Feat: Name unbridged CONNECT tunnels in the events ACTION column

authbridge/CLAUDE.md

@@ -516,6 +516,8 @@ Every plugin emits one of these 5 action values per invocation, so operators can
 
 Use `reason` to discriminate within an action — e.g. `skip/path_bypass` vs `skip/no_matching_route` tell different stories at the detail-pane level but both scan as "skip" in the at-a-glance timeline.
 
+**abctl's ACTION column is not only this vocabulary.** Two of its values are rendering, not plugin output: `—` when nothing acted, and `tunnel` for an opaque CONNECT — a row where no plugin ran, no protocol was parsed and there is no status, so METHOD and STATUS are blank too and the label is the only thing identifying it. Neither is ever emitted by a plugin, and neither is a verdict on the request.
+
 > **Producer-side contract:** the authoritative definition of the 5-value vocabulary, the `Invocation` struct fields, and which diagnostic fields each plugin type populates lives in [`docs/plugin-reference.md`](docs/plugin-reference.md#emitting-session-events). Edit that file when the vocabulary changes; this table is the consumer-side summary.
 
 ### Gotcha: denied requests

authbridge/cmd/abctl/tui/events_pane.go

@@ -22,7 +22,7 @@ func newEventsTable() table.Model {
 			{Title: "TIME", Width: 12},
 			{Title: "DIR", Width: 4},
 			{Title: "PHASE", Width: 7},
-			{Title: "ACTION", Width: 8},
+			{Title: "ACTION", Width: actionColWidth},
 			{Title: "PLUGIN", Width: 18},
 			{Title: "METHOD", Width: 22},
 			{Title: "STATUS", Width: 7},
@@ -115,7 +115,7 @@ func (m *model) rebuildEventsTable() {
 			continue
 		}
 
-		action, plugin := eventAction(invs)
+		action, plugin := rowAction(er, invs)
 		var idCell string
 		if id, ok := ids[ev]; ok {
 			idCell = strconv.Itoa(id)
@@ -316,6 +316,46 @@ func shadowFlagged(invs []pipeline.Invocation) bool {
 	return false
 }
 
+// actionColWidth is the ACTION column's width. Named rather than inlined in the
+// column literal so a test can assert against the real value: transcribing it
+// into the test gave two independent 8s, and narrowing the column left the test
+// passing while the label overflowed.
+const actionColWidth = 8
+
+// tunnelAction is the ACTION cell for an opaque CONNECT that no plugin acted on.
+//
+// It must fit actionColWidth. Truncation matters more here than on other rows:
+// METHOD and STATUS are both empty for an unbridged CONNECT, so a clipped
+// "tunne" would take the row back to unreadable — the state this label exists to
+// fix.
+const tunnelAction = "tunnel"
+
+// rowAction is the ACTION + PLUGIN pair for one display row.
+//
+// It wraps eventAction to name an unbridged CONNECT. Such a row carries TLS bytes,
+// so no plugin ran, no protocol was parsed and there is no status — left as "— —"
+// it reads as a request that failed or that the pipeline ignored, which is how a
+// routine egress tunnel came to look like a bug.
+//
+// The label applies only when nothing acted: a gate CAN deny a CONNECT on the
+// tunnel-open itself, and that deny must keep the headline. A BRIDGED tunnel never
+// reaches this branch — buildEventRows folds it into the decrypted inner request,
+// whose own action is the interesting one.
+//
+// invs is passed in rather than derived from er, so the headline is computed from
+// the same set the caller's visibility decision used. Deriving it again would make
+// that relationship implicit and silently divergent: were the call site ever to
+// filter invs — to honour a plugin-name filter in the hide logic, say — the ACTION
+// cell would keep using the unfiltered set and disagree with the row's own reason
+// for being visible.
+func rowAction(er eventRow, invs []pipeline.Invocation) (action, plugin string) {
+	action, plugin = eventAction(invs)
+	if er.event != nil && er.event.Tunnel && action == "—" {
+		return tunnelAction, "—"
+	}
+	return action, plugin
+}
+
 // eventAction folds a message's per-plugin invocations into the single ACTION +
 // PLUGIN cell pair shown in the timeline. The headline reflects what actually
 // took effect:

