@orb44/cli 0.1.9 → 0.1.10

package/README.md

@@ -13,11 +13,11 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli@0.1.9 status
-npx @orb44/cli@0.1.9 pulse
-npx @orb44/cli@0.1.9 install     # later: background pulse, starts after reboot
+npx @orb44/cli@0.1.10 status
+npx @orb44/cli@0.1.10 pulse
+npx @orb44/cli@0.1.10 install     # later: background pulse, starts after reboot
 orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
-npx @orb44/cli@0.1.9 logout
+npx @orb44/cli@0.1.10 logout
 ```
 
 Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.

package/bin/orb44.mjs

@@ -24,6 +24,7 @@ function args() {
     if (a === "--yes" || a === "-y") out.yes = true;
     else if (a === "--system") out.system = true;
     else if (a === "--daemon") out.daemon = true;
+    else if (a === "--logs") out.logs = true;
     else if (a === "--force") out.force = true;
     else if (a === "--purge") out.purge = true;
     else if (a === "--url" || a === "--code" || a === "--name" || a === "--interval" || a === "--lang") {
@@ -167,8 +168,33 @@ function printAdvice(notes) {
   }
 }
 
+async function wantLogs(opts) {
+  if (opts.logs) return true;
+  if (opts.yes) return false;
+  if (!input.isTTY || !output.isTTY) return false;
+  const idx = await pickFromList({
+    title: t(lang, "ask_logs"),
+    items: [t(lang, "logs_no"), t(lang, "logs_yes")],
+    index: 0,
+    hint: "↑↓  Enter",
+    stdin: input,
+    stdout: output,
+  });
+  return idx === 1;
+}
+
+function applyGrants(device, extra = {}) {
+  const grants = {
+    process: true,
+    daemon: extra.daemon != null ? Boolean(extra.daemon) : Boolean(device.grants?.daemon),
+    logs: extra.logs != null ? Boolean(extra.logs) : Boolean(device.grants?.logs),
+  };
+  device.grants = grants;
+  return grants;
+}
+
 async function sendPulse(device, { preview = true } = {}) {
-  const pulse = collectPulse();
+  const pulse = collectPulse({ grants: device.grants });
   const ver = readCliVersion(SCRIPT);
   if (ver && ver !== "0.0.0") pulse.cliVersion = ver;
   if (preview) {
@@ -318,6 +344,13 @@ async function cmdLogin(opts) {
   console.log(`\n\n✅  ${t(lang, "paired", { host: device.host, name: device.name })}`);
   console.log(dim(`🔑  ${t(lang, "key_file", { file: DEVICE_FILE })}\n`));
 
+  const daemon = await wantDaemon(opts);
+  const logs = await wantLogs(opts);
+  applyGrants(device, { daemon, logs });
+  saveDevice(device);
+  if (logs) console.log(dim(t(lang, "logs_on")));
+  else console.log(dim(t(lang, "logs_skip")));
+
   const { out } = await sendPulse(device);
   if (!out.ok) {
     console.error(failLine(out));
@@ -325,7 +358,7 @@ async function cmdLogin(opts) {
   }
   console.log("\n📡  " + t(lang, "pulse_ok"));
   printAdvice(out.body?.notes);
-  if (await wantDaemon(opts)) {
+  if (daemon) {
     if (cmdInstall(opts, { enable: true })) {
       console.log("\n" + t(lang, "login_done"));
     }
@@ -521,7 +554,15 @@ function cmdInstall(opts, { enable = false } = {}) {
   const srcPath = rec.path || DEVICE_FILE;
   const device = stripDevicePath(rec);
   if (opts.url) device.api = String(opts.url).replace(/\/$/, "");
-  if (srcPath !== DEVICE_FILE) saveDevice(device);
+  if (opts.logs) applyGrants(device, { logs: true });
+  saveDevice(device);
+  if (srcPath !== DEVICE_FILE) {
+    try {
+      fs.writeFileSync(srcPath, JSON.stringify(device, null, 2), { mode: 0o600 });
+    } catch {
+      /* unreadable system key stays as-is */
+    }
+  }
   const asSystem = Boolean(opts.system) || process.getuid?.() === 0;
   const interval = intervalSec(opts.interval);
   let deviceFile = DEVICE_FILE;
@@ -705,7 +746,7 @@ function cmdStatus() {
