@hienlh/ppm 0.18.8 → 0.18.10

package/src/services/edge-forwarder.ts

@@ -1,191 +1,191 @@
-/**
- * Edge forwarder — owns the public port and pipes raw TCP to the server's
- * current loopback port.
- *
- * ─── CRITICAL INVARIANT: THIS PROCESS MUST NEVER SPAWN A CHILD ───
- *
- * On Windows a child spawned with fd stdio inherits every inheritable handle,
- * including a listening socket. When such a descendant is orphaned it keeps the
- * socket open, so the port stays in LISTEN under a dead PID and can never be
- * rebound — a "zombie port". The server hits this constantly because it spawns
- * chat/tool/MCP subprocesses; those inherit its listener and wedge its port.
- *
- * The edge exists precisely because it spawns nothing, so its socket cannot be
- * inherited and its port cannot zombie. cloudflared can therefore stay pinned
- * to it forever and the public URL stops rotating. Adding any child-process
- * call to this file reintroduces the exact bug the edge was built to remove.
- *
- * Raw TCP, never HTTP: WebSocket upgrades and SSE streams pass through
- * untouched, and forwarded requests keep the headers cloudflared set.
- */
-import net from "node:net";
-import { resolveTargetPort, _resetTargetCache } from "./edge-target-resolver.ts";
-
-/** Delay between attempts while waiting for the server to come back. */
-const CONNECT_RETRY_MS = 250;
-/**
- * How long a client connection waits for a reachable server before giving up.
- * During an upgrade the server is briefly absent; refusing instantly would
- * surface as a broken page rather than a slow one.
- */
-const CONNECT_WINDOW_MS = 5000;
-
-const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
-
-/** Resolve once the socket is connected; reject on the first connect error. */
-function connectUpstream(port: number): Promise<net.Socket> {
-  return new Promise((resolvePromise, reject) => {
-    const upstream = net.connect({
-      port,
-      host: "127.0.0.1", // never taken from status.json — loopback only
-      allowHalfOpen: true,
-    });
-    const onError = (err: Error) => {
-      upstream.destroy();
-      reject(err);
-    };
-    upstream.once("error", onError);
-    upstream.once("connect", () => {
-      upstream.removeListener("error", onError);
-      resolvePromise(upstream);
-    });
-  });
-}
-
-/**
- * Largest amount of client data held while waiting for the server. Bounds the
- * memory a slow upload can pin during an upgrade window.
- */
-const MAX_PENDING_BYTES = 8 * 1024 * 1024;
-
-/**
- * Pipe one client connection to the server.
- *
- * Resolving the upstream is async, so the first bytes usually arrive before
- * there is anywhere to send them. They must be captured by a `data` listener
- * attached synchronously on this very tick and replayed once the upstream
- * exists.
- *
- * `socket.pause()` is NOT a substitute — verified against Bun 1.3.13: bytes
- * that arrive while paused are lost, and a later `pipe()`/`resume()` does not
- * bring them back. A socket with no `data` listener drops them outright too.
- * Both variants silently swallowed the first request in testing.
- */
-async function handleConnection(
-  client: net.Socket,
-  connectWindowMs: number,
-): Promise<void> {
-  const pending: Buffer[] = [];
-  let pendingBytes = 0;
-  let clientEnded = false;
-  const onEarlyData = (chunk: Buffer) => {
-    pendingBytes += chunk.length;
-    if (pendingBytes > MAX_PENDING_BYTES) {
-      client.destroy();
-      return;
-    }
-    pending.push(chunk);
-  };
-  client.on("data", onEarlyData);
-  client.once("end", () => { clientEnded = true; });
-
-  let upstream: net.Socket | null = null;
-  let clientGone = false;
-
-  // A socket error with no listener is an unhandled 'error' event, which would
-  // take the whole edge process — and the public port — down with it.
-  const teardown = () => {
-    upstream?.destroy();
-    client.destroy();
-  };
-  client.on("error", teardown);
-  client.once("close", () => { clientGone = true; });
-
-  const deadline = Date.now() + connectWindowMs;
-  while (!clientGone && Date.now() < deadline) {
-    const port = resolveTargetPort();
-    if (port !== null) {
-      try {
-        upstream = await connectUpstream(port);
-        break;
-      } catch {
-        // Server not up yet (or moved mid-restart) — re-resolve and retry.
