@glassmkr/crucible 0.7.1 → 0.8.1

package/dist/lib/capability.js

@@ -0,0 +1,110 @@
+// One-shot IPMI capability detection at process startup.
+//
+// The agent runs collectIpmi() every cycle. Without this layer, hosts
+// without a BMC (Pi, laptop, VM, container without /dev mapped) hit four
+// ipmitool ENOENT or "Could not open device" execs every interval forever.
+// They're silent (lib/exec.ts swallows ENOENT) but still wasted process
+// spawns, and there's no log telling the user IPMI is unavailable here.
+//
+// This module probes once at startup and caches the result. collectIpmi()
+// reads the cached capability and short-circuits when unavailable.
+import { promises as fs } from "node:fs";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const DEVICE_CANDIDATES = ["/dev/ipmi0", "/dev/ipmi/0", "/dev/ipmidev/0"];
+async function defaultStatDevice(path) {
+    try {
+        await fs.access(path, fs.constants.R_OK);
+        return "ok";
+    }
+    catch (err) {
+        if (err.code === "EACCES" || err.code === "EPERM")
+            return "eacces";
+        return "enoent";
+    }
+}
+async function defaultRunIpmitool(args) {
+    const { stdout, stderr } = await execFileAsync("ipmitool", args, { timeout: 2000 });
+    return { stdout, stderr };
+}
+export async function detectIpmiCapability(deps = {}) {
+    const statDevice = deps.statDevice ?? defaultStatDevice;
+    const runIpmitool = deps.runIpmitool ?? defaultRunIpmitool;
+    // Step 1: probe /dev/ipmi* device nodes.
+    let deviceFound = false;
+    let permissionDenied = false;
+    for (const path of DEVICE_CANDIDATES) {
+        const result = await statDevice(path);
+        if (result === "ok") {
+            deviceFound = true;
+            break;
+        }
+        if (result === "eacces") {
+            permissionDenied = true;
+        }
+    }
+    if (permissionDenied && !deviceFound) {
+        return {
+            available: false,
+            reason: "permission_denied",
+            detail: "/dev/ipmi0 exists but is not readable; run as root or add user to ipmi group",
+        };
+    }
+    // Step 2: probe ipmitool binary.
+    let ipmitoolVersion = null;
+    try {
+        const { stdout } = await runIpmitool(["-V"]);
+        const m = stdout.match(/ipmitool version (\S+)/);
+        ipmitoolVersion = m ? m[1] : null;
+    }
+    catch (err) {
+        if (err?.code === "ENOENT") {
+            return { available: false, reason: "no_ipmitool_binary" };
+        }
+        return {
+            available: false,
+            reason: "execution_failed",
+            detail: String(err?.stderr ?? err?.message ?? err).split("\n")[0]?.slice(0, 200),
+        };
+    }
+    // Step 3: device + binary present → assume capable.
+    if (deviceFound) {
+        return { available: true, method: "ipmitool_in_band", ipmitool_version: ipmitoolVersion };
+    }
+    // Step 4: binary present but no device node — try one sensor probe to
+    // disambiguate (some kernels expose IPMI through unconventional paths).
+    try {
+        const { stdout, stderr } = await runIpmitool(["sensor"]);
+        const out = stdout || "";
+        const errOut = (stderr || "").toLowerCase();
+        if (out.trim().length > 0 && !errOut.includes("could not open")) {
+            return { available: true, method: "ipmitool_in_band", ipmitool_version: ipmitoolVersion };
+        }
+        return { available: false, reason: "no_bmc_device" };
+    }
+    catch (err) {
+        const stderr = String(err?.stderr ?? "").toLowerCase();
+        if (stderr.includes("could not open")) {
+            return { available: false, reason: "no_bmc_device" };
+        }
+        return {
+            available: false,
+            reason: "execution_failed",
+            detail: String(err?.stderr ?? err?.message ?? err).split("\n")[0]?.slice(0, 200),
+        };
+    }
+}
+export function formatCapabilityLine(cap) {
+    if (cap.available) {
+        const v = cap.ipmitool_version ? `ipmitool ${cap.ipmitool_version}, ` : "";
+        return `IPMI: available (${v}${cap.method.replace(/_/g, " ")})`;
+    }
+    switch (cap.reason) {
+        case "no_ipmitool_binary": return "IPMI: not available (ipmitool not installed)";
+        case "no_bmc_device": return "IPMI: not available (no /dev/ipmi*, BMC not detected)";
+        case "permission_denied": return `IPMI: not available (${cap.detail ?? "permission denied"})`;
+        case "execution_failed": return `IPMI: not available (execution failed${cap.detail ? `: ${cap.detail}` : ""})`;
+    }
+}
+//# sourceMappingURL=capability.js.map

