@celilo/cli 0.5.0-alpha.9 → 0.6.0

package/src/cli/commands/module-update.ts

@@ -0,0 +1,571 @@
+/**
+ * Module update command
+ *
+ * Updates module code (manifest, scripts, templates) while preserving state
+ * (configs, secrets, infrastructure, capabilities).
+ *
+ * Usage: celilo module update <path>
+ *
+ * The module ID is read from the manifest at the given path.
+ */
+
+import { cpSync, existsSync, readFileSync, readdirSync } from 'node:fs';
+import { unlink } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { parse as parseYaml } from 'yaml';
+import { registerModuleCapabilities } from '../../capabilities/registration';
+import { getDb } from '../../db/client';
+import { capabilities, modules } from '../../db/schema';
+import { ModuleManifestSchema } from '../../manifest/schema';
+import type { ModuleManifest } from '../../manifest/schema';
+import { cleanupTempDir, extractPackage } from '../../module/packaging/extract';
+import { RegistryClient } from '../../registry/client';
+import { askConfirm, withInterviewSession } from '../../services/bus-interview';
+import { getFlag } from '../parser';
+import { log } from '../prompts';
+import type { CommandResult } from '../types';
+
+type UpdateOutcome =
+  | {
+      status: 'success';
+      moduleId: string;
+      /** Version that was on disk before the upgrade (manifest.yml semver). */
+      previousVersion: string;
+      /** Version that's now installed. Includes +N revision when known
+       *  (registry-driven upgrades pass the canonical "1.0.0+5" form;
+       *  path-driven upgrades fall back to the manifest semver). */
+      newVersion: string;
+    }
+  | { status: 'failed'; moduleId: string; error: string }
+  // `skipped` means the path expanded from a glob but isn't an
+  // upgradable target — either no manifest at all (probably a non-
+  // module sibling like `modules/archive/`) or a real module that
+  // isn't installed in this celilo. Treated as a soft pass so
+  // `celilo module update modules/*` does what users expect.
+  | { status: 'skipped'; moduleId: string; reason: string };
+
+/**
+ * Tunables for `updateOne`. Quiet mode silences the per-call log
+ * lines so callers driving a batch (the registry sweep) can render
+ * their own structured output without duplicates. `displayVersion`
+ * lets the registry caller carry the canonical `+N` revision through
+ * to both the DB column and the success log.
+ */
+interface UpdateOpts {
+  quiet?: boolean;
+  displayVersion?: string;
+}
+
+/**
+ * Parse a celilo version string into [major, minor, patch, revision].
+ * Celilo's published versions look like `1.0.0+3` — semver core plus a
+ * publish revision suffix (the +N resets on every semver bump). Missing
+ * segments default to 0; non-numeric segments are clamped to 0 so we
+ * never throw on weird upstream input.
+ */
+function parseModuleVersion(v: string): [number, number, number, number] {
+  const cleaned = v.replace(/^[v=]+/, '');
+  const [core, rev] = cleaned.split('+');
+  const parts = (core ?? '').split('.');
+  const num = (s: string | undefined) => {
+    const n = Number(s ?? '0');
+    return Number.isNaN(n) ? 0 : n;
+  };
+  return [num(parts[0]), num(parts[1]), num(parts[2]), num(rev)];
+}
+
+export type VersionChangeKind = 'up-to-date' | 'ahead' | 'patch' | 'minor' | 'major';
+
+/**
+ * Classify a registry-side update relative to the installed version.
+ *   `major` = breaking (semver-major bump). Operator must approve.
+ *   `minor` = additive feature. Auto-applied.
+ *   `patch` = bugfix or revision-only (+N) bump. Auto-applied.
+ *   `up-to-date` = identical version.
+ *   `ahead` = installed is newer than registry. Skip silently — usually
+ *             means the operator pushed locally without publishing.
+ *
+ * Exported for unit tests.
+ */
+export function classifyVersionChange(installed: string, latest: string): VersionChangeKind {
+  const [aMaj, aMin, aPat, aRev] = parseModuleVersion(installed);
+  const [bMaj, bMin, bPat, bRev] = parseModuleVersion(latest);
+  if (bMaj > aMaj) return 'major';
+  if (bMaj < aMaj) return 'ahead';
+  if (bMin > aMin) return 'minor';
+  if (bMin < aMin) return 'ahead';
+  if (bPat > aPat) return 'patch';
+  if (bPat < aPat) return 'ahead';
+  if (bRev > aRev) return 'patch';
+  if (bRev < aRev) return 'ahead';
+  return 'up-to-date';
+}
+
+/**
+ * Download a module package from the registry into a temp file and run
+ * the standard updateOne path against it. Cleans the temp file in a
+ * finally block so a mid-flight failure doesn't leak a tar.zst on disk.
