@glassmkr/crucible 0.11.0 → 0.13.0

package/dist/collect/__tests__/systemd.test.js

@@ -29,22 +29,30 @@ describe("collectSystemd", () => {
         // list-units output (2 failed services)
         runMock.mockResolvedValueOnce("fail2ban.service          loaded failed failed Fail2Ban Service\n" +
             "nginx.service             loaded failed failed nginx web server\n");
-        // journalctl output per unit (order matches `failed_units` iteration)
+        // Per-unit iteration: journalctl then systemctl-show, twice.
+        // C12 (2026-05-19) added the systemctl-show calls.
         runMock.mockResolvedValueOnce("Have not found any log file for sshd jail\n" +
             "Async configuration of server failed\n" +
             "fail2ban.service: Main process exited");
+        runMock.mockResolvedValueOnce("Result=exit-code\nActiveState=failed\nSubState=failed\nNRestarts=2");
         runMock.mockResolvedValueOnce("nginx: [emerg] bind() to 0.0.0.0:80 failed\n" +
             "nginx.service: Failed with result 'exit-code'");
+        runMock.mockResolvedValueOnce("Result=exit-code\nActiveState=failed\nSubState=failed\nNRestarts=1");
         const out = await collectSystemd();
         expect(out.failed_units).toEqual(["fail2ban.service", "nginx.service"]);
         expect(out.failed_count).toBe(2);
         expect(out.journal_excerpts).toBeDefined();
         expect(out.journal_excerpts["fail2ban.service"][0]).toMatch(/sshd jail/);
         expect(out.journal_excerpts["nginx.service"][0]).toMatch(/bind/);
+        // C12 details present.
+        expect(out.failed_unit_details).toBeDefined();
+        expect(out.failed_unit_details["fail2ban.service"].result).toBe("exit-code");
+        expect(out.failed_unit_details["fail2ban.service"].n_restarts).toBe(2);
     });
     it("empty journal output yields empty array, not missing field, for that unit", async () => {
         runMock.mockResolvedValueOnce("some-unit.service           loaded failed failed example\n");
         runMock.mockResolvedValueOnce(""); // journalctl returned nothing
+        runMock.mockResolvedValueOnce("Result=unknown\nActiveState=failed\nSubState=failed\nNRestarts=0");
         const out = await collectSystemd();
         expect(out.journal_excerpts["some-unit.service"]).toEqual([]);
     });
@@ -52,6 +60,7 @@ describe("collectSystemd", () => {
         runMock.mockResolvedValueOnce("systemd-networkd-wait-online.service  loaded failed failed wait-online\n" +
             "real.service                          loaded failed failed real\n");
         runMock.mockResolvedValueOnce("real journal line");
+        runMock.mockResolvedValueOnce("Result=exit-code\nActiveState=failed\nSubState=failed\nNRestarts=0");
         const out = await collectSystemd();
         expect(out.failed_units).toEqual(["real.service"]);
     });

package/dist/collect/__tests__/systemd.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"systemd.test.js","sourceRoot":"","sources":["../../../src/collect/__tests__/systemd.test.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,2DAA2D;AAC3D,8BAA8B;AAC9B,2DAA2D;AAC3D,kEAAkE;AAClE,iEAAiE;AACjE,yBAAyB;AAEzB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACxB,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,GAAG,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9C,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;AAEzD,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,CAAC,SAAS,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,2BAA2B;QAC9D,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7C,4CAA4C;QAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,wCAAwC;QACxC,OAAO,CAAC,qBAAqB,CAC3B,mEAAmE;YACnE,mEAAmE,CACpE,CAAC;QACF,sEAAsE;QACtE,OAAO,CAAC,qBAAqB,CAC3B,6CAA6C;YAC7C,wCAAwC;YACxC,uCAAuC,CACxC,CAAC;QACF,OAAO,CAAC,qBAAqB,CAC3B,8CAA8C;YAC9C,+CAA+C,CAChD,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,gBAAiB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,gBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,OAAO,CAAC,qBAAqB,CAC3B,4DAA4D,CAC7D,CAAC;QACF,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,8BAA8B;QACjE,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,gBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,OAAO,CAAC,qBAAqB,CAC3B,0EAA0E;YAC1E,mEAAmE,CACpE,CAAC;QACF,OAAO,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"systemd.test.js","sourceRoot":"","sources":["../../../src/collect/__tests__/systemd.test.