@bli-cockpit/cli 0.2.282 → 0.2.284

package/dist/autostart-memory-guard.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { fileExists, MEMORY_GUARD_AUTOSTART_LABEL, memoryGuardPlistPathFor, WINDOWS_MEMORY_GUARD_TASK_NAME, } from "./autostart-contract.js";
 import { describeDifference, renderedFileDifference, renderWindowsLauncherScript, UTF8_BOM, windowsPowerShellPath, windowsWScriptPath, } from "./autostart-windows-scripts.js";
 import { xmlEscape, decodeXmlEntities } from "./autostart-xml.js";
-import { lastKillIn, MEMORY_GUARD_DISABLED_MARKER, MEMORY_GUARD_LOG, memoryGuardLimitsFor, memoryGuardStateFile, memoryGuardTurnedOff, memoryGuardTurnedOn, } from "./memory-guard-contract.js";
+import { lastKillIn, MEMORY_GUARD_DISABLED_MARKER, MEMORY_GUARD_LOG, memoryGuardLimitsFor, swapLimitFor, memoryGuardStateFile, memoryGuardTurnedOff, memoryGuardTurnedOn, } from "./memory-guard-contract.js";
 import { renderDarwinMemoryGuardScript } from "./memory-guard-script-darwin.js";
 import { renderWindowsMemoryGuardRegistration, renderWindowsMemoryGuardScript } from "./memory-guard-script-windows.js";
 /**
@@ -70,7 +70,7 @@ function darwinFiles(options) {
     return {
         scriptPath,
         plistPath: memoryGuardPlistPathFor(options.homeDir ?? os.homedir()),
-        script: renderDarwinMemoryGuardScript({ limits: limitsOf(options), logPath: stateFile(options, MEMORY_GUARD_LOG) }),
+        script: renderDarwinMemoryGuardScript({ limits: limitsOf(options), logPath: stateFile(options, MEMORY_GUARD_LOG), swapLimitMb: swapLimitFor(options) }),
         plist: renderMemoryGuardPlist({ scriptPath, stdoutPath: stateFile(options, GUARD_OUT_LOG), stderrPath: stateFile(options, GUARD_ERR_LOG) }),
     };
 }

package/dist/commands/local-args-tower-notes.js

@@ -55,6 +55,7 @@ const NOTES_ACTIONS = new Set([
     "bot-upcoming",
     "record",
     "app",
+    "review",
 ]);
 /** Actions whose first positional is the note it acts on. */
 const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
@@ -110,6 +111,9 @@ const NOTES_ALLOWED_FLAGS = [
     // transcript was stored cut short. A FLAG, not a verb: it is the same sync
     // door with a different request.
     "--repair-truncated",
+    // BLI-22350. `review <note-id> --submit` reads `{ raw_hash, answers }` from stdin; `--accept-all` sends the defaults.
+    "--submit",
+    "--accept-all",
 ];
 const NOTES_VALUE_FLAGS = [
     "--home",
@@ -150,6 +154,7 @@ export function parseNotesArgs(args) {
         throw new Error("notes rename needs --name <name>.");
     const { to, clearShelf } = readNotesShelfTarget(action, values);
     const repairTruncated = readRepairTruncated(action, values);
+    const review = readReviewRequest(action, values, rest);
     const { limit, month, offset } = readNotesWindow(action, values);
     return {
         kind: "notes",
@@ -184,6 +189,7 @@ export function parseNotesArgs(args) {
         ...(month ? { month } : {}),
         ...(offset === undefined ? {} : { offset }),
         ...(repairTruncated ? { repairTruncated: true } : {}),
+        ...review,
         yes,
         json,
     };
@@ -193,7 +199,7 @@ function readNotesAction(first) {
     // almost always wants — same reasoning as bare `cockpit` running convergence.
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, summarize, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, granola-status, or transcription-stats (and record start|stop|status|cancel, app install|uninstall|status).`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, summarize, move, place, accounts, connect, detach, sync, sync-status, recordings, recording, webhook, granola-status, transcription-stats, or review (and record start|stop|status|cancel, app install|uninstall|status).`);
     }
     return action;
 }
@@ -220,6 +226,23 @@ function readAppRequest(rest) {
         throw new Error(`notes app ${verb} does not take "${rest[1]}".`);
     return { appAction: verb };
 }
+/** BLI-22350: `review [<note-id>] [--submit|--accept-all]`. Bare lists mine; an id shows one; a flag answers it. */
+function readReviewRequest(action, values, rest) {
+    const flag = values.booleans.has("--submit") ? "--submit" : values.booleans.has("--accept-all") ? "--accept-all" : null;
+    if (action !== "review") {
+        if (flag)
+            throw new Error(`${flag} belongs to \`cockpit notes review <note-id> ${flag}\`.`);
+        return {};
+    }
+    if (rest.length > 1)
+        throw new Error(`notes review takes one note id, not ${rest.length}.`);
+    const noteId = optionalNonEmpty(rest[0]);
+    if (values.booleans.has("--submit") && values.booleans.has("--accept-all"))
+        throw new Error("notes review takes --submit or --accept-all, not both.");
+    if (flag && !noteId)
+        throw new Error(`notes review ${flag} needs a note id: cockpit notes review <note-id> ${flag}.`);
+    return { ...(noteId ? { noteId } : {}), ...(flag === "--submit" ? { submit: true } : {}), ...(flag === "--accept-all" ? { acceptAll: true } : {}) };
+}
 function readRepairTruncated(action, values) {
     const repairTruncated = values.booleans.has("--repair-truncated");
     if (repairTruncated && action !== "sync") {
@@ -328,6 +351,7 @@ function readNotesPaths(action, rest) {
     const takesNoPositional = action !== "paste"
         && action !== "record"
         && action !== "app"
+        && action !== "review"
         && action !== "connect"
         && action !== "sync"
         && action !== "sync-status"

package/dist/commands/local-help-commands-tower-ops.js

@@ -29,7 +29,7 @@ export const TOWER_OPS_COMMAND_HELP = [
             "  -                   lines on stdin: plain text, `journalctl -o json`, `railway logs --json` or `vercel logs --json`.",
             "  <project>           a BLI project (tower, kolm, portpal, pearl-portal, triage-crm, ...; `--list` names them): the digest Tower's",
             "                      own 15-minute cron STORED from that project's Vercel, Railway and Supabase logs, merged over --since",
-            "                      (default 24h, at most 30d), real bugs first. Needs only this machine's Tower login: no vercel or railway",
+            "                      (default 24h, at most 1095d), real bugs first. Needs only this machine's Tower login: no vercel or railway",
             "                      login. It keeps no raw line, so --raw, --table and --all-levels do not apply.",
             "--stored              dashboard or railway read Tower's stored digest of project `tower` (this also happens by itself, and says so,",
             "                      when the local vercel or railway CLI is missing or logged out).",

