@celilo/cli 2.2.0 → 2.3.0

package/src/cli/commands/module-generate.ts

@@ -3,7 +3,7 @@
  */
 
 import { existsSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import { eq } from 'drizzle-orm';
 import {
   promptForMissingCapabilitySecrets,
@@ -13,12 +13,25 @@ import { getDb } from '../../db/client';
 import { moduleConfigs, modules } from '../../db/schema';
 import type { ModuleManifest } from '../../manifest/schema';
 import { interviewForMissingSecrets, validateModuleSecrets } from '../../services/config-interview';
-import { getModuleBuildStatus, verifyArtifactsExist } from '../../services/module-build';
 import { generateTemplates } from '../../templates/generator';
 import { promptForMissingConfig } from '../interactive-config';
 import { getArg, getFlag, validateRequiredArgs } from '../parser';
 import type { CommandResult } from '../types';
 
+/**
+ * Declared `build.artifacts` absent from the module's delivered payload.
+ *
+ * D1 (control-plane-stops-building-modules): generation consumes the payload.
+ * A declared output the payload does not carry is a publish defect, so it is
+ * reported to the caller and named, never repaired by running a build here.
+ * A fallback build is the shape that hid celilo#1307 for four months: the
+ * failure must fail loudly at the boundary, not be repaired downstream.
+ */
+export function missingBuildOutputs(modulePath: string, manifest: ModuleManifest): string[] {
+  const artifacts = manifest.build?.artifacts ?? [];
+  return artifacts.filter((artifact) => !existsSync(join(modulePath, artifact)));
+}
+
 /**
  * Handle module generate command
  *
@@ -71,31 +84,23 @@ export async function handleModuleGenerate(
     };
   }
 
-  // Check if module requires build step
+  // D1 (control-plane-stops-building-modules): generation consumes the
+  // delivered payload. Whether this machine ever ran a build is a fact about
+  // its own history, not about the module in front of it — gating on it is
+  // what made celilo#1307 refuse generation on a production control plane
+  // whose payload carried the correct binaries one directory away.
   const manifest = module.manifestData as ModuleManifest;
-  if (manifest.build) {
-    const buildStatus = await getModuleBuildStatus(moduleId, db);
-
-    if (!buildStatus || buildStatus.status !== 'success') {
-      return {
-        success: false,
-        error:
-          `Module ${moduleId} requires build step before generation.\n\n` +
-          `Run: celilo module build ${moduleId}`,
-      };
-    }
-
-    // Verify artifacts still exist
-    if (buildStatus.artifacts.length > 0) {
-      const artifactsValid = verifyArtifactsExist(buildStatus.artifacts);
-
-      if (!artifactsValid) {
-        return {
-          success: false,
-          error: `Build artifacts missing or invalid.\n\nRebuild: celilo module build ${moduleId}`,
-        };
-      }
-    }
+  const missingOutputs = missingBuildOutputs(modulePath, manifest);
+  if (missingOutputs.length > 0) {
+    return {
+      success: false,
+      error: [
+        `Module payload is missing ${missingOutputs.length} declared build output(s):`,
+        ...missingOutputs.map((artifact) => `  ${artifact}`),
+        '',
+        "The payload must carry the module's build outputs; a control plane never builds. This is a publish defect: re-package the module and update it. Generation will not fall back to running a build.",
+      ].join('\n'),
+    };
   }
 
   const outputPathFlag = getFlag(flags, 'output', '');

package/src/cli/commands/module-health.ts

@@ -23,6 +23,7 @@ const CHECK_ICONS: Record<string, string> = {
   pass: '✓',
   warn: '⚠',
   fail: '✗',
+  skip: '○',
 };
 
 function formatResult(result: HealthCheckResult): string {

package/src/cli/commands/module-import-aspect.test.ts

@@ -12,6 +12,7 @@ import { closeDb, getDb } from '../../db/client';
 import { runMigrations } from '../../db/migrate';
 import { modules } from '../../db/schema';
 import type { BaseModuleAspect } from '../../manifest/schema';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { handleAspectApprovalAfterImport } from './module-import';
 
 const aspect: BaseModuleAspect = {
@@ -61,7 +62,7 @@ describe('handleAspectApprovalAfterImport (non-interactive)', () => {
   afterEach(() => {
     setTTY(originalIsTTY);
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/cli/commands/module-import-registry.test.ts

@@ -17,6 +17,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { IndexEntry } from '../../registry/client';
 import { RegistryClient } from '../../registry/client';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { handlePublicRegistryImport } from './module-import';
 
