ysk-server-core 1.0.0

package/dist/monitoring/metrics.js

@@ -0,0 +1,144 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Host metrics snapshot for dashboard / predictive thresholds.
+ * Disk mounts and process lists use real host commands (honest, no fake rows).
+ */
+import { cpus, freemem, loadavg, totalmem, uptime } from 'node:os';
+import { readFileSync, existsSync } from 'node:fs';
+import fs from 'node:fs';
+export function collectMetrics(diskPath = '/') {
+    const total = totalmem();
+    const free = freemem();
+    const usedRatio = total > 0 ? 1 - free / total : 0;
+    const load = loadavg();
+    const alerts = [];
+    if (usedRatio > 0.9)
+        alerts.push('memory_high');
+    if (load[0] > cpus().length * 2)
+        alerts.push('load_high');
+    let available;
+    if (existsSync('/proc/meminfo')) {
+        try {
+            const meminfo = readFileSync('/proc/meminfo', 'utf8');
+            const m = meminfo.match(/^MemAvailable:\s+(\d+)\s*kB/m);
+            if (m)
+                available = Number(m[1]) * 1024;
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    let disk;
+    try {
+        const statfs = fs.statfsSync;
+        if (typeof statfs === 'function') {
+            const s = statfs(diskPath);
+            const dTotal = Number(s.blocks) * Number(s.bsize);
+            const dFree = Number(s.bfree) * Number(s.bsize);
+            const dUsed = dTotal > 0 ? 1 - dFree / dTotal : 0;
+            disk = { path: diskPath, free: dFree, total: dTotal, usedRatio: dUsed };
+            if (dUsed > 0.9)
+                alerts.push('disk_high');
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    return {
+        at: new Date().toISOString(),
+        loadavg: load,
+        cpuCount: cpus().length,
+        memory: { total, free, usedRatio, available },
+        uptimeSec: uptime(),
+        disk,
+        alerts,
+    };
+}
+/**
+ * Parse `df -P -B1` output into mounts.
+ * Skips tmpfs/devtmpfs/squashfs by default.
+ */
+export function parseDfOutput(stdout, opts) {
+    const lines = stdout.split('\n').map((l) => l.trim()).filter(Boolean);
+    if (lines.length < 2)
+        return [];
+    const out = [];
+    for (const line of lines.slice(1)) {
+        // Filesystem 1024-blocks Used Available Capacity Mounted on
+        // With -B1: size in bytes
+        const parts = line.split(/\s+/);
+        if (parts.length < 6)
+            continue;
+        const mount = parts.slice(5).join(' ');
+        const filesystem = parts[0];
+        const size = Number(parts[1]);
+        const used = Number(parts[2]);
+        const avail = Number(parts[3]);
+        if (!Number.isFinite(size) || size <= 0)
+            continue;
+        const fsLow = filesystem.toLowerCase();
+        if (!opts?.includePseudo &&
+            (fsLow.includes('tmpfs') ||
+                fsLow.includes('devtmpfs') ||
+                fsLow.includes('squashfs') ||
+                fsLow === 'overlay' ||
+                mount.startsWith('/snap'))) {
+            continue;
+        }
+        const usedRatio = size > 0 ? used / size : 0;
+        out.push({
+            filesystem,
+            size,
+            used,
+            avail: Number.isFinite(avail) ? avail : Math.max(0, size - used),
+            usedRatio,
+            mount,
+        });
+    }
+    return out;
+}
+/** Real multi-disk via df on host */
+export async function collectDiskMounts(host, opts) {
+    const notes = [];
+    const r = await host.runCommand(['df', '-P', '-B1'], { timeoutMs: 8_000 });
+    if (r.exitCode !== 0) {
+        notes.push(tl('notes.auto.t0458', { v0: ((r.stderr || r.stdout).slice(0, 160)) }));
+        return { mounts: [], notes };
+    }
+    const mounts = parseDfOutput(r.stdout, opts);
+    if (!mounts.length)
+        notes.push(tl('notes.auto.n0250'));
+    return { mounts, notes };
+}
+/**
+ * Full metrics with multi-disk when host available.
