@camstack/server 1.2.32 → 1.2.34

package/dist/api/trpc/trpc.router.js

@@ -17,7 +17,6 @@ const logs_router_js_1 = require("../core/logs.router.js");
 const notifications_router_js_1 = require("../core/notifications.router.js");
 const repl_router_js_1 = require("../core/repl.router.js");
 const server_management_provider_js_1 = require("../core/server-management.provider.js");
-const settings_backend_router_js_1 = require("../core/settings-backend.router.js");
 const stream_probe_router_js_1 = require("../core/stream-probe.router.js");
 const system_events_router_js_1 = require("../core/system-events.router.js");
 const cap_router_runtime_js_1 = require("./cap-router-runtime.js");
@@ -260,7 +259,6 @@ function buildCapabilityRouters(services) {
         // NOT the three-level settings gateway — that's the
         // `addonSettings` cap router (mounted dynamically above).
         addonSettingsRaw: (0, addon_settings_router_js_1.createAddonSettingsRouter)(services.configService),
-        settingsBackend: (0, settings_backend_router_js_1.createSettingsBackendRouter)(() => services.addonRegistry.getSettingsBackend()),
         eventBusProxy: (0, event_bus_proxy_router_js_1.createEventBusProxyRouter)(services.eventBus),
         repl: (0, repl_router_js_1.createReplRouter)(services.replEngine),
         systemEvents: (0, system_events_router_js_1.createSystemEventsRouter)(services.eventBus),

package/dist/core/addon/addon-registry.service.js

@@ -42,6 +42,7 @@ const addon_row_manifest_1 = require("./addon-row-manifest");
 const runner_convergence_1 = require("./runner-convergence");
 const package_dir_utils_1 = require("./package-dir-utils");
 const types_1 = require("@camstack/types");
+const prune_misplaced_addons_js_1 = require("./prune-misplaced-addons.js");
 const system_1 = require("@camstack/system");
 const system_2 = require("@camstack/system");
 const client_1 = require("@trpc/client");
@@ -481,6 +482,20 @@ class AddonRegistryService {
             this.healthMonitor.recordFailure(fail.packageName, fail.error, fail.addonId);
         }
         const loadedAddons = this.addonLoader.listAddons();
+        // Self-heal a leftover from before the installer honoured placement:
+        // `@camstack/addon-agent-ui` sat in /data/addons on the live hub dated
+        // 2026-07-22, skipped by the loop below ever since, and therefore shown as
+        // FAILED forever on a node where it cannot run. Fixing the installer was
+        // necessary and not sufficient — nothing removed what was already there,
+        // and a permanent red entry teaches people to ignore red entries.
+        (0, prune_misplaced_addons_js_1.prunePlacementLeftovers)((0, prune_misplaced_addons_js_1.decidePrune)(loadedAddons.map((a) => ({
+            packageName: a.packageName,
+            dir: path.join(addonsDir, a.packageName),
+            placement: (0, types_1.resolveAddonPlacement)(a.declaration),
+        })), 'hub'), path.join(addonsDir, '@camstack'), {
+            info: (msg, meta) => this.logger.info(msg, { meta }),
+            warn: (msg, meta) => this.logger.warn(msg, { meta }),
+        });
         for (const registered of loadedAddons) {
             // Skip agent-only addons — they never run on the hub, only on remote
             // agents that opt in via `execution.placement: 'agent-only'`.