-        _resetTargetCache();
-      }
-    }
-    await sleep(CONNECT_RETRY_MS);
-  }
-
-  if (clientGone) return;
-  if (!upstream) {
-    client.destroy();
-    return;
-  }
-
-  upstream.on("error", teardown);
-
-  // Replay what arrived during the connect, then hand both directions to the
-  // stream machinery. Removing the listener and piping happen in the same tick,
-  // so no chunk can slip through the gap.
-  client.off("data", onEarlyData);
-  for (const chunk of pending) upstream.write(chunk);
-  pending.length = 0;
-
-  client.pipe(upstream);
-  upstream.pipe(client);
-
-  // The client may have half-closed while we were still connecting.
-  if (clientEnded) upstream.end();
-}
-
-export interface EdgeForwarderOptions {
-  publicPort: number;
-  host?: string;
-  /** How long a client waits for a reachable server. Defaults to 5s. */
-  connectWindowMs?: number;
-}
-
-/**
- * Bind the public port and start forwarding. Resolves once listening so the
- * caller can fail fast when the port is unavailable.
- */
-export function startEdgeForwarder(
-  opts: EdgeForwarderOptions,
-): Promise<net.Server> {
-  const host = opts.host ?? "0.0.0.0";
-  const connectWindowMs = opts.connectWindowMs ?? CONNECT_WINDOW_MS;
-  return new Promise((resolvePromise, reject) => {
-    // allowHalfOpen keeps the other direction alive when one side sends FIN —
-    // long-lived chat WS and SSE streams depend on it.
-    const server = net.createServer({ allowHalfOpen: true }, (client) => {
-      void handleConnection(client, connectWindowMs);
-    });
-    server.once("error", reject);
-    server.listen(opts.publicPort, host, () => {
-      server.removeListener("error", reject);
-      resolvePromise(server);
-    });
-  });
-}
-
-// ─── Process entry ─────────────────────────────────────────────────────
-// Mirrors the `__serve__` guard in src/server/index.ts: the supervisor
-// re-invokes the binary as `<bin> __edge__ <publicPort> <host>`.
-if (process.argv.includes("__edge__")) {
-  const idx = process.argv.indexOf("__edge__");
-  const publicPort = parseInt(process.argv[idx + 1] ?? "", 10);
-  const host = process.argv[idx + 2] ?? "0.0.0.0";
-
-  if (!Number.isInteger(publicPort) || publicPort <= 0 || publicPort > 65535) {
-    process.stderr.write(`[edge] Invalid public port: ${process.argv[idx + 1]}\n`);
-    process.exit(2);
-  }
-
-  try {
-    await startEdgeForwarder({ publicPort, host });
-    process.stderr.write(`[edge] Listening on ${host}:${publicPort}\n`);
-  } catch (err) {
-    process.stderr.write(`[edge] Failed to bind ${host}:${publicPort}: ${err}\n`);
-    process.exit(1);
-  }
-}
+/**
+ * Edge forwarder — owns the public port and pipes raw TCP to the server's
+ * current loopback port.
+ *
+ * ─── CRITICAL INVARIANT: THIS PROCESS MUST NEVER SPAWN A CHILD ───
+ *
+ * On Windows a child spawned with fd stdio inherits every inheritable handle,
+ * including a listening socket. When such a descendant is orphaned it keeps the
+ * socket open, so the port stays in LISTEN under a dead PID and can never be
+ * rebound — a "zombie port". The server hits this constantly because it spawns
+ * chat/tool/MCP subprocesses; those inherit its listener and wedge its port.
+ *
+ * The edge exists precisely because it spawns nothing, so its socket cannot be
+ * inherited and its port cannot zombie. cloudflared can therefore stay pinned
+ * to it forever and the public URL stops rotating. Adding any child-process
+ * call to this file reintroduces the exact bug the edge was built to remove.
+ *
+ * Raw TCP, never HTTP: WebSocket upgrades and SSE streams pass through
+ * untouched, and forwarded requests keep the headers cloudflared set.
+ */
+import net from "node:net";
+import { resolveTargetPort, _resetTargetCache } from "./edge-target-resolver.ts";
+
+/** Delay between attempts while waiting for the server to come back. */
+const CONNECT_RETRY_MS = 250;
+/**
+ * How long a client connection waits for a reachable server before giving up.
