deepdebug-local-agent 1.0.22 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepdebug-local-agent",
-  "version": "1.0.22",
+  "version": "1.1.0",
   "description": "DeepDebug Local Agent - AI-powered code debugging assistant",
   "private": false,
   "type": "module",
@@ -22,6 +22,7 @@
     "docker:build": "docker build -t deepdebug/local-agent:latest .",
     "docker:push": "docker push deepdebug/local-agent:latest",
     "test": "node --test",
+    "sync-fixtures": "node scripts/sync-fixtures.mjs",
     "lint": "eslint src/"
   },
   "pkg": {
@@ -34,13 +35,20 @@
     "@anthropic-ai/sdk": "^0.39.0",
     "@modelcontextprotocol/sdk": "^1.0.4",
     "body-parser": "^1.20.3",
+    "chokidar": "^3.6.0",
     "cors": "^2.8.5",
     "express": "^4.19.2",
     "js-yaml": "^4.1.0",
     "pg": "^8.20.0",
     "pidusage": "^3.0.2",
+    "pino": "^10.3.1",
+    "prom-client": "^15.1.3",
     "properties-reader": "^2.3.0",
+    "ssh2": "^1.16.0",
     "strip-ansi": "^7.1.0",
+    "tree-sitter": "^0.22.4",
+    "tree-sitter-swift": "^0.7.1",
+    "typescript": "^5.9.3",
     "unidiff": "^1.0.2",
     "ws": "^8.18.0"
   },
@@ -72,10 +80,10 @@
   "license": "Proprietary",
   "repository": {
     "type": "git",
-    "url": "https://github.com/williambella/deepdebug-local-agent.git"
+    "url": "git+https://github.com/VISIONHAMMER/deepdebug-local-agent.git"
   },
-  "homepage": "https://deepdebug.ai",
+  "homepage": "https://visionhammer.io",
   "bugs": {
-    "url": "https://github.com/williambella/deepdebug-local-agent/issues"
+    "url": "https://github.com/VISIONHAMMER/deepdebug-local-agent/issues"
   }
 }

package/scripts/sync-fixtures.mjs

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+// scripts/sync-fixtures.mjs — Phase 2 fixture sync (Plan 02-12 full implementation).
+//
+// For each requested stack, clones williambella/visionhammer-example-<stack>
+// shallow (--depth 1, --branch main) into /tmp/sync-<stack>, copies samples/
+// log files into test/fixtures/<adapter-dir>/ (with IBM MQ filename mapping),
+// then deletes the temp clone. Idempotent: re-runs cleanly overwrite prior
+// fixtures and rewipe /tmp scratch dirs.
+//
+// SECURITY (T-2-04 — PAT discipline):
+//   - PAT read ONCE from ~/.config/visionhammer/github-pat.
+//   - Embedded ONLY in `https://x-access-token:$PAT@github.com/...` URL form,
+//     passed as a `child_process.spawn` ARGV element (not a shell string), so
+//     no shell ever sees it. The argv carrying the URL IS visible to ps(1)
+//     during clone — that is the standard git-over-https risk window per AD-3.
+//   - Stdout/stderr are CAPTURED but only stack names / generic progress are
+//     written to console. Git's own stderr (which can contain the embedded
+//     URL on auth failure) is sanitised: every literal occurrence of the PAT
+//     is replaced with `***REDACTED***` before the buffer touches stderr.
+//   - The PAT NEVER goes into argv via a shell string, environment variable,
+//     log file, or thrown error message.
+//
+// SECURITY (T-2-05 — PAT scope assertion):
+//   - Before any clone, calls GitHub /user (with the PAT) to confirm the token
+//     authenticates. We do NOT enforce a specific scope here because the
+//     fine-grained-PAT scope vocabulary differs from classic-PAT scopes; a
+//     successful GET /user is sufficient to prove the token is valid and the
+//     token cannot exceed `repo`-equivalent scope per the project setup
+//     contract documented in docs/legacy-connectors.md.
