@camstack/server 1.2.94 → 1.2.95

package/dist/agent/addon-scan.js

@@ -0,0 +1,131 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILTINS_PACKAGE = void 0;
+exports.resolveAddonPackageDirs = resolveAddonPackageDirs;
+exports.planAgentAddonScan = planAgentAddonScan;
+/**
+ * Which directories the agent scans for addons — decided as pure data.
+ *
+ * ── The single-copy collapse, finally on the agent ─────────────────────────
+ * The hub stopped loading framework builtins from a physical
+ * `<addonsDir>/@camstack/system` on 2026-07-18: it loads them from the ACTIVE
+ * CLOSURE it is itself running (`addon-registry.service.ts`, `loadFromAddonDir`
+ * on the closure dir, then `loadFromDirectory(addonsDir, ['@camstack/system'])`
+ * so the copy is skipped). The reason is in that file's comment — *"that copy
+ * drifted because no update channel refreshed it"*.
+ *
+ * The agent never got the change, and drifted exactly as predicted. Measured
+ * 2026-08-11: little-unraid carried `@camstack/system@1.2.61` and macmini
+ * `1.2.62` in their addon roots while both ran a `1.2.78` closure. Nothing
+ * refreshed them, because `seedBuiltinsFromClosure` (now deleted) only wrote
+ * the copy when it was ABSENT — a self-heal that guaranteed a copy existed and
+ * never that it was current. It also contradicted
+ * `AddonInstaller.shouldSkipClosureProvidedSeed`, which already refused to
+ * plant that copy for this very reason.
+ *
+ * ── Why the skip is correctness, not tidiness ──────────────────────────────
+ * `AddonLoader` keys its map on `declaration.id`, so loading the closure AND a
+ * stale copy through one loader is not a duplicate — it is LAST-LOAD-WINS. The
+ * builtins a node runs would depend on directory iteration order. The copy must
+ * be skipped, not merely deprioritized.
+ *
+ * ── The fallback ──────────────────────────────────────────────────────────
+ * If the closure cannot be resolved, the copy is NOT skipped and the node boots
+ * from it. In a running agent this is near-impossible — `agent/main.ts`
+ * statically imports `@camstack/system`, so if the process exists the walk-up
+ * resolves — but a node with neither source must fail through the D87 guard
+ * (`assertRequiredInfraResolved`, which names every missing required cap),
+ * never through a silent "no addon packages found" early return.
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/** The framework builtins package. Loaded from the closure, never from a copy. */
+exports.BUILTINS_PACKAGE = '@camstack/system';
+function isDir(p) {
+    try {
+        return fs.statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Every installed addon package under `addonsDir`, minus `skipPackages`.
+ *
+ * Matching mirrors `AddonLoader.loadFromDirectory`'s skip list exactly —
+ * `<scope>/<name>` for a scoped directory, the bare name for a flat one — so
+ * the hub and the agent exclude the same thing given the same list.
+ */
+function resolveAddonPackageDirs(addonsDir, skipPackages = []) {
+    const dirs = [];
+    if (!fs.existsSync(addonsDir))
+        return dirs;
+    const skip = new Set(skipPackages);
+    for (const name of fs.readdirSync(addonsDir)) {
+        const full = path.join(addonsDir, name);
+        if (name.startsWith('@') && isDir(full)) {
+            // Scoped packages: @camstack/addon-xyz
+            for (const sub of fs.readdirSync(full)) {
+                const subFull = path.join(full, sub);
+                if (skip.has(`${name}/${sub}`))
+                    continue;
+                if (isDir(subFull) && fs.existsSync(path.join(subFull, 'package.json'))) {
+                    dirs.push(subFull);
+                }
+            }
+        }
+        else if (isDir(full) && fs.existsSync(path.join(full, 'package.json'))) {
+            if (skip.has(name))
+                continue;
+            dirs.push(full);
+        }
+    }
+    return dirs;
+}
+/**
+ * The ordered directory list `bootCoreAddons` loads, closure first.
+ *
+ * `closureSystemDir` is `resolveHubClosurePackageDir(BUILTINS_PACKAGE)` — null
+ * only when the builtins are not resolvable from the running closure at all.
+ */
+function planAgentAddonScan(addonsDir, closureSystemDir) {
+    if (closureSystemDir === null) {
+        // No closure copy: fall back to whatever is on disk, including the
+        // addon-root builtins, rather than booting with no infra at all.
+        return resolveAddonPackageDirs(addonsDir);
+    }
+    return [closureSystemDir, ...resolveAddonPackageDirs(addonsDir, [exports.BUILTINS_PACKAGE])];
+}

