@camstack/server 1.1.71 → 1.1.73

package/dist/core/addon/addon-package.service.js

@@ -36,8 +36,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AddonPackageService = exports.FRAMEWORK_PACKAGES = exports.SYSTEM_PACKAGE = void 0;
 exports.isFrameworkPackage = isFrameworkPackage;
 exports.extractTgzStripped = extractTgzStripped;
-exports.sweepStaleFrameworkBackups = sweepStaleFrameworkBackups;
-exports.swapInFrameworkPackage = swapInFrameworkPackage;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const os = __importStar(require("node:os"));
@@ -911,9 +909,9 @@ class AddonPackageService {
     /**
      * Download the npm tarball for `name@version` as a Buffer.
      *
-     * Wraps the module-level `httpsDownloadTarball` for use by the
-     * lifecycle job engine (TarballFetcher signature). The `signal` is
-     * forwarded to the underlying fetch calls so the AbortController
+     * Resolves the tarball URL from the registry packument, then fetches it,
+     * for use by the lifecycle job engine (TarballFetcher signature). The
+     * `signal` is forwarded to the underlying fetch calls so the AbortController
      * timeout wired in LifecycleJobEngine fires correctly.
      */
     async fetchAddonTarball(name, version, signal) {
@@ -1040,210 +1038,6 @@ class AddonPackageService {
         }));
         return rows;
     }
-    /**
-     * Update one of the framework packages (manifest `camstack.system:
-     * true`) and schedule a hub restart.
-     *
-     * Steps:
-     *   1. Allow-list the package name (refuses anything not framework).
-     *   2. Resolve `'latest'`/`undefined` to a concrete version via `npm view`.
-     *   3. Run `npm install --prefix <appRoot> <name>@<version> --no-save`.
-     *   4. Write a `.restart-pending` marker (kind: `framework-update`).
-     *   5. Emit `system.restarting` event.
-     *   6. `scheduleSelfRestart({ delayMs: 500 })` — gives the cap method
-     *      time to return before the WS drops.
-     *
-     * Returns BEFORE the exit fires so the admin UI receives `restartingAt`
-     * and can pivot to the reconnect overlay.
-     */
-    /**
-     * Install the framework by SWAPPING each package's own directory, exactly
-     * like every addon is installed (download the single-package tarball →
-     * extract → atomic dir swap). We NEVER run `npm install --prefix <appRoot>`.
-     *
-     * Why: `npm install --prefix /data` manages the WHOLE node_modules tree — it
-     * prunes every package not in @camstack/system's closure (the addons +
-     * ui-library), deletes the stray manifest.json, and (via temp-install + merge
-     * variants) can clobber working native bindings. A per-package tarball swap
-     * touches only that package's folder; nothing else can be pruned, deleted, or
-     * corrupted.
-     *
-     * Swaps the @camstack framework packages versioned in lockstep with system:
-     * the pure-JS libs (types, sdk) AND @camstack/shm-ring. shm-ring is native
-     * but SAFE to swap because it ships its compiled `.node` prebuilds INSIDE the
-     * npm tarball (prebuildify + node-gyp-build resolves the matching one at
-     * require-time) — a bare extract is sufficient, no build or download.
-     *
-     * It does NOT swap download/compile-on-install natives such as `better-sqlite3`
-     * (prebuild-install fetches the binary from GitHub releases at install time —
-     * a bare extract would leave it without a binding). Those are third-party,
-     * hoisted, change only across majors, and are updated by an image redeploy.
-     * System's own deps stay exactly where they are, bindings intact.
-     */
-    async installFrameworkPackages(packageName, toVersion, appRoot) {
-        const registry = process.env['CAMSTACK_NPM_REGISTRY'];
-        // @camstack/shm-ring is native but ships prebuilds in its tarball → safe.
-        const lockstepDeps = ['@camstack/types', '@camstack/sdk', '@camstack/shm-ring'];
-        const swapTargets = [packageName, ...lockstepDeps];
-        // Self-heal: a previous run killed mid-swap (e.g. process restart while a
-        // slow download was in flight) can leave a `<pkg>.fw-bak` backup behind.
-        // It's inert (not a valid package the loader picks up) but sweep it so the
-        // tree stays clean.
