@bli-cockpit/cli 0.2.283 → 0.2.285

package/dist/autostart-memory-guard.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { fileExists, MEMORY_GUARD_AUTOSTART_LABEL, memoryGuardPlistPathFor, WINDOWS_MEMORY_GUARD_TASK_NAME, } from "./autostart-contract.js";
 import { describeDifference, renderedFileDifference, renderWindowsLauncherScript, UTF8_BOM, windowsPowerShellPath, windowsWScriptPath, } from "./autostart-windows-scripts.js";
 import { xmlEscape, decodeXmlEntities } from "./autostart-xml.js";
-import { lastKillIn, MEMORY_GUARD_DISABLED_MARKER, MEMORY_GUARD_LOG, memoryGuardLimitsFor, memoryGuardStateFile, memoryGuardTurnedOff, memoryGuardTurnedOn, } from "./memory-guard-contract.js";
+import { lastKillIn, MEMORY_GUARD_DISABLED_MARKER, MEMORY_GUARD_LOG, memoryGuardLimitsFor, swapLimitFor, memoryGuardStateFile, memoryGuardTurnedOff, memoryGuardTurnedOn, } from "./memory-guard-contract.js";
 import { renderDarwinMemoryGuardScript } from "./memory-guard-script-darwin.js";
 import { renderWindowsMemoryGuardRegistration, renderWindowsMemoryGuardScript } from "./memory-guard-script-windows.js";
 /**
@@ -70,7 +70,7 @@ function darwinFiles(options) {
     return {
         scriptPath,
         plistPath: memoryGuardPlistPathFor(options.homeDir ?? os.homedir()),
-        script: renderDarwinMemoryGuardScript({ limits: limitsOf(options), logPath: stateFile(options, MEMORY_GUARD_LOG) }),
+        script: renderDarwinMemoryGuardScript({ limits: limitsOf(options), logPath: stateFile(options, MEMORY_GUARD_LOG), swapLimitMb: swapLimitFor(options) }),
         plist: renderMemoryGuardPlist({ scriptPath, stdoutPath: stateFile(options, GUARD_OUT_LOG), stderrPath: stateFile(options, GUARD_ERR_LOG) }),
     };
 }

package/dist/commands/approvals-render.js

@@ -20,7 +20,16 @@ const HOW_WORDS = { tap: "approved by you", edit: "approved by you with an edit"
 function checkWhat(actKind) {
     return `check ${checkWhere(actKind)}, then approve with --checked-sent sent or --checked-sent not-sent`;
 }
+/**
+ * A meeting review card (`notes.review`) that Tower closed because the review moved on reads `rejected` in the database
+ * (the card states have no "withdrawn"), exactly like one the person dismissed. Neither is a "no" to anything, so the
+ * words say it was closed and that the review itself is untouched.
+ */
+const REVIEW_CARD_KIND = "notes.review";
+const REVIEW_CARD_CLOSED = "closed: the review moved on, or you dismissed this card. The review itself is unchanged";
 export function statusWords(card) {
+    if (card.act_kind === REVIEW_CARD_KIND && card.status === "rejected")
+        return REVIEW_CARD_CLOSED;
     if (card.status === "executing" && card.stuck)
         return `stuck sending, it may or may not have gone out: ${checkWhat(card.act_kind)}`;
     if (card.status === "failed" && card.delivery_unknown)
@@ -91,8 +100,10 @@ export function cardDetailLines(card, color) {
     const lines = [`${card.title}  [${statusWords(card)}]`, `Kind: ${card.kind_label}`, `To: ${card.recipient_label}`, `Why: ${card.reason}`, `From: ${sourceLine(card)}`];
     for (const fact of card.facts ?? [])
         lines.push(`${fact.label}: ${fact.value}`);
-    if (card.decided_how)
-        lines.push(`Decision: ${HOW_WORDS[card.decided_how] ?? card.decided_how}`);
+    if (card.decided_how) {
+        const closedReview = card.act_kind === REVIEW_CARD_KIND && card.decided_how === "reject";
+        lines.push(`Decision: ${closedReview ? REVIEW_CARD_CLOSED : (HOW_WORDS[card.decided_how] ?? card.decided_how)}`);
+    }
     if (card.rule)
         lines.push(`Standing rule: ${card.rule.label}`);
     lines.push("", ...contentLines(card));

package/dist/commands/local-help-commands-tower-ops.js

@@ -29,7 +29,7 @@ export const TOWER_OPS_COMMAND_HELP = [
             "  -                   lines on stdin: plain text, `journalctl -o json`, `railway logs --json` or `vercel logs --json`.",
             "  <project>           a BLI project (tower, kolm, portpal, pearl-portal, triage-crm, ...; `--list` names them): the digest Tower's",
             "                      own 15-minute cron STORED from that project's Vercel, Railway and Supabase logs, merged over --since",
-            "                      (default 24h, at most 30d), real bugs first. Needs only this machine's Tower login: no vercel or railway",
+            "                      (default 24h, at most 1095d), real bugs first. Needs only this machine's Tower login: no vercel or railway",
             "                      login. It keeps no raw line, so --raw, --table and --all-levels do not apply.",
             "--stored              dashboard or railway read Tower's stored digest of project `tower` (this also happens by itself, and says so,",
             "                      when the local vercel or railway CLI is missing or logged out).",