+ */
+export async function fetchAndUpdate(
+  client: RegistryClient,
+  moduleId: string,
+  version: string,
+  db: ReturnType<typeof getDb>,
+  flags: Record<string, string | boolean>,
+): Promise<UpdateOutcome> {
+  const tmpPath = join(tmpdir(), `${moduleId}-${version}-${Date.now()}.netapp`);
+  try {
+    const pkgData = await client.download(moduleId, version);
+    await Bun.write(tmpPath, pkgData);
+  } catch (err) {
+    return {
+      status: 'failed',
+      moduleId,
+      error: `Download failed: ${err instanceof Error ? err.message : String(err)}`,
+    };
+  }
+  try {
+    // Registry packages are pre-verified at publish time; skip the
+    // signature check here to match `module import`'s registry path.
+    // `quiet: true` suppresses updateOne's per-call log lines so the
+    // sweep can render its own structured per-module output without
+    // duplicates. `displayVersion: version` carries the registry's
+    // canonical "X.Y.Z+N" through to both the DB column and the success
+    // log line — without it, output would say "v1.0.0 → v1.0.0" because
+    // the manifest semver doesn't include the +N revision.
+    return await updateOne(
+      tmpPath,
+      db,
+      { ...flags, 'skip-verify': true },
+      { quiet: true, displayVersion: version },
+    );
+  } finally {
+    try {
+      await unlink(tmpPath);
+    } catch {}
+  }
+}
+
+/**
+ * Upgrade a single module from a source path
+ */
+export async function updateOne(
+  sourcePath: string,
+  db: ReturnType<typeof getDb>,
+  flags: Record<string, string | boolean> = {},
+  opts: UpdateOpts = {},
+): Promise<UpdateOutcome> {
+  const originalCwd = process.env.CELILO_ORIGINAL_CWD || process.cwd();
+  const importPath = resolve(originalCwd, sourcePath);
+  if (!existsSync(importPath)) {
+    return {
+      status: 'failed',
+      moduleId: sourcePath,
+      error: `Source path not found: ${importPath}`,
+    };
+  }
+
+  // Handle .netapp packages: extract to temp dir
+  let actualPath = importPath;
+  let tempDir: string | null = null;
+
+  if (importPath.endsWith('.netapp')) {
+    const extractResult = await extractPackage(importPath);
+    if (!extractResult.success || !extractResult.tempDir) {
+      return {
+        status: 'failed',
+        moduleId: sourcePath,
+        error: extractResult.error || 'Failed to extract package',
+      };
+    }
+    tempDir = extractResult.tempDir;
+    actualPath = tempDir;
+
+    // Skip signature verification if --skip-verify
+    if (flags['skip-verify'] !== true) {
+      const { verifyPackageIntegrity } = await import('../../module/packaging/extract');
+      const verifyResult = await verifyPackageIntegrity(tempDir);
+      if (!verifyResult.success) {
+        await cleanupTempDir(tempDir);
+        return {
+          status: 'failed',
+          moduleId: sourcePath,
+          error: verifyResult.error || 'Package verification failed',
+        };
+      }
+    } else if (!opts.quiet) {
+      log.warn('Skipping package signature verification (--skip-verify)');
+    }
+  }
+
+  const manifestPath = join(actualPath, 'manifest.yml');
+  if (!existsSync(manifestPath)) {
+    if (tempDir) await cleanupTempDir(tempDir);
+    // No manifest means the path isn't a module directory at all —
+    // a likely outcome of `module update modules/*` matching a
+    // non-module sibling. Skip silently rather than fail the batch.
+    return {
+      status: 'skipped',
+      moduleId: sourcePath,
+      reason: 'not a module directory (no manifest.yml)',
+    };
+  }
+
+  let newManifest: ModuleManifest;
+  try {
+    const raw = readFileSync(manifestPath, 'utf-8');
+    const parsed = parseYaml(raw);
+    newManifest = ModuleManifestSchema.parse(parsed);
+  } catch (err) {
+    if (tempDir) await cleanupTempDir(tempDir);
+    const msg = err instanceof Error ? err.message : String(err);
+    return { status: 'failed', moduleId: sourcePath, error: `Invalid manifest: ${msg}` };
+  }
+
+  const moduleId = newManifest.id;
+
+  const module = db.select().from(modules).where(eq(modules.id, moduleId)).get();
+  if (!module) {
+    if (tempDir) await cleanupTempDir(tempDir);
+    // Module isn't installed in this celilo. Don't fail the batch —
+    // `module update modules/*` should keep going for everything
+    // that IS installed. Caller surfaces the skip count so the user
+    // sees what was passed over.
