && len(m.startingPortStr) < 5 {
-			m.startingPortStr += string(r)
-			m.portError = ""
-		}
-	}
-	return m, nil
-}
-
-func (m *GenerateModel) parseStartingPort() (int, bool) {
-	if m.startingPortStr == "" {
-		m.portError = "Starting port is required"
-		return 0, false
-	}
-	v, err := strconv.Atoi(m.startingPortStr)
-	if err != nil {
-		m.portError = "Starting port must be a number"
-		return 0, false
-	}
-	if v < GenerateMinLocalPort {
-		m.portError = fmt.Sprintf("Starting port must be ≥ %d (privileged ports are not allowed)", GenerateMinLocalPort)
-		return 0, false
-	}
-	if v > GenerateMaxLocalPort {
-		m.portError = fmt.Sprintf("Starting port must be ≤ %d", GenerateMaxLocalPort)
-		return 0, false
-	}
-	m.portError = ""
-	return v, true
-}
-
-// assignPorts computes the planned forwards with collision-free local ports.
-// Stable order: sort by namespace, then service, then port.
-func (m *GenerateModel) assignPorts(start int) []config.Forward {
-	candidates := m.selectedCandidates()
-	sort.Slice(candidates, func(i, j int) bool {
-		if candidates[i].Namespace != candidates[j].Namespace {
-			return candidates[i].Namespace < candidates[j].Namespace
-		}
-		if candidates[i].Service != candidates[j].Service {
-			return candidates[i].Service < candidates[j].Service
-		}
-		return candidates[i].Port < candidates[j].Port
-	})
-
-	taken := make(map[int]struct{}, len(m.existingLocalPorts))
-	for p := range m.existingLocalPorts {
-		taken[p] = struct{}{}
-	}
-
-	out := make([]config.Forward, 0, len(candidates))
-	candidate := start
-	for _, c := range candidates {
-		// Walk forward while the port is taken. Stop if we run out of ports.
-		for _, used := taken[candidate]; used && candidate <= GenerateMaxLocalPort; _, used = taken[candidate] {
-			candidate++
-		}
-		if candidate > GenerateMaxLocalPort {
-			// Out of ports — bail; the save step will fail with a clear validation error.
-			break
-		}
-		f := config.Forward{
-			Resource:  "service/" + c.Service,
-			Port:      int(c.Port),
-			LocalPort: candidate,
-			Protocol:  "tcp",
-			Alias:     c.Service,
-		}
-		f.SetContext(m.contextName, c.Namespace)
-		out = append(out, f)
-		taken[candidate] = struct{}{}
-		candidate++
-	}
-	return out
-}
-
-func (m *GenerateModel) countSkippedNonTCP() int {
-	n := 0
-	for _, c := range m.svcOrder {
-		if c.Protocol != "TCP" {
-			n++
-		}
-	}
-	return n
-}
-
-// ---------- View ----------
-
-// View implements tea.Model.
-func (m *GenerateModel) View() string {
-	var b strings.Builder
-	b.WriteString(wizardHeaderStyle.Render(fmt.Sprintf("kportal generate · context: %s", m.contextName)))
-	b.WriteString("\n")
-	b.WriteString(mutedStyle.Render(fmt.Sprintf("config: %s", m.configPath)))
-	if m.dryRun {
-		b.WriteString("  ")
-		b.WriteString(warningStyle.Render("[dry-run]"))
-	}
-	b.WriteString("\n\n")
-
-	if m.loading {
-		b.WriteString(spinnerStyle.Render(spinnerFrame(m.spinnerFrame)))
-		b.WriteString(" Loading from cluster…\n")
-		b.WriteString("\n")
-		b.WriteString(helpStyle.Render("esc: cancel"))
-		return b.String()
-	}
-
-	if m.loadErr != "" && m.step == GenerateStepNamespaces {
-		b.WriteString(errorStyle.Render("Error: "))
-		b.WriteString(m.loadErr)
-		b.WriteString("\n\n")
-		b.WriteString(helpStyle.Render("esc/ctrl+c: exit"))
-		return b.String()
-	}
-
-	switch m.step {
-	case GenerateStepNamespaces:
-		b.WriteString(m.renderNamespaceStep())
-	case GenerateStepServices:
-		b.WriteString(m.renderServiceStep())
-	case GenerateStepPortAssign:
-		b.WriteString(m.renderPortStep())
-	}
-	return b.String()
-}
-
-func (m *GenerateModel) renderNamespaceStep() string {
-	var b strings.Builder
-	b.WriteString(breadcrumbStyle.Render("Step 1 / 3 · Select namespaces"))
-	b.WriteString("\n")
-	if m.nsFiltering {
-		b.WriteString(mutedStyle.Render("filter: "))
-		b.WriteString(inputStyle.Render(m.nsFilter + "█"))
-		b.WriteString("\n")
-	} else if m.nsFilter != "" {
-		b.WriteString(mutedStyle.Render(fmt.Sprintf("filter: %q (press / to edit, esc to clear)", m.nsFilter)))
-		b.WriteString("\n")
-	}
-	b.WriteString("\n")
-
-	if len(m.nsFilteredView) == 0 {
-		b.WriteString(mutedStyle.Render("(no namespaces match)\n"))
-	} else {
-		end := m.nsScroll + ViewportHeight
-		if end > len(m.nsFilteredView) {
-			end = len(m.nsFilteredView)
-		}
-		for i := m.nsScroll; i < end; i++ {
-			ns := m.nsFilteredView[i]
-			cursor := "  "
-			if i == m.nsCursor {
-				cursor = selectedStyle.Render("▸ ")
-			}
-			box := uncheckedBoxStyle.Render("[ ]")
-			if m.nsSelected[ns] {
-				box = checkedBoxStyle.Render("[x]")
-			}
-			line := fmt.Sprintf("%s%s %s", cursor, box, ns)
-			b.WriteString(line)
-			b.WriteString("\n")
-		}
-	}
-
-	b.WriteString("\n")
-	selected := m.selectedNamespaces()
-	b.WriteString(mutedStyle.Render(fmt.Sprintf("%d selected", len(selected))))
-	b.WriteString("\n")
-	help := "↑/↓: move  space: toggle  a: toggle-all  /: filter  enter: continue  esc: cancel"
-	b.WriteString(wrapHelpText(help, wizardHelpWidth(m.termWidth)))
-	return b.String()
-}
-
-func (m *GenerateModel) renderServiceStep() string {
-	var b strings.Builder
-	b.WriteString(breadcrumbStyle.Render("Step 2 / 3 · Select services"))
-	b.WriteString("\n")
-	if m.loadErr != "" {
-		b.WriteString(warningStyle.Render("warning: " + m.loadErr))
-		b.WriteString("\n")
-	}
-	if m.svcFiltering {
-		b.WriteString(mutedStyle.Render("filter: "))
-		b.WriteString(inputStyle.Render(m.svcFilter + "█"))
-		b.WriteString("\n")
-	} else if m.svcFilter != "" {
-		b.WriteString(mutedStyle.Render(fmt.Sprintf("filter: %q", m.svcFilter)))
-		b.WriteString("\n")
-	}
-	b.WriteString("\n")
-
-	if len(m.svcFilteredView) == 0 {
-		b.WriteString(mutedStyle.Render("(no services found)\n"))
-	} else {
-		end := m.svcScroll + ViewportHeight
-		if end > len(m.svcFilteredView) {
-			end = len(m.svcFilteredView)
-		}
-		for i := m.svcScroll; i < end; i++ {
-			c := m.svcFilteredView[i]
-			cursor := "  "
-			if i == m.svcCursor {
-				cursor = selectedStyle.Render("▸ ")
-			}
-			locked := m.svcLocked[c.Key()]
-			nonTCP := c.Protocol != "TCP"
-			box := uncheckedBoxStyle.Render("[ ]")
-			switch {
-			case locked:
-				box = mutedStyle.Render("[~]")
-			case nonTCP:
-				box = mutedStyle.Render("[!]")