package/dist/core/addon/prune-misplaced-addons.js

@@ -0,0 +1,138 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decidePrune = decidePrune;
+exports.isPrunableDir = isPrunableDir;
+exports.prunePlacementLeftovers = prunePlacementLeftovers;
+/**
+ * prune-misplaced-addons — remove an installed addon that can never run here.
+ *
+ * ## The state this exists to clear
+ *
+ * `@camstack/addon-agent-ui` declares `execution.placement: 'agent-only'`, and
+ * both hub-side load paths honour that: `addon-registry.service.ts` skips it at
+ * boot and after an install. `selectHubBootstrapPackages` also subtracts it, so
+ * a hub does not install it any more.
+ *
+ * None of that removes the copy an OLDER build already put on disk. On the live
+ * hub `/data/addons/@camstack/addon-agent-ui` is dated 2026-07-22 — eleven days
+ * before this was looked at. The loader skips it, so it never initialises, so
+ * the fleet UI shows it as **failed**, forever, on a node where it is not
+ * supposed to exist. An operator cannot tell that apart from an addon that is
+ * genuinely broken, which is the real cost: a permanent red entry teaches
+ * people to ignore red entries.
+ *
+ * Fixing the installer was necessary and not sufficient — the previous fix
+ * assumed no leftovers. This closes it.
+ *
+ * ## Why deleting is the right move
+ *
+ * An `agent-only` addon on a hub has no dormant use: it cannot be enabled, it
+ * cannot be reached, and keeping it costs a false failure. The directory is
+ * reinstallable from npm at any time, so removal is not destructive in the way
+ * deleting DATA would be. Anything outside `<dataDir>/addons/@camstack/` is
+ * refused outright.
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/**
+ * Decide what to prune for a node in `role`. Pure — the decision is the part
+ * worth testing, and it must never depend on a filesystem to be checked.
+ *
+ * Only the unambiguous direction is pruned: an `agent-only` addon on a hub. The
+ * mirror case (`hub-only` on an agent) is deliberately NOT handled here — an
+ * agent seeds its addon set from the hub's closure and a `hub-only` entry there
+ * is expected to be inert, so pruning it would fight the seeding rather than
+ * fix anything.
+ */
+function decidePrune(installed, role) {
+    if (role !== 'hub')
+        return [];
+    return installed
+        .filter((a) => a.placement === 'agent-only')
+        .map((a) => ({
+        packageName: a.packageName,
+        dir: a.dir,
+        reason: 'agent-only addon installed on the hub — it can never load here',
+    }));
+}
+/** Guard: only ever remove something under `<dataDir>/addons/@camstack/`. */
+function isPrunableDir(dir, addonsRoot) {
+    const rel = path.relative(addonsRoot, dir);
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel))
+        return false;
+    // Exactly one level below the scope directory — never a nested path.
+    return rel.split(path.sep).filter(Boolean).length === 1;
+}
+/**
+ * Apply the decisions. Returns what was actually removed.
+ *
+ * A failure to remove one entry never aborts the rest and never throws into
+ * boot: the worst case is the pre-existing state — a stale entry showing as
+ * failed — which is exactly what we are trying to improve, not a reason to
+ * refuse to start.
+ */
+function prunePlacementLeftovers(decisions, addonsRoot, logger, rm = (dir) => fs.rmSync(dir, { recursive: true, force: true })) {
+    const removed = [];
+    for (const d of decisions) {
+        if (!isPrunableDir(d.dir, addonsRoot)) {
+            logger.warn('refusing to prune a path outside the addon scope', {
+                packageName: d.packageName,
+                dir: d.dir,
+                addonsRoot,
+            });
+            continue;
+        }
+        try {
+            rm(d.dir);
+            removed.push(d.packageName);
+            // Say it out loud: a directory disappearing at boot must never be
+            // something the operator discovers by noticing it is gone.
+            logger.info('pruned a misplaced addon', {
+                packageName: d.packageName,
+                dir: d.dir,
+                reason: d.reason,
+            });
+        }
+        catch (err) {
+            logger.warn('could not prune a misplaced addon', {
+                packageName: d.packageName,
+                dir: d.dir,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    return removed;
+}

package/dist/main.js

@@ -183,8 +183,8 @@ async function bootstrap() {
     // the starter: the starter runs from the image's /opt closure, which only
     // changes with a new image, while this entry is what `applyServerUpdate`
     // replaces — so the telemetry reaches a running hub the same day it is
-    // written. See packages/node-root/src/heap-watch.ts for why it exists (four
-    // silent OOMs in ~15h, one nine seconds after a viewer connected).
+    // written. See packages/system/src/kernel/heap-watch.ts for why it exists
+    // (four silent OOMs in ~15h, one nine seconds after a viewer connected).
     (0, system_2.startHeapWatch)();
     // Clean up orphaned processes from previous crashes before starting
     cleanupOrphanProcesses();

