@celilo/cli 2.0.0 → 2.2.0

package/src/services/module-validator/git-hygiene.test.ts

@@ -1,8 +1,9 @@
 import { describe, expect, test } from 'bun:test';
 import { execSync } from 'node:child_process';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
+import { classifyModulePath } from '../../module/packaging/package-rules';
 import { checkGitHygiene, checkModuleStale } from './git-hygiene';
 
 interface TempRepo {
@@ -18,8 +19,19 @@ interface TempRepo {
  */
 function makeTempRepo(): TempRepo {
   const dir = mkdtempSync(join(tmpdir(), 'celilo-git-hygiene-'));
+  // Bound every git child. A git call that hangs used to run until bun's
+  // per-test timeout killed it, and bun's dangling-process kill left the
+  // WHOLE run parked (reproduced for celilo#1282; the park itself is
+  // celilo#1246). Erroring the test instead keeps the failure visible and
+  // the run exitable. 30s per command stays under the 60s per-test ceiling
+  // this suite runs with.
   const exec = (cmd: string): string =>
-    execSync(cmd, { cwd: dir, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
+    execSync(cmd, {
+      cwd: dir,
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 30_000,
+    });
   exec('git init -q');
   exec('git config user.email "test@example.com"');
   exec('git config user.name "Test"');
@@ -88,6 +100,113 @@ describe('checkModuleStale', () => {
   });
 });
 
+describe('staleness reach vs the packager (celilo#1270)', () => {
+  // Paths planted to span the classifications classifyModulePath produces.
+  // The expected staleness outcome is NOT hand-written per path: each test
+  // asks classifyModulePath what the packager does with the path and holds
+  // the staleness gate to the same answer.
+  const planted = [
+    'e2e/split-horizon-views.test.ts',
+    'e2e/fixtures/cases.json',
+    'scripts/install.sh',
+    'scripts/tsconfig.json',
+    'ansible/playbook.yml',
+    'terraform/main.tf',
+    'schema/tables.sql',
+    'hooks/run.test.ts',
+    'generated/report.json',
+    'state/last-run.json',
+  ];
+
+  /** Repo with only manifest.yml committed; returns `commit(rel)` helper. */
+  function repoWithManifest() {
+    const repo = makeTempRepo();
+    writeFileSync(join(repo.dir, 'manifest.yml'), 'id: x\nversion: 1.0.0\n');
+    repo.exec('git add manifest.yml && git commit -q -m manifest');
+    const commit = (rel: string) => {
+      const abs = join(repo.dir, rel);
+      mkdirSync(dirname(abs), { recursive: true });
+      writeFileSync(abs, 'planted\n');
+      repo.exec(`git add ${rel} && git commit -q -m ${JSON.stringify(rel)}`);
+    };
+    return { repo, commit };
+  }
+
+  test(
+    'a commit touching only e2e/ does not mark the manifest stale',
+    () => {
+      const { repo, commit } = repoWithManifest();
+      try {
+        commit('e2e/split-horizon-views.test.ts');
+        expect(checkModuleStale(repo.dir)).toBeNull();
+      } finally {
+        repo.cleanup();
+      }
+    },
+    { timeout: 30_000 },
+  );
+
+  test(
+    'a commit touching scripts/, ansible/, terraform/ or schema/ still fires',
+    () => {
+      for (const rel of [
+        'scripts/install.sh',
+        'ansible/playbook.yml',
+        'terraform/main.tf',
+        'schema/tables.sql',
+      ]) {
+        const { repo, commit } = repoWithManifest();
+        try {
+          commit(rel);
+          expect(classifyModulePath(rel)).toBe('package');
+          expect(checkModuleStale(repo.dir)).not.toBeNull();
+        } finally {
+          repo.cleanup();
+        }
+      }
+    },
+    { timeout: 30_000 },
+  );
+
+  test(
+    'reach parity: the gate fires exactly for paths the packager ships',
+    async () => {
+      for (const rel of planted) {
+        const { repo, commit } = repoWithManifest();
+        try {
+          commit(rel);
+          const stale = checkModuleStale(repo.dir);
+          if (classifyModulePath(rel) === 'package') {
+            expect(stale).not.toBeNull();
+          } else {
+            expect(stale).toBeNull();
+          }
+        } finally {
+          repo.cleanup();
+        }
+      }
+    },
+    { timeout: 30_000 },
+  );
+
+  test(
+    'non-shipped commits between manifest and a shipped change stay quiet until shipped bytes move',
+    () => {
+      const { repo, commit } = repoWithManifest();
+      try {
+        commit('e2e/split-horizon-views.test.ts');
+        commit('scripts/tsconfig.json');
+        expect(checkModuleStale(repo.dir)).toBeNull();
+        commit('scripts/install.sh');
+        expect(checkModuleStale(repo.dir)).not.toBeNull();
+      } finally {
+        repo.cleanup();
+      }
+    },
+    { timeout: 30_000 },
+  );
+});
+
 describe('checkGitHygiene', () => {
   test('all ok on a fresh, clean repo with manifest as latest commit', () => {
     const repo = makeTempRepo();

