@camstack/system 1.2.14 → 1.2.16

package/dist/framework-resolver-hook.mjs

@@ -19,6 +19,8 @@ const HOST_EXTERNAL_SPECIFIERS = [
   // in sync with host-externals.ts (a spec pins both).
   'sharp',
   'node-av',
+  'node-pty',
+  'ssh2',
 ]
 
 function isHostExternal(specifier) {

package/dist/index.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-yttC1aUI.js");
+const require_dist = require("./dist-3AzhkmeY.js");
 const require_model_download_service = require("./model-download-service-hf0ookyy.js");
-const require_manifest_python_deps = require("./manifest-python-deps-DSrmih6E.js");
+const require_manifest_python_deps = require("./manifest-python-deps-DRN3x53E.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
@@ -2733,21 +2733,26 @@ async function copyDirRecursive(src, dest) {
 	});
 }
 /**
-* Runtime natives that must stay installable even when an addon forgets to
-* declare them: the mirror of the build preset's `COMMON_NATIVE_DEPS`
-* (tools/build/vite-lib.preset.ts — build tooling, not loadable at runtime).
-* These are the ONLY packages a self-contained dist genuinely `require()`s
-* from node_modules; everything else is already inlined by the bundle.
+* Runtime deps a stripped addon package.json must KEEP so the installer still
+* `npm install`s them into the addon dir.
+*
+* Empty by design: every native an addon can import is now HOST-EXTERNAL
+* (node-av, sharp, node-pty — resolved from the framework closure via the
+* resolver hook, see host-externals.ts), and every pure-JS lib (ssh2, werift,
+* @simplewebauthn, mqtt, aws-sdk, …) is inlined by the self-contained vite
+* bundle. So a self-contained dist requires NOTHING from a local node_modules —
+* `addons/` stays node_modules-free, which is what lets the backup tar the whole
+* folder with no exclusion list (see ADR-0027). An addon that genuinely needs an
+* un-bundleable runtime dep declares it explicitly in
+* `camstack.runtimeDependencies`; the debug escape hatch
+* `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy install-everything path.
+*
+* (Historically this mirrored the build preset's COMMON_NATIVE_DEPS and
+* per-addon-installed node-av/sharp/onnxruntime-node/ssh2/werift/systeminformation
+* — 74k files / 1.34 GB of redundant node_modules on the live hub. That redundancy
+* is removed: the natives come from the framework, the pure-JS from the bundle.)
 */
-var RUNTIME_NATIVE_KEEP = [
-	"better-sqlite3",
-	"node-av",
-	"onnxruntime-node",
-	"sharp",
-	"ssh2",
-	"werift",
-	"systeminformation"
-];
+var RUNTIME_NATIVE_KEEP = [];
 /** Read `camstack.runtimeDependencies` (extra non-native deps the dist
 *  requires at runtime — versions come from the manifest's own dep maps). */
 function readRuntimeDependencies(pkg) {
@@ -3934,10 +3939,14 @@ var AddonInstaller = class AddonInstaller {
 	*   1. Rename current install dir → {addonsDir}/.backups/{name}/{ts}/
 	*   2. Run a fresh install (npm or local depending on installSource)
 	*   3. Record `lastBackupDir` in the manifest entry
+	*   4. Prune every OTHER backup of this addon — the previous one just
+	*      lost its only pointer and would otherwise be orphaned forever.
 	*
-	* The post-install caller (kernel.restartAddon + health-check) is
-	* responsible for verifying the new version actually works and for
-	* triggering `rollbackAddon()` if the health check fails.
+	* The post-install caller (restart + health-check) is responsible for
+	* verifying the new version actually works, and for calling either
+	* `clearBackup()` on success or `rollbackAddon()` on failure. This
+	* method must NOT delete the backup itself: at this point the new
+	* version has not been proven to work.
 	*
 	* Throws if there is no installed version to update — caller should
 	* prefer plain `install()` for first-time installs.
