@celilo/cli 2.1.0 → 2.2.0

package/src/services/backup-restore.ts

@@ -4,21 +4,21 @@
  * For system state backups, restores the Celilo database.
  */
 
-import { execSync } from 'node:child_process';
 import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
+import { extract as tarExtract } from 'tar';
 import { getDbPath } from '../config/paths';
 import { closeDb, getDb } from '../db/client';
 import { moduleConfigs, modules, secrets as secretsTable } from '../db/schema';
 import type { Backup } from '../db/schema';
 import { invokeHook } from '../hooks/executor';
+import { createHookStores } from '../hooks/hook-store';
 import { createConsoleLogger } from '../hooks/logger';
 import type { ModuleManifest } from '../manifest/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
-import { shellEscape } from '../utils/shell';
 import { decryptFileToFile } from './backup-cipher';
 import { assertCompatibleSchema, parseManifest } from './backup-manifest';
 import { createStorageProvider } from './backup-storage';
@@ -70,7 +70,7 @@ export async function restoreSystemStateBackup(backup: Backup): Promise<RestoreR
     mkdirSync(envelopeDir, { recursive: true });
     const tarPath = join(tempDir, 'envelope.tar');
     await decryptFileToFile(encryptedPath, tarPath, masterKey);
-    execSync(`tar -xf ${shellEscape(tarPath)} -C ${shellEscape(envelopeDir)}`);
+    await tarExtract({ file: tarPath, cwd: envelopeDir });
 
     // Read + validate manifest BEFORE touching the live DB. An
     // incompatible artifact must not get past this point.
@@ -180,6 +180,9 @@ export async function restoreModuleBackup(
   if (!backup.moduleId) {
     return { success: false, error: 'Backup has no associated module' };
   }
+  // Captured because the narrowing above does not survive into the hookStores
+  // callback below, where TypeScript widens the parameter back to string|null.
+  const moduleId = backup.moduleId;
 
   const db = getDb();
   const mod = db.select().from(modules).where(eq(modules.id, backup.moduleId)).get();
@@ -221,7 +224,7 @@ export async function restoreModuleBackup(
     const masterKey = await getOrCreateMasterKey();
     const tarPath = join(tempDir, 'envelope.tar');
     await decryptFileToFile(encryptedPath, tarPath, masterKey);
-    execSync(`tar -xf ${shellEscape(tarPath)} -C ${shellEscape(envelopeDir)}`);
+    await tarExtract({ file: tarPath, cwd: envelopeDir });
 
     // Read + validate envelope manifest BEFORE invoking the hook.
     const manifestPath = join(envelopeDir, 'manifest.json');
@@ -290,6 +293,7 @@ export async function restoreModuleBackup(
         debug: false,
         systems: getModuleSystems(backup.moduleId, db),
         remoteAccess: remoteAccessPolicy(backup.moduleId, db),
+        hookStores: () => createHookStores(db, moduleId),
       },
     );
 

package/src/services/bus-interview.ts

@@ -16,7 +16,7 @@
 
 import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
 import { getEventBusPath } from '../config/paths';
-import { InterviewAbandonedError } from './interview-errors';
+import { InterviewAbandonedError, InterviewUnansweredError } from './interview-errors';
 import { ensureResponderForInterview } from './responder-probe';
 