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,2DAA2D;AAC3D,8BAA8B;AAC9B,2DAA2D;AAC3D,kEAAkE;AAClE,iEAAiE;AACjE,yBAAyB;AAEzB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACxB,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,GAAG,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9C,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;AAEzD,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,CAAC,SAAS,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,2BAA2B;QAC9D,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7C,4CAA4C;QAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,wCAAwC;QACxC,OAAO,CAAC,qBAAqB,CAC3B,mEAAmE;YACnE,mEAAmE,CACpE,CAAC;QACF,6DAA6D;QAC7D,mDAAmD;QACnD,OAAO,CAAC,qBAAqB,CAC3B,6CAA6C;YAC7C,wCAAwC;YACxC,uCAAuC,CACxC,CAAC;QACF,OAAO,CAAC,qBAAqB,CAC3B,oEAAoE,CACrE,CAAC;QACF,OAAO,CAAC,qBAAqB,CAC3B,8CAA8C;YAC9C,+CAA+C,CAChD,CAAC;QACF,OAAO,CAAC,qBAAqB,CAC3B,oEAAoE,CACrE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,gBAAiB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,gBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClE,uBAAuB;QACvB,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,mBAAoB,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,CAAC,mBAAoB,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,OAAO,CAAC,qBAAqB,CAC3B,4DAA4D,CAC7D,CAAC;QACF,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,8BAA8B;QACjE,OAAO,CAAC,qBAAqB,CAAC,kEAAkE,CAAC,CAAC;QAClG,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,gBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,OAAO,CAAC,qBAAqB,CAC3B,0EAA0E;YAC1E,mEAAmE,CACpE,CAAC;QACF,OAAO,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QACnD,OAAO,CAAC,qBAAqB,CAAC,oEAAoE,CAAC,CAAC;QACpG,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/collect/cve.d.ts

@@ -0,0 +1,51 @@
+import type { CveDistro, CveSeverity, CveSnapshot, KernelCve } from "../lib/types.js";
+export declare function collectCve(): Promise<CveSnapshot>;
+declare function detectDistro(): CveDistro;
+/**
+ * Parse the relevant kernel-CVE subset of `pro security-status --format=json`.
+ * The full shape is large; we only need pending CVEs against the
+ * running kernel + a severity histogram.
+ *
+ * Best-effort + defensive: malformed JSON yields zeros and no events.
+ */
+export declare function parseUbuntuProJson(raw: string): {
+    kernel_cves: KernelCve[];
+    critical: number;
+    important: number;
+};
+/**
+ * Parse `dnf updateinfo list --security --quiet` text output.
+ *
+ * Format (one line per advisory; columns vary slightly by dnf version):
+ *   RHSA-2026:1234 Critical/Sec.   kernel-5.14.0-1234.x86_64
+ *   RHBA-2026:5678 Moderate/Sec.   bash-5.1.8-9.el9_4.x86_64
+ *
+ * We only keep advisories whose package name starts with "kernel"
+ * (the kernel meta-package or any kernel-* sub-package).
+ */
+export declare function parseDnfUpdateinfoText(raw: string): {
+    kernel_cves: KernelCve[];
+    critical: number;
+    important: number;
+};
+/**
+ * Parse `zypper list-patches --category=security` table output.
+ *
+ * Format (columns: Repository | Name | Category | Severity | Status):
+ *   SLES15-SP6-Updates | SUSE-SLE-...-1234 | security | critical | needed
+ *
+ * We restrict to security patches whose name contains "kernel" — best
+ * effort; zypper doesn't surface a "package" column the same way dnf
+ * does, so the kernel match is on the patch name itself.
+ */
+export declare function parseZypperListPatchesText(raw: string): {
+    kernel_cves: KernelCve[];
+    critical: number;
+    important: number;
+};
+declare function normaliseSeverity(raw: string): CveSeverity;
+export declare const __test_only: {
+    detectDistro: typeof detectDistro;
+    normaliseSeverity: typeof normaliseSeverity;
+};
+export {};

package/dist/collect/cve.js

@@ -0,0 +1,327 @@
+// Distro-aware CVE collection for the running kernel.
+//
+// Pre-C13 the collector reads /sys/devices/system/cpu/vulnerabilities
+// (Spectre / Meltdown / etc) under SecurityData.kernel_vulns. That's
+// CPU microcode + kernel-mitigation status, not the distro CVE patch
+// queue. C13 ships separate distro-CVE data so Dashboard can REDESIGN
+// the kernel_vulnerabilities rule from a uptime-proxy / kernel-line
+// check into a real CVE-driven signal.
