@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/daemon/daemon.rpc-service.js

@@ -22,9 +22,15 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { Service, Public } from '@omnitron-dev/titan/decorators';
+import { Errors } from '@omnitron-dev/titan/errors';
+import { callExposedService } from '../orchestrator/call-exposed-service.js';
+import { effectiveAppName } from '../orchestrator/orchestrator.service.js';
+import { worstVerdict } from '../orchestrator/app-health.js';
+import { redactEnv } from '../shared/redact-env.js';
 import { CLI_VERSION, DAEMON_SERVICE_ID } from '../config/defaults.js';
+import { OWN_BUILD } from '../shared/build-stamp.js';
 import { loadEcosystemConfig } from '../config/loader.js';
-import { VIEWER_ROLES, OPERATOR_ROLES, ADMIN_ROLES } from '../shared/roles.js';
+import { OPERATOR_ROLES, ADMIN_ROLES, CONTROL_PLANE_READ_ROLES, CONTROL_PLANE_ROLES } from '../shared/roles.js';
 let DaemonRpcService = class DaemonRpcService {
     orchestrator;
     titanHealth;
@@ -43,19 +49,142 @@ let DaemonRpcService = class DaemonRpcService {
     // Process Management (Operator: admin + operator)
     // ============================================================================
     async startApp(data) {
-        const entry = this.config.apps.find((a) => a.name === data.name);
-        if (!entry)
-            throw new Error(`Unknown app: ${data.name}`);
-        await this.orchestrator.startApp(entry);
+        const entry = this.findConfiguredApp(data.name);
+        if (!entry) {
+            // Nothing in THIS daemon's ecosystem config — but a project stack
+            // registers handles the daemon never declared, and those are the names
+            // `list` prints. `stop`, `restart` and `reload` all resolve through the
+            // registry; `start` alone stopped at the config, so every downstream backend
+            // could be stopped and restarted and not started: `omnitron start
+            // acme/dev/storage` answered "App with id acme/dev/storage not found"
+            // directly under an `ls` row reading `stopped`.
+            //
+            // The config still wins where it has an opinion; this only reaches
+            // names it has none about.
+            const known = this.orchestrator.getApp(data.name);
+            if (known) {
+                // Already up, or on its way: `start` is idempotent, not a second
+                // spawn racing the first.
+                if (known.status === 'online' || known.status === 'starting')
+                    return known;
+                await this.orchestrator.startKnownApp(data.name);
+                return this.orchestrator.getApp(data.name);
+            }
+            if (data.name.includes('/')) {
+                const [project, stack] = data.name.split('/');
+                throw Errors.notFound('App', `${data.name} — this daemon declares no such app and none is registered under that name. ` +
+                    `If it belongs to a registered project, bring its stack up with ` +
+                    `\`omnitron stack start ${project} ${stack}\``);
+            }
+            throw Errors.notFound('App', data.name);
+        }
+        // Accepting the canonical name is only half of it. `namespaceEntry` builds
+        // the handle key from THIS daemon's config, and a daemon supervising
+        // registered projects has no `project` of its own — so the promotion is a
+        // no-op and the app would register under the bare name, beside the
+        // canonical entry the stack owns, in classic mode.
+        //
+        // Observed on the stand: `omnitron start acme/dev/storage` reported
+        // success and left `storage` (classic, errored) in the state store next to
+        // the stack's six. Refusing and naming the command that does work is the
+        // honest answer; succeeding wrongly is worse than the "not found" this
+        // path used to give, because nothing tells the operator it went sideways.
+        if (data.name.includes('/') && !this.config.project) {
+            const [project, stack] = data.name.split('/');
+            throw Errors.badRequest(`'${data.name}' belongs to a registered project, which this daemon starts through its stack. ` +
+                `Use \`omnitron stack start ${project} ${stack}\`, or start the app by its bare name ` +
+                `('${entry.name}') if you mean the daemon's own config.`);
+        }
+        // Inject project + default-stack context so `ensureNamespacedEntry`
+        // promotes a bare-name `entry.name` to the canonical
+        // `${project}/${stack}/${name}` form. Without this, every CLI
+        // `omnitron start <bareName>` (and every webapp "Start" button)
+        // registered handles under bare keys that the stack/project view
+        // filtered out by prefix — same fault class as the user-reported
+        // "main shows stopped" bug.
