@orb44/cli 0.1.6 → 0.1.8

package/README.md

@@ -13,11 +13,11 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli@0.1.6 status
-npx @orb44/cli@0.1.6 pulse
-npx @orb44/cli@0.1.6 install     # later: background pulse, starts after reboot
+npx @orb44/cli@0.1.8 status
+npx @orb44/cli@0.1.8 pulse
+npx @orb44/cli@0.1.8 install     # later: background pulse, starts after reboot
 orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
-npx @orb44/cli@0.1.6 logout
+npx @orb44/cli@0.1.8 logout
 ```
 
 Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.

package/bin/orb44.mjs

@@ -122,7 +122,7 @@ async function ensureLang(opts) {
     return lang;
   }
   lang = detectLang();
-  if (opts.yes || !input.isTTY || !output.isTTY) {
+  if (opts.yes || opts.url || !input.isTTY || !output.isTTY) {
     saveCli({ ...loadCli(), lang });
     return lang;
   }
@@ -169,6 +169,8 @@ function printAdvice(notes) {
 
 async function sendPulse(device, { preview = true } = {}) {
   const pulse = collectPulse();
+  const ver = readCliVersion(SCRIPT);
+  if (ver && ver !== "0.0.0") pulse.cliVersion = ver;
   if (preview) {
     console.log(bold("📡 " + t(lang, "payload")));
     console.log(formatPulsePreview(pulse, lang));
@@ -242,9 +244,10 @@ async function revokeLocalDevices(devices, fallbackApi) {
 }
 
 async function cmdLogin(opts) {
+  const url = String(opts.url || process.env.ORB44_API || "http://127.0.0.1:8787").replace(/\/$/, "");
+  process.stdout.write(`orb44 login → ${url}\n`);
   await ensureLang(opts);
   banner();
-  const url = String(opts.url || process.env.ORB44_API || "http://127.0.0.1:8787").replace(/\/$/, "");
   const found = existingOnBox();
   if (hasExistingInstall(found)) {
     const replace = await wantReplace(found, opts);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {

package/server/pulse.mjs

@@ -78,17 +78,26 @@ function run(cmd, args) {
 
 const SKIP_TOP = new Set(["ps", "ss", "lsof"]);
 
+const STAT_RE = /^[DRSTZIX][A-Za-z+<]*$/;
+
 export function parsePsTop(text) {
   const rows = [];
   for (const line of String(text || "").split("\n")) {
-    const m = line.trim().match(/^(\d+)\s+([\d.]+)\s+(\d+)\s+(\S+)/);
+    const m = line.trim().match(/^(\d+)\s+([\d.]+)\s+(\d+)\s+(\S+)(?:\s+(\S+))?$/);
     if (!m) continue;
-    const comm = sanitizeComm(m[4]);
+    let stat = null;
+    let commRaw = m[4];
+    if (m[5] && STAT_RE.test(m[4]) && m[4].length <= 8) {
+      stat = m[4].slice(0, 4);
+      commRaw = m[5];
+    }
+    const comm = sanitizeComm(commRaw);
     if (!comm || SKIP_TOP.has(comm)) continue;
     rows.push({
       comm,
       cpuPct: Math.round(Number(m[2]) * 10) / 10,
       rssMb: Math.round(Number(m[3]) / 1024),
+      stat,
     });
   }
   rows.sort((a, b) => b.cpuPct - a.cpuPct || b.rssMb - a.rssMb);
@@ -168,8 +177,10 @@ function listenTable() {
 }
 
 function topTable() {
-  const text = run("ps", ["-axo", "pid=,pcpu=,rss=,comm="]);
-  return parsePsTop(text);
+  const withStat = run("ps", ["-axo", "pid=,pcpu=,rss=,stat=,comm="]);
+  const parsed = parsePsTop(withStat);
+  if (parsed.length) return parsed;
+  return parsePsTop(run("ps", ["-axo", "pid=,pcpu=,rss=,comm="]));
 }
 
 function okListenAddr(a) {
@@ -214,6 +225,7 @@ export function sanitizePulse(raw = {}) {
