@camstack/system 1.2.57 → 1.2.59

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { B as kebabToCamel, Ct as asString$1, Dt as expandCapMethods, Ft as scopeKey, G as looseSchema, I as isArrayOutputSchema, J as objectInputDeclaresAddonId, L as isCollectionArrayMethod, Lt as EventCategory$1, Mt as parseJsonUnknown$1, N as extractNestedAddonId, Nt as readinessKey, Pt as resolveCapMount, R as isObjectInput, St as asNumber, Tt as emitDownForOwnedCaps, V as lifecycleJobSchema, W as logLevelAtMost, Z as procedureAuthKey, c as METHOD_ACCESS_MAP, ft as DATAPLANE_SECRET_HEADER$1, h as addonSettingsCapability, jt as parseJsonObject, l as RUNTIME_DEFAULTS, mt as DEVICE_STATUS_METHOD, pt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, ut as errMsg$1, vt as ReadinessRegistry, wt as createEvent, xt as asJsonObject$1, yt as ReadinessTimeoutError, z as isVoidInput } from "./dist-DhL_zGRT.mjs";
-import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Ck4-9K9m.mjs";
+import { $ as procedureAuthKey, Ct as asJsonObject$1, Dt as emitDownForOwnedCaps, Et as createEvent, Ft as readinessKey, H as kebabToCamel, It as resolveCapMount, K as logLevelAtMost, L as isArrayOutputSchema, Lt as scopeKey, Nt as parseJsonObject, P as extractNestedAddonId, Pt as parseJsonUnknown$1, R as isCollectionArrayMethod, Tt as asString$1, U as lifecycleJobSchema, V as isVoidInput, X as objectInputDeclaresAddonId, bt as ReadinessRegistry, c as METHOD_ACCESS_MAP, ft as errMsg$1, gt as DEVICE_STATUS_METHOD, h as addonSettingsCapability, ht as DEVICE_SETTINGS_CONTRIBUTION_METHODS, kt as expandCapMethods, l as RUNTIME_DEFAULTS, mt as DATAPLANE_SECRET_HEADER$1, q as looseSchema, t as ALL_CAPABILITY_DEFINITIONS, wt as asNumber, xt as ReadinessTimeoutError, z as isObjectInput, zt as EventCategory$1 } from "./dist-BqJJWCS8.mjs";
+import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-D8B-4ktF.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-CX5tGRqf.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { SqliteSettingsAddon, t as SqliteSettingsBackend } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
+import { SqliteSettingsAddon, o as SqliteSettingsBackend } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
@@ -30,12 +30,12 @@ import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs
 import * as v8 from "node:v8";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { z } from "zod";
+import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { request } from "node:http";
 import * as fs$17 from "node:fs";
 import { accessSync, constants, existsSync, mkdirSync, readFileSync } from "node:fs";
 import * as path$39 from "node:path";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { asJsonObject, errMsg, parseJsonUnknown } from "@camstack/types/addon";
 import { execFile, spawn } from "node:child_process";
 import * as util$10 from "node:util";
@@ -3223,6 +3223,21 @@ async function installPackageFromNpm(packageName, targetDir) {
 //#region src/kernel/addon-manifest.ts
 var MANIFEST_FILENAME = "manifest.json";
 var MANIFEST_VERSION = 1;
+/**
+* Is `p` a directory, FOLLOWING symlinks?
+*
+* `Dirent.isDirectory()` answers false for a symlink, and dev installs
+* (`installSymlink`) point `addonsDir/@camstack/<pkg>` straight at the
+* workspace source. Trusting the dirent there finds zero addons on disk, which
+* with pruning would empty a developer's manifest on the next boot.
+*/
+function isDirLike(p) {
+	try {
+		return fs$17.statSync(p).isDirectory();
+	} catch {
+		return false;
+	}
+}
 var AddonManifest = class {
 	manifestPath;
 	cache = null;
@@ -3312,35 +3327,48 @@ var AddonManifest = class {
 		this.cache = null;
 	}
 	/**
-	* Reconcile the manifest with what is actually present on disk.
