@otto-code/brain 0.7.5

package/dist/service/supervisor.js

@@ -0,0 +1,222 @@
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _Supervisor_instances, _Supervisor_setState, _Supervisor_log, _Supervisor_health;
+import http from "node:http";
+import { spawn } from "node:child_process";
+import { EventEmitter } from "node:events";
+import { buildArgs, buildEnv, formatCommand } from "../runtime/index.js";
+import { usedBytes } from "../gpu.js";
+const LOG_LINES_KEPT = 300;
+/**
+ * Default loopback port for the private llama-server child. Deliberately clear
+ * of Otto's space: 8081 (the old default) is the Expo/Metro dev port, so a brain
+ * started from the dev checkout collided with the running app - the server bound
+ * a port the app also wanted, and benchmark requests hit Metro (or a dead
+ * socket) instead of the model. This range sits above Otto's daemon ports
+ * (6788/6868) and app port (8081/19000) and below the Windows ephemeral range.
+ * Calibrate and sweep run their own supervisors at +1/+2 so they never collide
+ * with a main service already holding the base port.
+ */
+export const DEFAULT_INTERNAL_PORT = 20800;
+/**
+ * Owns the llama-server child process.
+ *
+ * The server always listens on a private port; `router.js` fronts it on a
+ * stable one so switching models never asks a client to reconnect elsewhere.
+ */
+export class Supervisor extends EventEmitter {
+    constructor({ runtime, internalPort = DEFAULT_INTERNAL_PORT, host = "127.0.0.1", readyTimeoutMs = 300000, }) {
+        super();
+        _Supervisor_instances.add(this);
+        this.runtime = runtime;
+        this.internalPort = internalPort;
+        this.host = host;
+        this.readyTimeoutMs = readyTimeoutMs;
+        this.state = "stopped"; // stopped | starting | ready | failed
+        this.child = null;
+        this.model = null;
+        this.profile = null;
+        this.logLines = [];
+        this.lastError = null;
+        this.startedAt = null;
+        this.loadSeconds = null;
+        this.vramAtReadyBytes = null;
+        this.vramBaselineBytes = null;
+        this.command = null;
+    }
+    get upstreamBase() {
+        return `http://${this.host}:${this.internalPort}`;
+    }
+    /** Start (or restart) the server for a model + profile. */
+    async start(model, profile) {
+        await this.stop();
+        this.model = model;
+        this.profile = profile;
+        this.lastError = null;
+        this.logLines = [];
+        this.vramBaselineBytes = await usedBytes();
+        __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_setState).call(this, "starting");
+        const args = buildArgs({ ...profile, modelPath: model.modelPath, mmprojPath: model.mmprojPath }, { port: this.internalPort, host: this.host });
+        this.command = formatCommand(this.runtime, args);
+        __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_log).call(this, `launching: ${this.command}`);
+        const started = Date.now();
+        this.child = spawn(this.runtime.exe, args, {
+            cwd: this.runtime.dir,
+            env: buildEnv(this.runtime),
+            windowsHide: true,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const onChunk = (chunk) => {
+            for (const line of String(chunk).split(/\r?\n/)) {
+                if (line.trim())
+                    __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_log).call(this, line.trim());
+            }
+        };
+        this.child.stdout?.on("data", onChunk);
+        this.child.stderr?.on("data", onChunk);
+        let exitedEarly = null;
+        this.child.once("exit", (code, signal) => {
+            const wasReady = this.state === "ready";
+            this.child = null;
+            if (this.state === "stopping") {
+                __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_setState).call(this, "stopped");
+                return;
+            }
+            exitedEarly = { code, signal };
+            // 3221225781 == 0xC0000135 STATUS_DLL_NOT_FOUND: the vendor DLL trap.
+            const hint = code === 3221225781 ? " (missing runtime DLLs - the vendor directory was not on PATH)" : "";
+            this.lastError = `llama-server exited with code ${code}${signal ? ` signal ${signal}` : ""}${hint}`;
+            __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_setState).call(this, "failed", this.lastError);
+            if (wasReady)
+                this.emit("crashed", this.lastError);
+        });
+        this.child.once("error", (error) => {
+            this.lastError = `could not launch llama-server: ${error.message}`;
+            __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_setState).call(this, "failed", this.lastError);
+        });
+        // Poll /health until the model finishes loading.
+        const deadline = Date.now() + this.readyTimeoutMs;
