@celilo/cli 0.5.0-alpha.0 → 0.5.0-alpha.10

package/src/services/placement-reconcile.ts

@@ -0,0 +1,108 @@
+/**
+ * Reconcile a module's ACTUAL node placement from Proxmox (ISS-0060 pt 2).
+ *
+ * "The DB stores intent, Proxmox reports reality." `module status` / `list`
+ * must show where a container ACTUALLY lives — queried live from the Proxmox
+ * cluster — not a cached `__infra_target_node` that drifts (caddy recorded
+ * node3, ran on node2). Machine-pool systems and non-Proxmox container services
+ * have no Proxmox node to reconcile.
+ *
+ * Never throws: a Proxmox outage yields an 'unreachable' resolution so a status
+ * or list command still renders instead of erroring.
+ */
+
+import type { DeployedSystem } from '@celilo/capabilities';
+import { ProxmoxClient, type ProxmoxCredentials } from '../api-clients/proxmox';
+import { getContainerService, getServiceCredentials } from './container-service';
+
+export type PlacementResolution =
+  | { kind: 'node'; node: string } // reconciled: lives on <node>
+  | { kind: 'unreachable' } // a Proxmox container, but the API couldn't be reached
+  | { kind: 'absent' } // a Proxmox container with a vmid not present in the cluster
+  | { kind: 'uncreated' } // a container_service system not yet created (no vmid)
+  | { kind: 'machine' } // a machine-pool system (no Proxmox node)
+  | { kind: 'other' }; // a non-Proxmox container service (e.g. DigitalOcean)
+
+/** One-line placement description for `module status`. Pure (Rule 10). */
+export function formatPlacementLine(sys: DeployedSystem, res: PlacementResolution): string {
+  const zone = `zone ${sys.zone}`;
+  const vmid = sys.infrastructure.vmid;
+  switch (res.kind) {
+    case 'machine':
+      return `${sys.hostname} — machine (${zone})`;
+    case 'other':
+      return `${sys.hostname} — container_service, non-Proxmox (${zone})`;
+    case 'uncreated':
+      return `${sys.hostname} — not yet created (${zone})`;
+    case 'unreachable':
+      return `${sys.hostname} (vmid ${vmid}) → node unknown — Proxmox unreachable (${zone})`;
+    case 'absent':
+      return `${sys.hostname} (vmid ${vmid}) → not found in Proxmox — not created? (${zone})`;
+    case 'node':
+      return `${sys.hostname} (vmid ${vmid}) → ${res.node} (${zone})`;
+  }
+}
+
+/** Pure resolution of one system given the reconciled vmid→node map + service classification. */
+export function resolveOnePlacement(
+  sys: DeployedSystem,
+  vmidToNode: Map<number, string>,
+  unreachable: Set<string>,
+  nonProxmox: Set<string>,
+): PlacementResolution {
+  const infra = sys.infrastructure;
+  if (infra.type !== 'container_service') return { kind: 'machine' };
+  if (infra.serviceId && nonProxmox.has(infra.serviceId)) return { kind: 'other' };
+  if (infra.vmid == null) return { kind: 'uncreated' };
+  if (infra.serviceId && unreachable.has(infra.serviceId)) return { kind: 'unreachable' };
+  const node = vmidToNode.get(infra.vmid);
+  return node ? { kind: 'node', node } : { kind: 'absent' };
+}
+
+/**
+ * Reconcile each system's real node from Proxmox. One `/cluster/resources` fetch
+ * per distinct Proxmox service (usually one); machine + non-Proxmox systems need
+ * no call. Returns each system paired with its resolution, in input order.
+ */
+export async function reconcilePlacement(
+  systems: DeployedSystem[],
+): Promise<Array<{ system: DeployedSystem; resolution: PlacementResolution }>> {
+  const serviceIds = [
+    ...new Set(
+      systems
+        .filter((s) => s.infrastructure.type === 'container_service')
+        .map((s) => s.infrastructure.serviceId)
+        .filter((id): id is string => !!id),
+    ),
+  ];
+
+  const vmidToNode = new Map<number, string>();
+  const unreachable = new Set<string>();
+  const nonProxmox = new Set<string>();
+
+  for (const serviceId of serviceIds) {
+    const service = await getContainerService(serviceId);
+    if (!service || service.providerName !== 'proxmox') {
+      nonProxmox.add(serviceId);
+      continue;
+    }
+    try {
+      const creds = (await getServiceCredentials(serviceId)) as ProxmoxCredentials;
+      const result = await new ProxmoxClient(creds).clusterResources();
+      if (!result.success) {
+        unreachable.add(serviceId);
+        continue;
+      }
+      for (const r of result.data) {
+        if (typeof r.vmid === 'number' && r.node) vmidToNode.set(r.vmid, r.node);
+      }
+    } catch {
+      unreachable.add(serviceId);
+    }
+  }
+
+  return systems.map((system) => ({
+    system,
+    resolution: resolveOnePlacement(system, vmidToNode, unreachable, nonProxmox),
+  }));
+}

