@celilo/cli 2.1.0 → 2.2.1

package/src/hooks/test-fixtures/on-restore-staging-hook.ts

@@ -0,0 +1,26 @@
+/**
+ * Test fixture: an on_restore hook in the celilo-mgmt staging shape, minus
+ * everything the real one owns but the staging itself. Copies the artifact's
+ * celilo.db into restore_dir/system/ so the Phase 4 wrapper's
+ * applyStagedSystemFiles has something to swap.
+ */
+
+import { cpSync, existsSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { defineHook } from '@celilo/capabilities';
+
+export default defineHook({
+  hook: 'on_restore',
+  requires: [],
+  optional: [],
+  handler: async (ctx) => {
+    const restoreDir = (ctx as unknown as { restore_dir: string }).restore_dir;
+    const systemDir = join(restoreDir, 'system');
+    mkdirSync(systemDir, { recursive: true });
+    const artifactDb = join(restoreDir, 'celilo.db');
+    if (existsSync(artifactDb)) {
+      cpSync(artifactDb, join(systemDir, 'celilo.db'));
+    }
+    return { restored_items: 1 };
+  },
+});

package/src/hooks/test-fixtures/store-backed.ts

@@ -0,0 +1,47 @@
+import type { HookStore, HookStoreBackedMap } from '@celilo/capabilities';
+
+/**
+ * In-memory hook-owned-state stores for tests that build a HookContext
+ * without a broker. The four methods mutate the record directly; the
+ * manifest validation a real store applies lives broker-side
+ * (hook-store.ts) and has its own tests.
+ *
+ * Methods are defined non-enumerably, so the result spreads, serializes and
+ * `toEqual`s as the plain record the test wrote — the same shape a real
+ * broker-side context carries when executeHookScript frames it.
+ */
+export function configStore(
+  values: Record<string, unknown> = {},
+): Record<string, unknown> & HookStore {
+  return attach(values);
+}
+
+export function secretStore(values: Record<string, string> = {}): HookStoreBackedMap {
+  // Downcast: the caller passed Record<string, string>; attach only adds
+  // methods and never writes, so the value type is unchanged.
+  return attach(values) as HookStoreBackedMap;
+}
+
+function attach(values: Record<string, unknown>): Record<string, unknown> & HookStore {
+  const store: HookStore = {
+    get: async (name) => values[name] as string | undefined,
+    set: async (name, value) => {
+      values[name] = value;
+    },
+    delete: async (name) => {
+      delete values[name];
+    },
+    transaction: async (fn) => {
+      await fn(store);
+    },
+  };
+  for (const [name, method] of Object.entries(store)) {
+    Object.defineProperty(values, name, {
+      value: method,
+      enumerable: false,
+      writable: true,
+      configurable: true,
+    });
+  }
+  return Object.assign(values, store);
+}

package/src/hooks/test-fixtures/store-writing-hook.ts

@@ -0,0 +1,63 @@
+/**
+ * Test fixture: a hook that exercises the hook-owned-state accessor across
+ * the process boundary — set/get round trip on both stores, delete, a
+ * committed transaction, a discarded transaction, and the undeclared-name
+ * throw the whole design exists to produce.
+ */
+
+import { defineHook } from '@celilo/capabilities';
+
+export default defineHook({
+  hook: 'on_install',
+  requires: [],
+  handler: async (ctx) => {
+    const outputs: Record<string, unknown> = {};
+
+    // Round trip on each store.
+    await ctx.secrets.set('bot_token', 'token-value');
+    outputs.secretRoundTrip = await ctx.secrets.get('bot_token');
+
+    await ctx.config.set('public_ip', '203.0.113.7');
+    outputs.configRoundTrip = await ctx.config.get('public_ip');
+
+    // The map surface still answers from the values the context carried.
+    outputs.mapRead = ctx.config.mapOnlyValue;
+
+    // Delete removes; deleting a declared-but-never-written name is a no-op.
+    // (An UNDECLARED name on delete throws — that is 3.4, tested below.
+    // Declared-and-absent is the no-op case 3.7 pins.)
+    await ctx.secrets.delete('bot_token');
+    await ctx.secrets.set('api_key', 'to-delete');
+    await ctx.secrets.delete('api_key');
+    outputs.deletedIsGone = await ctx.secrets.get('api_key');
+
+    // Committed transaction: both writes land.
+    await ctx.secrets.transaction((s) => {
+      s.set('bot_token', 'committed-a');
+      s.set('api_key', 'committed-b');
+    });
+    outputs.transactionA = await ctx.secrets.get('bot_token');
+    outputs.transactionB = await ctx.secrets.get('api_key');
+
+    // Discarded transaction: nothing lands, including the overwrite of the
+    // committed value above.
+    try {
+      await ctx.secrets.transaction(async (s) => {
+        s.set('bot_token', 'discarded');
+        throw new Error('hook failed midway');
+      });
+    } catch (error) {
+      outputs.discarded = (error as Error).message;
+    }
+    outputs.afterDiscard = await ctx.secrets.get('bot_token');
+
+    // An undeclared name throws, naming the module and the declared set.
+    try {
+      await ctx.secrets.set('not_declared', 'x');
+    } catch (error) {
+      outputs.undeclaredSecret = (error as Error).message;
+    }
+
+    return outputs;
+  },
+});

