@camstack/server 1.2.277 → 1.2.278

package/dist/agent/agent-update-service.js

@@ -66,6 +66,7 @@ const path = __importStar(require("node:path"));
 const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
 const system_ensure_prebuilds_js_1 = require("../core/server-update/system-ensure-prebuilds.js");
+const system_apply_closure_patches_js_1 = require("../core/server-update/system-apply-closure-patches.js");
 const system_exec_npm_js_1 = require("../core/server-update/system-exec-npm.js");
 const update_availability_emitter_js_1 = require("../core/update-availability-emitter.js");
 const update_availability_store_js_1 = require("../core/update-availability-store.js");
@@ -194,6 +195,11 @@ class AgentUpdateService extends index_js_1.RootUpdateService {
             // ships the identical bare Node, so its `applyServerUpdate` staging would
             // hit the same source-only `better-sqlite3` miss without this.
             ensureNativePrebuilds: options.ensureNativePrebuilds ?? (0, system_ensure_prebuilds_js_1.buildSystemEnsureNativePrebuilds)(options.logger),
+            // Apply the closure patches ourselves. npm 12 blocks the root package's
+            // postinstall by default, and a silently-unpatched closure is refused by
+            // the validator — an update that can never apply. Idempotent, so this
+            // costs nothing where npm did run the lifecycle.
+            applyClosurePatches: options.applyClosurePatches ?? (0, system_apply_closure_patches_js_1.buildSystemApplyClosurePatches)(options.logger),
             env: options.env,
             now: options.now,
         });

package/dist/api/core/logging-settings.js

@@ -61,7 +61,7 @@
  * over the window (D245).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoggingSettingsService = exports.MAX_CHANNEL_WINDOW_MS = exports.EMPTY_LOG_CHANNEL_PLANE = exports.HUB_NODE_ID = exports.LOGGING_SETTINGS_KEY = void 0;
+exports.LoggingSettingsService = exports.MAX_CHANNEL_WINDOW_MS = exports.EMPTY_LOG_CHANNEL_PLANE = exports.OPS_LOG_RETENTION_DEFAULT_DAYS = exports.HUB_NODE_ID = exports.LOGGING_SETTINGS_KEY = void 0;
 exports.buildLogChannelPlane = buildLogChannelPlane;
 exports.toLoggingSettingsRecord = toLoggingSettingsRecord;
 exports.resolveLevel = resolveLevel;
@@ -79,6 +79,22 @@ const SYSTEM_SETTINGS_COLLECTION = 'system-settings';
 /** The node a hub speaks for when a caller does not name one. */
 exports.HUB_NODE_ID = 'hub';
 const LOG_LEVELS = ['debug', 'info', 'warn', 'error'];
+/**
+ * The persisted row. Every field optional — an older row must still read, and
+ * a field this version does not know about must survive a write by a version
+ * that does not know it either.
+ */
+/**
+ * How long the analytics ops log is kept when nothing is configured.
+ *
+ * Thirty days, the number that was hardcoded in `pipeline-analytics/index.ts`
+ * until D485. It is longer than any device retention window on purpose:
+ * `retention-model.ts` calls it "the one root that must NOT follow a device
+ * window … the audit trail is not history of the camera, it is history of the
+ * sweep". That reasoning is why the value stays 30 by default; it was never a
+ * reason for the value to be unreachable.
+ */
+exports.OPS_LOG_RETENTION_DEFAULT_DAYS = 30;
 /** A plane that reaches nothing. The shape of a hub with no addon booted yet. */
 exports.EMPTY_LOG_CHANNEL_PLANE = {
     declarations: async () => [],
@@ -184,6 +200,12 @@ class LoggingSettingsService {
         if (levelChanged) {
             next = mergeLevel(next, scope, component, patch.level ?? null, this.now());
         }
+        if (patch.opsLogRetentionDays !== undefined) {
+            // A scalar, merged like any other field. Absent leaves it alone — the
+            // patch contract: arming a channel must not silently rewrite how long the
+            // audit trail lives.
+            next = { ...next, opsLogRetentionDays: patch.opsLogRetentionDays, updatedAt: this.now() };
+        }
         if (channelsChanged) {
             // Validated BEFORE anything is written: a patch that names an
             // undeclared channel, or narrows a channel whose lines carry no
@@ -285,6 +307,7 @@ class LoggingSettingsService {
             activeWindows: await this.describeWindows(),
             channels: await this.declaredChannels(),
             activeChannels: describeChannelWindows(record ?? {}, this.now()),
+            opsLogRetentionDays: record?.opsLogRetentionDays ?? exports.OPS_LOG_RETENTION_DEFAULT_DAYS,
             persisted: record !== null,
         };
     }

