@camstack/server 1.2.268 → 1.2.270

package/dist/main.js

@@ -58,6 +58,7 @@ const ws_1 = require("@trpc/server/adapters/ws");
 const ws_2 = require("ws");
 const addon_upload_1 = require("./api/addon-upload");
 const auth_whoami_1 = require("./api/auth-whoami");
+const backup_download_js_1 = require("./api/backup-download.js");
 const health_routes_1 = require("./api/health/health.routes");
 const adaptive_probe_routes_1 = require("./api/health/adaptive-probe.routes");
 const model_distributor_js_1 = require("./api/model-distributor.js");
@@ -79,6 +80,7 @@ const trpc_router_1 = require("./api/trpc/trpc.router");
 const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
 const trpc_error_device_tags_1 = require("./api/trpc/trpc-error-device-tags");
 const ws_request_census_1 = require("./api/trpc/ws-request-census");
+const ws_slow_consumer_guard_js_1 = require("./api/trpc/ws-slow-consumer-guard.js");
 const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
 const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
@@ -302,6 +304,22 @@ async function bootstrap() {
         socketPlane: (0, system_1.createSocketPlaneReader)({
             registry: () => moleculerForEventPlane?.childRegistry ?? null,
         }),
+        // The write queue to every peer NODE, from Moleculer's own writer
+        // sockets. Those are unref'd (`TcpWriter.connect`), so the 2026-09-10
+        // exclusion of "every socket queue" — a sum over `_getActiveHandles()` —
+        // never saw them. With the UDS queues above, every outbound plane this
+        // process writes to is now on the line and judged on every probe (D446).
+        meshQueue: (0, system_1.createMeshQueueReader)(() => moleculerForEventPlane?.broker ?? null),
+        // The ArrayBuffer census, armed by the probe itself. Twice on 2026-09-10
+        // this process's `arrayBuffers` climbed linearly for an hour (to 1.3 GB
+        // and to 5 GB, both LIVE across a forced compaction) and released in one
+        // instant, with no line at either boundary; the measurement that names
+        // the shape existed and was never run because it needed a human awake
+        // during the episode. Now the heartbeat takes it: one forced full GC —
+        // the pause a reclaim pass already costs — walked in memory, nothing
+        // written, on a threshold held for a minute, at most twice an hour.
+        // It is NOT a heap snapshot; see `array-buffer-census.ts`.
+        arrayBufferCensus: { census: (0, system_1.createInspectorArrayBufferCensus)() },
     });
     // Clean up orphaned processes from previous crashes before starting
     cleanupOrphanProcesses();
@@ -810,89 +828,14 @@ async function bootstrap() {
                 });
             }
         });
-        // ── Backup archive download (Phase 4 / Task 24) ────────────────
-        // Streams an archive at `<locationId>/<archiveId>` through the
-        // storage cap's chunked-download protocol straight to an HTTP
-        // response. The admin UI uses an authenticated `fetch` + Blob to
-        // fetch and trigger a save dialog (no cookie auth on this server,
-        // so we can't rely on `window.location.assign`).
-        fastify.get('/api/backup/download/:locationId/:archiveId', async (request, reply) => {
-            const authHeader = request.headers.authorization;
-            if (!authHeader) {
-                return reply.status(401).send({ error: 'Unauthorized' });
-            }
-            try {
-                const token = authHeader.replace('Bearer ', '');
-                const downloadAuth = app.get(auth_service_1.AuthService);
-                const payload = downloadAuth.verifyToken(token);
-                if (!payload.isAdmin) {
-                    return reply.status(403).send({ error: 'Admin required' });
-                }
-            }
-            catch {
-                return reply.status(401).send({ error: 'Invalid token' });
-            }
-            const { locationId, archiveId } = request.params;
-            const backupSingleton = capabilityRegistry.getSingleton('backup');
-            if (!backupSingleton?.listArchives) {
-                return reply.status(503).send({ error: 'Backup orchestrator unavailable' });
-            }
-            const archives = await backupSingleton.listArchives({ destinationId: locationId });
-            const archive = archives.find((a) => a.id === archiveId);
-            if (!archive) {
-                return reply.status(404).send({ error: 'Archive not found' });
-            }
-            const storage = capabilityRegistry.getSingleton('storage');
-            if (!storage?.beginDownload) {
-                return reply.status(503).send({ error: 'Storage cap unavailable' });
-            }
-            const downloadName = `${archive.label ?? archive.id}.tar.gz`;
-            // Sanitize: strip newlines and double-quotes which would break
-            // the Content-Disposition header. Whitespace is fine.