+    return {
+      status: 'skipped',
+      moduleId,
+      reason: `not installed (run 'celilo module import ${sourcePath}' to add)`,
+    };
+  }
+
+  // Old version comes from the DB so we capture whatever was last
+  // recorded (which IS the registry-versioned form, e.g. "1.0.0+5",
+  // for registry-driven installs/upgrades).
+  const previousVersion = module.version;
+  // New version: prefer the caller-supplied display version (registry's
+  // canonical "X.Y.Z+N"), fall back to the manifest semver core when
+  // upgrading from a local path.
+  const newVersion = opts.displayVersion ?? newManifest.version;
+  if (!opts.quiet) {
+    log.info(`Upgrading ${moduleId}: ${previousVersion} → ${newVersion}`);
+  }
+
+  // Copy new module files, preserving generated output and state
+  const installedPath = module.sourcePath;
+  const preserveDirs = new Set(['generated', 'screenshots', 'cookies.json']);
+
+  const skipDirs = new Set(['.git', 'node_modules', '.next', '.cache']);
+  const entries = readdirSync(actualPath);
+  for (const entry of entries) {
+    if (preserveDirs.has(entry) || skipDirs.has(entry)) continue;
+    const src = join(actualPath, entry);
+    const dest = join(installedPath, entry);
+    cpSync(src, dest, { recursive: true, force: true });
+  }
+
+  // Clean up temp dir if we extracted a .netapp
+  if (tempDir) await cleanupTempDir(tempDir);
+
+  // Update manifest in database. We persist the display version (with
+  // +N when known) so subsequent `module list` / `module update` calls
+  // see the same version string the registry reported.
+  db.update(modules)
+    .set({
+      manifestData: newManifest as unknown as Record<string, unknown>,
+      version: newVersion,
+      name: newManifest.name,
+    })
+    .where(eq(modules.id, moduleId))
+    .run();
+
+  // Re-register capabilities
+  db.delete(capabilities).where(eq(capabilities.moduleId, moduleId)).run();
+
+  if (newManifest.provides?.capabilities && newManifest.provides.capabilities.length > 0) {
+    const regResult = await registerModuleCapabilities(moduleId, newManifest, db.$client);
+    if (!regResult.success && !opts.quiet) {
+      // Capability re-registration warnings are useful when upgrading
+      // from a path (operator iterating on dev module); for the
+      // registry sweep, the caller will surface them itself if needed.
+      log.warn(`  ${moduleId}: capability re-registration warning: ${regResult.error}`);
+    }
+  }
+
+  // (Re-)register event-bus subscriptions from the new manifest —
+  // mirrors import.ts (ISS-0091: update used to skip this, so a
+  // refreshed module silently lost its reconcile subscriptions).
+  // registerModuleSubscriptions is idempotent; best-effort like import:
+  // a bus problem shouldn't wedge the upgrade, but must be loud.
+  try {
+    const { registerModuleSubscriptions } = await import('../../services/module-subscriptions');
+    registerModuleSubscriptions(newManifest, installedPath);
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    log.warn(`  ${moduleId}: failed to register event-bus subscriptions: ${msg}`);
+    log.warn(
+      '  Module upgraded, but reactive flows on the event bus will not fire until this is fixed.',
+    );
+  }
+
+  if (!opts.quiet) {
+    log.success(`Upgraded ${moduleId} (${previousVersion} → ${newVersion})`);
+  }
+  return { status: 'success', moduleId, previousVersion, newVersion };
+}
+
+/**
+ * Handle module upgrade command
+ *
+ * @param args - Command arguments: [path, path, ...]
+ * @returns Command result
+ */
+export async function handleModuleUpdate(
+  args: string[],
+  flags: Record<string, string | boolean> = {},
+): Promise<CommandResult> {
+  const db = getDb();
+
+  // Zero args = registry sweep: walk every installed module, pick up
+  // any non-breaking update from the registry automatically, and
+  // prompt per-module for breaking (semver-major) updates.
