@celilo/cli 0.11.0 → 0.12.1

package/src/cli/commands/registry-owner.ts

@@ -0,0 +1,124 @@
+/**
+ * Registry module-ownership administration (ce-1ch, SECURE_MODULE_PUBLISH.md D-C/D-E).
+ *
+ * The registry-server owns the allow/deny decision; these commands are the
+ * first-class operator front door for the module-owner table:
+ *   celilo registry owner list                 — dump the whole table
+ *   celilo registry owner show <module>         — who owns one module name
+ *   celilo registry owner set  <module> <sub>   — reassign (admin overwrite)
+ *
+ * Auth: the admin/bootstrap publish token is read from the local
+ * publish_tokens list (resolveAdminToken) — these run on-mgr where that secret
+ * lives, never resurfacing the raw admin value to a laptop. The registry URL
+ * comes from --registry / CELILO_REGISTRY_URL / the built-in default.
+ */
+
+import { RegistryClient } from '../../registry/client';
+import { getArg, getFlag, validateRequiredArgs } from '../parser';
+import type { CommandResult } from '../types';
+import { resolveAdminToken } from './registry-token';
+
+type CommandError = Extract<CommandResult, { success: false }>;
+
+function isError(v: unknown): v is CommandError {
+  return typeof v === 'object' && v !== null && 'success' in v && v.success === false;
+}
+
+function clientFrom(flags: Record<string, string | boolean>): RegistryClient {
+  const registryUrl = getFlag(flags, 'registry', '');
+  return new RegistryClient(registryUrl || undefined);
+}
+
+function registryError(err: unknown): CommandError {
+  return {
+    success: false,
+    error: `Registry request failed: ${err instanceof Error ? err.message : String(err)}`,
+  };
+}
+
+/** `celilo registry owner list` — dump the module-owner table. */
+export async function handleRegistryOwnerList(
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  const token = await resolveAdminToken();
+  if (isError(token)) return token;
+
+  const client = clientFrom(flags);
+  try {
+    const owners = await client.listOwners(token);
+    if (owners.length === 0) {
+      return { success: true, message: 'No module ownerships recorded yet' };
+    }
+    const nameWidth = Math.max(6, ...owners.map((o) => o.moduleName.length));
+    const subWidth = Math.max(5, ...owners.map((o) => o.ownerSub.length));
+    const header = `${'MODULE'.padEnd(nameWidth)}  ${'OWNER'.padEnd(subWidth)}  CLAIMED`;
+    const rows = owners
+      .slice()
+      .sort((a, b) => a.moduleName.localeCompare(b.moduleName))
+      .map(
+        (o) => `${o.moduleName.padEnd(nameWidth)}  ${o.ownerSub.padEnd(subWidth)}  ${o.claimedAt}`,
+      );
+    return { success: true, message: [header, ...rows].join('\n') };
+  } catch (err) {
+    return registryError(err);
+  }
+}
+
+/** `celilo registry owner show <module>` — the owner of one module name. */
+export async function handleRegistryOwnerShow(
+  args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  const argErr = validateRequiredArgs(args, 1);
+  if (argErr) {
+    return { success: false, error: `${argErr}\n\nUsage: celilo registry owner show <module>` };
+  }
+  const name = getArg(args, 0)?.trim();
+  if (!name) return { success: false, error: 'Module name is required' };
+
+  const token = await resolveAdminToken();
+  if (isError(token)) return token;
+
+  const client = clientFrom(flags);
+  try {
+    const owner = await client.getOwner(name, token);
+    if (!owner) {
+      return { success: true, message: `${name} is unclaimed (first verified publisher owns it)` };
+    }
+    return {
+      success: true,
+      message: `${name}\n  owner:   ${owner.ownerSub}\n  claimed: ${owner.claimedAt}\n  via:     ${owner.sourceGroup}`,
+    };
+  } catch (err) {
+    return registryError(err);
+  }
+}
+
+/** `celilo registry owner set <module> <sub>` — admin reassignment. */
+export async function handleRegistryOwnerSet(
+  args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  const argErr = validateRequiredArgs(args, 2);
+  if (argErr) {
+    return {
+      success: false,
+      error: `${argErr}\n\nUsage: celilo registry owner set <module> <owner-sub>`,
+    };
+  }
+  const name = getArg(args, 0)?.trim();
+  const ownerSub = getArg(args, 1)?.trim();
+  if (!name) return { success: false, error: 'Module name is required' };
+  if (!ownerSub) return { success: false, error: 'Owner subject is required' };
+
+  const token = await resolveAdminToken();
+  if (isError(token)) return token;
+
+  const client = clientFrom(flags);
+  try {
+    const owner = await client.setOwner(name, ownerSub, token);
+    return { success: true, message: `Reassigned ${owner.moduleName} → ${owner.ownerSub}` };
+  } catch (err) {
+    return registryError(err);
+  }
+}

