@kvbox/server 0.5.9 → 0.5.11

package/dist/kvbox-server.js

@@ -292,6 +292,8 @@ var ConfigSchema = z2.object({
   /** Who boxes made over the local socket belong to: the Unix user running the server unless set here. No `@`, no `/`. */
   owner: z2.string().regex(LOCAL_OWNER_RE, "owner: letters, digits, '.', '_', '-'; no '@' or '/'").default(localOwner),
   pricing: PricingSchema.optional(),
+  /** What a new box gets when `new` does not say (#47): seconds without network traffic before it is hibernated; 0: never. */
+  autoHibernateSec: z2.number().int().min(0).default(0),
   /** Absent until the host joins a control plane; then the server also listens on HTTPS. */
   controlPlane: ControlPlaneSchema.optional(),
   /** Absent unless the host sits behind a relay. */
@@ -370,7 +372,9 @@ var MachineSchema = z3.object({
    */
   ssh: z3.object({ host: z3.string(), port: z3.number().int(), user: z3.string() }).optional(),
   /** Whether the owner slug is a user or an org. Only the control plane knows; it fills it in on `GET /machines`. */
-  ownerKind: z3.enum(["user", "org"]).optional()
+  ownerKind: z3.enum(["user", "org"]).optional(),
+  /** Seconds without network traffic before the host hibernates the box (#47). Absent: never. */
+  autoHibernateSec: z3.number().int().positive().optional()
 });
 var CreateMachineRequest = z3.object({
   name: z3.string().optional(),
@@ -384,7 +388,9 @@ var CreateMachineRequest = z3.object({
    * its SSH CA as one `cert-authority …` line (#51). Written into the box's authorized_keys at every
    * boot (#49); a host older than that ignores them.
    */
-  sshKeys: z3.array(z3.string()).optional()
+  sshKeys: z3.array(z3.string()).optional(),
+  /** Seconds without network traffic before the box is hibernated (#47); 0: never. Absent: the host's default. */
+  autoHibernateSec: z3.number().int().min(0).optional()
 });
 var SetSshKeysRequest = z3.object({
   sshKeys: z3.array(z3.string())
@@ -395,6 +401,10 @@ var RescaleMachineRequest = z3.object({
   memMib: z3.number().int().min(256).optional(),
   diskGib: z3.number().int().min(1).optional()
 });
+var SetMachineRequest = z3.object({
+  /** Seconds without network traffic before the box is hibernated (#47); 0: never. */
+  autoHibernateSec: z3.number().int().min(0).optional()
+});
 var SnapshotSchema = z3.object({
   name: z3.string(),
   owner: z3.string(),
@@ -447,7 +457,10 @@ var HealthSchema = z3.object({
     /** The public IP the relay owns for this host. */
     publicIp: z3.string(),
     /** The relay's WireGuard endpoint the tunnel dials. */
-    endpoint: z3.string()
+    endpoint: z3.string(),
+    /** Times the server redialed the tunnel since it started, because the relay stopped answering. Older servers omit them. */
+    restarts: z3.number().int().optional(),
+    lastRestartAt: z3.string().nullable().optional()
   }).nullable().optional(),
   /** Boxes brought back at the server's last start; null when there were none or it is still at it. Older servers omit it. */
   recovery: RecoveryReportSchema.nullable().optional()
@@ -471,6 +484,23 @@ var MachineUsageSchema = z3.object({
   estimatedStops: z3.number().int(),
   historyFrom: z3.string().nullable()
 });
+var GuestStatsSchema = z3.object({
+  /** Load average over 1, 5 and 15 minutes. */
+  load: z3.tuple([z3.number(), z3.number(), z3.number()]),
+  cpus: z3.number().int(),
+  memTotalMib: z3.number().int(),
+  /** Total minus available: page cache counts as free. */
+  memUsedMib: z3.number().int(),
+  /** The box's root, which is its overlay disk: the box's own writes, not the shared base. */
+  diskTotalBytes: z3.number().int(),
+  diskUsedBytes: z3.number().int(),
+  uptimeSec: z3.number().int()
+});
+var MachineStatsSchema = z3.object({
+  name: z3.string(),
+  owner: z3.string(),