+//
+// Three distro paths:
+//
+//   - Ubuntu / Ubuntu Pro:
+//       Requires `pro security-status --format=json` AND attached pro
+//       subscription. Token comes from GLASSMKR_UBUNTU_PRO_TOKEN env
+//       var per the spec. No token => available: false silently
+//       (legitimate state on non-Pro hosts).
+//
+//   - RHEL / Fedora / Rocky / Alma / CentOS:
+//       `dnf updateinfo --output json` exposes a per-advisory list.
+//       The dnf JSON output is well-defined on modern releases (8+);
+//       older dnf falls back to text scraping which we tag as "stub".
+//
+//   - SUSE / openSUSE:
+//       `zypper list-patches --category=security --severity=critical`
+//       returns one line per patch. Severity is a column.
+//
+// Capability gating: missing CLI => available: false with reason.
+// Distro detection uses snap.system.os_id (Crucible 0.8+ field); but
+// since this collector is called separately from system.ts, we re-
+// derive distro from /etc/os-release inside this module to stay
+// independent.
+//
+// Per CC_SPEC_CRUCIBLE_C11_C18_FULL_BUNDLE_2026-05-19.md §3.
+import { readProcFile } from "../lib/parse.js";
+import { run } from "../lib/exec.js";
+export async function collectCve() {
+    const distro = detectDistro();
+    switch (distro) {
+        case "ubuntu":
+        case "debian":
+            return collectUbuntuPro();
+        case "rhel":
+        case "fedora":
+        case "rocky":
+        case "alma":
+        case "centos":
+            return collectDnf(distro);
+        case "sles":
+        case "opensuse":
+            return collectZypper(distro);
+        default:
+            return {
+                available: false,
+                reason: `distro "${distro}" not supported by CVE collection`,
+                distro,
+                kernel_cves_pending: [],
+                total_critical_pending: 0,
+                total_important_pending: 0,
+                parser_quality: "stub",
+            };
+    }
+}
+function detectDistro() {
+    const raw = readProcFile("/etc/os-release");
+    if (!raw)
+        return "unknown";
+    for (const line of raw.split("\n")) {
+        if (line.startsWith("ID=")) {
+            const id = line.slice(3).trim().replace(/^"|"$/g, "").toLowerCase();
+            if (id === "ubuntu")
+                return "ubuntu";
+            if (id === "debian")
+                return "debian";
+            if (id === "rhel")
+                return "rhel";
+            if (id === "fedora")
+                return "fedora";
+            if (id === "rocky")
+                return "rocky";
+            if (id === "almalinux" || id === "alma")
+                return "alma";
+            if (id === "centos")
+                return "centos";
+            if (id === "sles")
+                return "sles";
+            if (id === "opensuse" || id === "opensuse-leap" || id === "opensuse-tumbleweed") {
+                return "opensuse";
+            }
+        }
+    }
+    return "unknown";
+}
+// === Ubuntu Pro path ===
+async function collectUbuntuPro() {
+    const token = process.env.GLASSMKR_UBUNTU_PRO_TOKEN;
+    if (!token) {
+        return {
+            available: false,
+            reason: "Ubuntu Pro token not set (export GLASSMKR_UBUNTU_PRO_TOKEN to enable CVE collection)",
+            distro: "ubuntu",
+            kernel_cves_pending: [],
+            total_critical_pending: 0,
+            total_important_pending: 0,
+            parser_quality: "fleet-tested",
+        };
+    }
+    const out = await run("pro", ["security-status", "--format=json"]);
+    if (!out) {
+        return {
+            available: false,
+            reason: "`pro security-status` returned no output (Ubuntu Pro CLI missing or not attached?)",
+            distro: "ubuntu",
+            kernel_cves_pending: [],
+            total_critical_pending: 0,
+            total_important_pending: 0,
+            parser_quality: "fleet-tested",
+        };
+    }
+    const parsed = parseUbuntuProJson(out);
+    return {
+        available: true,
+        distro: "ubuntu",
+        kernel_cves_pending: parsed.kernel_cves,
+        total_critical_pending: parsed.critical,
+        total_important_pending: parsed.important,
+        parser_quality: "fleet-tested",
+    };
+}
+/**
+ * Parse the relevant kernel-CVE subset of `pro security-status --format=json`.
+ * The full shape is large; we only need pending CVEs against the
+ * running kernel + a severity histogram.
+ *
+ * Best-effort + defensive: malformed JSON yields zeros and no events.
