@celilo/cli 2.2.0 → 2.2.1

package/src/config/paths.test.ts

@@ -141,7 +141,7 @@ describe('paths configuration', () => {
     it.skipIf(skipIntegration({ platform: 'darwin' }))(
       'returns data dir + celilo.db on macOS in production',
       () => {
-        process.env.CELILO_DB_PATH = undefined;
+        delete process.env.CELILO_DB_PATH;
         process.env.CELILO_DATA_DIR = undefined;
         process.env.ENVIRONMENT = undefined;
 
@@ -156,7 +156,7 @@ describe('paths configuration', () => {
     );
 
     it('returns celilo-data/celilo.db in development mode', () => {
-      process.env.CELILO_DB_PATH = undefined;
+      delete process.env.CELILO_DB_PATH;
       process.env.CELILO_DATA_DIR = undefined;
       process.env.ENVIRONMENT = 'dev';
 
@@ -165,7 +165,7 @@ describe('paths configuration', () => {
     });
 
     it('respects CELILO_DATA_DIR override', () => {
-      process.env.CELILO_DB_PATH = undefined;
+      delete process.env.CELILO_DB_PATH;
       process.env.CELILO_DATA_DIR = '/custom/data';
       process.env.ENVIRONMENT = undefined;
 

package/src/db/migrate.test.ts

@@ -20,6 +20,7 @@ import { describe, expect, it } from 'bun:test';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { closeDb, getDb } from './client';
 import { runMigrations } from './migrate';
 import { systemConfig } from './schema';
@@ -48,7 +49,7 @@ describe('runMigrations connection lifecycle', () => {
       closeDb();
     } finally {
       closeDb();
-      process.env.CELILO_DB_PATH = undefined;
+      resetTestDbPath();
       rmSync(dir, { recursive: true, force: true });
     }
   });

package/src/db/migrate.ts

@@ -80,26 +80,26 @@ export function runMigrationsOn(db: DbClient): void {
 }
 
 /**
- * Run database migrations (standalone entrypoint — `bun run src/db/migrate.ts`).
- * createDbClient already migrates on open; this re-asserts for explicit use.
+ * Open a database at `dbPath` with migrations applied, then close it.
+ * Standalone entrypoint (`bun run src/db/migrate.ts`); tests also use it to
+ * prepare a fresh scratch database.
+ *
+ * createDbClient migrates synchronously on open (its own runMigrationsOn
+ * call), so this function is open + close. It deliberately does NOT call
+ * runMigrationsOn again: a second pass is always a ledger no-op when the
+ * first succeeded, and keeping it invited a double-migrate everywhere this
+ * entrypoint is used (celilo#1315).
  */
 export async function runMigrations(dbPath?: string) {
   console.log('Running database migrations...');
   const db = createDbClient(dbPath ? { path: dbPath } : undefined);
-  try {
-    runMigrationsOn(db);
-    console.log('Migrations completed successfully');
-  } catch (error) {
-    console.error('Migration failed:', error);
-    throw error;
-  } finally {
-    // Close the connection THIS call created. It is not the singleton —
-    // createDbClient does not register one — so the old closeDb() here closed
-    // whatever else was open (usually nothing) and leaked this connection,
-    // which then held the file in WAL and blocked every later journal-mode
-    // switch on it (celilo#1269).
-    db.$client.close();
-  }
+  console.log('Migrations completed successfully');
+  // Close the connection THIS call created. It is not the singleton —
+  // createDbClient does not register one — so an old closeDb() here closed
+  // whatever else was open (usually nothing) and leaked this connection,
+  // which then held the file in WAL and blocked every later journal-mode
+  // switch on it (celilo#1269).
+  db.$client.close();
 }
 
 // Run migrations if executed directly

package/src/hooks/capability-loader.test.ts

@@ -7,7 +7,9 @@ import { mkdirSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { HookLogger, RouteReadView } from '@celilo/capabilities';
+import { and, eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
+import { moduleConfigs } from '../db/schema';
 import { upsertModuleConfig } from '../services/module-config';
 import { cleanupTestDatabase, setupTestDatabase } from '../test-utils/database';
 import { loadCapabilityFunctions } from './capability-loader';
@@ -40,6 +42,36 @@ export default function createDhcpServer(context) {
 }
 `;
 