@@ -3990,6 +3999,7 @@ var AddonInstaller = class AddonInstaller {
 			source: this.manifest.get(packageName)?.source ?? "npm",
 			lastBackupDir: backupDir
 		});
+		await this.pruneBackups(packageName, backupDir);
 		return {
 			name: result.name,
 			version: result.version,
@@ -4060,6 +4070,7 @@ var AddonInstaller = class AddonInstaller {
 			source: this.manifest.get(packageName)?.source ?? "npm",
 			lastBackupDir: backupDir
 		});
+		await this.pruneBackups(packageName, backupDir);
 		return {
 			name: packageName,
 			version,
@@ -4106,23 +4117,204 @@ var AddonInstaller = class AddonInstaller {
 		this.logger.info(`${packageName} — rolled back to v${restoredVersion}`);
 		return restoredVersion;
 	}
+	/** Root of the pre-update rollback copies: `{addonsDir}/.backups`. */
+	get backupsRoot() {
+		return node_path.join(this.addonsDir, ".backups");
+	}
+	/**
+	* True only when `target` resolves to something strictly INSIDE
+	* `{addonsDir}/.backups/`.
+	*
+	* Every deletion in this section funnels through here. `lastBackupDir`
+	* is read back from a manifest file on disk — an operator edit, a
+	* restored manifest from another host, or a `..` in the recorded path
+	* must never turn "reclaim a backup" into "delete the live install".
+	*/
+	isInsideBackups(target) {
+		const rel = node_path.relative(node_path.resolve(this.backupsRoot), node_path.resolve(target));
+		return rel !== "" && !rel.startsWith("..") && !node_path.isAbsolute(rel);
+	}
 	/**
-	* Drop the recorded backup for an addon (e.g. after a successful
-	* post-update health check confirms the new version is healthy).
-	* Frees disk space without affecting the running install.
+	* Best-effort removal of one path under `.backups/`.
+	*
+	* Never throws: an undeleted backup is a disk-space problem, whereas a
+	* throw on the post-update success path would turn a working update into
+	* a reported outage. Returns true only when the path is gone.
+	*/
+	async removeBackupPath(target, reason) {
+		if (!this.isInsideBackups(target)) {
+			this.logger.error("Refusing to remove a backup path outside .backups/", { meta: {
+				target,
+				backupsRoot: this.backupsRoot,
+				reason
+			} });
+			return false;
+		}
+		try {
+			await node_fs.promises.rm(target, {
+				recursive: true,
+				force: true
+			});
+			return true;
+		} catch (err) {
+			this.logger.warn("Backup removal failed; leaving residue for the next boot sweep", { meta: {
+				target,
+				reason,
+				error: require_dist.errMsg(err)
+			} });
+			return false;
+		}
+	}
+	/** List the timestamped backup dirs recorded for one package. */
+	listBackupsFor(packageName) {
+		const dir = node_path.join(this.backupsRoot, packageName);
+		try {
+			return node_fs.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => node_path.join(dir, e.name)).sort();
+		} catch {
+			return [];
+		}
+	}
+	/**
+	* Keep at most ONE backup per addon: drop every backup dir for
+	* `packageName` except `keepDir`.
+	*
+	* Called right after a new backup is recorded. Without this, a second
+	* update overwrites `lastBackupDir` and the previous backup becomes
+	* unreachable — no pointer, so neither `rollbackAddon` nor `clearBackup`
+	* can ever see it again. That is how the live hub accumulated two 398 MiB
+	* copies of one addon. Never throws.
+	*/
+	async pruneBackups(packageName, keepDir) {
+		const keep = keepDir == null ? null : node_path.resolve(keepDir);
+		const removed = [];
+		for (const candidate of this.listBackupsFor(packageName)) {
+			if (keep != null && node_path.resolve(candidate) === keep) continue;
+			if (await this.removeBackupPath(candidate, "superseded-backup")) removed.push(candidate);
+		}
+		if (removed.length > 0) this.logger.info(`${packageName} — pruned ${removed.length} superseded backup(s)`);
+		await this.removeEmptyBackupDirs(packageName);
+		return removed;
+	}
+	/** Drop `.backups/{pkg}` (and its `@scope` parent) once they are empty. */
+	async removeEmptyBackupDirs(packageName) {
+		const pkgDir = node_path.join(this.backupsRoot, packageName);
+		for (const dir of [pkgDir, node_path.dirname(pkgDir)]) {
+			if (!this.isInsideBackups(dir)) continue;
+			try {
+				await node_fs.promises.rmdir(dir);
+			} catch {
+				return;
+			}
+		}
+	}
+	/**
+	* Drop the recorded backup for an addon — call once the post-update
+	* health check confirms the new version actually works.
