@camstack/server 1.2.588 → 1.2.589

package/dist/agent/agent-update-service.js

@@ -258,6 +258,9 @@ class AgentUpdateService extends index_js_1.RootUpdateService {
             applyClosurePatches: options.applyClosurePatches ?? (0, system_apply_closure_patches_js_1.buildSystemApplyClosurePatches)(options.logger),
             env: options.env,
             now: options.now,
+            ...(options.runnerBootCheck !== undefined
+                ? { runnerBootCheck: options.runnerBootCheck }
+                : {}),
         });
         this.nodeId = nodeId;
         this.restartAnnouncer = restartAnnouncer;

package/dist/agent/main.js

@@ -35,10 +35,12 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startAgent = startAgent;
 const fs = __importStar(require("node:fs"));
+const runner_boot_check_js_1 = require("../core/runner-health/runner-boot-check.js");
 const path = __importStar(require("node:path"));
 const system_1 = require("@camstack/system");
-// Capability definitions — must be declared before addon registerProvider() calls
 const types_1 = require("@camstack/types");
+// Capability definitions — must be declared before addon registerProvider() calls
+const types_2 = require("@camstack/types");
 const server_management_provider_js_1 = require("../api/core/server-management.provider.js");
 const package_dir_utils_js_1 = require("../core/addon/package-dir-utils.js");
 const single_copy_cleanup_runner_js_1 = require("../single-copy-cleanup-runner.js");
@@ -83,7 +85,7 @@ const agentLogManager = new system_2.LogManager(5000);
  * the hub singleton (which reads `nodeId` as data) instead of being pinned to
  * a node with no provider (dead broker fallback → ServiceNotFoundError).
  */
-const DATA_NODEID_CAPS = new Set(types_1.ALL_CAPABILITY_DEFINITIONS.filter((c) => c.nodeIdMode === 'data').map((c) => c.name));
+const DATA_NODEID_CAPS = new Set(types_2.ALL_CAPABILITY_DEFINITIONS.filter((c) => c.nodeIdMode === 'data').map((c) => c.name));
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
@@ -417,33 +419,33 @@ async function startAgent(configPath) {
     const capabilityRegistry = new system_1.CapabilityRegistry(consoleLogger);
     // Declare all capabilities the agent uses — required before registerProvider()
     const agentCapabilities = [
-        types_1.storageCapability,
-        types_1.storageProviderCapability,
+        types_2.storageCapability,
+        types_2.storageProviderCapability,
         // The path browser for "add a storage location on this node" — the agent
         // registers the provider since day one, but without DECLARING the cap
         // here the hub's manifest never learns of it and node-routed browse
         // answers "not available on node X" (2026-07-30 fix).
-        types_1.filesystemBrowseCapability,
+        types_2.filesystemBrowseCapability,
         // The agent runs the same two-addon data topology as the hub (D44):
         // `settings-store` is the door served by storage-orchestrator,
         // `data-store-provider` is the engine sqlite-settings registers. BOTH
         // must be declared here — this array is hand-curated and nothing else
         // teaches an agent a capability, so omitting the engine leaves the
         // agent's door with nothing behind it.
-        types_1.settingsStoreCapability,
-        types_1.dataStoreProviderCapability,
-        types_1.logDestinationCapability,
-        types_1.metricsProviderCapability,
-        types_1.decoderCapability,
-        types_1.motionDetectionCapability,
-        types_1.pipelineExecutorCapability,
-        types_1.pipelineRunnerCapability,
-        types_1.audioAnalyzerCapability,
-        types_1.platformProbeCapability,
-        types_1.serverManagementCapability,
+        types_2.settingsStoreCapability,
+        types_2.dataStoreProviderCapability,
+        types_2.logDestinationCapability,
+        types_2.metricsProviderCapability,
+        types_2.decoderCapability,
+        types_2.motionDetectionCapability,
+        types_2.pipelineExecutorCapability,
+        types_2.pipelineRunnerCapability,
+        types_2.audioAnalyzerCapability,
+        types_2.platformProbeCapability,
+        types_2.serverManagementCapability,
         // Certificates of THIS node, called by the hub (D856): mesh leaf renewal and the
         // hub-issued HTTPS leaf. Provided by the runtime, like `server-management`.
-        types_1.nodeCertificatesCapability,
+        types_2.nodeCertificatesCapability,
     ];
     for (const cap of agentCapabilities) {
         capabilityRegistry.declareCapability(cap);
@@ -455,9 +457,14 @@ async function startAgent(configPath) {
     // `agent-runtime` addonId (no addon owns it); `buildAgentOwnManifest`
     // appends the matching manifest entry so the hub can route
     // nodeId-pinned `server-management` calls here.
+    // D877: the agent's runner boot check. Only the hub plans which addons an
+    // agent runs, so the agent compares what its process service holds (a runner
+    // that failed or refused is named; one that never spawned is not knowable here).
+    let agentRunnerBootCheck = null;
     const agentUpdateService = new agent_update_service_js_1.AgentUpdateService({
         logger: consoleLogger,
         dataDir: config.dataDir,
+        runnerBootCheck: () => agentRunnerBootCheck?.current(),
     });
     capabilityRegistry.registerProvider('server-management', agent_update_service_js_1.AGENT_RUNTIME_ADDON_ID, (0, server_management_provider_js_1.buildServerManagementProvider)(agentUpdateService));
     // The agent's certificates (D856): mesh leaf swap with automatic rollback, and the
@@ -781,6 +788,19 @@ async function startAgent(configPath) {
     // discovery resolve (or time out cleanly via the read-blob fallback)
     // so agent boot completes instead of hanging on the first infra addon.
     await broker.start();
+    agentRunnerBootCheck = new runner_boot_check_js_1.RunnerBootCheckService({
+        logger: consoleLogger,
+        nodeId: config.nodeId,
+        planned: () => null,
+        listProcesses: async () => {
+            // Untyped Moleculer boundary; the process service owns the row shape.
+            const rows = await broker.call('$process.list', {});
+            return rows;
+        },
+    });
+    agentRunnerBootCheck.scheduleAfterBoot();
+    // Re-evaluate a verdict that still had runners on their way, on each runner state change.
+    (0, system_1.getBrokerEventBus)(broker).subscribe({ category: types_1.EventCategory.ProcessStateChanged }, () => agentRunnerBootCheck?.noteRunnerChange());