package/src/hooks/unjailed-lint.test.ts

@@ -26,6 +26,7 @@ import { executeHookScript, hookChildEnv } from './executor';
 import type { MountSetWire } from './hook-protocol';
 import { createCapturingLogger } from './logger';
 import { deriveMountSet } from './mount-set';
+import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
 import { classifyAccess, mountSetEnvValue, parseLintMountSet } from './unjailed-lint';
 
@@ -54,10 +55,25 @@ function scratchModule(script: string): string {
 
 const describeSet = (overrides: Partial<MountSetWire>): MountSetWire => ({
   entries: [
-    { path: '/tmp', mode: 'tmpfs', reason: 'private scratch, per run' },
-    { path: '/srv/celilo/mod', mode: 'ro', reason: "the module's own tree" },
-    { path: '/srv/celilo/mod/state', mode: 'rw', reason: 'the sanctioned writable directory' },
-    { path: '/srv/staged', mode: 'rw', reason: "contract input 'backup_dir' (write)" },
+    { path: '/tmp', mode: 'tmpfs', reason: 'private scratch, per run', absence: 'runtime' },
+    {
+      path: '/srv/celilo/mod',
+      mode: 'ro',
+      reason: "the module's own tree",
+      absence: 'required',
+    },
+    {
+      path: '/srv/celilo/mod/state',
+      mode: 'rw',
+      reason: 'the sanctioned writable directory',
+      absence: 'required',
+    },
+    {
+      path: '/srv/staged',
+      mode: 'rw',
+      reason: "contract input 'backup_dir' (write)",
+      absence: 'required',
+    },
   ],
   chdir: '/srv/celilo/mod',
   ...overrides,
@@ -159,8 +175,8 @@ describe('the lint inside a real hook run', () => {
     mkdirSync(join(root, 'state'), { recursive: true });
     const { logger, messages } = createCapturingLogger();
     const context: HookContext = {
-      config: {},
-      secrets: {},
+      config: configStore(),
+      secrets: secretStore(),
       systems: [],
       logger,
       debug: false,

package/src/manifest/schema.ts

@@ -17,6 +17,7 @@ export const VariableSourceSchema = z.enum([
   'system',
   'terraform',
   'infrastructure',
+  'hook',
 ]);
 
 /**

package/src/module/packaging/audit.ts

@@ -13,7 +13,6 @@ import {
 } from '../../services/module-instances';
 import { computeFileChecksum } from './checksum';
 import type { IntegrityViolation } from './extract';
-import { compareVerbatimRoleAssets, readVerbatimRoleAssets } from './generated-plane';
 import { type HostPlaneResult, verifyModuleOnHosts } from './host-plane';
 import { classifyModulePath } from './package-rules';
 