+ * During an upgrade the server is briefly absent; refusing instantly would
+ * surface as a broken page rather than a slow one.
+ */
+const CONNECT_WINDOW_MS = 5000;
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/** Resolve once the socket is connected; reject on the first connect error. */
+function connectUpstream(port: number): Promise<net.Socket> {
+  return new Promise((resolvePromise, reject) => {
+    const upstream = net.connect({
+      port,
+      host: "127.0.0.1", // never taken from status.json — loopback only
+      allowHalfOpen: true,
+    });
+    const onError = (err: Error) => {
+      upstream.destroy();
+      reject(err);
+    };
+    upstream.once("error", onError);
+    upstream.once("connect", () => {
+      upstream.removeListener("error", onError);
+      resolvePromise(upstream);
+    });
+  });
+}
+
+/**
+ * Largest amount of client data held while waiting for the server. Bounds the
+ * memory a slow upload can pin during an upgrade window.
+ */
+const MAX_PENDING_BYTES = 8 * 1024 * 1024;
+
+/**
+ * Pipe one client connection to the server.
+ *
+ * Resolving the upstream is async, so the first bytes usually arrive before
+ * there is anywhere to send them. They must be captured by a `data` listener
+ * attached synchronously on this very tick and replayed once the upstream
+ * exists.
+ *
+ * `socket.pause()` is NOT a substitute — verified against Bun 1.3.13: bytes
+ * that arrive while paused are lost, and a later `pipe()`/`resume()` does not
+ * bring them back. A socket with no `data` listener drops them outright too.
+ * Both variants silently swallowed the first request in testing.
+ */
+async function handleConnection(
+  client: net.Socket,
+  connectWindowMs: number,
+): Promise<void> {
+  const pending: Buffer[] = [];
+  let pendingBytes = 0;
+  let clientEnded = false;
+  const onEarlyData = (chunk: Buffer) => {
+    pendingBytes += chunk.length;
+    if (pendingBytes > MAX_PENDING_BYTES) {
+      client.destroy();
+      return;
+    }
+    pending.push(chunk);
+  };
+  client.on("data", onEarlyData);
+  client.once("end", () => { clientEnded = true; });
+
+  let upstream: net.Socket | null = null;
+  let clientGone = false;
+
+  // A socket error with no listener is an unhandled 'error' event, which would
+  // take the whole edge process — and the public port — down with it.
+  const teardown = () => {
+    upstream?.destroy();
+    client.destroy();
+  };
+  client.on("error", teardown);
+  client.once("close", () => { clientGone = true; });
+
+  const deadline = Date.now() + connectWindowMs;
+  while (!clientGone && Date.now() < deadline) {
+    const port = resolveTargetPort();
+    if (port !== null) {
+      try {
+        upstream = await connectUpstream(port);
+        break;
+      } catch {
+        // Server not up yet (or moved mid-restart) — re-resolve and retry.
+        _resetTargetCache();
+      }
+    }
+    await sleep(CONNECT_RETRY_MS);
+  }
+
+  if (clientGone) return;
+  if (!upstream) {
+    client.destroy();
+    return;
+  }
+
+  upstream.on("error", teardown);
+
+  // Replay what arrived during the connect, then hand both directions to the
+  // stream machinery. Removing the listener and piping happen in the same tick,
+  // so no chunk can slip through the gap.
+  client.off("data", onEarlyData);
+  for (const chunk of pending) upstream.write(chunk);
+  pending.length = 0;
+
+  client.pipe(upstream);
+  upstream.pipe(client);
+
+  // The client may have half-closed while we were still connecting.
+  if (clientEnded) upstream.end();
+}
+
+export interface EdgeForwarderOptions {
+  publicPort: number;
+  host?: string;
+  /** How long a client waits for a reachable server. Defaults to 5s. */
+  connectWindowMs?: number;
+}
+
+/**
+ * Bind the public port and start forwarding. Resolves once listening so the
+ * caller can fail fast when the port is unavailable.
+ */
+export function startEdgeForwarder(
+  opts: EdgeForwarderOptions,
+): Promise<net.Server> {
+  const host = opts.host ?? "0.0.0.0";
+  const connectWindowMs = opts.connectWindowMs ?? CONNECT_WINDOW_MS;
+  return new Promise((resolvePromise, reject) => {
+    // allowHalfOpen keeps the other direction alive when one side sends FIN —
+    // long-lived chat WS and SSE streams depend on it.