+/**
+ * A factory that WRITES through the hook-owned-state accessor, so the loader's
+ * store view is proven end to end: the method's write lands as a hook-owned
+ * row, and an undeclared name throws instead of landing. Branded
+ * (defineCapabilityFunction, the Phase 8 pattern) — the branded path is the
+ * one the loader hands the store views to. The temp dir the fixture is
+ * dropped into has no node_modules link, so the import uses the workspace
+ * package by absolute path, the same trick capability-loader-firewall uses.
+ */
+const TEST_STORE_WRITING_DHCP_MODULE = `
+import { defineCapabilityFunction } from '${join(__dirname, '../../../..', 'packages/capabilities/src/index.ts')}';
+
+export default defineCapabilityFunction({
+  capability: 'dhcp_server',
+  handler: (context) => ({
+    async setDnsServers() {},
+    async getDnsServers() { return [context.config.marker]; },
+    async setDomainName() {},
+    async getDomainName() { return context.config.marker; },
+    async claimIp() {
+      await context.config.set('public_ip', '203.0.113.7');
+      return 'claimed';
+    },
+    async claimUndeclared() {
+      await context.config.set('no_such_key', 'x');
+    },
+  }),
+});
+`;
+
 describe('Capability Loader', () => {
   let db: DbClient;
   let tempDir: string;
@@ -134,6 +166,52 @@ describe('Capability Loader', () => {
     expect(await dhcp.getDomainName()).toBe('internal-dhcp');
   });
 
+  test('a provider factory writes hook-owned config through the injected store view', async () => {
+    // The store view must do more than carry the plain record a factory reads.
+    // A method writing `context.config.set` lands a hook-owned row (validated
+    // against the PROVIDER's manifest, source column 'hook'), and an
+    // undeclared name throws instead of writing a phantom row.
+    const modulePath = join(tempDir, 'storewriting-vpn');
+    const scriptsDir = join(modulePath, 'scripts');
+    mkdirSync(scriptsDir, { recursive: true });
+    writeFileSync(join(scriptsDir, 'dhcp-server-functions.ts'), TEST_STORE_WRITING_DHCP_MODULE);
+    const manifest = JSON.stringify({
+      variables: { owns: [{ name: 'public_ip', type: 'string', source: 'hook' }] },
+    });
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('storewriting-vpn', 'StoreWritingVpn', '1.0.0', '${modulePath}', '${manifest.replace(/'/g, "''")}')`,
+    );
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, registered_at) VALUES ('storewriting-vpn', 'dhcp_server', '1.0.0', '{}', unixepoch())`,
+    );
+    upsertModuleConfig(db, 'storewriting-vpn', 'marker', 'storewriting-vpn');
+
+    const result = await loadCapabilityFunctions('store-consumer', db, noopLogger);
+    const dhcp = result.dhcp_server as {
+      claimIp(): Promise<string>;
+      claimUndeclared(): Promise<void>;
+    };
+
+    expect(await dhcp.claimIp()).toBe('claimed');
+    const row = db
+      .select()
+      .from(moduleConfigs)
+      .where(
+        and(eq(moduleConfigs.moduleId, 'storewriting-vpn'), eq(moduleConfigs.key, 'public_ip')),
+      )
+      .get();
+    expect(row?.valueJson).toBe('"203.0.113.7"');
+    expect(row?.source).toBe('hook');
+
+    // The store round-trips text, so the map read the NEXT load takes sees the
+    // same string the write sent.
+    const reloaded = await loadCapabilityFunctions('store-consumer', db, noopLogger);
+    const dhcpAgain = reloaded.dhcp_server as { getDnsServers(): Promise<string[]> };
+    expect(await dhcpAgain.getDnsServers()).toEqual(['storewriting-vpn']);
+
+    await expect(dhcp.claimUndeclared()).rejects.toThrow(/no declared hook-owned config/);
+  });
+
   test('falls back to a zone-agnostic provider when no explicit zone provider exists', async () => {
     const modulePath = join(tempDir, 'upstream-dhcp');
     const scriptsDir = join(modulePath, 'scripts');

package/src/hooks/capability-loader.ts

@@ -60,6 +60,9 @@ import {
 import { resolveComputedFields } from '../variables/computed/evaluate';
 import { containsComputedMarker } from '../variables/computed/marker';
 import { buildProviderLookup } from '../variables/computed/provider-lookup';
+import type { BufferedStoreOp } from './hook-protocol';
+import { type HookStores, createHookStores } from './hook-store';
+import { type StoreTransport, buildStoreView } from './hook-store-proxy';
 import { loadHookConfigMap } from './load-hook-config';
 