+        const enriched = this.namespaceEntry(entry);
+        await this.orchestrator.startApp(enriched);
         return this.orchestrator.getApp(data.name);
     }
+    /**
+     * Find the config entry an operator means.
+     *
+     * The ecosystem config holds BARE names; `omnitron list` prints canonical
+     * handle keys (`acme/dev/payments`), because that is what a project-scoped app
+     * is registered under. Comparing the request to the config by string
+     * equality therefore rejected the only name an operator can see, with "App
+     * with id acme/dev/payments not found" printed directly under a row saying it
+     * exists. Every other entry point — `getApp`, `stopApp`, `restartApp`,
+     * `reloadApp` — already resolves through `orchestrator.resolveAppName`; this
+     * one compared strings.
+     *
+     * Matched by path SEGMENT, never by string suffix: `acme/dev/notpayments` must
+     * not reach `payments`. Ambiguity is an error rather than a guess, for the
+     * reason `resolveAppName` gives — operating on the wrong app is worse than
+     * refusing.
+     */
+    findConfiguredApp(requested) {
+        const exact = this.config.apps.find((a) => a.name === requested);
+        if (exact)
+            return exact;
+        const wanted = effectiveAppName(requested);
+        const matches = this.config.apps.filter((a) => effectiveAppName(a.name) === wanted);
+        if (matches.length === 1)
+            return matches[0];
+        if (matches.length > 1) {
+            throw Errors.badRequest(`App name '${requested}' is ambiguous — the config declares ${matches
+                .map((a) => a.name)
+                .join(', ')}. Use the name exactly as declared.`);
+        }
+        return undefined;
+    }
+    /**
+     * Decorate an ecosystem entry with the daemon's default project +
+     * stack env so downstream `ensureNamespacedEntry` promotes the
+     * handle key. No-op when the entry already declares them or the
+     * daemon config lacks a project name (multi-project deployments
+     * MUST go through the stack-mode startStack path instead).
+     */
+    namespaceEntry(entry) {
+        const project = this.config.project;
+        if (!project)
+            return entry;
+        if (entry.env?.['OMNITRON_PROJECT'] && entry.env?.['OMNITRON_STACK'])
+            return entry;
+        const stacks = this.config.stacks ?? {};
+        const stackKeys = Object.keys(stacks);
+        const defaultStack = stackKeys.length === 1 ? stackKeys[0] : (stacks['dev'] ? 'dev' : stackKeys[0]);
+        if (!defaultStack)
+            return entry;
+        return {
+            ...entry,
+            env: {
+                ...entry.env,
+                OMNITRON_PROJECT: project,
+                OMNITRON_STACK: defaultStack,
+            },
+        };
+    }
     async startAll() {
         await this.orchestrator.startAll(this.config);
         return this.orchestrator.list();
     }
     async stopApp(data) {
-        await this.orchestrator.stopApp(data.name, data.force, data.timeout);
-        return { success: true };
+        // P1-H — let the operator distinguish "stop happened" from
+        // "stop tried and SIGKILL failed". Pre-fix this always returned
+        // {success: true} regardless of whether stopChild swallowed an
+        // exception; UI rendered "stopped" while `ps` still showed the
+        // process. Now we surface stopChild errors explicitly without
+        // throwing — Netron clients see a structured payload they can
+        // render, and the typed return preserves back-compat for
+        // callers that only checked `success`.
