@celilo/cli 2.1.0 → 2.2.1

package/src/services/trusted-sources.test.ts

@@ -6,6 +6,7 @@ import type { DbClient } from '../db/client';
 import { systemConfig } from '../db/schema';
 import { loadTrustedSubnets } from '../hooks/capability-loader';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   buildTrustedSourceStore,
   composeTrustedSubnets,
@@ -30,7 +31,7 @@ describe('trusted-source store', () => {
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -147,7 +148,7 @@ describe('the render input excludes registrations; the reporting view includes t
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -256,5 +257,35 @@ describe('parsing the operator override', () => {
   it('an unset key contributes nothing', () => {
     expect(parseOperatorTrustedSubnets(undefined)).toEqual([]);
     expect(parseOperatorTrustedSubnets('')).toEqual([]);
+    expect(parseOperatorTrustedSubnets('   ')).toEqual([]);
+  });
+
+  it('parses the JSON-array form every sibling config key uses', () => {
+    expect(parseOperatorTrustedSubnets('["10.226.120.0/24"]')).toEqual(['10.226.120.0/24']);
+    expect(parseOperatorTrustedSubnets('[ "10.1.0.0/24" , "10.2.0.0/24" ]')).toEqual([
+      '10.1.0.0/24',
+      '10.2.0.0/24',
+    ]);
+  });
+
+  it('refuses a JSON-looking value that does not parse to an array of strings', () => {
+    // The exact e2e failure (ce-yaqa): a JSON array read as ONE subnet named
+    // ["10.226.120.0/24"], rendered verbatim into rules.v4, and
+    // iptables-restore failed the converge with "Bad argument `]'".
+    expect(() => parseOperatorTrustedSubnets('{"a":1}')).toThrow(/JSON array of CIDR strings/);
+    expect(() => parseOperatorTrustedSubnets('["10.0.0.0/24", 5]')).toThrow(
+      /JSON array of CIDR strings/,
+    );
+    expect(() => parseOperatorTrustedSubnets('[10.0.0.0/24')).toThrow(
+      /looks like JSON but does not parse/,
+    );
+  });
+
+  it('refuses a token that is not an IPv4 CIDR, naming it', () => {
+    expect(() => parseOperatorTrustedSubnets('10.0.0.1')).toThrow(/10\.0\.0\.1/);
+    expect(() => parseOperatorTrustedSubnets('10.0.0.1')).toThrow(/not an IPv4 CIDR/);
+    expect(() => parseOperatorTrustedSubnets('10.0.0.0/24, hostname.local')).toThrow(
+      /hostname\.local/,
+    );
   });
 });

package/src/services/trusted-sources.ts

@@ -14,6 +14,7 @@ import type {
   TrustedSource,
   TrustedSourceStore,
 } from '@celilo/capabilities';
+import { isCidr } from '@celilo/capabilities';
 import { and, eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { trustedSources } from '../db/schema';
@@ -80,20 +81,56 @@ export interface TrustedSubnetEntry {
 }
 
 /**
- * The operator's explicit trusted sources, as a comma-separated CIDR list in
- * system config. ADDITIVE rather than replacing the derived control-plane
- * subnet: dropping control-plane trust would block the SSH celilo uses to run
- * every hook and converge, so an operator cannot strand celilo's own management
- * by naming a subnet here.
+ * The operator's explicit trusted sources, in system config. Accepts the two
+ * forms a config value takes in this area: a comma-separated CIDR list and a
+ * JSON array of CIDRs (the form every sibling key uses, e.g. ddns_passwords).
+ *
+ * Every token must be a CIDR. The parser is the single choke point between the
+ * operator's value and the ruleset renderer, which emits each subnet verbatim
+ * into rules.v4 — a token that is not a CIDR used to ride through as a literal
+ * subnet name and iptables-restore failed the whole converge with
+ * "Bad argument `]'". Failing here names the token instead.
+ *
+ * ADDITIVE rather than replacing the derived control-plane subnet: dropping
+ * control-plane trust would block the SSH celilo uses to run every hook and
+ * converge, so an operator cannot strand celilo's own management by naming a
+ * subnet here.
  */
 export const TRUSTED_SUBNETS_CONFIG_KEY = 'firewall.trusted_subnets';
 