+  if (args.length === 0) {
+    return runRegistrySweep(db, flags);
+  }
+
+  const results: UpdateOutcome[] = [];
+
+  for (const path of args) {
+    const result = await updateOne(path, db, flags);
+    results.push(result);
+  }
+
+  const succeeded = results.filter(
+    (r): r is Extract<UpdateOutcome, { status: 'success' }> => r.status === 'success',
+  );
+  const failed = results.filter(
+    (r): r is Extract<UpdateOutcome, { status: 'failed' }> => r.status === 'failed',
+  );
+  const skipped = results.filter(
+    (r): r is Extract<UpdateOutcome, { status: 'skipped' }> => r.status === 'skipped',
+  );
+
+  // Skips that fall under a wildcard expansion (e.g. modules/* picking
+  // up `modules/archive/`) shouldn't even be mentioned — they're not
+  // signal. Skips for "module not installed" ARE signal because the
+  // user explicitly named the path; surface those.
+  const meaningfulSkips = skipped.filter((r) => !r.reason.startsWith('not a module directory'));
+
+  if (failed.length > 0) {
+    const errors = failed.map((r) => `  ${r.moduleId}: ${r.error}`).join('\n');
+    const parts: string[] = [];
+    if (succeeded.length > 0) {
+      parts.push(
+        `Upgraded ${succeeded.length} module(s): ${succeeded.map((r) => r.moduleId).join(', ')}`,
+      );
+    }
+    if (meaningfulSkips.length > 0) {
+      const skipLines = meaningfulSkips.map((r) => `  ${r.moduleId}: ${r.reason}`).join('\n');
+      parts.push(`Skipped ${meaningfulSkips.length}:\n${skipLines}`);
+    }
+    parts.push(`Failed ${failed.length}:\n${errors}`);
+    return { success: false, error: parts.join('\n\n') };
+  }
+
+  const lines: string[] = [];
+  if (succeeded.length > 0) {
+    lines.push(
+      `Updated ${succeeded.length} module(s): ${succeeded.map((r) => r.moduleId).join(', ')}`,
+    );
+  }
+  if (meaningfulSkips.length > 0) {
+    const skipLines = meaningfulSkips.map((r) => `  ${r.moduleId}: ${r.reason}`).join('\n');
+    lines.push(`Skipped ${meaningfulSkips.length}:\n${skipLines}`);
+  }
+  if (lines.length === 0) {
+    // Every arg was a non-module sibling — odd but not a failure.
+    lines.push(
+      `No modules to update (${results.length} path(s) skipped — none had a manifest.yml)`,
+    );
+  }
+  return { success: true, message: lines.join('\n\n') };
+}
+
+interface UpdatePlan {
+  moduleId: string;
+  installedVersion: string;
+  targetVersion: string;
+  classification: Exclude<VersionChangeKind, 'up-to-date' | 'ahead'>;
+}
+
+/**
+ * Walk every installed module, query the registry, and produce a plan.
+ * Auto-apply non-breaking updates (patch/minor); prompt per-module for
+ * breaking (major) updates. Modules absent from the registry are
+ * surfaced as a skip — typically these are local-only modules the
+ * operator imported from a path, never published.
+ */
+async function runRegistrySweep(
+  db: ReturnType<typeof getDb>,
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  const installed = db.select().from(modules).all();
+  if (installed.length === 0) {
+    return { success: true, message: 'No modules installed.' };
+  }
+
+  const registryUrl = getFlag(flags, 'registry', '');
+  const client = new RegistryClient(registryUrl || undefined);
+
+  log.info(`Checking ${installed.length} installed module(s) against the registry…`);
+
+  const plans: UpdatePlan[] = [];
+  const upToDate: string[] = [];
+  const notInRegistry: string[] = [];
+  const errored: Array<{ moduleId: string; error: string }> = [];
+
+  for (const mod of installed) {
+    try {
+      const entries = await client.getIndex(mod.id);
+      if (entries.length === 0) {
+        notInRegistry.push(mod.id);
+        continue;
+      }
+      const latest = client.latestVersion(entries);
+      if (!latest) {
+        // All versions yanked.
