@orb44/cli 0.1.5 → 0.1.7

package/README.md

@@ -13,11 +13,11 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli@0.1.5 status
-npx @orb44/cli@0.1.5 pulse
-npx @orb44/cli@0.1.5 install     # later: background pulse, starts after reboot
+npx @orb44/cli@0.1.7 status
+npx @orb44/cli@0.1.7 pulse
+npx @orb44/cli@0.1.7 install     # later: background pulse, starts after reboot
 orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
-npx @orb44/cli@0.1.5 logout
+npx @orb44/cli@0.1.7 logout
 ```
 
 Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.

package/bin/orb44.mjs

@@ -9,7 +9,8 @@ import { collectPulse, formatPulsePreview } from "../server/pulse.mjs";
 import { LANGS, LANG_LABEL, detectLang, normalizeLang, t } from "../server/sat-i18n.mjs";
 import { pickFromList } from "../server/cli-menu.mjs";
 import { SYSTEM_DEVICE, parseDeviceJson, hasExistingInstall, pickLiveDevice, deviceSearchPaths, loadFirstDevice, stripDevicePath } from "../server/sat-local.mjs";
-import { CLI_PACKAGE, cmpVer, readCliVersion, pickSatRoots, applyUpdateTree, fetchLatestMeta, unpackTarball } from "../server/sat-update.mjs";
+import { CLI_PACKAGE, cmpVer, readCliVersion, pickSatRoots, staleSatRoots, applyUpdateTree, fetchLatestMeta, unpackTarball } from "../server/sat-update.mjs";
+import { cabinetRequest, apiFailText } from "../server/sat-http.mjs";
 
 const DEVICE_FILE = process.env.ORB44_DEVICE_FILE || path.join(os.homedir(), ".config", "orb44", "device.json");
 const CLI_FILE = process.env.ORB44_CLI_FILE || path.join(path.dirname(DEVICE_FILE), "cli.json");
@@ -82,16 +83,12 @@ function clearDevice() {
   }
 }
 
-async function api(url, pathname, { method = "GET", json, secret } = {}) {
-  const headers = { "Content-Type": "application/json", Accept: "application/json" };
-  if (secret) headers.Authorization = `Bearer ${secret}`;
-  const r = await fetch(`${url.replace(/\/$/, "")}${pathname}`, {
-    method,
-    headers,
-    body: json ? JSON.stringify(json) : undefined,
-  });
-  const body = await r.json().catch(() => ({}));
-  return { ok: r.ok, status: r.status, body };
+function api(url, pathname, opts) {
+  return cabinetRequest(url, pathname, opts);
+}
+
+function failLine(out, fallbackKey = "pulse_fail") {
+  return "⚠️  " + apiFailText(lang, out, t, fallbackKey);
 }
 
 function dim(s) {
@@ -125,7 +122,7 @@ async function ensureLang(opts) {
     return lang;
   }
   lang = detectLang();
-  if (opts.yes || !input.isTTY || !output.isTTY) {
+  if (opts.yes || opts.url || !input.isTTY || !output.isTTY) {
     saveCli({ ...loadCli(), lang });
     return lang;
   }
@@ -245,9 +242,10 @@ async function revokeLocalDevices(devices, fallbackApi) {
 }
 
 async function cmdLogin(opts) {
+  const url = String(opts.url || process.env.ORB44_API || "http://127.0.0.1:8787").replace(/\/$/, "");
+  process.stdout.write(`orb44 login → ${url}\n`);
   await ensureLang(opts);
   banner();
-  const url = String(opts.url || process.env.ORB44_API || "http://127.0.0.1:8787").replace(/\/$/, "");
   const found = existingOnBox();
   if (hasExistingInstall(found)) {
     const replace = await wantReplace(found, opts);
@@ -259,7 +257,7 @@ async function cmdLogin(opts) {
       }
       const { out } = await sendPulse(live);
       if (!out.ok) {
-        console.error(`⚠️  ${out.body.error || t(lang, "pulse_fail")}`);
+        console.error(failLine(out));
         process.exit(1);
       }
       console.log("\n📡  " + t(lang, "pulse_ok"));
@@ -276,7 +274,7 @@ async function cmdLogin(opts) {
     json: { hostname, name },
   });
   if (!begin.ok || !begin.body.pollToken) {
-    console.error(`⚠️  ${begin.body.error || t(lang, "pair_fail")}`);
+    console.error(failLine(begin, "pair_fail"));
     process.exit(1);
   }
   console.log(`🔗  API ${url}`);
@@ -320,7 +318,7 @@ async function cmdLogin(opts) {
 
   const { out } = await sendPulse(device);
   if (!out.ok) {
-    console.error(`⚠️  ${out.body.error || t(lang, "pulse_fail")}`);
+    console.error(failLine(out));
     process.exit(1);
   }
   console.log("\n📡  " + t(lang, "pulse_ok"));
@@ -350,10 +348,7 @@ async function cmdPulse() {
   banner();
   const { out } = await sendPulse(device);
   if (!out.ok) {
-    console.error(
-      "⚠️  " +
