@celilo/cli 2.2.0 → 2.3.0

package/src/services/network-discovery.test.ts

@@ -15,8 +15,9 @@
 import { beforeEach, describe, expect, test } from 'bun:test';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
-import { systemConfig } from '../db/schema';
+import { modules, systemConfig } from '../db/schema';
 import { setupTestDatabase } from '../test-utils/database';
+import { CONTROL_PLANE_MODULE_ID, upsertDeployedSystem } from './deployed-systems';
 import {
   discoverAndRecordNetwork,
   discoveredNetworkKeys,
@@ -102,6 +103,33 @@ describe('discoveredNetworkKeys (issue #300 redeploy idempotency)', () => {
     });
   });
 
+  test('first install with control plane in secure-mgmt records there (celilo#1356)', () => {
+    // The default topology (ce-8mxz) puts celilo-mgr on secure-mgmt, so a fresh
+    // segmented bootstrap must not file the control-plane subnet under
+    // `network.internal.*` — celilo would otherwise be blind to its own
+    // internal zone.
+    expect(discoveredNetworkKeys(internal, false, { controlPlaneZone: 'secure-mgmt' })).toEqual({
+      'network.secure-mgmt.subnet': '192.168.1.0/24',
+      'network.secure-mgmt.gateway': '192.168.1.1',
+    });
+  });
+
+  test('first install with control plane in internal is unchanged', () => {
+    expect(discoveredNetworkKeys(internal, false, { controlPlaneZone: 'internal' })).toEqual({
+      'network.internal.subnet': '192.168.1.0/24',
+      'network.internal.gateway': '192.168.1.1',
+    });
+  });
+
+  test('first install never clobbers an already-set control-plane zone value', () => {
+    expect(
+      discoveredNetworkKeys(internal, false, {
+        controlPlaneZone: 'secure-mgmt',
+        secureMgmtAlreadySet: true,
+      }),
+    ).toEqual({});
+  });
+
   test('preserves an already-set subnet on redeploy (no override)', () => {
     // The regression: a redeploy on a box off the internal network discovers the
     // WRONG subnet — it must not clobber the operator's value.
@@ -165,6 +193,41 @@ describe('discoverAndRecordNetwork', () => {
     expect(read('network.internal.gateway')).toBe('10.31.7.1');
   });
 
+  test('first install for a control plane deployed in secure-mgmt records secure-mgmt (celilo#1356)', () => {
+    // Seed the module_systems row the deploy pipeline writes before
+    // bootstrapControlPlane runs, placing celilo-mgmt in secure-mgmt.
+    db.insert(modules)
+      .values({
+        id: CONTROL_PLANE_MODULE_ID,
+        name: 'Celilo Management Server',
+        version: '0.9.0',
+        manifestData: {},
+        sourcePath: '/tmp/modules/celilo-mgmt',
+      })
+      .run();
+    upsertDeployedSystem(db, CONTROL_PLANE_MODULE_ID, {
+      name: 'main',
+      hostname: 'celilo-mgr',
+      ipv4Address: '10.226.120.10',
+      zone: 'secure-mgmt',
+      infraType: 'machine',
+      machineId: null,
+      serviceId: null,
+      vmid: null,
+    });
+
+    const result = discoverAndRecordNetwork(db, () =>
+      ipRouteFor('10.226.120.0', '10.226.120.1', '10.226.120.10'),
+    );
+
+    expect(result.applied).toEqual([
+      'network.secure-mgmt.subnet = 10.226.120.0/24',
+      'network.secure-mgmt.gateway = 10.226.120.1',
+    ]);
+    expect(read('network.internal.subnet')).toBeUndefined();
+    expect(read('network.secure-mgmt.subnet')).toBe('10.226.120.0/24');
+  });
+
   test('a redeploy on the same box changes nothing and says so', () => {
     const routes = () => ipRouteFor('10.31.7.0', '10.31.7.1', '10.31.7.20');
     discoverAndRecordNetwork(db, routes);

package/src/services/network-discovery.ts

@@ -24,7 +24,8 @@
 import { execFileSync } from 'node:child_process';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
-import { systemConfig } from '../db/schema';
+import { type NetworkZone, systemConfig } from '../db/schema';
+import { CONTROL_PLANE_MODULE_ID, asZone, getModuleSystems } from './deployed-systems';
 