+  stats: GuestStatsSchema.nullable()
+});
 var UsageStatusSchema = z3.enum([...BoxStatusSchema.options, "removed"]);
 var BoxUsageSchema = MachineUsageSchema.omit({ window: true, status: true }).extend({
   /** The host's box id; a name removed and recreated appears twice, with two ids. */
@@ -930,7 +960,13 @@ function setIdentity(udsPath, id, timeoutMs) {
 function setAuthorizedKeys(udsPath, lines, timeoutMs) {
   return agentCall(udsPath, { op: "authorizedKeys", lines: [...lines] }, timeoutMs);
 }
+async function stats(udsPath, timeoutMs) {
+  const reply = GuestStatsSchema.safeParse(await agentCall(udsPath, { op: "stats" }, timeoutMs));
+  if (!reply.success) throw new KvboxError(`kvbox-agent sent stats kvbox does not understand: ${reply.error.issues[0]?.message ?? "invalid"}`);
+  return reply.data;
+}
 var isUnknownOp = (err) => /unknown op/.test(err.message ?? "");
+var isNoAgent = (err) => /vsock connect refused|vsock connection closed before the guest accepted|kvbox-agent unreachable: connect (ENOENT|ECONNREFUSED)/.test(err.message ?? "");
 
 // src/core/capacity.ts
 import { cpus, totalmem } from "node:os";
@@ -986,7 +1022,9 @@ var MachineMetaSchema = z4.object({
    */
   sshKeysStale: z4.boolean().optional(),
   /** Public port on the host DNATed to the box's SSH while it runs (#49); fixed for the box's life. Absent: none. */
-  sshPort: z4.number().int().optional()
+  sshPort: z4.number().int().optional(),
+  /** Seconds without traffic on the box's tap before the server hibernates it (#47, core/idle.ts). Absent: never. */
+  autoHibernateSec: z4.number().int().positive().optional()
 });
 function newBoxId(taken) {
   for (; ; ) {
@@ -1250,6 +1288,33 @@ function usageEventsInScope(scope, window, p = paths()) {
   return rows.filter((r) => inScope(r.owner, scope)).map(withId);
 }
 
+// src/core/locks.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var tails = /* @__PURE__ */ new Map();
+var held = new AsyncLocalStorage();
+async function withBoxLock(ref, fn) {
+  const key = refKey(ref);
+  const mine = held.getStore();
+  if (mine?.has(key)) return fn();
+  const previous = tails.get(key);
+  let release;
+  const tail = new Promise((resolve) => release = resolve);
+  tails.set(key, tail);
+  try {
+    await previous;
+    return await held.run(/* @__PURE__ */ new Set([...mine ?? [], key]), fn);
+  } finally {
+    release();
+    if (tails.get(key) === tail) tails.delete(key);
+  }
+}
+function boxBusy(ref) {
+  return tails.has(refKey(ref));
+}
+function locked(fn) {
+  return (...args) => withBoxLock(args[0], () => fn(...args));
+}
+
 // src/core/firecracker.ts
 import { Agent, request as request2 } from "undici";
 var FirecrackerClient = class {
@@ -1549,9 +1614,13 @@ function toMachine(meta, p = paths()) {
     createdAt: meta.createdAt,
     source: meta.source,
     status: statusOf(meta, p),
-    ...meta.sshPort === void 0 ? {} : { sshPort: meta.sshPort }
+    ...meta.sshPort === void 0 ? {} : { sshPort: meta.sshPort },
+    ...meta.autoHibernateSec ? { autoHibernateSec: meta.autoHibernateSec } : {}
   };
 }
+function autoHibernateFor(req, cfg) {
+  return (req.autoHibernateSec ?? cfg.autoHibernateSec) || void 0;
+}
 async function readAllMeta(p) {
   const metas = [];
   for (const ref of await listMachineRefs(p)) {
@@ -1774,7 +1843,7 @@ async function createMachine(req, owner, p = paths()) {
     const spec = { id, name, owner, ip, mac, vcpu: size.vcpu, memMib: size.memMib, base: base.version, sshKeys, sshPort };
     pid = await launch(spec, tap, cfg, keysB64, p);
     await openSshPort(spec, cfg);
-    const meta = { ...spec, pid, bootId: currentBootId(), createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: "base" };
+    const meta = { ...spec, pid, bootId: currentBootId(), createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: "base", autoHibernateSec: autoHibernateFor(req, cfg) };
