@celilo/cli 2.2.0 → 2.3.0

package/src/services/cross-module-read.test.ts

@@ -15,6 +15,7 @@ import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   type CrossModuleIndex,
   applyCrossModuleWriteRoot,
@@ -70,8 +71,8 @@ describe('materializeCrossModuleRoot', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.CELILO_DATA_DIR = undefined;
+    resetTestDbPath();
+    delete process.env.CELILO_DATA_DIR;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -179,7 +180,7 @@ describe('applyCrossModuleWriteRoot', () => {
   });
 
   afterEach(() => {
-    process.env.CELILO_DATA_DIR = undefined;
+    delete process.env.CELILO_DATA_DIR;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/deploy-preflight.ts

@@ -27,6 +27,7 @@ import type { DbClient } from '../db/client';
 import { getDb } from '../db/client';
 import { capabilities, moduleConfigs, modules, secrets } from '../db/schema';
 import { type ModuleManifest, getSingularSystemSpec } from '../manifest/schema';
+import { isPrivilegedCapability } from '../manifest/validate';
 import { buildResolutionContext } from '../variables/context';
 import { E2E_CONFLICT_FIX, runningE2eContainers } from './e2e-guard';
 import { describeCapabilityProblem, findBrokenCapabilityDerivations } from './fleet-checks';
@@ -113,6 +114,12 @@ export async function runPreflight(
   //    template-generation against an ABI the provider can't fulfil.
   if (manifest.requires?.capabilities) {
     for (const cap of manifest.requires.capabilities) {
+      // Framework-granted privileges (e.g. cross_module_read) aren't
+      // provider-backed — they're gated by the allow-list at import time,
+      // not satisfied by deploying another module. Skip them here.
+      if (isPrivilegedCapability(cap.name)) {
+        continue;
+      }
       const providers = db
         .select()
         .from(capabilities)

package/src/services/deploy-validation.test.ts

@@ -21,6 +21,7 @@ import { join } from 'node:path';
 import { type DbClient, getDb } from '../db/client';
 import { modules, secrets } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { findMissingSecrets } from './config-interview';
 import { findMissingBuildArtifacts, findMissingRequiredVariables } from './deploy-validation';
 
@@ -89,7 +90,7 @@ describe('findMissingRequiredVariables (deploy path)', () => {
 
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   // The bug we're guarding against: the deploy used to drop type +
@@ -210,7 +211,7 @@ describe('findMissingSecrets (shared)', () => {
 
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   test('accepts loose unknown[] declares (manifest read off disk)', async () => {

package/src/services/deployed-systems.ts

@@ -242,7 +242,7 @@ export function upsertDeployedSystem(
     .run();
 }
 
-function asZone(value: string | null | undefined): NetworkZone | null {
+export function asZone(value: string | null | undefined): NetworkZone | null {
   return value && (NETWORK_ZONES as readonly string[]).includes(value)
     ? (value as NetworkZone)
     : null;

package/src/services/dns-internal-records.test.ts

@@ -8,6 +8,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { dnsInternalRecords, modules } from '../db/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   listDnsInternalRecords,
   listViewOverrides,
@@ -42,7 +43,7 @@ describe('dns-internal-records ledger', () => {
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -248,7 +249,7 @@ describe('provider cascade (celilo#1010)', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dir, { recursive: true, force: true });
   });
 

package/src/services/dns-provider-backfill.test.ts

@@ -6,6 +6,7 @@ import type { DnsRecordRequest, HookLogger } from '@celilo/capabilities';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { capabilities, moduleConfigs, modules, webRoutes } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { backfillWebRouteDns } from './dns-provider-backfill';
 
 const silentLogger: HookLogger = {
@@ -26,7 +27,7 @@ describe('backfillWebRouteDns (ISS-0029)', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/dns-registrations.test.ts

@@ -14,6 +14,7 @@ import type { DnsRegistrarCapability } from '@celilo/capabilities';
 import { eq } from 'drizzle-orm';
 import { type DbClient, getDb } from '../db/client';
 import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   listDnsRegistrations,
   recordDnsRegistration,
@@ -44,7 +45,7 @@ describe('dns_registrations ledger', () => {
 
