@celilo/cli 2.1.0 → 2.2.1

package/src/module/packaging/build.ts

@@ -1,13 +1,15 @@
 import { execFileSync, execSync } from 'node:child_process';
-import { cpSync, existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { cpSync, existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { readFile, readdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, join, relative } from 'node:path';
+import { gunzipSync } from 'node:zlib';
 import { create as tarCreate } from 'tar';
 import { parse as parseYaml } from 'yaml';
 import { log } from '../../cli/prompts';
 import { formatViolations, scanModuleDirectory } from '../../policy/module-script-scan';
 import { validateModuleDirectory } from '../import';
+import { resolveBuildCommandPaths } from './build-paths';
 import { computeFileChecksum } from './checksum';
 import { classifyModulePath, includeNodeModulesPath } from './package-rules';
 import { signChecksums } from './signature';
@@ -22,6 +24,37 @@ export interface ChecksumsData {
   files: Record<string, string>; // filepath -> xxhash
 }
 
+/**
+ * Put `scripts/node_modules` back after a `bun pm pack` staging.
+ *
+ * `bun pm pack` drops every `node_modules` unconditionally — that is npm-pack
+ * semantics, and a `files` entry naming the path does not override it. But the
+ * packager is explicit downstream (`includeNodeModulesPath`) that
+ * `scripts/node_modules` is the module's HOOK RUNTIME and ships in full, so
+ * hooks resolve their third-party deps on a target with no reachable registry.
+ *
+ * Those two rules disagreed, and which one won was decided by whether a module
+ * happened to have a root `package.json`. Every module in `modules/` has only
+ * `scripts/package.json`, so all of them take the `cpSync` branch below and
+ * keep their runtime. A module that is ALSO a bun project — a build script, a
+ * data pipeline, its own tests — takes this branch instead and shipped without
+ * one. Nothing caught it: package, publish, import and deploy all succeed, and
+ * the first symptom is the hook dying on the target with
+ * `Cannot find package '@celilo/capabilities'` (celilo#1310).
+ *
+ * The hook runtime is not build input, so `files` has no business filtering it.
+ * Symlinks are materialised for the same reason the `cpSync` branch does it: a
+ * `file:` workspace link would point at a path the target does not have.
+ */
+function stageHookRuntime(sourceDir: string, buildDir: string): void {
+  const from = join(sourceDir, 'scripts', 'node_modules');
+  if (!existsSync(from)) return;
+  cpSync(from, join(buildDir, 'scripts', 'node_modules'), {
+    recursive: true,
+    dereference: true,
+  });
+}
+
 /**
  * Module build options
  */
@@ -120,6 +153,33 @@ export async function computeChecksums(sourceDir: string): Promise<ChecksumsData
   };
 }
 
+/**
+ * Ceiling on the final tar+gzip write of the .netapp. Every step before it
+ * (staging, the module's own build command) already carries a timeout, but the
+ * tar stream did not — and 2026-09-04 it stalled mid-write (all samples in
+ * kevent64, artifact truncated at 59 percent) and sat there for two hours with
+ * no error and no exit. A bounded wait turns that into a nameable failure.
+ */
+const PACKAGE_STREAM_TIMEOUT_MS = 300_000;
+
+/**
+ * Validate that a produced .netapp is a complete gzip stream.
+ *
+ * A .netapp is a gzipped tar (tarCreate above runs with gzip: true), so a
+ * full gunzip pass is the whole check: a stream truncated mid-write fails
+ * with 'unexpected end of file' instead of surviving to the consumer, where
+ * the same zlib error reads as a truncated DOWNLOAD from an unrelated cause.
+ * Returns null when valid, otherwise the reason.
+ */
+export function verifyNetappIntegrity(packagePath: string): string | null {
+  try {
+    gunzipSync(readFileSync(packagePath));
+    return null;
+  } catch (err) {
+    return err instanceof Error ? err.message : String(err);
+  }
+}
+
 /**
  * Build a module package (.netapp file)
  *
@@ -187,6 +247,7 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
           timeout: 60_000,
         });
         rmSync(tarballs[0], { force: true });
+        stageHookRuntime(sourceDir, buildDir);
       } catch (err) {
         const errMsg = err instanceof Error ? err.message : String(err);
         return {
@@ -230,6 +291,33 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
     if (manifest.build?.command || manifest.build?.script) {
       log.info(`Building module (${manifest.build.command ? 'command' : 'script'})...`);
 
