@celilo/cli 0.26.0 → 0.27.0

package/src/services/module-operations.test.ts

@@ -71,6 +71,70 @@ describe('module-operations', () => {
     });
   });
 
+  /**
+   * celilo#737. Recording an outcome is BOOKKEEPING; the caller's error is the
+   * information. On celilo-mgr a `SQLITE_BUSY` inside `failOperation` propagated
+   * out of the catch block that called it and REPLACED the deploy's own error,
+   * so the operator was shown a database-locking problem and never learned what
+   * the deploy did wrong — the original was destroyed and is unrecoverable.
+   *
+   * `breakOperationsTable` stands in for any write failure. The mechanism does
+   * not matter; what matters is that no failure of the write can reach the
+   * caller.
+   */
+  describe('recording an outcome cannot destroy what it records (#737)', () => {
+    function breakOperationsTable(): void {
+      const { getDb } = require('../db/client');
+      getDb().$client.run('DROP TABLE module_operations');
+    }
+
+    it('failOperation does not replace the error it was called to record', () => {
+      const id = startOperation('caddy', 'deploy');
+      breakOperationsTable();
+
+      const original = new Error('ansible task failed on step 7');
+      let surfaced: unknown;
+
+      // Exactly the shape every call site uses (module-deploy.ts,
+      // module-remove.ts): record the failure, then rethrow the original.
+      try {
+        try {
+          throw original;
+        } catch (err) {
+          failOperation(id, err);
+          throw err;
+        }
+      } catch (err) {
+        surfaced = err;
+      }
+
+      expect(surfaced).toBe(original);
+    });
+
+    it('failOperation does not throw when the write fails', () => {
+      const id = startOperation('caddy', 'deploy');
+      breakOperationsTable();
+      expect(() => failOperation(id, new Error('original'))).not.toThrow();
+    });
+
+    it('completeOperation does not throw when the write fails', () => {
+      // The mirror bug: a deploy that SUCCEEDED reporting a database error, and
+      // skipping the `emitDeployCompleted` that follows the call.
+      const id = startOperation('caddy', 'deploy');
+      breakOperationsTable();
+      expect(() => completeOperation(id)).not.toThrow();
+    });
+
+    it('startOperation still throws — its row IS the in-flight lock', () => {
+      // Deliberately NOT swallowed. `checkInFlight` reads this row to refuse a
+      // backup during a deploy, so a silently-missing row would let the two run
+      // together. Failing before any work happens is honest; failing after it
+      // is what #737 is about.
+      breakOperationsTable();
+      expect(() => startOperation('caddy', 'deploy')).toThrow();
+    });
+  });
+
   describe('checkInFlight', () => {
     it('returns empty when no operations are in flight', () => {
       expect(checkInFlight()).toHaveLength(0);
@@ -96,7 +160,14 @@ describe('module-operations', () => {
 
     it('ignores rows whose pid is no longer alive', () => {
       // Spawn a short-lived process, capture its pid, wait for it to exit.
-      const child = spawnSync('node', ['-e', 'process.exit(0)']);
+      //
+      // `process.execPath` (the bun binary running this suite), NOT a bare
+      // `node`: this repo is bun-based and nothing guarantees a node on PATH.
+      // Where there was none, spawnSync returned `pid: undefined` and the
+      // assertion below failed with "Expected and actual values must be numbers
+      // or bigints" — which reads as a broken pid check rather than a missing
+      // interpreter.
+      const child = spawnSync(process.execPath, ['-e', 'process.exit(0)']);
       const deadPid = child.pid;
       expect(deadPid).toBeGreaterThan(0);
       expect(isPidRunnable(deadPid)).toBe(false);

package/src/services/module-operations.ts

@@ -33,6 +33,7 @@
 import { spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { eq } from 'drizzle-orm';
+import { log } from '../cli/prompts';
 import { getDb } from '../db/client';
 import { type ModuleOperation, type ModuleOperationKind, moduleOperations } from '../db/schema';
 
@@ -55,21 +56,59 @@ export function startOperation(moduleId: string, operation: ModuleOperationKind)
   return id;
 }
 