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   test('record + list roundtrip; a re-assert is an upsert, not a second row', () => {

package/src/services/ensure-interview.test.ts

@@ -8,6 +8,7 @@ import { moduleConfigs, modules, secrets } from '../db/schema';
 import type { Ensure } from '../manifest/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   findEnsureOnProvider,
   interviewForEnsureInputs,
@@ -56,7 +57,7 @@ describe('interviewForEnsureInputs', () => {
 
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   test('appends to array config and sets secret object key', async () => {
@@ -185,7 +186,7 @@ describe('findEnsureOnProvider', () => {
 
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   test('finds ensure by id on a registered provider', () => {

package/src/services/fleet-checks.test.ts

@@ -3,8 +3,10 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
+import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import {
+  buildBusHookRuns,
   capabilities as capabilitiesTable,
   dnsInternalRecords,
   moduleConfigs,
@@ -14,11 +16,13 @@ import {
 } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { ensureInboundSubscriber, ensureSweepSubscriber } from './alerting/monitors';
 import { ensureBackupSweepSubscriber } from './backup-sweep';
 import { getDaemonUnitPath } from './events-daemon';
 import {
   type HostLivenessInputs,
+  checkBuildBusPublishing,
   checkCapabilityProviders,
   checkControlPlaneNetwork,
   checkDispatcher,
@@ -95,7 +99,7 @@ describe('checkDispatcher', () => {
   });
   afterEach(() => {
     bus.close();
-    process.env.EVENT_BUS_DB = undefined;
+    delete process.env.EVENT_BUS_DB;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -269,8 +273,8 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
   afterEach(() => {
     bus.close();
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.EVENT_BUS_DB = undefined;
+    resetTestDbPath();
+    delete process.env.EVENT_BUS_DB;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -291,6 +295,118 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
       .run();
   }
 