+ */
+export async function collectMetricsDeep(host, diskPath = '/') {
+    const base = collectMetrics(diskPath);
+    const { mounts, notes } = await collectDiskMounts(host);
+    const alerts = [...base.alerts];
+    for (const m of mounts) {
+        if (m.usedRatio > 0.9 && m.mount === '/') {
+            if (!alerts.includes('disk_high'))
+                alerts.push('disk_high');
+        }
+    }
+    // Prefer root mount from df for primary disk if present
+    const root = mounts.find((m) => m.mount === diskPath || m.mount === '/');
+    const disk = root
+        ? {
+            path: root.mount,
+            free: root.avail,
+            total: root.size,
+            usedRatio: root.usedRatio,
+        }
+        : base.disk;
+    return {
+        ...base,
+        disk,
+        diskMounts: mounts,
+        alerts,
+        notes: notes.length ? notes : undefined,
+    };
+}
+//# sourceMappingURL=metrics.js.map

package/dist/monitoring/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/monitoring/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,MAAM,SAAS,CAAC;AAOzB,MAAM,UAAU,cAAc,CAAC,QAAQ,GAAG,GAAG;IAC3C,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAE1D,IAAI,SAA6B,CAAC;IAClC,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACxD,IAAI,CAAC;gBAAE,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GACV,EAGD,CAAC,UAAU,CAAC;QACb,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACxE,IAAI,KAAK,GAAG,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM;QACvB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;QAC7C,SAAS,EAAE,MAAM,EAAE;QACnB,IAAI;QACJ,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,IAAkC;IAElC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,4DAA4D;QAC5D,0BAA0B;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACvC,IACE,CAAC,IAAI,EAAE,aAAa;YACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACtB,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC1B,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC1B,KAAK,KAAK,SAAS;gBACnB,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAC5B,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC;YACP,UAAU;YACV,IAAI;YACJ,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;YAChE,SAAS;YACT,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qCAAqC;AACrC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAkB,EAClB,IAAkC;IAElC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACvD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAkB,EAClB,QAAQ,GAAG,GAAG;IAEd,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,wDAAwD;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI;QACf,CAAC,CAAC;YACE,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACH,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAEd,OAAO;QACL,GAAG,IAAI;QACP,IAAI;QACJ,UAAU,EAAE,MAAM;QAClB,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACxC,CAAC;AACJ,CAAC"}

package/dist/monitoring/notifications.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Aggregate panel notifications for dashboard (honest, derived from live state).
+ */
+import type { YskDatabase } from '../db/database.js';
+import type { HostExecutor } from '../host/executor.js';
+export type NotificationLevel = 'critical' | 'warn' | 'info';
+export type NotificationItem = {
+    id: string;
+    level: NotificationLevel;
+    title: string;
+    body: string;
+    href?: string;
+    source: string;
+    at: string;
+};
+export declare function collectNotifications(input: {
+    db: YskDatabase;
+    host: HostExecutor;
+    dataDir: string;
+    /** precomputed optional */
+    executeEnabled?: boolean;
+    /** Optional JSON blobs from settings repo */
+    lastBackup?: Record<string, unknown> | null;
+    lastDnsbl?: Record<string, unknown> | null;
+}): Promise<{
+    items: NotificationItem[];
+    counts: Record<NotificationLevel, number>;
+}>;
+//# sourceMappingURL=notifications.d.ts.map

package/dist/monitoring/notifications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../../src/monitoring/notifications.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMxD,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAE7D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,EAAE,EAAE,WAAW,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAuUpF"}

package/dist/monitoring/notifications.js

@@ -0,0 +1,337 @@
+import { tl } from 'ysk-server-shared';
+import { collectMetrics } from './metrics.js';
+import { parseCertExpiryFromPath } from '../hosting/ssl-certs.js';
+import { auditApplyStatuses } from '../hosting/apply-audit.js';
+import { existsSync } from 'node:fs';
+export async function collectNotifications(input) {
+    const items = [];
+    const now = new Date().toISOString();
+    const push = (n) => {
+        items.push({ ...n, at: n.at ?? now });
+    };
+    // Execute permission