+//
+// SECURITY (T-2-06 — fixture quarantine):
+//   - test/fixtures/*/ is .gitignore'd at the repo root (verified by Plan 02-01).
+//     The synced files are therefore quarantined: they NEVER enter version
+//     control of deepdebug-local-agent. AD-2 explicit submodule rejection.
+
+import {
+  readFileSync,
+  mkdirSync,
+  rmSync,
+  readdirSync,
+  copyFileSync,
+  existsSync,
+} from 'node:fs';
+import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join, dirname, basename } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const PAT_PATH = join(homedir(), '.config', 'visionhammer', 'github-pat');
+const ALLOWED_STACKS = ['oracle-forms', 'plsql', 'sap-abap', 'cobol', 'ibm-mq'];
+
+// Mapping: example-repo-stack name → local fixture directory name.
+// Example repos use product names (sap-abap, ibm-mq); local fixtures use
+// adapter names (sap, ibmmq). plsql has no Phase 2 adapter — fixtures are
+// synced for Phase 3 catalog work.
+const FIXTURE_DIR_MAP = Object.freeze({
+  'oracle-forms': 'oracle-forms',
+  'plsql': 'plsql',
+  'sap-abap': 'sap',
+  'cobol': 'cobol',
+  'ibm-mq': 'ibmmq',
+});
+
+// IBM MQ filename mapping (per Plan 02-08 SUMMARY's filename-mismatch decision).
+// The IbmMqLogAdapter only reads files matching `^AMQERR0[1-3]\.LOG$`. The
+// remote example repo intentionally uses descriptive sample names; sync-time
+// renaming makes the synced fixtures consumable by the adapter's contract.
+// Order is stable so re-runs always produce the same target filenames.
+const IBM_MQ_FILENAME_MAP = Object.freeze({
+  'ibm-mq-sample-mqrc-2033.log': 'AMQERR01.LOG',
+  'ibm-mq-sample-mqrc-2058.log': 'AMQERR02.LOG',
+  'ibm-mq-sample-resource-leak.log': 'AMQERR03.LOG',
+});
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = join(__dirname, '..');
+
+function readPat() {
+  // SECURITY: do NOT log PAT_PATH contents on error or success. ENOENT = caller missing setup.
+  try {
+    return readFileSync(PAT_PATH, 'utf8').trim();
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      process.stderr.write(
+        'sync-fixtures: GitHub credentials not configured. See docs/legacy-connectors.md.\n',
+      );
+      process.exit(2);
+    }
+    throw err;
+  }
+}
+
+function parseArgs(argv) {
+  // --stacks=oracle-forms,plsql  OR  --stacks oracle-forms plsql  OR  default = all
+  const args = argv.slice(2);
+  const flagIdx = args.findIndex((a) => a === '--stacks' || a.startsWith('--stacks='));
+  if (flagIdx === -1) return ALLOWED_STACKS;
+  const flag = args[flagIdx];
+  const raw = flag.startsWith('--stacks=')
+    ? flag.slice('--stacks='.length)
+    : (args[flagIdx + 1] || '');
+  const requested = raw.split(',').map((s) => s.trim()).filter(Boolean);
+  const unknown = requested.filter((s) => !ALLOWED_STACKS.includes(s));
+  if (unknown.length > 0) {
+    process.stderr.write(
+      `sync-fixtures: unknown stack(s): ${unknown.join(', ')}. Allowed: ${ALLOWED_STACKS.join(', ')}\n`,
+    );
+    process.exit(2);
+  }
+  return requested.length === 0 ? ALLOWED_STACKS : requested;
+}
+
+/**
+ * Run a child process; never log argv. Captures stdout/stderr buffers.
+ * @returns {Promise<{code:number, out:string, err:string}>}
+ */
+function run(cmd, args, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, {
+      cwd,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let out = '';
+    let err = '';
+    child.stdout.on('data', (d) => { out += d.toString(); });
+    child.stderr.on('data', (d) => { err += d.toString(); });
+    child.on('close', (code) => resolve({ code, out, err }));
+    child.on('error', reject);
+  });
+}
+
+/**
+ * T-2-05: confirm the PAT authenticates against GitHub before any clone.
