@celilo/cli 0.9.1 → 0.11.0

package/src/api/serve.ts

@@ -0,0 +1,159 @@
+/**
+ * Remote API server — `celilo api-serve --principal=<id>` (Slices 1–3).
+ *
+ * Invoked as the sshd forced command for an enrolled key, so it starts already
+ * authenticated as `principal`. Reads `command`/`answer` messages as NDJSON on
+ * stdin/stdout, authorizes each command against the principal's grants
+ * (deny-by-default), and — if allowed — runs it as a child `celilo` process,
+ * translating the child's protocol-mode output into `progress`/`log` and a
+ * terminal `result`. While a command runs, a remote responder bridges the event
+ * bus to the wire so mid-run `interview`s are answered by the client. Every
+ * attempt is audited to stderr.
+ */
+
+import { createInterface } from 'node:readline';
+import { parseArguments } from '../cli/parser';
+import { getEventBusPath } from '../config/paths';
+import { isAuthorized } from '../services/api-access';
+import { type WireInterview, startRemoteResponder } from '../services/remote-responder';
+import {
+  API_PROTOCOL_VERSION,
+  ClientMessageSchema,
+  type ServerMessage,
+  translateOutputLine,
+} from './protocol';
+
+/** Exit code returned to the client when authz denies a command. */
+const EXIT_PERMISSION_DENIED = 126;
+
+function send(msg: ServerMessage): void {
+  process.stdout.write(`${JSON.stringify(msg)}\n`);
+}
+
+function audit(principal: string, op: string, decision: string, exitCode?: number): void {
+  const suffix = exitCode === undefined ? '' : ` exit=${exitCode}`;
+  process.stderr.write(
+    `[api-audit] principal=${principal} op=${op} decision=${decision}${suffix}\n`,
+  );
+}
+
+/** Derive the `command`/`subcommand` an argv would run, via the real parser. */
+function opOf(argv: string[]): { command: string; subcommand?: string; label: string } {
+  const parsed = parseArguments(['bun', 'celilo', ...argv]);
+  const label = parsed.subcommand ? `${parsed.command}:${parsed.subcommand}` : parsed.command;
+  return { command: parsed.command, subcommand: parsed.subcommand, label };
+}
+
+/** Drain a child stream line-by-line, forwarding each line as a message. */
+async function pumpLines(stream: ReadableStream<Uint8Array>): Promise<void> {
+  const decoder = new TextDecoder();
+  let buffer = '';
+  for await (const chunk of stream) {
+    buffer += decoder.decode(chunk, { stream: true });
+    let nl = buffer.indexOf('\n');
+    while (nl >= 0) {
+      const line = buffer.slice(0, nl);
+      buffer = buffer.slice(nl + 1);
+      send(translateOutputLine(line));
+      nl = buffer.indexOf('\n');
+    }
+  }
+  if (buffer.length > 0) {
+    send(translateOutputLine(buffer));
+  }
+}
+
+/** Run an authorized command as a child; returns its exit code. */
+async function runCommand(argv: string[]): Promise<number> {
+  // Re-invoke this same CLI as a child. The child is non-TTY (piped stdout) so
+  // ProgressDisplay resolves to protocol mode and emits `[progress:*]` markers.
+  const child = Bun.spawn([process.execPath, Bun.main, ...argv], {
+    stdin: 'ignore',
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+
+  await Promise.all([pumpLines(child.stdout), pumpLines(child.stderr)]);
+  const exitCode = await child.exited;
+  send({ type: 'result', success: exitCode === 0, exitCode });
+  return exitCode;
+}
+
+async function handleCommand(
+  principal: string,
+  argv: string[],
+  busDbPath: string,
+  ask: (interview: WireInterview) => Promise<unknown>,
+): Promise<void> {
+  const { command, subcommand, label } = opOf(argv);
+
+  if (!(await isAuthorized(principal, command, subcommand))) {
+    send({ type: 'error', error: `permission denied: "${principal}" is not granted "${label}"` });
+    send({ type: 'result', success: false, exitCode: EXIT_PERMISSION_DENIED });
+    audit(principal, label, 'deny');
+    return;
+  }
+
+  // Bridge the bus to the wire so mid-run interviews reach the client.
+  const responder = startRemoteResponder({ busDbPath, ask, emittedBy: `api:${principal}` });
+  try {
+    const exitCode = await runCommand(argv);
+    audit(principal, label, 'allow', exitCode);
+  } finally {
+    responder.close();
+  }
+}
+
+export async function apiServeMode(principal: string): Promise<void> {
+  send({ type: 'ready', protocolVersion: API_PROTOCOL_VERSION });
+
+  const busDbPath = getEventBusPath();
+  const pendingAnswers = new Map<string, (value: unknown) => void>();
+
+  const ask = (interview: WireInterview): Promise<unknown> =>
+    new Promise((resolve) => {
+      pendingAnswers.set(interview.id, resolve);
+      send({
+        type: 'interview',
+        id: interview.id,
+        kind: interview.kind,
+        message: interview.message,
+        description: interview.description,
+        defaultValue: interview.defaultValue,
+        placeholder: interview.placeholder,
+        options: interview.options,
+        required: interview.required,
+      });
+    });
+
+  const rl = createInterface({ input: process.stdin, terminal: false });
+
+  for await (const line of rl) {
+    if (!line.trim()) continue;
+
+    let msg: ReturnType<typeof ClientMessageSchema.parse>;
+    try {
+      msg = ClientMessageSchema.parse(JSON.parse(line));
+    } catch (error) {
+      send({ type: 'error', error: error instanceof Error ? error.message : String(error) });
+      continue;
+    }
+
+    if (msg.type === 'answer') {
+      const resolve = pendingAnswers.get(msg.id);
+      if (resolve) {
+        pendingAnswers.delete(msg.id);
+        resolve(msg.value);
+      }
+      continue;
+    }
+
+    if (msg.type === 'command') {
+      // Fire-and-forget so the read loop keeps consuming `answer` messages while
+      // the command runs — mid-run interviews are answered in-flight.
+      void handleCommand(principal, msg.argv, busDbPath, ask);
+    }
+  }
+
+  process.exit(0);
+}