           comm: sanitizeComm(r.comm),
           cpuPct: Math.max(0, Math.min(100, Number(r.cpuPct) || 0)),
           rssMb: Math.max(0, Math.round(Number(r.rssMb) || 0)),
+          stat: STAT_RE.test(String(r.stat || "")) ? String(r.stat).slice(0, 4) : null,
         }))
         .filter((r) => r.comm)
     : [];
@@ -253,6 +265,8 @@ export function sanitizePulse(raw = {}) {
   };
   const limited = Boolean(raw.limited);
   const oom = Boolean(raw.oom) || hardening.oomKills > 0;
+  const pressure = sanitizePressure(raw.pressure || raw);
+  const cliVersion = sanitizeCliVersion(raw.cliVersion);
   const base = {
     ts: Number(raw.ts) || Date.now(),
     hostname: sanitizeComm(raw.hostname) || os.hostname().slice(0, 40),
@@ -267,10 +281,19 @@ export function sanitizePulse(raw = {}) {
     oom,
     limited,
     hardening,
+    pressure,
+    cliVersion,
   };
   return { ...base, gradeInside: gradeInside(base) };
 }
 
+function sanitizeCliVersion(raw) {
+  const v = String(raw || "").trim();
+  if (!/^\d{1,3}\.\d{1,3}\.\d{1,3}(-[a-z0-9.]+)?$/i.test(v)) return null;
+  if (v === "0.0.0") return null;
+  return v.slice(0, 32);
+}
+
 const ADMIN_PORTS = new Set([2019, 2375, 2376, 3306, 5432, 6379, 27017, 9200, 11211, 15672, 8500, 2379, 6443, 9090, 5601, 7474, 7687, 1080, 6432]);
 
 const SERVICE_NAME = {
@@ -351,6 +374,172 @@ export function parseVmstatOom(text) {
   return m ? Number(m[1]) : 0;
 }
 
+export function parseSockstat(text) {
+  const tcp = /(?:^|\n)TCP:\s+inuse\s+(\d+)(?:\s+orphan\s+(\d+))?(?:\s+tw\s+(\d+))?/i.exec(String(text || ""));
+  if (!tcp) return { tcpInuse: null, tcpOrphan: null, tcpTw: null };
+  return {
+    tcpInuse: Number(tcp[1]),
+    tcpOrphan: tcp[2] != null ? Number(tcp[2]) : null,
+    tcpTw: tcp[3] != null ? Number(tcp[3]) : null,
+  };
+}
+
+export function parseFileNr(text) {
+  const p = String(text || "").trim().split(/[\s,]+/);
+  const used = Number(p[0]);
+  const max = Number(p[2] ?? p[1]);
+  if (!Number.isFinite(used) || !Number.isFinite(max) || max <= 0) return { fileUsed: null, fileMax: null, filePct: null };
+  return { fileUsed: used, fileMax: max, filePct: Math.max(0, Math.min(100, Math.round((used / max) * 100))) };
+}
+
+export function parseChronyTracking(text) {
+  const m =
+    /Last offset\s*:\s*([+-]?\d+(?:\.\d+)?)\s*seconds/i.exec(String(text || "")) ||
+    /System time\s*:\s*(\d+(?:\.\d+)?)\s*seconds\s+(slow|fast)/i.exec(String(text || ""));
+  if (!m) return null;
+  let n = Number(m[1]);
+  if (!Number.isFinite(n)) return null;
+  if (m[2] === "fast") n = Math.abs(n);
+  if (m[2] === "slow") n = -Math.abs(n);
+  return Math.round(n * 1000) / 1000;
+}
+
+export function parseCgroupEvents(text) {
+  const kill = /(?:^|\n)oom_kill\s+(\d+)/.exec(String(text || ""));
+  const oom = /(?:^|\n)oom\s+(\d+)/.exec(String(text || ""));
+  return {
+    cgroupOom: kill ? Number(kill[1]) : oom ? Number(oom[1]) : 0,
+    memFailcnt: 0,
+  };
+}
+
+export function parseNetstatListenOverflows(text) {
+  const lines = String(text || "").split("\n");
+  let header = "";
+  let values = "";
+  for (const line of lines) {
+    if (/^TcpExt:\s+/.test(line) && /ListenOverflows/.test(line)) header = line;
+    else if (/^TcpExt:\s+/.test(line) && header && !/ListenOverflows/.test(line)) values = line;