package/dist/commands/local-help-notes.js

@@ -42,7 +42,7 @@ export const NOTES_HELP = [
             "bot-upcoming [--json] — your own Google Meet meetings today that the bot will join, with claim state. Decline or mark private to opt out.",
             "granola-status [--limit <n>] [--json] — the Granola cron's own last several runs (ticket 10718): reason, counts, model, spend and which lookback it used. Granola runs on a shared server-side key, not a connected account, so this is its own read rather than `accounts`.",
             "transcription-stats [--month YYYY-MM] [--json] — what meeting transcription cost and did (BLI-18003): minutes, dollars (list and real), requests, failures and fallbacks per provider for the UTC month (default: this one), the spend against the monthly cap and how close the 80% message and the hold are, how many meetings are waiting for budget, which provider keys the deploy holds (by name), and how old the numbers are. Switch providers or move the cap with `cockpit settings switches set transcription.provider|transcription.fallback_chain|transcription.monthly_cap_usd <value>`.",
-            "review [<note-id>] [--submit|--accept-all] [--json] — the meeting reviews waiting for you (BLI-22350). A recorded meeting stays with its attendees until one of them clears one review screen: who's who, lines the raw transcript may have put under the wrong speaker, unclear words, spots where the clean-up may have changed the meaning, sensitive moments. Bare `review` lists yours (waiting, being applied, cleared in the last 7 days). `review <note-id>` shows one in that order with every default answer; --json prints the raw read (raw_hash, items, defaults). `--accept-all` submits every default (names as guessed, lines kept, best-guess readings, the words as said where the meaning may have changed, sensitive moments to attendees only) and prints what it accepted. `--submit` reads { \"raw_hash\": ..., \"answers\": [...] } from stdin: edit the defaults from --json and pipe them in. A refusal says to reload when the review changed (stale_raw_hash, stale_guess) or names what is wrong with the answers. Same door as the web screen (/meeting-notes/<note-id>/review) and the notes_review_* MCP tools.",
+            "review [<note-id>] [--submit|--accept-all] [--json] — the meeting reviews waiting for you (BLI-22350). A recorded meeting stays with its attendees until one of them clears one review screen: who's who, lines the raw transcript may have put under the wrong speaker, unclear words, spots where the clean-up may have changed the meaning, sensitive moments. Bare `review` lists yours (waiting, being applied, cleared in the last 7 days). `review <note-id>` shows one in that order with every default answer; --json prints the raw read (raw_hash, items, defaults, budget_stop_line). When money stopped the clean-up (kept as transcribed because the meeting is over the one-meeting limit, or waiting because the month's safety limit was reached or the budget could not be checked), one plain line under the title says so with the meeting's length and estimated cost. `--accept-all` submits every default (names as guessed, lines kept, best-guess readings, the words as said where the meaning may have changed, sensitive moments to attendees only) and prints what it accepted. `--submit` reads { \"raw_hash\": ..., \"answers\": [...] } from stdin: edit the defaults from --json and pipe them in. A refusal says to reload when the review changed (stale_raw_hash, stale_guess) or names what is wrong with the answers. Same door as the web screen (/meeting-notes/<note-id>/review) and the notes_review_* MCP tools.",
             "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",
             "--json writes one machine-readable object to stdout; every reason, receipt and progress line stays on stderr.",
             "Sharing and moving need a signed-in session the database can see. If this deployment cannot mint one, they are refused as needs_signed_in_session rather than done with no permission check — and reads say when they came back narrower than the browser's.",

package/dist/commands/notes-review.js

@@ -90,6 +90,9 @@ function stretch(label, text) {
 export function renderReview(body, dashboardUrl) {
     const out = [];
     out.push(`${body.note_title ?? "Meeting"}${body.meeting_date ? `, ${body.meeting_date}` : ""}: ${STATE_WORDS[body.state] ?? body.state}.`);
+    // Ticket BLI-23569: the server's own line, printed as it came, so the words stay in one place (the dashboard).
+    if (body.budget_stop_line)
+        out.push(body.budget_stop_line);
     const of = (kind) => body.items.filter((item) => item.kind === kind);
     const speakers = of("speaker");
     if (speakers.length)

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.283");
+    writeLine(io?.stdout ?? process.stdout, "0.2.285");
     return 0;
   }
 