package/src/services/module-validator/git-hygiene.ts

@@ -1,5 +1,6 @@
 import { spawnSync } from 'node:child_process';
 import { join } from 'node:path';
+import { classifyModulePath } from '../../module/packaging/package-rules';
 import { collectGitInfo, makeRealGitRunner } from '../../module/packaging/release-metadata';
 import type { Check } from './types';
 
@@ -19,10 +20,14 @@ export interface StalenessIssue {
  * anywhere should still talk to lunacycle's git history).
  */
 function lastCommitTouching(cwd: string, pathspec: string[]): string | null {
+  // timeout: a hung git degrades to the "can't determine — skip" path (status
+  // null) instead of hanging `module check` forever. 30s is enormous against
+  // the milliseconds a bounded `git log -1` takes on any real repo.
   const r = spawnSync('git', ['log', '-1', '--format=%H', '--', ...pathspec], {
     cwd,
     stdio: ['ignore', 'pipe', 'ignore'],
     encoding: 'utf-8',
+    timeout: 30_000,
   });
   if (r.status !== 0) return null;
   const sha = r.stdout.trim();
@@ -33,17 +38,90 @@ function isAncestor(cwd: string, maybeAncestor: string, descendant: string): boo
   const r = spawnSync('git', ['merge-base', '--is-ancestor', maybeAncestor, descendant], {
     cwd,
     stdio: 'ignore',
+    timeout: 30_000,
   });
   return r.status === 0;
 }
 