     await writeMachineMeta(meta, p);
     recordState(meta, "running", "new", p, meta.createdAt);
     return toMachine(meta, p);
@@ -1838,7 +1907,7 @@ async function restoreMachine(fromText, owner, req, cfg, p) {
     const stale = await pushAuthorizedKeys({ owner, name, sshKeys }, m.vsock, p);
     await attachTap(id, cfg);
     await openSshPort(spec, cfg);
-    const meta = { ...spec, pid, bootId: currentBootId(), createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: `snapshot:${refKey(from)}`, memSnapshots: 1, sshKeysStale: stale ? true : void 0 };
+    const meta = { ...spec, pid, bootId: currentBootId(), createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: `snapshot:${refKey(from)}`, memSnapshots: 1, sshKeysStale: stale ? true : void 0, autoHibernateSec: autoHibernateFor(req, cfg) };
     await writeMachineMeta(meta, p);
     recordState(meta, "running", "new", p, meta.createdAt);
     return toMachine(meta, p);
@@ -1919,7 +1988,7 @@ async function cleanupProcess(meta, cfg, p) {
   await rm(m.sock, { force: true });
   await rm(m.vsock, { force: true });
 }
-async function stopMachine(ref, p = paths()) {
+var stopMachine = locked(async function stopMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   const m = p.machine(ref.owner, ref.name);
@@ -1931,8 +2000,8 @@ async function stopMachine(ref, p = paths()) {
   await writeMachineMeta(stopped, p);
   recordState(stopped, "stopped", "stop", p);
   return toMachine(stopped, p);
-}
-async function startMachine(ref, p = paths()) {
+});
+var startMachine = locked(async function startMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   if (vmAlive(meta)) throw new KvboxError(`box ${shown(ref)} is already ${meta.paused ? "up, in standby (kvbox resume " + shown(ref) + ")" : "running"}`);
@@ -1957,15 +2026,15 @@ async function startMachine(ref, p = paths()) {
     await deleteTap(meta.id, cfg).catch(() => void 0);
     throw err;
   }
-}
-async function setSshKeys(ref, sshKeys, p = paths()) {
+});
+var setSshKeys = locked(async function setSshKeys2(ref, sshKeys, p = paths()) {
   const meta = await readMeta(ref, p);
   if (!isCloudBox(meta.owner)) throw new KvboxError(`box ${shown(ref)} is local: it trusts this host's key, there are no authorized_keys lines to replace`);
   if (sshKeys.length === 0) throw new KvboxError("sshKeys: at least one authorized_keys line (the box would keep only the host's own key)");
   authorizedKeysB64(await readHostPubkey(p), sshKeys);
   const { meta: updated, applied } = await applySshKeys(meta, sshKeys, p);
   return { machine: toMachine(updated, p), applied };
-}
+});
 async function applySshKeys(meta, sshKeys, p) {
   const status = statusOf(meta, p);
   let updated = { ...meta, sshKeys: [...sshKeys], sshKeysStale: status === "stopped" ? void 0 : true };
@@ -1983,27 +2052,30 @@ async function applySshKeys(meta, sshKeys, p) {
 }
 async function trustCa(publicKeyText, p = paths()) {
   const publicKey = parseSshPublicKey(publicKeyText);
-  const report = { publicKey, fingerprint: sshKeyFingerprint(publicKey), updated: [], pending: [], failed: [], local: 0 };
+  const report2 = { publicKey, fingerprint: sshKeyFingerprint(publicKey), updated: [], pending: [], failed: [], local: 0 };
   const hostKey = await readHostPubkey(p);
-  for (const meta of await readAllMeta(p)) {
-    if (!isCloudBox(meta.owner)) {
-      report.local++;
+  for (const listed of await readAllMeta(p)) {
+    if (!isCloudBox(listed.owner)) {
+      report2.local++;
       continue;
     }
-    const box = refKey(meta);
+    const box = refKey(listed);
     try {
-      const sshKeys = [...(meta.sshKeys ?? []).filter((l) => !isCaLine(l)), caLineFor(meta.owner, publicKey)];
-      authorizedKeysLines(hostKey, sshKeys);