package/dist/commands/local-help-notes.js

@@ -3,7 +3,7 @@ export const NOTES_HELP = [
     [
         "notes",
         [
-            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>|record start|stop|status|cancel|app install|uninstall|status] [flags]",
+            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]|recordings <note-id>|recording <id>|record start|stop|status|cancel|app install|uninstall|status|review [<note-id>] [--submit|--accept-all]] [flags]",
             "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 1 GB. Over 4 MB (a whole meeting) the file goes straight to storage and is transcribed in the background; --wait then polls for up to 4 hours and prints progress, otherwise for at most 330 seconds.",
             "",
             "record start|stop [<session-id>]|status|cancel — record a meeting in a room from this machine's microphone (Apple Silicon macOS and Windows; Linux says it is not supported). On Windows the microphone needs Settings > Privacy & security > Microphone on, including Let desktop apps access your microphone. Nothing leaves the machine while recording; the recorder stops by itself after 8 hours (under the 1 GB upload limit). `stop` uploads the whole original recording, silence included, and Tower writes a note with Speaker 1, Speaker 2... lines, or says no speech was detected (add --wait to watch the transcription). `cancel` stops and KEEPS the file; `status` lists what is recording and every session waiting for upload (`needs_upload`); `stop <session-id>` uploads a cancelled, crashed or auto-stopped session. The BLI Notetaker app uploads waiting sessions by itself. The recording also stays on this machine.",
@@ -42,6 +42,7 @@ export const NOTES_HELP = [
             "bot-upcoming [--json] — your own Google Meet meetings today that the bot will join, with claim state. Decline or mark private to opt out.",
             "granola-status [--limit <n>] [--json] — the Granola cron's own last several runs (ticket 10718): reason, counts, model, spend and which lookback it used. Granola runs on a shared server-side key, not a connected account, so this is its own read rather than `accounts`.",
             "transcription-stats [--month YYYY-MM] [--json] — what meeting transcription cost and did (BLI-18003): minutes, dollars (list and real), requests, failures and fallbacks per provider for the UTC month (default: this one), the spend against the monthly cap and how close the 80% message and the hold are, how many meetings are waiting for budget, which provider keys the deploy holds (by name), and how old the numbers are. Switch providers or move the cap with `cockpit settings switches set transcription.provider|transcription.fallback_chain|transcription.monthly_cap_usd <value>`.",
+            "review [<note-id>] [--submit|--accept-all] [--json] — the meeting reviews waiting for you (BLI-22350). A recorded meeting stays with its attendees until one of them clears one review screen: who's who, lines the raw transcript may have put under the wrong speaker, unclear words, spots where the clean-up may have changed the meaning, sensitive moments. Bare `review` lists yours (waiting, being applied, cleared in the last 7 days). `review <note-id>` shows one in that order with every default answer; --json prints the raw read (raw_hash, items, defaults, budget_stop_line). When money stopped the clean-up (kept as transcribed because the meeting is over the one-meeting limit, or waiting because the month's safety limit was reached or the budget could not be checked), one plain line under the title says so with the meeting's length and estimated cost. `--accept-all` submits every default (names as guessed, lines kept, best-guess readings, the words as said where the meaning may have changed, sensitive moments to attendees only) and prints what it accepted. `--submit` reads { \"raw_hash\": ..., \"answers\": [...] } from stdin: edit the defaults from --json and pipe them in. A refusal says to reload when the review changed (stale_raw_hash, stale_guess) or names what is wrong with the answers. Same door as the web screen (/meeting-notes/<note-id>/review) and the notes_review_* MCP tools.",
             "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",
             "--json writes one machine-readable object to stdout; every reason, receipt and progress line stays on stderr.",
             "Sharing and moving need a signed-in session the database can see. If this deployment cannot mint one, they are refused as needs_signed_in_session rather than done with no permission check — and reads say when they came back narrower than the browser's.",

