@camstack/server 1.2.540 → 1.2.542

package/dist/agent/agent-addon-runtime.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * ONE list for the agent UI: every addon on this node with the runner that
+ * hosts it (D841). It used to be two lists — `$agent.status` addons and
+ * `$process.list` runners — that the operator had to join by eye.
+ *
+ * The addon → runner link is the runner's own `addonIds`, which the process
+ * service fills from the runner it actually spawned (`resolveRunnerId` at spawn
+ * time). Nothing here (and nothing in the UI) re-derives a grouping: an addon
+ * shares a runner exactly when the process service listed it in that runner's
+ * `addonIds`. A runner hosting no known addon is still a row, so a stray
+ * process stays visible.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.joinAddonRuntime = joinAddonRuntime;
+exports.addonsFromStatus = addonsFromStatus;
+exports.processesFromList = processesFromList;
+function toRunner(p) {
+    return {
+        name: p.name,
+        pid: p.pid,
+        state: p.state,
+        groupId: p.groupId,
+        cpuPercent: p.cpuPercent,
+        memoryRss: p.memoryRss,
+        uptimeSeconds: p.uptimeSeconds,
+        addonIds: p.addonIds,
+    };
+}
+function joinAddonRuntime(addons, processes) {
+    const runnerByAddon = new Map();
+    for (const p of processes) {
+        for (const id of p.addonIds) {
+            if (!runnerByAddon.has(id))
+                runnerByAddon.set(id, p);
+        }
+    }
+    const known = new Set(addons.map((a) => a.id));
+    const addonRows = addons.map((a) => {
+        const runner = runnerByAddon.get(a.id);
+        return {
+            key: a.id,
+            kind: 'addon',
+            addonId: a.id,
+            packageName: a.packageName ?? null,
+            version: a.version ?? null,
+            status: a.status,
+            runner: runner === undefined ? null : toRunner(runner),
+        };
+    });
+    const strayRunners = processes
+        .filter((p) => !p.addonIds.some((id) => known.has(id)))
+        .map((p) => ({
+        key: `runner:${p.name}`,
+        kind: 'runner',
+        addonId: null,
+        packageName: null,
+        version: null,
+        status: p.state,
+        runner: toRunner(p),
+    }));
+    return [...addonRows, ...strayRunners];
+}
+function str(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+/** The addon rows of an `$agent.status` answer; unreadable rows are skipped. */
+function addonsFromStatus(status) {
+    const raw = status !== null && typeof status === 'object' ? Reflect.get(status, 'addons') : null;
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const item of raw) {
+        if (item === null || typeof item !== 'object')
+            continue;
+        const id = str(Reflect.get(item, 'id'));
+        if (id === undefined)
+            continue;
+        const version = str(Reflect.get(item, 'version'));
+        const packageName = str(Reflect.get(item, 'packageName'));
+        out.push({
+            id,
+            status: str(Reflect.get(item, 'status')) ?? 'unknown',
+            ...(version !== undefined ? { version } : {}),
+            ...(packageName !== undefined ? { packageName } : {}),
+        });
+    }
+    return out;
+}
+/** The runners of a `$process.list` answer; unreadable rows are skipped. */
+function processesFromList(list) {
+    if (!Array.isArray(list))
+        return [];
+    const out = [];
+    for (const item of list) {
+        if (item === null || typeof item !== 'object')
+            continue;
+        const name = str(Reflect.get(item, 'name'));
+        if (name === undefined)
+            continue;
+        const ids = Reflect.get(item, 'addonIds');
+        out.push({
+            name,
+            pid: num(Reflect.get(item, 'pid')),
+            state: str(Reflect.get(item, 'state')) ?? 'unknown',
+            groupId: str(Reflect.get(item, 'groupId')) ?? name,
+            addonIds: Array.isArray(ids) ? ids.filter((id) => typeof id === 'string') : [],
+            cpuPercent: num(Reflect.get(item, 'cpuPercent')),
+            memoryRss: num(Reflect.get(item, 'memoryRss')),
+            uptimeSeconds: num(Reflect.get(item, 'uptimeSeconds')),
+        });
+    }
+    return out;
+}

package/dist/agent/agent-addon-updates.js

@@ -42,27 +42,17 @@ exports.buildAgentAddonUpdateReport = buildAgentAddonUpdateReport;
  * Agent-local addon ALIGNMENT report — "is this node behind?", answered
  * WITHOUT the hub.
  *
- * ── Why this is read-only, and the update button is not here ──────────────
- * Updating an addon on an agent is hub-driven and CANNOT be initiated here:
- * the hub packs the version IT resolved and pushes the tarball over
- * `$agent.deploy` (`api/core/cap-providers.ts` `updatePackage`, agent branch).
- * There is no agent→hub trigger for that — the `addons` capability is
- * `mount: 'server-provided'`, i.e. it exists only inside the hub's tRPC
- * router and is never published as a Moleculer cap service, so an agent's
- * broker cannot reach it; and CLAUDE.md forbids minting a Moleculer action
- * for business logic to bridge the gap.
+ * ── Why this report installs nothing ─────────────────────────────────────
+ * An addon's version on an agent is decided by the HUB: every reconnect's
+ * back-fill restores the hub's installed version (`agent-addon-backfill.ts`).
+ * The Update action is therefore a request to the hub to bring a package to
+ * THAT version (`agent-hub-addon-update.ts`, D840) — never a local install, and
+ * never npm-latest: the hub routinely ships builds via `camstack deploy` that
+ * were never published, so a node that self-pulled npm-latest would run bytes
+ * the hub never sent and be undone at the next reconcile.
  *
- * Pulling the published tarball locally instead would be a SECOND install
- * channel resolving a DIFFERENT artifact: the hub routinely ships builds via
- * `camstack deploy` that were never published, so a node that self-pulled
- * npm-latest would run bytes the hub never sent and still report itself
- * updated. That is precisely the divergence the hub-push path exists to
- * prevent.
- *
- * So this module answers the question the isolated operator actually has —
- * *which of my addons are behind the published release?* — and the UI names
- * where the action lives. A read that cannot mislead beats a button that
- * cannot work.
+ * This module answers the read half: *which of my addons are behind the
+ * published release?* The hub-version half is joined in by the routes.
  */
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));

