@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/README.md

@@ -30,6 +30,10 @@ omnitron logs
 omnitron logs --level warn --grep "error"
 ```
 
+## Host-owned public ingress
+
+See [host ingress setup, application publication and recovery](HOST-INGRESS.md) for independent multi-application HTTPS hosting through the native CLI and RPC API.
+
 ## License
 
 MIT

package/dist/BUILD.json

@@ -0,0 +1,5 @@
+{
+  "commit": "d6c62c21805c1da8b787a7b54f0ff87ed5f7e113",
+  "dirty": true,
+  "builtAt": "2026-10-26T08:05:48.890Z"
+}

package/dist/cli/omnitron.js

@@ -7,16 +7,33 @@
  */
 import { Command } from 'commander';
 import { CLI_VERSION } from '../config/defaults.js';
+import { setEnvOverride } from '../shared/env-config.js';
 const program = new Command();
 program.name('omnitron').description('Production-grade Titan application supervisor').version(CLI_VERSION);
 // Global --json flag toggles structured machine-readable output and
 // suppresses spinners / styled prose. Also honors `OMNITRON_OUTPUT=json`
 // for environments where flag plumbing is awkward (CI templates, hooks).
 program.option('--json', 'Emit machine-readable JSON output (no spinners, no styling)');
-program.hook('preAction', (cmd) => {
+program.hook('preAction', async (cmd, actionCommand) => {
     const opts = cmd.opts();
     if (opts['json'] || process.env['OMNITRON_OUTPUT'] === 'json') {
+        // Update both the actual env (for child processes / subprocess
+        // inheritance) and the cached snapshot in env-config so
+        // subsequent getEnv() readers in this process see the flag.
         process.env['OMNITRON_OUTPUT'] = 'json';
+        setEnvOverride({ OMNITRON_OUTPUT: 'json' });
+        // Most commands render tables regardless of this flag and say nothing
+        // about it, so a caller asking for JSON silently receives a picture of a
+        // table. The guard makes that refusal explicit and parseable.
+        // The full path, not the leaf: `status` alone names four different
+        // subcommands, so the message has to say which one refused.
+        const path = [];
+        for (let node = actionCommand; node; node = node.parent) {
+            if (node.parent)
+                path.unshift(node.name());
+        }
+        const { installJsonModeGuard } = await import('../commands/output.js');
+        installJsonModeGuard(path.join(' ') || actionCommand.name());
     }
 });
 // ============================================================================
@@ -29,7 +46,7 @@ program
     .option('-p, --project <name>', 'Initial project (default: auto-detect from CWD)')
     .option('-f, --foreground', 'Run in foreground (block terminal)')
     .option('--no-infra', 'Skip Docker infrastructure provisioning')
-    .option('--no-watch', 'Disable file watching for dev stacks')
+    .option('--no-watch', 'Disable file watching daemon-wide')
     .option('--master', 'Configure as master node (first-run setup)')
     .option('--slave [address]', 'Configure as slave node (first-run setup). Optional: host:port of master')
     .option('--webapp', 'Enable Console UI (webapp) auto-start')
@@ -55,6 +72,40 @@ program
     await downCommand();
 });
 // ============================================================================
+// OS Service (daemon supervision — launchd/systemd)
+// ============================================================================
+const service = program
+    .command('service')
+    .description('Supervise the daemon with the OS (launchd/systemd): auto-restart on crash, start at boot');
+service
+    .command('install')
+    .description('Install + start the OS service (macOS launchd / Linux systemd)')
+    .option('--scope <scope>', 'user (stops at logout) or system (starts at boot, needs root). Default: system for a slave, user otherwise')
+    .action(async (options) => {
+    if (options.scope && options.scope !== 'user' && options.scope !== 'system') {
+        const { log } = await import('@xec-sh/kit');
+        log.error(`Unknown scope ${JSON.stringify(options.scope)}. Use 'user' or 'system'.`);
+        process.exitCode = 1;
+        return;
+    }
+    const { serviceInstall } = await import('../commands/service.js');
+    await serviceInstall(options.scope ? { scope: options.scope } : {});
+});
+service
+    .command('uninstall')
+    .description('Stop the supervised daemon and remove the OS service')
+    .action(async () => {
+    const { serviceUninstall } = await import('../commands/service.js');
+    await serviceUninstall();
+});
+service
+    .command('status')
+    .description('Show OS-service supervision state')
+    .action(async () => {
+    const { serviceStatus } = await import('../commands/service.js');
+    await serviceStatus();
+});
+// ============================================================================
 // Project Management
 // ============================================================================
 const project = program.command('project').aliases(['proj']).description('Manage seed projects');
@@ -127,9 +178,25 @@ stack
 stack
     .command('start <project> <stack>')
     .description('Start a stack — provision infra + deploy + start apps')
-    .action(async (projectName, stackName) => {
+    // A remote deployment ships the working tree, so it refuses one that is
+    // not its commit. This is how you say you meant it — and it is a FLAG
+    // rather than a setting because the path that caused the damage, a
+    // master restart resuming its stacks, cannot pass one.