+	* Reconcile the manifest against what is actually present on disk.
 	*
-	* For every `@scope/<pkg>` directory under `addonsDir` that has a
-	* readable `package.json` but NO manifest entry yet, add one with
-	* source `'seed'`. Existing entries are left untouched (their source,
-	* version and timestamps are authoritative — a later install/update
-	* overwrites them through `upsert`).
+	* **The directory is the truth.** It is what `AddonLoader` runs; a manifest
+	* that disagrees with it is a lie the update flow and the admin UI then
+	* repeat. Three corrections, all idempotent and safe on every boot:
 	*
-	* Why this exists: addons baked into the Docker/Electron image are
-	* copied straight into `addonsDir` by the container entrypoint (the
-	* launcher's `ensureRequiredPackages` then sees `package.json` already
-	* present and skips, never calling `upsert`). Without this reconcile
-	* those seeded addons stay absent from the manifest, so `applyUpdate`
-	* rejects them with "not currently tracked in manifest" — which is
-	* exactly what broke "Update all" on a fresh image. Idempotent and
-	* safe to run on every boot.
+	*  - **added** — an on-disk addon with no entry gets one, source `'seed'`.
+	*    Addons baked into the Docker/Electron image are copied straight into
+	*    `addonsDir` by the container entrypoint (`ensureRequiredPackages` then
+	*    sees `package.json` present and skips, never calling `upsert`), so they
+	*    would otherwise stay untracked and `applyUpdate` would reject them with
+	*    "not currently tracked in manifest" — what broke "Update all" on a
+	*    fresh image.
+	*  - **version-corrected** — an entry whose version disagrees with the
+	*    installed `package.json` adopts the DISK version. Provenance (`source`,
+	*    `installedAt`) is NOT derivable from disk and stays authoritative here;
+	*    `updatedAt` is left alone because the correction is not an update, and
+	*    stamping `now` would claim an install that never happened.
+	*  - **pruned** — an entry naming a directory that does not exist. The live
+	*    hub carried three (`@camstack/system 1.2.29`, `addon-viewer-ui 1.1.39`,
+	*    `addon-agent-ui 1.2.4`); `@camstack/system` in particular is
+	*    host-provided and deliberately NOT seeded under `addonsDir`
+	*    ([D45]), so its entry advertised a copy that must not exist.
+	*    An entry holding a `lastBackupDir` is NEVER pruned: that pointer is the
+	*    only reference to a pre-update backup, and the launcher's backup sweep
+	*    reclaims anything the manifest does not point at.
 	*
-	* Returns the number of entries added.
+	* `onChange` receives one record per correction, so the caller can log
+	* exactly what moved. Returns the total number of changes.