+ * On failure, exit 2 with a generic message — never echo the PAT or response.
+ */
+async function assertPatValid(pat) {
+  // node:fetch is built-in on Node 18+. Authorization header is the standard
+  // PAT delivery channel — never logged, never persisted.
+  const res = await fetch('https://api.github.com/user', {
+    headers: {
+      Authorization: `Bearer ${pat}`,
+      Accept: 'application/vnd.github+json',
+      'User-Agent': 'visionhammer-sync-fixtures',
+    },
+  });
+  if (!res.ok) {
+    // Do NOT print response body — GitHub may echo parts of the request URL.
+    process.stderr.write(
+      `sync-fixtures: PAT authentication failed (HTTP ${res.status}). Verify ~/.config/visionhammer/github-pat.\n`,
+    );
+    process.exit(2);
+  }
+  // We intentionally do NOT verify scope strings — fine-grained-PAT and
+  // classic-PAT report scopes differently. Validity is sufficient per AD-3.
+}
+
+async function syncStack(stack, pat) {
+  const tmpClone = `/tmp/sync-${stack}`;
+  const repoUrl = `https://x-access-token:${pat}@github.com/williambella/visionhammer-example-${stack}.git`;
+  const fixtureDir = FIXTURE_DIR_MAP[stack];
+  const dest = join(REPO_ROOT, 'test', 'fixtures', fixtureDir);
+
+  // Clean any prior temp clone (idempotent re-runs).
+  try { rmSync(tmpClone, { recursive: true, force: true }); } catch (_) { /* ok */ }
+
+  process.stdout.write(`sync-fixtures: cloning ${stack} ... `);
+  const clone = await run(
+    'git',
+    ['clone', '--depth', '1', '--branch', 'main', repoUrl, tmpClone],
+    REPO_ROOT,
+  );
+  if (clone.code !== 0) {
+    process.stderr.write(
+      `\nsync-fixtures: git clone failed for ${stack} (exit ${clone.code}).\n`,
+    );
+    // Sanitize: replace any occurrence of the PAT with a redaction before
+    // letting git's stderr touch our stderr. Defence in depth — git rarely
+    // includes the credential portion of the URL but the redaction is cheap.
+    const sanitized = clone.err.split(pat).join('***REDACTED***');
+    process.stderr.write(sanitized + '\n');
+    return false;
+  }
+  process.stdout.write('cloned. ');
+
+  const srcSamples = join(tmpClone, 'samples');
+  if (!existsSync(srcSamples)) {
+    process.stderr.write(
+      `\nsync-fixtures: ${stack}: samples/ dir missing in repo, skipping copy.\n`,
+    );
+    try { rmSync(tmpClone, { recursive: true, force: true }); } catch (_) { /* ok */ }
+    return false;
+  }
+
+  mkdirSync(dest, { recursive: true });
+  const files = readdirSync(srcSamples).filter(
+    (f) => f.toLowerCase().endsWith('.log'),
+  );
+  let copied = 0;
+  for (const f of files) {
+    let targetName = f;
+    if (stack === 'ibm-mq') {
+      // Apply filename mapping (Plan 02-08 SUMMARY decision).
+      targetName = IBM_MQ_FILENAME_MAP[f] ?? null;
+      if (!targetName) {
+        // Sample without an explicit mapping is silently skipped — adapter
+        // would not pick it up anyway (filename anchor /^AMQERR0[1-3]\.LOG$/).
+        continue;
+      }
+    }
+    copyFileSync(join(srcSamples, f), join(dest, targetName));
+    copied++;
+  }
+  process.stdout.write(`copied ${copied} log(s) → test/fixtures/${fixtureDir}/. `);
+
+  // Cleanup temp clone.
