@celilo/cli 0.14.4 → 0.15.0

package/src/services/backup-sweep.test.ts

@@ -0,0 +1,148 @@
+import { describe, expect, test } from 'bun:test';
+import type { ModuleManifest } from '../manifest/schema';
+import type { BackupSchedule } from './backup-schedule';
+import {
+  BACKUP_SWEEP_PATTERN,
+  BACKUP_SWEEP_SUBSCRIBER,
+  type BackupSweepDeps,
+  type BackupSweepModule,
+  ensureBackupSweepSubscriber,
+  runBackupSweep,
+} from './backup-sweep';
+import { InFlightError } from './module-operations';
+
+function moduleWith(id: string, schedule?: BackupSchedule): BackupSweepModule {
+  const manifest = {
+    id,
+    hooks: { on_backup: { script: 'backup.ts' } },
+    ...(schedule ? { backup: { schedule } } : {}),
+  } as unknown as ModuleManifest;
+  return { id, manifest };
+}
+
+function deps(
+  modules: BackupSweepModule[],
+  overrides: Partial<BackupSweepDeps> = {},
+): BackupSweepDeps & { pruned: string[] } {
+  const pruned: string[] = [];
+  return {
+    pruned,
+    listEligible: () => modules,
+    isDue: () => true,
+    backup: async () => ({ success: true }),
+    prune: async ({ id }) => {
+      pruned.push(id);
+    },
+    ...overrides,
+  };
+}
+
+describe('runBackupSweep', () => {
+  test('backs up a module whose declared cadence is due', async () => {
+    const d = deps([moduleWith('authentik', 'daily')]);
+    const report = await runBackupSweep(d);
+
+    expect(report.backedUp).toEqual(['authentik']);
+    expect(report.failures).toEqual([]);
+    expect(d.pruned).toEqual(['authentik']);
+  });
+
+  test('skips a module that is not yet due', async () => {
+    const report = await runBackupSweep(
+      deps([moduleWith('authentik', 'daily')], { isDue: () => false }),
+    );
+
+    expect(report.backedUp).toEqual([]);
+    expect(report.skippedNotDue).toEqual(['authentik']);
+  });
+
+  test('never auto-backs-up an explicit manual schedule', async () => {
+    const report = await runBackupSweep(deps([moduleWith('scratch', 'manual')]));
+
+    expect(report.backedUp).toEqual([]);
+    expect(report.skippedManual).toEqual(['scratch']);
+  });
+
+  test('an undeclared schedule is backed up, not treated as manual', async () => {
+    // The regression this whole subsystem exists for: forgejo and signal
+    // declare no `backup:` block and had never been backed up.
+    const report = await runBackupSweep(deps([moduleWith('forgejo')]));
+
+    expect(report.backedUp).toEqual(['forgejo']);
+    expect(report.skippedManual).toEqual([]);
+  });
+
+  test('a held operation lock is a skip, not a failure, and stops the pass', async () => {
+    const d = deps([moduleWith('authentik', 'daily'), moduleWith('forgejo', 'daily')], {
+      backup: async () => {
+        throw new InFlightError([]);
+      },
+    });
+    const report = await runBackupSweep(d);
+
+    expect(report.skippedLocked).toEqual(['authentik']);
+    expect(report.failures).toEqual([]);
+    expect(report.backedUp).toEqual([]);
+    expect(d.pruned).toEqual([]);
+  });
+
+  test('a failed backup is recorded and the remaining modules still run', async () => {
+    const report = await runBackupSweep(
+      deps([moduleWith('authentik', 'daily'), moduleWith('forgejo', 'daily')], {
+        backup: async (moduleId) =>
+          moduleId === 'authentik' ? { success: false, error: 'hook exited 1' } : { success: true },
+      }),
+    );
+
+    expect(report.failures).toEqual([{ moduleId: 'authentik', error: 'hook exited 1' }]);
+    expect(report.backedUp).toEqual(['forgejo']);
+  });
+
+  test('a thrown storage error fails only that module', async () => {
+    const report = await runBackupSweep(
+      deps([moduleWith('authentik', 'daily'), moduleWith('forgejo', 'daily')], {
+        backup: async (moduleId) => {
+          if (moduleId === 'authentik') throw new Error('Storage not verified');
+          return { success: true };
+        },
+      }),
+    );
+
+    expect(report.failures).toEqual([{ moduleId: 'authentik', error: 'Storage not verified' }]);
+    expect(report.backedUp).toEqual(['forgejo']);
+  });
+
+  test('does not prune when a backup failed', async () => {
+    const d = deps([moduleWith('authentik', 'daily')], {
+      backup: async () => ({ success: false, error: 'nope' }),
+    });
+    await runBackupSweep(d);
+
+    expect(d.pruned).toEqual([]);
+  });
+});
+
+describe('ensureBackupSweepSubscriber', () => {
+  test('registers the hourly sweep handler', () => {
+    const calls: Array<{
+      name: string;
+      pattern: string;
+      handler: string;
+      registeredBy?: string;
+    }> = [];
+    ensureBackupSweepSubscriber({
+      subscribe: (options) => calls.push(options),
+    });
+
+    expect(calls).toEqual([
+      {
+        name: BACKUP_SWEEP_SUBSCRIBER,
+        pattern: BACKUP_SWEEP_PATTERN,
+        handler: 'celilo backup sweep',
+        registeredBy: 'celilo-backup',
+      },
+    ]);
+    // 1h is the coarsest tick that can still serve an `hourly` cadence.
+    expect(BACKUP_SWEEP_PATTERN).toBe('timer.tick.1h');
+  });
+});