package/dist/server-root/index.js

@@ -86,6 +86,7 @@ var require_dist = __commonJS({
       SERVER_ROOT_DIRNAME: /* @__PURE__ */ __name(() => SERVER_ROOT_DIRNAME, "SERVER_ROOT_DIRNAME"),
       SERVER_ROOT_STATE_FILE: /* @__PURE__ */ __name(() => SERVER_ROOT_STATE_FILE, "SERVER_ROOT_STATE_FILE"),
       applyPendingRootSwap: /* @__PURE__ */ __name(() => applyPendingRootSwap, "applyPendingRootSwap"),
+      assessImageContract: /* @__PURE__ */ __name(() => assessImageContract, "assessImageContract"),
       clearPendingRootSwap: /* @__PURE__ */ __name(() => clearPendingRootSwap, "clearPendingRootSwap"),
       clearRestartIntentMarker: /* @__PURE__ */ __name(() => clearRestartIntentMarker, "clearRestartIntentMarker"),
       compareSemver: /* @__PURE__ */ __name(() => compareSemver, "compareSemver"),
@@ -712,6 +713,82 @@ var require_dist = __commonJS({
       };
     }
     __name(planBoot, "planBoot");
+    function releaseSeries(version) {
+      const [major, minor] = version.split(".").map((seg) => {
+        const n = Number.parseInt(seg, 10);
+        return Number.isNaN(n) ? 0 : n;
+      });
+      return [
+        major ?? 0,
+        minor ?? 0
+      ];
+    }
+    __name(releaseSeries, "releaseSeries");
+    function sameSeries(a, b) {
+      const [aMajor, aMinor] = releaseSeries(a);
+      const [bMajor, bMinor] = releaseSeries(b);
+      return aMajor === bMajor && aMinor === bMinor;
+    }
+    __name(sameSeries, "sameSeries");
+    function behindMessage(seed, contract, series) {
+      const base = `This node is running an image whose baked seed is @camstack/server@${seed}; the deployment contract currently delivers ${contract}. applyServerUpdate keeps the code current but NEVER updates the image \u2014 the starter, the entrypoint and the boot fallback are still the old copies.`;
+      if (!series) {
+        return `${base} Recreate the container from the contract image to converge.`;
+      }
+      return `${base} The seed is a full release series behind \u2014 the shape of a pinned tag or an image repository that no longer receives builds, where a docker pull fixes nothing. Verify the container's image reference against the deployment templates.`;
+    }
+    __name(behindMessage, "behindMessage");
+    function assessImageContract(inputs) {
+      const { seedVersion, latestVersion, runningVersion } = inputs;
+      if (seedVersion === null) {
+        return {
+          state: "unknown",
+          seedVersion: null,
+          contractVersion: latestVersion,
+          contractSource: latestVersion !== null ? "registry" : null,
+          message: "No baked seed closure detected (dev workspace) \u2014 no image contract to compare."
+        };
+      }
+      const contractVersion = latestVersion ?? (runningVersion !== null && compareSemver(seedVersion, runningVersion) < 0 ? runningVersion : null);
+      if (contractVersion === null) {
+        return {
+          state: "unknown",
+          seedVersion,
+          contractVersion: null,
+          contractSource: null,
+          message: `This node is running an image whose baked seed is @camstack/server@${seedVersion}; no registry check has run yet, so the release the contract image delivers is unknown. Run a server-update check to verify the image against the contract.`
+        };
+      }
+      const contractSource = latestVersion !== null ? "registry" : "running";
+      const cmp = compareSemver(seedVersion, contractVersion);
+      if (cmp === 0) {
+        return {
+          state: "in-sync",
+          seedVersion,
+          contractVersion,
+          contractSource,
+          message: `Image seed @camstack/server@${seedVersion} matches the current release \u2014 this node is running the image the deployment contract names.`
+        };
+      }
+      if (cmp > 0) {
+        return {