-        sweepStaleFrameworkBackups(appRoot);
-        const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'camstack-fw-'));
-        try {
-            for (const pkg of swapTargets) {
-                const isPrimary = pkg === packageName;
-                try {
-                    const tgzPath = await packTarball(pkg, toVersion, tmpRoot, registry);
-                    const extractDir = fs.mkdtempSync(path.join(tmpRoot, 'x-'));
-                    await execFileAsync('tar', ['-xzf', tgzPath, '-C', extractDir], { timeout: 60_000 });
-                    const result = swapInFrameworkPackage(path.join(extractDir, 'package'), appRoot);
-                    this.logger.info('updateFrameworkPackage: package swapped', {
-                        meta: { name: result.name, version: result.version },
-                    });
-                }
-                catch (err) {
-                    if (isPrimary)
-                        throw err;
-                    // A lockstep dep may not be published at this exact version (or the
-                    // download flaked) — keep the existing copy rather than fail the whole
-                    // framework update. System is the one that MUST succeed.
-                    this.logger.warn(`updateFrameworkPackage: lockstep dep ${pkg}@${toVersion} not swapped`, {
-                        meta: { error: (0, types_1.errMsg)(err) },
-                    });
-                }
-            }
-        }
-        finally {
-            fs.rmSync(tmpRoot, { recursive: true, force: true });
-        }
-    }
-    /**
-     * Resolve a version specifier (`'latest'`, semver tag, exact) for a
-     * framework package to a concrete version via `npm view`.
-     * Delegates to the module-level `resolveNpmVersion` helper.
-     * Exposed as a public method so the lifecycle job engine wiring in
-     * cap-providers can pass it as `resolveVersion` without duplicating the
-     * npm-view/manifest logic.
-     */
-    async resolveFrameworkVersion(packageName, versionSpec) {
-        return resolveNpmVersion(packageName, versionSpec, process.env['CAMSTACK_NPM_REGISTRY']);
-    }
-    /**
-     * Return the currently-installed version of a framework package, or `null`
-     * when it cannot be determined (not installed / no manifest).
-     * Delegates to the module-level `readResolvedPackageManifest` helper.
-     * Exposed as a public method for use by the lifecycle job engine wiring.
-     */
-    currentFrameworkVersionOf(packageName) {
-        const manifest = readResolvedPackageManifest(packageName);
-        if (manifest !== null && typeof manifest['version'] === 'string') {
-            return manifest['version'];
-        }
-        return null;
-    }
-    /**
-     * Update a framework package via the staged launcher-swap engine.
-     *
-     * New path (when `runner` is provided):
-     *   1. Resolve toVersion via `npm view`.
-     *   2. Delegate to `runner.startJob` with a `target:'framework'` task.
-     *      The engine calls `stageFramework` → downloads+stages the 4 lockstep
-     *      packages → calls the wired `requestFrameworkSwap`
-     *      (`requestFrameworkSwapAndRestart`), which writes the
-     *      `.pending-framework-swap.json` marker AND schedules the self-restart.
-     *      The hub exits; the launcher applies the swap on the next boot. The
-     *      restart is owned by that seam, so this method does NOT schedule one.
-     *   3. Return `{ packageName, fromVersion, toVersion, restartingAt }`.
-     *      `restartingAt = 0` only on the legacy in-hub path when `deferRestart`
-     *      is set (engine path always restarts once the framework is staged).
-     *
-     * Legacy path (when no `runner`): keeps the original in-hub live-swap for
-     * backward compatibility with callers (e.g. tests) that have not wired the
-     * engine deps.
-     */
-    async updateFrameworkPackage(input) {
-        const { packageName } = input;
-        if (packageName !== exports.SYSTEM_PACKAGE) {
-            throw new Error(`updateFrameworkPackage: '${packageName}' is not a framework package. Allowed: ${exports.SYSTEM_PACKAGE}`);
-        }
-        const fromVersion = this.currentFrameworkVersionOf(packageName) ?? 'unknown';
-        const requestedVersion = input.version ?? 'latest';
-        const toVersion = await this.resolveFrameworkVersion(packageName, requestedVersion);
-        // ── New staged-swap engine path ──────────────────────────────────
-        if (input.runner !== undefined) {
-            this.logger.info('updateFrameworkPackage: delegating to staged swap engine', {
-                meta: { packageName, fromVersion, toVersion, deferRestart: input.deferRestart ?? false },
-            });
-            await input.runner.startJob({
-                kind: 'update',
-                targets: [{ name: packageName, version: toVersion, target: 'framework' }],
-                createdBy: input.requestedBy ?? 'system',
-            });
-            // The engine's framework task already wrote the pending-swap marker AND
-            // scheduled the self-restart via the wired `requestFrameworkSwap`
-            // (`requestFrameworkSwapAndRestart`) — that is the single restart owner,
-            // so we must NOT schedule a second one here. We only surface the
-            // pre-restart toast event for the interactive single-update path.