authbridge/cmd/abctl/tui/events_pane_test.go

@@ -847,3 +847,116 @@ func TestComputeEventPairs_FieldTrace(t *testing.T) {
 		}
 	}
 }
+
+// An unbridged CONNECT must name itself in the ACTION column. It carries TLS
+// bytes, so no plugin ran, no protocol was parsed and there is no status — left
+// blank the row reads as a request that failed or that the pipeline ignored, which
+// is how a routine egress tunnel (git, gh, an SDK that does not trust the bridge
+// CA) came to look like a bug.
+func TestRowAction_UnbridgedTunnelIsNamed(t *testing.T) {
+	er := eventRow{event: &pipeline.SessionEvent{
+		Direction: pipeline.Outbound,
+		Phase:     pipeline.SessionRequest,
+		Host:      "api.github.com:443",
+		Tunnel:    true,
+	}}
+	action, plugin := rowAction(er, er.invocations())
+	if action != tunnelAction {
+		t.Errorf("ACTION = %q, want %q", action, tunnelAction)
+	}
+	if plugin != "—" {
+		t.Errorf("PLUGIN = %q, want an em dash: no plugin ran", plugin)
+	}
+}
+
+// A gate can deny a CONNECT on the tunnel-open itself. That deny is the whole
+// point of the row and must keep the headline.
+func TestRowAction_DeniedTunnelKeepsTheDeny(t *testing.T) {
+	er := eventRow{event: &pipeline.SessionEvent{
+		Direction: pipeline.Outbound,
+		Phase:     pipeline.SessionRequest,
+		Host:      "blocked.example:443",
+		Tunnel:    true,
+		Invocations: &pipeline.Invocations{Outbound: []pipeline.Invocation{
+			{Plugin: "egress-gate", Action: pipeline.ActionDeny},
+		}},
+	}}
+	action, plugin := rowAction(er, er.invocations())
+	if action != string(pipeline.ActionDeny) {
+		t.Errorf("ACTION = %q, want deny — the label must not mask a gate decision", action)
+	}
+	if plugin != "egress-gate" {
+		t.Errorf("PLUGIN = %q, want egress-gate", plugin)
+	}
+}
+
+// A bridged tunnel is folded into its decrypted inner request, so the row shows
+// the inner request's action. The tunnel label must not override it.
+func TestRowAction_BridgedTunnelShowsInnerAction(t *testing.T) {
+	tunnel := &pipeline.SessionEvent{
+		Direction: pipeline.Outbound, Phase: pipeline.SessionRequest,
+		Host: "ete-litellm.example:443", Tunnel: true,
+	}
+	inner := &pipeline.SessionEvent{
+		Direction: pipeline.Outbound, Phase: pipeline.SessionRequest,
+		Host: "ete-litellm.example",
+		Invocations: &pipeline.Invocations{Outbound: []pipeline.Invocation{
+			{Plugin: "inference-parser", Action: pipeline.ActionObserve},
+		}},
+	}
+	er := eventRow{event: inner, tunnel: tunnel}
+	action, plugin := rowAction(er, er.invocations())
+	if action != string(pipeline.ActionObserve) {
+		t.Errorf("ACTION = %q, want observe from the decrypted inner request", action)
+	}
+	if plugin != "inference-parser" {
+		t.Errorf("PLUGIN = %q, want inference-parser", plugin)
+	}
+}
+
+// An ordinary request that no plugin touched keeps its em dash: only a tunnel
+// earns the label, or every passthrough row would claim to be one.
+func TestRowAction_PlainPassthroughIsUnchanged(t *testing.T) {
+	er := eventRow{event: &pipeline.SessionEvent{
+		Direction: pipeline.Outbound, Phase: pipeline.SessionRequest,
+		Host: "example.com",
+	}}
+	if action, _ := rowAction(er, er.invocations()); action != "—" {
+		t.Errorf("ACTION = %q for a non-tunnel passthrough, want an em dash", action)
+	}
+}
+
+// The label must fit the column, or the table shifts.
+func TestTunnelAction_FitsTheActionColumn(t *testing.T) {
+	if got := len([]rune(tunnelAction)); got > actionColWidth {
+		t.Errorf("%q is %d columns, ACTION is %d wide", tunnelAction, got, actionColWidth)
+	}
+}
+
+// End to end through buildEventRows, using the event shapes a live server records:
+// an unbridged CONNECT stands alone and is named; a bridged pair folds to one row
+// showing the inner action.
+func TestBuildEventRows_TunnelRowsAreLabelled(t *testing.T) {
+	base := time.Now()
+	events := []pipeline.SessionEvent{
+		{At: base, Direction: pipeline.Outbound, Phase: pipeline.SessionRequest,
+			RequestID: "40", Host: "api.github.com:443", Tunnel: true},
+		{At: base.Add(time.Second), Direction: pipeline.Outbound, Phase: pipeline.SessionRequest,
+			RequestID: "41", Host: "ete-litellm.example:443", Tunnel: true},
+		{At: base.Add(time.Second), Direction: pipeline.Outbound, Phase: pipeline.SessionRequest,
+			RequestID: "41", Host: "ete-litellm.example",
+			Invocations: &pipeline.Invocations{Outbound: []pipeline.Invocation{
+				{Plugin: "inference-parser", Action: pipeline.ActionObserve},
+			}}},
+	}
+	rows := buildEventRows(events)
+	if len(rows) != 2 {
+		t.Fatalf("got %d rows, want 2 (the bridged pair folds)", len(rows))
+	}
+	if a, _ := rowAction(rows[0], rows[0].invocations()); a != tunnelAction {
+		t.Errorf("unbridged tunnel row ACTION = %q, want %q", a, tunnelAction)
+	}
+	if a, _ := rowAction(rows[1], rows[1].invocations()); a != string(pipeline.ActionObserve) {
+		t.Errorf("bridged row ACTION = %q, want observe", a)
+	}
+}