@camstack/server 1.2.36 → 1.2.38

package/dist/launcher.js

@@ -56,6 +56,7 @@ const path = __importStar(require("node:path"));
 const tar = __importStar(require("tar"));
 const yaml = __importStar(require("js-yaml"));
 const framework_nodepath_js_1 = require("./framework-nodepath.js");
+const package_inventory_js_1 = require("./package-inventory.js");
 const bootstrap_packages_js_1 = require("./bootstrap-packages.js");
 /** Path of the manifest file embedded inside every archive. */
 const ARCHIVE_MANIFEST_NAME = '.camstack-backup-manifest.json';
@@ -435,6 +436,64 @@ async function launch() {
             console.warn(`[launcher] could NOT resolve ${pkg}: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    // WHAT ELSE could have run? (D45 enforcement step 2)
+    //
+    // The line above says which copy this boot resolved. It cannot say what else
+    // is lying around, and that is the half that produced three wrong diagnoses:
+    // one agent held FOUR copies of @camstack/system (1.2.28 / 1.2.28 / 1.2.0 /
+    // 1.2.30), so every version the node reported was true of a copy nobody was
+    // running.
+    //
+    // Reported, not fatal. Every node in the fleet currently HAS extra copies —
+    // the image seeds under /opt and the legacy /data/framework — and D45 records
+    // their removal as a deliberate, scheduled migration with a container
+    // recreate as the escape hatch, not something a routine boot should enact by
+    // refusing to start. `CAMSTACK_INVENTORY_STRICT=1` makes it fatal, which is
+    // how a layout that HAS been cleaned keeps itself clean.
+    try {
+        const inventory = (0, package_inventory_js_1.inventoryHostProvided)((0, package_inventory_js_1.hostProvidedSearchRoots)({
+            nodePath: process.env['NODE_PATH'],
+            pathSeparator: process.platform === 'win32' ? ';' : ':',
+            dataDir: DATA_DIR,
+            serverNodeModules: nodeModulesDir,
+            seedRoots: (0, package_inventory_js_1.seedNodeModulesRoots)(fs),
+        }), {
+            exists: (dir) => fs.existsSync(path.join(dir, 'package.json')),
+            readVersion: (dir) => {
+                try {
+                    const raw = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8'));
+                    const version = typeof raw === 'object' && raw !== null
+                        ? raw.version
+                        : undefined;
+                    return typeof version === 'string' ? version : null;
+                }
+                catch {
+                    return null;
+                }
+            },
+            realPath: (dir) => {
+                try {
+                    return fs.realpathSync(dir);
+                }
+                catch {
+                    return dir;
+                }
+            },
+        });
+        const report = (0, package_inventory_js_1.formatInventoryReport)(inventory);
+        if (report !== '') {
+            console.error(`[launcher] ${report}`);
+            if (process.env['CAMSTACK_INVENTORY_STRICT'] === '1') {
+                console.error('[launcher] CAMSTACK_INVENTORY_STRICT=1 — refusing to boot on this layout');
+                process.exit(1);
+            }
+        }
+    }
+    catch (err) {
+        // The inventory is diagnostics. It must never be the reason a node fails
+        // to boot when it is the thing that was supposed to explain failures.
+        console.warn(`[launcher] package inventory failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
     // Now safe to load the role's runtime entry (both have static imports from
     // @camstack/system, resolved only after the framework dir + NODE_PATH setup
     // above). The agent boots from THIS same @camstack/server closure — there is