+ */
+export function parseUbuntuProJson(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { kernel_cves: [], critical: 0, important: 0 };
+    }
+    // Ubuntu Pro JSON shape (abbreviated; real output has many more fields):
+    //   { "summary": { "kernel-cves": { "pending": [{ "cve": "CVE-2026-1234",
+    //     "severity": "high", "package": "linux-image-...", ... }] } } }
+    // The exact key shape varies by pro CLI version; reach defensively.
+    const root = parsed;
+    const pendingArr = root?.summary?.["kernel-cves"]?.pending ??
+        root?.["kernel-cves"] ??
+        [];
+    const cves = [];
+    let crit = 0;
+    let imp = 0;
+    if (Array.isArray(pendingArr)) {
+        for (const entry of pendingArr) {
+            const e = entry;
+            const cveId = typeof e.cve === "string" ? e.cve : "";
+            if (!cveId)
+                continue;
+            const severity = normaliseSeverity(typeof e.severity === "string" ? e.severity : "");
+            const pkg = typeof e.package === "string" ? e.package : "";
+            const fixed = typeof e.fixed_version === "string" ? e.fixed_version : undefined;
+            cves.push({
+                cve_id: cveId,
+                severity,
+                package_name: pkg,
+                ...(fixed ? { fixed_version: fixed } : {}),
+            });
+            if (severity === "critical")
+                crit++;
+            else if (severity === "important")
+                imp++;
+        }
+    }
+    return { kernel_cves: cves, critical: crit, important: imp };
+}
+// === dnf path (RHEL family) ===
+async function collectDnf(distro) {
+    const out = await run("dnf", [
+        "updateinfo",
+        "list",
+        "--security",
+        "--quiet",
+    ]);
+    if (!out) {
+        return {
+            available: false,
+            reason: "`dnf updateinfo list --security` returned no output (dnf missing or no security advisories?)",
+            distro,
+            kernel_cves_pending: [],
+            total_critical_pending: 0,
+            total_important_pending: 0,
+            parser_quality: "stub",
+        };
+    }
+    const parsed = parseDnfUpdateinfoText(out);
+    return {
+        available: true,
+        distro,
+        kernel_cves_pending: parsed.kernel_cves,
+        total_critical_pending: parsed.critical,
+        total_important_pending: parsed.important,
+        // Text scrape; dnf JSON output is the cleaner path but isn't
+        // universally available across RHEL 8/9/10. Tagging stub so the
+        // dashboard rule shows the right honesty.
+        parser_quality: "stub",
+    };
+}
+/**
+ * Parse `dnf updateinfo list --security --quiet` text output.
+ *
+ * Format (one line per advisory; columns vary slightly by dnf version):
+ *   RHSA-2026:1234 Critical/Sec.   kernel-5.14.0-1234.x86_64
+ *   RHBA-2026:5678 Moderate/Sec.   bash-5.1.8-9.el9_4.x86_64
+ *
+ * We only keep advisories whose package name starts with "kernel"
+ * (the kernel meta-package or any kernel-* sub-package).
+ */
+export function parseDnfUpdateinfoText(raw) {
+    const cves = [];
+    let crit = 0;
+    let imp = 0;
+    for (const line of raw.split("\n")) {
+        const m = line.match(/^([A-Z]+-\d{4}:\d+)\s+(\S+)\/Sec\.\s+(\S+)/i);
+        if (!m)
+            continue;
+        const [, advisory, sevToken, pkg] = m;
+        if (!pkg.toLowerCase().startsWith("kernel"))
+            continue;
+        const severity = normaliseSeverity(sevToken);
+        cves.push({
+            cve_id: advisory, // dnf reports advisory IDs (RHSA-...) not CVE IDs directly
+            severity,
+            package_name: pkg,
+        });
+        if (severity === "critical")
+            crit++;
+        else if (severity === "important")
+            imp++;
+    }
+    return { kernel_cves: cves, critical: crit, important: imp };
+}
+// === zypper path (SUSE family) ===
+async function collectZypper(distro) {
+    const out = await run("zypper", [
+        "--non-interactive",
+        "list-patches",
+        "--category=security",
+    ]);
+    if (!out) {
+        return {
+            available: false,
+            reason: "`zypper list-patches --category=security` returned no output (zypper missing?)",
+            distro,
+            kernel_cves_pending: [],
+            total_critical_pending: 0,
+            total_important_pending: 0,
+            parser_quality: "stub",
+        };
+    }
+    const parsed = parseZypperListPatchesText(out);
+    return {
+        available: true,
+        distro,
+        kernel_cves_pending: parsed.kernel_cves,
+        total_critical_pending: parsed.critical,
+        total_important_pending: parsed.important,
+        parser_quality: "stub",
+    };
+}
+/**
+ * Parse `zypper list-patches --category=security` table output.