 /**
@@ -260,6 +263,13 @@ export async function loadCapabilityFunctions(
   // This allows modules to optionally consume capabilities at runtime
   // (e.g., caddy uses dns_registrar if available, falls back if not).
   const verbose = process.env.CELILO_DEBUG === '1';
+
+  // The broker-side stores, resolved from the PROVIDER on the first store
+  // call this consumer load makes, and shared across every capability it
+  // builds. Nothing pays for the manifest read until a factory actually
+  // writes or reads through the accessor. See the storeTransport construction
+  // at the factory-invocation site below.
+  let storesPromise: Promise<HookStores> | undefined;
   const debugLog = verbose
     ? (msg: string) => process.stderr.write(`[capability-loader] ${msg}\n`)
     : (_msg: string) => {};
@@ -392,10 +402,35 @@ export async function loadCapabilityFunctions(
       // Phase 8 path: branded defineCapabilityFunction factory. Call with
       // the canonical { config, secrets, logger } context. The factory
       // applies wrapWithLogging internally so we don't double-wrap.
+      //
+      // Both maps arrive as the hook-owned-state view (buildStoreView): the
+      // plain record the factory reads, PLUS get/set/delete/transaction that
+      // reach the broker-side stores (createHookStores), validated against
+      // the PROVIDER module's own manifest. The transport is in-process — a
+      // capability factory runs here in celilo's process, not in the jail —
+      // but the view is the same object a jailed hook sees, so a provider's
+      // self-config write goes through the same validated door regardless of
+      // which process it runs in (hook-owned-state tasks 0.7 and 5.5 shape).
       if (isCompiledCapabilityFactory(exported)) {
+        const storeTransport: StoreTransport = (store, method, args) => {
+          storesPromise ??= createHookStores(db, capability.moduleId);
+          return storesPromise.then((backend: HookStores): Promise<unknown> => {
+            const one = backend[store];
+            switch (method) {
+              case 'transaction':
+                return one.applyTransaction(args[0] as readonly BufferedStoreOp[]);
+              case 'set':
+                return one.set(args[0] as string, args[1] as string);
+              case 'delete':
+                return one.delete(args[0] as string);
+              default:
+                return one.get(args[0] as string);
+            }
+          });
+        };
         const capabilityInterface = exported({
-          config: providerConfig,
-          secrets: providerSecrets,
+          config: buildStoreView('config', providerConfig, storeTransport),
+          secrets: buildStoreView('secrets', providerSecrets, storeTransport),
           systems: getModuleSystems(capability.moduleId, db),
           logger,
           // WHO IS CALLING, so a provider can scope per-consumer state to them.

package/src/hooks/executor.test.ts

@@ -1,8 +1,12 @@
-import { describe, expect, test } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { existsSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { closeDb, getDb } from '../db/client';
+import { runMigrations } from '../db/migrate';
+import { systemConfig } from '../db/schema';
 import type { ContractHookSignature } from '../manifest/contracts';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   checkRequiredCapabilities,
   declaredPathInputs,
@@ -329,6 +333,88 @@ describe('Hook Executor', () => {
     });
   });
 