-			case m.svcSelected[c.Key()]:
-				box = checkedBoxStyle.Render("[x]")
-			}
-			label := fmt.Sprintf("%s/%s:%d", c.Namespace, c.Service, c.Port)
-			if c.Protocol != "TCP" {
-				label += fmt.Sprintf(" (%s)", c.Protocol)
-			}
-			suffix := ""
-			if locked {
-				suffix = " " + mutedStyle.Render("(already configured)")
-			} else if nonTCP {
-				suffix = " " + mutedStyle.Render("(non-TCP, skipped)")
-			}
-			line := fmt.Sprintf("%s%s %s%s", cursor, box, label, suffix)
-			if locked || nonTCP {
-				line = mutedStyle.Render(fmt.Sprintf("%s%s %s%s", cursor, box, label, suffix))
-			}
-			b.WriteString(line)
-			b.WriteString("\n")
-		}
-	}
-
-	b.WriteString("\n")
-	sel := m.selectedCandidates()
-	b.WriteString(mutedStyle.Render(fmt.Sprintf("%d selected", len(sel))))
-	b.WriteString("\n")
-	help := "↑/↓: move  space: toggle  a: toggle-all  /: filter  enter: continue  b: back  esc: cancel"
-	b.WriteString(wrapHelpText(help, wizardHelpWidth(m.termWidth)))
-	return b.String()
-}
-
-func (m *GenerateModel) renderPortStep() string {
-	var b strings.Builder
-	b.WriteString(breadcrumbStyle.Render("Step 3 / 3 · Assign local ports"))
-	b.WriteString("\n\n")
-	b.WriteString(renderTextInput("Starting local port: ", m.startingPortStr, m.portError == ""))
-	b.WriteString("\n")
-	if m.portError != "" {
-		b.WriteString(errorStyle.Render(m.portError))
-		b.WriteString("\n")
-	}
-	b.WriteString("\n")
-
-	start, ok := m.previewStartingPort()
-	if ok {
-		preview := m.assignPorts(start)
-		b.WriteString(mutedStyle.Render(fmt.Sprintf("Preview (%d forwards):", len(preview))))
-		b.WriteString("\n")
-		max := ViewportHeight
-		if len(preview) < max {
-			max = len(preview)
-		}
-		for i := 0; i < max; i++ {
-			f := preview[i]
-			line := fmt.Sprintf("  %d → %s/%s/%s:%d", f.LocalPort, f.GetContext(), f.GetNamespace(), f.Resource, f.Port)
-			b.WriteString(line)
-			b.WriteString("\n")
-		}
-		if len(preview) > max {
-			b.WriteString(mutedStyle.Render(fmt.Sprintf("  … %d more not shown", len(preview)-max)))
-			b.WriteString("\n")
-		}
-	}
-
-	b.WriteString("\n")
-	help := "type digits to set port  enter: save  esc/b: back  ctrl+c: cancel"
-	if m.dryRun {
-		help = "type digits to set port  enter: preview & exit (dry-run)  esc/b: back  ctrl+c: cancel"
-	}
-	b.WriteString(wrapHelpText(help, wizardHelpWidth(m.termWidth)))
-	return b.String()
-}
-
-// previewStartingPort attempts to parse the starting port for preview rendering.
-// Unlike parseStartingPort, it does not mutate model state.
-func (m *GenerateModel) previewStartingPort() (int, bool) {
-	if m.startingPortStr == "" {
-		return 0, false
-	}
-	v, err := strconv.Atoi(m.startingPortStr)
-	if err != nil {
-		return 0, false
-	}
-	if v < GenerateMinLocalPort || v > GenerateMaxLocalPort {
-		return 0, false
-	}
-	return v, true
-}
-
-// ---------- Helpers ----------
-
-func (m *GenerateModel) moveCursor(cursor, scroll *int, total, delta int) {
-	if total == 0 {
-		*cursor = 0
-		*scroll = 0
-		return
-	}
-	*cursor += delta
-	if *cursor < 0 {
-		*cursor = 0
-	}
-	if *cursor >= total {
-		*cursor = total - 1
-	}
-	if *cursor < *scroll {
-		*scroll = *cursor
-	}
-	if *cursor >= *scroll+ViewportHeight {
-		*scroll = *cursor - ViewportHeight + 1
-	}
-}
-
-func spinnerFrame(i int) string {
-	frames := []string{"⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"}
-	return frames[i%len(frames)]
-}
-
-func max(a, b int) int {
-	if a > b {
-		return a
-	}
-	return b
-}
-
-// RunGenerate runs the generate flow as a bubbletea program and returns the
-// final result. The discovery and mutator are passed as interfaces so tests
-// can inject fakes.
