@camstack/server 1.2.606 → 1.2.607

package/dist/api/core/cap-providers.js

@@ -719,6 +719,28 @@ function buildNodesProvider(agentRegistry, moleculer, addonRegistry, getNodeRoot
 function ownerSecrets(ar, owner) {
     return typeof ar.secretsForOwner === 'function' ? ar.secretsForOwner(owner) : null;
 }
+/**
+ * The integration settings keys the addon's own form stores in the keychain
+ * (by schema type, D783) — so the admin read can withhold a plaintext under one
+ * of them. Empty when the schema cannot be read (logged): markers are still
+ * withheld, and a coerced marker is caught without a schema.
+ */
+async function integrationSecretKeys(ar, addonId, logger) {
+    try {
+        const provider = ar
+            .getCapabilityRegistry()
+            .getSingleton('addon-settings');
+        const schema = await provider?.getGlobalSettings({ addonId, nodeId: 'hub' });
+        return (0, types_1.collectKeychainStoredKeys)(schema ?? null);
+    }
+    catch (err) {
+        logger.warn('integration settings: addon schema unreadable — plaintext secrets not detectable', {
+            tags: { addonId },
+            meta: { phase: 'getSettings', error: (0, types_1.errMsg)(err) },
+        });
+        return new Set();
+    }
+}
 function requireIntegrationRegistry(ar) {
     const reg = ar.getIntegrationRegistry();
     if (!reg)
@@ -1143,7 +1165,22 @@ function buildIntegrationsProvider(ar, eb, loggingService, capabilityRegistry) {
             const caller = Reflect.get(input, 'callerAddonId');
             const forOwner = typeof caller === 'string' &&
                 (caller === integration.addonId || ar.runnerIdFor(integration.addonId) === caller);
-            return (0, integration_secrets_1.readIntegrationSettings)({ registry: reg, secrets: forOwner ? ownerSecrets(ar, integration.addonId) : null }, { integrationId: input.id, forOwner });
+            // The schema is asked only for the admin read: the owner reads this at
+            // its own boot, and asking it for its schema then would call back into it.
+            const secretKeys = forOwner
+                ? undefined
+                : await integrationSecretKeys(ar, integration.addonId, logger);
+            return (0, integration_secrets_1.readIntegrationSettings)({ registry: reg, secrets: forOwner ? ownerSecrets(ar, integration.addonId) : null }, {
+                integrationId: input.id,
+                forOwner,
+                ...(secretKeys !== undefined ? { secretKeys } : {}),
+                onSuspectSecret: (suspect) => logger.error(suspect.kind === 'coerced-marker'
+                    ? 'integration secret is "[object Object]" — a keychain marker was coerced to text; the addon is sending it as the credential (repair: scripts/hub/repair-integration-secret-markers.ts, or re-type it)'
+                    : 'integration secret stored as PLAINTEXT under a keychain-declared key — withheld from the form; re-type it to move it into the keychain', {
+                    tags: { integrationId: input.id, addonId: integration.addonId },
+                    meta: { phase: 'getSettings', key: suspect.key, kind: suspect.kind, forOwner },
+                }),
+            });
         },
         setSettings: async (input) => {
             const reg = requireIntegrationRegistry(ar);

package/dist/api/core/integration-secrets.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.COERCED_MARKER_TEXT = void 0;
 exports.writeIntegrationSettings = writeIntegrationSettings;
 exports.readIntegrationSettings = readIntegrationSettings;
 /**
@@ -45,16 +46,36 @@ async function writeIntegrationSettings(deps, input) {
     if (orphaned.length > 0)
         deps.onOrphaned?.(orphaned);
 }
+/** The text `String(...)` makes of an object — a keychain marker some copy coerced. */
+exports.COERCED_MARKER_TEXT = '[object Object]';
+function suspectKind(key, value, secretKeys) {
+    if (value === exports.COERCED_MARKER_TEXT)
+        return 'coerced-marker';
+    if (secretKeys?.has(key) === true && typeof value === 'string' && value.length > 0) {
+        return 'plaintext';
+    }
+    return null;
+}
 async function readIntegrationSettings(deps, input) {
     const stored = await deps.registry.getIntegrationSettings(input.integrationId);
+    const suspects = new Set();
+    for (const [key, value] of Object.entries(stored)) {
+        const kind = suspectKind(key, value, input.secretKeys);
+        if (kind === null)
+            continue;
+        suspects.add(key);
+        input.onSuspectSecret?.({ key, kind });
+    }
     if (input.forOwner) {
         if (deps.secrets === null)
             return stored;
         return (await (0, types_1.resolveSecretMarkers)(stored, deps.secrets)).value;
     }
+    // Anyone but the owner — the admin form — never receives a secret's text:
+    // a marker becomes its "set" view, and so does a suspect plaintext.