-        (out.body.error === "bad_secret" || out.body.error === "not_found" ? t(lang, "key_revoked") : out.body.error || t(lang, "pulse_fail"))
-    );
+    console.error(failLine(out));
     process.exit(1);
   }
   console.log("\n📡  " + t(lang, "pulse_ok"));
@@ -370,14 +365,17 @@ async function cmdDaemon(opts) {
   const sec = intervalSec(opts.interval);
   console.log(`🛰️  ${t(lang, "daemon_run", { sec, host: device.host })}`);
   const tick = async () => {
-    const { out, pulse } = await sendPulse(device, { preview: false });
     const hh = new Date().toISOString().slice(11, 19);
-    if (!out.ok) {
-      const gone = out.body.error === "bad_secret" || out.body.error === "not_found";
-      console.error(`⚠️  ${hh} ${gone ? t(lang, "daemon_revoked") : out.body.error || t(lang, "pulse_fail")}`);
-      return;
+    try {
+      const { out, pulse } = await sendPulse(device, { preview: false });
+      if (!out.ok) {
+        console.error(`⚠️  ${hh} ${apiFailText(lang, out, t)}`);
+        return;
+      }
+      console.log(`📡  ${hh} ok  load ${pulse.load1}  ${pulse.gradeInside || "—"}`);
+    } catch (e) {
+      console.error(`⚠️  ${hh} ${String(e?.message || e).split("\n")[0].slice(0, 200)}`);
     }
-    console.log(`📡  ${hh} ok  load ${pulse.load1}  ${pulse.gradeInside || "—"}`);
   };
   await tick();
   const id = setInterval(tick, sec * 1000);
@@ -646,23 +644,24 @@ async function cmdUpdate() {
     process.exit(1);
   }
   const pin = t(lang, "update_npx", { version: meta.version });
-  if (cmpVer(current, meta.version) >= 0 && !opts.force) {
-    console.log("✅  " + t(lang, "update_same", { version: current }));
-    console.log(dim(pin));
-    return;
-  }
   const roots = pickSatRoots(SCRIPT);
+  const stale = staleSatRoots(roots, meta.version, { force: Boolean(opts.force) });
   if (!roots.length) {
     console.error("⚠️  " + t(lang, "update_no_tree"));
     console.log(dim(pin));
     process.exit(1);
   }
+  if (!stale.length) {
+    console.log("✅  " + t(lang, "update_same", { version: current || meta.version }));
+    console.log(dim(pin));
+    return;
+  }
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "orb44-upd-"));
   let wrote = [];
   try {
     const pkg = await unpackTarball(meta.tarball, tmp);
     const blocked = [];
-    for (const root of roots) {
+    for (const root of stale) {
       try {
         applyUpdateTree(pkg, root);
         wrote.push(root);
@@ -713,7 +712,7 @@ async function cmdLogout() {
   applyLang(opts);
   const device = loadDevice();
   if (device?.secret) {
-    await api(device.api, "/api/satellites/logout", { method: "POST", json: { secret: device.secret } });
+    await api(device.api, "/api/satellites/logout", { method: "POST", json: { secret: device.secret } }).catch(() => {});
   }
   clearDevice();
   console.log("✅  " + t(lang, "logged_out"));
@@ -769,4 +768,9 @@ if (!fn) {
   help();
   process.exit(1);
 }
-await fn();
+try {
+  await fn();
+} catch (e) {
+  console.error("⚠️  " + String(e?.message || e).split("\n")[0].slice(0, 200));
+  process.exit(1);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {
@@ -12,6 +12,7 @@
     "server/sat-i18n.mjs",
     "server/cli-menu.mjs",
     "server/sat-local.mjs",
+    "server/sat-http.mjs",
     "server/sat-update.mjs"
   ],
   "engines": {

package/server/pulse.mjs

@@ -78,17 +78,26 @@ function run(cmd, args) {
 
 const SKIP_TOP = new Set(["ps", "ss", "lsof"]);
 
+const STAT_RE = /^[DRSTZIX][A-Za-z+<]*$/;
+
 export function parsePsTop(text) {
   const rows = [];
   for (const line of String(text || "").split("\n")) {
-    const m = line.trim().match(/^(\d+)\s+([\d.]+)\s+(\d+)\s+(\S+)/);
+    const m = line.trim().match(/^(\d+)\s+([\d.]+)\s+(\d+)\s+(\S+)(?:\s+(\S+))?$/);
     if (!m) continue;
-    const comm = sanitizeComm(m[4]);
+    let stat = null;
+    let commRaw = m[4];
+    if (m[5] && STAT_RE.test(m[4]) && m[4].length <= 8) {
+      stat = m[4].slice(0, 4);
+      commRaw = m[5];
+    }
+    const comm = sanitizeComm(commRaw);
     if (!comm || SKIP_TOP.has(comm)) continue;
     rows.push({
       comm,
       cpuPct: Math.round(Number(m[2]) * 10) / 10,
       rssMb: Math.round(Number(m[3]) / 1024),
+      stat,
     });
   }