+	*
+	* Never throws and never rejects. The manifest pointer is cleared even
+	* when the bytes could not be removed: a pointer at a half-deleted tree
+	* would make `rollbackAddon` restore a gutted install, and the boot sweep
+	* reclaims the residue on the next start.
 	*/
-	clearBackup(packageName) {
+	async clearBackup(packageName) {
 		const entry = this.manifest.get(packageName);
 		if (entry?.lastBackupDir == null) return;
-		if (node_fs.existsSync(entry.lastBackupDir)) node_fs.rmSync(entry.lastBackupDir, {
-			recursive: true,
-			force: true
-		});
-		this.manifest.upsert(packageName, {
-			version: entry.version,
-			source: entry.source,
-			lastBackupDir: void 0
-		});
+		if (await this.removeBackupPath(entry.lastBackupDir, "update-confirmed")) this.logger.info(`${packageName} — update confirmed, backup reclaimed`, { meta: { backupDir: entry.lastBackupDir } });
+		try {
+			this.manifest.upsert(packageName, {
+				version: entry.version,
+				source: entry.source,
+				lastBackupDir: void 0
+			});
+		} catch (err) {
+			this.logger.warn(`${packageName} — could not clear the backup pointer`, { meta: { error: require_dist.errMsg(err) } });
+		}
+		await this.removeEmptyBackupDirs(packageName);
+	}
+	/**
+	* Boot-time retention sweep over `{addonsDir}/.backups/`.
+	*
+	* RULE: for each addon, the ONLY backup that survives is the one the
+	* manifest's `lastBackupDir` points at — everything else is unreachable
+	* by construction (no pointer ⇒ neither `rollbackAddon` nor `clearBackup`
+	* can ever reach it). One exception: when the addon's LIVE install dir is
+	* missing, the newest backup is the only surviving copy of that addon (a
+	* crash between the rename-aside and the manifest write in `applyUpdate`),
+	* so it is kept instead of reclaimed.
+	*
+	* Why not "delete everything once the addon is healthy": this installer
+	* has no health signal, and the pointed-at backup is precisely the one a
+	* failed update left for the operator's Rollback button. Bounding to one
+	* per addon is enough — the observed 814 MiB was duplicate copies, not a
+	* single retained rollback target.
+	*
+	* Never throws. Safe to run on every boot; runs before any update can be
+	* in flight.
+	*/
+	async sweepBackups() {
+		const removed = [];
+		const kept = [];
+		for (const packageName of this.listBackedUpPackages()) {
+			const backups = this.listBackupsFor(packageName);
+			if (backups.length === 0) {
+				await this.removeEmptyBackupDirs(packageName);
+				continue;
+			}
+			const keep = this.resolveBackupToKeep(packageName, backups);
+			for (const candidate of backups) {
+				if (keep != null && node_path.resolve(candidate) === node_path.resolve(keep)) {
+					kept.push(candidate);
+					continue;
+				}
+				if (await this.removeBackupPath(candidate, "boot-sweep")) removed.push(candidate);
+			}
+			await this.removeEmptyBackupDirs(packageName);
+		}
+		if (removed.length > 0 || kept.length > 0) this.logger.info(`Backup sweep — reclaimed ${removed.length}, retained ${kept.length} rollback target(s)`);
+		return {
+			removed,
+			kept
+		};
+	}
+	/**
+	* Which backup of `packageName` survives the sweep: the manifest's
+	* rollback target, or — when the live install is gone — the newest copy,
+	* which is then the only one that exists. `null` means "reclaim them all".