     // C2: wire the UDS ↔ Moleculer event bridge so events emitted by UDS
     // children fan to siblings and reach the cluster, and cluster / parent-
     // local events propagate to every UDS child. Inert when agentUdsRegistry
@@ -900,7 +920,7 @@ async function startAgent(configPath) {
         (0, agent_pairing_store_js_1.forgetPairing)(config.configPath, config.dataDir);
         pairing.noteUnpaired();
         hubConnectionStateOverride = null;
-        await reconnect().catch((err) => consoleLogger.error(`reconnect after unpairing failed: ${(0, types_1.errMsg)(err)}`));
+        await reconnect().catch((err) => consoleLogger.error(`reconnect after unpairing failed: ${(0, types_2.errMsg)(err)}`));
         advertise();
     };
     advertise();
@@ -1041,7 +1061,7 @@ async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFact
             await loader.loadFromAddonDir(dir);
         }
         catch (err) {
-            console.warn(`[Agent] Failed to scan ${dir}: ${(0, types_1.errMsg)(err)}`);
+            console.warn(`[Agent] Failed to scan ${dir}: ${(0, types_2.errMsg)(err)}`);
         }
     }
     // Resolution is per-CAPABILITY (the guard names every missing required
@@ -1094,7 +1114,7 @@ async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFact
                 // configured for type addons-data" → fatal crash-loop.
                 listStorageLocationDeclarations: () => loader.listStorageLocationDeclarations(),
             });
-            const initResult = (0, types_1.normalizeAddonInitResult)(await instance.initialize(context));
+            const initResult = (0, types_2.normalizeAddonInitResult)(await instance.initialize(context));
             for (const reg of initResult?.providers ?? []) {
                 const capName = reg.capability.name;
                 registry.registerProvider(capName, addonId, reg.provider);
@@ -1112,7 +1132,7 @@ async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFact
             console.log(`[Agent] Core addon "${addonId}" initialized`);
         }
         catch (err) {
-            const msg = (0, types_1.errMsg)(err);
+            const msg = (0, types_2.errMsg)(err);
             console.error(`[Agent] Failed to initialize core addon "${addonId}": ${msg}`);
             if (step.required) {
                 throw new Error(`Required infrastructure addon "${addonId}" failed: ${msg}`, { cause: err });
@@ -1155,7 +1175,7 @@ async function loadClusterCapableAddons(broker, config, capabilityRegistry, load
             await loader.loadFromAddonDir(dir);
         }
         catch (err) {
-            console.warn(`[Agent] Skipping ${dir}: ${(0, types_1.errMsg)(err)}`);
+            console.warn(`[Agent] Skipping ${dir}: ${(0, types_2.errMsg)(err)}`);
             continue;
         }
         dirToLoader.set(dir, loader);
@@ -1164,11 +1184,11 @@ async function loadClusterCapableAddons(broker, config, capabilityRegistry, load
                 continue;
             if (registered.declaration.execution === undefined)
                 continue;
-            const placement = (0, types_1.resolveAddonPlacement)(registered.declaration);
+            const placement = (0, types_2.resolveAddonPlacement)(registered.declaration);
             if (placement === 'hub-only')
                 continue;
             allGroupCandidates.push({
-                groupId: (0, types_1.resolveRunnerId)(registered.declaration, registered.declaration.id),
+                groupId: (0, types_2.resolveRunnerId)(registered.declaration, registered.declaration.id),
                 addonId: registered.declaration.id,
                 addonDir: dir,
                 version: registered.declaration.version ?? '0.0.0',
@@ -1216,7 +1236,7 @@ async function loadClusterCapableAddons(broker, config, capabilityRegistry, load
             const addonId = registered.declaration.id;
             if (loadedAddons.has(addonId))
                 continue;
-            if (!(0, types_1.isDeployableToAgent)(registered.declaration))
+            if (!(0, types_2.isDeployableToAgent)(registered.declaration))
                 continue;
             console.warn(`[Agent] Addon "${addonId}" is deployable but missing from any spawned group — verify package.json execution field`);
         }
@@ -1250,11 +1270,11 @@ async function loadDeployedAddons(broker, addonsDir, dataDir, loadedAddons, stor
             const addonId = decl.id;
             if (loadedAddons.has(addonId))
                 continue;
-            if (!(0, types_1.isDeployableToAgent)(decl))
+            if (!(0, types_2.isDeployableToAgent)(decl))
                 continue;
             if ((0, agent_group_runner_js_1.isGroupRunnerAddon)(decl)) {
                 groupCandidates.push({
-                    groupId: (0, types_1.resolveRunnerId)(decl, addonId),
+                    groupId: (0, types_2.resolveRunnerId)(decl, addonId),
                     addonId,
                     addonDir: dir,
                     version: decl.version ?? '0.0.0',
@@ -1316,14 +1336,14 @@ async function loadInProcessDeployedAddons(broker, dirs, dataDir, loadedAddons,
             await loader.loadFromAddonDir(dir);
         }
         catch (err) {
-            console.warn(`[Agent] Skipping ${dir}: ${(0, types_1.errMsg)(err)}`);
+            console.warn(`[Agent] Skipping ${dir}: ${(0, types_2.errMsg)(err)}`);
             continue;
         }
         for (const registered of loader.listAddons()) {
             const addonId = registered.declaration.id;
             if (loadedAddons.has(addonId))
                 continue;
-            if (!(0, types_1.isDeployableToAgent)(registered.declaration))
+            if (!(0, types_2.isDeployableToAgent)(registered.declaration))
                 continue;
             // Group-runner addons are dispatched to subprocesses by the caller.
             if ((0, agent_group_runner_js_1.isGroupRunnerAddon)(registered.declaration))
@@ -1345,7 +1365,7 @@ async function loadInProcessDeployedAddons(broker, dirs, dataDir, loadedAddons,
                 console.log(`[Agent] Deployed addon "${addonId}" loaded in-process`);
             }
             catch (err) {
-                const msg = (0, types_1.errMsg)(err);
+                const msg = (0, types_2.errMsg)(err);
                 console.error(`[Agent] Failed to load deployed addon "${addonId}": ${msg}`);
                 loadedAddons.set(addonId, { id: addonId, status: 'error' });
             }