   rows.sort((a, b) => b.cpuPct - a.cpuPct || b.rssMb - a.rssMb);
@@ -168,8 +177,10 @@ function listenTable() {
 }
 
 function topTable() {
-  const text = run("ps", ["-axo", "pid=,pcpu=,rss=,comm="]);
-  return parsePsTop(text);
+  const withStat = run("ps", ["-axo", "pid=,pcpu=,rss=,stat=,comm="]);
+  const parsed = parsePsTop(withStat);
+  if (parsed.length) return parsed;
+  return parsePsTop(run("ps", ["-axo", "pid=,pcpu=,rss=,comm="]));
 }
 
 function okListenAddr(a) {
@@ -180,23 +191,29 @@ function okListenAddr(a) {
 }
 
 export function collapseListen(rows = []) {
-  const groups = new Map();
+  const world = [];
+  const rest = [];
   for (const r of rows) {
-    const key = `${Number(r.port)}|${r.comm || ""}`;
-    if (!groups.has(key)) groups.set(key, []);
-    groups.get(key).push(r);
+    if (r.addr === "0.0.0.0" || r.addr === "::" || r.addr === "*") world.push(r);
+    else rest.push(r);
+  }
+  const byPort = new Map();
+  for (const r of world) {
+    const port = Number(r.port);
+    if (!byPort.has(port)) byPort.set(port, []);
+    byPort.get(port).push(r);
   }
   const out = [];
-  for (const list of groups.values()) {
+  for (const list of byPort.values()) {
     const addrs = new Set(list.map((x) => x.addr));
-    const rest = list.filter((x) => x.addr !== "0.0.0.0" && x.addr !== "::" && x.addr !== "*");
+    const comm = list.find((x) => x.comm)?.comm || list[0].comm;
     if (addrs.has("*") || (addrs.has("0.0.0.0") && addrs.has("::"))) {
-      out.push({ addr: "*", port: list[0].port, comm: list[0].comm });
-      out.push(...rest);
+      out.push({ addr: "*", port: list[0].port, comm });
     } else {
       out.push(...list);
     }
   }
+  out.push(...rest);
   return out;
 }
 
@@ -208,6 +225,7 @@ export function sanitizePulse(raw = {}) {
           comm: sanitizeComm(r.comm),
           cpuPct: Math.max(0, Math.min(100, Number(r.cpuPct) || 0)),
           rssMb: Math.max(0, Math.round(Number(r.rssMb) || 0)),
+          stat: STAT_RE.test(String(r.stat || "")) ? String(r.stat).slice(0, 4) : null,
         }))
         .filter((r) => r.comm)
     : [];
@@ -247,6 +265,7 @@ export function sanitizePulse(raw = {}) {
   };
   const limited = Boolean(raw.limited);
   const oom = Boolean(raw.oom) || hardening.oomKills > 0;
+  const pressure = sanitizePressure(raw.pressure || raw);
   const base = {
     ts: Number(raw.ts) || Date.now(),
     hostname: sanitizeComm(raw.hostname) || os.hostname().slice(0, 40),
@@ -261,6 +280,7 @@ export function sanitizePulse(raw = {}) {
     oom,
     limited,
     hardening,
+    pressure,
   };
   return { ...base, gradeInside: gradeInside(base) };
 }
@@ -345,6 +365,172 @@ export function parseVmstatOom(text) {
   return m ? Number(m[1]) : 0;
 }
 
+export function parseSockstat(text) {
+  const tcp = /(?:^|\n)TCP:\s+inuse\s+(\d+)(?:\s+orphan\s+(\d+))?(?:\s+tw\s+(\d+))?/i.exec(String(text || ""));
+  if (!tcp) return { tcpInuse: null, tcpOrphan: null, tcpTw: null };
+  return {
+    tcpInuse: Number(tcp[1]),
+    tcpOrphan: tcp[2] != null ? Number(tcp[2]) : null,
+    tcpTw: tcp[3] != null ? Number(tcp[3]) : null,
+  };
+}
+
+export function parseFileNr(text) {
+  const p = String(text || "").trim().split(/[\s,]+/);
+  const used = Number(p[0]);
+  const max = Number(p[2] ?? p[1]);
+  if (!Number.isFinite(used) || !Number.isFinite(max) || max <= 0) return { fileUsed: null, fileMax: null, filePct: null };
+  return { fileUsed: used, fileMax: max, filePct: Math.max(0, Math.min(100, Math.round((used / max) * 100))) };
+}
+
+export function parseChronyTracking(text) {
+  const m =
+    /Last offset\s*:\s*([+-]?\d+(?:\.\d+)?)\s*seconds/i.exec(String(text || "")) ||
+    /System time\s*:\s*(\d+(?:\.\d+)?)\s*seconds\s+(slow|fast)/i.exec(String(text || ""));
+  if (!m) return null;
+  let n = Number(m[1]);
+  if (!Number.isFinite(n)) return null;
+  if (m[2] === "fast") n = Math.abs(n);
+  if (m[2] === "slow") n = -Math.abs(n);
+  return Math.round(n * 1000) / 1000;
+}
+
+export function parseCgroupEvents(text) {
+  const kill = /(?:^|\n)oom_kill\s+(\d+)/.exec(String(text || ""));
+  const oom = /(?:^|\n)oom\s+(\d+)/.exec(String(text || ""));
+  return {
+    cgroupOom: kill ? Number(kill[1]) : oom ? Number(oom[1]) : 0,
+    memFailcnt: 0,
+  };
+}
+