package/dist/closure-patches/patch-reach.json

@@ -74,10 +74,13 @@
         "and no forceTurn guard.",
         "",
         "It now reaches production because `@camstack/server` ships these patches",
-        "in `dist/closure-patches/` and applies them from its own `postinstall`,",
-        "which runs inside the staging closure (the closure install passes no",
-        "`--ignore-scripts`). A closure where a marker did not land is refused by",
-        "`findUnappliedClosurePatches` before it can be swapped in.",
+        "in `dist/closure-patches/` and applies them from its own `postinstall`.",
+        "That alone was NOT enough (D484): npm 12 blocks a dependency's install",
+        "scripts by default, so on the Mac-mini agent the postinstall never ran and",
+        "the closure came out unpatched with exit 0. `stageClosure` now also",
+        "invokes the applier directly, and the staging manifest allow-lists the",
+        "packages whose scripts must run. A closure where a marker did not land is",
+        "still refused by `findUnappliedClosurePatches` before it can be swapped in.",
         "",
         "The version is EXACT, in this file and in all three declaring packages.",
         "A caret would let npm resolve 0.22.10 into the closure, the patch would",

package/dist/core/server-update/server-update.service.js

@@ -55,6 +55,7 @@ const path = __importStar(require("node:path"));
 const index_js_1 = require("../../server-root/index.js");
 const update_availability_emitter_js_1 = require("../update-availability-emitter.js");
 const system_ensure_prebuilds_js_1 = require("./system-ensure-prebuilds.js");
+const system_apply_closure_patches_js_1 = require("./system-apply-closure-patches.js");
 const system_exec_npm_js_1 = require("./system-exec-npm.js");
 class ServerUpdateService extends index_js_1.RootUpdateService {
     updateAvailability;
@@ -95,6 +96,11 @@ class ServerUpdateService extends index_js_1.RootUpdateService {
             // native-prebuild validator refuses the swap (toolchain-less packaged
             // desktop). No-op on docker where the install already carried it.
             ensureNativePrebuilds: options.ensureNativePrebuilds ?? (0, system_ensure_prebuilds_js_1.buildSystemEnsureNativePrebuilds)(options.logger),
+            // Apply the closure patches ourselves. npm 12 blocks the root package's
+            // postinstall by default, and a silently-unpatched closure is refused by
+            // the validator — an update that can never apply. Idempotent, so this
+            // costs nothing where npm did run the lifecycle.
+            applyClosurePatches: options.applyClosurePatches ?? (0, system_apply_closure_patches_js_1.buildSystemApplyClosurePatches)(options.logger),
             env: options.env,
             now: options.now,
         });

