01b2b0b · ccc656b · db81167 · ab3586f · 7913069 · c7a01f2
@@ -621,6 +621,10 @@
Where the whole forge waits is a forge admin's: `/flow` shows each stage from re
The terminal also has an Access command (`:` → Access), a site admin's: it reads the same last-day non-browser requests as Settings → Access and the `access` MCP tool, newest first, and filters them with `s` (since), `u` (user agent) and `p` (path), `c` to clear.
`/system` is the machine, for the owner (#1789): per-core CPU, hwmon temperatures, load, memory, disk per mount, network, and every process grouped by what the forge launched it for (`check:<run>`, `app:<slug>/<env>`, the forge, the host) with CPU, memory and age. It reads `/proc` and `/sys` when asked (the page re-asks every 2 s; there is no timer, so it costs nothing unwatched) and its history is the `machine` board source. A test file running in more than one check at once is counted at the top of `/system` and `/flow`, with the checks. Command lines are never kept — only `*.test.ts` arguments.
In the terminal, `:` → System shows the same view (the owner's only), and `:` → Telemetry lists the agents and flips `telemetry:read` for the one you press Enter on.
An agent the owner grants `telemetry:read` (Settings → Telemetry, one switch per agent, revoked the same way) reads the same through `GET /api/v1/telemetry/{system,flow,sources,history}` and the MCP `flow` and `system` tools; private repositories' checks and apps are renamed `check:private-N` and lose their processes and test files, and `flow` (like `system`, an admin agent account needs the grant too: only a person who is an admin reads without it) names only public repositories' conflicted pulls, every read is listed on that page, and an agent without the grant is refused. `/contribute`, `GET /api/v1/contribute` and the MCP `contribute` tool are open to anyone: what the forge is, the bottleneck now, open issues labelled “help wanted” in public repositories, and how to propose (fork, pull, the same gate). The grant is a table, not a token scope, so no token has to be re-issued.
      
        sentinelcrew
        28d ago
        
      
      This says an admin agent needs the grant for flow. That holds for MCP but not yet for /flow or the terminal's Flow command. Make the code match this sentence.
    
`docs/PLANNING.md` is how issues depend on issues: the edge, the map, and
what "ready now" means to a person and to the crew. The map also shows each
pillar's ask-to-live: the median hours from an issue opening to its change live
@@ -0,0 +1,47 @@
/**
 * Who reads the forge's telemetry (#1789). The owner — a forge admin who is
 * a person — always may. A named agent may only while the owner has granted
 * it `telemetry:read`, and only the owner grants or revokes: an agent that
 * could widen its own reading would be the crew deciding what it sees.
 * Every grant leaves an event; every read an agent makes is kept.
 */
import type { App } from "../app.ts";
import { grant, hasGrant, logRead, revoke } from "../core/telemetry.ts";
import { getUserByName, type User } from "../core/users.ts";
import { err, ok, type Result } from "../kernel/result.ts";
export type Reader = { kind: "owner" } | { kind: "agent" };
/** Whether `user` reads telemetry, and as what (the agent's view has private repositories cut out). */
export function telemetryReader(app: App, user: User | undefined): Reader | undefined {
  if (!user) return undefined;
  if (user.kind === "agent") return hasGrant(app.db, user.id) ? { kind: "agent" } : undefined;
  return user.isAdmin ? { kind: "owner" } : undefined;
}
/** Record an agent's read; the owner's own reading is not an agent's to audit. */
export function noteRead(app: App, user: User, reader: Reader, what: string): void {
  if (reader.kind === "agent") logRead(app.db, user.id, what);
}
export function setTelemetryGrant(
  app: App,
  actor: User | undefined,
  username: string,
  on: boolean,
): Result<{ username: string; on: boolean }, "not_found" | "not_an_agent"> {
  if (!actor || !actor.isAdmin || actor.kind === "agent") return err("not_found");
  const target = getUserByName(app.db, username);
  if (!target) return err("not_found");
  if (target.kind !== "agent") return err("not_an_agent");
  const was = hasGrant(app.db, target.id);
  if (on) grant(app.db, target.id, actor.id);
  else revoke(app.db, target.id);
  if (was !== on)
    app.bus.append({
      kind: on ? "telemetry.granted" : "telemetry.revoked",
      actorId: actor.id,
      payload: { agent: target.username },
    });
  return ok({ username: target.username, on });
}
@@ -806,3 +806,10 @@
function tick(): void {
    }
  }
}
/** The root process of every labelled cell being watched, for grouping the process table by what launched it (`system/view.ts`). */
export function cellRoots(): { label: string; root: number }[] {
  const out: { label: string; root: number }[] = [];
  for (const e of watched) if (e.label !== undefined) out.push({ label: e.label, root: e.root });
  return out;
}
@@ -0,0 +1,16 @@
// The `telemetry:read` grant (#1789): which named agent may read /flow,
// /system and the boards' sources, who gave it, and every read it made.
export default `
  CREATE TABLE telemetry_grant (
    user_id    TEXT PRIMARY KEY REFERENCES user(id) ON DELETE CASCADE,
    granted_by TEXT NOT NULL REFERENCES user(id),
    granted_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
  );
  CREATE TABLE telemetry_read (
    id      INTEGER PRIMARY KEY AUTOINCREMENT,
    user_id TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE,
    what    TEXT NOT NULL,
    at      TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
  );
  CREATE INDEX telemetry_read_at ON telemetry_read(at);
  `;
@@ -64,6 +64,7 @@
export const SYSTEM_NAMES: readonly string[] = [
  "big",
  "board",
  "boards",
  "contribute",
  "events",
  "explore",
  "family",
@@ -0,0 +1,50 @@
/**
 * The `telemetry:read` grant: an agent the owner named may read the forge's
 * flow, system and board sources (sealed values and private contents are
 * cut out where they are built, not here), and every read it makes is kept.
 * Pure data, no authz — `actions/telemetry.ts` decides who may grant.
 */
import type { Database } from "bun:sqlite";
export type ReadRow = { username: string; what: string; at: string };
export const READS_KEPT = 5_000;
export function hasGrant(db: Database, userId: string): boolean {
  return db.query("SELECT 1 FROM telemetry_grant WHERE user_id = ?1").get(userId) !== null;
}
export function grant(db: Database, userId: string, by: string): void {
  db.query("INSERT OR IGNORE INTO telemetry_grant (user_id, granted_by) VALUES (?1, ?2)").run(userId, by);
}
export function revoke(db: Database, userId: string): void {
  db.query("DELETE FROM telemetry_grant WHERE user_id = ?1").run(userId);
}
/** Agents the owner could grant to: every agent account. */
export function grantable(db: Database): { id: string; username: string; granted: boolean }[] {
  return db
    .query<{ id: string; username: string; granted: number }, []>(
      `SELECT u.id, u.username, EXISTS(SELECT 1 FROM telemetry_grant g WHERE g.user_id = u.id) AS granted
         FROM user u WHERE u.is_agent = 1 ORDER BY u.username`,
    )
    .all()
    .map((r) => ({ id: r.id, username: r.username, granted: r.granted === 1 }));
}
export function logRead(db: Database, userId: string, what: string): void {
  db.query("INSERT INTO telemetry_read (user_id, what) VALUES (?1, ?2)").run(userId, what.slice(0, 64));
  db.query(
    "DELETE FROM telemetry_read WHERE id <= (SELECT MAX(id) FROM telemetry_read) - ?1",
  ).run(READS_KEPT);
}
export function recentReads(db: Database, limit = 30): ReadRow[] {
  return db
    .query<ReadRow, [number]>(
      `SELECT u.username AS username, r.what AS what, r.at AS at
         FROM telemetry_read r JOIN user u ON u.id = r.user_id ORDER BY r.id DESC LIMIT ?1`,
    )
    .all(limit);
}
@@ -15,22 +15,22 @@
export interface ConflictedPull {
  readonly since: string;
}
/** Oldest first. */
export function conflictedPulls(db: Database): ConflictedPull[] {
/** Oldest first; `publicOnly` leaves out private repositories, for a reader who must not learn their names. */
export function conflictedPulls(db: Database, publicOnly = false): ConflictedPull[] {
  return db
    .query<ConflictedPull, []>(
    .query<ConflictedPull, [number]>(
      `SELECT o.username || '/' || r.name AS repo, i.number AS number,
              MIN(u.created_at) AS since
         FROM run u JOIN issue i ON i.id = u.issue_id
         JOIN pull p ON p.issue_id = i.id JOIN repo r ON r.id = i.repo_id JOIN user o ON o.id = r.owner_id
        WHERE u.kind = 'agent' AND u.reason = 'conflict' AND i.state = 'open'
          AND p.merged_at IS NULL
          AND p.merged_at IS NULL AND (?1 = 0 OR r.visibility = 'public')
          AND (SELECT state FROM run n WHERE n.issue_id = i.id AND n.kind = 'agent'
                  AND n.reason = 'conflict' ORDER BY n.created_at DESC, n.id DESC LIMIT 1)
              IN ('queued','running','failed')
        GROUP BY i.id ORDER BY since`,
    )
    .all();
    .all(publicOnly ? 1 : 0);
}
/** One sentence for /flow, or null when none is conflicted. */
@@ -58,6 +58,8 @@
import { reissueDoor, spawnDoor } from "../spawn/door.ts";
import { listSecrets, putSecret, removeSecret } from "../actions/secrets.ts";
import { proposeUpstream } from "../actions/upstream.ts";
import { relationOf, takeUpdates } from "../actions/forks.ts";
import { noteRead, telemetryReader, type Reader } from "../actions/telemetry.ts";
import { flowFor, historyFor, sourcesOut, systemFor, welcome } from "../system/telemetry.ts";
import { convergeFork, convergeState } from "../crew/converge.ts";
import { markReaders, mayDirectCrew } from "../crew/direct.ts";
import {
@@ -1325,6 +1327,26 @@
export function apiRoutes(router: Router<Handler>): void {
      : forbidden();
  };
  // Open read hooks (#1789): the owner, or an agent holding `telemetry:read`.
  // Anyone else is refused; every agent read is logged.
  const telemetryRead =
    (what: string, out: (ctx: Ctx, reader: Reader) => unknown) =>
    (ctx: Ctx): Response => {
      if (!ctx.auth.user) return unauthorized();
      const denied = requireScope(ctx, "ro");
      if (denied) return denied;
      const reader = telemetryReader(ctx.app, ctx.auth.user);
      if (!reader) return forbidden();
      noteRead(ctx.app, ctx.auth.user, reader, what);
      return json(out(ctx, reader));
    };
  router.add("GET", "/api/v1/telemetry/system", telemetryRead("system", (c, r) => systemFor(c.app, r)));
  router.add("GET", "/api/v1/telemetry/flow", telemetryRead("flow", (c, r) => flowFor(c.app, r)));
  router.add("GET", "/api/v1/telemetry/sources", telemetryRead("sources", () => ({ sources: sourcesOut() })));
  router.add("GET", "/api/v1/telemetry/history", telemetryRead("history", (c) => ({ points: historyFor(c.app) })));
  // The funnel: what any agent that arrives should know. Open to all.
  router.add("GET", "/api/v1/contribute", (ctx) => json(welcome(ctx.app)));
  router.add("GET", "/api/v1/boards/sources", (ctx) => {
    const denied = boardsAdmin(ctx);
    if (denied) return denied;
@@ -21,10 +21,6 @@
import { voteVariant } from "../actions/variants.ts";
import { mayView, mayViewId, sealedScope } from "../core/sealed.ts";
import { listAccess } from "../actions/access_log.ts";
import { changeCapacity, listCapacity } from "../actions/capacity.ts";
import { conflictedPulls, conflictedSays } from "../flow/conflicted.ts";
import { readPipeline, verdict } from "../flow/pipeline.ts";
import { readQueues } from "../flow/queue.ts";
import { readThroughput, stageOut, throughputSays } from "../flow/throughput.ts";
import { changeLimit, listLimits } from "../actions/limits.ts";
import { changeQuotas, readQuotas } from "../actions/quotas.ts";
import { QUOTA_KEYS } from "../settings/quotas.ts";
@@ -147,6 +143,8 @@
import {
} from "../actions/explore.ts";
import { frontInput, frontJson, setFront } from "../actions/front.ts";
import { readHealth } from "../actions/health.ts";
import { noteRead, telemetryReader } from "../actions/telemetry.ts";
import { flowFor, systemFor, welcome } from "../system/telemetry.ts";
import { running } from "../kernel/version.ts";
import { parentForgeFor } from "../core/parent_releases.ts";
import { COPIES_PER_DAY, makeItYours } from "../actions/make_it_yours.ts";
@@ -2077,28 +2075,35 @@
const TOOLS: readonly Tool[] = [
    inputSchema: { type: "object", properties: {} },
    writes: false,
    run(ctx, user) {
      if (!user.isAdmin)
        return bad("forbidden", "only an admin of this forge reads its pipeline");
      const now = new Date();
      const stages = readPipeline(ctx.app.db, now);
      const flow = readThroughput(ctx.app.db, stages.map((s) => s.key), now);
      const conflicted = conflictedPulls(ctx.app.db);
      return good({
        says: verdict(stages, now.getTime()),
        conflicted: {
          says: conflictedSays(conflicted, now.getTime()),
          pulls: conflicted,
        },
        stages,
        throughput: {
          says: throughputSays(flow),
          medianAskToLiveMs: flow.medianAskToLiveMs,
          stages: flow.stages.map(stageOut),
        },
        queue: readQueues(ctx.app.db, now),
      });
      const reader = telemetryReader(ctx.app, user);
      if (!reader)
        return bad("forbidden", "only an admin of this forge, or an agent granted telemetry:read, reads its pipeline");
      noteRead(ctx.app, user, reader, "flow");
      return good(flowFor(ctx.app, reader));
    },
  },
  {
    name: "system",
    description:
      "The machine the forge runs on, now: per-core CPU, temperatures, load, memory, disk per mount, network, and every process grouped by what launched it (which check, which app), each group with CPU cores, memory and age; and the test files running in more than one check at once (duplicates). For a forge admin, or an agent granted telemetry:read — whose view cuts out private repositories' checks and apps. Read-only; the same as /system and /api/v1/telemetry/system.",
    inputSchema: { type: "object", properties: {} },
    writes: false,
    run(ctx, user) {
      const reader = telemetryReader(ctx.app, user);
      if (!reader)
        return bad("forbidden", "only an admin of this forge, or an agent granted telemetry:read, reads its machine");
      noteRead(ctx.app, user, reader, "system");
      return good(systemFor(ctx.app, reader));
    },
  },
  {
    name: "contribute",
    description:
      "For any agent that arrives: what this forge is, where its bottleneck is right now, the open issues in public repositories labelled “help wanted” that welcome outside work, and how to propose (fork, pull, the gate it must pass). Open to every caller.",
    inputSchema: { type: "object", properties: {} },
    writes: false,
    run: (ctx) => good(welcome(ctx.app)),
  },
  {
    name: "limits",
    description:
@@ -11,11 +11,13 @@
import { unsealReleased } from "../actions/sealed.ts";
import { accessPage } from "../web/pages/access.ts";
import { capacityPage, capacitySet } from "../web/pages/capacity.ts";
import { flowPage } from "../web/pages/flow.ts";
import { systemPage } from "../web/pages/system.ts";
import { telemetryPage, telemetrySet } from "../web/pages/telemetry.ts";
import { contributePage } from "../web/pages/contribute.ts";
import { flagsPage, flagsSet } from "../web/pages/flags.ts";
import { domainsPage } from "../web/pages/domains.ts";
import { resiliencePage } from "../web/pages/resilience.ts";
import { limitsPage, limitsSet, quotasSet } from "../web/pages/admin-limits.ts";
import { systemPage } from "../web/pages/system.ts";
import { boardsPage } from "../web/pages/boards.ts";
import { boardNew, boardPin, boardPost } from "../web/pages/boards-edit.ts";
import { boardLive, boardShow, boardsList } from "../web/pages/boards-view.ts";
@@ -667,6 +669,10 @@
export function buildRouter(): Router<Handler> {
  router.add("GET", "/map", globalMapPage);
  // The pipeline's stages and its bottleneck, for a forge admin (#1554); literal, above /:owner.
  router.add("GET", "/flow", flowPage);
  router.add("GET", "/system", systemPage);
  router.add("GET", "/contribute", contributePage);
  router.add("GET", "/settings/telemetry", telemetryPage);
  router.add("POST", "/settings/telemetry", telemetrySet);
  // Each THREATS.md protection against the last gate; literal, above /:owner.
  router.add("GET", "/resilience", resiliencePage);
  // A selection's spend and runs over time; literal, above /:owner.
@@ -745,7 +751,6 @@
export function buildRouter(): Router<Handler> {
  router.add("GET", "/settings/resilience", domainsPage);
  router.add("GET", "/settings/capacity", capacityPage);
  router.add("POST", "/settings/capacity", capacitySet);
  router.add("GET", "/system", systemPage);
  router.add("GET", "/boards", boardsList);
  router.add("GET", "/boards/data", boardsPage);
  router.add("POST", "/boards/new", boardNew);
@@ -0,0 +1,14 @@
/** Sizes and spans as /system and the terminal both print them. */
export const bytes = (n: number): string => {
  const units = ["B", "KiB", "MiB", "GiB", "TiB"];
  let v = n;
  let i = 0;
  while (v >= 1024 && i < units.length - 1) {
    v /= 1024;
    i++;
  }
  return `${v >= 10 || i === 0 ? Math.round(v) : v.toFixed(1)} ${units[i]}`;
};
export const span = (s: number): string =>
  s < 90 ? `${s}s` : s < 5400 ? `${Math.round(s / 60)}m` : s < 172_800 ? `${Math.round(s / 3600)}h` : `${Math.round(s / 86_400)}d`;
@@ -0,0 +1,68 @@
/**
 * The latest reading of the machine, shared by every viewer. There is no
 * timer: a reading is taken when someone asks and the last one is more
 * than a second old, and the rates are over the two most recent. A viewer
 * that polls every 2 s therefore *is* the 2 s sampler, and costs nothing
 * when nobody looks. The node's own history is `boards/sampler.ts`'s.
 */
import type { App } from "../app.ts";
import { cellRoots } from "../apps/contain.ts";
import { HOST, readRaw, type Paths, type Raw } from "./proc.ts";
import { buildSystem, forAgent, type SystemView } from "./view.ts";
const FRESH_MS = 1_000;
export type Live = {
  read(now?: number): SystemView;
};
      
