@camstack/addon-terminal 0.1.27 → 0.1.29

package/dist/addon.js

@@ -31,7 +31,7 @@ let node_module = require("node:module");
 let sharp = require("sharp");
 sharp = __toESM(sharp);
 let node_http = require("node:http");
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -47,6 +47,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -19025,6 +19034,12 @@ var CameraStatusSchema = object({
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
+var InferenceDeviceExclusionReasonSchema = _enum([
+	"disabled",
+	"unavailable",
+	"cannot-host-camera-root",
+	"accelerator-preferred"
+]);
 var NodeInferenceDeviceSchema = object({
 	/** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
 	key: string(),
@@ -19055,7 +19070,17 @@ var NodeInferenceDeviceSchema = object({
 	* available per format; this is the stored selection that becomes the
 	* default for EVERY camera landing on this accelerator.
 	*/
-	steps: record(string(), DeviceStepConfigSchema).optional()
+	steps: record(string(), DeviceStepConfigSchema).optional(),
+	/**
+	* `null` when the device IS a camera-root candidate on this node; otherwise
+	* the reason the dispatcher drops it. Computed by the SAME
+	* `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+	* never disagree with the election — deriving it in the UI from
+	* `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+	* the node's model catalog) and `accelerator-preferred` (needs the node-wide
+	* "an accelerator is serving" predicate).
+	*/
+	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
@@ -24053,7 +24078,12 @@ var ListResultSchema = object({
 	probedAt: number()
 });
 var PreferredSchema = LocalInterfaceSchema.nullable();
-var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
+/**
+* Candidate base URL for the SDK to race on connect. Order matters —
+* the SDK should attempt these top-to-bottom with a short per-candidate
+* timeout (e.g. 1500ms) and cache the winner for the session.
+*/
+var ConnectionEndpointSchema = object({
 	/** Operator-facing label (e.g. "LAN — en0", "Public tunnel"). */
 	label: string(),
 	/** Fully-formed base URL with scheme + host + port. */
@@ -24096,7 +24126,42 @@ var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
 	* ordering between polls.
 	*/
 	priority: number()
-})).readonly() });
+});
+/**
+* Where the advertised local port came from. Ordered most → least
+* authoritative, and the whole point of returning it: a client must be able to
+* tell a FACT about the hub's socket from an echo of its own guess.
+*/
+var LocalPortSourceEnum = _enum([
+	"server-config",
+	"server-env",
+	"caller-hint",
+	"default"
+]);
+/** The port every LAN/loopback `baseUrl` in the same result was built with. */
+var AdvertisedLocalPortSchema = object({
+	port: number().int().min(1).max(65535),
+	source: LocalPortSourceEnum
+});
+var GetConnectionEndpointsResultSchema = object({
+	endpoints: array(ConnectionEndpointSchema).readonly(),
+	/**
+	* The port the hub built the LAN/loopback URLs with, and where that number
+	* came from.
+	*
+	* Returned rather than merely applied, because "the URL is right" and "the
+	* client can KNOW the URL is right" are different properties. A client that
+	* only sees a corrected URL cannot distinguish a hub that fixed the port from
+	* a hub that echoed the port the client sent, so it cannot decide whether to
+	* race the candidate or discard it. With `source` it can: anything but
+	* `caller-hint` is the hub's own socket.
+	*
+	* Absent on hubs predating this field — a client that finds it missing is
+	* talking to an echoing hub and must degrade exactly as it does for
+	* `caller-hint`.
+	*/
+	localPort: AdvertisedLocalPortSchema
+});
 /**
 * The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
 * AUTO (resolved from the candidate ranking at send time); `resolved` reports
@@ -24117,8 +24182,13 @@ var AllowedAddressesSchema = object({
 */
 addresses: array(string()).readonly() });
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
-	/** Local hub HTTP port to use in base URLs. */
-	port: number().int().min(1).max(65535),
+	/**
+	* LEGACY HINT — do not send from new code. Kept optional so clients
+	* written against the echoing contract keep working; the hub uses it
+	* only when it cannot read its own port, and says so via
+	* `localPort.source === 'caller-hint'`.
+	*/
+	port: number().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
 	*  candidate. Default `true`. */
 	includeLoopback: boolean().optional(),
@@ -44216,6 +44286,38 @@ var TerminalSessionManager = class {
 * (`node-pty`) and should update via `camstack deploy` independently of the
 * framework, exactly like the node-av decoder addon.
