@celilo/cli 0.9.0 → 0.10.0

package/src/cli/validators.test.ts

@@ -3,149 +3,7 @@
  */
 
 import { describe, expect, test } from 'bun:test';
-import {
-  validateDomain,
-  validateEmail,
-  validateIpAddress,
-  validateIpAddressList,
-  validateProxmoxUrl,
-  validateRequired,
-  validateRequiredNoDefault,
-  validateSubnet,
-} from './validators';
-
-describe('validateProxmoxUrl', () => {
-  test('accepts valid HTTPS URL with port', () => {
-    expect(validateProxmoxUrl('https://proxmox.example.com:8006')).toBeUndefined();
-    expect(validateProxmoxUrl('https://192.168.1.100:8006')).toBeUndefined();
-  });
-
-  test('rejects non-HTTPS URLs', () => {
-    expect(validateProxmoxUrl('http://proxmox.example.com:8006')).toBe(
-      'URL must start with https://',
-    );
-  });
-
-  test('rejects URLs without port', () => {
-    expect(validateProxmoxUrl('https://proxmox.example.com')).toBe(
-      'URL must include port (e.g., :8006)',
-    );
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateProxmoxUrl(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateProxmoxUrl('')).toBe('URL is required');
-    expect(validateProxmoxUrl('   ')).toBe('URL is required');
-  });
-
-  test('rejects invalid URLs', () => {
-    expect(validateProxmoxUrl('https://:8006')).toBe('Invalid URL format');
-    expect(validateProxmoxUrl('not-a-url')).toBe('URL must start with https://');
-  });
-});
-
-describe('validateSubnet', () => {
-  test('accepts valid CIDR notation', () => {
-    expect(validateSubnet('10.0.10.0/24')).toBeUndefined();
-    expect(validateSubnet('192.168.1.0/16')).toBeUndefined();
-    expect(validateSubnet('172.16.0.0/12')).toBeUndefined();
-  });
-
-  test('rejects invalid CIDR format', () => {
-    expect(validateSubnet('10.0.10.0')).toBe('Subnet must be in CIDR format (e.g., 10.0.10.0/24)');
-    expect(validateSubnet('10.0.10/24')).toBe('Subnet must be in CIDR format (e.g., 10.0.10.0/24)');
-  });
-
-  test('rejects invalid IP octets', () => {
-    expect(validateSubnet('256.0.10.0/24')).toBe('Invalid IP address (octets must be 0-255)');
-    expect(validateSubnet('10.300.10.0/24')).toBe('Invalid IP address (octets must be 0-255)');
-  });
-
-  test('rejects invalid prefix', () => {
-    expect(validateSubnet('10.0.10.0/33')).toBe('Invalid prefix length (must be 0-32)');
-    expect(validateSubnet('10.0.10.0/-1')).toBe('Invalid prefix length (must be 0-32)');
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateSubnet(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateSubnet('')).toBe('Subnet is required');
-  });
-});
-
-describe('validateDomain', () => {
-  test('accepts valid domains', () => {
-    expect(validateDomain('homelab.local')).toBeUndefined();
-    expect(validateDomain('example.com')).toBeUndefined();
-    expect(validateDomain('sub.domain.co.uk')).toBeUndefined();
-  });
-
-  test('rejects invalid domain format', () => {
-    expect(validateDomain('not-a-domain')).toBe('Invalid domain format (e.g., homelab.local)');
-    expect(validateDomain('.example.com')).toBe('Invalid domain format (e.g., homelab.local)');
-    expect(validateDomain('example..com')).toBe('Invalid domain format (e.g., homelab.local)');
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateDomain(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateDomain('')).toBe('Domain is required');
-  });
-});
-
-describe('validateEmail', () => {
-  test('accepts valid emails', () => {
-    expect(validateEmail('admin@example.com')).toBeUndefined();
-    expect(validateEmail('user.name@domain.co.uk')).toBeUndefined();
-  });
-
-  test('rejects invalid email format', () => {
-    expect(validateEmail('not-an-email')).toBe('Invalid email format');
-    expect(validateEmail('@example.com')).toBe('Invalid email format');
-    expect(validateEmail('user@')).toBe('Invalid email format');
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateEmail(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateEmail('')).toBe('Email is required');
-  });
-});
-
-describe('validateIpAddress', () => {
-  test('accepts valid IP addresses', () => {
-    expect(validateIpAddress('1.1.1.1')).toBeUndefined();
-    expect(validateIpAddress('192.168.1.100')).toBeUndefined();
-    expect(validateIpAddress('10.0.0.1')).toBeUndefined();
-  });
-
-  test('rejects invalid IP format', () => {
-    expect(validateIpAddress('not-an-ip')).toBe('Invalid IP format (e.g., 1.1.1.1)');
-    expect(validateIpAddress('192.168.1')).toBe('Invalid IP format (e.g., 1.1.1.1)');
-  });
-
-  test('rejects invalid octets', () => {
-    expect(validateIpAddress('256.1.1.1')).toBe('Invalid IP address (octets must be 0-255)');
-    expect(validateIpAddress('192.168.1.300')).toBe('Invalid IP address (octets must be 0-255)');
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateIpAddress(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateIpAddress('')).toBe('IP address is required');
-  });
-});
+import { validateRequired } from './validators';
 