+    .option('--allow-dirty', 'Deploy a working tree that differs from HEAD')
+    // A release instead of the working tree: built by `omnitron release build`
+    // from two commits in clean clones, every gate run. A stack whose config
+    // says `release: { mode: 'required' }` takes nothing else.
+    .option('--release <id>', 'Deploy this release (see `omnitron release build`) instead of the working tree')
+    // For an operator who doubts a node's record of what an app runs: every
+    // artifact is shipped and every app restarted, whatever the record says.
+    .option('--reinstall', "Ship and restart every app, whatever the node's record says it runs")
+    .action(async (projectName, stackName, options) => {
     const { stackStartCommand } = await import('../commands/stack.js');
-    await stackStartCommand(projectName, stackName);
+    await stackStartCommand(projectName, stackName, {
+        allowDirty: options.allowDirty === true,
+        ...(typeof options.release === 'string' ? { release: options.release } : {}),
+        ...(options.reinstall === true ? { reinstall: true } : {}),
+    });
 });
 stack
     .command('stop <project> <stack>')
@@ -138,6 +205,31 @@ stack
     const { stackStopCommand } = await import('../commands/stack.js');
     await stackStopCommand(projectName, stackName);
 });
+stack
+    .command('account <project> <stack>')
+    .description("Accounts on a remote stack's stand: make one (its password goes to this daemon's vault), show one, or take one away")
+    .option('--username <name>', "Make an account with this name")
+    .option('--role <role>', "Its platform role — which exist, and the default, are the project's tool's to say")
+    .option('--display-name <text>', 'Its display name (default: the username)')
+    .option('--show <name>', 'What the stand holds under this name — id, role, when made, last active; never a secret')
+    .option('--census', 'Count the accounts — by role, status and MFA form, and whether the seeded admin opens with its published password')
+    .option('--leftovers [mode]', 'What the probes left on the stand, by the project\'s tool: `census` (the default) — names and what holds each back; `rehearse` — the removal, measured and rolled back; `apply` — the removal, committed only where nothing of somebody who stays would go')
+    .option('--also <usernames>', 'With --leftovers: accounts no template matches, named after reading the census (comma-separated)')
+    .option('--remove <name>', 'Take the account with this name away — with --id, and its password from the vault')
+    .option('--id <uuid>', 'The id of the account --remove takes away (as --show prints it)')
+    .option('--vault-key <key>', 'Where the password is kept (default: <project>.<stack>.account.<username>.password)')
+    .action(async (projectName, stackName, options) => {
+    const { stackAccountCommand } = await import('../commands/stack.js');
+    await stackAccountCommand(projectName, stackName, options);
+});
+stack
+    .command('maintenance <project> <stack> [action]')
+    .description("The stack's maintenance lock at its gateway: `status` (the default), `on` — hold the platform for --minutes and let go by itself — or `off`")
+    .option('--minutes <n>', 'With `on`: how long to hold, 1–60 (default 15)')
+    .action(async (projectName, stackName, action, options) => {
+    const { stackMaintenanceCommand } = await import('../commands/stack.js');
+    await stackMaintenanceCommand(projectName, stackName, action, options);
+});
 stack
     .command('runtime <project> <stack>')
     .description('Show stack runtime status as JSON')
@@ -223,6 +315,13 @@ program
     const { monitCommand } = await import('../commands/monit.js');
     await monitCommand();
 });
+program
+    .command('doctor')
+    .description('Diagnose why the platform is unhealthy — findings, evidence, and what to do')
+    .action(async () => {
+    const { doctorCommand } = await import('../commands/doctor.js');
+    await doctorCommand();
+});
 program
     .command('health [app]')
     .description('Health check report')
@@ -273,16 +372,17 @@ program
 program
     .command('exec <app> <service> <method> [args...]')