 export interface DiscoveredNetwork {
   subnet: string;
@@ -61,7 +62,14 @@ export function parseInternalNetwork(ipRouteOutput: string): DiscoveredNetwork |
  *    LAN, so what it discovered IS `internal`. First install records it there.
  *  - Segmented deployment: the box sits on a dedicated control-plane network.
  *    `internal` is then someone else's subnet — the semi-trusted LAN — and the
- *    discovered value belongs under `secure-mgmt`.
+ *    discovered value belongs under the control plane's own zone (`secure-mgmt`
+ *    in the default topology, celilo#1356).
+ *
+ * On FIRST INSTALL the zone is decided the same way the rest of celilo decides
+ * it: from where the control plane actually landed. `discoverAndRecordNetwork`
+ * reads `celilo-mgmt`'s deployed-system row and passes that zone in as
+ * `opts.controlPlaneZone`; with no row recorded yet the fallback stays
+ * `internal`, the pre-#1356 behaviour.
  *
  * Issue #300 spotted the second case as "discovery returns the WRONG subnet" and
  * mitigated it by DISCARDING the value whenever `internal` was already set. That
@@ -76,14 +84,21 @@ export function parseInternalNetwork(ipRouteOutput: string): DiscoveredNetwork |
 export function discoveredNetworkKeys(
   host: DiscoveredNetwork | null,
   internalAlreadySet: boolean,
-  opts: { internalSubnet?: string; secureMgmtAlreadySet?: boolean } = {},
+  opts: {
+    internalSubnet?: string;
+    secureMgmtAlreadySet?: boolean;
+    /** Zone the control plane itself occupies; first install records there, not `internal`. */
+    controlPlaneZone?: NetworkZone;
+  } = {},
 ): Record<string, string> {
   if (!host) return {};
 
   if (!internalAlreadySet) {
+    const targetZone = opts.controlPlaneZone ?? 'internal';
+    if (targetZone !== 'internal' && opts.secureMgmtAlreadySet) return {};
     return {
-      'network.internal.subnet': host.subnet,
-      'network.internal.gateway': host.gateway,
+      [`network.${targetZone}.subnet`]: host.subnet,
+      [`network.${targetZone}.gateway`]: host.gateway,
     };
   }
 
@@ -118,6 +133,15 @@ function readValue(db: DbClient, key: string): string | undefined {
   return db.select().from(systemConfig).where(eq(systemConfig.key, key)).get()?.value ?? undefined;
 }
 
+/**
+ * The zone the control plane actually landed in, from its deployed-system row
+ * (same source `loadControlPlaneSubnet` reads). Undefined when celilo-mgmt has
+ * no system recorded yet, so the caller falls back to `internal`.
+ */
+function controlPlaneZone(db: DbClient): NetworkZone | undefined {
+  return asZone(getModuleSystems(CONTROL_PLANE_MODULE_ID, db)[0]?.zone) ?? undefined;
+}
+
 /**
  * Discover the network this box sits on and record it. Idempotent, and never
  * overwrites a value that is already set.
@@ -143,6 +167,7 @@ export function discoverAndRecordNetwork(
   const keys = discoveredNetworkKeys(host, internalSubnet !== undefined, {
     internalSubnet,
     secureMgmtAlreadySet: readValue(db, 'network.secure-mgmt.subnet') !== undefined,
+    controlPlaneZone: controlPlaneZone(db),
   });
 
   const applied: string[] = [];

package/src/services/port-forwards.test.ts

@@ -7,6 +7,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { portForwards } from '../db/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { deleteClaimedRows } from './capability-table-rows';
 import { buildPortForwardStore } from './port-forwards';
 
@@ -27,7 +28,7 @@ describe('port-forward store', () => {
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/programmatic-responder.aspect.test.ts

@@ -17,6 +17,7 @@ import { join } from 'node:path';
 import { defineEvents, openBus } from '@celilo/event-bus';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { type AspectRequiredPayload, EVENT_TYPES } from './bus-interview';
 import { startProgrammaticResponder } from './programmatic-responder';
 
@@ -72,7 +73,7 @@ describe('programmatic responder — aspect.required consent (#262)', () => {
   afterEach(() => {
     closeDb();
     rmSync(dir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   it('approves (consented=true) when the policy approves the module', async () => {

package/src/services/proxmox-reconcile.test.ts

@@ -27,6 +27,7 @@ import {
   modules,
 } from '../db/schema';
 import type { BaseModuleAspect } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { upsertModuleConfig } from './module-config';
 import { executeProxmoxReconcile, planProxmoxReconcile } from './proxmox-reconcile';
 
