@camstack/server 1.2.481 → 1.2.483

package/dist/agent/agent-infra-capabilities.js

@@ -40,8 +40,8 @@ exports.resolveAgentInfraCapabilities = resolveAgentInfraCapabilities;
  *
  * **To roll back:** set `CAMSTACK_AGENT_LOCAL_DATA_STORE=1` in the agent
  * container's environment and restart it. That restores `INFRA_CAPABILITIES`
- * EXACTLY — same entries, same order, same `required` flags — so the agent
- * boots its own `sqlite-settings` again and the data door resolves that engine
+ * EXACTLY (same entries, same order, same `required` flags) minus the hub-only
+ * `keychain`, which no flag brings to an agent — so the agent boots its own `sqlite-settings` again and the data door resolves that engine
  * instead of the hub (a local engine always wins over the remote; see
  * `data-store-dispatch.ts`). No redeploy, no revert, and the other two commits
  * in this series stay in place: commit 1 is inert whenever a local engine
@@ -56,6 +56,21 @@ const system_1 = require("@camstack/system");
 exports.AGENT_LOCAL_DATA_STORE_ENV = 'CAMSTACK_AGENT_LOCAL_DATA_STORE';
 /** The capability an agent no longer boots. */
 const DATA_STORE_PROVIDER = 'data-store-provider';
+/**
+ * The keychain (D787) is the HUB's, always — whatever the rollback flag says.
+ *
+ * Booting it on an agent was the bug that locked the hub on 2026-10-08: the
+ * agent's settings door forwards to the hub, so an agent's keychain wrote the
+ * `keychain:keys` row INTO THE HUB'S DATABASE while writing the master key to
+ * the AGENT's `<dataDir>/.keychain/master.key`. The Mac agent booted first,
+ * generated the key on the Mac, and the hub's next boot found a wrapped data
+ * key and no key file under `/data` — `key-missing`, locked. An agent-local
+ * keychain also shadowed `$hub-cap-fwd` for the agent's own forked addons, so
+ * their secrets resolved against a keychain that could only ever be locked.
+ *
+ * An agent reaches the keychain the way it reaches every hub cap: forwarded.
+ */
+const HUB_ONLY_INFRA = new Set(['keychain']);
 /**
  * Truthy spellings an operator actually types into a docker `-e`. Anything
  * else — including the empty string a declared-but-unset variable produces —
@@ -77,7 +92,6 @@ function isEnabled(raw) {
  * `INFRA_CAPABILITIES` itself is never touched: the hub reads the same array.
  */
 function resolveAgentInfraCapabilities(env) {
-    if (isEnabled(env[exports.AGENT_LOCAL_DATA_STORE_ENV]))
-        return system_1.INFRA_CAPABILITIES;
-    return system_1.INFRA_CAPABILITIES.filter((cap) => cap.name !== DATA_STORE_PROVIDER);
+    const keepLocalStore = isEnabled(env[exports.AGENT_LOCAL_DATA_STORE_ENV]);
+    return system_1.INFRA_CAPABILITIES.filter((cap) => !HUB_ONLY_INFRA.has(cap.name) && (keepLocalStore || cap.name !== DATA_STORE_PROVIDER));
 }

package/dist/agent/main.js

@@ -544,6 +544,10 @@ async function startAgent(configPath) {
                 // its behalf. Dropping it here would let the hub resolve the cap
                 // NAME instead — i.e. the wrapper the caller is trying to skip.
                 ...(input.native === true ? { native: true } : {}),
+                // WHO is calling: this agent's registry stamped it off the child
+                // connection the call arrived on. The hub checks it against this
+                // node and hands it to owner-checked caps (the keychain, D787).
+                ...(input.callerAddonId !== undefined ? { callerAddonId: input.callerAddonId } : {}),
             }, { timeout: 60_000 }),
             logger: { warn: (msg) => consoleLogger.warn(`[uds-fallback] ${msg}`) },
         });
@@ -577,9 +581,9 @@ async function startAgent(configPath) {
             // hub-main; recording in the agent would produce a map nobody ever reads,
             // which is exactly the shape that made this graph return `[]` for
             // months. An agent's addon traffic is a KNOWN blind spot of the graph —
-            // see `LocalChildRegistryOptions.capUsageObserver`. Closing it needs the
-            // caller identity to survive `$hub-cap-fwd`'s envelope, which today it
-            // does not.
+            // see `LocalChildRegistryOptions.capUsageObserver`. The caller identity
+            // now survives `$hub-cap-fwd`'s envelope (D787, for the keychain), so
+            // the hub could record these edges; nothing does yet.
         });
         await agentUdsRegistry.start();
         // E1: apply child manifest + cleanup from the UDS lifecycle (agent-local children).
@@ -613,7 +617,14 @@ async function startAgent(configPath) {
         // best-effort semantic as `HubForwarderDestination.forward`. Phase F will
         // retire the broker path once every log source emits over UDS end-to-end.
         agentUdsRegistry.onChildLog((childId, entry) => {
-            const workerEntry = (0, system_1.udsChildLogToWorkerEntry)(childId, entry);
+            // Key names and URL credentials redacted before the line leaves this
+            // node (D787 §8). The child already scrubbed the values it resolved.
+            const raw = (0, system_1.udsChildLogToWorkerEntry)(childId, entry);
+            const workerEntry = {
+                ...raw,
+                message: (0, system_1.redactLogText)(raw.message),
+                ...(raw.meta !== undefined ? { meta: (0, system_1.redactLogMeta)(raw.meta) } : {}),
+            };
             broker.call('log-receiver.ingest', workerEntry).catch(() => {
                 // Hub unreachable or not yet discovered — silently drop.
                 // HubForwarderDestination handles the agent's own buffered logs;

