@glassmkr/crucible 0.1.0

package/src/alerts/rules.ts

@@ -0,0 +1,184 @@
+// Alert rules for the collector are identical to the Forge evaluator.
+// Re-export from a shared definition to avoid duplication.
+// For the collector, we use the same 15 rules but with local thresholds from config.
+
+import type { Snapshot, AlertResult } from "../lib/types.js";
+import type { Config } from "../config.js";
+
+export interface AlertRule {
+  type: string;
+  evaluate(snap: Snapshot, thresholds: Config["thresholds"]): AlertResult[];
+}
+
+export const allRules: AlertRule[] = [
+  // 1. RAM high
+  { type: "ram_high", evaluate(snap, t) {
+    if (!snap.memory?.total_mb) return [];
+    const pct = (snap.memory.used_mb / snap.memory.total_mb) * 100;
+    if (pct < (t.ram_percent ?? 90)) return [];
+    return [{ type: "ram_high", severity: pct >= 95 ? "critical" : "warning",
+      title: `RAM usage at ${pct.toFixed(1)}%`,
+      message: `Using ${snap.memory.used_mb}MB of ${snap.memory.total_mb}MB. ${snap.memory.available_mb}MB available.`,
+      evidence: { used_mb: snap.memory.used_mb, total_mb: snap.memory.total_mb, percent: Math.round(pct * 10) / 10 },
+      recommendation: "Check: ps aux --sort=-rss | head -20" }];
+  }},
+  // 2. Swap active
+  { type: "swap_active", evaluate(snap, t) {
+    if (t.swap_alert === false || !snap.memory || snap.memory.swap_used_mb <= 0) return [];
+    return [{ type: "swap_active", severity: "warning", title: `Swap in use: ${snap.memory.swap_used_mb}MB`,
+      message: "Server is using swap space, indicating memory pressure.",
+      evidence: { swap_used_mb: snap.memory.swap_used_mb },
+      recommendation: "Check: free -h && ps aux --sort=-rss | head -20" }];
+  }},
+  // 3. Disk space high
+  { type: "disk_space_high", evaluate(snap, t) {
+    if (!snap.disks) return [];
+    const threshold = t.disk_percent ?? 85;
+    return snap.disks.filter(d => d.percent_used >= threshold).map(d => ({
+      type: "disk_space_high", severity: d.percent_used >= 95 ? "critical" as const : "warning" as const,
+      title: `Disk ${d.mount} at ${d.percent_used}%`,
+      message: `${d.device}: ${d.used_gb}GB of ${d.total_gb}GB used. ${d.available_gb}GB available.`,
+      evidence: { device: d.device, mount: d.mount, percent_used: d.percent_used },
+      recommendation: "Check: du -sh /* | sort -rh | head -20" }));
+  }},
+  // 4. CPU iowait
+  { type: "cpu_iowait_high", evaluate(snap, t) {
+    if (!snap.cpu || snap.cpu.iowait_percent < (t.iowait_percent ?? 20)) return [];
+    return [{ type: "cpu_iowait_high", severity: "warning", title: `CPU iowait at ${snap.cpu.iowait_percent.toFixed(1)}%`,
+      message: `High I/O wait: CPU spending ${snap.cpu.iowait_percent.toFixed(1)}% waiting for disk.`,
+      evidence: { iowait_percent: snap.cpu.iowait_percent },
+      recommendation: "Check: iotop -oP or iostat -x 1 5" }];
+  }},
+  // 5. OOM kills
+  { type: "oom_kills", evaluate(snap) {
+    if (!snap.os_alerts || snap.os_alerts.oom_kills_recent <= 0) return [];
+    return [{ type: "oom_kills", severity: "critical", title: `${snap.os_alerts.oom_kills_recent} OOM kill(s)`,
+      message: `Kernel OOM killer terminated ${snap.os_alerts.oom_kills_recent} process(es).`,
+      evidence: { oom_kills_recent: snap.os_alerts.oom_kills_recent },
+      recommendation: "Check: dmesg | grep -i 'out of memory'" }];
+  }},
+  // 6. SMART failing
+  { type: "smart_failing", evaluate(snap) {
+    if (!snap.smart) return [];
+    return snap.smart.filter(d => d.health !== "PASSED" || (d.reallocated_sectors && d.reallocated_sectors > 0) || (d.pending_sectors && d.pending_sectors > 0))