 	*/
-	reconcileFromDisk(addonsDir) {
+	reconcileFromDisk(addonsDir, onChange) {
 		if (!fs$17.existsSync(addonsDir)) return 0;
 		const m = this.read();
-		let added = 0;
+		let changes = 0;
 		const now = (/* @__PURE__ */ new Date()).toISOString();
+		/** Package name → version, for every ADDON package actually installed. */
+		const onDisk = /* @__PURE__ */ new Map();
 		for (const scope of fs$17.readdirSync(addonsDir, { withFileTypes: true })) {
-			if (!scope.isDirectory() || !scope.name.startsWith("@")) continue;
+			if (!scope.name.startsWith("@") || !isDirLike(path$39.join(addonsDir, scope.name))) continue;
 			const scopeDir = path$39.join(addonsDir, scope.name);
 			for (const pkg of fs$17.readdirSync(scopeDir, { withFileTypes: true })) {
-				if (!pkg.isDirectory()) continue;
+				if (!isDirLike(path$39.join(scopeDir, pkg.name))) continue;
 				const pkgJsonPath = path$39.join(scopeDir, pkg.name, "package.json");
 				if (!fs$17.existsSync(pkgJsonPath)) continue;
 				let pkgJson;
@@ -3354,22 +3382,57 @@ var AddonManifest = class {
 				if (!pkgJson.name || !pkgJson.version) continue;
 				const addons = pkgJson.camstack?.addons;
 				if (!Array.isArray(addons) || addons.length === 0) continue;
-				if (m.addons[pkgJson.name] != null) continue;
-				m.addons[pkgJson.name] = {
-					name: pkgJson.name,
-					version: pkgJson.version,
+				onDisk.set(pkgJson.name, pkgJson.version);
+			}
+		}
+		for (const [name, version] of onDisk) {
+			const prev = m.addons[name];
+			if (prev == null) {
+				m.addons[name] = {
+					name,
+					version,
 					source: "seed",
 					installedAt: now,
 					updatedAt: now
 				};
-				added++;
+				changes++;
+				onChange?.({
+					kind: "added",
+					name,
+					to: version
+				});
+				continue;
+			}
+			if (prev.version !== version) {
+				m.addons[name] = {
+					...prev,
+					version
+				};
+				changes++;
+				onChange?.({
+					kind: "version-corrected",
+					name,
+					from: prev.version,
+					to: version
+				});
 			}
 		}
-		if (added > 0) {
+		for (const [name, entry] of Object.entries(m.addons)) {
+			if (onDisk.has(name)) continue;
+			if (entry.lastBackupDir) continue;
+			delete m.addons[name];
+			changes++;
+			onChange?.({
+				kind: "pruned",
+				name,
+				from: entry.version
+			});
+		}
+		if (changes > 0) {
 			m.updatedAt = now;
 			this.write(m);
 		}
-		return added;
+		return changes;
 	}
 	/**
 	* Migration helper: if the manifest is empty but the addons directory
@@ -3752,6 +3815,34 @@ var noopLogger = {
 		return noopLogger;
 	}
 };
+/**
+* A staging tree younger than this may belong to an install still running —
+* possibly in another process. Only older trees are residue worth sweeping.
+* Generous on purpose: an addon's runtime-dependency `npm install` on a slow
+* host is minutes, and the cost of leaving residue one deploy longer is disk,
+* while the cost of sweeping a live one is a FAILED deploy.
+*/
+var STAGING_RESIDUE_MIN_AGE_MS = 30 * 6e4;
+/**
+* Pick the staging entries that are safe to delete.
+*
+* `installFromTgz` used to clear the WHOLE `.staging` root before creating its
+* own dir. Two deploys arriving within one install's lifetime — the normal case
+* when the hub propagates two packages back to back — meant the second one
+* deleted the first one's tree out from under its running `npm install`:
+*
+*   npm error code ENOENT
+*   npm error path …/.staging/install-14820-2026-08-07T12-28-28-875Z/package/package.json
+*
+* which the propagation then reported as `runtime dependency install failed`.
+* Observed on the Mac desktop agent and on little-unraid on 2026-08-07.
+*
+* So a sweep only removes what cannot be live: not a tree this process is
+* building, and not one young enough to belong to anybody's in-flight install.
+*/
+function selectSweepableStaging(entries, inFlight, minAgeMs = STAGING_RESIDUE_MIN_AGE_MS) {
+	return entries.filter((entry) => !inFlight.has(entry.name) && entry.ageMs >= minAgeMs).map((entry) => entry.name);
+}
 var AddonInstaller = class AddonInstaller {
 	addonsDir;
 	registry;
@@ -3768,6 +3859,11 @@ var AddonInstaller = class AddonInstaller {
 	* `getAddonInstallSource`).
 	*/
 	manifest;
+	/**
+	* Basenames under `.staging` this process is currently building. Never swept
+	* — see {@link selectSweepableStaging}.