+      // Publish-time gate on the build command's paths (D3 of
+      // control-plane-stops-building-modules). A `cd` whose target does not
+      // resolve where the command runs means the module depends on inputs it
+      // does not carry. celilo-registry did exactly this for four months
+      // (`cd ../../packages/registry-server`) and the failure surfaced on a
+      // production control plane, months after publish, as a /bin/sh error.
+      // Refuse here, at the only point where a human is watching, and name the
+      // path. Targets the gate cannot resolve (untracked shell variables,
+      // command substitution) are skipped, never guessed at.
+      if (manifest.build.command) {
+        const pathViolations = resolveBuildCommandPaths(manifest.build.command, {
+          moduleSourceDir: sourceDir,
+          buildDir,
+        });
+        if (pathViolations.length > 0) {
+          return {
+            success: false,
+            error: [
+              `Refusing to build ${moduleId}: the build command references a path that does not exist where the command runs.`,
+              ...pathViolations.map((v) => `  ${v.rawPath}\n    resolves to: ${v.resolvedPath}`),
+              '',
+              'A build input that does not resolve at publish time makes the module unbuildable wherever it is installed. Fix the path in manifest.yml (keep it module-local, or reach the monorepo through $CELILO_MODULE_SOURCE_DIR) and re-publish.',
+            ].join('\n'),
+          };
+        }
+      }
+
       // Resolve `workspace:` build deps (ISS-0147 / celilo#216). The staged
       // buildDir has no workspace root, so a sibling monorepo package pulled in
       // via `workspace:^` won't resolve during the build's `bun install`.
@@ -321,7 +409,7 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
 
     // Create tarball
     const finalOutputPath = outputPath || join(process.cwd(), `${moduleId}.netapp`);
-    await tarCreate(
+    const tarPromise = tarCreate(
       {
         file: finalOutputPath,
         cwd: buildDir,
@@ -329,6 +417,46 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
       },
       ['checksums.json', 'signature.sig', ...Object.keys(checksumsData.files)],
     );
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = new Promise<never>((_, reject) => {
+      timer = setTimeout(
+        () =>
+          reject(
+            new Error(
+              `packaging tar stream exceeded ${PACKAGE_STREAM_TIMEOUT_MS / 1000}s and was abandoned mid-write`,
+            ),
+          ),
+        PACKAGE_STREAM_TIMEOUT_MS,
+      );
+    });
+    timer?.unref?.();
+    try {
+      await Promise.race([tarPromise, timeout]);
+    } catch (tarError) {
+      // The losing side may still hold the output file open: swallow its
+      // eventual rejection and remove the partial artifact so nothing
+      // downstream mistakes a truncated write for a package.
+      tarPromise.catch(() => {});
+      rmSync(finalOutputPath, { force: true });
+      return {
+        success: false,
+        error: `Failed to build module: ${
+          tarError instanceof Error ? tarError.message : 'Unknown error'
+        }`,
+      };
+    }
+
+    // Refuse to declare success on an artifact we cannot read back. The tar
+    // step resolved, so this only trips if the stream left the file truncated
+    // anyway — the exact corruption build-infra shipped on 2026-09-04.
+    const integrityError = verifyNetappIntegrity(finalOutputPath);
+    if (integrityError) {
+      rmSync(finalOutputPath, { force: true });
+      return {
+        success: false,
+        error: `Produced package failed gzip integrity check (${finalOutputPath}): ${integrityError}`,
+      };
+    }
 
     return {
       success: true,

package/src/module/packaging/extract.ts

@@ -19,12 +19,8 @@ export interface IntegrityViolation {
    * being old rather than by the files having changed. Only `auditModule`
    * produces it; package verification compares a package to its own manifest
    * and cannot be stale in this sense.
-   *
-   * `stale-generated` is the second plane (D3): a verbatim role asset in
-   * `generated/` whose bytes are not the installed module's. That is what
-   * celilo#925 was, and what would ship on the next deploy.
    */
-  type: 'missing' | 'modified' | 'extra' | 'stale-baseline' | 'stale-generated';
+  type: 'missing' | 'modified' | 'extra' | 'stale-baseline';
   /**
    * What the baseline says the file should hash to, and what it actually
    * hashes to. Both optional because not every violation is about a digest —