package/dist/agent/main.js

@@ -47,7 +47,8 @@ const agent_update_service_js_1 = require("./agent-update-service.js");
 const server_management_provider_js_1 = require("../api/core/server-management.provider.js");
 const infra_boot_guard_js_1 = require("./infra-boot-guard.js");
 const infra_boot_plan_js_1 = require("./infra-boot-plan.js");
-const builtins_seed_js_1 = require("./builtins-seed.js");
+const package_dir_utils_js_1 = require("../core/addon/package-dir-utils.js");
+const addon_scan_js_1 = require("./addon-scan.js");
 const agent_service_js_1 = require("./agent-service.js");
 const agent_group_runner_js_1 = require("./agent-group-runner.js");
 const register_agent_cap_dispatch_js_1 = require("./register-agent-cap-dispatch.js");
@@ -769,13 +770,21 @@ async function startAgent(configPath) {
 // Core infra addons to load on agent — all infra including log-destination (hub-forwarder)
 const AGENT_INFRA = system_1.INFRA_CAPABILITIES;
 async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFactory) {
-    // Self-heal FIRST: a missing builtins package is answerable from the
-    // running closure (see `builtins-seed.ts`) — without this, the D87 guard
-    // below turns a recoverable gap into a crash-loop.
-    (0, builtins_seed_js_1.seedBuiltinsFromClosure)(config.addonsDir);
-    // Scan every installed addon package — infra providers may live outside
-    // `@camstack/system` (e.g. `@camstack/addon-platform-probe-native`).
-    const packageDirs = resolveAddonPackageDirs(config.addonsDir);
+    // Builtins come from the CLOSURE this process is running, exactly as the hub
+    // has done since 2026-07-18 — never from a `<addonsDir>/@camstack/system`
+    // copy, which nothing refreshes and which therefore drifts (both agents were
+    // 17 versions behind on 2026-08-11). `planAgentAddonScan` owns the decision
+    // and the fallback; see `addon-scan.ts`. Non-framework infra providers
+    // (e.g. `@camstack/addon-platform-probe-native`) still come from the scan.
+    const closureSystemDir = (0, package_dir_utils_js_1.resolveHubClosurePackageDir)(addon_scan_js_1.BUILTINS_PACKAGE);
+    if (closureSystemDir === null) {
+        // Louder than the hub's warn: on an agent the builtins ARE the infra, so
+        // this is pre-fatal. Boot continues to the D87 guard, which names every
+        // required cap it could not resolve.
+        console.error(`[Agent] ${addon_scan_js_1.BUILTINS_PACKAGE} not resolvable from the running closure — ` +
+            'falling back to the addon-root copy, if there is one');
+    }
+    const packageDirs = (0, addon_scan_js_1.planAgentAddonScan)(config.addonsDir, closureSystemDir);
     if (packageDirs.length === 0) {
         console.warn('[Agent] No addon packages found — running without infrastructure addons');
         return;
@@ -876,7 +885,13 @@ async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFact
 // Phase 1.5: Load cluster-capable addon packages
 // ---------------------------------------------------------------------------
 async function loadClusterCapableAddons(broker, config, capabilityRegistry, loadedAddons) {
-    const addonPackageDirs = resolveAddonPackageDirs(config.addonsDir);