+  try { rmSync(tmpClone, { recursive: true, force: true }); } catch (_) { /* ok */ }
+  process.stdout.write('done.\n');
+  return true;
+}
+
+async function main() {
+  const stacks = parseArgs(process.argv);
+  const pat = readPat();
+  await assertPatValid(pat); // T-2-05 gate
+  let failures = 0;
+  for (const s of stacks) {
+    const ok = await syncStack(s, pat);
+    if (!ok) failures++;
+  }
+  // PAT goes out of scope here — never persisted, never logged.
+  if (failures > 0) {
+    process.stderr.write(
+      `sync-fixtures: ${failures}/${stacks.length} stack(s) failed.\n`,
+    );
+    process.exit(1);
+  }
+  process.stdout.write(`sync-fixtures: all ${stacks.length} stack(s) synced.\n`);
+}
+
+main().catch((err) => {
+  // err.message MUST not contain PAT. We never interpolate the PAT into thrown
+  // errors anywhere above; the only thrown paths are fs/network errors whose
+  // messages do not reference the credential.
+  process.stderr.write(`sync-fixtures: fatal: ${err.message}\n`);
+  process.exit(1);
+});

package/scripts/upgrade-observability-push.sh

@@ -0,0 +1,227 @@
+#!/usr/bin/env bash
+# Upgrade an installed DeepDebug client observability bundle so that:
+#   1. Alloy also pushes the Docker log stream to VisionHammer
+#      (OTLP/HTTP JSON -> <gateway>/api/v1/webhooks/logs/otlp, Bearer <trigger secret>),
+#      which feeds Live logs and the services list;
+#   2. Alertmanager sends the trigger secret as a Bearer header instead of ?s= in the URL.
+#
+# Safe to re-run (idempotent). Backs up both files, validates the new configs with the
+# same images the stack runs, restarts only alloy + alertmanager, and rolls back on failure.
+#
+# Usage (on the server, as a user that can run docker):
+#   sudo bash upgrade-observability-push.sh            # apply
+#   sudo bash upgrade-observability-push.sh --dry-run  # show what would change
+# Optional env:
+#   INSTALL_DIR=/path/to/deepdebug-observability   (auto-detected otherwise)
+#   GATEWAY_URL=https://api-qa.visionhammer.io     (read from alertmanager.yml otherwise)
+set -euo pipefail
+
+DRY_RUN=0
+[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=1
+
+log()  { printf '\033[1;34m[upgrade]\033[0m %s\n' "$*"; }
+warn() { printf '\033[1;33m[upgrade]\033[0m %s\n' "$*" >&2; }
+die()  { printf '\033[1;31m[upgrade]\033[0m %s\n' "$*" >&2; exit 1; }
+mask() { local s="$1"; printf '%s...%s' "${s:0:8}" "${s: -4}"; }
+
+command -v docker >/dev/null || die "docker not found"
+docker compose version >/dev/null 2>&1 || die "docker compose plugin not found"
+command -v curl >/dev/null || die "curl not found"
+
+# ---------------------------------------------------------------- locate the stack
+find_install_dir() {
+  if [[ -n "${INSTALL_DIR:-}" ]]; then echo "$INSTALL_DIR"; return; fi
+  # 1) the running compose project
+  local cfg
+  cfg=$(docker compose ls --all --format json 2>/dev/null \
+        | tr '{' '\n' | grep '"Name":"deepdebug-observability"' \
+        | sed -n 's/.*"ConfigFiles":"\([^",]*\).*/\1/p' | head -1 || true)
+  if [[ -n "$cfg" && -f "$cfg" ]]; then dirname "$cfg"; return; fi
+  # 2) default provision paths
+  local d
+  for d in "$HOME/.deepdebug/observability/deepdebug-observability" \
+           /root/.deepdebug/observability/deepdebug-observability \
+           /home/*/.deepdebug/observability/deepdebug-observability; do
+    [[ -f "$d/docker-compose.yml" ]] && { echo "$d"; return; }
+  done
+}
+
+DIR=$(find_install_dir || true)
+[[ -n "$DIR" && -f "$DIR/docker-compose.yml" ]] \
+  || die "observability bundle not found; set INSTALL_DIR=/path/to/deepdebug-observability"