+  describe('checkBuildBusPublishing', () => {
+    const now = Date.now();
+
+    /** A module whose installed manifest really declares on_upstream_publish. */
+    function insertHookModule(id: string): void {
+      const src = join(dir, `${id}-src`);
+      mkdirSync(src, { recursive: true });
+      writeFileSync(
+        join(src, 'manifest.yml'),
+        [
+          'celilo_contract: "1.0"',
+          `id: ${id}`,
+          `name: ${id}`,
+          'version: 1.0.0',
+          'requires: { capabilities: [] }',
+          'provides: { capabilities: [] }',
+          'variables: { owns: [], imports: [] }',
+          'hooks:',
+          '  on_upstream_publish:',
+          '    - name: self-update',
+          '      match: { registry: npm, tag: latest, package_pattern: "@celilo/cli" }',
+          '      script: ./scripts/update.sh',
+        ].join('\n'),
+      );
+      insertModule(id, baseManifest({ id, name: id }), 'VERIFIED');
+      // insertModule pins sourcePath to /src/<id>; point it at the real manifest.
+      db.update(modules).set({ sourcePath: src }).where(eq(modules.id, id)).run();
+    }
+
+    function seedRun(overrides: Partial<typeof buildBusHookRuns.$inferInsert> = {}): void {
+      db.insert(buildBusHookRuns)
+        .values({
+          eventId: 'evt-1',
+          packageName: '@celilo/cli',
+          packageVersion: '2.2.1',
+          tag: 'latest',
+          moduleId: 'celilo-mgmt',
+          hookName: 'self-update',
+          scriptPath: '/src/celilo-mgmt/scripts/update.sh',
+          exitCode: 0,
+          timedOut: false,
+          durationMs: 1200,
+          // Default to the freshest time, not the describe-time `now`:
+          // emitRaw stamps the bus event with its own Date.now(), and a
+          // run stamped even 1ms earlier would read as "predates the
+          // newest publish".
+          ranAt: new Date(Date.now()),
+          ...overrides,
+        })
+        .run();
+    }
+
+    it('is ok when no installed module declares on_upstream_publish', () => {
+      const f = checkBuildBusPublishing(bus, db, { now });
+      expect(f.status).toBe('ok');
+      expect(f.summary).toContain('not in use');
+    });
+
+    it('warns when a self-update module is installed but no publish has ever arrived', () => {
+      insertHookModule('celilo-mgmt');
+      const f = checkBuildBusPublishing(bus, db, { now });
+      expect(f.status).toBe('warn');
+      expect(f.summary).toContain('no build-bus publish has ever arrived');
+      expect(f.remediation).toContain('subscribers serve');
+    });
+
+    it('warns when publishes arrive but no hook has ever run', () => {
+      insertHookModule('celilo-mgmt');
+      bus.emitRaw('build-bus.publish', { eventId: 'evt-1' });
+      const f = checkBuildBusPublishing(bus, db, { now });
+      expect(f.status).toBe('warn');
+      expect(f.summary).toContain('no self-update hook has ever run');
+    });
+
+    it('warns with the stderr tail when the newest run failed', () => {
+      insertHookModule('celilo-mgmt');
+      bus.emitRaw('build-bus.publish', { eventId: 'evt-1' });
+      seedRun({ exitCode: 1, stderrTail: 'bun add -g failed; not promoting' });
+      const f = checkBuildBusPublishing(bus, db, { now });
+      expect(f.status).toBe('warn');
+      expect(f.summary).toContain('exited 1');
+      expect(f.detail.join('\n')).toContain('bun add -g failed');
+    });
+
+    it('warns when the newest run timed out', () => {
+      insertHookModule('celilo-mgmt');
+      bus.emitRaw('build-bus.publish', { eventId: 'evt-1' });
+      seedRun({ exitCode: null, timedOut: true, durationMs: 300000 });
+      const f = checkBuildBusPublishing(bus, db, { now });
+      expect(f.status).toBe('warn');
+      expect(f.summary).toContain('timed out');
+    });
+
+    it('warns when the newest run predates the newest publish — that publish dispatched nothing', () => {
+      insertHookModule('celilo-mgmt');
+      bus.emitRaw('build-bus.publish', { eventId: 'evt-2' });
+      seedRun({ ranAt: new Date(now - 60 * MINUTE) });
+      const f = checkBuildBusPublishing(bus, db, { now });
+      expect(f.status).toBe('warn');
+      expect(f.summary).toContain('dispatched nothing');
+    });
+
+    it('is ok when the newest run succeeded and is fresh', () => {
+      insertHookModule('celilo-mgmt');
+      bus.emitRaw('build-bus.publish', { eventId: 'evt-1' });
+      seedRun();
+      const f = checkBuildBusPublishing(bus, db, { now });
+      expect(f.status).toBe('ok');
+      expect(f.summary).toContain('@celilo/cli@2.2.1');
+    });
+  });
+
   describe('checkSubscribers', () => {
     it('fails when a deployed module declares a subscription the bus is missing', () => {
       insertModule(
@@ -448,7 +564,11 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
         .run();
       const f = checkCapabilityProviders(db);
       expect(f.status).toBe('ok');
-      expect(f.detail.join(' ')).toContain('celilo capability chain');
+      // celilo#1308: `celilo capability chain` no longer exists, so the detail
+      // says the verification is by hand rather than naming a command that
+      // cannot run.
+      expect(f.detail.join(' ')).toContain('verify these by hand');
+      expect(f.detail.join(' ')).not.toContain('celilo capability chain');
     });
   });
 
@@ -978,8 +1098,8 @@ describe('runFleetChecks includes host liveness (#728)', () => {
   afterEach(() => {
     bus.close();
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.EVENT_BUS_DB = undefined;
+    resetTestDbPath();
+    delete process.env.EVENT_BUS_DB;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/fleet-checks.ts

@@ -17,13 +17,16 @@
  * rendering + `--fix` orchestration lives in the doctor command.
  */
 
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { type Bus, describeError } from '@celilo/event-bus';
-import { inArray } from 'drizzle-orm';
+import { desc, eq, inArray } from 'drizzle-orm';
+import { parse as parseYaml } from 'yaml';
 import { ProxmoxClient, type ProxmoxCredentials } from '../api-clients/proxmox';
 import { getModuleStoragePath } from '../config/paths';
 import { type DbClient, findMigrationsFolder } from '../db/client';
 import { getMigrationStatus } from '../db/migration-status';
-import { capabilities as capabilitiesTable, modules } from '../db/schema';
+import { buildBusHookRuns, capabilities as capabilitiesTable, modules } from '../db/schema';
 import { findSchemaDrift } from '../db/schema-introspection';
 import { loadControlPlaneSubnet, resolveFirewallNatIp } from '../hooks/capability-loader';
 import type { ModuleManifest } from '../manifest/schema';
@@ -384,6 +387,172 @@ export function checkDispatcher(bus: Bus, opts: DispatcherCheckOptions = {}): Fl
   };
 }
 
