@camstack/system 1.2.164 → 1.2.166

package/dist/{manifest-system-deps-Bk_XLYbB.mjs → manifest-system-deps-DTz_zNQf.mjs}

@@ -1,4 +1,4 @@
-import "./dist-BpsHt11f.mjs";
+import "./dist-Dw9cm1NS.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomBytes, randomUUID } from "node:crypto";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -8,6 +8,7 @@ import { isAbsolute, join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";
+import { existsSync } from "node:fs";
 import * as os from "node:os";
 import { tmpdir } from "node:os";
 import { createServer } from "node:http";
@@ -15,7 +16,7 @@ import * as v8 from "node:v8";
 import { monitorEventLoopDelay } from "node:perf_hooks";
 import * as vm from "node:vm";
 import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DeviceType, DisposerChain, EventCategory, ReadinessRegistry, asJsonObject, asString, createDeviceProxy, createEventBusSliceSource, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, readNodePin, scopeKey, sleep, withCapInputDefaults } from "@camstack/types/addon";
-import { connect, createServer as createServer$1 } from "node:net";
+import { connect, createConnection, createServer as createServer$1 } from "node:net";
 import { TRPCClientError, createTRPCClient } from "@trpc/client";
 //#region src/kernel/event-plane-report.ts
 /**
@@ -9694,6 +9695,106 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 	await deps.installPythonRequirements(reqAbs);
 }
 //#endregion
+//#region src/kernel/deps/system-package-allowlist.ts
+var DISTRO_PACKAGE_ALLOWLIST = {
+	apt: ["smbclient"],
+	apk: ["samba-client"],
+	dnf: ["samba-client"]
+};
+function packageIsAllowlisted(manager, packageName) {
+	if (manager === "brew") return true;
+	if (packageName.length === 0) return false;
+	if (!/^[a-zA-Z0-9][a-zA-Z0-9+._-]*$/.test(packageName)) return false;
+	return DISTRO_PACKAGE_ALLOWLIST[manager].includes(packageName);
+}
+//#endregion
+//#region src/kernel/deps/system-package-broker.ts
+/**
+* Who is allowed to run the package manager for this request.
+*
+* Apt/apk/dnf need root. In the CamStack container that is the
+* `camstack-pkgd` helper, not the runner and not hub-main (both uid
+* 1001). Brew is owned by the logged-in user, so it stays in-process.
+*/
+function decidePackageInstall(input) {
+	if (input.manager === "brew") return { kind: "local" };
+	if (!packageIsAllowlisted(input.manager, input.packageName)) return {
+		kind: "refuse",
+		reason: "not-allowlisted"
+	};
+	if (!input.helperAvailable) return {
+		kind: "refuse",
+		reason: "helper-unavailable"
+	};
+	return { kind: "helper" };
+}
+function pkgdSocketPath() {
+	return process.env["CAMSTACK_PKGD_SOCKET"] ?? "/run/camstack/pkgd.sock";
+}
+function privilegedHelperAvailable(socketPath = pkgdSocketPath()) {
+	return existsSync(socketPath);
+}
+/**
+* One JSON object per line. The helper answers one request per connection.
+*/
+function requestPrivilegedInstall(req, socketPath = pkgdSocketPath(), timeoutMs = 360 * 1e3) {
+	return new Promise((resolve) => {
+		const socket = createConnection({ path: socketPath });
+		const chunks = [];
+		const finish = (result) => {
+			socket.destroy();
+			resolve(result);
+		};
+		const timer = setTimeout(() => {
+			finish({
+				ok: false,
+				error: `privileged helper timed out after ${timeoutMs}ms`
+			});
+		}, timeoutMs);
+		socket.on("connect", () => {
+			socket.write(`${JSON.stringify({
+				v: 1,
+				...req
+			})}\n`);
+		});
+		socket.on("data", (data) => {
+			chunks.push(data);
+			const text = Buffer.concat(chunks).toString("utf8");
+			const nl = text.indexOf("\n");
+			if (nl === -1) return;
+			clearTimeout(timer);
+			try {
+				const parsed = JSON.parse(text.slice(0, nl));
+				finish({
+					ok: parsed.ok === true,
+					...parsed.error !== void 0 ? { error: parsed.error } : {}
+				});
+			} catch (err) {
+				finish({
+					ok: false,
+					error: err instanceof Error ? err.message : String(err)
+				});