+ALLOY="$DIR/alloy/config.alloy"
+AM="$DIR/alertmanager/alertmanager.yml"
+[[ -f "$ALLOY" ]] || die "missing $ALLOY"
+[[ -f "$AM" ]] || die "missing $AM"
+log "bundle: $DIR"
+
+# ---------------------------------------------------------------- secret + gateway
+SECRET=$(grep -oE 'vht_[A-Za-z0-9._-]+' "$AM" | head -1 || true)
+[[ -n "$SECRET" ]] || die "no vht_ trigger secret found in $AM"
+if [[ -z "${GATEWAY_URL:-}" ]]; then
+  GATEWAY_URL=$(grep -oE "https?://[^/'\" ]+" "$AM" | head -1 || true)
+fi
+GATEWAY_URL="${GATEWAY_URL%/}"
+[[ "$GATEWAY_URL" =~ ^https?://[A-Za-z0-9.:-]+$ ]] || die "could not determine GATEWAY_URL (set it explicitly)"
+log "gateway: $GATEWAY_URL   secret: $(mask "$SECRET")"
+case "$GATEWAY_URL" in
+  https://api-qa.visionhammer.io|https://api.visionhammer.io) ;;
+  *) warn "gateway is not api-qa/api.visionhammer.io; the push endpoint only exists on the current gateway." ;;
+esac
+
+# ---------------------------------------------------------------- 1. probe the endpoint
+# An empty OTLP batch authenticates and registers the SELF_HOSTED log source without
+# writing any log line.
+code=$(curl -sS -o /tmp/vh-otlp-probe.$$ -w '%{http_code}' -m 20 \
+  -X POST "$GATEWAY_URL/api/v1/webhooks/logs/otlp" \
+  -H "Authorization: Bearer $SECRET" -H 'Content-Type: application/json' \
+  --data '{"resourceLogs":[]}' || echo 000)
+case "$code" in
+  200) log "push endpoint OK (200)" ;;
+  401) die "push endpoint rejected the secret (401): the trigger source is disabled or the secret changed" ;;
+  404) die "push endpoint not deployed yet on $GATEWAY_URL (404); retry after the gateway deploy" ;;
+  *)   die "push endpoint probe failed (HTTP $code): $(head -c 300 /tmp/vh-otlp-probe.$$ 2>/dev/null)" ;;
+esac
+rm -f /tmp/vh-otlp-probe.$$
+
+# ---------------------------------------------------------------- 2. build new configs
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+cp "$ALLOY" "$TMP/config.alloy"
+cp "$AM" "$TMP/alertmanager.yml"
+
+alloy_changed=0
+if grep -q 'otelcol.exporter.otlphttp "visionhammer"' "$TMP/config.alloy"; then
+  log "alloy: push already configured"
+else
+  # loki.process "default" must also forward to the OTLP receiver.
+  n=$(grep -c 'forward_to = \[loki.write.default.receiver\]' "$TMP/config.alloy" || true)
+  [[ "$n" == "1" ]] || die "alloy config does not look like the stock bundle (expected one 'forward_to = [loki.write.default.receiver]', found $n); edit $ALLOY by hand"
+  sed -i 's|forward_to = \[loki.write.default.receiver\]|forward_to = [loki.write.default.receiver, otelcol.receiver.loki.visionhammer.receiver]|' "$TMP/config.alloy"
+  cat >> "$TMP/config.alloy" <<EOF
+
+// ---- push to VisionHammer: Loki entries -> OTLP logs (labels become attributes) ----
+otelcol.receiver.loki "visionhammer" {
+  output {
+    logs = [otelcol.processor.batch.visionhammer.input]
+  }
+}
+
+otelcol.processor.batch "visionhammer" {
+  send_batch_size     = 500
+  send_batch_max_size = 2000
+  timeout             = "5s"
+  output {
+    logs = [otelcol.exporter.otlphttp.visionhammer.input]
+  }
+}
+
+otelcol.exporter.otlphttp "visionhammer" {
+  client {
+    endpoint    = "$GATEWAY_URL"
+    compression = "gzip"
+    headers     = { "Authorization" = "Bearer $SECRET" }
+  }
+  encoding      = "json"
+  logs_endpoint = "$GATEWAY_URL/api/v1/webhooks/logs/otlp"
+}
+EOF
+  alloy_changed=1
+  log "alloy: push blocks added"
+fi
+
+am_changed=0
+if grep -q 'webhooks/alertmanager?s=' "$TMP/alertmanager.yml"; then
+  # Drop ?s=... from the URL and add http_config.authorization at the same indent
+  # as the url key of that list item.