+      .map(d => ({ type: "smart_failing", severity: "critical" as const,
+        title: `SMART failure: ${d.device}`, message: `${d.model}: drive showing signs of failure.`,
+        evidence: { device: d.device, health: d.health, reallocated_sectors: d.reallocated_sectors, pending_sectors: d.pending_sectors },
+        recommendation: `Back up data. Schedule replacement for ${d.device}.` }));
+  }},
+  // 7. NVMe wear
+  { type: "nvme_wear_high", evaluate(snap, t) {
+    if (!snap.smart) return [];
+    const threshold = t.nvme_wear_percent ?? 85;
+    return snap.smart.filter(d => d.percentage_used != null && d.percentage_used >= threshold)
+      .map(d => ({ type: "nvme_wear_high", severity: d.percentage_used! >= 95 ? "critical" as const : "warning" as const,
+        title: `NVMe ${d.device} wear at ${d.percentage_used}%`, message: `${d.model} at ${d.percentage_used}% lifetime wear.`,
+        evidence: { device: d.device, percentage_used: d.percentage_used },
+        recommendation: "Plan drive replacement." }));
+  }},
+  // 8. RAID degraded
+  { type: "raid_degraded", evaluate(snap) {
+    if (!snap.raid) return [];
+    return snap.raid.filter(r => r.degraded || r.failed_disks.length > 0)
+      .map(r => ({ type: "raid_degraded", severity: "critical" as const,
+        title: `RAID ${r.device} degraded`, message: `${r.device} (${r.level}) degraded. Failed: ${r.failed_disks.join(", ") || "unknown"}.`,
+        evidence: { device: r.device, failed_disks: r.failed_disks },
+        recommendation: "Replace failed drive immediately." }));
+  }},
+  // 9. Disk latency
+  { type: "disk_latency_high", evaluate(snap, t) {
+    if (!snap.disks) return [];
+    return snap.disks.filter(d => {
+      if (d.latency_p99_ms == null) return false;
+      const thresh = d.device.includes("nvme") ? (t.disk_latency_nvme_ms ?? 50) : (t.disk_latency_hdd_ms ?? 200);
+      return d.latency_p99_ms >= thresh;
+    }).map(d => ({ type: "disk_latency_high", severity: "warning" as const,
+      title: `Disk ${d.device} latency ${d.latency_p99_ms!.toFixed(1)}ms`,
+      message: `p99 I/O latency on ${d.device} is high.`,
+      evidence: { device: d.device, latency_p99_ms: d.latency_p99_ms },
+      recommendation: "Check: iotop -oP" }));
+  }},
+  // 10. Interface errors
+  { type: "interface_errors", evaluate(snap) {
+    if (!snap.network) return [];
+    return snap.network.filter(i => (i.rx_errors + i.tx_errors + i.rx_drops + i.tx_drops) > 0)
+      .map(i => ({ type: "interface_errors", severity: "warning" as const,
+        title: `${i.interface}: errors/drops detected`,
+        message: `RX errors=${i.rx_errors}, TX errors=${i.tx_errors}, RX drops=${i.rx_drops}, TX drops=${i.tx_drops}.`,
+        evidence: { interface: i.interface, rx_errors: i.rx_errors, tx_errors: i.tx_errors, rx_drops: i.rx_drops, tx_drops: i.tx_drops },
+        recommendation: "Check cables and SFP/transceiver." }));
+  }},
+  // 11. Link speed mismatch
+  { type: "link_speed_mismatch", evaluate(snap) {
+    if (!snap.network) return [];
+    return snap.network.filter(i => i.speed_mbps > 0 && i.speed_mbps < 1000)
+      .map(i => ({ type: "link_speed_mismatch", severity: "warning" as const,
+        title: `${i.interface} at ${i.speed_mbps} Mbps`,
+        message: `Interface negotiated below 1 Gbps.`,
+        evidence: { interface: i.interface, speed_mbps: i.speed_mbps },
+        recommendation: "Check cable, SFP, switch port config." }));
+  }},
+  // 12. Interface saturation
+  { type: "interface_saturation", evaluate(snap, t) {
+    if (!snap.network) return [];