package/dist/api/core/cap-providers.js

@@ -70,6 +70,7 @@ exports.buildNodesProvider = buildNodesProvider;
 exports.buildIntegrationsProvider = buildIntegrationsProvider;
 exports.dispatchCustomAction = dispatchCustomAction;
 exports.buildAddonsProvider = buildAddonsProvider;
+const integration_secrets_1 = require("./integration-secrets");
 const node_crypto_1 = require("node:crypto");
 const os = __importStar(require("node:os"));
 const system_1 = require("@camstack/system");
@@ -685,6 +686,14 @@ function buildNodesProvider(agentRegistry, moleculer, addonRegistry, getNodeRoot
         },
     };
 }
+/**
+ * The keychain handle a hub door uses for an integration's addon (D787), or
+ * `null` when this registry predates the keychain (a test double, an older
+ * kernel) — the door then stores the settings as it always did.
+ */
+function ownerSecrets(ar, owner) {
+    return typeof ar.secretsForOwner === 'function' ? ar.secretsForOwner(owner) : null;
+}
 function requireIntegrationRegistry(ar) {
     const reg = ar.getIntegrationRegistry();
     if (!reg)
@@ -845,7 +854,10 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
         },
         getByAddonId: async (input) => requireIntegrationRegistry(ar).getIntegrationByAddonId(input.addonId),
         create: async (input) => {
-            const { skipRestart, ...payload } = input;
+            const { skipRestart, secretKeys, settings, ...rest } = input;
+            // Settings are written AFTER the row exists: a secret's ref is scoped
+            // to the integration id (D787).
+            const payload = rest;
             const reg = requireIntegrationRegistry(ar);
             logger.info('request', {
                 tags: { addonId: input.addonId },
@@ -872,7 +884,7 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
             // those would make every integration lacking the hook uncreatable, and
             // would fail a good create on a flaky network. They pass, and they SAY SO
             // in the log: silence here would read as "validated".
-            const verdict = await runConnectionTest(ar, input.addonId, input.settings ?? {}, logger);
+            const verdict = await runConnectionTest(ar, input.addonId, settings ?? {}, logger);
             if (verdict.status === 'rejected') {
                 logger.warn('rejected — connection test refused the settings', {
                     tags: { addonId: input.addonId },
@@ -896,11 +908,25 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
                 });
             }
             const integration = await reg.createIntegration(payload);
+            if (settings !== undefined && Object.keys(settings).length > 0) {
+                await (0, integration_secrets_1.writeIntegrationSettings)({
+                    registry: reg,
+                    secrets: ownerSecrets(ar, integration.addonId),
+                    onOrphaned: (refs) => logger.warn('dropped keychain refs could not be deleted', {
+                        meta: { refs: [...refs] },
+                    }),
+                }, {
+                    integrationId: integration.id,
+                    settings,
+                    secretKeys: secretKeys ?? [],
+                    operatorWrite: true,
+                });
+            }
             logger.info('persisted', {
                 tags: { integrationId: integration.id, addonId: integration.addonId },
                 meta: { phase: 'create' },
             });
-            const hasSettings = input.settings != null && Object.keys(input.settings).length > 0;
+            const hasSettings = settings != null && Object.keys(settings).length > 0;
             if (!skipRestart && hasSettings) {
                 logger.info('settings present — restarting addon', {
                     tags: { addonId: input.addonId },
@@ -1086,7 +1112,13 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
             const integration = await reg.getIntegration(input.id);
             if (!integration)
                 throw new Error(`Integration "${input.id}" not found`);
-            return reg.getIntegrationSettings(input.id);
+            // The integration's own addon (the caller the transport stamped) reads
+            // its secrets resolved; anyone else — the admin form — reads "set"
+            // views, never a value (D787, D789).
+            const caller = Reflect.get(input, 'callerAddonId');
+            const forOwner = typeof caller === 'string' &&
+                (caller === integration.addonId || ar.runnerIdFor(integration.addonId) === caller);
+            return (0, integration_secrets_1.readIntegrationSettings)({ registry: reg, secrets: forOwner ? ownerSecrets(ar, integration.addonId) : null }, { integrationId: input.id, forOwner });
         },
         setSettings: async (input) => {
             const reg = requireIntegrationRegistry(ar);
@@ -1103,7 +1135,19 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
                 tags: { integrationId: input.id, addonId: integration.addonId },
                 meta: { phase: 'setSettings', keys: settingsKeys },
             });
-            await reg.setIntegrationSettings(input.id, input.settings);
+            await (0, integration_secrets_1.writeIntegrationSettings)({
+                registry: reg,
+                secrets: ownerSecrets(ar, integration.addonId),
+                onOrphaned: (refs) => logger.warn('dropped keychain refs could not be deleted', {
+                    meta: { refs: [...refs] },
+                }),
+            }, {
+                integrationId: input.id,
+                settings: input.settings,
+                secretKeys: input.secretKeys ?? [],
+                // The integration's own addon writing back is not the operator.
+                operatorWrite: typeof Reflect.get(input, 'callerAddonId') !== 'string',
+            });
             logger.info('persisted — restarting addon', {
                 tags: { addonId: integration.addonId },
                 meta: { phase: 'setSettings' },