+	*/
+	resolveBackupToKeep(packageName, backups) {
+		const liveDir = node_path.join(this.addonsDir, packageName);
+		if (!node_fs.existsSync(liveDir)) {
+			const newest = backups[backups.length - 1] ?? null;
+			if (newest != null) this.logger.warn(`${packageName} — live install dir missing; retaining its newest backup as the only surviving copy`, { meta: {
+				liveDir,
+				backupDir: newest
+			} });
+			return newest;
+		}
+		const pointer = this.manifest.get(packageName)?.lastBackupDir;
+		if (pointer == null) return null;
+		const resolved = node_path.resolve(pointer);
+		return backups.some((b) => node_path.resolve(b) === resolved) ? pointer : null;
+	}
+	/** Package names that have a `.backups/{pkg}` directory, scoped or not. */
+	listBackedUpPackages() {
+		let entries;
+		try {
+			entries = node_fs.readdirSync(this.backupsRoot, { withFileTypes: true });
+		} catch {
+			return [];
+		}
+		const names = [];
+		for (const entry of entries) {
+			if (!entry.isDirectory()) continue;
+			if (!entry.name.startsWith("@")) {
+				names.push(entry.name);
+				continue;
+			}
+			const scopeDir = node_path.join(this.backupsRoot, entry.name);
+			for (const inner of node_fs.readdirSync(scopeDir, { withFileTypes: true })) if (inner.isDirectory()) names.push(`${entry.name}/${inner.name}`);
+		}
+		return names;
 	}
 	async uninstall(packageName) {
 		const addonDir = node_path.join(this.addonsDir, packageName);

package/dist/index.mjs

@@ -1,7 +1,8 @@
-import { At as scopeKey, B as logLevelAtMost, Ct as expandCapMethods, Dt as parseJsonUnknown$1, Et as parseJsonObject, F as isVoidInput, G as objectInputDeclaresAddonId, I as kebabToCamel, J as procedureAuthKey, L as lifecycleJobSchema, M as isArrayOutputSchema, Mt as EventCategory$1, N as isCollectionArrayMethod, Ot as readinessKey, P as isObjectInput, V as looseSchema, _t as asJsonObject$1, bt as createEvent, c as RUNTIME_DEFAULTS, ct as DATAPLANE_SECRET_HEADER$1, ht as ReadinessTimeoutError, k as extractNestedAddonId, kt as resolveCapMount, lt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, m as addonSettingsCapability, mt as ReadinessRegistry, ot as errMsg$1, s as METHOD_ACCESS_MAP, t as ALL_CAPABILITY_DEFINITIONS, ut as DEVICE_STATUS_METHOD, vt as asNumber, xt as emitDownForOwnedCaps, yt as asString$1 } from "./dist-eOaraBhT.mjs";
+import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
+import { At as scopeKey, B as logLevelAtMost, Ct as expandCapMethods, Dt as parseJsonUnknown$1, Et as parseJsonObject, F as isVoidInput, G as objectInputDeclaresAddonId, I as kebabToCamel, J as procedureAuthKey, L as lifecycleJobSchema, M as isArrayOutputSchema, Mt as EventCategory$1, N as isCollectionArrayMethod, Ot as readinessKey, P as isObjectInput, V as looseSchema, _t as asJsonObject$1, bt as createEvent, c as RUNTIME_DEFAULTS, ct as DATAPLANE_SECRET_HEADER$1, ht as ReadinessTimeoutError, k as extractNestedAddonId, kt as resolveCapMount, lt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, m as addonSettingsCapability, mt as ReadinessRegistry, ot as errMsg$1, s as METHOD_ACCESS_MAP, t as ALL_CAPABILITY_DEFINITIONS, ut as DEVICE_STATUS_METHOD, vt as asNumber, xt as emitDownForOwnedCaps, yt as asString$1 } from "./dist-BU-QPlE8.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-bn3qrsxR.mjs";
-import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Le3l0qS2.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-D7-WBIg_.mjs";
+import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, t as SqliteSettingsBackend } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
@@ -17,7 +18,7 @@ import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
-import { LocalAuthAddon, a as require_ms, c as __esmMin, d as __toCommonJS, f as __toESM$1, i as AuthManager, l as __exportAll, n as ApiKeyManager, o as require_safe_buffer, r as UserManager, s as __commonJSMin$1, t as ScopedTokenManager, u as __require } from "./builtins/local-auth/local-auth.addon.mjs";
+import { LocalAuthAddon, a as require_ms, i as AuthManager, n as ApiKeyManager, o as require_safe_buffer, r as UserManager, t as ScopedTokenManager } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
 import { DeviceManagerAddon } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
@@ -2725,21 +2726,26 @@ async function copyDirRecursive(src, dest) {
 	});
 }
 /**
-* Runtime natives that must stay installable even when an addon forgets to
-* declare them: the mirror of the build preset's `COMMON_NATIVE_DEPS`
-* (tools/build/vite-lib.preset.ts — build tooling, not loadable at runtime).