package/dist/commands/notes-review.js

@@ -0,0 +1,207 @@
+/**
+ * `cockpit notes review [<note-id>] [--submit|--accept-all] [--json]` (BLI-22350): the attendee's meeting review in
+ * the terminal. Sibling of `notes.ts`, named in its header. Owner doc: `docs/runbooks/meeting-review-screen.md`.
+ *
+ *   review                       the reviews waiting for me (GET /api/notes/review)
+ *   review <id>                  one review, in the screen's order (GET /api/notes/review/<id>); --json is the raw read
+ *   review <id> --submit         `{ raw_hash, answers }` JSON from stdin (POST /api/notes/review/<id>)
+ *   review <id> --accept-all     read, then submit every item's default answer, and print what it accepted
+ *
+ * The same doors the web screen and the `notes_review_*` MCP tools call; the database decides who is a reviewer. This
+ * file holds no rule about answers: the door checks them and its refusal (reason and sentence) is relayed verbatim.
+ */
+import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
+import { ask, emit, errorText, fail, READ_DEADLINE_MS } from "./notes-door.js";
+const WRITE_DEADLINE_MS = 60_000;
+/** A review's answers are a few dozen short objects; this is far above any real one. */
+const SUBMIT_MAX_CHARS = 512_000;
+/** The dashboard's `review-words.ts` sentence, repeated here: this package does not import the dashboard. */
+const AS_TRANSCRIBED_LINE = "This meeting is kept as transcribed; only the speakers need confirming.";
+/** The web screen's plain label per meaning-check issue, repeated here for the same reason. */
+const MEANING_ISSUE_WORDS = {
+    number: "A number may have changed",
+    negation_or_pronoun: "A 'not' or a 'we/you' may have flipped",
+    hedge_or_correction: "A 'maybe' or a correction may have been dropped",
+    added_words: "Words may have been added",
+    unclear_made_sensible: "An unclear bit may have been made to sound sensible",
+    speaker_moved: "A line may have been moved to another speaker",
+    passage_left_out: "A passage may have been left out",
+    other: "The meaning may have changed",
+};
+const STATE_WORDS = {
+    queued: "waiting for Tower to prepare it",
+    preparing: "being prepared (transcript cleaned and checked)",
+    awaiting_attendee: "waiting for your answers",
+    applying: "answered; Tower is applying the answers",
+    cleared: "cleared",
+    failed: "stuck; an engineer has been told",
+};
+const reviewPath = (noteId) => `/api/notes/review/${encodeURIComponent(noteId)}`;
+export async function runNotesReview(command, door) {
+    if (!command.noteId)
+        return listReviews(door);
+    if (command.submit)
+        return submitFromStdin(command.noteId, door);
+    if (command.acceptAll)
+        return acceptAll(command.noteId, door);
+    return showReview(command.noteId, door);
+}
+async function listReviews(door) {
+    const answer = await ask(door, { path: "/api/notes/review", method: "GET", label: "notes review", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const body = answer.body;
+    if (door.json)
+        return emit(door, { ok: true, ...body });
+    const out = door.io.stdout;
+    if (body.reviews.length === 0) {
+        writeLine(out, "No meeting reviews for you: nothing waits, and nothing was cleared in the last 7 days.");
+        return 0;
+    }
+    writeLine(out, `${body.waiting} meeting(s) wait for your review.`);
+    for (const row of body.reviews) {
+        writeLine(out, `${row.note_id}  ${row.meeting_date}  ${row.item_count} item(s)  ${STATE_WORDS[row.state] ?? row.state}  ${row.note_title ?? "(untitled meeting)"}`);
+    }
+    writeLine(out, `Open one: cockpit notes review <note-id>, or ${door.dashboardUrl}/meeting-notes/<note-id>/review in a browser.`);
+    return 0;
+}
+async function readOne(noteId, door) {
+    return ask(door, { path: reviewPath(noteId), method: "GET", label: "notes review", timeoutMs: READ_DEADLINE_MS });
+}
+function lines(value) {
+    if (value === null || value === undefined)
+        return [];
+    if (typeof value === "string")
+        return value.trim() ? [value.trim()] : [];
+    if (Array.isArray(value))
+        return value.flatMap((entry) => (typeof entry === "string" ? [entry] : [JSON.stringify(entry)]));
+    return [JSON.stringify(value)];
+}
+/**
+ * The review in the screen's order: who's who, lines under the wrong speaker, unclear words, meaning checks,
+ * sensitive moments.
+ */
+/** A meaning check's stretch is one or more transcript lines: the label on the first, the rest indented under it. */
+function stretch(label, text) {
+    const [first = "", ...rest] = text.split(/\r?\n/);
+    const pad = " ".repeat(label.length + 5);
+    return [`    ${label} ${first}`, ...rest.map((line) => `${pad}${line}`)];
+}
+export function renderReview(body, dashboardUrl) {
+    const out = [];
+    out.push(`${body.note_title ?? "Meeting"}${body.meeting_date ? `, ${body.meeting_date}` : ""}: ${STATE_WORDS[body.state] ?? body.state}.`);
+    // Ticket BLI-23569: the server's own line, printed as it came, so the words stay in one place (the dashboard).
+    if (body.budget_stop_line)
+        out.push(body.budget_stop_line);
+    const of = (kind) => body.items.filter((item) => item.kind === kind);
+    const speakers = of("speaker");
+    if (speakers.length)
+        out.push("", "Who's who (the name you confirm or correct):");
+    for (const item of speakers) {
+        out.push(`  ${item.label}: ${item.guess || "(no guess; leave empty to keep the label)"} [${item.id}]`, `    why: ${item.reasoning}`);
+        for (const quote of item.quotes ?? [])
+            out.push(`    ${quote.timestamp} "${quote.text}"`);
+    }
+    const moved = of("speaker_line");
+    if (moved.length)
+        out.push("", "Lines that may be under the wrong speaker (default: keep):");
+    for (const item of moved)
+        out.push(`  ${item.timestamp} under ${item.guess || "(no speaker)"}: "${item.quote.text}" [${item.id}]`);
+    const unclear = of("unclear");
+    if (unclear.length)
+        out.push("", "Unclear words (default: the best guess):");
+    for (const item of unclear) {
+        out.push(`  ${item.timestamp} "${item.words}" -> ${item.guess || "(keep marked unclear)"}${item.changesMeaning ? "  CHANGES THE MEANING" : ""} [${item.id}]`, `    context: ${item.context}`);
+    }
+    const meaning = of("meaning_check");
+    if (meaning.length)
+        out.push("", "Did the clean-up change the meaning? (default: keep the words as said; answer \"raw\" or \"cleaned\"):");
+    for (const item of meaning) {
+        out.push(`  ${item.timestamp} ${MEANING_ISSUE_WORDS[item.issue] ?? MEANING_ISSUE_WORDS.other} [${item.id}]`);
+        if (item.said || item.written)
+            out.push(`    "${item.said}" -> "${item.written}"`);
+        out.push(...stretch("as said:      ", item.raw), ...stretch("as cleaned up:", item.cleaned));
+    }
+    const sensitive = of("sensitive");
+    if (sensitive.length)
+        out.push("", "Sensitive moments (default: attendees only):");
+    for (const item of sensitive)
+        out.push(`  ${item.timestamp} ${item.what} [${item.id}]`);
+    if (body.as_transcribed)
+        out.push("", AS_TRANSCRIBED_LINE);
+    else {
+        for (const [heading, value] of [["Summary", body.summary], ["Decisions", body.decisions], ["Action items", body.action_items]]) {
+            const said = lines(value);
+            if (said.length)
+                out.push("", `${heading}:`, ...said.map((line) => `  ${line}`));
+        }
+    }
+    if (body.state === "cleared" && body.attendee_notes)
+        out.push("", "Kept for the attendees only:", ...body.attendee_notes.split("\n").map((line) => `  ${line}`));
+    if (body.state === "awaiting_attendee") {
+        out.push("", `Answer: cockpit notes review ${body.note_id} --accept-all (every default above), or edit the defaults from`, `cockpit notes review ${body.note_id} --json and pipe { "raw_hash", "answers" } to cockpit notes review ${body.note_id} --submit.`, `Or open ${dashboardUrl}/meeting-notes/${body.note_id}/review.`);
+    }
+    return out;
+}
+async function showReview(noteId, door) {
+    const answer = await readOne(noteId, door);
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    if (door.json)
+        return emit(door, answer.body);
+    for (const line of renderReview(answer.body, door.dashboardUrl))
+        writeLine(door.io.stdout, line);
+    return 0;
+}
+async function post(noteId, door, body, accepted) {
+    const answer = await ask(door, { path: reviewPath(noteId), method: "POST", label: "notes review submit", timeoutMs: WRITE_DEADLINE_MS, body });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const done = answer.body;
+    if (door.json)
+        return emit(door, { ok: true, ...done, ...(accepted ? { accepted } : {}) });
+    writeLine(door.io.stdout, `Submitted ${done.answers} answer(s). Tower is applying them; the meeting is released to the team once its privacy check passes.`);
+    return 0;
+}
+async function submitFromStdin(noteId, door) {
+    if (isInteractiveStdin(door.io)) {
+        return fail(door, "nothing_piped", `Pipe { "raw_hash": ..., "answers": [...] } in: cockpit notes review ${noteId} --json, edit the defaults, then pipe them to cockpit notes review ${noteId} --submit.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(await readPipedText(door.io.stdin, { maxChars: SUBMIT_MAX_CHARS, overflowMessage: "The answers piped in are far larger than any review." }));
+    }
+    catch (error) {
+        return fail(door, "invalid_body", `The answers piped in are not JSON (${errorText(error)}). Send { "raw_hash": ..., "answers": [...] }.`);
+    }
+    return post(noteId, door, parsed);
+}
+function acceptedWords(answer) {
+    const value = answer.answer;
+    if (answer.kind === "speaker")
+        return `speaker ${answer.guess || "(no guess)"} -> ${value === "" ? "keep the label" : String(value)}`;
+    if (answer.kind === "speaker_line")
+        return "line stays where it is";
+    if (answer.kind === "unclear") {
+        const reading = value.reading;
+        return reading === null ? "unclear word stays marked" : `unclear word -> ${reading}`;
+    }
+    if (answer.kind === "meaning_check")
+        return value === "cleaned" ? "meaning check -> keep the clean-up's words" : "meaning check -> keep the words as said";
+    return `sensitive moment -> ${String(value) === "keep_in" ? "kept in" : "attendees only"}`;
+}
+async function acceptAll(noteId, door) {
+    const read = await readOne(noteId, door);
+    if (!read.ok)
+        return fail(door, read.reason, read.detail);
+    const review = read.body;
+    if (review.state !== "awaiting_attendee") {
+        return fail(door, "review_not_awaiting_attendee", `This review is ${STATE_WORDS[review.state] ?? review.state}, so there is nothing to answer.`);
+    }
+    if (!door.json) {
+        writeLine(door.io.stdout, `Accepting ${review.defaults.length} default answer(s):`);
+        for (const answer of review.defaults)
+            writeLine(door.io.stdout, `  ${answer.item_id}: ${acceptedWords(answer)}`);
+    }
+    return post(noteId, door, { raw_hash: review.raw_hash, answers: review.defaults }, review.defaults);
+}

