tare smoke

Send real traffic through an installed data plane and grade the response.

Pods, Gateway, and EPP resources can all be ready while inference routing,
streaming, or MCP session handling is broken. This exercises the real request
path instead of resource readiness.

Checks, in order of what they need:
  - auth enforced   — always runs; an unauthenticated request must be rejected
                      with the data plane's own 401. Needs no credential.
  - model routing   — with --smoke-api-key: an unknown model must be rejected
                      with a 400, proving the key authenticated.
  - completion      — with --smoke-model: a real request returns a completion.
  - streaming       — with --smoke-model: a streamed response stays valid to
                      completion.
  - MCP session     — with --smoke-mcp-route: initialize then list tools.

A check whose inputs are absent is skipped, not failed, so environment and
credential limits stay distinct from product failures. Exit is non-zero only
when a check finds the data plane itself at fault.

This is the same set tare install and tare upgrade run after they apply; run it
standalone to re-check after enabling a model, adding a route, or an incident.

Examples:
  # Credential-free: prove the data plane rejects anonymous traffic
  tare smoke https://proxy.example.com

  # Full path against an enabled model (spends a few tokens)
  tare smoke https://proxy.example.com \
    --smoke-api-key sk-... --smoke-model gpt-4o-mini

  # Check an MCP route as well
  tare smoke https://proxy.example.com \
    --smoke-api-key sk-... --smoke-mcp-route /mcp/<profile-id>

Usage:
  tare smoke <serve-url> [flags]

Flags:
      --smoke-api-key string     Inference API key for the post-apply data plane smoke tests. Prefer TARS_API_KEY — a key passed here lands in shell history and the process list. Mint one from the management-plane dashboard. Without it, only the credential-free auth check runs.
      --smoke-mcp-route string   MCP route path to establish a post-apply session against (e.g. /mcp/<profile-id>). Omit to skip.
      --smoke-model string       Model to send a real post-apply request to (e.g. gpt-4o-mini). Requires --smoke-api-key. Spends a few tokens on the named model to prove inference and streaming work end to end. Omit to skip.
      --smoke-timeout duration   Per-request timeout for the post-apply data plane smoke tests. (default 30s)

Global Flags:
  -q, --quiet     Suppress progress output; only errors and the final summary go to stderr
  -v, --verbose   Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr