@celilo/cli 0.19.0 → 0.21.0

package/src/services/remote-responder.test.ts

@@ -78,12 +78,18 @@ test('answers responder.probe with kind daemon', async () => {
 }, 15_000);
 
 /**
- * When the client can't reach a decider it says so. The responder must relay
- * that as an error reply — the waiting command then fails loudly instead of the
- * question quietly resolving to `defaultValue`, which is how a breaking update
- * came to be recorded as "operator declined".
+ * A responder that cannot reach a decider must emit NOTHING (celilo#609).
+ *
+ * PR #607 had it reply `{error}` here, which reads as "fail loudly" but carries
+ * `replyFor: <query id>` — it *consumes the query*. The question then no longer
+ * exists for anyone else to answer, and the command dies with it. Leaving it
+ * unanswered parks the command instead, so a later responder can still decide.
+ *
+ * Asserted on the value that comes back, not on liveness: the reply emitted
+ * afterwards correlates to the original query, which is only true if the
+ * responder left it standing.
  */
-test('an ask that cannot be answered replies with an error, not the default', async () => {
+test('an ask that cannot be answered emits no reply — the query stays answerable', async () => {
   const responder = startRemoteResponder({
     busDbPath,
     ask: async () => {
@@ -92,24 +98,31 @@ test('an ask that cannot be answered replies with an error, not the default', as
   });
 
   const bus = openBus({ dbPath: busDbPath, events: NO_SCHEMAS });
+  const type = 'interview.required.module-upgrade:iptables.apply_breaking';
   try {
-    const replies = (await bus.query(
-      'interview.required.module-upgrade:iptables.apply_breaking' as never,
-      {
-        scope: 'module-upgrade:iptables',
-        key: 'apply_breaking',
-        kind: 'confirm',
-        message: 'Apply breaking update for iptables?',
-        required: true,
-        defaultValue: 'false',
-      } as never,
-      { timeoutMs: 8000, pollIntervalMs: 100, expect: 'first' } as never,
-    )) as BusEvent[];
+    const query = bus.emitRaw(type, {
+      scope: 'module-upgrade:iptables',
+      key: 'apply_breaking',
+      kind: 'confirm',
+      message: 'Apply breaking update for iptables?',
+      required: true,
+      defaultValue: 'false',
+    });
+
+    // Well past the responder's watch latency: still nobody has answered.
+    await new Promise((r) => setTimeout(r, 600));
+    expect(bus.recentEvents({ type: `${type}.reply` })).toHaveLength(0);
 
+    // And the query is still live: a reply emitted now is a genuine answer.
+    bus.emitRaw(
+      `${type}.reply`,
+      { value: false },
+      { replyFor: query.id, emittedBy: 'later-responder' },
+    );
+    const replies = bus.recentEvents({ type: `${type}.reply` });
     expect(replies).toHaveLength(1);
-    const payload = replies[0].payload as { value?: unknown; error?: string };
-    expect(payload.value).toBeUndefined();
-    expect(payload.error).toContain('terminal');
+    expect((replies[0].payload as { value: unknown }).value).toBe(false);
+    expect(replies[0].replyFor).toBe(query.id);
   } finally {
     bus.close();
     responder.close();

package/src/services/remote-responder.ts

@@ -72,12 +72,16 @@ export function startRemoteResponder(opts: RemoteResponderOptions): RemoteRespon
         required: payload.required,
       });
     } catch (err) {
-      // The client had no way to answer. Reply with the reason so the waiting
-      // command fails loudly — never let the question decay to its default.
-      bus.emitRaw(
-        `${event.type}.reply`,
-        { error: err instanceof Error ? err.message : String(err) },
-        { replyFor: event.id, emittedBy: me },
+      // The client had no way to answer — so we emit NOTHING. A reply of any
+      // shape consumes the query (it carries `replyFor: event.id`), destroying
+      // a question nobody has answered yet; the asking command then dies with
+      // it and no other responder can ever act. Leaving it unanswered parks the
+      // command instead, which is what `busInterview`'s `timeoutMs: 0` is for.
+      // The client learns it is parked from the `blocked` wire message.
+      process.stderr.write(
+        `[remote-responder] parked ${event.type} (#${event.id}): ${
+          err instanceof Error ? err.message : String(err)
+        }\n`,
       );
       return;
     }

package/src/services/update/orchestrator.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from 'bun:test';
 import type { DbClient } from '../../db/client';
 import type { ModuleManifest } from '../../manifest/schema';
 import type { AuditDeps } from '../audit';
+import { unusedPublicDnsProbe } from '../audit/public-dns';
 import { buildModuleGraph } from './dep-graph';
 import {
   type ModuleSnapshot,
@@ -85,6 +86,7 @@ const cleanAudit: AuditDeps = {
   machinesReachable: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
   trustedSources: { firewalls: [] },
+  publicDns: { records: [], probe: unusedPublicDnsProbe },
 };
 
 describe('consumerSkipReason', () => {