+/**
+ * The build-bus self-update chain, asserted outcome-first like every check
+ * here. Four facts separate the ways `on_upstream_publish` silently does
+ * nothing (celilo#1304: the CLI on a management box aged in place while the
+ * doctor's dispatcher check read green — that check covers the event-bus
+ * dispatcher, which no build-bus hook ever travels through):
+ *
+ *   1. no module declares the hook        → nothing can self-update; not in use
+ *   2. `build-bus.publish` events arrive  → the webhook path works end to end
+ *   3. hook-run rows exist for an event   → the dispatcher ran matching hooks
+ *   4. the newest run exited 0            → the self-update itself succeeded
+ *
+ * Facts 3 and 4 read the `build_bus_hook_runs` ledger the dispatcher writes;
+ * before that ledger existed, a failed self-update existed only as daemon
+ * console output, which no surface reads.
+ */
+export function checkBuildBusPublishing(
+  bus: Bus,
+  db: DbClient,
+  opts: { now?: number } = {},
+): FleetFinding {
+  const now = opts.now ?? Date.now();
+
+  const hookModules = db
+    .select({ id: modules.id })
+    .from(modules)
+    .where(inArray(modules.state, ['INSTALLED', 'VERIFIED']))
+    .all()
+    .filter((m) => hasUpstreamPublishHooks(db, m.id));
+
+  const finding = (
+    status: FleetFindingStatus,
+    summary: string,
+    detail: string[],
+    remediation: string | null,
+  ): FleetFinding => ({
+    id: 'build-bus-publishing',
+    title: 'build-bus webhooks arriving and self-update hooks running',
+    status,
+    summary,
+    detail,
+    remediation,
+    autoFixable: false,
+  });
+
+  if (hookModules.length === 0) {
+    return finding(
+      'ok',
+      'no installed module declares on_upstream_publish — build-bus self-update not in use here',
+      [],
+      null,
+    );
+  }
+
+  const newestPublish = bus.recentEvents({ type: 'build-bus.publish', limit: 1 })[0];
+  if (!newestPublish) {
+    return finding(
+      'warn',
+      `${hookModules.map((m) => m.id).join(', ')} self-update can never fire: no build-bus publish has ever arrived`,
+      [
+        'The webhook receiver (`celilo subscribers serve`) either is not running here or was never sent a verified publish — and nothing in the deploy installs it.',
+      ],
+      "start the receiver: `celilo subscribers serve --secret $CELILO_BUS_SECRET` under a supervisor unit, and register this host in the publisher's build-bus-subscribers.json with the same secret (export CELILO_BUS_SECRET in that unit)",
+    );
+  }
+
+  const runs = db
+    .select()
+    .from(buildBusHookRuns)
+    .orderBy(desc(buildBusHookRuns.id))
+    .limit(10)
+    .all();
+
+  const detail: string[] = [
+    `newest publish: ${newestPublish.emittedAt ? `${Math.round((now - newestPublish.emittedAt) / 60000)}min ago` : 'unknown age'}`,
+  ];
+
+  const newest = runs[0];
+  if (!newest) {
+    return finding(
+      'warn',
+      'publish events arrive but no self-update hook has ever run',
+      [
+        ...detail,
+        'The receiver emitted to the bus, yet the in-process hook dispatcher dispatched nothing — it was started with --no-dispatch, no module matched, or the running CLI predates the run ledger.',
+      ],
+      "check how the receiver daemon is started (drop --no-dispatch) and compare the publish events against the installed modules' on_upstream_publish match rules",
+    );
+  }
+
+  const runAgeMin = newest.ranAt ? Math.round((now - newest.ranAt.getTime()) / 60000) : null;
+  const runLine = `newest hook run: ${newest.packageName}@${newest.packageVersion} on ${newest.moduleId}${runAgeMin != null ? `, ${runAgeMin}min ago` : ''}`;
+
+  if (newest.timedOut) {
+    return finding(
+      'warn',
+      `self-update hook timed out after ${newest.durationMs}ms`,
+      [
+        ...detail,
+        runLine,
+        `  stderr tail: ${(newest.stderrTail ?? '(none)').trim().slice(0, 500)}`,
+      ],
+      'inspect the ledger: `select * from build_bus_hook_runs order by id desc limit 10` in the celilo DB',
+    );
+  }
+  if (newest.exitCode !== 0) {
+    return finding(
+      'warn',