-func RunGenerate(
-	discovery DiscoveryInterface,
-	mutator MutatorInterface,
-	contextName string,
-	configPath string,
-	dryRun bool,
-	existingForwards []config.Forward,
-) (GenerateResult, error) {
-	m := NewGenerateModel(discovery, mutator, contextName, configPath, dryRun, existingForwards)
-	prog := tea.NewProgram(m, tea.WithAltScreen())
-	finalModel, err := prog.Run()
-	if err != nil {
-		return GenerateResult{}, err
-	}
-	if gm, ok := finalModel.(*GenerateModel); ok {
-		return gm.Result(), nil
-	}
-	return m.Result(), nil
-}

internal/ui/generate_test.go

@@ -1,529 +0,0 @@
-package ui
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sync"
-	"testing"
-
-	tea "github.com/charmbracelet/bubbletea"
-	"github.com/lukaszraczylo/kportal/internal/config"
-	"github.com/lukaszraczylo/kportal/internal/k8s"
-)
-
-// fakeMutator is a minimal MutatorInterface for tests that don't touch the
-// filesystem. It records the order of AddForward calls.
-type fakeMutator struct {
-	addError error
-	added    []config.Forward
-	mu       sync.Mutex
-}
-
-func (f *fakeMutator) AddForward(ctxName, ns string, fwd config.Forward) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if f.addError != nil {
-		return f.addError
-	}
-	fwd.SetContext(ctxName, ns)
-	f.added = append(f.added, fwd)
-	return nil
-}
-
-func (f *fakeMutator) RemoveForwards(predicate func(ctx, ns string, fwd config.Forward) bool) error {
-	return nil
-}
-func (f *fakeMutator) RemoveForwardByID(id string) error { return nil }
-func (f *fakeMutator) UpdateForward(oldID, newCtx, newNS string, newFwd config.Forward) error {
-	return nil
-}
-
-// fakeDiscovery is a minimal DiscoveryInterface for tests.
-type fakeDiscovery struct {
-	servicesByNS     map[string][]k8s.ServiceInfo
-	listNamespacesEr error
-	listServicesEr   error
-	namespaces       []string
-}
-
-func (f *fakeDiscovery) ListContexts() ([]string, error)    { return []string{"test"}, nil }
-func (f *fakeDiscovery) GetCurrentContext() (string, error) { return "test", nil }
-func (f *fakeDiscovery) ListNamespaces(_ context.Context, _ string) ([]string, error) {
-	return f.namespaces, f.listNamespacesEr
-}
-func (f *fakeDiscovery) ListPods(_ context.Context, _, _ string) ([]k8s.PodInfo, error) {
-	return nil, nil
-}
-func (f *fakeDiscovery) ListPodsWithSelector(_ context.Context, _, _, _ string) ([]k8s.PodInfo, error) {
-	return nil, nil
-}
-func (f *fakeDiscovery) ListServices(_ context.Context, _, ns string) ([]k8s.ServiceInfo, error) {
-	if f.listServicesEr != nil {
-		return nil, f.listServicesEr
-	}
-	return f.servicesByNS[ns], nil
-}
-
-// keyOf builds a tea.KeyMsg the same way bubbletea does for typed runes.
-func keyOf(s string) tea.KeyMsg {
-	switch s {
-	case "enter":
-		return tea.KeyMsg{Type: tea.KeyEnter}
-	case "esc":
-		return tea.KeyMsg{Type: tea.KeyEsc}
-	case "space":
-		return tea.KeyMsg{Type: tea.KeySpace, Runes: []rune(" ")}
-	case "backspace":
-		return tea.KeyMsg{Type: tea.KeyBackspace}
-	}
-	if len(s) == 1 {
-		return tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(s)}
-	}
-	return tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(s)}
-}
-
-// drainModel applies a sequence of messages and returns the final model.
-func drainModel(t *testing.T, m tea.Model, msgs ...tea.Msg) tea.Model {
-	t.Helper()
-	cur := m
-	for _, msg := range msgs {
-		next, _ := cur.Update(msg)
-		cur = next
-	}
-	return cur
-}
-
-func TestGenerateModel_NamespaceMultiSelect(t *testing.T) {
-	disc := &fakeDiscovery{
-		namespaces: []string{"alpha", "beta", "gamma"},
-		servicesByNS: map[string][]k8s.ServiceInfo{
-			"alpha": {{Name: "svc-a", Namespace: "alpha", Ports: []k8s.PortInfo{{Port: 80, Protocol: "TCP"}}}},
-		},
-	}
-	mut := &fakeMutator{}
-	m := NewGenerateModel(disc, mut, "ctx", "/tmp/x.yaml", true, nil)
-
-	// Init (load namespaces)
-	cmd := m.Init()
-	if cmd == nil {
-		t.Fatal("expected Init to return command")
-	}
-	// Simulate the namespaces-loaded message.
-	model, _ := m.Update(generateNamespacesLoadedMsg{namespaces: disc.namespaces})
-	gm := model.(*GenerateModel)
-
-	if gm.loading {
-		t.Fatal("expected loading=false after namespaces loaded")
-	}
-	if len(gm.nsFilteredView) != 3 {
-		t.Fatalf("want 3 namespaces, got %d", len(gm.nsFilteredView))
-	}
-
-	// Toggle first item with space — cursor starts at 0.
-	gm2 := drainModel(t, gm, keyOf("space")).(*GenerateModel)
-	if !gm2.nsSelected["alpha"] {
-		t.Fatal("expected alpha to be selected")
-	}
-
-	// 'a' toggles all. Because alpha is selected and the others are not,
-	// allSelected=false so the press selects everything visible.
-	gm3 := drainModel(t, gm2, keyOf("a")).(*GenerateModel)
-	for _, ns := range []string{"alpha", "beta", "gamma"} {
-		if !gm3.nsSelected[ns] {
-			t.Fatalf("expected %s to be selected after first toggle-all", ns)
-		}
-	}
-	// Press again — now all are selected, so it should deselect all.