package/dist/api/core/cap-providers.js

@@ -586,10 +586,11 @@ function buildNodesProvider(agentRegistry, moleculer, addonRegistry, getNodeRoot
             // tab can render the same shape regardless of whether the target is
             // hub or agent.
             if (input.nodeId === 'hub') {
+                await addonRegistry?.refreshRunnerStates();
                 const rows = addonRegistry?.listAddons() ?? [];
                 return rows.map((r) => ({
                     id: r.manifest.id,
-                    status: r.process?.state ?? 'running',
+                    status: r.process?.state ?? 'unknown',
                     version: r.manifest.packageVersion,
                     packageName: r.manifest.packageName,
                 }));
@@ -1477,6 +1478,8 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx, agentReg
             for (const h of ar.getAddonHealthSnapshot()) {
                 healthByPackage.set(h.packageName, h);
             }
+            // Real runner states (D877) - never the literal `running` the list used to carry.
+            await ar.refreshRunnerStates();
             const hubList = ar.listAllAddons().map((item) => ({
                 ...item,
                 hasBackup: rollbackable.has(item.manifest.packageName),
@@ -1506,6 +1509,8 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx, agentReg
                         },
                         hasBackup: false,
                         health: null,
+                        // The hub's runner state is not this agent's: report none rather than a borrowed one.
+                        process: undefined,
                     },
                 ];
             });

package/dist/api/health/health.routes.js

@@ -23,6 +23,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildHubHealth = buildHubHealth;
 exports.isAuthorizedHealthRequest = isAuthorizedHealthRequest;
 exports.registerHealthRoutes = registerHealthRoutes;
+const runner_boot_check_js_1 = require("../../core/runner-health/runner-boot-check.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const AGENT_HEALTH_TIMEOUT_MS = 3_000;
 function nowIso() {
@@ -35,6 +36,18 @@ async function buildHubHealth(deps, proc = process) {
     const offlineNodes = remote.filter((n) => !n.isOnline);
     const total = remote.length;
     const online = total - offlineNodes.length;
+    const check = deps.runnerBootCheck?.();
+    const runners = check === undefined
+        ? undefined
+        : {
+            degraded: (0, runner_boot_check_js_1.isRunnerBootCheckDegraded)(check),
+            expected: check.expected,
+            running: check.running,
+            failed: check.failed.length,
+            refused: check.refused.length,
+            missing: check.missing.length,
+            checkedAtMs: check.checkedAtMs,
+        };
     const memUsage = proc.memoryUsage();
     const totalMem = memUsage.heapTotal + memUsage.external + memUsage.arrayBuffers;
     const memoryPercent = totalMem > 0 ? Math.round((memUsage.heapUsed / totalMem) * 100) : 0;
@@ -55,6 +68,7 @@ async function buildHubHealth(deps, proc = process) {
         cpuPercent: 0,
         memoryPercent,
         checkedAt: nowIso(),
+        ...(runners !== undefined ? { runners } : {}),
     };
 }
 async function fetchAgentHealth(deps, nodeId) {

package/dist/api/trpc/generated-cap-routers.js

@@ -4995,6 +4995,14 @@ function createCapRouter_llm(getProvider, _createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.upsertProfile(input);
         }),
+        migrateRawSecrets: trpc_middleware_js_1.adminProcedure
+            .input(types_67.llmCapability.methods.migrateRawSecrets.input.loose())
+            .output(types_67.llmCapability.methods.migrateRawSecrets.output)
+            .mutation(async ({ input, ctx }) => {
+            const p = requireCapProvider('llm', () => getProvider(ctx));
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.migrateRawSecrets(input);
+        }),
         deleteProfile: trpc_middleware_js_1.adminProcedure
             .input(types_67.llmCapability.methods.deleteProfile.input.loose())
             .output(types_67.llmCapability.methods.deleteProfile.output)
@@ -11971,6 +11979,15 @@ function createCapRouter_userManagement(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getTotpStatus(methodInput);
         }),
+        migrateRawSecrets: trpc_middleware_js_1.adminProcedure
+            .input(types_138.userManagementCapability.methods.migrateRawSecrets.input.loose())
+            .output(types_138.userManagementCapability.methods.migrateRawSecrets.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.migrateRawSecrets(methodInput);
+        }),
         verifyTotp: trpc_middleware_js_1.protectedProcedure
             .input(types_138.userManagementCapability.methods.verifyTotp.input.loose())
             .output(types_138.userManagementCapability.methods.verifyTotp.output)