+			}
+		});
+		socket.on("error", (err) => {
+			clearTimeout(timer);
+			finish({
+				ok: false,
+				error: err.message
+			});
+		});
+		socket.on("end", () => {
+			if (chunks.length === 0) {
+				clearTimeout(timer);
+				finish({
+					ok: false,
+					error: "privileged helper closed without a reply"
+				});
+			}
+		});
+	});
+}
+//#endregion
 //#region src/kernel/deps/manifest-system-deps.ts
 /**
 * Auto-install the host binaries declared in an addon's manifest
@@ -9724,6 +9825,9 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 *  4. **Platform reality is stated, not assumed.** An unsupported host logs
 *     which manager it looked for and continues. Silence would read as
 *     "installed".
+*  5. **Apt is not the runner's.** Distro package managers need root. The
+*     runner and hub-main are uid 1001 (`gosu` in the entrypoint). Apt/apk/dnf
+*     go through `camstack-pkgd` (allowlisted). Brew stays in-process.
 *
 * Every branch that declines to install SAYS SO. A dependency step that
 * produced no line at all is indistinguishable from one that never ran, and
@@ -9746,12 +9850,16 @@ async function installManifestSystemDeps(declaration, logger, options = {}) {
 	const detectManager = options.detectManager ?? defaultDetectManager;
 	const run = options.run ?? defaultRun;
 	const platform = options.platform ?? process.platform;
+	const helperAvailable = options.helperAvailable ?? (async () => privilegedHelperAvailable());
+	const requestInstall = options.requestInstall ?? ((req) => requestPrivilegedInstall(req));
 	for (const dep of deps) try {
 		await satisfyOne(dep, declaration.id, {
 			hasBinary,
 			detectManager,
 			run,
-			platform
+			platform,
+			helperAvailable,
+			requestInstall
 		}, logger);
 	} catch (err) {
 		logger.warn("system dependency step failed", { meta: {
@@ -9789,15 +9897,43 @@ async function satisfyOne(dep, addonId, rt, logger) {
 		} });
 		return;
 	}
-	const plan = planFor(manager, packageName);
+	const decision = decidePackageInstall({
+		manager,
+		packageName,
+		helperAvailable: await rt.helperAvailable()
+	});
+	if (decision.kind === "refuse") {
+		const message = decision.reason === "helper-unavailable" ? "system dependency missing and the privileged helper is not running — apt cannot run as uid 1001" : "system dependency missing and the package is not on the helper allowlist";
+		logger.warn(message, { meta: {
+			addonId,
+			binary: dep.binary,
+			manager,
+			package: packageName,
+			reason: decision.reason,
+			...dep.reason !== void 0 ? { reason: dep.reason } : {}
+		} });
+		return;
+	}
 	logger.info("installing system dependency", { meta: {
 		addonId,
 		binary: dep.binary,
 		manager,
-		package: packageName
+		package: packageName,
+		via: decision.kind
 	} });
 	try {
-		for (const [command, args] of plan.steps) await rt.run(command, args);
+		if (decision.kind === "helper") {
+			const result = await rt.requestInstall({
+				addonId,
+				binary: dep.binary,
+				manager,
+				packageName
+			});
+			if (!result.ok) throw new Error(result.error ?? "privileged helper refused");
+		} else {
+			const plan = planFor(manager, packageName);
+			for (const [command, args] of plan.steps) await rt.run(command, args);
+		}
 	} catch (err) {
 		logger.warn("system dependency install failed — the addon loads, its capability must refuse", { meta: {
 			addonId,

package/dist/{retired-settings-keys-CqDbI-vK.js → retired-settings-keys-dehyu2N3.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BhE8zNfY.js");
+const require_dist = require("./dist-CFTKQGym.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-DLwieFXR.mjs → retired-settings-keys-diW1NmyP.mjs}

@@ -1,4 +1,4 @@
-import { Ht as asJsonObject } from "./dist-BpsHt11f.mjs";
+import { Ut as asJsonObject } from "./dist-Dw9cm1NS.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.164",
+  "version": "1.2.166",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",