 */
+/**
+* Default argv for the Glances profile — deliberately EMPTY.
+*
+* Measured on the hub (2026-08-21, glances 4.5.6, embedded Python, a real pty
+* at the terminal camera's own 120x40 grid, CPU sampled from
+* /proc/<pid>/{utime,stime} so the number is the process's own and not the
+* box's contention):
+*
+*   argv                                                 CPU (of one core)
+*   (none — this default)                                0.8 %
+*   -t 3                                                 0.7 %
+*   -t 5                                                 0.6 %
+*   --disable-plugin processlist                         0.7 %
+*   --disable-plugin containers                          0.9 %
+*   --disable-plugin sensors                             0.8 %
+*   --disable-process                                    0.8 %
+*   -t 3 --disable-plugin processlist,containers,sensors 0.5 %
+*   -t 5 --disable-plugin processlist,containers,sensors 0.4 %
+*
+* Startup costs 0.19 core-seconds; steady state is 1.0 % of one core at 36 MB
+* RSS. The whole tuning range is worth ~0.4 % of ONE core out of 20 — below the
+* noise floor of a box that idles at 2.6 cores — while every entry that buys
+* something removes a panel the operator opened the camera to read. `-t` is
+* additionally counter-productive here: the terminal camera renders at 2 FPS
+* and glances already repaints every 2 s, so slowing glances only makes the
+* camera show stale numbers.
+*
+* So the default ships empty and the knob stays in front of the operator.
+* Anyone who does want to trade panels for CPU has the numbers above.
+*/
+var DEFAULT_GLANCES_ARGS = [];
+var GLANCES_ARGS_DESCRIPTION = "Exact arguments passed to Glances. One tag per argv entry. Empty is the measured-best default: at the camera grid Glances costs ~1% of one core, and the cheapest tuning found (`-t 5 --disable-plugin processlist,containers,sensors`) saves only ~0.4% of one core while removing the panels most people open it for. `-t` also makes the camera show stale numbers — it renders at 2 FPS and Glances already repaints every 2s.";
 var DEFAULTS = {
 	btmPath: "",
 	btmEnabled: true,
@@ -44225,7 +44327,7 @@ var DEFAULTS = {
 	topArgs: [],
 	glancesEnabled: true,
 	glancesPath: "",
-	glancesArgs: [],
+	glancesArgs: DEFAULT_GLANCES_ARGS,
 	allowShell: false,
 	shellPath: "",
 	maxSessions: 4,
@@ -44612,85 +44714,13 @@ var TerminalAddon = class extends BaseAddon {
 		return this.instanceInfo(instance);
 	}
 	globalSettingsSchema() {
-		return this.schema({ sections: [{
-			id: "terminal",
-			title: "Terminal",
-			description: "Interactive terminal sessions in the Admin UI. Only pre-declared profiles can be opened; a free-form command is never accepted.",
-			columns: 2,
-			fields: [
-				this.field({
-					type: "boolean",
-					key: "btmEnabled",
-					label: "Enable BTM camera",
-					default: true,
-					perNode: true
-				}),
-				this.field({
-					type: "text",
-					key: "btmPath",
-					label: "BTM binary",
-					description: "Path to the `btm` (bottom) executable. Leave empty to resolve from PATH.",
-					placeholder: "btm",
-					default: "",
-					perNode: true
-				}),
-				this.field({
-					type: "tags",
-					key: "btmArgs",
-					label: "BTM arguments",
-					description: "Exact arguments passed to btm.",
-					default: [],
-					perNode: true
-				}),
-				this.field({
-					type: "boolean",
-					key: "topEnabled",
-					label: "Enable Top camera",
-					default: true,
-					perNode: true
-				}),
-				this.field({
-					type: "text",
-					key: "topPath",
-					label: "Top binary",
-					placeholder: "top",
-					default: "",
-					perNode: true
-				}),
-				this.field({
-					type: "tags",
-					key: "topArgs",
-					label: "Top arguments",
-					description: "Exact arguments passed to top.",
-					default: [],
-					perNode: true
-				}),
-				this.field({
-					type: "boolean",
-					key: "glancesEnabled",
-					label: "Enable Glances camera",
-					description: "Glances is installed automatically into CamStack embedded Python.",
-					default: true,
-					perNode: true
-				}),
-				this.field({
-					type: "text",
-					key: "glancesPath",
-					label: "Glances binary override",
-					description: "Optional executable override. Empty uses the automatically managed Python package.",