-	gm4 := drainModel(t, gm3, keyOf("a")).(*GenerateModel)
-	for _, ns := range []string{"alpha", "beta", "gamma"} {
-		if gm4.nsSelected[ns] {
-			t.Fatalf("expected %s to be unselected after second toggle-all", ns)
-		}
-	}
-}
-
-func TestGenerateModel_NamespaceFilter(t *testing.T) {
-	disc := &fakeDiscovery{namespaces: []string{"alpha", "beta", "gamma"}}
-	m := NewGenerateModel(disc, &fakeMutator{}, "ctx", "/tmp/x.yaml", true, nil)
-	model, _ := m.Update(generateNamespacesLoadedMsg{namespaces: disc.namespaces})
-	gm := model.(*GenerateModel)
-
-	// Enter filter mode
-	gm = drainModel(t, gm, keyOf("/")).(*GenerateModel)
-	if !gm.nsFiltering {
-		t.Fatal("expected to enter filter mode")
-	}
-	gm = drainModel(t, gm, keyOf("b")).(*GenerateModel)
-	if gm.nsFilter != "b" {
-		t.Fatalf("expected filter=b, got %q", gm.nsFilter)
-	}
-	if len(gm.nsFilteredView) != 1 || gm.nsFilteredView[0] != "beta" {
-		t.Fatalf("expected [beta], got %v", gm.nsFilteredView)
-	}
-	// Exit filter
-	gm = drainModel(t, gm, tea.KeyMsg{Type: tea.KeyEnter}).(*GenerateModel)
-	if gm.nsFiltering {
-		t.Fatal("expected filtering to be off after enter")
-	}
-}
-
-func TestGenerateModel_ServiceMultiSelectAndLock(t *testing.T) {
-	disc := &fakeDiscovery{
-		namespaces: []string{"ns1"},
-		servicesByNS: map[string][]k8s.ServiceInfo{
-			"ns1": {
-				{Name: "svc-a", Namespace: "ns1", Ports: []k8s.PortInfo{{Port: 80, Protocol: "TCP"}, {Port: 443, Protocol: "TCP"}}},
-				{Name: "svc-udp", Namespace: "ns1", Ports: []k8s.PortInfo{{Port: 53, Protocol: "UDP"}}},
-			},
-		},
-	}
-	// One forward already configured: svc-a:80 in ns1
-	existing := []config.Forward{makeFwd("ctx", "ns1", "service/svc-a", 80, 9000, "tcp")}
-
-	m := NewGenerateModel(disc, &fakeMutator{}, "ctx", "/tmp/x.yaml", true, existing)
-	// Drive past the namespace step.
-	model, _ := m.Update(generateNamespacesLoadedMsg{namespaces: disc.namespaces})
-	gm := model.(*GenerateModel)
-	gm.nsSelected["ns1"] = true
-	// Press enter to advance to services step.
-	model2, _ := gm.Update(keyOf("enter"))
-	gm2 := model2.(*GenerateModel)
-	// Provide the loaded services.
-	model3, _ := gm2.Update(generateServicesLoadedMsg{servicesByNS: map[string][]ServiceCandidate{
-		"ns1": {
-			{Namespace: "ns1", Service: "svc-a", Port: 80, Protocol: "TCP"},
-			{Namespace: "ns1", Service: "svc-a", Port: 443, Protocol: "TCP"},
-			{Namespace: "ns1", Service: "svc-udp", Port: 53, Protocol: "UDP"},
-		},
-	}})
-	gm3 := model3.(*GenerateModel)
-
-	if len(gm3.svcOrder) != 3 {
-		t.Fatalf("want 3 candidates, got %d", len(gm3.svcOrder))
-	}
-	if !gm3.svcLocked[(ServiceCandidate{Namespace: "ns1", Service: "svc-a", Port: 80, Protocol: "TCP"}).Key()] {
-		t.Fatal("svc-a:80 should be locked (already in config)")
-	}
-
-	// Move to svc-a:443 (cursor index 1) and toggle.
-	gm4 := drainModel(t, gm3, keyOf("down"), keyOf("space")).(*GenerateModel)
-	sel := gm4.selectedCandidates()
-	if len(sel) != 1 || sel[0].Service != "svc-a" || sel[0].Port != 443 {
-		t.Fatalf("expected [svc-a:443], got %v", sel)
-	}
-
-	// Try to toggle the locked row (cursor 0) — should remain unselected.
-	gm5 := drainModel(t, gm4, keyOf("up"), keyOf("space")).(*GenerateModel)
-	for _, c := range gm5.selectedCandidates() {
-		if c.Port == 80 {
-			t.Fatal("locked row was selectable")
-		}
-	}
-
-	// Toggle-all should select all selectable (i.e., svc-a:443 only — the others are locked or non-TCP).
-	gm6 := drainModel(t, gm5, keyOf("a")).(*GenerateModel)
-	// First press: all eligible already selected (svc-a:443) → deselect.
-	if len(gm6.selectedCandidates()) != 0 {
-		t.Fatalf("expected toggle-all to deselect, got %d", len(gm6.selectedCandidates()))
-	}
-	gm7 := drainModel(t, gm6, keyOf("a")).(*GenerateModel)
-	if len(gm7.selectedCandidates()) != 1 {
-		t.Fatalf("expected 1 selected after second toggle-all, got %d", len(gm7.selectedCandidates()))
-	}
-}
-
-// readyModel returns a model with loading already cleared so step-level
-// behaviour can be tested without injecting load messages first.
-func readyModel(disc DiscoveryInterface, mut MutatorInterface, ctx, cfg string, dryRun bool, existing []config.Forward) *GenerateModel {
-	m := NewGenerateModel(disc, mut, ctx, cfg, dryRun, existing)
-	m.loading = false
-	return m
-}
-
-func TestGenerateModel_PortAssignmentWithCollisions(t *testing.T) {
-	dir := t.TempDir()
-	configPath := filepath.Join(dir, ".kportal.yaml")
-	// Seed an existing config that has localPort 10000 and 10002 already used.
-	seed := []byte(`contexts:
-  - name: ctx
-    namespaces:
-      - name: existing
-        forwards:
-          - resource: service/legacy
-            port: 8080
-            localPort: 10000
-            protocol: tcp
-          - resource: service/legacy2
-            port: 8080
-            localPort: 10002
-            protocol: tcp
-`)
-	if err := os.WriteFile(configPath, seed, 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	// Re-load to grab the existing forwards.
-	cfg, err := config.LoadConfig(configPath)
-	if err != nil {
-		t.Fatalf("load: %v", err)
-	}
-	mut := config.NewMutator(configPath)
-
-	disc := &fakeDiscovery{}
-	m := readyModel(disc, mut, "ctx", configPath, false, cfg.GetAllForwards())
-	// Pre-populate svcOrder with three candidates that need ports.
