@celilo/cli 0.13.3 → 0.14.1

package/src/cli/commands/module-list.ts

@@ -1,5 +1,8 @@
-import { getDb } from '../../db/client';
-import { modules } from '../../db/schema';
+import { eq } from 'drizzle-orm';
+import { type DbClient, getDb } from '../../db/client';
+import { modules, modules as modulesTable, monitors } from '../../db/schema';
+import { moduleHealthCell } from '../../services/alerting/format';
+import { loadAllLiveAlerts, summariseByModule } from '../../services/alerting/store';
 import { hasFlag } from '../parser';
 import type { CommandResult } from '../types';
 
@@ -36,10 +39,18 @@ export async function handleModuleList(
     };
   }
 
+  // Observed health, derived from live alerts rather than from module state.
+  // The two answer different questions: `state` says whether someone
+  // deliberately verified this module, `health` says whether it is working
+  // right now. "not observed" is a finding, not a blank — see design D15.
+  const health = loadObservedHealth(db);
+
   // Format module list
   const lines = ['Installed modules:', ''];
   for (const module of moduleRows) {
-    lines.push(`${module.id} (v${module.version}) - ${module.state}`);
+    const observed = health.get(module.id);
+    const healthNote = observed ? `  [${observed}]` : '';
+    lines.push(`${module.id} (v${module.version}) - ${module.state}${healthNote}`);
     if (module.description) {
       lines.push(`  ${module.description}`);
     }
@@ -55,3 +66,39 @@ export async function handleModuleList(
     data: moduleRows,
   };
 }
+
+/**
+ * Observed health per module: `ok`, `N firing`, `suppressed`, or
+ * `not observed`.
+ *
+ * Only computed for DEPLOYED modules — a module still being imported has
+ * nothing to observe, and reporting it as unwatched would be noise rather
+ * than a finding.
+ */
+function loadObservedHealth(db: DbClient): Map<string, string> {
+  const monitored = new Set(
+    db
+      .select({ target: monitors.target })
+      .from(monitors)
+      .where(eq(monitors.enabled, true))
+      .all()
+      .map((m) => m.target),
+  );
+  const byModule = summariseByModule(loadAllLiveAlerts(db));
+
+  const result = new Map<string, string>();
+  for (const module of db.select().from(modulesTable).all()) {
+    if (module.state !== 'INSTALLED' && module.state !== 'VERIFIED') continue;
+
+    const summary = byModule.get(module.id) ?? [];
+    result.set(
+      module.id,
+      moduleHealthCell({
+        monitored: monitored.has(module.id),
+        firingCount: summary.filter((s) => !s.suppressed).length,
+        suppressed: summary.length > 0 && summary.every((s) => s.suppressed),
+      }),
+    );
+  }
+  return result;
+}

package/src/cli/commands/module-show.ts

@@ -5,7 +5,7 @@
 
 import { eq } from 'drizzle-orm';
 import { getDb } from '../../db/client';
-import { modules } from '../../db/schema';
+import { type NetworkZone, modules } from '../../db/schema';
 import { type ModuleManifest, getSingularSystemSpec } from '../../manifest/schema';
 import { buildResolutionContext } from '../../variables/context';
 import { getArg, validateRequiredArgs } from '../parser';
@@ -161,14 +161,22 @@ export async function handleModuleShowZone(args: string[]): Promise<CommandResul
       };
     }
 
-    const zoneDescriptions: Record<string, string> = {
+    // Keyed by NetworkZone, not string: a new zone added to NETWORK_ZONES becomes a
+    // compile error here rather than silently rendering as "Unknown zone". Both
+    // `internal` and `secure-mgmt` were missing from the previous string-keyed map.
+    const zoneDescriptions: Record<NetworkZone, string> = {
+      internal: 'Internal (Semi-trusted network behind the firewall)',
       dmz: 'DMZ (Public-facing services)',
       app: 'Application (Internal services)',
       secure: 'Secure (Authentication/Database)',
+      'secure-mgmt': "Secure-Mgmt (celilo's own control plane)",
       external: 'External (VPS/Cloud)',
     };
 