-            if (input.deferRestart !== true) {
-                this.eventBusService.emit({
-                    id: (0, node_crypto_1.randomUUID)(),
-                    timestamp: new Date(),
-                    source: { type: 'core', id: 'addon-package-service' },
-                    category: types_1.EventCategory.SystemRestarting,
-                    data: {
-                        kind: 'framework-update',
-                        packageName,
-                        fromVersion,
-                        toVersion,
-                        requestedAt: Date.now(),
-                    },
-                });
-            }
-            const restartingAt = input.deferRestart === true ? 0 : Date.now() + 500;
-            return { packageName, fromVersion, toVersion, restartingAt };
-        }
-        // ── Legacy in-hub live-swap path (no runner injected) ───────────
-        const appRoot = resolveFrameworkPackageAppRoot(packageName, this.logger);
-        this.logger.info('updateFrameworkPackage: installing (legacy in-hub path)', {
-            meta: { packageName, fromVersion, toVersion, appRoot },
-        });
-        await this.installFrameworkPackages(packageName, toVersion, appRoot);
-        if (input.deferRestart === true) {
-            this.logger.info(`updateFrameworkPackage(${packageName}@${toVersion}): install done, restart deferred`);
-            // Sentinel: 0 signals "no restart scheduled" to the caller
-            return { packageName, fromVersion, toVersion, restartingAt: 0 };
-        }
-        const restartingAt = Date.now();
-        const markerPayload = {
-            kind: 'framework-update',
-            packageName,
-            fromVersion,
-            toVersion,
-            requestedAt: restartingAt,
-            ...(input.requestedBy !== undefined ? { requestedBy: input.requestedBy } : {}),
-        };
-        try {
-            (0, system_1.writePendingRestart)(this.resolveDataDir(), markerPayload);
-        }
-        catch (err) {
-            // The npm install already completed — the restart will still
-            // pick up the new version, just without the completion toast.
-            this.logger.warn('Failed to write restart marker after framework update', {
-                meta: { error: (0, types_1.errMsg)(err) },
-            });
-        }
-        this.eventBusService.emit({
-            id: (0, node_crypto_1.randomUUID)(),
-            timestamp: new Date(),
-            source: { type: 'core', id: 'addon-package-service' },
-            category: types_1.EventCategory.SystemRestarting,
-            data: markerPayload,
-        });
-        (0, system_1.scheduleSelfRestart)({ delayMs: 500 });
-        return { packageName, fromVersion, toVersion, restartingAt };
-    }
     // =========================================================================
     // Reload
     // =========================================================================
@@ -1333,10 +1127,12 @@ class AddonPackageService {
     }
     /**
      * Run auto-update: check each installed package against its configured
-     * channel, then route ALL packages that have a newer version through ONE
-     * durable engine bulk job (F3 Task 5). The framework (`@camstack/system`) is
-     * auto-detected by the engine and ordered LAST; auto-updates survive a reboot
-     * via the boot reconcile, exactly like a manual "Update all".
+     * channel, then route ALL addon packages that have a newer version through ONE
+     * durable engine bulk job (F3 Task 5); auto-updates survive a reboot via the
+     * boot reconcile, exactly like a manual "Update all". The framework
+     * (`@camstack/system`) is NOT applied by the engine — it ships via
+     * `applyServerUpdate` (single-copy collapse), so a swept framework target is
+     * skipped by the engine.
      *
      * Candidate selection (channel resolution + npm metadata fetch + "is there a
      * newer version?" comparison) is unchanged from the previous per-item loop;
@@ -1394,9 +1190,10 @@ class AddonPackageService {
         // Execute as ONE durable engine bulk job. The runner singleton is resolved
         // lazily via a dynamic import (the singleton module transitively imports
         // SYSTEM_PACKAGE back from this module) to avoid an init-order cycle. The
-        // singleton is initialized at boot, before the scheduler timer fires. The
-        // framework target, if present, is ordered last by the engine. Wrap so a
-        // failure is logged, not thrown out of the timer callback.