package/src/module/web-root.ts

@@ -14,7 +14,7 @@
  */
 
 import { join } from 'node:path';
-import { MODULE_WEB_ROOT } from '@celilo/capabilities';
+import { MODULE_STATE_WEB_ROOT, MODULE_WEB_ROOT } from '@celilo/capabilities';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { modules } from '../db/schema';
@@ -33,3 +33,19 @@ export function resolveModuleWebRoot(moduleId: string, db: DbClient): string | u
   if (!module) return undefined;
   return join(module.sourcePath, MODULE_WEB_ROOT);
 }
+
+/**
+ * Absolute path to `<module root>/state/site` — the state web overlay
+ * (celilo#1265) — or undefined when no such module is installed.
+ *
+ * Beside `resolveModuleWebRoot` for the same reason that function lives here:
+ * ONE application of the convention, by the one party that can resolve it for
+ * a module that is not running. Does NOT check that the directory exists — a
+ * module with no generated site content has no overlay, and deciding what an
+ * absent directory means belongs to the caller (see `requireWebRoot`).
+ */
+export function resolveModuleStateWebRoot(moduleId: string, db: DbClient): string | undefined {
+  const module = db.select().from(modules).where(eq(modules.id, moduleId)).get();
+  if (!module) return undefined;
+  return join(module.sourcePath, MODULE_STATE_WEB_ROOT);
+}