     const out = {};
     for (const [key, value] of Object.entries(stored)) {
-        out[key] = (0, types_1.isSecretMarker)(value) ? (0, types_1.toSecretFieldView)(value) : value;
+        out[key] = (0, types_1.isSecretMarker)(value) || suspects.has(key) ? (0, types_1.toSecretFieldView)(value) : value;
     }
     return out;
 }

package/dist/api/core/logs.router.js

@@ -11,7 +11,9 @@ exports.createLogsRouter = createLogsRouter;
  */
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const types_1 = require("@camstack/types");
+const node_crypto_1 = require("node:crypto");
+const system_1 = require("@camstack/system");
+const log_history_js_1 = require("../../core/logging/log-history.js");
 const LogLevelSchema = zod_1.z.enum(['debug', 'info', 'warn', 'error']);
 const LogTagsSchema = zod_1.z.object({
     agentId: zod_1.z.string().optional(),
@@ -39,6 +41,8 @@ const LogTagsSchema = zod_1.z.object({
 });
 /** Wire shape of a log entry — timestamp is serialised to ISO string by tRPC. */
 const LogEntrySchema = zod_1.z.object({
+    /** `<bootId>.<seq>` — identical live and on disk; the client's dedupe key (D898). */
+    id: zod_1.z.string().optional(),
     timestamp: zod_1.z.string(),
     level: zod_1.z.string(),
     scope: zod_1.z.string().optional(),
@@ -53,63 +57,214 @@ const LogEntrySchema = zod_1.z.object({
     meta: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
 });
 const LogEntryArraySchema = zod_1.z.array(LogEntrySchema);
-function createLogsRouter(logging) {
+/** Wire shape of a history page (D898). */
+const LogPageSchema = zod_1.z.object({
+    entries: LogEntryArraySchema,
+    /** Pass back as `before` to load the next OLDER page; null = nothing older. */
+    nextBefore: zod_1.z.string().nullable(),
+    nextAfter: zod_1.z.string().nullable(),
+    /** Bytes the source scanned for this slice — the "N MB scanned" indicator. */
+    scannedBytes: zod_1.z.number().int().nonnegative(),
+    /**
+     * True when the source has nothing older. False with fewer than `limit`
+     * entries = the slice's time budget ran out first; ask again with
+     * `nextBefore` to keep searching.