+        let peakVram = this.vramBaselineBytes || 0;
+        while (Date.now() < deadline) {
+            if (exitedEarly)
+                throw new Error(this.lastError ?? undefined);
+            await new Promise((resolve) => setTimeout(resolve, 1000));
+            const used = await usedBytes();
+            if (used && used > peakVram)
+                peakVram = used;
+            const health = await __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_health).call(this);
+            if (health) {
+                this.loadSeconds = (Date.now() - started) / 1000;
+                this.startedAt = new Date();
+                this.vramAtReadyBytes = (await usedBytes()) ?? peakVram;
+                __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_setState).call(this, "ready");
+                this.emit("ready", {
+                    loadSeconds: this.loadSeconds,
+                    vramBytes: this.vramAtReadyBytes,
+                    deltaBytes: this.vramAtReadyBytes - (this.vramBaselineBytes || 0),
+                });
+                return this;
+            }
+        }
+        this.lastError = `model did not become ready within ${this.readyTimeoutMs / 1000}s`;
+        await this.stop();
+        __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_setState).call(this, "failed", this.lastError);
+        throw new Error(this.lastError);
+    }
+    /** Fetch /props from the running server (modalities, template caps, defaults). */
+    props() {
+        return new Promise((resolve) => {
+            const req = http.get({ host: this.host, port: this.internalPort, path: "/props", timeout: 5000 }, (res) => {
+                let body = "";
+                res.on("data", (c) => (body += c));
+                res.on("end", () => {
+                    try {
+                        resolve(JSON.parse(body));
+                    }
+                    catch {
+                        resolve(null);
+                    }
+                });
+            });
+            req.on("timeout", () => {
+                req.destroy();
+                resolve(null);
+            });
+            req.on("error", () => resolve(null));
+        });
+    }
+    async stop() {
+        if (!this.child) {
+            if (this.state !== "stopped")
+                __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_setState).call(this, "stopped");
+            return;
+        }
+        __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_setState).call(this, "stopping");
+        const child = this.child;
+        await new Promise((resolve) => {
+            const done = setTimeout(() => {
+                try {
+                    child.kill("SIGKILL");
+                }
+                catch {
+                    /* already gone */
+                }
+                resolve();
+            }, 6000);
+            child.once("exit", () => {
+                clearTimeout(done);
+                resolve();
+            });
+            try {
+                child.kill();
+            }
+            catch {
+                clearTimeout(done);
+                resolve();
+            }
+        });
+        this.child = null;
+        __classPrivateFieldGet(this, _Supervisor_instances, "m", _Supervisor_setState).call(this, "stopped");
+    }
+    status() {
+        return {
+            state: this.state,
+            model: this.model ? this.model.displayName : null,
+            modelId: this.model ? this.model.id : null,
+            pid: this.child ? (this.child.pid ?? null) : null,
+            loadSeconds: this.loadSeconds,
+            vramBytes: this.vramAtReadyBytes,
+            startedAt: this.startedAt ? this.startedAt.toISOString() : null,
+            lastError: this.lastError,
+            upstream: this.upstreamBase,
+            runtime: `${this.runtime.label} v${this.runtime.version}`,
+        };
+    }
+}
+_Supervisor_instances = new WeakSet(), _Supervisor_setState = function _Supervisor_setState(state, detail) {
+    this.state = state;
+    this.emit("state", { state, detail });
+}, _Supervisor_log = function _Supervisor_log(line) {
+    if (!line)
+        return;
+    this.logLines.push(line);
+    if (this.logLines.length > LOG_LINES_KEPT)
+        this.logLines.shift();
+    this.emit("log", line);
+}, _Supervisor_health = function _Supervisor_health() {
+    return new Promise((resolve) => {
+        const req = http.get({ host: this.host, port: this.internalPort, path: "/health", timeout: 2500 }, (res) => {
+            res.resume();
+            resolve(res.statusCode === 200);
+        });
+        req.on("timeout", () => {
+            req.destroy();
+            resolve(false);
+        });
+        req.on("error", () => resolve(false));
+    });
+};
+//# sourceMappingURL=supervisor.js.map