+    const exec = input.executeEnabled ?? input.host.executeEnabled();
+    if (!exec) {
+        push({
+            id: 'exec-disabled',
+            level: 'warn',
+            title: tl('notes.auto.n0025'),
+            body: tl('notes.auto.n0214'),
+            href: '/system/readiness',
+            source: 'host'
+        });
+    }
+    // Metrics
+    try {
+        const m = collectMetrics();
+        for (const a of m.alerts ?? []) {
+            if (a === 'memory_high') {
+                push({
+                    id: 'mem-high',
+                    level: 'warn',
+                    title: tl('notes.auto.n1357'),
+                    body: tl('notes.auto.n0504'),
+                    href: '/metrics',
+                    source: 'metrics'
+                });
+            }
+            if (a === 'load_high') {
+                push({
+                    id: 'load-high',
+                    level: 'warn',
+                    title: tl('notes.auto.n1446'),
+                    body: tl('notes.auto.n0063'),
+                    href: '/metrics',
+                    source: 'metrics'
+                });
+            }
+            if (a === 'disk_high') {
+                push({
+                    id: 'disk-high',
+                    level: 'critical',
+                    title: tl('notes.auto.n1292'),
+                    body: tl('notes.auto.n1007'),
+                    href: '/metrics',
+                    source: 'metrics'
+                });
+            }
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    // Suspended projects
+    const suspended = input.db.snapshot.projects.filter((p) => p.status === 'suspended');
+    if (suspended.length) {
+        push({
+            id: 'proj-suspended',
+            level: 'info',
+            title: tl('notes.auto.t0445', { v0: (suspended.length) }),
+            body: suspended
+                .slice(0, 3)
+                .map((p) => p.name)
+                .join('、'),
+            href: '/projects',
+            source: 'projects'
+        });
+    }
+    // Projects missing OS isolation (only warn when EXECUTE on — otherwise always true)
+    if (exec) {
+        const bare = input.db.snapshot.projects.filter((p) => !p.os_provisioned && p.status !== 'suspended');
+        if (bare.length) {
+            push({
+                id: 'proj-no-os',
+                level: 'warn',
+                title: tl('notes.auto.t0446', { v0: (bare.length) }),
+                body: tl('notes.auto.n1247'),
+                href: '/projects',
+                source: 'projects'
+            });
+        }
+    }
+    // Pending human approvals
+    const pendingApprovals = (input.db.snapshot.approvals ?? []).filter((a) => a.status === 'pending');
+    if (pendingApprovals.length) {
+        push({
+            id: 'approvals-pending',
+            level: pendingApprovals.length >= 5 ? 'critical' : 'warn',
+            title: tl('notes.auto.t0447', { v0: (pendingApprovals.length) }),
+            body: pendingApprovals
+                .slice(0, 3)
+                .map((a) => a.action)
+                .join('、'),
+            href: '/security?tab=approvals',
+            source: 'security'
+        });
+    }
+    // Certs expiring ≤ 30d
+    const nowMs = Date.now();
+    for (const c of input.db.snapshot.certificates ?? []) {
+        const domain = String(c.domain ?? '');
+        let exp = c.expires_at ? String(c.expires_at) : null;
+        if (!exp && c.fullchain_path && existsSync(String(c.fullchain_path))) {
+            exp = parseCertExpiryFromPath(String(c.fullchain_path));
+        }
+        if (!exp)
+            continue;
+        const days = Math.floor((new Date(exp).getTime() - nowMs) / 86400_000);
+        if (days <= 30) {
+            push({
+                id: `cert-${domain}`,
+                level: days <= 7 ? 'critical' : 'warn',
+                title: days < 0 ? tl('notes.auto.t0448', { v0: (domain) }) : tl('notes.auto.t0449', { v0: (days), v1: (domain) }),
+                body: exp,
+                href: `/ssl?domain=${encodeURIComponent(domain)}`,
+                source: 'ssl'
+            });
+        }
+    }
+    // Last backup failed (or side steps failed while tar ok)
+    const lastBackup = input.lastBackup;
+    if (lastBackup && lastBackup.ok === false) {
+        push({
+            id: 'backup-fail',
+            level: 'warn',
+            title: tl('notes.auto.n0490'),
+            body: lastBackup.at ? tl('notes.auto.t0450', { v0: (String(lastBackup.at)) }) : tl('notes.auto.n1383'),
+            href: '/backups?tab=ops',
+            source: 'backup'
+        });
+    }
+    else if (lastBackup && lastBackup.ok === true && lastBackup.sideOk === false) {
+        push({
+            id: 'backup-side-fail',
+            level: 'warn',
+            title: tl('notes.auto.n0560'),
