@celilo/cli 2.2.0 → 2.3.0

package/src/cli/commands/system-config.ts

@@ -7,6 +7,7 @@ import { dirname, join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import { getDb } from '../../db/client';
 import { systemConfig } from '../../db/schema';
+import { askConfirm, withInterviewSession } from '../../services/bus-interview';
 import type { SystemConfigSchema } from '../../services/system-config-schema-types';
 import { validateKey, validateValue } from '../../services/system-config-validator';
 import { getArg, validateRequiredArgs } from '../parser';
@@ -47,7 +48,10 @@ function loadSchema(): SystemConfigSchema {
  * @param args - Command arguments
  * @returns Command result
  */
-export function handleSystemConfigSet(args: string[]): CommandResult {
+export async function handleSystemConfigSet(
+  args: string[],
+  flags: Record<string, boolean | string> = {},
+): Promise<CommandResult> {
   // Validate arguments
   const error = validateRequiredArgs(args, 2);
   if (error) {
@@ -82,6 +86,27 @@ export function handleSystemConfigSet(args: string[]): CommandResult {
     return { success: false, error: valueValidation.error };
   }
 
+  // D5 of hook-jail-config-surface: turning jailing off fleet-wide is a security
+  // posture change, so the write asks first. `auto` and `required` write
+  // directly — `auto` is the status quo default and `required` tightens the
+  // posture. `--force` skips the ask, matching the house flags.force convention
+  // (backup-delete, machine-remove, service-remove, ...).
+  if (key === 'hooks.jail_policy' && value === 'off' && !flags.force) {
+    const confirmed = await withInterviewSession(() =>
+      askConfirm({
+        scope: 'hooks-jail-policy',
+        key: 'set-off',
+        message:
+          'Set hooks.jail_policy to off? Hooks will run unjailed fleet-wide and the doctor will warn.',
+        defaultValue: false,
+      }),
+    );
+
+    if (!confirmed) {
+      return { success: false, error: 'Cancelled by user' };
+    }
+  }
+
   const db = getDb();
 