+        try {
+            await this.orchestrator.stopApp(data.name, data.force, data.timeout);
+            return { success: true };
+        }
+        catch (err) {
+            return { success: false, error: err.message };
+        }
     }
     async stopAll(data) {
         const count = await this.orchestrator.stopAll(data.force);
@@ -67,9 +196,25 @@ let DaemonRpcService = class DaemonRpcService {
     }
     async restartAll() {
         const entries = this.config.apps;
-        for (const entry of entries) {
-            await this.orchestrator.restartApp(entry.name);
-        }
+        // P0-H — was a serial `for..await`. One hung app blocked the
+        // entire fleet restart (the operator hits "Restart all" and the
+        // whole UI stalls on apps[i+1..n]). Run in parallel with
+        // allSettled + per-app deadline so a slow restart can't take
+        // down the rest. Caller still sees the final fleet state via
+        // `orchestrator.list()`; per-app failures surface in the daemon
+        // log.
+        const PER_APP_TIMEOUT_MS = 60_000;
+        await Promise.allSettled(entries.map(async (entry) => {
+            try {
+                await Promise.race([
+                    this.orchestrator.restartApp(entry.name),
+                    new Promise((_, reject) => setTimeout(() => reject(new Error(`restartApp(${entry.name}) timed out after ${PER_APP_TIMEOUT_MS}ms`)), PER_APP_TIMEOUT_MS)),
+                ]);
+            }
+            catch (err) {
+                console.warn(`[daemon.restartAll] ${entry.name} failed: ${err.message} — continuing`);
+            }
+        }));
         return this.orchestrator.list();
     }
     async reloadApp(data) {
@@ -85,63 +230,148 @@ let DaemonRpcService = class DaemonRpcService {
     async getApp(data) {
         const info = this.orchestrator.getApp(data.name);
         if (!info)
-            throw new Error(`Unknown app: ${data.name}`);
+            throw Errors.notFound('App', data.name);
         return info;
     }
     async status() {
         const apps = this.orchestrator.list();
         const totalCpu = apps.reduce((sum, a) => sum + a.cpu, 0);
-        const totalMemory = apps.reduce((sum, a) => sum + a.memory, 0) + process.memoryUsage.rss();
+        const appsMemory = apps.reduce((sum, a) => sum + a.memory, 0);
+        const daemonMemory = process.memoryUsage.rss();
         return {
             version: CLI_VERSION,
+            // Which commit is running: the package version is 0.2.0 on every build.
+            build: OWN_BUILD,
             pid: process.pid,
             uptime: Date.now() - this.startedAt,
             apps,
             totalCpu,
-            totalMemory,
+            // Kept for older readers: apps AND daemon. `omnitron status` printed
+            // it in the «Omnitron Daemon» box as the daemon's memory — 2.4 GB for a
+            // daemon whose own RSS was 254 MB (2,808,774,656 = apps 2,555,019,264 +
+            // daemon 253,755,392, byte for byte). The two parts are named below.
+            totalMemory: appsMemory + daemonMemory,
+            daemonMemory,
+            appsMemory,
         };
     }
     // ============================================================================
     // Monitoring (Viewer: admin + operator + viewer)
     // ============================================================================
+    /**
+     * Each app's resources and traffic.
+     *
+     * Traffic is what the app's processes reported their transports answered
+     * (`reportTraffic`). This used to pass `requests`/`errors` through with
+     * `?? 0` and drop `latency`: the counts were the supervisor's own calls to
+     * the process wrapper (one more for every `omnitron inspect --graph`), an
+     * app that reported nothing read as zero, and MEAN/P95/P99 were never
+     * filled. An unknown name is refused rather than answered with nothing.
