@orb44/cli 0.1.7 → 0.1.9

package/README.md

@@ -13,11 +13,11 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli@0.1.7 status
-npx @orb44/cli@0.1.7 pulse
-npx @orb44/cli@0.1.7 install     # later: background pulse, starts after reboot
+npx @orb44/cli@0.1.9 status
+npx @orb44/cli@0.1.9 pulse
+npx @orb44/cli@0.1.9 install     # later: background pulse, starts after reboot
 orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
-npx @orb44/cli@0.1.7 logout
+npx @orb44/cli@0.1.9 logout
 ```
 
 Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.

package/bin/orb44.mjs

@@ -169,6 +169,8 @@ function printAdvice(notes) {
 
 async function sendPulse(device, { preview = true } = {}) {
   const pulse = collectPulse();
+  const ver = readCliVersion(SCRIPT);
+  if (ver && ver !== "0.0.0") pulse.cliVersion = ver;
   if (preview) {
     console.log(bold("📡 " + t(lang, "payload")));
     console.log(formatPulsePreview(pulse, lang));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {

package/server/pulse.mjs

@@ -1,5 +1,6 @@
 import os from "node:os";
 import fs from "node:fs";
+import net from "node:net";
 import { execFileSync } from "node:child_process";
 import { t } from "./sat-i18n.mjs";
 
@@ -54,6 +55,63 @@ function diskUsedPct(root = "/") {
   }
 }
 
+export function publicIpv4(ip) {
+  const s = String(ip || "").replace(/^::ffff:/, "").trim();
+  if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(s)) return null;
+  const p = s.split(".").map(Number);
+  if (p.some((n) => n > 255)) return null;
+  const [a, b] = p;
+  if (a === 10 || a === 127 || a === 0) return null;
+  if (a === 192 && b === 168) return null;
+  if (a === 172 && b >= 16 && b <= 31) return null;
+  if (a === 169 && b === 254) return null;
+  if (a === 100 && b >= 64 && b <= 127) return null;
+  return s;
+}
+
+export function pickPingTarget(pulse, seenIp) {
+  const ips = [...(pulse?.originA || []), seenIp].map(publicIpv4).filter(Boolean);
+  const ip = ips[0] || null;
+  if (!ip) return null;
+  const world = (pulse?.listen || [])
+    .filter((r) => r.addr === "0.0.0.0" || r.addr === "*" || r.addr === "::")
+    .map((r) => Number(r.port))
+    .filter((p) => p === 443 || p === 80 || p === 22);
+  const ports = [...new Set([443, 80, 22, ...world])];
+  return { ip, ports };
+}
+
+export function tcpRttMs(ip, port, timeoutMs = 700) {
+  return new Promise((resolve) => {
+    const t0 = performance.now();
+    const sock = net.connect({ host: ip, port: Number(port), timeout: timeoutMs }, () => {
+      const ms = Math.max(1, Math.round(performance.now() - t0));
+      sock.destroy();
+      resolve(ms);
+    });
+    const fail = () => {
+      sock.destroy();
+      resolve(null);
+    };
+    sock.on("error", fail);
+    sock.on("timeout", fail);
+  });
+}
+
+export async function measureHostRtt(pulse, seenIp) {
+  const target = pickPingTarget(pulse, seenIp);
+  if (!target) return null;
+  const hits = (
+    await Promise.all(target.ports.slice(0, 3).map(async (port) => {
+      const ms = await tcpRttMs(target.ip, port, 650);
+      return ms == null ? null : { ms, port, ip: target.ip };
+    }))
+  ).filter(Boolean);
+  if (!hits.length) return null;
+  hits.sort((a, b) => a.ms - b.ms);
+  return hits[0];
+}
+
 export function originAddrs(ifaces = os.networkInterfaces()) {
   const out = [];
   for (const rows of Object.values(ifaces || {})) {
@@ -266,6 +324,7 @@ export function sanitizePulse(raw = {}) {
   const limited = Boolean(raw.limited);
   const oom = Boolean(raw.oom) || hardening.oomKills > 0;
   const pressure = sanitizePressure(raw.pressure || raw);
+  const cliVersion = sanitizeCliVersion(raw.cliVersion);
   const base = {
     ts: Number(raw.ts) || Date.now(),
     hostname: sanitizeComm(raw.hostname) || os.hostname().slice(0, 40),