@@ -204,30 +203,11 @@ export async function auditModule(
       }
     }
 
-    // Plane two: is what we would deploy built from what we installed? Only
-    // verbatim role assets have a meaningful expected digest — Ansible
-    // templates the rest, and a `.j2` in `generated/` is SUPPOSED to differ.
-    // A module that has never been generated has nothing to compare and is not
-    // a finding; it is simply pre-deploy.
-    const generatedDir = join(moduleDir, 'generated');
-    if (existsSync(generatedDir)) {
-      const differences = compareVerbatimRoleAssets(
-        await readVerbatimRoleAssets(moduleDir),
-        await readVerbatimRoleAssets(generatedDir),
-      );
-      for (const difference of differences) {
-        violations.push({
-          type: 'stale-generated',
-          path: difference.relPath,
-          expectedDigest: difference.installedDigest,
-          actualDigest: difference.generatedDigest,
-          message:
-            difference.reason === 'missing'
-              ? `Generated project is missing ${difference.relPath} — the next deploy would ship nothing for it. Run 'celilo module generate ${moduleId}'.`
-              : `Generated project holds different bytes for ${difference.relPath} (generated ${difference.generatedDigest}, installed ${difference.installedDigest}) — the next deploy would ship the wrong ones. Run 'celilo module generate ${moduleId}'.`,
-        });
-      }
-    }
+    // The second plane (is what we would deploy built from what we installed?)
+    // retired here: the generated tree is ephemeral now (D4 of
+    // control-plane-stops-building-modules) — rendered for a deploy and
+    // deleted on success — so a persistent generated copy that verbatim role
+    // assets could be compared against no longer exists to compare.
 
     // Check for extra files (not in checksums)
     const actualFiles = await scanDirectory(moduleDir, moduleDir);
@@ -244,7 +224,10 @@ export async function auditModule(
     }
 
     // Plane three: is what is running what we generated? One SSH per system,
-    // so it is asked only when the caller says so.
+    // so it is asked only when the caller says so. With the generated tree
+    // ephemeral (D4), a deep audit after a successful deploy finds no playbook
+    // and says so — the remedy is generate, which is cheap and never builds.
+    const generatedDir = join(moduleDir, 'generated');
     let hostPlane: HostPlaneResult | undefined;
     if (options.deep) {
       hostPlane = await verifyModuleOnHosts({