+     */
+    done: zod_1.z.boolean(),
+    cancelled: zod_1.z.boolean().optional(),
+    /** The source that answered — `ring` when the requested one cannot read. */
+    source: zod_1.z.string(),
+});
+const LogSourceSchema = zod_1.z.object({
+    addonId: zod_1.z.string(),
+    readable: zod_1.z.boolean(),
+    reason: zod_1.z.string().nullable(),
+    isDefault: zod_1.z.boolean(),
+    retentionDays: zod_1.z.number().nullable(),
+    filters: zod_1.z.object({
+        deviceId: zod_1.z.boolean(),
+        addonId: zod_1.z.boolean(),
+        nodeId: zod_1.z.boolean(),
+        tags: zod_1.z.boolean(),
+        level: zod_1.z.boolean(),
+        text: zod_1.z.boolean(),
+        timeRange: zod_1.z.boolean(),
+    }),
+});
+/** `tags` (the LogStream scope) → the read contract's indexed fields + the rest. */
+function readFiltersFromTags(tags) {
+    if (tags === undefined)
+        return {};
+    const rest = {};
+    let deviceId;
+    let addonId;
+    let nodeId;
+    for (const [key, raw] of Object.entries(tags)) {
+        if (raw === undefined)
+            continue;
+        if (key === 'deviceId') {
+            const n = typeof raw === 'number' ? raw : Number(raw);
+            if (Number.isInteger(n))
+                deviceId = n;
+            continue;
+        }
+        if (key === 'addonId' && typeof raw === 'string') {
+            addonId = raw;
+            continue;
+        }
+        if (key === 'agentId' && typeof raw === 'string') {
+            nodeId = raw;
+            continue;
+        }
+        if (key === 'containerDeviceId') {
+            const n = typeof raw === 'number' ? raw : Number(raw);
+            rest[key] = Number.isInteger(n) ? n : String(raw);
+            continue;
+        }
+        rest[key] = raw;
+    }
+    return {
+        ...(deviceId !== undefined ? { deviceId } : {}),
+        ...(addonId !== undefined ? { fromAddonId: addonId } : {}),
+        ...(nodeId !== undefined ? { fromNodeId: nodeId } : {}),
+        ...(Object.keys(rest).length > 0 ? { tags: rest } : {}),
+    };
+}
+function toWire(entry) {
+    return {
+        ...(entry.id !== undefined ? { id: entry.id } : {}),
+        timestamp: new Date(entry.timestamp).toISOString(),
+        level: entry.level,
+        ...(entry.scope !== undefined ? { scope: entry.scope } : {}),
+        message: entry.message,
+        ...(entry.tags !== undefined
+            ? {
+                tags: Object.fromEntries(Object.entries(entry.tags).map(([k, v]) => [k, String(v)])),
+            }
+            : {}),
+        ...(entry.meta !== undefined ? { meta: entry.meta } : {}),
+    };
+}
+/** Hub-local providers only: an agent's own files hold lines the hub already has. */
+function hubLocalDestinations(registry) {
+    if (registry === null)
+        return [];
+    return registry
+        .getCollectionEntries('log-destination')
+        .filter(([addonId]) => !addonId.includes('@'));
+}
+const NOT_READABLE = {
+    readable: false,
+    reason: 'This destination only ships lines',
+    retentionDays: null,
+    filters: {
+        deviceId: false,
+        addonId: false,
+        nodeId: false,
+        tags: false,
+        level: false,
+        text: false,
+        timeRange: false,
+    },
+};
+function createLogsRouter(logging, capabilityRegistry = null) {
     return (0, trpc_middleware_js_1.trpcRouter)({
+        /**
+         * One page of history (D898): newest first, from the source the client
+         * picked (default the hub's rotated files), every filter applied by the
+         * source BEFORE the limit. Page older with `before: nextBefore`. A slice
+         * is time-bounded — `done: false` with a short page means "still
+         * searching", and aborting the request cancels the slice in flight.