+    const threshold = (t.interface_utilization_percent ?? 90) / 100;
+    return snap.network.filter(i => {
+      if (!i.speed_mbps) return false;
+      const maxBps = (i.speed_mbps * 1_000_000) / 8;
+      return Math.max(i.rx_bytes_sec, i.tx_bytes_sec) / maxBps >= threshold;
+    }).map(i => {
+      const maxBps = (i.speed_mbps * 1_000_000) / 8;
+      const util = Math.max(i.rx_bytes_sec, i.tx_bytes_sec) / maxBps * 100;
+      return { type: "interface_saturation", severity: "warning" as const,
+        title: `${i.interface} at ${util.toFixed(0)}% utilization`,
+        message: `Interface ${i.interface} (${i.speed_mbps} Mbps) near saturation.`,
+        evidence: { interface: i.interface, utilization_percent: Math.round(util * 10) / 10 },
+        recommendation: "Check: iftop or nload" };
+    });
+  }},
+  // 13. CPU temperature
+  { type: "cpu_temperature_high", evaluate(snap, t) {
+    if (!snap.ipmi?.available || !snap.ipmi.sensors) return [];
+    const warn = t.cpu_temp_warning_c ?? 80;
+    return snap.ipmi.sensors.filter(s => {
+      const n = s.name.toLowerCase();
+      if (!n.includes("cpu") && !n.includes("temp")) return false;
+      const v = typeof s.value === "number" ? s.value : parseFloat(String(s.value));
+      return !isNaN(v) && v >= warn;
+    }).map(s => {
+      const v = typeof s.value === "number" ? s.value : parseFloat(String(s.value));
+      const crit = s.upper_critical ?? (t.cpu_temp_critical_c ?? 90);
+      return { type: "cpu_temperature_high", severity: v >= crit ? "critical" as const : "warning" as const,
+        title: `${s.name}: ${v}${s.unit}`, message: `Temperature above warning threshold.`,
+        evidence: { sensor: s.name, value: v },
+        recommendation: "Check cooling, fans, airflow." };
+    });
+  }},
+  // 14. ECC errors
+  { type: "ecc_errors", evaluate(snap) {
+    if (!snap.ipmi?.ecc_errors) return [];
+    const { correctable, uncorrectable } = snap.ipmi.ecc_errors;
+    if (correctable <= 0 && uncorrectable <= 0) return [];
+    if (uncorrectable > 0) return [{ type: "ecc_errors", severity: "critical",
+      title: `${uncorrectable} uncorrectable ECC error(s)`, message: "Data corruption possible. DIMM failing.",
+      evidence: { correctable, uncorrectable },
+      recommendation: "Replace DIMM immediately. Run: ipmitool sdr type Memory" }];
+    return [{ type: "ecc_errors", severity: "warning",
+      title: `${correctable} correctable ECC error(s)`, message: "Early warning of DIMM failure.",
+      evidence: { correctable, uncorrectable },
+      recommendation: "Schedule DIMM replacement. Run: ipmitool sdr type Memory" }];
+  }},
+  // 15. PSU redundancy
+  { type: "psu_redundancy_loss", evaluate(snap) {
+    if (!snap.ipmi?.available || !snap.ipmi.sensors) return [];
+    const psus = snap.ipmi.sensors.filter(s => { const n = s.name.toLowerCase(); return n.includes("psu") || n.includes("power supply"); });
+    if (psus.length < 2) return [];
+    const failed = psus.filter(s => { const st = String(s.status).toLowerCase(); const v = String(s.value).toLowerCase();
+      return st.includes("fail") || st.includes("absent") || v.includes("fail") || v.includes("absent"); });
+    if (failed.length === 0) return [];
+    return [{ type: "psu_redundancy_loss", severity: "critical",
+      title: "PSU redundancy lost", message: `${failed.length} PSU(s) failed/absent: ${failed.map(p => p.name).join(", ")}.`,
+      evidence: { failed: failed.map(p => ({ name: p.name, status: p.status })) },
+      recommendation: "Replace failed PSU. Check power connections." }];
+  }},
+];