        sentinelcrew
        28d ago
        outdated
      
      history() and the 150-point ring behind it are never read in src/; the API's history comes from machine_sample. That makes this dead code. Remove it, or use it.
    
export function createLive(options: { paths?: Paths; roots?: typeof cellRoots; self?: number } = {}): Live {
  const paths = options.paths ?? HOST;
  const roots = options.roots ?? cellRoots;
  const self = options.self ?? process.pid;
  let prev: Raw | undefined;
  let last: Raw | undefined;
  let view: SystemView | undefined;
  return {
    read(now = Date.now()) {
      if (view !== undefined && last !== undefined && now - last.at < FRESH_MS) return view;
      const raw = readRaw(paths, now);
      // A first reading has no rate: its rates are null until a second reading is taken.
      prev = last;
      last = raw;
      view = buildSystem(prev, last, roots(), self);
      return view;
    },
  };
}
let shared = createLive();
export const live = (): Live => shared;
/** Swap the shared reading — a test hands it a /proc it wrote. */
export const useLive = (next: Live): void => {
  shared = next;
};
/** Whether the repository behind a cell's label is public. An unknown label is not. */
export function publicLabel(app: App, label: string): boolean {
  const check = /^check:([\w-]{1,64})$/.exec(label);
  const cell = /^app:([\w.-]{1,64})\//.exec(label);
  const row = check
    ? app.db
        .query<{ v: string }, [string]>(
          "SELECT repo.visibility AS v FROM run JOIN repo ON repo.id = run.repo_id WHERE run.id = ?1",
        )
        .get(check[1]!)
    : cell
      ? app.db
          .query<{ v: string }, [string]>(
            "SELECT repo.visibility AS v FROM app JOIN repo ON repo.id = app.repo_id WHERE app.slug = ?1",
          )
          .get(cell[1]!)
      : undefined;
  return row?.v === "public";
}
/** The view a named agent may read. */
export const agentView = (app: App, view: SystemView): SystemView =>
  forAgent(view, (label) => publicLabel(app, label));
@@ -0,0 +1,217 @@
/**
 * What the machine is doing right now, read from /proc and /sys and nothing
 * else: per-core ticks, temperatures (hwmon), memory, load, disk per mount,
 * network, and every process with its parent, CPU ticks, resident memory
 * and start. Plain data out; a file that is missing or unreadable leaves its
 * series empty, never a guess. Paths are a parameter so a test can hand it a
 * directory it wrote.
 */
import { readdirSync, readFileSync, statfsSync } from "node:fs";
import { join } from "node:path";
export type Paths = { proc: string; sys: string };
export const HOST: Paths = { proc: "/proc", sys: "/sys" };
const HZ = 100;
const PAGE = 4096;
const PROCESSES_MAX = 20_000;
const MOUNTS_MAX = 24;
export type CoreTicks = { busy: number; total: number };
export type Temp = { chip: string; label: string; celsius: number };
export type Memory = { total: number; available: number; swapTotal: number; swapFree: number };
export type Disk = { mount: string; fs: string; total: number; used: number };
export type Nic = { name: string; rx: number; tx: number };
export type Proc = {
  pid: number;
  ppid: number;
  comm: string;
  ticks: number;
  rss: number;
  /** Seconds since it started. */
  age: number;
  /** The `*.test.ts` files named in its arguments, nothing else of its command line. */
  tests: string[];
};
export type Raw = {
  at: number;
  cores: CoreTicks[];
  temps: Temp[];
  load: [number, number, number] | null;
  memory: Memory | null;
  disks: Disk[];
  net: Nic[];
  procs: Proc[];
};
function read(path: string): string | null {
  try {
    return readFileSync(path, "utf8");
  } catch {
    return null;
  }
}
const num = (s: string | undefined): number => {
  const n = Number(s);
  return Number.isFinite(n) && n >= 0 ? n : 0;
};
/** One entry per `cpuN` line of /proc/stat: busy and total ticks. */
export function parseCores(text: string | null): CoreTicks[] {
  const out: CoreTicks[] = [];
  for (const m of (text ?? "").matchAll(/^cpu(\d+) +(.*)$/gm)) {
    const f = m[2]!.trim().split(/\s+/).map(num);
    const total = f.slice(0, 8).reduce((a, b) => a + b, 0);
    const idle = (f[3] ?? 0) + (f[4] ?? 0);
    out[Number(m[1])] = { busy: total - idle, total };
  }
  return out.filter((c) => c !== undefined);
}
export function parseMemory(text: string | null): Memory | null {
  if (text === null) return null;
  const kb = (k: string): number => {
    const m = new RegExp(`^${k}:\\s+(\\d+) kB$`, "m").exec(text);
    return m ? Number(m[1]) * 1024 : 0;
  };
  const total = kb("MemTotal");
  return total === 0
    ? null
    : { total, available: kb("MemAvailable"), swapTotal: kb("SwapTotal"), swapFree: kb("SwapFree") };
}
export function parseLoad(text: string | null): [number, number, number] | null {
  const f = text?.trim().split(/\s+/).slice(0, 3).map(Number);
  return f && f.length === 3 && f.every(Number.isFinite) ? [f[0]!, f[1]!, f[2]!] : null;
}
export function parseNet(text: string | null): Nic[] {
  const out: Nic[] = [];
  for (const line of (text ?? "").split("\n").slice(2)) {
    const m = /^\s*([\w.@-]+):\s*(.*)$/.exec(line);
    if (!m || m[1] === "lo") continue;
    const f = m[2]!.trim().split(/\s+/);
    out.push({ name: m[1]!, rx: num(f[0]), tx: num(f[8]) });
  }
  return out;
}
/** The `stat` line of one process; null when it is not one. */
export function parseProcStat(text: string): { comm: string; ppid: number; ticks: number; rss: number; start: number } | null {
  const open = text.indexOf("(");
  const close = text.lastIndexOf(")");
  if (open < 0 || close < open) return null;
  const f = text.slice(close + 2).split(" ");
  if (f.length < 22) return null;
  return {
    comm: text.slice(open + 1, close).slice(0, 32),
    ppid: num(f[1]),
    ticks: num(f[11]) + num(f[12]),
    rss: num(f[21]) * PAGE,
    start: num(f[19]) / HZ,
  };
}
const TEST_FILE = /^(?:\.\/)?[\w@.+/-]{1,200}\.test\.ts$/;
/** The test files an argument vector names: only arguments shaped like one, so nothing else of a command line is kept. */
export function testFiles(cmdline: string | null): string[] {
  if (!cmdline) return [];
  const seen = new Set<string>();
  for (const arg of cmdline.split("\0")) if (TEST_FILE.test(arg)) seen.add(arg.replace(/^\.\//, ""));
  return [...seen].slice(0, 16);
}
export function readTemps(sys: string): Temp[] {
  const out: Temp[] = [];
  const base = join(sys, "class/hwmon");
  let chips: string[] = [];
  try {
    chips = readdirSync(base).filter((n) => /^hwmon\d+$/.test(n));
  } catch {
    return out;
  }
  for (const chip of chips) {
    const dir = join(base, chip);
    const name = read(join(dir, "name"))?.trim() ?? chip;
    let files: string[] = [];
    try {
      files = readdirSync(dir).filter((n) => /^temp\d+_input$/.test(n));
    } catch {
      continue;
    }
    for (const f of files) {
      const milli = Number(read(join(dir, f))?.trim());
      if (!Number.isFinite(milli)) continue;
      const label = read(join(dir, f.replace("_input", "_label")))?.trim() ?? f.replace("_input", "");
      out.push({ chip: name.slice(0, 32), label: label.slice(0, 48), celsius: milli / 1000 });
    }
  }
  return out;
}
const REAL_FS = new Set(["ext4", "xfs", "btrfs", "zfs", "f2fs", "vfat", "overlay", "nfs", "nfs4"]);
export function readDisks(proc: string): Disk[] {
  const out: Disk[] = [];
  const seen = new Set<string>();
  for (const line of (read(join(proc, "mounts")) ?? "").split("\n")) {
    const [dev, mount, fs] = line.split(" ");
    if (!dev || !mount || !fs || !REAL_FS.has(fs) || seen.has(dev + fs)) continue;
    seen.add(dev + fs);
    try {
      const s = statfsSync(mount.replace(/\\040/g, " "));
      const total = s.blocks * s.bsize;
      if (total > 0) out.push({ mount: mount.replace(/\\040/g, " "), fs, total, used: total - s.bfree * s.bsize });
    } catch {
      // unreadable mount: absent, not guessed
    }
    if (out.length >= MOUNTS_MAX) break;
  }
  return out;
}
export function readProcs(proc: string): Proc[] {
  let names: string[] = [];
  try {
    names = readdirSync(proc).filter((n) => /^\d+$/.test(n));
  } catch {
    return [];
  }
  const up = num(read(join(proc, "uptime"))?.split(" ")[0]);
  const out: Proc[] = [];
  for (const name of names.slice(0, PROCESSES_MAX)) {
    const text = read(join(proc, name, "stat"));
    const s = text === null ? null : parseProcStat(text);
    if (!s) continue;
    const isBun = /^(bun|node)/.test(s.comm);
    out.push({
      pid: Number(name),
      ppid: s.ppid,
      comm: s.comm,
      ticks: s.ticks,
      rss: s.rss,
      age: Math.max(0, up - s.start),
      // Only a runner of tests can be running a test file; skip the cmdline read for the rest.
      tests: isBun ? testFiles(read(join(proc, name, "cmdline"))) : [],
    });
  }
  return out;
}
export function readRaw(paths: Paths, at: number): Raw {
  return {
    at,
    cores: parseCores(read(join(paths.proc, "stat"))),
    temps: readTemps(paths.sys),
    load: parseLoad(read(join(paths.proc, "loadavg"))),
    memory: parseMemory(read(join(paths.proc, "meminfo"))),
    disks: readDisks(paths.proc),
    net: parseNet(read(join(paths.proc, "net/dev"))),
    procs: readProcs(paths.proc),
  };
}
export const TICKS_PER_SECOND = HZ;
@@ -0,0 +1,119 @@
/**
 * What the open read hooks hand out (#1789), built once so the page, the API
 * and the MCP tools say the same thing: the pipeline (flow), the machine
 * (system), the boards' sources (names and columns, never rows) and the
 * node's history. Everything here is counts, rates and names of public
 * things — no sealed value, no private repository's content, no person.
 */
import type { App } from "../app.ts";
import { SOURCES } from "../boards/sources.ts";
import { conflictedPulls, conflictedSays } from "../flow/conflicted.ts";
import { readPipeline, verdict } from "../flow/pipeline.ts";
import { readQueues } from "../flow/queue.ts";
import { readThroughput, stageOut, throughputSays } from "../flow/throughput.ts";
import type { Reader } from "../actions/telemetry.ts";
import { agentView, live } from "./live.ts";
import type { SystemView } from "./view.ts";
export function systemFor(app: App, reader: Reader): SystemView {
  const view = live().read();
  return reader.kind === "agent" ? agentView(app, view) : view;
}
export function flowFor(app: App, reader: Reader, now = new Date()) {
  const stages = readPipeline(app.db, now);
  const flow = readThroughput(app.db, stages.map((s) => s.key), now);
  const dup = systemFor(app, reader).duplicates;
  const conflicted = conflictedPulls(app.db, reader.kind === "agent");
  return {
    says: verdict(stages, now.getTime()),
    conflicted: { says: conflictedSays(conflicted, now.getTime()), pulls: conflicted },
    stages,
    throughput: {
      says: throughputSays(flow),
      medianAskToLiveMs: flow.medianAskToLiveMs,
      stages: flow.stages.map(stageOut),
    },
    // A private repository's name is not an agent's to read, so its queue line is cut.
    queue: queuesFor(app, reader, now),
    duplicateWork: dup,
  };
}
/** The merge queue as `reader` may see it: an agent's has private repositories cut out. */
export function queuesFor(app: App, reader: Reader, now = new Date()) {
  return readQueues(app.db, now).filter((q) => reader.kind === "owner" || publicRepo(app, q.repo));
}
function publicRepo(app: App, full: string): boolean {
  const [owner, name] = full.split("/");
  return (
    app.db
      .query<{ v: string }, [string, string]>(
        "SELECT r.visibility AS v FROM repo r JOIN user u ON u.id = r.owner_id WHERE u.username = ?1 AND r.name = ?2",
      )
      .get(owner ?? "", name ?? "")?.v === "public"
  );
}
export function sourcesOut() {
  return Object.entries(SOURCES).map(([name, s]) => ({
    name,
    time: s.time,
    columns: s.columns,
    ...(s.docs ? { docs: s.docs } : {}),
  }));
}
/** The node's 15-s points for the last hour: the `machine` source's `node` and `forge` targets, nothing per-cell. */
export function historyFor(app: App) {
  return app.db
    .query<
      { target: string; at: string; cpu_cores: number | null; memory_bytes: number | null; load: number | null },
      []
    >(
      `SELECT target, at, cpu_cores, memory_bytes, load FROM machine_sample
        WHERE step = 15 AND target IN ('node','forge')
          AND at >= strftime('%Y-%m-%dT%H:%M:%fZ','now','-1 hour') ORDER BY at, target`,
    )
    .all()
    .map((r) => ({ target: r.target, at: r.at, cpuCores: r.cpu_cores, memoryBytes: r.memory_bytes, load: r.load }));
}
export const WELCOME_LABEL = "help wanted";
/** What an agent that arrives should know: what this is, where it hurts, what welcomes it, how to propose. */
export function welcome(app: App, now = new Date()) {
  const stages = readPipeline(app.db, now);
  const issues = app.db
      
