@celilo/cli 1.6.0 → 1.7.0

package/src/cli/commands/module-remove.ts

@@ -15,6 +15,7 @@ import { createGaugeLogger } from '../../hooks/logger';
 import { runNamedHook } from '../../hooks/run-named-hook';
 import { deallocateForModule } from '../../ipam/auto-allocator';
 import { type ModuleManifest, ModuleManifestSchema } from '../../manifest/schema';
+import { deleteMonitorForModule } from '../../services/alerting/monitors';
 import { executeBuildWithProgress } from '../../services/build-stream';
 import { askConfirm, withInterviewSession } from '../../services/bus-interview';
 import {
@@ -22,7 +23,11 @@ import {
   emitUninstallFailed,
   emitUninstallStarted,
 } from '../../services/celilo-events';
-import { loadConsumerCleanupPlan, runConsumerCleanup } from '../../services/consumer-cleanup';
+import {
+  PRE_DEPLOY_STATES,
+  loadConsumerCleanupPlan,
+  runConsumerCleanup,
+} from '../../services/consumer-cleanup';
 import { getContainerService, getServiceCredentials } from '../../services/container-service';
 import { completeOperation, failOperation, startOperation } from '../../services/module-operations';
 import {
@@ -97,7 +102,7 @@ export async function handleModuleRemove(
         id: m.id,
         manifest: parsed.data,
         paused: m.state === 'PAUSED',
-        deployed: !(['IMPORTED', 'VALIDATED', 'CONFIGURED'] as string[]).includes(m.state),
+        deployed: !PRE_DEPLOY_STATES.has(m.state),
       });
     }
 
@@ -403,6 +408,33 @@ async function performModuleRemove(
     log.warn(`Failed to unregister event-bus subscriptions: ${msg}`);
   }
 
+  // Drop the module's health monitor. No cascade can reach it — `monitors.target`
+  // holds a module id or an audit check name depending on `kind`, so the column
+  // carries no foreign key (celilo#1029). Left behind, the monitor fires
+  // `Module not found` and then becomes permanently unschedulable, because its
+  // cadence resolves from a module row that no longer exists — so nothing ever
+  // runs it again to resolve the alert it just raised.
+  //
+  // What it was holding is named, not just counted. The alerts are deleted with
+  // it (cascade), so a firing check goes silent and the coverage of it goes at
+  // the same moment — an operator who is told only `removed monitor` never
+  // learns which real failure just stopped being reported.
+  try {
+    const droppedAlerts = deleteMonitorForModule(db, moduleId);
+    if (droppedAlerts) {
+      log.info(`Removed health monitor for ${moduleId}`);
+      for (const alert of droppedAlerts) {
+        log.warn(`  dropped live alert ${alert.key}: ${alert.message}`);
+      }
+      if (droppedAlerts.length > 0) {
+        log.warn(`  nothing checks ${moduleId} any more, so this will not be reported again.`);
+      }
+    }
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    log.warn(`Failed to remove health monitor for ${moduleId}: ${msg}`);
+  }
+
   // Delete module (cascade will remove configs, secrets, capabilities, infrastructure records)
   db.delete(modules).where(eq(modules.id, moduleId)).run();
 

package/src/cli/commands/module-update.test.ts

@@ -5,12 +5,21 @@
  */
 
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, relative } from 'node:path';
 import { eq } from 'drizzle-orm';
 import { type DbClient, getDb } from '../../db/client';
-import { modules } from '../../db/schema';
+import { moduleIntegrity, modules } from '../../db/schema';
 import { classifyVersionChange, handleModuleUpdate, updateOne } from './module-update';
 
