@camstack/server 1.2.629 → 1.2.631

package/THIRD_PARTY_MODELS.md

@@ -9,7 +9,7 @@
   The package copies (packages/addon-pipeline, packages/addon-post-analysis, packages/addon-ai, packages/addon-model-studio, server/backend) are byte-identical
   (npm cannot ship a file from outside the package); the Hugging Face mirror receives
   the same file from hf/camstack-models/upload.sh. Drift fails CI.
-  Facts: docs/superpowers/specs/2026-09-26-model-license-compliance.md. Not legal advice.
+  Facts: planning repo superpowers/specs/2026-09-26-model-license-compliance.md. Not legal advice.
 -->
 
 # Third-party models

package/dist/agent/agent-http.js

@@ -69,6 +69,7 @@ const derive_hub_url_js_1 = require("./derive-hub-url.js");
 Object.defineProperty(exports, "pickIpv4", { enumerable: true, get: function () { return derive_hub_url_js_1.pickIpv4; } });
 const agent_addon_runtime_js_1 = require("./agent-addon-runtime.js");
 const hubs_found_js_1 = require("./hubs-found.js");
+const release_identity_js_1 = require("../core/release-identity.js");
 /** The pinned CA's fingerprint, or `null` when none is pinned or the PEM cannot be read. */
 function describePairedHub(pinnedCa, hubHttpsOrigin) {
     if (pinnedCa === null)
@@ -408,6 +409,10 @@ async function createAgentHttpServer(getBroker, config) {
         // Version of the Electron wrapper (injected by the desktop app); absent
         // when the agent runs headless / in Docker.
         const appVersion = process.env['CAMSTACK_AGENT_APP_VERSION'] ?? null;
+        const identity = (0, release_identity_js_1.releaseIdentityFrom)({
+            productVersionEnv: process.env[release_identity_js_1.PRODUCT_VERSION_ENV],
+            serverVersion: config.serverVersion ?? null,
+        });
         const discoveredNodes = mapDiscoveredNodes(nodes, broker.nodeID);
         // The hub this agent is paired with, for the agent UI's "Paired with" card (D857).
         const pairedHub = describePairedHub((0, agent_pairing_store_js_1.pinnedMeshCaCert)(config.configPath), hubHttpsOrigin);
@@ -420,6 +425,8 @@ async function createAgentHttpServer(getBroker, config) {
                 resolvedHubAddress,
                 hubHttpsOrigin,
                 appVersion,
+                productVersion: identity.productVersion,
+                serverVersion: identity.serverVersion,
                 hubConnected,
                 hubConnectionState,
                 paired: eff.paired,
@@ -436,6 +443,8 @@ async function createAgentHttpServer(getBroker, config) {
                 resolvedHubAddress,
                 hubHttpsOrigin,
                 appVersion,
+                productVersion: identity.productVersion,
+                serverVersion: identity.serverVersion,
                 hubConnected,
                 hubConnectionState,
                 paired: eff.paired,

package/dist/agent/agent-hub-addon-update.js

@@ -28,7 +28,7 @@ exports.createAgentHubAddonControls = createAgentHubAddonControls;
  * (`remote-addon-update-grant.ts`): own node, the hub's recorded version, audited.
  * Any refusal reaches the UI verbatim as the update's failure, never as silence.
  */
-const index_js_1 = require("../server-root/index.js");
+const system_1 = require("@camstack/system");
 /** Hub procedures this module calls, as `$core-caps` actions. */
 exports.HUB_ADDON_LIST_ACTION = '$core-caps.addons.list';
 exports.HUB_ADDON_UPDATE_ACTION = '$core-caps.addons.updatePackage';
@@ -57,9 +57,15 @@ function hubVersionsFromList(list) {
     }
     return out;
 }
-/** True when the hub's version is strictly newer than this node's. */
+/**
+ * True when this node does not run the hub's version, in either direction.
+ * Unknown on either side is not a difference — an unreadable hub is not a
+ * reason to offer a move (D942, D49).
+ */
 function isBehindHub(installed, hub) {
-    return installed !== null && hub !== null && (0, index_js_1.compareSemver)(hub, installed) > 0;
+    if (installed === null || hub === null)
+        return false;
+    return (0, system_1.decideAddonVersionMove)(installed, hub, system_1.ADDON_VERSION_REASON_HUB).move;
 }
 /** The hub answered `{ success: false, error }`, or something unreadable. */
 function failureOf(result) {