+    const server = net.createServer({ allowHalfOpen: true }, (client) => {
+      void handleConnection(client, connectWindowMs);
+    });
+    server.once("error", reject);
+    server.listen(opts.publicPort, host, () => {
+      server.removeListener("error", reject);
+      resolvePromise(server);
+    });
+  });
+}
+
+// ─── Process entry ─────────────────────────────────────────────────────
+// Mirrors the `__serve__` guard in src/server/index.ts: the supervisor
+// re-invokes the binary as `<bin> __edge__ <publicPort> <host>`.
+if (process.argv.includes("__edge__")) {
+  const idx = process.argv.indexOf("__edge__");
+  const publicPort = parseInt(process.argv[idx + 1] ?? "", 10);
+  const host = process.argv[idx + 2] ?? "0.0.0.0";
+
+  if (!Number.isInteger(publicPort) || publicPort <= 0 || publicPort > 65535) {
+    process.stderr.write(`[edge] Invalid public port: ${process.argv[idx + 1]}\n`);
+    process.exit(2);
+  }
+
+  try {
+    await startEdgeForwarder({ publicPort, host });
+    process.stderr.write(`[edge] Listening on ${host}:${publicPort}\n`);
+  } catch (err) {
+    process.stderr.write(`[edge] Failed to bind ${host}:${publicPort}: ${err}\n`);
+    process.exit(1);
+  }
+}

package/src/services/proc-table-linux.ts

@@ -28,6 +28,9 @@ export interface ProcEntry {
   ppid: number;
   /** Average CPU% over the process lifetime — the same figure `ps %cpu` prints. */
   cpuPercent: number;
+  /** Cumulative CPU time (utime + stime), milliseconds. Diff two reads for an
+   *  instantaneous figure — `cpuPercent` is a lifetime average and never moves. */
+  cpuMs: number;
   rssKB: number;
   /** Seconds since the process started. */
   elapsedSec: number;
@@ -121,6 +124,7 @@ export function readProcTable(): ProcEntry[] | null {
       pid,
       ppid: f.ppid,
       cpuPercent: Math.round((cpuSec / elapsedSec) * 1000) / 10,
+      cpuMs: cpuSec * 1000,
       rssKB: f.rssPages * PAGE_SIZE_KB,
       elapsedSec,
       startedAtMs: bootTimeMs + startSec * 1000,

package/src/services/redact-secrets.ts

@@ -0,0 +1,33 @@
+/**
+ * Shared secret redactor for text that leaves the server: the public
+ * `/api/logs/recent` tail and process command lines in the metrics stream.
+ *
+ * Kept in one place so both consumers agree on what counts as a secret. Apply
+ * it BEFORE any truncation — secrets sit at the front of argv (`--token=…`,
+ * `postgres://user:pass@…`, `ANTHROPIC_API_KEY=… node x.js`), so truncating
+ * first would keep the secret and leave the redactor nothing to find.
+ *
+ * Rules: the six log-line forms (`Token: x`, `Bearer x`, `password: x`,
+ * `api_key: x`, `ANTHROPIC_API_KEY=x`, `secret: x`), then the argv forms —
+ * `key=value`, `--key value`, and URL userinfo `scheme://user:pass@host`.
+ */
+const RULES: ReadonlyArray<[RegExp, string]> = [
+  [/Token:\s*\S+/gi, "Token: [REDACTED]"],
+  [/Bearer\s+\S+/gi, "Bearer [REDACTED]"],
+  [/password['":\s]+\S+/gi, "password: [REDACTED]"],
+  [/api[_-]?key['":\s]+\S+/gi, "api_key: [REDACTED]"],
+  [/ANTHROPIC_API_KEY=\S+/gi, "ANTHROPIC_API_KEY=[REDACTED]"],
+  [/secret['":\s]+\S+/gi, "secret: [REDACTED]"],
+  // argv `--token=abc`, `API_KEY=abc`, `DB_PASSWORD=abc`.
+  [/((?:token|api[_-]?key|secret|password)=)\S+/gi, "$1[REDACTED]"],
+  // argv space form `--token abc`, `-p abc` is too ambiguous and is left alone.
