@camstack/system 1.2.57 → 1.2.59

package/dist/index.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BupxnZOi.js");
-const require_model_download_service = require("./model-download-service-hf0ookyy.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BqE5j0-O.js");
+const require_dist = require("./dist-CV6XTApk.js");
+const require_model_download_service = require("./model-download-service-Cpc6SWzV.js");
+const require_manifest_python_deps = require("./manifest-python-deps-d4acYXVV.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
@@ -32,13 +32,13 @@ let node_v8 = require("node:v8");
 node_v8 = require_chunk.__toESM(node_v8);
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
+let node_crypto = require("node:crypto");
 let node_http = require("node:http");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path, 1);
-let node_crypto = require("node:crypto");
 let _camstack_types_addon = require("@camstack/types/addon");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
@@ -3231,6 +3231,21 @@ async function installPackageFromNpm(packageName, targetDir) {
 //#region src/kernel/addon-manifest.ts
 var MANIFEST_FILENAME = "manifest.json";
 var MANIFEST_VERSION = 1;
+/**
+* Is `p` a directory, FOLLOWING symlinks?
+*
+* `Dirent.isDirectory()` answers false for a symlink, and dev installs
+* (`installSymlink`) point `addonsDir/@camstack/<pkg>` straight at the
+* workspace source. Trusting the dirent there finds zero addons on disk, which
+* with pruning would empty a developer's manifest on the next boot.
+*/
+function isDirLike(p) {
+	try {
+		return node_fs.statSync(p).isDirectory();
+	} catch {
+		return false;
+	}
+}
 var AddonManifest = class {
 	manifestPath;
 	cache = null;
@@ -3320,35 +3335,48 @@ var AddonManifest = class {
 		this.cache = null;
 	}
 	/**
-	* Reconcile the manifest with what is actually present on disk.
+	* Reconcile the manifest against what is actually present on disk.
 	*
-	* For every `@scope/<pkg>` directory under `addonsDir` that has a
-	* readable `package.json` but NO manifest entry yet, add one with
-	* source `'seed'`. Existing entries are left untouched (their source,
-	* version and timestamps are authoritative — a later install/update
-	* overwrites them through `upsert`).
+	* **The directory is the truth.** It is what `AddonLoader` runs; a manifest
+	* that disagrees with it is a lie the update flow and the admin UI then
+	* repeat. Three corrections, all idempotent and safe on every boot:
 	*
-	* Why this exists: addons baked into the Docker/Electron image are
-	* copied straight into `addonsDir` by the container entrypoint (the
-	* launcher's `ensureRequiredPackages` then sees `package.json` already
-	* present and skips, never calling `upsert`). Without this reconcile
-	* those seeded addons stay absent from the manifest, so `applyUpdate`
-	* rejects them with "not currently tracked in manifest" — which is
-	* exactly what broke "Update all" on a fresh image. Idempotent and
-	* safe to run on every boot.
+	*  - **added** — an on-disk addon with no entry gets one, source `'seed'`.
+	*    Addons baked into the Docker/Electron image are copied straight into
+	*    `addonsDir` by the container entrypoint (`ensureRequiredPackages` then
+	*    sees `package.json` present and skips, never calling `upsert`), so they
+	*    would otherwise stay untracked and `applyUpdate` would reject them with
+	*    "not currently tracked in manifest" — what broke "Update all" on a
+	*    fresh image.
+	*  - **version-corrected** — an entry whose version disagrees with the
+	*    installed `package.json` adopts the DISK version. Provenance (`source`,
+	*    `installedAt`) is NOT derivable from disk and stays authoritative here;
+	*    `updatedAt` is left alone because the correction is not an update, and
+	*    stamping `now` would claim an install that never happened.
+	*  - **pruned** — an entry naming a directory that does not exist. The live
+	*    hub carried three (`@camstack/system 1.2.29`, `addon-viewer-ui 1.1.39`,
+	*    `addon-agent-ui 1.2.4`); `@camstack/system` in particular is
+	*    host-provided and deliberately NOT seeded under `addonsDir`
+	*    ([D45]), so its entry advertised a copy that must not exist.
+	*    An entry holding a `lastBackupDir` is NEVER pruned: that pointer is the
+	*    only reference to a pre-update backup, and the launcher's backup sweep
+	*    reclaims anything the manifest does not point at.
 	*
-	* Returns the number of entries added.
+	* `onChange` receives one record per correction, so the caller can log
+	* exactly what moved. Returns the total number of changes.
