@celilo/cli 2.1.0 → 2.2.1

package/src/services/fleet-key.test.ts

@@ -5,10 +5,12 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { ensureFleetKey, getFleetSshDir } from './fleet-key';
+import { resetTestDbPath } from '../test-utils/db-path';
+import { ensureFleetKey, findFleetPrivateKey, getFleetSshDir } from './fleet-key';
 
 describe('ensureFleetKey', () => {
   let dataDir: string;
@@ -19,7 +21,7 @@ describe('ensureFleetKey', () => {
   });
 
   afterEach(() => {
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dataDir, { recursive: true, force: true });
   });
 
@@ -45,3 +47,66 @@ describe('ensureFleetKey', () => {
     expect(second.publicKey).toBe(first.publicKey);
   });
 });
+
+describe('findFleetPrivateKey', () => {
+  let dataDir: string;
+  let homeDir: string;
+  let realHome: string | undefined;
+
+  beforeEach(() => {
+    dataDir = mkdtempSync(join(tmpdir(), 'celilo-fleet-find-'));
+    homeDir = mkdtempSync(join(tmpdir(), 'celilo-fleet-home-'));
+    process.env.CELILO_DB_PATH = join(dataDir, 'celilo.db');
+    realHome = process.env.HOME;
+    process.env.HOME = homeDir;
+  });
+
+  afterEach(() => {
+    resetTestDbPath();
+    process.env.HOME = realHome;
+    rmSync(dataDir, { recursive: true, force: true });
+    rmSync(homeDir, { recursive: true, force: true });
+  });
+
+  /** A second, unrelated keypair in $HOME/.ssh, as every real box has. */
+  function plantHomeKey(): string {
+    const dir = join(homeDir, '.ssh');
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = join(dir, 'id_ed25519');
+    execFileSync('ssh-keygen', ['-t', 'ed25519', '-N', '', '-f', path, '-C', 'someone-else'], {
+      stdio: 'pipe',
+    });
+    return readFileSync(`${path}.pub`, 'utf-8').trim();
+  }
+
+  it('finds the key celilo minted, even when $HOME holds a different one', () => {
+    // This is celilo#1240. `ensureFleetKey` mints into the data dir and
+    // `machine add` searched $HOME only, so a fleet whose key celilo minted
+    // could not add a machine without --ssh-key-file. The e2e management
+    // container has both directories populated with DIFFERENT keys, which is
+    // why it failed there and not on a developer's box.
+    const homePublicKey = plantHomeKey();
+    const fleet = ensureFleetKey();
+    expect(fleet.publicKey).not.toBe(homePublicKey);
+
+    const found = findFleetPrivateKey(fleet.publicKey);
+
+    expect(found).toBe(join(dataDir, '.ssh', 'id_ed25519'));
+  });
+
+  it('still finds a key that only lives in $HOME', () => {
+    // The auto-detected case: `initializeSystem` reads $HOME/.ssh when
+    // ssh.public_key is unset, and that fleet must keep working.
+    const homePublicKey = plantHomeKey();
+
+    expect(findFleetPrivateKey(homePublicKey)).toBe(join(homeDir, '.ssh', 'id_ed25519'));
+  });
+
+  it('returns null when no private key matches the recorded public half', () => {
+    plantHomeKey();
+    const orphan =
+      'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA nobody';
+
+    expect(findFleetPrivateKey(orphan)).toBeNull();
+  });
+});