-      const { applied, why } = await applySshKeys(meta, sshKeys, p);
-      if (applied === "now") report.updated.push(box);
-      else report.pending.push(why === void 0 ? { box, when: applied } : { box, when: applied, why });
+      await withBoxLock(listed, async () => {
+        const meta = await readMeta(listed, p);
+        const sshKeys = [...(meta.sshKeys ?? []).filter((l) => !isCaLine(l)), caLineFor(meta.owner, publicKey)];
+        authorizedKeysLines(hostKey, sshKeys);
+        const { applied, why } = await applySshKeys(meta, sshKeys, p);
+        if (applied === "now") report2.updated.push(box);
+        else report2.pending.push(why === void 0 ? { box, when: applied } : { box, when: applied, why });
+      });
     } catch (err) {
-      report.failed.push({ box, error: err.message });
+      report2.failed.push({ box, error: err.message });
     }
   }
-  return report;
+  return report2;
 }
-async function pauseMachine(ref, p = paths()) {
+var pauseMachine = locked(async function pauseMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const status = statusOf(meta, p);
   if (status === "standby") throw new KvboxError(`${stateMessage(ref, status)} already`);
@@ -2019,8 +2091,8 @@ async function pauseMachine(ref, p = paths()) {
   await writeMachineMeta(paused, p);
   recordState(paused, "standby", "pause", p);
   return toMachine(paused, p);
-}
-async function resumeMachine(ref, p = paths()) {
+});
+var resumeMachine = locked(async function resumeMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const status = statusOf(meta, p);
   if (status === "running") throw new KvboxError(`${stateMessage(ref, status)} already`);
@@ -2033,8 +2105,8 @@ async function resumeMachine(ref, p = paths()) {
   await writeMachineMeta(running, p);
   recordState(running, "running", "resume", p);
   return toMachine(running, p);
-}
-async function hibernateMachine(ref, p = paths()) {
+});
+var hibernateMachine = locked(async function hibernateMachine2(ref, p = paths(), by = "hibernate") {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   const status = statusOf(meta, p);
@@ -2063,10 +2135,10 @@ async function hibernateMachine(ref, p = paths()) {
   await rm(m.memBase, { force: true });
   const hibernated = { ...meta, pid: null, memSnapshots: void 0, paused: void 0 };
   await writeMachineMeta(hibernated, p);
-  recordState(hibernated, "hibernated", "hibernate", p);
+  recordState(hibernated, "hibernated", by, p);
   return toMachine(hibernated, p);
-}
-async function wakeMachine(ref, p = paths()) {
+});
+var wakeMachine = locked(async function wakeMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   const status = statusOf(meta, p);
@@ -2105,7 +2177,7 @@ async function wakeMachine(ref, p = paths()) {
   await writeMachineMeta(running, p);
   recordState(running, "running", "wake", p);
   return toMachine(running, p);
-}
+});
 async function applyAtNextBoot(meta, changes, by, cfg, p, whileStopped) {
   const wasRunning = vmAlive(meta);
   if (wasRunning) {
@@ -2123,7 +2195,7 @@ function assertNotHibernated(meta, p) {
     throw new KvboxError(`${stateMessage(meta, "hibernated")}; its memory image was made with its current shape and base: kvbox wake ${shown(meta)} first`);
   }
 }
-async function updateMachine(ref, p = paths()) {
+var updateMachine = locked(async function updateMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   assertNotHibernated(meta, p);
@@ -2132,8 +2204,8 @@ async function updateMachine(ref, p = paths()) {
   if (base.version === meta.base) return toMachine(meta, p);
   await assertOverlayCapable(base.file, base.version);
   return applyAtNextBoot(meta, { base: base.version }, "update", cfg, p);
-}
-async function rescaleMachine(ref, req, p = paths()) {
+});