 	*/
-	reconcileFromDisk(addonsDir) {
+	reconcileFromDisk(addonsDir, onChange) {
 		if (!node_fs.existsSync(addonsDir)) return 0;
 		const m = this.read();
-		let added = 0;
+		let changes = 0;
 		const now = (/* @__PURE__ */ new Date()).toISOString();
+		/** Package name → version, for every ADDON package actually installed. */
+		const onDisk = /* @__PURE__ */ new Map();
 		for (const scope of node_fs.readdirSync(addonsDir, { withFileTypes: true })) {
-			if (!scope.isDirectory() || !scope.name.startsWith("@")) continue;
+			if (!scope.name.startsWith("@") || !isDirLike(node_path.join(addonsDir, scope.name))) continue;
 			const scopeDir = node_path.join(addonsDir, scope.name);
 			for (const pkg of node_fs.readdirSync(scopeDir, { withFileTypes: true })) {
-				if (!pkg.isDirectory()) continue;
+				if (!isDirLike(node_path.join(scopeDir, pkg.name))) continue;
 				const pkgJsonPath = node_path.join(scopeDir, pkg.name, "package.json");
 				if (!node_fs.existsSync(pkgJsonPath)) continue;
 				let pkgJson;
@@ -3362,22 +3390,57 @@ var AddonManifest = class {
 				if (!pkgJson.name || !pkgJson.version) continue;
 				const addons = pkgJson.camstack?.addons;
 				if (!Array.isArray(addons) || addons.length === 0) continue;
-				if (m.addons[pkgJson.name] != null) continue;
-				m.addons[pkgJson.name] = {
-					name: pkgJson.name,
-					version: pkgJson.version,
+				onDisk.set(pkgJson.name, pkgJson.version);
+			}
+		}
+		for (const [name, version] of onDisk) {
+			const prev = m.addons[name];
+			if (prev == null) {
+				m.addons[name] = {
+					name,
+					version,
 					source: "seed",
 					installedAt: now,
 					updatedAt: now
 				};
-				added++;
+				changes++;
+				onChange?.({
+					kind: "added",
+					name,
+					to: version
+				});
+				continue;
+			}
+			if (prev.version !== version) {
+				m.addons[name] = {
+					...prev,
+					version
+				};
+				changes++;
+				onChange?.({
+					kind: "version-corrected",
+					name,
+					from: prev.version,
+					to: version
+				});
 			}
 		}
-		if (added > 0) {
+		for (const [name, entry] of Object.entries(m.addons)) {
+			if (onDisk.has(name)) continue;
+			if (entry.lastBackupDir) continue;
+			delete m.addons[name];
+			changes++;
+			onChange?.({
+				kind: "pruned",
+				name,
+				from: entry.version
+			});
+		}
+		if (changes > 0) {
 			m.updatedAt = now;
 			this.write(m);
 		}
-		return added;
+		return changes;
 	}
 	/**
 	* Migration helper: if the manifest is empty but the addons directory
@@ -3760,6 +3823,34 @@ var noopLogger = {
 		return noopLogger;
 	}
 };
+/**
+* A staging tree younger than this may belong to an install still running —
+* possibly in another process. Only older trees are residue worth sweeping.
+* Generous on purpose: an addon's runtime-dependency `npm install` on a slow
+* host is minutes, and the cost of leaving residue one deploy longer is disk,
+* while the cost of sweeping a live one is a FAILED deploy.
+*/
+var STAGING_RESIDUE_MIN_AGE_MS = 30 * 6e4;
+/**
+* Pick the staging entries that are safe to delete.
+*
+* `installFromTgz` used to clear the WHOLE `.staging` root before creating its
+* own dir. Two deploys arriving within one install's lifetime — the normal case
+* when the hub propagates two packages back to back — meant the second one
+* deleted the first one's tree out from under its running `npm install`:
+*
+*   npm error code ENOENT
+*   npm error path …/.staging/install-14820-2026-08-07T12-28-28-875Z/package/package.json
+*
+* which the propagation then reported as `runtime dependency install failed`.
+* Observed on the Mac desktop agent and on little-unraid on 2026-08-07.
+*
+* So a sweep only removes what cannot be live: not a tree this process is
+* building, and not one young enough to belong to anybody's in-flight install.
+*/
+function selectSweepableStaging(entries, inFlight, minAgeMs = STAGING_RESIDUE_MIN_AGE_MS) {
+	return entries.filter((entry) => !inFlight.has(entry.name) && entry.ageMs >= minAgeMs).map((entry) => entry.name);
+}
 var AddonInstaller = class AddonInstaller {
 	addonsDir;
 	registry;
@@ -3776,6 +3867,11 @@ var AddonInstaller = class AddonInstaller {
 	* `getAddonInstallSource`).
 	*/
 	manifest;
+	/**
+	* Basenames under `.staging` this process is currently building. Never swept
+	* — see {@link selectSweepableStaging}.
