@celilo/cli 0.5.0-alpha.1 → 0.5.0-alpha.11

package/src/services/dns-internal-records.ts

@@ -0,0 +1,119 @@
+/**
+ * Internal split-horizon DNS A-record ledger (designs/CELILO_DOCTOR_FLEET_DRIFT.md
+ * Phase 4, ISS-0094 / ISS-0111).
+ *
+ * The dns_internal capability (technitium/knot) registers records straight
+ * into the resolver's own DB, leaving celilo no offline record of what it
+ * asked to be served. This ledger — the internal-DNS sibling of
+ * `dns_registrations` — records every successful `registerRecord({type:'A'})`
+ * so `celilo system doctor` can assert, without a live resolver probe, that
+ * service hostnames resolve to the firewall natIp (LAN-reachable) rather than
+ * a zone-side container IP a LAN device can't route to.
+ *
+ * Row lifecycle is FK cascade — records die with their provider or consumer.
+ */
+
+import type { DnsInternalCapability, DnsRecordRequest } from '@celilo/capabilities';
+import { and, eq } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { dnsInternalRecords } from '../db/schema';
+
+export interface DnsInternalRecordRow {
+  host: string;
+  ip: string;
+  providerModuleId: string;
+  consumerModuleId: string;
+  registeredAt: Date;
+}
+
+export function listDnsInternalRecords(
+  db: DbClient,
+  options: { providerModuleId?: string } = {},
+): DnsInternalRecordRow[] {
+  const query = db
+    .select({
+      host: dnsInternalRecords.host,
+      ip: dnsInternalRecords.ip,
+      providerModuleId: dnsInternalRecords.providerModuleId,
+      consumerModuleId: dnsInternalRecords.consumerModuleId,
+      registeredAt: dnsInternalRecords.registeredAt,
+    })
+    .from(dnsInternalRecords);
+  return options.providerModuleId
+    ? query.where(eq(dnsInternalRecords.providerModuleId, options.providerModuleId)).all()
+    : query.all();
+}
+
+export function recordDnsInternalRecord(
+  db: DbClient,
+  record: { providerModuleId: string; consumerModuleId: string; host: string; ip: string },
+): void {
+  db.insert(dnsInternalRecords)
+    .values({
+      providerModuleId: record.providerModuleId,
+      consumerModuleId: record.consumerModuleId,
+      host: record.host,
+      ip: record.ip,
+      registeredAt: new Date(),
+    })
+    .onConflictDoUpdate({
+      target: [dnsInternalRecords.providerModuleId, dnsInternalRecords.host],
+      set: {
+        consumerModuleId: record.consumerModuleId,
+        ip: record.ip,
+        registeredAt: new Date(),
+      },
+    })
+    .run();
+}
+
+export function removeDnsInternalRecord(
+  db: DbClient,
+  record: { providerModuleId: string; host: string },
+): void {
+  db.delete(dnsInternalRecords)
+    .where(
+      and(
+        eq(dnsInternalRecords.providerModuleId, record.providerModuleId),
+        eq(dnsInternalRecords.host, record.host),
+      ),
+    )
+    .run();
+}
+
+/**
+ * Wrap a dns_internal interface so A-record register/delete calls are
+ * mirrored into the ledger. Only A records are tracked — they're the
+ * host→IP mapping the natIp drift check reasons about; CNAMEs/others pass
+ * through unrecorded. A throw from the underlying call propagates before
+ * any ledger write, so only a confirmed register/delete earns a row change.
+ */
+export function withDnsInternalLedger(
+  iface: DnsInternalCapability,
+  ctx: { db: DbClient; providerModuleId: string; consumerModuleId: string },
+): DnsInternalCapability {
+  const isA = (request: DnsRecordRequest) => request.type.toUpperCase() === 'A';
+  return {
+    ...iface,
+    async registerRecord(request: DnsRecordRequest): Promise<void> {
+      await iface.registerRecord(request);
+      if (isA(request)) {
+        recordDnsInternalRecord(ctx.db, {
+          providerModuleId: ctx.providerModuleId,
+          consumerModuleId: ctx.consumerModuleId,
+          host: request.host,
+          ip: request.value,
+        });
+      }
+    },
+    async deleteRecord(request: DnsRecordRequest): Promise<void> {
+      await iface.deleteRecord(request);
+      if (isA(request)) {
+        removeDnsInternalRecord(ctx.db, {
+          providerModuleId: ctx.providerModuleId,
+          host: request.host,
+        });
+      }
+    },
+  };
+}