 const NO_SCHEMAS = defineEvents({});
@@ -271,17 +271,26 @@ export async function busInterview<TReply>(
   type: string,
   payload: object,
   ownerBus?: Bus,
+  timeoutMs = 0,
 ): Promise<TReply> {
   const ownsBus = !ownerBus;
   const bus: Bus = ownerBus ?? openBus({ dbPath: getEventBusPath(), events: NO_SCHEMAS });
   try {
     const replies = await bus.query(type as never, payload as never, {
-      timeoutMs: 0, // wait forever — race semantics, no timeout
+      timeoutMs, // 0 = wait forever — race semantics, no timeout
       pollIntervalMs: 250,
       expect: 'first',
     });
     if (replies.length === 0) {
-      throw new Error(`bus-interview: ${type} returned no reply`);
+      // Typed so a bounded caller can distinguish "nobody answered in time"
+      // from a decline. With the default 0 this is unreachable (the query
+      // waits forever), but keeping it typed costs nothing.
+      throw new InterviewUnansweredError(
+        type,
+        timeoutMs > 0
+          ? `No reply within ${timeoutMs}ms (${type})`
+          : `bus-interview: ${type} returned no reply`,
+      );
     }
     return replies[0].payload as unknown as TReply;
   } finally {
@@ -305,9 +314,10 @@ export async function busInterviewGuarded<TReply>(
   type: string,
   payload: object,
   ownerBus?: Bus,
+  timeoutMs = 0,
 ): Promise<TReply> {
   await ensureResponderForInterview(type);
-  return busInterview<TReply>(type, payload, ownerBus);
+  return busInterview<TReply>(type, payload, ownerBus, timeoutMs);
 }
 
 /**
@@ -326,9 +336,10 @@ export async function busInterviewGuarded<TReply>(
 export async function askInterview(
   payload: InterviewRequiredPayload,
   ownerBus?: Bus,
+  timeoutMs = 0,
 ): Promise<unknown> {
   const type = EVENT_TYPES.interviewRequired(payload.scope, payload.key);
-  const reply = await busInterviewGuarded<InterviewReply>(type, payload, ownerBus);
+  const reply = await busInterviewGuarded<InterviewReply>(type, payload, ownerBus, timeoutMs);
   if (reply.abandoned) throw new InterviewAbandonedError(type, reply.abandoned.reason);
   return reply.value;
 }
@@ -463,16 +474,28 @@ export async function askConfirm(opts: {
   message: string;
   defaultValue?: boolean;
   description?: string;
+  /**
+   * Bound the wait for a reply. 0 (the default) waits forever, which is
+   * right when the operator IS the responder (TTY). A headless caller whose
+   * responder may be attached but not staged for this question passes a
+   * finite bound so it skips instead of hanging until the suite budget
+   * kills it (module-orchestrator-primitives design.md D5).
+   */
+  timeoutMs?: number;
 }): Promise<boolean> {
-  const value = await askInterview({
-    scope: opts.scope,
-    key: opts.key,
-    kind: 'confirm',
-    message: opts.message,
-    required: true,
-    defaultValue: opts.defaultValue === undefined ? undefined : String(opts.defaultValue),
-    description: opts.description,
-  });
+  const value = await askInterview(
+    {
+      scope: opts.scope,
+      key: opts.key,
+      kind: 'confirm',
+      message: opts.message,
+      required: true,
+      defaultValue: opts.defaultValue === undefined ? undefined : String(opts.defaultValue),
+      description: opts.description,
+    },
+    undefined,
+    opts.timeoutMs,
+  );
   if (typeof value !== 'boolean') {
     throw new Error(
       `askConfirm(${opts.scope}.${opts.key}): expected a boolean reply, got ${typeof value}`,

package/src/services/config-provenance.ts

@@ -74,6 +74,8 @@ export function describeDerivedSource(variable: VariableDeclare): string {
       return 'from the infrastructure celilo selected for this module';
     case 'terraform':
       return 'from a Terraform output, at deploy time';
+    case 'hook':
+      return `by the module's own hooks at runtime (via context.config.set), and never by an operator`;
     default:
       return `computed by celilo (source: ${variable.source})`;
   }
@@ -98,6 +100,8 @@ export function explainNotSettable(moduleId: string, variable: VariableDeclare):
       return `${header}\n${origin}\n  • node placement: set the service default for NEW deploys (celilo service reconfigure); move an existing container with 'celilo proxmox migrate'.\n  • vmid / IP: auto-allocated by IPAM.`;
     case 'terraform':
       return `${header}\n${origin}\n  • It is read back from Terraform outputs after the deploy creates the resource.`;
+    case 'hook':
+      return `${header}\n${origin}\n  • It is written by the module's own hook via context.config.set, not by any operator path.`;
     default:
       return `${header}\n${origin}`;
   }

package/src/services/control-plane-bootstrap.test.ts

@@ -15,7 +15,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
-import { systemConfig } from '../db/schema';
+import { capabilities, modules, systemConfig } from '../db/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
 import {
   type ControlPlaneBootstrapOptions,
@@ -88,6 +88,126 @@ describe('bootstrapControlPlane', () => {
     expect(configValue(db, 'ssh.public_key')).toBe(PUBLIC_KEY);
   });
 