 describe('classifyVersionChange', () => {
@@ -409,3 +418,141 @@ description: fixture
     expect(snapshot(installedDir)).toEqual(before);
   });
 });
+
+/**
+ * celilo#1008. `updateOne` copied the new tree onto the installed one in
+ * place, so a copy that died partway left a module half old and half new,
+ * with no record anywhere of which files were which. Jeremy Banka's
+ * `f9a57f1b` staged into a sibling and swapped with two renames; the rest of
+ * that commit is superseded by celilo#925, but the atomicity is not, and this
+ * is where it lands.
+ *
+ * The failure is provoked rather than injected, so nothing test-only reaches
+ * production code. The source carries a FIFO, which `cpSync` refuses with
+ * ENOTSUP — a stand-in for any mid-copy failure a real update can hit (a full
+ * disk, a permission, an I/O error). It is chosen because it fails on the
+ * SOURCE, so it fires whether the copy targets the live install or a staging
+ * directory, which a destination-side collision would not. `z-` sorts last,
+ * so the entries ahead of it copy successfully first — precisely the
+ * half-applied state being ruled out.
+ */
+describe('updateOne — an update that fails partway leaves the install untouched', () => {
+  let tempDir: string;
+  let srcDir: string;
+  let installedDir: string;
+  let db: DbClient;
+
+  /** Every file under `root`, relative path → bytes, for an exact comparison. */
+  function snapshotTree(root: string, dir = root): Record<string, string> {
+    const out: Record<string, string> = {};
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = join(dir, entry.name);
+      if (entry.isDirectory()) Object.assign(out, snapshotTree(root, full));
+      else out[relative(root, full)] = readFileSync(full, 'utf-8');
+    }
+    return out;
+  }
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), 'celilo-atomic-'));
+    process.env.CELILO_DB_PATH = join(tempDir, 'test.db');
+    process.env.CELILO_ORIGINAL_CWD = tempDir;
+
+    installedDir = join(tempDir, 'installed', 'testmod');
+    mkdirSync(join(installedDir, 'scripts'), { recursive: true });
+    mkdirSync(join(installedDir, 'generated'), { recursive: true });
+    writeFileSync(
+      join(installedDir, 'manifest.yml'),
+      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
+    );
+    writeFileSync(join(installedDir, 'scripts', 'on_install.ts'), 'export const OLD = 1;\n');
+    // `derived` — celilo's own output, must survive an update either way.
+    writeFileSync(join(installedDir, 'generated', 'terraform.tfstate'), '{"old":true}\n');
+
+    srcDir = join(tempDir, 'src');
+    mkdirSync(join(srcDir, 'scripts'), { recursive: true });
+    writeFileSync(
+      join(srcDir, 'manifest.yml'),
+      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 2.0.0\ndescription: fixture\n',
+    );
+    writeFileSync(join(srcDir, 'scripts', 'on_install.ts'), 'export const NEW = 2;\n');
+    // cpSync refuses a FIFO with ENOTSUP. Sorts last, so the real files copy first.
+    execFileSync('mkfifo', [join(srcDir, 'z-boom')]);
+
+    db = getDb();
+    db.insert(modules)
+      .values({
+        id: 'testmod',
+        name: 'Test Module',
+        sourcePath: installedDir,
+        version: '1.0.0',
+        manifestData: {
+          celilo_contract: '1.0',
+          id: 'testmod',
+          name: 'Test Module',
+          version: '1.0.0',
+        },
+      })
+      .run();
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+    process.env.CELILO_DB_PATH = undefined;
+    process.env.CELILO_ORIGINAL_CWD = undefined;
+  });
+
+  test('a failed update leaves the installed tree byte-identical', async () => {
+    const before = snapshotTree(installedDir);
+    expect(before['scripts/on_install.ts']).toBe('export const OLD = 1;\n');
+
+    await expect(updateOne(srcDir, db, {}, { quiet: true })).rejects.toThrow();
+
+    expect(snapshotTree(installedDir)).toEqual(before);
+  });
+
+  test('a successful update keeps celilo output and drops what the version removed', async () => {
+    // Same fixture minus the FIFO, so the update runs to completion.
+    rmSync(join(srcDir, 'z-boom'));
+    // A file the previous version shipped and the new one does not.
+    writeFileSync(join(installedDir, 'scripts', 'gone_in_2.ts'), 'export const OLD = 1;\n');
+
+    const result = await updateOne(srcDir, db, {}, { quiet: true });
+    expect(result.status).toBe('success');
+
+    // `derived`: celilo's own output survives (task 11.6).
+    expect(readFileSync(join(installedDir, 'generated', 'terraform.tfstate'), 'utf-8')).toBe(
+      '{"old":true}\n',
+    );
+    // `package`: the new version's content landed...
+    expect(readFileSync(join(installedDir, 'scripts', 'on_install.ts'), 'utf-8')).toBe(
+      'export const NEW = 2;\n',
+    );
+    // ...and what it dropped is gone, pruned in staging rather than in place.
+    expect(existsSync(join(installedDir, 'scripts', 'gone_in_2.ts'))).toBe(false);
+    // No staging debris on the success path either.
+    expect(readdirSync(join(tempDir, 'installed'))).toEqual(['testmod']);
+  });
+
+  test('a failed update leaves no staging directory behind', async () => {
+    await expect(updateOne(srcDir, db, {}, { quiet: true })).rejects.toThrow();
+
+    const siblings = readdirSync(join(tempDir, 'installed'));
+    expect(siblings).toEqual(['testmod']);
+  });
+
+  test('a failed update does not advance the integrity baseline', async () => {
+    await expect(updateOne(srcDir, db, {}, { quiet: true })).rejects.toThrow();
+
+    const row = db
+      .select()
+      .from(moduleIntegrity)
+      .where(eq(moduleIntegrity.moduleId, 'testmod'))
+      .get();
+    // Nothing recorded at all: the update never reached a state worth claiming.
+    expect(row).toBeUndefined();
+    // And the module row still names the version actually on disk.
+    const mod = db.select().from(modules).where(eq(modules.id, 'testmod')).get();
+    expect(mod?.version).toBe('1.0.0');
+  });
+});