package/src/services/dns-provider-backfill.test.ts

@@ -105,14 +105,14 @@ describe('backfillWebRouteDns (ISS-0029)', () => {
     seedFirewall('100.64.0.1');
     seedRoute('apt.celilo.computer', '/');
     seedRoute('apt.celilo.computer', '/-/publish'); // same host, different path → deduped
-    seedRoute('registry.lunacycle.net', '/');
+    seedRoute('registry.example.net', '/');
 
     const calls: DnsRecordRequest[] = [];
     await backfillWebRouteDns('technitium', getDb(), silentLogger, stubLoader(calls));
 
     expect(calls.map((c) => c.host).sort()).toEqual([
       'apt.celilo.computer',
-      'registry.lunacycle.net',
+      'registry.example.net',
     ]);
     expect(calls.every((c) => c.value === '100.64.0.1' && c.type === 'A')).toBe(true);
   });

package/src/services/dns-provider-backfill.ts

@@ -15,7 +15,7 @@
  */
 
 import type { DnsInternalCapability, HookLogger } from '@celilo/capabilities';
-import { and, eq } from 'drizzle-orm';
+import { and, eq, inArray, or } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { capabilities as capabilitiesTable, modules, webRoutes } from '../db/schema';
 import { loadCapabilityFunctions, resolveFirewallNatIp } from '../hooks/capability-loader';
@@ -54,7 +54,19 @@ export async function backfillProviderDns(
 ): Promise<void> {
   logger.info(`dns_internal provider '${moduleId}' deployed — backfilling DNS for all systems`);
 
-  const deployed = db.select().from(modules).all();
+  // ISS-0009: register only DEPLOYED systems, never IMPORTED-but-undeployed
+  // modules (those have a hostname/target_ip configured but nothing serving at
+  // that address — registering an A record for them is a phantom record). A
+  // deployed system is INSTALLED or VERIFIED. The provider itself is already
+  // INSTALLED by the time backfill runs (module-deploy transitions state before
+  // calling this), but we union its id explicitly so the provider's own
+  // self-record is registered even if that transition order ever changes —
+  // critical in daemonless contexts where no dispatcher delivers system.created.
+  const deployed = db
+    .select()
+    .from(modules)
+    .where(or(inArray(modules.state, ['INSTALLED', 'VERIFIED']), eq(modules.id, moduleId)))
+    .all();
   const failures: string[] = [];
 