-					placeholder: "glances",
-					default: "",
-					perNode: true
-				}),
-				this.field({
-					type: "tags",
-					key: "glancesArgs",
-					label: "Glances arguments",
-					description: "Exact arguments passed to Glances.",
-					default: [],
-					perNode: true
-				}),
-				this.field({
+		return this.schema({ sections: [
+			{
+				id: "terminal",
+				title: "Terminal",
+				description: "Interactive terminal sessions in the Admin UI. Only pre-declared profiles can be opened; a free-form command is never accepted. Every setting below is per node — the values you see belong to the node selected above.",
+				columns: 2,
+				fields: [this.field({
 					type: "number",
 					key: "maxSessions",
 					label: "Max concurrent sessions",
@@ -44699,16 +44729,122 @@ var TerminalAddon = class extends BaseAddon {
 					step: 1,
 					default: 4,
 					perNode: true
-				}),
-				this.field({
+				})]
+			},
+			{
+				id: "terminal-btm",
+				title: "BTM camera",
+				description: "bottom (btm) — CPU, memory, network and process monitor.",
+				columns: 2,
+				fields: [
+					this.field({
+						type: "boolean",
+						key: "btmEnabled",
+						label: "Enabled",
+						description: "Offer the BTM profile on this node.",
+						default: true,
+						perNode: true
+					}),
+					this.field({
+						type: "text",
+						key: "btmPath",
+						label: "Binary",
+						description: "Path to the `btm` (bottom) executable. Leave empty to resolve from PATH.",
+						placeholder: "btm",
+						default: "",
+						perNode: true
+					}),
+					this.field({
+						type: "tags",
+						key: "btmArgs",
+						label: "Arguments",
+						description: "Exact arguments passed to btm. One tag per argv entry.",
+						default: [],
+						perNode: true,
+						span: 2
+					})
+				]
+			},
+			{
+				id: "terminal-top",
+				title: "Top camera",
+				description: "The operating system process and resource monitor.",
+				columns: 2,
+				fields: [
+					this.field({
+						type: "boolean",
+						key: "topEnabled",
+						label: "Enabled",
+						description: "Offer the Top profile on this node.",
+						default: true,
+						perNode: true
+					}),
+					this.field({
+						type: "text",
+						key: "topPath",
+						label: "Binary",
+						placeholder: "top",
+						default: "",
+						perNode: true
+					}),
+					this.field({
+						type: "tags",
+						key: "topArgs",
+						label: "Arguments",
+						description: "Exact arguments passed to top. One tag per argv entry.",
+						default: [],
+						perNode: true,
+						span: 2
+					})
+				]
+			},
+			{
+				id: "terminal-glances",
+				title: "Glances camera",
+				description: "Cross-platform curses monitor, installed automatically into CamStack embedded Python. Glances is the most expensive built-in profile — it only runs while somebody is watching, but while it runs it costs real CPU. See the Arguments help below before widening it.",
+				columns: 2,
+				fields: [
+					this.field({
+						type: "boolean",
+						key: "glancesEnabled",
+						label: "Enabled",
+						description: "Offer the Glances profile on this node.",
+						default: true,
+						perNode: true
+					}),
+					this.field({
+						type: "text",
+						key: "glancesPath",
+						label: "Binary override",
+						description: "Optional executable override. Empty uses the automatically managed Python package.",
+						placeholder: "glances",
+						default: "",
+						perNode: true
+					}),
+					this.field({
+						type: "tags",
+						key: "glancesArgs",
+						label: "Arguments",
+						description: GLANCES_ARGS_DESCRIPTION,
+						default: [...DEFAULT_GLANCES_ARGS],
+						perNode: true,
+						span: 2
+					})
+				]
+			},
+			{
+				id: "terminal-shell",
+				title: "Interactive shell",
+				description: "The one profile that is genuinely a command surface. Off by default; turning it on grants command execution as the server user to every admin.",
+				columns: 2,
+				fields: [this.field({
 					type: "boolean",
 					key: "allowShell",
 					label: "Allow interactive shell",
-					description: "Adds a \"Shell\" profile that grants command execution as the server user. Off by default.",
+					description: "Adds a \"Shell\" profile on this node.",