+    // Builtins are in-process infra, never group-spawned, and they come from the
+    // closure — so the addon-root copy is skipped here too. Leaving it in would
+    // import a stale entry module during the scan below, which is the whole thing
+    // the single-copy collapse removes. The closure dir is deliberately NOT added:
+    // adding it would newly expose `hub-forwarder` / `platform-probe` (the only
+    // builtins carrying `execution`) as spawn candidates.
+    const addonPackageDirs = (0, addon_scan_js_1.resolveAddonPackageDirs)(config.addonsDir, systemSkipList());
     if (addonPackageDirs.length === 0)
         return;
     // ── Phase 0 (cross-package): collect every group-eligible addon
@@ -974,7 +989,9 @@ async function loadDeployedAddons(broker, addonsDir, dataDir, loadedAddons, stor
     // the agent MAIN thread is what wedged `$agent.reload` and dropped the node
     // from topology. A group-runner addon only needs its declaration to be
     // (re)dispatched to a subprocess, which loads the real module itself.
-    const packageDirs = resolveAddonPackageDirs(addonsDir);
+    // Same skip: a `$agent.deploy` of `@camstack/system` still lands bytes in the
+    // addon root, but a reload must not adopt them over the closure.
+    const packageDirs = (0, addon_scan_js_1.resolveAddonPackageDirs)(addonsDir, systemSkipList());
     const groupCandidates = [];
     // Dirs holding a deployable NON-group addon — and ONLY these — need the
     // importing loader. None exist under the default `hub-only` placement
@@ -1118,36 +1135,14 @@ function readAgentVersion() {
     }
     return 'unknown';
 }
-/** Check if path is a directory (follows symlinks) */
-function isDir(p) {
-    try {
-        return fs.statSync(p).isDirectory();
-    }
-    catch {
-        return false;
-    }
-}
-/** Scan addonsDir for addon packages (scoped and unscoped, follows symlinks) */
-function resolveAddonPackageDirs(addonsDir) {
-    const dirs = [];
-    if (!fs.existsSync(addonsDir))
-        return dirs;
-    for (const name of fs.readdirSync(addonsDir)) {
-        const full = path.join(addonsDir, name);
-        if (name.startsWith('@') && isDir(full)) {
-            // Scoped packages: @camstack/addon-xyz
-            for (const sub of fs.readdirSync(full)) {
-                const subFull = path.join(full, sub);
-                if (isDir(subFull) && fs.existsSync(path.join(subFull, 'package.json'))) {
-                    dirs.push(subFull);
-                }
-            }
-        }
-        else if (isDir(full) && fs.existsSync(path.join(full, 'package.json'))) {
-            dirs.push(full);
-        }
-    }
-    return dirs;
+/**
+ * Skip the addon-root builtins copy — but ONLY when the closure can supply
+ * them. Same condition `planAgentAddonScan` applies, kept in one place so the
+ * infra scan and the two deployable-addon scans can never disagree about which
+ * copy is authoritative.
+ */
+function systemSkipList() {
+    return (0, package_dir_utils_js_1.resolveHubClosurePackageDir)(addon_scan_js_1.BUILTINS_PACKAGE) === null ? [] : [addon_scan_js_1.BUILTINS_PACKAGE];
 }
 // ---------------------------------------------------------------------------
 // E1 helper — agent-local UDS child manifest adaptation