package/dist/service/tailscale.d.ts

@@ -0,0 +1,19 @@
+export declare const DEFAULT_TAILSCALE_EXE = "tailscale";
+export interface RunResult {
+    stdout: string;
+    stderr: string;
+}
+/** Promisified execFile with a hard timeout and a useful error message. */
+export declare function run(exe: string, args: string[], timeout?: number): Promise<RunResult>;
+/** The tailnet IPv4 address of this machine (for a tailnet-only bind). */
+export declare function ipv4(exe?: string): Promise<string>;
+/** This machine's MagicDNS name, e.g. greyskull.tail279562.ts.net (trailing dot stripped). */
+export declare function dnsName(exe?: string): Promise<string>;
+/**
+ * Ask tailscaled for a Let's Encrypt cert for `hostname`, written to disk.
+ * Idempotent: tailscaled serves a cached cert until it is near expiry.
+ */
+export declare function issueCert(exe: string, hostname: string, certFile: string, keyFile: string): Promise<void>;
+/** True if the tailscale CLI is present and the daemon answers. */
+export declare function isAvailable(exe?: string): Promise<boolean>;
+//# sourceMappingURL=tailscale.d.ts.map

package/dist/service/tailscale.js

@@ -0,0 +1,62 @@
+/**
+ * A thin promisified wrapper over the `tailscale` CLI — the OS boundary for the
+ * `tailscale` TLS mode and the `listen.host: "tailscale"` bind. All Tailscale
+ * interaction goes through here. Ported from otto-brain-relay's `tailscale.js`.
+ *
+ * The default executable is `tailscale` on PATH; a caller may pass an explicit
+ * path (`tls.tailscaleExe`) when the CLI is installed somewhere non-standard
+ * (e.g. `C:\Program Files\Tailscale\tailscale.exe`).
+ */
+import { execFile } from "node:child_process";
+export const DEFAULT_TAILSCALE_EXE = "tailscale";
+/** Promisified execFile with a hard timeout and a useful error message. */
+export function run(exe, args, timeout = 120000) {
+    return new Promise((resolve, reject) => {
+        execFile(exe, args, { timeout, windowsHide: true }, (error, stdout, stderr) => {
+            if (error) {
+                const detail = (stderr || stdout || error.message).toString().trim();
+                reject(new Error(`\`${exe} ${args.join(" ")}\` failed: ${detail}`));
+                return;
+            }
+            resolve({ stdout: String(stdout), stderr: String(stderr) });
+        });
+    });
+}
+/** The tailnet IPv4 address of this machine (for a tailnet-only bind). */
+export async function ipv4(exe = DEFAULT_TAILSCALE_EXE) {
+    const { stdout } = await run(exe, ["ip", "-4"], 15000);
+    const address = stdout.trim().split(/\r?\n/)[0]?.trim();
+    if (!address)
+        throw new Error("tailscale reported no IPv4 address - is it connected?");
+    return address;
+}
+/** This machine's MagicDNS name, e.g. greyskull.tail279562.ts.net (trailing dot stripped). */
+export async function dnsName(exe = DEFAULT_TAILSCALE_EXE) {
+    const { stdout } = await run(exe, ["status", "--json"], 15000);
+    const status = JSON.parse(stdout);
+    const name = typeof status === "object" && status !== null
+        ? status.Self?.DNSName
+        : undefined;
+    if (typeof name !== "string" || !name) {
+        throw new Error("could not read Self.DNSName from `tailscale status --json`");
+    }
+    return name.replace(/\.$/, "");
+}
+/**
+ * Ask tailscaled for a Let's Encrypt cert for `hostname`, written to disk.
+ * Idempotent: tailscaled serves a cached cert until it is near expiry.
+ */
+export async function issueCert(exe, hostname, certFile, keyFile) {
+    await run(exe, ["cert", "--cert-file", certFile, "--key-file", keyFile, hostname], 180000);
+}
+/** True if the tailscale CLI is present and the daemon answers. */
+export async function isAvailable(exe = DEFAULT_TAILSCALE_EXE) {
+    try {
+        await run(exe, ["version"], 10000);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=tailscale.js.map