+/**
+ * One commit from `git log --name-only`: its SHA and the repo-root-relative
+ * paths it changed. A merge commit carries an empty file list (git log omits
+ * diffs for merges), so it never qualifies as a src commit — which is right,
+ * a merge changes no authored byte of its own.
+ */
+interface CommitWithPaths {
+  sha: string;
+  paths: string[];
+}
+
+/**
+ * The commits touching `pathspec`, newest first, with the repo-root-relative
+ * paths each one changed. `git log --name-only` prints repo-root-relative
+ * paths even when cwd is a subdirectory (measured: it does not honor cwd for
+ * output), so the caller strips the prefix itself via `show-prefix`.
+ */
+function listCommitsTouching(cwd: string, pathspec: string): CommitWithPaths[] {
+  const r = spawnSync(
+    'git',
+    ['-c', 'core.quotePath=false', 'log', '--format=%H', '--name-only', '--', pathspec],
+    { cwd, stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' },
+  );
+  if (r.status !== 0) return [];
+  const commits: CommitWithPaths[] = [];
+  let current: CommitWithPaths | null = null;
+  for (const line of (r.stdout ?? '').split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (/^[0-9a-f]{40}$/.test(trimmed)) {
+      current = { sha: trimmed, paths: [] };
+      commits.push(current);
+    } else if (current) {
+      current.paths.push(trimmed);
+    }
+  }
+  return commits;
+}
+
+/**
+ * SHA of the last commit that touched SHIPPED module source, or null when no
+ * commit qualifies (no history, or only non-shipped paths ever committed).
+ *
+ * The staleness scan's reach is the PACKAGER's rule, not a second list beside
+ * it (celilo#1270). A path counts as source exactly when `classifyModulePath`
+ * calls it `package` — the same answer that decides whether the path lands in
+ * the .netapp. So a commit touching only `e2e/**`, `*.test.ts`, or
+ * `tsconfig.json` changes no installed byte and must not read as drift.
+ *
+ * Excluding manifest.yml from the "src" scan is the gate's own semantics, not
+ * packaging: we want to know if anything else shipped past it. node_modules,
+ * dist, and other build outputs are gitignored and so never appear here.
+ */
+function lastShippedSourceCommit(moduleDir: string): string | null {
+  const prefixR = spawnSync('git', ['rev-parse', '--show-prefix'], {
+    cwd: moduleDir,
+    stdio: ['ignore', 'pipe', 'ignore'],
+    encoding: 'utf-8',
+  });
+  if (prefixR.status !== 0) return null;
+  const repoPrefix = (prefixR.stdout ?? '').trim();
+  for (const commit of listCommitsTouching(moduleDir, moduleDir)) {
+    for (const p of commit.paths) {
+      if (repoPrefix && !p.startsWith(repoPrefix)) continue;
+      const rel = repoPrefix ? p.slice(repoPrefix.length) : p;
+      if (rel === 'manifest.yml') continue;
+      if (classifyModulePath(rel) === 'package') return commit.sha;
+    }
+  }
+  return null;
+}
+
 /**
  * Detect "I edited module src but forgot to bump (or touch) manifest.yml."
  *
- * Returns null when the manifest is the most recently-touched file in the
- * dir (or when neither side has any commit history — e.g. brand-new module
- * not yet committed). Returns a StalenessIssue when src has commits AFTER
- * the last manifest.yml change — the operator must bump the manifest
+ * Returns null when the manifest is the most recently-touched shipped file in
+ * the dir (or when neither side has any commit history — e.g. brand-new module
+ * not yet committed). Returns a StalenessIssue when shipped src has commits
+ * AFTER the last manifest.yml change — the operator must bump the manifest
  * (semver change → reset +N to 1) or just touch it (release-only change →
  * auto-bump +N), then re-publish.
  *
@@ -54,16 +132,7 @@ function isAncestor(cwd: string, maybeAncestor: string, descendant: string): boo
 export function checkModuleStale(moduleDir: string): StalenessIssue | null {
   const manifestPath = join(moduleDir, 'manifest.yml');
   const lastManifest = lastCommitTouching(moduleDir, [manifestPath]);
-  // Excluding manifest.yml from the "src" pathspec is the whole point — we
-  // want to know if anything ELSE in the dir moved past it. node_modules
-  // and common build outputs are gitignored already, but be explicit
-  // defensively.
-  const lastSrc = lastCommitTouching(moduleDir, [
-    moduleDir,
-    `:(exclude)${manifestPath}`,
-    `:(exclude)${moduleDir}/node_modules`,
-    `:(exclude)${moduleDir}/dist`,
-  ]);
+  const lastSrc = lastShippedSourceCommit(moduleDir);
   if (!lastManifest || !lastSrc) return null;
   if (lastSrc === lastManifest) return null;
   if (!isAncestor(moduleDir, lastManifest, lastSrc)) return null;

package/src/services/remote-access.test.ts

@@ -7,16 +7,27 @@
  *   2. an explicit non-root user is allowed — the fleet key's authority is
  *      root on fleet systems, and a non-root account trusts it only where an
  *      operator installed it (the cPanel bootstrap);
- *   3. otherwise the target must be a system the module or one of its
- *      instances provisioned, and a refusal names the module, the target, and
- *      the capability route.
+ *   3. the target is a system the module or one of its instances provisioned;
+ *   4. or it is a machine in celilo's pool that this module's own config names
+ *      — the case a config-only manager module needs, since it provisions
+ *      nothing and so can never satisfy rule 3 (celilo#1225);
+ *
+ *   and otherwise a refusal names the module, the target, and the capability
+ *   route.
  */
 
