@camstack/server 1.2.75 → 1.2.77

package/dist/agent/builtins-seed.js

@@ -72,13 +72,18 @@ function seedBuiltinsFromClosure(addonsDir, log = console.log, resolveClosurePkg
         log(`[Agent] builtins seed: closure copy at ${closureRoot} has no dist — cannot self-heal`);
         return 'unavailable';
     }
-    fs.mkdirSync(target, { recursive: true });
-    fs.copyFileSync(closurePkgJson, path.join(target, 'package.json'));
-    fs.cpSync(closureDist, path.join(target, 'dist'), {
-        recursive: true,
-        filter: (src) => !src.split(path.sep).includes('node_modules'),
-    });
+    // The WHOLE package, node_modules included. A deps-free copy was tried
+    // first and failed live (2026-08-08): the builtins' dist requires native
+    // deps (better-sqlite3) that resolve relative to the COPY, so the addon
+    // scan logged "Failed to scan" and the guard aborted with "no addon
+    // under /data/addons" — while the log right above it said the seed had
+    // run. Nested `node_modules` are safe: the scan reads one level of
+    // `addonsDir/@scope/*`, never inside a package. (The double-registration
+    // the deps-free copy was guarding against was actually the per-capability
+    // init loop — fixed by `planInfraBoot` — not nested discovery.)
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.cpSync(closureRoot, target, { recursive: true });
     log(`[Agent] builtins seed: @camstack/system was missing under ${addonsDir} — ` +
-        `seeded package.json + dist from the running closure (${closureRoot})`);
+        `seeded the full package from the running closure (${closureRoot})`);
     return 'seeded';
 }

package/dist/api/core/cap-providers.js

@@ -1000,6 +1000,41 @@ function ensureCustomActionAuth(ctx, level) {
         return;
     }
 }
+/** How many neighbouring names a NOT_FOUND message is willing to spell out. */
+const UNRESOLVED_HINT_LIMIT = 40;
+/**
+ * Explain a `(addonId, action)` that did not resolve, by NAMING what does.
+ *
+ * `addons.custom` keys on the MANIFEST addon id (`camstack.addons[].id`), which
+ * is routinely not the npm package name — `@camstack/addon-post-analysis` ships
+ * `pipeline-analytics` and `embedding-encoder`, and neither is the package. A
+ * bare "has no custom action X" is then indistinguishable from "the addon is
+ * broken", "the deploy did not land" or "the catalog never registered", and the
+ * caller has no way to tell which. That ambiguity cost a session on 2026-08-08:
+ * a working require-cache fix (d0bf802f1) was investigated as the culprit while
+ * the action was reachable the whole time under its real id.
+ *
+ * So the two failures are separated and each names its neighbourhood — the ids
+ * that have actions, or the actions that addon has.
+ */
+function describeUnresolved(registry, input) {
+    const actions = registry.listActions(input.addonId);
+    if (actions.length > 0) {
+        return `addon '${input.addonId}' has no custom action '${input.action}' — known actions: ${formatNames(actions)}`;
+    }
+    return (`no addon '${input.addonId}' registers custom actions ` +
+        `(expected a manifest addon id, not the npm package name) — ` +
+        `addons with custom actions: ${formatNames(registry.listAddons())}`);
+}
+/** Sorted, comma-joined, bounded — a hint must never become a dump. */
+function formatNames(names) {
+    if (names.length === 0)
+        return '(none)';
+    const sorted = [...names].sort();
+    const shown = sorted.slice(0, UNRESOLVED_HINT_LIMIT);
+    const rest = sorted.length - shown.length;
+    return rest > 0 ? `${shown.join(', ')} (+${rest} more)` : shown.join(', ');
+}
 /**
  * Resolve + dispatch a single addon custom action. This is the LIVE dispatch
  * used by the `addons.custom` cap-provider handler below — factored out so it
@@ -1020,10 +1055,7 @@ function ensureCustomActionAuth(ctx, level) {
 async function dispatchCustomAction(registry, ctx, input) {
     const entry = registry.resolve(input.addonId, input.action);
     if (!entry) {
-        throw new server_1.TRPCError({
-            code: 'NOT_FOUND',
-            message: `addon '${input.addonId}' has no custom action '${input.action}'`,
-        });
+        throw new server_1.TRPCError({ code: 'NOT_FOUND', message: describeUnresolved(registry, input) });
     }
     ensureCustomActionAuth(ctx, entry.spec.auth);
     const parsedInput = entry.spec.input.parse(input.input);