+/**
+ * Write an operation's outcome without ever being able to break the flow that
+ * is reporting it (celilo#737).
+ *
+ * Recording an outcome is BOOKKEEPING; the caller's error is the information.
+ * On celilo-mgr a `SQLITE_BUSY` inside `failOperation` propagated out of the
+ * catch block that called it and REPLACED the deploy's own error, so the
+ * operator was shown a database-locking problem and never learned what the
+ * deploy actually did wrong. That error was destroyed and is unrecoverable —
+ * the whole cost of the bug. It also skipped the `emitDeployFailed` that
+ * follows the call, so the event bus never learned the deploy had failed at
+ * all, and the module was left `INSTALLED` while in fact verified.
+ *
+ * `getDb()` is inside the try on purpose: opening the database is one of the
+ * things that can throw here.
+ *
+ * ⚠️ `startOperation` deliberately does NOT get this treatment. Its row IS the
+ * in-flight lock `checkInFlight` reads to refuse a backup during a deploy, so a
+ * silently-missing row would let the two run together against the same module.
+ * Failing before any work happens is honest; failing after it is what #737 is
+ * about.
+ */
+function recordOutcome(outcome: 'completed' | 'failed', operationId: string, write: () => void) {
+  try {
+    write();
+  } catch (persistError) {
+    // Rule 6.2: never a bare catch. Secondary to whatever the caller is already
+    // reporting, so it is a warning rather than the headline — the caller's own
+    // error is what the operator needs to read.
+    const reason = persistError instanceof Error ? persistError.message : String(persistError);
+    log.warn(`Could not record operation ${operationId} as ${outcome}: ${reason}`);
+  }
+}
+
 export function completeOperation(operationId: string): void {
-  const db = getDb();
-  db.update(moduleOperations)
-    .set({ status: 'completed', completedAt: new Date() })
-    .where(eq(moduleOperations.id, operationId))
-    .run();
+  recordOutcome('completed', operationId, () => {
+    getDb()
+      .update(moduleOperations)
+      .set({ status: 'completed', completedAt: new Date() })
+      .where(eq(moduleOperations.id, operationId))
+      .run();
+  });
 }
 
 export function failOperation(operationId: string, error: unknown): void {
-  const db = getDb();
   const message = error instanceof Error ? error.message : String(error);
-  db.update(moduleOperations)
-    .set({ status: 'failed', completedAt: new Date(), errorMessage: message })
-    .where(eq(moduleOperations.id, operationId))
-    .run();
+  recordOutcome('failed', operationId, () => {
+    getDb()
+      .update(moduleOperations)
+      .set({ status: 'failed', completedAt: new Date(), errorMessage: message })
+      .where(eq(moduleOperations.id, operationId))
+      .run();
+  });
 }
 
 /**

package/src/services/ssh-key-manager.test.ts

@@ -55,7 +55,6 @@ describe('a machine with no stored SSH key fails loudly, not silently', () => {
       hardware: { cpu_cores: 4, memory_mb: 4096, disk_gb: 100 },
       role: 'host',
       interfaces: [],
-      assignedModuleIds: [],
     });
 
     await expect(writeTemporarySshKey(machine.id)).rejects.toThrow(/has no SSH key stored/);
@@ -114,7 +113,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath = await writeTemporarySshKey(machine.id);
@@ -142,7 +140,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath = await writeTemporarySshKey(machine.id);
@@ -163,7 +160,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath = await writeTemporarySshKey(machine.id);
@@ -189,7 +185,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const machine2 = await addMachine({
@@ -201,7 +196,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath1 = await writeTemporarySshKey(machine1.id);
@@ -232,7 +226,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);
@@ -252,7 +245,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);
@@ -274,7 +266,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);
@@ -301,7 +292,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);

package/src/types/infrastructure.ts

@@ -90,7 +90,17 @@ export interface Machine {
   hardware: MachineHardware;
   role: MachineRole;
   interfaces: NetworkInterface[];
-  assignedModuleIds: string[];
+  // No `assignedModuleIds` (celilo#773). Occupancy is DERIVED — call
+  // `getModulesOnMachine(machineId)` in machine-pool.ts. It used to be a stored
+  // array with an append-only writer and no removal path, which diverged in
+  // both directions on the live fleet: a removed module's id stranded forever
+  // so placement rejected an empty box citing a module that no longer existed,
+  // and a machine genuinely hosting `iptables` reported "None (available)" so a
+  // second module could be placed on top of it.
+  //
+  // It is gone from the TYPE rather than merely unused, so nothing can read it
+  // back: leaving the field is what would let a new call site compile clean
+  // against a value nobody maintains (Rule 3.9).
   /** Module ID this machine is earmarked for, or null/undefined */
   earmarkedModule?: string | null;
   /**