package/dist/commands/notes.js

@@ -40,6 +40,8 @@
  *    Notetaker app on this Mac or Windows PC (Mac LaunchAgent: `notes-app-plist.ts`; Windows: `notes-app-windows.ts`).
  *  - `notes-transcription-stats.ts` — BLI-18003: what meeting transcription
  *    cost and did per provider for a month, and the spend against the cap.
+ *  - `notes-review.ts` — BLI-22350: the meeting reviews waiting for me, one
+ *    review, and answering it (`--submit` from stdin, `--accept-all`).
  *
  * Every public name is still importable from this file.
  */
@@ -52,6 +54,7 @@ import { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts,
 import { showBotUpcoming } from "./notes-bot-upcoming.js";
 import { showGranolaStatus } from "./notes-granola-status.js";
 import { showTranscriptionStats } from "./notes-transcription-stats.js";
+import { runNotesReview } from "./notes-review.js";
 import { listRecordings, showRecording } from "./notes-recordings.js";
 import { defaultRecordDeps, runNotesRecord } from "./notes-record.js";
 import { runNotesApp } from "./notes-app.js";
@@ -94,6 +97,7 @@ const NOTES_VERBS = {
     "bot-upcoming": showBotUpcoming,
     "granola-status": showGranolaStatus,
     "transcription-stats": showTranscriptionStats,
+    review: runNotesReview,
 };
 export async function runNotes(command, io) {
     // BLI-22979: recording is local until `stop` uploads, so only the upload needs the paired session.

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.282");
+    writeLine(io?.stdout ?? process.stdout, "0.2.284");
     return 0;
   }
 

package/dist/memory-guard-contract.js

@@ -26,10 +26,30 @@ export const MEMORY_GUARD_REASONS = [
     "rss_over_limit",
     "pressure_warning",
     "pressure_critical",
+    "swap_pressure",
+    "swap_high_not_node",
+    "scan_timeout_footprint",
+    "scan_timeout_ps",
+    "scan_timeout_top",
+    "scan_timeout_sysctl",
     "orphan_vitest_worker",
 ];
-export const MEMORY_GUARD_EVENTS = ["killed", "kill_failed", "orphan_reaped", "started"];
+export const MEMORY_GUARD_EVENTS = ["killed", "kill_failed", "orphan_reaped", "scan_timeout", "swap_high", "started"];
 const MB = 1024 * 1024;
+/** The swap limit when RAM is unknown (a 16 GB Mac). */
+export const MEMORY_GUARD_DEFAULT_SWAP_LIMIT_MB = 16384;
+/**
+ * Swap in use (MB) past which the guard kills the node process holding a quarter of it: as much as the
+ * machine has RAM, clamped to 4 GB..32 GB. A 16 GB Mac that lives at 11 GB of swap is under it; the 43 GB of
+ * 2026-10-28 is far over.
+ */
+export function resolveSwapLimitMb(totalMemoryBytes) {
+    const totalMb = Math.floor(totalMemoryBytes / MB);
+    return Math.min(32768, Math.max(4096, totalMb));
+}
+export function swapLimitFor(options) {
+    return resolveSwapLimitMb(options.totalMemoryBytes ?? os.totalmem());
+}
 /**
  * hard = min(6144 MB, 40% of RAM); warning tier = min(4096, 25%); critical tier = min(2048, 12.5%).
  * `COCKPIT_MEMORY_GUARD_LIMIT_MB` replaces the hard limit and can only pull the other tiers down with it.
@@ -109,12 +129,14 @@ export function parseMemoryGuardLogLine(raw) {
         cmd_sha256: str("cmd_sha256"),
     };
 }
-/** The last kill (any event but "started") in a log's text, newest wins. */
+/** Events that mean a process was killed (or the kill failed). A scan timeout or a swap warning is not a kill. */
+export const MEMORY_GUARD_KILL_EVENTS = ["killed", "kill_failed", "orphan_reaped"];
+/** The last kill (not "started", a scan timeout or a swap warning) in a log's text, newest wins. */
 export function lastKillIn(logText) {
     let found;
     for (const raw of logText.split("\n")) {
         const line = raw.trim() ? parseMemoryGuardLogLine(raw) : null;
-        if (line && line.event !== "started")
+        if (line && MEMORY_GUARD_KILL_EVENTS.includes(line.event))
             found = { ts: line.ts, kind: line.kind, reason: line.reason, footprint_mb: line.footprint_mb };
     }
     return found;

package/dist/memory-guard-forward.js

@@ -13,7 +13,7 @@ import { MEMORY_GUARD_CURSOR, MEMORY_GUARD_LOG, MEMORY_GUARD_STEP, memoryGuardSt
  */
 const TAG = "[memory-guard-forward]";
 const MAX_LINES_PER_TICK = 40;
-const FORWARDED_EVENTS = new Set(["killed", "kill_failed", "orphan_reaped"]);
+const FORWARDED_EVENTS = new Set(["killed", "kill_failed", "orphan_reaped", "scan_timeout", "swap_high"]);
 function parseCursor(raw) {
     if (!raw)
         return null;

