@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/commands/status.js

@@ -10,37 +10,31 @@ import { createDaemonClient } from '../daemon/daemon-client.js';
 import { PidManager } from '../daemon/pid-manager.js';
 import { DEFAULT_DAEMON_CONFIG } from '../config/defaults.js';
 import { formatUptime, formatMemoryColored } from '../shared/format.js';
+import { expandPath } from '../shared/paths.js';
+import { reportAbsence } from './daemon-required.js';
 export async function statusCommand() {
     const client = createDaemonClient();
-    if (!(await client.isReachable())) {
-        // Socket not responding — check PID file for diagnostics
-        try {
-            const dc = DEFAULT_DAEMON_CONFIG;
-            const pidFile = dc.pidFile.replace('~', process.env['HOME'] ?? '');
-            const socketPath = dc.socketPath.replace('~', process.env['HOME'] ?? '');
-            const pidManager = new PidManager(pidFile);
-            const rawPid = pidManager.readPid();
-            if (rawPid !== null) {
-                if (PidManager.isProcessAlive(rawPid)) {
-                    log.warn(`Daemon process exists (PID: ${rawPid}) but socket is not responding`);
-                    log.info('The daemon may still be starting. Retry in a few seconds, or kill it:');
-                    log.info(`  omnitron daemon kill`);
+    const absence = await client.whyUnreachable();
+    if (absence) {
+        // This command's own copy of the pid-file check was, for a long time, the
+        // only place in the CLI that told a stopped daemon from a silent one.
+        // That copy is now `DaemonClient.whyUnreachable()`, so every command gets
+        // the distinction; what stays here is the part only `status` does —
+        // clearing up after a daemon that crashed.
+        reportAbsence(absence);
+        if (absence.kind === 'stale') {
+            try {
+                const dc = DEFAULT_DAEMON_CONFIG;
+                const pidManager = new PidManager(expandPath(dc.pidFile));
+                if (pidManager.cleanupStale(expandPath(dc.socketPath))) {
+                    log.info('Cleaned up the PID file and socket it left behind');
                 }
-                else {
-                    // Stale PID — clean up
-                    const cleaned = pidManager.cleanupStale(socketPath);
-                    if (cleaned) {
-                        log.warn('Cleaned up stale PID/socket from a previously crashed daemon');
-                    }
-                    log.warn('Daemon is not running');
-                }
-            }
-            else {
-                log.warn('Daemon is not running');
             }
+            catch { /* diagnostics only — the report above is what matters */ }
         }
-        catch {
-            log.warn('Daemon is not running');
+        if (absence.kind === 'silent') {
+            log.info('  omnitron down          # graceful: SIGTERM, then SIGKILL after 3s');
+            log.info('  omnitron kill          # force immediately');
         }
         await client.disconnect();
         return;
@@ -49,13 +43,40 @@ export async function statusCommand() {
         const status = await client.status();
         const onlineApps = status.apps.filter((a) => a.status === 'online');
         const erroredApps = status.apps.filter((a) => a.status === 'errored' || a.status === 'crashed');
+        // JSON mode — emit structured snapshot and skip TUI rendering.
+        {
+            const { emitJson } = await import('./output.js');
+            if (emitJson({
+                version: status.version,
+                ...(status.build !== undefined ? { build: status.build } : {}),
+                pid: status.pid,
+                uptime: status.uptime,
+                memoryBytes: status.totalMemory,
+                ...(status.daemonMemory !== undefined ? { daemonMemoryBytes: status.daemonMemory } : {}),
+                ...(status.appsMemory !== undefined ? { appsMemoryBytes: status.appsMemory } : {}),
+                appsTotal: status.apps.length,
+                appsOnline: onlineApps.length,
+                errors: erroredApps.map((a) => a.name),
+                apps: status.apps,
+            })) {
+                await client.disconnect();
+                return;
+            }
+        }
         // Daemon status only — no app table (use `omnitron list` for apps)
         const headerLines = [
-            `Version:    ${prism.bold(status.version)}`,
+            `Version:    ${prism.bold(status.version)}${describeBuild(status.build)}`,
             `PID:        ${status.pid}`,
             `Uptime:     ${formatUptime(status.uptime)}`,
-            `Memory:     ${formatMemoryColored(status.totalMemory)}`,
-            `Apps:       ${prism.green(String(onlineApps.length))} online / ${status.apps.length} total`,
+            // The daemon's own memory and the apps' apart; a daemon on an older
+            // build answers only the sum, and says so.
+            ...(status.daemonMemory !== undefined && status.appsMemory !== undefined
+                ? [
+                    `Memory:     ${formatMemoryColored(status.daemonMemory)} daemon (RSS)`,
+                    `Apps:       ${formatMemoryColored(status.appsMemory)} across ${status.apps.length} app(s)`,
+                ]
+                : [`Memory:     ${formatMemoryColored(status.totalMemory)} (daemon and apps together)`]),
+            `Online:     ${prism.green(String(onlineApps.length))} of ${status.apps.length} app(s)`,
             ...(erroredApps.length > 0
                 ? [`Errors:     ${prism.red(String(erroredApps.length))} (${erroredApps.map((a) => a.name).join(', ')})`]
                 : []),
@@ -67,4 +88,16 @@ export async function statusCommand() {
     }
     await client.disconnect();
 }
+/**
+ * Which commit the daemon runs. The package version is `0.2.0` on every
+ * build, so `Version: 0.2.0` said nothing about what was running.
+ */
+export function describeBuild(build) {
+    if (build === undefined)
+        return prism.dim(' · build not reported (older daemon)');
+    if (build === null)
+        return prism.dim(' · unstamped build (running from source, or built without a stamp)');
+    const at = build.builtAt.replace('T', ' ').slice(0, 16);
+    return ` · ${build.commit.slice(0, 8)}${build.dirty ? prism.yellow(' + uncommitted changes') : ''} ${prism.dim(`built ${at} UTC`)}`;
+}
 //# sourceMappingURL=status.js.map