+export function parseNetstatListenOverflows(text) {
+  const lines = String(text || "").split("\n");
+  let header = "";
+  let values = "";
+  for (const line of lines) {
+    if (/^TcpExt:\s+/.test(line) && /ListenOverflows/.test(line)) header = line;
+    else if (/^TcpExt:\s+/.test(line) && header && !/ListenOverflows/.test(line)) values = line;
+  }
+  if (!header || !values) return { listenOverflows: null, listenDrops: null };
+  const keys = header.replace(/^TcpExt:\s+/, "").trim().split(/\s+/);
+  const nums = values.replace(/^TcpExt:\s+/, "").trim().split(/\s+/).map(Number);
+  const idx = (name) => keys.indexOf(name);
+  const n = (i) => (i >= 0 && Number.isFinite(nums[i]) ? nums[i] : null);
+  return { listenOverflows: n(idx("ListenOverflows")), listenDrops: n(idx("ListenDrops")) };
+}
+
+function readTrim(p) {
+  try {
+    return fs.readFileSync(p, "utf8").trim();
+  } catch {
+    return "";
+  }
+}
+
+function numFile(p) {
+  const n = Number(readTrim(p));
+  return Number.isFinite(n) ? n : null;
+}
+
+export function stuckFromTop(top = []) {
+  return (top || []).filter((r) => {
+    const s = String(r.stat || "")[0];
+    return s === "D" || s === "Z" || s === "T";
+  }).slice(0, 6);
+}
+
+export function hotFromTop(top = []) {
+  return (top || []).filter((r) => Number(r.cpuPct) >= 70 || Number(r.rssMb) >= 1024).slice(0, 6);
+}
+
+export function cpuCount(pulse) {
+  const n = Number(pulse?.pressure?.cpus);
+  return Number.isFinite(n) && n > 0 ? n : 2;
+}
+
+function collectPressure() {
+  const cpus = Math.max(1, os.cpus()?.length || 1);
+  const sock = parseSockstat(readTrim("/proc/net/sockstat"));
+  const files = parseFileNr(readTrim("/proc/sys/fs/file-nr"));
+  let conntrackUsed = numFile("/proc/sys/net/netfilter/nf_conntrack_count");
+  let conntrackMax = numFile("/proc/sys/net/netfilter/nf_conntrack_max");
+  if (conntrackUsed == null) conntrackUsed = numFile("/proc/sys/net/nf_conntrack_count");
+  if (conntrackMax == null) conntrackMax = numFile("/proc/sys/net/nf_conntrack_max");
+  const conntrackPct =
+    conntrackUsed != null && conntrackMax > 0 ? Math.max(0, Math.min(100, Math.round((conntrackUsed / conntrackMax) * 100))) : null;
+  const overflows = parseNetstatListenOverflows(readTrim("/proc/net/netstat"));
+  let clockOffsetSec = parseChronyTracking(runOut("chronyc", ["tracking"]));
+  let ntpSync = null;
+  if (clockOffsetSec != null) ntpSync = true;
+  else {
+    const td = runOut("timedatectl", ["show", "-p", "NTPSynchronized", "--value"]);
+    if (/^yes$/i.test(td.trim())) ntpSync = true;
+    else if (/^no$/i.test(td.trim())) ntpSync = false;
+  }
+  let cgroupOom = 0;
+  let memFailcnt = 0;
+  const ev = parseCgroupEvents(readTrim("/sys/fs/cgroup/memory.events") || readTrim("/sys/fs/cgroup/memory/memory.events"));
+  cgroupOom = ev.cgroupOom || 0;
+  memFailcnt = numFile("/sys/fs/cgroup/memory/memory.failcnt") ?? ev.memFailcnt ?? 0;
+  return {
+    cpus,
+    conntrackUsed,
+    conntrackMax,
+    conntrackPct,
+    tcpInuse: sock.tcpInuse,
+    tcpTw: sock.tcpTw,
+    tcpOrphan: sock.tcpOrphan,
+    listenOverflows: overflows.listenOverflows,
+    listenDrops: overflows.listenDrops,
+    fileUsed: files.fileUsed,
+    fileMax: files.fileMax,
+    filePct: files.filePct,
+    clockOffsetSec,
+    ntpSync,
+    memFailcnt: Math.max(0, Math.min(999999, Number(memFailcnt) || 0)),
+    cgroupOom: Math.max(0, Math.min(999, Number(cgroupOom) || 0)),
+  };
+}
+
+function sanitizePressure(raw = {}) {
+  const n = (v, lo, hi) => {
+    if (v == null || v === "") return null;
+    const x = Number(v);
+    if (!Number.isFinite(x)) return null;
+    return Math.max(lo, Math.min(hi, x));
+  };
+  const cpus = n(raw.cpus, 1, 512) || null;
+  const conntrackUsed = n(raw.conntrackUsed, 0, 1e9);
+  const conntrackMax = n(raw.conntrackMax, 0, 1e9);
+  const conntrackPct =
+    raw.conntrackPct != null
+      ? n(raw.conntrackPct, 0, 100)
+      : conntrackUsed != null && conntrackMax > 0
+        ? Math.max(0, Math.min(100, Math.round((conntrackUsed / conntrackMax) * 100)))
+        : null;
+  const clockOffsetSec = n(raw.clockOffsetSec, -86400, 86400);
+  const ntpSync = raw.ntpSync === true || raw.ntpSync === false ? raw.ntpSync : null;
+  return {
