@celilo/cli 2.2.0 → 2.2.1

package/src/test-utils/bus-responder.ts

@@ -50,6 +50,7 @@ import {
   type ResponderValues,
   startProgrammaticResponder,
 } from '../services/programmatic-responder';
+import { resetTestDbPath } from './db-path';
 
 export interface BusResponderFixtureOptions extends ResponderValues {
   /** Path to the bus sqlite db (shared with the celilo subprocess). */
@@ -98,7 +99,6 @@ export function startBusResponderFixture(opts: BusResponderFixtureOptions): BusR
   const prevDataDir = process.env.CELILO_DATA_DIR;
   process.env.CELILO_DATA_DIR = opts.dataDir;
 
-  const prevDbPath = process.env.CELILO_DB_PATH;
   process.env.CELILO_DB_PATH = opts.celiloDbPath;
   const db: DbClient = createDbClient();
 
@@ -132,8 +132,10 @@ export function startBusResponderFixture(opts: BusResponderFixtureOptions): BusR
       db.$client.close();
       if (prevDataDir === undefined) process.env.CELILO_DATA_DIR = undefined;
       else process.env.CELILO_DATA_DIR = prevDataDir;
-      if (prevDbPath === undefined) process.env.CELILO_DB_PATH = undefined;
-      else process.env.CELILO_DB_PATH = prevDbPath;
+      // Reset to the scratch path, never restore the previous value: it may
+      // be another suite's temp database, or unset — which sends the next
+      // var-less reader to the operator's real celilo.db (celilo#1315).
+      resetTestDbPath();
     },
   };
 }

package/src/test-utils/db-path.ts

@@ -0,0 +1,25 @@
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+/**
+ * The neutral database path the test preload arms `CELILO_DB_PATH` with
+ * (celilo#1315). The file does not exist, so a reader falls into whatever
+ * "no database" branch its feature has — and no test ever opens the
+ * operator's real `~/Library/.../celilo.db`, which is what a suite that
+ * reads the variable without setting it would otherwise reach.
+ *
+ * Why teardowns RESET to this path instead of `delete`: bunfig's `[test]`
+ * preload runs ONCE PER PROCESS, not once per test file. A teardown that
+ * clears the variable leaves every later var-less reader on the real
+ * database for the rest of the run. Resetting to the scratch path keeps the
+ * preload's invariant standing from the first test to the last.
+ */
+export const SCRATCH_DB_PATH = join(tmpdir(), 'celilo-test-absent.db');
+
+/**
+ * Point `CELILO_DB_PATH` at the neutral scratch path. Call from a test's
+ * afterEach (or any teardown) that pointed the variable somewhere else.
+ */
+export function resetTestDbPath(): void {
+  process.env.CELILO_DB_PATH = SCRATCH_DB_PATH;
+}