package/dist/commands/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClC,yDAAyD;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,qBAAqB,CAAC;YACjC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;YAE3C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,IAAI,CAAC,+BAA+B,MAAM,gCAAgC,CAAC,CAAC;oBAChF,GAAG,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;oBAClF,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,uBAAuB;oBACvB,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;oBACpD,IAAI,OAAO,EAAE,CAAC;wBACZ,GAAG,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;oBAC3E,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAErG,mEAAmE;QACnE,MAAM,WAAW,GAAG;YAClB,eAAe,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAC3C,eAAe,MAAM,CAAC,GAAG,EAAE;YAC3B,eAAe,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YAC5C,eAAe,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;YACxD,eAAe,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ;YAC5F,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC9G,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;IAC9C,IAAI,OAAO,EAAE,CAAC;QACZ,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,oEAAoE;QACpE,2CAA2C;QAC3C,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,qBAAqB,CAAC;gBACjC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC1D,IAAI,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;oBACvD,GAAG,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,yDAAyD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAErG,+DAA+D;QAC/D,CAAC;YACC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC;gBACX,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC7B,UAAU,EAAE,UAAU,CAAC,MAAM;gBAC7B,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC3C,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,EAAE,CAAC;gBACH,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1B,OAAO;YACT,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG;YAClB,eAAe,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACzE,eAAe,MAAM,CAAC,GAAG,EAAE;YAC3B,eAAe,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YAC5C,oEAAoE;YACpE,2CAA2C;YAC3C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;gBACtE,CAAC,CAAC;oBACE,eAAe,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe;oBACtE,eAAe,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS;iBAC5F;gBACH,CAAC,CAAC,CAAC,eAAe,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;YAC1F,eAAe,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS;YACvF,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC9G,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAA6E;IACzG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAClF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAC3G,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;AACtI,CAAC"}