+     */
     async getMetrics(data) {
         const raw = await this.orchestrator.getMetrics(data.name);
+        if (data.name !== undefined && Object.keys(raw).length === 0) {
+            throw Errors.notFound('App', data.name);
+        }
         const apps = {};
         let totalCpu = 0;
         let totalMemory = 0;
         for (const [name, m] of Object.entries(raw)) {
+            const t = m?.traffic;
             apps[name] = {
                 cpu: m?.cpu ?? 0,
                 memory: m?.memory ?? 0,
-                requests: m?.requests ?? 0,
-                errors: m?.errors ?? 0,
+                traffic: t ? 'measured' : 'not-reported',
+                ...(t
+                    ? {
+                        requests: t.requests,
+                        errors: t.serverErrors,
+                        clientErrors: t.clientErrors,
+                        probes: t.probes,
+                        ...(t.held !== undefined ? { held: t.held } : {}),
+                        latency: t.latency
+                            ? {
+                                p50: t.latency.p50,
+                                p95: t.latency.p95,
+                                p99: t.latency.p99,
+                                mean: t.latency.mean,
+                                max: t.latency.max,
+                                count: t.latency.count,
+                                windowMs: t.latency.windowMs,
+                            }
+                            : null,
+                    }
+                    : {}),
             };
             totalCpu += m?.cpu ?? 0;
             totalMemory += m?.memory ?? 0;
         }
         return { timestamp: Date.now(), apps, totals: { cpu: totalCpu, memory: totalMemory } };
     }
-    async getHealth(_data) {
-        const result = await this.titanHealth.check();
-        // Map TitanHealth indicators to AggregatedHealthDto
+    /**
+     * The daemon's own indicators, and each app as the app answered.
+     *
+     * This returned the daemon's titan-health indicators under `apps` — one
+     * «app» per indicator — and never asked an app anything: `omnitron health`
+     * read «Apps: 5 healthy» beside six apps, and `omnitron health main`
+     * printed the daemon's memory for a question about `main`.
+     */
+    async getHealth(data) {
+        const answered = await this.orchestrator.getHealth(data.name);
+        if (data.name !== undefined && Object.keys(answered).length === 0) {
+            throw Errors.notFound('App', data.name);
+        }
         const apps = {};
-        for (const [name, indicator] of Object.entries(result.indicators)) {
-            const check = {
-                name,
-                status: indicator.status === 'healthy' ? 'pass' : indicator.status === 'degraded' ? 'warn' : 'fail',
+        for (const [name, health] of Object.entries(answered)) {
+            apps[name] = health
+                ? {
+                    status: health.status,
+                    checks: health.checks.map((c) => ({ name: c.name, status: c.status, ...(c.message ? { message: c.message } : {}) })),
+                }
+                : { status: 'degraded', checks: [{ name: 'health', status: 'warn', message: 'this app has not answered a health question yet' }] };
+        }
+        let daemon;
+        if (data.name === undefined) {
+            const result = await this.titanHealth.check();
+            daemon = {
+                status: result.status,
+                indicators: Object.entries(result.indicators).map(([name, indicator]) => ({
+                    name,
+                    status: indicator.status === 'healthy' ? 'pass' : indicator.status === 'degraded' ? 'warn' : 'fail',
+                    ...(indicator.message ? { message: indicator.message } : {}),
+                })),
             };
-            if (indicator.message)
-                check.message = indicator.message;
-            apps[name] = { status: indicator.status, checks: [check] };
         }
-        return {
-            timestamp: Date.now(),
-            overall: result.status,
-            apps,
-        };
+        const overall = worstVerdict([...(daemon ? [daemon.status] : []), ...Object.values(apps).map((a) => a.status)]);
+        return { timestamp: Date.now(), overall, ...(daemon ? { daemon } : {}), apps };
     }
+    /**
+     * An app's latest records: from this daemon's capture when it runs the app,
+     * otherwise from the rows stored in the log table — which is where the
+     * nodes' synced logs live.
+     *
+     * This read the local capture only, so every app on another machine had no
+     * logs: `omnitron logs daos/deployed/main` answered «No log entries found»
+     * while `OmnitronLogs.queryLogs` on this same daemon returned that app's
+     * rows from node 16f3dd5a. Each stored entry says where it came from in
+     * `data.sourceNode` — the node's id, or `null` for this machine's own.
+     *
+     * Nodes name what they run `<project>/deployed/<app>`; that is the name
+     * their rows carry and the one this answers to. Mapping a stack's name
+     * (`daos/test/main`) onto it needs the stack's nodes, which this service
+     * cannot see — `omnitron logs` asks the project for them and comes back
+     * with the node's name.