+  }
+  if (!header || !values) return { listenOverflows: null, listenDrops: null };
+  const keys = header.replace(/^TcpExt:\s+/, "").trim().split(/\s+/);
+  const nums = values.replace(/^TcpExt:\s+/, "").trim().split(/\s+/).map(Number);
+  const idx = (name) => keys.indexOf(name);
+  const n = (i) => (i >= 0 && Number.isFinite(nums[i]) ? nums[i] : null);
+  return { listenOverflows: n(idx("ListenOverflows")), listenDrops: n(idx("ListenDrops")) };
+}
+
+function readTrim(p) {
+  try {
+    return fs.readFileSync(p, "utf8").trim();
+  } catch {
+    return "";
+  }
+}
+
+function numFile(p) {
+  const n = Number(readTrim(p));
+  return Number.isFinite(n) ? n : null;
+}
+
+export function stuckFromTop(top = []) {
+  return (top || []).filter((r) => {
+    const s = String(r.stat || "")[0];
+    return s === "D" || s === "Z" || s === "T";
+  }).slice(0, 6);
+}
+
+export function hotFromTop(top = []) {
+  return (top || []).filter((r) => Number(r.cpuPct) >= 70 || Number(r.rssMb) >= 1024).slice(0, 6);
+}
+
+export function cpuCount(pulse) {
+  const n = Number(pulse?.pressure?.cpus);
+  return Number.isFinite(n) && n > 0 ? n : 2;
+}
+
+function collectPressure() {
+  const cpus = Math.max(1, os.cpus()?.length || 1);
+  const sock = parseSockstat(readTrim("/proc/net/sockstat"));
+  const files = parseFileNr(readTrim("/proc/sys/fs/file-nr"));
+  let conntrackUsed = numFile("/proc/sys/net/netfilter/nf_conntrack_count");
+  let conntrackMax = numFile("/proc/sys/net/netfilter/nf_conntrack_max");
+  if (conntrackUsed == null) conntrackUsed = numFile("/proc/sys/net/nf_conntrack_count");
+  if (conntrackMax == null) conntrackMax = numFile("/proc/sys/net/nf_conntrack_max");
+  const conntrackPct =
+    conntrackUsed != null && conntrackMax > 0 ? Math.max(0, Math.min(100, Math.round((conntrackUsed / conntrackMax) * 100))) : null;
+  const overflows = parseNetstatListenOverflows(readTrim("/proc/net/netstat"));
+  let clockOffsetSec = parseChronyTracking(runOut("chronyc", ["tracking"]));
+  let ntpSync = null;
+  if (clockOffsetSec != null) ntpSync = true;
+  else {
+    const td = runOut("timedatectl", ["show", "-p", "NTPSynchronized", "--value"]);
+    if (/^yes$/i.test(td.trim())) ntpSync = true;
+    else if (/^no$/i.test(td.trim())) ntpSync = false;
+  }
+  let cgroupOom = 0;
+  let memFailcnt = 0;
+  const ev = parseCgroupEvents(readTrim("/sys/fs/cgroup/memory.events") || readTrim("/sys/fs/cgroup/memory/memory.events"));
+  cgroupOom = ev.cgroupOom || 0;
+  memFailcnt = numFile("/sys/fs/cgroup/memory/memory.failcnt") ?? ev.memFailcnt ?? 0;
+  return {
+    cpus,
+    conntrackUsed,
+    conntrackMax,
+    conntrackPct,
+    tcpInuse: sock.tcpInuse,
+    tcpTw: sock.tcpTw,
+    tcpOrphan: sock.tcpOrphan,
+    listenOverflows: overflows.listenOverflows,
+    listenDrops: overflows.listenDrops,
+    fileUsed: files.fileUsed,
+    fileMax: files.fileMax,
+    filePct: files.filePct,
+    clockOffsetSec,
+    ntpSync,
+    memFailcnt: Math.max(0, Math.min(999999, Number(memFailcnt) || 0)),
+    cgroupOom: Math.max(0, Math.min(999, Number(cgroupOom) || 0)),
+  };
+}
+
+function sanitizePressure(raw = {}) {
+  const n = (v, lo, hi) => {
+    if (v == null || v === "") return null;
+    const x = Number(v);