package/dist/api/oauth2/consent-page.js

@@ -23,7 +23,9 @@ function renderConsentPage(input) {
   <div class="card">
     <h1>Authorize ${escapeHtml(input.displayName)}</h1>
     <p class="meta">Signed in as <strong>${escapeHtml(input.username)}</strong></p>
-    <p class="meta">This will grant: ${escapeHtml(input.scopeSummary)}</p>
+    <p class="meta">This will grant: ${escapeHtml(input.scopeSummary)}</p>${input.redirectUri
+        ? `\n    <p class="meta">Sending the authorization to <code>${escapeHtml(input.redirectUri)}</code></p>`
+        : ''}
     <form method="POST">
       ${hidden}
       <button class="allow" name="consent" value="allow" type="submit">Allow</button>

package/dist/api/oauth2/oauth2-routes.js

@@ -4,24 +4,70 @@ exports.validateAuthorizeQuery = validateAuthorizeQuery;
 exports.isRedirectUriAllowed = isRedirectUriAllowed;
 exports.summariseScopes = summariseScopes;
 exports.registerOauth2Routes = registerOauth2Routes;
-const consent_page_js_1 = require("./consent-page.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
+const consent_page_js_1 = require("./consent-page.js");
+const private_host_js_1 = require("./private-host.js");
 /** Validate the inbound authorize query. `client_id` is intentionally
- *  NOT checked — that pair is verified only at the Lambda boundary. */
+ *  NOT checked — that pair is verified only at the Lambda boundary, and a
+ *  PUBLIC client (`requiresPkce`) has no secret to check it against at all;
+ *  the S256 challenge is what binds the code to its requester instead. */
 function validateAuthorizeQuery(q, knownIntegrations) {
     if (q.response_type !== 'code')
         return { ok: false, status: 400, error: 'unsupported_response_type' };
-    if (!q.integration || !knownIntegrations.has(q.integration))
+    const policy = q.integration ? knownIntegrations.get(q.integration) : undefined;
+    if (!q.integration || !policy)
         return { ok: false, status: 400, error: 'invalid_request — unknown integration' };
     if (!q.redirect_uri)
         return { ok: false, status: 400, error: 'invalid_request — redirect_uri required' };
     if (!q.state)
         return { ok: false, status: 400, error: 'invalid_request — state required' };
-    return { ok: true, integration: q.integration, redirectUri: q.redirect_uri, state: q.state };
+    const challenge = q.code_challenge ?? '';
+    if (challenge !== '' && q.code_challenge_method !== 'S256') {
+        // `plain` is accepted by the RFC and is worth nothing: the challenge IS
+        // the verifier, so an intercepted authorize request yields both.
+        return { ok: false, status: 400, error: 'invalid_request — code_challenge_method must be S256' };
+    }
+    if (policy.requiresPkce === true && challenge === '') {
+        return { ok: false, status: 400, error: 'invalid_request — code_challenge required (PKCE)' };
+    }
+    return {
+        ok: true,
+        integration: q.integration,
+        redirectUri: q.redirect_uri,
+        state: q.state,
+        codeChallenge: challenge,
+    };
 }
-/** True if `redirectUri` starts with one of the integration's allowed prefixes. */
-function isRedirectUriAllowed(redirectUri, allowedPrefixes) {
-    return allowedPrefixes.some((p) => redirectUri.startsWith(p));
+/**
+ * True if `redirectUri` is one this integration is allowed to receive a code at.
+ *
+ * Two independent branches:
+ *   - prefix match against `allowedRedirectPrefixes` (Alexa's three fixed
+ *     Amazon origins), and
+ *   - exact-path match against `allowedPrivateHostPaths` when the host is
+ *     private (a self-hosted client whose LAN address the hub cannot know).
+ *
+ * An unparsable URI is refused rather than falling through to the prefix test —
+ * `startsWith` on a string the browser will parse differently is exactly how an
+ * allow-list gets walked around.
+ */
+function isRedirectUriAllowed(redirectUri, allowedPrefixes, allowedPrivateHostPaths = []) {
+    if (allowedPrefixes.some((p) => redirectUri.startsWith(p)))
+        return true;
+    if (allowedPrivateHostPaths.length === 0)
+        return false;
+    let url;
+    try {
+        url = new URL(redirectUri);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        return false;
+    if (!(0, private_host_js_1.isPrivateHost)(url.hostname))
+        return false;
+    return allowedPrivateHostPaths.includes(url.pathname);
 }
 /** One-line human summary of a scope list for the consent screen. */
 function summariseScopes(scopes) {
@@ -38,8 +84,7 @@ async function buildIntegrationMap(registry) {
         const descriptor = await provider.getDescriptor();
         descriptorMap.set(descriptor.integrationId, descriptor);
     }
-    const knownSet = new Set(descriptorMap.keys());
-    return { descriptorMap, knownSet };
+    return descriptorMap;
 }
 /** Parse an application/x-www-form-urlencoded body string into a plain object. */
 function parseFormBody(raw) {
@@ -88,14 +133,14 @@ function registerOauth2Routes(fastify, deps) {
         if (!registry) {
             return reply.status(503).send({ error: 'service_unavailable' });
         }
-        const { descriptorMap, knownSet } = await buildIntegrationMap(registry);
+        const descriptorMap = await buildIntegrationMap(registry);
         const query = request.query;
-        const v = validateAuthorizeQuery(query, knownSet);