package/dist/commands/stop.d.ts

@@ -4,6 +4,22 @@
  * Gracefully stops managed apps (or the whole daemon).
  * Falls back to PID-based cleanup when the socket is unreachable.
  */
+/**
+ * These commands wait for a whole Titan application to come up.
+ *
+ * The daemon allows an app up to its own `startupTimeout` — configured at two
+ * and five minutes for the applications on this host — while the CLI's default
+ * ceiling is sixty seconds. So the client gave up first, on an operation the
+ * daemon had four more minutes to finish, and reported
+ * `RPC request timed out after 60000ms`. Observed: three consecutive
+ * `omnitron restart` calls "failed" that way and one of the apps came up
+ * anyway. `daemon-client.ts` says why that is the worst thing to report — the
+ * daemon cancels nothing when the caller stops waiting, so the operation runs
+ * on with its outcome unknown, and an operator acts on the word "failed".
+ *
+ * `LONG_REQUEST_TIMEOUT` already exists for exactly this and was wired into
+ * the STACK commands only; the per-app ones kept the default.
+ */
 export declare function stopCommand(appName?: string, options?: {
     force?: boolean;
 }): Promise<void>;

package/dist/commands/stop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stop.d.ts","sourceRoot":"","sources":["../../src/commands/stop.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,wBAAsB,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA2DpG"}
+{"version":3,"file":"stop.d.ts","sourceRoot":"","sources":["../../src/commands/stop.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAqEpG"}

package/dist/commands/stop.js

@@ -4,17 +4,35 @@
  * Gracefully stops managed apps (or the whole daemon).
  * Falls back to PID-based cleanup when the socket is unreachable.
  */
-import { log, spinner } from '@xec-sh/kit';
-import { createDaemonClient } from '../daemon/daemon-client.js';
+import { log } from '@xec-sh/kit';
+import { spinner } from './spinner.js';
+import { createDaemonClient, LONG_REQUEST_TIMEOUT } from '../daemon/daemon-client.js';
 import { PidManager } from '../daemon/pid-manager.js';
 import { DEFAULT_DAEMON_CONFIG } from '../config/defaults.js';
+import { expandPath } from '../shared/paths.js';
+/**
+ * These commands wait for a whole Titan application to come up.
+ *
+ * The daemon allows an app up to its own `startupTimeout` — configured at two
+ * and five minutes for the applications on this host — while the CLI's default
+ * ceiling is sixty seconds. So the client gave up first, on an operation the
+ * daemon had four more minutes to finish, and reported
+ * `RPC request timed out after 60000ms`. Observed: three consecutive
+ * `omnitron restart` calls "failed" that way and one of the apps came up
+ * anyway. `daemon-client.ts` says why that is the worst thing to report — the
+ * daemon cancels nothing when the caller stops waiting, so the operation runs
+ * on with its outcome unknown, and an operator acts on the word "failed".
+ *
+ * `LONG_REQUEST_TIMEOUT` already exists for exactly this and was wired into
+ * the STACK commands only; the per-app ones kept the default.
+ */
 export async function stopCommand(appName, options = {}) {
-    const client = createDaemonClient();
+    const client = createDaemonClient(undefined, LONG_REQUEST_TIMEOUT);
     if (!(await client.isReachable())) {
         // Fall back: try to find and kill daemon via PID file
         const dc = DEFAULT_DAEMON_CONFIG;
-        const pidFile = dc.pidFile.replace('~', process.env['HOME'] ?? '');
-        const socketPath = dc.socketPath.replace('~', process.env['HOME'] ?? '');
+        const pidFile = expandPath(dc.pidFile);
+        const socketPath = expandPath(dc.socketPath);
         const pidManager = new PidManager(pidFile);
         const pid = pidManager.getPid();
         if (pid) {
@@ -26,7 +44,17 @@ export async function stopCommand(appName, options = {}) {
                 while (Date.now() - start < maxWait && PidManager.isProcessAlive(pid)) {
                     await new Promise((r) => setTimeout(r, 500));
                 }
-                if (!PidManager.isProcessAlive(pid)) {
+                // `getPid()` and not `isProcessAlive()`: the second reads the pid
+                // file AND checks the live process's argv against the signature
+                // written there, so it answers "is OUR daemon still at this pid",
+                // which is the question a SIGKILL needs answered. The ten seconds
+                // above are exactly the window in which the daemon exits and the
+                // kernel hands its number to something else — and this branch is
+                // reached only when the daemon did NOT exit on its own, which is
+                // when the file is most likely to be out of date. `daemonStop` was
+                // fixed the same way; leaving the two commands disagreeing is how
+                // one of them gets read as authoritative later.
+                if (pidManager.getPid() !== pid) {
                     pidManager.remove();
                     log.success('Daemon stopped');
                 }