+    if (!Number.isFinite(x)) return null;
+    return Math.max(lo, Math.min(hi, x));
+  };
+  const cpus = n(raw.cpus, 1, 512) || null;
+  const conntrackUsed = n(raw.conntrackUsed, 0, 1e9);
+  const conntrackMax = n(raw.conntrackMax, 0, 1e9);
+  const conntrackPct =
+    raw.conntrackPct != null
+      ? n(raw.conntrackPct, 0, 100)
+      : conntrackUsed != null && conntrackMax > 0
+        ? Math.max(0, Math.min(100, Math.round((conntrackUsed / conntrackMax) * 100)))
+        : null;
+  const clockOffsetSec = n(raw.clockOffsetSec, -86400, 86400);
+  const ntpSync = raw.ntpSync === true || raw.ntpSync === false ? raw.ntpSync : null;
+  return {
+    cpus,
+    conntrackUsed,
+    conntrackMax,
+    conntrackPct,
+    tcpInuse: n(raw.tcpInuse, 0, 1e9),
+    tcpTw: n(raw.tcpTw, 0, 1e9),
+    tcpOrphan: n(raw.tcpOrphan, 0, 1e9),
+    listenOverflows: n(raw.listenOverflows, 0, 1e12),
+    listenDrops: n(raw.listenDrops, 0, 1e12),
+    fileUsed: n(raw.fileUsed, 0, 1e12),
+    fileMax: n(raw.fileMax, 0, 1e12),
+    filePct: n(raw.filePct, 0, 100),
+    clockOffsetSec,
+    ntpSync,
+    memFailcnt: n(raw.memFailcnt, 0, 1e9) || 0,
+    cgroupOom: n(raw.cgroupOom, 0, 999) || 0,
+  };
+}
+
 export function insideServiceWorldPorts(pulse) {
   return [...new Set((pulse?.listen || []).filter((r) => exposed(r.addr) && ADMIN_PORTS.has(r.port)).map((r) => r.port))];
 }
@@ -425,19 +614,23 @@ export function parseFail2banJail(text) {
 export function gradeInside(pulse = {}) {
   const listen = pulse.listen || [];
   const h = pulse.hardening || {};
+  const pr = pulse.pressure || {};
   const exposedAdmin = listen.filter((r) => exposed(r.addr) && ADMIN_PORTS.has(r.port));
   const fw = Boolean(h.firewall);
   const ban = Boolean(h.fail2ban);
   const updates = Boolean(h.updates);
   const diskHigh = Number(pulse.diskUsedPct) >= 85;
-  const oom = Boolean(pulse.oom) || Number(h.oomKills) > 0;
+  const oom = Boolean(pulse.oom) || Number(h.oomKills) > 0 || Number(pr.cgroupOom) > 0;
+  const loadHigh = Number(pulse.load1) >= Math.max(2, cpuCount(pulse));
+  const connHot = Number(pr.conntrackPct) >= 90;
+  const stuck = stuckFromTop(pulse.top).length > 0;
   if (h.dockerApi) return "D";
   if (h.sshPassword && h.sshRoot && h.sshWorld) return "D";
   if (!fw && exposedAdmin.length) return "D";
   if (!fw && !ban) return "D";
   if (exposedAdmin.length || h.sshPassword || h.sshRoot) return "C";
   if (!fw || !ban) return "C";
-  if (diskHigh || oom || h.rebootNeeded || !h.timesync) return "C";
+  if (diskHigh || oom || h.rebootNeeded || !h.timesync || loadHigh || connHot || stuck) return "C";
   if (fw && ban && updates && h.timesync && !h.sshPassword && !h.sshRoot && !exposedAdmin.length && !h.dockerApi) return "A";
   if (fw && ban && !exposedAdmin.length && !h.dockerApi) return "B";
   return "C";
@@ -448,7 +641,7 @@ function labelPort(r) {
   return svc ? `${svc} :${r.port}` : `:${r.port}`;
 }
 
-export function compareInside(pulse, rec = {}) {
+export function compareInside(pulse, rec = {}, prev = null) {
   const notes = [];
   const listen = pulse?.listen || [];
   const streetIp = rec.ticket?.ip || rec.watch?.current?.ip || null;
@@ -488,8 +681,9 @@ export function compareInside(pulse, rec = {}) {