 					default: false,
 					perNode: true
-				}),
-				this.field({
+				}), this.field({
 					type: "text",
 					key: "shellPath",
 					label: "Shell binary",
@@ -44716,89 +44852,90 @@ var TerminalAddon = class extends BaseAddon {
 					placeholder: "/bin/bash",
 					default: "",
 					perNode: true
-				})
-			]
-		}, {
-			id: "terminal-profiles",
-			title: "Custom profiles",
-			description: "Enabled profiles are available templates on this node. Create a Terminal instance on the Terminal page to declare a camera; session requests only carry the profile ID and commands cannot be overridden by clients.",
-			columns: 1,
-			fields: [this.field({
-				type: "editable-array",
-				key: "customProfiles",
-				label: "Profiles",
-				perNode: true,
-				default: [],
-				maxRows: 32,
-				addLabel: "Add profile",
-				emptyMessage: "No custom profiles configured.",
-				rowTitleTemplate: "{label} — {executable}",
-				defaultItem: {
-					enabled: true,
-					profileId: "",
-					label: "",
-					description: "",
-					executable: "",
-					args: [],
-					cwd: "",
-					environment: []
-				},
-				itemFields: [
-					{
-						type: "boolean",
-						key: "enabled",
-						label: "Enabled",
-						default: true
-					},
-					{
-						type: "text",
-						key: "profileId",
-						label: "Profile ID",
-						description: "Stable lowercase slug, for example gpu-monitor.",
-						required: true
-					},
-					{
-						type: "text",
-						key: "label",
-						label: "Display name",
-						required: true
-					},
-					{
-						type: "textarea",
-						key: "description",
-						label: "Description",
-						rows: 2
-					},
-					{
-						type: "text",
-						key: "executable",
-						label: "Executable",
-						description: "Absolute path or a binary resolved from PATH.",
-						required: true
-					},
-					{
-						type: "tags",
-						key: "args",
-						label: "Arguments",
-						description: "One exact process argument per tag.",
-						maxTags: 64
-					},
-					{
-						type: "text",
-						key: "cwd",
-						label: "Working directory",
-						description: "Optional working directory for this profile."
+				})]
+			},
+			{
+				id: "terminal-profiles",
+				title: "Custom profiles",
+				description: "Enabled profiles are available templates on this node. Create a Terminal instance on the Terminal page to declare a camera; session requests only carry the profile ID and commands cannot be overridden by clients.",
+				columns: 1,
+				fields: [this.field({
+					type: "editable-array",
+					key: "customProfiles",
+					label: "Profiles",
+					perNode: true,
+					default: [],
+					maxRows: 32,
+					addLabel: "Add profile",
+					emptyMessage: "No custom profiles configured.",
+					rowTitleTemplate: "{label} — {executable}",
+					defaultItem: {
+						enabled: true,
+						profileId: "",
+						label: "",
+						description: "",
+						executable: "",
+						args: [],
+						cwd: "",
+						environment: []
 					},
-					{
-						type: "tags",
-						key: "environment",
-						label: "Environment",
-						description: "Optional NAME=value entries merged into the process environment.",
-						maxTags: 64
-					}
-				]
-			})]
-		}] });
+					itemFields: [
+						{
+							type: "boolean",
+							key: "enabled",
+							label: "Enabled",
+							default: true
+						},
+						{
+							type: "text",
+							key: "profileId",
+							label: "Profile ID",
+							description: "Stable lowercase slug, for example gpu-monitor.",
+							required: true
+						},
+						{
+							type: "text",
+							key: "label",
+							label: "Display name",
+							required: true
+						},
+						{
+							type: "textarea",
+							key: "description",
+							label: "Description",
+							rows: 2
+						},
+						{
+							type: "text",
+							key: "executable",
+							label: "Executable",
+							description: "Absolute path or a binary resolved from PATH.",
+							required: true
+						},
+						{
+							type: "tags",
+							key: "args",
+							label: "Arguments",
+							description: "One exact process argument per tag.",
+							maxTags: 64
+						},
+						{
+							type: "text",
+							key: "cwd",
+							label: "Working directory",
+							description: "Optional working directory for this profile."