        sentinelcrew
        28d ago
        outdated
      
      High: sealed issues are not excluded. A sealed security report on a public repo that carries "help wanted" would be listed to unauthenticated callers at /contribute, /api/v1/contribute and in the MCP contribute tool. Add AND i.sealed = 0 here, and add a test that would fail without it.
    
    .query<{ owner: string; name: string; number: number; title: string }, [string]>(
      `SELECT u.username AS owner, r.name AS name, i.number AS number, i.title AS title
         FROM issue i JOIN repo r ON r.id = i.repo_id JOIN user u ON u.id = r.owner_id
         JOIN issue_label il ON il.issue_id = i.id JOIN label l ON l.id = il.label_id
        WHERE i.kind = 'issue' AND i.state = 'open' AND r.visibility = 'public'
          AND i.sealed = 0
          AND l.name = ?1 COLLATE NOCASE
        ORDER BY i.updated_at DESC LIMIT 20`,
    )
    .all(WELCOME_LABEL);
  return {
    forge:
      "A forge that runs what it hosts: git, issues, pulls, a crew of agents and the apps they build, in the open. Every pull gets a preview; every push is judged by the same check.",
    bottleneck: { says: verdict(stages, now.getTime()), see: "/flow (the owner's crew and any agent granted telemetry:read)" },
    welcomeLabel: WELCOME_LABEL,
    issues: issues.map((i) => ({
      repo: `${i.owner}/${i.name}`,
      number: i.number,
      title: i.title,
      path: `/${i.owner}/${i.name}/issues/${i.number}`,
    })),
    propose: [
      "Fork the repository (POST /api/v1/repos/{owner}/{name}/forks, or the Fork button) and push a branch to your fork.",
      "Open a pull against the default branch. Your pull runs in the same isolated cell as the crew's: no network beyond what forge.json declares, none of the forge's data or secrets.",
      "The crew's reviewers read it. It lands only through the gate everything passes: `bun x tsc --noEmit` and `bun test` green, a test for every behaviour you add, zero new dependencies without a reason.",
      "Anyone may propose. The bar decides what merges. A person lands it; an agent never does.",
    ],
    telemetry:
      "Ask the owner for the telemetry:read grant to read /flow and /system from the API and MCP (tools flow, system), with private repositories and sealed values cut out. Every read is logged.",
  };
}
@@ -0,0 +1,178 @@
/**
 * The machine as one plain object (`/system`, the `system` MCP tool and
 * `/api/v1/telemetry/system`): two raw readings in, rates and groups out.
 * Every process belongs to the cell that launched it (`check:<run>` or
 * `app:<slug>/<env>`), else to the forge itself, else to the host. The same
 * test file under two checks at once is duplicate work, and is named.
 * Command lines are never kept — only `*.test.ts` arguments.
 */
import type { Proc, Raw } from "./proc.ts";
import { TICKS_PER_SECOND } from "./proc.ts";
export type Group = {
  label: string;
  kind: "check" | "app" | "forge" | "host";
  procs: number;
  cpuCores: number | null;
  rssBytes: number;
  oldestSeconds: number;
  top: { pid: number; comm: string; cpuCores: number | null; rssBytes: number; ageSeconds: number }[];
  tests: string[];
};
export type Duplicate = { file: string; checks: string[] };
export type SystemView = {
  at: string;
  /** Seconds between the two readings the rates are over; 0 when there was only one. */
  seconds: number;
  cpu: { busyPct: number | null; cores: (number | null)[] };
  temps: { chip: string; label: string; celsius: number }[];
  hottestC: number | null;
  load: [number, number, number] | null;
  memory: { totalBytes: number; usedBytes: number; swapUsedBytes: number } | null;
  disks: { mount: string; fs: string; totalBytes: number; usedBytes: number }[];
  net: { name: string; rxBytesPerSecond: number | null; txBytesPerSecond: number | null }[];
  processes: number;
  groups: Group[];
  duplicates: Duplicate[];
};
export type Roots = readonly { label: string; root: number }[];
const kindOf = (label: string): Group["kind"] =>
  label.startsWith("check:") ? "check" : label.startsWith("app:") ? "app" : label === "forge" ? "forge" : "host";
/** Which group each process is in: the nearest cell root above it, the forge, or the host. */
function groupOf(procs: readonly Proc[], roots: Roots, self: number): Map<number, string> {
  const by = new Map(procs.map((p) => [p.pid, p]));
  const rootLabel = new Map(roots.map((r) => [r.root, r.label]));
  const memo = new Map<number, string>();
  const find = (pid: number): string => {
    const hit = memo.get(pid);
    if (hit !== undefined) return hit;
    let at = pid;
    let found = "host";
    for (let i = 0; i < 64; i++) {
      const label = rootLabel.get(at);
      if (label !== undefined) {
        found = label;
        break;
      }
      if (at === self) {
        found = "forge";
        break;
      }
      const up = by.get(at)?.ppid;
      if (up === undefined || up <= 0) break;
      at = up;
    }
    memo.set(pid, found);
    return found;
  };
  for (const p of procs) find(p.pid);
  return memo;
}
const rate = (a: number | undefined, b: number | undefined, s: number): number | null =>
  a === undefined || b === undefined || s <= 0 || b < a ? null : (b - a) / s;
export function buildSystem(prev: Raw | undefined, next: Raw, roots: Roots, self: number): SystemView {
  const seconds = prev === undefined ? 0 : Math.max(0, (next.at - prev.at) / 1000);
  const cores = next.cores.map((c, i) => {
    const p = prev?.cores[i];
    if (!p || seconds <= 0 || c.total <= p.total) return null;
    return Math.round(((c.busy - p.busy) / (c.total - p.total)) * 1000) / 10;
  });
  const known = cores.filter((c): c is number => c !== null);
  const before = new Map((prev?.procs ?? []).map((p) => [p.pid, p]));
  const where = groupOf(next.procs, roots, self);
  const groups = new Map<string, Group>();
  const files = new Map<string, Set<string>>();
  for (const p of next.procs) {
    const label = where.get(p.pid) ?? "host";
    const g =
      groups.get(label) ??
      { label, kind: kindOf(label), procs: 0, cpuCores: null, rssBytes: 0, oldestSeconds: 0, top: [], tests: [] };
    const old = before.get(p.pid);
    const cpu = old && old.age <= p.age ? rate(old.ticks, p.ticks, seconds * TICKS_PER_SECOND) : null;
    g.procs++;
    g.rssBytes += p.rss;
    g.oldestSeconds = Math.max(g.oldestSeconds, Math.round(p.age));
    if (cpu !== null) g.cpuCores = (g.cpuCores ?? 0) + cpu;
    g.top.push({ pid: p.pid, comm: p.comm, cpuCores: cpu, rssBytes: p.rss, ageSeconds: Math.round(p.age) });
    for (const f of p.tests) {
      if (!g.tests.includes(f)) g.tests.push(f);
      if (g.kind === "check") (files.get(f) ?? files.set(f, new Set()).get(f)!).add(label);
    }
    groups.set(label, g);
  }
  for (const g of groups.values()) {
    g.top = g.top
      .sort((a, b) => (b.cpuCores ?? 0) - (a.cpuCores ?? 0) || b.rssBytes - a.rssBytes)
      .slice(0, 5);
    if (g.cpuCores !== null) g.cpuCores = Math.round(g.cpuCores * 100) / 100;
  }
  const mem = next.memory;
  return {
    at: new Date(next.at).toISOString(),
    seconds,
    cpu: {
      busyPct: known.length === 0 ? null : Math.round((known.reduce((a, b) => a + b, 0) / known.length) * 10) / 10,
      cores,
    },
    temps: next.temps,
    hottestC: next.temps.length === 0 ? null : Math.max(...next.temps.map((t) => t.celsius)),
    load: next.load,
    memory: mem && {
      totalBytes: mem.total,
      usedBytes: mem.total - mem.available,
      swapUsedBytes: mem.swapTotal - mem.swapFree,
    },
    disks: next.disks.map((d) => ({ mount: d.mount, fs: d.fs, totalBytes: d.total, usedBytes: d.used })),
    net: next.net.map((n) => {
      const o = prev?.net.find((x) => x.name === n.name);
      return {
        name: n.name,
        rxBytesPerSecond: rate(o?.rx, n.rx, seconds),
        txBytesPerSecond: rate(o?.tx, n.tx, seconds),
      };
    }),
    processes: next.procs.length,
    groups: [...groups.values()].sort((a, b) => (b.cpuCores ?? 0) - (a.cpuCores ?? 0) || b.rssBytes - a.rssBytes),
    duplicates: [...files]
      .filter(([, labels]) => labels.size > 1)
      .map(([file, labels]) => ({ file, checks: [...labels].sort() }))
      .sort((a, b) => b.checks.length - a.checks.length || (a.file < b.file ? -1 : 1)),
  };
}
/**
 * What a named agent may read: a private repository's checks and apps keep
 * their place in the totals but lose their name, their test files and their
 * processes. `visible` says whether a label's repository is public.
 */
export function forAgent(view: SystemView, visible: (label: string) => boolean): SystemView {
  const hide = new Map<string, string>();
  const n = { check: 0, app: 0 };
  const name = (label: string): string => {
    if (visible(label) || kindOf(label) === "forge" || kindOf(label) === "host") return label;
    const kind = kindOf(label) as "check" | "app";
    return hide.get(label) ?? hide.set(label, `${kind}:private-${++n[kind]}`).get(label)!;
  };
  return {
    ...view,
    groups: view.groups.map((g) =>
      // The forge and the host hold whatever no labelled cell claims (a crew run in a private clone,
      // an unwatched sandbox): their counts stay, their processes and test files never leave.
      g.kind === "forge" || g.kind === "host"
        ? { ...g, top: [], tests: [] }
        : visible(g.label)
          ? g
          : { ...g, label: name(g.label), top: [], tests: [] },
    ),
    duplicates: view.duplicates
      .map((d) => ({ file: d.checks.every(visible) ? d.file : "(private)", checks: d.checks.map(name).sort() }))
      .sort((a, b) => b.checks.length - a.checks.length),
  };
}
@@ -24,13 +24,13 @@
import {
  ORIGIN_MARK,
  PULL_MARK,
  errorText,
  pickerScreen,
  promptScreen,
  openOnWeb,
  runAsync,
} from "./screens/common.ts";
import { canSeeMemory } from "../boards/memory.ts";
import { boardsScreen } from "./screens/boards.ts";
import { systemScreen } from "./screens/system.ts";
import { askedScreen } from "./screens/asked.ts";
import { deciderScreen } from "./screens/decider.ts";
import { familyScreen } from "./screens/family.ts";
@@ -45,6 +45,11 @@
import { flagsScreen } from "./screens/flags.ts";
import { domainsScreen } from "./screens/domains.ts";
import { resilienceLines, resilienceScreen } from "./screens/resilience.ts";
import { flowLines, flowScreen } from "./screens/flow.ts";
import { memoryScreen, systemLines, systemScreen } from "./screens/system.ts";
import { grantable, READS_KEPT, recentReads } from "../core/telemetry.ts";
import { noteRead, setTelemetryGrant, telemetryReader } from "../actions/telemetry.ts";
import { queuesFor, systemFor } from "../system/telemetry.ts";
import { live as liveMachine } from "../system/live.ts";
import { releasesScreen } from "./screens/releases.ts";
import { mayRead } from "../release/gate.ts";
import { stalledScreen } from "./screens/stalled.ts";
@@ -235,19 +240,70 @@
export function forgeCommands(session: Session): (ctx: Ctx) => Command[] {
    // The forge's RSS beside its JS heap, as /system gates it (#2151).
    if (canSeeMemory(session.user))
      commands.push({
      
        sentinelcrew
        28d ago
        outdated
      
      The terminal's Flow door has the same gap: isAdmin alone lets an admin agent read flow and the unfiltered live().read().duplicates without the grant. Gate it the way the MCP tool now does.
    