+    cpus,
+    conntrackUsed,
+    conntrackMax,
+    conntrackPct,
+    tcpInuse: n(raw.tcpInuse, 0, 1e9),
+    tcpTw: n(raw.tcpTw, 0, 1e9),
+    tcpOrphan: n(raw.tcpOrphan, 0, 1e9),
+    listenOverflows: n(raw.listenOverflows, 0, 1e12),
+    listenDrops: n(raw.listenDrops, 0, 1e12),
+    fileUsed: n(raw.fileUsed, 0, 1e12),
+    fileMax: n(raw.fileMax, 0, 1e12),
+    filePct: n(raw.filePct, 0, 100),
+    clockOffsetSec,
+    ntpSync,
+    memFailcnt: n(raw.memFailcnt, 0, 1e9) || 0,
+    cgroupOom: n(raw.cgroupOom, 0, 999) || 0,
+  };
+}
+
 export function insideServiceWorldPorts(pulse) {
   return [...new Set((pulse?.listen || []).filter((r) => exposed(r.addr) && ADMIN_PORTS.has(r.port)).map((r) => r.port))];
 }
@@ -419,19 +605,23 @@ export function parseFail2banJail(text) {
 export function gradeInside(pulse = {}) {
   const listen = pulse.listen || [];
   const h = pulse.hardening || {};
+  const pr = pulse.pressure || {};
   const exposedAdmin = listen.filter((r) => exposed(r.addr) && ADMIN_PORTS.has(r.port));
   const fw = Boolean(h.firewall);
   const ban = Boolean(h.fail2ban);
   const updates = Boolean(h.updates);
   const diskHigh = Number(pulse.diskUsedPct) >= 85;
-  const oom = Boolean(pulse.oom) || Number(h.oomKills) > 0;
+  const oom = Boolean(pulse.oom) || Number(h.oomKills) > 0 || Number(pr.cgroupOom) > 0;
+  const loadHigh = Number(pulse.load1) >= Math.max(2, cpuCount(pulse));
+  const connHot = Number(pr.conntrackPct) >= 90;
+  const stuck = stuckFromTop(pulse.top).length > 0;
   if (h.dockerApi) return "D";
   if (h.sshPassword && h.sshRoot && h.sshWorld) return "D";
   if (!fw && exposedAdmin.length) return "D";
   if (!fw && !ban) return "D";
   if (exposedAdmin.length || h.sshPassword || h.sshRoot) return "C";
   if (!fw || !ban) return "C";
-  if (diskHigh || oom || h.rebootNeeded || !h.timesync) return "C";
+  if (diskHigh || oom || h.rebootNeeded || !h.timesync || loadHigh || connHot || stuck) return "C";
   if (fw && ban && updates && h.timesync && !h.sshPassword && !h.sshRoot && !exposedAdmin.length && !h.dockerApi) return "A";
   if (fw && ban && !exposedAdmin.length && !h.dockerApi) return "B";
   return "C";
@@ -442,7 +632,7 @@ function labelPort(r) {
   return svc ? `${svc} :${r.port}` : `:${r.port}`;
 }
 
-export function compareInside(pulse, rec = {}) {
+export function compareInside(pulse, rec = {}, prev = null) {
   const notes = [];
   const listen = pulse?.listen || [];
   const streetIp = rec.ticket?.ip || rec.watch?.current?.ip || null;
@@ -482,8 +672,9 @@ export function compareInside(pulse, rec = {}) {
       do: "Сверьте DNS A с тем VPS, куда поставили сателлит. Если сайт за Cloudflare — это ожидаемо, не инцидент.",
     });
   }
-  const loadHigh = Number(pulse?.load1) >= Math.max(2, (os.cpus() || []).length);
-  const memHigh = pulse?.memTotal && pulse.memUsed / pulse.memTotal >= 0.9;
+  const loadHigh = Number(pulse?.load1) >= Math.max(2, cpuCount(pulse));
+  const memHigh = pulse?.memTotal && pulse.memUsed / pulse.memTotal >= 0.85;
+  const pr = pulse?.pressure || {};
   if (loadHigh || memHigh) {
     const top = pulse.top?.[0];
     const who = top ? `${top.comm} ${top.cpuPct}%` : "процесс в топе не виден";
@@ -599,6 +790,93 @@ export function compareInside(pulse, rec = {}) {
       });
     }
   }
+  const stuck = stuckFromTop(pulse?.top);
+  if (stuck.length) {
+    const who = stuck.map((r) => `${r.comm} (${r.stat || "?"})`).join(", ");
+    notes.push({
+      kind: "stuck-proc",
+      title: "Процессы зависли или зомби",
+      text: `Состояние D/Z/T: ${who}. Так машина стоит на диске или мёртвых воркерах, а не «просто высокая нагрузка».`,
+      do: "Не убивайте с кабинета — его нет. На сервере: ps и диск, не WAF. Orb44 процессы сам не трогает.",
+    });
+  }
+  const hot = hotFromTop(pulse?.top);
+  if (hot.length && !loadHigh) {
+    const who = hot.map((r) => `${r.comm} ${r.cpuPct}%/${r.rssMb}M`).join(", ");
+    notes.push({
+      kind: "hot-proc",
+      title: "Сервис жрёт CPU или RAM",
+      text: `Топ без общей перегрузки load: ${who}. Воркер уже упёрся, витрина может ещё отвечать.`,
+      do: "Смотрите этот процесс (php-fpm, node, mysql). Orb44 его не рестартит.",
+    });
+  }
+  if (Number(pr.conntrackPct) >= 80) {