package/src/cli/commands/module-update.ts

@@ -9,7 +9,15 @@
  * The module ID is read from the manifest at the given path.
  */
 
-import { cpSync, existsSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+} from 'node:fs';
 import { unlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, relative, resolve } from 'node:path';
@@ -163,6 +171,13 @@ export async function fetchAndUpdate(
  * `generated/`, the hook runtime closure, `screenshots/`, `cookies.json` — and
  * `generated/` alone carries terraform state and provider binaries.
  */
+/**
+ * What an update leaves alone: celilo's own output and the operator's state,
+ * never the package's. The set the in-place update skipped, kept verbatim so
+ * the staging swap changes only WHEN files move, not WHICH ones.
+ */
+const PRESERVED_ENTRIES = new Set(['generated', 'screenshots', 'cookies.json']);
+
 function listPrunableFiles(root: string, dir = root): string[] {
   const found: string[] = [];
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
@@ -178,6 +193,88 @@ function listPrunableFiles(root: string, dir = root): string[] {
   return found;
 }
 
+/**
+ * Replace an installed module tree atomically (celilo#1008).
+ *
+ * The install used to be built in place: copy the new files over the old,
+ * then prune what the new version dropped. A failure anywhere in that
+ * sequence left a module half old and half new, with nothing on disk or in
+ * the DB recording which files were which. The comment on the in-place copy
+ * already named the hazard — "the copy dies partway, after the prune has
+ * already run".
+ *
+ * So the new tree is assembled in a sibling directory and swapped in with two
+ * renames. Everything that can fail — the copy, the prune, a bad source —
+ * fails while the live install is still untouched, because nothing has moved
+ * yet. If the second rename throws, the first is undone and the original is
+ * back. A sibling is deliberate: it is on the same filesystem, so the renames
+ * are atomic rather than a copy in disguise.
+ *
+ * The staging tree is removed on both paths, so a failure leaves no debris
+ * beside the module for the next reader to wonder about.
+ *
+ * `prune` receives the STAGED root, so the surviving-path rule is the one
+ * `updateOne` has always applied — only where it runs has changed.
+ *
+ * Adapted from `replaceInstalledModule` in Jeremy Banka's `f9a57f1b`. The rest
+ * of that commit is superseded by celilo#925; this half is not. It uses
+ * celilo's `classifyModulePath` rather than that commit's hand-rolled
+ * preserve/skip sets, which is what makes the `celilo/types.d.ts` special case
+ * it carried unnecessary — the classifier already calls that file `derived`.
+ */
+function replaceInstalledModule(
+  actualPath: string,
+  installedPath: string,
+  prune: (stagedRoot: string) => void,
+): void {
+  const suffix = `${process.pid}-${Date.now()}`;
+  const stagedPath = `${installedPath}.update-${suffix}`;
+  const previousPath = `${installedPath}.previous-${suffix}`;
+
+  rmSync(stagedPath, { recursive: true, force: true });
+  mkdirSync(stagedPath, { recursive: true });
+
+  try {
+    // The incoming version, filtered by the same classifier the in-place copy
+    // used, so an update from a directory still cannot plant `e2e/`,
+    // `*.test.ts` or `scripts/tsconfig.json` in the install.
+    for (const entry of readdirSync(actualPath)) {
+      if (PRESERVED_ENTRIES.has(entry)) continue;
+      cpSync(join(actualPath, entry), join(stagedPath, entry), {
+        recursive: true,
+        force: true,
+        filter: (from) => classifyModulePath(relative(actualPath, from)) !== 'unknown',
+      });
+    }
+
+    // Carry the live tree's own copies across. Same three entries the in-place
+    // update left alone, for the same reason: they are celilo's or the
+    // operator's, not the package's. Every other `derived` path — the hook
+    // runtime closure under `scripts/node_modules`, `celilo/types.d.ts` —
+    // still comes from the incoming version exactly as it did before, so a new
+    // module version can still deliver new hook dependencies.
+    for (const entry of PRESERVED_ENTRIES) {
+      const from = join(installedPath, entry);
+      if (!existsSync(from)) continue;
+      cpSync(from, join(stagedPath, entry), { recursive: true, force: true });
+    }
+
+    prune(stagedPath);
+
+    renameSync(installedPath, previousPath);
+    try {
+      renameSync(stagedPath, installedPath);
+    } catch (error) {
+      renameSync(previousPath, installedPath);
+      throw error;
+    }
+    rmSync(previousPath, { recursive: true, force: true });
+  } catch (error) {
+    rmSync(stagedPath, { recursive: true, force: true });
+    throw error;
+  }
+}
+
 export async function updateOne(
   sourcePath: string,
   db: ReturnType<typeof getDb>,
@@ -293,27 +390,7 @@ export async function updateOne(
     log.info(`Upgrading ${moduleId}: ${previousVersion} → ${newVersion}`);
   }
 