 export function parseOperatorTrustedSubnets(raw: string | undefined): string[] {
-  if (!raw) return [];
-  return raw
-    .split(',')
-    .map((s) => s.trim())
-    .filter((s) => s.length > 0);
+  if (!raw || raw.trim().length === 0) return [];
+
+  let tokens: string[];
+  const trimmed = raw.trim();
+  if (trimmed.startsWith('[') || trimmed.startsWith('{')) {
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      throw new Error(
+        `${TRUSTED_SUBNETS_CONFIG_KEY} looks like JSON but does not parse: ${raw}. Expected a JSON array of CIDRs, e.g. ["10.0.0.0/24"], or a comma-separated CIDR list.`,
+      );
+    }
+    if (!Array.isArray(parsed) || parsed.some((t) => typeof t !== 'string')) {
+      throw new Error(
+        `${TRUSTED_SUBNETS_CONFIG_KEY} must be a JSON array of CIDR strings, e.g. ["10.0.0.0/24"], or a comma-separated CIDR list.`,
+      );
+    }
+    tokens = parsed;
+  } else {
+    tokens = trimmed.split(',');
+  }
+
+  const subnets = tokens.map((s) => s.trim()).filter((s) => s.length > 0);
+  for (const subnet of subnets) {
+    if (!isCidr(subnet)) {
+      throw new Error(
+        `${TRUSTED_SUBNETS_CONFIG_KEY} contains "${subnet}", which is not an IPv4 CIDR. Expected e.g. 10.0.0.0/24 (comma-separated) or ["10.0.0.0/24"] (JSON array).`,
+      );
+    }
+  }
+  return subnets;
 }
 
 /**

package/src/services/zone-detector.test.ts

@@ -9,6 +9,7 @@ import { join } from 'node:path';
 import { closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { systemConfig } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { detectZoneFromIp, isValidIp } from './zone-detector';
 
 describe('zone-detector', () => {
@@ -46,7 +47,7 @@ describe('zone-detector', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   describe('detectZoneFromIp', () => {

package/src/templates/generator.ts

@@ -817,9 +817,16 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
     const configMap = new Map(configs.map((c) => [c.key, c.value || c.valueJson]));
 
     // Check for missing required variables
-    // Skip infrastructure and terraform variables - they're auto-populated during/after generation
+    // Skip infrastructure and terraform variables - they're auto-populated during/after generation.
+    // Skip hook-owned variables too: they are discovered by the module's own
+    // hooks at runtime (hook-owned-state D2), so a hook that has not run yet
+    // is not a configuration error.
     const missingVars = requiredVars.filter(
-      (v) => v.source !== 'infrastructure' && v.source !== 'terraform' && !configMap.has(v.name),
+      (v) =>
+        v.source !== 'infrastructure' &&
+        v.source !== 'terraform' &&
+        v.source !== 'hook' &&
+        !configMap.has(v.name),
     );
 
     if (missingVars.length > 0) {

package/src/test-utils/bus-responder.ts

@@ -50,6 +50,7 @@ import {
   type ResponderValues,
   startProgrammaticResponder,
 } from '../services/programmatic-responder';
+import { resetTestDbPath } from './db-path';
 
 export interface BusResponderFixtureOptions extends ResponderValues {
   /** Path to the bus sqlite db (shared with the celilo subprocess). */
@@ -98,7 +99,6 @@ export function startBusResponderFixture(opts: BusResponderFixtureOptions): BusR
   const prevDataDir = process.env.CELILO_DATA_DIR;
   process.env.CELILO_DATA_DIR = opts.dataDir;
 
-  const prevDbPath = process.env.CELILO_DB_PATH;
   process.env.CELILO_DB_PATH = opts.celiloDbPath;
   const db: DbClient = createDbClient();
 
@@ -132,8 +132,10 @@ export function startBusResponderFixture(opts: BusResponderFixtureOptions): BusR
       db.$client.close();
       if (prevDataDir === undefined) process.env.CELILO_DATA_DIR = undefined;
       else process.env.CELILO_DATA_DIR = prevDataDir;
-      if (prevDbPath === undefined) process.env.CELILO_DB_PATH = undefined;
-      else process.env.CELILO_DB_PATH = prevDbPath;
+      // Reset to the scratch path, never restore the previous value: it may
+      // be another suite's temp database, or unset — which sends the next
+      // var-less reader to the operator's real celilo.db (celilo#1315).
+      resetTestDbPath();
     },
   };
 }