+						},
+						{
+							type: "tags",
+							key: "environment",
+							label: "Environment",
+							description: "Optional NAME=value entries merged into the process environment.",
+							maxTags: 64
+						}
+					]
+				})]
+			}
+		] });
 	}
 };
 //#endregion

package/dist/addon.mjs

@@ -8,7 +8,7 @@ import { createServer } from "node:http";
 //#region \0rolldown/runtime.js
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 //#endregion
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -24,6 +24,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -19002,6 +19011,12 @@ var CameraStatusSchema = object({
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
+var InferenceDeviceExclusionReasonSchema = _enum([
+	"disabled",
+	"unavailable",
+	"cannot-host-camera-root",
+	"accelerator-preferred"
+]);
 var NodeInferenceDeviceSchema = object({
 	/** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
 	key: string(),
@@ -19032,7 +19047,17 @@ var NodeInferenceDeviceSchema = object({
 	* available per format; this is the stored selection that becomes the
 	* default for EVERY camera landing on this accelerator.
 	*/
-	steps: record(string(), DeviceStepConfigSchema).optional()
+	steps: record(string(), DeviceStepConfigSchema).optional(),
+	/**
+	* `null` when the device IS a camera-root candidate on this node; otherwise
+	* the reason the dispatcher drops it. Computed by the SAME
+	* `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+	* never disagree with the election — deriving it in the UI from
+	* `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+	* the node's model catalog) and `accelerator-preferred` (needs the node-wide
+	* "an accelerator is serving" predicate).
+	*/
+	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
@@ -24030,7 +24055,12 @@ var ListResultSchema = object({
 	probedAt: number()
 });
 var PreferredSchema = LocalInterfaceSchema.nullable();
-var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
+/**
+* Candidate base URL for the SDK to race on connect. Order matters —
+* the SDK should attempt these top-to-bottom with a short per-candidate
+* timeout (e.g. 1500ms) and cache the winner for the session.
+*/
+var ConnectionEndpointSchema = object({
 	/** Operator-facing label (e.g. "LAN — en0", "Public tunnel"). */
 	label: string(),
 	/** Fully-formed base URL with scheme + host + port. */
@@ -24073,7 +24103,42 @@ var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
 	* ordering between polls.
 	*/
 	priority: number()
-})).readonly() });
+});
+/**
+* Where the advertised local port came from. Ordered most → least
+* authoritative, and the whole point of returning it: a client must be able to
+* tell a FACT about the hub's socket from an echo of its own guess.
+*/
+var LocalPortSourceEnum = _enum([
+	"server-config",
+	"server-env",
+	"caller-hint",
+	"default"
+]);
+/** The port every LAN/loopback `baseUrl` in the same result was built with. */
+var AdvertisedLocalPortSchema = object({
+	port: number().int().min(1).max(65535),
+	source: LocalPortSourceEnum
+});
+var GetConnectionEndpointsResultSchema = object({
+	endpoints: array(ConnectionEndpointSchema).readonly(),
+	/**
+	* The port the hub built the LAN/loopback URLs with, and where that number
+	* came from.
+	*
+	* Returned rather than merely applied, because "the URL is right" and "the
+	* client can KNOW the URL is right" are different properties. A client that
+	* only sees a corrected URL cannot distinguish a hub that fixed the port from
+	* a hub that echoed the port the client sent, so it cannot decide whether to
+	* race the candidate or discard it. With `source` it can: anything but
+	* `caller-hint` is the hub's own socket.
+	*
+	* Absent on hubs predating this field — a client that finds it missing is
+	* talking to an echoing hub and must degrade exactly as it does for
+	* `caller-hint`.
+	*/
+	localPort: AdvertisedLocalPortSchema
+});
 /**
 * The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
 * AUTO (resolved from the candidate ranking at send time); `resolved` reports
@@ -24094,8 +24159,13 @@ var AllowedAddressesSchema = object({
 */
 addresses: array(string()).readonly() });
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
-	/** Local hub HTTP port to use in base URLs. */
-	port: number().int().min(1).max(65535),
+	/**
+	* LEGACY HINT — do not send from new code. Kept optional so clients
+	* written against the echoing contract keep working; the hub uses it
+	* only when it cannot read its own port, and says so via
+	* `localPort.source === 'caller-hint'`.
+	*/
+	port: number().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
 	*  candidate. Default `true`. */
 	includeLoopback: boolean().optional(),
@@ -44193,6 +44263,38 @@ var TerminalSessionManager = class {
 * (`node-pty`) and should update via `camstack deploy` independently of the
 * framework, exactly like the node-av decoder addon.
 */
+/**
+* Default argv for the Glances profile — deliberately EMPTY.