package/dist/agent/agent-config.js

@@ -38,6 +38,7 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const crypto = __importStar(require("node:crypto"));
 const os = __importStar(require("node:os"));
+const node_1 = require("@camstack/types/node");
 /**
  * Generate a stable nodeId and persist it to the config file.
  *
@@ -72,9 +73,8 @@ function ensurePersistedNodeId(configPath, dataDir) {
     const id = envSeed && envSeed.length > 0 ? envSeed : `agent-${crypto.randomBytes(4).toString('hex')}`;
     raw.nodeId = id;
     try {
-        fs.mkdirSync(path.dirname(resolvedPath), { recursive: true });
-        // 0600: the same file holds the cluster secret.
-        fs.writeFileSync(resolvedPath, JSON.stringify(raw, null, 2), { encoding: 'utf-8', mode: 0o600 });
+        // Owner-only: the same file holds the cluster secret.
+        (0, node_1.writeOwnerOnlyFileSync)(resolvedPath, JSON.stringify(raw, null, 2));
     }
     catch {
         /* best-effort */

package/dist/agent/agent-http-auth.js

@@ -82,10 +82,13 @@ function isPairingRequest(method, urlPath) {
     if (method === 'GET') {
         return (pathOnly === '/api/agent/status' ||
             pathOnly === '/api/agent/config' ||
-            pathOnly === '/api/agent/discovered-nodes');
+            pathOnly === '/api/agent/discovered-nodes' ||
+            pathOnly === '/api/agent/hubs-found');
     }
     if (method === 'POST') {
-        return pathOnly === '/api/agent/config' || pathOnly === '/api/agent/restart';
+        return (pathOnly === '/api/agent/config' ||
+            pathOnly === '/api/agent/restart' ||
+            pathOnly === '/api/agent/hubs-found/refresh');
     }
     return false;
 }

package/dist/agent/agent-http.js

@@ -47,6 +47,7 @@ exports.pickUiDist = pickUiDist;
 exports.resolveUiDistDir = resolveUiDistDir;
 exports.getRegistryNodes = getRegistryNodes;
 exports.resolveHubEndpoint = resolveHubEndpoint;
+exports.isOpaqueHostname = isOpaqueHostname;
 exports.nodeDisplayName = nodeDisplayName;
 exports.mapDiscoveredNodes = mapDiscoveredNodes;
 exports.createAgentHttpServer = createAgentHttpServer;
@@ -57,10 +58,13 @@ const path = __importStar(require("node:path"));
 const fastify_1 = __importDefault(require("fastify"));
 const system_1 = require("@camstack/system");
 const agent_http_auth_js_1 = require("./agent-http-auth.js");
+const node_1 = require("@camstack/types/node");
 const agent_mesh_enroll_js_1 = require("./agent-mesh-enroll.js");
 const agent_update_routes_js_1 = require("./agent-update-routes.js");
 const derive_hub_url_js_1 = require("./derive-hub-url.js");
 Object.defineProperty(exports, "pickIpv4", { enumerable: true, get: function () { return derive_hub_url_js_1.pickIpv4; } });
+const agent_addon_runtime_js_1 = require("./agent-addon-runtime.js");
+const hubs_found_js_1 = require("./hubs-found.js");
 /** Dotted-numeric version compare; `null` sorts lowest. */
 function compareVersions(a, b) {
     if (a === null && b === null)
@@ -155,11 +159,9 @@ function readConfigFile(configPath) {
         return {};
     }
 }
-/** agent.json holds the cluster secret (D797): always 0600. */
+/** agent.json holds the cluster secret (D797): owner-only on every OS. */
 function writeConfigFile(configPath, data) {
-    fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    fs.writeFileSync(configPath, JSON.stringify(data, null, 2), { encoding: 'utf-8', mode: 0o600 });
-    fs.chmodSync(configPath, 0o600);
+    (0, node_1.writeOwnerOnlyFileSync)(configPath, JSON.stringify(data, null, 2));
 }
 /** Live Moleculer registry snapshot — reused by agent-bootstrap's Option A. */
 function getRegistryNodes(broker) {
@@ -182,10 +184,17 @@ function resolveHubEndpoint(nodes) {
         return null;
     return (0, derive_hub_url_js_1.pickIpv4)(hub.ipList) ?? hub.hostname ?? null;
 }
-/** Prefer a name an operator can recognise over the bare Moleculer node id. */
+/** A container id (12 hex) or full id (64 hex): a name nobody chose. */
+function isOpaqueHostname(hostname) {
+    return /^[0-9a-f]{12}$|^[0-9a-f]{64}$/.test(hostname);
+}
+/**
+ * Prefer a name an operator can recognise over the bare Moleculer node id —
+ * and over a container's id, which is what the hostname of a hub in Docker is.
+ */
 function nodeDisplayName(node) {
     const hostname = typeof node.hostname === 'string' ? node.hostname.trim() : '';
-    if (hostname.length > 0 && hostname !== node.id)
+    if (hostname.length > 0 && hostname !== node.id && !isOpaqueHostname(hostname))
         return hostname;
     const ip = (0, derive_hub_url_js_1.pickIpv4)(node.ipList);
     if (ip !== null)
@@ -214,12 +223,12 @@ function mapDiscoveredNodes(nodes, selfId) {
  * external getter is wired. Does NOT detect `secret-mismatch` — that
  * requires the bootstrap to inject `getHubConnectionState`.
  */
-function deriveHubConnectionState(nodes, discoveryMode) {
+function deriveHubConnectionState(nodes, hubAddressConfigured) {
     const hubInRegistry = nodes.some((n) => n.id === 'hub');
     if (hubInRegistry)
         return 'connected';
-    if (discoveryMode)
-        return 'searching';
+    if (!hubAddressConfigured)
+        return 'unconfigured';
     return 'disconnected';
 }
 /**
@@ -325,10 +334,9 @@ async function createAgentHttpServer(getBroker, config) {
         const eff = getEffectiveConfig(config.configPath, config.nodeId);
         const nodes = getRegistryNodes(broker);
         const hubConnected = nodes.some((n) => n.id === 'hub');
-        const discoveryMode = !eff.hubAddress;
         const hubConnectionState = config.getHubConnectionState
             ? config.getHubConnectionState()
-            : deriveHubConnectionState(nodes, discoveryMode);
+            : deriveHubConnectionState(nodes, Boolean(eff.hubAddress));
         const meshTransport = config.getMeshTransport
             ? config.getMeshTransport()
             : eff.hasMeshTls
@@ -357,7 +365,6 @@ async function createAgentHttpServer(getBroker, config) {
                 appVersion,
                 hubConnected,
                 hubConnectionState,
-                discoveryMode,
                 hasSecret: eff.hasSecret,
                 meshTransport,
                 discoveredNodes,
@@ -373,7 +380,6 @@ async function createAgentHttpServer(getBroker, config) {
                 appVersion,
                 hubConnected,
                 hubConnectionState,
-                discoveryMode,
                 hasSecret: eff.hasSecret,
                 meshTransport,
                 discoveredNodes,
@@ -431,6 +437,15 @@ async function createAgentHttpServer(getBroker, config) {
             return [];
         }
     });
+    // -- Addons joined with their runners (D841) ---------------------------
+    app.get('/api/agent/addon-runtime', async () => {
+        const broker = getBroker();
+        const [status, list] = await Promise.all([
+            broker.call('$agent.status').catch(() => null),
+            broker.call('$process.list').catch(() => []),
+        ]);
+        return (0, agent_addon_runtime_js_1.joinAddonRuntime)((0, agent_addon_runtime_js_1.addonsFromStatus)(status), (0, agent_addon_runtime_js_1.processesFromList)(list));
+    });
     // -- Addon restart --------------------------------------------------
     app.post('/api/agent/addon/restart', async (req, reply) => {
         const addonId = req.body?.addonId;
@@ -553,6 +568,17 @@ async function createAgentHttpServer(getBroker, config) {
     // Registered AFTER the onRequest hook above, so every path it mounts is
     // gated by the same loopback-or-bearer rule as the rest of `/api/`.
     (0, agent_update_routes_js_1.registerAgentUpdateRoutes)(app, config.updateControls ?? {});
+    // -- Hubs found on this network (D839) ------------------------------
+    // The cached list is free; the refresh browses mDNS for a few seconds. The
+    // UI asks on demand (opening the edit form, "Search again"), never on its
+    // status poll.
+    const hubsFinder = config.hubsFinder ??
+        (0, hubs_found_js_1.createHubsFinder)({
+            getConfiguredHubAddress: () => getEffectiveConfig(config.configPath, config.nodeId).hubAddress,
+            log: (message) => console.warn(`[Agent] ${message}`),
+        });
+    app.get('/api/agent/hubs-found', async () => hubsFinder.snapshot());
+    app.post('/api/agent/hubs-found/refresh', async () => hubsFinder.refresh());
     // -- Discovered nodes -----------------------------------------------
     app.get('/api/agent/discovered-nodes', async () => {
         const b = getBroker();