package/src/services/fleet-key.ts

@@ -73,3 +73,57 @@ export function ensureFleetKey(): FleetKey {
 
   return { publicKey: readFileSync(publicKeyPath, 'utf-8').trim(), created: true };
 }
+
+/**
+ * Every directory a fleet private key may sit in, in priority order.
+ *
+ * Exported so an error message names exactly what was searched. The message
+ * used to say "~/.ssh/" while the search had already been widened, which is a
+ * smaller version of the bug this whole helper exists to prevent.
+ */
+export function fleetKeySearchDirs(): string[] {
+  return [getFleetSshDir(), join(process.env.HOME ?? '~', '.ssh')];
+}
+
+/**
+ * The private key whose public half is `publicKey`, or null.
+ *
+ * Searches celilo's own key directory FIRST and `$HOME/.ssh` second, and the
+ * order is the point. Two different keys are normally present: the one
+ * `ensureFleetKey` minted, which is what celilo authorizes on managed
+ * machines, and whatever keypair the operator or the base image left in the
+ * home directory. Only the first can open a machine celilo provisioned.
+ *
+ * This lives beside `getFleetSshDir` for the reason that helper exists. The
+ * caller that searched for the key hand-derived its own `join(HOME, '.ssh')`
+ * and therefore could not see a minted key at all (celilo#1240).
+ *
+ * Matching ignores the trailing comment, because ssh-keygen writes
+ * `user@host` there and the recorded public half carries `celilo-fleet`.
+ */
+export function findFleetPrivateKey(publicKey: string): string | null {
+  const [type, material] = publicKey.trim().split(/\s+/);
+  if (!type || !material) return null;
+
+  const byType: Record<string, string[]> = {
+    'ssh-ed25519': ['id_ed25519'],
+    'ssh-rsa': ['id_rsa'],
+    'ecdsa-sha2-nistp256': ['id_ecdsa'],
+    'ecdsa-sha2-nistp384': ['id_ecdsa'],
+    'ecdsa-sha2-nistp521': ['id_ecdsa'],
+  };
+  const candidates = byType[type] ?? ['id_ed25519', 'id_rsa', 'id_ecdsa'];
+
+  for (const dir of fleetKeySearchDirs()) {
+    if (!existsSync(dir)) continue;
+    for (const name of candidates) {
+      const keyPath = join(dir, name);
+      const pubPath = `${keyPath}.pub`;
+      if (!existsSync(keyPath) || !existsSync(pubPath)) continue;
+      const [fileType, fileMaterial] = readFileSync(pubPath, 'utf-8').trim().split(/\s+/);
+      if (fileType === type && fileMaterial === material) return keyPath;
+    }
+  }
+
+  return null;
+}

package/src/services/health-runner.ts

@@ -11,6 +11,7 @@ import type { DbClient } from '../db/client';
 import { type ModuleState, modules } from '../db/schema';
 import { loadCapabilityFunctions } from '../hooks/capability-loader';
 import { invokeHook } from '../hooks/executor';
+import { createHookStores } from '../hooks/hook-store';
 import { loadHookConfigMap } from '../hooks/load-hook-config';
 import { createCapturingLogger, createConsoleLogger, createGaugeLogger } from '../hooks/logger';
 import type { HookLogger, HookResult } from '../hooks/types';
@@ -212,6 +213,7 @@ export async function runModuleHealthCheck(
       requiredCapabilities,
       systems: getModuleSystems(moduleId, db),
       remoteAccess: remoteAccessPolicy(moduleId, db),
+      hookStores: () => createHookStores(db, moduleId),
     },
   );
   presentation.finish(hookResult.success);

package/src/services/infrastructure-selector.test.ts

@@ -10,6 +10,7 @@ import { closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
 import type { Module } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { addContainerService } from './container-service';
 import { InfrastructureError, selectInfrastructure } from './infrastructure-selector';
 import { addMachine } from './machine-pool';
@@ -46,7 +47,7 @@ describe('infrastructure-selector', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_MASTER_KEY_PATH = undefined;
   });
 

package/src/services/infrastructure-variable-resolver.test.ts

@@ -11,6 +11,7 @@ import {
 } from '@/db/schema';
 import type { ModuleManifest } from '@/manifest/schema';
 import { and, eq } from 'drizzle-orm';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { resolveInfrastructureVariables } from './infrastructure-variable-resolver';
 import { upsertModuleConfig } from './module-config';
 
@@ -38,7 +39,7 @@ beforeEach(() => {
 
 afterEach(async () => {
   db.$client.close();
-  process.env.CELILO_DB_PATH = undefined;
+  resetTestDbPath();
 
   // Clean up database files
   if (existsSync(TEST_DB_PATH)) {

package/src/services/machine-pool.test.ts

@@ -10,6 +10,7 @@ import { eq } from 'drizzle-orm';
 import { closeDb, createDbClient, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { machines, moduleInfrastructure, modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   addMachine,
   getMachine,
@@ -52,7 +53,7 @@ describe('machine-pool', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_MASTER_KEY_PATH = undefined;
   });
 

package/src/services/module-config.test.ts

@@ -9,6 +9,7 @@ import { join } from 'node:path';
 import { closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   formatConfigValue,
   getAllModuleConfigValues,
@@ -59,7 +60,7 @@ describe('module-config service', () => {
   afterEach(() => {
     closeDb();
     // Clean up environment variable
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     // Clean up test database
     rmSync(testDir, { recursive: true, force: true });
   });

package/src/services/module-config.ts

@@ -90,6 +90,7 @@ export function upsertModuleConfig(
   moduleId: string,
   key: string,
   value: string | number | boolean | unknown[] | Record<string, unknown> | null,
+  source?: 'hook',
 ): void {
   if (value === null || value === undefined) {
     throw new Error(`upsertModuleConfig(${moduleId}, ${key}): value must not be null/undefined`);
@@ -97,11 +98,28 @@ export function upsertModuleConfig(
   const valueJson = JSON.stringify(value);
   const displayValue = isComplexValue(value) ? valueJson : String(value);
 