+  # Each receiver keeps ITS OWN secret (a bundle may post to QA and PROD gateways,
+  # each registered with a different vht_ secret).
+  awk '
+    /webhooks\/alertmanager\?s=/ {
+      match($0, /vht_[A-Za-z0-9._-]+/)
+      secret = substr($0, RSTART, RLENGTH)
+      line = $0
+      sub(/\?s=[^'"'"'" ]*/, "", line)
+      print line
+      match($0, /^[ ]*(- )?/)
+      ind = RLENGTH
+      pad = sprintf("%" ind "s", "")
+      print pad "http_config:"
+      print pad "  authorization:"
+      print pad "    type: Bearer"
+      print pad "    credentials: '"'"'" secret "'"'"'"
+      next
+    }
+    { print }
+  ' "$TMP/alertmanager.yml" > "$TMP/alertmanager.yml.new"
+  mv "$TMP/alertmanager.yml.new" "$TMP/alertmanager.yml"
+  am_changed=1
+  log "alertmanager: secret moved from ?s= to Authorization header"
+else
+  log "alertmanager: already uses header auth (or a custom config); left unchanged"
+fi
+
+if [[ $alloy_changed == 0 && $am_changed == 0 ]]; then
+  log "nothing to do"; exit 0
+fi
+
+# Mask every vht_ secret in printed output, not only the first one.
+mask_all() { sed -E 's/(vht_[A-Za-z0-9]{4})[A-Za-z0-9._-]*([A-Za-z0-9._-]{4})/\1...\2/g'; }
+show_diff() { diff -u "$1" "$2" | mask_all || true; }
+[[ $alloy_changed == 1 ]] && show_diff "$ALLOY" "$TMP/config.alloy"
+[[ $am_changed == 1 ]] && show_diff "$AM" "$TMP/alertmanager.yml"
+
+if [[ $DRY_RUN == 1 ]]; then log "dry run: nothing written"; exit 0; fi
+
+# ---------------------------------------------------------------- 3. validate with the stack's images
+image_of() { grep -E "^\s*image:\s*.*$1" "$DIR/docker-compose.yml" | head -1 | awk '{print $2}'; }
+ALLOY_IMG=$(image_of 'grafana/alloy'); ALLOY_IMG=${ALLOY_IMG:-grafana/alloy:v1.3.1}
+AM_IMG=$(image_of 'prom/alertmanager'); AM_IMG=${AM_IMG:-prom/alertmanager:v0.27.0}
+
+if [[ $alloy_changed == 1 ]]; then
+  docker run --rm -v "$TMP/config.alloy:/c/config.alloy:ro" "$ALLOY_IMG" fmt /c/config.alloy >/dev/null \
+    || die "new alloy config failed validation; nothing changed"
+  log "alloy config valid ($ALLOY_IMG)"
+fi
+if [[ $am_changed == 1 ]]; then
+  docker run --rm --entrypoint amtool -v "$TMP/alertmanager.yml:/c/am.yml:ro" "$AM_IMG" check-config /c/am.yml >/dev/null \
+    || die "new alertmanager config failed validation; nothing changed"
+  log "alertmanager config valid ($AM_IMG)"
+fi
+
+# ---------------------------------------------------------------- 4. apply + restart
+STAMP=$(date +%Y%m%d-%H%M%S)
+cp -p "$ALLOY" "$ALLOY.bak-$STAMP"
+cp -p "$AM" "$AM.bak-$STAMP"
+log "backups: *.bak-$STAMP"
+# Overwrite in place (keeps owner/permissions and the bind-mounted inode semantics on restart).