-            const safeName = downloadName.replace(/[\r\n"]/g, '_');
-            reply.header('content-type', 'application/gzip');
-            reply.header('content-length', String(archive.sizeBytes));
-            reply.header('content-disposition', `attachment; filename="${safeName}"`);
-            const { downloadId, sizeBytes } = await storage.beginDownload({
-                location: locationId,
-                relativePath: archive.filename,
-            });
-            const CHUNK = 8 * 1024 * 1024;
-            try {
-                let offset = 0;
-                // Stream the chunked response. Fastify's `reply.raw` is the
-                // Node.js writable; we write each chunk and `end()` once
-                // we've drained the source. Per-write back-pressure is
-                // handled inside the runtime — buffered writes pile up but
-                // never beyond the OS socket buffer.
-                while (offset < sizeBytes) {
-                    const len = Math.min(CHUNK, sizeBytes - offset);
-                    const chunk = await storage.readChunk({ downloadId, offset, length: len });
-                    if (chunk.byteLength === 0) {
-                        throw new Error(`backup download: empty chunk at offset ${offset}/${sizeBytes}`);
-                    }
-                    reply.raw.write(chunk);
-                    offset += chunk.byteLength;
-                }
-                reply.raw.end();
-            }
-            catch (err) {
-                console.error('[backup-download] stream failed:', err);
-                // Headers may already be flushed — abort the socket if so.
-                if (!reply.raw.headersSent) {
-                    return reply.status(500).send({ error: 'Download failed' });
-                }
-                reply.raw.destroy(err instanceof Error ? err : new Error(String(err)));
-            }
-            finally {
-                try {
-                    await storage.endDownload({ downloadId });
-                }
-                catch {
-                    /* best-effort */
-                }
-            }
-            return reply;
+        // ── Backup archive download ─────────────────────────────────────
+        // Streams an archive through the storage cap's chunked-download
+        // protocol at the pace the client reads it (D447). The route, its
+        // auth chain and the drain-respecting pump live in `api/backup-download*`.
+        (0, backup_download_js_1.registerBackupDownloadRoute)(fastify, {
+            verifier: app.get(auth_service_1.AuthService),
+            capabilities: capabilityRegistry,
+            logger: app.get(logging_service_1.LoggingService).createLogger('backup-download'),
         });
         // POST /api/auth/session — upgrade a tRPC-issued JWT to a browser cookie.
         fastify.post('/api/auth/session', async (request, reply) => {
@@ -1223,18 +1166,39 @@ async function bootstrap() {
         // call. The frame is the only place an operation is observable from
         // outside the adapter — see `ws-request-census.ts`. Registered before
         // `applyWSSHandler` so no socket can be accepted without a session.
+        // A subscriber that stops READING is disconnected, not buffered until the
+        // hub dies. On 2026-09-10 the only WS client (the operator's phone, viewer
+        // in the background, JS suspended, TCP open) queued 88 MB of JSON strings
+        // in hub-main's old_space with no bound and no line. See
+        // `ws-slow-consumer-guard.ts` for the policy and the alternatives it beat.
+        const wsSlowConsumerGuard = new ws_slow_consumer_guard_js_1.WsSlowConsumerGuard({
+            logger: app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'),
+        });
+        wsSlowConsumerGuard.start();
         wss.on('connection', (client, req) => {
             (0, ws_request_census_1.attachWsCensusSession)(httpRequestCensus, client, req, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
+            wsSlowConsumerGuard.attach(client, (0, ws_slow_consumer_guard_js_1.wsConnectionFacts)(req));
         });
         (0, ws_1.applyWSSHandler)({
             wss,
             router: appRouter,
+            // The complement of the bound above, for the SUSPENDED client: a PING is
+            // a text frame the client's JS must answer, and a backgrounded app's JS
+            // does not run — so the socket is terminated ~40 s into the background
+            // instead of accumulating for the night, and the app reconnects on
+            // return (every WS client of this hub is `@trpc/client` >= 11, which
+            // answers PING with PONG; the viewer pins ^11.16). The bound stays: it
+            // covers a client whose JS runs but whose link cannot drain the events.
+            // A termination here closes with 1006; the guard's close line names it.
+            keepAlive: { enabled: true, pingMs: 30_000, pongWaitMs: 10_000 },
             createContext: async (opts) => {
                 const wsCtx = await (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
                 // The connection's identity, derived ONCE and reused for every
                 // operation on this socket. Frames that arrived while the bearer was
                 // still resolving are held by the session and released here.