+	*/
+	inFlightStaging = /* @__PURE__ */ new Set();
 	constructor(config, logger = noopLogger) {
 		this.addonsDir = config.addonsDir;
 		this.registry = config.registry;
@@ -3926,19 +4022,34 @@ var AddonInstaller = class AddonInstaller {
 		}
 	}
 	/**
-	* Reconcile the install manifest with the addons actually present on
-	* disk. Seeded addons (baked into the image and copied verbatim by the
-	* container entrypoint) never pass through an `install*` codepath, so
-	* they are missing from `manifest.json` and `applyUpdate` would reject
-	* them with "not currently tracked in manifest". Call this once after
-	* `ensureRequiredPackages` so every on-disk addon is updatable.
+	* Reconcile the install manifest against the addons actually present on
+	* disk: register seeded addons, correct a version that disagrees with the
+	* installed `package.json`, and drop entries naming a directory that does
+	* not exist. Call once after `ensureRequiredPackages`, before any update
+	* can be in flight. See `AddonManifest.reconcileFromDisk` for the rules.
 	*
-	* Returns the number of manifest entries added.
+	* Every correction is logged by name — a manifest that silently disagreed
+	* with disk is what made "@camstack/system 1.2.29" read as installed on a
+	* hub that deliberately has no copy of it.
+	*
+	* Returns the number of changes.
 	*/
 	reconcileManifest() {
-		const added = this.manifest.reconcileFromDisk(this.addonsDir);
-		if (added > 0) this.logger.info(`Manifest reconciled — ${added} seeded addon(s) registered`);
-		return added;
+		const changes = this.manifest.reconcileFromDisk(this.addonsDir, (c) => {
+			switch (c.kind) {
+				case "added":
+					this.logger.info(`Manifest — registered seeded addon ${c.name}@${c.to}`);
+					break;
+				case "version-corrected":
+					this.logger.info(`Manifest — ${c.name} recorded ${c.from} but disk has ${c.to}; adopting disk`);
+					break;
+				case "pruned":
+					this.logger.info(`Manifest — dropped ${c.name}@${c.from}: no install directory on disk`);
+					break;
+			}
+		});
+		if (changes > 0) this.logger.info(`Manifest reconciled — ${changes} correction(s)`);
+		return changes;
 	}
 	/**
 	* Install a single addon — on-demand installer used by AddonPackageService
@@ -4176,6 +4287,40 @@ var AddonInstaller = class AddonInstaller {
 			} });
 		});
 	}
+	/**
+	* Best-effort removal of `.staging` residue left by a CRASHED earlier deploy.
+	*
+	* Deliberately not `sweepGraveyard`: an evicted `.evicting/*` dir is dead by
+	* construction, but a `.staging/*` dir may be an install still running — in
+	* this process or another one. Deleting one of those fails a live deploy with
+	* an ENOENT on its own package.json, which is what happened on 2026-08-07.
+	*/
+	async sweepStagingResidue(stagingRoot) {
+		let names;
+		try {
+			names = fs$17.readdirSync(stagingRoot);
+		} catch {
+			return;
+		}
+		const now = Date.now();
+		const ages = [];
+		for (const name of names) try {
+			const stat = fs$17.statSync(path$39.join(stagingRoot, name));
+			ages.push({
+				name,
+				ageMs: now - stat.mtimeMs
+			});
+		} catch {}
+		const sweepable = selectSweepableStaging(ages, this.inFlightStaging);
+		if (sweepable.length > 0) this.logger.info("sweeping staging residue from a crashed earlier deploy", { meta: {
+			stagingRoot,
+			entries: sweepable
+		} });
+		await Promise.all(sweepable.map((name) => fs$17.promises.rm(path$39.join(stagingRoot, name), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0)));
+	}
 	/** Best-effort removal of leftover `.evicting/*` dirs from earlier deploys. */
 	async sweepGraveyard(graveyard) {
 		let entries;
@@ -4193,9 +4338,11 @@ var AddonInstaller = class AddonInstaller {
 	async installFromTgz(tgzPath) {
 		const stagingRoot = path$39.join(this.addonsDir, ".staging");