 // handlePublicRegistryImport is not exported by default — re-exported at end of module-import.ts
@@ -42,8 +43,8 @@ afterEach(() => {
   getIndexSpy.mockRestore();
   downloadSpy.mockRestore();
   rmSync(tempDir, { recursive: true, force: true });
-  process.env.CELILO_DB_PATH = undefined;
-  process.env.CELILO_DATA_DIR = undefined;
+  resetTestDbPath();
+  delete process.env.CELILO_DATA_DIR;
 });
 
 describe('handlePublicRegistryImport — registry lookup', () => {

package/src/cli/commands/module-jail.test.ts

@@ -0,0 +1,242 @@
+/**
+ * Tests for `celilo module jail` (per-module-jail-policy task 2.1/2.2).
+ *
+ * The verb records, clears and shows one module's hook jail policy, and asks
+ * over the bus interview when the write weakens the posture below the
+ * system's. Strengthening writes directly; `--force` skips the ask.
+ *
+ * Isolation mirrors system-config.test.ts: CELILO_DB_PATH / CELILO_DATA_DIR /
+ * EVENT_BUS_DB are set before the SUT is imported. bun test runs non-TTY, so
+ * a weakening write with no responder listening fails fast with "No responder
+ * is listening" — a successful direct weakening write in these tests is proof
+ * the command never asked.
+ */
+
+import { afterAll, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+
+const testRoot = mkdtempSync(join(tmpdir(), 'celilo-module-jail-'));
+const busDbPath = join(testRoot, 'bus.db');
+process.env.CELILO_DB_PATH = join(testRoot, 'celilo.db');
+process.env.CELILO_DATA_DIR = join(testRoot, 'data');
+process.env.EVENT_BUS_DB = busDbPath;
+
+import type { CommandError, CommandResult, CommandSuccess } from '../types';
+
+const { getDb, closeDb } = await import('../../db/client');
+const { moduleJailPolicies, modules, systemConfig } = await import('../../db/schema');
+const { handleModuleJail } = await import('./module-jail');
+const { startProgrammaticResponder } = await import('../../services/programmatic-responder');
+
+const MODULE_ID = 'jailmod';
+
+/** Narrow the result union after asserting the branch, so `.message` typechecks. */
+function expectOk(result: CommandResult): asserts result is CommandSuccess {
+  expect(result.success).toBe(true);
+}
+
+function expectErr(result: CommandResult): asserts result is CommandError {
+  expect(result.success).toBe(false);
+}
+
+function insertModule(id: string): void {
+  getDb()
+    .insert(modules)
+    .values({ id, name: id, sourcePath: `/tmp/${id}`, version: '1.0.0', manifestData: {} })
+    .run();
+}
+
+function storedPolicy(moduleId: string): string | undefined {
+  return getDb()
+    .select()
+    .from(moduleJailPolicies)
+    .where(eq(moduleJailPolicies.moduleId, moduleId))
+    .get()?.policy;
+}
+
+function setSystemPolicy(value: string | undefined): void {
+  const db = getDb();
+  if (value === undefined) {
+    db.delete(systemConfig).where(eq(systemConfig.key, 'hooks.jail_policy')).run();
+  } else {
+    db.insert(systemConfig)
+      .values({ key: 'hooks.jail_policy', value })
+      .onConflictDoUpdate({ target: systemConfig.key, set: { value } })
+      .run();
+  }
+}
+
+afterAll(() => {
+  closeDb();
+  rmSync(testRoot, { recursive: true, force: true });
+});
+
+describe('module jail — the write form', () => {
+  beforeEach(() => {
+    getDb().delete(moduleJailPolicies).run();
+    getDb().delete(systemConfig).where(eq(systemConfig.key, 'hooks.jail_policy')).run();
+    if (
+      !getDb()
+        .select()
+        .from(modules)
+        .all()
+        .some((m) => m.id === MODULE_ID)
+    ) {
+      insertModule(MODULE_ID);
+    }
+  });
+
+  test('records a policy and the read form resolves through it', async () => {
+    const set = await handleModuleJail([MODULE_ID, 'auto']);
+    expect(set.success).toBe(true);
+    expect(storedPolicy(MODULE_ID)).toBe('auto');
+
+    const show = await handleModuleJail([MODULE_ID]);
+    expectOk(show);
+    expect(show.message).toContain('effective:   auto — source: module');
+  });
+
+  test('rejects a value outside the accepted set', async () => {
+    const result = await handleModuleJail([MODULE_ID, 'sometimes']);
+    expectErr(result);
+    expect(result.error).toContain("Invalid jail policy 'sometimes'");
+    expect(storedPolicy(MODULE_ID)).toBeUndefined();
+  });
+
+  test('rejects an unknown module', async () => {
+    const result = await handleModuleJail(['no-such-module', 'off']);
+    expect(result.success).toBe(false);
+  });
+
+  test('refuses to pass both a policy and --clear', async () => {