+var rescaleMachine = locked(async function rescaleMachine2(ref, req, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   assertNotHibernated(meta, p);
@@ -2154,7 +2226,14 @@ async function rescaleMachine(ref, req, p = paths()) {
   const growTo = target.diskGib > currentDiskGib ? target.diskGib : void 0;
   if (Object.keys(changes).length === 0 && growTo === void 0) return toMachine(meta, p);
   return applyAtNextBoot(meta, changes, "rescale", cfg, p, growTo === void 0 ? void 0 : () => growDisk(disk, growTo));
-}
+});
+var setMachine = locked(async function setMachine2(ref, req, p = paths()) {
+  const meta = await readMeta(ref, p);
+  const next = { ...meta };
+  if (req.autoHibernateSec !== void 0) next.autoHibernateSec = req.autoHibernateSec || void 0;
+  await writeMachineMeta(next, p);
+  return toMachine(next, p);
+});
 async function growDisk(file, gib) {
   await truncate(file, gib * 1024 ** 3);
   await run(["e2fsck", "-f", "-p", file], { okExitCodes: [1] });
@@ -2168,13 +2247,13 @@ async function readMeta(ref, p) {
     throw err;
   }
 }
-async function destroyMachine(ref, p = paths()) {
+var destroyMachine = locked(async function destroyMachine2(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   await shutdown(meta, cfg, p, 2e3);
   recordState(meta, "stopped", "rm", p);
   await rm(p.machine(ref.owner, ref.name).dir, { recursive: true, force: true });
-}
+});
 var RECOVERY_CONCURRENCY = 2;
 async function settleDeadBoxes(p = paths()) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -2323,8 +2402,156 @@ async function dropRelay(p = paths()) {
   return relay;
 }
 
+// src/core/idle.ts
+import { readFile as readFile6 } from "node:fs/promises";
+var HIBERNATE_CONCURRENCY = 2;
+async function tapTraffic(id) {
+  const dir = `/sys/class/net/${tapName(id)}/statistics`;
+  try {
+    const [rx, tx] = await Promise.all([readFile6(`${dir}/rx_bytes`, "utf8"), readFile6(`${dir}/tx_bytes`, "utf8")]);
+    return Number(rx) + Number(tx);
+  } catch {
+    return null;
+  }
+}
+async function hibernateIfRunning(box, p) {
+  const ref = { owner: box.owner, name: box.name };
+  return withBoxLock(ref, async () => {
+    if ((await getMachine(ref, p)).status !== "running") return false;
+    await hibernateMachine(ref, p, "auto-hibernate");
+    return true;
+  });
+}
+function startIdleWatch(opts = {}) {
+  const intervalMs = opts.intervalMs ?? 6e4;
+  const p = opts.p ?? paths();
+  const list = opts.list ?? (() => listMachines(null, p));
+  const traffic = opts.traffic ?? tapTraffic;
+  const hibernate = opts.hibernate ?? ((box) => hibernateIfRunning(box, p));
+  const busy = opts.busy ?? ((box) => boxBusy(box));
+  const now = opts.now ?? Date.now;
+  const log = opts.log ?? ((line) => console.log(line));
+  const seen = /* @__PURE__ */ new Map();
+  let timer;
+  let stopped = false;
+  const inflight = /* @__PURE__ */ new Set();
+  const hibernateOne = async (box, quiet, bytes, t) => {
+    inflight.add(box.id);
+    try {
+      if (await hibernate(box)) log(`box ${box.owner}/${box.name}: no network traffic for ${quiet} min; hibernated it (kvbox connect wakes it)`);
+      seen.delete(box.id);
+    } catch (err) {
+      log(`warning: box ${box.owner}/${box.name}: could not hibernate it after ${quiet} min without traffic: ${err.message}`);
+      seen.set(box.id, { bytes, since: t });
+    } finally {
+      inflight.delete(box.id);
+    }
+  };
+  const check = async () => {
+    const started = [];
+    const watched = /* @__PURE__ */ new Set();
+    for (const box of await list()) {
+      if (!box.autoHibernateSec || box.status !== "running") continue;
+      if (inflight.has(box.id)) {
+        watched.add(box.id);
+        continue;
+      }
+      const bytes = await traffic(box.id);
+      if (bytes === null) continue;
+      watched.add(box.id);
+      const t = now();