package/dist/memory-guard-script-darwin.js

@@ -1,18 +1,27 @@
-import { MEMORY_GUARD_KIND_PATTERNS, MEMORY_GUARD_LOG_KEEP_LINES, MEMORY_GUARD_LOG_LIMIT_BYTES, MEMORY_GUARD_ORPHAN_MIN_AGE_SECONDS, } from "./memory-guard-contract.js";
+import { MEMORY_GUARD_DEFAULT_SWAP_LIMIT_MB, MEMORY_GUARD_KIND_PATTERNS, MEMORY_GUARD_LOG_KEEP_LINES, MEMORY_GUARD_LOG_LIMIT_BYTES, MEMORY_GUARD_ORPHAN_MIN_AGE_SECONDS, } from "./memory-guard-contract.js";
 import { shellQuote } from "./autostart-darwin-plist.js";
 /**
- * The macOS memory guard (BLI-23571): a bash loop launchd keeps alive.
+ * The macOS memory guard (BLI-23571, fixed by BLI-23628): a bash loop launchd keeps alive.
  *
- * Every 2 s it reads the kernel's memory-pressure level and a cheap `ps` RSS check. Every 10 s (every 2 s
- * under critical pressure) it scans real memory FOOTPRINT with `top -o mem`, because RSS alone misses
- * runaways: swapped and compressed pages leave RSS, and an 800 MB buffer showed 12 MB RSS. The limit
- * tightens with pressure. Every 60 s it reaps vitest workers orphaned by a dead runner (ppid 1, older than
- * 5 minutes). Only a process whose executable is `node` is ever touched; the guard never kills itself.
+ * Every 2 s tick it reads the kernel's memory-pressure level and swap in use, lists the node processes
+ * with `ps`, and judges them by memory FOOTPRINT (what Activity Monitor shows: dirty plus compressed plus
+ * swapped pages), read with `footprint -p` (about 5 ms per process; `ps` RSS alone misses runaways because
+ * swapped and compressed pages leave RSS: 39 MB RSS against 1515 MB footprint, reproduced). Every tick it
+ * reads the node processes that are big (RSS 128 MB or more) or were seen big (footprint 512 MB or more);
+ * every fifth tick (10 s, the old cadence), and every tick under memory pressure or high swap, it reads all of them. The limit
+ * tightens with pressure. When swap in use passes the swap limit and a node process holds a quarter of it,
+ * that process is killed even under the footprint limit. Every external tool runs under a deadline
+ * (`bounded`, 4 s for scans): a stalled `top`, `ps` or `footprint` used to freeze the whole loop, so
+ * nothing after it ran; now it is killed, logged as `scan_timeout`, and the tick moves on. Every 60 s it
+ * reaps vitest workers orphaned by a dead runner (ppid 1, older than 5 minutes). Only a process whose
+ * executable is `node` is ever touched; the guard never kills itself.
  *
  * It logs one JSON line per decision to the state dir: ids, sizes and a sha256 prefix, never a command
  * line (those carry tokens). Test seams, all env: `MEMGUARD_SOURCE_ONLY=1` defines the functions and
  * returns, `MEMGUARD_ONCE=1` runs one tick and exits, `MEMGUARD_NO_NOTIFY=1` skips the notification,
- * `MEMGUARD_ONLY_PID=<pid>` restricts kills to one process so a test cannot shoot its own runner.
+ * `MEMGUARD_ONLY_PID=<pid>` restricts kills to one process so a test cannot shoot its own runner,
+ * `MEMGUARD_SWAP_USED_MB` and `MEMGUARD_PRESSURE_LEVEL` replace the swap and pressure readings, `MEMGUARD_SCAN_TIMEOUT_S` the scan deadline and
+ * `MEMGUARD_FOOTPRINT_BIN` the footprint tool (a test points it at a stalling fake).
  */
 export function renderDarwinMemoryGuardScript(options) {
     const kindChecks = MEMORY_GUARD_KIND_PATTERNS.map(([kind, pattern]) => `  re=${shellQuote(pattern)}; [[ "$1" =~ $re ]] && { echo ${kind}; return; }`);
@@ -23,22 +32,63 @@ export function renderDarwinMemoryGuardScript(options) {
         `LIMIT_MB=${options.limits.hard}`,
         `WARN_LIMIT_MB=${options.limits.warning}`,
         `CRITICAL_LIMIT_MB=${options.limits.critical}`,
+        `SWAP_LIMIT_MB=${options.swapLimitMb ?? MEMORY_GUARD_DEFAULT_SWAP_LIMIT_MB}`,
         `ORPHAN_MIN_AGE_S=${MEMORY_GUARD_ORPHAN_MIN_AGE_SECONDS}`,
         `LOG=${shellQuote(options.logPath)}`,
         `LOG_LIMIT_BYTES=${MEMORY_GUARD_LOG_LIMIT_BYTES}`,
         `LOG_KEEP_LINES=${MEMORY_GUARD_LOG_KEEP_LINES}`,
-        'mkdir -p "$(dirname "$LOG")"',
+        "mkdir -p \"$(dirname \"$LOG\")\"",
+        "SCAN_TIMEOUT_S=\"${MEMGUARD_SCAN_TIMEOUT_S:-4}\"",
+        "FOOTPRINT_BIN=\"${MEMGUARD_FOOTPRINT_BIN:-/usr/bin/footprint}\"",
+        "HOT_RSS_MB=128",
+        "HOT_FOOTPRINT_MB=512",
+        "SWAP_NODE_FLOOR_MB=512",
+        "MAX_SCAN_PIDS=64",
+        "T=\"$(mktemp -d \"${TMPDIR:-/tmp}/memguard.XXXXXX\")\"",
+        "trap 'rm -rf \"$T\"' EXIT",
+        "HOT_PIDS=\"\"",
+        "NODE_ROWS=\"\"",
+        "FP_ROWS=\"\"",
+        "SWAP_USED_MB=0",
+        "KILLED=\" \"",
+        "LAST_TIMEOUT_LOG=-60",
+        "LAST_SWAP_LOG=-600",
+        "tick=0",
         "",
         "now_iso() { date -u +%Y-%m-%dT%H:%M:%SZ; }",
         "",
         "# event pid footprint_mb limit_mb reason kind cmd_sha256. Every value is a number or a fixed token.",
         "log_json() {",
-        `  printf '{"ts":"%s","event":"%s","pid":%s,"footprint_mb":%s,"limit_mb":%s,"reason":"%s","kind":"%s","cmd_sha256":"%s"}\\n' \\`,
-        '    "$(now_iso)" "$1" "$2" "$3" "$4" "$5" "$6" "$7" >> "$LOG"',
+        "  printf '{\"ts\":\"%s\",\"event\":\"%s\",\"pid\":%s,\"footprint_mb\":%s,\"limit_mb\":%s,\"reason\":\"%s\",\"kind\":\"%s\",\"cmd_sha256\":\"%s\"}\\n' \\",
+        "    \"$(now_iso)\" \"$1\" \"$2\" \"$3\" \"$4\" \"$5\" \"$6\" \"$7\" >> \"$LOG\"",
         "}",
         "",
         "notify() { [ \"${MEMGUARD_NO_NOTIFY:-}\" = 1 ] || osascript -e \"display notification \\\"$1\\\" with title \\\"Tower\\\"\" >/dev/null 2>&1 & }",