   // Store value in database

package/src/cli/commands/system-doctor-remediation-gate.test.ts

@@ -0,0 +1,295 @@
+/**
+ * Doctor remediation-arrow gate (celilo#1308).
+ *
+ * `celilo system doctor` renders `→ <command>` remediation lines under failing
+ * checks. Those strings are built by hand in three files and were never checked
+ * against the CLI's own command table, so doctor prescribed commands that
+ * cannot run:
+ *
+ * - `celilo module update <module-id>` — `module update` takes a PATH, so a
+ *   module id names an argument form that does not exist (the lunacycle case
+ *   in #1308).
+ * - `celilo system doctor --deep` — the doctor's own instruction, rejected by
+ *   `checkFlags` because `deep` was never declared on `system doctor`.
+ * - `celilo capability chain <module> <var>` — a command the ISS-0115 rework
+ *   removed from the registry.
+ *
+ * The gate scans the three files that produce the doctor's `→` surface
+ * (system-doctor.ts, fleet-checks.ts, module-integrity.ts) for `celilo ...`
+ * command spans and validates each against COMMANDS from @celilo/core:
+ *
+ * 1. every command word must resolve along the registry tree,
+ * 2. every flag must be declared on the leaf command,
+ * 3. positional count must fit the leaf command's declared args,
+ * 4. a value known to be a module id must never fill a path slot (an arg whose
+ *    completion is `directories` or `files`), variadic or not.
+ *
+ * Commands are parsed, never executed. A span is "strict" when a quote or
+ * backtick delimits it (the author wrote a command); a `celilo ...` occurrence
+ * without a delimiter is a hint embedded in a sentence and is only validated
+ * when everything after the command path is argument-shaped — trailing plain
+ * words mean the line talks ABOUT celilo ("celilo knows where its control
+ * plane runs"), which is prose, not a prescription.
+ *
+ * Reach floors: the scan asserts it resolved a real number of command spans
+ * and contains the anchors it exists to police, because a scan that resolves
+ * nothing exits 0 and proves nothing.
+ */
+
+import { describe, expect, it } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { type ArgDef, COMMANDS, type CommandDef } from '@celilo/core';
+
+const SOURCES = [
+  join(import.meta.dir, 'system-doctor.ts'),
+  join(import.meta.dir, '../../services/fleet-checks.ts'),
+  join(import.meta.dir, '../../services/audit/module-integrity.ts'),
+];
+
+/** Completion kinds whose value is a filesystem path, not an id. */
+const PATH_COMPLETIONS = new Set(['directories', 'files']);
+
+const INTERP = '\u0000';
+
+/** `${...}` expressions found by masking, in order. */
+const interps: string[] = [];
+
+function maskInterpolations(source: string): string {
+  interps.length = 0;
+  return source.replace(/\$\{([^{}]*)\}/g, (_m, expr: string) => {
+    interps.push(expr);
+    return `${INTERP}${interps.length - 1}${INTERP}`;
+  });
+}
+
+function interpText(masked: string): string {
+  const m = masked.match(new RegExp(`${INTERP}(\\d+)${INTERP}`));
+  return m ? (interps[Number(m[1])] ?? masked) : masked;
+}
+
+interface ParsedToken {
+  kind: 'word' | 'flag' | 'positional';
+  text: string;
+  /** True when the token's runtime value is a module id. */
+  isModuleId: boolean;
+}
+
+/**
+ * One `celilo ...` occurrence: the tokens after the word `celilo`, plus
+ * whether a quote delimited it (strict).
+ */
+interface Span {
+  tokens: ParsedToken[];
+  strict: boolean;
+  raw: string;
+}
+
+const FLAG = /^--[a-z0-9][a-z0-9-]*/;
+const PLACEHOLDER = /^<[^<>\s]+>/;
+
+function tokenize(text: string): ParsedToken[] {
+  const tokens: ParsedToken[] = [];
+  let rest = text;
+  while (rest.length > 0) {
+    rest = rest.replace(/^[\s,;]+/, '');
+    if (rest.length === 0) break;
+    let m = rest.match(FLAG);
+    if (m) {
+      tokens.push({ kind: 'flag', text: m[0].slice(2), isModuleId: false });
+      rest = rest.slice(m[0].length);
+      continue;
+    }
+    m = rest.match(PLACEHOLDER);
+    if (m) {
+      tokens.push({ kind: 'positional', text: m[0], isModuleId: false });
+      rest = rest.slice(m[0].length);
+      continue;
+    }
+    m = rest.match(/^\u0000(\d+)\u0000/);
+    if (m) {
+      const expr = interps[Number(m[1])] ?? '';
+      rest = rest.slice(m[0].length);
+      // ANSI chrome (${ANSI.reset} and friends) renders as an escape code,
+      // not as a value the operator types.
+      if (/^ANSI\.\w+$/.test(expr.trim())) continue;
+      tokens.push({ kind: 'positional', text: expr, isModuleId: /\bmoduleId\b/.test(expr) });
+      continue;
+    }
+    m = rest.match(/^[a-z][a-z0-9-]*(?:\.\u0000\d+\u0000[a-z0-9-]*)*/);
+    if (m) {
+      // A word that carries an interpolation (a key built at runtime, like
+      // network.<zone>.subnet) is a value, never a subcommand.
+      const isInterp = m[0].includes(INTERP);
+      const isModuleId = isInterp
+        ? (m[0].match(/\u0000(\d+)\u0000/g) ?? []).some((mark) =>
+            /\bmoduleId\b/.test(interpText(mark)),
+          )
+        : false;
+      tokens.push({ kind: isInterp ? 'positional' : 'word', text: m[0], isModuleId });
+      rest = rest.slice(m[0].length);
+      continue;
+    }
+    break; // punctuation, a closing quote, prose — the command part is over
+  }
+  return tokens;
+}
+
+/** Extract every `celilo ` occurrence with its span, per the rules above. */
+function extractSpans(maskedLine: string): Span[] {
+  const spans: Span[] = [];
+  const re = /\bcelilo(?=\s)/g;
+  let m: RegExpExecArray | null = re.exec(maskedLine);
+  while (m !== null) {
+    const before = m.index > 0 ? maskedLine[m.index - 1] : '';
+    const delimiter = before === '`' || before === "'" || before === '"' ? before : null;