-                (0, ws_request_census_1.identifyWsCensusSession)(opts.res, (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user));
+                const principal = (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user);
+                (0, ws_request_census_1.identifyWsCensusSession)(opts.res, principal);
+                wsSlowConsumerGuard.identify(opts.res, principal);
                 return wsCtx;
             },
             onError: ({ path: trpcPath, error, ctx, input, }) => {

package/dist/manual-boot.js

@@ -77,9 +77,11 @@ const server_update_service_1 = require("./core/server-update/server-update.serv
 const storage_service_1 = require("./core/storage/storage.service");
 const stream_probe_service_1 = require("./core/streaming/stream-probe.service");
 const topology_emitter_service_1 = require("./core/topology/topology-emitter.service");
+const update_availability_emitter_js_1 = require("./core/update-availability-emitter.js");
 const update_availability_store_js_1 = require("./core/update-availability-store.js");
 const agent_installed_packages_js_1 = require("./core/updates/agent-installed-packages.js");
 const update_check_scheduler_js_1 = require("./core/updates/update-check-scheduler.js");
+const wrapper_update_checker_js_1 = require("./core/updates/wrapper-update-checker.js");
 // ---------------------------------------------------------------------------
 // Service container — narrowing via `instanceof`, no casts.
 // ---------------------------------------------------------------------------
@@ -252,6 +254,25 @@ async function bootManual(opts) {
     // channel — that gate is why the only periodic publisher was dead on every
     // live hub (`{"channel":"off"}`). See UpdateCheckScheduler.
     const updateCheckLogger = loggingService.createLogger('UpdateCheck');
+    // The fifth target: the SHELL each node runs inside. Its own emitter scope,
+    // so a shell announcement and a code announcement never overwrite each
+    // other's dedup state — they are different facts about the same node (D437).
+    const wrapperUpdateChecker = new wrapper_update_checker_js_1.WrapperUpdateChecker({
+        logger: updateCheckLogger,
+        emitter: new update_availability_emitter_js_1.UpdateAvailabilityEmitter(eventBusService, { type: 'core', id: 'wrapper-update-check' }, new update_availability_store_js_1.FileUpdateAvailabilityStore(availabilityDataDir, 'wrapper-update', loggingService.createLogger('UpdateAvailability'))),
+        readStatus: async (nodeId, isHub) => {
+            if (isHub)
+                return serverUpdateService.getServerPackageStatus();
+            const proxy = moleculerService.createCapabilityProxy('server-management', nodeId);
+            if (proxy === null) {
+                // Unreachable is not "the image is fine". Reject so the scheduler
+                // records a failed check instead of a clean bill.
+                throw new Error(`server-management unreachable on ${nodeId}`);
+            }
+            const status = await proxy['getServerPackageStatus']?.({});
+            return types_1.ServerPackageStatusSchema.parse(status);
+        },
+    });
     const updateCheckScheduler = new update_check_scheduler_js_1.UpdateCheckScheduler({
         logger: updateCheckLogger,
         getIntervalSeconds: () => addonPackageService.getAutoUpdateSettings().updateCheckIntervalSeconds,
@@ -278,6 +299,7 @@ async function bootManual(opts) {
                 }
                 return proxy['checkServerUpdate']?.({});
             },
+            checkWrapperUpdate: (nodeId, isHub) => wrapperUpdateChecker.check(nodeId, isHub),
         },
     });
     addonPackageService.setUpdateCheckRescheduler(() => updateCheckScheduler.reschedule());

package/dist/server-root/index.js

@@ -77,6 +77,7 @@ var require_dist = __commonJS({
       DEV_UPLOADS_DIRNAME: /* @__PURE__ */ __name(() => DEV_UPLOADS_DIRNAME, "DEV_UPLOADS_DIRNAME"),
       DEV_UPLOADS_KEEP_COUNT: /* @__PURE__ */ __name(() => DEV_UPLOADS_KEEP_COUNT, "DEV_UPLOADS_KEEP_COUNT"),
       DEV_UPLOAD_MANIFEST_FILE: /* @__PURE__ */ __name(() => DEV_UPLOAD_MANIFEST_FILE, "DEV_UPLOAD_MANIFEST_FILE"),
+      ELECTRON_APP_VERSION_ENV: /* @__PURE__ */ __name(() => ELECTRON_APP_VERSION_ENV, "ELECTRON_APP_VERSION_ENV"),