        id: "system",
        id: "system-memory",
        title: "System memory",
        hint: "RSS beside the JS heap, hourly for 24 h",
        run: () => ctx.push(systemScreen(session, ctx)),
        run: () => ctx.push(memoryScreen(session, ctx)),
      });
    // The pipeline's bottleneck and throughput, as /flow says them: a site admin's (#1554, #1786).
    if (session.user?.isAdmin === true)
    const flowReader = telemetryReader(session.app, session.user);
    if (flowReader)
      commands.push({
        id: "flow",
        title: "Flow",
        hint: "the pipeline's bottleneck and throughput",
        run: () => ctx.push(flowScreen(ctx, flowLines(session.db))),
        run: () => {
          if (session.user) noteRead(session.app, session.user, flowReader, "flow");
          ctx.push(flowScreen(ctx, flowLines(
              session.db,
              new Date(),
              systemFor(session.app, flowReader).duplicates,
              flowReader.kind === "agent" ? { queues: queuesFor(session.app, flowReader) } : undefined,
            )));
        },
      });
    // The machine, as /system says it, and which agents may read it: the owner's, a person (#1789).
    if (session.user?.isAdmin === true && session.user.kind !== "agent") {
      commands.push({
        id: "system",
        title: "System",
        hint: "the machine now: CPU, memory, disks, processes",
        run: () => ctx.push(systemScreen(ctx, systemLines(liveMachine().read()))),
      });
      commands.push({
        id: "telemetry",
        title: "Telemetry",
        hint: "which agents may read flow and system; enter flips the grant",
        run: () => {
          const actor = session.user;
          const agents = grantable(session.db);
          if (agents.length === 0) return ctx.toast("No agent accounts yet");
          const last = new Map<string, { n: number; what: string; at: string }>();
          for (const r of recentReads(session.db, READS_KEPT).reverse()) {
            last.set(r.username, { n: (last.get(r.username)?.n ?? 0) + 1, what: r.what, at: r.at });
          }
          const readsOf = (name: string): string => {
            const l = last.get(name);
            return l ? `${l.n} read${l.n === 1 ? "" : "s"}, last ${l.what} ${l.at}` : "no reads";
          };
          ctx.push(
            pickerScreen(ctx, blank("Telemetry"), {
              title: "Telemetry: telemetry:read",
              items: agents.map((a) => ({ id: a.username, label: a.username, hint: `${a.granted ? "granted" : "not granted"} · ${readsOf(a.username)}` })),
              onPick: ([name]) => {
                const was = agents.find((a) => a.username === name);
                if (!was) return;
                const done = setTelemetryGrant(session.app, actor, was.username, !was.granted);
                ctx.toast(
                  done.ok ? `${was.username}: telemetry:read ${done.value.on ? "granted" : "revoked"}` : "Could not change the grant",
                  done.ok ? "success" : "attn",
                );
              },
            }),
          );
        },
      });
    }
    // Each THREATS.md protection's standing, as /resilience says it: a site admin's.
    if (session.user?.isAdmin === true)
      commands.push({
@@ -17,16 +17,24 @@
import type { Ctx, Screen } from "../app/app.ts";
import { binding } from "../app/keys.ts";
import { pad, truncate, wrap } from "../term/width.ts";
import { dialog } from "../ui/widgets.ts";
import { live } from "../../system/live.ts";
import { duplicateLines } from "./system.ts";
const WIDTH = 64;
/** What the dialog says, line by line, wrapped to fit inside it. */
export function flowLines(db: Database, now = new Date()): string[] {
export function flowLines(
  db: Database,
  now = new Date(),
  dups = live().read().duplicates,
  /** What an agent reader may see: its queue lines and conflicted pulls come already cut to public. */
  agent?: { queues: ReturnType<typeof readQueues> },
): string[] {
  const stages = readPipeline(db, now);
  const flow = readThroughput(db, stages.map((s) => s.key), now);
  const inner = WIDTH - 6;
  const queues = readQueues(db, now);
  const conflicted = conflictedSays(conflictedPulls(db), now.getTime());
  const queues = agent?.queues ?? readQueues(db, now);
  const conflicted = conflictedSays(conflictedPulls(db, agent !== undefined), now.getTime());
  return [
    ...wrap(verdict(stages, now.getTime()), inner),
    "",
@@ -46,6 +54,8 @@
export function flowLines(db: Database, now = new Date()): string[] {
            `${pad(truncate(q.repo, 30), 30)} ${pad(String(q.queued), 6, "right")} ${pad(String(q.gating), 6, "right")} ${pad(String(q.landedHour), 9, "right")}`,
        )),
    ...(conflicted === null ? [] : ["", ...wrap(conflicted, inner)]),
    "",
    ...duplicateLines(dups, inner),
  ];
}
@@ -1,19 +1,79 @@
/**
 * `/system` in the terminal (#2151): the forge's RSS beside its JS heap, an
 * hour a row for the last 24 h, read through `memoryHours` like the page. The
 * gate is the page's (`canSeeMemory`): anyone but a forge admin who is a
 * person gets no rows, and the palette offers the door only to that person.
 * Read-only.
 * The System command's dialog, the owner's (#1789): the machine now, in the
 * lines of `/system` — CPU, load, heat, memory, disks, and the heaviest
 * groups of processes with the test files running in more than one check.
 * It reads `live().read()`, the same view the page and the API serve.
 * Read-only; Enter, Esc or q closes it.
 *
 * `memoryScreen` is `/system`'s other half (#2151): the forge's RSS beside
 * its JS heap, an hour a row for the last 24 h, read through `memoryHours`
 * like the page. The gate is the page's (`canSeeMemory`): anyone but a forge
 * admin who is a person gets no rows. Read-only.
 */
import { canSeeMemory, memoryHours } from "../../boards/memory.ts";
import type { Ctx, Screen } from "../app/app.ts";
import type { SystemView } from "../../system/view.ts";
import { canSeeMemory, memoryHours } from "../../boards/memory.ts";
import { binding } from "../app/keys.ts";
import type { Session } from "../session.ts";
import { bytes } from "../../system/format.ts";
import { style } from "../term/style.ts";
import { pad } from "../term/width.ts";
import { pad, wrap } from "../term/width.ts";
import { dialog } from "../ui/widgets.ts";
import { Scroll, drawLines, hitScroll } from "./common.ts";
const WIDTH = 72;
const GROUPS = 6;
const pct = (n: number | null): string => (n === null ? "—" : `${n.toFixed(1)}%`);
/** The duplicate-work sentence, wrapped: the one /flow and /system say. */
export function duplicateLines(dups: SystemView["duplicates"], inner: number): string[] {
  return dups.length === 0
    ? ["No test file is running in more than one check."]
    : wrap(
        `${dups.length} test file${dups.length === 1 ? " is" : "s are"} running in more than one check: ${dups
          .slice(0, 3)
          .map((d) => `${d.file} (${d.checks.join(", ")})`)
          .join("; ")}`,
        inner,
      );
}
export function systemLines(v: SystemView): string[] {
  const inner = WIDTH - 6;
  return [
    `CPU ${pct(v.cpu.busyPct)} over ${v.cpu.cores.length} cores · load ${v.load ? v.load.map((l) => l.toFixed(2)).join(" ") : "—"}`,
    `hottest ${v.hottestC === null ? "—" : `${v.hottestC.toFixed(0)}°C`} · memory ${v.memory ? `${bytes(v.memory.usedBytes)} of ${bytes(v.memory.totalBytes)}` : "—"} · ${v.processes} processes`,
    ...v.disks.map((d) => `${pad(d.mount, 20)} ${Math.round((d.usedBytes / Math.max(1, d.totalBytes)) * 100)}% of ${bytes(d.totalBytes)}`),
    "",
    ...v.groups.slice(0, GROUPS).map((g) => `${pad(g.label, 28)} ${pad(String(g.procs), 4, "right")} procs`),
    "",
    ...duplicateLines(v.duplicates, inner),
  ];
}
export function systemScreen(ctx: Ctx, lines: readonly string[]): Screen {
  return {
    title: "System",
    keys: [binding(["enter", "esc", "q"], "close")],
    render(area, s) {
      const buttons = dialog(s, area, ctx.theme.c, {
        title: "System",
        body: lines,
        actions: [{ label: "Close" }],
        selected: 0,
        width: WIDTH,
      });
      buttons.forEach((rect) => ctx.hit(rect, () => ctx.pop()));
    },
    key(e) {
      if (e.key === "enter" || e.key === "esc" || e.key === "q") ctx.pop();
      return true;
    },
  };
}
const mib = (n: number) => `${(n / 1_048_576).toFixed(1)}`;
/** The header, then an hour a row (UTC); empty for anyone the gate refuses. */
@@ -31,7 +91,7 @@
export function memoryLines(session: Session, now = Date.now()): string[] {
  ];
}
export function systemScreen(session: Session, ctx: Ctx): Screen {
export function memoryScreen(session: Session, ctx: Ctx): Screen {
  const scroll = new Scroll();
  return {
    title: "System memory",
@@ -332,6 +332,7 @@
function paletteIndex(ctx: Ctx, extra: PaletteItem[]): Html {
    ...(ctx.auth.user?.isAdmin
      ? [
          { t: "Flow", h: "/flow", c: "Go to" },
          { t: "System", h: "/system", c: "Go to" },
          { t: "Forges you sent", h: "/forges", c: "Go to" },
          { t: "Family of forges", h: "/family", c: "Go to" },
        ]
@@ -0,0 +1,36 @@
/**
 * /contribute, open to anyone: what this forge is, where its bottleneck is
 * right now, the open issues that welcome outside work, and how to propose
 * (#1789). The same words as the MCP `contribute` tool and
 * `GET /api/v1/contribute` (`system/telemetry.ts`).
 */
import type { Ctx } from "../../http/context.ts";
import { welcome } from "../../system/telemetry.ts";
import { html } from "../html.ts";
import { page } from "../layout.ts";
import { card } from "../ui.ts";
// GET /contribute
export function contributePage(ctx: Ctx): Response {
  const w = welcome(ctx.app);
  const body = html`<div class="page-head">
      <h1>Help build this forge</h1>
      <p class="muted">${w.forge}</p>
    </div>
    <p id="bottleneck"><strong>Where it hurts now:</strong> ${w.bottleneck.says}</p>
    ${card(
      w.issues.length === 0
        ? html`<div class="card-body"><p class="muted">No open issue carries the “${w.welcomeLabel}” label right now.</p></div>`
        : html`<ul class="list">${w.issues.map(
            (i) => html`<li class="row"><a href="${i.path}">${i.repo}#${String(i.number)}</a> ${i.title}</li>`,
          )}</ul>`,
      { head: html`<h2>Issues that welcome outside work</h2>`, pad: false },
    )}
    ${card(
      html`<div class="card-body"><ol id="propose">${w.propose.map((s) => html`<li>${s}</li>`)}</ol>
        <p class="muted small">${w.telemetry}</p>
        <p class="muted small">For agents: <span class="mono">GET /api/v1/contribute</span>, or the MCP tool <span class="mono">contribute</span>.</p></div>`,
      { head: html`<h2>How to propose</h2>` },
    )}`;
  return page({ ctx, title: "Contribute", body });
}
@@ -19,6 +19,8 @@
 * command and the MCP `flow` tool read too.
 */
import { noteRead, telemetryReader } from "../../actions/telemetry.ts";
import { queuesFor, systemFor } from "../../system/telemetry.ts";
import { conflictedPulls, conflictedSays } from "../../flow/conflicted.ts";
import {
  bottleneck,
@@ -41,6 +43,7 @@
import {
} from "../../flow/throughput.ts";
import { readQueues, type QueueRow } from "../../flow/queue.ts";
import type { Ctx } from "../../http/context.ts";
import { live } from "../../system/live.ts";
      
        sentinelcrew
        28d ago
        
      
      live is imported but never used here; the page reads duplicates through systemFor. Likewise the value readQueues on line 44: only type QueueRow is still used. Filed as #2171.
    
import { notFoundPage, signInFirst } from "../chrome.ts";
import { html, type Html } from "../html.ts";
import { page } from "../layout.ts";
@@ -99,14 +102,17 @@
function outCell(t: StageThroughput): Html {
// GET /flow
export function flowPage(ctx: Ctx): Response {
  if (!ctx.auth.user) return signInFirst(ctx);
  if (!ctx.auth.user.isAdmin) return notFoundPage(ctx);
  const reader = telemetryReader(ctx.app, ctx.auth.user);
  if (!reader) return notFoundPage(ctx);
  noteRead(ctx.app, ctx.auth.user, reader, "flow");
  const now = Date.now();
  const stages = readPipeline(ctx.app.db, new Date(now));
  const worst = bottleneck(stages);
      
        sentinelcrew
        28d ago
        outdated
      
      Low: /flow used to be pure SQL. It now walks all of /proc (stat per process, cmdline per bun process) whenever the 1 s cache is cold. Consider whether duplicates belong on the common /flow request.
    
      
        sentinelcrew
        28d ago
        outdated
      
      This page is still gated on isAdmin alone, so an admin agent without telemetry:read reads the full view here, including private repositories' queue and conflicted lines and the unfiltered duplicates. The read is not logged. The MCP flow tool now refuses that same agent. Use telemetryReader() and show the agent view (with noteRead) when reader.kind === "agent".
    
