@celilo/cli 0.18.0 → 0.19.0

package/src/cli/commands/system-migrate.ts

@@ -10,8 +10,9 @@
 import type { Database } from 'bun:sqlite';
 import { defineEvents, openBus } from '@celilo/event-bus';
 import { getEventBusPath } from '../../config/paths';
-import { getDb } from '../../db/client';
+import { createDbClient, findMigrationsFolder, getDb } from '../../db/client';
 import { runMigrationsOn } from '../../db/migrate';
+import { getMigrationStatus } from '../../db/migration-status';
 import { findSchemaDrift } from '../../db/schema-introspection';
 import { ensureBackupSweepSubscriber } from '../../services/backup-sweep';
 import { ensureOperationsSweepSubscriber } from '../../services/module-operations';
@@ -62,7 +63,50 @@ function countApplied(sqlite: Database): number {
   }
 }
 
-export async function handleSystemMigrate(): Promise<CommandResult> {
+/**
+ * `celilo system migrate --status` — read-only interrogation (celilo#604).
+ *
+ * A rollout runbook that says "assert applied 19 → 20 and `backups.pid`
+ * present" needs a product surface to assert against; the table count that used
+ * to be the only answer cannot see a column migration at all.
+ */
+export function migrationStatusResult(sqlite: Database): CommandResult {
+  const status = getMigrationStatus(sqlite, findMigrationsFolder());
+  const missing = [...status.missingTables, ...status.missingColumns];
+  const lines = [
+    `Applied migrations: ${status.appliedCount}`,
+    `Latest applied:     ${status.latestApplied ?? '(none)'}`,
+    status.pending.length > 0
+      ? `Pending:            ${status.pending.join(', ')}`
+      : 'Pending:            none',
+    `Schema present:     ${status.tableCount} tables, ${status.columnCount} columns`,
+    ...(missing.length > 0 ? [`Missing:            ${missing.join(', ')}`] : []),
+  ];
+  if (status.pending.length > 0 || missing.length > 0) {
+    return {
+      success: false,
+      error: `${lines.join('\n')}\n\nRun \`celilo system migrate\` to apply pending migrations on this box.`,
+    };
+  }
+  return { success: true, message: lines.join('\n'), data: status };
+}
+
+export async function handleSystemMigrate(
+  _args: string[] = [],
+  flags: Record<string, string | boolean> = {},
+): Promise<CommandResult> {
+  // --status must NOT migrate. getDb() auto-migrates on open, so a status that
+  // went through it would repair the very state it claims to be reporting and
+  // could never say "pending" — the placebo shape this command exists to end.
+  if (flags.status) {
+    const ro = createDbClient({ readonly: true });
+    try {
+      return migrationStatusResult(ro.$client);
+    } finally {
+      ro.$client.close();
+    }
+  }
+
   // getDb() auto-migrates on open; do it inside try so an existing DB that
   // predates the drizzle-authoritative change fails with an actionable message
   // instead of a raw migrator error.
@@ -97,9 +141,13 @@ export async function handleSystemMigrate(): Promise<CommandResult> {
 
   ensureCoreSubscribers();
 
+  // Name the latest migration, not just a table count: "35 tables" reads the
+  // same whether a column migration applied or silently did nothing (celilo#604).
+  const status = getMigrationStatus(sqlite, findMigrationsFolder());
   const lines = [
     applied > 0 ? `Applied ${applied} migration(s).` : 'Schema already up to date.',
-    `Schema current: ${drift.tableCount} tables.`,
+    `Applied migrations: ${status.appliedCount} (latest: ${status.latestApplied ?? 'none'})`,
+    `Schema current: ${drift.tableCount} tables, ${drift.columnCount} columns.`,
   ];
-  return { success: true, message: lines.join('\n') };
+  return { success: true, message: lines.join('\n'), data: status };
 }

package/src/cli/completion.ts

@@ -125,6 +125,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'respond',
       'install-daemon',
       'uninstall-daemon',
+      'restart-daemon',
       'show-daemon',
     ];
     return filterSuggestions(subcommands, args[1] || '');

package/src/cli/index.ts

@@ -31,6 +31,7 @@ import {
   handleEventsRepair,
   handleEventsReply,
   handleEventsRespond,
+  handleEventsRestartDaemon,
   handleEventsResyncSubscriptions,
   handleEventsRun,
   handleEventsRunHook,
@@ -303,6 +304,7 @@ Subcommands:
   respond                      Run the terminal responder; answer deploy prompts from another shell
   install-daemon [--system]    Write a systemd/launchd unit for the dispatcher (--system: management-plane scope)
   uninstall-daemon [--system]  Remove the installed supervisor unit
+  restart-daemon [--system]    Restart the dispatcher and verify the new process is on current code
   show-daemon [--system]       Print the currently installed unit file
 