package/src/module/packaging/build-paths.test.ts

@@ -0,0 +1,127 @@
+import { describe, expect, test } from 'bun:test';
+import { cpSync, existsSync, mkdtempSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { resolveBuildCommandPaths } from './build-paths';
+
+/** Repo root: this file sits at apps/celilo/src/module/packaging/. */
+const REPO_ROOT = join(import.meta.dir, '..', '..', '..', '..', '..');
+
+/** Every module in the repo that declares a `build:` block (design, Context). */
+const BUILD_MODULES = [
+  'celilo-registry',
+  'celilo-web-console',
+  'celilo-website',
+  'forgejo',
+  'npm-cache-node',
+  'wireguard-manager',
+] as const;
+
+function buildCommand(moduleId: string): string {
+  const manifestPath = join(REPO_ROOT, 'modules', moduleId, 'manifest.yml');
+  if (!existsSync(manifestPath)) throw new Error(`fixture missing: ${manifestPath}`);
+  const manifest = parseYaml(readFileSync(manifestPath, 'utf8')) as {
+    build?: { command?: string };
+  };
+  const command = manifest.build?.command;
+  if (!command) throw new Error(`${moduleId} declares no build command`);
+  return command;
+}
+
+describe('publish-time build path gate', () => {
+  test('flags celilo-registry when packaged outside the monorepo (the control-plane shape)', () => {
+    // The known-bad form, per celilo#1307: the script reaches a sibling of the
+    // module source (`../../packages/registry-server`). Inside the monorepo
+    // that resolves; from a tree where the module stands alone — a control
+    // plane, or any packaging that is not the source checkout — it does not.
+    // The spec scenario pins this: "packaged from a tree where that directory
+    // does not exist".
+    const scratch = mkdtempSync(join(tmpdir(), 'celilo-build-paths-'));
+    const moduleSourceDir = join(scratch, 'celilo-registry');
+    cpSync(join(REPO_ROOT, 'modules', 'celilo-registry'), moduleSourceDir, {
+      recursive: true,
+    });
+    const violations = resolveBuildCommandPaths(buildCommand('celilo-registry'), {
+      moduleSourceDir,
+      buildDir: moduleSourceDir,
+    });
+    expect(violations).toHaveLength(1);
+    expect(violations[0].rawPath).toContain('../../packages/registry-server');
+    expect(violations[0].resolvedPath).not.toContain(REPO_ROOT);
+  });
+
+  test('flags a plain relative escape that does not resolve (spec scenario)', () => {
+    const scratch = mkdtempSync(join(tmpdir(), 'celilo-build-paths-'));
+    const violations = resolveBuildCommandPaths(
+      'cd ../../packages/registry-server && bun install',
+      { moduleSourceDir: scratch, buildDir: scratch },
+    );
+    expect(violations).toHaveLength(1);
+    expect(violations[0].rawPath).toBe('../../packages/registry-server');
+  });
+
+  test('accepts $CELILO_MODULE_SOURCE_DIR/server when it exists (npm-cache-node shape)', () => {
+    const scratch = mkdtempSync(join(tmpdir(), 'celilo-build-paths-'));
+    const moduleSourceDir = join(scratch, 'npm-cache-node');
+    cpSync(
+      join(REPO_ROOT, 'modules', 'npm-cache-node', 'server'),
+      join(moduleSourceDir, 'server'),
+      {
+        recursive: true,
+      },
+    );
+    const violations = resolveBuildCommandPaths(buildCommand('npm-cache-node'), {
+      moduleSourceDir,
+      buildDir: moduleSourceDir,
+    });
+    expect(violations).toEqual([]);
+  });
+
+  test('accepts every module build command at publish time in the monorepo', () => {
+    // The regression surface for the five healthy modules. celilo-registry
+    // passes here too, and that is correct: at publish, inside the monorepo,
+    // its `cd` target exists (the binaries shipped on 2026-08-20 prove the
+    // build ran). The gate refuses the script only where it genuinely cannot
+    // resolve — the first test above.
+    for (const moduleId of BUILD_MODULES) {
+      const moduleSourceDir = join(REPO_ROOT, 'modules', moduleId);
+      const violations = resolveBuildCommandPaths(buildCommand(moduleId), {
+        moduleSourceDir,
+        buildDir: moduleSourceDir,
+      });
+      expect(violations, moduleId).toEqual([]);
+    }
+  });
+
+  test('skips a cd target it cannot resolve rather than guessing (forgejo shape)', () => {
+    // `cd "$D"` where D was assigned earlier in the same command: the gate
+    // does not interpret shell, so an unresolvable target is skipped, not
+    // failed. A guard that rejects working modules is worse than none.
+    const scratch = mkdtempSync(join(tmpdir(), 'celilo-build-paths-'));
+    const violations = resolveBuildCommandPaths('D=files && mkdir -p "$D" && cd "$D" && ls', {
+      moduleSourceDir: scratch,
+      buildDir: scratch,
+    });
+    expect(violations).toEqual([]);
+  });
+
+  test('tracks the working directory across chained cds (celilo-web-console shape)', () => {
+    // `cd $SOURCE/../../apps/console` then `cd ../console-server`: the second
+    // target resolves against the FIRST cd's destination, not the build dir.
+    const scratch = mkdtempSync(join(tmpdir(), 'celilo-build-paths-'));
+    const moduleSourceDir = join(scratch, 'web');
+    const monorepo = join(scratch, 'mono');
+    cpSync(join(REPO_ROOT, 'modules', 'celilo-web-console'), moduleSourceDir, { recursive: true });
+    // A monorepo-shaped sibling tree, minimal but real.
+    const { mkdirSync } = require('node:fs') as typeof import('node:fs');
+    mkdirSync(join(monorepo, 'apps', 'console'), { recursive: true });
+    mkdirSync(join(monorepo, 'apps', 'console-server'), { recursive: true });
+    cpSync(moduleSourceDir, join(monorepo, 'modules', 'celilo-web-console'), { recursive: true });
+    const violations = resolveBuildCommandPaths(buildCommand('celilo-web-console'), {
+      moduleSourceDir: join(monorepo, 'modules', 'celilo-web-console'),
+      buildDir: join(monorepo, 'modules', 'celilo-web-console'),
+    });
+    expect(violations).toEqual([]);
+  });
+});