+*
+* Measured on the hub (2026-08-21, glances 4.5.6, embedded Python, a real pty
+* at the terminal camera's own 120x40 grid, CPU sampled from
+* /proc/<pid>/{utime,stime} so the number is the process's own and not the
+* box's contention):
+*
+*   argv                                                 CPU (of one core)
+*   (none — this default)                                0.8 %
+*   -t 3                                                 0.7 %
+*   -t 5                                                 0.6 %
+*   --disable-plugin processlist                         0.7 %
+*   --disable-plugin containers                          0.9 %
+*   --disable-plugin sensors                             0.8 %
+*   --disable-process                                    0.8 %
+*   -t 3 --disable-plugin processlist,containers,sensors 0.5 %
+*   -t 5 --disable-plugin processlist,containers,sensors 0.4 %
+*
+* Startup costs 0.19 core-seconds; steady state is 1.0 % of one core at 36 MB
+* RSS. The whole tuning range is worth ~0.4 % of ONE core out of 20 — below the
+* noise floor of a box that idles at 2.6 cores — while every entry that buys
+* something removes a panel the operator opened the camera to read. `-t` is
+* additionally counter-productive here: the terminal camera renders at 2 FPS
+* and glances already repaints every 2 s, so slowing glances only makes the
+* camera show stale numbers.
+*
+* So the default ships empty and the knob stays in front of the operator.
+* Anyone who does want to trade panels for CPU has the numbers above.
+*/
+var DEFAULT_GLANCES_ARGS = [];
+var GLANCES_ARGS_DESCRIPTION = "Exact arguments passed to Glances. One tag per argv entry. Empty is the measured-best default: at the camera grid Glances costs ~1% of one core, and the cheapest tuning found (`-t 5 --disable-plugin processlist,containers,sensors`) saves only ~0.4% of one core while removing the panels most people open it for. `-t` also makes the camera show stale numbers — it renders at 2 FPS and Glances already repaints every 2s.";
 var DEFAULTS = {
 	btmPath: "",
 	btmEnabled: true,
@@ -44202,7 +44304,7 @@ var DEFAULTS = {
 	topArgs: [],
 	glancesEnabled: true,
 	glancesPath: "",
-	glancesArgs: [],
+	glancesArgs: DEFAULT_GLANCES_ARGS,
 	allowShell: false,
 	shellPath: "",
 	maxSessions: 4,
@@ -44589,85 +44691,13 @@ var TerminalAddon = class extends BaseAddon {
 		return this.instanceInfo(instance);
 	}
 	globalSettingsSchema() {
-		return this.schema({ sections: [{
-			id: "terminal",
-			title: "Terminal",
-			description: "Interactive terminal sessions in the Admin UI. Only pre-declared profiles can be opened; a free-form command is never accepted.",
-			columns: 2,
-			fields: [
-				this.field({
-					type: "boolean",
-					key: "btmEnabled",
-					label: "Enable BTM camera",
-					default: true,
-					perNode: true
-				}),
-				this.field({
-					type: "text",
-					key: "btmPath",
-					label: "BTM binary",
-					description: "Path to the `btm` (bottom) executable. Leave empty to resolve from PATH.",
-					placeholder: "btm",
-					default: "",
-					perNode: true
-				}),
-				this.field({
-					type: "tags",
-					key: "btmArgs",
-					label: "BTM arguments",
-					description: "Exact arguments passed to btm.",
-					default: [],
-					perNode: true
-				}),
-				this.field({
-					type: "boolean",
-					key: "topEnabled",
-					label: "Enable Top camera",
-					default: true,
-					perNode: true
-				}),
-				this.field({
-					type: "text",
-					key: "topPath",
-					label: "Top binary",
-					placeholder: "top",
-					default: "",
-					perNode: true
-				}),
-				this.field({
-					type: "tags",
-					key: "topArgs",
-					label: "Top arguments",
-					description: "Exact arguments passed to top.",
-					default: [],
-					perNode: true
-				}),
-				this.field({
-					type: "boolean",
-					key: "glancesEnabled",
-					label: "Enable Glances camera",
-					description: "Glances is installed automatically into CamStack embedded Python.",
-					default: true,
-					perNode: true
-				}),
-				this.field({
-					type: "text",
-					key: "glancesPath",
-					label: "Glances binary override",
-					description: "Optional executable override. Empty uses the automatically managed Python package.",
-					placeholder: "glances",
-					default: "",
-					perNode: true
-				}),
-				this.field({
-					type: "tags",
-					key: "glancesArgs",
-					label: "Glances arguments",