+    const result = await handleModuleJail([MODULE_ID, 'off'], { clear: true });
+    expectErr(result);
+    expect(result.error).toContain('not both');
+  });
+
+  test('module row beats the system value in the read form', async () => {
+    setSystemPolicy('required');
+    await handleModuleJail([MODULE_ID, 'off'], { force: true });
+
+    const show = await handleModuleJail([MODULE_ID]);
+    expectOk(show);
+    expect(show.message).toContain('effective:   off — source: module');
+    expect(show.message).toContain('hooks.jail_policy = required');
+  });
+
+  test('--clear removes the row and the module follows the system again', async () => {
+    setSystemPolicy('auto');
+    await handleModuleJail([MODULE_ID, 'off'], { force: true });
+    expect(storedPolicy(MODULE_ID)).toBe('off');
+
+    const cleared = await handleModuleJail([MODULE_ID], { clear: true });
+    expectOk(cleared);
+    expect(storedPolicy(MODULE_ID)).toBeUndefined();
+    expect(cleared.message).toContain('follows the system: auto');
+
+    const show = await handleModuleJail([MODULE_ID]);
+    expectOk(show);
+    expect(show.message).toContain('effective:   auto — source: config');
+  });
+
+  test('--clear with no row succeeds', async () => {
+    const result = await handleModuleJail([MODULE_ID], { clear: true });
+    expectOk(result);
+    expect(result.message).toContain('already follows the system');
+  });
+});
+
+describe('module jail — the weakening interview gate', () => {
+  beforeEach(() => {
+    getDb().delete(moduleJailPolicies).run();
+    getDb().delete(systemConfig).where(eq(systemConfig.key, 'hooks.jail_policy')).run();
+    if (
+      !getDb()
+        .select()
+        .from(modules)
+        .all()
+        .some((m) => m.id === MODULE_ID)
+    ) {
+      insertModule(MODULE_ID);
+    }
+  });
+
+  test('weakening with no responder fails fast and writes nothing', async () => {
+    setSystemPolicy('auto');
+    let threw: unknown;
+    try {
+      await handleModuleJail([MODULE_ID, 'off']);
+    } catch (error) {
+      threw = error;
+    }
+
+    expect(threw).toBeInstanceOf(Error);
+    expect(String((threw as Error).message)).toContain('No responder is listening');
+    expect(storedPolicy(MODULE_ID)).toBeUndefined();
+  });
+
+  test('weakening writes after a confirming reply, and the question was asked', async () => {
+    setSystemPolicy('auto');
+    const responder = startProgrammaticResponder({
+      busDbPath,
+      db: getDb(),
+      onMissing: 'skip',
+      values: { interview: { 'module-jail-policy.weaken': true } },
+    });
+    try {
+      const result = await handleModuleJail([MODULE_ID, 'off']);
+      expect(result.success).toBe(true);
+      expect(storedPolicy(MODULE_ID)).toBe('off');
+
+      const asked = responder.seenInterviewPayloads();
+      expect(asked.length).toBe(1);
+      expect(asked[0].scope).toBe('module-jail-policy');
+      expect(asked[0].key).toBe('weaken');
+      expect(asked[0].message).toContain('unjailed');
+    } finally {
+      responder.close();
+    }
+  });
+
+  test('a denial writes nothing', async () => {
+    setSystemPolicy('auto');
+    const responder = startProgrammaticResponder({
+      busDbPath,
+      db: getDb(),
+      onMissing: 'skip',
+      values: { interview: { 'module-jail-policy.weaken': false } },
+    });
+    try {
+      const result = await handleModuleJail([MODULE_ID, 'off']);
+      expect(result.success).toBe(false);
+      expect(storedPolicy(MODULE_ID)).toBeUndefined();
+    } finally {
+      responder.close();
+    }
+  });
+
+  test('weakening with --force writes directly and asks nothing', async () => {
+    setSystemPolicy('required');
+    const result = await handleModuleJail([MODULE_ID, 'off'], { force: true });
+    expectOk(result);
+    expect(storedPolicy(MODULE_ID)).toBe('off');
+    expect(result.message).toContain('weaker than the system');
+  });
+
+  test('strengthening writes directly with no responder listening', async () => {
+    setSystemPolicy('off');
+    const result = await handleModuleJail([MODULE_ID, 'required']);
+    expect(result.success).toBe(true);
+    expect(storedPolicy(MODULE_ID)).toBe('required');
+  });
+
+  test('setting a policy equal to the system writes directly', async () => {
+    setSystemPolicy('off');
+    const result = await handleModuleJail([MODULE_ID, 'off']);
+    expect(result.success).toBe(true);
+    expect(storedPolicy(MODULE_ID)).toBe('off');
+  });
+});