   console.log(`📛  ${device.name}`);
   console.log(`🆔  ${device.id}`);
   console.log(dim(`🔑  ${DEVICE_FILE}`));
-  const pulse = collectPulse();
+  const pulse = collectPulse({ grants: device.grants });
   console.log(`\n${bold("📡 " + t(lang, "now_on_box"))}`);
   console.log(formatPulsePreview(pulse, lang));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {
@@ -13,7 +13,8 @@
     "server/cli-menu.mjs",
     "server/sat-local.mjs",
     "server/sat-http.mjs",
-    "server/sat-update.mjs"
+    "server/sat-update.mjs",
+    "server/sat-logs.mjs"
   ],
   "engines": {
     "node": ">=18"

package/server/pulse.mjs

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import net from "node:net";
 import { execFileSync } from "node:child_process";
 import { t } from "./sat-i18n.mjs";
+import { collectRuntime, sanitizeErrors, sanitizeGrants, sanitizeRuntime } from "./sat-logs.mjs";
 
 const COMM_RE = /[^a-zA-Z0-9._+-]/g;
 
@@ -341,6 +342,9 @@ export function sanitizePulse(raw = {}) {
     hardening,
     pressure,
     cliVersion,
+    grants: sanitizeGrants(raw.grants),
+    runtime: sanitizeRuntime(raw.runtime),
+    errors: sanitizeErrors(raw.errors),
   };
   return { ...base, gradeInside: gradeInside(base) };
 }
@@ -726,7 +730,7 @@ export function gradeInside(pulse = {}) {
   if (minersFromTop(pulse.top).length) return "D";
   if (exposedAdmin.length || h.sshPassword || h.sshRoot) return "C";
   if (!fw || !ban) return "C";
-  if (diskHigh || oom || h.rebootNeeded || !h.timesync || loadHigh || connHot || stuck) return "C";
+  if (diskHigh || oom || h.rebootNeeded || !h.timesync || loadHigh || connHot || stuck || pulse.failedUnit || (pulse.errors || []).length) return "C";
   if (fw && ban && updates && h.timesync && !h.sshPassword && !h.sshRoot && !exposedAdmin.length && !h.dockerApi) return "A";
   if (fw && ban && !exposedAdmin.length && !h.dockerApi) return "B";
   return "C";
@@ -1006,6 +1010,27 @@ export function compareInside(pulse, rec = {}, prev = null) {
       });
     }
   }
+  if (pulse?.failedUnit) {
+    notes.push({
+      kind: "failed-unit",
+      title: "Упал systemd-юнит",
+      text: `${pulse.failedUnit}. Имя из systemctl --failed — не стек.`,
+      do: "Откройте этот юнит на машине (systemctl status). Orb44 контейнеры не перезапускает.",
+    });
+  }
+  const errs = pulse?.errors || [];
+  if (errs.length) {
+    const line = errs
+      .slice(0, 3)
+      .map((e) => `${e.source} ${e.name}: ${e.text}`)
+      .join(" · ");
+    notes.push({
+      kind: "runtime-error",
+      title: "Ошибки на машине",
+      text: line,
+      do: "Это хвост журнала / docker / kubectl / nginx, который вы разрешили при login. Orb44 ничего не чинит.",
+    });
+  }
   return notes;
 }
 
@@ -1074,6 +1099,28 @@ export function insideWatchReasons(pulse, prev, rec = {}) {
       });
     }
   }
+  if (pulse?.failedUnit) {
+    notes.push({
+      kind: "failed-unit",
+      title: "Упал systemd-юнит",
+      text: `${pulse.failedUnit}. Это имя из systemctl --failed, не стек.`,
+    });
+  }
+  const errNow = (pulse?.errors || []).map((e) => `${e.source}:${e.name}`);
+  if (errNow.length) {
+    const prevErr = new Set((prev?.errors || []).map((e) => `${e.source}:${e.name}`));
+    const fresh = errNow.filter((k) => !prevErr.has(k));
+    if (!prev || fresh.length) {
+      notes.push({
+        kind: "runtime-error",
+        title: "Новые ошибки runtime",
+        text: (pulse.errors || [])
+          .slice(0, 3)
+          .map((e) => `${e.source} ${e.name}: ${e.text}`)
+          .join(" · "),
+      });
+    }
+  }
   if (stuckFromTop(pulse?.top).length) {
     notes.push({
       kind: "stuck-proc",