+        notInRegistry.push(mod.id);
+        continue;
+      }
+      const cmp = classifyVersionChange(mod.version, latest.vers);
+      if (cmp === 'up-to-date' || cmp === 'ahead') {
+        upToDate.push(mod.id);
+        continue;
+      }
+      plans.push({
+        moduleId: mod.id,
+        installedVersion: mod.version,
+        targetVersion: latest.vers,
+        classification: cmp,
+      });
+    } catch (err) {
+      errored.push({
+        moduleId: mod.id,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
+  if (plans.length === 0) {
+    const lines: string[] = ['All installed modules are up to date.'];
+    if (notInRegistry.length > 0) {
+      lines.push(`Not in registry: ${notInRegistry.join(', ')}`);
+    }
+    if (errored.length > 0) {
+      lines.push(`Registry errors: ${errored.map((e) => `${e.moduleId} (${e.error})`).join('; ')}`);
+    }
+    return { success: true, message: lines.join('\n') };
+  }
+
+  const nonBreaking = plans.filter((p) => p.classification !== 'major');
+  const breaking = plans.filter((p) => p.classification === 'major');
+
+  let appliedNonBreaking = 0;
+  const failed: Array<{ moduleId: string; error: string }> = [];
+
+  if (nonBreaking.length > 0) {
+    log.info(`Auto-applying ${nonBreaking.length} non-breaking update(s):`);
+    for (const plan of nonBreaking) {
+      const result = await fetchAndUpdate(client, plan.moduleId, plan.targetVersion, db, flags);
+      if (result.status === 'failed') {
+        failed.push({ moduleId: plan.moduleId, error: result.error });
+        console.log(
+          `  ✗ ${plan.moduleId.padEnd(30)} ${plan.installedVersion} → ${plan.targetVersion}  (${plan.classification}, FAILED)`,
+        );
+      } else if (result.status === 'success') {
+        appliedNonBreaking++;
+        console.log(
+          `  ✓ ${plan.moduleId.padEnd(30)} ${result.previousVersion} → ${result.newVersion}  (${plan.classification})`,
+        );
+      }
+      // status === 'skipped' shouldn't happen for registry-fetched packages
+      // (we know the module is installed; the package definitely has a
+      // manifest), but treat it as a no-op if it does.
+    }
+  }
+
+  let appliedBreaking = 0;
+  let skippedBreaking = 0;
+
+  if (breaking.length > 0) {
+    log.info('\nBreaking updates available — review required (semver-major bump):');
+    for (const plan of breaking) {
+      console.log(
+        `  ⚠ ${plan.moduleId.padEnd(30)} ${plan.installedVersion} → ${plan.targetVersion}`,
+      );
+    }
+    log.message('Each breaking update will be applied only on explicit confirmation.\n');
+
+    for (const plan of breaking) {
+      const proceed = await withInterviewSession(() =>
+        askConfirm({
+          scope: `module-upgrade:${plan.moduleId}`,
+          key: 'apply_breaking',
+          message: `Apply breaking update for ${plan.moduleId} (${plan.installedVersion} → ${plan.targetVersion})?`,
+          defaultValue: false,
+        }),
+      );
+      if (!proceed) {
+        skippedBreaking++;
+        continue;
+      }
+      const result = await fetchAndUpdate(client, plan.moduleId, plan.targetVersion, db, flags);
+      if (result.status === 'failed') {
+        failed.push({ moduleId: plan.moduleId, error: result.error });
+        console.log(
+          `  ✗ ${plan.moduleId.padEnd(30)} ${plan.installedVersion} → ${plan.targetVersion}  (major, FAILED)`,
+        );
+      } else if (result.status === 'success') {
+        appliedBreaking++;
+        console.log(
+          `  ✓ ${plan.moduleId.padEnd(30)} ${result.previousVersion} → ${result.newVersion}  (major)`,
+        );
+      }
+    }
+  }
+
+  // Summary
+  const summary: string[] = [];
+  const totalApplied = appliedNonBreaking + appliedBreaking;
+  if (totalApplied > 0) {
+    const parts = [`${appliedNonBreaking} non-breaking`];
+    if (appliedBreaking > 0) parts.push(`${appliedBreaking} breaking`);
+    summary.push(`Applied ${totalApplied} update(s) (${parts.join(', ')}).`);
+  } else {
+    summary.push('No updates applied.');
+  }
+  if (skippedBreaking > 0) {
+    summary.push(`Skipped ${skippedBreaking} breaking update(s) (operator declined).`);
+  }
+  if (notInRegistry.length > 0) {
+    summary.push(`Not in registry (${notInRegistry.length}): ${notInRegistry.join(', ')}`);
+  }
+  if (errored.length > 0) {
+    summary.push(
+      `Registry errors (${errored.length}): ${errored.map((e) => `${e.moduleId} — ${e.error}`).join('; ')}`,
+    );
+  }
+  if (failed.length > 0) {
+    return {
+      success: false,
+      error: [
+        ...summary,
+        '',
+        'Failures:',
+        ...failed.map((f) => `  ${f.moduleId}: ${f.error}`),
+      ].join('\n'),
+    };
+  }
+  return { success: true, message: summary.join('\n') };
+}