 describe('validateRequired', () => {
   test('accepts non-empty strings', () => {
@@ -170,66 +28,3 @@ describe('validateRequired', () => {
     expect(validator('')).toBe('Custom field is required');
   });
 });
-
-describe('validateRequiredNoDefault', () => {
-  test('accepts non-empty strings', () => {
-    const validator = validateRequiredNoDefault('Password');
-    expect(validator('value')).toBeUndefined();
-    expect(validator('  text  ')).toBeUndefined();
-  });
-
-  test('rejects undefined (no default values)', () => {
-    const validator = validateRequiredNoDefault('Password');
-    expect(validator(undefined)).toBe('Password is required');
-  });
-
-  test('rejects empty strings', () => {
-    const validator = validateRequiredNoDefault('Password');
-    expect(validator('')).toBe('Password is required');
-    expect(validator('   ')).toBe('Password is required');
-  });
-
-  test('uses custom field name in error message', () => {
-    const validator = validateRequiredNoDefault('Custom password');
-    expect(validator('')).toBe('Custom password is required');
-  });
-});
-
-describe('validateIpAddressList', () => {
-  test('accepts single IP address', () => {
-    expect(validateIpAddressList('1.1.1.1')).toBeUndefined();
-    expect(validateIpAddressList('192.168.1.100')).toBeUndefined();
-  });
-
-  test('accepts space-separated IP addresses', () => {
-    expect(validateIpAddressList('8.8.8.8 1.1.1.1')).toBeUndefined();
-    expect(validateIpAddressList('192.168.0.1 10.0.0.1 1.1.1.1')).toBeUndefined();
-  });
-
-  test('accepts multiple spaces between IPs', () => {
-    expect(validateIpAddressList('8.8.8.8  1.1.1.1')).toBeUndefined();
-    expect(validateIpAddressList('1.1.1.1   8.8.8.8   1.0.0.1')).toBeUndefined();
-  });
-
-  test('rejects comma-separated IPs', () => {
-    expect(validateIpAddressList('1.1.1.1,8.8.8.8')).toContain('Invalid IP address');
-  });
-
-  test('rejects invalid IP in list', () => {
-    expect(validateIpAddressList('8.8.8.8 999.999.999.999')).toContain(
-      "Invalid IP address '999.999.999.999'",
-    );
-    expect(validateIpAddressList('192.168.0.1 not-an-ip')).toContain(
-      "Invalid IP address 'not-an-ip'",
-    );
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateIpAddressList(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateIpAddressList('')).toBe('At least one IP address is required');
-    expect(validateIpAddressList('   ')).toBe('At least one IP address is required');
-  });
-});