package/src/cli/commands/registry-token.test.ts

@@ -0,0 +1,109 @@
+/**
+ * Regression tests for F2 (SECURE_MODULE_PUBLISH.md): `module secret set
+ * celilo-registry publish_tokens` clobbers the whole newline-separated list.
+ * `registry token add`/`rm` must read-modify-write instead.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { existsSync } from 'node:fs';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { closeDb, getDb } from '../../db/client';
+import { modules } from '../../db/schema';
+import { CrossModuleDataManager } from '../../services/cross-module-data-manager';
+import { handleRegistryTokenAdd, handleRegistryTokenRm } from './registry-token';
+
+/** Read back the stored publish_tokens list via the production read path. */
+async function readStoredTokens(): Promise<string[]> {
+  const manager = new CrossModuleDataManager();
+  await manager.initialize();
+  const raw = manager.getSecret('celilo-registry', 'publish_tokens');
+  if (!raw) return [];
+  return raw
+    .split('\n')
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0);
+}
+
+describe('registry token add/rm (F2 clobber fix)', () => {
+  let dataDir: string;
+
+  beforeEach(async () => {
+    dataDir = await mkdtemp(join(tmpdir(), 'celilo-registry-token-'));
+    process.env.CELILO_DATA_DIR = dataDir;
+    process.env.CELILO_DB_PATH = join(dataDir, 'celilo.db');
+
+    // Seed the celilo-registry module row (FK target for the secrets row).
+    getDb()
+      .insert(modules)
+      .values({
+        id: 'celilo-registry',
+        name: 'Celilo Registry',
+        version: '1.0.0',
+        sourcePath: '/test',
+        manifestData: {},
+      })
+      .run();
+  });
+
+  afterEach(async () => {
+    closeDb();
+    process.env.CELILO_DATA_DIR = undefined;
+    process.env.CELILO_DB_PATH = undefined;
+    if (existsSync(dataDir)) {
+      await rm(dataDir, { recursive: true, force: true });
+    }
+  });
+
+  test('add appends without clobbering existing tokens (F2 regression)', async () => {
+    await handleRegistryTokenAdd(['token-a']);
+    await handleRegistryTokenAdd(['token-b']);
+    await handleRegistryTokenAdd(['token-c']);
+
+    const result = await handleRegistryTokenAdd(['token-d']);
+    expect(result.success).toBe(true);
+
+    // The whole point of F2: adding token-d must NOT wipe a/b/c.
+    expect((await readStoredTokens()).sort()).toEqual(['token-a', 'token-b', 'token-c', 'token-d']);
+  });
+
+  test('rm removes one line, leaves the others', async () => {
+    await handleRegistryTokenAdd(['token-a']);
+    await handleRegistryTokenAdd(['token-b']);
+    await handleRegistryTokenAdd(['token-c']);
+
+    const result = await handleRegistryTokenRm(['token-b']);
+    expect(result.success).toBe(true);
+
+    expect((await readStoredTokens()).sort()).toEqual(['token-a', 'token-c']);
+  });
+
+  test('add is idempotent — no duplicate line', async () => {
+    await handleRegistryTokenAdd(['token-a']);
+    const result = await handleRegistryTokenAdd(['token-a']);
+    expect(result.success).toBe(true);
+
+    expect(await readStoredTokens()).toEqual(['token-a']);
+  });
+
+  test('rm of an absent token errors', async () => {
+    await handleRegistryTokenAdd(['token-a']);
+    const result = await handleRegistryTokenRm(['token-x']);
+    expect(result.success).toBe(false);
+  });
+
+  test('add requires a token argument', async () => {
+    const result = await handleRegistryTokenAdd([]);
+    expect(result.success).toBe(false);
+  });
+
+  test('errors when celilo-registry module is not installed', async () => {
+    getDb().delete(modules).run();
+    const result = await handleRegistryTokenAdd(['token-a']);
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error).toContain('celilo-registry');
+    }
+  });
+});