  const flow = readThroughput(ctx.app.db, stages.map((s) => s.key), new Date(now));
  const out = new Map(flow.stages.map((t) => [t.key, t]));
  const landed = out.get("approved");
  const conflicted = conflictedSays(conflictedPulls(ctx.app.db), now);
  const dups = systemFor(ctx.app, reader).duplicates;
  const conflicted = conflictedSays(conflictedPulls(ctx.app.db, reader.kind === "agent"), now);
  const listed = asked(ctx.url);
  const shown = listed === null ? undefined : out.get(listed.key);
  const body = html`<div class="page-head">
@@ -116,7 +122,8 @@
export function flowPage(ctx: Ctx): Response {
        long its oldest has waited, and what limits it. The limits are set on
        <a href="/settings/capacity">Capacity</a> and in each repository's
        autonomy settings. How the forge stands against its threats is on
        <a href="/resilience">Resilience</a>.
        <a href="/resilience">Resilience</a>. Where an outside agent can
        help is on <a href="/contribute">Contribute</a>.
      </p>
    </div>
    <p id="bottleneck" data-stage="${worst?.key ?? ""}">
@@ -132,6 +139,13 @@
export function flowPage(ctx: Ctx): Response {
      <span data-median>${flow.medianAskToLiveMs === null ? "—" : hoursSpan(flow.medianAskToLiveMs)}</span>
      (24 h)
    </p>
    <p id="duplicate-work" data-count="${String(dups.length)}" class="${dups.length === 0 ? "muted" : ""}">
      ${dups.length === 0
        ? html`No test file is running in more than one check.`
        : html`<strong>${String(dups.length)} test file${dups.length === 1 ? " is" : "s are"} running in more than one check:</strong>
          ${dups.slice(0, 5).map((d) => html`<span class="mono small">${d.file} (${d.checks.join(", ")})</span> `)}`}
      <a href="/system">System</a>
    </p>
    ${card(
      html`<div class="table-scroll">
        <table class="table" aria-label="Pipeline stages">
@@ -169,7 +183,7 @@
export function flowPage(ctx: Ctx): Response {
      </div>`,
      { pad: false },
    )}
    ${queueCard(readQueues(ctx.app.db, new Date(now)))}
    ${queueCard(queuesFor(ctx.app, reader, new Date(now)))}
    ${listed === null || shown === undefined ? null : outList(shown, listed.hour, now)}`;
  return page({ ctx, title: "Flow", body, styleCss: css });
}
@@ -81,6 +81,7 @@
export type AccountSection =
  | "backups"
  | "secrets"
  | "capacity"
  | "telemetry"
  | "access"
  | "resilience"
  | "limits"
@@ -136,6 +137,12 @@
export function accountSections(
            icon: "activity" as const,
            current: current === "capacity",
          },
          {
            label: "Telemetry",
            href: "/settings/telemetry",
            icon: "activity" as const,
            current: current === "telemetry",
          },
          {
            label: "Access",
            href: "/settings/access",
@@ -1,49 +1,122 @@
/**
 * GET /system, for a forge admin who is a person: the forge's resident
 * memory (RSS) beside its JS heap, hourly for the last 24 h (#2151). RSS
 * climbing while the heap stays flat is native memory growth. Drawn on the
 * server as SVG, with the hours under it as a table. Anyone else gets 403.
 * /system, for the owner: the machine as it is now — cores, temperatures,
 * load, memory, disks, network — and every process grouped by what the
 * forge launched it for, each with CPU, memory and age. The same test file
 * in more than one check at once is named at the top. It refreshes itself
 * every 2 s (a few lines of static script; `?pause` turns that off), so a
 * viewer *is* the sampler (`system/live.ts`). Numbers are `system/view.ts`'s.
 * Below it, for a forge admin who is a person, the forge's resident memory
 * (RSS) beside its JS heap, hourly for 24 h (#2151): RSS climbing while the
 * heap stays flat is native memory growth. Drawn on the server as SVG.
 */
import { drawChart } from "../../boards/chart.ts";
import { canSeeMemory, memoryHours } from "../../boards/memory.ts";
import { telemetryReader } from "../../actions/telemetry.ts";
import type { Ctx } from "../../http/context.ts";
import { html, raw } from "../html.ts";
import { bytes, span } from "../../system/format.ts";
import { live } from "../../system/live.ts";
import { notFoundPage, signInFirst } from "../chrome.ts";
import { html, raw, type Html } from "../html.ts";
import { page } from "../layout.ts";
import { btn, card, empty } from "../ui.ts";
import { card, empty } from "../ui.ts";
const pct = (n: number | null): string => (n === null ? "—" : `${n.toFixed(1)}%`);
const coresOf = (n: number | null): string => (n === null ? "—" : n.toFixed(2));
const mib = (n: number) => `${(n / 1_048_576).toFixed(1)} MiB`;
const hhmm = (at: number) => new Date(at).toISOString().slice(0, 16).replace("T", " ");
const forbiddenPage = (ctx: Ctx) =>
  page(
    {
      ctx,
      title: "Forbidden",
      body: html`<div class="page-head"><h1>403</h1></div>
        ${empty({ icon: "lock", title: "Admins only", note: "System memory is for a forge admin who is a person.", action: btn("Go home", { href: "/", variant: "primary" }) })}`,
    },
    403,
  );
export async function systemPage(ctx: Ctx): Promise<Response> {
  if (!canSeeMemory(ctx.auth.user)) return forbiddenPage(ctx);
/** The forge's RSS beside its JS heap, an hour a row; empty for anyone `canSeeMemory` refuses. */
function memorySection(ctx: Ctx): Html {
  if (!canSeeMemory(ctx.auth.user)) return html``;
  const hours = memoryHours(ctx.app.db, Date.now());
  const series = (title: string, pick: (h: (typeof hours)[number]) => number) =>
    card(
      html`<div class="chart-box">${raw(drawChart("line", hours.map((h) => ({ label: hhmm(h.at).slice(11), value: pick(h) / 1_048_576 })), title))}</div>`,
      { head: html`<h2>${title}</h2>` },
    );
  const body =
    hours.length === 0
      ? empty({ icon: "activity", title: "No samples yet", note: "The forge samples its memory every minute; the first hour appears shortly." })
      : html`<div class="sys-pair">${series("RSS (MiB, hourly mean)", (h) => h.rssMean)}${series("JS heap (MiB, hourly mean)", (h) => h.heapMean)}</div>
        <table class="table">
  return hours.length === 0
    ? empty({ icon: "activity", title: "No samples yet", note: "The forge samples its memory every minute; the first hour appears shortly." })
    : html`<div class="sys-pair">${series("RSS (MiB, hourly mean)", (h) => h.rssMean)}${series("JS heap (MiB, hourly mean)", (h) => h.heapMean)}</div>
        <table class="table" aria-label="Forge memory by hour">
          <thead><tr><th scope="col">Hour (UTC)</th><th scope="col" class="num">RSS mean</th><th scope="col" class="num">RSS max</th><th scope="col" class="num">Heap mean</th><th scope="col" class="num">Heap max</th></tr></thead>
          <tbody>${hours.map((h) => html`<tr><td class="mono">${hhmm(h.at)}</td><td class="num mono">${mib(h.rssMean)}</td><td class="num mono">${mib(h.rssMax)}</td><td class="num mono">${mib(h.heapMean)}</td><td class="num mono">${mib(h.heapMax)}</td></tr>`)}</tbody>
        </table>`;
  return page({
    ctx,
    title: "System",
    body: html`<div class="page-head"><h1>System memory</h1></div>${body}`,
  });
}
const RELOAD = `if (!/[?&]pause\\b/.test(location.search)) setTimeout(function () { location.reload(); }, 2000);`;
// GET /system
export function systemPage(ctx: Ctx): Response {
  if (!ctx.auth.user) return signInFirst(ctx);
  const reader = telemetryReader(ctx.app, ctx.auth.user);
  if (reader?.kind !== "owner") return notFoundPage(ctx);
  const v = live().read();
  const dup: Html =
    v.duplicates.length === 0
      ? html`<p id="duplicates" data-count="0" class="muted">No test file is running in more than one check.</p>`
      : html`<p id="duplicates" data-count="${String(v.duplicates.length)}">
            <strong>${String(v.duplicates.length)} test file${v.duplicates.length === 1 ? " is" : "s are"}
            running in more than one check at once:</strong>
          </p>
          <ul class="list small mono">
            ${v.duplicates.map((d) => html`<li>${d.file} · ${String(d.checks.length)} checks: ${d.checks.join(", ")}</li>`)}
          </ul>`;
  const cores = v.cpu.cores.map(
    (c, i) => html`<span class="mono small" title="cpu${String(i)}">${c === null ? "—" : String(Math.round(c))}</span> `,
  );
  const body = html`<div class="page-head">
      <h1>System</h1>
      <p class="muted">
        The machine now, sampled each time this page refreshes (every 2 s);
        <a href="/system?pause">pause</a>. Its history is on
        <a href="/boards">Boards</a> (the machine source); the pipeline is on
        <a href="/flow">Flow</a>.
      </p>
    </div>
    ${dup}
    ${card(
      html`<div class="card-body">
        <p id="summary">
          CPU <strong>${pct(v.cpu.busyPct)}</strong> over ${String(v.cpu.cores.length)} cores ·
          load ${v.load ? v.load.map((l) => l.toFixed(2)).join(" ") : "—"} ·
          hottest ${v.hottestC === null ? "—" : `${v.hottestC.toFixed(0)}°C`} ·
          memory ${v.memory ? `${bytes(v.memory.usedBytes)} of ${bytes(v.memory.totalBytes)}` : "—"} ·
          ${String(v.processes)} processes
        </p>
        <p class="small" id="cores" aria-label="Per-core CPU, percent">${cores}</p>
        <p class="small mono" id="temps">${v.temps.map((t) => `${t.chip} ${t.label} ${t.celsius.toFixed(0)}°C`).join(" · ")}</p>
      </div>`,
      { head: html`<h2>Machine</h2>` },
    )}
    ${card(
      html`<div class="table-scroll"><table class="table" aria-label="Disks and network">
        <thead><tr><th scope="col">Disk / interface</th><th scope="col">Used</th><th scope="col">Total / rate</th></tr></thead>
        <tbody>
          ${v.disks.map(
            (d) => html`<tr><td class="mono">${d.mount} <span class="muted small">${d.fs}</span></td>
              <td>${String(Math.round((d.usedBytes / d.totalBytes) * 100))}%</td><td>${bytes(d.totalBytes)}</td></tr>`,
          )}
          ${v.net.map(
            (n) => html`<tr><td class="mono">${n.name}</td><td>↓ ${n.rxBytesPerSecond === null ? "—" : `${bytes(n.rxBytesPerSecond)}/s`}</td>
              <td>↑ ${n.txBytesPerSecond === null ? "—" : `${bytes(n.txBytesPerSecond)}/s`}</td></tr>`,
          )}
        </tbody></table></div>`,
      { head: html`<h2>Disks and network</h2>`, pad: false },
    )}
    ${card(
      html`<div class="table-scroll"><table class="table" aria-label="Processes by what launched them">
        <thead><tr><th scope="col">Launched for</th><th scope="col">Processes</th><th scope="col">CPU (cores)</th>
        <th scope="col">Memory</th><th scope="col">Oldest</th><th scope="col">Busiest</th></tr></thead>
        <tbody>
          ${v.groups.map(
            (g) => html`<tr data-kind="${g.kind}"><td class="mono">${g.label}</td><td>${String(g.procs)}</td>
              <td>${coresOf(g.cpuCores)}</td><td>${bytes(g.rssBytes)}</td><td>${span(g.oldestSeconds)}</td>
              <td class="small mono">${g.top.slice(0, 3).map((p) => `${p.comm} ${coresOf(p.cpuCores)}`).join(" · ")}</td></tr>`,
          )}
        </tbody></table></div>`,
      { head: html`<h2>Processes</h2>`, pad: false },
    )}
    ${memorySection(ctx)}`;
  return page({ ctx, title: "System", body, wide: true, scriptJs: RELOAD });
}
@@ -0,0 +1,85 @@
/**
 * Settings → Telemetry, for the owner: which named agents hold
 * `telemetry:read`, one switch each, and the reads they have made (#1789).
 */
import { setTelemetryGrant } from "../../actions/telemetry.ts";
import { grantable, recentReads } from "../../core/telemetry.ts";
import type { Ctx } from "../../http/context.ts";
import { notFoundPage, settingsLayout, signInFirst } from "../chrome.ts";
import { field, readForm } from "../form.ts";
import { html } from "../html.ts";
import { flashTo, page } from "../layout.ts";
import { btn, card, icon, row, time } from "../ui.ts";
import { accountSections } from "./origins.ts";
function owner(ctx: Ctx): Response | undefined {
  if (!ctx.auth.user) return signInFirst(ctx);
  return ctx.auth.user.isAdmin && ctx.auth.user.kind !== "agent" ? undefined : notFoundPage(ctx);
}
// GET /settings/telemetry
export function telemetryPage(ctx: Ctx): Response {
  const denied = owner(ctx);
  if (denied) return denied;
  const agents = grantable(ctx.app.db);
  const reads = recentReads(ctx.app.db);
  const body = html`${card(
      html`<div class="card-body"><p class="muted small">
        A granted agent reads <a href="/flow">Flow</a>, <a href="/system">System</a> and the
        boards' sources through the API and MCP — counts and rates, with
        private repositories and sealed values cut out. Revoke at any time;
        every read is listed below.
      </p></div>
      <ul class="list">
        ${agents.length === 0
          ? html`<li class="muted small">No agent accounts yet.</li>`
          : agents.map((a) =>
              row({
                lead: icon("bot"),
                title: html`${a.username} <span class="muted small mono">telemetry:read</span>`,
                meta: html`${a.granted ? "Granted" : "Not granted"}`,
                trail: html`<form class="row-actions" method="post" action="/settings/telemetry">
                  <input type="hidden" name="agent" value="${a.username}" />
                  <input type="hidden" name="on" value="${a.granted ? "0" : "1"}" />
                  ${btn(a.granted ? "Revoke" : "Grant", {
                    size: "sm",
                    variant: a.granted ? "outline" : "primary",
                    label: `${a.granted ? "Revoke" : "Grant"} telemetry:read for ${a.username}`,
                  })}
                </form>`,
              }),
            )}
      </ul>`,
      { head: html`${icon("activity")}<h2>Telemetry grants</h2>`, pad: false },
    )}
    ${card(
      reads.length === 0
        ? html`<div class="card-body"><p class="muted small">No agent has read anything yet.</p></div>`
        : html`<ul class="list">${reads.map((r) =>
            row({ lead: icon("history"), title: html`${r.username} <span class="mono">${r.what}</span>`, meta: time(r.at) }),
          )}</ul>`,
      { head: html`${icon("history")}<h2>Reads</h2>`, pad: false },
    )}`;
  return page({
    ctx,
    title: "Telemetry",
    body: html`<div class="page-head"><h1>Telemetry</h1></div>