+        const v = validateAuthorizeQuery(query, descriptorMap);
         if (!v.ok) {
             return reply.status(v.status).send({ error: v.error });
         }
         const descriptor = descriptorMap.get(v.integration);
-        if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes)) {
+        if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes, descriptor.allowedPrivateHostPaths ?? [])) {
             return reply
                 .status(400)
                 .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });
@@ -104,15 +149,43 @@ function registerOauth2Routes(fastify, deps) {
             displayName: descriptor.displayName,
             username: tokenInfo.username ?? '',
             scopeSummary: summariseScopes(descriptor.requestedScopes),
+            // Shown, not merely validated. A `redirect_uri` on a private host is
+            // admitted by pattern rather than by registration, so the operator is
+            // the last check on WHERE the code goes — and a consent screen that
+            // hides the destination is theatre.
+            redirectUri: v.redirectUri,
             hidden: {
                 integration: v.integration,
                 redirect_uri: v.redirectUri,
                 state: v.state,
                 response_type: 'code',
+                ...(v.codeChallenge !== ''
+                    ? { code_challenge: v.codeChallenge, code_challenge_method: 'S256' }
+                    : {}),
             },
         });
         return reply.type('text/html').send(html);
     });
+    // ─── GET /api/oauth2/integrations ─────────────────────────────────────────
+    // Discovery. A client that has no token yet needs to know whether THIS hub
+    // knows it at all — a hub predating an integration must be distinguishable
+    // from one that is refusing it, or the client dead-ends on a 400 with no way
+    // to fall back. Unauthenticated (so is /token) and it discloses only which
+    // integrations are installed.
+    fastify.get('/api/oauth2/integrations', async (_request, reply) => {
+        const registry = deps.getRegistry();
+        if (!registry) {
+            return reply.status(503).send({ error: 'service_unavailable' });
+        }
+        const descriptorMap = await buildIntegrationMap(registry);
+        return reply.send({
+            integrations: [...descriptorMap.values()].map((d) => ({
+                integrationId: d.integrationId,
+                displayName: d.displayName,
+                requiresPkce: d.requiresPkce === true,
+            })),
+        });
+    });
     // ─── POST /api/oauth2/authorize ───────────────────────────────────────────
     fastify.post('/api/oauth2/authorize', async (request, reply) => {
         const cookie = request.cookies[session_cookie_js_1.SESSION_COOKIE];
@@ -136,20 +209,24 @@ function registerOauth2Routes(fastify, deps) {
         if (!registry) {
             return reply.status(503).send({ error: 'service_unavailable' });
         }
-        const { descriptorMap, knownSet } = await buildIntegrationMap(registry);
+        const descriptorMap = await buildIntegrationMap(registry);
         const body = request.body;
         const formQuery = {
             response_type: body.response_type,
             integration: body.integration,
             redirect_uri: body.redirect_uri,
             state: body.state,
+            code_challenge: body.code_challenge,
+            code_challenge_method: body.code_challenge_method,
         };
-        const v = validateAuthorizeQuery(formQuery, knownSet);
+        // Re-validated, not trusted: the hidden fields came back from a browser
+        // and every one of them is attacker-editable.
+        const v = validateAuthorizeQuery(formQuery, descriptorMap);
         if (!v.ok) {
             return reply.status(v.status).send({ error: v.error });
         }
         const descriptor = descriptorMap.get(v.integration);
-        if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes)) {
+        if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes, descriptor.allowedPrivateHostPaths ?? [])) {
             return reply
                 .status(400)
                 .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });
@@ -172,6 +249,7 @@ function registerOauth2Routes(fastify, deps) {
             // claim the cloud Lambda routes back on is the reachable public URL, not
             // the hub-global fallback (which defaults to localhost in dev).
             hubUrl: descriptor.hubUrl ?? deps.publicHubUrl(),
+            ...(v.codeChallenge !== '' ? { codeChallenge: v.codeChallenge } : {}),
         });
         return reply.redirect(`${v.redirectUri}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(v.state)}`);
     });
@@ -195,6 +273,10 @@ function registerOauth2Routes(fastify, deps) {
             tokenResult = await userMgmt.oauthExchangeCode({
                 code: body.code,
                 redirectUri: body.redirect_uri,
+                // Optional here and mandatory in the grant: the requirement is carried
+                // by the CODE (it embeds the challenge), not by this endpoint, so it
+                // cannot be dropped by a client that simply omits the parameter.
+                ...(body.code_verifier ? { codeVerifier: body.code_verifier } : {}),
             });
         }
         else if (body.grant_type === 'refresh_token') {

