@camstack/server 1.2.476 → 1.2.478

package/dist/agent/agent-service.js

@@ -42,6 +42,7 @@ const path = __importStar(require("node:path"));
 const system_1 = require("@camstack/system");
 const moleculer_1 = require("moleculer");
 const agent_deploy_swap_js_1 = require("./agent-deploy-swap.js");
+const agent_undeploy_js_1 = require("./agent-undeploy.js");
 const apply_model_distribution_js_1 = require("./apply-model-distribution.js");
 const fetch_bundle_from_hub_js_1 = require("./fetch-bundle-from-hub.js");
 /**
@@ -57,6 +58,14 @@ const deploySwapLogger = {
     child: () => deploySwapLogger,
     withTags: () => deploySwapLogger,
 };
+/**
+ * Packages an agent bootstraps itself when the bootstrap does not say
+ * otherwise. Mirrors the hub reconcile's `AGENT_BOOTSTRAP_PACKAGES`.
+ */
+const DEFAULT_AGENT_BOOTSTRAP_PACKAGES = new Set([
+    '@camstack/system',
+    '@camstack/addon-agent-ui',
+]);
 /** Timeout for the agent-local `$process.restart` delegation. */
 const AGENT_PROCESS_RESTART_TIMEOUT_MS = 30_000;
 function getLocalIps() {
@@ -455,81 +464,28 @@ function createAgentService(deps) {
                 },
             },
             /**
-             * Genuinely drop a deployed addon from this agent.
-             *
-             * A plain `loadedAddons.delete()` only forgets the bookkeeping entry —
-             * the addon instance keeps running and, crucially, its Moleculer
-             * service keeps advertising the addon's capabilities into the cluster
-             * (the hub still sees the provider as a live `<cap>@<agent>` entry).
-             * To truly undeploy we must, in order:
-             *   1. `shutdown()` the running instance (releases timers, sockets,
-             *      native handles) — same hook the agent's SIGTERM path uses.
-             *   2. `broker.destroyService(addonId)` — the deployed-addon Moleculer
-             *      service is named after the addon DECLARATION id (see
-             *      `createAddonService` → `name: declaration.id`). Destroying it
-             *      unregisters every capability action so the cluster stops
-             *      routing to / advertising this agent's provider.
-             *   3. Drop the `loadedAddons` entry and delete the on-disk folder.
-             *
-             * `addonId` here is the addon DECLARATION id — the same key
-             * `loadedAddons` uses and the same value `$agent.status` reports, so
-             * the hub reconciler can match it directly.
+             * Genuinely drop a deployed addon — or a whole package — from this agent.
+             * `{ packageName }` is the operator's uninstall (`addons.uninstallPackage
+             * ({ nodeId })`); `{ addonId }` is the stale-addon reconcile. Both stop the
+             * runner(s) hosting the addon, which the old body never did: on an agent
+             * nearly every addon lives in a group runner, so deleting its folder left
+             * the process running and advertising its caps. See `agent-undeploy.ts`.
              */
             undeploy: {
                 handler: async (ctx) => {
                     const { params, broker } = ctx;
-                    const { addonId } = params;
-                    const entry = deps.loadedAddons.get(addonId);
-                    // 1. Shut the running instance down (best-effort — a throwing
-                    //    disposer must not block the rest of the teardown).
-                    if (entry?.addon?.shutdown) {
-                        try {
-                            await entry.addon.shutdown();
-                        }
-                        catch (err) {
-                            broker.logger.warn(`$agent.undeploy: ${addonId} shutdown() threw`, {
-                                error: String(err),
-                            });
-                        }
-                    }
-                    // 2. Destroy the Moleculer service so the cluster stops seeing
-                    //    this agent's capability providers for the addon.
-                    try {
-                        await broker.destroyService(addonId);
-                    }
-                    catch {
-                        // Service may not exist (group-spawned addons have no per-addon
-                        // service on the agent broker, or it was never created).
-                    }
-                    // 3. Forget the entry and remove the deployed folder. The deploy
-                    //    handler keys the on-disk dir by the PACKAGE name, but $agent
-                    //    redeploys for a single addon use addonId === packageName for
-                    //    unscoped packages; remove whichever folder matches.
-                    deps.loadedAddons.delete(addonId);
-                    const addonDir = path.join(deps.addonsDir, addonId);
-                    if (fs.existsSync(addonDir)) {
-                        fs.rmSync(addonDir, { recursive: true, force: true });
-                    }
-                    // Defense-in-depth: one package dir can host MANY addons (e.g.