package/src/alerts/state.ts

@@ -0,0 +1,92 @@
+import { readFileSync, writeFileSync, mkdirSync } from "fs";
+import type { AlertResult } from "../lib/types.js";
+
+const STATE_FILE = "/var/lib/glassmkr/alert-state.json";
+
+interface AlertState {
+  type: string;
+  first_seen: string;
+  last_seen: string;
+  notified: boolean;
+}
+
+let state: Map<string, AlertState> = new Map();
+
+function load() {
+  try {
+    const raw = readFileSync(STATE_FILE, "utf-8");
+    const data: Record<string, AlertState> = JSON.parse(raw);
+    state = new Map(Object.entries(data));
+  } catch {
+    state = new Map();
+  }
+}
+
+function save() {
+  try {
+    mkdirSync("/var/lib/glassmkr", { recursive: true });
+    const obj: Record<string, AlertState> = {};
+    for (const [k, v] of state) obj[k] = v;
+    writeFileSync(STATE_FILE, JSON.stringify(obj, null, 2));
+  } catch (err) {
+    console.error("[state] Failed to save alert state:", err);
+  }
+}
+
+// Initialize on import
+load();
+
+export function updateAlertState(currentAlerts: AlertResult[]): {
+  newAlerts: AlertResult[];
+  resolvedAlerts: AlertResult[];
+} {
+  const now = new Date().toISOString();
+  const currentTypes = new Set(currentAlerts.map((a) => a.type));
+  const newAlerts: AlertResult[] = [];
+  const resolvedAlerts: AlertResult[] = [];
+
+  // Check for new alerts
+  for (const alert of currentAlerts) {
+    const existing = state.get(alert.type);
+    if (!existing) {
+      // New alert
+      state.set(alert.type, { type: alert.type, first_seen: now, last_seen: now, notified: false });
+      newAlerts.push(alert);
+    } else {
+      // Existing alert, update last_seen
+      existing.last_seen = now;
+    }
+  }
+
+  // Check for resolved alerts
+  for (const [type, alertState] of state) {
+    if (!currentTypes.has(type)) {
+      resolvedAlerts.push({
+        type,
+        severity: "warning",
+        title: `Resolved: ${type}`,
+        message: `Condition cleared. Active for ${timeSince(alertState.first_seen)}.`,
+        evidence: {},
+        recommendation: "",
+      });
+      state.delete(type);
+    }
+  }
+
+  save();
+  return { newAlerts, resolvedAlerts };
+}
+
+function timeSince(isoDate: string): string {
+  const ms = Date.now() - new Date(isoDate).getTime();
+  const minutes = Math.floor(ms / 60000);
+  if (minutes < 60) return `${minutes} minute(s)`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours} hour(s) ${minutes % 60} minute(s)`;
+  const days = Math.floor(hours / 24);
+  return `${days} day(s)`;
+}
+
+export function getActiveAlerts(): string[] {
+  return Array.from(state.keys());
+}