       do: "Сверьте DNS A с тем VPS, куда поставили сателлит. Если сайт за Cloudflare — это ожидаемо, не инцидент.",
     });
   }
-  const loadHigh = Number(pulse?.load1) >= Math.max(2, (os.cpus() || []).length);
-  const memHigh = pulse?.memTotal && pulse.memUsed / pulse.memTotal >= 0.9;
+  const loadHigh = Number(pulse?.load1) >= Math.max(2, cpuCount(pulse));
+  const memHigh = pulse?.memTotal && pulse.memUsed / pulse.memTotal >= 0.85;
+  const pr = pulse?.pressure || {};
   if (loadHigh || memHigh) {
     const top = pulse.top?.[0];
     const who = top ? `${top.comm} ${top.cpuPct}%` : "процесс в топе не виден";
@@ -605,6 +799,93 @@ export function compareInside(pulse, rec = {}) {
       });
     }
   }
+  const stuck = stuckFromTop(pulse?.top);
+  if (stuck.length) {
+    const who = stuck.map((r) => `${r.comm} (${r.stat || "?"})`).join(", ");
+    notes.push({
+      kind: "stuck-proc",
+      title: "Процессы зависли или зомби",
+      text: `Состояние D/Z/T: ${who}. Так машина стоит на диске или мёртвых воркерах, а не «просто высокая нагрузка».`,
+      do: "Не убивайте с кабинета — его нет. На сервере: ps и диск, не WAF. Orb44 процессы сам не трогает.",
+    });
+  }
+  const hot = hotFromTop(pulse?.top);
+  if (hot.length && !loadHigh) {
+    const who = hot.map((r) => `${r.comm} ${r.cpuPct}%/${r.rssMb}M`).join(", ");
+    notes.push({
+      kind: "hot-proc",
+      title: "Сервис жрёт CPU или RAM",
+      text: `Топ без общей перегрузки load: ${who}. Воркер уже упёрся, витрина может ещё отвечать.`,
+      do: "Смотрите этот процесс (php-fpm, node, mysql). Orb44 его не рестартит.",
+    });
+  }
+  if (Number(pr.conntrackPct) >= 80) {
+    notes.push({
+      kind: "conntrack",
+      title: "Таблица соединений почти полная",
+      text: `conntrack ${pr.conntrackUsed}/${pr.conntrackMax} (${pr.conntrackPct}%). Новые сессии начнут отбрасываться — с улицы это 502, изнутри это очередь.`,
+      do: "Ищите кто держит кучу TCP. Не открывайте порты «чтобы помогло».",
+    });
+  }
+  const prevPr = prev?.pressure || {};
+  const overDelta =
+    pr.listenOverflows != null && prevPr.listenOverflows != null
+      ? Number(pr.listenOverflows) - Number(prevPr.listenOverflows)
+      : 0;
+  const dropDelta =
+    pr.listenDrops != null && prevPr.listenDrops != null
+      ? Number(pr.listenDrops) - Number(prevPr.listenDrops)
+      : 0;
+  if (overDelta > 0 || dropDelta > 0) {
+    notes.push({
+      kind: "backlog",
+      title: "Очередь accept переполняется",
+      text: `С прошлого пульса ListenOverflows +${overDelta}, ListenDrops +${dropDelta}. Сервис не успевает брать соединения.`,
+      do: "Больше воркеров или меньше входа. Orb44 лимиты сам не поднимает.",
+    });
+  }
+  if (Number(pr.filePct) >= 85) {
+    notes.push({
+      kind: "files",
+      title: "Заканчиваются файловые дескрипторы",
+      text: `Открыто ${pr.filePct}% лимита (${pr.fileUsed}/${pr.fileMax}). Типичный «внезапно не открывается сокет».`,
+      do: "Кто держит файлы: воркер или утечка. Orb44 ulimit сам не меняет.",
+    });
+  }
+  if (pr.clockOffsetSec != null && Math.abs(pr.clockOffsetSec) >= 5) {
+    notes.push({
+      kind: "clock",
+      title: "Часы машины уехали",
+      text: `Смещение NTP ${pr.clockOffsetSec} с. TLS и метки Watch начнут врать.`,