package/dist/memory-guard-contract.js

@@ -26,10 +26,30 @@ export const MEMORY_GUARD_REASONS = [
     "rss_over_limit",
     "pressure_warning",
     "pressure_critical",
+    "swap_pressure",
+    "swap_high_not_node",
+    "scan_timeout_footprint",
+    "scan_timeout_ps",
+    "scan_timeout_top",
+    "scan_timeout_sysctl",
     "orphan_vitest_worker",
 ];
-export const MEMORY_GUARD_EVENTS = ["killed", "kill_failed", "orphan_reaped", "started"];
+export const MEMORY_GUARD_EVENTS = ["killed", "kill_failed", "orphan_reaped", "scan_timeout", "swap_high", "started"];
 const MB = 1024 * 1024;
+/** The swap limit when RAM is unknown (a 16 GB Mac). */
+export const MEMORY_GUARD_DEFAULT_SWAP_LIMIT_MB = 16384;
+/**
+ * Swap in use (MB) past which the guard kills the node process holding a quarter of it: as much as the
+ * machine has RAM, clamped to 4 GB..32 GB. A 16 GB Mac that lives at 11 GB of swap is under it; the 43 GB of
+ * 2026-10-28 is far over.
+ */
+export function resolveSwapLimitMb(totalMemoryBytes) {
+    const totalMb = Math.floor(totalMemoryBytes / MB);
+    return Math.min(32768, Math.max(4096, totalMb));
+}
+export function swapLimitFor(options) {
+    return resolveSwapLimitMb(options.totalMemoryBytes ?? os.totalmem());
+}
 /**
  * hard = min(6144 MB, 40% of RAM); warning tier = min(4096, 25%); critical tier = min(2048, 12.5%).
  * `COCKPIT_MEMORY_GUARD_LIMIT_MB` replaces the hard limit and can only pull the other tiers down with it.
@@ -109,12 +129,14 @@ export function parseMemoryGuardLogLine(raw) {
         cmd_sha256: str("cmd_sha256"),
     };
 }
-/** The last kill (any event but "started") in a log's text, newest wins. */
+/** Events that mean a process was killed (or the kill failed). A scan timeout or a swap warning is not a kill. */
+export const MEMORY_GUARD_KILL_EVENTS = ["killed", "kill_failed", "orphan_reaped"];
+/** The last kill (not "started", a scan timeout or a swap warning) in a log's text, newest wins. */
 export function lastKillIn(logText) {
     let found;
     for (const raw of logText.split("\n")) {
         const line = raw.trim() ? parseMemoryGuardLogLine(raw) : null;
-        if (line && line.event !== "started")
+        if (line && MEMORY_GUARD_KILL_EVENTS.includes(line.event))
             found = { ts: line.ts, kind: line.kind, reason: line.reason, footprint_mb: line.footprint_mb };
     }
     return found;

package/dist/memory-guard-forward.js

@@ -13,7 +13,7 @@ import { MEMORY_GUARD_CURSOR, MEMORY_GUARD_LOG, MEMORY_GUARD_STEP, memoryGuardSt
  */
 const TAG = "[memory-guard-forward]";
 const MAX_LINES_PER_TICK = 40;
-const FORWARDED_EVENTS = new Set(["killed", "kill_failed", "orphan_reaped"]);
+const FORWARDED_EVENTS = new Set(["killed", "kill_failed", "orphan_reaped", "scan_timeout", "swap_high"]);
 function parseCursor(raw) {
     if (!raw)
         return null;