package/dist/service/tls.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Supplies the TLS keypair for the brain's HTTPS listener and keeps it fresh,
+ * so the brain can be exposed over HTTPS with no relay in front. Ported and
+ * generalized from otto-brain-relay's `cert.js`.
+ *
+ * Modes (resolved from `config.tls`):
+ *  - `files`       — read the cert/key paths you provide; no renewal.
+ *  - `self-signed` — generate a local keypair on first run, cached under
+ *                    `certDir`; regenerated when it nears expiry. Clients must
+ *                    trust it (or pass `-k`); there is no chain of trust.
+ *  - `tailscale`   — issue/renew a real Let's Encrypt cert for this machine's
+ *                    MagicDNS name via `tailscaled`, so tailnet clients see no
+ *                    warnings. Renewal is hot: `renewed` fires with the new
+ *                    { cert, key } and the server swaps its secure context
+ *                    without dropping connections.
+ */
+import { EventEmitter } from "node:events";
+import type { BrainConfig } from "../config/schema.js";
+import type { BrainPaths } from "../config/paths.js";
+export interface SecurePair {
+    cert: Buffer;
+    key: Buffer;
+}
+export interface CertInfo {
+    subject: string;
+    issuer: string;
+    validFrom: Date;
+    validTo: Date;
+    certFile: string;
+    keyFile: string;
+}
+/** Minimal logger sink; only `warn`/`info` are used. */
+export interface TlsLogger {
+    info?(message: string): void;
+    warn?(message: string): void;
+}
+/** Concrete, fully-resolved options — no nulls, no auto-detection left to do. */
+export interface CertManagerOptions {
+    mode: "files" | "self-signed" | "tailscale";
+    certFile: string;
+    keyFile: string;
+    hostname: string;
+    certDir: string;
+    renewBeforeDays: number;
+    checkIntervalMs: number;
+    tailscaleExe: string;
+    logger?: TlsLogger;
+}
+/**
+ * Resolve `config.tls` into concrete CertManager options, or `null` when TLS is
+ * off. For `tailscale` mode with no configured hostname, this auto-detects the
+ * MagicDNS name from `tailscaled` (the one async step, done here so the manager
+ * itself is synchronous to construct).
+ */
+export declare function resolveTlsOptions(config: BrainConfig, paths: BrainPaths): Promise<CertManagerOptions | null>;
+export declare class CertManager extends EventEmitter {
+    private readonly options;
+    private readonly logger;
+    private timer;
+    private current;
+    constructor(options: CertManagerOptions);
+    /** Issue/generate if needed, then load and return the keypair. */
+    load(): Promise<SecurePair>;
+    /** Begin periodic expiry checks (renewing modes only). */
+    start(): void;
+    stop(): void;
+    get info(): CertInfo | null;
+    /** Days until the loaded cert expires, or null if none is loaded. */
+    get daysRemaining(): number | null;
+    /** Issue (tailscale) or generate (self-signed) when missing or near expiry. */
+    private ensureFresh;
+    private read;
+    /** Inspect the on-disk cert's expiry without loading it as current. */
+    private inspect;
+    private check;
+}
+//# sourceMappingURL=tls.d.ts.map

