feat: stream tunnel setup progress and fail fast on iroh DNS collision

The setup loop only checked accepted && programmed && !hostnames.is_empty()
and slept 2s at a time, so the user saw "Setting up tunnel..." then a 2s
silence and then "Tunnel ready" — even when the Connector's
IrohDNSPublished=False; DeferredToOwner condition meant the data plane
was silently unreachable.

Surface the six controller conditions that already exist on the HTTPProxy
and Connector (Accepted, CertificatesReady, ConnectorReady,
IrohDNSPublished, Programmed, ConnectorMetadataProgrammed) through a
typed TunnelProgress, and stream each transition as a checklist line.
Bail immediately when IrohDNSPublished comes back False with reason
DeferredToOwner — that's the cross-project iroh-key collision case
where waiting longer can't help, so we print the operator's message
naming the owning Connector and exit non-zero. Also warn on stdout when
any step stays pending past 30 seconds, since the controller's reason
string is the most useful diagnostic when something genuinely stalls.

Polling at 750ms is fine: get_active_progress does two reads
(HTTPProxy + Connector) on an already-warm PCP client, and server-side
reconcile latency dominates.

Author: drewr

cli/src/main.rs

@@ -8,7 +8,7 @@ use rustls::crypto::ring as rustls_ring;
 
 use lib::{
     Advertisment, AdvertismentTicket, ConnectNode, DiscoveryMode, HeartbeatAgent, ListenNode,
-    ProxyState, Repo, SelectedContext, TcpProxyData, TunnelService,
+    ProgressStepKind, ProxyState, Repo, SelectedContext, StepStatus, TcpProxyData, TunnelService,
     datum_cloud::{ApiEnv, DatumCloudClient, LoginState},
 };
 use n0_error::StdResultExt;
@@ -657,21 +657,10 @@ async fn main() -> n0_error::Result<()> {
                     println!();
                     println!("Your endpoint ID: {}", endpoint_id);
                     println!("Setting up tunnel...");
-                    let setup_start = std::time::Instant::now();
-
-                    let tunnel = loop {
-                        let t = service.get_active(&tunnel_id).await?;
-                        let Some(t) = t else {
-                            n0_error::bail_any!("Tunnel {} not found", tunnel_id);
-                        };
-                        if t.accepted && t.programmed && !t.hostnames.is_empty() {
-                            break t;
-                        }
-                        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
-                    };
+                    let progress = await_tunnel_progress(&service, &tunnel_id).await?;
 
-                    let elapsed = setup_start.elapsed().as_secs();
-                    for hostname in &tunnel.hostnames {
+                    let elapsed = progress.elapsed.as_secs();
+                    for hostname in &progress.hostnames {
                         println!("Tunnel ready after {} sec: https://{}", elapsed, hostname);
                     }
                     println!("Press Ctrl+C to stop...");
@@ -834,3 +823,106 @@ fn resolve_project_context(
     }
     None
 }
+
+/// Result of streaming the tunnel-setup progress to stdout. All conditions
+/// reached `Ready` (or we bailed before that for a terminal failure).
+struct SetupResult {
+    elapsed: std::time::Duration,
+    hostnames: Vec<String>,
+}
+
+/// Stuck threshold: a step that stays pending this long without progressing
+/// gets called out with a hint. Picked to cover normal slow paths (TLS cert
+/// issuance, edge programming) while still flagging genuine wedges.
+const PROGRESS_STUCK_WARN: std::time::Duration = std::time::Duration::from_secs(30);
+
+/// Poll cadence. Fast enough that step transitions feel responsive;
+/// the actual server-side reconcile latency dominates wall-clock anyway.
+const PROGRESS_POLL_INTERVAL: std::time::Duration = std::time::Duration::from_millis(750);
+
+/// Drive a tunnel through its setup conditions, printing a checklist as
+/// each one transitions to Ready. Bails fast on terminal failure
+/// (e.g. iroh DNS deferred to another project's Connector — waiting won't
+/// help, and the operator's message already names the conflict).
+async fn await_tunnel_progress(
+    service: &TunnelService,
+    tunnel_id: &str,
+) -> n0_error::Result<SetupResult> {
+    use std::collections::HashMap;
+
+    let start = std::time::Instant::now();
+    let mut last_status: HashMap<ProgressStepKind, StepStatus> = HashMap::new();
+    let mut pending_since: HashMap<ProgressStepKind, std::time::Instant> = HashMap::new();
+    let mut warned_stuck: std::collections::HashSet<ProgressStepKind> = Default::default();
+
+    loop {
+        let Some(progress) = service.get_active_progress(tunnel_id).await? else {
+            n0_error::bail_any!("Tunnel {} not found", tunnel_id);
+        };
+
+        for step in &progress.steps {
+            let prev = last_status.get(&step.kind).copied();
+            if prev != Some(step.status) {
+                match step.status {
+                    StepStatus::Ready => {
+                        println!(
+                            "  ✓ {} ({:.1}s)",
+                            step.kind.label(),
+                            start.elapsed().as_secs_f32()
+                        );
+                        pending_since.remove(&step.kind);
+                    }
+                    StepStatus::Pending => {
+                        pending_since.entry(step.kind).or_insert_with(std::time::Instant::now);
+                    }
+                    StepStatus::Unknown => {}
+                }
+                last_status.insert(step.kind, step.status);
+            }
+
+            // Generic stuck warning: if a step has been Pending past the
+            // threshold and we haven't already warned, surface the
+            // controller's reason/message so the user knows what's stalled.
+            if step.status == StepStatus::Pending
+                && !warned_stuck.contains(&step.kind)
+                && let Some(since) = pending_since.get(&step.kind)
+                && since.elapsed() >= PROGRESS_STUCK_WARN
+            {
+                warned_stuck.insert(step.kind);
+                let detail = step
+                    .message
+                    .as_deref()
+                    .or(step.reason.as_deref())
+                    .unwrap_or("no detail from controller");
+                eprintln!(
+                    "  … {} still pending after {}s: {}",
+                    step.kind.label(),
+                    since.elapsed().as_secs(),
+                    detail,
+                );
+            }
+        }
+
+        if let Some(fail) = progress.terminal_failure() {
+            let owner = fail.message.as_deref().unwrap_or("unknown owner");
+            n0_error::bail_any!(
+                "✗ {}: iroh DNS record is owned by another Connector ({}). \
+                 Another project on this machine registered the same iroh identity. \
+                 With per-project keys, delete the per-project listen_key under this project's \
+                 directory in your Datum repo (or the offending Connector in the other project) \
+                 and rerun.",
+                fail.kind.label(),
+                owner,
+            );
+        }
+
+        if progress.all_ready() && !progress.hostnames.is_empty() {
+            return Ok(SetupResult {
+                elapsed: start.elapsed(),
+                hostnames: progress.hostnames,
+            });
+        }
+
+        tokio::time::sleep(PROGRESS_POLL_INTERVAL).await;
+    }
+}