 		ensureDir(stagingRoot);
-		await this.sweepGraveyard(stagingRoot);
-		const stagingDir = path$39.join(stagingRoot, `install-${process.pid}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`);
+		await this.sweepStagingResidue(stagingRoot);
+		const stagingName = `install-${process.pid}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+		const stagingDir = path$39.join(stagingRoot, stagingName);
 		ensureDir(stagingDir);
+		this.inFlightStaging.add(stagingName);
 		try {
 			await execFileAsync("tar", [
 				"-xzf",
@@ -4250,6 +4397,7 @@ var AddonInstaller = class AddonInstaller {
 				version: pkgView.version
 			};
 		} finally {
+			this.inFlightStaging.delete(stagingName);
 			await fs$17.promises.rm(stagingDir, {
 				recursive: true,
 				force: true

package/dist/kernel/addon-installer.d.ts

@@ -66,6 +66,37 @@ export interface BackupSweepResult {
     /** Backup dirs deliberately retained (rollback target / last copy). */
     readonly kept: readonly string[];
 }
+/**
+ * A staging tree younger than this may belong to an install still running —
+ * possibly in another process. Only older trees are residue worth sweeping.
+ * Generous on purpose: an addon's runtime-dependency `npm install` on a slow
+ * host is minutes, and the cost of leaving residue one deploy longer is disk,
+ * while the cost of sweeping a live one is a FAILED deploy.
+ */
+export declare const STAGING_RESIDUE_MIN_AGE_MS: number;
+export interface StagingEntryAge {
+    readonly name: string;
+    /** Age of the entry's mtime, in ms. */
+    readonly ageMs: number;
+}
+/**
+ * Pick the staging entries that are safe to delete.
+ *
+ * `installFromTgz` used to clear the WHOLE `.staging` root before creating its
+ * own dir. Two deploys arriving within one install's lifetime — the normal case
+ * when the hub propagates two packages back to back — meant the second one
+ * deleted the first one's tree out from under its running `npm install`:
+ *
+ *   npm error code ENOENT
+ *   npm error path …/.staging/install-14820-2026-08-07T12-28-28-875Z/package/package.json
+ *
+ * which the propagation then reported as `runtime dependency install failed`.
+ * Observed on the Mac desktop agent and on little-unraid on 2026-08-07.
+ *
+ * So a sweep only removes what cannot be live: not a tree this process is
+ * building, and not one young enough to belong to anybody's in-flight install.
+ */
+export declare function selectSweepableStaging(entries: readonly StagingEntryAge[], inFlight: ReadonlySet<string>, minAgeMs?: number): readonly string[];
 export declare class AddonInstaller {
     readonly addonsDir: string;
     private readonly registry;
@@ -82,6 +113,11 @@ export declare class AddonInstaller {
      * `getAddonInstallSource`).
      */
     readonly manifest: AddonManifest;
+    /**
+     * Basenames under `.staging` this process is currently building. Never swept
+     * — see {@link selectSweepableStaging}.
+     */
+    private readonly inFlightStaging;
     constructor(config: AddonInstallerConfig, logger?: IScopedLogger);
     /**
      * Where a bootstrapped npm lives when the host has none on PATH (packaged
@@ -154,14 +190,17 @@ export declare class AddonInstaller {
      */
     ensureRequiredPackages(packages?: readonly string[]): Promise<void>;
     /**
-     * Reconcile the install manifest with the addons actually present on
-     * disk. Seeded addons (baked into the image and copied verbatim by the
-     * container entrypoint) never pass through an `install*` codepath, so
-     * they are missing from `manifest.json` and `applyUpdate` would reject
-     * them with "not currently tracked in manifest". Call this once after
-     * `ensureRequiredPackages` so every on-disk addon is updatable.