     .description('Invoke an RPC method on a managed app')
-    .action(async (app, service, method, args) => {
+    .action(async (app, serviceName, method, args) => {
     const { execCommand } = await import('../commands/exec.js');
-    await execCommand(app, service, method, args);
+    await execCommand(app, serviceName, method, args);
 });
 program
     .command('env <app>')
-    .description('Show resolved environment variables')
-    .action(async (app) => {
+    .description('Show resolved environment variables, secrets replaced')
+    .option('--reveal', 'Show secrets in clear (admin only; recorded in the audit trail)')
+    .action(async (app, options) => {
     const { envCommand } = await import('../commands/env.js');
-    await envCommand(app);
+    await envCommand(app, options);
 });
 // ============================================================================
 // Infrastructure
@@ -311,6 +411,13 @@ remote
     const { remoteListCommand } = await import('../commands/remote.js');
     await remoteListCommand();
 });
+remote
+    .command('restart <alias> <app>')
+    .description('Restart an app on a registered remote daemon')
+    .action(async (alias, app) => {
+    const { remoteRestartCommand } = await import('../commands/remote.js');
+    await remoteRestartCommand(alias, app);
+});
 remote
     .command('status <alias>')
     .description('Check remote server status')
@@ -343,6 +450,92 @@ fleet
     const { fleetMetricsCommand } = await import('../commands/fleet.js');
     await fleetMetricsCommand();
 });
+fleet
+    .command('recover <node> <receipt>')
+    .description('Recover an interrupted host upgrade from its recorded receipt')
+    .action(async (node, receipt) => {
+    const { fleetRecoverCommand } = await import('../commands/fleet-recover.js');
+    await fleetRecoverCommand(node, receipt);
+});
+fleet
+    .command('upgrade [nodes...]')
+    .description('Install the omnitron built from this working tree on registered nodes')
+    .option('--dry-run', 'Print the plan and ship nothing')
+    .option('--keep <n>', 'Versions to keep on each node (default: 3)', (v) => Number(v))
+    .option('--allow-dirty', 'Ship a working tree with uncommitted changes, deliberately')
+    .action(async (nodes, options) => {
+    const { fleetUpgradeCommand } = await import('../commands/fleet.js');
+    await fleetUpgradeCommand(nodes ?? [], options);
+});
+// ============================================================================
+// Release — two commits, clean clones, every gate, the artifacts
+// ============================================================================
+const release = program
+    .command('release')
+    .description('Build a release: a named commit of the project AND omni, in clean clones, gated and packed');
+release
+    .command('build <project>')
+    .description('Clone both commits, install, run every gate, pack the artifacts, write the manifest')
+    .option('--project-commit <sha>', "The project commit to build (default: the project checkout's HEAD)")
+    .option('--omni-commit <sha>', "The omni commit to build (default: the omni checkout's HEAD)")
+    .option('--keep-source', 'Keep the clones after a successful build')
+    .option('--skip-gates', 'Record every gate as not-run instead of running them — a look, never a release for a stack')
+    .option('--for <stack>', "Also build the static bundle this stack's gateway serves, with its environment")
+    .action(async (projectName, options) => {
+    const { releaseBuildCommand } = await import('../commands/release.js');
+    await releaseBuildCommand(projectName, { ...options, ...(options.for ? { forStack: options.for } : {}) });
+});
+release
+    .command('list')
+    .description('Every release built on this machine, newest first')
+    .action(async () => {
+    const { releaseListCommand } = await import('../commands/release.js');
+    await releaseListCommand();
+});
+release
+    .command('show <id>')
+    .description('One release in full: its commits, its gates, its artifacts')
+    .action(async (id) => {
+    const { releaseShowCommand } = await import('../commands/release.js');
+    await releaseShowCommand(id);
+});
+release
+    .command('attest <id>')