package/dist/api/oauth2/private-host.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * Is this hostname unreachable from the public internet?
+ *
+ * Used by `/api/oauth2/authorize` to admit a `redirect_uri` whose host the hub
+ * cannot know in advance — a self-hosted Home Assistant at
+ * `http://192.168.1.40:8123/auth/external/callback`. Pairing "private host" with
+ * "exact path" is what keeps that from being a wildcard prefix: a public host
+ * never satisfies it, so the worst an attacker can aim a code at is a machine
+ * they already need LAN presence to read.
+ *
+ * Literal inspection only — deliberately NO DNS resolution. A resolver turns an
+ * authorize request into an outbound lookup an attacker controls (SSRF-shaped,
+ * and a DNS-rebind race on top: the address that answers at validation time is
+ * not the one the browser will use). Names are admitted only by suffix, from a
+ * closed list of suffixes that cannot be registered on the public internet.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateHost = isPrivateHost;
+/** Suffixes that are, by definition, not publicly routable names. */
+const PRIVATE_NAME_SUFFIXES = ['.local', '.internal', '.home.arpa', '.ts.net'];
+/** Names that are exactly the loopback host. */
+const LOOPBACK_NAMES = ['localhost', 'localhost.localdomain'];
+function isPrivateIpv4(host) {
+    const parts = host.split('.');
+    if (parts.length !== 4)
+        return false;
+    const octets = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return false;
+        const n = Number(part);
+        if (n > 255)
+            return false;
+        octets.push(n);
+    }
+    const [a, b] = octets;
+    if (a === 127)
+        return true; // loopback
+    if (a === 10)
+        return true; // RFC1918
+    if (a === 192 && b === 168)
+        return true; // RFC1918
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // RFC1918
+    if (a === 169 && b === 254)
+        return true; // link-local
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // CGNAT / Tailscale 100.64/10
+    return false;
+}
+function isPrivateIpv6(host) {
+    // URL.hostname keeps IPv6 literals in brackets.
+    const inner = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+    if (!inner.includes(':'))
+        return false;
+    const lower = inner.toLowerCase();
+    if (lower === '::1' || lower === '::')
+        return true; // loopback / unspecified
+    if (/^f[cd][0-9a-f]{2}:/.test(lower))
+        return true; // fc00::/7 ULA
+    if (/^fe[89ab][0-9a-f]:/.test(lower))
+        return true; // fe80::/10 link-local
+    return false;
+}
+/**
+ * True iff `host` (a `URL.hostname`, already lowercased by the URL parser) is
+ * private by literal inspection. Never resolves.
+ */
+function isPrivateHost(host) {
+    if (host === '')
+        return false;
+    if (LOOPBACK_NAMES.includes(host))
+        return true;
+    if (isPrivateIpv4(host))
+        return true;
+    if (isPrivateIpv6(host))
+        return true;
+    return PRIVATE_NAME_SUFFIXES.some((suffix) => host.endsWith(suffix));
+}