@@ -153,7 +154,7 @@ describe('proxmox-reconcile', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/responder-probe.test.ts

@@ -32,7 +32,7 @@ describe('ensureResponderForInterview (ISS-0025)', () => {
     origTTY = process.stdin.isTTY;
   });
   afterEach(() => {
-    if (origEnv === undefined) process.env.EVENT_BUS_DB = undefined;
+    if (origEnv === undefined) delete process.env.EVENT_BUS_DB;
     else process.env.EVENT_BUS_DB = origEnv;
     setTTY(origTTY);
     try {

package/src/services/restore-from-file.test.ts

@@ -23,6 +23,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { applyStagedSystemFiles, restoreFromArtifactFile } from './restore-from-file';
 
 describe('applyStagedSystemFiles', () => {
@@ -44,9 +45,9 @@ describe('applyStagedSystemFiles', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
-    process.env.CELILO_DATA_DIR = undefined;
+    resetTestDbPath();
+    delete process.env.CELILO_MASTER_KEY_PATH;
+    delete process.env.CELILO_DATA_DIR;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -205,9 +206,9 @@ describe('restoreFromArtifactFile error paths', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.CELILO_DATA_DIR = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    resetTestDbPath();
+    delete process.env.CELILO_DATA_DIR;
+    delete process.env.CELILO_MASTER_KEY_PATH;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/restore-preflight.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   NonEmptyRestoreTargetError,
   assertRestoreTargetEmpty,
@@ -23,8 +24,8 @@ describe('restore pre-flight', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.CELILO_DATA_DIR = undefined;
+    resetTestDbPath();
+    delete process.env.CELILO_DATA_DIR;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/secret-schema-loader.test.ts

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { type DbClient, getDb } from '../db/client';
 import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   type SecretsSchema,
   getAllSecretMetadata,
@@ -40,7 +41,7 @@ describe('secret-schema-loader', () => {
   afterEach(() => {
     // Clean up temp directory
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   describe('loadSecretsSchema', () => {

package/src/services/ssh-key-manager.test.ts

@@ -8,6 +8,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { addMachine } from './machine-pool';
 import {
   LOCAL_MACHINE_IP,
@@ -97,9 +98,9 @@ describe('ssh-key-manager', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.CELILO_DATA_DIR = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    resetTestDbPath();
+    delete process.env.CELILO_DATA_DIR;
+    delete process.env.CELILO_MASTER_KEY_PATH;
   });
 
   describe('writeTemporarySshKey', () => {

package/src/services/static-content-converge.test.ts

@@ -14,6 +14,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { moduleConfigs, modules, webRoutes } from '../db/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   ansibleTreeMentions,
   buildStaticContentPlan,
@@ -64,7 +65,7 @@ describe('planStaticContent — the declared release set (D10 task 4.1)', () =>
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -177,7 +178,7 @@ describe('resolveStaticContentRetention — operator config with a default', ()
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -279,7 +280,7 @@ describe('the state web overlay (celilo#1265)', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -359,7 +360,7 @@ describe('writeStaticContentVars — lands in the generated inventory', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/static-content-converge.ts

@@ -23,7 +23,7 @@
  * `module verify` (celilo#1018, deliberately left to that thread).
  */
 