+      const last = seen.get(box.id);
+      if (!last || last.bytes !== bytes || busy(box)) {
+        seen.set(box.id, { bytes, since: t });
+        continue;
+      }
+      if (t - last.since < box.autoHibernateSec * 1e3) continue;
+      if (inflight.size >= HIBERNATE_CONCURRENCY) continue;
+      started.push(hibernateOne(box, Math.round((t - last.since) / 6e4), bytes, t));
+    }
+    for (const id of seen.keys()) if (!watched.has(id)) seen.delete(id);
+    return started;
+  };
+  const round2 = async () => {
+    await Promise.all(await check());
+  };
+  const schedule = () => {
+    if (stopped) return;
+    timer = setTimeout(() => void check().catch((err) => log(`warning: idle watch: ${err.message}`)).finally(schedule), intervalMs);
+    timer.unref();
+  };
+  schedule();
+  return {
+    stop: () => {
+      stopped = true;
+      clearTimeout(timer);
+    },
+    round: round2
+  };
+}
+
+// src/core/relayWatch.ts
+var report = { restarts: 0, lastRestartAt: null };
+function relayWatchReport() {
+  return report;
+}
+async function pingRelay() {
+  try {
+    await run(["ping", "-c", "1", "-W", "3", RELAY_TUNNEL_GATEWAY], { timeoutMs: 5e3 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function startRelayWatch(opts = {}) {
+  const intervalMs = opts.intervalMs ?? 3e4;
+  const misses = opts.misses ?? 3;
+  const probe = opts.probe ?? pingRelay;
+  const p = opts.p ?? paths();
+  const log = opts.log ?? ((line) => console.log(line));
+  const restart = opts.restart ?? (async () => netSetup(await loadConfig(p), ["relay", "restart"]));
+  report = { restarts: 0, lastRestartAt: null };
+  let missed = 0;
+  let stuck = false;
+  let timer;
+  let stopped = false;
+  const round2 = async () => {
+    const cfg = await loadConfig(p).catch(() => null);
+    if (!cfg?.relay) {
+      missed = 0;
+      return;
+    }
+    if (await probe()) {
+      if (stuck) log(`relay ${cfg.relay.name}: the tunnel carries traffic again`);
+      missed = 0;
+      stuck = false;
+      return;
+    }
+    if (++missed < misses) return;
+    missed = 0;
+    if (!stuck) log(`relay ${cfg.relay.name}: no answer through the tunnel for ${misses * intervalMs / 1e3} s; restarting it`);
+    try {
+      await restart();
+      report = { restarts: report.restarts + 1, lastRestartAt: (/* @__PURE__ */ new Date()).toISOString() };
+    } catch (err) {
+      if (!stuck) console.error(`warning: relay ${cfg.relay.name}: could not restart the tunnel: ${err.message}`);
+    }
+    stuck = true;
+  };
+  const schedule = () => {
+    if (stopped) return;
+    timer = setTimeout(() => void round2().catch((err) => console.error(`warning: relay watch: ${err.message}`)).finally(schedule), intervalMs);
+    timer.unref();
+  };
+  schedule();
+  return () => {
+    stopped = true;
+    clearTimeout(timer);
+  };
+}
+
 // src/listen.ts
-import { readFile as readFile6, rm as rm4, writeFile as writeFile5 } from "node:fs/promises";
+import { readFile as readFile7, rm as rm4, writeFile as writeFile5 } from "node:fs/promises";
 import { createServer as createHttpsServer } from "node:https";
 import { createAdaptorServer } from "@hono/node-server";
 
@@ -2344,7 +2571,7 @@ function versionOf(srcFileUrl, injected) {
 }
 
 // src/version.ts
-var VERSION = versionOf(import.meta.url, true ? "0.5.9" : void 0);
+var VERSION = versionOf(import.meta.url, true ? "0.5.11" : void 0);
 
 // src/caller.ts
 import { createHash as createHash2, timingSafeEqual } from "node:crypto";
@@ -2396,6 +2623,19 @@ function capacityRoutes() {
 // src/routes/machines.ts
 import { Hono as Hono2 } from "hono";
 
+// src/core/stats.ts
+var STATS_REPLY_MS = 3e3;
+async function machineStats(ref, p = paths()) {
+  const m = await getMachine(ref, p);
+  if (m.status !== "running") throw new KvboxError(`${stateMessage(ref, m.status)}; only a running box can say how it is doing`);