package/dist/agent/agent-hub-addon-update.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HUB_UPDATE_TIMEOUT_MS = exports.HUB_ADDON_UPDATE_ACTION = exports.HUB_ADDON_LIST_ACTION = void 0;
+exports.hubVersionsFromList = hubVersionsFromList;
+exports.isBehindHub = isBehindHub;
+exports.createAgentHubAddonControls = createAgentHubAddonControls;
+/**
+ * Updating an addon from the agent itself (D840) — by asking the HUB.
+ *
+ * ── Who decides an agent's addon version ───────────────────────────────────
+ * The hub. Every reconnect runs `reconcileAgentAddons` → `agent-addon-backfill`,
+ * whose INTENDED VERSION is "the hub's own installed version, and only that".
+ * A package installed on the agent at any other version is put back to the
+ * hub's — which is why an update run on an agent before the hub is undone, and
+ * why this module never installs anything locally.
+ *
+ * ── What the Update action does ───────────────────────────────────────────
+ * It asks the hub, over the mesh channel the agent already holds (the mTLS
+ * leaf; the bridge names the caller `node:<id>`), to deploy THE HUB'S version
+ * of one package to THIS node: `addons.updatePackage({ name, version:
+ * <hub version>, nodeId: <self> })`. The hub packs and pushes the tarball
+ * (`$agent.deploy` + `$agent.reload`) and records nothing new — the version
+ * it recorded is the version this node now runs, so the next reconcile finds
+ * nothing to repair. A newer PUBLISHED release is a hub-level decision (it
+ * moves every node), not something one agent can start.
+ *
+ * The hub accepts the call from an agent only under the scoped grant of D842
+ * (`remote-addon-update-grant.ts`): own node, the hub's recorded version, audited.
+ * Any refusal reaches the UI verbatim as the update's failure, never as silence.
+ */
+const index_js_1 = require("../server-root/index.js");
+/** Hub procedures this module calls, as `$core-caps` actions. */
+exports.HUB_ADDON_LIST_ACTION = '$core-caps.addons.list';
+exports.HUB_ADDON_UPDATE_ACTION = '$core-caps.addons.updatePackage';
+/** An agent's deploy + reload of a large package can take minutes. */
+exports.HUB_UPDATE_TIMEOUT_MS = 330_000;
+const HUB_LIST_TIMEOUT_MS = 15_000;
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/** `packageName → packageVersion` from an `addons.list` answer; unreadable rows are skipped. */
+function hubVersionsFromList(list) {
+    const out = new Map();
+    if (!Array.isArray(list))
+        return out;
+    for (const item of list) {
+        if (item === null || typeof item !== 'object')
+            continue;
+        const manifest = Reflect.get(item, 'manifest');
+        if (manifest === null || typeof manifest !== 'object')
+            continue;
+        const name = Reflect.get(manifest, 'packageName');
+        const version = Reflect.get(manifest, 'packageVersion');
+        if (typeof name === 'string' && typeof version === 'string' && !out.has(name)) {
+            out.set(name, version);
+        }
+    }
+    return out;
+}
+/** True when the hub's version is strictly newer than this node's. */
+function isBehindHub(installed, hub) {
+    return installed !== null && hub !== null && (0, index_js_1.compareSemver)(hub, installed) > 0;
+}
+/** The hub answered `{ success: false, error }`, or something unreadable. */
+function failureOf(result) {
+    if (result === null || typeof result !== 'object')
+        return null;
+    if (Reflect.get(result, 'success') !== false)
+        return null;
+    const error = Reflect.get(result, 'error');
+    return typeof error === 'string' && error.length > 0 ? error : 'the hub reported a failure';
+}
+function createAgentHubAddonControls(deps) {
+    const states = new Map();
+    const getHubVersions = async () => {
+        try {
+            const list = await deps.callHub(exports.HUB_ADDON_LIST_ACTION, undefined, HUB_LIST_TIMEOUT_MS);
+            return { ok: true, versions: hubVersionsFromList(list) };
+        }
+        catch (err) {
+            return { ok: false, error: errorMessage(err) };
+        }
+    };
+    const run = async (packageName, version) => {
+        try {
+            const result = await deps.callHub(exports.HUB_ADDON_UPDATE_ACTION, { name: packageName, version, nodeId: deps.nodeId }, exports.HUB_UPDATE_TIMEOUT_MS);
+            const failure = failureOf(result);
+            states.set(packageName, failure === null
+                ? { status: 'done', targetVersion: version, message: null }
+                : { status: 'failed', targetVersion: version, message: failure });
+            if (failure !== null) {
+                deps.onProblem?.(`hub refused to update ${packageName} to ${version}: ${failure}`);
+            }
+        }
+        catch (err) {
+            const message = errorMessage(err);
+            states.set(packageName, { status: 'failed', targetVersion: version, message });
+            deps.onProblem?.(`update of ${packageName} to ${version} through the hub failed: ${message}`);
+        }
+    };
+    return {
+        getHubVersions,
+        progress: () => states,
+        start: async (packageName, installedPackages) => {
+            if (!installedPackages.includes(packageName)) {
+                return { started: false, message: `${packageName} is not installed on this node.` };
+            }
+            if (states.get(packageName)?.status === 'running') {
+                return { started: false, message: `${packageName} is already being updated.` };
+            }
+            const hub = await getHubVersions();
+            if (!hub.ok) {
+                return {
+                    started: false,
+                    message: `The hub could not be asked which version this node should run: ${hub.error}`,
+                };
+            }
+            const hubVersion = hub.versions.get(packageName);
+            if (hubVersion === undefined) {
+                return {
+                    started: false,
+                    message: `The hub does not install ${packageName}, so it has no version to bring this node to.`,
+                };
+            }
+            states.set(packageName, { status: 'running', targetVersion: hubVersion, message: null });
+            // Not awaited: a deploy + reload outlives any request. The UI polls.
+            void run(packageName, hubVersion);
+            return { started: true, message: null };
+        },
+    };
+}