package/dist/lib/capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../../src/lib/capability.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AAEnE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAM1C,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAS1E,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAc;IAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAmB,EAAE;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAE3D,yCAAyC;IACzC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAAC,WAAW,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QACnD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAAC,gBAAgB,GAAG,IAAI,CAAC;QAAC,CAAC;IACvD,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,8EAA8E;SACvF,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjD,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjF,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAC5F,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACvD,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,oBAAoB,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;IAClE,CAAC;IACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,oBAAoB,CAAC,CAAC,OAAO,8CAA8C,CAAC;QACjF,KAAK,eAAe,CAAC,CAAM,OAAO,uDAAuD,CAAC;QAC1F,KAAK,mBAAmB,CAAC,CAAE,OAAO,wBAAwB,GAAG,CAAC,MAAM,IAAI,mBAAmB,GAAG,CAAC;QAC/F,KAAK,kBAAkB,CAAC,CAAG,OAAO,wCAAwC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IACnH,CAAC;AACH,CAAC"}

package/dist/lib/cpu-thermal-chips.d.ts

@@ -0,0 +1,2 @@
+export declare const CPU_THERMAL_CHIPS: ReadonlySet<string>;
+export declare function isCpuChip(name: string): boolean;

package/dist/lib/cpu-thermal-chips.js

@@ -0,0 +1,28 @@
+// Allowlist of hwmon chip `name` values that report CPU die / package
+// temperatures. Adding a new platform here is the supported way to teach
+// the thermal collector that a chip's readings represent CPU temperature.
+//
+// Drivers explicitly excluded:
+//   - "nvme"   already covered by SMART; double counts otherwise
+//   - "acpitz" often reads ambient or chassis air, not CPU die. Goes to
+//              other_readings if found, never to cpu_readings.
+export const CPU_THERMAL_CHIPS = new Set([
+    // Intel x86
+    "coretemp",
+    // AMD x86 (modern)
+    "k10temp",
+    "zenpower",
+    // ARM / SoC
+    "cpu_thermal", // Raspberry Pi 4/5, many ARM SBCs
+    "armada_thermal", // Marvell Armada SoCs
+    "tegra_thermal", // NVIDIA Tegra
+    "qcom_tsens", // Qualcomm
+    "imx_thermal", // NXP i.MX
+    "sun4i_ts", // Allwinner sunxi
+    "rockchip_thermal", // Rockchip RK3399 etc.
+    "exynos_thermal", // Samsung Exynos
+]);
+export function isCpuChip(name) {
+    return CPU_THERMAL_CHIPS.has(name);
+}
+//# sourceMappingURL=cpu-thermal-chips.js.map

package/dist/lib/cpu-thermal-chips.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpu-thermal-chips.js","sourceRoot":"","sources":["../../src/lib/cpu-thermal-chips.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,yEAAyE;AACzE,0EAA0E;AAC1E,EAAE;AACF,+BAA+B;AAC/B,iEAAiE;AACjE,wEAAwE;AACxE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,YAAY;IACZ,UAAU;IACV,mBAAmB;IACnB,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa,EAAO,kCAAkC;IACtD,gBAAgB,EAAI,sBAAsB;IAC1C,eAAe,EAAK,eAAe;IACnC,YAAY,EAAQ,WAAW;IAC/B,aAAa,EAAO,WAAW;IAC/B,UAAU,EAAU,kBAAkB;IACtC,kBAAkB,EAAE,uBAAuB;IAC3C,gBAAgB,EAAI,iBAAiB;CACtC,CAAC,CAAC;AAEH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/lib/types.d.ts