lib/src/datum_apis/connector.rs

@@ -102,3 +102,11 @@ pub struct ConnectorStatus {
     pub connection_details: Option<ConnectorConnectionDetails>,
     pub lease_ref: Option<v1::LocalObjectReference>,
 }
+
+pub const CONNECTOR_CONDITION_READY: &str = "Ready";
+pub const CONNECTOR_CONDITION_IROH_DNS_PUBLISHED: &str = "IrohDNSPublished";
+/// The iroh DNS record is already owned by another Connector with the same
+/// public key — typically a Connector in a different project. The losing
+/// Connector cannot publish DNS and its tunnel data plane is silently
+/// unreachable. See network-services-operator iroh_dns_controller.go.
+pub const CONNECTOR_REASON_DEFERRED_TO_OWNER: &str = "DeferredToOwner";

lib/src/datum_apis/http_proxy.rs

@@ -63,6 +63,8 @@ pub const HTTP_PROXY_CONDITION_ACCEPTED: &str = "Accepted";
 pub const HTTP_PROXY_CONDITION_PROGRAMMED: &str = "Programmed";
 pub const HTTP_PROXY_CONDITION_HOSTNAMES_VERIFIED: &str = "HostnamesVerified";
 pub const HTTP_PROXY_CONDITION_HOSTNAMES_IN_USE: &str = "HostnamesInUse";
+pub const HTTP_PROXY_CONDITION_CERTIFICATES_READY: &str = "CertificatesReady";
+pub const HTTP_PROXY_CONDITION_CONNECTOR_METADATA_PROGRAMMED: &str = "ConnectorMetadataProgrammed";
 
 pub const HTTP_PROXY_REASON_ACCEPTED: &str = "Accepted";
 pub const HTTP_PROXY_REASON_PROGRAMMED: &str = "Programmed";

lib/src/lib.rs

@@ -19,7 +19,10 @@ pub use node::*;
 pub use project_control_plane::ProjectControlPlaneClient;
 pub use repo::Repo;
 pub use state::*;
-pub use tunnels::{TunnelDeleteOutcome, TunnelService, TunnelSummary};
+pub use tunnels::{
+    ProgressStep, ProgressStepKind, StepStatus, TunnelDeleteOutcome, TunnelProgress, TunnelService,
+    TunnelSummary,
+};
 pub use update::{UpdateChannel, UpdateChecker, UpdateInfo, UpdateSettings};
 
 /// The root domain for datum connect urls to subdomain from. A proxy URL will