@@ -1125,13 +1172,38 @@ export function insideAlertDecision(row, reasons, now = Date.now(), debounceMs =
   return { emit: true, key };
 }
 
-export function collectPulse() {
+export function parseFailedUnits(text) {
+  const out = [];
+  for (const line of String(text || "").split("\n")) {
+    const hit = line.match(/\b([a-zA-Z0-9@._-]+\.(service|socket|mount|timer))\b/);
+    if (hit && !out.includes(hit[1])) out.push(hit[1].slice(0, 60));
+    if (out.length >= 6) break;
+  }
+  return out;
+}
+
+function collectFailedUnits() {
+  try {
+    const out = execFileSync("systemctl", ["--failed", "--no-legend", "--no-pager", "--plain"], {
+      encoding: "utf8",
+      timeout: 1500,
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    return parseFailedUnits(out);
+  } catch {
+    return [];
+  }
+}
+
+export function collectPulse(opts = {}) {
   const { memUsed, memTotal } = memInfo();
   const { listen, named } = listenTable();
   const top = topTable();
   const hardening = collectHardening(listen);
   const limited = listen.length > 0 && !named;
   const pressure = collectPressure();
+  const grants = sanitizeGrants(opts.grants);
+  const extra = collectRuntime({ listen, top, grants });
   return sanitizePulse({
     ts: Date.now(),
     hostname: os.hostname(),
@@ -1142,11 +1214,14 @@ export function collectPulse() {
     top,
     listen,
     originA: originAddrs(),
-    failedUnit: null,
+    failedUnit: collectFailedUnits().join(", ") || null,
     oom: Number(hardening.oomKills) > 0 || Number(pressure.cgroupOom) > 0,
     limited,
     hardening,
     pressure,
+    grants,
+    runtime: extra.runtime,
+    errors: extra.errors,
   });
 }
 
@@ -1222,6 +1297,14 @@ export function formatPulsePreview(pulse, lang = "en") {
   const pr = pulse.pressure || {};
   if (pr.conntrackPct != null) extraBits.push(`conntrack ${pr.conntrackPct}%`);
   if (pr.cpus) extraBits.push(`${pr.cpus} CPU`);
+  if (pulse.grants?.logs) extraBits.push("logs");
+  if (pulse.grants?.daemon) extraBits.push("daemon");
+  const rt = pulse.runtime || {};
+  for (const k of ["docker", "kube", "nginx"]) {
+    if (rt[k] === "ok") extraBits.push(k);
+    if (rt[k] === "denied") extraBits.push(`${k} denied`);
+  }
+  if ((pulse.errors || []).length) extraBits.push(`errors ${(pulse.errors || []).length}`);
   const extra = extraBits.length ? `\n${extraBits.join(" · ")}` : "";
   return `${machine}\n\n${listen}\n\n${top}\n\n${guard}${extra}`;
 }

package/server/sat-i18n.mjs

@@ -44,6 +44,11 @@ const STR = {
     daemon_no: "No",
     daemon_yes: "Yes — background, starts after reboot",
     daemon_skip: "Daemon not installed. Later: orb44 install   or login --daemon",
+    ask_logs: "Collect last errors from journal, Docker, Kubernetes, nginx?\nLast lines only, secrets stripped. Needs read access — Orb44 will not sudo.",
+    logs_no: "No — processes and listeners only",
+    logs_yes: "Yes — last errors if readable",
+    logs_skip: "Log monitoring off. Later: orb44 login --logs   or orb44 install --logs",
+    logs_on: "Log monitoring on. Docker/kube/nginx only if this user can read them.",
     need_login: "First: orb44 login",
     key_revoked: "Key revoked. Again: orb44 login",
     daemon_run: "daemon every {sec}s · {host}",
@@ -113,17 +118,17 @@ const STR = {
     preview_limited: "limited: cannot see which process owns the ports",
     help: `Orb44 satellite — admin device.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--interval 300]
+  orb44 install [--system] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
   orb44 update
   orb44 logout
 
-Login asks language (saved) then daemon (default no).