 Description:
@@ -1439,6 +1441,8 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
         return handleEventsInstallDaemon(parsed.args, parsed.flags);
       case 'uninstall-daemon':
         return handleEventsUninstallDaemon(parsed.args, parsed.flags);
+      case 'restart-daemon':
+        return handleEventsRestartDaemon(parsed.args, parsed.flags);
       case 'show-daemon':
         return handleEventsShowDaemon(parsed.args, parsed.flags);
       default:
@@ -2133,7 +2137,7 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
     }
 
     if (parsed.subcommand === 'migrate') {
-      return handleSystemMigrate();
+      return handleSystemMigrate(parsed.args, parsed.flags);
     }
 
     return {

package/src/db/migration-status.test.ts

@@ -0,0 +1,114 @@
+/**
+ * celilo#604: a table COUNT reported "up to date" for a DB missing a migrated
+ * COLUMN, so the rollout's own stop-condition was uncheckable by the tools the
+ * runbook named. These assert the column case specifically.
+ */
+
+import { Database } from 'bun:sqlite';
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { getMigrationStatus, readMigrationJournal } from './migration-status';
+
+/** A journal + a `__drizzle_migrations` table, wired the way drizzle wires them. */
+function seed(dir: string, entries: Array<{ when: number; tag: string }>, appliedWhens: number[]) {
+  mkdirSync(join(dir, 'meta'), { recursive: true });
+  writeFileSync(
+    join(dir, 'meta', '_journal.json'),
+    JSON.stringify({ version: '7', dialect: 'sqlite', entries }),
+  );
+  const db = new Database(':memory:');
+  db.run(
+    'CREATE TABLE `__drizzle_migrations` (id INTEGER PRIMARY KEY, hash TEXT, created_at NUMERIC)',
+  );
+  for (const when of appliedWhens) {
+    db.run('INSERT INTO `__drizzle_migrations` (hash, created_at) VALUES (?, ?)', [
+      `h${when}`,
+      when,
+    ]);
+  }
+  return db;
+}
+
+describe('getMigrationStatus', () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-migstatus-'));
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  it('names the latest applied migration and every pending one', () => {
+    const db = seed(
+      dir,
+      [
+        { when: 100, tag: '0018_drop_alert_policy_snapshot' },
+        { when: 200, tag: '0019_backup_pid' },
+        { when: 300, tag: '0020_future' },
+      ],
+      [100, 200],
+    );
+
+    const status = getMigrationStatus(db, dir);
+
+    expect(status.appliedCount).toBe(2);
+    expect(status.latestApplied).toBe('0019_backup_pid');
+    expect(status.pending).toEqual(['0020_future']);
+  });
+
+  it('reports nothing pending once every journal entry is applied', () => {
+    const db = seed(dir, [{ when: 100, tag: '0000_init' }], [100]);
+    const status = getMigrationStatus(db, dir);
+    expect(status.pending).toEqual([]);
+    expect(status.latestApplied).toBe('0000_init');
+  });
+
+  it('reports a DB that has never been migrated as all-pending', () => {
+    mkdirSync(join(dir, 'meta'), { recursive: true });
+    writeFileSync(
+      join(dir, 'meta', '_journal.json'),
+      JSON.stringify({ entries: [{ when: 1, tag: '0000_init' }] }),
+    );
+    const status = getMigrationStatus(new Database(':memory:'), dir);
+    expect(status.appliedCount).toBe(0);
+    expect(status.latestApplied).toBeNull();
+    expect(status.pending).toEqual(['0000_init']);
+  });
+
+  it('counts columns, not just tables — the signal a column migration needs', () => {
+    const db = seed(dir, [], []);
+    const status = getMigrationStatus(db, dir);
+    // Every schema table is missing here, so the counts are the code's totals.
+    expect(status.tableCount).toBeGreaterThan(0);
+    expect(status.columnCount).toBeGreaterThan(status.tableCount);
+  });
+
+  it('reads journal entries oldest-first regardless of file order', () => {
+    mkdirSync(join(dir, 'meta'), { recursive: true });
+    writeFileSync(
+      join(dir, 'meta', '_journal.json'),
+      JSON.stringify({
+        entries: [
+          { when: 300, tag: 'c' },
+          { when: 100, tag: 'a' },
+        ],
+      }),
+    );
+    expect(readMigrationJournal(dir).map((e) => e.tag)).toEqual(['a', 'c']);
+  });
+
+  it('returns an empty journal when the folder has none', () => {
+    expect(readMigrationJournal(join(dir, 'nope'))).toEqual([]);
+  });
+});
+
+describe('getMigrationStatus against the real migrations folder', () => {
+  it('sees backups.pid as missing when the column migration did not land', () => {
+    // The exact celilo#604 shape: every table present, one migrated column not.
+    const db = new Database(':memory:');
+    db.run('CREATE TABLE backups (id TEXT PRIMARY KEY)');
+    const status = getMigrationStatus(db, join(import.meta.dir, '../../drizzle'));
+    expect(status.missingColumns).toContain('backups.pid');
+    expect(status.pending).toContain('0019_backup_pid');
+  });
+});