package/src/services/backup-sweep.ts

@@ -0,0 +1,124 @@
+/**
+ * The thing that actually runs backups on a schedule.
+ *
+ * A manifest's `backup.schedule` was decorative until this existed: the drift
+ * audit reported staleness and `celilo module backup` needed a human. This is
+ * the pass that makes a module declaring `daily` get backed up daily with
+ * nobody watching.
+ *
+ * No new scheduling mechanism. Registered as an ordinary bus subscriber whose
+ * handler is `celilo backup sweep` against `timer.tick.1h`, exactly like the
+ * alerting sweep (`services/alerting/monitors.ts`) — the timer already exists,
+ * already survives restarts, and already has retry and dedup. One hour is the
+ * coarsest tick that can still serve an `hourly` cadence; `1d` cannot.
+ *
+ * Dependencies are injected so the pass itself tests with no database, no
+ * storage, and no hook execution.
+ */
+
+import type { ModuleManifest } from '../manifest/schema';
+import { type BackupSchedule, effectiveBackupSchedule } from './backup-schedule';
+import { InFlightError } from './module-operations';
+
+export const BACKUP_SWEEP_SUBSCRIBER = 'celilo-backup-sweep';
+export const BACKUP_SWEEP_PATTERN = 'timer.tick.1h';
+
+export interface SubscriberRegistrar {
+  subscribe(options: {
+    name: string;
+    pattern: string;
+    handler: string;
+    registeredBy?: string;
+  }): unknown;
+}
+
+/**
+ * Idempotent: `bus.subscribe` upserts by name, so this is safe to call on
+ * every module install and update.
+ */
+export function ensureBackupSweepSubscriber(bus: SubscriberRegistrar): void {
+  bus.subscribe({
+    name: BACKUP_SWEEP_SUBSCRIBER,
+    pattern: BACKUP_SWEEP_PATTERN,
+    handler: 'celilo backup sweep',
+    registeredBy: 'celilo-backup',
+  });
+}
+
+export interface BackupSweepModule {
+  id: string;
+  manifest: ModuleManifest;
+}
+
+export interface BackupSweepDeps {
+  /** Installed modules that declare an `on_backup` hook. */
+  listEligible(): BackupSweepModule[];
+  isDue(moduleId: string, schedule: BackupSchedule): boolean;
+  backup(moduleId: string): Promise<{ success: boolean; error?: string }>;
+  /** Apply the module's declared retention. No-op when it declares none. */
+  prune(module: BackupSweepModule): Promise<void>;
+}
+
+export interface BackupSweepReport {
+  backedUp: string[];
+  /** Explicit `schedule: manual` — the author opted out. */
+  skippedManual: string[];
+  skippedNotDue: string[];
+  /** Another module operation held the lock. Not a failure; retried next tick. */
+  skippedLocked: string[];
+  failures: Array<{ moduleId: string; error: string }>;
+}
+
+export async function runBackupSweep(deps: BackupSweepDeps): Promise<BackupSweepReport> {
+  const report: BackupSweepReport = {
+    backedUp: [],
+    skippedManual: [],
+    skippedNotDue: [],
+    skippedLocked: [],
+    failures: [],
+  };
+
+  for (const module of deps.listEligible()) {
+    const schedule = effectiveBackupSchedule(module.manifest);
+    if (schedule === 'manual') {
+      report.skippedManual.push(module.id);
+      continue;
+    }
+    if (!deps.isDue(module.id, schedule)) {
+      report.skippedNotDue.push(module.id);
+      continue;
+    }
+
+    let result: { success: boolean; error?: string };
+    try {
+      result = await deps.backup(module.id);
+    } catch (error) {
+      // Refusing to run while a deploy/restore is in flight is correct, and a
+      // scheduled run must not bypass it. The lock is global, so once it is
+      // held every remaining module would refuse identically — stop the pass
+      // rather than collect the same refusal N times. The next tick retries.
+      if (error instanceof InFlightError) {
+        report.skippedLocked.push(module.id);
+        break;
+      }
+      // Everything else — an unverified storage destination, a missing default
+      // — throws before a backup row exists. Record it against the module and
+      // keep going; one module's failure must not cancel the rest.
+      report.failures.push({
+        moduleId: module.id,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      continue;
+    }
+
+    if (!result.success) {
+      report.failures.push({ moduleId: module.id, error: result.error ?? 'backup failed' });
+      continue;
+    }
+
+    report.backedUp.push(module.id);
+    await deps.prune(module);
+  }
+
+  return report;
+}