package/dist/agent/main.js

@@ -947,6 +947,7 @@ async function startAgent(configPath) {
         getHubConnectionState,
         getMeshTransport: () => (currentMeshTls !== null ? 'tls' : 'clear'),
         updateControls,
+        serverVersion: agentUpdateService.getRunningRootPackage().version,
     }).then((listener) => {
         agentHttpListener = listener;
     });

package/dist/api/health/health.routes.js

@@ -23,6 +23,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildHubHealth = buildHubHealth;
 exports.isAuthorizedHealthRequest = isAuthorizedHealthRequest;
 exports.registerHealthRoutes = registerHealthRoutes;
+const release_identity_js_1 = require("../../core/release-identity.js");
 const runner_boot_check_js_1 = require("../../core/runner-health/runner-boot-check.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const AGENT_HEALTH_TIMEOUT_MS = 3_000;
@@ -115,6 +116,14 @@ function registerHealthRoutes(fastify, deps) {
             : {}),
         ...(typeof req.headers.cookie === 'string' ? { cookie: req.headers.cookie } : {}),
     }, deps.verifyToken);
+    // PUBLIC versions only — the login footer and the sidebar. Not topology:
+    // `/health` stays liveness-only for that reason.
+    fastify.get('/api/release-identity', async () => {
+        return (0, release_identity_js_1.releaseIdentityFrom)({
+            productVersionEnv: deps.productVersion ?? undefined,
+            serverVersion: deps.hubVersion,
+        });
+    });
     // PUBLIC probe: liveness only. Everything beyond `ok` (version, uptime,
     // pid, agent topology) moved to the AUTHENTICATED /health/details — a
     // public endpoint must not enumerate the deployment.