+ *
+ * Format (columns: Repository | Name | Category | Severity | Status):
+ *   SLES15-SP6-Updates | SUSE-SLE-...-1234 | security | critical | needed
+ *
+ * We restrict to security patches whose name contains "kernel" — best
+ * effort; zypper doesn't surface a "package" column the same way dnf
+ * does, so the kernel match is on the patch name itself.
+ */
+export function parseZypperListPatchesText(raw) {
+    const cves = [];
+    let crit = 0;
+    let imp = 0;
+    for (const line of raw.split("\n")) {
+        if (!line.includes("|"))
+            continue;
+        const cols = line.split("|").map((c) => c.trim());
+        if (cols.length < 5)
+            continue;
+        const [, name, category, severityRaw] = cols;
+        if (!/security/i.test(category))
+            continue;
+        if (!/kernel/i.test(name))
+            continue;
+        const severity = normaliseSeverity(severityRaw);
+        cves.push({
+            cve_id: name,
+            severity,
+            package_name: name,
+        });
+        if (severity === "critical")
+            crit++;
+        else if (severity === "important")
+            imp++;
+    }
+    return { kernel_cves: cves, critical: crit, important: imp };
+}
+// === shared helpers ===
+function normaliseSeverity(raw) {
+    const v = raw.toLowerCase().trim();
+    if (v === "critical" || v === "crit")
+        return "critical";
+    if (v === "important" || v === "high" || v === "imp")
+        return "important";
+    if (v === "moderate" || v === "medium" || v === "med")
+        return "moderate";
+    if (v === "low" || v === "negligible")
+        return "low";
+    return "unknown";
+}
+export const __test_only = {
+    detectDistro,
+    normaliseSeverity,
+};
+//# sourceMappingURL=cve.js.map

package/dist/collect/cve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve.js","sourceRoot":"","sources":["../../src/collect/cve.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,uCAAuC;AACvC,EAAE;AACF,sBAAsB;AACtB,EAAE;AACF,2BAA2B;AAC3B,sEAAsE;AACtE,qEAAqE;AACrE,gEAAgE;AAChE,6CAA6C;AAC7C,EAAE;AACF,6CAA6C;AAC7C,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,EAAE;AACF,uBAAuB;AACvB,sEAAsE;AACtE,0DAA0D;AAC1D,EAAE;AACF,kEAAkE;AAClE,qEAAqE;AACrE,mEAAmE;AACnE,gEAAgE;AAChE,eAAe;AACf,EAAE;AACF,6DAA6D;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAGrC,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,gBAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;QAC/B;YACE,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,WAAW,MAAM,mCAAmC;gBAC5D,MAAM;gBACN,mBAAmB,EAAE,EAAE;gBACvB,sBAAsB,EAAE,CAAC;gBACzB,uBAAuB,EAAE,CAAC;gBAC1B,cAAc,EAAE,MAAM;aACvB,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACpE,IAAI,EAAE,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YACrC,IAAI,EAAE,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YACrC,IAAI,EAAE,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC;YACjC,IAAI,EAAE,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YACrC,IAAI,EAAE,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACnC,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC;YACvD,IAAI,EAAE,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YACrC,IAAI,EAAE,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC;YACjC,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,eAAe,IAAI,EAAE,KAAK,qBAAqB,EAAE,CAAC;gBAChF,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0BAA0B;AAE1B,KAAK,UAAU,gBAAgB;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,sFAAsF;YACxF,MAAM,EAAE,QAAQ;YAChB,mBAAmB,EAAE,EAAE;YACvB,sBAAsB,EAAE,CAAC;YACzB,uBAAuB,EAAE,CAAC;YAC1B,cAAc,EAAE,cAAc;SAC/B,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,oFAAoF;YAC5F,MAAM,EAAE,QAAQ;YAChB,mBAAmB,EAAE,EAAE;YACvB,sBAAsB,EAAE,CAAC;YACzB,uBAAuB,EAAE,CAAC;YAC1B,cAAc,EAAE,cAAc;SAC/B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,QAAQ;QAChB,mBAAmB,EAAE,MAAM,CAAC,WAAW;QACvC,sBAAsB,EAAE,MAAM,CAAC,QAAQ;QACvC,uBAAuB,EAAE,MAAM,CAAC,SAAS;QACzC,cAAc,EAAE,cAAc;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAK5C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAGZ,CAAC;IACF,MAAM,UAAU,GACd,IAAI,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO;QACtC,IAAI,EAAE,CAAC,aAAa,CAAe;QACpC,EAAE,CAAC;IACL,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,KAAgC,CAAC;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,IAAI,CAAC,IAAI,CAAC;gBACR,MAAM,EAAE,KAAK;gBACb,QAAQ;gBACR,YAAY,EAAE,GAAG;gBACjB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;YACH,IAAI,QAAQ,KAAK,UAAU;gBAAE,IAAI,EAAE,CAAC;iBAC/B,IAAI,QAAQ,KAAK,WAAW;gBAAE,GAAG,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,iCAAiC;AAEjC,KAAK,UAAU,UAAU,CAAC,MAAiB;IACzC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE;QAC3B,YAAY;QACZ,MAAM;QACN,YAAY;QACZ,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,8FAA8F;YACtG,MAAM;YACN,mBAAmB,EAAE,EAAE;YACvB,sBAAsB,EAAE,CAAC;YACzB,uBAAuB,EAAE,CAAC;YAC1B,cAAc,EAAE,MAAM;SACvB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM;QACN,mBAAmB,EAAE,MAAM,CAAC,WAAW;QACvC,sBAAsB,EAAE,MAAM,CAAC,QAAQ;QACvC,uBAAuB,EAAE,MAAM,CAAC,SAAS;QACzC,6DAA6D;QAC7D,gEAAgE;QAChE,0CAA0C;QAC1C,cAAc,EAAE,MAAM;KACvB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAKhD,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAClB,6CAA6C,CAC9C,CAAC;QACF,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC;YACR,MAAM,EAAE,QAAQ,EAAE,2DAA2D;YAC7E,QAAQ;YACR,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,UAAU;YAAE,IAAI,EAAE,CAAC;aAC/B,IAAI,QAAQ,KAAK,WAAW;YAAE,GAAG,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,oCAAoC;AAEpC,KAAK,UAAU,aAAa,CAAC,MAAiB;IAC5C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE;QAC9B,mBAAmB;QACnB,cAAc;QACd,qBAAqB;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,gFAAgF;YACxF,MAAM;YACN,mBAAmB,EAAE,EAAE;YACvB,sBAAsB,EAAE,CAAC;YACzB,uBAAuB,EAAE,CAAC;YAC1B,cAAc,EAAE,MAAM;SACvB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM;QACN,mBAAmB,EAAE,MAAM,CAAC,WAAW;QACvC,sBAAsB,EAAE,MAAM,CAAC,QAAQ;QACvC,uBAAuB,EAAE,MAAM,CAAC,SAAS;QACzC,cAAc,EAAE,MAAM;KACvB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IAKpD,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC9B,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;QAC7C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC;YACR,MAAM,EAAE,IAAI;YACZ,QAAQ;YACR,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,UAAU;YAAE,IAAI,EAAE,CAAC;aAC/B,IAAI,QAAQ,KAAK,WAAW;YAAE,GAAG,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,yBAAyB;AAEzB,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC;IACxD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IACzE,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IACzE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,YAAY;IACZ,iBAAiB;CAClB,CAAC"}

package/dist/collect/dmesg-events.d.ts

@@ -0,0 +1,32 @@
+import type { DmesgEventType, DmesgEventsSnapshot, DmesgStructuredEvent } from "../lib/types.js";
+interface DmesgHandler {
+    event_type: DmesgEventType;
+    pattern: RegExp;
+    /** Returns null when the regex matched on accident (rare). */
+    parse(match: RegExpMatchArray, line: string): Omit<DmesgStructuredEvent, "timestamp_iso" | "raw_line"> | null;
+}
+export declare function collectDmesgEvents(): Promise<DmesgEventsSnapshot>;
+/**
+ * Parse a full dmesg output buffer; return structured events whose
+ * inferred timestamp is at or after `cutoffMs`. When the timestamp
+ * cannot be parsed (relative-time fallback), the event is included
+ * unconditionally (fail-open: better to over-report than silently
+ * drop a real hardware fault).