package/src/services/deploy-posture.ts

@@ -3,14 +3,27 @@
  * openspec/changes/build-bus-poll-cd/proposal.md).
  *
  * CD is CI-driven, so no operator is present to pass `--no-backup`. The posture
- * (fast = skip backup + extended verify; safe = backup + full verify) is
- * DERIVED, with this precedence:
+ * (fast = skip the pre-deploy backup; safe = back up first) is DERIVED, with
+ * this precedence:
  *   1. per-module `upgrade_policy: always-safe` — a hard floor (always safe).
  *   2. per-release `deploy_posture` stamped in the .netapp release metadata.
  *   3. per-module `upgrade_policy: always-fast`.
  *   4. default: the semver delta of installed → next (revision/patch = fast;
  *      minor/major = safe).
  *
+ * Posture gates the BACKUP ONLY. Both paths run the same post-deploy verify
+ * (module-upgrade.ts calls runModuleHealthCheck either way), and neither
+ * gates the deploy: verify is the last step, so a failing health check reports
+ * "upgraded but verify failed" on an upgrade that has already landed — there
+ * is no rollback and no auto-restore. This comment previously claimed safe
+ * posture ran a "full verify" against fast's "extended verify"; no such
+ * distinction has ever existed in the code, and believing it makes
+ * `auto_upgrade` sound far more guarded than it is.
+ *
+ * `upgrade_policy` (like `auto_upgrade`) is OPERATOR CONFIG, not a manifest
+ * key — `celilo module config set <module> upgrade_policy always-safe`. The
+ * manifest schema is `.strict()` and declares neither.
+ *
  * celilo reads version NUMBERS, never changesets — the default needs only the
  * versions. All functions here are pure (Rule 10).
  */

package/src/services/module-operations.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { spawnSync } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -7,10 +7,11 @@ import { closeDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import {
   InFlightError,
+  OPERATION_TTL_MS,
   checkInFlight,
   completeOperation,
   failOperation,
-  isPidAlive,
+  isPidRunnable,
   refuseIfInFlight,
   startOperation,
 } from './module-operations';
@@ -95,7 +96,7 @@ describe('module-operations', () => {
       const child = spawnSync('node', ['-e', 'process.exit(0)']);
       const deadPid = child.pid;
       expect(deadPid).toBeGreaterThan(0);
-      expect(isPidAlive(deadPid)).toBe(false);
+      expect(isPidRunnable(deadPid)).toBe(false);
 
       // Insert a fake row with the dead pid via raw SQL (bypasses pid=process.pid in startOperation).
       const { getDb } = require('../db/client');
@@ -141,14 +142,74 @@ describe('module-operations', () => {
     });
   });
 