package/src/db/migration-status.ts

@@ -0,0 +1,78 @@
+/**
+ * Read-only migration interrogation (celilo#604).
+ *
+ * `system migrate` used to report "Schema current: 35 tables" — a table COUNT,
+ * which cannot distinguish "the column migration applied" from "nothing
+ * happened". 0019_backup_pid adds a column; a rollout runbook asserting
+ * "applied 19 → 20, backups.pid present" had no product surface to check it
+ * against and had to reach for `sqlite3` over SSH.
+ *
+ * This names migrations. Drizzle's `__drizzle_migrations.created_at` is the
+ * journal entry's `when`, so the join back to a human tag is exact.
+ */
+
+import type { Database } from 'bun:sqlite';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { findSchemaDrift } from './schema-introspection';
+
+export interface MigrationStatus {
+  /** Rows in `__drizzle_migrations` — what the runbook calls "applied count". */
+  appliedCount: number;
+  /** Tag of the newest applied migration, e.g. `0019_backup_pid`. */
+  latestApplied: string | null;
+  /** Tags present on disk that this DB has not applied, oldest first. */
+  pending: string[];
+  /** Tables the running code declares that the DB lacks. */
+  missingTables: string[];
+  /** `table.column` the running code declares that the DB lacks. */
+  missingColumns: string[];
+  tableCount: number;
+  columnCount: number;
+}
+
+interface JournalEntry {
+  when: number;
+  tag: string;
+}
+
+/** Journal entries (oldest first), or [] when the folder has no journal. */
+export function readMigrationJournal(migrationsFolder: string): JournalEntry[] {
+  const path = join(migrationsFolder, 'meta', '_journal.json');
+  if (!existsSync(path)) return [];
+  const parsed = JSON.parse(readFileSync(path, 'utf-8')) as { entries?: JournalEntry[] };
+  return [...(parsed.entries ?? [])].sort((a, b) => a.when - b.when);
+}
+
+/** `created_at` timestamps recorded in `__drizzle_migrations` (empty if untracked). */
+function appliedTimestamps(sqlite: Database): number[] {
+  try {
+    return sqlite
+      .query<{ created_at: number }, []>(
+        'SELECT created_at FROM `__drizzle_migrations` ORDER BY created_at',
+      )
+      .all()
+      .map((r) => r.created_at);
+  } catch {
+    // No migrations table — a DB that has never been through the migrator.
+    return [];
+  }
+}
+
+export function getMigrationStatus(sqlite: Database, migrationsFolder: string): MigrationStatus {
+  const journal = readMigrationJournal(migrationsFolder);
+  const applied = new Set(appliedTimestamps(sqlite));
+  const appliedTags = journal.filter((e) => applied.has(e.when)).map((e) => e.tag);
+  const pending = journal.filter((e) => !applied.has(e.when)).map((e) => e.tag);
+  const drift = findSchemaDrift(sqlite);
+
+  return {
+    appliedCount: applied.size,
+    latestApplied: appliedTags.at(-1) ?? null,
+    pending,
+    missingTables: drift.missingTables,
+    missingColumns: drift.missingColumns,
+    tableCount: drift.tableCount,
+    columnCount: drift.columnCount,
+  };
+}