package/src/cli/command-registry.ts

@@ -92,6 +92,51 @@ export const COMMANDS: CommandDef[] = [
       },
     ],
   },
+  {
+    name: 'api',
+    description: 'Manage remote-API access (principals, grants, authorized_keys)',
+    subcommands: [
+      {
+        name: 'grant',
+        description: 'Grant or replace API access for a principal',
+        args: [{ name: 'principal', description: 'Principal name (kebab-case)' }],
+        flags: [
+          {
+            name: 'key',
+            description: 'SSH public key, or path to a .pub file',
+            takesValue: true,
+            valueHint: '_files',
+          },
+          {
+            name: 'can',
+            description: 'Comma-separated grants (e.g. module:deploy,service:*)',
+            takesValue: true,
+          },
+        ],
+      },
+      { name: 'list', description: 'List API principals and their grants' },
+      {
+        name: 'revoke',
+        description: 'Revoke API access for a principal',
+        args: [{ name: 'principal', description: 'Principal name' }],
+      },
+      {
+        name: 'authorized-keys',
+        description: "Print the API account's authorized_keys (forced-command lines)",
+      },
+      {
+        name: 'key',
+        description: 'Client-side key management',
+        subcommands: [
+          {
+            name: 'new',
+            description: 'Generate a new API keypair and print enrollment steps',
+            args: [{ name: 'name', description: 'Principal name for the key' }],
+          },
+        ],
+      },
+    ],
+  },
   {
     name: 'events',
     description: 'SQLite event-bus operations (status, tail, run dispatcher, etc.)',