package/dist/agent/agent-mesh-enroll.js

@@ -64,8 +64,8 @@ const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
 const http = __importStar(require("node:http"));
 const https = __importStar(require("node:https"));
-const path = __importStar(require("node:path"));
 const system_1 = require("@camstack/system");
+const node_1 = require("@camstack/types/node");
 class MeshEnrollError extends Error {
     constructor(message) {
         super(message);
@@ -283,12 +283,9 @@ function readJsonFile(file) {
 function withoutJoinToken(record) {
     return Object.fromEntries(Object.entries(record).filter(([key]) => key !== 'joinToken'));
 }
+/** Owner-only on every OS (an owner+SYSTEM ACL on Windows, where 0600 is a no-op). */
 function writeJsonFile0600(file, data) {
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    const tmp = `${file}.tmp`;
-    fs.writeFileSync(tmp, JSON.stringify(data, null, 2), { encoding: 'utf-8', mode: 0o600 });
-    fs.renameSync(tmp, file);
-    fs.chmodSync(file, 0o600);
+    (0, node_1.writeOwnerOnlyFileSync)(file, JSON.stringify(data, null, 2));
 }
 /**
  * Write the enrollment into `agent.json` (0600): `meshTls` + the host-only

package/dist/agent/agent-update-routes.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ADDON_UPDATE_UNAVAILABLE_REASON = exports.SERVER_UPDATE_UNAVAILABLE_REASON = exports.APPLY_ALREADY_RUNNING_MESSAGE = void 0;
+exports.ADDON_HUB_UPDATE_UNAVAILABLE_REASON = exports.ADDON_UPDATE_UNAVAILABLE_REASON = exports.SERVER_UPDATE_UNAVAILABLE_REASON = exports.APPLY_ALREADY_RUNNING_MESSAGE = void 0;
 exports.createAgentServerUpdateControls = createAgentServerUpdateControls;
 exports.registerAgentUpdateRoutes = registerAgentUpdateRoutes;
+const agent_hub_addon_update_js_1 = require("./agent-hub-addon-update.js");
 /** The message a second concurrent apply gets. Exported so the test names it once. */
 exports.APPLY_ALREADY_RUNNING_MESSAGE = 'Refused: an update is already in flight on this node.';
 /**
@@ -66,6 +67,25 @@ function createAgentServerUpdateControls(engine, onError) {
 exports.SERVER_UPDATE_UNAVAILABLE_REASON = 'Framework updates are not available on this agent build.';
 /** Why the addon report renders empty when nothing was wired. */
 exports.ADDON_UPDATE_UNAVAILABLE_REASON = 'The addon roster is not available on this agent build.';
+/** Why the Update action is absent when the hub channel was not wired. */
+exports.ADDON_HUB_UPDATE_UNAVAILABLE_REASON = 'Updating an addon through the hub is not available on this agent build.';
+async function withHubVersions(report, hub) {
+    const versions = hub === undefined ? null : await hub.getHubVersions();
+    const progress = hub?.progress();
+    return {
+        ...report,
+        hubVersionsError: versions === null || versions.ok ? null : versions.error,
+        entries: report.entries.map((entry) => {
+            const hubVersion = versions?.ok === true ? (versions.versions.get(entry.packageName) ?? null) : null;
+            return {
+                ...entry,
+                hubVersion,
+                behindHub: (0, agent_hub_addon_update_js_1.isBehindHub)(entry.installedVersion, hubVersion),
+                update: progress?.get(entry.packageName) ?? null,
+            };
+        }),
+    };
+}
 /**
  * Mount the update routes on an already-built agent HTTP server. Called from
  * `createAgentHttpServer` AFTER the auth hook, so every path here inherits it.
@@ -96,6 +116,18 @@ function registerAgentUpdateRoutes(app, controls) {
         if (addons === undefined) {
             return { available: false, reason: exports.ADDON_UPDATE_UNAVAILABLE_REASON };
         }
-        return { available: true, ...(await addons.getReport()) };
+        const report = await addons.getReport();
+        return { available: true, ...(await withHubVersions(report, addons.hub)) };
+    });
+    app.post('/api/agent/addon-updates/update', async (req, reply) => {
+        if (addons?.hub === undefined) {
+            return reply.status(503).send({ error: exports.ADDON_HUB_UPDATE_UNAVAILABLE_REASON });
+        }
+        const packageName = req.body?.packageName;
+        if (typeof packageName !== 'string' || packageName.length === 0) {
+            return reply.status(400).send({ error: 'packageName required' });
+        }
+        const report = await addons.getReport();
+        return addons.hub.start(packageName, report.entries.map((e) => e.packageName));
     });
 }