+Login asks language (saved), then daemon and logs (default no).
 Key: {file}
 Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   },
@@ -152,6 +157,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     daemon_no: "Нет",
     daemon_yes: "Да — в фоне и после перезагрузки",
     daemon_skip: "Демон не ставили. Позже: orb44 install   или login --daemon",
+    ask_logs: "Снимать последние ошибки journal, Docker, Kubernetes, nginx?\nТолько хвост, секреты вырезаем. Нужен доступ на чтение — sudo сателлит не берёт.",
+    logs_no: "Нет — только процессы и слушатели",
+    logs_yes: "Да — последние ошибки, если читаются",
+    logs_skip: "Логи не снимаем. Позже: orb44 login --logs   или orb44 install --logs",
+    logs_on: "Логи включены. Docker/kube/nginx — только если этот пользователь их видит.",
     need_login: "Сначала: orb44 login",
     key_revoked: "Ключ отозван. Снова: orb44 login",
     daemon_run: "демон каждые {sec}с · {host}",
@@ -221,17 +231,17 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_limited: "ограничено: не видно, какой процесс слушает порты",
     help: `Orb44 сателлит — устройство админа.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--interval 300]
+  orb44 install [--system] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
   orb44 update
   orb44 logout
 
-После login спрашивает язык (запоминает), затем демон — по умолчанию нет.
+После login спрашивает язык (запоминает), затем демон и логи — по умолчанию нет.
 Ключ: {file}
 Пульс исходящий. Кабинет не выполняет команды: отвечает текстом «что сделать».`,
   },
@@ -260,6 +270,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     daemon_no: "아니요",
     daemon_yes: "예 — 백그라운드, 재부팅 후 자동",
     daemon_skip: "데몬을 설치하지 않았습니다. 나중에: orb44 install  또는 login --daemon",
+    ask_logs: "journal / Docker / Kubernetes / nginx 마지막 오류를 보낼까요?\n마지막 줄만, 비밀은 지웁니다. 읽기 권한이 필요합니다 — sudo 하지 않습니다.",
+    logs_no: "아니요 — 프로세스와 리스너만",
+    logs_yes: "예 — 읽을 수 있으면 마지막 오류",
+    logs_skip: "로그 수집 안 함. 나중에: orb44 login --logs  또는 orb44 install --logs",
+    logs_on: "로그 수집 켜짐. Docker/kube/nginx는 이 사용자가 읽을 수 있을 때만.",
     need_login: "먼저: orb44 login",
     key_revoked: "키가 취소되었습니다. 다시: orb44 login",
     daemon_run: "데몬 {sec}초마다 · {host}",
@@ -329,17 +344,17 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_limited: "제한: 포트를 연 프로세스를 볼 수 없음",
     help: `Orb44 위성 — 관리자 장치.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--interval 300]
+  orb44 install [--system] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
   orb44 update
   orb44 logout
 
-login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니다.
+login에서 언어를 묻고 저장한 뒤, 데몬과 로그는 기본값 아니오입니다.