package/src/cli/commands/api.ts

@@ -0,0 +1,194 @@
+/**
+ * `celilo api ...` — manage remote-API principals (Slice 2a).
+ *
+ * grant / list / revoke operate on the api_principals table; authorized-keys
+ * renders the forced-command file for the API account. See v2/API_COMMUNICATION.md.
+ */
+
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import {
+  grantPrincipal,
+  listPrincipals,
+  renderAuthorizedKeys,
+  revokePrincipal,
+  validatePrincipalName,
+} from '../../services/api-access';
+import { celiloIntro } from '../prompts';
+import type { CommandResult } from '../types';
+
+function errMsg(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+/** `celilo api grant <principal> --key <pubkey|path> --can <grant[,grant...]>` */
+export async function handleApiGrant(
+  args: string[],
+  flags: Record<string, boolean | string> = {},
+): Promise<CommandResult> {
+  try {
+    const name = args[0];
+    if (!name) {
+      return {
+        success: false,
+        error: 'Usage: celilo api grant <principal> --key <pubkey|path> --can <grant[,grant...]>',
+      };
+    }
+
+    const keyArg = typeof flags.key === 'string' ? flags.key : '';
+    if (!keyArg) {
+      return {
+        success: false,
+        error: '--key <public-key-or-path> is required (e.g. ~/.ssh/id_ed25519.pub)',
+      };
+    }
+
+    const canArg = typeof flags.can === 'string' ? flags.can : '';
+    if (!canArg) {
+      return {
+        success: false,
+        error: '--can <grant[,grant...]> is required (e.g. --can module:deploy,service:*)',
+      };
+    }
+
+    const publicKey = existsSync(keyArg) ? readFileSync(keyArg, 'utf8').trim() : keyArg.trim();
+    const grants = canArg
+      .split(',')
+      .map((g) => g.trim())
+      .filter(Boolean);
+
+    const { principal, created } = await grantPrincipal({ name, publicKey, grants });
+
+    return {
+      success: true,
+      message: `${created ? 'Granted' : 'Updated'} API access for "${principal.name}" → ${grants.join(', ')}\n\nInstall the forced-command line on celilo-mgr with:\n  celilo api authorized-keys >> ~celilo-api/.ssh/authorized_keys`,
+    };
+  } catch (error) {
+    return { success: false, error: `Failed to grant API access: ${errMsg(error)}` };
+  }
+}
+
+/** `celilo api list` */
+export async function handleApiList(): Promise<CommandResult> {
+  try {
+    celiloIntro('API Principals');
+    const principals = await listPrincipals();
+
+    if (principals.length === 0) {
+      console.log('No API principals.\n');
+      console.log('Grant access:');
+      console.log('  celilo api grant <name> --key ~/.ssh/id_ed25519.pub --can module:deploy');
+      return { success: true, message: 'No API principals found' };
+    }
+
+    console.log('');
+    for (const p of principals) {
+      const parts = p.publicKey.split(/\s+/);
+      const keyType = parts[0] ?? '';
+      const comment = parts.length > 2 ? parts.slice(2).join(' ') : '';
+      console.log(`${p.name}`);
+      console.log(`  Grants: ${p.grants.join(', ') || '(none)'}`);
+      console.log(`  Key:    ${keyType}${comment ? ` (${comment})` : ''}`);
+      console.log('');
+    }
+
+    console.log(`Total: ${principals.length} principal${principals.length === 1 ? '' : 's'}\n`);
+    return { success: true, message: `Found ${principals.length} principal(s)` };
+  } catch (error) {
+    return { success: false, error: `Failed to list API principals: ${errMsg(error)}` };
+  }
+}
+
+/** `celilo api revoke <principal>` */
+export async function handleApiRevoke(args: string[]): Promise<CommandResult> {
+  try {
+    const name = args[0];
+    if (!name) {
+      return { success: false, error: 'Usage: celilo api revoke <principal>' };
+    }
+
+    const removed = await revokePrincipal(name);
+    if (!removed) {
+      return { success: false, error: `No API principal named "${name}".` };
+    }
+
+    return {
+      success: true,
+      message: `Revoked API access for "${name}".\n\nRe-render celilo-mgr's authorized_keys to drop the line:\n  celilo api authorized-keys > ~celilo-api/.ssh/authorized_keys`,
+    };
+  } catch (error) {
+    return { success: false, error: `Failed to revoke API access: ${errMsg(error)}` };
+  }
+}
+
+/** `celilo api authorized-keys` — print the forced-command file for the API account. */
+export async function handleApiAuthorizedKeys(): Promise<CommandResult> {
+  try {
+    const content = await renderAuthorizedKeys();
+    return { success: true, message: content, rawOutput: true };
+  } catch (error) {
+    return { success: false, error: `Failed to render authorized_keys: ${errMsg(error)}` };
+  }
+}
+
+/** `celilo api key new <name>` — generate a client-side keypair for API access. */
+export async function handleApiKeyNew(args: string[]): Promise<CommandResult> {
+  try {
+    const name = args[0];
+    if (!name) {
+      return { success: false, error: 'Usage: celilo api key new <name>' };
+    }
+    validatePrincipalName(name);
+
+    // Prefer $HOME (operator shell always sets it, and it's test-controllable);
+    // homedir() is the fallback for the rare unset case.
+    const keyPath = join(process.env.HOME || homedir(), '.ssh', `celilo-api-${name}`);
+    if (existsSync(keyPath) || existsSync(`${keyPath}.pub`)) {
+      return {
+        success: false,
+        error: `A key already exists at ${keyPath}. Remove it or choose another name.`,
+      };
+    }
+
+    mkdirSync(dirname(keyPath), { recursive: true, mode: 0o700 });
+
+    const gen = Bun.spawnSync([
+      'ssh-keygen',
+      '-t',
+      'ed25519',
+      '-N',
+      '',
+      '-C',
+      `celilo-api-${name}`,
+      '-f',
+      keyPath,
+    ]);
+    if (gen.exitCode !== 0) {
+      return {
+        success: false,
+        error: `ssh-keygen failed: ${gen.stderr.toString().trim() || `exit ${gen.exitCode}`}`,
+      };
+    }
+
+    const pubkey = readFileSync(`${keyPath}.pub`, 'utf8').trim();
+    return {
+      success: true,
+      message: [
+        `Generated API keypair for "${name}":`,
+        `  private: ${keyPath}  (keep secret — never share)`,
+        `  public:  ${keyPath}.pub`,
+        '',
+        `Public key: ${pubkey}`,
+        '',
+        'Enroll the public key on celilo-mgr:',
+        `  celilo api grant ${name} --key ${keyPath}.pub --can module:deploy`,
+        '',
+        'Then run commands remotely (configure a Host alias in ~/.ssh/config as needed):',
+        '  celilo --remote celilo-api@celilo-mgr <command>',
+      ].join('\n'),
+    };
+  } catch (error) {
+    return { success: false, error: `Failed to generate API key: ${errMsg(error)}` };
+  }
+}