+     * Reconcile the install manifest against the addons actually present on
+     * disk: register seeded addons, correct a version that disagrees with the
+     * installed `package.json`, and drop entries naming a directory that does
+     * not exist. Call once after `ensureRequiredPackages`, before any update
+     * can be in flight. See `AddonManifest.reconcileFromDisk` for the rules.
+     *
+     * Every correction is logged by name — a manifest that silently disagreed
+     * with disk is what made "@camstack/system 1.2.29" read as installed on a
+     * hub that deliberately has no copy of it.
      *
-     * Returns the number of manifest entries added.
+     * Returns the number of changes.
      */
     reconcileManifest(): number;
     /**
@@ -252,6 +291,15 @@ export declare class AddonInstaller {
      * on the next deploy.
      */
     private evictInstallDir;
+    /**
+     * Best-effort removal of `.staging` residue left by a CRASHED earlier deploy.
+     *
+     * Deliberately not `sweepGraveyard`: an evicted `.evicting/*` dir is dead by
+     * construction, but a `.staging/*` dir may be an install still running — in
+     * this process or another one. Deleting one of those fails a live deploy with
+     * an ENOENT on its own package.json, which is what happened on 2026-08-07.
+     */
+    private sweepStagingResidue;
     /** Best-effort removal of leftover `.evicting/*` dirs from earlier deploys. */
     private sweepGraveyard;
     /** Install addon from a tgz file (uploaded or downloaded) */

package/dist/kernel/addon-manifest.d.ts

@@ -23,6 +23,15 @@ export interface AddonManifestEntry {
      */
     meta?: Record<string, unknown>;
 }
+/** One correction `reconcileFromDisk` made to bring the manifest back to disk truth. */
+export interface ManifestReconcileChange {
+    readonly kind: 'added' | 'version-corrected' | 'pruned';
+    readonly name: string;
+    /** Version the manifest claimed before the change. Absent for `added`. */
+    readonly from?: string;
+    /** Version now recorded. Absent for `pruned`. */
+    readonly to?: string;
+}
 export interface AddonManifestFile {
     /**
      * Schema version. Increment whenever the on-disk shape changes
@@ -67,26 +76,37 @@ export declare class AddonManifest {
      */
     invalidate(): void;
     /**
-     * Reconcile the manifest with what is actually present on disk.
+     * Reconcile the manifest against what is actually present on disk.
      *
-     * For every `@scope/<pkg>` directory under `addonsDir` that has a
-     * readable `package.json` but NO manifest entry yet, add one with
-     * source `'seed'`. Existing entries are left untouched (their source,
-     * version and timestamps are authoritative — a later install/update
-     * overwrites them through `upsert`).
+     * **The directory is the truth.** It is what `AddonLoader` runs; a manifest
+     * that disagrees with it is a lie the update flow and the admin UI then
+     * repeat. Three corrections, all idempotent and safe on every boot:
      *
-     * Why this exists: addons baked into the Docker/Electron image are
-     * copied straight into `addonsDir` by the container entrypoint (the
-     * launcher's `ensureRequiredPackages` then sees `package.json` already
-     * present and skips, never calling `upsert`). Without this reconcile
-     * those seeded addons stay absent from the manifest, so `applyUpdate`
-     * rejects them with "not currently tracked in manifest" — which is
-     * exactly what broke "Update all" on a fresh image. Idempotent and
-     * safe to run on every boot.
+     *  - **added** — an on-disk addon with no entry gets one, source `'seed'`.
+     *    Addons baked into the Docker/Electron image are copied straight into
+     *    `addonsDir` by the container entrypoint (`ensureRequiredPackages` then
+     *    sees `package.json` present and skips, never calling `upsert`), so they
+     *    would otherwise stay untracked and `applyUpdate` would reject them with
+     *    "not currently tracked in manifest" — what broke "Update all" on a
+     *    fresh image.
+     *  - **version-corrected** — an entry whose version disagrees with the
+     *    installed `package.json` adopts the DISK version. Provenance (`source`,
+     *    `installedAt`) is NOT derivable from disk and stays authoritative here;
+     *    `updatedAt` is left alone because the correction is not an update, and
+     *    stamping `now` would claim an install that never happened.