package/src/collect/cpu.ts

@@ -0,0 +1,44 @@
+import { readProcFile, sleep } from "../lib/parse.js";
+import type { CpuInfo } from "../lib/types.js";
+
+interface CpuStat {
+  user: number; nice: number; system: number; idle: number;
+  iowait: number; irq: number; softirq: number; steal: number;
+}
+
+function parseProcStat(): CpuStat {
+  const raw = readProcFile("/proc/stat") || "";
+  const line = raw.split("\n").find((l) => l.startsWith("cpu "));
+  if (!line) return { user: 0, nice: 0, system: 0, idle: 0, iowait: 0, irq: 0, softirq: 0, steal: 0 };
+  const parts = line.split(/\s+/).slice(1).map(Number);
+  return {
+    user: parts[0] || 0, nice: parts[1] || 0, system: parts[2] || 0, idle: parts[3] || 0,
+    iowait: parts[4] || 0, irq: parts[5] || 0, softirq: parts[6] || 0, steal: parts[7] || 0,
+  };
+}
+
+export async function collectCpu(): Promise<CpuInfo> {
+  const stat1 = parseProcStat();
+  await sleep(1000);
+  const stat2 = parseProcStat();
+
+  const d = {
+    user: stat2.user - stat1.user, nice: stat2.nice - stat1.nice,
+    system: stat2.system - stat1.system, idle: stat2.idle - stat1.idle,
+    iowait: stat2.iowait - stat1.iowait, irq: stat2.irq - stat1.irq,
+    softirq: stat2.softirq - stat1.softirq, steal: stat2.steal - stat1.steal,
+  };
+  const total = Object.values(d).reduce((a, b) => a + b, 0) || 1;
+
+  const loadavg = (readProcFile("/proc/loadavg") || "0 0 0").trim().split(" ");
+
+  return {
+    user_percent: Math.round((d.user / total) * 10000) / 100,
+    system_percent: Math.round((d.system / total) * 10000) / 100,
+    iowait_percent: Math.round((d.iowait / total) * 10000) / 100,
+    idle_percent: Math.round((d.idle / total) * 10000) / 100,
+    load_1m: parseFloat(loadavg[0]) || 0,
+    load_5m: parseFloat(loadavg[1]) || 0,
+    load_15m: parseFloat(loadavg[2]) || 0,
+  };
+}

package/src/collect/disks.ts

@@ -0,0 +1,36 @@
+import { run } from "../lib/exec.js";
+import type { DiskInfo } from "../lib/types.js";
+
+export async function collectDisks(): Promise<DiskInfo[]> {
+  const dfOutput = await run("df", ["-B1", "--output=source,target,size,used,avail,pcent", "-x", "tmpfs", "-x", "devtmpfs", "-x", "squashfs"]);
+  if (!dfOutput) return [];
+
+  const lines = dfOutput.trim().split("\n").slice(1); // skip header
+  const disks: DiskInfo[] = [];
+
+  for (const line of lines) {
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 6) continue;
+    const device = parts[0];
+    const mount = parts[1];
+    const totalBytes = parseInt(parts[2]) || 0;
+    const usedBytes = parseInt(parts[3]) || 0;
+    const availBytes = parseInt(parts[4]) || 0;
+    const pctStr = parts[5].replace("%", "");
+    const percent = parseInt(pctStr) || 0;
+
+    // Skip pseudo-filesystems
+    if (!device.startsWith("/dev/")) continue;
+
+    disks.push({
+      device,
+      mount,
+      total_gb: Math.round((totalBytes / 1073741824) * 100) / 100,
+      used_gb: Math.round((usedBytes / 1073741824) * 100) / 100,
+      available_gb: Math.round((availBytes / 1073741824) * 100) / 100,
+      percent_used: percent,
+    });
+  }
+
+  return disks;
+}