+cat "$TMP/config.alloy" > "$ALLOY"
+cat "$TMP/alertmanager.yml" > "$AM"
+
+rollback() {
+  warn "rolling back to *.bak-$STAMP"
+  cat "$ALLOY.bak-$STAMP" > "$ALLOY"
+  cat "$AM.bak-$STAMP" > "$AM"
+  (cd "$DIR" && docker compose restart alloy alertmanager >/dev/null 2>&1) || true
+  die "$1"
+}
+
+(cd "$DIR" && docker compose restart alloy alertmanager) || rollback "restart failed"
+
+# ---------------------------------------------------------------- 5. verify
+log "waiting 30s for alloy to ship its first batch..."
+sleep 30
+running=$(cd "$DIR" && docker compose ps --status running --services 2>/dev/null || true)
+grep -qx alloy <<<"$running" || rollback "alloy is not running after the restart"
+grep -qx alertmanager <<<"$running" || rollback "alertmanager is not running after the restart"
+
+errs=$(cd "$DIR" && docker compose logs --since 40s alloy 2>&1 \
+       | grep -iE 'level=error|Exporting failed|permanent error' | grep -i 'visionhammer\|otlphttp' || true)
+if [[ -n "$errs" ]]; then
+  warn "alloy reported export errors:"
+  mask_all <<<"$errs" | tail -5 >&2
+  rollback "alloy cannot push to $GATEWAY_URL"
+fi
+
+log "done. Logs should appear in VisionHammer > Live logs within ~1-2 minutes."
+log "to undo: cp $ALLOY.bak-$STAMP $ALLOY; cp $AM.bak-$STAMP $AM; (cd $DIR && docker compose restart alloy alertmanager)"

package/src/adapters/as400/as400-parser.js

@@ -0,0 +1,12 @@
+// src/adapters/as400/as400-parser.js
+// OS/400 message ID prefixes: CPF (escape), MCH (machine check), SQL (DB2 for i)
+// Anchored at start-of-line so arbitrary text containing the substring
+// (e.g. "see CPF1234 docs") does not match — T-2-03-equivalent isolation surface.
+export const AS400_MSGID_REGEX = /^(CPF|MCH|SQL)(\d{4})\b/;
+
+export function extractMessageId(line) {
+  const m = line.match(AS400_MSGID_REGEX);
+  return m ? `${m[1]}${m[2]}` : null;
+}
+
+export const DSPLOG_COMMAND = 'system "DSPLOG OUTPUT(*PRINT) LOGTYPE(*MSG) MSGTYPE(*ESCAPE *NOTIFY)"';

package/src/adapters/as400/index.js

@@ -0,0 +1,134 @@
+// src/adapters/as400/index.js
+// AS/400 (IBM i) log adapter — ssh2 Client polls DSPLOG output.
+// T-2-01 mitigation: pollInterval default 30000 ms (30 s — distinct from chokidar 5 s default per AD-3 + Constraints).
+// T-2-02 mitigation: ssh2 keepaliveInterval=30 s + keepaliveCountMax=3; 'close' triggers reconnect with
+// exponential backoff [1, 2, 4, 8, 16, 32, 60] s (capped at 60 s); backoff resets to base after a successful auth.