+  test('hands discovery every address a deployed resolver advertises (celilo#1239)', async () => {
+    // The recurrence gate's second half: the refusal only works if bootstrap
+    // actually tells discovery what to refuse. Seed capability rows the way a
+    // deployed resolver provider (technitium) and its secondary
+    // (knot-unbound-secondary) write them, including the CIDR suffix IPAM
+    // resolves target_ip to. Selection is by the declared `fleet_resolver`
+    // marker in the data, never the capability name.
+    const [module] = db
+      .insert(modules)
+      .values({
+        id: 'technitium',
+        name: 'technitium',
+        version: '1.0.0',
+        manifestData: {},
+        sourcePath: '/test/technitium',
+      })
+      .returning()
+      .all();
+    db.insert(capabilities)
+      .values([
+        {
+          moduleId: module.id,
+          capabilityName: 'dns_internal',
+          version: '1.0.0',
+          data: {
+            fleet_resolver: true,
+            server: { ip: '10.0.10.13', internal_ip: '192.168.0.151/24' },
+          },
+        },
+        {
+          moduleId: module.id,
+          capabilityName: 'dns_internal_secondary',
+          version: '1.0.0',
+          data: { fleet_resolver: true, server: { ip: '10.0.20.14' } },
+        },
+      ])
+      .run();
+
+    const seen: string[][] = [];
+    await run({
+      discoverDnsImpl: (fleetResolverIps) => {
+        seen.push([...fleetResolverIps]);
+        return DNS;
+      },
+    });
+
+    expect(seen).toHaveLength(1);
+    expect(seen[0].sort()).toEqual(['10.0.10.13', '192.168.0.151/24', '10.0.20.14'].sort());
+  });
+
+  test('a resolver capability without the declared marker is not a fleet resolver', async () => {
+    // Selection is by the DECLARED marker, not the capability name. A row
+    // named like a resolver but not declaring fleet_resolver must be ignored,
+    // otherwise renaming this to a name check would pass every other test
+    // here and silently re-open celilo#1239 to name-shaped drift.
+    const [module] = db
+      .insert(modules)
+      .values({
+        id: 'technitium',
+        name: 'technitium',
+        version: '1.0.0',
+        manifestData: {},
+        sourcePath: '/test/technitium',
+      })
+      .returning()
+      .all();
+    db.insert(capabilities)
+      .values({
+        moduleId: module.id,
+        capabilityName: 'dns_internal',
+        version: '1.0.0',
+        data: { server: { ip: '10.0.10.13', internal_ip: '192.168.0.151/24' } },
+      })
+      .run();
+
+    const seen: string[][] = [];
+    await run({
+      discoverDnsImpl: (fleetResolverIps) => {
+        seen.push([...fleetResolverIps]);
+        return DNS;
+      },
+    });
+
+    expect(seen).toEqual([[]]);
+  });
+
+  test('a capability of any name declaring the marker is a fleet resolver', async () => {
+    // The other half of the same proof: a NEW resolver provider needs no core
+    // change. Its capability name is irrelevant; the declaration is what counts.
+    const [module] = db
+      .insert(modules)
+      .values({
+        id: 'technitium',
+        name: 'technitium',
+        version: '1.0.0',
+        manifestData: {},
+        sourcePath: '/test/technitium',
+      })
+      .returning()
+      .all();
+    db.insert(capabilities)
+      .values({
+        moduleId: module.id,
+        capabilityName: 'some_future_resolver',
+        version: '1.0.0',
+        data: { fleet_resolver: true, server: { ip: '10.0.30.15' } },
+      })
+      .run();
+
+    const seen: string[][] = [];
+    await run({
+      discoverDnsImpl: (fleetResolverIps) => {
+        seen.push([...fleetResolverIps]);
+        return DNS;
+      },
+    });
+
+    expect(seen).toEqual([['10.0.30.15']]);
+  });
+
   test('returns what each step found, so the caller renders and this does not', async () => {
     const result = await run();
 