+        // singleton is initialized at boot, before the scheduler timer fires. A
+        // framework target, if present, is skipped by the engine (framework updates
+        // ship via applyServerUpdate). Wrap so a failure is logged, not thrown out
+        // of the timer callback.
         try {
             const { getLifecycleRunner } = await Promise.resolve().then(() => __importStar(require('../lifecycle/lifecycle-runner.singleton.js')));
             const runner = getLifecycleRunner();
@@ -1754,7 +1551,7 @@ async function extractTgzStripped(tgz, destDir) {
     }
 }
 // ---------------------------------------------------------------------------
-// Framework live-update helpers
+// npm tarball / version helpers
 // ---------------------------------------------------------------------------
 /**
  * Build the npm CLI args that pin every relevant registry to
@@ -1763,179 +1560,16 @@ async function extractTgzStripped(tgz, destDir) {
  * user-home `.npmrc` files commonly declare
  * `@camstack:registry=https://registry.npmjs.org/`, and that scoped
  * entry takes precedence over the plain `--registry` CLI flag for
- * `@camstack/*` lookups — which is exactly the path framework-update
- * traverses.
+ * `@camstack/*` lookups.
  *
- * Without this, the e2e suite's verdaccio gets bypassed even with
- * `CAMSTACK_NPM_REGISTRY` set, AND in production any operator running
- * their own private npm proxy via `@camstack:registry` would have
- * `updateFrameworkPackage` silently route around it.
+ * Without this, an operator running their own private npm proxy via
+ * `@camstack:registry` would have package downloads silently route around it.
  */
 function buildNpmRegistryArgs(registry) {
     if (registry === undefined || registry.length === 0)
         return [];
     return ['--registry', registry, `--@camstack:registry=${registry}`];
 }
-/**
- * Remove any leftover `<pkg>.fw-bak` backup dirs under `appRoot/node_modules/
- * @camstack` — debris from a framework swap that was interrupted before its
- * own cleanup ran. Best-effort; returns the swept names.
- */
-function sweepStaleFrameworkBackups(appRoot) {
-    const scopeDir = path.join(appRoot, 'node_modules', '@camstack');
-    if (!fs.existsSync(scopeDir))
-        return [];
-    const swept = [];
-    for (const entry of fs.readdirSync(scopeDir, { withFileTypes: true })) {
-        if (!entry.isDirectory() || !entry.name.endsWith('.fw-bak'))
-            continue;
-        try {
-            fs.rmSync(path.join(scopeDir, entry.name), { recursive: true, force: true });
-            swept.push(entry.name);
-        }
-        catch {
-            // ignore — inert leftover, next sweep retries
-        }
-    }
-    return swept;
-}
-/**
- * Download the `.tgz` for an EXACT `pkg@version` into `destRoot`, returning its
- * path. Prefers a direct HTTPS GET (registry metadata → tarball URL) because
- * `fetch` + `AbortSignal.timeout` aborts RELIABLY on a slow/flaky network — an
- * `npm pack` child can stall for minutes past its `execFile` timeout (npm holds
- * its stdio pipes open, so the awaited promise never settles), which would wedge
- * the whole framework update. Falls back to `npm pack` (SIGKILL on timeout) only
- * when the HTTPS path fails (private registry quirks, auth, etc.).
- */
-async function packTarball(pkg, version, destRoot, registry) {
-    const dir = fs.mkdtempSync(path.join(destRoot, 'dl-'));
-    try {
-        return await httpsDownloadTarball(pkg, version, dir, registry);
-    }
-    catch (httpErr) {
-        const args = [
-            'pack',
-            `${pkg}@${version}`,
-            '--pack-destination',
-            dir,
-            ...buildNpmRegistryArgs(registry),
-        ];
-        // SIGKILL (not the default SIGTERM): npm can ignore SIGTERM while a
-        // grandchild holds the pipes — SIGKILL guarantees the timeout fires.