package/dist/agent/derive-hub-url.js

@@ -28,8 +28,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.deriveHubUrlFromHubAddress = deriveHubUrlFromHubAddress;
 exports.deriveHubUrlForExport = deriveHubUrlForExport;
 exports.pickIpv4 = pickIpv4;
-exports.normalizeObservedHost = normalizeObservedHost;
-exports.deriveHubUrlFromRegistry = deriveHubUrlFromRegistry;
 const HUB_API_PORT = 4443;
 function deriveHubUrlFromHubAddress(hubAddress) {
     const trimmed = hubAddress.trim();
@@ -72,15 +70,10 @@ function extractHostFromAuthority(authority) {
     const host = value.split(':')[0] ?? '';
     return host.length > 0 ? host : undefined;
 }
-/** Node id the hub broker always registers under. */
-const HUB_NODE_ID = 'hub';
-const IPV4_MAPPED_PREFIX = '::ffff:';
-const IPV4_DOTTED_QUAD = /^\d{1,3}(?:\.\d{1,3}){3}$/;
 /**
  * First non-internal IPv4 in a Moleculer node's advertised IP list.
  * Canonical home of this helper — `resolveHubEndpoint` in `agent-http.ts`
- * (UI-facing `resolvedHubAddress`) re-exports and reuses it so the UI display
- * and the exported `CAMSTACK_HUB_URL` always agree.
+ * (UI-facing `resolvedHubAddress`) re-exports and reuses it.
  */
 function pickIpv4(ipList) {
     if (!ipList)
@@ -94,46 +87,3 @@ function pickIpv4(ipList) {
     }
     return null;
 }
-/**
- * Normalize a socket-observed address so it survives a WHATWG-`URL` hostname
- * write (`substituteRtspHost`): strip the `::ffff:` IPv4-mapped prefix,
- * bracket bare IPv6 (an unbracketed IPv6 assigned to `url.hostname` is
- * silently IGNORED — the URL would keep 127.0.0.1), pass plain IPv4 /
- * hostnames / already-bracketed IPv6 through untouched.
- */
-function normalizeObservedHost(raw) {
-    if (raw === undefined || raw === null)
-        return undefined;
-    const trimmed = raw.trim();
-    if (trimmed.length === 0)
-        return undefined;
-    if (trimmed.startsWith('['))
-        return trimmed; // already-bracketed IPv6
-    if (trimmed.toLowerCase().startsWith(IPV4_MAPPED_PREFIX)) {
-        const mapped = trimmed.slice(IPV4_MAPPED_PREFIX.length);
-        if (IPV4_DOTTED_QUAD.test(mapped))
-            return mapped;
-    }
-    // Any remaining colon means bare IPv6 — bracket it.
-    if (trimmed.includes(':'))
-        return `[${trimmed}]`;
-    return trimmed;
-}
-/**
- * Best hub host from the agent-side Moleculer registry view:
- *   `udpAddress` (wire truth) → first non-loopback IPv4 in `ipList`
- *   (hub self-advertised; container-internal in bridge-mode Docker) →
- *   `hostname` (hub's `os.hostname()`; often unresolvable — last resort).
- * Returns `undefined` when the hub node is not (yet) known. Emits the SAME
- * `https://host:4443` shape as `deriveHubUrlFromHubAddress` — see the port
- * note at the top of this file.
- */
-function deriveHubUrlFromRegistry(nodes) {
-    const hub = nodes.find((node) => node.id === HUB_NODE_ID);
-    if (hub === undefined)
-        return undefined;
-    const host = normalizeObservedHost(hub.udpAddress) ?? pickIpv4(hub.ipList) ?? hub.hostname;
-    if (host === undefined || host.length === 0)
-        return undefined;
-    return `https://${host}:${HUB_API_PORT}`;
-}

package/dist/agent/hubs-found.js

@@ -0,0 +1,100 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFIGURED_HUB_SOURCE = void 0;
+exports.createHubsFinder = createHubsFinder;
+const derive_hub_url_js_1 = require("./derive-hub-url.js");
+/** Label of the configured hub in {@link FoundHub.sources}. */
+exports.CONFIGURED_HUB_SOURCE = 'configured hub address';
+/** A scan newer than this answers a refresh without scanning again. */
+const MIN_RESCAN_INTERVAL_MS = 5_000;
+const BROWSE_TIMEOUT_MS = 3_000;
+function toFoundHub(candidate) {
+    return {
+        url: candidate.url,
+        host: candidate.host,
+        nodeId: candidate.nodeId,
+        version: candidate.version,
+        sources: candidate.sources,
+    };
+}
+async function defaultDiscover(deps) {
+    // Lazy: the socket library is only loaded when an operator asks.
+    const { discoverHubs } = await Promise.resolve().then(() => __importStar(require('@camstack/develop/hub-discovery')));
+    return discoverHubs(deps);
+}
+function createHubsFinder(deps) {
+    const discover = deps.discover ?? defaultDiscover;
+    const now = deps.now ?? Date.now;
+    let hubs = [];
+    let scannedAt = null;
+    let inFlight = null;
+    const snapshot = () => ({ hubs, scannedAt, scanning: inFlight !== null });
+    const scan = async () => {
+        const configured = deps.getConfiguredHubAddress();
+        const configuredUrl = configured === null ? undefined : (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(configured);
+        try {
+            const found = await discover({
+                mdnsTimeoutMs: BROWSE_TIMEOUT_MS,
+                known: configuredUrl === undefined
+                    ? []
+                    : [{ url: configuredUrl, source: exports.CONFIGURED_HUB_SOURCE }],
+                onProblem: (message) => deps.log?.(`hub browse problem: ${message}`),
+            });
+            hubs = found.map(toFoundHub);
+        }
+        catch (err) {
+            // A failed scan keeps the previous list: unknown is not "no hub".
+            deps.log?.(`hub scan failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        scannedAt = now();
+        return { hubs, scannedAt, scanning: false };
+    };
+    return {
+        snapshot,
+        refresh: () => {
+            if (inFlight !== null)
+                return inFlight;
+            if (scannedAt !== null && now() - scannedAt < MIN_RESCAN_INTERVAL_MS) {
+                return Promise.resolve(snapshot());
+            }
+            const running = scan().finally(() => {
+                inFlight = null;
+            });
+            inFlight = running;
+            return running;
+        },
+    };
+}