-					description: "Exact arguments passed to Glances.",
-					default: [],
-					perNode: true
-				}),
-				this.field({
+		return this.schema({ sections: [
+			{
+				id: "terminal",
+				title: "Terminal",
+				description: "Interactive terminal sessions in the Admin UI. Only pre-declared profiles can be opened; a free-form command is never accepted. Every setting below is per node — the values you see belong to the node selected above.",
+				columns: 2,
+				fields: [this.field({
 					type: "number",
 					key: "maxSessions",
 					label: "Max concurrent sessions",
@@ -44676,16 +44706,122 @@ var TerminalAddon = class extends BaseAddon {
 					step: 1,
 					default: 4,
 					perNode: true
-				}),
-				this.field({
+				})]
+			},
+			{
+				id: "terminal-btm",
+				title: "BTM camera",
+				description: "bottom (btm) — CPU, memory, network and process monitor.",
+				columns: 2,
+				fields: [
+					this.field({
+						type: "boolean",
+						key: "btmEnabled",
+						label: "Enabled",
+						description: "Offer the BTM profile on this node.",
+						default: true,
+						perNode: true
+					}),
+					this.field({
+						type: "text",
+						key: "btmPath",
+						label: "Binary",
+						description: "Path to the `btm` (bottom) executable. Leave empty to resolve from PATH.",
+						placeholder: "btm",
+						default: "",
+						perNode: true
+					}),
+					this.field({
+						type: "tags",
+						key: "btmArgs",
+						label: "Arguments",
+						description: "Exact arguments passed to btm. One tag per argv entry.",
+						default: [],
+						perNode: true,
+						span: 2
+					})
+				]
+			},
+			{
+				id: "terminal-top",
+				title: "Top camera",
+				description: "The operating system process and resource monitor.",
+				columns: 2,
+				fields: [
+					this.field({
+						type: "boolean",
+						key: "topEnabled",
+						label: "Enabled",
+						description: "Offer the Top profile on this node.",
+						default: true,
+						perNode: true
+					}),
+					this.field({
+						type: "text",
+						key: "topPath",
+						label: "Binary",
+						placeholder: "top",
+						default: "",
+						perNode: true
+					}),
+					this.field({
+						type: "tags",
+						key: "topArgs",
+						label: "Arguments",
+						description: "Exact arguments passed to top. One tag per argv entry.",
+						default: [],
+						perNode: true,
+						span: 2
+					})
+				]
+			},
+			{
+				id: "terminal-glances",
+				title: "Glances camera",
+				description: "Cross-platform curses monitor, installed automatically into CamStack embedded Python. Glances is the most expensive built-in profile — it only runs while somebody is watching, but while it runs it costs real CPU. See the Arguments help below before widening it.",
+				columns: 2,
+				fields: [
+					this.field({
+						type: "boolean",
+						key: "glancesEnabled",
+						label: "Enabled",
+						description: "Offer the Glances profile on this node.",
+						default: true,
+						perNode: true
+					}),
+					this.field({
+						type: "text",
+						key: "glancesPath",
+						label: "Binary override",
+						description: "Optional executable override. Empty uses the automatically managed Python package.",
+						placeholder: "glances",
+						default: "",
+						perNode: true
+					}),
+					this.field({
+						type: "tags",
+						key: "glancesArgs",
+						label: "Arguments",
+						description: GLANCES_ARGS_DESCRIPTION,
+						default: [...DEFAULT_GLANCES_ARGS],
+						perNode: true,
+						span: 2
+					})
+				]
+			},
+			{
+				id: "terminal-shell",
+				title: "Interactive shell",
+				description: "The one profile that is genuinely a command surface. Off by default; turning it on grants command execution as the server user to every admin.",
+				columns: 2,
+				fields: [this.field({
 					type: "boolean",
 					key: "allowShell",
 					label: "Allow interactive shell",
-					description: "Adds a \"Shell\" profile that grants command execution as the server user. Off by default.",
+					description: "Adds a \"Shell\" profile on this node.",
 					default: false,
 					perNode: true
-				}),
-				this.field({
+				}), this.field({
 					type: "text",
 					key: "shellPath",
 					label: "Shell binary",
@@ -44693,89 +44829,90 @@ var TerminalAddon = class extends BaseAddon {
 					placeholder: "/bin/bash",
 					default: "",
 					perNode: true
-				})
-			]
-		}, {
-			id: "terminal-profiles",