-        await execFileAsync('npm', args, { timeout: 60_000, killSignal: 'SIGKILL' });
-        const tgz = fs.readdirSync(dir).find((f) => f.endsWith('.tgz'));
-        if (tgz === undefined) {
-            throw new Error(`download failed for ${pkg}@${version}: ${(0, types_1.errMsg)(httpErr)}`, {
-                cause: httpErr,
-            });
-        }
-        return path.join(dir, tgz);
-    }
-}
-/**
- * Direct HTTPS download of an exact `pkg@version` tarball. Resolves the tarball
- * URL from the registry packument, then streams it to a file. Every network
- * call is bounded by an `AbortSignal.timeout` so a DNS/registry stall fails fast
- * instead of hanging the framework update.
- */
-async function httpsDownloadTarball(pkg, version, dir, registry) {
-    const reg = (registry ?? 'https://registry.npmjs.org').replace(/\/+$/, '');
-    const metaUrl = `${reg}/${encodeURIComponent(pkg).replace(/^%40/, '@')}`;
-    const metaRes = await fetch(metaUrl, { signal: AbortSignal.timeout(20_000) });
-    if (!metaRes.ok)
-        throw new Error(`registry GET ${metaUrl} → ${metaRes.status}`);
-    const meta = (await metaRes.json());
-    const tarballUrl = meta.versions?.[version]?.dist?.tarball;
-    if (typeof tarballUrl !== 'string') {
-        throw new Error(`no tarball url for ${pkg}@${version}`);
-    }
-    const tarRes = await fetch(tarballUrl, { signal: AbortSignal.timeout(120_000) });
-    if (!tarRes.ok)
-        throw new Error(`tarball GET ${tarballUrl} → ${tarRes.status}`);
-    const buf = Buffer.from(await tarRes.arrayBuffer());
-    const outPath = path.join(dir, `${pkg.replace('@', '').replace('/', '-')}-${version}.tgz`);
-    fs.writeFileSync(outPath, buf);
-    return outPath;
-}
-/**
- * Atomically replace one `@camstack/*` package directory in
- * `appRoot/node_modules` with the contents of an extracted npm package dir
- * (`stagedPackageDir` = the `package/` folder from a `.tgz`).
- *
- * This is the framework-update primitive: it touches ONLY the target package's
- * folder. The current copy is renamed to a sibling `.fw-bak` backup first and
- * restored if the copy fails, so a crash mid-swap can't leave a half-written
- * package. Refuses anything outside the `@camstack/` scope as a safety guard.
- * Returns the installed package name + version.
- */
-function swapInFrameworkPackage(stagedPackageDir, appRoot) {
-    const pkgJsonPath = path.join(stagedPackageDir, 'package.json');
-    if (!fs.existsSync(pkgJsonPath)) {
-        throw new Error(`swapInFrameworkPackage: no package.json in ${stagedPackageDir}`);
-    }
-    const parsed = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
-    const pkg = parsed;
-    if (typeof pkg.name !== 'string' || typeof pkg.version !== 'string') {
-        throw new Error(`swapInFrameworkPackage: invalid package.json in ${stagedPackageDir}`);
-    }
-    if (!pkg.name.startsWith('@camstack/')) {
-        throw new Error(`swapInFrameworkPackage: refusing non-@camstack package ${pkg.name}`);
-    }
-    const targetDir = path.join(appRoot, 'node_modules', pkg.name);
-    const backupDir = `${targetDir}.fw-bak`;
-    fs.rmSync(backupDir, { recursive: true, force: true });
-    const hadExisting = fs.existsSync(targetDir);
-    if (hadExisting)
-        fs.renameSync(targetDir, backupDir);
-    try {
-        fs.mkdirSync(path.dirname(targetDir), { recursive: true });
-        fs.cpSync(stagedPackageDir, targetDir, { recursive: true });
-    }
-    catch (err) {
-        // Roll back to the previous copy so a failed swap never leaves the
-        // package missing or half-written.
-        fs.rmSync(targetDir, { recursive: true, force: true });
-        if (hadExisting)
-            fs.renameSync(backupDir, targetDir);
-        throw err;
-    }
-    fs.rmSync(backupDir, { recursive: true, force: true });
-    return { name: pkg.name, version: pkg.version };
-}
-/**
- * Resolve the directory whose `node_modules/<pkg>/` holds the currently-
- * installed copy of a framework package. `npm install --prefix <appRoot>`
- * will then update that exact copy in place.