package/dist/agent/main.js

@@ -51,6 +51,7 @@ const agent_group_runner_js_1 = require("./agent-group-runner.js");
 const agent_http_js_1 = require("./agent-http.js");
 const agent_infra_capabilities_js_1 = require("./agent-infra-capabilities.js");
 const agent_service_js_1 = require("./agent-service.js");
+const agent_hub_addon_update_js_1 = require("./agent-hub-addon-update.js");
 const agent_update_routes_js_1 = require("./agent-update-routes.js");
 const agent_update_service_js_1 = require("./agent-update-service.js");
 const derive_hub_url_js_1 = require("./derive-hub-url.js");
@@ -122,7 +123,7 @@ async function startAgent(configPath) {
         console.log(`[Agent] Starting node "${config.nodeId}" (name="${config.name}") connecting to ${config.hubAddress}`);
     }
     else {
-        console.log(`[Agent] Starting node "${config.nodeId}" (name="${config.name}") in discovery mode`);
+        console.log(`[Agent] Starting node "${config.nodeId}" (name="${config.name}") with no hub address — set one from the agent UI`);
     }
     console.log(`[Agent] Config: ${config.configPath}`);
     console.log(`[Agent] Data dir: ${config.dataDir}`);
@@ -230,10 +231,9 @@ async function startAgent(configPath) {
         }
         // Reload config from file (UI may have written new hubAddress/secret)
         const fresh = (0, agent_config_js_1.loadAgentConfig)(undefined, config.dataDir);
-        console.log(`[Agent] New config: hub=${fresh.hubAddress ?? 'discovery'}, secret=${fresh.secret ? 'yes' : 'none'}, ` +
+        console.log(`[Agent] New config: hub=${fresh.hubAddress ?? 'none'}, secret=${fresh.secret ? 'yes' : 'none'}, ` +
             `mesh=${fresh.meshTls !== undefined ? 'tls' : 'clear'}`);
-        // Re-derive CAMSTACK_HUB_URL for the discovery-mode → dashboard-configured
-        // flow (config file freshly written a hubAddress). Explicit operator values
+        // Re-derive CAMSTACK_HUB_URL when the dashboard has just written a hubAddress. Explicit operator values
         // still win via the boot-captured `hubUrlWasExplicit` flag.
         // KNOWN LIMITATION (Stage-0): runners already spawned before this reconnect
         // keep the env they inherited; picking up a changed hub address in live
@@ -279,7 +279,7 @@ async function startAgent(configPath) {
         // regardless of registry state.
         if (hubConnectionStateOverride !== null)
             return hubConnectionStateOverride;
-        // Fall through to live registry-derived state (connected/searching/disconnected).
+        // Fall through to live registry-derived state (connected/unconfigured/disconnected).
         // getRegistryNodes-equivalent inline: broker.registry.getNodeList
         try {
             const registry = broker.registry;
@@ -291,8 +291,8 @@ async function startAgent(configPath) {
             /* fall through */
         }
         const configNow = readConfigFile(config.configPath);
-        const discoveryMode = typeof configNow.hubAddress !== 'string' || configNow.hubAddress.length === 0;
-        return discoveryMode ? 'searching' : 'disconnected';
+        const hubAddressConfigured = typeof configNow.hubAddress === 'string' && configNow.hubAddress.length > 0;
+        return hubAddressConfigured ? 'disconnected' : 'unconfigured';
     }
     function readConfigFile(p) {
         if (!fs.existsSync(p))
@@ -773,45 +773,6 @@ async function startAgent(configPath) {
     // discovery resolve (or time out cleanly via the read-blob fallback)
     // so agent boot completes instead of hanging on the first infra addon.
     await broker.start();
-    // ── Registry-derived CAMSTACK_HUB_URL (Option A — discovery-mode fallback) ──
-    // In UDP-discovery mode `config.hubAddress` is null, so the boot-time
-    // derivation above (Option B) produced nothing. The agent parent is the only
-    // agent-side process with a Moleculer registry (addon-runner children are
-    // broker-less), so derive the hub host from the LIVE hub connection —
-    // `udpAddress` is wire truth — and export it through the same env contract
-    // before the runner spawns in loadClusterCapableAddons below.
-    // Precedence: explicit operator env > config-derived (B) > registry (A).
-    // A fills only the empty case; on later hub (re)connects it refreshes only
-    // its OWN previous value (hub IP change), never an explicit or B-derived one.
-    // BOOT-ORDER LIMITATION (Stage-0): a runner spawned before the first hub
-    // connect in discovery mode inherits an empty env until it is respawned —
-    // same class as Option B's reconnect limitation documented above. The first
-    // hub connect normally precedes any orchestrator attach dispatch, but the
-    // child env snapshot is fixed at spawn time.
-    let hubUrlFromRegistry;
-    const reconcileHubUrlFromRegistry = () => {
-        if (hubUrlWasExplicit)
-            return;
-        const current = process.env['CAMSTACK_HUB_URL'];
-        if (current !== undefined && current !== hubUrlFromRegistry)
-            return;
-        const fromRegistry = (0, derive_hub_url_js_1.deriveHubUrlFromRegistry)((0, agent_http_js_1.getRegistryNodes)(broker));
-        if (fromRegistry === undefined || fromRegistry === current)
-            return;
-        process.env['CAMSTACK_HUB_URL'] = fromRegistry;
-        hubUrlFromRegistry = fromRegistry;
-        console.log(`[Agent] Derived CAMSTACK_HUB_URL=${fromRegistry} from live hub connection`);
-    };
-    // Immediate attempt (the hub may already be in the registry), then reconcile
-    // on every hub (re)connect via the `$node.connected` localBus idiom — NO
-    // timers, NO registry polling (CLAUDE.md invariant).
-    reconcileHubUrlFromRegistry();
-    broker.localBus.on('$node.connected', (data) => {
-        const node = data.node;
-        if (node?.id !== 'hub')
-            return;
-        reconcileHubUrlFromRegistry();
-    });
     // C2: wire the UDS ↔ Moleculer event bridge so events emitted by UDS
     // children fan to siblings and reach the cluster, and cluster / parent-
     // local events propagate to every UDS child. Inert when agentUdsRegistry
@@ -870,6 +831,13 @@ async function startAgent(configPath) {
             });
         }),
         addons: {
+            hub: (0, agent_hub_addon_update_js_1.createAgentHubAddonControls)({
+                nodeId: config.nodeId,
+                // The mesh channel the agent already holds; the hub names this caller
+                // `node:<id>` and answers per its remote privilege grant.
+                callHub: (action, params, timeoutMs) => broker.call(action, params, { nodeID: 'hub', timeout: timeoutMs }),
+                onProblem: (message) => consoleLogger.warn(message, { tags: { nodeId: config.nodeId } }),
+            }),
             getReport: () => (0, agent_addon_updates_js_1.buildAgentAddonUpdateReport)({
                 addonsDir: config.addonsDir,
                 ...(process.env['CAMSTACK_NPM_REGISTRY'] !== undefined