package/dist/memory-guard-script-darwin.js

@@ -1,18 +1,27 @@
-import { MEMORY_GUARD_KIND_PATTERNS, MEMORY_GUARD_LOG_KEEP_LINES, MEMORY_GUARD_LOG_LIMIT_BYTES, MEMORY_GUARD_ORPHAN_MIN_AGE_SECONDS, } from "./memory-guard-contract.js";
+import { MEMORY_GUARD_DEFAULT_SWAP_LIMIT_MB, MEMORY_GUARD_KIND_PATTERNS, MEMORY_GUARD_LOG_KEEP_LINES, MEMORY_GUARD_LOG_LIMIT_BYTES, MEMORY_GUARD_ORPHAN_MIN_AGE_SECONDS, } from "./memory-guard-contract.js";
 import { shellQuote } from "./autostart-darwin-plist.js";
 /**
- * The macOS memory guard (BLI-23571): a bash loop launchd keeps alive.
+ * The macOS memory guard (BLI-23571, fixed by BLI-23628): a bash loop launchd keeps alive.
  *
- * Every 2 s it reads the kernel's memory-pressure level and a cheap `ps` RSS check. Every 10 s (every 2 s
- * under critical pressure) it scans real memory FOOTPRINT with `top -o mem`, because RSS alone misses
- * runaways: swapped and compressed pages leave RSS, and an 800 MB buffer showed 12 MB RSS. The limit
- * tightens with pressure. Every 60 s it reaps vitest workers orphaned by a dead runner (ppid 1, older than
- * 5 minutes). Only a process whose executable is `node` is ever touched; the guard never kills itself.
+ * Every 2 s tick it reads the kernel's memory-pressure level and swap in use, lists the node processes
+ * with `ps`, and judges them by memory FOOTPRINT (what Activity Monitor shows: dirty plus compressed plus
+ * swapped pages), read with `footprint -p` (about 5 ms per process; `ps` RSS alone misses runaways because
+ * swapped and compressed pages leave RSS: 39 MB RSS against 1515 MB footprint, reproduced). Every tick it
+ * reads the node processes that are big (RSS 128 MB or more) or were seen big (footprint 512 MB or more);
+ * every fifth tick (10 s, the old cadence), and every tick under memory pressure or high swap, it reads all of them. The limit
+ * tightens with pressure. When swap in use passes the swap limit and a node process holds a quarter of it,
+ * that process is killed even under the footprint limit. Every external tool runs under a deadline
+ * (`bounded`, 4 s for scans): a stalled `top`, `ps` or `footprint` used to freeze the whole loop, so
+ * nothing after it ran; now it is killed, logged as `scan_timeout`, and the tick moves on. Every 60 s it
+ * reaps vitest workers orphaned by a dead runner (ppid 1, older than 5 minutes). Only a process whose
+ * executable is `node` is ever touched; the guard never kills itself.
  *
  * It logs one JSON line per decision to the state dir: ids, sizes and a sha256 prefix, never a command
  * line (those carry tokens). Test seams, all env: `MEMGUARD_SOURCE_ONLY=1` defines the functions and
  * returns, `MEMGUARD_ONCE=1` runs one tick and exits, `MEMGUARD_NO_NOTIFY=1` skips the notification,
- * `MEMGUARD_ONLY_PID=<pid>` restricts kills to one process so a test cannot shoot its own runner.
+ * `MEMGUARD_ONLY_PID=<pid>` restricts kills to one process so a test cannot shoot its own runner,
+ * `MEMGUARD_SWAP_USED_MB` and `MEMGUARD_PRESSURE_LEVEL` replace the swap and pressure readings, `MEMGUARD_SCAN_TIMEOUT_S` the scan deadline and
+ * `MEMGUARD_FOOTPRINT_BIN` the footprint tool (a test points it at a stalling fake).
  */
 export function renderDarwinMemoryGuardScript(options) {
     const kindChecks = MEMORY_GUARD_KIND_PATTERNS.map(([kind, pattern]) => `  re=${shellQuote(pattern)}; [[ "$1" =~ $re ]] && { echo ${kind}; return; }`);
@@ -23,22 +32,63 @@ export function renderDarwinMemoryGuardScript(options) {
         `LIMIT_MB=${options.limits.hard}`,
         `WARN_LIMIT_MB=${options.limits.warning}`,
         `CRITICAL_LIMIT_MB=${options.limits.critical}`,
+        `SWAP_LIMIT_MB=${options.swapLimitMb ?? MEMORY_GUARD_DEFAULT_SWAP_LIMIT_MB}`,
         `ORPHAN_MIN_AGE_S=${MEMORY_GUARD_ORPHAN_MIN_AGE_SECONDS}`,
         `LOG=${shellQuote(options.logPath)}`,
         `LOG_LIMIT_BYTES=${MEMORY_GUARD_LOG_LIMIT_BYTES}`,
         `LOG_KEEP_LINES=${MEMORY_GUARD_LOG_KEEP_LINES}`,
-        'mkdir -p "$(dirname "$LOG")"',
+        "mkdir -p \"$(dirname \"$LOG\")\"",
+        "SCAN_TIMEOUT_S=\"${MEMGUARD_SCAN_TIMEOUT_S:-4}\"",
+        "FOOTPRINT_BIN=\"${MEMGUARD_FOOTPRINT_BIN:-/usr/bin/footprint}\"",
+        "HOT_RSS_MB=128",
+        "HOT_FOOTPRINT_MB=512",
+        "SWAP_NODE_FLOOR_MB=512",
+        "MAX_SCAN_PIDS=64",
+        "T=\"$(mktemp -d \"${TMPDIR:-/tmp}/memguard.XXXXXX\")\"",