package/dist/api/core/integration-secrets.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeIntegrationSettings = writeIntegrationSettings;
+exports.readIntegrationSettings = readIntegrationSettings;
+/**
+ * The integration-settings door of the keychain (D787). An integration's
+ * settings (a Wyze password, a PetKit account password) live in the
+ * `integration_settings` table, written by `integrations.create` /
+ * `setSettings` and read back by the integration's own addon through
+ * `integrations.getSettings` — and by the admin form through the same method.
+ *
+ * - WRITE: the keys the form's schema declares secret (`secretKeys`, by type)
+ *   and every key that already holds a marker go through the keychain save
+ *   path, OWNED by the integration's addon (`integration/<id>` scope). A value
+ *   equal to an inline pre-keychain one stays inline; `''` keeps.
+ * - READ, by the owning addon (the caller the transport stamped): markers
+ *   resolve to values. READ, by anyone else (the admin form): markers become
+ *   their "set" views — the value never leaves the hub.
+ */
+const types_1 = require("@camstack/types");
+async function writeIntegrationSettings(deps, input) {
+    if (deps.secrets === null) {
+        return deps.registry.setIntegrationSettings(input.integrationId, input.settings);
+    }
+    const stored = (await deps.registry.getIntegrationSettings(input.integrationId)) ?? {};
+    const markerKeys = Object.entries(stored)
+        .filter(([, v]) => (0, types_1.isSecretMarker)(v))
+        .map(([k]) => k);
+    const tree = (0, types_1.secretTreeFromPaths)([...new Set([...input.secretKeys, ...markerKeys])]);
+    if (tree.size === 0) {
+        return deps.registry.setIntegrationSettings(input.integrationId, input.settings);
+    }
+    const result = await (0, types_1.transformSecretWrite)({
+        tree,
+        secrets: deps.secrets,
+        patch: input.settings,
+        stored,
+        scope: { kind: 'integration', integrationId: input.integrationId },
+        operatorWrite: input.operatorWrite === true,
+    });
+    if (Object.keys(result.patch).length > 0) {
+        await deps.registry.setIntegrationSettings(input.integrationId, result.patch);
+    }
+    const { orphaned } = await result.afterWrite();
+    if (orphaned.length > 0)
+        deps.onOrphaned?.(orphaned);
+}
+async function readIntegrationSettings(deps, input) {
+    const stored = await deps.registry.getIntegrationSettings(input.integrationId);
+    if (input.forOwner) {
+        if (deps.secrets === null)
+            return stored;
+        return (await (0, types_1.resolveSecretMarkers)(stored, deps.secrets)).value;
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(stored)) {
+        out[key] = (0, types_1.isSecretMarker)(value) ? (0, types_1.toSecretFieldView)(value) : value;
+    }
+    return out;
+}

package/dist/api/trpc/generated-cap-mounts.js

@@ -2,7 +2,7 @@
 // AUTO-GENERATED by scripts/generate-cap-mounts.ts — DO NOT EDIT
 // Re-run: npx tsx scripts/generate-cap-mounts.ts
 //
-// Mounted: 162    Skipped (legacy): 3
+// Mounted: 164    Skipped (legacy): 3
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGACY_SHAPE_SKIP = void 0;
 exports.mountAllCaps = mountAllCaps;
@@ -269,6 +269,8 @@ function mountAllCaps(services) {
         imageSettings: (0, generated_cap_routers_js_1.createCapRouter_imageSettings)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'image-settings'), remoteCapProxy),
         integrations: (0, generated_cap_routers_js_1.createCapRouter_integrations)((_ctx) => reg?.getSingleton('integrations') ?? null, remoteCapProxy),
         intercom: (0, generated_cap_routers_js_1.createCapRouter_intercom)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'intercom'), remoteCapProxy),
+        keychain: (0, generated_cap_routers_js_1.createCapRouter_keychain)((_ctx) => reg?.getSingleton('keychain') ?? null, remoteCapProxy),
+        keychainAdmin: (0, generated_cap_routers_js_1.createCapRouter_keychainAdmin)((_ctx) => reg?.getSingleton('keychain-admin') ?? null, remoteCapProxy),
         lawnMowerControl: (0, generated_cap_routers_js_1.createCapRouter_lawnMowerControl)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'lawn-mower-control'), remoteCapProxy),
         llm: (0, generated_cap_routers_js_1.createCapRouter_llm)((_ctx, addonId) => {
             if (!reg)