package/src/cli/commands/module-jail.ts

@@ -0,0 +1,227 @@
+/**
+ * Module jail policy command (per-module-jail-policy task 2.1/2.2).
+ *
+ * The operator's handle on one module's hook jail posture. Absent a recorded
+ * row, a module follows the system's `hooks.jail_policy`; this verb records,
+ * clears, and shows the resolution. The precedence itself lives in
+ * `resolveJailPolicy` (hooks/jail.ts) and is NOT re-derived here — the read
+ * form calls the same function the executor calls, so what the operator sees
+ * is what a hook will get.
+ *
+ * Weakening below the system's posture asks first (task 2.2), the same shape
+ * `system config set hooks.jail_policy off` uses: an event-bus interview,
+ * answered by whatever responder is attached, skipped only by the registered
+ * `--force`. Strengthening never asks.
+ */
+
+import { eq } from 'drizzle-orm';
+import { getDb } from '../../db/client';
+import { moduleJailPolicies, modules, systemConfig } from '../../db/schema';
+import { type JailPolicy, POLICY_STRENGTH, resolveJailPolicy } from '../../hooks/jail';
+import { askConfirm, withInterviewSession } from '../../services/bus-interview';
+import { getArg, hasFlag, validateRequiredArgs } from '../parser';
+import type { CommandResult } from '../types';
+
+const JAIL_SYSTEM_KEY = 'hooks.jail_policy';
+const JAIL_POLICIES: readonly JailPolicy[] = ['auto', 'off', 'required'];
+
+function isJailPolicy(value: string): value is JailPolicy {
+  return (JAIL_POLICIES as readonly string[]).includes(value);
+}
+
+/**
+ * The system-wide policy a module would follow with no row of its own.
+ *
+ * Throws on a stored value outside the accepted set, matching the read-time
+ * refusal rule — a hand-edited or restored bad row must fail loudly, not
+ * quietly count as `off` for the weakening comparison.
+ */
+function systemJailPolicy(): { value: JailPolicy | undefined; effective: JailPolicy } {
+  const stored = getDb()
+    .select()
+    .from(systemConfig)
+    .where(eq(systemConfig.key, JAIL_SYSTEM_KEY))
+    .get()?.value;
+  if (stored === undefined) return { value: undefined, effective: 'off' };
+  if (!isJailPolicy(stored)) {
+    throw new Error(
+      `Stored ${JAIL_SYSTEM_KEY}='${stored}' is not a hook jail policy. Fix it with 'celilo system config set ${JAIL_SYSTEM_KEY} <auto|off|required>' before setting a per-module policy.`,
+    );
+  }
+  return { value: stored, effective: stored };
+}
+
+/**
+ * Handle module jail command.
+ *
+ * Usage:
+ *   celilo module jail <id>                — show the effective policy and its source
+ *   celilo module jail <id> <policy>       — record auto|off|required for this module
+ *   celilo module jail <id> --clear        — remove the row; follow the system again
+ *
+ * @param args - Command arguments (module id, optional policy)
+ * @param flags - Command flags (--clear, --force)
+ * @returns Command result
+ */
+export async function handleModuleJail(
+  args: string[],
+  flags: Record<string, string | boolean> = {},
+): Promise<CommandResult> {
+  const error = validateRequiredArgs(args, 1);
+  if (error) {
+    return {
+      success: false,
+      error: `${error}\n\nUsage:\n  celilo module jail <id>              # show the effective policy\n  celilo module jail <id> <auto|off|required>\n  celilo module jail <id> --clear`,
+    };
+  }
+
+  const moduleId = getArg(args, 0);
+  const policyArg = getArg(args, 1);
+  const clear = hasFlag(flags, 'clear');
+
+  if (policyArg && clear) {
+    return {
+      success: false,
+      error: 'Pass either a policy or --clear, not both.',
+    };
+  }
+
+  const db = getDb();
+  const module = moduleId
+    ? db.select().from(modules).where(eq(modules.id, moduleId)).get()
+    : undefined;
+  if (!moduleId || !module) {
+    return { success: false, error: `Module not found: ${moduleId}` };
+  }
+
+  if (clear) return clearModuleJailPolicy(moduleId);
+  if (policyArg) return setModuleJailPolicy(moduleId, policyArg, hasFlag(flags, 'force'));
+  return showModuleJailPolicy(moduleId);
+}
+
+/** The read form: the three sources, the effective value, and which one won. */