package/src/cli/commands/publish/helpers.ts

@@ -125,6 +125,24 @@ export function readExternalProjectPaths(): string[] {
   return [];
 }
 
+/**
+ * Read `NPM_PUBLISH_TARGET` from .env — the registry URL `celilo publish`
+ * points `bun publish --registry` at for @celilo/* packages (a deployed
+ * npm-cache-node). Unset → publish to npmjs (current behavior). See
+ * v2/NPM_CACHE_NODE.md Phase 3.1 / v2/PUBLILO_CLI.md decision 10.
+ */
+export function readNpmPublishTarget(): string | null {
+  if (!existsSync(ENV_FILE)) return null;
+  const content = readFileSync(ENV_FILE, 'utf-8');
+  for (const line of content.split('\n')) {
+    const m = line.match(/^\s*NPM_PUBLISH_TARGET\s*=\s*(.+?)\s*$/);
+    if (!m) continue;
+    const raw = m[1].replace(/^["']|["']$/g, '').trim();
+    return raw || null;
+  }
+  return null;
+}
+
 /**
  * Recursively find every package.json under a root, skipping
  * node_modules and common build-output dirs (so we don't try to rewrite

package/src/cli/commands/publish/types.ts

@@ -139,15 +139,13 @@ export interface RewriteOptions {
 }
 
 /**
- * Per-package pre-publish work. Currently only `@celilo/e2e` triggers
- * any of these (it ships netapps + registry server + caches inside its
- * tarball), but the plan still enumerates them so dry-run can show
- * what extra work the publish entails.
+ * Per-package pre-publish work. Currently only `@celilo/e2e` triggers this
+ * (it bundles the npm-compat registry server source inside its tarball).
+ * Sim-content caches (website/npm) and standard-module netapps are NOT
+ * bundled at publish — they're fetched from the public celilo sources at
+ * `cele2e build-infra` time instead (ce-qwz Decisions 2B + 3, ce-i2i).
  */
-export type PrePublishHookKind =
-  | 'registryServerBundle'
-  | 'rebuildE2eNetapps'
-  | 'stageE2ePublishCaches';
+export type PrePublishHookKind = 'registryServerBundle';
 