+    const start = m.index + 'celilo'.length;
+    let content: string;
+    let strict: boolean;
+    if (delimiter) {
+      const closer = maskedLine.indexOf(delimiter, start);
+      strict = true;
+      content = closer === -1 ? maskedLine.slice(start) : maskedLine.slice(start, closer);
+      if (closer !== -1) re.lastIndex = closer + 1;
+    } else {
+      strict = false;
+      content = maskedLine.slice(start);
+    }
+    const tokens = tokenize(content);
+    if (tokens.length > 0) spans.push({ tokens, strict, raw: content.trim() });
+    if (re.lastIndex <= m.index) re.lastIndex = start;
+    m = re.exec(maskedLine);
+  }
+  return spans;
+}
+
+function walkPath(tokens: ParsedToken[]): { path: CommandDef[]; rest: ParsedToken[] } {
+  const path: CommandDef[] = [];
+  let node: CommandDef | undefined = COMMANDS.find((c) => c.name === tokens[0]?.text);
+  if (!node) return { path, rest: tokens };
+  path.push(node);
+  let i = 1;
+  while (i < tokens.length && tokens[i].kind === 'word') {
+    const next: CommandDef | undefined = node.subcommands?.find((s) => s.name === tokens[i].text);
+    if (!next) break;
+    node = next;
+    path.push(next);
+    i++;
+  }
+  return { path, rest: tokens.slice(i) };
+}
+
+/** Which declared arg the i-th positional fills (variadic absorbs the tail). */
+function slotFor(args: ArgDef[], i: number): ArgDef | undefined {
+  const variadicIndex = args.findIndex((a) => a.variadic);
+  const fixed = variadicIndex === -1 ? args.length : variadicIndex;
+  if (i < fixed) return args[i];
+  return variadicIndex === -1 ? undefined : args[variadicIndex];
+}
+
+function validateSpan(span: Span): string[] {
+  const { path, rest } = walkPath(span.tokens);
+  if (path.length === 0) return []; // first word is not a command: prose about celilo
+
+  // A hint embedded in prose is only a prescription when everything after the
+  // command path is argument-shaped. Trailing plain words mean the sentence
+  // continues ("celilo system migrate` to apply pending migrations...").
+  if (!span.strict && rest.some((t) => t.kind === 'word')) return [];
+
+  const name = `celilo ${path.map((c) => c.name).join(' ')}`;
+  const leaf = path[path.length - 1];
+  const violations: string[] = [];
+
+  for (const t of rest.filter((t) => t.kind === 'word')) {
+    violations.push(`${name}: unknown command word '${t.text}'`);
+  }
+
+  const declaredFlags = new Set([...(leaf.flags ?? []).map((f) => f.name), 'help', 'h']);
+  for (const t of rest.filter((t) => t.kind === 'flag')) {
+    if (!declaredFlags.has(t.text)) {
+      violations.push(`${name}: flag --${t.text} is not declared in the command registry`);
+    }
+  }
+
+  const args = leaf.args ?? [];
+  const positionals = rest.filter((t) => t.kind === 'positional');
+  if (!args.some((a) => a.variadic) && positionals.length > args.length) {
+    violations.push(
+      `${name}: ${positionals.length} positional value(s) but only ${args.length} declared arg(s)`,
+    );
+  }
+  positionals.forEach((token, i) => {
+    const slot = slotFor(args, i);
+    if (!slot) return;
+    if (
+      token.isModuleId &&
+      slot.completion !== undefined &&
+      PATH_COMPLETIONS.has(slot.completion)
+    ) {
+      violations.push(
+        `${name}: module id '${token.text}' fills the '${slot.name}' slot, which takes a path (${slot.completion})`,
+      );
+    }
+  });
+
+  return violations;
+}
+
+describe('doctor remediation arrow gate (celilo#1308)', () => {
+  it('flags a module id passed into a path slot, even a variadic one', () => {
+    // Rule 7.6 anchor: the exact defect shape from #1308 (`module update
+    // <module-id>`), pinned synthetically so the rule cannot silently stop
+    // matching the registry.
+    maskInterpolations(''); // reset
+    interps.push('result.moduleId');
+    const violations = validateSpan({
+      tokens: tokenize(`module update ${INTERP}0${INTERP}`),
+      strict: true,
+      raw: 'module update ${result.moduleId}',
+    });
+    expect(violations.some((v) => v.includes('takes a path'))).toBe(true);
+  });
+
+  it('every command the doctor prescribes exists, with declared flags and fitting args', () => {
+    const violations: string[] = [];
+    let resolvedCount = 0;
+    const resolvedHeads = new Set<string>();
+
+    for (const file of SOURCES) {
+      const raw = readFileSync(file, 'utf8');
+      // Strip block comments and whole-line // comments so doc headers that
+      // mention commands historically are not prescribed commands now.
+      const stripped = raw.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+      const masked = maskInterpolations(stripped);
+      const shortFile = file.split('/').pop() ?? file;
+
+      for (const line of masked.split('\n')) {
+        for (const span of extractSpans(line)) {
+          const found = validateSpan(span);
+          if (found.length === 0 && span.strict) resolvedCount++;
+          for (const v of found) violations.push(`[${shortFile}] ${v}  (span: "${span.raw}")`);
+          const head = span.tokens
+            .slice(0, 2)
+            .map((t) => t.text)
+            .join(' ');
+          if (head) resolvedHeads.add(head);
+        }
+      }
+    }
+
+    // Reach floors. A scan that resolves nothing proves nothing.
+    expect(resolvedCount).toBeGreaterThanOrEqual(12);
+    for (const anchor of [
+      'system doctor',
+      'module verify',
+      'monitor add',
+      'events repair',
+      'system migrate',
+    ]) {
+      const found = [...resolvedHeads].some((h) => h.startsWith(anchor));
+      expect(found).toBe(true);
+    }
+
+    expect(violations).toEqual([]);
+  });
+});