+  [/(--?(?:token|api[_-]?key|secret|password)\s+)\S+/gi, "$1[REDACTED]"],
+  // URL userinfo `postgres://user:pass@host` → keep the user, drop the password.
+  [/(:\/\/[^/\s:@]+:)[^@\s]+@/g, "$1[REDACTED]@"],
+];
+
+export function redactSecrets(text: string): string {
+  let out = text;
+  for (const [re, replacement] of RULES) out = out.replace(re, replacement);
+  return out;
+}

package/src/services/system-metrics/cpu-memory-collector.ts

@@ -0,0 +1,101 @@
+/**
+ * Whole-machine CPU + memory from `node:os`. Runs in both tiers, spawns nothing.
+ */
+import os from "node:os";
+import { readFileSync } from "node:fs";
+import type { CpuMetrics, MemoryMetrics } from "../../types/system-metrics.ts";
+
+export interface CoreTimes {
+  user: number;
+  nice: number;
+  sys: number;
+  idle: number;
+  irq: number;
+}
+
+export interface CpuTimesSample {
+  times: CoreTimes[];
+  /** Wall clock of the sample, epoch ms. */
+  at: number;
+  model: string;
+}
+
+/**
+ * Read `os.cpus()` and copy the numbers out immediately. Bun 1.3.10 on Windows
+ * returns the SAME `times` on a later call while the array from the previous
+ * call is still referenced — the delta then reads 0 % forever, with no error
+ * anywhere. Keeping only plain copies between ticks avoids it.
+ */
+export function sampleCpuTimes(now: number = Date.now()): CpuTimesSample {
+  const cpus = os.cpus();
+  const times = cpus.map((c) => ({ ...c.times }));
+  return { times, at: now, model: cpus[0]?.model?.trim() ?? "" };
+}
+
+const round1 = (n: number): number => Math.round(n * 10) / 10;
+
+/** Busy % total + per core between two samples. Pure. First sample → all zeros. */
+export function computeCpuFromSamples(prev: CpuTimesSample | null, next: CpuTimesSample): CpuMetrics {
+  const zeros: CpuMetrics = { total: 0, cores: next.times.map(() => 0), model: next.model };
+  if (!prev || prev.times.length !== next.times.length) return zeros;
+
+  let busySum = 0;
+  let totalSum = 0;
+  const cores = next.times.map((n, i) => {
+    const p = prev.times[i]!;
+    const idle = n.idle - p.idle;
+    const total = (n.user - p.user) + (n.nice - p.nice) + (n.sys - p.sys) + idle + (n.irq - p.irq);
+    if (!(total > 0)) return 0;
+    busySum += total - idle;
+    totalSum += total;
+    return clampPercent((total - idle) / total * 100);
+  });
+  const total = totalSum > 0 ? clampPercent(busySum / totalSum * 100) : 0;
+  return { total, cores, model: next.model };
+}
+
+function clampPercent(v: number): number {
+  if (!Number.isFinite(v)) return 0;
+  return round1(Math.min(100, Math.max(0, v)));
+}
+
+/** Read `/proc/meminfo` on Linux, null elsewhere or on failure. Injectable for tests. */
+export function readMeminfo(): string | null {
+  if (process.platform !== "linux") return null;
+  try {
+    return readFileSync("/proc/meminfo", "utf-8");
+  } catch {
+    return null;
+  }
+}
+
+/** `MemAvailable` in bytes from a `/proc/meminfo` dump, or null when absent. */
+export function parseMemAvailableBytes(meminfo: string): number | null {
+  const m = /^MemAvailable:\s+(\d+)\s*kB/m.exec(meminfo);
+  if (!m) return null;
+  const kb = Number(m[1]);
+  return Number.isFinite(kb) ? kb * 1024 : null;
+}
+
+/**
+ * `os.totalmem()` matches `Win32_OperatingSystem.TotalVisibleMemorySize` exactly
+ * and `os.freemem()` is within 0.2 GiB of CIM's `FreePhysicalMemory`. On Linux
+ * `freemem()` is `MemFree`, which makes a warm page cache look like a nearly
+ * full machine — `MemAvailable` is what `free` and Task-Manager-like tools show.
