@celilo/cli 0.11.0 → 0.12.0

package/src/services/public-web-republish.test.ts

@@ -0,0 +1,189 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { DbClient } from '../db/client';
+import { modules, webRoutes } from '../db/schema';
+import type { ModuleManifest } from '../manifest/schema';
+import { setupTestDatabase } from '../test-utils/setup-test-db';
+import { providesPublicWeb, republishStaticWebConsumers } from './public-web-republish';
+
+const caddyManifest = {
+  provides: { capabilities: [{ name: 'public_web', version: '3.0.0' }] },
+} as unknown as ModuleManifest;
+
+const plainManifest = { provides: { capabilities: [] } } as unknown as ModuleManifest;
+
+describe('republishStaticWebConsumers', () => {
+  let dir: string;
+  let db: DbClient;
+
+  function seedModule(id: string) {
+    db.insert(modules)
+      .values({ id, name: id, version: '1.0.0', manifestData: {}, sourcePath: `/tmp/${id}` })
+      .run();
+  }
+
+  function seedRoute(
+    moduleId: string,
+    slug: string,
+    path: string,
+    type: 'static' | 'reverse_proxy',
+  ) {
+    db.insert(webRoutes)
+      .values({
+        slug,
+        moduleId,
+        type,
+        path,
+        hostname: 'iamtheinternet.org',
+        targetHost: type === 'reverse_proxy' ? '10.0.20.5' : null,
+        targetPort: type === 'reverse_proxy' ? 8080 : null,
+      })
+      .run();
+  }
+
+  function recordingHook(failFor: string[] = []) {
+    const calls: string[] = [];
+    const runHook = (async (moduleId: string) => {
+      calls.push(moduleId);
+      return failFor.includes(moduleId)
+        ? { success: false, outputs: {}, error: 'boom', duration: 1 }
+        : { success: true, outputs: {}, duration: 1 };
+    }) as unknown as Parameters<typeof republishStaticWebConsumers>[0]['runHook'];
+    return { runHook, calls };
+  }
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'pwr-'));
+    const dbPath = join(dir, 'celilo.db');
+    process.env.CELILO_DB_PATH = dbPath;
+    db = await setupTestDatabase(dbPath);
+  });
+
+  afterEach(() => {
+    db.$client.close();
+    process.env.CELILO_DB_PATH = undefined;
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  test('providesPublicWeb reads the manifest', () => {
+    expect(providesPublicWeb(caddyManifest)).toBe(true);
+    expect(providesPublicWeb(plainManifest)).toBe(false);
+  });
+
+  test('does not run for a module that is not a public_web provider', async () => {
+    seedModule('hello-foo');
+    seedRoute('hello-foo', 'foo', '/foo', 'static');
+    const { runHook, calls } = recordingHook();
+
+    const result = await republishStaticWebConsumers({
+      providerModuleId: 'namecheap',
+      manifest: plainManifest,
+      db,
+      runHook,
+    });
+
+    expect(result).toEqual({ ran: false, republished: [], failures: [] });
+    expect(calls).toEqual([]);
+  });
+
+  test('re-runs on_install for every static consumer', async () => {
+    seedModule('caddy');
+    seedModule('hello-foo');
+    seedModule('hello-bar');
+    seedModule('celilo-website');
+    seedRoute('hello-foo', 'foo', '/foo', 'static');
+    seedRoute('hello-bar', 'bar', '/bar', 'static');
+    seedRoute('celilo-website', 'celilo-website', '/', 'static');
+    const { runHook, calls } = recordingHook();
+
+    const result = await republishStaticWebConsumers({
+      providerModuleId: 'caddy',
+      manifest: caddyManifest,
+      db,
+      runHook,
+    });
+
+    expect(result.ran).toBe(true);
+    expect(calls.sort()).toEqual(['celilo-website', 'hello-bar', 'hello-foo']);
+    expect(result.republished.sort()).toEqual(['celilo-website', 'hello-bar', 'hello-foo']);
+    expect(result.failures).toEqual([]);
+  });
+
+  test('skips reverse-proxy-only consumers (no assets on the provider host)', async () => {
+    seedModule('caddy');
+    seedModule('forgejo');
+    seedModule('hello-foo');
+    seedRoute('forgejo', 'git', '/git', 'reverse_proxy');
+    seedRoute('hello-foo', 'foo', '/foo', 'static');
+    const { runHook, calls } = recordingHook();
+
+    await republishStaticWebConsumers({
+      providerModuleId: 'caddy',
+      manifest: caddyManifest,
+      db,
+      runHook,
+    });
+
+    expect(calls).toEqual(['hello-foo']);
+  });
+
+  test('never re-runs the provider itself', async () => {
+    seedModule('caddy');
+    // A provider that also owns a static route (a landing page of its own).
+    seedRoute('caddy', 'caddy', '/', 'static');
+    const { runHook, calls } = recordingHook();
+
+    const result = await republishStaticWebConsumers({
+      providerModuleId: 'caddy',
+      manifest: caddyManifest,
+      db,
+      runHook,
+    });
+
+    expect(calls).toEqual([]);
+    expect(result.republished).toEqual([]);
+  });
+
+  test('de-duplicates a consumer that owns several static routes', async () => {
+    seedModule('caddy');
+    seedModule('hello-foo');
+    seedRoute('hello-foo', 'foo', '/foo', 'static');
+    seedRoute('hello-foo', 'foo-docs', '/foo/docs', 'static');
+    const { runHook, calls } = recordingHook();
+
+    await republishStaticWebConsumers({
+      providerModuleId: 'caddy',
+      manifest: caddyManifest,
+      db,
+      runHook,
+    });
+
+    expect(calls).toEqual(['hello-foo']);
+  });
+
+  test('one consumer failing does not stop the others', async () => {
+    seedModule('caddy');
+    seedModule('hello-foo');
+    seedModule('hello-bar');
+    seedRoute('hello-foo', 'foo', '/foo', 'static');
+    seedRoute('hello-bar', 'bar', '/bar', 'static');
+    const { runHook, calls } = recordingHook(['hello-foo']);
+
+    const result = await republishStaticWebConsumers({
+      providerModuleId: 'caddy',
+      manifest: caddyManifest,
+      db,
+      runHook,
+    });
+
+    expect(calls.sort()).toEqual(['hello-bar', 'hello-foo']);
+    expect(result.republished).toEqual(['hello-bar']);
+    expect(result.failures).toEqual([{ moduleId: 'hello-foo', error: 'boom' }]);
+  });
+});