package/src/policy/fixture-capability-coverage.test.ts

@@ -0,0 +1,322 @@
+/**
+ * A module's e2e fixtures must deploy (at least import) a provider for every
+ * capability its manifest requires.
+ *
+ * The failure this exists to catch is silent in the worst way: the manifest
+ * requirement makes stage 1 of the module's own suite fail at
+ * `module import <id>` with "Required capability 'X' not found", and every
+ * later stage cascade-skips on requireStage. Nothing else goes red — the
+ * suite is quarantined, or CI never runs it, so a fixture can sit
+ * structurally incapable of passing for six weeks (celilo#1260:
+ * registry-pipeline required idp@1.2.0 from 7e2d27b9 onward and never
+ * deployed an idp provider).
+ *
+ * Both sides of the comparison are computed sets. The required set comes
+ * from each module's manifest.yml parsed by the production validator; the
+ * provided set comes from the manifests of whatever modules the module's
+ * fixtures actually import (`module import <ref>` statements, scanned in
+ * source). A hand-written list of "modules that need an idp" would rot the
+ * moment the next module declares the requirement.
+ *
+ * The check runs the real `validateCapabilityAccess` against an in-memory
+ * database seeded with the fixtures' providers — the same code path the CLI
+ * executes at import time, including the secret-allowlist gate — so the
+ * assertion is over the actual contract stage 1 exercises, not a re-derivation
+ * of it.
+ *
+ * ## What this gate does NOT prove. Read before trusting green.
+ *
+ * - Import is necessary, not sufficient. A fixture can import the provider
+ *   and still deploy the consumer before it, or never deploy the provider
+ *   at all (the consumer's on_install would then fail against a dead idp).
+ *   Only running the suite proves deploy order.
+ * - The import scan is a source scan. An import built dynamically in a way
+ *   this scanner cannot parse is invisible here (the scanner requires a
+ *   literal module id, a `${CONST}` reference to a string literal in the
+ *   same file, or a trailing path segment).
+ * - Fixtures living outside `modules/<id>/e2e/*.test.ts` (shared harness
+ *   files that deploy on the suite's behalf) are not scanned.
+ */
+
+import { Database, type Database as DatabaseType } from 'bun:sqlite';
+import { describe, expect, test } from 'bun:test';
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { validateCapabilityAccess } from '../capabilities/validation';
+import type { ModuleManifest } from '../manifest/schema';
+import { validateManifest } from '../manifest/validate';
+import { repoRoot } from './capability-shape';
+
+/** Every module manifest under `modulesDir`, parsed by the production validator. */
+function loadModuleManifests(modulesDir: string): Map<string, ModuleManifest> {
+  const manifests = new Map<string, ModuleManifest>();
+  for (const id of readdirSync(modulesDir)) {
+    const path = join(modulesDir, id, 'manifest.yml');
+    if (!existsSync(path)) continue;
+    const result = validateManifest(readFileSync(path, 'utf8'));
+    if (result.success) manifests.set(id, result.data);
+    // Manifests that fail validation are another gate's job (validate.test.ts
+    // and scripts/check-modules.sh); scanning them here would double-report.
+  }
+  return manifests;
+}
+
+/**
+ * Module ids a fixture source imports, via `module import <ref>` statements.
+ *
+ * Handles the three shapes fixtures actually use: a bare literal
+ * (`'module import authentik'`), a path (`'module import /celilo/modules/authentik'`),
+ * and a `${CONST}` reference to a string literal defined in the same file
+ * (`module import ${PRIMARY}`). Trailing CLI flags (`--accept-aspects`) and
+ * timeouts are stripped. Anything that does not resolve to a plausible
+ * module id is skipped rather than guessed.
+ */
+function scanFixtureImports(fixtureSource: string): string[] {
+  const constants = new Map<string, string>();
+  for (const match of fixtureSource.matchAll(/const\s+(\w+)\s*=\s*'([^']+)'/g)) {
+    constants.set(match[1], match[2]);
+  }
+
+  const imports: string[] = [];
+  for (const match of fixtureSource.matchAll(/module import ([^'"\n]+?)['"`]/g)) {
+    let ref = match[1].trim();
+    const constRef = ref.match(/^\$\{(\w+)\}/);
+    if (constRef) ref = constants.get(constRef[1]) ?? '';
+    const id = ref.split(/\s+/)[0]?.split('/').pop() ?? '';
+    if (id && /^[a-z0-9-]+$/.test(id)) imports.push(id);
+  }
+  return imports;
+}
+
+/** The union of modules any `*.test.ts` fixture in `moduleId`'s e2e/ imports. */
+function fixtureImportedModules(modulesDir: string, moduleId: string): string[] {
+  const e2eDir = join(modulesDir, moduleId, 'e2e');
+  if (!existsSync(e2eDir)) return [];
+  const imported = new Set<string>();
+  for (const file of readdirSync(e2eDir)) {
+    if (!file.endsWith('.test.ts')) continue;
+    for (const id of scanFixtureImports(readFileSync(join(e2eDir, file), 'utf8'))) {
+      imported.add(id);
+    }
+  }
+  return [...imported];
+}
+
+/**
+ * An in-memory database shaped like the CLI's module registry, seeded with
+ * every capability `modules` provide — what `getProviderManifest` queries.
+ */
+function providerDatabase(manifests: Map<string, ModuleManifest>): DatabaseType {
+  const db = new Database(':memory:');
+  db.exec('CREATE TABLE modules (id TEXT PRIMARY KEY, manifest_data TEXT)');
+  db.exec('CREATE TABLE capabilities (module_id TEXT, capability_name TEXT)');
+  const insertModule = db.prepare('INSERT INTO modules (id, manifest_data) VALUES (?, ?)');
+  const insertCapability = db.prepare(
+    'INSERT INTO capabilities (module_id, capability_name) VALUES (?, ?)',
+  );
+  for (const [id, manifest] of manifests) {
+    insertModule.run(id, JSON.stringify(manifest));
+    for (const capability of manifest.provides?.capabilities ?? []) {
+      insertCapability.run(id, capability.name);
+    }
+  }
+  return db;
+}
+
+/**
+ * Modules with e2e fixtures whose required capabilities no imported module
+ * provides. The provider union is seeded into a real database and each
+ * consumer is checked with the production `validateCapabilityAccess`.
+ */
+async function capabilityCoverageViolations(modulesDir: string): Promise<string[]> {
+  const manifests = loadModuleManifests(modulesDir);
+  const violations: string[] = [];
+  for (const [id, manifest] of manifests) {
+    if (fixtureImportedModules(modulesDir, id).length === 0) continue;