+     *  - **pruned** — an entry naming a directory that does not exist. The live
+     *    hub carried three (`@camstack/system 1.2.29`, `addon-viewer-ui 1.1.39`,
+     *    `addon-agent-ui 1.2.4`); `@camstack/system` in particular is
+     *    host-provided and deliberately NOT seeded under `addonsDir`
+     *    ([D45]), so its entry advertised a copy that must not exist.
+     *    An entry holding a `lastBackupDir` is NEVER pruned: that pointer is the
+     *    only reference to a pre-update backup, and the launcher's backup sweep
+     *    reclaims anything the manifest does not point at.
      *
-     * Returns the number of entries added.
+     * `onChange` receives one record per correction, so the caller can log
+     * exactly what moved. Returns the total number of changes.
      */
-    reconcileFromDisk(addonsDir: string): number;
+    reconcileFromDisk(addonsDir: string, onChange?: (change: ManifestReconcileChange) => void): number;
     /**
      * Migration helper: if the manifest is empty but the addons directory
      * has packages with `.install-source` markers (the legacy per-addon

package/dist/kernel/transport/frame-codec.d.ts

@@ -1,7 +1,48 @@
 /** Encode a value as a length-prefixed (4-byte big-endian) MsgPack frame. */
 export declare function encodeFrame(value: unknown): Buffer;
-/** Reassembles length-prefixed MsgPack frames from a byte stream. */
+/**
+ * Reassembles length-prefixed MsgPack frames from a byte stream.
+ *
+ * **Why this is a chunk LIST and not a growing Buffer.** The original
+ * accumulator did `this.buf = Buffer.concat([this.buf, chunk])` on every
+ * socket `data` event. A frame of N bytes delivered in C-byte pieces
+ * therefore copied ~N²/2C bytes: a 4 MiB native crop arriving in 64 KiB
+ * chunks is ~128 MiB of memcpy plus 64 intermediate Buffer allocations,
+ * synchronously, on the thread that also serves every tRPC request. Media
+ * transits this router constantly, and hub-main was measured busy 82.2 s out
+ * of 120 with 22 uninterrupted blocks ≥1 s.
+ *
+ * Here the pending chunks are kept as-is and joined ONCE, when a frame is
+ * complete — and not even then in the common case, because a frame that
+ * arrived whole inside one chunk is sliced out with zero copying. Total work
+ * is linear in the bytes received.
+ *
+ * The wire contract is unchanged: 4-byte big-endian length, then that many
+ * MsgPack bytes; a partial frame is buffered; several frames in one chunk are
+ * all returned; a frame spanning any number of chunks is reassembled. There
+ * is still no upper bound on a declared length — an oversized prefix parks
+ * bytes in `chunks` until the peer completes or the socket closes, exactly as
+ * before. Bounding it is a transport-protocol change, not a decoder cleanup.
+ */
 export declare class FrameDecoder {
-    private buf;
+    /** Unconsumed bytes, oldest first. `chunks[0]` starts at a frame boundary. */
+    private chunks;
+    /** Sum of `chunks[i].byteLength` — tracked so length checks cost nothing. */
+    private buffered;
     push(chunk: Buffer): unknown[];
+    /**
+     * Read the frame length without consuming it. The prefix itself can land
+     * across a chunk boundary (a 3-byte first chunk is a real socket event), so
+     * the slow path walks bytes until it has all four.
+     */
+    private readLength;
+    /**
+     * Consume and return exactly `n` contiguous bytes.
+     *
+     * Three cases, cheapest first: the head chunk already holds the whole frame
+     * (no copy at all, just a view); the head chunk holds more than the frame
+     * (a view plus a rebased head); the frame spans chunks (ONE `Buffer.concat`
+     * sized to the frame — the single copy this class is allowed).
+     */
+    private take;
 }