package/src/services/programmatic-responder.ts

@@ -23,6 +23,7 @@ import { getOrCreateMasterKey } from '../secrets/master-key';
 import type {
   ConfigRequiredPayload,
   EnsureRequiredPayload,
+  InterviewRequiredPayload,
   SecretRequiredPayload,
 } from './bus-interview';
 import { readModuleSecretKey, writeModuleSecretKey } from './config-interview';
@@ -58,6 +59,13 @@ export interface ResponderValues {
       secretValues?: Record<string, string>;
     }
   >;
+  /**
+   * Generic interview answers keyed by `<scope>.<key>` (ISS-0127). When a
+   * command emits `interview.required.<scope>.<key>`, the responder replies
+   * with `{ value }`. The value's shape should match the payload's `kind`
+   * (string for text/select, string[] for multiselect, boolean for confirm).
+   */
+  interview?: Record<string, unknown>;
 }
 
 export interface ProgrammaticResponderOptions {
@@ -108,6 +116,7 @@ export interface ProgrammaticResponderHandle {
   seenConfigPayloads(): ConfigRequiredPayload[];
   seenSecretPayloads(): SecretRequiredPayload[];
   seenEnsurePayloads(): EnsureRequiredPayload[];
+  seenInterviewPayloads(): InterviewRequiredPayload[];
   /** Stop watching. Caller still owns the db client. */
   close(): void;
 }
@@ -126,6 +135,7 @@ export function startProgrammaticResponder(
   const seenConfig: ConfigRequiredPayload[] = [];
   const seenSecret: SecretRequiredPayload[] = [];
   const seenEnsure: EnsureRequiredPayload[] = [];
+  const seenInterview: InterviewRequiredPayload[] = [];
   let lastActivityAt = Date.now();
 
   const me = opts.emittedBy ?? 'programmatic';
@@ -276,6 +286,28 @@ export function startProgrammaticResponder(
     answered.push({ type: event.type, key: lookupKey });
   });
 
+  const interviewWatch = bus.watch('interview.required.*.*', async (event) => {
+    if (event.replyFor !== null) return;
+    lastActivityAt = Date.now();
+
+    const payload = event.payload as InterviewRequiredPayload;
+    if (!payload || typeof payload.scope !== 'string' || typeof payload.key !== 'string') {
+      missed.push({ type: event.type, key: '?', reason: 'malformed payload' });
+      return;
+    }
+    seenInterview.push(payload);
+
+    const lookupKey = `${payload.scope}.${payload.key}`;
+    const value = opts.values.interview?.[lookupKey];
+    if (value === undefined) {
+      handleMissing(event.type, lookupKey, `no interview value for "${lookupKey}"`);
+      return;
+    }
+
+    bus.emitRaw(`${event.type}.reply`, { value }, { replyFor: event.id, emittedBy: me });
+    answered.push({ type: event.type, key: lookupKey });
+  });
+
   // Liveness probe: a non-interactive caller (e.g. `module generate`
   // with no TTY) emits `responder.probe` to detect whether any
   // responder is listening before calling busInterview (which waits
@@ -298,10 +330,12 @@ export function startProgrammaticResponder(
     seenConfigPayloads: () => [...seenConfig],
     seenSecretPayloads: () => [...seenSecret],
     seenEnsurePayloads: () => [...seenEnsure],
+    seenInterviewPayloads: () => [...seenInterview],
     close: () => {
       configWatch.close();
       secretWatch.close();
       ensureWatch.close();
+      interviewWatch.close();
       probeWatch.close();
       bus.close();
     },

package/src/services/terminal-responder.ts

@@ -37,6 +37,7 @@ import { getOrCreateMasterKey } from '../secrets/master-key';
 import type {
   ConfigRequiredPayload,
   EnsureRequiredPayload,
+  InterviewRequiredPayload,
   SecretRequiredPayload,
 } from './bus-interview';
 import { readModuleSecretKey, writeModuleSecretKey } from './config-interview';
@@ -283,6 +284,117 @@ export function startTerminalResponder(): TerminalResponderHandle {
     });
   });
 