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, rmSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { and, eq, isNotNull } from 'drizzle-orm';
@@ -237,9 +237,10 @@ export function staticContentVarsYaml(plan: StaticContentPlan): string {
  *
  * The shared half of both converge triggers: the capability's callback adds
  * `executeAnsible` after this, and the provider's own deploy already runs it.
- * Writing happens AFTER the deploy's staleness check (`refuseIfGeneratedIsStale`
- * only inspects verbatim role assets), so an injected vars file never reads as
- * a stale generation.
+ * Nothing inspects verbatim role assets any more — the staleness pre-flight
+ * retired with the ephemeral generated tree (D5 of
+ * control-plane-stops-building-modules), so an injected vars file cannot read
+ * as a stale generation because nothing reads staleness.
  */
 export async function writeStaticContentVars(
   db: DbClient,
@@ -308,13 +309,31 @@ export async function convergeStaticContent(
     return { success: false, error: `Provider module '${providerModuleId}' is not installed` };
   }
   const generatedPath = join(module.sourcePath, 'generated');
+  // D4 (control-plane-stops-building-modules): the generated project is
+  // ephemeral, so a successful provider deploy deletes it and nothing is
+  // persisted for this converge to read. Render it here, on demand, from the
+  // signed payload plus resolved config — generation is fast and local. A
+  // render failure fails loudly with the deploy-once remedy, same as the old
+  // missing-project refusal did; a tree that predates the converge support is
+  // still refused by the static_releases check below.
   if (!existsSync(generatedPath)) {
-    return {
-      success: false,
-      error:
-        `public_web provider '${providerModuleId}' has no generated deploy project at ${generatedPath}. ` +
-        `Run \`celilo module deploy ${providerModuleId}\` once, then retry the publish.`,
-    };
+    const { generateTemplates } = await import('../templates/generator');
+    const rendered = await generateTemplates({
+      moduleId: providerModuleId,
+      modulePath: module.sourcePath,
+      outputPath: generatedPath,
+      db,
+      skipVariableValidation: false,
+    });
+    if (!rendered.success) {
+      return {
+        success: false,
+        error:
+          `public_web provider '${providerModuleId}' has no generated deploy project at ${generatedPath} ` +
+          `and rendering one failed: ${rendered.error ?? 'unknown error'}. ` +
+          `Run \`celilo module deploy ${providerModuleId}\` once, then retry the publish.`,
+      };
+    }
   }
 
   const written = await writeStaticContentVars(db, providerModuleId, generatedPath);
@@ -342,5 +361,9 @@ export async function convergeStaticContent(
       varsPath: written.varsPath,
     };
   }
+  // D4: the converge rendered the tree, used it, and is done with it. The same
+  // no-secrets-at-rest rule the deploy follows applies here; on the failure
+  // paths above the tree stays for inspection.
+  rmSync(generatedPath, { recursive: true, force: true });
   return { success: true, varsPath: written.varsPath };
 }

package/src/services/system-state-stage.test.ts

@@ -13,6 +13,7 @@ import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { snapshotDatabase, stageSystemState } from './system-state-stage';
 
 describe('stageSystemState', () => {
@@ -37,9 +38,9 @@ describe('stageSystemState', () => {
   });
 
   afterEach(() => {
-    process.env.CELILO_DATA_DIR = undefined;
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_DATA_DIR;
+    resetTestDbPath();
+    delete process.env.CELILO_MASTER_KEY_PATH;
     rmSync(dataDir, { recursive: true, force: true });
   });
 

package/src/services/trusted-sources.test.ts

@@ -6,6 +6,7 @@ import type { DbClient } from '../db/client';
 import { systemConfig } from '../db/schema';
 import { loadTrustedSubnets } from '../hooks/capability-loader';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   buildTrustedSourceStore,
   composeTrustedSubnets,
@@ -30,7 +31,7 @@ describe('trusted-source store', () => {
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -147,7 +148,7 @@ describe('the render input excludes registrations; the reporting view includes t
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/update/orchestrator.test.ts

@@ -78,6 +78,7 @@ const cleanAudit: AuditDeps = {
   moduleConfigs: { modules: [] },
   moduleIntegrity: { results: [] },
   detectWithoutConverge: { modules: [] },
+  jailExemptions: { exemptions: [] },
   health: { results: [] },
   backups: { modules: [] },
   abandonedOperations: { records: [] },
@@ -87,6 +88,7 @@ const cleanAudit: AuditDeps = {
   secretsDecryptable: { results: [] },
   servicesReachable: { results: [] },
   machinesReachable: { results: [] },
+  diskSpace: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
   trustedSources: { firewalls: [] },
   publicDns: { records: [], probe: unusedPublicDnsProbe },

package/src/services/zone-detector.test.ts

@@ -9,6 +9,7 @@ import { join } from 'node:path';
 import { closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { systemConfig } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { detectZoneFromIp, isValidIp } from './zone-detector';
 
 describe('zone-detector', () => {
@@ -46,7 +47,7 @@ describe('zone-detector', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   describe('detectZoneFromIp', () => {

package/src/test-utils/bus-responder.ts

@@ -50,6 +50,7 @@ import {
   type ResponderValues,
   startProgrammaticResponder,
 } from '../services/programmatic-responder';
+import { resetTestDbPath } from './db-path';
 
 export interface BusResponderFixtureOptions extends ResponderValues {
   /** Path to the bus sqlite db (shared with the celilo subprocess). */
@@ -98,7 +99,6 @@ export function startBusResponderFixture(opts: BusResponderFixtureOptions): BusR
   const prevDataDir = process.env.CELILO_DATA_DIR;
   process.env.CELILO_DATA_DIR = opts.dataDir;
 