 키: {file}
 나가는 펄스. 콘솔은 명령을 실행하지 않고 조언만 돌려줍니다.`,
   },
@@ -368,6 +383,11 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     daemon_no: "No",
     daemon_yes: "Sí — segundo plano y tras el reinicio",
     daemon_skip: "Demonio no instalado. Luego: orb44 install   o login --daemon",
+    ask_logs: "¿Enviar los últimos errores de journal, Docker, Kubernetes, nginx?\nSolo las últimas líneas, sin secretos. Hace falta lectura — Orb44 no usa sudo.",
+    logs_no: "No — solo procesos y listeners",
+    logs_yes: "Sí — últimos errores si se pueden leer",
+    logs_skip: "Sin logs. Luego: orb44 login --logs   o orb44 install --logs",
+    logs_on: "Logs activos. Docker/kube/nginx solo si este usuario los ve.",
     need_login: "Primero: orb44 login",
     key_revoked: "Clave revocada. Otra vez: orb44 login",
     daemon_run: "demonio cada {sec}s · {host}",
@@ -437,17 +457,17 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     preview_limited: "limitado: no se ve qué proceso tiene los puertos",
     help: `Satélite Orb44 — dispositivo de admin.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--interval 300]
+  orb44 install [--system] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
   orb44 update
   orb44 logout
 
-Login pregunta idioma (lo guarda) y luego demonio (por defecto no).
+Login pregunta idioma (lo guarda), luego demonio y logs (por defecto no).
 Clave: {file}
 Pulso saliente. El gabinete no ejecuta órdenes; responde con consejos.`,
   },

package/server/sat-logs.mjs

@@ -0,0 +1,260 @@
+import fs from "node:fs";
+import { execFileSync } from "node:child_process";
+
+const SECRET_RE = /(password|passwd|secret|api[_-]?key|authorization|bearer|private[_-]?key|token)\s*[:=]/i;
+const RUNTIME_STATES = new Set(["ok", "absent", "denied"]);
+const ERROR_SOURCES = new Set(["journal", "docker", "kube", "nginx", "unit"]);
+
+export function sanitizeGrants(raw = {}) {
+  return {
+    process: true,
+    daemon: Boolean(raw?.daemon),
+    logs: Boolean(raw?.logs),
+  };
+}
+
+function oneState(v) {
+  return RUNTIME_STATES.has(v) ? v : "absent";
+}
+
+export function sanitizeRuntime(raw = {}) {
+  return {
+    daemon: oneState(raw.daemon),
+    journal: oneState(raw.journal),
+    docker: oneState(raw.docker),
+    kube: oneState(raw.kube),
+    nginx: oneState(raw.nginx),
+  };
+}
+
+export function redactLogLine(line) {
+  let s = String(line || "").replace(/\s+/g, " ").trim();
+  if (!s) return "";
+  if (SECRET_RE.test(s) || /-----BEGIN/.test(s)) return "[redacted]";
+  if (s.length > 160) s = `${s.slice(0, 159)}…`;
+  return s;
+}
+
+export function sanitizeErrors(list) {
+  const out = [];
+  const seen = new Set();
+  for (const e of Array.isArray(list) ? list : []) {
+    const source = ERROR_SOURCES.has(e?.source) ? e.source : null;
+    const text = redactLogLine(e?.text);
+    const name = String(e?.name || "")
+      .replace(/[^\w./:@-]/g, "")
+      .slice(0, 48);
+    if (!source || !text || text === "[redacted]") continue;
+    const key = `${source}:${name}:${text}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({
+      source,
+      name: name || source,
+      level: e.level === "warn" ? "warn" : "error",
+      text,
+    });
+    if (out.length >= 8) break;
+  }
+  return out;
+}
+
+export function inferRuntime(listen = [], top = []) {
+  const names = [...listen, ...top].map((r) => String(r.comm || "").toLowerCase());
+  const ports = listen.map((r) => Number(r.port));
+  const has = (re) => names.some((n) => re.test(n));
+  return {