package/src/cli/commands/registry-token.ts

@@ -0,0 +1,194 @@
+/**
+ * Registry publish-token management (append-safe)
+ *
+ * `celilo module secret set celilo-registry publish_tokens <v>` OVERWRITES the
+ * whole value. Because publish_tokens is a newline-separated list, that clobbers
+ * every other holder (external CI, scoped bootstrap tokens) whenever you rotate
+ * or add one token. These commands do a read-modify-write on the list instead.
+ *
+ * Runs on-mgr where the master key lives; never resurfaces the raw admin value
+ * to a laptop. Runtime-minted scoped tokens are handled elsewhere — this is the
+ * human-managed bootstrap/admin list only.
+ */
+
+import { and, eq } from 'drizzle-orm';
+import { getDb } from '../../db/client';
+import { modules, secrets } from '../../db/schema';
+import { decryptSecret, encryptSecret } from '../../secrets/encryption';
+import { getOrCreateMasterKey } from '../../secrets/master-key';
+import { getArg, validateRequiredArgs } from '../parser';
+import type { CommandResult } from '../types';
+
+const REGISTRY_MODULE_ID = 'celilo-registry';
+const PUBLISH_TOKENS_SECRET = 'publish_tokens';
+
+type CommandError = Extract<CommandResult, { success: false }>;
+
+/** Split a newline-separated token blob into trimmed, non-empty lines. */
+function parseTokens(raw: string | null): string[] {
+  if (!raw) return [];
+  return raw
+    .split('\n')
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0);
+}
+
+interface TokenStore {
+  masterKey: Buffer;
+  /** Existing secrets row id, or null if publish_tokens isn't set yet. */
+  rowId: number | null;
+  tokens: string[];
+}
+
+/**
+ * Read the current publish_tokens list (decrypted). Errors if celilo-registry
+ * isn't installed locally — these commands must run where the module lives.
+ */
+async function readTokenStore(): Promise<TokenStore | CommandError> {
+  const db = getDb();
+
+  const registryModule = db.select().from(modules).where(eq(modules.id, REGISTRY_MODULE_ID)).get();
+  if (!registryModule) {
+    return {
+      success: false,
+      error: `Module not found: ${REGISTRY_MODULE_ID}\n\nRun these commands on the host where celilo-registry is deployed (where the master key lives).`,
+    };
+  }
+
+  let masterKey: Buffer;
+  try {
+    masterKey = await getOrCreateMasterKey();
+  } catch (err) {
+    return { success: false, error: 'Failed to access master key', details: err };
+  }
+
+  const row = db
+    .select()
+    .from(secrets)
+    .where(and(eq(secrets.moduleId, REGISTRY_MODULE_ID), eq(secrets.name, PUBLISH_TOKENS_SECRET)))
+    .get();
+
+  const tokens = row
+    ? parseTokens(
+        decryptSecret(
+          { encryptedValue: row.encryptedValue, iv: row.iv, authTag: row.authTag },
+          masterKey,
+        ),
+      )
+    : [];
+
+  return { masterKey, rowId: row?.id ?? null, tokens };
+}
+
+function isError(v: TokenStore | CommandError): v is CommandError {
+  return 'success' in v && v.success === false;
+}
+
+/** Encrypt the list and upsert the publish_tokens row. */
+function writeTokens(store: TokenStore, tokens: string[]): void {
+  const db = getDb();
+  const encrypted = encryptSecret(tokens.join('\n'), store.masterKey);
+
+  if (store.rowId !== null) {
+    db.update(secrets)
+      .set({
+        encryptedValue: encrypted.encryptedValue,
+        iv: encrypted.iv,
+        authTag: encrypted.authTag,
+        updatedAt: new Date(),
+      })
+      .where(eq(secrets.id, store.rowId))
+      .run();
+    return;
+  }
+
+  db.insert(secrets)
+    .values({
+      moduleId: REGISTRY_MODULE_ID,
+      name: PUBLISH_TOKENS_SECRET,
+      encryptedValue: encrypted.encryptedValue,
+      iv: encrypted.iv,
+      authTag: encrypted.authTag,
+    })
+    .run();
+}
+
+/**
+ * Resolve the local admin/bootstrap publish token (ce-1ch) — the first
+ * bootstrap line with no package scope (a bare `<token>`), which the admin
+ * owner-management endpoints require. Runs on-mgr where publish_tokens lives.
+ * Returns the raw token or a CommandError describing what's missing.
+ */
+export async function resolveAdminToken(): Promise<string | CommandError> {
+  const store = await readTokenStore();
+  if (isError(store)) return store;
+  // A scoped line is `<token> <package>`; the admin/bootstrap token is a bare
+  // single-field line. Pick the first one.
+  const admin = store.tokens.find((line) => line.split(/\s+/).length === 1);
+  if (!admin) {
+    return {
+      success: false,
+      error:
+        'No admin publish token found in publish_tokens.\n\nAdd one with: celilo registry token add <admin-token>',
+    };
+  }
+  return admin;
+}
+
+/**
+ * Handle `celilo registry token add <token>`.
+ * Appends a token to publish_tokens without clobbering existing holders.
+ * Idempotent — adding a token that's already present is a no-op.
+ */
+export async function handleRegistryTokenAdd(args: string[]): Promise<CommandResult> {
+  const err = validateRequiredArgs(args, 1);
+  if (err) {
+    return { success: false, error: `${err}\n\nUsage: celilo registry token add <token>` };
+  }
+  const token = getArg(args, 0)?.trim();
+  if (!token) {
+    return { success: false, error: 'Token value is required' };
+  }
+
+  const store = await readTokenStore();
+  if (isError(store)) return store;
+
+  if (store.tokens.includes(token)) {
+    return { success: true, message: 'Token already present — no change' };
+  }
+
+  writeTokens(store, [...store.tokens, token]);
+  return {
+    success: true,
+    message: `Added publish token (${store.tokens.length + 1} total)`,
+  };
+}
+
+/**
+ * Handle `celilo registry token rm <token>`.
+ * Removes one token from publish_tokens, leaving the others intact.
+ */
+export async function handleRegistryTokenRm(args: string[]): Promise<CommandResult> {
+  const err = validateRequiredArgs(args, 1);
+  if (err) {
+    return { success: false, error: `${err}\n\nUsage: celilo registry token rm <token>` };
+  }
+  const token = getArg(args, 0)?.trim();
+  if (!token) {
+    return { success: false, error: 'Token value is required' };
+  }
+
+  const store = await readTokenStore();
+  if (isError(store)) return store;
+
+  if (!store.tokens.includes(token)) {
+    return { success: false, error: 'Token not found in publish_tokens' };
+  }
+
+  const remaining = store.tokens.filter((t) => t !== token);
+  writeTokens(store, remaining);
+  return {
+    success: true,
+    message: `Removed publish token (${remaining.length} remaining)`,
+  };
+}