package/src/db/schema-introspection.ts

@@ -20,6 +20,12 @@ export interface SchemaDrift {
   missingColumns: string[];
   /** Total number of tables the code's schema declares. */
   tableCount: number;
+  /**
+   * Total number of columns the code's schema declares. Reported alongside
+   * tableCount so the doctor can say what it actually checked — a table count
+   * alone reads as "columns unverified" even when they were (celilo#604).
+   */
+  columnCount: number;
 }
 
 /** Every table name + column names the drizzle schema declares. */
@@ -84,5 +90,6 @@ export function findSchemaDrift(sqlite: Database): SchemaDrift {
       if (!cols.has(c)) missingColumns.push(`${t.name}.${c}`);
     }
   }
-  return { missingTables, missingColumns, tableCount: tables.length };
+  const columnCount = tables.reduce((n, t) => n + t.columns.length, 0);
+  return { missingTables, missingColumns, tableCount: tables.length, columnCount };
 }

package/src/services/bus-interview.ts

@@ -14,6 +14,7 @@
 
 import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
 import { getEventBusPath } from '../config/paths';
+import { InterviewUnansweredError } from './interview-errors';
 import { ensureResponderForInterview } from './responder-probe';
 
 const NO_SCHEMAS = defineEvents({});
@@ -239,6 +240,13 @@ export interface InterviewRequiredPayload {
  */
 export interface InterviewReply {
   value: unknown;
+  /**
+   * Set instead of `value` when the responder could not reach a decider (e.g.
+   * the remote client has no TTY and no pre-staged answer). `askInterview`
+   * turns it into an `InterviewUnansweredError` so the question fails loudly
+   * rather than silently resolving to `defaultValue`.
+   */
+  error?: string;
 }
 
 /**
@@ -314,11 +322,9 @@ export async function askInterview(
   payload: InterviewRequiredPayload,
   ownerBus?: Bus,
 ): Promise<unknown> {
-  const reply = await busInterviewGuarded<InterviewReply>(
-    EVENT_TYPES.interviewRequired(payload.scope, payload.key),
-    payload,
-    ownerBus,
-  );
+  const type = EVENT_TYPES.interviewRequired(payload.scope, payload.key);
+  const reply = await busInterviewGuarded<InterviewReply>(type, payload, ownerBus);
+  if (reply.error) throw new InterviewUnansweredError(type, reply.error);
   return reply.value;
 }
 

package/src/services/events-daemon.test.ts

@@ -5,11 +5,17 @@ import { join } from 'node:path';
 import {
   getDaemonUnitPath,
   installDaemon,
+  orphanDispatcherPids,
+  planDaemonInstall,
   readInstalledUnit,
   renderLaunchdPlist,
   renderSystemdUnit,
+  resolveRestartScope,
   resolveRunAsUser,
+  restartDaemon,
+  supervisorCommands,
   uninstallDaemon,
+  unitInstalledInAnyScope,
 } from './events-daemon';
 
 describe('renderSystemdUnit', () => {
@@ -166,6 +172,61 @@ describe('installDaemon / uninstallDaemon roundtrip', () => {
     expect(existsSync(installed.unitPath)).toBe(false);
   });
 