package/dist/api/core/cap-providers.js

@@ -1176,14 +1176,24 @@ function isHubNode(nodeId) {
  * agent reports its addon roster (id + status + version + packageName);
  * we keep only entries that carry both a package name and a version so
  * the hub can diff them against npm.
+ *
+ * `@camstack/system` is KEPT, and it is one of the most important entries here.
+ * On an agent, `addons/@camstack/system` is the only copy of the builtin infra
+ * ([D87](../../../../docs/decisions/adr-0087.md)), so a pending update on it is
+ * a true, actionable signal: the node's infra is behind the closure it runs
+ * against. Both agents sat 17 versions behind that way until 2026-08-11. Do not
+ * filter it out to make the list look clean — the number reaching zero is the
+ * point of the number.
  */
 async function fetchAgentInstalledPackages(broker, nodeId) {
     const status = await broker.call('$agent.status', {}, { nodeID: nodeId, timeout: 5_000 });
     const out = [];
     for (const a of status.addons ?? []) {
-        if (typeof a.packageName === 'string' && typeof a.version === 'string') {
-            out.push({ name: a.packageName, version: a.version });
-        }
+        if (typeof a.packageName !== 'string' || typeof a.version !== 'string')
+            continue;
+        if ((0, addon_package_service_js_1.isFrameworkPackage)(a.packageName))
+            continue;
+        out.push({ name: a.packageName, version: a.version });
     }
     return out;
 }
@@ -1253,6 +1263,22 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
                 }
                 return { success: false, error: task?.error ?? 'update failed', jobId };
             }
+            // `@camstack/system` DELIBERATELY travels this way to an agent, and it is
+            // the only way it can. On the hub, `addons/@camstack/system` is a shadow
+            // of the closure; on an AGENT it is THE ONLY COPY of the builtin infra —
+            // `bootCoreAddons` scans the addon root and nothing else, and the image
+            // seed excludes the framework set on purpose ([D87](../../../../docs/decisions/adr-0087.md)).
+            // Removing it on 2026-08-07 left the node with no `filesystem-storage`,
+            // `sqlite-settings`, `storage-orchestrator`, `hub-forwarder`,
+            // `metrics-native` or `platform-probe`, and the outage was unobservable
+            // because the log shipper was in the same package.
+            //
+            // So do NOT add a framework guard here. A 2026-08-11 attempt to do so read
+            // the launcher's `resolved @camstack/system@… from <activeRoot>` line as
+            // proof that nothing loads the addon-root copy. That line answers which
+            // copy the LAUNCHER resolves for its own imports — a different consumer
+            // from `bootCoreAddons`. Same trap D45 names: a version is a property of a
+            // path, and a path is only evidence about the consumer that reads it.
             // Agent target: the hub packs the resolved version and ships the
             // tarball over `$agent.deploy` — the agent has no npm runtime.
             // The reload re-instantiates the changed package's addons; for a large
@@ -1349,12 +1375,30 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
             return { success: true };
         },
         // ── Lifecycle job engine ─────────────────────────────────────────
-        startJob: async (input) => lifecycleRunner.startJob({
-            kind: input.kind,
-            targets: input.targets,
-            nodeIds: input.nodeIds,
-            createdBy: lifecycleCreatedBy,
-        }),
+        startJob: async (input) => {
+            // The engine is HUB-LOCAL: `StartJobInput.nodeIds` is declared
+            // "reserved for future cluster jobs" and nothing reads it. Passing an
+            // agent id therefore used to apply every target to the HUB while the
+            // job, its per-task `nodeId` and the UI all reported the agent — so
+            // "Update all" on a selected agent silently updated the wrong node and
+            // left the agent pending forever. That is how two agents sat at 8
+            // pending addons across several sessions (2026-08-11). Refuse instead:
+            // an agent converges one package at a time through `updatePackage`,
+            // which has a real `$agent.deploy` path.
+            const offNode = (input.nodeIds ?? []).filter((id) => !isHubNode(id));
+            if (offNode.length > 0) {
+                throw new server_1.TRPCError({
+                    code: 'BAD_REQUEST',
+                    message: `The lifecycle job engine is hub-local; it cannot target ${offNode.join(', ')}. Update an agent's packages via updatePackage({ nodeId }).`,
+                });
+            }
+            return lifecycleRunner.startJob({
+                kind: input.kind,
+                targets: input.targets,
+                nodeIds: input.nodeIds,
+                createdBy: lifecycleCreatedBy,
+            });
+        },
         getJob: async (input) => lifecycleRunner.getJob(input.jobId),
         listJobs: async (input) => lifecycleRunner.listJobs({ activeOnly: input.activeOnly }),
         cancelJob: async (input) => lifecycleRunner.cancelJob(input.jobId),