       HOST_EXTERNAL_SPECIFIERS: /* @__PURE__ */ __name(() => HOST_EXTERNAL_SPECIFIERS, "HOST_EXTERNAL_SPECIFIERS"),
       HUB_ROOT_SPEC: /* @__PURE__ */ __name(() => HUB_ROOT_SPEC2, "HUB_ROOT_SPEC"),
       PENDING_ROOT_SWAP_FILE: /* @__PURE__ */ __name(() => PENDING_ROOT_SWAP_FILE, "PENDING_ROOT_SWAP_FILE"),
@@ -93,6 +94,7 @@ var require_dist = __commonJS({
       currentDir: /* @__PURE__ */ __name(() => currentDir, "currentDir"),
       currentEntryPath: /* @__PURE__ */ __name(() => currentEntryPath, "currentEntryPath"),
       detectWorkspaceRoot: /* @__PURE__ */ __name(() => detectWorkspaceRoot, "detectWorkspaceRoot"),
+      detectWrapperIdentity: /* @__PURE__ */ __name(() => detectWrapperIdentity, "detectWrapperIdentity"),
       devChannelEpoch: /* @__PURE__ */ __name(() => devChannelEpoch, "devChannelEpoch"),
       devUploadManifestPath: /* @__PURE__ */ __name(() => devUploadManifestPath, "devUploadManifestPath"),
       devUploadVersionDir: /* @__PURE__ */ __name(() => devUploadVersionDir, "devUploadVersionDir"),
@@ -110,6 +112,7 @@ var require_dist = __commonJS({
       readPendingRootSwap: /* @__PURE__ */ __name(() => readPendingRootSwap, "readPendingRootSwap"),
       readRestartIntentMarker: /* @__PURE__ */ __name(() => readRestartIntentMarker, "readRestartIntentMarker"),
       readServerRootState: /* @__PURE__ */ __name(() => readServerRootState, "readServerRootState"),
+      readWrapperProbes: /* @__PURE__ */ __name(() => readWrapperProbes, "readWrapperProbes"),
       registerActiveRootResolver: /* @__PURE__ */ __name(() => registerActiveRootResolver, "registerActiveRootResolver"),
       restartIntentMarkerPath: /* @__PURE__ */ __name(() => restartIntentMarkerPath, "restartIntentMarkerPath"),
       rootEntryPath: /* @__PURE__ */ __name(() => rootEntryPath2, "rootEntryPath"),
@@ -789,6 +792,93 @@ var require_dist = __commonJS({
       };
     }
     __name(assessImageContract, "assessImageContract");
+    var ELECTRON_APP_VERSION_ENV = "CAMSTACK_AGENT_APP_VERSION";
+    var CONTAINER_CGROUP_MARKERS = [
+      "docker",
+      "containerd",
+      "kubepods",
+      "podman"
+    ];
+    function cgroupNamesAContainer(contents) {
+      const lower = contents.toLowerCase();
+      return CONTAINER_CGROUP_MARKERS.some((marker) => lower.includes(marker));
+    }
+    __name(cgroupNamesAContainer, "cgroupNamesAContainer");
+    function cgroupDetail(contents) {
+      const lines = contents.split("\n").filter((line) => line.trim().length > 0);
+      const named = lines.find((line) => cgroupNamesAContainer(line));
+      return (named ?? lines[0] ?? "").trim().slice(0, 200);
+    }
+    __name(cgroupDetail, "cgroupDetail");
+    function detectWrapperIdentity(inputs) {
+      const { platform, dockerEnvFileExists, proc1Cgroup, electronAppVersion, seedVersion } = inputs;
+      const linux = platform === "linux";
+      const cgroupAnswered = proc1Cgroup !== null;
+      const cgroupSaysContainer = proc1Cgroup !== null && cgroupNamesAContainer(proc1Cgroup);
+      const containerObserved = dockerEnvFileExists || cgroupSaysContainer;
+      const electronDeclared = electronAppVersion !== void 0 && electronAppVersion.length > 0;
+      const containerRuledOut = !containerObserved && (cgroupAnswered || !linux);
+      const evidence = [
+        {
+          fact: "platform",
+          mode: "observed",
+          holds: linux,
+          detail: linux ? `process.platform=${platform} \u2014 a container is possible here` : `process.platform=${platform} \u2014 a linux container cannot run on this platform`
+        },
+        {
+          fact: "dockerenv-file",
+          mode: "observed",
+          holds: dockerEnvFileExists,
+          detail: dockerEnvFileExists ? "/.dockerenv exists" : "/.dockerenv not present"
+        },
+        {
+          fact: "proc-1-cgroup",
+          mode: "observed",
+          holds: cgroupSaysContainer,
+          detail: proc1Cgroup === null ? "/proc/1/cgroup unreadable \u2014 this probe did NOT answer" : cgroupDetail(proc1Cgroup)
+        },
+        {
+          fact: "electron-app-version-env",
+          mode: "declared",
+          holds: electronDeclared,