+     */
     async getLogs(data) {
-        return this.logManager.getLogs(data.name, data.lines);
+        const local = this.logManager.getLogs(data.name, data.lines);
+        if (data.name === undefined || local.length > 0 || this.orchestrator.getHandle(data.name))
+            return local;
+        return this.logStore ? this.logStore.storedEntries(data.name, data.lines ?? 100) : local;
+    }
+    /** Where the stored rows are — the daemon hands it over once it has one (`daemon.ts`). */
+    logStore = null;
+    setLogStore(store) {
+        this.logStore = store;
     }
     // ============================================================================
     // Scaling (Operator: admin + operator)
@@ -171,6 +401,16 @@ let DaemonRpcService = class DaemonRpcService {
     async reloadConfig() {
         const newConfig = await loadEcosystemConfig();
         this.config = newConfig;
+        // P0-G — push the new config into the orchestrator too. Pre-fix
+        // these two refs drifted: daemon.startApp read the new entries,
+        // orchestrator.restartApp kept reading the old ones (mode, env,
+        // dependsOn, restart policy all silently stale until next daemon
+        // restart).
+        this.orchestrator.setConfig(newConfig);
+        // Same omission as the config refs above, one layer out: the file
+        // watcher keeps its own app list, so without this a reload changed
+        // which apps get restarted but not which are watched.
+        this.daemon.applyWatchConfig(newConfig);
         return { success: true };
     }
     async setMetricsEnabled(data) {
@@ -191,50 +431,118 @@ let DaemonRpcService = class DaemonRpcService {
     async inspect(data) {
         const handle = this.orchestrator.getHandle(data.name);
         if (!handle)
-            throw new Error(`Unknown app: ${data.name}`);
-        const metricsMap = await this.orchestrator.getMetrics(data.name);
-        const appMetrics = metricsMap[data.name];
-        const memory = { heapUsed: 0, heapTotal: 0, external: 0, arrayBuffers: 0, rss: 0 };
-        if (handle.pid && handle.status === 'online') {
-            try {
-                const { execSync } = await import('node:child_process');
-                const psOutput = execSync(`ps -p ${handle.pid} -o rss=`, { encoding: 'utf-8' }).trim();
-                const rssKb = parseInt(psOutput, 10);
-                if (!isNaN(rssKb)) {
-                    memory.rss = rssKb * 1024;
-                }
-            }
-            catch {
-                /* process may have exited */
-            }
-        }
-        if (memory.rss === 0 && appMetrics?.memory) {
-            memory.rss = appMetrics.memory;
-        }
+            throw Errors.notFound('App', data.name);
+        // The app's resident memory is every process it runs — supervisor
+        // children and pool workers — sampled in one `ps` by the code `list`
+        // reads (`sampleAppMetrics`), which also leaves each entry's share in
+        // `handle.childMetrics`. This used to `ps` the single pid on the handle:
+        // one process, and the app's last child rather than its server —
+        // «Memory RSS 157.2MB» for a priceverse of ~508 MB. Keyed by the
+        // handle's own name, because `data.name` is what the operator typed and
+        // `main` is not a key of the answer. A stopped app has no processes; its
+        // last sample is history, not memory.
+        const metricsMap = await this.orchestrator.getMetrics(handle.name);
+        const appMetrics = metricsMap[handle.name];
+        const memory = {
+            heapUsed: 0,
+            heapTotal: 0,
+            external: 0,
+            arrayBuffers: 0,
+            rss: handle.status === 'stopped' ? 0 : (appMetrics?.memory ?? 0),
+        };
+        const sampledRss = (entryName) => handle.status === 'stopped' ? undefined : handle.childMetrics.get(entryName)?.memory;
+        const secondsSince = (startTime) => typeof startTime === 'number' ? Math.floor((Date.now() - startTime) / 1000) : undefined;
+        // T#66: per-child diagnostic surface. The legacy `services`
+        // flat list collapsed every child's service name into a single
+        // dedupe-less array — when 4 bootstrap children all exposed
+        // `BootstrapApp` (Titan's default Application service name)
+        // operators saw `BootstrapApp@1.0.0` four times with no way to
+        // tell which child each entry referred to. The new `children`
+        // array is keyed by supervisor child name (e.g. "http",
+        // "captcha-generator") and carries OS pid + processId + uptime.