+    const imported = fixtureImportedModules(modulesDir, id)
+      .map((dep) => manifests.get(dep))
+      .filter((m): m is ModuleManifest => m !== undefined);
+    const db = providerDatabase(new Map(imported.map((m) => [m.id, m])));
+    try {
+      const result = await validateCapabilityAccess(manifest, db);
+      if (!result.success) {
+        violations.push(`${id}: ${result.error ?? 'unknown error'}`);
+      }
+    } finally {
+      db.close();
+    }
+  }
+  return violations;
+}
+
+describe('fixture capability coverage', () => {
+  test('every module with e2e fixtures imports a provider for each required capability', async () => {
+    const violations = await capabilityCoverageViolations(join(repoRoot(), 'modules'));
+    expect(violations).toEqual([]);
+  });
+
+  // Reach measurement (Rule 2 of the lane plan): the real scanner and checker
+  // run against a mirrored module tree with planted markers, so the pass and
+  // fail cases are both proven to fire — not reasoned about. This is the
+  // mutation test for the gate itself: the real-tree test above can only go
+  // green, so the mirror is where the gate is shown to fail.
+  describe('reach: the gate fires on a mirrored tree (synthetic modules)', () => {
+    function mirrorTree(
+      dir: string,
+      modules: Record<string, { manifest: string; fixtures?: string[] }>,
+    ): string {
+      mkdirSync(dir, { recursive: true });
+      for (const [id, spec] of Object.entries(modules)) {
+        const moduleDir = join(dir, id);
+        mkdirSync(join(moduleDir, 'e2e'), { recursive: true });
+        writeFileSync(join(moduleDir, 'manifest.yml'), spec.manifest);
+        for (const [i, fixture] of (spec.fixtures ?? []).entries()) {
+          writeFileSync(join(moduleDir, 'e2e', `fixture-${i}.test.ts`), fixture);
+        }
+      }
+      return dir;
+    }
+
+    const providerManifest = [
+      'celilo_contract: "1.0"',
+      'id: marker-provider',
+      'name: Marker Provider',
+      'version: 1.0.0',
+      'description: synthetic provider',
+      'provides:',
+      '  capabilities:',
+      '    - name: marker_cap',
+      '      version: 1.0.0',
+      '',
+    ].join('\n');
+
+    const consumerFixture = "await net.celilo('module import marker-provider');\n";
+
+    test('a fixture importing the provider satisfies the requirement', async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'cap-coverage-ok-'));
+      try {
+        mirrorTree(dir, {
+          'marker-provider': { manifest: providerManifest },
+          'marker-consumer': {
+            manifest: [
+              'celilo_contract: "1.0"',
+              'id: marker-consumer',
+              'name: Marker Consumer',
+              'version: 1.0.0',
+              'description: synthetic consumer',
+              'requires:',
+              '  capabilities:',
+              '    - name: marker_cap',
+              '      version: 1.0.0',
+              '',
+            ].join('\n'),
+            fixtures: [consumerFixture],
+          },
+        });
+        expect(await capabilityCoverageViolations(dir)).toEqual([]);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
+    test('a fixture missing the provider fails, naming the module and capability', async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'cap-coverage-fail-'));
+      try {
+        mirrorTree(dir, {
+          'marker-provider': { manifest: providerManifest },
+          'marker-consumer': {
+            manifest: [
+              'celilo_contract: "1.0"',
+              'id: marker-consumer',
+              'name: Marker Consumer',
+              'version: 1.0.0',
+              'description: synthetic consumer',
+              'requires:',
+              '  capabilities:',
+              '    - name: marker_cap',
+              '      version: 1.0.0',
+              '    - name: marker_other',
+              '      version: 1.0.0',
+              '',
+            ].join('\n'),
+            // provider-b covers marker_cap; nothing covers marker_other
+            fixtures: [consumerFixture],
+          },
+          'marker-nonprovider': {
+            manifest: providerManifest.replace('marker_cap', 'marker_other'),
+          },
+        });
+        const violations = await capabilityCoverageViolations(dir);
+        expect(violations).toEqual([
+          expect.stringContaining("marker-consumer: Required capability 'marker_other' not found"),
+        ]);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
+    test('a privilege the framework grants needs no provider', async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'cap-coverage-priv-'));
+      try {
+        mirrorTree(dir, {
+          'marker-consumer': {
+            manifest: [
+              'celilo_contract: "1.0"',
+              'id: marker-consumer',
+              'name: Marker Consumer',
+              'version: 1.0.0',
+              'description: synthetic consumer',
+              'requires:',
+              '  capabilities:',
+              '    - name: cross_module_read',
+              '      version: 1.0.0',
+              '',
+            ].join('\n'),
+            fixtures: ["await net.celilo('module import nothing-here');\n"],
+          },
+        });
+        expect(await capabilityCoverageViolations(dir)).toEqual([]);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
+    test('a ${CONST} import resolves through the same-file string literal', async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'cap-coverage-const-'));
+      try {
+        mirrorTree(dir, {
+          'marker-provider': { manifest: providerManifest },
+          'marker-consumer': {
+            manifest: [
+              'celilo_contract: "1.0"',
+              'id: marker-consumer',
+              'name: Marker Consumer',
+              'version: 1.0.0',
+              'description: synthetic consumer',
+              'requires:',
+              '  capabilities:',
+              '    - name: marker_cap',
+              '      version: 1.0.0',
+              '',
+            ].join('\n'),
+            fixtures: [
+              "const PROVIDER = 'marker-provider';\nawait net.celilo(`module import ${PROVIDER} --accept-aspects`);\n",
+            ],
+          },
+        });
+        expect(await capabilityCoverageViolations(dir)).toEqual([]);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+  });
+});