         "",
+        "# bounded SECONDS OUTFILE COMMAND...: run COMMAND with its stdout in OUTFILE and a hard deadline. A tool that",
+        "# stalls (top, ps and sysctl all can, when a runaway has the machine swapping) is killed, never waited on,",
+        "# and the answer is 124. Without this one stalled call freezes every check after it.",
+        "bounded() {",
+        "  local secs=\"$1\" out=\"$2\" pid n=0 max",
+        "  shift 2",
+        "  max=$((secs * 20))",
+        "  \"$@\" >\"$out\" 2>/dev/null </dev/null &",
+        "  pid=$!",
+        "  while kill -0 \"$pid\" 2>/dev/null; do",
+        "    if [ \"$n\" -ge \"$max\" ]; then kill -9 \"$pid\" 2>/dev/null; return 124; fi",
+        "    sleep 0.05",
+        "    n=$((n + 1))",
+        "  done",
+        "  wait \"$pid\" 2>/dev/null",
+        "}",
+        "",
+        "# A stalled scan is a finding, so it is logged (at most once per 30 s) with the tool that stalled.",
+        "log_timeout() { # tool",
+        "  [ $((SECONDS - LAST_TIMEOUT_LOG)) -ge 30 ] || return 0",
+        "  LAST_TIMEOUT_LOG=$SECONDS",
+        "  log_json scan_timeout 0 0 0 \"scan_timeout_$1\" guard \"\"",
+        "}",
+        "",
         "# The coarse label for a command line. The same table as the Windows guard and the CLI's tests.",
         "classify_kind() {",
         "  local re",
@@ -49,77 +99,178 @@ export function renderDarwinMemoryGuardScript(options) {
         "cmd_sha() { printf '%s' \"$1\" | shasum -a 256 | cut -c1-12; }",
         "",
         "to_mb() { # top MEM like 470M, 69G, 512K, 1024B, with an optional +/- suffix",
-        '  local v="${1%[+-]}" n u',
-        '  n="${v%[BKMGT]}"; u="${v: -1}"',
-        '  case "$u" in B) echo $((n / 1048576)) ;; K) echo $((n / 1024)) ;; M) echo "$n" ;; G) echo $((n * 1024)) ;; T) echo $((n * 1048576)) ;; *) echo 0 ;; esac',
+        "  local v=\"${1%[+-]}\" n u",
+        "  n=\"${v%[BKMGT]}\"; u=\"${v: -1}\"",
+        "  case \"$u\" in B) echo $((n / 1048576)) ;; K) echo $((n / 1024)) ;; M) echo \"$n\" ;; G) echo $((n * 1024)) ;; T) echo $((n * 1048576)) ;; *) echo 0 ;; esac",
         "}",
         "",
         "kill_node() { # pid footprint_mb limit_mb reason",
-        '  local cmd kind sha result',
-        '  [ "$1" = "$$" ] && return',
-        '  [ -n "${MEMGUARD_ONLY_PID:-}" ] && [ "$1" != "$MEMGUARD_ONLY_PID" ] && return',
-        '  cmd="$(ps -o command= -p "$1" 2>/dev/null | cut -c1-2000)"',
-        '  kind="$(classify_kind "$cmd")"; sha="$(cmd_sha "$cmd")"',
+        "  local cmd kind sha result",
+        "  [ \"$1\" = \"$$\" ] && return",
+        "  [ -n \"${MEMGUARD_ONLY_PID:-}\" ] && [ \"$1\" != \"$MEMGUARD_ONLY_PID\" ] && return",
+        "  case \"$KILLED\" in *\" $1 \"*) return ;; esac",
+        "  bounded 2 \"$T/cmd\" ps -o command= -p \"$1\"",
+        "  cmd=\"$(cut -c1-2000 \"$T/cmd\" 2>/dev/null)\"",
+        "  kind=\"$(classify_kind \"$cmd\")\"; sha=\"$(cmd_sha \"$cmd\")\"",
         "  kill -9 \"$1\" 2>/dev/null && result=killed || result=kill_failed",
-        '  log_json "$result" "$1" "$2" "$3" "$4" "$kind" "$sha"',
-        '  if [ "$result" = killed ]; then',
-        '    if [ "$2" -ge 1024 ]; then notify "Tower killed a runaway node process ($(( ($2 + 512) / 1024 )) GB, $kind)"; else notify "Tower killed a runaway node process ($2 MB, $kind)"; fi',
+        "  KILLED=\"$KILLED$1 \"",
+        "  log_json \"$result\" \"$1\" \"$2\" \"$3\" \"$4\" \"$kind\" \"$sha\"",
+        "  if [ \"$result\" = killed ]; then",
+        "    if [ \"$2\" -ge 1024 ]; then notify \"Tower killed a runaway node process ($(( ($2 + 512) / 1024 )) GB, $kind)\"; else notify \"Tower killed a runaway node process ($2 MB, $kind)\"; fi",
         "  fi",
         "}",
         "",
         "# 1 normal, 2 warning, 4 critical",
-        "pressure_level() { sysctl -n kern.memorystatus_vm_pressure_level 2>/dev/null || echo 1; }",
+        "pressure_level() { # MEMGUARD_PRESSURE_LEVEL is the test seam",
+        "  local rc",
+        "  if [ -n \"${MEMGUARD_PRESSURE_LEVEL:-}\" ]; then echo \"$MEMGUARD_PRESSURE_LEVEL\"; return; fi",
+        "  bounded 2 \"$T/level\" sysctl -n kern.memorystatus_vm_pressure_level; rc=$?",
+        "  [ \"$rc\" -eq 124 ] && log_timeout sysctl",
+        "  if [ \"$rc\" -eq 0 ]; then cat \"$T/level\"; else echo 1; fi",
+        "}",
+        "",
+        "# MB of swap in use; 0 when unreadable. MEMGUARD_SWAP_USED_MB is the test seam.",
+        "swap_used_mb() {",
+        "  local rc",
+        "  if [ -n \"${MEMGUARD_SWAP_USED_MB:-}\" ]; then echo \"$MEMGUARD_SWAP_USED_MB\"; return; fi",
+        "  bounded 2 \"$T/swap\" sysctl -n vm.swapusage; rc=$?",
+        "  [ \"$rc\" -eq 124 ] && log_timeout sysctl",
+        "  [ \"$rc\" -eq 0 ] || { echo 0; return; }",
+        "  awk '{for (i = 1; i <= NF; i++) if ($i == \"used\") { v = $(i + 2); u = substr(v, length(v)); n = v + 0; if (u == \"G\") n *= 1024; else if (u == \"K\") n /= 1024; printf \"%d\\n\", n; exit } }' \"$T/swap\"",
+        "}",
+        "",
+        "# Every node process as \"pid rss_mb\". RSS is only the cheap first look; footprint is the judge.",
+        "node_snapshot() {",
+        "  local rc",
+        "  bounded \"$SCAN_TIMEOUT_S\" \"$T/ps\" ps -axo pid=,rss=,comm=; rc=$?",
+        "  if [ \"$rc\" -ne 0 ]; then [ \"$rc\" -eq 124 ] && log_timeout ps; NODE_ROWS=\"\"; return 1; fi",
+        "  NODE_ROWS=\"$(awk '$3 ~ /(^|\\/)node$/ {print $1, int($2/1024)}' \"$T/ps\")\"",