package/src/services/public-web-republish.ts

@@ -0,0 +1,84 @@
+/**
+ * Restore consumer content after a public_web provider redeploy.
+ *
+ * A provider redeploy destroys the provider's host and rebuilds it, taking
+ * `/srv/www` with it. The consumers' `web_routes` rows survive — they belong to
+ * the consumer modules, not the provider — so the rebuilt provider renders
+ * `root * /srv/www/<slug>` for directories that no longer exist and every
+ * static site 404s. Nothing re-uploaded the assets; an operator had to redeploy
+ * each consumer by hand and there was no signal telling them to.
+ *
+ * The fix is to do exactly what that operator did: after a provider deploy
+ * lands, re-run `on_install` for every module holding a STATIC route.
+ * `publishStaticSite` is idempotent (it upserts the route and re-tars the
+ * source dir), so the re-run re-registers the route and refills the fresh
+ * `/srv/www/<slug>`.
+ *
+ * Reverse-proxy consumers are skipped: they keep no state on the provider host,
+ * so re-running them buys nothing and only widens the blast radius.
+ *
+ * ponytail: re-runs every static consumer unconditionally rather than probing
+ * which /srv/www/<slug> directories are actually missing — O(static consumers)
+ * per provider deploy, currently a handful. If a large fleet makes provider
+ * deploys slow, probe the provider host first and re-run only the misses.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { webRoutes } from '../db/schema';
+import { createConsoleLogger } from '../hooks/logger';
+import { runNamedHook } from '../hooks/run-named-hook';
+import type { ModuleManifest } from '../manifest/schema';
+
+export interface RepublishFailure {
+  moduleId: string;
+  error: string;
+}
+
+export interface RepublishResult {
+  /** False when the deployed module isn't a public_web provider. */
+  ran: boolean;
+  /** Consumer modules whose on_install was re-run successfully. */
+  republished: string[];
+  failures: RepublishFailure[];
+}
+
+export function providesPublicWeb(manifest: ModuleManifest): boolean {
+  return (manifest.provides?.capabilities ?? []).some((c) => c.name === 'public_web');
+}
+
+export interface RepublishDeps {
+  providerModuleId: string;
+  manifest: ModuleManifest;
+  db: DbClient;
+  /** Injectable for tests. */
+  runHook?: typeof runNamedHook;
+}
+
+export async function republishStaticWebConsumers(deps: RepublishDeps): Promise<RepublishResult> {
+  const { providerModuleId, manifest, db, runHook = runNamedHook } = deps;
+
+  if (!providesPublicWeb(manifest)) {
+    return { ran: false, republished: [], failures: [] };
+  }
+
+  const staticRoutes = db.select().from(webRoutes).where(eq(webRoutes.type, 'static')).all();
+  const consumerIds = [
+    ...new Set(staticRoutes.map((r) => r.moduleId).filter((id) => id !== providerModuleId)),
+  ];
+
+  const republished: string[] = [];
+  const failures: RepublishFailure[] = [];
+
+  for (const moduleId of consumerIds) {
+    const logger = createConsoleLogger(moduleId, 'on_install');
+    const result = await runHook(moduleId, 'on_install', db, logger, {});
+    if (result.success) {
+      republished.push(moduleId);
+    } else {
+      failures.push({ moduleId, error: result.error ?? 'unknown error' });
+    }
+  }
+
+  return { ran: true, republished, failures };
+}