-	m.svcOrder = []ServiceCandidate{
-		{Namespace: "ns1", Service: "alpha", Port: 80, Protocol: "TCP"},
-		{Namespace: "ns1", Service: "beta", Port: 80, Protocol: "TCP"},
-		{Namespace: "ns1", Service: "gamma", Port: 80, Protocol: "TCP"},
-	}
-	for _, c := range m.svcOrder {
-		m.svcSelected[c.Key()] = true
-	}
-
-	planned := m.assignPorts(10000)
-	if len(planned) != 3 {
-		t.Fatalf("expected 3 planned forwards, got %d", len(planned))
-	}
-	got := []int{planned[0].LocalPort, planned[1].LocalPort, planned[2].LocalPort}
-	want := []int{10001, 10003, 10004} // 10000 and 10002 taken
-	for i, p := range want {
-		if got[i] != p {
-			t.Fatalf("planned[%d] localPort: want %d, got %d (full=%v)", i, p, got[i], got)
-		}
-	}
-
-	// Now invoke saveCmd through the model and verify mutator side-effects.
-	m.startingPortStr = "10000"
-	for _, c := range m.svcOrder {
-		m.svcSelected[c.Key()] = true
-	}
-	m.step = GenerateStepPortAssign
-	model2, cmd := m.Update(keyOf("enter"))
-	if cmd == nil {
-		t.Fatal("expected save command")
-	}
-	msg := cmd()
-	saved, ok := msg.(generateSavedMsg)
-	if !ok {
-		t.Fatalf("expected generateSavedMsg, got %T", msg)
-	}
-	if saved.added != 3 {
-		t.Fatalf("expected 3 added, got %d (errors=%v)", saved.added, saved.errors)
-	}
-
-	// Verify config file now has 5 forwards total.
-	cfg2, err := config.LoadConfig(configPath)
-	if err != nil {
-		t.Fatalf("reload config: %v", err)
-	}
-	if len(cfg2.GetAllForwards()) != 5 {
-		t.Fatalf("expected 5 forwards after save, got %d", len(cfg2.GetAllForwards()))
-	}
-	_ = model2
-}
-
-func TestGenerateModel_PortBelow1024Rejected(t *testing.T) {
-	m := readyModel(&fakeDiscovery{}, &fakeMutator{}, "ctx", "/tmp/x.yaml", true, nil)
-	m.step = GenerateStepPortAssign
-	m.svcOrder = []ServiceCandidate{{Namespace: "ns1", Service: "x", Port: 80, Protocol: "TCP"}}
-	m.svcSelected[m.svcOrder[0].Key()] = true
-	m.startingPortStr = "80"
-
-	model, cmd := m.Update(keyOf("enter"))
-	gm := model.(*GenerateModel)
-	if cmd != nil {
-		t.Fatal("expected no command (rejected)")
-	}
-	if gm.portError == "" {
-		t.Fatal("expected port error to be set")
-	}
-	if gm.step != GenerateStepPortAssign {
-		t.Fatal("expected to remain on port step after invalid input")
-	}
-
-	// Backspace + retype a valid value should clear the error and allow continuing.
-	gm.startingPortStr = "1024"
-	model2, cmd2 := gm.Update(keyOf("enter"))
-	gm2 := model2.(*GenerateModel)
-	if cmd2 == nil {
-		t.Fatal("expected save command after valid port")
-	}
-	if gm2.portError != "" {
-		t.Fatalf("expected port error cleared, got %q", gm2.portError)
-	}
-}
-
-func TestGenerateModel_DryRunDoesNotInvokeMutator(t *testing.T) {
-	mut := &fakeMutator{}
-	m := readyModel(&fakeDiscovery{}, mut, "ctx", "/tmp/x.yaml", true, nil)
-	m.step = GenerateStepPortAssign
-	m.svcOrder = []ServiceCandidate{{Namespace: "ns1", Service: "x", Port: 80, Protocol: "TCP"}}
-	m.svcSelected[m.svcOrder[0].Key()] = true
-	m.startingPortStr = "10000"
-
-	model, cmd := m.Update(keyOf("enter"))
-	gm := model.(*GenerateModel)
-	if !gm.result.UsedDryRun {
-		t.Fatal("expected dry-run flag set in result")
-	}
-	if len(mut.added) != 0 {
-		t.Fatalf("expected mutator untouched in dry-run, got %d adds", len(mut.added))
-	}
-	if cmd == nil {
-		t.Fatal("expected quit command from dry-run path")
-	}
-	if msg := cmd(); msg == nil {
-		// Quit returns a tea.QuitMsg — just ensure it's non-nil.
-		t.Fatal("expected non-nil quit message")
-	}
-}
-
-func TestGenerateModel_EndToEnd(t *testing.T) {
-	disc := &fakeDiscovery{
-		namespaces: []string{"ns1"},
-	}
-	mut := &fakeMutator{}
-	m := NewGenerateModel(disc, mut, "ctx", "/tmp/x.yaml", false, nil)
-
-	// Init returns a Cmd; we don't run it directly. Instead we manually
-	// inject the messages it would produce.
-	_ = m.Init()
-
-	// 1. Namespaces load.
-	model, _ := m.Update(generateNamespacesLoadedMsg{namespaces: disc.namespaces})
-	gm := model.(*GenerateModel)
-
-	// 2. Toggle ns1 + enter.
-	gm = drainModel(t, gm, keyOf("space"), keyOf("enter")).(*GenerateModel)
-	if gm.step != GenerateStepServices {
-		t.Fatalf("expected services step, got %v", gm.step)
-	}
-
-	// 3. Provide loaded services.
-	model2, _ := gm.Update(generateServicesLoadedMsg{servicesByNS: map[string][]ServiceCandidate{
-		"ns1": {{Namespace: "ns1", Service: "svc", Port: 8080, Protocol: "TCP"}},
-	}})
-	gm = model2.(*GenerateModel)
-
-	// 4. Toggle the (only) service + enter.
-	gm = drainModel(t, gm, keyOf("space"), keyOf("enter")).(*GenerateModel)
-	if gm.step != GenerateStepPortAssign {
-		t.Fatalf("expected port-assign step, got %v", gm.step)
-	}
-
-	// 5. Press enter on the default port (10000).
-	model3, cmd := gm.Update(keyOf("enter"))
-	gm = model3.(*GenerateModel)
-	if cmd == nil {
-		t.Fatal("expected save command")
-	}
-	msg := cmd()
-	saved := msg.(generateSavedMsg)
-	if saved.added != 1 {
-		t.Fatalf("expected 1 added, got %d (errs=%v)", saved.added, saved.errors)
-	}
-
-	// 6. Process the saved message → step should be Done.