package/src/services/control-plane-bootstrap.ts

@@ -34,6 +34,7 @@
 import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
 import { getEventBusPath } from '../config/paths';
 import type { DbClient } from '../db/client';
+import { capabilities } from '../db/schema';
 import { type DnsServers, discoverDns } from './dns-discovery';
 import { type FleetFinding, checkDispatcher } from './fleet-checks';
 import { type FleetKey, ensureFleetKey } from './fleet-key';
@@ -50,10 +51,55 @@ import { initializeSystem } from './system-init';
 const DISPATCHER_ATTEMPTS = 5;
 const DISPATCHER_INTERVAL_MS = 1_000;
 
+/**
+ * The marker a resolver provider declares in its capability data to say "the
+ * addresses I advertise are a resolver celilo itself deployed". Core reads
+ * this declaration and names no capability (module-business-barrier Scan B).
+ * Declared today by knot-unbound-internal, knot-unbound-secondary and
+ * technitium (celilo#1239).
+ */
+const FLEET_RESOLVER_MARKER = 'fleet_resolver';
+
+/** The declared shape of a resolver capability's data. Values checked before use. */
+type ResolverCapabilityData = {
+  fleet_resolver?: unknown;
+  server?: { ip?: unknown; internal_ip?: unknown };
+};
+
+/**
+ * Every address a deployed resolver provider advertises for itself.
+ *
+ * A capability row counts when its data declares {@link FLEET_RESOLVER_MARKER};
+ * the capability NAME is irrelevant to this selection, so a new resolver
+ * provider needs no core change. Discovery hands the addresses to
+ * {@link discoverDns} so a resolv.conf the provider's own aspect wrote is
+ * refused rather than adopted as the fleet's upstream (celilo#1239). Addresses
+ * come from the declared data only (`server.ip`, `server.internal_ip`). Values
+ * may carry a CIDR suffix; discovery normalises both sides before comparing.
+ */
+export function fleetResolverAddresses(db: DbClient): string[] {
+  const addresses: string[] = [];
+  const rows = db.select({ data: capabilities.data }).from(capabilities).all();
+  for (const row of rows) {
+    const data = row.data as ResolverCapabilityData | undefined;
+    if (data?.[FLEET_RESOLVER_MARKER] !== true) continue;
+    for (const value of [data.server?.ip, data.server?.internal_ip]) {
+      if (typeof value === 'string' && value.length > 0) {
+        addresses.push(value);
+      }
+    }
+  }
+  return addresses;
+}
+
 export interface ControlPlaneBootstrapOptions {
   db: DbClient;
-  /** Injectable so tests drive the whole sequence without a host or a bus. */
-  discoverDnsImpl?: () => DnsServers;
+  /**
+   * Injectable so tests drive the whole sequence without a host or a bus.
+   * Receives the addresses of resolvers celilo itself deployed, which the
+   * discovery must refuse (celilo#1239).
+   */
+  discoverDnsImpl?: (fleetResolverIps: readonly string[]) => DnsServers;
   ensureFleetKeyImpl?: () => FleetKey;
   discoverNetworkImpl?: (db: DbClient) => NetworkDiscoveryResult;
   /**
@@ -152,7 +198,8 @@ export async function bootstrapControlPlane(
 ): Promise<ControlPlaneBootstrapResult> {
   const {
     db,
-    discoverDnsImpl = discoverDns,
+    discoverDnsImpl = (fleetResolverIps: readonly string[]): DnsServers =>
+      discoverDns(undefined, { fleetResolverIps }),
     ensureFleetKeyImpl = ensureFleetKey,
     discoverNetworkImpl = discoverAndRecordNetwork,
     probeDispatcher = probeOwnDispatcher,
@@ -160,7 +207,7 @@ export async function bootstrapControlPlane(
     dispatcherAttempts = DISPATCHER_ATTEMPTS,
   } = options;
 