+function showModuleJailPolicy(moduleId: string): CommandResult {
+  const db = getDb();
+  const moduleRow = db
+    .select()
+    .from(moduleJailPolicies)
+    .where(eq(moduleJailPolicies.moduleId, moduleId))
+    .get();
+  const configRow = getDb()
+    .select()
+    .from(systemConfig)
+    .where(eq(systemConfig.key, JAIL_SYSTEM_KEY))
+    .get();
+  const envValue = process.env.CELILO_HOOK_JAIL;
+
+  let effective: { policy: JailPolicy; source: string };
+  try {
+    effective = resolveJailPolicy(envValue, moduleRow?.policy, configRow?.value);
+  } catch (error) {
+    return {
+      success: false,
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+
+  const lines = [`Hook jail policy for ${moduleId}:`];
+  lines.push(
+    `  environment: ${envValue === undefined || envValue === '' ? '(CELILO_HOOK_JAIL unset)' : envValue}`,
+  );
+  lines.push(
+    `  module:      ${moduleRow ? `${moduleRow.policy} (recorded ${moduleRow.updatedAt.toISOString()})` : '(none — follows the system)'}`,
+  );
+  lines.push(
+    `  system:      ${configRow ? `${JAIL_SYSTEM_KEY} = ${configRow.value}` : `(${JAIL_SYSTEM_KEY} unset — default off)`}`,
+  );
+  lines.push(`  effective:   ${effective.policy} — source: ${effective.source}`);
+
+  return {
+    success: true,
+    message: lines.join('\n'),
+    data: {
+      moduleId,
+      modulePolicy: moduleRow?.policy,
+      systemPolicy: configRow?.value,
+      envPolicy: envValue || undefined,
+      effective: effective.policy,
+      source: effective.source,
+    },
+  };
+}
+
+/** The write form. Weakening below the system's posture asks first. */
+async function setModuleJailPolicy(
+  moduleId: string,
+  policyArg: string,
+  force: boolean,
+): Promise<CommandResult> {
+  if (!isJailPolicy(policyArg)) {
+    return {
+      success: false,
+      error: `Invalid jail policy '${policyArg}'. Use 'auto' (jail when a backend is available), 'required' (an unavailable jail is a hard failure), or 'off'.`,
+    };
+  }
+
+  const system = systemJailPolicy();
+
+  if (POLICY_STRENGTH[policyArg] < POLICY_STRENGTH[system.effective] && !force) {
+    const confirmed = await withInterviewSession(() =>
+      askConfirm({
+        scope: 'module-jail-policy',
+        key: 'weaken',
+        message: `Set ${moduleId}'s jail policy to ${policyArg}, weaker than the system's ${system.effective}? This module's hooks will run unjailed while the rest of the fleet jails.`,
+        defaultValue: false,
+      }),
+    );
+    if (!confirmed) {
+      return { success: false, error: 'Cancelled by user' };
+    }
+  }
+
+  const db = getDb();
+  db.insert(moduleJailPolicies)
+    .values({ moduleId, policy: policyArg, updatedAt: new Date() })
+    .onConflictDoUpdate({
+      target: moduleJailPolicies.moduleId,
+      set: { policy: policyArg, updatedAt: new Date() },
+    })
+    .run();
+
+  const weakerNote =
+    POLICY_STRENGTH[policyArg] < POLICY_STRENGTH[system.effective]
+      ? ` (weaker than the system's ${system.effective} — this module's hooks run unjailed)`
+      : '';
+  return {
+    success: true,
+    message: `Set jail policy for ${moduleId}: ${policyArg}${weakerNote}`,
+  };
+}
+
+/**
+ * Remove the module's row so it follows the system again. Clearing can never
+ * weaken the posture — the module resolves to exactly the system value — so
+ * there is no interview on this path.
+ */
+function clearModuleJailPolicy(moduleId: string): CommandResult {
+  const db = getDb();
+  const existing = db
+    .select()
+    .from(moduleJailPolicies)
+    .where(eq(moduleJailPolicies.moduleId, moduleId))
+    .get();
+
+  if (!existing) {
+    return {
+      success: true,
+      message: `No jail policy recorded for ${moduleId} (already follows the system)`,
+    };
+  }
+
+  db.delete(moduleJailPolicies).where(eq(moduleJailPolicies.moduleId, moduleId)).run();
+  const system = systemJailPolicy();
+  return {
+    success: true,
+    message: `Cleared jail policy for ${moduleId} (now follows the system: ${system.effective})`,
+  };
+}