+         */
         query: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({
+            /** A read-capable log-destination addonId, or `ring`. Default `winston-logging`. */
+            source: zod_1.z.string().min(1).max(200).optional(),
             level: LogLevelSchema.optional(),
             since: zod_1.z.number().optional(),
             until: zod_1.z.number().optional(),
-            limit: zod_1.z.number().optional(),
+            limit: zod_1.z.number().int().min(1).max(1000).optional(),
             tags: LogTagsSchema.optional(),
+            /** Case-insensitive substring over message, scope, tags and meta. */
+            text: zod_1.z.string().max(200).optional(),
+            before: zod_1.z.string().min(1).max(1024).optional(),
+            after: zod_1.z.string().min(1).max(1024).optional(),
+            budgetMs: zod_1.z.number().int().min(50).max(10_000).optional(),
         }))
-            .output(LogEntryArraySchema)
-            .query(({ input, ctx }) => {
-            const filter = { limit: input.limit ?? 100 };
-            if (input.level)
-                filter.level = input.level;
-            if (input.since !== undefined)
-                filter.since = new Date(input.since);
-            if (input.until !== undefined)
-                filter.until = new Date(input.until);
-            if (input.tags)
-                filter.tags = input.tags;
-            const entries = logging.query(filter);
-            const filtered = (() => {
-                if (!ctx.user.isAdmin) {
-                    const ap = ctx.user.permissions?.allowedProviders;
-                    if (ap && ap !== '*') {
-                        const allowed = ap;
-                        return entries.filter((e) => {
-                            const addonId = e.tags?.addonId;
-                            if (typeof addonId !== 'string')
-                                return false;
-                            return allowed.some((p) => {
-                                const bare = (0, types_1.bareAddonId)(p);
-                                return addonId === bare || addonId.startsWith(bare);
-                            });
-                        });
-                    }
+            .output(LogPageSchema)
+            .query(async ({ input, signal }) => {
+            const sourceId = input.source ?? log_history_js_1.DEFAULT_LOG_SOURCE;
+            const provider = sourceId === log_history_js_1.RING_LOG_SOURCE
+                ? null
+                : (hubLocalDestinations(capabilityRegistry).find(([id]) => id === sourceId)?.[1] ??
+                    null);
+            const requestId = (0, node_crypto_1.randomUUID)();
+            const text = input.text?.trim();
+            const query = {
+                requestId,
+                ...readFiltersFromTags(input.tags),
+                ...(input.level !== undefined ? { level: input.level } : {}),
+                ...(text !== undefined && text.length > 0 ? { text } : {}),
+                ...(input.since !== undefined ? { since: input.since } : {}),
+                ...(input.until !== undefined ? { until: input.until } : {}),
+                ...(input.before !== undefined ? { before: input.before } : {}),
+                ...(input.after !== undefined ? { after: input.after } : {}),
+                ...(input.budgetMs !== undefined ? { budgetMs: input.budgetMs } : {}),
+                limit: input.limit ?? log_history_js_1.DEFAULT_PAGE_LIMIT,
+            };
+            const onAbort = () => {
+                void provider?.cancelRead?.({ requestId }).catch(() => undefined);
+            };
+            signal?.addEventListener('abort', onAbort, { once: true });
+            try {
+                const page = await (0, log_history_js_1.readLogHistory)({
+                    query,
+                    source: sourceId,
+                    tail: logging.query({}),
+                    provider,
+                });
+                return {
+                    entries: page.entries.map(toWire),
+                    nextBefore: page.nextBefore,
+                    nextAfter: page.nextAfter,
+                    scannedBytes: page.scannedBytes,
+                    done: page.done,
+                    ...(page.cancelled !== undefined ? { cancelled: page.cancelled } : {}),
+                    source: page.source,
+                };
+            }
+            finally {
+                signal?.removeEventListener('abort', onAbort);
+            }
+        }),
+        /**
+         * The history sources the Logs page can offer: every hub-local
+         * log-destination with what it can read. A destination without
+         * `describeRead` is listed as not readable, never omitted — "ships only"
+         * is an answer, "not installed" is a different one.
+         */
+        sources: trpc_middleware_js_1.adminProcedure.output(zod_1.z.array(LogSourceSchema)).query(async () => {
+            const out = [];
+            for (const [addonId, dest] of hubLocalDestinations(capabilityRegistry)) {
+                const isDefault = addonId === log_history_js_1.DEFAULT_LOG_SOURCE;
+                if (dest.describeRead === undefined) {
+                    out.push({ addonId, isDefault, ...NOT_READABLE });
+                    continue;
+                }
+                try {
+                    const caps = await dest.describeRead();
+                    out.push({ addonId, isDefault, ...caps });
                 }
-                return entries;
-            })();
-            return filtered.map((e) => ({
-                timestamp: e.timestamp instanceof Date ? e.timestamp.toISOString() : String(e.timestamp),
-                level: e.level,
-                ...(e.scope !== undefined ? { scope: e.scope } : {}),
-                message: e.message,
-                // Tags carry mixed primitive types (numeric deviceId is common —
-                // see kernel/capability-registry.ts logging calls). The wire
-                // schema is Record<string,string>, so stringify here. Mirrors
-                // the same normalisation applied in `subscribe` below.