package/dist/api/trpc/core-cap-bridge.js

@@ -18,7 +18,7 @@
  * routes the call exactly like any addon-provided cap.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REMOTE_PRIVILEGE_LOG_ONLY = exports.REMOTE_PRIVILEGE_ALLOWLIST = exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE = exports.REMOTE_DENIED_NAMESPACES = void 0;
+exports.REMOTE_PRIVILEGE_LOG_ONLY = exports.REMOTE_UPDATE_PACKAGE_PATH = exports.REMOTE_PRIVILEGE_ALLOWLIST = exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE = exports.REMOTE_DENIED_NAMESPACES = void 0;
 exports.setRemotePrivilegeLogSink = setRemotePrivilegeLogSink;
 exports.__resetRemotePrivilegeObservationForTests = __resetRemotePrivilegeObservationForTests;
 exports.observeRemotePrivilege = observeRemotePrivilege;
@@ -28,6 +28,7 @@ exports.describeMeshOrigin = describeMeshOrigin;
 exports.buildCoreCapService = buildCoreCapService;
 const system_1 = require("@camstack/system");
 const moleculer_1 = require("moleculer");
+const remote_addon_update_grant_js_1 = require("./remote-addon-update-grant.js");
 const http_request_census_singleton_js_1 = require("./http-request-census.singleton.js");
 const server_provided_caps_js_1 = require("./server-provided-caps.js");
 const trpc_context_js_1 = require("./trpc.context.js");
@@ -90,6 +91,8 @@ exports.REMOTE_PRIVILEGE_ALLOWLIST = new Set([
     'addons.setCapabilityProviderEnabled',
     'system.getSiteLocation',
 ]);
+/** The one path outside the allowlist a node may call, under {@link authorizeRemoteUpdatePackage}. */
+exports.REMOTE_UPDATE_PACKAGE_PATH = 'addons.updatePackage';
 /**
  * When true, remote bridged calls outside {@link REMOTE_PRIVILEGE_ALLOWLIST} are
  * logged once per `(nodeId, path)` per process — still admin, not refused.
@@ -276,7 +279,7 @@ function buildCoreCapService(appRouter, census = (0, http_request_census_singlet
         const method = path.slice(dot + 1);
         actions.push({
             actionName: `${toKebab(namespace)}.${method}`,
-            invoke: (input, origin) => {
+            invoke: async (input, origin) => {
                 countMeshCall(census, path, origin);
                 const remoteNode = remoteOrigin(origin, options.ownNodeId);
                 if (remoteNode !== null && exports.REMOTE_DENIED_NAMESPACES.has(namespace)) {
@@ -286,6 +289,12 @@ function buildCoreCapService(appRouter, census = (0, http_request_census_singlet
                     if (exports.REMOTE_PRIVILEGE_LOG_ONLY) {
                         observeRemotePrivilege(remoteNode, path);
                     }
+                    else if (path === exports.REMOTE_UPDATE_PACKAGE_PATH && options.remoteUpdateGrant) {
+                        const decision = await (0, remote_addon_update_grant_js_1.authorizeRemoteUpdatePackage)(remoteNode, input, options.remoteUpdateGrant);
+                        if (!decision.allowed) {
+                            throw new moleculer_1.Errors.MoleculerClientError(`"${path}" refused for caller "${remoteNode}": ${decision.reason ?? 'not permitted'}`, 403, exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE);
+                        }
+                    }
                     else if (!exports.REMOTE_PRIVILEGE_ALLOWLIST.has(path)) {
                         observeRemotePrivilegeRefused(remoteNode, path);
                         throw new moleculer_1.Errors.MoleculerClientError(`"${path}" is not on the remote privilege grant (caller "${remoteNode}")`, 403, exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE);

package/dist/api/trpc/remote-addon-update-grant.js

@@ -0,0 +1,81 @@
+"use strict";
+/**
+ * The scoped grant that lets an agent update an addon on ITS OWN node (D842).
+ *
+ * `addons.updatePackage` is deliberately not on `REMOTE_PRIVILEGE_ALLOWLIST`:
+ * that list is by path, and a path grant would let any enrolled node deploy any
+ * package version to any other node. This rule grants the path only under three
+ * conditions, all decided from what the hub knows, never from what the caller
+ * says about itself:
+ *
+ *  1. the target `nodeId` IS the caller's authenticated node id (the mesh
+ *     identity Moleculer reports for the calling node; the request body names a
+ *     target, it never names the caller);
+ *  2. the version asked for IS the version the hub itself has installed for that
+ *     package — the one its back-fill restores on every reconnect. An agent can
+ *     therefore only converge to the hub's record, never inject an older, newer
+ *     or unpublished build;
+ *  3. the package exists on the hub.
+ *
+ * Every decision, allowed or refused, is written to the auth audit trail.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeRemoteUpdatePackage = authorizeRemoteUpdatePackage;
+function readRequest(input) {
+    if (input === null || typeof input !== 'object')
+        return null;
+    const name = Reflect.get(input, 'name');
+    const version = Reflect.get(input, 'version');
+    const nodeId = Reflect.get(input, 'nodeId');
+    if (typeof name !== 'string' || name === '')
+        return null;
+    if (typeof version !== 'string' || version === '')
+        return null;
+    if (typeof nodeId !== 'string' || nodeId === '')
+        return null;
+    return { name, version, nodeId };
+}
+function decide(callerNodeId, input, deps) {
+    const request = readRequest(input);
+    if (request === null) {
+        return {
+            allowed: false,
+            reason: 'addons.updatePackage from a node needs { name, version, nodeId } — all three',
+            detail: { reason: 'malformed' },
+        };
+    }
+    const detail = { name: request.name, version: request.version, target: request.nodeId };
+    if (request.nodeId !== callerNodeId) {
+        return {
+            allowed: false,
+            reason: `a node may update packages on its own node only: "${callerNodeId}" asked for "${request.nodeId}"`,
+            detail: { ...detail, reason: 'other-node' },
+        };
+    }
+    const hubVersion = deps.hubInstalledVersion(request.name);
+    if (hubVersion === null) {
+        return {
+            allowed: false,
+            reason: `the hub does not install ${request.name}, so it has no version to bring "${callerNodeId}" to`,
+            detail: { ...detail, reason: 'not-on-hub' },
+        };
+    }
+    if (request.version !== hubVersion) {
+        return {
+            allowed: false,
+            reason: `a node can only be brought to the hub's version: the hub records ${request.name}@${hubVersion}, not ${request.version}`,
+            detail: { ...detail, reason: 'version-differs', hubVersion },
+        };
+    }
+    return { allowed: true, reason: null, detail };
+}
+/** Decide, audit, and return the decision. */
+async function authorizeRemoteUpdatePackage(callerNodeId, input, deps) {
+    const { allowed, reason, detail } = decide(callerNodeId, input, deps);
+    await deps.audit({
+        action: allowed ? 'agent-addon-update' : 'agent-addon-update-refused',
+        userId: `node:${callerNodeId}`,
+        detail,
+    });
+    return { allowed, reason };
+}