package/dist/core/addon/addon-process-view.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NEVER_LOADED_PROCESS = void 0;
+exports.describeAddonProcess = describeAddonProcess;
+function describeAddonProcess(input) {
+    if (!input.forked) {
+        // Hosted by hub-main itself: its state is hub-main's, which is running if this code is.
+        return input.initialized
+            ? { pid: input.hubPid, mode: 'in-process', state: 'running' }
+            : undefined;
+    }
+    if (input.runners === null)
+        return { mode: 'forked', state: 'unknown' };
+    const row = input.runners.get(input.runnerId);
+    if (row === undefined)
+        return { mode: 'forked', state: 'missing' };
+    return {
+        pid: row.pid,
+        mode: 'forked',
+        state: row.state,
+        ...(row.refusal !== undefined ? { reason: row.refusal.reason } : {}),
+    };
+}
+/**
+ * A package on disk that never loaded: there is no process, and the card must
+ * show the diagnostic state distinctly (`scanFailedToLoadPackages`).
+ */
+exports.NEVER_LOADED_PROCESS = { mode: 'in-process', state: 'failed' };

package/dist/core/addon/addon-registry.service.js

@@ -39,6 +39,7 @@ exports.shouldEvictMissingOnDisk = shouldEvictMissingOnDisk;
 exports.addonUpdatePayload = addonUpdatePayload;
 exports.parseDataPlaneEndpoints = parseDataPlaneEndpoints;
 exports.shouldEmitProviderRegisteredReady = shouldEmitProviderRegisteredReady;
+const addon_process_view_js_1 = require("./addon-process-view.js");
 const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
@@ -2045,17 +2046,16 @@ class AddonRegistryService {
         return this.isPackageProtected(entry.packageName);
     }
     listAddons() {
-        // Build process info map from in-memory data (sync, no stats)
-        const processMap = new Map();
-        for (const [id, entry] of this.addonEntries) {
-            if (entry.initialized) {
-                processMap.set(`addon:${id}`, {
-                    pid: process.pid,
-                    mode: 'in-process',
-                    state: 'running',
-                });
-            }
-        }
+        // The real process-service state of each addon's runner (D877) - the last
+        // `refreshRunnerStates()` answer; `unknown` before the first one.
+        const runnerStates = this.runnerStates;
+        const processFor = (id, entry) => (0, addon_process_view_js_1.describeAddonProcess)({
+            forked: this.runsInOwnRunner(entry),
+            initialized: entry.initialized === true,
+            runnerId: entry.declaration ? (0, types_1.resolveRunnerId)(entry.declaration, id) : id,
+            runners: runnerStates,
+            hubPid: process.pid,
+        });
         const live = Array.from(this.addonEntries.values())
             .filter((entry) => entry.addon?.manifest?.id)
             .map((entry) => {
@@ -2098,7 +2098,7 @@ class AddonRegistryService {
                 declaration: entry.declaration,
                 source: entry.source,
                 installSource,
-                process: processMap.get(`addon:${entry.addon.manifest.id}`),
+                process: processFor(entry.addon.manifest.id, entry),
             };
         });
         // Surface packages that exist on disk but failed to load — typical
@@ -2194,7 +2194,7 @@ class AddonRegistryService {
                     declaration: decl,
                     source: 'installed',
                     ...(installSource ? { installSource } : {}),
-                    process: { mode: 'in-process', state: 'failed' },
+                    process: addon_process_view_js_1.NEVER_LOADED_PROCESS,
                 });
             }
         };
@@ -2228,38 +2228,6 @@ class AddonRegistryService {
     listAllAddons() {
         return this.listAddons();
     }
-    /**
-     * List all addon processes (in-process addons)
-     * as ManagedProcessStatus-compatible entries for the process tree.
-     */
-    async listAddonProcesses() {
-        const result = [];
-        // Collect hub PID and fetch stats
-        const { getPidStats } = await Promise.resolve().then(() => __importStar(require('@camstack/system')));
-        const pidStats = await getPidStats([process.pid]);
-        // In-process addons
-        const hubStats = pidStats.get(process.pid);
-        for (const [id, entry] of this.addonEntries) {
-            if (entry.initialized) {
-                result.push({
-                    id: `addon:${id}`,
-                    label: `Addon: ${id} (in-process)`,
-                    state: 'running',
-                    pid: process.pid,
-                    stats: {
-                        pid: process.pid,
-                        cpu: hubStats?.cpu ?? 0,
-                        memory: hubStats?.memory ?? 0,
-                        uptime: Math.round(process.uptime()),
-                        restartCount: 0,
-                    },
-                    restartCount: 0,
-                    mode: 'in-process',
-                });
-            }
-        }
-        return result;
-    }
     /**
      * Phase 11 (settings redesign): `getAddonConfigSchema`,
      * `getAddonConfig`, and `updateAddonConfig` — the legacy adapter
@@ -3243,6 +3211,45 @@ class AddonRegistryService {
             meta: { runnerId, addonCount: addons.length, addonIds: addons.map((a) => a.addonId) },
         });
     }
+    /**
+     * The last answer of `$process.list`, keyed by runner id (D877); `null` before
+     * the first one or when the process service could not answer. Read by the
+     * synchronous `listAddons()`; refreshed by `refreshRunnerStates()`.
+     */
+    runnerStates = null;
+    /** Every runner row the process service holds right now, or `null` when it cannot answer. */
+    async listRunnerRows() {
+        try {
+            // Untyped Moleculer boundary: the process-service owns `ProcessInfo`.
+            const procs = (await this.broker.call('$process.list'));
+            return procs.map((p) => ({
+                name: p.name,
+                pid: p.pid,
+                addonIds: p.addonIds,
+                state: p.state,
+                ...(p.refusal !== undefined ? { refusal: { reason: p.refusal.reason } } : {}),
+            }));
+        }
+        catch (err) {
+            this.logger.warn('could not list the runner processes - addon process state is unknown', {
+                meta: { error: (0, types_1.errMsg)(err) },
+            });
+            return null;
+        }
+    }
+    /** Re-read the process service so the next `listAddons()` reports real runner states. */
+    async refreshRunnerStates() {
+        const rows = await this.listRunnerRows();
+        this.runnerStates = rows === null ? null : new Map(rows.map((r) => [r.name, r]));
+    }
+    /** The runner ids this node PLANS to run: `resolveRunnerId` over every forked addon. */
+    plannedRunnerIds() {
+        return [...this.buildAddonGroupPlan([...this.addonEntries.keys()]).keys()];
+    }
+    /** The forked addon ids (the ones whose Init the D870 guard gates). */
+    forkedAddonIds() {
+        return [...this.buildAddonGroupPlan([...this.addonEntries.keys()]).values()].flatMap((roster) => roster.map((r) => r.addonId));
+    }
     /**
      * Snapshot of the live runner subprocesses (`$process.list`), reduced to the
      * `{ runnerId, addonIds }` shape the convergence planner needs. Returns `[]`