package/dist/commands/stop.js.map

@@ -1 +1 @@
-{"version":3,"file":"stop.js","sourceRoot":"","sources":["../../src/commands/stop.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,UAA+B,EAAE;IACnF,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClC,sDAAsD;QACtD,MAAM,EAAE,GAAG,qBAAqB,CAAC;QACjC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAEhC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,IAAI,CAAC,wDAAwD,GAAG,MAAM,CAAC,CAAC;YAC5E,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,OAAO,IAAI,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC/C,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpC,UAAU,CAAC,MAAM,EAAE,CAAC;oBACpB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAC7B,UAAU,CAAC,MAAM,EAAE,CAAC;oBACpB,GAAG,CAAC,OAAO,CAAC,6BAA6B,GAAG,GAAG,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YACpC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAErC,IAAI,CAAC;QAEH,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,KAAK,CAAC,YAAY,OAAO,KAAK,CAAC,CAAC;YAClC,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,UAAU,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,IAAI,CAAC,WAAY,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"stop.js","sourceRoot":"","sources":["../../src/commands/stop.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,OAAO,GAAwB,EAAE;IACnF,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAEnE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClC,sDAAsD;QACtD,MAAM,EAAE,GAAG,qBAAqB,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAEhC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,IAAI,CAAC,wDAAwD,GAAG,MAAM,CAAC,CAAC;YAC5E,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,OAAO,IAAI,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC/C,CAAC;gBACD,kEAAkE;gBAClE,gEAAgE;gBAChE,kEAAkE;gBAClE,kEAAkE;gBAClE,iEAAiE;gBACjE,iEAAiE;gBACjE,iEAAiE;gBACjE,mEAAmE;gBACnE,kEAAkE;gBAClE,gDAAgD;gBAChD,IAAI,UAAU,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,CAAC;oBAChC,UAAU,CAAC,MAAM,EAAE,CAAC;oBACpB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAC7B,UAAU,CAAC,MAAM,EAAE,CAAC;oBACpB,GAAG,CAAC,OAAO,CAAC,6BAA6B,GAAG,GAAG,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YACpC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAErC,IAAI,CAAC;QAEH,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,KAAK,CAAC,YAAY,OAAO,KAAK,CAAC,CAAC;YAClC,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,UAAU,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,IAAI,CAAC,WAAY,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;AAC5B,CAAC"}

package/dist/commands/tor.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `omnitron tor [project] [stack]` — inspect Tor hidden service onion addresses.
+ *
+ * Reads `/var/lib/tor/<name>/hostname` from a running tor container via
+ * `docker exec`, and lists each hidden service with its .onion address.
+ * Useful since onions are not knowable until tor has generated the keys
+ * (first start) and never appear in logs unless tor is run with debug
+ * verbosity.
+ *
+ * Whose onion, and on which machine, is part of the answer. The command took
+ * the first container on THIS machine whose name ended in `-tor` and printed
+ * its onions under a bare «Tor Hidden Services» — measured 2026-09-23, the
+ * dev stack's (`daos-dev-tor`: portal `ohtohqkc5pknagnl…onion`), which is not
+ * the test portal (`6me2nawd…c7cid.onion`, on 37.27.130.185), and nothing on
+ * screen said which it was; the container was named only under --json.
+ *
+ * Supports `--json` for scripting.
+ */
+export declare function torCommand(project?: string, stack?: string): Promise<void>;
+//# sourceMappingURL=tor.d.ts.map

package/dist/commands/tor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tor.d.ts","sourceRoot":"","sources":["../../src/commands/tor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAuHH,wBAAsB,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDhF"}