      ${settingsLayout(accountSections("telemetry", { admin: true }), body, "Account settings")}`,
  });
}
// POST /settings/telemetry
export async function telemetrySet(ctx: Ctx): Promise<Response> {
  const denied = owner(ctx);
  if (denied) return denied;
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  const changed = setTelemetryGrant(ctx.app, ctx.auth.user, field(form, "agent"), field(form, "on") === "1");
  return flashTo(
    ctx,
    "/settings/telemetry",
    changed.ok
      ? { message: `${changed.value.username} ${changed.value.on ? "may now read" : "no longer reads"} telemetry.` }
      : { tone: "danger", message: "Only an agent account can be granted telemetry:read." },
  );
}
@@ -209,6 +209,8 @@
describe("the forge over MCP", () => {
      "access",
      "capacity",
      "flow",
      "system",
      "contribute",
      "limits",
      "quotas",
      "boards",
@@ -83,9 +83,10 @@
describe("GET /system", () => {
    expect(body).toContain("40.0 MiB");
  });
  test("a non-admin and an anonymous visitor get 403", async () => {
    expect((await get("bob")).status).toBe(403);
    expect((await get(null)).status).toBe(403);
  test("a non-admin gets 404 and an anonymous visitor is sent to sign in", async () => {
    expect((await get("bob")).status).toBe(404);
    const anon = await fetch(servers.url + "/system", { redirect: "manual" });
    expect(anon.status).toBe(303);
  });
});
@@ -98,8 +99,8 @@
describe("reaching /system", () => {
  });
  test("a refused visitor gets a page, not bare text", async () => {
    const res = await get(null);
    expect(res.status).toBe(403);
    expect(await res.text()).toContain("<h1>403</h1>");
    const res = await get("bob");
    expect(res.status).toBe(404);
    expect(await res.text()).toContain("<h1>");
  });
});
@@ -0,0 +1,429 @@
/**
 * Live machine telemetry and its open read hooks (#1789): /proc and /sys
 * read into one view; the same test file in two checks counted as duplicate
 * work; /system and /flow read by the owner and by an agent holding
 * `telemetry:read` — with private repositories cut out — and refused to an
 * agent without it; the grant is the owner's alone and every agent read is
 * logged; the funnel is open to all.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { createAgent } from "../src/actions/crew.ts";
import { createRepo } from "../src/actions/repos.ts";
import { setTelemetryGrant } from "../src/actions/telemetry.ts";
import { recentReads } from "../src/core/telemetry.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { parseCores, parseNet, testFiles } from "../src/system/proc.ts";
import { createLive, live, useLive } from "../src/system/live.ts";
import type { Ctx, Screen } from "../src/tui/app/app.ts";
import { forgeCommands, Session } from "../src/tui/forge.ts";
import { systemLines } from "../src/tui/screens/system.ts";
import { flowLines } from "../src/tui/screens/flow.ts";
import { hasGrant, logRead } from "../src/core/telemetry.ts";
const stat = (pid: number, comm: string, ppid: number, ticks: number): string => {
  const f: (number | string)[] = new Array<number>(40).fill(0);
  f[0] = "S";
  f[1] = ppid;
  f[11] = ticks;
  f[19] = 100;
  f[21] = 256;
  return `${pid} (${comm}) ${f.join(" ")}`;
};
function fakeHost(root: string, ticks: number): void {
  const proc = join(root, "proc");
  mkdirSync(join(proc, "net"), { recursive: true });
  mkdirSync(join(root, "sys/class/hwmon/hwmon0"), { recursive: true });
  writeFileSync(join(root, "sys/class/hwmon/hwmon0/name"), "coretemp\n");
  writeFileSync(join(root, "sys/class/hwmon/hwmon0/temp1_input"), "76000\n");
  writeFileSync(join(root, "sys/class/hwmon/hwmon0/temp1_label"), "Core 0\n");
  writeFileSync(
    join(proc, "stat"),
    `cpu  ${ticks} 0 0 100 0 0 0 0\ncpu0 ${ticks} 0 0 100 0 0 0 0\ncpu1 0 0 0 ${ticks} 0 0 0 0\n`,
  );
  writeFileSync(join(proc, "meminfo"), "MemTotal: 1000 kB\nMemAvailable: 400 kB\nSwapTotal: 0 kB\nSwapFree: 0 kB\n");
  writeFileSync(join(proc, "loadavg"), "64.00 60.00 50.00 3/3071 999\n");
  writeFileSync(join(proc, "uptime"), "5000.00 100.00\n");
  writeFileSync(join(proc, "mounts"), "");
  writeFileSync(
    join(proc, "net/dev"),
    "Inter-|   Receive\n face |bytes\n  lo: 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0\n eth0: ${r} 0 0 0 0 0 0 0 ${t} 0 0 0 0 0 0 0\n"
      .replace("${r}", String(ticks * 10))
      .replace("${t}", String(ticks * 5)),
  );
  const proc1 = (pid: number, comm: string, ppid: number, args: string) => {
    mkdirSync(join(proc, String(pid)), { recursive: true });
    writeFileSync(join(proc, String(pid), "stat"), stat(pid, comm, ppid, ticks));
    writeFileSync(join(proc, String(pid), "cmdline"), args);
  };
  proc1(1, "forge", 0, "bun\0src/main.ts\0");
  proc1(200, "bwrap", 1, "bwrap\0");
  proc1(201, "bun", 200, "bun\0test\0test/shared.test.ts\0--secret-flag=hunter2\0");
  proc1(300, "bwrap", 1, "bwrap\0");
  proc1(301, "bun", 300, "bun\0test\0./test/shared.test.ts\0");
  proc1(400, "bwrap", 1, "bwrap\0");
  proc1(401, "bun", 400, "bun\0test\0test/alone.test.ts\0");
  proc1(500, "bun", 1, "bun\0test\0test/private-thing.test.ts\0");
}
describe("the machine, read from /proc and /sys", () => {
  test("per-core ticks, interfaces and test-file arguments — nothing else of a command line", () => {
    expect(parseCores("cpu  9 0 0 1\ncpu0 3 0 0 1 0 0 0 0\ncpu1 1 0 0 3 0 0 0 0\n")).toEqual([
      { busy: 3, total: 4 },
      { busy: 1, total: 4 },
    ]);
    expect(parseNet("h\nh\n  lo: 5 0 0 0 0 0 0 0 5\neth0: 7 0 0 0 0 0 0 0 9\n")).toEqual([{ name: "eth0", rx: 7, tx: 9 }]);
    expect(testFiles("bun\0test\0./test/a.test.ts\0--token=abc\0../etc/x\0$(id).test.ts\0")).toEqual(["test/a.test.ts"]);
  });
  test("two checks running one test file are duplicate work, grouped by what launched them", () => {
    const root = mkdtempSync(join(tmpdir(), "forge-sys-"));
    try {
      fakeHost(root, 100);
      const roots = [
        { label: "check:RUN1", root: 200 },
        { label: "check:RUN2", root: 300 },
        { label: "check:RUN3", root: 400 },
      ];
      const l = createLive({ paths: { proc: join(root, "proc"), sys: join(root, "sys") }, roots: () => roots, self: 1 });
      const v = l.read(1_000_000);
      expect(v.duplicates).toEqual([{ file: "test/shared.test.ts", checks: ["check:RUN1", "check:RUN2"] }]);
      expect(v.groups.find((g) => g.label === "check:RUN1")?.procs).toBe(2);
      expect(v.groups.find((g) => g.label === "forge")?.procs).toBe(2);
      expect(v.cpu.cores.length).toBe(2);
      expect(v.hottestC).toBe(76);
      expect(v.load?.[0]).toBe(64);
      expect(v.memory).toEqual({ totalBytes: 1024_000, usedBytes: 614_400, swapUsedBytes: 0 });
      expect(JSON.stringify(v)).not.toContain("hunter2");
      // A later reading gives rates over the two latest.
      fakeHost(root, 300);
      const w = l.read(1_002_000);
      expect(w.seconds).toBeCloseTo(2, 5);
      expect(v.seconds).toBe(0);
      expect(v.net[0]?.rxBytesPerSecond).toBeNull();
      expect(w.net[0]?.rxBytesPerSecond).toBeCloseTo(2000 / 2, 3);
    } finally {
      rmSync(root, { recursive: true, force: true });
    }
  });
});
describe("telemetry:read: the owner grants it, an agent reads with it, nobody else does", () => {
  let dataDir: string;
  let host: string;
  let app: App;
  let servers: Servers;
  let alice: User;
  let bob: User;
  let muse: User;
  let grok: User;
  let tokens: Record<string, string>;
  const get = (token: string | undefined, path: string) =>
    fetch(`${servers.url}${path}`, token ? { headers: { authorization: `Bearer ${token}` } } : {});
  const login = async (username: string): Promise<string> => {
    const res = await fetch(`${servers.url}/signin`, {
      method: "POST",
      redirect: "manual",
      headers: { "content-type": "application/x-www-form-urlencoded", origin: servers.url },
      body: new URLSearchParams({ username, password: "a-good-passphrase" }),
    });
    return (res.headers.get("set-cookie") ?? "").split(";")[0] ?? "";
  };
  const tool = async (token: string, name: string) => {
    const res = await fetch(`${servers.url}/mcp`, {
      method: "POST",
      headers: { authorization: `Bearer ${token}`, "content-type": "application/json", accept: "application/json, text/event-stream" },
      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: {} } }),
    });
    const b = (await res.json()) as { result: { isError?: boolean; content: { text: string }[] } };
    return { error: b.result.isError === true, text: b.result.content[0]!.text };
  };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-telemetry-"));
    host = mkdtempSync(join(tmpdir(), "forge-host-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    const mk = async (username: string, adminIfFirst = false) => {
      const u = await createUser(app.db, {
        trusted: true, username, email: `${username}@forge.local`, password: "a-good-passphrase", adminIfFirst,
      });
      if (!u.ok) throw new Error(u.error);
      return u.value;
    };
    alice = await mk("alice", true);
    bob = await mk("bob");
    const agent = async (username: string) => {
      const made = await createAgent(app, alice, { username });
      if (!made.ok) throw new Error(String(made.error));
      return made.value.user;
    };
    muse = await agent("muse");
    grok = await agent("grokbot");
    const priv = await createRepo(app, alice, { name: "vault-of-secrets", visibility: "private" });
    const pub = await createRepo(app, alice, { name: "open-garden", visibility: "public" });
    if (!priv.ok || !pub.ok) throw new Error("repos");
    for (const [id, repo] of [["RUN1", priv.value], ["RUN2", pub.value], ["RUN3", pub.value]] as const)
      app.db
        .query("INSERT INTO run (id, repo_id, kind, state) VALUES (?1, ?2, 'deploy', 'running')")
        .run(id, repo.id);
    // One pull in conflict in each repository: only the public one may reach an agent.
    for (const [n, repo] of [[1, priv.value], [2, pub.value]] as const) {
      const id = `PULL${n}`;
      app.db
        .query("INSERT INTO issue (id, repo_id, number, kind, title, author_id) VALUES (?1, ?2, ?3, 'pull', 'p', ?4)")
        .run(id, repo.id, n, alice.id);
      app.db
        .query("INSERT INTO pull (issue_id, base_branch, head_branch, base_oid, head_oid) VALUES (?1, 'main', 'f', 'a', 'b')")
        .run(id);
      app.db
        .query("INSERT INTO run (id, repo_id, kind, issue_id, reason, state) VALUES (?1, ?2, 'agent', ?3, 'conflict', 'queued')")
        .run(`CONF${n}`, repo.id, id);
    }
    fakeHost(host, 100);
    useLive(
      createLive({
        paths: { proc: join(host, "proc"), sys: join(host, "sys") },
        roots: () => [
          { label: "check:RUN1", root: 200 },
          { label: "check:RUN2", root: 300 },
          { label: "check:RUN3", root: 400 },
        ],
        self: 1,
      }),
    );
    tokens = {
      alice: createToken(app.db, alice.id, "t", "admin").token,
      bob: createToken(app.db, bob.id, "t", "rw").token,
      muse: createToken(app.db, muse.id, "t", "ro").token,
      grok: createToken(app.db, grok.id, "t", "ro").token,
    };
    expect(setTelemetryGrant(app, alice, "muse", true).ok).toBe(true);
  });
  afterAll(async () => {
    useLive(createLive());
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
    rmSync(host, { recursive: true, force: true });
  });
  test("an agent without the grant, a member and nobody are refused", async () => {
    for (const path of ["/api/v1/telemetry/system", "/api/v1/telemetry/flow", "/api/v1/telemetry/sources"]) {
      expect((await get(tokens["grok"], path)).status).toBe(403);
      expect((await get(tokens["bob"], path)).status).toBe(403);
      expect((await get(undefined, path)).status).toBe(401);
    }
    expect((await tool(tokens["grok"]!, "system")).error).toBe(true);
    expect((await tool(tokens["grok"]!, "flow")).error).toBe(true);
    const bobCookie = await login("bob");
    expect((await fetch(`${servers.url}/system`, { headers: { cookie: bobCookie } })).status).toBe(404);
  });
  test("a granted agent reads /system and /flow, with private repositories cut out", async () => {
    const sys = await get(tokens["muse"], "/api/v1/telemetry/system");
    expect(sys.status).toBe(200);
    const text = await sys.text();
    expect(text).not.toContain("RUN1");
    expect(text).not.toContain("hunter2");
    // A test outside any cell lands in `forge`; its file name is not an agent's to read.
    expect(text).not.toContain("private-thing");
    const v = JSON.parse(text) as { groups: { label: string; kind: string; top: unknown[]; procs: number }[]; duplicates: { file: string; checks: string[] }[] };
    const hidden = v.groups.find((g) => g.label === "check:private-1");
    expect(hidden?.procs).toBe(2);
    expect(hidden?.top).toEqual([]);
    expect(v.groups.some((g) => g.label === "check:RUN2")).toBe(true);
    expect(v.duplicates).toEqual([{ file: "(private)", checks: ["check:RUN2", "check:private-1"] }]);
    const flow = await get(tokens["muse"], "/api/v1/telemetry/flow");
    expect(flow.status).toBe(200);
    const f = (await flow.json()) as { says: string; stages: unknown[]; duplicateWork: unknown[] };
    expect(f.stages.length).toBeGreaterThan(0);
    expect(f.duplicateWork.length).toBe(1);
    // A conflicted private pull is not named to an agent, in the list or in the sentence.
    const flowText = JSON.stringify(f);
    expect(flowText).toContain("alice/open-garden#2");
    expect(flowText).not.toContain("vault-of-secrets");
    const viaMcp = await tool(tokens["muse"]!, "flow");
    expect(viaMcp.text).toContain("alice/open-garden#2");
    expect(viaMcp.text).not.toContain("vault-of-secrets");
    const history = await get(tokens["muse"], "/api/v1/telemetry/history");
    expect(history.status).toBe(200);
    expect(Array.isArray(((await history.json()) as { points: unknown[] }).points)).toBe(true);
    expect((await get(tokens["grok"], "/api/v1/telemetry/history")).status).toBe(403);
    const sources = (await (await get(tokens["muse"], "/api/v1/telemetry/sources")).json()) as { sources: { name: string }[] };
    expect(sources.sources.map((s) => s.name)).toContain("machine");
    expect((await tool(tokens["muse"]!, "system")).error).toBe(false);
    expect((await tool(tokens["muse"]!, "flow")).error).toBe(false);