package/src/services/restore-from-file.ts

@@ -1,6 +1,6 @@
 /**
  * File-direct restore + system-file swap. Powers the `celilo restore`
- * top-level convenience command (Phase 4 of v2/SYSTEM_BACKUP_TERRAFORM_STATE.md).
+ * top-level convenience command (Phase 4 of openspec/specs/management-server-backup/spec.md).
  *
  * The generic `restoreModuleBackup` reads from a configured storage
  * destination — which on a fresh-bootstrap box doesn't exist yet.

package/src/services/restore-preflight.ts

@@ -13,7 +13,7 @@
  * Either signal is sufficient. Both are checked so a half-deployed
  * target (DB cleared but disk artifacts left over) still gets caught.
  *
- * Phase 4 of v2/SYSTEM_BACKUP_TERRAFORM_STATE.md (Design Decision 9).
+ * Phase 4 of openspec/specs/management-server-backup/spec.md (Design Decision 9).
  */
 
 import { existsSync, readdirSync, statSync } from 'node:fs';

package/src/services/system-identity.ts

@@ -16,7 +16,7 @@ export interface SystemIdentity {
 
 /**
  * Get a module's hostname and IP from its recorded deployed systems
- * (v2/MODULE_SYSTEMS_ADDRESSING.md). Returns null for a module with no host
+ * (openspec/specs/module-systems-addressing/spec.md). Returns null for a module with no host
  * (config-only providers like namecheap). Single-system modules have one; this
  * returns the first (Phase C iterates all systems for per-system events).
  */

package/src/services/system-init.test.ts

@@ -29,7 +29,7 @@ describe('System Init Service', () => {
       // a zone address).
       expect(defaults['network.bridge']).toBe('vmbr0');
       // Network/DNS addressing is no longer defaulted
-      // (v2/NETWORK_CONFIG_TO_FIREWALL.md): internal is discovered at
+      // (openspec/specs/progressive-zone-disclosure/spec.md): internal is discovered at
       // celilo-mgmt install; dmz/app/secure appear only when a firewall
       // module provides them.
       expect(defaults['network.dmz.subnet']).toBeUndefined();
@@ -184,7 +184,7 @@ describe('System Init Service', () => {
     test('keys off the sentinel, not config rows', async () => {
       // Config rows present but no sentinel → NOT initialized. Initialization
       // is tracked by the explicit `system.initialized` marker
-      // (v2/NETWORK_CONFIG_TO_FIREWALL.md), not by any network row.
+      // (openspec/specs/progressive-zone-disclosure/spec.md), not by any network row.
       db.insert(systemConfig).values({ key: 'network.dmz.subnet', value: '10.0.0.0/24' }).run();
       db.insert(systemConfig).values({ key: 'ssh.public_key', value: 'ssh-rsa AAAA...' }).run();
       expect(isSystemInitialized(db)).toBe(false);

package/src/services/system-init.ts

@@ -199,7 +199,7 @@ export function initializeSystem(
   }
 
   // Explicit init marker. Network/DNS addressing is no longer seeded with
-  // defaults (v2/NETWORK_CONFIG_TO_FIREWALL.md), so we can't key
+  // defaults (openspec/specs/progressive-zone-disclosure/spec.md), so we can't key
   // "is this system initialized?" off a network row anymore. Write a
   // dedicated sentinel instead. additionalProperties:true in the schema
   // permits this non-schema key.
@@ -238,7 +238,7 @@ export function loadExistingConfiguration(db: DbClient): Record<string, string>
  * Keys off the explicit `system.initialized` sentinel written by
  * initializeSystem(). Earlier this checked for a seeded network zone
  * subnet, but network/DNS addressing is no longer defaulted
- * (v2/NETWORK_CONFIG_TO_FIREWALL.md), so a fresh init leaves those
+ * (openspec/specs/progressive-zone-disclosure/spec.md), so a fresh init leaves those
  * rows absent.
  *
  * @param db - Database instance