+  describe('the executor resolves the jail policy through stored config (hook-jail-config-surface slice 4)', () => {
+    // Each test gets its own migrated scratch database and its own jail-mode
+    // store, so a planted row here never leaks into another test (or another
+    // host). With no module tree in `options.jail`, `planJailedSpawn` treats a
+    // `required` policy as a hard failure on EVERY host — which makes the
+    // resolution outcome observable without depending on what jail backend a
+    // given machine happens to have.
+    let dir: string;
+    const saved: Record<string, string | undefined> = {};
+
+    const plantPolicyRow = (value: string): void => {
+      getDb().insert(systemConfig).values({ key: 'hooks.jail_policy', value }).run();
+    };
+
+    const runVoidHook = (): Promise<Record<string, unknown>> => {
+      const { logger } = createCapturingLogger();
+      return executeHookScript(join(FIXTURES_DIR, 'void-hook.ts'), {
+        config: configStore(),
+        secrets: secretStore(),
+        systems: [],
+        logger,
+        debug: false,
+        screenshotDir: '/tmp',
+        stateDir: '/tmp',
+        capabilities: {},
+      });
+    };
+
+    beforeEach(async () => {
+      for (const key of ['CELILO_HOOK_JAIL', 'CELILO_HOOK_JAIL_MODE_PATH']) {
+        saved[key] = process.env[key];
+      }
+      dir = mkdtempSync(join(tmpdir(), 'celilo-executor-policy-'));
+      process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
+      process.env.CELILO_HOOK_JAIL_MODE_PATH = join(dir, 'mode.json');
+      delete process.env.CELILO_HOOK_JAIL;
+      await runMigrations(process.env.CELILO_DB_PATH);
+    });
+
+    afterEach(() => {
+      closeDb();
+      // The db path resets to the scratch path rather than restoring the
+      // saved value: that value may be another suite's temp database, or
+      // unset — which sends the next var-less reader to the operator's real
+      // celilo.db (celilo#1315).
+      resetTestDbPath();
+      for (const key of ['CELILO_HOOK_JAIL', 'CELILO_HOOK_JAIL_MODE_PATH']) {
+        if (saved[key] === undefined) delete process.env[key];
+        else process.env[key] = saved[key];
+      }
+      rmSync(dir, { recursive: true, force: true });
+    });
+
+    test('a stored row decides when the env is silent', async () => {
+      plantPolicyRow('required');
+      await expect(runVoidHook()).rejects.toThrow(/no hook jail is available/);
+    });
+
+    test('env wins over a conflicting stored row', async () => {
+      process.env.CELILO_HOOK_JAIL = 'off';
+      plantPolicyRow('required');
+      await expect(runVoidHook()).resolves.toBeDefined();
+    });
+
+    test('env=required still reaches the planner when the row says off', async () => {
+      process.env.CELILO_HOOK_JAIL = 'required';
+      plantPolicyRow('off');
+      await expect(runVoidHook()).rejects.toThrow(/no hook jail is available/);
+    });
+
+    test('a bad stored row fails the hook instead of running it unjailed', async () => {
+      plantPolicyRow('alwayssafe');
+      await expect(runVoidHook()).rejects.toThrow(/hooks\.jail_policy='alwayssafe'/);
+    });
+
+    test('nothing set resolves to the default, off (peba’s ruling on ce-rez7)', async () => {
+      // Migrated DB with no row: the stored-row read returns undefined and the
+      // resolver falls through to the default, which jails nobody.
+      await expect(runVoidHook()).resolves.toBeDefined();
+    });
+  });
+
   describe('resolveHookTimeouts', () => {
     test('no declaration: 60s total, 30s idle heuristic', () => {
       expect(resolveHookTimeouts(undefined, false)).toEqual({

package/src/hooks/executor.ts

@@ -51,6 +51,8 @@ import {
   moduleArtifactDir,
   moduleStateDir,
 } from '@celilo/capabilities';
+import { getDbPath } from '../config/paths';
+import { getDb } from '../db/client';
 import {
   type ContractHookSignature,
   contractHookSignature,
@@ -73,10 +75,10 @@ import {
 import {
   type JailPlan,
   detectJailBackend,
-  jailPolicy,
   planJailedSpawn,
   realpathRequest,
   recordJailMode,
+  resolveJailPolicy,
   runtimeModulePathsFor,
 } from './jail';
 import {
@@ -171,32 +173,47 @@ const FORWARDED_ENV = [
 ] as const;
 