package/dist/core/addon/addon-package.service.js

@@ -690,14 +690,14 @@ class AddonPackageService {
                 });
                 return;
             }
-            const latestVersion = lookup.latestVersion;
-            if (latestVersion === null || !isVersionNewer(latestVersion, version))
+            const decision = (0, system_1.decideAddonVersionMove)(version, lookup.latestVersion, system_1.ADDON_VERSION_REASON_REGISTRY_LATEST);
+            if (!decision.move)
                 return;
             const category = this.categorize(name);
             updates.push({
                 name,
                 currentVersion: version,
-                latestVersion,
+                latestVersion: decision.to,
                 category,
                 requiresRestart: category === 'core',
             });
@@ -1465,10 +1465,10 @@ class AddonPackageService {
      * `applyServerUpdate` (single-copy collapse), so a swept framework target is
      * skipped by the engine.
      *
-     * Candidate selection (channel resolution + npm metadata fetch + "is there a
-     * newer version?" comparison) is unchanged from the previous per-item loop;
-     * only the EXECUTION moved from sequential `updatePackage` calls to a single
-     * `startJob`.
+     * Candidate selection resolves dist-tag `latest` (or `beta` on that channel)
+     * and moves when the installed version DIFFERS — higher or lower (D942).
+     * A registry read that fails leaves that package alone. Execution is one
+     * `startJob`, not a per-package `updatePackage`.
      */
     async runAutoUpdate() {
         this.logger.info('Running auto-update check...');
@@ -1496,36 +1496,38 @@ class AddonPackageService {
                 const response = await fetch(url, {
                     signal: AbortSignal.timeout(AddonPackageService.REGISTRY_TIMEOUT_MS),
                 });
-                if (!response.ok)
+                if (!response.ok) {
+                    this.logger.warn('Auto-update left package unchanged — registry unreadable', {
+                        meta: { name: pkg.name, status: response.status },
+                    });
                     continue;
+                }
                 const data = await fetchJsonObject(response);
                 const distTags = asRecord(data['dist-tags']);
                 // Determine target version based on channel
                 const targetVersion = effectiveChannel === 'beta'
                     ? asString(distTags['beta']) || asString(distTags['latest'])
                     : asString(distTags['latest']);
-                // FORWARD-ONLY: update only when the registry advertises a STRICTLY
-                // NEWER semver. The old `!==` comparison happily "updated" BACKWARD —
-                // on 2026-07-22 it replaced same-day CLI-deployed builds (labelled
-                // with the older workspace version) with the freshly published npm
-                // artifacts, rolling back live fixes. A dev build whose label equals
-                // or exceeds the npm tag is left alone.
-                if (!targetVersion || !isVersionNewer(targetVersion, pkg.version))
+                // D942: follow the tag in either direction. An empty tag is an
+                // unreadable authority — leave the installed copy (D49).
+                const followed = (0, system_1.decideAddonVersionMove)(pkg.version, targetVersion ?? null, system_1.ADDON_VERSION_REASON_REGISTRY_LATEST);
+                if (!followed.move)
                     continue;
-                this.logger.info('Auto-update candidate', {
+                this.logger.info('Moving addon to registry latest', {
                     meta: {
                         name: pkg.name,
-                        currentVersion: pkg.version,
-                        targetVersion,
+                        from: followed.from,
+                        to: followed.to,
+                        reason: followed.reason,
                         channel: effectiveChannel,
                     },
                 });
-                targets.push({ name: pkg.name, version: targetVersion });
+                targets.push({ name: pkg.name, version: followed.to });
                 available.push({
                     target: 'addon',
                     packageName: pkg.name,
                     currentVersion: pkg.version,
-                    latestVersion: targetVersion,
+                    latestVersion: followed.to,
                 });
             }
             catch (err) {
@@ -1692,18 +1694,16 @@ class AddonPackageService {
                     });
                     continue;
                 }
-                const latestVersion = lookup.latestVersion;
-                if (!latestVersion)
+                const decision = (0, system_1.decideAddonVersionMove)(version, lookup.latestVersion, system_1.ADDON_VERSION_REASON_REGISTRY_LATEST);
+                if (!decision.move)
                     continue;
-                if (isVersionNewer(latestVersion, version)) {
-                    updates.push({
-                        name,
-                        currentVersion: version,
-                        latestVersion,
-                        category: this.categorize(name),
-                        requiresRestart: this.categorize(name) === 'core',
-                    });
-                }
+                updates.push({
+                    name,
+                    currentVersion: version,
+                    latestVersion: decision.to,
+                    category: this.categorize(name),
+                    requiresRestart: this.categorize(name) === 'core',
+                });
             }
             catch (error) {
                 // The package could not be evaluated at all (unreadable manifest, …).