+  // #610 — install-daemon defaults to USER scope, so running it on a box whose
+  // system unit Ansible already installed silently produced a second daemon of
+  // the same name. That is how celilo-mgr ended up with two dispatchers.
+  it('refuses to install when the other scope already has a unit', () => {
+    const home = join(dir, 'home');
+    const systemRoot = join(dir, 'root');
+    installDaemon({
+      platform: 'linux',
+      scope: 'system',
+      home,
+      systemRoot,
+      celiloPath,
+      busDbPath: '/var/lib/celilo/events.db',
+    });
+
+    expect(() =>
+      installDaemon({
+        platform: 'linux',
+        scope: 'user',
+        home,
+        systemRoot,
+        celiloPath,
+        busDbPath: '/var/lib/celilo/events.db',
+      }),
+    ).toThrow(/system-scope unit is already installed/);
+    // Nothing written: refusing must not leave the second unit behind.
+    expect(existsSync(getDaemonUnitPath('linux', home, 'user'))).toBe(false);
+  });
+
+  // --print creates nothing, and the celilo-mgmt Ansible role captures it —
+  // throwing there would wedge the deploy of the tool used to fix the conflict.
+  it('reports the conflict from planDaemonInstall without throwing', () => {
+    const home = join(dir, 'home');
+    const systemRoot = join(dir, 'root');
+    installDaemon({
+      platform: 'linux',
+      scope: 'system',
+      home,
+      systemRoot,
+      celiloPath,
+      busDbPath: '/var/lib/celilo/events.db',
+    });
+
+    const plan = planDaemonInstall({
+      platform: 'linux',
+      scope: 'user',
+      home,
+      systemRoot,
+      celiloPath,
+      busDbPath: '/var/lib/celilo/events.db',
+    });
+    expect(plan.conflict?.scope).toBe('system');
+    expect(plan.unitContent).toContain('ExecStart=');
+  });
+
   it('writes a launchd plist and uninstall removes it', () => {
     const home = join(dir, 'home');
     const installed = installDaemon({
@@ -241,3 +302,186 @@ describe('installDaemon / uninstallDaemon roundtrip', () => {
     ).toThrow(/does not exist/);
   });
 });
+
+// --- restart (celilo#604) ---------------------------------------------
+
+/**
+ * A fake bus + supervisor. `restartUnit()` only produces a new dispatcher if no
+ * live one is left — that IS the one-dispatcher-per-bus guard (#584), and it's
+ * what makes the orphan case fatal rather than merely untidy.
+ */
+function fakeFleet(opts: {
+  initial: Array<{ pid: number; version: string | null; supervised?: boolean }>;
+  newVersion: string;
+}) {
+  let live = opts.initial.map((d) => ({ ...d }));
+  const supervised = opts.initial.find((d) => d.supervised);
+  const killed: number[] = [];
+  let nextPid = 9000;
+  let restarts = 0;
+  return {
+    killed,
+    restarts: () => restarts,
+    deps: {
+      liveDispatchers: () => live.map((d) => ({ pid: d.pid, version: d.version })),
+      supervisorPid: () => supervised?.pid ?? null,
+      kill: (pid: number) => {
+        killed.push(pid);
+        live = live.filter((d) => d.pid !== pid);
+      },
+      restartUnit: () => {
+        restarts++;
+        live = live.filter((d) => d.pid !== supervised?.pid);
+        if (live.length > 0) return; // guard refuses: another dispatcher is live
+        live = [{ pid: nextPid++, version: opts.newVersion }];
+      },
+      sleep: async () => {},
+    },
+  };
+}
+
+describe('orphanDispatcherPids', () => {
+  it('names every live dispatcher the supervisor does not own', () => {
+    expect(orphanDispatcherPids([{ pid: 100 }, { pid: 200 }], 200)).toEqual([100]);
+  });
+
+  it('treats all of them as orphans when the supervisor owns none', () => {
+    expect(orphanDispatcherPids([{ pid: 100 }, { pid: 200 }], null)).toEqual([100, 200]);
+  });
+});
+
+describe('restartDaemon', () => {
+  let dir: string;
+  let home: string;
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-restart-'));
+    home = join(dir, 'home');
+    installDaemon({ platform: 'linux', home, celiloPath: '/bin/sh', busDbPath: '/db' });
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  it('stops an orphan the supervisor does not own, then brings up new code', async () => {
+    // celilo-mgr exactly: PPID 1, stale v0.1.8, systemd owns nothing.
+    const fleet = fakeFleet({