package/src/services/web-route-cleanup.test.ts

@@ -0,0 +1,250 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { RunResult, Runner } from '@celilo/capabilities';
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { capabilities, moduleConfigs, modules, webRoutes } from '../db/schema';
+import { setupTestDatabase } from '../test-utils/setup-test-db';
+import type { RouteReconcileWaitResult } from './celilo-events';
+import { cleanupWebRoutesForModule } from './web-route-cleanup';
+
+const CADDY_IP = '10.0.10.10';
+
+const CLEAN_RECONCILE: RouteReconcileWaitResult = {
+  events: 1,
+  succeeded: 1,
+  failed: 0,
+  timedOut: false,
+  noDispatcher: false,
+};
+
+function createRecordingRunner(result: Partial<RunResult> = {}): Runner & { calls: string[] } {
+  const calls: string[] = [];
+  const runner = ((cmd: string) => {
+    calls.push(cmd);
+    return { ok: true, stdout: '', stderr: '', ...result } as RunResult;
+  }) as Runner & { calls: string[] };
+  runner.calls = calls;
+  return runner;
+}
+
+describe('cleanupWebRoutesForModule', () => {
+  let dir: string;
+  let db: DbClient;
+
+  async function seedModule(id: string): Promise<void> {
+    db.insert(modules)
+      .values({
+        id,
+        name: id,
+        version: '1.0.0',
+        manifestData: {},
+        sourcePath: `/tmp/${id}`,
+      })
+      .run();
+  }
+
+  async function seedCaddyProvider(): Promise<void> {
+    await seedModule('caddy');
+    db.insert(capabilities)
+      .values({ moduleId: 'caddy', capabilityName: 'public_web', version: '3.0.0', data: {} })
+      .run();
+    db.insert(moduleConfigs)
+      .values({
+        moduleId: 'caddy',
+        key: 'target_ip',
+        value: `${CADDY_IP}/24`,
+        valueJson: JSON.stringify(`${CADDY_IP}/24`),
+      })
+      .run();
+  }
+
+  function seedRoute(
+    moduleId: string,
+    slug: string,
+    path: string,
+    type: 'static' | 'reverse_proxy',
+  ) {
+    db.insert(webRoutes)
+      .values({
+        slug,
+        moduleId,
+        type,
+        path,
+        hostname: 'iamtheinternet.org',
+        targetHost: type === 'reverse_proxy' ? '10.0.20.5' : null,
+        targetPort: type === 'reverse_proxy' ? 8080 : null,
+      })
+      .run();
+  }
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'wrc-'));
+    const dbPath = join(dir, 'celilo.db');
+    process.env.CELILO_DB_PATH = dbPath;
+    db = await setupTestDatabase(dbPath);
+  });
+
+  afterEach(() => {
+    db.$client.close();
+    process.env.CELILO_DB_PATH = undefined;
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  test('deletes routes, reclaims the asset root, and emits the reconcile', async () => {
+    await seedCaddyProvider();
+    await seedModule('hello-foo');
+    seedRoute('hello-foo', 'foo', '/foo', 'static');
+
+    const run = createRecordingRunner();
+    let emittedFor: string | undefined;
+
+    const result = await cleanupWebRoutesForModule({
+      moduleId: 'hello-foo',
+      db,
+      run,
+      emitAndWait: async (triggeredBy) => {
+        emittedFor = triggeredBy;
+        return CLEAN_RECONCILE;
+      },
+    });
+
+    expect(result.routesRemoved).toBe(1);
+    expect(result.assetDirsRemoved).toEqual(['/srv/www/foo']);
+    expect(result.warnings).toEqual([]);
+    expect(emittedFor).toBe('hello-foo');
+
+    expect(run.calls).toHaveLength(1);
+    expect(run.calls[0]).toContain(`root@${CADDY_IP}`);
+    expect(run.calls[0]).toContain('rm -rf');
+    expect(run.calls[0]).toContain('/srv/www/foo');
+
+    const remaining = db.select().from(webRoutes).where(eq(webRoutes.moduleId, 'hello-foo')).all();
+    expect(remaining).toHaveLength(0);
+  });
+
+  test('leaves other modules routes alone', async () => {
+    await seedCaddyProvider();