package/dist/core/agent/agent-addon-backfill.js

@@ -24,11 +24,12 @@
  * both mutations are attributable actions rather than heuristics.
  *
  * THE INTENDED VERSION
- * The hub's own installed version, and only that. Never `latest` — resolving
- * `latest` per node is exactly the silent per-node drift the bootstrap
- * installer already suffers from (`addon-installer.ts` installs unpinned and
- * `ensureRequiredPackages` never re-installs, so whatever `latest` meant at a
- * node's first boot is what that node runs forever).
+ * The hub's own installed version, and only that — including when the node
+ * is AHEAD of the hub (D942). Never npm `latest` directly: the hub follows
+ * the registry, and every node follows the hub. A package the hub's version
+ * map does not name is left as it is when it is already installed, and is
+ * never delivered when it is missing (`notOnHub`). An unreadable hub version
+ * is not a reason to move.
  *
  * A package the hub does NOT install is never delivered, whatever the node last
  * reported. It used to fall back to the node's last-reported version, which
@@ -55,6 +56,20 @@ exports.triggerMayDeliver = triggerMayDeliver;
 exports.computeBackfillPlan = computeBackfillPlan;
 exports.confirmBackfillPlan = confirmBackfillPlan;
 exports.executeBackfill = executeBackfill;
+/**
+ * Why a reconcile is running. Named on every back-fill decision, and an
+ * allowlist: a future caller has to CHOOSE a trigger, and a trigger that must
+ * not deliver bytes is refused here rather than in a comment.
+ *
+ * `node-registration` covers both a first registration and a rejoin — the
+ * distinction is not the discriminator it looks like. The case the back-fill
+ * exists for (a node that lost `<dataDir>/addons` and came back with 4 of 14
+ * packages) presents as a rejoin, so excluding rejoins would delete the only
+ * legitimate purpose. The transient-roster-gap case is excluded by the delivery
+ * ledger and the confirmation read instead, which discriminate on FACTS rather
+ * than on which callback fired.
+ */
+const system_1 = require("@camstack/system");
 /** Triggers permitted to install packages onto a node. */
 const DELIVERING_TRIGGERS = new Set([
     'node-registration',
@@ -70,34 +85,56 @@ function triggerMayDeliver(trigger) {
  * Pure — no I/O, no clock, no randomness.
  */
 function computeBackfillPlan(input) {
-    const liveNames = new Set(input.live.map((p) => p.name));
+    const liveByName = new Map(input.live.map((p) => [p.name, p.version]));
     const targets = [];
     const retired = [];
     const notOnHub = [];
     for (const entry of input.recorded) {
-        if (liveNames.has(entry.name))
-            continue;
         if (input.bootstrap.has(entry.name))
             continue;
         if (input.undeployed.has(entry.name))
             continue;
-        if (input.retired.has(entry.name)) {
-            retired.push(entry.name);
-            continue;
-        }
         const hubVersion = input.hubVersions.get(entry.name);
+        const present = liveByName.has(entry.name);
+        const liveVersion = present ? (liveByName.get(entry.name) ?? null) : null;
         if (hubVersion === undefined) {
-            notOnHub.push(entry.name);
+            if (!present && input.retired.has(entry.name))
+                retired.push(entry.name);
+            else if (!present)
+                notOnHub.push(entry.name);
+            continue;
+        }
+        const decision = (0, system_1.decideAddonVersionMove)(present ? liveVersion : null, hubVersion, system_1.ADDON_VERSION_REASON_HUB);
+        if (!decision.move)
+            continue;
+        if (input.retired.has(entry.name)) {
+            retired.push(entry.name);
             continue;
         }
         targets.push({ name: entry.name, version: hubVersion, versionSource: 'hub-installed' });
     }
-    return { targets, retired, notOnHub, liveCount: liveNames.size };
+    return { targets, retired, notOnHub, liveCount: liveByName.size };
 }
 function confirmBackfillPlan(plan, secondRead) {
-    const present = new Set(secondRead.map((p) => p.name));
-    const targets = plan.targets.filter((t) => !present.has(t.name));
-    const contradicted = plan.targets.filter((t) => present.has(t.name));
+    const seen = new Map(secondRead.map((p) => [p.name, p.version]));
+    const targets = [];
+    const contradicted = [];
+    for (const target of plan.targets) {
+        if (!seen.has(target.name)) {
+            targets.push(target);
+            continue;
+        }
+        const version = seen.get(target.name) ?? null;
+        if (version === target.version) {
+            contradicted.push(target);
+            continue;
+        }
+        if (version === null) {
+            contradicted.push(target);
+            continue;
+        }
+        targets.push(target);
+    }
     return { plan: { ...plan, targets }, contradicted };
 }
 /**