package/src/cli/commands/restore.ts

@@ -12,7 +12,7 @@
  * Calls restoreFromArtifactFile, then runs Drizzle migrations on the
  * restored DB so a backup from an older celilo still opens cleanly.
  *
- * Phase 4 of v2/SYSTEM_BACKUP_TERRAFORM_STATE.md.
+ * Phase 4 of openspec/specs/management-server-backup/spec.md.
  */
 
 import { existsSync } from 'node:fs';

package/src/cli/commands/service-add-proxmox.ts

@@ -146,7 +146,7 @@ export async function handleServiceAddProxmox(
 
       // VM template for `requires.system.type: vm` modules.
       // Auto-detect existing templates on the node; offer to build if none found.
-      // See v2/PROXMOX_VM_TEMPLATE.md.
+      // See reference/PROXMOX_VM_TEMPLATE.md.
       let vmTemplate: string | undefined;
       const existingTemplates = await detectExistingVmTemplates(credentials, targetNode);
       if (existingTemplates.length > 0) {

package/src/cli/commands/service-list.ts

@@ -22,8 +22,6 @@ export async function handleServiceList(
   flags: Record<string, boolean | string> = {},
 ): Promise<CommandResult> {
   try {
-    celiloIntro('Container Services');
-
     // Apply zone filter if provided
     const filters: ContainerServiceFilters = {};
     if (flags.zone && typeof flags.zone === 'string') {
@@ -32,6 +30,21 @@ export async function handleServiceList(
 
     const services = await listContainerServices(filters);
 