+      do: "Почините chrony/timesyncd. Orb44 время сам не ставит.",
+    });
+  }
+  if (Number(pr.cgroupOom) > 0 || Number(pr.memFailcnt) > 20) {
+    notes.push({
+      kind: "cgroup-oom",
+      title: "Контейнер или cgroup упирается в память",
+      text: `cgroup oom=${pr.cgroupOom || 0}, failcnt=${pr.memFailcnt || 0}. Это не journal — счётчик ядра.`,
+      do: "Лимит памяти контейнера, не WAF. Orb44 лимиты сам не поднимает.",
+    });
+  }
+  if (prev?.listen && pulse?.listen) {
+    const face = (p) =>
+      (p.listen || [])
+        .filter((r) => Number(r.port) === 80 || Number(r.port) === 443)
+        .map((r) => `${r.port}:${r.comm || "?"}`)
+        .sort()
+        .join(",");
+    const a = face(prev);
+    const b = face(pulse);
+    if (a && b && a !== b) {
+      notes.push({
+        kind: "listen-swap",
+        title: "На 80/443 сменился процесс",
+        text: `Было ${a}, стало ${b}. Бинарь витрины подменили или рядом встал другой сервер.`,
+        do: "Сверьте, кто должен слушать HTTPS. Orb44 процесс сам не откатывает.",
+      });
+    }
+  }
   return notes;
 }
 
@@ -618,7 +899,7 @@ export function insideWatchReasons(pulse, prev, rec = {}) {
   const notes = [];
   const incident = String(streetIncidentCode(rec) || "");
   const streetHot = /auth_hot|auth_open|l7_exhaustion/.test(incident);
-  const loadHigh = Number(pulse?.load1) >= 2;
+  const loadHigh = Number(pulse?.load1) >= Math.max(2, cpuCount(pulse));
   const memHigh = pulse?.memTotal && pulse.memUsed / pulse.memTotal >= 0.85;
   const top = pulse?.top?.[0];
   const who = top ? `${top.comm} ${top.cpuPct}%` : "процесс в топе не виден";
@@ -657,6 +938,52 @@ export function insideWatchReasons(pulse, prev, rec = {}) {
         text: `Появились ${added.join(", ")}. С прошлого пульса их не было.`,
       });
     }
+    const face = (p) =>
+      (p?.listen || [])
+        .filter((r) => Number(r.port) === 80 || Number(r.port) === 443)
+        .map((r) => `${r.port}:${r.comm || "?"}`)
+        .sort()
+        .join(",");
+    const a = face(prev);
+    const b = face(pulse);
+    if (a && b && a !== b) {
+      notes.push({
+        kind: "listen-swap",
+        title: "На 80/443 сменился процесс",
+        text: `Было ${a}, стало ${b}.`,
+      });
+    }
+  }
+  if (stuckFromTop(pulse?.top).length) {
+    notes.push({
+      kind: "stuck-proc",
+      title: "Процессы зависли",
+      text: stuckFromTop(pulse.top)
+        .map((r) => `${r.comm} ${r.stat}`)
+        .join(", "),
+    });
+  }
+  if (Number(pulse?.pressure?.conntrackPct) >= 80) {
+    notes.push({
+      kind: "conntrack",
+      title: "conntrack почти полный",
+      text: `${pulse.pressure.conntrackPct}%`,
+    });
+  }
+  const overDelta =
+    pulse?.pressure?.listenOverflows != null && prev?.pressure?.listenOverflows != null
+      ? Number(pulse.pressure.listenOverflows) - Number(prev.pressure.listenOverflows)
+      : 0;
+  const dropDelta =
+    pulse?.pressure?.listenDrops != null && prev?.pressure?.listenDrops != null
+      ? Number(pulse.pressure.listenDrops) - Number(prev.pressure.listenDrops)
+      : 0;
+  if (overDelta > 0 || dropDelta > 0) {
+    notes.push({
+      kind: "backlog",
+      title: "Очередь accept растёт",