-                    // `@camstack/addon-pipeline` ships decoder-ffmpeg, recorder,
-                    // motion-wasm, …). Removing the whole bundle because ONE member was
-                    // undeployed is destructive — every sibling runner would crash-loop
-                    // on the missing package.json. Only remove the package dir when no
-                    // OTHER loaded addon still lives in it (this addon's own entry was
-                    // already deleted from `loadedAddons` above, so the remaining
-                    // values are exactly the siblings).
-                    const pkgName = entry?.packageName;
-                    if (pkgName && pkgName !== addonId) {
-                        const pkgShared = [...deps.loadedAddons.values()].some((e) => e.packageName === pkgName);
-                        if (!pkgShared) {
-                            const pkgDir = path.join(deps.addonsDir, pkgName);
-                            if (fs.existsSync(pkgDir)) {
-                                fs.rmSync(pkgDir, { recursive: true, force: true });
-                            }
-                        }
-                    }
-                    broker.logger.info(`$agent.undeploy: ${addonId} disposed (instance + service + folder)`);
-                    return { success: true, addonId };
+                    return (0, agent_undeploy_js_1.undeployFromAgent)({
+                        addonsDir: deps.addonsDir,
+                        loadedAddons: deps.loadedAddons,
+                        bootstrapPackages: deps.bootstrapPackages ?? DEFAULT_AGENT_BOOTSTRAP_PACKAGES,
+                        listRunnersByAddon: (addonId) => broker.call('$process.listByAddon', { addonId }, { nodeID: broker.nodeID, timeout: AGENT_PROCESS_RESTART_TIMEOUT_MS }),
+                        stopRunner: (name) => broker.call('$process.stop', { name }, { nodeID: broker.nodeID, timeout: AGENT_PROCESS_RESTART_TIMEOUT_MS }),
+                        destroyService: (addonId) => broker.destroyService(addonId),
+                        unregisterProvider: (capName, addonId) => deps.unregisterProvider?.(capName, addonId),
+                        respawnSurvivors: deps.reloadDeployedAddons,
+                        reconcileNodeRegistration: deps.reconcileNodeRegistration,
+                        logger: deploySwapLogger,
+                    }, { addonId: params.addonId, packageName: params.packageName });
                 },
             },
             /**

package/dist/agent/agent-undeploy.js

@@ -0,0 +1,255 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.undeployFromAgent = undeployFromAgent;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const agent_group_runner_js_1 = require("./agent-group-runner.js");
+function capName(cap) {
+    return typeof cap === 'string' ? cap : cap.name;
+}
+function packageDirFor(addonsDir, packageName) {
+    const resolved = path.resolve(addonsDir, packageName);
+    const root = path.resolve(addonsDir);
+    // A package name is data from the network. It must name a dir INSIDE the
+    // addon root and never the root itself.
+    if (resolved === root || !resolved.startsWith(root + path.sep))
+        return null;
+    return resolved;
+}
+function resolveTarget(seam, request) {
+    const packageName = request.packageName ??
+        (request.addonId !== undefined
+            ? seam.loadedAddons.get(request.addonId)?.packageName
+            : undefined);
+    const packageDir = packageName !== undefined ? packageDirFor(seam.addonsDir, packageName) : null;
+    const manifest = packageDir !== null ? (0, agent_group_runner_js_1.readPackageManifestAddons)(packageDir) : null;
+    const capsByAddon = new Map();
+    let protectedBy = null;
+    for (const decl of manifest?.declarations ?? []) {
+        capsByAddon.set(decl.id, (decl.capabilities ?? []).map(capName));
+        if (decl.protected === true)
+            protectedBy = decl.id;
+    }
+    if (request.packageName === undefined) {
+        return {
+            packageName,
+            addonIds: request.addonId !== undefined ? [request.addonId] : [],
+            capsByAddon,
+            packageDir,
+            protectedBy,
+        };
+    }
+    const ids = new Set(capsByAddon.keys());
+    for (const entry of seam.loadedAddons.values()) {
+        if (entry.packageName === request.packageName)
+            ids.add(entry.id);
+    }
+    return { packageName, addonIds: [...ids], capsByAddon, packageDir, protectedBy };
+}
+function refusalReason(seam, target) {
+    if (target.packageName !== undefined && seam.bootstrapPackages.has(target.packageName)) {
+        return `${target.packageName} is this node's bootstrap infrastructure and cannot be uninstalled`;
+    }
+    if (target.protectedBy !== null) {
+        return `${target.packageName ?? 'package'} is protected (addon "${target.protectedBy}" declares protected: true)`;
+    }
+    if (target.packageName === undefined && target.addonIds.length === 0) {
+        return 'neither addonId nor packageName was given';
+    }
+    return null;
+}
+async function shutdownInProcess(seam, addonId) {
+    const entry = seam.loadedAddons.get(addonId);
+    if (entry?.addon?.shutdown) {
+        try {
+            await entry.addon.shutdown();
+        }
+        catch (err) {
+            seam.logger.warn(`undeploy: ${addonId} shutdown() threw`, {
+                tags: { addonId },
+                meta: { error: err instanceof Error ? err.message : String(err) },
+            });
+        }
+    }
+    try {
+        await seam.destroyService(addonId);
+    }
+    catch {
+        // Group-runner addons have no per-addon service on the agent broker.