+    .description('Store what a stack measured about this release — production asks for it by name')
+    .requiredOption('--stack <name>', 'Which stack ran the probes')
+    .option('--from <file>', 'Where the producer printed it; `-` or absent reads standard input')
+    .option('--on-node', "Have the daemon run the release's probes on the stack's node, over its own transport")
+    .action(async (id, options) => {
+    const { releaseAttestCommand } = await import('../commands/release.js');
+    await releaseAttestCommand(id, options);
+});
+release
+    .command('push <id>')
+    .description("Put a release in the artifact store (`releaseStore` in ~/.omnitron/config.json, its key in the daemon's vault)")
+    .option('--root <dir>', 'Where the release is read from (default: ~/.omnitron/releases)')
+    .option('--repair', "Write every object again even where the store's index matches — for a store a pull found damaged")
+    .action(async (id, options) => {
+    const { releasePushCommand } = await import('../commands/release-store.js');
+    await releasePushCommand(id, options);
+});
+release
+    .command('pull <id>')
+    .description('Take a release from the artifact store and check it as a deployment would, before it appears here')
+    .option('--root <dir>', 'Where the release is written (default: ~/.omnitron/releases)')
+    .action(async (id, options) => {
+    const { releasePullCommand } = await import('../commands/release-store.js');
+    await releasePullCommand(id, options);
+});
+release
+    .command('prune')
+    .description('Remove all but the newest releases, never one a stack runs')
+    .option('--keep <n>', 'How many to keep (default: 5)', (v) => Number(v))
+    .option('--yes', 'Remove them; without this it only says what it would remove')
+    .option('--allow-unprotected', 'Remove even when the daemon cannot say which releases the stacks run (stopped daemon, no audit trail)')
+    .action(async (options) => {
+    const { releasePruneCommand } = await import('../commands/release.js');
+    await releasePruneCommand(options);
+});
 // ============================================================================
 // Cluster
 // ============================================================================
@@ -386,6 +579,31 @@ secret
     const { secretListCommand } = await import('../commands/secret.js');
     await secretListCommand();
 });
+secret
+    .command('generate <key>')
+    .description('Make a random secret where it is kept — nothing printed but its name')
+    .option('--bytes <n>', 'How many random bytes (16–1024)', '32')
+    .option('--encoding <enc>', 'base64, base64url or hex', 'base64')
+    .action(async (key, opts) => {
+    const { secretGenerateCommand } = await import('../commands/secret.js');
+    await secretGenerateCommand(key, opts);
+});
+secret
+    .command('copy <from> <to>')
+    .description('A second key holding the same secret — nothing printed but key names')
+    .action(async (from, to) => {
+    const { secretCopyCommand } = await import('../commands/secret.js');
+    await secretCopyCommand(from, to);
+});
+secret
+    .command('rotate-rpcauth <passwordKey>')
+    .description('A new RPC password and its bitcoind rpcauth value, as a pair — nothing printed but key names')
+    .requiredOption('--user-key <key>', 'The secret holding the RPC user')
+    .requiredOption('--auth-key <key>', 'The secret to hold the rpcauth value')
+    .action(async (passwordKey, opts) => {
+    const { secretRotateRpcauthCommand } = await import('../commands/secret.js');
+    await secretRotateRpcauthCommand(passwordKey, opts);
+});
 secret
     .command('delete <key>')
     .description('Delete a secret')
@@ -414,15 +632,21 @@ program
 // Deployment
 // ============================================================================
 const deploy = program.command('deploy').description('Deployment management');
+// `--strategy rolling|blue-green|canary` and `--version` used to be declared
+// here, accepted by the parser, and read by nothing on the way to a command
+// that only restarted an app. An accepted flag is a promise — `--help`
+// advertised four deploy strategies this system has never implemented — so
+// they are gone rather than left decorating a refusal.