-  const prevDbPath = process.env.CELILO_DB_PATH;
   process.env.CELILO_DB_PATH = opts.celiloDbPath;
   const db: DbClient = createDbClient();
 
@@ -130,10 +130,12 @@ export function startBusResponderFixture(opts: BusResponderFixtureOptions): BusR
     close: () => {
       handle.close();
       db.$client.close();
-      if (prevDataDir === undefined) process.env.CELILO_DATA_DIR = undefined;
+      if (prevDataDir === undefined) delete process.env.CELILO_DATA_DIR;
       else process.env.CELILO_DATA_DIR = prevDataDir;
-      if (prevDbPath === undefined) process.env.CELILO_DB_PATH = undefined;
-      else process.env.CELILO_DB_PATH = prevDbPath;
+      // Reset to the scratch path, never restore the previous value: it may
+      // be another suite's temp database, or unset — which sends the next
+      // var-less reader to the operator's real celilo.db (celilo#1315).
+      resetTestDbPath();
     },
   };
 }

package/src/test-utils/db-path.ts

@@ -0,0 +1,25 @@
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+/**
+ * The neutral database path the test preload arms `CELILO_DB_PATH` with
+ * (celilo#1315). The file does not exist, so a reader falls into whatever
+ * "no database" branch its feature has — and no test ever opens the
+ * operator's real `~/Library/.../celilo.db`, which is what a suite that
+ * reads the variable without setting it would otherwise reach.
+ *
+ * Why teardowns RESET to this path instead of `delete`: bunfig's `[test]`
+ * preload runs ONCE PER PROCESS, not once per test file. A teardown that
+ * clears the variable leaves every later var-less reader on the real
+ * database for the rest of the run. Resetting to the scratch path keeps the
+ * preload's invariant standing from the first test to the last.
+ */
+export const SCRATCH_DB_PATH = join(tmpdir(), 'celilo-test-absent.db');
+
+/**
+ * Point `CELILO_DB_PATH` at the neutral scratch path. Call from a test's
+ * afterEach (or any teardown) that pointed the variable somewhere else.
+ */
+export function resetTestDbPath(): void {
+  process.env.CELILO_DB_PATH = SCRATCH_DB_PATH;
+}

package/src/test-utils/integration.ts

@@ -54,6 +54,13 @@ export interface IntegrationTestContext {
  * ```
  */
 export async function setupIntegrationTest(): Promise<IntegrationTestContext> {
+  // celilo#1246: the shell on a dev host carries CELILO_HOME pointing at the
+  // live install (DB and master.key included). Every CLI child this harness
+  // spawns would inherit it, and isolation would then rest on the per-run
+  // CELILO_DB_PATH / CELILO_DATA_DIR overrides below never being missed.
+  // Unset it once, here, so no child ever sees the live home.
+  delete process.env.CELILO_HOME;
+
   // Setup isolated database
   const testDb = await setupTestDatabaseFile();
   const dbPath = testDb.path;

package/src/test-utils/module-fixtures.ts

@@ -8,6 +8,7 @@
  */
 
 import { CLIContext } from './cli-context';
+import { resetTestDbPath } from './db-path';
 import { getModuleTestConfig } from './fixtures';
 import { type IntegrationTestContext, setupIntegrationTest } from './integration';
 
@@ -50,7 +51,6 @@ interface HomebridgeModuleOptions extends BaseFixtureOptions {
 async function insertMockContainerService(dbPath: string): Promise<void> {
   const { getDb } = await import('../db/client');
   const { containerServices } = await import('../db/schema');
-  const originalDbPath = process.env.CELILO_DB_PATH;
   process.env.CELILO_DB_PATH = dbPath;
   try {
     const db = getDb();
@@ -77,11 +77,10 @@ async function insertMockContainerService(dbPath: string): Promise<void> {
       updatedAt: new Date(),
     });
   } finally {
-    if (originalDbPath) {
-      process.env.CELILO_DB_PATH = originalDbPath;
-    } else {
-      process.env.CELILO_DB_PATH = undefined;
-    }
+    // Reset to the scratch path, never restore the previous value: it may
+    // be another suite's temp database, or unset — which sends the next
+    // var-less reader to the operator's real celilo.db (celilo#1315).
+    resetTestDbPath();
   }
 }