package/src/collect/ipmi.ts

@@ -0,0 +1,60 @@
+import { run } from "../lib/exec.js";
+import type { IpmiInfo } from "../lib/types.js";
+
+export async function collectIpmi(): Promise<IpmiInfo> {
+  const sensorRaw = await run("ipmitool", ["sensor"]);
+  if (!sensorRaw) {
+    return { available: false, sensors: [], ecc_errors: { correctable: 0, uncorrectable: 0 }, sel_entries_count: 0 };
+  }
+
+  // Parse sensor readings
+  const sensors: IpmiInfo["sensors"] = [];
+  for (const line of sensorRaw.split("\n")) {
+    const parts = line.split("|").map((s) => s.trim());
+    if (parts.length < 4) continue;
+    const name = parts[0];
+    const rawValue = parts[1];
+    const unit = parts[2];
+    const status = parts[3];
+
+    const numValue = parseFloat(rawValue);
+    const value: number | string = isNaN(numValue) ? rawValue : numValue;
+
+    // Parse upper critical threshold
+    let upperCritical: number | undefined;
+    if (parts[8]) {
+      const uc = parseFloat(parts[8]);
+      if (!isNaN(uc)) upperCritical = uc;
+    }
+
+    sensors.push({ name, value, unit, status, upper_critical: upperCritical });
+  }
+
+  // ECC errors from memory-type sensors
+  let correctable = 0;
+  let uncorrectable = 0;
+  for (const sensor of sensors) {
+    const name = sensor.name.toLowerCase();
+    if (name.includes("correctable") && typeof sensor.value === "number") {
+      correctable += sensor.value;
+    }
+    if (name.includes("uncorrectable") && typeof sensor.value === "number") {
+      uncorrectable += sensor.value;
+    }
+  }
+
+  // SEL entry count
+  let selCount = 0;
+  const selInfo = await run("ipmitool", ["sel", "info"]);
+  if (selInfo) {
+    const match = selInfo.match(/Entries\s*:\s*(\d+)/i);
+    if (match) selCount = parseInt(match[1], 10);
+  }
+
+  return {
+    available: true,
+    sensors,
+    ecc_errors: { correctable, uncorrectable },
+    sel_entries_count: selCount,
+  };
+}

package/src/collect/memory.ts

@@ -0,0 +1,30 @@
+import { readProcFile, parseKb } from "../lib/parse.js";
+import type { MemoryInfo } from "../lib/types.js";
+
+export async function collectMemory(): Promise<MemoryInfo> {
+  const raw = readProcFile("/proc/meminfo") || "";
+  const kv: Record<string, string> = {};
+  for (const line of raw.split("\n")) {
+    const match = line.match(/^(\w+):\s+(.+)/);
+    if (match) kv[match[1]] = match[2];
+  }
+
+  const totalKb = parseKb(kv["MemTotal"]);
+  const availableKb = parseKb(kv["MemAvailable"]);
+  const swapTotalKb = parseKb(kv["SwapTotal"]);
+  const swapFreeKb = parseKb(kv["SwapFree"]);
+
+  const totalMb = Math.round(totalKb / 1024);
+  const availableMb = Math.round(availableKb / 1024);
+  const usedMb = totalMb - availableMb;
+  const swapTotalMb = Math.round(swapTotalKb / 1024);
+  const swapUsedMb = Math.round((swapTotalKb - swapFreeKb) / 1024);
+
+  return {
+    total_mb: totalMb,
+    used_mb: usedMb,
+    available_mb: availableMb,
+    swap_total_mb: swapTotalMb,
+    swap_used_mb: swapUsedMb,
+  };
+}