-  describe('isPidAlive', () => {
+  describe('isPidRunnable', () => {
     it('returns true for the current process', () => {
-      expect(isPidAlive(process.pid)).toBe(true);
+      expect(isPidRunnable(process.pid)).toBe(true);
     });
 
     it('returns false for a dead pid', () => {
       const child = spawnSync('node', ['-e', 'process.exit(0)']);
-      expect(isPidAlive(child.pid as number)).toBe(false);
+      expect(isPidRunnable(child.pid as number)).toBe(false);
+    });
+
+    // The bug this whole module exists to prevent: a Ctrl-Z'd `module deploy`
+    // is still "alive" by kill(pid, 0) and held the backup lock for 20 days.
+    it('returns false for a STOPPED process, which kill(pid, 0) calls alive', () => {
+      const child = spawn('sleep', ['60'], { stdio: 'ignore' });
+      const pid = child.pid as number;
+      try {
+        expect(isPidRunnable(pid)).toBe(true);
+
+        child.kill('SIGSTOP');
+        // Wait for the state change to land in the process table.
+        for (let i = 0; i < 100 && isPidRunnable(pid); i++) spawnSync('sleep', ['0.01']);
+
+        // Still passes the old liveness test...
+        let existsByKill = true;
+        try {
+          process.kill(pid, 0);
+        } catch {
+          existsByKill = false;
+        }
+        expect(existsByKill).toBe(true);
+
+        // ...but is correctly reported as unable to make progress.
+        expect(isPidRunnable(pid)).toBe(false);
+      } finally {
+        child.kill('SIGCONT');
+        child.kill('SIGKILL');
+      }
+    });
+  });
+
+  describe('abandonment by age', () => {
+    function insertRow(id: string, pid: number, startedAt: Date): void {
+      const { getDb } = require('../db/client');
+      const { moduleOperations } = require('../db/schema');
+      getDb()
+        .insert(moduleOperations)
+        .values({
+          id,
+          moduleId: 'ancient',
+          operation: 'deploy',
+          status: 'in_progress',
+          pid,
+          startedAt,
+        })
+        .run();
+    }
+
+    it('ignores a row older than the TTL even though its process is alive', () => {
+      // process.pid is unquestionably running, so age is the only thing that
+      // can release this row. This is the pid-reuse case: an old row whose
+      // number now belongs to some unrelated healthy process.
+      insertRow('ancient-row', process.pid, new Date(Date.now() - OPERATION_TTL_MS - 60_000));
+      expect(checkInFlight()).toHaveLength(0);
+    });
+
+    it('still blocks on a young row whose process is alive', () => {
+      insertRow('fresh-row', process.pid, new Date(Date.now() - 60_000));
+      expect(checkInFlight()).toHaveLength(1);
     });
   });
 });

package/src/services/module-operations.ts

@@ -13,13 +13,23 @@
  *     throw err;
  *   }
  *
- * Rows with status='in_progress' whose pid is no longer alive are
- * treated as abandoned (the process crashed before the completion
- * update landed) and ignored by `checkInFlight()`. This keeps a single
- * Ctrl-C from wedging the system, at the cost of leaving stale rows in
- * the table; a future cleanup command can sweep them.
+ * A row with status='in_progress' stops holding the lock once it looks
+ * abandoned, which is three different things:
+ *
+ *   - the process is GONE      — it crashed before writing completion
+ *   - the process is STOPPED   — suspended (Ctrl-Z) or a zombie, so it
+ *                                will never reach the completion write
+ *   - the row is OLD           — past `OPERATION_TTL_MS`
+ *
+ * Only the first was originally handled, and the other two are not
+ * hypothetical: a `module deploy` Ctrl-Z'd on a lost terminal held the
+ * lock for 20 days and blocked every backup on the fleet.
+ *
+ * Stale rows are ignored rather than deleted; `celilo module operations`
+ * lists them and `... clear` sweeps them.
  */
 
+import { spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { eq } from 'drizzle-orm';
 import { getDb } from '../db/client';
@@ -62,17 +72,51 @@ export function failOperation(operationId: string, error: unknown): void {
 }
 