package/src/cli/commands/system-doctor.test.ts

@@ -1,7 +1,8 @@
 import { describe, expect, test } from 'bun:test';
-import type { JailModeRecord } from '../../hooks/jail';
+import { type JailModeRecord, resolveJailPolicy } from '../../hooks/jail';
 import {
   type HookExecutionInput,
+  assembleHookExecutionSection,
   compareVersions,
   renderHookExecutionSection,
 } from './system-doctor';
@@ -61,9 +62,13 @@ describe('renderHookExecutionSection (hook-process-boundary task 4.6)', () => {
     renderHookExecutionSection({
       availability: { backend: 'bubblewrap' },
       policy: 'auto',
+      source: 'env',
+      envValue: 'auto',
+      configValue: undefined,
       record: jailedRecord,
       host: HOST,
       monitored: true,
+      exemptions: [],
       ...over,
     });
 
@@ -92,10 +97,31 @@ describe('renderHookExecutionSection (hook-process-boundary task 4.6)', () => {
     expect(r.failCount).toBe(0);
   });
 
-  test('CELILO_HOOK_JAIL=off is reported as the operator’s own act', () => {
-    const r = render({ policy: 'off', record: undefined });
-    expect(text(r)).toContain('CELILO_HOOK_JAIL=off');
-    expect(r.warnCount).toBe(1);
+  test('an off policy warns, and the reason claims no source of its own', () => {
+    // This test used to be named "CELILO_HOOK_JAIL=off is reported as the
+    // operator's own act" and asserted that string. It stopped being true when
+    // ce-rez7 made `off` the DEFAULT: on a host where nobody set anything, the
+    // doctor named a variable that was unset and an act nobody performed. The
+    // source belongs on the source line, which is rendered separately.
+    const fromDefault = render({
+      policy: 'off',
+      source: 'default',
+      envValue: undefined,
+      record: undefined,
+    });
+    expect(text(fromDefault)).toContain('hooks run unjailed');
+    expect(text(fromDefault)).toContain('policy default (off)');
+    expect(text(fromDefault)).not.toContain('CELILO_HOOK_JAIL=off');
+    expect(fromDefault.warnCount).toBe(1);
+
+    const fromEnv = render({
+      policy: 'off',
+      source: 'env',
+      envValue: 'off',
+      record: undefined,
+    });
+    expect(text(fromEnv)).toContain('policy from CELILO_HOOK_JAIL=off (environment override)');
+    expect(fromEnv.warnCount).toBe(1);
   });
 
   test('auto deferral on sandbox-exec reads as unjailed, not jailed (ce-29z)', () => {
@@ -115,7 +141,7 @@ describe('renderHookExecutionSection (hook-process-boundary task 4.6)', () => {
       availability: { backend: 'none', reason: 'the profile did not load' },
       record: undefined,
     });
-    expect(text(r)).toContain('CELILO_HOOK_JAIL=required and no jail is available');
+    expect(text(r)).toContain("the hook jail policy is 'required' and no jail is available");
     expect(r.failCount).toBe(1);
   });
 