package/src/collect/network.ts

@@ -0,0 +1,61 @@
+import { readProcFile, sleep } from "../lib/parse.js";
+import { readFileSync } from "fs";
+import type { NetworkInfo } from "../lib/types.js";
+
+interface IfaceStats {
+  rx_bytes: number; rx_packets: number; rx_errors: number; rx_drops: number;
+  tx_bytes: number; tx_packets: number; tx_errors: number; tx_drops: number;
+}
+
+function parseNetDev(): Record<string, IfaceStats> {
+  const raw = readProcFile("/proc/net/dev") || "";
+  const result: Record<string, IfaceStats> = {};
+  for (const line of raw.split("\n").slice(2)) {
+    const match = line.match(/^\s*(\S+):\s+(.*)/);
+    if (!match) continue;
+    const name = match[1];
+    // Skip virtual interfaces
+    if (name === "lo" || name.startsWith("veth") || name.startsWith("docker") || name.startsWith("br-") || name.startsWith("virbr")) continue;
+    const parts = match[2].trim().split(/\s+/).map(Number);
+    result[name] = {
+      rx_bytes: parts[0] || 0, rx_packets: parts[1] || 0, rx_errors: parts[2] || 0, rx_drops: parts[3] || 0,
+      tx_bytes: parts[8] || 0, tx_packets: parts[9] || 0, tx_errors: parts[10] || 0, tx_drops: parts[11] || 0,
+    };
+  }
+  return result;
+}
+
+function getSpeed(iface: string): number {
+  try {
+    const speed = readFileSync(`/sys/class/net/${iface}/speed`, "utf-8").trim();
+    const val = parseInt(speed, 10);
+    return isNaN(val) || val <= 0 ? 0 : val;
+  } catch {
+    return 0;
+  }
+}
+
+export async function collectNetwork(): Promise<NetworkInfo[]> {
+  const stats1 = parseNetDev();
+  await sleep(1000);
+  const stats2 = parseNetDev();
+
+  const results: NetworkInfo[] = [];
+  for (const [name, s2] of Object.entries(stats2)) {
+    const s1 = stats1[name];
+    if (!s1) continue;
+
+    results.push({
+      interface: name,
+      speed_mbps: getSpeed(name),
+      rx_bytes_sec: s2.rx_bytes - s1.rx_bytes,
+      tx_bytes_sec: s2.tx_bytes - s1.tx_bytes,
+      rx_errors: s2.rx_errors,
+      tx_errors: s2.tx_errors,
+      rx_drops: s2.rx_drops,
+      tx_drops: s2.tx_drops,
+    });
+  }
+
+  return results;
+}

package/src/collect/os-alerts.ts

@@ -0,0 +1,43 @@
+import { run } from "../lib/exec.js";
+import { readProcFile } from "../lib/parse.js";
+import { readdirSync, readFileSync } from "fs";
+import type { OsAlerts } from "../lib/types.js";
+
+export async function collectOsAlerts(): Promise<OsAlerts> {
+  // OOM kills
+  let oomKills = 0;
+  const dmesg = await run("dmesg", ["--level=err,crit", "--since", "5 min ago"]);
+  if (dmesg) {
+    oomKills = (dmesg.match(/Out of memory/gi) || []).length;
+  }
+
+  // Zombie processes
+  let zombies = 0;
+  try {
+    const pids = readdirSync("/proc").filter((f) => /^\d+$/.test(f));
+    for (const pid of pids) {
+      try {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf-8");
+        // Field 3 is the state character
+        const state = stat.split(" ")[2];
+        if (state === "Z") zombies++;
+      } catch { /* process disappeared */ }
+    }
+  } catch { /* /proc not readable */ }
+
+  // Time drift (simple: check if chrony/ntp reports drift)
+  let timeDriftMs = 0;
+  const chrony = await run("chronyc", ["tracking"]);
+  if (chrony) {
+    const match = chrony.match(/System time\s*:\s*([\d.]+)\s*seconds\s*(slow|fast)/);
+    if (match) {
+      timeDriftMs = parseFloat(match[1]) * 1000;
+    }
+  }
+
+  return {
+    oom_kills_recent: oomKills,
+    zombie_processes: zombies,
+    time_drift_ms: Math.round(timeDriftMs * 100) / 100,
+  };
+}