-* These are the ONLY packages a self-contained dist genuinely `require()`s
-* from node_modules; everything else is already inlined by the bundle.
+* Runtime deps a stripped addon package.json must KEEP so the installer still
+* `npm install`s them into the addon dir.
+*
+* Empty by design: every native an addon can import is now HOST-EXTERNAL
+* (node-av, sharp, node-pty — resolved from the framework closure via the
+* resolver hook, see host-externals.ts), and every pure-JS lib (ssh2, werift,
+* @simplewebauthn, mqtt, aws-sdk, …) is inlined by the self-contained vite
+* bundle. So a self-contained dist requires NOTHING from a local node_modules —
+* `addons/` stays node_modules-free, which is what lets the backup tar the whole
+* folder with no exclusion list (see ADR-0027). An addon that genuinely needs an
+* un-bundleable runtime dep declares it explicitly in
+* `camstack.runtimeDependencies`; the debug escape hatch
+* `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy install-everything path.
+*
+* (Historically this mirrored the build preset's COMMON_NATIVE_DEPS and
+* per-addon-installed node-av/sharp/onnxruntime-node/ssh2/werift/systeminformation
+* — 74k files / 1.34 GB of redundant node_modules on the live hub. That redundancy
+* is removed: the natives come from the framework, the pure-JS from the bundle.)
 */
-var RUNTIME_NATIVE_KEEP = [
-	"better-sqlite3",
-	"node-av",
-	"onnxruntime-node",
-	"sharp",
-	"ssh2",
-	"werift",
-	"systeminformation"
-];
+var RUNTIME_NATIVE_KEEP = [];
 /** Read `camstack.runtimeDependencies` (extra non-native deps the dist
 *  requires at runtime — versions come from the manifest's own dep maps). */
 function readRuntimeDependencies(pkg) {
@@ -3926,10 +3932,14 @@ var AddonInstaller = class AddonInstaller {
 	*   1. Rename current install dir → {addonsDir}/.backups/{name}/{ts}/
 	*   2. Run a fresh install (npm or local depending on installSource)
 	*   3. Record `lastBackupDir` in the manifest entry
+	*   4. Prune every OTHER backup of this addon — the previous one just
+	*      lost its only pointer and would otherwise be orphaned forever.
 	*
-	* The post-install caller (kernel.restartAddon + health-check) is
-	* responsible for verifying the new version actually works and for
-	* triggering `rollbackAddon()` if the health check fails.
+	* The post-install caller (restart + health-check) is responsible for
+	* verifying the new version actually works, and for calling either
+	* `clearBackup()` on success or `rollbackAddon()` on failure. This
+	* method must NOT delete the backup itself: at this point the new
+	* version has not been proven to work.
 	*
 	* Throws if there is no installed version to update — caller should
 	* prefer plain `install()` for first-time installs.
@@ -3982,6 +3992,7 @@ var AddonInstaller = class AddonInstaller {
 			source: this.manifest.get(packageName)?.source ?? "npm",
 			lastBackupDir: backupDir
 		});
+		await this.pruneBackups(packageName, backupDir);
 		return {
 			name: result.name,
 			version: result.version,
@@ -4052,6 +4063,7 @@ var AddonInstaller = class AddonInstaller {
 			source: this.manifest.get(packageName)?.source ?? "npm",
 			lastBackupDir: backupDir
 		});
+		await this.pruneBackups(packageName, backupDir);
 		return {
 			name: packageName,
 			version,
@@ -4098,23 +4110,204 @@ var AddonInstaller = class AddonInstaller {
 		this.logger.info(`${packageName} — rolled back to v${restoredVersion}`);
 		return restoredVersion;
 	}
+	/** Root of the pre-update rollback copies: `{addonsDir}/.backups`. */
+	get backupsRoot() {
+		return path$39.join(this.addonsDir, ".backups");
+	}
+	/**
+	* True only when `target` resolves to something strictly INSIDE
+	* `{addonsDir}/.backups/`.
+	*
+	* Every deletion in this section funnels through here. `lastBackupDir`
+	* is read back from a manifest file on disk — an operator edit, a
+	* restored manifest from another host, or a `..` in the recorded path
+	* must never turn "reclaim a backup" into "delete the live install".