package/dist/core/runner-health/runner-boot-check.js

@@ -0,0 +1,175 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerBootCheckService = exports.RUNNER_BOOT_CHECK_DELAY_MS = void 0;
+exports.evaluateRunnerBootCheck = evaluateRunnerBootCheck;
+exports.isRunnerBootCheckSettled = isRunnerBootCheckSettled;
+exports.isRunnerBootCheckDegraded = isRunnerBootCheckDegraded;
+exports.describeRunnerBootCheck = describeRunnerBootCheck;
+/**
+ * Pure verdict. A planned runner is `running`, `refused` (typed Init refusal),
+ * `missing` (the process service has no entry), or `failed` - which here means
+ * "has an entry and is none of the above": the D6 breaker's terminal state, a
+ * crash waiting on its backoff, a stop, or a start that never reached READY.
+ */
+function evaluateRunnerBootCheck(input) {
+    const byName = new Map(input.processes.map((p) => [p.name, p]));
+    const expectedIds = input.planned ?? input.processes.map((p) => p.name);
+    const failed = [];
+    const refused = [];
+    const missing = [];
+    const pending = [];
+    let running = 0;
+    for (const runnerId of expectedIds) {
+        const row = byName.get(runnerId);
+        if (row === undefined) {
+            missing.push(runnerId);
+        }
+        else if (row.state === 'running') {
+            running += 1;
+        }
+        else if (row.state === 'starting' || row.state === 'crashed') {
+            // On its way: a slow boot or a crash waiting on its backoff respawn is not
+            // a failure yet - the breaker (`failed`) is what says "gave up".
+            pending.push(runnerId);
+        }
+        else if (row.state === 'refused') {
+            refused.push({
+                runnerId,
+                addonIds: [...row.addonIds],
+                reason: row.refusal?.reason ?? 'refused to start (reason not reported)',
+            });
+        }
+        else {
+            failed.push(runnerId);
+        }
+    }
+    return {
+        checkedAtMs: input.now,
+        expected: expectedIds.length,
+        running,
+        failed,
+        refused,
+        missing,
+        pending,
+        planKnown: input.planned !== null,
+    };
+}
+/** True when no runner is still on its way - only a settled verdict is pushed. */
+function isRunnerBootCheckSettled(check) {
+    return (check.pending ?? []).length === 0;
+}
+/** True when the check found anything an operator has to act on. */
+function isRunnerBootCheckDegraded(check) {
+    return (check !== undefined &&
+        (check.failed.length > 0 || check.refused.length > 0 || check.missing.length > 0));
+}
+/** One sentence naming the findings, for a log line or an alert. */
+function describeRunnerBootCheck(check) {
+    const parts = [];
+    if (check.failed.length > 0)
+        parts.push(`failed: ${check.failed.join(', ')}`);
+    if (check.refused.length > 0) {
+        parts.push(`refused: ${check.refused.map((r) => `${r.runnerId} (${r.reason})`).join('; ')}`);
+    }
+    if (check.missing.length > 0)
+        parts.push(`missing: ${check.missing.join(', ')}`);
+    if ((check.pending ?? []).length > 0)
+        parts.push(`still starting: ${(check.pending ?? []).join(', ')}`);
+    return `${check.running}/${check.expected} runners running${parts.length > 0 ? ` - ${parts.join(' - ')}` : ''}`;
+}
+exports.RUNNER_BOOT_CHECK_DELAY_MS = 60_000;
+class RunnerBootCheckService {
+    options;
+    latest;
+    timer = null;
+    constructor(options) {
+        this.options = options;
+    }
+    /** The stored verdict; `undefined` until the check has run. */
+    current() {
+        return this.latest;
+    }
+    /** Arm the one-shot check. A second call while armed is a no-op. */
+    scheduleAfterBoot(delayMs = exports.RUNNER_BOOT_CHECK_DELAY_MS) {
+        if (this.timer !== null)
+            return;
+        this.timer = setTimeout(() => {
+            this.timer = null;
+            void this.run();
+        }, delayMs);
+        this.timer.unref();
+    }
+    reevaluating = null;
+    /**
+     * A runner settled on a state. While the stored verdict still has pending
+     * runners, evaluate again - once at a time, no timer: the process service
+     * tells us when something changed (D3).
+     */
+    noteRunnerChange() {
+        if (this.latest === undefined || isRunnerBootCheckSettled(this.latest))
+            return;
+        if (this.reevaluating !== null) {
+            // A change landed while a re-evaluation was reading: read once more after it.
+            this.changedDuringRun = true;
+            return;
+        }
+        this.reevaluating = this.run().finally(() => {
+            this.reevaluating = null;
+            if (this.changedDuringRun) {
+                this.changedDuringRun = false;
+                this.noteRunnerChange();
+            }
+        });
+    }
+    changedDuringRun = false;
+    cancel() {
+        if (this.timer !== null)
+            clearTimeout(this.timer);
+        this.timer = null;
+    }
+    /** Run the check now. A process service that cannot answer leaves the previous verdict. */
+    async run() {
+        const { logger, nodeId } = this.options;
+        let processes;
+        try {
+            processes = await this.options.listProcesses();
+        }
+        catch (err) {
+            logger.warn('runner boot check could not list the runners - no verdict recorded', {
+                tags: { nodeId },
+                meta: { error: err instanceof Error ? err.message : String(err) },
+            });
+            return this.latest;
+        }
+        const check = evaluateRunnerBootCheck({
+            planned: this.options.planned(),
+            processes,
+            now: (this.options.now ?? Date.now)(),
+        });
+        this.latest = check;
+        const summary = describeRunnerBootCheck(check);
+        if (!isRunnerBootCheckSettled(check)) {
+            // Not final: nothing is announced until every runner has settled; the next
+            // runner state change re-evaluates (`noteRunnerChange`).
+            logger.info(`runner boot check not settled: ${summary}`, { tags: { nodeId } });
+            return check;
+        }
+        if (isRunnerBootCheckDegraded(check)) {
+            logger.error(`runner boot check DEGRADED: ${summary}`, { tags: { nodeId } });
+        }
+        else {
+            logger.info(`runner boot check: ${summary}`, { tags: { nodeId } });
+        }
+        try {
+            this.options.onResult?.(check);
+        }
+        catch (err) {
+            logger.warn('runner boot check result handler threw', {
+                tags: { nodeId },
+                meta: { error: err instanceof Error ? err.message : String(err) },
+            });
+        }
+        return check;
+    }
+}
+exports.RunnerBootCheckService = RunnerBootCheckService;