 /**
- * The PATH a hook child gets: the CLI's own directory ahead of the inherited
- * one, so the child can exec the SAME `celilo` the parent runs.
+ * The directory holding the `celilo` bin of the running CLI package, resolved
+ * from this file's own location: src/hooks -> the package's bin/. Every
+ * distribution layout lands there. The .deb wrapper execs
+ * `$CELILO_HOME/node_modules/@celilo/cli/bin/celilo` directly (packaging/celilo/
+ * scripts/wrapper.sh), and a bun global install symlinks ~/.bun/bin/celilo into
+ * that same bin directory, whose script self-locates its package dir.
+ */
+export const CLI_BIN_DIR = join(import.meta.dir, '..', '..', 'bin');
+
+/**
+ * The PATH a hook child gets: the CLI package's own bin directory, then the
+ * runtime's, ahead of the inherited one — so the child can exec the SAME
+ * `celilo` the parent runs, and that celilo can still find its interpreter.
  *
- * A bun global install lands the `celilo` bin beside the bun binary itself
- * (install.sh sets `BUN_INSTALL/bin`, default `~/.bun/bin`), so
- * `dirname(process.execPath)` is that directory. The inherited PATH carries no
- * such guarantee: the e2e management image runs the CLI only through an
- * absolute-path wrapper at /usr/local/bin because its ENV has no /root/.bun/bin,
- * and every hook that spawned `celilo` by name — caddy-internal's
- * `on_consumer_removed` route withdrawal — died with "Executable not found in
- * $PATH", leaving the stale routes it was withdrawing in place (celilo#1300).
- * A real fleet hits the same class whenever the CLI is launched by a systemd
- * unit or an absolute path with a minimal PATH.
+ * `dirname(process.execPath)` alone is NOT the CLI's directory under the fleet
+ * layout: the .deb runs the CLI through a wrapper at /usr/local/bin/celilo that
+ * execs bun on `node_modules/@celilo/cli/src/cli/index.ts`, so the directory
+ * beside the bun binary holds only bun (measured on the fleet, 2026-09-07,
+ * ce-y0fd). Hooks then found `celilo` only because the systemd unit happened to
+ * inherit /usr/local/bin on its PATH — the same accident that broke every hook
+ * spawning `celilo` by name in the e2e management image (celilo#1300).
+ * CLI_BIN_DIR resolves where the bin actually lives, whatever layout launched
+ * the parent, and comes FIRST so `celilo` is the package's own bin rather than
+ * an operator's wrapper. The runtime directory stays second because bin/celilo
+ * needs `command -v bun` (it is bash, not a shebanged TS file).
  *
- * Already-present wins: an operator who has the directory on PATH sees an
- * unchanged value. An absent inherited PATH still yields the CLI directory,
- * so a hook can always reach `celilo` even from a stripped parent.
+ * Already-present wins: an operator who has a directory on PATH sees an
+ * unchanged value. An absent inherited PATH still yields both directories, so
+ * a hook can always reach `celilo` even from a stripped parent; bash resolves
+ * through the loader's default search.
  *
  * Exported for the allow-list tests (hook-trespass.test.ts), which pin this
  * contract the same way they pin the rest of the child environment.
  */
 export function childPath(inherited: string | undefined): string {
-  const cliDir = dirname(process.execPath);
-  if (inherited === undefined) return cliDir;
-  if (inherited.split(':').includes(cliDir)) return inherited;
-  return `${cliDir}:${inherited}`;
+  const base = inherited === undefined ? [] : inherited.split(':');
+  const prepended: string[] = [];
+  for (const dir of [CLI_BIN_DIR, dirname(process.execPath)]) {
+    if (!base.includes(dir) && !prepended.includes(dir)) prepended.push(dir);
+  }
+  return [...prepended, ...base].join(':');
 }
 
 /** The shim celilo spawns. Resolved from here so an npm install finds it too. */
@@ -330,6 +347,25 @@ export interface ExecuteHookOptions {
   hookStores?: HookStoresProvider;
 }
 