+  // Generic interview family (ISS-0127). Non-deploy commands (e.g.
+  // `service reconfigure`) ask their questions here so they're driveable
+  // over the bus like a deploy. Renders by `kind`. Like the other watches,
+  // we ignore reply events (replyFor !== null) and de-dupe by event id.
+  const interviewWatch = bus.watch('interview.required.*.*', async (event) => {
+    if (event.replyFor !== null) return;
+    if (handled.has(event.id)) return;
+    handled.add(event.id);
+
+    const payload = event.payload as InterviewRequiredPayload;
+    if (!payload || typeof payload.scope !== 'string' || typeof payload.key !== 'string') {
+      log.warn(
+        `Terminal responder skipped malformed interview event ${event.type} (id ${event.id}): missing scope/key`,
+      );
+      return;
+    }
+
+    const message = payload.description
+      ? `${payload.message} — ${payload.description}`
+      : payload.message;
+
+    let value: unknown;
+
+    if (payload.kind === 'confirm') {
+      const answer = await p.confirm({
+        message,
+        initialValue: payload.defaultValue === 'true',
+      });
+      if (p.isCancel(answer)) {
+        log.warn(
+          `Terminal responder: cancelled prompt for ${payload.scope}.${payload.key}; no reply emitted`,
+        );
+        return;
+      }
+      value = answer;
+    } else if (payload.kind === 'select') {
+      const answer = await p.select({
+        message,
+        options: (payload.options ?? []).map((opt) => ({
+          value: opt.value,
+          label: opt.label,
+          hint: opt.hint,
+        })),
+        initialValue: payload.defaultValue,
+      });
+      if (p.isCancel(answer)) {
+        log.warn(
+          `Terminal responder: cancelled prompt for ${payload.scope}.${payload.key}; no reply emitted`,
+        );
+        return;
+      }
+      value = answer;
+    } else if (payload.kind === 'multiselect') {
+      const answer = await p.multiselect({
+        message,
+        options: (payload.options ?? []).map((opt) => ({
+          value: opt.value,
+          label: opt.label,
+          hint: opt.hint,
+        })),
+        required: payload.required,
+      });
+      if (p.isCancel(answer)) {
+        log.warn(
+          `Terminal responder: cancelled prompt for ${payload.scope}.${payload.key}; no reply emitted`,
+        );
+        return;
+      }
+      value = answer;
+    } else {
+      // kind === 'text'
+      const type = payload.type ?? 'string';
+      const typeHint = describeTypeHint(type);
+      const answer = await promptText({
+        message: typeHint ? `${message}  (${typeHint})` : message,
+        defaultValue: payload.defaultValue,
+        placeholder: payload.placeholder,
+        validate: (val) => {
+          if (payload.required && (!val || val.trim() === '')) {
+            return 'This field is required';
+          }
+          if (payload.pattern && val) {
+            const re = new RegExp(payload.pattern);
+            if (!re.test(val)) return `Value must match: ${payload.pattern}`;
+          }
+          try {
+            coerceValue(val, type);
+          } catch (err) {
+            return err instanceof Error ? err.message : String(err);
+          }
+        },
+      });
+      if (answer === undefined) {
+        log.warn(
+          `Terminal responder: cancelled prompt for ${payload.scope}.${payload.key}; no reply emitted`,
+        );
+        return;
+      }
+      value = coerceValue(answer, type);
+    }
+
+    bus.emitRaw(
+      `${event.type}.reply`,
+      { value },
+      {
+        replyFor: event.id,
+        emittedBy: me,
+      },
+    );
+  });
+
   // Liveness probe: lets a non-interactive caller in another shell
   // (e.g. `module generate`) detect that a terminal-responder is
   // running here and that calling busInterview is safe.
@@ -300,6 +412,7 @@ export function startTerminalResponder(): TerminalResponderHandle {
       configWatch.close();
       secretWatch.close();
       ensureWatch.close();
+      interviewWatch.close();
       probeWatch.close();
       bus.close();
     },

package/src/templates/generator.test.ts

@@ -6,12 +6,14 @@ import { type DbClient, createDbClient } from '../db/client';
 import { capabilities } from '../db/schema';
 import { upsertModuleConfig } from '../services/module-config';
 import {
+  decideTargetNode,
   discoverTemplateFiles,
   generateTemplates,
   getOutputFilename,
-  injectProxmoxLxcDns,
+  injectProxmoxDns,
   isTemplateFile,
   readTemplateFiles,
+  targetNodeFromTfState,
   writeGeneratedFiles,
 } from './generator';
 import type { GeneratedFile } from './types';
@@ -635,7 +637,7 @@ resource "proxmox_lxc" "container" {
     });
   });
 