+    await seedModule('hello-foo');
+    await seedModule('hello-bar');
+    seedRoute('hello-foo', 'foo', '/foo', 'static');
+    seedRoute('hello-bar', 'bar', '/bar', 'static');
+
+    const run = createRecordingRunner();
+    await cleanupWebRoutesForModule({
+      moduleId: 'hello-foo',
+      db,
+      run,
+      emitAndWait: async () => CLEAN_RECONCILE,
+    });
+
+    const survivors = db.select().from(webRoutes).all();
+    expect(survivors.map((r) => r.moduleId)).toEqual(['hello-bar']);
+    // Only /srv/www/foo is touched — the sibling's asset root must survive.
+    expect(run.calls.join('\n')).not.toContain('/srv/www/bar');
+  });
+
+  test('no-ops when the module owns no routes (its on_uninstall already ran)', async () => {
+    await seedCaddyProvider();
+    await seedModule('celilo-website');
+
+    const run = createRecordingRunner();
+    let emitted = false;
+
+    const result = await cleanupWebRoutesForModule({
+      moduleId: 'celilo-website',
+      db,
+      run,
+      emitAndWait: async () => {
+        emitted = true;
+        return CLEAN_RECONCILE;
+      },
+    });
+
+    expect(result).toEqual({ routesRemoved: 0, assetDirsRemoved: [], warnings: [] });
+    expect(run.calls).toHaveLength(0);
+    // No redundant reconcile on every module removal.
+    expect(emitted).toBe(false);
+  });
+
+  test('skips the remote rm for reverse-proxy routes (no assets on the host)', async () => {
+    await seedCaddyProvider();
+    await seedModule('forgejo');
+    seedRoute('forgejo', 'forgejo', '/git', 'reverse_proxy');
+
+    const run = createRecordingRunner();
+    const result = await cleanupWebRoutesForModule({
+      moduleId: 'forgejo',
+      db,
+      run,
+      emitAndWait: async () => CLEAN_RECONCILE,
+    });
+
+    expect(result.routesRemoved).toBe(1);
+    expect(run.calls).toHaveLength(0);
+  });
+
+  test('still deletes routes when the asset rm fails', async () => {
+    await seedCaddyProvider();
+    await seedModule('hello-foo');
+    seedRoute('hello-foo', 'foo', '/foo', 'static');
+
+    const run = createRecordingRunner({ ok: false, stderr: 'host unreachable' });
+    const result = await cleanupWebRoutesForModule({
+      moduleId: 'hello-foo',
+      db,
+      run,
+      emitAndWait: async () => CLEAN_RECONCILE,
+    });
+
+    expect(result.routesRemoved).toBe(1);
+    expect(result.assetDirsRemoved).toEqual([]);
+    expect(result.warnings.join(' ')).toMatch(/Failed to remove \/srv\/www\/foo/);
+    expect(db.select().from(webRoutes).all()).toHaveLength(0);
+  });
+
+  test('warns when no provider is deployed to clean assets from', async () => {
+    await seedModule('hello-foo');
+    seedRoute('hello-foo', 'foo', '/foo', 'static');
+
+    const run = createRecordingRunner();
+    const result = await cleanupWebRoutesForModule({
+      moduleId: 'hello-foo',
+      db,
+      run,
+      emitAndWait: async () => CLEAN_RECONCILE,
+    });
+
+    expect(result.routesRemoved).toBe(1);
+    expect(run.calls).toHaveLength(0);
+    expect(result.warnings.join(' ')).toMatch(/No public_web provider host found/);
+  });
+
+  test('warns — but does not throw — when the provider never reconciles', async () => {
+    await seedCaddyProvider();
+    await seedModule('hello-foo');
+    seedRoute('hello-foo', 'foo', '/foo', 'static');
+
+    const result = await cleanupWebRoutesForModule({
+      moduleId: 'hello-foo',
+      db,
+      run: createRecordingRunner(),
+      emitAndWait: async () => ({
+        events: 1,
+        succeeded: 0,
+        failed: 0,
+        timedOut: false,
+        noDispatcher: true,
+      }),
+    });
+
+    expect(result.routesRemoved).toBe(1);
+    expect(result.warnings.join(' ')).toMatch(/no event dispatcher is running/);
+  });
+});