-  // Copy new module files, preserving generated output and state
   const installedPath = module.sourcePath;
-  const preserveDirs = new Set(['generated', 'screenshots', 'cookies.json']);
-
-  // Route the copy through the one classifier, the way `module import` does.
-  // `updateOne` used to copy the source tree wholesale, so updating from a
-  // directory planted `e2e/`, `*.test.ts` and `scripts/tsconfig.json` in the
-  // install — files no package ships and no target runs. Import never did,
-  // because a directory import goes through the packager; update is the path
-  // that skipped it.
-  const entries = readdirSync(actualPath);
-  for (const entry of entries) {
-    if (preserveDirs.has(entry)) continue;
-    const src = join(actualPath, entry);
-    const dest = join(installedPath, entry);
-    cpSync(src, dest, {
-      recursive: true,
-      force: true,
-      filter: (from) => classifyModulePath(relative(actualPath, from)) !== 'unknown',
-    });
-  }
 
   // The integrity baseline for the version just installed. Prefer the package's
   // own signed `checksums.json`; a directory update has none, so compute over
@@ -343,14 +420,25 @@ export async function updateOne(
   // pruned: `generated/`, the hook runtime closure, `screenshots/` and
   // `cookies.json` are celilo's or the operator's, and survive an update by
   // design.
+  //
+  // Unchanged except for WHERE it runs. It now prunes the staged tree, before
+  // anything is swapped in, so a prune that throws cannot leave the live
+  // install short of files (celilo#1008).
   const survivingPaths = new Set(
     Object.keys(baselineChecksums).filter((p) => classifyModulePath(p) === 'package'),
   );
-  for (const relPath of listPrunableFiles(installedPath)) {
-    if (!survivingPaths.has(relPath)) {
-      rmSync(join(installedPath, relPath));
+  const pruneDropped = (root: string) => {
+    for (const relPath of listPrunableFiles(root)) {
+      if (!survivingPaths.has(relPath)) {
+        rmSync(join(root, relPath));
+      }
     }
-  }
+  };
+
+  // Build the new tree beside the install and swap it in with two renames.
+  // Everything above this line is reversible by doing nothing; everything
+  // below it runs only once the files are really in place.
+  replaceInstalledModule(actualPath, installedPath, pruneDropped);
 
   // Record it. `updateOne` never touched this table, so the baseline stayed
   // frozen at the module's FIRST import no matter how many times it was