package/dist/commands/tor.js

@@ -0,0 +1,180 @@
+/**
+ * `omnitron tor [project] [stack]` — inspect Tor hidden service onion addresses.
+ *
+ * Reads `/var/lib/tor/<name>/hostname` from a running tor container via
+ * `docker exec`, and lists each hidden service with its .onion address.
+ * Useful since onions are not knowable until tor has generated the keys
+ * (first start) and never appear in logs unless tor is run with debug
+ * verbosity.
+ *
+ * Whose onion, and on which machine, is part of the answer. The command took
+ * the first container on THIS machine whose name ended in `-tor` and printed
+ * its onions under a bare «Tor Hidden Services» — measured 2026-09-23, the
+ * dev stack's (`daos-dev-tor`: portal `ohtohqkc5pknagnl…onion`), which is not
+ * the test portal (`6me2nawd…c7cid.onion`, on 37.27.130.185), and nothing on
+ * screen said which it was; the container was named only under --json.
+ *
+ * Supports `--json` for scripting.
+ */
+import os from 'node:os';
+import { box, log, prism } from '@xec-sh/kit';
+import { listManagedContainers, execInContainer } from '../infrastructure/container-runtime.js';
+import { createDaemonClient } from '../daemon/daemon-client.js';
+import { emitJson, emitError, isJsonMode } from './output.js';
+/**
+ * A stack's tor container: by the `omnitron.service` label, or — for a
+ * container made before labels were written — by the `<prefix>-tor` name the
+ * service resolver gives it (e.g. `daos-dev-tor`, `omnitron-tor`).
+ */
+function isTor(c) {
+    return c.service === 'tor' || /(^|-)tor$/i.test(c.name);
+}
+/** Whether a container belongs to the stack asked about: labels first, name second. */
+function belongsTo(c, project, stack) {
+    if (!project)
+        return true;
+    if (c.project || c.stack)
+        return c.project === project && (!stack || c.stack === stack);
+    return c.name.startsWith(stack ? `${project}-${stack}-` : `${project}-`);
+}
+/** `project/stack` as the container's labels say, or its name when they do not. */
+function stackOf(c) {
+    return c.project && c.stack ? `${c.project}/${c.stack}` : `unlabelled (${c.name})`;
+}
+/**
+ * List the directories under /var/lib/tor that look like hidden services
+ * (i.e. contain a `hostname` file) and read each hostname.
+ */
+async function readOnions(container) {
+    // `find` (BusyBox-compatible) lists hidden-service hostname files — more
+    // portable across container shells than glob expansion in a quoted
+    // `sh -c '...'`, which has shown up as empty output via some runtime
+    // adapters. We avoid `-printf` (not in BusyBox find).
+    let raw;
+    try {
+        raw = await execInContainer(container, [
+            'find',
+            '/var/lib/tor',
+            '-mindepth', '2',
+            '-maxdepth', '2',
+            '-name', 'hostname',
+            '-type', 'f',
+        ]);
+    }
+    catch {
+        return [];
+    }
+    const paths = raw.split('\n').map((s) => s.trim()).filter(Boolean);
+    const entries = [];
+    for (const p of paths) {
+        // Service name is the parent dir of hostname.
+        const dir = p.replace(/\/hostname$/, '');
+        const service = dir.split('/').pop() ?? '';
+        let onion = null;
+        try {
+            const content = await execInContainer(container, ['cat', p]);
+            onion = content.trim() || null;
+        }
+        catch {
+            // hostname unreadable (permissions, race) — leave null
+        }
+        entries.push({ service, onion, source: p });
+    }
+    return entries;
+}
+/**
+ * Where a stack that has no tor container here runs, asked of the daemon.
+ *
+ * A remote stack's tor is on its node. No daemon RPC reads an onion address
+ * from a node — the master relays status, health and metrics, not files in a
+ * node's containers — so the honest answer names the container and the
+ * machine and prints no onion, rather than printing this machine's.
+ */
+async function explainAbsence(project, stack) {
+    const client = createDaemonClient();
+    try {
+        if (!(await client.isReachable())) {