package/dist/core/runner-health/update-preflight.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEGACY_BLOB_GUARD_SINCE = void 0;
+exports.buildUpdatePreflight = buildUpdatePreflight;
+exports.legacyGuardClientOf = legacyGuardClientOf;
+/**
+ * The `applyServerUpdate` pre-flight (D877).
+ *
+ * Question: would the TARGET version refuse to start any addon on THIS node's
+ * live data? Today there is one deterministic Init refusal the framework can
+ * pre-check: the D870 legacy-blob guard (`assertLegacyBlobsMigrated`) - an addon
+ * whose settings still sit in its per-addon blob tables while the standard store
+ * holds none.
+ *
+ * The store-shape check is deliberately version-independent: the live store is
+ * what it is, so the only version question is "does the target contain the
+ * guard?" - answered by {@link LEGACY_BLOB_GUARD_SINCE}. The honest limit: it
+ * runs inside the version that ships it, so it protects updates FROM this
+ * version onwards; an update from an older hub never ran it. And it knows only
+ * the refusals listed here - a new deterministic Init refusal has to be added
+ * to this module to be pre-checked.
+ */
+const system_1 = require("@camstack/system");
+const index_js_1 = require("../../server-root/index.js");
+/** The first server version whose addons run `assertLegacyBlobsMigrated` at Init. */
+exports.LEGACY_BLOB_GUARD_SINCE = '1.2.585';
+function buildUpdatePreflight(deps) {
+    return async (targetVersion) => {
+        if ((0, index_js_1.compareSemver)(targetVersion, exports.LEGACY_BLOB_GUARD_SINCE) < 0)
+            return [];
+        const store = deps.store();
+        if (store === null) {
+            throw new Error('the settings store is not available to pre-check the update');
+        }
+        const blockers = [];
+        for (const addonId of deps.forkedAddonIds()) {
+            try {
+                await (0, system_1.assertLegacyBlobsMigrated)(store, addonId, deps.logger);
+            }
+            catch (err) {
+                // A refusal is the finding; any other error is "could not ask" and the
+                // caller treats a throw as exactly that (it never blocks on it).
+                if (!(err instanceof system_1.UnmigratedSettingsError))
+                    throw err;
+                blockers.push({
+                    addonId,
+                    reason: err.message,
+                    remedy: system_1.UNMIGRATED_SETTINGS_REMEDY,
+                });
+            }
+        }
+        return blockers;
+    };
+}
+/** The three store calls the guard makes, over the hub's `settings-store` provider. */
+function legacyGuardClientOf(store) {
+    return {
+        query: { query: (input) => store.query(input) },
+        get: { query: (input) => store.get(input) },
+        count: { query: (input) => store.count(input) },
+    };
+}