+          state: "ahead",
+          seedVersion,
+          contractVersion,
+          contractSource,
+          message: `Image seed @camstack/server@${seedVersion} is NEWER than the best-known release ${contractVersion} \u2014 the registry check is stale or the registry was unreachable. Re-run a server-update check.`
+        };
+      }
+      const series = !sameSeries(seedVersion, contractVersion);
+      return {
+        state: series ? "behind-series" : "behind-patch",
+        seedVersion,
+        contractVersion,
+        contractSource,
+        message: behindMessage(seedVersion, contractVersion, series)
+      };
+    }
+    __name(assessImageContract, "assessImageContract");
     var fs4 = __toESM2(require("fs"));
     var path4 = __toESM2(require("path"));
     function detectWorkspaceRoot(fromDir) {
@@ -955,7 +1032,16 @@ var require_dist = __commonJS({
           pendingVersion: pending?.version ?? null,
           rolledBack: null,
           stateFileCorrupt: false,
-          lastCheckedAtMs: this.checkCache?.checkedAtMs ?? null
+          lastCheckedAtMs: this.checkCache?.checkedAtMs ?? null,
+          // Seed-vs-contract verdict: `runningVersion` can be perfectly current
+          // (applyServerUpdate) while the IMAGE is weeks old from a dead repo —
+          // 2026-08-02, hub on `camstack-server:intel-1.1.74` with every other
+          // field green. See `image-contract.ts` for the full account.
+          imageContract: assessImageContract({
+            seedVersion: this.seedVersion(),
+            latestVersion,
+            runningVersion
+          })
         };
       }
       // ── Check ─────────────────────────────────────────────────────────────
@@ -989,6 +1075,20 @@ var require_dist = __commonJS({
             checkedAtMs: this.now(),
             error: null
           };
+          const imageContract = assessImageContract({
+            seedVersion: this.seedVersion(),
+            latestVersion,
+            runningVersion
+          });
+          if (imageContract.state === "behind-patch" || imageContract.state === "behind-series") {
+            this.logger.warn(`image seed diverges from the release contract: ${imageContract.message}`, {
+              meta: {
+                state: imageContract.state,
+                seedVersion: imageContract.seedVersion,
+                contractVersion: imageContract.contractVersion
+              }
+            });
+          }
           const updateAvailable = latestVersion !== null && runningVersion !== null && compareSemver(latestVersion, runningVersion) > 0;
           return {
             packageName: this.spec.packageName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.32",
+  "version": "1.2.34",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "*",
-    "@camstack/addon-agent-ui": "*",
-    "@camstack/addon-auth": "*",
-    "@camstack/addon-decoder-nodeav": "*",
-    "@camstack/addon-notifiers": "*",
-    "@camstack/addon-pipeline": "*",
-    "@camstack/addon-pipeline-orchestrator": "*",
-    "@camstack/addon-post-analysis": "*",
-    "@camstack/sdk": "*",
-    "@camstack/shm-ring": "*",
-    "@camstack/system": "*",
-    "@camstack/types": "*",
-    "@camstack/ui-library": "*",
+    "@camstack/addon-admin-ui": "1.2.22",
+    "@camstack/addon-agent-ui": "1.2.10",
+    "@camstack/addon-auth": "1.2.10",
+    "@camstack/addon-decoder-nodeav": "1.2.9",
+    "@camstack/addon-notifiers": "1.2.11",
+    "@camstack/addon-pipeline": "1.2.39",
+    "@camstack/addon-pipeline-orchestrator": "1.2.19",
+    "@camstack/addon-post-analysis": "1.2.23",
+    "@camstack/sdk": "1.2.9",
+    "@camstack/shm-ring": "1.1.9",
+    "@camstack/system": "1.2.30",
+    "@camstack/types": "1.2.22",
+    "@camstack/ui-library": "1.2.18",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/api/addons-custom.router.js