package/src/policy/module-script-scan.test.ts

@@ -12,7 +12,11 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { buildModule } from '../module/packaging/build';
-import { scanModuleDirectory, scanModuleScriptSource } from './module-script-scan';
+import {
+  JAILED_CLI_SPAWN_RULE,
+  scanModuleDirectory,
+  scanModuleScriptSource,
+} from './module-script-scan';
 
 const rules = (src: string) => scanModuleScriptSource('f.ts', src).map((v) => v.rule);
 
@@ -60,6 +64,43 @@ describe('module script scan — namespace tools (hygiene, not a boundary)', ()
   });
 });
 
+describe('module script scan — jailed CLI spawn rule', () => {
+  // Each spawn spelling asserted separately. An alternation that loses a leg
+  // still passes a test that only exercises the first.
+  it.each([
+    [
+      "execFileSync('celilo', argv)",
+      "execFileSync('celilo', ['module', 'config', 'set', 'x', 'y']);",
+    ],
+    ['execFileSync("celilo", argv)', 'execFileSync("celilo", args);'],
+    ['execSync(`celilo …`)', 'execSync(`celilo module secret set x y`);'],
+    [
+      'exec(`celilo …`) after a shell prefix',
+      'exec(`cd /opt && sudo celilo system config get k`);',
+    ],
+    ["spawn('celilo', argv)", "const child = spawn('celilo', ['events', 'status']);"],
+  ])('catches %s', (_spelling, src) => {
+    expect(rules(src)).toContain(JAILED_CLI_SPAWN_RULE);
+  });
+
+  it('does not fire on operator prose that merely names the CLI', () => {
+    expect(rules('throw new Error("re-run `celilo module deploy x` to regenerate it");')).toEqual(
+      [],
+    );
+  });
+
+  // The `\w` after `celilo ` is what separates a CLI invocation from an
+  // argument that merely begins with the string, so the negative case has to
+  // be a hyphenated name, which would match a bare `\bcelilo\b`.
+  it('does not fire on a container argument named celilo-*', () => {
+    expect(rules('execSync(`docker exec celilo-mgr status`);')).toEqual([]);
+  });
+
+  it('does not fire on the celilo.db file name', () => {
+    expect(rules('execSync(`cp /var/lib/celilo/celilo.db /tmp/x`);')).toEqual([]);
+  });
+});
+
 describe('module script scan — raw-exec escape hatch', () => {
   it('flags a runAppCommand call with no justification', () => {
     expect(rules('const r = runAppCommand(system, "rm -f /tmp/x", run);')).toContain(