+ */
+export declare function parseDmesgOutput(raw: string, cutoffMs: number): DmesgStructuredEvent[];
+/**
+ * Extract a unix-ms timestamp from a dmesg line. Two shapes:
+ *   ISO:        "2026-05-19T12:34:56,789012+00:00 ..."  (--time-format=iso)
+ *   ctime:      "[Mon May 19 12:34:56 2026] ..."       (--ctime)
+ *
+ * Relative-time format ("[12345.678]") returns null (no absolute
+ * anchor available without `uptime`).
+ */
+export declare function parseDmesgTimestamp(line: string): number | null;
+export declare const __test_only: {
+    parseDmesgOutput: typeof parseDmesgOutput;
+    parseDmesgTimestamp: typeof parseDmesgTimestamp;
+    HANDLERS: DmesgHandler[];
+    WINDOW_SECONDS: number;
+};
+export {};

package/dist/collect/dmesg-events.js

@@ -0,0 +1,196 @@
+// dmesg structured event parsing.
+//
+// dmesg is line-by-line text; several event classes carry structured
+// information that's currently parsed only by humans. C18 extracts
+// three well-formed classes that have the highest signal-to-noise:
+//
+//   - SCSI sense codes (sense key + ASC/ASCQ)
+//   - NVMe controller resets
+//   - ext4 remount-readonly (filesystem error)
+//
+// Per CC_SPEC_CRUCIBLE_C11_C18_FULL_BUNDLE_2026-05-19.md §4. Spec's
+// original list included PCIe AER + XFS; deferred from this release
+// per karpathy simplicity-first to keep regex patterns auditable. PCIe
+// AER format varies across kernel versions (5.x vs 6.x has distinct
+// shapes); XFS error patterns vary by mount option set. Adding both
+// would double the test surface without delivering proportional
+// operational value — accept-rate signal from the three included
+// classes is high. Future Crucible release picks them up if customer
+// signal warrants.
+//
+// Capability gating: dmesg missing or unreadable -> available: false.
+// Window: last 3600 seconds (one hour) by default. Events older than
+// the window are excluded.
+//
+// Dedup within snapshot: same (event_type, primary_id, error_class)
+// tuple within 60 seconds collapses to one entry; not implemented in
+// v1 (each occurrence ships as a separate event for now). Dashboard's
+// side can collapse if needed via cross-snapshot library primitives.
+import { run } from "../lib/exec.js";
+const WINDOW_SECONDS = 3600;
+/**
+ * SCSI sense codes. Format observed across kernel 5.x and 6.x:
+ *   sd 1:0:0:0: [sda] Sense Key : Medium Error [current]
+ *   sd 1:0:0:0: [sda] Add. Sense: Read retries exhausted
+ *
+ * We parse the Sense Key line; the Add. Sense line follows but is
+ * captured by a separate handler if surfaced. Sense Key alone is the
+ * canonical severity signal: Medium Error / Hardware Error / Aborted
+ * Command are P1 candidates.
+ */
+const SCSI_SENSE_HANDLER = {
+    event_type: "scsi_sense",
+    pattern: /sd\s+\S+:\s+\[(\w+)\]\s+Sense Key\s*:\s*([\w ]+?)(?:\s+\[(?:current|deferred)\])?\s*$/,
+    parse: (m) => {
+        const [, device, senseKey] = m;
+        const sk = senseKey.trim();
+        const severityMajor = sk === "Medium Error" ||
+            sk === "Hardware Error" ||
+            sk === "Aborted Command";
+        return {
+            event_type: "scsi_sense",
+            severity: severityMajor ? "critical" : "warning",
+            details: { device, sense_key: sk },
+        };
+    },
+};
+/**
+ * NVMe controller reset. Format:
+ *   nvme nvme0: I/O 256 QID 1 timeout, reset controller
+ *   nvme nvme0: I/O 256 QID 1 timeout, aborting
+ *
+ * Either pattern indicates a controller-side fault that the NVMe
+ * driver responded to with a reset. P1.
+ */
+const NVME_RESET_HANDLER = {
+    event_type: "nvme_reset",
+    pattern: /nvme\s+(nvme\d+):\s+.*?(timeout|reset|aborting|disabling)/i,
+    parse: (m) => {
+        const [, controller, action] = m;
+        return {
+            event_type: "nvme_reset",
+            severity: "critical",
+            details: { controller, action: action.toLowerCase() },
+        };
+    },
+};
+/**
+ * ext4 "Remounting filesystem read-only". The kernel only does this
+ * after detecting an inconsistency it can't recover from; always P0
+ * in Dashboard's filesystem_readonly rule.
+ *
+ *   EXT4-fs (sda1): Remounting filesystem read-only
+ *   EXT4-fs error (device sda1): __ext4_read_inode_lock:5234: ...