package/src/module/packaging/build-paths.ts

@@ -0,0 +1,175 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+/**
+ * Publish-time gate on a module build command's filesystem references.
+ *
+ * A `build:` block runs when the module is packaged (publish/package/import),
+ * inside a staged copy of the module, with `CELILO_MODULE_SOURCE_DIR` pointing
+ * back at the authored source tree. A `cd` in that command is the build's
+ * claim about where its inputs live; a target that does not resolve there
+ * means the module ships inputs it does not carry, which is how celilo-registry
+ * was unbuildable on every real install for four months without anyone finding
+ * out (celilo#1307). The packager refuses up front and names the path.
+ *
+ * The gate does not interpret shell. It finds `cd` commands lexically, knows
+ * the two variables the packager supplies, and probes what those resolve to.
+ * A target it cannot resolve (an untracked shell variable, a command
+ * substitution, a glob) is SKIPPED, not failed: guessing would reject working
+ * modules, and a guard that rejects working modules is worse than none.
+ */
+
+export interface BuildPathViolation {
+  /** The path exactly as the build command wrote it, before substitution. */
+  rawPath: string;
+  /** The absolute path the packaging runtime would resolve it to. */
+  resolvedPath: string;
+}
+
+export interface ResolveBuildCommandPathsOptions {
+  /** What `$CELILO_MODULE_SOURCE_DIR` resolves to when the command runs. */
+  moduleSourceDir: string;
+  /** The staged tree the command runs in (its initial cwd, and `$STAGE`). */
+  buildDir: string;
+  /** Injectable existence probe; defaults to existsSync. */
+  exists?: (path: string) => boolean;
+}
+
+/**
+ * Extract the argument of every unquoted `cd` command in the string, with the
+ * quoting preserved so later substitution can strip it.
+ *
+ * A `cd` counts only at a command position: string start, or after `&&`, `||`,
+ * `;`, `|`, `(`, or a newline, ignoring whitespace. Quoted spans (single and
+ * double) are skipped whole, so a `cd` inside a string is not mistaken for a
+ * command.
+ */
+export function findCdTargets(command: string): string[] {
+  const targets: string[] = [];
+  let atCommandStart = true;
+  let i = 0;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "'") {
+      const end = command.indexOf("'", i + 1);
+      i = end === -1 ? command.length : end + 1;
+      atCommandStart = false;
+      continue;
+    }
+    if (ch === '"') {
+      const end = command.indexOf('"', i + 1);
+      i = end === -1 ? command.length : end + 1;
+      atCommandStart = false;
+      continue;
+    }
+    if (ch === '\\' && i + 1 < command.length) {
+      i += 2;
+      atCommandStart = false;
+      continue;
+    }
+    if (ch === '&' || ch === '|' || ch === ';' || ch === '\n' || ch === '(') {
+      atCommandStart = true;
+      i += 1;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      i += 1;
+      continue;
+    }
+    if (atCommandStart && command.startsWith('cd', i) && /\s/.test(command[i + 2] ?? '')) {
+      const { target, next } = readCdTarget(command, i + 2);
+      if (target.length > 0) targets.push(target);
+      i = next;
+      atCommandStart = false;
+      continue;
+    }
+    atCommandStart = false;
+    i += 1;
+  }
+  return targets;
+}
+
+/**
+ * Read one `cd` argument starting just after the `cd` keyword. Stops at an
+ * unquoted command terminator. Backslash escapes are carried through so the
+ * caller sees exactly what the shell would.
+ */
+function readCdTarget(command: string, start: number): { target: string; next: number } {
+  let i = start;
+  while (i < command.length && /\s/.test(command[i])) i += 1;
+  const begin = i;
+  let end = i;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "'") {
+      const close = command.indexOf("'", i + 1);
+      i = close === -1 ? command.length : close + 1;
+      end = i;
+      continue;
+    }
+    if (ch === '"') {
+      const close = command.indexOf('"', i + 1);
+      i = close === -1 ? command.length : close + 1;
+      end = i;
+      continue;
+    }
+    if (ch === '\\' && i + 1 < command.length) {
+      i += 2;
+      end = i;
+      continue;
+    }
+    if (ch === '&' || ch === '|' || ch === ';' || ch === '\n') break;
+    i += 1;
+    if (!/\s/.test(ch) || command.slice(begin, i).trim().length > 0) end = i;
+  }
+  return { target: command.slice(begin, end).trim(), next: i };
+}
+
+/**
+ * Substitute the packager-supplied variables, strip quoting, and drop the
+ * target to `null` when anything unresolvable remains. `null` means "this
+ * gate cannot answer whether this path exists", never "it does not exist".
+ */
+function resolveTarget(target: string, options: ResolveBuildCommandPathsOptions): string | null {
+  const substituted = target
+    .replaceAll('$CELILO_MODULE_SOURCE_DIR', options.moduleSourceDir)
+    .replaceAll('$(pwd)', options.buildDir)
+    .replaceAll('$STAGE', options.buildDir)
+    .replaceAll('"', '')
+    .replaceAll("'", '');
+  if (/[$`*?~[(]/.test(substituted)) return null;
+  if (substituted.startsWith('-')) return null; // `cd -` / flags, not a path
+  return substituted;
+}
+
+export function resolveBuildCommandPaths(
+  command: string,
+  options: ResolveBuildCommandPathsOptions,
+): BuildPathViolation[] {
+  const exists = options.exists ?? existsSync;
+  const violations: BuildPathViolation[] = [];
+  // The simulated working directory of the build. `null` means unknown: the
+  // previous cd could not be resolved, so a later relative cd cannot be either.
+  let cwd: string | null = options.buildDir;
+  for (const rawTarget of findCdTargets(command)) {
+    const target = resolveTarget(rawTarget, options);
+    if (target === null) {
+      cwd = null;
+      continue;
+    }
+    const resolved: string | null = target.startsWith('/')
+      ? target
+      : cwd === null
+        ? null
+        : resolve(cwd, target);
+    if (resolved === null) {
+      cwd = null;
+      continue;
+    }
+    if (!exists(resolved)) {
+      violations.push({ rawPath: rawTarget, resolvedPath: resolved });
+    }
+    cwd = resolved;
+  }
+  return violations;
+}