+    // Machine-readable output (consumed by @celilo/mcp auto-detect). Emit the
+    // fields detection needs — provider drives which tool groups surface.
+    if (flags.json) {
+      const payload = services.map((s) => ({
+        serviceId: s.serviceId,
+        name: s.name,
+        provider: s.providerName,
+        zones: s.zones,
+        verified: s.verified,
+      }));
+      return { success: true, message: JSON.stringify(payload), rawOutput: true };
+    }
+
+    celiloIntro('Container Services');
+
     if (services.length === 0) {
       console.log('No container services configured.\n');
       console.log('Add a service:');

package/src/cli/commands/subscribers-list.ts

@@ -1,7 +1,7 @@
 /**
  * `celilo subscribers list` — show registered build-bus subscribers.
  *
- * Reads the static-config subscriber list ([[v2/BUILD_BUS.md]] Phase
+ * Reads the static-config subscriber list ([[openspec/changes/build-bus-poll-cd/proposal.md]] Phase
  * 2-lite — registry-server switchboard is deferred). Doesn't print
  * the HMAC secret in cleartext — only a truncated hash so operators
  * can disambiguate subscribers without leaking credentials into

package/src/cli/commands/system-apply-config-equivalence.test.ts

@@ -1,5 +1,5 @@
 /**
- * End-to-end equivalence test for v2/MANAGEMENT_AS_NETAPP.md Phase 2.
+ * End-to-end equivalence test for openspec/specs/management-as-module/spec.md Phase 2.
  *
  * The spec calls for "celilo system apply-config" to write the same
  * systemConfig state that the legacy `celilo system init` produces,

package/src/cli/commands/system-apply-config.ts

@@ -1,7 +1,7 @@
 /**
  * `celilo system apply-config` — headless write to systemConfig.
  *
- * Phase 2 of v2/MANAGEMENT_AS_NETAPP.md: the celilo-mgmt module's
+ * Phase 2 of openspec/specs/management-as-module/spec.md: the celilo-mgmt module's
  * on_install hook needs a CLI surface it can shell out to that writes
  * the operator-chosen network/DNS/SSH config without the interactive
  * framing of `celilo system init`. This is that command.

package/src/cli/commands/system-init-deprecation.test.ts

@@ -1,5 +1,5 @@
 /**
- * Phase 5 of v2/MANAGEMENT_AS_NETAPP.md — confirm `celilo system init`
+ * Phase 5 of openspec/specs/management-as-module/spec.md — confirm `celilo system init`
  * surfaces a deprecation banner pointing at the new paths
  * (bootstrap.sh + `system apply-config`), and that
  * CELILO_SUPPRESS_DEPRECATION=1 silences it.

package/src/cli/commands/system-init.ts

@@ -45,7 +45,7 @@ export async function handleSystemInit(
   const cliOverrides = parseOverrides(args);
   const db = getDb();
 
-  // Phase 5 of v2/MANAGEMENT_AS_NETAPP.md — surface that this command
+  // Phase 5 of openspec/specs/management-as-module/spec.md — surface that this command
   // is on its way out so operators have time to migrate to the new
   // paths. Keeps working unchanged; the banner just points at the
   // replacements. CELILO_SUPPRESS_DEPRECATION=1 silences for callers
@@ -172,7 +172,7 @@ async function initInteractive(cliOverrides: Record<string, string> = {}): Promi
 
     // Network and DNS addressing are intentionally NOT prompted here.
     // Network topology is no longer owned by `system init`
-    // (v2/NETWORK_CONFIG_TO_FIREWALL.md): the `internal` zone and DNS are
+    // (openspec/specs/progressive-zone-disclosure/spec.md): the `internal` zone and DNS are
     // discovered when celilo-mgmt is deployed, and `dmz`/`app`/`secure`
     // come from a firewall module. The only thing left to capture
     // interactively is the SSH key celilo uses to reach managed machines.

package/src/cli/commands/token.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from 'bun:test';
+import { handleTokenList, handleTokenObtain, handleTokenRevoke } from './token';
+
+// These cover the argument-validation paths that short-circuit BEFORE the idp
+// capability is loaded — no DB or authentik needed. The idp-side behavior
+// (mint / list / revoke) is covered in modules/authentik/scripts/idp-functions.test.ts.
+
+describe('celilo token — argument validation', () => {
+  test('obtain requires a username', async () => {
+    const result = await handleTokenObtain([], {});
+    expect(result.success).toBe(false);
+    if (!result.success) expect(result.error).toMatch(/Username required/);
+  });
+
+  test('list requires a username', async () => {
+    const result = await handleTokenList([], {});
+    expect(result.success).toBe(false);
+    if (!result.success) expect(result.error).toMatch(/Username required/);
+  });
+
+  test('revoke requires an identifier', async () => {
+    const result = await handleTokenRevoke([], {});
+    expect(result.success).toBe(false);
+    if (!result.success) expect(result.error).toMatch(/Identifier required/);
+  });
+});