package/dist/service/tls.js

@@ -0,0 +1,192 @@
+/**
+ * Supplies the TLS keypair for the brain's HTTPS listener and keeps it fresh,
+ * so the brain can be exposed over HTTPS with no relay in front. Ported and
+ * generalized from otto-brain-relay's `cert.js`.
+ *
+ * Modes (resolved from `config.tls`):
+ *  - `files`       — read the cert/key paths you provide; no renewal.
+ *  - `self-signed` — generate a local keypair on first run, cached under
+ *                    `certDir`; regenerated when it nears expiry. Clients must
+ *                    trust it (or pass `-k`); there is no chain of trust.
+ *  - `tailscale`   — issue/renew a real Let's Encrypt cert for this machine's
+ *                    MagicDNS name via `tailscaled`, so tailnet clients see no
+ *                    warnings. Renewal is hot: `renewed` fires with the new
+ *                    { cert, key } and the server swaps its secure context
+ *                    without dropping connections.
+ */
+import { EventEmitter } from "node:events";
+import { existsSync, readFileSync } from "node:fs";
+import { X509Certificate } from "node:crypto";
+import path from "node:path";
+import generateSelfSigned from "selfsigned";
+import { ensurePrivateDirectory, writePrivateFileAtomicSync } from "../config/private-files.js";
+import { DEFAULT_TAILSCALE_EXE, dnsName, issueCert } from "./tailscale.js";
+const DAY_MS = 24 * 60 * 60 * 1000;
+// Self-signed certs live ~2 years; regenerated well before expiry by the check loop.
+const SELF_SIGNED_DAYS = 825;
+/**
+ * Resolve `config.tls` into concrete CertManager options, or `null` when TLS is
+ * off. For `tailscale` mode with no configured hostname, this auto-detects the
+ * MagicDNS name from `tailscaled` (the one async step, done here so the manager
+ * itself is synchronous to construct).
+ */
+export async function resolveTlsOptions(config, paths) {
+    const tls = config.tls;
+    if (tls.mode === "off")
+        return null;
+    const certDir = tls.certDir ?? path.join(paths.root, "certs");
+    const tailscaleExe = tls.tailscaleExe ?? DEFAULT_TAILSCALE_EXE;
+    if (tls.mode === "files") {
+        if (!tls.certFile || !tls.keyFile) {
+            throw new Error("tls.mode=files requires tls.certFile and tls.keyFile");
+        }
+        return {
+            mode: "files",
+            certFile: path.resolve(tls.certFile),
+            keyFile: path.resolve(tls.keyFile),
+            hostname: tls.hostname ?? "localhost",
+            certDir,
+            renewBeforeDays: tls.renewBeforeDays,
+            checkIntervalMs: tls.checkIntervalMs,
+            tailscaleExe,
+        };
+    }
+    const hostname = tls.hostname ?? (tls.mode === "tailscale" ? await dnsName(tailscaleExe) : "localhost");
+    return {
+        mode: tls.mode,
+        certFile: path.join(certDir, `${hostname}.crt`),
+        keyFile: path.join(certDir, `${hostname}.key`),
+        hostname,
+        certDir,
+        renewBeforeDays: tls.renewBeforeDays,
+        checkIntervalMs: tls.checkIntervalMs,
+        tailscaleExe,
+    };
+}
+export class CertManager extends EventEmitter {
+    constructor(options) {
+        super();
+        this.timer = null;
+        this.current = null;
+        this.options = options;
+        this.logger = options.logger ?? {};
+    }
+    /** Issue/generate if needed, then load and return the keypair. */
+    async load() {
+        if (this.options.mode !== "files")
+            await this.ensureFresh();
+        return this.read();
+    }
+    /** Begin periodic expiry checks (renewing modes only). */
+    start() {
+        if (this.options.mode === "files" || this.timer)
+            return;
+        this.timer = setInterval(() => {
+            this.check().catch((error) => this.logger.warn?.(`cert renewal check failed: ${errorMessage(error)}`));
+        }, this.options.checkIntervalMs);
+        this.timer.unref?.();
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+    }
+    get info() {
+        return this.current?.info ?? null;
+    }
+    /** Days until the loaded cert expires, or null if none is loaded. */
+    get daysRemaining() {
+        if (!this.current)
+            return null;
+        return Math.floor((this.current.info.validTo.getTime() - Date.now()) / DAY_MS);
+    }
+    /** Issue (tailscale) or generate (self-signed) when missing or near expiry. */
+    async ensureFresh() {
+        ensurePrivateDirectory(this.options.certDir);
+        const existing = this.inspect();
+        if (existing && existing.daysRemaining > this.options.renewBeforeDays)
+            return false;
+        const reason = existing
+            ? `expires in ${existing.daysRemaining}d (threshold ${this.options.renewBeforeDays}d)`
+            : "no cert on disk";
+        if (this.options.mode === "tailscale") {
+            this.logger.info?.(`requesting TLS certificate from tailscaled (${reason})...`);
+            await issueCert(this.options.tailscaleExe, this.options.hostname, this.options.certFile, this.options.keyFile);
+            return true;
+        }
+        // self-signed
+        this.logger.info?.(`generating a self-signed certificate for ${this.options.hostname} (${reason})`);
+        const pair = generateSelfSigned.generate([{ name: "commonName", value: this.options.hostname }], {
+            days: SELF_SIGNED_DAYS,
+            keySize: 2048,
+            algorithm: "sha256",
+            extensions: [
+                { name: "basicConstraints", cA: false },
+                {
+                    name: "subjectAltName",
+                    altNames: buildAltNames(this.options.hostname),
+                },
+            ],
+        });
+        writePrivateFileAtomicSync(this.options.certFile, pair.cert);
+        writePrivateFileAtomicSync(this.options.keyFile, pair.private);
+        return true;
+    }
+    read() {
+        const cert = readFileSync(this.options.certFile);
+        const key = readFileSync(this.options.keyFile);
+        const parsed = new X509Certificate(cert);
+        this.current = {
+            cert,
+            key,
+            info: {
+                subject: parsed.subject,
+                issuer: parsed.issuer.split("\n").find((l) => l.startsWith("CN=")) ?? parsed.issuer,
+                validFrom: new Date(parsed.validFrom),
+                validTo: new Date(parsed.validTo),
+                certFile: this.options.certFile,
+                keyFile: this.options.keyFile,
+            },
+        };
+        return { cert, key };
+    }
+    /** Inspect the on-disk cert's expiry without loading it as current. */
+    inspect() {
+        try {
+            if (!existsSync(this.options.certFile) || !existsSync(this.options.keyFile))
+                return null;
+            const parsed = new X509Certificate(readFileSync(this.options.certFile));
+            const validTo = new Date(parsed.validTo);
+            return { validTo, daysRemaining: Math.floor((validTo.getTime() - Date.now()) / DAY_MS) };
+        }
+        catch (error) {
+            this.logger.warn?.(`could not read existing certificate, will re-issue: ${errorMessage(error)}`);
+            return null;
+        }
+    }
+    async check() {
+        const before = this.current?.info.validTo.getTime();
+        const reissued = await this.ensureFresh();
+        if (!reissued)
+            return;
+        const { cert, key } = this.read();
+        if (this.current && this.current.info.validTo.getTime() === before)
+            return;
+        this.logger.info?.(`certificate renewed - now valid until ${this.current?.info.validTo.toISOString()}`);
+        this.emit("renewed", { cert, key });
+    }
+}
+function buildAltNames(hostname) {
+    const names = [
+        { type: 2, value: hostname },
+        { type: 2, value: "localhost" },
+        { type: 7, ip: "127.0.0.1" },
+        { type: 7, ip: "::1" },
+    ];
+    // Deduplicate when the hostname is itself "localhost".
+    return names.filter((n, i) => i === names.findIndex((m) => m.type === n.type && m.value === n.value && m.ip === n.ip));
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=tls.js.map