@@ -9,6 +9,8 @@ export interface Snapshot {
     network: NetworkInfo[];
     raid: RaidInfo[];
     ipmi: IpmiInfo;
+    dmi?: DmiInfo;
+    thermal?: ThermalInfo;
     os_alerts: OsAlerts;
     security?: SecurityData;
     zfs?: ZfsData;
@@ -206,8 +208,33 @@ export interface FanStatus {
     rpm: number;
     status: string;
 }
+export type Vendor = "dell" | "hpe" | "supermicro" | "asrockrack" | "lenovo" | "inspur" | "cisco" | "generic" | "virtual";
+export interface DmiInfo {
+    available: boolean;
+    vendor: Vendor;
+    /** Exact /sys/class/dmi/id/sys_vendor contents, trimmed. */
+    raw_vendor: string | null;
+    product_name: string | null;
+    bios_version: string | null;
+    bios_date: string | null;
+    is_virtual: boolean;
+}
+export type PsuRedundancyState = "fully_redundant" | "redundancy_lost" | "redundancy_degraded" | "unknown";
+export type IpmiCapability = {
+    available: true;
+    method: "ipmitool_in_band";
+    ipmitool_version: string | null;
+} | {
+    available: false;
+    reason: "no_ipmitool_binary" | "no_bmc_device" | "execution_failed" | "permission_denied";
+    detail?: string;
+};
 export interface IpmiInfo {
     available: boolean;
+    /** One-shot startup detection result; helps Forge surface "IPMI not
+     *  available on this host" with a precise reason. Not present on
+     *  pre-detection snapshots (older agent versions). */
+    detection?: IpmiCapability;
     sensors: Array<{
         name: string;
         value: number | string;
@@ -219,10 +246,41 @@ export interface IpmiInfo {
         correctable: number;
         uncorrectable: number;
     };
+    /**
+     * ECC error counts derived from SEL events instead of named sensors.
+     * Dell iDRAC reports memory ECC only via SEL on the Memory entity, so
+     * the named-sensor counter (`ecc_errors`) stays at zero on Dell. The
+     * `ecc_errors` rule reads max(named, sel) to cover both vendors.
+     * Cumulative since last SEL clear, not rate over interval.
+     */
+    ecc_errors_from_sel?: {
+        correctable: number;
+        uncorrectable: number;
+        newest_event_timestamp: string | null;
+    };
+    /**
+     * Aggregate PSU redundancy state from a vendor sensor (currently Dell
+     * `PS Redundancy` only). Undefined on hosts where no aggregate sensor
+     * exists; the rule then falls back to per-PSU status checks.
+     */
+    psu_redundancy_state?: PsuRedundancyState;
     sel_entries_count: number;
     sel_events_recent: SelEvent[];
     fans: FanStatus[];
 }
+export interface ThermalReading {
+    label: string;
+    value_celsius: number;
+    source_chip: string;
+    source: "hwmon" | "thermal_zone";
+}
+export interface ThermalInfo {
+    available: boolean;
+    source: "hwmon" | "thermal_zone" | "none";
+    cpu_readings: ThermalReading[];
+    other_readings: ThermalReading[];
+    max_cpu_celsius: number | null;
+}
 export interface OsAlerts {
     oom_kills_recent: number;
     zombie_processes: number;

package/dist/lib/vendor-sensors.d.ts

@@ -0,0 +1,27 @@
+import type { Vendor } from "./types.js";
+/**
+ * True if `name` looks like an individual PSU sensor (status / wattage / etc.)
+ * for the given vendor.
+ *
+ * Generic patterns cover Supermicro, HPE iLO, ASRockRack:
+ *   "PSU1 Status", "Power Supply 1", "PSU2 Power Out"
+ *
+ * Dell iDRAC adds:
+ *   "PS1 Status", "PS2 Status", "PS3 Status"
+ *
+ * Note that "PS Redundancy" is NOT an individual PSU sensor; see
+ * `isPsuRedundancySensor`.
+ */
+export declare function isPsuSensor(name: string, vendor: Vendor): boolean;
+/**
+ * True if `name` is the aggregate PSU redundancy state sensor.
+ * Currently only Dell exposes this as a discrete sensor reading;
+ * HPE/Supermicro report it via SEL events instead.
+ */
+export declare function isPsuRedundancySensor(name: string, vendor: Vendor): boolean;
+/**
+ * Map the value/status text of a Dell `PS Redundancy` sensor to a canonical
+ * state. Dell reports strings like "Fully Redundant", "Redundancy Lost",
+ * "Redundancy Degraded", or "0x01"-style raw codes depending on iDRAC firmware.
+ */
+export declare function classifyPsuRedundancyState(valueOrStatus: string): "fully_redundant" | "redundancy_lost" | "redundancy_degraded" | "unknown";