package/src/test-utils/integration.ts

@@ -54,6 +54,13 @@ export interface IntegrationTestContext {
  * ```
  */
 export async function setupIntegrationTest(): Promise<IntegrationTestContext> {
+  // celilo#1246: the shell on a dev host carries CELILO_HOME pointing at the
+  // live install (DB and master.key included). Every CLI child this harness
+  // spawns would inherit it, and isolation would then rest on the per-run
+  // CELILO_DB_PATH / CELILO_DATA_DIR overrides below never being missed.
+  // Unset it once, here, so no child ever sees the live home.
+  delete process.env.CELILO_HOME;
+
   // Setup isolated database
   const testDb = await setupTestDatabaseFile();
   const dbPath = testDb.path;

package/src/test-utils/module-fixtures.ts

@@ -8,6 +8,7 @@
  */
 
 import { CLIContext } from './cli-context';
+import { resetTestDbPath } from './db-path';
 import { getModuleTestConfig } from './fixtures';
 import { type IntegrationTestContext, setupIntegrationTest } from './integration';
 
@@ -50,7 +51,6 @@ interface HomebridgeModuleOptions extends BaseFixtureOptions {
 async function insertMockContainerService(dbPath: string): Promise<void> {
   const { getDb } = await import('../db/client');
   const { containerServices } = await import('../db/schema');
-  const originalDbPath = process.env.CELILO_DB_PATH;
   process.env.CELILO_DB_PATH = dbPath;
   try {
     const db = getDb();
@@ -77,11 +77,10 @@ async function insertMockContainerService(dbPath: string): Promise<void> {
       updatedAt: new Date(),
     });
   } finally {
-    if (originalDbPath) {
-      process.env.CELILO_DB_PATH = originalDbPath;
-    } else {
-      process.env.CELILO_DB_PATH = undefined;
-    }
+    // Reset to the scratch path, never restore the previous value: it may
+    // be another suite's temp database, or unset — which sends the next
+    // var-less reader to the operator's real celilo.db (celilo#1315).
+    resetTestDbPath();
   }
 }
 

package/src/module/packaging/generated-plane.test.ts

@@ -1,79 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import {
-  compareVerbatimRoleAssets,
-  describeVerbatimDifferences,
-  readVerbatimRoleAssets,
-} from './generated-plane';
-
-describe('compareVerbatimRoleAssets', () => {
-  const asset = 'ansible/roles/vpn/files/vpn-linux-x86_64';
-
-  test('identical trees produce no differences', () => {
-    const both = new Map([[asset, 'aaa']]);
-    expect(compareVerbatimRoleAssets(both, new Map(both))).toEqual([]);
-  });
-
-  test('the celilo#925 shape: generated holds the previous version bytes', () => {
-    const differences = compareVerbatimRoleAssets(
-      new Map([[asset, 'new-digest']]),
-      new Map([[asset, 'old-digest']]),
-    );
-    expect(differences).toEqual([
-      {
-        relPath: asset,
-        reason: 'stale',
-        installedDigest: 'new-digest',
-        generatedDigest: 'old-digest',
-      },
-    ]);
-    expect(describeVerbatimDifferences(differences)[0]).toContain(asset);
-  });
-
-  test('an asset generation never produced is missing, not stale', () => {
-    expect(compareVerbatimRoleAssets(new Map([[asset, 'aaa']]), new Map())).toEqual([
-      { relPath: asset, reason: 'missing', installedDigest: 'aaa', generatedDigest: null },
-    ]);
-  });
-
-  test('output for a role the module no longer has is not a difference', () => {
-    // Nothing includes it, so refusing a deploy over it would refuse a correct
-    // module for a file Ansible never reads.
-    expect(
-      compareVerbatimRoleAssets(new Map(), new Map([['ansible/roles/gone/files/x', 'aaa']])),
-    ).toEqual([]);
-  });
-});
-
-describe('readVerbatimRoleAssets', () => {
-  test('digests role files/ assets and nothing else', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'celilo-plane-'));
-    try {
-      mkdirSync(join(root, 'ansible', 'roles', 'vpn', 'files', 'nested'), { recursive: true });
-      mkdirSync(join(root, 'ansible', 'roles', 'vpn', 'templates'), { recursive: true });
-      writeFileSync(join(root, 'ansible', 'roles', 'vpn', 'files', 'bin'), 'NEW');
-      writeFileSync(join(root, 'ansible', 'roles', 'vpn', 'files', 'nested', 'blob'), 'B');
-      // Templated, and expected to differ once generated. Must not be compared.
-      writeFileSync(join(root, 'ansible', 'roles', 'vpn', 'templates', 'x.j2'), '{{ v }}');
-
-      const assets = await readVerbatimRoleAssets(root);
-      expect([...assets.keys()].sort()).toEqual([
-        'ansible/roles/vpn/files/bin',
-        'ansible/roles/vpn/files/nested/blob',
-      ]);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  test('a module with no ansible/ at all yields nothing rather than throwing', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'celilo-plane-'));
-    try {
-      expect((await readVerbatimRoleAssets(root)).size).toBe(0);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-});

package/src/module/packaging/generated-plane.ts

@@ -1,134 +0,0 @@
-/**
- * The second plane: is what we would deploy built from what we installed?
- *
- * A module exists in four places — the published package, the installed tree,
- * the generated project, and the host — and celilo reported a version for the
- * first as though it described the last. Between them sit three copies and two