-  const dns = discoverDnsImpl();
+  const dns = discoverDnsImpl(fleetResolverAddresses(db));
   const fleetKey = ensureFleetKeyImpl();
 
   initializeSystem(db, {

package/src/services/deploy-preflight.ts

@@ -174,8 +174,14 @@ export async function runPreflight(
     for (const variable of manifest.variables.owns) {
       if (!variable.required) continue;
 
-      // Infrastructure/terraform variables are auto-derived during deploy
-      if (variable.source === 'infrastructure' || variable.source === 'terraform') {
+      // Infrastructure/terraform variables are auto-derived during deploy;
+      // hook-owned variables are discovered by the module's own hooks at
+      // runtime (hook-owned-state D2). None of the three is operator input.
+      if (
+        variable.source === 'infrastructure' ||
+        variable.source === 'terraform' ||
+        variable.source === 'hook'
+      ) {
         continue;
       }
 

package/src/services/deploy-validation.test.ts

@@ -129,6 +129,28 @@ describe('findMissingRequiredVariables (deploy path)', () => {
     expect(missing[0].value_label).toBeUndefined();
   });
 
+  // Hook-owned-state task 2.3 (design D2): a `source: hook` variable is
+  // discovered by the module's own hook at runtime. It is never operator
+  // input, so an unwritten one must not read as missing configuration — not
+  // for the interview, and not as a deploy-blocking error.
+  test('a source: hook variable is never reported missing, even required and unwritten', async () => {
+    const manifest = {
+      celilo_contract: '1.0',
+      variables: {
+        owns: [
+          {
+            name: 'public_ip',
+            type: 'string',
+            required: true,
+            source: 'hook',
+          },
+        ],
+      },
+    } as unknown as ModuleManifest;
+    const missing = await findMissingRequiredVariables('testmod', manifest, db);
+    expect(missing).toEqual([]);
+  });
+
   test('configured secrets are not reported as missing', async () => {
     db.insert(secrets)
       .values({

package/src/services/deploy-validation.ts

@@ -430,6 +430,14 @@ export async function findMissingRequiredVariables(
         continue; // These are auto-populated from Terraform outputs
       }
 
+      // Hook-owned variables are discovered by the module's own hooks at
+      // runtime (hook-owned-state D2). An unwritten one is not a missing
+      // configuration value — prompting for it or failing validation would
+      // ask the operator to guess what a hook has not learned yet.
+      if (variable.source === 'hook') {
+        continue;
+      }
+
       // Check if variable is configured
       let isConfigured = false;
 