package/src/test-utils/db-path.ts

@@ -0,0 +1,25 @@
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+/**
+ * The neutral database path the test preload arms `CELILO_DB_PATH` with
+ * (celilo#1315). The file does not exist, so a reader falls into whatever
+ * "no database" branch its feature has — and no test ever opens the
+ * operator's real `~/Library/.../celilo.db`, which is what a suite that
+ * reads the variable without setting it would otherwise reach.
+ *
+ * Why teardowns RESET to this path instead of `delete`: bunfig's `[test]`
+ * preload runs ONCE PER PROCESS, not once per test file. A teardown that
+ * clears the variable leaves every later var-less reader on the real
+ * database for the rest of the run. Resetting to the scratch path keeps the
+ * preload's invariant standing from the first test to the last.
+ */
+export const SCRATCH_DB_PATH = join(tmpdir(), 'celilo-test-absent.db');
+
+/**
+ * Point `CELILO_DB_PATH` at the neutral scratch path. Call from a test's
+ * afterEach (or any teardown) that pointed the variable somewhere else.
+ */
+export function resetTestDbPath(): void {
+  process.env.CELILO_DB_PATH = SCRATCH_DB_PATH;
+}

package/src/test-utils/integration.ts

@@ -54,6 +54,13 @@ export interface IntegrationTestContext {
  * ```
  */
 export async function setupIntegrationTest(): Promise<IntegrationTestContext> {
+  // celilo#1246: the shell on a dev host carries CELILO_HOME pointing at the
+  // live install (DB and master.key included). Every CLI child this harness
+  // spawns would inherit it, and isolation would then rest on the per-run
+  // CELILO_DB_PATH / CELILO_DATA_DIR overrides below never being missed.
+  // Unset it once, here, so no child ever sees the live home.
+  delete process.env.CELILO_HOME;
+
   // Setup isolated database
   const testDb = await setupTestDatabaseFile();
   const dbPath = testDb.path;

package/src/test-utils/module-fixtures.ts

@@ -8,6 +8,7 @@
  */
 
 import { CLIContext } from './cli-context';
+import { resetTestDbPath } from './db-path';
 import { getModuleTestConfig } from './fixtures';
 import { type IntegrationTestContext, setupIntegrationTest } from './integration';
 
@@ -50,7 +51,6 @@ interface HomebridgeModuleOptions extends BaseFixtureOptions {
 async function insertMockContainerService(dbPath: string): Promise<void> {
   const { getDb } = await import('../db/client');
   const { containerServices } = await import('../db/schema');
-  const originalDbPath = process.env.CELILO_DB_PATH;
   process.env.CELILO_DB_PATH = dbPath;
   try {
     const db = getDb();
@@ -77,11 +77,10 @@ async function insertMockContainerService(dbPath: string): Promise<void> {
       updatedAt: new Date(),
     });
   } finally {
-    if (originalDbPath) {
-      process.env.CELILO_DB_PATH = originalDbPath;
-    } else {
-      process.env.CELILO_DB_PATH = undefined;
-    }
+    // Reset to the scratch path, never restore the previous value: it may
+    // be another suite's temp database, or unset — which sends the next
+    // var-less reader to the operator's real celilo.db (celilo#1315).
+    resetTestDbPath();
   }
 }
 

package/src/variables/context.ts

@@ -577,19 +577,30 @@ async function assembleResolutionContext(
   // LXC boots with a working resolver — before Ansible's apt update, and
   // independent of which Proxmox node it lands on (the nodes' DNS defaults
   // diverge): the internal dns_internal resolver first (it recurses, so it
-  // also answers external names), then the public resolvers as fallback.
+  // also answers external names), then the configured fleet resolvers as
+  // fallback.
   // Bootstrap (no dns_internal provider registered yet — e.g. the DNS module's
   // own LXC) → public only, so apt still works. Injected as
   // $self:lxc_nameserver, mirroring how inventory.* are auto-derived; the
   // proxmox_lxc terraform template drops it straight into `nameserver`.
   {
-    const publicDns: string[] = [];
+    // Named for what the keys hold, not for what a reader hopes they hold:
+    // `dns.primary` / `dns.fallback` mean "the resolvers systems should use",
+    // and an operator pointing the fleet at its own resolver (a deployed
+    // dns_internal provider's address) is established, deliberate practice
+    // (celilo#1239). These entries may therefore be private. The guard against
+    // a resolver celilo installed ending up here lives where the keys are
+    // WRITTEN from host state — discovery refuses a deployed provider's
+    // address (dns-discovery.ts) — not in a privateness check here, which
+    // would break that practice while fixing nothing: in an uncovered zone
+    // dropping the entries takes DNS away rather than tightening anything.