+            emitError(`No tor container for ${project}/${stack} on this machine, and the daemon did not answer — ` +
+                'so whether the stack runs somewhere else is unknown.');
+            return;
+        }
+        const projects = await client.service('OmnitronProject');
+        const info = await projects.getStack({ project, stack });
+        const container = info.infrastructure.services['tor']?.containerName ?? `${project}-${stack}-tor`;
+        if (info.type === 'local') {
+            emitError(`No tor container for ${project}/${stack} on this machine — the stack is local and has none running.`);
+            return;
+        }
+        const hosts = info.nodes.map((n) => n.host);
+        const where = hosts.length > 0 ? hosts.join(', ') : 'its node';
+        const message = `${project}/${stack} is a ${info.type} stack: its tor container ${container} runs on ${where}, not on this machine. ` +
+            'No daemon RPC reads an onion address from a node, so none is printed here.';
+        if (emitError(message, { project, stack, container, hosts }))
+            return;
+        for (const host of hosts) {
+            log.info(`  On the node: ssh <user>@${host} docker exec ${container} sh -c 'cat /var/lib/tor/*/hostname'`);
+        }
+    }
+    catch (err) {
+        emitError(`No tor container for ${project}/${stack} on this machine, and the daemon could not say where it runs: ${err.message}`);
+    }
+    finally {
+        await client.disconnect();
+    }
+}
+export async function torCommand(project, stack) {
+    const here = (await listManagedContainers()).filter(isTor);
+    const chosen = here.filter((c) => belongsTo(c, project, stack));
+    if (chosen.length === 0) {
+        process.exitCode = 1;
+        if (project && stack) {
+            await explainAbsence(project, stack);
+            return;
+        }
+        if (project) {
+            emitError(`No tor container for project ${project} on this machine.`);
+            return;
+        }
+        if (isJsonMode()) {
+            emitError('No tor container found. Add a `tor` service to your omnitron.config.ts.');
+        }
+        else {
+            log.warn('No tor container found on this machine.');
+            log.info('Add a `tor` service to your omnitron.config.ts:');
+            log.info("  services: { tor: { preset: 'tor', config: { hiddenServices: [...] } } }");
+        }
+        return;
+    }
+    const machine = os.hostname();
+    const found = [];
+    for (const c of chosen) {
+        found.push({ container: c.name, project: c.project ?? null, stack: c.stack ?? null, services: await readOnions(c.name) });
+    }
+    // One container keeps the old top-level `container` and `services`, so a
+    // script written against them still reads them; `containers` holds every
+    // one, each with its stack, and `machine` says whose disk they are on.
+    if (emitJson({ machine: 'this machine', hostname: machine, containers: found, ...(found.length === 1 ? found[0] : {}) })) {
+        return;
+    }
+    for (const [i, c] of found.entries()) {
+        // Short enough for the box border, which cuts a long title: the host
+        // name goes in the body.
+        const title = `Tor · stack ${stackOf(chosen[i])} · ${c.container} · this machine`;
+        if (c.services.length === 0) {
+            log.warn(`${title} (${machine}): running, but no hidden services have been published yet.`);
+            log.info('Tor needs ~30-90s after first start to generate keys and publish HSes.');
+            log.info(`Try 'docker logs ${c.container}' to see bootstrap progress.`);
+            continue;
+        }
+        const lines = [prism.dim(`on ${machine}`)];
+        for (const e of c.services) {
+            if (!e.onion) {
+                lines.push(`${prism.yellow('?')} ${prism.bold(e.service)}: ${prism.dim('not yet generated')}`);
+                continue;
+            }
+            lines.push(`${prism.green('●')} ${prism.bold(e.service)}: ${prism.cyan(e.onion)}`);
+        }
+        box(lines.join('\n'), title);
+    }
+}
+//# sourceMappingURL=tor.js.map