package/dist/core/server-update/server-update.service.js

@@ -103,6 +103,12 @@ class ServerUpdateService extends index_js_1.RootUpdateService {
             applyClosurePatches: options.applyClosurePatches ?? (0, system_apply_closure_patches_js_1.buildSystemApplyClosurePatches)(options.logger),
             env: options.env,
             now: options.now,
+            ...(options.updatePreflight !== undefined
+                ? { updatePreflight: options.updatePreflight }
+                : {}),
+            ...(options.runnerBootCheck !== undefined
+                ? { runnerBootCheck: options.runnerBootCheck }
+                : {}),
         });
         this.updateAvailability =
             options.eventBus !== undefined

package/dist/main.js

@@ -67,6 +67,7 @@ const request_census_settings_1 = require("./api/core/request-census-settings");
 const register_cors_policy_1 = require("./api/cors/register-cors-policy");
 const adaptive_probe_routes_1 = require("./api/health/adaptive-probe.routes");
 const health_routes_1 = require("./api/health/health.routes");
+const runner_boot_check_1 = require("./core/runner-health/runner-boot-check");
 const hub_cluster_url_1 = require("./api/hub-cluster-url");
 const model_distributor_js_1 = require("./api/model-distributor.js");
 const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
@@ -729,6 +730,7 @@ async function bootstrap() {
             // router finishes registering (see `trpcRegistered = true` below).
             isReady: () => trpcRegistered,
             verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
+            runnerBootCheck: () => app.get(runner_boot_check_1.RunnerBootCheckService).current(),
         });
         console.log(`[bootstrap] Health routes registered (hub v${hubVersion})`);
         (0, adaptive_probe_routes_1.registerAdaptiveProbeRoute)(fastify, {
@@ -1693,6 +1695,10 @@ async function bootstrap() {
     // Post-boot: fork workers, register device streams, emit system.boot
     const postBoot = app.get(post_boot_service_1.PostBootService);
     await postBoot.run({ port, host, dataPath, trpcRegistered, tlsCert });
+    // D877: ONE check, ~60 s after the boot sequence, of the runners this node
+    // planned against what its process service holds. Stored in memory and served
+    // on `getServerPackageStatus` / `/health`; not a timer loop.
+    app.get(runner_boot_check_1.RunnerBootCheckService).scheduleAfterBoot();
     // The hub reached ready — when this boot is the PROBATION boot of a freshly
     // staged @camstack/server root, promote it (currentVersion ← pending, N-1
     // retained for rollback) and disarm the starter's crash-loop auto-rollback.

package/dist/manual-boot.js

@@ -75,6 +75,8 @@ const notification_wrapper_service_1 = require("./core/notification/notification
 const toast_wrapper_service_1 = require("./core/notification/toast-wrapper.service");
 const repl_engine_service_1 = require("./core/repl/repl-engine.service");
 const server_update_service_1 = require("./core/server-update/server-update.service");
+const runner_boot_check_1 = require("./core/runner-health/runner-boot-check");
+const update_preflight_1 = require("./core/runner-health/update-preflight");
 const storage_service_1 = require("./core/storage/storage.service");
 const stream_probe_service_1 = require("./core/streaming/stream-probe.service");
 const topology_emitter_service_1 = require("./core/topology/topology-emitter.service");
@@ -251,7 +253,49 @@ async function bootManual(opts) {
     // Runtime-updatable root package (phase 1: hub only). The service owns the
     // data-dir server-root staging/rollback lifecycle; restarts route through
     // AddonPackageService.restartServer for the marker + reconnect toast.
+    // D877: the runner boot check (one-shot after boot, scheduled by main.ts) and
+    // the update pre-flight (would the target refuse addons on the live store?).
+    const hubRunnerBootCheck = new runner_boot_check_1.RunnerBootCheckService({
+        logger: loggingService.createLogger('RunnerBootCheck'),
+        nodeId: 'hub',
+        planned: () => addonRegistryService.plannedRunnerIds(),
+        listProcesses: async () => {
+            const rows = await addonRegistryService.listRunnerRows();
+            if (rows === null)
+                throw new Error('the process service did not answer');
+            return rows;
+        },
+        // The verdict reaches the alert centre (one alert + the direct critical push).
+        onResult: (check) => {
+            eventBusService.emit({
+                id: (0, node_crypto_1.randomUUID)(),
+                timestamp: new Date(),
+                source: { type: 'core', id: 'runner-boot-check' },
+                category: types_1.EventCategory.SystemRunnerCheck,
+                data: {
+                    nodeId: 'hub',
+                    degraded: (0, runner_boot_check_1.isRunnerBootCheckDegraded)(check),
+                    summary: (0, runner_boot_check_1.describeRunnerBootCheck)(check),
+                    expected: check.expected,
+                    running: check.running,
+                    failed: [...check.failed],
+                    refused: check.refused.map((r) => ({ runnerId: r.runnerId, reason: r.reason })),
+                    missing: [...check.missing],
+                },
+            });
+        },
+    });
+    const settingsStoreOrNull = () => capabilityService.getRegistry()?.getSingleton('settings-store') ?? null;
     const serverUpdateService = new server_update_service_1.ServerUpdateService({
+        updatePreflight: (0, update_preflight_1.buildUpdatePreflight)({
+            logger: loggingService.createLogger('UpdatePreflight'),
+            forkedAddonIds: () => addonRegistryService.forkedAddonIds(),
+            store: () => {
+                const store = settingsStoreOrNull();
+                return store === null ? null : (0, update_preflight_1.legacyGuardClientOf)(store);
+            },
+        }),
+        runnerBootCheck: () => hubRunnerBootCheck.current(),
         logger: loggingService.createLogger('ServerUpdate'),
         restartServer: (requestedBy, update) => addonPackageService.restartServer(requestedBy, update),
         eventBus: eventBusService,
@@ -337,6 +381,10 @@ async function bootManual(opts) {
     container.register(addon_package_service_1.AddonPackageService, addonPackageService);
     container.register(repl_engine_service_1.ReplEngineService, replEngineService);
     container.register(server_update_service_1.ServerUpdateService, serverUpdateService);
+    container.register(runner_boot_check_1.RunnerBootCheckService, hubRunnerBootCheck);
+    // A runner settling (READY / crashed / failed / refused) re-evaluates a verdict
+    // that still had runners on their way (D877).
+    eventBusService.subscribe({ category: types_1.EventCategory.ProcessStateChanged }, () => hubRunnerBootCheck.noteRunnerChange());
     container.register(topology_emitter_service_1.TopologyEmitterService, topologyEmitterService);
     container.register(post_boot_service_1.PostBootService, postBootService);
     container.register(update_check_scheduler_js_1.UpdateCheckScheduler, updateCheckScheduler);