+    const configuredDns: string[] = [];
     for (const key of ['dns.primary', 'dns.fallback']) {
       const raw = systemConfigMap[key];
       if (raw) {
         for (const part of raw.split(',')) {
           const ip = part.trim();
-          if (ip) publicDns.push(ip);
+          if (ip) configuredDns.push(ip);
         }
       }
     }
@@ -663,8 +674,8 @@ async function assembleResolutionContext(
     const nameservers = dropPublicResolvers
       ? [primaryIp, secondaryIp]
       : primaryIp
-        ? [primaryIp, ...publicDns]
-        : publicDns;
+        ? [primaryIp, ...configuredDns]
+        : configuredDns;
     const unique = [...new Set(nameservers)];
     if (unique.length > 0) {
       selfConfig.lxc_nameserver = unique.join(' ');

package/src/module/packaging/generated-plane.test.ts

@@ -1,79 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import {
-  compareVerbatimRoleAssets,
-  describeVerbatimDifferences,
-  readVerbatimRoleAssets,
-} from './generated-plane';
-
-describe('compareVerbatimRoleAssets', () => {
-  const asset = 'ansible/roles/vpn/files/vpn-linux-x86_64';
-
-  test('identical trees produce no differences', () => {
-    const both = new Map([[asset, 'aaa']]);
-    expect(compareVerbatimRoleAssets(both, new Map(both))).toEqual([]);
-  });
-
-  test('the celilo#925 shape: generated holds the previous version bytes', () => {
-    const differences = compareVerbatimRoleAssets(
-      new Map([[asset, 'new-digest']]),
-      new Map([[asset, 'old-digest']]),
-    );
-    expect(differences).toEqual([
-      {
-        relPath: asset,
-        reason: 'stale',
-        installedDigest: 'new-digest',
-        generatedDigest: 'old-digest',
-      },
-    ]);
-    expect(describeVerbatimDifferences(differences)[0]).toContain(asset);
-  });
-
-  test('an asset generation never produced is missing, not stale', () => {
-    expect(compareVerbatimRoleAssets(new Map([[asset, 'aaa']]), new Map())).toEqual([
-      { relPath: asset, reason: 'missing', installedDigest: 'aaa', generatedDigest: null },
-    ]);
-  });
-
-  test('output for a role the module no longer has is not a difference', () => {
-    // Nothing includes it, so refusing a deploy over it would refuse a correct
-    // module for a file Ansible never reads.
-    expect(
-      compareVerbatimRoleAssets(new Map(), new Map([['ansible/roles/gone/files/x', 'aaa']])),
-    ).toEqual([]);
-  });
-});
-
-describe('readVerbatimRoleAssets', () => {
-  test('digests role files/ assets and nothing else', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'celilo-plane-'));
-    try {
-      mkdirSync(join(root, 'ansible', 'roles', 'vpn', 'files', 'nested'), { recursive: true });
-      mkdirSync(join(root, 'ansible', 'roles', 'vpn', 'templates'), { recursive: true });
-      writeFileSync(join(root, 'ansible', 'roles', 'vpn', 'files', 'bin'), 'NEW');
-      writeFileSync(join(root, 'ansible', 'roles', 'vpn', 'files', 'nested', 'blob'), 'B');
-      // Templated, and expected to differ once generated. Must not be compared.
-      writeFileSync(join(root, 'ansible', 'roles', 'vpn', 'templates', 'x.j2'), '{{ v }}');
-
-      const assets = await readVerbatimRoleAssets(root);
-      expect([...assets.keys()].sort()).toEqual([
-        'ansible/roles/vpn/files/bin',
-        'ansible/roles/vpn/files/nested/blob',
-      ]);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  test('a module with no ansible/ at all yields nothing rather than throwing', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'celilo-plane-'));
-    try {
-      expect((await readVerbatimRoleAssets(root)).size).toBe(0);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-});

package/src/module/packaging/generated-plane.ts

@@ -1,134 +0,0 @@
-/**
- * The second plane: is what we would deploy built from what we installed?
- *
- * A module exists in four places — the published package, the installed tree,
- * the generated project, and the host — and celilo reported a version for the
- * first as though it described the last. Between them sit three copies and two
- * transformations, and nothing verified any of them against the one before it
- * (openspec/changes/module-integrity-rigor, D3).
- *
- * Only VERBATIM assets have a meaningful expected digest. Ansible templates
- * most of what it writes, and a `.j2` in `generated/` is supposed to differ
- * from its source. `ansible/roles/<role>/files/` is the exception: it holds
- * static assets — built binaries, certs, blobs — copied byte for byte because
- * they need no variable resolution and may not survive utf-8 round-tripping.
- *
- * That is exactly where celilo#925 lived. `copyAnsibleRoleFilesDirs` skipped an
