health: probe /api/config, and report when the target is not a Vaultwarden

Was /alive, which answers on a Vaultwarden and proves only that SOMETHING is
listening on that address. /api/config self-identifies:

  {"version":"2026.6.0","server":{"name":"Vaultwarden",...}}

That distinction is the point of the check. The failure worth catching is not
"the box is down" — that surfaces on its own the moment anything else fails —
it is pointing the vault at the wrong port on a host running several things,
where a 200 from an unrelated service reads as success and the real problem
appears later as a login that cannot work.

So the panel now has three states rather than two: reachable and identified,
reachable but NOT a Vaultwarden (amber, with what to check), or no answer. The
server version is shown when it identifies itself.

Only /api/config is parsed, and only for `server.name` and `version`. It is
unauthenticated and carries no vault data — the hard rule about never reading
bodies governs the proxy path, and this is not on it.

Also recorded in-code: Vaultwarden does not implement /api/status, which does
exist in Bitwarden's official cloud API, so a probe aimed there 404s against a
perfectly healthy server. That near-miss looks exactly like a wrong address.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

sidecar/index.ts

@@ -137,14 +137,51 @@ const server = Bun.serve<VaultWSData>({
   async fetch(req, server) {
     const url = new URL(req.url);
 
-    // Reachability probe — ours, never touches vault data.
+    /*
+      Reachability probe — ours, never touches vault data.
+
+      `/api/config`, not `/alive`. Both answer, and `/alive` is the smaller request, but it only proves
+      that SOMETHING is listening on that address. `/api/config` proves the thing listening is actually a
+      Vaultwarden, because it self-identifies:
+
+        {"version":"2026.6.0","server":{"name":"Vaultwarden","url":...}, ...}
+
+      That distinction is the whole value of the check. The failure this guards against is not "the box is
+      down" — the owner finds that out the moment anything else fails — it is pointing the vault at the
+      wrong port on a host that runs several things, where a 200 from an unrelated service reads as
+      success and the real problem surfaces later as a login that cannot work.
+
+      Vaultwarden does NOT implement `/api/status`, which exists in Bitwarden's official cloud API; a
+      probe aimed there 404s against a perfectly healthy server. Recorded because it is exactly the kind
+      of near-miss that looks like a wrong address.
+    */
     if (url.pathname === '/_health') {
       const base = await getVaultBase();
       if (!base) return Response.json({ ok: false, error: 'no Vaultwarden URL configured' }, { status: 503 });
       const started = Date.now();
       try {
-        const r = await fetch(`${base}/alive`, { method: 'GET', signal: AbortSignal.timeout(5000) });
-        return Response.json({ ok: r.ok, upstreamStatus: r.status, ms: Date.now() - started, url: base });
+        const r = await fetch(`${base}/api/config`, { method: 'GET', signal: AbortSignal.timeout(5000) });
+        const ms = Date.now() - started;
+        if (!r.ok) {
+          return Response.json({ ok: false, upstreamStatus: r.status, ms, url: base }, { status: 502 });
+        }
+        // Read only what identifies the server. This endpoint is unauthenticated and carries no vault
+        // data, which is why it may be parsed at all — the hard rule about never reading bodies is about
+        // everything on the proxy path, and this is not on it.
+        const body = (await r.json().catch(() => ({}))) as Record<string, unknown>;
+        const server = (body.server ?? {}) as Record<string, unknown>;
+        const name = typeof server.name === 'string' ? server.name : null;
+        return Response.json({
+          ok: true,
+          upstreamStatus: r.status,
+          ms,
+          url: base,
+          server: name,
+          version: typeof body.version === 'string' ? body.version : null,
+          // A 200 from something that is not a Vaultwarden is the case this probe exists to catch, so it
+          // is reported rather than smoothed over into a plain `ok`.
+          identified: name !== null,
+        });
       } catch {
         return Response.json(
           { ok: false, error: 'upstream unreachable', ms: Date.now() - started, url: base },