+        "trap 'rm -rf \"$T\"' EXIT",
+        "HOT_PIDS=\"\"",
+        "NODE_ROWS=\"\"",
+        "FP_ROWS=\"\"",
+        "SWAP_USED_MB=0",
+        "KILLED=\" \"",
+        "LAST_TIMEOUT_LOG=-60",
+        "LAST_SWAP_LOG=-600",
+        "tick=0",
         "",
         "now_iso() { date -u +%Y-%m-%dT%H:%M:%SZ; }",
         "",
         "# event pid footprint_mb limit_mb reason kind cmd_sha256. Every value is a number or a fixed token.",
         "log_json() {",
-        `  printf '{"ts":"%s","event":"%s","pid":%s,"footprint_mb":%s,"limit_mb":%s,"reason":"%s","kind":"%s","cmd_sha256":"%s"}\\n' \\`,
-        '    "$(now_iso)" "$1" "$2" "$3" "$4" "$5" "$6" "$7" >> "$LOG"',
+        "  printf '{\"ts\":\"%s\",\"event\":\"%s\",\"pid\":%s,\"footprint_mb\":%s,\"limit_mb\":%s,\"reason\":\"%s\",\"kind\":\"%s\",\"cmd_sha256\":\"%s\"}\\n' \\",
+        "    \"$(now_iso)\" \"$1\" \"$2\" \"$3\" \"$4\" \"$5\" \"$6\" \"$7\" >> \"$LOG\"",
         "}",
         "",
         "notify() { [ \"${MEMGUARD_NO_NOTIFY:-}\" = 1 ] || osascript -e \"display notification \\\"$1\\\" with title \\\"Tower\\\"\" >/dev/null 2>&1 & }",
         "",
+        "# bounded SECONDS OUTFILE COMMAND...: run COMMAND with its stdout in OUTFILE and a hard deadline. A tool that",
+        "# stalls (top, ps and sysctl all can, when a runaway has the machine swapping) is killed, never waited on,",
+        "# and the answer is 124. Without this one stalled call freezes every check after it.",
+        "bounded() {",
+        "  local secs=\"$1\" out=\"$2\" pid n=0 max",
+        "  shift 2",
+        "  max=$((secs * 20))",
+        "  \"$@\" >\"$out\" 2>/dev/null </dev/null &",
+        "  pid=$!",
+        "  while kill -0 \"$pid\" 2>/dev/null; do",
+        "    if [ \"$n\" -ge \"$max\" ]; then kill -9 \"$pid\" 2>/dev/null; return 124; fi",
+        "    sleep 0.05",
+        "    n=$((n + 1))",
+        "  done",
+        "  wait \"$pid\" 2>/dev/null",
+        "}",
+        "",
+        "# A stalled scan is a finding, so it is logged (at most once per 30 s) with the tool that stalled.",
+        "log_timeout() { # tool",
+        "  [ $((SECONDS - LAST_TIMEOUT_LOG)) -ge 30 ] || return 0",
+        "  LAST_TIMEOUT_LOG=$SECONDS",
+        "  log_json scan_timeout 0 0 0 \"scan_timeout_$1\" guard \"\"",
+        "}",
+        "",
         "# The coarse label for a command line. The same table as the Windows guard and the CLI's tests.",
         "classify_kind() {",
         "  local re",
@@ -49,77 +99,178 @@ export function renderDarwinMemoryGuardScript(options) {
         "cmd_sha() { printf '%s' \"$1\" | shasum -a 256 | cut -c1-12; }",
         "",
         "to_mb() { # top MEM like 470M, 69G, 512K, 1024B, with an optional +/- suffix",
-        '  local v="${1%[+-]}" n u',
-        '  n="${v%[BKMGT]}"; u="${v: -1}"',
-        '  case "$u" in B) echo $((n / 1048576)) ;; K) echo $((n / 1024)) ;; M) echo "$n" ;; G) echo $((n * 1024)) ;; T) echo $((n * 1048576)) ;; *) echo 0 ;; esac',
+        "  local v=\"${1%[+-]}\" n u",
+        "  n=\"${v%[BKMGT]}\"; u=\"${v: -1}\"",
+        "  case \"$u\" in B) echo $((n / 1048576)) ;; K) echo $((n / 1024)) ;; M) echo \"$n\" ;; G) echo $((n * 1024)) ;; T) echo $((n * 1048576)) ;; *) echo 0 ;; esac",
         "}",
         "",
         "kill_node() { # pid footprint_mb limit_mb reason",
-        '  local cmd kind sha result',
-        '  [ "$1" = "$$" ] && return',
-        '  [ -n "${MEMGUARD_ONLY_PID:-}" ] && [ "$1" != "$MEMGUARD_ONLY_PID" ] && return',
-        '  cmd="$(ps -o command= -p "$1" 2>/dev/null | cut -c1-2000)"',
-        '  kind="$(classify_kind "$cmd")"; sha="$(cmd_sha "$cmd")"',
+        "  local cmd kind sha result",
+        "  [ \"$1\" = \"$$\" ] && return",
+        "  [ -n \"${MEMGUARD_ONLY_PID:-}\" ] && [ \"$1\" != \"$MEMGUARD_ONLY_PID\" ] && return",
+        "  case \"$KILLED\" in *\" $1 \"*) return ;; esac",
+        "  bounded 2 \"$T/cmd\" ps -o command= -p \"$1\"",
+        "  cmd=\"$(cut -c1-2000 \"$T/cmd\" 2>/dev/null)\"",
+        "  kind=\"$(classify_kind \"$cmd\")\"; sha=\"$(cmd_sha \"$cmd\")\"",
         "  kill -9 \"$1\" 2>/dev/null && result=killed || result=kill_failed",
-        '  log_json "$result" "$1" "$2" "$3" "$4" "$kind" "$sha"',
-        '  if [ "$result" = killed ]; then',
-        '    if [ "$2" -ge 1024 ]; then notify "Tower killed a runaway node process ($(( ($2 + 512) / 1024 )) GB, $kind)"; else notify "Tower killed a runaway node process ($2 MB, $kind)"; fi',