package/src/cli/validators.ts

@@ -3,137 +3,6 @@
  * Validation functions for interactive prompts
  */
 
-/**
- * Validate URL format (must start with https:// and include port)
- */
-export function validateProxmoxUrl(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'URL is required';
-  }
-
-  if (!value.startsWith('https://')) {
-    return 'URL must start with https://';
-  }
-
-  if (!value.includes(':') || !value.match(/:\d+/)) {
-    return 'URL must include port (e.g., :8006)';
-  }
-
-  // Basic URL validation
-  try {
-    new URL(value);
-  } catch {
-    return 'Invalid URL format';
-  }
-}
-
-/**
- * Validate subnet CIDR notation (e.g., 10.0.10.0/24)
- */
-export function validateSubnet(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'Subnet is required';
-  }
-
-  // Check CIDR format: IP/prefix
-  const cidrPattern = /^(\d{1,3}\.){3}\d{1,3}\/(.+)$/;
-  if (!cidrPattern.test(value)) {
-    return 'Subnet must be in CIDR format (e.g., 10.0.10.0/24)';
-  }
-
-  // Validate IP octets (0-255)
-  const [ip, prefix] = value.split('/');
-  const octets = ip.split('.').map(Number);
-
-  for (const octet of octets) {
-    if (octet < 0 || octet > 255) {
-      return 'Invalid IP address (octets must be 0-255)';
-    }
-  }
-
-  // Validate prefix (0-32)
-  const prefixNum = Number(prefix);
-  if (prefixNum < 0 || prefixNum > 32) {
-    return 'Invalid prefix length (must be 0-32)';
-  }
-}
-
-/**
- * Validate domain name format
- */
-export function validateDomain(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'Domain is required';
-  }
-
-  // Basic domain format: lowercase, alphanumeric, hyphens, dots
-  const domainPattern = /^[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,}$/i;
-  if (!domainPattern.test(value)) {
-    return 'Invalid domain format (e.g., homelab.local)';
-  }
-}
-
-/**
- * Validate email format
- */
-export function validateEmail(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'Email is required';
-  }
-
-  const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-  if (!emailPattern.test(value)) {
-    return 'Invalid email format';
-  }
-}
-
-/**
- * Validate IP address format
- */
-export function validateIpAddress(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'IP address is required';
-  }
-
-  const ipPattern = /^(\d{1,3}\.){3}\d{1,3}$/;
-  if (!ipPattern.test(value)) {
-    return 'Invalid IP format (e.g., 1.1.1.1)';
-  }
-
-  // Validate octets (0-255)
-  const octets = value.split('.').map(Number);
-  for (const octet of octets) {
-    if (octet < 0 || octet > 255) {
-      return 'Invalid IP address (octets must be 0-255)';
-    }
-  }
-}
-
 /**
  * Validate non-empty string (allows undefined for prompts with default values)
  */
@@ -149,40 +18,3 @@ export function validateRequired(fieldName: string) {
     }
   };
 }
-
-/**
- * Validate required field with no defaults (for password fields)
- */
-export function validateRequiredNoDefault(fieldName: string) {
-  return (value: string | undefined): string | Error | undefined => {
-    // Reject undefined - no default value for this field
-    if (value === undefined || !value.trim()) {
-      return `${fieldName} is required`;
-    }
-  };
-}
-
-/**
- * Validate space-separated list of IP addresses
- */
-export function validateIpAddressList(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'At least one IP address is required';
-  }
-
-  // Split by spaces (any amount of whitespace)
-  const ips = value.trim().split(/\s+/);
-
-  // Validate each IP
-  for (const ip of ips) {
-    const error = validateIpAddress(ip);
-    if (error) {
-      return `Invalid IP address '${ip}': ${error}`;
-    }
-  }
-}

package/src/services/aspect-approvals.test.ts

@@ -247,5 +247,57 @@ describe('aspect-approvals', () => {
       const status = checkAspectApproval('knot-unbound-internal', '1.0.0', newAspect, db);
       expect(status).toBe('scope_changed');
     });
+
+    // #262 — scope-keyed carry-forward across versions. The ISS-0156 cutover
+    // hung because consent was recorded at the imported version, then a
+    // `module update` bumped the version and the deploy re-prompted (no row for
+    // the new version) — and nothing answered the prompt. Per D7, only a SCOPE
+    // change requires re-consent; a pure version bump must not.
+    it('carries approval forward to a bumped version with the SAME scope (#262 — no re-prompt)', () => {
+      insertModule('technitium', '1.0.2+4');
+      const db = getDb();
+      recordAspectApproval({
+        moduleId: 'technitium',
+        version: '1.0.2+4',
+        scopeHash: computeAspectScopeHash(baseAspect),
+        approver: null,
+        db,
+      });
+      // `module update` bumped +4 → +6; aspect scope unchanged.
+      expect(checkAspectApproval('technitium', '1.0.2+6', baseAspect, db)).toBe('approved');
+    });
+
+    it('carries a DENIAL forward to a bumped version with the same scope', () => {
+      insertModule('technitium', '1.0.2+4');
+      const db = getDb();
+      recordAspectConsent({
+        moduleId: 'technitium',
+        version: '1.0.2+4',
+        scopeHash: computeAspectScopeHash(baseAspect),
+        approver: null,
+        consented: false,
+        db,
+      });
+      expect(checkAspectApproval('technitium', '1.0.2+6', baseAspect, db)).toBe('denied');
+    });
+
+    it('does NOT carry forward to a bumped version when the scope changed', () => {
+      insertModule('technitium', '1.0.2+4');
+      const db = getDb();
+      recordAspectApproval({
+        moduleId: 'technitium',
+        version: '1.0.2+4',
+        scopeHash: computeAspectScopeHash(baseAspect),
+        approver: null,
+        db,
+      });
+      const narrowed: BaseModuleAspect = {
+        ansible_role: 'dns-client-config',
+        applicable_zones: ['dmz'],
+        triggers: ['on_install'],
+      };
+      // Bumped version AND narrowed scope → no exact row, no scope match → re-prompt.
+      expect(checkAspectApproval('technitium', '1.0.2+6', narrowed, db)).toBe('no_approval');
+    });
   });
 });