+/**
+ * The stored `hooks.jail_policy` value, or undefined when there is no row or
+ * no celilo DB to ask (a dev box). Same row-read pattern as
+ * `ipam/auto-allocator.ts` and the executor's fellow consumer
+ * `cli/commands/system-doctor.ts`; the drizzle table is `systemConfig` in
+ * `db/schema.ts`.
+ *
+ * Unlike `remoteAccess`, this read happens here rather than through a
+ * caller-built input because D2 names the executor itself as one of the two
+ * consumers that fetch the stored row and hand it to the pure resolver.
+ */
+function readStoredJailPolicy(): string | undefined {
+  if (!existsSync(getDbPath())) return undefined;
+  const row = getDb()
+    .$client.prepare('SELECT value FROM system_config WHERE key = ?')
+    .get('hooks.jail_policy') as { value: string } | undefined;
+  return row?.value;
+}
+
 /**
  * Execute a hook script
  *
@@ -394,7 +430,7 @@ export async function executeHookScript(
       [process.execPath, HOOK_RUNNER_SPAWN_PATH],
       mountSet,
       detectJailBackend(),
-      jailPolicy(),
+      resolveJailPolicy(process.env.CELILO_HOOK_JAIL, readStoredJailPolicy()).policy,
     );
     reportJail(jail, logger);
     // Only a real module hook says anything about whether this HOST jails. An

package/src/hooks/hook-store.test.ts

@@ -14,6 +14,7 @@ import { join } from 'node:path';
 import { type DbClient, closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { moduleConfigs, modules, secrets } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { createHookStores } from './hook-store';
 
 describe('hook stores', () => {
@@ -54,6 +55,11 @@ describe('hook stores', () => {
 
   afterEach(() => {
     closeDb();
+    // The variable pointed at this suite's (now removed) temp database;
+    // leaving it set sends the next var-less reader at a dangling path.
+    // Reset to the scratch path so no later reader reaches the operator's
+    // real celilo.db (celilo#1315).
+    resetTestDbPath();
     rmSync(testDir, { recursive: true, force: true });
     delete process.env.CELILO_MASTER_KEY_PATH;
   });

package/src/hooks/hook-trespass.test.ts

@@ -31,7 +31,7 @@ import {
   listUnpublishedWorkspacePackages,
   planFallbacks,
 } from '../../../../scripts/workspace-fallback';
-import { childPath, executeHookScript, hookChildEnv } from './executor';
+import { CLI_BIN_DIR, childPath, executeHookScript, hookChildEnv } from './executor';
 import { HOOK_PROTOCOL_VERSION } from './hook-protocol';
 import { detectJailBackend, jailPolicy } from './jail';
 import { createCapturingLogger } from './logger';
@@ -246,19 +246,29 @@ describe('the child environment is an allow-list', () => {
   // celilo#1300: a hook that spawns `celilo` by name must find the same CLI
   // the parent runs, whatever the inherited PATH looks like.
   describe('childPath', () => {
-    test('prepends the runtime directory so the child reaches the parent CLI', () => {
+    test('prepends the CLI bin and runtime directories so the child reaches the parent CLI', () => {
       const child = childPath('/usr/local/bin:/usr/bin');
-      expect(child.startsWith(`${dirname(process.execPath)}:`)).toBe(true);
+      expect(child.startsWith(`${CLI_BIN_DIR}:${dirname(process.execPath)}:`)).toBe(true);
       expect(child.endsWith('/usr/local/bin:/usr/bin')).toBe(true);
     });
 
-    test('leaves an inherited PATH that already carries the directory unchanged', () => {
-      const already = `${dirname(process.execPath)}:/usr/bin`;
+    test('leaves an inherited PATH that already carries the directories unchanged', () => {
+      const already = `${CLI_BIN_DIR}:${dirname(process.execPath)}:/usr/bin`;
       expect(childPath(already)).toBe(already);
     });
 
-    test('substitutes the directory when the parent has no PATH at all', () => {
-      expect(childPath(undefined)).toBe(dirname(process.execPath));
+    test('substitutes both directories when the parent has no PATH at all', () => {
+      expect(childPath(undefined)).toBe(`${CLI_BIN_DIR}:${dirname(process.execPath)}`);
+    });
+
+    // The fleet gate (ce-y0fd): the .deb layout runs the CLI through
+    // $CELILO_HOME/node_modules/@celilo/cli/bin/celilo, so the directory beside
+    // process.execPath holds only bun and holds no celilo. A PATH that resolves
+    // `celilo` must therefore come from the CLI package's own bin directory —
+    // and that directory must really contain the bin, or every prepended PATH
+    // entry is decoration over the same accident celilo#1300 recorded.
+    test('prepends a CLI bin directory that actually contains the celilo bin', () => {
+      expect(existsSync(join(CLI_BIN_DIR, 'celilo'))).toBe(true);
     });
   });
 });

package/src/hooks/jail.test.ts

@@ -27,6 +27,7 @@ import {
   readJailMode,
   realpathRequest,
   recordJailMode,
+  resolveJailPolicy,
   runtimeModulePathsFor,
 } from './jail';
 import { deriveMountSet } from './mount-set';
@@ -272,8 +273,12 @@ describe('jailPolicy reads the operator’s switch', () => {
     }
   };
 