+        const children = [];
         const services = [];
         if (handle.mode === 'bootstrap' && handle.supervisor) {
             const childNames = handle.supervisor.getChildNames();
             for (const childName of childNames) {
-                const processId = handle.supervisor.getChildProcessId(childName);
-                if (processId) {
-                    const workerHandle = this.orchestrator.getWorkerHandle(processId);
-                    if (workerHandle?.serviceName) {
-                        services.push(`${workerHandle.serviceName}@${workerHandle.serviceVersion}`);
-                    }
+                // A pool child's proxy answers `__processId` with a function.
+                const rawId = handle.supervisor.getChildProcessId(childName);
+                const processId = typeof rawId === 'string' ? rawId : undefined;
+                const workerHandle = processId ? this.orchestrator.getWorkerHandle(processId) : undefined;
+                const procInfo = processId ? this.orchestrator.getChildProcessInfo(processId) : undefined;
+                const uptimeSeconds = secondsSince(procInfo?.startTime);
+                // `childMetrics` is keyed by topology entry; a supervisor child is
+                // named `${app}/${entry}`, or by the app alone when it has no topology.
+                const prefix = `${handle.name}/`;
+                const rss = sampledRss(childName.startsWith(prefix) ? childName.slice(prefix.length) : childName);
+                const entry = {
+                    name: childName,
+                    pid: workerHandle?.pid ?? null,
+                    ...(processId && { processId }),
+                    ...(workerHandle?.serviceName && { serviceName: workerHandle.serviceName }),
+                    ...(workerHandle?.serviceVersion && { serviceVersion: workerHandle.serviceVersion }),
+                    ...(uptimeSeconds !== undefined && { uptimeSeconds }),
+                    ...(rss !== undefined && { rss }),
+                };
+                children.push(entry);
+                if (workerHandle?.serviceName) {
+                    services.push(`${workerHandle.serviceName}@${workerHandle.serviceVersion}`);
                 }
             }
         }
-        const appConfig = {};
-        const entry = this.config?.apps?.find((a) => a.name === data.name);
-        if (entry) {
-            appConfig['mode'] = handle.mode;
-            appConfig['instances'] = handle.instanceCount ?? 1;
-            appConfig['critical'] = entry.critical ?? false;
-            if (handle.port)
-                appConfig['port'] = handle.port;
-            if (entry.bootstrap)
-                appConfig['bootstrap'] = entry.bootstrap;
+        // Pools are not supervisor children, so the walk above never saw them —
+        // storage's two transform workers were in no section of this answer.
+        const pools = [];
+        for (const [poolName, pool] of handle.topologyPools) {
+            const workers = pool.getWorkerIds().map((workerId) => {
+                const uptimeSeconds = secondsSince(this.orchestrator.getChildProcessInfo(workerId)?.startTime);
+                return {
+                    pid: this.orchestrator.getWorkerHandle(workerId)?.pid ?? null,
+                    processId: workerId,
+                    ...(uptimeSeconds !== undefined && { uptimeSeconds }),
+                };
+            });
+            const rss = sampledRss(poolName);
+            pools.push({
+                name: poolName,
+                declaredInstances: handle.topologyProcesses?.find((p) => p.name === poolName)?.instances ?? workers.length,
+                workers,
+                ...(rss !== undefined && { rss }),
+            });
         }
+        // T#66: log paths. Project-mode apps live under
+        // ~/.omnitron/projects/{project}/{stack}/logs/{app}/, standalone
+        // apps under ~/.omnitron/logs/{app}/. The exact resolution is
+        // LogManager's responsibility — we just surface the result so
+        // operators don't have to memorise which layout an app uses.