-  describe('injectProxmoxLxcDns', () => {
+  describe('injectProxmoxDns', () => {
     const LXC = [
       'resource "proxmox_lxc" "caddy" {',
       '  target_node  = "pve"',
@@ -647,11 +649,11 @@ resource "proxmox_lxc" "container" {
     ].join('\n');
 
     test('injects nameserver + lifecycle when a nameserver is computable', () => {
-      const out = injectProxmoxLxcDns(LXC, true);
+      const out = injectProxmoxDns(LXC, true);
       expect(out).toContain('  nameserver = "$self:lxc_nameserver"');
       expect(out).toContain('  lifecycle {');
       expect(out).toContain(
-        '    ignore_changes = [nameserver, network[0].hwaddr, rootfs[0].volume]',
+        '    ignore_changes = [nameserver, network[0].hwaddr, rootfs[0].volume, ssh_public_keys]',
       );
       // Injected immediately after the opening line, before author attributes.
       const lines = out.split('\n');
@@ -664,17 +666,17 @@ resource "proxmox_lxc" "container" {
     });
 
     test('injects lifecycle only (no nameserver) when none is computable', () => {
-      const out = injectProxmoxLxcDns(LXC, false);
+      const out = injectProxmoxDns(LXC, false);
       expect(out).not.toContain('nameserver = "$self:lxc_nameserver"');
       expect(out).toContain('  lifecycle {');
       expect(out).toContain(
-        '    ignore_changes = [nameserver, network[0].hwaddr, rootfs[0].volume]',
+        '    ignore_changes = [nameserver, network[0].hwaddr, rootfs[0].volume, ssh_public_keys]',
       );
     });
 
     test('is idempotent — already-injected content is returned unchanged', () => {
-      const once = injectProxmoxLxcDns(LXC, true);
-      const twice = injectProxmoxLxcDns(once, true);
+      const once = injectProxmoxDns(LXC, true);
+      const twice = injectProxmoxDns(once, true);
       expect(twice).toBe(once);
     });
 
@@ -688,32 +690,137 @@ resource "proxmox_lxc" "container" {
         '  start        = true',
         '}',
       ].join('\n');
-      const out = injectProxmoxLxcDns(stale, true);
+      const out = injectProxmoxDns(stale, true);
       // Exactly one nameserver attribute survives.
       expect(out.match(/nameserver\s*=/g)?.length).toBe(1);
       // The lifecycle guard is still added (ISS-0055 extended the ignore list).
       expect(out).toContain('ignore_changes = [nameserver,');
     });
 
-    test('leaves non-proxmox_lxc resources untouched', () => {
-      const vm = ['resource "proxmox_vm" "build" {', '  cores = 4', '}'].join('\n');
-      expect(injectProxmoxLxcDns(vm, true)).toBe(vm);
+    test('injects cloud-init DNS + the VM ForceNew ignore list into proxmox_vm_qemu', () => {
+      const vm = [
+        'resource "proxmox_vm_qemu" "builder" {',
+        '  target_node = "pve"',
+        '  clone       = "ubuntu-2204-cloudinit"',
+        '  network {',
+        '    bridge = "vmbr0"',
+        '  }',
+        '}',
+      ].join('\n');
+      const out = injectProxmoxDns(vm, true);
+      expect(out).toContain('  nameserver = "$self:lxc_nameserver"');
+      expect(out).toContain('  lifecycle {');
+      // The VM ForceNew list (telmate 3.x), NOT the LXC one.
+      expect(out).toContain(
+        '    ignore_changes = [nameserver, network[0].macaddr, sshkeys, clone]',
+      );
+      const lines = out.split('\n');
+      expect(lines[0]).toBe('resource "proxmox_vm_qemu" "builder" {');
+      expect(lines[1]).toBe('  nameserver = "$self:lxc_nameserver"');
+      expect(out).toContain('  clone       = "ubuntu-2204-cloudinit"');
+    });
+
+    test('branches the ignore list per block in a mixed lxc + vm file', () => {
+      // The forgejo-runner builder pattern: one template with both a count-gated
+      // proxmox_lxc (light) and proxmox_vm_qemu (builder) — each gets its own list.
+      const mixed = [
+        'resource "proxmox_lxc" "light" {',
+        '  target_node = "pve"',
+        '}',
+        '',
+        'resource "proxmox_vm_qemu" "builder" {',
+        '  clone = "ubuntu-2204-cloudinit"',
+        '}',
+      ].join('\n');
+      const out = injectProxmoxDns(mixed, true);
+      expect(out).toContain(
+        'ignore_changes = [nameserver, network[0].hwaddr, rootfs[0].volume, ssh_public_keys]',
+      );
+      expect(out).toContain('ignore_changes = [nameserver, network[0].macaddr, sshkeys, clone]');
+    });
+
+    test('leaves non-Proxmox-compute resources untouched', () => {
+      // Not proxmox_lxc / proxmox_vm_qemu — an external-zone droplet, and the bare
+      // `proxmox_vm` type (which is NOT the cloud-init qemu resource we target).
+      const droplet = [
+        'resource "digitalocean_droplet" "edge" {',
+        '  size = "s-1vcpu-1gb"',
+        '}',
+      ].join('\n');
+      const bareVm = ['resource "proxmox_vm" "x" {', '  cores = 4', '}'].join('\n');
+      expect(injectProxmoxDns(droplet, true)).toBe(droplet);
+      expect(injectProxmoxDns(bareVm, true)).toBe(bareVm);
     });
 