@@ -281,11 +340,22 @@ export function sanitizePulse(raw = {}) {
     limited,
     hardening,
     pressure,
+    cliVersion,
   };
   return { ...base, gradeInside: gradeInside(base) };
 }
 
-const ADMIN_PORTS = new Set([2019, 2375, 2376, 3306, 5432, 6379, 27017, 9200, 11211, 15672, 8500, 2379, 6443, 9090, 5601, 7474, 7687, 1080, 6432]);
+function sanitizeCliVersion(raw) {
+  const v = String(raw || "").trim();
+  if (!/^\d{1,3}\.\d{1,3}\.\d{1,3}(-[a-z0-9.]+)?$/i.test(v)) return null;
+  if (v === "0.0.0") return null;
+  return v.slice(0, 32);
+}
+
+const ADMIN_PORTS = new Set([
+  2019, 2375, 2376, 3306, 5432, 6379, 27017, 9200, 11211, 15672, 8500, 2379, 6443, 9090, 5601, 7474, 7687, 1080, 6432,
+  11434, 6333, 19530, 9229, 9222,
+]);
 
 const SERVICE_NAME = {
   22: "SSH",
@@ -301,6 +371,7 @@ const SERVICE_NAME = {
   3306: "MySQL",
   5432: "Postgres",
   5601: "Kibana",
+  6333: "Qdrant",
   6379: "Redis",
   6432: "PgBouncer",
   6443: "kube-api",
@@ -310,8 +381,12 @@ const SERVICE_NAME = {
   8787: "туннель",
   9090: "Prometheus",
   9200: "Elasticsearch",
+  9222: "Chrome CDP",
+  9229: "Node inspector",
   11211: "memcached",
+  11434: "Ollama",
   15672: "RabbitMQ",
+  19530: "Milvus",
   27017: "Mongo",
 };
 
@@ -440,8 +515,37 @@ export function stuckFromTop(top = []) {
   }).slice(0, 6);
 }
 
-export function hotFromTop(top = []) {
-  return (top || []).filter((r) => Number(r.cpuPct) >= 70 || Number(r.rssMb) >= 1024).slice(0, 6);
+export function ramHotFloorMb(memTotal) {
+  const n = Number(memTotal);
+  if (!Number.isFinite(n) || n <= 0) return 1024;
+  const mb = n > 10_000_000 ? n / (1024 * 1024) : n;
+  return Math.max(1024, Math.round(mb * 0.3));
+}
+
+export function hotFromTop(top = [], memTotal) {
+  const floor = ramHotFloorMb(memTotal);
+  return (top || []).filter((r) => Number(r.cpuPct) >= 70 || Number(r.rssMb) >= floor).slice(0, 6);
+}
+
+const MINER_COMM = /^(xmrig|minerd|nbminer|t-rex|trex|ethminer|phoenixminer|lolminer|gminer|teamredminer|kdevtmpfsi|kinsing|sysupdate|networkservice)$/i;
+const MINER_HEX = /^[a-f0-9]{8,32}$/i;
+const LEGIT_HOT = /^(php-fpm|php|node|nodejs|java|mysqld|postgres|redis-server|nginx|caddy|apache2|httpd|python|python3|ruby|uwsgi|gunicorn|sidekiq|beanstalkd)$/i;
+
+/** Cryptojacking heuristic: known miner names, or near-100% CPU with tiny RSS and non-legit name. */
+export function looksLikeMiner(proc = {}) {
+  const comm = String(proc.comm || "").replace(/^.*\//, "").slice(0, 64);
+  if (!comm) return false;
+  if (MINER_COMM.test(comm)) return true;
+  if (LEGIT_HOT.test(comm)) return false;
+  if (MINER_HEX.test(comm) && Number(proc.cpuPct) >= 90) return true;
+  const cpu = Number(proc.cpuPct);
+  const rss = Number(proc.rssMb);
+  if (cpu >= 95 && Number.isFinite(rss) && rss > 0 && rss < 200) return true;
+  return false;
+}
+
+export function minersFromTop(top = []) {
+  return (top || []).filter((r) => looksLikeMiner(r)).slice(0, 4);
 }
 
 export function cpuCount(pulse) {
@@ -619,6 +723,7 @@ export function gradeInside(pulse = {}) {
   if (h.sshPassword && h.sshRoot && h.sshWorld) return "D";
   if (!fw && exposedAdmin.length) return "D";
   if (!fw && !ban) return "D";
+  if (minersFromTop(pulse.top).length) return "D";
   if (exposedAdmin.length || h.sshPassword || h.sshRoot) return "C";
   if (!fw || !ban) return "C";
   if (diskHigh || oom || h.rebootNeeded || !h.timesync || loadHigh || connHot || stuck) return "C";
@@ -800,14 +905,38 @@ export function compareInside(pulse, rec = {}, prev = null) {
       do: "Не убивайте с кабинета — его нет. На сервере: ps и диск, не WAF. Orb44 процессы сам не трогает.",
     });
   }
-  const hot = hotFromTop(pulse?.top);
+  const miners = minersFromTop(pulse?.top);
+  if (miners.length) {