+    notes.push({
+      kind: "conntrack",
+      title: "Таблица соединений почти полная",
+      text: `conntrack ${pr.conntrackUsed}/${pr.conntrackMax} (${pr.conntrackPct}%). Новые сессии начнут отбрасываться — с улицы это 502, изнутри это очередь.`,
+      do: "Ищите кто держит кучу TCP. Не открывайте порты «чтобы помогло».",
+    });
+  }
+  const prevPr = prev?.pressure || {};
+  const overDelta =
+    pr.listenOverflows != null && prevPr.listenOverflows != null
+      ? Number(pr.listenOverflows) - Number(prevPr.listenOverflows)
+      : 0;
+  const dropDelta =
+    pr.listenDrops != null && prevPr.listenDrops != null
+      ? Number(pr.listenDrops) - Number(prevPr.listenDrops)
+      : 0;
+  if (overDelta > 0 || dropDelta > 0) {
+    notes.push({
+      kind: "backlog",
+      title: "Очередь accept переполняется",
+      text: `С прошлого пульса ListenOverflows +${overDelta}, ListenDrops +${dropDelta}. Сервис не успевает брать соединения.`,
+      do: "Больше воркеров или меньше входа. Orb44 лимиты сам не поднимает.",
+    });
+  }
+  if (Number(pr.filePct) >= 85) {
+    notes.push({
+      kind: "files",
+      title: "Заканчиваются файловые дескрипторы",
+      text: `Открыто ${pr.filePct}% лимита (${pr.fileUsed}/${pr.fileMax}). Типичный «внезапно не открывается сокет».`,
+      do: "Кто держит файлы: воркер или утечка. Orb44 ulimit сам не меняет.",
+    });
+  }
+  if (pr.clockOffsetSec != null && Math.abs(pr.clockOffsetSec) >= 5) {
+    notes.push({
+      kind: "clock",
+      title: "Часы машины уехали",
+      text: `Смещение NTP ${pr.clockOffsetSec} с. TLS и метки Watch начнут врать.`,
+      do: "Почините chrony/timesyncd. Orb44 время сам не ставит.",
+    });
+  }
+  if (Number(pr.cgroupOom) > 0 || Number(pr.memFailcnt) > 20) {
+    notes.push({
+      kind: "cgroup-oom",
+      title: "Контейнер или cgroup упирается в память",
+      text: `cgroup oom=${pr.cgroupOom || 0}, failcnt=${pr.memFailcnt || 0}. Это не journal — счётчик ядра.`,
+      do: "Лимит памяти контейнера, не WAF. Orb44 лимиты сам не поднимает.",
+    });
+  }
+  if (prev?.listen && pulse?.listen) {
+    const face = (p) =>
+      (p.listen || [])
+        .filter((r) => Number(r.port) === 80 || Number(r.port) === 443)
+        .map((r) => `${r.port}:${r.comm || "?"}`)
+        .sort()
+        .join(",");
+    const a = face(prev);
+    const b = face(pulse);
+    if (a && b && a !== b) {
+      notes.push({
+        kind: "listen-swap",
+        title: "На 80/443 сменился процесс",
+        text: `Было ${a}, стало ${b}. Бинарь витрины подменили или рядом встал другой сервер.`,
+        do: "Сверьте, кто должен слушать HTTPS. Orb44 процесс сам не откатывает.",
+      });
+    }
+  }
   return notes;
 }
 
@@ -612,7 +890,7 @@ export function insideWatchReasons(pulse, prev, rec = {}) {
   const notes = [];
   const incident = String(streetIncidentCode(rec) || "");
   const streetHot = /auth_hot|auth_open|l7_exhaustion/.test(incident);
-  const loadHigh = Number(pulse?.load1) >= 2;
+  const loadHigh = Number(pulse?.load1) >= Math.max(2, cpuCount(pulse));
   const memHigh = pulse?.memTotal && pulse.memUsed / pulse.memTotal >= 0.85;
   const top = pulse?.top?.[0];
   const who = top ? `${top.comm} ${top.cpuPct}%` : "процесс в топе не виден";
@@ -651,6 +929,52 @@ export function insideWatchReasons(pulse, prev, rec = {}) {
         text: `Появились ${added.join(", ")}. С прошлого пульса их не было.`,
       });
     }
+    const face = (p) =>
+      (p?.listen || [])
+        .filter((r) => Number(r.port) === 80 || Number(r.port) === 443)
+        .map((r) => `${r.port}:${r.comm || "?"}`)
+        .sort()
+        .join(",");
+    const a = face(prev);
+    const b = face(pulse);
+    if (a && b && a !== b) {
+      notes.push({
+        kind: "listen-swap",
+        title: "На 80/443 сменился процесс",
+        text: `Было ${a}, стало ${b}.`,
+      });
+    }
+  }
+  if (stuckFromTop(pulse?.top).length) {
+    notes.push({
+      kind: "stuck-proc",
+      title: "Процессы зависли",
+      text: stuckFromTop(pulse.top)
+        .map((r) => `${r.comm} ${r.stat}`)
+        .join(", "),
+    });
+  }
+  if (Number(pulse?.pressure?.conntrackPct) >= 80) {
+    notes.push({