 /**
  * Single workspace package planned to publish (or explicitly skip) in

package/src/cli/commands/publish/workspace.test.ts

@@ -57,6 +57,7 @@ mock.module('./helpers', () => ({
   },
   listModuleDirs: () => [],
   readExternalProjectPaths: () => [],
+  readNpmPublishTarget: () => null,
   findPackageJsons: () => [],
   bareVersion: (s: string) => s.replace(/^[\s^~=><]+/, '').trim(),
   withOperator: (oldSpec: string, newVersion: string) => {
@@ -74,6 +75,10 @@ mock.module('./alpha', () => ({
     return { name: spec.slice(0, i), version: spec.slice(i + 1) };
   },
   stripAlphaSuffix: (v: string) => v.replace(/-alpha\.\d+$/, ''),
+  prereleaseDistTag: (v: string) => {
+    const dash = v.indexOf('-');
+    return dash === -1 ? undefined : v.slice(dash + 1).split('.')[0] || undefined;
+  },
   isAlphaVersion: (v: string) => /-alpha\.\d+$/.test(v),
   nextAlphaNumber: (name: string, semverCore: string) =>
     nextAlphaResponses[`${name}@${semverCore}`] ?? 0,
@@ -84,7 +89,7 @@ mock.module('./alpha', () => ({
   decideAlphaSkip: () => ({ skip: false }),
 }));
 
-const { planWorkspace } = await import('./workspace');
+const { planWorkspace, buildPublishArgs } = await import('./workspace');
 
 function buildBaseMap(): Map<string, string> {
   const m = new Map<string, string>();
@@ -131,7 +136,7 @@ describe('planWorkspace', () => {
       expect(cli?.skipReason).toBeUndefined();
     });
 
-    test('e2e gets the registry-bundle + netapps + cache hooks', () => {
+    test('e2e gets only the registry-bundle hook (caches/netapps fetched at build-infra, not bundled)', () => {
       publishedSet = new Set();
       const result = planWorkspace({
         mode: { kind: 'normal' },
@@ -141,11 +146,7 @@ describe('planWorkspace', () => {
       });
 
       const e2e = result.items.find((i) => i.pkg === 'packages/e2e');
-      expect(e2e?.hooks).toEqual([
-        'registryServerBundle',
-        'rebuildE2eNetapps',
-        'stageE2ePublishCaches',
-      ]);
+      expect(e2e?.hooks).toEqual(['registryServerBundle']);
       const cli = result.items.find((i) => i.pkg === 'apps/celilo');
       expect(cli?.hooks).toEqual([]);
     });
@@ -302,6 +303,42 @@ describe('planWorkspace', () => {
     });
   });
 
+  describe('buildPublishArgs registry target', () => {
+    test('no target → default registry (unchanged behavior)', () => {
+      expect(buildPublishArgs({ name: '@celilo/cli', tag: undefined }, null)).toEqual([
+        'publish',
+        '--access',
+        'public',
+      ]);
+    });
+
+    test('target set → --registry appended for @celilo/* package', () => {
+      expect(
+        buildPublishArgs({ name: '@celilo/cli', tag: undefined }, 'https://npm.example.test/'),
+      ).toEqual(['publish', '--access', 'public', '--registry', 'https://npm.example.test/']);
+    });
+
+    test('tag and registry both present', () => {
+      expect(
+        buildPublishArgs({ name: '@celilo/cli', tag: 'alpha' }, 'https://npm.example.test/'),
+      ).toEqual([
+        'publish',
+        '--access',
+        'public',
+        '--tag',
+        'alpha',
+        '--registry',
+        'https://npm.example.test/',
+      ]);
+    });
+
+    test('non-@celilo package never gets the private registry', () => {
+      expect(
+        buildPublishArgs({ name: 'some-other-pkg', tag: undefined }, 'https://npm.example.test/'),
+      ).toEqual(['publish', '--access', 'public']);
+    });
+  });
+
   describe('dependency order', () => {
     test('preserves PACKAGES order in planned items', () => {
       publishedSet = new Set();