 /**
- * True if the OS still has a process with the given pid. `kill(pid, 0)`
- * sends no signal but throws ESRCH if the process is gone — the standard
- * idiom for liveness on POSIX.
+ * How long an in_progress row may hold the lock before it is treated as
+ * abandoned regardless of what its process appears to be doing.
+ *
+ * This is not belt-and-braces on the liveness check — it is the only
+ * check that survives pid reuse. A pid is a recycled number, not a
+ * stable identity: a busy host wraps the whole pid space in days, after
+ * which an old row's pid names an unrelated live process and the
+ * liveness check happily reports "still running" forever. Ageing the row
+ * out is the only thing that ends that.
+ *
+ * Two hours is longer than any real deploy and short enough that a wedge
+ * is an inconvenience rather than an outage.
+ */
+export const OPERATION_TTL_MS = 2 * 60 * 60 * 1000;
+
+/**
+ * True if the process can still make progress on its operation.
+ *
+ * `kill(pid, 0)` answers only "does this pid exist". A STOPPED process —
+ * SIGTSTP from a Ctrl-Z, or a lost controlling terminal — passes that
+ * test while being permanently unable to finish, which is exactly how
+ * the 20-day wedge happened. `ps -o state=` reports the state itself and
+ * is spelled the same on Linux and macOS.
  */
-export function isPidAlive(pid: number): boolean {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
+export function isPidRunnable(pid: number): boolean {
+  const result = spawnSync('ps', ['-o', 'state=', '-p', String(pid)], { encoding: 'utf-8' });
+
+  // No usable `ps`. Fall back to bare existence: a stopped process will
+  // still block, which is the old behavior, but we never wrongly release
+  // a lock that a live operation is holding.
+  if (result.error) {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
   }
+
+  if (result.status !== 0) return false; // no such process
+
+  // Linux reports multi-character states ("Tl", "Ss"); the first
+  // character is the state proper. T = stopped, Z = zombie.
+  const state = result.stdout.trim()[0] ?? '';
+  return state !== 'T' && state !== 'Z';
 }
 
 export interface InFlightConflict {
@@ -82,9 +126,10 @@ export interface InFlightConflict {
 }
 
 /**
- * Returns rows that genuinely look in-flight: status='in_progress' AND
- * the originating process is still alive. Abandoned rows (process gone)
- * are excluded so a stale Ctrl-C doesn't block future operations.
+ * Returns rows that genuinely look in-flight: status='in_progress', the
+ * row is younger than `OPERATION_TTL_MS`, AND the originating process is
+ * still able to make progress. Everything else is abandoned and excluded,
+ * so a crashed, suspended, or forgotten operation cannot wedge the fleet.
  *
  * @param excludeOperationId - operation id to exclude from the check
  *   (so an operation doesn't see itself as a conflict).
@@ -97,10 +142,13 @@ export function checkInFlight(excludeOperationId?: string): InFlightConflict[] {
     .where(eq(moduleOperations.status, 'in_progress'))
     .all();
 
+  const now = Date.now();
   const conflicts: InFlightConflict[] = [];
   for (const row of rows) {
     if (excludeOperationId && row.id === excludeOperationId) continue;
-    if (!isPidAlive(row.pid)) continue;
+    // Age first: it costs nothing, where the liveness probe spawns `ps`.
+    if (now - row.startedAt.getTime() > OPERATION_TTL_MS) continue;
+    if (!isPidRunnable(row.pid)) continue;
     conflicts.push({
       operation: row,
       describe: `${row.operation} of ${row.moduleId} (pid ${row.pid})`,
@@ -117,8 +165,10 @@ export function checkInFlight(excludeOperationId?: string): InFlightConflict[] {
 export class InFlightError extends Error {
   constructor(public readonly conflicts: InFlightConflict[]) {
     const list = conflicts.map((c) => `  • ${c.describe}`).join('\n');
+    const hint =
+      'If it is not really running: "celilo module operations" to inspect, "celilo module operations clear" to release.';
     super(
-      `Cannot start: another module operation is in progress.\n${list}\nWait for it to complete (or fail) and re-run.`,
+      `Cannot start: another module operation is in progress.\n${list}\nWait for it to complete (or fail) and re-run.\n${hint}`,
     );
     this.name = 'InFlightError';
   }

package/src/services/module-subscriptions.test.ts

@@ -158,6 +158,34 @@ describe('register / unregister roundtrip', () => {
     expect(result.registered).toBe(0);
   });
 