package/dist/core/server-update/system-apply-closure-patches.js

@@ -0,0 +1,105 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSystemApplyClosurePatches = buildSystemApplyClosurePatches;
+/**
+ * `buildSystemApplyClosurePatches` — run the root package's OWN shipped patch
+ * applier inside a staged closure, without going through npm.
+ *
+ * ## Why this exists
+ *
+ * `@camstack/server` applies its `closure-postinstall` patches (D478 — werift)
+ * from its `postinstall`. npm 12 blocks a dependency's install scripts unless
+ * the installing manifest allow-lists it, and the block is a WARNING, not an
+ * error: the install succeeds, the patch silently does not land, and the only
+ * thing that notices is `findUnappliedClosurePatches` refusing the swap.
+ *
+ * Measured 2026-09-13 on the Mac-mini agent, which had bootstrapped npm 12.0.1
+ * while hub and little-unraid still ran npm 11. That node sat two versions
+ * behind with no other symptom, and the applier — run by hand in the very same
+ * staging closure — reported `APPLIED werift@0.22.9` on three files. The code
+ * was never wrong; it was never called.
+ *
+ * `CLOSURE_ALLOW_SCRIPTS` in `root-update-service.ts` un-blocks the lifecycle
+ * again, and that is the right fix for `better-sqlite3` and `node-av`, which
+ * genuinely need npm to fetch or build something. It is NOT the right fix for a
+ * patch of ours: making our own patch depend on an npm policy is the dependency
+ * D478 was written to remove. So this runs unconditionally and in addition.
+ *
+ * Safe to run twice: the applier is idempotent by construction — every hunk
+ * recognises its own output, so an already-patched file is skipped rather than
+ * patched again.
+ *
+ * ## Which Node
+ *
+ * `process.execPath` — the one already running. A packaged desktop ships a bare
+ * bundled Node and has no `node` on PATH at all (the Mac agent's process runs
+ * with `PATH=/usr/bin:/bin:/usr/sbin:/sbin`), so resolving `node` by name would
+ * ENOENT on exactly the host this was written for.
+ */
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_util_1 = require("node:util");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+/** Where the published root package keeps its applier, inside a closure. */
+const APPLIER_REL = ['node_modules', '@camstack', 'server', 'scripts', 'closure-postinstall.mjs'];
+/** A patch pass must never be the slow part of an update. */
+const APPLY_TIMEOUT_MS = 60_000;
+function buildSystemApplyClosurePatches(logger) {
+    return async (closureDir) => {
+        const applier = path.join(closureDir, ...APPLIER_REL);
+        if (!fs.existsSync(applier)) {
+            // A closure from before D478, or a root package that ships no patches.
+            // Nothing to apply is not a failure — and the patch VALIDATOR, not this,
+            // is what decides whether a missing patch matters.
+            logger.debug('closure ships no patch applier — nothing to apply', {
+                meta: { applier },
+            });
+            return;
+        }
+        const { stdout, stderr } = await execFileAsync(process.execPath, [applier], {
+            cwd: path.dirname(path.dirname(applier)),
+            timeout: APPLY_TIMEOUT_MS,
+        });
+        // The applier names every file it touched and every one it refused. Those
+        // lines are the only record that the patch pass happened at all, so they
+        // are forwarded rather than swallowed.
+        const output = `${stdout}${stderr}`.trim();
+        if (output.length > 0) {
+            logger.info('closure patches applied', { meta: { output } });
+        }
+    };
+}

package/dist/server-root/index.js

@@ -1071,6 +1071,15 @@ var require_dist = __commonJS({
     __name(buildNpmRegistryArgs, "buildNpmRegistryArgs");
     var NPM_VIEW_TIMEOUT_MS = 2e4;
     var NPM_INSTALL_TIMEOUT_MS = 15 * 6e4;
+    var CLOSURE_ALLOW_SCRIPTS = {
+      "@camstack/server": true,
+      "better-sqlite3": true,
+      "node-av": true,
+      "node-pty": true,
+      ssh2: true,
+      "cpu-features": true,
+      esbuild: true
+    };
     var RESTART_REASON_PREFIX = "server-update";
     var STALE_TRANSIENT_MS = 24 * 60 * 60 * 1e3;
     function readWrapperProbes() {
@@ -1118,6 +1127,7 @@ var require_dist = __commonJS({
       dataDir;
       execNpm;
       ensureNativePrebuildsFn;
+      applyClosurePatchesFn;
       env;
       readWrapperProbesFn;
       now;
@@ -1146,6 +1156,7 @@ var require_dist = __commonJS({
           };
         });
         this.ensureNativePrebuildsFn = options.ensureNativePrebuilds ?? (async () => void 0);
+        this.applyClosurePatchesFn = options.applyClosurePatches ?? (async () => void 0);
         this.env = options.env ?? process.env;
         this.readWrapperProbesFn = options.readWrapperProbes ?? readWrapperProbes;
         this.now = options.now ?? Date.now;
@@ -1461,7 +1472,8 @@ var require_dist = __commonJS({
           } else {
             fs6.writeFileSync(path6.join(stagingDir, "package.json"), JSON.stringify({
               name: "camstack-node-root",
-              private: true
+              private: true,
+              allowScripts: CLOSURE_ALLOW_SCRIPTS
             }, null, 2), "utf-8");
             await this.execNpm([
               ...installArgs,
@@ -1494,6 +1506,15 @@ var require_dist = __commonJS({
           if (missingNatives.length > 0) {
             throw new Error(`staged closure missing native prebuilds: ${missingNatives.join(", ")} \u2014 refusing to arm a swap that would break the forked runners`);
           }
+          try {
+            await this.applyClosurePatchesFn(stagingDir);
+          } catch (err) {
+            this.logger.warn("closure-patch apply step failed \u2014 validator will decide", {
+              meta: {
+                error: err instanceof Error ? err.message : String(err)
+              }
+            });
+          }
           const unpatched = findUnappliedClosurePatches(stagingDir);
           if (unpatched.length > 0) {
             throw new Error(`staged closure did not apply its shipped patches: ${unpatched.join(", ")} \u2014 refusing to arm a swap into an unpatched closure`);
@@ -1541,6 +1562,7 @@ var require_dist = __commonJS({
         return {
           name: "camstack-node-root",
           private: true,
+          allowScripts: CLOSURE_ALLOW_SCRIPTS,
           dependencies: {
             [this.spec.packageName]: fileRef(rootTgz)
           },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.277",
+  "version": "1.2.278",
   "private": false,
   "files": [
     "dist",
@@ -35,18 +35,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "*",
-    "@camstack/addon-agent-ui": "*",
-    "@camstack/addon-auth": "*",
-    "@camstack/addon-decoder-nodeav": "*",
-    "@camstack/addon-notifiers": "*",
-    "@camstack/addon-pipeline": "*",
-    "@camstack/addon-pipeline-orchestrator": "*",
-    "@camstack/addon-post-analysis": "*",
-    "@camstack/sdk": "*",
-    "@camstack/system": "*",
-    "@camstack/types": "*",
-    "@camstack/ui-library": "*",
+    "@camstack/addon-admin-ui": "1.2.187",
+    "@camstack/addon-agent-ui": "1.2.105",
+    "@camstack/addon-auth": "1.2.107",
+    "@camstack/addon-decoder-nodeav": "1.2.100",
+    "@camstack/addon-notifiers": "1.2.104",
+    "@camstack/addon-pipeline": "1.2.227",
+    "@camstack/addon-pipeline-orchestrator": "1.2.190",
+    "@camstack/addon-post-analysis": "1.2.228",
+    "@camstack/sdk": "1.2.103",
+    "@camstack/system": "1.2.227",
+    "@camstack/types": "1.2.184",
+    "@camstack/ui-library": "1.2.151",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/scripts/closure-postinstall.mjs