package/dist/commands/tor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tor.js","sourceRoot":"","sources":["../../src/commands/tor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEhG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAS9D;;;;GAIG;AACH,SAAS,KAAK,CAAC,CAAiB;IAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,CAAiB,EAAE,OAA2B,EAAE,KAAyB;IAC1F,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACxF,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED,mFAAmF;AACnF,SAAS,OAAO,CAAC,CAAiB;IAChC,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,GAAG,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CAAC,SAAiB;IACzC,yEAAyE;IACzE,mEAAmE;IACnE,qEAAqE;IACrE,sDAAsD;IACtD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE;YACrC,MAAM;YACN,cAAc;YACd,WAAW,EAAE,GAAG;YAChB,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,GAAG;SACb,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,8CAA8C;QAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa;IAC1D,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAClC,SAAS,CACP,wBAAwB,OAAO,IAAI,KAAK,oDAAoD;gBAC1F,sDAAsD,CACzD,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAyD,iBAAiB,CAAC,CAAC;QACjH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,IAAI,GAAG,OAAO,IAAI,KAAK,MAAM,CAAC;QAClG,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,SAAS,CAAC,wBAAwB,OAAO,IAAI,KAAK,6DAA6D,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAC/D,MAAM,OAAO,GACX,GAAG,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,6BAA6B,SAAS,YAAY,KAAK,yBAAyB;YACrH,4EAA4E,CAAC;QAC/E,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO;QACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,6BAA6B,IAAI,gBAAgB,SAAS,sCAAsC,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,wBAAwB,OAAO,IAAI,KAAK,iEAAkE,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/I,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAgB,EAAE,KAAc;IAC/D,MAAM,IAAI,GAAG,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAEhE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;YACrB,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,CAAC,gCAAgC,OAAO,mBAAmB,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,SAAS,CAAC,yEAAyE,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAC5D,GAAG,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACxF,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACzH,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,qEAAqE;QACrE,yBAAyB;QACzB,MAAM,KAAK,GAAG,eAAe,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,SAAS,iBAAiB,CAAC;QACnF,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,OAAO,6DAA6D,CAAC,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;YACnF,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,SAAS,8BAA8B,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAa,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;gBAC/F,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/commands/up.d.ts