+        //
+        // `handle.name`, NOT `data.name`. LogManager picks the layout by
+        // counting slashes, so it needs the fully-qualified name the writer
+        // uses; `data.name` is whatever the operator typed. `omnitron inspect
+        // main` therefore reported ~/.omnitron/logs/main/app.log while the app
+        // was writing to ~/.omnitron/projects/acme/dev/logs/main/app.log — and
+        // the reported file EXISTS, left over from the standalone era and full
+        // of real log lines from days earlier, so tailing it during an incident
+        // looks like an app that has gone quiet. `getLogFilePath` also mkdirs
+        // its answer, so asking the wrong question created the decoy directory.
+        // `getHandle` already resolves a bare name (see its comment — the same
+        // bug was fixed for `omnitron env main`), so the qualified name is
+        // right here.
+        const logPaths = {
+            app: this.logManager.getLogFilePath(handle.name, 'app'),
+            error: this.logManager.getLogFilePath(handle.name, 'error'),
+        };
+        // From the entry the app was started with. This looked the name up in
+        // the daemon's own config, which holds bare names and none of a
+        // project's apps — `config: {}` for `main` and `daos/dev/main` alike.
+        const entry = handle.entry;
+        const appConfig = {
+            mode: handle.mode,
+            instances: handle.instanceCount ?? 1,
+            critical: entry.critical ?? false,
+            ...(handle.port && { port: handle.port }),
+            ...(entry.bootstrap && { bootstrap: entry.bootstrap }),
+        };
         return {
             name: handle.name,
             pid: handle.pid,
@@ -243,39 +551,34 @@ let DaemonRpcService = class DaemonRpcService {
             uptime: handle.uptime,
             restarts: handle.restarts,
             services,
+            children,
+            pools,
+            logPaths,
             config: appConfig,
+            // Surface the crash context when the app is dead so
+            // `omnitron inspect` can render exit code + signal +
+            // stderr tail without a separate RPC round-trip.
+            ...(handle.lastExit && { lastExit: { ...handle.lastExit } }),
         };
     }
     async exec(data) {
         const handle = this.orchestrator.getHandle(data.name);
         if (!handle)
-            throw new Error(`Unknown app: ${data.name}`);
+            throw Errors.notFound('App', data.name);
         if (handle.status !== 'online')
-            throw new Error(`App '${data.name}' is not online`);
+            throw Errors.conflict(`App '${data.name}' is not online`);
         if (handle.mode === 'bootstrap' && handle.supervisor) {
-            const childNames = handle.supervisor.getChildNames();
-            if (childNames.length === 0)
-                throw new Error(`No running children for app '${data.name}'`);
-            const proxy = await handle.supervisor.getChildProxy(childNames[0]);
-            if (!proxy)
-                throw new Error(`Cannot get proxy for app '${data.name}'`);
-            const service = proxy[data.service];
-            if (!service)
-                throw new Error(`Service '${data.service}' not found on app '${data.name}'`);
-            const fn = service[data.method];
-            if (typeof fn !== 'function')
-                throw new Error(`Method '${data.method}' not found on service '${data.service}'`);
-            return fn.call(service, ...data.args);
+            return this.execInBootstrapApp(handle.supervisor, data);
         }
         if (!handle.port)
-            throw new Error(`App '${data.name}' has no port configured`);
+            throw Errors.conflict(`App '${data.name}' has no port configured`);
         const { HttpConnection } = await import('@omnitron-dev/titan/netron/transport/http');
         const connection = new HttpConnection(`http://127.0.0.1:${handle.port}`, { timeout: 30_000 });
         try {
             const service = await connection.queryInterface(data.service);
             const fn = service[data.method];
             if (typeof fn !== 'function')
-                throw new Error(`Method '${data.method}' not found on service '${data.service}'`);
+                throw Errors.notFound('Method', `${data.service}.${data.method}`);
             return await fn.call(service, ...data.args);
         }
         finally {
@@ -287,11 +590,44 @@ let DaemonRpcService = class DaemonRpcService {
             }
         }
     }
+    /** A bootstrap app's call, through the one road `exec` and the alert sink share. */
+    async execInBootstrapApp(supervisor, data) {
+        return callExposedService(supervisor, data.name, data.service, data.method, data.args);
+    }
+    /**
+     * An app's environment with its secrets replaced (`redactEnv`): by key name,
+     * and the password inside a URL-shaped value. This returned every value in
+     * clear to anyone with the operator role — `omnitron env main` printed
+     * JWT_SECRET and the database password — and `inspect` masked by key name
+     * alone, which left the password in `DATABASE_URL` on the screen.