-			title: "Custom profiles",
-			description: "Enabled profiles are available templates on this node. Create a Terminal instance on the Terminal page to declare a camera; session requests only carry the profile ID and commands cannot be overridden by clients.",
-			columns: 1,
-			fields: [this.field({
-				type: "editable-array",
-				key: "customProfiles",
-				label: "Profiles",
-				perNode: true,
-				default: [],
-				maxRows: 32,
-				addLabel: "Add profile",
-				emptyMessage: "No custom profiles configured.",
-				rowTitleTemplate: "{label} — {executable}",
-				defaultItem: {
-					enabled: true,
-					profileId: "",
-					label: "",
-					description: "",
-					executable: "",
-					args: [],
-					cwd: "",
-					environment: []
-				},
-				itemFields: [
-					{
-						type: "boolean",
-						key: "enabled",
-						label: "Enabled",
-						default: true
-					},
-					{
-						type: "text",
-						key: "profileId",
-						label: "Profile ID",
-						description: "Stable lowercase slug, for example gpu-monitor.",
-						required: true
-					},
-					{
-						type: "text",
-						key: "label",
-						label: "Display name",
-						required: true
-					},
-					{
-						type: "textarea",
-						key: "description",
-						label: "Description",
-						rows: 2
-					},
-					{
-						type: "text",
-						key: "executable",
-						label: "Executable",
-						description: "Absolute path or a binary resolved from PATH.",
-						required: true
-					},
-					{
-						type: "tags",
-						key: "args",
-						label: "Arguments",
-						description: "One exact process argument per tag.",
-						maxTags: 64
-					},
-					{
-						type: "text",
-						key: "cwd",
-						label: "Working directory",
-						description: "Optional working directory for this profile."
+				})]
+			},
+			{
+				id: "terminal-profiles",
+				title: "Custom profiles",
+				description: "Enabled profiles are available templates on this node. Create a Terminal instance on the Terminal page to declare a camera; session requests only carry the profile ID and commands cannot be overridden by clients.",
+				columns: 1,
+				fields: [this.field({
+					type: "editable-array",
+					key: "customProfiles",
+					label: "Profiles",
+					perNode: true,
+					default: [],
+					maxRows: 32,
+					addLabel: "Add profile",
+					emptyMessage: "No custom profiles configured.",
+					rowTitleTemplate: "{label} — {executable}",
+					defaultItem: {
+						enabled: true,
+						profileId: "",
+						label: "",
+						description: "",
+						executable: "",
+						args: [],
+						cwd: "",
+						environment: []
 					},
-					{
-						type: "tags",
-						key: "environment",
-						label: "Environment",
-						description: "Optional NAME=value entries merged into the process environment.",
-						maxTags: 64
-					}
-				]
-			})]
-		}] });
+					itemFields: [
+						{
+							type: "boolean",
+							key: "enabled",
+							label: "Enabled",
+							default: true
+						},
+						{
+							type: "text",
+							key: "profileId",
+							label: "Profile ID",
+							description: "Stable lowercase slug, for example gpu-monitor.",
+							required: true
+						},
+						{
+							type: "text",
+							key: "label",
+							label: "Display name",
+							required: true
+						},
+						{
+							type: "textarea",
+							key: "description",
+							label: "Description",
+							rows: 2
+						},
+						{
+							type: "text",
+							key: "executable",
+							label: "Executable",
+							description: "Absolute path or a binary resolved from PATH.",
+							required: true
+						},
+						{
+							type: "tags",
+							key: "args",
+							label: "Arguments",
+							description: "One exact process argument per tag.",
+							maxTags: 64
+						},
+						{
+							type: "text",
+							key: "cwd",
+							label: "Working directory",
+							description: "Optional working directory for this profile."
+						},
+						{
+							type: "tags",
+							key: "environment",
+							label: "Environment",
+							description: "Optional NAME=value entries merged into the process environment.",
+							maxTags: 64
+						}
+					]
+				})]
+			}
+		] });
 	}
 };
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-terminal",
-  "version": "0.1.27",
+  "version": "0.1.29",
   "description": "Interactive terminal sessions (pty + xterm) as a CamStack addon",
   "keywords": [
     "camstack",