+//
+// `-t, --target` went the same way: it named the alias in an
+// `omnitron remote restart` line the message no longer prints (a restart is
+// not a deployment, and that registry was empty), and nothing else read it.
 deploy
     .command('app <app>')
-    .description('Deploy app with strategy')
-    .option('-s, --strategy <strategy>', 'Deploy strategy (rolling|all-at-once|blue-green|canary)', 'all-at-once')
-    .option('-v, --version <version>', 'Version label (git sha, tag, or custom)')
-    .option('-t, --target <server>', 'Target server alias or tag')
-    .action(async (app, opts) => {
+    .description('Not implemented — prints where deployment is: `omnitron stack start`')
+    .action(async (app) => {
     const { deployCommand } = await import('../commands/deploy.js');
-    await deployCommand(app, opts);
+    await deployCommand(app);
 });
 deploy
     .command('build <app>')
@@ -431,26 +655,43 @@ deploy
     const { projectBuildCommand } = await import('../commands/deploy.js');
     await projectBuildCommand(app);
 });
+// `-t, --target` was accepted here and read by nothing (`_opts`).
 program
     .command('rollback <app>')
-    .description('Rollback app to previous version')
-    .option('-t, --target <server>', 'Target server alias or tag')
-    .action(async (app, opts) => {
+    .description('Not implemented — prints the way back: deploy the previous release')
+    .action(async (app) => {
     const { rollbackCommand } = await import('../commands/deploy.js');
-    await rollbackCommand(app, opts);
+    await rollbackCommand(app);
 });
 // ============================================================================
 // Infrastructure Management
 // ============================================================================
 // Top-level `tor` command — quick access to onion addresses.
 program
-    .command('tor')
-    .description('Show Tor hidden service onion addresses')
-    .action(async () => {
+    .command('tor [project] [stack]')
+    .description('Show Tor hidden service onion addresses (every tor container on this machine, or one stack\'s)')
+    .action(async (projectName, stackName) => {
     const { torCommand } = await import('../commands/tor.js');
-    await torCommand();
+    await torCommand(projectName, stackName);
 });
 const infra = program.command('infra').description('Manage infrastructure containers (PostgreSQL, Redis, MinIO, etc.)');
+const ingress = infra.command('ingress').description('Manage host-owned public ingress independently of application stacks');
+for (const operation of ['configure', 'check', 'validate', 'apply', 'restore', 'rollback-takeover', 'remove']) {
+    ingress.command(`${operation} <manifest>`)
+        .description(`${operation} host ingress using a JSON manifest (host daemon, exact generation CAS)`)
+        .action(async (manifest) => {
+        const { hostIngressCommand } = await import('../commands/host-ingress.js');
+        await hostIngressCommand(operation, manifest);
+    });
+}
+for (const operation of ['status', 'recover']) {
+    ingress.command(operation)
+        .description(operation === 'status' ? 'Read configured and observed ingress generation' : 'Recover an interrupted host ingress publication')
+        .action(async () => {
+        const { hostIngressCommand } = await import('../commands/host-ingress.js');
+        await hostIngressCommand(operation);
+    });
+}
 infra
     .command('up')
     .description('Provision and start all infrastructure services')
@@ -469,19 +710,33 @@ infra
 infra
     .command('status')
     .aliases(['ps'])
-    .description('Show infrastructure container status')
-    .action(async () => {
+    .description('Show infrastructure container status (this machine, or one stack\'s wherever it runs)')
+    .option('--stack <project/stack>', 'One stack\'s containers; a remote stack is asked of its node')
+    .action(async (opts) => {