  });
  test("a private repository's merge-queue line reaches the owner, never an agent", async () => {
    const priv = app.db
      .query<{ id: string }, []>("SELECT id FROM repo WHERE name = 'vault-of-secrets'")
      .get()!;
    app.db
      .query("INSERT INTO issue (id, repo_id, number, kind, title, author_id) VALUES ('PULLQ', ?1, 9, 'pull', 'q', ?2)")
      .run(priv.id, alice.id);
    app.db
      .query(
        "INSERT INTO pull (issue_id, base_branch, head_branch, base_oid, head_oid, merged_at) SELECT 'PULLQ', default_branch, 'q', 'a', 'b', strftime('%Y-%m-%dT%H:%M:%fZ','now') FROM repo WHERE id = ?1",
      )
      .run(priv.id);
    type Flow = { queue: { repo: string }[] };
    const names = (f: Flow) => f.queue.map((q) => q.repo);
    const mcp = async (t: string) => JSON.parse((await tool(t, "flow")).text) as Flow;
    const api = async (t: string) => (await (await get(t, "/api/v1/telemetry/flow")).json()) as Flow;
    expect(names(await api(tokens["alice"]!))).toContain("alice/vault-of-secrets");
    expect(names(await mcp(tokens["alice"]!))).toContain("alice/vault-of-secrets");
    expect(names(await api(tokens["muse"]!))).not.toContain("alice/vault-of-secrets");
    expect(names(await mcp(tokens["muse"]!))).not.toContain("alice/vault-of-secrets");
  });
  test("the owner sees everything; every agent read is logged; revoking closes the door", async () => {
    expect(await (await get(tokens["alice"], "/api/v1/telemetry/flow")).text()).toContain("vault-of-secrets");
    expect(await (await get(tokens["alice"], "/api/v1/telemetry/system")).text()).toContain("private-thing");
    const own = await (await get(tokens["alice"], "/api/v1/telemetry/system")).text();
    expect(own).toContain("check:RUN1");
    const page = await fetch(`${servers.url}/system`, { headers: { cookie: await login("alice") } });
    expect(page.status).toBe(200);
    const html = await page.text();
    expect(html).toContain('id="duplicates" data-count="1"');
    expect(html).toContain("test/shared.test.ts");
    const flowPage = await fetch(`${servers.url}/flow`, { headers: { cookie: await login("alice") } });
    expect(await flowPage.text()).toContain('id="duplicate-work" data-count="1"');
    const reads = recentReads(app.db).filter((r) => r.username === "muse");
    expect(reads.map((r) => r.what)).toContain("system");
    expect(reads.map((r) => r.what)).toContain("flow");
    expect(recentReads(app.db).some((r) => r.username === "alice")).toBe(false);
    // The grant is the owner's alone — not an agent's own, not a member's.
    expect(setTelemetryGrant(app, muse, "grokbot", true)).toEqual({ ok: false, error: "not_found" });
    expect(setTelemetryGrant(app, bob, "grokbot", true)).toEqual({ ok: false, error: "not_found" });
    expect(setTelemetryGrant(app, alice, "bob", true)).toEqual({ ok: false, error: "not_an_agent" });
    const cookie = await login("alice");
    const revoke = await fetch(`${servers.url}/settings/telemetry`, {
      method: "POST",
      redirect: "manual",
      headers: { cookie, "content-type": "application/x-www-form-urlencoded", origin: servers.url },
      body: new URLSearchParams({ agent: "muse", on: "0" }),
    });
    expect(revoke.status).toBe(303);
    expect((await get(tokens["muse"], "/api/v1/telemetry/system")).status).toBe(403);
    // A cross-origin grant is refused.
    const forged = await fetch(`${servers.url}/settings/telemetry`, {
      method: "POST",
      redirect: "manual",
      headers: { cookie, "content-type": "application/x-www-form-urlencoded", origin: "https://evil.example" },
      body: new URLSearchParams({ agent: "grokbot", on: "1" }),
    });
    expect(forged.status).not.toBe(303);
    expect((await get(tokens["grok"], "/api/v1/telemetry/system")).status).toBe(403);
    const settings = await fetch(`${servers.url}/settings/telemetry`, { headers: { cookie } });
    expect(settings.status).toBe(200);
  });
  test("the funnel is open to anyone and names the bottleneck, the welcoming issues and the gate", async () => {
    const res = await get(undefined, "/api/v1/contribute");
    expect(res.status).toBe(200);
    const w = (await res.json()) as { bottleneck: { says: string }; propose: string[]; issues: unknown[] };
    expect(w.bottleneck.says.length).toBeGreaterThan(0);
    expect(w.propose.join(" ")).toContain("bun test");
    const html = await (await get(undefined, "/contribute")).text();
    expect(html).toContain("How to propose");
    expect((await tool(tokens["grok"]!, "contribute")).error).toBe(false);
  });
  test("a sealed security report labelled help wanted is never offered to a visitor", async () => {
    const repo = app.db.query<{ id: string }, []>("SELECT id FROM repo WHERE name = 'open-garden'").get()!;
    app.db
      .query("INSERT INTO issue (id, repo_id, number, kind, title, author_id, sealed) VALUES ('SEALED1', ?1, 77, 'issue', 'overflow in the zebra parser', ?2, 1)")
      .run(repo.id, alice.id);
    app.db.query("INSERT INTO label (id, repo_id, name) VALUES ('LBLHW', ?1, 'help wanted')").run(repo.id);
    app.db.query("INSERT INTO issue_label (issue_id, label_id) VALUES ('SEALED1', 'LBLHW')").run();
    app.db
      .query("INSERT INTO issue (id, repo_id, number, kind, title, author_id) VALUES ('OPEN1', ?1, 78, 'issue', 'tidy the herbs', ?2)")
      .run(repo.id, alice.id);
    app.db.query("INSERT INTO issue_label (issue_id, label_id) VALUES ('OPEN1', 'LBLHW')").run();
    const api = await (await get(undefined, "/api/v1/contribute")).text();
    const page = await (await get(undefined, "/contribute")).text();
    const mcp = (await tool(tokens["grok"]!, "contribute")).text;
    for (const out of [api, page, mcp]) {
      expect(out).toContain("tidy the herbs");
      expect(out).not.toContain("zebra");
    }
  });
  test("an admin agent reads flow only with the grant, in the page and the terminal, and sees the agent view", async () => {
    const made = await createAgent(app, alice, { username: "zadminbot" });
    if (!made.ok) throw new Error(String(made.error));
    app.db.query("UPDATE user SET is_admin = 1 WHERE id = ?1").run(made.value.user.id);
    const adminbot = getUserByName(app.db, "zadminbot")!;
    expect(adminbot.isAdmin).toBe(true);
    const token = createToken(app.db, adminbot.id, "t", "admin").token;
    const flowCommand = () => {
      const ctx = { push: () => {}, pop: () => {}, toast: () => {} } as unknown as Ctx;
      const session = new Session(app, { sshUsername: "zadminbot", remoteAddress: "127.0.0.1", fingerprint: "SHA256:t", user: adminbot });
      return forgeCommands(session)(ctx).find((c) => c.id === "flow");
    };
    expect((await get(token, "/flow")).status).toBe(404);
    expect(flowCommand()).toBeUndefined();
    expect(setTelemetryGrant(app, alice, "zadminbot", true).ok).toBe(true);
    const page = await get(token, "/flow");
    expect(page.status).toBe(200);
    const text = await page.text();
    // (the page's palette index lists every repo an admin can open; the telemetry body must not)
    expect(text).not.toContain("/alice/vault-of-secrets/pulls");
    expect(text).not.toContain("RUN1");
    expect(flowCommand()).toBeDefined();
    expect(recentReads(app.db).some((r) => r.username === "zadminbot" && r.what === "flow")).toBe(true);
    // Revoked, the door closes again.
    setTelemetryGrant(app, alice, "zadminbot", false);
    expect((await get(token, "/flow")).status).toBe(404);
  });
  test("in the terminal, the owner is offered System and Telemetry; nobody else is", () => {
    const run = (user: User, id: string) => {
      const pushed: Screen[] = [];
      const toasts: string[] = [];
      const ctx = { push: (x: Screen) => pushed.push(x), pop: () => {}, toast: (t: string) => toasts.push(t) } as unknown as Ctx;
      const session = new Session(app, { sshUsername: user.username, remoteAddress: "127.0.0.1", fingerprint: "SHA256:t", user });
      return { cmd: forgeCommands(session)(ctx).find((c) => c.id === id), pushed, toasts };
    };
    for (const u of [bob, muse]) {
      expect(run(u, "system").cmd).toBeUndefined();
      expect(run(u, "telemetry").cmd).toBeUndefined();
    }
    const sys = run(alice, "system");
    sys.cmd!.run();
    expect(sys.pushed.map((x) => x.title)).toEqual(["System"]);
    expect(systemLines(JSON.parse(JSON.stringify(live().read()))).join("\n")).toContain("1 test file is running in more than one check");
    expect(flowLines(app.db, new Date(), JSON.parse(JSON.stringify(live().read().duplicates))).join("\n")).toContain(
      "1 test file is running in more than one check",
    );
    expect(flowLines(app.db, new Date(), []).join("\n")).toContain("No test file is running in more than one check.");
    logRead(app.db, grok.id, "system");
    const tel = run(alice, "telemetry");
    tel.cmd!.run();
    expect(tel.pushed.map((x) => x.title)).toEqual(["Telemetry: telemetry:read"]);
    expect(hasGrant(app.db, grok.id)).toBe(false);
    // Enter on the list's first row (grokbot, alphabetically before muse) flips its grant.
    tel.pushed[0]!.key({ key: "enter" } as never);
    expect(hasGrant(app.db, grok.id)).toBe(true);
    expect(tel.toasts.join()).toContain("granted");
  });
});
@@ -12,7 +12,7 @@
import { createApp, type App } from "../src/app.ts";
import { recordMemory } from "../src/boards/memory.ts";
import { createUser, type User } from "../src/core/users.ts";
import { createForgeApp, forgeCommands, Session } from "../src/tui/forge.ts";
import { memoryLines, systemScreen } from "../src/tui/screens/system.ts";
import { memoryLines, memoryScreen } from "../src/tui/screens/system.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { quietLogs } from "./helpers/globals.ts";
import { settleApp } from "./helpers/tui.ts";
@@ -37,7 +37,7 @@
async function screenText(user?: User): Promise<string> {
  const terminal = headlessTerminal(120, 30);
  const { app: tui, session } = createForgeApp(app, identity(user), { terminal, exitHooks: false });
  tui.start();
  tui.ctx.push(systemScreen(session, tui.ctx));
  tui.ctx.push(memoryScreen(session, tui.ctx));
  await settleApp(tui);
  const text = tui.screen.toText();
  tui.stop?.();
@@ -87,13 +87,13 @@
describe("tui system memory", () => {
    const text = await screenText(carol);
    expect(text).toContain("123.0");
    expect(text).toContain("45.0");
    expect(doors(carol)).toContain("system");
    expect(doors(carol)).toContain("system-memory");
  });
  test("nobody else has rows or the door", async () => {
    for (const who of [bob, bot, undefined]) {
      expect(memoryLines(new Session(app, identity(who)))).toEqual([]);
      expect(doors(who)).not.toContain("system");
      expect(doors(who)).not.toContain("system-memory");
      expect(await screenText(who)).not.toContain("123.0");
    }
  });
		@@ -621,6 +621,10 @@ Where the whole forge waits is a forge admin's: `/flow` shows each stage from re
621	621
622	622	The terminal also has an Access command (`:` → Access), a site admin's: it reads the same last-day non-browser requests as Settings → Access and the `access` MCP tool, newest first, and filters them with `s` (since), `u` (user agent) and `p` (path), `c` to clear.
623	623
	624	`/system` is the machine, for the owner (#1789): per-core CPU, hwmon temperatures, load, memory, disk per mount, network, and every process grouped by what the forge launched it for (`check:<run>`, `app:<slug>/<env>`, the forge, the host) with CPU, memory and age. It reads `/proc` and `/sys` when asked (the page re-asks every 2 s; there is no timer, so it costs nothing unwatched) and its history is the `machine` board source. A test file running in more than one check at once is counted at the top of `/system` and `/flow`, with the checks. Command lines are never kept — only `*.test.ts` arguments.
	625	In the terminal, `:` → System shows the same view (the owner's only), and `:` → Telemetry lists the agents and flips `telemetry:read` for the one you press Enter on.
	626	An agent the owner grants `telemetry:read` (Settings → Telemetry, one switch per agent, revoked the same way) reads the same through `GET /api/v1/telemetry/{system,flow,sources,history}` and the MCP `flow` and `system` tools; private repositories' checks and apps are renamed `check:private-N` and lose their processes and test files, and `flow` (like `system`, an admin agent account needs the grant too: only a person who is an admin reads without it) names only public repositories' conflicted pulls, every read is listed on that page, and an agent without the grant is refused. `/contribute`, `GET /api/v1/contribute` and the MCP `contribute` tool are open to anyone: what the forge is, the bottleneck now, open issues labelled “help wanted” in public repositories, and how to propose (fork, pull, the same gate). The grant is a table, not a token scope, so no token has to be re-issued.
		sentinelcrew 28d ago This says an admin agent needs the grant for `flow`. That holds for MCP but not yet for `/flow` or the terminal's Flow command. Make the code match this sentence.
	627
624	628	`docs/PLANNING.md` is how issues depend on issues: the edge, the map, and
625	629	what "ready now" means to a person and to the crew. The map also shows each
626	630	pillar's ask-to-live: the median hours from an issue opening to its change live
		@@ -0,0 +1,47 @@
	1	/**
	2	* Who reads the forge's telemetry (#1789). The owner — a forge admin who is
	3	* a person — always may. A named agent may only while the owner has granted
	4	* it `telemetry:read`, and only the owner grants or revokes: an agent that
	5	* could widen its own reading would be the crew deciding what it sees.
	6	* Every grant leaves an event; every read an agent makes is kept.
	7	*/
	8	import type { App } from "../app.ts";
	9	import { grant, hasGrant, logRead, revoke } from "../core/telemetry.ts";
	10	import { getUserByName, type User } from "../core/users.ts";
	11	import { err, ok, type Result } from "../kernel/result.ts";
	12
	13	export type Reader = { kind: "owner" } \| { kind: "agent" };
	14
	15	/** Whether `user` reads telemetry, and as what (the agent's view has private repositories cut out). */
	16	export function telemetryReader(app: App, user: User \| undefined): Reader \| undefined {
	17	if (!user) return undefined;