+	*/
+	inFlightStaging = /* @__PURE__ */ new Set();
 	constructor(config, logger = noopLogger) {
 		this.addonsDir = config.addonsDir;
 		this.registry = config.registry;
@@ -3934,19 +4030,34 @@ var AddonInstaller = class AddonInstaller {
 		}
 	}
 	/**
-	* Reconcile the install manifest with the addons actually present on
-	* disk. Seeded addons (baked into the image and copied verbatim by the
-	* container entrypoint) never pass through an `install*` codepath, so
-	* they are missing from `manifest.json` and `applyUpdate` would reject
-	* them with "not currently tracked in manifest". Call this once after
-	* `ensureRequiredPackages` so every on-disk addon is updatable.
+	* Reconcile the install manifest against the addons actually present on
+	* disk: register seeded addons, correct a version that disagrees with the
+	* installed `package.json`, and drop entries naming a directory that does
+	* not exist. Call once after `ensureRequiredPackages`, before any update
+	* can be in flight. See `AddonManifest.reconcileFromDisk` for the rules.
 	*
-	* Returns the number of manifest entries added.
+	* Every correction is logged by name — a manifest that silently disagreed
+	* with disk is what made "@camstack/system 1.2.29" read as installed on a
+	* hub that deliberately has no copy of it.
+	*
+	* Returns the number of changes.
 	*/
 	reconcileManifest() {
-		const added = this.manifest.reconcileFromDisk(this.addonsDir);
-		if (added > 0) this.logger.info(`Manifest reconciled — ${added} seeded addon(s) registered`);
-		return added;
+		const changes = this.manifest.reconcileFromDisk(this.addonsDir, (c) => {
+			switch (c.kind) {
+				case "added":
+					this.logger.info(`Manifest — registered seeded addon ${c.name}@${c.to}`);
+					break;
+				case "version-corrected":
+					this.logger.info(`Manifest — ${c.name} recorded ${c.from} but disk has ${c.to}; adopting disk`);
+					break;
+				case "pruned":
+					this.logger.info(`Manifest — dropped ${c.name}@${c.from}: no install directory on disk`);
+					break;
+			}
+		});
+		if (changes > 0) this.logger.info(`Manifest reconciled — ${changes} correction(s)`);
+		return changes;
 	}
 	/**
 	* Install a single addon — on-demand installer used by AddonPackageService
@@ -4184,6 +4295,40 @@ var AddonInstaller = class AddonInstaller {
 			} });
 		});
 	}
+	/**
+	* Best-effort removal of `.staging` residue left by a CRASHED earlier deploy.
+	*
+	* Deliberately not `sweepGraveyard`: an evicted `.evicting/*` dir is dead by
+	* construction, but a `.staging/*` dir may be an install still running — in
+	* this process or another one. Deleting one of those fails a live deploy with
+	* an ENOENT on its own package.json, which is what happened on 2026-08-07.
+	*/
+	async sweepStagingResidue(stagingRoot) {
+		let names;
+		try {
+			names = node_fs.readdirSync(stagingRoot);
+		} catch {
+			return;
+		}
+		const now = Date.now();
+		const ages = [];
+		for (const name of names) try {
+			const stat = node_fs.statSync(node_path.join(stagingRoot, name));
+			ages.push({
+				name,
+				ageMs: now - stat.mtimeMs
+			});
+		} catch {}
+		const sweepable = selectSweepableStaging(ages, this.inFlightStaging);
+		if (sweepable.length > 0) this.logger.info("sweeping staging residue from a crashed earlier deploy", { meta: {
+			stagingRoot,
+			entries: sweepable
+		} });
+		await Promise.all(sweepable.map((name) => node_fs.promises.rm(node_path.join(stagingRoot, name), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0)));
+	}
 	/** Best-effort removal of leftover `.evicting/*` dirs from earlier deploys. */
 	async sweepGraveyard(graveyard) {
 		let entries;
@@ -4201,9 +4346,11 @@ var AddonInstaller = class AddonInstaller {
 	async installFromTgz(tgzPath) {
 		const stagingRoot = node_path.join(this.addonsDir, ".staging");
 		ensureDir(stagingRoot);
-		await this.sweepGraveyard(stagingRoot);
-		const stagingDir = node_path.join(stagingRoot, `install-${process.pid}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`);
+		await this.sweepStagingResidue(stagingRoot);
+		const stagingName = `install-${process.pid}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+		const stagingDir = node_path.join(stagingRoot, stagingName);
 		ensureDir(stagingDir);
+		this.inFlightStaging.add(stagingName);
 		try {
 			await execFileAsync("tar", [
 				"-xzf",
@@ -4258,6 +4405,7 @@ var AddonInstaller = class AddonInstaller {
 				version: pkgView.version
 			};
 		} finally {
+			this.inFlightStaging.delete(stagingName);
 			await node_fs.promises.rm(stagingDir, {
 				recursive: true,
 				force: true