- * transformations, and nothing verified any of them against the one before it
- * (openspec/changes/module-integrity-rigor, D3).
- *
- * Only VERBATIM assets have a meaningful expected digest. Ansible templates
- * most of what it writes, and a `.j2` in `generated/` is supposed to differ
- * from its source. `ansible/roles/<role>/files/` is the exception: it holds
- * static assets — built binaries, certs, blobs — copied byte for byte because
- * they need no variable resolution and may not survive utf-8 round-tripping.
- *
- * That is exactly where celilo#925 lived. `copyAnsibleRoleFilesDirs` skipped an
- * existing destination on bun, so a module's built binary landed in
- * `generated/` once, at first generate, and no later version replaced it.
- * `cp` reported no error, Ansible copied that first binary forever and reported
- * `ok`, and the module's version field advanced past code that was never
- * shipped. This comparison is local, takes milliseconds, needs no SSH, and is
- * the check that turns that silence into a refusal.
- */
-
-import { existsSync } from 'node:fs';
-import { readdir } from 'node:fs/promises';
-import { join, relative } from 'node:path';
-import { computeFileChecksum } from './checksum';
-
-export interface VerbatimAssetDifference {
-  /** Path relative to the module root, identical in both trees. */
-  relPath: string;
-  /** `missing`: generation never produced it. `stale`: it holds other bytes. */
-  reason: 'missing' | 'stale';
-  installedDigest: string;
-  generatedDigest: string | null;
-}
-
-/**
- * Pure. Both sides are digest maps keyed by the same module-relative path.
- *
- * An asset present in `generated` but absent from `installed` is NOT reported.
- * That is a role the module no longer has, whose old output nothing includes,
- * and failing a deploy for it would refuse a correct module for a stale file
- * Ansible never reads.
- */
-export function compareVerbatimRoleAssets(
-  installed: ReadonlyMap<string, string>,
-  generated: ReadonlyMap<string, string>,
-): VerbatimAssetDifference[] {
-  const differences: VerbatimAssetDifference[] = [];
-  for (const [relPath, installedDigest] of installed) {
-    const generatedDigest = generated.get(relPath) ?? null;
-    if (generatedDigest === null) {
-      differences.push({ relPath, reason: 'missing', installedDigest, generatedDigest: null });
-    } else if (generatedDigest !== installedDigest) {
-      differences.push({ relPath, reason: 'stale', installedDigest, generatedDigest });
-    }
-  }
-  return differences;
-}
-
-/**
- * Digest every `ansible/roles/<role>/files/**` asset under `root`, keyed by its
- * path relative to `root`. The generated project mirrors that layout, so the
- * two maps this produces are directly comparable.
- */
-export async function readVerbatimRoleAssets(root: string): Promise<Map<string, string>> {
-  const assets = new Map<string, string>();
-  const rolesDir = join(root, 'ansible', 'roles');
-  if (!existsSync(rolesDir)) return assets;
-
-  for (const role of await readdir(rolesDir, { withFileTypes: true })) {
-    if (!role.isDirectory()) continue;
-    const filesDir = join(rolesDir, role.name, 'files');
-    if (!existsSync(filesDir)) continue;
-    for (const filePath of await listFiles(filesDir)) {
-      assets.set(relative(root, filePath), await computeFileChecksum(filePath));
-    }
-  }
-  return assets;
-}
-
-async function listFiles(dir: string): Promise<string[]> {
-  const found: string[] = [];
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
-    const full = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      found.push(...(await listFiles(full)));
-    } else if (entry.isFile()) {
-      found.push(full);
-    }
-  }
-  return found;
-}
-
-/**
- * One line per difference, naming the file. celilo#925 took days partly because
- * nothing anywhere named the file that had gone stale.
- */
-export function describeVerbatimDifferences(differences: VerbatimAssetDifference[]): string[] {
-  return differences.map((d) =>
-    d.reason === 'missing'
-      ? `${d.relPath}: generation never produced it (installed ${d.installedDigest})`
-      : `${d.relPath}: generated holds ${d.generatedDigest}, installed is ${d.installedDigest}`,
-  );
-}
-
-/**
- * The deploy pre-flight (D6). Returns the refusal message, or `null` to proceed.
- *
- * Local, milliseconds, no SSH, and it runs before anything contacts a system.
- * It deliberately does NOT verify after the deploy: Ansible's `changed` is
- * truthful about what Ansible did, and the lie in celilo#925 was upstream of
- * Ansible.
- */
-export async function refuseIfGeneratedIsStale(
-  moduleId: string,
-  modulePath: string,
-  generatedPath: string,
-): Promise<string | null> {
-  const differences = compareVerbatimRoleAssets(
-    await readVerbatimRoleAssets(modulePath),
-    await readVerbatimRoleAssets(generatedPath),
-  );
-  if (differences.length === 0) return null;
-  return [
-    `Refusing to deploy ${moduleId}: the generated project does not match the installed module.`,
-    `  ${differences.length} verbatim asset(s) differ:`,
-    ...describeVerbatimDifferences(differences).map((line) => `    ${line}`),
-    '',
-    `Deploying would ship these bytes and report success. Run 'celilo module generate ${moduleId}' and try again.`,
-  ].join('\n');
-}