package/src/collect/raid.ts

@@ -0,0 +1,40 @@
+import { readProcFile } from "../lib/parse.js";
+import type { RaidInfo } from "../lib/types.js";
+
+export async function collectRaid(): Promise<RaidInfo[]> {
+  const raw = readProcFile("/proc/mdstat");
+  if (!raw) return [];
+
+  const results: RaidInfo[] = [];
+  const lines = raw.split("\n");
+
+  for (let i = 0; i < lines.length; i++) {
+    const match = lines[i].match(/^(md\d+)\s*:\s*(\w+)\s+(\w+)\s+(.*)/);
+    if (!match) continue;
+
+    const device = match[1];
+    const status = match[2]; // "active" or "inactive"
+    const level = match[3]; // "raid1", "raid5", etc.
+    const disksPart = match[4];
+
+    // Parse component disks (e.g., "sda1[0] sdb1[1]")
+    const disks = (disksPart.match(/\w+\[\d+\]/g) || []).map((d) => d.replace(/\[\d+\]/, ""));
+
+    // Check next line for degraded status (e.g., "[UU_]" means one drive missing)
+    const statusLine = lines[i + 1] || "";
+    const bracketMatch = statusLine.match(/\[([U_]+)\]/);
+    const degraded = bracketMatch ? bracketMatch[1].includes("_") : false;
+
+    const failedDisks: string[] = [];
+    if (degraded && bracketMatch) {
+      const pattern = bracketMatch[1];
+      pattern.split("").forEach((c, idx) => {
+        if (c === "_" && disks[idx]) failedDisks.push(disks[idx]);
+      });
+    }
+
+    results.push({ device, level, status, degraded, disks, failed_disks: failedDisks });
+  }
+
+  return results;
+}

package/src/collect/smart.ts

@@ -0,0 +1,60 @@
+import { run } from "../lib/exec.js";
+import { readdirSync } from "fs";
+import type { SmartInfo } from "../lib/types.js";
+
+export async function collectSmart(): Promise<SmartInfo[]> {
+  // Find block devices
+  const devices: string[] = [];
+  try {
+    const entries = readdirSync("/sys/block");
+    for (const entry of entries) {
+      if (entry.startsWith("sd") || entry.startsWith("nvme") || entry.startsWith("hd")) {
+        devices.push(`/dev/${entry}`);
+      }
+    }
+  } catch {
+    return [];
+  }
+
+  const results: SmartInfo[] = [];
+  for (const device of devices) {
+    const output = await run("smartctl", ["--json", "--all", device]);
+    if (!output) continue;
+
+    try {
+      const data = JSON.parse(output);
+      const info: SmartInfo = {
+        device,
+        model: data.model_name || data.model_family || "unknown",
+        health: data.smart_status?.passed ? "PASSED" : "FAILED",
+        temperature_c: data.temperature?.current,
+        power_on_hours: data.power_on_time?.hours,
+      };
+
+      // NVMe specific
+      if (data.nvme_smart_health_information_log) {
+        const nvme = data.nvme_smart_health_information_log;
+        info.percentage_used = nvme.percentage_used;
+        info.temperature_c = nvme.temperature;
+      }
+
+      // SATA specific
+      if (data.ata_smart_attributes?.table) {
+        for (const attr of data.ata_smart_attributes.table) {
+          if (attr.id === 5 || attr.name === "Reallocated_Sector_Ct") {
+            info.reallocated_sectors = attr.raw?.value || 0;
+          }
+          if (attr.id === 197 || attr.name === "Current_Pending_Sector") {
+            info.pending_sectors = attr.raw?.value || 0;
+          }
+        }
+      }
+
+      results.push(info);
+    } catch {
+      // Failed to parse, skip this device
+    }
+  }
+
+  return results;
+}

package/src/collect/system.ts

@@ -0,0 +1,21 @@
+import { hostname } from "os";
+import { readProcFile } from "../lib/parse.js";
+import { run } from "../lib/exec.js";
+import type { SystemInfo } from "../lib/types.js";
+
+export async function collectSystem(): Promise<SystemInfo> {
+  const osRelease = readProcFile("/etc/os-release") || "";
+  const osName = osRelease.match(/PRETTY_NAME="(.+?)"/)?.[1] || "Unknown";
+  const kernel = (await run("uname", ["-r"]))?.trim() || "unknown";
+  const uptimeRaw = readProcFile("/proc/uptime") || "0";
+  const uptimeSeconds = Math.floor(parseFloat(uptimeRaw.split(" ")[0]));
+  const ip = (await run("hostname", ["-I"]))?.trim().split(" ")[0] || "unknown";
+
+  return {
+    hostname: hostname(),
+    ip,
+    os: osName,
+    kernel,
+    uptime_seconds: uptimeSeconds,
+  };
+}