+            body: tl('notes.auto.n1382'),
+            href: '/backups?tab=ops',
+            source: 'backup'
+        });
+    }
+    // DNSBL listed from last run
+    const lastDnsbl = input.lastDnsbl;
+    if (lastDnsbl?.reports) {
+        for (const r of lastDnsbl.reports) {
+            if (r.ok === false) {
+                push({
+                    id: `dnsbl-${r.domain}`,
+                    level: 'critical',
+                    title: tl('notes.auto.t0451', { v0: (r.domain ?? 'IP') }),
+                    body: (r.listedOn ?? []).join(', ') || 'listed',
+                    href: '/email',
+                    source: 'email'
+                });
+            }
+        }
+    }
+    // Defense threat from last status snapshot (optional settings)
+    try {
+        const def = input.db.snapshot.settings?.defense_last_threat;
+        if (def === 'under_attack' || def === 'critical') {
+            push({
+                id: 'defense-threat',
+                level: def === 'critical' ? 'critical' : 'warn',
+                title: def === 'critical' ? tl('notes.auto.n1527') : tl('notes.auto.n1529'),
+                body: tl('notes.auto.n1385'),
+                href: '/protection',
+                source: 'defense'
+            });
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    // Auto-ban circuit breaker / pause
+    try {
+        const raw = input.db.snapshot.settings?.defense_auto_ban;
+        if (raw) {
+            const pol = JSON.parse(raw);
+            if (pol.enabled && pol.pausedReason === 'circuit_breaker') {
+                push({
+                    id: 'defense-auto-ban-cb',
+                    level: 'warn',
+                    title: tl('notes.auto.n0026'),
+                    body: tl('notes.auto.n0994'),
+                    href: '/protection',
+                    source: 'defense'
+                });
+            }
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    // Apply honesty audit — surface blocked / stuck-at-written resources
+    try {
+        const audit = auditApplyStatuses(input.db);
+        if (audit.summary.bad > 0) {
+            const sample = audit.findings
+                .filter((f) => f.severity === 'bad')
+                .slice(0, 3)
+                .map((f) => f.name)
+                .join('、');
+            push({
+                id: 'apply-audit-bad',
+                level: 'critical',
+                title: tl('notes.auto.t0452', { v0: (audit.summary.bad) }),
+                body: sample || tl('notes.auto.n1384'),
+                href: '/?tab=notifications',
+                source: 'apply-audit'
+            });
+        }
+        else if (audit.summary.warn > 0) {
+            push({
+                id: 'apply-audit-warn',
+                level: 'warn',
+                title: tl('notes.auto.t0453', { v0: (audit.summary.warn) }),
+                body: tl('notes.auto.n0890'),
+                href: '/?tab=notifications',
+                source: 'apply-audit'
+            });
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    // Root not available while EXECUTE on — production risk
+    if (exec && !input.host.isRoot()) {
+        push({
+            id: 'not-root',
+            level: 'warn',
+            title: tl('notes.auto.n1595'),
+            body: tl('notes.auto.n0211'),
+            href: '/system/readiness',
+            source: 'host'
+        });
+    }
+    // Automation: suggest emergency / last escalate
+    try {
+        const raw = input.db.snapshot.settings?.defense_automation;
+        if (raw) {
+            const a = JSON.parse(raw);
+            if (a.enabled && a.suggestEmergency) {
+                push({
+                    id: 'defense-suggest-emergency',
+                    level: 'critical',
+                    title: tl('notes.auto.n1528'),
+                    body: tl('notes.auto.n0597'),
+                    href: '/protection',
+                    source: 'defense'
+                });
+            }
+            if (a.enabled && a.lastPresetId && a.lastPresetId !== 'daily') {
+                const note = (a.lastTickNotes ?? []).find((n) => n.includes(tl('notes.auto.n1337')));
+                if (note) {
+                    push({
+                        id: 'defense-auto-preset',
+                        level: 'warn',
+                        title: tl('notes.auto.t0454', { v0: (a.lastPresetId) }),
+                        body: note,
+                        href: '/protection',
+                        source: 'defense'
+                    });
+                }
+            }
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    // Failed audit in last 20
+    const failedAudit = (input.db.snapshot.audit_events ?? [])
+        .filter((e) => e.ok === false)
+        .slice(0, 5);
+    for (const e of failedAudit) {