package/dist/core/addon/addon-package.service.js

@@ -1032,6 +1032,15 @@ class AddonPackageService {
      * for use by the lifecycle job engine (TarballFetcher signature). The
      * `signal` is forwarded to the underlying fetch calls so the AbortController
      * timeout wired in LifecycleJobEngine fires correctly.
+     *
+     * `version` may be an exact semver OR a dist-tag. It looked up only
+     * `versions[version]` until 2026-08-11, so every caller that passed the
+     * DEFAULT — `updatePackage` resolves an absent input to `'latest'` — failed
+     * with `no tarball url`, because `latest` is a dist-tag key and never a
+     * `versions` key. The Addons page hid this by always sending the resolved
+     * `latestVersion` from `listUpdates`; the API path had no such caller and
+     * could not update anything. Mirrors `AddonInstaller.downloadNpmTarball`.
+     * Ranges (`^1.2.0`) are still not supported — resolve those upstream.
      */
     async fetchAddonTarball(name, version, signal) {
         const registry = process.env['CAMSTACK_NPM_REGISTRY'];
@@ -1041,9 +1050,15 @@ class AddonPackageService {
         if (!metaRes.ok)
             throw new Error(`registry GET ${metaUrl} → ${metaRes.status}`);
         const meta = (await metaRes.json());
-        const tarballUrl = meta.versions?.[version]?.dist?.tarball;
+        const versions = meta.versions ?? {};
+        const distTags = meta['dist-tags'] ?? {};
+        const resolvedVersion = versions[version] ? version : distTags[version];
+        if (resolvedVersion === undefined) {
+            throw new Error(`no version resolved for ${name}@${version}`);
+        }
+        const tarballUrl = versions[resolvedVersion]?.dist?.tarball;
         if (typeof tarballUrl !== 'string') {
-            throw new Error(`no tarball url for ${name}@${version}`);
+            throw new Error(`no tarball url for ${name}@${resolvedVersion}`);
         }
         const tarRes = await fetch(tarballUrl, { signal });
         if (!tarRes.ok)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.94",
+  "version": "1.2.95",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "*",
-    "@camstack/addon-agent-ui": "*",
-    "@camstack/addon-auth": "*",
-    "@camstack/addon-decoder-nodeav": "*",
-    "@camstack/addon-notifiers": "*",
-    "@camstack/addon-pipeline": "*",
-    "@camstack/addon-pipeline-orchestrator": "*",
-    "@camstack/addon-post-analysis": "*",
-    "@camstack/sdk": "*",
-    "@camstack/shm-ring": "*",
-    "@camstack/system": "*",
-    "@camstack/types": "*",
-    "@camstack/ui-library": "*",
+    "@camstack/addon-admin-ui": "1.2.48",
+    "@camstack/addon-agent-ui": "1.2.13",
+    "@camstack/addon-auth": "1.2.14",
+    "@camstack/addon-decoder-nodeav": "1.2.12",
+    "@camstack/addon-notifiers": "1.2.17",
+    "@camstack/addon-pipeline": "1.2.64",
+    "@camstack/addon-pipeline-orchestrator": "1.2.45",
+    "@camstack/addon-post-analysis": "1.2.64",
+    "@camstack/sdk": "1.2.14",
+    "@camstack/shm-ring": "1.1.12",
+    "@camstack/system": "1.2.79",
+    "@camstack/types": "1.2.59",
+    "@camstack/ui-library": "1.2.41",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/agent/builtins-seed.js

@@ -1,89 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.seedBuiltinsFromClosure = seedBuiltinsFromClosure;
-/**
- * Self-heal the agent's builtins package before the infra scan.
- *
- * `bootCoreAddons` scans `config.addonsDir` and nothing else, the image seed
- * ships no `@camstack/system`, and the running closure's copy is NOT loaded
- * as an addon — so an agent whose `/data/addons/@camstack/system` is missing
- * (greenfield container, an operator cleanup, a failed deploy) boots with
- * zero infrastructure. Before D87 that produced a silently gutted node; with
- * the D87 guard it produces a crash-loop. Both are wrong answers to a
- * question the node can answer itself: the closure it is RUNNING carries the
- * exact builtins package it needs.
- *
- * The copy is files-list shaped — `package.json` + `dist` — and NEVER
- * `node_modules`: a nested `node_modules/@camstack/*` carries its own
- * `package.json`s, the addon scan discovers those too, and the same addon
- * initializing twice is a boot abort (measured live 2026-08-08, twice, two
- * different vehicles).
- */
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-function seedBuiltinsFromClosure(addonsDir, log = console.log, resolveClosurePkg = () => require.resolve('@camstack/system/package.json')) {
-    const target = path.join(addonsDir, '@camstack', 'system');
-    if (fs.existsSync(path.join(target, 'package.json')))
-        return 'present';
-    let closurePkgJson;
-    try {
-        closurePkgJson = resolveClosurePkg();
-    }
-    catch {
-        log('[Agent] builtins seed: @camstack/system not resolvable from the closure — cannot self-heal');
-        return 'unavailable';
-    }
-    const closureRoot = path.dirname(closurePkgJson);
-    const closureDist = path.join(closureRoot, 'dist');
-    if (!fs.existsSync(closureDist)) {
-        log(`[Agent] builtins seed: closure copy at ${closureRoot} has no dist — cannot self-heal`);
-        return 'unavailable';
-    }
-    // The WHOLE package, node_modules included. A deps-free copy was tried
-    // first and failed live (2026-08-08): the builtins' dist requires native
-    // deps (better-sqlite3) that resolve relative to the COPY, so the addon
-    // scan logged "Failed to scan" and the guard aborted with "no addon
-    // under /data/addons" — while the log right above it said the seed had
-    // run. Nested `node_modules` are safe: the scan reads one level of
-    // `addonsDir/@scope/*`, never inside a package. (The double-registration
-    // the deps-free copy was guarding against was actually the per-capability
-    // init loop — fixed by `planInfraBoot` — not nested discovery.)
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    fs.cpSync(closureRoot, target, { recursive: true });
-    log(`[Agent] builtins seed: @camstack/system was missing under ${addonsDir} — ` +
-        `seeded the full package from the running closure (${closureRoot})`);
-    return 'seeded';
-}