     const { infraStatusCommand } = await import('../commands/infra.js');
-    await infraStatusCommand();
+    await infraStatusCommand(opts.stack ? { stack: opts.stack } : {});
+});
+const collect = (value, previous = []) => [...previous, value];
+infra
+    .command('inspect <project/stack>')
+    .description('What each node of a remote stack would find and do on its host — read, never changed')
+    .option('--unit <name>', 'Also read this systemd unit (repeatable)', collect)
+    .option('--path <path>', 'Also measure this path: owner, size, free space (repeatable)', collect)
+    .option('--snap <name>', 'Also read this snap package (repeatable)', collect)
+    .option('--config <file:key,key>', 'Also read these keys of a key=value file; credentials refused (repeatable)', collect)
+    .action(async (target, opts) => {
+    const { infraInspectCommand } = await import('../commands/infra.js');
+    await infraInspectCommand(target, opts);
 });
 infra
     .command('logs [service]')
     .description('View infrastructure service logs')
     .option('-f, --follow', 'Follow log output')
     .option('-n, --lines <N>', 'Number of lines', '50')
-    .action(async (service, opts) => {
+    .option('--stack <project/stack>', 'Only this stack\'s containers')
+    .action(async (serviceName, opts) => {
     const { infraLogsCommand } = await import('../commands/infra.js');
-    await infraLogsCommand(service, opts);
+    await infraLogsCommand(serviceName, opts);
 });
 infra
     .command('psql [database]')
@@ -548,6 +803,13 @@ backup
     const { backupCreateCommand } = await import('../commands/backup.js');
     await backupCreateCommand(database);
 });
+backup
+    .command('full')
+    .description('Full backup: all stack DBs + minio storage + tor keys + daemon-state')
+    .action(async () => {
+    const { backupFullCommand } = await import('../commands/backup.js');
+    await backupFullCommand();
+});
 backup
     .command('list')
     .description('List available backups')
@@ -562,6 +824,28 @@ backup
     const { backupRestoreCommand } = await import('../commands/backup.js');
     await backupRestoreCommand(id);
 });
+backup
+    .command('schedule <target> <cron>')
+    .description("Schedule recurring backups (target 'all' = every stack DB; " +
+    'cron: "0 3 * * *" | hourly|daily|weekly | <ms>)')
+    .action(async (target, cron) => {
+    const { backupScheduleCommand } = await import('../commands/backup.js');
+    await backupScheduleCommand(target, cron);
+});
+backup
+    .command('schedules')
+    .description('List configured backup schedules')
+    .action(async () => {
+    const { backupSchedulesCommand } = await import('../commands/backup.js');
+    await backupSchedulesCommand();
+});
+backup
+    .command('unschedule <target>')
+    .description('Remove a backup schedule')
+    .action(async (target) => {
+    const { backupUnscheduleCommand } = await import('../commands/backup.js');
+    await backupUnscheduleCommand(target);
+});
 // ============================================================================
 // Kubernetes
 // ============================================================================
@@ -603,6 +887,7 @@ node
     .option('--ssh-user <user>', 'SSH user', 'root')
     .option('--ssh-auth <method>', 'Auth method: password|key', 'key')
     .option('--ssh-key <path>', 'Path to SSH private key')
+    .option('--ssh-secret-stdin', 'Read an SSH secret: hidden prompt on a terminal (Enter), or pipe until EOF')
     .option('--runtime <runtime>', 'Runtime: node|bun', 'node')
     .option('--daemon-port <port>', 'Omnitron daemon port', '9700')
     .option('--tags <tags>', 'Comma-separated tags')
@@ -618,6 +903,7 @@ node
         runtime: opts.runtime,
         daemonPort: parseInt(opts.daemonPort, 10),
         tags: opts.tags?.split(',').map((t) => t.trim()) ?? [],
+        secretFromStdin: Boolean(opts.sshSecretStdin),
     });