+        push({
+            id: `audit-${e.id}`,
+            level: 'info',
+            title: tl('notes.auto.t0455', { v0: (e.action) }),
+            body: e.resource ? String(e.resource) : tl('notes.auto.n1350'),
+            href: '/security',
+            source: 'audit',
+            at: e.created_at
+        });
+    }
+    // Journal / log disk pressure from log-center settings snapshot (optional live probe)
+    try {
+        const raw = input.db.snapshot.settings?.log_center;
+        let warnMb = 1024;
+        if (raw) {
+            const p = JSON.parse(raw);
+            if (p.journalWarnMb && p.journalWarnMb > 0)
+                warnMb = Number(p.journalWarnMb);
+        }
+        // Prefer cached overview-style hint if present
+        const hint = input.db.snapshot.settings?.log_center_disk_hint;
+        if (hint) {
+            try {
+                const h = JSON.parse(hint);
+                if (h.journalDiskMb != null && h.journalDiskMb >= warnMb) {
+                    push({
+                        id: 'journal-disk-high',
+                        level: h.journalDiskMb >= warnMb * 2 ? 'critical' : 'warn',
+                        title: tl('notes.auto.t0456', { v0: (h.journalDiskMb) }),
+                        body: tl('notes.auto.t0457', { v0: (warnMb) }),
+                        href: '/logs?tab=maintain',
+                        source: 'logs',
+                        at: h.at
+                    });
+                }
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    // Sort: critical > warn > info
+    const rank = { critical: 0, warn: 1, info: 2 };
+    items.sort((a, b) => rank[a.level] - rank[b.level] || (a.at < b.at ? 1 : -1));
+    const counts = { critical: 0, warn: 0, info: 0 };
+    for (const i of items)
+        counts[i.level]++;
+    return { items: items.slice(0, 50), counts };
+}
+//# sourceMappingURL=notifications.js.map

package/dist/monitoring/notifications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/monitoring/notifications.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAOvC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAcrC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAS1C;IACC,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,CAAiD,EAAE,EAAE;QACjE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,qBAAqB;IACrB,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;IACjE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC;YACH,EAAE,EAAE,eAAe;YACnB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC5B,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;SAAE,CAAC,CAAC;IACtB,CAAC;IAED,UAAU;IACV,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,EAAE,EAAE,UAAU;oBACd,KAAK,EAAE,MAAM;oBACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;oBAC7B,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;oBAC5B,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,SAAS;iBAAE,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,EAAE,EAAE,WAAW;oBACf,KAAK,EAAE,MAAM;oBACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;oBAC7B,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;oBAC5B,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,SAAS;iBAAE,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,EAAE,EAAE,WAAW;oBACf,KAAK,EAAE,UAAU;oBACjB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;oBAC7B,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;oBAC5B,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,SAAS;iBAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,qBAAqB;IACrB,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;IACrF,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,IAAI,EAAE,SAAS;iBACZ,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,GAAG,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,UAAU;SAAE,CAAC,CAAC;IAC1B,CAAC;IAED,oFAAoF;IACpF,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,CACrD,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,EAAE,EAAE,YAAY;gBAChB,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;gBAC5B,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,UAAU;aAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CACjE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAC9B,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,gBAAgB,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;YACzD,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,IAAI,EAAE,gBAAgB;iBACnB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;iBACpB,IAAI,CAAC,GAAG,CAAC;YACZ,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,UAAU;SAAE,CAAC,CAAC;IAC1B,CAAC;IAED,uBAAuB;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,cAAc,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC;QACvE,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,EAAE,EAAE,QAAQ,MAAM,EAAE;gBACpB,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;gBACtC