package/dist/api/addons-custom.router.js

@@ -1,99 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAddonsCustomProcedures = createAddonsCustomProcedures;
-/**
- * `api.addons.custom` — generic dispatcher for addon-defined custom actions.
- *
- * Task 7.2 of the device-proxy redesign. Addons declare a catalog of
- * custom actions at boot via `AddonInitResult.customActions` + a single
- * `handleCustomAction(action, input)` handler. The catalog is registered
- * with a per-process `CustomActionRegistry` (Task 7.1). This endpoint is
- * the single tRPC entry point that resolves an `(addonId, action)` pair,
- * validates input + output against the action's Zod schemas, enforces the
- * action's declared auth level, and dispatches to the addon handler.
- *
- * The factory returns a record of procedures (not a router) so the caller
- * can spread it into the existing `addons` namespace:
- *
- *   trpcRouter({
- *     ...existingAddonsProcedures,
- *     ...createAddonsCustomProcedures({ getCustomActionRegistry: ... }),
- *   })
- *
- * This avoids `mergeRouters` (which requires sharing the `t` instance
- * across modules) while still mounting the procedure at `api.addons.custom`.
- */
-const zod_1 = require("zod");
-const server_1 = require("@trpc/server");
-const trpc_middleware_js_1 = require("./trpc/trpc.middleware.js");
-/**
- * Build the procedure record for the `custom` endpoint.
- *
- * The OUTER procedure is `protectedProcedure` — every caller must be
- * authenticated. The INNER per-action auth declared in `spec.auth` is
- * enforced manually by `ensureAuth` because the auth level is not known
- * until after the registry lookup.
- */
-function createAddonsCustomProcedures(deps) {
-    return {
-        custom: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({
-            addonId: zod_1.z.string().min(1),
-            action: zod_1.z.string().min(1),
-            input: zod_1.z.unknown(),
-        }))
-            .output(zod_1.z.unknown())
-            .mutation(async ({ input, ctx }) => {
-            const registry = deps.getCustomActionRegistry();
-            const entry = registry.resolve(input.addonId, input.action);
-            if (!entry) {
-                throw new server_1.TRPCError({
-                    code: 'NOT_FOUND',
-                    message: `addon '${input.addonId}' has no custom action '${input.action}'`,
-                });
-            }
-            // Per-action authorization. The outer procedure already requires
-            // authentication; here we additionally enforce the declared role
-            // when it's stricter than 'protected'.
-            ensureAuth(ctx, entry.spec.auth);
-            // Validate input against the action's declared Zod schema.
-            const parsedInput = entry.spec.input.parse(input.input);
-            // Dispatch through the addon handler, forwarding the authenticated
-            // caller when the action declares `caller: 'required'`. The caller is
-            // derived server-side from the request principal (never trusted from
-            // input); `ctx.user` is guaranteed present because `ensureAuth` above
-            // rejects unauthenticated callers for any non-public action, and the
-            // outer `protectedProcedure` rejects them for public ones.
-            const caller = entry.spec.caller === 'required' && ctx.user
-                ? { userId: ctx.user.id, isAdmin: ctx.user.isAdmin }
-                : undefined;
-            const result = await entry.handler(parsedInput, caller);
-            // Validate the addon's output. Crash-early on misbehaving addons.
-            return entry.spec.output.parse(result);
-        }),
-    };
-}
-/**
- * Enforce the action's declared auth level.
- *
- * Mirrors the role checks performed by `protectedProcedure` and
- * `adminProcedure` in trpc.middleware.ts:
- *   - public:    no auth
- *   - protected: any authenticated user
- *   - admin:     isAdmin only (scoped tokens bounce)
- */
-function ensureAuth(ctx, level) {
-    if (level === 'public')
-        return;
-    if (!ctx.user) {
-        throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
-    }
-    if (level === 'protected')
-        return;
-    if (level === 'admin') {
-        if (!ctx.user.isAdmin) {
-            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'custom action requires admin' });
-        }
-        return;
-    }
-}