+  // `source` records who owns the row (hook-owned-state design D7 — the same
+  // column `derived-value-recomputation` reads). Absent keeps the legacy
+  // pre-column shape for every existing caller: operator and interview writes
+  // stay sourceless until that change gives them their own value to write.
+  // Only the hook config store passes 'hook', and only a hook may: the
+  // manifest refuses `module config set` on any source: hook variable.
   db.insert(moduleConfigs)
-    .values({ moduleId, key, value: displayValue, valueJson })
+    .values({
+      moduleId,
+      key,
+      value: displayValue,
+      valueJson,
+      ...(source !== undefined ? { source } : {}),
+    })
     .onConflictDoUpdate({
       target: [moduleConfigs.moduleId, moduleConfigs.key],
-      set: { value: displayValue, valueJson, updatedAt: new Date() },
+      set: {
+        value: displayValue,
+        valueJson,
+        updatedAt: new Date(),
+        ...(source !== undefined ? { source } : {}),
+      },
     })
     .run();
 }

package/src/services/module-deploy.dns-repoint.test.ts

@@ -0,0 +1,188 @@
+// Slice 3 of openspec/changes/module-orchestrator-primitives: celilo performs
+// the dns.primary repoint when a dns_internal provider deploys (D5), gated on
+// an askConfirm interview. knot's on_install no longer touches these keys.
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { type DbClient, closeDb, getDb } from '../db/client';
+import { runMigrations } from '../db/migrate';
+import { capabilities, moduleSystems, modules, systemConfig } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
+import { InterviewUnansweredError } from './interview-errors';
+import { planDnsRepoint, repointDnsPrimaryForProvider } from './module-deploy';
+
+const MODULE_ID = 'knot-unbound-internal';
+const SERVER_IP = '10.226.10.53';
+
+type AskOpts = { scope: string; key: string; message: string };
+
+function makeAsk(answer: boolean): ((opts: AskOpts) => Promise<boolean>) & { calls: AskOpts[] } {
+  const calls: AskOpts[] = [];
+  const ask = async (opts: AskOpts) => {
+    calls.push(opts);
+    return answer;
+  };
+  return Object.assign(ask, { calls });
+}
+
+function makeAskThrowing(err: Error): ((opts: AskOpts) => Promise<boolean>) & { calls: AskOpts[] } {
+  const calls: AskOpts[] = [];
+  const ask = async (opts: AskOpts) => {
+    calls.push(opts);
+    throw err;
+  };
+  return Object.assign(ask, { calls });
+}
+
+describe('repointDnsPrimaryForProvider (module-orchestrator-primitives slice 3)', () => {
+  let dir: string;
+  let db: DbClient;
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-dns-repoint-'));
+    process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
+    await runMigrations(process.env.CELILO_DB_PATH);
+    db = getDb();
+    seedProvider();
+  });
+
+  afterEach(() => {
+    closeDb();
+    resetTestDbPath();
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* temp dir cleanup is best-effort */
+    }
+  });
+
+  function seedProvider() {
+    db.insert(modules)
+      .values({
+        id: MODULE_ID,
+        name: MODULE_ID,
+        version: '1.3.4',
+        manifestData: { id: MODULE_ID, name: MODULE_ID, version: '1.3.4', celilo_contract: '1.0' },
+        sourcePath: `/tmp/${MODULE_ID}`,
+      })
+      .run();
+    db.insert(capabilities)
+      .values({ moduleId: MODULE_ID, capabilityName: 'dns_internal', version: '1.0.0', data: {} })
+      .run();
+    db.insert(moduleSystems)
+      .values({
+        moduleId: MODULE_ID,
+        name: 'main',
+        hostname: 'dns',
+        ipv4Address: SERVER_IP,
+        zone: 'dmz',
+        infraType: 'container_service',
+      })
+      .run();
+  }
+
+  function setConfig(key: string, value: string) {
+    db.insert(systemConfig)