package/dist/core/moleculer/moleculer.service.js

@@ -181,21 +181,18 @@ class MoleculerService {
         this.streamProbe = streamProbe;
         this.logger = this.logging.createLogger('moleculer');
         // Optional port overrides. Live primarily for the e2e harness: when
-        // a developer's dev:full is up on the default 6000/4445 ports, an
-        // isolated test hub can't reuse them. Production keeps the defaults
-        // so cluster discovery + agent-to-hub connections keep working
-        // without per-deploy config.
+        // a developer's dev:full is up on the default 6000 port, an
+        // isolated test hub can't reuse it. Production keeps the default so
+        // agent-to-hub connections keep working without per-deploy config.
         const tcpPortEnv = process.env['CAMSTACK_HUB_TCP_PORT'];
-        const udpPortEnv = process.env['CAMSTACK_HUB_UDP_PORT'];
         const tcpPort = tcpPortEnv ? Number(tcpPortEnv) : undefined;
-        const udpPort = udpPortEnv ? Number(udpPortEnv) : undefined;
         // Two-step cast: createBroker's dist `.d.ts` chains through
         // moleculer→eventemitter2 whose types are unresolvable at this
         // boundary, so the inference falls to `error` and trips
         // `no-unsafe-assignment`. Going via `unknown` documents the boundary.
         // No cluster secret here (D797): the broker is created before the keychain
         // can answer, and the Moleculer namespace was never authentication (TCP
-        // ignores it; UDP discovery broadcasts it in clear). The secret gates
+        // ignores it). The secret gates
         // `$hub.registerNode`, read from the keychain at call time.
         this.meshGuard = new hub_mesh_guard_js_1.HubMeshGuard('hub', this.logging.createLogger('mesh-auth'));
         const broker = (0, system_1.createBroker)({
@@ -205,7 +202,6 @@ class MoleculerService {
             middlewares: [this.meshGuard.middleware()],
             logLevel: this.config.get('moleculer.logLevel') ?? 'warn',
             ...(tcpPort && !Number.isNaN(tcpPort) ? { tcpPort } : {}),
-            ...(udpPort && !Number.isNaN(udpPort) ? { udpPort } : {}),
         });
         // `ServiceBroker` itself surfaces as `error`-typed at this boundary
         // (eventemitter2 chain unresolvable). Documented + single-site cast.

package/dist/main.js

@@ -526,6 +526,34 @@ async function bootstrap() {
     addonRegistry.setDataPlaneRegistry(dataPlaneRegistry);
     // ── Configure the CapabilityRegistry (created in AddonRegistryService constructor) ──
     const capabilityRegistry = addonRegistry.getCapabilityRegistry();
+    // D842: the scoped grant behind a node's own-node `addons.updatePackage`. The
+    // hub's record is its installed package version; every decision is audited.
+    const remoteUpdateGrantDeps = () => ({
+        hubInstalledVersion: (name) => {
+            try {
+                return (app
+                    .get(addon_package_service_1.AddonPackageService)
+                    .listInstalled()
+                    .find((p) => p.name === name)?.version ?? null);
+            }
+            catch {
+                return null;
+            }
+        },
+        audit: async (event) => {
+            try {
+                const internal = (0, system_1.getUserManagementInternal)(capabilityRegistry.getSingleton('user-management'));
+                if (internal === null) {
+                    console.warn('[bootstrap] agent addon update not audited: no user-management internal');
+                    return;
+                }
+                await internal.audit.record(event);
+            }
+            catch (err) {
+                console.warn('[bootstrap] agent addon update audit row not written:', err);
+            }
+        },
+    });
     const sessionBacking = (0, hub_sessions_js_1.sessionBackingFrom)(capabilityRegistry, sessionLifetimes);
     // From here on every verify of a session-grade token — tRPC, addon routes,
     // the session cookie, OAuth authorize, uploads, health — requires its
@@ -647,7 +675,10 @@ async function bootstrap() {
                 {
                     const meshBroker = app.get(moleculer_service_1.MoleculerService);
                     // D802: another node's call runs as `node:<id>`, never the hub's own principal.
-                    meshBroker.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter, undefined, { ownNodeId: meshBroker.nodeId }));
+                    meshBroker.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter, undefined, {
+                        ownNodeId: meshBroker.nodeId,
+                        remoteUpdateGrant: remoteUpdateGrantDeps(),
+                    }));
                 }
                 console.log('[bootstrap] core-cap mesh bridge registered ($core-caps) — before addon boot');
             }
@@ -742,7 +773,10 @@ async function bootstrap() {
                 {
                     const meshBroker = app.get(moleculer_service_1.MoleculerService);
                     // D802: another node's call runs as `node:<id>`, never the hub's own principal.
-                    meshBroker.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter, undefined, { ownNodeId: meshBroker.nodeId }));
+                    meshBroker.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter, undefined, {
+                        ownNodeId: meshBroker.nodeId,
+                        remoteUpdateGrant: remoteUpdateGrantDeps(),
+                    }));
                 }
                 console.log('[bootstrap] core-cap mesh bridge registered ($core-caps) — late fallback');
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.540",
+  "version": "1.2.542",
   "license": "MIT",
   "private": false,
   "files": [
@@ -24,7 +24,8 @@
     "start": "node --env-file=.env dist/launcher.js",
     "typecheck": "tsc --noEmit -p tsconfig.spec.json",
     "test": "vitest run --reporter verbose",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "test:cluster": "vitest run -c vitest.cluster.config.ts --reporter verbose"
   },
   "camstack": {
     "agentBootstrapAddons": [
@@ -37,17 +38,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.406",
-    "@camstack/addon-agent-ui": "1.2.223",
+    "@camstack/addon-admin-ui": "1.2.408",
+    "@camstack/addon-agent-ui": "1.2.224",
     "@camstack/addon-auth": "1.2.141",
     "@camstack/addon-decoder-nodeav": "1.2.123",
     "@camstack/addon-notifiers": "1.2.134",
-    "@camstack/addon-pipeline": "1.2.359",
+    "@camstack/addon-pipeline": "1.2.361",
     "@camstack/addon-pipeline-orchestrator": "1.2.310",
-    "@camstack/addon-post-analysis": "1.2.358",
+    "@camstack/addon-post-analysis": "1.2.360",
+    "@camstack/develop": "0.1.5",
     "@camstack/sdk": "1.2.131",
-    "@camstack/system": "1.2.416",
-    "@camstack/types": "1.2.354",
+    "@camstack/system": "1.2.418",
+    "@camstack/types": "1.2.356",
     "@camstack/ui-library": "1.2.281",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",