fix: resolve diagnostic paths under the base path prefix and tolerate health-style ping responses

backend/src/workspaces/diagnostics.ts

@@ -236,8 +236,16 @@ export function createConcreteDiagnosticAdapters(
         if ("response" in request.diagnostic) {
           const payload = await response.json().catch(() => undefined) as Record<string, unknown> | undefined;
           const declared = request.diagnostic.response;
-          if (!payload || (declared?.database && payload[declared.database] !== request.resource.database)
-            || (declared?.schema && payload[declared.schema] !== request.resource.schema)) {
+          // Validate a declared field only when the probe response actually carries it, so a
+          // health-style ping (2xx + JSON without database/schema identity) still proves a
+          // reachable, authenticated connector. Declared fields that are present must match.
+          const databaseMatches = declared?.database === undefined
+            || payload?.[declared.database] === undefined
+            || payload[declared.database] === request.resource.database;
+          const schemaMatches = declared?.schema === undefined
+            || payload?.[declared.schema] === undefined
+            || payload[declared.schema] === request.resource.schema;
+          if (!payload || !databaseMatches || !schemaMatches) {
             throw new Error("REST probe failed");
           }
         }

backend/src/workspaces/schema.ts

@@ -423,7 +423,10 @@ export function validateOperationalWorkspace(workspace: unknown): WorkspaceV3 {
 export function resolveDiagnosticUrl(baseUrl: string, path: string): URL {
   if (!isOriginRelativeDiagnosticPath(path)) throw new Error("Diagnostic path must remain on the configured origin");
   const base = new URL(baseUrl);
-  const resolved = new URL(path, base);
+  // Resolve the origin-relative path beneath the configured base path (e.g. `/dwh/`), not the
+  // origin root: a leading slash must append to the base path instead of resetting it.
+  const basePath = base.pathname.endsWith("/") ? base.pathname : `${base.pathname}/`;
+  const resolved = new URL(`${basePath}${path.replace(/^\/+/, "")}`, base.origin);
   if (resolved.origin !== base.origin) throw new Error("Diagnostic URL must remain on the configured origin");
   return resolved;
 }

backend/test/workspaces-diagnostics.test.ts

@@ -9,7 +9,7 @@ import {
   type DiagnosticAdapters,
 } from "../src/workspaces/diagnostics.js";
 import type { RuntimeBindings } from "../src/workspaces/runtime-renderer.js";
-import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
+import { parseWorkspaceYaml, resolveDiagnosticUrl } from "../src/workspaces/schema.js";
 
 const workspace = parseWorkspaceYaml(`workspace:
   schema_version: 3
@@ -486,3 +486,10 @@ test("classifies an observed non-cosine Qdrant distance as semantic incompatibil
     code: "connector_unavailable",
   }));
 });
+
+test("resolveDiagnosticUrl appends the path to a base URL with a path prefix", () => {
+  expect(resolveDiagnosticUrl("https://dwh.example.test/dwh/", "/rpc/ping").toString())
+    .toBe("https://dwh.example.test/dwh/rpc/ping");
+  expect(resolveDiagnosticUrl("https://dwh.example.test/dwh", "/rpc/ping").toString())
+    .toBe("https://dwh.example.test/dwh/rpc/ping");
+});