+        "  KILLED=\"$KILLED$1 \"",
+        "  log_json \"$result\" \"$1\" \"$2\" \"$3\" \"$4\" \"$kind\" \"$sha\"",
+        "  if [ \"$result\" = killed ]; then",
+        "    if [ \"$2\" -ge 1024 ]; then notify \"Tower killed a runaway node process ($(( ($2 + 512) / 1024 )) GB, $kind)\"; else notify \"Tower killed a runaway node process ($2 MB, $kind)\"; fi",
         "  fi",
         "}",
         "",
         "# 1 normal, 2 warning, 4 critical",
-        "pressure_level() { sysctl -n kern.memorystatus_vm_pressure_level 2>/dev/null || echo 1; }",
+        "pressure_level() { # MEMGUARD_PRESSURE_LEVEL is the test seam",
+        "  local rc",
+        "  if [ -n \"${MEMGUARD_PRESSURE_LEVEL:-}\" ]; then echo \"$MEMGUARD_PRESSURE_LEVEL\"; return; fi",
+        "  bounded 2 \"$T/level\" sysctl -n kern.memorystatus_vm_pressure_level; rc=$?",
+        "  [ \"$rc\" -eq 124 ] && log_timeout sysctl",
+        "  if [ \"$rc\" -eq 0 ]; then cat \"$T/level\"; else echo 1; fi",
+        "}",
+        "",
+        "# MB of swap in use; 0 when unreadable. MEMGUARD_SWAP_USED_MB is the test seam.",
+        "swap_used_mb() {",
+        "  local rc",
+        "  if [ -n \"${MEMGUARD_SWAP_USED_MB:-}\" ]; then echo \"$MEMGUARD_SWAP_USED_MB\"; return; fi",
+        "  bounded 2 \"$T/swap\" sysctl -n vm.swapusage; rc=$?",
+        "  [ \"$rc\" -eq 124 ] && log_timeout sysctl",
+        "  [ \"$rc\" -eq 0 ] || { echo 0; return; }",
+        "  awk '{for (i = 1; i <= NF; i++) if ($i == \"used\") { v = $(i + 2); u = substr(v, length(v)); n = v + 0; if (u == \"G\") n *= 1024; else if (u == \"K\") n /= 1024; printf \"%d\\n\", n; exit } }' \"$T/swap\"",
+        "}",
+        "",
+        "# Every node process as \"pid rss_mb\". RSS is only the cheap first look; footprint is the judge.",
+        "node_snapshot() {",
+        "  local rc",
+        "  bounded \"$SCAN_TIMEOUT_S\" \"$T/ps\" ps -axo pid=,rss=,comm=; rc=$?",
+        "  if [ \"$rc\" -ne 0 ]; then [ \"$rc\" -eq 124 ] && log_timeout ps; NODE_ROWS=\"\"; return 1; fi",
+        "  NODE_ROWS=\"$(awk '$3 ~ /(^|\\/)node$/ {print $1, int($2/1024)}' \"$T/ps\")\"",
+        "}",
+        "",
+        "# The pids to read footprint for, largest RSS first, at most MAX_SCAN_PIDS: \"all\" takes every node process,",
+        "# \"hot\" only the ones already big (RSS) or seen big on the last full sweep.",
+        "pick_pids() { # mode",
+        "  echo \"$NODE_ROWS\" | awk -v mode=\"$1\" -v hot=\" $HOT_PIDS \" -v min=\"$HOT_RSS_MB\" 'NF == 2 && (mode == \"all\" || $2 >= min || index(hot, \" \" $1 \" \")) {print $2, $1}' |",
+        "    sort -rn | head -n \"$MAX_SCAN_PIDS\" | awk '{printf \"%s \", $2}'",
+        "}",
         "",
-        "footprint_scan() { # limit_mb reason",
-        "  top -l 1 -o mem -n 25 -stats pid,mem,command 2>/dev/null | awk 'NR>1 && $1 ~ /^[0-9]+$/' |",
-        "    while read -r pid mem comm _; do",
-        '      case "$comm" in node) ;; *) continue ;; esac',
-        '      mb="$(to_mb "$mem")"',
-        '      [ "$mb" -gt "$1" ] 2>/dev/null && kill_node "$pid" "$mb" "$1" "$2"',
-        "    done",
+        "# footprint -p reads the kernel's phys_footprint (what Activity Monitor shows: dirty plus compressed plus",
+        "# swapped) in ~5 ms per process. FP_ROWS becomes \"pid mb\". Returns 124 on a stall, 1 when nothing parsed.",
+        "footprint_read() { # \"pid pid ...\"",
+        "  local args=\"\" p rc",
+        "  for p in $1; do args=\"$args -p $p\"; done",
+        "  # shellcheck disable=SC2086",
+        "  bounded \"$SCAN_TIMEOUT_S\" \"$T/fp\" \"$FOOTPRINT_BIN\" --noCategories -f bytes $args; rc=$?",
+        "  FP_ROWS=\"\"",
+        "  if [ \"$rc\" -eq 124 ]; then log_timeout footprint; return 124; fi",
+        "  FP_ROWS=\"$(awk '/Footprint: [0-9]+ B/ && !/^Summary/ { i = index($0, \"[\"); j = index($0, \"]\"); if (i && j > i) { n = split($0, a, \"Footprint: \"); split(a[2], b, \" \"); printf \"%s %d\\n\", substr($0, i + 1, j - i - 1), b[1] / 1048576 } }' \"$T/fp\")\"",
+        "  [ -n \"$FP_ROWS\" ]",
         "}",
         "",
-        "rss_scan() { # limit_mb; the cheap every-tick check on resident memory alone",
-        `  ps -axo pid=,rss=,comm= | awk -v lim="$(($1 * 1024))" '$3 ~ /(^|\\/)node$/ && $2 > lim {print $1, int($2/1024)}' |`,