package/dist/api/trpc/cap-mount-helpers.js

@@ -61,22 +61,11 @@ function requireDeviceScoped(registry, capName) {
                     provider = registry.getProviderForDevice(capName, deviceId);
                 }
                 if (!provider) {
-                    // No native and no device-bound provider. For `getStatus`, the
-                    // device may still have a SYNTHESIZED status from device-links
-                    // (battery/consumables wired from sibling sensors). Consult the
-                    // resolver with a null base (the synthesize path) before failing —
-                    // it returns null when the device has no links for this cap,
-                    // preserving today's error.
-                    if (prop === 'getStatus') {
-                        const deviceManager = registry.getSingleton('device-manager');
-                        const synthesized = await deviceManager?.resolveLinkedStatus?.({
-                            deviceId,
-                            cap: String(capName),
-                            baseStatus: null,
-                        });
-                        if (synthesized != null)
-                            return synthesized;
-                    }
+                    // No native and no device-bound provider. There used to be one more
+                    // branch here: SYNTHESIZE a `getStatus` out of device-links, so a
+                    // cap with no provider at all still answered. Wiring was deleted on
+                    // 2026-08-08 — a composed device's caps are native to it, so there
+                    // is nothing to conjure and the honest answer is the error.
                     throw new server_1.TRPCError({
                         code: 'PRECONDITION_FAILED',
                         message: `Capability "${String(capName)}" not registered for device ${deviceId}`,
@@ -89,21 +78,11 @@ function requireDeviceScoped(registry, capName) {
                         message: `Capability "${String(capName)}" provider for device ${deviceId} does not implement "${prop}"`,
                     });
                 }
-                const result = await fn.call(provider, input);
-                // Device-property-wiring overlay (read-time): only `getStatus`, and only
-                // when the device has links for this cap (resolveLinkedStatus returns
-                // null otherwise → base result untouched). One in-process singleton hop.
-                if (prop === 'getStatus') {
-                    const deviceManager = registry.getSingleton('device-manager');
-                    const overlaid = await deviceManager?.resolveLinkedStatus?.({
-                        deviceId,
-                        cap: String(capName),
-                        baseStatus: result,
-                    });
-                    if (overlaid != null)
-                        return overlaid;
-                }
-                return result;
+                // The provider's answer, verbatim. `getStatus` used to be run through
+                // a read-time device-link overlay here — a second authority writing a
+                // field the provider owns, which is the field-level form of the sin
+                // D62 bans at feature level. Deleted with wiring on 2026-08-08.
+                return await fn.call(provider, input);
             };
         },
     });

package/dist/api/trpc/generated-cap-routers.js

@@ -1829,6 +1829,15 @@ function createCapRouter_coreBlocks(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.setEnabled(methodInput);
         }),
+        restart: trpc_middleware_js_1.adminProcedure
+            .input(types_31.coreBlocksCapability.methods.restart.input.loose())
+            .output(types_31.coreBlocksCapability.methods.restart.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('core-blocks', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.restart(methodInput);
+        }),
         compile: trpc_middleware_js_1.adminProcedure
             .input(types_31.coreBlocksCapability.methods.compile.input.loose())
             .output(types_31.coreBlocksCapability.methods.compile.output)
@@ -2573,15 +2582,6 @@ function createCapRouter_deviceManager(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.setChildLayout(methodInput);
         }),
-        setDeviceLinks: trpc_middleware_js_1.adminProcedure
-            .input(types_40.deviceManagerCapability.methods.setDeviceLinks.input.loose())
-            .output(types_40.deviceManagerCapability.methods.setDeviceLinks.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('device-manager', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.setDeviceLinks(methodInput);
-        }),
         setDisplay: trpc_middleware_js_1.adminProcedure
             .input(types_40.deviceManagerCapability.methods.setDisplay.input.loose())
             .output(types_40.deviceManagerCapability.methods.setDisplay.output)
@@ -8258,6 +8258,24 @@ function createCapRouter_streamBroker(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.renderPreBufferClip(methodInput);
         }),
+        produceEventMedia: trpc_middleware_js_1.adminProcedure
+            .input(types_103.streamBrokerCapability.methods.produceEventMedia.input.loose())
+            .output(types_103.streamBrokerCapability.methods.produceEventMedia.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('stream-broker', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.produceEventMedia(methodInput);
+        }),
+        fetchEventMedia: trpc_middleware_js_1.adminProcedure
+            .input(types_103.streamBrokerCapability.methods.fetchEventMedia.input.loose())
+            .output(types_103.streamBrokerCapability.methods.fetchEventMedia.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('stream-broker', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.fetchEventMedia(methodInput);
+        }),
         listAllCameraStreams: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
             .output(types_103.streamBrokerCapability.methods.listAllCameraStreams.output)