+      kind: "conntrack",
+      title: "conntrack почти полный",
+      text: `${pulse.pressure.conntrackPct}%`,
+    });
+  }
+  const overDelta =
+    pulse?.pressure?.listenOverflows != null && prev?.pressure?.listenOverflows != null
+      ? Number(pulse.pressure.listenOverflows) - Number(prev.pressure.listenOverflows)
+      : 0;
+  const dropDelta =
+    pulse?.pressure?.listenDrops != null && prev?.pressure?.listenDrops != null
+      ? Number(pulse.pressure.listenDrops) - Number(prev.pressure.listenDrops)
+      : 0;
+  if (overDelta > 0 || dropDelta > 0) {
+    notes.push({
+      kind: "backlog",
+      title: "Очередь accept растёт",
+      text: `+${overDelta} overflows, +${dropDelta} drops с прошлого пульса.`,
+    });
   }
   const streetIp = rec.ticket?.ip || rec.watch?.current?.ip || rec.watch?.last?.ip || null;
   if (pulse?.originA?.length && streetIp && !pulse.originA.includes(streetIp)) {
@@ -678,6 +1002,7 @@ export function collectPulse() {
   const top = topTable();
   const hardening = collectHardening(listen);
   const limited = listen.length > 0 && !named;
+  const pressure = collectPressure();
   return sanitizePulse({
     ts: Date.now(),
     hostname: os.hostname(),
@@ -689,9 +1014,10 @@ export function collectPulse() {
     listen,
     originA: originAddrs(),
     failedUnit: null,
-    oom: Number(hardening.oomKills) > 0,
+    oom: Number(hardening.oomKills) > 0 || Number(pressure.cgroupOom) > 0,
     limited,
     hardening,
+    pressure,
   });
 }
 
@@ -760,6 +1086,13 @@ export function formatPulsePreview(pulse, lang = "en") {
       [t(lang, "preview_row_ssh"), ssh],
     ]
   );
-  const extra = pulse.limited ? `\n${t(lang, "preview_limited")}` : "";
+  const extraBits = [];
+  if (pulse.limited) extraBits.push(t(lang, "preview_limited"));
+  const stuck = stuckFromTop(pulse.top);
+  if (stuck.length) extraBits.push(`D/Z/T ${stuck.map((r) => `${r.comm}:${r.stat}`).join(" ")}`);
+  const pr = pulse.pressure || {};
+  if (pr.conntrackPct != null) extraBits.push(`conntrack ${pr.conntrackPct}%`);
+  if (pr.cpus) extraBits.push(`${pr.cpus} CPU`);
+  const extra = extraBits.length ? `\n${extraBits.join(" · ")}` : "";
   return `${machine}\n\n${listen}\n\n${top}\n\n${guard}${extra}`;
 }

package/server/sat-http.mjs

@@ -0,0 +1,65 @@
+export const FETCH_MS = 15_000;
+
+const NET_CODES = new Set([
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ECONNABORTED",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "EPIPE",
+  "EAI_AGAIN",
+  "ENOTFOUND",
+]);
+
+export function classifyNetError(err) {
+  const cause = err?.cause && typeof err.cause === "object" ? err.cause : err;
+  const code = String(cause?.code || err?.code || "");
+  const name = String(err?.name || cause?.name || "");
+  const msg = `${cause?.message || ""} ${err?.message || ""}`;
+  if (name === "TimeoutError" || name === "AbortError" || code === "ABORT_ERR" || /timeout|aborted/i.test(msg)) {
+    return "timeout";
+  }
+  if (/CERT|UNABLE_TO_VERIFY|ERR_TLS|ERR_SSL/i.test(`${code} ${msg}`)) return "tls";
+  if (code === "ENOTFOUND" || code === "EAI_AGAIN" || /getaddrinfo/i.test(msg)) return "dns";
+  if (NET_CODES.has(code) || /fetch failed|socket hang up/i.test(msg)) return "unreachable";
+  return "unreachable";
+}
+
+export function cabinetFail(url, err) {
+  return {
+    ok: false,
+    status: 0,
+    body: { error: classifyNetError(err), url: String(url || "").replace(/\/$/, "") },
+  };
+}
+
+export async function cabinetRequest(url, pathname, { method = "GET", json, secret, fetchImpl = fetch, timeoutMs = FETCH_MS } = {}) {
+  const base = String(url || "").replace(/\/$/, "");
+  const headers = { "Content-Type": "application/json", Accept: "application/json" };
+  if (secret) headers.Authorization = `Bearer ${secret}`;
+  const signal = timeoutMs > 0 && typeof AbortSignal !== "undefined" && AbortSignal.timeout ? AbortSignal.timeout(timeoutMs) : undefined;
+  try {
+    const r = await fetchImpl(`${base}${pathname}`, {
+      method,
+      headers,
+      body: json ? JSON.stringify(json) : undefined,
+      signal,
+    });
+    const body = await r.json().catch(() => ({}));
+    return { ok: Boolean(r.ok), status: r.status, body };
+  } catch (err) {
+    return cabinetFail(base, err);