-  test('unset is auto', () => {
-    expect(withEnv(undefined, jailPolicy)).toBe('auto');
+  test('unset is off (peba, ce-rez7)', () => {
+    expect(withEnv(undefined, jailPolicy)).toBe('off');
+  });
+
+  test('an explicit auto still means auto', () => {
+    expect(withEnv('auto', jailPolicy)).toBe('auto');
   });
 
   test('a typo is refused rather than silently meaning auto', () => {
@@ -284,6 +289,60 @@ describe('jailPolicy reads the operator’s switch', () => {
   });
 });
 
+describe('resolveJailPolicy applies D2 precedence (hook-jail-config-surface)', () => {
+  test('an env value set and non-empty wins over stored config', () => {
+    expect(resolveJailPolicy('required', 'off')).toEqual({ policy: 'required', source: 'env' });
+  });
+
+  test('an EMPTY STRING env value counts as unset and falls through to config', () => {
+    // jailPolicy() already treats '' as unset, so the resolver agrees rather
+    // than inventing a second rule for what counts as set.
+    expect(resolveJailPolicy('', 'off')).toEqual({ policy: 'off', source: 'config' });
+  });
+
+  test('stored config wins when the env var is absent', () => {
+    expect(resolveJailPolicy(undefined, 'off')).toEqual({ policy: 'off', source: 'config' });
+    expect(resolveJailPolicy(undefined, 'required')).toEqual({
+      policy: 'required',
+      source: 'config',
+    });
+  });
+
+  test('both absent resolves to off from the default (peba, ce-rez7)', () => {
+    expect(resolveJailPolicy(undefined, undefined)).toEqual({ policy: 'off', source: 'default' });
+    expect(resolveJailPolicy('', undefined)).toEqual({ policy: 'off', source: 'default' });
+  });
+
+  test('an explicit env auto still wins (peba, ce-rez7)', () => {
+    expect(resolveJailPolicy('auto', 'off')).toEqual({ policy: 'auto', source: 'env' });
+  });
+
+  test('a stored empty jail_policy THROWS, it does not resolve to auto (peba, ce-8832)', () => {
+    // The set-time pattern ^(auto|off|required)$ rejects '', so a stored one
+    // can only arrive via a restore from file or a hand edit to the DB — the
+    // untrusted paths D3 exists to catch. It is outside the enum and fails
+    // closed like any other bad stored value.
+    expect(() => resolveJailPolicy(undefined, '')).toThrow(/is not a hook jail policy/);
+    expect(() => resolveJailPolicy(undefined, '')).toThrow(/hooks\.jail_policy=''/);
+  });
+
+  test('a typo in the STORED row is refused, not silently treated as auto (D3)', () => {
+    // The DB row is a trust boundary like any other (Rule 3.7): restores carry
+    // foreign state, and a typo that silently meant `auto` reads as an armed
+    // jail when nothing is armed. The config path is no laxer than the env
+    // path.
+    expect(() => resolveJailPolicy(undefined, 'alwayssafe')).toThrow(/is not a hook jail policy/);
+    expect(() => resolveJailPolicy(undefined, 'alwayssafe')).toThrow(
+      /hooks\.jail_policy='alwayssafe'/,
+    );
+  });
+
+  test('a typo in the env value is still refused (unchanged jailPolicy behaviour)', () => {
+    expect(() => resolveJailPolicy('requried', undefined)).toThrow(/is not a hook jail policy/);
+    expect(() => resolveJailPolicy('requried', 'off')).toThrow(/CELILO_HOOK_JAIL='requried'/);
+  });
+});
+
 describe('realpath at the caller (task 4.2k)', () => {
   test('a symlinked module root is resolved before it becomes a bind', () => {
     // `mod.sourcePath` comes out of the database, and a database restored from