+      initial: [{ pid: 3639051, version: '0.1.8' }],
+      newVersion: '0.2.0',
+    });
+
+    const result = await restartDaemon(
+      { platform: 'linux', home, expectedVersion: '0.2.0', pollMs: 0 },
+      fleet.deps,
+    );
+
+    expect(fleet.killed).toContain(3639051);
+    expect(result.orphansKilled).toEqual([3639051]);
+    expect(result.dispatcher.version).toBe('0.2.0');
+    expect(result.dispatcher.pid).not.toBe(3639051);
+  });
+
+  it('does not kill the dispatcher the supervisor already owns', async () => {
+    const fleet = fakeFleet({
+      initial: [{ pid: 4242, version: '0.1.8', supervised: true }],
+      newVersion: '0.2.0',
+    });
+
+    const result = await restartDaemon(
+      { platform: 'linux', home, expectedVersion: '0.2.0', pollMs: 0 },
+      fleet.deps,
+    );
+
+    expect(fleet.killed).toEqual([]);
+    expect(result.orphansKilled).toEqual([]);
+    expect(result.dispatcher.version).toBe('0.2.0');
+  });
+
+  it('fails when the restarted dispatcher still reports the OLD version', async () => {
+    // systemctl returned 0, a dispatcher is live — and it is the stale code.
+    // The whole point: never report success off the supervisor's exit code.
+    const fleet = fakeFleet({
+      initial: [{ pid: 3639051, version: '0.1.8' }],
+      newVersion: '0.1.8',
+    });
+
+    await expect(
+      restartDaemon(
+        { platform: 'linux', home, expectedVersion: '0.2.0', pollMs: 0, timeoutMs: 5 },
+        fleet.deps,
+      ),
+    ).rejects.toThrow(/no dispatcher on v0\.2\.0 came up/);
+  });
+
+  it('fails rather than reporting success when nothing comes back at all', async () => {
+    const fleet = fakeFleet({ initial: [], newVersion: '0.2.0' });
+    fleet.deps.restartUnit = () => {}; // unit crash-loops; bus stays empty
+
+    await expect(
+      restartDaemon(
+        { platform: 'linux', home, expectedVersion: '0.2.0', pollMs: 0, timeoutMs: 5 },
+        fleet.deps,
+      ),
+    ).rejects.toThrow(/no dispatcher is live on the bus/);
+  });
+
+  it('refuses when no supervisor unit is installed', () => {
+    expect(() => resolveRestartScope({ platform: 'linux', home: join(dir, 'empty') })).toThrow(
+      /no supervisor unit installed/,
+    );
+  });
+
+  // apt-upgrade runs restart-daemon on every box, including ones that never
+  // installed the daemon. The CLI branches on this so an upgrade with nothing
+  // stale to fix is not failed by a missing unit.
+  it('unitInstalledInAnyScope sees an installed unit, and its absence', () => {
+    expect(unitInstalledInAnyScope('linux', home)).toBe(true);
+    expect(unitInstalledInAnyScope('linux', join(dir, 'empty'))).toBe(false);
+  });
+});
+
+describe('supervisorCommands', () => {
+  it('uses systemctl --user for user scope', () => {
+    expect(supervisorCommands('linux', 'user').restart).toEqual([
+      'systemctl',
+      '--user',
+      'restart',
+      'celilo-events.service',
+    ]);
+  });
+
+  // The system unit is root-owned and celilo is unprivileged. Drop the sudo
+  // and every apt-upgrade on celilo-mgr reports "dispatcher still on old
+  // code" — honest, and never able to do its job. celilo-bootstrap ships the
+  // scoped grant for exactly these two argvs, so they must match it verbatim.
+  it('goes through sudo for system scope, matching the shipped sudoers grant', () => {
+    expect(supervisorCommands('linux', 'system').restart).toEqual([
+      'sudo',
+      'systemctl',
+      'restart',
+      'celilo-events.service',
+    ]);
+    expect(supervisorCommands('linux', 'system').mainPid).toEqual([
+      'sudo',
+      'systemctl',
+      'show',
+      'celilo-events.service',
+      '-p',
+      'MainPID',
+      '--value',
+    ]);
+  });
+
+  it('the shipped sudoers grant covers exactly the argvs used', () => {
+    const grant = readFileSync(
+      join(
+        import.meta.dir,
+        '../../../../packaging/celilo-bootstrap/conffiles/sudoers.d-celilo-events-restart',
+      ),
+      'utf-8',
+    );
+    const cmds = supervisorCommands('linux', 'system');
+    for (const argv of [cmds.restart, cmds.mainPid as string[]]) {
+      // `sudo` itself is the invoker, not part of the granted command.
+      expect(grant).toContain(`/usr/bin/${argv.slice(1).join(' ')}`);
+    }
+  });
+});