-                tags: e.tags
-                    ? Object.fromEntries(Object.entries(e.tags).map(([k, v]) => [
-                        k,
-                        v === undefined ? undefined : String(v),
-                    ]))
-                    : undefined,
-                ...(e.meta !== undefined ? { meta: e.meta } : {}),
-            }));
+                catch (error) {
+                    out.push({
+                        addonId,
+                        isDefault,
+                        ...NOT_READABLE,
+                        reason: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+            return out;
         }),
         /**
          * Drop matching entries from the in-memory ring buffer. Powers
@@ -149,13 +304,27 @@ function createLogsRouter(logging) {
             .input(zod_1.z.object({
             level: LogLevelSchema.optional(),
             tags: LogTagsSchema.optional(),
+            /** Same text filter as `query`, applied before the push (D898). */
+            text: zod_1.z.string().max(200).optional(),
         }))
             .subscription(({ input }) => {
+            const needle = input.text?.trim().toLowerCase() ?? '';
             return (0, trpc_middleware_js_1.iterableSubscription)((push) => {
                 return logging.subscribe({
                     level: input.level,
                     tags: input.tags,
                 }, (entry) => {
+                    if (needle.length > 0 &&
+                        !(0, system_1.lineContainsText)({
+                            timestamp: 0,
+                            level: entry.level,
+                            message: entry.message,
+                            scope: entry.scope,
+                            tags: entry.tags,
+                            meta: entry.meta,
+                        }, needle)) {
+                        return;
+                    }
                     const stringifiedTags = entry.tags
                         ? Object.fromEntries(Object.entries(entry.tags).map(([k, v]) => [
                             k,
@@ -163,6 +332,7 @@ function createLogsRouter(logging) {
                         ]))
                         : undefined;
                     push({
+                        ...(entry.id !== undefined ? { id: entry.id } : {}),
                         timestamp: entry.timestamp instanceof Date
                             ? entry.timestamp.toISOString()
                             : String(entry.timestamp),

package/dist/api/trpc/generated-cap-routers.js

@@ -2959,6 +2959,16 @@ function createCapRouter_deviceHistory(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.queryNode(methodInput);
         }),
+        queryMany: trpc_middleware_js_1.adminProcedure
+            .input(types_50.deviceHistoryCapability.methods.queryMany.input.loose())
+            .output(types_50.deviceHistoryCapability.methods.queryMany.output)
+            .query(async ({ input, ctx }) => {
+            const parsedInput = ctx.req !== undefined ? (0, types_3.withoutCallerStamp)(input) : input;
+            const { nodeId, ...methodInput } = parsedInput;
+            const p = resolveProvider('device-history', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.queryMany(methodInput);
+        }),
         declareSeries: trpc_middleware_js_1.adminProcedure
             .input(types_50.deviceHistoryCapability.methods.declareSeries.input.loose())
             .output(types_50.deviceHistoryCapability.methods.declareSeries.output)
@@ -5760,14 +5770,51 @@ function createCapRouter_logDestination(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.write(methodInput);
         }),
-        query: trpc_middleware_js_1.adminProcedure
-            .input(types_75.logDestinationCapability.methods.query.input.loose())
-            .output(types_75.logDestinationCapability.methods.query.output)
+        describeRead: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().optional(), addonId: zod_1.z.string().optional() }).optional())