+      `self-update hook exited ${newest.exitCode ?? 'without an exit code (spawn failure)'}`,
+      [
+        ...detail,
+        runLine,
+        `  stderr tail: ${(newest.stderrTail ?? '(none)').trim().slice(0, 500)}`,
+      ],
+      'fix the failing hook script, then re-publish or re-emit the build-bus.publish event',
+    );
+  }
+
+  // A success that predates the newest publish means the newest publish was
+  // dropped on the dispatch side even though earlier ones ran. The ledger's
+  // ran_at has second resolution (unixepoch), so the event's millisecond
+  // stamp is truncated to the same granularity before comparing — otherwise
+  // a run in the same second as its event reads as older than it.
+  const newestPublishSec = Math.floor((newestPublish.emittedAt ?? 0) / 1000) * 1000;
+  if (newest.ranAt && newest.ranAt.getTime() < newestPublishSec) {
+    return finding(
+      'warn',
+      'newest publish event predates the newest hook run — that publish dispatched nothing',
+      [...detail, runLine],
+      'check the receiver daemon logs for that event and the match rules against what the publisher sent',
+    );
+  }
+
+  return finding(
+    'ok',
+    `last self-update hook succeeded (${newest.packageName}@${newest.packageVersion})`,
+    [...detail, runLine],
+    null,
+  );
+}
+
+/**
+ * Does module `id`'s installed manifest declare an `on_upstream_publish`
+ * hook? Reads the manifest from disk exactly as the hook dispatcher's own
+ * loader does, so the check and the dispatcher cannot disagree about what
+ * "in use" means. A manifest that has vanished or fails to parse reads as
+ * "no hooks" — the dispatcher skips it silently too (Rule 6.2: the skip is
+ * visible here as fact 1 rather than as a crash).
+ */
+function hasUpstreamPublishHooks(db: DbClient, moduleId: string): boolean {
+  const row = db
+    .select({ sourcePath: modules.sourcePath })
+    .from(modules)
+    .where(eq(modules.id, moduleId))
+    .get();
+  if (!row?.sourcePath) return false;
+  try {
+    const parsed = parseYaml(readFileSync(join(row.sourcePath, 'manifest.yml'), 'utf-8')) as {
+      hooks?: { on_upstream_publish?: unknown[] };
+    };
+    return (parsed.hooks?.on_upstream_publish ?? []).length > 0;
+  } catch {
+    return false;
+  }
+}
+
 /** A deployed module + its parsed manifest (INSTALLED/VERIFIED only). */
 interface DeployedModule {
   id: string;
@@ -668,7 +837,10 @@ export function checkCapabilityProviders(db: DbClient): FleetFinding {
   }
   if (traceNeeded.length > 0) {
     detail.push(
-      `${traceNeeded.length} derived value(s) resolve through another capability — verify with \`celilo capability chain <module> <var>\` (ISS-0114): ${traceNeeded.join('; ')}`,
+      // celilo#1308: `celilo capability chain` no longer exists (the ISS-0115
+      // rework removed it), so prescribing it sent the operator to an
+      // "unknown command" error. No CLI command traces a chain; say so.
+      `${traceNeeded.length} derived value(s) resolve through another capability. No CLI command traces a capability chain, so verify these by hand (ISS-0114): ${traceNeeded.join('; ')}`,
     );
   }
 
@@ -1194,6 +1366,7 @@ export async function runFleetChecks(
   return [
     checkSchemaDrift(db),
     checkDispatcher(bus, { now: opts.now, installedCodeMtimeMs: opts.installedCodeMtimeMs }),
+    checkBuildBusPublishing(bus, db, { now: opts.now }),
     checkSubscribers(bus, db),
     checkCapabilityProviders(db),
     checkControlPlaneNetwork(db),

package/src/services/fleet-key.test.ts

@@ -9,6 +9,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { ensureFleetKey, findFleetPrivateKey, getFleetSshDir } from './fleet-key';
 
 describe('ensureFleetKey', () => {
@@ -20,7 +21,7 @@ describe('ensureFleetKey', () => {
   });
 
   afterEach(() => {
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dataDir, { recursive: true, force: true });
   });
 
@@ -61,7 +62,7 @@ describe('findFleetPrivateKey', () => {
   });
 
   afterEach(() => {
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.HOME = realHome;
     rmSync(dataDir, { recursive: true, force: true });
     rmSync(homeDir, { recursive: true, force: true });