- *
- * Strategy: ask Node's resolver where it finds the package today, then walk
- * up to the `node_modules/`-parent. This matches whatever resolution path
- * the running hub actually uses (server-local node_modules in prod;
- * workspace-root in dev; bundled in Electron) without hard-coding either.
- *
- * Test knob: `CAMSTACK_FRAMEWORK_APP_ROOT_OVERRIDE` short-circuits the walk
- * and returns the env-supplied path. Used by the e2e suite to redirect the
- * `npm install --prefix` side-effects into an isolated temp dir instead of
- * the workspace's `server/backend/node_modules/`. Never set in production.
- */
-function resolveFrameworkPackageAppRoot(packageName, logger) {
-    const override = process.env['CAMSTACK_FRAMEWORK_APP_ROOT_OVERRIDE'];
-    if (override !== undefined && override.length > 0) {
-        return override;
-    }
-    const resolved = require.resolve(`${packageName}/package.json`);
-    // …/<appRoot>/node_modules/<scope>/<name>/package.json
-    // walk up: package.json → name → scope → node_modules → appRoot
-    let dir = path.dirname(resolved);
-    while (dir !== path.dirname(dir)) {
-        if (path.basename(dir) === 'node_modules') {
-            return path.dirname(dir);
-        }
-        dir = path.dirname(dir);
-    }
-    logger.warn(`Could not resolve appRoot for ${packageName}; falling back to process.cwd()`);
-    return process.cwd();
-}
 /**
  * Read a framework package's `package.json`, resolved however the
  * running hub actually loads it — workspace symlink in dev, a real
@@ -1946,11 +1580,6 @@ function resolveFrameworkPackageAppRoot(packageName, logger) {
  * `@camstack/sdk`, `@camstack/ui-library`) make that throw — so we
  * fall back to resolving the package's main entry and walking up to
  * the first `package.json` whose `name` matches.
- *
- * This is deliberately independent of `resolveFrameworkPackageAppRoot`:
- * that walk only finds a real `node_modules`-parent, which doesn't
- * exist for workspace-symlinked packages in dev — the cause of the
- * `vunknown` version label in the System Packages UI.
  */
 function readResolvedPackageManifest(packageName) {
     try {

package/dist/launcher.js

@@ -44,15 +44,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * 3. Dynamically import main.ts (which has static @camstack/system imports)
  *
  * Load-order invariant: @camstack/system is imported DYNAMICALLY inside
- * launch() AFTER applyPendingFrameworkSwap runs, so the swapped framework
- * code is what gets loaded. NEVER add a top-level static import of
- * @camstack/system here — that would load the OLD framework before the swap.
+ * launch() AFTER the active framework dir is resolved (the single-copy
+ * collapse points CAMSTACK_FRAMEWORK_DIR at CAMSTACK_SERVER_ACTIVE_ROOT in
+ * data-root mode, or the baked seed otherwise). NEVER add a top-level static
+ * import of @camstack/system here — that would pin the resolver before the
+ * framework dir + NODE_PATH are set up. Framework/cap updates ship via the
+ * node-root `applyServerUpdate` flow, not an in-launcher package swap.
  */
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const tar = __importStar(require("tar"));
 const yaml = __importStar(require("js-yaml"));
-const launcher_framework_swap_js_1 = require("./launcher-framework-swap.js");
 const framework_nodepath_js_1 = require("./framework-nodepath.js");
 /** Path of the manifest file embedded inside every archive. */
 const ARCHIVE_MANIFEST_NAME = '.camstack-backup-manifest.json';
@@ -241,19 +243,6 @@ async function launch() {
     // `CAMSTACK_ADDONS_DIR` lets the Docker/Electron images point at their
     // node_modules path (e.g. /data/node_modules); dev keeps `<dataDir>/addons`.
     const addonsDir = process.env['CAMSTACK_ADDONS_DIR'] ?? path.resolve(dataDir, 'addons');
-    // ── Framework swap ────────────────────────────────────────────────────────
-    // MUST run before @camstack/system is loaded so the NEW framework code is
-    // what gets required. Both helpers are zero-dep (no @camstack imports).
-    // Roll back an unconfirmed prior swap (crash-loop guard), then apply any
-    // freshly-staged swap.