-	model4, _ := gm.Update(saved)
-	final := model4.(*GenerateModel)
-	if final.step != GenerateStepDone {
-		t.Fatalf("expected Done step, got %v", final.step)
-	}
-	if final.result.Added != 1 {
-		t.Fatalf("expected result.Added=1, got %d", final.result.Added)
-	}
-	if len(mut.added) != 1 {
-		t.Fatalf("expected mutator to record 1 forward, got %d", len(mut.added))
-	}
-	if mut.added[0].Resource != "service/svc" || mut.added[0].LocalPort != 10000 {
-		t.Fatalf("unexpected forward recorded: %+v", mut.added[0])
-	}
-}
-
-// makeFwd is a small helper to build a Forward with context/namespace pre-set.
-func makeFwd(ctxName, ns, resource string, port, localPort int, proto string) config.Forward {
-	f := config.Forward{
-		Resource:  resource,
-		Port:      port,
-		LocalPort: localPort,
-		Protocol:  proto,
-	}
-	f.SetContext(ctxName, ns)
-	return f
-}
-
-func TestGenerateModel_ParseStartingPortBoundary(t *testing.T) {
-	cases := []struct {
-		name    string
-		input   string
-		wantOK  bool
-		wantVal int
-	}{
-		{"empty", "", false, 0},
-		{"non-numeric", "abc", false, 0},
-		{"below min", "1023", false, 0},
-		{"at min", "1024", true, 1024},
-		{"above max", "70000", false, 0},
-		{"valid", "10000", true, 10000},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			m := NewGenerateModel(&fakeDiscovery{}, &fakeMutator{}, "c", "/tmp/x.yaml", true, nil)
-			m.startingPortStr = tc.input
-			got, ok := m.parseStartingPort()
-			if ok != tc.wantOK {
-				t.Fatalf("ok mismatch: want %v, got %v (err=%q)", tc.wantOK, ok, m.portError)
-			}
-			if ok && got != tc.wantVal {
-				t.Fatalf("val mismatch: want %d, got %d", tc.wantVal, got)
-			}
-		})
-	}
-}
-
-// TestGenerateModel_PortStepView ensures the port-step view renders without panic.
-func TestGenerateModel_PortStepView(t *testing.T) {
-	m := readyModel(&fakeDiscovery{}, &fakeMutator{}, "ctx", "/tmp/x.yaml", true, nil)
-	m.step = GenerateStepPortAssign
-	m.svcOrder = []ServiceCandidate{{Namespace: "ns", Service: "svc", Port: 80, Protocol: "TCP"}}
-	m.svcSelected[m.svcOrder[0].Key()] = true
-	view := m.View()
-	if !contains(view, "Step 3 / 3") {
-		t.Fatalf("expected step header in view, got: %s", view)
-	}
-	if !contains(view, "10000") {
-		t.Fatalf("expected default port in view, got: %s", view)
-	}
-}
-
-// contains is a tiny strings.Contains wrapper that also gives a clearer test failure message.
-func contains(s, sub string) bool {
-	return len(s) >= len(sub) && (sub == "" || stringIndex(s, sub) >= 0)
-}
-
-func stringIndex(s, sub string) int {
-	if sub == "" {
-		return 0
-	}
-	for i := 0; i+len(sub) <= len(s); i++ {
-		if s[i:i+len(sub)] == sub {
-			return i
-		}
-	}
-	return -1
-}
-
-// Sanity: ensure the model satisfies tea.Model interface — compile-time check.
-var _ tea.Model = (*GenerateModel)(nil)
-
-// Sanity: ensure existing key generation matches a manually-built one.
-func TestServiceCandidate_KeyDeterministic(t *testing.T) {
-	c := ServiceCandidate{Namespace: "ns1", Service: "svc", Port: 80, Protocol: "TCP"}
-	want := fmt.Sprintf("%s|%s|%s|%d", "ns1", "service/svc", "tcp", 80)
-	if c.Key() != want {
-		t.Fatalf("Key() mismatch: want %q, got %q", want, c.Key())
-	}
-}

internal/ui/httplog_state_test.go

@@ -1,229 +0,0 @@
-package ui
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestNewHTTPLogState tests the constructor
-func TestNewHTTPLogState(t *testing.T) {
-	state := newHTTPLogState("forward-123", "my-service")
-
-	assert.Equal(t, "forward-123", state.forwardID)
-	assert.Equal(t, "my-service", state.forwardAlias)
-	assert.NotNil(t, state.entries)
-	assert.Empty(t, state.entries)
-	assert.True(t, state.autoScroll)
-	assert.Equal(t, HTTPLogFilterNone, state.filterMode)
-	assert.Empty(t, state.filterText)
-	assert.False(t, state.filterActive)
-}
-
-// TestHTTPLogState_GetFilteredEntries_NoFilter tests filtering with no filter
-func TestHTTPLogState_GetFilteredEntries_NoFilter(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-	state.entries = []HTTPLogEntry{
-		{Method: "GET", Path: "/api/users", StatusCode: 200},
-		{Method: "POST", Path: "/api/orders", StatusCode: 201},
-		{Method: "GET", Path: "/health", StatusCode: 200},
-	}
-
-	filtered := state.getFilteredEntries()
-
-	assert.Len(t, filtered, 3)
-}
-
-// TestHTTPLogState_GetFilteredEntries_FiltersZeroStatusCode tests that entries without status codes are filtered
-func TestHTTPLogState_GetFilteredEntries_FiltersZeroStatusCode(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-	state.entries = []HTTPLogEntry{
-		{Method: "GET", Path: "/api/users", StatusCode: 200},
-		{Method: "GET", Path: "/streaming", StatusCode: 0}, // No status (in-progress or error)
-		{Method: "POST", Path: "/api/orders", StatusCode: 201},
-	}
-
-	filtered := state.getFilteredEntries()
-
-	assert.Len(t, filtered, 2)
-	assert.Equal(t, "/api/users", filtered[0].Path)
-	assert.Equal(t, "/api/orders", filtered[1].Path)
-}
-
-// TestHTTPLogState_GetFilteredEntries_Non200Filter tests non-2xx filter
-func TestHTTPLogState_GetFilteredEntries_Non200Filter(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-	state.filterMode = HTTPLogFilterNon200
-	state.entries = []HTTPLogEntry{