package/dist/package-inventory.js

@@ -0,0 +1,180 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HOST_PROVIDED_PACKAGES = void 0;
+exports.hostProvidedSearchRoots = hostProvidedSearchRoots;
+exports.seedNodeModulesRoots = seedNodeModulesRoots;
+exports.inventoryHostProvided = inventoryHostProvided;
+exports.formatInventoryReport = formatInventoryReport;
+/**
+ * Boot-time inventory of host-provided packages — enforcement step 2 of
+ * [D45](../../../docs/decisions/adr-0045.md).
+ *
+ * D45 requires exactly ONE copy of every host-provided package per node, inside
+ * the active server closure. The record exists because that was not true: one
+ * agent held four copies of `@camstack/system` — 1.2.28 under the image seed,
+ * 1.2.28 under a second seed tree, 1.2.0 in the legacy `/data/framework`, and
+ * 1.2.30 in the closure — and each could be truthfully quoted as "the version".
+ * Three consecutive diagnoses of which one actually ran were each disproved by
+ * the next measurement.
+ *
+ * Step 1 (the launcher naming the copy it RESOLVED) answers "which one runs".
+ * This answers the other half — "what else is lying around that could have
+ * run" — which is the question a resolved path alone cannot.
+ *
+ * Everything here is pure: the caller injects the three filesystem operations,
+ * so the whole inventory is testable against a described layout rather than a
+ * real disk.
+ */
+const path = __importStar(require("node:path"));
+/**
+ * Packages the closure provides to everything on the node. Addons never bundle
+ * these ([D15](../../../docs/decisions/adr-0015.md)); a second copy on disk is
+ * a resolution race waiting for a boot order to change.
+ */
+exports.HOST_PROVIDED_PACKAGES = [
+    '@camstack/system',
+    '@camstack/types',
+    '@camstack/sdk',
+];
+/**
+ * Every directory under which a host-provided package could sit as
+ * `<root>/<pkgName>`.
+ *
+ * The list is explicit rather than a filesystem walk: these are the places a
+ * copy has actually turned up, each named in D45, and a bounded list keeps this
+ * to a handful of stat calls at boot. `/data/addons` is a root in its own right
+ * because the bootstrap-install layout puts the package DIRECTLY there
+ * (`/data/addons/@camstack/system`), not under a `node_modules`.
+ */
+function hostProvidedSearchRoots(input) {
+    const fromNodePath = (input.nodePath ?? '')
+        .split(input.pathSeparator)
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0);
+    const roots = [
+        input.serverNodeModules,
+        ...fromNodePath,
+        path.join(input.dataDir, 'framework', 'node_modules'),
+        path.join(input.dataDir, 'addons'),
+        ...input.seedRoots,
+    ];
+    const seen = new Set();
+    return roots.filter((r) => {
+        if (seen.has(r))
+            return false;
+        seen.add(r);
+        return true;
+    });
+}
+/**
+ * The image seed trees: `/opt/<name>/node_modules`.
+ *
+ * Enumerated rather than hardcoded because their names have changed with the
+ * image layout (`camstack-hub`, `camstack-seed-framework`, …) and a hardcoded
+ * list would quietly stop finding the copy it was written for. Returns empty
+ * when `/opt` does not exist, which is every dev machine.
+ */
+function seedNodeModulesRoots(fs, optDir = '/opt') {
+    if (!fs.existsSync(optDir))
+        return [];
+    try {
+        return fs
+            .readdirSync(optDir)
+            .map((name) => path.join(optDir, name, 'node_modules'))
+            .filter((dir) => fs.existsSync(dir));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Find every copy of every host-provided package under `roots`.
+ *
+ * A copy whose package.json will not parse is still RECORDED, with a null
+ * version. Dropping it would under-report the very thing this exists to
+ * count — and an unreadable copy is exactly the kind that has been sitting
+ * somewhere since an interrupted install.
+ */
+function inventoryHostProvided(roots, fs, packages = exports.HOST_PROVIDED_PACKAGES) {
+    const copies = [];
+    for (const pkg of packages) {
+        // Keyed by canonical path: two roots that are the same directory (a
+        // symlinked closure, a repeated NODE_PATH entry) are ONE copy, and calling
+        // them two would cry wolf on a node that is actually compliant.
+        const seenReal = new Set();
+        for (const root of roots) {
+            const dir = path.join(root, pkg);
+            if (!fs.exists(dir))
+                continue;
+            const real = fs.realPath(dir);
+            if (seenReal.has(real))
+                continue;
+            seenReal.add(real);
+            copies.push({ pkg, path: dir, version: fs.readVersion(dir) });
+        }
+    }
+    const countByPkg = new Map();
+    for (const c of copies)
+        countByPkg.set(c.pkg, (countByPkg.get(c.pkg) ?? 0) + 1);
+    const duplicated = [...countByPkg.entries()]
+        .filter(([, n]) => n > 1)
+        .map(([pkg]) => pkg)
+        .sort();
+    return { copies, duplicated, rootsScanned: roots };
+}
+/**
+ * The loud report. Empty string when the node is clean — a compliant boot says
+ * nothing, so the one that isn't stands out instead of scrolling past.
+ */
+function formatInventoryReport(result) {
+    if (result.duplicated.length === 0)
+        return '';
+    const lines = [
+        'D45 violation — a host-provided package exists more than once on this node.',
+        'Which copy runs is a module-resolution outcome, and every version this node',
+        'reports is a claim about one of them rather than about the node.',
+        '',
+    ];
+    for (const pkg of result.duplicated) {
+        const found = result.copies.filter((c) => c.pkg === pkg);
+        lines.push(`  ${pkg} — ${found.length} copies:`);
+        for (const c of found) {
+            lines.push(`    ${c.version ?? '<unreadable package.json>'}  ${c.path}`);
+        }
+    }
+    lines.push('', `  roots scanned: ${result.rootsScanned.join(', ')}`);
+    return lines.join('\n');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.36",
+  "version": "1.2.38",
   "private": false,
   "files": [
     "dist",
@@ -35,16 +35,16 @@
   "dependencies": {
     "@camstack/addon-admin-ui": "1.2.22",
     "@camstack/addon-agent-ui": "1.2.10",
-    "@camstack/addon-auth": "1.2.10",
+    "@camstack/addon-auth": "1.2.11",
     "@camstack/addon-decoder-nodeav": "1.2.9",
-    "@camstack/addon-notifiers": "1.2.11",
+    "@camstack/addon-notifiers": "1.2.12",
     "@camstack/addon-pipeline": "1.2.39",
     "@camstack/addon-pipeline-orchestrator": "1.2.19",
     "@camstack/addon-post-analysis": "1.2.24",
     "@camstack/sdk": "1.2.9",
     "@camstack/shm-ring": "1.1.9",
-    "@camstack/system": "1.2.31",
-    "@camstack/types": "1.2.23",
+    "@camstack/system": "1.2.32",
+    "@camstack/types": "1.2.24",
     "@camstack/ui-library": "1.2.18",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",