package/dist/lib/vendor-sensors.js

@@ -0,0 +1,63 @@
+// Vendor-aware classifiers for IPMI sensor names.
+//
+// The substring filters in alert rules historically assumed Supermicro /
+// ASRockRack naming conventions (`PSU1 Status`, `CPU1 Temp`, etc.). Dell
+// iDRAC names sensors very differently: `PS1 Status`, `PS Redundancy`,
+// bare `Temp` per processor entity. HPE iLO is closer to Supermicro's
+// shape but has its own quirks. Adding a new vendor means adding a case
+// here, not editing every rule.
+/**
+ * True if `name` looks like an individual PSU sensor (status / wattage / etc.)
+ * for the given vendor.
+ *
+ * Generic patterns cover Supermicro, HPE iLO, ASRockRack:
+ *   "PSU1 Status", "Power Supply 1", "PSU2 Power Out"
+ *
+ * Dell iDRAC adds:
+ *   "PS1 Status", "PS2 Status", "PS3 Status"
+ *
+ * Note that "PS Redundancy" is NOT an individual PSU sensor; see
+ * `isPsuRedundancySensor`.
+ */
+export function isPsuSensor(name, vendor) {
+    const lower = name.toLowerCase();
+    if (lower.includes("psu") || lower.includes("power supply"))
+        return true;
+    if (vendor === "dell") {
+        // PS1, PS2 ... optionally followed by " Status" or other suffix.
+        // Excludes "PS Redundancy" and similar non-numeric.
+        if (/^ps\d+\b/i.test(name))
+            return true;
+    }
+    return false;
+}
+/**
+ * True if `name` is the aggregate PSU redundancy state sensor.
+ * Currently only Dell exposes this as a discrete sensor reading;
+ * HPE/Supermicro report it via SEL events instead.
+ */
+export function isPsuRedundancySensor(name, vendor) {
+    if (vendor === "dell") {
+        return /^ps\s+redundancy$/i.test(name);
+    }
+    return false;
+}
+/**
+ * Map the value/status text of a Dell `PS Redundancy` sensor to a canonical
+ * state. Dell reports strings like "Fully Redundant", "Redundancy Lost",
+ * "Redundancy Degraded", or "0x01"-style raw codes depending on iDRAC firmware.
+ */
+export function classifyPsuRedundancyState(valueOrStatus) {
+    const lower = valueOrStatus.toLowerCase();
+    if (lower.includes("fully redundant") || lower.includes("fully-redundant"))
+        return "fully_redundant";
+    if (lower.includes("lost"))
+        return "redundancy_lost";
+    if (lower.includes("degraded"))
+        return "redundancy_degraded";
+    // Some iDRAC firmwares report "ok" + numeric value 1 = fully redundant
+    if (lower === "ok")
+        return "fully_redundant";
+    return "unknown";
+}
+//# sourceMappingURL=vendor-sensors.js.map

package/dist/lib/vendor-sensors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor-sensors.js","sourceRoot":"","sources":["../../src/lib/vendor-sensors.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,gCAAgC;AAIhC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,iEAAiE;QACjE,oDAAoD;QACpD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,MAAc;IAChE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,aAAqB;IAC9D,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACrG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC7D,uEAAuE;IACvE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAC;IAC7C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/notify/telegram.js

@@ -3,7 +3,7 @@ const PRIORITY_MAP = {
     oom_kills: "P2", ram_high: "P2", disk_space_high: "P2", ipmi_sel_critical: "P2", disk_io_errors: "P2", zfs_pool_unhealthy: "P2",
     cpu_iowait_high: "P3", nvme_wear_high: "P3", disk_latency_high: "P3", cpu_temperature_high: "P3",
     ssh_root_password: "P3", pending_security_updates: "P3", kernel_vulnerabilities: "P3", zfs_scrub_errors: "P3",
-    swap_active: "P4", no_firewall: "P4", kernel_needs_reboot: "P4", unattended_upgrades_disabled: "P4",
+    swap_high: "P4", no_firewall: "P4", kernel_needs_reboot: "P4", unattended_upgrades_disabled: "P4",
     interface_errors: "P4", link_speed_mismatch: "P4", interface_saturation: "P4",
 };
 const PRIORITY_LABELS = {