+      text: `+${overDelta} overflows, +${dropDelta} drops с прошлого пульса.`,
+    });
   }
   const streetIp = rec.ticket?.ip || rec.watch?.current?.ip || rec.watch?.last?.ip || null;
   if (pulse?.originA?.length && streetIp && !pulse.originA.includes(streetIp)) {
@@ -684,6 +1011,7 @@ export function collectPulse() {
   const top = topTable();
   const hardening = collectHardening(listen);
   const limited = listen.length > 0 && !named;
+  const pressure = collectPressure();
   return sanitizePulse({
     ts: Date.now(),
     hostname: os.hostname(),
@@ -695,9 +1023,10 @@ export function collectPulse() {
     listen,
     originA: originAddrs(),
     failedUnit: null,
-    oom: Number(hardening.oomKills) > 0,
+    oom: Number(hardening.oomKills) > 0 || Number(pressure.cgroupOom) > 0,
     limited,
     hardening,
+    pressure,
   });
 }
 
@@ -766,6 +1095,13 @@ export function formatPulsePreview(pulse, lang = "en") {
       [t(lang, "preview_row_ssh"), ssh],
     ]
   );
-  const extra = pulse.limited ? `\n${t(lang, "preview_limited")}` : "";
+  const extraBits = [];
+  if (pulse.limited) extraBits.push(t(lang, "preview_limited"));
+  const stuck = stuckFromTop(pulse.top);
+  if (stuck.length) extraBits.push(`D/Z/T ${stuck.map((r) => `${r.comm}:${r.stat}`).join(" ")}`);
+  const pr = pulse.pressure || {};
+  if (pr.conntrackPct != null) extraBits.push(`conntrack ${pr.conntrackPct}%`);
+  if (pr.cpus) extraBits.push(`${pr.cpus} CPU`);
+  const extra = extraBits.length ? `\n${extraBits.join(" · ")}` : "";
   return `${machine}\n\n${listen}\n\n${top}\n\n${guard}${extra}`;
 }

package/server/sat-update.mjs

@@ -104,13 +104,35 @@ export async function fetchLatestMeta(fetchFn = fetch) {
   const version = j?.version;
   const tarball = j?.dist?.tarball;
   if (!version || !tarball) throw new Error("registry meta");
-  return { version: String(version), tarball: String(tarball) };
+  return { version: String(version), tarball: canonicalTarballUrl(tarball) };
 }
 
-export async function unpackTarball(url, tmp, fetchFn = fetch) {
-  const r = await fetchFn(url);
-  if (!r?.ok) throw new Error(`tarball ${r?.status || "fail"}`);
-  const buf = Buffer.from(await r.arrayBuffer());
+/** npm metadata uses /@scope/name/; GET of the tarball is more reliable as /@scope%2fname/. */
+export function canonicalTarballUrl(url) {
+  try {
+    const u = new URL(String(url));
+    u.pathname = u.pathname.replace(/^\/@([^/]+)\/([^/]+)\//, "/@$1%2f$2/");
+    return u.href;
+  } catch {
+    return String(url || "");
+  }
+}
+
+export async function unpackTarball(url, tmp, fetchFn = fetch, { retries = 4, delayMs = 1500 } = {}) {
+  const href = canonicalTarballUrl(url);
+  let last = "fail";
+  let buf = null;
+  for (let i = 0; i < retries; i++) {
+    const r = await fetchFn(href);
+    last = r?.status || "fail";
+    if (r?.ok) {
+      buf = Buffer.from(await r.arrayBuffer());
+      break;
+    }
+    if (Number(last) !== 404 && Number(last) !== 429) break;
+    if (i < retries - 1 && delayMs) await new Promise((ok) => setTimeout(ok, delayMs * (i + 1)));
+  }
+  if (!buf) throw new Error(`tarball ${last}`);
   const tgz = path.join(tmp, "pkg.tgz");
   fs.writeFileSync(tgz, buf);
   const unpack = path.join(tmp, "unpack");