-    const description = zoneDescriptions[zone] || 'Unknown zone';
+    // Cast at the lookup, not the declaration: `zone` comes from config and may be
+    // any string, so the runtime fallback stays — but the map above still has to
+    // cover every NetworkZone.
+    const description = zoneDescriptions[zone as NetworkZone] ?? 'Unknown zone';
 
     const lines = [`Module: ${moduleId}`, `Zone: ${zone} - ${description}`, ''];
 

package/src/cli/commands/monitor.ts

@@ -0,0 +1,178 @@
+/**
+ * `celilo monitor` — what celilo is watching, and running a check on demand.
+ *
+ * Thin adapter (Rule 10.5): parse, delegate, format. The scheduling decisions
+ * live in services/alerting/, and this command composes the real health runner
+ * and audit checks into the injectable deps `runOneMonitor` expects.
+ */
+
+import { defineEvents, openBus } from '@celilo/event-bus';
+import { getEventBusPath } from '../../config/paths';
+import { getDb } from '../../db/client';
+import type { MonitorKind } from '../../db/schema';
+import { parseIntervalMinutes } from '../../manifest/schema';
+import { runBuiltinCheckForMonitor } from '../../services/alerting/builtin-source';
+import { loadModuleCoverage } from '../../services/alerting/coverage-source';
+import { HEALTH_COVERAGE_CHECK } from '../../services/alerting/health-coverage';
+import {
+  createMonitor,
+  ensureSweepSubscriber,
+  findMonitorByTarget,
+  listMonitors,
+  setMonitorEnabled,
+} from '../../services/alerting/monitors';
+import { runOneMonitor } from '../../services/alerting/run-monitor';
+import { promoteReadyAlerts } from '../../services/alerting/store';
+import type { DriftCategory } from '../../services/audit/types';
+import { runModuleHealthCheck } from '../../services/health-runner';
+import type { CommandResult } from '../types';
+
+const NO_SCHEMAS = defineEvents({});
+
+/** Grace window before a newly-fired alert may notify. */
+const DEFAULT_GRACE_MS = 60_000;
+
+function buildDeps() {
+  const db = getDb();
+  return {
+    runModuleCheck: (moduleId: string) =>
+      runModuleHealthCheck(moduleId, db, { unattended: true, noInteractive: true }),
+    runBuiltinCheck: (category: DriftCategory) => runBuiltinCheckForMonitor(category),
+    loadModuleCoverage: () => loadModuleCoverage(db),
+    now: () => new Date(),
+    graceMs: DEFAULT_GRACE_MS,
+  };
+}
+
+function handleList(): CommandResult {
+  const rows = listMonitors(getDb());
+  if (rows.length === 0) {
+    console.log('\nNo monitors configured.\n');
+    console.log('A module declaring hooks.health_check.interval gets one on deploy,');
+    console.log('or add one directly:  celilo monitor add <module> --interval 15m\n');
+    return { success: true, message: 'No monitors configured' };
+  }
+
+  const width = Math.max(6, ...rows.map((r) => r.target.length));
+  console.log('');
+  console.log(`${'TARGET'.padEnd(width)}  ${'KIND'.padEnd(14)}  ${'EVERY'.padEnd(6)}  STATE`);
+  for (const monitor of rows) {
+    const state = monitor.enabled ? 'enabled' : 'disabled';
+    const suffix = monitor.lastRunAt ? '' : '  (never run)';
+    const every = `${monitor.intervalMinutes}m`;
+    console.log(
+      `${monitor.target.padEnd(width)}  ${monitor.kind.padEnd(14)}  ${every.padEnd(6)}  ${state}${suffix}`,
+    );
+  }
+  console.log('');
+  return { success: true, message: `${rows.length} monitor(s)` };
+}
+
+function handleAdd(args: string[], flags: Record<string, boolean | string>): CommandResult {