package/src/cli/commands/service-set-credentials.test.ts

@@ -0,0 +1,108 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { closeDb } from '../../db/client';
+import { runMigrations } from '../../db/migrate';
+import {
+  type ProxmoxCredentials,
+  addContainerService,
+  getContainerService,
+  getServiceCredentials,
+  updateVerificationStatus,
+} from '../../services/container-service';
+import { handleServiceSetCredentials } from './service-set-credentials';
+
+describe('service set-credentials', () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = mkdtempSync(join(tmpdir(), 'celilo-service-credentials-test-'));
+    process.env.CELILO_DB_PATH = join(testDir, 'test.db');
+    process.env.CELILO_MASTER_KEY_PATH = join(testDir, 'master.key');
+    writeFileSync(process.env.CELILO_MASTER_KEY_PATH, 'a'.repeat(64), 'utf8');
+    await runMigrations(process.env.CELILO_DB_PATH);
+  });
+
+  afterEach(() => {
+    closeDb();
+    delete process.env.CELILO_DB_PATH;
+    delete process.env.CELILO_MASTER_KEY_PATH;
+    delete process.env.PROXMOX_API_URL;
+    delete process.env.PROXMOX_API_TOKEN_ID;
+    delete process.env.PROXMOX_API_TOKEN_SECRET;
+    delete process.env.DIGITALOCEAN_API_TOKEN;
+    rmSync(testDir, { recursive: true, force: true });
+  });
+
+  it('updates only the Proxmox endpoint and retains the token', async () => {
+    const service = await addContainerService({
+      name: 'Chubs',
+      providerName: 'proxmox',
+      zones: ['internal'],
+      providerConfig: {},
+      apiCredentials: {
+        api_url: 'https://192.168.0.50:8006',
+        api_token_id: 'root@pam!celilo',
+        api_token_secret: 'existing-secret',
+      },
+    });
+    await updateVerificationStatus(service.id, { success: true, message: 'Connected' });
+
+    const result = await handleServiceSetCredentials(['chubs'], {
+      'api-url': 'https://10.77.20.50:8006',
+    });
+
+    expect(result.success).toBe(true);
+    expect(await getServiceCredentials(service.id)).toEqual({
+      api_url: 'https://10.77.20.50:8006',
+      api_token_id: 'root@pam!celilo',
+      api_token_secret: 'existing-secret',
+    });
+    expect((await getContainerService(service.id))?.verified).toBe(false);
+    if (!result.success) throw new Error(result.error);
+    expect(result.message).not.toContain('existing-secret');
+  });
+
+  it('accepts the endpoint through the documented environment variable', async () => {
+    const service = await addContainerService({
+      name: 'Nubs',
+      providerName: 'proxmox',
+      zones: ['internal'],
+      providerConfig: {},
+      apiCredentials: {
+        api_url: 'https://192.168.0.51:8006',
+        api_token_id: 'root@pam!celilo',
+        api_token_secret: 'existing-secret',
+      },
+    });
+    process.env.PROXMOX_API_URL = 'https://10.77.20.51:8006';
+
+    const result = await handleServiceSetCredentials(['nubs']);
+
+    expect(result.success).toBe(true);
+    expect(((await getServiceCredentials(service.id)) as ProxmoxCredentials).api_url).toBe(
+      'https://10.77.20.51:8006',
+    );
+  });
+
+  it('refuses a no-op that would only churn encrypted state', async () => {
+    await addContainerService({
+      name: 'Chubs',
+      providerName: 'proxmox',
+      zones: ['internal'],
+      providerConfig: {},
+      apiCredentials: {
+        api_url: 'https://192.168.0.50:8006',
+        api_token_id: 'root@pam!celilo',
+        api_token_secret: 'existing-secret',
+      },
+    });
+
+    const result = await handleServiceSetCredentials(['chubs']);
+
+    expect(result.success).toBe(false);
+    if (result.success) throw new Error('Expected set-credentials to reject a no-op');
+    expect(result.error).toContain('No credential changes supplied');
+  });
+});