+	*/
+	isInsideBackups(target) {
+		const rel = path$39.relative(path$39.resolve(this.backupsRoot), path$39.resolve(target));
+		return rel !== "" && !rel.startsWith("..") && !path$39.isAbsolute(rel);
+	}
 	/**
-	* Drop the recorded backup for an addon (e.g. after a successful
-	* post-update health check confirms the new version is healthy).
-	* Frees disk space without affecting the running install.
+	* Best-effort removal of one path under `.backups/`.
+	*
+	* Never throws: an undeleted backup is a disk-space problem, whereas a
+	* throw on the post-update success path would turn a working update into
+	* a reported outage. Returns true only when the path is gone.
+	*/
+	async removeBackupPath(target, reason) {
+		if (!this.isInsideBackups(target)) {
+			this.logger.error("Refusing to remove a backup path outside .backups/", { meta: {
+				target,
+				backupsRoot: this.backupsRoot,
+				reason
+			} });
+			return false;
+		}
+		try {
+			await fs$17.promises.rm(target, {
+				recursive: true,
+				force: true
+			});
+			return true;
+		} catch (err) {
+			this.logger.warn("Backup removal failed; leaving residue for the next boot sweep", { meta: {
+				target,
+				reason,
+				error: errMsg$1(err)
+			} });
+			return false;
+		}
+	}
+	/** List the timestamped backup dirs recorded for one package. */
+	listBackupsFor(packageName) {
+		const dir = path$39.join(this.backupsRoot, packageName);
+		try {
+			return fs$17.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path$39.join(dir, e.name)).sort();
+		} catch {
+			return [];
+		}
+	}
+	/**
+	* Keep at most ONE backup per addon: drop every backup dir for
+	* `packageName` except `keepDir`.
+	*
+	* Called right after a new backup is recorded. Without this, a second
+	* update overwrites `lastBackupDir` and the previous backup becomes
+	* unreachable — no pointer, so neither `rollbackAddon` nor `clearBackup`
+	* can ever see it again. That is how the live hub accumulated two 398 MiB
+	* copies of one addon. Never throws.
+	*/
+	async pruneBackups(packageName, keepDir) {
+		const keep = keepDir == null ? null : path$39.resolve(keepDir);
+		const removed = [];
+		for (const candidate of this.listBackupsFor(packageName)) {
+			if (keep != null && path$39.resolve(candidate) === keep) continue;
+			if (await this.removeBackupPath(candidate, "superseded-backup")) removed.push(candidate);
+		}
+		if (removed.length > 0) this.logger.info(`${packageName} — pruned ${removed.length} superseded backup(s)`);
+		await this.removeEmptyBackupDirs(packageName);
+		return removed;
+	}
+	/** Drop `.backups/{pkg}` (and its `@scope` parent) once they are empty. */
+	async removeEmptyBackupDirs(packageName) {
+		const pkgDir = path$39.join(this.backupsRoot, packageName);
+		for (const dir of [pkgDir, path$39.dirname(pkgDir)]) {
+			if (!this.isInsideBackups(dir)) continue;
+			try {
+				await fs$17.promises.rmdir(dir);
+			} catch {
+				return;
+			}
+		}
+	}
+	/**
+	* Drop the recorded backup for an addon — call once the post-update
+	* health check confirms the new version actually works.
+	*
+	* Never throws and never rejects. The manifest pointer is cleared even
+	* when the bytes could not be removed: a pointer at a half-deleted tree
+	* would make `rollbackAddon` restore a gutted install, and the boot sweep
+	* reclaims the residue on the next start.
 	*/
-	clearBackup(packageName) {
+	async clearBackup(packageName) {
 		const entry = this.manifest.get(packageName);
 		if (entry?.lastBackupDir == null) return;
-		if (fs$17.existsSync(entry.lastBackupDir)) fs$17.rmSync(entry.lastBackupDir, {
-			recursive: true,
-			force: true
-		});
-		this.manifest.upsert(packageName, {
-			version: entry.version,
-			source: entry.source,
-			lastBackupDir: void 0
-		});
+		if (await this.removeBackupPath(entry.lastBackupDir, "update-confirmed")) this.logger.info(`${packageName} — update confirmed, backup reclaimed`, { meta: { backupDir: entry.lastBackupDir } });
+		try {
+			this.manifest.upsert(packageName, {
+				version: entry.version,
+				source: entry.source,
+				lastBackupDir: void 0
+			});
+		} catch (err) {
+			this.logger.warn(`${packageName} — could not clear the backup pointer`, { meta: { error: errMsg$1(err) } });
+		}
+		await this.removeEmptyBackupDirs(packageName);
+	}
+	/**
+	* Boot-time retention sweep over `{addonsDir}/.backups/`.