+ */
+const EXT4_READONLY_HANDLER = {
+    event_type: "ext4_remount_readonly",
+    pattern: /EXT4-fs\s+\(([^)]+)\):\s+Remounting filesystem read-only/,
+    parse: (m) => {
+        const [, device] = m;
+        return {
+            event_type: "ext4_remount_readonly",
+            severity: "critical",
+            details: { device, remount_readonly: true },
+        };
+    },
+};
+const HANDLERS = [
+    SCSI_SENSE_HANDLER,
+    NVME_RESET_HANDLER,
+    EXT4_READONLY_HANDLER,
+];
+export async function collectDmesgEvents() {
+    const empty = (reason) => ({
+        available: false,
+        reason,
+        events: [],
+        events_by_type: { scsi_sense: 0, nvme_reset: 0, ext4_remount_readonly: 0 },
+        window_seconds: WINDOW_SECONDS,
+    });
+    // `--time-format=iso` for kernel 5.10+; older kernels ignore the
+    // flag and produce relative-time output we tolerate downstream.
+    const out = await run("dmesg", ["--time-format=iso", "--no-pager", "--ctime"]).catch(() => null);
+    // Fall back without --time-format if first call fails (no privileges
+    // is more common than missing flag).
+    const dmesgOut = out ?? (await run("dmesg", ["--no-pager"]));
+    if (!dmesgOut) {
+        return empty("dmesg not readable (CAP_SYSLOG missing or kernel.dmesg_restrict=1?)");
+    }
+    const cutoffMs = Date.now() - WINDOW_SECONDS * 1000;
+    const events = parseDmesgOutput(dmesgOut, cutoffMs);
+    const eventsByType = {
+        scsi_sense: 0,
+        nvme_reset: 0,
+        ext4_remount_readonly: 0,
+    };
+    for (const e of events)
+        eventsByType[e.event_type]++;
+    return {
+        available: true,
+        events,
+        events_by_type: eventsByType,
+        window_seconds: WINDOW_SECONDS,
+    };
+}
+/**
+ * Parse a full dmesg output buffer; return structured events whose
+ * inferred timestamp is at or after `cutoffMs`. When the timestamp
+ * cannot be parsed (relative-time fallback), the event is included
+ * unconditionally (fail-open: better to over-report than silently
+ * drop a real hardware fault).
+ */
+export function parseDmesgOutput(raw, cutoffMs) {
+    const events = [];
+    for (const line of raw.split("\n")) {
+        if (!line.trim())
+            continue;
+        const ts = parseDmesgTimestamp(line);
+        if (ts !== null && ts < cutoffMs)
+            continue;
+        for (const handler of HANDLERS) {
+            const m = line.match(handler.pattern);
+            if (!m)
+                continue;
+            const partial = handler.parse(m, line);
+            if (!partial)
+                continue;
+            events.push({
+                timestamp_iso: ts !== null ? new Date(ts).toISOString() : new Date().toISOString(),
+                raw_line: line.trim(),
+                ...partial,
+            });
+            break; // one match per line
+        }
+    }
+    return events;
+}
+/**
+ * Extract a unix-ms timestamp from a dmesg line. Two shapes:
+ *   ISO:        "2026-05-19T12:34:56,789012+00:00 ..."  (--time-format=iso)
+ *   ctime:      "[Mon May 19 12:34:56 2026] ..."       (--ctime)
+ *
+ * Relative-time format ("[12345.678]") returns null (no absolute
+ * anchor available without `uptime`).
+ */
+export function parseDmesgTimestamp(line) {
+    const isoMatch = line.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:[,.]\d+)?(?:[+-]\d{2}:?\d{2}|Z)?)/);
+    if (isoMatch) {
+        // Normalise the comma fractional separator to dot.
+        const iso = isoMatch[1].replace(",", ".");
+        const t = Date.parse(iso);
+        return Number.isFinite(t) ? t : null;
+    }
+    const ctimeMatch = line.match(/^\[([A-Z][a-z]{2}\s+[A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2}\s+\d{4})\]/);
+    if (ctimeMatch) {
+        const t = Date.parse(ctimeMatch[1]);
+        return Number.isFinite(t) ? t : null;
+    }
+    return null;
+}
+export const __test_only = {
+    parseDmesgOutput,
+    parseDmesgTimestamp,
+    HANDLERS,
+    WINDOW_SECONDS,
+};
+//# sourceMappingURL=dmesg-events.js.map