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { existsSync } from 'node:fs';
 import { rm } from 'node:fs/promises';
 import { type DbClient, createDbClient } from '../db/client';
-import { capabilities, moduleInstances, moduleSystems, modules } from '../db/schema';
+import {
+  capabilities,
+  machines,
+  moduleConfigs,
+  moduleInstances,
+  moduleSystems,
+  modules,
+} from '../db/schema';
 import { remoteAccessPolicy } from './remote-access';
 
 const TEST_DB_PATH = './test-remote-access.db';
@@ -48,6 +59,26 @@ function seedSystem(db: DbClient, moduleId: string, ipv4Address: string, hostnam
     .run();
 }
 
+/** A box the operator admitted to celilo's pool. */
+function seedPoolMachine(db: DbClient, ipAddress: string, hostname: string): void {
+  db.insert(machines)
+    .values({
+      id: `machine-${hostname}`,
+      hostname,
+      zone: 'internal',
+      ipAddress,
+      sshUser: 'root',
+      sshKeyEncrypted: 'x',
+      hardware: { cpu_cores: 1, memory_mb: 512, disk_gb: 8 },
+    })
+    .run();
+}
+
+/** A config value the operator set on a module. */
+function seedConfig(db: DbClient, moduleId: string, key: string, value: string): void {
+  db.insert(moduleConfigs).values({ moduleId, key, value }).run();
+}
+
 describe('remoteAccessPolicy', () => {
   let db: DbClient;
 
@@ -136,4 +167,57 @@ describe('remoteAccessPolicy', () => {
     );
     expect(verdict.allowed).toBe(false);
   });
+
+  describe('a config-only module managing a pool machine (celilo#1225)', () => {
+    // `iptables` is the archetype: it configures a pre-existing firewall and is
+    // deployed onto nothing, so `module_systems` holds no row for it EVER. Rule
+    // 3 is unsatisfiable for it by construction, not by timing.
+    const FIREWALL = '10.226.1.254';
+
+    beforeEach(() => {
+      seedModule(db, 'iptables');
+    });
+
+    test("allows a pool machine this module's config names", () => {
+      seedPoolMachine(db, FIREWALL, 'fw-main');
+      seedConfig(db, 'iptables', 'firewall_ip', FIREWALL);
+
+      expect(
+        remoteAccessPolicy('iptables', db).checkTarget({ ipv4_address: FIREWALL }, false),
+      ).toEqual({ allowed: true });
+    });
+
+    test('pool membership ALONE is not authorization', () => {
+      // Otherwise any module could reach every box celilo knows about, which is
+      // far wider than the rule this policy states.
+      seedPoolMachine(db, FIREWALL, 'fw-main');
+
+      const result = remoteAccessPolicy('iptables', db).checkTarget(
+        { ipv4_address: FIREWALL },
+        false,
+      );
+      expect(result.allowed).toBe(false);
+    });
+
+    test('config ALONE is not authorization', () => {
+      // A module names its own config keys. If naming an address were enough, a
+      // module could point itself at any box in the world.
+      seedConfig(db, 'iptables', 'firewall_ip', FIREWALL);
+
+      const result = remoteAccessPolicy('iptables', db).checkTarget(
+        { ipv4_address: FIREWALL },
+        false,
+      );
+      expect(result.allowed).toBe(false);
+    });
+
+    test("one module's config does not unlock another module's box", () => {
+      seedPoolMachine(db, FIREWALL, 'fw-main');
+      seedConfig(db, 'iptables', 'firewall_ip', FIREWALL);
+
+      // caddy has its own systems and no config naming the firewall.
+      const result = remoteAccessPolicy('caddy', db).checkTarget({ ipv4_address: FIREWALL }, false);
+      expect(result.allowed).toBe(false);
+    });
+  });
 });