+ */
+export function collectMemory(meminfo: () => string | null = readMeminfo): MemoryMetrics {
+  const totalBytes = os.totalmem();
+  let availableBytes = os.freemem();
+  const info = meminfo();
+  if (info) {
+    const avail = parseMemAvailableBytes(info);
+    if (avail !== null) availableBytes = avail;
+  }
+  availableBytes = Math.min(Math.max(availableBytes, 0), totalBytes);
+  const MB = 1024 * 1024;
+  const totalMB = round1(totalBytes / MB);
+  const availableMB = round1(availableBytes / MB);
+  const usedMB = round1(Math.max(totalMB - availableMB, 0));
+  const percent = totalMB > 0 ? round1(usedMB / totalMB * 100) : 0;
+  return { totalMB, usedMB, availableMB, percent };
+}

package/src/services/system-metrics/disk-net-collector-darwin.ts

@@ -0,0 +1,75 @@
+/**
+ * macOS disk + net cumulative counters via `ioreg` and `netstat -ib`.
+ * Runner-injected; parsers are pure. UNVERIFIED on real macOS hardware — on any
+ * parse failure the result is `null` (→ `available:false` + warning), never 0.
+ */
+import type { Runner } from "../host-info/spawn-runner.ts";
+import { defaultRunner } from "../host-info/spawn-runner.ts";
+import type { CounterSample } from "./rate-delta.ts";
+import type { DiskNetCounters } from "./disk-net-collector-linux.ts";
+
+/** Sum every `"Bytes (Read)"=N` / `"Bytes (Write)"=N` pair from `ioreg -rc IOBlockStorageDriver -w0`. */
+export function parseIoregBytes(text: string): { inBytes: number; outBytes: number } | null {
+  let read = 0;
+  let written = 0;
+  let matched = false;
+  for (const m of text.matchAll(/"Bytes \((Read|Write)\)"\s*=\s*(\d+)/g)) {
+    const n = Number(m[2]);
+    if (!Number.isFinite(n)) continue;
+    matched = true;
+    if (m[1] === "Read") read += n;
+    else written += n;
+  }
+  return matched ? { inBytes: read, outBytes: written } : null;
+}
+
+/**
+ * `netstat -ib` repeats an interface once per address family; only the
+ * `<Link#N>` row (the first per interface) carries the hardware counters, so
+ * summing every row would double-count. The Address column is blank on some
+ * virtual interfaces, so Ibytes/Obytes are located from the right-hand end.
+ */
+export function parseNetstatIb(text: string): { inBytes: number; outBytes: number } | null {
+  let rx = 0;
+  let tx = 0;
+  let matched = false;
+  const seen = new Set<string>();
+  for (const line of text.split("\n")) {
+    const f = line.trim().split(/\s+/);
+    if (f.length < 10) continue;
+    const iface = f[0]!;
+    if (iface === "Name" || iface.startsWith("lo") || seen.has(iface)) continue;
+    if (!(f[2] ?? "").startsWith("<Link#")) continue;
+    const ibytes = Number(f[f.length - 5]);
+    const obytes = Number(f[f.length - 2]);
+    if (!Number.isFinite(ibytes) || !Number.isFinite(obytes)) continue;
+    seen.add(iface);
+    matched = true;
+    rx += ibytes;
+    tx += obytes;
+  }
+  return matched ? { inBytes: rx, outBytes: tx } : null;
+}
+
+export async function collectDarwinDiskNet(run: Runner = defaultRunner, now: () => number = Date.now): Promise<DiskNetCounters> {
+  const warnings: string[] = [];
+  const atSec = now() / 1000;
+  let disk: CounterSample | null = null;
+  let net: CounterSample | null = null;
+
+  try {
+    const r = await run(["ioreg", "-rc", "IOBlockStorageDriver", "-w0"], 3000);
+    const parsed = r.code === 0 ? parseIoregBytes(r.stdout) : null;
+    if (parsed) disk = { ...parsed, atSec };
+  } catch { /* fall through to the warning */ }
+  if (!disk) warnings.push("Disk throughput unavailable: ioreg IOBlockStorageDriver statistics not readable");
+
+  try {
+    const r = await run(["netstat", "-ib"], 3000);
+    const parsed = r.code === 0 ? parseNetstatIb(r.stdout) : null;
+    if (parsed) net = { ...parsed, atSec };
+  } catch { /* fall through to the warning */ }
+  if (!net) warnings.push("Network throughput unavailable: netstat -ib not readable");
+
+  return { disk, net, warnings };
+}