package/dist/server-root/index.js

@@ -1141,6 +1141,8 @@ var require_dist = __commonJS({
       logTags;
       restartServerFn;
       dataDir;
+      updatePreflightFn;
+      runnerBootCheckFn;
       execNpm;
       ensureNativePrebuildsFn;
       applyClosurePatchesFn;
@@ -1172,6 +1174,8 @@ var require_dist = __commonJS({
         };
         this.restartServerFn = options.restartServer;
         this.dataDir = path6.resolve(options.dataDir);
+        this.updatePreflightFn = options.updatePreflight ?? null;
+        this.runnerBootCheckFn = options.runnerBootCheck ?? (() => void 0);
         this.execNpm = options.execNpm ?? (async (args, opts) => {
           const { stdout } = await execFileAsync("npm", [
             ...args
@@ -1320,7 +1324,12 @@ var require_dist = __commonJS({
           // The other half of the same question. `imageContract` says the shell is
           // BEHIND; this says WHAT the shell is, which is the only thing that can
           // turn that verdict into an instruction the operator can act on.
-          wrapper: this.wrapperIdentity()
+          wrapper: this.wrapperIdentity(),
+          // Planned runners against the process service's states (D877); absent
+          // until the one-shot boot check has run.
+          ...this.runnerBootCheckFn() !== void 0 ? {
+            runners: this.runnerBootCheckFn()
+          } : {}
         };
       }
       // ── Check ─────────────────────────────────────────────────────────────
@@ -1440,6 +1449,21 @@ var require_dist = __commonJS({
           error: null
         };
       }
+      async runPreflight(target) {
+        if (this.updatePreflightFn === null) return [];
+        try {
+          return await this.updatePreflightFn(target);
+        } catch (err) {
+          this.logger.warn("update pre-flight could not run - proceeding without it", {
+            tags: this.logTags,
+            meta: {
+              targetVersion: target,
+              error: err instanceof Error ? err.message : String(err)
+            }
+          });
+          return [];
+        }
+      }
       async applyServerUpdate(input) {
         this.logger.info("root package update requested", {
           tags: this.logTags,
@@ -1477,6 +1501,29 @@ var require_dist = __commonJS({
             return this.refuseUpdate("dev-uploads-missing", target, `Refused: dev-channel version ${target} has no uploaded tarballs on this node (${uploadsDir} is missing). On the hub: \`camstack deploy-server\`. On an agent: \`camstack deploy-server -n <nodeId>\` (or \`--all\`) so the hub can POST /api/server-upload/propagate first.`);
           }
         }
+        const blockers = await this.runPreflight(target);
+        if (blockers.length > 0 && input.acknowledgeRefusals !== true) {
+          const names = blockers.map((b) => b.addonId).join(", ");
+          const remedies = [
+            ...new Set(blockers.map((b) => b.remedy))
+          ].join(" ");
+          const refused = this.refuseUpdate("addon-would-refuse", target, `Refused: ${this.spec.packageName}@${target} would refuse to start ${blockers.length} addon(s) on this node's data: ${names}. ${remedies} Then retry, or pass acknowledgeRefusals to apply anyway (those addons will stay down).`);
+          return {
+            ...refused,
+            blockers: [
+              ...blockers
+            ]
+          };
+        }
+        if (blockers.length > 0) {
+          this.logger.warn("root package update applied over acknowledged addon refusals", {
+            tags: this.logTags,
+            meta: {
+              targetVersion: target,
+              addonIds: blockers.map((b) => b.addonId)
+            }
+          });
+        }
         this.inFlight = "staging";
         let stagingPath;
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.588",
+  "version": "1.2.589",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.432",
-    "@camstack/addon-agent-ui": "1.2.239",
+    "@camstack/addon-admin-ui": "1.2.433",
+    "@camstack/addon-agent-ui": "1.2.240",
     "@camstack/addon-auth": "1.2.148",
     "@camstack/addon-decoder-nodeav": "1.2.123",
     "@camstack/addon-notifiers": "1.2.135",
     "@camstack/addon-pipeline": "1.2.374",
     "@camstack/addon-pipeline-orchestrator": "1.2.329",
-    "@camstack/addon-post-analysis": "1.2.372",
+    "@camstack/addon-post-analysis": "1.2.373",
     "@camstack/develop": "0.1.11",
     "@camstack/sdk": "1.2.132",
-    "@camstack/system": "1.2.441",
-    "@camstack/types": "1.2.377",
-    "@camstack/ui-library": "1.2.295",
+    "@camstack/system": "1.2.442",
+    "@camstack/types": "1.2.378",
+    "@camstack/ui-library": "1.2.296",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",