package/dist/notify/telegram.js.map

@@ -1 +1 @@
-{"version":3,"file":"telegram.js","sourceRoot":"","sources":["../../src/notify/telegram.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAA2B;IAC3C,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI;IAC7G,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;IAC/H,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI;IAChG,iBAAiB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI;IAC7G,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI;IACnG,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI;CAC9E,CAAC;AAEF,MAAM,eAAe,GAA2B;IAC9C,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,kBAAkB;CACtG,CAAC;AAEF,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,MAAc,EACd,SAAwB,EACxB,cAA6B,EAC7B,UAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,oBAAoB;QACpB,MAAM,UAAU,GAAkC,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACvC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,EAAE,MAAM;gBAAE,SAAS;YAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,UAAU,SAAS,CAAC,CAAC;YAC/D,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,aAAa,cAAc,CAAC,MAAM,uBAAuB,UAAU,SAAS,CAAC,CAAC;QACzF,KAAK,MAAM,CAAC,IAAI,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,QAAQ,cAAc,EAAE;YAC7E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;YACrH,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"telegram.js","sourceRoot":"","sources":["../../src/notify/telegram.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAA2B;IAC3C,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI;IAC7G,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;IAC/H,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI;IAChG,iBAAiB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI;IAC7G,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI;IACjG,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI;CAC9E,CAAC;AAEF,MAAM,eAAe,GAA2B;IAC9C,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,kBAAkB;CACtG,CAAC;AAEF,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,MAAc,EACd,SAAwB,EACxB,cAA6B,EAC7B,UAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,oBAAoB;QACpB,MAAM,UAAU,GAAkC,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACvC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,EAAE,MAAM;gBAAE,SAAS;YAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,UAAU,SAAS,CAAC,CAAC;YAC/D,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,aAAa,cAAc,CAAC,MAAM,uBAAuB,UAAU,SAAS,CAAC,CAAC;QACzF,KAAK,MAAM,CAAC,IAAI,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,QAAQ,cAAc,EAAE;YAC7E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;YACrH,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,9 +1,24 @@
 {
   "name": "@glassmkr/crucible",
-  "version": "0.7.1",
+  "version": "0.8.1",
   "description": "Lightweight bare metal server monitoring. IPMI, SMART, OS, network. Opinionated alerts.",
   "type": "module",
   "main": "./dist/index.js",
+  "exports": {
+    ".": "./dist/index.js",
+    "./api": {
+      "types": "./dist/api.d.ts",
+      "default": "./dist/api.js"
+    },
+    "./rule-ids.json": "./rule-ids.json",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "rule-ids.json",
+    "README.md",
+    "LICENSE"
+  ],
   "bin": {
     "glassmkr-crucible": "./dist/index.js"
   },

package/rule-ids.json

@@ -0,0 +1,29 @@
+{
+  "$comment": "Static, hand-maintained list of every rule ID this collector ships. Kept in sync with src/alerts/rules.ts (ALL_RULE_IDS). Published in the npm package so tooling can read it without dynamic-importing the CLI module. CI checks the two stay in sync.",
+  "version": 1,
+  "rule_ids": [
+    "ram_high",
+    "swap_high",
+    "disk_space_high",
+    "cpu_iowait_high",
+    "oom_kills",
+    "smart_failing",
+    "nvme_wear_high",
+    "raid_degraded",
+    "disk_latency_high",
+    "interface_errors",
+    "link_speed_mismatch",
+    "interface_saturation",
+    "cpu_temperature_high",
+    "ecc_errors",
+    "psu_redundancy_loss",
+    "ipmi_sel_critical",
+    "ipmi_fan_failure",
+    "ssh_root_password",
+    "no_firewall",
+    "pending_security_updates",
+    "kernel_vulnerabilities",
+    "kernel_needs_reboot",
+    "unattended_upgrades_disabled"
+  ]
+}

package/.dockerignore

@@ -1,13 +0,0 @@
-node_modules
-.git
-.github
-*.md
-!README.md
-.svelte-kit
-dist
-coverage
-.env*
-.vscode
-.idea
-*.log
-.DS_Store

package/.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,24 +0,0 @@
----
-name: Bug Report
-about: Something is not working as expected
----
-
-**Crucible version:** (check package.json or service logs)
-**OS and version:** (e.g., Ubuntu 24.04)
-**Kernel:** (output of `uname -r`)
-**Node.js version:** (output of `node --version`)
-**Running as root:** yes/no
-
-**What happened:**
-
-**What you expected:**
-
-**Service status:**
-```
-systemctl status glassmkr-crucible
-```
-
-**Last 50 log lines:**
-```
-journalctl -u glassmkr-crucible -n 50 --no-pager
-```