package/dist/sysmon.d.ts

@@ -0,0 +1,50 @@
+import { query } from "./gpu.js";
+/**
+ * Live system telemetry for the UI: CPU, system RAM, GPU, and how many
+ * inference slots are actually busy.
+ *
+ * Slot state comes from llama-server's own `/slots` endpoint rather than being
+ * inferred from request counting, so it reflects what the engine is really
+ * doing. That matters for agentic use: several concurrent requests are only
+ * genuinely parallel if there are free slots to take them, and slots share one
+ * KV pool — so more concurrency costs context per request.
+ */
+/** A CPU busy-fraction sampler: returns the fraction in [0,1], or null. */
+export interface CpuSampler {
+    (): number | null;
+}
+/** Slot occupancy from the running server. */
+export interface SlotInfo {
+    total: number;
+    busy: number;
+    idle: number;
+    contexts: number[];
+}
+/** One combined reading for the status panel. */
+export interface SystemSample {
+    cpu: number | null;
+    cpuCount: number;
+    loadAverage: number | null;
+    ramUsedBytes: number;
+    ramTotalBytes: number;
+    gpu: Awaited<ReturnType<typeof query>>;
+    slots: SlotInfo | null;
+}
+interface Endpoint {
+    host?: string;
+    port?: number;
+}
+/** CPU busy fraction, sampled between successive calls. */
+export declare function createCpuSampler(): CpuSampler;
+/**
+ * Slot occupancy from the running server.
+ * @returns {{total:number, busy:number, idle:number, contexts:number[]}|null}
+ */
+declare function slots({ host, port }: {
+    host: string;
+    port: number;
+}): Promise<SlotInfo | null>;
+export { slots };
+/** One combined reading for the status panel. */
+export declare function sample(sampler: CpuSampler, { host, port }?: Endpoint): Promise<SystemSample>;
+//# sourceMappingURL=sysmon.d.ts.map