+    docker: has(/^(dockerd|containerd|docker-proxy)/) || ports.includes(2375) || ports.includes(2376) ? "ok" : "absent",
+    kube: has(/^(kubelet|kube-apiserver|k3s|k0s)$/) || ports.includes(6443) || ports.includes(10250) ? "ok" : "absent",
+    nginx: has(/^(nginx|httpd|apache2|caddy|openresty)$/) ? "ok" : "absent",
+  };
+}
+
+export function parseDockerPs(text) {
+  const bad = [];
+  for (const line of String(text || "").split("\n")) {
+    const tab = line.indexOf("\t");
+    const name = (tab >= 0 ? line.slice(0, tab) : line).trim();
+    const status = (tab >= 0 ? line.slice(tab + 1) : "").trim();
+    if (!name) continue;
+    if (/restarting|unhealthy|dead|exited \((?!0\))|oom/i.test(status)) {
+      bad.push({ name, status });
+    }
+  }
+  return bad;
+}
+
+export function parseKubePods(text) {
+  const bad = [];
+  for (const line of String(text || "").split("\n")) {
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 4) continue;
+    const [ns, name, ready, status] = parts;
+    if (/^(NAMESPACE|NAME)$/i.test(ns)) continue;
+    const notReady = /^0\/[1-9]/.test(ready);
+    if (/CrashLoop|Error|ImagePull|BackOff|OOMKilled|Evicted|Unknown|Failed|Terminating/i.test(status) || notReady) {
+      bad.push({ name: `${ns}/${name}`, text: status });
+    }
+  }
+  return bad.slice(0, 8);
+}
+
+export function parseNginxErrorLog(text) {
+  const out = [];
+  for (const line of String(text || "").split("\n").reverse()) {
+    if (!/\[(error|crit|alert|emerg)\]|emerg|fatal/i.test(line)) continue;
+    const t = redactLogLine(line);
+    if (t && t !== "[redacted]") out.push(t);
+    if (out.length >= 4) break;
+  }
+  return out;
+}
+
+export function parseJournalErrors(text) {
+  return String(text || "")
+    .split("\n")
+    .map(redactLogLine)
+    .filter((l) => l && l !== "[redacted]" && !/orb44/i.test(l))
+    .slice(0, 6);
+}
+
+function tryCmd(bin, args, timeout = 1600) {
+  try {
+    const out = execFileSync(bin, args, {
+      encoding: "utf8",
+      timeout,
+      maxBuffer: 48 * 1024,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    return { ok: true, text: String(out || "") };
+  } catch (e) {
+    if (e?.code === "ENOENT") return { absent: true };
+    const msg = `${e?.stderr || ""} ${e?.message || ""} ${e?.stdout || ""}`;
+    if (/permission denied|access denied|cannot connect|connect: permission|forbidden|unauthorized|dial unix|Got permission/i.test(msg)) {
+      return { denied: true };
+    }
+    if (/localhost:8080 was refused|no configuration|no such file|The connection to the server/i.test(msg)) {
+      return { absent: true };
+    }
+    if (e?.stdout) return { ok: true, text: String(e.stdout) };
+    return { fail: true };
+  }
+}
+
+function probeDaemon() {
+  const sys = tryCmd("systemctl", ["is-active", "orb44-satellite"]);
+  if (sys.ok && String(sys.text).trim() === "active") return "ok";
+  const user = tryCmd("systemctl", ["--user", "is-active", "orb44-satellite"]);
+  if (user.ok && String(user.text).trim() === "active") return "ok";
+  return "absent";
+}
+
+function collectJournal() {
+  const r = tryCmd("journalctl", ["-p", "err", "-n", "12", "--no-pager", "--output=cat"]);
+  if (r.absent) return { state: "absent", errors: [] };
+  if (r.denied) return { state: "denied", errors: [] };
+  if (!r.ok) return { state: "absent", errors: [] };
+  return {
+    state: "ok",
+    errors: parseJournalErrors(r.text).map((text) => ({ source: "journal", name: "journal", text })),
+  };
+}
+
+function collectDocker() {
+  const sock = "/var/run/docker.sock";