+            .output(types_75.logDestinationCapability.methods.describeRead.output)
             .query(async ({ input, ctx }) => {
+            const p = resolveProvider('log-destination', input?.nodeId, () => getProvider(ctx, input?.addonId), createRemoteProxy);
+            const fn = p.describeRead;
+            if (typeof fn !== 'function') {
+                throw new server_1.TRPCError({
+                    code: 'NOT_IMPLEMENTED',
+                    message: 'Capability "log-destination" provider does not implement "describeRead"',
+                });
+            }
+            return fn.call(p);
+        }),
+        read: trpc_middleware_js_1.adminProcedure
+            .input(types_75.logDestinationCapability.methods.read.input.loose())
+            .output(types_75.logDestinationCapability.methods.read.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, addonId, ...methodInput } = input;
+            const p = resolveProvider('log-destination', nodeId, () => getProvider(ctx, addonId), createRemoteProxy);
+            const fn = p.read;
+            if (typeof fn !== 'function') {
+                throw new server_1.TRPCError({
+                    code: 'NOT_IMPLEMENTED',
+                    message: 'Capability "log-destination" provider does not implement "read"',
+                });
+            }
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return fn.call(p, methodInput);
+        }),
+        cancelRead: trpc_middleware_js_1.adminProcedure
+            .input(types_75.logDestinationCapability.methods.cancelRead.input.loose())
+            .output(types_75.logDestinationCapability.methods.cancelRead.output)
+            .mutation(async ({ input, ctx }) => {
             const { nodeId, addonId, ...methodInput } = input;
             const p = resolveProvider('log-destination', nodeId, () => getProvider(ctx, addonId), createRemoteProxy);
+            const fn = p.cancelRead;
+            if (typeof fn !== 'function') {
+                throw new server_1.TRPCError({
+                    code: 'NOT_IMPLEMENTED',
+                    message: 'Capability "log-destination" provider does not implement "cancelRead"',
+                });
+            }
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.query(methodInput);
+            return fn.call(p, methodInput);
         }),
     });
 }

package/dist/api/trpc/trpc.router.js

@@ -331,7 +331,7 @@ function buildCapabilityRouters(services) {
         repl: (0, repl_router_js_1.createReplRouter)(services.replEngine),
         systemEvents: (0, system_events_router_js_1.createSystemEventsRouter)(services.eventBus),
         capabilities: (0, capabilities_router_js_1.createCapabilitiesRouter)(services.capabilityRegistry, services.configService),
-        logs: (0, logs_router_js_1.createLogsRouter)(services.loggingService),
+        logs: (0, logs_router_js_1.createLogsRouter)(services.loggingService, services.capabilityRegistry),
         live: (0, live_events_router_js_1.createLiveEventsRouter)(services.eventBus, services.addonRegistry),
         // stream-probe — fixed core API (ffprobe wrapper), not a cap.
         streamProbe: (0, stream_probe_router_js_1.createStreamProbeRouter)(services.streamProbe),

package/dist/core/logging/log-history.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PAGE_LIMIT = exports.RING_LOG_SOURCE = exports.DEFAULT_LOG_SOURCE = void 0;
+exports.readLogHistory = readLogHistory;
+/**
+ * `logs.query` — one page of history from the source the operator picked,
+ * merged with the hub's in-memory tail (D898).
+ *
+ * The tail is short (a couple of thousand lines) and exists for two things:
+ * the boot replay into destinations that register late, and the lines a file
+ * destination has accepted but not yet flushed. Everything older comes from
+ * the source. Both carry the same `id`, so the merge dedupes exactly.