package/src/services/dns-discovery.test.ts

@@ -90,4 +90,58 @@ describe('discoverDns', () => {
   test('returns the public fallback on a host with no resolver files at all', () => {
     expect(discoverDns(host({}))).toEqual({ primary: '1.1.1.1', fallback: '1.1.1.1' });
   });
+
+  // The recurrence gate for celilo#1239 (bead ce-dxr8). The dns-client-config
+  // aspect of a deployed dns_internal provider rewrites /etc/resolv.conf to
+  // name that provider. Discovery reading the file back adopts the fleet's own
+  // resolver as the fleet's upstream and writes it into dns.primary /
+  // dns.fallback, where it reaches every LXC's permanent birth nameserver
+  // line. Proven to fail against the accepting implementation first.
+  describe('refusing resolvers celilo itself installed', () => {
+    // technitium's advertised dns_internal addresses: its dmz zone address and
+    // (once advertised) the firewall ingress `internal`-zone systems use.
+    const FLEET = ['10.0.10.13', '192.168.0.151'];
+
+    test('refuses a resolv.conf naming a deployed dns_internal provider address', () => {
+      const servers = discoverDns(host({ [ETC]: `nameserver ${FLEET[0]}\n` }), {
+        fleetResolverIps: FLEET,
+      });
+      expect(servers).toEqual({ primary: '1.1.1.1', fallback: '1.1.1.1' });
+    });
+
+    test('keeps the real upstreams beside a refused fleet resolver', () => {
+      const servers = discoverDns(host({ [ETC]: `nameserver ${FLEET[0]}\nnameserver 9.9.9.9\n` }), {
+        fleetResolverIps: FLEET,
+      });
+      expect(servers).toEqual({ primary: '9.9.9.9', fallback: '1.1.1.1' });
+    });
+
+    test('falls through to /etc/resolv.conf when the systemd file holds only fleet resolvers', () => {
+      const servers = discoverDns(
+        host({
+          [SYSTEMD]: `nameserver ${FLEET[0]}\n`,
+          [ETC]: 'nameserver 9.9.9.9\n',
+        }),
+        { fleetResolverIps: FLEET },
+      );
+      expect(servers).toEqual({ primary: '9.9.9.9', fallback: '1.1.1.1' });
+    });
+
+    test('matches a capability address that carries a CIDR suffix', () => {
+      // Capability data advertises `192.168.0.151/24` (server.ip resolves from
+      // target_ip); the resolv.conf entry is the bare address.
+      const servers = discoverDns(host({ [ETC]: `nameserver ${FLEET[1]}\n` }), {
+        fleetResolverIps: [`${FLEET[1]}/24`],
+      });
+      expect(servers).toEqual({ primary: '1.1.1.1', fallback: '1.1.1.1' });
+    });
+
+    test('accepts a private upstream that is not a fleet resolver', () => {
+      // A home-lab upstream on the operator's own network is legitimate. The
+      // refusal is scoped to resolvers celilo deployed, not to privateness.
+      expect(
+        discoverDns(host({ [ETC]: 'nameserver 192.168.0.1\n' }), { fleetResolverIps: FLEET }),
+      ).toEqual({ primary: '192.168.0.1', fallback: '1.1.1.1' });
+    });
+  });
 });

package/src/services/dns-discovery.ts

@@ -72,18 +72,60 @@ export type ResolverFileReader = (path: string) => string | null;
 const readResolverFile: ResolverFileReader = (path) =>
   existsSync(path) ? readFileSync(path, 'utf-8') : null;
 
+/** Options for {@link discoverDns}. */
+export interface DiscoverDnsOptions {
+  /**
+   * Addresses of resolvers celilo itself deployed, as advertised in the
+   * capability data of providers that declare the `fleet_resolver` marker
+   * (`server.ip`, `server.internal_ip`). Entries may carry a CIDR suffix.
+   */
+  fleetResolverIps?: readonly string[];
+}
+
+/** Strip a CIDR suffix: `192.168.0.151/24` → `192.168.0.151`. */
+export function bareIp(address: string): string {
+  return address.split('/')[0];
+}
+
+/**
+ * Drop nameservers that are resolvers celilo itself installed.
+ *
+ * A deployed dns_internal provider's base-module aspect rewrites this box's
+ * `/etc/resolv.conf` to name that provider. Reading the file back afterwards
+ * adopts the fleet's own resolver as the fleet's upstream and writes it into
+ * `dns.primary` / `dns.fallback` (celilo#1239), where it reaches every LXC's
+ * permanent birth nameserver line. A resolver answering the fleet is not an
+ * upstream for the fleet; refusing it here is what keeps discovery honest
+ * once the aspect has run.
+ */
+export function excludeFleetResolvers(
+  nameservers: string[],
+  fleetResolverIps: readonly string[] = [],
+): string[] {
+  if (fleetResolverIps.length === 0) return nameservers;
+  const fleet = new Set(fleetResolverIps.map(bareIp));
+  return nameservers.filter((ns) => !fleet.has(ns));
+}
+
 /**
  * Read this box's upstream resolvers.
  *
- * Takes the systemd file only when it yielded a real server. `/etc/resolv.conf`
- * is the last resort and whatever it gives is accepted, including the fallback,
- * because there is nothing further to consult.
+ * Loopback stubs and resolvers celilo itself installed ({@link DiscoverDnsOptions.fleetResolverIps})
+ * are refused, so a file holding only refused entries falls through to the
+ * next one. `/etc/resolv.conf` is the last resort and whatever survives the
+ * refusal is accepted, including the public fallback, because there is
+ * nothing further to consult.
  */
-export function discoverDns(read: ResolverFileReader = readResolverFile): DnsServers {
+export function discoverDns(
+  read: ResolverFileReader = readResolverFile,
+  options: DiscoverDnsOptions = {},
+): DnsServers {
   for (const path of RESOLVER_FILES) {
     const contents = read(path);
     if (contents === null) continue;
-    const servers = chooseDns(parseNameservers(contents));
+    const servers = chooseDns(
+      excludeFleetResolvers(parseNameservers(contents), options.fleetResolverIps),
+    );
     if (servers.primary !== PUBLIC_FALLBACK || path === '/etc/resolv.conf') {
       return servers;
     }