@@ -1,99 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAddonsCustomProcedures = createAddonsCustomProcedures;
-/**
- * `api.addons.custom` — generic dispatcher for addon-defined custom actions.
- *
- * Task 7.2 of the device-proxy redesign. Addons declare a catalog of
- * custom actions at boot via `AddonInitResult.customActions` + a single
- * `handleCustomAction(action, input)` handler. The catalog is registered
- * with a per-process `CustomActionRegistry` (Task 7.1). This endpoint is
- * the single tRPC entry point that resolves an `(addonId, action)` pair,
- * validates input + output against the action's Zod schemas, enforces the
- * action's declared auth level, and dispatches to the addon handler.
- *
- * The factory returns a record of procedures (not a router) so the caller
- * can spread it into the existing `addons` namespace:
- *
- *   trpcRouter({
- *     ...existingAddonsProcedures,
- *     ...createAddonsCustomProcedures({ getCustomActionRegistry: ... }),
- *   })
- *
- * This avoids `mergeRouters` (which requires sharing the `t` instance
- * across modules) while still mounting the procedure at `api.addons.custom`.
- */
-const zod_1 = require("zod");
-const server_1 = require("@trpc/server");
-const trpc_middleware_js_1 = require("./trpc/trpc.middleware.js");
-/**
- * Build the procedure record for the `custom` endpoint.
- *
- * The OUTER procedure is `protectedProcedure` — every caller must be
- * authenticated. The INNER per-action auth declared in `spec.auth` is
- * enforced manually by `ensureAuth` because the auth level is not known
- * until after the registry lookup.
- */
-function createAddonsCustomProcedures(deps) {
-    return {
-        custom: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({
-            addonId: zod_1.z.string().min(1),
-            action: zod_1.z.string().min(1),
-            input: zod_1.z.unknown(),
-        }))
-            .output(zod_1.z.unknown())
-            .mutation(async ({ input, ctx }) => {
-            const registry = deps.getCustomActionRegistry();
-            const entry = registry.resolve(input.addonId, input.action);
-            if (!entry) {
-                throw new server_1.TRPCError({
-                    code: 'NOT_FOUND',
-                    message: `addon '${input.addonId}' has no custom action '${input.action}'`,
-                });
-            }
-            // Per-action authorization. The outer procedure already requires
-            // authentication; here we additionally enforce the declared role
-            // when it's stricter than 'protected'.
-            ensureAuth(ctx, entry.spec.auth);
-            // Validate input against the action's declared Zod schema.
-            const parsedInput = entry.spec.input.parse(input.input);
-            // Dispatch through the addon handler, forwarding the authenticated
-            // caller when the action declares `caller: 'required'`. The caller is
-            // derived server-side from the request principal (never trusted from
-            // input); `ctx.user` is guaranteed present because `ensureAuth` above
-            // rejects unauthenticated callers for any non-public action, and the
-            // outer `protectedProcedure` rejects them for public ones.
-            const caller = entry.spec.caller === 'required' && ctx.user
-                ? { userId: ctx.user.id, isAdmin: ctx.user.isAdmin }
-                : undefined;
-            const result = await entry.handler(parsedInput, caller);
-            // Validate the addon's output. Crash-early on misbehaving addons.
-            return entry.spec.output.parse(result);
-        }),
-    };
-}
-/**
- * Enforce the action's declared auth level.
- *
- * Mirrors the role checks performed by `protectedProcedure` and
- * `adminProcedure` in trpc.middleware.ts:
- *   - public:    no auth
- *   - protected: any authenticated user
- *   - admin:     isAdmin only (scoped tokens bounce)
- */
-function ensureAuth(ctx, level) {
-    if (level === 'public')
-        return;
-    if (!ctx.user) {
-        throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
-    }
-    if (level === 'protected')
-        return;
-    if (level === 'admin') {
-        if (!ctx.user.isAdmin) {
-            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'custom action requires admin' });
-        }
-        return;
-    }
-}