   // One register per deployed system across all modules — a module with N

package/src/services/dns-registrations.test.ts

@@ -0,0 +1,120 @@
+/**
+ * Unit tests for the DNS registration ledger
+ * (designs/DISPATCHER_DAEMON_AND_TIMER_EVENTS.md B2): upsert semantics,
+ * the registerHost recording wrapper (success-only), refresh stamping,
+ * and FK-cascade cleanup when a module is removed.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { DnsRegistrarCapability } from '@celilo/capabilities';
+import { eq } from 'drizzle-orm';
+import { type DbClient, getDb } from '../db/client';
+import { modules } from '../db/schema';
+import {
+  listDnsRegistrations,
+  recordDnsRegistration,
+  stampDnsRegistrationsRefreshed,
+  withDnsRegistrationLedger,
+} from './dns-registrations';
+
+describe('dns_registrations ledger', () => {
+  let tempDir: string;
+  let db: DbClient;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), 'celilo-dnsreg-'));
+    process.env.CELILO_DB_PATH = join(tempDir, 'test.db');
+    db = getDb();
+    for (const id of ['namecheap', 'caddy']) {
+      db.insert(modules)
+        .values({
+          id,
+          name: id,
+          sourcePath: join(tempDir, id),
+          version: '1.0.0',
+          manifestData: { celilo_contract: '1.0', id, name: id, version: '1.0.0' },
+        })
+        .run();
+    }
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+    process.env.CELILO_DB_PATH = undefined;
+  });
+
+  test('record + list roundtrip; upsert replaces ip and consumer', () => {
+    recordDnsRegistration(db, {
+      providerModuleId: 'namecheap',
+      consumerModuleId: 'caddy',
+      fqdn: 'www.example.net',
+      ip: '198.51.100.7',
+    });
+    recordDnsRegistration(db, {
+      providerModuleId: 'namecheap',
+      consumerModuleId: 'caddy',
+      fqdn: 'www.example.net',
+      ip: '198.51.100.8',
+    });
+
+    const rows = listDnsRegistrations(db, { providerModuleId: 'namecheap' });
+    expect(rows.length).toBe(1);
+    expect(rows[0].fqdn).toBe('www.example.net');
+    expect(rows[0].ip).toBe('198.51.100.8');
+    expect(rows[0].consumerModuleId).toBe('caddy');
+    expect(rows[0].refreshedAt).toBeNull();
+  });
+
+  test('stampDnsRegistrationsRefreshed sets refreshedAt for the provider', () => {
+    recordDnsRegistration(db, {
+      providerModuleId: 'namecheap',
+      consumerModuleId: 'caddy',
+      fqdn: 'git.example.net',
+      ip: null,
+    });
+    stampDnsRegistrationsRefreshed(db, 'namecheap');
+    const [row] = listDnsRegistrations(db, { providerModuleId: 'namecheap' });
+    expect(row.refreshedAt).not.toBeNull();
+  });
+
+  test('rows die with the consumer module (FK cascade)', () => {
+    recordDnsRegistration(db, {
+      providerModuleId: 'namecheap',
+      consumerModuleId: 'caddy',
+      fqdn: 'www.example.net',
+      ip: '198.51.100.7',
+    });
+    db.delete(modules).where(eq(modules.id, 'caddy')).run();
+    expect(listDnsRegistrations(db).length).toBe(0);
+  });
+
+  test('withDnsRegistrationLedger records successes only', async () => {
+    const calls: string[] = [];
+    const fake: DnsRegistrarCapability = {
+      async registerHost(request) {
+        calls.push(request.fqdn);
+        const success = !request.fqdn.startsWith('fail.');
+        return { success, outputs: {}, duration: 1 };
+      },
+    };
+    const wrapped = withDnsRegistrationLedger(fake, {
+      db,
+      providerModuleId: 'namecheap',
+      consumerModuleId: 'caddy',
+    });
+
+    await wrapped.registerHost({ fqdn: 'www.example.net', ip: '198.51.100.7' });
+    await wrapped.registerHost({ fqdn: 'fail.example.net', ip: '198.51.100.7' });
+    await wrapped.registerHost({ fqdn: 'auto.example.net' });
+
+    expect(calls.length).toBe(3);
+    const rows = listDnsRegistrations(db);
+    const fqdns = rows.map((r) => r.fqdn).sort();
+    expect(fqdns).toEqual(['auto.example.net', 'www.example.net']);
+    const auto = rows.find((r) => r.fqdn === 'auto.example.net');
+    expect(auto?.ip).toBeNull();
+  });
+});