+    }
+}
+async function stopHostingRunners(seam, addonIds) {
+    const removing = new Set(addonIds);
+    const runners = new Map();
+    const warnings = [];
+    for (const id of addonIds) {
+        try {
+            for (const row of await seam.listRunnersByAddon(id))
+                runners.set(row.name, row);
+        }
+        catch (err) {
+            warnings.push(`could not list runners for ${id}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const stopped = [];
+    const survivors = [];
+    for (const runner of runners.values()) {
+        const result = await seam.stopRunner(runner.name).catch((err) => ({
+            success: false,
+            reason: err instanceof Error ? err.message : String(err),
+        }));
+        if (!result.success) {
+            warnings.push(`runner "${runner.name}" did not stop: ${result.reason ?? 'unknown'}`);
+            continue;
+        }
+        stopped.push(runner.name);
+        for (const id of runner.addonIds) {
+            if (!removing.has(id))
+                survivors.push(id);
+        }
+    }
+    return { stopped, survivors, warnings };
+}
+function removeDirs(seam, request, target) {
+    const removed = [];
+    const rm = (dir) => {
+        if (dir === null || !fs.existsSync(dir))
+            return;
+        fs.rmSync(dir, { recursive: true, force: true });
+        removed.push(dir);
+    };
+    if (request.packageName !== undefined) {
+        rm(target.packageDir);
+        return removed;
+    }
+    // Addon mode — the reconcile's per-id removal. One package dir can host MANY
+    // addons; only remove it when no OTHER loaded addon still lives in it (this
+    // addon's own row is already gone from `loadedAddons`).
+    const addonId = request.addonId;
+    if (addonId !== undefined)
+        rm(packageDirFor(seam.addonsDir, addonId));
+    const pkg = target.packageName;
+    if (pkg !== undefined && pkg !== addonId) {
+        const shared = [...seam.loadedAddons.values()].some((e) => e.packageName === pkg);
+        if (!shared)
+            rm(target.packageDir);
+    }
+    return removed;
+}
+/** Run one `$agent.undeploy`. Never throws for a refusal — it answers `refused`. */
+async function undeployFromAgent(seam, request) {
+    const target = resolveTarget(seam, request);
+    const scope = request.packageName !== undefined ? 'package' : 'addon';
+    const base = {
+        scope,
+        addonId: request.addonId,
+        packageName: target.packageName,
+        addonIds: target.addonIds,
+    };
+    const refused = refusalReason(seam, target);
+    if (refused !== null) {
+        seam.logger.warn(`undeploy refused: ${refused}`, { meta: { request } });
+        return {
+            ...base,
+            success: false,
+            outcome: 'refused',
+            reason: refused,
+            runnersStopped: [],
+            runnersRespawned: [],
+            removedDirs: [],
+            warnings: [],
+        };
+    }
+    const present = target.addonIds.some((id) => seam.loadedAddons.has(id)) ||
+        (target.packageDir !== null && fs.existsSync(target.packageDir));
+    if (scope === 'package' && !present) {
+        return {
+            ...base,
+            success: true,
+            outcome: 'not-installed',
+            runnersStopped: [],
+            runnersRespawned: [],
+            removedDirs: [],
+            warnings: [],
+        };
+    }
+    for (const id of target.addonIds)
+        await shutdownInProcess(seam, id);
+    const runners = await stopHostingRunners(seam, target.addonIds);
+    for (const id of target.addonIds) {
+        for (const cap of target.capsByAddon.get(id) ?? [])
+            seam.unregisterProvider(cap, id);
+        seam.loadedAddons.delete(id);
+    }
+    // A survivor's row is dropped too, so the discovery pass below sees it as
+    // not-loaded and respawns its runner — without the removed addons, whose
+    // code is gone by then.