+import { EventEmitter } from 'node:events';
+import { Client as Ssh2Client } from 'ssh2';
+import { extractMessageId, DSPLOG_COMMAND } from './as400-parser.js';
+
+const ADAPTER = 'as400';
+const DEFAULT_BACKOFF = [1000, 2000, 4000, 8000, 16000, 32000, 60000];
+
+export class As400LogAdapter extends EventEmitter {
+  constructor(config = {}) {
+    super();
+    this.host = config.host || 'as400-prd-01';
+    this.port = config.port ?? 22;
+    this.username = config.username || 'TESTUSER01';
+    this.password = config.password;
+    this.privateKey = config.privateKey;
+    this.pollInterval = config.pollInterval ?? 30000;
+    this.backoffSchedule = config.backoffSchedule ?? DEFAULT_BACKOFF;
+    this._sshOpts = {
+      host: this.host,
+      port: this.port,
+      username: this.username,
+      ...(this.password ? { password: this.password } : {}),
+      ...(this.privateKey ? { privateKey: this.privateKey } : {}),
+      keepaliveInterval: 30000,
+      keepaliveCountMax: 3,
+      readyTimeout: 10000,
+    };
+    this._sshClientFactory = config.sshClientFactory || (() => new Ssh2Client());
+    this._client = null;
+    this._isRunning = false;
+    this._pollTimer = null;
+    this._backoffIdx = 0;
+    this._reconnectTimer = null;
+  }
+
+  get isRunning() { return this._isRunning; }
+
+  async start() {
+    if (this._isRunning) return;
+    this._isRunning = true;
+    this._connect();
+  }
+
+  async stop() {
+    if (!this._isRunning) return;
+    this._isRunning = false;
+    if (this._reconnectTimer) { clearTimeout(this._reconnectTimer); this._reconnectTimer = null; }
+    if (this._pollTimer) { clearInterval(this._pollTimer); this._pollTimer = null; }
+    if (this._client) {
+      try { this._client.end(); } catch { /* swallow */ }
+      this._client = null;
+    }
+  }
+
+  _connect() {
+    if (!this._isRunning) return;
+    const client = this._sshClientFactory();
+    this._client = client;
+
+    client.on('ready', () => {
+      this._backoffIdx = 0; // reset on successful auth
+      this._startPolling();
+    });
+
+    client.on('close', () => {
+      if (!this._isRunning) return;
+      if (this._pollTimer) { clearInterval(this._pollTimer); this._pollTimer = null; }
+      this._scheduleReconnect();
+    });
+
+    client.on('error', () => {
+      // ssh2 surfaces auth/network errors as 'error' then 'close'.
+      // 'close' handler schedules reconnect; nothing to do here.
+      if (!this._isRunning) return;
+    });
+
+    try {
+      client.connect(this._sshOpts);
+    } catch {
+      this._scheduleReconnect();
+    }
+  }
+
+  _scheduleReconnect() {
+    if (!this._isRunning) return;
+    const delay = this.backoffSchedule[Math.min(this._backoffIdx, this.backoffSchedule.length - 1)];
+    this._backoffIdx = Math.min(this._backoffIdx + 1, this.backoffSchedule.length - 1);
+    this._reconnectTimer = setTimeout(() => this._connect(), delay);
+    // Do not block process exit on a pending reconnect — `stop()` clears it explicitly.
+    this._reconnectTimer.unref?.();
+  }
+
+  _startPolling() {
+    const tick = () => {
+      if (!this._isRunning || !this._client) return;
+      this._client.exec(DSPLOG_COMMAND, (err, stream) => {
+        if (err) return; // close handler covers reconnect
+        let buf = '';
+        stream.on('data', (chunk) => { buf += chunk.toString('utf8'); });
+        stream.on('close', () => this._processOutput(buf));
+        stream.stderr?.on('data', () => { /* discard */ });
+      });
+    };
+    tick();
+    this._pollTimer = setInterval(tick, this.pollInterval);
+    // Do not block process exit on the poll cadence — `stop()` clears it explicitly.
+    this._pollTimer.unref?.();
+  }
+
+  _processOutput(text) {
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+      if (line.trim().length === 0) continue;
+      const code = extractMessageId(line);
+      if (!code) continue;
+      const event = Object.freeze({
+        adapter: ADAPTER,
+        errorCode: code,
+        file: `ssh://${this.host}/DSPLOG`,
+        message: line,
+        source: `ssh://${this.host}`,
+        timestamp: new Date().toISOString(),
+      });
+      this.emit('error', event);
+    }
+  }
+}
+
+export default As400LogAdapter;