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjH,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,eAAe,kBAAkB,CAAC,MAAM,CAAC,EAAE;gBACjD,MAAM,EAAE,KAAK;aAAE,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,IAAI,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;YACtG,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,QAAQ;SAAE,CAAC,CAAC;IACxB,CAAC;SAAM,IAAI,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC/E,IAAI,CAAC;YACH,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC5B,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,QAAQ;SAAE,CAAC,CAAC;IACxB,CAAC;IAED,6BAA6B;IAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,SAEhB,CAAC;IACT,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,EAAE,EAAE,SAAS,CAAC,CAAC,MAAM,EAAE;oBACvB,KAAK,EAAE,UAAU;oBACjB,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;oBACzD,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ;oBAC/C,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,OAAO;iBAAE,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;QAC5D,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,EAAE,EAAE,gBAAgB;gBACpB,KAAK,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;gBAC/C,KAAK,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;gBAC3E,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;gBAC5B,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,SAAS;aAAE,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QACzD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgE,CAAC;YAC3F,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,iBAAiB,EAAE,CAAC;gBAC1D,IAAI,CAAC;oBACH,EAAE,EAAE,qBAAqB;oBACzB,KAAK,EAAE,MAAM;oBACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;oBAC7B,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;oBAC5B,IAAI,EAAE,aAAa;oBACnB,MAAM,EAAE,SAAS;iBAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,qEAAqE;IACrE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ;iBAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;iBACnC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,EAAE,EAAE,iBAAiB;gBACrB,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,kBAAkB,CAAC;gBACtC,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,aAAa;aAAE,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,EAAE,EAAE,kBAAkB;gBACtB,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;gBAC5B,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,aAAa;aAAE,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,wDAAwD;IACxD,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC5B,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;SAAE,CAAC,CAAC;IACtB,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC3D,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAKvB,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,EAAE,EAAE,2BAA2B;oBAC/B,KAAK,EAAE,UAAU;oBACjB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;oBAC7B,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;oBAC5B,IAAI,EAAE,aAAa;oBACnB,MAAM,EAAE,SAAS;iBAAE,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;gBAC9D,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;gBACrF,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,EAAE,EAAE,qBAAqB;wBACzB,KAAK,EAAE,MAAM;wBACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;wBACvD,IAAI,EAAE,IAAI;wBACV,IAAI,EAAE,aAAa;wBACnB,MAAM,EAAE,SAAS;qBAAE,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;SACvD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;SAC7B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE;YACnB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;YAC9D,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,OAAO;YACf,EAAE,EAAE,CAAC,CAAC,UAAU;SAAE,CAAC,CAAC;IACxB,CAAC;IAED,sFAAsF;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QACnD,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;YACxD,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC;gBAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/E,CAAC;QACD,+CAA+C;QAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QAC9D,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4C,CAAC;gBACtE,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;oBACzD,IAAI,CAAC;wBACH,EAAE,EAAE,mBAAmB;wBACvB,KAAK,EAAE,CAAC,CAAC,aAAa,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;wBAC1D,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;wBACxD,IAAI,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC9C,IAAI,EAAE,oBAAoB;wBAC1B,MAAM,EAAE,MAAM;wBACd,EAAE,EAAE,CAAC,CAAC,EAAE;qBAAE,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,+BAA+B;IAC/B,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9E,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAEzC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC"}

package/dist/monitoring/process-signal.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Send signals to host processes (kill) — honest, fail-closed without YSK_EXECUTE.