package/src/services/aspect-approvals.ts

@@ -21,7 +21,7 @@
  */
 
 import { createHash, randomUUID } from 'node:crypto';
-import { and, eq, sql } from 'drizzle-orm';
+import { and, desc, eq, sql } from 'drizzle-orm';
 import type { getDb } from '../db/client';
 import { aspectApprovals } from '../db/schema';
 import type { BaseModuleAspect } from '../manifest/schema';
@@ -65,6 +65,26 @@ export function findAspectApproval(
     .get();
 }
 
+/**
+ * Find the most recent consent row for a (moduleId, scopeHash) pair across ALL
+ * versions. Used to carry an operator's decision forward when a module version
+ * bump leaves the aspect scope (applicable_zones + triggers) unchanged — so a
+ * `module update` auto-revision doesn't force re-consent (#262). The latest
+ * decision (by approvedAt) for that scope wins.
+ */
+export function findAspectApprovalByScope(
+  moduleId: string,
+  scopeHash: string,
+  db: DbClient,
+): typeof aspectApprovals.$inferSelect | undefined {
+  return db
+    .select()
+    .from(aspectApprovals)
+    .where(and(eq(aspectApprovals.moduleId, moduleId), eq(aspectApprovals.scopeHash, scopeHash)))
+    .orderBy(desc(aspectApprovals.approvedAt))
+    .get();
+}
+
 /**
  * Record the operator's consent DECISION for a module version's
  * base-module aspect — `consented: true` (approve) or `false`
@@ -132,9 +152,17 @@ export function recordAspectApproval(args: {
  *   - 'approved': a matching-scope row with `consented: true` — run.
  *   - 'denied': a matching-scope row with `consented: false` — the
  *     operator explicitly refused (ISS-0027). Skip; do NOT re-prompt.
- *   - 'scope_changed': a row exists but the manifest's scope differs
- *     (D7 — the prior decision was about a different scope; re-prompt).
- *   - 'no_approval': no row for this version — undecided; prompt.
+ *   - 'scope_changed': a row exists for THIS version but the manifest's scope
+ *     differs (D7 — the prior decision was about a different scope; re-prompt).
+ *   - 'no_approval': no row for this version AND no prior decision for this
+ *     scope at any version — undecided; prompt.
+ *
+ * #262: when there's no row for the exact version, the operator's decision is
+ * carried forward by SCOPE. A pure version bump (e.g. a `module update`
+ * auto-revision) that leaves applicable_zones + triggers unchanged must NOT
+ * re-prompt — that re-prompt, unanswerable headlessly, is what hung the
+ * ISS-0156 cutover. A genuine scope change has a different scopeHash, so it
+ * finds no match and correctly falls through to 'no_approval'.
  */
 export function checkAspectApproval(
   moduleId: string,
@@ -142,9 +170,14 @@ export function checkAspectApproval(
   aspect: BaseModuleAspect,
   db: DbClient,
 ): 'approved' | 'denied' | 'scope_changed' | 'no_approval' {
-  const existing = findAspectApproval(moduleId, version, db);
-  if (!existing) return 'no_approval';
   const currentHash = computeAspectScopeHash(aspect);
-  if (existing.scopeHash !== currentHash) return 'scope_changed';
-  return existing.consented ? 'approved' : 'denied';
+  const exact = findAspectApproval(moduleId, version, db);
+  if (exact) {
+    if (exact.scopeHash !== currentHash) return 'scope_changed';
+    return exact.consented ? 'approved' : 'denied';
+  }
+  // No row for this exact version — carry the decision forward by scope (#262).
+  const byScope = findAspectApprovalByScope(moduleId, currentHash, db);
+  if (byScope) return byScope.consented ? 'approved' : 'denied';
+  return 'no_approval';
 }

