fix: default tran to in-cluster cloud api

skills/device-pod-cli/SKILL.md

@@ -65,10 +65,13 @@ use the same remote channel that backs cmd passthrough. In HWLAB coder images,
 `/app/tools/hwlab-gateway-tran.mjs` is only the compatible explicit wrapper for
 the same transport. If the compatible wrapper exists but `/app/tools/tran.mjs`
 is missing, report a CI/CD preinstall gap instead of adding a device-pod
-workaround. `tran.mjs upload` uses bounded base64 chunks tuned for the Windows
+workaround. In HWLAB k8s runner pods, `tran.mjs` auto-selects the in-cluster
-cmd passthrough limit; do not raise the chunk size above the documented default
+`hwlab-cloud-api.<namespace>.svc.cluster.local:6667` API endpoint; outside k8s it
-to hide slow transfers. If upload/download becomes awkward again, fix `tran.mjs`
+falls back to local `127.0.0.1:6667`, and non-standard deployments may still pass
-or the gateway transport first.
+`--api-base-url`. `tran.mjs upload` uses bounded base64 chunks tuned for the
+Windows cmd passthrough limit; do not raise the chunk size above the documented
+default to hide slow transfers. If upload/download becomes awkward again, fix
+`tran.mjs` or the gateway transport first.
 
 ```text
 node /app/tools/tran.mjs <gatewaySessionId>:/d/Work/HWLAB-workspace upload /app/skills/device-pod-cli/assets/device-host-cli.mjs tools/device-host-cli.mjs

tools/hwlab-gateway-tran.mjs

@@ -11,7 +11,8 @@ import {
 } from "node:fs";
 import path from "node:path";
 
-const DEFAULT_API_BASE_URL = "http://127.0.0.1:6667";
+const LOCAL_API_BASE_URL = "http://127.0.0.1:6667";
+const DEFAULT_API_PORT = "6667";
 const DEFAULT_PROJECT_ID = "prj_mvp_topology";
 const DEFAULT_RESOURCE_ID = "res_windows_host";
 const DEFAULT_CAPABILITY_ID = "cap_windows_cmd_exec";
@@ -38,7 +39,7 @@ async function main() {
     return;
   }
 
-  const apiBaseUrl = stripTrailingSlash(cli.options.apiBaseUrl || process.env.HWLAB_GATEWAY_TRAN_API_BASE_URL || process.env.HWLAB_GATEWAY_SHELL_API_BASE_URL || DEFAULT_API_BASE_URL);
+  const apiBaseUrl = stripTrailingSlash(cli.options.apiBaseUrl || process.env.HWLAB_GATEWAY_TRAN_API_BASE_URL || process.env.HWLAB_GATEWAY_SHELL_API_BASE_URL || defaultApiBaseUrl());
   const timeoutMs = boundedPositiveInteger(cli.options.timeoutMs ?? process.env.HWLAB_GATEWAY_TRAN_TIMEOUT_MS, DEFAULT_TIMEOUT_MS, { min: 1000, max: MAX_TIMEOUT_MS });
   const requestTimeoutMs = boundedPositiveInteger(cli.options.requestTimeoutMs, timeoutMs + REQUEST_TIMEOUT_GRACE_MS, {
     min: timeoutMs,
@@ -61,6 +62,24 @@ async function main() {
   }
 }
 
+function defaultApiBaseUrl() {
+  const namespace = readKubernetesNamespace();
+  if (process.env.KUBERNETES_SERVICE_HOST && namespace) {
+    return `http://hwlab-cloud-api.${namespace}.svc.cluster.local:${DEFAULT_API_PORT}`;
+  }
+  return LOCAL_API_BASE_URL;
+}
+
+function readKubernetesNamespace() {
+  try {
+    const value = readFileSync("/var/run/secrets/kubernetes.io/serviceaccount/namespace", "utf8").trim();
+    if (/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(value)) return value;
+  } catch {
+    // Non-Kubernetes hosts keep the local cloud-api default.
+  }
+  return "";
+}
+
 function parseCli(argv) {
   if (argv.length === 0) return { help: true, exitCode: 2 };
   if (argv[0] === "--help" || argv[0] === "-h") return { help: true, exitCode: 0 };
@@ -441,7 +460,7 @@ function printHelp(exitCode = 0) {
     "  download <remote> [local]         Download a remote file using verified base64 chunks.",
     "",
     "Options:",
-    "  --api-base-url URL                Default http://127.0.0.1:6667 or HWLAB_GATEWAY_TRAN_API_BASE_URL.",
+    "  --api-base-url URL                Default env override, in-cluster hwlab-cloud-api service, or http://127.0.0.1:6667.",
     "  --timeout-ms N                    Gateway command timeout, default 120000ms.",
     "  --request-timeout-ms N            HTTP wait timeout; defaults to command timeout plus grace.",
     "  --chunk-size N                    Upload/download base64 chunk size, default 2000, max 2000.",