+      .values({ key, value })
+      .onConflictDoUpdate({ target: systemConfig.key, set: { value } })
+      .run();
+  }
+
+  function configValue(key: string): string | undefined {
+    return db.select().from(systemConfig).where(eq(systemConfig.key, key)).get()?.value;
+  }
+
+  test('3.1: repoints dns.primary at the resolver and demotes the prior primary WITHOUT losing the existing fallback', async () => {
+    setConfig('dns.primary', '1.1.1.1');
+    setConfig('dns.fallback', '8.8.8.8');
+    const ask = makeAsk(true);
+
+    await repointDnsPrimaryForProvider(MODULE_ID, db, ask);
+
+    expect(configValue('dns.primary')).toBe(SERVER_IP);
+    // The WHOLE resulting value: the existing fallback must survive beside the
+    // demoted prior primary (D5's secondary observation — knot's hook lost it).
+    expect(configValue('dns.fallback')).toBe('1.1.1.1,8.8.8.8');
+    expect(ask.calls).toHaveLength(1);
+    expect(ask.calls[0].message).toContain(SERVER_IP);
+    expect(ask.calls[0].message).toContain('1.1.1.1');
+  });
+
+  test('3.1: demotes the prior primary to dns.fallback when no fallback existed', async () => {
+    setConfig('dns.primary', '1.1.1.1');
+    const ask = makeAsk(true);
+
+    await repointDnsPrimaryForProvider(MODULE_ID, db, ask);
+
+    expect(configValue('dns.primary')).toBe(SERVER_IP);
+    expect(configValue('dns.fallback')).toBe('1.1.1.1');
+  });
+
+  test('3.1: sets dns.primary without touching dns.fallback when no primary was set', async () => {
+    const ask = makeAsk(true);
+
+    await repointDnsPrimaryForProvider(MODULE_ID, db, ask);
+
+    expect(configValue('dns.primary')).toBe(SERVER_IP);
+    expect(configValue('dns.fallback')).toBeUndefined();
+  });
+
+  test('does not ask when dns.primary already names this resolver (re-deploy)', async () => {
+    setConfig('dns.primary', SERVER_IP);
+    setConfig('dns.fallback', '8.8.8.8');
+    const ask = makeAsk(true);
+
+    await repointDnsPrimaryForProvider(MODULE_ID, db, ask);
+
+    expect(ask.calls).toHaveLength(0);
+    expect(configValue('dns.primary')).toBe(SERVER_IP);
+    expect(configValue('dns.fallback')).toBe('8.8.8.8');
+  });
+
+  test('3.2: a negative answer leaves both keys unchanged and does not fail the deploy', async () => {
+    setConfig('dns.primary', '1.1.1.1');
+    setConfig('dns.fallback', '8.8.8.8');
+    const ask = makeAsk(false);
+
+    await expect(repointDnsPrimaryForProvider(MODULE_ID, db, ask)).resolves.toBeUndefined();
+
+    expect(configValue('dns.primary')).toBe('1.1.1.1');
+    expect(configValue('dns.fallback')).toBe('8.8.8.8');
+    expect(ask.calls).toHaveLength(1);
+  });
+
+  test('no responder able to answer (headless) is a defined skip, never a hang', async () => {
+    setConfig('dns.primary', '1.1.1.1');
+    const ask = makeAskThrowing(
+      new InterviewUnansweredError('interview.required.deploy:knot.repoint_dns_primary', 'nobody'),
+    );
+
+    await expect(repointDnsPrimaryForProvider(MODULE_ID, db, ask)).resolves.toBeUndefined();
+
+    expect(configValue('dns.primary')).toBe('1.1.1.1');
+  });
+});
+
+describe('planDnsRepoint', () => {
+  test('merges the existing fallback without duplicating the demoted primary', () => {
+    const plan = planDnsRepoint({
+      serverIp: SERVER_IP,
+      priorPrimary: '1.1.1.1',
+      existingFallback: '1.1.1.1,9.9.9.9',
+    });
+    expect(plan.needsRepoint).toBe(true);
+    expect(plan.newFallback).toBe('1.1.1.1,9.9.9.9');
+  });
+
+  test('already-primary is a no-op plan', () => {
+    const plan = planDnsRepoint({
+      serverIp: SERVER_IP,
+      priorPrimary: SERVER_IP,
+      existingFallback: '8.8.8.8',
+    });
+    expect(plan.needsRepoint).toBe(false);
+    expect(plan.newFallback).toBeUndefined();
+  });
+});