package/src/services/programmatic-responder.aspect.test.ts

@@ -0,0 +1,157 @@
+/**
+ * Regression: the programmatic responder (`celilo events respond`) must handle
+ * `aspect.required.*` so a HEADLESS deploy of a module with a base_module_aspect
+ * can be approved without a TTY.
+ *
+ * Before the fix it watched only config/secret/ensure/interview — never aspect —
+ * so a headless deploy whose aspect consent wasn't pre-recorded emitted
+ * `aspect.required.<m>.<role>` and hung forever (busInterview uses timeoutMs:0;
+ * no responder ever replied). This reproduced the ISS-0156 cutover hang and is
+ * the core of #262.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { defineEvents, openBus } from '@celilo/event-bus';
+import { closeDb, getDb } from '../db/client';
+import { runMigrations } from '../db/migrate';
+import { type AspectRequiredPayload, EVENT_TYPES } from './bus-interview';
+import { startProgrammaticResponder } from './programmatic-responder';
+
+const NO_SCHEMAS = defineEvents({});
+
+const ASPECT_PAYLOAD: AspectRequiredPayload = {
+  module: 'technitium',
+  role: 'dns-client-config',
+  zones: ['dmz', 'app', 'secure', 'internal'],
+  triggers: ['on_install'],
+  trigger: 'on_install',
+  reason: 'no_approval',
+};
+
+/** Emit the aspect-consent query and return the responder's decision, or null. */
+async function askAspectConsent(
+  busPath: string,
+  module: string,
+  role: string,
+  payload: AspectRequiredPayload,
+): Promise<boolean | null> {
+  const bus = openBus({ dbPath: busPath, events: NO_SCHEMAS });
+  try {
+    const replies = await bus.query(
+      EVENT_TYPES.aspectRequired(module, role) as never,
+      payload as never,
+      {
+        timeoutMs: 3000,
+        pollIntervalMs: 100,
+        expect: 'first',
+      },
+    );
+    if (replies.length === 0) return null;
+    return (replies[0].payload as { consented?: boolean }).consented ?? null;
+  } finally {
+    bus.close();
+  }
+}
+
+describe('programmatic responder — aspect.required consent (#262)', () => {
+  let dir: string;
+  let busPath: string;
+  let db: ReturnType<typeof getDb>;
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-resp-aspect-'));
+    process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
+    busPath = join(dir, 'bus.db');
+    await runMigrations(process.env.CELILO_DB_PATH);
+    db = getDb();
+  });
+
+  afterEach(() => {
+    closeDb();
+    rmSync(dir, { recursive: true, force: true });
+    process.env.CELILO_DB_PATH = undefined;
+  });
+
+  it('approves (consented=true) when the policy approves the module', async () => {
+    const handle = startProgrammaticResponder({
+      busDbPath: busPath,
+      db,
+      onMissing: 'skip',
+      values: { aspects: { technitium: true } },
+    });
+    try {
+      const decision = await askAspectConsent(
+        busPath,
+        'technitium',
+        'dns-client-config',
+        ASPECT_PAYLOAD,
+      );
+      expect(decision).toBe(true);
+    } finally {
+      handle.close();
+    }
+  });
+
+  it("approves via the '*' wildcard policy", async () => {
+    const handle = startProgrammaticResponder({
+      busDbPath: busPath,
+      db,
+      onMissing: 'skip',
+      values: { aspects: { '*': true } },
+    });
+    try {
+      const decision = await askAspectConsent(
+        busPath,
+        'technitium',
+        'dns-client-config',
+        ASPECT_PAYLOAD,
+      );
+      expect(decision).toBe(true);
+    } finally {
+      handle.close();
+    }
+  });
+
+  it('refuses (consented=false) when the policy denies the module', async () => {
+    const handle = startProgrammaticResponder({
+      busDbPath: busPath,
+      db,
+      onMissing: 'skip',
+      values: { aspects: { technitium: false } },
+    });
+    try {
+      const decision = await askAspectConsent(
+        busPath,
+        'technitium',
+        'dns-client-config',
+        ASPECT_PAYLOAD,
+      );
+      expect(decision).toBe(false);
+    } finally {
+      handle.close();
+    }
+  });
+
+  it('does not reply when no aspect policy is provided (onMissing: skip)', async () => {
+    const handle = startProgrammaticResponder({
+      busDbPath: busPath,
+      db,
+      onMissing: 'skip',
+      values: {},
+    });
+    try {
+      const decision = await askAspectConsent(
+        busPath,
+        'technitium',
+        'dns-client-config',
+        ASPECT_PAYLOAD,
+      );
+      expect(decision).toBeNull();
+    } finally {
+      handle.close();
+    }
+  });
+});