+    const who = miners.map((r) => `${r.comm} ${r.cpuPct}%`).join(", ");
+    notes.push({
+      kind: "crypto-miner",
+      title: "Похоже на майнер",
+      text: `${who}. Имя из известного списка криптомайнеров или почти 100% CPU при маленьком RSS — типичный признак чужого майнера, не «Перегруз» легитимным java.`,
+      do: "На сервере остановите процесс и проверьте, как он появился (crontab, docker, скомпрометированный SSH). Orb44 процессы сам не убивает.",
+    });
+  }
+  const hot = hotFromTop(pulse?.top, pulse?.memTotal).filter((r) => !looksLikeMiner(r));
   if (hot.length && !loadHigh) {
-    const who = hot.map((r) => `${r.comm} ${r.cpuPct}%/${r.rssMb}M`).join(", ");
+    const floor = ramHotFloorMb(pulse?.memTotal);
+    const ramOnly = hot.every((r) => Number(r.rssMb) >= floor && Number(r.cpuPct) < 70);
+    const who = hot
+      .map((r) => {
+        const ram = Number(r.rssMb) >= floor;
+        const cpu = Number(r.cpuPct) >= 70;
+        if (ram && !cpu) return `${r.comm} ${r.rssMb} МБ RAM (CPU ${r.cpuPct}%)`;
+        if (cpu && !ram) return `${r.comm} CPU ${r.cpuPct}%`;
+        return `${r.comm} ${r.cpuPct}%/${r.rssMb}M`;
+      })
+      .join(", ");
     notes.push({
       kind: "hot-proc",
-      title: "Сервис жрёт CPU или RAM",
-      text: `Топ без общей перегрузки load: ${who}. Воркер уже упёрся, витрина может ещё отвечать.`,
-      do: "Смотрите этот процесс (php-fpm, node, mysql). Orb44 его не рестартит.",
+      title: ramOnly ? "Процесс держит много RAM" : "Сервис жрёт CPU или RAM",
+      text: ramOnly
+        ? `${who}. В «Перегруз» попадает процесс из топа от ${floor} МБ RSS (30% RAM, минимум 1 ГБ). CPU тут ни при чём: load может быть спокойным.`
+        : `Топ без общей перегрузки load: ${who}. Воркер уже упёрся, витрина может ещё отвечать.`,
+      do: ramOnly
+        ? "Это не атака и не 100% процессора. Смотрите, что за процесс и сколько ему реально нужно. Orb44 его не рестартит и память не ограничивает."
+        : "Смотрите этот процесс (php-fpm, node, mysql). Orb44 его не рестартит.",
     });
   }
   if (Number(pr.conntrackPct) >= 80) {

package/server/sat-update.mjs

@@ -104,13 +104,35 @@ export async function fetchLatestMeta(fetchFn = fetch) {
   const version = j?.version;
   const tarball = j?.dist?.tarball;
   if (!version || !tarball) throw new Error("registry meta");
-  return { version: String(version), tarball: String(tarball) };
+  return { version: String(version), tarball: canonicalTarballUrl(tarball) };
 }
 
-export async function unpackTarball(url, tmp, fetchFn = fetch) {
-  const r = await fetchFn(url);
-  if (!r?.ok) throw new Error(`tarball ${r?.status || "fail"}`);
-  const buf = Buffer.from(await r.arrayBuffer());
+/** npm metadata uses /@scope/name/; GET of the tarball is more reliable as /@scope%2fname/. */
+export function canonicalTarballUrl(url) {
+  try {
+    const u = new URL(String(url));
+    u.pathname = u.pathname.replace(/^\/@([^/]+)\/([^/]+)\//, "/@$1%2f$2/");
+    return u.href;
+  } catch {
+    return String(url || "");
+  }
+}
+
+export async function unpackTarball(url, tmp, fetchFn = fetch, { retries = 4, delayMs = 1500 } = {}) {
+  const href = canonicalTarballUrl(url);
+  let last = "fail";
+  let buf = null;
+  for (let i = 0; i < retries; i++) {
+    const r = await fetchFn(href);
+    last = r?.status || "fail";
+    if (r?.ok) {
+      buf = Buffer.from(await r.arrayBuffer());
+      break;
+    }
+    if (Number(last) !== 404 && Number(last) !== 429) break;
+    if (i < retries - 1 && delayMs) await new Promise((ok) => setTimeout(ok, delayMs * (i + 1)));
+  }
+  if (!buf) throw new Error(`tarball ${last}`);
   const tgz = path.join(tmp, "pkg.tgz");
   fs.writeFileSync(tgz, buf);
   const unpack = path.join(tmp, "unpack");