+     */
     async getEnv(data) {
         const handle = this.orchestrator.getHandle(data.name);
         if (!handle)
-            throw new Error(`Unknown app: ${data.name}`);
-        return handle.entry.env ?? {};
+            throw Errors.notFound('App', data.name);
+        return redactEnv(handle.entry.env ?? {});
+    }
+    /**
+     * The clear values — admin only, and recorded in the audit trail with who
+     * asked, because once shown they cannot be taken back.
+     */
+    async revealEnv(data) {
+        const handle = this.orchestrator.getHandle(data.name);
+        if (!handle)
+            throw Errors.notFound('App', data.name);
+        const env = handle.entry.env ?? {};
+        await this.audit?.record({
+            action: 'app.env.reveal',
+            resourceType: 'app',
+            resourceId: handle.name,
+            details: { keys: Object.keys(env).length },
+        });
+        return { ...env };
+    }
+    audit;
+    /** Wired once the audit trail is up; a daemon without one reveals nothing it could not record. */
+    setAudit(audit) {
+        this.audit = audit;
     }
     // ============================================================================
     // Watch Mode (Operator: admin + operator)
@@ -351,37 +687,37 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "reloadApp", null);
 __decorate([
-    Public({ auth: { roles: VIEWER_ROLES } }),
+    Public({ auth: { roles: CONTROL_PLANE_READ_ROLES } }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "list", null);
 __decorate([
-    Public({ auth: { roles: VIEWER_ROLES } }),
+    Public({ auth: { roles: CONTROL_PLANE_READ_ROLES } }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "getApp", null);
 __decorate([
-    Public({ auth: { roles: VIEWER_ROLES } }),
+    Public({ auth: { roles: CONTROL_PLANE_READ_ROLES } }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "status", null);
 __decorate([
-    Public({ auth: { roles: VIEWER_ROLES } }),
+    Public({ auth: { roles: CONTROL_PLANE_READ_ROLES } }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "getMetrics", null);
 __decorate([
-    Public({ auth: { roles: VIEWER_ROLES } }),
+    Public({ auth: { roles: CONTROL_PLANE_READ_ROLES } }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "getHealth", null);
 __decorate([
-    Public({ auth: { roles: VIEWER_ROLES } }),
+    Public({ auth: { roles: CONTROL_PLANE_READ_ROLES } }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
@@ -417,13 +753,13 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "setMetricsEnabled", null);
 __decorate([
-    Public({ auth: { roles: VIEWER_ROLES } }),
+    Public({ auth: { roles: CONTROL_PLANE_READ_ROLES } }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "getDependencyGraph", null);
 __decorate([
-    Public({ auth: { roles: VIEWER_ROLES } }),
+    Public({ auth: { roles: CONTROL_PLANE_READ_ROLES } }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
@@ -435,11 +771,17 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "exec", null);
 __decorate([
-    Public({ auth: { roles: VIEWER_ROLES } }),
+    Public({ auth: { roles: CONTROL_PLANE_ROLES } }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "getEnv", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], DaemonRpcService.prototype, "revealEnv", null);
 __decorate([
     Public({ auth: { roles: OPERATOR_ROLES } }),
     __metadata("design:type", Function),
@@ -453,7 +795,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], DaemonRpcService.prototype, "disableWatch", null);
 __decorate([
-    Public({ auth: { roles: VIEWER_ROLES } }),
+    Public({ auth: { roles: CONTROL_PLANE_READ_ROLES } }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)