-        '    while read -r pid mb; do kill_node "$pid" "$mb" "$1" rss_over_limit; done',
+        "# The fallback when footprint is missing or unreadable: top's MEM column, node processes among the 25 biggest.",
+        "top_rows() {",
+        "  local rc pid mem comm",
+        "  bounded \"$SCAN_TIMEOUT_S\" \"$T/top\" top -l 1 -o mem -n 25 -stats pid,mem,command; rc=$?",
+        "  FP_ROWS=\"\"",
+        "  if [ \"$rc\" -eq 124 ]; then log_timeout top; return 124; fi",
+        "  awk 'NR > 1 && $1 ~ /^[0-9]+$/' \"$T/top\" > \"$T/top.rows\"",
+        "  while read -r pid mem comm _; do",
+        "    case \"$comm\" in node) ;; *) continue ;; esac",
+        "    FP_ROWS=\"$FP_ROWS$pid $(to_mb \"$mem\")",
+        "\"",
+        "  done < \"$T/top.rows\"",
         "}",
         "",
+        "# Swap climbing past the limit with a big node process holding a quarter of it is a runaway in progress, even",
+        "# if every single footprint is under the limit (or no footprint could be read). Not node: say so, once per 5 min.",
+        "swap_check() { # biggest_pid biggest_mb",
+        "  local quarter",
+        "  [ \"$SWAP_USED_MB\" -ge \"$SWAP_LIMIT_MB\" ] 2>/dev/null || return 0",
+        "  quarter=$((SWAP_USED_MB / 4)); [ \"$quarter\" -lt \"$SWAP_NODE_FLOOR_MB\" ] && quarter=$SWAP_NODE_FLOOR_MB",
+        "  if [ \"$1\" -gt 0 ] && [ \"$2\" -ge \"$quarter\" ]; then",
+        "    case \"$KILLED\" in *\" $1 \"*) return 0 ;; esac",
+        "    kill_node \"$1\" \"$2\" \"$SWAP_LIMIT_MB\" swap_pressure",
+        "  elif [ $((SECONDS - LAST_SWAP_LOG)) -ge 300 ]; then",
+        "    LAST_SWAP_LOG=$SECONDS",
+        "    log_json swap_high 0 \"$SWAP_USED_MB\" \"$SWAP_LIMIT_MB\" swap_high_not_node guard \"\"",
+        "  fi",
+        "}",
+        "",
+        "# One pass: kill by RSS, then read footprint and kill by footprint, then the swap check.",
+        "guard_scan() { # mode(all|hot) limit_mb reason",
+        "  local pid mb rc pids hot=\"\" biggest=0 biggest_mb=0",
+        "  node_snapshot || return 0",
+        "  while read -r pid mb; do",
+        "    [ -n \"$pid\" ] || continue",
+        "    [ \"$mb\" -gt \"$2\" ] 2>/dev/null && kill_node \"$pid\" \"$mb\" \"$2\" rss_over_limit",
+        "  done <<< \"$NODE_ROWS\"",
+        "  pids=\"$(pick_pids \"$1\")\"",
+        "  if [ -n \"$pids\" ]; then",
+        "    footprint_read \"$pids\"; rc=$?",
+        "    [ \"$rc\" -eq 1 ] && top_rows",
+        "    while read -r pid mb; do",
+        "      [ -n \"$pid\" ] || continue",
+        "      [ \"$mb\" -ge \"$HOT_FOOTPRINT_MB\" ] 2>/dev/null && hot=\"$hot$pid \"",
+        "      [ \"$mb\" -gt \"$biggest_mb\" ] 2>/dev/null && { biggest=$pid; biggest_mb=$mb; }",
+        "      [ \"$mb\" -gt \"$2\" ] 2>/dev/null && kill_node \"$pid\" \"$mb\" \"$2\" \"$3\"",
+        "    done <<< \"$FP_ROWS\"",
+        "    [ \"$1\" = all ] && HOT_PIDS=\"$hot\"",
+        "  fi",
+        "  if [ \"$biggest\" -eq 0 ]; then # no footprint could be read: the biggest RSS is the next best witness for the swap check",
+        "    read -r biggest biggest_mb <<< \"$(echo \"$NODE_ROWS\" | sort -k2 -rn | head -n 1)\"",
+        "    biggest=${biggest:-0}; biggest_mb=${biggest_mb:-0}",
+        "  fi",
+        "  swap_check \"$biggest\" \"$biggest_mb\"",
+        "}",
+        "",
+        "footprint_scan() { guard_scan all \"$1\" \"$2\"; } # limit_mb reason: one full pass over every node process",
+        "",
         "orphan_vitest_scan() { # vitest workers whose runner died (ppid 1) and that outlived the grace period",
-        "  ps -axo pid=,ppid=,etime=,command= | awk '$2 == 1 && $4 ~ /(^|\\/)node$/ && $0 ~ /vitest\\/dist\\/workers\\/forks|vitest\\/dist\\/workers\\/threads|node \\(vitest/ {print $1, $3}' |",
-        "    while read -r pid etime; do",
-        `      secs="$(echo "$etime" | awk -F'[-:]' '{n=NF; s=$n+($(n-1))*60; if(n>=3)s+=$(n-2)*3600; if(n==4)s+=$1*86400; print s}')"`,
-        '      [ "$secs" -ge "$ORPHAN_MIN_AGE_S" ] 2>/dev/null || continue',
-        '      [ -n "${MEMGUARD_ONLY_PID:-}" ] && [ "$pid" != "$MEMGUARD_ONLY_PID" ] && continue',
-        '      cmd="$(ps -o command= -p "$pid" 2>/dev/null | cut -c1-2000)"',
-        '      kill -9 "$pid" 2>/dev/null && log_json orphan_reaped "$pid" 0 0 orphan_vitest_worker "$(classify_kind "$cmd")" "$(cmd_sha "$cmd")"',
-        "    done",