+    for (const id of runners.survivors) {
+        for (const cap of target.capsByAddon.get(id) ?? [])
+            seam.unregisterProvider(cap, id);
+        seam.loadedAddons.delete(id);
+    }
+    const removedDirs = removeDirs(seam, request, target);
+    const warnings = [...runners.warnings];
+    let runnersRespawned = [];
+    if (runners.survivors.length > 0) {
+        if (seam.respawnSurvivors) {
+            try {
+                await seam.respawnSurvivors();
+                runnersRespawned = runners.stopped;
+            }
+            catch (err) {
+                warnings.push(`survivors ${runners.survivors.join(', ')} were not respawned: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        else {
+            warnings.push(`survivors ${runners.survivors.join(', ')} were stopped and not respawned`);
+        }
+    }
+    seam.reconcileNodeRegistration?.();
+    seam.logger.info(`undeploy: ${target.packageName ?? request.addonId ?? '?'} removed ` +
+        `(addons=${target.addonIds.join(',') || '-'} runnersStopped=${runners.stopped.join(',') || '-'} ` +
+        `dirs=${removedDirs.length})`, { meta: { warnings } });
+    return {
+        ...base,
+        success: true,
+        outcome: 'uninstalled',
+        runnersStopped: runners.stopped,
+        runnersRespawned,
+        removedDirs,
+        warnings,
+    };
+}

package/dist/agent/main.js

@@ -470,6 +470,19 @@ async function startAgent(configPath) {
         // (manifest strip + runtime deps + native deps + atomic swap) instead of
         // the bare tar swap that shipped addons without their node_modules.
         installBundleTgz: (tgzPath) => installer.installFromTgz(tgzPath),
+        // `$agent.undeploy` refuses what this node bootstraps itself, and drops the
+        // group-runner cap proxies it removes (registered by
+        // `registerGroupRunnerProviders`, ownerless — so a plain unregister owns them).
+        bootstrapPackages: new Set([
+            '@camstack/system',
+            '@camstack/addon-agent-ui',
+            ...system_1.AddonInstaller.AGENT_PACKAGES,
+        ]),
+        unregisterProvider: (capName, addonId) => {
+            if (capabilityRegistry.hasProvider(capName, addonId)) {
+                capabilityRegistry.unregisterProvider(capName, addonId);
+            }
+        },
     });
     broker.createService(agentServiceSchema);
     // $process service — manages forked child processes (same as hub).

package/dist/api/core/cap-providers.js

@@ -77,6 +77,7 @@ const types_1 = require("@camstack/types");
 const server_1 = require("@trpc/server");
 const integration_id_backfill_1 = require("../../boot/integration-id-backfill");
 const addon_package_service_js_1 = require("../../core/addon/addon-package.service.js");
+const addon_uninstall_js_1 = require("../../core/addon/addon-uninstall.js");
 const lifecycle_runner_singleton_js_1 = require("../../core/lifecycle/lifecycle-runner.singleton.js");
 const agent_installed_packages_js_1 = require("../../core/updates/agent-installed-packages.js");
 const http_request_census_singleton_js_1 = require("../trpc/http-request-census.singleton.js");
@@ -1318,8 +1319,82 @@ function isHubNode(nodeId) {
  * filter it out to make the list look clean — the number reaching zero is the
  * point of the number.
  */
-function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
+/**
+ * How long the hub waits for an agent's `$agent.undeploy`. It stops runners
+ * (each up to a 5 s SIGTERM grace plus the group reap) and may respawn a shared
+ * runner's survivors, so it is far longer than a status read.
+ */
+const AGENT_UNDEPLOY_TIMEOUT_MS = 120_000;
+function parseAgentStatusAddons(reply) {
+    if (typeof reply !== 'object' || reply === null || !('addons' in reply))
+        return [];
+    const addons = reply.addons;
+    if (!Array.isArray(addons))
+        return [];
+    const rows = [];
+    for (const raw of addons) {
+        if (typeof raw !== 'object' || raw === null || !('id' in raw) || typeof raw.id !== 'string') {
+            continue;
+        }
+        const packageName = 'packageName' in raw && typeof raw.packageName === 'string' ? raw.packageName : undefined;
+        const version = 'version' in raw && typeof raw.version === 'string' ? raw.version : undefined;
+        rows.push({ id: raw.id, packageName, version });
+    }
+    return rows;
+}
+/**
+ * The real seam behind `addons.uninstallPackage` / `listInstallations`. The
+ * agent leg is the same hub-side `broker.call({ nodeID })` to the agent's
+ * `$agent` service that `updatePackage({ nodeId })` uses.