+        "}",
+        "",
+        "# The pids to read footprint for, largest RSS first, at most MAX_SCAN_PIDS: \"all\" takes every node process,",
+        "# \"hot\" only the ones already big (RSS) or seen big on the last full sweep.",
+        "pick_pids() { # mode",
+        "  echo \"$NODE_ROWS\" | awk -v mode=\"$1\" -v hot=\" $HOT_PIDS \" -v min=\"$HOT_RSS_MB\" 'NF == 2 && (mode == \"all\" || $2 >= min || index(hot, \" \" $1 \" \")) {print $2, $1}' |",
+        "    sort -rn | head -n \"$MAX_SCAN_PIDS\" | awk '{printf \"%s \", $2}'",
+        "}",
         "",
-        "footprint_scan() { # limit_mb reason",
-        "  top -l 1 -o mem -n 25 -stats pid,mem,command 2>/dev/null | awk 'NR>1 && $1 ~ /^[0-9]+$/' |",
-        "    while read -r pid mem comm _; do",
-        '      case "$comm" in node) ;; *) continue ;; esac',
-        '      mb="$(to_mb "$mem")"',
-        '      [ "$mb" -gt "$1" ] 2>/dev/null && kill_node "$pid" "$mb" "$1" "$2"',
-        "    done",
+        "# footprint -p reads the kernel's phys_footprint (what Activity Monitor shows: dirty plus compressed plus",
+        "# swapped) in ~5 ms per process. FP_ROWS becomes \"pid mb\". Returns 124 on a stall, 1 when nothing parsed.",
+        "footprint_read() { # \"pid pid ...\"",
+        "  local args=\"\" p rc",
+        "  for p in $1; do args=\"$args -p $p\"; done",
+        "  # shellcheck disable=SC2086",
+        "  bounded \"$SCAN_TIMEOUT_S\" \"$T/fp\" \"$FOOTPRINT_BIN\" --noCategories -f bytes $args; rc=$?",
+        "  FP_ROWS=\"\"",
+        "  if [ \"$rc\" -eq 124 ]; then log_timeout footprint; return 124; fi",
+        "  FP_ROWS=\"$(awk '/Footprint: [0-9]+ B/ && !/^Summary/ { i = index($0, \"[\"); j = index($0, \"]\"); if (i && j > i) { n = split($0, a, \"Footprint: \"); split(a[2], b, \" \"); printf \"%s %d\\n\", substr($0, i + 1, j - i - 1), b[1] / 1048576 } }' \"$T/fp\")\"",
+        "  [ -n \"$FP_ROWS\" ]",
         "}",
         "",
-        "rss_scan() { # limit_mb; the cheap every-tick check on resident memory alone",
-        `  ps -axo pid=,rss=,comm= | awk -v lim="$(($1 * 1024))" '$3 ~ /(^|\\/)node$/ && $2 > lim {print $1, int($2/1024)}' |`,
-        '    while read -r pid mb; do kill_node "$pid" "$mb" "$1" rss_over_limit; done',
+        "# The fallback when footprint is missing or unreadable: top's MEM column, node processes among the 25 biggest.",
+        "top_rows() {",
+        "  local rc pid mem comm",
+        "  bounded \"$SCAN_TIMEOUT_S\" \"$T/top\" top -l 1 -o mem -n 25 -stats pid,mem,command; rc=$?",
+        "  FP_ROWS=\"\"",
+        "  if [ \"$rc\" -eq 124 ]; then log_timeout top; return 124; fi",
+        "  awk 'NR > 1 && $1 ~ /^[0-9]+$/' \"$T/top\" > \"$T/top.rows\"",
+        "  while read -r pid mem comm _; do",
+        "    case \"$comm\" in node) ;; *) continue ;; esac",
+        "    FP_ROWS=\"$FP_ROWS$pid $(to_mb \"$mem\")",
+        "\"",
+        "  done < \"$T/top.rows\"",
         "}",
         "",
+        "# Swap climbing past the limit with a big node process holding a quarter of it is a runaway in progress, even",
+        "# if every single footprint is under the limit (or no footprint could be read). Not node: say so, once per 5 min.",
+        "swap_check() { # biggest_pid biggest_mb",
+        "  local quarter",
+        "  [ \"$SWAP_USED_MB\" -ge \"$SWAP_LIMIT_MB\" ] 2>/dev/null || return 0",
+        "  quarter=$((SWAP_USED_MB / 4)); [ \"$quarter\" -lt \"$SWAP_NODE_FLOOR_MB\" ] && quarter=$SWAP_NODE_FLOOR_MB",
+        "  if [ \"$1\" -gt 0 ] && [ \"$2\" -ge \"$quarter\" ]; then",
+        "    case \"$KILLED\" in *\" $1 \"*) return 0 ;; esac",
+        "    kill_node \"$1\" \"$2\" \"$SWAP_LIMIT_MB\" swap_pressure",
+        "  elif [ $((SECONDS - LAST_SWAP_LOG)) -ge 300 ]; then",
+        "    LAST_SWAP_LOG=$SECONDS",
+        "    log_json swap_high 0 \"$SWAP_USED_MB\" \"$SWAP_LIMIT_MB\" swap_high_not_node guard \"\"",
+        "  fi",
+        "}",
+        "",
+        "# One pass: kill by RSS, then read footprint and kill by footprint, then the swap check.",
+        "guard_scan() { # mode(all|hot) limit_mb reason",
+        "  local pid mb rc pids hot=\"\" biggest=0 biggest_mb=0",
+        "  node_snapshot || return 0",
+        "  while read -r pid mb; do",
+        "    [ -n \"$pid\" ] || continue",
+        "    [ \"$mb\" -gt \"$2\" ] 2>/dev/null && kill_node \"$pid\" \"$mb\" \"$2\" rss_over_limit",
+        "  done <<< \"$NODE_ROWS\"",
+        "  pids=\"$(pick_pids \"$1\")\"",
+        "  if [ -n \"$pids\" ]; then",
+        "    footprint_read \"$pids\"; rc=$?",
+        "    [ \"$rc\" -eq 1 ] && top_rows",
+        "    while read -r pid mb; do",
+        "      [ -n \"$pid\" ] || continue",
+        "      [ \"$mb\" -ge \"$HOT_FOOTPRINT_MB\" ] 2>/dev/null && hot=\"$hot$pid \"",
+        "      [ \"$mb\" -gt \"$biggest_mb\" ] 2>/dev/null && { biggest=$pid; biggest_mb=$mb; }",
+        "      [ \"$mb\" -gt \"$2\" ] 2>/dev/null && kill_node \"$pid\" \"$mb\" \"$2\" \"$3\"",
+        "    done <<< \"$FP_ROWS\"",
+        "    [ \"$1\" = all ] && HOT_PIDS=\"$hot\"",
+        "  fi",
+        "  if [ \"$biggest\" -eq 0 ]; then # no footprint could be read: the biggest RSS is the next best witness for the swap check",
+        "    read -r biggest biggest_mb <<< \"$(echo \"$NODE_ROWS\" | sort -k2 -rn | head -n 1)\"",
+        "    biggest=${biggest:-0}; biggest_mb=${biggest_mb:-0}",
+        "  fi",