-		{Method: "GET", Path: "/api/users", StatusCode: 200},
-		{Method: "GET", Path: "/api/error", StatusCode: 500},
-		{Method: "POST", Path: "/api/orders", StatusCode: 201},
-		{Method: "GET", Path: "/api/notfound", StatusCode: 404},
-		{Method: "PUT", Path: "/api/redirect", StatusCode: 301},
-	}
-
-	filtered := state.getFilteredEntries()
-
-	assert.Len(t, filtered, 3)
-	assert.Equal(t, 500, filtered[0].StatusCode)
-	assert.Equal(t, 404, filtered[1].StatusCode)
-	assert.Equal(t, 301, filtered[2].StatusCode)
-}
-
-// TestHTTPLogState_GetFilteredEntries_ErrorsFilter tests 4xx/5xx filter
-func TestHTTPLogState_GetFilteredEntries_ErrorsFilter(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-	state.filterMode = HTTPLogFilterErrors
-	state.entries = []HTTPLogEntry{
-		{Method: "GET", Path: "/api/users", StatusCode: 200},
-		{Method: "GET", Path: "/api/error", StatusCode: 500},
-		{Method: "POST", Path: "/api/orders", StatusCode: 201},
-		{Method: "GET", Path: "/api/notfound", StatusCode: 404},
-		{Method: "PUT", Path: "/api/redirect", StatusCode: 301},
-		{Method: "GET", Path: "/api/bad", StatusCode: 400},
-	}
-
-	filtered := state.getFilteredEntries()
-
-	assert.Len(t, filtered, 3)
-	assert.Equal(t, 500, filtered[0].StatusCode)
-	assert.Equal(t, 404, filtered[1].StatusCode)
-	assert.Equal(t, 400, filtered[2].StatusCode)
-}
-
-// TestHTTPLogState_GetFilteredEntries_TextFilter tests text filtering
-func TestHTTPLogState_GetFilteredEntries_TextFilter(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-	state.filterText = "users"
-	state.entries = []HTTPLogEntry{
-		{Method: "GET", Path: "/api/users", StatusCode: 200},
-		{Method: "GET", Path: "/api/users/123", StatusCode: 200},
-		{Method: "POST", Path: "/api/orders", StatusCode: 201},
-		{Method: "GET", Path: "/health", StatusCode: 200},
-	}
-
-	filtered := state.getFilteredEntries()
-
-	assert.Len(t, filtered, 2)
-	assert.Equal(t, "/api/users", filtered[0].Path)
-	assert.Equal(t, "/api/users/123", filtered[1].Path)
-}
-
-// TestHTTPLogState_GetFilteredEntries_TextFilterCaseInsensitive tests case-insensitive text filtering
-func TestHTTPLogState_GetFilteredEntries_TextFilterCaseInsensitive(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-	state.filterText = "API"
-	state.entries = []HTTPLogEntry{
-		{Method: "GET", Path: "/api/users", StatusCode: 200},
-		{Method: "GET", Path: "/Api/Orders", StatusCode: 200},
-		{Method: "GET", Path: "/health", StatusCode: 200},
-	}
-
-	filtered := state.getFilteredEntries()
-
-	assert.Len(t, filtered, 2)
-}
-
-// TestHTTPLogState_GetFilteredEntries_TextFilterByMethod tests filtering by HTTP method
-func TestHTTPLogState_GetFilteredEntries_TextFilterByMethod(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-	state.filterText = "POST"
-	state.entries = []HTTPLogEntry{
-		{Method: "GET", Path: "/api/users", StatusCode: 200},
-		{Method: "POST", Path: "/api/orders", StatusCode: 201},
-		{Method: "POST", Path: "/api/items", StatusCode: 201},
-		{Method: "PUT", Path: "/api/update", StatusCode: 200},
-	}
-
-	filtered := state.getFilteredEntries()
-
-	assert.Len(t, filtered, 2)
-	assert.Equal(t, "POST", filtered[0].Method)
-	assert.Equal(t, "POST", filtered[1].Method)
-}
-
-// TestHTTPLogState_GetFilteredEntries_CombinedFilters tests combining mode and text filters
-func TestHTTPLogState_GetFilteredEntries_CombinedFilters(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-	state.filterMode = HTTPLogFilterErrors
-	state.filterText = "api"
-	state.entries = []HTTPLogEntry{
-		{Method: "GET", Path: "/api/users", StatusCode: 200},
-		{Method: "GET", Path: "/api/error", StatusCode: 500},
-		{Method: "GET", Path: "/health", StatusCode: 500}, // Error but doesn't match text
-		{Method: "GET", Path: "/api/notfound", StatusCode: 404},
-	}
-
-	filtered := state.getFilteredEntries()
-
-	assert.Len(t, filtered, 2)
-	assert.Equal(t, "/api/error", filtered[0].Path)
-	assert.Equal(t, "/api/notfound", filtered[1].Path)
-}
-
-// TestHTTPLogState_GetFilteredEntries_EmptyResult tests when no entries match
-func TestHTTPLogState_GetFilteredEntries_EmptyResult(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-	state.filterText = "nonexistent"
-	state.entries = []HTTPLogEntry{
-		{Method: "GET", Path: "/api/users", StatusCode: 200},
-		{Method: "POST", Path: "/api/orders", StatusCode: 201},
-	}
-
-	filtered := state.getFilteredEntries()
-
-	assert.Empty(t, filtered)
-}
-
-// TestHTTPLogState_GetFilterModeLabel tests filter mode labels
-func TestHTTPLogState_GetFilterModeLabel(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-
-	tests := []struct {
-		expected string
-		mode     HTTPLogFilterMode
-	}{
-		{mode: HTTPLogFilterNone, expected: "All"},
-		{mode: HTTPLogFilterText, expected: "Text"},
-		{mode: HTTPLogFilterNon200, expected: "Non-2xx"},
-		{mode: HTTPLogFilterErrors, expected: "Errors (4xx/5xx)"},
-	}
-
-	for _, tt := range tests {
-		state.filterMode = tt.mode
-		assert.Equal(t, tt.expected, state.getFilterModeLabel())
-	}
-}
-
-// TestHTTPLogState_FilterModeValues tests filter mode constants are correct
-func TestHTTPLogState_FilterModeValues(t *testing.T) {
-	// Ensure the modes are sequential for cycling to work correctly