+	*
+	* RULE: for each addon, the ONLY backup that survives is the one the
+	* manifest's `lastBackupDir` points at — everything else is unreachable
+	* by construction (no pointer ⇒ neither `rollbackAddon` nor `clearBackup`
+	* can ever reach it). One exception: when the addon's LIVE install dir is
+	* missing, the newest backup is the only surviving copy of that addon (a
+	* crash between the rename-aside and the manifest write in `applyUpdate`),
+	* so it is kept instead of reclaimed.
+	*
+	* Why not "delete everything once the addon is healthy": this installer
+	* has no health signal, and the pointed-at backup is precisely the one a
+	* failed update left for the operator's Rollback button. Bounding to one
+	* per addon is enough — the observed 814 MiB was duplicate copies, not a
+	* single retained rollback target.
+	*
+	* Never throws. Safe to run on every boot; runs before any update can be
+	* in flight.
+	*/
+	async sweepBackups() {
+		const removed = [];
+		const kept = [];
+		for (const packageName of this.listBackedUpPackages()) {
+			const backups = this.listBackupsFor(packageName);
+			if (backups.length === 0) {
+				await this.removeEmptyBackupDirs(packageName);
+				continue;
+			}
+			const keep = this.resolveBackupToKeep(packageName, backups);
+			for (const candidate of backups) {
+				if (keep != null && path$39.resolve(candidate) === path$39.resolve(keep)) {
+					kept.push(candidate);
+					continue;
+				}
+				if (await this.removeBackupPath(candidate, "boot-sweep")) removed.push(candidate);
+			}
+			await this.removeEmptyBackupDirs(packageName);
+		}
+		if (removed.length > 0 || kept.length > 0) this.logger.info(`Backup sweep — reclaimed ${removed.length}, retained ${kept.length} rollback target(s)`);
+		return {
+			removed,
+			kept
+		};
+	}
+	/**
+	* Which backup of `packageName` survives the sweep: the manifest's
+	* rollback target, or — when the live install is gone — the newest copy,
+	* which is then the only one that exists. `null` means "reclaim them all".
+	*/
+	resolveBackupToKeep(packageName, backups) {
+		const liveDir = path$39.join(this.addonsDir, packageName);
+		if (!fs$17.existsSync(liveDir)) {
+			const newest = backups[backups.length - 1] ?? null;
+			if (newest != null) this.logger.warn(`${packageName} — live install dir missing; retaining its newest backup as the only surviving copy`, { meta: {
+				liveDir,
+				backupDir: newest
+			} });
+			return newest;
+		}
+		const pointer = this.manifest.get(packageName)?.lastBackupDir;
+		if (pointer == null) return null;
+		const resolved = path$39.resolve(pointer);
+		return backups.some((b) => path$39.resolve(b) === resolved) ? pointer : null;
+	}
+	/** Package names that have a `.backups/{pkg}` directory, scoped or not. */
+	listBackedUpPackages() {
+		let entries;
+		try {
+			entries = fs$17.readdirSync(this.backupsRoot, { withFileTypes: true });
+		} catch {
+			return [];
+		}
+		const names = [];
+		for (const entry of entries) {
+			if (!entry.isDirectory()) continue;
+			if (!entry.name.startsWith("@")) {
+				names.push(entry.name);
+				continue;
+			}
+			const scopeDir = path$39.join(this.backupsRoot, entry.name);
+			for (const inner of fs$17.readdirSync(scopeDir, { withFileTypes: true })) if (inner.isDirectory()) names.push(`${entry.name}/${inner.name}`);
+		}
+		return names;
 	}
 	async uninstall(packageName) {
 		const addonDir = path$39.join(this.addonsDir, packageName);