package/src/services/remote-access.ts

@@ -40,7 +40,7 @@
 
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
-import { capabilities, moduleSystems } from '../db/schema';
+import { capabilities, machines, moduleConfigs, moduleSystems } from '../db/schema';
 import type { RemoteAccessPolicy } from '../hooks/remote-broker';
 import { getModuleSystems } from './deployed-systems';
 import { ownedSystemModuleIds } from './module-instances';
@@ -60,11 +60,62 @@ export function remoteAccessPolicy(moduleId: string, db: DbClient): RemoteAccess
         return { allowed: true };
       }
 
+      if (managesPoolMachine(moduleId, target.ipv4_address, db)) {
+        return { allowed: true };
+      }
+
       return { allowed: false, message: refusalMessage(moduleId, target.ipv4_address, db) };
     },
   };
 }
 
+/**
+ * A machine in celilo's pool that this module's own config names.
+ *
+ * ## The case this exists for
+ *
+ * A module that MANAGES a pre-existing box rather than being deployed onto one
+ * — `iptables` configuring the firewall is the archetype — provisions no system
+ * and therefore never owns one. `module_systems` records nothing for a
+ * config-only module at any point in its lifecycle, so the owned-systems branch
+ * above cannot ever pass for it. Without this, such a module has no sanctioned
+ * path to the one box it exists to configure, and no amount of waiting fixes it
+ * (celilo#1225).
+ *
+ * ## Why this is not a module granting itself reach
+ *
+ * Both halves are the OPERATOR's acts, and a module can supply neither:
+ *
+ *   - The address is in the machine pool. `celilo machine add <ip> --ssh-key…`
+ *     is the operator saying celilo may use its credential on that box. The
+ *     fleet key's authority is exactly the set of boxes celilo was given, and
+ *     this is that set — the same reasoning as the non-root carve-out above.
+ *   - The module's own config names that address. `firewall_ip` is
+ *     `source: user, required: true`; an operator typed it.
+ *
+ * A module declares which config KEYS exist, never their values, so it cannot
+ * point itself at a box the operator did not both admit to the pool and assign
+ * to it. Two independent operator decisions have to agree.
+ *
+ * ## What it deliberately does not do
+ *
+ * It does not allow every pool machine. That would let any module reach any box
+ * celilo knows, which is far wider than the rule this file states. The
+ * intersection is the point: pool membership alone is not authorization, and
+ * config alone is not either.
+ */
+function managesPoolMachine(moduleId: string, ipv4Address: string, db: DbClient): boolean {
+  const inPool = db.select().from(machines).where(eq(machines.ipAddress, ipv4Address)).get();
+  if (!inPool) return false;
+
+  return db
+    .select({ value: moduleConfigs.value })
+    .from(moduleConfigs)
+    .where(eq(moduleConfigs.moduleId, moduleId))
+    .all()
+    .some((row) => row.value === ipv4Address);
+}
+
 /**
  * Name the module, the target, and the capability route (task 5.2). The owner
  * lookup is best-effort colour: the refusal stands whether or not celilo can

package/src/services/restore-from-file.test.ts

@@ -86,6 +86,26 @@ describe('applyStagedSystemFiles', () => {
     expect(existsSync(`${livePath}-shm`)).toBe(false);
   });
 