@@ -12,7 +12,7 @@
  *   omnitron up --no-infra       # Skip Docker provisioning
  *   omnitron up --no-watch       # Disable file watching
  */
-import type { DaemonRole } from '../config/types.js';
+import type { DaemonRole, IDaemonConfig } from '../config/types.js';
 export interface SavedDaemonConfig {
     role: DaemonRole;
     master?: {
@@ -23,9 +23,48 @@ export interface SavedDaemonConfig {
     initializedAt: string;
     /** Whether to auto-start webapp (Console UI) with daemon. Set via `omnitron up --webapp`. */
     webapp?: boolean;
+    /**
+     * Daemon auth settings. `jwtSecret` is generated once and persisted so the
+     * console's JWT sessions survive daemon restarts (see ensurePersistedJwtSecret).
+     */
+    auth?: {
+        jwtSecret: string;
+    };
+    /**
+     * Transport-level rate limiting and proxy trust for the daemon's HTTP
+     * surface. Persisted because the daemon boots from THIS file, not from the
+     * project's ecosystem config — anything set only there is invisible to a
+     * running daemon.
+     */
+    httpRateLimit?: IDaemonConfig['httpRateLimit'];
+    /**
+     * Transport bind address and the address slaves dial to reach a master.
+     *
+     * Here for the same reason `httpRateLimit` is: this file is what the daemon
+     * boots from. `IDaemonConfig` documents `host` at length — "set `0.0.0.0`
+     * to accept connections from other hosts" — and until these fields existed
+     * there was nowhere to set it that the daemon would read. A provisioned
+     * slave wrote `daemon: { host: '0.0.0.0', … }` into an `omnitron.config.ts`
+     * whose schema has no `daemon` key, and booted on loopback.
+     */
+    host?: string;
+    port?: number;
+    httpPort?: number;
+    advertiseHost?: string;
 }
 export declare function readSavedDaemonConfig(): SavedDaemonConfig | null;
 export declare function writeSavedDaemonConfig(config: SavedDaemonConfig): void;
+/**
+ * Read the daemon's persisted JWT signing secret, generating and storing a
+ * random 32-byte one on first use.
+ *
+ * Without this the secret falls back to a hardcoded dev constant (or, in
+ * production, the daemon refuses to boot). Persisting a per-install secret
+ * keeps console sessions (rows in `omnitron_sessions`) valid across daemon
+ * restarts — otherwise every `/netron/invoke` 401s after a restart and the
+ * operator is silently logged out.
+ */
+export declare function ensurePersistedJwtSecret(): string;
 export interface UpCommandOptions {
     configPath?: string;
     project?: string;
@@ -38,10 +77,55 @@ export interface UpCommandOptions {
     webapp?: boolean;
 }
 export declare function upCommand(options?: UpCommandOptions): Promise<void>;
+/**
+ * What a slave should say about replication when it starts.
+ *
+ * This printed `Sync: slave → master at <host>:<port>`, and replication is
+ * master-PULL: the master opens the connection, drains this node's buffer
+ * and acknowledges what it holds. A slave dials nothing. The address is
+ * real — `master-address.ts` resolves it carefully at provisioning time and
+ * refuses rather than guess — but it is the address the unbuilt push path
+ * would use, and printing it behind an arrow pointing the wrong way sends an
+ * operator to check a connection this node never opens.
+ *
+ * It is the one thing that reads `master` at all, which is worth knowing
+ * before anyone deletes the resolver for being unused.
+ */
+export declare function describeSlaveSync(master: {
+    host: string;
+    port: number;
+} | undefined): string;
 /**
  * omnitron down
  *
  * Stop the daemon — stops ALL projects, ALL stacks, ALL infrastructure.
  */
+/**
+ * What stopping the daemon has to do, given how it was started.
+ *
+ * `down` killed the process — SIGTERM, then SIGKILL — and said "Daemon
+ * force-killed". When the daemon is installed as a service, that is not
+ * stopping it: the supervisor has `KeepAlive`, and it starts a new one as
+ * soon as the old one dies. Measured on this machine:
+ *
+ *     omnitron down   → "Daemon force-killed (PID: 69597)"
+ *     29 seconds later → a new daemon, PID 73095, PPID 1
+ *
+ * The command reported success, the operator believed the daemon was down,
+ * and anything done on that belief — rebuilding the package it runs from —
+ * ran against a live daemon. The plist's `ThrottleInterval` is 10 seconds,
+ * so the window in which the report is true is ten seconds wide.
+ *
+ * Unloading the service FIRST is the whole fix. Killing first and unloading
+ * second leaves the same race, smaller: the supervisor can start a
+ * replacement between the two.
+ */
+export interface DownPlan {
+    /** Steps in the order they must happen. */
+    steps: Array<'unload-service' | 'stop-process'>;
+    /** What the operator is told, when the daemon is supervised. */
+    note: string | null;
+}
+export declare function planDown(supervised: boolean): DownPlan;
 export declare function downCommand(): Promise<void>;
 //# sourceMappingURL=up.d.ts.map

package/dist/commands/up.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/commands/up.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAQrD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAID,wBAAgB,qBAAqB,IAAI,iBAAiB,GAAG,IAAI,CAOhE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAGtE;AAMD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAmGD,wBAAsB,SAAS,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EzE;AA8FD;;;;GAIG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAGjD"}
+{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/commands/up.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAcH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AASpE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,IAAI,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAE/C;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,wBAAgB,qBAAqB,IAAI,iBAAiB,GAAG,IAAI,CAOhE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAStE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAQjD;AAMD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAsHD,wBAAsB,SAAS,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkFzE;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAAG,MAAM,CAI5F;AAgID;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,QAAQ;IACvB,2CAA2C;IAC3C,KAAK,EAAE,KAAK,CAAC,gBAAgB,GAAG,cAAc,CAAC,CAAC;IAChD,gEAAgE;IAChE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,OAAO,GAAG,QAAQ,CAStD;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBjD"}