+        "  local pid etime secs cmd rc",
+        "  bounded \"$SCAN_TIMEOUT_S\" \"$T/orphans\" ps -axo pid=,ppid=,etime=,command=; rc=$?",
+        "  if [ \"$rc\" -ne 0 ]; then [ \"$rc\" -eq 124 ] && log_timeout ps; return 0; fi",
+        "  awk '$2 == 1 && $4 ~ /(^|\\/)node$/ && $0 ~ /vitest\\/dist\\/workers\\/forks|vitest\\/dist\\/workers\\/threads|node \\(vitest/ {print $1, $3}' \"$T/orphans\" > \"$T/orphans.rows\"",
+        "  while read -r pid etime; do",
+        "    secs=\"$(echo \"$etime\" | awk -F'[-:]' '{n=NF; s=$n+($(n-1))*60; if(n>=3)s+=$(n-2)*3600; if(n==4)s+=$1*86400; print s}')\"",
+        "    [ \"$secs\" -ge \"$ORPHAN_MIN_AGE_S\" ] 2>/dev/null || continue",
+        "    [ -n \"${MEMGUARD_ONLY_PID:-}\" ] && [ \"$pid\" != \"$MEMGUARD_ONLY_PID\" ] && continue",
+        "    bounded 2 \"$T/cmd\" ps -o command= -p \"$pid\"",
+        "    cmd=\"$(cut -c1-2000 \"$T/cmd\" 2>/dev/null)\"",
+        "    kill -9 \"$pid\" 2>/dev/null && log_json orphan_reaped \"$pid\" 0 0 orphan_vitest_worker \"$(classify_kind \"$cmd\")\" \"$(cmd_sha \"$cmd\")\"",
+        "  done < \"$T/orphans.rows\"",
         "}",
         "",
         "trim_log() { # keep the log small: past the cap, keep the newest lines",
-        '  local size; size="$(wc -c < "$LOG" 2>/dev/null | tr -d \' \')"',
-        '  [ "${size:-0}" -gt "$LOG_LIMIT_BYTES" ] 2>/dev/null || return 0',
-        '  tail -n "$LOG_KEEP_LINES" "$LOG" > "$LOG.tmp" 2>/dev/null && mv "$LOG.tmp" "$LOG"',
+        "  local size; size=\"$(wc -c < \"$LOG\" 2>/dev/null | tr -d ' ')\"",
+        "  [ \"${size:-0}\" -gt \"$LOG_LIMIT_BYTES\" ] 2>/dev/null || return 0",
+        "  tail -n \"$LOG_KEEP_LINES\" \"$LOG\" > \"$LOG.tmp\" 2>/dev/null && mv \"$LOG.tmp\" \"$LOG\"",
+        "}",
+        "",
+        "# One tick. The limit tightens with memory pressure. Every tick judges the node processes that are big or were",
+        "# big; every fifth tick (10 s; every tick under pressure or high swap) it judges all of them.",
+        "guard_tick() {",
+        "  local level limit reason mode",
+        "  level=\"$(pressure_level)\"",
+        "  limit=$LIMIT_MB; reason=footprint_over_limit",
+        "  if [ \"$level\" -ge 4 ] 2>/dev/null; then limit=$CRITICAL_LIMIT_MB; reason=pressure_critical",
+        "  elif [ \"$level\" -ge 2 ] 2>/dev/null; then limit=$WARN_LIMIT_MB; reason=pressure_warning; fi",
+        "  SWAP_USED_MB=\"$(swap_used_mb)\"",
+        "  mode=hot",
+        "  [ $((tick % 5)) -eq 0 ] && mode=all",
+        "  [ \"$level\" -ge 2 ] 2>/dev/null && mode=all",
+        "  [ \"$SWAP_USED_MB\" -ge \"$SWAP_LIMIT_MB\" ] 2>/dev/null && mode=all",
+        "  KILLED=\" \"",
+        "  guard_scan \"$mode\" \"$limit\" \"$reason\"",
         "}",
         "",
-        '[ "${MEMGUARD_SOURCE_ONLY:-}" = 1 ] && return 0 2>/dev/null',
+        "[ \"${MEMGUARD_SOURCE_ONLY:-}\" = 1 ] && return 0 2>/dev/null",
         "",
-        'log_json started "$$" 0 "$LIMIT_MB" started guard ""',
-        "tick=0",
+        "log_json started \"$$\" 0 \"$LIMIT_MB\" started guard \"\"",
         "while :; do",
-        '  level="$(pressure_level)"',
-        '  if [ "$level" -ge 4 ] 2>/dev/null; then',
-        '    rss_scan "$CRITICAL_LIMIT_MB"',
-        '    footprint_scan "$CRITICAL_LIMIT_MB" pressure_critical',
-        '  elif [ "$level" -ge 2 ] 2>/dev/null; then',
-        '    rss_scan "$WARN_LIMIT_MB"',
-        '    [ $((tick % 5)) -eq 0 ] && footprint_scan "$WARN_LIMIT_MB" pressure_warning',
-        "  else",
-        '    rss_scan "$LIMIT_MB"',
-        '    [ $((tick % 5)) -eq 0 ] && footprint_scan "$LIMIT_MB" footprint_over_limit',
-        "  fi",
-        '  [ $((tick % 30)) -eq 0 ] && orphan_vitest_scan',
-        '  [ $((tick % 30)) -eq 15 ] && trim_log',
-        '  [ "${MEMGUARD_ONCE:-}" = 1 ] && exit 0',
+        "  guard_tick",
+        "  [ $((tick % 30)) -eq 0 ] && orphan_vitest_scan",
+        "  [ $((tick % 30)) -eq 15 ] && trim_log",
+        "  [ \"${MEMGUARD_ONCE:-}\" = 1 ] && exit 0",
         "  tick=$((tick + 1))",
         "  sleep 2",
         "done",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.283",
+  "version": "0.2.285",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.88",
-    "@bli-cockpit/mcp": "0.1.172",
+    "@bli-cockpit/mcp": "0.1.173",
     "@bli-cockpit/telemetry-core": "0.1.94",
     "unpdf": "1.8.1"
   },