+ */
+const system_1 = require("@camstack/system");
+/** The default history source: the hub's rotated files. */
+exports.DEFAULT_LOG_SOURCE = 'winston-logging';
+/** The in-memory tail, addressed as a source when no destination can read. */
+exports.RING_LOG_SOURCE = 'ring';
+exports.DEFAULT_PAGE_LIMIT = 200;
+function toReadable(entry) {
+    return {
+        timestamp: entryTime(entry),
+        level: entry.level,
+        message: entry.message,
+        scope: entry.scope,
+        tags: entry.tags,
+        meta: entry.meta,
+    };
+}
+function entryTime(entry) {
+    const ts = entry.timestamp;
+    if (ts instanceof Date)
+        return ts.getTime();
+    if (typeof ts === 'number')
+        return ts;
+    if (typeof ts === 'string')
+        return Date.parse(ts);
+    return 0;
+}
+function toReadEntry(entry) {
+    const tags = {};
+    for (const [key, value] of Object.entries(entry.tags ?? {})) {
+        if (typeof value === 'string' || typeof value === 'number')
+            tags[key] = value;
+    }
+    const level = entry.level;
+    return {
+        ...(entry.id !== undefined ? { id: entry.id } : {}),
+        timestamp: entryTime(entry),
+        level,
+        ...(entry.scope !== undefined ? { scope: entry.scope } : {}),
+        message: entry.message,
+        ...(Object.keys(tags).length > 0 ? { tags } : {}),
+        ...(entry.meta !== undefined ? { meta: entry.meta } : {}),
+    };
+}
+function tailMatching(tail, filter, limit) {
+    const out = [];
+    for (const entry of tail) {
+        if (!(0, system_1.lineMatches)(toReadable(entry), filter))
+            continue;
+        out.push(toReadEntry(entry));
+        if (out.length >= limit)
+            break;
+    }
+    return out;
+}
+function entryKey(entry) {
+    return (entry.id ?? `${String(entry.timestamp)}|${entry.level}|${entry.scope ?? ''}|${entry.message}`);
+}
+/**
+ * The first page (no cursor) merges the tail; a cursor page is the source's
+ * alone — the tail only ever holds the NEWEST lines, which the first page
+ * already showed.
+ */
+async function readLogHistory(args) {
+    const { query, tail, provider } = args;
+    const limit = query.limit ?? exports.DEFAULT_PAGE_LIMIT;
+    const filter = (0, system_1.compileLogFilter)(query);
+    const isFirstPage = query.before === undefined && query.after === undefined;
+    if (provider === null || provider.read === undefined) {
+        if (!isFirstPage) {
+            return {
+                entries: [],
+                nextBefore: null,
+                nextAfter: null,
+                scannedBytes: 0,
+                done: true,
+                source: exports.RING_LOG_SOURCE,
+            };
+        }
+        return {
+            entries: tailMatching(tail, filter, limit),
+            nextBefore: null,
+            nextAfter: null,
+            scannedBytes: 0,
+            done: true,
+            source: exports.RING_LOG_SOURCE,
+        };
+    }
+    const page = await provider.read({ ...query, limit });
+    if (!isFirstPage)
+        return { ...page, source: args.source };
+    // Tail lines newer than the oldest line the source returned (or all of them
+    // when the source returned nothing yet): the unflushed lines, and the levels
+    // the file destination does not keep.
+    const oldest = page.entries.at(-1)?.timestamp ?? Number.NEGATIVE_INFINITY;
+    const byKey = new Map();
+    for (const entry of page.entries)
+        byKey.set(entryKey(entry), entry);
+    for (const entry of tailMatching(tail, filter, limit)) {
+        if (entry.timestamp < oldest)
+            continue;
+        if (!byKey.has(entryKey(entry)))
+            byKey.set(entryKey(entry), entry);
+    }
+    const entries = [...byKey.values()].toSorted((a, b) => b.timestamp - a.timestamp);
+    return { ...page, entries, source: args.source };
+}

package/dist/core/logging/logging.service.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoggingService = void 0;
+exports.LoggingService = exports.HUB_LOG_TAIL_ENTRIES = exports.HISTORY_DESTINATION_ADDON_ID = void 0;
 const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
 /** Baseline tags every hub-local logger gets, so console output never
@@ -13,6 +13,19 @@ const types_1 = require("@camstack/types");
  *  forked workers via `$hub.log` carry their own `tags.pid` which
  *  wins over this baseline (right-biased merge in `writeFromWorker`). */
 const HUB_BASELINE_TAGS = { agentId: 'hub', nodeId: 'hub', pid: process.pid };
+/**
+ * The destination whose files ARE the hub's log history (D898). Once it has
+ * registered — and received the boot replay — the in-memory buffer only has
+ * to hold a short tail: the instant first page and the lines the file stream
+ * has accepted but not yet flushed.
+ */
+exports.HISTORY_DESTINATION_ADDON_ID = 'winston-logging';
+/**
+ * The tail, in entries, across every addon. ~2k lines is tens of seconds of a
+ * busy hub — enough for the first page and the unflushed window, ~0.6 MB.