+  }
+}
+
+export function apiFailText(lang, out, t, fallbackKey = "pulse_fail") {
+  const err = out?.body?.error;
+  const url = out?.body?.url || "";
+  if (err === "unreachable") return t(lang, "cabinet_down", { url });
+  if (err === "timeout") return t(lang, "cabinet_timeout", { url });
+  if (err === "tls") return t(lang, "cabinet_tls", { url });
+  if (err === "dns") return t(lang, "cabinet_dns", { url });
+  if (err === "bad_secret" || err === "not_found") return t(lang, "key_revoked");
+  if (typeof err === "string" && /^[a-z][a-z0-9_]{0,40}$/.test(err)) return err;
+  return t(lang, fallbackKey);
+}

package/server/sat-i18n.mjs

@@ -35,6 +35,10 @@ const STR = {
     payload: "What goes to the cabinet",
     pulse_ok: "Pulse is in the cabinet.",
     pulse_fail: "pulse not accepted",
+    cabinet_down: "Cabinet is not reachable ({url}). Start the cabinet or the tunnel to it.",
+    cabinet_timeout: "Cabinet did not answer ({url}). Try again later.",
+    cabinet_tls: "TLS to the cabinet failed ({url}).",
+    cabinet_dns: "Cannot resolve the cabinet host ({url}).",
     pair_fail: "could not start pairing",
     ask_daemon: "Install as a Watch daemon?\nRuns in the background and starts again after reboot. Pulse every 5 min.",
     daemon_no: "No",
@@ -139,6 +143,10 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     payload: "Что уходит в кабинет",
     pulse_ok: "Пульс в кабинете.",
     pulse_fail: "пульс не принят",
+    cabinet_down: "Кабинет недоступен ({url}). Поднимите кабинет или туннель к нему.",
+    cabinet_timeout: "Кабинет не ответил ({url}). Повторите позже.",
+    cabinet_tls: "TLS к кабинету не сошёлся ({url}).",
+    cabinet_dns: "Не резолвится хост кабинета ({url}).",
     pair_fail: "не удалось начать пару",
     ask_daemon: "Поставить Watch-демоном?\nБудет работать в фоне и подниматься после перезагрузки. Пульс каждые 5 мин.",
     daemon_no: "Нет",
@@ -243,6 +251,10 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     payload: "콘솔로 보내는 내용",
     pulse_ok: "펄스가 콘솔에 있습니다.",
     pulse_fail: "펄스 거부",
+    cabinet_down: "콘솔에 연결할 수 없습니다 ({url}). 콘솔 또는 터널을 올리세요.",
+    cabinet_timeout: "콘솔이 응답하지 않습니다 ({url}). 나중에 다시 시도하세요.",
+    cabinet_tls: "콘솔 TLS 실패 ({url}).",
+    cabinet_dns: "콘솔 호스트를 찾지 못했습니다 ({url}).",
     pair_fail: "페어링을 시작하지 못했습니다",
     ask_daemon: "Watch 데몬으로 설치할까요?\n백그라운드에서 돌고 재부팅 후에도 올라옵니다. 5분마다 펄스.",
     daemon_no: "아니요",
@@ -347,6 +359,10 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     payload: "Qué se envía al gabinete",
     pulse_ok: "Pulso en el gabinete.",
     pulse_fail: "pulso rechazado",
+    cabinet_down: "El gabinete no responde ({url}). Levante el gabinete o el túnel.",
+    cabinet_timeout: "El gabinete no contestó ({url}). Pruebe más tarde.",
+    cabinet_tls: "Falló TLS al gabinete ({url}).",
+    cabinet_dns: "No se resuelve el host del gabinete ({url}).",
     pair_fail: "no se pudo iniciar el emparejamiento",
     ask_daemon: "¿Instalar como demonio Watch?\nCorre en segundo plano y arranca de nuevo tras el reinicio. Pulso cada 5 min.",
     daemon_no: "No",

package/server/sat-update.mjs

@@ -9,6 +9,7 @@ export const SAT_TREE_FILES = [
   "server/sat-i18n.mjs",
   "server/cli-menu.mjs",
   "server/sat-local.mjs",
+  "server/sat-http.mjs",
   "server/sat-update.mjs",
   "package.json",
 ];
@@ -52,6 +53,24 @@ export function readCliVersion(scriptFile) {
   return "0.0.0";
 }
 
+export function treeNeedsRefresh(root, latest, { force = false } = {}) {
+  if (force) return true;
+  const ver = readCliVersion(path.join(root, "bin", "orb44.mjs"));
+  if (cmpVer(ver, latest) < 0) return true;
+  try {
+    const pulse = fs.readFileSync(path.join(root, "server", "pulse.mjs"), "utf8");
+    if (!pulse.includes("function collapseListen")) return true;
+    if (!fs.existsSync(path.join(root, "server", "sat-http.mjs"))) return true;
+  } catch {
+    return true;
+  }
+  return false;
+}
+
+export function staleSatRoots(roots, latest, opts = {}) {
+  return (roots || []).filter((r) => treeNeedsRefresh(r, latest, opts));
+}
+
 export function pickSatRoots(scriptFile, { systemLib = "/usr/lib/orb44-sat" } = {}) {
   const here = path.resolve(path.dirname(scriptFile), "..");
   const out = [];