	18	if (user.kind === "agent") return hasGrant(app.db, user.id) ? { kind: "agent" } : undefined;
	19	return user.isAdmin ? { kind: "owner" } : undefined;
	20	}
	21
	22	/** Record an agent's read; the owner's own reading is not an agent's to audit. */
	23	export function noteRead(app: App, user: User, reader: Reader, what: string): void {
	24	if (reader.kind === "agent") logRead(app.db, user.id, what);
	25	}
	26
	27	export function setTelemetryGrant(
	28	app: App,
	29	actor: User \| undefined,
	30	username: string,
	31	on: boolean,
	32	): Result<{ username: string; on: boolean }, "not_found" \| "not_an_agent"> {
	33	if (!actor \|\| !actor.isAdmin \|\| actor.kind === "agent") return err("not_found");
	34	const target = getUserByName(app.db, username);
	35	if (!target) return err("not_found");
	36	if (target.kind !== "agent") return err("not_an_agent");
	37	const was = hasGrant(app.db, target.id);
	38	if (on) grant(app.db, target.id, actor.id);
	39	else revoke(app.db, target.id);
	40	if (was !== on)
	41	app.bus.append({
	42	kind: on ? "telemetry.granted" : "telemetry.revoked",
	43	actorId: actor.id,
	44	payload: { agent: target.username },
	45	});
	46	return ok({ username: target.username, on });
	47	}
		@@ -806,3 +806,10 @@ function tick(): void {
806	806	}
807	807	}
808	808	}
	809
	810	/** The root process of every labelled cell being watched, for grouping the process table by what launched it (`system/view.ts`). */
	811	export function cellRoots(): { label: string; root: number }[] {
	812	const out: { label: string; root: number }[] = [];
	813	for (const e of watched) if (e.label !== undefined) out.push({ label: e.label, root: e.root });
	814	return out;
	815	}
		@@ -0,0 +1,16 @@
	1	// The `telemetry:read` grant (#1789): which named agent may read /flow,
	2	// /system and the boards' sources, who gave it, and every read it made.
	3	export default `
	4	CREATE TABLE telemetry_grant (
	5	user_id TEXT PRIMARY KEY REFERENCES user(id) ON DELETE CASCADE,
	6	granted_by TEXT NOT NULL REFERENCES user(id),
	7	granted_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
	8	);
	9	CREATE TABLE telemetry_read (
	10	id INTEGER PRIMARY KEY AUTOINCREMENT,
	11	user_id TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE,
	12	what TEXT NOT NULL,
	13	at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
	14	);
	15	CREATE INDEX telemetry_read_at ON telemetry_read(at);
	16	`;
		@@ -64,6 +64,7 @@ export const SYSTEM_NAMES: readonly string[] = [
64	64	"big",
65	65	"board",
66	66	"boards",
	67	"contribute",
67	68	"events",
68	69	"explore",
69	70	"family",
		@@ -0,0 +1,50 @@
	1	/**
	2	* The `telemetry:read` grant: an agent the owner named may read the forge's
	3	* flow, system and board sources (sealed values and private contents are
	4	* cut out where they are built, not here), and every read it makes is kept.
	5	* Pure data, no authz — `actions/telemetry.ts` decides who may grant.
	6	*/
	7	import type { Database } from "bun:sqlite";
	8
	9	export type ReadRow = { username: string; what: string; at: string };
	10
	11	export const READS_KEPT = 5_000;
	12
	13	export function hasGrant(db: Database, userId: string): boolean {
	14	return db.query("SELECT 1 FROM telemetry_grant WHERE user_id = ?1").get(userId) !== null;
	15	}
	16
	17	export function grant(db: Database, userId: string, by: string): void {
	18	db.query("INSERT OR IGNORE INTO telemetry_grant (user_id, granted_by) VALUES (?1, ?2)").run(userId, by);
	19	}
	20
	21	export function revoke(db: Database, userId: string): void {
	22	db.query("DELETE FROM telemetry_grant WHERE user_id = ?1").run(userId);
	23	}
	24
	25	/** Agents the owner could grant to: every agent account. */
	26	export function grantable(db: Database): { id: string; username: string; granted: boolean }[] {
	27	return db
	28	.query<{ id: string; username: string; granted: number }, []>(
	29	`SELECT u.id, u.username, EXISTS(SELECT 1 FROM telemetry_grant g WHERE g.user_id = u.id) AS granted
	30	FROM user u WHERE u.is_agent = 1 ORDER BY u.username`,
	31	)
	32	.all()
	33	.map((r) => ({ id: r.id, username: r.username, granted: r.granted === 1 }));
	34	}
	35
	36	export function logRead(db: Database, userId: string, what: string): void {
	37	db.query("INSERT INTO telemetry_read (user_id, what) VALUES (?1, ?2)").run(userId, what.slice(0, 64));
	38	db.query(
	39	"DELETE FROM telemetry_read WHERE id <= (SELECT MAX(id) FROM telemetry_read) - ?1",
	40	).run(READS_KEPT);
	41	}
	42
	43	export function recentReads(db: Database, limit = 30): ReadRow[] {
	44	return db
	45	.query<ReadRow, [number]>(
	46	`SELECT u.username AS username, r.what AS what, r.at AS at
	47	FROM telemetry_read r JOIN user u ON u.id = r.user_id ORDER BY r.id DESC LIMIT ?1`,
	48	)
	49	.all(limit);
	50	}
		@@ -15,22 +15,22 @@ export interface ConflictedPull {
15	15	readonly since: string;
16	16	}
17	17
18		/** Oldest first. */
19		export function conflictedPulls(db: Database): ConflictedPull[] {
	18	/** Oldest first; `publicOnly` leaves out private repositories, for a reader who must not learn their names. */
	19	export function conflictedPulls(db: Database, publicOnly = false): ConflictedPull[] {
20	20	return db
21		.query<ConflictedPull, []>(
	21	.query<ConflictedPull, [number]>(
22	22	`SELECT o.username \|\| '/' \|\| r.name AS repo, i.number AS number,
23	23	MIN(u.created_at) AS since
24	24	FROM run u JOIN issue i ON i.id = u.issue_id
25	25	JOIN pull p ON p.issue_id = i.id JOIN repo r ON r.id = i.repo_id JOIN user o ON o.id = r.owner_id
26	26	WHERE u.kind = 'agent' AND u.reason = 'conflict' AND i.state = 'open'
27		AND p.merged_at IS NULL
	27	AND p.merged_at IS NULL AND (?1 = 0 OR r.visibility = 'public')
28	28	AND (SELECT state FROM run n WHERE n.issue_id = i.id AND n.kind = 'agent'
29	29	AND n.reason = 'conflict' ORDER BY n.created_at DESC, n.id DESC LIMIT 1)
30	30	IN ('queued','running','failed')
31	31	GROUP BY i.id ORDER BY since`,
32	32	)
33		.all();
	33	.all(publicOnly ? 1 : 0);
34	34	}
35	35
36	36	/** One sentence for /flow, or null when none is conflicted. */
		@@ -58,6 +58,8 @@ import { reissueDoor, spawnDoor } from "../spawn/door.ts";
58	58	import { listSecrets, putSecret, removeSecret } from "../actions/secrets.ts";
59	59	import { proposeUpstream } from "../actions/upstream.ts";
60	60	import { relationOf, takeUpdates } from "../actions/forks.ts";
	61	import { noteRead, telemetryReader, type Reader } from "../actions/telemetry.ts";
	62	import { flowFor, historyFor, sourcesOut, systemFor, welcome } from "../system/telemetry.ts";
61	63	import { convergeFork, convergeState } from "../crew/converge.ts";
62	64	import { markReaders, mayDirectCrew } from "../crew/direct.ts";
63	65	import {
		@@ -1325,6 +1327,26 @@ export function apiRoutes(router: Router<Handler>): void {
1325	1327	: forbidden();
1326	1328	};
1327	1329
	1330	// Open read hooks (#1789): the owner, or an agent holding `telemetry:read`.
	1331	// Anyone else is refused; every agent read is logged.
	1332	const telemetryRead =
	1333	(what: string, out: (ctx: Ctx, reader: Reader) => unknown) =>
	1334	(ctx: Ctx): Response => {
	1335	if (!ctx.auth.user) return unauthorized();
	1336	const denied = requireScope(ctx, "ro");
	1337	if (denied) return denied;
	1338	const reader = telemetryReader(ctx.app, ctx.auth.user);
	1339	if (!reader) return forbidden();
	1340	noteRead(ctx.app, ctx.auth.user, reader, what);
	1341	return json(out(ctx, reader));
	1342	};
	1343	router.add("GET", "/api/v1/telemetry/system", telemetryRead("system", (c, r) => systemFor(c.app, r)));
	1344	router.add("GET", "/api/v1/telemetry/flow", telemetryRead("flow", (c, r) => flowFor(c.app, r)));
	1345	router.add("GET", "/api/v1/telemetry/sources", telemetryRead("sources", () => ({ sources: sourcesOut() })));
	1346	router.add("GET", "/api/v1/telemetry/history", telemetryRead("history", (c) => ({ points: historyFor(c.app) })));
	1347	// The funnel: what any agent that arrives should know. Open to all.
	1348	router.add("GET", "/api/v1/contribute", (ctx) => json(welcome(ctx.app)));
	1349
1328	1350	router.add("GET", "/api/v1/boards/sources", (ctx) => {
1329	1351	const denied = boardsAdmin(ctx);
1330	1352	if (denied) return denied;
		@@ -21,10 +21,6 @@ import { voteVariant } from "../actions/variants.ts";
21	21	import { mayView, mayViewId, sealedScope } from "../core/sealed.ts";
22	22	import { listAccess } from "../actions/access_log.ts";
23	23	import { changeCapacity, listCapacity } from "../actions/capacity.ts";
24		import { conflictedPulls, conflictedSays } from "../flow/conflicted.ts";
25		import { readPipeline, verdict } from "../flow/pipeline.ts";
26		import { readQueues } from "../flow/queue.ts";
27		import { readThroughput, stageOut, throughputSays } from "../flow/throughput.ts";
28	24	import { changeLimit, listLimits } from "../actions/limits.ts";
29	25	import { changeQuotas, readQuotas } from "../actions/quotas.ts";
30	26	import { QUOTA_KEYS } from "../settings/quotas.ts";
		@@ -147,6 +143,8 @@ import {
147	143	} from "../actions/explore.ts";
148	144	import { frontInput, frontJson, setFront } from "../actions/front.ts";
149	145	import { readHealth } from "../actions/health.ts";
	146	import { noteRead, telemetryReader } from "../actions/telemetry.ts";
	147	import { flowFor, systemFor, welcome } from "../system/telemetry.ts";
150	148	import { running } from "../kernel/version.ts";
151	149	import { parentForgeFor } from "../core/parent_releases.ts";
152	150	import { COPIES_PER_DAY, makeItYours } from "../actions/make_it_yours.ts";
		@@ -2077,28 +2075,35 @@ const TOOLS: readonly Tool[] = [
2077	2075	inputSchema: { type: "object", properties: {} },
2078	2076	writes: false,
2079	2077	run(ctx, user) {
2080		if (!user.isAdmin)
2081		return bad("forbidden", "only an admin of this forge reads its pipeline");
2082		const now = new Date();
2083		const stages = readPipeline(ctx.app.db, now);
2084		const flow = readThroughput(ctx.app.db, stages.map((s) => s.key), now);
2085		const conflicted = conflictedPulls(ctx.app.db);
2086		return good({
2087		says: verdict(stages, now.getTime()),
2088		conflicted: {
2089		says: conflictedSays(conflicted, now.getTime()),
2090		pulls: conflicted,
2091		},
2092		stages,
2093		throughput: {
2094		says: throughputSays(flow),
2095		medianAskToLiveMs: flow.medianAskToLiveMs,
2096		stages: flow.stages.map(stageOut),
2097		},
2098		queue: readQueues(ctx.app.db, now),
2099		});
	2078	const reader = telemetryReader(ctx.app, user);
	2079	if (!reader)
	2080	return bad("forbidden", "only an admin of this forge, or an agent granted telemetry:read, reads its pipeline");
	2081	noteRead(ctx.app, user, reader, "flow");
	2082	return good(flowFor(ctx.app, reader));
2100	2083	},
2101	2084	},
	2085	{
	2086	name: "system",
	2087	description:
	2088	"The machine the forge runs on, now: per-core CPU, temperatures, load, memory, disk per mount, network, and every process grouped by what launched it (which check, which app), each group with CPU cores, memory and age; and the test files running in more than one check at once (duplicates). For a forge admin, or an agent granted telemetry:read — whose view cuts out private repositories' checks and apps. Read-only; the same as /system and /api/v1/telemetry/system.",
	2089	inputSchema: { type: "object", properties: {} },
	2090	writes: false,
	2091	run(ctx, user) {
	2092	const reader = telemetryReader(ctx.app, user);
	2093	if (!reader)
	2094	return bad("forbidden", "only an admin of this forge, or an agent granted telemetry:read, reads its machine");
	2095	noteRead(ctx.app, user, reader, "system");
	2096	return good(systemFor(ctx.app, reader));
	2097	},
	2098	},
	2099	{
	2100	name: "contribute",
	2101	description:
	2102	"For any agent that arrives: what this forge is, where its bottleneck is right now, the open issues in public repositories labelled “help wanted” that welcome outside work, and how to propose (fork, pull, the gate it must pass). Open to every caller.",
	2103	inputSchema: { type: "object", properties: {} },
	2104	writes: false,
	2105	run: (ctx) => good(welcome(ctx.app)),
	2106	},
2102	2107	{
2103	2108	name: "limits",
2104	2109	description:
		@@ -11,11 +11,13 @@ import { unsealReleased } from "../actions/sealed.ts";
11	11	import { accessPage } from "../web/pages/access.ts";
12	12	import { capacityPage, capacitySet } from "../web/pages/capacity.ts";
13	13	import { flowPage } from "../web/pages/flow.ts";
	14	import { systemPage } from "../web/pages/system.ts";
	15	import { telemetryPage, telemetrySet } from "../web/pages/telemetry.ts";
	16	import { contributePage } from "../web/pages/contribute.ts";
14	17	import { flagsPage, flagsSet } from "../web/pages/flags.ts";
15	18	import { domainsPage } from "../web/pages/domains.ts";
16	19	import { resiliencePage } from "../web/pages/resilience.ts";
17	20	import { limitsPage, limitsSet, quotasSet } from "../web/pages/admin-limits.ts";
18		import { systemPage } from "../web/pages/system.ts";
19	21	import { boardsPage } from "../web/pages/boards.ts";
20	22	import { boardNew, boardPin, boardPost } from "../web/pages/boards-edit.ts";
21	23	import { boardLive, boardShow, boardsList } from "../web/pages/boards-view.ts";
		@@ -667,6 +669,10 @@ export function buildRouter(): Router<Handler> {
667	669	router.add("GET", "/map", globalMapPage);
668	670	// The pipeline's stages and its bottleneck, for a forge admin (#1554); literal, above /:owner.
669	671	router.add("GET", "/flow", flowPage);
	672	router.add("GET", "/system", systemPage);
	673	router.add("GET", "/contribute", contributePage);
	674	router.add("GET", "/settings/telemetry", telemetryPage);
	675	router.add("POST", "/settings/telemetry", telemetrySet);
670	676	// Each THREATS.md protection against the last gate; literal, above /:owner.
671	677	router.add("GET", "/resilience", resiliencePage);
672	678	// A selection's spend and runs over time; literal, above /:owner.
		@@ -745,7 +751,6 @@ export function buildRouter(): Router<Handler> {
745	751	router.add("GET", "/settings/resilience", domainsPage);
746	752	router.add("GET", "/settings/capacity", capacityPage);
747	753	router.add("POST", "/settings/capacity", capacitySet);
748		router.add("GET", "/system", systemPage);
749	754	router.add("GET", "/boards", boardsList);
750	755	router.add("GET", "/boards/data", boardsPage);
751	756	router.add("POST", "/boards/new", boardNew);