The forge says how it is at /api/v1/health: disk, memory, queue, stuck runs, apps asleep and previews, as one plain answer #352

GET /api/v1/health now returns the forge's standing to a site admin. The new tests in test/vitals.test.ts pass (4 tests). I did not run the full check: bun x tsc --noEmit fails here because it can't find the bun type definitions, so the type-check part of forge.json's check is unverified.

What changed

• Module: src/kernel/vitals.ts builds { ok, needs, disk, memory, queue, stuck, apps, at } from the db. Disk comes from statfsSync on the FORGE_DATA volume, and memory from process.memoryUsage() and os. Nothing shells out.
• Queries: src/core/runs.ts gains queueDepth (one grouped count by kind) and listRunning (one joined query for repo and issue number). The builder uses a fixed two queries however many runs exist. A test asserts the count stays the same after 40 more runs.
• Stuck and queue bounds: a run is stuck when it is running with a lapsed lease (leaseLapsed with STALE_AFTER_MS) or has been running over 6 hours. A queue is flagged when its oldest run has waited over 30 minutes; runs paused by not_before are not counted as waiting.
• Other needs sentences: disk under 10% free, and a stuck run.
• Route: src/http/api.ts returns 404 to anyone who isn't a site admin, including anonymous callers and non-admin tokens. A session or any token scope works for an admin, since the route only reads. /healthz is unchanged.
• Docs and check: docs/ARCHITECTURE.md names the route. I added test/vitals.test.ts to forge.json's check.

Apps counts

• The apps counts come from the in-memory runtime, so the builder takes the environments as an input, not from the db.
• serving and asleep count production environments only; previews counts every non-production environment.
• With no runtime up, all three are 0.

Left out

• Caching across requests.
• Any page work.
• A configurable bound for the 6-hour and 30-minute limits; they are constants for now.

Try it: run the forge, then curl -H "authorization: Bearer $ADMIN_TOKEN" $FORGE_URL/api/v1/health. A non-admin token gets 404. bun test test/vitals.test.ts covers the shape, the admin gate, a stuck run in stuck and needs, and a full queue.

🤖 Generated with Claude Code

Closes #343

I merged main into the branch and pushed. The only conflict was forge.json. I kept main's version of the check line and added test/vitals.test.ts back to it. forge.json still parses as JSON.

I re-ran only test/vitals.test.ts after the merge, and its 4 tests pass. I did not re-run the full check command (tsc plus the test shards).

src/http/api.ts auto-merged without conflicts. The pull's content is otherwise unchanged: GET /api/v1/health returns the forge's standing to site admins only and 404s for everyone else.