package/src/services/fleet-key.test.ts

@@ -5,10 +5,11 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { ensureFleetKey, getFleetSshDir } from './fleet-key';
+import { ensureFleetKey, findFleetPrivateKey, getFleetSshDir } from './fleet-key';
 
 describe('ensureFleetKey', () => {
   let dataDir: string;
@@ -45,3 +46,66 @@ describe('ensureFleetKey', () => {
     expect(second.publicKey).toBe(first.publicKey);
   });
 });
+
+describe('findFleetPrivateKey', () => {
+  let dataDir: string;
+  let homeDir: string;
+  let realHome: string | undefined;
+
+  beforeEach(() => {
+    dataDir = mkdtempSync(join(tmpdir(), 'celilo-fleet-find-'));
+    homeDir = mkdtempSync(join(tmpdir(), 'celilo-fleet-home-'));
+    process.env.CELILO_DB_PATH = join(dataDir, 'celilo.db');
+    realHome = process.env.HOME;
+    process.env.HOME = homeDir;
+  });
+
+  afterEach(() => {
+    process.env.CELILO_DB_PATH = undefined;
+    process.env.HOME = realHome;
+    rmSync(dataDir, { recursive: true, force: true });
+    rmSync(homeDir, { recursive: true, force: true });
+  });
+
+  /** A second, unrelated keypair in $HOME/.ssh, as every real box has. */
+  function plantHomeKey(): string {
+    const dir = join(homeDir, '.ssh');
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = join(dir, 'id_ed25519');
+    execFileSync('ssh-keygen', ['-t', 'ed25519', '-N', '', '-f', path, '-C', 'someone-else'], {
+      stdio: 'pipe',
+    });
+    return readFileSync(`${path}.pub`, 'utf-8').trim();
+  }
+
+  it('finds the key celilo minted, even when $HOME holds a different one', () => {
+    // This is celilo#1240. `ensureFleetKey` mints into the data dir and
+    // `machine add` searched $HOME only, so a fleet whose key celilo minted
+    // could not add a machine without --ssh-key-file. The e2e management
+    // container has both directories populated with DIFFERENT keys, which is
+    // why it failed there and not on a developer's box.
+    const homePublicKey = plantHomeKey();
+    const fleet = ensureFleetKey();
+    expect(fleet.publicKey).not.toBe(homePublicKey);
+
+    const found = findFleetPrivateKey(fleet.publicKey);
+
+    expect(found).toBe(join(dataDir, '.ssh', 'id_ed25519'));
+  });
+
+  it('still finds a key that only lives in $HOME', () => {
+    // The auto-detected case: `initializeSystem` reads $HOME/.ssh when
+    // ssh.public_key is unset, and that fleet must keep working.
+    const homePublicKey = plantHomeKey();
+
+    expect(findFleetPrivateKey(homePublicKey)).toBe(join(homeDir, '.ssh', 'id_ed25519'));
+  });
+
+  it('returns null when no private key matches the recorded public half', () => {
+    plantHomeKey();
+    const orphan =
+      'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA nobody';
+
+    expect(findFleetPrivateKey(orphan)).toBeNull();
+  });
+});