+  const target = args[0];
+  if (!target) {
+    return { success: false, error: 'Usage: celilo monitor add <target> [--interval 15m]' };
+  }
+
+  const db = getDb();
+  if (findMonitorByTarget(db, target)) {
+    return { success: false, error: `A monitor for "${target}" already exists.` };
+  }
+
+  const interval = typeof flags.interval === 'string' ? flags.interval : '15m';
+  const intervalMinutes = parseIntervalMinutes(interval);
+  if (intervalMinutes === null) {
+    return {
+      success: false,
+      error: `Invalid --interval "${interval}". Use a duration like "15m", "1h", or "1d".`,
+    };
+  }
+
+  // A target naming an audit category is a built-in check; anything else is a
+  // module's health_check hook.
+  const kind: MonitorKind =
+    target === HEALTH_COVERAGE_CHECK || target.includes('_') ? 'builtin_check' : 'module_hook';
+
+  createMonitor(db, { kind, target, intervalMinutes });
+
+  // Creating the first monitor is also what switches the sweep on. Registering
+  // here rather than at install means a celilo with no monitors carries no
+  // subscriber and does no periodic work.
+  const bus = openBus({ dbPath: getEventBusPath(), events: NO_SCHEMAS });
+  try {
+    ensureSweepSubscriber(bus);
+  } finally {
+    bus.close();
+  }
+
+  return {
+    success: true,
+    message: `Monitoring ${target} every ${interval} (sweep runs on timer.tick.5m)`,
+  };
+}
+
+async function handleRun(args: string[]): Promise<CommandResult> {
+  const target = args[0];
+  if (!target) return { success: false, error: 'Usage: celilo monitor run <target>' };
+
+  const db = getDb();
+  const monitor = findMonitorByTarget(db, target);
+  if (!monitor) {
+    return {
+      success: false,
+      error: `No monitor for "${target}".\n\nRun "celilo monitor list" to see configured monitors.`,
+    };
+  }
+
+  const summary = await runOneMonitor(db, monitor, buildDeps());
+  promoteReadyAlerts(db, new Date());
+
+  if (summary.outcome === 'error') {
+    return {
+      success: true,
+      message: `${target}: check could not run — ${summary.errorMessage ?? 'unknown error'}`,
+    };
+  }
+  return {
+    success: true,
+    message: `${target}: ${summary.failingKeyCount} failing, ${summary.resolvedIds.length} resolved`,
+  };
+}
+
+function handleToggle(args: string[], enabled: boolean): CommandResult {
+  const target = args[0];
+  const verb = enabled ? 'enable' : 'disable';
+  if (!target) return { success: false, error: `Usage: celilo monitor ${verb} <target>` };
+
+  const db = getDb();
+  const monitor = findMonitorByTarget(db, target);
+  if (!monitor) return { success: false, error: `No monitor for "${target}".` };
+
+  setMonitorEnabled(db, monitor.id, enabled, new Date());
+  return { success: true, message: `Monitor for ${target} ${enabled ? 'enabled' : 'disabled'}` };
+}
+
+export async function handleMonitor(
+  subcommand: string | undefined,
+  args: string[],
+  flags: Record<string, boolean | string> = {},
+): Promise<CommandResult> {
+  switch (subcommand) {
+    case undefined:
+    case 'list':
+      return handleList();
+    case 'add':
+      return handleAdd(args, flags);
+    case 'run':
+      return handleRun(args);
+    case 'enable':
+      return handleToggle(args, true);
+    case 'disable':
+      return handleToggle(args, false);
+    default:
+      return {
+        success: false,
+        error: `Unknown monitor subcommand: ${subcommand}\n\nUse: list, add, run, enable, disable`,
+      };
+  }
+}