- * existing destination on bun, so a module's built binary landed in
- * `generated/` once, at first generate, and no later version replaced it.
- * `cp` reported no error, Ansible copied that first binary forever and reported
- * `ok`, and the module's version field advanced past code that was never
- * shipped. This comparison is local, takes milliseconds, needs no SSH, and is
- * the check that turns that silence into a refusal.
- */
-
-import { existsSync } from 'node:fs';
-import { readdir } from 'node:fs/promises';
-import { join, relative } from 'node:path';
-import { computeFileChecksum } from './checksum';
-
-export interface VerbatimAssetDifference {
-  /** Path relative to the module root, identical in both trees. */
-  relPath: string;
-  /** `missing`: generation never produced it. `stale`: it holds other bytes. */
-  reason: 'missing' | 'stale';
-  installedDigest: string;
-  generatedDigest: string | null;
-}
-
-/**
- * Pure. Both sides are digest maps keyed by the same module-relative path.
- *
- * An asset present in `generated` but absent from `installed` is NOT reported.
- * That is a role the module no longer has, whose old output nothing includes,
- * and failing a deploy for it would refuse a correct module for a stale file
- * Ansible never reads.
- */
-export function compareVerbatimRoleAssets(
-  installed: ReadonlyMap<string, string>,
-  generated: ReadonlyMap<string, string>,
-): VerbatimAssetDifference[] {
-  const differences: VerbatimAssetDifference[] = [];
-  for (const [relPath, installedDigest] of installed) {
-    const generatedDigest = generated.get(relPath) ?? null;
-    if (generatedDigest === null) {
-      differences.push({ relPath, reason: 'missing', installedDigest, generatedDigest: null });
-    } else if (generatedDigest !== installedDigest) {
-      differences.push({ relPath, reason: 'stale', installedDigest, generatedDigest });
-    }
-  }
-  return differences;
-}
-
-/**
- * Digest every `ansible/roles/<role>/files/**` asset under `root`, keyed by its
- * path relative to `root`. The generated project mirrors that layout, so the
- * two maps this produces are directly comparable.
- */
-export async function readVerbatimRoleAssets(root: string): Promise<Map<string, string>> {
-  const assets = new Map<string, string>();
-  const rolesDir = join(root, 'ansible', 'roles');
-  if (!existsSync(rolesDir)) return assets;
-
-  for (const role of await readdir(rolesDir, { withFileTypes: true })) {
-    if (!role.isDirectory()) continue;
-    const filesDir = join(rolesDir, role.name, 'files');
-    if (!existsSync(filesDir)) continue;
-    for (const filePath of await listFiles(filesDir)) {
-      assets.set(relative(root, filePath), await computeFileChecksum(filePath));
-    }
-  }
-  return assets;
-}
-
-async function listFiles(dir: string): Promise<string[]> {
-  const found: string[] = [];
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
-    const full = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      found.push(...(await listFiles(full)));
-    } else if (entry.isFile()) {
-      found.push(full);
-    }
-  }
-  return found;
-}
-
-/**
- * One line per difference, naming the file. celilo#925 took days partly because
- * nothing anywhere named the file that had gone stale.
- */
-export function describeVerbatimDifferences(differences: VerbatimAssetDifference[]): string[] {
-  return differences.map((d) =>
-    d.reason === 'missing'
-      ? `${d.relPath}: generation never produced it (installed ${d.installedDigest})`
-      : `${d.relPath}: generated holds ${d.generatedDigest}, installed is ${d.installedDigest}`,
-  );
-}
-
-/**
- * The deploy pre-flight (D6). Returns the refusal message, or `null` to proceed.
- *
- * Local, milliseconds, no SSH, and it runs before anything contacts a system.
- * It deliberately does NOT verify after the deploy: Ansible's `changed` is
- * truthful about what Ansible did, and the lie in celilo#925 was upstream of
- * Ansible.
- */
-export async function refuseIfGeneratedIsStale(
-  moduleId: string,
-  modulePath: string,
-  generatedPath: string,
-): Promise<string | null> {
-  const differences = compareVerbatimRoleAssets(
-    await readVerbatimRoleAssets(modulePath),
-    await readVerbatimRoleAssets(generatedPath),
-  );
-  if (differences.length === 0) return null;
-  return [
-    `Refusing to deploy ${moduleId}: the generated project does not match the installed module.`,
-    `  ${differences.length} verbatim asset(s) differ:`,
-    ...describeVerbatimDifferences(differences).map((line) => `    ${line}`),
-    '',
-    `Deploying would ship these bytes and report success. Run 'celilo module generate ${moduleId}' and try again.`,
-  ].join('\n');
-}