+  it('a module with an on_backup hook arms the scheduled backup sweep', () => {
+    // The sweep is a system-level subscriber, not a module one, so it does not
+    // count toward `registered`. It appears the moment the fleet has something
+    // to back up — including on `module update`, which is how a manifest that
+    // newly declares a cadence reaches an already-deployed fleet.
+    const result = registerModuleSubscriptions(
+      baseManifest({ hooks: { on_backup: { script: 'backup.ts' } } }),
+      '/p',
+    );
+    expect(result.registered).toBe(0);
+
+    const bus = openBus({ dbPath, events: defineEvents({}) });
+    try {
+      const row = bus.db
+        .query<{ name: string; pattern: string; handler: string }, []>(
+          'SELECT name, pattern, handler FROM subscribers',
+        )
+        .get();
+      expect(row).toEqual({
+        name: 'celilo-backup-sweep',
+        pattern: 'timer.tick.1h',
+        handler: 'celilo backup sweep',
+      });
+    } finally {
+      bus.close();
+    }
+  });
+
   it('registers each subscription as a row, names scoped to module id', () => {
     const result = registerModuleSubscriptions(
       baseManifest({
@@ -358,7 +386,10 @@ describe('build-bus registry-poll wiring (ISS-0139)', () => {
     expect(poll).toBeDefined();
     expect(poll?.pattern).toBe('timer.tick.15m');
     // A literal handler command (the CLI poll), not a hook — see manifest comment.
-    expect(poll?.handler).toBe('celilo module upgrade');
+    // `--poll` is load-bearing: the dispatcher appends the event id to a
+    // subprocess handler, and without the flag it lands in the module-name slot
+    // ("Module not found: <event_id>" every tick).
+    expect(poll?.handler).toBe('celilo module upgrade --poll');
     expect(poll?.hook).toBeUndefined();
 
     const resolved = resolveSubscription(
@@ -368,6 +399,6 @@ describe('build-bus registry-poll wiring (ISS-0139)', () => {
       '/modules/celilo-mgmt',
     );
     expect(resolved.name).toBe('celilo-mgmt.registry-poll');
-    expect(resolved.handler).toBe('celilo module upgrade');
+    expect(resolved.handler).toBe('celilo module upgrade --poll');
   });
 });

package/src/services/module-subscriptions.ts

@@ -21,6 +21,7 @@ import { getEventBusPath, getModuleStoragePath } from '../config/paths';
 import { getDb } from '../db/client';
 import { modules } from '../db/schema';
 import type { ModuleManifest, ModuleSubscription } from '../manifest/schema';
+import { ensureBackupSweepSubscriber } from './backup-sweep';
 
 /**
  * The bus is opened by the celilo CLI without an event registry — the
@@ -90,10 +91,18 @@ export function registerModuleSubscriptions(
   modulePath: string,
 ): { registered: number } {
   const subs = manifest.subscriptions ?? [];
-  if (subs.length === 0) return { registered: 0 };
+  const backupSweep = Boolean(manifest.hooks?.on_backup);
+  if (subs.length === 0 && !backupSweep) return { registered: 0 };
 
   const bus = openBus({ dbPath: getEventBusPath(), events: NO_SCHEMAS });
   try {
+    // A module that can be backed up is also what switches the scheduled
+    // backup sweep on. Registering here rather than at system init means the
+    // sweep appears the moment the fleet has something to back up, and — since
+    // `module update` comes through here too — a manifest that newly declares a
+    // cadence arms the sweep on the same update that declares it. Idempotent.
+    if (backupSweep) ensureBackupSweepSubscriber(bus);
+
     for (const sub of subs) {
       const resolved = resolveSubscription(sub, manifest.id, modulePath);
       bus.subscribe(resolved);

package/src/services/module-validator/typescript-build.test.ts

@@ -43,11 +43,30 @@ describe('checkTypeScriptBuild', () => {
     }
   });
 
-  test('fail with helpful message when tsconfig present but no node_modules', async () => {
+  // A tsconfig at the module ROOT is not the one we run: it lives in scripts/,
+  // next to the package.json and node_modules that make @celilo/capabilities
+  // resolve. Looking at the wrong level is why this check never fired.
+  test('ignores a tsconfig at the module root', async () => {
     const dir = mkdtempSync(join(tmpdir(), 'celilo-tsc-'));
     try {
+      mkdirSync(join(dir, 'scripts'));
+      writeFileSync(join(dir, 'scripts', 'install.ts'), 'export const x = 1;\n');
       writeFileSync(join(dir, 'tsconfig.json'), '{}');
       const r = await checkTypeScriptBuild(dir);
+      expect(r.status).toBe('warn');
+      expect(r.message).toContain('scripts/tsconfig.json');
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('fail with helpful message when tsconfig present but no node_modules', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'celilo-tsc-'));
+    try {
+      mkdirSync(join(dir, 'scripts'));
+      writeFileSync(join(dir, 'scripts', 'install.ts'), 'export const x = 1;\n');
+      writeFileSync(join(dir, 'scripts', 'tsconfig.json'), '{}');
+      const r = await checkTypeScriptBuild(dir);
       expect(r.status).toBe('fail');
       expect(r.message).toContain('node_modules');
       expect(r.message).toContain('bun install');