@@ -13,8 +13,8 @@
  * arrives from npm unpatched. Production ran it unpatched from the day the
  * patch was written until 2026-09-12.
  *
- * The closure is an `npm install` into a staging dir and it passes no
- * `--ignore-scripts`, so this package's own `postinstall` is the one place that
+ * The closure is an `npm install` into a staging dir, so this package's own
+ * `postinstall` is the natural place to do it — it is the one place that
  * (a) runs inside the closure, (b) runs with the NEW release's patch files,
  * and (c) needs no new dependency, no diff library and no change to the update
  * service. Every node gets it identically — hub, Docker agent, Electron agent
@@ -29,6 +29,15 @@
  * must never leave a package half-patched — every hunk is applied to an
  * in-memory copy and the file is written once, or not at all.
  *
+ * ## It is no longer the ONLY place, and must not be (D484)
+ *
+ * "the install passes no `--ignore-scripts`" was true and was the wrong
+ * question. npm 12 blocks a dependency's install scripts WITHOUT the flag, so
+ * on the Mac-mini agent this script was simply never called and the closure
+ * came out unpatched with exit 0. `stageClosure` therefore also invokes this
+ * applier directly, and the idempotence below is what makes running twice
+ * harmless rather than a double patch.
+ *
  * The FAIL-CLOSED half lives elsewhere, in `@camstack/node-root`'s
  * `findUnappliedClosurePatches`, which refuses to swap into a closure whose
  * markers are absent. Silence here is therefore never silence overall: either