+        "  swap_check \"$biggest\" \"$biggest_mb\"",
+        "}",
+        "",
+        "footprint_scan() { guard_scan all \"$1\" \"$2\"; } # limit_mb reason: one full pass over every node process",
+        "",
         "orphan_vitest_scan() { # vitest workers whose runner died (ppid 1) and that outlived the grace period",
-        "  ps -axo pid=,ppid=,etime=,command= | awk '$2 == 1 && $4 ~ /(^|\\/)node$/ && $0 ~ /vitest\\/dist\\/workers\\/forks|vitest\\/dist\\/workers\\/threads|node \\(vitest/ {print $1, $3}' |",
-        "    while read -r pid etime; do",
-        `      secs="$(echo "$etime" | awk -F'[-:]' '{n=NF; s=$n+($(n-1))*60; if(n>=3)s+=$(n-2)*3600; if(n==4)s+=$1*86400; print s}')"`,
-        '      [ "$secs" -ge "$ORPHAN_MIN_AGE_S" ] 2>/dev/null || continue',
-        '      [ -n "${MEMGUARD_ONLY_PID:-}" ] && [ "$pid" != "$MEMGUARD_ONLY_PID" ] && continue',
-        '      cmd="$(ps -o command= -p "$pid" 2>/dev/null | cut -c1-2000)"',
-        '      kill -9 "$pid" 2>/dev/null && log_json orphan_reaped "$pid" 0 0 orphan_vitest_worker "$(classify_kind "$cmd")" "$(cmd_sha "$cmd")"',
-        "    done",
+        "  local pid etime secs cmd rc",
+        "  bounded \"$SCAN_TIMEOUT_S\" \"$T/orphans\" ps -axo pid=,ppid=,etime=,command=; rc=$?",
+        "  if [ \"$rc\" -ne 0 ]; then [ \"$rc\" -eq 124 ] && log_timeout ps; return 0; fi",
+        "  awk '$2 == 1 && $4 ~ /(^|\\/)node$/ && $0 ~ /vitest\\/dist\\/workers\\/forks|vitest\\/dist\\/workers\\/threads|node \\(vitest/ {print $1, $3}' \"$T/orphans\" > \"$T/orphans.rows\"",
+        "  while read -r pid etime; do",
+        "    secs=\"$(echo \"$etime\" | awk -F'[-:]' '{n=NF; s=$n+($(n-1))*60; if(n>=3)s+=$(n-2)*3600; if(n==4)s+=$1*86400; print s}')\"",
+        "    [ \"$secs\" -ge \"$ORPHAN_MIN_AGE_S\" ] 2>/dev/null || continue",
+        "    [ -n \"${MEMGUARD_ONLY_PID:-}\" ] && [ \"$pid\" != \"$MEMGUARD_ONLY_PID\" ] && continue",
+        "    bounded 2 \"$T/cmd\" ps -o command= -p \"$pid\"",
+        "    cmd=\"$(cut -c1-2000 \"$T/cmd\" 2>/dev/null)\"",
+        "    kill -9 \"$pid\" 2>/dev/null && log_json orphan_reaped \"$pid\" 0 0 orphan_vitest_worker \"$(classify_kind \"$cmd\")\" \"$(cmd_sha \"$cmd\")\"",
+        "  done < \"$T/orphans.rows\"",
         "}",
         "",
         "trim_log() { # keep the log small: past the cap, keep the newest lines",
-        '  local size; size="$(wc -c < "$LOG" 2>/dev/null | tr -d \' \')"',
-        '  [ "${size:-0}" -gt "$LOG_LIMIT_BYTES" ] 2>/dev/null || return 0',
-        '  tail -n "$LOG_KEEP_LINES" "$LOG" > "$LOG.tmp" 2>/dev/null && mv "$LOG.tmp" "$LOG"',
+        "  local size; size=\"$(wc -c < \"$LOG\" 2>/dev/null | tr -d ' ')\"",
+        "  [ \"${size:-0}\" -gt \"$LOG_LIMIT_BYTES\" ] 2>/dev/null || return 0",
+        "  tail -n \"$LOG_KEEP_LINES\" \"$LOG\" > \"$LOG.tmp\" 2>/dev/null && mv \"$LOG.tmp\" \"$LOG\"",
+        "}",
+        "",
+        "# One tick. The limit tightens with memory pressure. Every tick judges the node processes that are big or were",
+        "# big; every fifth tick (10 s; every tick under pressure or high swap) it judges all of them.",
+        "guard_tick() {",
+        "  local level limit reason mode",
+        "  level=\"$(pressure_level)\"",
+        "  limit=$LIMIT_MB; reason=footprint_over_limit",
+        "  if [ \"$level\" -ge 4 ] 2>/dev/null; then limit=$CRITICAL_LIMIT_MB; reason=pressure_critical",
+        "  elif [ \"$level\" -ge 2 ] 2>/dev/null; then limit=$WARN_LIMIT_MB; reason=pressure_warning; fi",
+        "  SWAP_USED_MB=\"$(swap_used_mb)\"",
+        "  mode=hot",
+        "  [ $((tick % 5)) -eq 0 ] && mode=all",
+        "  [ \"$level\" -ge 2 ] 2>/dev/null && mode=all",
+        "  [ \"$SWAP_USED_MB\" -ge \"$SWAP_LIMIT_MB\" ] 2>/dev/null && mode=all",
+        "  KILLED=\" \"",
+        "  guard_scan \"$mode\" \"$limit\" \"$reason\"",
         "}",
         "",
-        '[ "${MEMGUARD_SOURCE_ONLY:-}" = 1 ] && return 0 2>/dev/null',
+        "[ \"${MEMGUARD_SOURCE_ONLY:-}\" = 1 ] && return 0 2>/dev/null",
         "",
-        'log_json started "$$" 0 "$LIMIT_MB" started guard ""',
-        "tick=0",
+        "log_json started \"$$\" 0 \"$LIMIT_MB\" started guard \"\"",
         "while :; do",
-        '  level="$(pressure_level)"',
-        '  if [ "$level" -ge 4 ] 2>/dev/null; then',
-        '    rss_scan "$CRITICAL_LIMIT_MB"',
-        '    footprint_scan "$CRITICAL_LIMIT_MB" pressure_critical',
-        '  elif [ "$level" -ge 2 ] 2>/dev/null; then',
-        '    rss_scan "$WARN_LIMIT_MB"',
-        '    [ $((tick % 5)) -eq 0 ] && footprint_scan "$WARN_LIMIT_MB" pressure_warning',
-        "  else",
-        '    rss_scan "$LIMIT_MB"',
-        '    [ $((tick % 5)) -eq 0 ] && footprint_scan "$LIMIT_MB" footprint_over_limit',
-        "  fi",
-        '  [ $((tick % 30)) -eq 0 ] && orphan_vitest_scan',
-        '  [ $((tick % 30)) -eq 15 ] && trim_log',
-        '  [ "${MEMGUARD_ONCE:-}" = 1 ] && exit 0',
+        "  guard_tick",
+        "  [ $((tick % 30)) -eq 0 ] && orphan_vitest_scan",
+        "  [ $((tick % 30)) -eq 15 ] && trim_log",
+        "  [ \"${MEMGUARD_ONCE:-}\" = 1 ] && exit 0",
         "  tick=$((tick + 1))",
         "  sleep 2",
         "done",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.282",
+  "version": "0.2.284",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.88",
-    "@bli-cockpit/mcp": "0.1.171",
+    "@bli-cockpit/mcp": "0.1.173",
     "@bli-cockpit/telemetry-core": "0.1.94",
     "unpdf": "1.8.1"
   },