package/src/module/packaging/build.test.ts

@@ -7,10 +7,11 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { execFileSync } from 'node:child_process';
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { computeChecksums } from './build';
+import { buildModule, computeChecksums } from './build';
 
 describe('computeChecksums — scripts/node_modules bundling (ISS-0046)', () => {
   let dir: string;
@@ -73,3 +74,72 @@ describe('computeChecksums — scripts/node_modules bundling (ISS-0046)', () =>
     expect(paths.some((p) => p.startsWith('e2e/'))).toBe(false);
   });
 });
+
+/**
+ * The pack-staging branch must not eat the hook runtime (celilo#1310).
+ *
+ * `buildModule` stages through `bun pm pack` whenever a module has a root
+ * package.json, and npm-pack semantics drop every `node_modules` — a `files`
+ * entry naming the path does not override it. That silently contradicted
+ * `includeNodeModulesPath`, which exists to ship `scripts/node_modules` in full
+ * so hooks resolve their deps on a target with no reachable registry.
+ *
+ * Nothing in `modules/` can reach this branch: every module there has only
+ * `scripts/package.json` and takes the `cpSync` path. So the regression is only
+ * visible against a fixture shaped like a module that is ALSO a bun project.
+ */
+describe('buildModule — a root package.json must not strip the hook runtime', () => {
+  let source: string;
+  let out: string;
+
+  function write(rel: string, content: string): void {
+    const full = join(source, rel);
+    mkdirSync(join(full, '..'), { recursive: true });
+    writeFileSync(full, content, 'utf-8');
+  }
+
+  beforeEach(() => {
+    source = mkdtempSync(join(tmpdir(), 'celilo-pack-root-pkg-'));
+    out = join(mkdtempSync(join(tmpdir(), 'celilo-pack-out-')), 'm.netapp');
+
+    write('manifest.yml', 'celilo_contract: "1.0"\nid: root-pkg-module\nname: M\nversion: 0.1.0\n');
+    // The shape that triggers it: a module that is also a bun project. `files`
+    // deliberately names scripts/ — proving the loss is npm-pack semantics and
+    // not a missing entry.
+    write(
+      'package.json',
+      JSON.stringify({
+        name: 'root-pkg-module',
+        version: '0.1.0',
+        private: true,
+        files: ['manifest.yml', 'scripts/'],
+      }),
+    );
+    write('scripts/on_install.ts', "import '@celilo/capabilities';\n");
+    write(
+      'scripts/package.json',
+      JSON.stringify({ name: 'm-hooks', dependencies: { tldts: '^7.0.0' } }),
+    );
+    write('scripts/node_modules/tldts/index.js', 'module.exports = {};\n');
+    write(
+      'scripts/node_modules/tldts/package.json',
+      JSON.stringify({ name: 'tldts', version: '7.4.12' }),
+    );
+    write('scripts/node_modules/.bin/tldts', '#!/bin/sh\n');
+  });
+
+  afterEach(() => {
+    rmSync(source, { recursive: true, force: true });
+    rmSync(join(out, '..'), { recursive: true, force: true });
+  });
+
+  it('ships scripts/node_modules even though bun pm pack dropped it', async () => {
+    const result = await buildModule({ sourceDir: source, outputPath: out });
+    expect(result.success).toBe(true);
+
+    const listed = execFileSync('tar', ['tzf', out], { encoding: 'utf-8' }).split('\n');
+    expect(listed).toContain('scripts/node_modules/tldts/index.js');
+    // The one thing the runtime closure still excludes.
+    expect(listed).not.toContain('scripts/node_modules/.bin/tldts');
+  });
+});