 });
 node
@@ -629,6 +915,7 @@ node
     .option('--ssh-user <user>', 'SSH user')
     .option('--ssh-auth <method>', 'Auth method: password|key')
     .option('--ssh-key <path>', 'Path to SSH private key')
+    .option('--ssh-secret-stdin', 'Read an SSH secret: hidden prompt on a terminal (Enter), or pipe until EOF')
     .option('--runtime <runtime>', 'Runtime: node|bun')
     .option('--daemon-port <port>', 'Omnitron daemon port')
     .option('--tags <tags>', 'Comma-separated tags')
@@ -653,8 +940,31 @@ node
         input['daemonPort'] = parseInt(opts.daemonPort, 10);
     if (opts.tags)
         input['tags'] = opts.tags.split(',').map((t) => t.trim());
+    if (opts.sshSecretStdin)
+        input['secretFromStdin'] = true;
     await nodeUpdateCommand(id, input);
 });
+program
+    .command('audit')
+    .description('Who changed this control plane, and what they changed')
+    .option('-n, --limit <N>', 'How many entries, newest first (1 to 500)', '50')
+    .option('--action <action>', 'Only this action, e.g. stack.start or stack.start.failed')
+    .option('--resource <type>', 'Only this resource type, e.g. node')
+    .option('--actor <who>', 'Only this actor: user, service or system — or an id, e.g. omnitron-local')
+    .option('--before <time>', 'Only entries older than this ISO time, e.g. 2026-09-22T21:20:37Z')
+    .action(async (opts) => {
+    const { auditListCommand } = await import('../commands/audit.js');
+    // As typed. `parseInt` here turned `-n abc` into NaN, which reached
+    // Postgres as `LIMIT NaN`, and `-n 0` into a request for one row; the
+    // command checks them, and can refuse in JSON when --json was asked for.
+    await auditListCommand({
+        limit: opts.limit,
+        action: opts.action,
+        resource: opts.resource,
+        actor: opts.actor,
+        before: opts.before,
+    });
+});
 node
     .command('remove <id>')
     .alias('rm')
@@ -795,5 +1105,41 @@ kb.command('query <question>')
 // ============================================================================
 // Run
 // ============================================================================
-program.parse();
+/**
+ * Leave when the command is done, whatever the transport is still holding.
+ *
+ * A CLI process should end when its work ends. This one did not: after
+ * talking to the daemon it was kept alive by unix-socket handles that
+ * `netron.stop()` had not closed — and it cannot close them, because closing
+ * a socket gracefully needs the other end, which is exactly what is missing
+ * when the daemon is wedged or starved.
+ *
+ * Measured 2026-09-15 with the development daemon starved at a load average
+ * of 107:
+ *
+ *     $ omnitron ping
+ *     ▲  Daemon is running (PID 69597) but did not answer within 5s
+ *     ●  It is most likely busy starting apps…
+ *     (then nothing; killed by the shell's timeout at 2:00)
+ *
+ *     active resources after disconnect: ["PipeWrap","PipeWrap","PipeWrap"]
+ *
+ * The command had said everything it had to say and still could not return,
+ * which is worse for a script than either the hang or the error alone: the
+ * output arrived and the exit never did.
+ *
+ * `process.exitCode` is what the commands set to report failure, so it is
+ * what is used — this changes when the process leaves, not what it says.
+ *
+ * Commands that run indefinitely by design — `monit`, `logs --follow` — hold
+ * the loop with their own work and never reach here.
+ */
+program.parseAsync().then(() => process.exit(process.exitCode ?? 0), (err) => {
+    // Commander prints its own errors and sets an exit code; anything else
+    // reaching here is a bug in a command, and swallowing it would hide it.
+    if (err?.exitCode == null) {
+        console.error(err instanceof Error ? err.stack ?? err.message : String(err));
+    }
+    process.exit(process.exitCode ?? 1);
+});
 //# sourceMappingURL=omnitron.js.map