package/dist/core/addon/addon-registry.service.js

@@ -53,6 +53,7 @@ const node_crypto_1 = require("node:crypto");
 const path = __importStar(require("node:path"));
 const fs = __importStar(require("node:fs"));
 const node_url_1 = require("node:url");
+const require_cache_js_1 = require("./require-cache.js");
 const addon_settings_provider_js_1 = require("./addon-settings-provider.js");
 const addon_call_gateway_js_1 = require("./addon-call-gateway.js");
 const system_6 = require("@camstack/system");
@@ -3081,8 +3082,27 @@ class AddonRegistryService {
             return;
         let catalog;
         try {
-            // Cache-bust so a hot-updated bundle is re-read instead of served
-            // from Node's ESM module cache.
+            // ── The query string does NOT bust a CommonJS bundle ──────────────
+            //
+            // Every addon here builds to CJS, and Node's ESM loader serves a CJS
+            // module out of the REQUIRE cache, which is keyed by the resolved
+            // filename with the query stripped. So `?t=<now>` below busts nothing
+            // for them: this function re-registered the catalog captured at hub boot
+            // on every restart, forever.
+            //
+            // The consequence was invisible and total: an EXISTING action kept
+            // working, so nothing looked broken, while a NEWLY added one could never
+            // become reachable without restarting the whole hub process — which
+            // quietly falsifies the reason bridge actions exist ("no codegen, no
+            // republish, no train"). Found 2026-08-08, deploying `nc.injectTestEvent`:
+            // the deploy succeeded, the restart logged "custom actions registered",
+            // and the action 404'd.
+            //
+            // Dropping the addon's own modules from the require cache is what
+            // actually re-reads the bundle — see `require-cache.ts` for the scoping
+            // and the real-path match Node's cache keys demand.
+            (0, require_cache_js_1.purgeRequireCacheUnder)(path.dirname(entryPath));
+            // Kept for a genuinely ESM addon entry, where it IS the mechanism.
             const cacheBustedUrl = `${(0, node_url_1.pathToFileURL)(entryPath).href}?t=${Date.now()}`;
             // A plain `await import()` here is downleveled by tsc (the backend builds
             // with `module: CommonJS`) into a `require()`-based shim. `require()` then

package/dist/core/addon/require-cache.js

@@ -0,0 +1,68 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.purgeRequireCacheUnder = purgeRequireCacheUnder;
+/**
+ * require-cache — evicting an addon's own modules so a hot-updated bundle
+ * is actually re-read.
+ *
+ * Lives in its own file because the behaviour it encodes is a Node semantic
+ * that cannot be observed from inside the test runner: the runner transforms
+ * modules itself, so only a real `node` process re-executing a real CommonJS
+ * file proves anything. `require-cache.spec.ts` spawns one.
+ */
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+/**
+ * Drop every `require`-cached module that lives under `dir`.
+ *
+ * Node's ESM loader serves a CommonJS module from the require cache, keyed by
+ * the resolved filename — the `?t=` query an ESM import uses to force a re-read
+ * is stripped before that lookup and therefore does nothing. Since every addon
+ * bundle here is CJS, evicting the addon's own entries is what makes a
+ * hot-updated bundle actually load.
+ *
+ * Matched against the REAL path as well as the given one. Node keys the cache
+ * by the resolved-and-symlink-followed filename, while an addon directory is
+ * assembled from the configured `dataDir` and never realpath'd — so a single
+ * symlink anywhere above it (a `dataDir` under macOS's `/tmp`, a relocated data
+ * root) makes a prefix match on the given path miss every entry and this
+ * function silently do nothing. Which is precisely the failure it exists to
+ * fix, wearing its clothes: the catalog would look refreshed and be stale.
+ *
+ * Scoped to one directory on purpose: a blanket cache clear would evict the
+ * hub's own modules and every other addon's, turning a catalog refresh into a
+ * process-wide reload. Best-effort — a cache that cannot be walked leaves the
+ * previous (stale) behaviour rather than failing the caller.
+ */
+function purgeRequireCacheUnder(dir) {
+    try {
+        const cache = require.cache;
+        if (cache === undefined)
+            return;
+        const prefixes = candidatePrefixes(dir);
+        for (const key of Object.keys(cache)) {
+            if (prefixes.some((prefix) => key.startsWith(prefix)))
+                delete cache[key];
+        }
+    }
+    catch {
+        // Non-CJS host, or a frozen cache. The caller's import still runs.
+    }
+}
+/** The directory as given and as Node sees it, both as trailing-separator prefixes. */
+function candidatePrefixes(dir) {
+    const withSep = (d) => (d.endsWith(node_path_1.default.sep) ? d : `${d}${node_path_1.default.sep}`);
+    const given = withSep(dir);
+    let real = given;
+    try {
+        real = withSep(node_fs_1.default.realpathSync(dir));
+    }
+    catch {
+        // Directory gone between the caller's existsSync and here — `given` alone
+        // is still a correct (if narrower) match.
+    }
+    return real === given ? [given] : [given, real];
+}