-	assert.Equal(t, HTTPLogFilterMode(0), HTTPLogFilterNone)
-	assert.Equal(t, HTTPLogFilterMode(1), HTTPLogFilterText)
-	assert.Equal(t, HTTPLogFilterMode(2), HTTPLogFilterNon200)
-	assert.Equal(t, HTTPLogFilterMode(3), HTTPLogFilterErrors)
-}
-
-// TestHTTPLogState_LargeEntrySet tests filtering performance with many entries
-func TestHTTPLogState_LargeEntrySet(t *testing.T) {
-	state := newHTTPLogState("fwd", "alias")
-
-	// Add 1000 entries
-	for i := 0; i < 1000; i++ {
-		code := 200
-		if i%10 == 0 {
-			code = 500
-		}
-		state.entries = append(state.entries, HTTPLogEntry{
-			Method:     "GET",
-			Path:       "/api/test",
-			StatusCode: code,
-		})
-	}
-
-	// Filter should work correctly
-	state.filterMode = HTTPLogFilterErrors
-	filtered := state.getFilteredEntries()
-
-	assert.Len(t, filtered, 100) // 10% are errors
-}

internal/ui/interactive.go

@@ -0,0 +1,181 @@
+package ui
+
+import (
+	"fmt"
+	"os"
+	"sync"
+
+	"golang.org/x/term"
+)
+
+// InteractiveController handles keyboard input and selection state
+type InteractiveController struct {
+	mu             sync.RWMutex
+	selectedIndex  int
+	forwardIDs     []string        // Ordered list of forward IDs
+	disabledMap    map[string]bool // Tracks which forwards are disabled
+	toggleCallback func(id string, enable bool)
+	enabled        bool
+	oldTermState   *term.State
+}
+
+// NewInteractiveController creates a new interactive controller
+func NewInteractiveController(toggleCallback func(id string, enable bool)) *InteractiveController {
+	return &InteractiveController{
+		selectedIndex:  0,
+		forwardIDs:     make([]string, 0),
+		disabledMap:    make(map[string]bool),
+		toggleCallback: toggleCallback,
+		enabled:        false,
+	}
+}
+
+// Enable puts the terminal in raw mode for keyboard input
+func (ic *InteractiveController) Enable() error {
+	ic.mu.Lock()
+	defer ic.mu.Unlock()
+
+	if ic.enabled {
+		return nil
+	}
+
+	// Save current terminal state
+	oldState, err := term.MakeRaw(int(os.Stdin.Fd()))
+	if err != nil {
+		return fmt.Errorf("failed to enable raw mode: %w", err)
+	}
+
+	ic.oldTermState = oldState
+	ic.enabled = true
+	return nil
+}
+
+// Disable restores the terminal to normal mode
+func (ic *InteractiveController) Disable() error {
+	ic.mu.Lock()
+	defer ic.mu.Unlock()
+
+	if !ic.enabled {
+		return nil
+	}
+
+	if ic.oldTermState != nil {
+		if err := term.Restore(int(os.Stdin.Fd()), ic.oldTermState); err != nil {
+			return fmt.Errorf("failed to restore terminal: %w", err)
+		}
+	}
+
+	ic.enabled = false
+	return nil
+}
+
+// UpdateForwardsList updates the list of forwards for navigation
+func (ic *InteractiveController) UpdateForwardsList(ids []string) {
+	ic.mu.Lock()
+	defer ic.mu.Unlock()
+
+	ic.forwardIDs = ids
+
+	// Ensure selected index is valid
+	if ic.selectedIndex >= len(ic.forwardIDs) {
+		ic.selectedIndex = len(ic.forwardIDs) - 1
+	}
+	if ic.selectedIndex < 0 && len(ic.forwardIDs) > 0 {
+		ic.selectedIndex = 0
+	}
+}
+
+// MoveUp moves selection up
+func (ic *InteractiveController) MoveUp() {
+	ic.mu.Lock()
+	defer ic.mu.Unlock()
+
+	if ic.selectedIndex > 0 {
+		ic.selectedIndex--
+	}
+}
+
+// MoveDown moves selection down
+func (ic *InteractiveController) MoveDown() {
+	ic.mu.Lock()
+	defer ic.mu.Unlock()
+
+	if ic.selectedIndex < len(ic.forwardIDs)-1 {
+		ic.selectedIndex++
+	}
+}
+
+// ToggleSelected toggles the enable/disable state of the selected forward
+func (ic *InteractiveController) ToggleSelected() {
+	ic.mu.Lock()
+	if ic.selectedIndex < 0 || ic.selectedIndex >= len(ic.forwardIDs) {
+		ic.mu.Unlock()
+		return
+	}
+
+	selectedID := ic.forwardIDs[ic.selectedIndex]
+	currentlyDisabled := ic.disabledMap[selectedID]
+	newState := !currentlyDisabled
+	ic.disabledMap[selectedID] = newState
+	ic.mu.Unlock()
+
+	// Call the toggle callback
+	if ic.toggleCallback != nil {
+		ic.toggleCallback(selectedID, !newState) // enable is inverse of disabled
+	}
+}
+
+// GetSelectedIndex returns the current selection index
+func (ic *InteractiveController) GetSelectedIndex() int {
+	ic.mu.RLock()
+	defer ic.mu.RUnlock()
+	return ic.selectedIndex
+}
+
+// IsDisabled returns whether a forward is disabled
+func (ic *InteractiveController) IsDisabled(id string) bool {
+	ic.mu.RLock()
+	defer ic.mu.RUnlock()
+	return ic.disabledMap[id]
+}
+
+// GetSelectedID returns the ID of the currently selected forward
+func (ic *InteractiveController) GetSelectedID() string {
+	ic.mu.RLock()
+	defer ic.mu.RUnlock()
+
+	if ic.selectedIndex < 0 || ic.selectedIndex >= len(ic.forwardIDs) {
+		return ""
+	}
+	return ic.forwardIDs[ic.selectedIndex]
+}
+
+// HandleKey processes keyboard input and returns true if should continue
+func (ic *InteractiveController) HandleKey(b []byte) bool {
+	if len(b) == 0 {
+		return true
+	}
+
+	// Handle single byte keys
+	if len(b) == 1 {
+		switch b[0] {
+		case 'q', 'Q', 3: // q, Q, or Ctrl+C
+			return false
+		case ' ', '\r': // Space or Enter to toggle
+			ic.ToggleSelected()
+			return true
+		}
+	}
+
+	// Handle escape sequences (arrow keys)
+	if len(b) == 3 && b[0] == 27 && b[1] == 91 {
+		switch b[2] {
+		case 65: // Up arrow
+			ic.MoveUp()
+		case 66: // Down arrow
+			ic.MoveDown()
+		}
+	}
+
+	return true
+}