+          detail: electronDeclared ? `CAMSTACK_AGENT_APP_VERSION=${String(electronAppVersion)}` : "CAMSTACK_AGENT_APP_VERSION not set"
+        }
+      ];
+      if (containerObserved && electronDeclared) {
+        return {
+          kind: "contradictory",
+          evidence,
+          currentVersion: null
+        };
+      }
+      if (containerObserved) {
+        return {
+          kind: "docker",
+          evidence,
+          currentVersion: seedVersion
+        };
+      }
+      if (electronDeclared) {
+        return {
+          kind: "electron",
+          evidence,
+          currentVersion: electronAppVersion ?? null
+        };
+      }
+      if (containerRuledOut) {
+        return {
+          kind: "native",
+          evidence,
+          currentVersion: seedVersion
+        };
+      }
+      return {
+        kind: "unknown",
+        evidence,
+        currentVersion: null
+      };
+    }
+    __name(detectWrapperIdentity, "detectWrapperIdentity");
     var fs4 = __toESM2(require("fs"));
     var path4 = __toESM2(require("path"));
     function detectWorkspaceRoot(fromDir) {
@@ -930,6 +1020,26 @@ var require_dist = __commonJS({
     var NPM_INSTALL_TIMEOUT_MS = 15 * 6e4;
     var RESTART_REASON_PREFIX = "server-update";
     var STALE_TRANSIENT_MS = 24 * 60 * 60 * 1e3;
+    function readWrapperProbes() {
+      let proc1Cgroup = null;
+      try {
+        proc1Cgroup = fs6.readFileSync("/proc/1/cgroup", "utf-8");
+      } catch {
+        proc1Cgroup = null;
+      }
+      let dockerEnvFileExists = false;
+      try {
+        dockerEnvFileExists = fs6.existsSync("/.dockerenv");
+      } catch {
+        dockerEnvFileExists = false;
+      }
+      return {
+        platform: process.platform,
+        dockerEnvFileExists,
+        proc1Cgroup
+      };
+    }
+    __name(readWrapperProbes, "readWrapperProbes");
     function readPackageVersion(pkgJsonPath) {
       try {
         const raw = JSON.parse(fs6.readFileSync(pkgJsonPath, "utf-8"));
@@ -956,6 +1066,7 @@ var require_dist = __commonJS({
       execNpm;
       ensureNativePrebuildsFn;
       env;
+      readWrapperProbesFn;
       now;
       runningPackageJsonPath;
       workspaceProbeDir;
@@ -983,6 +1094,7 @@ var require_dist = __commonJS({
         });
         this.ensureNativePrebuildsFn = options.ensureNativePrebuilds ?? (async () => void 0);
         this.env = options.env ?? process.env;
+        this.readWrapperProbesFn = options.readWrapperProbes ?? readWrapperProbes;
         this.now = options.now ?? Date.now;
         this.runningPackageJsonPath = options.runningPackageJsonPath;
         this.workspaceProbeDir = options.workspaceProbeDir;
@@ -1008,6 +1120,20 @@ var require_dist = __commonJS({
         if (seedDir === void 0 || seedDir.length === 0) return null;
         return readPackageVersion(path6.join(seedDir, "package.json"));
       }
+      /**
+      * What this node runs INSIDE. Observed where it can be (the container
+      * probes), declared only where it cannot (the Electron app version, which a
+      * child process has no other way to learn). A contradiction between the two
+      * is reported as `contradictory`, never resolved — see `wrapper-identity.ts`
+      * and D437.
+      */
+      wrapperIdentity() {
+        return detectWrapperIdentity({
+          ...this.readWrapperProbesFn(),
+          electronAppVersion: this.env[ELECTRON_APP_VERSION_ENV],
+          seedVersion: this.seedVersion()
+        });
+      }
       rootDir() {
         return serverRootDir(this.dataDir);
       }
@@ -1046,7 +1172,11 @@ var require_dist = __commonJS({
             seedVersion: this.seedVersion(),
             latestVersion,
             runningVersion
-          })
+          }),
+          // The other half of the same question. `imageContract` says the shell is
+          // BEHIND; this says WHAT the shell is, which is the only thing that can
+          // turn that verdict into an instruction the operator can act on.
+          wrapper: this.wrapperIdentity()
         };
       }
       // ── Check ─────────────────────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.268",
+  "version": "1.2.270",
   "private": false,
   "files": [
     "dist",