+ */
+function buildUninstallSeam(ar, ps, broker, agentRegistry) {
+    return {
+        isProtected: (name) => ps.isProtected(name),
+        listHubPackages: () => {
+            let installed;
+            try {
+                installed = ps.listInstalled();
+            }
+            catch {
+                return [];
+            }
+            const idsByPackage = new Map();
+            for (const row of ar.listAddons()) {
+                const ids = idsByPackage.get(row.manifest.packageName) ?? [];
+                ids.push(row.manifest.id);
+                idsByPackage.set(row.manifest.packageName, ids);
+            }
+            return installed.map((p) => ({
+                name: p.name,
+                version: p.version,
+                addonIds: idsByPackage.get(p.name) ?? [],
+            }));
+        },
+        uninstallOnHub: async (name) => {
+            await ps.uninstallAndReload(name);
+        },
+        listAgents: async () => {
+            if (!agentRegistry)
+                return [];
+            const directory = await agentRegistry.listNodeDirectory();
+            return directory.nodes
+                .filter((n) => !n.isHub && !n.id.includes('/'))
+                .map((n) => ({ id: n.id, name: n.name, isOnline: n.isOnline }));
+        },
+        agentAddons: async (nodeId) => parseAgentStatusAddons(await broker.call('$agent.status', {}, { nodeID: nodeId, timeout: agent_installed_packages_js_1.AGENT_STATUS_TIMEOUT_MS })),
+        agentUndeploy: (nodeId, request) => broker.call('$agent.undeploy', request, {
+            nodeID: nodeId,
+            timeout: AGENT_UNDEPLOY_TIMEOUT_MS,
+        }),
+        recordedPackages: async (nodeId) => agentRegistry ? agentRegistry.getRecordedPackages(nodeId) : [],
+        notePackageUndeployed: async (nodeId, packageName, addonIds) => {
+            await agentRegistry?.notePackageUndeployed(nodeId, packageName, addonIds);
+        },
+    };
+}
+function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx, agentRegistry) {
     const broker = moleculer.broker;
+    const uninstallSeam = buildUninstallSeam(ar, ps, broker, agentRegistry);
     const frameworkAllowSet = new Set([addon_package_service_js_1.SYSTEM_PACKAGE]);
     // Process-wide runner built once at boot (manual-boot wires its deps from the
     // addon-package service + event bus). `createdBy` travels per `startJob` call.
@@ -1349,7 +1424,18 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
         installFromWorkspace: async (input) => ps.installFromWorkspaceAndLoad(input.packageName),
         isWorkspaceAvailable: async () => ps.isWorkspaceAvailable(),
         listWorkspacePackages: async () => ps.listWorkspacePackages(),
-        uninstallPackage: async (input) => ps.uninstallAndReload(input.packageName),
+        uninstallPackage: async (input) => {
+            try {
+                return await (0, addon_uninstall_js_1.uninstallPackage)(uninstallSeam, input);
+            }
+            catch (err) {
+                if (err instanceof addon_uninstall_js_1.PackageProtectedError) {
+                    throw new server_1.TRPCError({ code: 'FORBIDDEN', message: err.message });
+                }
+                throw err;
+            }
+        },
+        listInstallations: async (input) => (0, addon_uninstall_js_1.listInstallations)(uninstallSeam, input.packageName),
         reloadPackages: async () => ps.reloadPackages(),
         searchAvailable: async (input) => {
             const results = await ps.searchNpm(input?.query);
@@ -1486,7 +1572,9 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
             if (offNode.length > 0) {
                 throw new server_1.TRPCError({
                     code: 'BAD_REQUEST',
-                    message: `The lifecycle job engine is hub-local; it cannot target ${offNode.join(', ')}. Update an agent's packages via updatePackage({ nodeId }).`,
+                    message: input.kind === 'uninstall'
+                        ? `The lifecycle job engine is hub-local; it cannot target ${offNode.join(', ')}. Uninstall from an agent via uninstallPackage({ packageName, nodeId }), or from every node via uninstallPackage({ packageName, everywhere: true }).`
+                        : `The lifecycle job engine is hub-local; it cannot target ${offNode.join(', ')}. Update an agent's packages via updatePackage({ nodeId }).`,
                 });
             }
             return lifecycleRunner.startJob({