+ * `eventBus.logTailSize` overrides it.
+ */
+exports.HUB_LOG_TAIL_ENTRIES = 2000;
 class LoggingService extends system_1.LogManager {
     /**
      * Device-name cache consulted by the formatter when a log line
@@ -21,6 +34,9 @@ class LoggingService extends system_1.LogManager {
      * updated / removed events. Missing entries fall back to `#<id>`.
      */
     deviceNames = new Map();
+    /** Tail size applied once the history destination registers. */
+    tailEntries;
+    shrunkToTail = false;
     constructor(configService) {
         // The log buffer is now partitioned per addonId (see PartitionedLogBuffer):
         // this value caps EACH addon's bucket, not the total. A chatty addon evicts
@@ -39,12 +55,33 @@ class LoggingService extends system_1.LogManager {
         // Only entries at or below this level are ever discarded to meet the total.
         const pruneLevel = configService.get('eventBus.logBufferPruneLevel') ?? 'debug';
         super(perAddonCapacity, { maxTotalEntries, pruneLevel });
+        this.tailEntries = configService.get('eventBus.logTailSize') ?? exports.HUB_LOG_TAIL_ENTRIES;
         // Enriches every emitted LogEntry with `tags.deviceName` before
         // destinations / subscribers see it — works across bundled copies
         // of `@camstack/system` (addon packages) because the mutation
         // happens upstream of their formatters.
         this.setDeviceNameLookup((id) => this.deviceNames.get(id) ?? null);
     }
+    /**
+     * Adds the destination, and — the first time the HISTORY destination
+     * arrives — shrinks the buffer to the tail AFTER its boot replay, so the
+     * files start with the first boot line however long the boot was.
+     *
+     * The tail prunes `info` and below first (the lines are on disk); a live
+     * addon's `warn`/`error` still outlive them, and whole idle buckets go
+     * last, exactly as the buffer's own policy says.
+     */
+    addDestination(dest, opts = {}) {
+        super.addDestination(dest, opts);
+        if (!this.shrunkToTail && opts.addonId === exports.HISTORY_DESTINATION_ADDON_ID) {
+            this.shrunkToTail = true;
+            this.reconfigureBuffer({
+                perAddonCapacity: this.tailEntries,
+                maxTotalEntries: this.tailEntries,
+                pruneLevel: 'info',
+            });
+        }
+    }
     /** Bulk-refresh from device-manager snapshot. Replaces every entry. */
     setDeviceNames(entries) {
         this.deviceNames.clear();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.606",
+  "version": "1.2.607",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.442",
-    "@camstack/addon-agent-ui": "1.2.248",
-    "@camstack/addon-auth": "1.2.153",
-    "@camstack/addon-decoder-nodeav": "1.2.127",
-    "@camstack/addon-notifiers": "1.2.605",
-    "@camstack/addon-pipeline": "1.2.605",
-    "@camstack/addon-pipeline-orchestrator": "1.2.606",
-    "@camstack/addon-post-analysis": "1.2.611",
-    "@camstack/develop": "0.1.17",
-    "@camstack/sdk": "1.2.137",
-    "@camstack/system": "1.2.456",
-    "@camstack/types": "1.2.387",
-    "@camstack/ui-library": "1.2.304",
+    "@camstack/addon-admin-ui": "1.2.443",
+    "@camstack/addon-agent-ui": "1.2.249",
+    "@camstack/addon-auth": "1.2.154",
+    "@camstack/addon-decoder-nodeav": "1.2.128",
+    "@camstack/addon-notifiers": "1.2.606",
+    "@camstack/addon-pipeline": "1.2.606",
+    "@camstack/addon-pipeline-orchestrator": "1.2.607",
+    "@camstack/addon-post-analysis": "1.2.612",
+    "@camstack/develop": "0.1.18",
+    "@camstack/sdk": "1.2.138",
+    "@camstack/system": "1.2.457",
+    "@camstack/types": "1.2.388",
+    "@camstack/ui-library": "1.2.305",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",