package/.github/ISSUE_TEMPLATE/no_data.md

@@ -1,26 +0,0 @@
----
-name: No Data in Forge
-about: Crucible is running but Forge shows no data
----
-
-**Crucible version:**
-**OS and version:**
-**How long since install:**
-
-**Can you reach Forge?**
-```
-curl -s -o /dev/null -w "%{http_code}" https://forge.glassmkr.com/api/health
-```
-
-**Service status:**
-```
-systemctl status glassmkr-crucible
-```
-
-**Last 50 log lines:**
-```
-journalctl -u glassmkr-crucible -n 50 --no-pager
-```
-
-**Is smartctl installed?** `which smartctl`
-**Is ipmitool installed?** `which ipmitool`

package/.github/workflows/docker.yml

@@ -1,53 +0,0 @@
-name: Build and publish Docker image
-
-on:
-  push:
-    branches: [main]
-    tags: ['v*']
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  docker:
-    name: Build and push to ghcr.io and docker.io
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: docker/setup-buildx-action@v3
-
-      - uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: docker/login-action@v3
-        with:
-          registry: docker.io
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - uses: docker/metadata-action@v5
-        id: meta
-        with:
-          images: |
-            ghcr.io/glassmkr/crucible
-            docker.io/glassmkr/crucible
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable={{is_default_branch}}
-            type=sha,prefix=sha-,format=short
-
-      - uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max

package/.github/workflows/publish.yml

@@ -1,25 +0,0 @@
-name: Publish to npm
-
-on:
-  push:
-    tags: ['v*']
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  publish:
-    name: npm publish
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          # Node 24 ships with npm 11.x which has working npm Trusted Publishing.
-          node-version: 24
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm --version
-      - run: npm install
-      - run: npm run build
-      - run: npm publish --access public --provenance

package/Dockerfile

@@ -1,59 +0,0 @@
-# syntax=docker/dockerfile:1.7
-# Multi-stage build for Glassmkr Crucible monitoring agent.
-
-# ---------- Stage 1: build TypeScript to dist/ ----------
-FROM node:24-slim AS builder
-WORKDIR /build
-COPY package.json package-lock.json* ./
-RUN npm install --include=dev --no-audit --no-fund
-COPY tsconfig.json ./
-COPY src ./src
-RUN npm run build
-
-# ---------- Stage 2: production runtime ----------
-FROM node:24-slim AS runtime
-
-# Hardware monitoring tools. Crucible shells out to these; they must be on PATH.
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    smartmontools \
-    ipmitool \
-    dmidecode \
-    lm-sensors \
-    ethtool \
-    util-linux \
-    procps \
-    net-tools \
-    iproute2 \
-    ca-certificates \
-  && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-
-# Production node_modules only.
-COPY package.json package-lock.json* ./
-RUN npm ci --omit=dev --no-audit --no-fund && npm cache clean --force
-
-# Built code.
-COPY --from=builder /build/dist ./dist
-
-# Create a non-root user for future use. IPMI and SMART typically require root,
-# so the container is expected to run with --privileged or cap_add DAC_READ_SEARCH etc.
-# Keeping the user available lets operators drop privileges when hardware access is not needed.
-RUN useradd --system --no-create-home --shell /usr/sbin/nologin glassmkr
-
-# Crucible reads /etc/glassmkr/collector.yaml by default.
-# Mount the host config directory at this path.
-RUN mkdir -p /etc/glassmkr
-
-# Container health: verify the Node process is actually running and hasn't crashed.
-HEALTHCHECK --interval=60s --timeout=10s --start-period=30s --retries=3 \
-  CMD pgrep -f "node /app/dist/index.js" > /dev/null || exit 1
-
-LABEL org.opencontainers.image.source="https://github.com/glassmkr/crucible" \
-      org.opencontainers.image.description="Glassmkr Crucible - bare metal server monitoring agent" \
-      org.opencontainers.image.licenses="MIT" \
-      org.opencontainers.image.title="Crucible" \
-      org.opencontainers.image.vendor="Glassmkr"
-
-# Crucible does not listen on any port; data flows outbound to Forge.
-ENTRYPOINT ["node", "/app/dist/index.js"]