+  try {
+    return { name: m.name, owner: m.owner, stats: await stats(p.machine(m.owner, m.name).vsock, STATS_REPLY_MS) };
+  } catch (err) {
+    if (isUnknownOp(err) || isNoAgent(err)) return { name: m.name, owner: m.owner, stats: null };
+    throw err;
+  }
+}
+
 // src/core/usage.ts
 async function machineUsage(ref, since, p = paths()) {
   const box = await getMachine(ref, p);
@@ -2431,6 +2671,10 @@ function machineRoutes() {
     const body = RescaleMachineRequest.parse(await c.req.json().catch(() => ({})));
     return c.json(await rescaleMachine(parseRef(c.req.param("name"), c.get("owner")), body));
   });
+  r.post("/:name/set", async (c) => {
+    const body = SetMachineRequest.parse(await c.req.json().catch(() => ({})));
+    return c.json(await setMachine(parseRef(c.req.param("name"), c.get("owner")), body));
+  });
   r.post("/:name/ssh-keys", async (c) => {
     const body = SetSshKeysRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!body.success) throw new KvboxError("sshKeys: expected a list of authorized_keys lines");
@@ -2447,6 +2691,7 @@ function machineRoutes() {
     }
     return c.json(await machineUsage(parseRef(c.req.param("name"), c.get("owner")), from));
   });
+  r.get("/:name/stats", async (c) => c.json(await machineStats(parseRef(c.req.param("name"), c.get("owner")))));
   r.delete("/:name", async (c) => {
     await destroyMachine(parseRef(c.req.param("name"), c.get("owner")));
     return c.body(null, 204);
@@ -2504,7 +2749,11 @@ async function saveSnapshot(req, owner, p = paths()) {
   if (!NAME_RE2.test(req.name)) {
     throw new KvboxError(`invalid snapshot name "${req.name}": 1-64 chars, lowercase letters, digits, '.', '_' and '-', starting with a letter or digit`);
   }
-  const box = await readBox(parseRef(req.box, owner), p);
+  const ref = parseRef(req.box, owner);
+  return withBoxLock(ref, () => snapshotBox(ref, req, owner, p));
+}
+async function snapshotBox(ref, req, owner, p) {
+  const box = await readBox(ref, p);
   if (!vmAlive(box)) {
     if (existsSync3(p.machine(box.owner, box.name).hibernateVmstate)) {
       throw new KvboxError(`box ${req.box} is hibernated; a snapshot freezes a running box (kvbox wake ${req.box} first)`);
@@ -2651,7 +2900,7 @@ function createApp(opts = {}) {
       base: await currentBaseVersion().catch(() => null),
       owner: cfg.owner,
       controlPlane: cp ? { name: cp.name, url: cp.url, hostUrl: `https://${cp.advertise}:${cp.port}` } : null,
-      relay: cfg.relay ? { name: cfg.relay.name, publicIp: cfg.relay.publicIp, endpoint: cfg.relay.endpoint } : null,
+      relay: cfg.relay ? { name: cfg.relay.name, publicIp: cfg.relay.publicIp, endpoint: cfg.relay.endpoint, ...relayWatchReport() } : null,
       recovery: lastRecovery()
     });
   });
@@ -2692,7 +2941,7 @@ async function listen(opts = {}) {
   let httpsServer;
   const cp = cfg.controlPlane;
   if (cp) {
-    const [key, cert] = await Promise.all([readFile6(p.tlsKey), readFile6(p.tlsCert)]).catch((err) => {
+    const [key, cert] = await Promise.all([readFile7(p.tlsKey), readFile7(p.tlsCert)]).catch((err) => {
       throw new KvboxError(`joined ${cp.name} but the host's certificate is missing (${err.message}); run kvbox-server leave, then join again`);
     });
     httpsServer = createAdaptorServer({
@@ -2752,6 +3001,8 @@ program.command("start", { isDefault: true }).description("serve the API on the
   } catch (err) {
     console.error(`warning: host network not ready (${err.message}); run: kvbox-server net up`);
   }
+  startRelayWatch();
+  startIdleWatch();
   const recovery2 = await bootRecovered(settled, paths());
   if (recovery2) {
     for (const box of recovery2.booted) console.log(`box ${box} was running when it went down; booted it again`);