package/src/services/dns-registrations.ts

@@ -0,0 +1,108 @@
+/**
+ * DNS registration ledger operations
+ * (designs/DISPATCHER_DAEMON_AND_TIMER_EVENTS.md B2/B3).
+ *
+ * The capability loader records every successful
+ * dns_registrar.registerHost here; the run-hook path reads the ledger
+ * back to feed a provider's `refresh_registrations` hook, and `celilo
+ * dns registrations` lists it for the operator. Row lifecycle is FK
+ * cascade — registrations die with their provider or consumer module.
+ */
+
+import type { DnsRegistrarCapability, HookResult } from '@celilo/capabilities';
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { dnsRegistrations } from '../db/schema';
+
+export interface DnsRegistrationRow {
+  fqdn: string;
+  /** null = the provider auto-detected the request's source IP. */
+  ip: string | null;
+  providerModuleId: string;
+  consumerModuleId: string;
+  registeredAt: Date;
+  refreshedAt: Date | null;
+}
+
+export function listDnsRegistrations(
+  db: DbClient,
+  options: { providerModuleId?: string } = {},
+): DnsRegistrationRow[] {
+  const query = db
+    .select({
+      fqdn: dnsRegistrations.fqdn,
+      ip: dnsRegistrations.ip,
+      providerModuleId: dnsRegistrations.providerModuleId,
+      consumerModuleId: dnsRegistrations.consumerModuleId,
+      registeredAt: dnsRegistrations.registeredAt,
+      refreshedAt: dnsRegistrations.refreshedAt,
+    })
+    .from(dnsRegistrations);
+  const rows = options.providerModuleId
+    ? query.where(eq(dnsRegistrations.providerModuleId, options.providerModuleId)).all()
+    : query.all();
+  return rows;
+}
+
+export function recordDnsRegistration(
+  db: DbClient,
+  registration: {
+    providerModuleId: string;
+    consumerModuleId: string;
+    fqdn: string;
+    ip: string | null;
+  },
+): void {
+  db.insert(dnsRegistrations)
+    .values({
+      providerModuleId: registration.providerModuleId,
+      consumerModuleId: registration.consumerModuleId,
+      fqdn: registration.fqdn,
+      ip: registration.ip,
+      registeredAt: new Date(),
+    })
+    .onConflictDoUpdate({
+      target: [dnsRegistrations.providerModuleId, dnsRegistrations.fqdn],
+      set: {
+        consumerModuleId: registration.consumerModuleId,
+        ip: registration.ip,
+        registeredAt: new Date(),
+      },
+    })
+    .run();
+}
+
+/** Stamp every row of a provider as refreshed (successful refresh hook). */
+export function stampDnsRegistrationsRefreshed(db: DbClient, providerModuleId: string): void {
+  db.update(dnsRegistrations)
+    .set({ refreshedAt: new Date() })
+    .where(eq(dnsRegistrations.providerModuleId, providerModuleId))
+    .run();
+}
+
+/**
+ * Wrap a dns_registrar interface so successful registerHost calls are
+ * recorded in the ledger. Failures and MissingProviderInputError
+ * interview throws pass through untouched — only a confirmed
+ * registration earns a row.
+ */
+export function withDnsRegistrationLedger(
+  registrar: DnsRegistrarCapability,
+  ctx: { db: DbClient; providerModuleId: string; consumerModuleId: string },
+): DnsRegistrarCapability {
+  return {
+    ...registrar,
+    async registerHost(request): Promise<HookResult> {
+      const result = await registrar.registerHost(request);
+      if (result.success && request.fqdn) {
+        recordDnsRegistration(ctx.db, {
+          providerModuleId: ctx.providerModuleId,
+          consumerModuleId: ctx.consumerModuleId,
+          fqdn: request.fqdn,
+          ip: request.ip ?? null,
+        });
+      }
+      return result;
+    },
+  };
+}

package/src/services/events-daemon.test.ts

@@ -8,6 +8,7 @@ import {
   readInstalledUnit,
   renderLaunchdPlist,
   renderSystemdUnit,
+  resolveRunAsUser,
   uninstallDaemon,
 } from './events-daemon';
 
@@ -19,6 +20,7 @@ describe('renderSystemdUnit', () => {
       pollMs: 1000,
       concurrency: 4,
       home: '/home/op',
+      scope: 'user',
     });
     expect(out).toContain(
       'ExecStart=/usr/local/bin/celilo events run --poll-ms 1000 --concurrency 4',
@@ -26,6 +28,7 @@ describe('renderSystemdUnit', () => {
     expect(out).toContain('Environment=EVENT_BUS_DB=/var/lib/celilo/events.db');
     expect(out).toContain('Restart=on-failure');
     expect(out).toContain('WantedBy=default.target');
+    expect(out).not.toContain('User=');
   });
 