package/src/cli/commands/service-set-credentials.ts

@@ -0,0 +1,115 @@
+/**
+ * Service set-credentials command.
+ *
+ * Credential values travel only by flag or environment variable (D7). Fields
+ * omitted from the invocation retain their existing encrypted values, which
+ * lets an operator move a provider endpoint without rotating its API token.
+ */
+
+import {
+  type DigitalOceanCredentials,
+  type ProxmoxCredentials,
+  getContainerServiceByServiceId,
+  getServiceCredentials,
+  updateServiceCredentials,
+} from '../../services/container-service';
+import type { CommandResult } from '../types';
+
+type Flags = Record<string, boolean | string>;
+
+function credentialUpdateValue(flags: Flags, flag: string, envVar: string): string | undefined {
+  const flagValue = flags[flag];
+  if (flagValue === true) {
+    throw new Error(`--${flag} requires a value`);
+  }
+  if (typeof flagValue === 'string') {
+    const value = flagValue.trim();
+    if (!value) throw new Error(`--${flag} requires a non-empty value`);
+    return value;
+  }
+
+  const envValue = process.env[envVar]?.trim();
+  return envValue || undefined;
+}
+
+export async function handleServiceSetCredentials(
+  args: string[],
+  flags: Flags = {},
+): Promise<CommandResult> {
+  const serviceId = args[0];
+  if (!serviceId) {
+    return {
+      success: false,
+      error:
+        'Service ID is required\n\nUsage: celilo service set-credentials <service-id> [options]',
+    };
+  }
+
+  try {
+    const service = await getContainerServiceByServiceId(serviceId);
+    if (!service) {
+      return {
+        success: false,
+        error: `Service not found: ${serviceId}\n\nRun 'celilo service list' to see available services.`,
+      };
+    }
+
+    const current = await getServiceCredentials(service.id);
+    let changed = false;
+
+    if (service.providerName === 'proxmox') {
+      const existing = current as ProxmoxCredentials;
+      const apiUrl = credentialUpdateValue(flags, 'api-url', 'PROXMOX_API_URL');
+      const apiTokenId = credentialUpdateValue(flags, 'api-token-id', 'PROXMOX_API_TOKEN_ID');
+      const apiTokenSecret = credentialUpdateValue(
+        flags,
+        'api-token-secret',
+        'PROXMOX_API_TOKEN_SECRET',
+      );
+      changed = Boolean(apiUrl || apiTokenId || apiTokenSecret);
+
+      if (changed) {
+        await updateServiceCredentials(service.id, {
+          api_url: apiUrl ?? existing.api_url,
+          api_token_id: apiTokenId ?? existing.api_token_id,
+          api_token_secret: apiTokenSecret ?? existing.api_token_secret,
+        });
+      }
+    } else if (service.providerName === 'digitalocean') {
+      const existing = current as DigitalOceanCredentials;
+      const apiToken = credentialUpdateValue(flags, 'api-token', 'DIGITALOCEAN_API_TOKEN');
+      changed = Boolean(apiToken);
+
+      if (changed) {
+        await updateServiceCredentials(service.id, {
+          api_token: apiToken ?? existing.api_token,
+        });
+      }
+    } else {
+      return {
+        success: false,
+        error: `Credential updates are not supported for provider: ${service.providerName}`,
+      };
+    }
+
+    if (!changed) {
+      return {
+        success: false,
+        error:
+          service.providerName === 'proxmox'
+            ? 'No credential changes supplied. Pass --api-url, --api-token-id, or --api-token-secret (or set the corresponding PROXMOX_API_* environment variable).'
+            : 'No credential changes supplied. Pass --api-token or set $DIGITALOCEAN_API_TOKEN.',
+      };
+    }
+
+    return {
+      success: true,
+      message: `Updated credentials for service '${serviceId}'. Verification status cleared; run: celilo service verify ${serviceId}`,
+    };
+  } catch (error) {
+    return {
+      success: false,
+      error: `Failed to update service credentials: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  }
+}

package/src/cli/commands/system-migrate.ts

@@ -108,9 +108,11 @@ export async function handleSystemMigrate(
     }
   }
 
-  // getDb() auto-migrates on open; do it inside try so an existing DB that
-  // predates the drizzle-authoritative change fails with an actionable message
-  // instead of a raw migrator error.
+  // getDb() auto-migrates on open, and repairs a frozen `__drizzle_migrations`
+  // watermark itself when the declared schema is already complete. What reaches
+  // this catch is the case it will not guess at: schema that is only PARTLY
+  // there, where stamping would record migrations that never ran. Caught so it
+  // says what to do instead of surfacing a raw migrator error.
   let db: ReturnType<typeof getDb>;
   try {
     db = getDb();
@@ -118,7 +120,7 @@ export async function handleSystemMigrate(
     const msg = error instanceof Error ? error.message : String(error);
     return {
       success: false,
-      error: `Migration failed: ${msg}\n\nIf this DB predates the drizzle-authoritative migration change, it needs a one-time remediation (stamp \`__drizzle_migrations\` to the latest migration + create any missing table) before the migrator can run cleanly — see ISS-0100.`,
+      error: `Migration failed: ${msg}\n\nThis DB's \`__drizzle_migrations\` watermark disagrees with a schema that is only partly applied, which celilo will not resolve on its own. It needs a one-time remediation by hand (create the genuinely missing objects from their migration .sql, then stamp the watermark to the latest migration) — runbook in celilo#169.`,
     };
   }