package/dist/launcher.js

@@ -278,7 +278,30 @@ async function launch() {
     // @camstack/system is imported DYNAMICALLY here — AFTER the active framework
     // dir + NODE_PATH are resolved above — so the correct framework copy is what
     // gets loaded. Never import it at module top.
-    const { AddonInstaller, bootstrapSchema, detectWorkspacePackagesDir } = await Promise.resolve().then(() => __importStar(require('@camstack/system')));
+    const { AddonInstaller, bootstrapSchema, detectWorkspacePackagesDir, quarantineAddonResidue } = await Promise.resolve().then(() => __importStar(require('@camstack/system')));
+    // Residue quarantine — FIRST thing that touches the addon root, before the
+    // bootstrap seed writes into it and long before any loader scans it.
+    //
+    // A directory under `addons/@camstack` whose name is not the package it
+    // declares is not an archive: the loader, the agent's boot scan and the
+    // install manifest all key on the `package.json` inside, so a rename
+    // INSTALLS. On 2026-08-07/08 that shipped `@camstack/system 1.2.3` as the
+    // reported version on a node running a 1.2.61 closure, and kept a 17-day-old
+    // `better_sqlite3.node` mapped into the live process. Moved, never deleted —
+    // the cleanup that deleted one of these gutted an agent the same evening.
+    //
+    // Guarded with a typeof check for the same reason `reconcileManifest` is: a
+    // system-only framework update can swap in a build that predates this.
+    if (typeof quarantineAddonResidue === 'function') {
+        const residue = quarantineAddonResidue(addonsDir, (msg) => console.log(msg));
+        if (residue.quarantined.length > 0 || residue.failed.length > 0) {
+            console.log(`[launcher] Addon residue — quarantined ${residue.quarantined.length}, ` +
+                `failed ${residue.failed.length}`);
+        }
+    }
+    else {
+        console.warn('[launcher] quarantineAddonResidue unavailable — skipping residue quarantine');
+    }
     // Install source resolution:
     //   1. CAMSTACK_BUNDLED_ADDONS_DIR — set by Electron-packaged builds
     //      to <resourcesPath>/addons. Pre-built addons ship with the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.75",
+  "version": "1.2.77",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.35",
+    "@camstack/addon-admin-ui": "1.2.37",
     "@camstack/addon-agent-ui": "1.2.10",
     "@camstack/addon-auth": "1.2.11",
     "@camstack/addon-decoder-nodeav": "1.2.9",
     "@camstack/addon-notifiers": "1.2.13",
-    "@camstack/addon-pipeline": "1.2.46",
-    "@camstack/addon-pipeline-orchestrator": "1.2.29",
-    "@camstack/addon-post-analysis": "1.2.51",
+    "@camstack/addon-pipeline": "1.2.48",
+    "@camstack/addon-pipeline-orchestrator": "1.2.31",
+    "@camstack/addon-post-analysis": "1.2.53",
     "@camstack/sdk": "1.2.10",
     "@camstack/shm-ring": "1.1.9",
-    "@camstack/system": "1.2.61",
-    "@camstack/types": "1.2.45",
-    "@camstack/ui-library": "1.2.33",
+    "@camstack/system": "1.2.63",
+    "@camstack/types": "1.2.47",
+    "@camstack/ui-library": "1.2.35",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",