   it('honors --poll-ms and --concurrency overrides', () => {
@@ -35,9 +38,26 @@ describe('renderSystemdUnit', () => {
       pollMs: 250,
       concurrency: 8,
       home: '/h',
+      scope: 'user',
     });
     expect(out).toContain('--poll-ms 250 --concurrency 8');
   });
+
+  it('system scope sets explicit User= and multi-user.target', () => {
+    const out = renderSystemdUnit({
+      celiloPath: '/usr/local/bin/celilo',
+      busDbPath: '/var/celilo/events.db',
+      pollMs: 1000,
+      concurrency: 4,
+      home: '/root',
+      scope: 'system',
+      runAsUser: 'celilo',
+    });
+    expect(out).toContain('User=celilo');
+    expect(out).toContain('WantedBy=multi-user.target');
+    expect(out).toContain('journalctl -u celilo-events.service');
+    expect(out).not.toContain('journalctl --user');
+  });
 });
 
 describe('renderLaunchdPlist', () => {
@@ -48,6 +68,7 @@ describe('renderLaunchdPlist', () => {
       pollMs: 1000,
       concurrency: 4,
       home: '/Users/op',
+      scope: 'user',
     });
     expect(out).toContain('<string>/Users/op/Library/Logs/celilo-events.out.log</string>');
     expect(out).toContain('<string>/Users/op/Library/Logs/celilo-events.err.log</string>');
@@ -55,6 +76,24 @@ describe('renderLaunchdPlist', () => {
     expect(out).toContain('<string>com.celilo.events</string>');
     expect(out).toContain('<key>RunAtLoad</key>');
     expect(out).toContain('<key>KeepAlive</key>');
+    expect(out).not.toContain('<key>UserName</key>');
+  });
+
+  it('system scope sets UserName and logs under /Library/Logs', () => {
+    const out = renderLaunchdPlist({
+      celiloPath: '/c',
+      busDbPath: '/db',
+      pollMs: 1000,
+      concurrency: 4,
+      home: '/Users/op',
+      scope: 'system',
+      runAsUser: 'celilo',
+    });
+    expect(out).toContain('<key>UserName</key>');
+    expect(out).toContain('<string>celilo</string>');
+    expect(out).toContain('<string>/Library/Logs/celilo-events.out.log</string>');
+    expect(out).toContain('<string>/Library/Logs/celilo-events.err.log</string>');
+    expect(out).not.toContain('/Users/op/Library/Logs');
   });
 });
 
@@ -69,6 +108,24 @@ describe('getDaemonUnitPath', () => {
       '/Users/op/Library/LaunchAgents/com.celilo.events.plist',
     );
   });
+  it('returns the system paths for system scope', () => {
+    expect(getDaemonUnitPath('linux', '/home/op', 'system')).toBe(
+      '/etc/systemd/system/celilo-events.service',
+    );
+    expect(getDaemonUnitPath('darwin', '/Users/op', 'system')).toBe(
+      '/Library/LaunchDaemons/com.celilo.events.plist',
+    );
+  });
+});
+
+describe('resolveRunAsUser', () => {
+  it('honors an explicit override', () => {
+    expect(resolveRunAsUser('/var/celilo/events.db', 'celilo')).toBe('celilo');
+  });
+  it('falls back to the current user when the state dir is missing', () => {
+    const me = resolveRunAsUser('/no/such/dir/events.db');
+    expect(me.length).toBeGreaterThan(0);
+  });
 });
 
 describe('installDaemon / uninstallDaemon roundtrip', () => {
@@ -99,6 +156,8 @@ describe('installDaemon / uninstallDaemon roundtrip', () => {
       busDbPath: '/var/lib/celilo/events.db',
     });
     expect(existsSync(installed.unitPath)).toBe(true);
+    expect(installed.scope).toBe('user');
+    expect(installed.runAsUser).toBeUndefined();
     expect(installed.unitPath).toBe(join(home, '.config/systemd/user/celilo-events.service'));
     expect(installed.nextSteps[0]).toContain('systemctl --user daemon-reload');