+  const sockHere = fs.existsSync(sock);
+  const ps = tryCmd("docker", ["ps", "-a", "--format", "{{.Names}}\t{{.Status}}"]);
+  if (ps.absent && !sockHere) return { state: "absent", errors: [] };
+  if (ps.denied || (ps.absent && sockHere)) return { state: "denied", errors: [] };
+  if (!ps.ok) return { state: sockHere ? "denied" : "absent", errors: [] };
+  const errors = [];
+  for (const c of parseDockerPs(ps.text).slice(0, 4)) {
+    const logs = tryCmd("docker", ["logs", "--tail", "10", "--since", "20m", c.name], 1800);
+    const lines = String(logs.text || "")
+      .split("\n")
+      .map(redactLogLine)
+      .filter((l) => l && l !== "[redacted]" && /error|fatal|panic|oom|emerg/i.test(l));
+    errors.push({
+      source: "docker",
+      name: c.name,
+      text: lines[0] || c.status,
+    });
+  }
+  return { state: "ok", errors };
+}
+
+function collectKube() {
+  const pods = tryCmd("kubectl", ["get", "pods", "-A", "--no-headers"], 2000);
+  if (pods.absent) return { state: "absent", errors: [] };
+  if (pods.denied) return { state: "denied", errors: [] };
+  if (!pods.ok) return { state: "absent", errors: [] };
+  return {
+    state: "ok",
+    errors: parseKubePods(pods.text).map((p) => ({ source: "kube", name: p.name, text: p.text })),
+  };
+}
+
+const WEB_LOGS = ["/var/log/nginx/error.log", "/var/log/httpd/error_log", "/var/log/apache2/error.log", "/var/log/caddy/error.log"];
+
+function tailFile(file, max = 8192) {
+  const st = fs.statSync(file);
+  const fd = fs.openSync(file, "r");
+  try {
+    const buf = Buffer.alloc(Math.min(max, st.size));
+    fs.readSync(fd, buf, 0, buf.length, Math.max(0, st.size - max));
+    return buf.toString("utf8");
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function collectNginx() {
+  let denied = false;
+  let saw = false;
+  const errors = [];
+  for (const file of WEB_LOGS) {
+    if (!fs.existsSync(file)) continue;
+    saw = true;
+    try {
+      const lines = parseNginxErrorLog(tailFile(file));
+      for (const text of lines) errors.push({ source: "nginx", name: file.split("/").slice(-2).join("/"), text });
+    } catch {
+      denied = true;
+    }
+  }
+  if (errors.length) return { state: "ok", errors };
+  if (denied) return { state: "denied", errors: [] };
+  if (saw) return { state: "ok", errors: [] };
+  return { state: "absent", errors: [] };
+}
+
+function pickState(probed, inferred) {
+  if (probed && probed !== "absent") return probed;
+  return inferred || "absent";
+}
+
+export function collectRuntime({ listen = [], top = [], grants } = {}) {
+  const g = sanitizeGrants(grants);
+  const inferred = inferRuntime(listen, top);
+  const daemon = probeDaemon();
+  if (!g.logs) {
+    return {
+      runtime: sanitizeRuntime({ ...inferred, daemon, journal: "absent" }),
+      errors: [],
+    };
+  }
+  const journal = collectJournal();
+  const docker = collectDocker();
+  const kube = collectKube();
+  const nginx = collectNginx();
+  return {
+    runtime: sanitizeRuntime({
+      daemon,
+      journal: journal.state,
+      docker: pickState(docker.state, inferred.docker),
+      kube: pickState(kube.state, inferred.kube),
+      nginx: pickState(nginx.state, inferred.nginx),
+    }),
+    errors: sanitizeErrors([...journal.errors, ...docker.errors, ...kube.errors, ...nginx.errors]),
+  };
+}

package/server/sat-update.mjs

@@ -11,6 +11,7 @@ export const SAT_TREE_FILES = [
   "server/sat-local.mjs",
   "server/sat-http.mjs",
   "server/sat-update.mjs",
+  "server/sat-logs.mjs",
   "package.json",
 ];