+ * Never pretends success; never signals PID 1 without refusal.
+ */
+import type { HostExecutor } from '../host/executor.js';
+export type ProcessSignal = 'TERM' | 'KILL' | 'HUP' | 'USR1';
+export declare const PROCESS_SIGNALS: readonly ProcessSignal[];
+export type SignalProcessResult = {
+    ok: boolean;
+    blocked?: boolean;
+    blockMessage?: string;
+    pid: string;
+    signal: ProcessSignal;
+    /** After signal: kill -0 still succeeds → still alive */
+    stillAlive?: boolean;
+    /** /proc cmdline snippet when readable */
+    command?: string;
+    notes: string[];
+    executeEnabled?: boolean;
+};
+export declare function isProcessSignal(v: unknown): v is ProcessSignal;
+/**
+ * Normalize and validate PID string. Returns null if invalid / protected init.
+ */
+export declare function normalizePid(raw: string | number): {
+    ok: true;
+    pid: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Read process cmdline via host (honest empty when unreadable).
+ */
+export declare function readProcessCmdline(host: HostExecutor, pid: string): Promise<string | undefined>;
+/**
+ * Lightweight /proc detail for drawer.
+ */
+export declare function collectProcessDetail(host: HostExecutor, pidRaw: string): Promise<{
+    ok: boolean;
+    pid: string;
+    command?: string;
+    cwd?: string;
+    fdCount?: number;
+    notes: string[];
+}>;
+export type ReniceResult = {
+    ok: boolean;
+    blocked?: boolean;
+    blockMessage?: string;
+    pid: string;
+    nice?: number;
+    notes: string[];
+    executeEnabled?: boolean;
+};
+/**
+ * Adjust process nice value (-20..19). Requires YSK_EXECUTE.
+ * Uses `renice -n N -p PID` (relative) when absolute not available we use absolute via renice.
+ */
+export declare function reniceProcess(input: {
+    host: HostExecutor;
+    pid: string | number;
+    /** Absolute nice value -20..19 */
+    nice: number;
+}): Promise<ReniceResult>;
+export declare function signalProcess(input: {
+    host: HostExecutor;
+    pid: string | number;
+    signal: ProcessSignal;
+    /** Allow signaling this Node process (ysk-server itself) */
+    forceSelf?: boolean;
+    /**
+     * When true, allow signaling a process whose cmdline looks like ysk control plane
+     * (even if not process.pid). Default false.
+     */
+    forceControlPlane?: boolean;
+}): Promise<SignalProcessResult>;
+//# sourceMappingURL=process-signal.d.ts.map

package/dist/monitoring/process-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-signal.d.ts","sourceRoot":"","sources":["../../src/monitoring/process-signal.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7D,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAK1C,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,aAAa,CAAC;IACtB,yDAAyD;IACzD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AASF,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,aAAa,CAE9D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAc5G;AAYD;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,YAAY,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IACT,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAyCD;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,YAAY,CAAC,CAqExB;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,aAAa,CAAC;IACtB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgJ/B"}