package/dist/core/addon/require-cache.js

@@ -1,106 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.purgeRequireCacheUnder = purgeRequireCacheUnder;
-exports.bundleGraphRootFor = bundleGraphRootFor;
-/**
- * require-cache — evicting an addon's own modules so a hot-updated bundle
- * is actually re-read.
- *
- * Lives in its own file because the behaviour it encodes is a Node semantic
- * that cannot be observed from inside the test runner: the runner transforms
- * modules itself, so only a real `node` process re-executing a real CommonJS
- * file proves anything. `require-cache.spec.ts` spawns one.
- */
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-/**
- * Drop every `require`-cached module that lives under `dir`.
- *
- * Node's ESM loader serves a CommonJS module from the require cache, keyed by
- * the resolved filename — the `?t=` query an ESM import uses to force a re-read
- * is stripped before that lookup and therefore does nothing. Since every addon
- * bundle here is CJS, evicting the addon's own entries is what makes a
- * hot-updated bundle actually load.
- *
- * Matched against the REAL path as well as the given one. Node keys the cache
- * by the resolved-and-symlink-followed filename, while an addon directory is
- * assembled from the configured `dataDir` and never realpath'd — so a single
- * symlink anywhere above it (a `dataDir` under macOS's `/tmp`, a relocated data
- * root) makes a prefix match on the given path miss every entry and this
- * function silently do nothing. Which is precisely the failure it exists to
- * fix, wearing its clothes: the catalog would look refreshed and be stale.
- *
- * Scoped to one directory on purpose: a blanket cache clear would evict the
- * hub's own modules and every other addon's, turning a catalog refresh into a
- * process-wide reload. Best-effort — a cache that cannot be walked leaves the
- * previous (stale) behaviour rather than failing the caller.
- *
- * **The directory must be the whole BUNDLE, never the entry's own folder** —
- * see {@link bundleGraphRootFor}. A narrower scope purges half a module graph,
- * which is worse than purging none of it.
- */
-function purgeRequireCacheUnder(dir) {
-    try {
-        const cache = require.cache;
-        if (cache === undefined)
-            return;
-        const prefixes = candidatePrefixes(dir);
-        for (const key of Object.keys(cache)) {
-            if (prefixes.some((prefix) => key.startsWith(prefix)))
-                delete cache[key];
-        }
-    }
-    catch {
-        // Non-CJS host, or a frozen cache. The caller's import still runs.
-    }
-}
-/**
- * The directory that holds one addon bundle's WHOLE module graph.
- *
- * A multi-entry bundle does not live under its entry's folder. Every addon in
- * this repo builds through `tools/build/vite-lib.preset.ts`, whose entries are
- * `dist/<addon>/index.js` — and whose SHARED CHUNKS (`dist/dist-<hash>.js`,
- * `dist/node-<hash>.js`, …) sit one level up, in `dist/`. Purging
- * `dirname(entryPath)` therefore evicts the entry and leaves the chunks, so the
- * re-import RE-EXECUTES the entry against module state that was never reset.
- *
- * That is not a stale-cache bug, it is a corrupted one, and it took the hub's
- * `stream-broker` down on 2026-08-29: the entry chunk carries
- * `log-channels.ts`'s module-scope `declareLogChannel` calls while the
- * `LogChannelRegistry` singleton they write to is inlined into the shared
- * chunk. Half the graph re-ran, the registry did not, and the second
- * declaration threw `log channel "stream-broker.webrtc" is already declared in
- * this process` — a message that is correct, and that named the loader rather
- * than the addon. `dist/` is the unit the bundler emits, so `dist/` is the unit
- * the cache is purged in.
- *
- * `node_modules/` under the addon is deliberately OUTSIDE this root: a package
- * that declares `camstack.nativeDependencies` installs `.node` bindings there,
- * and re-`dlopen`ing a native addon is not a refresh, it is a coin flip.
- *
- * Falls back to the entry's directory when there is no `dist/` above it (a
- * loose `loadFromPath` module in a test or a dev tree) — the historical
- * behaviour, for the shape that has no bundle.
- */
-function bundleGraphRootFor(addonDir, entryPath) {
-    const distDir = node_path_1.default.resolve(addonDir, 'dist');
-    const withSep = distDir.endsWith(node_path_1.default.sep) ? distDir : `${distDir}${node_path_1.default.sep}`;
-    return entryPath.startsWith(withSep) ? distDir : node_path_1.default.dirname(entryPath);
-}
-/** The directory as given and as Node sees it, both as trailing-separator prefixes. */
-function candidatePrefixes(dir) {
-    const withSep = (d) => (d.endsWith(node_path_1.default.sep) ? d : `${d}${node_path_1.default.sep}`);
-    const given = withSep(dir);
-    let real = given;
-    try {
-        real = withSep(node_fs_1.default.realpathSync(dir));
-    }
-    catch {
-        // Directory gone between the caller's existsSync and here — `given` alone
-        // is still a correct (if narrower) match.
-    }
-    return real === given ? [given] : [given, real];
-}