@@ -153,4 +179,115 @@ describe('renderHookExecutionSection (hook-process-boundary task 4.6)', () => {
     expect(text(r)).toContain('belongs to host "old-box"');
     expect(r.failCount).toBe(0);
   });
+
+  test('the source line names the environment when the env var won (D4)', () => {
+    const r = render({
+      policy: 'off',
+      source: 'env',
+      envValue: 'off',
+      record: undefined,
+    });
+    expect(text(r)).toContain('policy from CELILO_HOOK_JAIL=off (environment override)');
+  });
+
+  test('the source line names system config when the stored key won (D4)', () => {
+    const r = render({
+      policy: 'required',
+      source: 'config',
+      configValue: 'required',
+      record: undefined,
+    });
+    expect(text(r)).toContain('policy from system config (hooks.jail_policy)');
+    expect(text(r)).not.toContain('policy from CELILO_HOOK_JAIL');
+  });
+
+  test('the source line names the default and how to change it (D4)', () => {
+    // Ask the resolver what the default IS rather than naming it. The literal
+    // that stood here said `auto`, and it kept passing after ce-rez7 flipped
+    // the default to `off`, because it rendered a { policy, source } pair the
+    // resolver can no longer produce. A correct assertion about a state that
+    // never arrives.
+    const fallback = resolveJailPolicy(undefined, undefined, undefined);
+    const r = render({
+      policy: fallback.policy,
+      source: fallback.source,
+      envValue: undefined,
+      record: undefined,
+    });
+    expect(fallback.source).toBe('default');
+    expect(text(r)).toContain(
+      `policy default (${fallback.policy}) — set hooks.jail_policy or CELILO_HOOK_JAIL to change`,
+    );
+  });
+
+  test('env and config disagreeing renders the losing value (D4)', () => {
+    const r = render({
+      policy: 'required',
+      source: 'env',
+      envValue: 'required',
+      configValue: 'off',
+      record: undefined,
+    });
+    expect(text(r)).toContain(
+      "system config holds 'off' but CELILO_HOOK_JAIL='required' overrides it",
+    );
+  });
+
+  test('env and config agreeing renders no disagreement line (D4)', () => {
+    const r = render({
+      policy: 'off',
+      source: 'env',
+      envValue: 'off',
+      configValue: 'off',
+      record: undefined,
+    });
+    expect(text(r)).not.toContain('system config holds');
+  });
+
+  test('a bad stored row renders as a failing check naming the row, not a crash', () => {
+    const r = assembleHookExecutionSection({
+      envValue: () => undefined,
+      configValue: () => 'alwayssafe',
+      availability: () => ({ backend: 'bubblewrap' }),
+      record: () => undefined,
+      host: () => HOST,
+      monitored: () => true,
+      exemptions: () => [],
+    });
+    expect(r.lines[0]).toBe('Hook execution');
+    expect(r.lines[1]).toContain("hooks.jail_policy='alwayssafe' is not a hook jail policy");
+    expect(r.failCount).toBe(1);
+    expect(r.warnCount).toBe(0);
+  });
+
+  test('an exemption is counted and named (per-module-jail-policy task 3.2)', () => {
+    const r = render({
+      exemptions: [
+        { moduleId: 'caddy', policy: 'off', systemPolicy: 'auto' },
+        { moduleId: 'vault', policy: 'auto', systemPolicy: 'auto' },
+      ],
+    });
+    expect(text(r)).toContain("2 modules run under a weaker jail policy than the system's");
+    expect(text(r)).toContain('caddy (off)');
+    expect(text(r)).toContain('vault (auto)');
+    expect(r.warnCount).toBe(1);
+  });
+
+  test('one exemption reads as singular', () => {
+    const r = render({
+      exemptions: [{ moduleId: 'caddy', policy: 'off', systemPolicy: 'auto' }],
+    });
+    expect(text(r)).toContain('1 module runs under a weaker jail policy');
+    expect(text(r)).not.toContain('modules run');
+  });
+
+  test('no exemptions render no exemption line (per-module-jail-policy task 3.4)', () => {
+    // The negative half: a surface that reports an exemption nobody set is
+    // as bad as one that hides a real one. With no rows the section must be
+    // word-for-word what it was before this slice.
+    const r = render({});
+    expect(text(r)).not.toContain('weaker jail policy');
+    expect(text(r)).not.toContain('exempt');
+    expect(r.warnCount).toBe(0);
+  });
 });