package/dist/core/agent/agent-registry.service.js

@@ -845,7 +845,10 @@ class AgentRegistryService {
         }
         if (outcome.delivered.length > 0) {
             console.log(`[agent-registry] Back-fill ${agentId}: delivered ${outcome.delivered
-                .map((d) => `${d.name}@${d.version} (pin from ${d.versionSource})`)
+                .map((d) => {
+                const from = live.find((p) => p.name === d.name)?.version ?? 'absent';
+                return `${d.name} ${from} → ${d.version} (agent follows the hub installed version)`;
+            })
                 .join(', ')} — trigger=${trigger}, node reported ${plan.liveCount} package(s) and its ` +
                 `declared roster has ${recorded.length}`);
             this.eventBus.emit({
@@ -901,9 +904,9 @@ class AgentRegistryService {
         }
         const { plan: confirmed, contradicted } = (0, agent_addon_backfill_1.confirmBackfillPlan)(plan, rosterFromAddons(secondAddons));
         if (contradicted.length > 0) {
-            console.warn(`[agent-registry] Back-fill ${agentId}: two roster reads DISAGREE — ` +
-                `${contradicted.map((t) => t.name).join(', ')} reported absent then present. ` +
-                `Not installing; the node was mid-reload, not missing packages`);
+            console.warn(`[agent-registry] Back-fill ${agentId}: confirmation read already has ` +
+                `${contradicted.map((t) => `${t.name}@${t.version}`).join(', ')} ` +
+                `(or could not read the version). Not installing over that read`);
         }
         return confirmed;
     }

package/dist/core/release-identity.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * What the About line shows: the product release (image / desktop app) and
+ * the running `@camstack/server` package. They are different lines (D943).
+ *
+ * The product version is declared by the shell — `CAMSTACK_PRODUCT_VERSION`,
+ * set by the image and by the desktop app. A dev workspace leaves it unset;
+ * that is absence, not a failure. The server version is the package this
+ * process loaded.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRODUCT_VERSION_ENV = void 0;
+exports.blankToNull = blankToNull;
+exports.releaseIdentityFrom = releaseIdentityFrom;
+exports.PRODUCT_VERSION_ENV = 'CAMSTACK_PRODUCT_VERSION';
+function blankToNull(value) {
+    const trimmed = value?.trim() ?? '';
+    return trimmed.length > 0 ? trimmed : null;
+}
+function releaseIdentityFrom(input) {
+    return {
+        productVersion: blankToNull(input.productVersionEnv),
+        serverVersion: blankToNull(input.serverVersion ?? undefined),
+    };
+}

package/dist/main.js

@@ -67,6 +67,7 @@ const request_census_settings_1 = require("./api/core/request-census-settings");
 const register_cors_policy_1 = require("./api/cors/register-cors-policy");
 const adaptive_probe_routes_1 = require("./api/health/adaptive-probe.routes");
 const health_routes_1 = require("./api/health/health.routes");
+const release_identity_1 = require("./core/release-identity");
 const runner_boot_check_1 = require("./core/runner-health/runner-boot-check");
 const hub_cluster_url_1 = require("./api/hub-cluster-url");
 const model_distributor_js_1 = require("./api/model-distributor.js");
@@ -731,6 +732,7 @@ async function bootstrap() {
             moleculer,
             agentRegistry: app.get(agent_registry_service_1.AgentRegistryService),
             hubVersion,
+            productVersion: (0, release_identity_1.blankToNull)(process.env[release_identity_1.PRODUCT_VERSION_ENV]),
             // Read the live flag at request time — flips to true once the tRPC
             // router finishes registering (see `trpcRegistered = true` below).
             isReady: () => trpcRegistered,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.629",
+  "version": "1.2.631",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.466",
-    "@camstack/addon-agent-ui": "1.2.266",
+    "@camstack/addon-admin-ui": "1.2.468",
+    "@camstack/addon-agent-ui": "1.2.267",
     "@camstack/addon-auth": "1.2.166",
     "@camstack/addon-benchmark": "1.2.266",
     "@camstack/addon-decoder-nodeav": "1.2.141",
     "@camstack/addon-notifiers": "1.2.619",
-    "@camstack/addon-pipeline": "1.2.624",
+    "@camstack/addon-pipeline": "1.2.625",
     "@camstack/addon-pipeline-orchestrator": "1.2.627",
-    "@camstack/addon-post-analysis": "1.2.633",
-    "@camstack/develop": "0.1.33",
+    "@camstack/addon-post-analysis": "1.2.634",
+    "@camstack/develop": "0.1.34",
     "@camstack/sdk": "1.2.151",
-    "@camstack/system": "1.2.480",
-    "@camstack/types": "1.2.412",
+    "@camstack/system": "1.2.482",
+    "@camstack/types": "1.2.414",
     "@camstack/ui-library": "1.2.323",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",