-    const frameworkDir = process.env['CAMSTACK_FRAMEWORK_DIR'];
-    const rb = (0, launcher_framework_swap_js_1.rollbackUnconfirmedFrameworkSwap)(dataDir, frameworkDir);
-    if (rb.rolledBack)
-        console.log('[launcher] Rolled back an unconfirmed framework update');
-    const fsw = (0, launcher_framework_swap_js_1.applyPendingFrameworkSwap)(dataDir, frameworkDir);
-    if (fsw.applied)
-        console.log(`[launcher] Applied staged framework update (job ${fsw.jobId ?? '?'})`);
-    // ── End framework swap ────────────────────────────────────────────────────
     // ── Single-copy framework dir (2026-07-18 collapse) ────────────────────────
     // In data-root mode the ACTIVE single copy (set by the starter as
     // CAMSTACK_SERVER_ACTIVE_ROOT) IS the framework — point the forked
@@ -271,8 +260,9 @@ async function launch() {
     // installer + symlink step pick up — otherwise we'd install a stale
     // set and overwrite it a step later.
     await applyPendingRestore(dataDir);
-    // @camstack/system is imported DYNAMICALLY here — AFTER applyPendingFrameworkSwap —
-    // so the swapped framework code is what gets loaded. Never import it at module top.
+    // @camstack/system is imported DYNAMICALLY here — AFTER the active framework
+    // dir + NODE_PATH are resolved above — so the correct framework copy is what
+    // gets loaded. Never import it at module top.
     const { AddonInstaller, bootstrapSchema, detectWorkspacePackagesDir } = await Promise.resolve().then(() => __importStar(require('@camstack/system')));
     // Install source resolution:
     //   1. CAMSTACK_BUNDLED_ADDONS_DIR — set by Electron-packaged builds

package/dist/manual-boot.js

@@ -47,10 +47,8 @@ exports.bootManual = bootManual;
 const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
 const fastify_1 = __importDefault(require("fastify"));
-const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
 const lifecycle_runner_singleton_1 = require("./core/lifecycle/lifecycle-runner.singleton");
-const request_framework_swap_1 = require("./request-framework-swap");
 const config_service_1 = require("./core/config/config.service");
 const logging_service_1 = require("./core/logging/logging.service");
 const event_bus_service_1 = require("./core/events/event-bus.service");
@@ -175,31 +173,6 @@ async function bootManual(opts) {
                 });
             }
         },
-        // ── Framework swap deps ──────────────────────────────────────────
-        stageFramework: (task, signal) => (0, system_1.stageFrameworkLockstep)({
-            jobId: task.taskId,
-            toVersion: task.toVersion,
-            frameworkDir: process.env['CAMSTACK_FRAMEWORK_DIR'] ?? '',
-            stagingDir: path.join(lifecycleDataDir, 'lifecycle', 'staging'),
-            fetchTarball: (name, version, sig) => addonPackageService.fetchAddonTarball(name, version, sig),
-            extract: (tgz, destDir) => addonPackageService.extractTarball(tgz, destDir),
-            // Called only for the lockstep COMPANIONS (types/sdk/shm-ring) — the
-            // primary (@camstack/system) uses `task.toVersion` directly inside
-            // stageFrameworkLockstep. Companions are versioned independently on npm
-            // (system's package.json declares them as `*`), so resolve each to its
-            // own latest — pinning to `task.toVersion` fetches a non-existent
-            // `@camstack/types@<system-version>` tarball and fails the swap.
-            resolveVersion: (name) => addonPackageService.resolveFrameworkVersion(name, 'latest'),
-            currentVersionOf: (name) => addonPackageService.currentFrameworkVersionOf(name),
-            signal,
-        }),
-        requestFrameworkSwap: ({ jobId, taskId, packages }) => {
-            // Write the pending-swap marker AND schedule the reboot that applies it.
-            // The engine assumes the process exits after this returns; the restart is
-            // owned here (the single seam for every engine path: single update,
-            // "Update all" bulk, and the auto-update scheduler).
-            (0, request_framework_swap_1.requestFrameworkSwapAndRestart)(lifecycleDataDir, { jobId, taskId, packages });
-        },
     });
     const replEngineService = new repl_engine_service_1.ReplEngineService(addonRegistryService, eventBusService, loggingService);
     // Runtime-updatable root package (phase 1: hub only). The service owns the