     test('injects into every proxmox_lxc block in a multi-resource file', () => {
       const two = `${LXC}\n\n${LXC.replace('"caddy"', '"forgejo"')}`;
-      const out = injectProxmoxLxcDns(two, true);
+      const out = injectProxmoxDns(two, true);
       expect(out.match(/ignore_changes = \[nameserver,/g)?.length).toBe(2);
     });
 
     test('matches the indentation of the resource opening line', () => {
       const indented = ['  resource "proxmox_lxc" "x" {', '    cores = 1', '  }'].join('\n');
-      const out = injectProxmoxLxcDns(indented, true);
+      const out = injectProxmoxDns(indented, true);
       expect(out).toContain('    nameserver = "$self:lxc_nameserver"');
       expect(out).toContain('    lifecycle {');
       expect(out).toContain(
-        '      ignore_changes = [nameserver, network[0].hwaddr, rootfs[0].volume]',
+        '      ignore_changes = [nameserver, network[0].hwaddr, rootfs[0].volume, ssh_public_keys]',
       );
     });
   });
 });
+
+describe("targetNodeFromTfState (ISS-0090 — terraform state is celilo's placement record)", () => {
+  test('reads the node from the proxmox_lxc target_node attribute', () => {
+    const state = {
+      resources: [
+        {
+          type: 'proxmox_lxc',
+          instances: [{ attributes: { target_node: 'node2', id: 'node2/lxc/200' } }],
+        },
+      ],
+    };
+    expect(targetNodeFromTfState(state)).toBe('node2');
+  });
+
+  test('falls back to parsing the resource id when target_node is absent', () => {
+    const state = {
+      resources: [{ type: 'proxmox_lxc', instances: [{ attributes: { id: 'node3/lxc/201' } }] }],
+    };
+    expect(targetNodeFromTfState(state)).toBe('node3');
+  });
+
+  test('returns null when there is no proxmox_lxc resource (fresh/empty state)', () => {
+    expect(targetNodeFromTfState({ resources: [] })).toBeNull();
+    expect(targetNodeFromTfState({})).toBeNull();
+  });
+});
+
+describe('decideTargetNode (ISS-0090 — deploy follows reality: Proxmox > state > default)', () => {
+  test('Proxmox reality wins — adopts a hand-migration tf-state would miss', () => {
+    expect(
+      decideTargetNode({ proxmoxNode: 'node2', stateNode: 'node3', defaultNode: 'node3' }),
+    ).toEqual({ node: 'node2', source: 'proxmox' });
+  });
+
+  test('falls back to terraform state when Proxmox is unknown/unreachable', () => {
+    expect(
+      decideTargetNode({ proxmoxNode: null, stateNode: 'node2', defaultNode: 'node3' }),
+    ).toEqual({ node: 'node2', source: 'state' });
+  });
+
+  test('first deploy (no Proxmox, no state) → service default', () => {
+    expect(decideTargetNode({ proxmoxNode: null, stateNode: null, defaultNode: 'node3' })).toEqual({
+      node: 'node3',
+      source: 'default',
+    });
+  });
+
+  test('a changed default never relocates a running container (reality overrides default)', () => {
+    // default flipped node2→node3, but the container actually runs on node2:
+    // resolution stays node2, so the redeploy is an in-place update, not a move.
+    expect(
+      decideTargetNode({ proxmoxNode: 'node2', stateNode: null, defaultNode: 'node3' }),
+    ).toEqual({ node: 'node2', source: 'proxmox' });
+  });
+});