+  // celilo#1293 live repro 2026-09-06: the restore process's own pre-swap
+  // connection can outlive closeDb() at the fd level (measured: bun:sqlite's
+  // close() returned while the fds stayed open), and an IN-PLACE copy
+  // overwrites the inode that connection holds locks on — the swapped-in DB
+  // then inherits locks it must not have, and the next opener's DELETE→WAL
+  // conversion fails with "database is locked". The swap must therefore
+  // replace the INODE (rename), so any lingering lock lands on the unlinked
+  // old inode and is irrelevant to the new file.
+  it('replaces the live DB inode, not just its content', () => {
+    writeFileSync(livePath, 'old-db');
+    writeFileSync(join(stagingDir, 'celilo.db'), 'new-db');
+    const inodeBefore = statSync(livePath).ino;
+
+    applyStagedSystemFiles(stagingDir);
+
+    expect(readFileSync(livePath, 'utf-8')).toBe('new-db');
+    expect(statSync(livePath).ino).not.toBe(inodeBefore);
+    expect(existsSync(`${livePath}.restore-swap`)).toBe(false);
+  });
+
   it('handles partial staging (only master.key, no DB)', () => {
     writeFileSync(join(stagingDir, 'master.key'), 'just-the-key');
     const result = applyStagedSystemFiles(stagingDir);

package/src/services/restore-from-file.ts

@@ -17,7 +17,6 @@
  */
 
 import { Database } from 'bun:sqlite';
-import { execSync } from 'node:child_process';
 import {
   chmodSync,
   closeSync,
@@ -29,20 +28,22 @@ import {
   readFileSync,
   readSync,
   readdirSync,
+  renameSync,
   rmSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
+import { extract as tarExtract } from 'tar';
 import { getDbPath, getMasterKeyPath, getModuleStoragePath } from '../config/paths';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
 import { invokeHook } from '../hooks/executor';
+import { createHookStores } from '../hooks/hook-store';
 import { createConsoleLogger } from '../hooks/logger';
 import type { ModuleManifest } from '../manifest/schema';
 import { getOrCreateMasterKey } from '../secrets/master-key';
-import { shellEscape } from '../utils/shell';
 import { decryptFileToFile } from './backup-cipher';
 import { assertCompatibleSchema, parseManifest } from './backup-manifest';
 import { applyCrossModuleWriteRoot, moduleHasCrossModuleRead } from './cross-module-read';
@@ -128,7 +129,7 @@ export async function restoreFromArtifactFile(
     }
 
     // Extract the envelope tar.
-    execSync(`tar -xf ${shellEscape(tarPath)} -C ${shellEscape(envelopeDir)}`);
+    await tarExtract({ file: tarPath, cwd: envelopeDir });
 
     // 2. Read + validate the envelope manifest.
     const manifestPath = join(envelopeDir, 'manifest.json');
@@ -221,6 +222,7 @@ export async function restoreFromArtifactFile(
         debug: false,
         systems: getModuleSystems(mod.id, db),
         remoteAccess: remoteAccessPolicy(mod.id, db),
+        hookStores: () => createHookStores(db, mod.id),
       },
     );
     if (!hookResult.success) {
@@ -428,9 +430,22 @@ export function applyStagedSystemFiles(systemStagingDir: string): StagedSystemAp
     closeDb();
     const livePath = getDbPath();
     mkdirSync(join(livePath, '..'), { recursive: true });
-    copyFileSync(stagedDb, livePath);
-
-    // Stale WAL/SHM siblings would corrupt the restored DB.
+    // Swap by RENAME, not by in-place copy. copyFileSync overwrites the live
+    // inode in place, so any connection whose fd close was deferred (measured
+    // 2026-09-06, celilo#1293 live repro: bun:sqlite's close() returns before
+    // the fds are released) keeps its WAL shared locks on the NEW content, and
+    // the next opener's DELETE→WAL conversion in ensureWalMode then fails with
+    // "database is locked" for its whole retry budget. A rename gives the new
+    // file a fresh inode nobody has ever held. It also makes the swap atomic:
+    // a crash mid-copy left a truncated live DB; a crash mid-rename leaves the
+    // old one.
+    const stagedSwapPath = `${livePath}.restore-swap`;
+    copyFileSync(stagedDb, stagedSwapPath);
+    renameSync(stagedSwapPath, livePath);
+
+    // Stale WAL/SHM siblings belong to the replaced inode — remove them before
+    // any new connection opens this path, or SQLite would try to recover
+    // through a foreign WAL.
     for (const suffix of ['-wal', '-shm']) {
       try {
         rmSync(`${livePath}${suffix}`, { force: true });